from http://ininjas.com/forum/index.php?topic=3523.15

Apple80211Associate.c

int Apple80211Associate(struct Apple80211 *handle, CFDictionaryRef *network, CFString *wpa_key);

compile.sh

gcc -Wall -Os -framework Foundation -framework CoreFoundation main.c -o net

ios_scan_wifi.c

#include <dlfcn.h>
#include <stdio.h>

#include <CoreFoundation/CoreFoundation.h>

int main() {
    void *handle = dlopen("/System/Library/SystemConfiguration/IPConfiguration.bundle/IPConfiguration", RTLD_LAZY);
    int (*open)(void *) = dlsym(handle, "Apple80211Open");
    int (*bind)(void *, CFStringRef) = dlsym(handle, "Apple80211BindToInterface");
    int (*close)(void *) = dlsym(handle, "Apple80211Close");        
    int (*scan)(void *, CFArrayRef *, void *) = dlsym(handle, "Apple80211Scan");
    
    void *airportHandle;
    
    open(&handle);
    
    bind(handle, CFSTR("en0"));
    
    CFDictionaryRef parameters = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
    
    CFArrayRef networks;
    
    scan(handle, &networks, parameters);
    
    int i;
    
    for (i = 0; i < CFArrayGetCount(networks); i++) {
        CFDictionaryRef network = CFArrayGetValueAtIndex(networks, i);
        
        CFShow(CFDictionaryGetValue(network, CFSTR("BSSID")));
    }
    
    close(handle);
    
    dlclose(handle);
    
    return 0;
}