Request 1973 (accepted)

aircrack-ng.changes Changed

@@ -1,4 +1,37 @@
 -------------------------------------------------------------------
+Sat Jun  6 06:10:28 UTC 2015 - mailaender@opensuse.org
+
+- update to 1.2-rc2
+  * Airtun-ng: Adds WPA CCMP and TKIP decryption and CCMP encryption
+  * Compilation: Added support for DUMA.
+  * Makefile: Renamed 'unstable' to 'experimental'.
+  * Airodump-ng: Fixed XML sanitizing.
+  * Airmon-ng: Airmon-zc is now stable enough to replace airmon-ng.
+  * Manpages: Removed airdriver-ng manpage and references to it (forgot to do it before the previous release).
+  * Manpages: Updated 'see also' references in all manpages.
+  * PCRE: Added it in various places and docs.
+  * WZCook: Fixed processing values stored in register.
+  * Updated a few headers files (if_llc, ieee80211, ethernet and if_arp).
+  * Compilation: de-hardcode -lpcap to allow specifying pcap libraries.
+  * Makefile: Fixed installing/uninstalling Airdrop-ng documentation files.
+  * Makefile: Fixed uninstalling ext_scripts.
+  * Airodump-ng: Added new paths (and removed one) for OUI files and simplified logic to find the OUI file.
+  * Aircrack-ng: Fixed ignoring -p when specified after -S.
+  * Airmon-ng: fixes for openwrt busybox ps/grep issues which do not seem present in other versions of busybox
+  * Airmon-ng: fix vm detection.
+  * Airserv-ng: Fixed channel setting (and assert call).
+  * Airodump-ng: Fixes to NetXML (unassociated clients missing and various other small bugs) and update the code to match current NetXML output.
+  * Airodump-ng: Removed requirement for 2 packets before AP is written to output (text) files.
+  * Airodump-ng: Fixed formatting of ESSID and display of WPA/WPA2 (as well as a bunch of other small fixes) in CSV file.
+  * Airodump-ng: Fixed GPSd.
+  * Airodump-ng: Allow to specify write interval for CSV, kismet CSV and NetXML files.
+  * Airserv-ng: Fixed wrong station data displayed in Airodump-ng.
+  * General: Fixed 64 bit promotion issues.
+  * General: Fixed a bunch of uninitialized values and non-zeroed structures (upon allocating them).
+  * General: Added Stack protection.
+  * Various other small fixes and improvements
+
+-------------------------------------------------------------------
 Thu Nov 13 10:57:39 UTC 2014 - p.seiler@linuxmail.org
 
 - update to 1.2-rc1

aircrack-ng.spec Changed

@@ -2,7 +2,7 @@
 #
 # spec file for package aircrack-ng
 #
-# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,20 +19,17 @@
 
 %bcond_without unstable
 %bcond_without sqlite
-%define pkg_version 1.2-rc1
+%define pkg_version 1.2-rc2
 
 Name:           aircrack-ng
-Version:        1.2.rc1
+Version:        1.2.rc2
 Release:        0
 License:        GPL-2.0
 Summary:        A set of tools for auditing wireless networks
 Url:            http://www.aircrack-ng.org/
 Group:          Productivity/Networking/Security
-# no source because of legal problems in Germany where mirrors are located
-# marguerite: still valid? 
-Source:        http://download.aircrack-ng.org/%{name}-%{pkg_version}.tar.gz
+Source0:        http://download.aircrack-ng.org/%{name}-%{pkg_version}.tar.gz
 Source1:        README.SUSE
-Patch:         aircrack-ng-1.2-remove_usr_local.patch
 BuildRequires:  gcc-c++
 BuildRequires:	libgcrypt-devel
 %if 0%{?suse_version} <= 1140
@@ -44,7 +41,7 @@
 BuildRequires:  pkg-config
 BuildRequires:	sqlite3-devel
 BuildRequires:	zlib-devel
-Requires:	wireless-tools
+Requires:	    wireless-tools
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -60,14 +57,13 @@
 %setup -q -n aircrack-ng-%{pkg_version}
 find patches/ -type f -exec sed -i 's|\r||g' {} \;
 cp "%{SOURCE1}" .
-%patch -p1
 
 %build
 CFLAGS="%{optflags} -Wall" \
 make \
         %{?_smp_mflags} \
         SQLITE=%{?with_sqlite:true}%{?!with_sqlite:false} \
-        UNSTABLE=%{?with_unstable:true}%{?!with_unstable:false} \
+        EXPERIMENTAL=%{?with_unstable:true}%{?!with_unstable:false} \
 	    gcrypt=true \
 	    libnl=true \
         prefix="%{_prefix}" \
@@ -77,7 +73,7 @@
 %install
 %makeinstall \
         SQLITE=%{?with_sqlite:true}%{?!with_sqlite:false} \
-        UNSTABLE=%{?with_unstable:true}%{?!with_unstable:false} \
+        EXPERIMENTAL=%{?with_unstable:true}%{?!with_unstable:false} \
         ext_scripts=true \
 	    gcrypt=true \
 	    libnl=true \
@@ -92,7 +88,7 @@
 
 %files
 %defattr(-,root,root)
-%doc AUTHORS ChangeLog LICENSE LICENSE.OpenSSL README README.md README.SUSE
+%doc AUTHORS ChangeLog LICENSE LICENSE.OpenSSL README README.SUSE
 %doc patches
 %{_bindir}/aircrack-ng
 %{_bindir}/airdecap-ng
@@ -106,7 +102,6 @@
 %{_sbindir}/airbase-ng
 %{_sbindir}/aireplay-ng
 %{_sbindir}/airmon-ng
-%{_sbindir}/airmon-zc
 %{_sbindir}/airodump-ng
 %{_sbindir}/airodump-ng-oui-update
 %{_sbindir}/airserv-ng

aircrack-ng-1.2-remove_usr_local.patch Deleted

@@ -1,39 +0,0 @@
---- aircrack-ng-1.2-rc1/src/Makefile.orig	2014-06-08 21:03:52.000000000 +0200
-+++ aircrack-ng-1.2-rc1/src/Makefile	2014-11-12 19:55:39.873329731 +0100
-@@ -101,7 +101,7 @@ endif
- 
- 
- ifeq ($(subst TRUE,true,$(filter TRUE true,$(sqlite) $(SQLITE))),true)
--	LIBSQL		= -L/usr/local/lib -lsqlite3
-+	LIBSQL		= -lsqlite3
- else
- 	LIBSQL		=
- endif
---- aircrack-ng-1.2-rc1/src/osdep/linux.c.orig	2014-07-12 04:24:03.000000000 +0200
-+++ aircrack-ng-1.2-rc1/src/osdep/linux.c	2014-11-12 19:56:11.137758873 +0100
-@@ -253,10 +253,8 @@ static char * wiToolsPath(const char * t
-         static const char * paths [] = {
-                 "/sbin",
-                 "/usr/sbin",
--                "/usr/local/sbin",
-                 "/bin",
-                 "/usr/bin",
--                "/usr/local/bin",
-                 "/tmp"
-         };
-     /*
---- aircrack-ng-1.2-rc1/scripts/airoscript-ng/src/plugins/yad.orig	2014-04-07 20:03:58.000000000 +0200
-+++ aircrack-ng-1.2-rc1/scripts/airoscript-ng/src/plugins/yad	2014-11-12 20:00:18.200167747 +0100
-@@ -26,10 +26,10 @@ mkmenuline(){ return; }
- mkmenueline(){ return; }
- 
- mkmenu(){ title=$1; shift; declare -a res; args=("${@}"); for i in ${!args[@]}; do res+=( "$i" "${args[$i]}" ); done ;
--	choice=$(yad --class="airoscript-ng" --window-icon="/usr/local/share/pixmaps/airoscript-ng.png" --separator=" " --list --width=450 --height=250 --title="$title" --text "Select an action:" --column=" " --column="n" --no-headers=1 "${res[@]}" --print-column=1;)
-+	choice=$(yad --class="airoscript-ng" --window-icon="/usr/share/pixmaps/airoscript-ng.png" --separator=" " --list --width=450 --height=250 --title="$title" --text "Select an action:" --column=" " --column="n" --no-headers=1 "${res[@]}" --print-column=1;)
-     [[ $? == 1 ]] && [[ $title == "Main Menu" ]] && exit
- }
- selectap_wrapper(){
--choice=$(yad --class="airoscript-ng" --window-icon="/usr/local/cal/share/pixmaps/airoscript-ng.png" --separator=" " --list --width=450 --height=250 --title="$title" --text "Select an action:" --column "position" --column "MAC" --column "Channel" --column "Privacy" --column "POWER" --column "LENGHT" --column "ESSID" --hide-column=1 "${res[@]}" --print-column=1;)
-+choice=$(yad --class="airoscript-ng" --window-icon="/usr/cal/share/pixmaps/airoscript-ng.png" --separator=" " --list --width=450 --height=250 --title="$title" --text "Select an action:" --column "position" --column "MAC" --column "Channel" --column "Privacy" --column "POWER" --column "LENGHT" --column "ESSID" --hide-column=1 "${res[@]}" --print-column=1;)
- }
- launch_counter(){  ( for i in $( seq 1 $1 ); do a=$(( ($i * 100) / $1 )); sleep 1; echo "$a"; done ) | zenity --text "Scanning for targets" --progress --auto-close --title="Scanning for targets"; }

aircrack-ng-1.2-rc1.tar.gz/.gitignore Deleted

aircrack-ng-1.2-rc1.tar.gz/.travis.yml Deleted

aircrack-ng-1.2-rc1.tar.gz/README.md Deleted

@@ -1,115 +0,0 @@
-# Aircrack-ng
-Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover
-keys once enough data packets have been captured. It implements the standard FMS
-attack along with some optimizations like KoreK attacks, as well as the
-all-new PTW attack, thus making the attack much faster compared to other WEP
-cracking tools.
-
-It can attack WPA1/2 networks with some advanced methods or simply by brute force.
-It can also fully use a multiprocessor system to its full power in order
-to speed up the cracking process.
-
-
-[![Build Status](https://api.travis-ci.org/aircrack-ng/aircrack-ng.png)](https://travis-ci.org/aircrack-ng/aircrack-ng)
-
-
-# Building
-
-## Requirements
-
- * OpenSSL development package or libgcrypt development package
- * If you want to use `airolib-ng` and `-r` option in aircrack-ng,
-   SQLite development package `>= 3.3.17` (3.6.X version or better is recommended):
-   `libsqlite3-devel`
- * On windows, cygwin has to be used and it also requires w32api and gcc-4 package.
- * If you want to use Airpcap, the 'developer' directory from the CD is required.
-
-## Compilating
-
- * Compilation:
-
-    `make`
-
- * Strip debugging symbols:
-
-    `make strip`
-
- * Installing:
-
-    `make install`
-
- * Uninstall:
-
-    `make uninstall`
-
-
-###  Makefile flags
-
-When compile and installing, the following flags can be used and combined
-to compile and install the suite:
-
-* **sqlite**:   needed to compile `airolib-ng` and add support for `airolib-ng`
-                databases in aircrack-ng.
-                On cygwin: SQLite has to be compiled manually. See next section.
-
-* **airpcap**:  needed for supporting airpcap devices on windows (cygwin only)
-                REQUIREMENT: Copy 'developers' directory from Airpcap CD one 
-                level below this INSTALLING file
-                Note: Not working yet.
-
-* **unstable**: needed to compile `tkiptun-ng`, `easside-ng` (and `buddy-ng`) and
-                `wesside-ng`
-
-* **ext_scripts**: needed to build `airoscript-ng`, `versuck-ng`, `airgraph-ng` and 
-                   `airdrop-ng`. 
-                   Note: Experimental. Each script has its own dependences.
-                   Note: It's only required in install phase.
-
-* **gcrypt**:   Use libgcrypt crypto library instead of the default OpenSSL.
-                And also use internal fast sha1 implementation (borrowed from GIT)
-
-* **libnl**:    Add support for netlink (nl80211). Linux only.
-    - Requires `libnl1` OR `libnl3`.
-    - Dependencies (debian):
-        +  LibNL 1: `libnl-dev`
-        + LibNL 3: `libnl-3-dev` and `libnl-genl-3-dev`.
-
-#### Examples:
-
-  * Compiling with sqlite and enabling unstable:
-
-    `make sqlite=true unstable=true`
-
-  * Installing:
-
-    `make sqlite=true unstable=true install`
-
-  * Installing, with external scripts:
-
-    `make sqlite=true unstable=true ext_scripts=true`
-
-  * Compiling with gcrypt:
-
-    `make gcrypt=true`
-
-
-# Using precompiled binaries
-
-Linux/BSD:
- * Use your package manager to download aircrack-ng
- * In most cases, they have an old version.
-
-Windows:
- * Install the appropriate "monitor" driver for your card (standard drivers doesn't work for capturing data).
- * aircrack-ng suite is command line tools. So, you have to open a commandline
-   `Start menu -> Run... -> cmd.exe` then use them
- * Run the executables without any parameters to have help
-
-# Documentation
-
-
-Documentation, tutorials, ... can be found on http://www.aircrack-ng.org
-
-See also manpages and the forum.
-
-For further information check the [README](README) file

aircrack-ng-1.2-rc1.tar.gz/manpages/airdriver-ng.8 Deleted

@@ -1,92 +0,0 @@
-.TH AIRDRIVER-NG 8 "October 2014" "Version 1.2-rc1"
-
-.SH NAME
-airdriver-ng - automatically install/uninstall and patch drivers and 802.11 stacks
-.SH SYNOPSIS
-.B airdriver-ng
-<command> [drivernumber]
-.SH DESCRIPTION
-.BI airdriver-ng
-is a script that provides status information about the wireless drivers on your system plus the ability to load and unload the drivers. Additionally, airdriver-ng allows you to install and uninstall drivers complete with the patches required for monitor and injection modes. Plus a number of other functions.
-.SH COMMAND
-.PP
-.TP
-.I supported
-Lists all supported drivers
-.TP
-.I kernel
-Lists all in-kernel drivers
-.TP
-.I installed
-Lists all installed drivers
-.TP
-.I loaded
-Lists all loaded drivers
-.TP
-.I load <drivernum>
-Loads a driver
-.TP
-.I unload <drivernum>
-Unloads a driver
-.TP
-.I reload <drivernum>
-Reloads a driver
-.TP
-.I install <drivernum>
-Installs a driver
-.TP
-.I remove <drivernum>
-Removes a driver
-.TP
-.I remove_stack <num>
-Removes a stack
-.TP
-.I install_stack <num>
-Installs a stack
-.TP
-.I details <drivernum>
-Prints driver details
-.TP
-.I detect
-Detects wireless cards
-.SH AUTHOR
-This manual page was written by Thomas d\(aqOtreppe.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-.SH SEE ALSO
-.br
-.B airbase-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B aireplay-ng(8)
-.br
-.B airmon-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airolib-ng(1)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B buddy-ng(1)
-.br
-.B easside-ng(8)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)

aircrack-ng-1.2-rc1.tar.gz/manpages/airmon-zc.8 Deleted

@@ -1,68 +0,0 @@
-.TH AIRMON-ZC 8 "October 2014" "Version 1.2-rc1"
-
-.SH NAME
-airmon-zc - bash script designed to turn wireless cards into monitor mode, Zero_Chaos version
-.SH SYNOPSIS
-.B airmon-zc
-<start|stop> <interface> [channel]
-.B airmon-zc
-<check> [kill]
-.SH DESCRIPTION
-.BI airmon-zc
-is script can be used to enable monitor mode on wireless interfaces. It may also be used to go back from monitor mode to managed mode. Entering the airmon-zc command without parameters will show the interfaces status. 
-It can list/kill programs that can interfere with the wireless card and set the right sources in /etc/kismet/kismet.conf too.
-.SH OPTIONAL PARAMETERS
-.PP
-.TP
-.I start <interface> [channel]
-Enable monitor mode on an interface (and specify a channel). Note: Madwifi-ng is a special case, \(aqstart\(aq has to be used on wifi interfaces and \(aqstop\(aq on ath interfaces.
-.I stop <interface>
-Disable monitor mode and go back to managed mode (except for madwifi-ng where it kills the ath VAP).
-.TP
-.I check [kill]
-List all possible programs that could interfere with the wireless card. If \(aqkill\(aq is specified, it will try to kill all of them.
-.SH AUTHOR
-This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
-And modified to fit airmon-zc by David Francos Cuartero <xayon@xayon.net>.
-Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
-On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
-
-.SH SEE ALSO
-.br
-.B airmon-ng(8)
-.br
-.B airbase-ng(8)
-.br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airdriver-ng(8)
-.br
-.B aireplay-ng(8)
-.br
-.B airodump-ng(8)
-.br
-.B airolib-ng(1)
-.br
-.B airserv-ng(8)
-.br
-.B airtun-ng(8)
-.br
-.B buddy-ng(1)
-.br
-.B easside-ng(8)
-.br
-.B ivstools(1)
-.br
-.B kstats(1)
-.br
-.B makeivs-ng(1)
-.br
-.B packetforge-ng(1)
-.br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)

aircrack-ng-1.2-rc1.tar.gz/scripts/airmon-zc Deleted

@@ -1,1154 +0,0 @@
-#!/bin/sh
-DEBUG="0"
-VERBOSE="0"
-ELITE="0"
-USERID=""
-IFACE=""
-MAC80211=0
-IW_SOURCE="https://www.kernel.org/pub/software/network/iw/iw-3.11.tar.bz2"
-IW_ERROR=""
-UDEV_ISSUE=0
-SYSFS=0
-if [ -d /sys/ ]
-then
-	SYSFS=1
-fi
-
-if [ "${1}" = "--elite" ]
-then
-	shift
-	ELITE="1"
-fi
-
-if [ "${1}" = "--verbose" ]
-then
-	shift
-	VERBOSE="1"
-fi
-
-if [ "${1}" = "--debug" ]
-then
-	shift
-	DEBUG="1"
-	VERBOSE="1"
-fi
-
-#yes, I know this is in here twice
-if [ "${1}" = "--elite" ]
-then
-	shift
-	ELITE="1"
-fi
-
-
-CH=${3}; [ x${3} = "x" ] && CH=10
-
-#TODO LIST
-
-#cleanup getDriver()
-#fix to not assume wifi drivers are modules
-
-if [ x"$(command -v id 2> /dev/null)" != "x" ]
-then
-	USERID="$(id -u 2> /dev/null)"
-fi
-
-if [ x${USERID} = "x" -a x${UID} != "x" ]
-then
-	USERID=${UID}
-fi
-
-if [ x${USERID} != "x" -a x${USERID} != "x0" ]
-then
-	printf "Run it as root\n" ; exit 1;
-fi
-
-#check for all needed binaries
-if [ ! -x "$(command -v uname 2>&1)" ]
-then
-	printf "How in the world do you not have uname installed?\n"
-	printf "Please select a linux distro which has at least basic functionality (or install uname).\n"
-	exit 1
-#else
-#	#write something in here to test uname for Darwin/Linux and set a variable
-fi
-
-if [ ! -x "$(command -v ip 2>&1)" ] && [ ! -x "$(command -v ifconfig 2>&1)" ]
-then
-	printf "You have neither ip (iproute2) nor ifconfig installed.\n"
-	printf "Please install one of them from your distro's package manager.\n"
-	exit 1
-fi
-
-if [ ! -x "$(command -v iw 2>&1)" ]
-then
-	printf "You don't have iw installed, please install it from your distro's package manager.\n"
-	printf "If your distro doesn't have a recent version you can download it from this link:\n"
-	printf "${IW_SOURCE}\n"
-	exit 1
-fi
-
-if [ ! -x "$(command -v ethtool 2>&1)" ]
-then
-	printf "Please install the ethtool package for your distro.\n"
-	exit 1
-fi
-
-if [ ! -x "$(command -v lsusb 2>&1)" ]
-then
-	printf "Please install lsusb from your distro's package manager.\n"
-	exit 1
-fi
-
-if [ -d /proc/bus/pci ]
-then
-	if [ ! -x "$(command -v lspci 2>&1)" ]
-	then
-		printf "Please install lspci from your distro's package manager.\n"
-		exit 1
-	else
-		LSPCI=1
-	fi
-else
-	LSPCI=0
-fi
-
-if [ -f /proc/modules ]
-then
-	if [ ! -x "$(command -v modprobe 2>&1)" ]
-	then
-		printf "Your kernel has module support but you don't have modprobe installed.\n"
-		printf "It is highly recommended to install modprobe (typically from kmod).\n"
-		MODPROBE=0
-	else
-		MODPROBE=1
-	fi
-	if [ ! -x "$(command -v modinfo 2>&1)" ]
-	then
-		printf "Your kernel has module support but you don't have modinfo installed.\n"
-		printf "It is highly recommended to install modinfo (typically from kmod).\n"
-		printf "Warning: driver detection without modinfo may yield inaccurate results.\n"
-		MODINFO=0
-	else
-		MODINFO=1
-	fi
-fi
-
-if [ ! -x "$(command -v awk 2>&1)" ]
-then
-	printf "How in the world do you not have awk installed?\n"
-	printf "Please select a linux distro which has at least basic functionality (or install awk).\n"
-	exit 1
-fi
-
-if [ ! -x "$(command -v grep 2>&1)" ]
-then
-	printf "How in the world do you not have grep installed?\n"
-	printf "Please select a linux distro which has at least basic functionality (or install grep).\n"
-	exit 1
-fi
-#done checking for binaries
-
-usage() {
-	printf "usage: $(basename $0) <start|stop|check> <interface> [channel or frequency]\n\n"
-	exit
-}
-
-setLink() {
-	if [ -x "$(command -v ip 2>&1)" ]
-	then
-		ip link set dev ${1} ${2} || printf "Failed to set ${1} ${2} using ip"
-	elif [ -x "$(command -v ifconfig 2>&1)" ]
-	then
-		ifconfig ${1} ${2} || printf "Failed to set ${1} ${2} using ifconfig"
-	fi
-	return
-}
-
-ifaceIsUp() {
-	if [ -x "$(command -v ip 2>&1)" ]
-	then
-		ifaceIsUpCmd="ip link show dev"
-	elif [ -x "$(command -v ifconfig 2>&1)" ]
-	then
-		ifaceIsUpCmd="ifconfig"
-	fi
-	if ${ifaceIsUpCmd} ${1} | grep -q UP
-	then
-		return
-	else
-		return 1
-	fi
-}
-
-listIfaceUnspec() {
-	if [ -x "$(command -v ip 2>&1)" ]
-	then
-		ip link 2>/dev/null | awk -F"[: ]+" '/UNSPEC/ {print $2}'
-	elif [ -x "$(command -v ifconfig 2>&1)" ]
-	then
-		ifconfig -a 2>/dev/null | awk -F"[: ]+" '/UNSPEC/ {print $1}'
-	fi
-}
-
-startDeprecatedIface() {
-	iwconfig ${1} mode monitor > /dev/null 2>&1
-	if [ ! -z ${2} ]
-	then
-		if [ ${2} -lt 1000 ]
-		then
-			iwconfig ${1} channel ${2} > /dev/null 2>&1
-		else
-			iwconfig ${1} freq ${2}000000 > /dev/null 2>&1
-		fi
-	else
-		iwconfig ${1} channel ${CH} > /dev/null 2>&1
-	fi
-	iwconfig ${1} key off > /dev/null 2>&1
-	setLink ${1} up
-	printf " (monitor mode enabled)"
-}
-
-startMac80211Iface() {
-	#check if $1 already has a mon interface on the same phy and bail if it does
-	if [ -d /sys/class/ieee80211/${PHYDEV}/device/net ]
-	then
-		for i in $(ls /sys/class/ieee80211/${PHYDEV}/device/net/)
-		do
-			if [ "$(cat /sys/class/ieee80211/${PHYDEV}/device/net/${i}/type)" = "803" ]
-			then
-				setChannelMac80211 ${1}
-				printf "\n\t\t(mac80211 monitor mode already enabled for [${PHYDEV}]${1} on [${PHYDEV}]${i})\n"
-				exit
-			fi
-		done
-	fi
-	#we didn't bail means we need a monitor interface
-	if [ -e /sys/class/net/${1}mon ]
-	then
-		printf "\nYou already have a ${1}mon device but it is NOT in monitor mode."
-		printf "\nWhatever you did, don't do it again."
-		printf "\nPlease run \"iw ${1}mon del\" before attempting to continue\n"
-		exit 1
-	fi
-	#we didn't bail means our target interface is available
-	setLink ${1} down
-	IW_ERROR=$(iw phy ${PHYDEV} interface add ${1}mon type monitor 2>&1 | grep "nl80211 not found")
-	if [ x${IW_ERROR} = "x" ]
-	then
-		sleep 1s
-		setChannelMac80211 ${1}mon
-		printf "\n\t\t(mac80211 monitor mode vif enabled for [${PHYDEV}]${1} on [${PHYDEV}]${1}mon)\n"
-	else
-		printf "\n\nERROR: something went wrong with iw."
-	fi
-	if [ ${ELITE} = "1" ]
-	then
-		#check if $1 is still down, warn if not
-		if ifaceIsUp ${1}
-		then
-			printf "\nInterface ${1} is up, but it should be down. Something is interferring."
-			printf "\nPlease run \"airmon-zc check kill\" and/or kill your network manager."
-		fi
-	else
-		iw ${1} del
-		printf "\t\t(mac80211 station mode vif disabled for [${PHYDEV}]${1})\n"
-	fi
-}
-
-startDarwinIface() {
-	if [ -x /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport ]
-	then
-		/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport $1 sniff
-	fi
-}
-
-setChannelMac80211() {
-	setLink ${1} up
-	if [ ! -z ${3} ]
-	then
-		if [ ${3} -lt 1000 ]
-		then
-			iw dev ${1} set channel ${3}
-		else
-			iw dev ${1} set freq "${3}"
-		fi
-	else
-		iw dev ${1} set channel ${CH}
-	fi
-}
-
-stopDeprecatedIface() {
-	setLink $1 down
-	iwconfig $1 mode Managed > /dev/null 2>&1
-	setLink $1 up
-	printf " (monitor mode disabled)"
-}
-
-stopMac80211Iface() {
-	if [ -f /sys/class/net/${1}/type ]
-	then
-		if [ "$(cat /sys/class/net/${1}/type)" != "803" ]
-		then
-			printf "\n\nYou are trying to stop a device that isn't in monitor mode.\n"
-			printf "Doing so is a terrible idea, if you really want to do it then you\n"
-			printf "need to type 'iw ${1} del' yourself since it is a terrible idea.\n"
-			printf "Most likely you want to remove an interface called wlan[0-9]mon\n"
-			printf "If you feel you have reached this warning in error,\n"
-			printf "please report it."
-			exit 1
-		else
-			if [ "${ELITE}" = "0" ]
-			then
-				#check if $1 already has a sta interface on the same phy and bail if it does
-				if [ -d /sys/class/ieee80211/${PHYDEV}/device/net ]
-				then
-					for i in $(ls /sys/class/ieee80211/${PHYDEV}/device/net/)
-					do
-						if [ "$(cat /sys/class/ieee80211/${PHYDEV}/device/net/${i}/type)" = "1" ]
-						then
-							printf "\n\t\t(mac80211 station mode vif already available for [${PHYDEV}]${1} on [${PHYDEV}]${i})\n"
-							exit
-						fi
-					done
-				fi
-				if [ -e /sys/class/net/${1%mon} ]
-				then
-					printf "\nYou already have a ${1%mon} device but it is NOT in station mode."
-					printf "\nWhatever you did, don't do it again."
-					printf "\nPlease run \"iw ${1%mon} del\" before attempting to continue\n"
-					exit 1
-				fi
-				IW_ERROR=$(iw phy ${PHYDEV} interface add ${1%mon} type station 2>&1)
-				if [ x${IW_ERROR} = "x" ]
-				then
-					printf "\n\t\t(mac80211 station mode vif enabled on [${PHYDEV}]${1%mon})"
-					unset IW_ERROR
-				else
-					printf "\n\n ERROR: iw command error"
-				fi
-			fi
-			IW_ERROR=$(iw dev "${1}" del 2>&1 | grep "nl80211 not found")
-			if [ x$IW_ERROR = "x" ]
-			then
-				printf "\n\t\t(mac80211 monitor mode vif disabled for [${PHYDEV}]${1})"
-			else
-				if [ -f /sys/class/ieee80211/"${PHYDEV}"/remove_iface ]
-				then
-					printf "${1}" > /sys/class/ieee80211/"${PHYDEV}"/remove_iface
-					printf "\n\t\t(mac80211 monitor mode vif disabled for [${PHYDEV}]${1})"
-				else
-					printf "\n\nERROR: Neither the sysfs interface links nor the iw command is available.\nPlease download and install iw from\n$IW_SOURCE\n"
-				fi
-			fi
-		fi
-	fi
-}
-
-getDriver() {
-	#standard detection path, this is all that is needed for proper drivers
-	#DRIVER=$(printf "$ethtool_output" | awk '/driver/ {print $2}')
-
-	#if $(modinfo -n ${DRIVER} > /dev/null 2>&1)
-	#then
-	#	true
-	#else
-	#	unset DRIVER
-	#fi
-
-	#if [ "$DRIVER" = "" ]
-	#then
-		if [ -f /sys/class/net/$1/device/uevent ]
-		then
-			DRIVER="$(awk -F'=' '$1 == "DRIVER" {print $2}' /sys/class/net/$1/device/uevent)"
-		else
-			#DRIVER we put SOMETHING in DRIVER here if we are unable to find anything real
-			DRIVER="??????"
-		fi
-	#fi
-
-	#here we test for driver usb, ath9k_htc,rt2870, possibly others show this
-	if [ "$DRIVER" = "usb" ]
-	then
-		echo "Warn ON: USB"
-		BUSADDR="$(printf "$ethtool_output" | awk '/bus-info/ {print $2}'):1.0"
-
-		if [ "$DEBUG" = "1" ]
-		then
-			printf "${BUSADDR}\n"
-
-		fi
-
-		if [ "$BUSADDR" != "" ]
-		then
-			if [ -f /sys/class/net/$1/device/$BUSADDR/uevent ]
-			then
-				DRIVER="$(awk -F'=' '$1 == "DRIVER" {print $2}' /sys/class/net/$1/device/$BUSADDR/uevent)"
-			fi
-		fi
-
-		#here we can normalize driver names we don't like
-		if [ "$DRIVER" = "rt2870" ]
-		then
-			DRIVER="rt2870sta"
-		fi
-		if [ -f /sys/class/net/$1/device/idProduct ]
-		then
-			if [ $(cat /sys/class/net/$1/device/idProduct) = "3070" ]
-			then
-				DRIVER="rt3070sta"
-			fi
-		fi
-	fi
-	if [ "$DRIVER" = "rtl8187L" ]
-	then
-		DRIVER="r8187l"
-	fi
-	if [ "$DRIVER" = "rtl8187" ] && [ "$STACK" = "ieee80211" ]
-	then
-		DRIVER="r8187"
-	fi
-
-	#Here we will catch the broken lying drivers not caught above
-	#currently this only functions for pci devices and not usb since lsusb has no -k option
-	if [ "${MODINFO}" = 1 ]
-	then
-		if $(modinfo -n $DRIVER  > /dev/null 2>&1)
-		then
-			true
-		else
-			if [ "${DEVICEID}" != "" ] && [ "$BUS" = "pci" ]
-			then
-				DRIVER="$(lspci -d $DEVICEID -k | awk '/modules/ {print $3}')"
-			fi
-			if [ "$DRIVER" = "" ]
-			then
-				DRIVER="??????"
-			fi
-		fi
-	fi
-	if [ "$DEBUG" = "1" ]
-	then
-		printf "getdriver() $DRIVER\n"
-	fi
-}
-
-getFrom() {
-	#from detection
-	FROM="K"
-	if [ "${MODINFO}" = 1 ] && [ -f /proc/modules ]
-	then
-		if [ $(modinfo -n $DRIVER 2>&1 | grep 'kernel/drivers') ]
-		then
-			FROM="K"
-			#we add special handling here because we hate the vendor drivers AND they install in the wrong place
-			if [ "$DRIVER" = "r8187" ]
-			then
-				FROM="V"
-			elif [ "$DRIVER" = "r8187l" ]
-			then
-				FROM="V"
-			elif [ "$DRIVER" = "rt5390sta" ]
-			then
-				FROM="V"
-			fi
-		elif [ $(modinfo -n $DRIVER 2>&1 | grep 'updates/drivers') ]
-		then
-			FROM="C"
-		elif [ $(modinfo -n $DRIVER 2>&1 | grep misc) ]
-		then
-			FROM="V"
-			#add a yell at the user in here
-		else
-			FROM="?"
-		fi
-
-		#check for staging drivers seperately
-		if [ $(modinfo -n $DRIVER 2>&1 | grep staging) ]
-		then
-			FROM="S"
-	        fi
-	else
-		FROM="K"
-	fi
-	if [ "$DEBUG" = "1" ]
-	then
-		printf "getFrom() $FROM\n"
-	fi
-}
-
-getFirmware() {
-	FIRMWARE=$(printf "$ethtool_output" | awk '/firmware-version/ {print $2}')
-	#ath9k_htc firmware is a shorter version number than most so trap and make it pretty
-	if [ "$DRIVER" = "ath9k_htc" ]
-	then
-		FIRMWARE="$FIRMWARE\t"
-	fi
-
-	if [ "$FIRMWARE" = "N/A" ]
-	then
-		FIRMWARE="$FIRMWARE\t"
-	elif [ -z "$FIRMWARE" ]
-	then
-		FIRMWARE="unavailable"
-	fi
-
-	if [ "$DEBUG" = "1" ]
-	then
-		printf "getFirmware $FIRMWARE\n"
-	fi
-
-}
-
-getChipset() {
-	#this needs cleanup, we shouldn't have multiple lines assigning chipset per bus
-	#fix this to be one line per bus
-	if [ -f /sys/class/net/$1/device/modalias ]
-	then
-		BUS=$(cat /sys/class/net/$1/device/modalias | cut -d ":" -f 1)
-		if [ "$BUS" = "usb" ]
-		then
-			BUSINFO=$(cat /sys/class/net/$1/device/modalias | cut -d ":" -f 2 | cut -b 1-10 | sed 's/^.//;s/p/:/')
-			CHIPSET=$(lsusb | grep -i "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')
-		#yes the below line looks insane, but broadcom appears to define all the internal buses so we have to detect them here
-		elif [ "${BUS}" = "pci" -o "${BUS}" = "pcmcia" ] && [ "${LSPCI}" = "1" ]
-		then
-			if [ -f /sys/class/net/$1/device/vendor -a -f /sys/class/net/$1/device/device ]
-			then
-				DEVICEID=$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)
-				CHIPSET=$(lspci -d $DEVICEID | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')
-			else
-				BUSINFO=$(printf "$ethtool_output" | grep bus-info | cut -d ":" -f "3-" | sed 's/^ //')
-				CHIPSET=$(lspci | grep "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')
-				DEVICEID=$(lspci -nn | grep "$BUSINFO" | grep '[[0-9][0-9][0-9][0-9]:[0-9][0-9][0-9][0-9]' -o)
-			fi
-		elif [ "${BUS}" = "sdio" ]
-		then
-			if [ -f /sys/class/net/$1/device/vendor -a -f /sys/class/net/$1/device/device ]
-			then
-				DEVICEID=$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)
-			fi
-			CHIPSET="unable to detect for sdio $DEVICEID"
-		else
-			CHIPSET="Not pci, usb, or sdio"
-		fi
-	#we don't do a check for usb here but it is obviously only going to work for usb
-	elif [ -f /sys/class/net/$1/device/idVendor -a -f /sys/class/net/$1/device/idProduct ]
-	then
-		DEVICEID=$(cat /sys/class/net/$1/device/idVendor):$(cat /sys/class/net/$1/device/idProduct)
-		CHIPSET=$(lsusb | grep -i "$DEVICEID" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')
-	elif [ "${DRIVER}" = "mac80211_hwsim" ]
-	then
-		CHIPSET="Software simulator of 802.11 radio(s) for mac80211"
-	elif $(printf "$ethtool_output" | awk '/bus-info/ {print $2}' | grep -q bcma)
-	then
-		BUS="bcma"
-
-		if [ "${DRIVER}" = "brcmsmac" ] || [ "${DRIVER}" = "brcmfmac" ] || [ "${DRIVER}" = "b43" ]
-		then
-			CHIPSET="Broadcom on bcma bus, information limited"
-		else
-			CHIPSET="Unrecognized driver \"${DRIVER}\" on bcma bus"
-		fi
-	else
-		CHIPSET="non-mac80211 device? (report this!)"
-	fi
-
-	if [ "$DEBUG" = "1" ]
-	then
-		printf "getchipset() $CHIPSET\n"
-		printf "BUS = $BUS\n"
-		printf "BUSINFO = $BUSINFO\n"
-		printf "DEVICEID = $DEVICEID\n"
-	fi
-}
-
-getStack() {
-	if [ x"$1" = "x" ]
-	then
-		return
-	fi
-
-	if [ -d /sys/class/net/$1/phy80211/ ]
-	then
-		MAC80211=1
-		STACK="mac80211"
-	else
-		MAC80211=0
-		STACK="ieee80211"
-	fi
-
-	if [ -e /proc/sys/dev/$1/fftxqmin ]
-	then
-		MAC80211=0
-		STACK="net80211"
-	fi
-
-	if [ "$DEBUG" = "1" ]
-	then
-		printf "getStack $STACK\n"
-	fi
-
-}
-
-getExtendedInfo() {
-	if [ "$DRIVER" = "??????" ]
-	then
-		EXTENDED="\t Failure detecting driver properly please report"
-	fi
-
-	#first we set all the real (useful) info we can find
-	if [ -f /sys/class/net/$1/device/product ]
-	then
-		EXTENDED="\t$(cat /sys/class/net/$1/device/product)"
-	fi
-
-	#then we sweep for known broken drivers with no available better drivers
-	if [ "$DRIVER" = "brcmsmac" ]
-	then
-		EXTENDED="Driver commonly referred to as brcm80211 (no injection yet)"
-	fi
-	if [ "$DRIVER" = "r8712u" ]
-	then
-		EXTENDED="\t\t\t\tNo monitor or injection support\n"
-	fi
-
-	#lastly we detect all the broken drivers which have working alturnatives
-	KV=$(uname -r | awk -F'-' '{print $1}')
-	KVMAJOR=$(printf ${KV} | awk -F'.' '{print $1$2}')
-	KVMINOR=$(printf ${KV} | awk -F'.' '{print $3}')
-
-	if [ $KVMAJOR -lt 26 ]
-	then
-		printf "You are running a kernel older than 2.6, I'm surprised it didn't error before now."
-	        if [ "$DEBUG" = "1" ]
-	        then
-			printf ${KVMAJOR} ${KVMINOR}
-		fi
-		exit 1
-	fi
-
-	if [ "$DRIVER" = "rt2870sta" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "35" ]
-		then
-			EXTENDED="\tBlacklist rt2870sta and use rt2800usb"
-		else
-			EXTENDED="\tUpgrade to kernel 2.6.35 or install compat-wireless stable"
-		fi
-		#add in a flag for "did you tell use to do X" and emit instructions
-	elif [ "$DRIVER" = "rt3070sta" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "35" ]
-		then
-			EXTENDED="\tBlacklist rt3070sta and use rt2800usb"
-		else
-			EXTENDED="\tUpgrade to kernel 2.6.35 or install compat-wireless stable"
-		fi
-	elif [ "$DRIVER" = "rt5390sta" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "39" ]
-		then
-			EXTENDED="\tBlacklist rt5390sta and use rt2800usb"
-		else
-			EXTENDED="\tUpgrade to kernel 2.6.39 or install compat-wireless stable"
-		fi
-	elif [ "$DRIVER" = "ar9170usb" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "37" ]
-		then
-			EXTENDED="\tBlacklist ar9170usb and use carl9170"
-		else
-			EXTENDED="\tUpgrade to kernel 2.6.37 or install compat-wireless stable"
-		fi
-	elif [ "$DRIVER" = "arusb_lnx" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "37" ]
-		then
-			EXTENDED="\tBlacklist arusb_lnx and use carl9170"
-		else
-			EXTENDED="\tUpgrade to kernel 2.6.37 or install compat-wireless stable"
-		fi
-	elif [ "$DRIVER" = "r8187" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "29" ]
-		then
-			EXTENDED="\t\tBlacklist r8187 and use rtl8187 from the kernel"
-		else
-			EXTENDED="\t\tUpgrade to kernel 2.6.29 or install compat-wireless stable"
-		fi
-	elif [ "$DRIVER" = "r8187l" ]
-	then
-		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "29" ]
-		then
-			EXTENDED="\t\tBlacklist r8187l and use rtl8187 from the kernel"
-		else
-			EXTENDED="\t\tUpgrade to kernel 2.6.29 or install compat-wireless stable"
-		fi
-	fi
-}
-
-scanProcesses() {
-	PROCESSES="wpa_action\|wpa_supplicant\|wpa_cli\|dhclient\|ifplugd\|dhcdbd\|dhcpcd\|NetworkManager\|knetworkmanager\|avahi-autoipd\|avahi-daemon\|wlassistant\|wifibox"
-	PS_ERROR="invalid\|illegal"
-
-	if [ -f "$(command -v service 2>&1)" ] && [ x"$1" = "xkill" ]
-	then
-		service network-manager stop 2> /dev/null > /dev/null
-		service avahi-daemon stop 2> /dev/null > /dev/null
-	fi
-
-	unset match
-	match=$(ps -A -o comm= | grep -c ${PROCESSES})
-	if [ ${match} -gt 0 -a x"${1}" != "xkill" -a x"${1}" = "x" ]
-	then
-		printf "Found $match processes that could cause trouble.\n"
-		printf "If airodump-ng, aireplay-ng or airtun-ng stops working after\n"
-		printf "a short period of time, you may want to kill (some of) them!\n\n"
-		#printf "\nPID\tName\n"
-	else
-		if [ x"${1}" != "xkill" -a x"${1}" = "x" ]
-		then
-			echo "No interfering processes found"
-			return
-		fi
-	fi
-
-	#if [ $match -gt 0 -a x"$1" = "xkill" ]
-	#then
-	#	printf "Killing processes..."
-	#fi
-
-	if [ ${match} -gt 0 ]
-	then
-		if [ x"${1}" = "xkill" ]
-		then
-			printf "Killing these processes:\n\n"
-		fi
-		ps -A -o pid=PID -o comm=Name | grep "${PROCESSES}\|PID"
-		if [ x"${1}" = "xkill" ]
-		then
-			for pid in $(ps -A -o pid= -o comm= | grep ${PROCESSES} | awk '{print $1}')
-			do
-				#we have to use signal 9 because things like nm actually respawn wpa_supplicant too quickly
-				kill -9 ${pid}
-			done
-		fi
-	fi
-
-	#i=1
-	#while [ $i -le $match ]
-	#do
-	#	pid=$(ps -A -o pid= -o comm= | grep $PROCESSES | head -n $i | tail -n 1 | awk '{print $1}')
-	#	pname=$(ps -A -o pid= -o comm= | grep $PROCESSES | head -n $i | tail -n 1 | awk '{print $2}')
-	#	if [ x"$1" != "xkill" ]
-	#	then
-	#		printf "${pid}\t${pname}\n"
-	#	else
-	#		kill ${pid}
-	#	fi
-	#	i=$(($i+1))
-	#done
-
-	printf "\n"
-
-	#this stub is for checking against the interface name, but since it almost never hits why bother?
-	#if [ x"${1}" != "x" -a x"${1}" != "xkill" ]
-	#then
-	#	#the next line doesn't work on busybox ps because -p is unimplimented
-	#	match2=$(ps -o comm= -p 1 2>&1 | grep $PS_ERROR -c)
-	#	if [ ${match2} -gt 0 ]
-	#	then
-	#		return
-	#	fi
-	#
-	#	for i in $(ps auxw | grep ${1} | grep -v "grep" | grep -v "airmon-zc" | awk '{print $2}')
-	#	do
-	#		pname=$(ps -o comm= -p ${i})
-	#		printf "Process with PID ${i} ($pname) is running on interface ${1}\n"
-	#	done
-	#fi
-}
-
-listInterfaces() {
-	unset iface_list
-	for iface in $(ls -1 /sys/class/net)
-	do
-		if [ -f /sys/class/net/${iface}/uevent ]; then
-			if $(grep -q DEVTYPE=wlan /sys/class/net/${iface}/uevent)
-			then
-				iface_list="${iface_list}\n ${iface}"
-			fi
-		fi
-	done
-	if [ -x "$(command -v iwconfig 2>&1)" ] && [ -x "$(command -v sort 2>&1)" ]
-	then
-		for iface in $(iwconfig 2> /dev/null | sed 's/^$[a-zA-Z0-9_.]*$ .*/\1/')
-		do
-			iface_list="${iface_list}\n ${iface}"
-		done
-		iface_list="$(printf "${iface_list}" | sort -bu)"
-	fi
-}
-
-getPhy() {
-	if [ x"$1" = "x" ]
-	then
-		return
-	fi
-
-	if [ $MAC80211 = "0" ]
-	then
-		PHYDEV="null"
-		return
-	fi
-
-	if [ -d /sys/class/net/$1/phy80211/ ]
-	then
-		PHYDEV="$(ls -l "/sys/class/net/$1/phy80211" | sed 's/^.*\/$[a-zA-Z0-9_-]*$$/\1/')"
-	fi
-}
-
-checkvm() {
-	#this entire section of code is completely stolen from Carlos Perez's work in checkvm.rb for metasploit and rewritten (poorly) in sh
-	#Check dmi info
-	if [ -x "$(command -v dmidecode 2>&1)" ]
-	then
-		dmi_info=$(dmidecode)
-		if [ dmi_info ]
-		then
-			echo ${dmi_info} | grep -iq "microsoft corporation" 2> /dev/null && vm="MS Hyper-V"
-			echo ${dmi_info} | grep -iq "vmware" 2> /dev/null && vm="VMware"
-			echo ${dmi_info} | grep -iq "virtualbox" 2> /dev/null && vm="VirtualBox"
-			echo ${dmi_info} | grep -iq "qemu" 2> /dev/null && vm="Qemu/KVM"
-			echo ${dmi_info} | grep -iq "domu" 2> /dev/null && vm="Xen"
-			vm_from="dmi_info"
-		fi
-	fi
-
-	#check loaded modules
-	if [ -z ${vm} ]
-	then
-		if [ -x "$(command -v lsmod 2>&1)" ]
-		then
-			lsmod_data=$(lsmod)
-			if [ lsmod ]
-			then
-				echo ${lsmod_data} | grep -iqE "vboxsf|vboxguest" 2> /dev/null && vm="VirtualBox"
-				echo ${lsmod_data} | grep -iqE "vmw_ballon|vmxnet|vmw" 2> /dev/null && vm="VMware"
-				echo ${lsmod_data} | grep -iqE "xen-vbd|xen-vnif" 2> /dev/null && vm="Xen"
-				echo ${lsmod_data} | grep -iqE "virtio_pci|virtio_net" 2> /dev/null && vm="Qemu/KVM"
-				echo ${lsmod_data} | grep -iqE "hv_vmbus|hv_blkvsc|hv_netvsc|hv_utils|hv_storvsc" && vm="MS Hyper-V"
-				vm_from="lsmod"
-			fi
-		fi
-	fi
-
-	#check scsi driver
-	if [ -z ${vm} ]
-	then
-		if [ -f /proc/scsi/scsi ]
-		then
-			grep -iq "vmware" /proc/scsi/scsi 2> /dev/null && vm="VMware"
-			grep -iq "vbox" /proc/scsi/scsi 2> /dev/null && vm="VirtualBox"
-			vm_from="/pro/scsi/scsi"
-		fi
-	fi
-
-	# Check IDE Devices
-	if [ -z ${vm} ]
-	then
-		if [ -d /proc/ide ]
-		then
-			ide_model=$(cat /proc/ide/hd*/model)
-			echo ${ide_model} | grep -iq "vbox" 2> /dev/null && vm="VirtualBox"
-			echo ${ide_model} | grep -iq "vmware" 2> /dev/null && vm="VMware"
-			echo ${ide_model} | grep -iq "qemu" 2> /dev/null && vm="Qemu/KVM"
-			echo ${ide_model} | grep -iqE "virtual (hd|cd)" 2> /dev/null && vm="Hyper-V/Virtual PC"
-			vm_from="ide_model"
-		fi
-	fi
-
-	# Check using lspci
-	if [ -z ${vm} ] && [ "${LSPCI}" = "1" ]
-	then
-			lspci_data=$(lspci)
-			echo ${lspci_data} | grep -iq "vmware" 2> /dev/null && vm="VMware"
-			echo ${lspci_data} | grep -iq "virtualbox" 2> /dev/null && vm="VirtualBox"
-			vm_from="lspci"
-	fi
-
-	# Xen bus check
-	## XXX: Removing unsafe check
-	# this check triggers if CONFIG_XEN_PRIVILEGED_GUEST=y et al are set in kconfig (debian default) even in not actually a guest
-	#if [ -z ${vm} ]
-	#then
-	#	ls -1 /sys/bus | grep -iq "xen" 2> /dev/null && vm="Xen"
-	#	vm_from="/sys/bus/xen"
-	#fi
-
-	# Check using lscpu
-	if [ !${vm} ]
-	then
-		if [ -x "$(command -v lscpu 2>&1)" ]
-                then
-                        lscpu_data=$(lscpu)
-			echo ${lscpu_data} | grep -iq "Xen" 2> /dev/null && vm="Xen"
-			echo ${lscpu_data} | grep -iq "KVM" 2> /dev/null && vm="KVM"
-			echo ${lscpu_data} | grep -iq "Microsoft" 2> /dev/null && vm="MS Hyper-V"
-			vm_from="lscpu"
-		fi
-	fi
-
-	#Check vmnet
-	if [ -z ${vm} ]
-	then
-		if [ -e /dev/vmnet ]
-		then
-			vm="VMware"
-			vm_from="/dev/vmnet"
-		fi
-	fi
-
-	# Check dmesg Output
-	if [ -z ${vm} ]
-	then
-		if [ -x "$(command -v dmesg 2>&1)" ]
-                then
-			dmesg_output=$(dmesg)
-			echo ${dmesg_output} | grep -iqE "vboxbios|vboxcput|vboxfacp|vboxxsdt|(vbox cd-rom)|(vbox harddisk)" && vm="VirtualBox"
-			echo ${dmesg_output} | grep -iqE "(vmware virtual ide)|(vmware pvscsi)|(vmware virtual platform)" && vm="VMware"
-			echo ${dmesg_output} | grep -iqE "(xen_mem)|(xen-vbd)" && vm="Xen"
-			echo ${dmesg_output} | grep -iqE "(qemu virtual cpu version)" && vm="Qemu/KVM"
-			vm_from="dmesg"
-		fi
-	fi
-}
-
-#end function definitions
-#begin execution
-
-listInterfaces
-
-#this should only run for start in elite mode? or should we have different warnings?
-if [ x"${1}" = "xcheck" ] || [ x"${1}" = "xstart" ]
-then
-	if [ x"${2}" = "xkill" ]
-	then
-		#if we are killing, tell scanProcesses that
-		scanProcesses "${2}"
-		return
-	elif [ x"${1}" = "xstart" ]
-	then
-		#this stub can send scanProcesses the interface name
-		#but this seems entirely unreliable so just run generic
-		#scanProcesses "${2}"
-		scanProcesses
-	else
-		scanProcesses
-		exit
-	fi
-fi
-
-if [ $# -ne "0" ]
-then
-	if [ x$1 != "xstart" ] && [ x$1 != "xstop" ]
-	then
-		usage
-	fi
-
-	if [ x$2 = "x" ]
-	then
-		usage
-	fi
-fi
-
-#startup checks complete, headers then main
-
-if [ "$VERBOSE" = "1" ]
-then
-	uname -a
-
-	checkvm
-	if [ ${vm} ]
-	then
-		printf "Detected VM using ${vm_from}\n"
-		printf "This appears to be a ${vm} Virtual Machine\n"
-		printf "If your system supports VT-d, it may be possible to use PCI devices\n"
-		printf "If your system does not support VT-d, you can only use USB wifi cards\n"
-	fi
-
-	printf "\nK indicates driver is from $(uname -r)\n"
-	if [ "${MODPROBE}" = 1 ]
-	then
-		modprobe compat > /dev/null 2>&1
-
-		if [ -f /sys/module/compat/parameters/compat_version ]
-		then
-			printf "C indicates driver is from $(cat /sys/module/compat/parameters/compat_version)\n"
-		fi
-	fi
-	printf "V indicates driver comes directly from the vendor, almost certainly a bad thing\n"
-	printf "S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE\n"
-	printf "? indicates we do not know where the driver comes from... report this\n\n"
-fi
-
-if [ ${VERBOSE} = "1" ]
-then
-	printf "\nX[PHY]Interface\t\tDriver[Stack]-FirmwareRev\t\tChipset\t\t\t\t\t\t\t\t\t\tExtended Info\n\n"
-else
-	printf "PHY\tInterface\tDriver\t\tChipset\n\n"
-fi
-
-#this whole block of code shouldn't be here, it makes no sense
-for iface in listIfaceUnspec
-do
-
-	if [ -e "/proc/sys/dev/$iface/fftxqmin" ]
-	then
-		setLink ${iface} up
-		printf "$iface\t\tAtheros\t\tmadwifi-ng"
-		if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-		then
-			IFACE=$(wlanconfig ath create wlandev $iface wlanmode monitor -bssid | grep ath)
-			setLink ${iface} up
-			if [ $CH -lt 1000 ]
-			then
-				iwconfig $IFACE channel $CH 2> /dev/null > /dev/null
-			else
-				iwconfig $IFACE freq "$CH"000000 2> /dev/null > /dev/null
-			fi
-		setLink ${IFACE} up
-		UDEV_ISSUE=$?
-		fi
-
-		if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-		then
-			printf "$iface does not support 'stop', do it on ath interface\n"
-		fi
-
-		#why, dear god why is there a random newline here?
-		printf "\n"
-		sleep 1s
-		continue
-	fi
-done
-#end random block of code that needs to die
-
-for iface in $(printf "${iface_list}")
-do
-	unset ethtool_output DRIVER FROM FIRMWARE STACK MADWIFI MAC80211 BUS BUSADDR BUSINFO DEVICEID CHIPSET EXTENDED PHYDEV ifacet DRIVERt FIELD1 FIELD1t FIELD2 FIELD2t CHIPSETt
-	#add a RUNNING check here and up the device if it isn't already
-	ethtool_output="$(ethtool -i $iface 2>&1)"
-	if [ "$ethtool_output" != "Cannot get driver information: Operation not supported" ]
-	then
-		getStack  ${iface}
-		getDriver   ${iface}
-		getChipset ${iface}
-		if [ ${VERBOSE} = "1" ]
-		then
-			getFrom ${iface}
-			getFirmware ${iface}
-			getExtendedInfo ${iface}
-		fi
-		getPhy     ${iface}
-	else
- 		printf "\nethtool failed...\n"
-		printf "Only mac80211 devices on kernel 2.6.33 or higher are officially supported by airmon-ng.\n"
-		exit 1
-	fi
-
-	#yes this really is the main output loop
-	if [ ${VERBOSE} = "1" ]
-	then
-		#beautify output spacing (within reason)
-		FIELD1="${FROM}[${PHYDEV}]${iface}"
-		if [ ${#FIELD1} -gt 15 ]
-		then
-			FIELD1t="\t"
-		else
-			FIELD1t="\t\t"
-		fi
-		FIELD2="${DRIVER}[${STACK}]-${FIRMWARE}"
-		if [ ${#FIELD2} -gt 27 ]
-		then
-			FIELD2t="\t"
-		else
-			FIELD2t="\t\t"
-		fi
-		if [ -n "${EXTENDED}" ]
-		then
-			CHIPSETt="\t\t\t\t\t\t\t\t\t\t"
-			if [ ${#CHIPSET} -gt 70 ]
-			then
-				CHIPSETt="\t"
-			elif [ ${#CHIPSET} -gt 63 ]
-			then
-				CHIPSETt="\t\t"
-			elif [ ${#CHIPSET} -gt 56 ]
-			then
-				CHIPSETt="\t\t\t"
-			elif [ ${#CHIPSET} -gt 49 ]
-			then
-				CHIPSETt="\t\t\t\t"
-			elif [ ${#CHIPSET} -gt 42 ]
-			then
-				CHIPSETt="\t\t\t\t\t"
-			elif [ ${#CHIPSET} -gt 35 ]
-			then
-				CHIPSETt="\t\t\t\t\t\t"
-			elif [ ${#CHIPSET} -gt 28 ]
-			then
-				CHIPSETt="\t\t\t\t\t\t\t"
-			elif [ ${#CHIPSET} -gt 21 ]
-			then
-				CHIPSETt="\t\t\t\t\t\t\t\t"
-			elif [ ${#CHIPSET} -gt 14 ]
-			then
-				CHIPSETt="\t\t\t\t\t\t\t\t\t"
-			fi
-		fi
-		printf "${FROM}[${PHYDEV}]${iface}${FIELD1t}${DRIVER}[${STACK}]-${FIRMWARE}${FIELD2t}${CHIPSET}${CHIPSETt}${EXTENDED}"
-	else
-		#beautify output spacing (within reason, interface/driver max length is 15 and phy max length is 7))
-		if [ ${#DRIVER} -gt 7 ]
-		then
-			DRIVERt="\t"
-		else
-			DRIVERt="\t\t"
-		fi
-		if [ ${#iface} -gt 7 ]
-		then
-			ifacet="\t"
-		else
-			ifacet="\t\t"
-		fi
-		printf "${PHYDEV}\t${iface}${ifacet}${DRIVER}${DRIVERt}${CHIPSET}"
-	fi
-
-	if [ x$MAC80211 = "x1" ]
-	then
-		if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-		then
-			startMac80211Iface $iface
-		fi
-
-		if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-		then
-			stopMac80211Iface $iface
-		fi
-
-		#why, dear god why is there a random newline here?
-		printf "\n"
-		continue
-	fi
-done
-
-#why, dear god why is there a random newline here?
-printf "\n"
-
-if [ $UDEV_ISSUE != 0 ]
-then
-	printf "udev renamed the interface. Read the following for a solution:\n"
-	printf "http://www.aircrack-ng.org/doku.php?id=airmon-ng#interface_athx_number_rising_ath0_ath1_ath2...._ath45\n\n"
-fi

aircrack-ng-1.2-rc1.tar.gz/ChangeLog -> aircrack-ng-1.2-rc2.tar.gz/ChangeLog Changed

@@ -1,11 +1,42 @@
+Version 1.2-rc2 (changes from aircrack-ng 1.2-rc1) - Released 10 April 2015:
+* Airtun-ng: Adds WPA CCMP and TKIP decryption and CCMP encryption
+* Compilation: Added support for DUMA.
+* Makefile: Renamed 'unstable' to 'experimental'.
+* Airodump-ng: Fixed XML sanitizing.
+* Airmon-ng: Airmon-zc is now stable enough to replace airmon-ng.
+* Manpages: Removed airdriver-ng manpage and references to it (forgot to do it before the previous release).
+* Manpages: Updated 'see also' references in all manpages.
+* PCRE: Added it in various places and docs.
+* WZCook: Fixed processing values stored in register.
+* Updated a few headers files (if_llc, ieee80211, ethernet and if_arp).
+* Travis CI: updated make parameter and add testing with pcre.
+* Compilation: de-hardcode -lpcap to allow specifying pcap libraries.
+* Makefile: Fixed installing/uninstalling Airdrop-ng documentation files.
+* Makefile: Fixed uninstalling ext_scripts.
+* Airodump-ng: Added new paths (and removed one) for OUI files and simplified logic to find the OUI file.
+* Aircrack-ng: Fixed ignoring -p when specified after -S.
+* Airmon-ng: fixes for openwrt busybox ps/grep issues which do not seem present in other versions of busybox
+* Airmon-ng: fix vm detection.
+* Airserv-ng: Fixed channel setting (and assert call).
+* Airodump-ng: Fixes to NetXML (unassociated clients missing and various other small bugs) and update the code to match current NetXML output.
+* Airodump-ng: Removed requirement for 2 packets before AP is written to output (text) files.
+* Airodump-ng: Fixed formatting of ESSID and display of WPA/WPA2 (as well as a bunch of other small fixes) in CSV file.
+* Airodump-ng: Fixed GPSd.
+* Airodump-ng: Allow to specify write interval for CSV, kismet CSV and NetXML files.
+* Airserv-ng: Fixed wrong station data displayed in Airodump-ng.
+* General: Fixed 64 bit promotion issues.
+* General: Fixed a bunch of uninitialized values and non-zeroed structures (upon allocating them).
+* General: Added Stack protection.
+* Various other small fixes and improvements.
+
 Version 1.2-rc1 (changes from aircrack-ng 1.2-beta3) - Released 31 October 2014:
 * Airodump-ng should be able to parse the canonical oui file.
 * Airodump-ng: Fixed GPS stack overflow.
 * Airodump-ng: Fixed stopping cleanly with Ctrl-C.
-* Airmon-zc: better handling for when modules are not available (incomplete)
-* Airmon-zc: users can now start the monitor interface again to change channels
+* Airmon-zc: better handling for when modules are not available (incomplete).
+* Airmon-zc: users can now start the monitor interface again to change channels.
 * Airmon-zc: update to use ip instead of ifconfig if available.
-* Airmon-zc: better handling of devices without pci bus
+* Airmon-zc: better handling of devices without pci bus.
 * Aireplay-ng: Fixed tcp_test stack overflow.
 * OSdep: Fixed libnl detection. Also avoid detection on non Linux systems.
 * OSdep: Fixed segmentation fault that happens with a malicious server.
@@ -13,9 +44,10 @@
 * Buddy-ng: Fixed segmentation fault.
 * Makefile: Fixed 'commands commence before first target' error when building Aircrack-ng.
 * Fixed segfault when changing the optimization when compiling with gcc thanks to Ramiro Polla.
-* Removed airdriver-ng (outdated and not meant for today's kernels)
+* Removed airdriver-ng (outdated and not meant for today's kernels).
 * Added gitignore file.
 * Fixed build issues on other compilers by using stdint.h types.
+* Fixed CVE-2014-8321, CVE-2014-8322, CVE-2014-8323 and CVE-2014-8324 across multiple tools.
 * Updating installation file and added pkg-config as a requirement.
 * Various small fixes and improvements.
 
@@ -46,7 +78,7 @@
 * Airmon-ng: Added 'check kill' to automatically kill services that could interfere.
 * Airmon-ng: Fixed issues with Intel chipsets detection.
 * Airmon-ng: Updated iw download link.
-* Airmon-ng: Better mac80211 handling
+* Airmon-ng: Better mac80211 handling.
 * Airmon-ng: Added detection for WiLink TI driver, rtl819xU, iwlwifi.
 * Airmon-zc: Improved version of Airmon-ng with more detailled information.
 * Airdecap-ng: Fixed decoding QoS frames (Closes: #667 and #858).
@@ -54,7 +86,7 @@
 * Airbase-ng: Fixed bug using clients list.
 * Airbase-ng: Fixed issue with QoS (ticket #760).
 * Airbase-ng: Fixed sending beacons with null SSID.
-* Airbase-ng: Allow non ASCII ESSID
+* Airbase-ng: Allow non ASCII ESSID.
 * Airodump-ng: Fixed buffer overflow (ticket #728).
 * Airodump-ng: Fixed channel parsing.
 * Airodump-ng: Fixed FreeBSD battery reading.
@@ -89,7 +121,7 @@
 * Airserv-ng: Fixed crash when clients disconnect.
 * Besside-ng-crawler: Added EAPOL Crawler.
 * Airdecloak-ng: Fixed bug when using pcap files with PPI headers.
-* dcrack: Distributed cracking server/client
+* dcrack: Distributed cracking server/client.
 * wifi-detect.sh: reference script for testing wifi card detection using iwconfig vs ls /sys/class/net
 * WPA Clean: Tool to merge and clean WPA capture files.
 * Wireless Panda: C# Library to parse Airodump-ng output files (and added example project).

aircrack-ng-1.2-rc1.tar.gz/INSTALLING -> aircrack-ng-1.2-rc2.tar.gz/INSTALLING Changed

@@ -32,15 +32,14 @@
 
 * sqlite:   needed to compile airolib-ng and add support for airolib-ng
             databases in aircrack-ng.
-            On cygwin: SQLite has to be compiled manually. See next section.
 
 * airpcap:  needed for supporting airpcap devices on windows (cygwin only)
             REQUIREMENT: Copy 'developers' directory from Airpcap CD one 
                          level below this INSTALLING file
             Note: Not working yet.
 
-* unstable: needed to compile tkiptun-ng, easside-ng (and buddy-ng) and
-            wesside-ng
+* experimental: needed to compile tkiptun-ng, easside-ng (and buddy-ng),
+                wesside-ng and besside-ng
 
 * ext_scripts: needed to build airoscript-ng, versuck-ng, airgraph-ng and 
             airdrop-ng. 
@@ -58,19 +57,22 @@
 * pcre:	    Add support for regular expression matching for ESSID in airodump-ng and besside-ng.
             Dependencies (debian): libpcre3-dev
 
+* duma:     Compile with DUMA support. DUMA is a library to detect buffer overruns and under-runs.
+            Dependencies (debian): duma
+
 Example:
 
   * Compiling:
-    make sqlite=true unstable=true
+    make sqlite=true experimental=true pcre=true
 
   * Compiling with gcrypt
     make gcrypt=true
 
   * Installing:
-    make sqlite=true unstable=true install
+    make sqlite=true pcre=true experimental=true install
 
   * Installing, with external scripts:
-    make sqlite=true unstable=true ext_scripts=true
+    make sqlite=true pcre=true experimental=true ext_scripts=true
 
 === Using precompiled binaries ===

aircrack-ng-1.2-rc1.tar.gz/Makefile -> aircrack-ng-1.2-rc2.tar.gz/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/README -> aircrack-ng-1.2-rc2.tar.gz/README Changed

@@ -30,7 +30,7 @@
 	
 	
 	Problem 1: No client can associate to an airbase soft AP.
-	Solution 1: None at this time.
+	Solution: Use a more recent driver. Madwifi-ng has been deprecated for years.
 	
 	
 	Problem 2: When changing rate while you are capturing packet makes airodump-ng stall
@@ -60,7 +60,7 @@
 	-----------
 
 	Problem: Fakeauth on a WRT54G with WEP (shared authentication) doesn't work.
-	Solution: None at this time (we'll try to fix it for next release).
+	Solution: None at this time (we'll try to fix it in an upcoming release).
 
 
 	Airolib-ng
@@ -82,7 +82,16 @@
 	
 	Problem: On windows, it doesn't display a list of adapters like the old 0.X
 	Solution: It requires you to develop your own DLL.
-	
+
+	Problem: Handshake is not captured/detected
+	Reason: You might be too far and your signal is bad (or too close with a signal too strong).
+	        Another possibility is that Airodump-ng didn't detect the handshake properly due to
+	        being far apart in the capture.
+	Solution 1: Check out our tutorial 'WPA Packet Capture Explained' in the wiki.
+	Solution 2: Try running Aircrack-ng on your capture, it might detect the capture.
+	Solution 3: Check out our wpaclean tool.
+	Note: It will be fixed in an upcoming release.
+
 	Cygwin
 	------
 	
@@ -132,3 +141,12 @@
 
 password.db
     This is a sample airolib-ng database for WPA key cracking.
+
+pingreply.c
+    Replies to all ping requests. Useful for testing sniffing/injecting packets with airtun-ng.
+
+Chinese-SSID-Name.pcap
+    Contains a beacon with an SSID displayed in Chinese.
+
+verify_inject.py
+    Testing DNS requests using airtun-ng.

aircrack-ng-1.2-rc1.tar.gz/VERSION -> aircrack-ng-1.2-rc2.tar.gz/VERSION Changed

aircrack-ng-1.2-rc1.tar.gz/common.mak -> aircrack-ng-1.2-rc2.tar.gz/common.mak Changed

@@ -39,7 +39,7 @@
 endif
 
 ifeq ($(PCRE), true)
-COMMON_CFLAGS += $(shell pcre-config --cflags) -DHAVE_PCRE
+COMMON_CFLAGS += $(shell $(PKG_CONFIG) --cflags libpcre) -DHAVE_PCRE
 endif
 
 ifeq ($(OSNAME), cygwin)
@@ -131,11 +131,34 @@
 libdir		= $(prefix)/lib
 etcdir		= $(prefix)/etc/aircrack-ng
 
+GCC_OVER41	= $(shell expr 41 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
 GCC_OVER45	= $(shell expr 45 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
+GCC_OVER49	= $(shell expr 49 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
+ifeq ($(GCC_OVER41), 0)
+	GCC_OVER41	= $(shell expr 4.1 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
+endif
 ifeq ($(GCC_OVER45), 0)
 	GCC_OVER45	= $(shell expr 4.5 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
 endif
+ifeq ($(GCC_OVER49), 0)
+	GCC_OVER49	= $(shell expr 4.9 \<= `$(CC) -dumpversion | awk -F. '{ print $1$2 }'`)
+endif
+
+
+ifeq ($(GCC_OVER49), 0)
+	ifeq ($(GCC_OVER41), 1)
+		COMMON_CFLAGS += -fstack-protector
+	endif
+endif
+
+ifeq ($(GCC_OVER49), 1)
+	COMMON_CFLAGS += -fstack-protector-strong
+endif
 
 ifeq ($(GCC_OVER45), 1)
 	CFLAGS		+= -Wno-unused-but-set-variable -Wno-array-bounds
 endif
+
+ifeq ($(subst TRUE,true,$(filter TRUE true,$(duma) $(DUMA))),true)
+	LIBS += -lduma
+endif

aircrack-ng-1.2-rc1.tar.gz/manpages/Makefile -> aircrack-ng-1.2-rc2.tar.gz/manpages/Makefile Changed

@@ -4,18 +4,16 @@
 MP_FILES	= aircrack-ng.1 airdecap-ng.1 ivstools.1 kstats.1 makeivs-ng.1 \
 		  packetforge-ng.1 airdecloak-ng.1 wpaclean.1 besside-ng-crawler.1
 
-SMP_FILES	= airdriver-ng.8 aireplay-ng.8 airmon-ng.8 airodump-ng.8 \
+SMP_FILES	= aireplay-ng.8 airmon-ng.8 airodump-ng.8 besside-ng.8 \
 		  airserv-ng.8 airtun-ng.8 airbase-ng.8 airodump-ng-oui-update.8 \
-		  besside-ng.8
-
 
 ifeq ($(subst TRUE,true,$(filter TRUE true,$(sqlite) $(SQLITE))),true)
 	MP_FILES += airolib-ng.1
 endif
 
-ifeq ($(subst TRUE,true,$(filter TRUE true,$(unstable) $(UNSTABLE))),true)
+ifeq ($(subst TRUE,true,$(filter TRUE true,$(experimental) $(EXPERIMENTAL))),true)
 	MP_FILES  += buddy-ng.1
-	SMP_FILES += tkiptun-ng.8 easside-ng.8 wesside-ng.8 airmon-zc.8
+	SMP_FILES += tkiptun-ng.8 easside-ng.8 wesside-ng.8
 endif
 
 
@@ -33,7 +31,7 @@
 # Uninstall just calls cleanfiles with all possible switches enabled to
 # ensure all previously installed manpages are cleaned
 uninstall:
-	$(MAKE) cleanfiles sqlite=true unstable=true
+	$(MAKE) cleanfiles sqlite=true experimental=true
 
 cleanfiles:
 	@-$(foreach CUR_MP,$(MP_FILES), rm -f $(DESTDIR)$(mandir)/$(CUR_MP); echo rm -f $(DESTDIR)$(mandir)/$(CUR_MP); )

aircrack-ng-1.2-rc1.tar.gz/manpages/airbase-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airbase-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/aircrack-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/aircrack-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airdecap-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airdecap-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airdecloak-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airdecloak-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/aireplay-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/aireplay-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airmon-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airmon-ng.8 Changed

@@ -1,4 +1,4 @@
-.TH AIRMON-NG 8 "October 2014" "Version 1.2-rc1"
+.TH AIRMON-NG 8 "April 2015" "Version 1.2-rc2"
 
 .SH NAME
 airmon-ng - bash script designed to turn wireless cards into monitor mode.
@@ -23,34 +23,44 @@
 List all possible programs that could interfere with the wireless card. If \(aqkill\(aq is specified, it will try to kill all of them.
 .SH AUTHOR
 This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others).
+And modified to fit airmon-ng by David Francos Cuartero <xayon@xayon.net>.
 Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation
 On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
+
 .SH SEE ALSO
 .br
 .B airbase-ng(8)
 .br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airdriver-ng(8)
-.br
 .B aireplay-ng(8)
 .br
 .B airodump-ng(8)
 .br
-.B airolib-ng(1)
+.B airodump-ng-oui-update(8)
 .br
 .B airserv-ng(8)
 .br
 .B airtun-ng(8)
 .br
-.B buddy-ng(1)
+.B besside-ng(8)
 .br
 .B easside-ng(8)
 .br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
 .B ivstools(1)
 .br
 .B kstats(1)
@@ -59,6 +69,4 @@
 .br
 .B packetforge-ng(1)
 .br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
+.B wpaclean(1)

aircrack-ng-1.2-rc1.tar.gz/manpages/airodump-ng-oui-update.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airodump-ng-oui-update.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airodump-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airodump-ng.8 Changed

@@ -1,4 +1,4 @@
-.TH AIRODUMP-NG 8 "October 2014" "Version 1.2-rc1"
+.TH AIRODUMP-NG 8 "April 2015" "Version 1.2-rc2"
 
 .SH NAME
 airodump-ng - a wireless packet capture tool for aircrack-ng
@@ -59,12 +59,18 @@
 .I -U, --uptime
 Display APs uptime obtained from its beacon timestamp.
 .TP
+.I -W, --wps
+Display a WPS column with WPS version, config method(s), AP Setup Locked obtained from APs beacon or probe response (if any).
+.TP
 .I --output-format <formats>
 Define the formats to use (separated by a comma). Possible values are: pcap, ivs, csv, gps, kismet, netxml. The default values are: pcap, csv, kismet, kismet-newcore.
 \(aqpcap\(aq is for recording a capture in pcap format, \(aqivs\(aq is for ivs format (it is a shortcut for --ivs). \(aqcsv\(aq will create an airodump-ng CSV file, \(aqkismet\(aq will create a kismet csv file and \(aqkismet-newcore\(aq will create the kismet netxml file. \(aqgps\(aq is a shortcut for --gps.
 .br
 Theses values can be combined with the exception of ivs and pcap.
 .TP
+.I -I <seconds>, --write-interval <seconds>
+Output file(s) write interval for CSV, Kismet CSV and Kismet NetXML in seconds (minimum: 1 second). By default: 5 seconds. Note that an interval too small might slow down airodump\-ng.
+.TP
 .I --ignore-negative-one
 Removes the message that says \(aqfixed channel <interface>: -1\(aq.
 .PP
@@ -192,6 +198,9 @@
 .I AUTH
 The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
 .TP
+.I WPS
+This is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the column indicates version supported. The second field indicates WPS config methods (can be more than one method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC = External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD =  Keypad. Locked is displayed when AP setup is locked.
+.TP
 .I ESSID
 The so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.
 .TP
@@ -219,30 +228,36 @@
 .br
 .B airbase-ng(8)
 .br
-.B aircrack-ng(1)
-.br
-.B airdecap-ng(1)
-.br
-.B airdecloak-ng(1)
-.br
-.B airdriver-ng(8)
-.br
 .B aireplay-ng(8)
 .br
 .B airmon-ng(8)
 .br
 .B airodump-ng-oui-update(8)
 .br
-.B airolib-ng(1)
-.br
 .B airserv-ng(8)
 .br
 .B airtun-ng(8)
 .br
-.B buddy-ng(1)
+.B besside-ng(8)
 .br
 .B easside-ng(8)
 .br
+.B tkiptun-ng(8)
+.br
+.B wesside-ng(8)
+.br
+.B aircrack-ng(1)
+.br
+.B airdecap-ng(1)
+.br
+.B airdecloak-ng(1)
+.br
+.B airolib-ng(1)
+.br
+.B besside-ng-crawler(1)
+.br
+.B buddy-ng(1)
+.br
 .B ivstools(1)
 .br
 .B kstats(1)
@@ -251,6 +266,4 @@
 .br
 .B packetforge-ng(1)
 .br
-.B tkiptun-ng(8)
-.br
-.B wesside-ng(8)
+.B wpaclean(1)

aircrack-ng-1.2-rc1.tar.gz/manpages/airolib-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airolib-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airserv-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airserv-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/airtun-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/airtun-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/besside-ng-crawler.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/besside-ng-crawler.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/besside-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/besside-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/buddy-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/buddy-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/easside-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/easside-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/ivstools.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/ivstools.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/kstats.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/kstats.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/makeivs-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/makeivs-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/packetforge-ng.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/packetforge-ng.1 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/tkiptun-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/tkiptun-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/wesside-ng.8 -> aircrack-ng-1.2-rc2.tar.gz/manpages/wesside-ng.8 Changed

aircrack-ng-1.2-rc1.tar.gz/manpages/wpaclean.1 -> aircrack-ng-1.2-rc2.tar.gz/manpages/wpaclean.1 Changed

aircrack-ng-1.2-rc1.tar.gz/packages/PKGBUILD -> aircrack-ng-1.2-rc2.tar.gz/packages/PKGBUILD Changed

aircrack-ng-1.2-rc1.tar.gz/packages/aircrack-ng.spec -> aircrack-ng-1.2-rc2.tar.gz/packages/aircrack-ng.spec Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airdrop-ng/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/airdrop-ng/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airdrop-ng/airdrop/libOuiParse.py -> aircrack-ng-1.2-rc2.tar.gz/scripts/airdrop-ng/airdrop/libOuiParse.py Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airdrop-ng/doc/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/airdrop-ng/doc/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airgraph-ng/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/airgraph-ng/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airgraph-ng/man/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/airgraph-ng/man/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/airmon-ng -> aircrack-ng-1.2-rc2.tar.gz/scripts/airmon-ng Changed

@@ -1,1335 +1,1220 @@
 #!/bin/sh
-
+DEBUG="0"
+VERBOSE="0"
+ELITE="0"
 USERID=""
 IFACE=""
-KISMET=/etc/kismet/kismet.conf
-CH=$3; [ x$3 = "x" ] && CH=10
-IFACE_FOUND="false"
-MADWIFI=0
 MAC80211=0
-USE_IW=0
-IW_SOURCE="https://www.kernel.org/pub/software/network/iw/iw-3.17.tar.xz"
+IW_SOURCE="https://www.kernel.org/pub/software/network/iw/iw-4.0.tar.gz"
 IW_ERROR=""
 UDEV_ISSUE=0
+SYSFS=0
+if [ -d /sys/ ]
+then
+	SYSFS=1
+fi
+
+if [ "${1}" = "--elite" ]
+then
+	shift
+	ELITE="1"
+fi
+
+if [ "${1}" = "--verbose" ]
+then
+	shift
+	VERBOSE="1"
+fi
+
+if [ "${1}" = "--debug" ]
+then
+	shift
+	DEBUG="1"
+	VERBOSE="1"
+fi
 
-if [ -f "`which iw 2>&1`" ]
+#yes, I know this is in here twice
+if [ "${1}" = "--elite" ]
 then
-	USE_IW=1
+	shift
+	ELITE="1"
 fi
 
-if [ "x$MON_PREFIX" = "x" ]
+
+CH=${3}; [ x${3} = "x" ] && CH=10
+
+#TODO LIST
+
+#cleanup getDriver()
+#fix to not assume wifi drivers are modules
+
+if [ x"$(command -v id 2> /dev/null)" != "x" ]
+then
+	USERID="$(id -u 2> /dev/null)"
+fi
+
+if [ x${USERID} = "x" -a x"$(id -ru)" != "x" ]
 then
-MON_PREFIX="mon"
+	USERID="$(id -ru)"
 fi
 
-PROCESSES="wpa_action\|wpa_supplicant\|wpa_cli\|dhclient\|ifplugd\|dhcdbd\|dhcpcd\|NetworkManager\|knetworkmanager\|avahi-autoipd\|avahi-daemon\|wlassistant\|wifibox"
-PS_ERROR="invalid"
+if [ x${USERID} != "x" -a x${USERID} != "x0" ]
+then
+	printf "Run it as root\n" ; exit 1;
+fi
+
+#check for all needed binaries
+if [ ! -x "$(command -v uname 2>&1)" ]
+then
+	printf "How in the world do you not have uname installed?\n"
+	printf "Please select a linux distro which has at least basic functionality (or install uname).\n"
+	exit 1
+#else
+#	#write something in here to test uname for Darwin/Linux and set a variable
+fi
+
+if [ ! -x "$(command -v ip 2>&1)" ] && [ ! -x "$(command -v ifconfig 2>&1)" ]
+then
+	printf "You have neither ip (iproute2) nor ifconfig installed.\n"
+	printf "Please install one of them from your distro's package manager.\n"
+	exit 1
+fi
+
+if [ ! -x "$(command -v iw 2>&1)" ]
+then
+	printf "You don't have iw installed, please install it from your distro's package manager.\n"
+	printf "If your distro doesn't have a recent version you can download it from this link:\n"
+	printf "${IW_SOURCE}\n"
+	exit 1
+fi
+
+if [ ! -x "$(command -v ethtool 2>&1)" ]
+then
+	printf "Please install the ethtool package for your distro.\n"
+	exit 1
+fi
+
+if [ ! -x "$(command -v lsusb 2>&1)" ]
+then
+	printf "Please install lsusb from your distro's package manager.\n"
+	exit 1
+fi
+
+if [ -d /proc/bus/pci ]
+then
+	if [ ! -x "$(command -v lspci 2>&1)" ]
+	then
+		printf "Please install lspci from your distro's package manager.\n"
+		exit 1
+	else
+		LSPCI=1
+	fi
+else
+	LSPCI=0
+fi
+
+if [ -f /proc/modules ]
+then
+	if [ ! -x "$(command -v modprobe 2>&1)" ]
+	then
+		printf "Your kernel has module support but you don't have modprobe installed.\n"
+		printf "It is highly recommended to install modprobe (typically from kmod).\n"
+		MODPROBE=0
+	else
+		MODPROBE=1
+	fi
+	if [ ! -x "$(command -v modinfo 2>&1)" ]
+	then
+		printf "Your kernel has module support but you don't have modinfo installed.\n"
+		printf "It is highly recommended to install modinfo (typically from kmod).\n"
+		printf "Warning: driver detection without modinfo may yield inaccurate results.\n"
+		MODINFO=0
+	else
+		MODINFO=1
+	fi
+fi
+
+if [ ! -x "$(command -v awk 2>&1)" ]
+then
+	printf "How in the world do you not have awk installed?\n"
+	printf "Please select a linux distro which has at least basic functionality (or install awk).\n"
+	exit 1
+fi
+
+if [ ! -x "$(command -v grep 2>&1)" ]
+then
+	printf "How in the world do you not have grep installed?\n"
+	printf "Please select a linux distro which has at least basic functionality (or install grep).\n"
+	exit 1
+fi
+#done checking for binaries
 
 usage() {
-	printf "usage: `basename $0` <start|stop|check> <interface> [channel or frequency]\n"
-	echo
+	printf "usage: $(basename $0) <start|stop|check> <interface> [channel or frequency]\n\n"
 	exit
 }
 
-startStdIface() {
-	iwconfig $1 mode monitor >/dev/null 2>&1
-	if [ ! -z $2 ]
+setLink() {
+	if [ -x "$(command -v ip 2>&1)" ]
+	then
+		ip link set dev ${1} ${2} > /dev/null 2>&1 || printf "\nFailed to set ${1} ${2} using ip\n"
+	elif [ -x "$(command -v ifconfig 2>&1)" ]
+	then
+		ifconfig ${1} ${2} > /dev/null 2>&1 || printf "\nFailed to set ${1} ${2} using ifconfig\n"
+	fi
+	return
+}
+
+ifaceIsUp() {
+	if [ -x "$(command -v ip 2>&1)" ]
+	then
+		ifaceIsUpCmd="ip link show dev"
+	elif [ -x "$(command -v ifconfig 2>&1)" ]
 	then
-	    if [ $2 -lt 1000 ]
-	    then
-		iwconfig $1 channel $2 >/dev/null 2>&1
-	    else
-		iwconfig $1 freq "$2"000000 > /dev/null 2>&1
-	    fi
+		ifaceIsUpCmd="ifconfig"
+	fi
+	if ${ifaceIsUpCmd} ${1} 2>&1 | grep -q UP
+	then
+		return
+	else
+		return 1
 	fi
-	iwconfig $1 key off >/dev/null 2>&1
-	ifconfig $1 up
+}
+
+listIfaceUnspec() {
+	if [ -x "$(command -v ip 2>&1)" ]
+	then
+		ip link 2>/dev/null | awk -F"[: ]+" '/UNSPEC/ {print $2}'
+	elif [ -x "$(command -v ifconfig 2>&1)" ]
+	then
+		ifconfig -a 2>/dev/null | awk -F"[: ]+" '/UNSPEC/ {print $1}'
+	fi
+}
+
+startDeprecatedIface() {
+	iwconfig ${1} mode monitor > /dev/null 2>&1
+	if [ ! -z ${2} ]
+	then
+		if [ ${2} -lt 1000 ]
+		then
+			iwconfig ${1} channel ${2} > /dev/null 2>&1
+		else
+			iwconfig ${1} freq ${2}000000 > /dev/null 2>&1
+		fi
+	else
+		iwconfig ${1} channel ${CH} > /dev/null 2>&1
+	fi
+	iwconfig ${1} key off > /dev/null 2>&1
+	setLink ${1} up
 	printf " (monitor mode enabled)"
 }
 
+startMac80211Iface() {
+	#check if $1 already has a mon interface on the same phy and bail if it does
+	if [ -d /sys/class/ieee80211/${PHYDEV}/device/net ]
+	then
+		for i in $(ls /sys/class/ieee80211/${PHYDEV}/device/net/)
+		do
+			if [ "$(cat /sys/class/ieee80211/${PHYDEV}/device/net/${i}/type)" = "803" ]
+			then
+				setChannelMac80211 ${1}
+				printf "\n\t\t(mac80211 monitor mode already enabled for [${PHYDEV}]${1} on [${PHYDEV}]${i})\n"
+				exit
+			fi
+		done
+	fi
+	#we didn't bail means we need a monitor interface
+	if [ -e /sys/class/net/${1}mon ]
+	then
+		printf "\nYou already have a ${1}mon device but it is NOT in monitor mode."
+		printf "\nWhatever you did, don't do it again."
+		printf "\nPlease run \"iw ${1}mon del\" before attempting to continue\n"
+		exit 1
+	fi
+	#we didn't bail means our target interface is available
+	setLink ${1} down
+	IW_ERROR=$(iw phy ${PHYDEV} interface add ${1}mon type monitor 2>&1 | grep "nl80211 not found")
+	if [ x${IW_ERROR} = "x" ]
+	then
+		sleep 1s
+		setChannelMac80211 ${1}mon
+		printf "\n\t\t(mac80211 monitor mode vif enabled for [${PHYDEV}]${1} on [${PHYDEV}]${1}mon)\n"
+	else
+		printf "\n\nERROR: something went wrong with iw."
+	fi
+	if [ ${ELITE} = "1" ]
+	then
+		#check if $1 is still down, warn if not
+		if ifaceIsUp ${1}
+		then
+			printf "\nInterface ${1} is up, but it should be down. Something is interferring."
+			printf "\nPlease run \"airmon-ng check kill\" and/or kill your network manager."
+		fi
+	else
+		iw ${1} del
+		printf "\t\t(mac80211 station mode vif disabled for [${PHYDEV}]${1})\n"
+	fi
+}
+
+startDarwinIface() {
+	if [ -x /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport ]
+	then
+		/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport $1 sniff
+	fi
+}
+
+setChannelMac80211() {
+	setLink ${1} up
+	if [ ! -z ${3} ]
+	then
+		if [ ${3} -lt 1000 ]
+		then
+			iw dev ${1} set channel ${3}
+		else
+			iw dev ${1} set freq "${3}"
+		fi
+	else
+		iw dev ${1} set channel ${CH}
+	fi
+}
 
-stopStdIface() {
-	ifconfig $1 down >/dev/null 2>&1
-	iwconfig $1 mode Managed >/dev/null 2>&1
-	ifconfig $1 down >/dev/null 2>&1
+stopDeprecatedIface() {
+	setLink $1 down
+	iwconfig $1 mode Managed > /dev/null 2>&1
+	setLink $1 up
 	printf " (monitor mode disabled)"
 }
 
-getModule() {
-    if [ -f "/sys/class/net/$1/device/driver/module/srcversion" ]
-    then
-        srcver1=`cat "/sys/class/net/$1/device/driver/module/srcversion"`
-        for j in `lsmod | awk '{print $1}' | grep -v "^Module$"`
-        do
-            srcver2="`modinfo $j 2>/dev/null | grep srcversion | awk '{print $2}'`"
-            if [ $srcver1 = "$srcver2" ]
-            then
-                MODULE=$j
-                break
-            fi
-        done
-    else
-        MODULE=""
-    fi
-#    return 0
+stopMac80211Iface() {
+	if [ -f /sys/class/net/${1}/type ]
+	then
+		if [ "$(cat /sys/class/net/${1}/type)" != "803" ]
+		then
+			printf "\n\nYou are trying to stop a device that isn't in monitor mode.\n"
+			printf "Doing so is a terrible idea, if you really want to do it then you\n"
+			printf "need to type 'iw ${1} del' yourself since it is a terrible idea.\n"
+			printf "Most likely you want to remove an interface called wlan[0-9]mon\n"
+			printf "If you feel you have reached this warning in error,\n"
+			printf "please report it."
+			exit 1
+		else
+			if [ "${ELITE}" = "0" ]
+			then
+				#check if $1 already has a sta interface on the same phy and bail if it does
+				if [ -d /sys/class/ieee80211/${PHYDEV}/device/net ]
+				then
+					for i in $(ls /sys/class/ieee80211/${PHYDEV}/device/net/)
+					do
+						if [ "$(cat /sys/class/ieee80211/${PHYDEV}/device/net/${i}/type)" = "1" ]
+						then
+							printf "\n\t\t(mac80211 station mode vif already available for [${PHYDEV}]${1} on [${PHYDEV}]${i})\n"
+							exit
+						fi
+					done
+				fi
+				if [ -e /sys/class/net/${1%mon} ]
+				then
+					printf "\nYou already have a ${1%mon} device but it is NOT in station mode."
+					printf "\nWhatever you did, don't do it again."
+					printf "\nPlease run \"iw ${1%mon} del\" before attempting to continue\n"
+					exit 1
+				fi
+				IW_ERROR=$(iw phy ${PHYDEV} interface add ${1%mon} type station 2>&1)
+				if [ x${IW_ERROR} = "x" ]
+				then
+					printf "\n\t\t(mac80211 station mode vif enabled on [${PHYDEV}]${1%mon})"
+					unset IW_ERROR
+				else
+					printf "\n\n ERROR: iw command error"
+				fi
+			fi
+			IW_ERROR=$(iw dev "${1}" del 2>&1 | grep "nl80211 not found")
+			if [ x$IW_ERROR = "x" ]
+			then
+				printf "\n\t\t(mac80211 monitor mode vif disabled for [${PHYDEV}]${1})"
+			else
+				if [ -f /sys/class/ieee80211/"${PHYDEV}"/remove_iface ]
+				then
+					printf "${1}" > /sys/class/ieee80211/"${PHYDEV}"/remove_iface
+					printf "\n\t\t(mac80211 monitor mode vif disabled for [${PHYDEV}]${1})"
+				else
+					printf "\n\nERROR: Neither the sysfs interface links nor the iw command is available.\nPlease download and install iw from\n$IW_SOURCE\n"
+				fi
+			fi
+		fi
+	fi
 }
 
 getDriver() {
-   if [ -e "/sys/class/net/$1/device/driver" ]
-   then
-       DRIVER="`ls -l "/sys/class/net/$1/device/driver" | sed 's/^.*\/$[a-zA-Z0-9_-]*$$/\1/'`"
-       BUS="`ls -l "/sys/class/net/$1/device/driver" | sed 's/^.*\/$[a-zA-Z0-9_-]*$\/.*\/.*$/\1/'`"
-   else
-       DRIVER=""
-       BUS=""
-   fi
-   if [ x$(echo $DRIVER | grep ath5k) != "x" ]
-   then
-       DRIVER="ath5k"
-   fi
-   if [ x$(echo $DRIVER | grep ath9k) != "x" ]
-   then
-       DRIVER="ath9k"
-   fi
-   if [ x$DRIVER = "x" ]
-   then
-	if [ -d /sys/class/net/tiwlan0/wireless ]
-	then
-		DRIVER=WiLink
-	fi
-   fi
+	#standard detection path, this is all that is needed for proper drivers
+	#DRIVER=$(printf "$ethtool_output" | awk '/driver/ {print $2}')
+
+	#if $(modinfo -n ${DRIVER} > /dev/null 2>&1)
+	#then
+	#	true
+	#else
+	#	unset DRIVER
+	#fi
+
+	#if [ "$DRIVER" = "" ]
+	#then
+		if [ -f /sys/class/net/$1/device/uevent ]
+		then
+			DRIVER="$(awk -F'=' '$1 == "DRIVER" {print $2}' /sys/class/net/$1/device/uevent)"
+		else
+			#DRIVER we put SOMETHING in DRIVER here if we are unable to find anything real
+			DRIVER="??????"
+		fi
+	#fi
+
+	#here we test for driver usb, ath9k_htc,rt2870, possibly others show this
+	if [ "$DRIVER" = "usb" ]
+	then
+		echo "Warn ON: USB"
+		BUSADDR="$(printf "$ethtool_output" | awk '/bus-info/ {print $2}'):1.0"
+
+		if [ "$DEBUG" = "1" ]
+		then
+			printf "${BUSADDR}\n"
 
+		fi
+
+		if [ "$BUSADDR" != "" ]
+		then
+			if [ -f /sys/class/net/$1/device/$BUSADDR/uevent ]
+			then
+				DRIVER="$(awk -F'=' '$1 == "DRIVER" {print $2}' /sys/class/net/$1/device/$BUSADDR/uevent)"
+			fi
+		fi
+
+		#here we can normalize driver names we don't like
+		if [ "$DRIVER" = "rt2870" ]
+		then
+			DRIVER="rt2870sta"
+		fi
+		if [ -f /sys/class/net/$1/device/idProduct ]
+		then
+			if [ $(cat /sys/class/net/$1/device/idProduct) = "3070" ]
+			then
+				DRIVER="rt3070sta"
+			fi
+		fi
+	fi
+	if [ "$DRIVER" = "rtl8187L" ]
+	then
+		DRIVER="r8187l"
+	fi
+	if [ "$DRIVER" = "rtl8187" ] && [ "$STACK" = "ieee80211" ]
+	then
+		DRIVER="r8187"
+	fi
+
+	#Here we will catch the broken lying drivers not caught above
+	#currently this only functions for pci devices and not usb since lsusb has no -k option
+	if [ "${MODINFO}" = 1 ]
+	then
+		if $(modinfo -n $DRIVER  > /dev/null 2>&1)
+		then
+			true
+		else
+			if [ "${DEVICEID}" != "" ] && [ "$BUS" = "pci" ]
+			then
+				DRIVER="$(lspci -d $DEVICEID -k | awk '/modules/ {print $3}')"
+			fi
+			if [ "$DRIVER" = "" ]
+			then
+				DRIVER="??????"
+			fi
+		fi
+	fi
+	if [ "$DEBUG" = "1" ]
+	then
+		printf "getdriver() $DRIVER\n"
+	fi
 }
 
-scanProcesses() {
-    if [ -f "`which service 2>&1`" ] && [ x"$1" = "xkill" ]
-    then
-    	service network-manager stop 2>/dev/null >/dev/null
- 	service avahi-daemon stop 2>/dev/null >/dev/null
-    fi
-
-    match=`ps -A -o comm= | grep $PROCESSES | grep -v grep | wc -l`
-    if [ $match -gt 0 -a x"$1" != "xkill" ]
-    then
-        printf "\n\n"
-        echo "Found $match processes that could cause trouble."
-        echo "If airodump-ng, aireplay-ng or airtun-ng stops working after"
-        echo "a short period of time, you may want to kill (some of) them!"
-        echo -e "\nPID\tName"
-    else
-        if [ x"$1" != "xkill" ]
-        then
-            return
-        fi
-    fi
-
-    if [ $match -gt 0 -a x"$1" = "xkill" ]
-    then
-        echo "Killing all those processes..."
-    fi
-
-    i=1
-    while [ $i -le $match ]
-    do
-        pid=`ps -A -o pid= -o comm= | grep $PROCESSES | grep -v grep | head -n $i | tail -n 1 | awk '{print $1}'`
-        pname=`ps -A -o pid= -o comm= | grep $PROCESSES | grep -v grep | head -n $i | tail -n 1 | awk '{print $2}'`
-        if [ x"$1" != "xkill" ]
-        then
-            printf "$pid\t$pname\n"
-        else
-            kill $pid
-        fi
-        i=$(($i+1))
-    done
+getFrom() {
+	#from detection
+	FROM="K"
+	if [ "${MODINFO}" = 1 ] && [ -f /proc/modules ]
+	then
+		if [ $(modinfo -n $DRIVER 2>&1 | grep 'kernel/drivers') ]
+		then
+			FROM="K"
+			#we add special handling here because we hate the vendor drivers AND they install in the wrong place
+			if [ "$DRIVER" = "r8187" ]
+			then
+				FROM="V"
+			elif [ "$DRIVER" = "r8187l" ]
+			then
+				FROM="V"
+			elif [ "$DRIVER" = "rt5390sta" ]
+			then
+				FROM="V"
+			fi
+		elif [ $(modinfo -n $DRIVER 2>&1 | grep 'updates/drivers') ]
+		then
+			FROM="C"
+		elif [ $(modinfo -n $DRIVER 2>&1 | grep misc) ]
+		then
+			FROM="V"
+			#add a yell at the user in here
+		else
+			FROM="?"
+		fi
+
+		#check for staging drivers seperately
+		if [ $(modinfo -n $DRIVER 2>&1 | grep staging) ]
+		then
+			FROM="S"
+	        fi
+	else
+		FROM="K"
+	fi
+	if [ "$DEBUG" = "1" ]
+	then
+		printf "getFrom() $FROM\n"
+	fi
 }
 
-checkProcessesIface() {
-    if [ x"$1" = "x" ]
-    then
-        return
-    fi
+getFirmware() {
+	FIRMWARE=$(printf "$ethtool_output" | awk '/firmware-version/ {print $2}')
+	#ath9k_htc firmware is a shorter version number than most so trap and make it pretty
+	if [ "$DRIVER" = "ath9k_htc" ]
+	then
+		FIRMWARE="$FIRMWARE\t"
+	fi
 
-    match2=`ps -o comm= -p 1 2>&1 | grep $PS_ERROR | grep -v grep | wc -l`
-    if [ $match2 -gt 0 ]
-    then
-	return
-    fi
+	if [ "$FIRMWARE" = "N/A" ]
+	then
+		FIRMWARE="$FIRMWARE\t"
+	elif [ -z "$FIRMWARE" ]
+	then
+		FIRMWARE="unavailable"
+	fi
+
+	if [ "$DEBUG" = "1" ]
+	then
+		printf "getFirmware $FIRMWARE\n"
+	fi
+
+}
+
+getChipset() {
+	#this needs cleanup, we shouldn't have multiple lines assigning chipset per bus
+	#fix this to be one line per bus
+	if [ -f /sys/class/net/$1/device/modalias ]
+	then
+		BUS=$(cat /sys/class/net/$1/device/modalias | cut -d ":" -f 1)
+		if [ "$BUS" = "usb" ]
+		then
+			BUSINFO=$(cat /sys/class/net/$1/device/modalias | cut -d ":" -f 2 | cut -b 1-10 | sed 's/^.//;s/p/:/')
+			CHIPSET=$(lsusb | grep -i "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')
+		#yes the below line looks insane, but broadcom appears to define all the internal buses so we have to detect them here
+		elif [ "${BUS}" = "pci" -o "${BUS}" = "pcmcia" ] && [ "${LSPCI}" = "1" ]
+		then
+			if [ -f /sys/class/net/$1/device/vendor -a -f /sys/class/net/$1/device/device ]
+			then
+				DEVICEID=$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)
+				CHIPSET=$(lspci -d $DEVICEID | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')
+			else
+				BUSINFO=$(printf "$ethtool_output" | grep bus-info | cut -d ":" -f "3-" | sed 's/^ //')
+				CHIPSET=$(lspci | grep "$BUSINFO" | head -n1 - | cut -f3- -d ":" | sed 's/Wireless LAN Controller //g;s/ Network Connection//g;s/ Wireless Adapter//;s/^ //')
+				DEVICEID=$(lspci -nn | grep "$BUSINFO" | grep '[[0-9][0-9][0-9][0-9]:[0-9][0-9][0-9][0-9]' -o)
+			fi
+		elif [ "${BUS}" = "sdio" ]
+		then
+			if [ -f /sys/class/net/$1/device/vendor -a -f /sys/class/net/$1/device/device ]
+			then
+				DEVICEID=$(cat /sys/class/net/$1/device/vendor):$(cat /sys/class/net/$1/device/device)
+			fi
+			CHIPSET="unable to detect for sdio $DEVICEID"
+		else
+			CHIPSET="Not pci, usb, or sdio"
+		fi
+	#we don't do a check for usb here but it is obviously only going to work for usb
+	elif [ -f /sys/class/net/$1/device/idVendor -a -f /sys/class/net/$1/device/idProduct ]
+	then
+		DEVICEID=$(cat /sys/class/net/$1/device/idVendor):$(cat /sys/class/net/$1/device/idProduct)
+		CHIPSET=$(lsusb | grep -i "$DEVICEID" | head -n1 - | cut -f3- -d ":" | sed 's/^....//;s/ Network Connection//g;s/ Wireless Adapter//g;s/^ //')
+	elif [ "${DRIVER}" = "mac80211_hwsim" ]
+	then
+		CHIPSET="Software simulator of 802.11 radio(s) for mac80211"
+	elif $(printf "$ethtool_output" | awk '/bus-info/ {print $2}' | grep -q bcma)
+	then
+		BUS="bcma"
 
-    for i in `ps auxw | grep $1 | grep -v "grep" | grep -v "airmon-ng" | awk '{print $2}'`
-    do
-        pname=`ps -o comm= -p $i`
-        echo "Process with PID $i ($pname) is running on interface $1"
-    done
+		if [ "${DRIVER}" = "brcmsmac" ] || [ "${DRIVER}" = "brcmfmac" ] || [ "${DRIVER}" = "b43" ]
+		then
+			CHIPSET="Broadcom on bcma bus, information limited"
+		else
+			CHIPSET="Unrecognized driver \"${DRIVER}\" on bcma bus"
+		fi
+	else
+		CHIPSET="non-mac80211 device? (report this!)"
+	fi
+
+	if [ "$DEBUG" = "1" ]
+	then
+		printf "getchipset() $CHIPSET\n"
+		printf "BUS = $BUS\n"
+		printf "BUSINFO = $BUSINFO\n"
+		printf "DEVICEID = $DEVICEID\n"
+	fi
 }
 
 getStack() {
-    if [ x"$1" = "x" ]
-    then
-        return
-    fi
-
-    if [ -d /sys/class/net/$1/phy80211/ ]
-    then
-        MAC80211=1
-    else
-        MAC80211=0
-    fi
+	if [ x"$1" = "x" ]
+	then
+		return
+	fi
+
+	if [ -d /sys/class/net/$1/phy80211/ ]
+	then
+		MAC80211=1
+		STACK="mac80211"
+	else
+		MAC80211=0
+		STACK="ieee80211"
+	fi
+
+	if [ -e /proc/sys/dev/$1/fftxqmin ]
+	then
+		MAC80211=0
+		STACK="net80211"
+	fi
+
+	if [ "$DEBUG" = "1" ]
+	then
+		printf "getStack $STACK\n"
+	fi
+
 }
 
-#you need to run getDriver $iface prior to getChipset
-getChipset() {
-    if [ x"$1" = "x" ]
-    then
-        return
-    fi
+getExtendedInfo() {
+	if [ "$DRIVER" = "??????" ]
+	then
+		EXTENDED="\t Failure detecting driver properly please report"
+	fi
+
+	#first we set all the real (useful) info we can find
+	if [ -f /sys/class/net/$1/device/product ]
+	then
+		EXTENDED="\t$(cat /sys/class/net/$1/device/product)"
+	fi
+
+	#then we sweep for known broken drivers with no available better drivers
+	if [ "$DRIVER" = "brcmsmac" ]
+	then
+		EXTENDED="Driver commonly referred to as brcm80211 (no injection yet)"
+	fi
+	if [ "$DRIVER" = "r8712u" ]
+	then
+		EXTENDED="\t\t\t\tNo monitor or injection support\n"
+	fi
 
-    CHIPSET="Unknown "
+	#lastly we detect all the broken drivers which have working alturnatives
+	KV=$(uname -r | awk -F'-' '{print $1}')
+	KVMAJOR=$(printf ${KV} | awk -F'.' '{print $1$2}')
+	KVMINOR=$(printf ${KV} | awk -F'.' '{print $3}')
 
-    if [ x$DRIVER = "xOtus" -o x$DRIVER = "xarusb_lnx" ]
-    then
-		CHIPSET="AR9001U"
-    fi
+	if [ $KVMAJOR -lt 26 ]
+	then
+		printf "You are running a kernel older than 2.6, I'm surprised it didn't error before now."
+	        if [ "$DEBUG" = "1" ]
+	        then
+			printf ${KVMAJOR} ${KVMINOR}
+		fi
+		exit 1
+	fi
 
-    if [ x$DRIVER = "xWiLink" ]
-    then
-	CHIPSET=`dmesg | grep TIWLAN | grep CHIP | tail -n 1 | awk -F\  '{ print $6 }'` 
-   	if [ x$CHIPSET = "x" ]
+	if [ "$DRIVER" = "rt2870sta" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "35" ]
+		then
+			EXTENDED="\tBlacklist rt2870sta and use rt2800usb"
+		else
+			EXTENDED="\tUpgrade to kernel 2.6.35 or install compat-wireless stable"
+		fi
+		#add in a flag for "did you tell use to do X" and emit instructions
+	elif [ "$DRIVER" = "rt3070sta" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "35" ]
+		then
+			EXTENDED="\tBlacklist rt3070sta and use rt2800usb"
+		else
+			EXTENDED="\tUpgrade to kernel 2.6.35 or install compat-wireless stable"
+		fi
+	elif [ "$DRIVER" = "rt5390sta" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "39" ]
+		then
+			EXTENDED="\tBlacklist rt5390sta and use rt2800usb"
+		else
+			EXTENDED="\tUpgrade to kernel 2.6.39 or install compat-wireless stable"
+		fi
+	elif [ "$DRIVER" = "ar9170usb" ]
 	then
-		CHIPSET="Unknown"
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "37" ]
+		then
+			EXTENDED="\tBlacklist ar9170usb and use carl9170"
+		else
+			EXTENDED="\tUpgrade to kernel 2.6.37 or install compat-wireless stable"
+		fi
+	elif [ "$DRIVER" = "arusb_lnx" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "37" ]
+		then
+			EXTENDED="\tBlacklist arusb_lnx and use carl9170"
+		else
+			EXTENDED="\tUpgrade to kernel 2.6.37 or install compat-wireless stable"
+		fi
+	elif [ "$DRIVER" = "r8187" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "29" ]
+		then
+			EXTENDED="\t\tBlacklist r8187 and use rtl8187 from the kernel"
+		else
+			EXTENDED="\t\tUpgrade to kernel 2.6.29 or install compat-wireless stable"
+		fi
+	elif [ "$DRIVER" = "r8187l" ]
+	then
+		if [ "$KVMAJOR" = "26" ] && [ "$KVMINOR" -ge "29" ]
+		then
+			EXTENDED="\t\tBlacklist r8187l and use rtl8187 from the kernel"
+		else
+			EXTENDED="\t\tUpgrade to kernel 2.6.29 or install compat-wireless stable"
+		fi
+	fi
+}
+
+scanProcesses() {
+	#this test means it errored and said it was busybox since busybox doesn't print without error
+	if (ps -A 2>&1 | grep -q BusyBox)
+	then
+		#busybox in openwrt cannot handle -A but its output by default is -A
+		psopts=""
 	else
-		CHIPSET="TI${CHIPSET}"	
-	fi 
-    fi
-    
-    if [ x$DRIVER = "xar9170usb" ]
-    then
-    	getPhy $2
-    	CHIPSET="Atheros `dmesg | grep $PHYDEV | grep "is registered as" | cut -d':' -f 2 | cut -d' ' -f 3`"
-    fi
-
-    if [ x$DRIVER = "xzd1211rw_mac80211" ]
-    then
-        CHIPSET="ZyDAS 1211"
-    fi
-
-	if [ x$DRIVER = "xzd1211rw" ]
-    then
-        getPhy $2
-        TEMP_USBPORT="`dmesg | grep $PHYDEV | grep zd1211rw | cut -d'w' -f 2 | cut -d' ' -f 2`"
-        TEMP_CHIPSET="`dmesg | grep "$TEMP_USBPORT" | grep chip | tail -n 1 | cut -d':' -f 3 | cut -d' ' -f 2`"
-        CHIPSET="Zydas $TEMP_CHIPSET"
-    fi
-
-    if [ x$DRIVER = "xacx" -o x$DRIVER = "xacx-mac80211" -o x$DRIVER = "xacx1xx" ]
-    then
-        CHIPSET="TI ACX1xx"
-    fi
-
-    if [ x$DRIVER = "adm8211" ]
-    then
-        CHIPSET="ADMtek 8211"
-    fi
-
-    if [ x$DRIVER = "xat76_usb" ]
-    then
-        CHIPSET="Atmel   "
-    fi
-
-    if [ x$DRIVER = "xb43" -o x$DRIVER = "xb43legacy" -o x$DRIVER = "xbcm43xx" -o x$DRIVER = "xwl" ]
-    then
-        CHIPSET="Broadcom"
-        if [ x$DRIVER = "xb43" ]
-        then
-        	getPhy $2
-        	TEMP_CHIPSET="`dmesg | grep $PHYDEV | grep found | cut -d':' -f 2 | cut -d' ' -f 3`"
-        	if [ x$TEMP_CHIPSET = "x4318" ]
-        	then
-        		CHIPSET="$CHIPSET $TEMP_CHIPSET"
-        	fi
-        fi
-    fi
-
-    if [ x$DRIVER = "xprism54" -o x$DRIVER = "xp54pci" -o x$DRIVER = "xp54usb" ]
-    then
-        CHIPSET="PrismGT "
-    fi
-
-    if [ x$DRIVER = "xhostap" ]
-    then
-        CHIPSET="Prism 2/2.5/3"
-    fi
-
-    if [ x$DRIVER = "xr8180" -o x$DRIVER = "xrtl8180" ]
-    then
-        CHIPSET="RTL8180/RTL8185"
-    fi
-
-    # r8187 is reporting itself as rtl8187
-    if [ x$DRIVER = "xrtl8187" ]
-    then
-        getPhy $2
-       if [ x"$PHYDEV" = "x" ]
-       then
-               CHIPSET="RTL8187 "
-       else
-               CHIPSET="`dmesg | grep $PHYDEV | grep hwaddr | cut -d',' -f 2 | cut -d' ' -f 2`"
-               if [ x$CHIPSET = "xRTL8187vB" ]
-               then
-                       CHIPSET="Realtek RTL8187L"
-               else
-                       CHIPSET="Realtek $CHIPSET"
-               fi
-       fi
-    fi
-    
-    if [ x$DRIVER = "xr8187" ]
-    then
-        CHIPSET="RTL8187 "
-    fi
-
-    if [ x$DRIVER = "xrt2570" -o x$DRIVER = "xrt2500usb" ]
-    then
-        CHIPSET="Ralink 2570 USB"
-    fi
-
-    if [ x$DRIVER = "xrt2400" -o x$DRIVER = "xrt2400pci" ]
-    then
-        CHIPSET="Ralink 2400 PCI"
-    fi
-
-    if [ x$DRIVER = "xrt2500" -o x$DRIVER = "xrt2500pci" ]
-    then
-        CHIPSET="Ralink 2560 PCI"
-    fi
-
-    if [ x$DRIVER = "xrt61" -o x$DRIVER = "xrt61pci" ]
-    then
-        CHIPSET="Ralink 2561 PCI"
-    fi
-
-    if [ x$DRIVER = "xrt73" -o x$DRIVER = "xrt73usb" ]
-    then
-        CHIPSET="Ralink 2573 USB"
-    fi
-
-	#if [ x$DRIVER = "xrt2800usb" ]
+		psopts="-A"
+	fi
+	if ( ps -o comm= 2>&1 | grep -q BusyBox )
+	then
+		#busybox in openwrt cannot handle -o
+		pso=0
+	else
+		pso=1
+	fi
+
+	PROCESSES="wpa_action\|wpa_supplicant\|wpa_cli\|dhclient\|ifplugd\|dhcdbd\|dhcpcd\|udhcpc\|NetworkManager\|knetworkmanager\|avahi-autoipd\|avahi-daemon\|wlassistant\|wifibox"
+	#PS_ERROR="invalid\|illegal"
+
+	if [ -f "$(command -v service 2>&1)" ] && [ x"$1" = "xkill" ]
+	then
+		service network-manager stop 2> /dev/null > /dev/null
+		service avahi-daemon stop 2> /dev/null > /dev/null
+	fi
+
+	unset match
+	if [ ${pso} = 1 ]
+	then
+		match=$(ps ${psopts} -o comm= | grep -c ${PROCESSES})
+	elif [ ${pso} = 0 ]
+	then
+		#openwrt busybox grep hits on itself so we -v it out
+		match=$(ps ${psopts} | grep -c ${PROCESSES} | grep -v grep) 
+	fi
+	if [ ${match} -gt 0 -a x"${1}" != "xkill" -a x"${1}" = "x" ]
+	then
+		printf "Found $match processes that could cause trouble.\n"
+		printf "If airodump-ng, aireplay-ng or airtun-ng stops working after\n"
+		printf "a short period of time, you may want to kill (some of) them!\n\n"
+		#printf "\nPID\tName\n"
+	else
+		if [ x"${1}" != "xkill" -a x"${1}" = "x" ]
+		then
+			echo "No interfering processes found"
+			return
+		fi
+	fi
+
+	if [ ${match} -gt 0 ]
+	then
+		if [ x"${1}" = "xkill" ]
+		then
+			printf "Killing these processes:\n\n"
+		fi
+		if [ ${pso} = 1 ]
+		then
+			ps ${psopts} -o pid=PID -o comm=Name | grep "${PROCESSES}\|PID"
+		else
+			#openwrt busybox grep hits on itself so we -v it out
+			ps ${psopts} | grep "${PROCESSES}\|PID | grep -v grep"
+		fi
+		if [ x"${1}" = "xkill" ]
+		then
+			#we have to use signal 9 because things like nm actually respawn wpa_supplicant too quickly
+			if [ ${pso} = 1 ]
+			then
+				for pid in $(ps ${psopts} -o pid= -o comm= | grep ${PROCESSES} | awk '{print $1}')
+				do
+					kill -9 ${pid}
+				done
+			else
+				#openwrt busybox grep hits on itself so we -v it out
+				for pid in $(ps ${psopts} | grep ${PROCESSES} | grep -v grep | awk '{print $1}')
+				do
+					kill -9 ${pid}
+				done
+			fi
+		fi
+	fi
+
+	#i=1
+	#while [ $i -le $match ]
+	#do
+	#	pid=$(ps ${psopts} -o pid= -o comm= | grep $PROCESSES | head -n $i | tail -n 1 | awk '{print $1}')
+	#	pname=$(ps ${psopts} -o pid= -o comm= | grep $PROCESSES | head -n $i | tail -n 1 | awk '{print $2}')
+	#	if [ x"$1" != "xkill" ]
+	#	then
+	#		printf "${pid}\t${pname}\n"
+	#	else
+	#		kill ${pid}
+	#	fi
+	#	i=$(($i+1))
+	#done
+
+	printf "\n"
+
+	#this stub is for checking against the interface name, but since it almost never hits why bother?
+	#if [ x"${1}" != "x" -a x"${1}" != "xkill" ]
 	#then
-	#	getPhy $2
-	#	CHIPSET="Ralink `dmesg | grep rt2800usb | grep firmware | cut -d':' -f 4 | cut -d' ' -f 3 | cut -d'.' -f 1`"
+	#	#the next line doesn't work on busybox ps because -p is unimplimented
+	#	match2=$(ps -o comm= -p 1 2>&1 | grep $PS_ERROR -c)
+	#	if [ ${match2} -gt 0 ]
+	#	then
+	#		return
+	#	fi
+	#
+	#	for i in $(ps auxw | grep ${1} | grep -v "grep" | grep -v "airmon-ng" | awk '{print $2}')
+	#	do
+	#		pname=$(ps -o comm= -p ${i})
+	#		printf "Process with PID ${i} ($pname) is running on interface ${1}\n"
+	#	done
 	#fi
-	
-    if [ x$DRIVER = "xrt2800" -o x$DRIVER = "xrt2800usb" -o x$DRIVER = "xrt3070sta" ]
-    then
-        CHIPSET="Ralink RT2870/3070"
-    fi
-
-    if [ x$DRIVER = "xipw2100" ]
-    then
-        CHIPSET="Intel 2100B"
-    fi
-
-    if [ x$DRIVER = "xipw2200" ]
-    then
-        CHIPSET="Intel 2200BG/2915ABG"
-    fi
-
-    if [ x$DRIVER = "xipw3945" -o x$DRIVER = "xipwraw" -o x$DRIVER = "xiwl3945" ]
-    then
-        CHIPSET="Intel 3945ABG"
-    fi
-
-    if [ x$DRIVER = "xipw4965" -o x$DRIVER = "xiwl4965" ]
-    then
-        CHIPSET="Intel 4965AGN"
-    fi
-
-    if [ x$DRIVER = "xiwlagn" -o x$DRIVER = "xiwlwifi" ]
-    then
-        CHIPSET="Intel 4965/5xxx/6xxx/1xxx"
-        
-        DETECTED_STR="`dmesg | grep $DRIVER | grep Detected | tail -n 1 `"
-        LINK_POS="3"
-        FOUND="0"
-        
-        if [ x"$DETECTED_STR" != "x" ]
-        then
-        	INTEL_WORD="Link"
-        	if [ "`echo "$DETECTED_STR" | grep $INTEL_WORD | wc -l`" = "0" ]
-        	then
-        		INTEL_WORD="Wireless"
-        		if [ "`echo "$DETECTED_STR" | grep $INTEL_WORD | wc -l`" = "0" ]
+}
+
+listInterfaces() {
+	unset iface_list
+	for iface in $(ls -1 /sys/class/net)
+	do
+		if [ -f /sys/class/net/${iface}/uevent ]; then
+			if $(grep -q DEVTYPE=wlan /sys/class/net/${iface}/uevent)
 			then
-				INTEL_WORD="Ultimate"
-        			if [ "`echo "$DETECTED_STR" | grep $INTEL_WORD | wc -l`" = "0" ]
-				then
-						INTEL_WORD="Advanced"
-	        		fi	
+				iface_list="${iface_list}\n ${iface}"
 			fi
-        	fi
-        	
-        	while [ $FOUND = "0" ]
+		fi
+	done
+	if [ -x "$(command -v iwconfig 2>&1)" ] && [ -x "$(command -v sort 2>&1)" ]
+	then
+		for iface in $(iwconfig 2> /dev/null | sed 's/^$[a-zA-Z0-9_.]*$ .*/\1/')
 		do
-			FOUND=`echo "$DETECTED_STR" | cut -d' ' -f $LINK_POS | grep $INTEL_WORD | wc -l`
-			LINK_POS=$(($LINK_POS+1))
+			iface_list="${iface_list}\n ${iface}"
 		done
-
-		TEMP_CHIPSET=`echo "$DETECTED_STR" | cut -d' ' -f $LINK_POS`
-
-		case "x${TEMP_CHIPSET}" in
-	#               x5100AGN)
-	#                       CHIPSET="Intel $TEMP_CHIPSET"
-	#                       ;;
-			x5300)
-				TYPE_TEMP=`echo "$DETECTED_STR" | cut -d' ' -f $(($LINK_POS+1)) | awk -F, '{ print $1 }' `
-				CHIPSET="Intel ${TEMP_CHIPSET}${TYPE_TEMP}"
-				;;
-			x1000)
-				TYPE_TEMP=`echo "$DETECTED_STR" | cut -d' ' -f $[$LINK_POS+2]`
-				CHIPSET="Intel ${TEMP_CHIPSET}${TYPE_TEMP}"
-				;;
-			*)
-				CHIPSET="Intel $TEMP_CHIPSET"
-				;;
-		esac
-        fi
-
-    fi
-
-	if [ x$DRIVER = "xath5k" ]
-	then
-		getPhy $2
-		CHIPSET="Atheros `dmesg | grep $PHYDEV | grep "chip found" | cut -d':' -f 2 | cut -d' ' -f 3`"
-	fi
-	
-    if [ x$DRIVER = "xath_pci" ]
-    then
-        CHIPSET="Atheros "
-    fi
-    
-    if [ x$DRIVER = "xath9k" ]
-    then
-    	getPhy $2
-    	CHIPSET="Atheros `dmesg | grep $PHYDEV | grep Atheros | tail -n 1 | cut -d':' -f 2 | cut -d' ' -f 3`"
-    fi
-
-    if [ x$DRIVER = "xorinoco" ]
-    then
-        CHIPSET="Hermes/Prism"
-    fi
-    
-    if [ x$DRIVER = "xath9k_htc" -o x$DRIVER = "xusb" ]
-    then
-        CHIPSET="AR9001/9002/9271"
-    fi
-    
-    if [ x$DRIVER = "xwl12xx" ]
-    then
-            CHIPSET="TI WL1251/WL1271"
-            IS_WL1251="`dmesg| grep firmware | grep wl1251 | wc -l`"
-            IS_WL1271="`dmesg| grep firmware | grep wl1271 | wc -l`"
-
-            if [ $IS_WL1251 != "0" ] && [ $IS_WL1271 = "0" ]
-            then
-                CHIPSET="TI WL1251"
-            fi
-            if [ $IS_WL1271 != "0" ] && [ $IS_WL1251 = "0" ]
-            then
-                CHIPSET="TI WL1271"
-            fi
-            # In any other case, we can't determine the chipset and thus give the generic: 1251/1271
-    fi
-    
-    
-    if [ x$DRIVER = "xr871x_usb_drv" ]
-    then
-            CHIPSET="Realtek 81XX"
-    fi
-    
-    if [ x$DRIVER = "xcarl9170" ]
-    then
-            getPhy $2
-            CHIPSET=`dmesg | grep usb | grep $PHYDEV | awk -F\  '{ print $3 " " $4 }'`
-	    if [ `echo $CHIPSET | grep -i atheros | wc -l` -eq 0 ]
-	    then
-		CHIPSET=`dmesg | grep usb | grep $PHYDEV | awk -F\  '{ print $5 " " $6 }'`
-	    fi
-    fi
+		iface_list="$(printf "${iface_list}" | sort -bu)"
+	fi
 }
 
 getPhy() {
-    PHYDEV=""
-    if [ x"$1" = "x" ]
-    then
-        return
-    fi
-
-    if [ x$MAC80211 = "x" ]
-    then
-        return
-    fi
-
-    if [ -d /sys/class/net/$1/phy80211/ ]
-    then
-	PHYDEV="`ls -l "/sys/class/net/$1/phy80211" | sed 's/^.*\/$[a-zA-Z0-9_-]*$$/\1/'`"
-    fi
+	if [ x"$1" = "x" ]
+	then
+		return
+	fi
+
+	if [ $MAC80211 = "0" ]
+	then
+		PHYDEV="null"
+		return
+	fi
+
+	if [ -d /sys/class/net/$1/phy80211/name ]
+	then
+		PHYDEV="$(cat /sys/class/net/$1/phy80211/name)"
+	fi
+	if [ -d /sys/class/net/$1/phy80211/ ] && [ -z ${PHYDEV} ]
+	then
+
+		PHYDEV="$(ls -l "/sys/class/net/$1/phy80211" | sed 's/^.*\/$[a-zA-Z0-9_-]*$$/\1/')"
+	fi
 }
 
-getNewMon() {
-    i=0
+checkvm() {
+	#this entire section of code is completely stolen from Carlos Perez's work in checkvm.rb for metasploit and rewritten (poorly) in sh
+	#Check dmi info
+	if [ -x "$(command -v dmidecode 2>&1)" ]
+	then
+		dmi_info=$(dmidecode)
+		if [ dmi_info ]
+		then
+			echo ${dmi_info} | grep -iq "microsoft corporation" 2> /dev/null && vm="MS Hyper-V"
+			echo ${dmi_info} | grep -iq "vmware" 2> /dev/null && vm="VMware"
+			echo ${dmi_info} | grep -iq "virtualbox" 2> /dev/null && vm="VirtualBox"
+			echo ${dmi_info} | grep -iq "qemu" 2> /dev/null && vm="Qemu/KVM"
+			echo ${dmi_info} | grep -iq "domu" 2> /dev/null && vm="Xen"
+			vm_from="dmi_info"
+		fi
+	fi
 
-    while [ -d /sys/class/net/$MON_PREFIX$i/ ]
-    do
-        i=$(($i+1))
-    done
+	#check loaded modules
+	if [ -z ${vm_from} ]
+	then
+		if [ -x "$(command -v lsmod 2>&1)" ]
+		then
+			lsmod_data=$(lsmod)
+			if [ lsmod ]
+			then
+				echo ${lsmod_data} | grep -iqE "vboxsf|vboxguest" 2> /dev/null && vm="VirtualBox"
+				echo ${lsmod_data} | grep -iqE "vmw_ballon|vmxnet|vmw" 2> /dev/null && vm="VMware"
+				echo ${lsmod_data} | grep -iqE "xen-vbd|xen-vnif" 2> /dev/null && vm="Xen"
+				echo ${lsmod_data} | grep -iqE "virtio_pci|virtio_net" 2> /dev/null && vm="Qemu/KVM"
+				echo ${lsmod_data} | grep -iqE "hv_vmbus|hv_blkvsc|hv_netvsc|hv_utils|hv_storvsc" && vm="MS Hyper-V"
+				vm_from="lsmod"
+			fi
+		fi
+	fi
 
-    MONDEV="$MON_PREFIX$i"
+	#check scsi driver
+	if [ -z ${vm_from} ]
+	then
+		if [ -f /proc/scsi/scsi ]
+		then
+			grep -iq "vmware" /proc/scsi/scsi 2> /dev/null && vm="VMware"
+			grep -iq "vbox" /proc/scsi/scsi 2> /dev/null && vm="VirtualBox"
+			vm_from="/pro/scsi/scsi"
+		fi
+	fi
+
+	# Check IDE Devices
+	if [ -z ${vm_from} ]
+	then
+		if [ -d /proc/ide ]
+		then
+			ide_model=$(cat /proc/ide/hd*/model)
+			echo ${ide_model} | grep -iq "vbox" 2> /dev/null && vm="VirtualBox"
+			echo ${ide_model} | grep -iq "vmware" 2> /dev/null && vm="VMware"
+			echo ${ide_model} | grep -iq "qemu" 2> /dev/null && vm="Qemu/KVM"
+			echo ${ide_model} | grep -iqE "virtual (hd|cd)" 2> /dev/null && vm="Hyper-V/Virtual PC"
+			vm_from="ide_model"
+		fi
+	fi
+
+	# Check using lspci
+	if [ -z ${vm_from} ] && [ "${LSPCI}" = "1" ]
+	then
+			lspci_data=$(lspci)
+			echo ${lspci_data} | grep -iq "vmware" 2> /dev/null && vm="VMware"
+			echo ${lspci_data} | grep -iq "virtualbox" 2> /dev/null && vm="VirtualBox"
+			vm_from="lspci"
+	fi
+
+	# Xen bus check
+	## XXX: Removing unsafe check
+	# this check triggers if CONFIG_XEN_PRIVILEGED_GUEST=y et al are set in kconfig (debian default) even in not actually a guest
+	#if [ -z ${vm} ]
+	#then
+	#	ls -1 /sys/bus | grep -iq "xen" 2> /dev/null && vm="Xen"
+	#	vm_from="/sys/bus/xen"
+	#fi
+
+	# Check using lscpu
+	if [ -z ${vm_from} ]
+	then
+		if [ -x "$(command -v lscpu 2>&1)" ]
+                then
+                        lscpu_data=$(lscpu)
+			echo ${lscpu_data} | grep -iq "Xen" 2> /dev/null && vm="Xen"
+			echo ${lscpu_data} | grep -iq "KVM" 2> /dev/null && vm="KVM"
+			echo ${lscpu_data} | grep -iq "Microsoft" 2> /dev/null && vm="MS Hyper-V"
+			vm_from="lscpu"
+		fi
+	fi
+
+	#Check vmnet
+	if [ -z ${vm_from} ]
+	then
+		if [ -e /dev/vmnet ]
+		then
+			vm="VMware"
+			vm_from="/dev/vmnet"
+		fi
+	fi
+
+	# Check dmesg Output
+	if [ -z ${vm_from} ]
+	then
+		if [ -x "$(command -v dmesg 2>&1)" ]
+                then
+			dmesg_output=$(dmesg)
+			echo ${dmesg_output} | grep -iqE "vboxbios|vboxcput|vboxfacp|vboxxsdt|(vbox cd-rom)|(vbox harddisk)" && vm="VirtualBox"
+			echo ${dmesg_output} | grep -iqE "(vmware virtual ide)|(vmware pvscsi)|(vmware virtual platform)" && vm="VMware"
+			echo ${dmesg_output} | grep -iqE "(xen_mem)|(xen-vbd)" && vm="Xen"
+			echo ${dmesg_output} | grep -iqE "(qemu virtual cpu version)" && vm="Qemu/KVM"
+			vm_from="dmesg"
+		fi
+	fi
 }
 
-if [ x"`which id 2> /dev/null`" != "x" ]
-then
-	USERID="`id -u 2> /dev/null`"
-fi
+#end function definitions
+#begin execution
 
-if [ x$USERID = "x" -a x$UID != "x" ]
+listInterfaces
+
+#this should only run for start in elite mode? or should we have different warnings?
+if [ x"${1}" = "xcheck" ] || [ x"${1}" = "xstart" ]
 then
-	USERID=$UID
+	if [ x"${2}" = "xkill" ]
+	then
+		#if we are killing, tell scanProcesses that
+		scanProcesses "${2}"
+		return
+	elif [ x"${1}" = "xstart" ]
+	then
+		#this stub can send scanProcesses the interface name
+		#but this seems entirely unreliable so just run generic
+		#scanProcesses "${2}"
+		scanProcesses
+	else
+		scanProcesses
+		exit
+	fi
 fi
 
-if [ x$USERID != "x" -a x$USERID != "x0" ]
+if [ $# -ne "0" ]
 then
-	echo Run it as root ; exit ;
+	if [ x$1 != "xstart" ] && [ x$1 != "xstop" ]
+	then
+		usage
+	fi
+
+	if [ x$2 = "x" ]
+	then
+		usage
+	fi
 fi
 
-iwpriv > /dev/null 2> /dev/null ||
-  { echo Wireless tools not found ; exit ; }
+#startup checks complete, headers then main
 
-if [ x"$1" = "xcheck" ] || [ x"$1" = "xstart" ]
+if [ "$DEBUG" = "1" ]
 then
-    scanProcesses
-    for iface in `iwconfig 2>/dev/null | egrep '(IEEE|ESSID|802\.11|WLAN)' | sed 's/^$[a-zA-Z0-9_.]*$ .*/\1/' | grep -v wifi`
-    do
-#         getModule $iface
-#         getDriver $iface
-        checkProcessesIface $iface
-    done
-
-    if [ x"$2" = "xkill" ]
-    then
-        scanProcesses "$2"
-    fi
-    if [ x"$1" = "xcheck" ]
-    then
-        exit
-    fi
+	if [ -x "$(command -v readlink 2>&1)" ]
+	then
+		printf "/bin/sh -> $(readlink -f /bin/sh)\n"
+		if $(readlink -f /bin/sh) --version > /dev/null 2>&1
+		then
+			printf "$($(readlink -f /bin/sh) --version)\n"
+		fi
+	else
+		ls -l /bin/sh
+		if /bin/sh --version > /dev/null 2>&1
+		then
+			/bin/sh --version
+		fi
+	fi
+	if [ $SHELL ]
+	then
+		if $SHELL --version > /dev/null 2>&1
+		then
+			printf "\nSHELL is $($SHELL --version)\n\n"
+		else
+			printf "\nSHELL is $SHELL\n\n"
+		fi
+	fi
 fi
+if [ "$VERBOSE" = "1" ]
+then
+	lsb_release -a
+	printf "\n"
+	uname -a
 
-printf "\n\n"
+	checkvm
+	if [ ${vm} ]
+	then
+		printf "Detected VM using ${vm_from}\n"
+		printf "This appears to be a ${vm} Virtual Machine\n"
+		printf "If your system supports VT-d, it may be possible to use PCI devices\n"
+		printf "If your system does not support VT-d, you can only use USB wifi cards\n"
+	fi
 
-if [ $# -ne "0" ]
-then
-    if [ x$1 != "xstart" ] && [ x$1 != "xstop" ]
-    then
-        usage
-    fi
-
-    if [ x$2 = "x" ]
-    then
-        usage
-    fi
+	printf "\nK indicates driver is from $(uname -r)\n"
+	if [ "${MODPROBE}" = 1 ]
+	then
+		modprobe compat > /dev/null 2>&1
+
+		if [ -f /sys/module/compat/parameters/compat_version ]
+		then
+			printf "C indicates driver is from $(cat /sys/module/compat/parameters/compat_version)\n"
+		fi
+	fi
+	printf "V indicates driver comes directly from the vendor, almost certainly a bad thing\n"
+	printf "S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE\n"
+	printf "? indicates we do not know where the driver comes from... report this\n\n"
 fi
 
-SYSFS=0
-if [ -d /sys/ ]
+if [ ${VERBOSE} = "1" ]
 then
-    SYSFS=1
+	printf "\nX[PHY]Interface\t\tDriver[Stack]-FirmwareRev\t\tChipset\t\t\t\t\t\t\t\t\t\tExtended Info\n\n"
+else
+	printf "PHY\tInterface\tDriver\t\tChipset\n\n"
 fi
 
-printf "Interface\tChipset\t\tDriver\n\n"
+#this whole block of code shouldn't be here, it makes no sense
+for iface in listIfaceUnspec
+do
 
+	if [ -e "/proc/sys/dev/$iface/fftxqmin" ]
+	then
+		setLink ${iface} up
+		printf "$iface\t\tAtheros\t\tmadwifi-ng"
+		if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
+		then
+			IFACE=$(wlanconfig ath create wlandev $iface wlanmode monitor -bssid | grep ath)
+			setLink ${iface} up
+			if [ $CH -lt 1000 ]
+			then
+				iwconfig $IFACE channel $CH 2> /dev/null > /dev/null
+			else
+				iwconfig $IFACE freq "$CH"000000 2> /dev/null > /dev/null
+			fi
+		setLink ${IFACE} up
+		UDEV_ISSUE=$?
+		fi
 
-for iface in `ifconfig -a 2>/dev/null | egrep UNSPEC | sed 's/^$[a-zA-Z0-9_]*$ .*/\1/'`
-do
+		if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
+		then
+			printf "$iface does not support 'stop', do it on ath interface\n"
+		fi
 
- if [ x"`iwpriv $iface 2>/dev/null | grep ipwraw-ng`" != "x" ]
- then
-        printf "$iface\t\tIntel 3945ABG\tipwraw-ng"
-        if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-        then
-                cp $KISMET~ $KISMET 2>/dev/null &&
-                echo "source=ipw3945,$iface,Centrino_abg" >>$KISMET
-                startStdIface $iface $CH
-                iwconfig $iface rate 1M 2> /dev/null >/dev/null
-                iwconfig $iface txpower 16 2> /dev/null >/dev/null
-        fi
-        if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-        then
-                stopStdIface $iface
-                iwconfig $iface txpower 15 2> /dev/null >/dev/null
-                iwconfig $iface rate 54M 2> /dev/null >/dev/null
-        fi
-        echo
-        continue
- fi
-
- if [ -e "/proc/sys/dev/$iface/fftxqmin" ]
- then
-    MADWIFI=1
-    ifconfig $iface up
-    printf "$iface\t\tAtheros\t\tmadwifi-ng"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-        IFACE=`wlanconfig ath create wlandev $iface wlanmode monitor -bssid | grep ath`
-        cp $KISMET~ $KISMET 2>/dev/null &&
-        echo "source=madwifi_g,$iface,Atheros" >>$KISMET
-        ifconfig $iface up 2>/dev/null >/dev/null
-        if [ $CH -lt 1000 ]
-        then
-            iwconfig $IFACE channel $CH 2>/dev/null >/dev/null
-        else
-            iwconfig $IFACE freq "$CH"000000 2>/dev/null >/dev/null
-        fi
-        ifconfig $IFACE up 2>/dev/null >/dev/null
-        UDEV_ISSUE=$?
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-            echo "$iface does not support 'stop', do it on ath interface"
-    fi
-    echo
-    continue
- fi
+		#why, dear god why is there a random newline here?
+		printf "\n"
+		sleep 1s
+		continue
+	fi
 done
+#end random block of code that needs to die
 
-if [ $MADWIFI -eq 1 ]
-then
-	sleep 1s
-fi
-
-for iface in `iwconfig 2>/dev/null | egrep '(IEEE|ESSID|802\.11|WLAN)' | sed 's/^$[a-zA-Z0-9_.]*$ .*/\1/' | grep -v wifi`
+for iface in $(printf "${iface_list}")
 do
- getModule  $iface
- getDriver  $iface
- getStack   $iface
- getChipset $DRIVER $iface
-
-
- if [ x$MAC80211 = "x1" ]
- then
-    getPhy $iface
-    getNewMon
-    printf "$iface\t\t$CHIPSET\t$DRIVER - [$PHYDEV]"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-        if [ $USE_IW = 1 ]
-        then
-            IW_ERROR=`iw dev $iface interface add $MONDEV type monitor 2>&1 | grep "nl80211 not found"`
-            if [ x$IW_ERROR = "x" ]
-            then
-                sleep 1s
-		if [ ! -z $3 ]
-                then
-            	    if [ $3 -lt 1000 ]
-            	    then
-                	iwconfig $MONDEV channel $3 >/dev/null 2>&1
-            	    else
-                	iwconfig $MONDEV freq "$3"000000 >/dev/null 2>&1
-            	    fi
-            	fi
-                ifconfig $MONDEV up
-                printf "\n\t\t\t\t(monitor mode enabled on $MONDEV)"
-            else
-                if [ -f /sys/class/ieee80211/"$PHYDEV"/add_iface ]
-                then
-                    echo -n "$MONDEV" > /sys/class/ieee80211/"$PHYDEV"/add_iface
-                    sleep 1s
-                    if [ $3 -lt 1000 ]
-                    then
-                        iwconfig $MONDEV mode Monitor channel $3 >/dev/null 2>&1
-                    else
-                        iwconfig $MONDEV mode Monitor freq "$3"000000 >/dev/null 2>&1
-                    fi
-                    ifconfig $MONDEV up
-                    printf "\n\t\t\t\t(monitor mode enabled on $MONDEV)"
-                else
-                    printf "\n\nERROR: nl80211 support is disabled in your kernel.\nPlease recompile your kernel with nl80211 support enabled.\n"
-                fi
-            fi
-        else
-            if [ -f /sys/class/ieee80211/"$PHYDEV"/add_iface ]
-            then
-                echo -n "$MONDEV" > /sys/class/ieee80211/"$PHYDEV"/add_iface
-                sleep 1s
-                if [ $3 -lt 1000 ]
-                then
-                    iwconfig $MONDEV mode Monitor channel $3 >/dev/null 2>&1
-                else
-                    iwconfig $MONDEV mode Monitor freq "$3"000000 >/dev/null 2>&1
-                fi
-                ifconfig $MONDEV up
-                printf "\n\t\t\t\t(monitor mode enabled on $MONDEV)"
-            else
-                printf "\n\nERROR: Neither the sysfs interface links nor the iw command is available.\nPlease download and install iw from\n$IW_SOURCE\n"
-            fi
-        fi
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-        z="`echo $iface | cut -b -${#MON_PREFIX}`"
-        if [ x$z = "x$MON_PREFIX" ]
-        then
-            if [ $USE_IW = 1 ]
-            then
-                IW_ERROR=`iw dev "$iface" interface del 2>&1 | grep "nl80211 not found"`
-                if [ x$IW_ERROR = "x" ]
-                then
-                    printf " (removed)"
-                else
-                    if [ -f /sys/class/ieee80211/"$PHYDEV"/remove_iface ]
-                    then
-                        echo -n "$iface" > /sys/class/ieee80211/"$PHYDEV"/remove_iface
-                        printf " (removed)"
-                    else
-                        printf "\n\nERROR: nl80211 support is disabled in your kernel.\nPlease recompile your kernel with nl80211 support enabled.\n"
-                fi
-                fi
-            else
-                if [ -f /sys/class/ieee80211/"$PHYDEV"/remove_iface ]
-                then
-                    echo -n "$iface" > /sys/class/ieee80211/"$PHYDEV"/remove_iface
-                    printf " (removed)"
-                else
-                    printf "\n\nERROR: Neither the sysfs interface links nor the iw command is available.\nPlease download and install iw from\n$IW_SOURCE\n"
-                fi
-	    fi
-        else
-            ifconfig $iface down
-            iwconfig $iface mode managed
-            printf "\n\t\t\t\t(monitor mode disabled)"
-        fi
-    fi
-    echo
-    continue
- fi
-
-
- if [ x$DRIVER = "xorinoco" ] || [ x"`iwpriv $iface 2>/dev/null | grep get_rid`" != "x" ] || [ x"`iwpriv $iface 2>/dev/null | grep dump_recs`" != "x" ]
- then
-    printf "$iface\t\tHermesI\t\torinoco"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-        cp $KISMET~ $KISMET 2>/dev/null &&
-        echo "source=orinoco,$iface,HermesI" >>$KISMET
-        if [ $CH -lt 1000 ]
-        then
-            iwconfig $iface mode Monitor channel $CH >/dev/null 2>&1
-        else
-            iwconfig $iface mode Monitor freq "$CH"000000 >/dev/null 2>&1
-        fi
-        iwpriv $iface monitor 1 $CH >/dev/null 2>&1
-        ifconfig $iface up
-        printf " (monitor mode enabled)"
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-        ifconfig $iface down
-        iwpriv $iface monitor 0 >/dev/null 2>&1
-        iwconfig $iface mode Managed >/dev/null 2>&1
-        printf " (monitor mode disabled)"
-    fi
-    echo
-    continue
- fi
-
- if [ x$DRIVER = "xrtl819xU" ]
- then
- 	printf "$iface\t\tRealtek 819x\trtl819xU"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-        startStdIface $iface $CH
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-        stopStdIface $iface
-    fi
-    echo
-    continue
- fi
-
- if [ x$DRIVER = "xipw2100" ] || [ x"`iwpriv $iface 2>/dev/null | grep set_crc_check`" != "x" ]
- then
-    printf "$iface\t\tIntel 2100B\tipw2100"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-        cp $KISMET~ $KISMET 2>/dev/null &&
-        echo "source=ipw2100,$iface,Centrino_b" >>$KISMET
-        startStdIface $iface $CH
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-        stopStdIface $iface
-    fi
-    echo
-    continue
- fi
-
-
- if [ x$DRIVER = "xarusb_lnx" ] || [ x$DRIVER = "Otus" ]
- then
-    printf "$iface\t\tAR9001USB\tOtus"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-	echo "Monitor mode not yet supported"
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then
-	stopStdIface $iface
-    fi
-    echo
-    continue
- fi  
-
- if [ x$DRIVER = "xWiLink" ]
- then
-    getChipset $iface
-    printf "$iface\t\t${CHIPSET}\t\t${DRIVER}"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then 
-        printf "\n\t\t\t\tMonitor mode not yet supported"
-    fi  
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-    then 
-        stopStdIface $iface
-    fi  
-    echo
-    continue
- fi
-
- if [ x$DRIVER = "xipw2200" ] || [ x"`iwpriv $iface 2>/dev/null | grep sw_reset`" != "x" ]
- then
-    MODINFO=`modinfo ipw2200  2>/dev/null | awk '/^version/ {print $2}'`
-    if { echo "$MODINFO" | grep -E '^1\.0\.(0|1|2|3)$' ; }
-    then
-    	echo "Monitor mode not supported, please upgrade"
-    else
-	printf "$iface\t\tIntel 2200BG\tipw2200"
-	if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-	then
-	    cp $KISMET~ $KISMET 2>/dev/null &&
-	    echo "source=ipw2200,$iface,Centrino_g" >>$KISMET
-	    startStdIface $iface $CH
-	fi
-	if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-	then
-	    stopStdIface $iface
-	fi
-
-    	if { echo "$MODINFO" | grep -E '^1\.0\.(5|7|8|11)$' ; }
-	then
-		printf " (Warning: bad module version, you should upgrade)"
-	fi
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xcx3110x" ] || [ x"`iwpriv $iface 2>/dev/null | grep set_backscan`" != "x" ]
- then
-     printf "$iface\t\tNokia 770\t\tcx3110x"
-     if [ x$1 = "xstart" ] || [ x$1 = "xstop" ]
-     then
-     	printf " (Enable/disable monitor mode not yet supported)"
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xipw3945" ] || [ x"`iwpriv $iface 2>/dev/null | grep set_preamble | grep -v set_crc_check`" != "x" ]
-  then
-        printf "$iface\t\tIntel 3945ABG\tipw3945"
-        if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-         then
-                cp $KISMET~ $KISMET 2>/dev/null &&
-                echo "source=ipw3945,$iface,Centrino_g" >>$KISMET
-                startStdIface $iface $CH
-        fi
-        if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-         then
-                stopStdIface $iface
-        fi
-        echo
-        continue
- fi
-
-
- if [ x"`iwpriv $iface 2>/dev/null | grep inact_auth`" != "x" ]
- then
-     if [ -e "/proc/sys/net/$iface/%parent" ]
-     then
-        printf "$iface\t\tAtheros\t\tmadwifi-ng VAP (parent: `cat /proc/sys/net/$iface/%parent`)"
-	if [ x$2 = x$iface ] && [ x$1 = "xstop" ]
-	then
-		wlanconfig $iface destroy
-		printf " (VAP destroyed)"
-	fi
-	if [ x$1 = "xstart" ]
-	then
-		if [ $iface = "$IFACE" ]
+	unset ethtool_output DRIVER FROM FIRMWARE STACK MADWIFI MAC80211 BUS BUSADDR BUSINFO DEVICEID CHIPSET EXTENDED PHYDEV ifacet DRIVERt FIELD1 FIELD1t FIELD2 FIELD2t CHIPSETt
+	#add a RUNNING check here and up the device if it isn't already
+	ethtool_output="$(ethtool -i $iface 2>&1)"
+	if [ "$ethtool_output" != "Cannot get driver information: Operation not supported" ]
+	then
+		getStack  ${iface}
+		getDriver   ${iface}
+		getChipset ${iface}
+		if [ ${VERBOSE} = "1" ]
+		then
+			getFrom ${iface}
+			getFirmware ${iface}
+			getExtendedInfo ${iface}
+		fi
+		getPhy     ${iface}
+	else
+ 		printf "\nethtool failed...\n"
+		printf "Only mac80211 devices on kernel 2.6.33 or higher are officially supported by airmon-ng.\n"
+		exit 1
+	fi
+
+	#yes this really is the main output loop
+	if [ ${VERBOSE} = "1" ]
+	then
+		#beautify output spacing (within reason)
+		FIELD1="${FROM}[${PHYDEV}]${iface}"
+		if [ ${#FIELD1} -gt 15 ]
+		then
+			FIELD1t="\t"
+		else
+			FIELD1t="\t\t"
+		fi
+		FIELD2="${DRIVER}[${STACK}]-${FIRMWARE}"
+		if [ ${#FIELD2} -gt 27 ]
 		then
-			printf " (monitor mode enabled)"
+			FIELD2t="\t"
+		else
+			FIELD2t="\t\t"
 		fi
-		if [ x$2 = x$iface ]
+		if [ -n "${EXTENDED}" ]
 		then
-			printf " (VAP cannot be put in monitor mode)"
+			CHIPSETt="\t\t\t\t\t\t\t\t\t\t"
+			if [ ${#CHIPSET} -gt 70 ]
+			then
+				CHIPSETt="\t"
+			elif [ ${#CHIPSET} -gt 63 ]
+			then
+				CHIPSETt="\t\t"
+			elif [ ${#CHIPSET} -gt 56 ]
+			then
+				CHIPSETt="\t\t\t"
+			elif [ ${#CHIPSET} -gt 49 ]
+			then
+				CHIPSETt="\t\t\t\t"
+			elif [ ${#CHIPSET} -gt 42 ]
+			then
+				CHIPSETt="\t\t\t\t\t"
+			elif [ ${#CHIPSET} -gt 35 ]
+			then
+				CHIPSETt="\t\t\t\t\t\t"
+			elif [ ${#CHIPSET} -gt 28 ]
+			then
+				CHIPSETt="\t\t\t\t\t\t\t"
+			elif [ ${#CHIPSET} -gt 21 ]
+			then
+				CHIPSETt="\t\t\t\t\t\t\t\t"
+			elif [ ${#CHIPSET} -gt 14 ]
+			then
+				CHIPSETt="\t\t\t\t\t\t\t\t\t"
+			fi
 		fi
+		printf "${FROM}[${PHYDEV}]${iface}${FIELD1t}${DRIVER}[${STACK}]-${FIRMWARE}${FIELD2t}${CHIPSET}${CHIPSETt}${EXTENDED}"
+	else
+		#beautify output spacing (within reason, interface/driver max length is 15 and phy max length is 7))
+		if [ ${#DRIVER} -gt 7 ]
+		then
+			DRIVERt="\t"
+		else
+			DRIVERt="\t\t"
+		fi
+		if [ ${#iface} -gt 7 ]
+		then
+			ifacet="\t"
+		else
+			ifacet="\t\t"
+		fi
+		printf "${PHYDEV}\t${iface}${ifacet}${DRIVER}${DRIVERt}${CHIPSET}"
 	fi
 
-	echo ""
-        continue
-
-     fi
-     printf "$iface\t\tAtheros\t\tmadwifi"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=madwifi_g,$iface,Atheros" >>$KISMET
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xprism54" ] || [ x"`iwpriv $iface 2>/dev/null | grep getPolicy`" != "x" ]
- then
-     printf "$iface\t\tPrismGT\t\tprism54"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=prism54g,$iface,Prism54" >>$KISMET
-         ifconfig $iface up
-         if [ $CH -lt 1000 ]
-         then
-             iwconfig $iface mode Monitor channel $CH
-         else
-             iwconfig $iface mode Monitor freq "$CH"000000
-         fi
-         iwpriv $iface set_prismhdr 1 >/dev/null 2>&1
-         printf " (monitor mode enabled)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xhostap" ] || [ x"`iwpriv $iface 2>/dev/null | grep antsel_rx`" != "x" ]
- then
-     printf "$iface\t\tPrism 2/2.5/3\tHostAP"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=hostap,$iface,Prism2" >>$KISMET
-         if [ $CH -lt 1000 ]
-         then
-             iwconfig $iface mode Monitor channel $CH
-         else
-             iwconfig $iface mode Monitor freq "$CH"000000
-         fi
-         iwpriv $iface monitor_type 1 >/dev/null 2>&1
-         ifconfig $iface up
-         printf " (monitor mode enabled)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xwlan-ng" ] || [ x"`wlancfg show $iface 2>/dev/null | grep p2CnfWEPFlags`" != "x" ]
- then
-     printf "$iface\t\tPrism 2/2.5/3\twlan-ng"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=wlanng,$iface,Prism2" >>$KISMET
-         wlanctl-ng $iface lnxreq_ifstate ifstate=enable >/dev/null
-         wlanctl-ng $iface lnxreq_wlansniff enable=true channel=$CH \
-                           prismheader=true wlanheader=false \
-                           stripfcs=true keepwepflags=true >/dev/null
-         echo p2CnfWEPFlags=0,4,7 | wlancfg set $iface
-         ifconfig $iface up
-         printf " (monitor mode enabled)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         ifconfig $iface down
-         wlanctl-ng $iface lnxreq_wlansniff enable=false  >/dev/null
-         wlanctl-ng $iface lnxreq_ifstate ifstate=disable >/dev/null
-         printf " (monitor mode disabled)"
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$SYSFS = "x" ] && [ x"`iwpriv $iface 2>/dev/null | grep get_RaAP_Cfg`" != "x" ]
- then
-    if [ x"`iwconfig $iface | grep ESSID | awk -F\  '{ print $2}' | grep -i rt61`" != "x" ]
-    then
-    	printf "$iface\t\tRalink 2561 PCI\trt61"
-    fi
-
-    if [ x"`iwconfig $iface | grep ESSID | awk -F\  '{ print $2}' | grep -i rt73`" != "x" ]
-    then
-        printf "$iface\t\tRalink 2573 USB\trt73"
-    fi
-
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-         startStdIface $iface $CH
-         iwpriv $iface rfmontx 1
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprismheader`" != "x" ]
-         then
-             iwpriv $iface forceprismheader 1
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprism`" != "x" ]
-         then
-             iwpriv $iface forceprism 1
-         fi
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-     	stopStdIface $iface
-    fi
-    echo
-    continue
-
- fi
-
-
- if [ x$DRIVER = "xrt61" ]
- then
-    printf "$iface\t\tRalink 2561 PCI\trt61"
-
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-         startStdIface $iface $CH
-         iwpriv $iface rfmontx 1
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprismheader`" != "x" ]
-         then
-             iwpriv $iface forceprismheader 1
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprism`" != "x" ]
-         then
-             iwpriv $iface forceprism 1
-         fi
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-     	stopStdIface $iface
-    fi    
-    echo
-    continue
-
- fi
-
-
- if [ x$DRIVER = "xrt73" ]
- then
-    printf "$iface\t\tRalink 2573 USB\trt73"
-
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-         startStdIface $iface $CH
-         iwpriv $iface rfmontx 1
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprismheader`" != "x" ]
-         then
-             iwpriv $iface forceprismheader 1
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprism`" != "x" ]
-         then
-             iwpriv $iface forceprism 1
-         fi
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-     	stopStdIface $iface
-    fi    
-    echo
-    continue
-
- fi
-
-
- if [ x$DRIVER = "xrt2500" ] || [ x"`iwpriv $iface 2>/dev/null | grep bbp`" != "x" ]
- then
-     printf "$iface\t\tRalink 2560 PCI\trt2500"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=rt2500,$iface,Ralink_g" >>$KISMET
-         iwconfig $iface mode ad-hoc 2> /dev/null >/dev/null
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xrt2570" ] || [ x"`iwpriv $iface 2>/dev/null | grep wpapsk`" != "x" ] && [ x"`iwpriv $iface 2>/dev/null | grep get_RaAP_Cfg`" = "x" ]
- then
-     printf "$iface\t\tRalink 2570 USB\trt2570"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=rt2500,$iface,Ralink_g" >>$KISMET
-         iwconfig $iface mode ad-hoc 2> /dev/null >/dev/null
-         startStdIface $iface $CH
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprismheader`" != "x" ]
-         then
-             iwpriv $iface forceprismheader 1
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep forceprism`" != "x" ]
-         then
-             iwpriv $iface forceprism 1
-         fi
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xr8180" ] || [ x"`iwpriv $iface 2>/dev/null | grep debugtx`" != "x" ]
- then
-     printf "$iface\t\tRTL8180/RTL8185\tr8180"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=rt8180,$iface,Realtek" >>$KISMET
-         if [ $CH -lt 1000 ]
-         then
-             iwconfig $iface mode Monitor channel $CH
-         else
-             iwconfig $iface mode Monitor freq "$CH"000000
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep prismhdr`" != "x" ]
-         then
-            iwpriv $iface prismhdr 1 >/dev/null 2>&1
-         fi
-         ifconfig $iface up
-         printf " (monitor mode enabled)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xr8187" ] || [ x"`iwpriv $iface 2>/dev/null | grep badcrc`" != "x" ]
- then
-     printf "$iface\t\tRTL8187\t\tr8187"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=rt8180,$iface,Realtek" >>$KISMET
-         if [ $CH -lt 1000 ]
-         then
-             iwconfig $iface mode Monitor channel $CH
-         else
-             iwconfig $iface mode Monitor freq "$CH"000000
-         fi
-         if [ x"`iwpriv $iface 2>/dev/null | grep rawtx`" != "x" ]
-         then
-             iwpriv $iface rawtx 1 >/dev/null 2>&1
-         fi
-         ifconfig $iface up
-         printf " (monitor mode enabled)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xzd1211rw" ] || [ x"`iwpriv $iface 2>/dev/null | grep get_regdomain`" != "x" ]
- then
-     printf "$iface\t\tZyDAS 1211\tzd1211rw"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=zd1211,$iface,ZyDAS" >>$KISMET
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xzd1211" ] || [ x"`iwpriv $iface 2>/dev/null | grep dbg_flag`" != "x" ]
- then
-     printf "$iface\t\tZyDAS 1211\tzd1211"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=zd1211,$iface,ZyDAS" >>$KISMET
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xacx" ] || [ x"`iwpriv $iface 2>/dev/null | grep GetAcx1`" != "x" ]
- then
-     printf "$iface\t\tTI ACX1xx\tacx"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=acx100,$iface,TI" >>$KISMET
-         iwpriv $iface monitor 2 $CH 2> /dev/null >/dev/null
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xbcm43xx" ] || [ x"`iwpriv $iface 2>/dev/null | grep write_sprom`" != "x" ]
- then
-     printf "$iface\t\tBroadcom\tbcm43xx"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         cp $KISMET~ $KISMET 2>/dev/null &&
-         echo "source=bcm43xx,$iface,broadcom" >>$KISMET
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-         ifconfig $iface up
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER = "xislsm" ] || [ x"`iwpriv $iface 2>/dev/null | grep set_announcedpkt`" != "x" ]
- then
-    printf "$iface\t\tPrismGT\t\tislsm"
-    if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-    then
-         startStdIface $iface $CH
-    fi
-    if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-     	stopStdIface $iface
-    fi    
-    echo
-    continue
-
- fi
-
-
- if [ x$DRIVER = "xat76c503a" ] || [ x"`iwpriv $iface 2>/dev/null | grep set_announcedpkt`" != "x" ]
-  then
-     printf "$iface\t\tAtmel\t\tat76c503a"
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-          startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-      then
-      	 stopStdIface $iface
-     fi     
-     echo
-     continue
-
- fi
-
-
- if [ x$DRIVER = "xndiswrapper" ] || [ x"`iwpriv $iface 2>/dev/null | grep ndis_reset`" != "x" ]
- then
-     printf "$iface\t\tUnknown\t\tndiswrapper"
-     if [ x$2 = x$iface ]
-     then
-         echo " (MONITOR MODE NOT SUPPORTED)"
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-
- if [ x$DRIVER != "x" ]
- then
-     if [ x$CHIPSET = "x" ]
-     then
-         printf "$iface\t\tUNKNOWN\t\t$DRIVER"
-     else
-         printf "$iface\t\t$CHIPSET\t\t$DRIVER"
-     fi
-
-     if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
-     then
-         startStdIface $iface $CH
-     fi
-     if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
-     then
-         stopStdIface $iface
-     fi
-     echo
-     continue
- fi
-
-printf "$iface\t\tUnknown\t\tUnknown (MONITOR MODE NOT SUPPORTED)\n"
+	if [ x$MAC80211 = "x1" ]
+	then
+		if [ x$1 = "xstart" ] && [ x$2 = x$iface ]
+		then
+			startMac80211Iface $iface
+		fi
+
+		if [ x$1 = "xstop" ] && [ x$2 = x$iface ]
+		then
+			stopMac80211Iface $iface
+		fi
 
+		#why, dear god why is there a random newline here?
+		printf "\n"
+		continue
+	fi
 done
 
-echo
+#why, dear god why is there a random newline here?
+printf "\n"
 
-if [ $UDEV_ISSUE != 0 ] ; then
-	echo udev renamed the interface. Read the following for a solution:
-	echo http://www.aircrack-ng.org/doku.php?id=airmon-ng#interface_athx_number_rising_ath0_ath1_ath2...._ath45
-	echo 
+if [ $UDEV_ISSUE != 0 ]
+then
+	printf "udev renamed the interface. Read the following for a solution:\n"
+	printf "http://www.aircrack-ng.org/doku.php?id=airmon-ng#interface_athx_number_rising_ath0_ath1_ath2...._ath45\n\n"
 fi

aircrack-ng-1.2-rc1.tar.gz/scripts/airoscript-ng/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/airoscript-ng/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/scripts/versuck-ng/Makefile -> aircrack-ng-1.2-rc2.tar.gz/scripts/versuck-ng/Makefile Changed

aircrack-ng-1.2-rc1.tar.gz/src/Makefile -> aircrack-ng-1.2-rc2.tar.gz/src/Makefile Changed

@@ -16,13 +16,14 @@
 
 LIBPCRE		=
 ifeq ($(PCRE), true)
-	LIBPCRE	= $(shell pcre-config --libs)
+	LIBPCRE = $(shell $(PKG_CONFIG) --libs libpcre)
 endif
 
 ifneq ($(OSNAME), cygwin) #There is yet no libpcap support for windows, so we skip the crawler
 	HAVE_PCAP	= $(shell ld -lpcap 2> /dev/null && echo yes)
 	ifeq ($(HAVE_PCAP), yes) #cannot link with -lpcap, skip crawler
 		BINFILES	+= besside-ng-crawler$(EXE)
+		LIBPCAP		= -lpcap
 	endif
 endif
 
@@ -32,14 +33,14 @@
 
 
 SBINFILES       = aireplay-ng$(EXE) airodump-ng$(EXE) airserv-ng$(EXE) \
-		  airtun-ng$(EXE) airbase-ng$(EXE) besside-ng$(EXE)
+		  airtun-ng$(EXE) airbase-ng$(EXE)
 		  
 OPTFILES	= aircrack-ng-opt-prof_gen aircrack-ng-opt \
 		  aircrack-ng-opt-prof prof/*
 
 
-ifeq ($(subst TRUE,true,$(filter TRUE true,$(unstable) $(UNSTABLE))),true)
-	SBINFILES	+= wesside-ng$(EXE) tkiptun-ng$(EXE) easside-ng$(EXE)
+ifeq ($(subst TRUE,true,$(filter TRUE true,$(experimental) $(EXPERIMENTAL))),true)
+	SBINFILES	+= wesside-ng$(EXE) tkiptun-ng$(EXE) easside-ng$(EXE) besside-ng$(EXE)
 	BINFILES	+= buddy-ng$(EXE)
 endif
 
@@ -168,7 +169,7 @@
 	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS_BS) -o $(@) $(LIBS) $(LIBSSL) -lz $(LIBPCRE)
 
 besside-ng-crawler$(EXE): $(OBJS_BC)
-	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS_BC) -o $(@) -lpcap
+	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS_BC) -o $(@) $(LIBPCAP)
 
 makeivs-ng$(EXE): $(OBJS_MI)
 	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS_MI) -o $(@) $(LDFLAGS)
@@ -193,7 +194,7 @@
 
 clean:
 	$(MAKE) -C $(OSD) clean
-	-rm -f $(SBINFILES) $(BINFILES) $(OPTFILES) airolib-ng$(EXE) *.o wesside-ng$(EXE) tkiptun-ng$(EXE) easside-ng$(EXE) buddy-ng$(EXE) a.out
+	-rm -f $(SBINFILES) $(BINFILES) $(OPTFILES) airolib-ng$(EXE) *.o wesside-ng$(EXE) tkiptun-ng$(EXE) easside-ng$(EXE) buddy-ng$(EXE) besside-ng$(EXE) a.out
 
 distclean: clean

aircrack-ng-1.2-rc1.tar.gz/src/airbase-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airbase-ng.c Changed

@@ -2,8 +2,8 @@
  *  802.11 monitor AP
  *  based on airtun-ng
  *
- *  Copyright (C) 2008-2013 Thomas d'Otreppe
- *  Copyright (C) 2008, 2009 Martin Beck
+ *  Copyright (C) 2008-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2008, 2009 Martin Beck <hirte@aircrack-ng.org>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -156,7 +156,7 @@
 
 char usage[] =
 "\n"
-"  %s - (C) 2008-2013 Thomas d'Otreppe\n"
+"  %s - (C) 2008-2014 Thomas d'Otreppe\n"
 "  Original work: Martin Beck\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
@@ -722,7 +722,7 @@
     while(cur->next != NULL)
     {
         old = cur->next;
-        timediff = (tv.tv_sec - old->access.tv_sec)*1000000 + (tv.tv_usec - old->access.tv_usec);
+        timediff = (tv.tv_sec - old->access.tv_sec)*1000000UL + (tv.tv_usec - old->access.tv_usec);
         if(timediff > FRAG_TIMEOUT)
         {
             //remove captured fragments
@@ -2994,7 +2994,7 @@
 
                     //set timestamp
                     gettimeofday( &tv1,  NULL );
-                    timestamp=tv1.tv_sec*1000000 + tv1.tv_usec;
+                    timestamp=tv1.tv_sec*1000000UL + tv1.tv_usec;
 
                     //copy timestamp into response; a mod 2^64 counter incremented each microsecond
                     for(i=0; i<8; i++)
@@ -3089,7 +3089,7 @@
 
                     //set timestamp
                     gettimeofday( &tv1,  NULL );
-                    timestamp=tv1.tv_sec*1000000 + tv1.tv_usec;
+                    timestamp=tv1.tv_sec*1000000UL + tv1.tv_usec;
 
                     //copy timestamp into response; a mod 2^64 counter incremented each microsecond
                     for(i=0; i<8; i++)
@@ -3523,7 +3523,7 @@
 //             ticks[2] = 0;
             fflush(stdout);
             gettimeofday( &tv1,  NULL );
-            timestamp=tv1.tv_sec*1000000 + tv1.tv_usec;
+            timestamp=tv1.tv_sec*1000000UL + tv1.tv_usec;
             fflush(stdout);
 
 
@@ -4563,8 +4563,6 @@
 		perror("setuid");
 	}
 
-    setuid( getuid() );
-
     /* XXX */
     if( opt.r_nbpps == 0 )
     {

aircrack-ng-1.2-rc1.tar.gz/src/aircrack-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/aircrack-ng.c Changed

@@ -1,7 +1,7 @@
 /*
  *  802.11 WEP / WPA-PSK Key Cracker
  *
- *  Copyright (C) 2006-2013 Thomas d'Otreppe
+ *  Copyright (C) 2006-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
  *  Copyright (C) 2004, 2005 Christophe Devine
  *
  *  Advanced WEP attacks developed by KoreK
@@ -181,7 +181,7 @@
 
 char usage[] =
 "\n"
-"  %s - (C) 2006-2013 Thomas d\'Otreppe\n"
+"  %s - (C) 2006-2014 Thomas d\'Otreppe\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
 "  usage: aircrack-ng [options] <.cap / .ivs file(s)>\n"
@@ -4484,6 +4484,8 @@
 
 	hccap_t hccap;
 
+	memset (&hccap, 0, sizeof (hccap));
+
 	memcpy (&hccap.essid,      &ap_cur->essid,          sizeof (ap_cur->essid));
 	memcpy (&hccap.mac1,       &ap_cur->bssid,          sizeof (ap_cur->bssid));
 	memcpy (&hccap.mac2,       &ap_cur->wpa.stmac,      sizeof (ap_cur->wpa.stmac));
@@ -5026,21 +5028,6 @@
 		{
 			case 'S':
 				_speed_test = 1;
-				opt.amode = 2;
-				opt.dict = stdin;
-				opt.bssid_set = 1;
-
-				ap_1st = ap_cur = malloc(sizeof(*ap_cur));
-				if (!ap_cur)
-					err(1, "malloc()");
-
-				memset(ap_cur, 0, sizeof(*ap_cur));
-
-				ap_cur->target = 1;
-				ap_cur->wpa.state = 7;
-				strcpy(ap_cur->essid, "sorbo");
-
-				goto __start;
 				break;
 
 			case ':' :
@@ -5434,6 +5421,24 @@
 		}
 	}
 
+	if (_speed_test) {
+		opt.amode = 2;
+		opt.dict = stdin;
+		opt.bssid_set = 1;
+		
+		ap_1st = ap_cur = malloc(sizeof(*ap_cur));
+		if (!ap_cur)
+			err(1, "malloc()");
+		
+		memset(ap_cur, 0, sizeof(*ap_cur));
+		
+		ap_cur->target = 1;
+		ap_cur->wpa.state = 7;
+		strcpy(ap_cur->essid, "sorbo");
+		
+		goto __start;
+	}
+
 	if( argc - optind < 1 )
 	{
 		if(argc == 1)

aircrack-ng-1.2-rc1.tar.gz/src/aircrack-ptw-lib.c -> aircrack-ng-1.2-rc2.tar.gz/src/aircrack-ptw-lib.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/aircrack-ptw-lib.h -> aircrack-ng-1.2-rc2.tar.gz/src/aircrack-ptw-lib.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/airdecap-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airdecap-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/airdecloak-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airdecloak-ng.c Changed

@@ -1,7 +1,7 @@
 /*
  *  WEP Cloaking filtering
  *
- *  Copyright (C) 2008-2013 Thomas d'Otreppe
+ *  Copyright (C) 2008-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
  *
  *  Thanks to Alex Hernandez aka alt3kx for the hardware.
  *
@@ -547,7 +547,7 @@
         }
 
 		#ifdef DEBUG
-        printf("From DS: %d - ToDS: %d\n", _packet_elt_head->current->fromDS, packet->toDS);
+        printf("From DS: %d - ToDS: %d\n", _packet_elt_head->current->fromDS, _packet_elt_head->current->toDS);
         printf("BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n", _packet_elt_head->current->bssid[0],
 				_packet_elt_head->current->bssid[1], _packet_elt_head->current->bssid[2],
 				_packet_elt_head->current->bssid[3], _packet_elt_head->current->bssid[4],
@@ -614,7 +614,7 @@
 			// Copy key index
 			_packet_elt_head->current->key_index = h80211[27];
 			#ifdef DEBUG
-			printf("Key index: %d\n", packet->key_index);
+			printf("Key index: %d\n", _packet_elt_head->current->key_index);
 			#endif
 			// Copy checksum
 			memcpy(_packet_elt_head->current->icv, buffer + (_packet_elt_head->current->header.caplen) - 4, 4);
@@ -1318,7 +1318,7 @@
 
 void usage() {
 	printf("\n"
-			"  %s - (C) 2008-2013 Thomas d\'Otreppe\n"
+			"  %s - (C) 2008-2014 Thomas d\'Otreppe\n"
 			"  http://www.aircrack-ng.org\n"
 			"\n"
 			"  usage: airdecloak-ng [options]\n"

aircrack-ng-1.2-rc1.tar.gz/src/airdecloak-ng.h -> aircrack-ng-1.2-rc2.tar.gz/src/airdecloak-ng.h Changed

@@ -1,3 +1,34 @@
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and
+ * NON-INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
 #ifndef _AIRUNDEFENSE_H_
 #define _AIRUNDEFENSE_H_

aircrack-ng-1.2-rc1.tar.gz/src/aireplay-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/aireplay-ng.c Changed

@@ -1,7 +1,7 @@
 /*
  *  802.11 WEP replay & injection attacks
  *
- *  Copyright (C) 2006-2013 Thomas d'Otreppe
+ *  Copyright (C) 2006-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
  *  Copyright (C) 2004, 2005 Christophe Devine
  *
  *  WEP decryption attack (chopchop) developed by KoreK
@@ -140,7 +140,7 @@
 char usage[] =
 
 "\n"
-"  %s - (C) 2006-2013 Thomas d\'Otreppe\n"
+"  %s - (C) 2006-2014 Thomas d\'Otreppe\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
 "  usage: aireplay-ng <options> <replay interface>\n"
@@ -507,7 +507,7 @@
 	return rc;
 }
 
-void read_sleep( int usec )
+void read_sleep( unsigned long usec )
 {
     struct timeval tv, tv2, tv3;
     int caplen;
@@ -519,7 +519,7 @@
     tv3.tv_sec=0;
     tv3.tv_usec=10000;
 
-    while( ((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) < (usec) )
+    while( ((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) < (usec) )
     {
         FD_ZERO( &rfds );
         FD_SET( dev.fd_in, &rfds );
@@ -623,7 +623,7 @@
             len = read_packet(pkt_sniff, sizeof(pkt_sniff), NULL);
 
             gettimeofday(&tv2, NULL);
-            if(((tv2.tv_sec-tv.tv_sec)*1000000) + (tv2.tv_usec-tv.tv_usec) > 10000*1000) //wait 10sec for beacon frame
+            if(((tv2.tv_sec-tv.tv_sec)*1000000UL) + (tv2.tv_usec-tv.tv_usec) > 10000*1000) //wait 10sec for beacon frame
             {
                 return -1;
             }
@@ -1968,7 +1968,7 @@
                 if(opt.npackets == -1) x_send = 4;
                 state = 0;
                 challengelen = 0;
-                read_sleep( deauth_wait * 1000000 );
+                read_sleep( deauth_wait * 1000000UL );
                 deauth_wait += 2;
                 continue;
             }
@@ -4838,14 +4838,14 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
                 {
                     PCT; printf("Not enough acks, repeating...\n");
                     again = RETRY;
                     break;
                 }
 
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
                 {
                     PCT; printf("No answer, repeating...\n");
                     round++;
@@ -4981,14 +4981,14 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
                 {
                     PCT; printf("Not enough acks, repeating...\n");
                     again = RETRY;
                     break;
                 }
 
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
                 {
                     PCT; printf("No answer, repeating...\n");
                     round++;
@@ -5488,7 +5488,7 @@
             //simple "high-precision" usleep
             select(1, NULL, NULL, NULL, &tv3);
         }
-        times[i] = ((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec));
+        times[i] = ((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec));
         printf( "\r%d/%d\r", i, REQUESTS);
         fflush(stdout);
         close(sock);
@@ -5522,7 +5522,7 @@
     int ret=0;
     float avg2;
     struct rx_info ri;
-    int atime=200;  //time in ms to wait for answer packet (needs to be higher for airserv)
+    unsigned long atime=200;  //time in ms to wait for answer packet (needs to be higher for airserv)
     unsigned char nulldata[1024];
 
     if(opt.port_out > 0)
@@ -5683,7 +5683,7 @@
             }
 
             gettimeofday( &tv2, NULL );
-            if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (3*atime*1000)) //wait 'atime'ms for an answer
+            if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (3*atime*1000)) //wait 'atime'ms for an answer
             {
                 break;
             }
@@ -5884,7 +5884,7 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (atime*1000)) //wait 'atime'ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (atime*1000)) //wait 'atime'ms for an answer
                 {
                     break;
                 }
@@ -6004,7 +6004,7 @@
                         }
 
                         gettimeofday( &tv2, NULL );
-                        if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000)) //wait 300ms for an answer
+                        if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000)) //wait 300ms for an answer
                         {
                             break;
                         }
@@ -6220,7 +6220,7 @@
                     }
 
                     gettimeofday( &tv2, NULL );
-                    if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (3*atime*1000)) //wait 3*'atime' ms for an answer
+                    if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (3*atime*1000)) //wait 3*'atime' ms for an answer
                     {
                         break;
                     }

aircrack-ng-1.2-rc1.tar.gz/src/airodump-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airodump-ng.c Changed

@@ -1,7 +1,7 @@
 /*
  *  pcap-compatible 802.11 packet sniffer
  *
- *  Copyright (C) 2006-2013 Thomas d'Otreppe
+ *  Copyright (C) 2006-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
  *  Copyright (C) 2004, 2005 Christophe Devine
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -77,6 +77,9 @@
 	GCRY_THREAD_OPTION_PTHREAD_IMPL;
 #endif
 
+// in common.c
+extern int is_string_number(const char * str);
+
 void dump_sort( void );
 void dump_print( int ws_row, int ws_col, int if_num );
 
@@ -396,6 +399,20 @@
     str[i - begin] = '\0'; // Null terminate string.
 }
 
+FILE *open_oui_file(void) {
+	int i;
+	FILE *fp = NULL;
+
+	for (i=0; OUI_PATHS[i] != NULL; i++) {
+		fp = fopen(OUI_PATHS[i], "r");
+		if ( fp != NULL ) {
+			break;
+		}
+	}
+
+	return fp;
+}
+
 struct oui * load_oui_file(void) {
 	FILE *fp;
 	char * manuf;
@@ -404,15 +421,10 @@
 	unsigned char b[2];
 	unsigned char c[2];
 	struct oui *oui_ptr = NULL, *oui_head = NULL;
-
-	if (!(fp = fopen(OUI_PATH0, "r"))) {
-		if (!(fp = fopen(OUI_PATH1, "r"))) {
-			if (!(fp = fopen(OUI_PATH2, "r"))) {
-				if (!(fp = fopen(OUI_PATH3, "r"))) {
-					return NULL;
-				}
-			}
-		}
+	
+	fp = open_oui_file();
+	if (!fp) {
+		return NULL;
 	}
 
 	memset(buffer, 0x00, sizeof(buffer));
@@ -615,7 +627,7 @@
 char usage[] =
 
 "\n"
-"  %s - (C) 2006-2013 Thomas d\'Otreppe\n"
+"  %s - (C) 2006-2014 Thomas d\'Otreppe\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
 "  usage: airodump-ng <options> <interface>[,<interface>,...]\n"
@@ -637,11 +649,14 @@
 "      -x            <msecs> : Active Scanning Simulation\n"
 "      --manufacturer        : Display manufacturer from IEEE OUI list\n"
 "      --uptime              : Display AP Uptime from Beacon Timestamp\n"
+"      --wps                 : Display WPS information (if any)\n"
 "      --output-format\n"
 "                  <formats> : Output format. Possible values:\n"
 "                              pcap, ivs, csv, gps, kismet, netxml\n"
 "      --ignore-negative-one : Removes the message that says\n"
 "                              fixed channel <interface>: -1\n"
+"      --write-interval\n"
+"                  <seconds> : Output file(s) write interval in seconds\n"
 "\n"
 "  Filter options:\n"
 "      --encrypt   <suite>   : Filter APs by cipher suite\n"
@@ -732,7 +747,7 @@
     /* accesspoints */
     while( ap_cur != NULL )
     {
-        time_diff = 1000000 * (cur_time.tv_sec  - ap_cur->ftimer.tv_sec )
+        time_diff = 1000000UL * (cur_time.tv_sec  - ap_cur->ftimer.tv_sec )
                             + (cur_time.tv_usec - ap_cur->ftimer.tv_usec);
 
         /* update every `QLT_TIME`seconds if the rate is low, or every 500ms otherwise */
@@ -741,12 +756,12 @@
             /* at least one frame captured */
             if(ap_cur->fcapt > 1)
             {
-                capt_time =   ( 1000000 * (ap_cur->ftimel.tv_sec  - ap_cur->ftimef.tv_sec )    //time between first and last captured frame
+                capt_time =   ( 1000000UL * (ap_cur->ftimel.tv_sec  - ap_cur->ftimef.tv_sec )    //time between first and last captured frame
                                         + (ap_cur->ftimel.tv_usec - ap_cur->ftimef.tv_usec) );
 
-                miss_time =   ( 1000000 * (ap_cur->ftimef.tv_sec  - ap_cur->ftimer.tv_sec )    //time between timer reset and first frame
+                miss_time =   ( 1000000UL * (ap_cur->ftimef.tv_sec  - ap_cur->ftimer.tv_sec )    //time between timer reset and first frame
                                         + (ap_cur->ftimef.tv_usec - ap_cur->ftimer.tv_usec) )
-                            + ( 1000000 * (cur_time.tv_sec  - ap_cur->ftimel.tv_sec )          //time between last frame and this moment
+                            + ( 1000000UL * (cur_time.tv_sec  - ap_cur->ftimel.tv_sec )          //time between last frame and this moment
                                         + (cur_time.tv_usec - ap_cur->ftimel.tv_usec) );
 
                 //number of frames missed at the time where no frames were captured; extrapolated by assuming a constant framerate
@@ -775,7 +790,7 @@
     /* stations */
     while( st_cur != NULL )
     {
-        time_diff = 1000000 * (cur_time.tv_sec  - st_cur->ftimer.tv_sec )
+        time_diff = 1000000UL * (cur_time.tv_sec  - st_cur->ftimer.tv_sec )
                             + (cur_time.tv_usec - st_cur->ftimer.tv_usec);
 
         if( time_diff > 10000000 )
@@ -1089,7 +1104,7 @@
 
     gettimeofday(&tv1, NULL);
 
-    timediff = (((tv1.tv_sec - ((*list)->ctime.tv_sec)) * 1000000) + (tv1.tv_usec - ((*list)->ctime.tv_usec))) / 1000;
+    timediff = (((tv1.tv_sec - ((*list)->ctime.tv_sec)) * 1000000UL) + (tv1.tv_usec - ((*list)->ctime.tv_usec))) / 1000;
     if( timediff > BUFFER_TIME )
     {
         list_tail_free(list);
@@ -1100,7 +1115,7 @@
     {
         if(next->next != NULL)
         {
-            timediff = (((tv1.tv_sec - (next->next->ctime.tv_sec)) * 1000000) + (tv1.tv_usec - (next->next->ctime.tv_usec))) / 1000;
+            timediff = (((tv1.tv_sec - (next->next->ctime.tv_sec)) * 1000000UL) + (tv1.tv_usec - (next->next->ctime.tv_usec))) / 1000;
             if( timediff > BUFFER_TIME )
             {
                 list_tail_free(&(next->next));
@@ -1288,6 +1303,7 @@
 			ap_cur->manuf = get_manufacturer(ap_cur->bssid[0], ap_cur->bssid[1], ap_cur->bssid[2]);
 		}
 
+	ap_cur->nb_pkt = 0;
         ap_cur->prev = ap_prv;
 
         ap_cur->tinit = time( NULL );
@@ -1306,6 +1322,7 @@
 
         ap_cur->uiv_root = uniqueiv_init();
 
+	ap_cur->nb_data = 0;
         ap_cur->nb_dataps = 0;
         ap_cur->nb_data_old = 0;
         gettimeofday(&(ap_cur->tv), NULL);
@@ -1328,6 +1345,7 @@
 
         ap_cur->ssid_length = 0;
         ap_cur->essid_stored = 0;
+        memset( ap_cur->essid, 0, MAX_IE_ELEMENT_SIZE );
         ap_cur->timestamp = 0;
 
         ap_cur->decloak_detect=G.decloak;
@@ -1408,9 +1426,15 @@
 //         if(ap_cur->fcapt >= QLT_COUNT) update_rx_quality();
     }
 
-    if( h80211[0] == 0x80 )
+    switch( h80211[0] )
     {
-        ap_cur->nb_bcn++;
+        case  0x80:
+            ap_cur->nb_bcn++;
+        case  0x50:
+            /* reset the WPS state */
+            ap_cur->wps.state = 0xFF;
+            ap_cur->wps.ap_setup_locked = 0;
+            break;
     }
 
     ap_cur->nb_pkt++;
@@ -1497,6 +1521,8 @@
 			st_cur->manuf = get_manufacturer(st_cur->stmac[0], st_cur->stmac[1], st_cur->stmac[2]);
 		}
 
+	st_cur->nb_pkt = 0;
+
         st_cur->prev = st_prv;
 
         st_cur->tinit = time( NULL );
@@ -1511,6 +1537,8 @@
         st_cur->lastseq = 0;
         st_cur->qos_fr_ds = 0;
         st_cur->qos_to_ds = 0;
+	st_cur->channel = 0;
+
         gettimeofday( &(st_cur->ftimer), NULL);
 
         for( i = 0; i < NB_PRB; i++ )
@@ -1545,6 +1573,10 @@
     {
         st_cur->power = ri->ri_power;
         st_cur->rate_from = ri->ri_rate;
+	if(ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
+		st_cur->channel = ri->ri_channel;
+	else
+		st_cur->channel = G.channel[cardnum];
 
         if(st_cur->lastseq != 0)
         {
@@ -1821,6 +1853,54 @@
                 ap_cur->security |= STD_QOS;
                 p += length+2;
             }
+            else if( (type == 0xDD && (length >= 4) && (memcmp(p+2, "\x00\x50\xF2\x04", 4) == 0)))
+            {
+                org_p = p;
+                p+=6;
+                int len = length, subtype = 0, sublen = 0;
+                while(len >= 4)
+                {
+                    subtype = (p[0] << 8) + p[1];
+                    sublen = (p[2] << 8) + p[3];
+                    if(sublen > len)
+                        break;
+                    switch(subtype)
+                    {
+                    case 0x104a: // WPS Version
+                        ap_cur->wps.version = p[4];
+                        break;
+                    case 0x1011: // Device Name
+                    case 0x1012: // Device Password ID
+                    case 0x1021: // Manufacturer
+                    case 0x1023: // Model
+                    case 0x1024: // Model Number
+                    case 0x103b: // Response Type
+                    case 0x103c: // RF Bands
+                    case 0x1041: // Selected Registrar
+                    case 0x1042: // Serial Number
+                        break;
+                    case 0x1044: // WPS State
+                        ap_cur->wps.state = p[4];
+                        break;
+                    case 0x1047: // UUID Enrollee
+                    case 0x1049: // Vendor Extension
+                    case 0x1054: // Primary Device Type
+                        break;
+                    case 0x1057: // AP Setup Locked
+                        ap_cur->wps.ap_setup_locked = p[4];
+                        break;
+                    case 0x1008: // Config Methods
+                    case 0x1053: // Selected Registrar Config Methods
+                        ap_cur->wps.meth = (p[4] << 8) + p[5];
+                        break;
+                    default:     // Unknown type-length-value
+                        break;
+                    }
+                    p += sublen+4;
+                    len -= sublen+4;
+                }
+                p = org_p + length+2;
+            }
             else p += length+2;
         }
     }
@@ -1926,7 +2006,7 @@
 
         if( ap_cur->channel == -1 )
         {
-            if(ri->ri_channel > 0 && ri->ri_channel < 167)
+            if(ri->ri_channel > 0 && ri->ri_channel <= HIGHEST_CHANNEL)
                 ap_cur->channel = ri->ri_channel;
             else
                 ap_cur->channel = G.channel[cardnum];
@@ -3082,6 +3162,22 @@
     if (G.show_uptime)
     	strcat(strbuf, "       UPTIME  ");
 
+    if (G.show_wps)
+    {
+        strcat(strbuf, "WPS   ");
+        if ( ws_col > (columns_ap - 4) )
+        {
+            memset(strbuf+columns_ap, 32, G.maxsize_wps_seen - 6 );
+            snprintf(strbuf+columns_ap+G.maxsize_wps_seen-6, 9,"%s","   ESSID");
+            if ( G.show_manufacturer  )
+            {
+                memset(strbuf+columns_ap+G.maxsize_wps_seen+2, 32, G.maxsize_essid_seen-5 );
+                snprintf(strbuf+columns_ap+G.maxsize_essid_seen-5, 15,"%s","  MANUFACTURER");
+            }
+        }
+    }
+    else
+    {
     strcat(strbuf, "ESSID");
 
 	if ( G.show_manufacturer && ( ws_col > (columns_ap - 4) ) ) {
@@ -3089,7 +3185,7 @@
 		memset(strbuf+columns_ap, 32, G.maxsize_essid_seen - 5 ); // 5 is the len of "ESSID"
 		snprintf(strbuf+columns_ap+G.maxsize_essid_seen-5, 15,"%s","  MANUFACTURER");
 	}
-
+    }
 	strbuf[ws_col - 1] = '\0';
 	fprintf( stderr, "%s\n", strbuf );
 
@@ -3260,13 +3356,64 @@
 	    if( ws_col > (columns_ap - 4) )
 	    {
 		memset( strbuf, 0, sizeof( strbuf ) );
+		if (G.show_wps)
+		{
+		    if (ap_cur->wps.state != 0xFF)
+		    {
+		        if (ap_cur->wps.ap_setup_locked) // AP setup locked
+		            snprintf(strbuf, sizeof(strbuf)-1, "Locked");
+		        else
+		        {
+		            snprintf(strbuf, sizeof(strbuf)-1, "%d.%d", ap_cur->wps.version >> 4, ap_cur->wps.version & 0xF); // Version
+		            if (ap_cur->wps.meth) // WPS Config Methods
+		            {
+		                char tbuf[64];
+		                memset( tbuf, '\0', sizeof(tbuf) );
+		                int sep = 0;
+#define T(bit, name) do {                       \
+    if (ap_cur->wps.meth & (1<<bit)) {          \
+        if (sep)                                \
+            strcat(tbuf, ",");                  \
+        sep = 1;                                \
+        strncat(tbuf, name, (64-strlen(tbuf))); \
+    } } while (0)
+		                T(0, "USB");     // USB method
+		                T(1, "ETHER");   // Ethernet
+		                T(2, "LAB");     // Label
+		                T(3, "DISP");    // Display
+		                T(4, "EXTNFC");  // Ext. NFC Token
+		                T(5, "INTNFC");  // Int. NFC Token
+		                T(6, "NFCINTF"); // NFC Interface
+		                T(7, "PBC");     // Push Button
+		                T(8, "KPAD");    // Keypad
+		                snprintf(strbuf+strlen(strbuf), sizeof(strbuf)-strlen(strbuf), " %s", tbuf);
+#undef T
+		            }
+		        }
+		    }
+		    else
+		        snprintf(strbuf, sizeof(strbuf)-1, " ");
+
+			if (G.maxsize_wps_seen <= strlen(strbuf))
+				G.maxsize_wps_seen = strlen(strbuf);
+			else // write spaces (32)
+				memset( strbuf+strlen(strbuf), 32,  (G.maxsize_wps_seen - strlen(strbuf))  );
+		}
 		if(ap_cur->essid[0] != 0x00)
 		{
+		    if (G.show_wps)
+		    snprintf( strbuf + G.maxsize_wps_seen, sizeof(strbuf)-G.maxsize_wps_seen,
+			    "  %s", ap_cur->essid );
+		    else
 		    snprintf( strbuf,  sizeof( strbuf ) - 1,
 			    "%s", ap_cur->essid );
 		}
 		else
 		{
+		    if (G.show_wps)
+		    snprintf( strbuf + G.maxsize_wps_seen, sizeof(strbuf)-G.maxsize_wps_seen,
+			    "  <length:%3d>%s", ap_cur->ssid_length, "\x00" );
+		    else
 		    snprintf( strbuf,  sizeof( strbuf ) - 1,
 			    "<length:%3d>%s", ap_cur->ssid_length, "\x00" );
 		}
@@ -3509,13 +3656,78 @@
     }
 }
 
+char * format_text_for_csv( const unsigned char * input, int len)
+{
+	// Unix style encoding
+	char * ret;
+	int i, pos, contains_space_end;
+	const char * hex_table = "0123456789ABCDEF";
+
+	if (len < 0)
+	{
+		return NULL;
+	}
+
+	if (len == 0 || input == NULL)
+	{
+		ret = (char*)malloc(1);
+		ret[0] = 0;
+		return ret;
+	}
+
+	pos = 0;
+	contains_space_end = (input[0] == ' ') || input[len-1] == ' ';
+
+	// Make sure to have enough memory for all that stuff
+	ret = (char *)malloc((len*4)+1+2);
+
+	if (contains_space_end)
+	{
+		ret[pos++] = '"';
+	}
+
+	for (i=0; i < len; i++)
+	{
+		if (!isprint(input[i]) || input[i] == ',' || input[i] == '\\' || input[i] == '"')
+		{
+			ret[pos++] = '\\';
+		}
+
+		if (isprint(input[i]))
+		{
+			ret[pos++] = input[i];
+		}
+		else if (input[i] == '\n' || input[i] == '\r' || input[i] == '\t')
+		{
+			ret[pos++] = (input[i] == '\n') ? 'n' : (input[i] == '\t') ? 't' : 'r';
+		}
+		else
+		{
+			ret[pos++] = 'x';
+			ret[pos++] = hex_table[input[i]/16];
+			ret[pos++] = hex_table[input[i]%16];
+		}
+	}
+
+	if (contains_space_end)
+	{
+		ret[pos++] = '"';
+	}
+
+	ret[pos++] = '\0';
+
+	ret = realloc(ret, pos);
+
+	return ret;
+}
+
 int dump_write_csv( void )
 {
-    int i, j, n;
+    int i, n, probes_written;
     struct tm *ltime;
-    char ssid_list[512];
     struct AP_info *ap_cur;
     struct ST_info *st_cur;
+    char * temp;
 
     if (! G.record_data || !G.output_format_csv)
     	return 0;
@@ -3542,7 +3754,7 @@
             continue;
         }
 
-        if(is_filtered_essid(ap_cur->essid) || ap_cur->nb_pkt < 2)
+        if(is_filtered_essid(ap_cur->essid))
         {
             ap_cur = ap_cur->next;
             continue;
@@ -3567,22 +3779,22 @@
                  ltime->tm_mday, ltime->tm_hour,
                  ltime->tm_min,  ltime->tm_sec );
 
-        fprintf( G.f_txt, "%2d, %3d, ",
+        fprintf( G.f_txt, "%2d, %3d,",
                  ap_cur->channel,
                  ap_cur->max_speed );
 
-        if( (ap_cur->security & (STD_OPN|STD_WEP|STD_WPA|STD_WPA2)) == 0) fprintf( G.f_txt, "    " );
+        if( (ap_cur->security & (STD_OPN|STD_WEP|STD_WPA|STD_WPA2)) == 0) fprintf( G.f_txt, " " );
         else
         {
-            if( ap_cur->security & STD_WPA2 ) fprintf( G.f_txt, "WPA2" );
-            if( ap_cur->security & STD_WPA  ) fprintf( G.f_txt, "WPA " );
-            if( ap_cur->security & STD_WEP  ) fprintf( G.f_txt, "WEP " );
-            if( ap_cur->security & STD_OPN  ) fprintf( G.f_txt, "OPN " );
+            if( ap_cur->security & STD_WPA2 ) fprintf( G.f_txt, " WPA2" );
+            if( ap_cur->security & STD_WPA  ) fprintf( G.f_txt, " WPA" );
+            if( ap_cur->security & STD_WEP  ) fprintf( G.f_txt, " WEP" );
+            if( ap_cur->security & STD_OPN  ) fprintf( G.f_txt, " OPN" );
         }
 
         fprintf( G.f_txt, ",");
 
-        if( (ap_cur->security & (ENC_WEP|ENC_TKIP|ENC_WRAP|ENC_CCMP|ENC_WEP104|ENC_WEP40)) == 0 ) fprintf( G.f_txt, "       ");
+        if( (ap_cur->security & (ENC_WEP|ENC_TKIP|ENC_WRAP|ENC_CCMP|ENC_WEP104|ENC_WEP40)) == 0 ) fprintf( G.f_txt, " ");
         else
         {
             if( ap_cur->security & ENC_CCMP   ) fprintf( G.f_txt, " CCMP");
@@ -3620,12 +3832,9 @@
 
         fprintf( G.f_txt, "%3d, ", ap_cur->ssid_length);
 
-        for(i=0; i<ap_cur->ssid_length; i++)
-        {
-            fprintf( G.f_txt, "%c", ap_cur->essid[i] );
-        }
-        fprintf( G.f_txt, ", " );
-
+	temp = format_text_for_csv(ap_cur->essid, ap_cur->ssid_length);
+        fprintf( G.f_txt, "%s, ", temp );
+	free(temp);
 
         if(ap_cur->key != NULL)
         {
@@ -3689,28 +3898,30 @@
                      ap_cur->bssid[2], ap_cur->bssid[3],
                      ap_cur->bssid[4], ap_cur->bssid[5] );
 
-        memset( ssid_list, 0, sizeof( ssid_list ) );
+	
 
+	probes_written = 0;
         for( i = 0, n = 0; i < NB_PRB; i++ )
         {
-            if( st_cur->probes[i][0] == '\0' )
+            if( st_cur->ssid_length[i] == 0 )
                 continue;
 
-            snprintf( ssid_list + n, sizeof( ssid_list ) - n - 1,
-                      "%c", ( i > 0 ) ? ',' : ' ' );
+	    temp = format_text_for_csv(st_cur->probes[i], st_cur->ssid_length[i]);
 
-            for(j=0; j<st_cur->ssid_length[i]; j++)
-            {
-                snprintf( ssid_list + n + 1 + j, sizeof( ssid_list ) - n - 2 - j,
-                          "%c", st_cur->probes[i][j]);
-            }
+	    if( probes_written == 0)
+	    {
+		fprintf( G.f_txt, "%s", temp);
+		probes_written = 1;
+	    }
+	    else
+	    {
+		fprintf( G.f_txt, ",%s", temp);
+	    }
 
-            n += ( 1 + st_cur->ssid_length[i] );
-            if( n >= (int) sizeof( ssid_list ) )
-                break;
+	    free(temp);
         }
 
-        fprintf( G.f_txt, "%s\r\n", ssid_list );
+        fprintf( G.f_txt, "\r\n" );
 
         st_cur = st_cur->next;
     }
@@ -3723,12 +3934,11 @@
 char * sanitize_xml(unsigned char * text, int length)
 {
 	int i;
-	size_t len;
+	size_t len, current_text_len;
 	unsigned char * pos;
-	char * newpos;
 	char * newtext = NULL;
 	if (text != NULL && length > 0) {
-		len = 6 * length;
+		len = 8 * length;
 		newtext = (char *)calloc(1, (len + 1) * sizeof(char)); // Make sure we have enough space
 		pos = text;
 		for (i = 0; i < length; ++i, ++pos) {
@@ -3748,13 +3958,20 @@
 				case '"':
 					strncat(newtext, "&quot;", len);
 					break;
+				case '\r':
+					strncat(newtext, "&#xD;", len);
+					break;
+				case '\n':
+					strncat(newtext, "&#xA;", len);
+					break;
 				default:
-					if ( isprint((int)(*pos)) || (*pos)>127 ) {
+					if ( isprint((int)(*pos)) ) {
 						newtext[strlen(newtext)] = *pos;
 					} else {
-						newtext[strlen(newtext)] = '\\';
-						newpos = newtext + strlen(newtext);
-						snprintf(newpos, strlen(newpos) + 1, "%3u", *pos);
+						strncat(newtext, "&#x", len);
+						current_text_len = strlen(newtext);
+						snprintf(newtext + current_text_len, len - current_text_len + 1, "%4x", *pos);
+						strncat(newtext, ";", len);
 					}
 					break;
 			}
@@ -3769,7 +3986,6 @@
 #define OUI_STR_SIZE 8
 #define MANUF_SIZE 128
 char *get_manufacturer(unsigned char mac0, unsigned char mac1, unsigned char mac2) {
-	static char * oui_location = NULL;
 	char oui[OUI_STR_SIZE + 1];
 	char *manuf;
 	//char *buffer_manuf;
@@ -3803,24 +4019,7 @@
 		}
 	} else {
 		// If the file exist, then query it each time we need to get a manufacturer.
-		if (oui_location == NULL) {
-			fp = fopen(OUI_PATH0, "r");
-			if (fp == NULL) {
-				fp = fopen(OUI_PATH1, "r");
-				if (fp == NULL) {
-				    fp = fopen(OUI_PATH2, "r");
-				    if (fp != NULL) {
-					oui_location = OUI_PATH2;
-				    }
-				} else {
-				    oui_location = OUI_PATH1;
-				}
-			} else {
-				oui_location = OUI_PATH0;
-			}
-		} else {
-			fp = fopen(oui_location, "r");
-		}
+		fp = open_oui_file();
 
 		if (fp != NULL) {
 
@@ -3873,10 +4072,154 @@
 #define KISMET_NETXML_TRAILER "</detection-run>"
 
 #define TIME_STR_LENGTH 255
+int dump_write_kismet_netxml_client_info(struct ST_info *client, int client_no)
+{
+	char first_time[TIME_STR_LENGTH];
+	char last_time[TIME_STR_LENGTH];
+	char * manuf;
+	int client_max_rate, average_power, i, nb_probes_written, is_unassociated;
+	char * essid = NULL;
+
+	if (client == NULL || client_no < 1) {
+		return 1;
+	}
+
+	is_unassociated = (client->base == NULL || memcmp(client->base->bssid, BROADCAST, 6) == 0);
+
+	strncpy(first_time, ctime(&client->tinit), TIME_STR_LENGTH - 1);
+	first_time[strlen(first_time) - 1] = 0; // remove new line
+
+	strncpy(last_time, ctime(&client->tlast), TIME_STR_LENGTH - 1);
+	last_time[strlen(last_time) - 1] = 0; // remove new line
+
+	fprintf(G.f_kis_xml, "\t\t<wireless-client number=\"%d\" "
+				 "type=\"%s\" first-time=\"%s\""
+				 " last-time=\"%s\">\n",
+				 client_no, (is_unassociated) ? "tods" : "established",
+				 first_time, last_time );
+
+	fprintf( G.f_kis_xml, "\t\t\t<client-mac>%02X:%02X:%02X:%02X:%02X:%02X</client-mac>\n",
+				 client->stmac[0], client->stmac[1],
+				 client->stmac[2], client->stmac[3],
+				 client->stmac[4], client->stmac[5] );
+
+	/* Manufacturer, if set using standard oui list */
+	manuf = sanitize_xml((unsigned char *)client->manuf, strlen(client->manuf));
+	fprintf(G.f_kis_xml, "\t\t\t<client-manuf>%s</client-manuf>\n", (manuf != NULL) ? manuf : "Unknown");
+	free(manuf);
+
+	/* SSID item, aka Probes */
+	nb_probes_written = 0;
+	for( i = 0; i < NB_PRB; i++ )
+        {
+		if( client->probes[i][0] == '\0' )
+			continue;
+
+		fprintf( G.f_kis_xml, "\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
+					first_time, last_time);
+		fprintf( G.f_kis_xml, "\t\t\t\t<type>Probe Request</type>\n"
+					"\t\t\t\t<max-rate>54.000000</max-rate>\n"
+					"\t\t\t\t<packets>1</packets>\n"
+					"\t\t\t\t<encryption>None</encryption>\n");
+		essid = sanitize_xml(client->probes[i], client->ssid_length[i]);
+		if (essid != NULL) {
+			fprintf( G.f_kis_xml, "\t\t\t\t<ssid>%s</ssid>\n", essid);
+			free(essid);
+		}
+		
+		fprintf( G.f_kis_xml, "\t\t\t</SSID>\n");
+
+		++nb_probes_written;
+        }
+
+	// Unassociated client with broadcast probes
+	if (is_unassociated && nb_probes_written == 0)
+	{
+		fprintf( G.f_kis_xml, "\t\t\t<SSID first-time=\"%s\" last-time=\"%s\">\n",
+					first_time, last_time);
+		fprintf( G.f_kis_xml, "\t\t\t\t<type>Probe Request</type>\n"
+					"\t\t\t\t<max-rate>54.000000</max-rate>\n"
+					"\t\t\t\t<packets>1</packets>\n"
+					"\t\t\t\t<encryption>None</encryption>\n");
+		fprintf( G.f_kis_xml, "\t\t\t</SSID>\n");
+	}
+
+	/* Channel
+	   FIXME: Take G.freqoption in account */
+	fprintf(G.f_kis_xml, "\t\t\t<channel>%d</channel>\n", client->channel);
+
+	/* Rate: inaccurate because it's the latest rate seen */
+	client_max_rate = ( client->rate_from > client->rate_to ) ? client->rate_from : client->rate_to ;
+	fprintf(G.f_kis_xml, "\t\t\t<maxseenrate>%.6f</maxseenrate>\n", client_max_rate / 1000000.0 );
+
+	/* Those 2 lines always stays the same */
+	fprintf(G.f_kis_xml, "\t\t\t<carrier>IEEE 802.11b+</carrier>\n");
+	fprintf(G.f_kis_xml, "\t\t\t<encoding>CCK</encoding>\n");
+
+	/* Packets */
+	fprintf(G.f_kis_xml, "\t\t\t<packets>\n"
+				"\t\t\t\t<LLC>0</LLC>\n"
+				"\t\t\t\t<data>0</data>\n"
+				"\t\t\t\t<crypt>0</crypt>\n"
+				"\t\t\t\t<total>%ld</total>\n"
+				"\t\t\t\t<fragments>0</fragments>\n"
+				"\t\t\t\t<retries>0</retries>\n"
+				"\t\t\t</packets>\n",
+				client->nb_pkt );
+
+	/* SNR information */
+	average_power = (client->power == -1) ? 0 : client->power;
+	fprintf(G.f_kis_xml, "\t\t\t<snr-info>\n"
+			"\t\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
+			"\t\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
+			"\t\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
+			"\t\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
+			"\t\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
+			"\t\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
+			"\t\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
+			"\t\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
+			"\t\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
+			"\t\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
+			"\t\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
+			"\t\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
+			 "\t\t\t</snr-info>\n",
+			 average_power, average_power, average_power,
+			 average_power, average_power );
+
+	/* GPS Coordinates
+	   XXX: We don't have GPS coordinates for clients */
+	if (G.usegpsd)
+	{
+		fprintf(G.f_kis_xml, "\t\t\t<gps-info>\n"
+					"\t\t\t\t<min-lat>%.6f</min-lat>\n"
+					"\t\t\t\t<min-lon>%.6f</min-lon>\n"
+					"\t\t\t\t<min-alt>%.6f</min-alt>\n"
+					"\t\t\t\t<min-spd>%.6f</min-spd>\n"
+					"\t\t\t\t<max-lat>%.6f</max-lat>\n"
+					"\t\t\t\t<max-lon>%.6f</max-lon>\n"
+					"\t\t\t\t<max-alt>%.6f</max-alt>\n"
+					"\t\t\t\t<max-spd>%.6f</max-spd>\n"
+					"\t\t\t\t<peak-lat>%.6f</peak-lat>\n"
+					"\t\t\t\t<peak-lon>%.6f</peak-lon>\n"
+					"\t\t\t\t<peak-alt>%.6f</peak-alt>\n"
+					"\t\t\t\t<avg-lat>%.6f</avg-lat>\n"
+					"\t\t\t\t<avg-lon>%.6f</avg-lon>\n"
+					"\t\t\t\t<avg-alt>%.6f</avg-alt>\n"
+					 "\t\t\t</gps-info>\n",
+					 0.0, 0.0, 0.0, 0.0,
+					 0.0, 0.0, 0.0, 0.0,
+					 0.0, 0.0, 0.0,
+					 0.0, 0.0, 0.0 );
+	}
+	fprintf(G.f_kis_xml, "\t\t</wireless-client>\n" );
+
+	return 0;
+}
+
+#define NETXML_ENCRYPTION_TAG "%s<encryption>%s</encryption>\n"
 int dump_write_kismet_netxml( void )
 {
-    int network_number, average_power, client_nbr;
-    int client_max_rate, unused;
+    int network_number, average_power, client_max_rate, max_power, client_nbr, unused;
     struct AP_info *ap_cur;
     struct ST_info *st_cur;
     char first_time[TIME_STR_LENGTH];
@@ -3913,7 +4256,7 @@
             continue;
         }
 
-        if(is_filtered_essid(ap_cur->essid) || ap_cur->nb_pkt < 2 /* XXX: Maybe this last check should be removed */ )
+        if(is_filtered_essid(ap_cur->essid))
         {
             ap_cur = ap_cur->next;
             continue;
@@ -3936,26 +4279,20 @@
 		fprintf(G.f_kis_xml, "\t\t\t<max-rate>%d.000000</max-rate>\n", ap_cur->max_speed );
 		fprintf(G.f_kis_xml, "\t\t\t<packets>%ld</packets>\n", ap_cur->nb_bcn );
 		fprintf(G.f_kis_xml, "\t\t\t<beaconrate>%d</beaconrate>\n", 10 );
-		fprintf(G.f_kis_xml, "\t\t\t<encryption>");
-		//Encryption
-		if( (ap_cur->security & (STD_OPN|STD_WEP|STD_WPA|STD_WPA2)) != 0)
-		{
-			if( ap_cur->security & STD_WPA2 ) fprintf( G.f_kis_xml, "WPA2 " );
-			if( ap_cur->security & STD_WPA  ) fprintf( G.f_kis_xml, "WPA " );
-			if( ap_cur->security & STD_WEP  ) fprintf( G.f_kis_xml, "WEP " );
-			if( ap_cur->security & STD_OPN  ) fprintf( G.f_kis_xml, "OPN " );
-		}
 
-		if( (ap_cur->security & (ENC_WEP|ENC_TKIP|ENC_WRAP|ENC_CCMP|ENC_WEP104|ENC_WEP40)) != 0 )
+		// Encryption
+		if( ap_cur->security & STD_OPN  ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "None" );
+		else if( ap_cur->security & STD_WEP  ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP" );
+		else if( ap_cur->security & STD_WPA2 || ap_cur->security & STD_WPA  )
 		{
-			if( ap_cur->security & ENC_CCMP   ) fprintf( G.f_kis_xml, "AES-CCM ");
-			if( ap_cur->security & ENC_WRAP   ) fprintf( G.f_kis_xml, "WRAP ");
-			if( ap_cur->security & ENC_TKIP   ) fprintf( G.f_kis_xml, "TKIP ");
-			if( ap_cur->security & ENC_WEP104 ) fprintf( G.f_kis_xml, "WEP104 ");
-			if( ap_cur->security & ENC_WEP40  ) fprintf( G.f_kis_xml, "WEP40 ");
-/*      	if( ap_cur->security & ENC_WEP    ) fprintf( G.f_kis_xml, "WEP ");*/
+			if( ap_cur->security & ENC_TKIP   ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+TKIP" );
+			if( ap_cur->security & AUTH_MGT   ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+MGT" ); // Not a valid value: NetXML does not have a value for WPA Enterprise
+			if( ap_cur->security & AUTH_PSK   ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+PSK" );
+			if( ap_cur->security & ENC_CCMP   ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+AES-CCM" );
+			if( ap_cur->security & ENC_WRAP   ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WPA+AES-OCB" );
 		}
-		fprintf(G.f_kis_xml, "</encryption>\n");
+		else if( ap_cur->security & ENC_WEP104 ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP104" );
+		else if( ap_cur->security & ENC_WEP40  ) fprintf( G.f_kis_xml, NETXML_ENCRYPTION_TAG, "\t\t\t", "WEP40" );
 
 		/* ESSID */
 		fprintf(G.f_kis_xml, "\t\t\t<essid cloaked=\"%s\">",
@@ -3983,17 +4320,21 @@
 
 		/* Channel
 		   FIXME: Take G.freqoption in account */
-		fprintf(G.f_kis_xml, "\t\t<channel>%d</channel>\n", ap_cur->channel);
+		fprintf(G.f_kis_xml, "\t\t<channel>%d</channel>\n", (ap_cur->channel) == -1 ? 0 : ap_cur->channel);
 
 		/* Freq (in Mhz) and total number of packet on that frequency
 		   FIXME: Take G.freqoption in account */
 		fprintf(G.f_kis_xml, "\t\t<freqmhz>%d %ld</freqmhz>\n",
-					getFrequencyFromChannel(ap_cur->channel),
+					(ap_cur->channel) == -1 ? 0 : getFrequencyFromChannel(ap_cur->channel),
 					//ap_cur->nb_data + ap_cur->nb_bcn );
 					ap_cur->nb_pkt );
 
 		/* XXX: What about 5.5Mbit */
-		fprintf(G.f_kis_xml, "\t\t<maxseenrate>%d</maxseenrate>\n", ap_cur->max_speed * 1000);
+		fprintf(G.f_kis_xml, "\t\t<maxseenrate>%d</maxseenrate>\n", (ap_cur->max_speed == -1) ? 0 : ap_cur->max_speed * 1000);
+
+		/* Those 2 lines always stays the same */
+		fprintf(G.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
+		fprintf(G.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
 
 		/* Packets */
 		fprintf(G.f_kis_xml, "\t\t<packets>\n"
@@ -4004,15 +4345,12 @@
 					"\t\t\t<fragments>0</fragments>\n"
 					"\t\t\t<retries>0</retries>\n"
 					"\t\t</packets>\n",
-					ap_cur->nb_bcn, ap_cur->nb_data,
+					ap_cur->nb_data, ap_cur->nb_data,
 					//ap_cur->nb_data + ap_cur->nb_bcn );
 					ap_cur->nb_pkt );
 
 
-		/*
-		 * XXX: What does that field mean? Is it the total size of data?
-		 *      It seems that 'd' is appended at the end for clients, why?
-		 */
+		/* XXX: What does that field mean? Is it the total size of data? */
 		fprintf(G.f_kis_xml, "\t\t<datasize>0</datasize>\n");
 
 		/* Client information */
@@ -4021,119 +4359,21 @@
 
 		while ( st_cur != NULL )
 		{
-			/* If not associated or Broadcast Mac, try next one */
-			if ( st_cur->base == NULL ||
-				 memcmp( st_cur->stmac, BROADCAST, 6 ) == 0  )
+			/* Check if the station is associated to the current AP */
+			if ( memcmp( st_cur->stmac, BROADCAST, 6 ) != 0 &&
+				st_cur->base != NULL &&
+				memcmp( st_cur->base->bssid, ap_cur->bssid, 6 ) == 0 )
 			{
-				st_cur = st_cur->next;
-				continue;
+				dump_write_kismet_netxml_client_info(st_cur, ++client_nbr);
 			}
 
-			/* Compare BSSID */
-			if ( memcmp( st_cur->base->bssid, ap_cur->bssid, 6 ) != 0 )
-			{
-				st_cur = st_cur->next;
-				continue;
-			}
-
-			++client_nbr;
-
-
-			strncpy(first_time, ctime(&st_cur->tinit), TIME_STR_LENGTH - 1);
-			first_time[strlen(first_time) - 1] = 0; // remove new line
-
-			strncpy(last_time, ctime(&st_cur->tlast), TIME_STR_LENGTH - 1);
-			last_time[strlen(last_time) - 1] = 0; // remove new line
-
-			fprintf(G.f_kis_xml, "\t\t<wireless-client number=\"%d\" "
-								 "type=\"established\" first-time=\"%s\""
-								 " last-time=\"%s\">\n",
-								 client_nbr, first_time, last_time );
-
-			fprintf( G.f_kis_xml, "\t\t\t<client-mac>%02X:%02X:%02X:%02X:%02X:%02X</client-mac>\n",
-						 st_cur->stmac[0], st_cur->stmac[1],
-						 st_cur->stmac[2], st_cur->stmac[3],
-						 st_cur->stmac[4], st_cur->stmac[5] );
-
-			/* Manufacturer, if set using standard oui list */
-			fprintf(G.f_kis_xml, "\t\t\t<client-manuf>%s</client-manuf>\n", (st_cur->manuf != NULL) ? st_cur->manuf : "Unknown");
-
-			/* Channel
-			   FIXME: Take G.freqoption in account */
-			fprintf(G.f_kis_xml, "\t\t\t<channel>%d</channel>\n", ap_cur->channel);
-
-			/* Rate: unaccurate because it's the latest rate seen */
-			client_max_rate = ( st_cur->rate_from > st_cur->rate_to ) ? st_cur->rate_from : st_cur->rate_to ;
-			fprintf(G.f_kis_xml, "\t\t\t<maxseenrate>%.6f</maxseenrate>\n", client_max_rate / 1000000.0 );
-
-			/* Packets */
-			fprintf(G.f_kis_xml, "\t\t\t<packets>\n"
-						"\t\t\t\t<LLC>0</LLC>\n"
-						"\t\t\t\t<data>0</data>\n"
-						"\t\t\t\t<crypt>0</crypt>\n"
-						"\t\t\t\t<total>%ld</total>\n"
-						"\t\t\t\t<fragments>0</fragments>\n"
-						"\t\t\t\t<retries>0</retries>\n"
-						"\t\t\t</packets>\n",
-						st_cur->nb_pkt );
-
-			/* SNR information */
-			average_power = (st_cur->power == -1) ? 0 : st_cur->power;
-			fprintf(G.f_kis_xml, "\t\t\t<snr-info>\n"
-					"\t\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
-					"\t\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
-					"\t\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
-					"\t\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
-					"\t\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
-					"\t\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
-					"\t\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
-					"\t\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
-					"\t\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
-					"\t\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
-					"\t\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
-					"\t\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
-					 "\t\t\t</snr-info>\n",
-					 average_power, average_power, average_power,
-					 average_power, average_power );
-
-			/* GPS Coordinates
-			   XXX: We don't have GPS coordinates for clients */
-			if (G.usegpsd)
-			{
-				fprintf(G.f_kis_xml, "\t\t<gps-info>\n"
-							"\t\t\t<min-lat>%.6f</min-lat>\n"
-							"\t\t\t<min-lon>%.6f</min-lon>\n"
-							"\t\t\t<min-alt>%.6f</min-alt>\n"
-							"\t\t\t<min-spd>%.6f</min-spd>\n"
-							"\t\t\t<max-lat>%.6f</max-lat>\n"
-							"\t\t\t<max-lon>%.6f</max-lon>\n"
-							"\t\t\t<max-alt>%.6f</max-alt>\n"
-							"\t\t\t<max-spd>%.6f</max-spd>\n"
-							"\t\t\t<peak-lat>%.6f</peak-lat>\n"
-							"\t\t\t<peak-lon>%.6f</peak-lon>\n"
-							"\t\t\t<peak-alt>%.6f</peak-alt>\n"
-							"\t\t\t<avg-lat>%.6f</avg-lat>\n"
-							"\t\t\t<avg-lon>%.6f</avg-lon>\n"
-							"\t\t\t<avg-alt>%.6f</avg-alt>\n"
-							 "\t\t</gps-info>\n",
-							 0.0, 0.0, 0.0, 0.0,
-							 0.0, 0.0, 0.0, 0.0,
-							 0.0, 0.0, 0.0,
-							 0.0, 0.0, 0.0 );
-			}
-
-
-			/* Trailing information */
-			fprintf(G.f_kis_xml, "\t\t\t<cdp-device></cdp-device>\n"
-								 "\t\t\t<cdp-portid></cdp-portid>\n");
-			fprintf(G.f_kis_xml, "\t\t</wireless-client>\n" );
-
 			/* Next client */
 			st_cur = st_cur->next;
 		}
 
 		/* SNR information */
 		average_power = (ap_cur->avg_power == -1) ? 0 : ap_cur->avg_power;
+		max_power = (ap_cur->best_power == -1) ? average_power : ap_cur->best_power;
 		fprintf(G.f_kis_xml, "\t\t<snr-info>\n"
 					"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
 					"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
@@ -4149,7 +4389,7 @@
 					"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
 					 "\t\t</snr-info>\n",
 					 average_power, average_power, average_power,
-					 average_power, average_power );
+					 max_power, max_power );
 
 		/* GPS Coordinates */
 		if (G.usegpsd)
@@ -4187,9 +4427,11 @@
 						ap_cur->gps_loc_best[2] );
 		}
 
+		/* BSS Timestamp */
+		fprintf(G.f_kis_xml, "\t\t<bsstimestamp>%llu</bsstimestamp>\n", ap_cur->timestamp);
+
 		/* Trailing information */
-		fprintf(G.f_kis_xml, "\t\t<bsstimestamp>0</bsstimestamp>\n"
-					 "\t\t<cdp-device></cdp-device>\n"
+		fprintf(G.f_kis_xml, "\t\t<cdp-device></cdp-device>\n"
 					 "\t\t<cdp-portid></cdp-portid>\n");
 
 		/* Closing tag for the current wireless network */
@@ -4199,6 +4441,128 @@
         ap_cur = ap_cur->next;
     }
 
+	/* Write all unassociated stations */
+	st_cur = G.st_1st;
+	while (st_cur != NULL) {
+		/* If not associated and not Broadcast Mac */
+		if ( st_cur->base == NULL || memcmp(st_cur->base->bssid, BROADCAST, 6) == 0 )
+		{
+			++network_number; // Network Number
+
+			/* Write new network information */
+			strncpy(first_time, ctime(&st_cur->tinit), TIME_STR_LENGTH - 1);
+			first_time[strlen(first_time) - 1] = 0; // remove new line
+			
+			strncpy(last_time, ctime(&st_cur->tlast), TIME_STR_LENGTH - 1);
+			last_time[strlen(last_time) - 1] = 0; // remove new line
+			
+			fprintf(G.f_kis_xml, "\t<wireless-network number=\"%d\" type=\"probe\" ",
+				network_number);
+			fprintf(G.f_kis_xml, "first-time=\"%s\" last-time=\"%s\">\n", first_time, last_time);
+
+			/* BSSID */
+			fprintf( G.f_kis_xml, "\t\t<BSSID>%02X:%02X:%02X:%02X:%02X:%02X</BSSID>\n",
+					 st_cur->stmac[0], st_cur->stmac[1],
+					 st_cur->stmac[2], st_cur->stmac[3],
+					 st_cur->stmac[4], st_cur->stmac[5] );
+
+			/* Manufacturer, if set using standard oui list */
+			manuf = sanitize_xml((unsigned char *)st_cur->manuf, strlen(st_cur->manuf));
+			fprintf(G.f_kis_xml, "\t\t<manuf>%s</manuf>\n", (manuf != NULL) ? manuf : "Unknown");
+			free(manuf);
+
+			/* Channel
+			   FIXME: Take G.freqoption in account */
+			fprintf(G.f_kis_xml, "\t\t<channel>%d</channel>\n", st_cur->channel);
+
+			/* Freq (in Mhz) and total number of packet on that frequency
+			   FIXME: Take G.freqoption in account */
+			fprintf(G.f_kis_xml, "\t\t<freqmhz>%d %ld</freqmhz>\n",
+						getFrequencyFromChannel(st_cur->channel),
+						st_cur->nb_pkt );
+
+			/* Rate: inaccurate because it's the latest rate seen */
+			client_max_rate = ( st_cur->rate_from > st_cur->rate_to ) ? st_cur->rate_from : st_cur->rate_to ;
+			fprintf(G.f_kis_xml, "\t\t<maxseenrate>%.6f</maxseenrate>\n", client_max_rate / 1000000.0 );
+
+			fprintf(G.f_kis_xml, "\t\t<carrier>IEEE 802.11b+</carrier>\n");
+			fprintf(G.f_kis_xml, "\t\t<encoding>CCK</encoding>\n");
+
+			/* Packets */
+			fprintf(G.f_kis_xml, "\t\t<packets>\n"
+					"\t\t\t<LLC>0</LLC>\n"
+					"\t\t\t<data>0</data>\n"
+					"\t\t\t<crypt>0</crypt>\n"
+					"\t\t\t<total>%ld</total>\n"
+					"\t\t\t<fragments>0</fragments>\n"
+					"\t\t\t<retries>0</retries>\n"
+					"\t\t</packets>\n",
+					st_cur->nb_pkt);
+
+			/* XXX: What does that field mean? Is it the total size of data? */
+			fprintf(G.f_kis_xml, "\t\t<datasize>0</datasize>\n");
+	
+			/* SNR information */
+			average_power = (st_cur->power == -1) ? 0 : st_cur->power;
+			fprintf(G.f_kis_xml, "\t\t<snr-info>\n"
+						"\t\t\t<last_signal_dbm>%d</last_signal_dbm>\n"
+						"\t\t\t<last_noise_dbm>0</last_noise_dbm>\n"
+						"\t\t\t<last_signal_rssi>%d</last_signal_rssi>\n"
+						"\t\t\t<last_noise_rssi>0</last_noise_rssi>\n"
+						"\t\t\t<min_signal_dbm>%d</min_signal_dbm>\n"
+						"\t\t\t<min_noise_dbm>0</min_noise_dbm>\n"
+						"\t\t\t<min_signal_rssi>1024</min_signal_rssi>\n"
+						"\t\t\t<min_noise_rssi>1024</min_noise_rssi>\n"
+						"\t\t\t<max_signal_dbm>%d</max_signal_dbm>\n"
+						"\t\t\t<max_noise_dbm>0</max_noise_dbm>\n"
+						"\t\t\t<max_signal_rssi>%d</max_signal_rssi>\n"
+						"\t\t\t<max_noise_rssi>0</max_noise_rssi>\n"
+						 "\t\t</snr-info>\n",
+						 average_power, average_power, average_power,
+						 average_power, average_power );
+
+			/* GPS Coordinates
+			   XXX: We don't have GPS coordinates for clients */
+			if (G.usegpsd)
+			{
+				fprintf(G.f_kis_xml, "\t\t<gps-info>\n"
+							"\t\t\t<min-lat>%.6f</min-lat>\n"
+							"\t\t\t<min-lon>%.6f</min-lon>\n"
+							"\t\t\t<min-alt>%.6f</min-alt>\n"
+							"\t\t\t<min-spd>%.6f</min-spd>\n"
+							"\t\t\t<max-lat>%.6f</max-lat>\n"
+							"\t\t\t<max-lon>%.6f</max-lon>\n"
+							"\t\t\t<max-alt>%.6f</max-alt>\n"
+							"\t\t\t<max-spd>%.6f</max-spd>\n"
+							"\t\t\t<peak-lat>%.6f</peak-lat>\n"
+							"\t\t\t<peak-lon>%.6f</peak-lon>\n"
+							"\t\t\t<peak-alt>%.6f</peak-alt>\n"
+							"\t\t\t<avg-lat>%.6f</avg-lat>\n"
+							"\t\t\t<avg-lon>%.6f</avg-lon>\n"
+							"\t\t\t<avg-alt>%.6f</avg-alt>\n"
+							 "\t\t</gps-info>\n",
+							 0.0, 0.0, 0.0, 0.0,
+							 0.0, 0.0, 0.0, 0.0,
+							 0.0, 0.0, 0.0,
+							 0.0, 0.0, 0.0 );
+			}
+
+			fprintf(G.f_kis_xml, "\t\t<bsstimestamp>0</bsstimestamp>\n");
+
+			/* CDP information */
+			fprintf(G.f_kis_xml, "\t\t<cdp-device></cdp-device>\n"
+					 	"\t\t<cdp-portid></cdp-portid>\n");
+
+
+			/* Write client information */
+			dump_write_kismet_netxml_client_info(st_cur, 1);
+
+			fprintf(G.f_kis_xml, "\t</wireless-network>");
+		}
+		st_cur = st_cur->next;
+	}
+	/* TODO: Also go through na_1st */
+
 	/* Trailing */
     fprintf( G.f_kis_xml, "%s\n", KISMET_NETXML_TRAILER );
 
@@ -4409,15 +4773,204 @@
     return 0;
 }
 
+/* See if a string contains a character in the first "n" bytes.
+ * 
+ * Returns a pointer to the first occurrence of the character, or NULL
+ * if the character is not present in the string.
+ * 
+ * Breaks the str* naming convention to avoid a name collision if we're
+ * compiling on a system that has strnchr()
+ */
+static char *strchr_n(char *str, int c, size_t n)
+{
+	size_t count = 0;
+	if (str == NULL || n == 0)
+	{
+		return NULL;
+	}
+	while(*str != c && *str != '\0' && count < n)
+	{
+		str++;
+		count++;
+	}
+
+	return (*str == c) ? str : NULL;
+}
+
+/* Read at least one full line from the network.
+ * 
+ * Returns the amount of data in the buffer on success, 0 on connection
+ * closed, or a negative value on error.
+ * 
+ * If the return value is >0, the buffer contains at least one newline
+ * character.  If the return value is <= 0, the contents of the buffer
+ * are undefined.
+ */
+static int read_line(int sock, char *buffer, int pos, int size)
+{
+	int status = 1;
+	if (pos < 0 || size < 1 || pos >= size || buffer == NULL || sock < 0)
+	{
+		return -1;
+	}
+	while(strchr_n(buffer, 0x0A, pos) == NULL && status > 0  && pos < size )
+	{
+		status = recv(sock, buffer+pos, size-pos, 0);
+		if(status > 0)
+		{
+			pos += status;
+		}
+	}
+
+	if(status <= 0)
+	{
+		return status;
+	}
+	else if(pos == size && strchr_n(buffer, 0x0A, pos) == NULL)
+	{
+		return -1;
+	}
+	
+	return pos;
+}
+
+/* Remove a newline-terminated block of data from a buffer, replacing 
+ * the newline with a '\0'.
+ * 
+ * Returns the number of characters left in the buffer, or -1 if the 
+ * buffer did not contain a newline.
+ */
+static int get_line_from_buffer(char *buffer, int size, char *line)
+{
+	char *cursor = strchr_n(buffer, 0x0A, size);
+	if(NULL != cursor)
+	{
+		*cursor = '\0';
+		cursor++;
+		strcpy(line, buffer);
+		memmove(buffer, cursor, size - (strlen(line) + 1));
+		return size - (strlen(line) + 1);
+	}
+	
+	return -1;
+} 
+
+/* Extract a name:value pair from a null-terminated line of JSON.
+ * 
+ * Returns 1 if the name was found, or 0 otherwise. 
+ * 
+ * The string in "value" is null-terminated if the name was found.  If
+ * the name was not found, the contents of "value" are undefined. 
+ */
+static int json_get_value_for_name( const char *buffer, const char *name, char *value )
+{
+	char * to_find;
+	char *cursor;
+	size_t to_find_len;
+	char *vcursor = value;
+	int ret = 0;
+	
+	if (buffer == NULL || strlen(buffer) == 0 || name == NULL || strlen(name) == 0 || value == NULL)
+	{
+		return 0;
+	}
+
+	to_find_len = strlen(name) + 3;
+	to_find = (char*) malloc(to_find_len);
+	snprintf(to_find, sizeof(to_find), "\"%s\"", name);
+	cursor = strstr(buffer, to_find);
+	free(to_find);
+	if(cursor != NULL)
+	{
+		cursor += to_find_len -1;
+		while(*cursor != ':' && *cursor != '\0')
+		{
+			cursor++;
+		}
+		if(*cursor != '\0')
+		{
+			cursor++;
+			while(isspace(*cursor) && *cursor != '\0')
+			{
+				cursor++;
+			}
+		}
+		if('\0' == *cursor)
+		{
+			return 0;
+		}
+
+		if('"' == *cursor)
+		{
+			/* Quoted string */
+			cursor++;
+			while(*cursor != '"' && *cursor != '\0')
+			{
+				if('\\' == *cursor && '"' == *(cursor+1))
+				{
+					/* Escaped quote */
+					*vcursor = '"';
+					cursor++;
+				}
+				else
+				{
+					*vcursor = *cursor;
+				}
+				vcursor++;
+				cursor++;
+			}
+			*vcursor = '\0';
+			ret = 1;
+		}
+		else if(strncmp(cursor, "true", 4) == 0)
+		{
+			/* Boolean */
+			strcpy(value, "true");
+			ret = 1;
+		}
+		else if(strncmp(cursor, "false", 5) == 0)
+		{
+			/* Boolean */
+			strcpy(value, "false");
+			ret = 1;
+		}
+		else if('{' == *cursor || '[' == *cursor)
+		{
+			/* Object or array.  Too hard to handle and not needed for
+			 * getting coords from GPSD, so pretend we didn't see anything.
+			 */
+			ret = 0;
+		}
+		else
+		{
+			/* Number, supposedly.  Copy as-is. */
+			while(*cursor != ',' && *cursor != '}' && !isspace(*cursor))
+			{
+				*vcursor = *cursor;
+				cursor++; vcursor++;
+			}
+			*vcursor = '\0';
+			ret = 1;
+		}
+	}
+
+	return ret;
+}
+
 void gps_tracker( void )
 {
 	ssize_t unused;
     int gpsd_sock;
-    char line[256], *temp;
+    char line[1537], buffer[1537], data[1537];
+    char *temp;
     struct sockaddr_in gpsd_addr;
     int ret, is_json, pos;
+    int mode;
     fd_set read_fd;
     struct timeval timeout;
+    memset(line, 0, 1537);
+    memset(buffer, 0, 1537);
+    memset(data, 0, 1537);
 
     /* attempt to connect to localhost, port 2947 */
 
@@ -4438,50 +4991,54 @@
     }
 
     // Check if it's GPSd < 2.92 or the new one
-    // 2.92+ immediately send stuff
+    // 2.92+ immediately sends version information
     // < 2.92 requires to send PVTAD command
     FD_ZERO(&read_fd);
     FD_SET(gpsd_sock, &read_fd);
     timeout.tv_sec = 1;
     timeout.tv_usec = 0;
     is_json = select(gpsd_sock + 1, &read_fd, NULL, NULL, &timeout);
-    if (is_json) {
-    	/*
-			{"class":"VERSION","release":"2.95","rev":"2010-11-16T21:12:35","proto_major":3,"proto_minor":3}
-			?WATCH={"json":true};
-			{"class":"DEVICES","devices":[]}
-    	 */
-
+    
+    if (is_json > 0) {
+		/* Probably JSON.  Read the first line and verify it's a version of the protocol we speak. */
 
-    	// Get the crap and ignore it: {"class":"VERSION","release":"2.95","rev":"2010-11-16T21:12:35","proto_major":3,"proto_minor":3}
-    	if( recv( gpsd_sock, line, sizeof( line ) - 1, 0 ) <= 0 )
+    	if((pos = read_line(gpsd_sock, buffer, 0, sizeof(buffer))) <= 0)
     		return;
+    	
+    	pos = get_line_from_buffer(buffer, pos, line);
 
-    	is_json = (line[0] == '{');
+    	is_json = (json_get_value_for_name(line, "class", data) &&
+    			   strncmp(data, "VERSION", 7) == 0);
+		
     	if (is_json) {
-			// Send ?WATCH={"json":true};
-			memset( line, 0, sizeof( line ) );
-			strcpy(line, "?WATCH={\"json\":true};\n");
-			if( send( gpsd_sock, line, 22, 0 ) != 22 )
+			/* Verify it's a version of the protocol we speak */
+			if(json_get_value_for_name(line, "proto_major", data) && data[0] != '3')
+			{
+				/* It's an unknown version of the protocol.  Bail out. */
 				return;
-
-			// Check that we have devices
+			}
+			
+			// Send ?WATCH={"json":true};
 			memset(line, 0, sizeof(line));
-			if( recv( gpsd_sock, line, sizeof( line ) - 1, 0 ) <= 0 )
-				return;
-
-			// Stop processing if there is no device
-			if (strncmp(line, "{\"class\":\"DEVICES\",\"devices\":[]}", 32) == 0) {
-				close(gpsd_sock);
+			strcpy(line, "?WATCH={\"json\":true};\n");
+			if(send(gpsd_sock, line, 22, 0) != 22)
+			{
 				return;
-			} else {
-				pos = strlen(line);
 			}
+			// Device check removed -- if there isn't a device, just
+			// read and discard lines until the user plugs one in, at
+			// which point GPSD will start emitting coordinates.
     	}
     }
+    else if(is_json < 0)
+    {
+		/* An error occurred while we were waiting for data */
+		return;
+	}
+	/* Else select() returned zero (timeout expired) and we assume we're
+	 * connected to an old-style gpsd. */
 
     /* loop reading the GPS coordinates */
-
     while( G.do_exit == 0 )
     {
         usleep( 500000 );
@@ -4491,78 +5048,91 @@
         if (is_json) {
         	// Format definition: http://catb.org/gpsd/gpsd_json.html
 
-        	if (pos == sizeof( line )) {
-        		memset(line, 0, sizeof(line));
-        		pos = 0;
-        	}
+		if( (pos = read_line(gpsd_sock, buffer, pos, sizeof(buffer))) <= 0 )
+		{
+			return;
+		}
+		pos = get_line_from_buffer(buffer, pos, line);
+
+		// See if we got a TPV report
+		if(!json_get_value_for_name(line, "class", data) ||
+			strncmp(data, "TPV", 3) != 0)
+		{
+			/* Not a TPV report.  Get another line. */
 
-        	// New version, JSON
-        	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
-        		return;
-
-        	// search for TPV class: {"class":"TPV"
-        	temp = strstr(line, "{\"class\":\"TPV\"");
-        	if (temp == NULL) {
         		continue;
         	}
 
-        	// Make sure the data we have is complete
-        	if (strchr(temp, '}') == NULL) {
-        		// Move the data at the beginning of the buffer;
-        		pos = strlen(temp);
-        		if (temp != line) {
-        			memmove(line, temp, pos);
-        			memset(line + pos, 0, sizeof(line) - pos);
-        		}
-        	}
+		/* See what sort of GPS fix we got.  Possibilities are:
+		* 0: No data
+		* 1: No fix
+		* 2: Lat/Lon, but no alt
+		* 3: Lat/Lon/Alt
+		* Either 2 or 3 may also have speed and heading data.
+		*/
+		if(!json_get_value_for_name(line, "mode", data) ||
+			(mode = atoi(data)) < 2)
+		{
+			/* No GPS fix, so there are no coordinates to extract. */
+			continue;
+		}
 
-			// Example line: {"class":"TPV","tag":"MID2","device":"/dev/ttyUSB0","time":1350957517.000,"ept":0.005,"lat":46.878936576,"lon":-115.832602964,"alt":1968.382,"track":0.0000,"speed":0.000,"climb":0.000,"mode":3}
+		/* Extract the available data from the TPV report.  If we're
+		* in mode 2, latitude and longitude are mandatory, altitude
+		* is set to 0, and speed and heading are optional.
+		* In mode 3, latitude, longitude, and altitude are mandatory,
+		* while speed and heading are optional.
+		* If we can't get a mandatory value, the line is discarded
+		* as fragmentary or malformed.  If we can't get an optional
+		* value, we default it to 0.
+		*/
 
         	// Latitude
-        	temp = strstr(temp, "\"lat\":");
-			if (temp == NULL) {
-				continue;
-			}
-
-			ret = sscanf(temp + 6, "%f", &G.gps_loc[0]);
-
-			// Longitude
-			temp = strstr(temp, "\"lon\":");
-			if (temp == NULL) {
-				continue;
-			}
+        	if(!json_get_value_for_name(line, "lat", data))
+			continue;
+		if(1 != sscanf(data, "%f", &G.gps_loc[0]))
+			continue;
 
-			ret = sscanf(temp + 6, "%f", &G.gps_loc[1]);
+		// Longitude
+		if(!json_get_value_for_name(line, "lon", data))
+			continue;
+		if(1 != sscanf(data, "%f", &G.gps_loc[1]))
+			continue;
 
-			// Altitude
-			temp = strstr(temp, "\"alt\":");
-			if (temp == NULL) {
+		// Altitude
+		if(3 == mode)
+		{
+			if(!json_get_value_for_name(line, "alt", data))
 				continue;
-			}
-
-			ret = sscanf(temp + 6, "%f", &G.gps_loc[4]);
-
-			// Speed
-			temp = strstr(temp, "\"speed\":");
-			if (temp == NULL) {
+			if(1 != sscanf(data, "%f", &G.gps_loc[4]))
 				continue;
-			}
-
-			ret = sscanf(temp + 6, "%f", &G.gps_loc[2]);
-
-			// No more heading
+		}
+		else
+		{
+			G.gps_loc[4] = 0;
+		}
 
-			// Get the next TPV class
-			temp = strstr(temp, "{\"class\":\"TPV\"");
-			if (temp == NULL) {
-				memset( line, 0, sizeof( line ) );
-				pos = 0;
-			} else {
-				pos = strlen(temp);
-				memmove(line, temp, pos);
-				memset(line + pos, 0, sizeof(line) - pos);
-			}
+		// Speed
+		if(!json_get_value_for_name(line, "speed", data))
+		{
+			G.gps_loc[2] = 0;
+		}
+		else
+		{
+			if(1 != sscanf(data, "%f", &G.gps_loc[2]))
+				G.gps_loc[2] = 0;
+		}
 
+		// Heading
+		if(!json_get_value_for_name(line, "track", data))
+		{
+			G.gps_loc[3] = 0;
+		}
+		else
+		{
+			if(1 != sscanf(data, "%f", &G.gps_loc[3]))
+				G.gps_loc[3] = 0;
+		}
         } else {
         	memset( line, 0, sizeof( line ) );
 
@@ -5561,6 +6131,8 @@
         {"ignore-negative-one", 0, &G.ignore_negative_one, 1},
         {"manufacturer",  0, 0, 'M'},
         {"uptime",   0, 0, 'U'},
+        {"write-interval", 1, 0, 'I'},
+        {"wps",  0, 0, 'W'},
         {0,          0, 0,  0 }
     };
 
@@ -5644,7 +6216,9 @@
     G.output_format_csv = 1;
     G.output_format_kismet_csv = 1;
     G.output_format_kismet_netxml = 1;
-
+    G.file_write_interval = 5; // Write file every 5 seconds by default
+    G.maxsize_wps_seen  =  6;
+    G.show_wps     = 0;
 #ifdef HAVE_PCRE
     G.f_essid_regex = NULL;
 #endif
@@ -5726,7 +6300,7 @@
         option_index = 0;
 
         option = getopt_long( argc, argv,
-                        "b:c:egiw:s:t:u:m:d:N:R:aHDB:Ahf:r:EC:o:x:MU",
+                        "b:c:egiw:s:t:u:m:d:N:R:aHDB:Ahf:r:EC:o:x:MUI:W",
                         long_options, &option_index );
 
         if( option < 0 ) break;
@@ -5747,6 +6321,21 @@
                 printf("\"%s --help\" for help.\n", argv[0]);
                 return( 1 );
 
+            case 'I':
+
+            	if (!is_string_number(optarg)) {
+            		printf("Error: Write interval is not a number (>0). Aborting.\n");
+            		exit ( 1 );
+            	}
+            	
+            	G.file_write_interval = atoi(optarg);
+            	
+            	if (G.file_write_interval <= 0) {
+            		printf("Error: Write interval must be greater than 0. Aborting.\n");
+            		exit ( 1 );
+            	}
+            	break;
+                
 			case 'E':
 				G.detect_anomaly = 1;
 				break;
@@ -5785,6 +6374,11 @@
 	    		G.show_uptime = 1;
 	    		break;
 
+            case 'W':
+
+                G.show_wps = 1;
+                break;
+
             case 'c' :
 
                 if (G.channel[0] > 0 || G.chanoption == 1) {
@@ -6138,6 +6732,9 @@
         return( 1 );
     }
 
+    if (G.show_wps && G.show_manufacturer)
+        G.maxsize_essid_seen += G.maxsize_wps_seen;
+
     if(G.s_iface != NULL)
     {
         /* initialize cards */
@@ -6383,26 +6980,25 @@
             break;
         }
 
-        if( time( NULL ) - tt1 >= 5 )
+        if( time( NULL ) - tt1 >= G.file_write_interval )
         {
-            /* update the csv stats file */
+            /* update the text output files */
 
             tt1 = time( NULL );
             if (G. output_format_csv)  dump_write_csv();
             if (G.output_format_kismet_csv) dump_write_kismet_csv();
             if (G.output_format_kismet_netxml) dump_write_kismet_netxml();
-
-            /* sort the APs by power */
-
-	    if(G.sort_by != SORT_BY_NOTHING) {
-		pthread_mutex_lock( &(G.mx_sort) );
-		    dump_sort();
-		pthread_mutex_unlock( &(G.mx_sort) );
-	    }
         }
 
-        if( time( NULL ) - tt2 > 3 )
+        if( time( NULL ) - tt2 > 5 )
         {
+        	if( G.sort_by != SORT_BY_NOTHING) {
+				/* sort the APs by power */
+				pthread_mutex_lock( &(G.mx_sort) );
+				dump_sort();
+				pthread_mutex_unlock( &(G.mx_sort) );
+        	}
+
             /* update the battery state */
             free(G.batt);
             G.batt = NULL;
@@ -6426,10 +7022,10 @@
 
         gettimeofday( &tv1, NULL );
 
-        cycle_time = 1000000 * ( tv1.tv_sec  - tv3.tv_sec  )
+        cycle_time = 1000000UL * ( tv1.tv_sec  - tv3.tv_sec  )
                              + ( tv1.tv_usec - tv3.tv_usec );
 
-        cycle_time2 = 1000000 * ( tv1.tv_sec  - tv4.tv_sec  )
+        cycle_time2 = 1000000UL * ( tv1.tv_sec  - tv4.tv_sec  )
                               + ( tv1.tv_usec - tv4.tv_usec );
 
         if( G.active_scan_sim > 0 && cycle_time2 > G.active_scan_sim*1000 )
@@ -6567,7 +7163,7 @@
                 {
                     gettimeofday( &tv2, NULL );
 
-                    time_slept += 1000000 * ( tv2.tv_sec  - tv1.tv_sec  )
+                    time_slept += 1000000UL * ( tv2.tv_sec  - tv1.tv_sec  )
                                         + ( tv2.tv_usec - tv1.tv_usec );
 
                     continue;
@@ -6586,7 +7182,7 @@
 
         gettimeofday( &tv2, NULL );
 
-        time_slept += 1000000 * ( tv2.tv_sec  - tv1.tv_sec  )
+        time_slept += 1000000UL * ( tv2.tv_sec  - tv1.tv_sec  )
                               + ( tv2.tv_usec - tv1.tv_usec );
 
         if( time_slept > REFRESH_RATE && time_slept > G.update_s * 1000000)
@@ -6688,7 +7284,7 @@
 
     if(G.own_channels)
         free(G.own_channels);
-    
+
     if(G.f_essid)
         free(G.f_essid);

aircrack-ng-1.2-rc1.tar.gz/src/airodump-ng.h -> aircrack-ng-1.2-rc2.tar.gz/src/airodump-ng.h Changed

@@ -142,10 +142,20 @@
 "\x00\x00\x00\x00\x00\x00\x00\x00"
 "\x00\x00\x00\x00\x00\x00\x00\x00";
 
-#define OUI_PATH0 "/etc/aircrack-ng/airodump-ng-oui.txt"
-#define OUI_PATH1 "/usr/local/etc/aircrack-ng/airodump-ng-oui.txt"
-#define OUI_PATH2 "/usr/share/aircrack-ng/airodump-ng-oui.txt"
-#define OUI_PATH3 "/usr/share/misc/oui.txt"
+const char *OUI_PATHS[] = {
+    "/etc/aircrack-ng/airodump-ng-oui.txt",
+    "/usr/local/etc/aircrack-ng/airodump-ng-oui.txt",
+    "/usr/share/aircrack-ng/airodump-ng-oui.txt",
+    "/var/lib/misc/oui.txt",
+    "/usr/share/misc/oui.txt",
+    "/var/lib/ieee-data/oui.txt",
+    "/usr/share/ieee-data/oui.txt",
+    "/etc/manuf/oui.txt",
+    "/usr/share/wireshark/wireshark/manuf/oui.txt",
+    "/usr/share/wireshark/manuf/oui.txt",
+    NULL
+};
+
 #define MIN_RAM_SIZE_LOAD_OUI_RAM 32768
 
 int read_pkts=0;
@@ -190,6 +200,14 @@
 	struct oui *next;
 };
 
+/* WPS_info struct */
+struct WPS_info {
+    unsigned char version;    /* WPS Version */
+    unsigned char state;      /* Current WPS state */
+    unsigned char ap_setup_locked; /* AP setup locked */
+    unsigned int meth;        /* WPS Config Methods */
+};
+
 /* linked list of detected access points */
 struct AP_info
 {
@@ -259,6 +277,7 @@
 					  
     int marked;
     int marked_color;
+    struct WPS_info wps;
 };
 
 /* linked list of detected clients */
@@ -285,6 +304,8 @@
     struct WPA_hdsk wpa;     /* WPA handshake data        */
     int qos_to_ds;           /* does it use 802.11e to ds */
     int qos_fr_ds;           /* does it receive 802.11e   */
+    int channel;             /* Channel station is seen   */
+                             /*  Not used yet		  */
 };
 
 /* linked list of detected macs through ack, cts or rts frames */
@@ -452,6 +473,9 @@
     u_int maxsize_essid_seen;
     int show_manufacturer;
     int show_uptime;
+    int file_write_interval;
+    u_int maxsize_wps_seen;
+    int show_wps;
 }
 G;

aircrack-ng-1.2-rc1.tar.gz/src/airolib-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airolib-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/airserv-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airserv-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/airtun-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/airtun-ng.c Changed

@@ -2,8 +2,8 @@
  *  802.11 WEP network connection tunneling
  *  based on aireplay-ng
  *
- *  Copyright (C) 2006-2013 Thomas d'Otreppe
- *  Copyright (C) 2006, 2007, 2008, 2009 Martin Beck
+ *  Copyright (C) 2006-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
+ *  Copyright (C) 2006-2009 Martin Beck <hirte@aircrack-ng.org>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -69,6 +69,7 @@
 
 #define CRYPT_NONE 0
 #define CRYPT_WEP  1
+#define CRYPT_WPA  2
 
 //if not all fragments are available 60 seconds after the last fragment was received, they will be removed
 #define FRAG_TIMEOUT (1000000*60)
@@ -83,7 +84,7 @@
 
 char usage[] =
 "\n"
-"  %s - (C) 2006-2013 Thomas d'Otreppe\n"
+"  %s - (C) 2006-2014 Thomas d'Otreppe\n"
 "  Original work: Martin Beck\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
@@ -95,6 +96,9 @@
 "      -i iface         : capture packets from this interface\n"
 "      -y file          : read PRGA from this file\n"
 "      -w wepkey        : use this WEP-KEY to encrypt packets\n"
+"      -p pass          : use this WPA passphrase to decrypt packets\n"
+"                       : (use with -a and -e)\n"
+"      -e essid         : target network SSID (use with -p)\n"
 "      -t tods          : send frames to AP (1) or to client (0)\n"
 "                       : or tunnel them into a WDS/Bridge (2)\n"
 "      -r file          : read frames out of pcap file\n"
@@ -132,6 +136,10 @@
     int tods;
     int bidir;
 
+    char essid[36];
+    char passphrase[65];
+    unsigned char pmk[40];
+
     unsigned char wepkey[64];
     int weplen, crypt;
 
@@ -192,6 +200,8 @@
 unsigned char srcbuf[4096];
 char strbuf[512];
 struct net_entry *nets = NULL;
+struct WPA_ST_info *st_1st = NULL;
+unsigned char ZERO[32];
 
 int ctrl_c, alarmed;
 
@@ -400,7 +410,7 @@
     while(cur->next != NULL)
     {
         old = cur->next;
-        timediff = (tv.tv_sec - old->access.tv_sec)*1000000 + (tv.tv_usec - old->access.tv_usec);
+        timediff = (tv.tv_sec - old->access.tv_sec)*1000000UL + (tv.tv_usec - old->access.tv_usec);
         if(timediff > FRAG_TIMEOUT)
         {
             //remove captured fragments
@@ -860,6 +870,7 @@
 {
     unsigned char K[64];
     unsigned char buf[4096];
+    struct WPA_ST_info *st_cur;
     int data_begin = 24;
     int dest_net;
 
@@ -929,6 +940,45 @@
 
         h80211[1] = h80211[1] | 0x40;
     }
+    else if( opt.crypt == CRYPT_WPA )
+    {
+        /* Add QoS */
+        /*   Doesn't seem to be needed -> commented out */
+        // memmove( h80211 + data_begin + 2, h80211 + data_begin, length - data_begin );
+        // memset( h80211 + data_begin, 0, 2 );
+        // data_begin += 2;
+        // length += 2;
+        // h80211[0] |= 0x80; // Set QoS
+
+        /* Find station */
+        st_cur = st_1st;
+        while( st_cur != NULL )
+        {
+            // STA -> AP
+            if( opt.tods == 1 && memcmp( st_cur->stmac, packet+6, 6 ) == 0 )
+                break;
+
+            // AP -> STA
+            if( opt.tods == 0 && memcmp( st_cur->stmac, packet, 6 ) == 0 )
+                break;
+
+            st_cur = st_cur->next;
+        }
+        if( st_cur == NULL )
+        {
+            printf( "Cannot inject: handshake not captured yet.\n" );
+            return 1;
+        }
+
+        // Todo: overflow to higher bits (pn is 6 bytes wide)
+        st_cur->pn[5] += 1;
+
+        h80211[1] = h80211[1] | 0x40; // Set Protected Frame flag
+
+        encrypt_ccmp( h80211, length, st_cur->ptk + 32, st_cur->pn );
+        length += 16;
+        data_begin += 8;
+    }
     else if( opt.prgalen > 0 )
     {
         if(create_wep_packet(h80211, &length, data_begin) != 0) return 1;
@@ -953,17 +1003,22 @@
     return 0;
 }
 
+
 int packet_recv(unsigned char* packet, int length)
 {
     unsigned char K[64];
-    unsigned char bssid[6], smac[6], dmac[6];
+    unsigned char bssid[6], smac[6], dmac[6], stmac[6];
     unsigned char *buffer;
+    unsigned long crc;
 
     int len;
     int z;
     int fragnum, seqnum, morefrag;
     int process_packet;
 
+    struct WPA_ST_info *st_cur;
+    struct WPA_ST_info *st_prv;
+
     z = ( ( packet[1] & 3 ) != 3 ) ? 24 : 30;
     if ( ( packet[0] & 0x80 ) == 0x80 ) /* QoS */
             z+=2;
@@ -984,16 +1039,19 @@
             memcpy( bssid, packet + 4, 6 );
             memcpy( dmac, packet + 16, 6 );
             memcpy( smac, packet + 10, 6 );
+            memcpy( stmac, packet + 10, 6 );
             break;
         case  2:
             memcpy( bssid, packet + 10, 6 );
             memcpy( dmac, packet + 4, 6 );
             memcpy( smac, packet + 16, 6 );
+            memcpy( stmac, packet + 4, 6 );
             break;
         default:
             memcpy( bssid, packet + 10, 6 );
             memcpy( dmac, packet + 16, 6 );
             memcpy( smac, packet + 24, 6 );
+            memcpy( stmac, packet + 4, 6 );
             break;
     }
 
@@ -1032,12 +1090,77 @@
 
     if( process_packet )
     {
-        if( (packet[z] != packet[z + 1] || packet[z + 2] != 0x03) && opt.crypt == CRYPT_WEP )
+        /* find station */
+
+        st_prv = NULL;
+        st_cur = st_1st;
+
+        while( st_cur != NULL )
+        {
+            if( ! memcmp( st_cur->stmac, stmac, 6 ) )
+                break;
+
+            st_prv = st_cur;
+            st_cur = st_cur->next;
+        }
+
+        /* if it's a new station, add it */
+
+        if( st_cur == NULL )
+        {
+            if( ! ( st_cur = (struct WPA_ST_info *) malloc(
+                             sizeof( struct WPA_ST_info ) ) ) )
+            {
+                perror( "malloc failed" );
+                return 1;
+            }
+
+            memset( st_cur, 0, sizeof( struct WPA_ST_info ) );
+
+            if( st_1st == NULL )
+                st_1st = st_cur;
+            else
+                st_prv->next = st_cur;
+
+            memcpy( st_cur->stmac, stmac, 6 );
+            memcpy( st_cur->bssid, bssid, 6 );
+        }
+
+        /* check if we haven't already processed this packet */
+
+        crc = calc_crc_buf( packet + z, length - z );
+
+        if( ( packet[1] & 3 ) == 2 )
+        {
+            if( st_cur->t_crc == crc )
+            {
+                return 1;
+            }
+
+            st_cur->t_crc = crc;
+        }
+        else
+        {
+            if( st_cur->f_crc == crc )
+            {
+                return 1;
+            }
+
+            st_cur->f_crc = crc;
+        }
+
+        /* check the SNAP header to see if data is encrypted *
+         * as unencrypted data begins with AA AA 03 00 00 00 */
+
+        if( packet[z] != packet[z + 1] || packet[z + 2] != 0x03 )
         {
             /* check the extended IV flag */
 
             if( ( packet[z + 3] & 0x20 ) == 0 )
             {
+                if( opt.crypt != CRYPT_WEP )
+                    return 1;
+
                 memcpy( K, packet + z, 3 );
                 memcpy( K + 3, opt.wepkey, opt.weplen );
 
@@ -1053,11 +1176,178 @@
 
                 length -= 8;
 
-                memcpy( packet + z, packet + z + 4, length - z );
+                /* can overlap */
+                memmove( packet + z, packet + z + 4, length - z );
+
+                packet[1] &= 0xBF;
+            }
+            else
+            {
+                if( opt.crypt != CRYPT_WPA )
+                    return 1;
+
+                /* if the PTK is valid, try to decrypt */
+
+                if( st_cur == NULL || ! st_cur->valid_ptk )
+                    return 1;
+
+                if( st_cur->keyver == 1 )
+                {
+                    if( decrypt_tkip( packet, length,
+                                      st_cur->ptk + 32 ) == 0 )
+                    {
+                        printf("ICV check failed (WPA-TKIP)!\n");
+                        return 1;
+                    }
+
+                    length -= 20;
+                }
+                else
+                {
+                    buffer = malloc( length );
+                    memcpy( buffer, packet, length );
+                    if ( memcmp( smac, st_cur->stmac, 6 ) == 0 ) {
+                        st_cur->pn[0] = packet[z + 7];
+                        st_cur->pn[1] = packet[z + 6];
+                        st_cur->pn[2] = packet[z + 5];
+                        st_cur->pn[3] = packet[z + 4];
+                        st_cur->pn[4] = packet[z + 1];
+                        st_cur->pn[5] = packet[z + 0];
+                    }
+
+                    if( decrypt_ccmp( packet, length,
+                                      st_cur->ptk + 32 ) == 0 )
+                    {
+                        printf("ICV check failed (WPA-CCMP)!\n");
+                        return 1;
+                    }
+
+                    length -= 16;
+                }
+
+                /* WPA data packet was successfully decrypted, *
+                 * remove the WPA Ext.IV & MIC, write the data */
+
+                /* can overlap */
+                memmove( packet + z, packet + z + 8, length - z );
 
                 packet[1] &= 0xBF;
             }
         }
+        else if ( opt.crypt == CRYPT_WPA )
+        {
+            /* check ethertype == EAPOL */
+
+            z += 6;
+
+            if( packet[z] != 0x88 || packet[z + 1] != 0x8E )
+            {
+                return 1;
+            }
+
+            z += 2;
+
+            /* type == 3 (key), desc. == 254 (WPA) or 2 (RSN) */
+
+            if( packet[z + 1] != 0x03 ||
+                ( packet[z + 4] != 0xFE && packet[z + 4] != 0x02 ) )
+                return 1;
+
+            /* frame 1: Pairwise == 1, Install == 0, Ack == 1, MIC == 0 */
+
+            if( ( packet[z + 6] & 0x08 ) != 0 &&
+                ( packet[z + 6] & 0x40 ) == 0 &&
+                ( packet[z + 6] & 0x80 ) != 0 &&
+                ( packet[z + 5] & 0x01 ) == 0 )
+            {
+                /* set authenticator nonce */
+
+                memcpy( st_cur->anonce, &packet[z + 17], 32 );
+            }
+
+            /* frame 2 or 4: Pairwise == 1, Install == 0, Ack == 0, MIC == 1 */
+
+            if( ( packet[z + 6] & 0x08 ) != 0 &&
+                ( packet[z + 6] & 0x40 ) == 0 &&
+                ( packet[z + 6] & 0x80 ) == 0 &&
+                ( packet[z + 5] & 0x01 ) != 0 )
+            {
+                if( memcmp( &packet[z + 17], ZERO, 32 ) != 0 )
+                {
+                    /* set supplicant nonce */
+
+                    memcpy( st_cur->snonce, &packet[z + 17], 32 );
+                }
+
+                /* copy the MIC & eapol frame */
+
+                st_cur->eapol_size = ( packet[z + 2] << 8 )
+                                   +   packet[z + 3] + 4;
+
+                if (length - z < (int)st_cur->eapol_size  || st_cur->eapol_size == 0 ||
+                    st_cur->eapol_size > sizeof(st_cur->eapol))
+                {
+                        // Ignore the packet trying to crash us.
+                        st_cur->eapol_size = 0;
+                        return 1;
+                }
+
+                memcpy( st_cur->keymic, &packet[z + 81], 16 );
+                memcpy( st_cur->eapol, &packet[z], st_cur->eapol_size );
+                memset( st_cur->eapol + 81, 0, 16 );
+
+                /* copy the key descriptor version */
+
+                st_cur->keyver = packet[z + 6] & 7;
+            }
+
+            /* frame 3: Pairwise == 1, Install == 1, Ack == 1, MIC == 1 */
+
+            if( ( packet[z + 6] & 0x08 ) != 0 &&
+                ( packet[z + 6] & 0x40 ) != 0 &&
+                ( packet[z + 6] & 0x80 ) != 0 &&
+                ( packet[z + 5] & 0x01 ) != 0 )
+            {
+                if( memcmp( &packet[z + 17], ZERO, 32 ) != 0 )
+                {
+                    /* set authenticator nonce */
+
+                    memcpy( st_cur->anonce, &packet[z + 17], 32 );
+                }
+
+                /* copy the MIC & eapol frame */
+
+                st_cur->eapol_size = ( packet[z + 2] << 8 )
+                                   +   packet[z + 3] + 4;
+
+                if (length - z < (int)st_cur->eapol_size  || st_cur->eapol_size == 0 ||
+                    st_cur->eapol_size > sizeof(st_cur->eapol))
+                {
+                    // Ignore the packet trying to crash us.
+                    st_cur->eapol_size = 0;
+                    return 1; //continue;
+                 }
+
+                memcpy( st_cur->keymic, &packet[z + 81], 16 );
+                memcpy( st_cur->eapol, &packet[z], st_cur->eapol_size );
+                memset( st_cur->eapol + 81, 0, 16 );
+
+                /* copy the key descriptor version */
+
+                st_cur->keyver = packet[z + 6] & 7;
+            }
+
+            st_cur->valid_ptk = calc_ptk( st_cur, opt.pmk );
+
+            if ( st_cur->valid_ptk )
+            {
+                printf("WPA handshake: %02X:%02X:%02X:%02X:%02X:%02X\n",
+                       st_cur->stmac[0], st_cur->stmac[1],
+                       st_cur->stmac[2], st_cur->stmac[3],
+                       st_cur->stmac[4], st_cur->stmac[5]
+                );
+            }
+        }
 
         switch( packet[1] & 3 )
         {
@@ -1138,6 +1428,7 @@
 
     /* check the arguments */
 
+    memset( ZERO, 0, sizeof( ZERO ) );
     memset( &opt, 0, sizeof( opt ) );
     memset( &dev, 0, sizeof( dev ) );
 
@@ -1162,7 +1453,7 @@
         };
 
         int option = getopt_long( argc, argv,
-                        "x:a:h:i:r:y:t:s:bw:m:d:fH",
+                        "x:a:h:i:r:y:t:s:bw:p:e:m:d:fH",
                         long_options, &option_index );
 
         if( option < 0 ) break;
@@ -1327,7 +1618,47 @@
                 opt.weplen = i;
 
                 break;
+
+            case 'e' :
+
+                if ( opt.essid[0])
+                {
+                    printf( "ESSID already specified.\n" );
+                    printf("\"%s --help\" for help.\n", argv[0]);
+                    return( 1 );
+                }
+
+                opt.crypt = CRYPT_WPA;
+
+                memset(  opt.essid, 0, sizeof( opt.essid ) );
+                strncpy( opt.essid, optarg, sizeof( opt.essid ) - 1 );
+                break;
+
+
+            case 'p' :
+
+                if( opt.prga != NULL )
+                {
+                    printf( "PRGA file already specified.\n" );
+                    printf("\"%s --help\" for help.\n", argv[0]);
+                    return( 1 );
+                }
+                if( opt.crypt != CRYPT_NONE )
+                {
+                    printf( "Encryption key already specified.\n" );
+                    printf("\"%s --help\" for help.\n", argv[0]);
+                    return( 1 );
+                }
+
+                opt.crypt = CRYPT_WPA;
+
+                memset(  opt.passphrase, 0, sizeof( opt.passphrase ) );
+                strncpy( opt.passphrase, optarg, sizeof( opt.passphrase ) - 1 );
+
+                break;
+
             case 'm':
+
                 if ( memcmp(opt.f_netmask, NULL_MAC, 6) != 0 )
                 {
                     printf("Notice: netmask already given\n");
@@ -1417,6 +1748,23 @@
         return 1;
     }
 
+    if( opt.crypt == CRYPT_WPA )
+    {
+        if( opt.passphrase[0] != '\0' )
+        {
+            /* compute the Pairwise Master Key */
+
+            if( opt.essid[0] == '\0' )
+            {
+                printf( "You must also specify the ESSID (-e).\n" );
+                printf("\"%s --help\" for help.\n", argv[0]);
+                return( 1 );
+            }
+
+            calc_pmk( opt.passphrase, opt.essid, opt.pmk );
+        }
+    }
+
     dev.fd_rtc = -1;
 
     /* open the RTC device if necessary */
@@ -1552,7 +1900,11 @@
     {
         printf( "No encryption specified. Sending and receiving frames through %s.\n", argv[optind]);
     }
-    else if(opt.crypt != CRYPT_NONE)
+    else if(opt.crypt == CRYPT_WPA)
+    {
+        printf( "WPA encryption specified. Sending and receiving frames through %s.\n", argv[optind] );
+    }
+    else if(opt.crypt == CRYPT_WEP)
     {
         printf( "WEP encryption specified. Sending and receiving frames through %s.\n", argv[optind] );
     }
@@ -1686,7 +2038,6 @@
                 send_packet(h80211, caplen);
             }
 
-
             packet_recv( h80211, caplen);
             msleep( 1000/opt.r_nbpps );
             continue;

aircrack-ng-1.2-rc1.tar.gz/src/buddy-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/buddy-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/common.c -> aircrack-ng-1.2-rc2.tar.gz/src/common.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/crypto.c -> aircrack-ng-1.2-rc2.tar.gz/src/crypto.c Changed

@@ -1188,6 +1188,155 @@
         dst[i] ^= src[i];
 }
 
+// Important documents for the implementation of encrypt_ccmp() and
+// decrypt_ccmp():
+//
+//  * RFC 3610 Counter with CBC-MAC (CCM)
+//    https://www.ietf.org/rfc/rfc3610.txt
+//
+//  * IEEE 802.11(TM)-2012
+//    http://standards.ieee.org/about/get/802/802.11.html
+//
+// Note: RFC uses the abbriviation MAC (Message Authentication Code, or
+//       value U in the RFC). It is the same as IEEE's MIC (Message
+//       Integrity Code)
+
+// encrypt_ccmp() takes an h80211 frame and encrypts it in-place using CCMP.
+// This results in a frame that is 16 bytes longer than the original, take this
+// into account when allocating h80211! encrypt() returns the new length (and
+// thus the offset where the caller needs to write the FCS).
+// caplen is the combined length of the 802.11 header and data, not the FCS!
+int encrypt_ccmp( unsigned char *h80211, int caplen, unsigned char TK1[16], unsigned char PN[6] )
+{
+    int is_a4, i, n, z, blocks, is_qos;
+    int data_len, last, offset;
+    unsigned char B0[16], B[16], MIC[16];
+    unsigned char AAD[32];
+    AES_KEY aes_ctx;
+
+    is_a4 = ( h80211[1] & 3 ) == 3;
+    is_qos = ( h80211[0] & 0x8C ) == 0x88;
+    z = 24 + 6 * is_a4;
+    z += 2 * is_qos;
+
+    // Insert CCMP header
+    memmove( h80211+z+8, h80211+z, caplen-z );
+    h80211[z + 0] = PN[5];
+    h80211[z + 1] = PN[4];
+    h80211[z + 2] = 0x00;           // Reserved -> 0
+    h80211[z + 3] = 0x20;           // ExtIV=1, KeyID=0
+    h80211[z + 4] = PN[3];
+    h80211[z + 5] = PN[2];
+    h80211[z + 6] = PN[1];
+    h80211[z + 7] = PN[0];
+
+    data_len = caplen - z;
+
+    // B_0 := B0
+    B0[0] = 0x59;                      // Flags
+    B0[1] = 0;                         // Nonce := CCM Nonce: - Nonce flags
+    memcpy( B0 + 2, h80211 + 10, 6 );  //                     - A2
+    memcpy( B0 + 8, PN, 6 );           //                     - PN
+    B0[14] = ( data_len >> 8 ) & 0xFF; // l(m)
+    B0[15] = ( data_len & 0xFF );      // l(m)
+
+    // B_1 := AAD[ 0..15]
+    // B_2 := AAD[16..31]
+    //        AAD[ 0.. 1] = l(a)
+    //        AAD[ 2..31] = a
+    memset( AAD, 0, sizeof( AAD ) );
+    AAD[2] = h80211[0] & 0x8F;              // AAD[2..3]  = FC
+    AAD[3] = h80211[1] & 0xC7;              //
+    memcpy( AAD + 4, h80211 + 4, 3 * 6 );   // AAD[4..21] = [A1,A2,A3]
+    AAD[22] = h80211[22] & 0x0F;            // AAD[22]    = SC
+
+    if( is_a4 )
+    {
+        memcpy( AAD + 24, h80211 + 24, 6 ); // AAD[24..29] = A4
+
+        if( is_qos )
+        {
+            AAD[30] = h80211[z - 2] & 0x0F; // AAD[30..31] = QC
+            AAD[31] = 0;                    //
+            B0[1] = AAD[30];                //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 2 + 6;            // AAD[ 0.. 1] = l(a)
+        }
+        else
+        {
+            memset(&AAD[30], 0, 2);         // AAD[30..31] = QC
+            B0[1] = 0;                      //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 6;                // AAD[ 0.. 1] = l(a)
+        }
+    }
+    else
+    {
+        if( is_qos )
+        {
+            AAD[24] = h80211[z - 2] & 0x0F; // AAD[24..25] = QC
+            AAD[25] = 0;                    //
+            B0[1] = AAD[24];                //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 2;                // AAD[ 0.. 1] = l(a)
+        }
+        else
+        {
+            memset(&AAD[24], 0, 2);         // AAD[24..25] = QC
+            B0[1] = 0;                      //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22;                    // AAD[ 0.. 1] = l(a)
+        }
+    }
+
+    AES_set_encrypt_key( TK1, 128, &aes_ctx );
+    AES_encrypt( B0, MIC, &aes_ctx );       // X_1 := E( K, B_0 )
+    XOR( MIC, AAD, 16 );                    // X_2 := E( K, X_1 XOR B_1 )
+    AES_encrypt( MIC, MIC, &aes_ctx );      //
+    XOR( MIC, AAD + 16, 16 );               // X_3 := E( K, X_2 XOR B_2 )
+    AES_encrypt( MIC, MIC, &aes_ctx );      //
+
+    // A_i := B0
+    //        B0[     0] = Flags
+    //        B0[ 1..13] = Nonce := CCM Nonce
+    //        B0[14..15] = i
+    B0[0] &= 0x07;
+    B0[14] = B0[15] = 0;
+    AES_encrypt( B0, B, &aes_ctx );         // S_0 := E( K, A_i )
+    memcpy( h80211+z+8+data_len, B, 8 );
+    //      ^^^^^^^^^^^^^^^^^^^  ^
+    //      S_0[0..7]/future U   S_0
+
+    blocks = ( data_len + 16 - 1 ) / 16;
+    last = data_len % 16;
+    offset = z + 8;
+
+    for( i = 1; i <= blocks; i++ )
+    {
+        n = ( last > 0 && i == blocks ) ? last : 16;
+
+        XOR( MIC, h80211 + offset, n );     // X_i+3 := E( K, X_i+2 XOR B_i+2 )
+        AES_encrypt( MIC, MIC, &aes_ctx );  //
+        //    (X_i+2 ^^^)(^^^ X_i+3)
+
+        // The message is encrypted by XORing the octets of message m with the
+        // first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
+        B0[14] = ( i >> 8 ) & 0xFF;         // A_i[14..15] = i
+        B0[15] =   i & 0xFF;                //
+        AES_encrypt( B0, B, &aes_ctx );     // S_i := E( K, A_i )
+        XOR( h80211 + offset, B, n );
+        // [B_3, ..., B_n] := m
+
+        offset += n;
+    }
+
+    // We need to free the ctx when using gcrypt to avoid memory leaks
+    #ifdef USE_GCRYPT
+        gcry_cipher_close(aes_ctx);
+    #endif
+
+    // T :=     X_i+3[ 0.. 7]
+    // U := T XOR S_0[ 0.. 7]
+    XOR( h80211+offset, MIC, 8 );
+    return z+8+data_len+8;
+}
+
 int decrypt_ccmp( unsigned char *h80211, int caplen, unsigned char TK1[16] )
 {
     int is_a4, i, n, z, blocks, is_qos;
@@ -1210,66 +1359,76 @@
 
     data_len = caplen - z - 8 - 8;
 
-    B0[0] = 0x59;
-    B0[1] = 0;
-    memcpy( B0 + 2, h80211 + 10, 6 );
-    memcpy( B0 + 8, PN, 6 );
-    B0[14] = ( data_len >> 8 ) & 0xFF;
-    B0[15] = ( data_len & 0xFF );
-
+    // B_0 := B0
+    B0[0] = 0x59;                      // Flags
+    B0[1] = 0;                         // Nonce := CCM Nonce: - Nonce flags
+    memcpy( B0 + 2, h80211 + 10, 6 );  //                     - A2
+    memcpy( B0 + 8, PN, 6 );           //                     - PN
+    B0[14] = ( data_len >> 8 ) & 0xFF; // l(m)
+    B0[15] = ( data_len & 0xFF );      // l(m)
+
+    // B_1 := AAD[ 0..15]
+    // B_2 := AAD[16..31]
+    //        AAD[ 0.. 1] = l(a)
+    //        AAD[ 2..31] = a
     memset( AAD, 0, sizeof( AAD ) );
-    
-    AAD[2] = h80211[0] & 0x8F;
-    AAD[3] = h80211[1] & 0xC7;
-    memcpy( AAD + 4, h80211 + 4, 3 * 6 );
-    AAD[22] = h80211[22] & 0x0F;
+    AAD[2] = h80211[0] & 0x8F;              // AAD[2..3]  = FC
+    AAD[3] = h80211[1] & 0xC7;              //
+    memcpy( AAD + 4, h80211 + 4, 3 * 6 );   // AAD[4..21] = [A1,A2,A3]
+    AAD[22] = h80211[22] & 0x0F;            // AAD[22]    = SC
     
     if( is_a4 ) 
     {
-        memcpy( AAD + 24, h80211 + 24, 6 );
+        memcpy( AAD + 24, h80211 + 24, 6 ); // AAD[24..29] = A4
         
         if( is_qos ) 
         {
-            AAD[30] = h80211[z - 2] & 0x0F;
-            AAD[31] = 0;
-            B0[1] = AAD[30];
-            AAD[1] = 22 + 2 + 6;
+            AAD[30] = h80211[z - 2] & 0x0F; // AAD[30..31] = QC
+            AAD[31] = 0;                    //
+            B0[1] = AAD[30];                //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 2 + 6;            // AAD[ 0.. 1] = l(a)
         } 
         else 
         {
-            memset(&AAD[30], 0, 2);
-            B0[1] = 0;
-            AAD[1] = 22 + 6;
+            memset(&AAD[30], 0, 2);         // AAD[30..31] = QC
+            B0[1] = 0;                      //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 6;                // AAD[ 0.. 1] = l(a)
         }
     } 
     else 
     {
         if( is_qos ) 
         {
-            AAD[24] = h80211[z - 2] & 0x0F;
-            AAD[25] = 0;
-            B0[1] = AAD[24];
-            AAD[1] = 22 + 2;
+            AAD[24] = h80211[z - 2] & 0x0F; // AAD[24..25] = QC
+            AAD[25] = 0;                    //
+            B0[1] = AAD[24];                //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22 + 2;                // AAD[ 0.. 1] = l(a)
         }
         else
         {
-            memset(&AAD[24], 0, 2);
-            B0[1] = 0;
-            AAD[1] = 22;
+            memset(&AAD[24], 0, 2);         // AAD[24..25] = QC
+            B0[1] = 0;                      //  B0[     1] = CCM Nonce flags
+            AAD[1] = 22;                    // AAD[ 0.. 1] = l(a)
         }
     }
 
     AES_set_encrypt_key( TK1, 128, &aes_ctx );
-    AES_encrypt( B0, MIC, &aes_ctx );
-    XOR( MIC, AAD, 16 );
-    AES_encrypt( MIC, MIC, &aes_ctx );
-    XOR( MIC, AAD + 16, 16 );
-    AES_encrypt( MIC, MIC, &aes_ctx );
-
+    AES_encrypt( B0, MIC, &aes_ctx );       // X_1 := E( K, B_0 )
+    XOR( MIC, AAD, 16 );                    // X_2 := E( K, X_1 XOR B_1 )
+    AES_encrypt( MIC, MIC, &aes_ctx );      //
+    XOR( MIC, AAD + 16, 16 );               // X_3 := E( K, X_2 XOR B_2 )
+    AES_encrypt( MIC, MIC, &aes_ctx );      //
+
+    // A_i := B0
+    //        B0[     0] = Flags
+    //        B0[ 1..13] = Nonce := CCM Nonce
+    //        B0[14..15] = i
     B0[0] &= 0x07;
     B0[14] = B0[15] = 0;
-    AES_encrypt( B0, B, &aes_ctx );
-    XOR( h80211 + caplen - 8, B, 8 );
+    AES_encrypt( B0, B, &aes_ctx );         // S_0 := E( K, A_i )
+    XOR( h80211 + caplen - 8, B, 8 );       // T   := U XOR S_0[0..7]
+    //   ^^^^^^^^^^^^^^^      ^
+    //     U:=MIC -> T       S_0
 
     blocks = ( data_len + 16 - 1 ) / 16;
     last = data_len % 16;
@@ -1279,13 +1438,17 @@
     {
         n = ( last > 0 && i == blocks ) ? last : 16;
 
-        B0[14] = ( i >> 8 ) & 0xFF;
-        B0[15] =   i & 0xFF;
+        B0[14] = ( i >> 8 ) & 0xFF;         // A_i[14..15] = i
+        B0[15] =   i & 0xFF;                //
 
-        AES_encrypt( B0, B, &aes_ctx );
+        AES_encrypt( B0, B, &aes_ctx );     // S_i := E( K, A_i )
+        // The message is encrypted by XORing the octets of message m with the
+        // first l(m) octets of the concatenation of S_1, S_2, S_3, ... .
         XOR( h80211 + offset, B, n );
-        XOR( MIC, h80211 + offset, n );
-        AES_encrypt( MIC, MIC, &aes_ctx );
+        // [B_3, ..., B_n] := m
+        XOR( MIC, h80211 + offset, n );     // X_i+3 := E( K, X_i+2 XOR B_i+2 )
+        AES_encrypt( MIC, MIC, &aes_ctx );  //
+        //    (X_i+2 ^^^)(^^^ X_i+3)
 
         offset += n;
     }
@@ -1295,6 +1458,9 @@
         gcry_cipher_close(aes_ctx);
     #endif
 
+    // T := X_n[ 0.. 7]
+    // Note: Decryption is succesful if calculated T is the same as the one
+    //       that was sent with the message.
     return( memcmp( h80211 + offset, MIC, 8 ) == 0 );
 }

aircrack-ng-1.2-rc1.tar.gz/src/crypto.h -> aircrack-ng-1.2-rc2.tar.gz/src/crypto.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/easside-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/easside-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/include/ethernet.h -> aircrack-ng-1.2-rc2.tar.gz/src/include/ethernet.h Changed

@@ -1,7 +1,7 @@
 /*
  * Fundamental constants relating to ethernet.
  *
- * $FreeBSD: src/sys/net/ethernet.h,v 1.30 2007/03/07 12:51:52 bms Exp $
+ * $FreeBSD$
  *
  */
 
@@ -9,7 +9,7 @@
 #define _NET_ETHERNET_H_
 
 /*
- * Somce basic Ethernet constants.
+ * Some basic Ethernet constants.
  */
 #define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
 #define	ETHER_TYPE_LEN		2	/* length of the Ethernet type field */
@@ -70,11 +70,6 @@
 	u_char octet[ETHER_ADDR_LEN];
 } __packed;
 
-#ifdef CTASSERT
-CTASSERT(sizeof (struct ether_header) == ETHER_ADDR_LEN * 2 + 2);
-CTASSERT(sizeof (struct ether_addr) == ETHER_ADDR_LEN);
-#endif
-
 #define	ETHER_IS_MULTICAST(addr) (*(addr) & 0x01) /* is address mcast/bcast? */
 
 /*
@@ -129,14 +124,14 @@
 #define	ETHERTYPE_NBPVCD	0x3C00	/* 3Com NBP virtual circuit datagram (like XNS SPP) not registered */
 #define	ETHERTYPE_NBPSCD	0x3C01	/* 3Com NBP System control datagram not registered */
 #define	ETHERTYPE_NBPCREQ	0x3C02	/* 3Com NBP Connect request (virtual cct) not registered */
-#define	ETHERTYPE_NBPCRSP	0x3C03	/* 3Com NBP Connect repsonse not registered */
+#define	ETHERTYPE_NBPCRSP	0x3C03	/* 3Com NBP Connect response not registered */
 #define	ETHERTYPE_NBPCC		0x3C04	/* 3Com NBP Connect complete not registered */
 #define	ETHERTYPE_NBPCLREQ	0x3C05	/* 3Com NBP Close request (virtual cct) not registered */
 #define	ETHERTYPE_NBPCLRSP	0x3C06	/* 3Com NBP Close response not registered */
 #define	ETHERTYPE_NBPDG		0x3C07	/* 3Com NBP Datagram (like XNS IDP) not registered */
 #define	ETHERTYPE_NBPDGB	0x3C08	/* 3Com NBP Datagram broadcast not registered */
 #define	ETHERTYPE_NBPCLAIM	0x3C09	/* 3Com NBP Claim NetBIOS name not registered */
-#define	ETHERTYPE_NBPDLTE	0x3C0A	/* 3Com NBP Delete Netbios name not registered */
+#define	ETHERTYPE_NBPDLTE	0x3C0A	/* 3Com NBP Delete NetBIOS name not registered */
 #define	ETHERTYPE_NBPRAS	0x3C0B	/* 3Com NBP Remote adaptor status request not registered */
 #define	ETHERTYPE_NBPRAR	0x3C0C	/* 3Com NBP Remote adaptor response not registered */
 #define	ETHERTYPE_NBPRST	0x3C0D	/* 3Com NBP Reset not registered */
@@ -317,7 +312,7 @@
 #define	ETHERTYPE_SECUREDATA	0x876D	/* Secure Data (RFC1701) */
 #define	ETHERTYPE_FLOWCONTROL	0x8808	/* 802.3x flow control packet */
 #define	ETHERTYPE_SLOW		0x8809	/* 802.3ad link aggregation (LACP) */
-#define	ETHERTYPE_PPP		0x880B	/* PPP (obsolete by PPPOE) */
+#define	ETHERTYPE_PPP		0x880B	/* PPP (obsolete by PPPoE) */
 #define	ETHERTYPE_HITACHI	0x8820	/* Hitachi Cable (Optoelectronic Systems Laboratory) */
 #define	ETHERTYPE_MPLS		0x8847	/* MPLS Unicast */
 #define	ETHERTYPE_MPLS_MCAST	0x8848	/* MPLS Multicast */
@@ -370,7 +365,7 @@
 
 struct ifnet;
 struct mbuf;
-struct rtentry;
+struct route;
 struct sockaddr;
 struct bpf_if;
 
@@ -379,13 +374,14 @@
 extern	void ether_demux(struct ifnet *, struct mbuf *);
 extern	void ether_ifattach(struct ifnet *, const u_int8_t *);
 extern	void ether_ifdetach(struct ifnet *);
-extern	int  ether_ioctl(struct ifnet *, int, caddr_t);
-extern	int  ether_output(struct ifnet *,
-		   struct mbuf *, struct sockaddr *, struct rtentry *);
+extern	int  ether_ioctl(struct ifnet *, u_long, caddr_t);
+extern	int  ether_output(struct ifnet *, struct mbuf *,
+	    const struct sockaddr *, struct route *);
 extern	int  ether_output_frame(struct ifnet *, struct mbuf *);
 extern	char *ether_sprintf(const u_int8_t *);
 void	ether_vlan_mtap(struct bpf_if *, struct mbuf *,
 	    void *, u_int);
+struct mbuf  *ether_vlanencap(struct mbuf *, uint16_t);
 
 #else /* _KERNEL */
 
@@ -396,9 +392,11 @@
  */
 __BEGIN_DECLS
 struct	ether_addr *ether_aton(const char *);
+struct	ether_addr *ether_aton_r(const char *, struct ether_addr *);
 int	ether_hostton(const char *, struct ether_addr *);
 int	ether_line(const char *, struct ether_addr *, char *);
 char 	*ether_ntoa(const struct ether_addr *);
+char 	*ether_ntoa_r(const struct ether_addr *, char *);
 int	ether_ntohost(char *, const struct ether_addr *);
 __END_DECLS

aircrack-ng-1.2-rc1.tar.gz/src/include/ieee80211.h -> aircrack-ng-1.2-rc2.tar.gz/src/include/ieee80211.h Changed

@@ -1,3 +1,4 @@
+/*	$NetBSD: ieee80211.h,v 1.26 2013/03/30 14:14:31 christos Exp $	*/
 /*-
  * Copyright (c) 2001 Atsushi Onoe
  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
@@ -29,7 +30,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD: src/sys/net80211/ieee80211.h,v 1.12 2006/12/01 18:40:51 imp Exp $
+ * $FreeBSD: src/sys/net80211/ieee80211.h,v 1.10 2005/07/22 16:55:27 sam Exp $
  */
 #ifndef _NET80211_IEEE80211_H_
 #define _NET80211_IEEE80211_H_
@@ -51,7 +52,7 @@
 	u_int16_t	i_crc;
 } __packed;
 
-#define IEEE80211_PLCP_SFD      0xF3A0 
+#define IEEE80211_PLCP_SFD      0xF3A0
 #define IEEE80211_PLCP_SERVICE  0x00
 
 /*
@@ -148,6 +149,21 @@
 #define	IEEE80211_FC0_SUBTYPE_QOS		0x80
 #define	IEEE80211_FC0_SUBTYPE_QOS_NULL		0xc0
 
+/*
+ * DS bit usage
+ *
+ * TA = transmitter address
+ * RA = receiver address
+ * DA = destination address
+ * SA = source address
+ *
+ * ToDS    FromDS  A1(RA)  A2(TA)  A3      A4      Use
+ * -----------------------------------------------------------------
+ *  0       0       DA      SA      BSSID   -       IBSS/DLS
+ *  0       1       DA      BSSID   SA      -       AP -> STA
+ *  1       0       BSSID   SA      DA      -       AP <- STA
+ *  1       1       RA      TA      DA      SA      unspecified (WDS)
+ */
 #define	IEEE80211_FC1_DIR_MASK			0x03
 #define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
 #define	IEEE80211_FC1_DIR_TODS			0x01	/* STA->AP  */
@@ -158,7 +174,8 @@
 #define	IEEE80211_FC1_RETRY			0x08
 #define	IEEE80211_FC1_PWR_MGT			0x10
 #define	IEEE80211_FC1_MORE_DATA			0x20
-#define	IEEE80211_FC1_WEP			0x40
+#define	IEEE80211_FC1_PROTECTED			0x40
+#define	IEEE80211_FC1_WEP			0x40	/* pre-RSNA compat */
 #define	IEEE80211_FC1_ORDER			0x80
 
 #define	IEEE80211_SEQ_FRAG_MASK			0x000f
@@ -168,19 +185,22 @@
 
 #define	IEEE80211_NWID_LEN			32
 
-#define	IEEE80211_QOS_TXOP			0x00ff
+/*
+ * QoS Control field (see 7.1.3.5).
+ */
 /* bit 8 is reserved */
-#define	IEEE80211_QOS_ACKPOLICY			0x60
+#define	IEEE80211_QOS_TXOP			0xff00
+#define	IEEE80211_QOS_AMSDU			0x0080  /* 11n */
+#define	IEEE80211_QOS_ACKPOLICY_NORMAL          0x0000
+#define	IEEE80211_QOS_ACKPOLICY_NOACK           0x0020
+#define	IEEE80211_QOS_ACKPOLICY_NOEXPLACK       0x0040
+#define	IEEE80211_QOS_ACKPOLICY			0x0060
 #define	IEEE80211_QOS_ACKPOLICY_S		5
-#define	IEEE80211_QOS_ESOP			0x10
+#define	IEEE80211_QOS_ACKPOLICY_MASK		0x0060
+#define	IEEE80211_QOS_ACKPOLICY_BA		0x0060
+#define	IEEE80211_QOS_ESOP			0x0010
 #define	IEEE80211_QOS_ESOP_S			4
-#define	IEEE80211_QOS_TID			0x0f
-
-/* does frame have QoS sequence control data */
-#define	IEEE80211_QOS_HAS_SEQ(wh) \
-	(((wh)->i_fc[0] & \
-	  (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) == \
-	  (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
+#define	IEEE80211_QOS_TID			0x000f
 
 /*
  * WME/802.11e information element.
@@ -232,7 +252,14 @@
 	u_int16_t	acp_txop;
 } __packed;
 
-#define WME_NUM_AC		4	/* 4 AC categories */
+/* WME stream classes */
+enum ieee80211_wme_ac {
+	WME_AC_BE	= 0,		/* best effort */
+	WME_AC_BK	= 1,		/* background */
+	WME_AC_VI	= 2,		/* video */
+	WME_AC_VO	= 3,		/* voice */
+};
+#define WME_NUM_AC	4		/* 4 AC categories */
 
 #define WME_PARAM_ACI		0x60	/* Mask for ACI field */
 #define WME_PARAM_ACI_S		5	/* Shift for ACI field */
@@ -335,6 +362,50 @@
 	/* FCS */
 } __packed;
 
+static __inline int
+ieee80211_has_seq(const struct ieee80211_frame *wh)
+{
+	return (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
+	    IEEE80211_FC0_TYPE_CTL;
+}
+
+static __inline int
+ieee80211_has_addr4(const struct ieee80211_frame *wh)
+{
+	return (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) ==
+	    IEEE80211_FC1_DIR_DSTODS;
+}
+
+static __inline int
+ieee80211_has_qos(const struct ieee80211_frame *wh)
+{
+	return (wh->i_fc[0] &
+	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
+	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS);
+}
+
+static __inline int
+ieee80211_has_htc(const struct ieee80211_frame *wh)
+{
+	return (wh->i_fc[1] & IEEE80211_FC1_ORDER) &&
+	    (ieee80211_has_qos(wh) ||
+	     (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
+	     IEEE80211_FC0_TYPE_MGT);
+}
+
+static __inline u_int16_t
+ieee80211_get_qos(const struct ieee80211_frame *wh)
+{
+	const u_int8_t *frm;
+
+	if (ieee80211_has_addr4(wh))
+		frm = ((const struct ieee80211_qosframe_addr4 *)wh)->i_qos;
+	else
+		frm = ((const struct ieee80211_qosframe *)wh)->i_qos;
+
+	return le16toh(*(const u_int16_t *)frm);
+}
+
 /*
  * BEACON management packets
  *
@@ -401,14 +472,30 @@
 	IEEE80211_ELEMID_TIM		= 5,
 	IEEE80211_ELEMID_IBSSPARMS	= 6,
 	IEEE80211_ELEMID_COUNTRY	= 7,
+	IEEE80211_ELEMID_EDCAPARMS	= 12,
 	IEEE80211_ELEMID_CHALLENGE	= 16,
 	/* 17-31 reserved for challenge text extension */
+	IEEE80211_ELEMID_PWRCNSTR	= 32,
+	IEEE80211_ELEMID_PWRCAP		= 33,
+	IEEE80211_ELEMID_TPCREQ		= 34,
+	IEEE80211_ELEMID_TPCREP		= 35,
+	IEEE80211_ELEMID_SUPPCHAN	= 36,
+	IEEE80211_ELEMID_CHANSWITCHANN	= 37,
+	IEEE80211_ELEMID_MEASREQ	= 38,
+	IEEE80211_ELEMID_MEASREP	= 39,
+	IEEE80211_ELEMID_QUIET		= 40,
+	IEEE80211_ELEMID_IBSSDFS	= 41,
 	IEEE80211_ELEMID_ERP		= 42,
+	IEEE80211_ELEMID_HTCAP		= 45,	/* 11n */
+	IEEE80211_ELEMID_QOS_CAP	= 46,
 	IEEE80211_ELEMID_RSN		= 48,
 	IEEE80211_ELEMID_XRATES		= 50,
+	IEEE80211_ELEMID_TIE		= 56,	/* 11r */
+	IEEE80211_ELEMID_HTINFO		= 61,	/* 11n */
+	IEEE80211_ELEMID_MMIE		= 76,	/* 11w */
 	IEEE80211_ELEMID_TPC		= 150,
 	IEEE80211_ELEMID_CCKM		= 156,
-	IEEE80211_ELEMID_VENDOR		= 221,	/* vendor private */
+	IEEE80211_ELEMID_VENDOR		= 221	/* vendor private */
 };
 
 struct ieee80211_tim_ie {
@@ -420,15 +507,17 @@
 	u_int8_t	tim_bitmap[1];		/* variable-length bitmap */
 } __packed;
 
+struct ieee80211_band {
+	u_int8_t schan;			/* starting channel */
+	u_int8_t nchan;			/* number channels */
+	u_int8_t maxtxpwr;		/* tx power cap */
+} __packed;
+
 struct ieee80211_country_ie {
 	u_int8_t	ie;			/* IEEE80211_ELEMID_COUNTRY */
 	u_int8_t	len;
 	u_int8_t	cc[3];			/* ISO CC+(I)ndoor/(O)utdoor */
-	struct {
-		u_int8_t schan;			/* starting channel */
-		u_int8_t nchan;			/* number channels */
-		u_int8_t maxtxpwr;		/* tx power cap */
-	} __packed band[4];			/* up to 4 sub bands */
+	struct ieee80211_band band[4];		/* up to 4 sub bands */
 } __packed;
 
 #define IEEE80211_CHALLENGE_LEN		128
@@ -488,12 +577,6 @@
 #define	WME_PARAM_OUI_SUBTYPE	0x01
 #define	WME_VERSION		1
 
-/* WME stream classes */
-#define	WME_AC_BE	0		/* best effort */
-#define	WME_AC_BK	1		/* background */
-#define	WME_AC_VI	2		/* video */
-#define	WME_AC_VO	3		/* voice */
-
 /*
  * AUTH management packets
  *
@@ -520,14 +603,14 @@
 
 enum {
 	IEEE80211_AUTH_OPEN_REQUEST		= 1,
-	IEEE80211_AUTH_OPEN_RESPONSE		= 2,
+	IEEE80211_AUTH_OPEN_RESPONSE		= 2
 };
 
 enum {
 	IEEE80211_AUTH_SHARED_REQUEST		= 1,
 	IEEE80211_AUTH_SHARED_CHALLENGE		= 2,
 	IEEE80211_AUTH_SHARED_RESPONSE		= 3,
-	IEEE80211_AUTH_SHARED_PASS		= 4,
+	IEEE80211_AUTH_SHARED_PASS		= 4
 };
 
 /*
@@ -569,13 +652,16 @@
 	IEEE80211_STATUS_TOO_MANY_STATIONS	= 22,
 	IEEE80211_STATUS_RATES			= 23,
 	IEEE80211_STATUS_SHORTSLOT_REQUIRED	= 25,
-	IEEE80211_STATUS_DSSSOFDM_REQUIRED	= 26,
+	IEEE80211_STATUS_DSSSOFDM_REQUIRED	= 26
 };
 
 #define	IEEE80211_WEP_KEYLEN		5	/* 40bit */
 #define	IEEE80211_WEP_IVLEN		3	/* 24bit */
 #define	IEEE80211_WEP_KIDLEN		1	/* 1 octet */
 #define	IEEE80211_WEP_CRCLEN		4	/* CRC-32 */
+#define	IEEE80211_WEP_TOTLEN		(IEEE80211_WEP_IVLEN + \
+					 IEEE80211_WEP_KIDLEN + \
+					 IEEE80211_WEP_CRCLEN)
 #define	IEEE80211_WEP_NKID		4	/* number of key ids */
 
 /*
@@ -620,7 +706,7 @@
 
 #define	IEEE80211_AID(b)	((b) &~ 0xc000)
 
-/* 
+/*
  * RTS frame length parameters.  The default is specified in
  * the 802.11 spec as 512; we treat it as implementation-dependent
  * so it's defined in ieee80211_var.h.  The max may be wrong
@@ -629,7 +715,7 @@
 #define	IEEE80211_RTS_MIN		1
 #define	IEEE80211_RTS_MAX		2346
 
-/* 
+/*
  * TX fragmentation parameters.  As above for RTS, we treat
  * default as implementation-dependent so define it elsewhere.
  */
@@ -637,27 +723,40 @@
 #define	IEEE80211_FRAG_MAX		2346
 
 /*
- * Beacon interval (TU's).  Min+max come from WiFi requirements.
- * As above, we treat default as implementation-dependent so
- * define it elsewhere.
+ * 802.11 frame duration definitions.
  */
-#define	IEEE80211_BINTVAL_MAX	1000	/* max beacon interval (TU's) */
-#define	IEEE80211_BINTVAL_MIN	25	/* min beacon interval (TU's) */
 
-/*
- * DTIM period (beacons).  Min+max are not really defined
- * by the protocol but we want them publicly visible so
- * define them here.
- */
-#define	IEEE80211_DTIM_MAX	15	/* max DTIM period */
-#define	IEEE80211_DTIM_MIN	1	/* min DTIM period */
-
-/*
- * Beacon miss threshold (beacons).  As for DTIM, we define
- * them here to be publicly visible.  Note the max may be
- * clamped depending on device capabilities.
- */
-#define	IEEE80211_HWBMISS_MIN 	1
-#define	IEEE80211_HWBMISS_MAX 	255
+struct ieee80211_duration {
+	uint16_t	d_rts_dur;
+	uint16_t	d_data_dur;
+	uint16_t	d_plcp_len;
+	uint8_t		d_residue;	/* unused octets in time slot */
+};
 
-#endif /* _NET80211_IEEE80211_H_ */
+/* One Time Unit (TU) is 1Kus = 1024 microseconds. */
+#define IEEE80211_DUR_TU		1024
+
+/* IEEE 802.11b durations for DSSS PHY in microseconds */
+#define IEEE80211_DUR_DS_LONG_PREAMBLE	144
+#define IEEE80211_DUR_DS_SHORT_PREAMBLE	72
+
+#define IEEE80211_DUR_DS_SLOW_PLCPHDR	48
+#define IEEE80211_DUR_DS_FAST_PLCPHDR	24
+#define IEEE80211_DUR_DS_SLOW_ACK	112
+#define IEEE80211_DUR_DS_FAST_ACK	56
+#define IEEE80211_DUR_DS_SLOW_CTS	112
+#define IEEE80211_DUR_DS_FAST_CTS	56
+
+#define IEEE80211_DUR_DS_SLOT		20
+#define IEEE80211_DUR_DS_SIFS		10
+#define IEEE80211_DUR_DS_PIFS	(IEEE80211_DUR_DS_SIFS + IEEE80211_DUR_DS_SLOT)
+#define IEEE80211_DUR_DS_DIFS	(IEEE80211_DUR_DS_SIFS + \
+				 2 * IEEE80211_DUR_DS_SLOT)
+#define IEEE80211_DUR_DS_EIFS	(IEEE80211_DUR_DS_SIFS + \
+				 IEEE80211_DUR_DS_SLOW_ACK + \
+				 IEEE80211_DUR_DS_LONG_PREAMBLE + \
+				 IEEE80211_DUR_DS_SLOW_PLCPHDR + \
+				 IEEE80211_DUR_DS_DIFS)
+
+
+#endif /* !_NET80211_IEEE80211_H_ */

aircrack-ng-1.2-rc1.tar.gz/src/include/if_arp.h -> aircrack-ng-1.2-rc2.tar.gz/src/include/if_arp.h Changed

@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)if_arp.h	8.1 (Berkeley) 6/10/93
- * $FreeBSD: src/sys/net/if_arp.h,v 1.24 2005/11/11 16:04:48 ru Exp $
+ * $FreeBSD$
  */
 
 #ifndef _NET_IF_ARP_H_
@@ -50,6 +50,7 @@
 #define ARPHRD_ARCNET	7	/* arcnet hardware format */
 #define ARPHRD_FRELAY 	15	/* frame relay hardware format */
 #define ARPHRD_IEEE1394	24	/* firewire hardware format */
+#define ARPHRD_INFINIBAND 32	/* infiniband hardware format */
 	u_short	ar_pro;		/* format of protocol address */
 	u_char	ar_hln;		/* length of hardware address */
 	u_char	ar_pln;		/* length of protocol address */
@@ -108,6 +109,39 @@
 #define IFP2AC(ifp) ((struct arpcom *)(ifp->if_l2com))
 #define AC2IFP(ac) ((ac)->ac_ifp)
 
-#endif
+#endif /* _KERNEL */
+
+struct arpstat {
+	/* Normal things that happen: */
+	uint64_t txrequests;	/* # of ARP requests sent by this host. */
+	uint64_t txreplies;	/* # of ARP replies sent by this host. */
+	uint64_t rxrequests;	/* # of ARP requests received by this host. */
+	uint64_t rxreplies;	/* # of ARP replies received by this host. */
+	uint64_t received;	/* # of ARP packets received by this host. */
+
+	uint64_t arp_spares[4];	/* For either the upper or lower half. */
+	/* Abnormal event and error  counting: */
+	uint64_t dropped;	/* # of packets dropped waiting for a reply. */
+	uint64_t timeouts;	/* # of times with entries removed */
+				/* due to timeout. */
+	uint64_t dupips;	/* # of duplicate IPs detected. */
+};
+
+#ifdef _KERNEL
+#include <sys/counter.h>
+#include <net/vnet.h>
+
+VNET_PCPUSTAT_DECLARE(struct arpstat, arpstat);
+/*
+ * In-kernel consumers can use these accessor macros directly to update
+ * stats.
+ */
+#define	ARPSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct arpstat, arpstat, name, (val))
+#define	ARPSTAT_SUB(name, val)	ARPSTAT_ADD(name, -(val))
+#define	ARPSTAT_INC(name)	ARPSTAT_ADD(name, 1)
+#define	ARPSTAT_DEC(name)	ARPSTAT_SUB(name, 1)
+
+#endif /* _KERNEL */
 
 #endif /* !_NET_IF_ARP_H_ */

aircrack-ng-1.2-rc1.tar.gz/src/include/if_llc.h -> aircrack-ng-1.2-rc2.tar.gz/src/include/if_llc.h Changed

@@ -1,6 +1,6 @@
-/*	$NetBSD: if_llc.h,v 1.12 1999/11/19 20:41:19 thorpej Exp $	*/
+/*	$NetBSD: if_llc.h,v 1.21 2014/09/05 05:32:07 matt Exp $	*/
 
-/*-
+/*
  * Copyright (c) 1988, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
@@ -12,7 +12,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -29,7 +29,6 @@
  * SUCH DAMAGE.
  *
  *	@(#)if_llc.h	8.1 (Berkeley) 6/10/93
- * $FreeBSD: src/sys/net/if_llc.h,v 1.13 2006/12/01 17:50:11 imp Exp $
  */
 
 #ifndef _NET_IF_LLC_H_
@@ -44,59 +43,59 @@
  */
 
 struct llc {
-	u_int8_t llc_dsap;
-	u_int8_t llc_ssap;
+	uint8_t llc_dsap;
+	uint8_t llc_ssap;
 	union {
 	    struct {
-		u_int8_t control;
-		u_int8_t format_id;
-		u_int8_t class;
-		u_int8_t window_x2;
-	    } __packed type_u;
+		uint8_t control;
+		uint8_t format_id;
+		uint8_t class_u;
+		uint8_t window_x2;
+	    } type_u /* XXX __packed ??? */;
 	    struct {
-		u_int8_t num_snd_x2;
-		u_int8_t num_rcv_x2;
-	    } __packed type_i;
+		uint8_t num_snd_x2;
+		uint8_t num_rcv_x2;
+	    } type_i /* XXX __packed ??? */;
 	    struct {
-		u_int8_t control;
-		u_int8_t num_rcv_x2;
-	    } __packed type_s;
+		uint8_t control;
+		uint8_t num_rcv_x2;
+	    } type_s /* XXX __packed ??? */;
 	    struct {
-	        u_int8_t control;
+	        uint8_t control;
 		/*
 		 * We cannot put the following fields in a structure because
 		 * the structure rounding might cause padding.
 		 */
-		u_int8_t frmr_rej_pdu0;
-		u_int8_t frmr_rej_pdu1;
-		u_int8_t frmr_control;
-		u_int8_t frmr_control_ext;
-		u_int8_t frmr_cause;
-	    } __packed type_frmr;
+		uint8_t frmr_rej_pdu0;
+		uint8_t frmr_rej_pdu1;
+		uint8_t frmr_control;
+		uint8_t frmr_control_ext;
+		uint8_t frmr_cause;
+	    } type_frmr /* XXX __packed ??? */;
 	    struct {
-		u_int8_t  control;
-		u_int8_t  org_code[3];
-		u_int16_t ether_type;
-	    } __packed type_snap;
+		uint8_t  control;
+		uint8_t  org_code[3];
+		uint16_t ether_type;
+	    } type_snap __packed;
 	    struct {
-		u_int8_t control;
-		u_int8_t control_ext;
-	    } __packed type_raw;
-	} __packed llc_un;
+		uint8_t control;
+		uint8_t control_ext;
+	    } type_raw /* XXX __packed ??? */;
+	} llc_un /* XXX __packed ??? */;
 } __packed;
 
 struct frmrinfo {
-	u_int8_t frmr_rej_pdu0;
-	u_int8_t frmr_rej_pdu1;
-	u_int8_t frmr_control;
-	u_int8_t frmr_control_ext;
-	u_int8_t frmr_cause;
+	uint8_t frmr_rej_pdu0;
+	uint8_t frmr_rej_pdu1;
+	uint8_t frmr_control;
+	uint8_t frmr_control_ext;
+	uint8_t frmr_cause;
 } __packed;
 
 #define	llc_control		llc_un.type_u.control
 #define	llc_control_ext		llc_un.type_raw.control_ext
 #define	llc_fid			llc_un.type_u.format_id
-#define	llc_class		llc_un.type_u.class
+#define	llc_class		llc_un.type_u.class_u
 #define	llc_window		llc_un.type_u.window_x2
 #define	llc_frmrinfo 		llc_un.type_frmr.frmr_rej_pdu0
 #define	llc_frmr_pdu0		llc_un.type_frmr.frmr_rej_pdu0
@@ -114,10 +113,6 @@
 #define LLC_FRMRLEN    7
 #define LLC_SNAPFRAMELEN 8
 
-#ifdef CTASSERT
-CTASSERT(sizeof (struct llc) == LLC_SNAPFRAMELEN);
-#endif
-
 /*
  * Unnumbered LLC format commands
  */
@@ -153,9 +148,22 @@
 /*
  * ISO PDTR 10178 contains among others
  */
-#define LLC_8021D_LSAP	0x42
+#define	LLC_8021D_LSAP	0x42
 #define LLC_X25_LSAP	0x7e
 #define LLC_SNAP_LSAP	0xaa
 #define LLC_ISO_LSAP	0xfe
 
-#endif /* _NET_IF_LLC_H_ */
+/*
+ * LLC XID definitions from 802.2, as needed
+ */
+
+#define LLC_XID_FORMAT_BASIC	0x81
+#define LLC_XID_BASIC_MINLEN	(LLC_UFRAMELEN + 3)
+
+#define LLC_XID_CLASS_I 	0x1
+#define LLC_XID_CLASS_II	0x3
+#define LLC_XID_CLASS_III	0x5
+#define LLC_XID_CLASS_IV	0x7
+
+
+#endif /* !_NET_IF_LLC_H_ */

aircrack-ng-1.2-rc1.tar.gz/src/ivstools.c -> aircrack-ng-1.2-rc2.tar.gz/src/ivstools.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/kstats.c -> aircrack-ng-1.2-rc2.tar.gz/src/kstats.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/makeivs-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/makeivs-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/airpcap.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/airpcap.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/byteorder.h -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/byteorder.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/common.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/common.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/common.h -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/common.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/cygwin.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/cygwin.c Changed

@@ -47,6 +47,7 @@
 	volatile int	pc_running;
 	int		pc_pipe[2]; /* reader -> parent */
 	int		pc_channel;
+	int		pc_frequency;
 	struct wif	*pc_wi;
 	int		pc_did_init;
 
@@ -55,6 +56,7 @@
 
 	int		(*pc_init)(char *param);
 	int		(*pc_set_chan)(int chan);
+	int		(*pc_set_freq)(int freq);
 	int		(*pc_inject)(void *buf, int len, struct tx_info *ti);
 	int		(*pc_sniff)(void *buf, int len, struct rx_info *ri);
 	int		(*pc_get_mac)(void *mac);
@@ -157,6 +159,7 @@
 
 		priv->pc_init		= dlsym(lib, xstr(CYGWIN_DLL_INIT));
 		priv->pc_set_chan	= dlsym(lib, xstr(CYGWIN_DLL_SET_CHAN));
+		priv->pc_set_freq	= dlsym(lib, xstr(CYGWIN_DLL_SET_FREQ));
 		priv->pc_get_mac	= dlsym(lib, xstr(CYGWIN_DLL_GET_MAC));
 		priv->pc_set_mac	= dlsym(lib, xstr(CYGWIN_DLL_SET_MAC));
 		priv->pc_close		= dlsym(lib, xstr(CYGWIN_DLL_CLOSE));
@@ -248,6 +251,23 @@
 }
 
 /**
+ * Change frequency
+ * @param freq Frequency
+ * @return 0 if successful, -1 if it failed
+ */
+static int cygwin_set_freq(struct wif *wi, int freq)
+{
+	struct priv_cygwin *priv = wi_priv(wi);
+
+	if (!priv->pc_set_freq || priv->pc_set_freq(freq) == -1)
+		return -1;
+
+	priv->pc_frequency = freq;
+	return 0;
+}
+
+
+/**
  * Capture a packet
  * @param buf Buffer for the packet (has to be already allocated)
  * @param len Length of the buffer
@@ -301,6 +321,13 @@
 	return pc->pc_channel;
 }
 
+static int cygwin_get_freq(struct wif *wi)
+{
+	struct priv_cygwin *pc = wi_priv(wi);
+
+	return pc->pc_frequency;
+}
+
 int cygwin_read_reader(int fd, int plen, void *dst, int len)
 {
 	/* packet */
@@ -465,6 +492,11 @@
 
 	while (priv->pc_running) {
 		/* read one packet */
+
+		/* a potential problem: the cygwin_read_packet will never return
+		 * if there no packet sniffered, so the thread cannot be closed
+		 * correctly.
+		 */
 		len = cygwin_read_packet(priv, buf, sizeof(buf), &ri);
 		if (len == -1)
 			break;
@@ -501,6 +533,8 @@
 	wi->wi_write		= cygwin_write;
 	wi->wi_set_channel	= cygwin_set_channel;
 	wi->wi_get_channel	= cygwin_get_channel;
+	wi->wi_set_freq		= cygwin_set_freq;
+	wi->wi_get_freq		= cygwin_get_freq;
 	wi->wi_close		= cygwin_close;
 	wi->wi_fd		= cygwin_fd;
 	wi->wi_get_mac		= cygwin_get_mac;

aircrack-ng-1.2-rc1.tar.gz/src/osdep/cygwin.h -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/cygwin.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/cygwin_tap.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/cygwin_tap.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/linux.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/linux.c Changed

@@ -1,7 +1,7 @@
 /*
  *  OS dependent APIs for Linux
  *
- *  Copyright (C) 2006-2013 Thomas d'Otreppe
+ *  Copyright (C) 2006-2015 Thomas d'Otreppe <tdotreppe@aircrack-ng.org>
  *  Copyright (C) 2004, 2005 Christophe Devine
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -72,6 +72,9 @@
 static int chan;
 #endif //CONFIG_LIBNL
 
+/* if_nametoindex is defined in net/if.h but that conflicts with linux/if.h */
+extern unsigned int if_nametoindex (const char *__ifname);
+extern char *if_indextoname (unsigned int __ifindex, char *__ifname);
 
 typedef enum {
         DT_NULL = 0,
@@ -178,6 +181,8 @@
 static int is_ndiswrapper(const char * iface, const char * path)
 {
     int n, pid, unused;
+    if (!path || !iface)
+	return 0;
     if ((pid=fork())==0)
     {
         close( 0 ); close( 1 ); close( 2 ); unused = chdir( "/" );
@@ -259,22 +264,7 @@
                 "/usr/local/bin",
                 "/tmp"
         };
-    /*
-	#define SEPARATOR ":"
-
-	env = getenv("PATH");
-	if (env) {
-		path = strtok(env, SEPARATOR);
-		while (path) {
-			found = searchInside(path, tool);
-	                if (found != NULL)
-	                        return found;
-			path = strtok(NULL, SEPARATOR);
-		}
-	}
-	#undef SEPARATOR
-	*/
-	
+
 	// Also search in other known location just in case we haven't found it yet
 	nbelems = sizeof(paths) / sizeof(char *);
 	for (i = 0; i < nbelems; i++)
@@ -373,15 +363,16 @@
 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
                      void *arg)
 {
-    printf("\n\n\nERROR");
-        int *ret = arg;
-            *ret = err->error;
-                return NL_STOP;
+	if (nla) { }
+	printf("\n\n\nERROR");
+	int *ret = arg;
+	*ret = err->error;
+	return NL_STOP;
 }
 
 static void test_callback(struct nl_msg *msg, void *arg)
 {
-
+	if (msg || arg) { }
 }
 #endif /* End nl80211 */
 
@@ -952,14 +943,11 @@
     struct priv_linux *dev = wi_priv(wi);
     char s[32];
     int pid, status, unused;
-    struct iwreq wrq;
 
     unsigned int devid;
     struct nl_msg *msg;
     unsigned int freq;
     int err;
-    struct nl_cb *cb;
-    struct nl_cb *s_cb;
     unsigned int htval = NL80211_CHAN_NO_HT;
 
     memset( s, 0, sizeof( s ) );
@@ -1034,15 +1022,6 @@
         fprintf(stderr, "failed to allocate netlink message\n");
         return 2;
     }
-    cb = nl_cb_alloc(NL_CB_DEFAULT);
-    s_cb = nl_cb_alloc(NL_CB_DEFAULT);
-    if (!cb || !s_cb) {
-        fprintf(stderr, "failed to allocate netlink callbacks\n");
-        err = 2;
-        goto out_free_msg;
-    }
-
-    //nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, test_callback, NULL);
 
     genlmsg_put(msg, 0, 0, genl_family_get_id(state.nl80211), 0,
             0, NL80211_CMD_SET_WIPHY, 0);
@@ -1052,13 +1031,11 @@
     NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, htval);
 
     nl_send_auto_complete(state.nl_sock,msg);
+    nlmsg_free(msg);
 
     dev->channel = channel;
 
     return( 0 );
- out_free_msg:
-    nlmsg_free(msg);
-    return err;
  nla_put_failure:
     return -ENOBUFS;
 }
@@ -1654,8 +1631,9 @@
     }
 
         /* Check iwpriv existence */
+	iwpriv = wiToolsPath("iwpriv");
+
 #ifndef CONFIG_LIBNL
-    iwpriv = wiToolsPath("iwpriv");
     dev->iwpriv = iwpriv;
     dev->iwconfig = wiToolsPath("iwconfig");
     dev->ifconfig = wiToolsPath("ifconfig");

aircrack-ng-1.2-rc1.tar.gz/src/osdep/network.c -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/network.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/network.h -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/network.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/osdep/packed.h -> aircrack-ng-1.2-rc2.tar.gz/src/osdep/packed.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/packetforge-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/packetforge-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/src/tkiptun-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/tkiptun-ng.c Changed

@@ -1,7 +1,7 @@
 /*
  *  802.11 WPA replay & injection attacks
  *
- *  Copyright (C) 2008, 2009 Martin Beck
+ *  Copyright (C) 2008, 2009 Martin Beck <hirte@aircrack-ng.org>
  *
  *  WEP decryption attack (chopchop) developed by KoreK
  *
@@ -143,7 +143,7 @@
 char usage[] =
 
 "\n"
-"  %s - (C) 2008-2013 Thomas d\'Otreppe\n"
+"  %s - (C) 2008-2014 Thomas d\'Otreppe\n"
 "  http://www.aircrack-ng.org\n"
 "\n"
 "  usage: tkiptun-ng <options> <replay interface>\n"
@@ -693,7 +693,7 @@
     return rc;
 }
 
-void read_sleep( int usec )
+void read_sleep( unsigned long usec )
 {
     struct timeval tv, tv2, tv3;
     int caplen;
@@ -705,7 +705,7 @@
     tv3.tv_sec=0;
     tv3.tv_usec=10000;
 
-    while( ((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) < (usec) )
+    while( ((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) < (usec) )
     {
         FD_ZERO( &rfds );
         FD_SET( dev.fd_in, &rfds );
@@ -835,7 +835,7 @@
             len = read_packet(pkt_sniff, sizeof(pkt_sniff), NULL);
 
             gettimeofday(&tv2, NULL);
-            if(((tv2.tv_sec-tv.tv_sec)*1000000) + (tv2.tv_usec-tv.tv_usec) > 10000*1000) //wait 10sec for beacon frame
+            if(((tv2.tv_sec-tv.tv_sec)*1000000UL) + (tv2.tv_usec-tv.tv_usec) > 10000*1000) //wait 10sec for beacon frame
             {
                 return -1;
             }
@@ -3263,14 +3263,14 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
                 {
                     PCT; printf("Not enough acks, repeating...\n");
                     again = RETRY;
                     break;
                 }
 
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
                 {
                     PCT; printf("No answer, repeating...\n");
                     round++;
@@ -3406,14 +3406,14 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
                 {
                     PCT; printf("Not enough acks, repeating...\n");
                     again = RETRY;
                     break;
                 }
 
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
                 {
                     PCT; printf("No answer, repeating...\n");
                     round++;
@@ -3527,14 +3527,14 @@
                 }
 
                 gettimeofday( &tv2, NULL );
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (100*1000) && acksgot >0 && acksgot < packets  )//wait 100ms for acks
                 {
                     PCT; printf("Not enough acks, repeating...\n");
                     again = RETRY;
                     break;
                 }
 
-                if (((tv2.tv_sec*1000000 - tv.tv_sec*1000000) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
+                if (((tv2.tv_sec*1000000UL - tv.tv_sec*1000000UL) + (tv2.tv_usec - tv.tv_usec)) > (1500*1000) && !gotit) //wait 1500ms for an answer
                 {
                     PCT; printf("No answer, repeating...\n");
                     round++;
@@ -4192,7 +4192,9 @@
     }
 
     /* drop privileges */
-    setuid( getuid() );
+    if (setuid( getuid() ) == -1) {
+	perror("setuid");
+    }
 
     /* XXX */
     if( opt.r_nbpps == 0 )
@@ -4447,7 +4449,7 @@
     while(1)
     {
         gettimeofday(&mic_fail, NULL);
-        if( (mic_fail.tv_sec - opt.last_mic_failure.tv_sec) * 1000000 + (mic_fail.tv_usec - opt.last_mic_failure.tv_usec) > opt.mic_failure_interval * 1000000)
+        if( (mic_fail.tv_sec - opt.last_mic_failure.tv_sec) * 1000000UL + (mic_fail.tv_usec - opt.last_mic_failure.tv_usec) > opt.mic_failure_interval * 1000000UL)
             break;
         sleep(1);
     }

aircrack-ng-1.2-rc1.tar.gz/src/version.h -> aircrack-ng-1.2-rc2.tar.gz/src/version.h Changed

aircrack-ng-1.2-rc1.tar.gz/src/wesside-ng.c -> aircrack-ng-1.2-rc2.tar.gz/src/wesside-ng.c Changed

aircrack-ng-1.2-rc1.tar.gz/test/cryptounittest/Makefile -> aircrack-ng-1.2-rc2.tar.gz/test/cryptounittest/Makefile Changed

@@ -14,8 +14,7 @@
 
 SRC_CRYPTO	  = $(AC_ROOT)/src/crypto.c $(AC_ROOT)/src/sha1-git.c
 
-TESTFILES        = test-encrypt-wep$(EXE) test-calc-pmk$(EXE) test-calc-mic$(EXE) test-calc-ptk$(EXE) test-decrypt-ccmp$(EXE) test-calc-4pmk$(EXE)
-
+TESTFILES        = test-encrypt-wep$(EXE) test-calc-pmk$(EXE) test-calc-mic$(EXE) test-calc-ptk$(EX) test-encrypt-ccmp$(EXE) test-decrypt-ccmp$(EXE) test-calc-4pmk$(EXE)
 
 OBJS_TEST_EWEP  = test-encrypt-wep.c $(SRC_CRYPTO)
 OBJS_TEST_CPMK  = test-calc-pmk.c $(SRC_CRYPTO)
@@ -23,6 +22,7 @@
 OBJS_TEST_CMIC  = test-calc-mic.c $(SRC_CRYPTO)
 OBJS_TEST_CPTK  = test-calc-ptk.c $(SRC_CRYPTO)
 OBJS_TEST_DCMP  = test-decrypt-ccmp.c $(SRC_CRYPTO)
+OBJS_TEST_ECMP  = test-encrypt-ccmp.c $(SRC_CRYPTO)
 
 test-encrypt-wep$(EXE): $(OBJS_TEST_EWEP)
 	$(CC) $(CFLAGS) $(OBJS_TEST_EWEP) -o $(@) $(LIBSSL)
@@ -39,6 +39,9 @@
 test-calc-ptk$(EXE): $(OBJS_TEST_CPTK)
 	$(CC) $(CFLAGS) $(OBJS_TEST_CPTK) -o $(@) $(LIBSSL)
 
+test-encrypt-ccmp$(EXE): $(OBJS_TEST_ECMP)
+	$(CC) $(CFLAGS) $(OBJS_TEST_ECMP) -o $(@) $(LIBSSL)
+
 test-decrypt-ccmp$(EXE): $(OBJS_TEST_DCMP)
 	$(CC) $(CFLAGS) $(OBJS_TEST_DCMP) -o $(@) $(LIBSSL)

aircrack-ng-1.2-rc2.tar.gz/test/cryptounittest/test-encrypt-ccmp.c Added

@@ -0,0 +1,76 @@
+/*
+ *
+ * test-encrypt-ccmp.c
+ *
+ * Copyright (C) 2015 Jorn van Engelen <spamme@quzart.com>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ *
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include "crypto.h"
+#include "tests.h"
+
+#define BUFFER_SIZE 65536
+
+int main(int argc, char **argv)
+{
+    int error = 0;
+    int caplen = 44;
+
+    // CCMP test vector as described in IEEE 802.11(TM)-2012, Section M.6.4.
+
+    unsigned char tk1[16] =
+    "\xc9\x7c\x1f\x67\xce\x37\x11\x85\x51\x4a\x8a\x19\xf2\xbd\xd5\x2f";
+
+    unsigned char pn[6] =
+    "\xb5\x03\x97\x76\xe7\x0c";
+
+    unsigned char h80211[44] =
+    "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
+    "\xab\xae\xa5\xb8\xfc\xba\x80\x33\xf8\xba\x1a\x55\xd0\x2f\x85\xae"
+    "\x96\x7b\xb6\x2f\xb6\xcd\xa8\xeb\x7e\x78\xa0\x50";
+
+    unsigned char expected[60] =
+    "\x08\x48\xc3\x2c\x0f\xd2\xe1\x28\xa5\x7c\x50\x30\xf1\x84\x44\x08"
+    "\xab\xae\xa5\xb8\xfc\xba\x80\x33\x0c\xe7\x00\x20\x76\x97\x03\xb5"
+    "\xf3\xd0\xa2\xfe\x9a\x3d\xbf\x23\x42\xa6\x43\xe4\x32\x46\xe8\x0c"
+    "\x3c\x04\xd0\x19\x78\x45\xce\x0b\x16\xf9\x76\x23";
+
+    unsigned char expected_output[BUFFER_SIZE];
+    unsigned char input[BUFFER_SIZE];
+
+    if (argc < 1)
+	return 1;
+
+    bzero( expected_output, BUFFER_SIZE );
+    bzero( input, BUFFER_SIZE );
+    memcpy( expected_output, expected, sizeof(expected) );
+    memcpy( input, h80211, sizeof(h80211) );
+
+    caplen = encrypt_ccmp( input, caplen, tk1, pn );
+    if ( caplen != sizeof(expected) )
+        error++;
+    error += test( input, expected_output, sizeof(expected), argv[0] );
+
+    return error;
+}
+

aircrack-ng-1.2-rc2.tar.gz/test/pingreply.c Added

@@ -0,0 +1,261 @@
+/* pingreply.c - Ping reply
+ *
+ * DESCIPTION
+ *
+ * Replies to all ping requests. Useful for testing sniffing/injecting
+ * packets with airtun-ng.
+ *
+ * USAGE
+ *
+ * ./pingreply <iface>
+ *
+ * INSTALL
+ *
+ * cc -lpcap -o pingreply pingreply.c
+ *
+ * LICENSE
+ *
+ * Copyright (c) 2015, Jorn van Engelen <spamme@quzart.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice unmodified, this list of conditions, and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+#include <pcap.h>
+#include <arpa/inet.h>
+
+
+struct eth_hdr {
+    unsigned char dst[6];
+    unsigned char src[6];
+    unsigned short type;
+};
+
+struct ip_hdr {
+    unsigned char vhl;
+    unsigned char tos;
+    unsigned short length;
+    unsigned short id;
+    unsigned short off;
+    unsigned char ttl;
+    unsigned char proto;
+    unsigned short chksum;
+    unsigned char src[4];
+    unsigned char dst[4];
+};
+
+struct icmp_hdr {
+    unsigned char type;
+    unsigned char code;
+    unsigned short chksum;
+    unsigned short id;
+    unsigned short seq;
+    unsigned char data[];
+};
+
+struct eth_ip_icmp_reply {
+    struct eth_hdr eth;
+    struct ip_hdr ip;
+    struct icmp_hdr icmp;
+};
+
+
+
+pcap_t *p;
+char errbuf[PCAP_ERRBUF_SIZE];
+
+
+short internet_chksum( unsigned char *hdr, int len )
+{
+    unsigned int sum = 0;
+
+    while ( len > 1 )
+    {
+        sum += * (unsigned short*) hdr;
+        hdr += 2;
+        len -= 2;
+    }
+
+    if ( len > 0 )
+        sum += * (unsigned char*) hdr;
+
+    while ( sum >> 16 )
+        sum = (sum >> 16) + (sum & 0xffff);
+
+    return ~sum;
+}
+
+void reply_icmp_echo(
+    const struct eth_hdr *eth,
+    const struct ip_hdr *ip,
+    const struct icmp_hdr *icmp,
+    int len)
+{
+    unsigned char *ptr;
+    struct eth_ip_icmp_reply *reply;
+
+    reply = (struct eth_ip_icmp_reply*) calloc( sizeof(struct eth_ip_icmp_reply) + len, 1 );
+    assert( reply != NULL );
+
+    memcpy( reply->eth.src, eth->dst, 6 );
+    memcpy( reply->eth.dst, eth->src, 6 );
+    reply->eth.type = htons(0x0800);
+
+    reply->ip.vhl = 0x45;
+    reply->ip.length = htons(sizeof(struct ip_hdr) + sizeof(struct icmp_hdr) + len);
+    reply->ip.id = htons(0xCAFE);
+    reply->ip.ttl = 0x80;
+    reply->ip.proto = 0x01;
+    memcpy( reply->ip.src, ip->dst, 4 );
+    memcpy( reply->ip.dst, ip->src, 4 );
+
+    reply->icmp.type = 0x00;
+    reply->icmp.code = 0x00;
+    reply->icmp.id = icmp->id;
+    reply->icmp.seq = icmp->seq;
+    memcpy( reply->icmp.data, icmp->data, len );
+    
+    reply->ip.chksum = internet_chksum( (unsigned char*) &(reply->ip), sizeof(struct ip_hdr) );
+    reply->icmp.chksum = internet_chksum( (unsigned char*) &(reply->icmp), sizeof(struct icmp_hdr) + len );
+
+    printf( "Sent icmp echo reply to: %i.%i.%i.%i.\n", ip->src[0], ip->src[1], ip->src[2], ip->src[3] );
+    
+    if ( pcap_inject( p, reply, sizeof(struct eth_ip_icmp_reply) + len ) == -1 )
+    {
+        fprintf( stderr, "Could not inject packet: %s\n", pcap_geterr( p ) );
+    }
+
+    free( reply );
+}
+
+    
+void receive_packet(
+    unsigned char *args,
+    const struct pcap_pkthdr *header,
+    const unsigned char *packet)
+{
+    int len = header->caplen;
+    int ip_hdr_len;
+    const struct eth_hdr *eth;
+    const struct ip_hdr *ip;
+    const struct icmp_hdr *icmp;
+    
+    len -= sizeof(struct eth_hdr);
+    if ( len < 0 )
+        return;
+
+    eth = (struct eth_hdr*) packet;
+    packet += sizeof(struct eth_hdr);
+    
+    /* Packet must be IPv4 */
+    if ( ntohs(eth->type) != 0x0800 )
+        return;
+
+    if ( len < sizeof(struct ip_hdr) )
+        return;
+
+    ip = (struct ip_hdr*) packet;
+    if ( ntohs( ip->length ) != len )
+        return;
+    if ( ip->vhl >> 4 != 4 )
+        return;
+    
+    ip_hdr_len = ( ip->vhl & 0x0F ) * 4;
+    if ( ip_hdr_len < sizeof(struct ip_hdr) )
+        return;
+    
+    len -= ip_hdr_len;
+    if ( len < 0 )
+        return;
+    
+    packet += ip_hdr_len;
+    
+    /* Packet must be ICMP */
+    if ( ip->proto != 0x01 )
+        return;
+
+    len -= sizeof(struct icmp_hdr);
+    if ( len <  0 )
+        return;
+
+    icmp = (struct icmp_hdr*) packet;
+    packet += sizeof(struct icmp_hdr);
+
+    /* Packet must be echo request */
+    if ( ! ( icmp->type == 0x08 && icmp->code == 0x00 ) )
+        return;
+
+    usleep( 2000 );
+    
+    reply_icmp_echo( eth, ip, icmp, len );
+}
+
+int main( int argc, char *argv[] )
+{
+    struct bpf_program fp;
+
+    if ( argc != 2 )
+    {
+        fprintf( stderr, "Usage: pingrep <dev>\n" );
+        return 2;
+    }
+
+    p = pcap_open_live( argv[1], 1024, 1, 0, errbuf );
+    if ( p == NULL )
+    {
+        fprintf( stderr, "Could not open device %s: %s\n", argv[1], errbuf );
+        return 2;
+    }
+
+    if ( pcap_datalink( p ) != DLT_EN10MB )
+    {
+        fprintf( stderr, "Expected Ethernet from device %s.\n", argv[1] );
+        return 2;
+    }
+
+    if ( pcap_compile( p, &fp, "icmp[icmptype] = icmp-echo", 0, PCAP_NETMASK_UNKNOWN ) == -1 )
+    {
+        fprintf( stderr, "Could not parse filter: %s\n", pcap_geterr( p ) );
+        return 2;
+    }
+
+    if ( pcap_setfilter( p, &fp ) == -1 )
+    {
+        fprintf( stderr, "Could not install filter: %s\n", pcap_geterr( p ) );
+        return 2;
+    }
+
+    printf( "Receiving packets ...\n" );
+    pcap_loop( p, 0, receive_packet, NULL );
+
+    pcap_freecode( &fp );
+    pcap_close( p );
+
+    printf( "Done.\n" );
+    
+    return 0;
+}

aircrack-ng-1.2-rc2.tar.gz/test/verify_inject.py Added

Overview

Request 1973 (accepted)

Request History