Remote code execution via MIDI messages

In January 2025, the author details their journey of reverse-engineering a Yamaha PSR-E433 synth. They discovered an unconventional method using MIDI messages to prompt their synth to play ‘Bad Apple’ on its LCD screen. Delving into the internals, they unearthed a powerful chip identified as a ‘YAMAHA SWL01U’, speculated to contain a SuperH CPU core. Through persistent testing via UART interfaces and JTAG connections, they uncovered the ARM7TDMI core within the chip and successfully dumped the firmware. The process involved meticulous examination with tools like Ghidra to dissect the firmware, ultimately leading to the discovery of a key subsystem known as The Shell, integral to the synth’s unique functions.

https://psi3.ru/blog/swl01u/

To top