Alex-aut wrote on 2020-11-28, 11:11:

mattw 😀 your commends are a pleasure but you did'nt lift your secrete in terms of trying the N nth bit, on which pattern do you recognize, that N (in your case '10' as the next bit is the correct bit. what is the trick, that you know, that THIS x is the correct bit ? That would also be wortrh of an explanation 😀

here human-verification based on how descrambled SC-55 Waverom looks like comes into play - the structure looks similar. So, in my most extreme manual step example N=9, I know how first 0x1ff bytes of SC-55 Waverom looks like, if those of descrambled SC-88 look similar, then the sequence is correct. Then the same for N=10, the block becomes first 0x3ff bytes. I attach 2 pictures maybe that will make it more clear.

That is what makes it harder and harder for N > 10, because the block to manually check becomes larger and larger, but on the other hand the data stream becomes more and more defined as well, that helps to rule out what are the possible options. As I said for N=11 and N=12, I found 2 potential good options, but it's extremely hard to rule out, because verification becomes very difficult.

Hmmm, thank you for your great explanation. Ok, if we assume, that for given example the TR808 samples are the same in SC55 as well in SC88, we could make following adäquate konklusion: Why should roland take the affort, to sample TR808 samples a second time for the SC88? Taking samples costs money, i am in doubt, that for example esspeccially the TR808 samples are taken a second time. If that assumption ist true, than the {x1,x2,x3,x4,x5,x6...} samles as a signature -pattern in SC55 (in the mantissa bytes) should be found at a correct permutation of reminding unknown bits. Is this a great idea?:-)

@mattw, exuse me for my dumb writing, because i assumed, that data descrambling was already done, my idea is therefore obsolete 🙁

OK, new clean slide, with a new finding - it's actually based on very old observation I made about "Roland Sound Canvas VA VSTi Plugin ":

Re: About Roland Virtual Sound Canvas 3

when very long time ago I noticed the Waverom data there look totally unencrypted.

Now, with SC-55/MKII descrambled and SC-88 partially descrambled, It was very easy to find the full Waveroms inside the "SCCore.dll" from "Roland Sound Canvas VA VSTi Plugin " - see the attached screenshots as well:

1. SC-8820 Waverom released:

11999-08-17

it's very similar as structure to my partially descrambled SC-88 Waverom, I mean it has

1 wv0

in its header and then the release date exactly as SC-88 has. What surprised me is that it consists of 4 parts each with size of 1MB - I was expecting to be bigger, but maybe SC-8820 was with 4MB of sound samples.

2. Another Waverom with:

1ver200..........1994-12-08

in the header, it's 8MB and it looks almost identical to SC-88: based on my partially descrambled SC-88 ROM dump we have here, which is from 1993. So, that is either SC-88 ROM V2.0 or maybe that is SC-88Pro Waverom, i.e. it was denoted as SC-88 V2.0 in the ROM header.

Now, even having "2" and I can tell it's almost the same (if not the same) Waverom data as my partially descrambled SC-88 Waverom we have here, it's still hard to define the exact bit shuffling of the address line for SC-88.

Anyway, we have now another two and fully decrypted Waverom - give ideas what exactly is "2" - newer revision of SC-88 or SC-88Pro? Why SC-8820 Waverom is only 4MB - is that normal or "Roland Sound Canvas VA VSTi Plugin " includes partial SC-8820 Waverom and not he full one?

Alex-aut wrote on 2020-11-28, 12:54:

@mattw, exuse me for my dumb writing, because i assumed, that data descrambling was already done, my idea is therefore obsolete 🙁

See my post above - I found fully decrypted Waverom of what seems to be SC-88 Rev 2.0 from 1994

your SC-88 Waverom is from 1993 and for it, data value decoding (8-bit shuffling) is done, it's the same as SC-55/MKII, what is not done address line bit-shuffling, I found only fist 10 bits. However, now with having that "SC-88 Rev 2.0" Waverom, it can help to make tool that can decrypt fully your SC-88 Waverom.

What I noticed additionally is that each of your 2MB ROM chips contains 2 x 1MB ROM segments, because each 1MB segment of data has its own Header.

mattw wrote on 2020-11-28, 13:59:

See my post above - I found fully decrypted Waverom of what seems to be SC-88 Rev 2.0 from 1994 […]
Show full quote

Alex-aut wrote on 2020-11-28, 12:54:

@mattw, exuse me for my dumb writing, because i assumed, that data descrambling was already done, my idea is therefore obsolete 🙁

See my post above - I found fully decrypted Waverom of what seems to be SC-88 Rev 2.0 from 1994

your SC-88 Waverom is from 1993 and for it, data value decoding (8-bit shuffling) is done, it's the same as SC-55/MKII, what is not done address line bit-shuffling, I found only fist 10 bits. However, now with having that "SC-88 Rev 2.0" Waverom, it can help to make tool that can decrypt fully your SC-88 Waverom.

What I noticed additionally is that each of your 2MB ROM chips contains 2 x 1MB ROM segments, because each 1MB segment of data has its own Header.

Yes, your are right, i took a look and indeed, @ 0xFFFFF starts a brand new header

@mattw, here you can see my roms, and they are definilty 2MB. Datasheet of ROM is attached.

Alex-aut wrote on 2020-11-28, 14:34:

Yes, your are right, i took a look and indeed, @ 0xFFFFF starts a brand new header

yes and what i see in "SCCore.dll" of "Roland Sound Canvas VA VSTi Plugin" - that SC-88 Ver2.0 Waverom there is 8 parts each one 1MB. So, why SC-8820 Waverom is only 4MB I don't know unless, SC-8820 doesn't include 4MB of new SC-8820 sounds and additionally those 8MB of SC-88 Ver2.0 for compatibility with previous models or something like that. After all "Roland Sound Canvas VA VSTi Plugin" is supposed to be based on SC08820.

I will check the readout once aagain, the two headers in one ROM makes me nervous

Alex-aut wrote on 2020-11-28, 14:59:

I will check the readout once aagain, the two headers in one ROM makes me nervous

I think no need to check, it's correct for sure based on what I see inside the"S CCore.dll" from "Roland Sound Canvas VA VSTi Plugin" - the SC-88 Ver2.0 Waverom there is structured the same, 8 parts each with size of 1MB. Also, your ROMs are "Roland XP-GS Ver.1.00", but the one from "SCCore.dll" is:

1Roland XP-GS    Ver.1.01 

so, you either have earlier revision of SC-88 or there was firmware update that you don't have. Also, at this point I see descrambling your ROMs more as just academic exercise (to double check the data in "S CCore.dll") than anything with real value, because from "SCCore.dll" newer version can be extracted and it's not protected in any way. What is more interested is from what device ROM the data inside "S CCore.dll" are taken - maybe it's not SC-88, but SC-88Pro or SC-88ST or SC-88ST Pro, which are the later revisions.

mattw wrote on 2020-11-28, 15:05:

I think no need to check, it's correct for sure based on what I see inside the"S CCore.dll" from "Roland Sound Canvas VA VSTi Pl […]
Show full quote

Alex-aut wrote on 2020-11-28, 14:59:

I will check the readout once aagain, the two headers in one ROM makes me nervous

I think no need to check, it's correct for sure based on what I see inside the"S CCore.dll" from "Roland Sound Canvas VA VSTi Plugin" - the SC-88 Ver2.0 Waverom there is structured the same, 8 parts each with size of 1MB. Also, your ROMs are "Roland XP-GS Ver.1.00", but the one from "SCCore.dll" is:

Copy code to clipboard

1Roland XP-GS    Ver.1.01 

so, you either have earlier revision of SC-88 or there was firmware update that you don't have. Also, at this point I see descrambling your ROMs more as just academic exercise (to double check the data in "S CCore.dll") than anything with real value, because from "SCCore.dll" newer version can be extracted and it's not protected in any way.

Of course, i have the firmware, slaughtered from the same SC88 😀

@ 0x7FC0 in Firmware you can read: "GS64 Ver=3.00 SC-88

@2FF80 there is: "SC-88 Ver101"

Alex-aut wrote on 2020-11-28, 15:22:

@2FF80 there is: "SC-88 Ver101"

yes, but what I wonder, which device is "SC-88 Ver200", because in your ROMs we have "SC-88 Ver101" and "Roland XP-GS 1.00", while in "S CCore.dll" from "Roland Sound Canvas VA VSTi Plugin" it's Ver200 and "Roland XP-GS 1.01". maybe, it's still SC-88, just newer/updated firmware.

mattw wrote on 2020-11-28, 15:48:

Alex-aut wrote on 2020-11-28, 15:22:

@2FF80 there is: "SC-88 Ver101"

yes, but what I wonder, which device is "SC-88 Ver200", because in your ROMs we have "SC-88 Ver101" and "Roland XP-GS 1.00", while in "S CCore.dll" from "Roland Sound Canvas VA VSTi Plugin" it's Ver200 and "Roland XP-GS 1.01". maybe, it's still SC-88, just newer/updated firmware.

Roland XP-GS probably points to the Roland XP synth range. Of those, the XP-10 (successor to the JV50) is a GM-only (GS) model:

https://www.roland.com/us/products/xp-10/

The manual accessible from that link might help confirm things, as it lists the number of instruments etc.

The other XP synths are based on the JV1080 and higher, and also have a GM (GS) bank. To me, it sounds logical that "Roland XP-GS 1.00" and "Roland XP-GS 1.01" are that bank (just different versions from different XP synths).

Alex-aut wrote on 2020-11-28, 12:47:

Hmmm, thank you for your great explanation. Ok, if we assume, that for given example the TR808 samples are the same in SC55 as well in SC88, we could make following adäquate konklusion: Why should roland take the affort, to sample TR808 samples a second time for the SC88? Taking samples costs money, i am in doubt, that for example esspeccially the TR808 samples are taken a second time. If that assumption ist true, than the {x1,x2,x3,x4,x5,x6...} samles as a signature -pattern in SC55 (in the mantissa bytes) should be found at a correct permutation of reminding unknown bits. Is this a great idea?:-)

AFAIK, there is a master version of the samples that is uncompressed, and Roland makes new versions of the samples from that master version each time they update their algorithms - which explains why the same sample set has been reused for a variety of synths, albeit with different compression algorithms and better quality the newer the synth. Now and then new samples were added to it.

If you compare the patch sets of various Roland PCM synthesizers, you often can find patches with the same name and a similar sound, even though there sometimes are major differences in the synthesis engines with regards to the available parameters (e.g. Fantasia). Basically you could make a "hereditary tree" based on patch names, and the root of each patch in the result would probably match the actual release order of the various synths and expansion cards pretty well.

There are only a few samples that are unique to a specific Roland synth or expansion card, and almost all of those are located on promotional expansion cards that were included for free with certain synth models.

So no, they do not resample a real TR808 every time they make a new PCM ROM set. 😀

TLDR: Sound Canvas cannot be seen as a truly separate product line, because the same GM banks were also used in Roland's more professional products (JV, XP, XV, Fantom, etc., and Integra-7), with all samples having a common origin in a master bank, and on top of that the SC55's architecture and those professional synths' architecture have a common origin in ultimately the U110 rompler.

Edit: And this whole piece just gave me an awesome idea: Apply phylogenetics to Roland synths and patch names... 😁

totally, scrambled my mind with Roland SC-88 scrambling, really need to take break from it, but just to document that in "S CCore.dll" from "Roland Sound Canvas VA VSTi Plugin", SC-88 Waverom (or whatever "Roland XP-GS 1.01" variant of SC-88 designates, because SC-88 ROM dump @Alex-aut made and posted here is "Roland XP-GS 1.00") is located at:

1SCCore.dll v1.0.7 offset 0x8B6D8
2with size of: 8MB (8388608 bytes)

using "19,18, 17,15, 14, 11,8,6, 9, 16, 10,5,12,7, 13, 1, 3, 2, 4, 0" address line bit-shuffling (which is not the entirely correct one, but 10, maybe even 12 bits are correct and is what I call "partially decoded"), I can tell that SC-88 ROM dump @Alex-aut made corresponds to what's inside "SCCore.dll" as follows:

1partially decoded PCM_IC_325.bin is related to the 1st 1MB segment in SCCore.dll at offset 0x08B6D8 - 0x18B6D8, let's call it SegmentA
2partially decoded PCM_IC_325.bin is related to the 5th 1MB segment in SCCore.dll  at offset 0x48B6D8 - 0x58B6D8, let's call it SegmentB

in fact with the above address line bit-shuffling sequence SegmentA offset 0x400 properly decodes to offset 0x400 of partially decoded PCM_IC_325.bin, but SegmentB offset 0x400 decodes to offset 0xa30 of partially decoded PCM_IC_325.bin (most likely because the address line bit-shuffling sequence is not entirely correct, but partially correct).

So, the data from @Alex-aut dumps and those from SCCore.dll are almost the same - big chunk of them are byte-by-byte identical, just the chunk order is not the same, because of the partially correct address line bit-shuffling sequence. In any way, that shows without a doubt that "SCCore.dll" contains SC-88 Waverom and it's in descrambled form (no protection), that Waverom is "Roland XP-GS 1.01" from 1994, while @Alex-aut dumps contain scrambled "Roland XP-GS 1.00" from 1993.

Now, based on the above with more work, we should be able to figure out SC-88 scrambling and descramble @Alex-aut dumps, because now at least we know what fully descrambled PCM_IC_325.bin should look like - it has to resemble byte-by-byte (or almost byte-by-byte in case there is some small difference between "Roland XP-GS 1.01" and "Roland XP-GS 1.00"), the data that SegmentA + SegmentB from "SCCore.dll" contain.

@mattw, i am very impressed of you work, it is stunning. All these progress, without logic-analizer, but human thinking an combining. Great! These "Game" looks for me, that you got a SUDOKU to solve, with only 2 numbers and you solve it. At the end i would like to write a little sumary about all this stuff, because with lifting the secrets of these ROMS, a dream come true for me, because these roms are since years in a box, i started countless attemps to crack this jewel symth. I will build a synth (only for private use) based on these samples. Yes, your are absoloutly right, neither SC55 nor SC88 can compete with todays synths but its a pleasure for me, to keep then "alive". I have a functioning roland SCC-1, i ask myself, trying unsolder roms and also make a readout. After readout resolder the roms.

Alex-aut wrote on 2020-11-29, 19:26:

... "alive"...

maybe some day someone will make SC-55/88 emulator like MUNT for MT-32 or add support to MAME for SC-55/88 as how CM-32P has support there. So, they can live forever there.

Alex-aut wrote on 2020-11-29, 19:26:

I have a functioning roland SCC-1, i ask myself, trying unsolder roms and also make a readout. After readout resolder the roms.

I am sure a lot of people will appreciate ROM dumps of SCC-1!

ROM Chips are known, Firmware Chip please confirmation 😀 Type of firmware chip not known., 🙁

The big beast should be the MPU-401 processor