DissPair

org.disspair.disspair
by Zapstore _@zapstore.dev

Audit Bluetooth Classic and BLE devices: RFCOMM, GATT and advertisements

Republished from GitHub / F-Droid by the Zapstore main account.

DissPair is an open-source Bluetooth security toolkit for auditing **Bluetooth Classic (RFCOMM)** and **Bluetooth Low Energy (BLE)** devices you own or are authorized to test. Instead of trusting what a device advertises, it actively probes how the device really behaves. Two CVEs have been found with it (CVE-2026-31280, CVE-2025-67133). **Discovery** - Scan Classic (BR/EDR) and BLE devices, plus already-paired devices - Device class tags, RSSI and filters for unnamed and paired devices **Bluetooth Classic (RFCOMM)** - Sweep RFCOMM channels 1-30 and see which accept unpaired (insecure) or paired connections - Send AT commands and OBEX payloads, with automatic HFP handshake handling - Flood test to stress a channel's buffer handling **BLE advertisement inspector (GAP)** - Decodes every advertising field: flags, service UUIDs, names, TX power, appearance, service and manufacturer data - Vendor formats: Apple Continuity (iBeacon, AirDrop, Handoff, Nearby Info, Find My), Eddystone, Google Fast Pair - Privacy checks: public vs rotating addresses, identifiers in device names, tracker beacons (Find My, SmartTag, Tile) - Advertising interval estimate, RSSI graph, legacy/extended PDU, PHY and connectable flags **BLE GATT analysis** - Full service and characteristic map with standard and vendor names - Read and write (with or without response), hex or text - Subscribe to notifications and indications with a live log - Automatic maximum MTU negotiation **GATT access audit** - One tap tests what every characteristic allows without pairing: read, subscribe and write - Results marked OPEN, AUTH, ENC, AUTHZ, KEY or DENY - Optional write test: echo the value just read, or commit a chosen payload - Exportable text report for vendor disclosure Follows the system light or dark theme. A companion Linux CLI is available in the source repository. **Warning:** some features (flooding, payload injection, writes) can disrupt or reconfigure the target device. Use only on hardware you own or have explicit permission to test.

First release: Oct 13, 2026, 1 total release.

Most recent release: Oct 13, 2026.

Repo

Appears in 0 app stacks.

0 sats / 0 zaps received in the past year.

Sats Received

Underlying data available via MCP: app_zaps, app_releases.

Zap Count

Underlying data available via MCP: app_zaps, app_releases.

Releases

  • Oct 13, 2026 2.2.0
    ## DissPair v2.2.0 ### New **Advertisement Inspector (GAP)** Tap **ADV** on any BLE device to see what it broadcasts, without connecting. Updates live while scanning. - Decodes every advertising data field: flags, service UUIDs (with names), local name, TX power, appearance, service and manufacturer data, Mesh, URI and more. Malformed advertisements are flagged. - Vendor formats: Apple Continuity (iBeacon, AirDrop, Proximity Pairing, Handoff, Nearby Info/Action, Find My), Eddystone UID/URL/TLM/EID, Google Fast Pair, company-ID lookup. - Privacy checks: address type (public / random static / resolvable private / non-resolvable), private addresses that never rotate, serials or MAC fragments in device names, tracker beacons (Find My, SmartTag, Tile). - Over time: estimated advertising interval, RSSI graph, payload changes, PDU details (legacy/extended, connectable, PHY, TX power).
    More…
    - Risk flags for exposed firmware-update (DFU) and Nordic UART services. - **COPY / SHARE** a full report, or jump straight to GATT analysis. **GATT Access Audit** One tap tests what every characteristic allows **without pairing**. - Read, subscribe and write results labelled `OPEN` / `AUTH` / `ENC` / `AUTHZ` / `KEY` / `DENY`. - Write test: **Off**, **Echo only** (safe), or **Echo + commit** a payload you choose. - Exportable text report for vendor disclosure. **GATT improvements** - **SUB / UNSUB** for notifications and indications, with a live notification log. - Write-without-response support: characteristics that only allow it are now writable. - Maximum MTU requested automatically on connect; payload limits follow the negotiated MTU. - Real names for standard and vendor services (ANCS, AMS, Device Information, Nordic UART/DFU, …). - Readable text shown alongside hex values. - Error codes shown by name (e.g. `INSUFFICIENT_AUTHENTICATION`). **Appearance** - Follows the system light/dark theme, with a manual **System / Light / Dark** toggle. - New app icon, adapted for all launcher shapes. ### Fixed - Back gesture returns to the main screen instead of exiting the app. - Rapid GATT actions are no longer silently dropped (all operations are queued). - Reads were handled twice on Android 13+. - Dual-mode devices now connect over BLE for GATT analysis.