DissPair
Audit Bluetooth Classic and BLE devices: RFCOMM, GATT and advertisements
新版本 2.2.0
New in 2.2.0:
- Advertisement inspector (ADV): decodes advertising data, Apple Continuity, Eddystone, Fast Pair; privacy and tracker checks, interval and RSSI graph
- GATT: notifications, write-without-response, MTU, named services
- GATT access audit with optional write probes and exportable report
- System light/dark theme, new icon
- Back returns to the main screen
- Advertisement inspector (ADV): decodes advertising data, Apple Continuity, Eddystone, Fast Pair; privacy and tracker checks, interval and RSSI graph
- GATT: notifications, write-without-response, MTU, named services
- GATT access audit with optional write probes and exportable report
- System light/dark theme, new icon
- Back returns to the main screen
DissPair is an open-source Bluetooth security toolkit for auditing Bluetooth Classic (RFCOMM) and Bluetooth Low Energy (BLE) devices you own or are authorized to test. Instead of trusting what a device advertises, it actively probes how the device really behaves. Two CVEs have been found with it (CVE-2026-31280, CVE-2025-67133).
Discovery
Bluetooth Classic (RFCOMM)
BLE advertisement inspector (GAP)
BLE GATT analysis
GATT access audit
Follows the system light or dark theme. A companion Linux CLI is available in the source repository.
Warning: some features (flooding, payload injection, writes) can disrupt or reconfigure the target device. Use only on hardware you own or have explicit permission to test.
Discovery
- Scan Classic (BR/EDR) and BLE devices, plus already-paired devices
- Device class tags, RSSI and filters for unnamed and paired devices
Bluetooth Classic (RFCOMM)
- Sweep RFCOMM channels 1-30 and see which accept unpaired (insecure) or paired connections
- Send AT commands and OBEX payloads, with automatic HFP handshake handling
- Flood test to stress a channel's buffer handling
BLE advertisement inspector (GAP)
- Decodes every advertising field: flags, service UUIDs, names, TX power, appearance, service and manufacturer data
- Vendor formats: Apple Continuity (iBeacon, AirDrop, Handoff, Nearby Info, Find My), Eddystone, Google Fast Pair
- Privacy checks: public vs rotating addresses, identifiers in device names, tracker beacons (Find My, SmartTag, Tile)
- Advertising interval estimate, RSSI graph, legacy/extended PDU, PHY and connectable flags
BLE GATT analysis
- Full service and characteristic map with standard and vendor names
- Read and write (with or without response), hex or text
- Subscribe to notifications and indications with a live log
- Automatic maximum MTU negotiation
GATT access audit
- One tap tests what every characteristic allows without pairing: read, subscribe and write
- Results marked OPEN, AUTH, ENC, AUTHZ, KEY or DENY
- Optional write test: echo the value just read, or commit a chosen payload
- Exportable text report for vendor disclosure
Follows the system light or dark theme. A companion Linux CLI is available in the source repository.
Warning: some features (flooding, payload injection, writes) can disrupt or reconfigure the target device. Use only on hardware you own or have explicit permission to test.
- 作者: ThreadpoolX and Tapadyuti Baral
- 授權條款: GNU General Public License v3.0 only
- 問題追蹤系統
- 原始碼
- 建置詮釋資料
- 可重現建置狀態
捐助
版本
雖然在下方可選擇下載 APK 檔案，但要留意這樣的安裝方式將不會收到更新通知，是一種較不安全的下載方法。建議您先安裝 F-Droid 用戶端使用。
下載 F-Droid-
arm64-v8aarmeabi-v7ax86x86_64此版本需要 Android 7.0 或更高的版本。
此套件包由原開發者建置和簽署，並保證與此原始碼 Tarball 保持一致。
-
arm64-v8aarmeabi-v7ax86x86_64此版本需要 Android 7.0 或更高的版本。
此套件包由原開發者建置和簽署，並保證與此原始碼 Tarball 保持一致。