TaintDroid Bluetooth Framework

This project was part of my diploma thesis.

What does it do

This program connects to an Android phone and looks for specific entries in the logs, which are generated by TaintDroid. It is capable to list every generated UUID, and if the UUID resembles a BLE related UUID it recognizes it.

What UUIDs does this tool know?

The mapping module was written in mid 2019, so it is based on the Bluetooth 5.1 specification.

How do I use this tool?

Start it, and you'll see a terminal based menu. First an analysis should be started. During the analysis the phone must be connected to the device you are running this tool. Click around in the app, and try to initiate a BLE connection, as the goal of the first analysis is to leak BLE UUIDs.

As UUIDs are used for GUI and parcel related stuff as well you should repeat the analysis a few times (at least 2 more runs), and then the correlation can be started. It basically tries to find UUIDs, which were found in multiple runs, and thus they are with a (high probablility) BLE UUIDs.

With the Show analysis results the leaked UUIDs and traffic can be presented. If a UUID can be categorized, it will be.

With the leaked UUID with a special JSON-Format a modified version of the BlueZ BLE-Server the presence of a real device can be faked. This modified version of BlueZ is available here. Build it and use the tools/btgatt-server-mine. The binary has a help menu as well. The only important thing is, that the JSON-Parser in the BLE-Server is not really intelligent, so the JSON has to have the following structure:

{
  "services": [
    {
      "uuid": "<service uuid>",
      "characteristics": [
        {
          "uuid": "<characteristic1 uuid>",
          "descriptions": [
            {
              "uuid": "<description1 uuid>",
              "text": "<description1 text>"
            },
            ...
          ]
        },
        ...
      ]
    },
    ...
  ]
}

So the important thing ist, that the uuid has to preceed the arrays/text, otherwise the server is going to crash and burn.

How to get TaintDroid?

You have to use my modified version of TaintDroid, as the original one doesn't taint A) incoming data from the internet and B) outgoing Bluetooth data.

As a begininning you can use the steps written by the original devs of TaintDroid for the setup, however my version is written for the Android 4.4.4_r2, so everywhere you see in the guide 4.2, use 4.4.4_r2. Moreover you have to overrule some paths in the local_manifest files, to use my version of Taintdroid.

This is the list of stuff where there is code from me and is TaintDroid related:

• dalvik
• libcore
• frameworks/base
• frameworks/native
• frameworks/opt/telephony
• external/sh
• system/vold
• system/core

Not nececerally all of them has to be installed, but I can't remember which of them were important. I guess if they have a 4.4.4_r2 branch they are important otherwise not...

I tested it with a Nexus 5, and it more or less worked... Sometimes there were some hangs/crashes, but nothing a reflash/reboot couldn't fix ;)