bleadv

package
v0.783.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 29, 2026 License: AGPL-3.0 Imports: 4 Imported by: 0

Documentation

Overview

Package bleadv decodes a Bluetooth advertising / scan-response payload — the GAP "AD structure" list (Bluetooth Core Specification, Vol 3 Part C §11, and the Core Specification Supplement / Assigned Numbers). The exact same length-type-value structure is the BR/EDR Extended Inquiry Response (EIR), so this also decodes EIR.

A BLE advertising payload is what every passive BLE scan surfaces first — the Flipper "BLE scan", an ESP32 Marauder / nRF sniffer, a phone's nRF Connect: before any connection or GATT traffic (bt_hci_decode → bt_l2cap_decode → bt_att_decode), the advertising data is the recon headline. It carries the device's advertised name, its discoverability/role flags, the service UUIDs it offers, its TX power and appearance, and — most usefully for fingerprinting — manufacturer-specific data: Apple iBeacon (proximity UUID + major/minor), Eddystone beacons (UID/URL/TLM), and the company identifier of the chipset / vendor behind an otherwise anonymous device. It is the advertising-layer complement to the project's Bluetooth-stack decode chain.

Wrap-vs-native judgement

Native. An advertising payload is a flat list of [length][AD type][data]
structures; each AD type has a fixed, documented layout (little-endian
UUIDs, a flags bitfield, signed TX power, a 2-byte company identifier, the
iBeacon / Eddystone sub-formats). A length-prefixed TLV walk plus small
lookup tables; stdlib only, no new go.mod dep.

Verifiable / no confidently-wrong output

The AD type numbers, the Flags bits, the service-UUID list layouts, the
company-identifier assignment, and the iBeacon / Eddystone sub-formats
follow the Bluetooth Assigned Numbers and the published iBeacon / Eddystone
specifications — deterministic and byte-checkable. Where a value space is
open-ended or undocumented (an unknown AD type, an unknown company id, a
manufacturer blob other than iBeacon such as Apple's proprietary Continuity
stream, service data for a UUID other than Eddystone's 0xFEAA), the bytes
are surfaced raw with a note rather than guessed.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Eddystone

type Eddystone struct {
	FrameType string `json:"frame_type"`

	// UID / URL frames carry a calibrated 0 m TX power.
	TxPower0mDBm *int `json:"tx_power_0m_dbm,omitempty"`

	// UID frame.
	NamespaceHex string `json:"namespace_hex,omitempty"`
	InstanceHex  string `json:"instance_hex,omitempty"`

	// URL frame.
	URL string `json:"url,omitempty"`

	// TLM (unencrypted, version 0x00) frame.
	BatteryMV     *int     `json:"battery_mv,omitempty"`
	TemperatureC  *float64 `json:"temperature_c,omitempty"`
	AdvCount      *uint32  `json:"adv_count,omitempty"`
	UptimeSeconds *float64 `json:"uptime_seconds,omitempty"`

	Raw string `json:"raw,omitempty"`
}

Eddystone is a decoded Eddystone frame (service data for UUID 0xFEAA).

type IBeacon

type IBeacon struct {
	UUID          string `json:"proximity_uuid"`
	Major         int    `json:"major"`
	Minor         int    `json:"minor"`
	MeasuredPower int    `json:"measured_power_dbm"`
}

IBeacon is the decoded Apple iBeacon manufacturer payload.

type Manufacturer

type Manufacturer struct {
	CompanyID   string `json:"company_id"`
	CompanyName string `json:"company_name"`
	DataHex     string `json:"data_hex,omitempty"`
}

Manufacturer is decoded AD type 0xFF (Manufacturer Specific Data).

type Result

type Result struct {
	Structures []Structure `json:"structures"`
	Notes      []string    `json:"notes,omitempty"`
}

Result is the decoded view of an advertising / scan-response (EIR) payload.

func Decode

func Decode(input string) (*Result, error)

Decode parses a BLE advertising / scan-response payload (or BR/EDR EIR) from hex (whitespace / ':' / '-' / '_' separators and a '0x' prefix tolerated).

type ServiceData

type ServiceData struct {
	UUID    string `json:"uuid"`
	DataHex string `json:"data_hex,omitempty"`
}

ServiceData is decoded AD type 0x16 / 0x20 / 0x21 (Service Data).

type Structure

type Structure struct {
	Length   int    `json:"length"`
	ADType   int    `json:"ad_type"`
	TypeName string `json:"ad_type_name"`

	Flags        []string `json:"flags,omitempty"`
	ServiceUUIDs []string `json:"service_uuids,omitempty"`
	LocalName    string   `json:"local_name,omitempty"`
	TxPowerDBm   *int     `json:"tx_power_dbm,omitempty"`
	Appearance   string   `json:"appearance,omitempty"`
	LERole       string   `json:"le_role,omitempty"`
	URI          string   `json:"uri,omitempty"`

	Manufacturer *Manufacturer `json:"manufacturer,omitempty"`
	ServiceData  *ServiceData  `json:"service_data,omitempty"`
	IBeacon      *IBeacon      `json:"ibeacon,omitempty"`
	Eddystone    *Eddystone    `json:"eddystone,omitempty"`

	Raw   string `json:"raw,omitempty"`
	Notes string `json:"notes,omitempty"`
}

Structure is one AD structure (one [length][type][data] record).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL