8

For a personal project of mine, I'm trying to retrieve iPhone WiFi signal strength. I'm fully aware that this in the land of undocumented goodness, so please refrain from the "No Appstore" answers. :)

Anywho, I've been reading up on previous WiFi Network Scanner Apps (WiFi Stumbler), but I'm afraid most (if not all) reflect outdated SDK documentation. Hopefully, this question will also provide some centralized / insightful material with the most recent iPhone SDK 3.1.2.

Here's my incomplete/not-working code:

.h

 void *libHandle;
 void *airportHandle; 
 int (*open)(void *);
 int (*bind)(void *, NSString *);
 int (*close)(void *);
 int (*scan)(void *, NSArray **, void *);

.m

libHandle = dlopen("/System/Library/PrivateFrameworks/MobileWiFi.framework/MobileWiFi",RTLD_LAZY);

open = dlsym(libHandle, "Apple80211Open");
bind = dlsym(libHandle, "Apple80211BindToInterface");
close = dlsym(libHandle, "Apple80211Close");
scan = dlsym(libHandle, "Apple80211Scan");

open(&airportHandle);
bind(airportHandle, @"en0");

NSLog(@"Result %@",libHandle);

When executed on the device, it'll produce my ever-so-favorite...

Exception Type: EXC_BAD_ACCESS (SIGSEGV)

I'm thinking the dynamic loading call, isn't loading anything. The directory: /System/Library/PrivateFrameworks/ only lists a Info.plist file with no binaries or aliases.

Probably doing something terribly wrong (wrong directory?)... appreciate any help!

Also, as a follow up. To extract the WiFi information, it might be done by:

GetInfoCopy = dlsym(libHandle, "Apple80211GetInfoCopy");

And my questions are 1) Has anybody had any luck with this? 2) How do you get a header dump like I would using with class-dump on Objective-C libraries (because MobileWifi is in C)?

0

4 Answers 4

8

For anybody who stumbles upon this question, here's my library to access 802.11 networks. Although Apple claims to deny any applications that use private frameworks, there are several closed-sourced WiFi applications on the AppStore. Use at your own risk.

This library works with iPhone SDK 3.1.2.

Use:

SOLStumbler *networksManager = [[SOLStumbler alloc] init];
[networksManager scanNetworks];

Result:

An networks NSDictionary of a info NSDictionary.

Use CFShow to explore the returned pointer containing information. Or call the description method for sample output.

4
  • 2
    Be warned. Lately, Apple has been enforcing removal of WiFi scanners.
    – Rev316
    Commented Mar 8, 2010 at 17:04
  • it not exists WiFiManager.bundle/WiFiManager -> crack app
    – vualoaithu
    Commented Apr 21, 2014 at 1:53
  • it's not compilling because apple80211Scan accept void *: NSDictionary *parameters = [[NSDictionary alloc] init]; NSArray *scan_networks; apple80211Scan(airportHandle, &scan_networks, parameters); it'needed to put (void*) & cast before parameters. But I don't think that is right way. Can you help to fix this file.
    – skywinder
    Commented Jun 19, 2014 at 13:56
  • These links are dead Commented Apr 7, 2016 at 15:52
5

Update as of July 2012 (iOS 5.0)

The code you're trying to use is pretty old. This stuff (e.g. WiFiManager or MobileWiFi) is in a private framework. That means Apple can, and often will, change it or move if from OS version to version.

I ran nm on the MobileWifi framework, and didn't see any of those function names. So, I think that's why your code fails.

$ pwd /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/System/Library/PrivateFrameworks/MobileWiFi.framework

$ nm MobileWiFi | grep 80211

$

I suppose it might be necessary to run nm on the actual device framework, but I didn't waste my time, after looking at this:

Discussion of this framework, and follow-ons.

It looks like you can now find equivalent (?) functions in the IPConfiguration framework. Try this code:

libHandle = dlopen("/System/Library/SystemConfiguration/IPConfiguration.bundle/IPConfiguration", RTLD_LAZY);

I ran it on a jailbroken iOS 5.0.1 phone and it worked (loaded the dylib and found a few of the Apple80211 functions). From that thread I linked to, it looks like you may need to have this installed in /Applications on a jailbroken phone, in order to work fully. Or, possibly have to mess around with adding some entitlements to your sandboxed app.

4
  • it not use for iphone 5S os 7.1, i have get Null
    – vualoaithu
    Commented Apr 21, 2014 at 1:54
  • Yes. With this string it pass if ( libHandle == NULL && (error = dlerror()) != NULL) on iOS 7. But can't make it work. scanNetworks doesn't find any networks around.
    – skywinder
    Commented Jun 19, 2014 at 14:02
  • @skywinder, scanNetworks fails because that code is now 4 years old. As I describe in my answer, you have to use a new framework to get the equivalent functionality (and you have had to since at least iOS 5). If you are trying to do this with iOS 7, I would recommend posting a new question.
    – Nate
    Commented Jun 20, 2014 at 8:49
  • @Nate thank you. FYI: it still works with your fix of libHandle. stackoverflow.com/questions/24324184/… But, now I try to figure out, how to pass sandbox restrictions.
    – skywinder
    Commented Jun 20, 2014 at 15:51
4

These Apple80211xxx functions do not exist in MobileWiFi.framework (you can check using the `nm' tool against the SDK binaries).

(Also, it's impossible to dump a C header from binaries because all type information are removed during compilation. You need to reverse engineer it yourself or wait for someone to do so.)

2

I'm not sure if this would be a problem, but open/close/bind are names that are already in-use (standard C library).

The binary doesn't exist, as it is stored in the dyld shared_cache (dlopen will succeed because the library is technically 'loaded.'); however, I note that you're not checking that any of libHandle, open, close, bind or scan are valid when you retrieve them from the dl* functions.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.