{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/dissector/README.md",
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/dissector/INSTALL.md",
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/dissector/FIELDS.md",
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/dissector/CHANGELOG.md",
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/HARDWARE.md",
    "https://github.com/furiousMAC/continuity/tree/d9fa98bddafbfa3baafc84e37a417d78a0598546/messages",
    "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/LICENSE.md",
    "https://github.com/furiousMAC/continuity/commit/c125a620598bc132ac356202fcced6a481775909",
    "https://petsymposium.org/2019/files/papers/issue4/popets-2019-0057.pdf"
  ],
  "category": "protocol-analysis",
  "description_en": "Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.",
  "description_zh": "针对 Apple 专有 Continuity 蓝牙低功耗广播的逆向工程笔记与 Wireshark 解析器，是作者 PETS 2019 隐私研究的延续。各报文页面记录了 AirDrop、Handoff、Proximity Pairing、Nearby Info、Find My 等 14 种报文类型的字段布局和观测到的取值；解析器替换 Wireshark 的 packet-bthci_cmd.c，使捕获到的广播能解码为具名的 btcommon.apple 字段。",
  "entry_url": "https://awesomerea.org/resources/furiousmac-continuity/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/furiousmac-continuity/",
  "evidence_url": "https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/README.md",
  "group": "tools",
  "id": "furiousmac-continuity",
  "json_url": "https://awesomerea.org/resources/furiousmac-continuity/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/furiousmac-continuity/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/furiousmac-continuity/index.md",
  "name": "furiousMAC Continuity",
  "name_zh": "furiousMAC Apple Continuity 协议逆向与解析器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "No GitHub releases; the reviewed commit, from 2025-08-29, merges a typo fix. The dissector README calls the March 2021 version for Wireshark 3.4.4 the most up to date: the 4.4.0 file contributed in 2024 ports it to build on Wireshark 4.4.0 without dissector changes and may not correctly dissect messages from the latest iOS versions. Fields the message tables mark as unknown or uncertain remain open.",
    "On Linux and macOS, users download the Wireshark source for the matching version, replace epan/dissectors/packet-bthci_cmd.c with the project's file and build Wireshark. The repository also commits prebuilt 64-bit Windows Wireshark installers for 3.0.8 and 3.2.1, which the dissector README says are based on the original ShmooCon 2020 dissector and should not be used.",
    "Capturing advertisements needs a BLE sniffer: HARDWARE.md recommends a Nordic nRF51 dongle with Nordic's sniffer firmware, or an Ubertooth One with the included btleshark.sh capture script. Analysis uses advertisements the analyst captures; the repository contains no sample captures.",
    "GPL-2.0. The README credits many message types and field meanings to Celosia and Cunche's PETS 2020 paper."
  ],
  "requirements_zh": [
    "没有 GitHub 发布版本；所审阅的提交日期为 2025-08-29，合并的是一处拼写修正。解析器 README 称 2021 年 3 月针对 Wireshark 3.4.4 的版本是最新的：2024 年贡献的 4.4.0 文件只是将其移植到 Wireshark 4.4.0 上编译，解析逻辑没有改动，可能无法正确解析最新 iOS 版本的报文。报文表中标为未知或不确定的字段仍未解决。",
    "在 Linux 和 macOS 上，需下载对应版本的 Wireshark 源码，用项目提供的文件替换 epan/dissectors/packet-bthci_cmd.c，再编译 Wireshark。仓库还提交了 3.0.8 和 3.2.1 版的 64 位 Windows Wireshark 预编译安装程序，解析器 README 称它们基于 ShmooCon 2020 时的初版解析器，不应再使用。",
    "捕获广播需要 BLE 嗅探硬件：HARDWARE.md 推荐刷入 Nordic 嗅探固件的 Nordic nRF51 加密狗，或配合仓库内 btleshark.sh 抓包脚本使用的 Ubertooth One。分析对象是分析者自己捕获的广播，仓库中没有附带样本抓包。",
    "采用 GPL-2.0。README 指出，许多报文类型和字段含义最早由 Celosia 与 Cunche 在 PETS 2020 论文中发现。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/furiousMAC/continuity",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}