psp based mitm sniffer

dowload · Post by **dowload** » Mon Sep 10, 2007 10:46 am

I posted this on some other forums and was told to check here.
Would it be possible to write a non-promiscuous mode sniffer for the
PSP that simply captures all incoming packets, ie: intercept all incoming
pings.
Also, is it possible to craft ARP packets on the PSP?
My idea was to write a sniffer that uses ARP cache poisoning to create
a Man-In-The-Middle condition which would allow one to sniff packets
without using promiscuous mode.
Here is a link to the code I have written so far: http://intercon.ifastnet.com/files/main.c
And here is the sniffer it was based on:
http://hacktivist.net/index.php?page=sc ... scripts=41
Unfortunately, it is not capturing the incoming packets.
I have been looking up the sceIoIoctl function to see if this would help.
Does anyone know what I should try?

--download

califrag · Post by **califrag** » Tue Sep 11, 2007 7:14 pm

well i don't know anything about what you've posted above, BUT, here's something you can look into...

take a look at psputility_netparam.h

would it be possible make a call to

sceUtilitySetNetParam(int param, const void *val)

and pass PSP_NETPARAM_WEPKEY

I'm thinking you could generate WEP keys and brute force it until it connects... though there is no telling how long it may take to crack the WEP key. but I know the source for some key crackers are available (aircrack -ng)

let me know if you make any progress, interested in this myself!

just a thought

dowload · Post by **dowload** » Wed Sep 12, 2007 2:26 pm

no, I meant to capture packets once already connected to the network,
not try to brute force WEP. That would be theoretically possible, but would
take an inordinate amount of time.

Viper8896 · Post by **Viper8896** » Wed Sep 12, 2007 2:58 pm

It would be great as a tool that worked as a team with another computer connected through the usb so the psp just does the capturing while the high performance computer does the cracking

dowload · Post by **dowload** » Wed Sep 12, 2007 5:33 pm

It doesn't need to crack anything!
It's just sopposed to capture already incoming packets.
For example: you ping the PSP and those ICMP echo request
packets show up in the sniffer logs.
THIS HAS NOTHING TO DO WITH WEP CRACKING!

mojojojo · Post by **mojojojo** » Sun Sep 16, 2007 3:59 am

dowload wrote:It doesn't need to crack anything!
It's just sopposed to capture already incoming packets.
For example: you ping the PSP and those ICMP echo request
packets show up in the sniffer logs.
THIS HAS NOTHING TO DO WITH WEP CRACKING!

I've been looking for a libpcap like sniffer capability for the PSP myself. (As a user, not a coder)

From my research, it seems like the stopping block is the wireless NIC technology they used. There are no obvious hooks into the low-level capabilities of the NIC.

http://jylam.info/psp/dev.html wrote:

PSP uses two chips for wifi stuff :

* Marvell Libertas 88W8010 - RF Transceiver
* Marvell Libertas 88W8380 - ARM9 Processor

It handles 802.11b and g (11 and 54Mbps), WEP and AES encryption (not sure for AES).

Unfortunately, there is no GPL'd Linux driver for this. A big problem, I've absolutely no experience in wlan drivers coding, and it seems Marvell released no documentation at all about its chip.x

If you've got driver/linux kung fu ... you can try here http://wiki.laptop.org/go/Libertas ...

Scroll down to links with some projects to reverse engineer libertas for various devices. I've looked at some of it but it is way out of my league.

Viper8896 · Post by **Viper8896** » Sun Sep 16, 2007 8:02 pm

mojojojo wrote:
http://jylam.info/psp/dev.html wrote:
...It handles 802.11b and g (11 and 54Mbps)...

g/54Mbps?? erm don't think so.

adrahil · Post by **adrahil** » Sun Sep 16, 2007 8:39 pm

The Marvell card the PSP got does :) But of course SCE are too cheap to extend their WLAN FW ;)

Viper8896 · Post by **Viper8896** » Sun Sep 16, 2007 11:08 pm

adrahil wrote:...SCE are too cheap to extend their WLAN FW ;)

is that the same fw as in
a. psp fw 3.52
or
b. something built on the wlan

if the answer is b is it writable and could it be a possibility it a new custom fw.

someone · Post by **someone** » Mon Sep 24, 2007 10:54 am

I believe that the Libertas ARM9/ARM7 combo with its own flash chip and a JTAG port is able to do a lot of nice stuff not already implemented.

But without specs or code written, it will be very hard to implement it.

tabularasa · Post by **tabularasa** » Mon Oct 08, 2007 6:53 pm

dowload wrote: Here is a link to the code I have written so far: http://intercon.ifastnet.com/files/main.c

Hm doesn't really work for me that URL. But i like the idea of a working psp sniffer. More to come?

Edit:
Hm. Are there any other ways to hijack wifi connections more low level based than on ARP spoofing? I'm not that familiar with wifi so ...
http://monkey.org/~dugsong/dsniff/ should be a good starting point regarding arp spoofed packets. Maybe i got some more time later on to check code and try to figure out some things.

tabularasa · Post by **tabularasa** » Tue Oct 09, 2007 1:47 am

Hm. Unforunately when i try to send something over raw socket i get the errno error #121 = Remote I/O error.
My arp packet looks something like that:

Code: Select all

/*
    router&#58; 192.168.2.1   &#40;00&#58;03&#58;C9&#58;A8&#58;70&#58;D5&#41;
    laptop&#58; 192.168.2.155 &#40;00&#58;01&#58;36&#58;0E&#58;21&#58;8E&#41;
    psp&#58;    192.168.2.102 &#40;00&#58;01&#58;4A&#58;A8&#58;D8&#58;18&#41;
*/

const char atob&#91;&#93; = "\x00\x01\x36\x0E\x21\x8E" /* address to spoof &#40;laptop&#41;*/
                    "\x00\x01\x4a\xa8\xd8\x18" /* myself &#40;psp&#41; */
                    "\x08\x06"                 /* type&#58; ARP */
                    "\x00\01"                  /* hardware type&#58; ethernet */
                    "\x08\x00"                 /* prot. type&#58; IP */
                    "\x06"                     /* hardware size&#58; 6 */
                    "\x04"                     /* prot. size&#58; 4 */
                    "\x00\x02"                 /* Opcode&#58; reply */
                    "\x00\x01\x4a\xa8\xd8\x18" /* sender mac address &#40;psp&#41; */
                    "\xc0\xa8\x02\x01"         /* sender ip address &#40;router&#41; */
                    "\x00\x01\x36\x0E\x21\x8e" /* target mac address &#40;laptop&#41; */
                    "\xc0\xa8\x02\x9b";        /* target ip address &#40;laptop&#41; */

const char btoa&#91;&#93; = "\x00\x03\xc9\xa8\x70\xd5" /* address to spoof &#40;router&#41; */
                    "\x00\x01\x4a\xa8\xd8\x18" /* myself &#40;psp&#41; */
                    "\x08\x06"                 /* type&#58; ARP */
                    "\x00\01"                  /* hardware type&#58; ethernet */
                    "\x08\x00"                 /* prot. type&#58; IP */
                    "\x06"                     /* hardware size&#58; 6 */
                    "\x04"                     /* prot. size&#58; 4 */
                    "\x00\x02"                 /* Opcode&#58; reply */
                    "\x00\x01\x4a\xa8\xd8\x18" /* sender mac address &#40;psp&#41; */
                    "\xc0\xa8\x02\x9b"         /* sender ip address &#40;laptop&#41; */
                    "\x00\x03\xc9\xa8\x70\xd5" /* target mac address &#40;router&#41; */
                    "\xc0\xa8\x02\x01";        /* target ip address &#40;router&#41; */

Gaby_64 · Post by **Gaby_64** » Thu Jan 15, 2009 9:53 am

I posted this on some other forums and was told to check here.
Would it be possible to write a non-promiscuous mode sniffer for the
PSP that simply captures all incoming packets, ie: intercept all incoming
pings.
Also, is it possible to craft ARP packets on the PSP?
My idea was to write a sniffer that uses ARP cache poisoning to create
a Man-In-The-Middle condition which would allow one to sniff packets
without using promiscuous mode.
Here is a link to the code I have written so far: http://intercon.ifastnet.com/files/main.c
And here is the sniffer it was based on:
http://hacktivist.net/index.php?page=sc ... scripts=41
Unfortunately, it is not capturing the incoming packets.
I have been looking up the sceIoIoctl function to see if this would help.
Does anyone know what I should try?

The links dont work, does anyone know what was the sniffer he used
This technic is very much possible on psp to capture packets and hopefuly dump them into a cap file

Wally · Post by **Wally** » Thu Jan 15, 2009 12:22 pm

Gaby_64 wrote:
I posted this on some other forums and was told to check here.
Would it be possible to write a non-promiscuous mode sniffer for the
PSP that simply captures all incoming packets, ie: intercept all incoming
pings.
Also, is it possible to craft ARP packets on the PSP?
My idea was to write a sniffer that uses ARP cache poisoning to create
a Man-In-The-Middle condition which would allow one to sniff packets
without using promiscuous mode.
Here is a link to the code I have written so far: http://intercon.ifastnet.com/files/main.c
And here is the sniffer it was based on:
http://hacktivist.net/index.php?page=sc ... scripts=41
Unfortunately, it is not capturing the incoming packets.
I have been looking up the sceIoIoctl function to see if this would help.
Does anyone know what I should try?
The links dont work, does anyone know what was the sniffer he used
This technic is very much possible on psp to capture packets and hopefuly dump them into a cap file

This thread is two years old! Of course the links wont work.
No I have no idea

Gaby_64 · Post by **Gaby_64** » Fri Jan 16, 2009 1:01 pm

Well witch program would be the best to port that has arp spoofing capability's and captures packets

Anyway here is a link to my current progress: http://psp.wijou.com/forum/index.php?showtopic=815

Gaby_64 · Post by **Gaby_64** » Fri Jan 30, 2009 12:23 am

Version 0.52 of my aircrack was released yesterday, its goty a working wep cap file decrypter that takes less then 10 seconds

Gaby_64 · Post by **Gaby_64** » Sat Feb 07, 2009 12:13 pm

Well Aircrack-PSP 0.544993 was released today

Does anyone look at this, reply, im still looking for that file

the one Download made (main.c) if you look at the first post

Dariusc123456 · Post by **Dariusc123456** » Sat Feb 07, 2009 1:42 pm

Gaby,

Where the link on that site to download the latest version of Aircrack-psp?

Gaby_64 · Post by **Gaby_64** » Sat Feb 07, 2009 1:45 pm

here: http://psp.wijou.com/forum/index.php?showtopic=815

forums.ps2dev.org

psp based mitm sniffer

psp based mitm sniffer

Libertas!

Re: Libertas!

Re: psp based mitm sniffer

No one working on this anymore

Re: No one working on this anymore