hcxdumptool and OpenWRT

[ZerBea]

Starting in February 2022, support for ARMv5 and ARMv6 architectures have been ended in Arch Linux ARM:
https://archlinuxarm.org/forum/viewtopic.php?f=3&t=15721

OpenWRT is by far the best alternative.

As of today I changed the recommendation for the operating system (README.md):

For small computer systems like a Raspberry Pi or a router I strongly recommend OpenWRT.

• lightweight
• incredible performance
• optimized WiFi drivers
• easy to install
• easy to configure
• well documented
• hcxdumptool is running out of the box (provided that OpenWRT is correctly installed and configured)

It is easy to create an image if you follow the instructions here:
https://openwrt.org/docs/guide-developer/toolchain/use-buildsystem

It is easy to compile hcxdumptool for OpenWRT, if you follow the instructions here:
https://openwrt.org/docs/guide-developer/helloworld/start

Or get a "Raspberry Pi Ready-to-use" image here:
https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi

Or get a user defined image here:
https://firmware-selector.openwrt.org/

All supported devices:
https://openwrt.org/toh/start

[vertexgamer]

oh interesting, might be useful for a headless rpi zero install

[ZerBea]

Exactly that's what it's made for:
https://github.com/ZerBea/hcxdumptool/wiki/Penetration-testing-system-1

[strasharo]

Hey @ZerBea , what's the model of the tripods you use for that Logilink panel and dish? Or they come with the antennas?

[ZerBea]

I recommend to use OpenWRT image builder to build the image for a Raspberry Pi.
And I recommend to change the default configs, because they may not work as expected, e.g.:
#421 (comment)

By the way, this also applies to KALI: hcxdumptool may not work as expected if it is not configured/customized.

[v74863]

OpenWrt works on x86 hardware as well
https://openwrt.org/docs/guide-user/installation/openwrt_x86

[ZerBea]

For the panel antennas every photo tripod is fine:
https://www.reichelt.de/stativ-tripod-reise-walimex-17996-p159787.html?&trstct=pol_1&nbc=1

for the dish a sat-tripod:
https://www.amazon.de/Microelectronic-360016-Dreibeinstativ-Satellitenantennen-Durchmesser/dp/B00FJ02URW/ref=sr_1_14?__mk_de_DE=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=ST6PY3PXZT10&dib=eyJ2IjoiMSJ9.uU0wFZjTOk9tQp2ynHLMYjjM2Irfou-nHxDO6iSQibVWlwH4_QcxAmpL8V5WsXHUVdpCYz3qW3nLGQbPjOO31N21f3LrzUzBN-FnJgXaqQpgHvEloQtJ0JdKLNAqDiw31_7IrxjNxW-VHUXCLJi1EKIsRQ2TYl663Pl1S_VkZhJwO97stGTxIU2sgdf1lnaJKC7SrmIrcSg5kFmO8jBpV6N3EfFO3VewpvMRpb_7V6A.CfKVQt-RAi7WAUITGcsH5_BT2GsBLgxo4RXjI1Z75F8&dib_tag=se&keywords=sat-stativ&qid=1728111486&sprefix=sat-stativ%2Caps%2C242&sr=8-14&th=1

or a floodlight tripod:
https://www.reichelt.de/de/en/tripod-stand-for-floodlights-black-color-vt-9546-p190976.html?GROUPID=9753&START=0&OFFSET=100&SID=93cb76921d03ba40462f089993699d8dd29aa02aaedbda4114c72&LANGUAGE=EN&&r=1

[v74863]

Hi, Mike

I was running OpenWrt on x86_64 laptop, mainly for self-education and fun. I was able to compile helloworld
Using opkg install hcxdumptool
it is possible to install your tool, but the version is outdated
hcxdumptool 6.2.4 (C) 2021 ZeroBeat

Latest release of OpenWrt (23.05.5) use kernel 5.15.167
So, theoretically it's possible to install the latest and greatest version of hcxdumptool
But that's where the trouble starts.

Latest release of SDK use gcc 12.3.0
https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/

Development snapshot use gcc 13.3.0
https://downloads.openwrt.org/snapshots/targets/x86/64/

However, you recommend gcc >= 14
https://github.com/ZerBea/hcxdumptool#requirements

Probably the best way is to compile your tool in Arch Linux, linking it to musl (OpenWrt use musl).
How to do this? Your advice is needed.
Thanks in advance.

[ZerBea]

The recommended way is to install the openwrt toolchain and to compile hcxlabtool/hcxdumtool directly to the image or to build a package.

This is the Make file to be used by the toolchain. It is designed to compile hcxlabtool (== hcxdumptool v 7.0.0).
Expect some compiler warnings, because rcascan is not completely implemented yet, but the functions are present
If you need hcxdumptool just replace hcxlabtool by hcxdumtool.

include $(TOPDIR)/rules.mk

PKG_NAME:=hcxlabtool
PKG_VERSION:=3.0.0
PKG_RELEASE:=1

SOURCE_DIR:=$HOME/openwrttools/git_hcxlaboratory
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

PKG_MAINTAINER:=ZeroBeat <zerobeat@gmx.de>
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=license.txt

include $(INCLUDE_DIR)/package.mk

define Package/hcxlabtool
	SECTION:=custom
	CATEGORY:=Custom
	DEPENDS:=+libpcap
	TITLE:=hcxlabtool
endef

define Package/hcxlabtool/description
  Small tool to capture packets from wlan devices. After capturing, upload
  the "uncleaned" cap here (https://wpa-sec.stanev.org/?submit)
  to see if your ap or the client is vulnerable by using common wordlists.
  Convert the cap to hccapx and/or to WPA-PMKID-PBKDF2 hashline (16800) with hcxpcaptool (hcxtools)
  and check if wlan-key or plainmasterkey was transmitted unencrypted.
endef

define Build/Prepare
	mkdir -p $(PKG_BUILD_DIR)
	cp $(SOURCE_DIR)/Makefile $(PKG_BUILD_DIR)
	cp $(SOURCE_DIR)/*.c $(PKG_BUILD_DIR)
	cp -r $(SOURCE_DIR)/include $(PKG_BUILD_DIR)
	$(Build/Patch)
endef


define Build/Compile
	$(MAKE) -C $(PKG_BUILD_DIR)/ \
		$(TARGET_CONFIGURE_OPTS) \
		CFLAGS="$(TARGET_CFLAGS)"
endef

define Package/hcxlabtool/install
	$(INSTALL_DIR) $(1)/usr/sbin
	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hcxlabtool $(1)/usr/sbin/
endef

$(eval $(call BuildPackage,hcxlabtool))

Everything should compile fine (e.g. cross compile for a Raspberry Pi Zero):

./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root.orig-bcm27xx/usr/lib/opkg/info/hcxlabtool.postinst
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root.orig-bcm27xx/usr/lib/opkg/info/hcxlabtool.list
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root.orig-bcm27xx/usr/lib/opkg/info/hcxlabtool.control
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root.orig-bcm27xx/usr/lib/opkg/info/hcxlabtool.prerm
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root-bcm27xx/usr/lib/opkg/info/hcxlabtool.list
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root-bcm27xx/usr/lib/opkg/info/hcxlabtool.control
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root-bcm27xx/usr/lib/opkg/info/hcxlabtool.prerm
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root-bcm27xx/root/source/hcxlabtool/include/hcxlabtool.h
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/root-bcm27xx/root/source/hcxlabtool/hcxlabtool.c
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/hcxlabtool/include/hcxlabtool.h
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/hcxlabtool/hcxlabtool.c
./build_dir/target-arm_arm1176jzf-s+vfp_musl_eabi/hcxlabtool/.pkgdir/hcxlabtool.installed

The requirements mentioned in README.md are recommendations only.
hcxdumptool/hcxlabtool and hcxtools should compile fine using a still supported gcc version
https://gcc.gnu.org/releases.html

and a still supported Linux kernel
https://www.kernel.org/

So, gcc 12.x and Linux kernel 5.15 are fine.

[ZerBea]

It is also possible to build a single package (.opkg) via the toolchain. Copy it to the target system and install it via packet manager.
https://openwrt.org/docs/guide-developer/toolchain/single.package.

[ZerBea]

The third way:
Install the development files on the target system.
Clone hcxlabtool/hcxdumptool to the target system.
Run make and make install.

[ZerBea]

Please do not use a pre-configured OpenWRT image or a pre-configured .config!
OpenWRT is designed to be a router OS and a lot of the dafault services interfere with hcxdumptool/hcxlabtool.
It is mandatory to install the toolchain.
To configure the Makefile.
To compile an image tailored to hcxdumptool/hcxlabtool.

Attached an example of a Raspberry Pi Zero .config file.
Decompress it, rename it to .config and copy it to the root directory of your toolchain (git 23.05) (don't forget to backup the old one),
Run make menuconfig to see selected tools.
config.zip

[strasharo]

@ZerBea are you using v23.05.0 currently or v23.05.5 ?

[ZerBea]

$ git branch --show-current
openwrt-23.05

Should be the latest head:

$ git log -1
commit 0f30b8d2d252af125c059cb3a499850c5a9bd315 (HEAD -> openwrt-23.05, origin/openwrt-23.05)
Author: Rosen Penev <rosenp@gmail.com>
Date:   Wed Oct 16 15:31:20 2024 -0700

    mpc85xx: p1010: fix NAND devices
    
    Upstream commit 9ba0cae3cac07c21c583f9ff194f74043f90d29c made FSL_IFC
    visible and selectable, which means that in order for MTD_NAND_FSL_IFC
    to work, it needs these two extra CONFIG options.
    
    Signed-off-by: Rosen Penev <rosenp@gmail.com>
    Link: https://github.com/openwrt/openwrt/pull/16717
    Signed-off-by: Robert Marko <robimarko@gmail.com>

[strasharo]

Got it, thank you.

[ZerBea]

If everything is fine yous should see this running hcxlabtool (the same applies to hcxdumptool) on your OpenWRT system:

$ hcxlabtool -v
hcxlabtool 7.0 (C) 2024 ZeroBeat
running on Linux kernel 5.15.164
compiled by gcc 12.3.0
compiled with Linux API headers 5.15.158
glibc (__GLIBC_MINOR__) is not defined
enabled BPF compiler

[v74863]

I managed to compile

$ hcxdumptool -v
hcxdumptool 6.3.4 (C) 2024 ZeroBeat
running on Linux kernel 5.15.167
compiled by gcc 12.3.0
compiled with Linux API headers 5.15.167
glibc (__GLIBC_MINOR__) is not defined
enabled REALTIME DISPLAY
disabled GPS support
disabled BPF compiler

We are the champions! Again! :)
I will write details later.

[ZerBea]

Glad to read that it is working, now.

[v74863]

Here are some details.
I am using Arch Linux and have installed a BuildSystem according to this link
https://openwrt.org/docs/guide-developer/toolchain/install-buildsystem#archmanjaroendeavouros

My home folder is /home/user
For the sake of brevity, I don't mention the sudo

pacman -S --needed base-devel autoconf automake bash binutils bison \
bzip2 fakeroot file findutils flex gawk gcc gettext git grep groff \
gzip libelf libtool libxslt m4 make ncurses openssl patch pkgconf \
python python-distutils-extra rsync sed texinfo time unzip util-linux wget which zlib

mkdir -p /home/user/mysources
cd /home/user/mysources
git clone https://github.com/ZerBea/hcxdumptool.git

mkdir -p /home/user/mypackages/custom/hcxdumptool
Put here this Makefile

include $(TOPDIR)/rules.mk

PKG_NAME:=hcxdumptool
PKG_VERSION:=6.3.4
PKG_RELEASE:=1

SOURCE_DIR:=$(HOME)/mysources/hcxdumptool
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

PKG_MAINTAINER:=ZeroBeat <zerobeat@gmx.de>
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=license.txt

include $(INCLUDE_DIR)/package.mk

define Package/hcxdumptool
	SECTION:=custom
	CATEGORY:=Custom
	DEPENDS:=+libpcap
	TITLE:=hcxdumptool
endef

define Package/hcxdumptool/description
  Small tool to capture packets from wlan devices. After capturing, upload
  the "uncleaned" cap here (https://wpa-sec.stanev.org/?submit)
  to see if your ap or the client is vulnerable by using common wordlists.
  Convert the cap to hccapx and/or to WPA-PMKID-PBKDF2 hashline (16800) with hcxpcaptool (hcxtools)
  and check if wlan-key or plainmasterkey was transmitted unencrypted.
endef

define Build/Prepare
	mkdir -p $(PKG_BUILD_DIR)
	cp $(SOURCE_DIR)/Makefile $(PKG_BUILD_DIR)
	cp $(SOURCE_DIR)/*.c $(PKG_BUILD_DIR)
	cp -r $(SOURCE_DIR)/include $(PKG_BUILD_DIR)
	$(Build/Patch)
endef


define Build/Compile
	$(MAKE) -C $(PKG_BUILD_DIR)/ \
		$(TARGET_CONFIGURE_OPTS) \
		CFLAGS="$(TARGET_CFLAGS)"
endef

define Package/hcxdumptool/install
	$(INSTALL_DIR) $(1)/usr/sbin
	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hcxdumptool $(1)/usr/sbin/
endef

$(eval $(call BuildPackage,hcxdumptool))

From https://downloads.openwrt.org/releases/23.05.5/targets/x86/64
download openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz
and decompress it to /home/user/sdk

Edit /home/user/sdk/feeds.conf.default

src-link mypackages /home/user/mypackages
src-git-full base https://git.openwrt.org/openwrt/openwrt.git;openwrt-23.05
#src-git packages https://git.openwrt.org/feed/packages.git^b5ed85f6e94aa08de1433272dc007550f4a28201
#src-git luci https://git.openwrt.org/project/luci.git^63ba3cba5b7bfb803a875d4d8f01248634687fd5
#src-git routing https://git.openwrt.org/feed/routing.git^e351d1e623e9ef2ab78f28cb1ce8d271d28c902d
#src-git telephony https://git.openwrt.org/feed/telephony.git^98c8a5aa4624312ed758e2e2b6d4039050a1649d

The second line above is only needed if you have enabled the BPF compiler in the
/home/user/mysources/hcxdumptool/Makefile

cd /home/user/sdk
./scripts/feeds update -a
./scripts/feeds install -a -p mypackages

You should see (partial output)

Installing all packages from feed mypackages.
Installing package 'hcxdumptool' from mypackages
Installing package 'libpcap' from base

make menuconfig
Check out the Custom (hcxdumptool) and Libraries (libpcap)
Save and then Exit

make package/hcxdumptool/compile

if all goes well, you'll see your package
ls -l /home/user/sdk/bin/packages/x86_64/mypackages

For more information, see here
https://openwrt.org/docs/guide-developer/toolchain/using_the_sdk
https://openwrt.org/docs/guide-developer/helloworld/start

By the way, the package description is outdated
https://hashcat.net/forum/thread-10253.html

[ZerBea]

Thanks for this tutorial. Arch and OpenWRT is a great combination and your comment might be useful for beginners.

[ea1kt]

Could you put more details into this tutorial?
I have followed it trying to build the package for a Raspberry Pi 4 with OpenWRT installed, and followed the steps on your tutorial using the armv8 sdk instead of the x86_64 one. When trying to install the ipk file I get
"Packages for hcxdumptool found, but incompatible with the architectures configured."

[ZerBea]

Looks like you're using the wrong SDK. As a result, your ipk (armv8 build) is incompatible.
RPi 4 is bcm2711
https://mirror-03.infra.openwrt.org/releases/23.05.5/targets/bcm27xx/bcm2711/

[ea1kt]

Compiled hcxlabtool for rpi4>

---

| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -| || | | || || |
|_____|| |||||___||| |____|
|| W I R E L E S S F R E E D O M

OpenWrt 24.10.0-rc4, r28211-d55754ce0d

root@OpenWrt:~# hcxlabtool -v
hcxlabtool 7.0 (C) 2024 ZeroBeat
running on Linux kernel 6.6.67
compiled by gcc 12.3.0
compiled with Linux API headers 5.15.167
glibc (GLIBC_MINOR) is not defined
enabled BPF compiler
and I have been testing it with several usb-wifi adapters with relative success: I get packets dropped by kernel in a percentage of 1% best case to 4% worst case. how can I do better? the point is that with arch on rpi4 I easily get no dropped packets.

[ZerBea]

Packets "dropped by kernel'' is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism of the Linux kernel itself (not the distribution). Running an interface in monitor mode produce a high workload (many incoming packets, partly oversized or damaged, which have to be processed) and the buffer runs out of space.

The bad: There is nothing that you can do to prevent that.
The good: If the packet loss is below 25%, everything is still fine.

I got drops running Arch Linux, too:

$ uname -r
6.6.69-1-lts

$ sudo hcxlabtool --rds=1 -c 1a
...
mt7601u:
5762 Packet(s) captured by kernel
15 Packet(s) dropped by kernel
exit on sigterm

rtl8188eus:
5666 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
exit on sigterm

rtl8192eu:
7101 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
exit on sigterm

[ZerBea]

I just read this:
https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1502771-ubuntu-25-04-plucky-puffin-development-opens-defaulting-to-o3-optimizations#post1502786

It fits with my comments and recommendations:
If you install Linux using the default configuration, you'll get a system which is configured for one-size-fits-all.
https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1502771-ubuntu-25-04-plucky-puffin-development-opens-defaulting-to-o3-optimizations#post1502797

And that may not be what you want.