Tmall Genie

1 Setup WiFi

配网指南

”找队友“ 可以发现进入配网状态的 WiFi 设备

BRLink plug: 78:0F:77:C8:70:58

Tmall Genie: 78:DA:07:78:66:78

MAC Query

原理：

Plug Dev 广播 UDP 包，ieee80211 Probe Request，Probe Request 包的 tagged parameter 字段是不加密的，这个字段中的 SSID 可以每次最大传送 32 字节的数据。Refer to: https://github.com/ly0/esp8266-smartlink

• Probe Request SSID = BROADLINK
• Probe Response: SSID = tmall_genie/TmallGenie

2 Discover

Send UDP to: 239.255.255.250:1900

Tmall-Genie send UDP packet when 'discover devices':

M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
ST: ssdp:all
MAN: "ssdp:discover"
MX: 3

M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
MAN: "ssdp:discover"
MX: 10
ST: urn:aligenie:iotdevice:service

3 Reference

• Upnp
• Amazon Alexa
• Airkiss