A Kontrol S61 Mk3 and a screwdriver walk into a bar...

Options
reffahcs
reffahcs Member Posts: 845 Guru
edited February 2 in Komplete Kontrol

For everyone that's been curious to know what's inside a Kontrol S61 MK3 keyboard, here's a bit of a teaser. I'm hoping to make this an ongoing thread so other people who find out more info about the MK3 can post it here.

The brains. As I've mentioned in other posts, the main microcontroller is an STM32MP157. I didn't look up the 2 nanya chips, but I'm 99% certain they're SDRAM. The Kingston chip is where the OS lives, which is a modified version of Linux.

image.png

Here's a little helper chip the ATMEL and I would assume the chip at the top is it's RAM as well. Interesting there's a rather large unpopulated board area on the left there just underneath the smaller unpopulated footprint.

image.png

And what do we have here? Engineering mode you say? (cue evil laugh) I wonder if that's enabled in the release firmware??

image.png

Time to warm up the soldering iron.

There's another core chip that deals with the mod and pitch wheels that I didn't get a picture of. I'll try and remember to grab one if I can next time I'm messing with the guts again.

If anyone else is silly enough to take their MK3 apart, please be careful! There's lots of flat flex cables and some of the connectors aren't very durable (not rated for very many insertions). Also, it's a bit of a beast just to turn upside down to access all the PCB's.

Hope you all enjoyed a look at the insides.

Cheers

Tagged:
«1

Comments

  • D-One
    D-One Moderator Posts: 2,884 mod
    Options

    👀

    Oh yeah, fun times! If you hack it so it can make coffee I'll pay you 6$ and a pack of gum, the good kind!

    So, you gotta short those first 2 pin pairs to get into 'Eng Mode' ? Very curious to see what you find out

  • reffahcs
    reffahcs Member Posts: 845 Guru
    edited February 2
    Options

    That's my thought but it's entirely possible that whatever features are enabled by engineering mode have been removed from the production firmware. It's very common to see that in embedded devices.

    I might have to buy one of those USB-C portable soldering irons, it's just not practical to move the entire keyboard to my electronics space where my soldering station is at.

  • reffahcs
    reffahcs Member Posts: 845 Guru
    edited February 2
    Options

    As promised, "How to change your startup splashscreen"

    ************

    I do not work for NI, I'm not associated with NI in any way, nor is this advice endorsed or condoned by NI. Don't blame me or Native Instruments if you brick your device.

    ************

    Step 1 is to find the firmware and mount it. You know you have the firmware when you run file and it reports the file is an ext4 filesystem. It's a standard Linux ext4 filesystem so mounting it is the same as any other.

    image.png

    Where's the firmware exactly? That's the question. I'll say that everyone already has the firmware, they just need to search for it.

    The splashscreens are 1280x480 BMP files. I'm pretty sure they're 256 color as well, but don't quote me on that. If you get some weird color shifting with your picture, then try dropping the colors down to 256 colors. The files are located in /boot/splashscreens

    image.png

    The normal splashscreen displayed during boot is default.bmp when you place your device in firmware update mode with the power button, that file is called recovery.bmp

    Make sure the files are the proper size. I haven't done a lot of testing so the keyboard might rescale some files, but I do know that if they're over a certain size it just shows up as garbled junk.

    Once you've replaced default.bmp and/or recovery.bmp, you're good to unmount the filesystem (maybe run sync a few times first?)

    Now all that's left to do is replace the original ext4 filesystem with your modified version, place your device in recovery mode and update your firmware!

    image.png

    And if you did everything correctly you now have a new splashscreen.

    image.png
    image.png

    If it doesn't work, the MK3 keyboard seems pretty resilient and you can simply try again. As long as you can still put it in recovery mode you can simply use the original ext4 to restore your MK3 back to the factory firmware.

    I'll end this with saying I have no idea if this voids your warranty (probably, especially if you brick it), for me I'm not too concerned. I took my keyboard to pieces, "void warranty" is pretty much my middle name.

    That being said, I'd be curious to see what other people change their splashscreen to if anyone is brave enough to post results :)

    Cheers

  • nightjar
    nightjar Member Posts: 1,287 Guru
    Options

    A Kontrol S61 Mk3 and a screwdriver walk into a bar...

    Bartender says to the screwdriver: "Hey buddy, your date looks a little young. Sure she's ready for a place like this?"

    Screwdriver says: "Oh she's not gonna drink. She'll just have a few chips..."

  • reffahcs
    reffahcs Member Posts: 845 Guru
    Options
    https://community.native-instruments.com/discussion/comment/130474#Comment_130474

    Get it???? CHIPS!!! 😂🤣

    image.png


  • MorrisEd
    MorrisEd Member Posts: 68 Helper
    Options

    I envision Native Instruments “engineering” mode being Lego Star Wars or one of those games where you have to match different shaped blocks with their respective holes.

  • Duffcat
    Duffcat Member Posts: 31 Helper
    Options

    I’m finding this thread full of interesting possibilities. Any chance we can start a GitHub group and create an alternate firmware to NI?

  • Simchris
    Simchris Member Posts: 254 Pro
    Options

    can we port my old RECEPTOR files? (*kidding)

  • Oscar Morante
    Oscar Morante Member Posts: 34 Member
    Options
    https://community.native-instruments.com/discussion/comment/140655#Comment_140655

    I would be very interested in a dumb firmware that sends midi and allows remote control of all the leds/screen (a la Push2).

    Has anybody succeeded at inspecting the system while it's running? I think all the magic happens in /usr/bin/ni-roda but I don't know if we can just replace that binary with something simpler without breaking things.

  • reffahcs
    reffahcs Member Posts: 845 Guru
    Options
    https://community.native-instruments.com/discussion/comment/149487#Comment_149487

    I'm not sure what would happen if the file was missing or if it was modified. A lot of embedded devices are designed to restart if any of their critical services aren't running or stop running. I haven't been able to connect to it while it's running, but I'm sure there's a way. A forum member mentioned a few months ago something about using a Raspberry Pi and an USB ethernet adapter to perform a firmware update, but I was never able to find out any details and they never responded to my dm on this forum.

    You could start by running a recursive grep, just "grep -R ni-roda" on Ubuntu to find any file that references the binary. That should tell you if it's running as a service. All that said, I don't think it would brick your keyboard if you modified it as you should be able to boot it into recovery mode.

    I can't say for 100% certainty though that ni-roda isn't critical to the firmware update process though. You would probably want to put it in IDA or Ghidra first and have a gander at it to make sure it's not a necessary part of the firmware update process.

  • Oscar Morante
    Oscar Morante Member Posts: 34 Member
    Options

    From my very superficial inspection using strings /usr/bin/ni-roda it looks like it's the Qt QML app that runs the GUI on the screen. Qt is statically linked and the QML compiled and also embedded in the binary… so I think it's going to be very hard to modify/extend. I'm yet to check which libraries it's linking dynamically and try to get an idea of how it controls the leds/buttons/midi bits, that's why opening a shell while the keyboard is running would be very helpful. I see the firmware includes openocd… that might be a way forward but I'm not familiar with that tool.

    It would be great if ni-rode isn't doing anything critical about system initialization, firmware, etc. so we can replace it with something else that changes the behavior without making many changes and without risking bricking the keyboard.

  • nightjar
    nightjar Member Posts: 1,287 Guru
    Options

    And I suspect the Qt QML app running the screen GUI that is related to the ongoing problems with the MK3 keyboards running with Apple Sonoma. But????

  • Oscar Morante
    Oscar Morante Member Posts: 34 Member
    Options

    This one is running inside the keyboard though so I think it's unlikely that it would be causing crashes on the mac…

    FWIW Kontakt/KK are working fine for me on Sonoma with Cubase/ProTools/Reason.

  • reffahcs
    reffahcs Member Posts: 845 Guru
    Options
    https://community.native-instruments.com/discussion/comment/149764#Comment_149764

    It uses OpenOCD to flash the firmware to the other two microcontrollers.

    The LED's shouldn't be too hard to blink, most embedded devices map then to either /dev or more likely /sys and then it's typically just a matter of echo 0 or 1 to the device name.

    That's where I got stuck too, I was able to make changes to the file system but unsure of how to physically establish a connection. I do think a USB ethernet adapter is probably the best bet assuming you can get SSH running on the keyboard.

Back To Top

Categories