I was curious as to how Apple implemented AirDrop discovery (particularly the Contacts Only feature) because their documentation is helpful, but vague[1]. I spent a night reverse engineering it, and this is the process:

1. Alice opens the AirDrop sheet.

2. Alice begins advertising her short "proximity"[2] hashes over BTLE.

3. Bob, continually scanning in the background, sees Alice and her hashes.

4. If Bob either a) has the "Everyone" setting enabled, or b) has a match to one of Alice's proximity hashes in his contacts, Bob connects to Alice over AWDL.

6. Bob starts a HTTP server.

7. Bob advertises a Bonjour service for his HTTP server.

8. Alice sends a discovery request.

9. If the request is valid, Bob sends a discovery response (including device model, name and icon).

Also to note, the author, Mario Ciabarra is the (co?)-founder of Rock Your Phone, the alternative to Cydia until the two merged in 2010[3].

[1] https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20... (Page 23)

[2] Each device hashes every phone number and email in its address book with SHA256 after normalizing them. These hashes are referred to as full hashes. The "proximity" hashes are the first two bytes of the long hash. The full hashes are not broadcasted, but they are verified later over AWDL.

[3] http://www.tuaw.com/2010/09/11/alliance-of-the-jailbreakers-...