配网请求部分协议解析
分析目标：
ssid =12345
password =12345678
数据包：
Hex= 5A 6E 3C 6F 10 01 0B 01 FF 05 31 32 33 34 35 08 31 32 33 34 35 36 37 38
String= Zn<o 1234512345678
ble gatt接受参数函数 (234行)
// out/t113-100ask/compile_dir/target/wifimanager-v2.0-0.1/core/src/os/linux/linkd/linkd_ble/linkd_ble.c
void bt_blink_gatt_char_write_request_cb(gatts_char_write_req_t *char_write)
{
blink_priv_t *priv = blink;
WMG_DEBUG("enter_func %d\n", __LINE__);
int ret = 0;
if(char_write) {
WMG_DEBUG("attr_handle: %d,tran_id: %d\n",char_write->attr_handle,
char_write->trans_id);
WMG_DEBUG("Value:");
bt_manager_hex_dump(" ", 20, (unsigned char *)char_write->value, char_write->value_len);
}
WMG_DEBUG("char_write->need_rsp: %d\n", char_write->need_rsp);
if (char_write->need_rsp) {
gatts_write_rsp_t data;
data.trans_id = char_write->trans_id;
data.attr_handle = char_write->attr_handle;
data.state = BT_GATT_SUCCESS;
ret = bt_manager_gatt_server_send_write_response(&data);
if (ret != 0)
WMG_DEBUG("send write response failed!\n");
else
WMG_DEBUG("send write response success!\n");
}
if (char_write->value_len > BLINK_MSG_LEN_MAX) {
WMG_DEBUG("exec blink buffer!\n");
return;
}
blink_parse_message((uint8_t *)priv->message, (uint8_t *)char_write->value, char_write->value_len, 0);
}
配网数据解析函数（471行）
static int blink_parse_message(uint8_t *value, uint8_t *buf, uint16_t len, uint16_t offset)
value指针，buf配网数据， len 数据长度，offset 0
static int blink_parse_message(uint8_t *value, uint8_t *buf, uint16_t len, uint16_t offset)
{
blink_priv_t *priv = blink;
uint8_t *message = buf;
uint32_t sync = (uint32_t)message[0] << 24 | (uint32_t)message[1] << 16 |
(uint32_t)message[2] << 8 | message[3];
uint8_t version = message[BLINK_MSG_VERSION_INDEX];
if (priv->status != BLINK_STATUS_COMPLETE &&
sync == BLINK_MSG_SYNC && version == BLINK_MSG_VERSION) {
WMG_DEBUG("%s %d\n", __func__, __LINE__);
if (message[BLINK_MSG_FMT_INDEX] == BLINK_MSG_FMT_SUBC) {
/* TO DO.. */
return -1;
}
memset(value, 0, BLINK_MSG_LEN_MAX);
memcpy(value + offset, buf, len);
*(value + offset + len) = '\0';
priv->status = BLINK_STATUS_COMPLETE;
sem_post(&priv->sem);
}
return 0;
}
uint32_t sync = (uint32_t)message[0] << 24 | (uint32_t)message[1] << 16 | (uint32_t)message[2] << 8 | message[3];
#define BLINK_MSG_SYNC (0x5A6E3C6F)
同步标识[0-3]：5A 6E 3C 6F
uint8_t version = message[BLINK_MSG_VERSION_INDEX]; //BLINK_MSG_VERSION_INDEX=4
版本号[4]：10
FMT[5]：不为0
未知字段[6-9]：0B 01 FF 05(ssid长度)
bt_blink_gatt_char_write_request_cb分析结果：
函数是用来匹配gatt特征的
msg[0-3]: 同步标识，必须和预设相同
msg[4]: 版本号，必须和预设相同
msg[5]: FMT,不能为0，默认01
msg[6-9]: 未知
配网响应（590行）
blink_ret_t blink_get_result(blink_result_t *result)
{
blink_priv_t *priv = blink;
if (!priv || !result) {
WMG_ERROR("invalid state or param\n");
return BLINK_ERROR;
}
if (priv->status != BLINK_STATUS_COMPLETE) {
WMG_WARNG("blink not completed\n");
return BLINK_ERROR;
}
result->ssid_len = priv->message[BLINK_MSG_SSID_INDEX];
result->passphrase_len = priv->message[priv->message[BLINK_MSG_SSID_INDEX] + BLINK_MSG_SSID_INDEX + 1];
if (result->ssid_len > SSID_MAX_LEN || result->ssid_len == 0 ||
result->passphrase_len > PSK_MAX_LEN || result->passphrase_len == 0) {
WMG_WARNG("invalid len\n");
return BLINK_ERROR;
}
memcpy(result->ssid, priv->message + BLINK_MSG_SSID_INDEX + 1, result->ssid_len);
memcpy(result->passphrase, priv->message + priv->message[BLINK_MSG_SSID_INDEX] + BLINK_MSG_SSID_INDEX + 2, result->passphrase_len);
result->ssid[result->ssid_len] = '\0';
result->passphrase[result->passphrase_len] = '\0';
return BLINK_OK;
}
#define BLINK_MSG_SSID_INDEX (9)
//ssid长度索引 9
result->ssid_len = priv->message[BLINK_MSG_SSID_INDEX];
//ssid长度
result->passphrase_len = priv->message[priv->message[BLINK_MSG_SSID_INDEX] + BLINK_MSG_SSID_INDEX + 1];
//密码长度=ssid长度+ssid索引+1，ssid的后一位是密码长度
Blink逆向关键代码
/bleService/BleDeviceAPProfile.java
public static byte[] getAPProfile(byte b, String str, String str2) {
byte[] bytes = str.getBytes();
SSIDLength = (byte) bytes.length;
if (b != (byte) 0) {
PasswordLength = (byte) str2.getBytes().length;
}
byte[] bArr = new byte[(((SSIDLength + 10) + 1) + PasswordLength)];
System.arraycopy(syncTr, 0, bArr, 0, 4);
bArr[4] = version;
bArr[5] = GeneralConfig.APP_PROFILE_SEND_POLICY;
bArr[6] = ServiceID;
bArr[7] = GeneralConfig.APP_PROFILE_SECURITY_POLICY;
bArr[8] = b;
byte b2 = SSIDLength;
bArr[9] = b2;
System.arraycopy(bytes, 0, bArr, 10, b2);
if (b != (byte) 0) {
bytes = str2.getBytes();
b2 = SSIDLength;
byte b3 = PasswordLength;
bArr[b2 + 10] = b3;
System.arraycopy(bytes, 0, bArr, b2 + 11, b3);
}
Log.d(TAG, "getAPProfile: ");
return bArr;
}
/config/GeneralConfig.java
package com.example.android.config;
public class GeneralConfig {
public static byte APP_BLE_DEVICE_BOND = (byte) 1;
public static byte APP_BLE_DEVICE_FILTER = (byte) 1;
public static String APP_BLE_DEVICE_FILTER_NAME = "Xradio Ble";
public static byte APP_DEV_VERSION = (byte) 16;
public static byte APP_PROFILE_SECURITY_POLICY = (byte) 1;
public static byte APP_PROFILE_SEND_POLICY = (byte) 1;
}
配网响应部分协议解析
在发送配网信息后客户端（手机端）会接收到如下通知数据
分析目标：<0A0B1112>
设置配网状态（618行）
// out/t113-100ask/compile_dir/target/wifimanager-v2.0-0.1/core/src/os/linux/linkd/linkd_ble/linkd_ble.c
#define BLINK_IND_SYNC (0x0A)
#define BLINK_MSG_SERVICE_ID (0x0B)
#define BLINK_IND_STATUS_DEFAULT (0x10)
#define BLINK_IND_STATUS_COMPLETE (0x11)
#define BLINK_IND_STATUS_CONNECT (0x12)
//(以下为618行)
blink_ret_t blink_set_state(blink_state_t state)
{
blink_priv_t *priv = blink;
WMG_WARNG("blink_set_state\n");
if (priv == NULL) {
WMG_WARNG("not init\n");
return BLINK_ERROR;
}
if (priv->indicate > 0) {
priv->indValue[0] = BLINK_IND_SYNC;
priv->indValue[1] = BLINK_MSG_SERVICE_ID;
priv->indValue[2] = (priv->status == BLINK_STATUS_COMPLETE) ?
BLINK_IND_STATUS_COMPLETE : BLINK_IND_STATUS_DEFAULT;
priv->indValue[3] = (state == BLINK_STATE_SUCCESS) ?
BLINK_IND_STATUS_CONNECT : BLINK_IND_STATUS_DEFAULT;
bt_blink_send_indication(tx_handle, &(priv->indValue[0]), sizeof(priv->indValue));
return BLINK_OK;
}
return BLINK_ERROR;
}
安卓逆向代码
public static int getAPStatus(byte[] bArr) {
if (bArr[0] == syncRe && bArr[1] == ServiceID) {
if (bArr[2] == 17 && bArr[3] == 18) {
Log.d(TAG, "getAPStatus: ok");
return 1;
}
Log.d(TAG, "getAPStatus: fail");
return 0;
}
Log.d(TAG, "getAPStatus: fail");
return 0;
}
wifimanager-v2 ble配网协议
// 发送数据
Hex：5A 6E 3C 6F 10 01 0B 01 FF 05 31 32 33 34 35 08 31 32 33 34 35 36 37 38
完整协议分析结果：
5A 6E 3C 6F // [0-3] 发送同步标识，必须和预设相同
10 // [4] 协议版本
01 // [5] FMT,不能为0，默认01
0B // [6] ServiceID固定值
01 // [7] APP_PROFILE_SEND_POLICY固定值
FF // [8] 0xff
05 // ssid长度
31 32 33 34 35 // 12345 ssid
08 // password长度
31 32 33 34 35 36 37 38 // 12345678 password
// 响应数据
Hex：0A 0B 11 12
0A [0] 通知同步标识，固定值
0B [1] SERVICE_ID固定值，需要和发送数据的SERVICE_ID相同
11 [2] 配网完成状态，完成：0x11，失败：0x10
12 [3] 配网成功状态，成功：0x12，失败：0x10
判断配网成功可以参考getAPStatus(byte[] bArr)函数
验证：
安卓app，BLE调试助手
如果失败了，请查看底部FAQ
微信小程序，科名BLE
FAQ:
如果默认使用配网工具会遇到发送密码不完整，发现发送的数据被截断
这是因为没有修改包大小（默认长度20左右）
使用科名BLE调试可以直接调整包大小为一个比较大的值
使用BLE调试助手，需要在连接ble后，修改mtu大小
