cybersecurity · intermediate · ~12 min · safe pentest lab
Bit-field decoding from a single header byte.
Classify an 802.11 frame by its type field — the first decision a Wi-Fi forensics tool makes before it knows the rest of the layout. Pure bit work on a fixed header byte; no NIC or capture.
Implement int classify_frame(const uint8_t *hdr) that extracts the frame TYPE from the Frame Control field's first byte and maps it to a category.
The first byte is laid out as:
bits 7..4 : subtype
bits 3..2 : TYPE <- extract this: (hdr[0] >> 2) & 0x3
bits 1..0 : protocol version
Map the 2-bit type:
hdr: a pointer to the header bytes (only hdr[0] is read), or NULL. The grader passes fixed bytes.Returns int: 0, 1, or 2 for valid types; -1 for the reserved type or a NULL pointer.
hdr[0] with type bits = 0 -> 0 (management)
hdr[0] with type bits = 1 -> 1 (control)
hdr[0] with type bits = 2 -> 2 (data)
hdr[0] with type bits = 3 -> -1 (reserved)
NULL -> -1
NULL hdr returns -1.Every Wi-Fi forensics tool starts by classifying the frame type before it knows the layout of the rest of the bytes.
A pointer hdr to at least one byte (only hdr[0] is read), or NULL.
An int: 0/1/2 for the type, or -1 for reserved/NULL.
Extract (hdr[0] >> 2) & 0x3; mask out subtype and protocol-version bits.
#include <stdint.h>
int classify_frame(const uint8_t *hdr) {
/* TODO */
(void)hdr;
return -1;
}
Reading the wrong bit position. Forgetting the NULL check. Allowing the reserved type 3 through.
All-zeros byte (type 0). Top bits set (subtype) should not affect classification.
O(1).
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.