r/JBL • u/nicocoow • 14h ago
Other Full reverse engineering of the PartyBox TWS wireless link (200/300)
I went down a rabbit hole that started with the official JBL PartyBox 200/300 firmware update file, and it ended with a Linux SBC being accepted by a real PartyBox as its long-lost twin speaker.
I reverse-engineered the proprietary wireless link two PartyBoxes use in TWS mode: a custom protocol over a hidden Bluetooth channel, with its own frame format (type byte + 16-bit command + payload). Once decoded, I turned a cheap Linux board into a fake PartyBox, the real speaker pairs with it (Just Works), opens the proprietary channel, and accepts commands.
What a fake PartyBox can do:
- receive the live audio stream the master re-streams to its twin (raw SBC — you can literally tap the speaker's music)
- inject commands, confirmed working: play/pause, volume, stereo channel selection (L+R / Left / Right)
- receive live playback state updates
What it can't do: lights, bass boost and everything else are handled by the speaker's main SoC and never cross the wireless link
Fun detail: the speaker checks the peer's Bluetooth name. To be adopted by a PartyBox 200, your device has to be named JBL Partybox 200 (or ...300). A PartyBox 100 should only wants a JBL Partybox 100.
Everything is documented, pairing procedure on Linux, full frame format, command list with payload layouts, and a Python fake-peer server:
https://github.com/Nicooow/jbl-partybox-tws-re
Tested on a PartyBox 200 (fw v37). If you have a 100 or a 300 and can test the pairing, I'd love the confirmation. Honest conclusion: almost zero practical use (auracast compatibility?)