Analog Way LivePremier / Aquilon

Verdict. Hardware, and the manufacturer says so in its own source comments. RS models are factory-fixed card lists; C, C+, Cmax and Cmini are the same chassis in configurable form. One firmware package covers the family, cards are discovered and their FPGA designs matched at boot, and the machine is whatever is plugged into it. The architecture is a clean three-layer split: a COM Express Xeon-D module for the application and web interface, an ATSAM per card for local control, and Arria 10 GX fabric doing all the video behind a lane-based crosspoint. Its most useful property for anyone studying it is accidental — the web bundle was shipped with comments, and those comments document 387 internal enumerations of a machine whose firmware is otherwise sealed. A physical Aquilon C has since confirmed the useful half of that from the outside: the control protocol will not enumerate its own object model, the front end that ships with the device gives it up in full, and every write is broadcast to every client watching.

Method

Two bases, deliberately kept apart. The architecture findings are static: the vendor update package is AES-encrypted and was not decrypted, and what is known comes from the vendor's simulator, which bundles eleven complete device software trees whose web interface shipped unminified with its source comments intact, including a generated file documenting 387 internal enumerations. Since 2026-08-20 there is a second basis: a physical Aquilon C on our LAN, read over the documented AWJ control protocol and over the undocumented WebSocket its own front end uses, and later driven through a full write chain with every touched value restored. Rows labelled measured came off that unit. Every claim about the card silicon, the update package and the other ten firmware trees is still file-only.

Artifacts examined

• AQL_Updater_6_2_73.awp, 751 MB — encrypted; statistics only
• AW LivePremier Simulator.app — eleven firmware trees from 3.0.255 to 6.1.59, each carrying the device application and the web bundle the device itself serves
• dist/client/app.*.js — the unminified web bundle; variables-webapp.enum.json revision 69.0.0-dev.0, generated from C:\Projets\NLC\wa-nlc-data-objects\resources
• AW_APP_SIMULATOR — the 21 MB Qt/Node device binary, for the enum value strings the web bundle does not carry
• The AWJ Protocol Programmer's Guide v4.0 — Analog Way's own published control documentation, which is why the protocol rows below are partly public rather than recovered
• app..js, served by the device itself — roughly 22 MB of unminified webpack output, 8,105 concatenated modules that keep their original TypeScript paths and __Generated__ headers. Around 2,040 device-object module paths, each carrying an attribute table with the type, minimum, maximum, default, read-only flag and enum of every property
• Read-only AWJ captures from the Aquilon C — the running and the staged VPU mixer maps, and the shape (not the contents) of every top-level store collection

No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See the method and legal statement for the basis on which this analysis was performed and the boundaries it observes.

Hardware architecture

Software architecture

Update path & security model

These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.

What is programmable

1. 1The AWJ control API

   The whole device model is a JSON tree over a documented interface, and the web client that drives it ships unminified with the generator's comments intact — which is the only reason the model is reachable at all, since AWJ itself will not enumerate a container. This is the most thoroughly self-documenting machine in the index, everything useful about it is reachable without touching the encrypted package, and both halves have now been exercised on a real Aquilon C.

2. 2Standards-based transport

   ST2110, NMOS, NDI, SDVoE and Dante are all first-class. Anything that wants to get pictures or audio in or out of this platform should do it through one of those rather than through the vendor's own plumbing.

3. 3Nothing inside the frame

   Arria 10 designs delivered inside an encrypted package, matched to card identifiers at boot, with an ATSAM gatekeeping each card. There is no third-party route into the video path and no reason to look for one.

Traps

Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.

• Going after the encrypted 751 MB package first. It is the obvious artifact and it yields four statistics; the simulator sitting in /Applications carries eleven complete firmware trees and a web bundle that was never minified. Check what the vendor already gave you before attacking what they locked.
• Taking AQL and NLC for different products. They are the same platform — NLC is the internal name and appears in the code, the build paths and the web app manifest, while AQL appears only in user-facing labels. Searching for one and not the other halves what you find.
• Assuming the enum names and the enum value strings live together. The binary holds the names ENUM_CHASSIS_TYPE, ENUM_CARD_FEBE_MEZZA_TYPE and so on in one table and their values in another, hundreds of kilobytes apart. Grepping for the name and finding nothing useful around it suggests the values are absent when they are simply elsewhere.
• Reading the 64-entry scaler enumeration as sixty-four independent layer engines. They are four processing cards × eight mixers × an A/B pair, and the pairing is what makes a main-and-preview transition possible. The flat list hides the structure that matters.
• Grepping the front-end bundle. BSD grep fails silently on its multi-megabyte lines — no match, no error, no indication anything went wrong. Everything that reads that bundle has to do it in a language that does not care how long a line is.
• Reading a limit off the error oracle. It answers for the model rather than the chassis and contradicts the device's own declared dimensions; two of the four memory banks were nearly recorded at the wrong size this way.
• Matching a write's acknowledgement on true instead of on the value written. Triggers are boolean, labels are strings and every master-store filter is an array, so a client that only accepts true reports labels and filters as unconfirmed forever while they land perfectly. It cost a real bug, and only hardware showed it.
• Waiting for a keep-alive frame to identify the client's socket. It only pings after three seconds of silence and a live device never goes quiet, so a hook installed late waits forever. Adopt on the first frame instead.

Open questions

• What VDW_* is. Three chassis variants with a dedicated FORCE_VDW processing mode, no product page and no artwork. Video-wall is the obvious guess from the initials and it is only a guess.
• Whether the boot-time card and design check is cryptographic. CheckFpgaDesign and the MISMATCH state prove a check exists; nothing in the files says what it compares.
• The Arria 10 part per card role. _66 clearly marks the 660K die on the output designs, which implies the unsuffixed designs target something smaller, but the specific parts are not named anywhere.
• How much of the simulator's behaviour is the real firmware. It is a build of the device application, not a reimplementation, but it has been compiled for macOS and the boundary between simulated and real was not mapped.
• The .awp key, which is on the device side and was not pursued.
• What the mixer model does outside the two configurations we read. Link setups (devices 2–4), capacities other than 4K and 5K, combined VPUs, Optimized mode and Cut & Fill are all unexercised — and the second configuration we did read corrected two things the first had made look settled, which is the reason to distrust a one-chassis model.
• Whether the path-existence oracle can be trusted for anything beyond existence. An unknown path answers with an error code, which gives a free existence check — but it reports the model's maximum rather than what the chassis has configured, and it disagrees with the front end's own declared dimensions. Useful for diffing firmware path tables, useless for limits.

Related entries

• Analog Way Midra series — Video presentation switcher
• Analog Way LiveCore — Video presentation switcher
• Blackmagic Design ATEM (switcher family) — Live production video switcher