How to decode bluetooth traffic to Android app? [closed]

Question

I'm trying to decode a WM-Bus (smartmeter) frame. Here is what the situation looks like:

1. I have:

• a water meter
• device to read that meter (wm-bus <-> bluetooth)
• Android application which connects to that device via bluetooth.
• On PC I have a software which decodes received data (frame is encrypted, key is known to me).

Furthermore I disassembled Android Apk (source has not been obfuscated, passwords in plain text etc.), I've modified source code to log received frame (hopefully correct one, dalvik/smali), then I used adb logcat to get that data.

2. I have a USB wm-bus dongle connected to my PC. Via virtual serial port I'm receiving the same data (at least I think so) which goes to the device in point 1.

Here's the frame from USB Dongle:

FF 64 44 01 06 81 32 20 00 05 07 7A CD 00 60 85 C1 03 5C D8 C9 86 9A 7D 55 49 DC 3A 4B 48 AC A4 BD 95 FE 4F BA 79 EE 01 55 D7 BC A8 9D B8 E1 33 33 56 58 75 BB 8B 2E FF 1E 4A F8 41 FB 82 FF 4B 46 C9 68 5A 56 37 5D BE 4B 05 6E BE 44 16 E2 59 D6 16 A7 73 C9 E1 7E FC CA 6B 3F 15 BF 3A 21 B5 28 6B 62 73 8C FD 96 FD 35 40 F5 71 23 91 B1 B6 A1

And here's the frame from the device:

C0 02 7B D0 6C 44 01 06 81 32 20 00 05 07 47 5A 7A CD 00 00 80 0F 15 02 AB 92 08 00 08 43 36 05 F4 F1 83 00 11 51 15 02 4B 01 40 1A 26 10 A1 00 00 00 CB CB 7B 1C A1 00 00 00 A1 00 00 00 A1 00 00 00 A1 00 39 2C 00 00 A1 00 00 00 A1 00 00 00 A2 00 00 00 A2 00 10 40 00 00 A2 00 00 00 A2 00 00 00 00 00 00 00 00 00 36 A5 00 00 A0 CF BC 11 02 FF FF FF FF FF FF FF FF FF 2D CA FF 79 F4 B5 C2

Some fragments are the same, for example:

44 01 06

20 00 05 07

7A CD 00

So... I'm getting two different frames for the exact the same transmission (that I'm sure of). I'm thinking that the problem might be:

• device is adding something to the frame
• I'm not reading raw data (despite the fact that the variable I'm reading from is called raw frame

Messing with the device (to somehow solder wires and intercept raw data from the chip) is out of question (it's a pretty expensive piece of hardware, yet there's nothing fancy on board).

I was thinking of intercepting raw data which goes to my Android phone - and that's the question - can I do that simply? I was trying to log that bluetooth data, but there's a lot of traffic going on. It would be nice to have something like Wireshark to look only into the data coming in.

Anyway - I'm open to other suggestions, thoughts...

Just to clarify: Firstly - water meter is/has not a bluetooth device. It transmits data via wm-bus to the device (special device from the water meter's manufacturer). That device then talks to the Android phone app via bluetooth. That app decrypt/decyphers the frame into useful data and saves it on the phone (sqlite). Later that data can be transferred onto PC.

Secondly - what I REALLY want to do is to be able to take a frame from the usb dongle (so not the official harware) and use some algorithms from decompiled Android app (read it as - make my own piece of software based on that one) to decrypt it. That's the ultimate goal. I'm just somewhere in the middle and I don't know exactly how to push forward.

Answer 1

Given that you discarded hardware modifications, to sniff the bluetooth packets you would need to either:

• Install something like Wireshark on your phone, this would probably require root privileges.
• Have some device like Ubertooth that allows you to sniff the communication between the watermeter and the android app

I'm not sure if the Ubertooth device supports every bluetooth version out there. And the wireshark-like app is only possible if you have root privileges on your phone, which may or may not be the case.

I'm not sure what is your objective on this task, but I think that whatever you're trying to do is probably easier to do installing a modified version of the APK, for example to include a Frida gadget and then interact with the app in runtime to log whatever messages are being sent

In this way you can get the information that is being transmited directly from the application if this is the only thing you need. Or if you want to actually decode the bluetooth packets on the fly you can use this to start decoding them using the ubertooth mentioned earlier or another device