Skip to main content

ALFA AWUS036H (rtl8187) and linux kernel 2.6.28 - the ultimate ALFA driver

Notice: This tutorial is not only intended for AWUS036H or rtl8187 users, as the mac80211 stack in 2.6.28 is very nice, this tutorial should be helpful/useful for anyone with a wireless card supported by the mac80211 stack.

Updates:
09/01/09 17:24CET: fixed a bug in "mac80211_2.6.28-rc8-wl_frag+ack_radiotap_2.6.28_mod.patch" please redownload (h t t p : / / astray.fragstore.net/apps/mac80211_2.6.28-rc8-wl_frag+ack_radiotap_2.6.28_mod.patch)

Hey,

it seems like the documentation about the Realtek 8187 chipset and aircrack-ng, as well as some of the
forum posts are a bit outdated - they usually cover the r8187 driver, old mac80211 and ndiswrapper things for WPA authentication.
I've been searching for a complete solution, which allows me to use the ALFA AWUS036H in monitor mode, packet injection, fragmentation
attacks, aswell as authenticating with my AP using WPA or WPA2 without driver switching and other hassles, without much success. (e.g. h t t p : / / forums.remote-exploit.org/showthread.php?t=15497)

So I asked in the aircrack-ng IRC chan about the problem and got an answer by hdm, who told me that the mac80211 implementation in the current 2.6.28 linux kernel is very good.

The outcome of compiling a new 2.6.28 kernel with the current aircrack-ng SVN patches and the aircrack-ng trunk was everything I wanted:
full compatibility to aircrack-ng
wpa_supplicant wpa/wpa2 authentication (without a hassle)
support of all aireplay-ng attack modes
about 500 packets per second injection rate
full iwconfig support including setting TX-Power
All this without driver switching, ndiswrapper scripts or anything.

To perhaps save you guys some time, here are the necessary steps to take after you've compiled/got the new 2.6.28 kernel
(h t t p : / / forums.remote-exploit.org/showpost.php?p=113187&postcount=1):

- have a 2.6.28 final kernel ready (h t t p : / / w w w . kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2), I won't cover how to compile the kernel, as there are several tutorials available (google for "slackware kernel compile"), basically you need to find the .config file of your current kernel, unzip the contents of the new kernel to /usr/src/linux-something/, copy the .config there, then "make oldconfig && make bzImage && make modules && make modules_install && cp arch/x86/bzImage /boot/vmlinuz", and editing your grub/LILO config should do the trick basically

- be sure the mac80211 module is activated in your kernel config

download the following patches:
h t t p : / / trac.aircrack-ng.org/export/1330/trunk/patches/rtl8187-mac80211-injection-speed-2.6.28-rc6.patch
h t t p : / / astray.fragstore.net/apps/mac80211_2.6.28-rc8-wl_frag+ack_radiotap_2.6.28_mod.patch
h t t p : / / astray.fragstore.net/apps/rtl8187-mac80211-pwr.patch

- copy the just downloaded patches to your kernel source folder (will be "/usr/src/linux/" from now on)
- cd /usr/src/linux/
- copy the following files to a safe place:
drivers/net/wireless/rtl818x/rtl8187_dev.c
include/net/ieee80211_radiotap.h
net/mac80211/tx.c
drivers/net/wireless/rtl8187_dev.c (not sure about this one)

Make a dry-run of all patches over your kernel sources:
patch -Np1 --dry-run -i mac80211_2.6.28-rc8-wl_frag+ack_radiotap_2.6.28_mod.patch
patch -Np1 --dry-run -i rtl8187-mac80211-injection-speed-2.6.28-rc6.patch
patch -Np1 --dry-run -i rtl8187-mac80211-pwr.patch

If everything goes without errors, remove "--dry-run" from the commands issued above to finally patch the sources.

Note:
"mac80211_2.6.28-rc8-wl_frag+ack_radiotap_2.6.28_mod.patch" is a modified version of the original 2.6.28-rc8 wl_frag+ack radiotap patch from aircrack SVN (h t t p : / / trac.aircrack-ng.org/browser/trunk/patches/mac80211_2.6.28-rc8-wl_frag%2Back_radiotap.patch), which results in a compiling error because of a duplicate line, in 2.6.28 final.

After patching the sources redo "make modules && make modules_install" and reboot the system.

Known issues:
PWR-tab in airodump-ng shows negative values for me (without the PWR patch it doesn't show any values in PWR-tab)
"airmon-ng start wlan0" and "ifconfig wlan0 up" take about 5 seconds to bring the interface up

Comments

Popular posts from this blog

Test New ALFA-AWUS036H v.2 (1.000mW) VS ALFA-AWUS036H v.1 (500mW)

- Recently emerged the New ALFA-AWUS036H v.2 (1.000mW), and these are the tests. TEST WITH NETSTUMBLER 1) usb da 100mW chipset railink 2) usb da 200mW chipset railink rt73 3) intel 2200 b/g con connettore esterno rp-sma 4) Alfa-AWUS036H 500mW 5) New Alfa-AWUS036H V2 da 1.000mW

TBS5520 Multi-standard TV Tuner USB Box review

Noul TBS5520 Multi-standard TV Tuner USB Box a celor de la TBS se foloseste de RafaelMicro R848 multi-standard tuner si  AVL6882 Demodulator pentru a reda urmatoarele standarde: ETSI EN 302-755 V1.3.1 (DVB-T2/T2-Lite) ETSI EN 300-744 V1.6.1 (DVB-T) ETSI EN 300-429 V1.2.1 (DVB-C) ETSI EN 307-421 V1.2.1 (DVB-S2) ETSI EN 300-421 V1.1.2 (DVB-S) ARIB STD-B31 V1.6-E2 (ISDB-T) ITU-T J.83 Annex B 12/2007 (J.83/B) http://www.tbsdtv.com/products/tbs5520_multi-standard_tv_tuner_usb_box.html Pe aspectul fizic nu insist, sunt destule fotografii pe internet, vreau doar sa punctez cateva aspecte: pentru alimentare este necesar cablu Y USB - este singura modalitate de a furniza energie si de aici avem o limitare in ceea ce priveste functionalitatea cu motor HH mobilitate sporita si posibilitatea alimentarii directe din bateria unui notebook sau chiar conectarea la Tableta Android (de indata ce driverele vor fi gata) “TBS 5520 USB2.0 in warm state” nici rece dar nici fierbin

FTS4BT Wireless Bluetooth® Protocol Analyzer & Packet Sniffer

Complex & Ever Changing Bluetooth is an extremely complex software and hardware technology that is evolving fast. Even the most experienced Bluetooth developers and test engineers are challenged by keeping up with the latest changes from the baseband all the way to the profile level. Interoperability There are now enough Bluetooth-enabled devices on the market to prove that the technology is viable. Commercial success is tied to making sure that your devices interoperate smoothly so consumers can realize the benefits of Bluetooth. Currently Supported Version 2.1+EDR Features: Extended Inquiry Response. Secure Simple Pairing. QoS. Non-Automatically Flushable Packet Boundary Flag. Sniff Subrating. Erroneous Data Reporting. Encryption Pause and Resume. Link Supervision Timeout Changed Event. Security Mode 4. Supports EDR (Enhanced Data Rate): FTS4BT is the only analyzer currently on the market to support Bluetooth v2.1 + EDR. Finger-sized Bluetooth ComProbe: Air sniffing hardware