These are the offsets of important address you can find inside the
asr-x's operating system memory.
1) It will be fun to create our
own presets for the FX and have them there when you power-on, no?
2) It would be cool to change the LFO shapes, right?!?!
3) It might also be interesting to change the graphics around, eg.
replace the * =* ==* ===* with G NG ING KING RKING ORKING WORKING, etc.
4) Also, for humorous effect you can change the data in the strings.
change **EMPTY** to -NADA! :(-
If you find any more useful info, esp. FX parameter locations,
i/o address of peripherals, etc, please mail us.
Addr. Information
--------------------
0x00a9a strange routine, called often.
It saves the status register in d0.
Enables only interrupt #1, goes into supervisor state.
reads word from $be00030
if negative, it writes d0 to $be00032. (WHY!)
then it adds one to $be00030.
and returns.
0x00c8a The code makes three jsr's in a row here. The first one is to
print out the power-on message. the other two??
jsr($972a) - disp poweron msg
jsr($a9da) - ?
jsr($ae92) - ?
then more jumps to
jsr($16622)
jsr($61e56)
jsr($6ddc6)
jsr($976fa)
jsr($157da)
jsr($15e1a)
jsr($f9cb2)
jsr($6de1a)
jsr($1c756)
0x0a9da This code just seems to clear a whole bunch of registers...locations:
start at $be000B0.
0x0ae92 This code clears some registers in the range $be47e00.
0x0972a This is apparently the code that prints the string ENSONIQ ASR-X
to the LCD screen at power-up"
it does a bsr (like call subroutine) to 0x96ea, saves some
registers. From there, it does jsr's to ($A9A), ($9BEE), and
($AB2).
The entry point is 0x0972a, this is called from 0x00c8a.
0x096ea<->0x09779
0x098e1 The string: "ENSONIQ ASR-X ..Resampler w/ Effects"
0x1d753 50us 100us 200 400, etc.
0x1d833 5Hz 10Hz 15 20 30 40, etc.
0x1d883 0.0sec 0.1 0.2 0.3, etc.
0x1da23 0.0ms 0.2 0.4, etc.
[tons more strings of numbers]
0x1e0ba -99% -98 -97, etc
0x1e573 Off -49.5dB -49.0, etc.
[tons more strings of numbers]
0x1f163 11 Sys 1/1T Sys 1/2 Sys, etc.
0x1f66c Triangle Sine Sawtooth Square Asymm, etc.
0x1f6aa -180deg -178 -176, etc.
0x2066a 'A' 'E' 'I' 'O' etc. AA AE AH AO EH ER IH IY IH UW B D F G J K L M
0x2088a Off FullModAmt Velocidy Vel+Pressure etc.
0x20f52 L----|----R -L---|---R-, etc.
0x2b6e0 Strings dealing with effects!!! (test mode?)
0x2e452 "Scanning seqs" etc.
0x2f8c0 "Pad Xpose=Kit Mapper" etc.
0x30271 "ENSONIQ ASR-X O.S. Version:"
0x32262 "System/MIDI" +rest of Global/System Menu
0x332ea "Edit insert effect"
0x3e1a2 Record Click menu options
0x3e23e Sequence Process menu options
0x41f08 **EMPTY**
0x41a30 Memory Manager Menu options (what is polyphony meter?)
0x47972 Quantize values (tighten, randomize, etc.)
0x4bef0 Sample Edit Functions
0x4bf60 the famous/dreaded * =* ==* ===* ====* =====*
0x4df48 Sampling messages (Sampling in Progress, etc.)
0x4fb90 disk formatting messages
0x57716 save type menu
0x836a0 diagnostic error messages!!! (otto chip?)
0x5c740 bunch of error messages...
Possible LFO locatons
---------------------
(triangle waveform)
0x5e4a8 a 256 8-bit signed waveform that goes 01 03 05 to 7f, then to 0,
then down to 81, then back up to 01 again....all by steps of 02.
0x5e5a8 Another trianglularish waveform.
<sawtooth waveform)
0x5e6a8 a waveform that goes up to 7f quickly in steps of 03.
stays there for a while, then falls off slowly to zero by 128 bytes.
(sawtooth #2)
0x5e7a8 wavefrom that starts halfway up (0x42),
moves linearly to 7f by the first 64 bytes,
falls off very slowly to 0 for 128 bytes,
rises up to linearly 0x42 in 64 bytes.
0x5e8a8 starts at 0x42.
rises linearly to 7f
falls linearly to 40
falls linearly to 01
rises linearly to 40
(perfect rising sawtooth)
0x5e9a8 starts at 80 (all the way negative)
rises linearly to 7f
(square wave!!!!!)
0x5eaa8 0x80 bytes of 7f, followed by 0x80 bytes if 0x00
0x5eba8 climbs from 0x00 to 0x7f s l o w l y over 256 bytes
0x5eca8 falls from 0x7f to 0x00 s l o w l y over 256 bytes
0x61f7a a 12-bit waveform?!?! rises slowly up to 0x0fff at
0x6277a ends at 0x62d60 at 0x00
0x62f7a another 12-bit waveform, starts at 0x0800
rises to 0x0ffe at 0x63b7a
[ more waveforms until 0x66440 ]
0x76e04 Pitch Table strings
0x770a4 Reverb names
0x77480 parameter names
0x7c27a X with a bunch of spaces...
0x83710 all kinds of diag messages...
0x990ea "Allocating memory..Please wait"
0xa1f40 more waveforms!!!!!
0xa3860 lot of weird stuff involving 0x3fxx...pitch tables maybe?
RoM sounds?
These are data structures spaced 0x01c4 bytes spart from
each other!!!! Each structure seems to start with "$PGP1"
The names of the sounds are padded with spaces.
Within each data structures are a number of text fields, including:
MAP2
LFO1
ENV1
ENV1
ENV1
LFO1
PRG1
OFST
some fields are longer and have different fields in there or multiple
of the above
0xb5d14 start of Thump Kick
0xb5ed8 start of Muff Kick
0xb609d start of Tite Kick
0xb6261 start of 808 Kick
0xc8170 Text for "Gizmo Bop"
0xc88c0 "Track 1, Track 2 ..." up to 16 weird... now discovered to be
part of gizmo bop's MIDI file
FX Presets!!!
0xcee12 "Crunchy" as part of distortion effect
from here, are five chunks of data, with a name (with leading spaces)
and data following it. Each chunk is 0x5C (72) bytes long
0xc5922 DDL~EQ note, the system expans ~ into ->
5/17/99 MIDI FILES -------------------------------------
MTrk
It is now clear that much of the X's internals utilize MIDI files.
Also, there are five instances of the string MTrk (midi track header)
in the ROM
There are also six instances of MThd, the midi file header. It is believed
some of these are for the demo song "Gizmo Bop." And also, it is believed
that at least on of the MTrk instances is a "blank track." The reason
this blank track MTrk header is signficant: It may contain the
default, annoying MIDI events which reset the controllers at the beginning
of each event, and prevent the machine being truly groovy in a way.
time: 00000000:controller: (0xb0,0x07,0x7f) Volume (coarse).
time: 00000000:controller: (0xb0,0x0a,0x40) Pan position (coarse).
time: 00000000:controller: (0xb0,0x01,0x00) Modulation Wheel (coarse).
time: 00000000:controller: (0xb0,0x0b,0x7f) Expression (coarse).
time: 00000000:controller: (0xb0,0x46,0x00) Sound Variation.
time: 00000000:pitch wheel: (0xe0,0x00,0x40).
0x8c4ec instance #1 of MTrk. in an array with other instesting headers:
MSet MThd MSng MSeq
0x949e4 instance #2 of MTrk
0x96e04 instance #3 of MTrk. next to Mse, MSng, MSeq, MTrk and MPly again.
0x9f3ba instance #4 of MTrk. alone by itself...the next four numbers 00000000
don't constitute a proper length. seems to be surrounded by code.
0xc81b6 instance #5 of MTrk. This is Track #0 in Gizmo Bop. Note: Gizmo
Bop is a type 0, 1 track MIDI file embedded in the ROM image.
It's start address is 0xc81a7. It's end address is 0xca9b3.
length = 0x280c.
MThd
0x8c4d0 Instance #1 of MThd. In array with other chunk headers
(MSet Mthd MSng MSeq MTrk)
0x90bfc instance #2 of MThd. Seems to be located in middle of nowhere,
surrounded by code
0x949d2 instances #3 of MThd. in array with other chunk headers.
(MThd MSeq MSng MTrk) [ note Mset, Mply is not in this group ]
0x96dec instance #4 of MThd. in array with others
(MThd MSet MSng MSeq MTrk MPly)
0xa95fa instance #5 of MThd. in short array..MThd MSeq MSng odd,
it's located near a text array of fractional values.
0xc81a7 instance #6 of MThd. This is the header for the Gizmo Bop.
0x9e186 apparently an instruction that access 0009f3ba, which is the
location of a lone "MTrk" string. Could this be code where
a new track is created? If so, could we modify the initialization
of the string?
the following codes: Not sure what's going on here, but
the number 4 is pushed onto the stack, then a pointer
to the string "MTrk" is pushed onto the stack. Then
another mysterious value is pushed onto the stack and F8352 is
called. my guess is either strncmp, strncat, or strncpy,
since all of those involve two arguments, with the second
one being a string, and the last arg (first on stack) being
a number. Also 4 is the length of the string "MTrk."
Also, since the subroutine (F8352) is located near the end of
memory, it is most likely part of the standard C lib.
hopefully soon, we can disassemble that subroutine. Note also,
nothing is done (immediately) with the return value from the
call, which suggests strncat or strncpy over strncmp.
000186 287C 0BE4 81B4 movea.l #$BE481B4,a4
00018C 2014 move.l (a4),d0 _
00018E D0B9 0BE4 8068 add.l ($BE48068),d0 _
000194 2D40 FFBC move.l d0,-68(a6) _
000198 7004 moveq #4,d0 _
00019A 2F00 move.l d0,-(a7) _
00019C 41F9 0009 F3BA lea ($9F3BA),a0 _
0001A2 2F08 move.l a0,-(a7) _
0001A4 2F2E FFBC move.l -68(a6),-(a7) _
0001A8 4EB9 000F 8352 jsr ($F8352) _
perhaps 12 is the offset for track length in the data structure
representing a MIDI track?
0001AE 4FEF 000C lea 12(a7),a7 _
0001B2 2F0D move.l a5,-(a7) _
0001B4 4EB9 0008 FF32 jsr ($8FF32) _
also intriguing is adding four to a7...could a7 be the addr for the
length of the MIDI Track, as it's being written to?
0001BA 588F addq.l #4,a7 _
0001BC 2640 movea.l d0,a3 _
0001BE 202D 00D8 move.l 216(a5),d0 _
0001C2 2040 movea.l d0,a0 _
0001C4 2E28 000C move.l 12(a0),d7 _
0001C8 2F0A move.l a2,-(a7) _
0001CA 2F00 move.l d0,-(a7) _
0001CC 486E FFBC pea -68(a6) _
0001D0 2F0D move.l a5,-(a7) _
0001D2 6100 FB7A bsr -1158 _
Is bsr the end of that routine? who calls it?
0001D6 4FEF 0010 lea 16(a7),a7 _
0001DA 206E FFC8 movea.l -56(a6),a0 _
0001DE 4868 0008 pea 8(a0) _
0001E2 2F2E FFBC move.l -68(a6),-(a7) _
0001E6 206D 00D8 movea.l 216(a5),a0 _
0001EA 2F10 move.l (a0),-(a7) _
0001EC 4EB9 0008 FAD6 jsr ($8FAD6) _
0001F2 4FEF 000C lea 12(a7),a7 _
0001F6 202E FFC8 move.l -56(a6),d0 _
0001FA 9087 sub.l d7,d0 _
0001FC 2E00 move.l d0,d7 _
0001FE DF94 add.l d7,(a4) _
000200 207C 0BE4 82A0 movea.l #$BE482A0,a0 _
000206 7000 moveq #0,d0 _
000208 3015 move.w (a5),d0 _
00020A 49F0 0C00 lea 0(a0,d0.l),a4 _
00020E DF94 add.l d7,(a4) _
000210 2B54 005C move.l (a4),92(a5) _
000214 4EB9 0009 447E jsr ($9447E) _
00021A 2F0B move.l a3,-(a7) _
00021C 2F0D move.l a5,-(a7)
00021E 4EB9 0008 FE7E jsr ($8FE7E) _
000224 508F addq.l #8,a7 _
000226 4A2A 0022 tst.b 34(a2)
String Manipulation Function
----------------------------
0x0F8352 compares addr's....makes call in some cases to
$F83AA. don't know what's there.