qkaiser / broadcom-wps

# Broadcom 802.11 SDK Detection Toolkit
This repository contains two ways to detect the presence of Broadcom's 802.11 implementation on a target router:
1. Statically using YARA rules on extracted firmware
2. Dynamically by running a fingerprinting script against a live access point
The list of affected devices is available at the end of this page. **This list is not exhaustive**. We expect the complete list to contains thousands of different devices, make and models.
## Broadcom WPS Monitor YARA rules
`broadcom_wps_monitor.yar` contains three candidate detectors for ELF32 ARM and
MIPS binaries:
- `BRCM_WPS_Monitor_Generic_ELF` identifies a generic Broadcom WPS Monitor
 binary from independent vendor and protocol strings.
- `BRCM_WPS_Monitor_HAL_Config_ELF` identifies the narrower HAL configuration
 event variant.
- `VULN_BRCM_WPS_EAP_Fragment_Reassembly_ELF` requires the generic component
 evidence plus an ARM or MIPS opcode shape associated with the vulnerable
 fragment-reassembly path.
These rules are triage aids. Compiler changes can evade
opcode patterns, and a patched binary can retain strings or code bytes used by
a candidate detector. Confirm findings against the integrated source or by
manual review of the fragment-length validation and copy sink.
You can find binaries with this command:
 [code] 
## Broadcom SDK Fingerprinter
Make sure your interface supports monitor mode and enable monitor mode:
 [code] 
> **Note on hardware:** monitor mode / frame injection is very driver-dependent.
> In my testing the built-in **Intel Dual Band Wireless-AC 7265** (`iwlwifi`)
> accepted `type monitor` but captured **zero** frames (no beacons even with a
> strong signal), so the fingerprinter never locked onto a target. A USB adapter
> with a MediaTek chipset — **MT7921AU** (USB id `0e8d:7961`, driver `mt7921u`) —
> worked immediately. If the script keeps sweeping without finding your SSID,
> suspect the adapter rather than the target. Known-good chipsets for this kind
> of work include MediaTek `mt76`, Atheros `ath9k_htc`, and Realtek `rtl8812au`.
You should seem something like this on affected devices:
 [code] 
 [code] 
 [code] 
On patched devices you'll see:
 [code] 
If your device does not advertise WPS it's not affected and you'll see this:
 [code] 
The fingerprinting script relies on two things:
1. the presence of Broadcom proprietary information elements
2. an implementation quirk that can differentiate between Broadcom's wps_monitor and hostapd
The presence of Broadcom proprietary information element is not a sufficiently
strong signal since it's sometimes added by Broadcom's Linux kernel module
while the user space implementation is not from their SDK. We use that signal
to check if it's Broadcom or not.
If it's a Broadcom AP, we send a zero-length fragmented frame to differentiate
between Broadcom's wps_monitor and hostapd. hostapd sends an ACK while
wps_monitor sends a NACK (in a nutshell).
If we have both signals (Broadcom IE + implementatio