WebSVN – nexmon – Blame – Rev 1

1

office

1

![NexMon logo](https://github.com/seemoo-lab/nexmon/raw/master/gfx/nexmon.png)

2

3

# What is nexmon?

4

Nexmon is our C-based firmware patching framework for Broadcom/Cypress WiFi chips

5

that enables you to write your own firmware patches, for example, to enable monitor

6

mode with radiotap headers and frame injection.

7

8

Before we started to work on this repository, we developed patches for the Nexus 5 (with bcm4339 WiFi chip) in the [bcm-public](https://github.com/seemoo-lab/bcm-public)  repository and those for the Raspberry Pi 3 (with bcm43430a1 WiFi chip) in the [bcm-rpi3](https://github.com/seemoo-lab/bcm-rpi3) repository. To remove the development overhead of maintaining multiple separate repositories, we decided to merge them in this repository and add support for some additional devices. In contrast to the former repositories, here, you can only build the firmware patch without drivers and kernels. The Raspberry Pi 3 makes an exception, as here it is always required to also build the driver.

9

10

# Give Feedback

11

We setup a survey to learn about who uses Nexmon to which purpose and how we could improve Nexmon. We would be happy if every Nexmon user filled out this survey: https://nexmon.org/survey

12

13

# WARNING

14

Our software may damage your hardware and may void your hardware’s warranty! You use our tools at your own risk and responsibility! If you don't like these terms, don't use nexmon!

15

16

# Important changes

17

* We started to collect usage statistics. In the file [STATISTICS.md](STATISTICS.md), you can find information on which data we collect and how you can opt-out of the statistics collection

18

* Starting with commit 4f8697743dc46ffc37d87d960825367531baeef9 the brcmfmac driver for the RPi3 can now be used as a regular interface. You need to use nexutil to activate monitor mode (`nexutil -m2` for monitor mode with radiotap headers), which will automtically adjust the interface type.

19

* Starting with commit 184480edd6696392aae5f818f305f244606f2d17 you can choose different monitor mode options using nexutil. Use `nexutil -m1` to activate monitor mode without radiotap headers, `nexutil -m2` to activate it with radiotap headers. The numbers were chosen as non-Nexmon firmwares also support native monitor mode without radiotap headers by activating monitor mode with `nexutil -m1`.

20

* Starting with commit 1bcfdc95b4395c2e8bdd962791ae20c4ba602f5b we changed the nexutil interface. Instead of calling `nexutil -m true` to activate monitor mode, you should now write `nexutil -m1`. To get the current monitor mode state execute `nexutil -m` instead of `nexutil -n`.

21

22

# Supported Devices

23

The following devices are currently supported by our nexmon firmware patch.

24

25

WiFi Chip                | Firmware Version     | Used in                   | Operating System          |  M  | RT  |  I  | FP  | UC  | CT

26

------------------------ | -------------------- | ------------------------- | ------------------------- | --- | --- | --- | --- | --- | ---

27

bcm4330                  | 5_90_100_41_sta      | Samsung Galaxy S2         | Cyanogenmod 13.0          |  X  |  X  |     |  X  |  X  |  O

28

bcm4335b0                | 6.30.171.1_sta       | Samsung Galaxy S4         | LineageOS 14.1            |  X  |  X  |  X  |     |  X  |  O

29

bcm4339                  | 6_37_34_43           | Nexus 5                   | Android 6 Stock           |  X  |  X  |  X  |  X  |  X  |  O

30

bcm43430a1<sup>1</sup>   | 7_45_41_26           | Raspberry Pi 3 and Zero W | Raspbian 8                |  X  |  X  |  X  |  X  |  X  |  O

31

bcm43430a1<sup>1</sup>   | 7_45_41_46           | Raspberry Pi 3 and Zero W | Raspbian Stretch          |  X  |  X  |  X  |  X  |  X  |  O

32

bcm43451b1               | 7_63_43_0            | iPhone 6                  | iOS 10.1.1 (14B100)       |     |     |     |  X  |  X  |

33

bcm43455                 | 7_45_77_0_hw         | Huawei P9                 | Android 7 Stock           |  X  |  X  |  X  |  X  |  X  |

34

bcm43455                 | 7_120_5_1_sta_C0     | Galaxy J7 2017            | ?                         |     |     |     |  X  |  X  |

35

bcm43455                 | 7_45_77_0_hw(8-2017) | Huawei P9                 | Android 7 Stock           |  X  |  X  |  X  |  X  |  X  |

36

bcm43455c0               | 7_45_154             | Raspberry Pi B3+          | Raspbian Kernel 4.9/4.14  |  X  |  X  |     |  X  |  X  |

37

bcm4356                  | 7_35_101_5_sta       | Nexus 6                   | Android 7.1.2             |  X  |  X  |     |  X  |  X  |  O

38

bcm4358                  | 7_112_200_17_sta     | Nexus 6P                  | Android 7 Stock           |  X  |  X  |     |  X  |  X  |  O

39

bcm4358                  | 7_112_201_3_sta      | Nexus 6P                  | Android 7.1.2 Stock       |  X  |  X  |     |  X  |  X  |  O

40

bcm4358<sup>2</sup>      | 7_112_300_14_sta     | Nexus 6P                  | Android 8.0.0 Stock       |  X  |  X  |  X  |  X  |  X  |  O

41

bcm43596a0<sup>3</sup>   | 9_75_155_45_sta_c0   | Samsung Galaxy S7         | Android 7 Stock           |  X  |     |     |  O  |  X  |

42

bcm43596a0<sup>3,2</sup> | 9_96_4_sta_c0        | Samsung Galaxy S7         | LineageOS 14.1            |  X  |  X  |  X  |  O  |  X  |

43

qca9500<sup>4</sup>      | 4-1-0_55             | TP-Link Talon AD7200      | Custom LEDE Image         |     |     |     |     |     |

44

45

1 bcm43430a1 was wrongly labeled bcm43438 in the past.

46

47

2 use LD_PRELOAD=libnexmon.so instead of LD_PRELOAD=libfakeioctl.so to inject frames through ioctls

48

49

3 flash patches need to be 8 bytes long and aligned on an 8 byte boundary

50

51

<sup>4</sup> 802.11ad Wi-Fi chip from first 60 GHz Wi-Fi router Talon AD7200. Patch your firmware using [nexmon-arc](https://github.com/seemoo-lab/nexmon-arc) and run it with our custom LEDE image [lede-ad7200](https://github.com/seemoo-lab/lede-ad7200)

## Legend

- M = Monitor Mode

- RT = Monitor Mode with RadioTap headers

56

- I = Frame Injection

57

- FP = Flash Patching

58

- UC = Ucode Compression

59

- CT = c't Article Support (for consistent support, use our ct-artikel branch)

60

61

# Steps to create your own firmware patches

62

63

## Build patches for bcm4330, bcm4339 and bcm4358 using a x86 computer running Linux (e.g. Ubuntu 16.04)

64

* Install some dependencies: `sudo apt-get install git gawk qpdf adb flex bison`

65

* **Only necessary for x86_64 systems**, install i386 libs:

66

67

```

68

sudo dpkg --add-architecture i386

69

sudo apt-get update

70

sudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i386

71

```

72

* Clone our repository: `git clone https://github.com/seemoo-lab/nexmon.git`

73

* In the root directory of the repository: `cd nexmon`

74

* Setup the build environment: `source setup_env.sh`

75

* Compile some build tools and extract the ucode and flashpatches from the original firmware files: `make`

76

* Go to the *patches* folder of your target device (e.g. bcm4339 for the Nexus 5): `cd patches/bcm4339/6_37_34_43/nexmon/`

77

* Compile a patched firmware: `make`

78

* Generate a backup of your original firmware file: `make backup-firmware`

79

  * Install the patched firmware on your smartphone: `make install-firmware` (make sure your smartphone is connected to your machine beforehand)

80

81

### Using the Monitor Mode patch

82

* Install at least *nexutil* and *libfakeioctl* from our utilities. The easiest way to do this is by using this app: https://nexmon.org/app. But you can also build it from the source by executing `make` in the *utilties* folder (Note: you will need the Android NDK properly installed for this).

83

* Connect to your Android phone using the ADB tools: `adb shell`

84

* Make sure you are **not** connected to an access point

85

* Use *nexutil* to enable monitor mode: `nexutil -m2`

86

* At this point the monitor mode is active. There is no need to call *airmon-ng*.

87

* **Important:** Most tools need a Radiotap interface to work properly. *libfakeioctl* emulates this type of interface for you, therefore, use LD_PRELOAD to load this library when you call the favourite tool (e.g. tcpdump or airodump-ng): `LD_PRELOAD=libfakeioctl.so tcpdump -i wlan0`

88

* *untested hint:* Thanks to XDA member ruleh, there is a bcmdhd driver patch to activate native monitor mode, see: https://github.com/ruleh/misc/tree/master/monitor

89

90

### Using nexutil over UDP on Nexus 5

91

To be able to communicate with the firmware without root priviledges, we created a UDP interface accessible through the `libnexio`, which is also used by `nexutil`. You first have to prove to the firmware that you generally have root priviledges by setting a securtiy cookie. Then you can use it for UDP based connections. Your wlan0 interface also needs an IP address in the 192.168.222.0/24 range or you have to change the default nexutil `broadcast-ip`:

92

* Set the IP address of the wlan0 interface: `ifconfig wlan0 192.168.222.1 netmask 255.255.255.0`

93

* Set the security cookie as root: `nexutil -x<cookie (uint)>`

94

* Start a UDP connection for example to activate monitor mode: `nexutil -X<cookie> -m1`

95

96

## Build patches for bcm43430a1 on the RPI3/Zero W or bcm434355c0 on the RPI3+ using Raspbian (recommended)

97

**Note:** We currently support Kernel Version 4.4 (depricated), 4.9 and 4.14

98

* Make sure the following commands are executed as root: `sudo su`

99

* Upgrade your Raspbian installation: `apt-get update && apt-get upgrade`

100

* Install the kernel headers to build the driver and some dependencies: `sudo apt install raspberrypi-kernel-headers git libgmp3-dev gawk qpdf bison flex make`

101

* Clone our repository: `git clone https://github.com/seemoo-lab/nexmon.git`

102

* Go into the root directory of our repository: `cd nexmon`

103

* Check if `/usr/lib/arm-linux-gnueabihf/libisl.so.10` exists, if not, compile it from source:

104

  * `cd buildtools/isl-0.10`, `./configure`, `make`, `make install`, `ln -s /usr/local/lib/libisl.so /usr/lib/arm-linux-gnueabihf/libisl.so.10`

105

* Then you can setup the build environment for compiling firmware patches

106

* Setup the build environment: `source setup_env.sh`

107

* Compile some build tools and extract the ucode and flashpatches from the original firmware files: `make`

108

* Go to the *patches* folder for the bcm43430a1/bcm43455c0 chipset: `cd patches/bcm43430a1/7_45_41_46/nexmon/` / `patches/bcm43455c0/7_45_154/nexmon/`

109

* Compile a patched firmware: `make`

110

* Generate a backup of your original firmware file: `make backup-firmware`

111

* Install the patched firmware on your RPI3: `make install-firmware`

112

* Install nexutil: from the root directory of our repository switch to the nexutil folder: `cd utilities/nexutil/`. Compile and install nexutil: `make && make install`.

113

* *Optional*: remove wpa_supplicant for better control over the WiFi interface: `apt-get remove wpasupplicant`

114

* **Note:** To connect to regular access points you have to execute `nexutil -m0` first

115

116

### Using the Monitor Mode patch

117

* Thanks to the prior work of Mame82, you can setup a new monitor mode interface by executing:

118

```iw phy `iw dev wlan0 info | gawk '/wiphy/ {printf "phy" $2}'` interface add mon0 type monitor```

119

* To activate monitor mode in the firmware, simply set the interface up: `ifconfig mon0 up`.

120

* At this point, monitor mode is active. There is no need to call *airmon-ng*.

121

* The interface already set the Radiotap header, therefore, tools like *tcpdump* or *airodump-ng* can be used out of the box: `tcpdump -i mon0`

122

* *Optional*: To make the RPI3 load the modified driver after reboot:

123

* Find the path of the default driver at reboot: `modinfo brcmfmac` #the first line should be the full path

124

* Backup the original driver: `mv "<PATH TO THE DRIVER>/brcmfmac.ko" "<PATH TO THE DRIVER>/brcmfmac.ko.orig"`

125

  * Copy the modified driver (Kernel 4.9): `cp /home/pi/nexmon/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac_kernel49/brcmfmac.ko "<PATH TO THE DRIVER>/"`

126

  * Copy the modified driver (Kernel 4.14): `cp /home/pi/nexmon/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac_4.14.y-nexmon/brcmfmac.ko "<PATH TO THE DRIVER>/"`

127

* Probe all modules and generate new dependency: `depmod -a`

128

* The new driver should be loaded by default after reboot: `reboot`

129

  * **Note:** It is possible to connect to an access point or run your own access point in parallel to the monitor mode interface on the `wlan0` interface.

130

131

# How to build the utilities

132

To build the utilities such as nexmon or dhdutil for Android, you need to download the **old** NDK version 11c,

133

extract it and export the environment variable `NDK_ROOT` pointing to the directory where you extracted the NDK

134

files.

135

136

# How to extract the ROM

137

The Wi-Fi firmware consists of a read-only part stored in the ROM of every Wi-Fi chip and another part that is

138

loaded by the driver into the RAM. To analyze the whole firmware, one needs to extract the ROM. There are two

139

options to do this. Either you write a firmware patch that simply copies the contents of the ROM to RAM and then

140

you dump the RAM, or you directly dump the ROM after loading the regular firmware into the RAM. Even though,

141

the second option is easier, it only works, if the ROM can be directly accessed by the driver, which is not always

142

the case. Additionally, the firmware loaded into RAM can contain ROM patches that overlay the data stored in ROM.

143

By dumping the ROM after loading the original RAM firmware, it contains flash patches. Hence, the ROM needs to be

144

dumped again for every RAM firmware update to be consistent. As a conclusion, we prefer to dump the clean ROM after

145

copying it to RAM.

146

147

## Dumping the ROM directly

148

To dump the ROM directly, you need to know, where to find it and how large it is. On chips with Cortex-M3 it is

149

usually at upper addresses such as 0x800000, while on chips with Cortex-R4 it is likely at 0x0. Run dhdutil to

150

perform the dump:

151

```

152

dhdutil membytes -r 0x0 0xA0000 > rom.bin

153

```

154

155

## Dumping a clean ROM after copying to RAM

156

For the BCM4339 and BCM4358, we created `rom_extraction` projects that load a firmware patch that copies ROM to

157

RAM and them dumps it using dhdutil. To dump the ROM simply execute the following in the project directory:

```

make dump-rom

```

After ROM extraction, the `rom.bin` file will be copies to the corresponding firmwares subdirectory. To apply the

163

flash patches of a specific RAM firmware version, enter its directory and execute:

```

make rom.bin

```

# Structure of this repository

171

* `buildtools`: Contains compilers and other tools to build the firmware

172

* `firmwares`

173

* `<chip version>`

174

* `<firmware version>`

175

* `<firmware file>`: The original firmware that will be loaded into the RAM of the WiFi Chip

176

* `definitions.mk`: Contains mainly firmware specific addresses

177

* `structs.h`: Structures only valid for this firmware version

178

* `Makefile`: Used to extract flashpatches and ucode

179

* `flashpatches.c` (generated by Makefile): Contains flashpatches

180

* `ucode.bin` (extracted by Makefile): Contains uncompressed Ucode

181

* `structs.common.h`: Structures that are common between firmware versions

182

* `patches`

183

* `<chip version>`

184

* `<firmware version>`

185

* `nexmon`

186

* `Makefile`: Used to build the firmware

187

* `patch.ld`: Linker file

188

* `src`

189

* `patch.c`: General patches to the firmware

190

* `injection.c`: Code related to frame injection

191

* `monitormode.c`: Code related to monitor mode with radiotap headers

192

* `ioctl.c`: Handling of custom IOCTLs

193

* ...

194

* `obj` (generated by Makefile): Object files created from C files

195

* `log` (generated by Makefile): Logs written during compilation

196

* `gen` (generated by Makefile): Files generated during the build process

197

* `nexmon.pre` (generated by gcc plugin): Extracted at-attributes and targetregion-pragmas

198

          * `nexmon.ld` (generated from nexmon.pre): Linker file use to place patch code at defined addresses in the firmware

199

* `nexmon.mk` (generated from nexmon.pre): Make file used take code from patch.elf and place it into firmware

200

          * `flashpatches.ld` (generated from nexmon.pre): Linker file that places flashpatches at target locations in firmware ROM

201

          * `flashpatches.mk` (generated from nexmon.pre): Make file used to insert flashpatch config and data structures into firmware

202

          * `patch.elf` (generated from object files and linker scripts): contains the newly compiled code placed at predefined addresses

203

* `common`

204

* `wrapper.c`: Wrappers for functions that already exist in the firmware

205

* `ucode_compression.c`: [tinflate](http://achurch.org/tinflate.c) based ucode decompression

206

* `radiotap.c`: RadioTap header parser

207

* `helper.c`: Helpful utility functions

208

* `include`: Common include files

209

* `firmware_version.h`: Definitions of chip and firmware versions

210

      * `patcher.h`: Macros use to perform patching for existing firmware code (e.g., BPatch patches a branch instruction)

211

* `capabilities.h`: Allows to indicate capabilities (such as, monitor mode and frame injection)

212

* `nexioctl.h`: Defines custom IOCTL numbers

213

214

# Related projects

215

* [bcmon](https://bcmon.blogspot.de/): Monitor Mode and Frame Injection for the bcm4329 and bcm4330

216

* [monmob](https://github.com/tuter/monmob): Monitor Mode and Frame Injection for the bcm4325, bcm4329 and bcm4330

217

* [P4wnP1](https://github.com/mame82/P4wnP1): Highly customizable attack platform, based on Raspberry Pi Zero W and Nexmon

218

* [kali Nethunter OS](https://github.com/nethunteros): ROM that brings Kali Linux to smartphones with Nexmon support

219

220

# Interesting articles on firmware hacks

221

If you know more projects that use nexmon or perform similar firmware hacks, let us know and we will add a link.

222

223

* [Project Zero](https://googleprojectzero.blogspot.de/2017/09/over-air-vol-2-pt-1-exploiting-wi-fi.html): Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices

224

* [broadpwn](https://blog.exodusintel.com/2017/07/26/broadpwn/): Remotely Compromising Android and IOS via a Bug in Broadcom's Wi-Fi Chipsets

225

* [Project Zero](https://googleprojectzero.blogspot.de/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html): Over The Air: Exploiting Broadcom's Wi-Fi Stack (Part 1)

226

* [Project Zero](https://googleprojectzero.blogspot.de/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html): Over The Air: Exploiting Broadcom's Wi-Fi Stack (Part 2)

227

228

# Read my PhD thesis

229

* Matthias Schulz. [**Teaching Your Wireless Card New Tricks: Smartphone Performance and Security Enhancements through Wi-Fi Firmware Modifications**](http://tuprints.ulb.tu-darmstadt.de/7243/). Dr.-Ing. thesis, Technische Universität Darmstadt, Germany, February 2018. [pdf](http://tuprints.ulb.tu-darmstadt.de/7243/7/dissertation_2018_matthias_thomas_schulz.pdf)

230

231

# Read our papers

232

* M. Schulz, D. Wegemer, and M. Hollick. [**The Nexmon Firmware Analysis and Modification Framework: Empowering Researchers to Enhance Wi-Fi Devices**](https://doi.org/10.1016/j.comcom.2018.05.015). Accepted to appear in Elsevier Computer Communications (COMCOM) Journal. 2018.

233

* M. Schulz, J. Link, F. Gringoli, and M. Hollick. **Shadow Wi-Fi: Teaching Smart- phones to Transmit Raw Signals and to Extract Channel State Information to Implement Practical Covert Channels over Wi-Fi**. Accepted to appear in *Proceedings of the 16th ACM International Conference on Mobile Systems, Applications, and Services*, MobiSys 2018, June 2018.

234

* D. Steinmetzer, D. Wegemer, M. Schulz, J. Widmer, M. Hollick. **Compressive Millimeter-Wave Sector Selection in Off-the-Shelf IEEE 802.11ad Devices**. *Proceedings of the 13th International Conference on emerging Networking EXperiments and Technologies*, CoNEXT 2017, December 2017.

235

* M. Schulz, D. Wegemer, M. Hollick. [**Nexmon: Build Your Own Wi-Fi Testbeds With Low-Level MAC and PHY-Access Using Firmware Patches on Off-the-Shelf Mobile Devices**](https://dl.acm.org/citation.cfm?id=3131476). *Proceedings of the 11th ACM International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH 2017)*, October 2017. [pdf](https://www.seemoo.tu-darmstadt.de/mschulz/wintech2017) [video](https://youtu.be/m5Zrk4n4hoE)

236

* M. Schulz, F. Knapp, E. Deligeorgopoulos, D. Wegemer, F. Gringoli, M. Hollick. [**DEMO: Nexmon in Action: Advanced Applications Powered by the Nexmon Firmware Patching Framework**](https://dl.acm.org/citation.cfm?id=3133333), Accepted for publication in *Proceedings of the 11th ACM International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH 2017)*, October 2017. [pdf](https://www.seemoo.tu-darmstadt.de/mschulz/wintech2017demo)

237

* M. Schulz, F. Gringoli, D. Steinmetzer, M. Koch and M. Hollick. [**Massive Reactive Smartphone-Based Jamming using Arbitrary Waveforms and Adaptive Power Control**](https://dl.acm.org/citation.cfm?id=3098253). Proceedings of the *10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2017)*, July 2017. [pdf](https://www.seemoo.tu-darmstadt.de/mschulz/wisec2017) [video](https://youtu.be/S2XPBK0KdiQ)

238

* M. Schulz, E. Deligeorgopoulos, M. Hollick and F. Gringoli. [**DEMO: Demonstrating Reactive Smartphone-Based Jamming**](https://dl.acm.org/citation.cfm?id=3106022). Proceedings of the *10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2017)*, July 2017. [pdf](https://www.seemoo.tu-darmstadt.de/mschulz/wisec2017demo)

239

* M. Schulz. [**Nexmon - Wie man die eigene WLAN-Firmware hackt**](http://heise.de/-3538660),

240

c't 26/2016, S. 168, Heise Verlag, 2016.

241

* M. Schulz, D. Wegemer, M. Hollick. [**DEMO: Using NexMon, the C-based WiFi

242

firmware modification framework**](https://dl.acm.org/citation.cfm?id=2942419),

243

Proceedings of the *9th ACM Conference on Security and Privacy in Wireless and

244

Mobile Networks (WiSec 2016)*, July 2016. [pdf](https://www.seemoo.tu-darmstadt.de/mschulz/wisec2016demo1)

245

* M. Schulz, D. Wegemer and M. Hollick. [**NexMon: A Cookbook for Firmware

246

Modifications on Smartphones to Enable Monitor Mode**](http://arxiv.org/abs/1601.07077),

247

CoRR, vol. abs/1601.07077, December 2015.

248

[bibtex](http://dblp.uni-trier.de/rec/bibtex/journals/corr/SchulzWH16)

249

250

[Get references as bibtex file](https://nexmon.org/bib)

251

252

# Reference our project

253

Any use of this project which results in an academic publication or other publication which includes a bibliography should include a citation to the Nexmon project and probably one of our papers depending on the code you use. Find all references in our [bibtex file](nexmon.bib). Here is the reference for the project only:

254

```

255

@electronic{nexmon:project,

256

author = {Schulz, Matthias and Wegemer, Daniel and Hollick, Matthias},

257

title = {Nexmon: The C-based Firmware Patching Framework},

258

url = {https://nexmon.org},

year = {2017}

}

```

# Contact

* [Matthias Schulz](https://seemoo.tu-darmstadt.de/mschulz) <mschulz@seemoo.tu-darmstadt.de>

265

* Daniel Wegemer <dwegemer@seemoo.tu-darmstadt.de>

266

267

# Powered By

268

## Secure Mobile Networking Lab (SEEMOO)

269

<a href="https://www.seemoo.tu-darmstadt.de">![SEEMOO logo](https://github.com/seemoo-lab/nexmon/raw/master/gfx/seemoo.png)</a>

270

## Networked Infrastructureless Cooperation for Emergency Response (NICER)

271

<a href="https://www.nicer.tu-darmstadt.de">![NICER logo](https://github.com/seemoo-lab/nexmon/raw/master/gfx/nicer.png)</a>

272

## Multi-Mechanisms Adaptation for the Future Internet (MAKI)

273

<a href="http://www.maki.tu-darmstadt.de/">![MAKI logo](https://github.com/seemoo-lab/nexmon/raw/master/gfx/maki.png)</a>

274

## Technische Universität Darmstadt

275

<a href="https://www.tu-darmstadt.de/index.en.jsp">![TU Darmstadt logo](https://github.com/seemoo-lab/nexmon/raw/master/gfx/tudarmstadt.png)</a>

nexmon – Blame information for rev 1