lofi-12xt-firmware/FINDINGS.md

Lofi-12 XT — Findings Library

Living knowledge base for this device. Process/tips live in RE-PROCESS.md. Per-version structural notes: docs/firmware/notes-v{1.1.156,1.2.179,1.5.205}.md; version diff: rev-diff.md; mod feasibility: tweakability-report.md; tool docs: tools/README.md. Deep dives: docs/hardware.md, docs/bootloader.md, docs/firmware-update.md, docs/firmware/v1.5.205.md.

1. Hardware

• Device: Sonicware Lofi-12 XT (shares platform with SmplTrek/Cydrums).
• Main SoC (core module): TI TMS320C6748 — ARM9 + C674x DSP. Marking on unit: TMS320 C6748EZW T / 13CP99W / GI 375 / 527 ZWT.
• DRAM (core module): EtronTech EM68C16CWQG-25H — 1 Gbit DDR2, base 0xC0000000.
• SPI flash (core module, 2×): Macronix MX25L12833F (MXIC MX 25L12833F M2I-10G), 16 MByte each, SOIC-8, silkscreen IC300 / IC301. Shipping units hide the marking under small stickers (C047/C949-style labels) — peel + photo to confirm.
• USB/aux MCU (main board): ARTERY AT32F421K8T (own firmware, out of scope).
• Storage: full-size SD slot (firmware update + samples/projects).
• PCBs seen: 405-VTOR-3852 (I/O), 405-VTOR-3849B (main), 405-VTOR-3853 (jack), core module with CN201A/CN200A/CN203A/CN203B board-to-board connectors.
• Silkscreen pin tables on main board expose UART1_RX1/TX1, SPI1_SCK/MOSI, SD_*, USB_DP/DN, key/LED matrix — worth mapping before any invasive work.

2. Memory map (DDR2)

Region	Content
0xC0000000…	DDR2 base (128 MB)
0xC2xxxxxx	SD .bin application image (DSP). v1.5 code C2B80C00, strings C2D84DE0, assets C2DA7600
0xC7074630–C70B0598	SPI AIS bootloader image (DSP), entry C70A28A0
0xC706F280	Runtime constant seen in updater (also == checksum seed, §5)
0xC27C6282	Scratch DDR used by updater (§5; value doubles as checksum seed)

3. SPI flash layout (ic300.bin / ic301.bin, 16 MiB each)

Dumps: ic300.bin (c2b86808…), ic301.bin (81f7b1f5…). Always keep these as recovery backups; re-verify with a second read (sha256sum + cmp).

IC300 (boot + app): TI AIS image, magic 0x41504954 (TIPA) at file 0x0. PLL/DDR config (0x5853590D ×2), then 10× Section Load (0x58535901):

File off	DDR	Size
0x000050	C7074630	0x1D0
0x00022C	C7074800	0x33B00 (main code)
0x033D38	C70A8300	0x28CC (rodata)
…	C70AABD0/C70AABE0/C70AABF0	0xC/0xC/0xD44
…	C70AF000/C70AF4E8/C70AF5EC/C70AF660	0x200/0x104/0x70/0xF38

JumpClose (0x58535906) at file 0x38660 → entry C70A28A0 (DSP reset prelude ZERO b0; mvc b0,ier; mvc b0,csr). After it: FF gap to ~0x100000, data to ~0x1EFFFF, FF gap 0x1F–0x4Fxxxx, data 0x500000–0xFC7C17. No AIS CRC opcodes.

IC301 (data): AILS header + drum-pattern names (KICK/HIHAT/BALLAD/BLUES/…), 24× RIFF/WAVE starting 0x8007E0, nearly full to 0xFFFD7B. Factory-sample flash.

Update path (from updater strings + code): SystemUpdater::{start, updateBootSection, updateMainSection, updatePresetSection, updateMCUSection, updateMCUBootSection}(CatMetaData::ROMSection) + SystemVerify::verifyPresetSection. Public ZIPs ship only the SYSTEM section (the SD .bin); BOOT/PRESET/MCU use separate (unreleased) files. Updater lives in AIS flash, so a bad SYSTEM image cannot kill recovery — hold PAD while powering on → SYSTEM UPDATE still works.

4. SD .bin container (cmtd/mmtd/sect → EOF)

Off	Field
0x00	cmtd magic
0x04	u32 LE filesize (must match actual)
0x08	u32 checksum — solved, §5
0x0C	reserved 0
0x10–0x2F	12, 1, 3, fw_maj, fw_min, fw_patch, 48, remaining
0x30	mmtd magic; +0x04 remaining; +0x08 flags (per-build, part of hash)
0x40	fw triple; 0x4C entry point; 0x50 sect count
0x54…	sect ×N: 73 65 63 74 + u32 load_addr + u32 len + payload; must tile EOF

Known builds: v1.1.156 (1,595,605 B, entry C26C4820, 7 sects), v1.2.179 (1,606,197 B, entry C26CA4C0, 6 sects), v1.5.205 (1,707,049 B, entry C2CD1AA0, 7 sects). Code is C674x LE, entropy ~6.89, unencrypted. Parser/packer: tools/lofi_image.py (parse_image asserts filesize + chain fit).

5. Checksum (SOLVED)

Rule: cmtd+0x08 = CRC32-IEEE (init 0) over the entire file with bytes [8:12] replaced by 0xC27C6282.

• tools/lofi_image.py: CKSEED = 0xC27C6282, compute_checksum(); build_image() auto-computes by default (--checksum keep in lofi_pack.py preserves).
• Proof: GF(2) linear solve per image for the 32 unknown bits at [8:12] gives K = 0xC27C6282 on all three images independently (2⁻⁶⁴ fluke); forward recompute reproduces F58AF539 / DFF0D8C2 / B17C0857; unpack→pack rebuilds stock v1.5.205 byte-identical; a Threshold→ThresholX mod forges to a self-consistent 462F735B.
• Code anchors (bootloader DSP): CRC routine C70A0A60 (NOT A6→state, poly EDB88320 via MVK/MVKH, byte loop, final NOT in delay slot ≡ zlib chaining F(buf,len,init)); 4K-chunk caller C708E4E4 (MVK 0x1000, CMPGT, CALLP C70A0A60); check fn C709E7C0 (16-byte header CRC init 0 → chained 0x40000 chunks → CMPEQ A13,A12 compare); orchestrator C708678C CALLP C709E7C0, reject path builds ERROR : This file is invalid. (C70A8E82).
• Forging: build image normally, then set [8:12] = compute_checksum(image).

6. OLED / updater UI strings (orientation)

Checking... 0%, Check the firmware file., ERROR : This file is invalid., Erasing.../Writing.../Verifying... 0%, 100%, done./OK./NG., Update completed./Update failed., Please restart., Are you sure?, [CLR] : No / [OK] : Yes, >> BOOT/MCU/MCU Boot/PRESET/SYSTEM, BOOT:/MCU:/MCU Boot:/PRESET:/SYSTEM:, $ systemupdate, [Lofi-12 XT] ~, SYSTEM INFO/VERSION/BOOT/SYSTEM/MCU, crash dumper (Legacy NMI Exception, A0–A31/B0–B31, NTSR/ITSR/…). v1.5-only markers: AppAudioExport*, MIsolator/MRackComp/SlipRoll/HoldDelay, MIDINoteMap, REVERSE, removeResourceFork (all present in IC300 → board runs v1.5).

7. Open questions

• mmtd+0x08 flags semantics (timestamp? covered by checksum as-is, no need to crack).
• Exact flash section table for BOOT/PRESET/MCU offsets (only SYSTEM reverse-engineered).
• AT32F421 firmware extraction/update protocol.
• UART/JTAG test-point mapping (silkscreen names exist, continuity not traced).