search

seemoo-lab / mobisys2018_nexmon_channel_state_information_extractor

Example project for extracting channel state information of up to 80 MHz wide 802.11ac Wi-Fi transmissions using the BCM4339 Wi-Fi chip of Nexus 5 smartphones.
Other
98 stars 39 forks source link

“__nex_driver_io: error”, how to solve ? #15

Open cumtlitao opened 5 years ago

cumtlitao commented 5 years ago

Hello, After we complete the installation, when we execute "nexutil -s500 -l20 -b -vZNABAIAAAAD///////+cIWoPIF4=", such a error “__nex_driver_io: error” occurred. We don't know what went wrong. Could you give us some advice? We would appreciate your help very much. Looking forward to your reply .

intarian commented 5 years ago

are u sure ur wlan0 is up. In adb shell type su to get root access and then: ifconfig wlan0 up to make the wifi up again.

cumtlitao commented 5 years ago

Thank you for your quick reply. We're sure we have connected to the wlan and we get root access in adb shell type and executed ifconfig wlan0 up to make the wifi up again. However, "__nex_driver_io: error" still appeared. We tried again later and found that the key of the error was the "-s500". We do not know how to set "-s500 "and "-l20" in command "nexutil -s500 -l20 -b -vznabaiaaaad ////+cIWoPIF4=". We hope you can give us some advice on how to set up these two commands "-s500 "and "-l20". In addition, we don't understand the means of "64d0010080000000ffffffffffff " in command "echo" 64d0010080000000ffffffffffff001122334455 "| XXD -r -p | base64". We just use our wlan MAC address replace "001122334455". Could you give us some suggestions about the means of "64d0010080000000ffffffffffff "? Thank you very much for your help. Looking forward to your reply .

intarian commented 5 years ago

Well in my case nex_driver error appears only when the wlan0 is down. this happens after restart. I will suggest you to follow the guidelines again. Re-install stock ROM on Nexus 5, root it again and follow the guidelines till make install in utilities. Even if you run nexutil -m the error will appear, I don't think the error is due to -s500. As far as I understant -s500 is the method they are using to enable csi extraction function and I have no idea about -l20.

intarian commented 5 years ago

For your next question: 64d0 represents the channel 100 in 5Ghz band with bandwidth of 20MHz. I guess the rest is the payload (I guess this is the standard payload of beacon frame) followed by MAC address of the AP. Run this command on your host i.e. ubuntu machine. This will give you encoded payload. Use this payload in nexutil -s500 command. I was able to capture some UDP packets on 5Ghz band and nothing in 2.4Ghz, I guess I have alot of 2.4Ghz traffic here, so I am sticking with 5Ghz.
How to know 64d0 represents channel 100 in 5Ghz band? The answer to this lies in https://github.com/seemoo-lab/nexmon/blob/master/patches/include/channels.h file. channel 100 in hex is 64 and 5Ghz band is represented as 0xc0 and 20Mhz bandwidth is represented as 0x10 taking or between 0xc0 + 0x10 = 0xd0 Use windows calculator.

cumtlitao commented 5 years ago

Thank you very much. We have understood the meaning of these commands through your detailed answer, and we will try to reinstall to solve this error. Thank you very much once again.

cumtlitao commented 5 years ago

Hello, We have reinstalled according to the steps in the guide. This time all the installations were successful and there were no errors. However, after the execution of "nexutil -s500 - l20 - b - vJNABAIAAAAD / / / / / / / / QducElsg =", the function of the mobile WiFi becomes unavailable. And when we rerun step 12 "make install-firmware", the function of the mobile WiFi returns to normal again. We've tried this multiple times on two nexus 5 phones, and it occurs the same problem. Would you please give us some advice? Thank you very much.

intarian commented 5 years ago

Hi! As per my understanding. When you clone this repo and run make install-firmware, mobile wifi doesn't work in managed mode. Hence, you can't connect it to a certain Access Point. Use ADB shell and ifconfig to make sure you have wlan0 available. Alternatively, you can run ifconfig wlan0 up to make sure the wifi is recognized by the Android OS. You can use it in monitor mode as per given instructions. And by using the MAC address of the Access Point and knowing its frequency and bandwidth you can capture its beacon frames. I suggest you use a 5Ghz Access Point.

cumtlitao commented 5 years ago

Thanks for your reply. We have cloned this repo and run "make install-firmware", it have been successfully installed in our nexus5. Then we run "adb shell" and "ifconfig wlan0 up" to make sure we have wlan0 available. But every time we run "nexutil -s500 - l20 - b - vJNABAIAAAAD / / / / / / / / QducElsg =" , the wlfi of our mobile phone(nexus5) becomes unavailable. Then we run "ifconfig wlan0 up", and wlan0 is still unavailable. However, when we first run "ifconfig wlan0 down" and then run "ifconfig wlan0 up",the wlan0 becomes available. Then we run "nexutil -m1" and "tcpdump -i wlan0 -xxx -c 2000 -w /sdcard/csi.pcap". We got csi.pcap, and we ran it in matlab. We found that all the data in it was 0.

intarian commented 5 years ago

Apologies for the late reply! Here are the steps that I have taken to run this repo: 1- Make sure you have followed all the steps of installation. 2- Run make install-firmware to install the nexmon channel state information extractor 3- Reboot the mobile 4- run into adb shell 5- take root access 6- run ifconfig wlan0 down up 7- run your nexutil -s500 - l20 - b - vJNABAIAAAAD / / / / / / / / QducElsg =. Where JNABAIAAAAD / / / / / / / / QducElsg = is your generated payload which includes MAC address, wifi band and bandwidth of AP 8- run into monitor mode nexutil -m1 9- capture the dump file bu using tcpdump -i wlan0 -v -w /sdcard/csi.pcap 10- analyze the tcpdump in wireshark and make sure you are getting UDP packets. If tcpdump doesn't contain UDP packets, then make sure you are on free channel without any interference from adjacent channels and on Band 5Ghz. As in my case, I didn't get any UDP packets in 2.4Ghz band. If the problem still persists, I can look into your issue with Teamviewer/skype etc.

cumtlitao commented 5 years ago

Thank you for your detailed reply. After receiving your reply last night, we immediately followed the steps you provided to execute the corresponding operations. However, after rebooting the phone in the step 3, the Wifi function of the phone became unavailable. We executed the same operations on another phone, and the same problem happened. Moreover, WiFi cannot be turned on by using "ifconfig wlan0 down up". We executed "make install-firmware" again, but the WiFI function of the mobile phone didn't return to normal. We also tried to restore factory Settings, and root again. And then we reinstall, it still could not restore the WiFi function of the phone. We plan to buy two more nexus 5 phones, and we hope to make a time with you to make video calls using skype. My skype account is ts17170015a3@cumt.edu.cn. And my name is Tao Li. We hope you can add my skype friends, so that we can communicate directly on skype. We sincerely thank you for your warm and earnest help. Looking forward to your reply.

intarian commented 5 years ago

What exactly you mean when you can't restore the wifi function back to normal ? You can't use wifi in normal/managed mode after running make install-firmware. Hence, you can't connect to access point and browse internet. If you want that functionality you have to re-install stock ROM from scratch (https://developers.google.com/android/ota#hammerhead) . I have struggled with the same problem and turns out re-installing the stock ROM was the only option to restore wifi function back to normal. I will send you the invite on skype.