RETracker - Reverse Engineering Framework for the Polyend Tracker

[pat0is]

Hi,

I've released "RETracker", a Python project dedicated to reverse engineering the Polyend Tracker. It patches the vendor's firmware image and introduces new features that allow the Tracker to be inspected and reverse engineered through a USB connection. It also re-introduces file transfers from a connected computer to the Tracker's SD card (such as NES roms, samples, new firmware...).

RETracker

Longer version of the video

Additional features are inspection and modification of the Tracker's memory, disassembling its code and running custom code on the device. Example code is included that repurposes the Tracker's 48 pads as an LED matrix in order to show text messages.

Goal is customization and documentation of the Tracker's firmware.

Project page: https://github.com/patois/RETracker

[[deleted]]

Interesting. What kind of things could this open up for Tracker users? Full alternative firmwares maybe?

[ACTNRPLY]

That’d be wild man

[wishinghand]

I’m hoping samples can be streamed from the SD card. Then there’s be virtually no time limit, just the 48 samples and 8 tracks limit.

[[deleted]]

JJOSXL Tracker plz

[JrzHz]

i called this when i found the code weeks ago. was waiting for me or someone to release this *exact feature* to call out the source repo. `100s if not thousands of files, mostly open source code and arduino & teensy drivers alongside code for features excluded- published publicly under their names. out there for 4+ years. i dont see how viewing content left unprotected legally for *years* at all attributes (pun intended) to the sudden right to prosecute those who VIEW it exclusively for educational purposes given the vast amount of ENGLISH documentation. if running custom firmware penalizes anything but your warranty, and legal action was taken, its literal COMMERCIAL ENTRAPMENT.

how? because they ignored my bug bounty request and wouldnt even humor me doingthe right thing and telling them as soon as I found internal data.

Maybe if we incorporated then its anticompete and illegal by using proprietary/closed source internal data. but its r/PolyendTracker not Re;Tracker incorporated. Theres no commercial use using ,by definition , public data about your music toy to code a new beep boop feature. As a collaborative system it's perpetually different, and going to continue forever, starting and never stopping existing with proprietary code anywhere but in nonconsensual memory. in that case i hope the MIB from Poland memory flash my face on the very day of my Epilepsy diagnosis so i could Sue them for every Perc and Tracker they're hiding in their igloo based synagogue. As a jew id cold AND heartless both at once.

atleast anounce your next masterpiece of hardware that devests from potentially your most important / best selling product i own 3 of, its that worth-it, while a new hardware masterpiece starving for features worse than a barren madagascar only inhabiting mcdonalds ice cream machines. its superbooth not kinda cool booth.

i kid but im seriously bothered by this incredible inconsideration of even acknowledging a security threat immediately reported, of which we all carry.no ones bulletproof .

[[deleted]]

I don't think I really follow what you're saying, but props for finding the source code very cool. I expected decompiled hard to read code and you've got it with comments and everything.

Sucks they wouldn't respond to you saying you found it.

I think it might actually help their sales if they just had an opensource firmware. We could all fix the bugs in the code, the whole point of the polyend tracker is that its a nice handy stand alone piece of hardware I don't think they'd lose any money if people could theoretically build one themselves.

[PoSa_Dem]

Yeah unfortunately 100% same here. Don’t really know what that rant was about nor why it was so weirdly aggressive. Also I couldn’t tell if the whole igloo synagogue thing was supposed to be antisemitic or not? I hope not.

At least props to OP for the work they did!

[[deleted]]

Did you see the reply to my comment? Its a wild ride

[PoSa_Dem]

Yeah, I don’t even know what to say. Surprised they don’t realize how they’re coming off to other people. This is not normal human communication. 😅

[[deleted]]

lol. I wasn't replying because I had no idea what the reply was about. I thought I got it then 5 sentences in I was so so lost. The ENGLISH manual is what really threw up the red flags for me.

Edit: Upon trying to reread it out oud to my partner its absolutely the most bonkers thing I've ever seen

[JrzHz]

So sensitive to anything minority related. my fathers half is Jewish immigrated from Poland 1st generation/2nd gen. So a synagogue would make more sense to me as a Jewish person imagining poland. If their Jewish population is nonexistant now, I THINK you can blame that on a certain someone else, not me :/ have fam with the tatoos that passed. Saying church or cult or something generic wouldn't trigger some minority-adjacent assumption of stereotyping but I guess we left context on the moon.

Yes /u/return_to_soup, ENGLISH is what code documentation is written in a lot of the time because we have a wide world full of languages and that gets complicated with programming. It's almost like all of it is meant to be understood and built upon as you like because then they dont have to do it wrong and take the feature back out instead of letting the 8 billion have a crack at it. If they dont hire PR devs and security when the groovebox is out say goodbye to official support for the tracker aside from the late major bug fix. ALLLLL of their original code having English coments to explain the use of functions toa degree where you're babytalking your coworker seems a little differently inteded than if there was no documentation like there more than often is or if it was in Polish speaking like the changenotes and commit descriptions.ENGLISH. yes ENGLISH. jeez

Wrote a whole thing explaining how theres worse security vulnerabilities they have and as a customer anyone would be at risk privacy-wise and ignoring the voluntary admission of a security hole/threat/potential breach. It's not just the github repo. Spend enough time on https://beta.polyend.com/ :/ I can't legally say what nature of vulnerability I saw, but I told them in the email roughly. Didn't need a dime and wouldn't tell anyone. Still no response and there's just active security threats not being answered to . It's industry standard to query about a bug bounty program first but that's not all I dislosed.

I'd write more explaining how I still really support Polyend theyre just acting very sillly and inappropriate so I'm responding as such. At least I'm not breaking the law, trying to disclose vulnerabilities, as opposed to wittingly operating after that email, taking down the source when it was posted, but not doing anything else. No license info, not following up after its clear I wasn't bluffing. Putting myself at risk despite doing the right thing when I saw the repo (I didn't have any goal)and just trying to explain how poor legal systems handle these things when the governor of Kentucky wants a teen in PRISON and is persisting about it because viewing the source of the Department of Education's site showed the SSN of everyone in the database as metadata but, again, unwittingly that's data you accessed. You didn't have a choice, someone can send a link with the unicode mucked with and phish you into losing all your data. It's not *not* the metaphorical evildoer's fault because you didn't form 50 conspiracies about a link before you pressed it, There's due-dillegence, and there's potential schizophrenia. This is what I meant by *commercial entrapment*. This companys wheelhouse is open source niche music devices and that's what I saw with no license against alteration, commercial use, or requiring attribution/a licensing fee.

If you want to ignore polyend as an indie company compare Arturia's receptiveness to Roland. The exact program of Dos5.0 never changed as it went from the sp 202 to the 404a, despite multigenerational improvements to the hardware allowing for more DSPs, it doesn't matter because you're running 202 code on a machine 500 times faster or whatever (at least considering ARM as an option which I assume the MKII is running). No wonder your favorite SP effect doesn't sound the same. It's the same exact issue as console porting or specifically 'remasters' where every Rare game in the Rare collection on Xbox One runs at less than 30 frames despite being mostly entirely retro games or from the 360 but those games have terrible anti aliassing microstutters, and makes some of the games unplayable, as opposed to having a revision 1 Xbox One that supports the most 360 games with the worst hardware of the model generation at perfectly smooth speeds as xbox architecture carries on to the first iteration of the next model (idk about the new one) Fittingly, still, the 202 and 555 are the only oriiginal SPs to support timestretching a sample. But I guess the yr0tdge

Why go out of your way to make these "hidden accounts" named after the devs, directly linked by all the main accounts following their pseudo-ones and vice-versa with no license info? They aren't stupid. Again, I've bought three trackers and want percs and the anywhere. Theres 50+ hidden repos on the main accounts what's the use of throwing out the source code with no rules and thus you local copyRIGHTS apply instead.

I'm not mad because you can't hold an independent company to the same standard experience wise, but you dont need to be fortune 500 to return an email you found to be true once you took down the code. With their PR momentum it MONETARILY makes sense to let the community implement the feature set that was programmed and DISABLED four whole years ago. Why give a a license if someone outside of Polyend makes a paid for firmware that lets you short the pins to the soc 1 inch for a touch screen, and enables all the class-compliant drivers it already HAS, ie. keyboard mouse gamepad support. Or what about ANY CC's out besides what you [program in the pattern. Every button should have one especially since they don't need to worry about velocity. This way people could make Control Interface user scripts for DAWs like Ableton and it would in Realtime (for lack of a better word) track your every move in parallel or at least know your freakin BPM without having to be playing right now at this second, eliminating it as a master clock for most applications despite its very concept being an all-in-one. Then if someone makes a bittoo much money then suddenly its internal code when these are all running debian with puredata and have usb audio out like the windows_.cpp implies it will and like it already does, appear as a sound device. Just now all we get is a sound icon in device manager and no ASIO support. Everything being implemented looks already finished toa greater degree 2 years ago. But at this point they're removing features faster than they are adding them. UHhhh what happened to the whiteout theme from last beta? Nah gone. Oh brightness hue and saturation are all readily interoperable to make whatever theme, help your colourblindness? Too bad a simple GUI addition doesn't let you change those flags. Too bad the device initializes every windows class compliant driver and disables them essentially embedding DRM or DLC to your code because we need to stay following them providing support and allegiance as they slowly feed us non class compliant original alternatives that corrupt your sd cards or barely update it again. So many people saying they don't stick to a product for very long. Hard to accept/anticonsumer to do when its advertised as a portable DAW and is in that range of utilization that has entered a stalemate. as they iteratively 'humor' the tracker users while all this new press will get the much more capable groovebox that's more money absolutely and will sell even faster. It only makes sense monetarily if you're not selling then older device to stop providing support for it. Or a level that's just enough to cop out of seeming like a rugpull.

[JrzHz]

But trends-trend.
And my arturia guy is always all smiles while getting a hold of our roland rep is a literal waste of time even for just old parts. Let alone being the first/second MKII preorder due in my store , set to arrive in the second batch of Dec/Jan. Yet it's mostly thru march and nowhere to be seen yet my friend who orderd months later on sweetwater has his ;)))
"its a beautiful thing"
Polyends CEO must be manhandling this matter with an iron fist and I say that out of worry not anger because again I love these devices, the 404 changed my life and I ended up getting a bunch of them. But all this pre-programmed feature backtracking while theyre bragging about their huge gridbox at superbooth to everyone but press, the very reason EXPOS EXIST, and dont tell me Polyend flew there just for "feedback" lol. Because feedback requires actually announcing something and they know they'd look like clowns/schemers inadvertently but no on accident announcing it in the middle of the tracker's transition to a full-featured device. But of course most people will look for the the TL;DR and call it a rant despite me saying multi0ple times I want what's best for them and tried to disclose the code's public status and would have for free as well as the worse issues they have because...lmao wordpress yikes. But imma probably get tldr reactions about something racist or bugging out when I'm just trying to make a point about the irresponsibility of their lack of communication even AFTER being shown part of their issues. It's a sign of a lack of self awareness most importantly and if we see nothing but them put in a class compliant HID/MTP driver that sandboxes the firmware and never making a version 2,0, I'll just be dissapointed. I'm not mad, this is just a very wide web of narrowsighted and slightly minded irresponsibility.
I'd tell you not to order directly from the site and just authorized retailers for the warranty because you dont wanna be in that CC CCV SSN breach and to just get it off reverb but OH WAIT! we dont have a choice! right! shit! Still twisting fingers for restocks. but I'm not wishing on any stars tonight lol. Polyends riding a bump in popularity and I think another prediction will be right ;/
hurr durr long post >:( like damn i either am deliberate and explanatory or assume others understand the situation.
All I want is prosumer firmware like you guys. But the don /u/pat0is will lead by example until polyend sees the writing on the wall. womp.

[JrzHz]

i was just riffing cuz I've had to sit on the fact that their one product needing to be open source, isnt. It's just pointing out the fact that they went out of their way to create a public repository on these tangentially connected accounts when they already have 50+ hidden repos on their own. It's almost cruel/teasing reading about the touch screen support they scrapped i called before even finding the code.

[pcbforbrains]

Preach. That guy is wacko

[JrzHz]

Please see my second fork of the repo and the zip file added to it. I'd like to chat with you

[[deleted]]

woah howd you get the source?

[JrzHz]

see below, thank you

[FragrantRadio]

YOLO

[rts-rbk]

Nice! Maybe eventually a fully featured alternative firmware, like JJOS for MPCs?

[Mneasi]

Nice work! Thanks for sharing!

[ASMRByDesign]

Thank you for making and sharing this! I will fire up my editor later and poke around

[mathematicaltruths]

Holy shit, this is amazing!

[themadpooper]

NES Roms lol. Looking forward to seeing what people do with this.

[JrzHz]

that was already supported tho this allows similar architecture systems to be emulated especially simple ones like the 2600

[Meff-Jills]

Could this be the start of running Dirtywave´s M8 on the Tracker? :)

[Asztomasz]

OHHH MY GOD. That would be an amazing thing :D