Reverse engineering and update-protocol research for the M-Vave FM-1 synthesizer. Package, SPL, and SDK provenance identify the target as Jie Li AC791N/WL82 with a pi32v2 CPU, XIP flash at 0x02000000, and a Dexed/msfa-derived six-operator FM engine. The embedded JL-BR22 string is inherited library nomenclature, not reliable SoC identification. This main branch intentionally contains no replacement firmware or custom image builders.
Architecture overview: mapped hardware, boot chain, memory layout, and major subsystems. OTA protocol: captured USB-MIDI framing, session flow, loader behavior, and unresolved gates. Debug-surface audit: static search for consoles, factory modes, test commands, and recovery entry points. Windows updater analysis: decompiled M-UPGRADE state machine and identity parsing.
Repository layout includes analysis/, docs/, scripts/, tools/, ghidra/scripts/, firmware-images/, reference/, and 3rd-party submodules. The repository retains two independently developed V13 analysis pipelines. Reproduce commands from the repository root include scripts for disassembly, OTA loader extraction, and database building.
Safety status: The update protocol is not a demonstrated recovery mechanism. Current work has not established ROM recovery, rollback, or safe interrupted-write behavior for the single-bank layout. The console/factory-mode audit found no substitute recovery entry. Read TODO_aug2.md before using any update or flash utility.
Source: Hacker News · Summarized by HeadlinesBriefing