Reverse-Engineering AirPods: An Open-Source Project Brings Full AACP Protocol to Android
For Android developers and power users, this project proves that Apple's hardware lock-in is breakable at the protocol level. It also exposes a real, widespread L2CAP bug in Android's Bluetooth stack that affects more devices than most realize — a signal that Google's Bluetooth implementation still has rough edges.
A new open-source project called LibrePods brings the full suite of AirPods features to Android by reverse-engineering Apple's private AACP (Apple Accessory Communication Protocol). The project works on three Bluetooth layers: passive BLE scanning for battery and in-ear status, a custom L2CAP channel (PSM 0x1001) for bidirectional control commands like noise cancellation and conversational awareness, and an ATT layer (PSM 31) for fine-grained transparency and hearing aid parameters.
The biggest hurdle is a widespread bug in Android's Bluetooth stack (Fluoride/Gabeldorsche) that blocks L2CAP connections to the required PSM. LibrePods works around this with an Xposed module that hooks the low-level `l2c_fcr_chk_chan_modes` function, plus reflection to create L2CAP sockets directly. Some devices — including recent ColorOS, OxygenOS, and Android 16 QPR3 builds — have already fixed the bug and don't need the hook.
To unlock features like multi-device switching and ATT access, the project also spoofs the Bluetooth DID VendorID to Apple's `0x004C`, tricking AirPods into treating the Android device as an Apple product. Over 60 control commands have been reverse-engineered so far, though spatial audio and heart rate monitoring remain unimplemented.
The fact that a single developer could reverse-engineer Apple's private protocol and reimplement it on a competing platform shows how much of Apple's 'ecosystem lock-in' is just protocol obscurity, not technical impossibility.
The L2CAP bug in Android's Bluetooth stack is a surprisingly fundamental flaw — it blocks a standard protocol feature that AirPods happen to rely on, and it's present across most devices.
The VendorID spoofing trick is a neat reminder that Apple's hardware checks are often just a few bytes in a profile — once you know the magic number, the gates open.
The project's reliance on Xposed and reflection highlights how Android's public Bluetooth APIs are still too restrictive for low-level protocol work.