Coming from Another Tool

Coming from Another Tool

If you already use another BLE tool, find the row that matches your habit. One target flag everywhere (-b <BDADDR>) and -o json on any command for scripting.

If you reach for...	for...	Try in caeruleus
bettercap ble.recon	finding devices (live-updating list)	caeruleus scan --live (streams found/updated devices; -o jsonl for one event/line)
hcitool lescan	LE device discovery	caeruleus scan (add -t <secs> for the window)
bettercap ble.enum <mac>	listing services/chars	caeruleus enumerate -b <mac> --values
gatttool -I / -b <mac> -I	an interactive session	caeruleus shell -b <mac>
gatttool --char-read-hnd 0x0013	reading a handle	caeruleus read -b <mac> -a 0x0013
gatttool --char-write-req 0x15 -n 41	writing a handle	caeruleus write -b <mac> -a 0x0015 -n 41 --req
bluetoothctl scan/info	discovery + a quick profile	caeruleus scan / caeruleus recon -b <mac>
nRF Connect (GUI) GATT browser	seeing the whole tree + values	caeruleus enumerate -b <mac> --values
custom Bleak/pygatt: "what can I read unpaired?"	unauth exposure + audit	caeruleus recon -b <mac> and caeruleus assess check-auth -b <mac>
custom script: "does it enforce pairing/encryption?"	encryption enforcement	caeruleus assess encryption -b <mac>
bluetoothctl pair / remove	pairing / bonding tests	caeruleus pair -b <mac> / caeruleus unpair -b <mac>
custom Bleak notification logger	capturing notifications	caeruleus listen -b <mac> -a 0xHND --duration 10s
btmon grep for notifications	catching notifications BlueZ hides	sudo caeruleus monitor -b <mac>
nrfutil / DFU poking	spotting an exposed DFU entry	caeruleus assess dfu -b <mac>
custom write fuzzers / boofuzz	fuzzing a writable characteristic	caeruleus fuzz write -b <mac> -a 0xHND
hcitool con / nRF Connect conn-params	interval / latency / timeout / MTU	sudo caeruleus conn-params -b <mac> ; caeruleus mtu -b <mac> --show
hciconfig reset / rfkill / power-cycling	recovering a stuck adapter	caeruleus doctor ; caeruleus adapter power cycle ; caeruleus forget -b <mac>
bdaddr (BlueZ tool)	reading / spoofing the adapter MAC	sudo caeruleus bdaddr --show / --set <mac>

Worked examples

Recon and read, like ble.enum then gatttool:

caeruleus scan -t 8
caeruleus enumerate -b AA:BB:CC:DD:EE:FF --values   # full GATT + values
caeruleus read  -b AA:BB:CC:DD:EE:FF -a 0x0013      # or  -u 2a00

Interactive, like gatttool -I (gatttool-style verbs work):

caeruleus shell -b AA:BB:CC:DD:EE:FF
  > primary
  > characteristics
  > char-read-hnd 0x0013          # or: read 0x0013
  > char-write-req 0x0015 41424344
  > listen 0x001e
  > quit

Write a string vs hex (--req forces write-with-response):

caeruleus write -b AA:BB:CC:DD:EE:FF -a 0x0015 -s "hello"
caeruleus write -b AA:BB:CC:DD:EE:FF -a 0x0015 -n 48656c6c6f --req

Replace one-off Bleak audit scripts:

caeruleus recon -b AA:BB:CC:DD:EE:FF             # fingerprint + hidden-readable chars + DFU/serial audit
caeruleus assess check-auth -b AA:BB:CC:DD:EE:FF # what an unpaired attacker can read (secrets flagged via Titus)
caeruleus assess encryption -b AA:BB:CC:DD:EE:FF # baseline -> pair -> re-test -> unpair fallback
caeruleus assess dfu -b AA:BB:CC:DD:EE:FF        # detect 0xFE59 + unauthenticated buttonless entry