QC35 Command Reference

The NCH700 supports a subset of the QC35 command protocol documented by the based-connect project. These commands work on both channels 8 and 9.

Message format

[fn1] [fn2] [sub] [len] [data...]

fn1 and fn2 identify the function group
sub is the subcommand: 01 = GET, 02 = SET, 03 = response (typical pattern)
len is the byte count of the data payload
No checksum — the message ends immediately after the data bytes

This differs from some other Bluetooth headphone protocols that append CRC or XOR check bytes.

Confirmed commands

Command	Hex	Description	Response Format
Get protocol version	`00 01 01 00`	Protocol version string	`00 01 03 05 31 2e 31 2e 30` (“1.1.0”)
Get product ID	`00 03 01 00`	Product identification	Contains `40 24` (0x4024)
Get firmware version	`00 05 01 00`	Firmware version string	ASCII: `2.0.4-13730+d2cb81b`
Get device name	`01 02 01 00`	Current device name	`01 02 03 <len> 00 <ascii name>`
Set device name	`01 02 02 <len> <ascii name>`	Change device name	Echo with new name
Get NC level	`01 06 01 00`	Current noise cancellation level	`01 06 04 01 <level>`
Set NC level	`01 06 02 01 <level>`	Attempt to set NC level	Returns same as GET (see note)
Get NC config	`01 07 01 00`	NC preset/configuration data	`f6 0a` pattern groups
Get VA mode	`01 0a 01 00`	Voice assistant mode	`01 0a 03 01 <mode>`

Command details

Device name (read/write)

Reading the device name returns the current Bluetooth name visible to paired devices. The response includes a leading 00 byte before the ASCII name string:

Send:  01 02 01 00
Recv:  01 02 03 07 00 42 6f 6d 62 61 79    ("Bombay")

The set command is confirmed working. The new name persists across power cycles and is reflected in Bluetooth discovery:

Send:  01 02 02 07 42 6f 6d 62 61 79       ("Bombay")
Recv:  01 02 03 07 00 42 6f 6d 62 61 79    (echo with new name)

Noise cancellation level (read)

Send:  01 06 01 00
Recv:  01 06 04 01 0a                       (level = 10, maximum)

The level byte represents the NCH700’s 11-level scale (0-10), where 10 is maximum noise cancellation and 0 is full transparency.

Noise cancellation level (set — unconfirmed)

Send:  01 06 02 01 05                       (attempt to set level 5)
Recv:  01 06 04 01 0a                       (returns current level, unchanged)

The set command 01 06 02 01 <level> can be sent on channel 8, but the NC level does not appear to change. The response mirrors the GET response with the pre-existing level value. This may indicate that:

NC level changes require the ff55 protocol on channel 14
An additional authorization or session state is needed
The QC35-compatible layer provides read-only access on the NCH700

Firmware version

Send:  00 05 01 00
Recv:  00 05 03 <len> 32 2e 30 2e 34 2d 31 33 37 33 30 ...
       ASCII: "2.0.4-13730+d2cb81b"

The version string includes a build number and git short hash, consistent with Bose firmware versioning seen in the bosefirmware/ced archive under the goodyear/ directory.

NC configuration

Send:  01 07 01 00
Recv:  (variable length, contains f6 0a pattern groups)

The NC config response contains structured data with repeating f6 0a markers. The full structure is not yet decoded but likely maps to the preset noise cancellation profiles configurable in the Bose Music app.

Subcommand conventions

Based on observed responses, the subcommand byte follows a consistent pattern:

Sub	Meaning	Direction
`01`	GET / query	Host to device
`02`	SET / write	Host to device
`03`	Response / ACK	Device to host
`04`	Extended response	Device to host (seen in NC level)

The 04 subcommand in the NC level response (01 06 04 01 <level>) deviates from the expected 03. This may indicate a different response type for status values vs. string data.