Decode MPEG 2,4 AAC-LC LATM bitstream for a2dp - bluetooth

Question

I am trying to decode bitstream that I received from Apple IPhone for bluetooth A2DP profile.
According to Apple the structure should be
The sample bitstream I have is
36 00 47 00 | 80 60 00 01 00 06 3c ab 00 00 00 00 |
47 fc 00 00 b0 90 80 03 00 20 20 66 00 01 98 00 0d e1 20 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c
First four bytes are L2CAP, next 12 are AVDTP. But I am not able to decode rest of the bytes. Kindly help.
I have seen ISO 14496-3 that define AudioMuxElement but still I am not able to relate it to the bytes.

Answer 1

Recently, I've got very same problem. Since decoding bit-stream on a piece of paper is not very handy, I've created a simple decoder (for debugging purposes) based on ISO/IEC 14496-3 reference implementation.
Properly decoded stream from the question:
useSameStreamMux:1 = 0 => 0
audioMuxVersion:1 = 1 => 1
audioMuxVersionA:1 = 0 => 0
bytesForValue:2 = 00 => 0
valueTmp:8 = 11111111 => 255 (taraBufferFullness)
allStreamsSameTimeFraming:1 = 1 => 1
numSubFrames:6 = 000000 => 0
numProgram:4 = 0000 => 0
numLayer:3 = 000 => 0
bytesForValue:2 = 00 => 0
valueTmp:8 = 00010110 => 22 (ascLen)
audioObjectType:5 = 00010 => 2
samplingFrequencyIndex:4 = 0100 => 4
channelConfiguration:4 = 0010 => 2
frameLengthFlag:1 = 0 => 0
dependsOnCoreCoder:1 = 0 => 0
extensionFlag:1 = 0 => 0
fillBits:6 = 000000 => 0
frameLengthType:3 = 000 => 0
latmBufferFullness:8 = 11000000 => 192
otherDataPresent:1 = 0 => 0
crcCheckPresent:1 = 0 => 0
tmp:8 = 00100000 => 32 (MuxSlotLengthBytes)
payload:8 = 00100000 => 32
...
payload:8 = 00011100 => 28
byteAlign:0 = 0 => 0

Answer 2

"ISO/IEC 14496-3, Subpart 1: Main, Section 1.6: Interface to 14496-1" is the right place to look.
First look into AudioSyncStream():
AudioSyncStream()
{
while(nextbits()==0x2B7) // 11-bits
{
audioMuxLengthBytes; // 13-bit
AudioMuxElement(1); // proceed to decode AudioMuxElement
}
}
LATM should start withg 11-bit long syncword: syncword==(2B7)hex==(1010110111)bin. This does not seem to be the case with your stream: (47FC)hex==(0100011111111100)bin, first 11 bits being (01000111111)bin.

Answer 3

I was able to decode the header as follows:
Use same stream config = 0 (1 bit)
StreamMuxConfig():
AudioMuxVersion = 1 (1 bit)
AudioMuxVersionA = 0 (1 bit)
LATM value Temp Bytes = 00 (2 bit)
Fullness value = 1111 1111 ( 8 Bit)
AllStreamsUseSameTimeFrame = 1 (1 bit)
numSubFrames = 000000 (6 bits)
num program = 0000 (4 bits)
num layer = 000 ( 3 bits)
use same config = 0 (1 bit)
Fill + other bits = 0000 1010 0 (9 bits)
AudioSpecificConfig():
Object Type (aac) = 00010 ( 5 bits)
Sample Type = 0100 ( 4 bits)
Channel = 0010 ( 4 bits)
GAS specific config = 000 (3 bits)
Looks like I was having an older version of spec. The correct version of Spec to look for is ISO/IEC 14496-3:2005. Also there are typo errors in Apple's Bluetooth design guidelines doc (it refers to non-existent doc 13818-3:2005 !).