REF // RFCOMM CH 15 → NOW
THIS IS AN EARBUD
THIS IS WHAT IT SAYSAA 0D 00 00 06 81 00 06 …
How a Mac learned to talk to a pair of earbuds — from electrons to a menu-bar app.
Begin the story ↓FIG. 00 — THE PROBLEM
00/08
the problem
On a phone, realme Link shows each bud's battery and changes noise cancelling, EQ, spatial audio and taps. On a Mac: nothing. The buds play music, and every setting is invisible. This is the story of fixing that, from the electrons up.
01/08
anatomy
Pull one apart along its axis and you find a speaker, three microphones, sensors, a battery, a radio and a processor with memory. Every setting Earshot changes ends up somewhere in here.
02/08
sound
Current through the voice coil pushes against the magnet, the diaphragm moves, and air moves with it. The ear tip seals it all in — without the seal there is no bass and nothing for noise cancelling to work with.
03/08
the brain
The Bluetooth SoC is radio, DSP and CPU on one chip. Its firmware reads and writes the flash, where your EQ, noise mode and tap actions are kept — which is why they survive switching to your phone.
04/08
senses
A feed-forward mic hears the world, a feedback mic hears your ear canal, a talk mic hears you. Infrared light bouncing off skin says “in ear”. Your finger changes the touch pad's capacitance.
05/08
power & radio
A tiny lithium-ion cell, charged through two pogo pins, and an antenna tuned to 2.4 GHz in the stem — where 79 channels are hopped 1600 times a second.
06/08
the door
Behind the music sits a hidden serial channel macOS never opens. Earshot opens it and asks, in nine bytes, “how full is your battery?” — and the buds answer: left 10 %.
07/08
the case
The case is a computer too: its own cell, a charger, and a Hall sensor that notices the lid. Each bud drops onto two pogo pins in its well; the case tells them its level, and the buds tell Earshot.
08/08
read on
Sound to bits, radio, the Bluetooth stack, macOS, the method, the protocols byte by byte, integrity, seven brands, the app and shipping. Start anywhere.
Start with the prologue →contents · asset 000–012
Each one opens where the story was, then goes all the way down.
It started with one sentence: "I have a realme Buds Air 7. All features are available on Android, but on the Mac they're not. What can we do?"
Before the first byte, we had to know what we were talking to. A Mac sees "a pair of headphones"; inside each bud is a computer with sensors, a radio and memory where every setting lives.
The first reply from the buds was a row of numbers like AA 0D 00 00 06 81 …. To read it we need to know what a byte is, why it's written in hex, and why 06 81 means 0x8106. This chapter builds that from air…
The bytes we write on the Mac arrive in the buds a few centimetres away, through the air, past Wi-Fi and microwaves. This is how.
The buds were already "connected" to the Mac and playing music, yet none of the settings were reachable. The reason is in the layers of the Bluetooth stack, and in which of them macOS chooses to open.
The probe found the hidden service oppointeraction on channel 15, and the first test read the battery. Turning that into an app that links every time took retries, link resets and clean shutdowns, after many…
Realme publishes nothing. Gadgetbridge got us started, but EQ, the volume enhancer and spatial audio were undocumented, and one encoder had a hidden bug. This is the careful method that solved both.
Channel 15 is open and the buds answer. Now we have to speak their language fluently: every field, every command, every quirk. This is the protocol Earshot was born speaking.
The first replies sometimes arrived glued together, or split across two callbacks. The decoder had to learn to find the edges of messages in a stream of bytes, and the other brands each protect their messages…
After v1.0, the question was "Most earbuds that are not Apple, the ones sold in India and English-speaking countries. I don't have them. Is that doable?" This chapter is the answer: five protocol families…
With a working protocol, the user asked for "a beautiful app… prod level", in the same design language as their other projects. Then the real-world problems arrived: flicker, stuck links, ugly notifications…
"All good, ship it." Code on a laptop helps one person. This chapter is how Earshot became a download anyone can install, and how every push is checked automatically.
| Term | Meaning |