I2S

I2S#

Inter-IC Sound. A three-wire synchronous bus that carries digital audio between a codec (ADC or DAC) and a processor; nothing else. Bit clock, word-select clock, and serial data; an optional master clock for ICs that need an oversampling reference. Not a hacker’s attack surface by itself, but the wire between every embedded microphone and its CPU; the operator who can tap I2S pulls audio off a target in raw PCM before any application-layer encoding.

Wires#

Signal

Direction

Purpose

SCK (BCLK, BCK)

Master out

Serial bit clock; equals sample rate × channels × bits per sample.

WS (LRCLK, FS)

Master out

Word select; left channel when low, right channel when high. Frequency equals the sample rate.

SD (SDATA, DIN, DOUT)

Transmitter out

Serial audio data; one line per direction.

MCLK (optional)

Master out

Master clock; typically 256× or 384× the sample rate.

GND

Reference

Ground.

Wire format#

The transmitter shifts samples MSB-first on the falling edge of SCK. The receiver samples on the rising edge.

  • On WS falling edge, the next SCK cycle starts the left channel sample.

  • On WS rising edge, the right channel sample starts.

  • The MSB of each sample is delayed by one SCK cycle after the WS transition (this one-cycle offset is what distinguishes I2S from “left-justified” and “right-justified” variants).

Common sample rates: 8, 16, 22.05, 32, 44.1, 48, 96, 192 kHz. Common sample widths: 16, 24, 32 bits.

        sequenceDiagram
    participant M as Master
    participant TX as Transmitter
    participant RX as Receiver
    M->>TX: SCK + WS
    M->>RX: SCK + WS
    TX->>RX: SD (Left sample, MSB first)
    Note over M,RX: WS toggles, next sample on the other channel
    TX->>RX: SD (Right sample, MSB first)

Pads#

I2S signals usually live on the codec’s own pins; finding them on a board means tracing from a known audio chip (WM8960, ES8311, MAX9814-style mic preamps, SGTL5000, TLV320AIC3204). Some boards expose I2S on a header for an external microphone (MEMS digital mics like the ICS-43434 or SPH0645 are I2S-native).

Tools#

Tool

Effect

Logic analyzer with I2S decoder (Saleae, PulseView)

Decode the stream; export to .wav for listening.

sigrok-cli with i2s decoder

Same, scriptable from the command line.

alsa-utils (arecord, aplay)

Drive an I2S codec exposed by a Linux ALSA driver.

ESP32 I2S peripheral

Sniff or generate I2S in firmware; useful as a cheap I2S-to-Wi-Fi exfil bridge in a lab setup.

References#

Contents