So, you too want to explore the Yamaha QY100’s code? Here’s how you can do it…

Lets Explore Together

As you know, QY100 Explorer is dedicated to uncovering hidden content and overcoming the devices built-in limitations. This project is a huge undertaking and there is still so much left to be discovered. With that said, I want to encourage others to undertake their own exploration of the code. The more eyes on the code, the faster we can work towards revealing all of the QY100’s secrets.

What you need:

  1. Yamaha QY100 Music Sequencer
  2. Smart Media Card (this is the card that inserts into the slot on the side of the QY100)
  3. USB Card Reader (one that has a Smart Media Card slot)
  4. Computer
    • HxD (or another hexadecimal editing program)

Which Code?

First, I want to point out that there are two types of code being handled by the Yamaha QY100:

Internal Code – The system software or firmware that is stored on the Yamaha QY100.

We will not be touching the internal code. This is a sure-fire way to brick the Yamaha QY100 if something is done incorrectly.

External Code – The code which is stored externally on a Smart Media Card. These files consist of the filetypes: .Q1P (the styles file for storing data in Pattern Mode), .Q1S (the song file for storing data in Song Mode), and .Q1A (the ‘all’ file for storing combined data from both modes in a single file).

The external code is much safer to manipulate. Mistakes in the external code can still cause the QY100 to crash but does not damage the internal code, and can be fixed by powering down the device.

For this reason our exploration will be focused on the external code only.

Background

Before getting into analyzing the code, a quick review of binary, hexadecimal, and ASCII is in order.

Binary – Is the foundational number system used by computers, represented using two symbols: 0 and 1. Each digit in a binary number is called a bit. Computers process data in binary because it aligns with their physical design, where circuits are either on (1) or off (0).

Hexadecimal (hex) – Is a base-16 number system that uses sixteen symbols: 0-9 for values 0-9, and A-F for values 10-15. Binary can be efficiently grouped into sets of four bits to convert into hexadecimal. For example, the binary number 1010 1111 can be grouped as 1010 (A in hex) and 1111 (F in hex), resulting in the hexadecimal representation AF.

ASCII (American Standard Code for Information Interchange) – Is a character encoding standard where each character (like letters, numbers, and symbols) is represented by a unique number. ASCII values are typically shown in hexadecimal or decimal. For instance, the binary number 01000001 corresponds to the decimal number 65, which is represented as 41 in hexadecimal, and this matches the ASCII character ‘A’.

Code Analysis

Realize that binary can be converted to hexadecimal, and that hex value can be mapped to an ASCII character. This concept is essential for analyzing the Yamaha QY100’s filetypes: .Q1P, .Q1S, and .Q1A.

01101100 → 6C (in hexadecimal) → ‘l’ (in ASCII)

While there are no programs that can open the .Q1P, .Q1S, and .Q1A filetypes, they can still be opened by a hex editor such a HXD where they can be viewed as hexadecimal or even ASCII values. When viewed in this way, it is much easier to interpret patterns and uncover secrets.

Case Study – Analyzing the Code

This example is intended to illustrate how hidden content/features can be found in the .Q1P filetype.

Step 1 – On the QY100 in Pattern Mode, I have saved an untouched .Q1P file (I haven’t added any patterns, altered any instruments, or changed the tempo. Everything remains untouched). This file wile be used as a baseline to compare future changes against.

Step 2 – Next I create a second .Q1P file by making a single alteration to the baseline file. The change I have made is I’ve changed the Chord from a “CM7 Chord” to a “CM7(9) Chord.”

By comparing how the code differs between these two files, we will be able to understand which bytes control the Chord.

Step 3 – Connect the USB card reader to your computer.

Step 4 – Insert the Smart Media Card into the slot on your USB card reader (hooked to your computer).

Step 5 – Open the .Q1P files in HxD (or another hex editor). When comparing the two files you will notice that the highlighted byte differs between the files.

The baseline file shows a value of 00 which represents a CM7 Chord. While the altered file shows a value of 04 which represents a CM7(9) Chord.

Conclusion – With this analysis, we’ve determined which byte affect the Chord. We can now inject any hexadecimal from 00 to FF into this spot, save the .Q1P file, and boot it up in the QY100 to observe how it behaves.

Through this method I was able to find many hidden chords that can be loaded into the Yamaha QY100 by using hexadecimal inputs such as: 27, 70, and FF.

I hope this guide has armed you with tools and techniques needed to make your own findings on the QY100. The analysis is not always so straight forward as some parameters are tied to multiple bytes. This sort of analysis is quite tedious though with more people investigating the code I’m hopeful we can break new ground.

If you have any questions or would like to combine efforts in analyzing the code, do reach out!