Firmware-possibility of reverse engineering

This is the place to post if you are having problems with you Fusion.

Moderators: Jesse, parametric

Post Reply
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Firmware-possibility of reverse engineering

Post by Jokeyman123 »

I'm posting this under technical issues. Although there are certainly many CC messages (thanks to Psionic and a few others who have assiduously (big word for the day) extracted much of this. I am still trying to understand how to design an interface for the CC messages that work with external controllers since the "CTRLR" website has software routines to do this but it needs some sysex to get a software front-end to work, god how I wish Steve were still with us but his spirit helps drive me.

The problem of not being able to reverse-engineer the firmware-which if it can be done, might present some wonderful new functions in our Fusions which have already been discussed here-due to Hadley's very recent post-showing us a wunderkind (aw shucks 2 big words today) who managed to crack open the keytar firmware to change a function or 2, I would like to know, primarily directed to Jesse and Parametric as our moderators-if you think i should try to contact this genius software programmer and request that he help see what he can do with our Fusion firmware? We have it, although I'm not sure this downloaded version is the full OS-but if he can give us any insight-and if he is willing to look at this-I will follow through-work with him-send him the OS firmware we have, send him technical info re the mainboards, TI chips, anything else we already have that might help him. I am not a programmer, but I have done some work on the windows command line and with Linux terminal for that OS, not good with Python-which is what I think a few users have used to develop Fusion Sort and the Alliance project. Considering the state of development I've seen with new keyboards (not much, still expensive and tending to use cheaper Chinese parts of plastic) and that so many-must be younger-musicians are taking a new interest in hardware (what goes around comes around, guess some are getting tired of the virtual worlds of software and Zoom conferencing, I know I am!!!) I still think this Fusion has good enough "bones" to be resurrected like this. And when I looked in 2020 for a new 88 key workstation and realized it would still cost me a good 2-4000 for any decent major that are all still missing something the Fusion already had-I decided to buy and resurrect my 2 now fully working 8HDs, seemed like a much better deal.
User avatar
Jesse
Administrator
Administrator
Posts: 1638
Joined: Thu Jul 07, 2005 5:49 pm
Do you own a fusion?: Yes
Location: Wilmington, NC USA

Re: Firmware-possibility of reverse engineering

Post by Jesse »

Glad to hear all the enthusiasm for the Fusion, Like most of us I wish Alesis had stuck to their guns, the Fusion has a lot of undeveloped potential by way of the FPGA chips :)

Don't forget this diagram by pev69

https://www.alesismusic.com/viewtopic.p ... v69#p36628
Tempus & Ludwig Drums, Roto Toms, Djembe, Bongo's, Ibanez Bass, Fusion8HD, SUMO300 Amps, Alesis16 Firewire Mixer, AKG D112, Behringer B2, Shure Beta 58a Microphones, Windows 10, Audigy Soundcard, Audition 3, Sony MDR-7506 Headphones, Kontakt 6 & East West Goliath Sound Banks
hadley
General
General
Posts: 51
Joined: Thu May 01, 2008 8:43 pm

Re: Firmware-possibility of reverse engineering

Post by hadley »

I personally wouldn't bother marcan - he probably has tons of his own stuff to do.

Nothing can be done with the Fusion firmware until the encryption is cracked.

There are plenty of guides online, for anyone who wants to have a go at it. For example, try https://www.pentestpartners.com/securit ... hthawk-m1/

The patterns we can see in the Fusion firmware file indicate that it should be XOR encrypted. And they key might be 32 bytes long. When I get more time I will poke at it more. I probably won't succeed, but I guess eventually somebody will decrypt this.
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Re: Firmware-possibility of reverse engineering

Post by Jokeyman123 »

Hadley-what are you using to read the firmware code? I have only-because of my limited programming knowledge-been using a simple hex editor/translator (just simple binary or octal translations-doesn't help decrypt anything. And with no knowledge of what any of these codes mean-with no hope of any Alesis software engineers helping us....I will study your link-try to teach myself...I am primarily a musician/performer, not a code expert. But if you managed to do this-even to make rudimentary progress-you will be a hero in several Fusion user groups I believe. One goal for example-a few years back-a UK software/hardware designer managed to design duplicate ram boards for the Fusions-since the original sources were disappearing although there are still 2 sources I know of in the US at least. He also designed and made available the same boards-but with double the ram capacity-and these worked, but only up to the Fusion's firmware (or hardware?) limits-128MB per card-128 plus the 64 onboard. He designed 256MB ram cards-plus 64MB onboard. It seems the OS or firmware would not recognize the 192MB ceiling-and of course this may be due to the limits of the CPU's ability to address it-but studying the Fusion Texas Instrument's chip specs and schematics-I think the chips can address this much, so it may be a function of the firmware. Ask Jesse or parametric about that. And the hard drive IDE bottleneck-might also be opened up in firmware as might the SATA port-which hardware is already there. Would give us the ability to tremendously speed up the Fusion all around. and design a full editor/librarian, which has been impossible as there was no sysex implementation-that we know of. A good coder might be able to add this sysex code if they could get into the OS or firmware at the programming level/code level.
User avatar
kpr
Advanced
Advanced
Posts: 384
Joined: Thu Sep 22, 2005 9:14 pm
Location: Germany, mainly
Contact:

Re: Firmware-possibility of reverse engineering

Post by kpr »

In such cases, it is recommended to simply talk to one of the key developers. With Fusion, that was Bret Victor, a pretty awesome guy. You can get in touch with him here.

http://worrydream.com/#!/Alesis
Rock´n Roll is music, not driving instructions.
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Re: Firmware-possibility of reverse engineering

Post by Jokeyman123 »

Excellent! Thank you KPR-I will do that. I have posted, and hoped we could find, one of the original developers to see what might be possible in 2021-after all, this would not be the first time in music/tech history that an after-development accomplished something previously thought impossible.

Another idea-recently I successfully installed a firmware upgrade-called "Middleton's upgrade"- to one of my older computers-designed by an independent developer-which added the following features to firmware that is normally only accessible from the company who installed the original firmware-in this case IBM/Lenovo, it is a T61. what caught me here-the firmware bumps the SATA bus (I know the Fusion is PATA) from the original SATA I which also allowed for PATA access-to SATA III, much faster, as well as several other firmware mods to update to a much faster processor formerly not compatible with the T61 and a higher resolution screen (see my comments below).

So there are some similarities to what he unlocked and what we would like to see a Fusion is capable of. I am thinking out loud, if he is still available online-I can look, the firmware is on ThinkWiki with his description-if he might be willing to look at the Fusion firmware, might be able to do something with it. oddly enough-Middleton's upgrade did something startling i hadn't expected-my screen which is (I thought) an older fluorescent backlight and looked like it) now is clearer, brighter-which i can't understand-it looks like an LED screen now. Possibly the firmware is overdriving the screen to do this, not sure-there is no description in the Thinkwiki suggesting this will happen but the visual improvement is amazing. so Middleton might be our man too.
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Re: Firmware-possibility of reverse engineering

Post by Jokeyman123 »

Hello KPR-whew, he is a pretty "evolved" Fusion inventor. Quite a resume-developing the Fusion architecture-must have been child's play for him. But iI could not find direct contact information at his website for a simple email-and wow, I'm not sure he would be willing-with some of the projects he is involved in, or evolved towards but i will. I looked at several of his websites and blogs. Quite amazing, but now I know better-why the Fusion is such an genius musical instrument. I like his comment that most of his projects didn't work out......because most wouldn't take the time to even understand. Then, Einstein dropped out of high school I believe, and most saw no relevance to his special and general theories of relativity. And my father helped design the guidance system for the F-20 Tiger Shark fighter jet when he worked for a brief moment at Northrup-which most fighter pilots couldn't handle-it was too powerful and "twitchy", so the govt. abandoned it, like Alesis abandoned the Fusion. Years later, this became-the F16 when the govt. figured out how to make it cheaper and 'dumb it down" a bit. See a co-relation? Maybe why I am fighting for the Fusion revival movement (I made that up). No hats or t-shirts though, or cups or bobble-head dolls, please!!!! A few lines of code perhaps, and we will have an F-20 Tiger Shark with a keyboard attached to it. Never say never.
hadley
General
General
Posts: 51
Joined: Thu May 01, 2008 8:43 pm

Re: Firmware-possibility of reverse engineering

Post by hadley »

Some light reading, to get started...

https://www.nxp.com/docs/en/reference-m ... 5249UM.pdf

If we find the vector table in this book, then match it up with the recurring pattern near the beginning of the firmware file, the XOR key (or half the bytes, at least) might pop out.

(Jesse perhaps you could add this pdf to the 'files' section ?)
hadley
General
General
Posts: 51
Joined: Thu May 01, 2008 8:43 pm

Re: Firmware-possibility of reverse engineering

Post by hadley »

kpr wrote: Thu Jun 03, 2021 12:57 pm In such cases, it is recommended to simply talk to one of the key developers. With Fusion, that was Bret Victor, a pretty awesome guy. You can get in touch with him here.

http://worrydream.com/#!/Alesis
Klaus thank you for that link to a really fascinating website.
hadley
General
General
Posts: 51
Joined: Thu May 01, 2008 8:43 pm

Re: Firmware-possibility of reverse engineering

Post by hadley »

More useful reference manuals:

https://www.nxp.com/docs/en/reference-manual/CFPRM.pdf

https://www.nxp.com/docs/en/reference-m ... 49C3UM.pdf

Does someone have high-resolution photos of the boards and chips inside the Fusion? Is there really a 9-pin RS232 D-sub connection on the board, as suggested in section 1.8.7 of this manual ?
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Re: Firmware-possibility of reverse engineering

Post by Jokeyman123 »

There are some photos posted somewhere here already. I have 2 partially functioning mainboards-one i removed from one of my Fusions, another that turned out to have a few defects purchased from InMusic in the US, who sent me a working replacement. I will photo and send if Jesse doesn't have these already here, I think he does. This is wonderful information-jesse has the service manual, if you PM Jesse about this-it has full schematics for the entire Fusion layout, all boards and interface controls. This project is looking forward, I had not been able to locate these Coldfire data sheets, this is excellent. An interesting surprise-the Coldfire is based-on-I think-the original Motorola CPU used in the Atari computers-which were designed heavily towards the earliest computer music functions. I think my first Atari 520ST-FM had the Motorola MT6000 referred to in this one data document. I only wish i were a better programmer and coder-for the right coder, this looks like there is a real possibility for re-writing the firmware to open up at least one-two functions now dormant. -I would be willing to be a beta-tester for a revised firmware with one of my Fusions if this comes to fruition. I have the service manual also, but would need Jesse's permission to send it to you via PM, there are still some licensing restrictions involved since Alesis is still a 'viable" company, we might be violating their copyright laws making this a public document. yes this is the same Motorola MT68000 CPU architecture, according to wikipedia in use for 40 years.
hadley
General
General
Posts: 51
Joined: Thu May 01, 2008 8:43 pm

Re: Firmware-possibility of reverse engineering

Post by hadley »

If we do ever manage to decrypt this firmware, the first modification I want is to make the 'default' program an analog sine. I'm fed up with constantly waiting for the Holy Grail sample to load.
User avatar
Jokeyman123
Moderator
Moderator
Posts: 278
Joined: Fri Nov 27, 2020 1:56 pm
Do you own a fusion?: Yes
Location: United States
Contact:

Re: Firmware-possibility of reverse engineering

Post by Jokeyman123 »

Right-this is in ROM-one of the many reasons cracking this open, interpreting what is there, and seeing if we can change some code. One of the inventors/creators has been contacted, we will wait and see if anything comes of this. Are you sure I shouldn't try to contact this programmer who did this with his Vortex? I bet he can do it. I'd contribute a payment to him if 1) it isn't too much money and 2) if there is any hope he could get into this and modify even a single thing that has been locked out. I'd imagine the Vortex might be a it easier to decipher-but not by much. A few key codes, we could be in.
User avatar
Arevyn
General
General
Posts: 100
Joined: Fri Oct 21, 2016 4:38 am
Do you own a fusion?: Yes

Re: Firmware-possibility of reverse engineering

Post by Arevyn »

I sometimes have wondered if a gofundme type page could ever garner enough attention to show the interest that still lies in some discontinued products like the Fusion. I know I would be happy to contribute. If not a monetary page, then trying to figure out what would be the best way to show that there is still an interest in a product that was killed before it saw its full potential
6HD+SSD - Alesis 8HD+SSD - Yamaha CP33 - Ibanez AS93 with Graphtech Acoustiphonic System - Washburn WI64DL - Taylor 214CE QM 2016 Anniversary - 1982 Washburn D28 - Fibes Acoustic Bop Drums - Roland TD9 Hybrid kit
Post Reply
  • Similar Topics
    Replies
    Views
    Last post