NexMon is a firmware patching framework for the BCM4339 WiFi firmware of Nexus 5 smartphones. It's main intension was to enable monitor mode and frame injection, which is already working quite well. Nevertheless, we also publish many example patches that allow to dive into firmware reverse engineering and firmware patching. Especially, the ability to write firmware patches in C makes it easy to use, also for beginners.
If you only intend to activate monitor mode on a device using the bcmdhd driver, take a look at the following commit: ed11c18
- We moved to GitHub!
- You can now follow us on twitter: @nexmon_dev
- Monitor Mode for the Raspberry Pi 3: rpi3.nexmon.org
Our software may damage your hardware and may void your hardware’s warranty! You use our tools at your own risk and responsibility! If you don't like these terms, don't use nexmon!
- A bootable boot ROM for Android
- Everything needed to build the ROM by yourself
- Nexus 5 with bcm4339 chipset
- Your bootloader needs to be unlocked (no root required)
- Android 6.0 or 6.0.1
- Android Tools (adb + fastboot)
- Xubuntu 14.04.4 64-Bit (do not use a different version to avoid compilation problems)
- set the environment variable
NDK_ROOTto an installation of android-ndk-r11c (using exactly this version allows to build all tools without problems)
- Download the boot.img (this project is still in heavy development, the monitor mode should work on the boot.img in this commit though: 2c39825)
adb reboot bootloaderfastboot boot boot.img- without the
flashparameter, this boot image will be reset to the previous one on the next reboot
- without the
fastboot rebootadb shellsuinsmod /nexmon/bcmdhd.koifconfig wlan0 upnexutil -m truethis tells the firmware to activate monitor mode- do whatever you want, e.g. run tcpdump:
/nexmon/bin/tcpdump -i wlan0 -s0
source setup_env.shmake cleanbootmake boot.img
- see the firmware patching folder
The current patch is unable to handle aggregated frames (A-MSDU's). This makes it impossible to receive frames in an 802.11n/802.11ac enabled environment.- Current Monitor Mode was tested and works for 802.11n with 20MHz wide channels (2.4 as well as 5GHz),
40MHz channels seems to be a problem. We keep working on it ;-) - Using this patch should enalbe
iwto set 40MHz channels. It currently only works for 5GHz frequencies. Capturing WiFi packets which use mutliple spatial streams is still not possible, this is caused by a hardware limitation of the Nexus 5
Feel free to read and reference our papers on the development of this project
- M. Schulz, D. Wegemer and M. Hollick. [NexMon: A Cookbook for Firmware Modifications on Smartphones to Enable Monitor Mode] (http://arxiv.org/abs/1601.07077), CoRR, vol. abs/1601.07077, December 2015. bibtex
- M. Schulz, D. Wegemer, M. Hollick. DEMO: Using NexMon, the C-based WiFi firmware modification framework, Proceedings of the 9th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2016, July 2016.