一个WiFi模块开出多个热点（不可连接）

作者: Neucrack | 来源:发表于2017-02-16 01:47 被阅读1460次

效果图

原理

根据802.11协议，发现热点使用的是广播，并且是明文，所以在混杂模式下发送beacon帧或者在接收到Probe request之后返回Probe response即可模拟一个热点，接收到Association request 或者其它请求可以不用理会，这里的目的只是生成一个假热点，不会实现连接认证等步骤

IEEE官方网站

可以在这里查看相关资料，也可以百度

beacon帧格式

WiFi的帧格式如下：

802.11frame format
关于每个字段的意义，可以看这篇文章
beacon帧type=0,subtype=8。一个典型的beacon帧分析看这里
关于element ID，简单地，可以看这篇文章

beacon帧举例：

uint8_t beacon_frame[]={
/*FC*/            0x80 ,0x0 ,
/*DID*/           0x0 ,0x0 ,
/*MAC Addr*/      0xff ,0xff ,0xff ,0xff ,0xff ,0xff ,0x8 ,0x9b ,0x4b ,0x92 ,0x3e ,0xcd ,0x8 ,0x9b ,0x4b ,0x92 ,0x3e ,0xcd ,
/*SC*/            0x30 ,0x4f ,
/*Timestamp*/     0x80 ,0x51 ,0xcb ,0x68 ,0xd ,0x0 ,0x0 ,0x0 ,
/*BeaconInterval*/0x64 ,0x0 ,
/*CapabilityInfo*/0x31 ,0x0 ,
/*SSID(ElementID(1 Byte)-Length(1 Byte)-Data(Length Bytes))*/
                  0x0 ,28 ,'0','0','0','0','0','0','0','0','0','0','0','0','0','0','0',
        '0','0','0','0','0','0','0','0','0','0','0','0','0',
        0x1 ,0x8 ,0x82 ,0x84 ,0x8b ,0x96 ,0xc ,0x12 ,0x18 ,0x24 ,
/*Below same as SSID，elementID different*/
        0x3 ,0x1 ,0xb ,
        0x5 ,0x4 ,0x1 ,0x2 ,0x0 ,0x0 ,
        0x2a ,0x1 ,0x0 ,
        0x32 ,0x4 ,0x30 ,0x48 ,0x60 ,0x6c ,
        0x30 ,0x14 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x4 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x4 ,0x1 ,0x0 ,0x0 ,0xf ,0xac ,0x2 ,0xc ,0x0 ,
        0x2d ,0x1a ,0xed ,0x11 ,0x1b ,0xff ,0xff ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0 ,0x1 ,0x1 ,0x0 ,0xba ,0x0,
        0xa5, 0x10 ,0xf2 ,0x50 ,0x0 ,0x0 ,0x0 ,0x0 ,0x0  };

为保证所有的beacon帧都能被识别成一个热点，源mac地址应都不一样，最好信道也不一样，经测试，很多手机会过滤mac相同的beacon，只显示其中一个热点

实现

esp8266

8266支持混杂模式，在这个模式下可以接收和发送有限制的底层数据。station模式下进入混杂模式，发送WiFi beacon帧

注意：不能链接任何wifi，先调用wifi_station_disconnect();断开连接，避免自动连接上了wifi
每次发送要确保上一次已经发送完毕了(发送回调函数调用后)再发送

//汉字：2个字节+'\0'==>每个汉字3字节
uint8_t ssids[4][28]={{"一、泉眼无声惜细流"},{"二、树阴照水爱晴柔"},{"三、小荷才露尖尖角"},{"四、早有蜻蜓立上头"}};

void send_beacon()
{
    static int count=0;
    wifi_set_channel(count+5);
    beacon_frame[10] = count+1;
    beacon_frame[16] = count+1;
    os_memcpy(beacon_frame+38,ssids[count],28);
    beacon_frame[78] = count+5;
    wifi_send_pkt_freedom(beacon_frame,sizeof(beacon_frame),0);
    os_printf("send %d bytes data,ssid:%s\n",sizeof(beacon_frame),ssids[count]);
    if(++count ==4)
        count=0;
}

void on_reedom_pkg_sent(uint8 status)
{
    if(status == 0)
    {
        //sent succeed
        os_printf("send beacon success\n");
    }
    send_beacon();
}

    wifi_set_opmode(STATION_MODE);
    wifi_promiscuous_enable(0);
    wifi_station_disconnect();
     wifi_set_promiscuous_rx_cb(on_wifi_promiscuous_received);
     wifi_promiscuous_enable(1);
     wifi_register_send_pkt_freedom_cb(on_reedom_pkg_sent);
     send_beacon();

linux

需要网卡及驱动支持混杂模式即可，原理相同

附录

esp8266混杂模式接收到的部分原始数据
接收到的数据先用十六进制输出，然后用ascll码输出


a6 10 15 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 6 88 f b8 55 10 6 88 f e0 25 ac 3 33 7e 52 1 0 0 64 0 11 4 0 f 54 4f 54 4f 4c 49 4e 4b 5f 30 36 38 38 30 46 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 1 0 15 1 

�Q��������U��U��%�3~RdTOTOLINK_06880����$
                                                           *20H`l-n�=




b2 4b 1e 50 a 6a 0 7 40 0 b 0 

�KP
j@
  



a2 10 66 50 0 0 0 0 e2 0 0 0 8 42 0 0 ff ff ff ff ff ff bc d1 77 f ac 7c 0 e0 4c 4f 83 87 20 11 3 23 63 60 0 7 79 7a 70 31 32 30 1 0 66 0 20 11 0 e0 4c 4f 83 87 

�fPB��������w�|�LO�� #c`yzp120f �LO��



b3 4b b7 50 a 4c 4 7 40 0 b 0 

�K�P
L@
  



bb 10 c3 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 16 cf 92 37 bd a2 16 cf 92 37 bd a2 70 ed 80 b5 ed 73 52 1 0 0 64 0 31 4 0 7 70 72 69 6e 74 65 72 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 1 2 0 0 7 6 30 30 20 1 b 14 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a 6c 11 1b ff 0 0 0 1 0 c3 0 

��P�������ϒ7��ϒ7��p퀵�sRd1printe����$
                                                       00 
                                                          *20H`l0���-l��



ab 0 4 51 0 0 0 0 0 0 0 0 50 0 3a 1 e8 b4 c8 ad e2 47 b8 55 10 69 aa 82 b8 55 10 69 aa 82 20 61 2b 5e bc f6 28 3 0 0 64 0 11 4 0 4 31 30 31 31 1 8 82 84 8b 96 c 12 18 24 3 1 b 2a 1 0 32 4 30 48 60 6c 2d 1a 6e 18 1e ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 4 1 

�QP:�ȭ�G�Ui���Ui�� a+^��(d101����$
                                                 *20H`l-n��=




a8 4b 12 50 85 7e 0 6 40 0 b 0 

�KP�~@




ac 10 a 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 69 aa 82 b8 55 10 69 aa 82 30 61 73 21 bd f6 28 3 0 0 64 0 11 4 0 4 31 30 31 31 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 0 0 0 0 0 0 0 0 0 0 1 0 a 1 

�
Q��������Ui���Ui��0as!��(d101����$
                                                     *20H`l-n��=





a7 4b 12 50 85 70 0 6 40 0 b 0 

�KP�p@




a3 10 2d 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff a8 ad 3d c1 32 14 a8 ad 3d c1 32 14 40 94 76 51 92 ff 2a 2 0 0 64 0 11 4 0 d 43 68 69 6e 61 4e 65 74 2d 4e 72 48 4b 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 2c 18 1e ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 0 0 1 0 2d 1 

�-Q���������=�2��=�2@�vQ��*dChinaNet-NrH����$
                                                                  *20H`l-,��=
                                                                               -



b7 4b 99 50 7 fe 5 16 e2 0 0 0 88 42 2c 0 28 b2 bd 43 61 38 8 9b 4b 92 3e cd 0 1a 20 e0 2 ee 0 6b 0 0 2c 67 0 20 0 0 12 88 43 35 1 0 fe 5 0 6b 0 1a 20 e0 2 ee 

�K�P���B,(��Ca�K�>� ��k,g �C5�k ��



b2 4b 18 50 b 5e 0 7 40 0 b 0 

�KP
    ^@




9e 10 d7 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 24 69 68 c3 6a ee 24 69 68 c3 6a ee 30 8 7 9 9 af 51 0 0 0 64 0 31 4 0 b 4c 61 6f 43 68 61 6e 67 53 68 61 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 7 0 1 0 0 0 0 0 2a 1 0 32 4 30 48 60 6c 2d 1a 6e 10 3 ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 1 0 d7 0 

��P�������$ih�j�$ih�j�0            �Qd1
                                                     LaoChangSh����$
                                                                        *20H`l-n��=
                                                                                     �



a6 4b 12 50 87 74 0 1f c3 0 b 0 

�KP�t�




a7 10 15 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 6 88 f b8 55 10 6 88 f 20 26 e6 41 39 7e 52 1 0 0 64 0 11 4 0 f 54 4f 54 4f 4c 49 4e 4b 5f 30 36 38 38 30 46 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 1 0 15 1 

�Q��������U��U� &�A9~RdTOTOLINK_06880����$
                                                           *20H`l-n�=




bc 10 c3 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 16 cf 92 37 bd a2 16 cf 92 37 bd a2 a0 ed 81 65 f2 73 52 1 0 0 64 0 31 4 0 7 70 72 69 6e 74 65 72 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 2 0 0 7 6 30 30 20 1 b 14 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a 6c 11 1b ff 0 0 0 1 0 c3 0 

��P�������ϒ7��ϒ7����e�sRd1printe����$
                                                         00 
                                                            *20H`l0���-l��



a0 10 d7 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 24 69 68 c3 6a ee 24 69 68 c3 6a ee 40 8 8 99 a af 51 0 0 0 64 0 31 4 0 b 4c 61 6f 43 68 61 6e 67 53 68 61 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 7 0 1 0 0 0 0 0 2a 1 0 32 4 30 48 60 6c 2d 1a 6e 10 3 ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 1 0 d7 0 

��P�������$ih�j�$ih�j�@
�Qd1
     LaoChangSh����$
                        *20H`l-n��=
                                     �



aa 4b 12 50 85 8c 0 6 40 0 b 0 

�KP��@




ad 10 a 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 69 aa 82 b8 55 10 69 aa 82 60 61 73 d1 c1 f6 28 3 0 0 64 0 11 4 0 4 31 30 31 31 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 0 0 0 0 0 0 0 0 0 0 1 0 a 1 

�
Q��������Ui���Ui��`as���(d101����$
                                                      *20H`l-n��=





be 10 c3 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 16 cf 92 37 bd a2 16 cf 92 37 bd a2 b0 ed 80 f5 f3 73 52 1 0 0 64 0 31 4 0 7 70 72 69 6e 74 65 72 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 1 2 0 0 7 6 30 30 20 1 b 14 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a 6c 11 1b ff 0 0 0 1 0 c3 0 

��P�������ϒ7��ϒ7������sRd1printe����$
                                                          00 
                                                             *20H`l0���-l��



a7 4b 2a 50 87 55 2 1f c3 0 b 0 

�K*P�U�




b5 10 ba 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 8 9b 4b 92 3e cd 8 9b 4b 92 3e cd 10 72 a 64 67 10 b 0 0 0 64 0 31 0 0 6 76 61 6e 6b 69 61 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 1 2 0 0 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a ed 11 1b ff ff 0 0 0 0 0 0 0 0 0 0 1 1 0 ba 0 

��P�������K�>�K�>�r
dg
  d1vanki����$
                  *20H`l0���-����



b7 4b 99 50 7 f8 5 16 e2 0 0 0 88 42 2c 0 28 b2 bd 43 61 38 8 9b 4b 92 3e cd 0 1a 20 e0 2 ee 50 6b 0 0 31 67 0 20 0 0 64 0 31 0 1 0 f8 5 50 6b 0 1a 20 e0 2 ee 

�K�P���B,(��Ca�K�>� ��Pk1g d1�Pk ��



ab 4b 12 50 85 86 0 6 40 0 b 0 

�KP��@




b2 4b 18 50 b 5e 0 7 40 0 b 0 

�KP
    ^@




b8 9 1e 50 0 0 0 0 0 0 0 0 c8 11 2c 0 8 9b 4b 92 3e cd 78 4f 43 67 9f e9 8 9b 4b 92 3e cd 50 bb 6 0 0 0 f5 db 51 a0 0 a8 6f ae 1 0 1e 0 50 bb 8 9b 4b 92 3e cd 

�      P��K�>�xOCg��K�>�P���Q��o�P�K�>�



ac 10 a 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 69 aa 82 b8 55 10 69 aa 82 70 61 73 61 c3 f6 28 3 0 0 64 0 11 4 0 4 31 30 31 31 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 7 0 0 0 0 0 0 0 0 0 0 1 0 a 1 

�
Q��������Ui���Ui��pasa��(d101����$
                                                     *20H`l-n��=





aa 4b 12 50 85 8b 0 6 40 0 b 0 

�KP��@




a9 4b 12 50 85 7c 0 6 40 0 b 0 

�KP�|@




b3 10 ba 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 8 9b 4b 92 3e cd 8 9b 4b 92 3e cd 20 72 74 8 69 10 b 0 0 0 64 0 31 0 0 6 76 61 6e 6b 69 61 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 2 0 0 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a ed 11 1b ff ff 0 0 0 0 0 0 0 0 0 0 1 1 0 ba 0 

��P�������K�>�K�>� ri
                                    d1vanki����$
                                                    *20H`l0���-����



a4 10 d8 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 28 2c b2 80 a2 6 28 2c b2 80 a2 6 50 3b 80 e9 b1 76 52 1 0 0 64 0 31 4 0 c 63 68 69 70 72 69 73 65 30 30 30 31 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 7 0 1 1 0 0 0 0 2a 1 0 32 4 30 48 60 6c 2d 1a 6e 10 3 ff ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 1 0 d8 0 

��P�������(,���(,���P;��vRd1chiprise000����$
                                                                 *20H`l-n��=
                                                                              �



a9 10 15 51 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff b8 55 10 6 88 f b8 55 10 6 88 f 50 26 24 f2 3d 7e 52 1 0 0 64 0 11 4 0 f 54 4f 54 4f 4c 49 4e 4b 5f 30 36 38 38 30 46 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 0 1 0 0 2a 1 4 32 4 30 48 60 6c 2d 1a 6e 18 1e ff 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3d 16 b 1 0 15 1 

�Q��������U��U�P&$�=~RdTOTOLINK_06880����$
                                                           *20H`l-n�=




c4 10 c3 50 0 0 0 0 0 0 0 0 80 0 0 0 ff ff ff ff ff ff 16 cf 92 37 bd a2 16 cf 92 37 bd a2 d0 ed 81 15 f7 73 52 1 0 0 64 0 31 4 0 7 70 72 69 6e 74 65 72 1 8 82 84 8b 96 c 12 18 24 3 1 b 5 4 1 2 0 0 7 6 30 30 20 1 b 14 2a 1 0 32 4 30 48 60 6c 30 14 1 0 0 f ac 4 1 0 0 f ac 4 1 0 0 f ac 2 c 0 2d 1a 6c 11 1b ff 0 0 0 1 0 c3 0 

��P�������ϒ7��ϒ7�����sRd1printe����$
                                                        00 
                                                           *20H`l0���-l��



bb 9 1e 50 0 0 0 0 0 0 0 0 c8 1 2c 0 8 9b 4b 92 3e cd 78 4f 43 67 9f e9 8 9b 4b 92 3e cd 60 bb 6 0 0 0 6 0 0 0 64 0 11 4 1 0 1e 0 60 bb 8 9b 4b 92 3e cd 

�      P��K�>�xOCg��K�>�`�d`�K�>�

一个WiFi模块开出多个热点（不可连接）

原理

IEEE官方网站

beacon帧格式

实现

esp8266

linux

附录

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读