Bluetooth Ops

The Bluetooth Ops run on the Pro's main processor (the ESP32-S3), alongside the app link. Every Op is configured and driven from the ZeroTrace app, there's no console on the device. Some of the more advanced Ops (BLE MITM, GATT emulation) also enlist the second radio (the ESP32-C5) as a BLE advertiser and GATT server.

---

BLE Advertisement Spam

Rapidly broadcasts crafted BLE advertisements to test how nearby devices, operating systems, and apps react to pairing prompts and proximity pop-ups. This is the tool for exercising OS pairing UX, validating that a fleet's devices ignore unsolicited adverts, and demonstrating how noisy the BLE spectrum can get.

The Op rotates through crafted payloads at a configurable interval (interval_ms, 20-2000 ms; the ble_spam_interval_ms config key sets the default of 120 ms). It carries a library of 40+ Apple Continuity payloads, covering AirPods, Beats, and the various "setup"/pairing pop-ups an iPhone shows near an unpaired accessory.

Eleven modes are available:

In Apple (one) mode, apple_index selects which single payload from the Apple library is broadcast, useful when you want to reproduce one specific pop-up rather than the whole rotation.

Use it to: test how phones and apps respond to unsolicited pairing prompts, confirm a device rejects/ignores spoofed adverts, and run awareness demos of BLE advertising noise.

Config & control: blespam.config (mode, apple_index, interval_ms), blespam.start / blespam.stop, blespam.status (reports sent / fps).

---

iBeacon Broadcast

Broadcasts a standard Apple iBeacon advertisement, the beacon format proximity apps and indoor-location systems listen for. Use it to exercise a beacon receiver, verify an app's region enter/exit logic, or stand in for a physical beacon during testing.

You control the standard iBeacon fields:

You can save, load, and delete up to 5 profiles on the device, so a set of test beacons is one tap away instead of re-entered each time.

Use it to: test beacon-based apps and indoor-location systems, reproduce a specific beacon identity, validate region-monitoring logic.

Config & control: ibeacon.config / ibeacon.start / ibeacon.stop / ibeacon.status, plus ibeacon.profiles.list / .save / .load / .delete (max 5).

---

BLE Device Spoofer

Round-robins through a set of spoofed device identities, each a custom advertising name plus a manufacturer-data hex payload, cycling from one to the next on a timer. Where advertisement spam tests pop-up behaviour, the spoofer is about presenting a rotating cast of distinct-looking devices, useful for populating a scanner's view, testing device-inventory and allowlist logic, or checking how a system reacts to identities appearing and disappearing.

Each identity advertises under a deterministic MAC derived from the profile, so the same identity reappears with the same address across cycles.

Use it to: populate a scanner or inventory system with controlled test identities, exercise allowlist/blocklist logic, test reaction to appearing/disappearing devices.

Config & control: blespoof.config / blespoof.start / blespoof.stop / blespoof.status.

---

AirTag / Find My Decoy

Broadcasts decoy Apple Find My "lost" beacons, advertisements that look like a separated (lost) item finder, using fake public keys. This has two legitimate uses: anti-stalking awareness (showing people what a tracker looks like on the air so they learn to spot one), and testing tracker-detection systems (does a given app, scanner, or the Pro's own detector actually flag it?).

Use it to: demonstrate what a tracker looks like over the air, and validate detection tools, including AirLeak Pro's own tracker detection. Setting demo_mac keeps the decoys unmistakably synthetic.

Config & control: airtag.config / airtag.start / airtag.stop / airtag.status (reports publishes and the macs[] in use).

---

Find My Tools

The active counterpart to passive Tracker Detection. It scans for real nearby item finders and can trigger sound on one you've located.

• findmy.scan (duration_ms) detects nearby real tags, AirTag, FMNA (Find My Network Accessory), and DULT-compliant trackers, and classifies each by status, battery, and whether it's separated from its owner. Results are logged to /captures/findmy.log.
• findmy.beep (addr, kind: airtag | fmna | dult) plays a sound on a located tag so you can physically find it; findmy.stop silences it.

Use it to: locate a tracker you've found on you or your belongings, confirm whether a suspected tag is nearby, and audit a space for unwanted trackers.

---

GATT Client (dump / write)

Acts as a Bluetooth client to a target device to enumerate and interact with what it exposes over BLE, standard assessment work for an authorized security review.

• ble.gatt.dump (addr, read, timeout_s) connects to the target and enumerates its services and characteristics, reporting each characteristic's properties and, where readable, decoded values, including recognized sensor readings (battery, temperature, humidity).
• ble.gatt.write (addr, service_uuid, char_uuid, hex) writes a value to a specific characteristic.

Use it to: map a Bluetooth product's exposed services during an authorized security review, and, where in scope, exercise a characteristic to observe device behaviour.

---

Surveillance & Tracker Detectors

A defensive sweep: passively scans for a chosen class of device and reports what it finds, without transmitting. Point it at one target category at a time.

Each hit reports address, name, RSSI, kind, and category-specific fields.

Use it to: sweep a space for unwanted trackers, spot surveillance hardware and camera systems, and check for drones broadcasting Remote ID nearby.

Control: detector.scan (target, duration_ms), returns devices[] with {addr, name, rssi, kind, fields}. See also the dedicated Tracker Detection feature.

---

Foxhunt (direction finding)

RSSI direction-finding: hone in on a specific target MAC by watching how its signal changes as you move. On start, the Op boosts BLE scanning to 100% duty and locks onto the target.

Polling foxhunt.status is the hunt loop, each poll reports:

Walk, poll, and let trend and frac guide you toward the device.

Use it to: physically locate a specific BLE device you're authorized to find, a rogue beacon, a lost asset tag, a device flagged during a sweep.

Control: foxhunt.start (mac), foxhunt.status, foxhunt.stop.

---

Ninebot / Segway

Finds nearby Ninebot / Segway scooters and provides a catalog of canned command frames for authorized testing of those scooters' BLE control interface.

• ninebot.scan (duration_ms) scans for scooters by name prefix, Nordic UART Service (NUS), and company ID.
• ninebot.payloads returns a catalog of pre-built command frames (Max2/G30, F2, and generic variants). There is no dedicated control-send RPC, you deliver a chosen frame to the scooter's NUS characteristic using ble.gatt.write.

Use it to: inventory scooters in an authorized assessment and, on a scooter you own or are contracted to test, exercise its BLE control surface.

---

BLE MITM / GATT Emulation

The most advanced Bluetooth Op, and strictly for authorized labs. The main processor connects to a target peripheral as a central and clones its services and characteristics onto the second radio (the C5), which advertises the clone as a stand-in GATT server. Two modes:

• Static clone (proxy=false) reproduces the target's service/characteristic structure on the device so a host can connect to the emulated peripheral.
• Live proxy (proxy=true) stands up a relay: reads, writes, and notifications pass between the real device and a connecting host through the Pro, with no reboot, so you can observe and study the live exchange.

The clone captures up to 4 services and 16 characteristics. The C5 GATT server can also present standard DIS/HID identity services alongside the clone.

Use it to: study how a BLE product and its companion app talk to each other, in a controlled lab, on devices you own or are contracted to test.

Control: mitm.clone (addr, proxy), mitm.status, mitm.stop; the underlying C5 GATT server is driven by c5gatt.push / .notify / .stop / .status. Status reports relayed_out / relayed_in counts and a recent-activity log[].

---