Need help identifying main processor for Roland synthesizer

Question

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.

So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into assembly language, but I have no info on the processor type. I have tried to analyze the firmware, which is a binary file using binwalk but wasn't able to find any info. I've also used the tool cpu_rec to see if it would give me any info and it told me it's a pic10 but I don't thinks that's accurate. I'll post pics below of the gr-55 motherboard, and the firmware , and some other stuff.

R05011845 WSP IC

R8A02021ABG IC

MXIC mx29lv640ebti-70g IC

ESMT m12l128168a-azl1p10jy IC

gr-55 firmware link here's the roland gr-55's firmware

gr-55 schematics here's the roland gr-55 schematics

I think the R8A02021ABG could be the main cpu due to these forms (similar sythesizer internals). This person seems to have some of the same ic numbers, and hes saying the R8A02021ABG is the main processor, and that it's a sh3/sh4 7700 series processor. When I go to the link for his units OS website OS website for bk9 it tells me that the processor for that OS is a sh3 (sh 7727). It seems that ida pro does not have an option for a (sh 7727). I read another form from someone who said they also have a (sh 7727) in their unit, this website wont let me post any more links so if you type mpc500 os code in google and click link for mpc-forms.com, it's on the second page second comment down. This person says they don't make a disassembler for the (sh 7727) and reverse engineering it would be impossible

My main goal is to be able to change some things in the roland gr-55's firmware, like changing some of the names to make things easier to understand so I can make music in peace. Is what i'm trying to do even possible or am I just giving myself a headache for no reason. Sorry if the post is confusing, and for the excessive links. If anybody can give me any info I would appreciate it.

Answer 1

The firmware is compressed, so it is no wonder that up to this point attempting to determine the target CPU of the firmware has been so troublesome.

A signature scan reveals a signature associated with LHA compression:

$ binwalk gr55.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
4             0x4             LHa (2.x) archive data [lh5] [NSRL|LHA2]

lhasa can be used to decompress the file, which produces a file called appli.bin. A signature scan of this file produces the following results:

$ binwalk appli.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2229080       0x220358        Ubiquiti partition header, header size: 56 bytes, name: "PARTITION#", base address: 0x00040000, data size: 524288 bytes
3513280       0x359BC0        Copyright string: "Copyright"
3527064       0x35D198        Broadcom 96345 firmware header, header size: 256, board id: "   1/8", ~CRC32 header checksum: 0x43452043, ~CRC32 data checksum: 0x43452042
3579113       0x369CE9        VxWorks symbol table, big endian, first entry: [type: uninitialized data, code address: 0xE00, symbol address: 0x13C18800]
7197404       0x6DD2DC        Copyright string: "Copyright Kobe Steel Ltd."
7252974       0x6EABEE        Copyright string: "Copyright 2004 TEPCO UQUEST, LTD."

Be aware that some may be false positives. For example, I believe that Broadcom 96345 firmware typically targets MIPS CPUs in routers. Further investigation is required. An entropy scan of appli.bin reveals that it is not compressed or encrypted:

There is quite a bit of string data in this binary, some of it potentially interesting. For example, this bit:

$Id: k_version.c,v 1.3 2010/09/22 13:10:33 shigeno Exp $
  SHELL for iTRON ver 1.01
===========================================================
  Copyright 2004 TEPCO UQUEST, LTD.

Tepco Uquest is a Japanese company that develops middleware for embedded devices.

A search for "SHELL for iTRON ver 1.01" results in this:

There is quite a bit of technical information contained in this document; for example on page 71:

It may contain information relevant to identifying the CPU, as the SH (SuperH) family of CPUs is discussed (Renesas SH7145, SH7727).

Radare2 supports the SuperH instruction set.

Other strings include things like this:

St.Piano 3
St.Piano 4
St.Piano 5
Brite Piano
Stage Piano
Honky Tonk
LoFi Piano
Piano 1 w
European Pf
Piano 2 w
Honky-tonk
Honky-tonk w
Pop Piano 1
Pop Piano 2
Pop Piano 3
Piano 3 w
Stage EP 1
Stage EP 2
Stage EP Trm
Tremolo EP 1
E.Piano 1

Perhaps there is no need for reverse engineering, just patching strings.