The Kaossilator Pro is a Dynamic Phrase Synthesizer/Loop recorder from KORG,
and I just got mine this week !
However, the version I was able to find for a reasonable price is the Pro
one, which is discontinued... It has been replaced by the Pro + version which
looks almost the same, but offers 50 more programs.
I played a little with it, but soon I wondered if it was possible to upgrade it
to the "+" version. After all, both version might share the same hardware
(HW) ? It is quite possible since I do not see any real improvement that
would justify a entirely new HW revision. Maybe a bigger ROM to fit the new
I tried to find some service manuals, schematics, pictures of the inside of
both versions, or any other useful information, but I had no luck. Well, that's
not entirely true since I found the
service manual of the KORG Kaoss Pad 3 (KP3). The KP3 looks like a red
Kaossilator Pro, only offers effects (in a more advanced way than the
Kaossilator Pro would), is also discontinued, and has been replaced by a "+"
version too ! So not the same product, but they might still share some
HW/production related stuff/firmware layout, and we will see they do ! I
also found, on KORG's website,
one firmware upgrade for the Kaossilator Pro and and one for the KP3. No
firmware upgrade for the Kaossilator Pro + however (that would have helped a
lot), nor for the KP3 + yet... That's pretty much what I found so far.
The KP3 service manual is full of interesting things : a block diagram
of the device, a disassembly guide, all the schematics, the special key
combinations used in production/RMA, the touchscreen calibration procedure and
the BOM ! If the Kaossilator Pro and the KP3 HW are close enough, I might
be able to turn mine into a KP3...
So now I'm currently following two paths for deeper
- the hardware one
- the firmware one
Let's start with the hardware
Since I found nothing on the Kaossilator Pro hardware, it did not take long
before I opened mine, so here are some pictures :
We see that the KP3 and KaossPro HW are similar, but not identical.
They share (only the main ICs) :
- the C55xx DSP from TI (TMS320VC5501PGF 300)
- the AKM 4384ET DAC
- the 128Mbit SDRAM
They do not share :
- the H8S/2215C CPU : the KP3 has a
HD64F2215UTE16V (256KB ROM, 16KB RAM), the KaossPro has a HD64F2215CTE24V
which is probably
this one (256KB ROM, 20KB RAM)
- the ADC : the KP3 has a AKM 5381ET, the KaossPro has a AKM 5358AE
- the 64Kbit EEPROM : the KP3 has an SPI AKM 93C10AF, the KaossPro has
what appears to be an I2C L64 0S33W EEPROM which is unknown to Google
The ADCs are probably compatible, and the H8S/2215C CPU (the
manual can be found here) of the KaossPro should be able to run the KP3
code just fine. However, if they switched from an SPI EEPROM to an I2C one, the
KP3 FW will need to be patched...
I do not have the KaossPro schematics to check every connection, so if
someone has/finds the Kaossilator Pro Service Manual, please let me know
I would also gladly appreciate if someone could do the same work on a
Kaossilator Pro + or a KP3 +.
That's mainly what I found so far on the hardware side.
Now on the software side
I looked at both, the KaossPro (V1.02) and the KP3 (v2.00) firmware, and
they follow the same format :
- a 256 byte header
- a 256 kbyte (0x40000 bytes) block, which is the actual FW padded with 0xFF
(the size of the H8S/2215C On-chip ROM, lucky us !)
I saw no encryption/compression, nor signature.
The header format seems to be :
- the string "KORG SYSTEM FILE" on 16 bytes
- the string "KaossilatorPro" or "KaossPad3" (depending on the targeted
device), padded with 0x00 on 16 bytes
- the string "SYSTEM" padded with 0x00 on 10 bytes
- the FW version on 2 bytes (big-endian), read, as far as I know, by the
Updater application only
- a 4 byte unknown big-endian value (00 01 0E FF for the KaossPro, 78 FF FF
FF for the KP3)
- 16 unkown bytes (00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 for
- a 2 byte unknown value (02 80 for the KaossPro, FF FF for the KP3)
- 190 bytes being all 0xFF
The FW block seems to be exactly what the Updater will write into the ROM.
The first 512 bytes match the expected Exception Handling Vector Table, the
first vector being the actual entry point address (0x210).
I built the binutils tools
for the H8S arch, and used the generated objdump to disassemble the code. The
result at 0x210 looks legit as expected, but I did not find enough time to
analyze the code yet...
The first bytes of the code section (0x200) are "KORG", followed by what
appears to be the version in big-edian, probably the one returned/displayed by
the device itself.
What we learned so far
The KP3 HW is very similar to the KaossPro one, however its firmware won't
work as is on it. Some parts (at least the EEPROM access) will probably need to
be patched. I say probably because we can see an unpopulated footprint close to
the EEPROM that might be a SPI alternative for it.
I still hope that the Kaossilator Pro/Pro + HWs are the same, but since I have
no information on it at all, please do not hesitate to share anything you might
Regarding the firmware format itself, it seems that the code can be easily
modified. However, that looks a little risky considering there is no recovery
nor bootloader that would allow to restore a working firmware in case something
goes wrong (the code allowing to update the unit seems to be in the
firmware)... So for now, I will not play with that !
According to the H8S/2215C manual, it looks like there is a way to boot the
CPU from the USB, which would allow to repair a damaged unit, as well as
perform some safe tests. I will try to find more information about