0

I wanted to learn how other bluetooth applications connects bluetooth OBject EXchange Object Push Profile , as my app continuously threw famous errors

socket might closed are timeout; read() ret : -1

So I tried to decompile the app, but the app was protected.

So I chose to perform a dynamic analysis.

public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable
{
        if (!lpparam.packageName.equals("the.target.package") && !lpparam.packageName.equals("javax.obex"))
        {
            //Log.v(TAG, "Not: " + lpparam.packageName);
            return;
        }

        Log.i(TAG, "Yes " + lpparam.packageName);
        TAG += lpparam.packageName;

        ClassLoader sysClsLoader=lpparam.classLoader.getSystemClassLoader();
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothOutputStream", sysClsLoader, "close", new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BTOutputStream.Close() called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothOutputStream", sysClsLoader, "write", int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BTOutputStream.write(" + param.args[0] + ")");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothOutputStream", sysClsLoader, "write", byte[].class, int.class, int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BTOutputStream.write(" + Arrays.toString((byte[])param.args[0]) + "," + param.args[1] + "," + param.args[2] + ")");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothOutputStream", sysClsLoader, "flush", new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BTOutputStream.flush() called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothInputStream", sysClsLoader, "available", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Object o=param.getResult();
                    if (o != null)
                    {
                        Log.i(TAG, "BTInputStream.available()=" + (int)o);
                    }
                    else
                    {
                        Log.i(TAG, "BTInputStream.available() may have thrown an exception");
                    }
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothInputStream", sysClsLoader, "close", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BTInputStream.close()");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothInputStream", sysClsLoader, "read", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Object o=param.getResult();
                    if (o != null)
                        Log.i(TAG, "BTInputStream.read() ret:" + (int)o);
                    else
                        Log.i(TAG, "BTInputStream.read() may have thrown an exception");

                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothInputStream", sysClsLoader, "read", byte[].class, int.class, int.class, new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Object o=param.getResult();
                    if (o != null)
                    {
                        Log.i(TAG, "BTInputStream.read(buf," + param.args[1] + "," + param.args[2] + ") ret:" + (int)o);
                        if (param.args[0] != null)
                            Log.i(TAG, "buf=" + Arrays.toString((byte[])param.args[0]));
                        else
                            Log.i(TAG, "buf is null;;;;;");
                    }
                    else
                        Log.i(TAG, "BTInputStream.read(buf," + param.args[1] + "," + param.args[2] + ") may have thrown an exception");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createInsecureRfcommSocket", int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createInsecureRfcommSocket(" + param.args[0] + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createInsecureRfcommSocketToServiceRecord", UUID.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createInsecureRfcommSocketToServiceRecord(UUID=" + ((UUID)param.args[0]).toString() + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createRfcommSocketToServiceRecord", UUID.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createRfcommSocketToServiceRecord(UUID=" + ((UUID)param.args[0]).toString() + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createInsecureL2capSocket", int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createInsecureL2capSocket(channel=" + ((int)param.args[0]) + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createL2capSocket", int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createL2capSocket(channel=" + ((int)param.args[0]) + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothDevice", sysClsLoader, "createRfcommSocket", int.class, new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothDeice.createRfcommSocket(channel=" + ((int)param.args[0]) + ")called");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothSocket", sysClsLoader, "connect", new XC_MethodHook(){
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothSocket.connect() called");
                }
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    try
                    {
                        Object o=param.getResultOrThrowable();
                        if (o != null)
                        {
                            Log.i(TAG, "BluetoothSocket.connect() ret:" + o.toString());                    
                        }
                        else
                            Log.i(TAG, "BluetoothSocket.connect() may have thrown an exception");
                    }
                    catch (Exception e)
                    {
                        Log.i(TAG,"BluetoothSocket.connect exception",e);
                        param.setResult(e);
                    }
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothSocket", sysClsLoader, "isConnected", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothSocket.isConnected() returned " + param.getResult());
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothSocket", sysClsLoader, "getInputStream", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothSocket.getInputStream()");
                }
            });
        XposedHelpers.findAndHookMethod("android.bluetooth.BluetoothSocket", sysClsLoader, "getOutputStream", new XC_MethodHook(){
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable
                {
                    Log.i(TAG, "BluetoothSocket.getOutputStream()");
                }
            });         
    }

I used XPosed framework to hook some methods of Android bluetooth APIs. However after analyzing the logs, I found something odd.

(Start of log of pid 26792)
10-23 16:48:50.659 I/ActivityManager(1586): Start proc 26792:the.target.package/u0a88 for activity the.target.package/.AMain
10-23 16:48:51.072 I/chatty  (26792): uid=10088(the.target.package) expire 65 lines
10-23 16:48:51.685 I/chatty  (26792): uid=10088(the.target.package) Jit thread pool expire 7 lines
10-23 16:48:52.512 I/chatty  (26792): uid=10088(the.target.package) expire 1 line
10-23 16:48:52.753 I/chatty  (26792): uid=10088(the.target.package) expire 4 lines
10-23 16:48:52.792 I/chatty  (26792): uid=10088(the.target.package) expire 6 lines
10-23 16:48:52.808 I/chatty  (26792): uid=10088(the.target.package) expire 3 lines
10-23 16:48:53.011 I/chatty  (26792): uid=10088(the.target.package) HeapTaskDaemon expire 1 line
10-23 16:48:53.075 I/chatty  (26792): uid=10088(the.target.package) Thread-5 expire 1 line
10-23 16:48:53.088 I/chatty  (26792): uid=10088(the.target.package) AdWorker(Defaul expire 2 lines
10-23 16:48:53.899 I/chatty  (26792): uid=10088(the.target.package) Chrome_InProcGp expire 21 lines
10-23 16:49:12.791 I/chatty  (26792): uid=10088(the.target.package) expire 7 lines
10-23 16:49:12.799 I/chatty  (26792): uid=10088(the.target.package) expire 3 lines
10-23 16:49:14.122 I/chatty  (26792): uid=10088(the.target.package) expire 6 lines
10-23 16:49:23.937 I/chatty  (26792): uid=10088(the.target.package) expire 2 lines
10-23 16:49:25.801 I/LogBluetooththe.target.package(26792): BTInputStream.read(buf,0,8256) ret:3
10-23 16:49:25.819 I/LogBluetooththe.target.package(26792): buf=[-112, 0, 3, 16, 0, 31, -39, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, (I omitted)
10-23 16:49:25.872 I/LogBluetooththe.target.package(26792): BTOutputStream.write([2, 0, 22, 72, 0, 19, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 120, 0, 116, 0, 0, 68, 0, 18, 50, 48, 49, 56, 49, 48, 50, 49, 84, 48, 57, 51, 48, 50, 55, 72, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, , 0(I omitted)
10-23 16:49:25.873 I/LogBluetooththe.target.package(26792): BTOutputStream.flush() called
10-23 16:49:25.960 I/LogBluetooththe.target.package(26792): BTInputStream.read(buf,0,8256) ret:3
10-23 16:49:25.964 I/LogBluetooththe.target.package(26792): buf=[-112, 0, 3, 16, 0, 31, -39, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,(I omitted) 
10-23 16:49:25.971 I/LogBluetooththe.target.package(26792): BTOutputStream.write([-126, 0, 6, 73, 0, 3, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 120, 0, 116, 0, 0, 68, 0, 18, 50, 48, 49, 56, 49, 48, 50, 49, 84, 48, 57, 51, 48, 50, 55, 72, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, (I omitted)
10-23 16:49:25.972 I/LogBluetooththe.target.package(26792): BTOutputStream.flush() called
10-23 16:49:26.045 I/LogBluetooththe.target.package(26792): BTInputStream.read(buf,0,8256) ret:3
10-23 16:49:26.048 I/LogBluetooththe.target.package(26792): buf=[-96, 0, 3, 16, 0, 31, -39, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, (I omitted)
10-23 16:49:34.299 I/LogBluetooththe.target.package(26792): BTOutputStream.write([-127, 0, 3, 73, 0, 3, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 120, 0, 116, 0, 0, 68, 0, 18, 50, 48, 49, 56, 49, 48, 50, 49, 84, 48, 57, 51, 48, 50, 55, 72, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ... (I omitted)
10-23 16:49:34.299 I/LogBluetooththe.target.package(26792): BTOutputStream.flush() called
10-23 16:49:34.358 I/LogBluetooththe.target.package(26792): BTInputStream.read(buf,0,8256) ret:3
10-23 16:49:34.362 I/LogBluetooththe.target.package(26792): buf=[-96, 0, 3, 16, 0, 31, -39, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ... (I omitted)
10-23 16:51:34.405 I/art     (26792): Do full code cache collection, code=126KB, data=123KB
10-23 16:51:34.407 I/art     (26792): Starting a blocking GC JitCodeCache
10-23 16:51:34.407 I/art     (26792): After code cache collection, code=117KB, data=103KB
(End of the log of pid 26792)

As you can see in this log, there is no connect() call. I checked the logs

How can it be? (I'll post this(<<) question on Stack Overflow.)

Question

So I want to ask you, where I should hook more to log all the bluetooth communication process.

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.