TC Electronic Toneprint Hack?

[binge]

So I was thinking, when you download a Toneprint all the settings for your pedal are in that file, correct? Well, I believe that there's bound to be a way that you can get in and manually change those settings and then load the Toneprint on to your pedal...

Has anyone tried this? I am using a Mac OS but didn't get very far, I can view the package contents of the Toneprint file but my lack of knowledge with the command line makes it difficult for me to go further. I think that you would need to use the command line to edit the source, or at least try to edit it.

Someone has to have some views on this.....right?

[electrical]

Nahh, it wouldn't be in the command line... it would be in the source code itself. You need some form of a text editor. I can take a look at it later in the evening after I've freed up a bit. I'm also on Mac OS, but I also know a few programming languages.

[binge]

Originally Posted by electrical

Nahh, it wouldn't be in the command line... it would be in the source code itself. You need some form of a text editor. I can take a look at it later in the evening after I've freed up a bit. I'm also on Mac OS, but I also know a few programming languages.

Cool! I checked out the file in the Contents folder via Text Edit and it was all garbage. Hopefully you can come up with something. I really think that this would work and don't see a reason why it wouldn't.

Just opened the file in the Contents folder with pico and it's all garbage too. I'm guessing you need some sort of disassemble command and then you'd need to reassmble after making changes...?

Just ran a otool command and got loads of this:

000ca793 popl %ecx
000ca794 pushl %ebp
000ca795 movl %esp,%ebp
000ca797 leal 0x0007fa4d(%ecx),%eax
000ca79d movl %eax,0x08(%ebp)
000ca7a0 leave
000ca7a1 jmpl 0x0014c1c7


This means nothing to me....

[cj_wattage]

The Tone Print loader files are binary. You need a hex editor to get in there and make the changes. But first you have to figure out what to change, and that's not just listed in plain English (or Danish, for that matter).

I've poked around with this already a little bit. It *should* be possible to make a Flashback Tone Print work on a Hall of Fame, and vice versa.

But the trick is, I think, in the "authentication" part of the Tone Print loader applications. Again, I *think* if we knew what the "challenge-response" process is (probably just a simple code check/verification), it would be possible to edit the Tone Print loader app so that it would load its Tone Print onto a different pedal. If you try to fire up a HOF Tone Print app with a Flashback connected, for example, the button that initiates the upload is greyed out, and it says "Not Connected" even though there is a pedal connected (just not the *right* pedal). So if the loader app can be convinced that the right pedal is connected even though it isn't, I think it will load the Tone Print.

I've been doing a little USB sniffing trying to get a full dump of the entire communication between the app and the pedal, but there is no software USB sniffer for Macs, and I don't have admin access to any Windows machines. But I may be able to get the data dump done tomorrow or perhaps this weekend some time.

This all might get deleted, but whatever. I don't want to cheat TC out of a pedal sale or anything. And I think if this actually works out, they'll sell more pedals. I'd buy another one. After all, it won't turn a Flasback into a HOF. It just allows the loading of one single program of the opposite pedal. And since you can't have two programs running at once, it's only sort of useful. But an interesting exercise nonetheless.

[Stevil]

Originally Posted by cj_wattage

This all might get deleted, but whatever. I don't want to cheat TC out of a pedal sale or anything. And I think if this actually works out, they'll sell more pedals. I'd buy another one.

i've got a Vortex & a HoF. while they sound nice in a pedestrian sort of way, i put both back in the original packaging because i wasn't all that impressed with the current batch of sounds available & the only reason i havent sold or returned em is because i'm waiting to see if they or someone else will make it so i can do my own custom toneprints & see what these boxes can really do.

[cj_wattage]

Originally Posted by Stevil

i'm waiting to see if they or someone else will make it so i can do my own custom toneprints & see what these boxes can really do.

Well, that's a different issue. If TC releases some stripped down version of their program editor, that would be awesome. But what I'm talking about still just leaves you at the mercy of what they release.

[binge]

Originally Posted by cj_wattage

The Tone Print loader files are binary. You need a hex editor to get in there and make the changes. But first you have to figure out what to change, and that's not just listed in plain English (or Danish, for that matter).

I've poked around with this already a little bit. It *should* be possible to make a Flashback Tone Print work on a Hall of Fame, and vice versa.

But the trick is, I think, in the "authentication" part of the Tone Print loader applications. Again, I *think* if we knew what the "challenge-response" process is (probably just a simple code check/verification), it would be possible to edit the Tone Print loader app so that it would load its Tone Print onto a different pedal. If you try to fire up a HOF Tone Print app with a Flashback connected, for example, the button that initiates the upload is greyed out, and it says "Not Connected" even though there is a pedal connected (just not the *right* pedal). So if the loader app can be convinced that the right pedal is connected even though it isn't, I think it will load the Tone Print.

I've been doing a little USB sniffing trying to get a full dump of the entire communication between the app and the pedal, but there is no software USB sniffer for Macs, and I don't have admin access to any Windows machines. But I may be able to get the data dump done tomorrow or perhaps this weekend some time.

This all might get deleted, but whatever. I don't want to cheat TC out of a pedal sale or anything. And I think if this actually works out, they'll sell more pedals. I'd buy another one. After all, it won't turn a Flasback into a HOF. It just allows the loading of one single program of the opposite pedal. And since you can't have two programs running at once, it's only sort of useful. But an interesting exercise nonetheless.

I'd be interested to see the outcome of this!!

[heminder]

Originally Posted by binge

Cool! I checked out the file in the Contents folder via Text Edit and it was all garbage. Hopefully you can come up with something. I really think that this would work and don't see a reason why it wouldn't.

Just opened the file in the Contents folder with pico and it's all garbage too. I'm guessing you need some sort of disassemble command and then you'd need to reassmble after making changes...?

Just ran a otool command and got loads of this:

000ca793 popl %ecx
000ca794 pushl %ebp
000ca795 movl %esp,%ebp
000ca797 leal 0x0007fa4d(%ecx),%eax
000ca79d movl %eax,0x08(%ebp)
000ca7a0 leave
000ca7a1 jmpl 0x0014c1c7


This means nothing to me....

dude, that looks like Assembler code to me.
http://en.wikipedia.org/wiki/Assembly_language

yep, my first post.
i registered here just to post that
determined to get this pedal cracked!
hope that helps out a bit

[spamsponge]

Originally Posted by binge

Cool! I checked out the file in the Contents folder via Text Edit and it was all garbage. Hopefully you can come up with something. I really think that this would work and don't see a reason why it wouldn't.

Just opened the file in the Contents folder with pico and it's all garbage too. I'm guessing you need some sort of disassemble command and then you'd need to reassmble after making changes...?

Just ran a otool command and got loads of this:

000ca793 popl %ecx
000ca794 pushl %ebp
000ca795 movl %esp,%ebp
000ca797 leal 0x0007fa4d(%ecx),%eax
000ca79d movl %eax,0x08(%ebp)
000ca7a0 leave
000ca7a1 jmpl 0x0014c1c7


This means nothing to me....

IIRC, otool on an Intel Mac assumes what it disassembles is Intel assembler code.
The posted code is without a doubt Intel 32 bit x86 Assembly Code. But, some parts of it do not make sense AND I doubt they'd use an Intel chip in their pedals since they cost too much for what they can do versus a real DSP.

[td2243]

This thread rules. Maybe the fact that 'the kids' are trying to crack the toneprint will get TC in gear about releasing the software editor.

Then, hopefully 1 week after that they'll release a pedal with 10 empty slots!

[kwaping]

Assuming it's some sort of plain-text file and not a binary...

[Bombshell]

i can't imagine it being straight binary, although, a simple .cfg-style seems far too simple.

hope someone figures it out. i'm staying away from the Flashback until someone cracks it, or the official software comes out.

[sonicmayhem]

I want the software you see in the making of the toneprints videos.

[electrical]

Well I haven't looked at it yet, but the code you just posted could be... well, just about anything. Most likely C. What you've copy/pasted is a bunch of pointers. And some commands, and comments. That's going to be sticky...

[Ramblin390]

watch out, Tore has a bad accent-and it has come to my attention he's like ^6'6". He has a wrath of god toneprint as well as a armegeddon tp. Just sayin'....