BLE Blood Pressure Monitor Reverse Engineering Project

⚠️ IMPORTANT DISCLAIMER

This project is for EDUCATIONAL and RESEARCH purposes only. This code represents reverse engineering efforts to understand BLE communication protocols for blood pressure monitoring devices.

Legal and Safety Warnings:

• 🚫 NOT FOR MEDICAL USE: This software is not approved by any medical regulatory body (FDA, CE, etc.)
• ⚖️ Reverse Engineering: This project involves reverse engineering of proprietary BLE protocols
• 🔒 Security Research: Intended for cybersecurity researchers and IoT enthusiasts only
• 📊 Data Privacy: Be aware of health data handling regulations in your jurisdiction (HIPAA, GDPR)
• 🛡️ No Warranty: No guarantees on accuracy, reliability, or safety of measurements
• 🏥 Medical Advice: Always consult healthcare professionals for medical decisions

---

🎯 Project Overview

This project demonstrates a sophisticated reverse engineering approach to interface with Bluetooth Low Energy (BLE) blood pressure monitors, specifically targeting the BC54 device. The implementation showcases advanced BLE security handling, protocol analysis, and IoT data integration.

🧠 What Makes This Project Genius

1. Advanced BLE Security Implementation

   • Full support for BLE bonding and encryption (MITM protection)
   • Dynamic passkey handling with user interaction
   • Proper security callback management
   • ESP_BLE_SEC_ENCRYPT_MITM encryption enforcement

2. Protocol Reverse Engineering

   • Complete IEEE 11073-10407 Blood Pressure Service implementation
   • Bit-level flag parsing for measurement data
   • Little-endian byte order handling
   • Support for optional fields (timestamp, heart rate, user ID)

3. Robust Connection Management

   • Automatic device discovery and reconnection
   • Graceful handling of connection failures
   • Memory management for BLE client objects
   • Connection state monitoring

4. IoT Integration Ready

   • ThingSpeak cloud integration framework
   • WiFi connectivity management
   • Real-time data streaming capabilities

---

🏗️ Architecture

┌─────────────────┐    BLE Security     ┌──────────────────┐
│     ESP32       │◄──────────────────►│   BC54 Device    │
│  (This Code)    │    Encrypted        │ (Blood Pressure  │
│                 │   Communication     │    Monitor)      │
└─────────┬───────┘                     └──────────────────┘
          │
          │ WiFi
          ▼
┌─────────────────┐
│   ThingSpeak    │
│   Cloud API     │
└─────────────────┘

🔧 Technical Features

BLE Protocol Implementation

• Service UUID: 00001810-0000-1000-8000-00805f9b34fb (Blood Pressure Service)
• Characteristic UUID: 00002A35-0000-1000-8000-00805f9b34fb (Blood Pressure Measurement)
• Security Level: MITM (Man-in-the-Middle) Protection with Bonding
• Data Format: IEEE 11073-20601 compliant

Measurement Data Parsing

// Extracts from raw BLE data:
- Systolic Pressure (mmHg)
- Diastolic Pressure (mmHg)  
- Mean Arterial Pressure (mmHg)
- Heart Rate (BPM) 

Security Features

• Encryption: AES-128 with MITM protection
• Authentication: Numeric comparison with user confirmation
• Bonding: Persistent security keys storage
• Passkey Handling: Dynamic 6-digit passkey exchange

---

🛠️ Hardware Requirements

• ESP32 Development Board (ESP32-WROOM-32 recommended)
• BC54 Bluetooth Blood Pressure Monitor (or compatible device)
• USB Cable for programming and serial monitoring
• WiFi Network for cloud connectivity

📚 Software Dependencies

#include <BLEDevice.h>      // ESP32 BLE Arduino Library
#include <BLEUtils.h>       // BLE Utility functions
#include <BLEScan.h>        // BLE scanning capabilities
#include <BLEAdvertisedDevice.h>  // Device advertisement handling
#include <BLEClient.h>      // BLE client functionality
#include <WiFi.h>           // WiFi connectivity
#include <HTTPClient.h>     // HTTP requests for ThingSpeak

⚙️ Configuration

1. WiFi Setup

const char* ssid = "YOUR_WIFI_SSID";
const char* password = "YOUR_WIFI_PASSWORD";

2. ThingSpeak Integration

const char* apiKey = "YOUR_THINGSPEAK_API_KEY";
const char* channelID = "YOUR_CHANNEL_ID";

3. Device Targeting

#define DEVICE_NAME "BC54"  // Change to match your device

🚀 Installation & Usage

1. Arduino IDE Setup

# Install ESP32 Board Package
# Add to Additional Board Manager URLs:
https://dl.espressif.com/dl/package_esp32_index.json

2. Library Installation

• ESP32 BLE Arduino (built-in with ESP32 package)
• WiFi library (built-in)
• HTTPClient library (built-in)

3. Upload Process

1. Connect ESP32 via USB
2. Select board: "ESP32 Dev Module"
3. Configure WiFi and ThingSpeak credentials
4. Upload the code
5. Open Serial Monitor (9600 baud)

4. Pairing Process

1. Put BC54 device in pairing mode
2. ESP32 will discover and attempt connection
3. Enter displayed passkey on BC54 device within 15 seconds
4. Monitor Serial output for connection status

---

🔍 Reverse Engineering Methodology

1. Protocol Analysis

• BLE Advertisement Scanning: Identified device name and service UUIDs
• Service Discovery: Mapped available characteristics and descriptors
• Data Format Analysis: Reverse engineered measurement packet structure
• Security Requirements: Determined encryption and authentication needs

2. Security Research

// Security Configuration Discovered:
esp_ble_auth_req_t auth_req = ESP_LE_AUTH_REQ_SC_MITM_BOND;
esp_ble_io_cap_t iocap = ESP_IO_CAP_KBDISP;

3. Data Structure Reverse Engineering

Byte 0: Flags (indicates which fields are present)
├── Bit 0: Blood pressure units (0=mmHg, 1=kPa)
├── Bit 1: Time stamp present
├── Bit 2: Pulse rate present  
├── Bit 3: User ID present
└── Bit 4: Measurement status present

Bytes 1-2: Systolic pressure (little-endian)
Bytes 3-4: Diastolic pressure (little-endian)
Bytes 5-6: Mean arterial pressure (little-endian)
[Optional fields follow based on flags]

🐛 Debugging & Troubleshooting

Common Issues:

1. Bonding Failures: Ensure passkey is entered within 15-second window
2. Connection Drops: Check power management settings on both devices
3. No Notifications: Verify CCCD (0x2902) descriptor configuration
4. Parse Errors: Enable verbose serial debugging for packet analysis

Debug Commands:

Serial.setDebugOutput(true);  // Enable verbose BLE debugging

📊 Data Flow Diagram

[BC54 Device] 
      │ (Encrypted BLE)
      ▼
[ESP32 BLE Stack]
      │
      ▼
[Protocol Parser]
      │ (Parsed Values)
      ▼
[Serial Monitor] ──► [ThingSpeak Cloud]
      │                    │
      ▼                    ▼
[Local Display]      [Web Dashboard]

🔬 Research Applications

This codebase enables research in:

• IoMT Security: Analysis of medical device BLE implementations
• Protocol Fuzzing: Testing device robustness against malformed packets
• Privacy Research: Understanding health data transmission patterns
• Interoperability: Creating bridges between proprietary devices and standard APIs

🤝 Contributing

This is a research project. Contributions should focus on:

• Additional device compatibility
• Security analysis improvements
• Protocol documentation
• Educational resources

---

🏆 Acknowledgments

• ESP32 Community for BLE stack documentation
• Bluetooth SIG for BLE specifications
• IEEE for 11073 medical device standards
• Security researchers in the IoMT field

Remember: This is a proof-of-concept for educational purposes. Always prioritize security and privacy in your implementations!