Sunday, December 4, 2011

Introduction to Bluetooth RFCOMM Reverse Engineering

by Travis Goodspeed <travis at radiantmachines.com>
with thanks to Alexei Karpenko

Spot Connect (cropped)

Reverse engineering a Bluetooth device is rather straightforward, but quite a few good neighbors don't know where to begin. This article demonstrates exactly how an Android client was reverse engineered in order to produce open source clients in Python and QT Mobility. I'm writing with the assumption that you are trying to reverse engineering your own device, which is similar but not identical to mine. As this is an introductory guide, I'll stay clear of any code reverse engineering, sticking only to network traffic.

The subject of this article is the Spot Connect, which transmits one-way text messages and GPS coordinates by L-band to the GlobalStar satellite constellation. These messages are then forwarded by email or SMS. Except in its emergency mode, the device is operated through Bluetooth by a smart phone. Thanks to Android's use of the Bluez bluetooth stack, it is rather easy to get the necessary traffic dumps.

Kind thanks are due to Alexei Karpenko (Natrium42) for his article on SPOT Reverse Engineering, which covers the original SPOT unit in excellent and thorough detail. It was his article that got me looking at the Spot Connect, and his description of the GPS format saved me quite a bit of travel for sample collection.

GlobalStar Beacon

Sniffing RFCOMM


The first step is to load the official client onto a rooted Android phone, in my case a Nexus S. I had to swap SIM cards as my Brazilian one put me in a region of the Android market that didn't have the application. Switching to a Swiss card fixed this, and a moment later the app was installing.

SPOT Connect

The Spot Connect uses RFCOMM, which is Bluetooth's alternative to a TCP socket or a UART. As it is easy to prototype and always delivers packets in order, RFCOMM has become the standard way of implementing custom protocols. To sniff the traffic before knowing the mode, we'll use hcidump running in a debugging shell of the phone. For this, run adb shell hcidump -X | tee spotlog.txt on your workstation, send a transmission, and watch the result in the log.

The message being sent stands out as ASCII, of course, so it's the first thing to look for. With no knowledge of the HCI protocol, you can still be sure that you have a cleartext recording.

HCIDump Screenshot

35 00 40 00 0b ef 63 aa 31 26 01 00 01 00 01 4d  5.@...c.1&.....M
72 2e 20 57 61 74 73 6f 6e 2c 20 63 6f 6d 65 20 r. Watson, come
68 65 72 65 2e 20 49 20 77 61 6e 74 20 74 6f 20 here. I want to
73 65 65 20 79 6f 75 2e 9a see you..

From Alexei's article, you can expect that frames inside of RFCOMM will begin with 0xAA, followed by a length, followed by a verb and the objects. These bytes will be wrapped in padding on the outbound end, and they'll be fragmented on the inbound end. Sure enough, these are the bytes that come before the word ``Watson'':
aa Preamble
31 Length
26 Verb
01 00 01 00 01 Flags (OK, Check In)
4d 72 2e 20 57 ASCII Message (abbreviated)

Counting 0x31 bytes out, notice that the packet ends exactly on a byte of the ASCII message, without a checksum! By looking for bytes of AA and searching for length, with allowances for packet fragmentation and the RFCOMM wrapper, it becomes possible to decode every command and its matching response.

Be aware that responses will be fragmented more than transmissions. If you need to reverse engineer longer transactions or have a more complete log, it will be handy to have a script to reassembly from the HCI frames. In those cases, toss together a proper HCI decoder to get a more accurate interpretation of the records.

Looking through the entire log, it the protocol appears to be as follows. First, the client queries the Device ID with verb 0x01, using the exact same format as Alexei's article. Then it uses verb 0x25 to query the last known position of the device, which will be returned in the style that Alexei reverse engineered from the original unit. Use pen and paper to decode these transactions from my Python client.
Location Query

First Implementation


With these recordings in hand, the complete language can now be described and implemented. Luckily, three verbs make for a quick implementation!

I use py-bluez for prototyping such implementations, as its rfcomm-client.py example is simple enough to get a working client in minutes. As py-bluez is specific to Linux, Mac users might prefer lightblue.

For simplicity, cut the UUID code or switch it to RFCOMM's UUID, which is 00001101-0000-1000-8000-00805F9B34FB. For a list of all services on a device, run 'sdptool records $adr'. This only lists those which are publicly announced by SDP, the Service Discovery Protocol. To scan for unadvertised services, try BT Audit from Collin Mulliner.

0x01 -- Get ID
A minimal test client will just test the serial number of the device. To do this, simply send "\xAA\x03\x01" and then catch the reply with verb 0x01. Bytes 3, 4, 5, and 6 of the reply will contain the serial number in Big Endian notation. For this first implementation, commands and their responses may be handled synchronously for simplicity.

Where self.tx() takes a frame as its input and returns the response, this is implemented in Python as the following. What could be simpler?
SpotConnect.getid(self)

0x25 -- Get Last Position
Similar in calling convention, the 0x25 verb requests the last known GPS position of the device. The coordinate format is exactly the same as in Alexei Karpenko's Spot Hacking article, consisting of three bytes apiece to describe latitude and longitude. The following is my C++ code for parsing the position data, which has already been requested as "\xAA\x03\x25".

SpotConnect::parsePosition(char*)

0x26 -- Transmit Text
Transmitting text is just as easy, with the Spot Connect handling all the work after a message has been loaded. The following is Python code to transmit a short text message with the OK message-code. This lacks length checks and doesn't support the changing of flags, but it will work perfectly well for a test.

SpotConnect.checkin()

After the device receives this command, it will reply with an acknowledgment and then begin to attempt transmissions at irregular intervals. Each transmission consists of a number of fragments, such that the packet can be reassembled so long as one copy of each fragment makes it through. If you have a clear view of the sky and have configured the first destination to be your email address, you should receive a notification within a few minutes. If you don't receive a notification by the time the mailbox icon has ceased blinking, then the transmission failed.

Other Verbs
These three verbse--0x01, 0x25, and x026--are sufficient to implement a minimal client for the Spot Connect. If you'd care to help out, it would be useful to have more documentation for the flags of the 0x26 verb, as well as documentation for 0x52, 0x40, and 0x38. By scanning and listening for error codes, it should be possible to get a complete list of those verbs that are unused by the Android application.

You can find my Python client at https://github.com/travisgoodspeed/pyspot . It ought to run as-is on Linux with py-bluez, including the Nokia N900.

A Graphical Client


Now that the protocol has been sufficiently well documented to have a Python implementation, it is worthwhile to rewrite it as a GUI. In my case, I wanted a QT Mobility client for my Nokia N9. You can find my work in progress at https://github.com/travisgoodspeed/goodspot.

Pacific Ocean

Other Methods


If hcidump isn't available for your platform, you might try Sniffing with a USRP or reflashing a dongle to become a commercial sniffer. For a jailbroken iPhone, see the iPhone Wiki's documentation.

Another option would be to create a Bluetooth proxy, relying on the slim authentication performed in the protocol. In this case, the proxy would open all relevant port to the device being reverse engineered, ferrying commands back and forth as a way to record them. You might also need to experiment with changing the device class and, in the case of iOS devices, there is also a lockout sequence that must be implemented.

If none of that works for your device, you could sniff the UART lines that come from the bluetooth module, shown here on the left board. This particular module happens to be a BT23, and Page 8 of BT23_Datasheet.pdf shows that pins 14 and 13 should be tapped to get a communications log.
SPOT Connect

As a last resort, you could always ask for documentation. I didn't bother with this because of my own impatience, but for some devices, such as the Metawatch, documentation is freely available. More than once, a neighborly vendor has been so kind as to give me the source code or documentation just to be neighborly.

Future Work


This article will be followed with one on the physical layer protocol of the SPOT, which I've been able to sniff thanks to some kind help from Michael Ossmann. For a preview of that technique, you are welcome to stalk my SPOT Connect Set on Flickr. The most neighborly of these shows individual bits from a FunCube Dongle recording of the transmission. It's cleartext, of course.
Bits from SPOT Connect

Replacement firmware is also a possibility. The Spot Connect uses an MSP430F5xx microcontroller with the standard USB bootloader, using a Java client on Windows and an Objective C client on OS X. The firmware itself is downloaded by HTTPS, and a copy could be acquired either by a MITM attack on HTTPS or by asking the bootloader politely, using the password that is to be found within the firmware update. Be careful when doing this to test on a unit without a service contract, as service cannot be moved from one unit to another and bricking is a distinct possibility.

Conclusions


I hope that this article has given you a decent overview of the methods for reverse engineering Bluetooth RFCOMM devices. While my subject was the Spot Connect, these methods would apply equally well to something like a GPS, the Metawatch, Bluetooth chat applications, and multiplayer games. Other brands of Bluetooth satellite communicators are available, and open documentation for them would be quite handy. For a list of a few thousand potential targets, search the Bluetooth SIG's Gadget Guide.

268 comments:

«Oldest   ‹Older   201 – 268 of 268
praise said...

Internet Cafe Simulator Mod Apk
My Telenor App Download
Payment not completed
How to Lock apps in samsung
Facebook Marketplace
Tata Study app

India Ai Credit cash Loan app
Master Duel Meta
Bulli Bai App
Jio Phone Finger Print Lock App

sarah said...

Nice post Biology Dissertation Help Dunedin

David Paul said...

Uncommon experience, was upheld and finances move inside 1-2 work days. Completed everything on the application, affirmed data with specialists. Quick and straightforward cycle! Will stay with allbadcreditloan!
Personal Loans for Bad credit
Loans for Bad credit

Loans for people with bad credit said...

Speedy and simple endorsement process. Extraordinary client support delegates who were cordial and educated. By and large, exceptionally happy with allbadcreditloan.
Online Loans for Bad credit
Loans for people with bad credit

Personal Loans for Bad credit said...

In a real sense took me 5 minutes and I was endorsed! Cash in my record the following week!
Bad Credit Loans Personal
Bad Credit Loans for people

personal loans for bad credit said...

Fast and simple and uncommon client service....would most certainly suggest.

Car Loans for Bad credit
Bad Credit Loans

David Paul said...

Exploited once before while buying a vehicle and considered them again when prepared to do redesigning. The rate is truly sensible and I can decide my own time allotment. I stay exceptionally dedicated to the installment timetable or pay some extra to pay off right on time. Client support is private and checked out needs.
Personal Loans for Bad credit
Loans for Bad credit

Loans for people with bad credit said...

I applied for a commitment cementing credit, the development cycle was so fast and basic! Allbadcreditloan dealt with my extravagant premium Mastercards exceptionally speedy and I had the choice to get a much lower financing cost on the credit.
Online Loans for Bad credit
Loans for people with bad credit

Personal Loans for Bad credit said...

allbadcreditloan was easy to investigate through process. Had a mistake with on the web anyway had the choice to complete the connection through phone.
Bad Credit Loans Personal
Bad Credit Loans for people

personal loans for bad credit said...

I truly needed a tree cut down and the expense isn't awful, yet not incredible either high I simply expected to get a loan....and the allbadcreditloan sent me an email ...so I asked and got in such a brief period of time...Amazing...I should have mentioned more!
Car Loans for Bad credit
Bad Credit Loans

Instant loans for low credit score said...

The experience was extraordinary. Everything was smoothed out and effortless.
Personal Loans for Bad credit
Loans for Bad credit

Homeloan4badcredit said...

It was not difficult to iron out the subtleties, and I'm exceptionally happy with the outcomes.
Online Loans for Bad credit
Loans for people with bad credit

Quick loan said...

the cash was moved straightforwardly into my record and was accessible immediately.
Bad Credit Loans Personal
Bad Credit Loans for people

personal loans for bad credit said...

Generally speaking, from the point where I chose to apply for a line of loan , through the real dispensing of the assets, was extremely speedy and proficient. I was pre-supported quickly online while applying, needed to supply 1 extra archive on the web, and had the subsidizing only a couple of days after the fact.


No check credit loan
Installment Loans for Bad credit

Loans for people with bad credit said...

By a long shot awesome and effortless credit process I have at any point experienced. What grabbed my attention is the No start expense.
Loans for Bad Credit Online
Loans for Bad credit score

The Hydrocodone said...

The process was easy and the call to finalize the loan was fast and simple.
Auto Loans for Bad credit
Urgent Loans for Bad credit

Loans for Bad credit score said...

Quick, easy application process, great customer service when I called with questions.
Small Loans for Bad credit
Home Loans for Bad credit

Fast loan with terrible credits said...

I found assistance delegate exceptionally simple to work with which aided settle on my choice to finish the credit. Gotten the credit expeditiously.
Car Loans for Bad credit
Bad Credit Loans

Installment Loans for Bad credit said...

This is my subsequent time getting an individual advance and the subsequent time was much more straightforward.
No check credit loan
Installment Loans for Bad credit

allbadcreditloan said...

The interaction was very easy to use. The outcomes were quick and I preferred that I could require some investment and finish up all the loan boss data to combine my obligation. Additionally, my obligations were paid extremely quickly.
Loans for Bad Credit Online
Loans for Bad credit score

Allbadcreditloan said...

it was quite easy to get the development; in any case, it would've been less difficult accepting I'd known early what regulatory work I needed. For my circumstance, it was three months of monetary equilibrium history. Whenever I gave that information it expected just a few days to get the money.
Auto Loans for Bad credit
Urgent Loans for Bad credit

Loans for Bad credit score said...

The entire cycle from beginning to end was so basic. I was genuinely stunned!
Small Loans for Bad credit
Home Loans for Bad credit

ireland assignment help said...

After looking into a handful of the blog articles on your site, I really like your technique of writing a blog. I book marked it to my bookmark site list and will be checking back in the near future. help in write my essay

Bad Credit Loans Personal said...

Excellent post. I learned numerous things regarding this theme!
Bad Credit Loans Personal
Bad Credit Loans for people

MalaysiaAssignmentHelp said...

Exams approaching near and still did not have started studying, don't worry just visit Malaysia assignment help for Final exam helper Malaysia and get help of our experts at very low price in online exams and score good marks.

Anonymous said...

We offer the best Naran valley tour packages at Tour My Pakistan

Unknown said...

Sell My House Fast!
Receive Cash Offer From A Trusted Home Buying Expert! Sell Your House Fast Without An Agent. Sell My Home Today

Mstech said...

If you click on this link and read this article, it means that you are also a big fan OnlineMovieWatchs

Study live zone said...

Usually I never comment on blogs but your article is so convincing that I never stop myself to say something about it. You’re doing a great job Man,Keep it up. Meanwhile visit our website for nmims solved assignments june 2022

lasmusic said...

GRSoft's Remote IT infrastructure services are custom-tailored based on your business needs. Our Remote IT infrastructure services align network architecture and end-to-end communication, to ensure your company has the best IT solutions. We provide a wide array of IT infrastructure services, right from IT infrastructure and consulting support to managing the most complex of IT infrastructural issues, with absolute precision.

Lucy Lohan said...

Suppose your credit score is bad. So don't worry. We will give you the loan because we are a three-year-old Blockchain crypto exchange. We will provide you with the loan within 24 hours.

Personal Loans for Bad credit
Loans for Bad credit

Since 2015, we’ve been bringing borrowers and investors together, transforming the way people access to credit. Over the last 5 years, we’ve helped over 50,000 people take control of their debt, grow their small businesses, and invest in the future.

Online Loans for Bad credit
Loans for people with bad credit

The individual credit moneylenders in our system offer advance choices with terms going from twelve to eighty-four months—those people with great to-phenomenal. On the off chance that you are a person with not as much as excellent credit, Life House Financial. Our system of sheltered and trusted unsecured advance suppliers welcomes all credit circumstances.

Bad Credit Loans
No check credit loan

Finding the Personal Loans For Bad Credit for your requirements and credit event just got a great deal simpler. By submitting one frame, you’ve detected the bank’s unions—other portion advance suppliers inspired by seeking your business.

Bad Credit Loans Personal
Car Loans for Bad credit

Life House Financial has practical experience in securing. An unsecured advance’s most widely recognized employments contain obligation union—

Installment Loans for Bad credit
Loans for Bad Credit Online


If you are hunting down a personal advance, you’ve found the correct organization. Our coordinating oversight is accessible. 

Loans for Bad credit
Auto Loans for Bad credit

There is never any commitment or strain to continue if you are unhappy with the result. 

Urgent Loans for Bad credit
Small Loans for Bad credit


Use the begin catch beneath to inform us regarding your own advanced needs and get the chance to work instantly. 

Home Loans for Bad credit
Bad Credit Loans Personal

Richhustlershub said...

Long Paragraphs for Him Copy And Paste
Love Messages
Biography And Net worth
Ogb Recent Biography
Long Paragraphs for Him Copy And Paste

Richhustlershub said...

Long Cute Paragraphs For Him With Emoji’s

Aditi Gupta said...

Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.
Buy Instagram Followers In Delhi

Ronnie XP said...

Excellent read full of rich and detailed information.
Hey music lovers, check your favourite song lyrics here : LyricsTUBEs

lasmusic said...

Do you know there is a great writer and actor you haven't heard about? his name is bnorris read about him here

jasa cleaning service said...

Nice for sharing your article, Please visit my webiste please jasa kebersihan kantor

EDF Renewables India said...

Thank you for sharing such valuable information with us. Renewable energy companies in India

SFA Body Repairs said...

Hey, I'm Hussian Ceo At SFA body repairs Dandenong, Australia, We specialize in all top class body repairs, with expertise in car restoration to give aesthetic and practical standard that goes beyond all expectations.

LindaRoss said...

It’s the best time to make a few plans for the long run and it is time to be happy. I have read this post and if I may just I desire to suggest you few fascinating issues or advice. Maybe you can write next articles referring to this article. I wish to learn more issues approximately it!.
situs judi bola
agen bola parlay
bandar judi bola online
agen bola hepibet
agen slot parlay
judi bola resmi
agen judi bola

Shifa Aman said...

Bluetooth is becoming an important part of our lives. These days headphones, speakers, and other devices are connected to it. Other factors are also important for Best Mobile Under 20000. I was a good camera and some extra space for my apps. Thank God I was successful. I manage to buy a good set.

M Toqeer said...

Excellent blog! Appreciate your effort of writing a value able content.
We also publish this type of content in our video and content marketing website, just visit our profile.

diploma assignmenthelp uk said...

Thanks for posting this info. I just want to let you know that I just check out your site and I find it very interesting and informative. Homework help online in uk

Oasis Visas said...

Thank you for sharing such amazing content, I would like to share my articles with you, we are an immigration consultant in India hope your users like it. Please go through my articles once. Are you eager to know about Immigration to USA from India You can consult with Oasis Resource Management.

Amelia william said...

Your blog is awsome dr squatch soap we craft our soap using a traditional cold process and use nourishing natural ingredients like Coconut Oil, Shea Butter, and Kaolin Clay.

ramarajanmech said...

always wish to read. this is really helpful to us inventory management system

Aslam Shaha said...

agar apko bhi paisa kamana hai to aap insabse jaada paisa dene wala app se ghar baithe paise kama sakte ho. our jaankari ke liye upar diye hue link par visit kare thank you

Good and Bad People said...

The Eiffel Tower in Bahria Town Lahore

cyphershield said...

tron smart contract audit

Supreme Hospital said...

What a wonderful blog it really helps me a lot keep doing this work also have a look on this Best Fertility Clinic In Faridabad

My Translation Services said...

Searching for a reliable translation service provider in the UK? Look no further than MyTranslationServices.com. As a leading UK translation agency, we offer comprehensive language solutions for individuals and businesses alike. Our dedicated team of translators understands the nuances of different languages and cultures, enabling us to deliver translations that resonate with your target audience. From professional document translations to video subtitling and voice-over services, we strive to exceed your expectations with our exceptional linguistic skills and attention to detail.

Jamesen said...

Your blogs are really good and interesting. It is very great and informative. I'm writing with the assumption that you are trying to reverse engineering your own device, which is similar but not identical to mine. As this is an introductory guide, I'll stay clear of any code reverse engineering, sticking only to network traffic Sex Crime Lawyer. I got a lots of useful information in your blog. Keeps sharing more useful blogs..

Electrifying Empire said...

Very interesting article, and very educative as well... Thanks for this

Pema wangmo said...

Thanks for sharing nice content with us! Embrace the captivating charm of canvas embroidery at SmewIndia, where creativity finds its canvas and every thread tells a tale. Allow your surroundings to metamorphose, infusing your life with artistry and depth. Each intricate stitch becomes a whisper of inspiration, guiding your voyage into the enchanting world of art.

Pema wangmo said...

Thanks for sharing nice content with us, keep sharing! Experience the magic of 3D Paper Cut Shadow Boxes with SmewIndia and let your surroundings come alive with the artistry they bring.

Presh said...

This is some really good stuff. You should see mine too:
Facebook Bonus Program
Streetbees App
Vegamovies
Thomdock Login

shofialisa said...

Analysis of the Protocol: To reverse engineer RFCOMM, you must analyse the protocol in great detail. Understanding the data packet format, commands, and answers used for Bluetooth device communication is part of this...... Divorce Lawyers Fredericksburg VA
divorce custody laws

Jewel Galore said...

Unleash your inner glamour with Jewel Galore's earrings that shine like precious gems. From classic to contemporary, adorn yourself with elegance and brilliance.

OSH UNIVERSITY said...

Osh University is a distinguished medical science university , known for its commitment to advancing healthcare education and research on a global scale.

Shalamar Hospital said...

Shalamar Hospital's plastic surgery center is dedicated to enhancing your appearance, combining expertise with a caring approach in a modern medical environment.

Robert Adler said...

Kudos to your blog for being a beacon of knowledge in the ever-evolving world of web and mobile app development! Your insights on top frameworks have proven invaluable for our team in San Diego , shaping our approach to crafting cutting-edge mobile applications. Your guidance has empowered us to explore new horizons about mobile app development los angeles , delivering exceptional solutions to our clients. The wealth of information here is a game-changer, and we eagerly anticipate more pearls of wisdom in future posts. Cheers to elevating the standards of mobile app development!

naresh said...

I think this is an informative post and it is very useful and knowledgeable. Therefore, I would like to thank you for your efforts in writing this article. Thanks for sharing the best article post
Here is sharing PTC Windchill Admin related stuff that may be helpful to you.
PTC Windchill Admin Training

assignment helper said...

Need help with your assignment, then connect with Global assignment expert. We serve our assignment worldwide and with accuracy. Global assignment help has a team of educational writer and they are good at their work and help you with your assignment and clear your doubts. Assignment writer is known of writing assignment error free and plagiarism free too. If you are looking for accounting homework help, project related help, or help in any academic subject, We have solution for all. And the best part is, we are reachable 24/7 for your help, so contact us on our website for more assignment related help, and we will write assignment as per your requirement and budget.

Sophia said...

Social media agency Dubai offers innovative strategies and creative solutions, elevating brands in the city's dynamic digital landscape with expertly crafted campaigns and engaging content.

karthichivee103 said...

Great article gratitude for sharing.The subject of this article is the Spot Interface, which sends one-way instant messages and GPS facilitates by L-band to the GlobalStar satellite star grouping. These messages are then sent by email or SMS. But in its crisis mode, the gadget is worked through Bluetooth by a PDA. On account of Android's utilization of the Bluez bluetooth stack, it is fairly simple to get the fundamental traffic dumps. Bienes Abogado Charlottesville VA

Architecture in Lahore said...

Thanks for sharing the information Architects in Lahore

ISO provider said...

Great introduction to Bluetooth RFCOMM. Your explanations made the technical details much easier to understand, especially for beginners. Thanks for providing such a valuable resource on wireless communication.
For ISO Certification In Saudi Arabia Contact us.

Newberrycountyhistory said...

In Southeast Asia, especially in Indonesia, Ligamansion2 is a popular online slot platform. Its extensive selection of slot games, secure, user-friendly design, and excellent RTP (Return to Player) rates have earned it widespread recognition. Gamers gain access to a large selection of game themes from top providers, significant bonuses, and trustworthy, round-the-clock customer support. With quick payment alternatives and strong data protection, Ligamansion2 provides all users with a seamless and profitable slot experience.

hot-game

poker-game

crash-game

live-casino

e-sports

«Oldest ‹Older   201 – 268 of 268   Newer› Newest»