{"action":"created","issue":{"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/72","repository_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration","labels_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/72/comments","events_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/72/events","html_url":"https://github.com/jbenden/aircrack-ng-migration/issues/72","id":297835653,"number":72,"title":"CommView frame reading/injecting code","user":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"labels":[{"id":839245225,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/%23general","name":"#general","color":"0000aa","default":false},{"id":839245326,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/@minor","name":"@minor","color":"dcffff","default":false},{"id":839242831,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/enhancement","name":"enhancement","color":"a2eeef","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-16T16:07:16Z","updated_at":"2018-02-16T16:07:18Z","closed_at":null,"author_association":"OWNER","body":"**Reported by anonymous on 26 Jan 2007 18:01 UTC**\n\nMost of the code isn't relevant, and left as an excercise for the reader to interpret.  The important information regarding the CommView DLL is:\n\n\n\n```\n  ca2k_dll = LoadLibrary(\"ca2k.dll\");\n\n  // Initialise\n  F1 = (void *)GetProcAddress(ca2k_dll, \"F1\");\n  // Transmit\n  T1 = (void *)GetProcAddress(ca2k_dll, \"T1\");\n  // Change monitoring channel\n  CC = (void *)GetProcAddress(ca2k_dll, \"CC\");\n  // Start monitoring\n  S1 = (void *)GetProcAddress(ca2k_dll, \"S1\");\n  // Read packets\n  S5 = (void *)GetProcAddress(ca2k_dll, \"S5\");\n```\n\n\n```\nchar (__cdecl * F1)(int BufferSize);\n```\nF1 = Initialise Driver, takes a single parameter which I believe is the buffer size in the kernel for packets to be queued up in\n\n```\nchar (__cdecl * T1)(int Size, unsigned char *Buffer);\n```\nT1 = Transmit packet, takes a buffer and a length.  No headers, first byte of the buffer is the first byte of the 802.11 frame.\n\n```\nchar (__cdecl * CC)(int Channel);\n```\nCC = Change monitor channel\n\n```\nchar (__cdecl * S1)(int Channel);\n```\nS1 = Start monitoring on a channel\n\nF1, T1, CC and S1 all return 1 on success, 0 on failure.\n\n```\nint (__cdecl *S5)(unsigned char *Buffer, int Length);\n```\nS5 = Read frames from the capture buffer.  Going into more detail with this one... The buffer may return multiple frames.  Each frame has a 20 byte header, a 14 byte header, and the 802.11 data.\n\nThe return value is the number of bytes copied into the buffer.\n\nThe first header is as follows:\n```\nstruct CV_Header {\n  unsigned int TickCount; // GetTickCount() / 1000 at time of packet\n  unsigned int Micros;    // Microsecond counter at time of packet\n  /* The following might be backwards, unsure */\n  int PacketSize;         // Full packet size?\n  int SliceSize;          // Truncated packet size?\n  int Unknown;            // Not sure what this is.\n};\n```\n\nPacketSize and SliceSize always seem to be the same for me.  It's also possible that it's OriginalPacketSize/CompressedPacketSize - the documentation for their SDK indicates that could be possible in plugins.\n\nPacketSize is the length of the length of the 802.11 data AND the 14 byte header.\n\nThe 14 byte header is as follows:\n```\nstruct CV_Header2 {\n  char ErrorFlag;   // ErrorFlag & 1 = CRC error\n  char Unknown2[// Unknown\n  char Power;       // Power\n  char Unknown3[6](6];); // Unknown\n};\n```\n\nAfter the 802.11 data, the next packet is aligned on a 4 byte boundary. NB - The return value includes these alignment bytes.\n\nI've written this as a server, as CA2K.DLL does not allow multiple processes to access it - this enables separate things such as aireplay-ng and airodump-ng to access it at the same time.  There is also no way to select which device to use, as CommView only supports one device at a time having its drivers installed.\n\nI've tested the packet injecting with proof-of-concept code, but I'm still working on getting aireplay-ng to talk to this server.  airodump-ng works quite happily with some tweaking.\n\nI have no idea how well injecting will perform under load.\n\nMigrated-From: https://trac.aircrack-ng.org/ticket/72"},"comment":{"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/comments/366278622","html_url":"https://github.com/jbenden/aircrack-ng-migration/issues/72#issuecomment-366278622","issue_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/72","id":366278622,"user":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"created_at":"2018-02-16T16:07:18Z","updated_at":"2018-02-16T16:07:18Z","author_association":"OWNER","body":"**Modified by misterx on 26 Jan 2007 18:01 UTC**"}}
{"actor":{"display_login":"jbenden"}}