Program crash with --band 5

[jules1j]

Describe the bug Program crashes when using --band 5, probably because the interface does not support all channels used by AngryOxide . To Reproduce

sudo angryoxide --interface wlo1 --band 5
Starting AngryOxide... 😈
💲 Interface Summary:
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Interface: wlo1                                                                                  ┃
┃ Index: 3 | Driver: iwlwifi                                                                       ┃
┃ Mode: IftypeMonitor | Active Monitor: false                                                      ┃
┃ Modes: Adhoc, Station, Ap, ApVlan, Monitor, P2P Client, P2P Go, P2P Device                       ┃
┃ State: Unknown                                                                                   ┃
┃ Current Frequency: 5320 (5GHz 64)                                                                ┃
┃ Band2GHz:                                                                                        ┃
┃     [2412 (1)]    [2417 (2)]    [2422 (3)]    [2427 (4)]    [2432 (5)]    [2437 (6)]             ┃
┃     [2442 (7)]    [2447 (8)]    [2452 (9)]    [2457 (10)]    [2462 (11)]    [2467 (12)]          ┃
┃     [2472 (13)]                                                                                  ┃
┃                                                                                                  ┃
┃ Band5GHz:                                                                                        ┃
┃     [5180 (36)]    [5200 (40)]    [5220 (44)]    [5240 (48)]    [5260 (52)]    [5280 (56)]       ┃
┃     [5300 (60)]    [5320 (64)]    [5500 (100)]    [5520 (104)]    [5540 (108)]    [5560 (112)]   ┃
┃     [5580 (116)]    [5600 (120)]    [5620 (124)]    [5640 (128)]    [5660 (132)]    [5680 (136)] ┃
┃     [5700 (140)]    [5720 (142)]    [5745 (149)]    [5765 (153)]    [5785 (157)]    [5805 (161)] ┃
┃     [5825 (165)]                                                                                 ┃
┃                                                                                                  ┃
┃                                                                                                  ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
💲 No target list provided... everything is a target 😏
💲 No whitelist list provided.

======== Hop Channels ========
 └ Band 5 Channels:
   ├ 36
   ├ 40
   ├ 44
   ├ 48
   ├ 52
   ├ 56
   ├ 60
   ├ 64
   ├ 68
   ├ 72
   ├ 76
   ├ 80
   ├ 84
   ├ 88
   ├ 92
   ├ 96
   ├ 100
   ├ 104
   ├ 108
   ├ 112
   ├ 116
   ├ 120
   ├ 124
   ├ 128
   ├ 132
   ├ 136
   ├ 140
   ├ 142
   ├ 149
   ├ 153
   ├ 157
   ├ 161
   ├ 165
   ├ 169
   ├ 173
   ├ 177
   └ 181
==============================

💲 Attack Rate: Normal (2)
💲 Setting wlo1 down.
💲 Randomizing wlo1 mac to 58324e148c6f
💲 Setting wlo1 to Monitor mode. ("active" flag: false)
💲 Setting wlo1 up.
💲 OUI Records Imported: 50153
💲 Sockets Opened [Rx: 5 | Tx: 6]
🎩 KICKING UP THE 4D3D3D3 🎩

======================================================================

thread 'main' panicked at /home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/nl80211-ng-0.2.6/src/lib.rs:115:18:
called `Option::unwrap()` on a `None` value
stack backtrace:
   0: rust_begin_unwind
             at /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:645:5
   1: core::panicking::panic_fmt
             at /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/panicking.rs:72:14
   2: core::panicking::panic
             at /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/panicking.rs:127:5
   3: nl80211_ng::Nl80211::set_interface_chan
   4: angryoxide::main
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Expected behavior Use only channels supported by the interface

Screenshots

Hardware:

• Device: x86_64 GNU/Linux
• OS: Ubuntu 22.04
• Interface: Intel Corporation Wireless-AC 9462

Additional context Supported Frequency list from adapter:

sudo iwlist wlo1 freq 
wlo1      32 channels in total; available frequencies :
          Channel 01 : 2.412 GHz
          Channel 02 : 2.417 GHz
          Channel 03 : 2.422 GHz
          Channel 04 : 2.427 GHz
          Channel 05 : 2.432 GHz
          Channel 06 : 2.437 GHz
          Channel 07 : 2.442 GHz
          Channel 08 : 2.447 GHz
          Channel 09 : 2.452 GHz
          Channel 10 : 2.457 GHz
          Channel 11 : 2.462 GHz
          Channel 12 : 2.467 GHz
          Channel 13 : 2.472 GHz
          Channel 36 : 5.18 GHz
          Channel 40 : 5.2 GHz
          Channel 44 : 5.22 GHz
          Channel 48 : 5.24 GHz
          Channel 52 : 5.26 GHz
          Channel 56 : 5.28 GHz
          Channel 60 : 5.3 GHz
          Channel 64 : 5.32 GHz
          Channel 100 : 5.5 GHz
          Channel 104 : 5.52 GHz
          Channel 108 : 5.54 GHz
          Channel 112 : 5.56 GHz
          Channel 116 : 5.58 GHz
          Channel 120 : 5.6 GHz
          Channel 124 : 5.62 GHz
          Channel 128 : 5.64 GHz
          Channel 132 : 5.66 GHz
          Channel 136 : 5.68 GHz
          Channel 140 : 5.7 GHz
          Current Frequency:5.32 GHz (Channel 64)

Channels that AngryOxide tries to use when --band 5 option is provided:

======== Hop Channels ========
 └ Band 5 Channels:
   ├ 36
   ├ 40
   ├ 44
   ├ 48
   ├ 52
   ├ 56
   ├ 60
   ├ 64
   ├ 100
   ├ 104
   ├ 108
   ├ 112
   ├ 116
   ├ 120
   ├ 124
   ├ 128
   ├ 132
   ├ 136
   ├ 140
   ├ 142
   ├ 149
   ├ 153
   ├ 157
   ├ 161
   ├ 165
   ├ 169
   └ 173
==============================

[Ragnt]

Hm. It’s supposed to be getting that list of frequencies from the interface.

I’ll look into this today and see what might be causing it.

Thank you for the detailed report!

[Ragnt]

What does iw list show for this interface, including disabled freqs? I’m traveling but a quick review tells me this may be related to not validating the channels available against channels that are disabled by regulation settings.

[Ragnt]

After some testing I am almost positive that was the issue and it is resolved in the dev branch, which will become 0.8.4.

[sincere360]

Hello, I was getting the same error as OP and saw you recently updated the dev branch. I tried the new version, but it's still crashing. I set up backtrace, but it doesn't seem like it's working. The wireless nic is the only spare one I had that supported 5GHz, but it works fine using the 2.4 band. I have an Alfa AWUS036ACHM coming shortly to test with as well. I posted the image below

Hardware: Raspberry Pi 4

OS: Distributor ID: Kali Description: Kali GNU/Linux Rolling Release: 2023.4 Codename: kali-rolling

Device: Startech USB867WAC22 Chipset: RTL8812AU

[Ragnt]

Certainly something very wrong happening. I’ll continue to dig into this and hopefully I can reproduce on my end. It able, can you show me the output of band 2 on iw list so I can check which channels are disabled on your system as well?

[sincere360]

Is the screenshot below what you are looking for? The screenshot in my previous post shows all supported channels in the 2 band as well. If not let me know how you would like me to run the iw command to give you the proper info you are looking for. Thanks

[Ragnt]

Sorry! Here's what I mean:

iw phy$(iw wlan1 info | grep wiphy | awk '{print $2}') info

Then the frequencies block associated with Band 2, which shows power and whether it is disabled by the regulatory domain. I'm trying to chase down if this bug is related to disabled channels so it's useful to compare the output of AO with what channels are reporting as disabled. Mine looks like:

also, your regulatory domain doesn't happen to be Japan, does it? Those freqs seem to be from 802.11j and your issue is probably because I'm not handling them well in nl80211-ng yet. I can rush this out if it is the case for you though.

[sincere360]

Thanks! for the info. No, my regulatory domain is not Japan. If you need any more info please let me know, Thanks.

Here are the screenshots you requested.

Band 2

Band 5

[Ragnt]

Thanks! Lookin further into this now; but I think the fix will be a heavier refactor of the underlying library so I’ll push it to AO as soon as I’m confident in it. I’ll post here to let you know when the dev branch is ready for testing.

I would expect less than a day but I’m traveling so we will see.

[jules1j]

What does iw list show for this interface, including disabled freqs? I’m traveling but a quick review tells me this may be related to not validating the channels available against channels that are disabled by regulation settings.

$ iw list 
Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 20
        max scan IEs length: 422 bytes
        max # sched scan SSIDs: 20
        max # match sets: 8
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports RSN-IBSS.
        Device supports AP-side u-APSD.
        Device supports T-DLS.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * GCMP-128 (00-0f-ac:8)
                * GCMP-256 (00-0f-ac:9)
                * CMAC (00-0f-ac:6)
                * GMAC-128 (00-0f-ac:11)
                * GMAC-256 (00-0f-ac:12)
        Available Antennas: TX 0x1 RX 0x1
        Configured Antennas: TX 0x1 RX 0x1
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * P2P-client
                 * P2P-GO
                 * P2P-device
        Band 1:
                Capabilities: 0x196f
                        RX LDPC
                        HT20/HT40
                        SM Power Save disabled
                        RX HT20 SGI
                        RX HT40 SGI
                        RX STBC 1-stream
                        Max AMSDU length: 7935 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 4 usec (0x05)
                HT Max RX data rate: 150 Mbps
                HT TX/RX MCS rate indexes supported: 0-7
                Bitrates (non-HT):
                        * 1.0 Mbps
                        * 2.0 Mbps (short preamble supported)
                        * 5.5 Mbps (short preamble supported)
                        * 11.0 Mbps (short preamble supported)
                        * 6.0 Mbps
                        * 9.0 Mbps
                        * 12.0 Mbps
                        * 18.0 Mbps
                        * 24.0 Mbps
                        * 36.0 Mbps
                        * 48.0 Mbps
                        * 54.0 Mbps
                Frequencies:
                        * 2412 MHz [1] (22.0 dBm)
                        * 2417 MHz [2] (22.0 dBm)
                        * 2422 MHz [3] (22.0 dBm)
                        * 2427 MHz [4] (22.0 dBm)
                        * 2432 MHz [5] (22.0 dBm)
                        * 2437 MHz [6] (22.0 dBm)
                        * 2442 MHz [7] (22.0 dBm)
                        * 2447 MHz [8] (22.0 dBm)
                        * 2452 MHz [9] (22.0 dBm)
                        * 2457 MHz [10] (22.0 dBm)
                        * 2462 MHz [11] (22.0 dBm)
                        * 2467 MHz [12] (22.0 dBm)
                        * 2472 MHz [13] (22.0 dBm)
                        * 2484 MHz [14] (disabled)
        Band 2:
                Capabilities: 0x196f
                        RX LDPC
                        HT20/HT40
                        SM Power Save disabled
                        RX HT20 SGI
                        RX HT40 SGI
                        RX STBC 1-stream
                        Max AMSDU length: 7935 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 4 usec (0x05)
                HT Max RX data rate: 150 Mbps
                HT TX/RX MCS rate indexes supported: 0-7
                VHT Capabilities (0x33907132):
                        Max MPDU length: 11454
                        Supported Channel Width: neither 160 nor 80+80
                        RX LDPC
                        short GI (80 MHz)
                        SU Beamformee
                        MU Beamformee
                        RX antenna pattern consistency
                        TX antenna pattern consistency
                VHT RX MCS set:
                        1 streams: MCS 0-9
                        2 streams: not supported
                        3 streams: not supported
                        4 streams: not supported
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT RX highest supported: 0 Mbps
                VHT TX MCS set:
                        1 streams: MCS 0-9
                        2 streams: not supported
                        3 streams: not supported
                        4 streams: not supported
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT TX highest supported: 0 Mbps
                Bitrates (non-HT):
                        * 6.0 Mbps
                        * 9.0 Mbps
                        * 12.0 Mbps
                        * 18.0 Mbps
                        * 24.0 Mbps
                        * 36.0 Mbps
                        * 48.0 Mbps
                        * 54.0 Mbps
                Frequencies:
                        * 5180 MHz [36] (22.0 dBm) (no IR)
                        * 5200 MHz [40] (22.0 dBm) (no IR)
                        * 5220 MHz [44] (22.0 dBm) (no IR)
                        * 5240 MHz [48] (22.0 dBm) (no IR)
                        * 5260 MHz [52] (22.0 dBm) (no IR, radar detection)
                        * 5280 MHz [56] (22.0 dBm) (no IR, radar detection)
                        * 5300 MHz [60] (22.0 dBm) (no IR, radar detection)
                        * 5320 MHz [64] (22.0 dBm) (no IR, radar detection)
                        * 5340 MHz [68] (disabled)
                        * 5360 MHz [72] (disabled)
                        * 5380 MHz [76] (disabled)
                        * 5400 MHz [80] (disabled)
                        * 5420 MHz [84] (disabled)
                        * 5440 MHz [88] (disabled)
                        * 5460 MHz [92] (disabled)
                        * 5480 MHz [96] (disabled)
                        * 5500 MHz [100] (22.0 dBm) (no IR, radar detection)
                        * 5520 MHz [104] (22.0 dBm) (no IR, radar detection)
                        * 5540 MHz [108] (22.0 dBm) (no IR, radar detection)
                        * 5560 MHz [112] (22.0 dBm) (no IR, radar detection)
                        * 5580 MHz [116] (22.0 dBm) (no IR, radar detection)
                        * 5600 MHz [120] (22.0 dBm) (no IR, radar detection)
                        * 5620 MHz [124] (22.0 dBm) (no IR, radar detection)
                        * 5640 MHz [128] (22.0 dBm) (no IR, radar detection)
                        * 5660 MHz [132] (22.0 dBm) (no IR, radar detection)
                        * 5680 MHz [136] (22.0 dBm) (no IR, radar detection)
                        * 5700 MHz [140] (22.0 dBm) (no IR, radar detection)
                        * 5720 MHz [144] (22.0 dBm) (no IR, radar detection)
                        * 5745 MHz [149] (22.0 dBm)
                        * 5765 MHz [153] (22.0 dBm)
                        * 5785 MHz [157] (22.0 dBm)
                        * 5805 MHz [161] (22.0 dBm)
                        * 5825 MHz [165] (22.0 dBm)
                        * 5845 MHz [169] (disabled)
                        * 5865 MHz [173] (disabled)
                        * 5885 MHz [177] (disabled)
                        * 5905 MHz [181] (disabled)
        Supported commands:
                 * new_interface
                 * set_interface
                 * new_key
                 * start_ap
                 * new_station
                 * new_mpath
                 * set_mesh_config
                 * set_bss
                 * authenticate
                 * associate
                 * deauthenticate
                 * disassociate
                 * join_ibss
                 * join_mesh
                 * remain_on_channel
                 * set_tx_bitrate_mask
                 * frame
                 * frame_wait_cancel
                 * set_wiphy_netns
                 * set_channel
                 * tdls_mgmt
                 * tdls_oper
                 * start_sched_scan
                 * probe_client
                 * set_noack_map
                 * register_beacons
                 * start_p2p_device
                 * set_mcast_rate
                 * connect
                 * disconnect
                 * channel_switch
                 * set_qos_map
                 * add_tx_ts
                 * set_multicast_to_unicast
        WoWLAN support:
                 * wake up on disconnect
                 * wake up on magic packet
                 * wake up on pattern match, up to 20 patterns of 16-128 bytes,
                   maximum packet offset 0 bytes
                 * can do GTK rekeying
                 * wake up on GTK rekey failure
                 * wake up on EAP identity request
                 * wake up on 4-way handshake
                 * wake up on rfkill release
                 * wake up on network detection, up to 8 match sets
        software interface modes (can always be added):
                 * AP/VLAN
                 * monitor
        valid interface combinations:
                 * #{ managed } <= 1, #{ AP, P2P-client, P2P-GO } <= 1, #{ P2P-device } <= 1,
                   total <= 3, #channels <= 2
        HT Capability overrides:
                 * MCS: ff ff ff ff ff ff ff ff ff ff
                 * maximum A-MSDU length
                 * supported channel width
                 * short GI for 40 MHz
                 * max A-MPDU length exponent
                 * min MPDU start spacing
        Device supports TX status socket option.
        Device supports HT-IBSS.
        Device supports SAE with AUTHENTICATE command
        Device supports low priority scan.
        Device supports scan flush.
        Device supports per-vif TX power setting
        P2P GO supports CT window setting
        P2P GO supports opportunistic powersave setting
        Driver supports full state transitions for AP/GO clients
        Driver supports a userspace MPM
        Driver/device bandwidth changes during BSS lifetime (AP/GO mode)
        Device adds DS IE to probe requests
        Device can update TPC Report IE
        Device supports static SMPS
        Device supports dynamic SMPS
        Device supports WMM-AC admission (TSPECs)
        Device supports configuring vdev MAC-addr on create.
        Device supports randomizing MAC-addr in scans.
        Device supports randomizing MAC-addr in sched scans.
        Device supports randomizing MAC-addr in net-detect scans.
        max # scan plans: 2
        max scan plan interval: 65535
        max scan plan iterations: 254
        Supported TX frame types:
                 * IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
        Supported RX frame types:
                 * IBSS: 0x40 0xb0 0xc0 0xd0
                 * managed: 0x40 0xb0 0xd0
                 * AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
                 * AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
                 * mesh point: 0xb0 0xc0 0xd0
                 * P2P-client: 0x40 0xd0
                 * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
                 * P2P-device: 0x40 0xd0
        Supported extended features:
                * [ VHT_IBSS ]: VHT-IBSS
                * [ RRM ]: RRM
                * [ MU_MIMO_AIR_SNIFFER ]: MU-MIMO sniffer
                * [ SCAN_START_TIME ]: scan start timestamp
                * [ BSS_PARENT_TSF ]: BSS last beacon/probe TSF
                * [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
                * [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
                * [ FILS_MAX_CHANNEL_TIME ]: FILS max channel attribute override with dwell time
                * [ ACCEPT_BCAST_PROBE_RESP ]: accepts broadcast probe response
                * [ OCE_PROBE_REQ_HIGH_TX_RATE ]: probe request TX at high rate (at least 5.5Mbps)
                * [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
                * [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
                * [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
                * [ ENABLE_FTM_RESPONDER ]: enable FTM (Fine Time Measurement) responder
                * [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
                * [ PROTECTED_TWT ]: protected Target Wake Time (TWT) support
                * [ DEL_IBSS_STA ]: deletion of IBSS station support
                * [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
                * [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support

[Ragnt]

@sincere360 It's an early fix and there may be issues but I have rewritten the channel system to be mostly dynamic, based on how iw is doing it.

It's been pushed to the dev branch, I'm hoping it will fix this for good. Let me know how it reacts to those weird channels.

@jules1j I can't say for sure obviously but I am almost positive your issue was fixed when I started checking for disabled channels before adding them. I was able to recreate it locally by messing with my regulatory settings and the fix already implemented on the dev branch fixed it on my end.

[sincere360]

I just compiled the latest and it's up and running currently. Will let you know if I run into any bugs. Thank you for looking into it and fixing it.

[Ragnt]

Sure thing! Let me know.