a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

add: further ble infos

Browse Source
This commit is contained in:
a.edenhauser
2026-10-29 09:49:18 +01:00
parent fccc75d98b
commit 40545aef24
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document0-Initial_Information_Gathering.md
+7 -1
View File
@@ -174,10 +174,16 @@ Some playing around with Metasploit's `check` on these 2 cloud endpoints couldn'
I ran ToothFairy on the lock. It's advertising name is "Loqed Inside" and it uses a fixed MAC address `FF:EC:EE:E7:32:E5`.
I obtained the [GATT table](ble/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](ble/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of hardware.
I obtained the [GATT table](ble/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](ble/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of HW.
However, ToothFairy labelled `WRLS-FUZZ-002` as `FAIL`, due to the target not recovering after malformed packets were sent.
### Sniffing
After obtaining the needed HW, I tried snifing the app connection process and sent a lock/unlock command, none of which showed ATT protocol packets. This could be due to:
- Encryption on the link layer
- The sniffer struggling with frequency hopping (nRF nordic)
## 1.8 Collect Firmware Dump of Firmware after initial Setup
### Bridge