Does anyone know how Sound Controller app works?

hikari · March 25, 2024, 07:14:15 AM

Since YAMAHA has discontinued Sound Controller app for PSR-E3 series keyboard. So PSR-E3 series keyboard cannot have pitch bend or modulation wheel by connect a iOS device to it.

So does anyone tried to sniff into USB line to get the command that iOS device send to the keyboard to adjust pitch bend or modulation wheel?

I knows that I can send a local off command to the keyboard and create a loopback between MIDI IN/OUT on this keyboard. And send pitch bend or modulation wheel MIDI command to the keyboard by a microcontroller. But it still is pain in the *** cuz I can't easily change the panel voice of this keyboard.

Since I can't get Sound Controller app so I don't really know how YAMAHA implement this app. Does anyone know how to send pitch bend/modulation wheel, even change effects setting or panel voice via USB-MIDI for budget YAMAHA PSR-E series keyboard?

pjd · March 25, 2024, 01:11:50 PM

Hi --

Welcome to the Forum!

There isn't any magic, really. The Sound Controller app sends standard MIDI messages to the target keyboard. This is accomplished by sending MIDI over USB.

The PSR-E series keyboards respond to the XG Lite subset of MIDI messages. Yamaha didn't bother to document these in the Data List PDF.

You should be able to send these messages from the MIDI Designer app on IOS. I built a MIDI Designer template for the SHS-500 Sonogenic which has a similar tone generator as the PSR-E series:

https://sandsoftwaresound.net/sonogenic-voice-editor/
https://sandsoftwaresound.net/shs-500-sonogenic-midi/
https://sandsoftwaresound.net/sonogenic-ui-midi-flow/
http://sandsoftwaresound.net/customizing-the-sonogenic-voice-editor/

Unfortunately, I've never found a way to select panel voices. Yamaha's internal architecture treats the keyboard as separate channels distinct from the incoming external MIDI channels.

Hope this helps your exploration.

-- pj

pjd · March 25, 2024, 01:14:39 PM

By the way, Yamaha apps do sometimes generate "magic" undocumented MIDI Sy*** messages.

I have monitored them in MIDI Designer. I've sometimes been able to monitor these messages by splitting out the messages from the MIDI stream and sending the messages to a MIDI monitor like MIDI-OX or even MIDI Designer.

It takes a lot of experimenting and faffing around, but it can be done!

-- pj

pjd · March 25, 2024, 02:51:58 PM

I hooked up Sound Controller to Genos1 and monitored the outgoing MIDI messages.

When Sound Controller starts up, it sends the following set-up messages:


TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 000B0BCE   2  --     F0  Buffer:     2 Bytes   System Exclusive      
 SYSX: F0 F7
 000B1051   2  --     F0  Buffer:     2 Bytes   System Exclusive      
 SYSX: F0 F7
 000B18A0   2  --     F0  Buffer:     6 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 01 F7
 000B18BE   2  --     F0  Buffer:     8 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 01 F7
 000B1C90   2  --     F0  Buffer:     6 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 01 F7
 000B1C9B   2  --     F0  Buffer:     8 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 01 F7
 000B1C9E   2  --     F0  Buffer:     9 Bytes   System Exclusive      
 SYSX: F0 43 73 01 52 26 02 02 F7

F0 7E 7F 06 01 F7 is the standard MIDI identity request messages. BTW, if no keyboard is connected, Sound Controller will loop and send this message over and over again until it receives a response. This is how Sound Controller detects a connected and supported keyboard.

-- pj

pjd · March 25, 2024, 02:55:37 PM

I monitored Genos1's responses to the Sound Controller app:


TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 00002D38   2  --     FE    --    --   --  ---  Active Sensing        
 00002E00   2  --     FE    --    --   --  ---  Active Sensing        
 00002EC7   2  --     FE    --    --   --  ---  Active Sensing        
 00002F8F   2  --     FE    --    --   --  ---  Active Sensing        
 00002FDD   2  --     F0  Buffer:    15 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7
 00002FEA   2  --     F0  Buffer:    16 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7
 00003057   2  --     FE    --    --   --  ---  Active Sensing        
 00003120   2  --     FE    --    --   --  ---  Active Sensing        
 000031E7   2  --     FE    --    --   --  ---  Active Sensing        
 000032AF   2  --     FE    --    --   --  ---  Active Sensing        
 00003378   2  --     FE    --    --   --  ---  Active Sensing        
 000033CD   2  --     F0  Buffer:    15 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7
 000033D8   2  --     F0  Buffer:    16 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7
 000033EC   2  --     F0  Buffer:    42 Bytes   System Exclusive      
 SYSX: F0 43 73 01 52 26 02 03 20 01 02 03 04 30 31 32 33 20
 SYSX: 21 22 23 24 25 26 27 00 00 00 00 00 00 00 00 00 00 00
 SYSX: 00 00 00 00 00 F7
 00003440   2  --     FE    --    --   --  ---  Active Sensing        
 00003507   2  --     FE    --    --   --  ---  Active Sensing

F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7 is the Genos1 reply to the identity request. It says "I'm Genos 1".

Good luck discovering what these Sy*** messages do!

-- pj

pjd · March 25, 2024, 02:59:07 PM

Once Sound Controller and Genos1 are happy, Sound Controller sends modulation and pitchbend on all four keyboard channels (RIGHT1, RIGHT2, RIGHT3, LEFT):


 TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT      
 0010D786   2  --     B3    01    17    4  ---  CC: Modulation                         
 0010D786   2  --     B0    01    17    1  ---  CC: Modulation        
 0010D787   2  --     B1    01    17    2  ---  CC: Modulation        
 0010D78A   2  --     B2    01    17    3  ---  CC: Modulation


 TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 0012407E   2  --     E3    5A    10    4  ---  Pitch Bend            
 00124080   2  --     E0    5A    10    1  ---  Pitch Bend            
 00124082   2  --     E1    5A    10    2  ---  Pitch Bend            
 00124082   2  --     E2    5A    10    3  ---  Pitch Bend

I guessing that the Sy*** somehow gets the incoming MIDI stream directed to the keyboard parts.

Hope this helps -- pj

hikari · March 26, 2024, 06:15:11 AM

Quote from: pjd on March 25, 2024, 02:59:07 PM
Once Sound Controller and Genos1 are happy, Sound Controller sends modulation and pitchbend on all four keyboard channels (RIGHT1, RIGHT2, RIGHT3, LEFT):


 TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT      
 0010D786   2  --     B3    01    17    4  ---  CC: Modulation                         
 0010D786   2  --     B0    01    17    1  ---  CC: Modulation        
 0010D787   2  --     B1    01    17    2  ---  CC: Modulation        
 0010D78A   2  --     B2    01    17    3  ---  CC: Modulation


 TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 0012407E   2  --     E3    5A    10    4  ---  Pitch Bend            
 00124080   2  --     E0    5A    10    1  ---  Pitch Bend            
 00124082   2  --     E1    5A    10    2  ---  Pitch Bend            
 00124082   2  --     E2    5A    10    3  ---  Pitch Bend

I guessing that the Sy*** somehow gets the incoming MIDI stream directed to the keyboard parts.

Hope this helps -- pj

Thank you! I have a further question about this, do the Sound Controller app disables Local control, and create a MIDI loopback? Or did it just sent a initial sequence, and control message to the MIDI input of the keyboard can be apply to the keyboard parts?

pjd · March 26, 2024, 12:31:37 PM

Quote from: hikari on March 26, 2024, 06:15:11 AM
Or did it just sent a initial sequence, and control message to the MIDI input of the keyboard can be apply to the keyboard parts?

I believe this is what happens. Local Control appeared to remain ON and I did not observe any note messages coming from Genos to Sound Controller (no loopback).

There are many undocumented Sy*** messages, so it is difficult (or impossible) to know exactly what is going on! After all these years, Yamaha still keeps this information secret. Oh, well.

Good luck with your investigations -- pj

hikari · March 27, 2024, 01:58:41 AM

Quote from: pjd on March 26, 2024, 12:31:37 PM
I believe this is what happens. Local Control appeared to remain ON and I did not observe any note messages coming from Genos to Sound Controller (no loopback).

There are many undocumented Sy*** messages, so it is difficult (or impossible) to know exactly what is going on! After all these years, Yamaha still keeps this information secret. Oh, well.

Good luck with your investigations -- pj

Maybe Yamaha's Smart Pianist app also do that too, it allows the device to change panel voice, even accompaniment style. I have a CVP-809 too, I should install one on my phone and use USB analyzer to sniff into it. Therefore we can know much about Yamaha's undocumented Sy*** messages. Thank you!

pjd · March 27, 2024, 01:14:36 PM

Hi --

Please keep investigating!

I have a Yamaha CSP-170 and did one or two sessions sniffing the MIDI traffic between Smart Pianist (IOS) and the CSP-170. It's a little easier sniffing 5-pin DIN MIDI than USB...

The Sy*** messages are quite different, possibly model-specific? Yamaha seem to like the notion of an operation byte followed by the address for a panel/part parameter.

Long term, I will probably take another look. I want to control drawbar footage from a MIDI Designer template. CSP doesn't have much direct access to anything through the front panel -- only Smart Pianist.

Good luck! -- pj

hikari · March 27, 2024, 09:56:11 PM

Quote from: pjd on March 27, 2024, 01:14:36 PM
Hi --

Please keep investigating!

I have a Yamaha CSP-170 and did one or two sessions sniffing the MIDI traffic between Smart Pianist (IOS) and the CSP-170. It's a little easier sniffing 5-pin DIN MIDI than USB...

The Sy*** messages are quite different, possibly model-specific? Yamaha seem to like the notion of an operation byte followed by the address for a panel/part parameter.

Long term, I will probably take another look. I want to control drawbar footage from a MIDI Designer template. CSP doesn't have much direct access to anything through the front panel -- only Smart Pianist.

Good luck! -- pj

Well, maybe you can get a WCH USB analyzer or a DSLogic analyzer. Both of them are cheap and easy-to-use. Since Yamaha often uses USB full-speed interface device port, I think DSLogic is a better choice (as a universal logic analyzer) than a USB analyzer (specifically for USB).

I owned both of these two analyzers and I planned to do it at May.1 - May.7 cuz it's national holiday here so there's plenty of free time to do it.

pjd · March 28, 2024, 12:18:43 PM

Hi --

Your suggestion is technically valid, but is over-kill. I monitored the USB traffic using Wireshark. It's just USB carrying MIDI messages! Unless the logic analyzer understands MIDI over USB protocol, it's actually a major hassle to decode the MIDI message stream over USB.

So, if I can monitor 5-pin MIDI, I will -- it's easier and there are lots of tools like MIDI-OX. Honest to goodness, it's the same MIDI messages either way. That might be surprising, but Yamaha reuses code and protocols like crazy.

Anyway, I do wish you luck and good will! Sorting through raw HEX, cataloging it and teasing out a protocol is tedious (I'm sure you know...)

All the best -- pj

P.S. Probably should have mentioned: The CSP, CVP, Genos, etc. all have an "operation, ACK/NAK" message protocol. Makes note ON/OFF, CC, etc. look simple.

hikari · March 29, 2024, 04:09:13 AM

Quote from: pjd on March 28, 2024, 12:18:43 PM
Hi --

Your suggestion is technically valid, but is over-kill. I monitored the USB traffic using Wireshark. It's just USB carrying MIDI messages! Unless the logic analyzer understands MIDI over USB protocol, it's actually a major hassle to decode the MIDI message stream over USB.

So, if I can monitor 5-pin MIDI, I will -- it's easier and there are lots of tools like MIDI-OX. Honest to goodness, it's the same MIDI messages either way. That might be surprising, but Yamaha reuses code and protocols like crazy.

Anyway, I do wish you luck and good will! Sorting through raw HEX, cataloging it and teasing out a protocol is tedious (I'm sure you know...)

All the best -- pj

P.S. Probably should have mentioned: The CSP, CVP, Genos, etc. all have an "operation, ACK/NAK" message protocol. Makes note ON/OFF, CC, etc. look simple.

Well, DSLogic is a libsigrok based logic-analyzer, it's easy to stack decoder for more clear view. Like I can stack USB MIDI over USB packet over USB signalling... All I have to do is to write a decoder to decode USB MIDI message in python, well, not so tough for me, and I'll send a patch to libsigrok project when it's done to help everyone do it.

And thank you for your tips! That helps a lot.

hikari · March 30, 2024, 11:00:27 PM

Quote from: pjd on March 25, 2024, 02:51:58 PM
I hooked up Sound Controller to Genos1 and monitored the outgoing MIDI messages.

When Sound Controller starts up, it sends the following set-up messages:
TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 000B0BCE   2  --     F0  Buffer:     2 Bytes   System Exclusive      
 SYSX: F0 F7
 000B1051   2  --     F0  Buffer:     2 Bytes   System Exclusive      
 SYSX: F0 F7
 000B18A0   2  --     F0  Buffer:     6 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 01 F7
 000B18BE   2  --     F0  Buffer:     8 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 01 F7
 000B1C90   2  --     F0  Buffer:     6 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 01 F7
 000B1C9B   2  --     F0  Buffer:     8 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 01 F7
 000B1C9E   2  --     F0  Buffer:     9 Bytes   System Exclusive      
 SYSX: F0 43 73 01 52 26 02 02 F7
F0 7E 7F 06 01 F7 is the standard MIDI identity request messages. BTW, if no keyboard is connected, Sound Controller will loop and send this message over and over again until it receives a response. This is how Sound Controller detects a connected and supported keyboard.

-- pj

I tried sy*** 'F0 43 73 01 52 26 02 02 F7' on Yamaha's P-225, it turns out that not only this Sy*** allows control change to the keyboard part, but also allows program change to the keyboard part. Although the panel voice display did not change, and effect parameters did not change too, it made some voice weird so I'm sure you don't want to do that way. But it's still a big step forward!

The proper way to change keyboard part voice externally still hide in Smart Pianist program but I will do it at my spare time.

I assume that this Sy*** controls MIDI Preset of the keyboard. If I understand correctly, the last 02 should be the index of MIDI template 'KBD & Style', I'm at vacation so I don't have access to Genos2, if you have spare time you can check on this (MIDI receive/transmitting setting and template) to sure how this Sy*** does to the keyboard. Btw, I think 01 should be 'ALL PARTS', I tried on P-225 and it back to normal operation (Send any CC doesn't affect keyboard parts).

And I assume that the reply message should indicate the mapping of MIDI channel of input ports. But it may have a bug because P-225 replied this message as following:
F0 43 73 01 52 26 02 03 20 01 02 04 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F7

13-1F may indicate song channels. The instrument itself have to have 32 internal channels.

It seems 01 02 04 is the keyboard part but in MIDI format it should be 00 01 03. (00-0F as keyboard & style parts and 10-1F as song parts) The reply from Genos seems have this bug too. I don't know am I wrong or Yamaha have a buggy reply.

Btw when I sent 'F0 43 73 01 52 26 02 01 F7' to P-225, the reply is 'F0 43 73 01 52 26 02 03 20 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F7'.

hikari · March 31, 2024, 01:48:19 AM

Quote from: pjd on March 25, 2024, 02:55:37 PM
I monitored Genos1's responses to the Sound Controller app:


TIMESTAMP IN PORT STATUS DATA1 DATA2 CHAN NOTE EVENT               
 00002D38   2  --     FE    --    --   --  ---  Active Sensing        
 00002E00   2  --     FE    --    --   --  ---  Active Sensing        
 00002EC7   2  --     FE    --    --   --  ---  Active Sensing        
 00002F8F   2  --     FE    --    --   --  ---  Active Sensing        
 00002FDD   2  --     F0  Buffer:    15 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7
 00002FEA   2  --     F0  Buffer:    16 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7
 00003057   2  --     FE    --    --   --  ---  Active Sensing        
 00003120   2  --     FE    --    --   --  ---  Active Sensing        
 000031E7   2  --     FE    --    --   --  ---  Active Sensing        
 000032AF   2  --     FE    --    --   --  ---  Active Sensing        
 00003378   2  --     FE    --    --   --  ---  Active Sensing        
 000033CD   2  --     F0  Buffer:    15 Bytes   System Exclusive      
 SYSX: F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7
 000033D8   2  --     F0  Buffer:    16 Bytes   System Exclusive      
 SYSX: F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7
 000033EC   2  --     F0  Buffer:    42 Bytes   System Exclusive      
 SYSX: F0 43 73 01 52 26 02 03 20 01 02 03 04 30 31 32 33 20
 SYSX: 21 22 23 24 25 26 27 00 00 00 00 00 00 00 00 00 00 00
 SYSX: 00 00 00 00 00 F7
 00003440   2  --     FE    --    --   --  ---  Active Sensing        
 00003507   2  --     FE    --    --   --  ---  Active Sensing

F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7 is the Genos1 reply to the identity request. It says "I'm Genos 1".

Good luck discovering what these Sy*** messages do!

-- pj

Btw I think 'F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7 ' is a common reply said 'I'm an Yamaha product'. And 'F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7' said I'm Genos1.

Because '47 65 6E 6F 73' is ASCII code of 'Genos'.

I tried these two Sy*** inquiry to P-225 and I got same first reply. The second reply is 'F0 43 50 00 00 07 02 07 00 50 2D 32 32 35 00 F7', it also has ASCII code said I'm P-225.

pjd · April 01, 2024, 01:47:52 PM

Quote from: hikari on March 31, 2024, 01:48:19 AM
Btw I think 'F0 7E 7F 06 02 43 00 44 42 1C 0A 00 00 01 F7 ' is a common reply said 'I'm an Yamaha product'. And 'F0 43 50 00 00 07 02 07 00 47 65 6E 6F 73 00 F7' said I'm Genos1.

Because '47 65 6E 6F 73' is ASCII code of 'Genos'.

I tried these two Sy*** inquiry to P-225 and I got same first reply. The second reply is 'F0 43 50 00 00 07 02 07 00 50 2D 32 32 35 00 F7', it also has ASCII code said I'm P-225.

Hi --

Thanks for posting all of your results!

MIDI Identity Request is a standard message. The Yamaha synth manuals document the request and model-specific reply. The arranger and piano engineers do not document this message -- "security through obscurity?"

This is how Smart Pianist and other apps recognize the target, connected keyboard.

I sometimes think about spoofing the reply and seeing what happens.

Have fun -- pj