...at least, for the one Bose device I own. Other Bose Bluetooth devices use the same image format and can be updated by the same official update tool (which doesn't run on Linux or support downgrades, hence this one), so I'm hopeful they use the same protocol as well.

This was a fun reverse engineering project, and I also used it as an opportunity to learn Rust better. The protocol is quite close to USB DFU[1], but it's been altered to run on top of HID reports instead of raw USB transactions, presumably because every major OS lets you talk to HID devices without having to publish and sign your own driver.

Interestingly, Bose seems to have also forked dfu-util[2], which is GPL-licensed, altered it to speak this protocol, and shipped the binary with an official update tool for a different product with no accompanying source to be found. More details on that at the end of the README.

[1] https://www.usb.org/sites/default/files/DFU_1.1.pdf [2] http://dfu-util.sourceforge.net/