💻 Research
How to Ubertooth BR/EDR Sniff
How to Ubertooth BR/EDR Sniff
Overview
I recently tried sniffing bluetooth packets via ubertooth.
As far as we know, ubertooth has provided sniffing capabilities for Bluetooth low energy (BLE), but in a recent update, firmware was developed to allow sniffing of Bluetooth packets for the Bluetooth Classic (BR/EDR) specification.
This is included in the release firmware (2020-12-R1), but it is not the default application, so you can build your own firmware and use the and flash it to your ubertooth device.
Build Firmware
Before building the firmware, download the official git repository and follow the steps below.
This step may require some essential packages to build the ubertooth firmware, which can be found in the documentation below.
https://ubertooth.readthedocs.io/en/latest/building_from_git.htmlubertooth.readthedocs.io
apt install gcc-arm-none-eabi libnewlib-arm-none-eabi
Flash Firmware
If the #Build Firmware step completed compilation for your firmware, you should have a btbr.dfu file in your current working location.
![[Figure 1] btbr.dfu (ubertooth/firmware/btbr/btbr.dfu)](https://prod-files-secure.s3.us-west-2.amazonaws.com/ddfb90e3-766a-4fa2-b58c-bd09d4b4e865/e3ac6bcb-1849-4b4d-822c-983393ee907a/btbr.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIAZI2LB4667AUBM7WU%2F20261110%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20261110T180038Z&X-Amz-Expires=3600&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEHoaCXVzLXdlc3QtMiJHMEUCIQDPXaj04e%2FEHLYSHiNZ2IIaDxC1qow2xU8ZHYZhqkWCnwIgdak9NuMIQzMNT2b1Zn%2FLJt755ytR70XrRs3PaSSQGHIq%2FwMIQxAAGgw2Mzc0MjMxODM4MDUiDM8t%2BsMYl2%2F9oUxHCircA5m5gjzftUifsDsYhs55vEKJK1TV4dZNiGQ9mtfbSuVqZMqyiPfm8dPAhCgPHschRRKl9eWF%2FwRDtCjyq%2Bea%2BWw%2FxhnGiv145uF7w%2Bdw0AfId9c3XX%2BYnP0ixBU2%2B5p1gWxwO570ziv6O%2FORBSmFJSQCml470fT4iRf%2BT5wBmQzAXtiUKHoHYOO64ed%2BKd2X%2FRpsJ8ixCwsmjN56TSMmZpv0cAqGXc4m1z%2BhfuHBYzOxEqMHVJ07dzv5%2BVAURl2LX2hwW3u7%2FLjRiE%2Fqlbza1OMLKOpm3a6rG9NH4xVsLVfYV%2BNsJkmjwdZhxgu%2F69a6teFy1fvfC8K1VRCA8bzumHWno8XIyu%2F928BJYctQkCqPEbPg8iGGIIPDCFoV0E0C5pptDuo41zhbluFD%2FclvTIpmtrJH%2Bn4ziNVuL%2BEvc9TIHZA1sJpMaScw8GCvMFO5C4vkHiF6nhOjLxcX8nUD%2BYPGxVPiO0Yxmuk6rEVpB0cxJUyVLvm%2BpbxvsyyAPcGnnWsv43jehQpoX8Wl3fTF51uCZZRx6lRWNihwdWVebvBgmR9POrhbHaUjcpPriBoQ5%2BZog9hFWVW1BNHWKONDJ3LiT59DKT0kNIHnxoim8qtBzu%2BB6UgOaPS9q2%2BBMJ60zdcGOqUBbbnJvn0IP0Gj2e428frCNlcJK3Vd2Xf7hZxr0S5R7tQ5OMAAu8WMPA7s%2BDUnPjyHuY3NKlMB4eOth4rBPclEae8IwNHcRfVFzyNyihQz%2BYrf%2BD7GF0b8sSYaZUu6%2BHb2SDs%2FwU9asGnv8Ff0EqiIcP6h7HBlGbe9ZZAQM5lbN8UzwiHBTMnOhu%2F7c4YiYk81i5VTTZ5CjGI4TFWWV%2Bn9GoYx2ILa&X-Amz-Signature=e579abee00568bdf223e85332f4ad3b229a4c6cbab9ecd032d32a4f27987d8b5&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)
Sniffing BR/EDR
If the firmware was flashed successfully, ubertooth-dfu will exit the detach log for the last time. Afterwards, the ubertooth device with the new firmware flashed will automatically connect.
Now that my ubertooth device is configured to sniff BR/EDR Bluetooth packets, I can run the tool with the following command.
ubertooth-btbr
![[Figure 2] ubertooth-btbr](https://prod-files-secure.s3.us-west-2.amazonaws.com/ddfb90e3-766a-4fa2-b58c-bd09d4b4e865/77a306d4-4398-4080-9a5b-2556ae7dc43d/ubertooth-btbr.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIAZI2LB4667AUBM7WU%2F20261110%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20261110T180038Z&X-Amz-Expires=3600&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEHoaCXVzLXdlc3QtMiJHMEUCIQDPXaj04e%2FEHLYSHiNZ2IIaDxC1qow2xU8ZHYZhqkWCnwIgdak9NuMIQzMNT2b1Zn%2FLJt755ytR70XrRs3PaSSQGHIq%2FwMIQxAAGgw2Mzc0MjMxODM4MDUiDM8t%2BsMYl2%2F9oUxHCircA5m5gjzftUifsDsYhs55vEKJK1TV4dZNiGQ9mtfbSuVqZMqyiPfm8dPAhCgPHschRRKl9eWF%2FwRDtCjyq%2Bea%2BWw%2FxhnGiv145uF7w%2Bdw0AfId9c3XX%2BYnP0ixBU2%2B5p1gWxwO570ziv6O%2FORBSmFJSQCml470fT4iRf%2BT5wBmQzAXtiUKHoHYOO64ed%2BKd2X%2FRpsJ8ixCwsmjN56TSMmZpv0cAqGXc4m1z%2BhfuHBYzOxEqMHVJ07dzv5%2BVAURl2LX2hwW3u7%2FLjRiE%2Fqlbza1OMLKOpm3a6rG9NH4xVsLVfYV%2BNsJkmjwdZhxgu%2F69a6teFy1fvfC8K1VRCA8bzumHWno8XIyu%2F928BJYctQkCqPEbPg8iGGIIPDCFoV0E0C5pptDuo41zhbluFD%2FclvTIpmtrJH%2Bn4ziNVuL%2BEvc9TIHZA1sJpMaScw8GCvMFO5C4vkHiF6nhOjLxcX8nUD%2BYPGxVPiO0Yxmuk6rEVpB0cxJUyVLvm%2BpbxvsyyAPcGnnWsv43jehQpoX8Wl3fTF51uCZZRx6lRWNihwdWVebvBgmR9POrhbHaUjcpPriBoQ5%2BZog9hFWVW1BNHWKONDJ3LiT59DKT0kNIHnxoim8qtBzu%2BB6UgOaPS9q2%2BBMJ60zdcGOqUBbbnJvn0IP0Gj2e428frCNlcJK3Vd2Xf7hZxr0S5R7tQ5OMAAu8WMPA7s%2BDUnPjyHuY3NKlMB4eOth4rBPclEae8IwNHcRfVFzyNyihQz%2BYrf%2BD7GF0b8sSYaZUu6%2BHb2SDs%2FwU9asGnv8Ff0EqiIcP6h7HBlGbe9ZZAQM5lbN8UzwiHBTMnOhu%2F7c4YiYk81i5VTTZ5CjGI4TFWWV%2Bn9GoYx2ILa&X-Amz-Signature=9ed3abff26321fed238d2ca7e453be7f17f3ce2513706be29e0067f79af049e2&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)