Open abbiy opened 1 year ago
Ideally, download the bluetoothd of one of the versions with known addresses. You can find these on https://appledb.dev, unzip the IPSW, and then mount the largest .dmg file. Within that, you can find the bluetoothd binary.
For diffing, you can use Ghidra's versioning tool or attempt to manually do so. Many functions in bluetoothd still print meaningful strings and typically functions are easy to find, unless Apple did too much refactoring between the versions.
Hi jiska thanks for your reply. I tried the poc using the same steps and setup of keychange but whenever i change the LTK it doesn't get connected and again target device asked for pairing process. Can you tell me is there any way possible to achieve the poc?