Fender Rumble LT 25 support? about plug

[brentmaxwell]

I've got some good news and bad news.

Bad news is that the protocol seems to be different enough from the previous amp versions that it will likely require a complete rewrite of the code to handle communications with the amp (I have only scanned the current code, not familiar enough with it to say for sure).

Good news is that Fender used protobuf for their new amps, and using this tool on the Fender Tone LT executable file, I was able to pull the entire protobuf spec!

Basically, the Fender Tone software and the amplifier communicate over USB HID data messages, and the data is sent as protobuf, with json embedded in the protobuf messages for the preset settings.

I'm in the process of documenting it and putting together a library and a simple dotnet core application to allow for importing and exporting the presets to files. I'll be expanding that to a more powerful amp controller after I finish the initial library and documentation.

I haven't done much C/C++ programming (other than Arduino) in a very long time, and I'm more comfortable in C#, but everything will be dotnet core so that it will be able to run on Linux. Of course I will be sharing all the documentation I come up with so anyone else can implement it as they would like.

[brentmaxwell]

I have documented the protocol used by the amp, and created a rough implementation of a library in dotnet.

I haven't had a chance to test this on linux yet, but it uses HidSharp, which is cross platform, and that's the only thing that reaches outside of the code itself.

There is literally no user code at the moment, but my next step will be to create a UI. I'm still trying to figure out which cross-platform UI in dotnet will work best. I have to find a raspberry pi (I have a billion of them, and I don't know where they all are - even some of the ones that are running!), and try some of the toolkits out (but if anyone has any suggestions).

If anyone is interested in porting this to another language, it's actually a pretty simple protocol. All the "messages" sent between the computer and amp are protobuf, and all the protobuf schema documents were extracted from the Fender Tone executable. From there it was just generating the stubs for my programming language with protoc, and wrapping it with the USB HID code. I feel like I've documented it pretty well in my repo, but if there are any questions, I'm glad to help out. I will be taking a stab at a C++ version sometime in the future, if only to help build my skills back up.

Take a look. I know that there are probably some major issues with the design; I was mostly focused on having something "work" and getting it documented.

[brentmaxwell]

I just got a Mustang LT25, and took a quick look in Wireshark.

It looks like the Fender Tone application communicates with the amp over HID messages. I've only had a quick look, but at startup, the amp sends all the current presets as JSON. Selecting a preset in the application sends a message that starts with an integer corresponding to the preset bank to switch to.

I haven't had a chance to really dive into it, but I hope to have some time over the next month.

I'll start putting together some documentation of the protocol, and share the link here once I get started.

[ScottG489]

I have a Mustang LT25. I'd be happy to help get this supported!.

How would I go about getting a communications dump? I have access to a Windows machine.

[ScottG489]

Here's what I believe you're looking for for the VID/PID:

Bus 003 Device 017: ID 1ed8:0037 FENDER MUSICAL INSTRUMENTS CORPORATION Mustang LT 25

Let me know what I should do about the dump file and if it would be safe to just attach it here. Happy to email it to you or by other means.

[offa]

I don't have any experience with the amp unfortunately. Is there a software like the former FUSE to control it?

[pintergreg]

Now, I have the device.

lsusb output:

Bus 002 Device 005: ID 1ed8:0038 FENDER MUSICAL INSTRUMENTS CORPORATION Rumble LT 25

dmesg:

[ 3852.321058] usb 2-1.2: new full-speed USB device number 6 using ehci-pci
[ 3852.420588] usb 2-1.2: New USB device found, idVendor=1ed8, idProduct=0038, bcdDevice= 2.00
[ 3852.420600] usb 2-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3852.420606] usb 2-1.2: Product: Rumble LT 25
[ 3852.420610] usb 2-1.2: Manufacturer: FMIC
[ 3852.420614] usb 2-1.2: SerialNumber: 00000000001A
[ 3852.422940] hid-generic 0003:1ED8:0038.0008: hiddev97,hidraw3: USB HID v1.11 Device [FMIC Rumble LT 25] on usb-0000:00:1d.0-1.2/input0

Let me know If there are any other output, that can be useful.

I have installed plug from AUR, version 1.4.2-1, it does not recognize the amp: ERROR: Failed to open usb device

Is there a software like the former FUSE to control it?

Fender Tone shoud be used, but I still haven't got any time to test it via wine. I will report if I had any success.

edit: dmesg output added

[offa]

I have installed plug from AUR, version 1.4.2-1, it does not recognize the amp: ERROR: Failed to open usb device

Even though this version is old, the USB PID isn't implemented. The main question is: Does this type of amp use the same protocol as the Mustangs?

[pintergreg]

Does this type of amp use the same protocol as the Mustangs?

I don't know. I would use the same (or as close as possible) , because it is more expensive to develop and maintain a completely different one, just because it is a bass amp and not a guitar amp.

Do you have any idea how could I find out?
I haven't read every paper I've got, but I do think those are for the end users and not hackers.
By the way, the mustang amp protocol are completely reverse engineered or there are some documentation available?

[offa]

No, everything is reverse engineered and without any docs unfortunately. I don't assume there's one for newer generations :-/ .

I don't know. I would use the same (or as close as possible) , because it is more expensive to develop and maintain a completely different one, just because it is a bass amp and not a guitar amp.

Yea, wouldn't make sense to me too.

Do you have any idea how could I find out?

Do these amp share any settings like amps with the mustang series? If so, maybe we can use the current configurations and try. Or, we send an init sequence and see what we get back.

The best way would be to dump the communication of the official software though.

[Naln1]

Hi, I own the Mustang LT 25 and have used the Rumble LT 25. They both have the exact same user-interfaces - the only difference seems to the the amps & stompboxes themselves.

[offa]

So it could work to dump the values.

[offa]

How would I go about getting a communications dump? I have access to a Windows machine.

You can use Wireshark and record the communication of the official software with the amp.

What we can try: Add the USB VID / PID mentioned above and see how far we get.

Update: I have prepared a branch: experimental/lt25

[ScottG489]

Alright I'm up and running. On Windows and I have Fender Tone LT Desktop version 1.5.0.10741 installed and have successfully captured packets with it with Wireshark. Able to see what looks like volume adjustments and such when I make them on either side.

I'm new to reverse engineering a binary protocol, so I might need a little help getting started. I didn't quite follow what you were saying. It sounds like you want me to checkout that branch then build and run the app and just see if it works with those changes?

Also just to clarify, I have the Mustang LT25 and not the Rumble LT25.

Let me know if you'd like me to send you some capture data from Wireshark. I'm also happy to jump on Discord, IRC, etc. if that would help!

[offa]

Also just to clarify, I have the Mustang LT25 and not the Rumble LT25.

Thanks for pointing that out, didn't know there ware different types of LT25.

It sounds like you want me to checkout that branch then build and run the app and just see if it works with those changes?

Yes (if you have some minutes spare). But before this I have to change PID. I assume the VID is same, but can you post the Mustang LT25s PID?

Let me know if you'd like me to send you some capture data from Wireshark. I'm also happy to jump on Discord, IRC, etc. if that would help!

The first thing to figure out: Does the device use the same protocol as the others? So the initial two packets send to the amp are most interesting I guess (these initialize the communication).

Can you attach the first two packets (or the wireshark dump)?

[ScottG489]

Sorry, not familiar with what a VID and PID are. How would I find them?

Nvm, will use lsusb when I boot back into Linux to get this.

Will get some Wireshark data shortly.

Would it be safe to attach a dump here or could there be sensitive data in it?

[offa]

Will get some Wireshark data shortly.

Would it be safe to attach a dump here or could there be sensitive data in it?

If it's only the usb communication with the amp, there's no sensitive data in it. Just make sure you filter right.
You can also paste the hex bytes of the first packets here, that should enough for the first steps.

Here's what I believe you're looking for for the VID/PID:

Exactly! 👍 1ed8 is the vid and 0037 is the pid.

I have updated the branch with this pid.

[ScottG489]

Ok well here is the first packet:

0000   1c 00 20 fa 3e eb 86 86 ff ff 00 00 00 00 0b 00   .. .>...........
0010   00 03 00 10 00 80 02 08 00 00 00 00 80 06 00 01   ................
0020   00 00 12 00                                       ....

It's info is "GET DESCRIPTOR Request DEVICE". And I guess I'll paste the second packet here that was the "Response" while I'm at it:

0000   1c 00 20 fa 3e eb 86 86 ff ff 00 00 00 00 08 00   .. .>...........
0010   01 03 00 10 00 80 02 12 00 00 00 03 12 01 00 02   ................
0020   00 00 00 40 d8 1e 37 00 00 02 01 02 03 01         [email protected].......

Let me know if this looks right.

[offa]

Thanks! From a first look it looks like the device uses a different protocol format. The other Mustangs use 64 byte (16 byte header + 48 byte payload) and the initial first two packets (send to the amp) use other values.

So testing the branch mentioned above wont help much :-(

Are request / response constant between connections or are there values that change?

[ScottG489]

Sorry, not sure I understand your question or would know what to look for.

Here's my .pcapng file: mustang_init.zip

Let me know what else I can do to help.

[offa]

Thanks! Regarding my question: If you connect your amp multiple times, are the bytes always as listed above or is there a difference?

Update:

The amp seems to use a different (but similar?) format.

[ScottG489]

Sorry for the very long delay! Hadn't booted up Windows in a while.

I ran a capture again and these were the results:
mustang_init2.zip

Does it seem like there's a difference compared to the first?

[offa]

No problem. Thanks, I'll have a look at it.

Update

The first packet sent uses some different bytes (unlike normal mustang devices do!?)