[Galaxy S I9000 Android Development] n01ce:
PwnAir

WiFi monitor mode & AirCrack

ONLY for Galaxy S1 with any compatible ROM

"STABLE" RELEASE /* YOUR WARRANTY IS NOW VOID */

​

05/2014 [NEW] 1.03 TARGET-SCAN (airodump-ng) is now part of PwnAir Lite!

06/2014 [NEW] 1.05/1.06 Signal strength indication is now reported in TARGET-SCAN

07/2014 [NEW] 1.07 The app will try again if you fail to give superuser rights at first launch. Tested with several ROMs.

11/2014 [NEW] PwnAir Pro is now free! No ads. No trackers added.

PwnAir is a package (kernel + app) that will turn your Galaxy S1 phone into a WiFi cracking device.

* Enable WiFi monitor mode, like bcmon did

* Recover WEP and WPA-PSK keys, through AirCrack

* Capture WiFi traffic, through AirCrack too

I couldn't resist to put this reference to the Watch Dogs game.

What a better timing to launch PwnAir than Watch Dogs game release ? (PwnAir is not sponsored by Ubisoft, btw!)

What's new is that PwnAir intends to:

* port bcmon to recent ROMs/kernels. As you may have noticed, bcmon won't run on recent ROMs, except if you've built it yourself. That's normal.

* bring a new graphical user interface to bcmon app (LOAD)

* bring a new graphical user interface to airodump-ng (TARGET-SCAN)

* [Pro only] bring a new graphical user interface for the main AirCrack-ng command-line tools (TARGET-LOG, ATTACK, CRACK) with terminal scrolling optimizations

[more screenshots]

PRE-REQUISITES

* Your phone is a Galaxy S1 (galaxysmtd, GT-I9000). It is NOT going to work on S2/S3/S4, or any other phones that are using anything else than the Aries kernel, and especially anything else than a Broadcom 4329 WiFi chipset.

* You are using a KitKat ROM* (or you swear to do a kernel/NANDROID backup in case you're unsure). PwnAir Kernel has been tested on CyanogenMod v11 (best supported snapshot: cm-11-20140504-SNAPSHOT-M6-galaxysmtd.zip), CyanFox 2.0.2 (dead download link) and C-RoM v7.1.

* You have a custom recovery installed, like CWM or TWRP. I recommend CWM Philz Touch (philz_touch_6.19.3-galaxysmtd.img).

* You are not afraid of loosing your phone warranty and/or data, making your phone bootloop until you get to reflash it, and all those funny stuff that kernel/ROM flashers surprisingly enjoy.

*About KitKat ROM compatibility: To be more exact, you need a ROM compatible with CyanogenMod 11 kernel (a.k.a. Aries stable/cm11.0, this version is the KitKat release), which is generally the case of KitKat ROMs. It is possible that older non-KitKat ROM work also. There should be no reason your ROM is not compatible with PwnAir kernel, if you use a fairly recent ROM (ie. KitKat, i.e. 4.4) without strong kernel customizations. The risk as for any kernel is that some peripherals may not work or that the phone may bootloop until reflashed. On Linux/Android, the approach of flashing a full kernel is safer than forcing a Wi-Fi driver to load into an unknown kernel. For the compatibility paranoïds, you can use the indicated CyanogenMod ROM snapshot.

INSTALL INSTRUCTIONS

Download PwnAir Kernel zip file

Open PwnAir kernel zip archive with 7zip or similar zip tool

Download the monitor mode firmware: fw_bcm4329.bcmon.bin

Copy fw_bcm4329.bcmon.bin into the system/vendor/firmware folder of the PwnAir kernel zip file

Save the zip file

Transfer the zip file to your sdcard

Reboot your phone in Recovery Mode (from the menu, or power off and power on with Volume Up + Home + Power)

Do a NANDROID backup

or at least a quicker kernel backup

Flash the zip file from recovery mode

Reboot your phone

MONITOR MODE ACTIVATION & WHAT'S NEXT

The PwnAir Lite app has been installed during the process. Open it and "Load Monitor Mode".

First option, "Mode monitor" appears. -- You're happy.

So then, go to the target tab and launch a scan to see access points and clients ("stations") traffic.

Additional functions are part of the (free) Pro App or can be used with free Command Line Interface tools : Wireless Tools (mandatory) + Aircrack (see "sources" section, check "bin" folders).

Second option, an error message appears or you're stuck into a bootloop.

If an error message appears...

1. Post the error message here.

2. Connect your phone in USB debugging mode

3. Post the output of

adb shell su -c dmesg

4. Don't pay me a beer, I don't deserve it :(

If the error message when trying to flash is "This package is for "galaxys,galaxysmtd,GT-I9000,GT-I9000M,GT-I9000T" devices; this is a "". Status 7.", then you need to install CWM Philz Touch (philz_touch_6.19.3-galaxysmtd.img), which is a CWM Advanced Recovery, and try again to install PwnAir from Recovery Mode.

To install Philz Touch, go to Download Mode (not Recovery Mode) and run from your computer:

heimdall flash --KERNEL philz_touch_6.19.3-galaxysmtd.img

If you're stuck into a bootloop or frozen boot -- Don't cry, you're not alone, that happens.

First of all, remove the battery and reboot. Still in trouble?

Sometimes Often, CWM isn't working properly so re-flash the PwnAir kernel with Heimdall.

Connect your phone USB cable to your PC, put your phone in Download Mode (long press Volume Down + Home + Power), extract boot.img from the zip file and run from your PC command prompt:

heimdall flash --KERNEL boot.img

You can do this with ODIN if you prefer.

Still in trouble, again?

From Download Mode, flash your working ROM/Kernel boot.img the same way as described just before.

Or from Recovery Mode, restore your NANDROID backup or flash another working kernel or ROM.

DOWNLOADS :laugh: DOWNLOADS!

pwnair-no-firmware.zip: PwnAir Kernel+App flashable zip - Mirror: XDA Download - FIRMWARE NOT INCLUDED, GET FIRMWARE FROM THE LINK BELOW AND CHECK INSTALL INSTRUCTIONS!

fw_bcm4329.bcmon.bin: Bcmon monitor mode firmware for Broadcom 4329 WiFi chipset

[OPTIONAL] PwnAir Pro App For FREE, an easy-to-use graphical interface that implements Aircrack automated scan/attack/cracking tools on WEP and WPA networks (WPA: includes the 10k most commonly used password dictionnary). You can also download it from this thread Download section but in this case you need to install it manually (adb install or whatever).

KNOWN ISSUES

Unload was supposed to bring my normal WiFi back, not "kill" all the WiFi drivers! dmesg log will show some info about memory usage. From what I understand, the WiFi driver, especially the "normal" one (Mode: managed), is asking the kernel to reserve too much memory aligned space to store the wifi interface class. And the kernel, as a result of time and driver load/unload, is too much fragmented to satisfy this request. That's the strange way the Linux kernel works. So you just need to realign your kernel memory. So just "Reboot".

EDIT: NIK510 reported that clicking the Unload button and then running iwconfig eth0 power off and iwconfig eth0 power on in a terminal can bring your normal WiFi back without rebooting. Try your luck!

Having airodump-ng (SCAN) launched for a long time may cause the phone to freeze or reboot Well, for this, I've no idea. You know my answer: "Reboot". The hard way if necessary.

LIMITATIONS

PwnAir Lite App is limited to loading the monitor mode and scanning for networks. Get the (free) Pro version for attacks and cracking. Otherwise, if you like typing command-lines with MAC addresses on your touch phone, here's the deal: AirCrack is open source GNU GPL. That means you can get the CLI sources of the Android port directly on my repo and compile it or get the CLI binaries.

PwnAir is not compatible with Aircrack-ng-GUI, Reaver-WPS-GUI apps or any "normal" WiFi app. Either use the PwnAir Pro app or the free Wireless Tools binaries + Aircrack CLI binaries (see "sources" section). Try your luck with "Unload" but the only clean way to get your normal WiFi back is just to reboot your phone.

Not all possible WiFi attacks are implemented. Attack of hidden SSID, client attack (Caffe Latte) and client MAC spoofing need to be manually (CLI) performed. Get the aircrack-ng CLI tools from my repo if you want to perform such attacks. Like other client attacks, Hirte Attack is not implemented and it's possible that the driver doesn't support it anyway: Get a Caffe Latte instead, it's quite the same.

Q&A

Q: Can I use a custom dictionnary for WPA-PSK cracking?

A: Yes. See Tips about WPA dictionnary attacks

Q: Can I use Reaver command line or Reaver for Android (RfA) with this app?

A: Yes and no. There is no evidence that bcmon bcm4329 firmware (the one on Google Code or the one bundled with the bcmon app) can actually perform reaver-based attacks. If you managed to do it, contact me and I'll update the app with a RfA launch script.[/post]

SOURCES, CREDITS, BUILD INSTRUCTIONS, PRIVACY POLICY, SUPPORT...

[PWNED SOURCES]

I have ported all the CLI tools to Android/Aries/CM11:

AirCrack-ng suite for Android

Wireless Tools for Android

GNU Macchanger for Android

Airpcap Android static library for Aries (this recent version is needed for reaver-wps to work)

Reaver-WPS for Android (UNTESTED)

PwnAir Kernel (CM11 stable Aries with dual standard/bcmon WiFi drivers)

[UNPWNED SOURCES / CREDITS]

Adapted from Bcmon work

Android Terminal Emulator

Android Bootstrap

Java Installer's execpty

[BUILD INSTRUCTIONS FOR ADVENTUROUS USERS]

CLI executables: Use Cyanogenmod build system, check instructions in Android.mk and Aircrack for Android README file.

Detailed kernel build instructions/porting to other devices with broadcom 4329 chipset: check this post. In addition, to have the CLI executables bundled during the build: Use Cyanogenmod build system, copy manifest from build dir of PwnAir Kernel (bcmon_aries) repo to cyanogenmod .repo/local_manifests/, copy config file in kernel/samsung/aries/arch/arm/configs, init the repo, breakfast galaxysmtd and build (check my wiki section "How to (edit and) build an officially supported kernel?" on CM integrated kernel building wiki page for kernel building).

[PRIVACY POLICY]

This app doesn't leak your private information. The code doesn't use any ads or tracker libraries. Root permissions are only used to provide the described functionalities.

Note that if you are downloading through the Google Play Store, general statistics are collected by Google (number of installs, user country, crash log, etc.): refer to Play Store privacy policy. As seens from the Android Developer Console and not from Google eyes, there's nothing like private data, even the crash logs look like this: java.lang.NullPointerException at a.a.a.r.run(Unknown Source). (nothing more and in this case it needs to be un-ProGuard-ed).

On you side, by using this app, you agree not to use it to leak private information without consent.

[SUPPORT]

Support is done in this thread preferably. If you don't have posting rights, send me a PM.

Bug reports and feature requests are also managed in this thread: see the tabs in the XDA DevDB dark bar above this post.

If you like the Pro app, please leave a comment on the Play Store page.

It's not a good idea to use Play Store contact link, I don't check it often.

Issues clearly specific to CLI tools source code (except Reaver) can be raised as GitHub issues.

XDA:DevDB Information

[GALAXYSMTD][KERNEL]+[APP] [PRO FREE] PwnAir WiFi monitor mode, Kernel for the Samsung GT-I9000 Galaxy S

Contributors

n01ce

Source Code: https://github.com/kriswebdev/bcmon_aries

Kernel Special Features: wifi monitor mode, cm11

Version Information

Status: Stable

Current Stable Version: 1.07

Stable Release Date: 2014-06-22

Beta Release Date: 2014-05-30

Created 2014-05-22

Last Updated 2016-01-23