Setting TXPOWER as high as your card can go

Setting:

You bought a WiFi card that can be used at 500mw or even 1w. You run iwconfig and see that txpower is only set to 20. You try to set it to 30, and it doesn’t let you. You try to set your location to Bolivia, because you read that this would fix it, but it doesn’t help.

Maybe that card is an Alfa AWUS036NHA, or maybe it’s a different model.

Well it turns out that some cards have the location set in their EEPROM, so even if you are located in Canada, where you should be able to set your power to 27, you can’t go above 20 because the card thinks it’s in the UK.

Here’s how to fix it in Linux. These instructions have been tested in Backtrack 5RC3.

Here is how things work:

When the card is hooked up, a call is made to CRDA, which will set your location from the data contained on the eeprom. Then, wireless-regdb’s provided regulatory.bin file contains the appropriate restrictions to apply for this location. So all that is needed to fix this is to put a regulatory.bin that replaces the wrong country’s restrictions with the appropriate ones. However, that binary file is signed, and the system verifies it hasn’t been tampered with. Here are the simple steps you need to follow in the right order to defeat this check.

WARNING: Removing all restrictions might be illegal. Do not do it, and if you do, then that’s your decision to break the law, not mine.

  1. Ensure you have the following packages installed:  python-m2crypto libgcrypt11 libgcrypt11-dev libnl-dev
  2. Download wireless-regdb and CRDA from Kernel.org. Be sure to grab the latest versions.
  3. Extract them, each in their own directory.
  4. In the wireless-regdb directory, you will find db.txt. This is the ASCII version of regulatory.bin. Edit it to your liking, but remember that restrictions are applied first for the “world” (00), and then for the country. So for example, BO has no restrictions, so copy that over to the “World” restrictions. See warning about legality above. Apply the proper restrictions for your country to the country your card believes it’s in. That way, your country’s restrictions will apply even for a card that believes it is for example in “GB”.
  5. make wireless-regdb.
  6. The compilation process generated a self-signed regulatory.bin. Overwrite the one that was on your system (which you should backup first) in /usr/lib/crda/regulatory.bin
  7. Copy any .pem files from the wireless-regdb extracted directory to the crda/pubkeys directory. This is what crda will use to check regulatory.bin is valid.
  8. Go into the extracted crda directory and make. If you get an access denied on key2pub, you might want to chmod +x that file.
  9. make install CRDA.
  10. Reboot and test your card. It should now be allowed to work at the maximum power allowed in your country!
Posted in Gadgets, Security and tagged , , , . Bookmark the permalink. RSS feed for this post. Leave a trackback.

12 Responses to Setting TXPOWER as high as your card can go

  1. J says:

    Tried a couple of times following along exactly as written and received no errors. Upon reboot I can change country to BO (and displays as such when getting the reg) but it still won’t allow me to increase txpower beyond 20. Any idea what the problem might be?

    I have the NHA and was using BT5R3 as well – exact same equipment.

    • Guillaume says:

      Some cards have their region burned in. This trick is to boost that region instead of trying to change to BO. Once your OS has the right settings for the region your card is in, you should be able to set the power right without switching to BO.

      What region does your card think it’s in?

      I saw this with a card locked to GB.

      • J says:

        Not sure what it thought it was originally, though I was able to change regions after your following your method and it reports back as being in BO. Based on your response I assume I could just replace the information for all of the countries and go at it that way? Or is there an easier way of going back to “stock” and just tackling the home region?

        Thanks for the help. :)

        • Guillaume says:

          I don’t have the card with me but try this: plug it while tailing log/messages – I think the actual region will be reported there. Then, fix up that region as well as world and try that.

  2. Rich says:

    Cheers for the guide man, got as far as installing CRDA and I get the following error:

    install: cannot stat `regdbdump’: No such file or directory
    make: *** [install] Error 1

    any ideas?
    a

    Any

    any
    anyu

    • Guillaume says:

      It seems that either you don’t have the proper permissions (are you root, using su?) OR maybe regdbdump isn’t available. What distro are you using?

    • Mr-Protocol says:

      Rich, do you have ia32-libs installed? That might resolve your issue if you are on a 64 bit Linux OS.

  3. 11idan1q says:

    I am running BT5RC3 and have both an Alfa AWUS036H and AWUS036NH. A few months ago I was easily able to do this on the H but when I was trying again on the NH (or the H again after a fresh re-install for that matter) I was unable to move it off 20dbm after I modified the db.txt and copied the files etc. If I copied the backup regulatory.bin back over and restarted, I could do the normal iw reg set BO and get it to 30dbm again but not 33 where the NH loves to play :) .
    I found the solution was that I was doing a ‘make’ for both the wireless-regdb and the crda instead of a make on the wireless-regdb and a make install on the crda. Once I did that, everything came good. Hope this helps someone.

  4. Mr-Protocol says:

    Rich, do you have ia32-libs installed? That might resolve your issue if you are on a 64 bit Linux OS.

  5. nico says:

    Hey, thanks. works like a charm in ubuntu 12.04. you don’t even need to build crda! if you do that, then it won’t work (database verification failed for me). just build the regulatory.bin and put in in /lib along with the keys. awus036nha

  6. Jon says:

    Hi. I am a total noob and cannot extract the latest-regulatory.bin in bt5r3. Please can someone let me know what command I should be using? ./latest-regulatory.bin is giving an error. (I have run chmod +x on the file already). Thanks

    • Matt says:

      The file you mentioned is in binary format, there is nothing to extract from it…
      By issuing the command ./latest-regulatory.bin you are telling the system to run the file as if it were a program or script, but it isn’t either and therefore you get an error.
      Files that you can extract in linux typically have an extenstion “.tar.gz” or “.tgz” and you would extract them with the command tar -xvzf filename.tar.gz

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Swedish Greys - a WordPress theme from Nordic Themepark.