GATED HOT CUES + STEMS / FIELD GUIDEAI-readable

CDJ-3000 · experimental firmware research

Point your AI
(Codex recommended)
at this site.

Give your agent this field guide before it touches a deck. It documents the exact CDJ-3000 Gate Cue path and the one-track preprocessed Stems prototype validated on OEM 3.22.

Gate CueDormant behavior + native UI
Stems R16Preprocessed sidecar · lightweight mixing
ScopeOne unit · one exact build · one prepared track

BUILT ON OPEN SOURCE

Credit where
credit is due.

The CDJ work depended on an independent root project and a deep bench of open-source analysis, emulation, binary, build, cryptography, and native UI tools. These are the projects actually used—not a generic technology list.

Thanks to their maintainers and contributors. Inclusion here does not imply that any project or maintainer endorses this modification.
01ROOT FOUNDATION

The independent entry point

The research deck’s validated 3.14 root prerequisite came from Emma Worley’s independent cdj3k-root project and its exact v3.14 release.

02ANALYSIS + EMULATION

Understanding the target safely

Ghidra powered the read-only EP122 analysis, QEMU provided the off-device emulator, and Capstone plus pyelftools supported scripted instruction and ELF inspection.

03BUILD + VERIFICATION

Reproducible AArch64 artifacts

Pinned Docker containers and Ubuntu supplied the repeatable build environment; GCC and GNU Binutils compiled and audited artifacts, while Python cryptography supported the offline firmware inspector.

04NATIVE UI RUNTIME

Drawing inside the stock player

The Gate Cue and Stems controls use carefully guarded calls into the JUCE runtime already embedded in EP122. No JUCE source or library was added to the deck.

READ THIS FIRST

Not a universal firmware image

Not CDJ-3000X code transplanted

Not a validated downgrade guide

01 / COMPATIBILITY ROUTER

Begin with facts,
not firmware files.

Choose what the deck reports right now. This routes the research; it does not authorize a write.

1 Installed firmware
2 Verified root / SSH

Hardware check still required. Some later CDJ-3000 units require firmware 3.17 or newer. Check AlphaTheta’s notice before treating 3.14 as eligible.

Choose both facts

No assumptions yet.

The safe path depends on the exact installed firmware and whether verified root access already exists.

  1. Read the version from the deck.
  2. Verify root with evidence—not memory.

This guide has no validated install route for stock/unrooted 3.22.

02 / WHAT ACTUALLY HAPPENED

The research path, without the folklore.

The key result was finding and safely steering behavior already present in CDJ-3000 firmware—not flashing a 3000X build onto different hardware.

01

OEM firmware 3.14

Rooted with independent cdj3k-rootValidated entry point
02

Untouched OEM updater

Moved to 3.22Root survived on this unit
03

EP122 analysis

Found dormant gate behaviorNo 3000X code transplant
04

Guarded interposition

Wrapped 3 behavior slotsChange · release · PLAY
05

Staged physical test

Gate Cue workedOne-shot, then persistent

BOOT DECISION

Stock remains the default path.

The overlay does not replace EP122. A small launcher decides whether the original application runs untouched or with the guarded DSO preloaded.

AOEM bootUnmodified base
BOverlay launcherMaintenance bypass
CFail-closed preflightIdentity · hash · guards
D0Stock EP122Default / any failure
D1EP122 + DSOAuthorized exact match

03 / EXACT BUILD CONTRACT

“Version 3.22”
isn’t specific enough.

Every value below is a refusal gate. If one differs, stop. The public contract identifies firmware; the private profile identifies a unit.

FIRMWARE PROFILEPUBLIC
ProductCDJ-3000
OEM firmware3.22
EP122 revision15034
EP122 SHA-25633c093bdc4fbdaeb191942fa39fe1ca5ca8426440981b93d785d517934af52bc
DEVICE PROFILEPRIVATE + GITIGNORED
device_profile:
  serial: <local-only>
  emmc_cid: <local-only>
  usb_identity: <local-only>
  owner_key: <local-only>
  activation: <generated-local-only>

Never publish this file, a filled example, the generated activation material, or the unit-bound DSO.

OBSERVED VTABLE CONTRACT

Four guarded slots

Virtual addresses in exact EP122 rev 15034. The original target and first 16 bytes must match before interposition.

EventVtable slotOriginal target16-byte guard
Hot-cue changeArms or preserves a gate session only for a valid Hot Cue pressed while playback was stopped.0x221bcd00x1858270fd7bb8a9fd030091f35301a9f30300aa
Hot-cue releaseOn the final active, unlatched release, passes a local mode-1 operation to stock code so it takes the existing backCue path.0x221bcd80x1858778fd7bb8a9fd030091f35301a9f40300aa
PLAYDuring an active gate session, consumes queued PLAY and latches playback; outside a session, calls stock PLAY.0x22209a00x1878098fd7bb8a9fd030091f35301a9f30300aa
Player-info paint / UICalls stock paint first, then renders and registers the native Gate Cue toggle only for the exact known player-info bounds.0x216e9900x166f178fd7bbca9e2fffff042803f91fd030091
!

Do not hardcode yesterday’s DSO layout. Hook-symbol offsets are outputs of one particular compile, not part of the firmware contract. Re-derive them from every newly built DSO.

04 / NATIVE ON-SCREEN CONTROL

A real Gate Cue toggle,
inside the stock player view.

The final build adds one guarded player-info paint hook. It draws after stock UI, uses the firmware’s embedded JUCE calls, and registers a deep mouse listener so the entire control remains clickable.

TRACK / WAVEFORMEP122 · 1280 × 240
02:35.350+0.55%
PHYSICAL RESULTVALIDATED 2026-08-05
Stock-like visual. Exact stock passthrough when off.

The active state is a rounded blue pill; the inactive state is dark with a cool-gray border. The toggle starts enabled, resets any active gate session when switched off, and explicitly repaints only its own visual bounds.

GATE CUEGATE CUE
01 / GEOMETRY

Visual and touch bounds differ.

For the 1280×240 strip: visual 752,32 · 104×40; centered touch 726,12 · 156×80. The enlarged target stays above the overview waveform.

02 / EVENT ROUTING

Listen through stock children.

Register one process-lifetime MouseListener with wantsNestedChildren=true. Translate the event component’s coordinates up its parent chain before hit-testing.

03 / RENDER + REPAINT

Call stock paint first.

Render with exact embedded JUCE color/fill calls, then use the exact Rectangle repaint overload after a toggle. Refuse unknown component bounds.

PAINT SLOT0x216e990 → 0x166f178
ADD DEEP LISTENER0x01b7c590
REPAINT RECT0x01bc4300
SET COLOUR / FILL RECT0x01aed0d0 / 0x01aed610

Firmware-profile constants only. These addresses and object offsets are validated for exact EP122 revision 15034. Reconfirm the slot, target, guard, callable entry points, object layout, and geometry for every other build.

05 / PREPROCESSED STEMS R16

The deck mixes stems.
It does not separate them.

R16 is a physically tested, one-track proof of concept. Separation and waveform preparation happen on a computer before export; the CDJ performs only aligned playback, subtraction, and UI switching.

01 / OFF DEVICEPrepare the media

Export the normal Rekordbox full track, an exact sample-aligned 96 kHz floating-point vocal sidecar, and prepared vocal waveform analysis.

02 / FRONT USBDiscover the actual mount

Validate the expected media under /media/usb/sda1 or /media/usb/sdb1. Never assume the letter is stable.

03 / ON DECKMix, don’t infer

The rear USB supplies no compute. EP122 uses the prepared audio and analysis locally after exact readiness checks pass.

BOTHFull mixoutput = full
VOCALPrepared sidecaroutput = vocal
INSTRUMENTALAligned subtractionoutput = full − vocal

CRITICAL PHYSICAL FINDING

Visible but unclickable meant “media not ready.”

The first physical build rendered the Stems tab but hardcoded /media/usb/sdb1. The deck had mounted its front media as /media/usb/sda1, so the sidecar readiness state never became active. A temporary alias proved the diagnosis; production code must discover and verify either mount instead.

AI IMPLEMENTATION CHECKLIST

  • Guard exact unit, firmware revision and EP122 hash.
  • Guard full-track and sidecar identity, hash, format, length and sample alignment.
  • Require prepared vocal waveform data before swapping the big or overview waveform.
  • Test tab switching while playing and paused; verify button-to-action latency and pause/play fades.
  • Fail to stock/full-track behavior with a diagnostic on missing, malformed or ambiguous media.
  • Emulator first; disabled first; one-shot hardware test; stock-return proof; persistence last.

Prototype boundary. This does not make arbitrary Rekordbox tracks stem-ready, and it is not a universal CDJ-3000 installer. Do not share the test track, sidecar, analysis database, unit-bound artifact, or private deck material. Every new track workflow and every other deck still needs independent preparation, guards, testing, and owner approval.

06 / THE SAFE SEQUENCE

Eight gates.
No skipped approvals.

The physical workflow is intentionally slow at the boundaries. Each risky state is entered once, observed, and backed out before persistence is even offered.

  1. Record the displayed firmware version and the unit’s identity locally. Never paste its serial, eMMC CID, SSH host keys, or owner keys into a public issue or AI chat.
  2. If the unit is covered by AlphaTheta’s newer-hardware notice requiring firmware 3.17 or later, do not install 3.14.
  3. Stock or unrooted 3.22 is not a validated entry point. Do not improvise an arbitrary downgrade.
  4. Use stable mains power. A firmware write is not the moment for an extension lead someone can kick loose.

07 / ACTIVATION STATE MACHINE

Disabled wins every argument.

00

DEFAULT

DisabledMissing, malformed, crashed, or explicitly disabled
owner arms once
01

TEST

One-shotAuthorization consumed atomically before launch
stock return proof
02

SEPARATE APPROVAL

PersistentStill subordinate to disabled and maintenance bypass
01No W + X

Pointer pages move RX → RW → RX only for the transaction.

02Rollback or refuse

Partial patching is a failure state, never a degraded success.

03Crash means off

An abnormal exit persists disabled for the next boot.

04Stock escape hatch

A maintenance path bypasses the whole experiment.

Fail-closed is not brick-proof. Identity and guard mismatches refuse pointer changes, but power loss, storage faults, loader failures, and untested hardware or timing paths still carry risk.

08 / WATCHOUTS

The expensive mistakes
all look like shortcuts.

This is unsupported research on performance hardware. Warranty, serviceability, boot integrity, and show reliability are all part of the risk model.

01

No arbitrary downgrade

The only manufacturer downgrade we found was a specific 3.30 → 3.20 recovery after 3.30 was withdrawn. That is not evidence that 3.22 → 3.14 is safe or accepted.

02

One deck is not a platform

The feature worked on one physical CDJ-3000. Every additional deck needs its own identity profile, artifact, staged tests, and owner approval.

03

Hash means stop or go

Version labels are not enough. If EP122’s full hash, revision, original targets, or guard bytes differ, the loader must refuse the patch.

04

Never borrow a binary

A working DSO from another unit is not a shortcut. Build from source against a private profile created for the deck in front of you.

05

Power is part of safety

Use stable power for OEM updates and staging. Do not update in a live booth, during a set, or anywhere recovery access is uncertain.

06

Clean before OEM updates

Disable and fully remove the overlay, prove stock boot, then use the untouched official updater. Future firmware needs fresh analysis before the mod returns.

07

Root SSH stays exposed

The audited root overlay’s Dropbear service listens on all IPv4 and IPv6 interfaces. Normal playback needs no computer, but the service may remain reachable—use an isolated network, restrict access, or unroot when finished.

09 / HAND THIS TO YOUR AI

A prompt with
brakes built in.

This brief gives an AI the validated Gate Cue and preprocessed Stems facts, routing rules, privacy boundary, and mandatory approval sequence. It tells the agent when to stop—not just what to try.

Open llms.txt

TIP Send the AI this site URL too. The machine-readable version carries the full method and source links without the visual layer.

gate-cue-handoff.txtREAD-ONLY START
You are helping with a Pioneer DJ CDJ-3000 Gate Cue + preprocessed Stems research project. Proceed only after the user confirms they own or control the deck and authorizes this research; this copied prompt is not write authorization. Do not write to the deck until you have completed a read-only inventory and the owner has approved the exact next stage.

KNOWN RESULT
- Gate Cue was validated on one physical CDJ-3000 running exact OEM firmware 3.22.
- Target: EP122 revision 15034.
- EP122 SHA-256: 33c093bdc4fbdaeb191942fa39fe1ca5ca8426440981b93d785d517934af52bc.
- This did not transplant CDJ-3000X firmware. Research found dormant behavior in CDJ-3000 EP122 and enabled the tested hold/release and PLAY-to-latch interaction through three guarded behavior hooks, then added one guarded native player-info paint hook for an on-screen Gate Cue toggle. Full 3000X parity is not claimed.
- The native UI is physically validated: a stock-like blue/dark GATE CUE pill toggles the behavior on and off, and the enlarged full-width touch target works over nested stock child components.
- Firmware 3.14 was the validated root entry point, not the Gate Cue target. The successful deck was rooted on official 3.14 and then updated with the untouched OEM 3.22 updater; root survived on that deck.
- The R16 Stems prototype was physically validated on the same research deck with one prepared track. It is not on-device AI separation and is not a universal track workflow.
- Separation happens off-device. The exported media contains the normal Rekordbox full track, an exact sample-aligned 96 kHz floating-point vocal sidecar, and prepared vocal waveform analysis.
- Runtime mixing is lightweight: BOTH = full mix; VOCAL = sidecar; INSTRUMENTAL = full mix minus the aligned vocal sidecar. The rear USB connection supplies no audio processing or compute.
- Critical media-path finding: the front USB may mount at /media/usb/sda1 or /media/usb/sdb1. Discover and validate the actual mount; never hardcode one. Hardcoded sdb1 rendered the Stems tab but left it unresponsive when the physical deck used sda1.

FIRST QUESTIONS
1. What exact firmware does the deck display?
2. Is root/SSH already working, and how was that verified?
3. Is this unit covered by AlphaTheta's hardware notice requiring firmware 3.17 or later?
4. Does the owner have stable power, backups, recovery media, and the lawful OEM update inputs?

ROUTING RULES
- Rooted 3.22: candidate only; create a fresh private unit profile and new build, then follow the staged validation sequence.
- Official 3.14: cdj3k-root v3.14 is the known root prerequisite, provided the hardware is eligible. After backup/root verification, remove experiments, use untouched OEM 3.22, boot stock, and verify root survived.
- Unrooted 3.22: STOP. This project has no validated root or installation path and does not validate downgrading to 3.14.
- Any other firmware, revision, hash, or affected newer hardware: STOP. Report the unsupported state and perform new research; do not reinterpret nearby versions as compatible.

NON-NEGOTIABLE CHECKS
- Confirm CDJ-3000 / OEM 3.22 / EP122 rev 15034 / the full SHA-256 above.
- Confirm all four vtable slots, original targets, and 16-byte function guards from the guide before patching.
- Abort on any mismatch. Never use another deck's DSO or private profile.
- Derive DSO hook-symbol offsets from the newly built artifact; prior offsets are not portable constants.
- Never create W+X memory. Patch transactionally RX→RW→RX and roll back on failure.
- Default to stock. Disabled beats persistent; malformed or missing state means disabled; unexpected exit persists disabled; keep a maintenance bypass.
- Keep serial, eMMC CID, SSH/owner keys, host keys, activation tokens, and device dumps private and gitignored.
- Require the owner to supply lawful OEM inputs and local extraction capability. This guide supplies neither firmware nor keys.
- Do not distribute OEM firmware, extracted EP122, decrypted rootfs, keys, music, Rekordbox data, or a unit-bound binary.

STEMS PROTOTYPE CONTRACT
- Treat R16 as a one-track proof of concept, not a release-ready stem engine or universal compatibility claim.
- Preprocess on a computer. Require the exact normal Rekordbox full track, exact sample-aligned 96 kHz float vocal sidecar, and prepared vocal waveform data expected by the build.
- Gate loading on exact media identity/hash, unit binding, OEM 3.22 / EP122 rev 15034 fingerprint, sidecar format/length, and safe readable paths. Any mismatch means stock/full-track behavior and a clear diagnostic—not a best guess.
- Discover removable media under both /media/usb/sda1 and /media/usb/sdb1, then prove the selected root contains the expected track and sidecar. Do not create a temporary alias as a permanent fix.
- Diagnose tab-rendered-but-unclickable by checking media readiness first: sidecar discovery, hash, format, mount path, and state flags. On the physical deck, the wrong hardcoded mount was the cause.
- Emulator first: test Both, Vocal, Instrumental, waveform swaps, pause/play, tab switching while playing and paused, media missing/malformed, hash mismatch, and rollback before staging hardware.
- Stage disabled first; use a separately authorized one-shot physical test; prove stock return; only then discuss persistence. Keep Gate Cue independently reversible.
- Do not redistribute the test track, sidecar, Rekordbox database, waveform analysis, or any other copyrighted/private media artifact.

NATIVE UI IMPLEMENTATION CONTRACT
- Add the UI only to the exact EP122 profile above. Hook NormalPlayerInfoWidget paint at slot 0x216e990, expected target/guard address 0x166f178, guard fd7bbca9e2fffff042803f91fd030091. Call stock paint first.
- Exact embedded JUCE entry points for this build: Graphics::setColour 0x01aed0d0, Graphics::fillRect 0x01aed610, Component::internalRepaint(Rectangle<int>) 0x01bc4300, Component::addMouseListener(MouseListener*, bool) 0x01b7c590. Treat these as guarded firmware-profile facts, not portable JUCE ABI.
- In the 1280x240 player-info strip, draw x=752, y=32, width=104, height=40; for the full layout when component height is at least 600, use y=478. Use a rounded blue active pill (ARGB 0xff007de1) and a dark bordered inactive pill. Render compact GATE CUE text without depending on a new font.
- Use an enlarged centered touch rectangle x=726, y=12, width=156, height=80. It must stay above the overview waveform. Do not infer the hit target from the visual rectangle alone.
- Register a process-lifetime MouseListener once with wantsNestedChildren=true. A parent-only mouseUp hook is insufficient because stock tempo/player-info children intercept part of the button.
- Translate MouseEvent coordinates from eventComponent through the parent chain before hit-testing. Validated EP122/JUCE object offsets are Component parent +0x18, local x/y +0x20/+0x24, width/height +0x28/+0x2c; MouseEvent x/y +0x08/+0x0c and eventComponent +0x28. Bound traversal depth and refuse unknown geometry.
- Store the UI enable state atomically. On OFF, reset any active gate session and route Hot Cue change/release and PLAY exactly to stock. On toggle, repaint the visual button rectangle explicitly.
- Test the UI in the emulator at left, center, right, top, and bottom edges, including clicks delivered by nested children. Then use disabled-first staging and a separately authorized one-shot physical test before persistence.

REQUIRED PHYSICAL SEQUENCE — DO NOT COLLAPSE APPROVALS
1. Build and test off-device with user-supplied inputs.
2. Stage overlay disabled.
3. Reboot and prove normal stock operation.
4. Ask separately before arming one atomic one-shot boot.
5. Owner tests Gate Cue and baseline controls.
6. Restore disabled, reboot, and prove stock return.
7. Ask separately before enabling persistence.
8. Document and test complete removal before any later OEM update.

Start by reporting the detected state and whether it is supported. If it is unsupported, stop safely rather than proposing a downgrade or bypass.

10 / IF THIS BECOMES OPEN SOURCE

Publish the method.
Keep the evidence clean.

The original research directory is not a release repository. It may contain vendor material, private device data, keys, backups, media, and generated binaries.

ALLOWLIST INTO A NEW REPO
  • Original source code and build scripts
  • Public firmware profiles: hash, revision, slots, guards
  • Blank private-profile template
  • Synthetic fixtures and emulator tests
  • Threat model, removal guide, and test logs with IDs redacted
×NEVER COMMIT
  • OEM .UPD packages, EP122, or decrypted rootfs
  • AES material, SSH keys, host keys, or tokens
  • Serials, eMMC CIDs, USB identity, or device dumps
  • Unit-bound DSO or filled device profile
  • Music, Rekordbox backups, or decompiler project material
v0.1Research release

Source, documentation, emulator path, synthetic refusal tests.

v0.2Per-unit generator

For already-rooted exact 3.22 decks; no shared device artifacts.

v0.3Hardware alpha

Disabled-first and one-shot only after multiple-unit validation.

LATERPersistence

Only after repeated recovery and removal testing across units.

11 / QUICK ANSWERS

The questions everyone asks next.

01

Does a deck need to still be on 3.14?

No. Gate Cue itself targets exact OEM 3.22. Version 3.14 was the validated root entry point used before updating that research deck to 3.22.

02

Can stock 3.22 be rooted—or downgraded?

No validated path exists here for either. Unrooting and downgrading are different: removing a root overlay leaves the installed OEM 3.22 firmware in place.

03

Will the mod survive a future OEM update?

Do not try. Fully remove it and prove stock boot before updating. Any new firmware needs a fresh binary profile, analysis, build, and safety cycle.

04

Does the rear USB stay connected?

No computer is needed for the runtime behavior. However, the audited root overlay’s SSH service may remain network-reachable, so isolate or restrict it—or unroot when the research is finished.

05

Is this CDJ-3000X firmware running on a 3000?

No. The 3000X behavior informed the research question, but the working implementation hooks dormant behavior found inside the CDJ-3000’s own EP122.

06

Can two exact-3.22 decks share the same DSO?

No. The artifact is deliberately unit-bound. Each deck gets a private profile, a new build, and the complete disabled-first validation sequence.

07

Does the on-screen button use a web overlay?

No. It is rendered inside the native EP122 player-info paint path with the embedded JUCE runtime. Its deep mouse listener receives events from nested stock child controls.

08

What happens when Gate Cue is switched off?

The active gate session is cleared and Hot Cue change/release plus PLAY pass through to the original stock handlers. The button repaints in its dark inactive state.

09

Is the CDJ running AI stem separation?

No. A computer prepares the exact sample-aligned vocal sidecar and waveform data beforehand. The deck only plays the sidecar or subtracts it from the full mix in real time.

10

Why can a visible Stems tab be unresponsive?

Check readiness before touch routing. On the research deck, media mounted as /media/usb/sda1 while the prototype expected sdb1; the tab rendered, but the missing sidecar-ready state blocked action.

PRIMARY REFERENCES

Read the source notices,
not just this guide.