Skip to content

DESIGN.md

Latest commit

 

History

History
110 lines (67 loc) · 3.2 KB

DESIGN.md

File metadata and controls

110 lines (67 loc) · 3.2 KB
Raw

Change Bluetooth Link Key on Linux to Match the Windows

Introduction

The Bluetooth Link Key is a 16-byte value that is used to authenticate a Bluetooth device. It is used to ensure that the device is the one that it claims to be. The Link Key is generated by the device and is unique to the device. The Link Key is used to encrypt the communication between the device and the host.

Problem

When having a dual boot system with Linux and Windows you can't use the same Bluetooth device on both systems. This is because the Link Key is stored in the Bluetooth controller and is unique to the device. When you connect the device to the Linux system, the Link Key is generated and stored in the Bluetooth controller. When you connect the device to the Windows system, the Link Key is generated and stored in the Bluetooth controller. This means that the Link Key is different on both systems.

Solution

The solution is to change the Link Key on Linux to match the Link Key on Windows. For this we need the SYSTEM registry file from C:\Windows\System32\config\SYSTEM We also need chntpw to read the Windows registry on Linux.

Requirements

Pair bluetooth device on Linux

Pair bluetooth device on Windows

Steps

Get BT controller MAC address

ls /var/lib/bluetooth/

The output will be something like:

9C:FC:E8:B8:86:06

The directory will be the MAC address of the Bluetooth controller.

Get BT device MAC address

ls /var/lib/bluetooth/<controller-mac>/

Which will list directories corresponding to the Bluetooth devices that have been paired with the controller.

Dump BT Windows registry data

reged -x <path-to-SYSTEM> "\ControlSet001\Services\BTHPORT\Parameters\Keys" '\\' tmp.reg

Note: reged is a tool to read the Windows registry on Linux, for some reason I couldn't use chntpw directly because it crashed with SIGSEGV.

Get BT device Link Key from the dump

The dump will be full of crap, but we only care about contain something like:

[\ControlSet001\Services\BTHPORT\Parameters\Keys\ControlSet001\Services\BTHPORT\Parameters\Keys\9cfce8b88606]
"7845ce0af692"=hex:c5,cc,96,ec,48,ee,88,8f,04,a8,63,34,4c,c6,a7,2d
"98583d332bda"=hex:43,63,a8,89,a9,e3,1d,ef,05,b3,eb,35,bb,71,7b,19
"c87b230bc130"=hex:be,92,93,99,aa,dc,0d,ff,69,88,9b,e8,cd,79,47,a7

Now, notice that this corresponds to:

[\ControlSet001\Services\BTHPORT\Parameters\Keys\ControlSet001\Services\BTHPORT\Parameters\Keys\<controller-mac>]
"<device1-mac>"=hex:9e,f1,4f,8c,b5,4d,8b,01,04,8f,4a,8f,4a,8f,4a,8f
"<device2-mac>"=hex:c5,cc,96,ec,48,ee,88,8f,04,a8,63,34,4c,c6,a7,2d
...

The MACs are lowercased and stripped of colons (:).

Get BT device Link Key from the dump

Now, we need to get the Link Key from the dump and remove the hex prefix and commas, so:

hex:9e,f1,4f,8c,b5,4d,8b,01,04,8f,4a,8f,4a,8f,4a,8f

Would become:

9ef14f8cb54d8b01048f4a8f4a8f4a8f

Save the Link Key

Now we need to go to /var/lib/bluetooth///info

Which looks like:

[General]
Name=<device-name>
...

[LinkKey]
Key = <link-key>
Type=4
PINLength=0

...

and replace the uppercased link key with the one we got from the dump (without commans and hex: prefix)