Kris takes apart the stanton SCS.4DJ… Last update: 11:00 BST Friday 13th April 2012.

I’ve had a Stanton SCS.4DJ unit for a few months now, and thorougly enjoy using it. However, there are a community of users who want to get their hands on the OS/application so we can help to improve it.

What follows is a collection of notes from my initial reserach into the device. Much of it isn’t complete, I need to spend more time doing in-depth analysis but that’s a hard task fitting it within my day job. Hopefully this is a good enough start that it picks up some interest from the community (or maybe even Stanton/Gibson themselves).

Lets start with QuickGrid:

QuickGrid is a PC based analysis program which analyses BPMs and generates the waveform display that is used on the unit. The SCS.4DJ can do it itself, but doing it on a PC is much faster. Lets see what it’s doing:

Analysis

Well, it’s a Java App with a couple of dependencies, namely djanalyze.exe. Running it manually gives:

C:\Program Files (x86)\Stanton>djanalyze.exe --help
usage: djanalyze audioFileName rootFolder songId [userBPM] [userBPMMode]
						or
			djanalyze --version
						or
			djanalyze --supports-hash
						or
			djanalyze --error-code
						or
			djanalyze --help

example: djanalyze "e:\audio.mp3" "e:" "FE66E7B1E7D1C4B8AAA2FD5BB8B71A39"

So the app must be generating the hash (which we assume to be an MD5 because it’s 32 characters long, though it’s not a plain md5 so it must be salted somehow It IS an md5 hash of the file!), analysing the mp3, then storing the results. So how does it store this data?

On-USB-Device filesystem:

  • SCS.4DJ_Database
    • analysis
      • {two-chars}/{hash}.sar
      • {two-chars}/{hash}.sek
      • {two-chars}/{hash}.wfv
    • db_reserved_space
    • Stanton_DJ_DB.db

The most interesting file is of course, Stanton_DJ_DB.db. This is an SQLite database, and there’s a nifty extension for Firefox called ‘SQLite Manager‘. Opening this file gives us 5 database tables:

  • Device
  • Playlists
  • SongAnalysis
  • Songs
  • Vieos

So if you ever wanted to find all the 87 BPM tracks and double them to 174, all it takes is a single SQL query (maybe someone will write a utility that can quickly do this…)

And now on the SCS.4DJ itself:

Normally to work this out we’d have to take apart the unit, but not wanting to void my warranty, we’re stuck with the hard way…. or maybe not so hard: Stanton have given us a firmware update file we can take apart!

Extracting the zip file at http://www.stantondj.com/pdf/products/controllers/scs4dj/SCS4%202_1-update-and-changelog.zip gives us

  • SC-IX Update Instructions_Changelog.pdf
  • SCS.4DJ_OSv2.1_2011-12-02.update

Looking at the .update file header, we can see that it’s a .tar.gz file, so extracting all of the contents of that gives us something that looks like:

  • ColdfireUpdateAction
    • MR1.0.1_SCS4DJ_CF4.11_7_15.cfupdate
    • update-coldfire (ELF file)
  • DeleteSelfAction
  • DjappUpdateAction
    • home/jars/workspace
      • app
      • djanalyze
      • midi_controller
  • KernelUpdateAction
    • zImage
  • PrerequisiteCheckAction
  • RootfsUpdateAction
    • boot …
    • etc …
    • lib …
    • root …
    • tmp …
    • usr …
  • Scripts
    • 01-PrerequisiteCheckAction.sh
    • 02-RootfsUpdateAction.sh
    • 03-KernelUpdateAction.sh
    • 04-DjappUpdateAction.sh
    • 05-ColdfireUpdateAction.sh
    • 06-DeleteSelfAction.sh
  • UpdateHelpers
    • fbsplash.ini
    • progress
    • scs4_progress.ppm.bz2
  • Update

Some interesting files there, most notably the stuff in RootFsUpdateAction. Here’s what i’ve found out:

Modifying the scripts may void your warranty!
Lots of files have a header similar to this:
	#!/bin/sh
	# SCS.4DJ_OSv2.1_rc1_2011-12-02.update
	# Copyright Stanton Magnetics Inc.  All rights reserved.
	# Modifying any component of this file may void your warranty.
	# This script is automatically generated.  Do not update it manually.
ColdFire – the name of the chipset used.
It’s a RISC based 32bit processor, and CF4 denotes that it’s a v4 coldfire processor (which is bad news for those of us who wish for a faster processor!). Looks like build tools are available at freescale (go for the “Special Suite (Free Trial)” under codewarrior suites, and get the ColdFire bundle)
RootfsUpdateAction
Looks like a unix style file system! I’m gonna say BSD based…
ELF executable files
ELF format files are used for executables
There is a USB Ethernet adapter configured on this device
RootfsUpdateAction.tar\etc\udev\rules.d\68-drivers-net.rules shows us that the Trendnet USB Ethernet TUET100C has drivers loaded. Which is useful for the next part:
SSHD is available, but not configured
The files are there, but sshd.conf is not setup.
SFTP is available
sftp-server is located in RootfsUpdateAction.tar\usr\libexec
RootfsUpdateAction.tar\lib\modules\2.6.31.12-rt21-ivl-00001-ga75aeaa is a folder
2.6.31.12-rt21 is a linux release, ivl is the manufacturer, not sure what the rest means.

SCS.4DJ startup shell script

#!/bin/sh# Set time from hardware clockhwclock--hctosys# Don't shut off screenecho-e-n'\033[9]'>/dev/tty0echo-e-n'\033[?25l'>/dev/tty0ENABLE_USB_SLAVE_EMI_TEST=0if[$ENABLE_USB_SLAVE_EMI_TEST==1]thenecho"setting up USB slave"RANDOM_SERIAL=$(hexdump -d -n 4 /dev/urandom | \
				sed -e "s/\s\+/ /g" | \
				cut -d' ' -f2,3 -s | \
				sed -e "s/\s\+//g" )modprobeg_midiidVendor=0x0d60idProduct=0x3434\iManufacturer="Stanton Magnetics"iProduct="SCS.4DJ"\iSerialNumber="$RANDOM_SERIAL"fiUBI_OK=0iftest-e/dev/mtd5then# Hynix flash partition schemeMTD_USERFS=5else# Samsung flash partition schemeMTD_USERFS=3fiecho"Setting up ubi/ubifs"ubiattach/dev/ubi_ctrl-m$MTD_USERFS&&\mount-tubifsubi1:app/home&&\UBI_OK=1if[$UBI_OK==0]thenecho"Application not found.">/dev/tty0echo"Formatting user partition...">/dev/tty0# This might fail, depending on whether or not ubiattach succeededubidetach/dev/ubi_ctrl-m$MTD_USERFS||echo"Can't detach but continuing anyway"ubiformat/dev/mtd${MTD_USERFS}-y&&\ubiattach/dev/ubi_ctrl-m$MTD_USERFS&&\ubimkvol/dev/ubi1-Napp-m&&\mount-tubifsubi1:app/homefiiftest-x/home/jars/workspace/app/mx35r/djappthen# Check for BIST requestiftest-d/root/bistthencd/root/bist/tests/entry/root/bin/bistfi# Start usbmuxd (coldplug)usbmuxd# Set default language to EnglishexportLANG=en_US.UTF-8# Core dumps -- set size limit in KBexportCOREDUMP_PREFIX=/home/SCS.4DJ_error_reportulimit-c160000echo"${COREDUMP_PREFIX}_%e_%t">/proc/sys/kernel/core_pattern# Delete any old core dumpsrm-rf"${COREDUMP_PREFIX}"*whiletruedo# Start Xfbdev if not runningfbset-depth16pgrepXfbdev||Xfbdev-keybdkeyboard-screen480x272x16&cd/home/jars/workspace/app/mx35r./djapp&PID=$!wait$PIDDJAPP_RET=$?echo-ne'\x90\x00\x00'>/dev/ttymxc1if[$DJAPP_RET-eq0]thenpoweroffbreak# Counterintuitively, poweroff returnselif[$DJAPP_RET-ge16-a$DJAPP_RET-lt32]then# Unmount devices so they will be removed cleanly if the user decides to remove themumount-lr/mnt/sd*umount-lr/mnt/ipod*# Don't kill X hereMIDI_CHAN=$(($DJAPP_RET-16))echo"MIDI channel $MIDI_CHAN"cd/home/jars/workspace/midi_controller/mx35r./midi_controller-m$MIDI_CHAN&PID=$!sleep1ddif=/home/jars/workspace/app/resources/themes/GrayRed480x272/gtk-2.0/scs4_midi_screen.rgb565of=/dev/fb0bs=960count=272wait$PIDelif[$DJAPP_RET-eq64]thenset-x# The application has indicated that it wants to do a firmware update# and it creates a symlink at /tmp/djapp-requested-fwupdate# For some reason -h tests for symlinksiftest!-h/tmp/djapp-requested-fwupdatethenecho"The application requested a firmware update but the symlink">2echo"to the update was not set.  (/tmp/djapp-requested-fwupdate)">2echo"No update to apply -- restarting application">2continuefikillallXfbdev/root/bin/fwupdate-apply/tmp/djapp-requested-fwupdaterm-f/tmp/djapp-requested-fwupdate# The update may trigger a reboot on its own, or may exit, indicating# we should continue as normalset+xcontinueelif[$DJAPP_RET-eq68]then# X is not always in a good state when we exitkillallXfbdev# Delete local database and support files (-wal, -shm,...)rm-f/home/jars/workspace/app/local.db*# Delete midi controller configurationrm-f/home/jars/workspace/midi_controller/resources/*.txtsynccontinueelif[$DJAPP_RET-eq69]then# X is not always in a good state when we exitkillallXfbdev# Run a scriptif[-f/tmp/djapp-exit-script.sh]thenchmod+x/tmp/djapp-exit-script.shsh-x/tmp/djapp-exit-script.shrm-f/tmp/djapp-exit-script.shelseecho'Could not find /tmp/djapp-exit-script.sh'ficontinueelif[$DJAPP_RET-ge128]thenERROR_SIGNAL=$(($DJAPP_RET-128))SIGINT=2SIGTERM=15SIGSTOP=19# Kill Xfbdev, just in casekillallXfbdevif[$ERROR_SIGNAL-eq$SIGINT-o$ERROR_SIGNAL-eq$SIGTERM-o$ERROR_SIGNAL-eq$SIGSTOP]then# Stopped for debuggingbreakelse# Check for a core dump/root/bin/handle-core-dumps.sh# Try restarting applicationcontinuefielse# Kill Xfbdev, just in casekillallXfbdevfidoneeliftest-d/root/bistthen# Wait for devices to settleudevadmsettlesleep10udevadmsettleecho"Checking for firmware updates..."/root/bin/fwupdate-check-all-devicescd/root/bist/tests/menu/root/bin/bistelseecho"No BIST or application.  Insert USB stick with update.">/dev/tty0while[1]dosleep10/root/bin/fwupdate-check-all-devicesif[$?==0]then# Successful update -- reboot even if the script does not specify# a reboot, because we have nothing better to dorebootfidonefi

The DJApp itself

Some app resources can be found in DjappUpdateAction.tar\home\jars\workspace\app\resources\, including the db schema, of which there are two:

  1. One called ddb_schema (Device Database Schema?)
  2. and ldb_schema (Local Database Schema).

The DDB doesn’t have indexes on things like song.bpm and song.artist, whereas the LDB does, which leads me to believe that the database data from USB devices is simply imported into the local device database whenever you plug in a new device. I can’t tell if the data in the LDB is persistant across reboots.

The application language files have some further info on the development of the device (* symbols added for privacy),

POT-Creation-Date: 2011-05-24 15:35-0700
PO-Revision-Date: 2008-04-14 18:18-0700
Last-Translator: S******** M******** <********@ivl.com>
Language-Team: ENGLISH S******** M******** <********@ivl.com>

The new ‘Generate Device Playlist’ feature? Looks like the code was based off of the stanton forum community post!

(header of generate_playlist.sh)

#!/bin/sh
#
# Copyright (C) 2011 by IVL, Inc.,
# All Rights Reserved Worldwide.
#
# This script was derived from work by Vincent Falco from One Guy Group, Inc.,
# You can find him as "thevinn" in the Stanton SCS.4DJ forums
#
# This file is provided under MIT License
# http://www.opensource.org/licenses/mit-license.php
#
# Stanton SCS.4DJ is a trademark of Stanton Magnetics Inc
#   http://www.stantondj.com
#
# -----------------------------------------------------------------------------

Other ‘pegasus’ compatible network cards that we could use (if we updated the udev rules)

3Com USB Ethernet 3C460B
ATEN USB Ethernet UC-110T
Accton USB 10/100 Ethernet Adapter
SpeedStream USB 10/100 Ethernet
ADMtek ADM8511 "Pegasus II" USB Ethernet
ADMtek ADM8513 "Pegasus II" USB Ethernet
ADMtek ADM8515 "Pegasus II" USB-2.0 Ethernet
ADMtek AN986 "Pegasus" USB Ethernet (evaluation board)
AN986A USB MAC
AEI USB Fast Ethernet Adapter
Allied Telesyn Int. AT-USB100
Belkin F5D5050 USB Ethernet
Billionton USB-100
Billionton USBEL-100
Billionton USBE-100
iPAQ Networking 10/100 USB
Corega FEther USB-TX
Corega FEther USB-TXS
D-Link DSB-650TX
D-Link DSB-650TX(PNA)
D-Link DSB-650
GOLDPFEIL USB Adapter
ELECOM USB Ethernet LD-USB20
EasiDock Ethernet
Elsa Micolink USB2Ethernet
GIGABYTE GN-BR402W Wireless Router
Hawking UF100 10/100 Ethernet
HP hn210c Ethernet USB
IO DATA USB ET/TX
IO DATA USB ET/TX-S
IO DATA USB ETX-US2
Kingston KNU101TX Ethernet
LANEED USB Ethernet LD-USB/TX
LANEED USB Ethernet LD-USBL/TX
LANEED USB Ethernet LD-USB/T
Linksys USB10TX
Linksys USB100TX
Linksys USB10T Ethernet Adapter
Linksys USBVPN1
Linksys USB USB100TX
MELCO/BUFFALO LUA-TX
MELCO/BUFFALO LUA2-TX
Microsoft MN-110
NETGEAR FA101
OCT Inc.
OCT USB TO Ethernet
smartNIC 2 PnP Adapter
SMC 202 USB Ethernet
SMC 2206 USB Ethernet
SOHOware NUB100 Ethernet
SOHOware NUB110 Ethernet

Got shell access!!!

Friday 13th April. After I had the filesystem files, I rewrote the update script to give us a shell on the SCS.4DJ screen! To get shell, do this:

  1. Extract the “update” file [here] on a usb stick
  2. Get a USB keyboard plugged into the SCS.4DJ
  3. Turn on the device whilst holding the pitch bend [-] key on the left deck, and the pitch bend [+] key on the right deck. The top corner lights will flash if you have done this correctly.
  4. Once inside the test menu, press the [SYSTEM] button to initiate a firmware update
  5. a login prompt should appear
  6. enter “user” at the login prompt and type in “user” as the password.
  7. boom 🙂
 

Next Steps:

To continue the investigation, we need to get a suitable USB ethernet controller so we can access the device.

There may also be some leverage in using ubiattach…


Comments have been disabled, for more information email kris at switchsystems.co.uk or follow this post in the stanton/gibson forums.