android - 已配对安卓设备的蓝牙配置文件

Question

有什么方法可以获取配对的蓝牙设备的配置文件。 我已经能够配对蓝牙设备并且它已配对为 INPUT_DEVICE 在 android 中，我得到了 BluetoothDevice 的对象，其中包含地址和其他内容，但是如果 android 存储了它的配置文件，那么我们可以从那里获取配对的设备配置文件，比如 HEADSET 或 A2DP 或 INPUT_DEVICE 或其他。

我已经尝试过service listener的方法

private BluetoothProfile.ServiceListener listener=new BluetoothProfile.ServiceListener() {

        @Override
        public void onServiceDisconnected(int profile) {
            // TODO Auto-generated method stub
            //if(profile==BluetoothProfile.HEADSET)
                headSet=null;
        }

        @Override
        public void onServiceConnected(int profile, BluetoothProfile proxy) {
            // TODO Auto-generated method stub
            switch(profile){
            case BluetoothProfile.HEADSET:
                Log.e("found","headset");
                break;
            case BluetoothProfile.A2DP:
                Log.e("found","a2dp");
                activity.onA2DPListenr((BluetoothA2dp) proxy);
                break;
            case BluetoothProfile.HEALTH:
                Log.e("found","HEALTH");
                break;
            }


            }
        }
    };

现在每当我调用它时

activity.getAdapter().getProfileProxy(activity, listener,
                BluetoothProfile.HEADSET);

它会转到耳机日志，当我打电话时

activity.getAdapter().getProfileProxy(activity, listener,
                BluetoothProfile.HEALTH);

它会转到健康日志，并显示配置文件已连接到同一设备。但同一设备可以同时成为两者。

我的要求也与此完全不同，我不想尝试不同的场景来找出 android 已经包含的配对设备的实际配置文件，他们有什么方法可以获取实际配置文件..？

Answer 1

可以通过以下方式找到与 BluetoothDevice 关联的蓝牙配置文件或服务

    boolean hasLatestUuids=device.fetchUuidsWithSdp();
            if(hasLatestUuids){
/*getUuids() return cached uuids so we need to make an sdp request to get refresh uuid associated with the device*/
                ParcelUuid[] uu=device.getUuids();
                for(ParcelUuid u:uu){
                    Log.e("found","uuid "+u.getUuid());
                }
            }

我们也可以通过反射发出请求:

Method m=null;
        boolean hasLatestUuid=false;
        try {
            m=BluetoothDevice.class.getDeclaredMethod("fetchUuidsWithSdp", null);
            m.setAccessible(true);
            hasLatestUuid=(Boolean) m.invoke(device, null);
        } catch (NoSuchMethodException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IllegalArgumentException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (InvocationTargetException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        ParcelUuid[] uuids=null;
if(hasLatestUuid){
    try {
        m=device.getClass().getDeclaredMethod("getUuids", null);
        m.setAccessible(true);
        uuids=(ParcelUuid[]) m.invoke(device, null);
    } catch (NoSuchMethodException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IllegalArgumentException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IllegalAccessException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (InvocationTargetException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    if(uuids!=null){
        for(ParcelUuid u:uuids){
            Log.e("found","uuid "+u.describeContents());
            Log.e("found","uuid "+u.getUuid());
        }
    }

此处日志返回远程设备支持的 uuid 列表，例如在我的情况下我需要连接到两个不同的设备，第一个具有 HID 配置文件，第二个具有串行端口或套接字，所以

对于串行端口设备，我得到 uuid:00001101-0000-1000-8000-00805f9b34fb

对于 HumanInterface，我得到 uuid:00001124-0000-1000-8000-00805f9b34fb

它有 bas_uuid:00000000-0000-1000-8000-00805F9B34FB 和串行端口:0x1101 和 HID:0x1124

所有这些信息都可以找到http://bluetooth-pentest.narod.ru/doc/assigned_numbers_-_service_discovery.html

我们也可以通过 BluetoothClass 检查这个，即

public static final int PROFILE_HEADSET = 0;
/** @hide */
public static final int PROFILE_A2DP = 1;
/** @hide */
public static final int PROFILE_OPP = 2;
/** @hide */
public static final int PROFILE_HID = 3;
/** @hide */
public static final int PROFILE_PANU = 4;
/** @hide */
public static final int PROFILE_NAP = 5;


BluetoothClass myClass=device.getBluetoothClass();
        int val=myClass.getDeviceClass();
        Log.e("found","class "+val);
        Log.e("found","class "+(val|bitmask));

        Log.e("found","PROFILE_HEADSET:"+doesclassMatch(PROFILE_HEADSET,myClass));
        Log.e("found","PROFILE_A2DP:"+doesclassMatch(PROFILE_A2DP,myClass));
        Log.e("found","PROFILE_OPP:"+doesclassMatch(PROFILE_OPP,myClass));
        Log.e("found","PROFILE_HID:"+doesclassMatch(PROFILE_HID,myClass));
        Log.e("found","PROFILE_PANU:"+doesclassMatch(PROFILE_PANU,myClass));
        Log.e("found","PROFILE_NAP:"+doesclassMatch(PROFILE_NAP,myClass));




private boolean doesclassMatch(int profile,BluetoothClass myClass){
    Method m=null;
    try {
        m=BluetoothClass.class.getMethod("doesClassMatch", new Class[]{int.class});
        m.setAccessible(true);
        return (Boolean) m.invoke(myClass, profile);
    } catch (NoSuchMethodException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IllegalArgumentException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IllegalAccessException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (InvocationTargetException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
    return false;

}

它将针对设备包含的特定类型或服务返回 true。

但根据 BluetoothClass 规范:

BluetoothClass is useful as a hint to roughly describe a device
 * (for example to show an icon in the UI), but does not reliably describe which
 * Bluetooth profiles or services are actually supported by a device. Accurate
 * service discovery is done through SDP requests, which are automatically
 * performed when creating an RFCOMM socket with 
 * BluetoothDevice#createRfcommSocketToServiceRecord} and 
 * BluetoothAdapter#listenUsingRfcommWithServiceRecord

https://android.googlesource.com/platform/frameworks/base/+/4f868ed/core/java/android/bluetooth/BluetoothClass.java