OP-Free - OP-Z firmware liberated

OP-Z
1

OP-Z firmware is open for exploration. OP-FREE

TL:DR

- This site allows you to add new synths and FX without modding your firmware

- It links to research and how to get your own decrypted firmware

  • I’m planning on firmware mods but this opens the doors for others
  • feel free to test, submit new synths and effects, build your own etc.

IF YOU LOAD MULTIPLE SYNTHS AND FX IT CAN TAKE QUITE A WHILE. JUST BE PATIENT.

Also note, this is very experimental. Proceed at your own risk

I didn’t want to release the research without expanding on it a little more. I am not a developer and so the general warnings hold. This is all very untested. It may brick devices.
I am sharing my research, sdk and a site that i’ve built that anyone can build on, submit synths, engines and fx too and in future, firmware mods. Firmware mods remain untested.

In this site and research you will find some synths and FX that can be pushed to your op-z and tested in browser. They don’t sound incredible. I am not a sound designer but they are POC and the SDK now gives clear guidance on how to develop engines for the OP-Z. I have limited time to work on this so feel free to expand.

As stated above, we’ve found a way to find the key and decrypt the firmware. thanks @rastalukee for their method:

Full path:

  1. OP-Z in update mode [battery out, hold screen (i taped mine with electric tape wrap around to have it pushed all the time) on power-up].
  2. Over the serial console send the read-only 0x17 (read SPI flash) and dump bootloader.ldr - the installed copy is already decrypted, no cracking.
  3. Open the dump in Ghidra with a Blackfin+ extension (BF703 is Blackfin+, not classic - build hekar-lab’s Ghidra-BlackFinPlus).
  4. Find the decrypt routine (it logs “key index”); for key_index 0xFF it copies a fixed 32-byte constant from the image - that’s the AES-256 key.
  5. Verify: AES-256-CBC-decrypt the .zfw filename slot at 0x300 (IV at 0x70) → firmware_bin_only_with_bootloader.zip; payload from 0x400 → normal ZIP.

BUT as per the research the firmware can also be extracted unencrypted from any OP-Z device.

Also thank you to @oksami for inspiration

2 Likes