« All posts

Reverse-Engineered: iPod Classic's Undocumented Mikey Remote Chip

An undocumented iPod Classic chip called Mikey got reverse-engineered via register sweeping, bringing working earbud remote buttons to Rockbox.

On the iPod Classic (6G/7G) running Rockbox, the inline remote buttons on Apple's wired earbuds never worked. The cause: Mikey, the tiny I2C jack controller (address 0x72) that handles the remote, has zero public documentation, and a TODO for remote support sat untouched in Rockbox since 2017. One developer tracked down the only prior art — a 16-year-old writeup on a now-dead blog, rescued via a wiki mirror — and then brute-forced Mikey's mode register through all 256 values directly on hardware to find the setting (0x2f) that enables button reporting.

The investigation revealed the remote is far simpler than assumed: it's a pure analog voltage-divider scheme, where the center button shorts the mic line and the volume buttons apply different resistive loads to droop it to specific voltages. It also exposed quirky hardware behavior, including an event engine that falls asleep after about 5 seconds and reports button releases with a 1.8-second delay.

The result is a driver now under review upstream as Gerrit change 7677, plus a prebuilt Rockbox image (ipod6g-mikey-v1) that already gets all three buttons working. It's a solid example of reverse-engineering undocumented embedded hardware through disciplined register sweeping, and of keeping decade-old open-source projects moving forward.