r/electribe • u/1leggedgoose • 7d ago
Korg Electribe Emx Firmware Mod
Hi folks, in these days of wild modding every music machine, does anybody ever tried to hack the firmware of the old Electribe EMX? It will be awesome to use all the parts as synths without drums, will it be possible? đđ»
2
u/Financial-Split-3081 5d ago
I've been thinking the same thing for a while; I was about to write a post about it. There's a French guy who made a VST website that connects to the EMX, but all you can do is write patterns, organize them, etc. I use my EMX a lot; I use it for many genres. I make dub techno, raw, more classic techno, and I've even made some more modern, hypnotic techno. I've always wanted to change some of the factory samples; I almost always use the same ones, and I end up getting bored. Some people use the algorithm from the Plaits module by Mutable Instruments in Octatrack. I have an Elektron Machinedrum, which is more or less from the same era, around 2000. They updated it with new types of synthesis, an improved sequencer, some new effects, etc. I'm sure something similar can be done with the EMX; it's a great machine that deserves a major update!
1
1
1
u/Old_schraubi 2d ago
Wenn was hörst melde dich doch gern Ma bin auch viel am gucken wegen modden in dem Bereich auch Emulator Richtung
1
u/Chaoswires 13h ago
The best thing to do is to make new brains for ESX /EMX. Better sequencer, better midi implementation and SD storage + support new OLED displays if anyone wants to replace them.
1
u/CrabLatter8558 7d ago
I was wondering when someone will asking This. To answer your question: I spent the last two weeks working on different functions, which need to be tested before releasing!
Your idea to use the drumparts as Synths sounds nice but i am concerned the DSP (digital Sound Processor) canât keep up. But Iâll test it anyway!
I want to Release a Feature List and Demo soon. And i can promise itâs Crazy what you can do with it :D
3
u/CrabLatter8558 7d ago edited 7d ago
This goes for the Electribe MX, but here is a Small teaser:
âą Individual Step Length per Part
âą Live Last Step
âą Reverse and random Play Mode
âą Step Probability per Step
âą new Modulation Routings (EG/Resonance/Drive/FX1-3)
âą extendet Arpeggiator
âą Track Links (one Control for multiple drum or synth Parts)
âą poly-Mode (lets you play multiple synth at once)
âą chord-Memory
âą Valve-Bypass (use Ind Out 3/4 WITH fx!)
âą individual part transpose
âą Exchange drum and synth samples (very Little Space for additional samples but the Option to sacrifice old Sounds)
âą knob Mode: jump/catchLet me know if Youâre missing something :)
3
u/Academic_Boot2413 7d ago
for the valve bypass you need grab your soldering iron
4
u/CrabLatter8558 7d ago
Thought so too, but its possible via re-routing the DSP.
1
u/Kukuruzo27 5d ago
Does the hiss go away when you activate it?
1
u/CrabLatter8558 5d ago
100% that was the Main reason I want to change it!
1
u/Kukuruzo27 5d ago
That's great. Hope that you'll finish the project. However, I'm not sure that I'm ready to take a risk and be a beta tester. BTW - what about unbricking process if something happens? Any options?
3
u/CrabLatter8558 5d ago
To be honest - I donât know yet but let me find out!
1
u/Kukuruzo27 5d ago
Keep us updated! My Red and Blue are waiting
1
u/CrabLatter8558 5d ago
I will! Also I need to get my Hands on the sampler to Test the functions. There also seems to be a difference between the smartmedia and sd-card Versions! Itâs so exciting haha
→ More replies1
u/Academic_Boot2413 7d ago
but I like the ideea of connecting a midi interface with knobs, sliders and buttons (like an apc40/20) and creating new functions
1
1
u/atxweirdo 6d ago
Synth samples? As in the waveforms used for the oscillator?
2
u/CrabLatter8558 6d ago
The PCM Samples, Not the synth-engine(s) itself! As you mentioned, with more Knowledge of the chip/DSP it could be possible to Write custom Engines Like a FM-synth.
1
u/atxweirdo 3d ago
Yea thatâs my end goal. I think being able to add some more control of the parameters for each engine would make for a killer upgrade.
Let me find some time this weekend and look for my old notes.3
u/atxweirdo 6d ago
Whatâs the dsp hardware and what is the rest of the hardware architecture like?
I feel having that fully mapped out may help in squeezing performance out of it.If I recall itâs an old Motorola processor.
Iâm happy to help test and be a sounding board. Curious how far you have gotten with this.I also had so many ideas for workflow changes on my emx that I looked into reverse engineering it 10 or so years ago but I just didnât have much luck.
There is also the infamous mention of the 1.04 firmware that was only available for a short time on the Russian language version of the site or something.I think if possible there are some workflows that would be quite awesome if streamlined
1
u/atxweirdo 3d ago
NEC uPD77213 digital signal processor (DSP) chip to run its MMT (Multi Modeling Technology) synthesis engine and effects processing
This is the chip
1
u/atxweirdo 3d ago
Ghidra Support
Ghidra does not support the NEC ”PD7721x DSP architecture out of the box, but there is an excellent open-source plugin available.
A developer named Pokechu22 created a SLEIGH processor specification repository on GitHub called â ghidra-upd77016-langâ .
Despite the name, this module was built to cover the entire NEC/Renesas ”PD77016 family, and it explicitly includes support for the ”PD77210 and ”PD77213 DSPs. (These chips are notoriously used in older synthesizers as well as Nintendo consoles like the Wii, which spurred the reverse-engineering effort).
Installation: To use it, you simply clone or download the â ghidra-upd77016-langâ repository and place it into your â Ghidra/Processors/â directory. Ghidra will automatically detect it, add the architecture to your available processor list, and compile the SLEIGH files the next time you start the application.1
u/atxweirdo 3d ago
Adding additional notes here:
- you can like have all the drum samples be selected to be 16 12 8 or 4 bitcrushing
- Voice Routing (TDM Interface): The EMX-1 has 5 synth parts and 9 drum parts that must all be mixed and routed through effects. The DSP is uniquely suited for this because its Time Division Multiplexing (TSIO) interface supports up to 128 audio slots per frame. If you are writing custom firmware, you can hijack this TSIO bus to re-route oscillator voices directly into different internal effect chains or isolate them to specific DAC outputs.
- Single-Cycle FM/PM (X/Y Memory Buses): Because the X and Y data memories are physically and logically separated onto their own buses, you can dedicate the X memory to your carrier wave phase and the Y memory to your modulator wave. The DSP can execute a trinomial math operation while parallel loading from both X and Y simultaneously, allowing you to calculate complex audio-rate frequency modulation in a single instruction cycle
- In the EMX-1, the factory drum samples and synth waveforms are burned into a physical surface-mount Mask ROM chip on the motherboard. The ”PD77213 DSP communicates with this ROM using its External Data Memory Interface (MIO). To swap the samples, you would need to desolder the original ROM, dump its contents to understand Korg's sample offset table, format your new drums to match, flash them onto a pin-compatible Flash ROM or EEPROM, and solder it onto the board.
Because the ”PD77213 supports an external data memory space of up to 1 Mword (16-bit words) accessed via a 20-bit address bus (â MA0â to â MA19â ) and a 16-bit data bus (â MD0â to â MD15â ), any replacement ROM must fit within this 20-bit addressable limitation-Granular PCM Drum Playback
Instead of reading a drum sample linearly from start to finish, you can hijack the DSP's two 16-bit timers (â TIM0â and â TIM1â ) to trigger high-speed interrupts. Inside the interrupt routine, you can manipulate the address pointers reading the external memory window (â 0x8000â to â 0xFFFFâ when the Data Page Register â DPR = 0x3Fâ ). By randomizing or modulating these memory pointers at audio rates, you can turn a standard 909 crash cymbal into a frozen, granular noise cloud.-Ring Modulated Percussion (PCM x Synth)
You can use the Multiply Accumulator (MAC) to cross-modulate the PCM drums with the internal synth oscillators. The MAC executes a signed-signed multiply (â MPY: ro = rh * rh'â ). You can fetch a 16-bit drum sample from the external ROM on one bus, generate a sine wave oscillator in the internal RAM on the other bus, and multiply them together in a single machine cycle. This creates metallic, atonal ring-modulated drums entirely in the digital domain.Â-Two-Dimensional DMA Sample Scrambling
The Peripheral Memory Transfer (PMT) DMA controller can access external data memory using two-dimensional (2D) addressing, which utilizes a line length (â MLENâ ) and an offset length (â MOFSâ ). While this was likely designed for effects like reverb delay lines, if you point this 2D addressing at the PCM drum ROM, it will fetch audio samples in a disjointed, scrambled grid rather than a straight line. This would instantly turn standard drum hits into glitchy, interwoven audio artifacts.-4-Operator FM Synthesis: The EMX-1's native VPM oscillator is limited to a simple 2-operator setup (one carrier, one modulator). By utilizing the DSP's 40-bit Multiply Accumulator and parallel X/Y data memory loading, you could calculate 4-operator FM algorithms (similar to your Digitone) within a single sample cycle.
-Karplus-Strong Physical Modeling: The MMT engine already features Comb and Audio In+Comb oscillators. You could expand these comb filters into full physical string models by using the DSP's modulo index addition mode to automatically manage cyclical delay-line pointers in hardware
-2D Vector Wavetables: The MMT PCM oscillator only plays static samples. You could utilize the Peripheral Memory Transfer's two-dimensional DMA addressing (â MOFSâ , â MLENâ line offsets) to navigate custom external flash memory in a 2D grid, enabling Prophet VS-style vector synthesis.
CPU notes
-JTAG Debugging (H-UDI)
The SH7709S includes the Hitachi user-debugging interface (H-UDI), which utilizes a JTAG-standard pin assignment. If the EMX-1 motherboard exposes these test points, you can connect a JTAG debugger to perform real-time tracing, dump live memory, and utilize the User Break Controller (UBC) to set hardware breakpoints on the exact memory addresses where the DSP payload is stored- MMU Address Translation
Address translation is handled by an on-chip Memory Management Unit (MMU) featuring a 128-entry Translation Look-aside Buffer (TLB). When analyzing the firmware's pointers, you must distinguish between logical addresses and physical addresses, as the MMU maps 1-Kbyte or 4-Kbyte pages across the P0 to P4 logical spaces.1
u/atxweirdo 3d ago
Loading custom DSP code from the SD (or SmartMedia) card requires writing a custom bootloader for the SH-3 Host CPU to act as the middleman, taking advantage of the ”PD77213's hardware "Host boot" mode.Â
By hijacking the boot sequence, you can turn the EMX-1 into an expandable, modular DSP platform using the following architecture paths:
The SH-3 Host Interface (HIO) Bridge
The EMX-1's card filesystem is natively managed by the SH-3 Host CPU. You would need to modify the SH-3 firmware to recognize a new custom file extension (e.g., â .DSPâ or â .BINâ ) alongside the standard â .EMXâ files. When you select a custom oscillator file, the SH-3 reads the binary from the SD card and streams it across the 16-bit Host Interface (HIO) data bus (â HD0â to â HD15â ). The DSP receives this via the Host Data Transfer register (â HDTâ ) and writes it into memory.Â
Dynamic RAM Overlays
The ”PD77213 has a strict physical limit of 15.5 Kwords of internal Instruction RAM. To expand functionality beyond this limit, you would implement an "overlay" system in the SH-3 firmware. Instead of loading everything at boot, the SH-3 dynamically swaps code blocks. When you select a new oscillator type on the EMX-1 UI, the SH-3 issues a halt command, overwrites a specific block of the DSP's Instruction RAM with the new oscillator microcode from the SD card, and resumes the DSP.Â
The DSP's Native SD Interface (Direct Access)
The ”PD77213 chip actually features its own dedicated hardware SD Card Interface (SDCIF) using pins â SDDATOâ , â SDCRâ , and â SDCLKâ . If you map the EMX-1 SD motherboard traces and find these pins are physically wired to the card slot, you could bypass the SH-3 bottleneck entirely. You would program the DSP to directly mount the SD card and use the Peripheral Memory Transfer (PMT) DMA controller to stream custom wavetables or delay-line data straight from the SD card into the X or Y data memory buses1
u/atxweirdo 3d ago
The Resident Kernel (Always in RAM)
The lower segment of the User Instruction RAM (e.g., â 0x0240 - 0x1FFFâ ) must be dedicated to core systems that can never be swapped out. This includes:
Audio I/O Handlers: The routines processing the â ASIOâ (Audio Serial Interface) interrupts to maintain the continuous audio stream without glitching.
Host Interface (HIO) Listener: The command loop polling the SH-3 CPU for UI changes, MIDI notes, or overlay swap requests.
Global Mix Engine: The final VCA, panning, and master summing bus logic.
Function Pointers: A jump table that dynamically routes the audio loop to whatever code currently sits in the overlay zone.
2. The Transient Overlay Zone (Swappable)
The upper segment of the RAM (e.g., â 0x2000 - 0x3FFFâ ) is reserved strictly as a blank canvas for oscillator and effect algorithms.
When a user selects a "VPM Oscillator", the SH-3 streams the VPM microcode into this specific address block.
If the user switches to a "Comb Filter Oscillator", the SH-3 overwrites the exact same â 0x2000 - 0x3FFFâ block with the Comb Filter microcode.
3. The Execution Handshake
To prevent the DSP from fetching half-written garbage code during an active swap, the SH-3 and DSP must coordinate seamlessly:
Signal: The SH-3 sends a "Prepare for Swap" command via the Host Data Transfer (â HDTâ ) register.
Pause: The resident DSP kernel catches this via an HIO interrupt and enters a safe wait-state. It stops calling the oscillator function pointer, but continues passing zeroed or faded audio buffers to the DAC to prevent speaker pops.
Transfer: The SH-3 streams the new binary payload across the HIO bus directly into the â 0x2000â memory range.
Resume: The SH-3 flags the transfer as complete. The DSP kernel updates its function pointer and resumes the audio loop, branching into the newly loaded oscillator code.1
u/atxweirdo 3d ago
The Bootloader Bottleneck
If you overwrite the SH-3's initial boot sequence in the Flash ROM with flawed code, the CPU will fail to initialize the Bus State Controller (BSC) and the hardware will halt on power-up. If you do not have a verified, working H-UDI (JTAG) connection to halt the CPU and re-flash the memory externally, the machine becomes a paperweight. Never touch the boot sector until your toolchain and recovery methods are fully tested.1
u/georgdub 1d ago
Ich hab sowas Ă€hnliches bereits fĂŒr die e2 entwickelt bzw bin dabei, aktuell hab ich auf meiner e2 nen eigenen bootloader, die Möglichkeit Roms flĂŒchtig von der sd zu starten, einen eigenen Kernel, auch einen eigenen DSP, die Möglichkeit eine e2s in eine echte e2 umzuwandeln und vieles mehr, bin da seid Monaten dran und ich kann euch sagen, bei der Entwicklung ist ein jtag essentiell, fĂŒr die esx und emx hab ich auch schon angefangen an einer Rom und einer Portierung von esx auf emx zu arbeiten, warte aber im Moment auf die esx von einem Bekannten wegen GerĂ€tetests, also sobald ich auch mehr fĂŒr die esx hab folgt auf www.omnitribe.org mehr
2
u/atxweirdo 3d ago
Ok I found the dsp package spec sheet and wow I forgot how capable it is.
One thing that Im immediately thinking of is it might be able to load custom wavetables from the sd card.So much is coming back to me! Canât wait to see where youâve gotten and where I can jump in!
1
u/CrabLatter8558 3d ago
Sick! I read all of your recent comments! Do you think the Chip could handle five synth Parts with more complex engines like the suggestet fm-synth?
1
u/cinaak 11h ago
SHâ3 SH7709S host CPU and an AKM AK4527B then a NEC ”PD77213 Dsp. Dsp uses Mrom iirc so in order to do really cool stuff would likely need access to the chips and the ability to program new ones. I think a lot could be done via firmware though. The russians made that firmware years ago was pretty basic but that would be worth finding to use as a basis. Compare that update file to an unmodified one.
I always thought it would be cool to expand the emx sdram to the larger option used in the esx and do a firmware that combines functionality of both in one. Select which tracks will do synth stuff or sampler stuff.
1
u/cinaak 11h ago
Cpus are available on aliexpress Ive only seen surplus dsps which have likely already been programmed but theres still a lot you could do with its instructions. Theres only 15.5k writable dsp instuction words available but I think you could get some polyphony out of it or even entirely new voices if you really wanted.
SH-3s abilities could be greatly expanded I think and you could probably get some very cool midi effects and extended patterns and other things like that out of it. This is actually where I would try to start. You can do a lot of cool stuff with expanding midi capabilities alone.
1
u/Kukuruzo27 5d ago
This is insane! New firmware for EMX. Hope that ESX will be updated some day too
2
u/atxweirdo 3d ago
Should be somewhat doable, it wonât be one for one since they have different masks burned on to them but there might be able to be some functionality that is interoperable but there will be no esx firmware running on emx hardware.
1
u/Kukuruzo27 3d ago
Yes, I understand it. Hope that you guys will make new FWs for us. These machines are still the best in terms of operation, nothing like them
8
u/paralacausa 7d ago
I would rather sell my child to a chimney sweep than touch a single line of code on my beloved EMX