米家智能设备Token获取及控制IOT设备

本文最后更新于 2022年02月09日 已经是 411天前了，文章可能具有时效性，若有错误或已失效，请在下方留言。

获取Token方法

这里我只介绍我获取成功的方法，网上许多方法都失效了

下载Mi Home v5.4.54版本

下载地址 https://android-apk.org/com.xiaomi.smarthome/43397902-mi-home/

这里我给一个镜像地址 https://wwi.lanzouy.com/isgMhztjbmb

获取token

登录小米账号并且操作一下设备。
使用文件浏览器打开

/sdcard/SmartHome/logs/Plug_Devicemanager/

你可以看到下面的内容，保存到一个位置，后面会用到

...
erifyCode":0,"isPasswordEncrypt":0},"uid":***,"pd_id":2451,"password":"","p2p_id":"","rssi":-39,"family_id":0,"reset_flag":0},{"did":"***","token":"e***f","longitude":"0.00000000","latitude":"0.00000000","name":"台灯","pid":"0","localip":"192.168.2.172","mac":"***","ssid":"***","bssid":"***","parent_id":"","parent_model":"","show_mode":1,"model":"yeelink.light.lamp4","adminFlag":1,"shareFlag":0,"permitLevel":16,"isOnline":true,"desc":"设备在线 ","extra":
...

尝试连接IOT设备

环境安装和配置

这里使用的是

GitHub

rytilahti/python-miio

python-miio 安装方法

首先你的设备需要安装好 Python 环境，通过运行
pip install python-miio
安装该工具，如有报错请先 Google 一下，具体安装教程在
https://python-miio.readthedocs.io/en/latest/discovery.html#installation

你的计算机需要和IOT设备在一个网络中

开始连接

PS C:\Users\enjoy> miiocli device --ip 192.168.2.172 --token e***f info
Model: yeelink.light.lamp4
Hardware version: esp32
Firmware version: 2.1.7_0017

出现上面的信息则代表连接成功！

分析 Binary Protocol

sequenceDiagram autonumber note right of Client: 初始握手 Client->>Device: Hello 包 Device->>Client: Hello 包 (未初始化设备会包含 token)

 0                   1                   2                   3   
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Magic number = 0x2131         | Packet Length (incl. header)  |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Unknown1                                                      |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Device ID ("did")                                             |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Stamp                                                         |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| MD5 checksum                                                  |
| ... or Device Token in response to the "Hello" packet         |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| optional variable-sized data (encrypted)                      |
|...............................................................|

                Mi Home Binary Protocol header
       Note that one tick mark represents one bit position.
 
 Magic number: 16 bits
     Always 0x2131
     
 Packet length: 16 bits unsigned int
     Length in bytes of the whole packet, including the header.
  
 Unknown1: 32 bits
     This value is always 0,
     except in the "Hello" packet, when it's 0xFFFFFFFF
     
 Device ID: 32 bits
     Unique number. Possibly derived from the MAC address.
     except in the "Hello" packet, when it's 0xFFFFFFFF

 Stamp: 32 bit unsigned int
     continously increasing counter
     
 MD5 checksum:
     calculated for the whole packet including the MD5 field itself,
     which must be initialized with 0.
     
     In the special case of the response to the "Hello" packet,
     this field contains the 128-bit device token instead.
 
 optional variable-sized data:
     encrypted with AES-128: see below.
     length = packet_length - 0x20

The variable-sized data payload is encrypted with the Advanced Encryption Standard (AES)

AES加密的key和iv使用下面的算法计算

Key = MD5(Token)
IV  = MD5(MD5(Key) + Token)
CBC & PKCS#7 padding

payloads 数据大多数都是 JSON 数据

{
  'id': XXX,  // 这是 UNIX 时间戳
  'method': 'miIO.config_router',
  'params': {
    'ssid': 'WiFi network',
    'passwd': 'WiFi password',
    'uid': YYY   // 设备的所有者
  }
}

详细控制数据参考文档 https://www.yeelight.com/download/Yeelight_Inter-Operation_Spec.pdf