I'm attempting to control a toy RC car with my own custom input device over BLE. The RC car is typically controlled by an app, and I've logged decrypted BLE packets from a session between the app and the car. Each command packet from the app has an incrementing counter followed by a length byte that indicates how many remaining bytes are in the packet (plus one).

[2 bytes: counter] [1 byte: remaining packet length "n"] ["n+1" bytes: message]

I've generated a number of packets that tell the car to "turn right". Each of these packets contains a 6 byte message; however, the 6 bytes are different every time, indicating some sort of custom encryption scheme from the RC vendor driven by the counter.

Given that I have many repeated samples of the same message, what tools are at my disposal to identify the encryption scheme and decrypt the protocol?

migrated from security.stackexchange.com Nov 26 '18 at 14:29

This question came from our site for information security professionals.

  • Thanks- better? Feel free to suggest wording – JHalpert Nov 26 '18 at 14:27
  • yes, better, but now I'm wondering if this is the right place for you to get an answer – schroeder Nov 26 '18 at 14:28
  • Do you know if you are actually generating "turn right" each time, or could you, for example, be generating "turn 89.9 degrees", "turn 90.1 degrees", etc., thus accounting for the different payloads? – TripeHound Nov 26 '18 at 16:19
  • I'm not sure, and I did think about that- however, every byte in the packet is different each time it's captured. Presumably at least one or two of the bytes in the protocol would specify "this is a turn right command". – JHalpert Nov 26 '18 at 16:53
  • As another example, when I start a new session between app and car there's always a three byte message to start off. Presumably in the decrypted protocol this sequence would be the same every time, but encrypted each byte is different each time. – JHalpert Nov 26 '18 at 16:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.