Reverse Engineering the iPod Classic's Undocumented Mikey Chip | TerminalBytes

Skip to content

Go back<br>at the top of the post serves mobile. --><br>Reverse Engineering the iPod Classic's Undocumented Mikey Chip<br>14 Jul, 2026

On this page

My iPod Classic (7th gen) runs Rockbox, and I love almost everything about that arrangement. But the inline remote on Apple’s wired earbuds (the center play/pause button and the volume clicker) did nothing. Never has, for anyone running Rockbox on this family of iPods.

The reason is sitting right there in the Rockbox source:

/* TODO:<br>* - detect jack accessory<br>* - support for remote buttons<br>*/<br>And honestly, fair enough. Rockbox on this iPod exists because volunteers reverse engineered Apple hardware with zero documentation, for free, since January 2011. Music, clickwheel, recording, all of it figured out the hard way. The earbud remote just never made it to the top of anyone’s list: the 2014 commit that added the button-interrupt plumbing called remote events “work in progress”, and the TODO landed in the audio driver in 2017. Nobody picked it up since. So I did.

TL;DR

The chip that decodes the iPod’s earphone remote (“Mikey”, I2C address 0x72) has no public documentation. At all. Anywhere.

The only prior art was a 16-year-old reverse engineering writeup on a blog that no longer exists. A wiki mirror saved the day, straight out of xkcd 979.

I swept the chip’s mode register through all 256 values on the device itself, found the one that enables button reporting (0x2f), and decoded the events.

The hardware lies: the chip’s event engine falls asleep after ~5 seconds and reports button releases 1.8 seconds late.

The result is a driver, under review upstream as Gerrit change 7677. All three buttons work.

What do I do to fix it?

If you’re not here for the reverse engineering story and just want working earbud buttons: I’ve published a prebuilt Rockbox image with the remote driver as ipod6g-mikey-v1. It works on the iPod Classic 6G and 7th gen, and assumes your iPod already runs Rockbox (bootloader installed via the official Rockbox Utility).

Download rockbox.zip from the release

Connect the iPod in disk mode and unzip it onto the drive root (it replaces the .rockbox firmware files; your settings, themes, database, and music are untouched)

Eject and reboot

Play/pause then works on every screen, volume works everywhere including menus (hold to ramp), and the remote keeps working with the hold switch on. This doesn’t touch the bootloader, so worst case you delete .rockbox from disk mode and unzip an official build back. Once the change merges upstream, switch back to the official daily builds.

A chip named Mikey, documented nowhere

Quick cast of characters. The iPod Classic (mine is the 7th gen; Rockbox names the whole family “ipod6g” after the 2007 original) has a dedicated little controller for the headphone jack that Apple’s firmware calls “Mikey”. It sits on I2C bus 0 at address 0x72, has 8 registers, and handles two jobs: powering the headset microphone and decoding the inline remote buttons. Rockbox has always known it exists, but only ever used it for one thing: raising the mic bias voltage so jack recording works.

Before touching a wire, I went looking for anyone who had done this before. The search was thorough and completely empty:

freemyipod , the community that reverse engineered this iPod enough to run custom code on it in the first place, has no Mikey driver and no register docs.

Rockbox’s Gerrit has zero abandoned attempts. Nobody even tried and gave up publicly.

GitHub code search for “mikey” returns the Atari Lynx sound chip and a Blue microphone accessory. Genuinely nothing else.

openiBoot , the old iPhone Linux project, never did headset accessories.

macOS ships an AppleMikeyDriver.kext, which proves the name is real, but nobody ever documented its internals, and on Macs the equivalent logic lives inside the audio codec anyway.

An undocumented chip, an unfinished driver, and 15 years of nobody picking it up. From an earlier session I already had half a win: raise the mic bias (write 7 to register 0, the same value the recording path uses) and the center button shows up as a nonzero value in register 4. Play/pause worked. Volume was a wall. My working theory was that volume rode some undocumented serial protocol, with an interrupt on GPIO E6 announcing new data.

That theory was wrong in every detail, and the E6 interrupt never fired once during the entire project. Not once.

The DenverCoder9 moment

If you’ve spent any time debugging obscure problems, you know xkcd 979. Ten years of searching, one forum thread with your exact problem, and the only reply is the author saying “never mind, fixed it.”

xkcd 979 “Wisdom of the Ancients” by Randall Munroe, CC BY-NC 2.5

Searching for the remote’s wire protocol surfaced exactly one thread to pull: a Hackaday post from February 2010 and a matching 16-year-old Reddit thread about David Carne reverse...