Trying to reverse engineer SysEx data from Peavey guitar amp. Malformed midi data (int >127)

[ekaats]

Hi there. I'm trying to reverse engineer the protocol Peavey uses for their modelling guitar amplifiers. Apparently they are using commands with values higher than 127. For example, the B0 and C0 in the quoted text a bit down. The manual of a comparable model mentions these values as well (B0 01 01 C0 03 on page 2).

In the issues I come across similar use cases, but there the problem often proved to be a start and end byte that was added to the message. Am I overlooking something similar, or is Peavey really using out of spec commands?

Sample aseqdump data:

Source Event Ch Data
14:0 System exclusive F0 00 00 1B 12 00 46 F7
14:0 System exclusive F0 B0 00 01 C0 58 F7
14:0 System exclusive F0 00 00 1B 12 00 63 7F 7F F7
28:0 System exclusive F0 00 00 1B 12 09 46 00 08 02 05 00 00 0A 64 64 4F 40 6A 00 00 00 00 00 00 00 F7
28:0 System exclusive F0 00 00 1B 12 09 63 7F 7F 01 0F 06 0A 05 0A 06 04 01 05 01 0F 00 0F 00 06 00 04 02 0A 01 0A 04 0E 06 08 00 00 03 09 00 00 0F 0F 00 00 04 00 04 00 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F 00 00 00 00 00 00 00 00 02 0A 04 01 04 03 04 0F 05 05 05 03 05 04 04 09 04 03 02 0A 04 06 04 0E 04 07 05 02 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02
28:0 System exclusive 00 02 00 02 00 02 00 0A 05 F7

Manual:
https://assets.peavey.com/literature/additional/118745_31036.pdf

[rdoursenaud]

B0 00 01 is a standard MIDI Control Change message on the first channel, controller number 0, value 1.
C0 58 is a standard MIDI Program Change message on the first channel with program number 58.

This matches what is stated in the linked manual.

There is no reason to have these embedded in a SysEx command.

Where is the aseqdump data comming from?

[rdoursenaud]

To clarify: per specification, MIDI System Exclusive messages cannot contain any data byte above 127 (0x7F) except System Real Time Status Bytes (0xF8-0xFF).
Such bytes (>127) are, by design, Status Bytes.
If present after a Start of Exclusive (0xF0) and before an End of Exclusive (0xF7), these bytes terminate the System Exclusive data stream as an End of Exclusive message would.
Thus F0 B0 00 01 C0 58 F7 is equivalent to F0 F7 B0 00 01 C0 58 F7 and should be interpreted as B0 00 01 C0 58.

[ekaats]

Thank you for your explanation.

The aseqdump is from a bridged device, showing the messages from propriety software (14:0) And from the amplifier (28:0)
So if I understand it correctly, those lines should be CC message, but somehow is send as SysEx?

[rdoursenaud]

Ok so the offending messages are comming from your software since you misinterpreted the documentation.

In fact, the device uses standard Control Change (Bc cc vv) and Program Change (Cc pp) messages.

• B: Control Change Status Byte
• C: Program Change Status Byte
• c: MIDI channel
• cc: Control Number
• pp: Program Number

So, yes, you should change this sysex message: F0 B0 00 01 C0 58 F7 to two standard messages for the expected behavior.

With MIDO, this would translate into:

• B0 00 01:

  mido.Message('control_change', channel=0, control=0x00, value=0x01)  # or control=0, value=1 in decimal notation

• C0 58

  mido.Message('program_change', channel=0, program=0x58)  # or program=88 in decimal notation

Hope this will help you follow the documentation and achieve the results you expect.

Welcome to the community!

[rdoursenaud]

Oh, I just red the thread again and notice I’ve been mistaking the software you’re trying to reverse engineer with your own software. Apologies.

You’ve found a bug in the proprietary software! Congratulations.

The programmer might not have known MIDI very well. Fortunately, the protocol designers have accounted for such a case and it seems that the people developing the hardware followed the specification and ignored the bogus bytes.

My explanations still stand and sending the messages above should yield the same result.

Feel free to ask if anything is unclear.

[ekaats]

Thank you for your help so far. Both ends are indeed not my own software or firmware, but I am trying to build something that may replace the software part.

I'll have a go at it later to see if the firmware also reacts to properly formatted data.

[ekaats]

I probably need to spend some more time poking at the amp to have it do what I'd like, but thank you for your help. I'll close the treat to not clutter it up. Thanks again!

[rdoursenaud]

Thanks. Please let me know how it goes. I love reverse engineering projects and am a guitarist myself ;)