Ferret

Reads the AES-256 keys out of your TX-6 firmware - in your browser.

No keys are stored on this site: the OTP key is read from your connected TX-6, and the built-in key is derived from your own firmware file.

Nothing is sent to a server - the page writes only to your TX-6 (over USB) and to your downloads folder.

Tested, but experimental: this modifies your unit's firmware - use at your own risk.

How this works

The TX-6 keeps its firmware key in write-only OTP fuses, so the only way to read it out is to run a small patched bootloader on the unit. This page builds that patch from your own official firmware file and installs it as a normal bootloader update.

  1. Two keys. The OTP key lives in the TX-6's OTP fuses and decrypts every TX-6 .tfw. The built-in key is a constant embedded in TE firmware; it decrypts OP-Z and OP-1 Field <= 1.1.5 firmware, not TX-6 files. Neither key is stored on this site.
  2. The patch. Your official 1.3.3 file is verified by SHA-256, then a tiny patched bootloader is appended: encrypted with the same key, CBC-chained to the file's last block, with the container length word and both CRC-16s fixed up. The unit installs it as an ordinary bootloader update.
  3. The read. The patched bootloader points console message 0x1f at the ROM's OTP read, so the unit returns the 32-byte OTP key over the USB console. The key is read locally and goes straight into your browser.
  4. What 0x1f was. In the stock bootloader that console message reads OTP row 0x13 - a 16-byte factory/bootloader ID, not key material; the AES key lives in rows 3 and 4. The patch redirects the call to the ROM's otp_get and reads both key halves into the reply buffer, so one request returns the full 32-byte key. The patched block is located by fingerprint, and its call target is per-build and range-checked.
  5. The second key. With the OTP key, the page decrypts your own file, opens the zip, pulls out bootloader.ldr, and reads the built-in key at a fixed offset - then checks it against a pinned SHA-256 before showing it. No keys are shipped in the page.
  6. Reversible. It installs like any firmware update, so on any CRC failure the unit falls back to its previous bootloader. When you are done, re-flash the official firmware to overwrite the patched bootloader - don't leave the unit on the patched build. (The page walks you through it in step 6, and Plan B has the same flow.)
  7. Local only. There is no server: the page writes only to your TX-6 (over USB) and to your downloads folder. The patch is inert without your own file.
  1. 1ok

    Browser check

    Checking browser support...

  2. 2ok

    Connect your TX-6

    Power on the TX-6 and connect it over USB. Chrome will ask for MIDI access - click Allow.

  3. 3ok

    Load the official firmware

    Download the official tx-6_firmware_1_3_3.tfw (archive.org snapshot) and drop it here. The page verifies its SHA-256 and refuses anything else.

    no file loaded

  4. 4ok

    Install the patch

    The TX-6 switches to update mode. Select its disk in the dialog. After the write, eject the disk (Cmd+E in Finder) to start the upgrade - the unit shows UPGRADE -> DONE and reboots. Continue once it is back.

  5. 5ok

    Read the keys

    The TX-6 switches to console mode and the OTP key is read over serial; the built-in key is then derived from your firmware file. On first use, pick the TX-6 port in the browser dialog.

  6. 6ok

    Return to normal mode

    Reboot the TX-6 back to normal mode.

Decrypt a .tfw with your key
Plan B - manual controls

Every wizard step as an individual button.

MIDI

Modes

Firmware

Update disk

Keys

Live log