Intel iwlwifi drivers with injection * WORKING with 3945 & 4965 cards *

[GM]

I am just an idiot, after what GM said I wanted to try mon0 but by habit I typed wlan0 everytime ! Now I figured out that it was mon0 and surprise...

I don't know why you got that habit in the first place.
Injection can't ever work with mac80211 on wlan0 afaik...
You need to create mon0, then inject on mon0...

Also, in the future, it would be nice if you didn't post all your console output... It is pure spam for this thread.
If you absolutely have to, just attach it as text files, so people don't have to scroll 10 pages to read 

[.NetRolller 3D]

This is a known bug in the driver, where the channel gets reset to 1 every time a data packet is injected. A patch for this is on the way, it should get into compat-wireless in the coming days.

Really? I don't recall ever seeing that. Where did you see that bug/patch?

It was posted on the ipw3945-devel mailing list. The patches are named "patch for incorrect monitor mode operation on 3945" and "patch for incorrect monitor mode operation on 4965".

BTW the IWL5000 is a combined WiFi-AGN/WiMAX card.

As I thought... Didn't see much info though at Intel's site. I think there aren't many computers shipping with it yet, or maybe none at all

It will be used in Centrino 2 and Atom-based systems.

[deathwest]

I am just an idiot, after what GM said I wanted to try mon0 but by habit I typed wlan0 everytime ! Now I figured out that it was mon0 and surprise...

I don't know why you got that habit in the first place.
Injection can't ever work with mac80211 on wlan0 afaik...
You need to create mon0, then inject on mon0...

Also, in the future, it would be nice if you didn't post all your console output... It is pure spam for this thread.
If you absolutely have to, just attach it as text files, so people don't have to scroll 10 pages to read 

Yes I know, I will be more careful now with my console listings. I never used airmon-ng start wlan0, before I had the habit to use ipwraw and you can inject without doing that.

[deathwest]

Ok injection works but only the first time :

03:37:53  Trying directed probe requests...
03:37:53  00:18:39:4B:A2:4D - channel: 3 - 'Hello'
03:37:56  Ping (min/avg/max): 1.604ms/91.186ms/114.763ms Power: 104.87
03:37:56  30/30: 100%

03:37:56  Injection is working!

root@ubuntu:/lib/firmware# aireplay-ng -9 mon0
03:37:57  Trying broadcast probe requests...
03:37:59  No Answer...
03:37:59  Found 1 AP

03:37:59  Trying directed probe requests...
03:37:59  00:18:39:4B:A2:4D - channel: 3 - 'Hello'
03:38:05   0/30:   0%

root@ubuntu:/lib/firmware# aireplay-ng -9 mon0
03:38:06  Trying broadcast probe requests...
03:38:08  No Answer...
03:38:08  Found 1 AP

03:38:08  Trying directed probe requests...
03:38:08  00:18:39:4B:A2:4D - channel: 3 - 'Hello'
03:38:14   0/30:   0%

root@ubuntu:/lib/firmware# aireplay-ng -9 mon0
03:38:14  Trying broadcast probe requests...
03:38:16  No Answer...
03:38:16  Found 1 AP

03:38:16  Trying directed probe requests...
03:38:16  00:18:39:4B:A2:4D - channel: 3 - 'Hello'
03:38:22   0/30:   0%

[grandstream]

Hi guys, I have gotten my 4965 with injection working via deathwest's steps. I will just compile them here
aptitude install kernel-package  libnl-dev libssl-dev ( Packages required or you will face problem for compiling some of the source later)

All steps assumed you're root, else add sudo to every command.
wget http://http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.25.4.tar.gz

cp linux-2.6.25.4.tar.gz /usr/src

tar -vxzf linux-2.6.25.4.tar.gz

cd /usr/src/linux-2.6.25.4
 
cp your .config from your old kernel or /boot/ to new kernel source directory (/usr/src/linux-2.6.25.4)

I didn't really do any changes to  .config, if you wanna customize the kernel modules type : make menuconfig     ( You have to install ncurses-dev first)

make-kpkg clean

make-kpkg --initrd kernel_image kernel_headers modules_image

after the kernel is compiled. Install the package with

dpkg -i  /usr/src/linux-image-2.6.25.4*.deb

Reboot and boot into your newly installed kernel.

After reboot let's install compat wireless

cd /usr/src

wget http://www.orbit-lab.org/kernel/compat-wireless-2.6/2008/06/compat-wireless-2008-06-25.tar.bz2
wget http://patches.aircrack-ng.org/mac80211_2.6.26-rc6-wl_frag.patch
download http://tinyshell.be/aircrackng/forum/index.php?action=dlattach;topic=2898.0;id=360 into /usr/src for 0001-iwlwifi-Fix-packet-injection-in-iwl3945-and-iwl4965.patch

decompress and extract compat-wireless

bunzip2 compat-wireless-2008-06-25.tar.bz2
tar -vxf compat-wireless-2008-06-25.tar

cd compat-wireless-2008-06-25
patch -p1 < /usr/src/0001-iwlwifi-Fix-packet-injection-in-iwl3945-and-iwl4965.patch
patch -p1 < /usr/src/mac80211_2.6.26-rc6-wl_frag.patch
make
make install
make load
modprobe -r iwl4965
modprobe iwl4965

Now copy the iwl4965 firmware to /lib/firmware/

wget http://www.intellinuxwireless.org/iwlwifi/downloads/iwlwifi-4965-ucode-4.44.1.20.tgz
tar -vxzf http://www.intellinuxwireless.org/iwlwifi/downloads/iwlwifi-4965-ucode-4.44.1.20.tgz
cp ./iwlwifi-4965-ucode-4.44.1.20/iwlwifi-4965-1.ucode  /lib/firmware/

Now install aircrack rc1 and iw.tar. If you have install aircrack-ng, type aptitude remove aircrack-ng

wget http://download.aircrack-ng.org/aircrack-ng-1.0-rc1.tar.gz
wget http://dl.aircrack-ng.org/iw.tar.bz2

bunzip2 iw.tar.bz2
tar -vxf iw.tar
make
make install

tar -vzxf aircrack-ng-1.0-rc1.tar.gz
cd aircrack-ng-1.0-rc1
make
make install

ifdown wlan0
airmon-ng start wlan0
aireplay-ng -9 mon0

dang dang your injection should work!

[zaidan]

Hi again!

Wow, u made a lot of progress in just 2 weeks. I've been in holidays 10 days and today i'm back home.
I've read all posts and it seems that work is almost done.
I'll try the steps described by grandstream and post my results asap.

Congratulations for your great work!

[XAVeRY]

I also got injection to work over here on my iwl4965. Kernel 2.6.25.9 (custom) and compat-wireless 2008-06-25 with Zhu Yi's patch and mac80211 fragmentation patch.

Here are my results :

Code:

daniel@Jurij# aireplay-ng -9 mon0
12:02:45  Trying broadcast probe requests...
12:02:46  Injection is working!
12:02:47  Found 1 AP

12:02:47  Trying directed probe requests...
12:02:47  AA:BB:CC:DD:EE:FF - channel: 1 - 'NewOrder'
12:02:50  Ping (min/avg/max): 1.465ms/101.955ms/139.868ms Power: 234.97
12:02:50  30/30: 100%

Somehow, I still can't get the card to authenticate with the AP. I think it's because of the mentioned bug regarding channel-hopping when using monitor mode.

Would somebody be nice enough to update the wiki page for iwl4965? I tried to do it myself, but somehow couldn't find a way to edit it. I'd be glad to write something to be put there.

[darkAudax]

XAVeRY,

In the interim, I have added links to iwl4965 page to messages here.  If you post the write-up you would like on the wiki, I will add it.

Thanks for your offer to help.

d.

[XAVeRY]

Here's my work intended for the wiki. I don't know if it's maybe too detailed or too generic, feel free to comment and make changes as you wish.

[darkAudax]

XAVeRY,

Added.  Thanks.

d.

[KoVaLL]

I`ve done everything with Grandstream`s sollution, but when I modprobe iwl4965 i got many "undefined symbol" errors in dmesg... (also some simillar warnings when compiling)
I remember that I was many times trying to compile kernel and compat-wireless about two months ago and i got the same problem... ;/
Does anybody have some idea how can I fix it?
(sorry for my english... )

[XAVeRY]

Compile everything (that is, as much as you can) in Networking -> Wireless as modules.

[GhostR]

Hello

I always get errors when i "modprobe iwl4965" like KoVaLL.

Code:

user@user-laptop:~$ sudo modprobe iwl4965
WARNING: Error inserting iwlcore (/lib/modules/2.6.25.9/updates/drivers/net/wireless/iwlwifi/iwlcore.ko): Unknown symbol in module, or unknown parameter (see dmesg)
FATAL: Error inserting iwl4965 (/lib/modules/2.6.25.9/updates/drivers/net/wireless/iwlwifi/iwl4965.ko): Unknown symbol in module, or unknown parameter (see dmesg)

I have attached dmesg | grep iwl also. Im relavilely new to linux, so i guess i made some mistakes during compiling the kernel, but i don´t know which ones. While "make oldconfig" i just selected everywhere "y" and "m".

sry for bad english

btw I have selected everything i could in Networking -> Wireless

[XAVeRY]

Read the wiki page on the iwl4965 driver, it tells you which options exactly should be marked as M (modularized) and * (built-in). -> http://aircrack-ng.org/doku.php?id=iwl4965

Also, don't use make oldconfig, since it's been deprecated for a long time. Use the replacement - make menuconfig, it's much more visually appealing and just more useful.

i guess i made some mistakes during compiling the kernel, but i don´t know which ones. While "make oldconfig" i just selected everywhere "y" and "m".

You must be very patient, then. I would've flipped out if I had to wait for the entire kernel to build.

[.NetRolller 3D]

Also, don't use make oldconfig, since it's been deprecated for a long time. Use the replacement - make menuconfig, it's much more visually appealing and just more useful.

Or, if you like GUIs, use make xconfig or make gconfig. (Oldconfig is not deprecated, it's used for updating config files written for older kernels.)