I2C driver (software implementation), for controlling I2C components (e.g. EEPROM on BLE Mini) Firmware upgradable via USB port (support TI CC2540 UBL 1.3) USB CDC which provides a virtual UART via USB port for connecting to an external device with the USB port (e.g. PC Windows/Linux or Mac OSX) Requirement. CC2540 hardware (e.g. The CC2540 USB Evaluation Module Kit contains one CC2540 Bluetooth low energy USB Dongle. The dongle can be used to enable Bluetooth low energy on your PC. Izotope bundle mac crack version. It can also be used as a packet sniffer for analyzing the BLE protocol and for software and system level debugging (use the free tool SmartRF Packet Sniffer ). Until Now I was working with the cc2540 USB dongle. I ran my program that includes USB CDC implementation. When I connected it to a windows 8 pc it was automatically identified,driver is installed and it worked fine. Now I am working with my costume board.

Project CC2540
Reverse engineering the CC2540 BLE sniffer dongle
Status	Stalled
Contact	bertrik
Last Update	2018-05-13

3Analysis
4Protocol
- 4.2Reading BLE frames

Status

At this point (2017-05-09), the status is:

it is pretty clear which commands the default sniffer firmware understands
I wrote a little test program to dump raw BLE frames
there is no plugin for WireShark yet

Introduction

This page is about the CC2540 bluetooth low-energy sniffer dongle and getting it to work with Linux.A nice end result could be that it becomes possible to sniff directly in WireShark with this dongle.

I have such a 'WeBee' dongle that can be found for about E15,- on websites like Aliexpress.

It's supposedly a CC2540 (or compatible) dongle, the USB id is 0451:16b3.

Interesting links:

Analysis

USB descriptor

When plugging this stick into a Linux machine, you can see it uses only one bulk endpoint.

Reading the identification from the stick with the 0xC0 command, results in the following 8-byte response

You can recognise the 2540 type number in there.

USB logs from Windows

This USB device does actually work with Windows:

I've captured a log of the communication over USB while the BLE is capturing bluetooth traffic from some iBeacon, using USB pcap.

In the logs, I cannot see any firmware blobs being downloaded to the stick.Probably the stick comes with a pre-loaded firmware of itself to do the BLE sniffing.

The USB control transfer request codes seem to match up with the code in https://github.com/christianpanton/ccsniffer/blob/master/ccsniffer.py

0xC0, GET_IDENT: returns some kind of identifier
0xC5, SET_POWER
0xC6, GET_POWER
0xC9, no idea, this appears in my USB logs but I can't find it in the python code
0xD0, START
0xD1, STOP
0xD2, SET CHAN

Protocol

In the windows sniffer software, it seems there are only two things communicated:

towards the stick: which radio channel to sniff, and some other radio settings
from the stick: raw sniffed BLE frames

Configuring the radio

This appears to be done using USB control transfers.

The following requests are sent:

Request type	Request	Index	Data	Description
0x40	0xC5	4	-	Set power
0xC0	0xC6	0	0x00	Get power
0xC0	0xC6	0	0x04	Get power
0x40	0xC9	0	-	???
0x40	0xD2	0	0x27	Set channel
0x40	0xD2	1	0x00	Set channel
0x40	0xD0	0	-	Start capture

Request type 0x40 is a vendor-specific device request from host-to-device.Request type 0xC0 is a vendor-specific device request from device-to-host.

Reading BLE frames

This appears to be done using USB bulk input transfers.

I can see a lot of similarities between the USB log and the BLE sniffer log.

Each frame starts with a byte indicating the type of frame, following by two bytes indicating the length of the rest of the frame (encoded as little endian).

data frames

The bulk USB data starts off with two bytes indicating the length of the rest of the data.

In the example image on the right:

00: 0 means this is a data frame
31 00: length of rest of frame encoded in little endian = 49 bytes decimal
39 04 29 54: part of the time stamp
2c d6 be .: data frame contents

unknown frames (tick or 'alive'?)

The stick also returns 4-byte frames, alternating between

and

Interpretation:

01: 1 means this is a frame of type 1
01 00: length of the rest of the frame encoded in little endian = 1 byte
40 or C0: unknown data byte

Software

Preliminary code can be found athttps://github.com/bertrik/cc2540

It connects to the dongle and dumps raw USB packets to stdout.

This software requires libusb-1.0-dev

Retrieved from ‘https://revspace.nl/index.php?title=CC2540&oldid=18383’

NOTICE: The Processors Wiki will End-of-Life on January 15, 2021. It is recommended to download any files or other content you may need that are hosted on processors.wiki.ti.com. The site is now set to read only.

The Bluetooth low energy (BLE) Device Monitor is a Windows application that serves as a monitoring and control application for TI SensorTag devices. In addition it offers some functionality that applies to all BLE devices.

4BLE Device Monitor first use
- 4.2Finding the correct COM port
5Connecting to a SensorTag (or any Bluetooth low energy device)
7Using the SensorTag tab
8Using the LaunchPad tab

Introduction[edit]

BLE Device Monitor connects to a BLE Central Device (Host) via a serial port. The following TI modules may serve as BLE hosts: CC2540 USB dongle, CC2650 LaunchPad, CC1350 LaunchPad and CC2640R2 LaunchPad. The host firmware is the HostTestApplication and is the same that BTOOL uses. The host firmware for all platforms is bundled with BLE Device Monitor.

BLE Device Monitor is available for download here.

The application (latest version 2.9.0) has been tested on Windows 7 and Windows 10.

**BLE Device Monitor** functionality
Feature	BLE Generic	TI BLE Devices	CC2541 SensorTag	CC2650/CC1350 SensorTag	Launchpad (CC2650,CC1350,CC2640R2) **
Device discovery	Y	Y	Y	Y	Y
Connect	Y	Y	Y	Y	Y
GATT explorer	Y	Y	Y	Y	Y
OAD	-	Y	Y	Y	Y
Display firmware revision	Y*	Y	Y	Y	Y
Display battery level	Y*	Y	-	Y	Y
Display Sensor Data	-	-	Y	Y	-
Control LED	-	-	Y	Y	Y
Control Buzzer	-	-	-	Y	-
Visualize button activity	-	-	Y	Y	Y
Visualize relay activity	-	-	-	Y	-
Visualize light intensity	-	-	-	Y	-
Wake On Motion	-	-	-	Y	-
Device reset	-	-	-	Y	Y
External Flash erase	-	-	-	Y	Y

Driver Ti Cc2540 Usb Cdc