lofi-12xt-firmware/docs/firmware/notes-v1.5.205.md

Historical snapshot (2026-09-26 working notes). Two claims are superseded: update entry is hold-PAD-while-powering-on (see ../firmware-update.md), and the cmtd checksum is solved (see ../../tools/README.md).

Lofi-12 XT.bin — Reverse Engineering Notes

• File: Lofi-12 XT.bin (firmware v1.5.205)
• Size: 1,707,049 bytes (0x1A0C29)
• SHA256: a8bffa65919c0a2d4ff2ce77d16301551af4d2964497b8804deed49ce4198026
• Source: Lofi-12XT_v1.5.205 update ZIP (also contains Dibiase/, Ski Beatz/ sample folders)
• Update method: copy .bin to SD root, boot with button held → SYSTEM UPDATE

Hardware context

Based on community teardown (SmplTrek / Lofi-12 XT / Cydrums share platform):

• TI TMS320C6748 (ARM9 + C674x floating-point DSP) — main SoC
• ARTERY AT32F421K8T (ARM Cortex-M, USB/aux)
• Etron EM68C16CWQG 1 Gbit DDR2, base 0xC0000000
• Macronix MX25L12833F SPI flash (bootloader lives here, parses SD .bin)

All sect load addresses are 0xC2xxxxxx, i.e. DDR2. The .bin is a DDR snapshot loaded by the SPI-flash bootloader, not a flash image itself.

Container format (Sonicware custom, not AIS/ELF)

[cmtd 48B][mmtd 36B][sect x7 -> EOF, exact fit]

cmtd (file header, 0x00–0x2F, 48 bytes)

Off	Bytes	Meaning
0x00	63 6d 74 64 (cmtd)	magic
0x04	29 0c 1a 00	u32 LE filesize = 1707049 (matches)
0x08	57 08 7c b1	u32 checksum (?) 0xB17C0857, algorithm TBD (not plain CRC32)
0x0C	00 00 00 00	reserved
0x10	0c 00 00 00	12 (?)
0x14	01 00 00 00	container ver major? (1)
0x18	03 00 00 00	container ver minor? (3)
0x1C	01 00 00 00	firmware major (1)
0x20	05 00 00 00	firmware minor (5)
0x24	cd 00 00 00	firmware patch (205) → v1.5.205
0x28	30 00 00 00	48 = cmtd header len
0x2C	f9 0b 1a 00	remaining size = filesize − 48 = 1707001

mmtd (image header, 0x30–0x53, 36 bytes)

Off	Bytes	Meaning
0x30	6d 6d 74 64 (mmtd)	magic
0x34	f9 0b 1a 00	remaining size
0x38	e8 bc f8 4f	timestamp/flags? (0x4FF8BCE8)
0x3C	ff ff ff ff	−1
0x40	01 00 00 00	fw major (1)
0x44	05 00 00 00	fw minor (5)
0x48	cd 00 00 00	fw patch (205)
0x4C	a0 1a cd c2	entry point 0xC2CD1AA0 (inside big code sect)
0x50	07 00 00 00	sect count = 7

sect (0x54 → EOF)

Each: 73 65 63 74 (sect) | u32 LE load_addr | u32 LE len | payload. Chain verified: next_off = off + 12 + len, ends exactly at EOF (0x1A0C29).

#	File off	Load addr	Len	End addr	Role
0	0x000054	C2DA7600	86168 (0x15098)	C2DBC698	asset/blob (7e xx patterned)
1	0x0150F8	C2DA6DD4	688 (0x2B0)	C2DA7084	float table (~−97…−102)
2	0x0153B4	C2DA7400	512 (0x200)	C2DA7600	record table, links #1→#0
3	0x0155C0	C2B80C00	1490112 (0x16BCC0)	C2CEC8C0	main code (.text), C6000 DSP
4	0x18128C	C2B809E8	8	C2B809F0	zeros (gap/patch slot)
5	0x1812A0	C2D84DE0	125081 (0x1E899)	C2DA32D9	.rodata/.data (all readable strings)
6	0x019FB45	C2DA5680	4312 (0x10D8)	C2DA6758	float ramp (~−99.34 step)

Sorted by address they tile C2B809E8…C2DBC698 with small gaps (descriptors/BSS).

Unpacked with:

import struct
off = 0x54
while d[off:off+4] == b'sect':
    a, b = struct.unpack('<II', d[off+4:off+12])
    open(f'sect_addr{a:08X}_off{off:06X}.bin','wb').write(d[off+12:off+12+b])
    off += 12 + b

Split files in /tmp/opencode/lofi/sect*_addr*.bin (7 files).

Code identification

• Entry 0xC2CD1AA0 → file off 0x16646C. Disassembled as TMS320C64x LE (capstone CS_ARCH_TMS320C64X) gives a textbook C6000 reset prelude: ZERO b0; mvc b0,ier; mvc b0,csr; mvk/mvklh b15/b14; and -8,… (disable interrupts, align stack). ARM/Thumb disassembly of the big sect yields ~nothing (2× E92D push in 1.5 MB; bx lr hits are coincidental Thumb-dense false positives).
• Data sect has 6,362 words pointing into the big code range (C2BDxxxx, e.g. C++ vtables) + 3,051 self-pointers. Big sect itself has ~0 pointers into data (PC-relative addkpc style) + 102 self-words — consistent with C6000 .text vs .rodata split.
• Big sect entropy ~6.9–7.0 with ~12% zeros (code+data mix, not packed/encrypted); tail (+0x140000…) drops to ~3.0 with repeating 64 B zero-padded structs (data/BSS area).

Data sect contents (file 0x1812A0–0x19FB45)

• C++ RTTI/mangled names (libc++, NSt3__, so TI clang-based CGT): FileUtil::removeResourceFork/copyFolderRecursive/convFsRecursive/…, 14AppSongBrowser/TestControl/TestEncoder, 13AppFileRename/FileSelect/ SongRename/SystemInfo/SystemMenu, 12AppSceneMenu/TempoMenu/TrackMenu, 11AppSDReader/SongEdit, 10AppTapeRec/TestADC/TestLED, N3HAL9I2CDriverE/ SPIDriver/IODriver/SDDriver, N8SoundOSC4StepE, N5Asset5PLockE, …
• C674x crash dumper: Legacy NMI Exception, IERR=, Fetch packet, Execute packet, Opcode/Privilege/Loop buffer, A0=…A31=, B0=…B31=, NTSR/ITSR/IRP/SSR/AMR/RILC/ILC, Exception at, EFR/NRP, cache/security faults.
• UI strings: Lofi-12XT, PATTERN MIXDOWN/MENU, PROJECT SAVE AS/SELECT, SONG MIXDOWN, SCENE/TRACK MANAGER, CARD/MIDI SETTING, ARE YOU SURE?, PROCESSING/COPYING…, Threshold, Tempo: 120.0, *.wav, …
• Container/chunk tags: RIFF/WAVE/fmt /smpl/labl/adtl/data/cue /MThd/MTrk, project tags PJST/SMPS/PTD2/PTDT/PJCF/SONG/TRAU/TMAM/…, TRACK0/TRK0.

Small sects

• #0 (86 kB): byte pattern 00 7e 7e 00 … 7e xx 00 0f — bitmap/font/waveform asset.
• #1/#6: LE float32 tables (filter/window coeffs?).
• #2 (512 B): fixed records, e.g. f6 54 3c 00 5a a3 xx 00 … 6a 61 00 (ja\0/jma\0 fragments) — preset/pattern table.

Open questions / next steps

1. Checksum at cmtd+0x08 (0xB17C0857) — not CRC32 of obvious spans; brute-force variants (BE, seeded, Fletcher, TI AIS style) before attempting repack.
2. Full C64x disassembly of sect #3 (TI CGT / Ghidra C6000, or capstone script); recover vtables using pointers in sect #5.
3. Diff vs older .bin (e.g. v1.2.x) to isolate v1.5 feature code.
4. Confirm ARM9 vs DSP split (ARM9 may be bootloader-only in SPI flash; everything in .bin looks like DSP).