{"id":13580171,"url":"https://github.com/fO-000/bluing","last_synced_at":"2025-04-06T00:30:52.110Z","repository":{"id":36607936,"uuid":"209273476","full_name":"fO-000/bluing","owner":"fO-000","description":"An intelligence gathering tool for hacking Bluetooth","archived":false,"fork":false,"pushed_at":"2023-04-23T09:44:31.000Z","size":6890,"stargazers_count":780,"open_issues_count":11,"forks_count":104,"subscribers_count":18,"default_branch":"master","last_synced_at":"2025-02-04T09:37:01.752Z","etag":null,"topics":["android","ble","bluetooth","bluetooth-classic","br-edr","hacking","hacking-tool","intelligent-gathering","iot","linux","python","scanner","security","spoofing"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fO-000.png","metadata":{"files":{"readme":"README-cn.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-09-18T09:46:13.000Z","updated_at":"2025-02-03T23:24:24.000Z","dependencies_parsed_at":"2023-01-17T03:04:27.151Z","dependency_job_id":"c922eb0d-357c-498c-ac6a-7ead64f43470","html_url":"https://github.com/fO-000/bluing","commit_stats":{"total_commits":76,"total_committers":4,"mean_commits":19.0,"dds":"0.17105263157894735","last_synced_commit":"68793ca20717697a5e83ef0343eb28a3c303d224"},"previous_names":["fo-000/bluescan"],"tags_count":49,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fO-000%2Fbluing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fO-000%2Fbluing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fO-000%2Fbluing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fO-000%2Fbluing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fO-000","download_url":"https://codeload.github.com/fO-000/bluing/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247299831,"owners_count":20916190,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","ble","bluetooth","bluetooth-classic","br-edr","hacking","hacking-tool","intelligent-gathering","iot","linux","python","scanner","security","spoofing"],"created_at":"2024-08-01T15:01:48.313Z","updated_at":"2025-04-06T00:30:48.947Z","avatar_url":"https://github.com/fO-000.png","language":"Python","readme":"\u003ch1 align=\"center\"\u003eBluing\u003c/h1\u003e\n\u003ch3 align=\"center\"\u003e为 hack 蓝牙而生的情报收集工具\u003c/h3\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://fo-000.github.io/bluing/\"\u003eEnglish\u003c/a\u003e · \u003ca href=\"https://fo-000.github.io/bluing/index-cn.html\"\u003e简体中文\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/python-3.10-blue\"\u003e\n    \u003ca href=\"https://pypi.org/project/bluing/\"\u003e\u003cimg src=\"https://img.shields.io/pypi/v/bluing?color=blue\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://pepy.tech/badge/bluing\"\u003e\u003cimg src=\"https://pepy.tech/badge/bluing\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://pepy.tech/badge/bluescan\"\u003e\u003cimg src=\"https://static.pepy.tech/personalized-badge/bluescan?period=total\u0026units=international_system\u0026left_color=grey\u0026right_color=blue\u0026left_text=predecessor%20downloads\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/Tested%20on-Ubuntu%2022.04%20(x64)%20%7C%20Kali%202022.4%20(x64)%20%7C%20Kali%20NetHunter%202022.4%20(aarch64)-brightgreen\"\u003e\n\u003c/p\u003e\n\nBluing（前身为 [bluescan](https://pypi.org/project/bluescan/)）是一个主要基于 Python 实现的蓝牙情报收集工具。它可以帮助我们窥探蓝牙这种复杂协议的内部结构或是 hack 蓝牙设备。其主要特性如下：\n\n![](https://raw.githubusercontent.com/fO-000/bluing/master/assets/bluing-features-mermaid-mindmap-cn.svg)\n\u003c!-- ![](./assets/bluing-features-mermaid-mindmap-cn.svg) --\u003e\n\n## 安装\n\nBluing 部分依赖 Linux 官方的 [BlueZ](http://www.bluez.org/) 蓝牙协议栈，因此它仅支持在 Linux 上运行。执行如下命令可安装依赖包：\n\n```sh\nsudo apt install python3-pip python3-dev libcairo2-dev libgirepository1.0-dev \\\n                 libbluetooth-dev libdbus-1-dev bluez-tools python3-cairo-dev \\\n                 rfkill meson patchelf bluez ubertooth adb python-is-python3\n```\n\n目前 bluing 的分发途径是 [PyPI](https://pypi.org/project/bluing/)，且仅支持 Python 3.10。安装命令如下：\n\n```sh\nsudo pip3.10 install bluing\n```\n\n## 使用\n\n\u003e * 神说：“要有**彩色**。”就有了[**彩色**](https://fo-000.github.io/bluing/index-cn.html#-使用)。\n\u003e * 可以先了解下[推荐的硬件](https://fo-000.github.io/bluing/index-cn.html#-硬件推荐)。\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nAn intelligence gathering tool for hacking Bluetooth\n\nUsage:\n    bluing [-h | --help]\n    bluing (-v | --version)\n    bluing [-i \u0026lthci\u003e] --clean BD_ADDR\n    bluing --flash-micro-bit\n    bluing \u0026ltcommand\u003e [\u0026ltargs\u003e...]\n\nArguments:\n    BD_ADDR    Bluetooth device address\n\nOptions:\n    -h, --help           Print this help and quit\n    -v, --version        Print version information and quit\n    -i \u0026lthci\u003e             HCI device\n    --clean              Clean cached data of a remote device\n    --flash-micro-bit    Download the dedicated firmware to micro:bit(s)\n\nCommands:\n    br         Basic Rate system, includes an optional Enhanced Data Rate (EDR) extension\n    le         Low Energy system\n    android    Android Bluetooth stack\n    spoof      Spoof with new local device information\n    plugin     Manage plugins\n\nRun `bluing \u0026ltcommand\u003e --help` for more information on a command.\n\u003c/pre\u003e\n\u003c/details\u003e\n\n### `br` 命令：Basic Rate system\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e br --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nUsage:\n    bluing br [-h | --help]\n    bluing br [-i \u0026lthci\u003e] [--inquiry-len=\u0026ltn\u003e] --inquiry\n    bluing br [-i \u0026lthci\u003e] --sdp BD_ADDR\n    bluing br [-i \u0026lthci\u003e] --local --sdp\n    bluing br [-i \u0026lthci\u003e] --lmp-features BD_ADDR\n    bluing br [-i \u0026lthci\u003e] --local --lmp-features\n    bluing br [-i \u0026lthci\u003e] --stack BD_ADDR\n    bluing br [-i \u0026lthci\u003e] --local --stack\n    bluing br [-i \u0026lthci\u003e] [--inquiry-scan] --mon-incoming-conn\n    bluing br --org=\u0026ltname\u003e --timeout=\u0026ltsec\u003e --sniff-and-guess-bd-addr\n\nArguments:\n    BD_ADDR    BR/EDR Bluetooth device address\n\nOptions:\n    -h, --help                   Print this help and quit\n    -i \u0026lthci\u003e                     HCI device\n    --local                      Target a local BR/EDR device instead of a remote one\n    --inquiry                    Discover other nearby BR/EDR controllers\n    --inquiry-len=\u0026ltn\u003e            Maximum amount of time (added to --ext-inquiry-len=\u0026ltn\u003e) \n                                 specified before the Inquiry is halted.\n                                     Time = n * 1.28 s\n                                     Time range: 1.28 to 61.44 s\n                                     Range of n: 0x01 to 0x30 [default: 8]\n    --ext-inquiry-len=\u0026ltn\u003e        Extended_Inquiry_Length measured in number of \n                                 Baseband slots.\n                                     Interval Length = n * 0.625 ms (1 Baseband slot)\n                                     Time Range: 0 to 40.9 s\n                                     Range of n: 0x0000 to 0xFFFF [default: 0]\n    --sdp                        Retrieve information from the SDP database of a \n                                 remote BR/EDR device\n    --lmp-features               Read LMP features of a remote BR/EDR device\n    --stack                      Determine the Bluetooth stack type of a remote BR/EDR device\n    --mon-incoming-conn          Print incoming connection from other nearby BR/EDR devices\n    --inquiry-scan               Enable the Inquiry Scan\n    --sniff-and-guess-bd-addr    Sniff SAPs of BD_ADDRs over the air, then guess the \n                                 address based on the organization name. Need at \n                                 least one Ubertooth device\n    --org=\u0026ltname\u003e                 An organization name in the OUI.txt\n    --timeout=\u0026ltsec\u003e              Timeout in second(s)\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--inquiry`：发现附近其他的 BR/EDR 控制器\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e br --inquiry\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Discovering other nearby BR/EDR Controllers on \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ehci0\u003c/span\u003e for \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e10.24\u003c/span\u003e sec\n\nBD_ADDR: \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eB0:C9:52:45:33:13\u003c/span\u003e (\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eGUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD\u003c/span\u003e)\nPage scan repetition mode: 1 (R1)\nReserved: 0x02\nCoD: 0x5a020c\n    Service Class: 0b1011010000\n        Telephony\n        Object Transfer\n        Capturing\n        Networking\n    Major Device Class: 0b00010, \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePhone\u003c/span\u003e\nClock offset: 0x50D5\nRSSI: -61\nExtended inquiry response: \n    Complete Local Name: \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eold man phone\u003c/span\u003e\n    Complete List of 16-bit Service Class UUIDs\n        0x1105 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eOBEXObjectPush\u003c/span\u003e\n        0x110a \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eAudioSource\u003c/span\u003e\n        0x110c \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eA/V_RemoteControlTarget\u003c/span\u003e\n        0x110e \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eA/V_RemoteControl\u003c/span\u003e\n        0x1112 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eHeadset - Audio Gateway (AG)\u003c/span\u003e\n        0x1115 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePANU\u003c/span\u003e\n        0x1116 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eNAP\u003c/span\u003e\n        0x111f \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eHandsfreeAudioGateway\u003c/span\u003e\n        0x112d \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eSIM_Access\u003c/span\u003e\n        0x112f \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePhonebook Access - PSE\u003c/span\u003e\n        0x1200 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePnPInformation\u003c/span\u003e\n        0x1132 \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eMessage Access Server\u003c/span\u003e\n    Complete List of 32-bit Service Class UUIDs\n        \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eNone\u003c/span\u003e\n    Complete List of 128-bit Service Class UUIDs\n        \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eA49EAA15-CB06-495C-9F4F-BB80A90CDF00\u003c/span\u003e\n        \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e00000000-0000-0000-0000-000000000000\u003c/span\u003e\n... ...\n\n\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Requesting the names of all discovered devices...\nB0:C9:52:45:33:13 : \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eold man phone\u003c/span\u003e\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--sdp`：检索远端 BD/EDR 设备的 SDP 数据库信息\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e br --sdp 34:13:46:23:6A:4D\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nScanning \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠋\u003c/span\u003e\nNumber of service records: 18 \n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eService Record\u003c/span\u003e\n0x0000: ServiceRecordHandle (uint32)\n\t0x0001000d\n0x0001: ServiceClassIDList (sequence)\n\t0x1105: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eOBEXObjectPush\u003c/span\u003e\n0x0004: ProtocolDescriptorList (sequence)\n\t0x0100: L2CAP\n\t0x0003: RFCOMM\n\t\tchannel: 0x0c\n\t0x0008: OBEX\n0x0005: BrowseGroupList (sequence)\n\t0x1002: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ePublicBrowseRoot\u003c/span\u003e\n0x0009: BluetoothProfileDescriptorList (sequence)\n\t0x1105: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eOBEXObjectPush\u003c/span\u003e \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ev1.2\u003c/span\u003e\n0x0100: ServiceName (guess) (text)\n\tOBEX Object Push \n0x0200: GoepL2CapPsm (guess) (uint16)\n\u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e\t0x1023\u003c/span\u003e\n0x0303: SupportedFormatsList (guess) (sequence)\n\t0x01: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003evCard 2.1\u003c/span\u003e\n\t0x02: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003evCard 3.0\u003c/span\u003e\n\t0x03: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003evCal 1.0\u003c/span\u003e\n\t0x04: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eiCal 2.0\u003c/span\u003e\n\t0xff: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eAny type of object\u003c/span\u003e\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--lmp-features`：读取远端 BR/EDR 设备的 LMP 特性\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e br --lmp-features 6A:8D:99:33:56:AE\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eVersion\u003c/span\u003e\n    Version:\n        Bluetooth Core Specification 5.2 (LMP)\n        Bluetooth Core Specification 5.2 (LL)\n    Manufacturer name: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eHiSilicon Technologies CO., LIMITED\u003c/span\u003e\n    Subversion: 33561 \n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eLMP features\u003c/span\u003e\n    3 slot packets: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    5 slot packets: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Encryption: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Slot offset: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Timing accuracy: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Role switch: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Hold mode: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Sniff mode: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Previously used: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Power control requests: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Channel quality driven data rate (CQDDR): \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    ... ...\n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eExtended LMP features\u003c/span\u003e\nPage 1\n    Secure Simple Pairing (Host Support): \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    LE Supported (Host): \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Simultaneous LE and BR/EDR to Same Device Capable (Host): \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Secure Connections (Host Support): \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\nPage 2\n    Connectionless Slave Broadcast - Master Operation: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Connectionless Slave Broadcast - Slave Operation: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Synchronization Train: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Synchronization Scan: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    HCI_Inquiry_Response_Notification event:  \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    ... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--mon-incoming-conn`：打印附近其他 BR/EDR 设备进来的连接\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e br --inquiry-scan --mon-incoming-conn\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Inquiry_Scan_Interval: 4096, 2560.0 ms\n       Inquiry_Scan_Window:   4096, 2560.0 ms\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Inquiry Scan and Page Scan enabled\n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eA0:DE:0F:99:EF:78\u003c/span\u003e incoming\n    CoD: 0x5a020c\n        Service Class: 0b1011010000\n            Telephony\n            Object Transfer\n            Capturing\n            Networking\n        Major Device Class: 0b00010, \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePhone\u003c/span\u003e\n    link type: 0x01 - ACL\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--sniff-and-guess-bd-addr`：嗅探并推测附近的 BD_ADDR\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e br --org=\u003cspan style=\"font-weight: bold; color: #eac179\"\u003e'Huawei Device Co., Ltd.'\u003c/span\u003e --timeout=600 --sniff-and-guess-bd-addr\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Possible BD_ADDR(s) for ??:??:99:4C:45:C3\n       24:A7:99:4C:45:C3\n\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Possible BD_ADDR(s) for ??:??:E4:2D:69:EE\n       BC:1A:E4:2D:69:EE\n       D0:05:E4:2D:69:EE\n       30:AA:E4:2D:69:EE\n\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Possible BD_ADDR(s) for ??:??:15:60:81:7F\n       64:23:15:60:81:7F\n       D4:74:15:60:81:7F\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n### `le` 命令：Low Energy system\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e le --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nUsage:\n    bluing le [-h | --help]\n    bluing le [-i \u0026lthci\u003e] [--scan-type=\u0026lttype\u003e] [--timeout=\u0026ltsec\u003e] [--sort=\u0026ltkey\u003e] --scan\n    bluing le [-i \u0026lthci\u003e] --pairing-feature [--timeout=\u0026ltsec\u003e] [--addr-type=\u0026lttype\u003e] PEER_ADDR\n    bluing le [-i \u0026lthci\u003e] --ll-feature-set [--timeout=\u0026ltsec\u003e] [--addr-type=\u0026lttype\u003e] PEER_ADDR\n    bluing le [-i \u0026lthci\u003e] --gatt [--io-cap=\u0026ltname\u003e] [--addr-type=\u0026lttype\u003e] PEER_ADDR\n    bluing le [-i \u0026lthci\u003e] --local --gatt\n    bluing le [-i \u0026lthci\u003e] --mon-incoming-conn\n    bluing le [--channel=\u0026ltnum\u003e] --sniff-adv\n\nArguments:\n    PEER_ADDR    LE Bluetooth device address\n\nOptions:\n    -h, --help            Print this help and quit\n    -i \u0026lthci\u003e              HCI device\n    --scan                Discover advertising devices nearby\n    --scan-type=\u0026lttype\u003e    The type of scan to perform. active or passive [default: active]\n    --sort=\u0026ltkey\u003e          Sort the discovered devices by key, only support RSSI \n                          now [default: rssi]\n    --ll-feature-set      Read LL FeatureSet of a remote LE device\n    --pairing-feature     Request the pairing feature of a remote LE device\n    --timeout=\u0026ltsec\u003e       Duration of the LE scanning, but may not be precise [default: 10]\n    --gatt                Discover GATT Profile hierarchy of a remote LE device\n    --io-cap=\u0026ltname\u003e       Set IO capability of the agent. Available value: \n                              DisplayOnly, DisplayYesNo, KeyboardOnly, NoInputNoOutput, \n                              KeyboardDisplay (KeyboardOnly) [default: NoInputNoOutput]\n    --addr-type=\u0026lttype\u003e    Type of the LE address, public or random\n    --sniff-adv           Sniff advertising physical channel PDU. Need at least \n                          one micro:bit\n    --channel=\u0026ltnum\u003e       LE advertising physical channel, 37, 38 or 39 [default: 37,38,39]\n    --device=\u0026lt/dev/tty\u003e   Device to use, comma separated (e.g., /dev/ttyUSB0,/dev/ttyUSB1,/dev/ttyUSB2)\n                          Only needed if using NRF51 devices other than micro:bit (e.g., Bluefruit)\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--scan`：发现附近正在 advertising 的设备\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e le --scan\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eWARNING\u003c/span\u003e] You might want to spoof your LE address before doing an active scan\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] LE \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eactive\u003c/span\u003e scanning on \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ehci0\u003c/span\u003e for \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e10\u003c/span\u003e sec\nScanning \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠴\u003c/span\u003e\n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e----------------LE Devices Scan Result----------------\u003c/span\u003e\nAddr:        \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e74:A3:4A:D4:78:55\u003c/span\u003e (\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eZIMI CORPORATION\u003c/span\u003e)\nAddr type:   \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003epublic\u003c/span\u003e\nConnectable: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\nRSSI:        -68 dBm\nGeneral Access Profile:\n    Flags: \n        LE General Discoverable Mode\n        BR/EDR Not Supported\n    Service Data - 16-bit UUID: \n        UUID: 0x95FE\n        Data: 9055990701b743e34aa3740e00\n    Appearance: 0000\n    Tx Power Level: 0 dBm (pathloss 68 dBm)\n    Complete Local Name: Mesh Mi Switch\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--ll-feature-set`：读取远端 LE 设备的 LL FeatureSet\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e le --ll-feature-set --addr-type=public 18:D9:8F:77:24:F1\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Reading LL FeatureSet of \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e18:D9:8F:77:24:F1\u003c/span\u003e on \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ehci0\u003c/span\u003e\nReading \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠼\u003c/span\u003e\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eLE LL Features:\u003c/span\u003e\n    LE Encryption: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    Connection Parameters Request Procedure: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Extended Reject Indication: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Slave-initiated Features Exchange: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    LE Ping: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    LE Data Packet Length Extension: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n    LL Privacy: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Extended Scanner Filter Policies: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    LE 2M PHY: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Stable Modulation Index - Transmitter: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    Stable Modulation Index - Receiver: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n    ... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--pairing-feature`：请求远端 LE 设备的 pairing feature\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e le --pairing-feature --addr-type=public 18:D9:8F:77:24:F1\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Requesting pairing feature of \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e18:D9:8F:77:24:F1\u003c/span\u003e on \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ehci0\u003c/span\u003e\nRequesting \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠧\u003c/span\u003e\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003ePairing Response\u003c/span\u003e\n    IO Capability: 0x03 - \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eNoInputNoOutput\u003c/span\u003e\n    OOB data flag: 0x00 - Not Present\n    AuthReq: 0x01\n    Maximum Encryption Key Size: 16\nInitiator Key Distribution: 0x00\n        EncKey:  \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        IdKey:   \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        SignKey: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        LinkKey: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        RFU:     0b0000\nResponder Key Distribution: 0x01\n        EncKey:  \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eTrue\u003c/span\u003e\n        IdKey:   \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        SignKey: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        LinkKey: \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eFalse\u003c/span\u003e\n        RFU:     0b0000\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--gatt`：发现远端 LE 设备 GATT Profile 的层次结构\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e le --gatt --addr-type=public 18:D9:8F:77:24:F1\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nConnecting \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠋\u003c/span\u003e\nDiscovering all primary services \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠏\u003c/span\u003e\nDiscovering all characteristics of service 0x0001 \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠹\u003c/span\u003e\n... ...\nDiscovering all descriptors of characteristic 0x0002 \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠼\u003c/span\u003e\n... ...\nReading value of the descriptor 0x0013 \u003cspan style=\"font-weight: bold\"\u003e\u003c/span\u003e\u003cspan style=\"font-weight: bold; color: #00aaaa\"\u003e⠴\u003c/span\u003e\n... ... \n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003e----------------GATT Scan Result----------------\u003c/span\u003e\nNumber of services: 6\n\n\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eService\u003c/span\u003e (0x0100 - 0x0112, 7 characteristics)\n    \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eDeclaration\u003c/span\u003e\n        Handle: 0x0100\n        Type:   2800 (Primary Service declaration)\n        Value:  \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e1812\u003c/span\u003e (\u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eHuman Interface Device\u003c/span\u003e)\n        Permissions: Read (no authen/author)\n\n    \u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eCharacteristic\u003c/span\u003e (2 descriptors)\n        \u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eDeclaration\u003c/span\u003e\n            Handle: 0x010d\n            Type:   2803 (Characteristic declaration)\n            Value:\n                Properties: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eRead, Write Without Response, Write, Notify\u003c/span\u003e\n                Handle:     \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e0x010e\u003c/span\u003e\n                UUID:       \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e2A4D\u003c/span\u003e (\u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eReport\u003c/span\u003e)\n            Permissions: Read (no authen/author)\n\n        \u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eValue\u003c/span\u003e\n            Handle: 0x0302\n            Type:   4A02 (Unknown)\n            Value:  \u003cspan style=\"font-weight: bold; color: #c35956\"\u003eRead Not Permitted\u003c/span\u003e\n            Permissions: Higher layer specific\n\n        \u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eDescriptor\u003c/span\u003e\n            Handle: \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e0x010f\u003c/span\u003e\n            Type:   \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003e2902\u003c/span\u003e (\u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eClient Characteristic    Configuration declaration\u003c/span\u003e)\n            Value:  \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003eb'\\x00\\x00'\u003c/span\u003e\n            Permissions: Read (no authen/author), Write (higher layer specifies authen/author)\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--sniff-adv`：嗅探 advertising physical channel PDU\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo bluing\u003c/span\u003e le --sniff-adv\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Using micro:bit /dev/ttyACM2 on channel 37\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Using micro:bit /dev/ttyACM1 on channel 38\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] Using micro:bit /dev/ttyACM0 on channel 39\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] micro:bit 38 \u003c Ready -\u003e Start\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] micro:bit 37 \u003c Ready -\u003e Start\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] micro:bit 39 \u003c Ready -\u003e Start\n[38] [\u003cspan style=\"font-weight: bold; color: #c35956\"\u003eADV_NONCONN_IND\u003c/span\u003e]\nrandom AdvA: 28:7A:88:B2:35:0B\n[39] [\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eADV_IND\u003c/span\u003e]\npublic AdvA: A4:E4:72:B1:CB:8D\n[37] [\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eSCAN_REQ\u003c/span\u003e]\nrandom ScanA: 6A:90:0C:07:3E:14\nrandom AdvA: 7D:9B:A8:5A:F2:81\n... ...\n\u003c/pre\u003e\n\u003c/details\u003e\n\n### `android` 命令: Android 蓝牙协议栈\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e android --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nUsage:\n    bluing android [-h | --help]\n    bluing android [-t \u0026ltid\u003e] --collect-btsnoop-log [-o \u0026ltfile\u003e]\n\nOptions:\n    -h, --help               Display this help and quit\n    -t \u0026ltid\u003e                  Use android device with given transport id. This option \n                             will be ignored when only one device is available\n    --collect-btsnoop-log    Collect the btsnoop log being generated to a local file, \n                             default ./btsnoop_hci.log\n    -o \u0026ltfile\u003e                Place the output into \u003cfile\u003e [default: ./btsnoop_hci.log]\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--collect-btsnoop-log`: 收集正在产生的 btsnoop log\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e android -t 3 --collect-btsnoop-log -o btsnoop_hci.log; \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003efile\u003c/span\u003e btsnoop_hci.log\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nbtsnoop_hci.log: BTSnoop version 1, HCI UART (H4)\n\u003c/pre\u003e\n\u003c/details\u003e\n\n### `spoof` 命令：使用新的设备信息做欺骗\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e spoof --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nUsage:\n    bluing spoof [-h | --help]\n    bluing spoof [-i \u0026lthci\u003e] --bd-addr=\u0026ltBD_ADDR\u003e\n    bluing spoof [-i \u0026lthci\u003e] --cls-of-dev=\u0026ltnum\u003e\n    bluing spoof --host-name=\u0026ltname\u003e\n    bluing spoof [-i \u0026lthci\u003e] --alias=\u0026ltalias\u003e\n\nOptions:\n    -h, --help             Print this help and quit\n    -i \u0026lthci\u003e               HCI device\n    --bd-addr=\u0026ltBD_ADDR\u003e    Spoof with a new BD_ADDR\n    --cls-of-dev=\u0026ltnum\u003e     Spoof with a new Class of Device\n    --host-name=\u0026ltname\u003e     Spoof with a new host name\n    --alias=\u0026ltalias\u003e        Spoof with a new alias\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--bd-addr=\u003cBD_ADDR\u003e`：使用新的设备地址做欺骗\n\n该功能当前基于 `spooftooph` 完成。如果在 Kali Linux 上使用它，先执行 `sudo apt install spooftooph` 即可完成安装。但在 Ubuntu 上使用时，则需要手动编译安装 [`spooftooph`](https://gitlab.com/kalilinux/packages/spooftooph)。\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ sudo \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e spoof --bd-addr=AA:BB:CC:DD:EE:FF\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n[\u003cspan style=\"font-weight: bold; color: #ecc179\"\u003eWARNING\u003c/span\u003e] The original HCI device number may have been changed\n[\u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eINFO\u003c/span\u003e] BD_ADDR changed: 11:22:33:44:55:66 -\u0026gt; \u003cspan style=\"font-weight: bold; color: #7da9c7\"\u003eAA:BB:CC:DD:EE:FF\u003c/span\u003e\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--cls-of-dev=\u003cnum\u003e`：使用新的设备类型做欺骗\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ sudo \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e spoof --cls-of-dev=0x6c0100\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nNo output when successful\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--host-name=\u003cname\u003e`：使用新的主机名做欺骗\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ sudo \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e spoof --host-name=Bluing\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nNo output when successful\n\u003c/pre\u003e\n\u003c/details\u003e\n\n#### `--alias=\u003calias\u003e`：使用新的控制器别名做欺骗\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ sudo \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e spoof --alias='Bluing Alias'\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\nNo output when successful\n\u003c/pre\u003e\n\u003c/details\u003e\n\n### `plugin` 命令：插件管理\n\n\u003cdetails\u003e\u003csummary\u003e\u003ccode\u003e$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e plugin --help\u003c/code\u003e\u003c/summary\u003e\n\n\u003cpre\u003e\n$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e plugin --help\n\nUsage:\n    bluing plugin [-h | --help]\n    bluing plugin \u0026ltcommand\u003e [\u0026ltargs\u003e...]\n\nOptions:\n    -h, --help    Display this help and quit\n\nCommands:\n    list         List installed plugins\n    install      Install a plugin\n    uninstall    Uninstall a plugin\n    run          Run a plugin\n\u003c/pre\u003e\n\u003c/details\u003e\n\n## 硬件推荐\n\n### 蓝牙适配器\n\n很多 bluing 功能都需要访问蓝牙适配器。虽然可以使用 Linux 物理机自带的适配器或让 Linux 虚拟机**独占**宿主机的适配器，但是为了更稳定地运行 bluing，仍建议使用外接的 USB 蓝牙适配器，比如 [Parani UD100-G03](http://www.senanetworks.com/ud100-g03.html)。\n\n### Original micro:bit（可选）\n\nBluing 在嗅探 advertising physical channel PDU 时 ([`le --sniff-adv`](https://fo-000.github.io/bluing/index-cn.html#--sniff-adv%E5%97%85%E6%8E%A2-advertising-physical-channel-pdu))，至少需要 1 块 [original micro:bit](https://microbit.org/get-started/user-guide/overview/#original-micro:bit)，且推荐同时使用 3 块。这些 micro:bit 需要运行 bluing 提供的专用固件。将 micro:bit 接入 Linux 后，执行如下命令便可刷写预先构建好的固件：\n\n\u003cpre\u003e\n\u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ebluing\u003c/span\u003e --flash-micro-bit\n\u003c/pre\u003e\n\n除了 original micro:bit，使用 nRF51822 的其他板子也可以被支持，比如 Adafruit Bluefruit LE Friend 和 BLE400 with Core51822，但可能需要修改串口引脚的对应关系。\n\n### Ubertooth One（可选）\n\n当嗅探并推测附近的 BD_ADDR 时 ([`br --sniff-and-guess-bd-addr`](https://fo-000.github.io/bluing/index-cn.html#--sniff-and-guess-bd-addr%E5%97%85%E6%8E%A2%E5%B9%B6%E6%8E%A8%E6%B5%8B%E9%99%84%E8%BF%91%E7%9A%84-bd_addr))，bluing 需要用到一块 [Ubertooth One](https://greatscottgadgets.com/ubertoothone/)。\n\n## FAQ\n\n### `rfkill` 无法找到 hci0\n\n异常消息如下：\n\n```txt\nException: Can't find the ID of hci0 in rfkill\n```\n\n该异常可能因为老版本的 rfkill 不支持 `-r` 和 `-n` 选项而导致，比如：\n  \n\u003cpre\u003e\n$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ecat\u003c/span\u003e /etc/os-release | \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ehead\u003c/span\u003e -n 2\nNAME=\"Ubuntu\"\nVERSION=\"16.10 (Yakkety Yak)\"\n\n$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003erfkill\u003c/span\u003e --version\nrfkill 0.5-1ubuntu3 (Ubuntu)\n\u003c/pre\u003e\n\n此时升级 rfkill 到较新的版本可以解决该问题，比如：\n  \n\u003cpre\u003e\n$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ecat\u003c/span\u003e /etc/os-release | \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003ehead\u003c/span\u003e -n 2\nPRETTY_NAME=\"Kali GNU/Linux Rolling\"\nNAME=\"Kali GNU/Linux\"\n\n$ \u003cspan style=\"font-weight: bold; color: #9fab76\"\u003erfkill\u003c/span\u003e --version\nrfkill from util-linux 2.38.1\n\u003c/pre\u003e\n\n### 管理命令 `scanend` 执行失败了\n\n错误消息如下：\n\n```txt\nERROR: Failed to execute management command 'scanend' (code: 11, error: Rejected)\n```\n\n可通过重启 Bluetooth 服务尝试解决该问题。命令如下：\n\n\u003cpre\u003e\n\u003cspan style=\"font-weight: bold; color: #9fab76\"\u003esudo systemctl\u003c/span\u003e restart bluetooth.service\n\u003c/pre\u003e\n","funding_links":[],"categories":["Python","Wireless Protocols"],"sub_categories":["Bluetooth / BLE"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FfO-000%2Fbluing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FfO-000%2Fbluing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FfO-000%2Fbluing/lists"}