Asus RT-AC86U: Building Nexmon_CSI

[zeroby0]

Welcome to the Nexmon_csi build guide for Asus RT-AC86U!

Please use #2, unless you're modifying the source code

Commands prepended with admin@router $ should be run on your RT AC86U via SSH. All other commands are run on your computer (as a normal user. Don't use root). Please run all the steps in one go, and in one Terminal so you don't lose environmental variables.

Install Merlin-WRT on the router

This step is optional, but highly recommended.

• Download the latest release from https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC86U/Release/
• I used https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC86U/Release/RT-AC86U_384.19_0.zip/download
• Unzip.
• In ac86U's web interface,
• In Administration > Firmware Upgrade > Manual firmware upload
• Upload the RT-AC86U_384.19_0_cferom_ubi.w file.

Create a Ubuntu 20.04 Virtual Machine

Creating a VM is optional, but is strongly recommended. Some of the dependencies (python2, python-is-python2) may break your other projects, so run in a VM . If you report a build issue, I'll ask you to run it in a VM.

• Don't use "Auto Install" if you're using VMware. Set it up manually.
• Disable network connection during install. We can manually update it later.
• You can use the minimal install.

Install VMware Tools

If you're using VMware, install VMware tools

sudo apt update
sudo apt install open-vm-tools-desktop
sudo reboot

Setup SSH keys

This step is optional too, but SSH keys make it convenient when you're building Nexmon_CSI multiple times.
If you skip this step, type in the routers password manually when the script asks for it.

• Run ssh-keygen -t ed25519 and generate a SSH Key. You can use the default settings.
• Login to the router Web interface.
• In Advanced > Administration > System:
  • Enable SSH
  • Copy paste the key from ~/.ssh/id_ed25519.pub
• Ensure that the router login name is admin. The makefiles need this.
• Test that the VM is able to ssh into the router
• ssh admin@<RT AC86Us IP> this should happen without asking for a password.
• Exit ssh. Further commands happen in the VM.

Install dependencies

sudo apt update
sudo apt install git libgmp3-dev gawk qpdf bison flex make automake texinfo libtool-bin g++ python2 python-is-python2
sudo reboot

Install Nexmon

We will cross-compile Nexmon_CSI on your VM and then send it to the RT AC86-U.

cd ~
sudo dpkg --add-architecture i386
sudo apt update
sudo apt install libc6:i386 libncurses5:i386 libstdc++6:i386

git clone https://github.com/seemoo-lab/nexmon.git
cd nexmon
source setup_env.sh
make

cd patches/bcm4366c0/10_10_122_20/
git clone https://github.com/seemoo-lab/nexmon_csi.git
cd nexmon_csi
make install-firmware REMOTEADDR=<RT AC86Us IP Address>

Get Merlin Toolchain

cd ~
git clone https://github.com/RMerl/am-toolchains.git
export AMCC=$(pwd)/am-toolchains/brcm-arm-hnd/crosstools-aarch64-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin/aarch64-buildroot-linux-gnu-
export LD_LIBRARY_PATH=$(pwd)/am-toolchains/brcm-arm-hnd/crosstools-aarch64-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/lib

Build Nexutil

Let's cross-compile Nexutil.

cd nexmon/utilities/libnexio
${AMCC}gcc -c libnexio.c -o libnexio.o -DBUILD_ON_RPI
${AMCC}ar rcs libnexio.a libnexio.o
cd ../nexutil
echo "typedef uint32_t uint;" > types.h
sed -i 's/argp-extern/argp/' nexutil.c
${AMCC}gcc -static -o nexutil nexutil.c bcmwifi_channels.c b64-encode.c b64-decode.c -DBUILD_ON_RPI -DVERSION=0 -I. -I../libnexio -I../../patches/include -L../libnexio/ -lnexio

# Install Nexutil on the router
scp nexutil admin@<IP address of your RT-AC86u>:/jffs/nexutil
ssh admin@<IP address of your RT-AC86u> "/bin/chmod +x /jffs/nexutil"

Build Makecsiparams

Note: Makecsiparams is a program used to generate the text used to configure Nexutil. So you can compile Makecsiparams to run on your VM or on the router. The following commands show you how to build for your VM, but you can follow the steps in the Nexutil and Tcpdump sections and cross compile Makecsiparams similarly. You can also simply use the Makecsiparams I compiled to run on the router from here: #2

cd ../bcm4366c0/10_10_122_20/nexmon_csi/utils/makecsiparams/
make
sudo ln -s $PWD/makecsiparams /usr/local/bin/mcp

You can now run Makecsiparams by typing mcp. Try mcp -c 36/80 -C 1 -N 1 to generate a text that will configure Channel 36 and Bandwidth 80 MHz.

Install Tcpdump

Again, we will cross compile Tcpdump.

# Get Merlin firmware
git clone https://github.com/RMerl/asuswrt-merlin.ng.git

# Cross-compile LibPCAP. It's a dependency for tcpdump.
cd asuswrt-merlin.ng/release/src/router/libpcap
CC=aarch64-linux-gcc AR=aarch64-linux-ar RANLIB=aarch64-linux-ranlib AS=aarch64-linux-as LD=aarch64-linux-ld NM=aarch64-linux-nm ./configure --host=x86_64-unknown-linux-gnu --with-pcap=linux
make

# Cross-compile Tcpdump
cd ../tcpdump-4.4.0
CC=aarch64-linux-gcc AR=aarch64-linux-ar RANLIB=aarch64-linux-ranlib AS=aarch64-linux-as LD=aarch64-linux-ld NM=aarch64-linux-nm ac_cv_linux_vers=2 CFLAGS=-static CPPFLAGS=-static LDFLAGS=-static ./configure --host=x86_64-unknown-linux-gnu
make

# Copy Tcpdump to router and make it executable
scp tcpdump admin@<address of your rt-ac86u>:/jffs/tcpdump
ssh admin@<Ip address of your rt-ac86u> "/bin/chmod +x /jffs/tcpdump"

Testing

• Go to your RT AC86Us browser admin UI, and change the 5GHz channel to 36 and country to US.
• Reboot the router
• Find the 5GHz interface for CSI collection. It's most probably eth6.
  • In the routers web interface, find Mac ID of 5GHz wifi. It should be in the right side column on the home screen.
  • SSH into the router, run ifconfig -a and find which interface matches this address.

In the VM, generate a specstring using Makecsiparams (mcp). mcp -c 36/80 -C 1 -N 1. We will use the output of this command to configure Nexutil.

SSH into your router. The following commands need to be run on your router.

Load modified firmware

admin@router$ /sbin/rmmod dhd
admin@router$ /sbin/insmod /jffs/dhd.ko

To verify new dhd is properly loded, run dmesg | grep 10.10.122.20. You should see lines like CONSOLE: 026738.774 10.10.122.20 (nexmon.org/csi: ba99-1)

Bring up the interfaces

admin@router$ wl -i eth6 up
admin@router$ wl -i eth6 radio on
admin@router$ wl -i eth6 country US
admin@router$ ifconfig eth6 up

Note: You will need to load the modified firmware, and bring up interfaces every time you reboot the router, unless you setup Persistence.

Set chanspec and monitor mode

# Replace the part after -v with output of Makecsiparas - mcp
admin@router$ /jffs/nexutil -Ieth6 -s500 -b -l34 -vKuABEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
admin@router$ /usr/sbin/wl -i eth6 monitor 1

# Verify chanspec is set
admin@router$ /jffs/nexutil -Ieth6 -k

Collect CSI with TCPdump

/jffs/tcpdump -i eth6 dst port 5500

Important: While using Tcpdump, the .pcap files should always be saved to an external drive. Saving pcap files to the router's file-system will wear out the flash storage and damage your router.

Persistence

Same as the persistence section on #2.

---

Download for offline use

[Arsering]

Thank you for this great contribution! But when I try to cross-compile LibPCAP, there will be an error "aarch64-linux-gcc: command not found". I don't know how to solve it. Would you mind get me some advices. Thanks a lot.

[hsujim2]

Try this
CC=aarch64-linux-gnu-gcc AR=aarch64-linux-gnu-ar RANLIB=aarch64-linux-gnu-ranlib AS=aarch64-linux-gnu-as LD=aarch64-linux-ld NM=aarch64-linux-nm ./configure --host=x86_64-unknown-linux-gnu --with-pcap=linux
before make LibPCAP

and this
CC=aarch64-linux-gnu-gcc AR=aarch64-linux-gnu-ar RANLIB=aarch64-linux-gnu-ranlib AS=aarch64-linux-gnu-as LD=aarch64-linux-gnu-ld NM=aarch64-linux-gnu-nm ac_cv_linux_vers=2 CFLAGS=-static CPPFLAGS=-static LDFLAGS=-static ./configure --host=x86_64-unknown-linux-gnu
before make tcpdump
It works for me, hope it'll helps you.

[zeroby0]

Sorry, I missed your comment! @hsujim2 is right, make uses those variable, and they need to be set. It could fail if you're using a different shell, for example, Fish uses a different syntax for defining variables.

It could also fail if you're not doing the compiling in one sitting. The variables set in previous steps, like AMCC and LD_LIBRARY_PATH are also needed.

You can also grab the compiled libPcap and tcpdump from nexmonster-rtac86u.zip in #2 . :)

[ljh990817]

How long has this code make install-firmware REMOTEADDR=<RT AC86Us IP Address> been running? Mine has been running for more than 40 minutes, but it hasn’t responded yet and the router’s signal cannot be found.

[zeroby0]

About an hour, if I remember it right.

Is there any output or has it stalled?

[ljh990817]

I tried again. For about an hour and a half, nothing was displayed. The computer couldn't find the router signal.

[ljh990817]

LOADING /jffs/dhd.ko
[email protected]'s password:
Then there was no reply

[zeroby0]

Did you do the Setup SSH keys section? That adds your SSH key to the router, so you can send files to it over SSH, without typing a password.

When this happens, [email protected]'s password:, type in the password of the router. Also, unless you modified Nexmon_CSI, you can use the pre-built binaries in #2 , that makes the hours long install process complete within 5 minutes.

[zikunliu6]

Thanks for your contribution. This is super helpful!

[zeroby0]

:)) It makes my day knowing people are benefiting from this! Feel free to look around the repo and ask if you need help :)