Bringing the iPod Classic's earbud buttons back to life: reverse-engineering the Mikey chip

The owner of a 7^th-generation iPod Classic had long since switched to the Rockbox firmware, but the inline remote on Apple's wired earbuds — the play/pause button and the volume clicker — never worked in it. The source code still carried a TODO: detect the jack accessory and support the remote buttons. Rockbox exists for this iPod family only because volunteers have been reverse-engineering Apple's undocumented hardware blind since 2011; the earbud remote simply never reached the top of anyone's list. The author decided to finish the job.

A chip with no documentation anywhere

The headphone jack is handled by a dedicated controller that Apple's firmware calls "Mikey". It sits on I2C bus 0 at address 0x72, has eight registers, and does two things: it powers the headset microphone and decodes the inline remote. There is no public documentation for it anywhere. Searches across freemyipod, Rockbox's own Gerrit, GitHub, and old projects like openiBoot turned up nothing.

The only lead was David Carne's 2010 teardown of the iPod shuffle 3G remote. His site is long dead — exactly like the xkcd comic about the "wisdom of the ancients," where the sole forum reply reads "never mind, fixed it." This time, though, a wiki mirror and a GitHub repo had preserved the notes.

The buttons were analog all along

Carne's findings demolished the theory of a clever serial protocol. It was far simpler: the center button is a dead short of the mic line, while the volume buttons are resistive loads that droop the voltage to set levels. The "smart" part is a single ultrasonic ID chirp at power-up — identification, not DRM.

You cannot attach a debugger to an iPod's jack controller, so the author built a debug screen inside Rockbox that polled all eight registers every 20 ms and logged every change. An auto-sweep ran register 0 through all 256 values — and at 0x2f the chip began reporting button presses cleanly and repeatably. An AI helped diff the logs across three sweep passes, but every conclusion was verified on the actual device.

The hardware lies

The most curious discovery was that the chip's event engine naps: after about five seconds of inactivity a press still registers instantly, but the release comes 1.7–1.8 seconds late. No amount of debouncing can fix hardware that reports the past, so the center button is now click-only, with no long-press semantics.

The result is a driver submitted for review on Gerrit as change 7677: one clean commit, eight files, 318 insertions. All three buttons work on hardware from 2009. A prebuilt image is available separately, and the TODO in audio-6g.c is finally gone.

Source: Lobsters