Author Topic: Hacking the TI Nspire CX Native OS? (Read 18234 times)

Juju · « **Reply #15 on:** January 18, 2013, 03:24:09 am »

Quote from: critor on January 18, 2013, 03:06:43 am

Quote from: ElementCoder on January 17, 2013, 03:30:14 am
Don't we have nsNandMgr for this now? Or is that not capable of loading custom OSes?
nsNandMgr doesn't deal with OSes at all, and so is unable to run them.
But as nsNandMgr does deal with Boot2/Diags, you could run a custom Boot2 which would then load an OS the way you want.

IIRC you can boot Linux this way.

willrandship · « **Reply #16 on:** January 18, 2013, 03:39:05 am »

Well, the current method for running Linux doesn't do this, but it's certainly a possible route to do so. The current program loads itself into RAM then shuts off the nspire, all post-boot, so it bypasses the whole protection system.

Jim Bauwens · « **Reply #17 on:** January 18, 2013, 03:56:08 am »

The best way is to hot patch the OS, add hooks and stuff such as Adriweb mentioned. This is probably more easy too.

davetheant · « **Reply #18 on:** January 18, 2013, 09:05:57 am »

How difficult is it to create a custom Boot2? Could this brick my calculator if I messed up?

and are there any simple tutorials for adding hooks?

Lionel Debroux · « **Reply #19 on:** January 18, 2013, 09:48:20 am »

Quote

How difficult is it to create a custom Boot2?

Impossible: the boot2 is validated by the boot1. If the boot2 is not valid, it's erased by the boot1, and then, the calculator requires reflashing through the RS232 port, which requires additional hardware.

Quote

Could this brick my calculator if I messed up?

The calculator is not bricked as long as the boot1 is not.

davetheant · « **Reply #20 on:** January 18, 2013, 07:07:50 pm »

Alright thank you for the clarification. I'll attempt to add hooks to the OS but I'm not sure where I would put them or how to get my custom OS onto my calculator.

willrandship · « **Reply #21 on:** January 18, 2013, 07:09:04 pm »

You don't get the OS onto the calculator. You run an ndless program that changes the OS state in RAM. By putting such a patch in the ndless startup folder, you can have it run on boot, so it feels like you've put in a new OS even though you haven't.

davetheant · « **Reply #22 on:** January 18, 2013, 07:29:50 pm »

Thanks. Now where would I begin modifying the OS to change some menus around? I see a bunch of asm files

Lionel Debroux · « **Reply #23 on:** January 19, 2013, 01:43:15 am »

Quote

Now where would I begin modifying the OS to change some menus around? I see a bunch of asm files

Without any official documentation, that's indeed what the OS is - a large pack of ASM.
The Ndless SVN repository contains some information about symbols.

davetheant · « **Reply #24 on:** January 19, 2013, 10:18:49 am »

I can't seem to find Ndless on SVN at all, just an Unofficial Ndless clone with nothing in it

EDIT: I think I found a clone of Ndless, but where do I go from here? Say, to add some entries to the menu when the "menu" key is pressed?

excale · « **Reply #25 on:** January 19, 2013, 10:29:34 am »

Quote from: davetheant on January 19, 2013, 10:18:49 am

But where do I go from here? Say, to add some entries to the menu when the "menu" key is pressed?

I'm pretty sure there is no documentation about this. The easiest way for now would probably be to have a look at the source code of ThemeEditor v2 and understand how it works.

davetheant · « **Reply #26 on:** January 19, 2013, 04:15:52 pm »

Alright thanks, so I played aroudn with theme editor and examined the source for a while, and the only part that seems useful is as follows (in C):

Code: [Select]

void hook_menu_handler(Button button, CallbackData button_data, EventCode eventCode)
{
	if(eventCode == ENTER || eventCode == MOUSECLIC)
	{
		Config *conf = new_config();
		char *filename = "/ThemeEditor.tns";
		char *argv[] = {filename};
		if (read_config(conf, 1, argv))
		{
			free_config(conf);
			return;
		}
		
		if (conf->mode == 2)
			conf->current_index = themeEditor(conf->current_index);
		else
			theme_editor_gui(conf);
		
		write_config(conf);
		free_config(conf);
	}
}

static int32_t* new_menu = NULL;

void hook_menu ()
{
	if(*((int*)HOOK_ADDR) == HOOK_VALUE)
	{
		int32_t new_menu_[] = {
			1, 0xE5,  0xFFFFFFFF, 1, SYST,
			2, 0xE7,  0,          0, SYST,
			3, 0xEB,  0xFFFFFFFF, 2, SYST,
			3, 0x16D, 0xFFFFFFFF, 3, SYST,
			1, 0x176, 0xFFFFFFFF, 4, SYST,
			1, 0x192, 0xFFFFFFFF, 5, SYST,
			1, 0x5E,  0xFFFFFFFF, 6, SYST,
			// sentinel 0x42133769 because we can't get absolute addressing in the declaration of a table
			1, 0x34,  0x42133769, 0, SYST,
			0, 0,     0,          0, 0
		};

		new_menu = malloc (sizeof (new_menu_));
		unsigned i = 0;
		unsigned n = sizeof (new_menu_) / sizeof (new_menu_[0]);
		for (; i < n; ++i)
			if (new_menu_[i] == (int32_t)0xFFFFFFFF)
				new_menu[i] = (int32_t)MENU_CALLBACK;
			else if (new_menu_[i] == 0x42133769)
				new_menu[i] = (int32_t)hook_menu_handler;
			else
				new_menu[i] = (int32_t)new_menu_[i];

		*((int32_t**)HOOK_ADDR) = new_menu;
		puts("patched");
		nl_set_resident();
	}

I understand C fairly well, but I don't see where the code adds the "6: Theme Editor" to the Settings menu.. Any ideas?

Levak · « **Reply #27 on:** January 19, 2013, 07:55:39 pm »

Quote from: davetheant on January 19, 2013, 04:15:52 pm

I understand C fairly well, but I don't see where the code adds the "6: Theme Editor" to the Settings menu.. Any ideas?

In Gui.c, last lines.

Edit1: okay, I'm naughty ..

Basicly, menus in the TI-Nspire OS are static and encoded like that :

Quote

Deep, Resource ID, callback, callbackdata, Resource Lib,
...
0, 0, 0, 0, 0

Deep defines what deep the menu entry is, basically, if it is in a submenu.
When you have a submenu, its callback and callbackdata are null.
The submenu is right after this entry.

Resource ID defines the offset in the Resource Lib. You'll have to extract all the resource strings to have an idea what is behind.
The function called is get_res_string(lib, id); This returns an utf16 char array.

Callback is the function that is ran when you hit the entry
Callbackdata is the data passed to this function as 2nd argument (first is the Button, third is the event Code - keep in mind to have a condition code to filter only active events like Enter or MouseClic).

Resource Lib is the lib to use for the string (SYST, DCOL, CTLG, etc ....) - those are defines in nFrame, sorry.

Edit2: By the way, I do not really add '6 - Theme Editor' because I do not have the place for one more entry in the OS.
I simply copied the existing table (I could have made a simple copy table also) in the source code and put one more entry.
This is not the extensible way to do, I know it, but it was worth for testing :p.

davetheant · « **Reply #28 on:** January 20, 2013, 06:22:52 pm »

Wow, I never thought that Levak himself would reply to my post! You cleared up a lot of my questions, so thanks a lot!

I think one last question will set me on the way to adding my own entries to the menus:
How do I extract the resource strings using "get_res_string(lib, id)" ? Say I added that in the C file somewhere, how would I be able to see the array that is returned?
Thanks again everyone

Levak · « **Reply #29 on:** January 20, 2013, 08:06:30 pm »

Quote from: davetheant on January 20, 2013, 06:22:52 pm

How do I extract the resource strings using "get_res_string(lib, id)" ? Say I added that in the C file somewhere, how would I be able to see the array that is returned?

Code: [Select]

#include <os.h>
#include <libndls.h>

static unsigned get_res_string_addrs[] = {0x100E9B20, 0x100E9E10, 0x100E9634, 0x100E994C};
#define get_res_string SYSCALL_CUSTOM(get_res_string_addrs, char *, int, int)

enum {
    CLNK = 0x636C6E6B,
    CTLG = 0x63746C67,
    DCOL = 0x64636F6C,
    DLOG = 0x646C6F67,
    DTST = 0x64747374,
    GEOG = 0x67656F67,
    MATH = 0x6D617468,
    MWIZ = 0x6D77697A,
    NTPD = 0x6E747064,
    PGED = 0x70676564,
    QCKP = 0x71636B70,
    QUES = 0x71756573,
    SCPD = 0x73637064,
    SYST = 0x73797374,
    TBLT = 0x74626C74,
};

int main()
{
    char *undef = "U\0n\0d\0e\0f\0i\0n\0e\0d\0\0";
    int i = 0;
    char *utf16;
    String s = string_new();
    do
    {
        string_set_utf16(s, get_res_string(SYST, i));
        if (memcmp(undef, s->str, 20) == 0)
            break;
        char ascii[s->len + 1];
        printf("0x%X : %s\n", i, string_to_ascii(s));
        ++i;
    } while (1);
    string_free(s);
    puts("");
    return 0;
}

Or simply : https://www.dropbox.com/sh/orpup682k3f7nkd/fQRyPHoVvv

Author Topic: Hacking the TI Nspire CX Native OS? (Read 18234 times)

Juju

Re: Hacking the TI Nspire CX Native OS?

willrandship

Re: Hacking the TI Nspire CX Native OS?

Jim Bauwens

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

Lionel Debroux

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

willrandship

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

Lionel Debroux

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

excale

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

Levak

Re: Hacking the TI Nspire CX Native OS?

davetheant

Re: Hacking the TI Nspire CX Native OS?

Levak

Re: Hacking the TI Nspire CX Native OS?