-
-
Save brainstorm/24e843ae0295ee1e41dff47c5b43a02c to your computer and use it in GitHub Desktop.
| void process_promisc(void* buf, uint16_t len) | |
| { | |
| char* buflen = (char*) buf + len; | |
| uint8_t hexdump_cols = 0; | |
| uint8_t offset = 0; | |
| // RAW packet | |
| for (char* ptr = buf; ptr < buflen; ptr++) printf("%c", *ptr); | |
| printf("\n\n"); | |
| // Hexdump (wireshark-friendly) | |
| for (char* ptr = buf; ptr < buflen; ptr++) { | |
| // print offset | |
| printf("%06X", offset); | |
| for (hexdump_cols=0; hexdump_cols < HEX_COLSIZE; hexdump_cols++) | |
| printf("%02X ", *ptr + hexdump_cols); | |
| offset = offset + HEX_COLSIZE; | |
| printf("\n"); | |
| } | |
| //free(buf); | |
| //free(buflen); | |
| printf("\n\n"); | |
| } |
As a cross-reference with the discussion in the ESP32.com forum about this topic:
The approach above will never inject 802.11 frames, reversing of libpp.a and lib80211.a seems to be needed:
Hi brainstorm,
Can I hire you to small work on esp32 promiscuous?
Please email me to [email protected] or call my Skype nissim.text
Thank you
-Nissim
It appears that Espressif will be imminently releasing a feature to inject 802.11 data frames (but not management frames):
https://esp32.com/viewtopic.php?f=13&t=2025#p9539
It is probably the function esp_wifi_80211_tx() introduced by this commit:
espressif/esp32-wifi-lib@ce0ce8b
Another approach is to get the whole frame by casting the buffer and greb the playload with casted_buffer->payload. Also the length is in sig_len (see https://github.com/espressif/esp-idf/blob/master/components/esp32/include/esp_wifi_types.h). With this variant, i'll also get nearly all of the packets. Though i also have the same problem with malformed packets.
a possibility could be:
// get length of packet
for (i = 0; i < casted_buffer->rx_ctrl.sig_len; i++) {
// print payload
printf(" %02X", casted_buffer->payload[i]);
}
This gist originated after playing with the ESP32 promiscuous callback and while searching around the esp32.com community forums.
Below there's a dump from the callback function in the code outlined above. The mac address can be found on offset
0x25and repeated shortly afterwards (src/dstMAC addresses):C4 04 15 0B 75 D3.The rest of the payload resembles a 802.11 WLAN/Ethernet frame, but wireshark still has some issues decoding it when imported as a plain hexfile:
/ping @chris-zen