Modifying Bluetooth headphone firmware.

[QueenApis]

I have a pair of Logitech Astro A30s and I'd like to modify their firmware. Tbh the headphones are pretty great for what I need! Just the firmware is sooo bad. There's weird volume changes, the headphones go to sleep if I'm too still for too long, the sound effect for connecting to a Bluetooth source is painfully loud, ect.

 

I do have experience with programming, and I'm fairly tech savvy, but I haven't worked with firmware before. I was hoping I could get some insight from more experienced people into how difficult this will be to do, or if possible some resources on how to do this.

(Also, please don't just tell me to get different headphones, I legitimately do like almost everything but the firmware, and some of the things I want from headphones are hard to find.)

[goatedpenguin]

If you have not done firmware programming before than I highly recommend you proceed with caution since you can end up bricking your headphones rendering it useless. Afaik logitech has there own firmware loading tool so you could try to make your own file and load it but there firmware is proprietary so it would be a difficult task to accomplish. If your going to be making a firmware for this use C.

[porina]

I use to support similar products from another company and had to work with the audio and firmware teams. I don't know if Logitech work the same way, but basically you'll need the dev tools from the manufacturer of the chip they used. If you're lucky, you can just alter values to change certain characteristics. At worse, you'll have to change how it works. Even in the simple option, you need to know which values affects what. Without documentation, you're going to need to be a hardcore hacker to work this out. Basically, if you have to ask how to do it, you probably can't.

[goatedpenguin]

They also probably have some sort of implementation for firmware level obfuscation.

[QueenApis]

4 hours ago, porina said:

I use to support similar products from another company and had to work with the audio and firmware teams. I don't know if Logitech work the same way, but basically you'll need the dev tools from the manufacturer of the chip they used. If you're lucky, you can just alter values to change certain characteristics. At worse, you'll have to change how it works. Even in the simple option, you need to know which values affects what. Without documentation, you're going to need to be a hardcore hacker to work this out. Basically, if you have to ask how to do it, you probably can't.

Well if I can get access to the unobfuscated firmware then I think I'd have a good shot. I don't really want to do more than tweak some values.

 

I don't really appreciate when people comment on a thread "If you have to ask how to do it, you probably can't." It's not helpful and straight up kinda rude. I'm asking not because I can't do it, but because I want advice on where to start.

 

Everyone starts learning from scratch, there's no harm in asking for advice before you get started with something new. Thanks for the tips you gave me though, I do appreciate the insight.

[porina]

7 hours ago, QueenApis said:

Everyone starts learning from scratch, there's no harm in asking for advice before you get started with something new. Thanks for the tips you gave me though, I do appreciate the insight.

Apologies, I didn't intend it to sound so harsh but even with some exposure to similar products I wouldn't be confident in taking such a task on.

 

If it helps with some further insight, the products I did have some experience with used CSR chipsets. Configuration data was stored in non-volatile PSKEYS. With the right software you can alter the values in those. I just did a search around, and they might have provided some devboards of some chips, so obtaining software might not be as difficult as I imagined. Maybe there is some public info out there.

 

The challenge will be to find out what chipset your product uses, then see if you can find any info on it.

[Kilrah]

You'll want to know what chip/platform is used, either find someone who made teardown photos/videos or open yours. Then try to find any info/documentation/datasheet/dev tools for that platform you can, but often that's all hidden behind contracts and NDA's.

 

Also see if you can obtain a copy of the original firmware, e.g. if the app ever provided an update it might have it cached in the app bundle or download it from somewhere.

 

The next steps basically vary way too much depending on what can be found to go into detail.

[QueenApis]

Thank you both, Kilrah and Porina. This is probably enough for me to get started. Don't worry, I'll be super careful and make sure that I don't do anything I can't revert. The first thing I'll try to change will be something harmless, that way if I mess it up and somehow can't undo it it won't be a big deal. I'll probably just change the volume for a sound effect that way it'll be easy to tell if the changes applied.

[Kilrah]

1 hour ago, QueenApis said:

The first thing I'll try to change will be something harmless, that way if I mess it up and somehow can't undo it it won't be a big deal. I'll probably just change the volume for a sound effect that way it'll be easy to tell if the changes applied.

With all due respect, that's why @porina's answer was how it was... you're not even close to even knowing whether anything can be done, let alone how at this point.

There are so many possible caveats in the way... Yes if you're extremely lucky the whole thing has a standard implementation of a common chip, documentation etc is available and nothing custom was done by Logitech but edit a couple of editable parameters in settings region separate from the actual firmware.... but on the other hand you could be dealing with completely custom firmware for a chip you can't even know what architecture it is, that you can't even get a copy of, is encrypted and/or signed and no change would be accepted by the update mechanism unless you got access to the manufacturer's private signing keys, or worse it would accept it but would never work again because a check failed.

 

Unfortunately "How to get started in firmware reversing/modding" is an entire book, not a forum post.