[Hero, G2 Touch Android Development] blackplatypus:
Hi,

Motivated by zewelor´s thread about injection support for the G1, I decided to create an equal one for our beloved Hero :).

The attached kernel is Flykernel 13 by erasmux with patched compat wireless kernel modules, using the injection patches from David and Bobs msm_wifi patch. Thanks to zewelor for the prepatched sources. This means the kernel supports packet injection and monitor mode, so you can inject packets with aireplay-ng or capture them with kismet/aircrack and so on.

ALWAYS MAKE A NANDROID BACKUP!

What do you need?

Instructions:

Known Issues/Bugs

For Devs:

89fc9c7fd97dab56d3220e93dea77d63 kernel-config_2.6.29.zip

e03c0a22bcb5425f1b301f463ea87490 injection_FlyKernel-13.zip

8009fa3c70211aaa329a6456eb0af6c8 iwconfig-static.zip

14b1866cc2b60ddbc1b565dab4a219d8 injection_scripts.zip

Yes the scripts are very dirty, but hey they work! ;)

start-inject.sh: http://pastebin.com/MDKc2WJm

stop-inject.sh: http://pastebin.com/UuX83CBD

kernel config 2.6.29: http://pastebin.com/8ASmEAgN

ATTENTION!

If you want to set the interface into monitor mode without a linux image, push the attached (static compiled) iwconfig to /data/local/bin and execute "/data/local/bin/iwconfig wlan0 mode monitor" or uncomment the line in both shell scripts, of course you can copy the binary in any directory you like.

Action Time:

$adb shell
# sh start-inject.sh
[x] Injection startup
[x] Firmware/calibration file found
[+] Load injection modules
[+] Start wlan0 interface
wlan0 should be up and running :)
lo UP 127.0.0.1 255.0.0.0 0x00000049
dummy0 DOWN 0.0.0.0 0.0.0.0 0x00000082
rmnet0 UP 2.45.243.195 255.255.255.248 0x00001043
rmnet1 DOWN 0.0.0.0 0.0.0.0 0x00001002
rmnet2 DOWN 0.0.0.0 0.0.0.0 0x00001002
usb0 DOWN 0.0.0.0 0.0.0.0 0x00001002
wlan0 UP 0.0.0.0 0.0.0.0 0x00001003

# debian [B][I](I'm using lil´debian this command starts the chroot script)[/I][/B]
root@localhost:/# ifconfig wlan0 down [B][I](In order to set monitor mode you most shutdown the interface or edit the injection script to start iwconfig)[/I][/B]
root@localhost:/# iwconfig wlan0 mode monitor
root@localhost:/# ifconfig wlan0 up
root@localhost:/# iwconfig wlan0
wlan0 IEEE 802.11bg Mode:Monitor Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Power Management:on

root@localhost:/# aireplay-ng --test wlan0
15:27:09 Trying broadcast probe requests...
15:27:13 Injection is working!
15:27:13 Found 1 AP

15:27:13 Trying directed probe requests...
15:27:13 E0:91:F5:XX:XX:XX - channel: 4 - 'XX_G'
15:27:43 Ping (min/avg/max): 982.727ms/993.888ms/1001.832ms Power: -70.16
15:27:43 19/30: 63%

root@localhost:/# exit
logout

# sh stop-inject.sh
[x] Stop Injection
[-] Stop wlan0 interface
[-] Unload injection modules
[+] Load wlan.ko module
[+] Load Firmware
[+] Start tiwlan0 interface
tiwlan0 should be up and running :)
lo UP 127.0.0.1 255.0.0.0 0x00000049
dummy0 DOWN 0.0.0.0 0.0.0.0 0x00000082
rmnet0 UP 2.45.243.195 255.255.255.248 0x00001043
rmnet1 DOWN 0.0.0.0 0.0.0.0 0x00001002
rmnet2 DOWN 0.0.0.0 0.0.0.0 0x00001002
usb0 DOWN 0.0.0.0 0.0.0.0 0x00001002
tiwlan0 UP 0.0.0.0 0.0.0.0 0x00001043

[B][I]Now enable wifi in android![/I][/B]

Remember these are not my patches, I only provide the patched kernel/kernel modules and loading scripts! Regarding the functionality and stability, Take it or leave it!, I have not the time and skill to make real modifications to the kernel module code to fix or improve stuff. You are free and welcome to post any progress you made.