# aircrack-ng monitor mode patch for FreeBSD



## Alt (Jan 6, 2010)

Hi i installed net-mgmt/aircrack-ng - it works, but i have problem patching ath drivers for FreeBSD, so inject in monitor mode does not work. Searched aircrack-ng.org but not found any useful info about driver patching. Have anyone experience to handle this? My network adapter is Atheros AR5007EG


----------



## richardpl (Jan 6, 2010)

ath driver doesnt need patch, monitor and injection works in AHDEMO mode, you just need to patch aircrack-ng code.


----------



## Alt (Jan 6, 2010)

AHDEMO does nothing (airodump and aireplay doesnt work - they just exit silently), tried to create with this command:

```
ifconfig wlan1 create wlandev ath0 wlanmode ahdemo
```
MONITOR mode - only airodump works. aireplay says

```
wi_write(): Permission denied.
```
Maybe port is broken in 8.0 or i need 'special' patch ?


----------



## oomka (Jan 26, 2010)

hi
had the same problem in 8.0
here i've found the solution. in few words:

opened /usr/src/sys/net80211/ieee80211.c
found this section

```
ether_ifattach(ifp, vap->iv_myaddr);
        if (vap->iv_opmode == IEEE80211_M_MONITOR) {
                /* NB: disallow transmit */
                ifp->if_transmit = null_transmit;
                ifp->if_output = null_output;
        } else {
                /* hook output method setup by ether_ifattach */
                vap->iv_output = ifp->if_output;
                ifp->if_output = ieee80211_output;
        }
```

modified it to this

```
ether_ifattach(ifp, vap->iv_myaddr);

// if (vap->iv_opmode == IEEE80211_M_MONITOR) { // /* NB: disallow transmit */ // ifp->if_transmit = null_transmit; // ifp->if_output = null_output; // } else {

    /* hook output method setup by ether_ifattach */ vap->iv_output = ifp->if_output; ifp->if_output = ieee80211_output;

// }
```

recompiled and installed kernel with my custom configuration file (unchanged)
reboot

aireplay-ng works fine now. hope it helped you.
have a nice day.


----------



## richardpl (Jan 30, 2010)

You should really use AHDEMO and not MONITOR, you just need to modify driver code, which is trivial.

Here is general patch to fix broken aircrack-ng injection on FreeBSD:


```
diff -Nur aircrack-ng-1.0/src/aircrack-ng.c aircrack-ng-1.0_new/src/aircrack-ng.c
--- aircrack-ng-1.0/src/aircrack-ng.c   2009-07-26 18:46:42.000000000 +0000
+++ aircrack-ng-1.0_new/src/aircrack-ng.c       2010-01-09 22:42:54.000000000 +0000
@@ -40,7 +40,7 @@
 #define _GNU_SOURCE

 #include <sys/types.h>
-#include <sys/termios.h>
+#include <termios.h>
 #include <sys/ioctl.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
diff -Nur aircrack-ng-1.0/src/osdep/freebsd.c aircrack-ng-1.0_new/src/osdep/freebsd.c
--- aircrack-ng-1.0/src/osdep/freebsd.c 2008-02-26 18:12:19.000000000 +0000
+++ aircrack-ng-1.0_new/src/osdep/freebsd.c     2009-10-22 16:07:20.000000000 +0000
@@ -389,7 +389,7 @@

         memset(&ifr, 0, sizeof(ifr));
         strcpy(ifr.ifr_name, iface);
-        ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
+        ifr.ifr_media = ifmr.ifm_current;
         if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1)
                goto close_sock;

@@ -544,6 +544,8 @@
        pf->pf_fd = fd;
         pf->pf_txparams.ibp_vers = IEEE80211_BPF_VERSION;
        pf->pf_txparams.ibp_len = sizeof(struct ieee80211_bpf_params) - 6;
+       pf->pf_txparams.ibp_rate0 = 2;         /* 1 MB/s XXX */
+       pf->pf_txparams.ibp_try0 = 1;          /* no retransmits */
        pf->pf_txparams.ibp_rate1 = 2;         /* 1 MB/s XXX */
        pf->pf_txparams.ibp_try1 = 1;          /* no retransmits */
        pf->pf_txparams.ibp_flags = IEEE80211_BPF_NOACK;
Files aircrack-ng-1.0/src/wep.cap and aircrack-ng-1.0_new/src/wep.cap differ
diff -Nur aircrack-ng-1.0/src/wesside-ng.c aircrack-ng-1.0_new/src/wesside-ng.c
--- aircrack-ng-1.0/src/wesside-ng.c    2009-07-29 11:31:34.000000000 +0000
+++ aircrack-ng-1.0_new/src/wesside-ng.c        2010-01-30 16:28:59.000000000 +0000
@@ -33,7 +33,7 @@

 #include <sys/types.h>
 #include <sys/socket.h>
-#include <sys/termios.h>
+#include <termios.h>
 #include <sys/ioctl.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
```


----------



## tfwiii (Jan 18, 2011)

Hi,

I'm having the same problems with aircrack.

I've tried following the patching instructions here but they haven't done the trick.

To be honest I was hoping that a year after this thread started this would have been resolved in the FreeBSD ports/packages!

Is it possible to inject packets in FreeBSD? Specifically with aireplay?

The primary reason I have installed FreeBSD again after a long break is to polish up my pen testing skills. If I can't use aircrack then I will have to use something else which would be a pity - I like FreeBSD!

Any help, advice, updates on this would be hugely appreciated 


```
# uname -a
FreeBSD  8.1-RELEASE FreeBSD 8.1-RELEASE #1: Tue Jan 18 20:53:09 GMT 2011     root@:/usr/obj/usr/src/sys/MYKERNEL  i386

# pciconf -lvc
ath0@pci0:2:0:0:        class=0x028000 card=0x10891a3b chip=0x002b168c rev=0x01 hdr=0x00
    vendor     = 'Atheros Communications Inc.'
    device     = 'Atheros AR9285 Wireless LAN 802.11 a/b/g/n Controller (AR928x)'
    class      = network
    cap 01[40] = powerspec 3  supports D0 D1 D3  current D0
    cap 05[50] = MSI supports 1 message 
    cap 10[60] = PCI-Express 2 legacy endpoint max data 128(128) link x1(x1)
```


```
# ifconfig wlan0
wlan0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect <monitor> (autoselect <monitor>)
        status: no carrier
        ssid "" channel 11 (2462 MHz 11g)
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20
        scanvalid 60 protmode CTS wme burst bintval 0
```


```
# aireplay-ng -9 wlan0
23:23:50  Trying broadcast probe requests...
23:23:50  Injection is working!
23:23:52  Found 6 APs

23:23:52  Trying directed probe requests...
23:23:52  00:1F:5B:89:98:4C - channel: 11 - 'Apple Network 89984c'
wi_write(): Input/output error
wi_write(): Input/output error
wi_write(): Input/output error
wi_write(): Input/output error
wi_write(): Input/output error
wi_write(): Input/output error
wi_write(): Input/output error
```

I initially had the wi_write(): Permission denied error so I seem to have made some progress - but not enough :\

TIA
Tom


----------



## richardpl (Jan 19, 2011)

Read thread again, use AHDEMO mode and not MONITOR mode.

MONITOR mode is read-only and you can not inject when kernel is operating in such mode.

Contact aircrack-ng developer/maintainter to close 666. bug and/or report problem to port maintainer (if there is one).

Injecting always worked and will always work on FreeBSD.


----------



## tfwiii (Jan 19, 2011)

*ahdemo*



			
				richardpl said:
			
		

> Read thread again, use AHDEMO mode and not MONITOR mode.
> 
> MONITOR mode is read-only and you can not inject when kernel is operating in such mode.
> 
> ...



Hi Richard,

Thanks for your reply - really appreciate your time.

I have tried ahdemo mode as well. It exits silently with any of the aircrack suite of tools.


```
[root@ ~]# ifconfig wlan0 create wlandev ath0 wlanmode ahdemo
[root@ ~]# ifconfig wlan0
wlan0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect <flag0,adhoc> (autoselect <flag0,adhoc>)
        status: no carrier
        ssid "" channel 11 (2462 MHz 11g)
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20
        scanvalid 60 protmode CTS wme burst
[root@ ~]# aireplay-ng -9 wlan0
[root@ ~]# ifconfig wlan0
wlan0: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <flag0,adhoc>
        status: running
        ssid asdf channel 11 (2462 MHz 11g) bssid 00:24:b2:8b:2c:f8
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20
        scanvalid 60 protmode CTS wme burst
[root@ ~]#
```

Something I have noticed is that after attempting to use aireplay, as above, the wlan0 interface has become associated with an access point. I don't know if this is normal/desired behaviour...

In any case - as you can see aireplay exits silently.

Am I doing anything wrong? Any thoughts?

Tom


----------



## richardpl (Jan 20, 2011)

Did you noticed my patch for aircrack-ng in this same thread? Did you used it at all?

Without that patch aircrack-ng suite will fail to work.


----------



## tfwiii (Jan 20, 2011)

*Patch*



			
				richardpl said:
			
		

> Did you noticed my patch for aircrack-ng in this same thread? Did you used it at all?
> 
> Without that patch aircrack-ng suite will fail to work.



Hi again,

No, I didn't try it. I tried the kernel patch instead. Sorry! I'll try it and let you know how I get on...

What does this line mean by the way?


```
Files aircrack-ng-1.0/src/wep.cap and aircrack-ng-1.0_new/src/wep.cap differ
```

Tom


----------



## richardpl (Jan 20, 2011)

tfwiii said:
			
		

> What does this line mean by the way?
> 
> 
> ```
> ...



Ignore it. I was testing stuff in same directory and binary file got created so just ignore that line.


----------



## tfwiii (Jan 21, 2011)

*Not quite...*



			
				tfwiii said:
			
		

> Hi again,
> 
> No, I didn't try it. I tried the kernel patch instead. Sorry! I'll try it and let you know how I get on...



Hi again,

Recompiled aircrack with you patches applied. With the following result...


```
[root@ ~/aircrack]# ifconfig wlan0 create wlandev ath0 wlanmode ahdemo
[root@ ~/aircrack]# aireplay-ng -9 wlan0
00:03:27  Trying broadcast probe requests...
00:03:29  No Answer...
00:03:29  Found 0 APs
[root@ ~/aircrack]# ifconfig wlan0
wlan0: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect <flag0,adhoc> (autoselect <flag0,adhoc>)
        status: no carrier                                                                           
        ssid "" channel 4 (2427 MHz 11b)                                                             
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20                                 
        scanvalid 60 wme burst
```

So that doesn't seemed to have worked!

It does appear to have done something to my wireless card hardware however! When I try to reassociate with my AP it fails as follows:


```
[root@ ~/aircrack]# ifconfig wlan0 destroy
[root@ ~/aircrack]# ifconfig wlan0 create wlandev ath0 ssid asdf up
[root@ ~/aircrack]# dhclient wlan0
wlan0: no link .............. giving up
[root@ ~/aircrack]# ifconfig wlan0
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
        status: no carrier
        ssid asdf channel 2 (2417 MHz 11g)
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20 bmiss 7
        scanvalid 60 bgscan bgscanintvl 300 bgscanidle 250 roam:rssi 7
        roam:rate 5 protmode CTS wme burst bintval 0
[root@ ~/aircrack]# ifconfig wlan0 up
[root@ ~/aircrack]# ifconfig wlan0
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 1c:4b:d6:37:12:9d
        media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
        status: no carrier
        ssid asdf channel 1 (2412 MHz 11g)
        regdomain 96 indoor ecm authmode OPEN privacy OFF txpower 20 bmiss 7
        scanvalid 60 bgscan bgscanintvl 300 bgscanidle 250 roam:rssi 7
        roam:rate 5 protmode CTS wme burst bintval 0
```

And I get the following error on console repeating...


```
ath0: harware error; resetting
ath0: 0x00000000 0x00002000 0x00000000, 0x00000000 0x00000000 0x00000000
```

Could this be a result of the kernel patch I have applied form this thread? Or is this just a problem with my hardware and ahdemo mode? (Or are those both terrible guesses on my part?  ).

Tom


----------



## richardpl (Jan 21, 2011)

Do not modify kernel code unless you know what are you doing.

The errors on console could mean anything - you did not mentioned exact time/situation when it happens.


----------



## tfwiii (Jan 22, 2011)

richardpl said:
			
		

> Do not modify kernel code unless you know what are you doing.
> 
> The errors on console could mean anything - you did not mentioned exact time/situation when it happens.



Hi,

As soon as I took the interface out of ahdemo mode and associated with my AP the messages started appearing on console.

Any idea why aireply isn't working?

Tom


----------



## richardpl (Jan 22, 2011)

Hmm, I forgot this completely. With ath(4) driver injection should worked in your first try (modified kernel). So it looks to me it is driver/chip bug. Try newer FreeBSD version.

FYI bwn(4) injection works just fine for me (with above mentioned patch for aircrack-ng).


----------



## chmmr (Sep 19, 2011)

*Wireless card messed up as well*

Hi,
first of all I'm sorry to dig this out of the dust but got the exact same situation here. And since this thread was the closest thing I came across and there doesn't seem to be any solution to this I decided to post anyway.

So similar story - playing with aircrack-ng suite on a FreeBSD 8.2-STABLE i386, rebuilt a week or so ago from latest sources, Intel based wireless card - bit short on features but that's what I got in this old laptop


```
wpi0: <Intel(R) PRO/Wireless 3945ABG> mem 0xd2100000-0xd2100fff irq 19 at device 0.0 on pci5
```

At first I couldn't get aireplay-ng work at all, then read here and there (ports post-install messages are actually our friends ) and put the wireless in *monitor* mode. While being able to run airodump-ng in this mode, aireplay-ng was a no-go (wi_write(): Input/output error). So I found this thread and following the advice here tried to put the wi-fi card in *ahdemo* mode which failed because it turned out the card doesn't support this mode (doh). So I quit trying on aircrack-ng but just like with tfwiii my wireless card got sort of messed up.

No matter what config I set on it, it just can't connect to anything and keeps spitting in the console


```
wpi0: fatal firmware error
```

It's not completely dead because I can do some basic stuff like scanning for networks for example (and if I set it in *monitor* mode still runs airodump-ng and captures) but can't hook it to any network, rendering it practically useless.

The wpi man page mentions this


```
[B]wpi%d: fatal firmware error[/B]  An unknown error has occurred in the
     uploaded firmware, you may have to unload/reload the driver to continue.
```

but sadly in this case this is not a solution - as soon as the kernel modules are reloaded the error message is on the console again.

The card used to work fine before this stunt and it can't have suffered any hardware damage as it still works perfectly under Windows (have dual boot on the machine).

Haven't tweaked or patched any sources, only played with ifconfig.

If anyone has ideas or surplus of curiosity I can provide extra info and diagnostics.

All input is much appreciated. Cheers.


----------



## Hategrin (Nov 21, 2011)

richardpl said:
			
		

> Did you noticed my patch for aircrack-ng in this same thread? Did you used it at all?
> 
> Without that patch aircrack-ng suite will fail to work.



That is very nice of you to supply code. However there are no instructions where or how to apply it.

I am trying to get aircrack to work tonight with little success...


`ifconfig wlan1 create wlandev urtw0 wlanmode ahdemo`

simply says

```
Operation not supported.
```


----------



## Radibor (Jun 27, 2012)

*Injection with ipw3945*

Hello,

I am using FreeBSD 9.0-RELEASE with an Intel Pro Wireless 3945ABG. I was able to get Kismet and Airodump running with the ipw3945 driver, but as already mentioned in this thread there is the 
	
	



```
wi_write(): Permission Denied
```
 problem when trying to run Aireplay. As the thread was mixing different chipset (Atheros with Intel) I'm not sure which (if any at all) patches are suitable to fix this problem for the ipw3945. As Hategrin wrote in the last post the ipw3945 does not support the wlanmode ahdemo.

So is there a way to get Aireplay working with the 3945ABG chip? There have been some posts in Linux forums using the ipwraw driver but when I downloaded the source and tried this one, make fails and I wasn't able to build it. Also there has been some info on a iwl3945 driver for Linux but I couldn't find any information about this one.

So does anyone have a solution on how to get injection working for the Intel Pro Wireless 3945?

Best regards.


----------

