conorpp / btproxy

Man in the Middle analysis tool for Bluetooth.
GNU General Public License v3.0
507 stars 76 forks source link

Support for BT-LE? #1

Open ghost opened 8 years ago

ghost commented 8 years ago

Any chance of supporting Bluetooth Low Energy? This seems like the perfect tool for reverse engineering the new BB-8 toy.

conorpp commented 8 years ago

Yes, BLE could be supported. This has been on my TODO list for a while, just a matter of finding the timer.

Since BLE is essentially a completely different protocol, a few days or week of work would be required. A similar approach taken with btproxy currently with regular Bluetooth protocol can be applied to BLE, it's just a matter of writing functionality for:

With the later being the more complicated part. To put simply, regular Bluetooth applications set up a RFCOMM or L2CAP socket and they can easily be cloned or relayed. BLE on the other hand, doesn't do RFCOMM/L2CAP sockets for applications and instead uses a more specialized protocol GATT.

See the two stacks:

Regular Bluetooth

BLE

AFAIK, layers below L2CAP can be ignored.

So I see two ways about going about it.

  1. Take the current btproxy approach and emulate GATT sockets and relay data sent by each device in a GATT supported manner. This would be easier to setup for different platforms.
  2. Just relay traffic on L2CAP layer. But L2CAP is typically handled in a kernel module. So that may be too invasive to get working. Also I'm not sure how functional this approach would be yet.

I was planning to try the first approach when I got some free time down the road. If anyone is interested in helping out, that would be great.

There are some nice looking BLE libraries out there.

https://github.com/IanHarvey/bluepy https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno

piaca commented 7 years ago

@conorpp what time btproxy support BLE?

conorpp commented 7 years ago

@piaca It probably won't. Check out btlejuice.

piaca commented 7 years ago

@conorpp the btlejuice project so good, thank you