I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth.

The new application I am writing should be able to control the same robots as the first one does.

How can I intercept the commands -sent via bluetooth- from the closed source application ?
And more importantly, will I be able to "reproduce" them ?

An outline of the steps I have to take is enough to answer my question. A detailed answer would be appreciated.

4 Answers 4


The Ubertooth one will allow you to sniff bluetooth traffic. It is fully capable of being placed into monitor mode and can be used with tools such as Kismet to perform bluetooth sniffing. There may be additional functionality that will allow you to perform packet injection as well. However if the traffic is encrypted this may not allow you to see the packets in the clear but it may give you a good start at reverse engineering the communication protocols.


There is a better method today if you are using android. The developer tools offer a way to sniff Bluetooth packets into a log that can be opened in Wireshark.

Go to Developer Options on your phone and enable hcidump.

See this blog post for more details


Controlling robots via bluetooth sounds cool.

Perhaps instead of intercepting the bluetooth communication and decoding it, it might actually be easier to decompile the closed-source app and then search for the bluetooth commands? The control devices might use a standard bluetooth library that you might be able to hook into and log all requests/responses somehow?

  • 1
    I thought that would be more complicated, thanks for the answer, it turned out it's pretty easy to decompile/reverse engineer an android apk..
    – Pierre
    Commented Mar 13, 2012 at 11:08
  • 2
    some times it's easier walking through the front-door than climbing through the window :)
    – Yoav Aner
    Commented Mar 14, 2012 at 14:17

Well it is not that easy.

Unlike sniffing 802.11, Bluetooth doesn't use one channel, but hops over 79 channels. Which makes sniffing a lot harder.

You also have little or no control over the hardware, the only way to do this is by using the HCI with predefined commands.

The thing is when you check the sites you will see you need to ask a quote for a device. Most of the time that's not a good sign.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .