Upgrade to Pro — share decks privately, control downloads, hide ads and more …

TEPRA Lite ではじめる BLE リバースエンジニアリング / tepra-lite-...

Takumi Sueda
September 26, 2021
6.1k

TEPRA Lite ではじめる BLE リバースエンジニアリング / tepra-lite-ble-reverse-engineering

第54回 情報科学若手の会 #wakate2021

Takumi Sueda

September 26, 2021
Tweet

More Decks by Takumi Sueda

Transcript

  1. 8

  2. : 9

  3. 1 . Android APK 2 . BLE sni ff er

    2 BLE 29 Bluefruit LE Sni ff er https://www.switch-science.com/catalog/ 3 34 7 /
  4. PC Bluetooth API 
 MicroPython Wi-Fi BLE 🥰 BLE 31

    ESPr® Developer 32 https://www.switch-science.com/catalog/ 3 21 0 /
  5. 1 . 2 . BLE Service Characteristic 
 3 .

    4 . 5 . 2 4 6 . API 7 . 32 
 CC BY 2 . 0 https://www. fl ickr.com/photos/inucara/ 4 809 4 81634
  6. 1. Nordic 
 Wireshark sni ff er Python 2 Apple

    Silicon Mac pyenv Python 2 . 7 . 18 pyenv PR macOS + Apple Silicon + pyenv Python 3 Bluefruit LE Sni ff er Python 2 Bluefruit LE Sni ff er macOS (Apple Silicon) 35
  7. 2 . GATT Service Characteristic ATT (ATTribute Protocol) 
 512

    Attribute Handle 2 GATT (Generic ATTribute Protocol) 
 Attribute Service Characteristic ATT Service 
 Characteristic 
 Service 
 37 ATT GATT Service Service Declaration Declaration Characteristic Characteristic Declaration Value Descriptor Declaration Value Descriptor Characteristic Characteristic
  8. 2 . GATT Service Characteristic MicroPython Python (REPL) Bluetooth API

    bluetooth import BLE IRQ API gattc_discover_services Service discovery prop_write_without_response Characteristic MicroPython BLE 38
  9. 2 . GATT Service Characteristic 0x180f Battery Service … 0x2a19

    Battery Level Characteristic 0xfff0 TEPRA Lite Service 0xfff1 TEPRA Lite Char. … Notify (RX) 0xfff2 TEPRA Lite Char. … Write Without Response (TX) Service Characteristic 39 Service Characteristic
  10. 2 . GATT Service Characteristic 0x180f Battery Service … 0x2a19

    Battery Level Characteristic 0xfff0 TEPRA Lite Service 0xfff1 TEPRA Lite Char. … Notify (RX) 0xfff2 TEPRA Lite Char. … Write Without Response (TX) Service Characteristic 40 Characteristic
  11. 3. 45 f0 5c = 2 00 03 00 00

    00 00 00 00 = 1 00 03 00 00 00 00 00 00 = 2
  12. 3. 46 00 03 00 00 00 00 00 00

    2 Bytes (word) After 00 00 00 00 00 00 00 03 Before After
  13. 55