1
0

cfuzz.c 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266
  1. /*
  2. This is the main file. It handles sending, receiving, but also monitoring of frames.
  3. */
  4. #include <stdio.h>
  5. #include <pcap.h>
  6. #include <stdlib.h>
  7. #include <stdint.h>
  8. #include <string.h>
  9. #include <sys/time.h>
  10. #include "cfuzz.h"
  11. #include "frameCreator.h"
  12. #include "frameDefinitions.h"
  13. #include "fuzzer.h"
  14. #define DEBUG (0)
  15. #define SUTTIMEOUTMS (30000) //30s
  16. //Used for timing
  17. struct timeval tm1;
  18. struct timeval longtm;
  19. //Number of acked frames in current step
  20. int ackedFrames = 0;
  21. //Copied from Wireshark
  22. u_char radioTapHeader[36] = "\x00\x00\x24\x00\x2f\x40\x00\xa0\x20\x08\x00\x00\x00\x00\x00\x00" \
  23. "\x9d\x5c\xa0\x15\x01\x00\x00\x00\x10\x02\x6c\x09\xa0\x00\xa7\x00" \
  24. "\x00\x00\xa7\x00";
  25. //Mac address of Atheros Wi-Fi dongle
  26. //Dongle will only ACK frames to its own MAC address
  27. u_char myMAC[6] = "\x00\x0a\xeb\x2d\x72\x55";
  28. //Mac address of SUT
  29. //Is needed to ignore frames from other devices
  30. /*List of MACs for test devices:
  31. - d0:17:6a:e8:e9:7a Samsung Galaxy Ace
  32. - xx:xx:xx:xx:xx:xx Chromecast 1
  33. - ec:9b:f3:1e:19:71 Samsung Galaxy S6
  34. - cc:fa:00:c9:fc:ad LG Optimus G
  35. - 12:42:2a:7e:d4:e8 Orange Pi Zero
  36. */
  37. //Comment out the SUT
  38. //u_char sutMAC[6] = "\xec\x9b\xf3\x1e\x19\x71"; //Galaxy S6
  39. //u_char sutMAC[6] = "\xcc\xfa\x00\xc9\xfc\xad"; //LG Optimus G
  40. //u_char sutMAC[6] = "\xd0\x17\x6a\xe8\xe9\x7a"; //Galaxy Ace
  41. //u_char sutMAC[6] = "\x12\x42\x2a\x7e\xd4\xe8"; //Orange Pi Zero
  42. //u_char sutMAC[6] = "\xe0\xe7\x51\x45\x5e\x5d"; //DSI XL
  43. u_char sutMAC[6] = "\xe0\xe7\x51\x45\x5e\x5d"; //DSI XL
  44. //Returns filter for libpcap
  45. //we want to use as many filters here as possible, since libpcap is closer to the hardware than this user-level program
  46. //we only want to receive Probe requests, Authentication frames and Association requests, all to only our own MAC address or broadcast address in case of Probe requests
  47. //furthermore, all frames except ACK frames (have no send address) should be sent from the SUT MAC address
  48. //also, it is important not to compile and set the filter between each pcap_next. Otherwise ACK frames will be missed
  49. //when changing the filterString, the strncpy() locations should also be changed!
  50. const char *getFilterString()
  51. {
  52. static char filterString[] = "wlan addr2 e0:e7:51:45:5e:5d";
  53. return filterString;
  54. }
  55. //Starts timer by setting current (starting) time to tm1
  56. void startTimer()
  57. {
  58. gettimeofday(&tm1, NULL);
  59. }
  60. //Stops timer by setting current (ending) time to tm2
  61. //Then compares difference in time and returns it in milliseconds
  62. unsigned long long stopTimer()
  63. {
  64. struct timeval tm2;
  65. gettimeofday(&tm2, NULL);
  66. unsigned long long t = 1000 * (tm2.tv_sec - tm1.tv_sec) + (tm2.tv_usec - tm1.tv_usec) / 1000;
  67. return t;
  68. }
  69. //Starts timer by setting current (starting) time to longtm
  70. //Longtimer is used to determine if it was more than X seconds since the SUT sent out frames
  71. void startLongTimer()
  72. {
  73. gettimeofday(&longtm, NULL);
  74. }
  75. //Stops timer by setting current (ending) time to longtm2
  76. //Then compares difference in time and returns it in milliseconds
  77. unsigned long long stopLongTimer()
  78. {
  79. struct timeval longtm2;
  80. gettimeofday(&longtm2, NULL);
  81. unsigned long long t = 1000 * (longtm2.tv_sec - longtm.tv_sec) + (longtm2.tv_usec - longtm.tv_usec) / 1000;
  82. return t;
  83. }
  84. //Returns source address pointer location in packet
  85. u_char *getSourceAddrOfPacket(const u_char *packet)
  86. {
  87. //get header length
  88. u_char headerLength;
  89. headerLength = packet[2];
  90. //calculate offset to address
  91. const u_char *addr;
  92. int offset = headerLength;
  93. offset = offset + 10;
  94. //get pointer to address
  95. addr = packet + offset;
  96. return (u_char*) addr;
  97. }
  98. //Returns Version, Type and Subtype (one byte)
  99. u_char getFrameTypeOfPacket(const u_char *packet)
  100. {
  101. //get header length
  102. u_char headerLength;
  103. headerLength = packet[2];
  104. //calculate offset to frame type
  105. const u_char *frameType;
  106. int offset = headerLength;
  107. offset = offset + 0;
  108. //get pointer to frameType
  109. frameType = packet + offset;
  110. return *frameType;
  111. }
  112. //Sends packet using pcap. Returns status
  113. int sendPacket(pcap_t *pcap_h, u_char *packet, int size)
  114. {
  115. int sendStatus = pcap_sendpacket(pcap_h, packet, size);
  116. //when frame failed to send
  117. if (sendStatus == 1)
  118. {
  119. printf("Failed to send frame:\n");
  120. //print failed frame
  121. int printCounter = 0;
  122. for(int i = 0; i < size; i++)
  123. {
  124. printf("%02X ", packet[i]);
  125. printCounter = printCounter + 1;
  126. if (printCounter == 16)
  127. {
  128. printCounter = 0;
  129. printf("\n");
  130. }
  131. }
  132. printf("\n");
  133. }
  134. return sendStatus;
  135. }
  136. int main(int argc, char *argv[])
  137. {
  138. pcap_t *pcap_h;
  139. struct bpf_program fp;
  140. struct pcap_pkthdr header;
  141. char *dev;
  142. char errbuf[PCAP_ERRBUF_SIZE];
  143. //check argument number
  144. if(argc != 2)
  145. {
  146. printf("Usage: %s device\n", argv[0]);
  147. exit(EXIT_FAILURE);
  148. }
  149. dev = argv[1];
  150. //initialize libpcap
  151. if((pcap_h = pcap_create(dev, errbuf)) == NULL)
  152. {
  153. printf("pcap_create() failed: %s\n", errbuf);
  154. exit(EXIT_FAILURE);
  155. }
  156. if(pcap_can_set_rfmon(pcap_h) == 0)
  157. {
  158. printf("Monitor mode can not be set.\n");
  159. exit(EXIT_FAILURE);
  160. }
  161. if(pcap_set_rfmon(pcap_h, 1) != 0)
  162. {
  163. printf("Failed to set monitor mode.\n");
  164. exit(EXIT_FAILURE);
  165. }
  166. if(pcap_activate(pcap_h) != 0)
  167. {
  168. printf("pcap_activate() failed\n");
  169. exit(EXIT_FAILURE);
  170. }
  171. //compile filter for incoming packets
  172. if(pcap_compile(pcap_h, &fp, getFilterString() , 0, PCAP_NETMASK_UNKNOWN) == -1)
  173. {
  174. printf("failed pcap_compile() with error: %s\n", pcap_geterr(pcap_h));
  175. exit(EXIT_FAILURE);
  176. }
  177. //apply filter
  178. if(pcap_setfilter(pcap_h, &fp) == -1)
  179. {
  180. printf("failed pcap_setfilter() with error: %s\n", pcap_geterr(pcap_h));
  181. exit(EXIT_FAILURE);
  182. }
  183. //free memory allocated by pcap_compile()
  184. pcap_freecode(&fp);
  185. //flag to indicate if we have to listen for ACK verification
  186. int waitForACK = 0;
  187. //counter for continuous ACK fail
  188. int noACKcounter = 0;
  189. //start long timer
  190. startLongTimer();
  191. //infinite listen-respond loop
  192. while (1)
  193. {
  194. //receive packet
  195. const u_char *rpacket = pcap_next(pcap_h, &header);
  196. printf("Received Frame\n");
  197. int packetSize;
  198. u_char *packet = createProbeResponse(sutMAC, &packetSize, radioTapHeader, myMAC);
  199. sendPacket(pcap_h, packet, packetSize);
  200. free(packet); //free allocated memory
  201. printf("Sent frame:\n");
  202. //print failed frame
  203. int printCounter = 0;
  204. for(int i = 0; i < packetSize; i++)
  205. {
  206. printf("%02X ", packet[i]);
  207. printCounter = printCounter + 1;
  208. if (printCounter == 16)
  209. {
  210. printCounter = 0;
  211. printf("\n");
  212. }
  213. }
  214. printf("\n");
  215. increaseFuzzer();
  216. }
  217. return 0;
  218. }