wonder command-line tool

purpose

provides a command-line interface for configuring the wonder driver available in newer pixels. with some driver patches, can be used to implement active packet injection on the bcm4390 and bcm4383 chipsets.

tested with

• pixel 9 "tokay" running GrapheneOS 2026081300 (kernel 6.1.176, with mods)
• pixel 11 "cubs" running Android 17 CD1A.260618.001.C2 (kernel 6.12.69)

does my device support this

if you're rooted, and the output of adb shell lsmod | grep wonder looks like something this:

wonder                 69632  0
mac80211             1167360  1 wonder
cfg80211             1187840  3 bcmdhd4383,wonder,mac80211

then you have the wonder driver loaded and it should work.

usage

wonderctl set defaults handles creation of the wonder0 interface and sets ~reasonable defaults that should allow you to bring up the interface:

cubs:/data/local/tmp # ./wonderctl-0.3.0 set defaults
[INFO ] --- [2026-09-01 18:14:53] [main.odin:346:handle_set_channel()] Frequency: 5745 MHz w/ _80 MHz band
[INFO ] --- [2026-09-01 18:14:53] [main.odin:353:handle_set_channel()] TX Rate: HE / _80 MHz band / _1_6_US GI / 7 NSS / 2 MCS
[INFO ] --- [2026-09-01 18:14:53] [main.odin:430:handle_set_region()] Region: US
[INFO ] --- [2026-09-01 18:14:53] [main.odin:364:handle_set_filter_bssid()] Filter BSSID: disabled
[INFO ] --- [2026-09-01 18:14:53] [main.odin:389:handle_set_filter_frame()] Filter Frame: disabled
cubs:/data/local/tmp # ip link set wonder0 up
cubs:/data/local/tmp # tcpdump -i wondertap0
cubs:/data/local/tmp # tcpdump -i wondertap0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wondertap0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), snapshot length 262144 bytes
18:25:20.246180 597579497us tsft short preamble 6.0 Mb/s 5745 MHz 11a -66dBm signal -96dBm noise antenna 0 unknown 802.11 ctrl frame subtype (5)
18:25:20.246208 597580063us tsft short preamble 24.0 Mb/s 5745 MHz 11a -58dBm signal -96dBm noise antenna 0 BA RA:28:70:4e:5b:21:65 (oui Unknown)
18:25:20.283587 597616801us tsft short preamble 24.0 Mb/s 5745 MHz 11a -58dBm signal -96dBm noise antenna 0 BA RA:28:70:4e:5b:21:65 (oui Unknown)
18:25:20.310954 597642488us tsft short preamble 6.0 Mb/s 5745 MHz 11a -75dBm signal -96dBm noise antenna 0 Clear-To-Send RA:b0:bb:e5:50:8d:d4 (oui Unknown)
18:25:20.310980 597643566us tsft short preamble 6.0 Mb/s 5745 MHz 11a -75dBm signal -96dBm noise antenna 0 Clear-To-Send RA:b0:bb:e5:50:8d:d4 (oui Unknown)

specific values can be set by using wonderctl set PROPERTY VALUE. note that these settings are only sent to firmware when the interface is brought up:

127|cubs:/data/local/tmp # ./wonderctl-0.3.0  set channel 6
[INFO ] --- [2026-09-01 18:27:53] [main.odin:346:handle_set_channel()] Frequency: 2437 MHz w/ _20 MHz band
[INFO ] --- [2026-09-01 18:27:53] [main.odin:353:handle_set_channel()] TX Rate: HT / _20 MHz band / _0_8_US GI / 7 NSS / 2 MCS
cubs:/data/local/tmp # ip link set wonder0 down
cubs:/data/local/tmp # ip link set wonder0 up
cubs:/data/local/tmp # tcpdump -i wondertap0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wondertap0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), snapshot length 262144 bytes
18:28:07.328326 3084038us tsft -85dBm signal -95dBm noise antenna 0 2437 MHz 11n ht/20 6.5 Mb/s MCS 0 20 MHz long GI greenfield BCC FEC Acknowledgment RA:1c:e8:9e:4a:3c:aa (oui Unknown)
18:28:07.332310 3088090us tsft -84dBm signal -95dBm noise antenna 0 2437 MHz 11n ht/20 6.5 Mb/s MCS 0 20 MHz long GI greenfield BCC FEC Acknowledgment RA:1c:e8:9e:5b:c1:ff (oui Unknown)

building

requires Odin, along with static versions of libnl-3 and libnl-genl-3.