Reverse Engineering of the M-VAVE FM-1 Pocket Synthesizer Firmware
Analysis of the M-VAVE FM-1 Pocket Synthesizer Firmware
This project focuses on the reverse engineering and update-protocol investigation of the M-VAVE FM-1 synthesizer.
🛠 Hardware & System Architecture
Based on the SDK, SPL, and package provenance, the device utilizes the following specifications:
- SoC: JieLi AC791N/WL82
- CPU:
pi32v2 - Memory: XIP flash located at
- Audio Engine: A six-operator FM synthesis engine derived from Dexed/msfa.
[!IMPORTANT] Note that the string
JL-BR22found in the firmware is merely inherited library nomenclature andshould not be used for SoC identification.
Project Scope
The main branch is dedicated to analysis and contains no custom firmware or image creation tools. For those seeking experimental implementations, please refer to the with-custom-firmware branch.
🗺 Repository Roadmap
To navigate this research, follow these primary documentation paths:
- Architecture Overview: Details on memory mapping, hardware, boot sequences, and subsystems.
- OTA Protocol: Analysis of USB-MIDI framing, session logic, and loader behavior.
- Safety Assessment: Evaluation of whether update paths are recoverable.
- Debug Audit: Search for factory modes, consoles, and recovery entry points.
- OTA Loader Trace: Control flow analysis of the device loader and flash gates.
- Windows Updater: Decompilation of the
M-UPGRADEstate machine.
Directory Structure
| Folder | Purpose |
|---|---|
analysis/ | V13 disassembly, function databases, and OTA loader research. |
docs/ | Architecture teardowns, function indexes, and firmware characterization. |
scripts/ | Pipelines for extraction, indexing, and classification. |
ghidra/scripts/ | Headless analysis scripts for the pi32v2 CPU. |
firmware-images/ | Unpacked and immutable V13/V14 firmware packages. |
reference/ | SDKs and upstream mirrors (populated via setup_reference.sh). |
3rd-party/ | Submodules like jl-misctools and jl-uboot-tool. |
⚙️ Analysis Pipeline
The repository employs two distinct V13 analysis workflows for cross-validation.
Reproduction Steps
To replicate the analysis, execute the following from the root directory:
1. Low-level Disassembly & Mapping
scripts/run_ghidra.sh
python3 scripts/build_funcdb.py
python3 scripts/resolve_strings.py
python3 scripts/match_libs.py
python3 scripts/build_master_index.py
python3 scripts/build_slices.py
2. OTA Loader & Vendor Mapping
scripts/analyze_ota_loader.sh
scripts/run_ghidra_loader.sh
3. Documentation & Database Enrichment
python3 scripts/build_db.py
scripts/disasm_toolchain_libs.sh
python3 scripts/match_libs.py
python3 scripts/mech_tag.py
python3 scripts/export_shards.py
python3 scripts/aggregate.py
4. Protocol Verification
python3 -m unittest discover -s tools/tests -v
⚠️ Safety Status
The current findings regarding the update process are cautious:
Warning: The update protocol has not been proven to be a reliable recovery mechanism.
- Confirmed ROM recovery method.
- Confirmed rollback capability.
- Safe behavior during interrupted writes (single-bank layout).
- Discovery of a substitute recovery entry via factory-mode audit.
📚 External References
- USB_KEY | jielie: Research on triggering JieLi USB boot via signals (includes waveforms and timing).
- JL SoC Forum: A Russian community hub discussing SDKs, toolchains, and ISP/UART experiments.
- SMK-37 Pro Notes: Community observations on a similar M-Vave device.
jl-misctools: Utilities for JieLi containers and UI resources.jl-uboot-tool: Python tools for UBOOT devices. Note: WL82/AC791N is listed as unknown; not a confirmed flasher for FM-1.fw-AC79_AIoT_SDK: Official Jieli-Tech SDK used to identify stock behavior and MaskROM APIs.