Fun stuff. I would also recommend using some kind of packet sniffer to collect sample data which can make your static analysis easier. To do this, buy the CC2541 development kit with packet sniffer for about $25. Alternatively, you can write a BLE proxy (using two Bluetooth adapters). To Apple’s credit, the CoreBluetooth API on iOS does not let the app know the MAC address of the peripheral, so the app will never know that it is talking to your proxy vs the actual device.
yeah I thought about physical sniffing and wanted to buy/build a bt sniffer myself ... but you know, some Android versions have a builtin bt sniffing feature ;)
