Bluetooth PTT Remote Control
Hans
I would like to use the PTT Remote Control (SHP612) switch as a kind
of Bluetooth GPIO signal. According to its manufacturer it supports a
serial bluetooth profile.
http://www.seecode.com/sub/DownLoad.asp?table=manual&Filenum=1&idx=6
I would like to integrate this i one of the Apple example XCode
projects, because displaying info on iPhone screen is already shown
there.
Is btstack capable of receiving serial data from SPH612? Also
important: would it be necessary to bring the Bluetooth device in
pairing mode each time the app is started, or can pairing be stored
persistently in the app?
Hans
Matthias Ringwald
On 18.01.2011, at 11:47, Hans wrote:
> Hi,
>
> I would like to use the PTT Remote Control (SHP612) switch as a kind
> of Bluetooth GPIO signal. According to its manufacturer it supports a
> serial bluetooth profile.
> http://www.seecode.com/sub/DownLoad.asp?table=manual&Filenum=1&idx=6
>
> I would like to integrate this i one of the Apple example XCode
> projects, because displaying info on iPhone screen is already shown
> there.
well, that was OpenGL-EL :)
>
> Is btstack capable of receiving serial data from SPH612?
yes, see RFCOMM in the wiki.
> Also
> important: would it be necessary to bring the Bluetooth device in
> pairing mode each time the app is started, or can pairing be stored
> persistently in the app?
no, yes, but since a while (don't know exactly) the BTstack daemon stores the link keys generated by the pairing process itself.
Best
matthias
>
> Hans
>
> --
> You received this message because you are subscribed to the Google Groups "btstack-dev" group.
> To post to this group, send email to btsta...@googlegroups.com.
> To unsubscribe from this group, send email to btstack-dev...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/btstack-dev?hl=en.
>
Hans
On 21 Jan., 21:54, Matthias Ringwald <matthias.ringw...@gmail.com>
wrote:
> > important: would it be necessary to bring the Bluetooth device in
> > pairing mode each time the app is started, or can pairing be stored
> > persistently in the app?
>
> no, yes, but since a while (don't know exactly) the BTstack daemon stores the link keys generated by the pairing process itself.
code, e.g. PIN?
Because I have no idea what the packet will look like that the PTT
device will send upon button press, I thought it would be a good idea
to create a Wireshark trace, at least interactive wireshark tracing
will show the relationship between button press and a certain packet.
This way I would know where to insert my code in BTstack to use the
PTT signal.
Unfortunately it seems Wireshark Bluetooth tracing is not possbile on
OSX using libPcap. Am I right? Can it be done on Windows, or do I need
a Linux machine for tracing?
One thing is not clear to me yet: which files from the BTstack svn do
I need to copy into my XCode project? I know I need rfcomm.c and can
try to pull files step-by-step, but would be easier to understand the
structure of the repository.
Best, Hans
Hans
on iOS 4.0.1 device in debug mode. The iPhone lists the bluetooth
device as SHP-612 as well as my MacBook. I guess I am halfway there,
because I have the BTstack running and I have a GUI.
The SHP-612 being listed in BTstackCocoa means: pairing is not yet
done, I guess?
Any pointers on how to create a Wireshark trace (probably on the
iPhone) are welcome.
Hans
Matthias Ringwald
On 23.01.2011, at 21:46, Hans wrote:
> I managed to build BTstackCocoa using XCode version 3.2.5 and run it
> on iOS 4.0.1 device in debug mode. The iPhone lists the bluetooth
> device as SHP-612 as well as my MacBook. I guess I am halfway there,
> because I have the BTstack running and I have a GUI.
>
> The SHP-612 being listed in BTstackCocoa means: pairing is not yet
> done, I guess?
Why? A device discovery shows all devices that are, well, in discovery mode.
>
> Any pointers on how to create a Wireshark trace (probably on the
> iPhone) are welcome.
On the iPhone (iPod/iPad), BTstack logs to /tmp/hci_dump.pklg.
On the Mac, Apple's PacketLogger is cool.
Best
Matthias
Matthias Ringwald
On 22.01.2011, at 17:30, Hans wrote:
>
>
> On 21 Jan., 21:54, Matthias Ringwald <matthias.ringw...@gmail.com>
> wrote:
>>> Also
>>> important: would it be necessary to bring the Bluetooth device in
>>> pairing mode each time the app is started, or can pairing be stored
>>> persistently in the app?
>>
>> no, yes, but since a while (don't know exactly) the BTstack daemon stores the link keys generated by the pairing process itself.
>
> Do I need to configure the pairing process in some way in BTstack
> code, e.g. PIN?
>
No. BTstack deamon provides access to the Bluetooth module. If there is a pairing process, your app will get an event packet that ask for the PIN which you have to answer. (see code in some of the examples).
> Because I have no idea what the packet will look like that the PTT
> device will send upon button press, I thought it would be a good idea
> to create a Wireshark trace, at least interactive wireshark tracing
> will show the relationship between button press and a certain packet.
> This way I would know where to insert my code in BTstack to use the
> PTT signal.
Looking at packet logs is a good idea. However, as I've said, the BTstack lib provides access to the BTdaemon. BTdaemon won't do anything with your data, it allows to have an app that receives/sends data.
>
> Unfortunately it seems Wireshark Bluetooth tracing is not possbile on
> OSX using libPcap. Am I right? Can it be done on Windows, or do I need
> a Linux machine for tracing?
I managed to do an USB trace on Windows, but that's a pain to read. Linux & Mac are fine using hcidump and PacketLogger respectively.
>
> One thing is not clear to me yet: which files from the BTstack svn do
> I need to copy into my XCode project?
basically none. The CocoaTouch interface isn't mature yet, so you're free to compile them into your project, otherwise you link against libBTstack.dylib and include the exposed headers in BTstack/include/
> I know I need rfcomm.c and can
> try to pull files step-by-step, but would be easier to understand the
> structure of the repository.
Ah right. Until RFCOMM is part of the BTdaemon (don't ask for when), you can also copy/compile rfcomm.c into your app
best
matthias
>
> Best, Hans
Hans
Using Bluetooth development tools on OSX was helpful to discover
information about the SHP-612.
As of now, I have put rfcomm.c into another XCode project from Apple
examples, some header files needed in btstack/includes, and linked to
libBTstack.dylib. I have renamed main() and I am calling it from my
projects main funtion. I can step through rfcomm.c initialisation and
hit breakpoints in packet handler.
What I see looks logical to me: SHP-612 rejects the pairing attempt
because from OSX environment I have the same experience when pairing
with PIN. There are four code options in OSX bluetooth assistant: 1)
automatic code, 2) "empty" code, 3) specific code, 4) no code. Only
option 4 using no code works.
Maybe its trivial, but it does not seem to be in the example code to
pair without pin. If I simply omit the "-p 0000" option I get
EXC_BAD_ACCESS. Do I need to extend and rebuild the btstack library?
Hans
Matthias Ringwald
to skip authentification, you can change
bt_send_cmd(&hci_write_authentication_enable, 1);
to
bt_send_cmd(&hci_write_authentication_enable, 0);
in rfcomm.c
best
Matthias
Hans
BTW: I disabled mknod and open(FIFO_NAME...) because that failed. But
as I receive packets anyway I don't bother. Should I?
This authentication/pin thing is strange. I did pairing again with my
MacBook and logged with PacketLogger. Here I can clearly see that PIN
packets are exchanged although I have selected "no pin" in OSX gui. I
think the best way would be to compare packet traces of both
environments.
I can SSH to my iPhone and see hci_dump.pklg but iOS shell does not
have ftp command. So, what is the smartest way to transfer the packet
log to the MacBook? Maybe Air Sharing app (http://www.pure-mac.com/
iphone/filetransfer.html)?
Best, Hans
tz
If you have
ssh ro...@192.168.20.1
you can do
scp ro...@192.168.20.1:/tmp/file /Users/myname
to transfer files. There are manpages with more details on the usage.
Matthias Ringwald
On 30.01.2011, at 16:06, Hans wrote:
> Hi Matthias,
>
> BTW: I disabled mknod and open(FIFO_NAME...) because that failed. But
> as I receive packets anyway I don't bother. Should I?
That's ok. The FIFO was added due to popular demand, but wasn't there in the beginning and I don't think RFCOMM should be used via a FIFO (better integrate it with your actual app)
Best
matthias
Hans
Regarding FIFO: If its not necessary, what is the purpose? Having a
hardware buffer that stores received data in case CPU is busy? That
brings me to another question: When using RFCOMM protocol to receive
data from the PTT device, is there a TCP-like transport control that
retransmits data to make sure no PTT event gets lost?
Best, Hans
Matthias Ringwald
On 31.01.2011, at 11:32, Hans wrote:
> Regarding FIFO: If its not necessary, what is the purpose?
The FIFO is nice for quick first check to see if a connection can be established. I've added it because people asked for it and even supplied a patch.
..
> When using RFCOMM protocol to receive
> data from the PTT device, is there a TCP-like transport control that
> retransmits data to make sure no PTT event gets lost?
RFCOMM runs over connection-oriented L2CAP channels, which are reliable according to the Bluetooth specification. It's the task of the Link Manager in the Bluetooth module to either provide a reliable connection or just drop it.
Best
Matthias
Hans
wrote:
> The FIFO is nice for quick first check to see if a connection can be established. I've added it because people asked for it and even supplied a patch.
Where can I find it?
I did the comparative logs. If someone wants to share my view:
http://www.klaviervilla.org/btstack/logs.php
In SPH612_OSX_pairing.pklg I see that OSX does a Connection Request
with PSM 0x0001 - Service Discovery Protocol (@21:37:14.395) whereas
BTstack sends a Connection Request with PSM 0x0003 - RFCOMM
(@21:53:16.366). Upon l2cap_create_channel the SPH612 always sends a
pin code request.
So I guess OSX does not really do a usable pairing here, it just does
a service discovery? It appers to me I need a PIN for that device?
Best, Hans
Matthias Ringwald
yupp. Mac OS does a proper service discovery, which doesn't required authentication usually. You can try to read from that virtual serial port and motivate OS X to really do the pairing, or fail.
And the PIN is usually hard-coded and in the manual. Try "0000", "1234" and ... "5555" <- TomTom iPhone Car Kit
Best
Matthias
Hans
this Bluetooth PTT is one of multiple parts in a handsfree solution
for professional radio communications, i.e. It is intended to be used
by another device of the same vendor. It could well be that
applications with other Bluetooth devices are not desired. The PIN is
not in the user manual that I have found (link see one of my previous
post).
I am currently seeing two alternatives: a simple Bluetooth mouse or
ArduinoBT. Time effort becomes critical.
I am not sure what is easier:
1) Trying to break the PIN of the PTT device. (I will try the ones you
suggested)
2) Implementing the necessary stuff to make the HID layer of the mouse
happy.
3) Puzzling with ArduinoBT which is another embedded system. Not clear
to me how ready-to-use this system is, at least a fully working RFCOMM
code template would be needed (that transfers one "Button pressed" PDU
that I can catch on BTstack).
Best, Hans
Matthias Ringwald
Sorry, I lost track of your project and the pieces. Let me recacp:
So you have this "Bluetooth PTT" and want to use it on the iPhone with BTstack, right?
The service discovery from the Mac shows that it only supports one or multiple RFCOMM connections.
The connection with rfcomm.c fails without a PIN but you don't know the right one.
Not sure what your options are. If you can pair it with the Mac and actually communicate over RFCOMM, it should also work with BTstack.
I have no clue how your options 2) and 3) are related to that device. (2- a mouse? HID? 3 - ArduinoBT is a basic AVR with a serial-to-RFCOMM chip but it will need a PIN, too)
Best
Matthias
Hans
wrote:
here "without PIN". It is just PSM 0x0001 - Service Discovery
Protocol. PIN based pairing also fails on OSX with all the easy
standard PINs.
sense to drop that PTT thing and start with a different input device.
I understand that mice use HID protocol and that example/test.c can be
used as a starting point. The form factor of my input device is not of
any importance. It should be of somewhat limited size and battery
driven. I just need a packet over Bluetooth (or WiFi...) if a button
is pressed. So from a hardware perspective a standard Bluetooth mouse
would be fine.
I am not clear about the effort required to implement a minimalistic
"mouse driver" that just notifies BTstack about button presses.
The same applies to ArduinoBT (PIN is publicly available). It will
require some initialisation code and very few lines of actual
functionality. But I couldn't find an Arduno Bluetooth code template
so far. However there is code for debouncing GPIO input, but that's
only half of the story.
Best, Hans
Matthias Ringwald
ok. thanks for the details.
given the constraints, I'd suggest going the "use Bluetooth mouse" route. If you run example/test.c and set the Bluetooth address of your mouse, it will connect and deliver HID reports. HID reports can be very complex, but for a mouse button, there will be a single bit that toggles. That's really easy to use in that case - Writing a full blown HID description parser which can work with any HID device and properly detect what's it supposed to to with the input is a different one. One that I'll be facing soon btw...
best
Matthias
Hans
wrote:
aware of, models I should avoid because they are not able to deal with
a minimalistic stack?
(I hope all that powersave stuff can be handled by BTstack layers
below HDI.)
tz
would help to know the model or manufacturer or more details. It
might be a simple phone device that when paired uses Hayes style AT
commands like many handsfree (there was some stuff for the Nokia
n-series tablets using this).
You are using the mac to try to connect - is it asking for a PIN or is
it telling you to enter on on the remote device?
What does the device do? Does it have buttons? Receive audio? Send
audio? Has a display? I'm a little confused as to which end you want
to use or emulate.
You might need one of these when they become available:
http://ossmann.blogspot.com/2011/01/ubertooth-video-and-news.html
He has a kickstarter project, so for $100 you can be an early adopter.
Hans
> First, have you tried pairing with the other side of the unit?
(SHD612). I just have PTT Remote Control (SHP612).
> It would help to know the model or manufacturer or more details. It
> might be a simple phone device that when paired uses Hayes style AT
> commands like many handsfree (there was some stuff for the Nokia
> n-series tablets using this).
>
> You are using the mac to try to connect - is it asking for a PIN or is
> it telling you to enter on on the remote device?
>
> What does the device do? Does it have buttons? Receive audio? Send
> audio? Has a display? I'm a little confused as to which end you want
> to use or emulate.
thread. I want to use the PTT button (essentially: some external
hardware button) in an iPhone app.
> You might need one of these when they become available:
>
> http://ossmann.blogspot.com/2011/01/ubertooth-video-and-news.html
>
> He has a kickstarter project, so for $100 you can be an early adopter.
Seecode units. Right? But that could be done with BTstack, too. See
mitm.c
Matthias Ringwald
you cannot get the Bluetooth PIN even with a an expensive Bluetooth sniffer. It is never sent over the air. Bluetooth security isn't perfect, but it is not THAT broken. :)
I don't know the details, but the PIN + some random data which is exchanged is used to create the link key.
see diffie-hellman key exchange for similar approaches.
Best
matthias
> --
> You received this me
Matthias Ringwald
any mouse but the previous Apple Mighty Mouse work with BTstack Mouse and after sending them the "use boot procotol" package, they send back in a standardized format.
for powersave, you could issue a sniff command (again, one single command) for that connection
best
matthias
tz
ephermal key and hijack or at least decode the session.
Looking at the manuals via google - the headset in the kit has a pin
of 0000 but it doesn't say about the PTT.
It isn't diffie-helman (I wrote one of the three interoperable
versions of openPGP for rfc2440 and did an SSL layer for Lynx so I
know something about the subject) .
Steve Gibson described the complex but failrly secure exchange
mechanism in a recent security now podcast (grc.com) but it isn't
proven strong crypto. He had a followup listing security flaws. It
isn't like SSL or PGP, but is (apparently) a lot better than WEP.
If the PINs are known it generally isn't considered secure - why not
use 0000 for keyboards if not, but most people don't care about
headset audio. And you can brute-force the search on the initial
pairing much faster on a PC desktop than trying every pin.
It may also be using the MAC address and/or name of the device to make
sure it pairs with the dongle instead of the headset or something else.
Hans
> Looking at the manuals via google - the headset in the kit has a pin
> of 0000 but it doesn't say about the PTT.
> And you can brute-force the search on the initial
> pairing much faster on a PC desktop than trying every pin.
only. A kind of PIN loop will bringt the device out of pairing mode, I
guess.
> It may also be using the MAC address and/or name of the device to make
> sure it pairs with the dongle instead of the headset or something else.
somewhat annoying for the intended user of that system. Most probably
this device has a hard coded PIN.
Hans
BTstack.
[23:52:19.520] [HCI EVENT] PIN code request - 00-15-45-31-15-1C
PIN code request - 00-15-45-31-15-1C
Parameter Length: 6 (0x06)
Device Address: 00-15-45-31-15-1C
[23:52:19.520] [HCI EVENT] 16 06 1C 15 31 45 15 00
[23:52:19.520] [HCI COMMAND] [040D] PIN Code Request Reply:
00-15-45-31-15-1C
[040D] PIN Code Request Reply: 00-15-45-31-15-1C
Opcode: 0x040D (OGF: 0x01 OCF: 0x0D)
Parameter Length: 23 (0x17)
Device Address: 00-15-45-31-15-1C
PIN Code Length: 0x04
PIN Code: 0000 (0x30 30 30 30 00 00 00 00 00 00 00 00
00 00 00 00)
[23:52:19.520] [HCI COMMAND] 0D 04 17 1C 15 31 45 15 00 04 30 30 30
30 00 00 00 00 00 00 00 00 00 00 00 00
[23:52:19.520] [NOTE] [0xb903000] Req OpCode 040D from: Bluetooth
Setup (216) status: 00 state: 2 timeout: 10000
[23:52:19.530] [HCI EVENT] Command Complete - PIN Code Request Reply
Command Complete - PIN Code Request Reply
Parameter Length: 10 (0x0A)
Status: 0x00 - Success.
Num HCI Command Packets: 0x01
Opcode: 0x040d (OGF: 0x01 OCF: 0x0D) - [Link Control
Commands OGF] PIN Code Request Reply
Device Address: 00-15-45-31-15-1C
Now it should be possible to open RFCOMM in BTstack.
Thanks for your help, guys!
Matthias Ringwald
I don't want to be negative here, but in the debug output I read that "0000" is sent to the Bluetooth module and the module answers that it successfully received that PIN. This does not imply that both devices are paired as this would result in a link key notification.
as for the brute forcing before, if we assume that the PIN is just 4 digits and hard-coded, you could write a little tool that just tries all combinations with any environment you like. pyBluez or lightblue (both python) might be an easy one.
Best
Matthias
Hans
processing a 17 character string (Bluetooth MAC address including "-"
separators), because it is limited to 16 characters.
So that didn't work. I bought a Microsoft Wireless Mobile Mouse 1000
and learned that wireless mouse is not equivalent to bluetooth mouse :-
(
So I modified rfcomm.c to be more like bruteforce.c.
That did work! 6 hours later I know the PIN: 3334. :-)
And hci_dump.pklg contains
[00:22:28.971] [RFCOMM RECEIVE] UIH 6 bytes of data for channel 0x01
[+PTT=P]
UIH 6 bytes of data for channel 0x01 [+PTT=P]
RFCOMM Address: 0x09 [EA = 1 CR = 0 D = 0 Server
Channel = 0x01]
RFCOMM Control: 0xef
P/F Bit: OFF
RFCOMM Length: 0x0006 (in a 0x01 bytes format)
UIH
Frame with 6 bytes of data
RFCOMM Data:
0x00000000: 2B 50 54 54 3D
50 :+PTT=P
RFCOMM FCS: 40
[00:22:28.971] [L2CAP RECEIVE] Data [Handle: 0x000c, Channel ID:
0x0040, Length: 0x000a (10)]
[00:22:29.982] [RFCOMM RECEIVE] UIH 6 bytes of data for channel 0x01
[+PTT=R]
UIH 6 bytes of data for channel 0x01 [+PTT=R]
RFCOMM Address: 0x09 [EA = 1 CR = 0 D = 0 Server
Channel = 0x01]
RFCOMM Control: 0xef
P/F Bit: OFF
RFCOMM Length: 0x0006 (in a 0x01 bytes format)
UIH
Frame with 6 bytes of data
RFCOMM Data:
0x00000000: 2B 50 54 54 3D
52 :+PTT=R
RFCOMM FCS: 40
[00:22:29.982] [L2CAP RECEIVE] Data [Handle: 0x000c, Channel ID:
0x0040, Length: 0x000a (10)]
which are the packets for PPT Press and Release.
Now I need to code a switch-case for those packets.
How do I combine the BTstack run loop with the GUI of the iPhone
example code from Apple? I need the GUI mainly for output.
Matthias Ringwald
congratulations on breaking the PIN - which tells us that a 4 digit number was never secure. but that's good in your case.
On 05.02.2011, at 00:38, Hans wrote:
> How do I combine the BTstack run loop with the GUI of the iPhone
> example code from Apple? I need the GUI mainly for output.
all you have to do (besides making the compiler & Xcode happy) is to call run_loop_init(RUN_LOOP_COCOA). And you don't need to call run_loop_execute() when running in a normal iOS app (as BTstack integrates with the provided CoreFoundation run loop after selecting RUN_LOOP_COCOA).
Also, take a look at CocoaTouch/ ... The BTstackManager class provides a basic Obj-C interface (which can be improved a lot, I know) and already handles activation and run loop setup, see TestBTstackManager.m.
Best
Matthias
Hans
iPhone.
Now I am in trouble because it is expected that I get it running on
iPad. I installed WiiMote because that installs the BTstack dynamic
link library, right? According to the debugger it seems to me that I
can use identical source code on iPad. As on iPhone Bluetooth seems to
be more reliable when WiFi is off.
The problem I experience is that the PTT device does not accept the
PIN that works on iPhone. I tried pairing on OSX and on Android with
the same negative result. This makes we wonder. Could it be that the
PTT device does not allow pairing with two devices at the same time?
Does kind of unpairing exist? Or probably the second pairing requires
another PIN?
BTW, how likely is it that the PTT device allows RFCOMM channel open
of iPhone and iPad at the same time? Would that be possible with an
ordinary Bluetooth mouse?
And more: I also need to port my app to iPod in the next step. Is that
going to cause issues regarding BTstack?
Best, Hans
Matthias Ringwald
On 20.02.2011, at 18:18, Hans wrote:
> ..
> Now I am in trouble because it is expected that I get it running on
> iPad. I installed WiiMote because that installs the BTstack dynamic
> link library, right? According to the debugger it seems to me that I
> can use identical source code on iPad. As on iPhone Bluetooth seems to
> be more reliable when WiFi is off.
yes. same package from Cydia on all supported platforms: iPhone, iPad, iPod, AppleTV 2
>
> The problem I experience is that the PTT device does not accept the
> PIN that works on iPhone. I tried pairing on OSX and on Android with
> the same negative result. This makes we wonder. Could it be that the
> PTT device does not allow pairing with two devices at the same time?
> Does kind of unpairing exist? Or probably the second pairing requires
> another PIN?
no idea. I don't think it needs a different PIN.
> BTW, how likely is it that the PTT device allows RFCOMM channel open
> of iPhone and iPad at the same time?
Tehcnically its possible, a mac can do that, BTstack should support that, too. However, it's quite possible that multiple connections might are not supported.
> Would that be possible with an
> ordinary Bluetooth mouse?
Nope.
> And more: I also need to port my app to iPod in the next step. Is that
> going to cause issues regarding BTstack?
Nope.
Best
Matthias
Hans
I just want to say thank you for you BTstack code and your great
support. End of March my iPhone/iPad app using your stack was live on
stage in highly visible position. Failure would have been noticeable
for everyone, but it worked rock-solid. I coded some realiability
measures to re-establish RFCOMM channel in case of unexpected channel
closure.
http://www.klaviervilla.org/forum/viewtopic.php?f=11&t=225
Best, Hans
P.S.: If someone is interested in the source code, send me a private
message.
Matthias Ringwald
after the Mardi Grass Costume, another use of BTstack in art. I certainly didn't expect that. :)
What did your app actually do? In the forum post you say "a counter". Can you tell a bit more? And is this related to the PTT thing you re-used?
Best
Matthias
Hans
On 6 Apr., 17:10, Matthias Ringwald <matthias.ringw...@gmail.com>
wrote:
> What did your app actually do? In the forum post you say "a counter". Can you tell a bit more? And is this related to the PTT thing you re-used?
the bluetooth button and displayed them for the pianist, iPad used a
TCP socket client to a socket server on the iPhone via WiFi tethering
app to get counter updates and displayed it for the audience. My
MacBook also was registered in the same WiFi network and able to send
commands to the iPhone to correct the counter in case pianists forgot
to press the button. WiFi was actually a very good idea, because the
Spiegelsaal is that large that bluetooth range was not sufficient to
reach the loge where the event organisation commitee resided.
Best, Hans