ASSieid.c 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189
  1. /*
  2. Fuzzes AssResp by testing all 256 IEs on overflow in four ways
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include <math.h>
  9. #include "../frameDefinitions.h"
  10. //Creates Probe response frame
  11. u_char *Assieid(u_char *dstAddress, int *packetSize, u_char * radioTapHeader, u_char *myMAC, int step)
  12. {
  13. #define AssieidIES (2) //number of information elements
  14. infoElem suppRates = {
  15. 1, //id
  16. 7, //len
  17. 7, //real length of data
  18. "\x96\x18\x24\x30\x48\x60\x6c" //data
  19. };
  20. infoElem fuzzIE;
  21. switch(step % 4)
  22. {
  23. case 0:
  24. {
  25. fuzzIE.id = step/4;
  26. fuzzIE.len = 255;
  27. fuzzIE.len_data = 255;
  28. //create data of 255 times 0xff
  29. u_char *data = malloc(255);
  30. memset(data, 0xff, 255);
  31. fuzzIE.data = data;
  32. break;
  33. }
  34. case 1:
  35. {
  36. fuzzIE.id = step/4;
  37. fuzzIE.len = 0;
  38. fuzzIE.len_data = 0;
  39. fuzzIE.data = "";
  40. break;
  41. }
  42. case 2:
  43. {
  44. fuzzIE.id = step/4;
  45. fuzzIE.len = 253;
  46. fuzzIE.len_data = 253;
  47. //create data of 253 times 0xff
  48. u_char *data = malloc(253);
  49. memset(data, 0xff, 253);
  50. fuzzIE.data = data;
  51. break;
  52. }
  53. case 3:
  54. {
  55. fuzzIE.id = step/4;
  56. fuzzIE.len = 255;
  57. fuzzIE.len_data = 255;
  58. //create data of 255 times 0x00
  59. u_char *data = malloc(255);
  60. memset(data, 0x00, 255);
  61. fuzzIE.data = data;
  62. break;
  63. }
  64. }
  65. //create array of information elements
  66. infoElem taggedParams[AssieidIES] = {suppRates, fuzzIE};
  67. //length of all info elements, including id and len field
  68. int len_taggedParams = 0;
  69. for(int i = 0; i < AssieidIES; i++)
  70. {
  71. if (taggedParams[i].len_data != -1) //do not include when len_data == -1
  72. {
  73. //+2 to include id and len field size
  74. len_taggedParams = len_taggedParams + taggedParams[i].len_data+2;
  75. }
  76. }
  77. //fill in struct
  78. assResponse assResp = {
  79. 36, radioTapHeader, //RadioTap hdr
  80. 1, "\x10", //Type
  81. 1, "\x00", //Flags
  82. 2, "\x40\x01", //Duration
  83. 6, dstAddress, //DST addr
  84. 6, myMAC, //Source addr
  85. 6, myMAC, //BSS addr
  86. 2, "\x00\x00", //Seq nr (overwritten by firmware)
  87. 2, "\x01\x00", //Capab info
  88. 2, "\x00\x00", //Status code
  89. 2, "\x01\xc0", //Association id
  90. len_taggedParams,
  91. taggedParams, //Information elements
  92. 4, "\x00\x00\x00\x00" //FSC (overwritten by firmware)
  93. };
  94. //calculate size of final packet
  95. *packetSize = assResp.len_radioTapHdr
  96. + assResp.len_type
  97. + assResp.len_flags
  98. + assResp.len_duration
  99. + assResp.len_destAddr
  100. + assResp.len_sourceAddr
  101. + assResp.len_bssAddr
  102. + assResp.len_seqNr
  103. + assResp.len_capabInfo
  104. + assResp.len_status
  105. + assResp.len_assId
  106. + assResp.len_taggedParams
  107. + assResp.len_fsc;
  108. //define packet
  109. u_char *assRespPacket = malloc(*packetSize);
  110. if(!assRespPacket)
  111. {
  112. printf("Memory allocation error!\n");
  113. exit(-1);
  114. }
  115. //copy all struct fields into packet
  116. int copyOffset = 0;
  117. memcpy(assRespPacket + copyOffset, assResp.radioTapHdr, assResp.len_radioTapHdr);
  118. copyOffset = copyOffset + assResp.len_radioTapHdr;
  119. memcpy(assRespPacket + copyOffset, assResp.type, assResp.len_type);
  120. copyOffset = copyOffset + assResp.len_type;
  121. memcpy(assRespPacket + copyOffset, assResp.flags, assResp.len_flags);
  122. copyOffset = copyOffset + assResp.len_flags;
  123. memcpy(assRespPacket + copyOffset, assResp.duration, assResp.len_duration);
  124. copyOffset = copyOffset + assResp.len_duration;
  125. memcpy(assRespPacket + copyOffset, assResp.destAddr, assResp.len_destAddr);
  126. copyOffset = copyOffset + assResp.len_destAddr;
  127. memcpy(assRespPacket + copyOffset, assResp.sourceAddr, assResp.len_sourceAddr);
  128. copyOffset = copyOffset + assResp.len_sourceAddr;
  129. memcpy(assRespPacket + copyOffset, assResp.bssAddr, assResp.len_bssAddr);
  130. copyOffset = copyOffset + assResp.len_bssAddr;
  131. memcpy(assRespPacket + copyOffset, assResp.seqNr, assResp.len_seqNr);
  132. copyOffset = copyOffset + assResp.len_seqNr;
  133. memcpy(assRespPacket + copyOffset, assResp.capabInfo, assResp.len_capabInfo);
  134. copyOffset = copyOffset + assResp.len_capabInfo;
  135. memcpy(assRespPacket + copyOffset, assResp.status, assResp.len_status);
  136. copyOffset = copyOffset + assResp.len_status;
  137. memcpy(assRespPacket + copyOffset, assResp.assId, assResp.len_assId);
  138. copyOffset = copyOffset + assResp.len_assId;
  139. //copy all information elements
  140. for(int i = 0; i < AssieidIES; i++)
  141. {
  142. if (taggedParams[i].len_data != -1) //if id == -1, we do not want to include the information element
  143. {
  144. memcpy(assRespPacket + copyOffset, &taggedParams[i].id, 1);
  145. copyOffset = copyOffset + 1;
  146. memcpy(assRespPacket + copyOffset, &taggedParams[i].len, 1);
  147. copyOffset = copyOffset + 1;
  148. memcpy(assRespPacket + copyOffset, taggedParams[i].data, taggedParams[i].len_data);
  149. copyOffset = copyOffset + taggedParams[i].len_data;
  150. }
  151. }
  152. memcpy(assRespPacket + copyOffset, assResp.fsc, assResp.len_fsc);
  153. copyOffset = copyOffset + assResp.len_fsc;
  154. //send packet
  155. return assRespPacket;
  156. }