Overview
When using multiple datasources of the same type and channels, kismet attempts to split the channels across the sources unless told otherwise. This is done, to the best of my understanding, by passing an offset into the capture binary, telling some of the sources to only use channels from that offset onwards.
As a side point: This doesn't actually work due to the way the offset is used to calculate the hopping position in capture_framework.c:1535, and anyway it can't work with more than 2 sources without an offset endpoint.
Why this is a problem
But the bigger issue, causing a crash, happens when we attempt to set a smaller list of channels dynamically using the API. As seen at datasource_tracker.cc:762, the hop_offset is simply passed into the new hopping thread. If we had previously calculated the offset to be, say, half of all the channels, and then set the actual list of channels to a much smaller array, problems happen. The hopping thread at capture_framework.c:1496 calls the chancontrol callback with an out-of-range hoppos, causing the channel control callback to attempt to read a channel definition from a pointer which no longer points to anything real. This causes a segfault and crashes the entire capture binary.
Overview
When using multiple datasources of the same type and channels, kismet attempts to split the channels across the sources unless told otherwise. This is done, to the best of my understanding, by passing an offset into the capture binary, telling some of the sources to only use channels from that offset onwards.
As a side point: This doesn't actually work due to the way the offset is used to calculate the hopping position in
capture_framework.c:1535, and anyway it can't work with more than 2 sources without an offset endpoint.Why this is a problem
But the bigger issue, causing a crash, happens when we attempt to set a smaller list of channels dynamically using the API. As seen at
datasource_tracker.cc:762, the hop_offset is simply passed into the new hopping thread. If we had previously calculated the offset to be, say, half of all the channels, and then set the actual list of channels to a much smaller array, problems happen. The hopping thread atcapture_framework.c:1496calls the chancontrol callback with an out-of-rangehoppos, causing the channel control callback to attempt to read a channel definition from a pointer which no longer points to anything real. This causes a segfault and crashes the entire capture binary.