idevicebtlogger: Switch to using DLT_BLUETOOTH_HCI_H4_WITH_PHDR (201) and capture direction for better decoding in wireshark.

1 files changed, 20 insertions, 3 deletions

diff --git a/tools/idevicebtlogger.c b/tools/idevicebtlogger.c
index 48be01a..8728ef0 100644
--- a/tools/idevicebtlogger.c
+++ b/tools/idevicebtlogger.c
@@ -45,6 +45,10 @@
 #include <libimobiledevice/bt_packet_logger.h>
 #include <pcap.h>
 
+#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201
+#define LIBPCAP_BT_PHDR_SENT    0x00000000
+#define LIBPCAP_BT_PHDR_RECV    htonl(0x00000001)
+
 static int quit_flag = 0;
 static int exit_on_disconnect = 0;
 
@@ -67,9 +71,10 @@ static void bt_packet_logger_callback(uint8_t * data, uint16_t len, void *user_d
         bt_packet_logger_header_t * header = (bt_packet_logger_header_t *)data;
         uint16_t offset = sizeof(bt_packet_logger_header_t);
 
+        // size + sizeof(uint32_t) to account for the direction pseudo header
         struct pcap_pkthdr pcap_header;
-        pcap_header.caplen = ntohl(header->length);
-        pcap_header.len = len - sizeof(bt_packet_logger_header_t);
+        pcap_header.caplen = ntohl(header->length) + sizeof(uint32_t);
+        pcap_header.len = len - sizeof(bt_packet_logger_header_t) + sizeof(uint32_t);
         pcap_header.ts.tv_sec = ntohl(header->ts_secs);
         pcap_header.ts.tv_usec = ntohl(header->ts_usecs);
 
@@ -81,31 +86,43 @@ static void bt_packet_logger_callback(uint8_t * data, uint16_t len, void *user_d
 
         uint8_t packet_type = data[offset];
         uint8_t hci_h4_type = 0xff;
+        uint32_t direction;
 
         switch(packet_type) {
                 case HCI_EVENT:
                         hci_h4_type = 0x04;
+                        direction = LIBPCAP_BT_PHDR_RECV;
                         break;
 
                 case HCI_COMMAND:
                         hci_h4_type = 0x01;
+                        direction = LIBPCAP_BT_PHDR_SENT;
                         break;
 
                 case SENT_ACL_DATA:
                         hci_h4_type = 0x02;
+                        direction = LIBPCAP_BT_PHDR_SENT;
                         break;
 
                 case RECV_ACL_DATA:
                         hci_h4_type = 0x02;
+                        direction = LIBPCAP_BT_PHDR_RECV;
                         break;
 
                 default:
                         // unknown packet logger type, just pass it on
                         hci_h4_type = packet_type;
+                        direction = LIBPCAP_BT_PHDR_RECV;
                         break;
         }
         if(hci_h4_type != 0xff) {
                 data[offset] = hci_h4_type;
+                // we know we are sizeof(bt_packet_logger_header_t) into the buffer passed in to
+                // this function.  We need to add the uint32_t pseudo header to the front of the packet
+                // so adjust the offset back by sizeof(uint32_t) and write it to the buffer.  This avoids
+                // having to memcpy things around.
+                offset -= sizeof(uint32_t);
+                *(uint32_t*)&data[offset] = direction;
                 pcap_dump((unsigned char*)dump, &pcap_header, &data[offset]);
                 pcap_dump_flush(dump);
         }
@@ -328,7 +345,7 @@ int main(int argc, char *argv[])
                 }
         }
 
-        dump = pcap_dump_open(pcap_open_dead(187, BT_MAX_PACKET_SIZE), out_filename);
+        dump = pcap_dump_open(pcap_open_dead(DLT_BLUETOOTH_HCI_H4_WITH_PHDR, BT_MAX_PACKET_SIZE), out_filename);
         idevice_event_subscribe(device_event_cb, NULL);
 
         while (!quit_flag) {