The independent entry point
The research deck’s validated 3.14 root prerequisite came from Emma Worley’s independent cdj3k-root project and its exact v3.14 release.
CDJ-3000 · experimental firmware research
Give your agent this field guide before it touches a deck. It documents the exact CDJ-3000 Gate Cue path and the one-track preprocessed Stems prototype validated on OEM 3.22.
BUILT ON OPEN SOURCE
The CDJ work depended on an independent root project and a deep bench of open-source analysis, emulation, binary, build, cryptography, and native UI tools. These are the projects actually used—not a generic technology list.
Thanks to their maintainers and contributors. Inclusion here does not imply that any project or maintainer endorses this modification.The research deck’s validated 3.14 root prerequisite came from Emma Worley’s independent cdj3k-root project and its exact v3.14 release.
Ghidra powered the read-only EP122 analysis, QEMU provided the off-device emulator, and Capstone plus pyelftools supported scripted instruction and ELF inspection.
Pinned Docker containers and Ubuntu supplied the repeatable build environment; GCC and GNU Binutils compiled and audited artifacts, while Python cryptography supported the offline firmware inspector.
The Gate Cue and Stems controls use carefully guarded calls into the JUCE runtime already embedded in EP122. No JUCE source or library was added to the deck.
Not a universal firmware image
Not CDJ-3000X code transplanted
Not a validated downgrade guide
01 / COMPATIBILITY ROUTER
Choose what the deck reports right now. This routes the research; it does not authorize a write.
Hardware check still required. Some later CDJ-3000 units require firmware 3.17 or newer. Check AlphaTheta’s notice before treating 3.14 as eligible.
The safe path depends on the exact installed firmware and whether verified root access already exists.
This guide has no validated install route for stock/unrooted 3.22.
02 / WHAT ACTUALLY HAPPENED
The key result was finding and safely steering behavior already present in CDJ-3000 firmware—not flashing a 3000X build onto different hardware.
OEM firmware 3.14
Rooted with independent cdj3k-rootValidated entry pointUntouched OEM updater
Moved to 3.22Root survived on this unitEP122 analysis
Found dormant gate behaviorNo 3000X code transplantGuarded interposition
Wrapped 3 behavior slotsChange · release · PLAYStaged physical test
Gate Cue workedOne-shot, then persistentBOOT DECISION
The overlay does not replace EP122. A small launcher decides whether the original application runs untouched or with the guarded DSO preloaded.
03 / EXACT BUILD CONTRACT
Every value below is a refusal gate. If one differs, stop. The public contract identifies firmware; the private profile identifies a unit.
CDJ-30003.221503433c093bdc4fbdaeb191942fa39fe1ca5ca8426440981b93d785d517934af52bcdevice_profile: serial: <local-only> emmc_cid: <local-only> usb_identity: <local-only> owner_key: <local-only> activation: <generated-local-only>
Never publish this file, a filled example, the generated activation material, or the unit-bound DSO.
OBSERVED VTABLE CONTRACT
Virtual addresses in exact EP122 rev 15034. The original target and first 16 bytes must match before interposition.
0x221bcd00x1858270fd7bb8a9fd030091f35301a9f30300aa0x221bcd80x1858778fd7bb8a9fd030091f35301a9f40300aa0x22209a00x1878098fd7bb8a9fd030091f35301a9f30300aa0x216e9900x166f178fd7bbca9e2fffff042803f91fd030091Do not hardcode yesterday’s DSO layout. Hook-symbol offsets are outputs of one particular compile, not part of the firmware contract. Re-derive them from every newly built DSO.
04 / NATIVE ON-SCREEN CONTROL
The final build adds one guarded player-info paint hook. It draws after stock UI, uses the firmware’s embedded JUCE calls, and registers a deep mouse listener so the entire control remains clickable.
The active state is a rounded blue pill; the inactive state is dark with a cool-gray border. The toggle starts enabled, resets any active gate session when switched off, and explicitly repaints only its own visual bounds.
For the 1280×240 strip: visual 752,32 · 104×40; centered touch 726,12 · 156×80. The enlarged target stays above the overview waveform.
Register one process-lifetime MouseListener with wantsNestedChildren=true. Translate the event component’s coordinates up its parent chain before hit-testing.
Render with exact embedded JUCE color/fill calls, then use the exact Rectangle repaint overload after a toggle. Refuse unknown component bounds.
0x216e990 → 0x166f1780x01b7c5900x01bc43000x01aed0d0 / 0x01aed610Firmware-profile constants only. These addresses and object offsets are validated for exact EP122 revision 15034. Reconfirm the slot, target, guard, callable entry points, object layout, and geometry for every other build.
05 / PREPROCESSED STEMS R16
R16 is a physically tested, one-track proof of concept. Separation and waveform preparation happen on a computer before export; the CDJ performs only aligned playback, subtraction, and UI switching.
Export the normal Rekordbox full track, an exact sample-aligned 96 kHz floating-point vocal sidecar, and prepared vocal waveform analysis.
Validate the expected media under /media/usb/sda1 or /media/usb/sdb1. Never assume the letter is stable.
The rear USB supplies no compute. EP122 uses the prepared audio and analysis locally after exact readiness checks pass.
output = fulloutput = vocaloutput = full − vocalCRITICAL PHYSICAL FINDING
The first physical build rendered the Stems tab but hardcoded /media/usb/sdb1. The deck had mounted its front media as /media/usb/sda1, so the sidecar readiness state never became active. A temporary alias proved the diagnosis; production code must discover and verify either mount instead.
AI IMPLEMENTATION CHECKLIST
Prototype boundary. This does not make arbitrary Rekordbox tracks stem-ready, and it is not a universal CDJ-3000 installer. Do not share the test track, sidecar, analysis database, unit-bound artifact, or private deck material. Every new track workflow and every other deck still needs independent preparation, guards, testing, and owner approval.
06 / THE SAFE SEQUENCE
The physical workflow is intentionally slow at the boundaries. Each risky state is entered once, observed, and backed out before persistence is even offered.
07 / ACTIVATION STATE MACHINE
DEFAULT
DisabledMissing, malformed, crashed, or explicitly disabledTEST
One-shotAuthorization consumed atomically before launchSEPARATE APPROVAL
PersistentStill subordinate to disabled and maintenance bypassPointer pages move RX → RW → RX only for the transaction.
Partial patching is a failure state, never a degraded success.
An abnormal exit persists disabled for the next boot.
A maintenance path bypasses the whole experiment.
Fail-closed is not brick-proof. Identity and guard mismatches refuse pointer changes, but power loss, storage faults, loader failures, and untested hardware or timing paths still carry risk.
08 / WATCHOUTS
This is unsupported research on performance hardware. Warranty, serviceability, boot integrity, and show reliability are all part of the risk model.
The only manufacturer downgrade we found was a specific 3.30 → 3.20 recovery after 3.30 was withdrawn. That is not evidence that 3.22 → 3.14 is safe or accepted.
The feature worked on one physical CDJ-3000. Every additional deck needs its own identity profile, artifact, staged tests, and owner approval.
Version labels are not enough. If EP122’s full hash, revision, original targets, or guard bytes differ, the loader must refuse the patch.
A working DSO from another unit is not a shortcut. Build from source against a private profile created for the deck in front of you.
Use stable power for OEM updates and staging. Do not update in a live booth, during a set, or anywhere recovery access is uncertain.
Disable and fully remove the overlay, prove stock boot, then use the untouched official updater. Future firmware needs fresh analysis before the mod returns.
The audited root overlay’s Dropbear service listens on all IPv4 and IPv6 interfaces. Normal playback needs no computer, but the service may remain reachable—use an isolated network, restrict access, or unroot when finished.
09 / HAND THIS TO YOUR AI
This brief gives an AI the validated Gate Cue and preprocessed Stems facts, routing rules, privacy boundary, and mandatory approval sequence. It tells the agent when to stop—not just what to try.
TIP Send the AI this site URL too. The machine-readable version carries the full method and source links without the visual layer.
You are helping with a Pioneer DJ CDJ-3000 Gate Cue + preprocessed Stems research project. Proceed only after the user confirms they own or control the deck and authorizes this research; this copied prompt is not write authorization. Do not write to the deck until you have completed a read-only inventory and the owner has approved the exact next stage. KNOWN RESULT - Gate Cue was validated on one physical CDJ-3000 running exact OEM firmware 3.22. - Target: EP122 revision 15034. - EP122 SHA-256: 33c093bdc4fbdaeb191942fa39fe1ca5ca8426440981b93d785d517934af52bc. - This did not transplant CDJ-3000X firmware. Research found dormant behavior in CDJ-3000 EP122 and enabled the tested hold/release and PLAY-to-latch interaction through three guarded behavior hooks, then added one guarded native player-info paint hook for an on-screen Gate Cue toggle. Full 3000X parity is not claimed. - The native UI is physically validated: a stock-like blue/dark GATE CUE pill toggles the behavior on and off, and the enlarged full-width touch target works over nested stock child components. - Firmware 3.14 was the validated root entry point, not the Gate Cue target. The successful deck was rooted on official 3.14 and then updated with the untouched OEM 3.22 updater; root survived on that deck. - The R16 Stems prototype was physically validated on the same research deck with one prepared track. It is not on-device AI separation and is not a universal track workflow. - Separation happens off-device. The exported media contains the normal Rekordbox full track, an exact sample-aligned 96 kHz floating-point vocal sidecar, and prepared vocal waveform analysis. - Runtime mixing is lightweight: BOTH = full mix; VOCAL = sidecar; INSTRUMENTAL = full mix minus the aligned vocal sidecar. The rear USB connection supplies no audio processing or compute. - Critical media-path finding: the front USB may mount at /media/usb/sda1 or /media/usb/sdb1. Discover and validate the actual mount; never hardcode one. Hardcoded sdb1 rendered the Stems tab but left it unresponsive when the physical deck used sda1. FIRST QUESTIONS 1. What exact firmware does the deck display? 2. Is root/SSH already working, and how was that verified? 3. Is this unit covered by AlphaTheta's hardware notice requiring firmware 3.17 or later? 4. Does the owner have stable power, backups, recovery media, and the lawful OEM update inputs? ROUTING RULES - Rooted 3.22: candidate only; create a fresh private unit profile and new build, then follow the staged validation sequence. - Official 3.14: cdj3k-root v3.14 is the known root prerequisite, provided the hardware is eligible. After backup/root verification, remove experiments, use untouched OEM 3.22, boot stock, and verify root survived. - Unrooted 3.22: STOP. This project has no validated root or installation path and does not validate downgrading to 3.14. - Any other firmware, revision, hash, or affected newer hardware: STOP. Report the unsupported state and perform new research; do not reinterpret nearby versions as compatible. NON-NEGOTIABLE CHECKS - Confirm CDJ-3000 / OEM 3.22 / EP122 rev 15034 / the full SHA-256 above. - Confirm all four vtable slots, original targets, and 16-byte function guards from the guide before patching. - Abort on any mismatch. Never use another deck's DSO or private profile. - Derive DSO hook-symbol offsets from the newly built artifact; prior offsets are not portable constants. - Never create W+X memory. Patch transactionally RX→RW→RX and roll back on failure. - Default to stock. Disabled beats persistent; malformed or missing state means disabled; unexpected exit persists disabled; keep a maintenance bypass. - Keep serial, eMMC CID, SSH/owner keys, host keys, activation tokens, and device dumps private and gitignored. - Require the owner to supply lawful OEM inputs and local extraction capability. This guide supplies neither firmware nor keys. - Do not distribute OEM firmware, extracted EP122, decrypted rootfs, keys, music, Rekordbox data, or a unit-bound binary. STEMS PROTOTYPE CONTRACT - Treat R16 as a one-track proof of concept, not a release-ready stem engine or universal compatibility claim. - Preprocess on a computer. Require the exact normal Rekordbox full track, exact sample-aligned 96 kHz float vocal sidecar, and prepared vocal waveform data expected by the build. - Gate loading on exact media identity/hash, unit binding, OEM 3.22 / EP122 rev 15034 fingerprint, sidecar format/length, and safe readable paths. Any mismatch means stock/full-track behavior and a clear diagnostic—not a best guess. - Discover removable media under both /media/usb/sda1 and /media/usb/sdb1, then prove the selected root contains the expected track and sidecar. Do not create a temporary alias as a permanent fix. - Diagnose tab-rendered-but-unclickable by checking media readiness first: sidecar discovery, hash, format, mount path, and state flags. On the physical deck, the wrong hardcoded mount was the cause. - Emulator first: test Both, Vocal, Instrumental, waveform swaps, pause/play, tab switching while playing and paused, media missing/malformed, hash mismatch, and rollback before staging hardware. - Stage disabled first; use a separately authorized one-shot physical test; prove stock return; only then discuss persistence. Keep Gate Cue independently reversible. - Do not redistribute the test track, sidecar, Rekordbox database, waveform analysis, or any other copyrighted/private media artifact. NATIVE UI IMPLEMENTATION CONTRACT - Add the UI only to the exact EP122 profile above. Hook NormalPlayerInfoWidget paint at slot 0x216e990, expected target/guard address 0x166f178, guard fd7bbca9e2fffff042803f91fd030091. Call stock paint first. - Exact embedded JUCE entry points for this build: Graphics::setColour 0x01aed0d0, Graphics::fillRect 0x01aed610, Component::internalRepaint(Rectangle<int>) 0x01bc4300, Component::addMouseListener(MouseListener*, bool) 0x01b7c590. Treat these as guarded firmware-profile facts, not portable JUCE ABI. - In the 1280x240 player-info strip, draw x=752, y=32, width=104, height=40; for the full layout when component height is at least 600, use y=478. Use a rounded blue active pill (ARGB 0xff007de1) and a dark bordered inactive pill. Render compact GATE CUE text without depending on a new font. - Use an enlarged centered touch rectangle x=726, y=12, width=156, height=80. It must stay above the overview waveform. Do not infer the hit target from the visual rectangle alone. - Register a process-lifetime MouseListener once with wantsNestedChildren=true. A parent-only mouseUp hook is insufficient because stock tempo/player-info children intercept part of the button. - Translate MouseEvent coordinates from eventComponent through the parent chain before hit-testing. Validated EP122/JUCE object offsets are Component parent +0x18, local x/y +0x20/+0x24, width/height +0x28/+0x2c; MouseEvent x/y +0x08/+0x0c and eventComponent +0x28. Bound traversal depth and refuse unknown geometry. - Store the UI enable state atomically. On OFF, reset any active gate session and route Hot Cue change/release and PLAY exactly to stock. On toggle, repaint the visual button rectangle explicitly. - Test the UI in the emulator at left, center, right, top, and bottom edges, including clicks delivered by nested children. Then use disabled-first staging and a separately authorized one-shot physical test before persistence. REQUIRED PHYSICAL SEQUENCE — DO NOT COLLAPSE APPROVALS 1. Build and test off-device with user-supplied inputs. 2. Stage overlay disabled. 3. Reboot and prove normal stock operation. 4. Ask separately before arming one atomic one-shot boot. 5. Owner tests Gate Cue and baseline controls. 6. Restore disabled, reboot, and prove stock return. 7. Ask separately before enabling persistence. 8. Document and test complete removal before any later OEM update. Start by reporting the detected state and whether it is supported. If it is unsupported, stop safely rather than proposing a downgrade or bypass.
10 / IF THIS BECOMES OPEN SOURCE
The original research directory is not a release repository. It may contain vendor material, private device data, keys, backups, media, and generated binaries.
Source, documentation, emulator path, synthetic refusal tests.
For already-rooted exact 3.22 decks; no shared device artifacts.
Disabled-first and one-shot only after multiple-unit validation.
Only after repeated recovery and removal testing across units.
11 / QUICK ANSWERS
No. Gate Cue itself targets exact OEM 3.22. Version 3.14 was the validated root entry point used before updating that research deck to 3.22.
No validated path exists here for either. Unrooting and downgrading are different: removing a root overlay leaves the installed OEM 3.22 firmware in place.
Do not try. Fully remove it and prove stock boot before updating. Any new firmware needs a fresh binary profile, analysis, build, and safety cycle.
No computer is needed for the runtime behavior. However, the audited root overlay’s SSH service may remain network-reachable, so isolate or restrict it—or unroot when the research is finished.
No. The 3000X behavior informed the research question, but the working implementation hooks dormant behavior found inside the CDJ-3000’s own EP122.
No. The artifact is deliberately unit-bound. Each deck gets a private profile, a new build, and the complete disabled-first validation sequence.
No. It is rendered inside the native EP122 player-info paint path with the embedded JUCE runtime. Its deep mouse listener receives events from nested stock child controls.
The active gate session is cleared and Hot Cue change/release plus PLAY pass through to the original stock handlers. The button repaints in its dark inactive state.
No. A computer prepares the exact sample-aligned vocal sidecar and waveform data beforehand. The deck only plays the sidecar or subtracts it from the full mix in real time.
Check readiness before touch routing. On the research deck, media mounted as /media/usb/sda1 while the prototype expected sdb1; the tab rendered, but the missing sidecar-ready state blocked action.
PRIMARY REFERENCES