d4rken
commented
1 month ago See here for details from the MagicPods project:
- https://github.com/steam3d/MagicPodsCore/blob/master/src/aap/Aap.h
- https://github.com/steam3d/MagicPodsCore/blob/master/src/aap/Aap.cpp
and here is a python script that can connect to AirPods from a desktop computer:
import bluetooth
# Change to MAC address of your AirPods
address = "MAC_ADDRESS"
aap_service = "74EC2172-0BAD-4D01-8F77-997B2BE0722A"
aap_port = 0x1001
# Commands taken from https://github.com/steam3d/MagicPodsCore/blob/master/src/aap/Aap.h
cmd_handshake = b"\x00\x00\x04\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
cmd_off = b"\x04\x00\x04\x00\x09\x00\x0d\x01\x00\x00\x00"
cmd_on = b"\x04\x00\x04\x00\x09\x00\x0d\x02\x00\x00\x00"
cmd_transparency = b"\x04\x00\x04\x00\x09\x00\x0d\x03\x00\x00\x00"
services = bluetooth.find_service(address=address)
service = [s for s in services if s["service-classes"] == [aap_service]]
if not service:
print("Device does not have AAP service")
exit()
sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
sock.connect((address, aap_port))
print("Connected to AirPods")
print("Sending handshake...")
sock.send(cmd_handshake)
while True:
# Ignore the responses because I am unsure what they mean
# res = sock.recv(1024)
# print(f"Response: {res.hex()}")
print("Select command:")
print("1. Turn off")
print("2. Turn on")
print("3. Toggle transparency")
print("4. Exit")
cmd = input("Enter command: ")
if cmd == "1":
sock.send(cmd_off)
elif cmd == "2":
sock.send(cmd_on)
elif cmd == "3":
sock.send(cmd_transparency)
elif cmd == "4":
break
sock.close()
fynngodau
vulpes2
xerootg
Our sister project for Windows, MagicPods, has reverse engineered reading and writing data to AirPods.
The good news is that this actually works and I could reproduce it on a desktop computer running linux. So support for changing settings (ANC mode, microphone etc.) and getting more reliable information would be possible
The bad news is that I'm unable to get the connection established on an Android device.
If anyone can figure out how to establish the connection, then I could start on adding support for this.
AirPods require a Bluetooth connection that uses the
L2CAPprotocol. I was unable to establish this connection on a Pixel 6 running Android 15 and Pixel 8 running Android 14.This is what I tried so far
Use the public
createInsecureL2capChannelmethodbut that seems to have limits on the
PSMvalue that you can providehttps://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Bluetooth/system/stack/l2cap/l2c_api.cc;l=416?q=%22Invalid%20BLE%20PSM%20value%22
Then I tried the hidden method
createInsecureL2capSockethttps://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Bluetooth/framework/java/android/bluetooth/BluetoothDevice.java;l=2924?q=createInsecureL2capSocket&sq=&ss=android%2Fplatform%2Fsuperproject%2Fmain
Which needed some convincing to execute (https://github.com/LSPosed/AndroidHiddenApiBypass) but
still no dice.
A friend has tried simulating AirPods on a Desktop computer and was able to connect to that mock via
createInsecureL2capSocketfrom an Android phone, but wasn't able to do this with actual AirPods.