search

securing / gattacker

A Node.js package for BLE (Bluetooth Low Energy) security assessment using Man-in-the-Middle and other attacks
http://www.gattack.io
MIT License
708 stars 142 forks source link

bleno and noble #2

Open mprokopowicz opened 8 years ago

mprokopowicz commented 8 years ago

Why are bleno and noble packages kept in lib dir? Are they modified somehow? If not then I want to suggest adding them package.json as dependencies.

securing commented 8 years ago

Yes, they are modified.

Noble:

We need raw hex values of BLE advertisements: EIR broadcasted from device, and the EIR "scan response". Noble gives us only parsed versions, and in many cases it is not enough to "clone" original device 1:1. My PR to noble: https://github.com/sandeepmistry/noble/pull/426 Similar discussion: https://github.com/sandeepmistry/noble/issues/436

I would be happy to depend on unmodified noble. I was planning to give a try a trick by Damien Cauquil in btlejuice: https://github.com/DigitalSecurity/btlejuice/blob/a0be08e0a05f6946b8c18a5ffa124ff975e0662c/proxy.js#L185-#L191 https://github.com/DigitalSecurity/btlejuice/blob/a0be08e0a05f6946b8c18a5ffa124ff975e0662c/proxy.js#L213-#L227 I haven't been able to test it yet.

Secondly, I recently added long write support for noble: https://github.com/sandeepmistry/noble/pull/452 This feature is not yet pushed here in GATTacker's lib/noble. But if the PR to noble won't be accepted, this would be another reason to keep fork.

Bleno:

Because of mobile OS GATT cache we need to specify exact handle numbers. And also we don't need default bleno services. Discussion (with detailed description): https://github.com/sandeepmistry/bleno/issues/224