The Apple Accessory Protocol is used for communication between the iPod and serially connected accessories (such as the Remote, iTalk, Honda Music Link etc). The protocol was introduced with the 3rd generation iPods, and at present it is assumed is also compatible with the 4th generation iPods and mini iPods. (The iPod Dock Connector provides access to this communication channel as well.)

The connections uses a standard 8N1 serial protocol. The original speed rate is 19200 baud - higher rates (up to 57600 baud) work properly (tested the 5G) but make trouble sending large amounts of data (picture blocks) faster than 38400 baud. The Honda Music Link communicates at 9600 baud.

Request/Response Structure

The request and response messages follow this general form. The mode in the message indicates which mode the command belongs to, these same mode values are used in the mode switching command below.

For example: FF 55 03 00 01 04 F8

Request Response Structure
Header20xff 0x55
Length1Size of Mode + Command + Parameter
Mode1The mode the command is referring to.
Command2The two bite command.
Parameter0..nOptional parameter, depending on the command.
Checksum10x100 - ( (sum of all length/mode/command/parameter bytes) & 0xFF)

Mode List

List of Modes
Mode NumberPurpose
0x00Mode switching
0x01Voice Recorder
0x02Simple Remote
0x03Request Mode Status
0x04AiR Mode

Mode Switching (Mode 0)

Mode 0 Commands
0x01 0x01Switch to Voice Recorder mode, not working on G5.
0x01 0x02Switch to iPod Remote mode.
0x01 0x04Switch to AiR mode.
0x03Get current mode status.
0x04 xx(response) The current mode number (xx is the mode returned by the iPod), 0x04 0x01 could also be an indicator that the iPod is currently busy. (I frequently get this skipping tracks very fast.) This info is not 100% correct, I'm getting different responses. Will try to work this out later.
0x05Switch to AiR mode (same as 0x01 0x04?)
0x06Switch to iPod Remote mode (same as 0x01 0x02?)

Clearly there's stuff here waiting to be figured out.

Voice Memo (Mode 1)

The Mode 1 commands are used for the voice recording functions. To initiate the recording mode on the iPod the send the switch to mode 0x01 command - this will switch the iPod display to the "Voice Memo" screen. When the record button is pressed the iPod will send the command "0x00 0x00", sending the command to switch to mode 0x01 will start the actual recording.

Mode 1 Commands
0x01 0x00Recording has started.
0x01 0x01Recording has stopped (or paused).

iPod Remote (Mode 2)

The Mode 2 commands are used by the remote control to signal button presses. When a button is pressed the appropriate code is send 66 times per second until the button is released at which point the button released command is sent.

Note that the 3 and 4 byte commands may not work for older (tested on a 3G) iPods. They are valid for newer (tested on an iPod Nano) iPods however.

Mode 2 Commands
0x00 0x00Button Released
0x00 0x01Play
0x00 0x02Vol+
0x00 0x04Vol-
0x00 0x08Skip>
0x00 0x10Skip<
0x00 0x20Next Album
0x00 0x40Previous Album
0x00 0x80Stop
0x00 0x00 0x01Play (Just Play, No Pause)
0x00 0x00 0x02Pause (Just Pause, No Play)
0x00 0x00 0x04Mute (Toggle)
0x00 0x00 0x20Next Playlist
0x00 0x00 0x40Previous Playlist
0x00 0x00 0x80Toggles Shuffle
0x00 0x00 0x00 0x01Toggles Repeat
0x00 0x00 0x00 0x04iPod Off
0x00 0x00 0x00 0x08iPod On
0x00 0x00 0x00 0x40Menu Button
0x00 0x00 0x00 0x80OK/Select Button
0x00 0x00 0x00 0x00 0x01Scroll Up
0x00 0x00 0x00 0x00 0x02Scroll Down

Advanced Remote (Mode 4)

The mode 4 commands are used for the Advanced iPod Remote (AiR) functions. The commands can be used to remotely control much of the iPod functions. Unfortunately when switched to this mode the iPod display changes to "OK to disconnect".

Commands you send to the iPod are highlighted, responses to those commands from the iPod are not. The response is always the command + 1.

Mode 4 Commands and Responses
Command / ResponseParameter (bytes)Purpose
0x00 0x00Result(1) Command(2)think that the result 0x04 means that the command wasn´t understood
0x00 0x01Result(1) Command(2)Gives you feedback on the command you just executed. Result: 0=success, 2=failure, 4=you exceeded the limit of whatever you were requesting/wrong parameter-count, 5=sent an iPod-Answere-Cmd(?). The Command is the command that this is in response to.
0x00 0x02noneperhaps a simple ping-request ?!
0x00 0x038 bytes0xFF 0xFF 0xFF 0xFF 0x00 0x00 0x00 0x00 (echo?)
0x00 0x09none? returns flag set with 0x00 0x0b, don´t know, what this means (perhaps an indicator for track-change - if you set this flag to 0x01 it turns to 0x00 again after changing the track)
0x00 0x0a1 byte0x00 or 0x01
0x00 0x0b1 byteparameter 0x00 & 0x01 result in a success-answere (copare 0x00 0x01), don´t know what happens - seems to be a flag which can be read with 0x00 0x09
0x00 0x0c7 bytes??? results in a answere 0x0d
0x00 0x0d11 bytes or 1 bytetried some parameters - result seems to dependent on current playlist
parameters 0x00 0x00 0x00 0x00 0x00 0x00 0x00 give (on my Ipod) 11 bytes
(0x00 0x00 0x00 0x00 0x00 0x00 0x02 0xf0 0xdb 0x00 0x00 in main-Playlist - *not* the playlist-number and *not* the count of tracks in this playlist)
0x00 0x12none? Get iPod Type Size ?
0x00 0x132 bytesGen3 20GB: 0x01 0x02 (0x01 = Gen3 iPod, 0x02 = 20GB ??)
Gen4 30GB: 0x01 0x09
Gen5 30GB: 0x01 0x09
0x00 0x14noneGet iPod Name
0x00 0x15namestring(var)iPod Name as a null terminated string
0x00 0x16noneSwitch to the main library playlist (playlist 0)
0x00 0x17type(1) number(4)Switch to item identified by the number and type given.
0x00 0x18type(1)Get Count of the given types (count of playlists, etc)
0x00 0x19number(4)Amount of requested type returned
0x00 0x1Atype(1) number(4) number(4)Get Names for a range of items, first number is starting item offset (0 for the first item), second number is number of items to retrieve. The iPod will send back an entire message for each item requested.
0x00 0x1Bnumber(4) stringoffset, name of the item (note that playlist 0 is the "main library" and will contain all the songs on the iPod and have the same name as the iPod itself as in command 0x00 0x14).
0x00 0x1CnoneGet time and status info
0x00 0x1Dlength(4) time(4) status(1)Track length in milliseconds, elapsed time in milliseconds, status=0x0 stop, 0x01 playing, 0x02 paused
0x00 0x1EnoneGet current position in playlist
0x00 0x1Fposition(4)Current position in playlist
0x00 0x20number(4)Get title of a song number
0x00 0x21stringtitle returned as a null terminated string
0x00 0x22number(4)Get artist of a song number
0x00 0x23stringArtist returned as a null terminated string
0x00 0x24number(4)Get album of a song number
0x00 0x25stringAlbum returned as a null terminated string
0x00 0x26pollingmode(1)Start Polling Mode = 0x01, Stop Polling Mode = 0x00. Polling mode causes the iPod to return the time elapsed (0x00 0x27) every 500 milliseconds.
0x00 0x27number(4)time elapsed on current song
0x00 0x28number(4)Execute Playlist switch specified in command 0x00 0x17, and jump to specified songnumber in the playlist (0xFFFFFFFF = start at the beginning of the playlist, even when shuffled... probably what you want to use)
0x00 0x29command(1)AiR Playback Control. Play/Pause=0x01, Stop=0x02, Skip++=0x03, Skip--=0x04, FFwd=0x05, FRwd=0x06, StopFF/RW=0x07
0x00 0x2CnoneGet Shuffle Mode
0x00 0x2Dshufflemode(1)Returns current Shuffle mode: Off = 0x00, Songs = 0x01, Albums = 0x02
0x00 0x2Eshufflemode(1)Sets the shuffle mode. Off = 0x00, Songs = 0x01, Albums = 0x02.
0x00 0x2FnoneGet Repeat Mode
0x00 0x30repeatmode(1)Returns current Repeat mode: Off = 0x00, One song = 0x01, All songs = 0x02
0x00 0x31repeatmode(1)Sets the repeat mode. Off = 0x00, One song = 0x01, All songs = 0x02
0x00 0x32Picture BlocksUpload Picture for AiR mode (see picture block description below)
0x00 0x33none? Get Max Screen Size for Picture Upload ?
0x00 0x342+2+1 bytesGen3 20GB: 0x00 0x78 0x00 0x41 0x01 => 120 x 65 ?

Gen5 30GB: 0x01 0x36 0x00 0xa8 0x01 => 310 x 168 ?
what means the 0x01 at the end? - perhaps the supported resolution for 1bit bitmaps

0x00 0x35noneGet number of songs in current playlist
0x00 0x36number(4)Number of songs in current playlist
0x00 0x37number(4)Jump to specified Songnumber in the current playlist
0x00 0x38none???
0x00 0x392*(2+2+1) = 10 bytes?? Gen5 30GB: 0x01 0x36 0x00 0xa8 0x02 0x01 0x36 0x00 0xa8 0x03 ... some similarities to 0x00 0x34

perhaps different solutions for different colordepth?

Type Bytes

Some of the commands refers to type bytes. These are as follows:

Type Bytes

Picture Blocks

Transferring a picture to the iPod's screen is done using picture blocks. A picture block is basically the picture command (0x00 0x32). It's complicated enough to deserve its own section.

The parameter bytes of a picture block look like the following:

Picture Block Parameters
block number2Number of the block, starting from zero.
unknown1Always 1, only in the first block.
width2Width of the picture, only in the first block.
height2Height of the picture, only in the first block.
bytes per line4Number of bytes you will send for each line. Divisible by 4, and only in the first block
picture bytesN3 lines? of pixels to be displayed, every 2 bits represents a pixel. (4 color greyscale)

An example would look something like the following:

First block:

0xFF 0x55 (standard header)
0x6E (length of data in this block)
0x04 (mode of the command)
0x00 0x32 (command for picture display)
0x00 0x00 (indicates the first block (block zero))
0x01 (damned if I know.. perhaps indicates that the size info for the picture is here)
0x00 0x78 (width of picture to be displayed)
0x00 0x40 (height of picture to be displayed)
0x00 0x00 0x00 0x20 (number of bytes you're sending for each line of the display - must be a multiple of 8 and has to fit the needed bits!)
The rest is a 4 color picture, with every two bits representing a pixel.

Second block and every block thereafter:

0xFF 0x55 (standard header)
0x65 (length of data in this block)
0x04 (mode of the command)
0x00 0x32 (command for picture display)
0x00 0x01 (indicates the second block (increment as you go))
The rest is a 4 color picture, with every two bits representing a pixel.

Any extra pixels you send outside the range of the picture size on the right or bottom of the picture then get cut off.

You can see if the command was valid when you watch the response string for each block.

Good response is 0xFF 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xC3.

Bad response 0xFF 0x55 0x06 0x04 0x00 0x01 0x04 0x00 0x32 0xBF.

Below a width of 0x10 fillbits are used (only every 4th nibble of the picturedata is taken for the picture).


Most of the information on this page was acquired from the Apple Accessory Protocol - wikiPodLinux document at the iPodLinux site, acquired on 29-Jan-2007 @ 14:11 EST. This information is duplicated here so that it is available whenever I need it.

The bulk of this information is due to the hard work by Christoph, you can find his results at http://stud3.tuwien.ac.at/%7Ee0026607/ipod_remote/ipod_ap.html. Generalisation of the results was the work of Otto, see http://ipodlinux.sourceforge.net/forums/viewtopic.php?p=3362#3362.

This article is issued from Nuxx. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.