WLAN Scan with NDIS Miniport and Much More
3.57/5 (12 votes)
Oct 29, 2007
3 min read
160854
6369
An article about using NDIS Miniport from userspace to access several functions of the WLANcard
Introduction
I spent some time with WLAN, and I wondered how NetStumbler performed this nice scan, but the source is not free. I programmed a lot of stuff but nothing worked. I tried to code my own driver and used WinPcap, but nothing worked very well. Then I read an article, "Scanning for Wireless Networks" in 29A magazine 8 from GriYo. My work is mainly based on this article and you can find a lot of sources on the internet that do the same thing.
Background
It's possible via NDIS Miniport (from userspace) to access a lot of functions of the WLANcard. To get access to all these nice functions, you need the Windows DDK.
Take a look at ntddndis.h and you will find a lot of actions you can perform. For example, you can get or set the WEP key. I only implemented the scanning function, but you can improve it. To build your own application, you can take my article class or write our own.
Using the Code
Well, I put a lot of comments in the code so you will be able to understand it easily. All the functions you need are in the airctl class. Take a look at the header file.
class airctl
{
HANDLE m_handle;
deviceInfo* m_devices;
public:
airctl(void);
// Frees the list of wlans
void freeScanList(void);
//scans for wlan and returns pointer to the list.
NDIS_802_11_BSSID_LIST* scan(void);
bool open( char *device_name);
//lists all devices and saves them in an internal list.
BOOL list_devices( void);
// return the pointer to the list
inline deviceInfo* getDevList( ){return m_devices;};
public:
~airctl(void);
private:
// adds one device to the list
void AddDevice(char * desc, char * name);
// clears the intern list
void clearDeviceList(void);
NDIS_802_11_BSSID_LIST* m_pBSSIDList;
// intern used to get more information about an interface
BOOL get_device_info( int Index,
char *key_name,
char *device_info,
char *device_description);
};
First, we need a list of all devices. Call list_devices() and it will list everything in an single linked list. Then the demo program shows the user a list of all available devices. The structure for the list is as follows:
struct deviceInfo
{
char *description;//information for the user
char *name;// important to open the device
deviceInfo* next;//single linked list
};
Look at the following piece of code. It is from the demo program.
//return me the pointer to the list
deviceInfo* dv = win->m_airctl.getDevList();
if (dv == NULL)
{
List.AddString("No available interface found !");
}else{
while (dv != NULL) //step through the linked list
{
List.AddString(dv->description);// adds it to the list.
dv = dv->next;
}
}
After the user selects a device, it will be opened.
To open the device with the aitctl class, we only need to call open() with the device name in it.
if(m_airctl.open(dv->name)!= true)
{
MessageBox("Cant open selected device","fehler",0);
}else
{
::AfxBeginThread( threadFunc , (LPVOID) this);
}
But we are curious and will take a small look into that function.
//we open the physical device with CreateFileA
m_handle = CreateFileA( device_file,
GENERIC_READ,
FILE_SHARE_READ | FILE_SHARE_WRITE,// share
// mode
NULL, // default security attributes
OPEN_EXISTING, // disposition
0, // file attributes
NULL) ; // do not copy file attributes
if( m_handle == INVALID_HANDLE_VALUE)
{
return false;
}
else
{
// ... open
return true;
}
Now it's time to search the WLANs. We will call scan() from the aitctl class.
NDIS_802_11_BSSID_LIST * pBSSIDList = pDlg->m_airctl.scan();
How is this performed? It's done via DeviceIoControl. This is for direct input and output, or for retrieving information from a physical device. For more information, read this article. It's a really nice series of articles.
First we force the WLAN device to scan for WLANs; we wait for a moment and then we ask the device again to tell us an answer. The source code for this looks like this:
oidcode = OID_802_11_BSSID_LIST_SCAN ;//action to perform
DeviceIoControl( m_handle,
IOCTL_NDIS_QUERY_GLOBAL_STATS,
&oidcode,
sizeof( oidcode),
( ULONG *) NULL,
0,
&bytesreturned,
NULL) ;
Sleep( 2000) ;// we give him some time
memset( m_pBSSIDList, 0, sizeof( NDIS_802_11_BSSID_LIST) *
NUMBEROF_BSSIDS) ;
oidcode = OID_802_11_BSSID_LIST ; //action to perform
if( DeviceIoControl( m_handle, // device to be queried
IOCTL_NDIS_QUERY_GLOBAL_STATS,// operation to
// perform
&oidcode,
sizeof( oidcode), // input buffer
( ULONG *) m_pBSSIDList, // output buffer
sizeof( NDIS_802_11_BSSID_LIST) *
NUMBEROF_BSSIDS,
&bytesreturned, // # bytes returned
NULL) == 0) // synchronous I/O
{
// List failed
return NULL;
}
else {
return m_pBSSIDList;
}
Now we have a pointer to the NDIS_802_11_BSSID_LIST take a look in ntddndis.h where it's defined.
typedef struct _NDIS_802_11_BSSID_LIST
{
ULONG NumberOfItems; // in list below, at least 1
NDIS_WLAN_BSSID Bssid[1];
}
So far so good, but what does NDIS_WLAN_BSSID look like?
typedef struct _NDIS_WLAN_BSSID
{
ULONG Length; // Length of this
// structure
NDIS_802_11_MAC_ADDRESS MacAddress; // BSSID
UCHAR Reserved[2];
NDIS_802_11_SSID Ssid; // SSID
ULONG Privacy; // WEP encryption
// requirement
NDIS_802_11_RSSI Rssi; // receive signal
// strength in dBm
NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
NDIS_802_11_CONFIGURATION Configuration;
NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
NDIS_802_11_RATES SupportedRates;
} NDIS_WLAN_BSSID, *PNDIS_WLAN_BSSID;
This looks much better. This is the information we would like to obtain. Now we can show them to the user.
But, we have one thing left to discuss: how to get the next item. For this, we will use another pointer which points to NDIS_WLAN_BSSID. Now the variable ULONG Length tells us how long this entry is. After this, a certain number of bytes the next entry "lies."
Well, the following is not a good solution, but it shows you what I mean and what it could look like.
//NumberOfItems indicates how many are now in the list
for(unsigned int i =0 ;i < pBSSIDList->NumberOfItems;i++){
int temp=i; //used to build the difference
//step to the next in list...
PNDIS_WLAN_BSSID cpSsid=pBSSIDList->Bssid;//save
//if we aren't in the first loop we have to set the pointer
//to the next
while(temp!=0 ){
// go forward
cpSsid=(PNDIS_WLAN_BSSID)((char*)cpSsid+ cpSsid->Length);
temp--;
}
//do something with your data
}
That's it! Thank you for reading, now it's up to you.
Points of Interest
You can perform a lot of more functions to the WLAN device. Just take a look into ntddndis.h under 802.11 OIDs.
History
- First release version 0.1
License
This article has no explicit license attached to it, but may contain usage terms in the article text or the download files themselves. If in doubt, please contact the author via the discussion board below.
A list of licenses authors might use can be found here.