[MS-CDP] Advertising Beacon Documentation

Question

Hi,

I'm currently looking at the Bluetooth: Advertising Beacon documentation. It describes one byte as fixed 0xFF and two bytes fixed as 0x0006 followed by 24 bytes of beacon data. This gives 27 bytes in total. The length field, in contrast, says 30 bytes. What is the secret of the remaining 3 bytes?

When looking at real data, I correctly get the said 30 bytes. However, the byte marked as being reserved and set to 0x00 is 0x02 instead. Why is that, what does that mean? Is there something missing in the documentation?

Thanks,
Rene

Answer 1

Hello King-Kong-4442, can you provide the sample structure you have with your version of parsing? Do those extra bytes contain the same bytes always? Also when taking the length field into consideration, we seem to be having 28 bytes.

Regards,
Sreekanth Nadendla
Microsoft Windows Open Specifications

Answer 2

can you provide the sample structure you have with your version of parsing?

1EFF0600010920029CA04DCA6D1594FE05BD181C198278A9C3C49B217E94D3

Do those extra bytes contain the same bytes always?

On a first view, it does not seem so.

Also when taking the length field into consideration, we seem to be having 28 bytes.

Yes, but you don't do so, see Bluetooth Core Specification chapter 11 "Advertising and scan response data format".
Anyway, your documentation clearly says 30 and this exactly what I am seeing. So there is something missing in the docs:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cdp/77b446d0-8cea-4821-ad21-fabdf4d9a569

Also, the documentation mentions a position "Reserved (1 byte): Currently set to zero.". This is not true either. This bytes is always 0x02.

Answer 3

can you provide the sample structure you have with your version of parsing?

I somehow missed the last part, but here it is:

1E        Length (1 byte): Set to 30 (0x1E).  
FF        0xFF (1 byte): Fixed value 0xFF.  
0600      Microsoft ID (2 bytes): Set to 0006  
01        Scenario Type (1 byte): Set to 1  
09        Version and Device Type (1 byte): Windows 10 Desktop  
20        Version and Flags (1 byte): The high 3 bits are set to 001; the lower 3 bits to 00000.  
02        Reserved (1 byte): Currently set to zero.  <--- ???  
9CA04DCA  Salt (4 bytes): Four random bytes.  
6D1594FE05BD181C198278A9C3C49B21 Device Hash (16 bytes): SHA256 Hash of Salt plus Device Thumbprint. Truncated to 16 bytes.  
7E94D3    What is this???  
  

The original message, again:
1EFF0600010920029CA04DCA6D1594FE05BD181C198278A9C3C49B217E94D3

Answer 4

Do you need any more information from my side to answer the question, did I forget something?

Answer 5

Hello KingKong-4442, below are the changes to your parsing scheme. The specification will be updated indicating what version of Windows OS introduced these changes. If you have follow-up questions, please contact me via email (dochelp at microsoft dot com).

Reserved field is now -> Additional flags and ExtendedDeviceStatus (1 byte): RemoteSessionNotHosted (02)
Device Hash is actually 19 bytes. So, it is - 6D1594FE05BD181C198278A9C3C49B217E94D3

Regards,
Sreekanth Nadendla
Microsoft Windows Open Specifications