iPhone Wireless Scanner iOS5

As followers know, last year Apple has blocked wifi scanners from App Store, however till iOS5 it was still available for private usage via WiFiManager bundle:

Old Path: ~~/System/Library/SystemConfiguration/WiFiManager.bundle/WiFiManager~~

in iOS5, WifiManager bundle no more exists however 80211 functions are still available via IPConfiguration bundle

New Path: /System/Library/SystemConfiguration/IPConfiguration.bundle/IPConfiguration

The scanning functions are the same as previous version
(For detailed information: http://code.google.com/p/iphone-wireless/ )
but there is one thing you need to pay attention while developing

Your application requires super user privileges in order to perform network scan.
That’s why, you need to put your application in Root’s Applications folder

Correct Path in IOS: /Applications (in this path, app runs with root user permissions)
Wrong Path in IOS: ~~/private/var/mobile/Applications~~ (in this path, app runs with mobile user permissions)

I have prepared a sample project for using Stumbler class on iOS5,
you can download it via

Stumbler Class on iOS5 Usage Sample Download Link.

Also I would like to share couple of screens that may be interesting for some developers.

1) Disassembled screen of iPConfiguration (Processed with IDA Evaluation by HEx Rays )

2) Screenshots of sample project on iPod Touch 4G running iOS 5

Credits:
WifiFofum, They are the first developers who realized IPConfiguration.bundle.
Stumbler “iphone-wireless”, they have provided a lot to community. many thanks.

If you enjoyed this post, make sure you subscribe to my RSS feed!

Post Metadata

Date

November 5th, 2011

Author

Guvener Gokce

16 Comments

Purnima

1

Guvener
We noticed a strange phenomenon. When running the app on a non-jailbroken device via the debugger the Wi-Fi scans would not work. However as soon as we hit the stop button on Xcode for debugger the scan results came through. Is there a way around it by programatically issuing a stop that mimics the stop issued from debugger.
with best regards
Jagan
November 11th, 2011 at 6:50 pm
Guvener Gokce

2

Hi Jagan,

That’s very interesting phenomenon. Although I haven’t tried (yet) hitting a break point programmatically, I will check and let you know if I can succeed.

Many thanks for letting me know, really interesting notice.
Bests,
Guvener
November 12th, 2011 at 10:03 am
Dwarf

3

Hi!

How can I put my application in Root’s Applications folder instead of /private/var/mobile/Applications?

I can´t get the sample working…

Thanxs!
November 14th, 2011 at 3:25 am
Guvener Gokce

4

Hi Dwarf,

I’m assuming that your device is already jailbroken (otherwise not possible)
You shall create release build of sample app and upload release build in to /Applications folder.
(you can use open ssh for that )

Bests,
Guvener
November 14th, 2011 at 3:32 am
Dwarf

5

Ohhh!

I want to distribute my app in the App Store…

This may work for Cydia apps, but Stumbler class will never work in “official” apps, am I right?

Thanxs!
November 14th, 2011 at 6:41 am
Guvener Gokce

6

Hi Dwarf,

You’re right, it’s not allowed to publish an app that uses private frameworks,
and just to be clear, Apple has never published an iOS API for wifi scanning.

Bests,
Guvener
November 14th, 2011 at 8:01 am
Dwarf

7

My app is in the Store, using this framework and working in iOS4, but it crashes in iOS5.
November 14th, 2011 at 11:28 am
Guvener Gokce

8

that’s lucky, good for u.
November 14th, 2011 at 11:45 am
Purnima

9

Guvener
Any progress on doing Wi-Fi scans for non-jailbroken devices with the workaround I mentioned.
Jagan
December 3rd, 2011 at 10:59 pm
nimesh

10

i have tried wifi neworks scanning using stumbler class but when i tried

dlopen(”System/Library/SystemConfiguration/IPConfiguration.bundle/IPConfiguration”,1)

It gives “file not find”

Please help me out in this.
December 19th, 2011 at 5:59 am
kimtaeil

11

hi~

I tried to build in Xcode 4.2 but it does’t work.

Is it only work on Device???

please tell me how to test T.T
December 21st, 2011 at 4:28 am
tpnolan

12

I’m curious, has anyone tested the monitor mode support ?
Can captured packets be successfully parsed into aircrack-ng ?
March 1st, 2012 at 2:03 am
Dan O

13

I am trying to get this to work in an private app that needs to know what WiFi Connection the Ipad is on. Any way when I put the SOStumber.h/m in my code I get an error with the following
apple80211Scan(airportHandle, &scan_networks, parameters);

It gives me an “implicit conversion of Objectiv-C pointer type ‘NSDictionary *’ to C pointer type ‘void *’ requires a bridged cast

I have looked at all the settings from your test app and they all look the same. I know I am missing something but can’t figure it out.

I just need to see what WiFi I am currently attached to.

Any help would be great.
March 15th, 2012 at 9:59 am
pengpeng

14

Hi,
I test the sample on my jailbroken iPod 4G running IOS5.0.1. I copy StumblerIOS5.app to /Applications, but it will terminate immediately so I can’t see the scan results. I try using Xcode4.2 to build and run on my iPod, this time it will not exit, but the results is nil, I am sure there is a Wi-Fi network nearby.
Any help would be great. Sorry for my poor English.
March 31st, 2012 at 12:33 am
henry

15

Hi,
I test the sample on my ipod without jb and IOS 5.0.1

but when I scan Networks, I never find wifi server.

it’s always null….

can you help me ? thanks~
April 4th, 2012 at 8:55 pm
Jeff

16

Everyone only finds the dlsym for Apple80211Open, Apple80211Close, Apple80211BindToInterface, and Apple80211Scan. But what about WirelessGetAssociationInfo and alike? Are there other parts of Apple80211 available in the IPConfiguration bundle according to your library dumps?
April 12th, 2012 at 7:44 pm