• Stars
    star
    144
  • Rank 247,326 (Top 6 %)
  • Language
    Swift
  • Created almost 4 years ago
  • Updated over 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Nmap for Bluetooth Low Energy

BTLEmap

Installation

Pull the GitHub repository, open it in Xcode and run it on iOS or macOS. The linked libraries should be fetched automatically with the Swift Package Manager integration of Xcode.

Features

The main app is divided in three parts: (1) BLE Devices, (2) Proximity View, (3) RSSI Graph.

BLE Devices

This view shows a list of BLE Devices discovered in your surrounding. Every device has an icon, either a Bluetooth logo or an icon representing the identified device class. You can click on a device to show all advertisements that have been received by this device. The advertisements are dissected at best effort. If no dissector is available or parts of the data are encrypted the binary data will be shown. If the BLE scanner has been able to detect services on this devices it lists them in the detail view as well. This includes all detected characteristics.

Using the Button with 3 Dots on the right of the list the settings are accessible.

Proximity View

The proximity view presents the same data on a circular plane. All devices are positioned on this plane according to the measured RSSI value. RSSI values do not allow distance measurement, but they give an estimation on the relative distance between all devices discovered in the area. The devices animate in real-time to new RSSI values received. A user can click on a device to show its detail view as possible on the BLE Devices view.

RSSI Graph

The RSSI graph plots a graph automatically on all received RSSI values for each device. On the left side all devices are listed and they can be select to be highlighted.

PCAP support

All received advertisements can be exported into the pcap format. This allows them to be opened in Wireshark. The export can be started from the Settings view. Pcap files can also be imported to show previous measurements.

External scanners

The app allows to get its Bluetooth scanning data from an external scanner. In our example implementation this is performed by an Raspberry Pi. How to setup the Raspberry Pi can be seen in a section below. Other scanners are generally supported, too. For this the scanner needs to support the same protocol as the Raspberry Pi and be able to communicate over TCP to the device running the app. This communication could be handled over WiFi or Ethernet.

WiSec Demo Paper

This project has been accepted as a demo on WiSec 2020. You can find the demo paper on arxiv.

Limits

Due to Apple's CoreBluetooth API the app has certain limits to the Bluetooth Low Energy access. These limits are based on the operating system and mostly apply to iOS.

  1. No access to manufacturer data starting with the Apple company id (0x4c00). This issue is only present on iOS / iPadOS
  2. No access to certain Apple specific GATT services. Present on iOS and macOS. The services will not be listed if requested
  3. No access to the device MAC address. The MAC address is replaces with a UUID that is generated on demand and not linked to a MAC address

Removing the limits

Those limits are introduced by Apple's entitlement scheme that grants certain permissions to apps that are signed with a specific set of entitlements. Certain Apple daemons and apps have full access to all Bluetooth data, e.g. the sharingd. To assign this entitlements to any app, Apple would need to create a provisioning profile that is signed by apple and grants the priviliges to a specific app or development team. It is possible to resign an application with any entitlements and install it on devices that supports running unsigned apps, e.g. a jailbroken iPhone.

Raspberry Pi Setup

The app supports a Raspberry pi (Rpi) as an external scanner. We created a shell script that allows setup the raspberry pi as a scanner as easy as possible. We are currently tweaking some last things before this will be released.

Icons

Icons are from

Laura Reen using creative commons license as stated in https://creativecommons.org/licenses/by/3.0/

Icons8 - https://icons8.com/license

Apple Inc - https://developer.apple.com/design/human-interface-guidelines/sf-symbols/overview/

More Repositories

1

opendrop

An open Apple AirDrop implementation written in Python
Python
8,426
star
2

openhaystack

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
Swift
7,719
star
3

nexmon

The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more
C
2,319
star
4

AirGuard

Protect yourself from being tracked 🌍 by AirTags 🏷 and Find My accessories 📍
Kotlin
1,809
star
5

owl

An open Apple Wireless Direct Link (AWDL) implementation written in C
C
1,192
star
6

openwifipass

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Python.
Python
789
star
7

mobisys2018_nexmon_software_defined_radio

Proof of concept project for operating Broadcom Wi-Fi chips as arbitrary signal transmitters similar to software-defined radios (SDRs)
Shell
749
star
8

internalblue

Bluetooth experimentation framework for Broadcom and Cypress chips.
Python
655
star
9

frankenstein

Broadcom and Cypress firmware emulation for fuzzing and further full-stack debugging
C
414
star
10

nexmon_csi

Channel State Information Extraction on Various Broadcom Wi-Fi Chips
C
286
star
11

toothpicker

Python
229
star
12

polypyus

Python
212
star
13

privatedrop

Practical Privacy-Preserving Authentication for Apple AirDrop
Swift
210
star
14

bcm-rpi3

DEPRECATED: Monitor Mode and Firmware patching framework for the Raspberry Pi 3, development moved to: https://github.com/seemoo-lab/nexmon
C
158
star
15

airtag

AirTag instrumentation including AirTechno and firmware downgrades.
JavaScript
130
star
16

wireshark-awdl

Wireshark Dissector for Apple Wireless Direct Link (AWDL) and Apple's CoreCapture logging framework. Note: the AWDL dissector is part of Wireshark 3.0!
129
star
17

mobisys2018_nexmon_channel_state_information_extractor

Example project for extracting channel state information of up to 80 MHz wide 802.11ac Wi-Fi transmissions using the BCM4339 Wi-Fi chip of Nexus 5 smartphones.
MATLAB
96
star
18

airdrop-keychain-extractor

Extracting Apple ID Validation Record, Certificate, and Key for AirDrop
Objective-C
94
star
19

frida-scripts

JavaScript
89
star
20

bcm-public

DEPRECATED: Monitor Mode and Firmware patching framework for the Google Nexus 5, development moved to: https://github.com/seemoo-lab/nexmon
C
75
star
21

fitness-app

Java
68
star
22

apple-continuity-tools

Reverse engineering toolkit for Apple's wireless ecosystem
JavaScript
59
star
23

nexmon_debugger

Debugger with hardware breakpoints and memory watchpoints for BCM4339 Wi-Fi chips
C
54
star
24

talon-tools

Talon Tools: The Framework for Practical IEEE 802.11ad Research
TeX
41
star
25

aristoteles

A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.
Lua
41
star
26

wisec2017_nexmon_jammer

This project contains the nexmon-based source code required to repeat the experiments of our WiSec 2017 paper.
C
41
star
27

mmTrace

mmTrace: Millimeter Wave Propagation Simulation
MATLAB
39
star
28

fitness-firmware

HTML
39
star
29

apple_u1

JavaScript
38
star
30

dtrace-memaccess_cve-2020-27949

C++
33
star
31

proxawdl

Tunnels a regular TCP connection through an AWDL link by exploiting the NetService API
Objective-C
33
star
32

chirpotle

A LoRaWAN Security Evaluation Framework
Jupyter Notebook
31
star
33

AirGuard-iOS

Protect yourself from being tracked 📍by Samsung SmartTags and Tile Trackers
Swift
26
star
34

pyshimmer

pyshimmer provides a Python API to work with the wearable sensor devices produced by Shimmer.
Python
24
star
35

mobisys2018_nexmon_covert_channel

Wi-Fi based covert channel that hides information in hand crafted acknowledgement frames imitating additional channel effects that can be extracted from channel state information at the intended receiver.
C
23
star
36

h4bcm_wireshark_dissector

Wireshark dissector for Broadcom specific H4 diagnostic commands
C
21
star
37

owlink.org

Opening up Apple's wireless ecosystem around the Apple Wireless Direct Link (AWDL) protocol
HTML
19
star
38

uwb-sniffer

A UWB Sniffer with accurate timestamps
C
19
star
39

wisec2017_nexmon_jammer_demo_app

This project contains source code of our Nexmon-based jammer app presented as a demo at WiSec 2017.
Java
18
star
40

plist17lib

Python
17
star
41

seemoo-mobile-sensing

Sensor data collector for Android devices
Java
17
star
42

BTLEmap-Framework

BTLEmap's Bluetooth Low Energy framework that powers the app
Swift
16
star
43

seemoo-wearable-sensing

Sensor data collector for Samsung Gear S3
JavaScript
16
star
44

nexmon-arc

The nexmon C-based firmware patching framework adapted for the ARC architecture.
C
16
star
45

csicloak

Python
14
star
46

talon-sector-patterns

Antenna Sector Patterns as obtained by Measurements in the CoNEXT'17 paper
MATLAB
13
star
47

privatefind

Lost and Found: Stopping Bluetooth Finders from Leaking Private Information
C
12
star
48

nexmon_tx_task

Scheduled frame transmission on Broadcom Wi-Fi Chips
C
11
star
49

wisec2017_nexmon_jammer_demo_firmware

This project contains the nexmon-based source code of the jammer used in our WiSec 2017 demo Android app.
C
11
star
50

fido2ext

Bring Your Own FIDO2 Extensions!
JavaScript
11
star
51

wifi-password-sharing

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Swift.
Swift
10
star
52

bcm_misc

10
star
53

Hardwhere

snipeit-it based asset management app
Kotlin
9
star
54

opennan

OpenNAN - An open source NAN stack for Linux
C
9
star
55

ubicomp19_zero_interaction_security

Source code for experiments and evaluation of five zero-interaction security schemes, for our Ubicomp 2019 paper "Perils of Zero-Interaction Security in the Internet of Things"
Jupyter Notebook
9
star
56

myo-keylogging

Code for "My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack" paper
Python
8
star
57

natural-disaster-mobility

Natural Disaster Mobility Model and Scenarios in the ONE
Java
7
star
58

wisec2017_nexmon_jammer_reproducibility

This project contains all measured data and scripts to recreate the plots used in our WiSec 2017 paper.
MATLAB
7
star
59

nexmon_energy_measurement

This repository contains patched Linux kernel sources to run energy measurements on the Wi-Fi chip of a Nexus 5 smartphone.
C
7
star
60

next2you

Source code for experiments and evaluation of Next2You copresence detection scheme, for our TIOT 2021 paper "Next2You: Robust Copresence Detection Based on Channel State Information".
C
7
star
61

aic-prototype

Proof of concept implementation of Acoustic Integrity Codes (AICs) for Android smartphones
Kotlin
7
star
62

offline-finding-evaluation

Quantitative analysis of location reports from Apple's offline finding (OF) location tracking system
Jupyter Notebook
6
star
63

pico-nexmon

Applications for the Raspberry Pi Pico W related to Nexmon the C-based firmware patching framework for Broadcom/Cypress WiFi chips.
CMake
5
star
64

fastzip

Source code for experiments and evaluation of FastZIP zero-interaction pairing scheme, for our Mobisys 2021 paper "FastZIP: Faster and More Secure Zero-Interaction Pairing".
Python
5
star
65

powerpc-ose

C++
4
star
66

d11-emu

D11emu: A BCM43 D11 Emulation Framework
Rust
4
star
67

PrivateDrop-Base

The framework that powers PrivateDrop
C
3
star
68

graphics

3
star
69

click-castor

Click implementation of LIDOR/SEMUD (based on the Castor routing protocol)
C++
3
star
70

tpy

A Lightweight Framework for Agile Distributed Network Experiments
Python
3
star
71

privatedrop-evaluation

Jupyter Notebook
3
star
72

wintech23_nexmon_d11debug

Pawn
3
star
73

wintech2017_nexmon_ping_offloading

This project contains the nexmon-based source code of the ping offloading application used in our WiNTECH 2017 paper.
C
2
star
74

wisec23-speaker-bootstrapping

Software repository for our WiSec '23 demo: Secure Bootstrapping of Smart Speakers Using Acoustic Communication
C
2
star
75

hardzipa

Source code for experiments and evaluation of HardZiPA system for our EWSN 2023 paper "Hardening and Speeding UpZero-interaction Pairing and Authentication".
Python
2
star
76

talon-library-measurements

Large-Scale Talon Measurements at Library
1
star
77

kardia-demod

Python
1
star
78

handoff-authentication-swift

C++
1
star
79

caret

CARET: The Crisis and Resilience Evaluation Tool
Python
1
star
80

Please-Unstalk-Me

User Data and Online Survey results
Jupyter Notebook
1
star
81

python-msp430-tools

This is a fork of the original python-msp430-tools repository on Launchpad. It features a patchset that is required to use the tools with the Shimmer3 devices.
Python
1
star