Headset Reports

[Plutoberth]

Please post your experiences with the software here.

Headset: Client version: OS: Description:

[Plutoberth]

Headset: WH-1000-XM3 Client version: v1.0.2 OS: Windows 10 Description: Fully works :)

[templeman]

Headset: WH-1000-XM4 Client version: v1.1.1 OS: Windows 10 Description: Works with minor caveats.

In my testing the XM4s do work on Windows 10. I was able to successfully connect, adjust ambient sound levels, and toggle the Focus On Voice setting. I did, however, encounter an issue where the app would fail to complete a command with the Invalid checksum! error. This did not happen in a predictable way and I was not able to reproduce it with consistency, but it did happen more than once.

[emadzz]

Headset: WH-1000-XM4 Client version: v1.1.1 OS: macOS Big Sur (11.2.2) Description: I can connect but never able to adjust the ambient sound level or toggle the "Focus on Voice" option.

1. Able to successfully connect
2. I can increase the ambient sound level without getting any error, but it doesn't seem to actually change the setting on the headphones.
3. The "Focus on Voice" option is enabled, but when I check I get "Unexpected error occurred and disconnected. Invalid checksum!".
4. Reconnecting and adjusting the ambient sound level up or down raises the same error.

I didn't have the time to check the entire repo, but if there's a guide or tips on reverse engineering the Android client I may be able to help faster on this.

[Plutoberth]

Headset: WH-1000-XM4 Client version: v1.1.1 OS: macOS Big Sur (11.2.2) Description: I can connect but never able to adjust the ambient sound level or toggle the "Focus on Voice" option.

1. Able to successfully connect

2. I can increase the ambient sound level without getting any error, but it doesn't seem to actually change the setting on the headphones.

3. The "Focus on Voice" option is enabled, but when I check I get "Unexpected error occurred and disconnected. Invalid checksum!".

4. Reconnecting and adjusting the ambient sound level up or down raises the same error.

Those issues seem very common on XM4s, but sometimes people can send a few messages successfully, so this is pretty perplexing.

I didn't have the time to check the entire repo, but if there's a guide or tips on reverse engineering the Android client I may be able to help faster on this.

I used jadx-gui to decompile the app and export the decompilation to files. Then most of the work is to read the code and rename stuff based on your assumptions. I think that the best approach is the one described here. I reversed it statically because I thought that I'd have to root my phone to actually sniff the messages :P

[lkutsenok]

Headset: MDR-XB950BT Client version: v1.2 Description: Fully works!

[pmastrosimone]

Headset: Sony WH-1000-XM4 Client: v1.2 OS: Linux (Fedora 33) Description:

• Changing ambient sound seems to fully work, commands are sent successfully
• Not sure if this is implemented, but no Speak-to-Chat option

[lawtancool]

Headset: WF-1000XM3 Client version: v1.2 OS: Windows 10 Description: All controls work fine!

[XeonForce]

Headset: WF-1000XM4 Client version: v1.2 OS: Windows 10 Description: Couldn't Connect: 10049

[semvis123]

@XeonForce Thanks for trying, sadly the WF-1000XM4 uses a completely new protocol (literally uses ....mdr.link2 as external Accessory protocol string (still need to find the sppServiceUUID btw, but that can be found in the app)), support for these earbuds might come in the future as I already have semi working code ready (slider doesn't seem to be affecting the ambient sound), but I don't have much time to work on this rn and I don't own them, so adding support is extra difficult.

[ipeacocks]

Headset: WH-1000XM3 Client version: v1.2 OS: Ubuntu 21.04 Description: Fully works, but I miss ANC turn on/off button.

Additional packages needs to be installed:

apt install libglfw3 libglew2.1

[luizkowalski]

Headset: WH-CH710N Client version: v1.2 OS: macOS Big Sur (11.4) (Chip Apple M1)

I can't connect, behavior is erratic. sometimes it closes, sometimes it says "Could not open rfcomm"

[andro2157]

Headset: WH-XB900N Client version: v1.2 OS: Windows Description: Works perfectly!

[Netanel-Lalazar]

Headset: WF-1000XM4 Client version: v1.2 probably OS: Windows 10 Description: Works great! thank you! :-)

[emiel556]

Headset: WF-1000XM4 Client version: v1.2 OS: Windows 10 Description: Couldn't Connect: 10049

Headset has latest firmware (1.2.6) installed today

[pumpkinlink]

Headset: WH-1000XM3 Client version: v1.2 OS: Ubuntu 20.04 Description: Fully works. (had to disconnect app on my phone first)

Only one additional package needs to be installed:

apt install libglfw3

[comio]

Headset: WH-N910H Client version: v1.2 OS: Ubuntu 21.04 Description: Fully works :)

[runtav-gyz]

Headset: MDR-XB950BT Client version: v1.2 OS: Fedora 34 Description: Error - Could not connect to bluetooth socket.

[dogtopus]

Headset: WH-1000XM2 Client version: commit e671114cc9e89355d42a215241e41f25a01d3d32 OS: Arch Linux Description: Had to downgrade C++ standard from GNU++20 to GNU++17 for it to compile (SonyHeadphonesClient/Client/SingleInstanceFuture.h:15:33: error: expected unqualified-id before ‘)’ token), but otherwise seems to work fine without any other modifications.

[iddo]

Headset: WF-1000XM4 Client version: v1.2 OS: Ubuntu 20.04.3 LTS Description: Error - Could not connect to bluetooth socket. Had to install dependencies before use:

sudo apt install libglew2.1 libglfw3 libopengl0

Log:

connecting to <redacted mac>
channel: 0
closed

[ca5ua1]

Headset: WI-1000XM2 Client version: v1.2 OS: Arch Linux Description: Works, but all changes to ambient sound mode need to re-enable a function few times to apply. Had to install dependencies before use: sudo pamac install glfw-x11 glew-2.1

[stephaniecarag]

Headset: WF-1000XM4 Client version: v1.2 OS: Windows 10 Description: Getting an error "Couldn't connect: 10049"

[dogtopus]

Headset: WH-1000XM4 Client version: commit c45af000 OS: Arch Linux Description: The app is able to find the control serial port but then it's stuck on "sending command" forever. Did $**y change the protocol?

[CodeBrauer]

Headset: WH-1000-XM3 Client version: v1.2 OS: macOS 10.15.7 Description: Fully works on second start of the App. First start the controls did not operate the headphones.

[ralex]

Headset: WH-1000XM2 Client version: v1.2 OS: Debian GNU/Linux 12 (Bookworm) Description: Works like a charm!

Additional packages installed:

apt install libglew2.1 libglfw3 libopengl0

[technos12]

Headset: WF-1000XM4 v1.2.6 Client version: Self-build from [e671114] and from release [v1.2] OS: Windows10 21H1 Description: Application start, detects device, but crash at connect with answer Couldn't Connect: 10049

I would love to help, I have knowledge in programming in C#/WPF and I would really like to be able to change some parameters from a desktop App. @semvis123 said that the used protocol is mdr.link2 but I can't find any information on that. I can make tests with my device and VSStudio.

[semvis123]

@semvis123 said that the used protocol is mdr.link2 but I can't find any information on that. I can make tests with my device and VSStudio.

jp.co.sony.songpal.mdr.link2 seems to be the new protocol which the WF-1000XM4 uses. Since I don't own any device that uses this new protocol, I can't really debug anything or collect any logs. But I've managed to make it work in a Jailbreak tweak I made (based on some logs and feedback I received from users). See this file (apologies for the messy code)

This implementation only sends data, so it doesn't know if it was successful or not. (for simplicity) Because I can't test it, I can only report that this implementation was able to change the noise cancelling to ambient sound and back according to users (with the default settings), iirc custom values for ASMValue didn't seem to work (it had to be 20). Because this implementation is purely based on logs I am not sure if the variable names are correct for the V2 protocol.

I would suggest you to collect your own logs and see if you can find any similarities between them. Another option would be to decompile the android app and research that, but it's quite a large app and pretty obfuscated.

[technos12]

I would suggest you to collect your own logs and see if you can find any similarities between them. Another option would be to decompile the android app and research that, but it's quite a large app and pretty obfuscated.

Cool, thank you for the answer ! I have created a working environment on my usual tools, so I can discover the device, establish a connexion, get the stream and write to it. In parallel, I used the code from Sonitus to create the frame of data to be sent. As the code is covering both version of the protocol and all the different scenario with ? : it is sometimes difficult to follow the logic. So my headset is actually not reacting to the command. I would like to capture the frames (collect my logs) sent from my phone (android) and use them as an example. Could you help me about this first step ? Thanks.

[semvis123]

I would like to capture the frames (collect my logs) sent from my phone (android) and use them as an example. Could you help me about this first step ?

I do not have experience with logging the traffic on Android devices but this helpful comment might give you a hint: https://github.com/Plutoberth/SonyHeadphonesClient/pull/36#issuecomment-795633877

I also was able to find the logs I got (it isn't a lot, but might give you some extra clues):

jp.co.sony.songpal.mdr.link2 | 17 ⬆ 0x3e 0x0c 0x01 0x00 0x00 0x00 0x08 0x68 0x15 0x01 0x01 0x01 0x05 0x00 0x14 0xffffffae 0x3c 
jp.co.sony.songpal.mdr.link2 | 9 ⬇ 0x3e 0x01 0x00 0x00 0x00 0x00 0x00 0x01 0x3c 
jp.co.sony.songpal.mdr.link2 | 17 ⬇ 0x3e 0x0c 0x00 0x00 0x00 0x00 0x08 0x69 0x15 0x01 0x01 0x01 0x05 0x00 0x14 0xffffffae 0x3c 
jp.co.sony.songpal.mdr.link2 | 9 ⬆ 0x3e 0x01 0x01 0x00 0x00 0x00 0x00 0x02 0x3c 
jp.co.sony.songpal.mdr.link2 | 17 ⬆ 0x3e 0x0c 0x00 0x00 0x00 0x00 0x08 0x68 0x15 0x01 0x01 0x00 0x05 0x00 0x14 0xffffffac 0x3c 
jp.co.sony.songpal.mdr.link2 | 9 ⬇ 0x3e 0x01 0x01 0x00 0x00 0x00 0x00 0x02 0x3c 
jp.co.sony.songpal.mdr.link2 | 17 ⬇ 0x3e 0x0c 0x01 0x00 0x00 0x00 0x08 0x69 0x15 0x01 0x01 0x00 0x05 0x00 0x14 0xffffffae 0x3c 
jp.co.sony.songpal.mdr.link2 | 9 ⬆ 0x3e 0x01 0x00 0x00 0x00 0x00 0x00 0x01 0x3c 

btw: it might be better to open a separate issue for this conversation.

[audunmg]

Headset: WH-1000XM2 Client version: v1.2 OS: Arch Linux Description: Works great!

Thank you!

[CaramelFur]

Headset: WH-1000XM5 Client version: v1.3.0 OS: Fedora 36 Description: Can't connect

I get Error: could not connect to bluetooth socket in the gui And

connecting to 88:C9:E8:16:F5:FD
channel: 0
closed

In the cli

So I suppose the XM5 uses a different protocol again.