Skip to content

Frida (Android) Script for extracting bluetooth information

Notifications You must be signed in to change notification settings

IOActive/BlueCrawl

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 

Repository files navigation

BlueCrawl

Bluetooth meta-data collector for Android (using Frida JS). BlueCrawl serves to aid any bluetooth based research folks seek to do on android. As with any other protocol, reverse engineering it requires seeing how it is interpreted from different view points; here I present the viewpoint of the java layer in the application. Having this info can also aid a variety of activities involving spoofing bluetooth information and checking whether apps are stealing or maliciously scanning for bluetooth objects.

Example

> frida -U -l bluecrawl-1.0.0.js com.android.bluetooth
     ____
    / _  |   Frida 12.2.15 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
                                   
[LGE Nexus 5X::com.android.bluetooth]-> 
 ---------- BlueCrawl : Bluetooth Metadata collector
 v1.0.0

 finding loaded bluetooth classes
[->]	android.bluetooth.IBluetoothManagerCallback$Stub
[->]	android.bluetooth.IBluetoothHeadset$Stub
[->]	android.bluetooth.IBluetoothProfileServiceConnection$Stub
[->]	android.bluetooth.BluetoothProfile$ServiceListener
[->]	android.bluetooth.IBluetoothHeadset
[->]	android.bluetooth.BluetoothGattServerCallback
...
[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothSocket'...
[*] 'android.bluetooth.BluetoothSocket' instance found 'android.bluetooth.BluetoothSocket@c445cb2'
[*]	getting info for 'android.bluetooth.BluetoothSocket@c445cb2'
[*]	- isConnected          :false
[*]	- connection type    :(1) L2CAP
[x]	- conneted device   : device details not available
[*]	- InputStream        :android.bluetooth.BluetoothInputStream@ceae875
[*]	- OutputStream        :android.bluetooth.BluetoothOutputStream@256d00a

[*] 'android.bluetooth.BluetoothSocket' instance found 'android.bluetooth.BluetoothSocket@5f8bd5f'
[*]	getting info for 'android.bluetooth.BluetoothSocket@5f8bd5f'
[*]	- isConnected          :false
[*]	- connection type    :(3) SCO
[x]	- conneted device   : device details not available
[*]	- InputStream        :android.bluetooth.BluetoothInputStream@3b7d3f3
[*]	- OutputStream        :android.bluetooth.BluetoothOutputStream@8cb78b0

[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothServerSocket'...
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 5'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 4'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4097'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 6'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4099'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_L2CAP Channel: 4101'
[*]  'android.bluetooth.BluetoothServerSocket' instance found 'ServerSocket: Type: TYPE_RFCOMM Channel: 7'
[*] -----

 searching loaded classes for 'android.bluetooth.BluetoothDevice'...
[*]  android.bluetooth.BluetoothDevice instance found :=> 'FF:FF:FF:BE:EE:EF'
[*]	Bluetooth device ['FF:FF:FF:BE:EE:EF']
[*]	- Name           :Nexus 5
[*]	- Address        :FF:FF:FF:BE:EE:EF
[*]	- Type           :(1) Classic
[*]	- Device Class   :5a020c
[*]		-- Class Major  : (512)  Phone
[*]	- Bond State     :(12) Bonded

*Disclaimer : MAC addresses shown here are fabricated entirely. Prints in color too!

About

Frida (Android) Script for extracting bluetooth information

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published