AwesomeREA.org

Tool

furiousMAC Continuity

Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.

Requirements and limitations

  • No GitHub releases; the reviewed commit, from 2025-08-29, merges a typo fix. The dissector README calls the March 2021 version for Wireshark 3.4.4 the most up to date: the 4.4.0 file contributed in 2024 ports it to build on Wireshark 4.4.0 without dissector changes and may not correctly dissect messages from the latest iOS versions. Fields the message tables mark as unknown or uncertain remain open.
  • On Linux and macOS, users download the Wireshark source for the matching version, replace epan/dissectors/packet-bthci_cmd.c with the project's file and build Wireshark. The repository also commits prebuilt 64-bit Windows Wireshark installers for 3.0.8 and 3.2.1, which the dissector README says are based on the original ShmooCon 2020 dissector and should not be used.
  • Capturing advertisements needs a BLE sniffer: HARDWARE.md recommends a Nordic nRF51 dongle with Nordic's sniffer firmware, or an Ubertooth One with the included btleshark.sh capture script. Analysis uses advertisements the analyst captures; the repository contains no sample captures.
  • GPL-2.0. The README credits many message types and field meanings to Celosia and Cunche's PETS 2020 paper. No advertisements were captured and Wireshark was not built.

About this entry

Type
Tool
Category
Protocol analysis tools
Relationship
Foundation tool
Targets
Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · furiousMAC/continuity · Revision d9fa98b
  2. dissector/README.md GitHub · furiousMAC/continuity · Revision d9fa98b
  3. dissector/INSTALL.md GitHub · furiousMAC/continuity · Revision d9fa98b
  4. dissector/FIELDS.md GitHub · furiousMAC/continuity · Revision d9fa98b
  5. dissector/CHANGELOG.md GitHub · furiousMAC/continuity · Revision d9fa98b
  6. HARDWARE.md GitHub · furiousMAC/continuity · Revision d9fa98b
  7. messages GitHub · furiousMAC/continuity · Revision d9fa98b
  8. LICENSE.md GitHub · furiousMAC/continuity · Revision d9fa98b
  9. https://github.com/furiousMAC/continuity/commit/c125a620598bc132ac356202fcced6a481775909
  10. https://petsymposium.org/2019/files/papers/issue4/popets-2019-0057.pdf