kasploosh.com

Which Bits?

You can access the hidden features of a CZ-1 using a hex editor. You can manually edit the hex data of a sysex file, and then send the edited file to the CZ-1. If you want to try that, you need to know which bytes to edit, and what they all do.

To systematically create all of the samples that are found on the subsequent pages, I made a little Python script that allowed me to manipulate the hex data faster. That saved a lot of time over using a text editor, but was more complicated to set up.

Intro To Casio Sysex Data

This stuff has been written about before, because I've read about it online. However I feel the explanations were not always crystal clear, so I'm going to take another crack at it.

binaryhex
000000000x00
000010000x08
100000000x80
101001000xA4
111111110xFF

Casio sysex is usually done with 8-bit binary data. That means there are eight 1s and 0s in every "word". With 8-bit binary data, there are 256 possibilities (28 = 256).

The hex version of 8-bit binary data would be a pair of hex characters (162 = 256). The table shows some basic examples of binary and hex equivalents.

With some projects, you are either dealing with hex or dealing with binary. But for a Casio Sysex project, it becomes necessary to switch back and forth between the two. For example, you might need to compose a binary string, and then convert that to hex, to match what you are seeing with a hex editor.

Each section of 8 binary bits constitutes one hex byte1.

  • The minimum value for a byte is 00000000, or 0x00.
  • The maximum value for a byte is 11111111, or 0xFF.

The Tricky Part Of Casio Sysex Data

That was the easy part. But Casio does something tricky with their data. Before sending the data, Casio takes each byte, divides it into two parts, pads each part with a zero, and THEN sends it via sysex. Further complicating the issue is that ORDER of each of the new bytes is counter-intuitive. This can only be explained with examples.

For example, lets say the byte in question is 0xA4. This is equivalent to 164 in decimal. Casio splits the byte into two parts, "A" and "4". It pads each part with zero, creating two bytes where there was previously one: 0x0A and 0x04. Next Casio packs the data into the sysex file in the counter-intuitive order: 0x04 0x0A.

Here are some examples:

  • The hex data 0x12 is transmitted as 0x02 0x01.
  • The hex data 0x5C is transmitted as 0x0C 0x05.
  • The hex data 0x08 is transmitted as 0x08 0x00.

Bits That Control The Waveforms, Window Function, And Modulation

There are 16 bits that control WAVE 1, WAVE 2, WINDOW, and MODULATION. Here is my master list of those 16 bits and what each one controls. Each section of the following detail is described in detail on a subesquent page.

binary data description
................ 16 bit data = 16 1s or 0s
000............. WAVE 1 - SAW
001............. WAVE 1 - SQUARE
010............. WAVE 1 - PULSE
011............. WAVE 1 - NULL
100............. WAVE 1 - SINE-PULSE
101............. WAVE 1 - SAW-PULSE
110............. WAVE 1 - MULTI-SINE
111............. WAVE 1 - PULSE2
...000.......... WAVE 2 - SAW
...001.......... WAVE 2 - SQUARE
...010.......... WAVE 2 - PULSE
...011.......... WAVE 2 - NULL
...100.......... WAVE 2 - SINE-PULSE
...101.......... WAVE 2 - SAW-PULSE
...110.......... WAVE 2 - MULTI-SINE
...111.......... WAVE 2 - PULSE2
......1......... Yes, there's a second wave
......0......... No, there's not a second wave
.......000...... WINDOW - NONE
.......001...... WINDOW - SAW
.......010...... WINDOW - TRIANGLE
.......011...... WINDOW - TRAPEZOID
.......100...... WINDOW - PULSE
.......101...... WINDOW - DOUBLESAW
.......110...... WINDOW - DOUBLESAW
(same as 101)
.......111...... WINDOW - DOUBLESAW
(same as 101)
..........000... MODULATION - NO MODULATION
..........001... MODULATION - NO MODULATION
(same as 000)
..........010... MODULATION - RING MODULATION 2
..........011... MODULATION - NOISE MODULATION 1
..........100... MODULATION - RING MODULATION 1
..........101... MODULATION - RING MODULATION 1
(same as 100)
..........110... MODULATION - RING MODULATION 3
..........111... MODULATION - NOISE MODULATION 2
.............0.. MODULATION - NORMAL
Modulation behaves normally, mixing the modulated and non-modulated output.
.............1.. MODULATION - SPECIAL
LINE 1 is muted, and only the product of modulation (LINE 1' or LINE 2') is sent out.
..............XX These bits seem to have no effect on anything

Key for this table

This option is only available through sysex.

How Do I Make The CZ-1 Do What I Want?

First, create a bit sequence to your taste using the table above. Let's say you want the first wave to be SINE-PULSE, the second wave to be PULSE, run it through the DOUBLESAW window, and for it to be RING modulated. You would assemble the following bit sequence:

1000101101100000 looks intimidating!
1000101101100000 WAVE 1 - SINE-PULSE
1000101101100000 WAVE 2 - PULSE
1000101101100000 Yes, there's a second wave
1000101101100000 WINDOW - DOUBLESAW
1000101101100000 MODULATION - RING MODULATION 1
1000101101100000 MODULATION - NORMAL
1000101101100000 These bits seem to have no effect on anything

Now that you have the bit sequence, you need to convert it into hex data that can be used in a sysex file. The following is a shortcut way to do it.

10001011 01100000 Divide the 16-bit sequence into two 8-bit sequences.
0x8B 0x60 Convert each of the 8-bit sequences into its hex byte equivalent.
0x0B 0x08 0x00 0x06 Split each byte, pad it with zero, and reverse it as explained above.

The result is a four byte sequence 0x0B 0x08 0x00 0x06. You can use a hex editor to insert this sequence into any sysex file if you know where to put it.

How Do I Edit The Sysex File?

The easiest way is to open a sysex file with a hex editor, find the four bytes that control the waveforms and modulation, and replace them with bytes of your choice. Step by step:

  1. Open a sysex file with a hex editor.
  2. 0xF0 begins a sysex message, and 0xF7 ends a sysex message
  3. Make sure you're editing a TIMBRE DATA sysex message. For a CZ-1 this message will be 296 bytes long, from 0xF0 to 0xF7. For a CZ-101 et al this message will be 264 bytes long, from 0xF0 to 0xF7.
  4. The 0xF0 that start a message is BYTE 0. Count up through all the bytes until you find bytes 35, 36, 37, and 38.
  5. Replace bytes 35, 36, 37, and 38 with whatever you please. This alters the waveforms, window function, and modulation for LINE 1.
  6. Continue counting through the message until you get to bytes 149, 150, 151, and 152.
  7. Replace bytes 149, 150, 151, and 152 with whatever you please. This alters the waveforms and window function for LINE 2. Note that LINE 2 does not carry any modulation information.

Footnotes

  1. Note that it is sometimes useful to think of Casio Sysex data as being a string of binary digits greater than 8 bits or less than 8 bits. The Casio engineers have the data crammed in to the Sysex messages. When we break the data back apart to study it, we wind up with some segments that are not in perfect 8-bit chunks.
11809.74600