Change ANC mode from app

[superbonaci]

Would like to know if it's possible to change ANC settings from your app, like from iOS Control Center:

• Noise Cancellation
• Off
• Transparency

I've purchased version 1.0.71.0

[steam3d]

Hi. Unfortunately, Apple does not allow to do it.

[superbonaci]

Is that you can do it with your application and Apple has some contract with you, or is that you don't know how to do it?

[steam3d]

Apple does not provide documentation how their protocols works. No one knows how AirPods works. There are only assumptions about how they work.

I am assuming that a dedicated driver is needed to control the headphones. This requires extensive experience in reverse engineering.

[superbonaci]

I don't think any special driver is needed, except that they use any custom profile protocol to send additional parameters, similar to how Samsung operates: https://github.com/ThePBone/GalaxyBudsClient https://github.com/ThePBone/GalaxyBuds-BatteryLevel

It's just a matter of finding it.

[steam3d]

This is the list of available AirPods protocols:

[{'description': 'PnP Information',
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': None,
  'port': None,
  'profiles': [],
  'protocol': None,
  'provider': None,
  'service-classes': ['1200'],
  'service-id': None},
 {'description': None,
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': 'AAP Server',
  'port': 4097,
  'profiles': [('4B6F7C74-07F4-49DE-B0B9-AB4304728F29', 256)],
  'protocol': 'L2CAP',
  'provider': None,
  'service-classes': ['74EC2172-0BAD-4D01-8F77-997B2BE0722A'],
  'service-id': None},
 {'description': None,
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': 'Handsfree',
  'port': 7,
  'profiles': [('111E', 262)],
  'protocol': 'RFCOMM',
  'provider': None,
  'service-classes': ['111E', '1203'],
  'service-id': None},
 {'description': None,
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': 'AVRCP Target',
  'port': 23,
  'profiles': [('110E', 261)],
  'protocol': 'L2CAP',
  'provider': None,
  'service-classes': ['110C'],
  'service-id': None},
 {'description': None,
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': 'AVRCP Controller',
  'port': 23,
  'profiles': [('110E', 261)],
  'protocol': 'L2CAP',
  'provider': None,
  'service-classes': ['110E', '110F'],
  'service-id': None},
 {'description': None,
  'host': 'XX:XX:XX:XX:XX:XX',
  'name': 'Audio Sink',
  'port': 25,
  'profiles': [('110D', 259)],
  'protocol': 'L2CAP',
  'provider': None,
  'service-classes': ['110B'],
  'service-id': None}]

My guess is that the AAP Server is responsible for this, which on Windows does not have a driver. Dennis was able to access the console, but only through a dedicated wire https://twitter.com/ttdennis/status/1249975453219258374

I have no experience with reverse engineering and i do not have mac computer to try and understand the protocols.

[steam3d]

there is also another option - BLE (not Classic bluetooth), but i am almost sure that Apple use other way. Also Apple use icloud to storage some keys. They are used to communicate with AirPods.

[superbonaci]

I know about Windows. You would be better off with Linux and BlueZ to debug bluetooth.

[steam3d]

Yes. Linux much better, i use it. In this case you have 2 options.

1. Redirect traffic throughout third device
2. Use traffic sniffer for Mac os (it better solution)

Anyway Samsung and Sony use enough simple way to transfer data, expect Apple. If i will have a free access to mac os i maybe i can found something. I also check other developers to get information.

[superbonaci]

You say that Airpods use iCloud to communicate to devices, that can be true when checking for lost devices. However, if you have an iPad Pro in airplane mode (only bluetooth), and you connect your Airpods Pro to it, you can change ANC level at any moment, they don't require to use "internet" or "cloud" to switch between modes. So to adjust that setting it must be something sent over bluetooth. I don't think they use additional WiFi channels to operate.

Probably you can use _WireShark to sniff that information.

[MulverineX]

Perhaps you could load up a hackintosh partition to do this? I believe there are certain places where you can get OS images. Would require an Intel processor with integrated graphics or alongside a supported AMD card.

[superbonaci]

I has already set up the long press to switch between Noise Cancellation and Transparency. The problem is that it doesn't cycle through Off mode, which can only be done by external software. @MulverineX that's a great idea, maybe I could even set up a virtual machine and pass it a new usb bluetooth dongle. The whole idea is to cycle through Off mode as well (which is the mode that saves more battery I'm guessing), no idea why Apple didn't put it.

[bigplayer-ai]

I has already set up the long press to switch between Noise Cancellation and Transparency. The problem is that it doesn't cycle through Off mode, which can only be done by external software. @MulverineX that's a great idea, maybe I could even set up a virtual machine and pass it a new usb bluetooth dongle. The whole idea is to cycle through Off mode as well (which is the mode that saves more battery I'm guessing), no idea why Apple didn't put it.

Apple being Apple. I was thinking why magic pods does not have this feature. Just searched the issues turns out it is impossible because Apple does not allow it except on their devices.

[MulverineX]

Yeah all of that could be worked around with some reverse engineering. I'm just not at all familiar with doing that 😅. The part where it could get tough is if there's an authenticated handshake you have to do first, especially if that goes through Apple's servers.

[steam3d]

@MulverineX The main problem how to connect to AirPods services. AirPods refuse regular connection. Usually you need to connect to Bluetooth service then send some data and receive result if everything ok you can continue send / read data.

Also we know that some necessary keys storage in iCloud, maybe those keys used to sing data or encrypt or something else and AirPods just unencrypt it.

Also some person figured out that AirPods use a spicial OS instead of ordinary firmware like use most Bluetooth headphones.

[bigplayer-ai]

Yeah till they patch it. I don't like reverse engineering as software tends to change alot.

[MulverineX]

There's a good chance that once we have a good method it'll stick. I doubt Apple's going to up and change their whole protocol for these, they're just wireless earbuds.

[steam3d]

@MulverineX They already did. AirPods Pro 2 works different from other headphones.

[Kohakka]

dammit apple