AptX Adaptive support #2

[leleobhz]

Following up #1 to track aptX Adaptive support.

[leleobhz]

@arkq do you already know the .so and binary files that do aptX Adaptive in a phone?

[arkq]

The only library that I've got is this one: https://github.com/Arkq/openaptx/blob/master/archive/qdsp6/capi_v2_aptX_CLHDAD_Encoder.so Unfortunately, it's for QDSP6 platform which is rater nor suitable (for me) for reverse engineering.

[anonymix007]

@arkq you'll probably won't find ARM or X86 versions of aptX Adaptive library. However, QDSP6 (aka Hexagon DSP) is kinda supported in Ghidra and in Binary Ninja.
Here are newer V2.2 and V3 QDSP6 encoder libraries. Looks like V2.2 is the latest aptX Adaptive version, and V3 is called aptX Lossless.
As for decoder libraries, it's worse. I do have object files for their Kalimba architecture 4 (used in QCC Bluetooth SoCs), but some of them may be stripped. There exists disassembler for this architecture (well, actually full GNU binutils build is also available as well as compiler).

[arkq]

The problem with QDSP6 is that the algorithm in there is not as straightforward as in x86/ARM code. I've been checking it in IDA but I was not able to get anything useful (in a timeframe I can invest in that).

[anonymix007]

Can you also take a look at Kalimba versions? I added few examples of object files as well as objdump binary.
Maybe it will be easier to add support of Kalimba to i.e. Ghidra and only after that try to reverse it.

UPD: There also exists QEMU for Hexagon. Wonder if it would be possible to just use library as-is instead of reverse engineering it.
UPD2: There's also Kalimba simulator software (linux binary also exists), maybe it could be used as well

[arkq]

Can you also take a look at Kalimba versions?

Yes, these binaries might be reversible at least based on symbols in them. Anyway Kalimba is not a general purpose CPU, so the assembler code might not be easy to read.

[anonymix007]

@arkq I think I found x86 executables for decoding aptX Adaptive (looks like this includes aptX Lossless as well, which seems to be v2.2 of aptX Adaptive) and aptX Voice (so maybe finally better quality for calls). Would you be interested in taking a look into them?

[arkq]

Yes, I can take a look at it. You can send it on my email or submit PR for this repo with lib added to archives directory. I'm not sure whether I will be able to reverse it to C code in a reasonable time period (I've got lots of other things on my head currently), but at leas I will check how much effort will be required :)

[anonymix007]

@arkq PR was submitted. It will probably be a lot of effort, maybe even more than kalimba ones (they at least have the debug information)

[AxionQc]

Do we have progress on this?

[anonymix007]

Nope. Maybe if there was Ghidra for Kalimba, it wouldn't be hard to reverse engineer.
Using those executables directly (inside of the emulator) might be easier until someone will add it to Ghidra or IDA (ISA docs are not public tho I have them).

[DrMirage]

is there any new progress?

[Animatron1]

The silence on this topic is quite deafening... It's been years...

[moracabanas]

Yeah, I know Steam Deck added aptX LL support but, Bose eaburds didn't have aptX support until Bose Quiet Confort (Ultra) skipping completely LL.
Because they aren't backward compatible with LL, most Adaptivr earbuds render useless to play games, and It is just another lost battle to the Bluetooth monopoly...
I hope reverse engineering wins this battle!

[Rongronggg9]

Some AOSP vendor components [1] reveal how to parse the Codec Specific Information Elements of AptX Adaptive. Some other AOSP vendor components contain the configuration for the HW DSP encoder [2][3].

(Quickly glancing at these codes, I doubt if the actual AptX Adaptive encoder reuses AptX HD/LL encoders with some modifications to make them "adaptive"...)

[1]: https://github.com/syberia-project/platform_hardware_qcom_bt/blob/439c224484e233c4ff189b19d47a16a65fe1fc5a/bthost_ipc/bthost_ipc.c#L549

[2]: https://github.com/sonyxperiadev/vendor-qcom-opensource-interfaces/blob/764d41a3fcdf490df2eb4a9c347184e02e2895c7/bluetooth_audio/2.0/types.hal#L164

[3]: https://git.codelinaro.org/clo/le/platform/hardware/qcom/audio/-/blob/LA.UM.12.2.1.c26-00500-sdm660.0/hal/audio_extn/a2dp.c?ref_type=tags