nccgroup / blesuite

BLESuite is a Python package that provides an easier way to test Bluetooth Low Energy (BLE) device

BLESuite README

Overview

BLESuite is a python package to make Bluetooth Low Energy (BLE) device communication more user friendly and enables rapid BLE device testing. Version 2 of BLESuite removes the dependency on PyGattlib and BlueZ and instead uses a modified version of PyBT (https://github.com/mikeryan/PyBT) to implement and manage our own BLE stack. This version increases communication reliability, increases communication flexibility, improves device scanning, and enables device fuzzing at the host layers of the Bluetooth stack. The stack utilized by BLESuite intentionally allows malformed requests/responses to be sent to devices in order to enable device testing.

Features:

• Includes 2 CLI tools to facilitate basic BLESuite operations: blesuite and ble-replay
• Support for the Central and Peripheral BLE roles
• Supports multiple HCI devices (such as a USB Bluetooth adapter)
• With a HCI device used for a central role, support for numerous simultaneous connections to peripherals (limited by the HCI controller's maximum number of connections)
• Scan for BLE devices
• Scan BLE devices for all GATT entities
• Quickly and easily send ATT requests to a peer peripheral device
• Construct and send carefully constructed (or intentionally malformed) L2CAP and ATT packets to a target devices
• Supports JustWorks LE Legacy pairing. Additional pairing methods will be available in a later version
• Quickly spin up a GATT server using an abstract object definition and numerous helper functions
• Support for GATT server import and export
• Support for Security Manager Long Term Key Database import and export
• Optionally, install a Python API-friendly version of BlueZ's BDADDR tool (https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/tools/bdaddr.c) that enables a user to spoof the BD_ADDR of their host's Bluetooth adapter (only supports some chipsets. This is a modified version of the BlueZ's bdaddr.c)

Note to the reader:

In order to access Bluetooth Low Energy functionality, you must have access to a Bluetooth adapter that supports it.

Why BLESuite?

The goal of BLESuite is to provide a simplified method of quickly scripting communication with target BLE devices for security assessments. Combined with the move from PyGattlib and BlueZ to PyBT, we now can have more control over the BLE stack and use it to test various BLE stack layers of a target device.

Additionally, BLESuite is no longer restricted to just using the Central role. BLESuite now supports the Peripheral role and allows users to quickly configure and stand-up a GATT server that can be used to test Central role BLE devices (or dual role devices).

Installation

The following are installation instruction for the BLESuite Python package.

Prerequisites

Supported Operating Systems:

BLESuite was developed and tested against Debian 9.3. The library may be supported by other Linux distributions, however support is not currently guaranteed.

Note: Recent attempts to use BLESuite with Fedora 28 were achieved by installing the following items:

• dnf install bluez-libs-devel python2-devel python2-sphinx python2-gevent
• follow the rest of the installtion instructions to install the supplied version of Scapy and BLESuite

With Fedora 28, there has been one non-repeatable reported issue with BLESuite related to a TypeError that is not present in Debian 9.3 installations when attemtping to handle an incoming ATT request.

Fix contributions welcome!

Required Software

The following are requirements in order to use BLESuite:

• libbluetooth-dev
• libpython-dev
• python-sphinx
• gevent (https://pypi.org/project/gevent/)
• Scapy (https://github.com/secdev/scapy/) (MUST BE INSTALLED FROM THE COPY IN THIS REPOSITORY FOR NOW)
  • This version of Scapy includes several modifications to the bluetooth.py layer that supports several new packet types and gracefully closes the BluetoothUserSocket. These changes are not currently available in Scapy's mainline.
• pycrypto (https://pypi.org/project/pycrypto/)
• pyshark (https://github.com/KimiNewt/pyshark/)
• prettytable (https://pypi.org/project/PrettyTable/)
• sphinx_rtd_theme (https://pypi.org/project/sphinx_rtd_theme/) - For compiling documentation

After installing libbluetooth-dev, libpython-dev, and python-sphinx, run the following to install the remaining Python dependencies:

pip install -r requirements.txt

Documentation

From the docs folder, run:

make html

Then in docs/_build/html a full set of documentation and reference guides will be available.

Installing Everything

Run the following command to install the python package:

python setup.py install

If you do not want to install the BDADDR Python API or are having issues getting it to install, comment out the following line in setup.py and re-run the command above:

ext_modules = [c_ext],

Future Plans

Full pairing support

As of now, BLESuite can only support LE Legacy JustWorks pairing. The Security Manager has mostly outlined, but the remaining cryptographic programming for LESC and the alternate association models still need to be implemented.

Signed write support

The ATT signed write operation is currently not supported by BLESuite. This is not a commonly used operation, however in order to support security mode 2, it should be supported.

Further support for private addresses

BLESuite currently only supports Public and Random (static) addresses. However, Random addresses can be of two sub-types: Static or Private. A Random Private address can also be broken down into two sub-types not supported currently by BLESuite: Non-resolvable Private address and Resolvable Private address (resolved using IRK exchanged during pairing).

As such, functionality to set these types of addresses to the host adapter is not currently exposed by BLESuite. Also, the ability to resolve Random resolvable addresses of a peer based on an exchanged IRK is not yet implemented.

Additional Tooling Built Using BLESuite

With the library built, the next step is to build security assessment tooling that utilizes this library.

Once such example that we have included with this library is ble-replay, which can take in a BLE packet capture and replay the GATT traffic to a target device. ble-replay can quickly help identify application layer security flaws related to replay attacks.

These sorts of tools decrease the time spent manually analyzing packet captures and manually scripting BLE communication test cases.

blesuite's Issues

Scan (or any other socket-related operation) hangs at recv().

The program hangs whenever it uses a bluetooth socket. The following examples are extracted from a simple scan executed with the following command:

sudo blesuite -i 1 scan

Fiddling with the code, I set up a timeout of 15 seconds where the socket gets created, and then I get the following traceback:

Traceback (most recent call last):
  File "/usr/local/bin/blesuite", line 10, in <module>    
    blesuite_cli.main()
  File "/usr/local/lib/python2.7/dist-packages/blesuite/cli/blesuite_cli.py", line 364, in main
    process_args(args)
  File "/usr/local/lib/python2.7/dist-packages/blesuite/cli/blesuite_cli.py", line 171, in process_args 
    with BLEConnectionManager(args.adapter[0], 'central') as connection_manager:
  File "/usr/local/lib/python2.7/dist-packages/blesuite/connection_manager.py", line 131, in __init__
    self._create_central()
  File "/usr/local/lib/python2.7/dist-packages/blesuite/connection_manager.py", line 174, in _create_central
    att_operation_event_hook=self.att_operation_event_hook)
  File "/usr/local/lib/python2.7/dist-packages/blesuite/pybt/roles.py", line 26, in __init__ 
    self.stack = BTStack(adapter=adapter)
  File "/usr/local/lib/python2.7/dist-packages/blesuite/pybt/stack.py", line 144, in __init__
    r = self.command(HCI_Cmd_Read_BD_Addr())
  File "/usr/local/lib/python2.7/dist-packages/blesuite/pybt/stack.py", line 375, in command
    return self.s.send_command(HCI_Hdr()/HCI_Command_Hdr()/cmd)
  File "/usr/local/lib/python2.7/dist-packages/scapy-2.4.3rc1.dev132-py2.7.egg/scapy/layers/bluetooth.py", line 1415, in send_command
    r = self.recv()
  File "/usr/local/lib/python2.7/dist-packages/scapy-2.4.3rc1.dev132-py2.7.egg/scapy/layers/bluetooth.py", line 1423, in recv
    return HCI_Hdr(self.ins.recv(x))

The debug output of the same command shows:

BTLE Scan beginning
DEBUG:blesuite.connection_manager:creating central
DEBUG:blesuite.pybt.stack:[!] Creating socket failed: BluetoothSocketError('Unable to bind',)

DEBUG:blesuite.pybt.stack:[+] have root, attempting to take iface down

DEBUG:blesuite.pybt.stack:Trying to set reuseaddr
DEBUG:blesuite.pybt.stack:Settings ins reuse

and then stays there.
I tried versions 2.4.0 and 2.4.3rc1.dev132 of scapy, with the same results.

I have no clue where to keep looking, if there is any other information needed, I will reply as soon as I can.

Thank you all.

Unable to handle indications

Indications are being handled as nopayload packets by scapy so it fails a marshall_request() in pybt.att.

AttributeError is raised on line 154 for req_pkt.gatt_handle

global name 'HCI_Cmd_LE_Set_Scan_Response_Data' is not defined

On Running advertising.py, I see following error. Any idea how to get around this?

pi@PiG-SNA3-019:~/BLESuite/docs/examples $ sudo python advertising.py
Traceback (most recent call last):
File "advertising.py", line 34, in
connection_manager.set_scan_response_data(ad_entries)
File "/usr/local/lib/python2.7/dist-packages/blesuite/connection_manager.py", line 847, in set_scan_response_data
self.stack_connection.set_scan_response_data(data)
File "/usr/local/lib/python2.7/dist-packages/blesuite/pybt/core.py", line 567, in set_scan_response_data
self.role.stack.set_scan_response_data(data)
File "/usr/local/lib/python2.7/dist-packages/blesuite/pybt/stack.py", line 147, in set_scan_response_data
self.command(HCI_Cmd_LE_Set_Scan_Response_Data(data=data))
NameError: global name 'HCI_Cmd_LE_Set_Scan_Response_Data' is not defined

can it check battery level

i want to write a ware to show bluetooth's battery ,in dynamic

Error in `python': double free or corruption (fasttop)

When I run the following python script, it throws an error

sudo python /opt/temp-pal/bleSuite-runner.py smartScan --addr 50:65:83:20:B7:E6
BTLE Smart Scan beginning
*** Error in `python': double free or corruption (fasttop): 0xb5702a00 ***
Aborted

Does anyone know what needs to be done to fix this? Thanks

unknow problem about ble-replay

Follow the instructions to perform the results:

root@kali:~# ble-replay -i 0 -d AC:9A:22:C4:84:E8 -p '/root/tmp/btsnoop_hci.log' -r
loading file
Btsnoop capture file version 1, type 1002
DEBUG:blesuite.connection_manager:creating central
DEBUG:blesuite.pybt.stack:Trying to set reuseaddr
DEBUG:blesuite.pybt.stack:Settings ins reuse

The program stopped here and there was no response. I used the wireshark to capture the Bluetooth port and only sent a hci_cmd package. The content is: 01 09 10 00, I don't know what the problem is. I tried https://github.com/nccgroup/BLE-Replay this tool, but the effect is even worse, as shown below:

root@kali:~/code/BLE-Replay-master# python ble-replay.py -h
Traceback (most recent call last):
  File "ble-replay.py", line 1, in <module>
    import hci_parser
  File "/root/code/BLE-Replay-master/hci_parser.py", line 3, in <module>
    import util
  File "/root/code/BLE-Replay-master/util.py", line 4, in <module>
    from blesuite.bleServiceManager import bleServiceWriteToHandle
ImportError: No module named bleServiceManager

I used grep to search the directory of BLEsulte, and did not find the string about bleServiceManager. Is this the reason for the version aid change? Is this class still useful?

I hope you can see, thank you, I urgently need to do some testing, I hope BLEsuite can help me.

Characteristic value not updated during connection

Hello,
we are writing a project in order to test a mobile app developed by our company.
This project creates a peripheral device that has to expose some services and characteristics that the app needs to read.
As of now, on the mobile phone we are using nRF connect instead of the app for test purposes. We are able to properly overwrite a characteristic value from the device. However, if we try to modify such value from within the code while the device is connected, nRF doesn't see the updated value.
We are sure that the modification happens locally. In fact, if we modify the value before connecting, nRF reads the modified value.
According to a common BLE behaviour, we would expect that the modification of a characteristic value should be accordingly updated on the central device while it is connected.
Is there any option or configuration that needs to be set in order to achieve such behaviour?

Thank you.

Ps: I am attaching an excerpt of our code where the connection is defined (I had to modify the format from .py to .txt).
connection_manager.txt

[Question] Record and Replay Eddystone uid beacon frames ?

Hi,

I was wondering if it possible to capture and replay, eddystone uid frames with BLESuite ? I'm currently developping a scanner for these types of frames and i need to generate as many frames as possible to test stress test my scanner and see how much it can handle simultaneously.

Thanks a lot for your support.
Y.

Support fot python 3 ?

Python 2 support ends in 2020.
Is there a schedule/plan for Python3 migration ?

ImportError: libboost_python-py27.so.1.55.0

When using BLESuite, latest version from GIT (August 1, 2016), in Kali Linux 2017.3, the following error is generated when trying to run any of the default scripts from the "bleSuite" dir:

# python bleSmartScan.py -h
Traceback (most recent call last):
  File "bleSmartScan.py", line 4, in <module>
    from bleConnectionManager import BLEConnectionManager
  File "/Labs/BLE/BLESuite/BLESuite-master/bleSuite/bleConnectionManager.py", line 1, in <module>
    from gattlib import GATTRequester, GATTResponse
  File "build/bdist.linux-x86_64/egg/gattlib.py", line 7, in <module>
  File "build/bdist.linux-x86_64/egg/gattlib.py", line 6, in __bootstrap__
ImportError: libboost_python-py27.so.1.55.0: cannot open shared object file: No such file or directory

After creating a symbolic link from libboost 1.55 to the currently available (latest) libboost version, v1.62, the error message disappears:

# pwd
/usr/lib/x86_64-linux-gnu
# ln -s libboost_python-py27.so.1.62.0 libboost_python-py27.so.1.55.0

Then, a similar issue affects the related "thread" library:

# ln -s libboost_thread.so.1.62.0 libboost_thread.so.1.55.0

However, when a tool that makes use of BLESuite and that requires establishing a BLE connection is run, such as "https://github.com/nccgroup/BLESuite-CLI", a mismatch library error is generated:

# python ./bleSuite-runner.py smartScan --addr 0E:0A:B0:00:23:15
BTLE Smart Scan beginning
Traceback (most recent call last):
  File "./bleSuite-runner.py", line 12, in <module>
    main()
  File "/Labs/BLE/BLESuite/BLESuite-CLI-master/bleSuiteCLI/bleSuiteCLI.py", line 356, in main
    processArgs(args)
  File "/Labs/BLE/BLESuite/BLESuite-CLI-master/bleSuiteCLI/bleSuiteCLI.py", line 191, in processArgs
    args.addrType[0], args.security[0])
  File "/Labs/BLE/BLESuite/BLESuite-CLI-master/bleSuiteCLI/cmdLineToolWrappers.py", line 520, in bleRunSmartScan
    connectionManager = bleConnectionManager.BLEConnectionManager(address, adapter, addressType, securityLevel)
  File "/usr/local/lib/python2.7/dist-packages/bleSuite/bleConnectionManager.py", line 41, in __init__
    self.createRequester()
  File "/usr/local/lib/python2.7/dist-packages/bleSuite/bleConnectionManager.py", line 55, in createRequester
    self.requester = GATTRequester(self.address, False)
Boost.Python.ArgumentError: Python argument types in
    GATTRequester.__init__(GATTRequester, str, bool)
did not match C++ signature:
    __init__(_object*, std::string)
    __init__(_object*, std::string, bool)
    __init__(_object*, std::string, bool, std::string)

Is there any specific reason why BLESuite is linked to libboost v1.55, or could it make use of newer libboost versions?

Unable to complete a basic scan

Running a scan for the first time comes back with empty results.

Running it for the second consecutive time generates the error below.

Running any blesuite command inbetween makes it keep coming back with empty results and no error.

Running the same scan with bettercap successfully discovers a dozen devices in range and enumerates their services, so I know the adapter (Intel 8265) works.

This is on Ubuntu 18.04.01.

(ve2) root@bletester:/home/bletester/XXXXX/root# blesuite scan
BTLE Scan beginning
Discovered:
(ve2) root@bletester:/home/bletester/XXXXX/root# blesuite scan
BTLE Scan beginning
Traceback (most recent call last):
  File "src/gevent/greenlet.py", line 766, in gevent._greenlet.Greenlet.run
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/blesuite/pybt/core.py", line 283, in run
    event = self.conn.role.stack.handle_data()
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/blesuite/pybt/stack.py", line 217, in handle_data
    return BTEvent(BTEvent.SCAN_DATA, (p.addr, p.atype, p.data))
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 325, in __getattr__
    fld, v = self.getfield_and_val(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 1431, in getfield_and_val
    raise AttributeError(attr)
AttributeError: addr
2019-03-29T10:07:04Z <Greenlet at 0x7fe10fea0158: <bound method SocketHandler.run of <blesuite.pybt.core.SocketHandler object at 0x7fe10feb5ed0>>> failed with AttributeError

Discovered:

--debug output:

BTLE Scan beginning
DEBUG:blesuite.connection_manager:creating central
DEBUG:blesuite.pybt.stack:[!] Creating socket failed: BluetoothSocketError('Unable to bind',)

DEBUG:blesuite.pybt.stack:[+] have root, attempting to take iface down

DEBUG:blesuite.pybt.stack:Trying to set reuseaddr
DEBUG:blesuite.pybt.stack:Settings ins reuse
DEBUG:blesuite.connection_manager:creating PyBT connection
DEBUG:blesuite.connection_manager:creating listeners
ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Parameters Error: Command 200b failed with c

ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Enable Error: Command 200c failed with c

DEBUG:blesuite.connection_manager:Starting sleep loop
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Done scanning!
Discovered:
DEBUG:blesuite.connection_manager:Exiting bleConnectionManager. exc_type:None exc_val:None exc_tb:None
DEBUG:blesuite.pybt.core:Connection quit(), killing remaining connection threads
DEBUG:blesuite.pybt.roles:Destroying LECentral
DEBUG:blesuite.pybt.stack:Destroying PyBT, closing HCI device
DEBUG:blesuite.pybt.stack:Stop advertising
DEBUG:blesuite.pybt.stack:Stop Scanning
ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Enable Error: Command 200c failed with c

DEBUG:blesuite.pybt.stack:Flushing socket
DEBUG:blesuite.cli.blesuite_cli:Args: Namespace(adapter=[0], address=None, address_type=['public'], async=False, command=['scan'], data=[], debug=True, files=[], handles=[], mode=[1], payload_delimiter=['EOF'], skip_device_info_query=False, smart_read=False, subscribe_timeout=[None], timeout=[5], uuids=[])
-----
BTLE Scan beginning
DEBUG:blesuite.connection_manager:creating central
DEBUG:blesuite.pybt.stack:[!] Creating socket failed: BluetoothSocketError('Unable to bind',)

DEBUG:blesuite.pybt.stack:[+] have root, attempting to take iface down

DEBUG:blesuite.pybt.stack:Trying to set reuseaddr
DEBUG:blesuite.pybt.stack:Settings ins reuse
DEBUG:blesuite.connection_manager:creating PyBT connection
DEBUG:blesuite.connection_manager:creating listeners
ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Parameters Error: Command 200b failed with c

ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Enable Error: Command 200c failed with c

DEBUG:blesuite.connection_manager:Starting sleep loop
DEBUG:blesuite.connection_manager:Scanning...
Traceback (most recent call last):
  File "src/gevent/greenlet.py", line 766, in gevent._greenlet.Greenlet.run
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/blesuite/pybt/core.py", line 283, in run
    event = self.conn.role.stack.handle_data()
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/blesuite/pybt/stack.py", line 217, in handle_data
    return BTEvent(BTEvent.SCAN_DATA, (p.addr, p.atype, p.data))
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 327, in __getattr__
    return self.payload.__getattr__(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 325, in __getattr__
    fld, v = self.getfield_and_val(attr)
  File "/home/bletester/XXXXX/root/BLESuite/ve2/local/lib/python2.7/site-packages/scapy-2.4.3rc1.dev53-py2.7.egg/scapy/packet.py", line 1431, in getfield_and_val
    raise AttributeError(attr)
AttributeError: addr
2019-03-29T10:28:27Z <Greenlet at 0x7fea9399c158: <bound method SocketHandler.run of <blesuite.pybt.core.SocketHandler object at 0x7fea939550d0>>> failed with AttributeError

DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Scanning...
DEBUG:blesuite.connection_manager:Done scanning!
Discovered:
DEBUG:blesuite.connection_manager:Exiting bleConnectionManager. exc_type:None exc_val:None exc_tb:None
DEBUG:blesuite.pybt.core:Connection quit(), killing remaining connection threads
DEBUG:blesuite.pybt.roles:Destroying LECentral
DEBUG:blesuite.pybt.stack:Destroying PyBT, closing HCI device
DEBUG:blesuite.pybt.stack:Stop advertising
DEBUG:blesuite.pybt.stack:Stop Scanning
ERROR:blesuite.pybt.stack:[!] Controller error for command: LE Set Scan Enable Error: Command 200c failed with c

DEBUG:blesuite.pybt.stack:Flushing socket
DEBUG:blesuite.cli.blesuite_cli:Args: Namespace(adapter=[0], address=None, address_type=['public'], async=False, command=['scan'], data=[], debug=True, files=[], handles=[], mode=[1], payload_delimiter=['EOF'], skip_device_info_query=False, smart_read=False, subscribe_timeout=[None], timeout=[5], uuids=[])

Various issues

Using pyshark-legacy since newest pyshark doesn't support Python 2...

[parker@stealth BLESuite]$ ble-replay -p ~/btsnoop_hci.log -of replaydata.json
loading file
Btsnoop capture file version 1, type 1002
loading file
Btsnoop capture file version 1, type 1002
[parker@stealth BLESuite]$ cat replaydata.json 
[parker@stealth BLESuite]$ 

Everything seems to run twice and I can't get my hci log converted to the readable format.

Does interface want the hci0 or MAC address? I try both and get a similar error

[parker@stealth BLESuite]$ ble-replay -i hci0 -d 70:26:05:CF:67:25  -r -p btsnoop_hci.log 
loading file
Error: 

Traceback (most recent call last):
  File "/usr/bin/ble-replay", line 7, in <module>
    import blesuite.cli.ble_replay as ble_replay
  File "/usr/lib/python2.7/site-packages/blesuite/cli/ble_replay.py", line 88, in <module>
    main()
  File "/usr/lib/python2.7/site-packages/blesuite/cli/ble_replay.py", line 78, in main
    blesuite.replay.util.gatt_writes(int(args.iface), args.address, args.address_type, replay_data,
ValueError: invalid literal for int() with base 10: 'hci0'
[parker@stealth BLESuite]$ ble-replay -i 9C:B6:D0:0E:0D:CE -d 70:26:05:CF:67:25  -r -p btsnoop_hci.log 
loading file
Error: 

Traceback (most recent call last):
  File "/usr/bin/ble-replay", line 7, in <module>
    import blesuite.cli.ble_replay as ble_replay
  File "/usr/lib/python2.7/site-packages/blesuite/cli/ble_replay.py", line 88, in <module>
    main()
  File "/usr/lib/python2.7/site-packages/blesuite/cli/ble_replay.py", line 78, in main
    blesuite.replay.util.gatt_writes(int(args.iface), args.address, args.address_type, replay_data,
ValueError: invalid literal for int() with base 10: '9C:B6:D0:0E:0D:CE'