| Type | Purpose |
|---|---|
| 0x01 | Playlist |
| 0x02 | Artist |
| 0x03 | Album |
| 0x04 | Genre |
| 0x05 | Song |
| 0x06 | Composer |
Playlist 0 is the main library and has the same name as the iPod. In this case the result would be the same as given by command 0x00 0x14
iPod Accessory Serial Protocol
At the same time as the introduction of the dock connector, the Apple Accessory Protocol was also introduced. It is used by accessories that communicate via serial; either through the serial connector around the headphone socket or through the dock connector.
The serial connection uses the standard RS232 8N1 (1 start bit, 8 data bits, no parity and 1 stop bit). The baud rate reported by others is around 19200 but apparently it can be higher. I have also found that some accessories use baud rates as low as 9200. Each command is sent using a string, with an acknowledge command being sent from the receiving unit.
The original work for this information was done by Christoph (his data can be found here). It was generalised by Otto at Ipodlinux where the full protocol can also be found. The following is my interpretation of the information, with additional notes for use with my Kenwood-to-computer interface project. (Commands that are responses only are in red)
Request / Response Structure
Each request and response message is sent as string. One part, the header, is always the same but the rest depends on the command being sent. The data sent via the serial connection is in blocks of eight bits (1 byte), IE 0 to 255 in decimal or 0x00 to 0xFF in hex, so for a field size of 2, 16-bits (2-bytes) are required. The general structure is as follows:
Field |
Size |
Value |
|---|---|---|
| Header | 2 |
0xFF 0x55 |
| Length (A) | 1 |
Size of Mode + Size of Command + Size of the Parameter |
| Mode (B) | 1 |
Mode relating to command |
| Command (C) | 2 |
Two byte Command |
| Parameter (D) | 0...N |
Optional Parameter, depending on the command |
| Checksum | 1 |
0x100 - ((Sum of all data in A, B, C & D) & 0xFF) |
The length of the Parameter (D) has be less than about 252 because length (A) can not be more than 0xFF. Calculating the checksum is very important as with out it or if it is incorrect, the command is ignored by the receiving side and an error message is sent. As the sum of all the data could be more than 0xFF, only the lower byte of the sum is used (selected by the & 0xFF). Each set of commands are defined by a mode, only commands within a mode can be used while in that mode.
Mode List
The mode list defines the command sets. The number is used both for switching mode as well as defining the mode being used during a command.
Mode Number |
Purpose |
|---|---|
0x00 |
Mode Switching |
0x01 |
Voice Recorder |
0x02 |
Simple Remote |
0x03 |
Request Mode Status |
0x04 |
Advanced Remote Mode (AiR) |
Mode Switching (Mode 0)
The first operation of an accessory is to put the iPod into the correct mode or at least, find out which mode the ipod is currently in. The commands possible in switching mode are as follows:
Command |
Purpose |
|---|---|
0x01 0x01 |
Switch to Voice Recorder mode (dose not working in 5th generation) |
0x01 0x02 |
Switch to iPod remote mode |
0x01 0x04 |
Switch to Air Mode |
0x03 |
Get current mode status |
0x04 xx |
The current mode number is returned by the iPod |
0x05 |
Also switches to AiR mode |
0x06 |
Also switches to iPod remote mode |
For example, to switch to AiR mode the following bytes are sent:
0xFF 0x55 0x03 0x00 0x01 0x04 0xF8
Advanced Remote - AiR (Mode 4)
There are two types of remote command sets available to accessories. The simple set is limited to controlling playback (eg Play/Pause) and is explained later on this page. The more complex, Advanced iPod Remote (AiR), has extra features for getting extra information, such as trackname or artistname. As the majority of accessories use AiR mode I have put it before the simpler version. It should also be noted that when using AiR, the iPod display will change to "Ok to Disconnect" by default but there are tricks for getting alternative images displayed. (This is discussed in my Kenwood to Computer project.)
Again, commands are in normal text and responses are in red. Responses are always the command plus one unless it is a general Success/Failure response. Blue text indicates additional notes, place pointer over them for information. The parameter information can be split, IE Result(1) means that one byte is sent back as a result code. NCU = Not Completely Understood. SFR = Success/Failure Response.
Command |
Parameter (bytes) |
Purpose |
|---|---|---|
0x00 0x00 |
Result(1) Command(2) |
NCU, not often used. |
0x00 0x01 |
Result(1) Command(2) |
Feedback on command just executed. Result: 0x00 = Success 0x02 = Failure 0x04 = Exceeded limit/Byte Count Wrong 0x05 = Is a Response Not a Command Command: The command code this is responding to. |
0x00 0x02 |
None | NCU, simple ping-request ? |
0x00 0x03 |
8 | NCU 0xFF 0xFF 0xFF 0xFF 0x00 0x00 0x00 0x00 |
0x00 0x09 |
None | NCU, requests flag set by command 0x00 0x0b |
0x00 0x0a |
1 | 0x00 or 0x01 depending on flag status |
0x00 0x0b |
1 | Parameter is either 0x00 or 0x01. Get SFR |
0x00 0x0c |
7 | NCU, gives response 0x00 0x0d |
0x00 0x0d |
11 or 1 | NCU, response from 0x00 0x0c |
0x00 0x12 |
None | Thought to be "Get iPod Type / Size" |
0x00 0x13 |
2 | Gen3 30GB: 0x01 0x02 Gen4 30GB: 0x01 0x09 Gen5 30GB: 0x01 0x09 |
0x00 0x14 |
None | Get iPod Name |
0x00 0x15 |
string length | iPod name as null terminated string |
0x00 0x16 |
None | Switch to main library playlist (playlist 0) |
0x00 0x17 |
type(1) number(4) |
Switch to item identified by number and type given. |
0x00 0x18 |
type(1) | get count of the given type (count of tracks etc) |
0x00 0x19 |
number(4) | result of above command |
0x00 0x1A |
type(1) number(4) number(4) |
Get names for range of items. First number is starting item offset (0 is first item) and second number is how many. One response message 0x00 0x1B for each item. |
0x00 0x1B |
number(4) string length |
Number is the offset of item from 0. String is the name of the item. (1) |
0x00 0x1C |
none | Get time and status info |
0x00 0x1D |
length(4) time(4) status(1) |
Track length in milliseconds Elapsed time in milliseconds Status: 0x00 = Stop 0x01 = Playing 0x02 = Paused |
0x00 0x1E |
none | Get current position in playlist |
0x00 0x1F |
position(4) | current position in playlist |
0x00 0x20 |
number(4) | Get title of a song number |
0x00 0x21 |
string length | Title of song as null terminated string |
0x00 0x22 |
number(4) | Get artist of a song number |
0x00 0x23 |
string length | Artist returned as null terminated string |
0x00 0x24 |
number(4) | Get album of a song number |
0x00 0x25 |
string length | Album returned as null terminated string |
0x00 0x26 |
pollingmode(1) | Polling Mode: 0x01 = Start 0x00 = Stop Polling causes the return command 0x00 0x27 to be sent if 500 milliseconds. |
0x00 0x27 |
number(4) | time elapsed on current song |
0x00 0x28 |
number(4) | Execute playlist and jump to specified songnumber. 0xFFFFFFFF will always be start of playlist even when shuffle is on. |
0x00 0x29 |
command(1) | AiR Playbck Control: 0x01 = Play/Pause 0x02 = Stop 0x03 = Skip++ 0x04 = Skip-- 0x05 = FFwd 0x06 = FRwd 0x07 = StopFF/RW |
0x00 0x2C |
none | Get shuffle mode |
0x00 0x2D |
shuffle(1) | Returns current shuffle mode: 0x00 = Off 0x01 = Songs 0x02 = Albums |
0x00 0x2E |
shuffle(1) | Sets the shuffle mode: 0x00 = Off 0x01 = Songs 0x02 = Albums |
0x00 0x2F |
none | Get Repeat Mode |
0x00 0x30 |
repeatmode(1) | Returns current repeat mode: 0x00 = Off 0x01 = Songs 0x02 = Albums |
0x00 0x31 |
repeatmode(1) | Sets the repeat mode: 0x00 = Off 0x01 = Songs 0x02 = Albums |
0x00 0x32 |
Picture Blocks | upload a picture (see below) |
| none | Get max screen size for picture upload | |
| 2+2+1 | Return screen size: Gen3: 120 * 65 0x00 0x78 0x00 0x41 0x01 Gen5: 310 * 168 0x01 0x36 0x00 0xA8 0x01 |
|
0x00 0x35 |
none | Get number of songs in playlist |
0x00 0x36 |
number(4) | number of songs in playlist |
0x00 0x37 |
number(4) | jump to specified songnumber in playlist |
0x00 0x38 |
none | NCU |
0x00 0x39 |
2*(2+2+1) | NCU - suggested that it is the colour version of 0x00 0x34 |
Picture Control for AiR
The iPod when in AiR mode can accept a picture which is transferred in picture blocks. So far information is only available for iPods with a grayscale screen. The block data in this case has 2 bits for every pixel which selects one of the 4 greyscales possible (clear, lightgray, darkgray or black). Each block would send a series of pixel information for each line. I assume that the system for colour screens is similar but this is unknown. The actual block parameters are different for the first block and those following so I have provided two tables, the 1st for the 1st block and the 2nd for all other blocks un till the end. It should be noted that blocks are zero indexed - IE block one is index zero, block two is index one etc.
For Block 1 |
||
|---|---|---|
| Field | Size (bytes) | Value |
| Block Number | 2 |
Number of block (0x00 0x00 for block 1) |
| Unknown | 1 |
NCU, but I suggest it might be indicating grayscale (0x01) and colour would have another code. In all likelihood this command set was built knowing that colour screens would eventually be used. |
| Width | 2 |
Width of picture - should be the same as obtained from command 0x00 0x33 and response 0x00 0x34 |
| Height | 2 |
height of picture - should be the same as obtained from command 0x00 0x33 and response 0x00 0x34 |
| Bytes Per Line | 4 |
Number of bytes sent for each line. Should be divisible by 4. |
| Picture Bytes | N |
The data for a set number of lines. This has an upperlimit because of the length field used for all commands. |
For Block 2 Un till End |
||
|---|---|---|
| Field | Size (bytes) | Value |
| Block Number | 2 |
Number of block (0x00 0x01, 0x00 0x02 and up) |
| Picture Bytes | N |
The data for a set number of lines. This has an upperlimit because of the length field used for all commands. |
The number of lines sent per block should be the same. The original work suggested that 3 lines are sent per block but I think that this really depends on which accessory is being used. It should also be noted that extra pixels to the right and bottom will be ignored if they go over the screen size.
Other Modes (1 & 2)
Although I do not expect many accessories to still use these I have added them for reference. Some iPods will not like the 3 and 4 byte commands of Mode 2. Also in mode two the commands are sent 66 times per second until the button is released at which point the release command is sent.
Mode 1 Voice Memo |
|
|---|---|
Command |
Purpose |
0x01 0x00 |
Recording has started |
0x01 0x01 |
Recoding has stopped (or paused). |
Mode 2 iPod Remote |
|
|---|---|
Command |
Purpose |
0x00 0x00 |
Button Released |
0x00 0x01 |
Play |
0x00 0x02 |
Vol+ |
0x00 0x04 |
Vol- |
0x00 0x08 |
Skip> |
0x00 0x10 |
Skip< |
0x00 0x20 |
Next Album |
0x00 0x40 |
Previous Album |
0x00 0x80 |
Stop |
0x00 0x00 0x01 |
Play |
0x00 0x00 0x02 |
Pause |
0x00 0x00 0x04 |
Mute (toggle) |
0x00 0x00 0x20 |
Next Playlist |
0x00 0x00 0x40 |
Previous Playlist |
0x00 0x00 0x80 |
Toggles Shuffle |
0x00 0x00 0x00 0x01 |
Toggles Repeat |
0x00 0x00 0x00 0x04 |
Ipod Off |
0x00 0x00 0x00 0x08 |
Ipod On |
0x00 0x00 0x00 0x40 |
Menu Button |
0x00 0x00 0x00 0x80 |
OK/Select |
0x00 0x00 0x00 0x00 0x01 |
Scroll Up |
0x00 0x00 0x00 0x00 0x02 |
Scroll Down |