Home

Awesome

NexMon logo

What is nexmon?

Nexmon is our C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection.

Below, you find an overview what is possible with nexmon. This repository mainly focuses on enabling monitor mode and frame injection on many chips. If you want additional features, the following projects might be interesting for you:

NexMon logo

WARNING

Our software may damage your hardware and may void your hardware’s warranty! You use our tools at your own risk and responsibility! If you don't like these terms, don't use nexmon!

Supported Devices

The following devices are currently supported by our nexmon firmware patch.

WiFi ChipFirmware VersionUsed inOperating SystemMRTIFPUCCT
bcm43305_90_100_41_staSamsung Galaxy S2Cyanogenmod 13.0XXXXO
bcm4335b06.30.171.1_staSamsung Galaxy S4LineageOS 14.1XXXXO
bcm43396_37_34_43Nexus 5Android 6 StockXXXXXO
bcm43430a1<sup>1</sup>7_45_41_26      Raspberry Pi 3 and Zero WRaspbian 8          XXXXXO
bcm43430a1<sup>1</sup>7_45_41_46      Raspberry Pi 3 and Zero WRaspbian Stretch    XXXXXO
bcm43439a0<sup>7</sup>7_95_49 (2271bb6 CY)Raspberry Pi Pico WPico SDK  XXXX
bcm43451b17_63_43_0iPhone 6iOS 10.1.1 (14B100)XX
bcm434557_45_77_0_hwHuawei P9Android 7 StockXXXXX
bcm434557_120_5_1_sta_C0Galaxy J7 2017?XX
bcm434557_45_77_0_hw(8-2017)Huawei P9Android 7 StockXXXXX
bcm43455<sup>5</sup>7_46_77_11_hwHuawei P9Android 8 China StockXXXXX
bcm434557_45_59_16Sony Xperia Z5 CompactLineageOS 14.1XXXXX
bcm43455c07_45_154Raspberry Pi B3+/B4Raspbian Kernel 4.9/14/19XXXX
bcm43455c07_45_189Raspberry Pi B3+/B4Raspbian Kernel 4.14/19, 5.4XXXX
bcm43455c07_45_206Raspberry Pi B3+/B4Raspberry Pi OS Kernel 5.4XXXXX
bcm43455c07_45_234 (4ca95bb CY)Raspberry Pi B3+/B4/5Raspberry Pi OSXX
bcm43436b0<sup>3</sup>9_88_4_65Raspberry Pi Zero 2 WRaspberry Pi OS Kernel 5.10XXXXX
bcm43567_35_101_5_staNexus 6Android 7.1.2XXXXO
bcm43587_112_200_17_staNexus 6PAndroid 7 StockXXXXO
bcm43587_112_201_3_staNexus 6PAndroid 7.1.2 StockXXXXO
bcm4358<sup>2</sup>7_112_300_14_staNexus 6PAndroid 8.0.0 StockXXXXXO
bcm43596a0<sup>3</sup>9_75_155_45_sta_c0Samsung Galaxy S7Android 7 StockXOX
bcm43596a0<sup>3,2</sup>9_96_4_sta_c0Samsung Galaxy S7LineageOS 14.1XXXOX
bcm4375b1<sup>3,5,6</sup>18_38_18_staSamsung Galaxy S10Rooted + disabled SELinuxXXXOX
bcm4375b1<sup>3,5,6</sup>18_41_8_9_staSamsung Galaxy S20Rooted + disabled SELinuxXXXOX
bcm4389c1<sup>5,8,9</sup>20_82_42_sta (r994653)Samsung Galaxy S22 PlusAndroid 14, Rooted with MagiskXX
bcm4389c1<sup>5,8,9</sup>20_101_36_2 (r994653)Google Pixel 7 and 7 ProRooted with MagiskXX
bcm4389c1<sup>5,8,9</sup>20_101_57 (r1035009)Google Pixel 7 and 7 ProRooted with MagiskXX
bcm4398d0<sup>5,8,9</sup>24_671_6_9 (r1031525)Google Pixel 8Rooted with MagiskXX
bcm6715b0<sup>5</sup>17_10_188_6401 (r808804)Asus RT-AX86U ProStock firmware 3.0.0.4_388.23565/X
qca9500<sup>4</sup>4-1-0_55TP-Link Talon AD7200Custom LEDE Image

<sup>1</sup> bcm43430a1 was wrongly labeled bcm43438 in the past.

<sup>2</sup> use LD_PRELOAD=libnexmon.so instead of LD_PRELOAD=libfakeioctl.so to inject frames through ioctls

<sup>3</sup> flash patches need to be 8 bytes long and aligned on an 8 byte boundary

<sup>4</sup> 802.11ad Wi-Fi chip from first 60 GHz Wi-Fi router Talon AD7200. Patch your firmware using nexmon-arc and run it with our custom LEDE image lede-ad7200

<sup>5</sup> Disabled the execution protection (called Execute Never) on region 1, because it interferes with the nexmon code (Permission fault on Section)

<sup>6</sup> To use nexutil, you need to deactivate SELinux or set it to permissive

<sup>7</sup> See pico-nexmon for example applications using Pico SDK with nexmon.

<sup>8</sup> flash patches need to be 16 bytes long and aligned on a 16 byte boundary.

<sup>9</sup> Uses Magisk module to install firmware, nexutil, and set SELinux policies.

Legend

Steps to create your own firmware patches

Build patches for bcm4330, bcm4339 and bcm4358 using a x86 computer running Linux (e.g. Ubuntu 16.04)

Using the Monitor Mode patch

Using nexutil over UDP on Nexus 5

To be able to communicate with the firmware without root priviledges, we created a UDP interface accessible through the libnexio, which is also used by nexutil. You first have to prove to the firmware that you generally have root priviledges by setting a security cookie. Then you can use it for UDP based connections. Your wlan0 interface also needs an IP address in the 192.168.222.0/24 range or you have to change the default nexutil broadcast-ip:

Build patches for bcm43430a1 on the RPI3/Zero W or bcm434355c0 on the RPI3+/RPI4 or bcm43436b0 on the RPI Zero 2W using Raspbian/Raspberry Pi OS (recommended)

Note: We currently support Kernel Version 4.4 (deprecated), 4.9, 4.14, 4.19, 5.4, 5.10 and 5.15. Raspbian contains firmware version 7.45.154 for the bcm43455c0. We also support the newer firmware release 7.45.189 from Cypress. Raspberry Pi OS contains firmware version 7.45.206. Please, try which works best for you.

Using the Monitor Mode patch

How to build the utilities

To build the utilities such as nexmon or dhdutil for Android, you need to download the old NDK version 11c, extract it and export the environment variable NDK_ROOT pointing to the directory where you extracted the NDK files.

How to extract the ROM

The Wi-Fi firmware consists of a read-only part stored in the ROM of every Wi-Fi chip and another part that is loaded by the driver into the RAM. To analyze the whole firmware, one needs to extract the ROM. There are two options to do this. Either you write a firmware patch that simply copies the contents of the ROM to RAM and then you dump the RAM, or you directly dump the ROM after loading the regular firmware into the RAM. Even though, the second option is easier, it only works, if the ROM can be directly accessed by the driver, which is not always the case. Additionally, the firmware loaded into RAM can contain ROM patches that overlay the data stored in ROM. By dumping the ROM after loading the original RAM firmware, it contains flash patches. Hence, the ROM needs to be dumped again for every RAM firmware update to be consistent. As a conclusion, we prefer to dump the clean ROM after copying it to RAM.

Dumping the ROM directly

To dump the ROM directly, you need to know, where to find it and how large it is. On chips with Cortex-M3 it is usually at upper addresses such as 0x800000, while on chips with Cortex-R4 it is likely at 0x0. Run dhdutil to perform the dump:

dhdutil membytes -r 0x0 0xA0000 > rom.bin

Dumping a clean ROM after copying to RAM

For the BCM4339 and BCM4358, we created rom_extraction projects that load a firmware patch that copies ROM to RAM and them dumps it using dhdutil. To dump the ROM simply execute the following in the project directory:

make dump-rom

After ROM extraction, the rom.bin file will be copies to the corresponding firmwares subdirectory. To apply the flash patches of a specific RAM firmware version, enter its directory and execute:

make rom.bin

Structure of this repository

Related projects

Interesting articles on firmware hacks

If you know more projects that use nexmon or perform similar firmware hacks, let us know and we will add a link.

Read my PhD thesis

Read our papers

Get references as bibtex file

Reference our project

Any use of this project which results in an academic publication or other publication which includes a bibliography should include a citation to the Nexmon project and probably one of our papers depending on the code you use. Find all references in our bibtex file. Here is the reference for the project only:

@electronic{nexmon:project,
	author = {Schulz, Matthias and Wegemer, Daniel and Hollick, Matthias},
	title = {Nexmon: The C-based Firmware Patching Framework},
	url = {https://nexmon.org},
	year = {2017}
}

Contact

Powered By

Secure Mobile Networking Lab (SEEMOO)

<a href="https://www.seemoo.tu-darmstadt.de">SEEMOO logo</a>

Networked Infrastructureless Cooperation for Emergency Response (NICER)

<a href="https://www.nicer.tu-darmstadt.de">NICER logo</a>

Multi-Mechanisms Adaptation for the Future Internet (MAKI)

<a href="http://www.maki.tu-darmstadt.de/">MAKI logo</a>

Technische Universität Darmstadt

<a href="https://www.tu-darmstadt.de/index.en.jsp">TU Darmstadt logo</a>