Nothing to see here ...

I tried to find some service manuals, schematics, pictures of the inside of both versions, or any other useful information, but I had no luck. Well, that's not entirely true since I found the service manual of the KORG Kaoss Pad 3 (KP3). The KP3 looks like a red Kaossilator Pro, only offers effects (in a more advanced way than the Kaossilator Pro would), is also discontinued, and has been replaced by a "+" version too ! So not the same product, but they might still share some HW/production related stuff/firmware layout, and we will see they do ! I also found, on KORG's website, one firmware upgrade for the Kaossilator Pro and and one for the KP3. No firmware upgrade for the Kaossilator Pro + however (that would have helped a lot), nor for the KP3 + yet... That's pretty much what I found so far.

The KP3 service manual is full of interesting things : a block diagram of the device, a disassembly guide, all the schematics, the special key combinations used in production/RMA, the touchscreen calibration procedure and the BOM ! If the Kaossilator Pro and the KP3 HW are close enough, I might be able to turn mine into a KP3...

So now I'm currently following two paths for deeper investigations :

• the hardware one
• the firmware one

Let's start with the hardware

Since I found nothing on the Kaossilator Pro hardware, it did not take long before I opened mine, so here are some pictures :

We see that the KP3 and KaossPro HW are similar, but not identical.

They share (only the main ICs) :

• the C55xx DSP from TI (TMS320VC5501PGF 300)
• the AKM 4384ET DAC
• the 128Mbit SDRAM

They do not share :

• the H8S/2215C CPU : the KP3 has a HD64F2215UTE16V (256KB ROM, 16KB RAM), the KaossPro has a HD64F2215CTE24V which is probably this one (256KB ROM, 20KB RAM)
• the ADC : the KP3 has a AKM 5381ET, the KaossPro has a AKM 5358AE
• the 64Kbit EEPROM : the KP3 has an SPI AKM 93C10AF, the KaossPro has what appears to be an I2C L64 0S33W EEPROM which is unknown to Google

The ADCs are probably compatible, and the H8S/2215C CPU (the manual can be found here) of the KaossPro should be able to run the KP3 code just fine. However, if they switched from an SPI EEPROM to an I2C one, the KP3 FW will need to be patched...

I do not have the KaossPro schematics to check every connection, so if someone has/finds the Kaossilator Pro Service Manual, please let me know !
I would also gladly appreciate if someone could do the same work on a Kaossilator Pro + or a KP3 +.

That's mainly what I found so far on the hardware side.

Now on the software side

I looked at both, the KaossPro (V1.02) and the KP3 (v2.00) firmware, and they follow the same format :

1. a 256 byte header
2. a 256 kbyte (0x40000 bytes) block, which is the actual FW padded with 0xFF (the size of the H8S/2215C On-chip ROM, lucky us !)

I saw no encryption/compression, nor signature.

The header format seems to be :

1. the string "KORG SYSTEM FILE" on 16 bytes
2. the string "KaossilatorPro" or "KaossPad3" (depending on the targeted device), padded with 0x00 on 16 bytes
3. the string "SYSTEM" padded with 0x00 on 10 bytes
4. the FW version on 2 bytes (big-endian), read, as far as I know, by the Updater application only
5. a 4 byte unknown big-endian value (00 01 0E FF for the KaossPro, 78 FF FF FF for the KP3)
6. 16 unkown bytes (00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 for both)
7. a 2 byte unknown value (02 80 for the KaossPro, FF FF for the KP3)
8. 190 bytes being all 0xFF

The FW block seems to be exactly what the Updater will write into the ROM. The first 512 bytes match the expected Exception Handling Vector Table, the first vector being the actual entry point address (0x210).
I built the binutils tools for the H8S arch, and used the generated objdump to disassemble the code. The result at 0x210 looks legit as expected, but I did not find enough time to analyze the code yet...
The first bytes of the code section (0x200) are "KORG", followed by what appears to be the version in big-edian, probably the one returned/displayed by the device itself.

What we learned so far

The KP3 HW is very similar to the KaossPro one, however its firmware won't work as is on it. Some parts (at least the EEPROM access) will probably need to be patched. I say probably because we can see an unpopulated footprint close to the EEPROM that might be a SPI alternative for it.
I still hope that the Kaossilator Pro/Pro + HWs are the same, but since I have no information on it at all, please do not hesitate to share anything you might find.

Regarding the firmware format itself, it seems that the code can be easily modified. However, that looks a little risky considering there is no recovery nor bootloader that would allow to restore a working firmware in case something goes wrong (the code allowing to update the unit seems to be in the firmware)... So for now, I will not play with that !

According to the H8S/2215C manual, it looks like there is a way to boot the CPU from the USB, which would allow to repair a damaged unit, as well as perform some safe tests. I will try to find more information about that !