From Silicon to Darude Sand-storm: breaking famous synthesizer DSPs

From Silicon to Darude Sand-storm: breaking famous synthesizer DSPs

Speakers: giulioz

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=XM_q5T7wTpQ

Overview

This talk, "From Silicon to Darude Sand-storm: breaking famous synthesizer DSPs," delves into the intricate process of reverse engineering proprietary Digital Signal Processor (DSP) chips found in iconic 1990s and 2000s synthesizers. Presented by giulioz, a software engineer and member of "the usual suspects" group, the presentation details their ambitious quest to create accurate, low-level software emulations of these vintage instruments. The core challenge addressed is the preservation of musical history by making the unique sounds and functionalities of these aging, often prohibitively expensive, hardware synthesizers accessible in modern Digital Audio Workstations (DAWs).

The talk highlights the specific case of the Roland JP-8000, a virtual analog synthesizer famous for its distinctive "Super Saw" oscillator, which was notably used in the iconic trance track "Darude Sandstorm." Despite the JP-8000's widespread popularity, the proprietary nature of its internal DSP chip meant that its exact workings, particularly the Super Saw algorithm, remained a mystery for decades, sparking extensive speculation among audio enthusiasts. giulioz's team embarked on a multi-faceted reverse engineering journey, combining intricate silicon analysis with innovative hardware probing techniques, ultimately deciphering the DSP's architecture and instruction set, and finally revealing the surprisingly simple secret behind the legendary Super Saw sound. This endeavor not only provides a blueprint for preserving complex digital hardware but also underscores the power of persistent, interdisciplinary reverse engineering in unlocking the secrets of black-box systems.

Background

▶ Watch: Introducing the project: Emulating old digital synthesizers (0:40)

The "usual suspects" group is dedicated to the preservation of vintage digital and virtual analog synthesizers from the 1990s and 2000s. Their mission is to create highly accurate, low-level software emulations that allow musicians to experience these instruments in a modern DAW environment, even as the original hardware inevitably ages, breaks down, and becomes prohibitively expensive. Early successes included emulating synthesizers like the Nord Lead 2, Access Virus, and Waldorf models, which relied on the well-documented Motorola DSP 56K chip. This allowed the team to build a JIT-optimized emulator called Gear Emulator, converting the DSP's code to ARM and x86 for fast execution on contemporary computers.

However, a significant challenge emerged with the Roland JP-8000, a virtual analog synthesizer from 1996 that achieved legendary status in trance music, largely due to its unique "Super Saw" oscillator. Unlike the Motorola DSP, the JP-8000's DSP was entirely proprietary, lacking any public documentation. This lack of information left the inner workings of the Super Saw a subject of intense, often speculative, debate within music production forums since at least 2009. Theories ranged from complex phase detuning and comb filtering to exotic chorus effects, with some even proposing extraterrestrial origins for its sound. In 2010, Adam Szabo published a bachelor's thesis attempting to deduce the Super Saw's mechanism through audio analysis and mathematical modeling, achieving remarkably close results but without access to the actual software. The prevailing sentiment among enthusiasts was that without a datasheet for the proprietary DSP, a true emulation was impossible. The "usual suspects" group, however, held a fundamental belief: digital audio, at its core, is mathematics and software. If the underlying math and code could be correctly identified, an accurate emulation—and thus a complete understanding—was achievable, no matter how proprietary the hardware. This conviction set the stage for their deep dive into the Roland JP-8000's silicon.

Key Findings

▶ Watch: The famous 'Super Saw' sound and its mysterious origins (4:00)

The extensive reverse engineering effort yielded several critical findings that not only enabled the successful emulation of the Roland JP-8000 but also demystified one of electronic music's most iconic sounds.

Firstly, the team successfully reconstructed a comprehensive understanding of the proprietary Roland DSP's architecture and instruction set, effectively creating a "datasheet" where none existed. They discovered it was a dual-core processor with a 24-bit multiplier, two accumulators, and a program memory capable of holding 766 instructions. The instruction set was found to be remarkably simple, primarily centered around Multiply-Accumulate (MAC) operations, which are fundamental for DSP tasks like oscillators, filters, and chorusing. They also identified specific instructions for storing results, saturation (for modulo operations), and communication between cores via a shared Global RAM (GRAM). Crucially, they identified unique control flow mechanisms, including conditional jumps and a "skip based on condition" instruction. A surprising discovery was the architectural similarity between this advanced 1996 synthesizer DSP and a simpler 1990s guitar pedal DSP (the LSP), suggesting a common underlying design philosophy and the iterative nature of DSP development.

Secondly, and perhaps most anticipated by the music community, the mystery of the Super Saw oscillator was definitively solved. Through the disassembler built during the emulation process, the team revealed that the Super Saw is implemented with remarkable simplicity: seven naive saw waves, each generated by a simple counter, passed through an output high-pass filter. There are no complex phase tricks, modulation, or chorus effects involved. The distinctive "detuned" character comes from a specific table of coefficients applied with integer math. To mitigate aliasing artifacts inherent in naive saw waves, the entire DSP engine runs at double the standard sample rate (88.2 kHz), effectively pushing aliasing frequencies beyond the audible range without complex anti-aliasing algorithms. This revelation validated Adam Szabo's earlier work, showing how close his mathematical derivations of detuning coefficients were to the actual program values.

Finally, the project culminated in a highly performant and accurate software emulation. Initial C++ emulation, while functional, ran slower than real-time. This led to significant optimization efforts, including JIT (Just-In-Time) compilation using the AsmJit library, which translates the DSP bytecode into native x86 or ARM instructions. This optimization boosted performance to five times real-time on a single core, making the emulation practical for modern DAWs. The resulting plugin, designed with an interface mirroring the original hardware, garnered significant positive feedback, even receiving an endorsement from Darude himself. The successful emulation not only preserves the sound of the JP-8000 but also makes the underlying technology transparent and accessible, culminating in the public release of the emulator's code on GitHub.

Technical Deep Dive

▶ Watch: Digital audio is mathematics, enabling software emulation (6:00)

The journey to break the Roland JP-8000's proprietary DSP involved a multi-pronged technical approach, starting with physical silicon analysis and pivoting to innovative hardware probing when the former hit a roadblock.

The synthesizer's mainboard revealed several key components: an Hitachi H8S microcontroller (well-documented) handling front panel controls, the keyboard, and crucially, uploading programs to the DSPs. This microcontroller was successfully emulated early on, providing a crucial interface for interacting with the unknown DSPs. The real challenge lay with the four proprietary DSP chips, connected in series, which performed the actual signal processing. These chips were entirely undocumented, presenting themselves as "a bunch of random bytes" to the microcontroller.

The initial strategy involved silicon decapping, a technique common in arcade and console emulation where the protective packaging of a chip is removed to expose its internal circuitry. While the speaker had prior experience decapping an older 1986 Roland piano module, the 1996 DSP proved far more complex. Microscopic analysis revealed areas of static RAM and extensive standard cell logic—rows of basic logic gates (AND, OR, XOR) interconnected by two layers of metal wiring (one blue, one orange). To automate the tedious process of mapping these cells, the team collaborated with an expert in semiconductor photography and reverse engineering. They trained a machine learning model to recognize specific "vias" (connection points) within the cells, allowing for the automated identification and mapping of every instance of each logic cell across the chip.

Extracting the wiring proved to be a two-tiered challenge. The top metal layer was successfully mapped using specialized microscope lenses that could focus on this layer while blurring everything beneath. Computer vision techniques were then employed to extract these clear wiring paths. However, extracting the bottom layer of connections presented a "giant roadblock." The conventional method, lapping (sanding down the chip micrometer by micrometer), was deemed too time-consuming, unreliable, and prone to alignment errors. Manual tracing was an option but would have taken an estimated month of work, leading to a slowdown in the project.

At this juncture, the team pivoted to hardware probing, treating the DSP as a black box that could be interacted with. The philosophy was to "poke it with a stick and see what happens." This involved building a test setup using an Arduino Mega connected to the DSP's host interface. To avoid sacrificing expensive synthesizers, they sourced a cheaper expansion board that contained the same proprietary DSP. An easier target for initial exploration was a Factor Rack unit, which coincidentally used the same DSP and CPU architecture. Crucially, its service manual detailed a test mode that provided diagnostic error messages, hinting at internal memory areas like PR0 (program 0), PR1 (program 1), E RAM, and G RAM.

By running these test modes, the team gleaned critical insights: the DSP had two program memories, each 768 words (instructions) long, strongly suggesting a dual-core architecture (later confirmed). Instructions were found to be 24-bit and 28-bit, consistent with silicon observations. Further analysis involved observing program changes when manipulating synthesizer parameters. For example, changing the volume clearly showed a coefficient in the program changing, leading to the deduction that the last eight bits of each instruction encoded a signed integer coefficient (likely for multiplication). Similarly, manipulating delay times revealed patterns related to ROM read parameters.

To understand the DSP's interaction with external memory, a logic analyzer was attached to the DRAM. By spamming random ROM commands, they identified specific patterns for "read" and "write" operations at particular addresses. A breakthrough came with identifying an opcode that sent results back to the CPU. This enabled a crucial feedback loop: running a single instruction, reading its output via the Arduino, and deducing its function. This iterative process allowed them to reverse engineer fundamental instructions like immediate loading, multiplication, subtraction, and control flow.

Combining the insights from silicon analysis (e.g., multiplier presence, dual-core hints) and hardware probing, a comprehensive "datasheet" for the proprietary DSP was reconstructed. It confirmed the dual-core design, a 24-bit multiplier, two accumulators, and distinct program memories. The instruction set was confirmed to be highly specialized for DSP, featuring Multiply-Accumulate (MAC) operations (accumulator += RAM_value * constant), along with instructions for storing results (including saturated stores for modulo), reading/writing GRAM for inter-core communication, variable multiplication, and "rectify/clamp/interpolate" (essentially absolute value functions). The complex control flow included conditional jumps and a "skip based on condition" instruction. A significant finding was the striking similarity of this instruction set, memory addressing, and coefficient size to the earlier LSP DSP found in the 1990s guitar pedal board, indicating an evolutionary design.

To ensure accuracy, rigorous unit testing was implemented, checking specific cases against the real hardware and employing fuzzing (spamming random instructions) to verify that the emulator and hardware behaved identically. Audio output comparison was also crucial, ensuring the emulator's bit-perfect reproduction of the original hardware's sound, as even minor discrepancies could lead to severe audio artifacts like "spicy sine waves" or DC offset.

Demo / Proof of Concept

▶ Watch: The major hurdle: A proprietary, undocumented DSP chip (8:00)

The culmination of the extensive reverse engineering effort was the successful creation and demonstration of a fully functional, high-fidelity software emulation of the Roland JP-8000.

The initial proof of concept involved integrating the newly developed C++ class for the DSP emulation into the existing JP-8000 keyboard emulator. Since the four DSPs in the JP-8000 are connected in series, the team first isolated the output of the very first DSP. When audio was rendered from this single DSP and analyzed in Audacity, it produced the unmistakable sound of the Super Saw. This moment marked a significant breakthrough, confirming the accuracy of their reverse engineering and solving a decades-old musical mystery.

Next, the full system was assembled by instantiating the DSP class four times, meticulously configuring their inter-communication and data passing. When the emulator was run with the original JP-8000 firmware and demo songs, it produced the correct audio, albeit with a critical performance issue: it ran slower than real-time. This meant the sound was correct but played with noticeable gaps and delays, rendering it unusable for practical music production.

To address the performance bottleneck, a series of aggressive optimizations were implemented. These included pre-decoding instructions to avoid repetitive bitwise operations, flattening instruction sequences, removing no-op instructions, flattening accumulators, and simplifying the internal pipeline. While these steps improved performance, they were still insufficient. The ultimate solution was JIT (Just-In-Time) compilation. Leveraging the AsmJit library, the DSP bytecode was dynamically translated into native x86 or ARM instructions at runtime. This proved to be a game-changer, dramatically boosting performance from slower than real-time to an impressive five times real-time on a MacBook. This level of performance meant that a single CPU core could comfortably run multiple instances of the JP-8000 plugin simultaneously.

The team then developed a user-friendly plugin interface designed to closely mirror the original JP-8000 hardware, providing an authentic user experience. The plugin was released in a closed beta, receiving overwhelmingly positive feedback from the music community. A particularly notable endorsement came from Darude, the artist behind "Sandstorm," who actively promoted the plugin on Instagram and even defended its authenticity against skeptics in online discussions. The talk concluded with a live audio demonstration of the emulated JP-8000 playing various sounds, showcasing its accurate reproduction of the iconic Super Saw and other patches. The project's code was subsequently released as open-source on GitHub, making this groundbreaking emulation accessible to everyone.

Defensive Implications

▶ Watch: The bold decision: Decapping chips to reverse engineer DSP (9:00)

While this talk isn't about traditional cybersecurity vulnerabilities or exploits, it carries significant "defensive implications" within the realm of digital preservation, user empowerment, and combating planned obsolescence. The core defense articulated by giulioz's work is against the loss of cultural artifacts and functionality due to proprietary black boxes and the inevitable decay of hardware.

Firstly, by successfully reverse engineering the Roland JP-8000's proprietary DSP, the team provides a powerful defense against vendor lock-in and the planned obsolescence of complex electronic instruments. When hardware fails or becomes too expensive to maintain, access to its unique sounds and features is lost. This project demonstrates that even undocumented, custom silicon can be deconstructed and emulated, ensuring that musical heritage embodied in these synthesizers remains accessible indefinitely. This is a defense for artists, producers, and enthusiasts against losing tools that defined entire genres of music.

Secondly, the methodology employed—combining silicon analysis, hardware probing, and bytecode reconstruction—serves as a blueprint for digital forensics and intellectual property transparency in embedded systems. The ability to understand exactly how a black-box system operates, down to its instruction set and algorithms, provides a powerful check against opaque designs. While not directly applied to security here, this capability could be crucial in auditing embedded systems for hidden functionalities, backdoors, or unintended behaviors if such systems were integrated into critical infrastructure or consumer devices where trust and transparency are paramount.

Finally, the open-sourcing of the emulator code reinforces the defense of knowledge sharing and community-driven preservation. Instead of proprietary secrets dying with their original creators or hardware, the detailed technical insights and the working emulation are made available to the public. This collective knowledge base strengthens the ability of enthusiasts and researchers to understand, maintain, and even innovate upon existing technologies, fostering a more resilient and open ecosystem for digital culture and technology. In essence, the talk champions a defense through understanding and open access, ensuring that "magic pixie dust" is replaced with transparent mathematics and software.

Key Takeaways

• Proprietary Hardware is Not Impenetrable: Even highly customized and undocumented DSP chips from complex instruments like the Roland JP-8000 can be reverse-engineered through a combination of physical silicon analysis and systematic hardware probing.
• Multi-Modal Reverse Engineering is Powerful: When one approach (e.g., silicon decapping) reaches its limits, pivoting to another (e.g., hardware probing with an Arduino and logic analyzer) can provide crucial breakthroughs, leading to a comprehensive understanding of the system.
• The "Super Saw" Mystery Solved: The iconic Roland JP-8000 Super Saw is surprisingly simple: seven naive saw waves, high-pass filtered, and run at double the sample rate (88.2 kHz) to mitigate aliasing, rather than complex phase modulation or chorus effects.
• Performance Requires JIT Compilation: Accurate, low-level emulation of complex DSPs for real-time audio applications demands significant optimization, with JIT (Just-In-Time) compilation proving essential for achieving practical, real-time, or even faster-than-real-time performance.
• Preservation of Digital Heritage: Open-source, low-level emulation is a vital tool for preserving musical history, making the sounds and functionalities of aging, proprietary hardware synthesizers accessible to future generations in modern software environments.
• Interdisciplinary Collaboration and Persistence: The project demonstrates the power of combining expertise (e.g., software engineering with semiconductor analysis) and the importance of persistent effort in overcoming seemingly "impossible" challenges posed by black-box systems.

About the Speaker(s)

giulioz is a software engineer and a key member of "the usual suspects" group. His work focuses on the low-level emulation of vintage digital and virtual analog synthesizers from the 1990s and 2000s, aiming to preserve their unique sounds and functionalities for modern musicians. Despite self-admittedly having limited formal hardware expertise, giulioz has a proven track record in hardware reverse engineering, having previously presented on his successful efforts to reverse engineer a 1986 Roland piano module. His dedication lies in transforming complex, proprietary hardware into accessible, accurate software emulations.