fO-000 / bluing

An intelligence gathering tool for hacking Bluetooth
GNU General Public License v3.0
714 stars 100 forks source link

How did you get the RSSI value? #2

Closed playground7 closed 3 years ago

playground7 commented 3 years ago

Hello,

How did you get the RSSI value?

fO-000 commented 3 years ago

For BR/EDR devices, when we start inquiry (scanning), we may receive the following two HCI events. And both of them have a RSSI parameter.

For LE devices, when we start scanning, we may receive the HCI_LE_Advertising_Report event. And it also has a RSSI parameter.

image

So just analyze the above HCI events, we can get the RSSI.

In the code, I simply use PyBlueZ and bluepy to do these. But may be later, I‘ll change the implementation method to improve stability.

playground7 commented 3 years ago

I have some questions for you.

1) I wonder if i can get the raw advertising packets when I start inquiry(scanning).

2) Is it possible to get the class of device(COD) value through the BLE scanner?

fO-000 commented 3 years ago

The advertising packet is a concept belonging to BLE. And the inquiry is a concept belonging to BR/EDR. So when we start an inquiry, there is no advertising packet.

And the CoD is a concept belonging to BR/EDR. So in BLE scanning, there is no CoD we can get.

playground7 commented 3 years ago

Thank you for your kind reply.

I have some questions for you.

1) Could I get the raw inquiry reply or advertising packets from your BD/EDR or BLE scanner?

2) When the scan() function is called in the le_scan.py file, the type error occurs as shown below.

TypeError:` scan() missing 1 required positional argument: 'self'

Could you let me know the solution for this?

3) When I run sdp_scan.py, I could see the error the following error.

FileNotFoundError: [Errno 2] No such file or directory: '../res/sdp_record_xml_sample/2.xml'

Could you please provide me with the 2.xml file?

fO-000 commented 3 years ago

Which version of the bluescan are you using? And how did you execute bluescan? Please provide more information, like command line output.

playground7 commented 3 years ago

I am using 0.1.1 version of the bluescan.

I have run the le_scan.py file in Pycharm.

In the le_scan.py file, "LEScanner.scan()" is added as follows to call scan() function in the LEScanner class.


class LEScanner(BlueScanner):
    def scan(self, timeout=8, scan_type='active', sort='rssi'):

           scanner = Scanner(self.devid).withDelegate(LEDelegate())

                                          ...

def __test():
    LEScanner.scan()

if __name__ == "__main__":
    __test()

The result is that the the type error occurs as shown below.


Traceback (most recent call last): File "/home/user/PycharmProjects/bluescan/le_scan.py", line 112, in __test() File "/home/user/PycharmProjects/bluescan/le_scan.py", line 109, in __test LEScanner.scan() TypeError: scan() missing 1 required positional argument: 'self'


I am wondering if what argument should be entered when the scan() function is called.

fO-000 commented 3 years ago

I see. The way you run that test is wrong and you can't directly run thele_scan.py. This is because of the import mechanism in Python 3.

For normal users, you should only use this tool within the scope of the help document. It can be found in README.md and bluescan --help. For advanced users, of course, you can play whatever you want. But you should also know how to deal with basic problems.

And for raw inquiry results or advertising packets, we might need some programmable SoCs to get them. Currently bluescan doesn't plan to bring these functions to open source, but it may be in the future.

playground7 commented 3 years ago

1) Do you know how to identify the vendor ID of bluetooth LE?

2) When scanning bluetooth low energy devices, the manufacturer(0xFF) is displayed in the terminal. What does manufacturer(0xFF) mean?

fO-000 commented 3 years ago

Please check the Bluetooth Core Specification.

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C page 1392, 11 ADVERTISING AND SCAN RESPONSE DATA FORMAT