Home

This wiki documents the protocol that Meta's smart glasses speak with their companion phone: Ray-Ban Meta, Oakley Meta and the rest of the family. It covers the radios, the encrypted link, the message layer, every service the phone uses, and the parts of Meta's servers that setup needs.

The parties

The diagram shows who talks to whom. Everything between the phone and the glasses runs on the glasses' own protocol, with no Meta server in the path. Meta's servers take part in setup and in two lookups.

flowchart LR
    G["Glasses"]
    P["Phone"]
    M["Meta servers"]
    P <-->|"Bluetooth LE L2CAP or Classic RFCOMM<br/>control, settings, assistant, small files"| G
    P <-->|"Wi-Fi Direct, the phone owns the group<br/>media, live stream"| G
    P -->|"login and ownership receipts at setup<br/>frame style, language packs"| M

Loading

The stack

Each layer carries the one above it as opaque bytes.

Layer	What it does	Page
Radio	LE L2CAP channel, Classic RFCOMM, or TCP over Wi-Fi Direct	Radios-and-links, Wi-Fi-Direct
Framing	Cuts a byte stream into whole messages	Transport-and-framing
AirShield	ECDH handshake, then AES-256-CBC and HMAC-SHA-256 on every frame	Link-setup-and-AirShield, AirShield-frames-and-ciphers
DataX	Channels, services and message types	DataX-channels
Trust	Proves the phone holds the owner key, on every connect	Identity-and-trust
Services	Protobuf, Thrift compact or FlatBuffers payloads per service	Service-catalogue

Protocol-overview walks one session from connect to the first service answer.

Pages

The glasses:

• Glasses-hardware: models and product ids, and what the glasses report about themselves.
• Firmware: the build fingerprint and the update query.
• Radios-and-links: advertising, bonding, LE L2CAP, RFCOMM and the one-session rule.
• Service-catalogue: every service id the firmware names.

The link:

• Protocol-overview: the layers and one whole session.
• Transport-and-framing: message lengths on a byte stream, and the COMMAND frame trap.
• Link-setup-and-AirShield: the handshake on svc5, the keys and the EndLinkSetup UUID rule.
• AirShield-frames-and-ciphers: frame bytes, padding and the cipher.
• DataX-channels: headers, tags, fragments, channel ids and error codes.

Identity:

• Identity-and-trust: the owner key and the svc36 trust exchange.
• Meta-login-and-ownership: Meta's login and the change of owner.
• Device-state-and-build-info: svc28 device state, svc100 build info, svc2000 capture signals.

Media:

• Capture-list: svc18, the list of captures and the re-requests.
• Airship-file-transfer: svc20, files in both directions.
• Live-photos-and-capture-formats: capture kinds, file formats and sensor logs.
• Wi-Fi-Direct: moving the session onto a Wi-Fi Direct group.
• Live-stream: the camera stream on svc51350.

Settings:

• Settings-and-RLDrive: svc31 writes and RLDrive syncs on svc33.
• Settings-catalogue: the setting keys, their fields and namespaces.
• MobileConfig: Meta's feature flags on the glasses and their table format.
• Notifications-and-contacts: svc46 notifications and the contact sync.

The assistant:

• Assistant-protocol: svc15, with the phone as the assistant server.
• Assistant-events: the NetEvent ids and the svc15 message types.
• Assistant-voice-and-languages: the glasses' own voice and language packs.
• Assistant-follow-ups-and-photos: follow-ups, photos for visual questions, Live AI.

Unknowns

Where a fact is not confirmed, the page says so in the sentence. Each page ends with its open questions, and Open-questions collects them. Terms are defined on Glossary.

Serial numbers, Bluetooth addresses and device uuids appear only as placeholders: <serial>, AA:BB:CC:DD:EE:FF and <device-uuid>.

Out of scope

The wiki covers what a companion phone sends and understands. It does not cover security research or installing apps on the glasses. Security reports follow SECURITY.md.

Reference code: Visor implements this protocol.