Spoof an Apple device ID and your AirPods unlock their hidden features on Android

A 28,000-star GitHub project called LibrePods makes your AirPods act like they’re paired with an iPhone, even when they aren’t. It reverse-engineers the private protocol Apple uses to talk to its earbuds, then speaks it from Android or Linux. The result: ear detection, real battery readouts, and noise-control switching on hardware Apple never meant to support.

If you own AirPods and a non-Apple device, you already know the gap this fills. The earbuds connect and play audio over plain Bluetooth fine. But pause-when-you-take-them-out, the per-ear battery percentages, the press-and-hold to cycle between noise cancellation and transparency, those are Apple-only. LibrePods is the open-source answer from developer Kavish Devar, and the way it works is a clean case study in how you pry open a closed accessory.

What LibrePods actually does

Start with what’s broken without it. AirPods are Bluetooth headphones, so any phone can pair them and stream music. What they aren’t, on Android, is smart. The features people pay the Apple tax for live in a proprietary control channel that runs alongside the audio, and Apple only opens that channel for its own gear.

LibrePods implements that channel. The project README lists what works today: changing the listening mode (noise cancellation, transparency, off), ear detection, battery status, renaming the buds, conversational awareness that ducks your volume when you start talking, automatic connection, configurable call controls, personalized volume, and microphone-side selection. On Android specifically, it adds head gestures, the nod-to-answer and shake-to-decline trick. That’s most of the feature sheet an iPhone owner gets.

A second tier needs more aggressive tactics and ships with an explicit “at your own risk” label: loud-sound reduction, multi-device connectivity (two devices, the same cap Apple enforces), and transparency-mode customization. A third tier is still in development, including Find My integration and head-tracked spatial audio. The maintainer also draws a hard line on one thing he won’t build: spatializing plain stereo into surround, which he says is out of scope.

The reach matters more than any single feature. AirPods are one of the best-selling consumer electronics products on earth, and a large share of the people who own them don’t carry an iPhone every day. For that crowd, the buds have been half-bricked. LibrePods un-bricks them.

How you reverse-engineer a closed Bluetooth accessory

Here’s the part that’s genuinely fun. Apple never published the AirPods control protocol, so the first job was figuring out what the bytes mean.

The method is old-school packet sniffing. You put an iPhone next to a real pair of AirPods, capture the Bluetooth traffic flowing between them, and stare at the hex until patterns emerge. A companion project, a Wireshark dissector by Nojus, does exactly this: it teaches Wireshark to decode Apple’s accessory protocols (the repo names AACP among them) so the raw capture stops looking like noise and starts looking like commands. Toggle noise cancellation on the iPhone, watch which packet changes, and now you know the opcode for noise cancellation. Repeat a few hundred times and you’ve rebuilt the protocol from the outside.

The control data doesn’t ride the audio stream. It travels over L2CAP, the Bluetooth layer that carries arbitrary packets between paired devices independent of the music. LibrePods opens its own connection on that layer and sends the same commands an iPhone would. To the earbuds, the packets are indistinguishable from Apple’s.

There’s one more catch, and it’s the clever bit. Some features only switch on when the AirPods believe an Apple device is on the other end. So LibrePods performs vendor ID spoofing: it presents an Apple identifier during the handshake. As one Hacker News commenter put it in the project’s discussion thread, “the fact that simple VendorID spoofing makes features available” tells you the lock was always a soft one, a check Apple bolted on rather than a hard technical barrier. Hackaday’s writeup reached the same read: the app “tricks AirPods into believing they’re communicating with Apple devices by mimicking the necessary identification signals.”

Worth flagging: the maintainer is upfront that parts of the codebase were AI-generated, specifically the head-gestures module, the troubleshooter, and the log collector, while the Bluetooth manager, the background service, and the entire UI were hand-written. The Linux side is a Rust rewrite; the Android app is mostly Kotlin.

The Android root problem

LibrePods runs cleaner on Linux than on Android, and the reason is a bug, not a policy. To send those non-standard handshake packets, the app needs lower-level access to the Bluetooth stack than Android normally grants third-party apps. On most phones today, that means a rooted device running the Xposed framework. Hackaday put it plainly: “a bug in the Android Bluetooth stack means that LibrePods requires root on most devices.”

That’s a real barrier. Rooting a modern Android phone is fiddly, voids most warranties, and breaks banking and DRM apps that check for it. For a lot of people, that alone is a dealbreaker.

The good news showed up in the discussion: the underlying stack bug was reportedly fixed in a newer Android release, which should drop the root requirement going forward. So the friction is temporary, an artifact of where Android’s Bluetooth plumbing happens to be, not something Apple is actively defending. When the fixed OS version reaches enough phones, LibrePods becomes a normal install for a much wider audience.

The legal grey area, and why it’s grey not black

Reverse-engineering a protocol for interoperability sits in a spot the law has mostly blessed. US courts have long treated reverse-engineering to achieve compatibility as legitimate, the lineage that runs from Sega v. Accolade through Sony v. Connectix. LibrePods isn’t copying Apple’s code; it’s observing behavior and writing fresh, GPLv3-licensed code that produces compatible behavior. That’s the textbook interoperability case.

The maintainer is careful about the parts that would invite trouble. The README states flatly that “the LibrePods project is not affiliated with or endorsed by Apple Inc. in any way,” warns about scam sites impersonating the project, and notes that the GPL grants no rights to the LibrePods name or branding. No Apple trademarks, no shipped Apple code, no pretending to be official.

What’s striking is what the Hacker News thread (356 points, more than 100 comments) didn’t dwell on. There was no serious DMCA panic, no hand-wringing about anti-circumvention law. The closest thing to a legal worry was fatalistic, not principled: a few people figured Apple might patch the spoofing trick in a future firmware update. The community treated the project as plain interoperability research, because that’s what it is. The risk here is technical (Apple could change the protocol) far more than legal.

Why locked accessories make projects like this matter

LibrePods is small in lines of code and large in what it represents. You bought the earbuds. They’re a Bluetooth device. The features they’re physically capable of are gated behind a software handshake whose only purpose is to check whether you’re holding the “right” brand of phone. Strip that check and the hardware does everything it always could.

That’s the right-to-tinker argument in miniature, and it generalizes well past AirPods. Smart-home gear that bricks when the vendor’s cloud shuts down, printers that reject third-party ink, cars that paywall heated seats you already paid to install: the pattern is a capable device deliberately hobbled in software to protect an ecosystem. Reverse-engineering projects are the pressure-release valve. They don’t break anything Apple built; they decline to respect an artificial fence.

What this means for you

If you’ve got AirPods and an Android phone or a Linux box, LibrePods is worth a look right now, with one caveat: on most Android phones you’ll need root and Xposed until the Bluetooth-stack fix lands widely, so check your device and your tolerance for that before committing. Linux users have the smoother path. Either way, the project is GPLv3 and free, the Play Store version’s payment is an optional sponsorship rather than a paywall, and the GitHub repo is the canonical source (watch out for impersonator sites). Don’t expect feature parity with an iPhone on day one, head-tracked spatial audio and Find My aren’t done yet. But ear detection, real battery numbers, and one-tap noise control cover the things people actually miss. The thing to watch is Apple’s next AirPods firmware: if the protocol shifts, LibrePods has to chase it. So far, the spoof has held.