EEPW论坛

其实呢，也不是那么深奥。

简单的说呢，

1）手机发送广播UDP数据包

2）设备扫描所有的可用热点（遍历），并处于混杂模式（监听模式，此模式下可以收到广播UDP包）

3）设备在正确的热点上接收到密码（广播UDP数据包）

4）设备连入网络成功

其中UDP如何发送密码相对比较复杂

大概意思就是两者无法通过UDP包的内容来交换数据（因为还未建立起来连接？）

但是可以获取数据包的长度

然后呢，聪明的人类就在长度上做文章了，比如长度1000个字节代表1，1001个字节代表2...
这样就可以通过不同的长度对内容进行编码

太有才了。

这样一说是不是就明白了？

如果你还不明白呢，也没关系，其实我都是瞎猜的。

微信的AirKiss呢，就是发包的

ESP模块这端呢，就负责扫描，解码

然后呢，两者就勾搭上了。

帖子中居然有关键字被屏蔽

我这是技术贴好不好？

BUG啊

编辑帖子

实际发出来，还是普通文字

论坛BUG多啊

http://electronics.stackexchange.com/questions/61704/how-does-ti-cc3000-wifi-smart-config-work

这篇文章说的很好

说的是CC3000，用的原理、方法以及协议，应该和ESP模块大同小异吧 （我瞎猜的）

As @Colin mentions the scheme that TI now use to communicate a network SSID and keyphrase from a setup application to a CC3000 enabled device is called Smart Config.

Smart Config has to communicate information (the network SSID and keyphrase) from a secure wifi network to a CC3000 enabled device that is not yet able to decrypt the traffic on that network.

Initially the CC3000 is not connected to the network (but can monitor the traffic), so the Smart Config application cannot send its information directly to the device. Instead it sends UDP packets to another existing machine on the network - the wifi access point (AP). That the AP isn't interested in receiving them is irrelevant, it's just important that the packets be visible on the network.

While the CC3000 can monitor the traffic it can't decrypt it, it can't even tell for certain that a given encrypted packet contains UDP data. So how can it pick out the UDP packets or do anything useful with them?

Basically Smart Config encodes its information not in the content of the packets it is sending but in their length. Wifi encryption affects the length of packets, but in a consistent way, i.e. it adds L additional bytes to the size of every packet, where L is a constant.

The Smart Config application encodes the SSID and keyphrase into the packet lengths of a sequence of UDP packets. The CC3000 can see the encrypted packets and their sizes.

In many environments the CC3000 will be able to see traffic from multiple nearby networks so how can it spot the relevant traffic? Even after encryption one can still see the MAC addresses of the source and destination of a packet so one can group traffic this way. In addition to the primary information that Smart Config is trying to send it also sends out regularly repeating patterns of packet lengths, so the CC3000 groups the traffic as described and then looks out for such patterns, when it finds them in the traffic of a given source and destination pair it then focuses in to recover the primary information.

There's obviously more too it than that, e.g. even once the CC3000 has found the source and destination pair, that correspond to the AP and the machine running the Smart Config application, how does it filter the Smart Config packets from other unrelated traffic going between the AP and the machine? I've written this all up in a series of blog posts.

The most technically detailed one covers the heart of Smart Config - how it encodes the SSID and keyphrase and transmits them such that a CC3000 can pick them up:

http://depletionregion.blogspot.ch/2013/10/cc3000-smart-config-transmitting-ssid.html

Then I have a post that's less technical, more an opinion piece about why you should always use an AES key with Smart Config:

http://depletionregion.blogspot.ch/2013/10/cc3000-smart-config-and-aes.html

There is a technical bit in the middle that does describe briefly how you'd configure a cipher in Java with the necessary AES transformation needed to work as the CC3000 expects.

And finally the proof of the pudding - I wrote an application to emulate the Smart Config related behavior of the CC3000, i.e. it can recover the SSID and keyphrase transmitted by any Smart Config application without needing to be able to decrypt the relevant network traffic. You can find where to download the source and all the details here:

http://depletionregion.blogspot.ch/2013/10/cc3000-smart-config-and-keyphrase.html

This should enable one to test the behavior of any Smart Config application one writes, i.e. one can see what a CC3000 would be able to reconstruct from the data transmitted by the application.

I also have a few more Smart Config / CC3000 related posts:

http://depletionregion.blogspot.ch/search/label/CC3000

For some background information it can also be interesting to read through these threads on the TI forum relevant to the CC3000.

First one covering Smart Config itself:

http://e2e.ti.com/support/low_power_rf/f/851/t/253463.aspx

And one on mDNS, the mechanism by which a Smart Config application detects that a CC3000 enabled device has joined the network:

http://e2e.ti.com/support/low_power_rf/f/851/p/290584/1020839.aspx

In both threads some initial messages may not seem so relevant but there's some interesting information mixed in too. But there's also a lot of inaccurate information as well so don't assume all of it is correct, even information from TI employees or from me (I learned a lot eventually but started with some incorrect assumptions/beliefs).

Patents have been mentioned a few times, however I can't find any evidence that there are patents pending or granted on this technology.

http://iot.weixin.qq.com/wiki/new/index.html?page=4-1-1

微信AirKiss的文档

原来配网只是其中一个功能

1)微信配网

2）局域网发现

3）局域网通信

大微信太威威霸气了