[Android Software/Hacking General [Developers Only]] n01ce:
WiFi monitor mode kernel building steps

Hi.

I've developed a Wi-Fi monitor Kernel+App for the Galaxy S1 (and ONLY for this) ==> PwnAir thread. You'll also find all the compiled wireless extensions tools and aircrack CLI on the sources section.

For those who want to port the wifi monitor mode kernel to other devices

THAT HAVE A BROADCOM 4329 CHIPSET

, you will need to build your own kernel. It's required since kernel wireless extensions are generally disabled in recent ROMs, in profit of bcmdhd and cfg80211 drivers. And that's not compatible with bcmon bcm4329 firmware/driver.

These are instructions to build a CyanogenMod 11 bcm4329 wifi monitor mode kernel. This kernel may (or may not!) work with non-CyanogenMod ROM. But you can adapt those instructions to compile your own ROM's kernel (except that CM build system provides useful tools to automate the build and install the kernel).

Prepare the CyanogenMod build environment on Linux. Check this kernel build guide section "Building only the Kernel from the full CyanogenMod source". It starts with your device build guide (until and before you brunch). Beware your disk space, that's ~20GB of sources + binaries.

BELOW IS THE EXAMPLE COMMANDS for galaxysmtd, building on a Unbuntu x64

. This will vary for other phones/OS so check the ROM build/kernel build guide directly.

sudo apt-get install android-tools-adb
sudo apt-get install android-tools-fastboot
sudo apt-get install bison build-essential curl flex git gnupg gperf libesd0-dev libncurses5-dev libsdl1.2-dev libwxgtk2.8-dev libxml2 libxml2-utils lzop openjdk-6-jdk openjdk-6-jre phablet-tools pngcrush schedtool squashfs-tools xsltproc zip zlib1g-dev
sudo apt-get install g++-multilib gcc-multilib lib32ncurses5-dev lib32readline-gplv2-dev lib32z1-dev
mkdir -p ~/bin
mkdir -p ~/android/system
cd ~/android/system/
repo init -u git://github.com/CyanogenMod/android.git -b stable/cm-11.0
repo sync

Connect your device in USB debugging mode and run (BEWARE: galaxysmtd below means it's for Samsung Galaxy S1!).

cd ~/android/system/vendor/cm
./get-prebuilts
source build/envsetup.sh
breakfast galaxysmtd
cd ~/android/system/device/samsung/galaxysmtd
./extract-files.sh
export USE_CCACHE=1
croot

Check your Java version. You should use SUN JDK 6. Check this tuto Java section for Howto (don't follow the rest of the tutorial, it's made for CM10). Check with:

java -version

Download my updated bcmon driver (bcm4329 folder)

mkdir -p ~/android/monitor
cd ~/android/monitor
git clone [url]https://github.com/kriswebdev/bcmon_aries.git[/url]

Among other small differences with the original bcmon driver, there's a compatibility patch to use enable_irq_wake instead of set_irq_wake (no more supported).

Overwrite bcm4329 folder in CM source with the one downloaded above. Location to overwrite: kernel/samsung/aries/drivers/net/wireless/bcm4329

Put bcmon fw_bcm4329.bcmon.bin in your device firmware path (assumption here: /system/vendor/firmware/)

adb root
adb remount
adb push fw_bcm4329.bcmon.bin /system/vendor/firmware/

Open your device configuration file in the CM source (eg. for samsung galaxysmtd: kernel/vendor-name/kernel-name/arch/arm/configs/cyanogenmod_galaxysmtd_defconfig) and enable those options (add at this at the end of the file):

CONFIG_BCM4329=m
CONFIG_BCM4329_FW_PATH="/vendor/firmware/fw_bcm4329.bcmon.bin"
CONFIG_BCM4329_NVRAM_PATH="/vendor/firmware/nvram_net.txt"
CONFIG_WIRELESS=y
CONFIG_WIRELESS_EXT=y
CONFIG_WEXT_CORE=y
CONFIG_WEXT_PROC=y
CONFIG_WEXT_SPY=y
CONFIG_WEXT_PRIV=y

Build and install the kernel as described in this kernel build guide *YOU NEED TO HAVE A COMPATIBLE ROM, OTHERWISE BUILD THE FULL ROM*

cd ~/android/system/
mka bootimage
adb root
adb remount
installboot
adb reboot

Note: In case you need it, don't use Heimdall inside a VM.