Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

furiousMAC Continuity

Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • No GitHub releases; the reviewed commit, from 2025-08-29, merges a typo fix. The dissector README calls the March 2021 version for Wireshark 3.4.4 the most up to date: the 4.4.0 file contributed in 2024 ports it to build on Wireshark 4.4.0 without dissector changes and may not correctly dissect messages from the latest iOS versions. Fields the message tables mark as unknown or uncertain remain open.
  • On Linux and macOS, users download the Wireshark source for the matching version, replace epan/dissectors/packet-bthci_cmd.c with the project's file and build Wireshark. The repository also commits prebuilt 64-bit Windows Wireshark installers for 3.0.8 and 3.2.1, which the dissector README says are based on the original ShmooCon 2020 dissector and should not be used.
  • Capturing advertisements needs a BLE sniffer: HARDWARE.md recommends a Nordic nRF51 dongle with Nordic's sniffer firmware, or an Ubertooth One with the included btleshark.sh capture script. Analysis uses advertisements the analyst captures; the repository contains no sample captures.
  • GPL-2.0. The README credits many message types and field meanings to Celosia and Cunche's PETS 2020 paper.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · furiousMAC/continuity · Revision d9fa98b
  2. dissector/README.md GitHub · furiousMAC/continuity · Revision d9fa98b
  3. dissector/INSTALL.md GitHub · furiousMAC/continuity · Revision d9fa98b
  4. dissector/FIELDS.md GitHub · furiousMAC/continuity · Revision d9fa98b
  5. dissector/CHANGELOG.md GitHub · furiousMAC/continuity · Revision d9fa98b
  6. HARDWARE.md GitHub · furiousMAC/continuity · Revision d9fa98b
  7. messages GitHub · furiousMAC/continuity · Revision d9fa98b
  8. LICENSE.md GitHub · furiousMAC/continuity · Revision d9fa98b
  9. https://github.com/furiousMAC/continuity/commit/c125a620598bc132ac356202fcced6a481775909
  10. https://petsymposium.org/2019/files/papers/issue4/popets-2019-0057.pdf

More in Protocols

All 140 entries in Protocols

↑↓ move↵ open⌘↵ new tab