Let's Decode a VST | Hacker News Reader

Let's Decode a VST

adamkulidjian.com

50 pointsakully33 comments

This is the format of patch files for Propellerhead's Scream 4. It is just a serialization format for the settings of the knobs. Not exactly the same as "decoding a VST".

Pretty unusable on mobile - my phone keeps trying to either start a phone call to the “number” of the byte sequence I clicked on, or it tells me (repeatedly) that the site has been blocked from making calls, after I have canceled out a few times.

Must be an iPhone thing. No problem on Pixel 3XL

Yeah, iOS will try to automatically detect phone numbers in web views. It can be annoying sometimes if the web page author doesn’t take that into consideration.

  <meta name="format-detection" content="telephone=no">

And yet in some crazy parallel universe, content authors choose to tag telephone numbers as such to make them clickable, rather than having to tell a browser not to incorrectly interpret text.

A crazy parallel universe where iPhone came before the web and could shape it from its inception, surely.

RFC-5341 defines "the tel URI for telephone numbers" and is dated December 2004. The first iPhone was released June 2007, so there was already a way of marking phone numbers well before day one.

Surely apple is to blame for it though.

Interesting. On Firefox on PC I only have one page; Cracking the Code lets me hover over bytes but I expected something more of HN link. What VSTs are? How they reverse engineered? Other uses of either technique?

This is literally a translation for specific obscure file format ¯\_(ツ)_/¯

thanks for letting me know. weird about the phone calls. I'll check this out on mobile

ok fixed

fixed

> = 0072 + 2 * (filenameLength // 2)

I'm having a hard time understanding what is meant by this. Particularly when 114 is the size of the patch after the 8 header bytes. The description also seems to get the word size wrong by treating the first 4 bytes as a NULL-terminated string.

A 4-byte ID and a 4-byte big-endian length is almost universal for audio data. There's even a Python module[1] for it. And it's often nested, so within a chunk of data will be smaller chunks described the same way.

The more complete and easier to analyze description of this patch would look like:

    "FORM" (114)
      "PTCH"
      "CAT " (4)
        "REFS"
      "DESC" (35)
        [BC 01 03 00 00 FF] -- ?
        (2) "17" -- File name
        (19) "Scream 4 Distortion" -- Patch name
      "PARM" (37)
        [BC 01] -- Another BC01
        (15) -- Number of params that follow
        [01 01]
        [02 3E]
        [03 00]
        [04 3E]
        [05 1E]
        [06 00]
        [07 00]
        [08 00]
        [09 00]
        [0A 00]
        [0B 69]
        [0C 28]
        [0D 00]
        [0E 00]
        [0F 55]
        [00]
      "BODY" (0)

(In fact, "FORM" is the header used by AIFF files.)

So a patch is a CAT, a DESC, a PARM, and a BODY (required even if not used). The number and meaning of parameters will depend on the type of effect, but from this we can guess they're all byte-sized, though a mix of signed and unsigned. The 0 byte after the list is a bit of a mystery.

The meanings of these parameters I assume was found by changing a value then seeing which byte changed in the file. The next step will be to compare a patch from a different effect. Even better to find one that makes use of the BODY section. Another fun way of reversing a format is to modify an unknown byte then see what happens when it is loaded.

As for the way the website is presented, I think it would be helpful if the description activated by clicking on a byte instead of hovering. That would make it possible to then select and copy the description. (Truthfully, I'm increasingly convinced that hover effects in general are bad UX.)

[1] https://docs.python.org/3/library/chunk.html

thanks for this - and good suggestion about click vs hover - any particular bad examples of hover UX that you come to mind?

This concrete page doesn't offer much (not sure why anybody needs to know how VST effect serializes its data in general), but the simplicity of it made me look into other site topic.

Assembly in 7 minutes is great:

http://adamkulidjian.com/vlahb.html

Not sure what are the problems with mobile version that people complain, but I wish more sites are like this, simple and strait to the point.

I look forward for new articles. Keep up the good job m8.

Thank you for the love for Assembly in 7!

The file format used in the song files of Rebirth by proppelerhead is similar, they are based on the.iff format created by EA. Propellerhead released a document in the late 90s describing the format, I found a copy in this GitHub repo: https://github.com/nsauzede/jsynth/blob/master/RBS42.txt

Is something missing on mobile or is this literally just decoding a few bytes from a patch?

That's all there is on desktop, too

Hovering over the bytes on desktop tells you most of the file format.

Not a particularly device friendly way to describe the format, I'll give you that.

So it’s a VST patch, for one particular VSTi. Title is wrong.

It’s not even a Vst unless you count the fact the the entire reason suite was made into a vst/au/aax plug-in as of the latest release.

misleading title too... what a let-down...

It just says 'stuff' for most of it...

I think this might seem more interesting for programmers who are mostly used to working with human readable textual serialization formats.

Has anyone got some similar info for sylenth 1? I have a lot of patch backs for it, but they are not ordered in what I would consider a sensible way - random distributions of different types of patch in a bank. I extracted loads of them and sorted them into folders, but what I want to do is then put them back into banks (such as a bass bank, etc), but there's no way to do this quickly in sylenth other than to load them all in manually and then save the bank.

I can't make sense of the data in existing individual patches or banks (I did some single value changes and resaved and the file was completely different), so it's probably above my pay grade, but if anyone has some ideas they would be appreciated.

(I'm a simple amateur python programmer, for the record)

I used the same approach: turn knob, save, see what the bytes look like.

For one of the Reason instruments that I was thinking of decoding, I encountered a similar problem. Even saving the same patch with different filenames resulted in different looking bytes.

This is outside my own scope but try graphing these patch files out, color coding and seeing what patterns you can notice.

Please change the title

Disappointed, but I would love to get some real insights into the workings of the VST format (not the patches) and its history. Apparently this is not about patch files for VST plugins (.fxp), but about PHs proprietary patch file format. So I don't understand what this has to do with "a VST". Patch files are the least interesting part about audio software anyway, aren't they?

0072 = 0072 + 2 * (filenameLength // 2)

That's wrong. filenameLength is 2, so that equation would come out to 74, not 72.

oh did I make a mistake here? good catch. I'm gonna look back at my original notes for this.

I think 0072 + 2 * ( (filenameLength-1) / 2) should work but I'll test

okay, so the correct formula is: = 0070 + 2 * (filenameLen // 2) where // is floor division.

Site is updated too :)

Reply on news.ycombinator.com