The short (painful) answer is to start with the default patch, change parameters one at a time, and look through the hex dumps to see what changed in the output. If you have a list of parameters that you care about editing most, start with those, because then you get something up and running quickly that has partial support. Then you can add more parameters over time as you identify them.
Specifically, to start:
- Dump out the default patch.
- Change a single parameter, then dump that out.
- Use the default patch as a template to create an editor that lets you select either the default value, or what you changed that value to.
- Change that parameter to its max/min values, and dump out patches for those. Hopefully that will give you enough insight to allow full editing of a single parameter.
- Repeat as needed.
Some parameters may be bit fields, some may be one or two bytes, etc. Having documentation for the general sysex format will be helpful, because some small parts will be dictated by that spec (as opposed to Yamaha specific). If you can find documentation for some other piece of Yamaha gear (esp. something released in the same time period), it may give you some insight into how they tend to design formats as a company. If you can't find something from Yamaha, even reading through documentation of the sysex format for some other company may help.
For example, taking a look at the hexdump of a couple patches from the Planet Groove archive, we can identify a few things just by inspection.
From looking at the midi spec, and both of these patches, it looks like all the patches are going to begin with
0xf0, and end with
0xf7. In addition, the
0x43 (which follows the
0xf0) is Yamaha's Manufacturer ID.
Table 2: Expanded Status Bytes List
Binary |Hex| Dec Function 2nd Byte 3rd Byte
11110000= F0= 240 System Exclusive ** **
11110111= F7= 247 End of SysEx (EOX) none none
** Note: System Exclusive (data dump) 2nd byte= Vendor ID
(or Universal Exclusive) followed by more data bytes and
ending with EOX.
Even though this is only two example patches, there's a good chance that the patch format always has seven sysex messages in sequence (each starting/ending with
0xf0 0x43 0x00 0x4b 0x00 /
0xf7), that are always the same length. The task is just to follow the above procedure to reverse the individual parameters.
A few other observations:
It looks like the first couple bytes after each header are related to the length of each message (i.e.
0x29, each followed by
0x60), but I'm not sure exactly what the relationship is. If the fields always do stay the same length, the good news is that it doesn't really matter.
It looks like the patch name is always eight ASCII characters, and is always in the same place, so the first bare-bones version of the editor could just allow editing that.
One of the fields in each message may be a checksum for that message. If you try creating an editor for the patch name, and the resulting patch doesn't load, that may be what the issue is. If that happens, to test it further, try changing some binary parameter in the default patch (i.e. an on/off option), and see if only one localized bit/byte changes, or if two [non-localized] bytes change. If there is a checksum, finding Yamaha documentation for some other piece of gear is probably your best bet for figuring it out. Barring that, there's a description of a Roland checksum in this document [pdf], which at least will get you started on attempting to guess how it works.
The whole process could be relatively easy, or it could be brutal, but this is a good way to get started.