We can’t think of where you’d buy a new, cheap, MIDI keytar that’s just a keyboard and a handle with some pitch and mod wheels or ribbon controllers. This is a format that died in the 90s or thereabouts. Yes, the Rock Band controller exists, but my point stands. In fact, the closest you can get to a cheap, simple MIDI keytar is the Alesis Vortex Wireless 2 Keytar, but the buttons on the handle don’t make any sense. [marcan] of Wii and Kinect hacking fame took note. (YouTube, embedded below.)
Reverse engineering is a research project, and all research projects begin with looking at the docs. When it comes to consumer electronics, the best resource is the documents a company is required to submit to the FCC (shout out to FCC.io), which gave [marcan] the user manual, and photos of the guts of the keytar. The ‘system update download’ files are living on the Alesis servers, and that’s really all you need to reverse engineer a keytar.
The first step is extracting the actual device firmware from whatever software package appears on the desktop when you download the software update. This is a simple job for 7zip, and after looking at a binary dump of the firmware, [marcan] discovered this was for an STM chip. With the datasheet of the chip, [marcan] got the entry point for the firmware, some values, and the real hardware hacking began. All of this was done with IDA.
This is a five-hour hacking session of cross-referencing the MIDI spec and a microcontroller built thirty years after this spec was developed. It’s an amazing bit of work just to find the bit of code than handled the buttons on the keytar grip, and it gets even better when the patched firmware is uploaded. If you want to ‘learn hacking’, as so many submitters on our tip line want to do, this is what you need to watch. Thanks [hmn] for the tip.
Five hours plus and sliding along the time line I didn’t even see him play it. Edit.
Playing the thing — although he does in the beginning and the end — is actually not the point. Also, you realize this is the replay of a live stream, right?
Don’t poo-poo the Rock Band keytar. It has MIDI-out, a ribbon, AND pressure sensitive – and about $20 new on eBay!
I realize my comment misses the point of the hack. 5 hours from unboxing to flashing (working) custom firmware is impressive. Having it recorded is neat, because you can watch the process and hear him reasoning the solution out, which is sometimes more useful than a written tutorial.
It’s not pressure sensitive in construction. I took one apart (I have um… a lot of them) and it turns out that it has two switches per key. The switches are set up so they will be hit sequentially. The time between the first and second switch closing allow you infer how the key was struck to add dynamics to the MIDI.
I agree that the disparagement of the Rock Band keytar is misinformed.
Shut Up ‘n Play Yer Keytar…with apologies to Frank Zappa
Yamaha Sonogenic Keytar just released recently. So the format has not died, but has recently been revived.