Platform index / Digital mixing console
Midas HD96
The one console examined whose control plane is wide open: a full Linux computer speaking documented Thrift and Protobuf. The mixer still lives in FPGA fabric — but the bitstreams ship in the clear and the exact parts are known.
The load-bearing finding. Three stacked computers: a Jetson TK1 runs the GUI and the control protocols, an ARM920T card runs the mixer, and the mixing itself is an unencrypted Spartan-6 bitstream that ships inside the update.
Verdict. The most open console examined. The mixer still lives in FPGA fabric, as on the SQ-5 — but here the bitstreams ship in the clear, the exact Spartan-6 parts are known from their IDCODEs, and, unlike the SQ, the entire control plane is documented RPC you can speak now. The value is interop, and it is unusually reachable; rehosting remains pointless for the same reason it was on the SQ.
Method
Static analysis of the public 2.4.0 firmware bundle — a signed APT repository plus Yocto board images. No hardware was inspected. The bundle was retained, so every claim here re-derives from it. Two protocol schemas were recovered whole: the Thrift RPC from shipped generated Python, the Protobuf bus from descriptors embedded in a shared library.
Artifacts examined
hd96_2.4.0+sumo.329.tar— VERSION/WHATSNEW/CHECKSUMS(.asc),repo.tar(APT repo, 108 debs),mghd271-tk1-*.tar.gz(Yocto images)libPufferfishCore.so— embeds all 13 control-busFileDescriptorProtosas88_hmac.bin/as88_smac.bin— the mix-engine FPGA bitstreams, shipped insidemkt-as88
No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See themethod and legal statement for the basis on which this analysis was performed and the boundaries it observes.
Hardware architecture
| Item | Finding | Confidence |
|---|---|---|
| Host SoC | NVIDIA Tegra124 (Jetson TK1), quad Cortex-A15 — from the device tree compatible = "nvidia,jetson-tk1","nvidia,tegra124" and the armhf package architecture | Verified |
| Host DRAM | 2 GB — the DT memory node is reg = <0x80000000 0x80000000>. A 4 GB boot-config (bct_hyinx_4gb) also ships, so a 4 GB surface variant exists | Verified |
| Mix-engine card (AS88) | A separate board hosting the mixer: an ARM920T running a Buildroot 2013.08 / uClibc Linux under the RedBoot bootloader, from 32 MB of NOR flash mapped at 0x60000000. Build path KES-BR14-ARM920T, RedBoot FIS table intact | Verified |
| Mixing FPGA (HMAC) | Xilinx Spartan-6 XC6SLX100 — proven from the bitstream's own IDCODE register write (0x04011093) in as88_hmac.bin, not inferred | Verified |
| AES50 SuperMAC FPGA (SMAC) | Xilinx Spartan-6 XC6SLX150 — IDCODE 0x0401D093 in as88_smac.bin. This is the Klark Teknik SuperMAC/HyperMAC AES50 fabric | Verified |
| Host-side FPGAs | Routing and IO on the TK1 side: mkt-fpga-{io,io2,ve,ctrl,hd272-ctrl,hd272-audio} plus expansion-card ASRC/AES50 images, flashed by mkt-fpga | Verified |
| FX DSPs | An Analog-Devices-SHARC-family DSP subsystem reached through /dev/dayak; 63 effects ship as loadable *_MultiApp DSP images. Part not pinned — inferred from ADSP- strings and the loader format | Inferred |
| Ethernet switch | Marvell mv88e6096 managed switch, configured over memory-mapped IO-FPGA access (mkt-hd271-switch-config) | Verified |
| Expansion / STM32 | An STM32 “HD271C” expansion-card handler (mkt-hermes) drives AES50 option cards and DP48 stageboxes; IO boxes are controlled in-band over the AES50 port (HardwareControlOverAesPort) | Verified |
Software architecture
| Item | Finding | Confidence |
|---|---|---|
| Host OS | Full embedded Linux — Yocto “sumo”, ID=hd271dist 2.20.1, kernel 3.10.40, u-boot 2014.10. Not bare metal | Verified |
| Application layer | A signed APT repository of 108 packages (57 first-party mkt-*) layered on the Yocto rootfs; mkt-heritage is the top-level that pulls in the whole console | Verified |
| GUI | squig — a CEF/Chromium-backed application (cef-runtime 3770), run as offlinesquig … --allowRemoteClients true | Verified |
| Control bus | pufferfish — Protobuf over ZMQ/TCP on port 9990, advertised over mDNS as “HD96Control”. The complete proto3 schema (13 files, namespace serialisation) was recovered from embedded descriptors | Verified |
| Parameter model | A string-key + category addressed tree: ParameterRequest{subscribe|unsubscribe; identifier{category|key}} → ParameterEvent{Parameter{key,value,categories}}, values a 10-arm ConsoleValue union. Show control is a 41-verb AutomationEvent enum (recall / store / loadShow / fireEvent / import·exportShow) | Verified |
| Test RPC | razorbill — Apache Thrift on port 9094, three privilege tiers up to a 60-method development interface (SetParameterValue, Screenshot, InstallPackage, Reboot, user-DB inject/wipe). The IDL was read back from shipped generated Python | Verified |
| Surface variants | HD96-16, HD96-24 and HD96 Air, six surface bays and dual mix engines (HMAC1/HMAC2) — leaked verbatim by the DebugEvent enum (surfaceConfigHd96_16_revA, _24_revD, _Air_revA) | Verified |
Update path & security model
| Item | Finding | Confidence |
|---|---|---|
| Package trust | The update is a GPG-signed APT repo (Origin “Music Group Research UK”) with a SHA-256 CHECKSUMS manifest and a detached PGP signature over it. Package-level integrity, not silicon secure boot | Verified |
| Mixing bitstream encryption | None. Both Spartan-6 bitstreams ship unencrypted — the AA·99·55·66 sync word is in the clear and there is no key-load sequence. They are byte-bit-reversed for flash storage, nothing more | Verified |
| Host secure boot | No evidence of fused Tegra secure boot. u-boot carries the Tegra bootsecure/BCT infrastructure, but nothing indicates the fuses are burned on shipping hardware | Inferred |
| Control-plane auth | None observed. razorbill Thrift is a plain TBinaryProtocol server with no authentication; squig runs with --allowRemoteClients true. Whether 9990/9094 bind off-box on a shipping desk is unconfirmed | Inferred |
| Entitlement | A device-uniqueness / licensing mechanism exists (mkt-uniqueness, the mCloud proxy). Its content was not analysed — see the methodology page | Verified |
These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.
What is programmable
- 1Interoperability via the recovered protocols
`pufferfish` (Protobuf, :9990) is a live parameter/metering bus and `razorbill` (Thrift, :9094) a full control RPC. Both schemas are recovered. This is a console you can speak to today, and it is where the value is.
- 2The Spartan-6 mixing fabric
Unencrypted and identified (XC6SLX100 / XC6SLX150), so analysable with Project X-Ray. But replacing it means writing a mix engine against an unpublished pinout and an ARM920T host interface.
- 3Rehost the Jetson TK1
Trivially Linux-friendly — but replacing the TK1 software leaves you wired to the same engine cards, which is the part that actually mixes. It buys nothing, exactly as on the SQ-5.
Traps
Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.
- Two unrelated “HMAC”: the Midas mix-engine path, and hmac-md5/hmac-sha crypto strings in the AS88 rootfs. They are not related.
- The FPGA bitstreams are byte-bit-reversed for flash, so a naive search for the AA·99·55·66 sync word fails until each byte is reversed.
- The embedded Protobuf descriptors cannot be carved by binary-searching the length — descriptor validity is not monotonic. A field-by-field wire-format walk is required to find each descriptor's exact end.
Open questions
- Do ports 9990 and 9094 bind off-box on a shipping desk, and is the Protobuf bus authenticated? The mDNS advert and --allowRemoteClients true suggest reachable, but this was never tested on hardware.
- The parameter key/category namespace — the actual channel/bus/FX addressing — is the last missing piece for real show control, and needs a live console to enumerate.
- The register/AXI interface between the ARM920T host and the HMAC Spartan-6 is undocumented — the same black box the SQ-5 has, one layer down.
- The exact SHARC part and the _MultiApp DSP loader format are unexamined.
Status of this entry. A written teardown exists and its claims carry evidence citations. Unless a row says otherwise, nothing on this page has been verified against physical hardware.