[0x09] Reversing Shorts :: iOS Bluetooth Debugging Driver Internals & Packet Logging
Channel: jiska
Date: 2022-10-30

Let's take a look into the iOS Bluetooth stack! Logging all packets with PacketLogger is easy, but how does it work internally? How do bluetoothd and the kernel interact with each other?

Full playlist of reversing shorts: https://www.youtube.com/playlist?list=PLkOopkYm0fCV45i_n8z5LSUL3QBXNAP2G

Apple's Bluetooth developer tools and information: https://developer.apple.com/bluetooth
libimobiledevice: https://github.com/libimobiledevice/libimobiledevice
Information about the CoreCapture framework: https://arxiv.org/pdf/1808.07353v1.pdf
Thesis on the iOS Bluetooth stack: https://github.com/seemoo-lab/toothpicker/blob/master/assets/toothpicker_thesis.pdf
Bluetooth Core Specification 5.3: https://www.bluetooth.com/specifications/specs/core-specification-5-3/

Chapters:
00:00 - Introduction
00:31 - Bluetooth PacketLogger on macOS and Linux
01:15 - Inside the Bluetooth configuration profile
03:20 - CoreCapture and IOKit
05:53 - AppleConverged Transport for PCIe Bluetooth
06:59 - BlueTool vs. bluetoothd
07:40 - Calling BlueTool
08:15 - Takeaways