0

I want to change the bluetooth mac address of the builtin wifi/bluetooth chip, but all my attempts have been futile despite multiple sources (including the commands) implying it to be possible. See e.g. this question about how often it can be done.

A few notes on what exactly i want/need:

  • I need to change the vendor bytes to some known "authentic" ones.
  • both temporary and permanent change would suffice
  • spoofing is also ok, as long as other devices don't notice
  • other features beyond bluetooth are expendable, say if e.g. the Wifi misbehaves
  • I don't care about specific versions of firmware/packages
  • I currently use bluetoothctl show to view the current MAC if that matters

What I tried (and didnt't work yet):

From this post by infineon: I tried both what worked for the asker:

# hcitool cmd 0x3f 0x001 0x01 0x23 0x45 0x67 0x89 0xab
< HCI Command: ogf 0c3f, ocf 0x001, plen 6
  01 23 45 67 89 ab
> HCI Event: 0x0e plen 4
  01 01 FC 00

and what didnt:

# sudo bdaddr -i hci0 01:23:45:67:89:ab
Manufacturer:   Cypress Semiconductor Corporation (305)
Device address: DC:A6:32:16:71:D4
New BD address: 01:23:45:67:89:ab

Address changed - Reset device now

And I presume both work but I need to powercycle, presumably the bluetooth? How would I do that. I tried a shutdown -r but that just reset the address back to stock. Do I have toggle some GPIO? send more magic numbers via hcitool cmd?

Edit: after comments I tried bthelper hci0 to no avail and looking into the sourcethe command it calls hciconfig hci0 reset also has no effect.

the btmgmt also has commands to change mac, but these always fail. I couldn't find anything related to reset, but there are undocumented opcodes.

Any tipps are also appreciated.

Used versions (latest as of 17.04.2021):

  • bluetoothd: 5.50
  • bluetoothctl: 5.50
  • pi-bluetooth: 0.1.15
  • cypress firmware: brcm/brcmfmac43455-sdio
  • raspi firmware: 3. Sep 2020
  • kernel: 5.10.17-v7l+
3
0

I figured it out. TLDR: (run everyhting as root, you won't get permission errors if you don't but it won't work)

After every reboot (yes the bytes in reverse)

hcitool cmd 0x3f 0x001 0xab 0x89 0x67 0x45 0x23 0x01

and every time you want to change it:

bdaddr -i hci0 01:23:45:67:89:ab
hciconfig hci0 reset
systemctl restart bluetooth.service

Source: https://scribles.net/changing-a-bluetooth-device-address-on-raspberry-pi/, but don't use the suggested version of bdaddr use the one supplied with the raspi4

The problem apparently was that everything in the stack caches the MAC and you have to reset the entire stack in the correct order else it will retain the old one. Also you have to use these BT commands, as others offering the same funcionallity seem to not work (e.g. btaddr -r).

Also linux uses the mac as an alias for the device and some tools get confused as to what is going on when it changes. Thats why hciconfig didn't report the change earlier.

Edit: The extra step after reboot

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.