mikeryan/crackle

Crack and decrypt BLE encryption

crackle's Issues

decrypt with LTK

I'm trying to decrypt a connexion using the ltk cracked before...
But the command line show me that error:

---

root@K4Li:~/Software/crackle-master# ./crackle -i Capturas/Prueba.pcapng -o Capturas/PruebaRecogidaDatos_dec.pcapng -l 7530d81af7aab41da8b1c2500faf6504 -v
Violación de segmento

---

"Violación de segmento" is like segmentation fault, and it's supposed to be caused by crackle...
¿Some help?
Thanks.

cracking BLE packets captured through Adafruit Bluefruit LE Sniffer

hello,

I captured BLE packets (including pairing information) by using Adafruit Bluefruit LE Sniffer which uses the Nordic's NRF sniffer software. I can see all the pairing related information in wireshark but when i run the packet capture through crackle , crackle is unable to read/interpret the packets. Everything works fine when i use Ubertooth to capture the BLE packets that include paring information and i can crack the link layer encyrption using crackle in that case. I noticed that unlike ubertooth , in case of Adafruit/nordic packet capture analysis on wireshark , i need to add DLT_User (157) as "nordic_ble" ( it is DLT_User (147) > btle in case of ubertooth).

Can you advise if there is a simple way so that i could get crackle to read packets captured through Adafruit Bluefruit LE Sniffer?

Thanks
Rick

LE Secure Connections with Debug Keys (or one known private key)

It seems like it would be possible to decrypt the traffic even if using LE Secure Connections if one of the private keys is known. Like for example if either device was using the BLE Debug Keys or if the user was able to extract one private key through another means and enter it as an argument. Do you think this sounds plausible?

Make OpenMP a conditional compile

Updates

going to make any more updates?

Crackle does not work / after instalation Wireshark break down

Hi Friends

I installed the Crackle from this source: http://lacklustre.net/projects/crackle/ . After installation on Ubuntu, I tried to decrypt BLE packages from PCAP file. When I opened it in Crackle, the Wireshark breaks down and other applications on my computer, like Firefox, too. The crackle destroys the PCAP file, because it is not able to be opened anymore.

decrypting pcapfile

hello mike
I'm trying to run a captured pcap file in crackle which contains all the necessary packets needed to decrypt but it still gives an error and does not detect any packets. any help would be great thanks

Crackle can't find TK

Hello,

I am using crackle for recovering the TK. I am using a pcap file generated by Btlejack with the command
btlejack -c any -x ll_phdr -o btlejack_cap.pcap and it contains all the necessary packets (CONNECT_REQ, Pairing Request and Response, Pairing Confirms and Pairing Randoms).

Then with crackle, I run the command crackle -i btlejack_cap.pcap and the output is ( I remove th device addresses):

Warning: No output file specified. Decrypted packets will be lost to the ether.
Found 1 connection

Analyzing connection 0:
  xx:xx:xx:xx:xx:xx (public) -> yy:yy:yy:yy:yy:yy (public)
  Found 98 encrypted packets
  Cracking with strategy 0, 20 bits of entropy
    TK is not found. The connection could be using OOB pairing or something
    else fishy is going on. File a bug with more info about the devices.
    Sorry d00d :(

Done, processed 0 total packets, decrypted 0

The pairing was done via Passkey Entry (not JustWorks or OOB) and BLE v4.1.

Comments and suggestions are welcome! Thank you.

crackle -l Does not work

Hi, please noticed that the function of -l (decrypt PCAP with known LTK) does not work on the latest version of crackle.
The latest version that i've found working properly was on Kali repository - http://git.kali.org/gitweb/?p=packages/crackle.git;a=summary

CONNECT_REQ 0x05 and Randomized Tx Address bit: True

Hello, I am trying to use crackle to decrypt but have encountered a problem. When running crackle it indicates one error that no connect packet has been found, while I have found this in my capture file.

With wireshark I have found that the packet header is 0x2245 (PDU Type: CONNECT_REQ and TxAddress: True)

In de crackle.c code i have found

//connect packet, grab those addresses!
if ((flags % 0xf) == 5)

I believe the above code should be changed as below, too test if the CONNECT_REQ (0x05) bits are set.
if ((flags & 0xf) == 5)

After changing this, the state->connect_found is marked as 1.

The crackle output is now:
TK not found, the connection is probably using OOB pairing
Sorry dood :(

Crackle does not seem to handle the "Randomized Tx Address bit: true", but is it possible to decrypt and is crackle just missing some additional handling?

Does this still work with BLE 4.2?

Given the new security implementations that they've done with the ECDH, will this still work?

document STK brute force (-s) mode

The -h text does not mention it, nor does README

TK Bruteforce

I have listen a pairing between 2 Bluetooth LE devices...
The pairing procedure uses the 6 digit-key algorithm (not just works), and i run crackle in mode -s and -v.
Crackle try to bruteforce the TK, but only try combinations with the first 3 digits, the last 3 digits it assume that are 000... I know that the TK is like "123456", so, crackle won't get the correct key because it doesn't use the last 3 digits.

I attach the execution where you can notice the problem:
crackle_execution-s.txt

Sorry of my English... bye!
PD: great tool Mike! it's very useful for my BLE security research. (:

Found TK, STK but 0 packets decrypted

I came across a problem exactly like this closed issue.

I am using the nRF sniffer(3rd-party nRF52840 based hardware) with wireshark to get the packets.

$ crackle -v -i mydevice_pairing2.pcapng -o decryted.pcapng
PCAP contains [NORDIC_BLE] frames
Warning: packet is too short to be encrypted (1), skipping
Warning: packet is too short to be encrypted (1), skipping
Found 1 connection

Analyzing connection 0:
  mac1 (random) -> mac2 (random)
  Found 2179 encrypted packets
  Cracking with strategy 0, 20 bits of entropy

  !!!
  TK found: 6digits
  !!!

  STK: 5e0be96c4f80c856e9aba58917126545
  Decrypted 0 packets

Did not decrypt any packets, not writing a new PCAP
Done, processed 0 total packets, decrypted 0
Connection 0
  connect_found: 1
  preq_found: 1
  pres_found: 1
  confirm_found: 2
  random_found: 2
  enc_req_found: 1
  enc_rsp_found: 1
  pairing_public_key_found: 0
  pairing_dhkey_check_found: 0
  AA: af9a852b
  IA: mac1
  RA: mac2
  IAt: 1
  RAt: 1
  PREQ: 0b 0b 10 2d 00 04 01
  PRES: 03 02 10 05 00 00 02
  MCONFIRM: 6c a3 32 c4 7f ae c3 b8 77 ac 86 37 f0 d3 48 b4
  SCONFIRM: c8 72 56 6c 4f 26 d1 01 7d 58 b5 9d 4b 6c 0b 13
  MRAND: 39 3c d8 24 06 ce 15 2a 7c 28 60 10 fe 28 dc 6c
  SRAND: 14 6f 12 c2 ad b8 c0 9b 24 20 b4 cf f3 41 96 21
  Rand: 00 00 00 00 00 00 00 00
  EDIV: 00 00
  SKDm: 0e 60 16 0f 5a ae 4a 99
  IVm:  31 57 96 8d
  SKDs: c0 81 bf 1c 50 4c a6 e6
  IVs:  18 7c 29 54

I can send some files through email if you are interested.

crackle installation problem

I am not able to install the crackle.
`blackroot@blackroot:~/Desktop/crackle-master$ make

cc -O2 -Wall -Werror -g -c -o crackle.o crackle.c

In file included from crackle.c:38:0:

crackle.h:5:18: fatal error: pcap.h: No such file or directory

compilation terminated.

: recipe for target 'crackle.o' failed

make: *** [crackle.o] Error 1
`

Encrypted packets found but not decrypted

It is not showing any errors but not decrypting the connections as well. What's wrong ?

crackle -i captured.pcapng -o decrypted-dlt_PPI_without-LTK.pcap
Found 1 connection

Analyzing connection 0:
  52:59:91:36:91:31 (random) -> f0:c7:7f:fc:da:8e (public)
  Found 12 encrypted packets
  Unable to crack due to the following error:
    Missing both Mrand and Srand

Did not decrypt any packets, not writing a new PCAP
Done, processed 0 total packets, decrypted 0

Then tried with LTK

rajib@rajib-lab-desk:~/bluetooth$ crackle -i captured.pcapng -o decrypted-dlt_PPI-LTK.pcap -l e77655c8523f02fc93c05e2fa279f1b8
Found 1 connection

Analyzing connection 0:
  52:59:91:36:91:31 (random) -> f0:c7:7f:fc:da:8e (public)
  Found 12 encrypted packets
  Decrypted 0 packets

Did not decrypt any packets, not writing a new PCAP
Done, processed 0 total packets, decrypted 0

No connect packet found, when its present?

I have a capture which crackle gives the error "no connect packet found" but the packet seems to be present in the capture file? Not sure where I am going wrong here, I have attached the capture file if anyone can help.

Thanks

(Remove .txt from end of file)
test5.pcapng.txt

Sample Data

What was the source of the sample data?

When dumping decrypted pcaps and the original encrypted pcaps, one sees the exact same data.

What should the result of the decrypted data look like?

Thanks!
Chris

Crackle: Invalid interface capture length

Hi.
Output:
When I use pcapng:
crackle: invalid interface capture length 4294967295, bigger than maximum of 262144
If I use pcap, then crackle can't find anything.
Output:
Warning: unknown packet type encountered, skipping
Warning: unknown packet type encountered, skipping
No connect packet found
No pairing request found
No pairing response found
Not enough confirm values found (0, need 2)
Not enough random values found (0, need 2)
No LL_ENC_REQ found
No LL_ENC_RSP found
Giving up due to 7 errors

Sniffer:
CC2642R1 with default SmartRF software

Crackle not decrypting the Android BT snooping enabled packet dumps ?

Hello ,

I was enabled the bluetooth HCI snoop logs in android device and try to decrypt. Crackle says unknown file format .
Is this HCI snoop logs not valid to use crackle?

issue with crackle

Hello,
When using crackle I am always getting the following:

No connect packet found
No pairing request found
No pairing response found
No confirm values found, at least one is needed
Not enough random values found (0, need 2)
No LL_ENC_REQ found
No LL_ENC_RSP found
Giving up due to 7 errors

I sniffed the pairing process several times with ubertooth-btle and always get this result.

What could be the issue here?
TNX.

decrypt incorrectly

I write and compile a ble sm-pairing program on raspberry. And I use a ble debug app on Android to pairing and communicate with it, i.e., read CHARACTERISTIC.
The binding uses Just Works.

Everything goes ok util I try to use Crackle to decrypt captured pcap data.
crackle -i test.pcap -o output.pcap

The output is as follow:
`
Found 1 connection

Analyzing connection 0:
xx:xx:xx:xx:xx:xx (random) -> xx:xx:xx:xx:xx:xx (public)
Found 32 encrypted packets
Cracking with strategy 0, 20 bits of entropy

!!!
TK found: 000000
ding ding ding, using a TK of 0! Just Cracks(tm)
!!!

Decrypted 31 packets
LTK found: 560d2302fe5813b5520295edbadc3909

Decrypted 31 packets, dumping to PCAP
Done, processed 3653 total packets, decrypted 31
`

But the output.pcap seems wrong and all of opertions is not analyzed correctly.
For example, when I read one CHARACTERISTIC, it returns the device name (a const string), but now it was not analyzed correctly.

I open this output.pcap with wireshark, and the error is "Error Response: Attribute not Found." and I do not see the device name string in output.pcap.

Could please help me solve this issues?
Is the Crackle's problem or my program's problem?

Thank you very much.

Support BLUETOOTH_HCI_H4_WITH_PHDR

Consider this a feature request to support BLUETOOTH_HCI_H4_WITH_PHDR.

Currently:

$crackle -i foo.pcap
PCAP contains [BLUETOOTH_HCI_H4_WITH_PHDR] frames
Frames inside PCAP file not supported ! dlt_name=BLUETOOTH_HCI_H4_WITH_PHDR
Frames format supported:
 [256] BLUETOOTH_LE_LL_WITH_PHDR
 [192] PPI
$

The value it is getting for cap_dlt is 201.

Support for pcap files generated by Nordic sniffer

It would be great to support these files.

They use dlt 157 (User 10) and payload nordic_ble

This is the device I'm using:
https://www.adafruit.com/product/2269

If necessary, I can provide some captured files.

Thanks!

Decrypted But Cannot View Input Data

I have captured the entire pairing process and decrypted the capture successfully but I can't view the data entered on the device by the user?

decrypted_logitech - full pairing.pcapng.txt

Issues in finding pairing

Hi there,

So I've been trying to use crackle to find and decrypt a pairing between my Pebble smartwatch and iPhone. Here's the pcap attached:

capture.pcap.zip

I used Ubertooth's command to try catch a pairing: ubertooth-btle -f -c capture.pcap

However when running crackle -i capture.pcap -o foo.pcap, I get this issue:

No connect packet found
No pairing request found
No pairing response found
Not enough confirm values found (0, need 2)
Not enough random values found (0, need 2)
No LL_ENC_REQ found
No LL_ENC_RSP found
Giving up due to 7 errors

If anyone could share some insight for this as I'm still beginning, would be very helpful.

Found STK but couldn't crack

Hello :)

crackle found the correct TK but couldn't decrypt any packet:

Found 1 connection

Analyzing connection 0:
  59:1a:d3:2e:c4:42 (private) -> 63:22:fe:be:be:c6 (private)
  Found 286 encrypted packets
  Cracking with strategy 0, 20 bits of entropy

  !!!
  TK found: 112191
  !!!

  STK: 7d8df0b316f4571ba8d867de68c57a5b
  Decrypted 0 packets

Did not decrypt any packets, not writing a new PCAP
Done, processed 0 total packets, decrypted 0
Connection 0
  connect_found: 1
  preq_found: 1
  pres_found: 1
  confirm_found: 2
  random_found: 2
  enc_req_found: 1
  enc_rsp_found: 1
  pairing_public_key_found: 0
  pairing_dhkey_check_found: 0
  AA: af9aa3de
  IA: 59:1a:d3:2e:c4:42
  RA: 63:22:fe:be:be:c6
  IAt: 1
  RAt: 1
  PREQ: 03 03 10 0d 00 04 01
  PRES: 03 03 10 05 00 00 02
  MCONFIRM: 42 d9 20 e2 da 8c 06 5e 73 0f fe 3f 5c 9b 93 7f
  SCONFIRM: 37 2c 9d 3f 1b cb b3 99 2a 4b 16 b2 79 59 7d 00
  MRAND: 42 da f2 9d 95 26 b7 cc 2b 4d 85 5d 64 bf bc b0
  SRAND: 49 c5 aa 79 72 d8 d1 81 75 30 af 9d c0 c1 0e 86
  Rand: 00 00 00 00 00 00 00 00
  EDIV: 00 00
  SKDm: 4e 4e 2e ea 61 30 14 4d
  IVm:  97 a7 e7 d7
  SKDs: e8 8d 9b 4b 23 95 97 1f
  IVs:  8c 66 c3 4d

I dug a little bit and found that the code was entering this section in aes_ccm_ad():

if (memcmp(x, t, M) != 0) {
        return -1; // program goes here
    }

I'm sniffing with Adafruit BLE sniffer and use a custom script to convert to PPI. All packets appear correctly in Wireshark (CRC correct).

Any idea? I can send the PCAP to an email (don't want to make it public, it may contain sensitive data :).

Thanks for your help :)

Pairing issues

Hi Mike,

I have the same issue. I am able to see the LL_ENC_REQ and the pairing messages in Wiresharl but crackle gives me the error that there are no requests found. So do I keep changing the advertising channel to a 37,38 or a 39 till I get the right packet.

Unable to decrypt

Hi Mike,
I'm unable to decrypt my bluetooth captures. I end up getting the following error even though the LL_ENC_REQ, LL_ENC_RSP, and LL_START_ENC_REQ have been captured.

Error:
Unable to crack due to the following error:
Missing both Mrand and Srand

I really appreciate your work and your help would be invaluable to me. I've attached my pcap files.
pcap.zip

Thanks!

Tag the source

It would be very helpful if you could tag releases. This would enable distributions to ship versioned packages.

Thanks

Problems with decrypting packets from BT Smart keyboard

Hi! Unfortunately I'm getting trouble with decoding packets from my BTLE Smart keyboard by Microsoft. I'm sniffing with an Ubertooth One (Firmware version: 2017-03-R2 (API:1.02), ubertooth 2017-03-R2).

My approach:

Pairing the keyboard with a laptop, writing anything (=smashing one key several times and hoping to find it anywhere in the packets later), unpairing it again, rinse repeat.

I aim to show that it is possible to get some interesting information (text/passwords/...) by sniffing BTLE keyboard packets.
Assuming that the packets send by a keyboard are encrypted, I try to use crackle. Unlickily I do not understand what I am doing wrong.

root@kali:~# crackle -i microsoft_btle_kb_multiple_pairings.pcapng -o crackle_output.pcap
Found 2 connections

Analyzing connection 0:
  WINDOWS_LAPTOP_MAC (public) -> KEYBOARD_MAC (random)
  Found 0 encrypted packets
  Unable to crack due to the following errors:
    Missing both Mrand and Srand
    Missing LL_ENC_REQ
    Missing LL_ENC_RSP

Analyzing connection 1:
  WINDOWS_LAPTOP_MAC (public) -> KEYBOARD_MAC (random)
  Found 0 encrypted packets
  Unable to crack due to the following errors:
    Missing both Mrand and Srand
    Missing LL_ENC_REQ
    Missing LL_ENC_RSP

Did not decrypt any packets, not writing a new PCAP
Done, processed 0 total packets, decrypted 0

I'd appreciate any help.

Decrypt LE Secure Connection with known LTK does not work

Hi, I have a pcap file from sniffing an LE Secure owner pairing. I have got the correct LTK on another way.
The output of the tool reports a successful decription and a new output.pcap file is generated. But when i load it into Wireshark the payload of the decypted packets is much less than in the original files messages and Wireshark says "bad MIC" just like in the original file.

Original File:

Decrypted File:

So my question is: Is the "decrypt with LTK" part of crackle able to decript LE Secure Connection when the LTK is known?

Many Thanks!

Can crackle can be used with ubertooth?

Hi,

I'm curious about this tool. I'm trying to figure out how to verify LAP information, to be able to identify the Bluetooth device that belongs. I already play a bit with ubertooth combined with Wireshark, kismet, and now also tried crackle but I still unable to double-check which LAP belongs to which equipment (MAC address)...nothing found on youtube neither. So imagine a thesis question about this...

1. How do you know which LAP belong to which bluetooth equipment? Using these image below....for example?
2. I was able to identify the MAC address of the Galaxy Watch but still not sure how is the convertion to the LAP founded that should be fab261