conorpp/btproxy

Man in the Middle analysis tool for Bluetooth.

btproxy's Issues

master and slave seem to be switched

Hi,

I'm having trouble establishing a connection and I was wondering if you somehow got the master and slave mixed up. I execute the following:

samd@vaiolaptop:~/btproxy$ sudo btproxy <mac address of master> <mac address of slave> --repair
Running proxy on master  <mac address of master>  and slave  <mac address of slave>
Slave adapter:  hci0
Master adapter:  hci1
Looking up info on slave (<mac address of slave>)
Looking up info on master (<mac address of master>)
Spoofing master name as  <real name of slave>_btproxy
Spoofing slave name as  <real name of master>_btproxy

Are the last 2 lines correct? It looks like it should be the other way around, right?

Even in your own example, it says
Spoofing master name as Pebble 9FAA_btproxy. Isn't the Pebble the slave?

Reconnecting

Running in a vm using one adapter. Everything works well clones both devices and says I can now connect the master. once I pair I then get a constant reconnecting stream. Any ideas?

Neither python2 nor python3 working (different errors, though)

With python2:

  $  btproxy BE:FF:20:00:97:52 AC:E4:B5:8C:82:42
Traceback (most recent call last):
  File "/usr/local/bin/btproxy", line 4, in <module>
    __import__('pkg_resources').run_script('btproxy==0.1', 'btproxy')
  File "/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 666, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 1462, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/EGG-INFO/scripts/btproxy", line 4, in <module>
    from libbtproxy.argparser import args,parser
  File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/libbtproxy/__init__.py", line 6, in <module>
    from . import adapter
  File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/libbtproxy/adapter.py", line 7, in <module>
    import bluetooth, clone
  File "build/bdist.linux-x86_64/egg/bluetooth/__init__.py", line 282, in <module>
AttributeError: attribute '__doc__' of 'instancemethod' objects is not writable

With python3:

  $  btproxy BE:FF:20:00:97:52 AC:E4:B5:8C:82:42
Traceback (most recent call last):
  File "/usr/local/bin/btproxy", line 4, in <module>
    __import__('pkg_resources').run_script('btproxy==0.1', 'btproxy')
  File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 666, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 1462, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python3.7/dist-packages/btproxy-0.1-py3.7-linux-x86_64.egg/EGG-INFO/scripts/btproxy", line 4, in <module>
    from libbtproxy.argparser import args,parser
  File "/usr/local/lib/python3.7/dist-packages/btproxy-0.1-py3.7-linux-x86_64.egg/libbtproxy/__init__.py", line 3, in <module>
    import clone
ImportError: /usr/local/lib/python3.7/dist-packages/btproxy-0.1-py3.7-linux-x86_64.egg/clone.cpython-37m-x86_64-linux-gnu.so: undefined symbol: Py_InitModule

uninstall

Unfortunately the program crashes at first run - error message below.

Traceback (most recent call last):
File "/usr/local/bin/btproxy", line 4, in
import('pkg_resources').run_script('btproxy==0.1', 'btproxy')
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 739, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 1494, in run_script
exec(code, namespace, namespace)
File "/usr/local/lib/python3.5/dist-packages/btproxy-0.1-py3.5-linux-x86_64.egg/EGG-INFO/scripts/btproxy", line 4, in
from libbtproxy.argparser import args,parser
File "/usr/local/lib/python3.5/dist-packages/btproxy-0.1-py3.5-linux-x86_64.egg/libbtproxy/init.py", line 3, in
import clone
ImportError: /usr/local/lib/python3.5/dist-packages/btproxy-0.1-py3.5-linux-x86_64.egg/clone.cpython-35m-x86_64-linux-gnu.so: undefined symbol: Py_InitModule

How do I remove the program completely?
I tried the following ...

sudo python setup.py remove
sudo python setup.py uninstall
sudo python3 setup.py remove
sudo python3 setup.py uninstall

... did not work.

thanks in advance

Error when starting service

I'm getting stuck on a attribute error when it tries "starting service". It pairs with my slave fine and looks up all the info it seems to need. I get a pairing successful message on my slave. It looks like it's having an issue polling the services?

I'd love to get this working as it's the only MITM BDR/EDR tool that I know of!
Running proxy on master BC:EE:7B:A4:2A:50 and slave E4:22:A5:0B:DF:8B
running ['replace_bluetoothd']
running ['hciconfig', '-a']
Using shared adapter
running ['hciconfig', 'hci0', 'up']
Slave adapter: hci0
Master adapter: hci0
Looking up info on slave (E4:22:A5:0B:DF:8B)
running ['hcitool', 'inq']
Looking up info on master (BC:EE:7B:A4:2A:50)
running ['hcitool', 'inq']
Spoofing master name as PLT_Legend_btproxy
running ['hciconfig', 'hci0', 'name', 'PLT_Legend_btproxy']
running ['hciconfig', 'hci0', 'sspmode', '1']
running ['hciconfig', 'hci0', 'class', '0x240404']
running ['hciconfig', 'hci0', 'piscan']
running ['which', 'bluez_simple_agent_nouser']
running ['python', '/usr/local/bin/bluez_simple_agent_nouser', 'hci0', 'E4:22:A5:0B:DF:8B']
paired
running ['replace_bluetoothd', '/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/blocksdp.so']
Spoofing master name as PLT_Legend_btproxy
running ['hciconfig', 'hci0', 'name', 'PLT_Legend_btproxy']
running ['hciconfig', 'hci0', 'sspmode', '1']
running ['hciconfig', 'hci0', 'class', '0x240404']
running ['hciconfig', 'hci0', 'piscan']
{'protocol': None, 'name': None, 'service-id': None, 'profiles': [], 'service-classes': ['1200'], 'host': 'E4:22:A5:0B:DF:8B', 'provider': None, 'port': None, 'description': None}
SDP interceptor started
Starting service {'protocol': None, 'name': None, 'service-id': None, 'profiles': [], 'service-classes': ['1200'], 'host': 'E4:22:A5:0B:DF:8B', 'provider': None, 'port': None, 'description': None}
Traceback (most recent call last):
[Errno 2] No such file or directory
File "/usr/local/bin/btproxy", line 4, in
import('pkg_resources').run_script('btproxy==0.1', 'btproxy')
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 719, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 1504, in run_script
exec(code, namespace, namespace)
File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/EGG-INFO/scripts/btproxy", line 39, in
btproxy.mitm()
File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/libbtproxy/mitm.py", line 535, in mitm
server_sock = self.start_service(service)
File "/usr/local/lib/python2.7/dist-packages/btproxy-0.1-py2.7-linux-x86_64.egg/libbtproxy/mitm.py", line 260, in start_service
if service['protocol'].lower() == 'l2cap':
AttributeError: 'NoneType' object has no attribute 'lower'

undefined symbol: Py_InitModule

when running, whatever the case

Traceback (most recent call last):
  File "/usr/bin/btproxy", line 4, in <module>
    __import__('pkg_resources').run_script('btproxy==0.1', 'btproxy')
  File "/usr/lib/python3.7/site-packages/pkg_resources/__init__.py", line 661, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/lib/python3.7/site-packages/pkg_resources/__init__.py", line 1441, in run_script
    exec(code, namespace, namespace)
  File "/usr/lib/python3.7/site-packages/btproxy-0.1-py3.7-linux-x86_64.egg/EGG-INFO/scripts/btproxy", line 4, in <module>
    from libbtproxy.argparser import args,parser
  File "/usr/lib/python3.7/site-packages/btproxy-0.1-py3.7-linux-x86_64.egg/libbtproxy/__init__.py", line 3, in <module>
    import clone
ImportError: /usr/lib/python3.7/site-packages/btproxy-0.1-py3.7-linux-x86_64.egg/clone.cpython-37m-x86_64-linux-gnu.so: undefined symbol: Py_InitModule

The code of line 42 in btproxy file was mistake

It's should be:

not args.interface

not

not args.bluetooth

not able to run on py3

i am running the newest py3 and ubuntu, installed all your preconditions, btproxy and was able to run the script btproxy, but it stocked at
running ['replace_bluetoothd']

see all details below. any help would be appreciated.

lolo@pi3:~$ sudo btproxy -v B4:74:43:1C:B0:E8 80:E4:6E:C0:82:76
[sudo] password for lolo: 
Running proxy on master  B4:74:43:1C:B0:E8  and slave  80:E4:6E:C0:82:76
running  ['replace_bluetoothd']

any tip?

• was running: sudo hciconfig hci0 up

lolo@pi3:~$ hcitool dev
Devices:
	hci0	B8:27:EB:4D:47:09

- lolo@pi3:~$ hcitool scan
Scanning ...
	B4:74:43:1C:B0:E8        VR 1 (master)
	80:E4:6E:C0:82:76	led27730 (slave)

Options for devices that `hcitool inq` can't query?

I'm trying to MITM a device that pairs with a PS Vita, and the device is scanned fine, but the PS Vita seems to basically be invisible to hcitool. scan doesn't see it, and inq can't query it, and sdptool can't reach it, and neither can l2ping.

I'm using two different Bluetooth adapters, so it's not that, neither one see it.

I've turned on PSCAN and ISCAN, and so the computer is visible to the Vita, but even trying to pair it doesn't help.

Do I have any options?

Support for BT-LE?

Any chance of supporting Bluetooth Low Energy? This seems like the perfect tool for reverse engineering the new BB-8 toy.