Bc2000 (for the BCF2000 & BCR2000)

Let's start...

It's an ARM7TDMI core in the OKI thingy, 


DISARM:
http://web.ukonline.co.uk/g.mccaughan/software/disarm.c-0.10

...

The thing boots directly on the firmware so just dump it if you can
(if someone can dump the FLASH with two different firmwares (and
indicate the version)).



b.

--- In bc2000@yahoogroups.com, "bjonnh" <bjonnh@...> wrote:
> DISARM:
> http://web.ukonline.co.uk/g.mccaughan/software/disarm.c-0.10

hello...could the above software be used to disassemble the 
firmware .syx file? i guess the hard part is understanding the 
disassmbled code...

ciao,
Goyya

>  > DISARM:
>  > http://web.ukonline.co.uk/g.mccaughan/software/disarm.c-0.10
>
>  hello...could the above software be used to disassemble the
>  firmware .syx file? i guess the hard part is understanding the
>  disassmbled code...
>
>  ciao,
>  Goyya
>
You don't need a disassembler to look at a sysex file, just use a hex
editor. It's just sysex

--- In bc2000@yahoogroups.com, "Tony Cappellini" <cappy2112@...> wrote:

> You don't need a disassembler to look at a sysex file, just use a hex
> editor. It's just sysex
>
yeah of course - i did it, but i didn't understand anything so i 
thought that the disassembler (maybe it's a disassembler targeted at 
that specific chip) could "translate" groups of bytes into more 
significant words/expressions etc...

I haven't been following this whole thread.
If that syx file contains firmware, then yes, a disassembler would help.
If it's just sysex to program the bcrs' knobs/buttons then it will be of no use

On Jan 3, 2008 9:54 AM, goyya76 <goyya76@...> wrote:
>
>
>
>
>
>
> --- In bc2000@yahoogroups.com, "Tony Cappellini" <cappy2112@...> wrote:
>
>  > You don't need a disassembler to look at a sysex file, just use a hex
>  > editor. It's just sysex
>  >
>  yeah of course - i did it, but i didn't understand anything so i
>  thought that the disassembler (maybe it's a disassembler targeted at
>  that specific chip) could "translate" groups of bytes into more
>  significant words/expressions etc...
>
>

The BC OS can be updated by sysex.
On a quick initial inspection these short sysex messages look to be of
the form
Header + 2 (possibly 3) flash address + OS data + $F7
If this is the case the OS data is scrambled (not in order) and so
will have to extracted into a block of memory to reorder it inside the
PC line by line then disassembled.

As the OS data is either 8 or 16 bit, 7 bit Midi will have to be
converted. I'm not sure what conversion is used.

The flash seems to be divided into 3 sections. My guess is a boot
loader, the main program and program data. 

There is this message about $200 bytes in
'be in control with the b-control by BEHRINGER hw/sw by Thomas Zint'

So thanks Thomas, my BCR2000 is great.

If you find how is the program data on the .syx encoded you can. But
it will be no help before that... Juste get an InstructionSheet of the
ARM7 and dig :p


--- In bc2000@yahoogroups.com, "Tony Cappellini" <cappy2112@...> wrote:

>
> >  > DISARM:
> >  > http://web.ukonline.co.uk/g.mccaughan/software/disarm.c-0.10
> >
> >  hello...could the above software be used to disassemble the
> >  firmware .syx file? i guess the hard part is understanding the
> >  disassmbled code...
> >
> >  ciao,
> >  Goyya
> >
> You don't need a disassembler to look at a sysex file, just use a hex
> editor. It's just sysex
>

It seems I can find data into the program code... I must dig into this... 

What I don't understand is that the bootloader jumps directly to an
invalid instruction code for the ARM7... (and I'm in the right endian
style as some parts of the program are coherent judging by jumps and
operations).

--- In bc2000@yahoogroups.com, "rpcfender" <rpcfender@...> wrote:

>
> The BC OS can be updated by sysex.
> On a quick initial inspection these short sysex messages look to be of
> the form
> Header + 2 (possibly 3) flash address + OS data + $F7
> If this is the case the OS data is scrambled (not in order) and so
> will have to extracted into a block of memory to reorder it inside the
> PC line by line then disassembled.
> 
> As the OS data is either 8 or 16 bit, 7 bit Midi will have to be
> converted. I'm not sure what conversion is used.
> 
> The flash seems to be divided into 3 sections. My guess is a boot
> loader, the main program and program data. 
> 
> There is this message about $200 bytes in
> 'be in control with the b-control by BEHRINGER hw/sw by Thomas Zint'
> 
> So thanks Thomas, my BCR2000 is great.
>

The problem with that "translation" is that your disassembler must
really understand your code. I'm jumping here so this location is
really code ... But I'm reading from here so it is data, ...
Disassembly is an art ;)

And some software developers put false instructions like "read data
@A0010" from one part of the program but in fact the data at @A0010 is
in fact instructions, ... (I don't know if my explanation is so
clear). But they use that in order to fool "intelligent disassemblers"
and so on automatic disassembly.

Take an ARM Instruction Sheet like this one:
http://www.simplemachines.it/doc/QRC0001H_rvct_v2.1_arm.pdf

But if you don't know anything about how assembler works and how to
understand assembler code, you would better start by something easier
than an hardware system firmware.


For those interested, I also made python programs to remove the sysex
 s firmware headers and footer for each packets and made individual
files for each of the blocks, ... 
And I found that between 1.07 and 1.10 for example some blocks are
identical in the sysex, so I think they have done that to provide
direct update from 1.03 (or lower maybe) and not incremental updates.


--- In bc2000@yahoogroups.com, "goyya76" <goyya76@...> wrote:

>
> --- In bc2000@yahoogroups.com, "Tony Cappellini" <cappy2112@> wrote:
> 
> > You don't need a disassembler to look at a sysex file, just use a hex
> > editor. It's just sysex
> >
> yeah of course - i did it, but i didn't understand anything so i 
> thought that the disassembler (maybe it's a disassembler targeted at 
> that specific chip) could "translate" groups of bytes into more 
> significant words/expressions etc...
>

Never miss a thing. Make Yahoo your homepage.

Hi all

I try to transmit a sysex preset I made. I can transfer it without 
errors. During the transfer I only see the MIDI In is flashing, but the 
LED does not circle.
After that I dont see my config on the actual preset. I tried a preset I 
made from Birdies Editor. And try to transfer with Birdie and midiox. I 
have firmware 1.10.

Carma

Are you using a USB cable? Or traditional Midi?

Karl

On Jan 18, 2008 10:51 AM, Carma Trepp <carma_trepp@...> wrote:
>
>
>
>
>
>
> Hi all
>
>  I try to transmit a sysex preset I made. I can transfer it without
>  errors. During the transfer I only see the MIDI In is flashing, but the
>  LED does not circle.
>  After that I dont see my config on the actual preset. I tried a preset I
>  made from Birdies Editor. And try to transfer with Birdie and midiox. I
>  have firmware 1.10.
>
>  Carma
>

Hi Steve,
I use PSpad all the time. It's great.
I even have a template for writing BCL. Anyone want a copy? 


--- In bc2000@yahoogroups.com, Steve Meiers <tekrytor@...> wrote:
>
> Maybe you already know about this and other tools for decoding 
soft/firmware, but there's a program called PSpad that is really a
text and hex editor. It allows you to make your own display templates,
which you can use to make the code more readable. Just a tip.

> 
> Steve M
> 
> oh yeah, pspad is freeware.
> 
>        
> ---------------------------------
> Never miss a thing.   Make Yahoo your homepage.
>

Hi Carma,
these sound like the symptoms you get when your BC has a device number
doesn't match the sysex. 

There are a few ways around this...
Change the Device ID. Enter Global Edit mode by pressing both "Store"
& "Edit" on the BC.
Encoder 5 (Top row) is the device ID. Start with Id 1 and see if this
fixes it.  "Exit" to get out of global mode before you send the sysex.

On Birdie's editor there is a dropdown box on the left near the top
labeled "SysId" Set it to match you BC Id or set it to 0x7F which
means ignore the Id
(0x is the  bit that says the number is in hexadecimal for the non C
programmers out there. 0x7F is the same as $7F in BCL)

I have fixed the ID setting in my editor. Make sure you have the
latest version.
Go to the "Save & Get" page and on the right there is a panel called
"Sysex Header Bytes" and the Id button is below this.
If it is set to "all" then it shouldn't matter what your BC is set to.

Let us know if this doesn't fix the problem.

Royce

--- In bc2000@yahoogroups.com, Carma Trepp <carma_trepp@...> wrote:
>
> Hi all
> 
> I try to transmit a sysex preset I made. I can transfer it without 
> errors. During the transfer I only see the MIDI In is flashing, but the 
> LED does not circle.
> After that I dont see my config on the actual preset. I tried a
preset I 

> made from Birdies Editor. And try to transfer with Birdie and midiox. I 
> have firmware 1.10.
> 
> Carma
>

A great thank you for your particular explanation Roys. I will test this 
in the evening.


rpcfender schrieb:

>
> Hi Carma,
> these sound like the symptoms you get when your BC has a device number
> doesn't match the sysex.
>
> There are a few ways around this...
> Change the Device ID. Enter Global Edit mode by pressing both "Store"
> & "Edit" on the BC.
> Encoder 5 (Top row) is the device ID. Start with Id 1 and see if this
> fixes it. "Exit" to get out of global mode before you send the sysex.
>
> On Birdie's editor there is a dropdown box on the left near the top
> labeled "SysId" Set it to match you BC Id or set it to 0x7F which
> means ignore the Id
> (0x is the bit that says the number is in hexadecimal for the non C
> programmers out there. 0x7F is the same as $7F in BCL)
>
> I have fixed the ID setting in my editor. Make sure you have the
> latest version.
> Go to the "Save & Get" page and on the right there is a panel called
> "Sysex Header Bytes" and the Id button is below this.
> If it is set to "all" then it shouldn't matter what your BC is set to.
>
> Let us know if this doesn't fix the problem.
>
> Royce
>
> --- In bc2000@yahoogroups.com <mailto:bc2000%40yahoogroups.com>, Carma 
> Trepp <carma_trepp@...> wrote:
> >
> > Hi all
> >
> > I try to transmit a sysex preset I made. I can transfer it without
> > errors. During the transfer I only see the MIDI In is flashing, but the
> > LED does not circle.
> > After that I dont see my config on the actual preset. I tried a
> preset I
> > made from Birdies Editor. And try to transfer with Birdie and midiox. I
> > have firmware 1.10.
> >
> > Carma
> >
>
>

Now I tried to send to the Interface BCR2000 and not BCR2000-A or B. Now 
its works. In the past I always got a Err22 Error over the BCR2000 
Interface. But now Its works.
Thank you Royce. Your Editor Is nice! Would be cool when the Editor have 
a search and replace function, to set multiple Parameters at one 
time(like MIDI Channel of all Elements, or edit Modes on all Push 
Encoders...etc).

Carma Trepp schrieb:

>
> Hi Royce
>
> I configured ID 1 and 2 on the BCR. Then I try it on your and birdies 
> editor. Same Problem with Device ID all(on your editor), and 1 or 2.
> Still only see the flashing light on the MIDI In.
>
> I tryed the connection over USB and a MIDI Interface.
>
> rpcfender schrieb:
>
>> Hi Carma,
>> these sound like the symptoms you get when your BC has a device number
>> doesn't match the sysex.
>>
>> There are a few ways around this...
>> Change the Device ID. Enter Global Edit mode by pressing both "Store"
>> & "Edit" on the BC.
>> Encoder 5 (Top row) is the device ID. Start with Id 1 and see if this
>> fixes it. "Exit" to get out of global mode before you send the sysex.
>>
>> On Birdie's editor there is a dropdown box on the left near the top
>> labeled "SysId" Set it to match you BC Id or set it to 0x7F which
>> means ignore the Id
>> (0x is the bit that says the number is in hexadecimal for the non C
>> programmers out there. 0x7F is the same as $7F in BCL)
>>
>> I have fixed the ID setting in my editor. Make sure you have the
>> latest version.
>> Go to the "Save & Get" page and on the right there is a panel called
>> "Sysex Header Bytes" and the Id button is below this.
>> If it is set to "all" then it shouldn't matter what your BC is set to.
>>
>> Let us know if this doesn't fix the problem.
>>
>> Royce
>>
>> --- In bc2000@yahoogroups.com <mailto:bc2000%40yahoogroups.com>, 
>> Carma Trepp <carma_trepp@...> wrote:
>> >
>> > Hi all
>> >
>> > I try to transmit a sysex preset I made. I can transfer it without
>> > errors. During the transfer I only see the MIDI In is flashing, but 
>> the
>> > LED does not circle.
>> > After that I dont see my config on the actual preset. I tried a
>> preset I
>> > made from Birdies Editor. And try to transfer with Birdie and 
>> midiox. I
>> > have firmware 1.10.
>> >
>> > Carma
>> >
>>
>
>

Hi Royce

After mutiple trials I get now the preset list. Sometimes it works 
sometime don`t. When I try to send your Script I get the following 
errors: http://img143.imageshack.us/my.php?image=screenhunter26gs9.jpg

I done this connected over USB. When I try to send It over other MIDI 
(or other MIDI Hub to), I only see the flashing MIDI in. But no config 
is updated.

Here one of my preset scripts:

$rev R1
$preset
.name 'Synth                   '
.snapshot off
.request off
.egroups 4
.fkeys on
.lock off
.init
$encoder 1
.easypar CC 1 1 0 127 absolute
.showvalue on
.mode 1dot
$encoder 2
.easypar CC 1 2 0 127 absolute
.showvalue on
.mode 1dot
$encoder 3
.easypar CC 1 3 0 127 absolute
.showvalue on
.mode 1dot
$encoder 4
.easypar CC 1 4 0 127 absolute
.showvalue on
.mode 1dot
$encoder 5
.easypar CC 1 5 0 127 absolute
.showvalue on
.mode 1dot
$encoder 6
.easypar CC 1 6 0 127 absolute
.showvalue on
.mode 1dot
$encoder 7
.easypar CC 1 7 0 127 absolute
.showvalue on
.mode 1dot
$encoder 8
.easypar CC 1 8 0 127 absolute
.showvalue on
.mode 1dot
$encoder 9
.easypar CC 1 9 0 127 absolute
.showvalue on
.mode 1dot
$encoder 10
.easypar CC 1 10 0 127 absolute
.showvalue on
.mode 1dot
$encoder 11
.easypar CC 1 11 0 127 absolute
.showvalue on
.mode 1dot
$encoder 12
.easypar CC 1 12 0 127 absolute
.showvalue on
.mode 1dot
$encoder 13
.easypar CC 1 13 0 127 absolute
.showvalue on
.mode 1dot
$encoder 14
.easypar CC 1 14 0 127 absolute
.showvalue on
.mode 1dot
$encoder 15
.easypar CC 1 15 0 127 absolute
.showvalue on
.mode 1dot
$encoder 16
.easypar CC 1 16 0 127 absolute
.showvalue on
.mode 1dot
$encoder 17
.easypar CC 1 17 0 127 absolute
.showvalue on
.mode 1dot
$encoder 18
.easypar CC 1 18 0 127 absolute
.showvalue on
.mode 1dot
$encoder 19
.easypar CC 1 19 0 127 absolute
.showvalue on
.mode 1dot
$encoder 20
.easypar CC 1 20 0 127 absolute
.showvalue on
.mode 1dot
$encoder 21
.easypar CC 1 21 0 127 absolute
.showvalue on
.mode 1dot
$encoder 22
.easypar CC 1 22 0 127 absolute
.showvalue on
.mode 1dot
$encoder 23
.easypar CC 1 23 0 127 absolute
.showvalue on
.mode 1dot
$encoder 24
.easypar CC 1 24 0 127 absolute
.showvalue on
.mode 1dot
$encoder 25
.easypar CC 1 25 0 127 absolute
.showvalue on
.mode 1dot
$encoder 26
.easypar CC 1 26 0 127 absolute
.showvalue on
.mode 1dot
$encoder 27
.easypar CC 1 27 0 127 absolute
.showvalue on
.mode 1dot
$encoder 28
.easypar CC 1 28 0 127 absolute
.showvalue on
.mode 1dot
$encoder 29
.easypar CC 1 29 0 127 absolute
.showvalue on
.mode 1dot
$encoder 30
.easypar CC 1 30 0 127 absolute
.showvalue on
.mode 1dot
$encoder 31
.easypar CC 1 31 0 127 absolute
.showvalue on
.mode 1dot
$encoder 32
.easypar CC 1 32 0 127 absolute
.showvalue on
.mode 1dot
$encoder 33
.easypar CC 1 81 0 127 absolute
.showvalue on
.mode 1dot
$encoder 34
.easypar CC 1 82 0 127 absolute
.showvalue on
.mode 1dot
$encoder 35
.easypar CC 1 83 0 127 absolute
.showvalue on
.mode 1dot
$encoder 36
.easypar CC 1 84 0 127 absolute
.showvalue on
.mode 1dot
$encoder 37
.easypar CC 1 85 0 127 absolute
.showvalue on
.mode 1dot
$encoder 38
.easypar CC 1 86 0 127 absolute
.showvalue on
.mode 1dot
$encoder 39
.easypar CC 1 87 0 127 absolute
.showvalue on
.mode 1dot
$encoder 40
.easypar CC 1 88 0 127 absolute
.showvalue on
.mode 1dot
$encoder 41
.easypar CC 1 89 0 127 absolute
.showvalue on
.mode 1dot
$encoder 42
.easypar CC 1 90 0 127 absolute
.showvalue on
.mode 1dot
$encoder 43
.easypar CC 1 91 0 127 absolute
.showvalue on
.mode 1dot
$encoder 44
.easypar CC 1 92 0 127 absolute
.showvalue on
.mode 1dot
$encoder 45
.easypar CC 1 93 0 127 absolute
.showvalue on
.mode 1dot
$encoder 46
.easypar CC 1 94 0 127 absolute
.showvalue on
.mode 1dot
$encoder 47
.easypar CC 1 95 0 127 absolute
.showvalue on
.mode 1dot
$encoder 48
.easypar CC 1 96 0 127 absolute
.showvalue on
.mode 1dot
$encoder 49
.easypar CC 1 97 0 127 absolute
.showvalue on
.mode 1dot
$encoder 50
.easypar CC 1 98 0 127 absolute
.showvalue on
.mode 1dot
$encoder 51
.easypar CC 1 99 0 127 absolute
.showvalue on
.mode 1dot
$encoder 52
.easypar CC 1 100 0 127 absolute
.showvalue on
.mode 1dot
$encoder 53
.easypar CC 1 101 0 127 absolute
.showvalue on
.mode 1dot
$encoder 54
.easypar CC 1 102 0 127 absolute
.showvalue on
.mode 1dot
$encoder 55
.easypar CC 1 103 0 127 absolute
.showvalue on
.mode 1dot
$encoder 56
.easypar CC 1 104 0 127 absolute
.showvalue on
.mode 1dot
$button 1
.easypar CC 1 33 127 0 down
.showvalue on
$button 2
.easypar CC 1 34 127 0 down
.showvalue on
$button 3
.easypar CC 1 35 127 0 down
.showvalue on
$button 4
.easypar CC 1 36 127 0 down
.showvalue on
$button 5
.easypar CC 1 37 127 0 down
.showvalue on
$button 6
.easypar CC 1 38 127 0 down
.showvalue on
$button 7
.easypar CC 1 39 127 0 down
.showvalue on
$button 8
.easypar CC 1 40 127 0 down
.showvalue on
$button 9
.easypar CC 1 41 127 0 down
.showvalue on
$button 10
.easypar CC 1 42 127 0 down
.showvalue on
$button 11
.easypar CC 1 43 127 0 down
.showvalue on
$button 12
.easypar CC 1 44 127 0 down
.showvalue on
$button 13
.easypar CC 1 45 127 0 down
.showvalue on
$button 14
.easypar CC 1 46 127 0 down
.showvalue on
$button 15
.easypar CC 1 47 127 0 down
.showvalue on
$button 16
.easypar CC 1 48 127 0 down
.showvalue on
$button 17
.easypar CC 1 49 127 0 down
.showvalue on
$button 18
.easypar CC 1 50 127 0 down
.showvalue on
$button 19
.easypar CC 1 51 127 0 down
.showvalue on
$button 20
.easypar CC 1 52 127 0 down
.showvalue on
$button 21
.easypar CC 1 53 127 0 down
.showvalue on
$button 22
.easypar CC 1 54 127 0 down
.showvalue on
$button 23
.easypar CC 1 55 127 0 down
.showvalue on
$button 24
.easypar CC 1 56 127 0 down
.showvalue on
$button 25
.easypar CC 1 57 127 0 down
.showvalue on
$button 26
.easypar CC 1 58 127 0 down
.showvalue on
$button 27
.easypar CC 1 59 127 0 down
.showvalue on
$button 28
.easypar CC 1 60 127 0 down
.showvalue on
$button 29
.easypar CC 1 61 127 0 down
.showvalue on
$button 30
.easypar CC 1 62 127 0 down
.showvalue on
$button 31
.easypar CC 1 63 127 0 down
.showvalue on
$button 32
.easypar CC 1 64 127 0 down
.showvalue on
$button 33
.easypar CC 1 65 127 0 down
.showvalue on
$button 34
.easypar CC 1 66 127 0 down
.showvalue on
$button 35
.easypar CC 1 67 127 0 down
.showvalue on
$button 36
.easypar CC 1 68 127 0 down
.showvalue on
$button 37
.easypar CC 1 69 127 0 down
.showvalue on
$button 38
.easypar CC 1 70 127 0 down
.showvalue on
$button 39
.easypar CC 1 71 127 0 down
.showvalue on
$button 40
.easypar CC 1 72 127 0 down
.showvalue on
$button 41
.easypar CC 1 73 127 0 down
.showvalue on
$button 42
.easypar CC 1 74 127 0 down
.showvalue on
$button 43
.easypar CC 1 75 127 0 down
.showvalue on
$button 44
.easypar CC 1 76 127 0 down
.showvalue on
$button 45
.easypar CC 1 77 127 0 down
.showvalue on
$button 46
.easypar CC 1 78 127 0 down
.showvalue on
$button 47
.easypar CC 1 79 127 0 down
.showvalue on
$button 48
.easypar CC 1 80 127 0 down
.showvalue on
$button 49
.easypar CC 1 105 127 0 down
.showvalue on
$button 50
.easypar CC 1 106 127 0 down
.showvalue on
$button 51
.easypar CC 1 107 127 0 down
.showvalue on
$button 52
.easypar CC 1 108 127 0 down
.showvalue on
$button 61
.easypar CC 1 109 127 0 down
.showvalue on
$button 62
.easypar CC 1 110 127 0 down
.showvalue on
$end

Hi Royce

I got the up to date Firmware 1.10 and drivers v1.213 on Windows.

In S-1 mode all works really fine, I can load all the Sysex Files!

Seems only the USB Connection make some problems. The Unit is still 
under warranty. But now I think its my Windows that makes some problems.

Carma

Hi Carma ,
perhaps we are going through similar things.

When I loaded the new drivers strange things happened at seemingly
random times.
Have the BCF/BCR on and go to the Win Device Manager
  (Right click My Computer and go to Properties then Hardware Tab then
Device Manager button)
To my surprise version 1.1.1.1 of the USB was still there.
Disable it , then delete it.
Turn off the BCR and reboot the PC (just to make sure).
Turn on the BCR and reinstall the new USB driver.
This worked for me today, I hope it solves your problems as well

Royce

--- In bc2000@yahoogroups.com, Carma Trepp <carma_trepp@...> wrote:
>
> Hi Royce
>
> I got the up to date Firmware 1.10 and drivers v1.213 on Windows.
>
> In S-1 mode all works really fine, I can load all the Sysex Files!
>
> Seems only the USB Connection make some problems. The Unit is still
> under warranty. But now I think its my Windows that makes some
problems.

>
> Carma
>

Got the current Driver: 
http://img103.imageshack.us/my.php?image=screenhunter27nv7.jpg

I think someday I will buy a Mac :P

But Its now ok for me, I can work, fortunatly :)

rpcfender schrieb:

>
> Hi Carma ,
> perhaps we are going through similar things.
>
> When I loaded the new drivers strange things happened at seemingly
> random times.
> Have the BCF/BCR on and go to the Win Device Manager
> (Right click My Computer and go to Properties then Hardware Tab then
> Device Manager button)
> To my surprise version 1.1.1.1 of the USB was still there.
> Disable it , then delete it.
> Turn off the BCR and reboot the PC (just to make sure).
> Turn on the BCR and reinstall the new USB driver.
> This worked for me today, I hope it solves your problems as well
>
> Royce
>
> --- In bc2000@yahoogroups.com <mailto:bc2000%40yahoogroups.com>, Carma 
> Trepp <carma_trepp@...> wrote:
> >
> > Hi Royce
> >
> > I got the up to date Firmware 1.10 and drivers v1.213 on Windows.
> >
> > In S-1 mode all works really fine, I can load all the Sysex Files!
> >
> > Seems only the USB Connection make some problems. The Unit is still
> > under warranty. But now I think its my Windows that makes some
> problems.
> >
> > Carma
> >
>
>

Just a quick note about custom firmware efforts.
I have been making some small steps toward decoding it.

The firmware flash memory is 512kb in size, split into 2 banks of
256kb. When you update the firmware via sysex, it writes to the bank
that is currently not in use and switches banks on reboot.

The good news is that the current BC2000 firmware only uses 68-72kb of
the 256kb available for a firmware, so there is quite a lot of room
for custom code in there.

There seems to be a boot-loader in the first 4kb of each bank that
never changes. Based on their FAQ, I suspect that this boot-loader is
capable of accepting a sysex firmware update via the MIDI-In port even
if the main firmware and USB code is corrupted. This means it should
be possible to experiment with writing a custom firmware without
completely bricking your BC2000.

My first short term goal is to decompile the 4kb boot-loader and
figure out how it decodes midi firmware update packets. I am currently
writing my own windows ARM disassembler for this purpose. Once I
figure out the sysex firmware encoding, I will make my disassembler
and a sysex decoder available so others can work on the firmware as well.

I have several ideas that could improve the BC2000 UI significantly
once we get deeper into the firmware:

1) A new LED display driver that uses Bit-Angle modulation to add 2 or
4-bits of brightness per LED would be nice:
http://www.artisticlicence.com/app%20notes/appnote011.pdf

2) Add more display modes for the lower encoder rings

3) Make the Encoder Group buttons apply to more controls than just the
top 8 encoders.

4) New LED ring display modes that can show information from 2
controllers, like filter frequency(dot position) and resonance (dot
width) or the way some of the Nordlead LED rings work (showing
default/current values).

-Dan G.

Some great ideas!!

I reckon it would also be cool if we could create the ability to hold
down a button and then click another button - sending an entirely new
midi message.

Karl

On Tue, Feb 26, 2008 at 9:05 AM, Dan Gendreau <gendreau@...> wrote:
>
>
>
>
>
>
> Just a quick note about custom firmware efforts.
>  I have been making some small steps toward decoding it.
>
>  The firmware flash memory is 512kb in size, split into 2 banks of
>  256kb. When you update the firmware via sysex, it writes to the bank
>  that is currently not in use and switches banks on reboot.
>
>  The good news is that the current BC2000 firmware only uses 68-72kb of
>  the 256kb available for a firmware, so there is quite a lot of room
>  for custom code in there.
>
>  There seems to be a boot-loader in the first 4kb of each bank that
>  never changes. Based on their FAQ, I suspect that this boot-loader is
>  capable of accepting a sysex firmware update via the MIDI-In port even
>  if the main firmware and USB code is corrupted. This means it should
>  be possible to experiment with writing a custom firmware without
>  completely bricking your BC2000.
>
>  My first short term goal is to decompile the 4kb boot-loader and
>  figure out how it decodes midi firmware update packets. I am currently
>  writing my own windows ARM disassembler for this purpose. Once I
>  figure out the sysex firmware encoding, I will make my disassembler
>  and a sysex decoder available so others can work on the firmware as well.
>
>  I have several ideas that could improve the BC2000 UI significantly
>  once we get deeper into the firmware:
>
>  1) A new LED display driver that uses Bit-Angle modulation to add 2 or
>  4-bits of brightness per LED would be nice:
>  http://www.artisticlicence.com/app%20notes/appnote011.pdf
>
>  2) Add more display modes for the lower encoder rings
>
>  3) Make the Encoder Group buttons apply to more controls than just the
>  top 8 encoders.
>
>  4) New LED ring display modes that can show information from 2
>  controllers, like filter frequency(dot position) and resonance (dot
>  width) or the way some of the Nordlead LED rings work (showing
>  default/current values).
>
>  -Dan G.
>
>

--- In bc2000@yahoogroups.com, "Karl Lurman" <karl.lurman@...> wrote:
> Some great ideas!!
> 
> I reckon it would also be cool if we could create the ability to hold
> down a button and then click another button - sending an entirely new
> midi message.
> 
> Karl

Yes, Modifier keys.

I had thought of that for the top encoders (like having encoder 1-8
send one message normally, but a different message while they are pressed.

Generalizing it to a shift key that affects certain buttons or
controls would be a better way to do it.

Lets hope it wont take too long to make sense of this firmware so we
can do some of these things.

-Dan G.

Hello,

Sorry if I missed something here, but where can I find that firmware dump?
Would be nice to take a look at it. Can you upload it to files section? Didn't
see it there.

> Just a quick note about custom firmware efforts.
> I have been making some small steps toward decoding it.
>

-- 
I like random noise generation, and when I grow up, I want to be random noise
generation too

    _o
 _-\<,_
(_)/ (_)

I don't think Lenny and Lawrence are looking for any others to be a part 
of their
group...  but yea.. RNG is sick!


Cheers,
Dave

Tadas Sasnauskas wrote:

>
>
> -- 
> I like random noise generation, and when I grow up, I want to be 
> random noise
> generation too
>
> **********
>
>
>

--- In bc2000@yahoogroups.com, "Dan Gendreau" <gendreau@...> wrote:
>
> Just a quick note about custom firmware efforts.
> I have been making some small steps toward decoding it.
> 
> The firmware flash memory is 512kb in size, split into 2 banks of
> 256kb. When you update the firmware via sysex, it writes to the bank
> that is currently not in use and switches banks on reboot.
> 
> The good news is that the current BC2000 firmware only uses 68-72kb of
> the 256kb available for a firmware, so there is quite a lot of room
> for custom code in there.
> 
> There seems to be a boot-loader in the first 4kb of each bank that
> never changes. Based on their FAQ, I suspect that this boot-loader is
> capable of accepting a sysex firmware update via the MIDI-In port even
> if the main firmware and USB code is corrupted. This means it should
> be possible to experiment with writing a custom firmware without
> completely bricking your BC2000.
> 
> My first short term goal is to decompile the 4kb boot-loader and
> figure out how it decodes midi firmware update packets.

As you may have noticed, BC Manager 1.0 includes a routine that
upgrades the BCF/BCR's firmware by means of the syx-firmware files
published by Behringer.
A firmware syx-file for the BCR defines 16 sections of 16 SysEx
messages, each message encrypting 256 bytes of actual firmware. So all
in all exactly 64 kB is upgraded. For the BCF there are 17 sections,
i.e. 68 kB.
An upgrade operation causes the display of the BCF/BCR to flash each
section's internal address while their 16 SysEx messages are being
been received (or HAVE been received? I forget which). In any case,
the first address shown is indeed "2". So there's a strong suggestion
that the area before section 2 is "fixed" and contains among other
things the decrypting algorithm.

I also intended to include firmware syx-file decrypting/encrypting
routines in BC Manager 1.0. To that end I managed to crack several
stages of the BCF/BCR's firmware encryption method. Unfortunately I
haven't been able to crack it completely, but it would help enormously
if I could see the actual firmware lifted from the ROM chip. Maybe I
haven't looked well, but I haven't seen any of this data in the files
section of the Yahoo group, so could someone send this to me?

By the way, it would also help if someone could send me firmware
syx-files for versions other than 1.07 and 1.10. (Were any other
versions ever available from the Behringer website?)

Mark.