TLDR: Apple has added some extra request IDs to the Companion-Link protocol that's used to talk between Apple devices and the HomePod Mini. These keys show that it's possible to check whether temperature and humidity measuring is enabled, and fetch readings if it is. I'm working on reverse engineering the protocol, plan to publish more soon, and this would be great to get into something like HomeAssistant.

For the last month or so I've been reverse-engineering with the companion-link protocol that Apple uses to communicate between devices, and specifically between iPhones/Macs and the HomePod and AppleTV. I've managed to get it all working, including media control, Live Audio and Announcements.

I plan to do a more detailed post on how it all works, but I spotted a recent change in tvOS 14.6 that indicates temperature and humidity monitoring may be coming soon. iFixit noted the hardware when they did their teardown, but this is the first time I seen anything that shows it might actually be used in the near future.

There's some authentication and cryptography I'm going to skip for the purposes of this post, and focus on the core of the companion-link protocol. At its core, the companion-link messages consist of events, requests and responses. Inbound messages to the device are handled by the Rapport daemon (rapportd).

Other system components can register event or request handlers with the rapportd daemon, and incoming messages are passed to that subsystem. For example, there's a request ID _mcc which can be used to control the currently playing music, and that is handled by the media subsystem. The basic message is _systemInfo which does what it says on the tin: here's a truncated view of its output:

{ '_c': { '_pubID': 'XX:XX:XX:XX:XX:XX', '_mRtID': 'XXXX', '_sv': '250.5', '_bf': 1944, _stA': [ 'com.apple.announce', 'com.apple.coreduet.sync', 'com.apple.siri.wakeup', 'com.apple.LiveAudio' ], _roomName': 'Office', 'model': 'AudioAccessory5,1', 'name': '%'}, '_t': 3, }

The key subsystem on HomePod is an application called SoundBoard, that I believe is broadly analogous to the iPhone's SpringBoard application. In the case of the HomePod it's responsible for orchestrating the system and launching other applications such as those providing the music, podcasts or sound effects features.

While examining the startup system logs on a newly updated HomePod I noticed SoundBoard registering three new event IDs:

com.apple.TempHumidityMetrics.Enabled / com.apple.TempHumidityMetrics.Fetch / com.apple.TempHumidityMetrics.Info

At the momement the only one that works is the Info key, and returns the following:

{'_c': {'Enabled': False, 'MetricsPayloadVersion': 1}, '_t': 3, '_x': 123}

The other two keys get no response - the next step is to take a look inside the updated SoundBoard binary and see if there's a way of enabling them, or if it's a case of waiting for Apple to finish rolling out the feature.

I expect we might see more on this at WWDC in a few days regardless...