[mergen3107]

Some progress!

I tested the keyboard with a Samsung Galaxy phone - it works fine, NUMPAD keys 1-4 are correct.

In res/raw/bt_keypad.json I found this:

{
  "keypad": [
    {
      "keySet": [
        "KEYCODE_F1"
      ],
      "shortPressAction": "KEYCODE_MENU",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F2"
      ],
      "shortPressAction": "KEYCODE_BACK",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F3"
      ],
      "shortPressAction": "showDisplayControlAndIncreaseContrast",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F4"
      ],
      "shortPressAction": "fullRefreshScreen",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F5"
      ],
      "shortPressAction": "screenshot",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F6"
      ],
      "shortPressAction": "toggleFrontLight",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F7"
      ],
      "shortPressAction": "KEYCODE_F7",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F8"
      ],
      "shortPressAction": "back_to_home",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F9"
      ],
      "shortPressAction": "showDisplayControlDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F10"
      ],
      "shortPressAction": "showRefreshModeDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F11"
      ],
      "shortPressAction": "KEYCODE_F11",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F12"
      ],
      "shortPressAction": "openFrontLightDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_1"
      ],
      "shortPressAction": "KEYCODE_BUTTON_1",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_2"
      ],
      "shortPressAction": "KEYCODE_BUTTON_2",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_3"
      ],
      "shortPressAction": "KEYCODE_BUTTON_3",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_4"
      ],
      "shortPressAction": "KEYCODE_BUTTON_4",
      "longPressAction": "",
      "repeat": false
    }
  ]
}

As you can see this is exactly the substitution used for hijacking!
Onyx uses those for any keyboard connected, BT or not, I think.

Now, how could I proceed to replace this file in the apk safely?