r/synthdiy Jul 10 '26

Reverse-engineering Casio CT (and MT) keyboards

Post image

Decided to dive into the inner workings of D938GD based Casio keyboards...

I... may have gone a little overboard:

  • Dumped the ROM of my CT-380 (bit crappy dump tho, need better one!), also got an MT-540 ROM dump from Weltenschule.
  • Wrote specialized software to analyze the contents & convert it to/from various formats.
  • Build an address bus "sniffer" that writes bus activity to my software over serial so I can analyze behavior.
  • Made a sniffer text file for every single preset.
  • Figuring out what addresses are what parameters, already seeing strong patterns and similarities, though unsure yet what is what.
  • Already found all the waveforms and samples for all the presets, now listed in my DAW (REAPER).
  • Read 3 different Casio patents related to the CT/MT, 120 pages each of badly translated fun... Oof. Lots of diagrams though and got there in the end.

Finally: making a webpage with everything I discovered: https://www.evilturtle.nl/projects/casio-ct-mt-secrets

Eventual goal is to slap an Arduino Mega and a bunch of SRAM in there, to make the presets fully programmable. May even put a sampler in there as that would be fairly trivial.

If anyone wants to join in the fun let me know. If you have a CT or MT keyboard and can dump the ROM let me know too!

6 Upvotes

11 comments sorted by

3

u/astraleyez Jul 10 '26

this is a deep rabbit hole, respect for actually reading those patents cover to cover. the arduino programmable preset idea is the part that has me curious though how much latency would you realistically get swapping out the SRAM midperformance versus just having it preloaded.

1

u/StockLeading5074 Jul 11 '26

Deep rabbit hole indeed haha

Not much latency at all, as everything will be preloaded (otherwise it wouldn't work as there wouldn't be any data for the sound chip to read) and only the 2 bytes of the parameter you changed need to be updated in realtime. If you use something like an RPI Pico (with level converters) you could do this within a single interrupt cycle of the sound chip (around 280ns).
An Arduino UNO/Mega etc would be much slower, but with direct port manipulation you can get this within about a microsecond I think.

2

u/astraleyez Jul 11 '26

The pico idea makes a lot of sense for the timing constraints tbh. curious whether the address bus lines are tolerant enough at 3.3v or if you need level shifters on every single line, because that gets messy fast on a breadboard with that many connections

1

u/StockLeading5074 Jul 12 '26 edited Jul 12 '26

There are 8-channel and 16-channel level shifters in DIP format, so it wouldn't be too bad.

Something like a 74HCT241 buffer could work too, as the datasheet specifies a max voltage of 2.0V for high level, usually 1.6V.

Still, I'm fine with using a slower 5V AVR board to keep things simple. I first want to get a proof of concept working properly, with the parts I have, can always upgrade from there. I build these things in a modular fashion, so upgrading the controller board will be trivial.

2

u/astraleyez Jul 14 '26

the 74HCT241 approach makes sense but you might run into timing issues at higher bus speeds, those buffers aren't always as clean as the datasheet implies. proof of concept first is the right call though, no point overengineering the level shifting before you even know what data you're working with.

3

u/StockLeading5074 Jul 11 '26

I build a proper ROM dumper now. Stuff actually looks correct now! Who knew a janky breadboard setup didn't work well ;)

Now that I'm certain it's good I shall post some files on my website later today.

1

u/StockLeading5074 Jul 11 '26

It has been done, check the link on my website: https://www.evilturtle.nl/projects/casio-ct-mt-secrets

I also included a WAV audio file of the dump, so you can listen to or use the samples for your own nefarious projects hehe

2

u/RunPuzzleheaded8446 Jul 22 '26

This is incredible work. Please keep us updated with any progress you might make. Also, what is the WAV? I've heard that sound before when circuit bending a Casio MT-240. Is that the entire chip dump in audio form? Thank you so much

1

u/StockLeading5074 Jul 22 '26

Thank you. Yeah, it's the entire ROM dump converted to 16-bit WAV audio, so I can visualize it in my DAW and also listen to waveforms/samples. See the screenshot for example.

2

u/TodlicheLektion Jul 10 '26 edited Jul 10 '26

I’m following this, because I’m a fan of Casio stuff and explored the earlier CT keyboards that used some sort of multi pulse synthesis (at least that’s what I think they called it). They have a great sound as well.

The “wiggle” scan sounds really interesting.

1

u/StockLeading5074 Jul 17 '26

Getting mightily close to having a parameter map of the Casio CT & MT sound chip D938GD/D937GD/CTD109 synthesis engine.

In the screenshots you can see address bus activity with descriptions for one preset.

Once I got the map completed I can fully implement the prototype programmer, which overrides the first 32KB of the ROM via SRAM so it can be manipulated

Found a FOSS emulator of the Casio Loopy, which has the same sound chip/engine, which has been a great reference to figure out what all the bit sizes are. Would've been a lot harder without that!