Skip to content

Instantly share code, notes, and snippets.

Last active Jul 18, 2021
What would you like to do?
Obtaining a shell on Yamaha Montage
Obtaining a shell on Yamaha Montage
Yamaha Montage firmware updates consist of an ext2 filesystem image which is
loopback mounted from a file 8N70OS_.PGM on an attached USB drive when the
machine powers up with the Utility and Cursor Up buttons held.
The initramfs /init script detects the magic button combination, mounts the
USB drive and filesystem image, then runs from within that image.
(The name '' is misleading: it is actually exec()ed rather than run
with a shell, so needs execute permissions and #! magic.)
Real firmware updates overwrite the partitions on /dev/mmcblk0 with new
images, but you can instead use this mechanism to non-destructively launch a
shell on the Montage.
Attached to this gist is such an script, along with a ready-made
ext2 filesystem containing it. Copy the 8N70OS_.PGM image file to the root
of a USB drive, then switch on the instrument with the drive attached,
holding Utility and Cursor Up. A prompt will appear on the touchscreen and
you can plug in a USB keyboard to interact with it.
Before launching the shell, the instrument's main / and /home filesystems
are mounted read-only on /mnt/root and /mnt/home respectively. In normal
operation, Montage uses /home/ngs to store user data and configuration, and
preset data can be found in /usr/share/yamaha. The front-end itself is
started by the /usr/bin/daisy-start script.
The FAT32 boot filesystem is left unmounted as damaging this will brick the
instrument in a way that will require JTAG and cannot be fixed with the
standard update process.
8N70OS_.PGM is built from on a GNU/Linux host with
fallocate -l 64k 8N70OS_.PGM
mke2fs -t ext2 8N70OS_.PGM
mkdir -p mnt && mount -o loop 8N70OS_.PGM mnt
cp mnt/
umount mnt
Please remember that if your synthesiser bursts into flames and kills the
cat as a result of experiments or modifications gone wrong, you are unlikely
to elicit much sympathy from Yamaha. I make no warranty and disclaim all
liability for any damage caused by your use of this unofficial hack, which I
hereby dedicate to the public domain.
exec <>/dev/tty0 2>&1
while [ ! -b /dev/mmcblk0 ]; do
sleep 1
if [ ! -d /mnt/root ]; then
mkdir -p /mnt/root
mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p2 /mnt/root
if [ ! -d /mnt/home ]; then
mkdir -p /mnt/home
mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p3 /mnt/home
umount -l /mnt/loop
exec getty -l sh -n 115200 tty0
Copy link

arachsys commented Jul 18, 2021

A more recent version of this code is maintained as part of my Montage resources at and can be found at

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment