Reverse engineering the Use Audio Plugiator
An attempt to document and preserve the licensing system of a fascinating and increasingly obscure synthesizer.
The Use Audio Plugiator was a small hardware synthesizer released in the late 2000s. Internally it used an Analog Devices SHARC DSP and could run several different synthesizer models originally developed by CreamWare.
The basic instruments — Minimax, B4000 and LightWave — were supplied with the hardware. Additional synths including Vocodizer, Prodyssey, Pro-12, FMagia and Drums'n'Bass could be purchased separately.
Those additional synths were activated using a hardware-specific licence key.
Unfortunately the original online infrastructure has long since disappeared.
I own a Plugiator and have been trying to understand and document how this forgotten activation system worked.
What I've discovered
Plugiators have a nine-character hardware serial number (HWSN). The original software can decode this into a 32-bit hardware identity.
For example, one historical machine for which activation information survives has:
HWSN E489AXKRR Hardware 2A010187
The synths were represented internally by simple numeric IDs:
01 Minimax 02 B4000 03 LightWave 04 Vocodizer 05 Prodyssey 06 Pro-12 07 FMagia 08 Drums'n'Bass
The activation key isn't the secret
One of the most useful discoveries came from examining the original Mac Plugiator software.
The familiar 12-character activation key is an encoded representation of a 32-bit entitlement value. The original software contains routines named:
SerialGen::Crypt SerialGen::Decrypt SerialGen::EncodeHWS SerialGen::DecodeHWS SerialGen::EncodeSer SerialGen::DecodeSer
This means the printable activation key itself can be decoded.
The mystery is how the original Use Audio/inDSP system calculated the underlying 32-bit entitlement from the Plugiator and the synth being purchased.
The missing function
From surviving genuine licences, we currently have examples such as:
Hardware 2A010187 + synth 04 = 6D5060DF Hardware 2A010187 + synth 05 = 24C27F98 Hardware 2A010187 + synth 06 = 5ABACBAC Hardware 2A010187 + synth 07 = 3BB89466 Hardware 2A010187 + synth 08 = 126B84A5 Hardware 2A010512 + synth 04 = D36DA199
So the remaining historical puzzle can be expressed very simply:
hardware serial + synth ID
|
v
?????????
|
v
32-bit entitlement
That little question-mark box is what I'm trying to reconstruct.
What happened when a plugin was installed?
The original Plugin Manager does not appear to generate the entitlement itself.
Instead it decodes the supplied activation key and sends the resulting entitlement to the Plugiator using a hardware command called CHECKKEY.
Experiments with the hardware show two CHECKKEY results:
0x40 invalid 0x41 valid
The entitlement and synth ID are lightly transformed before transmission. One particularly nice piece of archaeology is that the constants spell out the name of the company behind the technology:
Entitlement XOR 0x494E4453 = "INDS"
Synth ID XOR 0x50 = "P"
"INDSP"
inDSP Audio Technologies was the company behind the underlying technology.
The licence is also stored in the DSP loader
Comparing otherwise identical Plugiator loader images revealed that the 32-bit entitlement is stored directly in the loader metadata.
The loader contains a marker named:
YODA
The entitlement sits immediately outside the protected DSP payload.
I also performed an experiment using an entitlement belonging to another Plugiator. Persuading the Plugin Manager to pass its installation-time CHECKKEY test allowed the loader to be written, but the licence was subsequently rejected by the Plugiator itself.
So passing the installation-time CHECKKEY test is not sufficient. There is further device-side validation of the installed licence.
Two computers inside the Plugiator
The hardware contains both an ATmega32 microcontroller and an ADSP-21364 SHARC DSP.
The ATmega supervises the hardware and communicates with the SHARC over SPI.
Historical evidence also shows that there were two distinct kinds of software update:
ATmega/controller firmware
e.g. 01.03.0134 / 01.03.0137
SHARC DSP operating system
updateable through the Plugin Manager
One remaining question is therefore whether CHECKKEY was validated by the ATmega itself or passed to the SHARC.
A mysterious firmware archive
An archived copy of the old Use Audio server reveals that a password-protected firmware area once existed.
Among the surviving URLs are:
/firmware/Plugiator_FW_v134/ /firmware/Plugiator_FW_v134/file_1.pfw
The actual firmware file was unfortunately not preserved by the Internet Archive.
The name v134 is intriguing because real Plugiators are known with hardware firmware version 01.03.0134, although I have not established that the two are connected.
The vanished online shop
The Wayback Machine preserves surprising fragments of the original Use Audio licensing infrastructure.
Customers registered their Plugiator's nine-character HWSN before accessing the online shop.
The administration system separately tracked:
HWSN Hardware serial numbers SWSN Software-related serial/licence records Voucher Voucher codes
The surviving database statistics show only a handful of SWSN records had been issued in the captured version of the system.
Unfortunately none of the actual SWSN detail pages appear to have been archived, so the exact meaning and contents of an SWSN record remain unknown.
The people behind it
This research has also uncovered fragments of the history of Use Audio and inDSP.
Frank Hund was closely associated with inDSP and Use Audio. Ray Mehta represented Use Audio in contemporary online discussions, while surviving forum posts report that a support contact named Rahul was still helping owners register Plugiators as late as 2014.
Benoit Bouchez later independently investigated the Plugiator hardware and reconstructed parts of its circuitry and ATmega-to-SHARC communication.
If you worked for Use Audio or inDSP during this period, I'd particularly love to hear from you.
Can you help?
This is where another Plugiator owner could make a huge difference.
I'm looking for any surviving original activation information for the optional Plugiator synths.
Useful material includes:
- old Use Audio activation emails;
- a Plugiator HWSN together with one or more of its activation keys;
- old .PIL, .LDR or .PFW files;
- old versions of the Plugiator Plugin Manager;
- Use Audio/inDSP service or production software;
- anything named ASRCommander or ASX Production Test;
- information about SWSN records;
- ATmega firmware or service-update files;
- old correspondence with Use Audio or inDSP.
I am particularly interested in matched HWSN + activation-key pairs. You don't need to post them publicly. Please contact me privately if you have one and are willing to help with the research.
Even an old backup CD or forgotten downloads folder could contain something that has otherwise disappeared from the internet.
Why am I doing this?
Not because I need the synths.
The Plugiator's instruments survive in other hardware, and I already have working versions of them.
I'm interested because this is a little piece of music-technology history which is gradually disappearing.
We've reached the strange point where much of the system can be explained — the serial-number encoding, activation-key format, Plugin Manager protocol, loader format, server infrastructure and hardware architecture — but the function which connected a hardware serial number and synth ID to its entitlement remains unknown.
I'd like to solve that final part while enough information still survives to make it possible.
A note about this research
This page documents research into obsolete music technology and does not provide a method for bypassing the Plugiator's licensing system. My aim is to understand and preserve how the original system worked.
If you've stumbled across this page years from now because you recognise Plugiator_FW_v134, file_1.pfw, SWSN, ASRCommander, ASX Production Test, YODA or CHECKKEY, please get in touch.
— Mike
Mike's MIDI Page 🎹