BTLE is an open-source Software Defined Radio tool for sniffing and transmitting Bluetooth Low Energy packets, supporting both standard and raw bit protocols.
Bluetooth Low Energy (BLE) packet sniffer and transmitter for both standard and non standard (raw bit) based on Software Defined Radio (SDR).
This tool is primarily used by security researchers, developers, and engineers to monitor, analyze, and test Bluetooth Low Energy communications, including non-standard protocols. It enables detailed BLE packet sniffing with channel hopping tracking and flexible packet transmission for testing and development purposes.
Users should carefully tune RX and LNA gain settings to avoid distortion and ensure optimal performance. Modifying HackRF driver source code can improve operation speed but requires recompilation of both the HackRF library and BTLE. The tool requires compatible SDR hardware (HackRF or bladeRF) and proper driver installation before use.
Ensure SDR hardware drivers and libraries (HackRF or bladeRF) are installed and configured
Clone the repository: git clone https://github.com/JiaoXianjun/BTLE.git
Navigate to host directory: cd BTLE/host
Create build directory: mkdir build
Enter build directory: cd build
Run cmake for HackRF (default): cmake ../
Or run cmake for bladeRF: cmake ../ -DUSE_BLADERF=1
Compile the project: make
Run the sniffer: ./btle-tools/src/btle_rx
Optionally, modify hackrf/host/libhackrf/src/hackrf.c for faster operation and recompile HackRF library./btle-tools/src/btle_rx
Start BLE packet sniffing on default advertising channel 37
./btle-tools/src/btle_tx 37-DISCOVERY-TxAdd-1-RxAdd-0-AdvA-010203040506-LOCAL_NAME09-SDR/Bluetooth/Low/Energy r500
Transmit BLE discovery packets on advertising channel with specified device name
-h or --help
Print all arguments and usage information
-c or --chan <0~39>
Specify BLE channel number to sniff or transmit on (default 37)
-g or --gain <0-62 for HackRF, 0-66 for bladeRF>
Set receiver gain in dB for optimal signal reception
-l or --lnaGain <0-40> (HackRF only)
Set Low Noise Amplifier gain in dB
-b or --amp
Enable amplifier on HackRF (default off)
-a or --access <access address>
Set access address for data channel sniffing (default 8e89bed6 for ADV channels)
-k or --crcinit <crc init>
Set CRC initialization value for data channel sniffing (default 555555 for ADV channels)
-v or --verbose
Enable verbose mode for detailed error and status output
-r or --raw
Print raw 42 bytes after access address detection without parsing
-f or --freq_hz <frequency in Hz>
Override channel setting by specifying exact frequency