import struct

def parse_btsnoop(filepath):
    with open(filepath, 'rb') as f:
        header = f.read(16)
        magic = header[:8]
        version = struct.unpack('>I', header[8:12])[0]
        datalink = struct.unpack('>I', header[12:16])[0]
        print(f"Magic: {magic}, Version: {version}, Datalink: {datalink}")
        
        pkt_num = 0
        ble_writes = []
        
        while True:
            pkt_hdr = f.read(24)
            if len(pkt_hdr) < 24:
                break
            
            orig_len, inc_len, flags, drops, ts = struct.unpack('>IIIIq', pkt_hdr)
            data = f.read(inc_len)
            if len(data) < inc_len:
                break
            
            pkt_num += 1
            direction = "SENT" if (flags & 1) == 0 else "RECV"
            
            if len(data) < 4:
                continue
                
            acl_hdr = struct.unpack('<HH', data[:4])
            handle = acl_hdr[0] & 0x0FFF
            
            if len(data) < 8:
                continue
            l2cap = struct.unpack('<HH', data[4:8])
            cid = l2cap[1]
            
            if cid != 4:
                continue
            
            att_opcode = data[8] if len(data) > 8 else None
            
            if att_opcode in (0x52, 0x12):
                att_handle = struct.unpack('<H', data[9:11])[0] if len(data) > 10 else None
                payload = data[11:] if len(data) > 11 else b''
                hex_payload = payload.hex()
                
                ble_writes.append({
                    'dir': direction,
                    'opcode': f'0x{att_opcode:02x}',
                    'handle': f'0x{att_handle:04x}' if att_handle else None,
                    'payload': hex_payload,
                    'payload_len': len(payload),
                })
        
        print(f"\nTotal packets: {pkt_num}")
        print(f"BLE writes found: {len(ble_writes)}")
        print(f"\n--- BLE Write Commands ---")
        for i, w in enumerate(ble_writes):
            print(f"[{i:3d}] {w['dir']} {w['opcode']} handle={w['handle']} len={w['payload_len']} payload={w['payload']}")
        
        return ble_writes

writes = parse_btsnoop('/tmp/FS/data/misc/bluetooth/logs/btsnooz_hci.log')