Author Topic: Casio Prizm documentation  (Read 240199 times)

0 Members and 1 Guest are viewing this topic.

Offline jnesselr

  • King Graphmastur
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2270
  • Rating: +81/-20
  • TAO == epic
    • View Profile
Re: Casio Prizm documentation
« Reply #120 on: December 29, 2010, 05:36:39 pm »
And do we have those bytes for all the files? Excluding .bmp, .txt, and .csv of course. And why is hello world listed at the top?

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Casio Prizm documentation
« Reply #121 on: December 29, 2010, 05:42:06 pm »
We could probably get them without too much effort.

BTW: The Hello World was me testing the table. You can see the full edited version if you look at it again.

∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline jnesselr

  • King Graphmastur
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2270
  • Rating: +81/-20
  • TAO == epic
    • View Profile
Re: Casio Prizm documentation
« Reply #122 on: December 29, 2010, 05:43:32 pm »
Oh, okay, I see it now. Well, let's attempt to get all the files, then. ;-) Does casio have a main site like education.ti.com?

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Casio Prizm documentation
« Reply #123 on: December 29, 2010, 05:48:28 pm »
∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline z80man

  • Casio Traitor
  • LV8 Addict (Next: 1000)
  • ********
  • Posts: 977
  • Rating: +85/-3
    • View Profile
Re: Casio Prizm documentation
« Reply #124 on: December 30, 2010, 12:54:02 am »
As with previous casio calcs there is a seven byte copy protection at 0x000E, but I can't tell if anyone has cracked it yet. I believe its supposed to be some sort of checksum of the first 32 bytes of the header. Also these sven bytes are largely similar between the picture plot apps and the geometry apps, but not the conversion app
Code: [Select]
16 FE FF FE B9 57 9F ; picture plot
16 FE FF F4 75 57 9F ; geometry
C2 FE FF FF 8E 03 4B ; conversion

List of stuff I need to do before September:
1. Finish the Emulator of the Casio Prizm (in active development)
2. Finish the the SH3 asm IDE/assembler/linker program (in active development)
3. Create a partial Java virtual machine  for the Prizm (not started)
4. Create Axe for the Prizm with an Axe legacy mode (in planning phase)
5. Develop a large set of C and asm libraries for the Prizm (some progress)
6. Create an emulator of the 83+ for the Prizm (not started)
7. Create a well polished game that showcases the ability of the Casio Prizm (not started)

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55943
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Casio Prizm documentation
« Reply #125 on: December 30, 2010, 12:59:39 am »
@z80man: On the fx-9860G, the addins and the OS used a similar checksum. IIRC, the checksum for the addins on the fx-9860G was simply a sum of some 32 bytes in the header. For reference, here are the specs of the fx-9860G header: http://www.casiocalc.org?s=&showtopic=2622&view=findpost&p=36912. For the OS, it was just a sum of all the bytes in the OS placed into a 4 byte integer at the end of the OS image.

Yeah they say on their site it has 61 KB of user RAM. Are we sure that it's not just user RAM though?
Yes, you have 61KB of storage for your BASIC programs.

Some bad news:
Quote
Thank you for sending e-mail.

Also we appreciate for your running of a website for Casio scientific
calculators.
However we regret to say that Casio has no schedule for releasing a SDK for Prism
as for now.

This attractive model, developed as new education equipment, we are suggesting
new function and specification which were not able to achieved by previous
graph function.

Especially Picture Plot Function, it is favored so much, we are going to spread
more useful functions in our website contents as needed.
We would highly appreciate for your effectively usage and continued patronage
of our products.

Best regards
I guess they really don't have plans for a SDK. This came directly from their headquarters in Japan.

But if the header format get cracked, we'll be able to run our own custom code on the Prizm and we can figure out how to program it ourselves.
That sucks. Well, I guess our only way for now is hacking. I hope they don't try to counter every hacking attempt like TI did for a while with the Nspire.

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Casio Prizm documentation
« Reply #126 on: December 30, 2010, 01:17:47 am »
Looks like we're already working on the hacking  :P
∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline z80man

  • Casio Traitor
  • LV8 Addict (Next: 1000)
  • ********
  • Posts: 977
  • Rating: +85/-3
    • View Profile
Re: Casio Prizm documentation
« Reply #127 on: December 30, 2010, 01:23:55 am »
Code: [Select]
16 FE FF FE B9 57 9F ; picture plot
16 FE FF F4 75 57 9F ; geometry
C2 FE FF FF 8E 03 4B ; conversion
I figured out part of the copy protection. First of the 2nd and 3rd bytes appear to always be FE anf FF, but thats pretty obvious. More interesting was if you subtract from the picture app's 4th, 5th, and 6th bytes by the geometry app's 4th, 5th and 6th you get the same difference of their file size not including the header. You will notice though that for the 4th, 5th and 6th that the conversion app has the greatest number and the geometry the smallest which may seem strange at first considering that the conversion app is the smallest and he geometry app is the smallest. Checking it over again I noticed that the bytes were written in inverse binary. As in the 1's became 0's and the 0's became 1's. So these bytes are just the file size written in inverse.

List of stuff I need to do before September:
1. Finish the Emulator of the Casio Prizm (in active development)
2. Finish the the SH3 asm IDE/assembler/linker program (in active development)
3. Create a partial Java virtual machine  for the Prizm (not started)
4. Create Axe for the Prizm with an Axe legacy mode (in planning phase)
5. Develop a large set of C and asm libraries for the Prizm (some progress)
6. Create an emulator of the 83+ for the Prizm (not started)
7. Create a well polished game that showcases the ability of the Casio Prizm (not started)

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Casio Prizm documentation
« Reply #128 on: December 30, 2010, 01:28:01 am »
Interesting. Also, I noticed in the .g3p files that certain bytes were copied from other locations in the code, in addition to the aforementioned subtraction.

Of course, I have to credit Xeda for pointing it out to me.
∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline Builderboy

  • Physics Guru
  • CoT Emeritus
  • LV13 Extreme Addict (Next: 9001)
  • *
  • Posts: 5673
  • Rating: +613/-9
  • Would you kindly?
    • View Profile
Re: Casio Prizm documentation
« Reply #129 on: December 30, 2010, 01:32:15 am »
Now correct me if i'm wrong but if we swap two bytes, the checksum should be the same and the program should run right?  However it would fail if one of the bytes was the checksum right?  Maybe this could be used to find out where the checksum is if we don't know it already?

Offline z80man

  • Casio Traitor
  • LV8 Addict (Next: 1000)
  • ********
  • Posts: 977
  • Rating: +85/-3
    • View Profile
Re: Casio Prizm documentation
« Reply #130 on: December 30, 2010, 02:05:29 am »
Now correct me if i'm wrong but if we swap two bytes, the checksum should be the same and the program should run right?  However it would fail if one of the bytes was the checksum right?  Maybe this could be used to find out where the checksum is if we don't know it already?
Yes if we swap two bytes programs still run. Also at address 0x0020 there is a checksum of the program, but it excludes a few bytes which I have not found yet. There is also a checksum of just the first 32 bytes of the header, but i hav not found that either. So far though most of the header is cracked. Currently I'm writing documentation file for the entire app header which is $7000 bytes long. If we're lucky we could get a test NOP app running before the year ends.

List of stuff I need to do before September:
1. Finish the Emulator of the Casio Prizm (in active development)
2. Finish the the SH3 asm IDE/assembler/linker program (in active development)
3. Create a partial Java virtual machine  for the Prizm (not started)
4. Create Axe for the Prizm with an Axe legacy mode (in planning phase)
5. Develop a large set of C and asm libraries for the Prizm (some progress)
6. Create an emulator of the 83+ for the Prizm (not started)
7. Create a well polished game that showcases the ability of the Casio Prizm (not started)

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55943
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Casio Prizm documentation
« Reply #131 on: December 30, 2010, 03:21:55 am »
Looks like we're already working on the hacking  :P
Yeah I mean I hope that we can succeed in running 3rd party ASM code on it. Then we have to re-do it everytime Casio release a patch/OS that blocks it (unless they don't care).

Offline Builderboy

  • Physics Guru
  • CoT Emeritus
  • LV13 Extreme Addict (Next: 9001)
  • *
  • Posts: 5673
  • Rating: +613/-9
  • Would you kindly?
    • View Profile
Re: Casio Prizm documentation
« Reply #132 on: December 30, 2010, 03:35:32 am »
It doesn't sound like they care, nor does it sound like its possible for them to block us without breaking compatibility with the previous apps written.  I'll make an analogy to the Apps in the 84/83 series, these apps are like those.  And just like the apps we are used to, these new ones have special data and stuff to make the calculator recognize them and run them.  After we figure out how to get that to work, we can replicate it and the calculator will not even be able to tell the difference :) As far as i have heard, the apps aren't even signed O.O

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55943
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Casio Prizm documentation
« Reply #133 on: December 30, 2010, 12:34:25 pm »
Nice. That makes me wonder, though: if they use the same system as their old calcs, this means maybe we could crack the 9860G too? On the 9860G we already have a SDK, but no way to run ASM programs from BASIC, for example.

Offline jnesselr

  • King Graphmastur
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2270
  • Rating: +81/-20
  • TAO == epic
    • View Profile
Re: Casio Prizm documentation
« Reply #134 on: December 30, 2010, 05:16:41 pm »
Now correct me if i'm wrong but if we swap two bytes, the checksum should be the same and the program should run right?  However it would fail if one of the bytes was the checksum right?  Maybe this could be used to find out where the checksum is if we don't know it already?
Yes if we swap two bytes programs still run. Also at address 0x0020 there is a checksum of the program, but it excludes a few bytes which I have not found yet. There is also a checksum of just the first 32 bytes of the header, but i hav not found that either. So far though most of the header is cracked. Currently I'm writing documentation file for the entire app header which is $7000 bytes long. If we're lucky we could get a test NOP app running before the year ends.
That's awesome, really. I wish I had a prizm, because I would write the program to test the checksum for you, and have it automatically try and resent it. It shouldn't be too hard.

I'm eager to try and break the usb protocol. If anyone wants to give me a data logging for usb, and the file that they sent/received, I would be very happy, and would try and analyze it. (Simple USB Logger file is a free logger, or of you can log the bytes to a text file, that would be fine, too.)
« Last Edit: December 30, 2010, 05:16:52 pm by graphmastur »