Matrix-1000 sensation: Rare bug spotted in the wild after 30-odd years!

An option for setting voice allocation in the Matrix simply does not work – never has – and nobody seems to have noticed up to now. But there’s a fix for that.

A cute golden bug akin to a cricket looking above the edge of a circuit board

“Hey, I want that update! Especially as I already own V1.20!” — PLEASE READ HERE

A couple of days ago, Bob Grieb – the engineer behind the Matrix-1000 update I am selling here – got a email from a Matrix owner using the updated V1.20. The mail politely noted that the “Reassign/Rob” setting wasn’t working, and inquired whether there might be a problem with the V1.20 firmware. Bob, who does no longer own a Matrix-1000, fired up a Verilog simulation he had created for testing, and found that the Matrix owner indeed was right – the “Reassign/Rob” setting of Parameter 48 (0x030h) wasn’t working, and it wasn’t working in firmware V1.13 either – a very early patch of the last factory firmware by Oberheim itself.

So it was a bug that had always been there, and nobody seems to have noticed. Or, at least, have cared enough to look for a fix.

What “Reassign/Rob” is supposed to do – and why you never noticed

The Matrix-1000 has six voices. When your Matrix is playing six notes at once, it won’t accept any new notes unless you release one of the notes being played. This is the default setting, and it comes in two flavours, “Rotate”, and “Reassign”. They are set with values 0 and 1 of parameter 48, and the Matrix-1000 manual also has two more settings, Unison (all voices playing at once), and “Reassign/Rob”.

The Matrix-1000 manual is a bit cryptic about the meaning of all this; quoting from the Matrix-6 manual instead:

  • ROTATE: When playing notes on the Keyboard, this polyphonic mode loops through the six Voices assigning each new note to next available voice.
  • REASGN: Abbreviation for “Reassign”, this polyphonic mode is similar to ROTATE but notes that have the same pitch (otherwise known as “note value”) are reassigned to the same voice. For example, if you play Middle C it will be assigned to a certain voice. Every time thereafter when Middle C is played on the Keyboard, that voice will play. “Reassign”, by the way, is the KEYBOARD MODE enabled in the Basic Patch.
  • UNISON: This mode takes the MATRIX-6 out of polyphonic mode and makes the synthesizer monophonic.
    (…)
  • REAROB “Reassign Rob”: When in Reassign (REASGN) mode, voices will be robbed from keys held in the same way as ROTROB.

So what the “Reassign/Rob” value actually is supposed to do, is to enable voice stealing — notes being played suddenly go missing, making it painfully obvious that your synth is running out of resources. It is infuriating when we notice, and we seem to notice the limitations of a 6-voice synth a lot more when notes suddenly vanish than when they never appear in the first place.

So to be honest, I never noticed that this doesn’t work. Did you?

Bob, however, found the reason: The code for the note-stealing setting is 3, but there is a safety check that limits the parameter to entries from 0-2 instead of 0-3, so that the correct value can never be received. It’s only one byte that has to be changed – no, one bit, actually: Look for 0x81 0x02 0x22 0x02 in the ROM and change it to 0x81 0x03 0x22 0x02; changing one lousy bit. It’s that simple. And this is what we decided to call V1.21.

A rack with a controller, a Matrix-1000 synthesizer, and a Lexicon digital reverb; the Matrix showing

V1.21 is displayed on powering up

So how do I get it?

Unfortunately, this means that we will have to throw all V1.20s away, we cannot correct them. The one bit we have to change cannot be reprogrammed, so to upgrade from V1.20 to V1.21, you have to create a new chip, send it, and swap it.

And this is the main reason we don’t give the update away – this needs chips, and this takes work, so we charge you what is basically just the price of the chip and a fiver for programming it, and one Euro for Bob. We had a similar deal for Matrix-6 V2.14 owners when Bob discovered another bug that had always been hiding in the Matrix-6 firmware — and I hope you think that this is fair, because it is: after all, the bug wasn’t Bob’s fault, so he is in no obligation to fix it for free.

One last thought: ask yourself whether voice stealing is really worth the hassle. I know perfectly well that it’s quite possible to go GASsing for a software update, but: If you haven’t noticed the bug before, you probably won’t need the patch.

M1000 V1.20->V1.21 Update

Matrix-1000 V1.21 Firmware Update ROM for V1.20 owners

Item number: 0002
Item price: 12,00 EUR
(incl. 19,00% sales tax and plus Shipping cost)
ROM chip with re-engineered firmware for the Oberheim Matrix-1000 synthesizer

Firmware chip for the Oberheim Matrix-1000, V1.21 (Update for V1.20 owners)

V1.21 fixes a bug that prevented using voice stealing in all former firmware versions and assumes that you own a V1.20 license, i.e. bought the chip from me, Alpes Machines, or Bob Grieb. Price covers the chip and the burning of the firmware but not the license for the update - if you don't have an updated synth yet, you will have to buy a V1.21 new. Firmware update engineered by Bob Grieb/tauntek.com. Sold with permission, please prove ownership of a V1.20 license. (That doesn't cover anything you bought from some guy on the internet, I'm afraid.)
   

OMG OMG I actually played that thing!

Looking at the analytics, I have noted that my reminiscence to/analysis of the Keytek CTS-2000 synth has been found by a number of people that surprises me, given that it is an article about a truly horrible, obscure late-80s hybrid synth in a rather niche blog. Given that, I would like to share some proof that I actually played that thing, and on stage, too. And though it is hard to date the old photographs, I would estimate that I held onto it for quite some time.

So I guess at least the CTS-2000’s keyboard was really decent.

5-piece band: female bass player, percussion player, guitarist, keyboardist with guitar.

The band, by the way, was named “Voice of the Alien”. You won’t find anything Googling it.

I added another photo to the original article.

Explaining how to use the Digitakt is the one thing AI is actually good at

Well yes, the Digitakt II. A beautiful drum machine and sequencer but it takes you some time and effort to learn how to use it. But you may ask an AI, and this actually helps.

A black, square computer device very much like the original Digitakt but with a lot of knobs and buttons with illegible writing

Fantasy drum machine generated by Midjourney from a Digitakt image

It’s fairly straightforward: I gave the Digitakt II manual to a “GPTs”, ChatGPT’s way of building user-configurable assistants with an RAG. What that means is that the AI is actually trying to find the segments in the manual dealing with the user’s question, and using them to answer it.

A pixelated black/amber display showing a stylized brain, some buttons and knobs around it, illegible writing; the machine is named

A fantasy drum computer’s display, created by Midjourney

Wiring up the Digitakt, I needed information on how to play an expander via a synth keyboard attached to the Digitakt’s MIDI In. Given that the answer includes setting “Auto Channel”, and not anything associated with “MIDI Thru”, I am actually quite glad I had the AI to help.

You can find the Digitakt II Manual GPTs here – not sure whether you actually need a GPT-Plus paid account to use it, but you can use any RAG implementation for that. Prompt is straightforward:

# Role
You are “Digitakt II Bot”, an AI advisor helping to explain how to use the Electron Digitakt II drum computer and sequencer.

# Actions
– Use Retrieval to look for answers in the manual document
– Answer quoting the manual
– As a reference, name the chapter in the manual
– If possible, name the page number
– Explain step for step

# Rules and Limitations
– You are multilingual. If the user asks a question in a language like German or French, answer in German or French, translating the manual for her.
– Be concise and thorough.
– Always use examples to explain.
– Always check against the Digitakt II manual.
– Check whether your answer actually applies to the Digitakt II, rather than to its predecessor, the original Digitakt machine. The original Digitakt had a mono sampler engine and offered 8 instrument and 8 MIDI tracks, Digitakt II has a stereo sampler engine, and offers 16 tracks that may be assigned freely.

HackTribe your E2S with a Colab Notebook

Follow-up to the post on the Hacktribe firmware project for the Electribe 2:

Colab Notebook as online step-by-step tutorial doing all the work – no need to install Python

Want to have a Hacktribe, but don’t want to install Python? You can use this Notebook – which you can run on a virtual Python environment provided by Google, called Colab. It creates a modified firmware file with Bangcorrupt’s scripts, as well as modified sample and pattern files from the existing samples and patterns on your Electribe Sampler.

Additional Python script to adapt sample bank AND pattern bank to the HackTribe firmware

There is also a new Python script the notebook uses, but which you can also run locally on your machine: It takes an e2sSample.all sample dump file, and a matching .e2sallpat pattern dump, and adapts them to the HackTribe by moving all samples to User sample space. The patterns are then modified to find the samples in their new locations.

You can find and download the script in my repository here.

Documentation

In writing the script, I had to document parts of the sample dump file. bangcorrupt did not want to have documentation as part of the main hacktribe repository to be on the safe side of hacking/reengineering regulations, so I created a separate documentation repository. It’s quite empty so far.

Link to electribe2 doc repository.

Free-for-all Filters And VPM – How The Hacktribe came to be

I really like my Electribe 2. I know, it gets a lot of hate from the EMX/ESX lovers, but the workflow really suits me, and, as you might know, I’ve got a heart for underdogs, especially when they are from Korg – don’t you think that even Korg’s blunders are more interesting than Roland’s successes?

A mutant Electribe

StableDiffusion 1.5 hallucinating the hell out of an Electribe with IMG2IMG and “Superman Drum Machine” as prompt

Which doesn’t mean that Korg does everything right. As Electribe users know, you have to make up your mind: 

  • Do you want the (blue or grey) E2 synth (“BlueTribe”), or
  • the (red or black) E2S sampler (“RedTribe”)? 

The RedTribe sampler, gravitating a bit more towards hip-hop compared to the dancefloor-oriented BlueTribe, is generally more flexible – but you have to sacrifice the BlueTribe’s many additional filter types and synth oscillator models.

Which is a real shame considering that the hardware for BlueTribe and RedTribe is absolutely identical – apart from the colour scheme and the built-in samples. You can even crossgrade from BlueTribe to RedTribe and vice versa (involves a bit of hex editor manipulation and a sizeable risk of bricking the Electribe, but it’s doable – I did it once before settling on a black RedTribe for good).

So why doesn’t one just analyze the firmware, and copy&paste the BlueTribe goodness to the RedTribe ROM? It’s that kind of project you dream of for about 15 seconds until you realize how cumbersome this really is, and that it would be madness to commit yourself to that kind of ambitious hacking project.

Luckily, bangcorrupt has already done just that.

Behold: The Hacktribe!

In case you lived under a rock and haven’t heard of it: Hacker bangcorrupt has analyzed the Electribe’s bootloader, finding the requirements for installing modified firmware. And he modified Korg’s 2.02 Electribe Sampler firmware, adding the BlueTribe’s extra capabilities concerning filters and oscillators to it – and even more: VPM, Korg’s version of FM synthesis for people without a degree in acoustics.

It’s as simple as downloading the factory firmware, running a Python script that patches it, and updating your E2 to the Hacktribe firmware. If you want to keep running your existing RedTribe patterns, I created some small additional scripts for that – my tiny contribution to the project – and you will find soon find a step-by-step tutorial as a Python notebook that you can just click-and-run on Google Colab, saving you the intimidating Python installation business.

But for the moment, let’s geek out for a bit: I reached out to bangcorrupt, the hacker who did this, and asked him how he did the hack.

Hacktribing your RedTribe

We were communicating via mail – he answered my first set of questions – which were originally intended just to tell him what I wanted to know – in bulk. These are his answers; I’ve just added some links and notes in italics and square brackets where I felt like it. Everything else is bangcorrupt’s answers.

Q: How did you get the idea of doing it?

bangcorrupt: I got the idea from the firmware swap posted on korgforums years ago.
I wanted to create a hybrid based on the latest firmware version, with some added features and configuration options.

[With the first couple of firmware revisions, it was quite easy to swap the firmware of a RedTribe for a BlueTribe; with v2.02, Korg added checks to keep you from crossgrading, so you had to do a bit of hex editing and downgrading to do the swap. It was quite a feat and, honestly, not worth it, as you wouldn’t get the samples of the other machine – these seem to be stored in ROM, separate from the firmware. While it is quite easy to get someone with an E2S to perform an “Export All Samples” for you, I have not seen the BlueTribe factory sample set in the wild yet.]

Q: Why didn’t you just stop when you realized how overwhelmingly complex the whole thing would become?

[Think about it.The Electribe is a complex machine – see this hardware breakdown in the Korg forums from 2015 which is one of the first things a prospective hacker might end up with. It hasn’t got just one microcontroller but three: The main processor is an ARM9 processor called AM1802 (datasheet), accompanied by a Blackfin 523 DSP from Analog Devices (datasheet) – a type of microprocessor optimized to process real-time data. There is also an additional feeble ARM Cortex M3 reading the front panel dials, which we may safely ignore if we’re lucky. Scanning the datasheets, you will find all sorts of scary words like “protecting code integrity”. There is obviously some kind of bootloader involved which you have to analyze to find out what it accepts as a firmware, and how it is loaded into memory. And once you mess things up, there is a considerable risk of bricking your Electribe for good – which did indeed happen, see below.]

bangcorrupt: Once I started seeing patterns and how they interrelate it was difficult to stop. I was really obsessed with it for a while; hopefully I can find the time to dedicate to taking it to the next level.

Q: Did you have a background in microcontroller development before?

bangcorrupt: I had a basic understanding of computer architecture and electronics, but most of what I know about microcontrollers and reverse engineering comes from working on Hacktribe.

[Which I, as a full-blown blunderer and tinkerer, find wonderfully serendipous and inspiring.]

Q: What were the challenges in doing it?

bangcorrupt: Everything. I’m learning how to do this as I go along, most of the tools and protocols are new to me. At one point I bricked my electribe and had to hack some other things to learn how to fix it.

Q: What kind of tools does one use for rewriting Electribe code?

bangcorrupt: A J-Link or a Raspberry Pi running OpenOCD will work as a JTAG debugger for the CPU.

[Let’s stop here for a moment and explain what a JTAG debugger actually is. Imagine you have some sort of program, and want to see what it does – especially if it doesn’t do what you want it to do. In that case, it would be handy to stop the code and look at registers and memory.

As long as the program is still running on your desktop computer, you can simulate and debug your program there, but once it has been transferred to the machine, you will have to use special hardware to do that.

When I did my first 8-bit development project some 30 to 40 years ago, we had to buy a murderously expensive type of hardware called a Z80 In-Circuit Emulator, a blue box that could act as a microcontroller in my machine but kept transmitting data on order to a PC. It has become much, much simpler these days, as all modern microcontrollers have a standard serial interface called JTAG. It takes orders and code, and transmits data if you want to talk to the processor, but you still have to have special hardware and software which does the talking.]

bangcorrupt: I couldn’t get the Raspberry Pi [running the OpenOCD JTAG debugger] working with the Blackfin DSP, but thanks to people sponsoring Hacktribe I was able to buy the official Analog Devices debug adapter.
Raspberry Pi will also work with the Cortex M3 on the panel board, but I want to try using Black Magic Probe [an open-source standalone JTAG debugger for ST Micro’s M3 hardware and others] on an STM32F103.
On the software side I’ve been using Ghidra for static analysis, with Rizin for patching and debugging.

[What is this for? The original programmers wrote high-level code in languages like C, and probably low-level Assembler code handling single processor instructions, before compiling and assembling their program code into the string of bytes in the SYSTEM.VSB file. Disassembler frameworks like Ghidra – by the NSA, for god’s sake! – and Rizin help you turn back these bytes into readable code, much like turning a meal back into a recipe – so you end up with code that your brain can process, and the JTAG debugger which helps you watch what it is actually doing. This gives you a good chance to understand what the code does, and how to expand it.]  

Q: How much of what your HackTribe code does was already in there, and what did you have to write from scratch?

bangcorrupt: This is hard to answer, it’s all interlinked. At the start I was hex editing the binary directly, changing pointers and conditional tests to run existing functions with new data. I’ve started reworking it into separate assembly code; the most new code I’ve written is probably for NRPN handling or FX editing. Even here I am using the existing functions as much as possible, just calling them in a different order with different arguments.

Q: And have you got a clue what the hell Korg thinks about all this?

bangcorrupt: I have nothing to do with Korg. I try to stay within the law and the license agreement, and as far as I know I have.

bangcorrupt’s answers are printed as they were given. All errors in the italics are mine.

Yay! I’ve bought a DIY Minimoog. (And Jenny is going to love it!)

Isn’t it GORGEOUS? Classic Minimoog – less of a control panel, more of an erogenous zone for synth nerds. Tell me you don’t want to feel up these knobs! The pure beauty of a one-of-a-kind electronic instrument. The design and the sounds are still in highest demand more than 50 years after its design – and I was pretty sure I’d never, never even be tempted to buy one.

I never even wanted a Minimoog!

Let’s be honest: Moogs are ludicrously overpriced, and overhyped. Not a single classic Moog ladder filter sound you couldn’t do just as well with a modern plugin, or almost any modern hardware. Hey, even the R3 – my most underdog synth – can do pretty decent Moog impressions. And if you are with the “Digital-will-never-sound-like-true-analog” esoterics, there is still the option of Neo Old School: Using the old design with the upsides of modern analog technology. Get yourself a Boog, for fuck’s sake. (And a life.)

Still… as we know, it’s all about the workflow – and about that unique combination of how an instrument looks, feels, and sounds. So when I saw a Moog enclosure and front panel on eBay for a couple of Euros, I could not resist and had to buy it.

“It’s aliiiiive!” – How to give life to an empty corpus

Continue reading

The Noisy One

I’ve won a Dreadbox Typhon in a sweepstake, and it’s bloody brilliant. Like, really, really brilliant! A fun machine with a monster sound and a great concept for real-time sound manipulation and editing. If there wasn’t that nasty problem with digital noise.

Dreadbox Typhon powered from USB hub; preset A1

Just listen to it! It’s wonderful – but you will have noticed the nasty sound on switching it on, and the permanent high-frequency noise. (Oddly enough, it’s no longer in the recording as soon as the sequencer starts, but believe me – it’s there, all of the time.)

Digital noise, for sure.

Continue reading