AwesomeREA.org

Tool

Mirage

Python framework from IoT-security research at LAAS-CNRS for analysing wireless communications, with lightweight protocol stacks for Bluetooth Low Energy, Bluetooth, Enhanced ShockBurst, Mosart, Zigbee, Wi-Fi and infrared that a command-line interpreter drives through chainable modules. For protocol analysis it offers per-protocol scan, information and sniffing modules, BLE ATT/GATT discovery that saves the discovered attribute table, HCI monitoring of an Android phone through its btsnoop log over ADB, PCAP reading and writing, and an experimental HackRF software-radio receive path with FSK demodulators and BLE and Zigbee decoders. Its author has deprecated it in favour of the WHAD tool suite.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Version 1.2 according to mirage/__init__.py; the repository has no tags or GitHub releases. The README, last edited 2025-04-13 at the reviewed commit, declares the project officially deprecated and no longer maintained and points to its successor WHAD (whad-team/whad-client); the last code change is from 2022-11-24. It installs from this source tree with setup.py, since the PyPI package named mirage is an unrelated JWST data simulator.
  • setup.py depends on scapy, pyusb, pyserial, pycryptodomex, keyboard, psutil, terminaltables and matplotlib, and its classifiers list Python 3.6 and Linux. Live capture needs supported radio hardware: Bluetooth HCI adapters, a BBC micro:bit running BTLEJack firmware, Nordic and Sniffle sniffers, Ubertooth, a Crazyradio PA for Enhanced ShockBurst and Mosart, an RZUSBStick for Zigbee, a Wi-Fi interface, the IRma infrared device, a ButteRFly nRF52840 dongle or a HackRF One for the experimental SDR path. Their firmware lives in separate repositories; this repository holds only Python sources and no firmware images.
  • Without radio hardware, PCAP files serve as input interfaces (BLE link-layer PCAPs use DLT 256), and the ADB and hcidump interfaces read HCI traffic recorded on an Android phone or Linux host. The documentation site linked from the README returned HTTP 404 at review; its Sphinx sources are on the LAAS Redmine.
  • The README and setup.py describe Mirage as an offensive framework whose modules and example scenarios also cover man-in-the-middle, jamming, hijacking, cloning and injection, including experimental InjectaBLE attacks; this record covers only the scanning, sniffing, dissection and information-gathering features and does not document the others. Capture only devices and networks you are authorised to observe.
  • MIT (LICENSE.txt, copyright 2019 Romain Cayre). The README cites SSTIC 2019 and IEEE ISSRE 2019 papers describing the framework. No hardware was used and nothing was installed or run in this review; the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. readme.md GitHub · RCayre/mirage · Revision b6cd39e
  2. setup.py GitHub · RCayre/mirage · Revision b6cd39e
  3. CHANGELOG.md GitHub · RCayre/mirage · Revision b6cd39e
  4. mirage/__init__.py GitHub · RCayre/mirage · Revision b6cd39e
  5. mirage/modules GitHub · RCayre/mirage · Revision b6cd39e
  6. mirage/modules/ble_discover.py GitHub · RCayre/mirage · Revision b6cd39e
  7. mirage/libs/ble_utils/adb.py GitHub · RCayre/mirage · Revision b6cd39e
  8. mirage/libs/wireless_utils/pcapDevice.py GitHub · RCayre/mirage · Revision b6cd39e
  9. mirage/libs/ble_utils/pcap.py GitHub · RCayre/mirage · Revision b6cd39e
  10. LICENSE.txt GitHub · RCayre/mirage · Revision b6cd39e
  11. https://hal.science/hal-02346074

More in Protocols

All 66 entries in Protocols