Originally Posted by bulanula

So does this mean that your results can be replicated on any device with the wl12xx driver ?

If so, that is fantastic news. Macchanger is not a big problem at all.

Why do you still need David to help you since it seems it is 90% working ?

Originally Posted by nieldk

Got it! I will ask devs of power kernel to add these patches

We need two patches to kernel/net/wireless/chan.c and kernel/net/mac80211/tx.c

Code:

diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index b01a6f6..09d979b 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -49,9 +49,12 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
 {
 	struct ieee80211_channel *chan;
 	int result;
+	struct wireless_dev *mon_dev = NULL;
 
-	if (wdev && wdev->iftype == NL80211_IFTYPE_MONITOR)
+	if (wdev && wdev->iftype == NL80211_IFTYPE_MONITOR) {
+		mon_dev = wdev;
 		wdev = NULL;
+	}
 
 	if (wdev) {
 		ASSERT_WDEV_LOCK(wdev);
@@ -76,5 +79,8 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
 	if (wdev)
 		wdev->channel = chan;
 
+	if (mon_dev)
+		mon_dev->channel = chan;
+
 	return 0;
 }

Code:

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0855cac..221bed6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -677,11 +677,19 @@ int tid;
 
 	/*
 	 * Packet injection may want to control the sequence
-	 * number, if we have no matching interface then we
-	 * neither assign one ourselves nor ask the driver to.
+	 * number, so if an injected packet is found, skip
+	 * renumbering it. Also make the packet NO_ACK to avoid
+	 * excessive retries (ACKing and retrying should be
+	 * handled by the injecting application).
+	 * FIXME This may break hostapd and some other injectors.
+	 * This should be done using a radiotap flag.
 	 */
-	if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
+	if (unlikely((info->flags & IEEE80211_TX_CTL_INJECTED) &&
+	   !(tx->sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))) {
+		if (!ieee80211_has_morefrags(hdr->frame_control))
+			info->flags |= IEEE80211_TX_CTL_NO_ACK;
 		return TX_CONTINUE;
+	}
 
 	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
 		return TX_CONTINUE;

Originally Posted by Lucazz990

Hi,
I followed the steps in the first post and everything seems to work as expected but when at the end i type aireplay-ng -9 mon0 the output is:

16:14:49 Trying broadcast probe request...
16:14:51 No answer...
16:14:49 Found 0 APs

but there are two APs, both in wpa-psk and wep

Originally Posted by nieldk

Like said. This is unstable.
it needs more work (please follow powerkernel thread)
for some reason, this happens, i have yet to find out why.
you can make it more reliable, by opening network connection, and let the phone discover accesspoints.
Also, try experimenting with macchanger, to change mac address of mon0.
macchanger is on my openrepos (look in my signature)