Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I dig up the Bluetooth link key for a paired device in Windows 7? Is this something that is dependent on the Bluetooth stack I'm using (Toshiba), or is there a generic place to store these in Windows 7?

Note: I'm not talking about the six-digit code usually typed by the user during pairing - that is worthless since it's discarded after pairing process. What I mean is the 128-bit link key that the devices exchange during pairing, and use thereafter to encrypt all their Bluetooth traffic.

Background:

I dualboot Windows 7 / Ubuntu on my laptop, and I would like to have my phone paired to both OS's. Since the dualbooting computer has only one Bluetooth adapter and thus only one Bluetooth address, I cannot do two pairings to the phone, since on the second pairing (Windows) the phone just replaces the previous pairing (Linux) to the same Bluetooth address.

A thread on Ubuntu forums pointed me to what I have to do - pair first on Linux, then on Windows, and then replace the link key on Linux side with the one Windows negotiated.

I can find the Linux side pairing key from /var/lib/Bluetooth/[BD_ADDR]/linkkeys - no problems there.

However, on Windows side I can't find the key. According to the forum post, on Windows side the key should be in SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\[BD_ADDR] but while that registry key does exist, it has no subkeys. (And a similar registry path in ControlSet001 didn't have any subkeys either.)

One thing I've been instructed to do is to capture all events during pairing with Sysinternals Process Monitor. I did this, but I haven't been able to find any useful information from the captured events, not even by exporting the data to a huge XML and grepping that with the BD_ADDRs (with or without colons).

So how could I find the link key for a paired device in Windows 7?

Some reference information: Wikipedia: Bluetooth, Security Now: Bluetooth security

share|improve this question

3 Answers 3

up vote 5 down vote accepted
+250

The registry key you should use is :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys.

On my computer, it refused to let me access this key. I had to change the owner to Administrators before I could see the sub-key.

If you are using the Toshiba Bluetooth stack, its keys are stored somewhere else. One can either find where, or simply return to the Microsoft stack. In the later case, the Bluetooth keys will be stored in the registry as above.

This thread describes the process :

  1. Uninstall Toshiba Bluetooth (Add/Remove programs),
  2. Reboot,
  3. Windows should now detect the "new" Bluetooth device and install its own drivers for it.

Caution: Create a system restore point first, and ensure you have the installation media for the Toshiba driver for going back (just in case). Test well the functionality of the paired phone before crying victory.

share|improve this answer
    
I changed the owner to Administrator, which then let me access that key, but unfortunately it contains no sub-keys. –  Ilari Kajaste Jan 9 '11 at 12:00
    
Did you do that while paired? –  harrymc Jan 9 '11 at 13:28
    
Yes, I have and had the phone (plus two other devices) paired to windows. I wasn't connected to any of them at the time, though - I figure that couldn't matter since the key has to be stored in any case. –  Ilari Kajaste Jan 9 '11 at 18:33
1  
I am sure Toshiba wouldn't use Microsoft registry entries. Can you go back to the Microsoft stack? –  harrymc Jan 10 '11 at 11:05
1  
This thread says: 1. Uninstall Toshiba Bluetooth (Add/Remove programs), 2. Reboot, 3. Windows should now detect the "new" Bluetooth device and install its own drivers for it. Create a system restore point first, and ensure you have the installation media for the Toshiba driver (in case). If this works, test well only the functionality of the paired phone that you really use. –  harrymc Jan 10 '11 at 20:14

For the reference, on Microsoft Bluetooth stack, the link keys are located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\aabbccddeeff where aabbccddeeff is your Bluetooth adapter. Since the adapter is already installed, this key should exist.

Within that key, you can have multiple REG_BINARY values, where the value name is the paired device's MAC address (in same form -- hex, lowercase, no separators) and the value is the link key (16 bytes).

To pick up the link keys from OS X, perform (in OSX Terminal) defaults read /private/var/root/Library/Preferences/blued.plist. Within LinkKeys, you should have a link key per MAC address of a paired device. The keys are base64-encoded so do: echo -n 'aabbcc...==' | base64 -d | hexdump -C and type this key into your Windows registry.

share|improve this answer

I had exactly the same problem, so I found this post and now want to share my experience. If you have android smartphone that task might be actually much more easy since pairing linkkey should be present on both of your devices.

The most useful tool is the ADB from Android SDK.

Let's assume the phone have XX^6 address and PC -- YY^6

$ adb shell
~ # find|grep linkkeys
~ # ./data/misc/bluetoothd/XX:XX:XX:XX:XX:XX/linkkeys
~ # cat ./data/misc/bluetoothd/XX:XX:XX:XX:XX:XX/linkkeys
YY:YY:YY:YY:YY:YY 393FCA48F0DB57AA4D59F423E4EA60D5 5 -1
~ #

Thus you can just pick the key from that file and put it into similar file on your PC:

pc $ sudo -s
pc # cat /var/lib/bluetooth/YY:YY:YY:YY:YY:YY/linkkeys
XX:XX:XX:XX:XX:XX 393FCA48F0DB57AA4D59F423E4EA60D5 5 0

This way seems to be most easy as linux and android usually use the same bluez bluetooth stack.

Still, if you personally despise such a technique, there is another way for getting the key from the windows registry provided standard windows drivers are used. I did receive that security message dialog, so I used "chntpw" native linux utility which allows one to reset the password or edit the windows registry file. The file requiered was "windows\system32\config\SYSTEM".

Here it goes:

$ chntpw -e SYSTEM
blah-blah-blah
> cd ControlSet001\services\BTHPORT\Parameters\Keys\yyyyyyyyyyyy
(...)\BTHPORT\Parameters\Keys\5cac4c10c4f1> ls
Node has 0 subkeys and 1 values
  size     type            value name             [value if type DWORD]
     16  REG_BINARY        <xxxxxxxxxxxx>

(...)\BTHPORT\Parameters\Keys\5cac4c10c4f1> hex xxxxxxxxxxxx
Value <xxxxxxxxxxxx> of type REG_BINARY, data length 16 [0x10]
:00000  39 3F CA 48 F0 DB 57 AA 4D 59 F4 23 E4 EA 60 D5 9?.H..W.MY.#..`.

As you can see that is exactly the same numbers as in files above. Hope it will help future generations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.