You tear open a brand-new pair of AirPods Pro — $200. You pair them with your Android phone. Sound comes through. No problem there. But you scroll through every settings menu and find no battery indicator. The noise cancellation toggle might as well not exist. You want to switch to transparency mode — the option simply isn’t there. You double-check on Taobao: yes, you bought the real thing.
These features aren’t broken. They’re all inside the earbuds, fully intact. The headphones just refuse to hand over the data unless an Apple device is asking.
The absurdity of this arrangement is now being laid bare by an open-source project called LibrePods.
Who Are the Earbuds Talking To?
To understand this fight, you need to know what AirPods and iPhones actually transmit between each other.
When any Apple device connects to AirPods, two communication paths open up. The first runs standard Bluetooth protocols — it’s responsible for delivering music to your ears. The second runs on Apple’s own secret channel: something called AAP (Apple Accessory Protocol).
This dedicated channel operates on top of Bluetooth’s L2CAP layer, on port 0x1001, with a service ID of 74ec2172-0bad-4d01-8f77-997b2be0722a. To an ordinary Bluetooth device, this looks like an inconsequential data pipe. But to AirPods, it’s the real brain.
The packets traveling over this channel follow a fixed format: a four-byte header 04 00 04 00, followed by a length byte, a function code, and then the actual data. Battery status uses 22 bytes to describe the charge levels of the left earbud, right earbud, and charging case. In-ear detection is 8 bytes. Noise cancellation switching — off, ANC, transparency — is done with 0D followed by 01, 02, or 03.
In other words, all the “premium feature” information AirPods transmit to Apple devices is just short, fixed-format data packets. The earbuds have been broadcasting all along — they’re just speaking a language only Apple devices were trained to “understand.”
Beyond this, AirPods also broadcast encrypted data over BLE advertisements that include battery information and in-ear status. But the encryption keys — synchronized via iCloud — only exist between Apple devices. Non-Apple devices get nothing but scrambled noise.
Three Locks: How Apple Sealed These Features Away
Apple’s closed strategy works through a kind of awareness gap: if you never realize something is missing, you never ask for it. But if you do try to ask, you find three locked doors waiting.
Lock one: iCloud pairing lock. When you first connect AirPods to an iPhone, Apple’s cloud service exchanges a set of encryption keys behind the scenes, binds them to your Apple ID, and stores them in the earbuds’ secure chip. From that point on, any device without those keys is locked out of premium feature data exchange. The “Connected” status you see on your Android phone is a crippled state: music plays, but the earbuds refuse to tell you how much battery is left.
Lock two: Proprietary BLE advertisement extensions. The Bluetooth advertising protocol defines standard broadcast formats. Apple layered an encrypted payload on top of the standard — only devices with the iCloud keys can decrypt it. LibrePods’s approach is to actively request these keys from the earbuds, mimicking how an Apple device makes the request. The process is called “Magic Pairing” in the code — pretend to be an Apple device, and the earbuds hand you the keys.
Lock three: MFi chip and Vendor ID checks. Apple’s MFi (Made for iPhone) certification requires accessories to contain an authentication chip. AirPods themselves don’t need external certification, but they do check the Vendor ID of the connecting device. If the Vendor ID isn’t 0x004C (Apple’s company ID), certain features get silently disabled — no warning, no message, the menu options just aren’t there. The LibrePods project discovered that spoofing an Android device’s Vendor ID to Apple’s unlocks additional features. On Linux, it’s even simpler: change one line in a config file.
These three locks reveal an uncomfortable truth: the AirPods hardware is capable of far more than Apple allows it to do.
28,000 Stars and a 16-Year-Old
The creator of LibrePods is Kavish Devar, based in Gurugram, India. He was 16 years old when the project first attracted widespread media coverage. According to the GitHub repository, the project has now accumulated over 28,000 stars (28,000 people marking “I want to keep following this”) with over 1,600 forks.
The first step of reverse engineering is packet capture — using Bluetooth sniffing tools to capture the raw data exchanges between an iPhone and AirPods. What you see are streams of hexadecimal: the 04 00 04 00 handshake, 0D 01 meaning “switch to noise cancellation,” 28 01 meaning “enable Conversation Awareness.”
The second step is per-function experimentation. Toggle noise cancellation on and off, watch which bytes change in the packets. After hundreds of iterations, the meaning of every byte is decoded. Devar credits multiple community contributors — @tyalie wrote the first protocol documentation, @pabloaul developed the Wireshark dissector plugin, @timgromeyer implemented the Linux prototype.
The elegance of this reverse-engineering process: it cracked no encryption algorithms, and it stole no trade secrets. It did the simplest thing — sat beside two people having a conversation, recorded what they said word for word, and figured out what each word meant. This approach falls squarely under interoperability fair use and is explicitly protected in many jurisdictions.
The Hardware Is Yours. The Experience Is Apple’s.
This project puts a hard question on the table: when you buy something for $200, how much of it is actually yours?
Legally, the physical earbuds belong to you. But running inside them is Apple’s firmware — code Apple owns the copyright to, does not publish the source for, and that can only be fully activated through an Apple device. If you’ve never connected your AirPods to an Apple device, you’ll never know the noise cancellation can switch between three modes — because the switching command travels over that encrypted channel.
This amounts to a form of feature leasing: $200 buys you the headphone hardware, but full access to what it can do depends on whether you also own another Apple product. From Apple’s perspective, the closed protocol reduces experience fragmentation, avoids compatibility-driven support burdens, and allows security updates to be pushed uniformly — “for a better experience, we control the entire chain.”
But users see it very differently. As one Hacker News commenter put it: “Since AirPods are offline devices, if you buy a pair now, they’ll last you a lifetime. That said, maybe the smarter move is to reward companies that don’t make you solve puzzles to use your own hardware.” Another was sharper: “We used to use encryption to protect ourselves. Now corporations and governments use encryption to protect themselves from us.”
The project is also honest about its own limits. Dual-channel HD voice, heart rate monitoring, spatial audio — these either require Android root access, or the protocol hasn’t been fully decoded yet. LibrePods uses five symbols to mark each feature’s implementation status: ✅ fully working, ⚪ requires Apple device spoofing, 🔴 not yet implemented, ⛔ explicitly out of scope, ❓ status unknown. This honesty makes the project read less like a victory declaration and more like a partially filled-in map.
Two Camps, No Winners
The LibrePods story isn’t a simple “good guys beat bad guys” tale. From a researcher’s perspective, Apple’s investment in privacy and security is real — AirPods’ end-to-end encryption keeps location data from leaking easily, and the closed firmware update mechanism reduces the risk of malicious tampering. Apple hasn’t actively sabotaged the experience on non-Apple devices — it simply never built that experience.
The community’s answer is: since you won’t do it, we’ll do it ourselves. 28,000 people watching signals this is not a niche demand. When the price of a pair of earbuds exceeds what many people earn in a month, sensitivity around “how much of what I paid for can I actually use” only grows sharper.
The project’s future is equally uncertain. Apple could modify the protocol in any firmware update, wiping out years of reverse-engineering effort overnight. The pragmatic advice on Hacker News: if you’re using LibrePods long-term, make sure your AirPods never connect to an Apple device for auto-updates — lock the firmware at the current version. This doesn’t sound like freedom. It sounds like carving out a small space while still wearing the handcuffs.
I don’t think there’s a simple right or wrong answer here. Apple has the right to invest in its ecosystem and benefit from it. Consumers have the right to ask why hardware they paid full price for can only use a subset of its features. This tension won’t be resolved by a single open-source project. But every project like LibrePods makes the tension a little bit more visible.
Reference Links: