Without entering the Factory Mode by using Bluetooth.

Procedure runs the script file every time Bluetooth starts.

This requires modifications of your camera internal file system.

Run the standard procedure for rooting the camera and starting the telnet server on the camera.

See https://github.com/ottokiksmaler/nx500_nx1_modding/blob/master/Running-telnet-server-on-camera.md

Once you have telnet access do following:

[root@drime5 ~]# mount -o remount,rw /
[root@drime5 ~]# cd /usr/sbin
[root@drime5 sbin]# mv bluetoothd bluetoothd.orig
[root@drime5 sbin]# vi bluetoothd
#!/bin/bash
if [ -x /opt/storage/sdcard/scripts/init.sh ];
then
  /opt/storage/sdcard/scripts/init.sh &
fi
/usr/sbin/bluetoothd.orig -d
[root@drime5 sbin]# chmod +x bluetoothd
[root@drime5 sbin]# ls -la blu*
-rwxr-xr-x 1 root root    136 Apr  8 10:50 bluetoothd
-rwxr-xr-x 1 root root 332440 Apr  8 10:38 bluetoothd.orig
[root@drime5 sbin]# sync;sync;sync
[root@drime5 sbin]# mount -o remount,ro /

Here is the example init.sh (located in scripts directory on SD card):

#!/bin/bash
killall keyscan && sleep 1
/mnt/mmc/scripts/keyscan /dev/event0 /dev/event1 /mnt/mmc/scripts/ &

You can reboot the camera if you want to be extra sure changes were written to disk:

reboot

You can power off the camera now, remove info.tg file from SD card (or just rename it to info.tgx or similar). If you create the init.sh file in SD card directory scripts it will be executed every time (pay attention to this) you start BT on the camera. If you want to start it only once use any method to check whether it's already running (PID file, lock file, env variable, ps, etc).