Recreate Div-0/RTFM/RainSel, but for ZD2

[mungewell]

The original MS pedals had a set of community modified effects, which are ZDL format.

https://github.com/ELynx/zoom-fx-modding

The author wrote a fair bit of documentation on how they work, and how they interact with the pedals. Knowing engineers the ones at Zoom probably have the same (or similar) operation on the newer/G-Series pedals....

I've figured out the first part; downloading the ZD2, extracting the ELF segment and disassembing it...

$ python3 zoomzt2.py --effectdown LINESEL.ZD2
Downloading effect: "LINESEL.ZD2"

$ python3 decode_effect.py --summary LINESEL.ZD2
0x09000f00 : LINESEL.ZD2, LineSel (v1.10 2.66%)

$ python3 decode_effect.py --code LINESEL.ZD2.code LINESEL.ZD2

$ md5sum LINESEL.ZD2.code
ae35e3f3813b3395845582472f0c1196  LINESEL.ZD2.code

$ hexdump -C LINESEL.ZD2.code | head
00000000  7f 45 4c 46 01 01 01 40  00 00 00 00 00 00 00 00  |.ELF...@........|
00000010  03 00 8c 00 01 00 00 00  60 02 00 00 3f 18 00 00  |........`...?...|

TI have a compiler for our CPU here:
https://www.ti.com/product/TMS320C6745?keyMatch=TMS320C6745&tisearch=universal_search&usecase=GPN#software-development

C:\ti\ccs2002\ccs\tools\compiler\ti-cgt-c6000_8.3.13\bin>.\dis6x.exe c:\Users\simon\Downloads\LINESEL.ZD2.code

Disassembly of c:\Users\simon\Downloads\LINESEL.ZD2.code:

TEXT Section .text (Little Endian), 0x2c0 bytes at 0x00000000
00000000            Fx_SFX_LineSel_onf:
00000000       a247           MV.L2         B4,B5
00000002       0a33 ||        MVK.S2        40,B4
00000004       31f7 ||        STW.D2T2      B3,*B15--[2]
00000006       948d           LDW.D2T2      *B5[B4],B0
00000008       200c           LDW.D1T1      *A4[1],A0
0000000a       004c           LDW.D1T1      *A4[0],A4
0000000c       0627           MVK.L2        0,B4
0000000e       0c6e           NOP           1
00000010   10004413           CALLP.S2      __call_stub (PC+544 = 0x00000220),B3
...

Now to see if I can understand the inner workings.

[shooking]

I made a docker to allow anyone to mount compiler via docker without polluting env on Pi, Mac or Intel.

https://youtu.be/3g_qLS7NlNE?si=TEZpG5PzZ7H-yvYk

Elynx was also commenting he did something similar. I plumbed your ELF extract and his ZDL image extract to get icons from the ZDLs. I was also able to reliably extra parameters. I need to double back to get the floats also encoded in the elf - a poor version of the parameters to Ascii we found way back when for ZD2.

[mungewell]

@shooking Thanks for the link. I previously had difficulty getting tools working on my Linux install (too old), so perhaps I can use this docker.

Q. Do you have a 're-assemble' recipe, or is this just to disassemble/inspect the code/data?

In the meantime I had another go on Windows and was able to install this (3rd) version of the CSS tools, which are intended for a C6747 development board.
https://www.ti.com/tool/TMDSOSKL137#related-design-resources

This fits closer with the method(s) suggested by @ELynx, and I was able to disassemble from ZD2 code/ELF, manipulate '.asm' and rebuild (to '.obj).

C:\ti\ccs930\ccs\tools\compiler\ti-cgt-c6000_8.3.5\bin\dis6x.exe --noaddr ^
   LINESEL.ZD2.code  > LINESEL.ZD2.code.asm

tail -n +4 LINESEL.ZD2.code.asm | sed ^
   -e "s/^TEXT.*$/                    .text/" ^
   -e "s/^DATA.*$/                    .const/" ^
   -e "s/ NOP.*$/ NOP/" ^
   | cut -c 21- > test.asm

The compiler has a couple of glitches I don't understand:
NOP 1 - it doesn't like the digit, if I remove it compiles
$C$L1 - duplicate label, comment out
$C$L2 - duplicate label, comment out

Looks like I have a compile flag set wrong as the OP-codes of the result doesn't match

Disassembly of Debug\test.obj:

TEXT Section .text (Little Endian), 0x600 bytes at 0x00000000 
00000000            Fx_SFX_LineSel_onf:
00000000   02900fdb           MV.L2         B4,B5
00000004   0200142b ||        MVK.S2        0x0028,B4
00000008   01bc54f6 ||        STW.D2T2      B3,*B15--[2]
0000000c   00148ae6           LDW.D2T2      *+B5[B4],B0
00000010   00102264           LDW.D1T1      *+A4[1],A0
00000014   02100264           LDW.D1T1      *+A4[0],A4
00000018   0200a35a           MVK.L2        0,B4
0000001c   00000000           NOP           
00000020   10005093           CALLP.S2      __call_stub (PC+644 = 0x000002a4),B3

[mungewell]

I found an option to disable compression, which turns off 16bit instructions, but not how to enable it.

There's also a cmp6x.exe program, which I think performs the compression. But this does not work when called manually. Perhaps the build process calls this at some point...

[ELynx]

Yooo, I see my mention. Let me scribble from my memory :3

I worked on single "segment" at a time. In ZDL it was named ".audio", from your discussions I saw ".text" which is actually much more standard.

So the flow was to take .audio segment from .asm, just as a text, rewrite it as much as needed, then

• compile that .asm into .obj as sanity check plus mnemonics and opcodes -> .obj binary
• disassemble .obj again, to have the byte values
• then paste byte values instead of original bytes, if yours is smaller pad with 0s.

As far as I remember trying to compile whole .asm file did not really work for me either. Plus there were specific disassemle flags, I think for code modification I specifically had to tell it "please do not dump me the binary" and for obj -> asm I had to tell it "please DO dump me the binary".

And do not forget there was an endiness to swap, fully manual step done by saved regex on regex101.

In general, I am very happy that people continue to do this. I hoped for this all along. There is a somewhat steep entry barrier to .asm, but it is actually much more simple than it looks, once you understand that

a) it loves loop unrolling

• it makes each simple operation look x times more intimidating than it is
• while compiler optimizes some registry operations, so each unroll looks a bit different, you do not have to

b) outside of setup and teardown of function, for LineSel, it is just a hacky way to multiply by 1 and by 0

Wish you best, ping me if something in my scribbles was confusing. For now, remember, I had a bug somewhere in my latest implementation, but I forgot what it was, and when the war started a lot of fell apart for me, so period is very blank in my head and I cannot ffs remember the detail. I remember it was something simple that I fugred just by reading my own comments...

[mungewell]

@ELynx Thank you for your comments, and the write-ups on the previous project. They are certainly a good reference on understanding how the pedal(s) work internally.

The ZD2 effects' ELF section does not have a .audio section. Zoom has a number of ZD2 available for download (nominally via Guitar-Lab, but we can grab them too), unfortunately 'LINESEL.ZD2' is not one of them.

I played some more with CCS, and was moderately successful;

• The duplicated $C$L1 symbols seem to be a quirk of the disassembler, it seems to output these for code within a symbol. I was able to hand re-write them to a different value.
• By adding .global definitions I was able to compile the test.out ELF, as it could now find my entry point. For some reason the .const section was missing though....
• I found another '--nocompress' flag and was able to get 16bit op-codes, but this caused boundary errors with the '.fphead' in the code.

So definitely making forward progress :-)

[ELynx]

$C$L1 are "labels", as far as I understood it.
Declare them like this https://github.com/ELynx/zoom-fx-modding/blob/main/diy/div0.asm#L29
and call them like this https://github.com/ELynx/zoom-fx-modding/blob/main/diy/div0.asm#L80
I presume it duplicates them because it thinks names are unique to scope (jump distance) they are in, but on compile checks them to be globally unique. They are usually "local" jumps, or may have address information associated (somehow, may be confusing with other disassemblies I have done), so in theory you can mark them by hand, or even automate that :)

If you can compile whole .asm, you are already far ahead of me. I was always only part swapping and null padding. So for .const section, I have null ideas. .fphead is very well documented, but I was never able to figure them out myself too. I feel like they were meant to be used by compiler, not any human, since optimizations there were quite contextual.

As on choice of effect to practice upon, I literally sorted .ZDLs by size, and picked smallest one, reasoning that less bytes == less things to think about. Plus I went for something that I can easily verify without doing double blind hearing tests :)

Looking for what comes out of this.

[mungewell]

For the G1Four (my 'broken'/critical test pedal):

zoom_fx_AllZDL7/G1 FOUR$ find . -name "*.ZD2" -exec du -hb {} \; | sort -n
12133	./unzipped/OCTAVE.ZD2
13357	./unzipped/BENDCHO.ZD2
13371	./unzipped/EXCITER.ZD2
13390	./unzipped/COMP.ZD2
13933	./unzipped/THEVIBE.ZD2
14269	./unzipped/CHORUS.ZD2
14380	./unzipped/OPTCOMP.ZD2
14461	./unzipped/AUTOPAN.ZD2
14820	./unzipped/RINGMOD.ZD2
14823	./unzipped/STEP.ZD2
14868	./unzipped/VIBRATO.ZD2
...

But for all (G-Series) pedals looks like the simplest is the Volume FX (for pedals with expression).

zoom_fx_AllZDL7$ find . -name "*.ZD2" -exec du -hb {} \; | sort -n | head -n 20
4944	./A1X FOUR/unzipped/OUT_VP.ZD2
4944	./B1X FOUR/unzipped/OUT_VP.ZD2
4944	./B3n/unzipped/OUT_VP.ZD2
4944	./B6/unzipped/OUT_VP.ZD2
4944	./G11/unzipped/OUT_VP.ZD2
4944	./G1X FOUR/unzipped/OUT_VP.ZD2
4944	./G3n/unzipped/OUT_VP.ZD2
4944	./G3Xn/unzipped/OUT_VP.ZD2
4944	./G5n/unzipped/OUT_VP.ZD2
4944	./G6/unzipped/OUT_VP.ZD2
...

And regardless which you (or anyone) chooses, the ELF is identical.

zoom_fx_AllZDL7$ find . -name "OUT_VP.ZD2" -exec bash -c 'python3 ../decode_effect.py -c "{}.code" "{}"' \;

zoom_fx_AllZDL7$ find . -name "OUT_VP.ZD2.code" -exec md5sum {} \;
ef3e435f75cf71a9079f96927fd5acc4  ./A1X FOUR/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G1X FOUR/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G11/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./B1X FOUR/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G3n/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./B3n/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G6/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./B6/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G5n/unzipped/OUT_VP.ZD2.code
ef3e435f75cf71a9079f96927fd5acc4  ./G3Xn/unzipped/OUT_VP.ZD2.code

PS. ;-)
https://www.zoom.co.jp/archive/GUITAR_LAB/AllZDL7.lst

[mungewell]

I had made some progress, but stepped away/got distracted. Thought it's worth while update as best I can....

Firstly I switched which version of CCS to use; download for '9.3.0' supports the correct CPU (later versions do not appear to).
https://www.ti.com/tool/download/CCSTUDIO/9.3.0.00012

I was able to use this to decompile (on command line) the ELF from a ZD2 and then build a project, assembling from ASM (text) code.

I did NOT progress to uploading back to a pedal, I decompilied the built version and then was comparing the Zoom vs self-built one. I theory I can zip up bits of the project, but I would have to remove the Zoom copyright files or possible have some script that could be used to re-do my technique(s) so someone could could download LINESEL.zip themselves...

$ wget https://www.zoom.co.jp/archive/GUITAR_LAB/HGL_for_MS70CDR_Plus/ZDLF/LINESEL.zip

[mungewell]

Further to that, this evening I confirmed that I can build in a similar manner with the more recent 'CCS12.8.1' release... so I will write up instructions based on that.
https://www.ti.com/tool/download/CCSTUDIO/12.8.1

[mungewell]

I am continuing to make progress, but it seems that the assembler/linker is NOT setting the object size in the resultant ELF. I don't know if this is really a problem, but it means (for example) that my ICON script can not extract the on device icon...

Symbol table '.dynsym' contains 15 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 00000000     0 NOTYPE  LOCAL  HIDDEN   ABS __TI_STATIC_BASE
     2: 00000238     0 FUNC    GLOBAL PROTECTED    3 Dll_LineSel
     3: 0000012c     0 FUNC    GLOBAL PROTECTED    3 Fx_SFX_LineSel
     4: 00000064     0 FUNC    GLOBAL PROTECTED    3 Fx_SFX_LineSel_E[...]
     5: 000000ac     0 FUNC    GLOBAL PROTECTED    3 Fx_SFX_LineSel_O[...]
     6: 000000f4     0 FUNC    GLOBAL PROTECTED    3 Fx_SFX_LineSel_init
     7: 00000000     0 FUNC    GLOBAL PROTECTED    3 Fx_SFX_LineSel_onf
     8: 80000130     0 OBJECT  GLOBAL PROTECTED    4 LineSel
     9: 8000026c     0 OBJECT  GLOBAL PROTECTED    4 _Fx_SFX_LineSel_Coe
    10: ffffffff     0 NOTYPE  GLOBAL PROTECTED  ABS __TI_pprof_out_hndl
    11: ffffffff     0 NOTYPE  GLOBAL PROTECTED  ABS __TI_prof_data_size
    12: ffffffff     0 NOTYPE  GLOBAL PROTECTED  ABS __TI_prof_data_start
    13: 80000210     0 OBJECT  GLOBAL PROTECTED    4 _picTotalDisplay[...]
                    ^^^
    14: 80000000     0 OBJECT  GLOBAL PROTECTED    4 effectTypeImageInfo

Confirmed that the same happens with older compiler, and on both Windows/Linux. The inbuilt C "hello world" example DOES give the object sizes, and when I de-assemble that I get a load a dwarf descriptors.

Recreating these for 'LINESEL.ASM' code I do get size (and can extract), but I am not convinced this is the way forward.

	.def _picTotalDisplay_LineSel
$C$DW$16	.dwtag  DW_TAG_subprogram
	.dwattr $C$DW$16, DW_AT_name("_picTotalDisplay_LineSel")
	.dwattr $C$DW$16, DW_AT_low_pc(_picTotalDisplay_LineSel)
	.dwattr $C$DW$16, DW_AT_high_pc(0x00)
_picTotalDisplay_LineSel:
           .byte 0xfc
           .byte 0x06

Here's what I have so far....
20250616a_test.zip

[mungewell]

More progress, with 'relocations'. It looks like the disassembler does NOT handle the relocation table and as such there is none in the rebuilt ELF.

In the original ELF (from OUT_VP effect, as it's simpler).

$ readelf -r OUT_VP.ZD2.code 

Relocation section '.rela.dyn' at offset 0x384 contains 8 entries:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
00000064  00000509 R_C6000_ABS_L16   80000130   Bypass + 0
00000068  00000409 R_C6000_ABS_L16   80000000   effectTypeImageInfo + 0
0000006c  0000050a R_C6000_ABS_H16   80000130   Bypass + 0
00000074  0000040a R_C6000_ABS_H16   80000000   effectTypeImageInfo + 0
80000008  00000101 R_C6000_ABS32     800001a0   picTotalDisplay_O[...] + 0
8000014c  00000301 R_C6000_ABS32     00000080   Bypass_DummyEditor + 0
80000184  00000301 R_C6000_ABS32     00000080   Bypass_DummyEditor + 0
80000188  00000201 R_C6000_ABS32     00000000   Fx_Bypass + 0

It looks like we need to manually tweak the ASM listing to re-insert the references. So disassemble without the --realquiet --suppress flags, and locate the appropriate lines. For example I pasted the lines from table to end...

00000060            Dll_Bypass:
00000060       21ef           BNOP.S2       B3,1
00000062       4426           MVK.L1        2,A0
00000064   0000982a ||        MVK.S2        0x0130,B0           ; 00000064  00000509 R_C6000_ABS_L16   80000130
00000068   00800029           MVK.S1        0x0000,A1           ; 00000068  00000409 R_C6000_ABS_L16   80000000
0000006c   0040006b ||        MVKH.S2       0x80000000,B0       ; 0000006c  0000050a R_C6000_ABS_H16   80000130
00000070       0204 ||        STB.D1T1      A0,*A4[0]
00000072       3004           STW.D1T2      B0,*A4[1]
00000074   00c00068 ||        MVKH.S1       0x80000000,A1       ; 00000074  0000040a R_C6000_ABS_H16   80000000
00000078   00906274           STW.D1T1      A1,*+A4[3]
0000007c   e2200202           .fphead       n, l, W, BU, nobr, nosat, 0010001b

Then back in the 'real' ASM file replace the numerical values with the references to symbols. Note I added 'L' to 'MVKL' to prevent linker errors

Dll_Bypass:
           BNOP.S2       B3,1
           MVK.L1        2,A0
 ||        MVKL.S2       Bypass,B0					; 00000064  00000509 R_C6000_ABS_L16   80000130   Bypass + 0
           MVKL.S1       effectTypeImageInfo,A1		; 00000068  00000409 R_C6000_ABS_L16   80000000   effectTypeImageInfo + 0
 ||        MVKH.S2       Bypass,B0					; 0000006c  0000050a R_C6000_ABS_H16   80000130   Bypass + 0
 ||        STB.D1T1      A0,*A4[0]
           STW.D1T2      B0,*A4[1]
 ||        MVKH.S1       effectTypeImageInfo,A1		; 00000074  0000040a R_C6000_ABS_H16   80000000   effectTypeImageInfo + 0
           STW.D1T1      A1,*+A4[3]
           ;.fphead       n, l, W, BU, nobr, nosat, 0010001b

and

effectTypeImageInfo:
           .word 0x00000017
           .word 0x0000001e
           .word picTotalDisplay_OutputVP		; 80000008  00000101 R_C6000_ABS32     800001a0   picTotalDisplay_O[...] + 0
           .word 0x00000000
           .word 0x00000000

And... WOW!.... it actually builds and creates relocation table in the rebuilt ELF. The offsets are slightly different as I commented out the '.fphead' instructions... next problem.

$ readelf -r check2/Debug/check2.out 

Relocation section '.rela.dyn' at offset 0x3bc contains 8 entries:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
00000060  00000609 R_C6000_ABS_L16   80000130   Bypass + 0
00000064  00000509 R_C6000_ABS_L16   80000000   effectTypeImageInfo + 0
00000068  0000060a R_C6000_ABS_H16   80000130   Bypass + 0
00000070  0000050a R_C6000_ABS_H16   80000000   effectTypeImageInfo + 0
80000008  00000401 R_C6000_ABS32     800001a0   picTotalDisplay_O[...] + 0
8000014c  00000301 R_C6000_ABS32     00000078   Bypass_DummyEditor + 0
80000184  00000301 R_C6000_ABS32     00000078   Bypass_DummyEditor + 0
80000188  00000101 R_C6000_ABS32     00000000   Fx_Bypass + 0

[mungewell]

On the offsets; disassembling rebuilt code shows '.fpheads' are re-introduced. I also notice that functions had trailing 'NOP's, so it looks like they are using `.align 32'.

Adding this to my ASM lets me build to same as Zoom ;-)

$ readelf -r check2/Debug/check2.out 

Relocation section '.rela.dyn' at offset 0x38c contains 8 entries:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
00000064  00000609 R_C6000_ABS_L16   80000130   Bypass + 0
00000068  00000509 R_C6000_ABS_L16   80000000   effectTypeImageInfo + 0
0000006c  0000060a R_C6000_ABS_H16   80000130   Bypass + 0
00000074  0000050a R_C6000_ABS_H16   80000000   effectTypeImageInfo + 0
80000008  00000401 R_C6000_ABS32     800001a0   picTotalDisplay_O[...] + 0
8000014c  00000301 R_C6000_ABS32     00000080   Bypass_DummyEditor + 0
80000184  00000301 R_C6000_ABS32     00000080   Bypass_DummyEditor + 0
80000188  00000101 R_C6000_ABS32     00000000   Fx_Bypass + 0

Note: since we don't know the data contents of the objects, we don't know which 0x00000000 are real and which are padding. Should not really pose a problem though, except (perhaps) when we are changing inbuilt graphics.

[ELynx]

Note: since we don't know the data contents of the objects, we don't know which 0x00000000 are real and which are padding. Should not really pose a problem though, except (perhaps) when we are changing inbuilt graphics.

From my memory of prodding random resources, I think it should be fine. For strings, they are either limited to size and will be visibly cut off, or null terminated, then running over original size if there are nulls should be OK.
For graphics, I expect the same logic, something like a parser will wait for "stop byte", most likely 0x00.
In the meantime I was "hacking" into other embedded stuff, and I used all padded spaces not only for resources, but for executable code. Yes, logic was a Swiss cheese of jumps, but embedded usually does not care about such formalities.

[mungewell]

Looking through different effects, I saw up-to 100 relocs for some and wanted a way to automate the process. I adjusted my 'patch_asm.py' script to match addresses and insert the reloc definitions as comments - thus making it easier to manually adjust code later.
patch_asm.py.txt

The process is now:

$ readelf -r OUT_VP.ZD2.code > OUT_VP.reloc
$ ~/ti/ccs1281/ccs/tools/compiler/ti-cgt-c6000_8.3.12/bin/dis6x --all --noaddr --realquiet OUT_VP.ZD2.code | sed 's/\.fphead/;.fphead/' > temp.asm
$ python3 patch_asm.py -r OUT_VP.reloc temp.asm > check2/OUT_VP.asm

Then:

1. Fix asm to reference relocs (comment is below affected line).
2. Fix any '$C$L1'/etc duplication.
3. Comment out trailing NOPS at end of functions.
4. Correct any dwarf tags (sometimes glitches with multiple references to same bit of code).
5. Check project start/exported symbols.
6. Build project.... :-)

This gives us a 100% duplicate compile, although ELF tags do not (yet) match 100%.

$ ~/ti/ccs1281/ccs/tools/compiler/ti-cgt-c6000_8.3.12/bin/dis6x --all OUT_VP.ZD2.code > temp.asm
$ ~/ti/ccs1281/ccs/tools/compiler/ti-cgt-c6000_8.3.12/bin/dis6x --all check2/Debug/check2.out > check2.asm
$ meld temp.asm check2.asm

20250618_check2.zip

I think we're getting to the point where we can re-insert our code/elf into the ZD2 and try on a pedal, although extreme caution is advised. After that's confirmed I guess we can start re-writing bits of code....

[mungewell]

I poked around further with the project settings, and was able to get more of the 'readelf' tags/tables to match after (re-)building the 'LINESEL' effect....

20250618_test.zip

And then I did the crazy thing. Trying to test modified effect on my (broken screen) G1Four, as this device
would not be a major loss if it were completely destroyed..

Midi to configure Current Patch Effect(s)

$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 01  02 3d 17 00 00 00 f7'
                                                    ^^ ^^ ^^ ^^ ^^ value
                                                    (7bit little endian)
                                                 ^^ param
                                             ^^ config effect in slot (0..8)
param 0: effect on/off (0,1)
param 1: effect type
param 2: dial 1 (left most)
param 3: dial 2
param 4: dial 3
param 5: dial 4 (right most)
param 6: dial 5 (pg 2, if applicable)
param 7: dial 6
param 8: dial 7
param 9: dial 8

Note: I strongly suggest turning Autosave off, as this will prevent modified ZD2
being loaded into current patch on boot (and thus causing a 'crash loop').

Prepare the files.

We use a script (from 'zoomzt2' project) to alter the ZD2 file.

$ python3 zoomzt2/decode_effect.py --help
usage: decode_effect [-h] [-d] [-s] [-n] [-v] [-m] [-7] [-b BITMAP] [-i INFO] [-c CODE] [-j]
                     [-x XML] [-t TEXT] [-D DONOR] [-B] [-T] [-I] [-C] [-X] [-F] [-E] [-V]
                     [--force-target FORCE_TARGET] [--force-id FORCE_ID]
                     [--force-name FORCE_NAME] [--force-gname FORCE_GNAME] [-o OUTPUT]
                     FILE

positional arguments:
  FILE                  File to process

options:
  -h, --help            show this help message and exit
  -d, --dump            dump configuration to text
  -s, --summary         summarized configuration in human readable form
  -n, --id              output the effect's numerical ID (in hex)
  -v, --version         output the effect's version
  -m, --md5sum          include md5sum of file in summary report
  -7, --7bit            include ID as 5x 7bit summary report
  -b BITMAP, --bitmap BITMAP
                        extract Icon/Bitmap to FILE
  -i INFO, --info INFO  extract Info to FILE
  -c CODE, --code CODE  extract Code to FILE

Language:
  Extract either English or Japanese segments

  -j, --japan           select Japanese version for export
  -x XML, --xml XML     extract XML to FILE
  -t TEXT, --text TEXT  extract Text to FILE

Donor:
  Take replacement sections from a donor ZD2

  -D DONOR, --donor DONOR
                        specify donor ZD2 FILE
  -B, --donor-bitmap    inject Icon/Bitmap from donor
  -T, --donor-text      inject Text from donor
  -I, --donor-info      inject Info from donor
  -C, --donor-code      inject Code from donor
  -X, --donor-xml       inject XML from donor
  -F, --donor-final     inject FinalBytes from donor
  -E, --donor-elf       replace Code with ELF file (ie whole file)

Modify:
  manipulate values specified in ZD2

  -V, --crc             validate CRC32 checksum
  --force-target FORCE_TARGET
                        Force target pedal (in Hex) - WARNING may be 'unsafe'
  --force-id FORCE_ID   Force the ID to a particular value (in Hex)
  --force-name FORCE_NAME
                        Force the Name to a particular string (max 11 chars)
  --force-gname FORCE_GNAME
                        Force the GroupName to a particular string (max 11 chars)
  -o OUTPUT, --output OUTPUT
                        output combined result to FILE

Rewrite the ZD2 to change target bits, thus allowing it to run on the G1Four
(my test pedal).

$ python3 zoomzt2/decode_effect.py --force-target 2 -o LINESELo.ZD2 LINESEL.ZD2
Checksum Recalculated: 0xc670420a

Force the new (re-built) ELF into the ZD2, saving as a new file.

$ python3 zoomzt2/decode_effect.py --donor test/Debug/test.out --donor-elf --force-target 2  -o LINESELm.ZD2 LINESEL.ZD2
Checksum Recalculated: 0xfcc29a78

$ md5sum LINESEL*.ZD2
23b8f3850a990870f02df460158442dc  LINESELm.ZD2
ff6b2186a26c00c6ad65e602e2c9c090  LINESELo.ZD2
e1fe28d99b3b419974f7a1c70785f85b  LINESEL.ZD2

If we are installing effect into patch via midi, we need to know the 32-bit ID in 7-bit values

$ python3 zoomzt2/decode_effect.py --summary LINESELo.ZD2 
0x09000f00 : LINESELo.ZD2, LineSel (v1.10 2.66%)

$ python3 zoomzt2/convert_id_to_7bit.py 
0x09000f00
--
0x00
0x1e
0x00
0x48
0x00

OK here we go

Confirm current patch is empty, then install original/official effect

$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 
$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 00 01 00 1e 00 48 00 f7'
$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: LineSel (On)
EFX LVL : 100
OUT LVL : 100
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 

Power cycle (to ensure/confirm auto-save is off, for safety), uninstall original effect, install the self-built effect, and add it to current patch.

$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 

$ python3 zoomzt2/zoomzt2.py --uninstall LINESELo.ZD2 
Uninstalling effect: LINESELo.ZD2
$ python3 zoomzt2/zoomzt2.py --install LINESELm.ZD2 
Installing effect: LINESELm.ZD2
uploading...

$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 00 01 00 1e 00 48 00 f7'
$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: LineSel (On)
Efx-Lvl : 100 <---------- note the lower case here!
OUT LVL : 100
 : 
 : 
---
Effect: Bypass (Off)
 : 
 :

OMG... It actually works! So just looking for someone else to confirm, check my instructions.

Edit: Well checking the audio is not quite so good, OK at first when effect is on - but high pitch tone/crashed pedal when the effect is turned off (via midi)... I double check the original effect and it does work OK (when on/off).

$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: Bypass (Off)
 : 
 : 
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 

simon@portal:~/workspace_v12$ python3 zoomzt2/zoomzt2.py -I LINESELm.ZD2 
Installing effect: LINESELm.ZD2
uploading...
$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 00 01 00 1e 00 48 00 f7'
$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 01 01 10 00 00 48 00 f7'
$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 01 02 7f 00 00 00 00 f7'
$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: LineSel (On)
Efx-Lvl : 100
OUT LVL : 100
 : 
 : 
---
Effect: Air (On)
Size : 100
REF : 5

$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 00 00 00 00 00 00 00 f7'

$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
0 bytes read

Power-off to recover... maybe thanks to 'autosave off'

Edit2 - I was able to adjust the 1st parameter, which lowers volume when effect is on.

$ amidi -p hw:1,0,0 -S 'f0 52 00 6e 64 03 00 00 02 18 00 00 00 00 f7'
$ amidi -p hw:1,0,0 -S 'F0 52 00 6e 64 02 00 05 00 F7' -r temp.bin -t 2
1015 bytes read

$ python3 zoomzt2/decode_screens.py temp.bin| head
---
Effect: LineSel (On)
Efx-Lvl : 24
OUT LVL : 100
 : 
 : 
---
Effect: Bypass (Off)
 : 
 : 

Edit 3; Looking at the disassembly of the original vs. the modified, I found that I had commented out this NOP 4 which wasn't at the end of a function. Re-introduced it and now the audio works OK whether effect is on or off, and the 'out lvl' works when off.

$C$L2_1:
          LDW.D2T2      *++B15[2],B3
          NOP           4                        <--------------------------
          ;.fphead       n, l, W, BU, nobr, nosat, 1110000b
          BNOP.S2       B3,5
	.def Fx_SFX_LineSel_EfxLvl_edit
	.align 32
Fx_SFX_LineSel_EfxLvl_edit:
          MV.L2         B4,B5