DigiNinja wrote a set of patches for hostapd that allow it to operate in KARMA mode (i.e. respond to any probe in an attempt to fool wifi devices into joining it). His last set of patches were for v1.0. I spent some time porting them to v2.0 of hostapd.

The functionality is exactly the same (although the probe response is a little more aggressive), and you can grab either the patch or the full tarball here:

• hostapd-2.0-karma.patch (38K)
• hostapd-2.0-karma.tar.gz (1.4M)

If you want to clean them up, some context: the majority of the changes are based in src/ap/beacon.c and are due to the introduction of the new ssid_match() function. I initially had something fairly intelligent, but it got turfed as I debugged back to Robin's initial method. The big problem was that the probe response's SSID was being grabbed from the configured SSIDs instead of what was probed for. So I created a new _karma probe response method that took the SSID as a parameter.