Broadcom Wps

This repository contains two ways to detect the presence of Broadcom's 802.11 implementation on a target router:

Statically using YARA rules on extracted firmware

Dynamically by running a fingerprinting script against a live access point

Broadcom WPS Monitor YARA rules

broadcom_wps_monitor.yar contains three candidate detectors for ELF32 ARM and MIPS binaries:

BRCM_WPS_Monitor_Generic_ELF identifies a generic Broadcom WPS Monitor binary from independent vendor and protocol strings.

BRCM_WPS_Monitor_HAL_Config_ELF identifies the narrower HAL configuration event variant.

VULN_BRCM_WPS_EAP_Fragment_Reassembly_ELF requires the generic component evidence plus an ARM or MIPS opcode shape associated with the vulnerable fragment-reassembly path.

These rules are triage aids. Compiler changes can evade opcode patterns, and a patched binary can retain strings or code bytes used by a candidate detector. Confirm findings against the integrated source or by manual review of the fragment-length validation and copy sink.

You can find binaries with this command:

Broadcom SDK Fingerprinter

Make sure your interface supports monitor mode and enable monitor mode:

You should seem something like this:

Reporting Affected Devices

You can report affected devices by opening a Pull Request. In your PR, make sure to provide the vendor, product, version, and optionally the Internet Service Provider that deploys them. If you identified it statically, please provide a link to the firmware. If you identified it dynamically, please provide the PCAP generated by the fingerprinting script.