WPS Pixie Dust Attack (Offline WPS Attack)

[soxrok2212]

We weren't alble to find where in reaver the PKR is debugged. It's probably in there somewhere but we just use small DH keys because the value is always 2. If you really need it without DH keys, just look in the m2 message with wireshark... "Public Key"

[SubZero5]

We weren't alble to find where in reaver the PKR is debugged. It's probably in there somewhere but we just use small DH keys because the value is always 2. If you really need it without DH keys, just look in the m2 message with wireshark... "Public Key"

M1, M3, M5, M7 is seen at wps_registar.c
M2, M4, M6, M8 is seen at wps_enrollee.c

The PKE is in wps_process_pubkey() of wps_registar.c so the PKR might probably be in wps_process_pubkey() of wps_enrollee.c file.

Have you tested this?