Init

2026-09-30 22:48:06 +02:00
commit 8913cb4314
37 changed files with 3190 additions and 0 deletions
@@ -0,0 +1,96 @@
+> Historical snapshot (2026-09-26 working notes). Two claims are superseded:
+> update entry is hold-PAD-while-powering-on (see ../firmware-update.md),
+> and the cmtd checksum is solved (see ../../tools/README.md).
+
+# Lofi-12 XT.bin — Reverse Engineering Notes (v1.2.179)
+
+- File: `Lofi-12 XT.bin` (firmware v1.2.179)
+- Size: 1,606,197 bytes (`0x188235`)
+- SHA256: `30ea9eeb58cfeb2cddc68f1b15f65f2586d6956df27009eb9045ca78b616a212`
+- Same SD-root `SYSTEM UPDATE` flow as the other builds
+
+## Hardware context
+
+Same platform as v1.5.205 (see `../Lofi-12XT_v1.5.205/Lofi-12XT_v1.5.205/reversed.md`):
+TI TMS320C6748 (ARM9 + C674x DSP), DDR2 base `0xC0000000`. All `sect`
+load addresses are `0xC2xxxxxx` (DDR2 snapshot loaded by the SPI-flash bootloader).
+
+## Container format (same Sonicware custom format)
+
+```
+[cmtd 48B][mmtd 36B][sect x6 -> EOF, exact fit]
+```
+
+Note: **6 sects** — the 8-byte zero patch slot (`C2589508` in v1.1.156,
+`C2B809E8` in v1.5.205) is absent here.
+
+### cmtd (0x00–0x2F)
+
+| Off | Value | Meaning |
+|-----|-------|---------|
+| 0x00 | `cmtd` | magic |
+| 0x04 | 1606197 | u32 LE filesize (matches) |
+| 0x08 | `0xDFF0D8C2` | u32 checksum (?) — differs per version, algorithm TBD |
+| 0x10–0x2F | `(12, 1, 3, 1, 2, 179, 48, 1606149)` | container (?, 1, 3), fw (1, 2, 179), hdr len 48, remaining |
+
+### mmtd (0x30–0x53)
+
+| Off | Value | Meaning |
+|-----|-------|---------|
+| 0x30 | `mmtd` | magic |
+| 0x34 | 1606149 | remaining size |
+| 0x38 | `4e b6 e4 04 ff ff ff ff` | timestamp/flags? (build-specific) |
+| 0x40 | `(1, 2, 179)` | fw version |
+| 0x4C | `0xC26CA4C0` | **entry point** (inside big code sect, verified below) |
+| 0x50 | 6 | sect count |
+
+### sects
+
+| # | File off | Load addr | Len | End addr | Role |
+|---|----------|-----------|-----|----------|------|
+| 0 | 0x000054 | C277B320 | 83496 (`0x14628`) | C278F948 | asset/blob |
+| 1 | 0x014688 | C277AB18 | 660 (`0x294`) | C277ADAC | float table |
+| 2 | 0x014928 | C277B000 | 512 (`0x200`) | C277B200 | record table |
+| 3 | 0x014B34 | C258D800 | 1399200 (`0x1559A0`) | C26E31A0 | **main code (.text), C6000 DSP** |
+| 4 | 0x16A4E0 | C275A7A0 | 117825 (`0x1CC41`) | C27773E1 | **.rodata/.data** (all readable strings) |
+| 5 | 0x18712D | C27793E8 | 4348 (`0x10FC`) | C277A4E4 | float ramp tail |
+
+Chain verified: `next_off = off + 12 + len`, ends exactly at EOF (`0x188235`).
+
+## Code identification
+
+- Entry `0xC26CA4C0` → file off `0x151800`. C64x-LE disassembly:
+  `ZERO b0; mvc b0,ier; mvc b0,csr; mvk -0x6c1c,b15; mvklh -0x3d89,b15;
+  and -8,…` — same reset prelude as v1.1.156/v1.5.205, only stack immediates
+  differ. Confirms C6000 DSP code.
+- Big sect entropy 6.887, zeros 177,496 (12.7%) — same code+data mix.
+- String sect cross-refs: 5,909 words into code range + 2,967 self-pointers
+  (vs 5,854 + 2,932 in v1.1.156; 6,362 + 3,141 in v1.5.205).
+- Total `strings>=4`: 11,110; meaningful (≥10 chars) in data sect: 1,053.
+
+## Data sect contents (file 0x16A4E0–0x18712D)
+
+- Same C674x crash dumper, `14AppSongBrowser`, `N3HAL…Driver`, libc++ `NSt3__`
+  as v1.1.156.
+- Same older `FileUtil` API shape as v1.1.156 (`(…S1_S1_PA256_c…Fv…)`,
+  `(…S1_jjPjS2_…)`); **no `removeResourceFork`** — that API (plus `Rb` params
+  and `Fvi` callbacks) appears only in v1.5.205.
+- v1.5-only feature strings absent: `Snip Loop` 0, `PATTERN MIXDOWN` 0,
+  `AUDIO EXPORT` 0 (same isolated `Isolator`/`Reverse`/`Compressor` hits as v1.1.156).
+
+## Differences vs the other builds
+
+| | v1.1.156 | v1.2.179 | v1.5.205 |
+|---|---|---|---|
+| size | 1,595,605 | 1,606,197 | 1,707,049 |
+| nsect | 7 (with 8 B patch slot) | **6 (slot absent)** | 7 (slot back) |
+| code len | 1,389,120 | 1,399,200 | 1,490,112 |
+| strings len | 115,561 | 117,825 | 125,081 |
+| code base | C2589800 | C258D800 | C2B80C00 |
+| entry | C26C4820 | C26CA4C0 | C2CD1AA0 |
+
+v1.1→v1.2 is a small delta (+10 kB code, +2 kB strings — matches the v1.2
+changelog: per-track swing, new filters LSF/HSF, EVEN slice mode, PAD hold/ROLL,
+PTN MUTE, …). v1.2→v1.5 is the big jump (+91 kB code: audio export, 4 new master
+FX, 16 slices, MIDI Note Map, …). The coming/going 8 B zero sect looks like
+alignment/patch-slot churn in their image generator rather than a real payload.