fix(recon): consolidate chipset/OUI tables into core.ble_meta, drop dupes + bogus OUI (#56)

gatt_enum and ble_target_enum each carried a private copy of the
CHIPSET_VENDORS, MFR_CHIPSET_HINTS, LMP_SUBVER_CHIPSET and OUI_CHIPSET
tables. The gatt_enum copy contained a malformed 7-char OUI key
('D436390') that never matched. Both copies drifted from each other.

Moved all four tables (plus convenience helpers chipset_for_address /
_company_id / _manufacturer / _lmp_subversion) into core.ble_meta as
public names. Both recon modules now import from one source of truth.

adv_parser.COMPANY_IDS previously had 3 duplicate keys (0x0310, 0x038F,
0x0131) where silent override flipped vendor names. Trimmed to unique
keys and added a fallback through core.utils.bt.decode_company_id on
miss.

Regenerated docs/recon.md and docs/exploits.md.

Author: V33RU

core/ble_meta.py

@@ -23,7 +23,7 @@
 
 from __future__ import annotations
 
-from typing import Iterable, List, Optional
+from typing import Dict, Iterable, List, Optional
 
 # 16-bit GATT service UUIDs and their short names.
 # Pulled from the Bluetooth SIG Assigned Numbers (Services section).
@@ -353,15 +353,150 @@ def permissions_from_bitmap(bits: int) -> List[str]:
     return out
 
 
+# ── Chipset / vendor identification ──────────────────────────────────────────
+#
+# Shared truth used by recon modules that walk GATT (gatt_enum,
+# ble_target_enum) and any future module that needs to map a BD_ADDR,
+# PnP vendor id, or LMP subversion to a chipset label. Live in one place
+# to avoid drift; previous duplicate copies caused real bugs (e.g. a
+# malformed 7-char OUI key that never matched).
+
+# Bluetooth SIG company identifiers -> chipset / brand vendor label.
+CHIPSET_VENDORS: Dict[int, str] = {
+    0x0002: "Intel",
+    0x0006: "Microsoft",
+    0x000D: "Texas Instruments",
+    0x000F: "Broadcom",
+    0x001D: "Qualcomm Atheros",
+    0x0059: "Nordic Semiconductor",
+    0x0075: "Samsung",
+    0x0087: "Garmin",
+    0x004C: "Apple",
+    0x00E0: "Google",
+    0x012D: "GN Audio (Jabra)",
+    0x012E: "MediaTek",
+    0x0131: "Huawei Technologies",
+    0x0157: "Xiaomi / LYWSD",
+    0x0310: "Wyze Labs",
+    0x038F: "Espressif Systems",
+    0x03DA: "Bose",
+    0x0499: "Ruuvi Innovations",
+    0x054C: "Sony",
+    0x0603: "Sonos",
+    0x0822: "Espressif",
+}
+
+# Manufacturer name substring -> probable chipset label. Used when the
+# Device Information Service exposes a manufacturer string but no PnP ID.
+MFR_CHIPSET_HINTS: Dict[str, str] = {
+    "nordic":       "Nordic Semiconductor nRF5x",
+    "dialog":       "Dialog Semiconductor DA14xxx",
+    "texas":        "Texas Instruments CC264x",
+    "ti ":          "Texas Instruments CC264x",
+    "silicon labs": "Silicon Labs EFR32",
+    "silabs":       "Silicon Labs EFR32",
+    "telink":       "Telink TLSR",
+    "realtek":      "Realtek RTL8762",
+    "beken":        "Beken BK36xx",
+    "mediatek":     "MediaTek MT25xx",
+    "qualcomm":     "Qualcomm QCC",
+    "cypress":      "Infineon/Cypress CYW43xxx",
+    "broadcom":     "Broadcom BCM",
+    "espressif":    "Espressif ESP32",
+    "esp":          "Espressif ESP32",
+    "nxp":          "NXP KW4x",
+    "kaha":         "Realtek RTL8762 (KaHa platform)",
+    "huawei":       "HiSilicon BLE SoC",
+    "xiaomi":       "Beken / MediaTek platform",
+}
+
+# LMP / LE-LL subversion value -> exact chipset model. Read off the
+# HCI_Read_Remote_Version response.
+LMP_SUBVER_CHIPSET: Dict[int, str] = {
+    0x0001: "Nordic nRF52xxx",
+    0x000D: "Nordic nRF52840",
+    0x0048: "Texas Instruments CC2640",
+    0x0051: "Texas Instruments CC2642",
+    0x1000: "Nordic nRF51xxx",
+    0x22BB: "Silicon Labs EFR32BG22",
+    0x6109: "Qualcomm QCC512x",
+    0x8761: "Realtek RTL8761",
+    0x8762: "Realtek RTL8762",
+    0x8763: "Realtek RTL8763",
+    0x9908: "Dialog DA14531",
+}
+
+# OUI prefix (6 uppercase hex chars, no colons) -> chipset / SoC vendor.
+# Smaller than the full IEEE OUI table; covers only the BLE-relevant
+# vendor blocks we want chipset attribution for.
+OUI_CHIPSET: Dict[str, str] = {
+    "000F00": "Broadcom",
+    "001A8A": "Samsung Electro-Mechanics",
+    "001B10": "Nokia / MediaTek",
+    "001E10": "Huawei Technologies",
+    "240AC4": "Espressif ESP32",
+    "246FAB": "Espressif ESP32",
+    "30AEA4": "Espressif ESP32",
+    "3C71BF": "Espressif ESP32",
+    "5091F7": "Nordic Semiconductor",
+    "5CCF7F": "Espressif ESP32",
+    "84CCA8": "Espressif ESP32",
+    "F4CE36": "Nordic Semiconductor",
+}
+
+
+def chipset_for_company_id(cid: int) -> Optional[str]:
+    """Map a Bluetooth SIG company id to a chipset / brand label."""
+    return CHIPSET_VENDORS.get(cid)
+
+
+def chipset_for_manufacturer(name: str) -> Optional[str]:
+    """Best-effort chipset label from a manufacturer string (case-insensitive
+    substring match against `MFR_CHIPSET_HINTS`)."""
+    if not name:
+        return None
+    low = name.lower()
+    for needle, label in MFR_CHIPSET_HINTS.items():
+        if needle in low:
+            return label
+    return None
+
+
+def chipset_for_lmp_subversion(subver: int) -> Optional[str]:
+    """Map an LMP / LE-LL subversion value to a specific chipset model."""
+    return LMP_SUBVER_CHIPSET.get(subver)
+
+
+def chipset_for_address(bd_addr: str) -> Optional[str]:
+    """Best-effort chipset / SoC vendor from a BD_ADDR's OUI prefix.
+
+    Accepts addresses with or without colons, in any case. Returns None
+    if the OUI is not in `OUI_CHIPSET`."""
+    if not bd_addr:
+        return None
+    oui = bd_addr.replace(":", "").upper()[:6]
+    if len(oui) != 6:
+        return None
+    return OUI_CHIPSET.get(oui)
+
+
 __all__ = [
     "SERVICE_NAMES",
     "CHARACTERISTIC_NAMES",
     "DESCRIPTOR_NAMES",
     "PROP_BIT_NAMES",
+    "CHIPSET_VENDORS",
+    "MFR_CHIPSET_HINTS",
+    "LMP_SUBVER_CHIPSET",
+    "OUI_CHIPSET",
     "short_uuid",
     "name_for_service",
     "name_for_characteristic",
     "name_for_descriptor",
     "properties_to_permissions",
     "permissions_from_bitmap",
+    "chipset_for_company_id",
+    "chipset_for_manufacturer",
+    "chipset_for_lmp_subversion",
+    "chipset_for_address",
 ]

docs/exploits.md

@@ -401,7 +401,7 @@ Apple BT subsystem crash via malformed packets, iOS/macOS/watchOS/tvOS (CVE-2026
 
 ### `exploits/badchoice`
 
-**exploits/classic/badchoice**
+**BadChoice (CVE-2020-12352 Linux BT info leak)**
 
 BleedingTooth Linux A2MP Stack Info Leak (CVE-2020-12352)
 
@@ -423,7 +423,7 @@ BleedingTooth Linux A2MP Stack Info Leak (CVE-2020-12352)
 
 ### `exploits/badkarma`
 
-**exploits/classic/badkarma**
+**BadKarma (CVE-2020-12351 BleedingTooth L2CAP)**
 
 BleedingTooth Linux L2CAP Type Confusion RCE (CVE-2020-12351)
 
@@ -447,7 +447,7 @@ BleedingTooth Linux L2CAP Type Confusion RCE (CVE-2020-12351)
 
 ### `exploits/bias`
 
-**exploits/classic/bias**
+**BIAS Authentication Bypass**
 
 BIAS - Bluetooth Impersonation AttackS (CVE-2020-10135)
 
@@ -775,7 +775,7 @@ Spoof BLE advertisements to impersonate AirTag, Fast Pair beacons, iBeacon, or T
 
 ### `exploits/bleedingtooth_native`
 
-**exploits/classic/bleedingtooth_native**
+**BleedingTooth Native Exploit**
 
 BleedingTooth full native RCE (CVE-2020-12351/52, EDB-49754)
 
@@ -847,7 +847,7 @@ Spoof a previously paired BLE peripheral to hijack reconnection and serve forged
 
 ### `exploits/blueborne_bnep_overflow`
 
-**exploits/classic/blueborne_bnep_overflow**
+**BlueBorne BNEP Buffer Overflow**
 
 BlueBorne Android BNEP setup overflow (CVE-2017-0781, EDB-44554)
 
@@ -869,7 +869,7 @@ BlueBorne Android BNEP setup overflow (CVE-2017-0781, EDB-44554)
 
 ### `exploits/blueborne_leak`
 
-**exploits/classic/blueborne_leak**
+**BlueBorne Information Leak**
 
 BlueBorne Android BNEP Information Leak (CVE-2017-0781)
 
@@ -894,7 +894,7 @@ BlueBorne Android BNEP Information Leak (CVE-2017-0781)
 
 ### `exploits/blueborne_linux_rce`
 
-**exploits/classic/blueborne_linux_rce**
+**BlueBorne Linux RCE**
 
 BlueBorne Linux L2CAP Stack Buffer Overflow RCE (CVE-2017-1000251)
 
@@ -916,7 +916,7 @@ BlueBorne Linux L2CAP Stack Buffer Overflow RCE (CVE-2017-1000251)
 
 ### `exploits/blueborne_sdp_leak`
 
-**exploits/classic/blueborne_sdp_leak**
+**BlueBorne SDP Information Leak**
 
 BlueBorne Android SDP heap info leak (CVE-2017-0785, EDB-44555)
 
@@ -937,7 +937,7 @@ BlueBorne Android SDP heap info leak (CVE-2017-0785, EDB-44555)
 
 ### `exploits/bluebugging`
 
-**exploits/classic/bluebugging**
+**Bluebugging (AT-command abuse)**
 
 RFCOMM AT Command Injection via unauthenticated serial channel
 
@@ -1008,7 +1008,7 @@ Run Rubber-Ducky-style payloads against unauthenticated HID Bluetooth peers via
 
 ### `exploits/bluefrag`
 
-**exploits/classic/bluefrag**
+**BlueFrag (CVE-2020-0022 Android RCE)**
 
 BlueFrag Android A2DP Heap Overflow RCE (CVE-2020-0022)
 
@@ -1031,7 +1031,7 @@ BlueFrag Android A2DP Heap Overflow RCE (CVE-2020-0022)
 
 ### `exploits/bluesnarfing`
 
-**exploits/classic/bluesnarfing**
+**Bluesnarfing OBEX object exfil**
 
 Unauthorized OBEX phonebook & object pull (Bluesnarfing)
 
@@ -1054,7 +1054,7 @@ Unauthorized OBEX phonebook & object pull (Bluesnarfing)
 
 ### `exploits/bluffs`
 
-**exploits/classic/bluffs**
+**BLUFFS Session Key Downgrade**
 
 BLUFFS Bluetooth session key downgrade attack (CVE-2023-24023)
 
@@ -1080,7 +1080,7 @@ BLUFFS Bluetooth session key downgrade attack (CVE-2023-24023)
 
 ### `exploits/bluffs_mitm`
 
-**exploits/classic/bluffs_mitm**
+**BLUFFS MITM Variant**
 
 Active MITM session key downgrade attack (BLUFFS/CVE-2023-24023)
 
@@ -1128,7 +1128,7 @@ Exploit Cross-Transport Key Derivation to overwrite an existing authenticated Bl
 
 ### `exploits/bnep_heap_disclosure`
 
-**exploits/classic/bnep_heap_disclosure**
+**BNEP Heap Disclosure**
 
 BNEP bnep_data_ind() Remote Heap Disclosure (CVE-2017-13258)
 
@@ -1155,7 +1155,7 @@ BNEP bnep_data_ind() Remote Heap Disclosure (CVE-2017-13258)
 
 ### `exploits/braktooth_esp32`
 
-**exploits/classic/braktooth_esp32**
+**BrakTooth ESP32 LMP Exploits**
 
 BrakTooth ESP32 Feature Page ACE (CVE-2021-28139)
 
@@ -1399,7 +1399,7 @@ Inject keystrokes into a Windows host by spoofing the BD_ADDR of a keyboard alre
 
 ### `exploits/knob`
 
-**exploits/classic/knob**
+**KNOB Key Negotiation Attack**
 
 KNOB Attack - Encryption Key Entropy Downgrade (CVE-2019-9506)
 
@@ -1422,7 +1422,7 @@ KNOB Attack - Encryption Key Entropy Downgrade (CVE-2019-9506)
 
 ### `exploits/knob_active`
 
-**exploits/classic/knob_active**
+**KNOB Active Downgrade**
 
 Actively force encryption key entropy downgrade (KNOB/CVE-2019-9506)
 
@@ -1991,7 +1991,7 @@ Force 7-byte (56-bit) LTK derivation by responding to LE pairing with max_key_si
 
 ### `exploits/sweyntooth`
 
-**exploits/ble/sweyntooth**
+**SweynTooth BLE Link-Layer Exploits**
 
 SweynTooth BLE Link Layer stack overflow / deadlock family
 
@@ -2040,7 +2040,7 @@ Skip ECDH validation on TI SimpleLink CC2640R2 by setting up encryption before S
 
 ### `exploits/unauth_write`
 
-**exploits/ble/unauth_write**
+**Unauthenticated GATT Write**
 
 Unauthenticated GATT characteristic write