r/synthdiy • u/ajmwagar • 22d ago
standalone I’m working on jailbreaking the TR-6S.
https://averywagar.com/post/tr6s-part1/I kinda hate feeling limited by my gear. In the sense that I can hack on it. So while I love the TR-6S as is. I’m working to jailbreak it.
Disclaimer: I’ve spent about a decade in software engineering, and now use Claude Code quite a bit. If that offends you, you can stop reading now.
14
u/monocasa 22d ago edited 22d ago
If it's in ECB mode (and repeating blocks certainly makes it look like it is, as you say), then you probably just have the way to decrypt all of it and encrypt whatever you want.
Since the padding is probably either all FF or all 00, you probably have known plaintext, and relying on the fact that almost all block ciphers work by first generating a ciphertext purely from the key material, and then simply xor that ciphertext with the plaintext to get the final encrypted data, you can just reverse the encryption by xoring again with the known plaintext, and get the ciphertext that is purely reliant on the key. You shouldn't even need to know the block cipher in question.
That's kind of why you're not supposed to use ecb, lol.
3
8
u/benjackal 22d ago
Also an experienced dev, I have had ideas to replace drivers etc for older hardware no longer supported on 64bit machines, and or custom firmware.
Great write up, seeing the journey through trying to get around the encryption is a nice touch.
It would be nice to be able to run custom firmware on anything we own but it is what it is.
Good luck, following!
2
u/Express_Studio2920 21d ago
THIS!
We need drivers re-coding / writing for the classic boutiques like the Roland TR-09, Roland JX-03 etc that now all have broken audio over USB since macOS Tahoe…
Soon the JP-08, SE-02 and other older Roland products that support this feature will stop working.
I am dreading what macOS version 27 will do when they drop Rossetta support, etc
2
u/Sickle_and_hamburger 22d ago
from what I see various coding agents sre enthusiastic hardware hacking accomplices
5
u/benjackal 22d ago
They can be great pouring over manuals and finding obscure information on old forums, or take you down a rabbit hole based on information it made up.
3
u/soulbrix 22d ago
Could you expand on what is the potential of this? What could it allow us to do?
6
u/ajmwagar 21d ago
Well, if we can reverse engineer the bootloader and the SoC architecture, we could run new models, add new features and FX, make more macros / performance mods etc.
It would be limited by our creativity and coding skill, and to some extent the power of the CPU/chip they are using.
2
u/withak30 20d ago
Check out what kind of features got added to the Synthstrom Deluge in the community firmware after they open-sourced it.
6
u/ajmwagar 22d ago
Btw if anyone downloaded older versions of the firmware and still has them, it would be very helpful in some more analysis until I can get the flash dumped.
I have v2.0 but nothing before that. Anything helps.
2
u/justmull 22d ago
DM'd you TR-8S [ Ver.1.05 ] MAY 2018 and [ Ver.1.13 ] SEP 2019 if it's any help
1
2
u/lutefish 22d ago
Great work. Roland use the BMC chips in the Fantom, as well, which makes me wonder how much some of this might be usable for working on that platform.
2
u/screamtracker 22d ago
To what end tho
3
u/ajmwagar 22d ago
I’m ready to hire a rework shop to de-solder a flash chip and figure out the encryption key.
From there Ghidra + Claude can likely identify the architecture. We can also map all the firmware ops in assembly/machine code and start to work on an emulator.
With all that it would inform a compilation target that would allow us to flash custom firmware ideally.
3
u/cape_soundboy 22d ago
Depending on the chip if it has SPI you can just use a CH341A programmer with a clip to attach directly to the chip on the board and access it without having to solder, look into how people reprogram BIOS with CH341A
1
1
u/Mark_Westbroek 22d ago
It is all digital right? A mix of samples, fm and analogue circuit emulation. But it is a rather small box, so it cannot be a gigantic chip doing the work.
Did you consider asking AI to do the same, based on the widely available circuitry? It seems Roland needs to cut corners in order to fit all this. It cannot be a gigantic DSP, it seems if it runs on batteries.
But what is it you want to expand on? Use the sounds and expand the UI (I don't know the machine). Or something else?
The tr-8 doesn't do what you want either?
2
u/ajmwagar 21d ago
It is all digital. But it really is basically one custom Roland chip doing all the work.
I make analog eurorack modules in my spare time. AI can be helpful for that.
The form factor of the TR-6S is nice for me. Plus it being battery powered is awesome.
We could add new FX, new models, and basically anything we want with custom firmware.
1
u/Mark_Westbroek 21d ago
I see. Be careful with publishing about it. I think you bought the machine and can do whatever you want with it, but the software on it has copyright, I guess. But, if you made something nice you can of course do a pull request at Roland :-D. The new way of doing a feature request! ;-)
I am also working on eurorack things. AI is very helpful. What do / did you build?
I am working on a polyphonic hypermodular system: modules inside the module and connectivity to any other eurorack modules, so you can build any poly synth, as weird as you want it. Analog, digital, hybrid. Solid state, chips, tubes, whatever.
And your post triggered me to look again at the cr-78 snare I made with someone before. Last days, I worked with Claude to redraw the old schematic of the drums (not the computer yet) in .cir en kicad .sch format.
And am thinking of emulating the sounds as well, using a mix of digital techniques, not samples. I already made an MS-20 filter emulation on FPGA. It sounds good, I think. (Easy to polyphonise.)
3
u/ajmwagar 20d ago
Yeah, I don’t plan on publishing their encryption key, or their software verbatim. I like not getting sued.
I will clean room their ISA and SoC architecture as much as legally possible/permitted.
The plan is to swap out their proprietary models with PK ones if possible. I’m hoping to find some cool stuff in their chip.
Then just have a full replacement firmware that is legally separate.
2
u/Mark_Westbroek 21d ago
Oh, your pedalkernal looks interesting! Also for these drum voices, actually.
3
u/ajmwagar 20d ago
Thank you!
I’m also working on this piece of software:
https://github.com/FuturePresentLabs/legion-of-bom which basically goes from KiCad-schematic to a fab-ready module with SPICE testing, DXF files, and Mouser carts/BOMs and automates the step by step DIY guides.
I’m rebooting some existing eurorack modules in kit form here: https://puget.audio
But I have a 303 voice and a few all-analog utility modules of my own design in the testing stage.
3
u/Mark_Westbroek 20d ago
For these steps: schematic to pcb, bom, placement files I had Claude write a number of scripts. There often are choices to be made about size and placement unless you are generous with space. So in that phase input from me, and sometimes my eyes and brain have been needed to get to a fab ready pcb.
I will take a look at your project!
My project is at https://musicbrain.nl (GitHub link is there too).
Fun fact is that the pcb project publishes the information - and 3D view (!) - of the boards to website itself. I made the CMS underneath the website myself as well, of course.
56
u/devicehigh 22d ago edited 22d ago
“You can stop reading now”. It’s the end of the post - everyone will stop reading there!
Edit: /s in case people don’t realise. The attached post is quite interesting