4.1 KiB
Historical snapshot (2026-09-26 working notes). Two claims are superseded: update entry is hold-PAD-while-powering-on (see ../firmware-update.md), and the cmtd checksum is solved (see ../../tools/README.md).
Lofi-12 XT.bin — Reverse Engineering Notes (v1.2.179)
- File:
Lofi-12 XT.bin(firmware v1.2.179) - Size: 1,606,197 bytes (
0x188235) - SHA256:
30ea9eeb58cfeb2cddc68f1b15f65f2586d6956df27009eb9045ca78b616a212 - Same SD-root
SYSTEM UPDATEflow as the other builds
Hardware context
Same platform as v1.5.205 (see ../Lofi-12XT_v1.5.205/Lofi-12XT_v1.5.205/reversed.md):
TI TMS320C6748 (ARM9 + C674x DSP), DDR2 base 0xC0000000. All sect
load addresses are 0xC2xxxxxx (DDR2 snapshot loaded by the SPI-flash bootloader).
Container format (same Sonicware custom format)
[cmtd 48B][mmtd 36B][sect x6 -> EOF, exact fit]
Note: 6 sects — the 8-byte zero patch slot (C2589508 in v1.1.156,
C2B809E8 in v1.5.205) is absent here.
cmtd (0x00–0x2F)
| Off | Value | Meaning |
|---|---|---|
| 0x00 | cmtd |
magic |
| 0x04 | 1606197 | u32 LE filesize (matches) |
| 0x08 | 0xDFF0D8C2 |
u32 checksum (?) — differs per version, algorithm TBD |
| 0x10–0x2F | (12, 1, 3, 1, 2, 179, 48, 1606149) |
container (?, 1, 3), fw (1, 2, 179), hdr len 48, remaining |
mmtd (0x30–0x53)
| Off | Value | Meaning |
|---|---|---|
| 0x30 | mmtd |
magic |
| 0x34 | 1606149 | remaining size |
| 0x38 | 4e b6 e4 04 ff ff ff ff |
timestamp/flags? (build-specific) |
| 0x40 | (1, 2, 179) |
fw version |
| 0x4C | 0xC26CA4C0 |
entry point (inside big code sect, verified below) |
| 0x50 | 6 | sect count |
sects
| # | File off | Load addr | Len | End addr | Role |
|---|---|---|---|---|---|
| 0 | 0x000054 | C277B320 | 83496 (0x14628) |
C278F948 | asset/blob |
| 1 | 0x014688 | C277AB18 | 660 (0x294) |
C277ADAC | float table |
| 2 | 0x014928 | C277B000 | 512 (0x200) |
C277B200 | record table |
| 3 | 0x014B34 | C258D800 | 1399200 (0x1559A0) |
C26E31A0 | main code (.text), C6000 DSP |
| 4 | 0x16A4E0 | C275A7A0 | 117825 (0x1CC41) |
C27773E1 | .rodata/.data (all readable strings) |
| 5 | 0x18712D | C27793E8 | 4348 (0x10FC) |
C277A4E4 | float ramp tail |
Chain verified: next_off = off + 12 + len, ends exactly at EOF (0x188235).
Code identification
- Entry
0xC26CA4C0→ file off0x151800. C64x-LE disassembly:ZERO b0; mvc b0,ier; mvc b0,csr; mvk -0x6c1c,b15; mvklh -0x3d89,b15; and -8,…— same reset prelude as v1.1.156/v1.5.205, only stack immediates differ. Confirms C6000 DSP code. - Big sect entropy 6.887, zeros 177,496 (12.7%) — same code+data mix.
- String sect cross-refs: 5,909 words into code range + 2,967 self-pointers (vs 5,854 + 2,932 in v1.1.156; 6,362 + 3,141 in v1.5.205).
- Total
strings>=4: 11,110; meaningful (≥10 chars) in data sect: 1,053.
Data sect contents (file 0x16A4E0–0x18712D)
- Same C674x crash dumper,
14AppSongBrowser,N3HAL…Driver, libc++NSt3__as v1.1.156. - Same older
FileUtilAPI shape as v1.1.156 ((…S1_S1_PA256_c…Fv…),(…S1_jjPjS2_…)); noremoveResourceFork— that API (plusRbparams andFvicallbacks) appears only in v1.5.205. - v1.5-only feature strings absent:
Snip Loop0,PATTERN MIXDOWN0,AUDIO EXPORT0 (same isolatedIsolator/Reverse/Compressorhits as v1.1.156).
Differences vs the other builds
| v1.1.156 | v1.2.179 | v1.5.205 | |
|---|---|---|---|
| size | 1,595,605 | 1,606,197 | 1,707,049 |
| nsect | 7 (with 8 B patch slot) | 6 (slot absent) | 7 (slot back) |
| code len | 1,389,120 | 1,399,200 | 1,490,112 |
| strings len | 115,561 | 117,825 | 125,081 |
| code base | C2589800 | C258D800 | C2B80C00 |
| entry | C26C4820 | C26CA4C0 | C2CD1AA0 |
v1.1→v1.2 is a small delta (+10 kB code, +2 kB strings — matches the v1.2 changelog: per-track swing, new filters LSF/HSF, EVEN slice mode, PAD hold/ROLL, PTN MUTE, …). v1.2→v1.5 is the big jump (+91 kB code: audio export, 4 new master FX, 16 slices, MIDI Note Map, …). The coming/going 8 B zero sect looks like alignment/patch-slot churn in their image generator rather than a real payload.