Hacking the Bluetooth Pairing Authentication Process
Content Overview
Linux Bluetooth Architecture
Protocol Stack
Pairing Authentication
Pairing Authentication
Adapt to Byte Sequence Pincode
Conclusion
Appendex

Pairing Authentication
3. Connection established
– adapter launches an SDP session to search for available peer devices once user opened the “device setup” interface provided via the GUI plugin (user module: plugins/hciops.c)

– available devices listed (devices previously paired do not show up again) and user selects one to connect. Now adapter initiates an agent for the selected peer

– SDP session stops once the plugin starts connecting to the picked device via the HCI interface, which connects to the peer by sending connection event to the kernel module that then connects to the device via socket (through the protocol stack with the driver code invoked) (user module: plugins/hciops.c –> src/device.c –> kernel module: net/bluetooth/hci_event. –> net/bluetooth/hci_core.c –> driver code…)