REVERSE ENGINEERING IOT DEVICES
USING FOSS
@iAyanPahwa/iayanpahwa
@iAyanPahwa/iayanpahwa
‣ Embedded Software Engineer by profession
‣ FPV Drone racer
‣ Content creator and Tech blogger https://iayanpahwa.github.io
‣ Intrigued by everything related to IoT, 3D printing, AI, Wearable
electronics, Cyber forensics, Automation, Programming etc.
KNOW THE PRESENTER
IOT DEVICES
IOT DEVICES
@iAyanPahwa/iayanpahwa
Reverse Engineering?
@iAyanPahwa/iayanpahwa
Syska Smart light bulb
@iAyanPahwa/iayanpahwa
Syska Smart light bulb
COMMUNICATION PROTOCOL
BLUETOOTH
BT - Bluetooth Classic (< 4.0)
BLE - Bluetooth Low Energy (> = 4.0)
GAP - Generic Access Profile
GATT- Generic Attribute
Classes - Definition and inheritance
Characteristics - User defined functionalities
NRF CONNECT
MAC ID
NRF CONNECT
GATT
NRF CONNECT
Characteristics
NRF CONNECT
NRF CONNECT
https://www.bluetooth.com/specifications/gatt/services
NRF CONNECT
NRF CONNECT
EXPECTATIONS
NRF CONNECT
REALITY
NRF CONNECT
LEGENDS
NRF CONNECT
LEGENDS
WHAT TO DO NOW?
WHAT TO DO NOW?
WHAT TO DO NOW?
WHAT TO DO NOW?
btsnoop_hci.log
WIRESHARK
WIRESHARK
PACKET ANALYSIS
Value: 00100006000a03000101000025ff00000000
Value: 00110006000a030001010049ff0000000000
Value: 00120006000a0300010100ff000000000000
Value: 00130006000a030001010049ff0000000000
Value: 00140006000a03000101000025ff00000000
PACKET ANALYSIS
Value: 00 10 000 6000a0300010100 0025ff 00000000
Value: 00 11 000 6000a0300010100 49ff00 00000000
Value: 00 12 000 6000a0300010100 ff0000 00000000
Value: 00 13 000 6000a0300010100 49ff00 00000000
Value: 00 14 000 6000a0300010100 0025ff 00000000
PACKET ANALYSIS
RED GREEN BLUE
2^8 = 256 (0 to 255) or (0x00 to 0xff)
PACKET ANALYSIS
Value: 00 25 ff
Value: 49 ff 00
Value: ff 00 00
Value: 49 ff 00
Value: 00 25 ff
X
PACKET ANALYSIS
Value: 00 25 ff
Value: 49 ff 00
Value: ff 00 00
Value: 49 ff 00
Value: 00 25 ff
X
CMON IT’S JUST A BULB
@iAyanPahwa/iayanpahwa
DEMO
@iAyanPahwa
/iayanpahwa
https://iayanpahwa.github.io/Reverse-Engineering-IoT-Devices/

Reverse engineering IoT Devices