How did you manage to create an L2Cap channel on Android?

[tyalie]

Hi,

Back when the first AirPods released, I already looked into the AACP side of the AirPods. I created one of the first Android support apps for the AirPods, and I wanted more than what the BLE notifications by the device could offer me. But I never figured out how to create a Bluetooth Classic L2Cap channel to write my own AACP driver. As I don't see any big changes in the Android API since then, how do you do it?

Back then I was even in contact with a dude, who send me some keychain tags with an nRF inside, so we could create a translation layer between AirPods and Android. Besides fixing a BLE compatibility issue, we wanted to create an AACP translation layer. But the project never got anywhere.

Thank you so much for this project. It's something I always dreamed about, but life moved on. It's super cool that y'all did it :D

[kavishdevar]

hi! thank you so very much for your work- I would not have been able to figure out the handshake/init-connection packet on my own without your documentation! :D

As I don't see any big changes in the Android API since then, how do you do it?

I too tried using the createL2capSocket on BluetoothDevice and discovered that was only for l2cap over LE, not br/edr. So, I'm using HiddenAPIBypass for accessing the private constructors for BluetoothSocket class to create a classic l2c socket directly.

Back then I was even in contact with a dude, who send me some keychain tags with an nRF inside, so we could create a translation layer between AirPods and Android. Besides fixing a BLE compatibility issue, we wanted to create an AACP translation layer. But the project never got anywhere.

That actually sounds like a great idea! Although, I tried running a custom stack instead of the Windows/BlueZ on linux, but I couldn't get airpods to play any sound over a2dp and hsp/hfp. I don't know what windows does different that AirPods accept the a2dp connection. however this wasn't the case with other bluetooth audio devices; a2dp worked just fine. Maybe there is something that AirPods check on the host to accept audio streams. This would also explain why a2dp (and even hsp/hfp) is not available on linux immediately after connecting, if at all. Wondering if you had any success with audio...

I started experimenting with a custom stack to figure out how to get the transparency and hearing aid customizations to work (it was a real pain- it works when I switch from a mac VM to linux, and then it just stops working after a few minutes!). I thought I'd make something using that for windows too removing the need for a unsigned driver (like in MagicPods), but I got nowhere because of the audio problem.

[tyalie]

hi! thank you so very much for your work- I would not have been able to figure out the handshake/init-connection packet on my own without your documentation! :D

I'm happy that you found it useful. I wanted to go soo much further with that :D Does librepods btw extract the magic keys from the AirPods? If yes, congrats ^^

using HiddenAPIBypass

Damn. Early whilst working on that project I thought about whether I could inject myself into the stack using a JNI program. But my 'hacking' skills weren't that developed back than. You've no idea how cool I find it to see people find ways to work around the artificial limitations, implementing what I could only have imagined back then ^^

I started experimenting with a custom stack to figure out how to get the transparency and hearing aid customizations to work

That's really funky idea :D But I think at least for Linux I'd recommend to maybe just fix or amend the BlueZ stack. It is open source at least. But for Windows, all is game. That BL stack is so broken in too many ways /0\ My focus with the AirPods was mostly on the BLE beacons from them and I quickly found out that this is simply not feasible on Windows as the BLE support is sporadic at best...

[kavishdevar]

sorry for the late reply, have been getting so many new issues lately :[

Does librepods btw extract the magic keys from the AirPods? If yes, congrats ^^

Yup! I did find the opcode for that, just to realize it was in your findings the whole time lol

Damn. Early whilst working on that project I thought about whether I could inject myself into the stack using a JNI program. But my 'hacking' skills weren't that developed back than. You've no idea how cool I find it to see people find ways to work around the artificial limitations, implementing what I could only have imagined back then ^^

I can totally relate to that! I've spent tens of hours into figuring out how to get a classic l2c socket opened on Android with no success! I had no knowledge of the AOSP codebase, and no real experience of android development when I started this. I even tried to make it a system app. But I gave up because system apps need to be complied with soong, and I wasn't ready to wait minutes to test out a small change.

That's really funky idea :D But I think at least for Linux I'd recommend to maybe just fix or amend the BlueZ stack. It is open source at least.

I really wish I had thought of that!

But for Windows, all is game. That BL stack is so broken in too many ways /0\ My focus with the AirPods was mostly on the BLE beacons from them and I quickly found out that this is simply not feasible on Windows as the BLE support is sporadic at best...

That's interesting! I thought this used BLE advertisements. Although, I've never tested it; haven't used windows in quite some time :p