04 // THE UNDERGROUND · MODS · HACKS · DEV · DIY

The Underground

Under the plastic is a quad-core Rockchip Linux computer, and since September 2026 a small crew on MPC-Forums and GitHub has been mapping it: root shells over USB, the full panel protocol, and a from-scratch Sample Mode running from RAM. This page is the field guide, with every claim linked to the person who proved it.

Read before you touch anythingEverything here is unofficial and can void your warranty. The safe tier changes nothing on flash and a reboot returns the unit to stock, but a root shell can still damage the device. Back up your projects first. Never flash firmware from strangers, never share private keys or prepared SD cards, and don't redistribute Akai's binaries: every project linked here ships only its own code. Validated on firmware 1.3.0.12 only.

4.1

Risk ladder

Climb only as high as you need. Tiers 1–5 leave flash untouched (reboot = stock). Tier 6 is where bricks live.

Tier	Access	Writes flash?	Status
1	Web updater + USB-MIDI control	No	official
2	Project/kit tools on your computer (.xpj)	No	verified
3	Root SSH via SD autorun (RAM-only)	No*	verified, 1 unit
4	Custom app in RAM via `systemd-run`	No	verified
5	Byte-patched stock app, bind-mounted from RAM	No	scaffold
6	Persistent firmware / rootfs mods	Yes	blocked by signing

*Normal OS activity can still write to /data. A root shell can write anywhere it wants; stay out of /factory.

4.2

What's inside

Model AC50 on inMusic's AZ07 platform, from firmware analysis and read-only inspection of live units.

software stack

U-Boot (inMusic build) · FIT signed sha256,rsa2048 key "akai-1"
 └─ kernel 6.12.60-rt (PREEMPT_RT) + dm-verity rootfs
    └─ Yocto "AZ0x" 5.0.14 (scarthgap) · BusyBox · systemd
       ├─ ac50.service
       │   └─ launch-ac50 → az0x-firmware-tool (flashes panel MCU fw)
       │      └─ "/usr/bin/MPC Sample" 119 MB AArch64 · JUCE 5.4.4
       ├─ az0x-webserver.service → /var/www/ac50 (updater UI)
       └─ sshd (installed, not started by default)

Partition map

spl1/2 · env1/2 · uboot1/2 (A/B redundancy) · factory (never touch) · boot · recovery · rootfs (dm-verity, any write breaks boot) · content (factory library) · data = /var/lib (your projects).

The app opens ALSA hw: devices directly: "Audio 44100Hz; 4-in; 4-out; 128 sample buffer" (I2S stereo + USB stereo). There's no amixer on the device.

Sources

4.3

Firmware anatomy

Why you can't just edit the rootfs and reflash it.

The updater onion

Windows updater = 7-Zip SFX (real archive at offset 0x34445) holding update.img, FirmwareUpdater.exe, libusb and a Config.json that names the CHOP + MUTE + SAMPLE SELECT boot combo.
update.img: an AZ0x container for product AC50: bootloader, recovery, boot and rootfs payloads (last three XZ-compressed ext images; rootfs ≈ 408 MiB).
The header holds a SHA-256 for every payload, and the header is RSA-2048 signed (PKCS#1 v1.5 over bytes 0x000–0x190, key akai-1).
Edit a payload → its hash changes → the signature breaks → the updater refuses it. Unpacking: solved. Repacking: blocked.

Tools (read-only)

# jrold/MPC-Sample-RE: unpack an updater you downloaded yourself
python tools/extract_updater.py "MPC Sample 1.3.0 Updater.exe"
python tools/parse_update_img.py work/updater/files/update.img
python tools/scan_mpc_binary.py "rootfs/usr/bin/MPC Sample"

# gospodindilly-ops/mpc-sample-lab
python tools/az0x.py Update.img      # parse/unpack AZ0x
python tools/rbin.py UpdateImage.rbin # panel MCU firmware

The panel MCU has its own image (UpdateImage.rbin, "!Rbn" blocks with CRC32 regions: bootloader 1.0.0.022, app 1.0.0.051).

4.4

Root SSH over USB

By puckcv (MPC-Forums), packaged as orrpunk-art/mpc-sample-root-ssh. It starts the OpenSSH server already on the device through the stock SD autorun mechanism. No flashing, no modified Akai binary.

How it works verified

Download the release ZIP (v1.2.0 fixed a cold-boot hang). Read the scripts first.
sh setup_unix.sh (or setup_windows.ps1) generates your own client key and a separate host key. No shared keys, no root password.
Copy the generated autorun/ folder (autorun.json, autorun.check, autorun.sh, keys) to the root of an exFAT microSD.
Insert the card, connect USB-C data, wait up to ~45 s for USB networking.
SSH in. Config, keys and logs live in /run (RAM) and vanish at reboot.

host → MPC (USB link)

# on your computer, inside the extracted release
sh setup_unix.sh
# → copy ./autorun to the SD root, boot the MPC with USB connected
ssh -p 2222 -i ~/.ssh/mpc_sample_client_ed25519 root@192.168.155.1
id                     # uid=0(root)

first look (read-only)

cat /etc/os-release
uname -a
systemctl status ac50.service --no-pager
df -h; ls "/media/MPC SAMPLE"
# copy a file in without sftp (none installed)
ssh -p 2222 -i ~/.ssh/mpc_sample_client_ed25519 root@192.168.155.1 'cat > /run/tool' < tool

GotchasSSH is key-only and bound to the USB address. Pulling the card doesn't stop a running server; reboot does. Booting without the card = stock. The SD is mounted noexec, so binaries run only from /run or /tmp. Validated on one unit at 1.3.0.12 (two cold boots); other firmware is untested.

Two autorun storiesThe verified mechanism is autorun/autorun.json + autorun.check at the SD root, checksummed with a firmware-specific salt. The patcher project describes a different "Script detected: do you want to run it?" prompt for scripts/autorun; mpc-sample-lab notes that path doesn't match the verified one.

4.5

The factory test-app path

What's in the stock image unconfirmed on AC50

/usr/bin/test-app-launcher and an enabled az0x-webserver with web auth disabled in the AC50 config.
A multipart upload form at http://192.168.155.1/testapp (field file) whose config stops ac50 and runs test-app-launcher --testapp-path=….
The launcher parses inMusic's V2 package schema, and both signed and unsigned code paths are compiled in. The same schema accepted unsigned packages on sibling inMusic Engine OS hardware.
Never upload a test package to /software-update: that endpoint wants a signed firmware image.

manifest.yaml (experimental probe, from MPC-Sample-RE)

testApps:
  - version: 0.1.0
    osVersionID: scarthgap
    products:
      - AC50
    signedImage: False
    basePath: test-apps/ac50
    relativeExePath: AC50TestApp
    launcher-XXXXXX: MPCSampleRE
    name: MPC Sample RE Probe

4.6

RAM-only custom firmware

mpc-sample-lab rebuilt Sample Mode from the manual as a ~100 KB static AArch64 binary. It runs instead of the stock app and never writes flash.

8×16pads, 32 voices

3.3%of one core

124 µsrender of 2902 µs budget

0underruns

37 MBRSS

~100 KBbinary (zig cc)

Stage 1 implements

Envelopes, tune, mono/poly, mute groups, loop, reverse, Note On; B1–B3 pages, K1–K3, encoder, fader (pad volume); LEDs; waveform + envelope display. Loads the first 128 WAVs (44.1 kHz) of a folder onto banks A–H. Next on the roadmap: filter, Chop, 16 Levels, browser, recording, sequencer, FX.

cd firmware && make test   # host self-test, ASan/UBSan
cd firmware && make        # static aarch64 binary via zig cc

the safe-swap template

ssh -p 2222 -i ~/.ssh/mpc_sample_client_ed25519 root@192.168.155.1 \
 'systemd-run --unit=mpcfw --collect -p RuntimeMaxSec=900 \
  -p ExecStartPre="/usr/bin/systemctl stop ac50.service" \
  -p ExecStopPost="/usr/bin/systemctl start ac50.service" \
  /run/mpcfw "/media/MPC SAMPLE/folder"'
# systemd stops the stock app, runs yours, and ALWAYS restarts the
# stock app on exit, crash or time limit

4.7

Patching, boot menu & UI kit

mpc-sample-patcher scaffold

Ships only offsets + bytes, never Akai code. It verifies your stock /usr/bin/MPC Sample by size and SHA-256, patches a copy in /tmp, bind-mounts it over the original, backs off after 2 failed starts, and reboot restores stock. Not yet run on hardware. Explicitly out of scope: code signing, licence or activation checks.

mpc boot thingy

A boot menu so custom firmware and apps can coexist: install several, then pick one from a menu on the device. It includes a small web page for managing entries. VIDEO

mpc-ui-toolkit

A C library for the 320×240 panel: boxes, buttons, soft keys (B1–B3 aligned to the top edge), K1–K3 value boxes, lists, a 4×4 pad grid, hold-to-open menus, and a pad multi-tap text editor. Terminus font, about 50 ms per full SPI frame. The examples include Sudoku.

4.8

Control-surface protocol

The pads, buttons and knobs are a separate microcontroller that speaks plain 3-byte MIDI to the Linux side over a 4 Mbit/s UART, which shows up as ALSA rawmidi "Control Surface". It streams events even with the stock app stopped; no handshake needed.

Input	Message	Notes
Pad hit	`99 nn vv`	Ch 10 note-on
Pad pressure	`A9 nn pp`	Poly aftertouch, sent on change
Pad release	`A9 nn 00` → `89 nn 00`
Button	`90 nn 7F` / `80 nn 00`	Ch 1, 24 inputs
MAIN VOLUME	`B0 13 vv`	CC 19: volume is software
K1 · K2 · K3	`B0 10/11/12 vv`	CC 16–18, absolute 0–127
Fader	`B0 14 vv`	CC 20, absolute
Encoder	`B0 64 01\|7F`	CC 100 relative: +1 / −1

Output	Message	Notes
Button LED	`B0 <btn note> v`	Single: 0 off · 1 dim · ≥2 full. Bi-colour: 0–8 = 3·A + B
Pad colour	`F0 47 7F 5C 65 00 04 pp RR GG BB F7`	7-bit RGB, one pad per message
Init?	`F0 47 7F 5C 42 00 00 F7`	Sent before pad sweeps; purpose unclear
Auth	cmd `0x50`	XTEA challenge-response; key deliberately unpublished, not needed for your own apps
Service	cmds `0x60/0x70–0x73/0x79`	Do not send: serial / hardware-revision writes

Internal pad notes (ch 10) vs external MIDI

The panel sends the classic MPC drum-note layout; the app remaps it. Over the external/USB MIDI port, pads 1–16 answer 36–51 instead.

4.9

Pad colour SysEx builder

Pick a pad and a colour to get the exact bytes the panel MCU expects. Useful for your own apps (tier 4). Only meaningful on the internal Control Surface port with the stock app stopped. The external MIDI port belongs to the app.

Pad

Colour SysEx (hex)

On-device (root, ac50 stopped)

R, G, B are 7-bit (0–127); the MCU expands them to 8-bit as v·2+1. Find the port name with amidi -l.

4.10

Web MIDI pad tester

Drive a real MPC Sample from this page. On the device: → MIDI Port = USB, Pad MIDI In = On. Needs Chrome/Edge; serve the page over localhost or https if MIDI is blocked.

Output

Channel

Velocity

Pads → notes 36–51

Program change switches sequences when Receive Program Change = Sequence. Start/Stop affect the MPC only when it follows MIDI clock.

Monitor (incoming, hex): the MPC echoes what it receives (soft-thru)

> idle. press Connect MIDI.

Hardware behaviour (notes 36–51, port switch, echo) verified by micknoise. Their kit adds a CoreMIDI CLI, a pattern language with Euclidean rhythms and a full Web MIDI app.

4.11

Project files & desktop tools

Peek inside an .xpj

An MPC Sample project is a gzip-compressed .xpj plus a _[ProjectData] folder of WAVs. MPCTK parses it into project → track → instrument → layer → sample/slice models, and keeps unknown fields intact when it writes.

zcat "MyBeat.xpj" | head -c 1200
python3 -c "import gzip,sys;print(gzip.open(sys.argv[1]).read()[:1200].decode('utf-8','replace'))" MyBeat.xpj

Verified tuning limits on hardware: coarse ±24 semitones, fine ±90. MPCTK refuses banks outside them rather than let the unit clamp silently.

Tool rack

MPCTK: CLI + macOS app. WAV → chromatic or scale pad banks (major / natural minor) → playable project. hw-tested
MPC Sample Kit Maker: browser/Electron kit builder that exports .xpj. LIVE
mpc-sample-kit: algorithmic drums over USB-MIDI, Web MIDI app, latency measurements.
MPC2Live: MPC projects → Ableton Live Sets. DL
Padbangers project converter · Padhead chopper & kit export
BeatOS sample database · YT2TW pad chopper · Companion app

4.12

The hidden plugin host

The 1.3.0 app binary carries a surprisingly complete MPC/JUCE plugin-host layer: VST_PATH, /usr/lib/vst;/usr/local/lib/vst;~/.vst, VSTPluginMain, plugin-scan strings, EngineVst::loadProgram, ExpansionManager.showVST/showVST3, and engine names like MPC:Bassline, MPC:TubeSynth, FMSynth and GranularSynth.

Not proven: that the AC50 UI can reach it without patching feature gates, that the synth binaries are even in the rootfs (they aren't obvious), or that ARMv7 plugins from older MPCs would run on this AArch64 system. Treat it as shared-codebase residue until someone shows otherwise. speculative

4.13

Hardware mods & accessories

3D-printed stand / lid

A MakerWorld collection includes an "AKAI MPC SAMPLE – cover – raiser – stand" model. Check the comments for fit before printing.

MIDI adapters

You need TRS Type A ↔ 5-pin DIN. Label your adapters; Type B looks identical and won't work.

Field power

Any USB-C power bank that holds 5 V / 2 A gets you hours past the internal battery. Some cable/source combos only charge while the unit is off.

Silent mode

Plug anything into PHONES and the speaker mutes; headphone and line detect run on GPIO pins.

Sibling platform

MPC Sample shares inMusic's AZ0x OS with Denon/Engine DJ hardware. That scene has a Yocto BSP, QEMU emulation and test-launcher research, and its techniques often carry over.

Open call: teardown

No public battery-swap or full teardown photo guide found yet (Oct 2026). If you open one up, document the screws, battery connector and cell spec, and post it to the forum thread.