What is the iBeacon Bluetooth Profile

by

For an iBeacon with ProximityUUID E2C56DB5-DFFB-48D2-B060-D0F5A71096E0, major 0, minor 0, and calibrated Tx Power of -59 RSSI, the transmitted BLE advertisement packet looks like this:

d6 be 89 8e 40 24 05 a2 17 6e 3d 71 02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 52 ab 8d 38 a5

This packet can be broken down as follows:

d6 be 89 8e # Access address for advertising data (this is always the same fixed value)
40 # Advertising Channel PDU Header byte 0.  Contains: (type = 0), (tx add = 1), (rx add = 0)
24 # Advertising Channel PDU Header byte 1.  Contains:  (length = total bytes of the advertising payload + 6 bytes for the BLE mac address.)
05 a2 17 6e 3d 71 # Bluetooth Mac address (note this is a spoofed address)
02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 # Bluetooth advertisement
52 ab 8d 38 a5 # checksum

The key part of that packet is the Bluetooth Advertisement, which can be broken down like this:

02 # Number of bytes that follow in first AD structure
01 # Flags AD type
1A # Flags value 0x1A = 000011010  
   bit 0 (OFF) LE Limited Discoverable Mode
   bit 1 (ON) LE General Discoverable Mode
   bit 2 (OFF) BR/EDR Not Supported
   bit 3 (ON) Simultaneous LE and BR/EDR to Same Device Capable (controller)
   bit 4 (ON) Simultaneous LE and BR/EDR to Same Device Capable (Host)
1A # Number of bytes that follow in second (and last) AD structure
FF # Manufacturer specific data AD type
4C 00 # Company identifier code (0x004C == Apple)
02 # Byte 0 of iBeacon advertisement indicator
15 # Byte 1 of iBeacon advertisement indicator
e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 # iBeacon proximity uuid
00 00 # major 
00 00 # minor 
c5 # The 2's complement of the calibrated Tx Power

Any Bluetooth LE device that can be configured to send a specific advertisement can generate the above packet. I have configured a Linux computer using Bluez to send this advertisement, and iOS7 devices running Apple’s AirLocate test code pick it up as an iBeacon with the fields specified above. See: Use BlueZ Stack As A Peripheral (Advertiser)

This blog has full details about the reverse engineering process.

More Related Contents:

  1. Understanding ibeacon distancing
  2. iBeacon: didRangeBeacons stops getting called, must reset device for it to work again
  3. SWIFT – BLE communications
  4. Get MAC address of bluetooth low energy peripheral in iOS
  5. How to get list of available Bluetooth devices?
  6. How to get the status of bluetooth (ON/OFF) in iphone programmatically
  7. How to use bluetooth classic instead of le
  8. iBeacon Notification when the app is not running
  9. Can an Android device act as an iBeacon?
  10. Communicating between iOS and Android with Bluetooth LE
  11. locationManager:didEnterRegion not called when a beacon is detected
  12. CoreBluetooth: What is the lifetime of unique UUIDs
  13. iOS CoreBluetooth passively check if Bluetooth is enabled without prompting user to turn Bluetooth on
  14. How to bring application to foreground in ios?
  15. Core Bluetooth advertise and scan in the background
  16. extract folder id from url ios
  17. iOS 7 status bar back to iOS 6 default style in iPhone app?
  18. SourceKitService Terminated
  19. UIButton inside a view that has a UITapGestureRecognizer
  20. Callback Method if user declines Push Notification Prompt?
  21. Round Top Corners of a UIButton in Swift
  22. Change Status Bar Background Color in Swift 3
  23. NSDate – Convert Date to GMT
  24. Add child view controller to current view controller
  25. Swiftui – How do I initialize an observedObject using an environmentobject as a parameter?
  26. Https iOS with self signed certificate
  27. Find current country from iPhone device
  28. iOS navigation bar item image size
  29. iOS13 share sheet: how to set preview thumbnail when sharing UIImage
  30. Does webKit in iOS 11 (Beta) support WebRTC?

Leave a Comment