Sniffing, Reverse Engineering, and Coding the ESP32 Bluetooth LE Part 3 of 3

  Переглядів 9,897

Stuart Patterson

Stuart Patterson

День тому

Learn to Sniff Bluetooth traffic, reverse engineer a custom protocol, and then code an embedded app on the ESP32 to leverage the protocol. Sniffing Bluetooth is not difficult and this 3 part series gets your started!
Part 3 - We review the BLE_Client example and then write our own RGB random color generator for the Lumin+
Bitbucket source code for random RGB
bitbucket.org/stuartpatterson...
Nice PDF BLE C++ Guide by Neil Kolan
github.com/nkolban/esp32-snip...
Any action you take upon the information in my UKposts videos or related schematics/stl/source code/additional content is strictly at your own risk and I will not be liable for losses, damages, or injuries in connection to the use of the videos or the recreation of the projects in the videos. I am NOT a professional Electrical Engineer, nor am I licensed as an EE.

КОМЕНТАРІ: 88
@BriSouth
@BriSouth 2 роки тому
Wow, amazing tutorial! Connected so many dots for me in like 30 minutes. You are a talented communicator and instructor. Please keep posting new content. I would love to see what else you are working on.
@StuartPatterson
@StuartPatterson 2 роки тому
Thank you for the kind words!
@ArtificiallyIntellegent
@ArtificiallyIntellegent 3 роки тому
Stuart, you're famous! Hackaday not only covered you on their website but spoke about this tutorial on their podcast as well. And the best part is, I actually learnt something new! Thanks for sharing!
@StuartPatterson
@StuartPatterson 3 роки тому
Cool! Thanks! I will be sure to listen to it!
@MisguidedOracle
@MisguidedOracle Рік тому
I just watched all 3 parts and wanted to thank you for taking the time to put together a tutorial. Simple, to the point, and with a concrete example.
@StuartPatterson
@StuartPatterson Рік тому
Thank you very much!
@zinobi
@zinobi 2 місяці тому
I needed a quick overview of reverse engineering BTLE that i could listen to in the background to judge the feasiability of a project and this 3-parter was very easy to follow even when i couldn't watch it.
@StuartPatterson
@StuartPatterson 2 місяці тому
Glad it helped!
@lemonysnicket6153
@lemonysnicket6153 3 роки тому
Great series, congrats on getting featured on hackaday!!
@StuartPatterson
@StuartPatterson 3 роки тому
Thanks!
@peterkatz7544
@peterkatz7544 3 роки тому
I enjoyed your series, thank you. I use an ESP32 as an infra red remote control for my TV and settopbox. I expect that future remote controls will make use of Bluetooth instead of IR. That is where your sniffer will come in handy, to make my ESP32 even smarter than it already is. Regards, Peter.
@StuartPatterson
@StuartPatterson 3 роки тому
Thank you!
@gerdsfargen6687
@gerdsfargen6687 Рік тому
This is great. Was looking for an embedded C project and I was thrilled to come across this!
@StuartPatterson
@StuartPatterson Рік тому
Thanks for the kind reply!
@uscjake868
@uscjake868 2 роки тому
I appreciate your video series so much! It came just in time for where I am with my learning. I just bought the NRF sniffer yesterday and have some adafruit BLE to play with. I am trying to study a BLE heartrate monitor I have and then build one from parts, so your guide was right on target.
@StuartPatterson
@StuartPatterson 2 роки тому
Awesome. So glad you are finding it helpful!
@rieduciumaratonas
@rieduciumaratonas 3 роки тому
Very interesting subject and detailed explanation in the series.
@StuartPatterson
@StuartPatterson 3 роки тому
Thanks!
@rascal1234
@rascal1234 3 місяці тому
Very informative. Thanks for making this video, and series.
@StuartPatterson
@StuartPatterson 3 місяці тому
Thanks for watching it!
@tr9050
@tr9050 Рік тому
Hi Stuart, I just discovered your 3-part video on this topic and I like it very much. You explained it very well in a simple, easy to understand way. This triggered my interest to explore and experiment on this topic further. Thanks for catalyzing my interest!
@StuartPatterson
@StuartPatterson Рік тому
Thank you! I am really glad you enjoyed it and learned something!
@rustycwright
@rustycwright 3 роки тому
Very nice! I've been trying to figure out how to get the data from a temperature/humidity/pressure sensor and this finally answers my questions. As for what to do with that light, I haven't been doing anything with it, but the "obvious" answer is to have the light color reflect the price of bitcoin; dojo or whatever Elon Musk is promoting.
@StuartPatterson
@StuartPatterson 3 роки тому
Good suggestion!
@javiergarciaochoadeaspuru5166
@javiergarciaochoadeaspuru5166 3 роки тому
Thanks a lot for the tutorials !! For a newbie in BT comms like me gave me a lot of help. Was incredibly useful to implement some message sending I needed in Android and APP Inventor.
@StuartPatterson
@StuartPatterson 3 роки тому
You are welcome! Thank you for the kind comment!
@BrianCanning
@BrianCanning 6 місяців тому
I'm late to the party, but thank you so much for taking the time to make these
@StuartPatterson
@StuartPatterson 6 місяців тому
Never too late! Thank you!
@BrianCanning
@BrianCanning 6 місяців тому
@@StuartPatterson don't thank me yet. Once the sniffer arrives I might be back with a 1000 questions 🤣
@StuartPatterson
@StuartPatterson 6 місяців тому
Before forewarned, that most BLE is being encrypted now. I made that video a few years ago.@@BrianCanning
@davidflatow7927
@davidflatow7927 2 роки тому
Really great stuff!
@StuartPatterson
@StuartPatterson 2 роки тому
Thanks!
@sajidshiraji1456
@sajidshiraji1456 7 місяців тому
Thank you very much for this video sir. It helped for my project
@StuartPatterson
@StuartPatterson 7 місяців тому
Glad it helped and thanks for the comment!
@wei48221
@wei48221 3 роки тому
Great video. Very helpful.
@StuartPatterson
@StuartPatterson 3 роки тому
Thanks!
@rpavlik1
@rpavlik1 3 роки тому
Thanks for walking thru the code: I've got an esp32 node mcu board I've never really used for much, but I've done ble on nrf52 chips, with both the Adafruit and Arduino c++ bsp, as well as the Adafruit CircuitPython Bluetooth LE stuff. The esp32 api as wrapped in the Arduino support looks pretty straightforward. I'm likely to get one of these and get it connected in to mqtt so I can easily control it via node red, which is how I do all my smart home stuff.
@StuartPatterson
@StuartPatterson 3 роки тому
Thanks! I plan on looking at a few more devices and making videos -as time allows.
@spacewolfjr
@spacewolfjr 2 роки тому
thanks for the video, learned a lot!
@StuartPatterson
@StuartPatterson 2 роки тому
Good to hear! Thank you!
@bahaakallas1425
@bahaakallas1425 2 роки тому
Today I learned something new as a software developer. So happy and so glad that you shared this. I am really looking forward for applying this on a cheap drone bought from amazon that is controller through an app. I really would like to test If I can do the same
@StuartPatterson
@StuartPatterson 2 роки тому
Cool! Glad you liked the videos!
@digitalmelons
@digitalmelons Рік тому
Thank you very much for this videos, are really interesting.
@StuartPatterson
@StuartPatterson Рік тому
You are welcome!
@tolipydob
@tolipydob Рік тому
Thank you for this video series. Imna try and capture and graph pulse and spO2 data from wellue devices (on an Arm linux box).
@StuartPatterson
@StuartPatterson Рік тому
You are welcome. Glad it helped.
@fluiditynz
@fluiditynz Рік тому
Interesting. I'm similar age to you and only just getting back onto microcontrollers after a long hiatus filled with 3D printing design, hydrofoil design etc. I've been collecting up different ESP32 variants including S2 and C3 models, SEEDUINO variants etc. As the ESP32-C3 is supposed to be Bluetooth 5 with BLE and one of my projects is to make an RC hydrofoil boat, I'm experimenting with that first. I've had ESP-NOW working on the C3s but I only get around 200m line of sight which is still impressive but not BLE worthy. I've experimented with the nRF app too, it's great, though you've reminded me that encrypting the values passed by the characteristics are important in any commercial product. It's a little slow going as only hobby work, had to upgrade my laptop to speed the edit/download/test cycle, I was feeling pretty dumb waiting 5 to 10 minutes on the previous laptop. But now I see progress, get things working and it's great. Re applying your reverse engineering, I think it would be more impressive with a bunch of those lights. You could locate them as pixels in a pattern and then flow colours through them with sinewaves applied to your RGB components and apply to a ESP32 held map with pattern positioning properties for each light. 3D if you were to get a sponsor for a large display.
@StuartPatterson
@StuartPatterson Рік тому
Thanks Graham. Hang in there and keep plugging away! Also, thanks for the ideas for the RGB lights. I've moved on to other projects for now, but it is a cool idea!
@harrypehkonen
@harrypehkonen 3 роки тому
I'm very grateful for this series!!! I have never done anything with BLE before now. About to order an nRF52840 dongle. Thank you!!! Would you mind also posting (or providing the source of) the supposed-to-be-like-this example? By the way, I'm here because I heard about the videos on the hackaday podcast.
@StuartPatterson
@StuartPatterson 3 роки тому
Sure, but it is listed in the description of the 3rd video in the series: bitbucket.org/stuartpatterson/esp32_ble_lumin_random_rgb/src/master/
@harrypehkonen
@harrypehkonen 3 роки тому
Thanks, @@StuartPatterson . Actually, I meant the code at 2:55. But now I have found it in Arduino / Examples / ESP32 BLE Arduino / BLE_client. Take care!
@kmpnelson
@kmpnelson Рік тому
Super informative, unfortunately it seems like the dongle you picked up I can't easily find (I'm in Canada). He'll I'll order something similar and give it a shot for my specific application. Thank you for the tutorial!
@StuartPatterson
@StuartPatterson Рік тому
Checkout NordicSemi they should have something similar.
@chrisboring3170
@chrisboring3170 4 місяці тому
THis was a great tutorial, thank you. One question - I'm trying to emulate a BT remote for an Android set top box. Is there a way to do this if they are using LTK?
@StuartPatterson
@StuartPatterson 4 місяці тому
Glad it was helpful. Sorry I have no experience with long term keys.
@AbelPinales
@AbelPinales 2 роки тому
This is a fantastic series and I am using it to teach a class. How would this work if I were to do this on a raspberry pi(master)?
@AbelPinales
@AbelPinales 2 роки тому
You also mentioned you’d write some code in python, will you make a follow up with python code?
@StuartPatterson
@StuartPatterson 2 роки тому
That is great to hear, thank you! I have not tried using the same tools under Linux, so that is something that you will need to experiment with, sorry.
@AbelPinales
@AbelPinales 2 роки тому
@@StuartPatterson will you still do a python version
@michaeltheophilou5309
@michaeltheophilou5309 2 роки тому
Thank you for this great lesson. Wondering if you could point me in the right direction for a little project i am working on. I completely understand the sniffing and reverse engineering of the data, and the code you have for the rgb randomiser. I just need a little help with sending a simple on / off command, or taking from the example you have, sending a command to turn the light on using its last setting and turning it off. thank you in advance
@StuartPatterson
@StuartPatterson 2 роки тому
This sounds vaguely familiar. I think the on off for that light is really sending the black color #000000 to the lamp. I might have played around with that a year ago, but I have not looked at it recently. Try sniffing the traffic while using the app.
@michaeltheophilou5309
@michaeltheophilou5309 2 роки тому
@@StuartPatterson thank you for the response. In the second video, you show the values as On service=ffd5, characteristic=ffd9, value=cc2333 Of service=ffd5, characteristic=ffd9, value=cc2433 my query was more along the lines of, instead of sending the black colour, to send the service/characteristic/value for on/off (instead of the random color rgb_color_data portion of the code) so that i can then adjust the code for another use. Backstory: I have a Virion EQ25 (pool controller) which i can connect to via Bluetooth and app on my phone/device. It does not offer any other API/connection method i can connect into (thus cannot add it into my home automation environment, which is my ultimate goal), so i wanted to try to sniff and reverse engineer the traffic for on/off (I understand how to do this) to then add it into an esp32 and then add the esp32 into my home automation system (HomeAssistant) EDIT: I am not a dev, so just lost on how to do this. I can read and understand what is happening in code, but cannot write it.
@StuartPatterson
@StuartPatterson 2 роки тому
@@michaeltheophilou5309 You should be able to send the on and off codes to the BLE device using a similar method as the colors. I am sorry, but I don't have this project easily available to set it up again and look and the code.
@michaeltheophilou5309
@michaeltheophilou5309 2 роки тому
@@StuartPatterson not a problem. Thank you for your help.
@StuartPatterson
@StuartPatterson 2 роки тому
@@michaeltheophilou5309 Working on a new video about Lumin+, cheerlights.com, and MQTT. Had to chance to get the on/off working... Here you go. Also watch for the video. uint8_t off_command[] = { 0xcc, 0x24, 0x33 }; uint8_t on_command[] = { 0xcc, 0x23, 0x33 }; pRemoteCharacteristic->writeValue(off_command, sizeof(off_command)); delay(500); pRemoteCharacteristic->writeValue(on_command, sizeof(on_command));
@Sharedbook
@Sharedbook 7 місяців тому
This is just FLAWLESS. Thank you so much for creating and sharing this with us. I was wondering if this is possible (and how): - Can I connect the nRF dongle/module/etc to an ESP32 and capture the BT/BLE traffic directly from my ESP32 board (or maybe with a Raspberry Pi)? (but not using a PC) Thank you!!
@StuartPatterson
@StuartPatterson 7 місяців тому
Thank you for the kind words! I would suspect that would be possible, however, it might even be possible to leverage the ESP32 built in BT/BLE support and not even use the nRF. Sniffing is also possible with the Nordic phone app!
@Sharedbook
@Sharedbook 7 місяців тому
@@StuartPatterson are you open (available) for a quick chat? how it'll be best to reach you? thanks again!
@StuartPatterson
@StuartPatterson 7 місяців тому
Sure. Best option would be just to use Twitter/X @codemonkey0 I am pretty busy and don't do any outside consulting at this time. However, I will do my best to answer your questions, if I can.
@homayounneirizi4980
@homayounneirizi4980 2 роки тому
Thanks for the video, it was grate. I'm looking for the way to connect esp to my IPhone and all I need is for the esp to realise that it is connected to phone. I would be grateful if you could make a video on that. Thanks
@StuartPatterson
@StuartPatterson 2 роки тому
Always looking for new projects for the channel. Can you give me a little more detail? What do you want the esp32 to do besides advertise a service?
@homayounneirizi4980
@homayounneirizi4980 2 роки тому
@@StuartPatterson Hi Stuart thanks for quick reply I'm trying to install a esp at home with my home automation system and would like to get the esp to wait for the IPhone to come in range and after connecting to Iphone turn the light on and Off. Regards Amir
@StuartPatterson
@StuartPatterson 2 роки тому
So, what you really want to do is expose a service, called a Peripheral, in BLE talk, on the esp32 that the IPhone connects to when it is in range. I’ll add it to the list.
@homayounneirizi4980
@homayounneirizi4980 2 роки тому
@@StuartPatterson Thats correct, the biggest problem is to make it discoverable by IPhone.
@StuartPatterson
@StuartPatterson 2 роки тому
OK, I've added it to the list to research and possibly do a video.
@mitchellzelmanovich2782
@mitchellzelmanovich2782 2 роки тому
I was able to sniff out some traffic for my teptron move blinds but the value seems to change eveytime i send it from the app (Note I am using android HCI logs) does this point to some encryption or something else I need to take into account before I can send the command?
@StuartPatterson
@StuartPatterson 2 роки тому
It could but not necessarily. It should be a packed number with some timing value. However, it could also be encryption. Sorry I can offer more help.
@ardahanli
@ardahanli 11 місяців тому
Will this work, if your device ask for a pincode to connect? in part 2 when i connect it ask for a pin code, since the device is a fireplace it has no screen so no pincode available. How can i make this work for devices that ask pincode. The fireplace has only a bluetooth remote no app.
@StuartPatterson
@StuartPatterson 11 місяців тому
I suspect the fireplace is Bluetooth and not BLE. Of course, I could be wrong. Sorry, but I can’t really answer your question. This is one of those times you need to roll up your sleeves and “hack the planet.”
@ardahanli
@ardahanli 11 місяців тому
@@StuartPatterson Nah it was Ble, but in the sniffer i found out my remote had auth false, so i could ignore the pin code, and it works. i used my own code for the bluetooth and mqtt on esp32 and now i can use in homeassistant also. thanks a lot for your videos it really helped to make my fireplace smart
@StuartPatterson
@StuartPatterson 11 місяців тому
Awesome. So glad you got it working! Good job!
Sniffing, Reverse Engineering, and Coding the ESP32 Bluetooth LE Part 2 of 3
21:08
i cant stop thinking about this exploit
8:40
Low Level Learning
Переглядів 156 тис.
Stray Kids "Lose My Breath (Feat. Charlie Puth)" M/V
02:53
JYP Entertainment
Переглядів 9 млн
"Поховали поруч": у Луцьку попрощались із ДВОМА Героями 🕯🥀 #герої #втрати
00:15
Телеканал Конкурент TV - новини Луцька та Волині
Переглядів 316 тис.
ЧТО ДЕЛАТЬ, ЕСЛИ НЕ ХВАТАЕТ ДЕНЕГ НА ВОССТАНОВЛЕНИЕ ТАЧКИ?
47:52
Sniffing, Reverse Engineering, and Coding the ESP32 Bluetooth LE Part 1 of 3
12:26
BLE Fundamentals - GAP, GATT and ATT protocol ( Part 2)
12:56
Bina Bhatt
Переглядів 52 тис.
Best OS for programming? Mac vs Windows vs Linux debate settled
8:41
449 OpenMQTTGateway Connects Many Things to Your Home Automation
11:56
Andreas Spiess
Переглядів 82 тис.
Extracting Firmware from Embedded Devices (SPI NOR Flash) ⚡
18:41
Flashback Team
Переглядів 493 тис.
The ARM chip race is getting wild… Apple M4 unveiled
4:07
Fireship
Переглядів 598 тис.
Master BLE Basics in Just 10 Minutes: The Ultimate Guide!
9:15
Novel Bits
Переглядів 87 тис.
The First PCBs: Open-source Industrial Robot Controller Part 3
11:41
Excessive Overkill
Переглядів 53 тис.
Phone charger explosion
0:43
_vector_
Переглядів 44 млн
Портативная PS 5 🎮 #ps5 #expressly
0:22
ExpresSLY Shorts
Переглядів 236 тис.
Phone charger explosion
0:43
_vector_
Переглядів 44 млн
#Shorts Good idea for testing to show.
0:17
RAIN Gadgets
Переглядів 2 млн