IPOD 3G Accessory Protocol




This document describes the serial protocol used by the orginal iPod remote , the different Voice Recorders, and maybe for the Alpine and BMW Car Adapters.

With this information you are able to

The G3 protocol


I only own a 3G model so i'm not able to verifiy this for the 4G model. But it should work also on 4G models
The format is a standard 8N+1 serial structure which means 1 startbit 8 databits no parity bit and 1 stopbit
the usual baud rate is 19200 baud. But it seems to work also on higher rates.
The iPod communication is done in strings.

This is the frame for each string.
0xFF 0x55 0x00 3 to n Byte 0x00
A B C ... D
A A is always 0xFF
B B is always 0x55
C C gives the number of data bytes between C and D
...Contains,mode,command and parameter
D D is the checksum always the last byte


FieldnameSize (Byte)ValueFrameName
Header2 0xFF 0x55 A and B
Length1 sizeof mode + command + parameter C
Mode1 The mode the command is refering to (Look at "List of Modes" below) Between C and D
Command2 The two byte command Between C and D
Parameter0..n Optional Parameter, depending on the command Between C and D
Checksum1 0x100 - sum of all between B and D Frames D


ModePurpose
0x00Mode switching
0x01Voice Recorder
0x02Simple Remote
0x04Advanced iPod Remote (AiR)

The Original Remote Commands



Button
 String
Play/Pause 0xFF 0x55 0x03 0x02 0x00 0x01 0xFA
Vol+ 0xFF 0x55 0x03 0x02 0x00 0x02 0xF9
Vol- 0xFF 0x55 0x03 0x02 0x00 0x04 0xF7
Skip>> 0xFF 0x55 0x03 0x02 0x00 0x08 0xF3
<<Skip 0xFF 0x55 0x03 0x02 0x00 0x10 0xEB
End Button 0xFF 0x55 0x03 0x02 0x00 0x00 0xFB

As you can see C is for each of the Remote commands 0x03 because there are 3 databytes ( 0x02 0x00 0x01 for Play/Pause ). D is the checksum which is the number you have to add to the sum of the databytes ( 0x02 0x00 0x01 for Play/Pause ) plus the C byte to get an even multiple of 0x100.
For our Play Pause example: 0x02 + 0x00 + 0x01 + 0x03(C) + 0xFA(D) =0x100.

Connection

For the remote connector schematics look at the maushammer page
For the dock pinout of the serial connector take a look at partial dock pinout You should also use the setttings shown on the maushammer page for baudrate, character size, etc..
The most complete iPod Hardware information: www.ipodlinux.org

The Voice Recorder Mode

The first bitpattern you have to send to the iPod is 0xFF 0x55 0x03 0x00 0x01 0x01 0xFB.

-> The menu switches to the /Extras/Voice Memos/Record Now Folder.
Voice Memos / record now
Now you can choose between record and cancel. If you select Record the iPod is sending a request to check if there is an compatible microphone attached.
This request is 0xFF 0x55 0x02 0x00 0x00 0xFE You have to answer it again with 0xFF 0x55 0x03 0x00 0x01 0x01 0xFB to start recording.

iPod is recordingg
Until the iPod is starting recording the bitpattern 0xFF 0x55 0x02 0x01 0x00 0xFD gets send. This might tell the external device that recording has started.
If you pause or stop the recording 0xFF 0x55 0x02 0x01 0x01 0xFC might signal the external device the end or the pausing of the recording.

Because i had no microphone, i was using my sony headphones. The quality of the recording was not very good but it makes clear that a usual microphone would work. Overview:
Overview
Key press on iPod Data to ipod Data from ipod Reaction
0xFF 0x55 0x03 0x00 0x01 0x01 0xFB iPod switches to Voice Memos record now
Record 0xFF 0x55 0x02 0x00 0x00 0xFE iPod is waiting for correct answer
0xFF 0x55 0x03 0x00 0x01 0x01 0xFB
0xFF 0x55 0x02 0x01 0x00 0xFD iPod is starting recording
Pause 0xFF 0x55 0x02 0x01 0x01 0xFC iPod is pausing or has stoped recording
Resume 0xFF 0x55 0x02 0x01 0x00 0xFD iPod is resuming recording
Note.you are only responsible to send the green commands. The red commands are firmware based you only have to listen to them and to react as required.

Advanced iPod Remote (AiR)

If you want to receive artistname, albumname, songname or any other extra information you have to set the iPod in AiR Mode.

Send 0xFF 0x55 0x03 0x00 0x01 0x04 0xF8 for AiR Mode


This "ok to disconnect" message will last until you disconnect the serial lines from the iPod.This makes the iPod display useless in the AiR Mode. The only way i found to prevent the iPod to show this "ok to disconnect" image is to send the command before the iPod is in a specific playlist (after a reboot) and to send Play/Pause. However in both cases you are not able to use the iPod keys or the wheel.

Air Mode is mode 0x04: for instance a basic command would be "Get ipod name: 0xFF 0x55 0x03 0x04 0x00 0x14 0xE5"


The useful commands in AiR mode

CNum Cmd Parameter Description
1 0x00 0x12 ? Get iPod Type Size ?
2 0x00 0x13 2 byte ? 0x01 0x02 ?
3 0x00 0x14 Get iPod Name
4 0x00 0x15 String Name of the iPod
5 0x00 0x17 0x00 0x00 0x00 0x00 0x00 Switch to Playlist/Artist/Album/Song/Genre First Byte 0x01 - 0x06 Rest Number of Playlist/Artist/Album/Song/Genre
6 0x00 0x18 0x00 Get Amount of Playlists/Artists/Albums/Song/Genres 0x01 - 0x06
7 0x00 0x19 Number Amount of Playlists/Artists/Albums/Song/Genres
8 0x00 0x1A 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Get Name for Playlist/Artist/Album/Song/Genre First Byte 0x01 - 0x06 Rest numberrange of playlist/artist/album/song/genre (0x00000001 - 0x000000FF)
9 0x00 0x1B String Playlist/Artist/Album/Song/Genre
10 0x00 0x1C Get Time and Status Info
11 0x00 0x1D Number/Number/byte Time and Status Info 4/4/1 Complete Time/Passed Time/ Run/Stop/Pause
12 0x00 0x1E Get Position in Current Playlist
13 0x00 0x1F Number Position in Current Playlist
14 0x00 0x20 0x00 0x00 0x00 0x00 Get Songtitle of Tracknumber in Playlist
15 0x00 0x21 string Songtitle of Tracknumber in Playlist
16 0x00 0x22 0x00 0x00 0x00 0x00 Get Artistname of Tracknumber in Playlist
17 0x00 0x23 string Songtitle of Tracknumber in Playlist
18 0x00 0x24 0x00 0x00 0x00 0x00 Get Albumname of Tracknumber in Playlist
19 0x00 0x25 string Songtitle of Tracknumber in Playlist
20 0x00 0x26 0x00 Start/Stop Polling mode 0x01/0x00
21 0x00 0x27 number time passed of current song
22 0x00 0x28 0x00 0x00 0x00 0x00 Execute Playlist switch and jump to specified songnumber
23 0x00 0x29 0x00 AiR Playback Control Play Pause/Stop/Skip++/Skip--/FFwd/FRwd 0x01 - 0x06
24 0x00 0x2C ? Always 0 ?
25 0x00 0x2D 1 byte ? Always 0 ?
26 0x00 0x2E 0x00 Shuffelmode Off/On Songs/On Albums
27 0x00 0x2F ? Always 0 ?
28 0x00 0x30 1 byte ? Always 0 ?
29 0x00 0x31 0x00 Loop mode off/on/all 0x00 - 0x02
30 0x00 0x32 Picture Blocks Upload Picture for AiR mode
31 0x00 0x33 ? Get Max Screen Size for Picture Upload ?
32 0x00 0x34 5 byte 4/1 ? 0x00 0x78 0x00 0x41 0x01 ?
33 0x00 0x35 Get number of songs in current playlist
34 0x00 0x36 number Number of songs in current playlist
35 0x00 0x37 0x00 0x00 0x00 0x00 Jump to specified Songnumber

  2. Unknown: But i think the answer 0x01 0x02 means 0x01 Gen3 iPod 0x02 20GB

  4. Get iPod Name: The iPod will send the name you gave your iPod. From the 7th byte of the receiving String.

  5. Select "playlist" This can either be on of the iTunes Playlists or Artists,Albums,Songs or Genres The first byte descripes the target of your request
    0x01 Playlists
    0x02 Artists
    0x03 Albums
    0x04 Songname
    0x05 Genre
    0x06 Unknown, maybe Composer

  6. Get the amount of the items described in CMD No 5

  8. Get the name of the items desribed in CMD No 5. The last eight byte describe a requested range. ( From 0x00 0x00 0x00 0x01 to 0x00 0x00 0x00 0x1F) 1st to 31 Note: Playlist 0 ist the "Mainplaylist containing all songs" the resulting nameof Playlist 0 is the same as the result of CMD No 3

  10. Time and status information: will give from the 7th Byte 8 Bytes with time information the first four bytes (7 - 10) give the complete time of the current song (in milliseconds), (11 - 14) show the time which has passed (in milliseconds) the 15th byte gives the status of the playback 0x00 Stop 0x01 Pause 0x02 Play

  12. Get position in current playlist

  14. Get songtitle: You have to send the number in the playlist for the song you are requesting the songname Byte (7 - 10) in the send string. In my example i'm asking for the 0x00 0x00 0x00 0x00 song (the first song). The String from the iPod contains from the 7th Byte on the songtitle.

  16. Get artistname: You have to send the number in the playlist for the song you are requesting the artistname Byte (7 - 10) in the send string. In my example i'm asking for the 0x00 0x00 0x00 0x00 song (the first song). The String from the iPod contains from the 7th Byte on the artistname.

  18. Get albumname: You have to send the number in the playlist for the song you are requesting the albumname Byte (7 - 10) in the send string. In my example i'm asking for the 0x00 0x00 0x00 0x00 song (the first song). The String from the iPod contains from the 7th Byte on the albumname.

  20. Start polling mode: if the parameter is 0x01 the ipod sends when playback is started all 500 msec the passed time 0x00 as parameter turns polling off

  22. Executes the Playlist switch specified in CMD No 5 and jumps to the specified songnumber

  23. The Playback Control for the AiR Mode:

    0x01 Play/Pause
    0x02 Stop
    0x03 Skip++
    0x04 Skip--
    0x05 FFwd
    0x06 FRwd
    The main difference to the commands of the original remote is that there is no stop word necessary and the backlight will not flash up


  26. Turn shuffle mod on for songs 0x01, on for albums 0x02, or off


  29. Turn loop mod on for songs 0x01, on for albums 0x02, or off

  30. The command to upload a picture displayed while in AiR mode
    The transfer is done in blocks. The first block includes the picture header
    0xFF 0x55 0x6E 0x04 0x00 0x32 0x00 0x00 0x01 0x00 0x78 0x00 0x40 0x00 0x00 0x00 0x20

    0x78 is the width, 0x40 is the height 0x00 0x00 0x00 0x20 must be set in conection with the width

    0x71 - 0x78 -> 0x20
    0x61 - 0x6F -> 0x1C
    0x51 - 0x5F -> 0x18
    0x41 - 0x4F -> 0x14
    0x31 - 0x3F -> 0x10
    0x21 - 0x2F -> 0x0C
    0x11 - 0x1F -> 0x08
    0x01 - 0x0F -> 0x04

    From the second block on the last two bytes of the blockheader (0x00 0x01) count the blocks

    0xFF 0x55 0x6E 0x04 0x00 0x32 0x00 0x01
    A colordepth of 2-bit is used. You only have to send the amount of pixels necessary for the picture tp satisfy the iPod It seems that there should be 3 lines of pixeldata in each block.
    You can see if the command was valid when you watch the response string for each block
    Good response is 0xFF 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xC3
    Bad response 0xFF 0x55 0x06 0x04 0x00 0x01 0x04 0x00 0x32 0xBF

    Below a width of 0x10 fillbits are used (only every 4th nibble of the picturedata is taken for the picture)
    --> Demo pic download 120x64 2-bit <--

  31. This Command seems to give the max possible size of a picture to upload and maybe the number of colors (Should be verified by a iPod photo owner)

  33. Gets the number of songs in the current playlist

  35. Similar to CMD No 22 this command jumps to the specified songnumber but will not jump out of the current playlist



Contact:

e0026607@student.tuwien.ac.at