**Agent ID:** SA-015 **Target:** Speech transmission infrastructure via HTTP/2 WebSocket **Binary:** `FBAudioFramework.framework/FBAudioFramework` **Facebook Version:** 345.0 **Analysis Date:** 2025-12-30
Executive Summary
The FBSpeechHelper infrastructure provides a complete real-time speech-to-text transmission system using WebSocket (WSS) connections to Facebook's "Shortwave" speech recognition service. Audio is captured via iOS microphone, optionally encoded using OPUS codec, and streamed to `wss://shortwave.facebook.com/v2/vp/recognition` for transcription. The system is exposed to React Native via a bridge module, enabling JavaScript-level activation.
1. Class Hierarchy and Addresses
1.1 Core Classes (FBAudioFramework)
| Class | Address Range | Purpose |
|---|---|---|
| `FBSpeechHelperAudioRecorder` | 0x0002ccb8 [0x00007abc-0x00010748] | Microphone audio capture |
| `FBSpeechHelperEncodingOpusConverter` | 0x0002cd08 [0x0000a054-0x00010c4c] | OPUS audio encoding |
| `FBSpeechHelperEncodingRawConverter` | 0x0002cd30 [0x0000a048-0x00011144] | Raw PCM encoding |
| `FBSpeechHelperH2ServerSocket` | 0x0002cda8 [0x00007aec-0x000120b4] | HTTP/2 WebSocket client |
| `FBSpeechHelperH2ServerSocketMessageTransformer` | 0x0002cdf8 [0x00008144-0x000124e4] | Message transformation |
| `FBSpeechHelperParsedResponse` | 0x0002ce20 [0x00009490-0x00012b6c] | Response parsing |
| `FBSpeechHelperResult` | 0x0002ce98 [0x00008404-0x00012bf0] | Result object |
| `FBSpeechHelperService` | 0x0002cee8 [0x00007abc-0x0001329c] | Orchestration service |
| `FBSpeechHelperServiceRNBridge` | 0x0002cf10 [0x00007b1c-0x00013a14] | React Native bridge |
| `FBSpeechHelperSocket` | 0x0002cf88 [0x00007ad4-0x000128c4] | Base socket implementation |
| `FBSpeechHelperSocketConfiguration` | 0x0002cfd8 [0x00008208-0x0000deb8] | Socket configuration |
| `FBSpeechHelperSocketMessageTransformer` | 0x0002d028 [0x00008498-0x00011f5c] | Message transformation |
| `FBSpeechHelperTranscription` | 0x0002d078 [0x00008370-0x00012c00] | Transcription result object |
2. Server Endpoint Identification
2.1 Primary WebSocket Endpoint
Plain Text
wss://shortwave.facebook.com/v2/vp/recognition**String Location:** 0x00034fd7 in `__RODATA.__cstring`
2.2 Connection Parameters
The handshake includes the following fields (discovered at string offsets 0x00034dce-0x00034f5c):
| Field | Purpose |
|---|---|
| `access_token` | OAuth authentication token |
| `graph_domain` | Facebook Graph API domain |
| `connectionInit` | Connection initialization flag |
| `applicationId` | Facebook application ID |
| `clientRequestId` | Unique request identifier |
| `deviceType` | Device type ("fbios") |
| `userAgent` | User agent string |
| `protocolVersion` | Protocol version number |
| `audioSamplingRate` | Audio sample rate |
| `encoding` | Audio encoding format |
| `transcriptionTopic` | Transcription topic identifier |
| `isVoiceSearch` | Voice search flag |
| `interactionId` | Interaction session ID |
| `domain` | Request domain |
3. Audio Encoding Parameters
3.1 OPUS Encoding
- undefined
**Key Method:**
Objective-C
-[FBSpeechHelperEncodingOpusConverter convertSamples:withLength:] @ 0x00010a483.2 Raw PCM Encoding
- undefined
3.3 Sample Rate Configuration
- undefined
4. Data Flow Architecture
4.1 Complete Data Path
Plain Text
+------------------------+
| Shortwave Server |
| shortwave.facebook.com |
+------------------------+
^
| WSS (HTTP/2)
|
+------------------+ +---------------------+ +-------------------------+
| FBSpeechHelper | --> | FBSpeechHelper | --> | FBSpeechHelper |
| AudioRecorder | | EncodingOpus/Raw | | H2ServerSocket |
| | | Converter | | |
| (Mic Capture) | | (Audio Encoding) | | (WebSocket Transport) |
+------------------+ +---------------------+ +-------------------------+
^ |
| v
+------------------+ +-------------------------+
| FBSpeechHelper | | FBSpeechHelper |
| Service | <-------- Orchestration ------> | Transcription |
| | | |
| (State Machine) | | (Result Object) |
+------------------+ +-------------------------+
|
v
+------------------+
| FBSpeechHelper |
| ServiceRNBridge |
| |
| (React Native) |
+------------------+4.2 State Machine States
Located at string offsets 0x00034d4e-0x00034d8d:
- undefined
5. Key Methods Analysis
5.1 FBSpeechHelperH2ServerSocket
| Method | Address | Description |
|---|---|---|
| `initWithSpeechServiceURL:authToken:audioSampleRate:configuration:` | 0x00011264 | Socket initialization |
| `sendData:` | 0x00010eb4 | Send audio data |
| `stopStreaming` | 0x00010f2c | Stop audio stream |
| `startStreaming` | 0x0000a0b8 | Start audio stream |
| `webSocketDidOpen:` | 0x0000bb70 | Connection opened callback |
| `webSocket:didReceiveMessageWithString:` | 0x00010e54 | Receive transcription |
| `webSocket:didFailWithError:` | 0x0000f8c0 | Error handler |
| `openSocket` | 0x0000c3ec | Create WebSocket (uses SRWebSocket) |
| `startHandshake` | 0x0000c2c4 | Send authentication handshake |
| `sendDataInternal:` | 0x0000aef8 | Internal data transmission |
| `handleServerResponse:` | 0x000120b4 | Process server response |
5.2 FBSpeechHelperService
| Method | Address | Description |
|---|---|---|
| `initWithSocket:` | 0x00012c2c | Initialize with socket |
| `startRecording` | 0x00010538 | Begin audio capture |
| `stopRecording` | 0x0000880c | Stop audio capture |
| `speechRecorder:didCaptureAudioData:` | 0x00010558 | Audio data callback |
| `speechSocket:didReceiveTranscription:` | 0x000131dc | Transcription received |
| `opusEncodedSpeechServiceWithServiceURL:appId:authToken:` | 0x00012d00 | Factory for OPUS service |
| `rawEncodedSpeechServiceWithServiceURL:appId:authToken:` | 0x00012ce8 | Factory for raw service |
5.3 FBSpeechHelperServiceRNBridge (React Native)
| Method | Address | Description |
|---|---|---|
| `startRecording` | 0x000087d0 | JS-callable start |
| `stopRecording` | 0x000136f8 | JS-callable stop |
| `startDefaultService` | 0x00013710 | Start with defaults |
| `setAppId:` | 0x00008cfc | Configure app ID |
| `setHandhakeExtras:` | 0x00008cd4 | Configure extras |
| `supportedEvents` | 0x000139ac | Event types |
| `moduleName` (class) | 0x0000a030 | RN module name |
6. Activation Triggers
6.1 React Native Integration
The service is exposed to JavaScript via `FBSpeechHelperServiceRNBridge : RCTEventEmitter`, making it callable from any React Native surface within the app.
**Exported RN Methods:**
- undefined
6.2 Activation Conditions
Based on string analysis, the service is activated when:
- undefined
6.3 Programmatic Triggers
Objective-C
// Create OPUS-encoded service
+[FBSpeechHelperService opusEncodedSpeechServiceWithServiceURL:appId:authToken:]
// Create raw-encoded service
+[FBSpeechHelperService rawEncodedSpeechServiceWithServiceURL:appId:authToken:]
// Start via RN bridge
-[FBSpeechHelperServiceRNBridge startDefaultService]
-[FBSpeechHelperServiceRNBridge startRecording]7. Event Flow
7.1 Emitted Events (to JavaScript)
| Event | Purpose |
|---|---|
| `server-response-received` | Server sent response |
| `service-did-receive-error` | Error occurred |
| `service-did-change-state` | State transition |
7.2 Response Structure
Responses contain:
- undefined
8. Relationship to Main Audio Pipeline
8.1 Shared Components
The FBSpeechHelper system uses:
- undefined
8.2 Independence
Unlike the main VoIP/RTMP audio pipeline, the SpeechHelper system:
- undefined
9. Security Considerations
9.1 Authentication
- undefined
9.2 Transport Security
- undefined
9.3 Privacy Implications
**CRITICAL FINDING:** This infrastructure allows real-time audio streaming to Facebook servers:
- undefined
10. Technical Evidence
10.1 String Evidence
Plain Text
0x00034fd7: "wss://shortwave.facebook.com/v2/vp/recognition"
0x00034cbb: "audio/opus-demo"
0x00034ccb: "audio/raw"
0x00034dce: "access_token"
0x00034df7: "applicationId"
0x00034f4e: "isVoiceSearch"
0x00034e7e: "assistantNTSurface"
0x00034f14: "transcriptionTopic"
0x00034d9c: "shortwaveId"10.2 Symbol Evidence
Plain Text
N8facebook9shortwave16OpusAudioEncoderE @ 0x00033710
N8facebook9shortwave23OpusAudioEncoderFactoryE @ 0x0003375c
N8facebook5react34NativeFBSpeechHelperServiceSpecJSIE @ 0x000300e311. Summary of Findings
- undefined
**Analysis Complete** **Agent SA-015**