This is Peter "blasty" Geissler's original upc_keys.c, modified to support custom prefixes. The output is also more machine-readable. This is what powers my passphrase recovery tool for UPC1234567
devices.
I run this code in AWS Lambda, so I've included a short howto for setting it up, Node.js wrapper, and Makefile to make a .zip file to upload to Lambda.
make build
or gcc -O3 -o upc_keys upc_keys.c -lcrypto
upc_keys <ESSID> <PREFIXES>
Where:
<ESSID>
should be inUPCxxxxxxx
format<PREFIXES>
should be a string of comma separated serial number prefixes