Thesis in Progress

21 Entries found


After reverse engineering the firmware of BCM4339 WiFi chips, we now intend to continue with the Bluetooth tranceiver that is included in the chip. In this thesis, you will extract the Bluetooth firmware, analyze how it interacts with the WiFi core and how we can use it to perform attacks or extend the capabilites of Bluetooth in a smartphone.

Here are some references, of our previous work:

[1] M. Schulz, D. Wegemer, M. Hollick. DEMO: Using NexMon, the C-based WiFi firmware modification framework, Proceedings of the 9th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2016, July 2016. [pdf]

[2] M. Schulz, D. Wegemer and M. Hollick. NexMon: A Cookbook for Firmware Modifications on Smartphones to Enable Monitor Mode, CoRR, vol. abs/1601.07077, December 2015. [bibtex]


Bachelor Thesis


Bachelor Thesis

In recent macOS and iOS devices, Apple includes IEEE 802.11ac chipsets with which it is possible to communicate directly between two peers while remaining connected to an infrastructure WiFi which requires some sort of channel hopping. As a proprietary protocol, Apple Wireless Direct Link (AWDL) is known to be used by AirPlay, AirDrop, and the Multipeer Connectivity Framework.

Reverse engineering AWDL could pave to way for a vendor-independent high-performance device-to-device link layer which would be highly beneficial for use cases such as emergency communication.

Using tools such as Wireshark and IDA Pro:

  • Gain as much information as possible about AWDL (frame format, protocol state machine, ...)
  • Write a Wireshark plugin to document your findings
  • Finally, connect a non-Apple device via AWDL

Prof. Dr.-Ing. Matthias Hollick

Technische Universität Darmstadt
Department of Computer Science
Secure Mobile Networking Lab 

Mornewegstr. 32 (S4/14)
64293 Darmstadt, Germany

Phone: +49 6151 16-25472
Fax: +49 6151 16-25471

A A A | Drucken Drucken | Impressum Impressum | Sitemap Sitemap | Suche Suche | Kontakt Kontakt | Webseitenanalyse: Mehr Informationen
zum Seitenanfangzum Seitenanfang