decode_capture.js

// Decrypts a btsnoop_hci.log from an Android device (enabled in developer options.)

// First use tshark to create a text log from a hci capture:
//   tshark -r btsnoop_hci.log -Y 'btatt.opcode == 0x12 || btatt.opcode == 0x1d' -Tfields -e frame.number -e btatt.opcode -e btatt.handle -e btatt.value >capture.log
// Then, assuming you already have set your offline key:
//   node tools/decode_capture.js capture.log >command.log

'use strict';

var crypto = require('crypto');
var fs = require('fs');

var ZERO_BYTES = new Buffer(16);
ZERO_BYTES.fill(0);

var cryptoKey, sessionKey, txCipherSec, rxCipherSec, txCipher, rxCipher;

function isSecurityChecksumValid(buf) {
  var cs = (0 - (buf.readUInt32LE(0x00) + buf.readUInt32LE(0x04) + buf.readUInt32LE(0x08))) >>> 0;
  return cs === buf.readUInt32LE(0x0c);
}

function isSimpleChecksumValid(buf) {
  var cs = 0;
  for (var i = 0; i < 0x12; i++) {
    cs = (cs + buf[i]) & 0xff;
  }
  return cs === 0;
}

var STATUS = {
   0: 'STM32_FIRMWARE',
   2: 'LOCK_STATE',
   3: 'CURRENT_ANGLE',
   5: 'BATTERY_LEVEL',
   9: 'LOCK_EVENTS_UNREAD',
  10: 'RTC',
  41: 'GIT_HASH'
};

var PARAMETERS = {
   0: 'BACKOFF_TIME_MS',
   1: 'ANIMATION_PERIOD_MS',
   2: 'BATTERY_TYPE',
   3: 'SERIAL_NUMBER_L',
   4: 'SERIAL_NUMBER_H',
   5: 'MANUF_INFO',
   6: 'MANUF_DATE',
   7: 'AUDIO_VOLUME',
   8: 'LED_BRIGHTNESS',
   9: 'CURRENT_KDT',
  10: 'CURRENT_KI',
  11: 'CURRENT_KP',
  12: 'CURRENT_ILIMIT',
  13: 'POS_KDT',
  14: 'POS_KI',
  15: 'POS_KP',
  16: 'POS_ILIMT',
  17: 'RSSI_THRESHOLD',
  18: 'RSSI_FILTER',
  19: 'ACC_THRESHOLD',
  20: 'KNOCK_THRESHOLD',
  21: 'KNOCK_FILTER',
  22: 'STALL_CURRENT_LIMIT',
  23: 'PWM_LIMIT',
  24: 'STALL_POSITION_CW',
  25: 'STALL_POSITION_CCW',
  26: 'TARGET_POSITION_CW',
  27: 'TARGET_POSITION_CCW',
  28: 'BATTERY_SOC_THRESHOLD',