[Manual] SBC XQ, Implement High quality bluetooth audio to full android watches

Warning: Doing this at your own risk.

If you never heard of SBC XQ, look this article before read.
This manual is based on this article by ValdikSS, Who first coined the concept of SBC XQ.

1. Introduce

Since our watches does not support aptx-HD or LDAC, No high qualtity bluetooth audio available. but SBC codec is quite flexible codec actually, You can easily mod the bluetooth stack to increase its bitrate and get high quality bluetooth audio. There is no real technical limit for this.

Bluetooth SBC profile consist of 7 numbers basically. They are Samplerates, Channel mode, Blocks in frame, Subbands, Allocation mode, Max Bitpool, Min Bitpool. It limits its bitrate by Max Bitpool, which is usually set to 53. and You can not go any further because It is also limitation of almost all bluetooth audio receivers.

But SBC codec also have some strange logic on it. This bitrate limit of Max Bitpool itself can be changed by other mode changes. Such as Channel mode and Subbands. An example, By changing channel mode from Joint stereo(which is default in most cases) to Dual channel mode, Your SBC bitrate limit will be almost doubled and You can adjust its bitrate by ‘lowering’ its Bitpool value.

In this case, Bitpool limit still not exceed “53”, You can bypass its bitrate limit and enjoy high quality(4~600 kbps around) bluetooth audio. Dual channel mode is not really ‘optimized’ mode if we compared it to Joint stereo and stereo. but If you can go this extreme bitrate, That kind of limitaion is meaningless. Various tests shows that It actually can go with aptx-HD qualtiy, or even further.

This is not new thing to audio communities and actually implemented to a lot of Android, MAC, linux devices. I’ll explain ‘HOW TO’ do this in this document specially for our precious full android watches.

2. Required

  • Your watch must runs marshmallow or nougat.
  • Your watch must be rooted.

3. Tools may needed

  • Good root explorer for android. I suggest MiXplorer.
  • ARM disassembler for windows(I’ll use IDA 7.0 Pro).
  • ARM to HEX converter(I’m using this).
  • Hex editor for windows.
  • SBC Bitrate Calculator by ValdikSS(link here).
  • Wireshark for windows.

4. Limitation

  • By trasmitter: There are various bluetooth stacks for android. but what I’m actullay able to mod are legacy broadcom(I found this stack from some Gingerbread devices), bluez(4.1 jellybean and below), bluedroid(4.2 jellybean to nougat), fluoride and modded fluoride stack by qualcomm(Oreo and Pie). Lollipop and below mediatek devices using blueangel stack which is dedicated stack for mtk devices. Currently, I’m not really moddable this stack. So, This manual is only for marshmallow and nougat mediatek watches. or which are NOT USING mtk chipset.

  • By receiver: Some bluetooth receiver just do not handle Dualchannel. In this case, Your audio will not played or begin crackling seriously. and most of TWS won’t go higher than 452kbps. Bare it mind.

5. HOW TO

First, Get “bluetooth.default.so” from "/system/lib/hw"

screen

Back up it as default and store it somewhere safe place. You’ll edit a copy of it.

Second, Change bitrate limit of SBC stream.

Open the “bluetooth.default.so” file by IDA 7.0 pro and HEX Editor. Wait till load. Open “View → Open Sub View → Strings” from IDA. You’ll meet the window like this.

Search “non-edr”. Click it. Right click aNonEdrA2dpSink and look what functions refer this. You’ll see this window.

bandicam 2021-01-31 01-58-17-354

for marshmallow watches, There will be 2 sections. 1 sections for nougat watches. You must mod all of these.

There will be code like this. “MOV.W R4, #0x148” or “MOV.W R0, #0x148”. 0x148 is the bitrate limit and You want to change this. To do this, Open ARM to HEX converter and put the code on.

and change like this.

This is just limit of bitrate and We’ll edit Bitpool setting later. Thus You can put any value of above which you have planned. Go to hex edit and search original code(4FF4A474). Only one value will be matched. Change it to the code from latter screenshot(4FF49864) and save it. Your bitrate limit has been off now. Keep it mind that this is just an example and actual code can be vary.

Third, Change default SBC profile.

Search “20 01 10 04 01 35 02” for 44.1khz, “10 01 10 04 01 35 02” for 48khz from hex editor. There would be only one matched code for this.

0x20 : Samplerate 44.1 (You must not mod this)
0x01 : Channel mode Jointstereo
0x10 : Block Count 16 (You must not mod this)
0x04 : Sub Bands 8
0x01 : Allocation louness (You must not mod this)
0x35 : Max bitpool
0x02 : Min bitpool

Change channel mode Jointstereo(0x01) to DualChannel(0x04). And Max bitpool to preferred. to figure out what bitpool value matched to your preferred bitrate, You can use SBC Bitrate Calculator.

According to my test, There is no problem to being maximum (0x35=53=617.4 kbps). but I recommend max bitpool value (0x26=38=452.0 kbps). It’ll be much more stable and still perfoms close quality to aptx-HD.

Last, Check if it is actually working.

If modding done, Turn bluetooth off and put your file back to “/system/lib/hw/bluetooth.default.so”. Check file property setting is vaild and reboot. The changes should be applied at this point.

To check if it is actually working, You need to get bluetooth HCI log.

Turn off bluetooth → Go to develop setting and enable HCI log → Turn on bluetooth and connect to audio receiver → play music 10 sec around → turn off bluetooth → disable HCI log.

log file will be saved on “/sdcard/mtklog/btlog/btsnoop_hci.log”. Pull this file to your computer and open it by Wireshark.

6. Additional
Here are some pre modded bluetooth stack which I’m currently using. Enjoy.

for LEMFO LEMX DMN_DM19_LEMX_20190522
for LEMFO LEM11 Z31-LEM11-V1.9

3 Likes

More pre modded stack added.

for Finow Q1 Pro 1.2
for LEMFO LEM7 Z28S-LEM7-V1.5 (mt6739 7.1.1 version)
for LEMFO LEM8 Z29-LEM8-V1.5
for KOSPET POWER V1.1

1 Like

Very detailed tutorial. Thanks

1 Like

7. Disable AAC codec. (Optional, A thing I missed on manual.)

I found this piece of codes from Finow watch. Some android watches(and chinese mediatek phones) supports AAC codec. I have no idea if it is marshmellow or vendor specific. Anyway, You want to disable it because AAC on android usually perfoms bad quallity. It is even worse than default setting of SBC.

If you know that your watch does not support AAC at all(as far as I know, LEMFO and KOSPET 7.1 watches does not support this), or do not use AAC supported receiver, or want let them work as it is, You can ignore this section.

How to

Search “bta_av_co_audio_peer_supports_codec” string and figure out what function refers it. There will be only one function.

You will change its code flows. By changing “BGE loc_724E0” to “B loc_724E0”. It means will jump to “loc_724E0” no matter what, So stack will ‘thinks’ that your audio receiver does not support AAC even if it does.

To do this, highlight “loc_724E0” by clicking it, and change tab to hex view.

That highlighted “22 DA” is the code. You will change this “DA” to “E0”. Open hex editor, search this part from it and change it. Remember this is just an example and code can be vary for devices and roms.

After reload, flows should looks like this. It won’t connect AAC after all.

1 Like

KOSPET POWER1.1 works perfectly on PRIME1. Thanks! :+1: :+1:
This is a super solution to improve sound quality.
I hope android 10 will have such a solution sometime. :pray:

I won’t really surprise even if those 7.1 stacks are all compatible among all 7.1 models on the market. Basically, They are all same stacks. I just put the label to being safe.

Works APTX and APTX-HD on A10 PRIME2.
I’ll describe how I did it soon.

2 Likes