1

Please bare with me with this introduction to the problem. Unfortunately title might be confusing, but it's hard to came up with proper one - let me show you why.

I'm trying to decode WM-Bus (Smart meters) frame. Here is how the situation looks like:

  1. I have:
    • a watermeter
    • device to read that meter (wm-bus <-> bluetooth)
    • Android application which connects to that device via bluetooth.
    • On PC I have a software which decodes received data (frame is encrypted, key is known to me).

Furthermore I disassembled Android Apk (source has not been obfuscated, passwords in plain text etc.), I've modified source code to log received frame (hopefully correct one, dalvik/smali), then I used adb logcat to get that data.

  1. I have a USB wm-bus dongle connected to my PC. Via virtual serial port I'm receiving the same data (at least I think so) which goes to the device in point 1.

Here's the frame from USB Dongle:

FF 64 44 01 06 81 32 20 00 05 07 7A CD 00 60 85 C1 03 5C D8 C9 86 9A 7D 55 49 DC 3A 4B 48 AC A4 BD 95 FE 4F BA 79 EE 01 55 D7 BC A8 9D B8 E1 33 33 56 58 75 BB 8B 2E FF 1E 4A F8 41 FB 82 FF 4B 46 C9 68 5A 56 37 5D BE 4B 05 6E BE 44 16 E2 59 D6 16 A7 73 C9 E1 7E FC CA 6B 3F 15 BF 3A 21 B5 28 6B 62 73 8C FD 96 FD 35 40 F5 71 23 91 B1 B6 A1

And here's the frame from the device:

C0 02 7B D0 6C 44 01 06 81 32 20 00 05 07 47 5A 7A CD 00 00 80 0F 15 02 AB 92 08 00 08 43 36 05 F4 F1 83 00 11 51 15 02 4B 01 40 1A 26 10 A1 00 00 00 CB CB 7B 1C A1 00 00 00 A1 00 00 00 A1 00 00 00 A1 00 39 2C 00 00 A1 00 00 00 A1 00 00 00 A2 00 00 00 A2 00 10 40 00 00 A2 00 00 00 A2 00 00 00 00 00 00 00 00 00 36 A5 00 00 A0 CF BC 11 02 FF FF FF FF FF FF FF FF FF 2D CA FF 79 F4 B5 C2

Some fragments are the same, for example:

44 01 06

20 00 05 07

7A CD 00

So... I'm getting two different frames for the exact the same transmission (that I'm sure of). I'm thinking that the problem might be:

  • device is adding something to the frame
  • I'm not reading raw data (despite the fact that the variable I'm reading from is called raw frame

Messing with the device (to somehow solder wires and intercept raw data from the chip) is out of question (it's pretty expensive piece of hardware, yet there's nothing fancy on board).

I was thinking of intercepting raw data which goes to my Android phone - and that's the question - can I do that pretty simple? I was trying to log that bluetooth data, but there's a lot of traffic going on. It would be nice to have something like Wireshark to look only into the data coming in.

Anyway - I'm open to other suggestions, thoughts...

Just to clarify: Firstly - watermeter is/has not a bluetooth device. It transmits data via wm-bus to the device (special device from the watermeter's manufacturer). That device then talks to the Android phone app via bluetooth. That app decrypt/decyphers the frame into useful data and saves it on the phone (sqlite). Later that data can be transfer onto PC.

Secondly - what I REALLY want to do is to be able to take a frame from the usb dongle (so not the official harware) and use some algorithms from decompiled Android app (read it as - make my own piece of software based on that one) to decrypt it. That's the ultimate goal. I'm just somewhere in the middle and I don't know exactly how to push forward.

  • Your question is not how to sniff, but how to interpret the results. Have you looked at bluetooth encryption? – schroeder Apr 10 at 18:40
  • No, I did not. I'm not sure what to look for at the moment. – matt Apr 11 at 20:28
0

Given that you discarded hardware modifications, to sniff the bluetooth packets you would need to either:

  • Install something like Wireshark on your phone, this would probably require root privileges.
  • Have some device like Ubertooth that allows you to sniff the communication between the watermeter and the android app

I'm not sure if the Ubertooth device supports every bluetooth version out there. And the wireshark-like app is only possible if you have root privileges on your phone, which may or may not be the case.

I'm not sure what is your objective on this task, but I think that whatever you're trying to do is probably easier to do installing a modified version of the APK, for example to include a Frida gadget and then interact with the app in runtime to log whatever messages are being sent

In this way you can get the information that is being transmited directly from the application if this is the only thing you need. Or if you want to actually decode the bluetooth packets on the fly you can use this to start decoding them using the ubertooth mentioned earlier or another device

  • Just to clarify - Firstly - watermeter is/has not a bluetooth device. It transmits data via wm-bus to the device (special device from the watermeter's manufacturer). That device then talks to the Android phone app via bluetooth. Secondly - what I REALLY want to do is to take frame from the usb dongle and use some algorithms from decompiled Android app to decrypt it. At the moment what I need to do is to confirm how both frames (from the device and usb dongle) really looks like. – matt Apr 11 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.