Firmware

The firmware of the Zik2 (and maybe others too) is updateable, over the air through the Parrot Zik app and by file. The file can be downloaded from here. A simple string search reveals quite some interesting things, e.g. that they use SQLite (see below) in the headphone itself to store presets and settings.

Bluetooth API Protocol

The API paths:

/api/audio/noise_control/enabled/get
/api/audio/noise_control/enabled/set?arg
/api/audio/noise_control/get
/api/audio/noise_control/set?arg
/api/audio/noise_control/phone_mode/get
/api/audio/noise_control/phone_mode/set?arg
/api/audio/noise_cancellation/enabled/get
/api/audio/noise_cancellation/enabled/set?arg
/api/audio/thumb_equalizer/value/set?arg
/api/audio/thumb_equalizer/value/get
/api/audio/equalizer/enabled/get
/api/audio/equalizer/enabled/set?arg
/api/audio/param_equalizer/value/set?arg
/api/audio/smart_audio_tune/set?arg
/api/audio/smart_audio_tune/get
/api/audio/preset/bypass/set?arg
/api/audio/preset/bypass/get
/api/audio/preset/download?name
/api/audio/preset/activate?id
/api/audio/preset/save?name
/api/audio/preset/remove?id
/api/audio/preset/counter/get
/api/audio/preset/clear_all
/api/audio/preset/synchro/start
/api/audio/preset/synchro/stop
/api/audio/preset/current/get
/api/audio/preset/cancel_producer
/api/audio/sound_effect/enabled/get
/api/audio/sound_effect/enabled/set?arg
/api/audio/sound_effect/angle/get
/api/audio/sound_effect/angle/set?arg
/api/audio/sound_effect/room_size/get
/api/audio/sound_effect/room_size/set?arg
/api/audio/sound_effect/get
/api/audio/noise/get
/api/audio/volume/get
/api/software/version/get
/api/software/version_checking/get
/api/bluetooth/friendlyname/get
/api/bluetooth/friendlyname/set?arg
/api/software/download_size/set?arg
/api/software/download_check_state/get
/api/system/battery/forecast/get
/api/system/battery/get
/api/audio/track/metadata/get
/api/audio/track/metadata/force?artist
/api/audio/source/get
/api/system/auto_connection/enabled/get
/api/system/auto_connection/enabled/set?arg
/api/system/factory_reset
/api/system/anc_phone_mode/enabled/get
/api/system/anc_phone_mode/enabled/set?arg
/api/system/device_type/get
/api/system/color/get
/api/system/pi/get
/api/system/auto_power_off/presets_list/get
/api/system/auto_power_off/get
/api/system/auto_power_off/set?arg
/api/system/head_detection/enabled/get
/api/system/head_detection/enabled/set?arg
/api/audio/specific_mode/enabled/get
/api/audio/specific_mode/enabled/set?arg
/api/system/bt_address/get
/api/appli_version/set?arg
/api/system/calibrate
/api/account/username/get
/api/account/username/set?arg
/api/audio/equalizer/preset_id/set?arg
/api/audio/equalizer/preset_value/set?arg
/api/software/tts/enable
/api/software/tts/disable
/api/software/tts/get
/api/flight_mode/enable
/api/flight_mode/disable
/api/flight_mode/get

This will be helpful for reverse engineering the protocol.

Codecs!

But it also reveals other fine stuff! Like a list of supported codecs, look at this excerpt:

"config->codectype == BLP_A2DP_CODEC_AAC" && 0
"config->codectype == BLP_A2DP_CODEC_SBC" && 0
"config->codectype == BLP_A2DP_CODEC_MP3" && 0
"config->codectype == BLP_A2DP_CODEC_NONA2DP" && 0
"config->codec.nonA2DP.vendorID == BTH_PARROT_MANUFACTURER" && 0
"config->codec.nonA2DP.vendorCodecID == BLP_PARROT_CODEC_LPCM" && 0
"config->codec.nonA2DP.vendorCodecID == BLP_PARROT_CODEC_WMA" && 0
"config->codec.nonA2DP.vendorCodecID == BLP_PARROT_CODEC_OGG" && 0
"info.Codectype == PFD_WMA" && 0
"info.Codectype == PFD_OGGOPUS" && 0
"info.Codectype == PFD_OGV" && 0
"info.Codectype == PFD_FLAC" && 0
"info.Codectype == PFD_AAC" && 0
"info.Codectype == PFD_MP3" && 0

So I assume for A2DP the codecs SBC, AAC and MP3 are supported. This is pretty good news since MP3 and AAC are pretty common formats and this do not require recoding for SBC transmission. Even more interesting there is a list of non-A2DP codecs which suggests that also Ogg/OGV, Ogg-Opus, Flac, WMA and LPCM could be supported!? Interesting! Flac would make the a line-in unnecessary. I wonder why MP3 and the non-A2DP codecs are not mentioned anywhere in the specs? But judging from the above mentioned symbols I would also think that the non-A2DP codecs can only be accessed with very specialised software since they require a proprietary vendorID and vendorCodecID. So let’s first restrict our hopes to AAC and MP3 😉

Update: The Bluetooth A2DP service discovery tells more, see towards the end of the Bluetooth protocol page.

Hardware

The firmware dump also reveals some details of the hardware. From the strings I would think:

  • CPU Parrot P6i @ 416MHz, which is ARM based
    The 416MHz is a guess from other devices mentioned on the ‘net running the same CPU but open systems like Linux on them.
  • Codename of the hardware could be “Voyager”
  • 128Mb x 16 mobile SDRAM: Micron MT48H8M16LF 7.5ns @ CL=3 BL=4 104 MHz – Voyager
  • Audio Codec WM8731
  • TouchPanel: Some Cygnus Solutions? API calls “cyg_i2c_…”

Software

At least the firmware updater is based on the free realtime system eCos:

Parrotboot for target VOYAGER, git version ecos-4.2.7-lib-10-gfe6f34b-dirty, built on Oct 15 2014

Furthermore SQLite3 is used for internal databases, like phonebook and presets.

For understanding the equalizer preset handling it might be good to know the SQLite database table layout which holds them:

CREATE TABLE IF NOT EXISTS name_preset (id INTEGER PRIMARY KEY AUTOINCREMENT,
config TEXT NOT NULL, equalizer INTEGER NOT NULL,
enabled INTEGER NOT NULL, enabledEQ INTEGER,
fc0 INTEGER NOT NULL, Q0 REAL NOT NULL, gain0 REAL NOT NULL,
fc1 INTEGER NOT NULL, Q1 REAL NOT NULL, gain1 REAL NOT NULL,
fc2 INTEGER NOT NULL, Q2 REAL NOT NULL, gain2 REAL NOT NULL,
fc3 INTEGER NOT NULL, Q3 REAL NOT NULL, gain3 REAL NOT NULL,
fc4 INTEGER NOT NULL, Q4 REAL NOT NULL, gain4 REAL NOT NULL,
enabledHeadspat INTEGER, room INTEGER, angle INTEGER,
album TEXT, isLinkedAlbum INTEGER, artist TEXT, isLinkedArtist INTEGER,
genre TEXT, isLinkedGenre INTEGER, song TEXT, isLinkedSong INTEGER,
thumb_r INTEGER, thumb_theta INTEGER, UNIQUE(id))

Fun

Many programmers are funny guys and they leave traces of their humor in places like error messages, also here in the firmware:

"verify version failed %i times. Reset PIC. Good-bye, Cow-Boy.."

…which of course also tells us, that there might be some PIC microcontroller built into it too.