Skip to content

Instantly share code, notes, and snippets.

@arachsys
Last active Jul 18, 2021
Embed
What would you like to do?
Obtaining a shell on Yamaha Montage
Obtaining a shell on Yamaha Montage
===================================
Yamaha Montage firmware updates consist of an ext2 filesystem image which is
loopback mounted from a file 8N70OS_.PGM on an attached USB drive when the
machine powers up with the Utility and Cursor Up buttons held.
The initramfs /init script detects the magic button combination, mounts the
USB drive and filesystem image, then runs update.sh from within that image.
(The name 'update.sh' is misleading: it is actually exec()ed rather than run
with a shell, so needs execute permissions and #! magic.)
Real firmware updates overwrite the partitions on /dev/mmcblk0 with new
images, but you can instead use this mechanism to non-destructively launch a
shell on the Montage.
Attached to this gist is such an update.sh script, along with a ready-made
ext2 filesystem containing it. Copy the 8N70OS_.PGM image file to the root
of a USB drive, then switch on the instrument with the drive attached,
holding Utility and Cursor Up. A prompt will appear on the touchscreen and
you can plug in a USB keyboard to interact with it.
Before launching the shell, the instrument's main / and /home filesystems
are mounted read-only on /mnt/root and /mnt/home respectively. In normal
operation, Montage uses /home/ngs to store user data and configuration, and
preset data can be found in /usr/share/yamaha. The front-end itself is
started by the /usr/bin/daisy-start script.
The FAT32 boot filesystem is left unmounted as damaging this will brick the
instrument in a way that will require JTAG and cannot be fixed with the
standard update process.
8N70OS_.PGM is built from update.sh on a GNU/Linux host with
fallocate -l 64k 8N70OS_.PGM
mke2fs -t ext2 8N70OS_.PGM
mkdir -p mnt && mount -o loop 8N70OS_.PGM mnt
cp update.sh mnt/update.sh
umount mnt
Please remember that if your synthesiser bursts into flames and kills the
cat as a result of experiments or modifications gone wrong, you are unlikely
to elicit much sympathy from Yamaha. I make no warranty and disclaim all
liability for any damage caused by your use of this unofficial hack, which I
hereby dedicate to the public domain.
#!/bin/sh
RELEASE_VERSION=999.999.999
exec <>/dev/tty0 2>&1
reset
while [ ! -b /dev/mmcblk0 ]; do
sleep 1
done
if [ ! -d /mnt/root ]; then
mkdir -p /mnt/root
mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p2 /mnt/root
fi
if [ ! -d /mnt/home ]; then
mkdir -p /mnt/home
mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p3 /mnt/home
fi
umount -l /mnt/loop
exec getty -l sh -n 115200 tty0
@arachsys
Copy link
Author

arachsys commented Jul 18, 2021

A more recent version of this code is maintained as part of my Montage resources at https://arachsys.github.io/montage/ and can be found at https://github.com/arachsys/montage/tree/main/shell

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment