<![CDATA[Elektronmods - All Forums]]> https://elektronmods.com/ Sat, 14 Nov 2026 02:13:18 +0000 MyBB <![CDATA[Question about sample capacity with the Modded-Cycles FW upgrade]]> https://elektronmods.com/showthread.php?tid=98 Thu, 12 Nov 2026 05:12:36 +0000 MoeShinola1@mail.com]]> https://elektronmods.com/showthread.php?tid=98 <![CDATA[Aggregat: one place to find Elektron mods, and everything you need to build your own]]> https://elektronmods.com/showthread.php?tid=97 Wed, 11 Nov 2026 22:22:28 +0000 70b185]]> https://elektronmods.com/showthread.php?tid=97 Mods for Elektron boxes are spread across dozens of repos, threads and Discords, and so is the knowledge behind them. Aggregat brings both together in one place:
https://70b185.github.io/Aggregat/ (website)
https://github.com/70b185/Aggregat (repo)
It’s meant for two kinds of people: those looking for a mod who want an overview of what exists for their device, and those who want to develop mods and need to know how the hardware works, what others have already built and what has gone wrong before.
It currently covers 263 projects: the Digitakt and Digitone families, Syntakt and Analog Heat in depth; Octatrack, Rytm, A4, Model:Cycles/Samples, Machinedrum and Monomachine as a catalogue. It holds only metadata and short notes in my own words: no firmware, no binaries, no copied code. Every entry links to the original project and says where the information came from.
If you’re looking for mods If you want to develop mods Everything is collected from public repos, READMEs and threads, so it’s second-hand. Please check addresses and byte patterns against the original project before relying on them.
How you can help
  • Corrections first. If something about your project is wrong, missing or out of date (OS versions, test status, the memory your mod uses), reply here, or open an issue or pull request on GitHub.
  • Run a five-minute test on your stock unit, no flashing needed (read your unit’s IDs, check whether unsaved edits survive a power cycle, film a cold start…). Each result answers a question mod developers are currently guessing about. Failures are as useful as successes.
    https://70b185.github.io/Aggregat/?t=stock_tests
]]> Mods for Elektron boxes are spread across dozens of repos, threads and Discords, and so is the knowledge behind them. Aggregat brings both together in one place:
https://70b185.github.io/Aggregat/ (website)
https://github.com/70b185/Aggregat (repo)
It’s meant for two kinds of people: those looking for a mod who want an overview of what exists for their device, and those who want to develop mods and need to know how the hardware works, what others have already built and what has gone wrong before.
It currently covers 263 projects: the Digitakt and Digitone families, Syntakt and Analog Heat in depth; Octatrack, Rytm, A4, Model:Cycles/Samples, Machinedrum and Monomachine as a catalogue. It holds only metadata and short notes in my own words: no firmware, no binaries, no copied code. Every entry links to the original project and says where the information came from.
If you’re looking for mods If you want to develop mods Everything is collected from public repos, READMEs and threads, so it’s second-hand. Please check addresses and byte patterns against the original project before relying on them.
How you can help
  • Corrections first. If something about your project is wrong, missing or out of date (OS versions, test status, the memory your mod uses), reply here, or open an issue or pull request on GitHub.
  • Run a five-minute test on your stock unit, no flashing needed (read your unit’s IDs, check whether unsaved edits survive a power cycle, film a cold start…). Each result answers a question mod developers are currently guessing about. Failures are as useful as successes.
    https://70b185.github.io/Aggregat/?t=stock_tests
]]> <![CDATA[Digitakt 1 One Shot+ Mode Mod?]]> https://elektronmods.com/showthread.php?tid=96 Mon, 09 Nov 2026 10:34:50 +0000 pmj]]> https://elektronmods.com/showthread.php?tid=96
Ideally it'd be an additional mode where without the sequencer running you can just push a button and have something loop and then push it again when you want it to stop. Eight of those available. All the SRC and FX buttons can still be used in real time along with the copy and paste to get back to a different state.

Having to use 1st conditional triggers and infinitely open envelopes on the amp page to achieve this with the stock firmware is needlessly clunky imo.]]>
Ideally it'd be an additional mode where without the sequencer running you can just push a button and have something loop and then push it again when you want it to stop. Eight of those available. All the SRC and FX buttons can still be used in real time along with the copy and paste to get back to a different state.

Having to use 1st conditional triggers and infinitely open envelopes on the amp page to achieve this with the stock firmware is needlessly clunky imo.]]> <![CDATA[Digitakt 2 internal battery mod]]> https://elektronmods.com/showthread.php?tid=95 Sun, 08 Nov 2026 20:32:45 +0000 Moos]]> https://elektronmods.com/showthread.php?tid=95
.jpg   IMG_3930.jpg (Size: 157.7 KB / Downloads: 105)

.jpg   IMG_3860.jpg (Size: 119.68 KB / Downloads: 91)

.jpg   IMG_3861.jpg (Size: 146.52 KB / Downloads: 89)

.jpg   D64FABB0-AA67-4CD1-9F1C-AE8F1B3C70F9.jpg (Size: 422.03 KB / Downloads: 88)

.jpg   c2c3d1d4-42aa-4aa8-abc7-0e2c89a8b892.jpg (Size: 220.08 KB / Downloads: 64)

.jpg   IMG_3931.jpg (Size: 120.2 KB / Downloads: 90)
Hi all. 

I wanted a battery mod for the digitakt after having sold my op1 and opz.
The plus side is that I can charge the digitakt with my usb c phone charger and use it on the go. 
I’ve attached some images and the schematic. All in all it cost me around 50 

I used Claude to debug the project and as such, I’ve asked it to write a description which is very accurate:

What you need
Tools:
  • Drill
  • Dremel with a milling bit
  • Soldering iron and solder
  • Multimeter (you need it to set the converters)
  • Kapton tape and heatshrink
Parts:
  • 20 AWG wire
  • USB-C Power Delivery trigger board, set to 9 V
  • Boost converter (XL6009, buck-boost version), set to 15 V
  • CC/CV buck converter (XL4015), set to 12.6 V and about 1 A
  • 1N5822 Schottky diode
  • 3S common-port BMS with its balance lead (I used a Daly)
  • 3× 21700 cells (Samsung INR21700-50E, 4900 mAh) plus holders
  • 3 A slow-blow fuse with holder
  • Optional: a TP4056 single-cell charger, to pre-balance the cells
How it works
The battery is wired straight onto the Digitakt's DC input, before the power switch. The original switch therefore turns the battery side on and off too, and nothing drains the pack while the Digitakt is off. The USB-C side is purely a charger: PD board (9 V) → boost to 15 V → CC/CV buck to 12.6 V → diode → pack. The diode stops the battery from leaking back into the charging electronics.
Steps
  1. Charge each cell separately to 4.2 V, for example with a TP4056. Make sure they're within about 0.05 V of each other. The cheap BMS boards balance poorly, so start balanced.
  2. Build the pack and connect the BMS. I number the cells the way Daly does: cell 1 sits at the pack's minus, cell 3 at the plus.
    • Wire the cells in series: cell 1 + → cell 2 −, and cell 2 + → cell 3 −.
    • Pack − (cell 1 −) → BMS B− with a thick wire.
    • Solder the balance leads, but don't plug the connector into the BMS yet:
      • B0 → cell 1 − (pack −)
      • B1 → the cell 1 + / cell 2 − joint
      • B2 → the cell 2 + / cell 3 − joint
      • B3 → cell 3 + (pack +), directly at the cell, not after the fuse

    • Check with a multimeter, black probe on B0. B1 should read about 4.2 V, B2 about 8.4 V, B3 about 12.6 V. If any reading is off, fix it before going on, because a wrong balance lead can destroy the BMS.
    • Only then plug the balance connector into the BMS.
    • Put the fuse right at the pack + terminal (cell 3 +). The other end of the fuse is your "pack +" from here on.

  3. Set the converters before connecting them to anything:
    • PD board to 9 V (and save it as the default)
    • XL6009 to 15 V
    • XL4015 to 12.6 V without load, measured before the diode, and the current limit to about 0.8–1 A

  4. Wire the charge path:
    • PD board → XL6009 → XL4015 IN.
    • XL4015 OUT+ → diode (stripe toward the battery) → pack +.
    • XL4015 OUT− → BMS P−.
    • Important: the PD board's and XL6009's minus go only to the XL4015 IN−, never directly to P−. Otherwise you bypass the XL4015's current limit.

  5. Connect pack + and BMS P− to the + and − pins of the Digitakt's DC jack. These are before the power switch, which on the DT2 cuts both + and −.
  6. Drill and mill a slot for the USB-C port, and mount everything securely with Kapton tape over all bare metal.
  7. Test before closing it up. Unplug USB, switch the Digitakt off, and measure the pack voltage at the DC jack. Then do a first charge while keeping an eye on things, and check that nothing gets more than warm.
Result
  • It runs fully off the battery, and the power switch works as normal.
  • It charges from any USB-C phone charger that offers 9 V PD. The original Elektron PSU also still charges the battery.
  • You can plug and unplug USB while playing without it hiccupping. Charging while playing works too, but slowly.
  • Expected runtime is around 4 hours on my 3 × 4900 mAh pack. I'll update once I've done a full run-down test.
Disclaimer: lithium cells inside a closed case are no joke, so do this at your own risk. Only use the original Elektron PSU on the DC jack, not a stronger supply. Opening the case probably voids your warranty.]]>
.jpg   IMG_3930.jpg (Size: 157.7 KB / Downloads: 105)

.jpg   IMG_3860.jpg (Size: 119.68 KB / Downloads: 91)

.jpg   IMG_3861.jpg (Size: 146.52 KB / Downloads: 89)

.jpg   D64FABB0-AA67-4CD1-9F1C-AE8F1B3C70F9.jpg (Size: 422.03 KB / Downloads: 88)

.jpg   c2c3d1d4-42aa-4aa8-abc7-0e2c89a8b892.jpg (Size: 220.08 KB / Downloads: 64)

.jpg   IMG_3931.jpg (Size: 120.2 KB / Downloads: 90)
Hi all. 

I wanted a battery mod for the digitakt after having sold my op1 and opz.
The plus side is that I can charge the digitakt with my usb c phone charger and use it on the go. 
I’ve attached some images and the schematic. All in all it cost me around 50 

I used Claude to debug the project and as such, I’ve asked it to write a description which is very accurate:

What you need
Tools:
  • Drill
  • Dremel with a milling bit
  • Soldering iron and solder
  • Multimeter (you need it to set the converters)
  • Kapton tape and heatshrink
Parts:
  • 20 AWG wire
  • USB-C Power Delivery trigger board, set to 9 V
  • Boost converter (XL6009, buck-boost version), set to 15 V
  • CC/CV buck converter (XL4015), set to 12.6 V and about 1 A
  • 1N5822 Schottky diode
  • 3S common-port BMS with its balance lead (I used a Daly)
  • 3× 21700 cells (Samsung INR21700-50E, 4900 mAh) plus holders
  • 3 A slow-blow fuse with holder
  • Optional: a TP4056 single-cell charger, to pre-balance the cells
How it works
The battery is wired straight onto the Digitakt's DC input, before the power switch. The original switch therefore turns the battery side on and off too, and nothing drains the pack while the Digitakt is off. The USB-C side is purely a charger: PD board (9 V) → boost to 15 V → CC/CV buck to 12.6 V → diode → pack. The diode stops the battery from leaking back into the charging electronics.
Steps
  1. Charge each cell separately to 4.2 V, for example with a TP4056. Make sure they're within about 0.05 V of each other. The cheap BMS boards balance poorly, so start balanced.
  2. Build the pack and connect the BMS. I number the cells the way Daly does: cell 1 sits at the pack's minus, cell 3 at the plus.
    • Wire the cells in series: cell 1 + → cell 2 −, and cell 2 + → cell 3 −.
    • Pack − (cell 1 −) → BMS B− with a thick wire.
    • Solder the balance leads, but don't plug the connector into the BMS yet:
      • B0 → cell 1 − (pack −)
      • B1 → the cell 1 + / cell 2 − joint
      • B2 → the cell 2 + / cell 3 − joint
      • B3 → cell 3 + (pack +), directly at the cell, not after the fuse

    • Check with a multimeter, black probe on B0. B1 should read about 4.2 V, B2 about 8.4 V, B3 about 12.6 V. If any reading is off, fix it before going on, because a wrong balance lead can destroy the BMS.
    • Only then plug the balance connector into the BMS.
    • Put the fuse right at the pack + terminal (cell 3 +). The other end of the fuse is your "pack +" from here on.

  3. Set the converters before connecting them to anything:
    • PD board to 9 V (and save it as the default)
    • XL6009 to 15 V
    • XL4015 to 12.6 V without load, measured before the diode, and the current limit to about 0.8–1 A

  4. Wire the charge path:
    • PD board → XL6009 → XL4015 IN.
    • XL4015 OUT+ → diode (stripe toward the battery) → pack +.
    • XL4015 OUT− → BMS P−.
    • Important: the PD board's and XL6009's minus go only to the XL4015 IN−, never directly to P−. Otherwise you bypass the XL4015's current limit.

  5. Connect pack + and BMS P− to the + and − pins of the Digitakt's DC jack. These are before the power switch, which on the DT2 cuts both + and −.
  6. Drill and mill a slot for the USB-C port, and mount everything securely with Kapton tape over all bare metal.
  7. Test before closing it up. Unplug USB, switch the Digitakt off, and measure the pack voltage at the DC jack. Then do a first charge while keeping an eye on things, and check that nothing gets more than warm.
Result
  • It runs fully off the battery, and the power switch works as normal.
  • It charges from any USB-C phone charger that offers 9 V PD. The original Elektron PSU also still charges the battery.
  • You can plug and unplug USB while playing without it hiccupping. Charging while playing works too, but slowly.
  • Expected runtime is around 4 hours on my 3 × 4900 mAh pack. I'll update once I've done a full run-down test.
Disclaimer: lithium cells inside a closed case are no joke, so do this at your own risk. Only use the original Elektron PSU on the DC jack, not a stronger supply. Opening the case probably voids your warranty.]]> <![CDATA[Elek View. See your devices screens in a browser via webmidi]]> https://elektronmods.com/showthread.php?tid=93 Mon, 02 Nov 2026 18:27:08 +0000 blueSGL]]> https://elektronmods.com/showthread.php?tid=93 https://bluesgl.github.io/Elek_View/ < Be sure not to have any other program accessing midi (DAWs/Electron Transfer/other webmidi/etc)
Tested with a DT2 and M:C also confirmed working with the Analog Heat MkII < If you try it with anything else let me know and I will add it!

This is requesting then displaying the current screen data via a built in debug sysex command. 

  1. click "Connect Webmidi"
  2. click the dropdown and select your device, and click "Start"
This is a .html implementation of the work already done here: https://github.com/jakobbak/screendump

.png   Elek_view_Multi_Screen.png (Size: 45.71 KB / Downloads: 453) ]]> https://bluesgl.github.io/Elek_View/ < Be sure not to have any other program accessing midi (DAWs/Electron Transfer/other webmidi/etc)
Tested with a DT2 and M:C also confirmed working with the Analog Heat MkII < If you try it with anything else let me know and I will add it!

This is requesting then displaying the current screen data via a built in debug sysex command. 

  1. click "Connect Webmidi"
  2. click the dropdown and select your device, and click "Start"
This is a .html implementation of the work already done here: https://github.com/jakobbak/screendump

.png   Elek_view_Multi_Screen.png (Size: 45.71 KB / Downloads: 453) ]]> <![CDATA[Analog Heat FX+ MultiMode. Beta 0.1.]]> https://elektronmods.com/showthread.php?tid=92 Mon, 02 Nov 2026 09:28:26 +0000 sapfir365karat]]> https://elektronmods.com/showthread.php?tid=92 Hi everyone! I’m making a custom firmware for Heat FX — here are the first results! I’ll soon post a GitHub link with the modified firmware! Stay tuned!

.png   square-cropped-1793611567464.png (Size: 155.74 KB / Downloads: 169)

.png   square-cropped-1793611546264.png (Size: 159.42 KB / Downloads: 159)

.png   square-cropped-1793611526963.png (Size: 163.27 KB / Downloads: 156)

.png   square-cropped-1793611508765.png (Size: 161.17 KB / Downloads: 157)

.png   square-cropped-1793611489179.png (Size: 151.13 KB / Downloads: 155)

.png   square-cropped-1793611377512.png (Size: 150.22 KB / Downloads: 156)

.png   square-cropped-1793611364003.png (Size: 139.63 KB / Downloads: 155)

.png   square-cropped-1793611348527.png (Size: 150.61 KB / Downloads: 157)

.png   square-cropped-1793611317511.png (Size: 77 KB / Downloads: 155) ]]> Hi everyone! I’m making a custom firmware for Heat FX — here are the first results! I’ll soon post a GitHub link with the modified firmware! Stay tuned!

.png   square-cropped-1793611567464.png (Size: 155.74 KB / Downloads: 169)

.png   square-cropped-1793611546264.png (Size: 159.42 KB / Downloads: 159)

.png   square-cropped-1793611526963.png (Size: 163.27 KB / Downloads: 156)

.png   square-cropped-1793611508765.png (Size: 161.17 KB / Downloads: 157)

.png   square-cropped-1793611489179.png (Size: 151.13 KB / Downloads: 155)

.png   square-cropped-1793611377512.png (Size: 150.22 KB / Downloads: 156)

.png   square-cropped-1793611364003.png (Size: 139.63 KB / Downloads: 155)

.png   square-cropped-1793611348527.png (Size: 150.61 KB / Downloads: 157)

.png   square-cropped-1793611317511.png (Size: 77 KB / Downloads: 155) ]]> <![CDATA[Model (Cycles) Flasher: Mix and match the different mods?]]> https://elektronmods.com/showthread.php?tid=91 Sun, 01 Nov 2026 03:27:58 +0000 Frog Stew]]> https://elektronmods.com/showthread.php?tid=91
 Please make a mix-and-match flasher for these cycles mods.  

Or if I missed it, please drop a link, Thanks.]]>
 Please make a mix-and-match flasher for these cycles mods.  

Or if I missed it, please drop a link, Thanks.]]> <![CDATA[Overtone - Custom Digitone 2 Firmware]]> https://elektronmods.com/showthread.php?tid=90 Fri, 30 Oct 2026 11:08:06 +0000 complex-ping]]> https://elektronmods.com/showthread.php?tid=90 New machines (pick them with [FUNC] + [SYN] like any other):
  • SOPHIE: percussive metal, pipes and kicks, a port of Matt Estela’s Schwung Sophie
  • MACHINEDRUM: the Machinedrum’s TRX, EFM and P-I families, ported from its own sound engine
  • LOOP: an always-recording looper per track, with time-stretch and slices; it records a track, the main mix or the input
  • THRU: runs another track’s sound through this track’s filter, envelopes and effects
Insert effects on every track: FLNG, PHSR, CHOR, REVB (the Monomachine’s), before or after the filter, with p-locks and LFO modulation.
Modulation: two LFOs, two envelope followers and two arpeggiators per sound. Every knob of each is a modulation destination for the others. ARP 1 can lock to the keyboard scale, and ARP 2 works as a step modulator.
GROOVE replaces swing. Each step of a cycle gets a weight, and the bar stays in time. It includes:
  • MPC-style swing presets plus shuffle, push, lazy and quintuplet feels
  • DRIFT, which moves the groove a little differently every cycle and can be modulated by an LFO
  • random grooves: hold [TEMPO] and press [YES]
Playing: parameter slides between trigs (SLD / SLEN on TRIG page 2), and knobs that show the value actually playing (p-locks, slides, LFOs).
Install: no firmware file is shared. A small Python patcher turns Elektron’s own OS 1.12 download into Overtone on your computer, checks the result byte for byte against the tested build, and you send it with Transfer. Going back to Elektron’s OS works the same way.
Download, install steps and every control:
https://github.com/complex-ping/overtone

New features are coming as well. Please let me know in case you find any bugs or performance issues.

Not made or supported by Elektron. Built with Claude Code; every build runs about 160 checks in a ColdFire and a SHARC emulator before it reaches a unit.]]> New machines (pick them with [FUNC] + [SYN] like any other):
  • SOPHIE: percussive metal, pipes and kicks, a port of Matt Estela’s Schwung Sophie
  • MACHINEDRUM: the Machinedrum’s TRX, EFM and P-I families, ported from its own sound engine
  • LOOP: an always-recording looper per track, with time-stretch and slices; it records a track, the main mix or the input
  • THRU: runs another track’s sound through this track’s filter, envelopes and effects
Insert effects on every track: FLNG, PHSR, CHOR, REVB (the Monomachine’s), before or after the filter, with p-locks and LFO modulation.
Modulation: two LFOs, two envelope followers and two arpeggiators per sound. Every knob of each is a modulation destination for the others. ARP 1 can lock to the keyboard scale, and ARP 2 works as a step modulator.
GROOVE replaces swing. Each step of a cycle gets a weight, and the bar stays in time. It includes:
  • MPC-style swing presets plus shuffle, push, lazy and quintuplet feels
  • DRIFT, which moves the groove a little differently every cycle and can be modulated by an LFO
  • random grooves: hold [TEMPO] and press [YES]
Playing: parameter slides between trigs (SLD / SLEN on TRIG page 2), and knobs that show the value actually playing (p-locks, slides, LFOs).
Install: no firmware file is shared. A small Python patcher turns Elektron’s own OS 1.12 download into Overtone on your computer, checks the result byte for byte against the tested build, and you send it with Transfer. Going back to Elektron’s OS works the same way.
Download, install steps and every control:
https://github.com/complex-ping/overtone

New features are coming as well. Please let me know in case you find any bugs or performance issues.

Not made or supported by Elektron. Built with Claude Code; every build runs about 160 checks in a ColdFire and a SHARC emulator before it reaches a unit.]]> <![CDATA[Model Cycle - Someone made a sequene generator, can we add it to Modded ?]]> https://elektronmods.com/showthread.php?tid=89 Wed, 28 Oct 2026 22:48:04 +0000 incent]]> https://elektronmods.com/showthread.php?tid=89 Modded-Cycles: Sequence GeneratorAveyYouTube · loads when you click play ]]> Modded-Cycles: Sequence GeneratorAveyYouTube · loads when you click play ]]> <![CDATA[Model Cycles Basics]]> https://elektronmods.com/showthread.php?tid=88 Sat, 24 Oct 2026 22:44:31 +0000 klausklaerwerk]]> https://elektronmods.com/showthread.php?tid=88 I just want some basic stuff:

Attack parameter
2nd LFO (not 3 and 4, cycling through them is annoying)
Trig preview
Latch mute mode
Slide trigs
Portamento
Link tracks
Only SY Bits and SY Swarm from Syntakt, no other additional machines.

Can someone make this happen? I know most of it is available in different mods but I don't want all the additional stuff that comes with them. More features mean more potential bugs, more confusing key combos and higher risk of driving the CPU too hot.

Thanks!]]> I just want some basic stuff:

Attack parameter
2nd LFO (not 3 and 4, cycling through them is annoying)
Trig preview
Latch mute mode
Slide trigs
Portamento
Link tracks
Only SY Bits and SY Swarm from Syntakt, no other additional machines.

Can someone make this happen? I know most of it is available in different mods but I don't want all the additional stuff that comes with them. More features mean more potential bugs, more confusing key combos and higher risk of driving the CPU too hot.

Thanks!]]> <![CDATA[Tonverk ...what I found out some time ago about it]]> https://elektronmods.com/showthread.php?tid=87 Fri, 23 Oct 2026 18:56:33 +0000 petedorky]]> https://elektronmods.com/showthread.php?tid=87
Code:
# Tonverk OS - Reverse Engineering Notes ## Device Info - **Product**: Elektron Tonverk (Eimur) - **Manufacturer**: Elektron Music Machines - **Serial**: A0xxxxxxxx-42 - **USB VID/PID**: 6453 / 4138 - **SoC**: NXP i.MX8M Plus QuadLite (MIMX8ML4DVNLZAB) — ARM Cortex-A53, no GPU/NPU - **RAM**: Micron 8GB LPDDR4 (MT53E2G32D4DE-046, D8CJN) - **eMMC**: SanDisk 8GB (SDINBDG4-8G, 44B2DPDGE0LH) - **WiFi/BT**: AzureWave AW-CM276NF (WiFi 5 + BT 5.0) — shares UART with `bt_or_console` - **Audio Codec**: Cirrus Logic CS42526 (2-ch ADC + 6-ch DAC) - **PCB**: PCBH2053, © 2024 Elektron, board ref `X-18ASA00230D002` - **Firmware Version**: 1.2.1 - **bcdDevice**: 1554 (fw revision 0612) ## Firmware Structure The firmware is distributed as a `.swu` file (SWUpdate CPIO archive, 109 MB). ### Extracted Contents (`Tonverk-OS-1.2.1.swu`) | File | Size | Description | |------|------|-------------| | `sw-description` | 5.8 KB | SWUpdate metadata (encrypted/binary) | | `sw-description.sig` | 384 bytes | Cryptographic signature (RSA-3072 or ECDSA-P384) | | `mb-image-release-esp5-mb.rootfs-rootfs.squashfs` | 48 MB | Main root filesystem (encrypted) | | `mb-image-release-esp5-mb.rootfs-apps.squashfs` | 13 MB | Apps partition (encrypted) | | `mb-image-release-esp5-mb.rootfs-rescue.fit` | 26 MB | Rescue/recovery image (encrypted) | | `mb-image-release-esp5-mb.rootfs.fit` | 22 MB | Main boot FIT image (encrypted) | | `flash.bin-esp5-mb-mb0.signed` | 938 KB | Signed U-Boot bootloader (slot 0) | | `flash.bin-esp5-mb-mb1.signed` | 938 KB | Signed U-Boot bootloader (slot 1) | | `bootscript-release.fit` | 3.8 KB | U-Boot boot script (FIT wrapped, readable) | | `DEMO.tar.gz` | 87 KB | Demo project (LevelDB database with kits/presets) | | `esp5-update.sh` | 483 bytes | Post-install script for SWUpdate | ### Encryption Status - All `.squashfs` and `.fit` images are **fully encrypted** (AES or similar) - Entropy analysis confirms flat maximum entropy across entire files - no structure visible - `sasquatch` and standard `unsquashfs` cannot read them (non-standard magic bytes, not just vendor-modified SquashFS) - `binwalk v3.1.0` finds zero signatures inside the encrypted images - The bootloader (`flash.bin`) is **not encrypted** but is **signed** (HAB - High Assurance Boot) ### SWUpdate Signing The `.swu` package uses cryptographic signing: 1. `sw-description` contains image metadata + SHA256 hashes 2. `sw-description.sig` signs the description with a 384-byte signature 3. Reflashing modified firmware requires Elektron's private signing key - **not feasible** ## SoC Details (NXP i.MX8MP) Extracted from bootloader strings: ### Peripherals found in device tree - **2x Ethernet**: `ethernet@30be0000`, `ethernet@30bf0000` (FEC, i.MX8MP-FEC) - **4x UART/Serial**:   - `serial@30860000` (SPBA bus)   - `serial@30880000` (SPBA bus)   - `serial@30890000` (SPBA bus)   - `serial@30a60000` - **2x USB**: `usb@32e40000`, `usb@32e50000` (DWC3 controller, `dr_mode` present) - **GPIO**: 5 banks (`gpio@30200000` through `gpio@30240000`) - **I2C, SPI (ECSPI), CAN (FlexCAN), DSP, MIPI-DSI, LCDIF** - **USB-C connector** referenced in device tree ### Console Configuration (Release Firmware) ``` stdin  = nulldev      # Serial input DISABLED in release builds stdout = serial      # Serial output goes to UART (read-only) stderr = serial      # Errors go to UART ``` **Important**: There is a `bt_or_console` variable in the bootloader, suggesting one UART is **shared between Bluetooth and debug console**. In debug/development builds, this UART likely serves as a full interactive console. ### Boot Storage - **eMMC** (mmc device 2):   - Partition 1: rescue image   - Partition 2: bootscript (`bootscript.fit`)   - Partition 3: root filesystems (`rootA` / `rootB` for A/B updates) - **`/data` partition**: writable, stores factory projects, demo content, user data ## Boot Flow & Rescue Mode Extracted from `bootscript-release.fit`: ### Normal Boot Sequence 1. U-Boot loads `bootscript.fit` from eMMC partition 2 2. Sets `dtb_conf=esp5`, constructs board revision from `hw_bom` 3. Checks for rescue/recovery conditions (see below) 4. Loads `fitImage` from `activeroot` (rootA or rootB) on partition 3 5. Boots with `bootm` 6. Falls back to rescue if boot fails ### Rescue Mode Triggers ``` # USER-REQUESTED RESCUE (button combo) if test "${ui-alive}" = "true" && test "${ui-int}" = "true"; then     setenv request_rescue "user-requested" # INTERRUPTED UPDATE if test -n "${recovery_status}"; then     setenv update_failed "interrupted" # ROLLBACK (boot failed after update) if test -n "${upgraderoot}" && test "${bootcount}" != "1"; then     setenv update_failed "rollback" ``` **`ui-alive`** and **`ui-int`** are U-Boot env vars set by the front panel MCU. When both are `true`, the device enters **user-requested rescue mode**. This is the most promising entry point. ### How to Trigger Rescue Mode Based on Elektron's standard patterns and the bootscript variables: 1. **Power off the Tonverk completely** 2. **Hold the main encoder pressed** (this likely sets `ui-int=true` via the UI MCU) 3. **Power on while holding the encoder** 4. Watch USB for a different device profile (may switch to ECM/RNDIS network gadget or serial) Other combos to try: - Hold **FUNC** + power on (standard Elektron recovery pattern) - Hold **multiple encoders** or specific button combinations - Hold **encoder + FUNC** simultaneously while powering on ### HAB (High Assurance Boot) The bootloader contains: `authenticate image via HAB. Switch to USB BootROM mode on failure` If HAB authentication fails, the i.MX8MP falls back to **USB Serial Download Protocol (SDP)**. NXP's `uuu` (Universal Update Utility) tool can communicate with this mode. However, HAB is fuse-programmed and won't be easily triggered on a production device. ## USB Interface (Current Behavior) When connected via USB in normal operation: - **USB Class**: 239 (Miscellaneous / IAD - Interface Association Descriptor) - **USB SubClass**: 2, **Protocol**: 1 - **Interfaces exposed**:   - **MIDI** (claimed by macOS MIDIServer)   - **Mass Storage** (USB class 8, subclass 6 = SCSI transparent)     - SCSI Vendor: `Linux`     - SCSI Product: `File-Stor Gadget`     - Revision: `0612`     - Uses Linux USB gadget framework (`g_mass_storage` or `configfs`)     - **Does NOT mount** as a volume on macOS - likely exposes an empty LUN or requires a specific device mode ## Post-Install Script (`esp5-update.sh`) The SWUpdate postinst script writes to the **writable `/data` partition**: ```sh DEMO_FILE="/data/demo.tar.gz" PROJECT_PATH="/data/factory/projects" # Extracts demo project to /data/factory/projects/DEMO ``` This `/data` partition is the most promising target for modifications since it: - Survives firmware updates - Is writable (ext4 or ubifs) - Is likely **not integrity-checked** at boot (unlike the signed rootfs) ## DEMO Project Structure The `DEMO.tar.gz` contains a LevelDB database with: - `ProjectV2` tag - Kits with presets (`KitV2`) - Preset parameters (`PresetParameterValueV1`) - Backend port rules ## Attack Vectors (Ranked by Feasibility) ### 1. Rescue Mode via Button Combo (Most Promising) - Trigger `ui-int=true` via front panel button hold at boot - Rescue mode may enable full UART console, SSH, or USB network gadget - No hardware modification required ### 2. UART Serial Console - i.MX8MP has 4 UART ports; at least one outputs boot logs (`stdout=serial`) - Need to open the case and find UART pads/header on PCB - Look for 4-pin header near SoC: GND, TX, RX, VCC (3.3V) - Connect with USB-UART adapter at **115200 baud** (standard for i.MX8) - In release firmware `stdin=nulldev` blocks input, but:   - Rescue mode likely enables full console   - U-Boot may have a brief window to interrupt boot (press any key)   - The `bt_or_console` UART mux might be switchable ### 3. Ethernet - i.MX8MP has **two FEC Ethernet controllers** - If RJ45 jack exists (or test pads on PCB), connecting Ethernet may provide:   - DHCP client (check router for new device)   - SSH/Dropbear (if enabled in rescue mode)   - mDNS/Avahi advertisement ### 4. USB Gadget Mode Switching - The DWC3 USB controller supports `dr_mode` (dual-role: host/peripheral/otg) - In rescue mode, the device might expose different USB gadgets:   - `g_ether` / USB ECM/RNDIS (network over USB)   - `g_serial` (serial console over USB)   - `g_multi` (mass storage + serial + network) ### 5. NXP UUU (Universal Update Utility) - If you can get into USB SDP mode (Serial Download Protocol):   - Install `uuu` (`brew install uuu`)   - Can write directly to eMMC, load custom kernels to RAM   - Trigger: some i.MX8 boards have a "boot mode" DIP switch or test pad   - Alternative: short the eMMC data lines during boot to force SDP fallback ### 6. Writable `/data` Partition - If mass storage or rescue mode exposes `/data`:   - Drop scripts/binaries that get executed by the main app   - Modify project files to include payloads   - Add SSH keys or enable services ## PCB Analysis (Teardown Photos) ### Key Components (by reference designator) | Ref | Component | Notes | |-----|-----------|-------| | U1 | NXP i.MX8MP QuadLite SoC | Under heatsink | | U2 | (near SoC) | Support IC | | U3 | SanDisk eMMC 8GB | Under heatsink | | U8 | (near SoC area) | | | U21 | (near J3) | | | J3 | **2-pin header/jumper** | Likely `bt_or_console` UART mux — **most promising debug access point** | ### J3 — Suspected BT/Console UART Mux Located near U21, this 2-pin header likely controls the GPIO that switches a UART between the AzureWave BT module and a debug console: - **Open** (default) = UART connected to Bluetooth HCI - **Shorted/jumpered** = UART connected to debug console ### Test Points - **USNUS_1V8** — labeled test point near U8/U2, 1.8V SNVS power rail - Multiple gold test pads/vias visible around the SoC area ### Board Layout - **Left side**: Audio section (electrolytic caps, Cirrus Logic CS42526 area) - **Center**: AzureWave WiFi/BT module (gold-shielded) - **Right side**: Heatsink covering SoC/RAM/eMMC - **Top right**: Red/black ribbon cable to display/UI board - **Bottom left**: Coin cell battery (RTC) ## USB Disk Mode The Tonverk has a **USB disk mode** (separate from rescue mode) that exposes the `/data` partition: - **Volume name**: `Tonverk` - **Size**: 62.3 GB (wait — device has 8GB eMMC, so this may be reporting wrong or there's additional storage) - **Mount point on device**: `/mnt/sdcard` - **Filesystem**: FAT32 or ext4 (macOS readable) ### Contents of `/data` partition ``` /Elektron/Tonverk Factory Library/  — Factory presets and samples /User/                              — User samples, presets, projects /.system/active_project/            — LevelDB/RocksDB database (RocksDB 8.1.1, aarch64) /Diagnostics/                        — Encrypted system diagnostic logs ``` ### Diagnostics (encrypted) The "Save Diagnostics" option in rescue mode writes gzipped tar archives to `/Diagnostics/`: - Contains `journal.log.enc` (encrypted system journal) and `journal.log.enc.key` (384-byte RSA-encrypted AES key) - Only Elektron support can decrypt these ## Rescue Mode Accessed by holding the main encoder while powering on. ### Menu Options 1. **Reset active project** — clears current project 2. **OS upgrade** — looks for `.swu` file on **SD card** (NOT USB!) 3. **Save diagnostics** — writes encrypted logs to `/data/Diagnostics/` 4. **Exit reboot** — normal reboot **Note**: Rescue mode does NOT expose any USB interface. No network, no serial, no mass storage over USB in rescue mode. ## NXP UUU (Serial Download Protocol) ### SDP Mode Details - **USB VID:PID in SDP**: `1fc9:0146` (NXP SE Blank 865) - **UUU installed**: v1.5.243 (`brew install uuu`) - **BOOT_MODE[1:0] = `01`** → Serial Download Protocol mode - **HAB**: RSA-4096 keys fused (SRK1_sha256_4096_65537_v3_ca), `hab_auth_img_or_fail` — authentication is mandatory ### How to Enter SDP Mode 1. **BOOT_MODE pins** — find test pads on PCB, set BOOT_MODE[1:0] to `01` during power-on 2. **Corrupt eMMC boot area** — via U-Boot or UART: `mmc dev 2 && mmc erase 0 8000` 3. **Short eMMC DAT0 to GND** — prevents ROM from reading eMMC, forces SDP fallback (risky) ### UUU Commands (once in SDP) ```bash uuu -lsusb                    # Check if device shows up as 1fc9:0146 uuu -b spl flash.bin          # Boot custom SPL into RAM ``` If HAB is **Open** (unlikely but possible on dev units), we can boot a custom Linux with SSH directly into RAM without touching the device's eMMC. ## Goal Get full shell access to run custom apps and hook into the audio pipeline (likely PipeWire/ALSA on the i.MX8MP) to add custom audio effects. ## Tools Used - **binwalk v3.1.0**: Firmware extraction and entropy analysis - **sasquatch**: SquashFS extraction (vendor-modified formats) - could not extract due to encryption - **unsquashfs**: Standard SquashFS extraction - **uuu v1.5.243**: NXP Universal Update Utility for SDP mode - **Elektron Transfer**: Official Elektron file management tool ## Files Location - Project root: `~/AI/Tonverk_OS/` - Firmware + extractions: `~/AI/Tonverk_OS/tmp/` - PCB teardown photos: `~/AI/Tonverk_OS/*.webp`
]]>
Code:
# Tonverk OS - Reverse Engineering Notes ## Device Info - **Product**: Elektron Tonverk (Eimur) - **Manufacturer**: Elektron Music Machines - **Serial**: A0xxxxxxxx-42 - **USB VID/PID**: 6453 / 4138 - **SoC**: NXP i.MX8M Plus QuadLite (MIMX8ML4DVNLZAB) — ARM Cortex-A53, no GPU/NPU - **RAM**: Micron 8GB LPDDR4 (MT53E2G32D4DE-046, D8CJN) - **eMMC**: SanDisk 8GB (SDINBDG4-8G, 44B2DPDGE0LH) - **WiFi/BT**: AzureWave AW-CM276NF (WiFi 5 + BT 5.0) — shares UART with `bt_or_console` - **Audio Codec**: Cirrus Logic CS42526 (2-ch ADC + 6-ch DAC) - **PCB**: PCBH2053, © 2024 Elektron, board ref `X-18ASA00230D002` - **Firmware Version**: 1.2.1 - **bcdDevice**: 1554 (fw revision 0612) ## Firmware Structure The firmware is distributed as a `.swu` file (SWUpdate CPIO archive, 109 MB). ### Extracted Contents (`Tonverk-OS-1.2.1.swu`) | File | Size | Description | |------|------|-------------| | `sw-description` | 5.8 KB | SWUpdate metadata (encrypted/binary) | | `sw-description.sig` | 384 bytes | Cryptographic signature (RSA-3072 or ECDSA-P384) | | `mb-image-release-esp5-mb.rootfs-rootfs.squashfs` | 48 MB | Main root filesystem (encrypted) | | `mb-image-release-esp5-mb.rootfs-apps.squashfs` | 13 MB | Apps partition (encrypted) | | `mb-image-release-esp5-mb.rootfs-rescue.fit` | 26 MB | Rescue/recovery image (encrypted) | | `mb-image-release-esp5-mb.rootfs.fit` | 22 MB | Main boot FIT image (encrypted) | | `flash.bin-esp5-mb-mb0.signed` | 938 KB | Signed U-Boot bootloader (slot 0) | | `flash.bin-esp5-mb-mb1.signed` | 938 KB | Signed U-Boot bootloader (slot 1) | | `bootscript-release.fit` | 3.8 KB | U-Boot boot script (FIT wrapped, readable) | | `DEMO.tar.gz` | 87 KB | Demo project (LevelDB database with kits/presets) | | `esp5-update.sh` | 483 bytes | Post-install script for SWUpdate | ### Encryption Status - All `.squashfs` and `.fit` images are **fully encrypted** (AES or similar) - Entropy analysis confirms flat maximum entropy across entire files - no structure visible - `sasquatch` and standard `unsquashfs` cannot read them (non-standard magic bytes, not just vendor-modified SquashFS) - `binwalk v3.1.0` finds zero signatures inside the encrypted images - The bootloader (`flash.bin`) is **not encrypted** but is **signed** (HAB - High Assurance Boot) ### SWUpdate Signing The `.swu` package uses cryptographic signing: 1. `sw-description` contains image metadata + SHA256 hashes 2. `sw-description.sig` signs the description with a 384-byte signature 3. Reflashing modified firmware requires Elektron's private signing key - **not feasible** ## SoC Details (NXP i.MX8MP) Extracted from bootloader strings: ### Peripherals found in device tree - **2x Ethernet**: `ethernet@30be0000`, `ethernet@30bf0000` (FEC, i.MX8MP-FEC) - **4x UART/Serial**:   - `serial@30860000` (SPBA bus)   - `serial@30880000` (SPBA bus)   - `serial@30890000` (SPBA bus)   - `serial@30a60000` - **2x USB**: `usb@32e40000`, `usb@32e50000` (DWC3 controller, `dr_mode` present) - **GPIO**: 5 banks (`gpio@30200000` through `gpio@30240000`) - **I2C, SPI (ECSPI), CAN (FlexCAN), DSP, MIPI-DSI, LCDIF** - **USB-C connector** referenced in device tree ### Console Configuration (Release Firmware) ``` stdin  = nulldev      # Serial input DISABLED in release builds stdout = serial      # Serial output goes to UART (read-only) stderr = serial      # Errors go to UART ``` **Important**: There is a `bt_or_console` variable in the bootloader, suggesting one UART is **shared between Bluetooth and debug console**. In debug/development builds, this UART likely serves as a full interactive console. ### Boot Storage - **eMMC** (mmc device 2):   - Partition 1: rescue image   - Partition 2: bootscript (`bootscript.fit`)   - Partition 3: root filesystems (`rootA` / `rootB` for A/B updates) - **`/data` partition**: writable, stores factory projects, demo content, user data ## Boot Flow & Rescue Mode Extracted from `bootscript-release.fit`: ### Normal Boot Sequence 1. U-Boot loads `bootscript.fit` from eMMC partition 2 2. Sets `dtb_conf=esp5`, constructs board revision from `hw_bom` 3. Checks for rescue/recovery conditions (see below) 4. Loads `fitImage` from `activeroot` (rootA or rootB) on partition 3 5. Boots with `bootm` 6. Falls back to rescue if boot fails ### Rescue Mode Triggers ``` # USER-REQUESTED RESCUE (button combo) if test "${ui-alive}" = "true" && test "${ui-int}" = "true"; then     setenv request_rescue "user-requested" # INTERRUPTED UPDATE if test -n "${recovery_status}"; then     setenv update_failed "interrupted" # ROLLBACK (boot failed after update) if test -n "${upgraderoot}" && test "${bootcount}" != "1"; then     setenv update_failed "rollback" ``` **`ui-alive`** and **`ui-int`** are U-Boot env vars set by the front panel MCU. When both are `true`, the device enters **user-requested rescue mode**. This is the most promising entry point. ### How to Trigger Rescue Mode Based on Elektron's standard patterns and the bootscript variables: 1. **Power off the Tonverk completely** 2. **Hold the main encoder pressed** (this likely sets `ui-int=true` via the UI MCU) 3. **Power on while holding the encoder** 4. Watch USB for a different device profile (may switch to ECM/RNDIS network gadget or serial) Other combos to try: - Hold **FUNC** + power on (standard Elektron recovery pattern) - Hold **multiple encoders** or specific button combinations - Hold **encoder + FUNC** simultaneously while powering on ### HAB (High Assurance Boot) The bootloader contains: `authenticate image via HAB. Switch to USB BootROM mode on failure` If HAB authentication fails, the i.MX8MP falls back to **USB Serial Download Protocol (SDP)**. NXP's `uuu` (Universal Update Utility) tool can communicate with this mode. However, HAB is fuse-programmed and won't be easily triggered on a production device. ## USB Interface (Current Behavior) When connected via USB in normal operation: - **USB Class**: 239 (Miscellaneous / IAD - Interface Association Descriptor) - **USB SubClass**: 2, **Protocol**: 1 - **Interfaces exposed**:   - **MIDI** (claimed by macOS MIDIServer)   - **Mass Storage** (USB class 8, subclass 6 = SCSI transparent)     - SCSI Vendor: `Linux`     - SCSI Product: `File-Stor Gadget`     - Revision: `0612`     - Uses Linux USB gadget framework (`g_mass_storage` or `configfs`)     - **Does NOT mount** as a volume on macOS - likely exposes an empty LUN or requires a specific device mode ## Post-Install Script (`esp5-update.sh`) The SWUpdate postinst script writes to the **writable `/data` partition**: ```sh DEMO_FILE="/data/demo.tar.gz" PROJECT_PATH="/data/factory/projects" # Extracts demo project to /data/factory/projects/DEMO ``` This `/data` partition is the most promising target for modifications since it: - Survives firmware updates - Is writable (ext4 or ubifs) - Is likely **not integrity-checked** at boot (unlike the signed rootfs) ## DEMO Project Structure The `DEMO.tar.gz` contains a LevelDB database with: - `ProjectV2` tag - Kits with presets (`KitV2`) - Preset parameters (`PresetParameterValueV1`) - Backend port rules ## Attack Vectors (Ranked by Feasibility) ### 1. Rescue Mode via Button Combo (Most Promising) - Trigger `ui-int=true` via front panel button hold at boot - Rescue mode may enable full UART console, SSH, or USB network gadget - No hardware modification required ### 2. UART Serial Console - i.MX8MP has 4 UART ports; at least one outputs boot logs (`stdout=serial`) - Need to open the case and find UART pads/header on PCB - Look for 4-pin header near SoC: GND, TX, RX, VCC (3.3V) - Connect with USB-UART adapter at **115200 baud** (standard for i.MX8) - In release firmware `stdin=nulldev` blocks input, but:   - Rescue mode likely enables full console   - U-Boot may have a brief window to interrupt boot (press any key)   - The `bt_or_console` UART mux might be switchable ### 3. Ethernet - i.MX8MP has **two FEC Ethernet controllers** - If RJ45 jack exists (or test pads on PCB), connecting Ethernet may provide:   - DHCP client (check router for new device)   - SSH/Dropbear (if enabled in rescue mode)   - mDNS/Avahi advertisement ### 4. USB Gadget Mode Switching - The DWC3 USB controller supports `dr_mode` (dual-role: host/peripheral/otg) - In rescue mode, the device might expose different USB gadgets:   - `g_ether` / USB ECM/RNDIS (network over USB)   - `g_serial` (serial console over USB)   - `g_multi` (mass storage + serial + network) ### 5. NXP UUU (Universal Update Utility) - If you can get into USB SDP mode (Serial Download Protocol):   - Install `uuu` (`brew install uuu`)   - Can write directly to eMMC, load custom kernels to RAM   - Trigger: some i.MX8 boards have a "boot mode" DIP switch or test pad   - Alternative: short the eMMC data lines during boot to force SDP fallback ### 6. Writable `/data` Partition - If mass storage or rescue mode exposes `/data`:   - Drop scripts/binaries that get executed by the main app   - Modify project files to include payloads   - Add SSH keys or enable services ## PCB Analysis (Teardown Photos) ### Key Components (by reference designator) | Ref | Component | Notes | |-----|-----------|-------| | U1 | NXP i.MX8MP QuadLite SoC | Under heatsink | | U2 | (near SoC) | Support IC | | U3 | SanDisk eMMC 8GB | Under heatsink | | U8 | (near SoC area) | | | U21 | (near J3) | | | J3 | **2-pin header/jumper** | Likely `bt_or_console` UART mux — **most promising debug access point** | ### J3 — Suspected BT/Console UART Mux Located near U21, this 2-pin header likely controls the GPIO that switches a UART between the AzureWave BT module and a debug console: - **Open** (default) = UART connected to Bluetooth HCI - **Shorted/jumpered** = UART connected to debug console ### Test Points - **USNUS_1V8** — labeled test point near U8/U2, 1.8V SNVS power rail - Multiple gold test pads/vias visible around the SoC area ### Board Layout - **Left side**: Audio section (electrolytic caps, Cirrus Logic CS42526 area) - **Center**: AzureWave WiFi/BT module (gold-shielded) - **Right side**: Heatsink covering SoC/RAM/eMMC - **Top right**: Red/black ribbon cable to display/UI board - **Bottom left**: Coin cell battery (RTC) ## USB Disk Mode The Tonverk has a **USB disk mode** (separate from rescue mode) that exposes the `/data` partition: - **Volume name**: `Tonverk` - **Size**: 62.3 GB (wait — device has 8GB eMMC, so this may be reporting wrong or there's additional storage) - **Mount point on device**: `/mnt/sdcard` - **Filesystem**: FAT32 or ext4 (macOS readable) ### Contents of `/data` partition ``` /Elektron/Tonverk Factory Library/  — Factory presets and samples /User/                              — User samples, presets, projects /.system/active_project/            — LevelDB/RocksDB database (RocksDB 8.1.1, aarch64) /Diagnostics/                        — Encrypted system diagnostic logs ``` ### Diagnostics (encrypted) The "Save Diagnostics" option in rescue mode writes gzipped tar archives to `/Diagnostics/`: - Contains `journal.log.enc` (encrypted system journal) and `journal.log.enc.key` (384-byte RSA-encrypted AES key) - Only Elektron support can decrypt these ## Rescue Mode Accessed by holding the main encoder while powering on. ### Menu Options 1. **Reset active project** — clears current project 2. **OS upgrade** — looks for `.swu` file on **SD card** (NOT USB!) 3. **Save diagnostics** — writes encrypted logs to `/data/Diagnostics/` 4. **Exit reboot** — normal reboot **Note**: Rescue mode does NOT expose any USB interface. No network, no serial, no mass storage over USB in rescue mode. ## NXP UUU (Serial Download Protocol) ### SDP Mode Details - **USB VID:PID in SDP**: `1fc9:0146` (NXP SE Blank 865) - **UUU installed**: v1.5.243 (`brew install uuu`) - **BOOT_MODE[1:0] = `01`** → Serial Download Protocol mode - **HAB**: RSA-4096 keys fused (SRK1_sha256_4096_65537_v3_ca), `hab_auth_img_or_fail` — authentication is mandatory ### How to Enter SDP Mode 1. **BOOT_MODE pins** — find test pads on PCB, set BOOT_MODE[1:0] to `01` during power-on 2. **Corrupt eMMC boot area** — via U-Boot or UART: `mmc dev 2 && mmc erase 0 8000` 3. **Short eMMC DAT0 to GND** — prevents ROM from reading eMMC, forces SDP fallback (risky) ### UUU Commands (once in SDP) ```bash uuu -lsusb                    # Check if device shows up as 1fc9:0146 uuu -b spl flash.bin          # Boot custom SPL into RAM ``` If HAB is **Open** (unlikely but possible on dev units), we can boot a custom Linux with SSH directly into RAM without touching the device's eMMC. ## Goal Get full shell access to run custom apps and hook into the audio pipeline (likely PipeWire/ALSA on the i.MX8MP) to add custom audio effects. ## Tools Used - **binwalk v3.1.0**: Firmware extraction and entropy analysis - **sasquatch**: SquashFS extraction (vendor-modified formats) - could not extract due to encryption - **unsquashfs**: Standard SquashFS extraction - **uuu v1.5.243**: NXP Universal Update Utility for SDP mode - **Elektron Transfer**: Official Elektron file management tool ## Files Location - Project root: `~/AI/Tonverk_OS/` - Firmware + extractions: `~/AI/Tonverk_OS/tmp/` - PCB teardown photos: `~/AI/Tonverk_OS/*.webp`
]]> <![CDATA[Model Cycles U25 dump]]> https://elektronmods.com/showthread.php?tid=86 Thu, 22 Oct 2026 20:04:09 +0000 DISCO]]> https://elektronmods.com/showthread.php?tid=86 updater or a project backup. Please include the installed OS version and SHA-256 checksum.]]> updater or a project backup. Please include the installed OS version and SHA-256 checksum.]]> <![CDATA[GOOD NEWS, EVERYONE! SY FM4 is here + a fully modular Syntakt firmware builder!]]> https://elektronmods.com/showthread.php?tid=85 Tue, 20 Oct 2026 00:22:37 +0000 kariGardarsson]]> https://elektronmods.com/showthread.php?tid=85 Well, I've been busy again

Two big updates this time

First, SY FM4 is now available for Syntakt OS 1.41!

I've ported Rxuting's 4-operator FM engine to OS 1.41, bringing 11 FM algorithms to SY TONE, along with a second SYN page, eight FM parameters, native editing, parameter locks and sound save/reload

ALGO 0 keeps the original SY TONE behavior, while ALGO 1–11 give you the new FM engine

And second, I've built a fully modular Windows firmware builder!

Instead of downloading a fixed collection of mods, you can now pick exactly what you want in your custom Syntakt firmware

The builder includes eight selectable mod groups:
  • SY FM4 — 4-operator FM synthesis
  • Master Compressor
  • FX3 — Chorus, Flanger, Phaser and Crusher
  • Beat Repeat
  • Déjà Vu LFO
  • Expanded SY CHORD — 31 additional waveforms
  • Dual Mono Input
  • Readable Parameter Values
You can select individual mods or use presets like MAX FULL + FM4, Original MAX 1.0 and FM4 Only

The builder handles dependencies automatically, so you don't need to worry about which supporting mods are required

Just select your official Syntakt OS 1.41 firmware, choose your mods and hit Build

No Python, no WSL, no programming required!

Everything runs locally on Windows, and the builder doesn't connect to your Syntakt or flash anything automatically

All 255 possible non-empty mod combinations have passed automated structural validation, and I've also successfully tested the combined MAX + FM4 firmware on my own Syntakt

A quick heads-up: This is still experimental firmware. I've tested quite a bit on real hardware, but definitely not every possible combination or workflow. Some combinations, including the new standalone FM4-only builder profile, still need broader hardware testing

I'd recommend backing up your projects and sounds and keeping the official OS 1.41 handy. If you ever need to revert, Syntakt has a recovery mode (FUNC + TRIG 4 at startup) that allows reinstalling the official firmware over MIDI DIN. Recovery instructions are included with the builder

Feedback, testing results and bug reports are always welcome!

Huge thanks to:
  • Rxuting — for creating the original SY FM4 engine
  • Angelo-politek — for SyntHack, the original mods and modular infrastructure
  • Bezronczek — for the original Déjà Vu and CHORD implementations

This wouldn't have been possible without their work

The builder uses your own official Elektron OS 1.41 file. No Elektron firmware or prebuilt firmware images are distributed

GitHub release:

https://github.com/karigardarsson/Synthack-OS/releases/tag/syntakt-max-modular-builder-rc1

Have fun experimenting!

°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
Quick development update!

I'm investigating two issues reported by MAX 1.0 users: FX3 controls appearing on MIDI tracks and a brief compressor level dip during FUNC + NO operations

I've reproduced the MIDI UI issue on hardware and I'm checking whether the new Modular RC1 configurations are affected too

I'll share an update when the fixes are verified

Thanks for all the feedback and testing!

.png   Screenshot 2026-10-19 222524.png (Size: 28.53 KB / Downloads: 911)

.jpg   Image 19 Oct 2026, 23_09_00.jpg (Size: 181.02 KB / Downloads: 729) ]]> Well, I've been busy again

Two big updates this time

First, SY FM4 is now available for Syntakt OS 1.41!

I've ported Rxuting's 4-operator FM engine to OS 1.41, bringing 11 FM algorithms to SY TONE, along with a second SYN page, eight FM parameters, native editing, parameter locks and sound save/reload

ALGO 0 keeps the original SY TONE behavior, while ALGO 1–11 give you the new FM engine

And second, I've built a fully modular Windows firmware builder!

Instead of downloading a fixed collection of mods, you can now pick exactly what you want in your custom Syntakt firmware

The builder includes eight selectable mod groups:
  • SY FM4 — 4-operator FM synthesis
  • Master Compressor
  • FX3 — Chorus, Flanger, Phaser and Crusher
  • Beat Repeat
  • Déjà Vu LFO
  • Expanded SY CHORD — 31 additional waveforms
  • Dual Mono Input
  • Readable Parameter Values
You can select individual mods or use presets like MAX FULL + FM4, Original MAX 1.0 and FM4 Only

The builder handles dependencies automatically, so you don't need to worry about which supporting mods are required

Just select your official Syntakt OS 1.41 firmware, choose your mods and hit Build

No Python, no WSL, no programming required!

Everything runs locally on Windows, and the builder doesn't connect to your Syntakt or flash anything automatically

All 255 possible non-empty mod combinations have passed automated structural validation, and I've also successfully tested the combined MAX + FM4 firmware on my own Syntakt

A quick heads-up: This is still experimental firmware. I've tested quite a bit on real hardware, but definitely not every possible combination or workflow. Some combinations, including the new standalone FM4-only builder profile, still need broader hardware testing

I'd recommend backing up your projects and sounds and keeping the official OS 1.41 handy. If you ever need to revert, Syntakt has a recovery mode (FUNC + TRIG 4 at startup) that allows reinstalling the official firmware over MIDI DIN. Recovery instructions are included with the builder

Feedback, testing results and bug reports are always welcome!

Huge thanks to:
  • Rxuting — for creating the original SY FM4 engine
  • Angelo-politek — for SyntHack, the original mods and modular infrastructure
  • Bezronczek — for the original Déjà Vu and CHORD implementations

This wouldn't have been possible without their work

The builder uses your own official Elektron OS 1.41 file. No Elektron firmware or prebuilt firmware images are distributed

GitHub release:

https://github.com/karigardarsson/Synthack-OS/releases/tag/syntakt-max-modular-builder-rc1

Have fun experimenting!

°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
Quick development update!

I'm investigating two issues reported by MAX 1.0 users: FX3 controls appearing on MIDI tracks and a brief compressor level dip during FUNC + NO operations

I've reproduced the MIDI UI issue on hardware and I'm checking whether the new Modular RC1 configurations are affected too

I'll share an update when the fixes are verified

Thanks for all the feedback and testing!

.png   Screenshot 2026-10-19 222524.png (Size: 28.53 KB / Downloads: 911)

.jpg   Image 19 Oct 2026, 23_09_00.jpg (Size: 181.02 KB / Downloads: 729) ]]> <![CDATA[D50 Type PCM/sample based machine]]> https://elektronmods.com/showthread.php?tid=84 Mon, 19 Oct 2026 11:37:54 +0000 River5tyx]]> https://elektronmods.com/showthread.php?tid=84 <![CDATA[GOOD NEWS, EVERYONE! I added waveform zoom to the Digitakt II]]> https://elektronmods.com/showthread.php?tid=83 Mon, 19 Oct 2026 01:49:07 +0000 kariGardarsson]]> https://elektronmods.com/showthread.php?tid=83 So, I've been messing around with the DT2 firmware some more, and this time I managed to add something I've really been missing: waveform zoom on the regular ONESHOT SRC page

Push encoder C to cycle through 1×, 2× and 3.75× zoom, and just turn C to scroll through the waveform. No FUNC, no menus

I didn't realise how much better this would feel until I actually tried it on the machine

It's now part of the new v0.2.0 beta, alongside the Déjà Vu LFOs from my previous post

The standalone Windows builder uses your own official Elektron OS 1.17 file to generate the modified firmware locally. OS 1.16 is still supported for Déjà Vu only

Still experimental firmware, so make sure to read the recovery instructions

GitHub:
https://github.com/karigardarsson/digitakt-ii-research/releases/tag/v0.2.0-beta

.mp4   VID_20261018_040837.mp4 (Size: 28.92 MB / Downloads: 43) ]]> So, I've been messing around with the DT2 firmware some more, and this time I managed to add something I've really been missing: waveform zoom on the regular ONESHOT SRC page

Push encoder C to cycle through 1×, 2× and 3.75× zoom, and just turn C to scroll through the waveform. No FUNC, no menus

I didn't realise how much better this would feel until I actually tried it on the machine

It's now part of the new v0.2.0 beta, alongside the Déjà Vu LFOs from my previous post

The standalone Windows builder uses your own official Elektron OS 1.17 file to generate the modified firmware locally. OS 1.16 is still supported for Déjà Vu only

Still experimental firmware, so make sure to read the recovery instructions

GitHub:
https://github.com/karigardarsson/digitakt-ii-research/releases/tag/v0.2.0-beta

.mp4   VID_20261018_040837.mp4 (Size: 28.92 MB / Downloads: 43) ]]>