Class: PWN::SDR::Decoder::WiFi::MACReassembler

Inherits:
Object
  • Object
show all
Defined in:
lib/pwn/sdr/decoder/wifi.rb

Overview

Ordered plaintext data fragments only; bounded capture-time state. Protected MPDUs remain opaque; no ciphertext inference or key recovery.

Instance Method Summary collapse

Constructor Details

#initialize ⇒ MACReassembler

Returns a new instance of MACReassembler.



91
92
93
 
# File 'lib/pwn/sdr/decoder/wifi.rb', line 91

def initialize
  @pending = {}
end

Instance Method Details

#clear ⇒ Object 



138
139
140
 
# File 'lib/pwn/sdr/decoder/wifi.rb', line 138

def clear
  @pending.clear
end

#feed(frame, sample_time:) ⇒ Object 



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/pwn/sdr/decoder/wifi.rb', line 95

def feed(frame, sample_time:)
  @pending.delete_if { |_, state| sample_time - state[:time] > 1.0 }
  return frame unless frame[:type] == 2

  key = frame.values_at(:transmitter, :receiver, :source_address, :destination, :bssid,
                        :sequence, :to_ds, :from_ds) + [frame.fetch(:qos_control, 0) & 15]
  if frame[:protected] || frame.fetch(:qos_control, 0).anybits?(0x80)
    @pending.delete(key)
    return frame
  end
  number = frame[:fragment]
  return frame if number.zero? && !frame[:more_fragments]

  payload = [frame[:payload_hex]].pack('H*')
  if payload.bytesize > 2304
    @pending.delete(key)
    return frame
  end
  if number.zero?
    @pending.shift if @pending.length >= 64
    @pending[key] = { time: sample_time, next: 1, payload: payload, previous: payload }
    return frame
  end
  state = @pending[key]
  return frame unless state
  return frame if frame[:retry] && number == state[:next] - 1 && payload == state[:previous]

  if number != state[:next] || state[:payload].bytesize + payload.bytesize > 2304
    @pending.delete(key)
    return frame
  end
  state[:payload] << payload
  state[:previous] = payload
  state[:next] += 1
  return frame if frame[:more_fragments]

  @pending.delete(key)
  body = state[:payload]
  result = frame.merge(reassembled: true, fragments: state[:next], msdu_hex: body.unpack1('H*'))
  result.merge!(ethertype: body[6, 2].unpack1('n'), network_payload_hex: body[8..].unpack1('H*')) if body.bytesize >= 8 && body.start_with?(['aaaa03000000'].pack('H*'))
  result
end