Sharp Zaurus 5500

    Ambicom WL1100C-CF 802.11b Wi-Fi card

    TRENDnet/TRENDware TE-CF100 10/100 Ethernet card

    OpenZaurus 3.3.6 Pre-1 or 3.5.3 as a do my updates.

Updated for OZ 3.5.1
Website: http://www.openzaurus.org
Packages: http://www.openzaurus.org/official/unstable/3.5.1/
Upgrades like OpenSSH: http://www.openzaurus.org/official/unstable/3.5.1/upgrades/
Install Guide: http://openembedded.org/oe_wiki/index.php/OpenZaurusInstallGuide

     The OpenZaurus ROM gives you more options than the Sharp ROM, and it's said that OZ has better hardware support. It's fairly easy to install, just copy the root file system (opie-image in my case, renamed to initrd.bin) and kernel (zImage) you want to a CF card and hit the hard reset button while holding down C and D on the keyboard (if you have big paws it can be tough). See the install Guide linked above for more details.

Package Management:

     You can add packages by put them on an SD/CF card and using the Package Manager app or the ipkg and ipkg-link command line tools. The GUI Package Manager seems to be largely fubared as far as finding packages on CF cards goes, so I recommend using the command line tools. The basic syntax is as follows (after you change to the directory the package is in):

To install to ram:

ipkg -d ram install Whatever-Package3.3_60.ipk

To symlink it into the root file system:

ipkg-link add Whatever-Package-shortname

If you don't know the short name of a package run the following command and look though your options:

ipkg list

If you get tired of seeing portmap error use the following command to get rif of portmap:

ipkg remove portmap

     In OZ 3.5.1 Many of the apps on these pages will need LibPcap to function, but it seems to be installed by default with OZ 3.5.1. Before you install any of the Packages I have mirrored  please check in the directories ( http://www.openzaurus.org/official/ ) at the OpenZarus site to see if there are any newer versions available.

     One downside to OZ 3.5.1 is that it was built with a newer version of gcc then a lot of the apps compiled for the Sharp ROM which means you will need the compatibility libraries from http://www.mithis.com/zaurus/ipkgs/. A newer version of the package for OZ 3.5.1 can be found here: oz-compat_0.5-r0_arm.ipk. You will know when you have a compatibility problem when you get an error like "undefined symbol: _7QString.shared_null". The GUI tool that comes with the compatibility libraries does not always seem to work so what I do is edit the .desktop files and add "runcompat" in front of whatever the exec= line points to (see my example in the Zethereal section). Update 3/15/2004: Tim Ansell (aka Mithro) of the OZ-compat project sent me the following notes that might help you with GCC compatibility problems:

Some general tips:

1. Make sure you have a good text editor like Nano installed so you can edit system files, the text editor from the GUI is flaky as hell.

2. The first thing you you should do after installing OZ is give the root account a password using the passwd command.

3. Fn-C acts as Ctrl-C would on the desktop.

4. Make sure you have a good SSH and SFTP program on you box. In Windows I use Putty for SSH and FileZilla for SFTPing files. I use EditPad Lite for editing system files on my Windows box, it does not screw up Unix style line feeds. Also, upgrade to OpenSSH instead of Dropbear on your Zaurus so you can do SFTP.

5. Keep the backlight low to extend battery life and have suspend mode only turn of the LCD when you are wardriving.

6. Space is limited, get yourself an SD card to log information to.

7. My old instructions say to install LibPcap, almost all of these apps will need it, but with OZ 3.5.1 it seems to be installed by default.

Here is how to change you MAC address in OpenZaurus. Iuse these two commands:

ifconfig wlan0 down hw ether 0:0a:0a:a0:a0:a0
ifconfig wlan0 up

This would set you wlan0 interface to use the MAC 0:0a:0a:a0:a0:a0. This could be useful for sniffing other connections or for bypassing MAC address restrictions on an Access Point (find valid MAC addresses by sniffing them). It also makes it less traceable to your hardware.

Config:

DHCP Warning:

Wellenreiter II

Updated for OZ 3.5.3
Website: http://www.vanille.de/projects/wellenreiter.html
Packages: http://www.openzaurus.org/official/unstable/3.5.3/upgrades/

opie-wellenreiter_1.2.0-r1_arm.ipk

     Make sure you get 1.2.0-r1 and not 1.2.0-r0 as r0 seems to have issues with some of the other WiFi software on the ROM (some sort of version conflict between We V16 and We V17). To install just change to the directory the package is in and use the two following commands:

ipkg -d ram install opie-wellenreiter_1.2.0-r1_arm.ipk
ipkg-link add opie-wellenreiter

     You may have to restart your Zaurus after the install to get the icons to appear. When you first run it give Wellenreiter II  a few seconds so it will pop up the message about killing the DHCP client, once DHCP is killed it works a lot better. Make sure you choose the proper card under the config page, in my case wlan0 (I have a TRENDware TE-CF100, if I choose WiFi0 there are no errors, but no WAPs are ever found either). Wellenreiter II can tell you what WAPs it finds, some of the clients, the signal strength and information about the packets it sees. Wellenreiter II can also generate a capture dump file that you can later open up in Ethereal on your pc and see much of the traffic on multiple Waps and SSIDs. It's a pretty kick ass tool.

Signal Strength:

Packet:

Updated for OZ 3.5.3
Website: http://www.kismetwireless.net/
Packages: http://www.kismetwireless.net/code/

Kismet, you know it, you love it. Kismet is one of the most popular wardiving tools for Linux. It's great because it can do RF monitoring and pick up APs that are not broadcasting their SSID (aka:cloaked).

2005-06-R1

These instructions should help you get Kismet 2005-06-R1 working on your Zaurus. First we need to install Ncurses support to get rid of errors like "Error opening terminal: xterm." To install ncurses get  ncurses_5.4-r7_arm.ipk and ncurses-terminfo_5.4-r7_arm.ipk from the OZ 3.5.3 feed and libstdc++6_4.0.1-3_arm.deb from the Debian packages site (http://packages.debian.org/unstable/libs/libstdc++6) , then use these commands to install them:

ipkg -d ram install ncurses_5.4-r7_arm.ipk
ipkg-link add ncurses

ipkg -d ram install ncurses-terminfo_5.4-r7_arm.ipk
ipkg-link add ncurses-terminfo

ipkg -d ram install libstdc\+\+6_4.0.1-3_arm.deb
ipkg-link add libstdc++6

Now  we can install Kismet, you can get the deb file for it from the Debian packages site (http://packages.debian.org/unstable/net/kismet)  Use these commands to install it:

ipkg --force-depends -d ram install kismet_2005.06.R1-1_arm.deb
ipkg-link add kismet

SIDE NOTE: Now we will have to do some file editing. I'm a lamer so I don't use the vi package that comes already installed, I use Nano.You can find Nano in the OZ 3.5.3 feed or at my archive. It's very easy to install:

ipkg -d ram install nano_1.3.5-r0_arm.ipk
ipkg-link add nano

Once you have installed Kismet edit the old kismet.conf (/mnt/ram/usr/local/etc/kismet.conf , it could be in a different path depending on where you installed it) to reflect the proper source setting, for my
Ambicom WL1100C-CF 802.11b Wi-Fi card I used:

Replace:

source=none,none,addme

With:

source=hostap,wlan0,hostap

While your at it, it may be a good idea to change where Kismet dumps log files. This could be useful if you want to dump a lot of packets to a dump file so you can look at them in Ethereal on your PC later. In my case, I just wrote them to the RAM mount:

Replace:

logtemplate=/var/log/kismet/%n-%d-%i.%l

With:

logtemplate=/mnt/ram/%n-%d-%i.%l

If you have a Prism2 card you may just want to use my conf file: kismet.conf. Basically all I did was tell it to use hostap as the source, you may have to make some changes if you don't use a Prism based card. Look for the "source=" setting, some possible choices might be:

source=prism2,wlan0,prism2source
source=prism2_avs,wlan0,newprism2source
source=orinoco,eth0,orinocosource

Next edit the kismet script (/mnt/ram/packages/usr/bin/kismet if you installed it to ram) and add the following lines right after "#!/bin/sh"

export TERMINFO=/usr/share/terminfo
export TERM=linux

Or you can jus copy of my kismet script here. Now all you should have to do is drop out to Opie Terminal and type:

kismet

You should now see the Kismet interface we all know and love. After running Kismet you should see log files in /root with names like:

Kismet-*-1.gps
Kismet-*-1.network
Kismet-*-1.csv
Kismet-*-1.xml
Kismet-*-1.dump

These are basically logs of all the APs you have found, but the dump file is something special. The dump file contains captured packets from the networks Kismet has detected, it's in TCPDump format and can be loaded into other tools like TCPDump, Ethereal and Ettercap to find out more information about what's running on the network the packets were captured from. Don't forget to delete these files if you start to run out of space on your Zaurus.

Thanks to Dave Dmytriw and this thread:
http://www.kismetwireless.net/archive.php?mss:5393:200410:jpjgolgbcmecjmfdlona for helping me to get the latest version of Kismet to work.

Update 6/20/2005: Jake sent me the following info that may help some of you that are having problems running Kismet:

Website: http://ettercap.sourceforge.net/  

I found that you can get the Debian ARM packages to work on the Zaurus if you just rename them with a .ipk on the end. Make sure you have installed LibPcap. To install you will have to force dependences and symlink as follows (your paths may vary, I installed Ettercap off of an SD card):

ipkg -force-depends -d ram install /mnt/card/ettercap_0.6.b-2_arm.ipk
ipkg -force-depends -d ram install /mnt/card/ettercap-common_0.6.b-2_arm.ipk
ln -s /mnt/ram/etc/ettercap/ /etc/ettercap
ln -s /mnt/ram/usr/sbin/ettercap /usr/sbin/ettercap

The first pic shows the use of the flags needed to do a password capture with the IP base sniffing method in command line mode. To see it in its non command line mode (2nd pic) make sure you turn off wrapping under the Options menu of Konsole and that the onscreen keyboard is not up, otherwise you get an error like "Screen must be at least 25x80 !!". If you get an error about not being able to find etter.ssl.crt make sure you ran the symlink command above. I'm still having problem getting it to do IP forwarding, even if I do a:

echo 1 > /proc/sys/net/ipv4/ip_forward

I'll try to let you know more when I get more time for testing, it may just be that it does not work with WI-Fi (I have a 10/100 Ethernet card on the way for testing). For the time being when it arpspoofs the two host it kills all communications between them. If Ettercap trys to sniff the USB connection (which is most likely not what you want) make sure you specify what interface to use with the "-i" option:

ettercap -i wlan0

If Ettercap loads too slowly because of host name resolution just turn it of using the "-d" option.

Update 2/6/04: Ok, after testing it with a 10/100 Ethernet card Ettercap still does not work for catching passwords, must be something Zaurus specific because I got the package from Debian and I'm sure they tested it on other ARM platforms. For right now Ettercap on the Zaurus is only good for fingerprinting computers and for killing their net access (packet forwarding does not seem to work). I'll have to  try the Dsniff package to see if I can get it to work better.

Website: http://ngrep.sourceforge.net/

Ngrep is basically Grep for network packets. It has a lot of filter options so check out the webpage for all of the options. The link above is to a binary, copy it to some place like /mnt/ram/usr/bin/ and symlink it to someplace in your path ( ln -s /mnt/ram/usr/bin/ngrep /bin/ngrep). If you want to save the information instead of show it on the screen use a command like:

ngrep > /mnt/card/ngrep.log

to pipe it to a file for later viewing.

Website: http://www.tcpdump.org/

John H.Sawyer pointed out that I did not list TCPDump, so here it is. Not a bad little command line sniffer See all of the options here: http://www.tcpdump.org/tcpdump_man.html 

Updated for OZ 3.5.1
Website: http://nemesis.sourceforge.net

     Nemesis is packet injection utility. It allows you to spoof other hosts and generally cause confusion on the network. I just took the Debian ARM packages and renamed them with a .ipk on the end. The package comes with the following utilitys:

nemesis-arp
nemesis-rip
nemesis-dns
nemesis-tcp
nemesis-icmp
nemesis-udp
nemesis-igmp
nemesis-osp

I wanted to get the newest package I could find (nemesis_1.32+1.4beta3-2_arm.deb) to work but I can't find a version on Libnet0 that I can install on my Zaurus. I decided to use the older version, 1.32-5. To install from the CF card do the following commands:

ipkg -force-depends -d ram install /mnt/cf/nemesis_1.32-5_arm.ipk

then symlink everything someplace in you path:

ln -s /mnt/ram/usr/sbin/n* /bin/

Since the libpcap libray files have a different name in OZ 3.5.1  we have to do the following symlink so nemesis can find it:

ln -s /usr/lib/libpcap.so.0.7 /usr/lib/libpcap.so.0

One cool use is to fake out an IDS system. If I used the command

nemesis-tcp -x 1025 -y 22 -S 207.46.134.157 -D 192.168.240.7

it would make it look as if Microsoft.com was attacking the target host. Here is a example of a script I wrote that can be used to make it look like another host is doing a port scan:

copy all that into a text file, chmod +x it and use it by issuing a command like

frame.sh Farmed_ip Target_IP

You will most likely want to change your MAC address first.