PwnAir
WiFi monitor mode & AirCrack
ONLY for Galaxy S1 with compatible KitKat-based ROMs
BETA RELEASE /* YOUR WARRANTY IS NOW VOID */
[NEW] TARGET-SCAN (airodump-ng) is now part of PwnAir Lite!
PwnAir is a package (kernel + app) that will turn your Galaxy S1 phone into a WiFi cracking device.
*
Enable WiFi monitor mode, like bcmon did
*
Recover WEP and WPA-PSK keys, through AirCrack
*
Capture WiFi traffic, through AirCrack too
![]()
I couldn't resist to put this reference to the Watch Dogs game.
What a better timing to launch PwnAir than Watch Dogs game release ? (PwnAir is not sponsored by Ubisoft, btw!)
What's new is that PwnAir intends to:
* port bcmon to recent ROMs/kernels. As you may have noticed, bcmon won't run on recent ROMs, except if you've built it yourself.
That's normal.
* bring a new graphical user interface to bcmon app
(LOAD)
* bring a new graphical user interface to airodump-ng
(TARGET-SCAN)
* [Pro only] bring a new graphical user interface for the main AirCrack-ng command-line tools
(TARGET-LOG, ATTACK, CRACK) with terminal scrolling optimizations
![]()
![]()
[more screenshots]
PRE-REQUISITES
* Your phone is a
Galaxy S1 (galaxysmtd, GT-I9000). It is NOT going to work on S2/S3/S4, or any other phones that are using anything else than the Aries kernel, and especially anything else than a Broadcom 4329 WiFi chipset.
* You are using a
ROM compatible with CyanogenMod 11 kernel (a.k.a. Aries stable/cm11.0, this version is the KitKat release). This includes, of course,
CyanogenMod 11 itself and, among others, I've tested CyanFox 2.0.2 (Cyanfox has broken download links). Several ROM are directly using the CM kernel, check with your ROM author. Otherwise and as for any kernel, the kernel may be incompatible with your ROM, meaning that some peripherals may not work or that the phone may bootloop until reflashed. This risk is limited, as kernels interfaces with the ROM (Android system) are *generally* stable among time, especially on old devices. Moreover, it's safer to flash the full kernel than to force a Wi-Fi driver to load into an unknown kernel. For the most paranoids that want maximum compatibility, use this CyanogenMod ROM snapshot:
cm-11-20140504-SNAPSHOT-M6-galaxysmtd.zip.
* You have a
custom recovery installed, like CWM (preferably) or TWRP.
* You are not afraid of loosing your phone warranty and/or data, making your phone bootloop until you get to reflash it, and all those funny stuff that kernel/ROM flashers surprisingly enjoy.
INSTALL INSTRUCTIONS
- Download PwnAir Kernel zip file
- Open PwnAir kernel zip archive with 7zip or similar zip tool
- Download the monitor mode firmware: fw_bcm4329.bcmon.bin
- Copy fw_bcm4329.bcmon.bin into the system/vendor/firmware folder of the PwnAir kernel zip file
- Save the zip file
- Transfer the zip file to your sdcard
- Reboot your phone in recovery mode (from the menu, or power off and power on with Volume Up + Home + Power)
- Do a NANDROID backup
- Flash the zip file
- Reboot your phone
MONITOR MODE ACTIVATION & WHAT'S NEXT
The PwnAir Lite app has been installed during the process. Open it and "Load Monitor Mode".
- First option, "Mode monitor" appears. -- You're happy.
Buy me a beer if it works.
Nah... who cares about paying beers to strangers that are going to drink it with someone else?
Be materialist, get the Pro App, that will make everybody happier and it's cheaper than a beer :fingers-crossed:
So then, go to the target tab and launch a scan to see access points and clients ("stations") traffic.
Additional functions are part of the Pro App or can be used with free Command Line Interface tools : Wireless Tools (mandatory) + Aircrack (see "sources" section, check "bin" folders).
- Second option, an error message appears. -- You're sad.
1. Post the error message here.
2. Connect your phone in USB debugging mode
3. Post the output of
Code:
adb shell su -c dmesg
4. Don't pay me a beer, I don't deserve it :(
- Third option, there's no such thing as a "PwnAir Lite" app. -- Are you sure you've flashed the kernel successfully?
You should stop drinking beers while flashing kernels.
- Last option, you're stuck into a bootloop -- You're not alone.
First of all, remove the battery and reboot. Don't ask why, I don't know, but sometimes it works. Still in trouble?
You've carefully followed the pre-requisites : complain here while waiting for the recovery of your phone with your NANDROID backup.
You've not followed the pre-requisites because making NANDROID backup is long and boring: flash a working kernel compatible with your ROM, ideally your ROM's kernel. If that's still not working, flash a full ROM.
I WON'T GO PRO. GIVE ME AIRCRACK FOR FREE OR I'LL HACK YOUR WIFI !
Okay, okay, you like typing command-lines with MAC addresses on your touch phone, here's the deal: AirCrack is open source GNU GPL. That means you can
get the sources of the Android port directly on my repo, and there's even the binaries!
DOWNLOADS :laugh:
DOWNLOADS!
pwnair-no-firmware.zip: PwnAir Kernel+App flashable zip -
FIRMWARE NOT INCLUDED, GET FIRMWARE FROM THE LINK BELOW AND CHECK INSTALL INSTRUCTIONS!
fw_bcm4329.bcmon.bin: Bcmon monitor mode firmware for Broadcom 4329 WiFi chipset
[OPTIONAL] PwnAir Pro App For 0,99$/, an easy-to-use graphical interface that implements Aircrack automated scan/attack/cracking tools on WEP and WPA networks (WPA: includes the 10k most commonly used password dictionnary).
KNOWN ISSUES
Unload was supposed to bring my normal WiFi back, not "kill" all the WiFi drivers! dmesg log will show some info about memory usage. From what I understand, the WiFi driver, especially the "normal" one (Mode: managed), is asking the kernel reserve too much memory aligned space to store the wifi interface class. And the kernel, as a result of time and driver load/unload, is too much fragmented to satisfy this request. That's the strange way the Linux kernel works. So you just need to realign your kernel memory. That's where you say "Whaaaaat?". And I say "
Reboot". And you say "Why didn't you tell this before?". And so on.
Having airodump-ng (SCAN) launched for a long time may cause the phone to freeze or reboot Well, for this, I've no idea. You know my answer: "
Reboot". The hard way if necessary.
LIMITATIONS
PwnAir Lite App is limited to loading the monitor mode and scanning for networks.
PwnAir is not compatible with Aircrack-ng-GUI, Reaver-WPS-GUI apps or any "normal" WiFi app. Either use the PwnAir Pro app or the free Wireless Tools binaries + Aircrack CLI binaries (see "sources" section). Try your luck with "Unload" but the only clean way to get your normal WiFi back is just to reboot your phone.
Not all possible WiFi attacks are implemented. Attack of hidden SSID, client attack (Caffe Latte) and client MAC spoofing need to be manually (CLI) performed. Get the aircrack-ng CLI tools from my repo if you want to perform such attacks.
Like other client attacks, Hirte Attack is not implemented and it's possible that the driver doesn't support it anyway. Get a Caffe Latte instead, it's quite the same.
CREDITS, SOURCES, GPL STUFF, ETC...
[PWNED SOURCES]
I have ported all the CLI tools to Android/Aries/CM11:
AirCrack-ng suite for Android
Wireless Tools for Android
GNU Macchanger for Android
Airpcap Android static library for Aries (this recent version is needed for reaver-wps to work)
Reaver-WPS for Android (UNTESTED)
PwnAir Kernel (
CM11 stable Aries with dual standard/bcmon WiFi drivers)
[UNPWNED SOURCES / CREDITS]
Adapted from
Bcmon work
Android Terminal Emulator
Android Bootstrap
Java Installer's execpty
[BUILD INSTRUCTIONS FOR ADVENTUROUS USERS]
CLI executables: Use Cyanogenmod build system, check instructions in Android.mk and Aircrack for Android README file.
Kernel: Use Cyanogenmod build system, copy manifest from build dir of PwnAir Kernel (bcmon_aries) repo to cyanogenmod .repo/local_manifests/, copy config file in kernel/samsung/aries/arch/arm/configs, init the repo, breakfast galaxysmtd and build (check my wiki section "How to (edit and) build an officially supported kernel?" on
CM integrated kernel building wiki page for kernel building).
Detailed kernel build instructions/porting to other devices with broadcom 4329 chipset:
check this post.
XDA:DevDB Information
[GALAXYSMTD][KERNEL]+[APP] PwnAir WiFi monitor mode, Kernel for the Samsung GT-I9000 Galaxy S
Contributors
n01ce
Kernel Special Features: wifi monitor mode, cm11
Version Information
Status: Beta
Current Beta Version: 1.01
Beta Release Date: 2014-05-30
Created 2014-05-22
Last Updated 2014-06-01
