Frequency response
Parametric EQ — DAC bank
Snapshots
Four in-memory A/B slots. Capture, tweak, then click a slot to jump back instantly — useful for comparing two curves on-device. Slots also overlay on the graph.
Presets
AutoEQ
Drop an AutoEQ parametric export (filters plus its target curve) anywhere on the page. The target draws as a dashed line on the graph, and the fit error is measured against it.
No AutoEQ target loaded.
Analog PGA
Analog input/output gain, selected by index. Semantics are vendor-confirmed on KT0211L / KT02H20 and read best-effort elsewhere — the KT0231H map puts its EQ table at these addresses.
Digital gain
Signed byte, 0.5 dB per step. On stereo models register 0x66 holds DACL in byte0 and DACR in byte1; single-DAC parts ignore byte1.
Noise gate
Thresholds encode as byte = 256 + dB, so −60 dB is 0xC4 and −96 dB is 0xA0. The formula saturates one step below 0 dB, so the usable range stops at −1 dB (0xFF). Hold is fixed at 10 ms. Register layout decoded from the vendor desktop app on KT02H20.
Limiter
Register 0x78 carries EN in bit7 and SOFT in bit6; bit16+ holds the threshold byte. SOFT is the vendor app's soft-knee mode.
Fingerprint & chip prober
A read-only census of the device: version, build, USB strings, flags, magic, and a band-register layout discriminator that names the chip class even when the OEM product string has been renamed. See PROTOCOL.md §10.
Not read yet — connect, then Read & probe.
Profile override
The app picks a profile from the product string first, then VID:PID. Override it here when a renamed dongle or a roster-only part needs a different register map.
Chip identification
Matched against the vendor's own product catalogue — 0 parts — so a device can be named even when no register map has been verified for it. Naming the part and knowing its register layout are separate questions, and this panel keeps them separate.
Connect a device to identify it.
USB identity
These edit the USB string descriptors the host shows. They live in run-mode RAM — replug to see them, and use Save to flash where the chip supports persistence. A VID/PID change re-enumerates the device, so record the current pair first.
Memory peek
The 0x08 word reader answers from an extended space that most runtimes map to zeros. It cannot read flash, and it cannot modify the device. For a real backup see HARDWARE-DUMP.md.
—
Vendor chip roster
Roster strings recovered from KT_BOOT_TOOL 1.0.58. Profiled parts have a run-mode register map in the app; the rest are documented-only or belong to a different platform (ARCHITECTURE.md §4).
Register space 0x00–0xFF
A full sweep is 256 round-trips at the queue cadence — expect it to take a while. Annotated addresses come from the reverse-engineered map; unknown ones are listed bare.
Extended space 0x08
Two address regimes are known; most runtimes return zeros. Results are exported little-endian. This is not a flash dump (PROTOCOL.md §9.1).
Firmware image surgery
The vendor persistence path when a chip has no working SAVE command: take the unit's own image, rewrite the embedded EQ tables with the current bands, and flash it back. The EQ table is located by pattern, not by a hardcoded offset.
Compare two images
Which of two builds is which. Differences are grouped by what the bytes mean — a build-number edit and a re-tuned EQ are both "a few bytes changed" but call for opposite conclusions — so the verdict distinguishes them. This is how a re-badged firmware is told apart from a genuinely different one.
Bootloader flasher
Put the dongle into bootloader mode, connect, and write a patched image you dumped from that same unit. Never flash a foreign BIN. The handshake is KTM → VER → KEY → CHP → CFG → PWO → KSTA, then 512-byte 0x69 blocks. Typing FLASH arms the write.
The unit re-enumerates as a CDC port once it is in boot mode, so connect after it has rebooted. Leave the base at 0 for the stock flag=0 images; the flag shifts the target by 32 KB per bit.