[Galaxy S I9000 Android Development] n01ce:
Experimental run on CM11 kernel

Fiiiiinally I got bcm4329 driver + firmware, airodump and aircrack-ng (self-compiled, not GUI) running in monitor mode above a CyanogenMod 11 Aries (i.e. Samsung Galaxy S1) kernel.

That was painful.

What I've learned:

Don't try to use bcmdhd firmware from bcmon apk content. It generates at least a bus clock sync issue, if not a kernel panic, even when used with a recent bcmdhd driver version with bcmon port. However I've not tried with the firmware file in the source package if different, but that's too late.

Don't try to use any of the bcmdhd/bcm4329 from the apk package. Just don't un7zip it. bcm4329 fw file is not the same than the file in bcmon source.

Indeed use fw_bcm4329.bcmon.bin from the source fw dir. Put it in /vendor/firmware (you may need to adb root and adb remount your device before adb push'ing the file).

Forget about cracking new firmware files if yo'ure not a cracking expert: ARM decompilers are expensive, ARM binaries includes code in thumb mode, that is complex to separate from standard ARM code and from data/function tables. bcmon developers didn't publish their C source file they injected into the firmware and that's a pain. And so on. That's pointless to publish firmware patching tools but not the firmware patch code itself. Firmware cracking steps are unusably "documented" on bcmon presentation.

Creating debug dump files from kernel modules is painful but possible, as you have to use lower level file handling (and everybody will say that's bad). Hopefully, that's not necessary anymore. For those interested,the best place to dump is on dhd_linux.c after bcmon_decode() and skb == 0 test: pcap_dump(skb->data, skb->len). But writing a pcap parser and kernel file handling is no easy way.

If you don't see any traffic on channel 15 (test channel used by bcmon patched firmware to transport monitored frames) coming from the broadcom chipset, that means you are using the wrong firmware.

Say goodbye to CONFIG_CFG80211 kernel flag (and to an usable wifi driver by the way).

Say hi to all old CONFIG_WIRELESS* CONFIG_WEXT* kernel flags (except CONFIG_WIRELESS_EXT_SYSFS - not required). Don't change the "select" flags in bcm4329 Kconfig file or the compiler will forget about it when checking the #ifdef statements.

Working kernel config (cyanogenmod_galaxysmtd_defconfig):

CONFIG_BCMDHD=m
CONFIG_BCMDHD_FW_PATH="/vendor/firmware/fw_bcmdhd.bin"
CONFIG_BCMDHD_NVRAM_PATH="/vendor/firmware/nvram_net.txt"
CONFIG_CFG80211=y
CONFIG_NL80211_TESTMODE=y
# CONFIG_CFG80211_WEXT is not set
CONFIG_CFG80211_ALLOW_RECONNECT=y

CONFIG_BCM4329=m
CONFIG_BCM4329_FW_PATH="/vendor/firmware/fw_bcm4329.bcmon.bin"
CONFIG_BCM4329_NVRAM_PATH="/vendor/firmware/nvram_net.txt"
CONFIG_WIRELESS=y
CONFIG_WIRELESS_EXT=y
CONFIG_WEXT_CORE=y
CONFIG_WEXT_PROC=y
CONFIG_WEXT_SPY=y
CONFIG_WEXT_PRIV=y

Compile and "installboot" the whole kernel from the cyanogenmod full source build system, with the bcm4329 directory extracted from bcmon source (replace CyanogenMod bcm4329 folder with the one from bcmon source in CyanogenMod kernel/samsung/aries/drivers/net/wireless)

Forget about aircrack-ng-GUI, that's not meant to work without bcmon apk (except with legacy mode: strange and requires a chrooted unbuntu - forget about it)

Compile your own aircrack-ng suite with by creating (painfully) an android.mk (see the one for airodump), using cyanogenmod build system (put the source dir in cyanogen root /external) and specify the shared and static libraries dependencies, that are usually within cyanogenmod source. I will post the full Android.mk later. Note that most aircrack tools coming from bcmon (static or not) don't work. They may be compiled for chrooted unbuntu, not android?

Copy tcpdump, iwconfig and iwmulticall from bcmon utils/misc folder to your device /system/xbin folder.

Create a symbolic link for iwpriv to be recognized on your device: ln -s /system/xbin/iwmulticall /system/xbin/iwpriv

Manually turn on wireless: svc wifi disable, ifconfig wlan0 down, rmmod bcmdhd, insmod /system/lib/modules/bcm4329.ko (this should be the kernel-specific compiled bcmon driver, forget about firmware_path, you should define it in your kernel config) then ifconfig eth0 up, and check that the driver is loaded with lsmod and that it appears as managed with iwconfig eth0.

There's no need to LD_PRELOAD the fake driver library as you've compiled the WiFi driver (and it works after a reboot without this command).I start to understand the purpose of this command: The presentation says that by running aircrack suite with LD_PRELOAD, "when the utility will try to find out the network interface’s Hardware Address, we are going to return “It’s a 802.11 Radiotap device!” And when it will try to check it’s mode – we are going to return “Hey! It’s in monitor mode!”". That mean there's theorically no need to patch the kernel wifi driver, and thus no need to patch the kernel! But we can't in our context: as we run on a kernel with bcmdhd "official" driver and not bcm4329 "official" driver, we can't avoid adding a bcm4329 driver that is absent in the CM11 Aries kernel. Unfortunately the bcm4329 patched firmware is not compatible with the "official" bcmdhd driver. The solution would be to develop a patched bcmdhd firmware for 4329 chipset. But that's out of my competencies (see above).

airodump-ng is not compatible with adb shell. Run from the android "terminal emulator" app prompt or use my fixed adb shell terminal size patch.

airodump-ng is not compatible with... android, in its current source form. Apply this other iwpriv patch.

EDIT:

I've compiled most of the aircrack suite with Android NDK (and not chrooted Unbuntu). Injection is working. Acess Point ARP Replay attack and client Caffe Latte attack are working. Hirte attack is not working, maybe because of the driver ability to fragment packets.

I'll post detailed instruction and maybe precompiled files when I'll be over with the aircrack tool suite.

As of now, I discourage you to follow this build process with this level of instructions, some details may be missing leading to a non-working solution.

EDIT2:

RESULTING COMPILED KERNEL+APP AND SOURCES ARE HERE: PWNAIR