Platform index / Installed system processor
Allen & Heath AHM-16 / AHM-32 / AHM-64
The install processor whose control surface is half published. Allen & Heath document levels, mutes, routing crosspoints, preset recall and source selection — and nothing at all for EQ, delay, dynamics or metering. The other half lives in System Manager's own protocol and in its configuration files, and only the files have been opened.
The load-bearing finding. A .cfg system file is gzip → tar, and the model is carried by the filename of a zero-byte member. Inside, CurrentSettings.dat names the entire per-zone chain in plain text — delay, parametric EQ, xGEQ, GEQ-PEQ, compressor and side chain, insert, limiter, allpass — and not one of those blocks' field layouts is decoded. No firmware image has been opened and the silicon is unknown.
Verdict. The lopsided one. This is the only platform in the index examined entirely from the desktop software that configures it, and it shows: the control surface Allen & Heath publish is fully implemented and needed no reverse engineering at all, while everything a system processor exists to do — EQ, delay, dynamics, metering — is present here only as a list of block names and the byte gaps between them. The container is solved, the parameter model is named, and no parameter is decoded. Nothing is known about the silicon, and nothing from the SQ, Qu or Avantis transfers on the strength of the badge.
Method
Static analysis of files that ship inside AHM System Manager 1.61 on macOS — the six factory .cfg configs from FactoryConfigs{,16,32}/ — cross-read against Allen & Heath's published AHM TCP/IP Protocol V1.0. No AHM hardware was involved: none is available and none is expected, so every method has to work from files alone. The firmware images in the System Manager bundle have not been opened. Protocol behaviour was exercised only against our own simulator built from the same published document, which demonstrates self-consistency and not hardware compatibility.
Artifacts examined
AHM System Manager 1.61(macOS) — a Qt 6 application, licensed and installed on our own machine; no Allen & Heath file is redistributed- Six factory configs —
AHM-16/32/64 Default.cfgandAHM-16/32/64 Empty.cfg, format versionV1.6X - Rev. 92182 - Build. 30 Firmware.tar.xz(26 MB) andIP1/IP4/IP6Firmware.bin(~440 KB each), present in the System Manager bundle — referenced only; neither opened- AHM TCP/IP Protocol V1.0 — Allen & Heath's published specification
No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See the method and legal statement for the basis on which this analysis was performed and the boundaries it observes.
Hardware architecture
| Item | Finding | Confidence |
|---|---|---|
| Model range | One platform in three sizes — AHM-16, AHM-32, AHM-64. Mixer.cfg geometry scales exactly with the model across all six factory configs: the mono/stereo pairing maps are N/2 characters and the two fixed lines are N and N/2 long for N = 16, 32, 64. The geometry is what confirms the size, not the badge | Verified |
| Silicon | Not established. Nothing in this analysis identifies a CPU, DSP, FPGA or memory — no AHM firmware image has been opened. The SQ, Qu and Avantis findings in this index are not evidence about a rackmount install processor and are not carried across | Unknown |
| I/O classes | Three are named inline in CurrentSettings.dat, each numbered per instance: $Unit Analogue Input, Port B Digital Input and Unit SLink Digital Output — local analogue in, an option-card digital input port, and A&H's SLink expansion bus on the output side | Verified |
| Port controllers | IP1Firmware.bin, IP4Firmware.bin and IP6Firmware.bin, ~440 KB each, ship inside System Manager 1.61. IP1/IP4/IP6 is the same port-controller naming the Avantis package flashes from its host, so these are near-certainly the AHM's I/O port controllers rather than the main application — but neither image has been opened and the correspondence rests on the naming alone | Inferred |
| Main firmware | Firmware.tar.xz, 26 MB, plain xz, in the System Manager bundle. Its size relative to the port-controller images makes it the main application, and nothing beyond that is established: not its contents, not its packaging, not what it runs on | Unknown |
Software architecture
| Item | Finding | Confidence |
|---|---|---|
| System Manager | AHM System Manager 1.61 for macOS — a Qt 6 application with its QML compiled into the binary (the bundled Resources/qml tree is stock Qt, not the app's own). It carries the AHM firmware images and the six factory configs inside its own bundle | Verified |
| Config container | A .cfg system file is gzip → POSIX tar with a fixed archive/ member set: Mixer.cfg (plain-text geometry), Version.txt, a unit-type marker, CurrentSettings.dat, Scene1.dat, and a Devices/ directory that is empty in every factory file. A reader for the container parses all six | Verified |
| Model marker | The model is carried by the filename of a zero-byte member — archive/UnitType_AHM-64-Unit.txt has no contents. Reading the file gets you nothing; the name is the field, and it agrees with Mixer.cfg's geometry in every factory config | Verified |
| `Mixer.cfg` | Six CRLF-terminated lines: a MixerConfigV2 magic, two N/2-character mono/stereo pairing maps (m mono, S stereo, one character per channel pair), a decimal count, and two fixed fill lines of N and N/2 characters | Verified |
| `Mixer.cfg` line 4 | An independent field of undetermined meaning. On the three Empty configs it equals N, which reads as two per map slot — but no per-slot weighting reproduces the Default configs (12 / 24 / 52 against 14 / 30 / 60 for mono=2 stereo=1, or 12 / 28 / 56 for mono=2 stereo=0), and the shortfall tracks neither N nor the stereo count. It is parsed verbatim and nothing downstream depends on it | Unknown |
| Parameter blobs | CurrentSettings.dat and Scene1.dat are a fixed-layout struct dump, not a tagged format. Sizes differ between Default and Empty for the same model — 543,794 vs 567,365 bytes for the AHM-64's CurrentSettings.dat — so the blobs are not a fixed-size image and carry length-varying content, most plausibly name and label regions | Verified |
| Named processing chain | The blobs store their block labels inline, which gives the per-zone parameter model for free: Mix Delay, Parametric EQ, xGEQ, GEQ-PEQ, Compressor, Compressor side chain, Insert, Limiter, Allpass EQ, and Source Select Controller. Every block worth targeting is named. Not one field layout inside them is decoded | Verified |
| Record strides | In the AHM-64 Default file the input-unit records begin at 0x834A on a 38-byte stride, and the source-selector slots are on a 17-byte stride. The zone-processing labels that follow sit at irregular offsets, and the gap to the next label bounds each block's payload: 25 bytes after Mix Delay, 250 after Parametric EQ, 635 after xGEQ, 245 after GEQ-PEQ, 137 after Compressor, 21 after Insert, 27 after Limiter | Verified |
| Published control protocol | AHM TCP/IP Protocol V1.0 is SysEx over TCP under the 00 00 1A Allen & Heath manufacturer ID. Strips are addressed as a MIDI channel plus note number — inputs on channel 0, zones on 1, control groups on 2 — with messages for mute, level, level increment, send level and send mute, preset recall, audio playback and source select. The source-select reply adds a colour byte and an ASCII name | Public |
| What the protocol omits | There is no published message for PEQ, GEQ, delay, compressor, limiter or metering, and no way to read a channel or preset name back. The published surface is levels, mutes, routing crosspoints, preset recall and source selection, and it stops there. Everything else travels over AHM System Manager's own protocol, which Allen & Heath do not publish | Public |
| Level curve | LV = floor(((dB + 48) / 58) × 127), covering −48 dB to +10 dB in a single 7-bit byte, with 0x69 (105) at unity. It truncates; it does not round, and the manufacturer's own reference table only reproduces under truncation | Public |
| Verification basis | The protocol implementation is exercised against a simulator built from the same published document. That demonstrates the two agree with each other; it is not hardware verification, and nothing on this page has been confirmed against an AHM | Verified |
Update path & security model
| Item | Finding | Confidence |
|---|---|---|
| Control-plane authentication | Two published ports. TCP 51325 is plaintext with no authentication of any kind. TCP 51327 is the TLS variant and expects a user profile (0x00–0x1F) and password first, replying AuthOK or dropping the link. Only the open port has been implemented here | Public |
| Firmware validation | Unknown, and deliberately not assumed. No AHM firmware image has been opened, so nothing is established about packaging, checksums or signing. The unsigned, CRC-or-MD5-only posture documented on the SQ, Qu and Avantis is a finding about those platforms and says nothing about this one | Unknown |
| Configuration files | The .cfg container carries no signature, no checksum member and no obfuscation — it is an ordinary gzip tar. What makes a system file opaque is that its .dat payloads are an undocumented fixed-layout struct dump, not that they are protected | Verified |
These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.
What is programmable
- 1Interoperability — and half of it is already published
Levels, mutes, input→zone and zone→zone crosspoints, preset recall and source selection are all in Allen & Heath's own document, and a complete system controller has been built from that document alone. Nothing in that half requires reverse engineering, and it is the half most integration work actually needs.
- 2The
.cfgfield layout — the cheapest route to the other halfThe system file is the same parameter model at rest, and it is fixed-layout, so byte offsets are stable between saves of one model. That makes System Manager itself the oracle: change one parameter, save, diff. Deterministic, offline, no hardware and no network. The prerequisite is the save-to-save noise floor — what the application rewrites even when nothing changed — because until that is known no later diff can be read.
- 3System Manager's own protocol
Discovery, identity and the session handshake are the gate; past it the application synchronises the whole system state, which would be every parameter in protocol form. None of that wire format is known — not how units are discovered, not what identity a unit must present, not what handshake precedes the parameter stream.
- 4Firmware, last and unopened
26 MB of plain xz plus three ~440 KB port-controller images sit in the System Manager bundle. Reading a parser is the reliable way to resolve a handshake and far more work than watching one, which is why it is last — and it is also why every hardware question on this page is currently unanswerable.
Traps
Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.
- Trusting a run of printable bytes in a
.datto be one field. The string fields are fixed-width and are not cleared on write, so a short value leaves the tail of its predecessor in place and rawstringsoutput is full of chimeras —Unit AnalSource3,ue InputSource13. A naive extractor does not fail visibly; it produces confident nonsense. Read the record stride, not the text: the source-selector slots are on 17 bytes. - Deriving
Mixer.cfgline 4 from the pairing maps. On the three Empty configs it equals the model size exactly, which reads as two per map slot and confirms beautifully — on half the sample. No weighting reproduces the Default configs as well. Validating a rule only against the subset that suggested it is what makes this one plausible enough to ship. - Assuming the published level formula rounds. It truncates. At −40 dB the manufacturer's table gives 17 where rounding gives 18, and at −45 dB it gives 6 where rounding gives 7 — an off-by-one visible on two printed rows and nowhere else. The truncation then needs an epsilon in floating point: without it byte 3 lands at 2.9999999999999996 and a byte → dB → byte round trip silently loses a step.
- Reading "500 presets in four banks of 128" as 512 slots. The fourth bank runs 385–500, so it holds 116. A recall grid that offers all 128 in bank 4 is offering twelve presets that do not exist.
Open questions
- The hardware, entirely — CPU, DSP, FPGA, memory, boot. No firmware image has been opened, and the other Allen & Heath platforms in this index are not evidence about a rackmount install processor.
- Every
.datfield layout. The blocks are named and their sizes are bounded; not one parameter's offset, encoding or scale is known. - Whether the 250-byte gap after
Parametric EQ, Zone NNis an 8-band PEQ at roughly 28 bytes per band. It fits the arithmetic and it has not been tested — the gap is an upper bound on the payload, not a measurement of it. Mixer.cfgline 4. It is an independent field, and no weighting of the pairing maps reproduces all three Default configs.- The whole of System Manager's wire protocol: how it discovers units, what identity a unit must present to appear in its device list, and what handshake precedes the parameter stream.
- Whether a unit echoes a level or mute write back to the client that sent it. It is undocumented, and it changes how any controller has to be written — ours does an explicit debounced read-back rather than rely on an echo. Preset recall is documented as echoed to everyone.
- Two rows of Allen & Heath's own published level table disagree with the formula printed in the same document — +5 dB (table 118, formula 116) and −47.5 dB (table 0, formula 1). Neither can be settled without a unit.
Status of this entry. Substantial findings recorded, but whole subsystems remain unexamined. Nothing on this page has been verified against physical hardware — no unit of this platform has been opened, connected to or modified.