Android Bluetooth Hacking Java Day2010 Eng

Bluetooth Hacking
Stefano Sanna - JUG Sardegna
Emanuele Di Saverio - JUG Roma

Stefano Sanna & Emanuele Di Saverio – JUG Sardegna / JUG Roma
Javaday IV – Roma – 01/30/2010

Outline

• Who we are
• The relevance of Bluetooth on mobile devices
• Android & Bluetooth: an unconsummated marriage
• Happy hacking!
• Bluetooth API for Android 1.x
• Official API for Android 2.x
• Demo: Android controls Arduino Bluetooth
Stefano Sanna & Emanuele di Saverio – JUG Sardegna / JUG Roma
Javaday IV – Roma – 30 gennaio 2010

Who we are

• Stefano Sanna
• Senior Solution Engineer Android @ beeweeb SpA
• Author of the book “Java Micro Edition”, Hoepli (2007)
• Main designer Bluetooth API for Android 1.x

• Emanuele Di Saverio
• Scrum Master and Senior Developer @ beeweeb SpA
• SCMAD, SCJP
• Committer easy-bluetooth spin-off for Android


Bluetooth on Android

• early Android
• Wrapper Java su Bluez
• Android 0.9
• API Bluetooth disappears!

• Android 1.x
• No API for developers
• Android 2.x
• Exposes an API allowing discovery of remote devices,
opening and accepting RFCOMM connections

The relevance of Bluetooth

• Without a dedicated API is not possible to:
• Discovery devices and services
• Transfer files with Bluetooth FTP and OBEX

• GPS connections, gamepads, medical devices

• Remote control of embedded modules and sensor networks

• Robotic application (i.e. LEGO Mindstorms)

A lot of devices out there...


Happy
Hacking!


System service & Reflection

• Bluetooth Service is accessible like every other
Android Service:

Object bluetoothService = context.getSystemService(“bluetooth”);

Having the right Class, we can leverage la reflection
to know (and invoke!) the methods:

Class bluetoothServiceClass = bluetoothService.class;

Method[] bluetoothMethods = bluetoothServiceClass.getMethods();


Available Methods
public android.bluetooth.BluetoothDevice(android.bluetooth.IBluetoothDevice)
public boolean android.bluetooth.BluetoothDevice.cancelBondProcess(java.lang.String)
public void android.bluetooth.BluetoothDevice.cancelDiscovery()
public boolean android.bluetooth.BluetoothDevice.cancelPin(java.lang.String)
public boolean android.bluetooth.BluetoothDevice.createBond(java.lang.String)
public boolean android.bluetooth.BluetoothDevice.disable()
public boolean android.bluetooth.BluetoothDevice.disconnectRemoteDeviceAcl(java.lang.String)
public boolean android.bluetooth.BluetoothDevice.enable()
public java.lang.String android.bluetooth.BluetoothDevice.getAddress()
public int android.bluetooth.BluetoothDevice.getBluetoothState()
public int android.bluetooth.BluetoothDevice.getBondState(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getCompany()
public int android.bluetooth.BluetoothDevice.getDiscoverableTimeout()
public java.lang.String android.bluetooth.BluetoothDevice.getManufacturer()
public java.lang.String android.bluetooth.BluetoothDevice.getName()
public int android.bluetooth.BluetoothDevice.getRemoteClass(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteCompany(java.lang.String)
public [B android.bluetooth.BluetoothDevice.getRemoteFeatures(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteManufacturer(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteName(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteRevision(java.lang.String)
public boolean
android.bluetooth.BluetoothDevice.getRemoteServiceChannel(java.lang.String,short,android.bluetoot
h.IBluetoothDeviceCallback)


Available Methods
public android.bluetooth.BluetoothDevice(android.bluetooth.IBluetoothDevice)
public boolean android.bluetooth.BluetoothDevice.cancelBondProcess(java.lang.String)
public void android.bluetooth.BluetoothDevice.cancelDiscovery()

O X!
public boolean android.bluetooth.BluetoothDevice.cancelPin(java.lang.String)
public boolean android.bluetooth.BluetoothDevice.createBond(java.lang.String)

O E
public boolean android.bluetooth.BluetoothDevice.disable()
public boolean android.bluetooth.BluetoothDevice.disconnectRemoteDeviceAcl(java.lang.String)

T L
public boolean android.bluetooth.BluetoothDevice.enable()
public java.lang.String android.bluetooth.BluetoothDevice.getAddress()
public int android.bluetooth.BluetoothDevice.getBluetoothState()
public int android.bluetooth.BluetoothDevice.getBondState(java.lang.String)

P
public java.lang.String android.bluetooth.BluetoothDevice.getCompany()
public int android.bluetooth.BluetoothDevice.getDiscoverableTimeout()

M
public java.lang.String android.bluetooth.BluetoothDevice.getManufacturer()
public java.lang.String android.bluetooth.BluetoothDevice.getName()

O
public int android.bluetooth.BluetoothDevice.getRemoteClass(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteCompany(java.lang.String)
public [B android.bluetooth.BluetoothDevice.getRemoteFeatures(java.lang.String)

C
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteManufacturer(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteName(java.lang.String)
public java.lang.String android.bluetooth.BluetoothDevice.getRemoteRevision(java.lang.String)
public boolean
android.bluetooth.BluetoothDevice.getRemoteServiceChannel(java.lang.String,short,android.bluetoot
h.IBluetoothDeviceCallback)


Permission

• First Step: to access Bluetooth functionalities we
need to declare two Permissions in the Manifest:

<uses-permission android:name="android.permission.BLUETOOTH" />

<uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />


Remote device discovery

LocalBluetoothDevice local = LocalBluetoothDevice.init(context);

local.setListener(new LocalBluetoothDeviceListener() {

public void scanStarted() {
// scan has started...
}

public void scanCompleted(ArrayList<String> devices) {
// scan is over
}
});

local.scan(); // start scan...


Open an RFCOMM socket from client

RemoteBluetoothDevice dev = local.getRemoteBluetoothDevice(address);

dev.setListener(new RemoteBluetoothDeviceListener() {

public void paired() {
// we open sockets and I/O streams... 3
BluetoothSocket socket = dev.openSocket(1);
InputStream input = socket.getInputStream();
OutputStream output = socket.getOutputStream();
}

public void pinRequested() {
// show dialog for PIN input 2
}
});

dev.pair(); 1

Compatible devices

• HTC Dream
• HTC Magic
• HTC Tattoo
• Samsung Galaxy i7500
• Samsung Galaxy i5700
• Huawei U8220
• Sony-Ericsson XPERIA X10

Bluetooth API for Android 1.x

• The only opensource library (Apache 2.0) for
accessing Bluetooth stack on Android 1.x
• Features:
• turn on/off Bluetooth
• discovery of remote devices and RFCOMM bound to a
service
• opening of RFCOMM connections from client
• Works without the necessity of root access
• Check it out!
• http://code.google.com/p/android-bluetooth

Bluetooth API for Android 1.x

• More than 1000 downloads!
• Used in commercial and free projects:
• Inspired Bluetooth File Transfer by Medieval Software, the
most succesful file transfer application on the Android
Market
• Used in Amarino (developed by MIT), first framework for
controlling Arduino via an Android device
• Used in GoPayment by Intuit Inc., for credit card payment
via swiper and Bluetooth printer
• Used in DUBwise project, for flying helicpoters :)

Main limitations

• It’s not possible to register an SDP (Service
Discovery Protocol) service on the database, even
though is possible to create RFCOMM server socket

• If a device inquiry is issue just after phone startup,
the native call interferes with a system scan process
and Bluetooth stack become unusable

• Compatibility problems with HTC Hero


Permission on socket dbus


Android 2.x API

• Android 2.0 : Bluetooth officially in the SDK!
• Yay! But...
• No direct control over pairing
• No direct access to RFCOMM channels
• No service discovery
...not so :
• Android style: based on Intents and Receivers
• Publish/Subscribe paradigm, a little clunky!

Discovery in Android 2.x

BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();

IntentFilter filter = new IntentFilter();

filter.addAction(BluetoothDevice.ACTION_FOUND);
filter.addAction(BluetoothAdapter.ACTION_DISCOVERY_FINISHED);

//also can register for DISCOVERY_STARTED Action

context.registerReceiver(receiver, filter);

adapter.startDiscovery();


BroadcastReceiver
private final BroadcastReceiver receiver = new BroadcastReceiver() {

public void onReceive(Context ctx, Intent intent) {

final String action = intent.getAction();

if (action.equals(BluetoothDevice.ACTION_FOUND)) {
BluetoothDevice device = (BluetoothDevice)
intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);

//process device
} else if
(action.equals(BluetoothAdapter.ACTION_DISCOVERY_FINISHED))
{
//done :o)
}
}
};


Socket e stream I/O

//given a valid “BluetoothDevice”...

UUID uuidOfTargetService =
UUID.nameUUIDFromBytes(“2d26618601fb47c28d9f10b8ec891363”);

BluetoothSocket socket =
rbd.createRfcommSocketToServiceRecord(uuidOfTargetService);

socket.connect();

InputStream input = socket.getInputStream();
OutputStream output = socket.getOutputStream();

....

socket.close();


Android good practices

• It’s important to keep in mind good practices of
Android (and Java) programming!:

• I/O operations always in a separate Thread

• update UI via Handler

• unregister Receivers before destroying Context


Is a separate library still useful?

• In spite of Android 2.0 API, a Bluetooth library would
be greatly useful!

• Access to hidden features (via reflection)
• Expose a simpler API
• 1.x vs 2.x abstraction Retrocompatibility!

• ....working out Easy Bluetooth
• Check it out:
http://android-bluetooth.googlecode.com/svn/

Android controls Arduino

• We want to use Android to control
via Bluetooth a LED and read
a temperature


Arduino

• “Arduino is an open-source electronics prototyping
platform based on flexible, easy-to-use hardware and
software. [...] It can sense the environment by
receiving input from a variety of sensors and can
affect its surroundings by controlling lights, motors,
and other actuators.
• Strictly MADE IN ITALY!

• http://www.arduino.cc


Arduino Source
int LED_PIN = 13; int LM35_PIN = 2;

void setup() { Hardware:
Serial.begin(115200);

}
pinMode(LED_PIN, OUTPUT);
• Arduino Bluetooth
• Prototype shield e breadboard
void loop() { • LM35 Temperature Sensor
if (Serial.available() > 0) {
int inByte = Serial.read();

switch (inByte) {
case '1':
digitalWrite(LED_PIN, HIGH);
Serial.write('1');
break;
case '0': void readTemp() {
digitalWrite(LED_PIN, LOW); int temp = analogRead(LM35_PIN);
Serial.write('0'); temp= ( 5.0 * temp * 100.0) / 1024.0;
break; Serial.write(temp);
case 'r':
}
readTemp();
break;
}
}


Android Source

// define commands...
byte LED_ON_REQUEST = ‘1’;
byte LED_OFF_REQUEST = ‘0’;
byte READ_TEMPERATURE = ‘r’;

[...]

// in the Thread we send comandi and read responses...
output.write(request);
final int response = input.read();

if (request == 'r') {
handler.post(new Runnable() {
public void run() {
String temp = Integer.toString(response);
Toast.makeText(Controller.this, "LM35 Sensor: " + temp + "°C", 4000).show();

});
}


DEMO!

Starring:

Motorola Milestone (Android 2.0), HTC Magic (Android 1.6) and Arduino Bluetooth


Resources

• Android
• http://developer.android.com
• http://source.android.com

• Bluetooth API for Android 1.x e Easy Bluetooth
• http://code.google.com/p/android-bluetooth

• Arduino
• http://www.arduino.cc


References

• Stefano Sanna
• gerdavax AT gmail DOT com
• http://www.gerdavax.it

• Emanuele Di Saverio
• emanuele DOT disaverio AT gmail DOT com


THANK YOU!

Stefano & Emanuele & i rispettivi JUG!


Android Bluetooth Hacking Java Day2010 Eng

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (10)

Ähnlich wie Android Bluetooth Hacking Java Day2010 Eng

Ähnlich wie Android Bluetooth Hacking Java Day2010 Eng (20)

Mehr von Emanuele Di Saverio

Mehr von Emanuele Di Saverio (6)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Android Bluetooth Hacking Java Day2010 Eng