  Multiple initiatives propose utilizing Bluetooth Low Energy (BLE)
advertisements for contact tracing and SARS-CoV-2 exposure notifications. This
demo shows a research tool to analyze BLE advertisements; if universally
enabled by the vendors, the uncovered features could improve exposure
notifications for everyone. We reverse-engineer the firmware-internal
implementation of BLE advertisements on Broadcom and Cypress chips and show how
to extract further physical-layer information at the receiver. The analyzed
firmware works on hundreds of millions of devices, such as all iPhones, the
European Samsung Galaxy S series, and Raspberry Pis.
