https://blog.yunwuhai.com/tags/bluetooth/Recent content in Bluetooth on 云雾海的博客Hugo -- gohugo.iozh-cnMon, 17 Nov 2025 18:31:28 +0800https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/Mon, 17 Nov 2025 18:31:28 +0800https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/<img src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/cover.jpg" alt="Featured image of post 蓝牙协议HCI抓包实验" /><h1 id="蓝牙协议hci抓包实验"><a href="#%e8%93%9d%e7%89%99%e5%8d%8f%e8%ae%aehci%e6%8a%93%e5%8c%85%e5%ae%9e%e9%aa%8c" class="header-anchor"></a>蓝牙协议HCI抓包实验 </h1><h2 id="实验准备"><a href="#%e5%ae%9e%e9%aa%8c%e5%87%86%e5%a4%87" class="header-anchor"></a>实验准备 </h2><h3 id="实验硬件"><a href="#%e5%ae%9e%e9%aa%8c%e7%a1%ac%e4%bb%b6" class="header-anchor"></a>实验硬件 </h3><ul> <li>一台电脑</li> <li>一台安卓手机（以VIVO手机为例）</li> <li>一个蓝牙设备（以小米手环为例）</li> <li>一根手机数据线</li> </ul> <h3 id="实验软件"><a href="#%e5%ae%9e%e9%aa%8c%e8%bd%af%e4%bb%b6" class="header-anchor"></a>实验软件 </h3><ul> <li><a class="link" href="https://developer.android.google.cn/tools/releases/platform-tools?hl=zh-cn" target="_blank" rel="noopener" >安卓调试桥（ADB工具）</a></li> </ul> <h2 id="实验步骤"><a href="#%e5%ae%9e%e9%aa%8c%e6%ad%a5%e9%aa%a4" class="header-anchor"></a>实验步骤 </h2><h3 id="软件安装"><a href="#%e8%bd%af%e4%bb%b6%e5%ae%89%e8%a3%85" class="header-anchor"></a>软件安装 </h3><h4 id="下载adb工具"><a href="#%e4%b8%8b%e8%bd%bdadb%e5%b7%a5%e5%85%b7" class="header-anchor"></a>下载ADB工具 </h4><p>访问链接后，根据电脑平台选择软件包<img alt="image-20251117183731056" class="gallery-image" data-flex-basis="542px" data-flex-grow="226" height="619" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117183731056.webp" width="1400"></p> <h4 id="解压文件"><a href="#%e8%a7%a3%e5%8e%8b%e6%96%87%e4%bb%b6" class="header-anchor"></a>解压文件 </h4><p>下载得到一个压缩包，将其解压缩到一个文件夹中，并打开该文件夹</p> <img alt="image-20251117184035148" class="gallery-image" data-flex-basis="3094px" data-flex-grow="1289" height="38" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117184035148.webp" width="490"><img alt="image-20251117184350656" class="gallery-image" data-flex-basis="336px" data-flex-grow="140" height="999" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117184350656.webp" width="1400"><h4 id="检查下载"><a href="#%e6%a3%80%e6%9f%a5%e4%b8%8b%e8%bd%bd" class="header-anchor"></a>检查下载 </h4><p>在该目录下右键选择在终端中打开，或可以先行打开终端然后跳转到该目录。</p> <img alt="image-20251117184436327" class="gallery-image" data-flex-basis="2629px" data-flex-grow="1095" height="47" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117184436327.webp" width="515"><p>输入<code>.\adb.exe --version</code>来检查是否可用，如果正常，应该会显示版本号。</p> <img alt="image-20251117185501167" class="gallery-image" data-flex-basis="1207px" data-flex-grow="502" height="203" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117185501167.webp" width="1021"><h3 id="手机设置"><a href="#%e6%89%8b%e6%9c%ba%e8%ae%be%e7%bd%ae" class="header-anchor"></a>手机设置 </h3><h4 id="打开开发者模式"><a href="#%e6%89%93%e5%bc%80%e5%bc%80%e5%8f%91%e8%80%85%e6%a8%a1%e5%bc%8f" class="header-anchor"></a>打开开发者模式 </h4><p>现在的安卓手机，开发者选项是隐藏的，需要手动打开开发者模式才能看到。</p> <p>根据不同手机，可能有不同打开开发者模式的方法，vivo手机的方式是进入<code>设置-关于手机-版本信息</code>，连续点击软件版本号，即可开启开发者模式。大部分手机应该也是类似的方式，如果该操作不行，请自行搜索自己手机的开启方式。</p> <img alt="ab4198ebaed6d20d10ee83711c66b7da" class="gallery-image" data-flex-basis="108px" data-flex-grow="45" height="1400" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/ab4198ebaed6d20d10ee83711c66b7da.webp" width="630"><h4 id="开启日志功能"><a href="#%e5%bc%80%e5%90%af%e6%97%a5%e5%bf%97%e5%8a%9f%e8%83%bd" class="header-anchor"></a>开启日志功能 </h4><p>进入设置中，选择开发者选项，并将<code>启用蓝牙HCI信息收集日志</code>选项设置为启用。<strong>注意：如果此时蓝牙已经启动，应该将其关闭后重启，然后蓝牙日志就将开始记录。</strong></p> <img alt="85ecdf4b9a96df9ffb096d142be7bf55" class="gallery-image" data-flex-basis="108px" data-flex-grow="45" height="1400" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/85ecdf4b9a96df9ffb096d142be7bf55.webp" width="630"><h4 id="开启usb调试功能"><a href="#%e5%bc%80%e5%90%afusb%e8%b0%83%e8%af%95%e5%8a%9f%e8%83%bd" class="header-anchor"></a>开启USB调试功能 </h4><p>为了电脑能够读取日志，需要开启USB调试功能。</p> <img alt="0d63412e35d35021c1d5172f4b2785e2" class="gallery-image" data-flex-basis="108px" data-flex-grow="45" height="1400" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/0d63412e35d35021c1d5172f4b2785e2.webp" width="630"><h4 id="完成一次数据传输"><a href="#%e5%ae%8c%e6%88%90%e4%b8%80%e6%ac%a1%e6%95%b0%e6%8d%ae%e4%bc%a0%e8%be%93" class="header-anchor"></a>完成一次数据传输 </h4><p>正常情况下，手环只要是用过的，在手机蓝牙开启后都会自动连接到手机上，不过为了测试，我们可以手动打开手环软件，比如小米的运动健康，然后刷新手环数据。此时理论上我们的手机和手环会进行如下通信：手机告知手环自己需要的数据，手环将数据传输给手机，当然它们可能还会参杂一些其他相关的认证消息，但是总体内容应该差不多就是这些。</p> <img alt="10bedddd5a0ce8cfad0be2d2b47de836" class="gallery-image" data-flex-basis="108px" data-flex-grow="45" height="1400" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/10bedddd5a0ce8cfad0be2d2b47de836.webp" width="630"><p>在完成了这个操作后，为了数据干净，就可以选择关闭蓝牙了，我们的通信日志已经被记录下来了。</p> <h3 id="开始调试"><a href="#%e5%bc%80%e5%a7%8b%e8%b0%83%e8%af%95" class="header-anchor"></a>开始调试 </h3><h4 id="连接电脑"><a href="#%e8%bf%9e%e6%8e%a5%e7%94%b5%e8%84%91" class="header-anchor"></a>连接电脑 </h4><p>我们现在需要的工作就是将通信日志保存到电脑中，此时就需要用到我们的ADB调试工具了。首先将手机通过数据线连接电脑。</p> <p>因为开启了USB调试模式，此时会弹窗问是否允许该电脑进行调试，选择允许即可。</p> <img alt="ce5bee27055c32a4712b02fccfca0d6f" class="gallery-image" data-flex-basis="229px" data-flex-grow="95" height="1056" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/ce5bee27055c32a4712b02fccfca0d6f.webp" width="1008"><p>然后选择传输模式为管理文件。</p> <img alt="9adc00c77d4d63f6da7ad58484c76d77" class="gallery-image" data-flex-basis="185px" data-flex-grow="77" height="1279" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/9adc00c77d4d63f6da7ad58484c76d77.webp" width="986"><p>此时，我们的电脑已经可以对其进行调试了。</p> <h4 id="adb读取报告"><a href="#adb%e8%af%bb%e5%8f%96%e6%8a%a5%e5%91%8a" class="header-anchor"></a>ADB读取报告 </h4><p>通过<code>.\adb.exe bugreport</code>然后加压缩包文件名的方式，可以将日志下载到一个压缩包中，该过程需要一两分钟。</p> <img alt="image-20251117192226872" class="gallery-image" data-flex-basis="5014px" data-flex-grow="2089" height="67" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117192226872.webp" width="1400"><p>下载完成后就可以解压缩该压缩包，然后通过访问这个路径，可以找到蓝牙日志。如果是其他手机，不确定是不是一样的，但是可以通过搜索<code>hci</code>和<code>log</code>两个关键字来查找。</p> <img alt="image-20251117192405842" class="gallery-image" data-flex-basis="3333px" data-flex-grow="1389" height="91" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117192405842.webp" width="1264"><img alt="image-20251117192505861" class="gallery-image" data-flex-basis="1012px" data-flex-grow="421" height="332" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117192505861.webp" width="1400"><p>其中<code>btsnoop_hci.log.last</code>就是我们的目标文件了，当然根据实际情况可能没有<code>.last</code>文件，此时只有<code>.log</code>文件大概率也是对的。</p> <h3 id="查看抓包内容"><a href="#%e6%9f%a5%e7%9c%8b%e6%8a%93%e5%8c%85%e5%86%85%e5%ae%b9" class="header-anchor"></a>查看抓包内容 </h3><h4 id="找到连接"><a href="#%e6%89%be%e5%88%b0%e8%bf%9e%e6%8e%a5" class="header-anchor"></a>找到连接 </h4><p>打开WireShark，将<code>btsnoop_hci.log.last</code>拖拽进去打开。</p> <img alt="image-20251117192819626" class="gallery-image" data-flex-basis="621px" data-flex-grow="258" height="541" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117192819626.webp" width="1400"><p>现在我们关注<code>Source</code>和<code>Destination</code>，只要其中出现了我们的设备名，就说明抓包成功了。</p> <img alt="image-20251117193059622" class="gallery-image" data-flex-basis="9882px" data-flex-grow="4117" height="34" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117193059622.webp" width="1400"><p>可以发现，我们的手机先给手环发送了一个L2CAP发送包，然后手环回了一个L2CAP的接收包。我们知道L2CAP是用于蓝牙协议中建立连接的，故此可以知道我们的通信成功了。</p> <h4 id="观察数据"><a href="#%e8%a7%82%e5%af%9f%e6%95%b0%e6%8d%ae" class="header-anchor"></a>观察数据 </h4><p>我们继续往下观察，可以发现RFCOMM协议的几个包，我们知道RFCOMM协议是用于构建虚拟串口的，显然这里是在构建通信连接。</p> <img alt="image-20251117200144842" class="gallery-image" data-flex-basis="2024px" data-flex-grow="843" height="166" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117200144842.webp" width="1400"><p>而后我们继续观察，可以发现过了一段时间后，突然出现了大量的SPP包，我们知道这个包适用于规范RFCOMM传输内容的，而且通过数据包长度也可以知晓，这显然就是在传输我们的手环数据给手机。</p> <img alt="image-20251117200315178" class="gallery-image" data-flex-basis="2947px" data-flex-grow="1228" height="114" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117200315178.webp" width="1400"><p>让我们点开其中的一个看一下里面的数据：</p> <img alt="image-20251117200450721" class="gallery-image" data-flex-basis="594px" data-flex-grow="247" height="565" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.yunwuhai.com/posts/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E8%93%9D%E7%89%99%E5%8D%8F%E8%AE%AEhci%E6%8A%93%E5%8C%85%E5%AE%9E%E9%AA%8C/img/image-20251117200450721.webp" width="1400"><p>这部分数据是data部分的内容，而具体内容则是非常杂乱的，我们在此可以猜测这个数据大概率是加密的数据，需要在手机软件中才会解密，防止被中间截获。</p>