Let's Decode a VST (opens in new tab)

This is the format of patch files for Propellerhead's Scream 4. It is just a serialization format for the settings of the knobs. Not exactly the same as "decoding a VST".

Pretty unusable on mobile - my phone keeps trying to either start a phone call to the “number” of the byte sequence I clicked on, or it tells me (repeatedly) that the site has been blocked from making calls, after I have canceled out a few times.

> = 0072 + 2 * (filenameLength // 2)

I'm having a hard time understanding what is meant by this. Particularly when 114 is the size of the patch after the 8 header bytes. The description also seems to get the word size wrong by treating the first 4 bytes as a NULL-terminated string.

A 4-byte ID and a 4-byte big-endian length is almost universal for audio data. There's even a Python module[1] for it. And it's often nested, so within a chunk of data will be smaller chunks described the same way.

The more complete and easier to analyze description of this patch would look like:

    "FORM" (114)
      "PTCH"
      "CAT " (4)
        "REFS"
      "DESC" (35)
        [BC 01 03 00 00 FF] -- ?
        (2) "17" -- File name
        (19) "Scream 4 Distortion" -- Patch name
      "PARM" (37)
        [BC 01] -- Another BC01
        (15) -- Number of params that follow
        [01 01]
        [02 3E]
        [03 00]
        [04 3E]
        [05 1E]
        [06 00]
        [07 00]
        [08 00]
        [09 00]
        [0A 00]
        [0B 69]
        [0C 28]
        [0D 00]
        [0E 00]
        [0F 55]
        [00]
      "BODY" (0)

(In fact, "FORM" is the header used by AIFF files.)

So a patch is a CAT, a DESC, a PARM, and a BODY (required even if not used). The number and meaning of parameters will depend on the type of effect, but from this we can guess they're all byte-sized, though a mix of signed and unsigned. The 0 byte after the list is a bit of a mystery.

The meanings of these parameters I assume was found by changing a value then seeing which byte changed in the file. The next step will be to compare a patch from a different effect. Even better to find one that makes use of the BODY section. Another fun way of reversing a format is to modify an unknown byte then see what happens when it is loaded.

As for the way the website is presented, I think it would be helpful if the description activated by clicking on a byte instead of hovering. That would make it possible to then select and copy the description. (Truthfully, I'm increasingly convinced that hover effects in general are bad UX.)

[1] https://docs.python.org/3/library/chunk.html

This concrete page doesn't offer much (not sure why anybody needs to know how VST effect serializes its data in general), but the simplicity of it made me look into other site topic.

Assembly in 7 minutes is great:

http://adamkulidjian.com/vlahb.html

Not sure what are the problems with mobile version that people complain, but I wish more sites are like this, simple and strait to the point.

I look forward for new articles. Keep up the good job m8.

The file format used in the song files of Rebirth by proppelerhead is similar, they are based on the.iff format created by EA. Propellerhead released a document in the late 90s describing the format, I found a copy in this GitHub repo: https://github.com/nsauzede/jsynth/blob/master/RBS42.txt

Is something missing on mobile or is this literally just decoding a few bytes from a patch?

Has anyone got some similar info for sylenth 1? I have a lot of patch backs for it, but they are not ordered in what I would consider a sensible way - random distributions of different types of patch in a bank. I extracted loads of them and sorted them into folders, but what I want to do is then put them back into banks (such as a bass bank, etc), but there's no way to do this quickly in sylenth other than to load them all in manually and then save the bank.

I can't make sense of the data in existing individual patches or banks (I did some single value changes and resaved and the file was completely different), so it's probably above my pay grade, but if anyone has some ideas they would be appreciated.

(I'm a simple amateur python programmer, for the record)

Please change the title

Disappointed, but I would love to get some real insights into the workings of the VST format (not the patches) and its history. Apparently this is not about patch files for VST plugins (.fxp), but about PHs proprietary patch file format. So I don't understand what this has to do with "a VST". Patch files are the least interesting part about audio software anyway, aren't they?

0072 = 0072 + 2 * (filenameLength // 2)

That's wrong. filenameLength is 2, so that equation would come out to 74, not 72.