Some explanation of how it works?

[soraxas]

Hi there, thanks for this promising looking repo!

I've recently got a WF-1000XM4, wanted a finer control of the noise cancelling, and came across your repo. The initial apk does not work initially (says headset not found). After playing around with it for a while, I realise the checks on UUID.
I found that XM4 generates the following UUID:

{'00000000-0000-1000-8000-00805f9b34fb',
 '00000000-deca-fade-deca-deafdecacaff',
 '00001108-0000-1000-8000-00805f9b34fb',
 '0000110b-0000-1000-8000-00805f9b34fb',
 '0000110e-0000-1000-8000-00805f9b34fb',
 '0000111e-0000-1000-8000-00805f9b34fb',
 '764cbf0d-bbcb-438f-a8bb-6b92759d6053',
 '85dbf2f9-73e3-43f5-a129-971b91c72f1e',
 '8901dfa8-5c7e-4d8f-9f0c-c2b70683f5f0',
 '956c7b26-d49a-4ba8-b03f-b17d393cb6e2'}

and added one of these uuid (I simply took the last uuid):

diff --git a/app/src/main/java/com/clusterrr/sonyheadphonescontrol/TaskerFireReceiver.java b/app/src/main/java/com/clusterrr/sonyheadphonescontrol/TaskerFireReceiver.java
index 9e97f2c..8e6a74a 100644
--- a/app/src/main/java/com/clusterrr/sonyheadphonescontrol/TaskerFireReceiver.java
+++ b/app/src/main/java/com/clusterrr/sonyheadphonescontrol/TaskerFireReceiver.java
@@ -44,7 +44,8 @@ public final class TaskerFireReceiver extends BroadcastReceiver {
     public static final String TAG = "SonyHeadphonesControl";
     public static final UUID[] HEADSET_UUIDS = new UUID[]{
             UUID.fromString("96cc203e-5068-46ad-b32d-e316f5e069ba"),
-            UUID.fromString("ba69e0f5-16e3-2db3-ad46-68503e20cc96")
+            UUID.fromString("ba69e0f5-16e3-2db3-ad46-68503e20cc96"),
+            UUID.fromString("956c7b26-d49a-4ba8-b03f-b17d393cb6e2")
     };

---

Now, the app seems to now able to detect the XM4 but all of the action has no effect (e.g. enable noise/wind cancelling, set ambient sound, etc.) I think perhaps the bytes that it writes are incompatible?.

Example log:

2022-05-13 13:27:33.687 11996-11996/com.clusterrr.sonyheadphonescontrol I/SonyHeadphonesControl: Headset found: 14:3F:A6:ED:7F:1B WF-1000XM4
2022-05-13 13:27:33.824 11996-11996/com.clusterrr.sonyheadphonescontrol D/SonyHeadphonesControl: BluetoothSocket connected: true
2022-05-13 13:27:33.828 11996-11996/com.clusterrr.sonyheadphonescontrol D/SonyHeadphonesControl: write: 3e 0c 00 00 00 00 08 68 02 00 02 00 01 00 00 81 3c
2022-05-13 13:27:33.867 11996-11996/com.clusterrr.sonyheadphonescontrol D/SonyHeadphonesControl: read: 3e 01 01 00 00 00 00 02 3c
2022-05-13 13:27:33.868 11996-11996/com.clusterrr.sonyheadphonescontrol D/BluetoothSocket: close() this: android.bluetooth.BluetoothSocket@83601d0, channel: 9, mSocketIS: android.net.LocalSocketImpl$SocketInputStream@a6c55c9, mSocketOS: android.net.LocalSocketImpl$SocketOutputStream@4b9f4cemSocket: android.net.LocalSocket@1182fef impl:android.net.LocalSocketImpl@7c16afc fd:java.io.FileDescriptor@6db8585, mSocketState: CONNECTED
2022-05-13 13:27:33.875 11996-11996/com.clusterrr.sonyheadphonescontrol I/Quality: Skipped: false 23
2022-05-13 13:27:45.558 11996-12014/com.clusterrr.sonyheadphonescontrol D/BluetoothSocket: close() this: android.bluetooth.BluetoothSocket@99715d3, channel: 9, mSocketIS: android.net.LocalSocketImpl$SocketInputStream@22cc510, mSocketOS: android.net.LocalSocketImpl$SocketOutputStream@b7af809mSocket: null, mSocketState: CLOSED
2022-05-13 13:27:45.560 11996-12014/com.clusterrr.sonyheadphonescontrol D/BluetoothSocket: close() this: android.bluetooth.BluetoothSocket@f29fe3b, channel: 9, mSocketIS: android.net.LocalSocketImpl$SocketInputStream@cf96958, mSocketOS: android.net.LocalSocketImpl$SocketOutputStream@65adab1mSocket: null, mSocketState: CLOSED
2022-05-13 13:27:45.561 11996-12014/com.clusterrr.sonyheadphonescontrol D/BluetoothSocket: close() this: android.bluetooth.BluetoothSocket@f522007, channel: 9, mSocketIS: android.net.LocalSocketImpl$SocketInputStream@823f534, mSocketOS: android.net.LocalSocketImpl$SocketOutputStream@63d6f5dmSocket: null, mSocketState: CLOSED
2022-05-13 13:27:45.562 11996-12014/com.clusterrr.sonyheadphonescontrol D/BluetoothSocket: close() this: android.bluetooth.BluetoothSocket@83601d0, channel: 9, mSocketIS: android.net.LocalSocketImpl$SocketInputStream@a6c55c9, mSocketOS: android.net.LocalSocketImpl$SocketOutputStream@4b9f4cemSocket: null, mSocketState: CLOSED

---

My question is, how did you figure out what bytes to write to the BluetoothSocket? Was it via using some sort of app/logcat to monitor the Bluetooth traffic?

If you can provide some pointers that'd be great. Thanks!

[1saagit]

@soraxas Did you ever find a solution to this?

[soraxas]

@1saagit Nope, waiting for explanation

[1saagit]

@soraxas I understand, thank you for answering. I would love to figure this out.

[1saagit]

@soraxas , would it be possible for me to get the modified apk that detects WF-1000XM4s from you?

[soraxas]

It does absolutely nothing, and the modifications needed as denoted above

[soraxas]

Literally, it's just taking the source code, adding a uuid signature, and recompiling it.

[1saagit]

Roger that. Ugh, this is driving me nuts hahaha

[soraxas]

Yeah I'd love to control my device a bit better as well. It would be great if @ClusterM could provide us some guideline on how to figure out the Bytes to write to the socket!

[ClusterM]

Yeah I'd love to control my device a bit better as well. It would be great if @ClusterM could provide us some guideline on how to figure out the Bytes to write to the socket!

You need to sniff bluetooth traffic and see.

[1oh1]

Hi there, I recorded Bluetooth traffic from my phone to the WF-1000XM4 and it's available here: btsnoop_hci.log (filtered: data.csv)

This note from @crab2313 might help: Plutoberth/SonyHeadphonesClient#65 (comment).

According to them, the right UUID is 956c7b26-d49a-4ba8-b03f-b17d393cb6e2. They were able to toggle 'Speak to Chat' with these bytes:

3e0c0100000004f80200010c3c -----------> on
3e0c0000000004f80201010c3c -----------> off

Related: Plutoberth/SonyHeadphonesClient#65

[ClusterM]

Oh, sorry, i totally missed this thread!
You can use Android built-in feature to capture Bluetooth data. You can find it in the developer's options.