DEQ2496 firmware hacking

This is not a full eeprom dump. It's update file to upload it via MIDI interface.
This way not work for me :(

Sorry just saw you'd already tried this, and I'm still moderated so can't edit my post yet. [EDIT: Not anymore, thanks!]

The "F" on the screen means that EEPROM block failed to be written successfully, so it looks like somehow your EEPROM chip has stopped working properly. This would explain why the application disappeared in the first place.

You'll need to source a replacement EEPROM from an electronics supplier and flash it with the bootloader and application. (You already have the application in the .syx file, but not the bootloader.)

Unless someone else can post a copy of the v1 bootloader they took with an EEPROM reader, you might have to figure out a way of dumping it yourself. In theory you can use the code I wrote to produce a .syx file that will fully flash the new chip (so you can do a hot switch, powering up with the old broken EEPROM, swapping in the new blank one with the power still on, then performing the bootloader flash via MIDI to get it into the new chip, then reflashing the application into the new chip as you have already done), but I haven't tried this with a v1 device so I don't know if the encryption key is correct in order to generate a .syx file that contains the bootloader (if we even had a dump of the v1 bootloader).

EDIT: Actually, before you do that, it would be a good idea to open up the unit and just make sure there's no fluff or dust or anything touching the IC pins on the EEPROM. I have seen before that if some of the address lines aren't working properly you can get failures on some flash blocks but not others. It's possible the chip is defective, although odd so many blocks would fail at once, so there is some possibility it might just be some sort of conductive rubbish touching the wrong pins on the chip. The EEPROM is the large rectangular chip that sits in a socket.
 
Last edited:
Hello Guys Im new on the forum, hope youre well!
Ive a question , I try to update my DEQ2496 ultracurve pro from 1.1 vers to 1.4 vers with sysex, c6 on mac and midi ox on windows without result, the maschine is blocked on bootloader , I try to send syx file with RME Fireface 800 via midi , Audio 8 and Usb to Midi, but doesnt work , can anyone help me please? maybe send the firmware 1.1 or a correct update? how i can solve the problem? thank you in advance
 

Attachments

  • Senza-titolo-1.jpg
    Senza-titolo-1.jpg
    196.6 KB · Views: 154
Hi all,

I'm new to this forum so not sure if this is the sort of thing that interests anyone here.

I've recently repaired a Behringer DEQ2496 due to a failed power supply (bad caps and a failed TOP245 switching controller) and while I had it in pieces I decided to finally write a program to communicate with it over MIDI as I had been meaning to do for many years.

It turned out that Behringer's SysEx document for the DEQ2496 is mostly wrong when it comes to the firmware, so it look a bit of reverse engineering and disassembly but I finally got the unit to accept messages from me:

deq2496.hello_world.jpg


The code is written in NodeJS and is available on GitHub if anyone is interested. It's still incomplete at the moment but I hope to add a few more features to it. Contributions are welcome if anyone wants to add support for other devices!

It's been a bit of an adventure getting this far, figuring out all the undocumented things. The data blocks you send to the device are encrypted with the string "TZ'04" (I'm guessing the initials of one of the developers), and the 7/8 coding and "CRC" algorithms mentioned in the SysEx manual aren't widely used or documented anywhere. But after a few days of trial and error I got it to work!

There are hints in the firmware that there might be a few undocumented SysEx functions (mostly technical) and there seems to be a hidden hardware test mode that I'd like to figure out how to activate, just out of curiosity. Apparently (from the messages I found) it's got something to do with adjusting the VR1 potentiometer on the main board.

My goal is to see if I can get the unit to run my own firmware, just for the fun of it. I could never hope to reproduce the functionality of the official firmware, but it always struck me that the device seems under utilised, with all those extra push knobs and buttons that duplicate functionality. Perhaps if I get all the pieces in place, someone else might end up creating their own firmware for it. Apparently there are ports of Linux that run on the Blackfin processors used by the device, so although it would be completely pointless, part of me wants to get Linux to boot on it just to see if it can be done :D (might be a bit tight though as it only has 2MB of RAM.)

Let me know if anyone is interested in this sort of thing and I'll post updates if I have any successes.

Hi Malvin,
This is very interesting !
I'm an IT guy so this adds fuel to the fire :D

If I understand this correctly, we can "mod" the firmware from Behringer to our liking?
I always feel the "selectable" frequency in the parametric equalizer and the Q factor is too coarse.
It would be wonderful if we can make it so that the parametric equalizer slides per 10 Hz or event 1 Hz.