Reverse engineering of the Novation Bass Station II SysEx format.

See also my other project: Bass Station II Web Interface

Ref: https://www.midi.org/specifications/item/table-1-summary-of-midi-message

A MIDI System Exclusive message has the following format:

N is the number of bytes of bytes of the messages.

Note: "Japanese Group" manufacturers have only one ID byte. See [https://www.midi.org/specifications/item/manufacturer-id-numbers] for more details.

Manufacturer ID for Focusrite/Novation: 0x00 0x20 0x29 (in decimal: 00 32 41)

By default, the Bass Station II send 154 bytes. However, a patch (.syx file) may be smaller.

• Offset: index from the start of the SysEx data. First byte (0xF0) has offset=0.
• Bytes: number of bytes to consider for this parameter
• Mask: mask to apply to the above bytes to get the bits relative to the parameter
• Bits: how many bits form the value

Some parameters use two bytes to increase the value range from 0..127 to 0..255.

• The first byte in the dump is the MSB, Most Significant Byte.
• The second byte in the dump is the LSB, Least Significant Byte.
• The msb (most significant bit) of any byte is always 0.

Value = 201. In binary : 11001001

1. The seven most significants bits are 1100100. Left-pad them to form a byte: 01100100 = 100. This will be the first byte to send.
2. The least significant bit is 1. We left-shift it by 6 positions : 01000000 = 64. This will be the second byte so send.

In summary:

byte1 = integer part of value/2
byte2 = 0 if value is even, 64 if value is odd

We receive two bytes: 01100100 and 01000000

1. Left-shift byte 1 by one position: 01100100 << 1 = 11001000
2. Right-shift byte 2 by 6 position: 01000000 >>> 6 = 00000001
3. Add them: 11001000 + 00000001 = 11001001 = 201

In summary:

value = byte1*2 + byte2/64

Some bytes seem to always have the same value. This is confirmed accross all patch I could get.

• byte 05 is always 0x33
• bytes 30..35 are always 0x01 0x00 0x43 0x40 0x20 0x00
• byte 96 is always 0x40
• byte 104 is always 0x40

BS II SysEx Message in decimal:

240 000 032 041 000 051 000 000 000 000 000 000 000 000 001 000 
076 000 000 072 004 000 002 000 002 032 016 000 007 048 001 000
067 064 032 000 035 127 127 127 117 000 000 000 013 081 124 000
008 032 001 068 032 000 000 000 113 002 071 071 000 000 000 000
000 000 014 032 000 000 012 000 000 043 000 000 032 040 004 008
029 025 019 104 004 002 001 020 064 032 032 016 008 002 001 000
064 064 016 015 116 002 001 000 064 054 064 000 000 003 016 000
000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
000 000 000 000 000 000 000 000 000 247 

BS II SysEx Message in hexadecimal:

f0 00 20 29 00 33 00 00 00 00 00 00 00 00 01 00 
4c 00 00 48 04 00 02 00 02 20 10 00 07 30 01 00
43 40 20 00 23 7f 7f 7f 75 00 00 00 0d 51 7c 00
08 20 01 44 20 00 00 00 71 02 47 47 00 00 00 00
00 00 0e 20 00 00 0c 00 00 2b 00 00 20 28 04 08
1d 19 13 68 04 02 01 14 40 20 20 10 08 02 01 00
40 40 10 0f 74 02 01 00 40 36 40 00 00 03 10 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 f7 

Let's decode the Osc 1 Range value. The definition is:

Take bytes 20 and 21 from the above example:

hex: 48 04
bin: 01001000 00000100

Apply masks:

bin:  01001000 00000100
mask: 00000111 01111000
      -----------------
           000 00000

Value:

value: 00000000 (bin) == 0 (dec)

Let's encode the Osc 1 Coarse value. The definition is:

The value we want to encode is 91:

91 (dec) == 01011011 (bin) 

If the mask comprises two bytes, convert the value to encode to a sixteen-bits number, else take the value has an eight-bits value.

01011011 --> 00000000 01011011 (MSB LSB) 

From the mask LSB, count how many bits we need to shift to the left:

01111100 --> 2 bits

Shit the value:

0000000001011011 << 2 --> 0000000101101100   

Get the sysex LSB:

0000000101101100 & 01111100 = 1101100

How many bits has gone into the sysex_lsb?:

LSB_bits = 7 - 2 = 5

Discard, from the original value, this number of bits used for the sysex LSB:

0000000001011011 >>> 5 --> 0000000000000010  

Get the sysex MSB:

0000000000000010 & 00000111 = 00000010 

We can now inject these sysex values into the sysex data:

first, reset the target bits to zero with the inverted masks:     
 
sysex MSB: sysex_data[offset]   = sysex_data[offset]   & 11111000   
sysex LSB: sysex_data[offset+1] = sysex_data[offset+1] & 10000011
 
then inject the value bits: 
 
sysex MSB: sysex_data[offset]   = sysex_data[offset]   | 00000010   
sysex LSB: sysex_data[offset+1] = sysex_data[offset+1] | 01101100

$ xxd -g 1 factory-patches/70-127_INIT\ PATCH.syx
0000000: f0 00 20 29 00 33 00 00 00 00 00 00 00 00 01 00  .. ).3..........
0000010: 4c 00 00 48 04 04 02 00 02 20 10 10 08 00 01 00  L..H..... ......
0000020: 43 40 20 00 03 7f 7c 00 00 00 00 00 0f 78 00 00  C@ ...|......x..
0000030: 08 20 00 00 07 78 00 00 40 00 00 0f 70 00 00 00  . [email protected]...
0000040: 00 00 12 63 10 00 00 00 00 1a 06 20 20 20 04 00  ...c.......   ..
0000050: 1f 19 10 09 24 02 01 14 40 20 20 10 08 02 01 00  ....$...@  .....
0000060: 40 40 10 08 04 02 01 00 40 20 00 00 00 03 10 00  @@......@ ......
0000070: 00 00 00 00 00 00 00 00 00 f7                    ..........

• MIDI specifications: https://www.midi.org/specifications
  • https://www.midi.org/specifications/item/the-midi-1-0-specification
  • https://www.midi.org/specifications/category/reference-tables
• Manufacturer MIDI ID Numbers: https://www.midi.org/specifications/item/manufacturer-id-numbers
• http://www.personal.kent.edu/~sbirch/Music_Production/MP-II/MIDI/midi_system_exclusive_messages.htm
• SendMIDI and ReceiveMIDI tools:
  • https://github.com/gbevin/SendMIDI
  • https://github.com/gbevin/ReceiveMIDI

Novation is a registered trade mark of Focusrite Audio Engineering Limited.

Bass Station II is a trade mark of Focusrite Audio Engineering Limited.