BTServer

Daemon that implements iPhone bluetooth stack. Based on BLUEmagic 2.1.

Implemented services: Handsfree, Phonebook, Remote, A2dp, Hid, Sensor, NetSharing, Gaming, WiAP, Braille.

IPC Client library: MobileBluetooth (a private framework). Obj-C level library: BluetoothManager.

Written in C++ with STL classes.

Packet log :

touch /var/mobile/Library/Logs/BTServer_hci.pklg 
killall BTServer

(Copy to Mac, open with PacketLogger)

OS 4.0 Beta 4 - logging:

plutil -create /var/mobile/Library/Preferences/com.apple.MobileBluetooth.debug.plist
plutil -key DiagnosticMode -value true -type bool /var/mobile/Library/Preferences/com.apple.MobileBluetooth.debug.plist
plutil -key DefaultLevel -value Debug -type string /var/mobile/Library/Preferences/com.apple.MobileBluetooth.debug.plist
killall BTServer

Verbose log in /var/mobile/Library/Logs/BTServer_stdout.log.

Each service is accessed by the stack using a virtual function table of functions inherited from a base service class, so it's possible to easily intercept all functions for a given service and/or modify its behavior. It should also be possible (although not too easy) to create new services overriding about 5-10 functions in the VTable of the base Service class.

Debugging: during debugging Bluetooth may interfere with WiFi, use USB tunneling in that case.

Reverse engineered header here: http://code.google.com/p/iphone-bluetooth/source/browse/trunk/btGpsServer/MobileBluetooth.h