wpair-app - WPair is a defensive security research tool that d

项目说明

<p align="center">
<img src="assets/logo.png" alt="WhisperPair Logo" width="120" height="120">
</p>

<h1 align="center">WPair</h1>

<p align="center">
<strong>C (eg WhisperPair) Scanner & Research Tool</strong>
</p>

<p align="center">
<a href=" src=" alt="Platform"></a>
<a href=" src=" alt="Kotlin"></a>
<a href=" src=" alt="CVE"></a>
<a href="LICENSE"><img src=" alt="License"></a>
</p>

<p align="center">
<a href="#features">Features</a> •
<a href="#installation">Installation</a> •
<a href="#usage">Usage</a> •
<a href="#how-it-works">How It Works</a> •
<a href="#"></a> •
<a href="#credits">Credits</a>
</p>

---

Disclaimer

This application is an independent implementation created by in his own capacity. The original KU Leu discovered and disclosed the but have not released any code and are not affiliated with this project. Their inclusion in credits is solely to acknowledge their research contribution.

O

WPair is a defensi research tool that demonstrates the C in Google's Fast Pair protocol. This affects millions of Bluetooth audio devices worldwide, allowing unauthorized pairing and potential microphone access without user consent.

> Purpose: Help security researchers, device manufacturers, and end-users identify devices that need firmware updates.

Features

| Feature | Description |
|---------|-------------|
| BLE Scanner | Discovers Fast Pair devices broadcasting the 0xFE2C service UUID |
| Tester | Non-in check if device is patched against C |
| Exploit Demonstration | Full proof-of-concept for authorized security testing |
| HFP Audio Access | Demonstrates microphone access post-exploitation |
| Li | Real-time audio streaming to phone speaker |
| Recording | Sa audio as M4A files |

Screenshots

<p align="center">
<img src="assets/screenshot_scanner.png" width="250" alt="Scanner Screen">
<img src="assets/screenshot_.png" width="250" alt=" Device">
<img src="assets/screenshot_recordings.png" width="250" alt="Recordings">
</p>

Note on Find Hub Network (FMDN) tracking

This tool deliberately does not include FMDN pro functionality. While the chain technically allows enrolling compromised devices into Google's Find Hub Network for persistent location tracking, I' not to implement this capability. Con someone's headphones into a covert tracking beacon crosses a clear ethical line from security research into stalkerware territory. The Account Key write and audio access demonstrations are sufficient to prove the 's se.

Installation

Requirements

Android 8.0 (API 26) or higher

Bluetooth LE support

Location permission (required for BLE scanning on Android) / Nearby Devices (A13+)

Download

1. Go to Releases
2. Download the latest WPair-vX.X.X.apk
3. Enable "Install from unknown sources" if prompted
4. Install and grant required permissions

Build from Source

Usage

1. Scan for Devices

Tap Scan to disco Fast Pair devices. Devices in pairing mode will show a "Pairing" badge.

2. Test

For devices not in pairing mode, tap Test to check if they're . This is non-in and doesn't pair with the device.

| Status | Meaning |
|--------|---------|
| | Device is affected by C |
| Patched | Device has been updated with security fix |
| Error | Test inconclusi may be already paired) |

3. Exploit (Authorized Testing Only)

For devices, tap Magic to demonstrate the full exploit chain:

Key-Based Pairing bypass

BR/EDR address extraction

Bluetooth Classic bonding

Account Key persistence

4. Audio Access

After successful pairing:
1. Tap Connect Audio (HFP) to establish Hands-Free Profile
2. Use Live for real-time listening through phone speaker
3. Use Record to sa as M4A file

How It Works

Attack Flow

C: Fast Pair Key-Based Pairing Authentication Bypass (also known as WhisperPair)

Se: High
C: 8.1
Affected: Google Fast Pair Protocol implementations

#### Technical Details

The Fast Pair protocol uses Key-Based Pairing to authenticate pairing requests. The exists because:

1. Missing Signature : Many devices accept Key-Based Pairing requests without the cryptographic signature
2. No User Confirmation: The protocol doesn't require explicit user consent for pairing
3. Persistent Access: Attackers can write Account Keys for permanent device tracking

#### Impact

Unauthorized Pairing: Attacker pairs with 's headphones without consent

Microphone Access: Full access to device microphone via HFP profile

Location Tracking: Persistent tracking Key ad

#### Affected Devices

Major affected manufacturers include:

JBL

Harman Kardon

Sony (select models)

Marshall

And many more...

Project Structure

Credits

App De

Original Research Team

KU Leuven, Belgium

| Researcher | Affiliation |
|------------|-------------|
| Sayon Duttagupta* | COSIC Group |
| Nikola Antonijević | COSIC Group |
| Bart Preneel | COSIC Group |
| Seppe Wyns* | DistriNet Group |
| Daée | DistriNet Group |

*\* Primary authors*

Funding for the original research: Flemish Go Cybersecurity Research Program ()

Resources

WhisperPair Research Paper

Demo Video

COSIC Research Group

Media Co

WIRED

9to5Google

Legal Disclaimer

> This tool is provided for authorized security research and educational purposes only.

Only test devices you own or have explicit written permission to test

Unauthorized access to computer systems is illegal in most jurisdictions

The de are not responsible for misuse of this tool

This tool is intended to help identify devices for remediation

By using this software, you agree to use it responsibly and in compliance with all applicable laws.

See Also

| Tool | Description |
|------|-------------|
| Stryker | Comprehensi pentesting toolkit for Android |

Support De

If you find WhisperPair useful for your security research:

<a href="
<img src=" alt="Star on GitHub">
</a>

Crypto Donations:

License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

---

<p align="center">
_{Built with ❤️ for the security research community}
</p>

项目信息

开发语言：Kotlin

Star 数：856

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕WPair is a defensive security research tool that demonstrates the CVE-2025-36911 (eg WhisperPair) vulnerability in Google's Fast Pair protocol. This vulnerability affects millions of Bluetooth audio devices worldwide, allowing unauthorized pairing and potential microphone access without user consent.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。