harald

statically analyze a vendor android app (.apk, .xapk or .apks) already on disk. detects the framework. for a native app it runs jadx and lists the uuids (gatt and rfcomm) in gatt_uuids and file:line candidates (uuids, aes keys, base64 blobs, command builders, rfcomm socket calls) to open under jadx_dir, the app's own package first and third-party libraries skipped. each list keeps at most 50 per kind; totals has the full counts, and when anything was cut a warning names the file under jadx_dir that lists them all. flutter and react-native apps keep their ble code compiled, so the warnings point to capture analysis instead. harald never downloads apps.

list the bluetooth classic devices paired with this computer. connected says whether each is linked to this computer now. use an address from here with classic_services, classic_send and classic_listen.

open a classic device's rfcomm channel, send nothing, and collect `seconds` (at most 30) of what it says. needs no arm, but standard profiles are still refused. service is an rfcomm service uuid or channel number from classic_services. returns one entry per chunk: seconds since the channel opened and the value as hex.

send hex messages to a classic device's rfcomm channel and collect its answers. refused unless the human armed this device by running `harald arm <address>` in their own terminal. each message spends one armed write, a query included, because classic has no read. all messages go over one connection, in order, with `listen` seconds (at most 30) of listening after each, so handshakes and acks can be sent as messages. service is an rfcomm service uuid or channel number from classic_services; standard profiles and channels missing from classic_services are refused, and firmware-update channels stay blocked. received holds each chunk with the message number it followed (0 = before the first), seconds since the channel opened and the value as hex. stopped explains a budget that ran out partway, or a link that failed after the first message; it is empty when every message was sent.

list a paired classic device's service records from this computer's cache. each record has a name, service-class uuids and an rfcomm channel (null when rfcomm cannot reach it). protected channels are standard profiles such as hands-free and headset, which harald never opens; firmware_update channels stay blocked for writes. refresh=true asks the device again instead of trusting the cache.

connect to a device and list its gatt services and their characteristics. use the characteristic uuids listed here with read_char, write_char and subscribe.

compare hex payloads byte by byte. returns how many payloads have each length, the byte at every position that is the same in all of them (over the shortest), the positions that vary, and whether the set looks like block-cipher output.

name the checksums and length fields one hex payload is consistent with. checks sum8 and xor8 in the last byte, and the byte before a trailing end marker, over the bytes after a leading start marker; crc16-ccitt in the last two; and a length byte at position 0 or 1.

list the gadgets in harald's device library, with status and summary.

the device library entry for one slug, including any app-wide key and cipher.

show the att and rfcomm timeline of a phone capture (.pklg or btsnoop log). one line per event with time, acl connection, direction, op and value hex. att events show their handle and uuid; rfcomm events (rfcomm data, rfcomm_open and rfcomm_close) show their server channel, e.g. ch=9. any warnings come first and a `showing a–b of n events` footer comes last. a capture can hold several connections, each with its own handles. page with limit and offset. handle (an integer, e.g. 18 for h=0x0012) keeps only att events on that handle, channel (e.g. 9) only rfcomm events on that channel, conn (e.g. 64 for c=0x0040) only events on that connection, and offset then counts those filtered events. for a bluetooth classic gadget, capture its android app in a btsnoop log: an iphone app reaches classic gadgets only through apple iap2, which harald shows as rfcomm data but can't unwrap yet. relative paths resolve against the server's working directory.

read a characteristic once; returns its value as hex.

the working notes for a device, or an empty string when there are none. notes live in harald-work/<slug>/notes.md, relative to the server's working directory.

append a timestamped note to harald-work/<slug>/notes.md. the path is relative to the server's working directory. slugs use lowercase letters, digits and hyphens, e.g. demo-lamp.

scan for bluetooth le devices for `timeout` seconds, strongest signal first. manufacturer_data maps each company id (as 0x-hex) to its payload hex.

collect notifications from a characteristic for `seconds`. returns one entry per notification: seconds since the start and the value as hex.

decrypt hex payloads with each candidate aes key, in ecb and in cbc with a zero iv, best-scoring first. samples holds the first plaintexts as hex. the score only tells keys apart across several distinct payloads: with one payload, or identical copies, every key scores 1.0. keys that are not 16, 24 or 32 bytes and payloads that are not a multiple of 16 bytes are skipped.

write hex bytes to a characteristic; returns the writes left. refused unless the human armed this device by running `harald arm <address>` in their own terminal. each write spends one from that budget, and firmware-update services stay blocked. by default it writes without response when the characteristic allows that, and with response otherwise. response=true waits for the device to acknowledge the write; false does not.