Skip to content
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 

BlueCrawl

Bluetooth meta-data collector for Android (using Frida JS). BlueCrawl serves to aid any bluetooth based research folks seek to do on android. As with any other protocol, reverse engineering it requires seeing how it is interpreted from different view points; here I present the viewpoint of the java layer in the application. Having this info can also aid a variety of activities involving spoofing bluetooth information and checking whether apps are stealing or maliciously scanning for bluetooth objects.

Example

> frida -U -l bluecrawl-1.0.0.js com.android.bluetooth
     ____
    / _  |   Frida 12.2.15 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
                                   
[LGE Nexus 5X::com.android.bluetooth]-> 
 ---------- BlueCrawl : Bluetooth Metadata collector
 v1.0.0

 finding loaded bluetooth classes
[->]	android.bluetooth.IBluetoothManagerCallback$Stub
[->]	android.bluetooth.IBluetoothHeadset$Stub
[->]	android.bluetooth.IBluetoothProfileServiceConnection$Stub
[->]	android.bluetooth.BluetoothProfile$ServiceListener
[->]	android.bluetooth.IBluetoothHeadset
[->]	android.bluetooth.BluetoothGattServerCallback
...
[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothSocket'...
[*] 'android.bluetooth.BluetoothSocket' instance found 'android.bluetooth.BluetoothSocket@c445cb2'
[*]	getting info for 'android.bluetooth.BluetoothSocket@c445cb2'
[*]	- isConnected          :false
[*]	- connection type    :(1) L2CAP
[x]	- conneted device   : device details not available
[*]	- InputStream        :android.bluetooth.BluetoothInputStream@ceae875
[*]	- OutputStream        :android.bluetooth.BluetoothOutputStream@256d00a

[*] 'android.bluetooth.BluetoothSocket' instance found 'android.bluetooth.BluetoothSocket@5f8bd5f'
[*]	getting info for 'android.bluetooth.BluetoothSocket@5f8bd5f'
[*]	- isConnected          :false
[*]	- connection type    :(3) SCO
[x]	- conneted device   : device details not available
[*]	- InputStream        :android.bluetooth.BluetoothInputStream@3b7d3f3
[*]	- OutputStream        :android.bluetooth.BluetoothOutputStream@8cb78b0

[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothServerSocket'...
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 5'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 4'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4097'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 6'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4099'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4101'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 7'
[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothDevice'...
[*]  android.bluetooth.BluetoothDevice instance found :=> 'FF:FF:FF:BE:EE:EF'
[*]	Bluetooth device ['FF:FF:FF:BE:EE:EF']
[*]	- Name           :Nexus 5
[*]	- Address        :FF:FF:FF:BE:EE:EF
[*]	- Type           :(1) Classic
[*]	- Device Class   :5a020c
[*]		-- Class Major  : (512)  Phone
[*]	- Bond State     :(12) Bonded

*Disclaimer : MAC addresses shown here are fabricated entirely. Prints in color too!

About

Frida (Android) Script for extracting bluetooth information

Resources

Releases

No releases published

Packages

No packages published