Develop Your Own Bluetooth Low Energy Applications

Chapter 1: Introduction

1.1 What is Bluetooth Low Energy?

1.2 Layered architecture

1.3 How to communicate with BLE devices

1.3.1 Without a connection

1.3.2 With a connection

1.4 Advantages of BLE

1.4.1 Low power consumption

1.4.2 Ubiquitous

1.4.3 Low cost

1.5 Disadvantages of BLE

1.5.1 Short range

1.5.2 Limited speed

1.5.3 You need a gateway

1.6 Platforms used in this book

1.6.1 Python/Bleak (Raspberry Pi, PC)

1.6.2 C++/NimBLE-Arduino (ESP32)

1.6.3 C/Zephyr (nRF52)

1.7 How to use this book

1.8 Summary and further exploration

Chapter 2: Preparing Your Development Environment

2.1 Python and Bleak on your PC or Raspberry Pi

2.2 The Arduino platform with NimBLE-Arduino for the ESP32

2.2.1 Install Arduino CLI

2.2.2 Install the ESP32 Arduino core

2.2.3 Detect your ESP32 board

2.2.4 Install the NimBLE-Arduino library

2.3 The Zephyr development environment for nRF5 devices

2.3.1 Build a Zephyr application

2.3.2 Flash a Zephyr application

2.4 The nRF Connect for Desktop application

2.5 The nRF Connect mobile app

2.6 The Bluetooth Low Energy app in nRF Connect for Desktop

2.7 Wireshark and a BLE sniffer dongle

2.7.1 Downloading Wireshark and the nRF Sniffer for Bluetooth LE

2.7.2 Installing the nRF Sniffer for Bluetooth LE firmware

2.7.3 Installing the nRF Sniffer capture tool

2.7.4 Installing the BLE profile

2.7.5 Testing a BLE packet capture

2.8 Summary and further exploration

Chapter 3: Broadcasting Data with Advertisements

3.1 Device roles

3.2 Advertising packets

3.2.1 Advertising channels

3.2.2 Advertising packet structure

3.3 Discovering advertisements with Bleak

3.3.1 Scanning for devices

3.3.2 Detection callbacks

3.3.3 Active and passive scanning

3.4 Public and random Bluetooth addresses

3.5 The iBeacon specification

3.6 Decoding iBeacon advertisements using Bleak

3.7 Discovering advertisements with NimBLE-Arduino

3.8 Decoding manufacturer-specific data using NimBLE-Arduino

3.8.1 Decoding iBeacon advertisements

3.8.2 Decoding Microsoft advertising beacons

3.9 Broadcasting iBeacon advertisements with Zephyr

3.9.1 Advertising data structures in Zephyr

3.9.2 Enabling Bluetooth

3.9.3 Advertising

3.9.4 Building and flashing the code

3.9.5 Investigating the advertised packets

3.10 Broadcasting sensor data as manufacturer-specific data with Zephyr

3.10.1 Hardware

3.10.2 Project structure

3.10.3 Source code

3.10.4 Decoding the BME280 sensor data

3.11 Advertise scan response data with Zephyr

3.12 Summary and further exploration

Chapter 4: Connections and Services

4.1 Device roles

4.2 Attributes

4.3 Services, characteristics, and descriptors

4.3.1 Services

4.3.2 Characteristics

4.3.3 Descriptors

4.4 Discovering services and characteristics with nRF Connect

4.5 A minimal GATT server

4.6 Discovering services and characteristics with Bleak

4.7 Reading and writing characteristics using Bleak

4.7.1 Reading characteristics

4.7.2 Reading characteristics by their handle

4.7.3 Writing characteristics

4.8 Notifications and indications

4.8.1 Read heart rate notifications

4.8.2 Read notifications from multiple devices

4.9 Creating a heart rate monitor with NimBLE-Arduino

4.10 Creating a GATT server with Zephyr

4.10.1 Exposing the Device Information service

4.10.2 Creating a BLE sensor with Zephyr

4.10.3 Reading the sensor characteristic

4.10.4 Sniffing packets in an unencrypted BLE connection

4.11 Receiving service data without a connection

4.11.1 Scanning for service data

4.11.2 Receiving Exposure Notification advertisements

4.12 Summary and further exploration

Chapter 5: Securing BLE Connections

5.1 BLE security architecture

5.2 Pairing and bonding

5.2.1 Phase 1: Exchange of pairing information

5.2.2 Phase 2: Pairing

5.2.2.1 LE Legacy Connection pairing

5.2.2.2 LE Secure Connection pairing

5.2.3 Phase 3: Bonding

5.3 Security modes and levels

5.4 Encrypting the BLE connection to a Zephyr sensor

5.4.1 Implementing Security Mode 1 Level 2

5.4.2 Securely connecting to your sensor board

5.4.3 Sniffing the pairing procedure with Wireshark

5.5 Authenticating a BLE connection

5.5.1 Implementing Secure Connections Only Mode

5.5.2 Securely connecting with the board

5.5.3 Sniffing the pairing procedure with Wireshark

5.6 Privacy

5.7 Summary and further exploration

Chapter 6: Profiles and Roles

6.1 Common BLE profiles

6.1.1 Generic profiles

6.1.2 GATT profiles

6.2 Understanding a profile specification

6.2.1 Introduction

6.2.2 Configuration

6.2.3 Proximity Reporter Requirements

6.2.4 Proximity Monitor Requirements

6.2.5 Connection Establishment

6.2.6 Security Considerations

6.2.7 GATT Interoperability Requirements

6.2.8 Acronyms and Abbreviations

6.2.9 References

6.3 Understanding a service specification

6.3.1 Introduction

6.3.2 Service Declaration

6.3.3 Service Characteristics

6.3.4 Service Behaviors

6.3.5 Acronyms and Abbreviations

6.3.6 References

6.4 Understanding the definition of a characteristic

6.4.1 Description

6.4.2 Definition

6.5 Implementing a Proximity Reporter in Zephyr

6.6 Implementing a Proximity Monitor in NimBLE-Arduino

6.7 Summary and further exploration

Chapter 7: Reverse Engineering BLE Devices

7.1 Investigating the LED badge

7.2 Decompiling the mobile app

7.3 Sniffing BLE traffic between the LED badge and the mobile app

7.4 Writing arbitrary images to the LED badge using Bleak

7.4.1 Finding LED badges

7.4.2 Writing images to the LED badge

7.5 Summary and further exploration

Chapter 8: Lowering Power Consumption

8.1 Measuring power consumption with the Nordic Semiconductor Power Profiler Kit II

8.1.1 Ampere Meter mode

8.1.2 Source Meter mode

8.2 Measuring an iBeacon's power consumption

8.3 Lowering power consumption by disabling hardware

8.4 Lowering the power consumption by using a larger advertising interval

8.5 Estimating battery life

8.6 Summary and further exploration

Chapter 9: Conclusion

9.1 Other BLE development platforms

9.2 More about Bluetooth Low Energy

9.3 Some ideas for further exploration

Chapter 10: Appendix

10.1 Where to find BLE specifications

10.2 16-bit UUID ranges

10.3 Verifying a product's Bluetooth qualifications

10.4 Establishing a serial connection to a device over USB

10.4.1 Check the port

10.4.2 Install the USB-to-serial driver

10.4.3 Give the user access

10.4.4 Start the serial connection

10.5 Sniffing BLE traffic on your Android device using the Bluetooth HCI snoop log

10.5.1 Investigating the Bluetooth HCI snoop log file with Wireshark

10.5.2 Sniffing live BLE traffic in Wireshark with the Android Debug Bridge

10.6 Tips for specific hardware

10.6.1 Programming boards that have the Adafruit nRF52 bootloader

10.6.2 Programming boards with Arduino BOSSA