Browse Source

Association fuzzing done

Bart 4 years ago
parent
commit
364fa2830b
3 changed files with 21 additions and 4 deletions
  1. BIN
      assFuzzer/cfuzz
  2. 17 2
      assFuzzer/cfuzz.c
  3. 4 2
      assFuzzer/frameCreator.c

BIN
assFuzzer/cfuzz


+ 17 - 2
assFuzzer/cfuzz.c

@@ -6,6 +6,7 @@ This is the main file. It handles sending, receiving, but also monitoring of fra
 #include <stdlib.h>
 #include <stdint.h>
 #include <string.h>
+#include <unistd.h>
 #include <sys/time.h>
 #include "cfuzz.h"
 #include "frameCreator.h"
@@ -35,9 +36,9 @@ u_char myMAC[6]            =  "\x00\x0a\xeb\x2d\x72\x55";
 //Mac address of SUT
 //Is needed to ignore frames from other devices
 //Comment out the SUT
-//u_char sutMAC[6]            =  "\xec\x9b\xf3\x1e\x19\x71"; //Galaxy S6
+u_char sutMAC[6]            =  "\xec\x9b\xf3\x1e\x19\x71"; //Galaxy S6
 //u_char sutMAC[6]            =  "\xcc\xfa\x00\xc9\xfc\xad"; //LG Optimus G
-u_char sutMAC[6]            =  "\xd0\x17\x6a\xe8\xe9\x7a"; //Galaxy Ace
+//u_char sutMAC[6]            =  "\xd0\x17\x6a\xe8\xe9\x7a"; //Galaxy Ace
 //u_char sutMAC[6]            =  "\x12\x42\x2a\x7e\xd4\xe8"; //Orange Pi Zero
 //u_char sutMAC[6]            =  "\x00\x09\xbf\x7d\x6d\xaa"; //Nintendo DS
 //u_char sutMAC[6]            =  "\x00\x01\x4a\x93\xce\x34"; //PSP
@@ -317,10 +318,24 @@ int main(int argc, char *argv[])
                         //disassociate if specified
                         if (SENDDISASS == 1)
                         {
+                            sleep(1);
                             int packetSize;
                             u_char *packet = createDisAss(sutMAC, &packetSize, radioTapHeader, myMAC);
                             sendPacket(pcap_h, packet, packetSize);
                             free(packet);      //free allocated memory
+                            /*packet = createDisAss(sutMAC, &packetSize, radioTapHeader, myMAC);
+                            sendPacket(pcap_h, packet, packetSize);
+                            free(packet);      //free allocated memory
+                            //sleep(1);
+                            packet = createDisAss(sutMAC, &packetSize, radioTapHeader, myMAC);
+                            sendPacket(pcap_h, packet, packetSize);
+                            free(packet);      //free allocated memory
+                            packet = createDisAss(sutMAC, &packetSize, radioTapHeader, myMAC);
+                            sendPacket(pcap_h, packet, packetSize);
+                            free(packet);      //free allocated memory
+                            packet = createDisAss(sutMAC, &packetSize, radioTapHeader, myMAC);
+                            sendPacket(pcap_h, packet, packetSize);
+                            free(packet);      //free allocated memory*/
                         }
                         increaseFuzzer();               //fuzz next thing
                     }

+ 4 - 2
assFuzzer/frameCreator.c

@@ -13,6 +13,7 @@ Creates frames.
 #include "fuzzHTCAPAB.h"
 #include "fuzzHTINFO.h"
 #include "fuzzEXTCAPAB.h"
+#include "fuzzEDCA.h"
 #include "fuzzAssResponse.h"
 //CHANGE WHEN NEW SUBFUZZER
 
@@ -109,7 +110,7 @@ u_char *createAssResponse(u_char *dstAddress, int *packetSize, u_char * radioTap
     if (getNotifyDone() != 0)
         return AssRespFuzz(dstAddress, packetSize, radioTapHeader, myMAC);
 
-    #define numberOfAssInfoElems (5)   //number of information elements
+    #define numberOfAssInfoElems (6)   //number of information elements
 
     //definition of all info elements 
     //CHANGE WHEN NEW SUBFUZZER
@@ -118,11 +119,12 @@ u_char *createAssResponse(u_char *dstAddress, int *packetSize, u_char * radioTap
     infoElem htcapab = htcapabFuzz();
     infoElem htinfo = htinfoFuzz();
     infoElem extcapab = extcapabFuzz();
+    infoElem edca = edcaFuzz();
 
     //CHANGE WHEN NEW SUBFUZZER
     //create array of information elements
     infoElem taggedParams[numberOfAssInfoElems] = {suppRates, extrates, htcapab, 
-        htinfo, extcapab};
+        htinfo, extcapab, edca};
 
     //length of all info elements, including id and len field
     int len_taggedParams = 0;