I'd like to create my own iBeacon with some bluetooth low energy dev kits. Apple has yet to release a specification for iBeacons, however a few hardware developers have reverse Engineered the iBeacon from the AirLocate Sample code and started selling iBeacon dev kits.
So what is the iBeacon Bluetooth Profile?
Bluetooth Low Energy uses GATT for LE profile service discovery. So I think we need to know the Attribute Handle, Attribute Type, Attribute Value, and maybe the Attribute Permissions of the iBeacon attribute. So for an iBeacon with a UUID of E2C56DB5-DFFB-48D2-B060-D0F5A71096E0 a major value of 1 and a minor value of 1 what would the Bluetooth GATT profile service be?
Heres some assumptions I've made from the discussion on Apple's forums and through the docs.
For an iBeacon with ProximityUUID
0, and calibrated Tx Power of
-59 RSSI, the transmitted BLE advertisement packet looks like this:
d6 be 89 8e 40 24 05 a2 17 6e 3d 71 02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 52 ab 8d 38 a5
This packet can be broken down as follows:
d6 be 89 8e # Access address for advertising data (this is always the same fixed value) 40 # Advertising Channel PDU Header byte 0. Contains: (type = 0), (tx add = 1), (rx add = 0) 24 # Advertising Channel PDU Header byte 1. Contains: (length = total bytes of the advertising payload + 6 bytes for the BLE mac address.) 05 a2 17 6e 3d 71 # Bluetooth Mac address (note this is a spoofed address) 02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 # Bluetooth advertisement 52 ab 8d 38 a5 # checksum
The key part of that packet is the Bluetooth Advertisement, which can be broken down like this:
02 # Number of bytes that follow in first AD structure 01 # Flags AD type 1A # Flags value 0x1A = 000011010 bit 0 (OFF) LE Limited Discoverable Mode bit 1 (ON) LE General Discoverable Mode bit 2 (OFF) BR/EDR Not Supported bit 3 (ON) Simultaneous LE and BR/EDR to Same Device Capable (controller) bit 4 (ON) Simultaneous LE and BR/EDR to Same Device Capable (Host) 1A # Number of bytes that follow in second (and last) AD structure FF # Manufacturer specific data AD type 4C 00 # Company identifier code (0x004C == Apple) 02 # Byte 0 of iBeacon advertisement indicator 15 # Byte 1 of iBeacon advertisement indicator e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 # iBeacon proximity uuid 00 00 # major 00 00 # minor c5 # The 2's complement of the calibrated Tx Power
Any Bluetooth LE device that can be configured to send a specific advertisement can generate the above packet. I have configured a Linux computer using Bluez to send this advertisement, and iOS7 devices running Apple's AirLocate test code pick it up as an iBeacon with the fields specified above. See: Use BlueZ Stack As A Peripheral (Advertiser)
This blog has full details about the reverse engineering process.