Reverse Engineering the iPod Classic's Undocumented Mikey Chip

The iPod Classic 7th generation runs Rockbox, a free and volunteer-driven operating system for Apple hardware. The inline remote on Apple's wired earbuds does not function when Rockbox is installed. To enable the earbud remote, the chip responsible for decoding the iPod's earphone remote, known as "Mikey", had to be reverse engineered.

No public documentation exists for this chip, which has an I2C address of 0x72. The chip has 8 registers and handles two tasks: powering the headset microphone and decoding the inline remote buttons.

After extensive research, no prior work on reverse engineering this chip was found. Only a 16-year-old reverse engineering writeup on a blog that no longer exists and a wiki mirror of the original writeup were discovered. The hardware behaves unexpectedly, with the chip falling asleep after ~5 seconds and reporting button releases with a delay of 1.8 seconds.

Using the Rockbox debug menu, an auto-sweep mode was implemented to test all 256 register values, while a MARK key stamped the log when pressing the Menu button for button press synchronization.

After pressing buttons, connecting and disconnecting the jack, and flashing builds, the results were analyzed using a diff tool. All three buttons work with this reverse-engineered driver, which is currently under review in the Rockbox upstream. The prebuilt Rockbox image with the remote driver is available for download and works on both the iPod Classic 6G and 7th generation.

Once the change merges upstream, users can switch back to the official daily builds. Additionally, a Rockbox Boot Logo Patcher was developed to swap the startup logo with any desired image.