Sniffing serial Bluetooth traffic on Android

Question

Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker.

One approach would be to install the app on an Android VM, connect to the speaker and capture the traffic exchanged.

With VirtualBox, I would probably need to connect a Bluetooth dongle as a USB device and let the VM control it.

How can I capture the serial traffic exchanged between the speaker and the app?

Answer 1

According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable Bluetooth HCI snoop log”.

I have not tried this myself yet, but according to the information I could find:

• Communication should be logged to a file called /sdcard/btsnoop_hci.log.
• If your external storage dir is something else than /sdcard, modify the path accordingly.
• Some flavors of Android may use an entirely different path. Look for the FileName parameter in /etc/bluetooth/bt_stack.conf to find the correct path. (Some flavors of Android may put this file in /system/etc or /vendor/etc.)
• On some flavors of Android (including Android x86_64 CM 14.1), none of the above will work but you will find the log in /data/misc/bluetooth/logs/btsnoop_hci.log (you need to have root permissions to get the file).
• The resulting file can then be analyzed with Wireshark or similar.

To get Bluetooth from an Android VM running on VirtualBox:

• If you are on Linux (tried on Ubuntu 18.04):
  • Add yourself to the vboxusers group, e.g. by running sudo usermod -a -G vboxusers your_user_name
  • Log out and back in for the new group membership to take effect.
• Start your Android VM.
• In Devices > USB Devices, connect the Bluetooth adapter to the VM. It may have an inconspicuous name (mine is just called Intel [0001]).
• Optionally, add a USB filter to have the VM grab the BT device automatically whenever it starts.
• Be aware that the host system will lose access to the BT adapter while it is in use by the VM. If you have a BT mouse or keyboard, either replace it with a wired one, or get an additional BT adapter and use that for your VM.

In practice, however, I was unable to get a reliable Bluetooth connection from the Android VM. I can scan for devices and managed to pair the BT device (though that took multiple attempts), but I never managed to connect to the device. I suspect that is because Android is quite resource-hungry, and the overhead of virtualization along with a restriction to 2 out of 4 processor cores (which I have set this way to keep VMs from hogging my entire CPU) does not leave enough room for Android to run smoothly. Will need to retry with Android x86_64 on a USB stick, running on physical hardware.