Bypassing regulatory locks, hacking AirPods and Faraday cages

(lagrangepoint.substack.com)

Comments

userbinator 12 November 2024
It appears that the Hearing Aid feature is actually an equalizer preset that is pushed to the AirPods and will replace your transparency mode.

Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but perhaps that was a huge calculated risk.

There's an incredible amount of processing power and flexibility in these things. Even the sub-$10 ones using the infamous JieLi SoCs - a 160MHz 32-bit computer in each ear. I'm surprised there hasn't yet been any TWS advertised with open-source firmware, although there's been some work in the usual Chinese (and Russian) communities on customisations.

jrockway 13 November 2024
> Since WiFi and a microwave operate at the same frequency (2.4GHz), we ran our leaky microwave at full power to block out any persistent network signals in the air.

Incidentally, WiFi tries to intentionally avoid this interference. Microwaves output no power during the zero crossing of the AC line that's driving it, and in this interval, there is no signal in the air to jam things. WiFi listens before sending (so as to avoid stepping on other stations), and the microwave's signal is enough to trigger this. (I forget if microwave ovens are "half wave" and you get 1/120th of a second 60 times a second, or if there is just a threshold near the zero crossing where there isn't enough power to interfere.)

I would say it's likely that the microwave oven didn't really do much here.

shawa_a_a 13 November 2024
A commenter on Reddit [1] pointed out that you can access the hearing test feature directly by using a special URL:

    x-apple-health://HearingAppPlugin.healthplugin/HearingTest

I wonder if there’s a similar deep link to be found to enable Hearing Aid mode?

1: https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_...

thel3l 12 November 2024
Hey! I'm Rithwik, one of the authors of the article, happy to answer questions etc!
post_break 12 November 2024
Does this reset itself after a certain amount of time or is it one and done? I'd be worried about the feature being removed when the iPad or airpods decide they've been in India for too long.
eliasdaler 13 November 2024
This showcases why free software is important. Geo-locking is a such hostile practice which makes zero sense here.

If the software/firmware was free and open, you’d be able to patch out/disable the geo-lock. But it probably wouldn’t be there in the first place…

kristofferR 12 November 2024
Does anyone know what the Hearing Protection mode does? It's not available in Norway (or anywhere outside of NAmerica).

I've used the AirPods Pro 2 as hearing protection for some stuff before, it works fine. Is it just due to the words ("Hearing Protection") which they are only allowed to use only in America or is it actually better than regular Pro 2 noise-cancelling?

RobMurray 13 November 2024
Is this actually different from the custom transparency mode in accessibility / headphone accommodations that existed before they even announced the hearing aid feature? It can use an audiogram stored in the health app. sounds pretty terrible with custom transparency mode though, a bit like a comb filter.
myself248 12 November 2024
This is fantastic! We're building a walk-in-closet-sized Faraday cage at i3Detroit, though of course we're in the US so we won't need it for this specific hack, there's a zillion reasons it's fun to have one!

Off the top of my head:

The biggie is that we're right down the street from WOMC's transmitter, which is 135,000 watts EIRP. It gets into EVERYTHING and makes other RF measurements more difficult, so if you're trying to align an amplifier or something, it's nice to start from a quiet place and get the basics solid, and only THEN add sources of potential intermod and stuff.

Debugging wifi, bluetooth, and other wireless stuff without a zillion other nodes in view. Yes you can filter the output of a sniffer, but it's more fun to filter the input. ;)

Lighting up a 1G or 2G cellular network without worrying about spectrum licensing.

Practicing offensive wifi techniques or other stuff that might interfere with the hackerspace's existing network.

Playing with GPS spoofers in an FCC-free zone. Or anything else you might find amusing but want to do responsibly.

Locking an iPhone in there to see if it reboots itself... (rofl)

notpushkin 13 November 2024
Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.
supersing 13 November 2024
Some Chinese users have discovered a more effective way to bypass geo-locking, even on iPhones (some Apple Health features require approval and can only be enabled on iPhone, not iPad).

TLDR, iPhones prioritize external GPS devices over internal ones. All you need is a "fake" lightning or USB-C external GPS device that tells your device where you want it to think it is.

Source: https://www.v2ex.com/t/1075937

sagz 13 November 2024
Can this be used to get EU specific features too? (AltStore and such)
PeterStuer 13 November 2024
Reminds me on how I setup laptops these days for geodisplaced vpn enjoyment.

Have the laptop on the vpn even during OS install. Never run the vpn client on the laptop. Never connect to any other network. Use the target's localisation (language, kb, timezone) during install. Have a dedicated browser with detailed location features turned off for your target sites.

sheerun 12 hours ago
This is just low point for Apple and any company who does something like this
pomian 12 November 2024
Looking forward to further write ups on faraday cages, design and uses. That was great what you did with the air pods.
rkagerer 13 November 2024
Is the hearing aid feature unavailable if you use the AirPods with an Android?
kuon 13 November 2024
How can the GET request be modified if it uses HTTPS? You can spoof certificates on iOS devices with dev tools?
tanvach 13 November 2024
Don’t know if running the microwave does much, since there are plenty of 5Ghz access points around too.
biosboiii 13 November 2024
Does anyone know which decompilation tool produces these graphs, as shown in the blog post?
trhway 13 November 2024
>modern devices position you within cities by using a combination of WiFi SSIDs + MAC addresses of routers and devices around you as well as GPS to triangulate your location. This was also the reason that our WiFi only iPad was able to display an accurate location in apps even though it had neither GPS nor cellular.

can't wait for this to find its way into Tomahawk missiles as a fallback for the jammed GPS environment

ryanmccullagh 13 November 2024
I bought AirPods Pro this year and it has been disappointing compared to the first gen non pro I had previously.

Somehow they fall out of my if i adjust my head down.

Battery life is good though

auspbro 13 November 2024
awesome hacking...
tzs 12 November 2024
> Hearing aids typically cost anywhere from ₹ 50,000 to upwards of ₹ 8L depending on the correction capability

For those who don't recognize the ₹ symbol it is the symbol for the Indian Rupee and an "L" after a number means 100,000, so ₹ 8L is ₹ 800,000.

At current exchange rates that puts hearing aids in India from $600 to upwards of $9,500.

AirPods Pro 2 are ₹ 24,900 ($295).