深入浅出低功耗蓝牙(BLE)协议栈（实战篇）

apt-get install python-software-properties
add-apt-repository ppa:pyside
apt-get update
apt-get install libnl-dev libusb-1.0-0-dev pyside-tools

wget https://github.com/greatscottgadgets/libbtbb/archive/2015-09-R2.tar.gz -O libbtbb-2015-09-R2.tar.gz
tar xf libbtbb-2015-09-R2.tar.gz
cd libbtbb-2015-09-R2
mkdir build
cd build
cmake ..
make
sudo make install

wget https://github.com/greatscottgadgets/ubertooth/releases/download/2015-09-R2/ubertooth-2015-09-R2.tar.xz -O ubertooth-2015-09-R2.tar.xz
tar xf ubertooth-2015-09-R2.tar.xz
cd ubertooth-2015-09-R2/host
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

sudo apt-get install checkinstallwget https://www.wireshark.org/download/src/wireshark-2.0.3.tar.bz2tar -xvf wireshark-2.0.3.tar.bz2cd wireshark-2.0.3./configuremakemake install

wget https://kismetwireless.net/code/kismet-2013-03-R1b.tar.xz
tar xf kismet-2013-03-R1b.tar.xz
cd kismet-2013-03-R1b
ln -s ../ubertooth-2015-09-R2/host/kismet/plugin-ubertooth .
./configure
make && make plugins
sudo make suidinstall
sudo make plugins-install

git clone https://github.com/mikeryan/crackle.git
cd crackle
make
make install

root@0xroot:~# hcitool --help
hcitool - HCI Tool ver 4.99
Usage:
    hcitool [options] <command> [command parameters]
Options:
    --help    Display help
    -i dev    HCI device
Commands:
    dev     Display local devices
    inq     Inquire remote devices
    scan    Scan for remote devices
    name    Get name from remote device
    info    Get information from remote device
    spinq    Start periodic inquiry
    epinq    Exit periodic inquiry
    cmd     Submit arbitrary HCI commands
    con     Display active connections
    cc      Create connection to remote device
    dc      Disconnect from remote device
    sr      Switch master/slave role
    cpt     Change connection packet type
    rssi    Display connection RSSI
    lq      Display link quality
    tpl     Display transmit power level
    afh     Display AFH channel map
    lp      Set/display link policy settings
    lst     Set/display link supervision timeout
    auth    Request authentication
    enc     Set connection encryption
    key     Change connection link key
    clkoff    Read clock offset
    clock    Read local or remote clock
    lescan    Start LE scan
    lewladd    Add device to LE White List
    lewlrm    Remove device from LE White List
    lewlsz    Read size of LE White List
    lewlclr    Clear LE White list
    lecc    Create a LE Connection
    ledc    Disconnect a LE Connection
    lecup    LE Connection Update

root@0xroot:~# gatttool -h
Usage:
  gatttool [OPTION...]

Help Options:
  -h, --help                                Show help options
  --help-all                                Show all help options
  --help-gatt                               Show all GATT commands
  --help-params                             Show all Primary Services/Characteristics arguments
  --help-char-read-write                    Show all Characteristics Value/Descriptor Read/Write arguments

Application Options:
  -i, --adapter=hciX                        Specify local adapter interface
  -b, --device=MAC                          Specify remote Bluetooth address
  -m, --mtu=MTU                             Specify the MTU size
  -p, --psm=PSM                             Specify the PSM for GATT/ATT over BR/EDR
  -l, --sec-level=[low | medium | high]     Set security level. Default: low
  -I, --interactive                         Use interactive mode

gatttool -b 1C:96:5A:FF:4B:E7 -I
[   ][1C:96:5A:FF:4B:E7][LE]> help
help                                           Show this help
exit                                           Exit interactive mode
quit                                           Exit interactive mode
connect         [address]                      Connect to a remote device
disconnect                                     Disconnect from a remote device
primary         [UUID]                         Primary Service Discovery
characteristics [start hnd [end hnd [UUID]]]   Characteristics Discovery
char-desc       [start hnd] [end hnd]          Characteristics Descriptor Discovery
char-read-hnd   <handle> [offset]              Characteristics Value/Descriptor Read by handle
char-read-uuid  <UUID> [start hnd] [end hnd]   Characteristics Value/Descriptor Read by UUID
char-write-req  <handle> <new value>           Characteristic Value Write (Write Request)
char-write-cmd  <handle> <new value>           Characteristic Value Write (No response)
sec-level       [low | medium | high]          Set security level. Default: low
mtu             <value>                        Exchange MTU for GATT/ATT
[   ][1C:96:5A:FF:4B:E7][LE]>

root@0xroot:~# ubertooth-scan --help
ubertooth-scan: invalid option -- '-'
ubertooth-scan - active(bluez) device scan and inquiry supported by Ubertooth
Usage:
    -h this Help
    -U<0-7> set ubertooth device to use
    -s hci Scan - perform HCI scan
    -t scan Time (seconds) - length of time to sniff packets. [Default: 20s]
    -x eXtended scan - retrieve additional information about target devices
    -b Bluetooth device (hci0)

ubertooth-btle - passive Bluetooth Low Energy monitoring
Usage:
    -h this help

    Major modes:
    -f follow connections
    -p promiscuous: sniff active connections
    -a[address] get/set access address (example: -a8e89bed6)
    -s<address> faux slave mode, using MAC addr (example: -s22:44:66:88:aa:cc)
    -t<address> set connection following target (example: -t22:44:66:88:aa:cc)

    Interference (use with -f or -p):
    -i interfere with one connection and return to idle
    -I interfere continuously

    Data source:
    -U<0-7> set ubertooth device to use

    Misc:
    -r<filename> capture packets to PCAPNG file
    -q<filename> capture packets to PCAP file (DLT_BLUETOOTH_LE_LL_WITH_PHDR)
    -c<filename> capture packets to PCAP file (DLT_PPI)
    -A<index> advertising channel index (default 37)
    -v[01] verify CRC mode, get status or enable/disable
    -x<n> allow n access address offenses (default 32)

If an input file is not specified, an Ubertooth device is used for live capture.
In get/set mode no capture occurs.

btle.data_header.length > 0 || btle.advertising_header.pdu_type == 0x05

crackle -i <file.pcap>

crackle -i <file.pcap> -o <output.pcap>
crackle -i <file.pcap> -o <out.pcap> -l <ltk>