Project CC2540 | |
---|---|
Reverse engineering the CC2540 BLE sniffer dongle | |
Status | Stalled |
Contact | bertrik |
Last Update | 2018-05-13 |
- 3Analysis
- 4Protocol
- 4.2Reading BLE frames
Driver Tool, CC2540 driver for example. Windows 7 32 bit, CC2540 BLE is. While working on a client s project it became necessary to use a Bluetooth Low Energy sniffer to debug some weird behavior happening with the data transfers between the master and slave device. Drivers dell laptop vostro 3446 Windows xp download.
HID® FARGO® HDP5000 Windows Driver. Hdp5000windowsv3.3.0.1setup.zip - (23.87 MB) This driver has the fix for the Windows 10 build 1903 or later update. DriverMax is a very handy Windows Update utility which makes keeping your system drivers up-to-date an extremely easy task. It handles the following tasks with ease: Downloading driver updates, backing up drivers, detailed reports, checking for changes, hardware information and sharing detail reports of your hardware information with friends.
Status
At this point (2017-05-09), the status is:
- it is pretty clear which commands the default sniffer firmware understands
- I wrote a little test program to dump raw BLE frames
- there is no plugin for WireShark yet
Introduction
This page is about the CC2540 bluetooth low-energy sniffer dongle and getting it to work with Linux.A nice end result could be that it becomes possible to sniff directly in WireShark with this dongle.
I have such a 'WeBee' dongle that can be found for about E15,- on websites like Aliexpress.
It's supposedly a CC2540 (or compatible) dongle, the USB id is 0451:16b3.
Interesting links:
Analysis
USB descriptor
When plugging this stick into a Linux machine, you can see it uses only one bulk endpoint.
Reading the identification from the stick with the 0xC0 command, results in the following 8-byte response
You can recognise the 2540 type number in there.
USB logs from Windows
This USB device does actually work with Windows:
I've captured a log of the communication over USB while the BLE is capturing bluetooth traffic from some iBeacon, using USB pcap.
In the logs, I cannot see any firmware blobs being downloaded to the stick.Probably the stick comes with a pre-loaded firmware of itself to do the BLE sniffing.
The USB control transfer request codes seem to match up with the code in https://github.com/christianpanton/ccsniffer/blob/master/ccsniffer.py
- 0xC0, GET_IDENT: returns some kind of identifier
- 0xC5, SET_POWER
- 0xC6, GET_POWER
- 0xC9, no idea, this appears in my USB logs but I can't find it in the python code
- 0xD0, START
- 0xD1, STOP
- 0xD2, SET CHAN
Protocol
In the windows sniffer software, it seems there are only two things communicated:
- towards the stick: which radio channel to sniff, and some other radio settings
- from the stick: raw sniffed BLE frames
Configuring the radio
This appears to be done using USB control transfers.
The following requests are sent:
Request type | Request | Value | Index | Data | Description |
---|---|---|---|---|---|
0x40 | 0xC5 | 0 | 4 | - | Set power |
0xC0 | 0xC6 | 0 | 0 | 0x00 | Get power |
0xC0 | 0xC6 | 0 | 0 | 0x04 | Get power |
0x40 | 0xC9 | 0 | 0 | - | ??? |
0x40 | 0xD2 | 0 | 0 | 0x27 | Set channel |
0x40 | 0xD2 | 0 | 1 | 0x00 | Set channel |
0x40 | 0xD0 | 0 | 0 | - | Start capture |
Request type 0x40 is a vendor-specific device request from host-to-device.Request type 0xC0 is a vendor-specific device request from device-to-host.
Reading BLE frames
This appears to be done using USB bulk input transfers.
I can see a lot of similarities between the USB log and the BLE sniffer log.
Each frame starts with a byte indicating the type of frame, following by two bytes indicating the length of the rest of the frame (encoded as little endian).
data frames
The bulk USB data starts off with two bytes indicating the length of the rest of the data.
In the example image on the right:
- 00: 0 means this is a data frame
- 31 00: length of rest of frame encoded in little endian = 49 bytes decimal
- 39 04 29 54: part of the time stamp
- 2c d6 be ..: data frame contents
unknown frames (tick or 'alive'?)
The stick also returns 4-byte frames, alternating between
and
Interpretation:
- 01: 1 means this is a frame of type 1
- 01 00: length of the rest of the frame encoded in little endian = 1 byte
- 40 or C0: unknown data byte
Software
Preliminary code can be found athttps://github.com/bertrik/cc2540
Cc2540 Hid
It connects to the dongle and dumps raw USB packets to stdout.
This software requires libusb-1.0-dev
DriverMax is a very handy Windows Update utility which makes keeping your system drivers up-to-date an extremely easy task. It handles the following tasks with ease: Downloading driver updates, backing up drivers, detailed reports, checking for changes, hardware information and sharing detail reports of your hardware information with friends. DriverMax can also display a complete report of currently installed drivers.
DriverMax currently supports drivers for various components such as: System drivers, motherboard drivers, mp3 player drivers, modem drivers, bluetooth drivers and usb drivers. The list is by no means complete. It has been known to work wonders with issues surrounding game play on systems with NVidea and AMD ATI drivers installed; also known for solving sound driver problems.
DriverMax also supports device drivers from big, well-known brand name manufacturers like AMD, Atheros, Asus, Acer, RealTek, Nokia, Sony Ericsson, Toshiba, Dell, Sony and many more.
Our verdict: Install DriverMax today. Keep those pesky outdated drivers on your system, keep your registry and system clean and you're sure to run into very little errors or issues with modern gaming and computing.
The program currently supports a whopping 1.3 million drivers and almost 300,000 devices compatible with Windows.
Features and highlights
- Update all PC drivers
- Immediate increases in speed
- Access to DriverMax knowledge base
- Easy-to-use
- Automatic updates to system drivers
DriverMax 11.12 on 32-bit and 64-bit PCs
This download is licensed as freeware for the Windows (32-bit and 64-bit) operating system on a laptop or desktop PC from drivers without restrictions. DriverMax 11.12 is available to all software users as a free download for Windows.
Filed under:Cc2540 Driver Windows 7 32-bit
- DriverMax Download
- Freeware Drivers
- Driver Updating Software