# Firmware v1.5.205 — analyzed image

Deep dive on the newest analyzed release (the version running on the dumped
unit: every `strings≥6` in this image also occurs in IC300). Older releases and
deltas: `rev-diff.md`. Container/code basics: `FINDINGS.md` §4.

## Vitals

- File `Lofi-12 XT.bin`: **1,707,049 B**, sha256
  `a8bffa65919c0a2d4ff2ce77d16301551af4d2964497b8804deed49ce4198026`,
  checksum `B17C0857`, triple (1, 5, 205), container (1, 3).
- Entry **`C2CD1AA0`** (DSP reset prelude), **7 sects**, chain tiles EOF exactly.

## Composition

| # | Load addr | Len | Role |
|---|---|---|---|
| 0 | `C2DA7600` | 86,168 | asset/blob (`7e xx` bitmap/font/waveform pattern) |
| 1 | `C2DA6DD4` | 688 | float table (filter/window coeffs) |
| 2 | `C2DA7400` | 512 | fixed-record table (presets/patterns) |
| 3 | `C2B80C00` | 1,490,112 | **code** (C674x LE, entropy ~6.89, ~12.6% zeros) |
| 4 | `C2B809E8` | 8 | zero slot (alignment churn, not usable space) |
| 5 | `C2D84DE0` | 125,081 | **rodata** (all strings, vtables; 6,362 code-ptrs, 3,141 self-ptrs) |
| 6 | `C2DA5680` | 4,312 | float ramp tail |

## What it does (from strings/symbols)

- Groovebox app: patterns/songs/tracks/scenes, 16-slice engine, pad handling
  (`AppPad`), step sequencer + transport with precount, per-track swing/mute.
- **Audio export** (`AppAudioExport*`, `DialogAudioExporting`, `MixDown~`):
  pattern/song mixdown + individual tracks, `MIXDOWN FILE NAME:`.
- **MIDI Note Map** (`AppMIDINoteMap`), MIDI I/O + CC step-lock handling.
- Master FX: `MIsolator`, `MRackComp`, `SlipRoll`, `HoldDelay`; sample `REVERSE`;
  tag search, file normalize/convert, `FILE DATABASE` (1,024 files/folder).
- Storage: SD via `N3HAL` drivers; project chunk tags
  (`PJST/SMPS/PTD2/PTDT/PJCF/SONG/TRAU/…`); audio `RIFF/WAVE/smpl/cue`,
  `MThd/MTrk`; `FileUtil` recursive copy/search + `removeResourceFork`.
- UI: OLED via custom `RenderBuffer` pipeline + `StepEditPageController`
  (`updateAppLED`); `SYSTEM INFO` (VERSION/BOOT/SYSTEM/MCU); `SYSTEM UPDATE`;
  full C674x crash dumper (`Legacy NMI Exception`, `A0–A31/B0–B31`).
- Toolchain traces: libc++ RTTI (`NSt3__`…) ⇒ TI clang-based CGT.

## Learned / verified

- Unpacked + repacked with `tools/` → byte-identical (`cmp` clean).
- `Threshold→ThresholX` Level-0 mod forges to self-consistent `462F735B`.
- Top string-sect zero gaps (388/256/223/≈196 B) bound same-build string growth
  without pointer surgery.
- v1.2→v1.5 added ~91 KiB code (export + note-map + 4 FX + transport rework);
  callback ABI migrated `Fv→Fvi/Fvii/Fviii`; display symbols turned over
  (`RenderBufferIhLi128ELi128ELi1327E` gone) — see `rev-diff.md`.