A tale of two 9's

[bean]

On the left we have the EHX Synth 9, PCB rev.E and on the right the B9, PCB rev.B.

Looks like the two boards are nearly identical with the rev.E having possibly additional decoupling caps. Also, the Rev.E has a dry mute option. Both have Macronix MX25L6445E flash memory chips (on the left it's the one with the purple dot). https://datasheetspdf.com/pdf-file/927690/MACRONIX/25l6445E/1

You see where I'm going with this? I don't know too much about digital but I guess it's safe to assume there's going to be some kind of code protection on the memory to prevent copying. But, I'm wondering about removing both and setting up a selector switch in a single unit for hot swapping (or, at worst, swap with power cycling).

[imJonWain]

Maybe?  I'm sure someone more knowledgeable then I will chime in but it's gonna depend.  I doubt hot swapping would be possible. 

What's U7?  and U1?

[bluebunny]

This is way beyond my pay grade, Brian (I did some VLSI stuff for my degree, but that was soooo last century...), but that chip select pin looks like a good way to choose between two chips?  Dunno whether those I/O pins sit on something that constitutes a "bus", but assuming the un-select makes them go high-impedance, then I would make a wild guess and say piggy-back two chips.

[bean]

I did a little more reading and it looks like the chip select pin can be used in slave configurations. So, you set the CS pin to a high impedance output and it basically turns it off, if I read that correctly. So, I'm thinking rather than a selector switch maybe a PIC type control which mutes the effect output, does the chip swap and then cycles the power all in one go via a pushbutton momentary. I'll need to spend a bit more time to see if that's "in my pay-grade" as you put it

[bluebunny]

Does the power need to be cycled?  Are you talking about the flash chip?

[Digital Larry]

Does the power need to be cycled?  Are you talking about the flash chip?

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

[bean]

Does the power need to be cycled?  Are you talking about the flash chip?

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

Thanks. I think that is probably the easiest thing to do. Do you think I should include a pull-up resistor for each CS pin or just connect straight to (assuming) 3.3v?
I'll report back if I make any progress.

[Digital Larry]

Use pullup resistors and switch to ground.

[pruttelherrie]

How would the code protection work? The bits need to get sent over the line, so I would think the flash is readable?
Unless there's some kind of encryption in place, with decryption on the DSP.

[pruttelherrie]

To reply to myself:

Unless there's some kind of encryption in place, with decryption on the DSP.

In that case, just copying encrypted code would work. So to be able to fully protect the data, the DSP needs to send a key, with which the memchip encrypts it data.
But as far as I can tell from the dtasheet linked, the data protection concerns accidental overwrites, and ways to make it read-only.
So it looks like it might be copy-able?

[hgamal]

In that case, just copying encrypted code would work. So to be able to fully protect the data, the DSP needs to send a key, with which the memchip encrypts it data.
But as far as I can tell from the dtasheet linked, the data protection concerns accidental overwrites, and ways to make it read-only.
So it looks like it might be copy-able?

The Analog Device DSP can be booted in some ways. Using internal ROM code or just by download an external flash ram.

If DSP uses the internal ROM, which must be ordered from Analog Devices with that, the ROM code can decode the data inside the external flash ram and load it as DSP code.

If this ROM is not used, it is very probable that the DSP just downloads the flash and runs it as a DSP code program.

If the code is encrypted and those two products use the same key, they can be switched.

[hgamal]

Maybe the DSP code is not encrypted after all:

https://www.musicradar.com/news/electro-harmonix-wins-copyright-infringement-case-against-mooer

Maybe this pedal can be cloned with some effort. Looking at its construction seen to be just a DSP, boot flash, and CODEC. But I have not seen the other side of the board and if it has other boards.

[pruttelherrie]

It has no other boards; check my pictures of the guts at https://imgur.com/gallery/W1GQnxx
or the thread about this pedal here https://www.diystompboxes.com/smfforum/index.php?topic=124047.0

I'm not actually interested in cloning, but merging all pedals into one, with MIDI control, would save a LOT of board space!

[pruttelherrie]

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

Thanks. I think that is probably the easiest thing to do. Do you think I should include a pull-up resistor for each CS pin or just connect straight to (assuming) 3.3v?
I'll report back if I make any progress.

Any news on this?