RE-ing BLE fitness smart watch protocol made easy. Part 2. Kaitai

 

Parts: 1, 2.

I'm not going to advertise the Kaitai set of instruments. Just want to note that it may be very useful in simple RE cases.

E.g. you already have the BT network dump in PCAP format. And can open the Kaitai Web IDE, open you dump there and see it parsed to a certain detalisation level.

But for a real KSY development we need to deploy our local copy of the IDE.

RE-ing BLE fitness smart watch protocol made easy. Part 1. Dump

You got your shiny new fitness bracelet or a smart watch. Great! You installed a companion app on your smartphone. Allright.

You could already be fine and happy using it. But if not... Want to know nuts and bolts of the protocol? Then go DEEPER

 

MITM for SSL using socat

Sometimes you need to look inside the SSL traffic without having keys. The alternative way would be to redirect the traffic to a decoder/encoder pair and listen in between.
HOWTO: