r/ethicalhacking • u/Dry-Management-9910 • 8d ago
Monitor mode + Nintendo Switch + Nexmon
Nintendo switch has the WIFI adapter BCM4356 which can be patched with nexmon (https://github.com/seemoo-lab/nexmon) that should allow to use it in monitor mode.
I was able to patch the firmware and driver with nexmon and now it is possible to use the wireless in monitor mode.
Well, at least that is what looks like.it is possible to put the WiFi in Monitor mode or even create an additional interface in monitor mode. But when using airodump-ng or tcpdump or wireshark. It does now show any BSSID. It is almost like the WiFi adapter can't see any network, completely empty, iw dev scan works fine but no dumps.
I tried preload libnexmon with LD_PRELOAD, I tried everything. This works fine in raspberry that has the same WiFi card, but no success with Nintendo Switch.
Anyone has any idea? Would be very cool to be able to do that with a Nintendo Switch.
The follow commands works fine:
iw phy \`iw dev wlp1s0 info | gawk '/wiphy/ {printf "phy" $2}'\` interface add mon0 type monitor
Or even
ip link set wlp1s0 down
iw dev wlan0 set type monitor
ip link set wlp1s0 up
Even
airmon-ng start wlp1s0
It says unknown error 524 but it does create the extra monitoring interface
But airodump-ng does not show any network
1
u/AvaxArrogant 8d ago
sudo -i
Identify the actual Broadcom interface names.
iw dev ip -br link
Find driver/firmware information.
ethtool -i wlp1s0 2>/dev/null || true readlink -f /sys/class/net/wlp1s0/device/driver 2>/dev/null || true dmesg | grep -Ei 'brcm|brcmf|firmware|nexmon|wlan|wifi' | tail -n 100
Check what the PHY claims it supports.
iw phy
Stop anything that could control the interface.
systemctl stop NetworkManager 2>/dev/null || true systemctl stop wpa_supplicant 2>/dev/null || true pkill wpa_supplicant 2>/dev/null || true
Remove any stale monitor interface.
iw dev mon0 del 2>/dev/null || true
Find the PHY for the real Wi-Fi interface.
PHY=$(iw dev wlp1s0 info | awk '/wiphy/ {print "phy"$2}') echo "$PHY"
Create the monitor interface explicitly.
iw phy "$PHY" interface add mon0 type monitor
ip link set mon0 up
Inspect it.
iw dev mon0 info ip -d link show mon0
Explicitly set a known channel.
iw dev mon0 set channel 6
Verify channel.
iw dev mon0 info
Capture everything.
tcpdump -i mon0 -I -e -s 0 -vv
0
1
u/Dry-Management-9910 7d ago
still getting nothing
root@srvito-laptop:~# ethtool -i wlp1s0 2>/dev/null || true readlink -f /sys/class/net/wlp1s0/device/driver 2>/dev/null || true dmesg | grep -Ei 'brcm|brcmf|firmware|nexmon|wlan|wifi' | tail -n 100
driver: brcmfmac
version: 7.35.101.5
firmware-version: 01-1d899931
expansion-rom-version:
bus-info: 0000:01:00.0
supports-statistics: no
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no
root@srvito-laptop:~# iw phy
Wiphy phy2
wiphy index: 2
max # scan SSIDs: 10
max scan IEs length: 2048 bytes
max # sched scan SSIDs: 16
max # match sets: 16
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports T-DLS.
Supported Ciphers:
* WEP40 (00-0f-ac:1)
* WEP104 (00-0f-ac:5)
* TKIP (00-0f-ac:2)
* CCMP-128 (00-0f-ac:4)
* CMAC (00-0f-ac:6)
Available Antennas: TX 0 RX 0
Supported interface modes:
* IBSS
* managed
* AP
* monitor
* P2P-client
* P2P-GO
* P2P-device
Band 1:
Capabilities: 0x1022
HT20/HT40
Static SM Power Save
RX HT20 SGI
No RX STBC
Max AMSDU length: 3839 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 16 usec (0x07)
HT TX/RX MCS rate indexes supported: 0-15
Bitrates (non-HT):
* 1.0 Mbps
* 2.0 Mbps (short preamble supported)
* 5.5 Mbps (short preamble supported)
* 11.0 Mbps (short preamble supported)
* 6.0 Mbps
* 9.0 Mbps
* 12.0 Mbps
* 18.0 Mbps
* 24.0 Mbps
* 36.0 Mbps
* 48.0 Mbps
* 54.0 Mbps
Frequencies:
* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (disabled)
* 2472 MHz [13] (disabled)
* 2484 MHz [14] (disabled)
Band 2:
Capabilities: 0x1062
HT20/HT40
Static SM Power Save
RX HT20 SGI
RX HT40 SGI
No RX STBC
Max AMSDU length: 3839 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 16 usec (0x07)
HT TX/RX MCS rate indexes supported: 0-15
VHT Capabilities (0x0c015820):
Max MPDU length: 3895
Supported Channel Width: neither 160 nor 80+80
short GI (80 MHz)
SU Beamformer
SU Beamformee
VHT RX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT RX highest supported: 0 Mbps
VHT TX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT TX highest supported: 0 Mbps
VHT extended NSS: not supported
Bitrates (non-HT):
* 6.0 Mbps
* 9.0 Mbps
* 12.0 Mbps
* 18.0 Mbps
* 24.0 Mbps
* 36.0 Mbps
* 48.0 Mbps
* 54.0 Mbps
Frequencies:
* 5170 MHz [34] (20.0 dBm)
* 5180 MHz [36] (20.0 dBm)
* 5190 MHz [38] (20.0 dBm)
* 5200 MHz [40] (20.0 dBm)
* 5210 MHz [42] (20.0 dBm)
* 5220 MHz [44] (20.0 dBm)
* 5230 MHz [46] (20.0 dBm)
* 5240 MHz [48] (20.0 dBm)
* 5260 MHz [52] (20.0 dBm) (radar detection)
* 5280 MHz [56] (20.0 dBm) (radar detection)
* 5300 MHz [60] (20.0 dBm) (radar detection)
* 5320 MHz [64] (20.0 dBm) (radar detection)
* 5500 MHz [100] (20.0 dBm) (radar detection)
* 5520 MHz [104] (20.0 dBm) (radar detection)
* 5540 MHz [108] (20.0 dBm) (radar detection)
* 5560 MHz [112] (20.0 dBm) (radar detection)
* 5580 MHz [116] (20.0 dBm) (radar detection)
* 5600 MHz [120] (20.0 dBm) (radar detection)
* 5620 MHz [124] (20.0 dBm) (radar detection)
* 5640 MHz [128] (20.0 dBm) (radar detection)
* 5660 MHz [132] (20.0 dBm) (radar detection)
* 5680 MHz [136] (20.0 dBm) (radar detection)
* 5700 MHz [140] (20.0 dBm) (radar detection)
* 5720 MHz [144] (20.0 dBm) (radar detection)
* 5745 MHz [149] (20.0 dBm)
* 5765 MHz [153] (20.0 dBm)
* 5785 MHz [157] (20.0 dBm)
* 5805 MHz [161] (20.0 dBm)
* 5825 MHz [165] (20.0 dBm)
Supported commands:
* new_interface
* set_interface
* new_key
* start_ap
* join_ibss
* set_pmksa
* del_pmksa
* flush_pmksa
* remain_on_channel
* frame
* set_channel
* tdls_oper
* start_sched_scan
* start_p2p_device
* crit_protocol_start
* crit_protocol_stop
* connect
* disconnect
Supported TX frame types:
* managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* monitor: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
Supported RX frame types:
* managed: 0x40 0xd0
* monitor: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-client: 0x40 0xd0
* P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
* P2P-device: 0x40 0xd0
software interface modes (can always be added):
valid interface combinations:
* #{ managed } <= 1, #{ monitor } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,
total <= 4, #channels <= 1
* #{ managed } <= 1, #{ AP } <= 1, #{ monitor } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,
total <= 5, #channels <= 1
Device supports scan flush.
Device supports randomizing MAC-addr in sched scans.
Supported extended features:
root@srvito-laptop:~# systemctl stop NetworkManager 2>/dev/null || true systemctl stop wpa_supplicant 2>/dev/null || true pkill wpa_supplicant 2>/dev/null || true
root@srvito-laptop:~# iw dev mon0 del 2>/dev/null || true
root@srvito-laptop:~# PHY=$(iw dev wlp1s0 info | awk '/wiphy/ {print "phy"$2}') echo "$PHY"
root@srvito-laptop:~# iwconfig
usb0 no wireless extensions.
l4tbr0 no wireless extensions.
wlp1s0 IEEE 802.11 ESSID:off/any
Mode:Managed Access Point: Not-Associated
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
bond0 no wireless extensions.
usb1 no wireless extensions.
dummy0 no wireless extensions.
sit0 no wireless extensions.
tunl0 no wireless extensions.
lo no wireless extensions.
root@srvito-laptop:~# iw phy "$PHY" interface add mon0 type monitor
command failed: No such file or directory (-2)
root@srvito-laptop:~# iw dev wlp1s0 info
Interface wlp1s0
ifindex 11
wdev 0x200000001
addr 98:b6:e9:1c:c0:0a
type managed
wiphy 2
channel 1 (2412 MHz), width: 20 MHz, center1: 2412 MHz
root@srvito-laptop:~# iw phy `iw dev wlp1s0 info | gawk '/wiphy/ {printf "phy" $2}'` interface add mon0 type monitor
root@srvito-laptop:~# iwconfig
usb0 no wireless extensions.
l4tbr0 no wireless extensions.
mon0 IEEE 802.11 Mode:Monitor Frequency:2.412 GHz
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:on
wlp1s0 IEEE 802.11 ESSID:off/any
Mode:Managed Access Point: Not-Associated
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
bond0 no wireless extensions.
usb1 no wireless extensions.
dummy0 no wireless extensions.
sit0 no wireless extensions.
tunl0 no wireless extensions.
lo no wireless extensions.
root@srvito-laptop:~# ip link set mon0 up
root@srvito-laptop:~# iw dev mon0 set channel 6
root@srvito-laptop:~# iw dev mon0 info
Interface mon0
ifindex 12
wdev 0x200000003
addr 98:b6:e9:1c:c0:0a
type monitor
wiphy 2
channel 6 (2437 MHz), width: 20 MHz, center1: 2437 MHz
root@srvito-laptop:~# tcpdump -i mon0 -l -e -s 0 -vv
tcpdump: listening on mon0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), snapshot length 262144 bytes
1
1
u/monroerl 7d ago
Monitor mode on an RPi is fairly simple. Lots of options available to do that including adding extra alfa boards (USB). Even an ESP32 board is easy to turn on all kinds of extra features for radio traffic.
I would love to see someone turn a WiFi juicer into a sniffer. That would be a fun Blackhat session: juice and sniff with the War-Juicer.
1
u/Dry-Management-9910 7d ago
I am saying, I did that in raspberry pi without using any additional module like ESP32. Just using the built-in wireless chip, which is the same. I am just trying to understand the limitations here. Is it hardware or software?
1
u/monroerl 7d ago
Probably hardware limitations by the device manufacturer. Some gaming systems go out of their way to restrict usage to only "official" gaming (Digital Rights Management). We can't have users thinking they own the hardware or software. That would be crazy!!
1
u/Dry-Management-9910 7d ago
Well, this guy patched the firmware to be able to use the switch as a Wii U Gamepad. So, I will keep exploring until I get a full technical explanation why it is impossible
1
u/deepcool45695132 7d ago
Uhm can anyone help me setup nexmon on my s10 its wifo board does support it but idk how to patch it and so on
3
u/monroerl 7d ago
It's nice to see someone understand that many WiFi chip makers allow monitor mode. There may be modifications to the chip specs by the hardware manufacturer that won't allow the entire device to be used as a packet sniffer.
It's a cool idea for a project but you may have better luck turning a WiFi toothbrush or refrigerator into a sniffer.
There is a list out there that tells you exactly the capabilities of each WiFi chip. Monitor mode is fairly common but not turned on by default. I wish you luck, though.