Replies: 14 comments 15 replies
-
|
Just did the capture. Hope I did it well. I send it to you by email since Github refuse to upload it. |
Beta Was this translation helpful? Give feedback.
-
|
When you'll confirm the capture is ok, can I reenable csrutil? |
Beta Was this translation helpful? Give feedback.
-
|
For re-enable SIP; Boot into recovery-mode, run |
Beta Was this translation helpful? Give feedback.
-
|
This is what an MK2 capture looks like displaying payload of packets sent to the device from Komplete Kontrol:
|
Beta Was this translation helpful? Give feedback.
-
|
I would still be very interested to find people willing to invest a bit into helping reversing the MK3 controllers. Please ping me! |
Beta Was this translation helpful? Give feedback.
-
|
I would be happy to help. As soon as I can but it won’t be before sunday at least. |
Beta Was this translation helpful? Give feedback.
-
|
We could aim for Monday, next week - if that suited you. :) -- Oh, happy new year dear Nicolas! |
Beta Was this translation helpful? Give feedback.
-
|
Could maybe do this it will depend of the unexpected things that will happen at work tomorrow :) Do you have any preferred time slot? |
Beta Was this translation helpful? Give feedback.
-
|
One more note here: it is imperative that the controller is in its default mode. Basically freshly switched on without having enabled anything extra. You could achieve that by disconnecting it from power and reconnecting it. Only then, start KompleteKontrol. The display of your MK3 controller should now show the graphics that KompleteKontrol show by default -- NOT a MIDI symbol. |
Beta Was this translation helpful? Give feedback.
-
Random observations on the Komplete Kontrol MK3 ProtocolPackets are headed by the payload sizeThe packets are headed by their payload size encoded into four byte little endian integers. There is a frequent signal - like a keep-alive?A packet is sent on an 8 seconds interval by the Komplete Kontrol macOS app (aka out); The packet payload is 6 bytes long as encoded in the header. The payload is a constant |
Beta Was this translation helpful? Give feedback.
-
more digging for lightguide dataOpen Komplete Kontrol - no instrument loaded, default as it opens!
Open WireShark - start capturing the interface of interest! Back into Komplete Kontrol, load the
It should initialise the controller lightguide showing some coloured keys. That is the data we want to capture and should now see in WireShark. It will also initialise the screen with graphics, thus be very interesting as well. Send the capture to my email; toenshoff@me.com |
Beta Was this translation helpful? Give feedback.
-
Hi @tillt. Just sent the capture into your inbox. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry but it doesn't seems to make any difference. Light guides doesn't trigger. It stay as it was after init process. I can trigger notes but the light guides test mode don't do anything |
Beta Was this translation helpful? Give feedback.
-
|
can I capture something else to help you ? Maybe when I trigger a note that light up the guide? |
Beta Was this translation helpful? Give feedback.
-
|
May be a trail or not but in the first version you gave me, the touch strip was displaying the note played. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @Bounga - thank you so much for your patience and trying out all my attempts. Right now I am quite confused on why nothing seems to go into the right direction. Actually, the fact that the touch strip did react on the notes makes me even more confused cause KK does not seem to use that "primitive" way of addressing the device at all from what I see in the captures. It sounds like the MK3 devices are somewhat compatible with that "old way" but changed slightly how it worked. Just, KK doesn't try that at all it seems. I would love to keep on fuzzing but atm I need to invest a bit of time into me career -- not so fun fact, I am losing my job due to the company I work for ceasing operation and need to find a replacement asap. The moment I have new spirit and ideas, I will weave you in -- thanks for all your help! |
Beta Was this translation helpful? Give feedback.
-
|
Oh man… I'm so sorry. Keep time for yourself. There is no urgency at all. Thanks a lot for your time. If it's ok for you, let's us know if you find a new job. Hope you're doing well despite of that. |
Beta Was this translation helpful? Give feedback.
-
It loaded 53rd Ave in my case. 
|
Beta Was this translation helpful? Give feedback.
-
|
Alternatively to the capture based reversing, I have now started another desperate attempt in getting some control over the MK3 devices. See #34 for more. |
Beta Was this translation helpful? Give feedback.
-
|
Gonna try this today |
Beta Was this translation helpful? Give feedback.
-
|
This is what @Bounga observed and described in #18 (comment). I am quoting his great work here for getting an idea on our progress within this thread for posterity. NOTE(tillt): The below was run after the MK1 & MK2 init command string Buttons on the upper half of the keyboard are enlightened:
as you can see touchstrip, wheels and buttons at the left are off. Lightguides too. Then this: turns on wheels, touchstrip and buttons from the left side.
Then this: turns on lightguides:
|
Beta Was this translation helpful? Give feedback.
-
|
For the fun of it, I started looking at the firmware of the device itself. Some quick notes on that process for the interested... Downloaded the MK3 firmware updater from the NI site. Extracted the That allowed me to confirm that the correct product ID for the S49MK3 indeed is |
Beta Was this translation helpful? Give feedback.
-
|
well done! |
Beta Was this translation helpful? Give feedback.
-
Reverse Engineering the NI Kontrol MK3 Controller
Get WireShark in its latest version from https://www.wireshark.org.
Boot into Recovery-Mode to disable System Integrity Protection
Disable SIP and reboot:
Find out which interfaces we got available.
The USB ports we want to capture are named
XHCnnnn. On my Mac, the numbers are 0-3 but your milage may vary.Example output for an Apple Silicon Mac with 4 USB ports. For getting such list you could use
tcpdump;Make sure the NI Kontrol MK3 Controller is the only thing connected to one of your USB ports on the machine. Do not use any USB-HUBs or alike, we want direct access. It does not matter if other USB devices are connected, as long as those are using a different port.
Now up all the USB interfaces to get them visible in WireShark;
Open WireShark and check the
Capturesection. In this example, only a single USB port shows traffic on this dashboard. Given that we have not interacted with the NI Kontrol device, it shouldn't be the interesting interface.Now push a few keys on your Kontrol. We can expect a some noise on the related interface. In my case, it is a Kontrol MK2 on
XHC2. The Capture section now shows a recent spike in traffic onXHC2.Click on the interface that showed noise when you pushed the keys. It should not show any data - just silence.
Now open the Komplete Kontrol application on your Mac.
That should create a bunch of entries within WireShark;

Above we see the first thing sent by Komplete Kontrol towards my Komplete Kontrol MK2 controller is the init string
a0 00 00(the last three bytes displayed). This may be entirely different on your MK3 device but we will now learn how different. :DSave your session by quitting WireShark, send me that file!
Beta Was this translation helpful? Give feedback.
All reactions