Hi swiftb0y, thanks for the documentation you made! It's been the reference for a
project reverse-engineering CDJ HID control I am working on together with some LLM-assistance. During the process I used a CDJ-3000 and I noticed the "contributions wanted" note on the handshake page (https://swiftb0y.github.io/CDJHidProtocol/hid-analysis/handshake.html).
I captured both handshakes for Serato and Rekordbox for the CDJ-3000:
CDJ3000 / Serato = 390EAC84A745F29D7F74
CDJ3000 / NativeInstruments = 0B540B224A0AD0F73177
Captured on a macOS laptop using tshark on XHC0/XHC1 USB interfaces. Both decode with the FNV-1a scheme and TLV framing your
docs describe, using stage_base=0x10 (stages 0x11-0x15), same as the NXS2 generation.
Sample of the Serato exchange (0x11-0x15, header trimmed of zero padding):
0x11 announce CDJ->host 00 f0 01 00 01 00 11 06 01 04 03 14
0x12 challenge host->CDJ 00 f0 01 00 01 00 12 27 01 08 53 65 72 61 74 6f
02 0b 73 65 72 61 74 6f 20 44 4a 03 12 05 0b 09
0e 01 06 03 0c 06 07 0c 05 0e 0c 02 01
0x13 response CDJ->host 00 f0 01 00 01 00 13 2a 01 0b 50 69 6f 6e 65 65
72 44 4a 02 09 43 44 4a 33 30 30 30 04 0a 08 04
00 0e 01 02 07 0f 03 0a 09 01 03 0d 0d 04 02 04
0x14 host-resp host->CDJ 00 f0 01 00 01 00 14 35 01 08 53 65 72 61 74 6f
02 0b 73 65 72 61 74 6f 20 44 4a 04 0a 02 0f 0e
05 05 02 06 01 05 16 03 09 00 0e 0a 0c 08 04 0a
07 04 05 0f 02 09 0d 07 0f 07 04
0x15 confirm CDJ->host 00 f0 01 00 01 00 15 02
I will attach some pcaps if it allows me (trimmed to a window around each handshake for size; each is
100-1000 frames, well under 1MB, includes real surrounding traffic for context, not
just the isolated handshake frames).
Surprisingly the CDJ-3000X does not seem to require a handshake anymore.
Let me know if you are interested in other captures or information to map out the HID protocol of these devices.
traktor_serato_cdj3000_capture.zip
Hi swiftb0y, thanks for the documentation you made! It's been the reference for a
project reverse-engineering CDJ HID control I am working on together with some LLM-assistance. During the process I used a CDJ-3000 and I noticed the "contributions wanted" note on the handshake page (https://swiftb0y.github.io/CDJHidProtocol/hid-analysis/handshake.html).
I captured both handshakes for Serato and Rekordbox for the CDJ-3000:
Captured on a macOS laptop using tshark on XHC0/XHC1 USB interfaces. Both decode with the FNV-1a scheme and TLV framing your
docs describe, using stage_base=0x10 (stages 0x11-0x15), same as the NXS2 generation.
Sample of the Serato exchange (0x11-0x15, header trimmed of zero padding):
I will attach some pcaps if it allows me (trimmed to a window around each handshake for size; each is
100-1000 frames, well under 1MB, includes real surrounding traffic for context, not
just the isolated handshake frames).
Surprisingly the CDJ-3000X does not seem to require a handshake anymore.
Let me know if you are interested in other captures or information to map out the HID protocol of these devices.
traktor_serato_cdj3000_capture.zip