Segfault when running knob attack

[mrmischi3f]

I am trying to run the Knob attack using bt_exploiter. However when the ESP32 tries to do the connection I get the following:

Assigned CPUSET:
0, 1, 2, 3, 
/proc/sys/kernel/sched_rt_runtime_us = -1
Enabling Core dump for this process: ulimit -c unlimited
Loading Model...
Model Loaded. Total States:169  Total Transistions:1299
Loop detection ENABLED
[Modules] Loading C++ Modules at "modules/exploits/bluetooth/"
[Modules] --> repeated_host_connection.so loaded
[Modules] --> duplicated_iocap.so loaded
[Modules] --> paging_scan_disable.so loaded
[Modules] --> truncated_sco_link_request.so loaded
[Modules] --> feature_req_ping_pong.so loaded
[Modules] --> feature_response_flooding.so loaded
[Modules] --> sdp_unkown_element_type.so loaded
[Modules] --> lmp_invalid_transport.so loaded
[Modules] --> truncated_lmp_accepted.so loaded
[Modules] --> lmp_auto_rate_overflow.so loaded
[Modules] --> au_rand_flooding.so loaded
[Modules] --> invalid_max_slot.so loaded
[Modules] --> noncomplicance_duplicated_encryption_request.so loaded
[Modules] --> lmp_max_slot_overflow.so loaded
[Modules] --> lmp_overflow_dm1.so loaded
[Modules] --> invalid_feature_page_execution.so loaded
[Modules] --> knob.so loaded
[Modules] --> sdp_oversized_element_size.so loaded
[Modules] --> duplicated_encapsulated_payload.so loaded
[Modules] --> invalid_setup_complete.so loaded
[Modules] --> wrong_encapsulated_payload.so loaded
[Modules] --> lmp_overflow_2dh1.so loaded
[Modules] --> invalid_timing_accuracy.so loaded
[Modules] --> noncompliance_invalid_stop_encryption.so loaded
[Modules] 24/24 Modules Compiled / Loaded
[ESP32BT] HCI Bridge ON: /dev/pts/3
[ESP32BT] Firmware version: 1.4.1
[ESP32BT] LMP Sniffing ENABLED
[ESP32BT] TX Packet interception ENABLED
[ESP32BT] [!] RX Bypass DISABLED
[ESP32BT] [!] Bypass on Demand DISABLED
[ESP32BT] [!] Role Switch ENABLED
[ESP32BT] Own BDADDR set to bc:bb:b1:8c:dd:4e
[ESP32BT] Measuring UART Latency...
[ESP32BT] USB Latency:119 us [OK]
Serial port /dev/ttyUSB1@4000000 opened
[Monitor] ERROR: Could not open /dev/ttyUSB3@115200
Host BDAddress randomized to e2:d1:b7:c9:c6:f8
[!] Global timeout started with 45 seconds
[BT Program] Starting program bin/sdp_rfcomm_query -u /dev/pts/3 -a b0:be:83:63:92:5d --iocap 3 --authreq 3 --bounding 1
bin/sdp_rfcomm_query -u /dev/pts/3 -a b0:be:83:63:92:5d --iocap 3 --authreq 3 --bounding 1
-u /dev/pts/3 -a b0:be:83:63:92:5d --iocap 3 --authreq 3 --bounding 1
/home/lightship/wdissector/bin/sdp_rfcomm_query
Packet Log: logs/Bluetooth/hci_dump.pklg
H4 device: /dev/pts/3
address=b0:be:83:63:92:5d
iocap=3
authreq=3
bouding=1
Local version information:
- HCI Version    0x0008
- HCI Revision   0x030e
- LMP Version    0x0008
- LMP Subversion 0x030e
- Manufacturer 0x0060
Unknown manufacturer / manufacturer not supported yet.
Local name: 
BTstack up and running on E2:D1:B7:C9:C6:F8.
Starting RFCOMM Query
[Baseband] TX --> FHS
[LMP] TX --> LMP_features_req
[LMP] RX <-- LMP_features_res
[LMP] TX --> LMP_features_req_ext
[LMP] RX <-- LMP_features_res_ext
[LMP] TX --> LMP_features_req_ext
[LMP] RX <-- LMP_features_res_ext
[LMP] TX --> LMP_version_req
[LMP] RX <-- LMP_version_res
[LMP] TX --> LMP_timing_accuracy_req
[LMP] RX <-- LMP_timing_accuracy_res
[LMP] TX --> LMP_host_connection_req
[LMP] RX <-- LMP_slot_offset
[LMP] RX <-- LMP_switch_req
[LMP] TX --> LMP_accepted
[Baseband] RX <-- FHS
[LMP] RX <-- LMP_accepted
[LMP] TX --> LMP_setup_complete
[LMP] RX <-- LMP_setup_complete
[LMP] TX --> LMP_max_slot
[LMP] TX --> LMP_auto_rate
[LMP] RX <-- LMP_packet_type_table_req
[LMP] TX --> LMP_packet_type_table_req
[LMP] RX <-- LMP_max_slot
[LMP] RX <-- LMP_max_slot_req
[LMP] TX --> LMP_accepted
[LMP] RX <-- LMP_auto_rate
[LMP] RX <-- LMP_not_accepted_ext
[LMP] TX --> LMP_accepted_ext
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0041)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0042)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0042)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0043)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0043)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0044)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0044)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0045)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0045)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0046)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0046)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0047)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0047)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0048)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0048)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x0049)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x0049)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x004a)
[L2CAP] RX <-- Connection Response - Refused - no resources available (SCID: 0x004a)
SDP query failed 0x67, retrying...
[L2CAP] TX --> Connection Request (SDP, SCID: 0x004b)
[BT Program] Restart Triggered
Process already started, stopping now...
Segmentation fault

From all the tries I've done I conclude that once the SDP query is done the exploiter wants to restart the connection instead of continuing into the pairing phase where the KNOB attack takes place. Am I missing something?

Since the source code of the exploiter is not public, I can not debug exactly what the problem is as the coredump from the segfault indicates some kind of problem related to the threads I assume the binary creates to perform the BT connection.

Can you help me with that?