Android源碼各個擊破之-藍牙屬性配置分析

?三星4.2手機，vivo7.1手機，藍牙不加"android.permission.BLUETOOTH_ADMIN"權限，無法掃描藍牙，但是可以根據mac直接連接。

Android MTK 修改手機和藍牙名稱

https://blog.csdn.net/mr_kings/article/details/51042991

?關于google官方藍牙代碼關閉藍牙時的一個bug:

???????? http://www.it1352.com/124594.html

????

Android通過反射機制實現后臺設置藍牙可見性

https://blog.csdn.net/Frakie_Kwok/article/details/78028115

? 1.init方法

? ? ? ? config_new方法將bt_config.conf文件加載到config變量，具體這個方法我就不細說了。

????

? 這個init方法怎么被調用的呢？

????????

?

? ?module_t是一個結構體，這個結構體主要是定義了一個大的模塊的生命周期方法。

? ? ? ??

? ??

? ? stack_manager?

????init_stack -> event_init_stack -> btif_config.c

? ??

? ??

? ?? ?

? ? ? ?stack_manager又通過interface暴露引用給上層。

? ? ? ?

????? ? ?

? ? ? bluetooth.c ->stack_manager.c

? ? ? ?

?????

? ? ? 那么bluetooth.c是在哪里被調用呢？

? ? ? 參照我的另外一篇博客https://blog.51cto.com/4259297/2161333?中關于藍牙物理mac的分析，就能串起來了。思路就是framework-jni-c。

??????

? ?????在此，我就對藍牙物理mac的獲取作一下總結：

? ? ? ?BluetoothAdapter-->BluetoothManagerService-->AdapterService-->bluetooth.c

??????

? ? ? ?AdapterService通過JNI(com_android_bluetooth_btservice_AdapterService.cpp)與bluetooth.c交互，開啟藍牙協議棧。

? ? ? ?

? ? ? ?

? ? ? ? ?

????????結合上面這段代碼 看看bluetooth.c的這段代碼：

????????

?????????根據moduleid??

? ? ? ? ?由此推斷com_android_bluetooth_btservice_AdapterService.cpp里面的module就是bluetooth.c里的?HAL_MODULE_INFO_SYM

?????????

? ???????HAL_MODULE_INFO_SYM的methods指向了結構體bt_stack_module_methods，結構體bt_stack_module_methods的open方法成員又指向了open_bluetooth_stack方法。

?????????open_bluetooth_stack方法創建了device對象，將外部的module傳遞進來 ，并將創建的device傳遞出去。

?????????

?????????device中的get_bluetooth_interface成員方法指向了bluetooth.c的bluetooth__get_bluetooth_interface的方法。這個接口定義在bluetooth.h中，為一個接口體，里面有各種方法指針。bluetooth.c對接口做了

???????? 實現。

????????

? ? ? ? 理論上藍牙物理mac是受保護，不允許修改。我最終的目的是在開啟藍牙時，使用自定義的mac就行。所以只能通用找尋藍牙開啟時，外部掃描的那個mac是如何顯示的，修改源碼了。

????????

尋找藍牙開啟時如何設置的mac

? 1.搜索btif_config.c的btif_config_get_str方法

????????

? 2. 上面這個就是獲取本地藍牙地址的方法? ? ?

?static?void?btif_fetch_local_bdaddr(bt_bdaddr_t?*local_addr)
{
????????????char?val[];
????????????uint8_t?valid_bda?=?FALSE;
????????????int?val_size?=?0;
????????????const?uint8_t?null_bdaddr[BD_ADDR_LEN]?=?{0,0,0,0,0,0};
????????
????????????/*?Get?local?bdaddr?storage?path?from?property?*/?????????????//獲取本地藍牙mac的存儲路徑
????????????//##########1
????????????if?(property_get(PROPERTY_BT_BDADDR_PATH,?val,?NULL))
????????????????{
????????????????????int?addr_fd;
????????????
????????????????????BTIF_TRACE_DEBUG("local?bdaddr?is?stored?in?%s",?val);
????????????
????????????????????if?((addr_fd?=?open(val,?O_RDONLY))?!=?-1)
????????????????????????{
????????????????????????????memset(val,?0,?sizeof(val));
????????????????????????????read(addr_fd,?val,?FACTORY_BT_BDADDR_STORAGE_LEN);
????????????????????????????string_to_bdaddr(val,?local_addr);
????????????????????????????/*?If?this?is?not?a?reserved/special?bda,?then?use?it?*/
????????????????????????????if?(memcmp(local_addr->address,?null_bdaddr,?BD_ADDR_LEN)?!=?0)
????????????????????????????????{
????????????????????????????????????valid_bda?=?TRUE;
????????????????????????????????????BTIF_TRACE_DEBUG("Got?Factory?BDA?%02X:%02X:%02X:%02X:%02X:%02X",
????????????????????????????????????????????????local_addr->address[0],?local_addr->address[1],?local_addr->address[2],
????????????????????????????????????????????????local_addr->address[3],?local_addr->address[4],?local_addr->address[5]);
????????????????????????????????}
????????????????
????????????????????????????close(addr_fd);
????????????????????????}
????????????????}
????????
????????????????//##########2
????????????if(!valid_bda)
????????????????{
????????????????????val_size?=?sizeof(val);
????????????????????if(btif_config_get_str("Adapter",?"Address",?val,?&val_size))
????????????????????{
????????????????????????????string_to_bdaddr(val,?local_addr);
????????????????????????????BTIF_TRACE_DEBUG("local?bdaddr?from?bt_config.xml?is??%s",?val);
????????????????????????????return;
????????????????????????}
?????????????????}
????????
????????????/*?No?factory?BDADDR?found.?Look?for?previously?generated?random?BDA?*/
????????????if?((!valid_bda)?&&?\
????????????????(property_get(PERSIST_BDADDR_PROPERTY,?val,?NULL)))
????????????{
????????????????????string_to_bdaddr(val,?local_addr);
????????????????????valid_bda?=?TRUE;
????????????????????BTIF_TRACE_DEBUG("Got?prior?random?BDA?%02X:%02X:%02X:%02X:%02X:%02X",
????????????????????????????????local_addr->address[0],?local_addr->address[1],?local_addr->address[2],
????????????????????????????????local_addr->address[3],?local_addr->address[4],?local_addr->address[5]);
????????????????}
????????
????????????/*?Generate?new?BDA?if?necessary?*/
????????????if?(!valid_bda)
????????????????{
????????????????????bdstr_t?bdstr;
????????????????????/*?Seed?the?random?number?generator?*/
????????????????????srand((unsigned?int)?(time(0)));
????????????
????????????????????/*?No?autogen?BDA.?Generate?one?now.?*/
????????????????????local_addr->address[0]?=?0x22;
????????????????????local_addr->address[1]?=?0x22;
????????????????????local_addr->address[2]?=?(uint8_t)?((rand()?>>?8)?&?0xFF);
????????????????????local_addr->address[3]?=?(uint8_t)?((rand()?>>?8)?&?0xFF);
????????????????????local_addr->address[4]?=?(uint8_t)?((rand()?>>?8)?&?0xFF);
????????????????????local_addr->address[5]?=?(uint8_t)?((rand()?>>?8)?&?0xFF);
????????????
????????????????????/*?Convert?to?ascii,?and?store?as?a?persistent?property?*/
????????????????????bdaddr_to_string(local_addr,?bdstr,?sizeof(bdstr));
????????????
????????????????????BTIF_TRACE_DEBUG("No?preset?BDA.?Generating?BDA:?%s?for?prop?%s",
?????????????????????????????????(char*)bdstr,?PERSIST_BDADDR_PROPERTY);
????????????
????????????????????if?(property_set(PERSIST_BDADDR_PROPERTY,?(char*)bdstr)?<?0)
????????????????????????BTIF_TRACE_ERROR("Failed?to?set?random?BDA?in?prop?%s",PERSIST_BDADDR_PROPERTY);
????????????????}
????????
????????????//save?the?bd?address?to?config?file
????????????bdstr_t?bdstr;
????????????bdaddr_to_string(local_addr,?bdstr,?sizeof(bdstr));
????????????val_size?=?sizeof(val);
????????????if?(btif_config_get_str("Adapter",?"Address",?val,?&val_size))
????????????{
????????????????????if?(strcmp(bdstr,?val)?==0)
????????????????????????{
????????????????????????????//?BDA?is?already?present?in?the?config?file.
????????????????????????????return;
????????????????????????}
????????????????}
????????????btif_config_set_str("Adapter",?"Address",?bdstr);
????????}

?

上面的源碼好像是提到廠商配置文件，但是我們的系統默認是沒有的。所以能不能通過配置廠商文件改變mac？

藍牙HCI日志查看的方法

????????https://www.jianshu.com/p/73f7366161d1

????????https://blog.csdn.net/chy555chy/article/details/52231043

????????注意設置里開啟日志后，要重啟手機才能生效。

????

????????下載查看hci日志的工具（注意安裝的時候彈出的cmd窗口不要人為干擾關閉，否則軟件裝不成功）

????????https://download.freedownloadmanager.org/Windows-PC/ComProbe-Protocol-Analysis-System/FREE-14.12.5943.6007.html

????????

????????https://www.52pojie.cn/thread-726412-1-1.html? （收費改mac的工具）

????????