效果图
原理
根据802.11协议,发现热点使用的是广播,并且是明文,所以在混杂模式下发送beacon帧或者在接收到Probe request之后返回Probe response即可模拟一个热点,接收到Association request 或者其它请求可以不用理会,这里的目的只是生成一个假热点,不会实现连接认证等步骤
可以在这里查看相关资料,也可以百度
beacon帧格式
WiFi的帧格式如下:
802.11frame format
关于每个字段的意义,可以看这篇文章
beacon帧type=0,subtype=8。一个典型的beacon帧分析看这里
关于element ID,简单地,可以看这篇文章
beacon帧举例:
uint8_t beacon_frame[]={
/*FC*/ 0x80 ,0x0 ,
/*DID*/ 0x0 ,0x0 ,
/*MAC Addr*/ 0xff ,0xff ,0xff ,0xff ,0xff ,0xff ,0x8 ,0x9b ,0x4b ,0x92 ,0x3e ,0xcd ,0x8 ,0x9b ,0x4b ,0x92 ,0x3e ,0xcd ,
/*SC*/ 0x30 ,0x4f ,
/*Timestamp*/ 0x80 ,0x51 ,0xcb ,0x68 ,0xd ,0x0 ,0x0 ,0x0 ,
/*BeaconInterval*/0x64 ,0x0 ,
/*CapabilityInfo*/0x31 ,0x0 ,
/*SSID(ElementID(1 Byte)-Length(1 Byte)-Data(Length Bytes))*/
0x0 ,28 ,'0','0','0','0','0','0','0','0','0','0','0','0','0','0','0',
'0','0','0','0','0','0','0','0','0','0','0','0','0',
0x1 ,0x8 ,0x82 ,0x84 ,0x8b ,0x96 ,0xc ,0x12 ,0x18 ,0x24 ,
/*Below same as SSID,elementID different*/
0x3 ,0x1 ,0xb ,
0x5 ,0x4 ,0x1 ,0x2 ,0x0 ,0x0 ,
0x2a ,0x1 ,0x0 ,
0x32 ,0x4 ,0x30 ,0x48 ,0x60 ,0x6c ,
0x30 ,0x14 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x4 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x4 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x2 ,0xc ,0x0 ,
0x2d ,0x1a ,0xed ,0x11 ,0x1b ,0xff ,0xff ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x1 ,0x1 ,0x0 ,0xba ,0x0,
0xa5, 0x10 ,0xf2 ,0x50 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 };
为保证所有的beacon帧都能被识别成一个热点,源mac地址应都不一样,最好信道也不一样,经测试,很多手机会过滤mac相同的beacon,只显示其中一个热点
实现
esp8266
8266支持混杂模式,在这个模式下可以接收和发送有限制的底层数据。station模式下进入混杂模式,发送WiFi beacon帧
注意:不能链接任何wifi,先调用wifi_station_disconnect();断开连接,避免自动连接上了wifi
每次发送要确保上一次已经发送完毕了(发送回调函数调用后)再发送
//汉字:2个字节+'\0'==>每个汉字3字节
uint8_t ssids[4][28]={ {"一、泉眼无声惜细流"},{"二、树阴照水爱晴柔"},{"三、小荷才露尖尖角"},{"四、早有蜻蜓立上头"}};
void send_beacon()
{
static int count=0;
wifi_set_channel(count+5);
beacon_frame[10] = count+1;
beacon_frame[16] = count+1;
os_memcpy(beacon_frame+38,ssids[count],28);
beacon_frame[78] = count+5;
wifi_send_pkt_freedom(beacon_frame,sizeof(beacon_frame),0);
os_printf("send %d bytes data,ssid:%s\n",sizeof(beacon_frame),ssids[count]);
if(++count ==4)
count=0;