1
0

cfuzz.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407
  1. /*
  2. This is the main file. It handles sending, receiving, but also monitoring of frames.
  3. */
  4. #include <stdio.h>
  5. #include <pcap.h>
  6. #include <stdlib.h>
  7. #include <stdint.h>
  8. #include <string.h>
  9. #include <sys/time.h>
  10. #include "cfuzz.h"
  11. #include "frameCreator.h"
  12. #include "frameDefinitions.h"
  13. #include "fuzzer.h"
  14. #define DEBUG (0)
  15. #define SUTTIMEOUTMS (30000) //30s
  16. #define NUMBEROFCONFIRMS (1) //number of extra confirms after the first confirm before moving on to the next frame
  17. //Used for timing
  18. struct timeval tm1;
  19. struct timeval longtm;
  20. //Number of acked frames in current step
  21. int ackedFrames = 0;
  22. //Copied from Wireshark
  23. u_char radioTapHeader[36] = "\x00\x00\x24\x00\x2f\x40\x00\xa0\x20\x08\x00\x00\x00\x00\x00\x00" \
  24. "\x9d\x5c\xa0\x15\x01\x00\x00\x00\x10\x02\x6c\x09\xa0\x00\xa7\x00" \
  25. "\x00\x00\xa7\x00";
  26. //Mac address of Atheros Wi-Fi dongle
  27. //Dongle will only ACK frames to its own MAC address
  28. u_char myMAC[6] = "\x00\x0a\xeb\x2d\x72\x55";
  29. //Mac address of SUT
  30. //Is needed to ignore frames from other devices
  31. //Comment out the SUT
  32. //u_char sutMAC[6] = "\xec\x9b\xf3\x1e\x19\x71"; //Galaxy S6
  33. //u_char sutMAC[6] = "\xcc\xfa\x00\xc9\xfc\xad"; //LG Optimus G
  34. //u_char sutMAC[6] = "\xd0\x17\x6a\xe8\xe9\x7a"; //Galaxy Ace
  35. //u_char sutMAC[6] = "\x12\x42\x2a\x7e\xd4\xe8"; //Orange Pi Zero
  36. //u_char sutMAC[6] = "\x00\x09\xbf\x7d\x6d\xaa"; //Nintendo DS
  37. //u_char sutMAC[6] = "\x00\x01\x4a\x93\xce\x34"; //PSP
  38. u_char sutMAC[6] = "\xe0\xe7\x51\x45\x5e\x5d"; //DSI
  39. //u_char sutMAC[6] = "\x9c\xe6\x35\x2a\x69\x16"; //WII U
  40. //u_char sutMAC[6] = "\x6c\xad\xf8\xc8\x77\xca"; //Chromecast 1
  41. //u_char sutMAC[6] = "\xb8\x27\xeb\xf1\x89\x68"; //RPI 3
  42. //u_char sutMAC[6] = "\x84\x00\xd2\xe0\x81\xb2"; //Xperia Ray
  43. //u_char sutMAC[6] = "\x54\x60\x09\xf8\xbe\x28"; //Chromecast Audio
  44. //u_char sutMAC[6] = "\x80\x7d\x3a\x73\x81\xc7"; //Power plug
  45. //Returns filter for libpcap
  46. //we want to use as many filters here as possible, since libpcap is closer to the hardware than this user-level program
  47. //we only want to receive Probe requests, Authentication frames and Association requests, all to only our own MAC address or broadcast address in case of Probe requests
  48. //furthermore, all frames except ACK frames (have no send address) should be sent from the SUT MAC address
  49. //also, it is important not to compile and set the filter between each pcap_next. Otherwise ACK frames will be missed
  50. //when changing the filterString, the strncpy() locations should also be changed!
  51. const char *getFilterString()
  52. {
  53. //xx:xx:xx:xx:xx:xx will become myMAC, yy:yy:yy:yy:yy:yy will become sutMAC
  54. static char filterString[] = "(wlan subtype probe-req and (wlan addr1 xx:xx:xx:xx:xx:xx or wlan addr1 ff:ff:ff:ff:ff:ff) and wlan addr2 yy:yy:yy:yy:yy:yy)" \
  55. " or ( wlan addr1 xx:xx:xx:xx:xx:xx and wlan addr2 yy:yy:yy:yy:yy:yy and ( wlan subtype auth or wlan subtype assoc-req))" \
  56. " or ( wlan addr1 xx:xx:xx:xx:xx:xx and wlan subtype ack)";
  57. //convert myMAC and sutMAC to strings
  58. char myMacStr[18];
  59. char sutMacStr[18];
  60. snprintf(myMacStr, sizeof(myMacStr), "%02x:%02x:%02x:%02x:%02x:%02x",
  61. myMAC[0], myMAC[1], myMAC[2], myMAC[3], myMAC[4], myMAC[5]);
  62. snprintf(sutMacStr, sizeof(sutMacStr), "%02x:%02x:%02x:%02x:%02x:%02x",
  63. sutMAC[0], sutMAC[1], sutMAC[2], sutMAC[3], sutMAC[4], sutMAC[5]);
  64. //replace placeholder MACs in filterString with correct MACstring (hardcoded positions!)
  65. strncpy(filterString+40, myMacStr,17);
  66. strncpy(filterString+106, sutMacStr,17);
  67. strncpy(filterString+141, myMacStr,17);
  68. strncpy(filterString+174, sutMacStr,17);
  69. strncpy(filterString+260, myMacStr,17);
  70. return filterString;
  71. }
  72. //Starts timer by setting current (starting) time to tm1
  73. void startTimer()
  74. {
  75. gettimeofday(&tm1, NULL);
  76. }
  77. //Stops timer by setting current (ending) time to tm2
  78. //Then compares difference in time and returns it in milliseconds
  79. unsigned long long stopTimer()
  80. {
  81. struct timeval tm2;
  82. gettimeofday(&tm2, NULL);
  83. unsigned long long t = 1000 * (tm2.tv_sec - tm1.tv_sec) + (tm2.tv_usec - tm1.tv_usec) / 1000;
  84. return t;
  85. }
  86. //Starts timer by setting current (starting) time to longtm
  87. //Longtimer is used to determine if it was more than X seconds since the SUT sent out frames
  88. void startLongTimer()
  89. {
  90. gettimeofday(&longtm, NULL);
  91. }
  92. //Stops timer by setting current (ending) time to longtm2
  93. //Then compares difference in time and returns it in milliseconds
  94. unsigned long long stopLongTimer()
  95. {
  96. struct timeval longtm2;
  97. gettimeofday(&longtm2, NULL);
  98. unsigned long long t = 1000 * (longtm2.tv_sec - longtm.tv_sec) + (longtm2.tv_usec - longtm.tv_usec) / 1000;
  99. return t;
  100. }
  101. //Returns source address pointer location in packet
  102. u_char *getSourceAddrOfPacket(const u_char *packet)
  103. {
  104. //get header length
  105. u_char headerLength;
  106. headerLength = packet[2];
  107. //calculate offset to address
  108. const u_char *addr;
  109. int offset = headerLength;
  110. offset = offset + 10;
  111. //get pointer to address
  112. addr = packet + offset;
  113. return (u_char*) addr;
  114. }
  115. //Returns Version, Type and Subtype (one byte)
  116. u_char getFrameTypeOfPacket(const u_char *packet)
  117. {
  118. //get header length
  119. u_char headerLength;
  120. headerLength = packet[2];
  121. //calculate offset to frame type
  122. const u_char *frameType;
  123. int offset = headerLength;
  124. offset = offset + 0;
  125. //get pointer to frameType
  126. frameType = packet + offset;
  127. return *frameType;
  128. }
  129. //Sends packet using pcap. Returns status
  130. int sendPacket(pcap_t *pcap_h, u_char *packet, int size)
  131. {
  132. int sendStatus = pcap_sendpacket(pcap_h, packet, size);
  133. //when frame failed to send
  134. if (sendStatus == 1)
  135. {
  136. printf("Failed to send frame:\n");
  137. //print failed frame
  138. int printCounter = 0;
  139. for(int i = 0; i < size; i++)
  140. {
  141. printf("%02X ", packet[i]);
  142. printCounter = printCounter + 1;
  143. if (printCounter == 16)
  144. {
  145. printCounter = 0;
  146. printf("\n");
  147. }
  148. }
  149. printf("\n");
  150. }
  151. return sendStatus;
  152. }
  153. int main(int argc, char *argv[])
  154. {
  155. pcap_t *pcap_h;
  156. struct bpf_program fp;
  157. struct pcap_pkthdr header;
  158. char *dev;
  159. char errbuf[PCAP_ERRBUF_SIZE];
  160. //check argument number
  161. if(argc != 2)
  162. {
  163. printf("Usage: %s device\n", argv[0]);
  164. exit(EXIT_FAILURE);
  165. }
  166. dev = argv[1];
  167. //initialize libpcap
  168. if((pcap_h = pcap_create(dev, errbuf)) == NULL)
  169. {
  170. printf("pcap_create() failed: %s\n", errbuf);
  171. exit(EXIT_FAILURE);
  172. }
  173. if(pcap_can_set_rfmon(pcap_h) == 0)
  174. {
  175. printf("Monitor mode can not be set.\n");
  176. exit(EXIT_FAILURE);
  177. }
  178. if(pcap_set_rfmon(pcap_h, 1) != 0)
  179. {
  180. printf("Failed to set monitor mode.\n");
  181. exit(EXIT_FAILURE);
  182. }
  183. if(pcap_activate(pcap_h) != 0)
  184. {
  185. printf("pcap_activate() failed\n");
  186. exit(EXIT_FAILURE);
  187. }
  188. //compile filter for incoming packets
  189. if(pcap_compile(pcap_h, &fp, getFilterString() , 0, PCAP_NETMASK_UNKNOWN) == -1)
  190. {
  191. printf("failed pcap_compile() with error: %s\n", pcap_geterr(pcap_h));
  192. exit(EXIT_FAILURE);
  193. }
  194. //apply filter
  195. if(pcap_setfilter(pcap_h, &fp) == -1)
  196. {
  197. printf("failed pcap_setfilter() with error: %s\n", pcap_geterr(pcap_h));
  198. exit(EXIT_FAILURE);
  199. }
  200. //free memory allocated by pcap_compile()
  201. pcap_freecode(&fp);
  202. //flag to indicate if we have to listen for ACK verification
  203. int waitForACK = 0;
  204. //counter for continuous ACK fail
  205. int noACKcounter = 0;
  206. //number of times the frame was acked
  207. int confirms = 0;
  208. //initialize the fuzzer
  209. increaseFuzzer();
  210. //start long timer
  211. startLongTimer();
  212. //infinite listen-respond loop
  213. while (1)
  214. {
  215. //receive packet
  216. const u_char *packet = pcap_next(pcap_h, &header);
  217. unsigned long long LongtimeSincePrevPacket = stopLongTimer();
  218. if (LongtimeSincePrevPacket > SUTTIMEOUTMS)
  219. {
  220. printf("\e[31mIt took %llu ms to receive any frame from the SUT. Possible crash?\e[39m\n", LongtimeSincePrevPacket);
  221. }
  222. startLongTimer();
  223. unsigned long long timeSincePrevPacket = stopTimer();
  224. u_char frameType = getFrameTypeOfPacket(packet);
  225. u_char* sourceAddr;
  226. if (frameType != 0xd4) //ACK frames have no source address
  227. sourceAddr = getSourceAddrOfPacket(packet);
  228. //if we had to wait for an ACK, verify if current frame is an ACK
  229. if (waitForACK != 0)
  230. {
  231. //printf("Received frame of type %d\n", frameType);
  232. if (stopTimer() <= 30)
  233. {
  234. if (frameType == 0xd4)
  235. {
  236. //printf("ACKed\n");
  237. if (DEBUG)
  238. {
  239. switch (waitForACK)
  240. {
  241. case 1:
  242. {
  243. printf("Association response ACKed\n");
  244. break;
  245. }
  246. case 2:
  247. {
  248. printf("Authentication frame ACKed\n");
  249. break;
  250. }
  251. case 3:
  252. {
  253. printf("Probe response ACKed\n");
  254. break;
  255. }
  256. default:
  257. {
  258. printf("Frame ACKed\n");
  259. break;
  260. }
  261. }
  262. }
  263. ackedFrames = ackedFrames + 1; //the frame is acked, so increase counter
  264. waitForACK = 0; //we should stop waiting for ack and move on
  265. noACKcounter = 0; //reset counter
  266. if (confirms < NUMBEROFCONFIRMS)
  267. {
  268. confirms = confirms + 1;
  269. }
  270. else
  271. {
  272. confirms = 0;
  273. increaseFuzzer(); //fuzz next thing
  274. }
  275. if (DEBUG)
  276. {
  277. //printf("Frame ACKed, fuzzStep is now %d\n", getFuzzStep());
  278. printf("Frame ACKed\n");
  279. }
  280. }
  281. else //received other frame. Ignore and keep listening
  282. {
  283. if (DEBUG)
  284. {
  285. printf("Got other frame. Will be ignored\n");
  286. }
  287. }
  288. }
  289. else //waited more than 10 ms for ack. failed
  290. {
  291. //printf("Did not capture an ACK in time\n");
  292. noACKcounter = noACKcounter + 1;
  293. if (noACKcounter == 20)
  294. {
  295. printf("\e[31mFrame not ACKed after 20 retries, moving on\e[39m\n");
  296. noACKcounter = 0;
  297. increaseFuzzer();
  298. }
  299. if (DEBUG)
  300. {
  301. printf("Not sure if frame was ACKed\n");
  302. }
  303. waitForACK = 0;
  304. }
  305. }
  306. else //Process frame depending on type
  307. {
  308. switch(frameType)
  309. {
  310. case 0x40:
  311. {
  312. int packetSize;
  313. u_char *packet = createProbeResponse(sourceAddr, &packetSize, radioTapHeader, myMAC);
  314. sendPacket(pcap_h, packet, packetSize);
  315. free(packet); //free allocated memory
  316. waitForACK = 3;
  317. startTimer();
  318. break;
  319. }
  320. case 0xb0:
  321. {
  322. //int packetSize;
  323. //u_char *packet = createAuthResponse(sourceAddr, &packetSize, radioTapHeader, myMAC);
  324. //sendPacket(pcap_h, packet, packetSize);
  325. //free(packet); //free allocated memory
  326. //waitForACK = 2;
  327. //startTimer();
  328. break;
  329. }
  330. case 0x00:
  331. {
  332. //int packetSize;
  333. //u_char *packet = createAssResponse(sourceAddr, &packetSize, radioTapHeader, myMAC);
  334. //sendPacket(pcap_h, packet, packetSize);
  335. //free(packet); //free allocated memory
  336. //waitForACK = 1;
  337. //startTimer();
  338. break;
  339. }
  340. case 0xd4:
  341. {
  342. break;
  343. }
  344. default: break;
  345. }
  346. }
  347. }
  348. return 0;
  349. }