How to send and receive data using BluetoothManager.framework private API on iOS

Question

These Days I'm working on a project in which we need to connect an non-MFI Bluetooth Device to iPhone,and that device doesn't support to be an BLE peripheral client, so we have to do this on classical bluetooth.

I managed to paired and connected the device to iPhone using BluetoothManager.framework with the guide of the demo project BeeTee

But I don't known how to send and recv data, I can't find the API in the class-dump headers.

It seems that the answer lies in this three structs:BTAccessoryManagerImpl & BTSessionImpl & BTDeviceImpl ,but I can't get the definition of them.

@class NSMutableDictionary;

struct BTSessionImpl { };
struct BTDeviceImpl { };


@interface BluetoothManager : NSObject {
    struct BTAccessoryManagerImpl { } *_accessoryManager;
    BOOL _audioConnected;
    int _available;
    NSMutableDictionary *_btAddrDict;
    NSMutableDictionary *_btDeviceDict;
    struct BTDiscoveryAgentImpl { } *_discoveryAgent;
    struct BTLocalDeviceImpl { } *_localDevice;
    struct BTPairingAgentImpl { } *_pairingAgent;
    BOOL _scanningEnabled;
    BOOL _scanningInProgress;
    unsigned int _scanningServiceMask;
    struct BTSessionImpl *_session; // struct BTSessionImpl { } *_session;

}

+ (int)lastInitError;
+ (id)sharedInstance;

- (struct BTAccessoryManagerImpl *)_accessoryManager; // - (struct BTAccessoryManagerImpl { }*)_accessoryManager;
- (void)_advertisingChanged;
- (BOOL)_attach:(id)arg1;
- (void)_cleanup:(BOOL)arg1;
- (void)_connectabilityChanged;
- (void)_connectedStatusChanged;
- (void)_discoveryStateChanged;
- (BOOL)_onlySensorsConnected;
- (void)_postNotification:(id)arg1;
- (void)_postNotificationWithArray:(id)arg1;
- (void)_powerChanged;
- (void)_removeDevice:(id)arg1;
- (void)_restartScan;
- (void)_scanForServices:(unsigned int)arg1 withMode:(int)arg2;
- (void)_setScanState:(int)arg1;
- (BOOL)_setup:(struct BTSessionImpl*)arg1;
- (void)acceptSSP:(int)arg1 forDevice:(id)arg2;
- (id)addDeviceIfNeeded:(struct BTDeviceImpl *)arg1;
- (BOOL)audioConnected;
- (BOOL)available;
- (void)cancelPairing;
- (void)connectDevice:(id)arg1 withServices:(unsigned int)arg2;
- (void)connectDevice:(id)arg1;
- (BOOL)connectable;
- (BOOL)connected;
- (id)connectedDevices;
- (id)connectingDevices;
- (void)dealloc;
- (BOOL)devicePairingEnabled;
- (BOOL)deviceScanningEnabled;
- (BOOL)deviceScanningInProgress;
- (void)enableTestMode;
- (BOOL)enabled;
- (void)endVoiceCommand:(id)arg1;
- (id)init;
- (BOOL)isAnyoneAdvertising;
- (BOOL)isAnyoneScanning;
- (BOOL)isDiscoverable;
- (BOOL)isServiceSupported:(unsigned int)arg1;
- (int)localDeviceSupportsService:(unsigned int)arg1;
- (id)pairedDevices;
- (void)postNotification:(id)arg1;
- (void)postNotificationName:(id)arg1 object:(id)arg2 error:(id)arg3;
- (void)postNotificationName:(id)arg1 object:(id)arg2;
- (int)powerState;
- (BOOL)powered;
- (void)resetDeviceScanning;
- (void)scanForConnectableDevices:(unsigned int)arg1;
- (void)scanForServices:(unsigned int)arg1;
- (void)setAudioConnected:(BOOL)arg1;
- (void)setConnectable:(BOOL)arg1;
- (void)setDevicePairingEnabled:(BOOL)arg1;
- (void)setDeviceScanningEnabled:(BOOL)arg1;
- (void)setDiscoverable:(BOOL)arg1;
- (BOOL)setEnabled:(BOOL)arg1;
- (void)setPincode:(id)arg1 forDevice:(id)arg2;
- (BOOL)setPowered:(BOOL)arg1;
- (void)showPowerPrompt;
- (void)startVoiceCommand:(id)arg1;
- (void)unpairDevice:(id)arg1;
- (BOOL)wasDeviceDiscovered:(id)arg1;

@end

Answer 1

Reading or writing data on a bluetooth connection can be done over a virtual file /dev/ttys*. After a successful connection to the right service, you need to call BTDeviceGetComPortForService from MobileBluetooth.framework, that will retrieve the correct file path. A full example with the right header file you will find here.

Open the file and read or write to it. That's it. To read data asynchronously you might have look here at the methods openTty and readCompletionNotification.

This worked for me on a jailbroken iOS 7 iPhone. I would like to hear if someone else has success with this solution.