mungewell / zoom-zt2

Python script to install/remove effects from the Zoom G1Four pedal
MIT License
51 stars 10 forks source link

Difference between G1Four and G1XFour? #18

Open mungewell opened 3 years ago

mungewell commented 3 years ago

Someone posed a question as to whether the PCB for these pedals are different, I highly doubt it... they may have different components fitted. The difference is likely a FW thing.

After uploading a pedal effect (PDL_VOL.ZD2) to a G1Four it is not listed.

Running the SysEx 'Identity Request' command on a G1Four I get.

$ amidi -p hw:2,0,0 -S 'F0 7e 00 06 01 F7' -r temp.bin -t 1 ; hexdump -C temp.bin | head

15 bytes read
00000000  f0 7e 00 06 02 52 6e 00  0c 00 32 2e 30 30 f7     |.~...Rn...2.00.|
0000000f

If someone runs the same command on a G1XFour, I have strong reason to believe the '0x0c' will change to '0x0d'.

mungewell commented 3 years ago

Whoops....

$ amidi -p hw:1,0,0 -S 'F0 7e 00 06 01 F7' -r temp.bin -t 1 ; hexdump -C temp.bin | head

15 bytes read
00000000  f0 7e 00 06 02 52 6e 00  0d 00 31 2e 30 30 f7     |.~...Rn...1.00.|
0000000f

preset_error

installer_hack4

mungewell commented 3 years ago

Recovered...

$ amidi -p hw:1,0,0 -S 'F0 7e 00 06 01 F7' -r temp.bin -t 1 ; hexdump -C temp.bin | head

15 bytes read
00000000  f0 7e 00 06 02 52 6e 00  0c 00 32 2e 30 30 f7     |.~...Rn...2.00.|
0000000f
mungewell commented 3 years ago

I need some help understanding the '.exe' archive.I want to replace the '133' file in one installer, from that of another.... $ 7z l ZOOM\ G1X\ FOUR\ System\ v2.00\ Updater.exe -slt > 7zip_detailed_list.txt 7zip_detailed_list.txt

I see that the '133' file has no compression, but is not visible in a hexeditor.

Path = .rsrc/1041/BIN/133
Size = 45056
Packed Size = 45056
Virtual Size =
Characteristics =
Offset =
Virtual Address =

I suspect that it's actually compressed within the '.data' section, and that 7z is being super helpfui when extracting (not so helpful with replacing).

Path = .data
Size = 11264
Packed Size = 11264
Virtual Size = 5916348
Characteristics = InitializedData Read Write
Offset = 290816
Virtual Address = 0x49000

Can anyone give me the right commands to run?

mungewell commented 3 years ago

Further understanding achieved. but now tools are failing me....

$ 7z x ZOOM\ G1X\ FOUR\ System\ v2.00\ Updater.exe -tPE ".rsrc/1041/BIN/133"
$ cp ../G1_FOUR_v2.00/unzipped/.rsrc/1041/BIN/133 .rsrc/1041/BIN/133 
$ 7z u ZOOM\ G1X\ FOUR\ System\ v2.00\ Updater.exe -tPE ".rsrc/1041/BIN/133"

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=C,Utf16=off,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6500U CPU @ 2.50GHz (406E3),ASM,AES-NI)

System ERROR:
E_NOTIMPL
mungewell commented 3 years ago

Found this tool, which was able to replace the '133' file in the exe. http://www.angusj.com/resourcehacker/

An outright replacement maintained the '52 6e 00 0c' "identity" after flashing and did not make the "PDL_*" effects in the patch edit section.

The G1X '133' has a section in it close the end: 0000a000 6e 00 0d 00 47 31 58 20 49 56 00 00 00 00 00 00 |n...G1X IV......|

When only this section in '133' was changed and flashed to pedal, I did not get the error but I got this on boot... 20201219_164149

but I still did not get the "PDL_*" effects listed in the patch edit section.

This leads me to believe either: 1). FW looks at these bytes and decides it's not running on X pedal. 2). FW looks else where and make same decision. 3). There is a hardware difference (pull up/down resistor or the like).

It also means that the graphic for boot is iikely the data at the start of the 133 file.

mungewell commented 3 years ago

Yep, first section is the Mono/Bit-Mapped image used at boot...

$ dd if=133 of=start_screen.raw bs=512 count=1
1+0 records in
1+0 records out
512 bytes copied, 0.00043497 s, 1.2 MB/s
$ convert -monochrome -size 8x512 -depth 1 MONO:start_screen.raw -transpose -crop 128x8+0+0 stripe1.png
$ convert -monochrome -size 8x512 -depth 1 MONO:start_screen.raw -transpose -crop 128x8+128+0 stripe2.png
$ convert -monochrome -size 8x512 -depth 1 MONO:start_screen.raw -transpose -crop 128x8+256+0 stripe3.png
$ convert -monochrome -size 8x512 -depth 1 MONO:start_screen.raw -transpose -crop 128x8+384+0 stripe4.png
$ convert stripe1.png stripe2.png stripe3.png stripe4.png -append start_screen.png

start_screen

mungewell commented 3 years ago

Took my pedal apart (again!) to look at possible hardware changes, and most notably CN1 is missing... this is likely where the Expression pedal would attach. The eagle-eyed will also note L6, L7 and C165 missing too. G!Four_CN1

However I note that normally an expression pedal would have 3 connections (+ve voltage, wiper and GND). This has four, which could be a couple of things: 1). There is an extra signal which indicates the presence of the pedal, may be GPIO tied high or low. 2). The pedal is more than a POT, maybe a I2C ADC - which would be a good way to eliminate noise from the reading.

Without access to a pedal I can't tell, but YOU may be able to. These are accessible on the reverse of the board, just removing the rear metal cover, no need to remove the PCB from the unit.

With a DVM (volt meter) measure between pin 4 (nearest battery) and each of the center pins in turn as the pedal is moved. If you get one of them showing a range of voltages it is likely option 1), above. Also not the voltage on the other....

mungewell commented 3 years ago

I also noticed that for the B3n (and some other older pedals) Zoom actually provided an input for a regular expression pedal. If someone has one of those can they confirm whether 'Group 11' effects are only present with expression pedal plugged in?

aishik-x0 commented 3 years ago

Hi, I have a G1XFour. Can I help out with testing this in any way?

mungewell commented 3 years ago

Hi @aishik-10x if you have a volt-meter and are willing to take the rear metal cover off, I'd be interested to know what the voltage on the middle pins of the CN1 connector do as the expression pedal is moved... measure between each middle pin and the pin marked as '1' in the picture (closest to the battery compartment).

You don't need to remove the PCB to do this as you can probe the connector from the rear (exposed) side of the board.

If you get curious and decide to take the PCB out; note that as well as the 4 screws in the corners, there are ADDITIONAL screws down in the white plastic tubes... which hold the display to the front case. If you remove these then the PCB and Screen can come out as one piece.

Try not to separate them as it's quite a pain/challenge getting the flex cable between PCB and display back into it's connector.

aishik-x0 commented 3 years ago

Sure man. I don't have a voltmeter, but I'll try to procure one and let you know

mungewell commented 3 years ago

Got my hands on a G1XFour... Pin 1 : 3.3V Pin 2 : Changes 0.588 (toe down) to 1.707 (heal down) Pin 3 : 3.3V Pin 4 : 0V

The Pot is a 4 pin device, with a cam like coupling to the foot plate. The maximum movement only turns it around 45'.

[edit] The pot appears to be 6KOhm, with ends connected to 3.3V and GND directly. Center/wiper is connected to pin2 of connector.

The next question is whether a G1Four with added components will load pedal effects?

thement commented 2 years ago

Any progress on this issue? I'm trying to figure out how to add external expression pedal to G1Four (I've ordered one and it's on the way).

The next question is whether a G1Four with added components will load pedal effects?

Well, I doubt that. But maybe the extra pin (either Pin 1 or Pin 2) is "input pin with pullup" that gets pulled down if the expression pedal is connected (shorted to ground). Can you check if the value on Pin 1/3/4 changes on G1XFour when you plug/unplug the 4 pin connector?

Other than that my guess is that the updater checks the current firmware and only allows uploading compatible version. This might be circumvented by patching the firmware for G1Xon to have G1on header or making custom firmware uploader that doesn't do this check. I'll look into it when my pedal arrives.

mungewell commented 2 years ago

I have not had time/energy to work on this for a while, plus the screen on my G1Four flaked out again - If anyone has a broken pedal they want to donate for parts???

I am not sure I want to disassemble my G1XFour.

I can confirm 2 useful things: 1). Hand editing installer EXE allows a G1XFour FW to be loaded onto a G1Four. It ran, but gave 'Preset Error' 2). Hand editing the 133 file, then allowed the G1XFour image to run properly. The pedal effects were not offered as selectable - I don't remember whether I confirmed that they were actually installed, perhaps I missed this step.

Looking at image above: https://user-images.githubusercontent.com/236907/102724526-0c4b6880-4308-11eb-8783-bdab28b7085e.png

For a proper install you will definitely need to remove to PCB from the pedal to install a few components (at least L6 and L7), or just to put blob of solder onto their pads.

But for testing you may be able to short pin 3 to another VCC point (maybe that electrolytic cap C114, near L7) which is accessible from just the underside of the board.... thus only needs the metal cover/back plate removed.

We might now know enough that I can figure out what is on the display without actually being able to see it. If this is true I can try to mod my G1Four...

mungewell commented 2 years ago

Started to look at this. here's a patch file which was generated on the G1XFour. expression_hack.zip

GuitarLab and Tonelib don't seem to like the idea of using a PDL effect at all. It can be upload to G1Four with the following, using the CLI app. $ python3 zoomzt2.py -P 59 59_pedaltest.zptc

Since I can not see the screen of my G1Four, I am using Midi to see the settings. It appears the effect is accepted on upload, but automatically turned off.

$ amidi -p hw:2,0,0 -S 'F0 52 00 6e 64 02 00 09 00 F7' -r pedaltest_display_G1Four.bin -t 2
$ python decode_screens.py  pedaltest_display_G1Four.bin
---
Effect: PDL Vol (Off)
VOL : 100
Min : 20
Max : 80
Curve : A
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: PDL Vol (Off)
VOL : 100
Min : 20
Max : 80
Curve : A
mungewell commented 2 years ago

I managed to trace the tracks from the CN1 header: Pin 3 leads directly to CPU - 'bottom' edge, 8th pin from left. Which is just before the pin from C35. Pin 2 leads to R6/R9 near IC4 - all these components are NOT installed on the G1Four.

They can be seen on this picture: G1Four_PCB

Given the location of IC4 near IC3 (which was previous identified as a SPI memory IC), I would place a bet that IC4 is a SPI ADC.

If I pull my G1XFour apart I will grab the type, but I'm pretty sure that this means it's too hard for most people to convert a G1Four into a G1XFour..... just spend the extra $$$.

thement commented 2 years ago

Hey, thanks for the research. The reason I was looking into this was that I was gonna use a control voltage (from LFO) instead of expression pedal, so I was gonna chop off the expression pedal part anyway. But if the ADC chip is missing then there's not much to do and it's easier just to use the G1X Four.

mungewell commented 2 years ago

@thement I don't see a reason as to why a G1XFour board couldn't be used in this way.

I also had a thought that if the same ADC IC is available in a larger package, then it might be possible to use the header (CN2) to connect it, rather than the very small footprint of IC4. This might be more solderable for a hobbyist.

mungewell commented 2 years ago

Shooking is making good process on remote control of the GCE-3. https://github.com/shooking/ZoomPedalFun/issues/2

I think I saw something about sending/injecting the Pedal value/state over Midi....

With the on/off mentioned above, did I make/break the 4th connection on the connector?? Maybe I missed this... some other pedals have jack for expression, maybe they uses this connection to sense whether it's plugged it - thus en/disabling the effects.

shooking commented 2 years ago

I have the pedals including one I am prepared to sacrifice (|G1XFour). What I wonder really know is what I am doing inside of them. Should I make some time in week to film one taking apart and edit in pictures (plus post them)? I also got the G5n and G3n - the has an external control pedal input but no built in pedal. The 5 has both pedal and control in. So I dont see why Zoom would build two routes to same function - likely the SW and pedal do two different things?

Maybe you are better at reading manual than me but I dont easily recall info about using pedal on later Zooms. The G5 (not n) has explicit menu for pedal FX dest. I notice it sets some of the bits between volume and name in the sysex. Too many pedals - about to post extra cheats on the other Issue.

mungewell commented 2 years ago

The B3N does not come in a version with expression pedal, instead it has a 'CONTROL IN' jack. And the effects list contain "PDL_" effects.

Spec notes - Option: FP02 Expression Pedal