Before Android 4.2, BlueZ is the default Bluetooth stack. Starting with Android 4.2, Google launched Bluedroid, which was developed with Broadcom, in place of BlueZ in the Android source code. It supports both Classic Bluetooth and Bluetooth Low Energy. In Android 8.0, it also introduced some new features. Now, Bluedroid can support a lot of profiles through various protocols.Rich and complex services may often introduce bugs. I have audited most of the protocol code on Bluedroid. Hence, just relying on a laptop, I can turn on a variety of Bluetooth protocol communication channels, through which the packets of different protocols can be sent to remote devices. By sending different kinds of attack packets, spoofing Bluetooth services and bypassing various restrictions, many types of vulnerabilities were discovered. So far, I have discovered and reported 25+ vulnerabilities with a total bonus of $90,000 USD on Bluedroid in the first half of 2018. All of them can be triggered remotely and do not require user interaction. I will bring it up in hope of arousing the attention and discussion in the industry. In this presentation, I'll introduce all representative vulnerabilities, and how vulnerable the Bluedroid code is, including some architectural design issues. Bluedroid is very complicated, sometimes even when the vulnerable code are exposed, it will might be hard to write the PoC that could effectively trigger the vulnerability. In this section, I'll explain how I discovered these attack surfaces and attack vectors. Then I will share the methods to trigger the vulnerable code only using a laptop with these attack vectors, as well as how researchers can find new attack vectors. Finally, I will give some improvement suggestions about Bluedroid code.