DissPair
Audit Bluetooth Classic and BLE devices: RFCOMM, GATT and advertisements
新版本 2.2.0
New in 2.2.0:
- Advertisement inspector (ADV): decodes advertising data, Apple Continuity, Eddystone, Fast Pair; privacy and tracker checks, interval and RSSI graph
- GATT: notifications, write-without-response, MTU, named services
- GATT access audit with optional write probes and exportable report
- System light/dark theme, new icon
- Back returns to the main screen
- Advertisement inspector (ADV): decodes advertising data, Apple Continuity, Eddystone, Fast Pair; privacy and tracker checks, interval and RSSI graph
- GATT: notifications, write-without-response, MTU, named services
- GATT access audit with optional write probes and exportable report
- System light/dark theme, new icon
- Back returns to the main screen
DissPair is an open-source Bluetooth security toolkit for auditing Bluetooth Classic (RFCOMM) and Bluetooth Low Energy (BLE) devices you own or are authorized to test. Instead of trusting what a device advertises, it actively probes how the device really behaves. Two CVEs have been found with it (CVE-2026-31280, CVE-2025-67133).
Discovery
Bluetooth Classic (RFCOMM)
BLE advertisement inspector (GAP)
BLE GATT analysis
GATT access audit
Follows the system light or dark theme. A companion Linux CLI is available in the source repository.
Warning: some features (flooding, payload injection, writes) can disrupt or reconfigure the target device. Use only on hardware you own or have explicit permission to test.
Discovery
- Scan Classic (BR/EDR) and BLE devices, plus already-paired devices
- Device class tags, RSSI and filters for unnamed and paired devices
Bluetooth Classic (RFCOMM)
- Sweep RFCOMM channels 1-30 and see which accept unpaired (insecure) or paired connections
- Send AT commands and OBEX payloads, with automatic HFP handshake handling
- Flood test to stress a channel's buffer handling
BLE advertisement inspector (GAP)
- Decodes every advertising field: flags, service UUIDs, names, TX power, appearance, service and manufacturer data
- Vendor formats: Apple Continuity (iBeacon, AirDrop, Handoff, Nearby Info, Find My), Eddystone, Google Fast Pair
- Privacy checks: public vs rotating addresses, identifiers in device names, tracker beacons (Find My, SmartTag, Tile)
- Advertising interval estimate, RSSI graph, legacy/extended PDU, PHY and connectable flags
BLE GATT analysis
- Full service and characteristic map with standard and vendor names
- Read and write (with or without response), hex or text
- Subscribe to notifications and indications with a live log
- Automatic maximum MTU negotiation
GATT access audit
- One tap tests what every characteristic allows without pairing: read, subscribe and write
- Results marked OPEN, AUTH, ENC, AUTHZ, KEY or DENY
- Optional write test: echo the value just read, or commit a chosen payload
- Exportable text report for vendor disclosure
Follows the system light or dark theme. A companion Linux CLI is available in the source repository.
Warning: some features (flooding, payload injection, writes) can disrupt or reconfigure the target device. Use only on hardware you own or have explicit permission to test.
- 作者: ThreadpoolX and Tapadyuti Baral
- 许可: GNU General Public License v3.0 only
- 问题跟踪系统
- 源代码
- 构建元数据
- 可重复性状态
捐赠
版本
尽管下面提供了 APK 安装包的下载选项，但你应该注意，以这种方式安装将不会收到更新通知，这是一种不太安全的下载方式。 我们建议你安装使用 F-Droid 客户端。
下载 F-Droid-
arm64-v8aarmeabi-v7ax86x86_64该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
arm64-v8aarmeabi-v7ax86x86_64该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。