Kekz Headphones
Close to a year ago, I stumbled upon the Kekz Headphones, which seemed like an interesting approach on the whole digital audio device space. They claimed to work without any internet connection and all of the content already on the headphones itself. I was intrigued, because there were some speculations going around, how they operate with those “Kekz”-Chips.
I invite you to join me on a journey into the inner workings of those headphones. We will talk about accessing the encrypted files on the device, breaking the crypto and discovering disclosure of data from customers.
I sourced my headphones from “Kleinanzeigen” (something like craigslist, or facebook marketplace) to keep the research costs low and maybe get some cookies with it. I got the wonderful colour red. After opening up the headphones, you will have 2 PCBs which are connected by 7 wires. Two speakers and a battery. The chinese lettering in the silk layer is just the colour description of the wires itself. You don’t see any interesting breakout for anything here. The Pin-Row in the middle is for the NFC antenna on the other side of the board. You see two Vias with the label DP and DM, which is on the USB line. This will be interesting at a later stage.
The first thing that stands out is a Jieli Chip, which appears to be the core component of the entire headset. These chips are mostly used in cheap Bluetooth hardware and are difficult to determine which version is currently running. From a quick search i think this Chip (AC21BP0H733-51C8) is probably some version of the AC6951C.
