rekordbox 7 — DDJ-FLX4 internal implementation

Reverse-engineering notes for the Windows rekordbox 7 installation in this directory, focused on the Pioneer DDJ-FLX4. The FLX4 is a MIDI controller in this build, not a vendor-HID controller; the wiki documents its MIDI map, LED feedback, level indicator and the proprietary Pioneer SysEx layer, then provides the HID stack as background for the other DDJ/DJM/XDJ models.

Everything here was derived from the shipped binaries and data files. No controller hardware was required. Addresses are RVAs (image base 0x140000000 for rekordbox.exe); file offsets are noted where useful.

FLX4 first

• DDJ-FLX4 — detection, MidiMapDDJFLX4, the complete default MIDI map, channel level indicator, LED feedback and Pioneer SysEx.
• Authentication — the device challenge/response handshake, the FNV-1a hash, model-specific keys, and which features are gated by auth.
• Phrase analysis — how rekordbox detects beats/downbeats (madmom RNN + Viterbi) and how the proprietary SongStructureAnalyze stage turns that grid into phrases. Deep dive: Phrase model — exact filter bank, feature extractors, DP passes, and the All-In-One comparison.
• Key facts:
  • DDJ-FLX4 is matched by the MIDI map factory at RVA 0x23C2500 and instantiated as MidiMapDDJFLX4 (constructor 0x23D59E0, object size 0x80D20).
  • The default mapping is MidiMappings/DDJ-FLX4.midi.csv (259 lines, 201 control rows).
  • The FLX4 uses MIDI notes/CCs, not vendor HID. There is no HidMapDDJFLX4.
  • Channel level is a MIDI CC indicator (B002), with per-channel ChannelLevel.%d indicators created at RVA 0x23F8640.
  • Settings/indicators use MIDI channel 16 (0x9F/0xBF) and Pioneer SysEx (F0 00 40 05 ... F7).
  • 0xFFF2 (JogRatency) and 0xFFF3 (MidiOutInterval) are internal parameter IDs in the CSV, not standard MIDI.
  • The FLX4 does authenticate: the map creates @AuthReq … @AuthEnd (packet IDs 0x11…0x15) and rekordbox only starts the MIDI device after the handshake reaches state 5 (or the device is in the force list).

What is in this directory

Path	What it is
rekordbox.exe	Main application; contains the whole djplay controller stack and the dmx lighting engine.
MidiMappings/*.midi.csv	User-visible MIDI mappings for DDJ/DJM/XDJ/CDJ/PLX/Phase controllers.
pad/*.pad.csv	Pad-mode definitions (Hot Cue, Beat Jump, Lighting, Stems, …).
LIGHTING_DB.zip → macro.db3	Built-in lighting macro database (SQLite + XML macro payloads).
models/	Beat/downbeat TensorFlow models and cue/embedding ONNX models; see ONNX models and Phrase analysis.
PSvLinkSysMgrINI.xml	Pro DJ Link / network stack timers and IDs.
drivers/*.exe	Pioneer/AlphaTheta USB audio and controller driver installers.
firmware/DJM-250MK2_v107.exe	Controller firmware updater payload.
residentmanager/FWUPDM_1.0.1.exe	Firmware update manager.
clatc.dll	castLabs Widevine/DRM library. Not the controller library.
lsapiw64.dll	Sentinel RMS licensing + OpenSSL + SQLite. Not lighting.
rbHttpServer.exe	Go-based HTTP server (cloud/mobile endpoints).
NFSDaemon.dll	NFS server used by Pro DJ Link track transfer.

The controller implementation is not in a separate DLL. It is linked into rekordbox.exe in the djplay namespace; clatc.dll and lsapiw64.dll are red herrings.

Start here

1. DDJ-FLX4 — the primary page: MIDI map, LEDs, level indicator, SysEx.
2. Authentication — device challenge/response, hash, key table, and feature gating.
3. Data formats — the FLX4 MIDI CSV, pad CSV, macro.db3, config files.
4. Architecture — process/module map and object model.
5. Phrase analysis — madmom beat/downbeat detection and the proprietary SongStructureAnalyze phrase stage; deep dive: Phrase model.
6. ONNX models — what onnxruntime.dll is used for: auto cue, Collection Radar embeddings, and Demucs stems; not beat/Spleeter.
7. HID transport — Windows HID enumeration, overlapped reads, write path, queues and threads (for non-FLX4 controllers).
8. HID protocol — report framing, packet IDs, 12-bit control keys, fragmentation and authentication (for non-FLX4 controllers).
9. Devices — supported devices, VID/PID, product-name factory and map-class reuse.
10. Lights — controller LED output, blink, MIDI LED feedback, and the separate DMX lighting engine.
11. Level meters — audio meters, 14-bit HID feedback and the FLX4 MIDI indicator path.
12. Non-standard details — the quirks worth knowing before writing an alternative client.
13. Reversing notes — key RVAs, class list, method map.

Executive summary

• The DDJ-FLX4 is MIDI, not vendor HID. rekordbox detects the MIDI port name DDJ-FLX4, instantiates MidiMapDDJFLX4 (constructor 0x23D59E0) and loads MidiMappings/DDJ-FLX4.midi.csv.
• Device authentication is a challenge/response handshake in the same packet stream (@AuthReq → @AuthChallengeA → @AuthResponseA → @AuthEnd). The hash is FNV-1a 32-bit with a model-specific 10-byte key. rekordbox only starts the MIDI device when the auth state reaches 5 (or the device is in the force list). FLX4 uses this handshake over MIDI.
• Software licensing (Sentinel RMS / server validator), hardware unlock ("DJ equipment linkage") and cloud auth (KUVO/CloudDirectPlay OAuth) are separate from the device handshake. See Authentication.
• Track analysis uses a madmom RNN downbeat tracker (multi-resolution STFT + bidirectional LSTM + Viterbi) for beats/downbeats. Phrase labels come from rekordbox's proprietary SongStructureAnalyze stage, not a separate model. See Phrase analysis.
• ONNX Runtime (onnxruntime.dll, DirectML) is used for auto cue, Collection Radar embeddings and Demucs stem separation — not for beat/downbeat, Spleeter or vocal detection, which are TensorFlow. See ONNX models.
• FLX4 LEDs are MIDI note/CC feedback; the channel level indicator is MIDI CC 0x02 (B002), with per-channel ChannelLevel.%d indicators. There is no HID level packet for the FLX4.
• FLX4 settings/indicators use MIDI channel 16 (0x9F/0xBF) and Pioneer SysEx (F0 00 40 05 ... F7). 0xFFF2/0xFFF3 are internal parameter IDs.
• The other DDJ/DJM/XDJ/CDJ models use vendor-defined USB HID. Windows HID is only a byte pipe; the report contents are Pioneer/AlphaTheta proprietary.
• HID device selection is done by product string (HidD_GetProductString), not by a single fixed PID table. Both Pioneer VID 0x08E4 and AlphaTheta VID 0x2B73 are accepted.
• A HidMap subclass per device family decodes input reports and encodes output reports. Several products share one map class (for example DDJ-800 reuses the DDJ-1000 map, DJM-V10/A9/V5 reuse the DJM-900NXS2 map).
• The HID protocol has two packet namespaces: input packet IDs 0x01…0x13 and output packet IDs 0x21…0x3A. Control addressing is 12-bit: (byte1 & 0xF0) << 8 | byte2.
• HID output packets are fragmented into 58-byte chunks with a 7-byte transport header (00 00 F0 idx_lo idx_hi cnt_lo cnt_hi) and a 0x41 terminator.
• HID device authentication is a separate control handshake (@AuthReq, @AuthChallengeA, @AuthResponseA, @AuthResponseE, @AuthEnd) used by DDJ-1000/800 and the DMX interfaces.
• HID controller LED/level feedback is a 14-bit value path (0…0x3FFF), pushed to per-channel and master output units, queued by priority and written as HID reports.
• rekordbox Lighting is a separate DMX engine (dmx namespace) with its own macro database, fixture library, clock and transports (RB-DMX1, internal DMX, Enttec/DMXKing/FTDI/Vince USB interfaces).
• Many DDJ/DJM/XDJ models also expose a MIDI mode; those mappings are the CSV files in MidiMappings/, not the HID protocol. The FLX4 is MIDI-only in this build.

Evidence tags

• Facts stated without qualification were read directly from the binary (disassembly, RTTI, strings) or from the shipped data files.
• [INFERENCE] marks a semantic interpretation that fits the code but was not proven by a live device trace.