StealthTech Docs
Index

StealthTech Protocol Mapping

Complete BLE protocol specification for the Lovesac StealthTech Sound + Charge system.

Protocol reverse-engineered from MCU firmware analysis and confirmed by homebridge-lovesac-stealthtech (MIT, Alex Rosenberg).

Custom GATT Service

The StealthTech service UUID encodes "excelpoint.com" in ASCII:

65786365-6c70-6f69-6e74-2e636f6d0000
 e x c e  l p  o i  n t  . c o m

Excelpoint Technology is a Singapore-based electronics distributor that designed the BLE firmware for Harman Kardon.

All characteristics share this base UUID with the last 2 bytes varying.

GATT Characteristics

UUID SuffixNamePropertiesPurpose
0001UpStreamNotifyDevice → host status notifications
0002DeviceInfoWriteRequest state dump or firmware version
0003EqControlWriteVolume, bass, treble, center, rear, mute, quiet, preset
0004AudioPathWriteBalance, power
0005PlayerControlWriteBluetooth media play/pause/skip
0006SystemLayoutWriteConfiguration shape
0007SourceWriteInput source selection
0008CoveringWriteFabric type for acoustic tuning
0009UserSettingWriteUser preferences
000aOTAWriteOver-the-air firmware update

Standard BLE services are also present: Generic Access (0x1800), Generic Attribute (0x1801), Device Information (0x180A).

Packet Formats

All writes use WriteWithoutResponse.

Format A (5 bytes)

AA <cmd_id> <sub_cmd_id> 01 <value>

Used for EQ commands (cmd=0x03), audio path (cmd=0x04), player control (cmd=0x05).

Format B (4 bytes)

AA <cmd_id> <value> 00

Used for preset (cmd=0x03), source (cmd=0x07), device info requests (cmd=0x01).

Command Encoding Table

CommandCharacteristicFormatcmd_idsub_cmd_idValueRange
VolumeEqControl (0003)A0x030x02level0-36
BassEqControl (0003)A0x030x01level0-20
TrebleEqControl (0003)A0x030x00level0-20
Center VolumeEqControl (0003)A0x030x03level0-30
Rear VolumeEqControl (0003)A0x030x0Alevel0-30
MuteEqControl (0003)A0x030x090/1bool
Quiet ModeEqControl (0003)A0x030x040/1bool
PresetEqControl (0003)B0x03—see below5-9
BalanceAudioPath (0004)A0x040x00balance0-100
PowerAudioPath (0004)A0x040x010/1bool
SourceSource (0007)B0x07—see below0-3
Play/PausePlayerControl (0005)A0x050x00value—
SkipPlayerControl (0005)A0x050x01value—
Get StateDeviceInfo (0002)B0x01—0x01—
Get VersionDeviceInfo (0002)———AA 01 01 01—

Preset / Sound Mode Values

Write and read values differ:

ModeWrite Value (to device)Read Value (from notifications)
Movies70
Music81
TV52
News63
Manual9— (write-only)

Input Source Values

Same for read and write:

SourceValue
HDMI-ARC0
Bluetooth1
AUX2
Optical3

Notification Protocol

Notifications arrive on the UpStream characteristic (0001).

Status Notifications

Format: CC 05/06 AA ... <response_code> <value>

The last 2 bytes are always the response code and value.

CodeNameValue RangeNotes
0x01Volume0-36
0x02Center Volume0-30
0x03Treble0-20
0x04Bass0-20
0x05Mute0/11=muted
0x06Quiet Mode0/11=enabled
0x07Balance0-10050=center
0x08LayoutbyteConfig shape
0x09Source0-3See source table
0x0APower0/1INVERTED: 0=ON, 1=OFF
0x0BPreset0-3See read values table
0x0CCoveringbyteFabric type ID
0x0DArm Typebyte
0x0ESubwoofer0/11=connected
0x0FRear Volume0-30

Version Notifications

Format: CC 05/06 AA 01 03 <type> <major> <minor>

TypeComponent
0x01MCU
0x02DSP
0x03EQ

Example: CC 06 AA 01 03 01 01 47 = MCU version 1.71.

Hardware Architecture

ComponentChipCommunication
BLE/Audio SoCQualcomm QCC3008UART (AT commands) to MCU
MCUARM Cortex-MI2C to DSP/amp, UART to QCC3008
DSPAnalog Devices ADAU1452 SigmaDSPI2C from MCU
AmplifierTexas Instruments TAS5825MI2C from MCU
HDMI/SPDIFSP8107I2C/SPI from MCU
WiSA TXSummit SemiconductorSWM API from MCU

Known Firmware Versions

PackageAPPMCUEQDate
V-1.62UnknownUnknownUnknownUnknown
V-1.66V-1.66V-1.66V-1.232023-05-24
V-1.71V-1.68V-3.71V-1.232024

BT chipset firmware: QCC3008 v3.0 (2023-09-18).

References