From Silence to Sound: Enabling Calling on the Rabbit R1

When Rabbit Inc. launched the Rabbit R1, I was instantly intrigued. As someone passionate about open-source development and tinkering with unique hardware, I saw an opportunity to explore what this device was truly capable of. I reached out to Rabbit, expressing my interest in developing for the R1. They welcomed my enthusiasm, and before long, I had the device in hand.

One of the first things I requested was for Rabbit to publish the kernel sources. To my delight, they not only agreed but also entrusted me with the responsibility of uploading and maintaining their open-source repository on GitHub. It was an honor to be chosen for this task, and I took it upon myself to ensure that the kernel sources were properly managed and made available to the developer community.

Understanding the Rabbit R1

At its core, the Rabbit R1 is an Android device powered by the MediaTek Helio G36 processor. It comes equipped with 4GB of RAM and 128GB of internal storage. However, what makes this device truly unique is its unconventional design choices.

• It lacks a traditional volume button, replacing it with a scrolling wheel.

• There is no power button; instead, Rabbit has integrated a circular "PTT Button," which functions as a push-to-talk button.

• The camera is a rotating unit, serving both as the front and rear camera, powered by a step motor.

Despite these quirks, the fact remains that this is, at its foundation, an Android device. With that in mind, I repurposed the scrolling wheel as a volume control and the push-to-talk button as a power button, bringing back some of the expected Android functionality.

The Challenge of Enabling Calling

One major drawback of the Rabbit R1 is that it does not support 2G or 3G networks. These bands are not software-locked; they are completely absent from the hardware itself. The device only supports select 4G frequencies, and to make matters worse, RabbitOS had completely disabled IMS (IP Multimedia Subsystem) in the codebase.

For those unfamiliar, IMS is essential for routing calls over 4G networks. Since 2G and 3G are absent, calling must be handled over 4G, which requires VoLTE or VoWiFi—both of which rely on IMS. With IMS completely disabled, the Rabbit R1 was essentially incapable of making phone calls.

This was an exciting challenge, and given my extensive experience with MediaTek devices, I was determined to find a solution.

Reverse Engineering the Modem

Since the R1’s software stack was primarily based on a stock MediaTek ALPS (MediaTek BSP Software), I decided to compare it with firmware from another MT6765 device. I dumped the firmware from both devices and loaded the modem image into Ghidra, a powerful reverse engineering tool. By comparing the two images, I identified what was missing in the Rabbit R1’s modem configuration.

My first attempt was to hex-patch the modem to re-enable IMS. Unfortunately, this failed because the device’s newer firmware versions had Secure Boot Control (SBC) enabled, preventing the loading of unsigned images. While I could have downgraded to an older firmware version to bypass this restriction, I had to consider the possibility of users unknowingly flashing my modifications on newer versions, potentially bricking their devices. This was not an acceptable risk.

Asking Rabbit for a helping hand

Recognizing the need for an official solution, I closely collaborated with Rabbit’s team. They understood the importance of this feature, and after some discussions, they agreed to sign the modified modem image, allowing it to be safely flashed without security issues. However, this was only one piece of the puzzle.

Restoring IMS Functionality

In addition to modem changes, the IMS vendor components had been entirely removed from the vendor & system. Fortunately, I was able to extract IMS blobs from another MediaTek device and integrate them into my build. This brought back the IMS functionality, but the service still wouldn’t start.

At this point, the VoLTE toggle was visible in the system settings, yet making calls remained impossible. After some troubleshooting, I realized that the IMS service I had ported was buggy. Thanks to the contributions of the MediaTek open-source community, I found a suitable patch that fixed the issue.

Even then, calls were still not working. To resolve this, I:

• Force-enabled IMS support in framework overlays.

• Explicitly declared IMS availability in CarrierConfig.

• Forced IMS-related system properties at boot.

The Breakthrough

After implementing these changes, I tested VoLTE calling, and to my excitement, it worked! For the first time ever, calling was successfully enabled on the Rabbit R1 hardware. This was a significant milestone, proving that, despite its limitations, the R1 was capable of handling voice calls over LTE.

What’s Next?

While VoLTE is now fully functional and stable, VoWiFi and ViLTE (video calling over LTE) remain unreliable. These features require further testing and refinement. However, the major hurdle—getting calls to work at all—has been overcome.

If you own a Rabbit R1 and want to try calling, I encourage you to check out CipherOS for the R1. With this firmware, you’ll be able to make and receive calls using VoLTE, transforming the R1 into a more practical and usable device.

Final Thoughts

This project was an incredible experience, blending my passion for reverse engineering, Android development, and open-source collaboration. I’m grateful to Rabbit for their help & support, and to the MediaTek open-source community for their valuable contributions.

Stay tuned for more updates as we continue exploring new possibilities, Also Looking ahead, I'm intrigued by the Humane AI Pin—a wearable device that aimed to revolutionize personal technology. Despite its ambitious goals, the AI Pin faced challenges, leading to its discontinuation less than a year after its launch. This development presents a unique opportunity to explore and potentially repurpose its hardware, especially considering its foundation on a Snapdragon 720G chipset and it’s just another android device in weird form factor :D.

However, this isn't the end of the story for the Rabbit R1 either. Stay tuned for more updates, as there's much more to come in unlocking the full potential of these devices. The journey of innovation and exploration continues!…

Best,
Aryan