Bose NCH700 Protocol Research

Reverse engineering the Bluetooth protocol for Bose Noise Cancelling Headphones 700 (codename Goodyear)

What is this?

This site documents an ongoing effort to reverse engineer the Bluetooth control protocol used by the Bose Noise Cancelling Headphones 700 (NCH700). The goal is to enable open-source programmatic control of headphone features — noise cancellation levels, EQ, device naming, and more — without the Bose Music app.

The NCH700 uses a dual-protocol architecture over Bluetooth SPP (Serial Port Profile): a QC35-compatible legacy layer for basic queries, and a newer ff55-framed protocol for NCH700-specific features like 11-level noise cancellation.

Dual Protocol

Two distinct protocol variants discovered: QC35-compatible commands on channels 8/9, and NCH700-specific ff55 framing on channel 14.

9 RFCOMM Channels

The headphones expose channels 8, 9, 14, 20, 21, 25, 27, 29, and 30 — far more than the QC35’s single channel.

Working Commands

Device name read/write, firmware version query, NC level query, and product ID retrieval are confirmed working.

Open Questions

NC level set command for 11-level control, EQ adjustment, and the deca-fade vendor UUID remain undocumented.

Current Status

The project is in Phase 2: Protocol Documentation. Basic traffic capture and channel mapping are complete. The focus now is on documenting the full command set and finding the NCH700-specific control commands that go beyond QC35 compatibility.

Confirmed Working

Device name query and rename via QC35 protocol (channel 8)
Firmware version query (2.0.4-13730+d2cb81b)
Product ID query (0x4024)
NC level query (read current level)
Channel 14 ff55 initial handshake capture

Not Yet Solved

NC level set command (11 levels, 0–10)
EQ adjustment (bass/mids/treble)
Conversation mode toggle
Multi-point connection control
Full ff55 protocol command set