gbadev.org forum archive

Aireplay NDS *Early Build*
by JSR

Notes :
------------------------------------

Aireplay is a Wifi Packet injection software, well known for Wifi Hacking.
I decided to port it to NDS as most of the new Wifi Chipset allow only Packet Capture and Aireplay is only available on Linux. Having a mobile wifi hacking solution is also a good idea...
In this build, the only activated function is the Broadcast Deauthentification module which allow to deauthenticate every user connected to a specific Access Point. It's useful for capturing ARP Request or flooding the wifi trafic.

*SPECIAL NOTES*
Most of Aireplay Linux functions are ported but not included. The NDS Wifi Driver allow only capture of packet sended at 1/2mbit rate. As all the function, unless the one included in this build, require capturing some packet from client side, you can't use them as the Client send them at over 2mbit rate(11mbit...).
I have no solution for this problem. If you have an idea/solution to set/slowdown the traffic rate to 2mbit, send me an email here : jsr(.)exp(@)gmail(.)com.
I will implement your solution and release a full build.

Usage :
------------------------------------

AireplayNDS_EarlyBuild.nds for NDS Cart (Slot-1)
AireplayNDS_EarlyBuild.ds.gba for GBA Cart (Slot-2)

Thanks to :
------------------------------------

Sgstair and Liranuna for their support.
M3 Team and DS-X Team for their homebrew contribution.


Link : here

Update : WifiLib updated to 0.3d (Now working with new DS Lite)

_JSR_ wrote: AireplayNDS_EarlyBuild.nds for NDS Cart (Slot-1)
AireplayNDS_EarlyBuild.ds.gba for GBA Cart (Slot-2)

.nds existed before Slot-1 cards existed, they're not just for slot-1 cards

Yeah i know, this explanation is just for usage.

It's still more confusing than you intended. Likely complaint: "So what should I use with a GBA Movie Player (which fits in SLOT-2 and has GBA in its name)?" GBA Movie Player that isn't M3 uses .nds.

@_JSR_: About your implementing problem:

1. Long time ago I heard tht the DS was locked down to 2 Mbits cause of the powerconsumption an 11 Mbit transfer rate would cause, so if this would be true, you could try to "unlock" it and then try to implement the other features.

2. Whats about this crazy idea ? :
Send so much packages to the AP until the trafic is that high so you can use that other tools you currently don?t have implemented.

Sorryif these "Ideas" are totally nonsense, I just thought it "might maybe" help...

Greets:

Pas

Thanks for the idea pas. I already tried a flooding test to see if the rate would lower (or stay at a lower rate). But it never happen with an NDS :(.
I have no idea if the nds wifi rate is unlockable... sgstair didn't say something like that so it's unlikely possible.

Well this is cool, but what's with the interface? It's just asking me to enter an AP number, without listing which AP is which.

Oh ok, it's not clear. When you see the (growing) number of AP present in the area, this number also corresponds to the specific AP listed at the same moment.

It dont work on my DS Lite : wifi chipset pb ?

What possiblities can this program produce? Wifi Tunneling?

@_JSR_: I got a new Idea:
Saving an ammount of the packages the AP sended out/responded to the CF/SD (DLDI compatible of course ^^ ) Card and then check them afterwards to be able to crack/hack things as we like.

Is this understandable English ?

@Jester:
Sorry Mate, but what are you talking about ? This is a Wifi Package INJECTION Hack Software which currently can only flood networks... tunneling is something VERY different .

oh i see what thanks but what can flooding networks do?

Flooding networks is good for being able to start a hacker attack e.g. get the trafic high and then crack the WEP / WPA Key using the responded packages.

Thats atleast the way I think it works ^^ .

@_JSR_: Couldn?t you just port Aircrack, Kismet and Airdump instead of this or do they have the same limitations ?

Thank you for your interest :)

Saving an ammount of the packages the AP sended out/responded to the CF/SD (DLDI compatible of course ^^ ) Card and then check them afterwards to be able to crack/hack things as we like.

This is what i want to do when my program is able to capture data sended by various client at over 2mbit/s
All wifi capture program that can be ported on NDS are stuck with this problem.
Porting Aircrack is useless as the NDS cpu is too slow for things like that and you can use a computer for it instead.

I hope someone have the magical fix for this problem. Because when i got it, we could have a complete solution for wifi hacking !

Speaking of wifi, is the DS capable of WPA?