Apple NI Configuration Data Frame

Wireless Connectivity Ultra-Wideband
, ,
32

Here is what i found out thru reverse engineering:

This is what we send to the iPhone at first, the last two bytes are the UWB MAC address we use, the rest is always the same:

// AccessoryConfigurationData uwbConfigData
// END: 0xAA, 0xAA = NIDiscoveryToken = MAC generated by device
static uint8_t ac_config[]
	= {0x01, 0x00, 0x00, 0x00, 0x3f, 0xf5, 0x03, 0x00, 0xb8, 0x0b,
	   0x00, 0x00, 0x01, 0x09, 0x09, 0x00, 0x00, 0xAA, 0xAA};

Then we receive from the iPhone:

struct as_conf_data {
	uint8_t _unk[2]; // UNKNOWN 0x45 0x55
	uint32_t session_id;
	uint8_t preamble_code;
	uint8_t channel;
	uint16_t num_slots; // ?
	uint16_t slot_duration_rstu;
	uint16_t block_duration_ms;
	uint8_t report; // ? 3 = TOF Report
	uint8_t sts_iv[6];
	uint16_t dst_addr;
} __attribute__((packed));

This is later used for configuring the FIRA session parameters