BLE set custom Packet Header.

[NKern]

Hello, industry. Two questions for you:

1. To test fault-tolerance of our BLE scanning device we need to generate and advertise from another BLE device custom faulty (!) BLE packets.

As we understand, 
BLE data format = Preamble (1 byte) + Access address (4 bytes) + [Packet Payload] (2-39 bytes) + CRC (3 bytes).
Packet Payload = Header (2 bytes) + [Payload] (0-37 bytes).
Payload = AdvA (6 bytes) + AdvData (0-31 bytes)

SoftDevice API allows us to modify only Broadcast Data (AdvData = 31 byte), which does not break what we need.

So we are looking for a way how to modify with custom data all of the mentioned data structures:

Preamble (1 byte)
Access address (4 bytes)
PDU Type (2 bytes)
MAC address (6 bytes)

2. What part in BLE data format (if any) defines the total overall packet length to be accepted by BLE scan device?

[Sigurd]

Hi,

SoftDevice API allows us to modify only Broadcast Data (AdvData = 31 byte), which does not break what we need.

And in addition, it does not allow you to generate invalid packets, i.e. packets that does not follow the Bluetooth spec.

So we are looking for a way how to modify with custom data all of the mentioned data structures:

This is not supported with the SoftDevice. You will need to access and use the RADIO directly. The only code I'm aware of that does something similar like this is the beacon advertising done in SD timeslots in the Thingy:52 FW: https://github.com/NordicSemiconductor/Nordic-Thingy52-FW/blob/master/source/util/advertiser_beacon_timeslot.c

2. What part in BLE data format (if any) defines the total overall packet length to be accepted by BLE scan device?

There is a length field in the advertising data header: https://www.novelbits.io/bluetooth-low-energy-advertisements-part-1/

[NKern]

Thank you for quick response.

Can we get direct low-level access to RADIO on NRF51-DK or NRF52-DK?

[Sigurd]

NKern said:

Can we get direct low-level access to RADIO on NRF51-DK or NRF52-DK?

Yes.

[NKern]

Great, but how?

[Sigurd]

The radio transmitter example in the nRF5 SDK could be a good starting point.

https://infocenter.nordicsemi.com/topic/sdk_nrf5_v17.1.0/nrf_dev_radio_tx_example.html