Does anybody have a copy of older update files for the Motif XS? It appears that the only version Yamaha now provides is 1.60.

🎹Lex - 08 October 2019 09:49 AM

Does anybody have a copy of older update files for the Motif XS?

Just curious - why?

 

🎹Lex -

It appears that the only version Yamaha now provides is 1.60.

Version 1.12 is here:
http://www.motifator.com/index.php/support/view/motif_xs_os_updater_v1122

That version incorporates features and bug fixes of all XS OS updates previous to it. Only versions 1.51, 1.55, and 1.60 followed.

Thank you! I’m doing some exploratory work regarding modifying the OS, and it’s helpful to have more data to dig through. At the moment things aren’t progressing as smoothly as hoped, as the XS update files aren’t as easily picked apart as the ones for the Montage (those are simply Linux filesystem images).

You’re welcome.

I’m not sure how helpful they might be for you, but source code files for the MOTIF XS, MOTIF-RACK XS, S90XS and MOTIF XF (which run under MontaVista Linux) are available at…
https://download.yamaha.com/sourcecodes/synth/
...as are the Montage and MODX files.

Thanks again. I’ve done some looking through the GPL licensed code (on that page) for the XS and XF, and unfortunately there does not seem to be very much in there that is unique to the Motif. There are some Yamaha and MontaVista patches to GPL code in order to customize it for the XS/XF hardware, but I haven’t gleaned much from these.

One interesting thing is a Yamaha patch to a bit of software called “ivman” which provides for CD and DVD autostart functionality. This is present in both the XS and XF. Do these Motifs have disc drive support hidden inside? Can it be accessed in production hardware (via USB?), or is it a relic of development? I’m not sure.

Another thing is that the XF contains a Yamaha patched copy of a version of the VNC Server which was originally ported to Android. I don’t have an XF to explore if there actually is an active VNC Server listening on its network interface. Interesting to see that an Android port was used.

I haven’t yet had success cracking open the update (PGM) files. I can see that there are large blocks of data between versions 1.12 and 1.60 that are identical. No success yet in determining if it’s compressed. It’s interesting that version 1.60 is more than 3.5 times larger than version 1.12.

I’ve been trying to gain access to a shell on the Motif via exploitation of the Samba file sharing server, in order to hopefully be able to make a copy of the live OS itself. Interestingly, the version of the Samba server was updated from 3.0.10 to 3.0.24 between Motif XS OS 1.12 and 1.60. Yamaha’s source code packages only contain version 3.0.10 and the source for 3.0.24 is nowhere to be found—except in the Motif XF source code packages.

Even Samba server version 3.0.24 should have a few vulnerabilities, but I haven’t yet had any success here.

I wonder if VNC capability relates to the “News” function that was implemented as of version 1.30 of the XF OS.

See page 8 of the XF Supplementary Manual
https://usa.yamaha.com/files/download/other_assets/4/325614/motifxf_v150_en_nf_c0.pdf

However, it would seem that in this case the XF would be the “client”.

Although I have my XF connected via Ethernet LAN, I’ve never connected it to the Internet. I’m therefore not sure whether that function is still supported by Yamaha, and how useful it is/was.

VNC is used for remotely viewing and controlling one computer screen (the server) using another (the client). If you like, you could try downloading a VNC client (RealVNC offers a free client for many platforms including mobile) and attempting to connect to the IP address of your XF on your local network.

Alternatively you could try using Zenmap (a GUI interface for nmap. the download link on that page is nmap-7.80-setup.exe as of this writing) to scan the XF for open ports. It’s possible that the VNC server is listening on a nonstandard port, or perhaps only runs in development versions of the build. Perhaps there’s even a secret key combination that when held at startup will activate the server (and perhaps other debugging tools?) Just spitballing.

With my XS, when the File Server is turned on, nmap finds the two standard Samba ports (139 and 445) and nothing else. Any extra ports on the XF would be really interesting.

Looking through the service manual, I got really excited when I saw that there were three separate test modes: one of which performs a “system dump” to USB. Unfortunately, it’s really just a copy of all user data that’s written to an image file on the USB.

I did find another mention of CD ROM, in the service manual as an explanation for the error message that an XS will provide when trying to write to a read-only disk. Perhaps these keyboards really can read from an external disc drive connected to the USB port. I don’t have one to try it out. I figure that this is only support for reading files from data discs, though. It would be kind of neat if they could actually read audio discs straight into the sampler.

Now that I remember the XF’s network audio feature as well as the technical description by arachsys, I should mention that you should also see port 5555 open in nmap. That also presents another potential entry point for hacking a way into a shell prompt.

That’s one of the XF features that I believe should be able to be backported to the XS…

Edit: also port 5556.