Update:
--------------------------------------------------------
Instructions for the CX to CXCAS Exploit (Quick version)
--------------------------------------------------------
READ ME!
This information assumes that the reader is at risk for exploiting a TI-Nspire CX touchpad only calculator, wherever CX is denoted. Also, this instructional slightly curtails the already NlaunchCX v2.0 instructions, and tries to combine all restarts and steps where ever possible making an efficient and speedy non-CAS CX to a CXCAS switch, with out intermediary steps. In other words, this report is a quicker method for getting the CX OS to the "CXCAS OS exploit point", if one will, and works the same, if not better. However, I make no guarantees that it can be recreated exactly as stated for others. Do further research if uncomfortable with this modified exploit method before proceeding.
Furthermore, bricking the CX calc. is possible, but unheard to me. If worse comes to worse, just reinstall the original OS at step #2 through the TI-Nspire PC Software, then do it again at reboot. (Then close this instructional, and walk away very quickly)
I make no guarantees that no damages, or damages, will, or will not occur to ones CX calc. ;P On top of this, I do not condone illegal uses for the instructions contain herein. "They're on their own, especially if clueless". However, if anyone has questions, if it can be made more efficient, grammatically, or technically better, it's for those to do what they will. Otherwise, if one is hesitant, do some research by reading all posts from where this exploit began rumored.
Last but not least, I'm in the process of coding a C++/VB program to make the below steps even simpler. If allowed to do so, a "No Brainer" Exploit.zip/.exe for the Non-CAS to CAS TI Nspire calculators maybe available in the future, if I can find the time. The source files will be included of course, for those who want to improve upon it.
With that in mind....
CX calculators with serials ending with P-xxxxA-I, has in my research will work based on other testimonies, including my own. Otherwise, this exploit, or possibly other methods like this, may or may not work; outside of downgrading the CX OS, if even that.
For the sake of simplicity, The below exploit is for CX serial# P-xxxxA-I and OS's before or on 3.2.3.1233.tcc OS, but not including 3.2.3.1233.tcc onward.
-------------
Instructions:
-------------
Please read through first, and follow the steps exactly for any exploit to be successful. (See below For original nlaunch exploit instructions if needed)
1. Download TI-Nspire PC Software 3.2.0.124 from TI website, install, and run.
a) Connect both CX calc and PC with the USB cable, if it's not already, and backup all data on CX calc.
b) Find, and connect to the CX calc. handheld through the TI-Nspire PC software by clicking on the lower right icon, where "Select
A Handheld" is found.
2. Download TI-NspireCX versions, 3.1.0.392, 3.2.0.1212, 3.2.0.1219 or 3.2.3.1233.tcc from:
http://ti-pla.net/a3717 a) *NOTE* the unit may already have one of these CX OSs already pre-installed.
b) Check under 5. Settings, 4. Status, tab, and About on the CX calc.first if in doubt.
c) If so proceed to step #3 and ignore
http://ti-pla.net/a3717.
d) If not, download a suitable OS from:
http://ti-pla.net/a3717, and use the TI-Nspire PC Software to install before proceeding further.
3. Download, extract/unzip, nlaunchy CX 2.3 from:
https://github.com/Excale/nLaunchy 4. Download, install, and run TNOC from:
http://ti-pla.net/a19225. Download TI-NspireCXCAS-3.1.x.xxx.tcc from:
http://ti-pla.net/a3718 (*Notice* this is the CXCAS OS and not the CX OS)
6. Focus the TNOC program and load the downloaded TI-NspireCXCAS-3.1.x.xxxx.tcc file.
a) The TNOC executable is found here, more or less. C:\x...\TNOC\TNOC_1.24\Windows\TNOC_en.exe
b) Check the Delete boot2 box, then one can optionally delete the samples files in the Example folder, and process. However, this does not delete the Example folder, just the samples in the Example folder.
c) After TNOC'ing the TI-NspireCXCAS-3.1.x.xxxx.tcc file, find, and rename the TI-NspireCXCAS-3.1.x.xxxx_xx.tcc to "phoenix.tns"
d) Select the handheld by finding the handheld icon in the LRH screen in the TI-Nspire PC Software.
e) Add folder named nlaunch under...Documents\nlaunch\ (Left bottom screen area, where -Documents/+examples+MyLib...etc. are)
f) Drag phoenix.tns, into \nlaunch.(Although, any directory under the Document root will work)
g) Drag #3. files from nlaunchCX\CX\ {nlaunch.tns, preloader.tns} into Document\nlaunch.
7. Put CX calc into Maintenance Options Mode by pressing and holding {doc+enter+EE}. (Tricky)
a) *Note* The calculator can be off, or on for steps #1.- #7.
b) Then depress and release the reset button on CX calc. back.
c) Once reset shows the TI screen loading bars, then release {doc+enter+EE}.
d) When CX calc enters Maintenance Options, choose 2 to delete OS, choose 1 to proceed, deleting,,,and then press any key to restart.
8. After the CX restarts, Open TI-Nspire PC Software, if not already opened, with CX calc. connected.
a) When the CX calc. restarts, shows a caution (/!\) symbol, Install OS, and the progress bar is stuck at 60%....
b) Select the CX hand held again by finding the handheld icon in the LRH screen in the TI-Nspire PC Software.
c) Drag or copy the nlaunch.tco from the PC nlaunchCX\CX\ into CX calc. Documents\nlaunch\
d) The TI-Nspire PC software will give an error dialog, "Error Experienced a problem while communicating with the handheld. A retry may be successfull." but low and behold, it installs the nlaunch.tco anyway on the CX calc.
e) It takes a few minuets for the nlaunch exploit to install the phoenix.tns file.
f) If steps #1.- #8. c). are done properly, the TNOC'ed phoenix.tns "CXCAS OS" file will install and reboot. Then ABC123, blink, then ABC1234 will appear briefly in the upper LH corner of the CX calc, at the restart of the nlaunch.tco\phoenix.tcc install.
g) If not, push the reset button on back of CX calc. again and repeat #8.
9. Once installed, go through all the CX "CXCAS" calc. setup prompts.
a) *Notice* one of the CX system start up prompt says a CXCAS OS was installed. This can be further investigated by checking 5. Settings, 4. Status, tab, and About on the CX calc. to see if indeed the CX is now a CXCAS. If not start over, give up, and reinstall the CX back to the original OS at #2. (Then slowly close this instructional, and walk away very slowly)
b) *Note* If those have made it this far, and have had success, congrats. One is not "Out of the woods yet", Do Not Upgrade the calculator with an OS unapproved by this exploit mentioned in, and, or before this post until it's safe to do so. Mainly 3.2.4.xxxx.tcc OS onward, but others on may render the CX calc. stuck with that OS. Which ultimately means the unit is hard coded with no hopes in downgrading to make this exploit work again, or again it might work. (Per other testimonials)
c) However, my CXCAS V3.2.0.1219 OS works, but not all CX/CXCAS OSs will nlaunch correctly exploit. So read up on what has worked, and ignore what has not been posted as exploitable.
----------------------
Cautions and Warnings:
----------------------
A) I guarantee nothing, and I hold myself harmless to any damages done to the CX calc. unit, and, or from other further legal measures taken against those, by TI, and, or by academic constituents if this device is used in a manner not authorized by such authorities that are within the power that govern herein and here out this construed instructional. ;P
B) These, and other CX to CXCAS exploits are meant for those who love math, coding, TI's, and their freedom in using their other God given talents. Those who are educated, do their work mostly by hand, and then want to double check their work. Others, want to upgrade the CX to a CXCAS OS for personal use, and, or for their careers after graduating. Others feel that they have been cheated by a capitalistic system, and demand a product that was promised flawless beforehand. Wherever others fit in, heed these warnings!
C) Most educational institutions will not allow a CAS driven graphing calculator, or any calculator for that matter unless specifically authorized to do so. Some professors, or teachers have even been alerted via memos on which exploited TI Nspire OS are out there. Which most TI Nspires are. Then those in power can easily check under 5. Settings, 4. Status, tab, and About on the CX calc..
D) However, no matter how, or what intentions were when these instruction were found, one may make think thyself clever, innovative, curious, and maybe even intelligent. However, it also shows a tendency to be reckless by taking shortcuts in life, or in ones education. In other words...please, do not try to use this exploit where prohibitive.
_____________________________________________________________________________________________________________________________________________
Thanks to those who provided the shoulder to stand on for this exploit,
Theascen
_____________________________________________________________________________________________________________________________________________
-------------------------------------------------------------------------------------------------------------------------
Below are are the edited supplemental original nlaunch v2.0 instructions for the CX calc., minus the Clickpad and Touchpad info.
Copyright (C) 2012-2013 nLaunch team Copyright, (C) 2013 nLaunch CX guy.
-------------------------------------------------------------------------------------------------------------------------
=======================
| nLaunch CX v2.0 |
=======================
PLEASE READ THE WHOLE README BEFORE DOING ANYTHING.
nLaunch is a set of programs and crafted OS updates suitable for:
* Nspire Clickpad and Touchpad calculators running boot2 1.4.1571 ("1.4");
* Nspire CX calculators running boot2 3.1.0.16 ("3.1").
It enables users to install and launch arbitrary OS updates located into the
user-accessible part of the filesystem - especially Linux :-) (see
http://github.com/tangrs/linux for more information )
As usual, use at your own risk :-P
Initial installation
====================
Needless to say, all steps are important ;-)
**** CX installation (see above for Clickpad and Touchpad) *****
----------------------------------------------------------------
0) backup your documents from your nspire on your computer
1) install the 3.1.0.16 boot2, usually known as "3.1".
If you have installed OS 3.1.0.392, 3.2.0.1212, 3.2.0.1219 or 3.2.3.1233 you
already have it. If you have installed any newer version, you probably will
not be able to easily install the 3.1.0.16 boot2.
Otherwise, install OS 3.1.0.392:
CX CAS:
http://ti-pla.net/a3718 CX :
http://ti-pla.net/a37172) get a compatible OS. See
http://tiplanet.org/forum/archives_list.php?id=OS+Nspire - NOTE: Not all TI-OSes are compatible with nLaunch.
OSes 3.1.0.392, 3.2.0.1212, 3.2.0.1219 and 3.2.3.1233 are.
For a full list of compatible OSes, check src/patch.c
3) use TNOC (
http://ti-pla.net/a1922 ) on the OS upgrade to remove the boot2
(you can remove the examples too)
4) rename the TNOC'ed OS to phoenix.tns
5) transfer phoenix.tns to your calculator in the folder /nlaunch/, being at
the root of the user-accessible part of the file-system
6) get to the CX folder
7) transfer nlaunch.tns and preloader.tns to your calculator in the folder
/nlaunch/, being at the root of the user-accessible part of the file-system
if you have installed it on OS 3.1.0.392, uninstall Ndless by launching
ndless_resources.tns
9) reboot (the reset button is the easiest way), go to the maintenance menu
(
http://ti-pla.net/t5360 ), delete OS (option 2)
10)reboot, transfer nlaunch.tco/tcc to your calculator (an error will certainly
be shown on the computer, check if it is ok on your calculator)
- /!\ the initial exploit can fail. If the progress bar is stuck at 60% and
nothing is shown (you should briefly see "YZ") at the top left of the
screen, reset and send nlaunch.tco/tcc again.
- /!\ getting to the OS the first time can be fairly long (max 3 min); the
progression bar can be quite unstable. If the bar did not move at all
during 3 minutes, consider the boot as a failure
- NOTE: unplugging the USB cable "at the right time", i.e. after sending
the TNO/TNC and shortly after the bar has reached 60% again, may increase
the reliability of the installation procedure. Likewise, the second
generation of Ndless (1.7/2.0) worked better when USB was unplugged.
11)enjoy :-)
- /!\ when rebooting, the progress bar can sometimes be stuck a 60% with
nothing shown at the top left of the screen. Simply press "reset" until it
works.
NOTE: if it is working fine and you want nLaunch to be more stealthy when
booting, you can compile a quiet version ("DEBUG 1" in nlaunch.c).
Update of the target OS version
===============================
1) get a compatible OS. See
http://tiplanet.org/forum/archives_list.php?id=OS+Nspire2) Use TNOC (
http://ti-pla.net/a1922 ) on the OS upgrade to remove the boot2
3) rename the TNOC'ed OS to phoenix.tns
4) transfer phoenix.tns to your calculator in the folder /nlaunch/, being at
the root of the user-accessible part of the file-system
5) reboot
- /!\ first boot can be fairly long (max 3 min); the progression bar can be
quite unstable.
Update of nLaunch
=================
1) get to the CLASSIC or CX folder according to your calculator
2) transfer nlaunch.tns to your calculator in the folder /nlaunch/, being at
the root of the user-accessible part of the file-system.
3) reboot
Uninstallation
==============
1) get any compatible OS. See
http://tiplanet.org/forum/archives_list.php?id=OS+Nspire2) use TNOC (
http://ti-pla.net/a1922 ) on the OS upgrade to remove the boot2
3) reboot, go to the maintenance menu (
http://ti-pla.net/t5360 ), delete OS
4) reboot, transfer the OS to your calculator
Troubleshooting
===============
Signification of a few debug strings:
* 'U': the OS was not recognized and thus not patched
* 'F': if this is an OS made by TI, this means it was not loaded correctly in
memory.
CX: if the reset button doesn't work, use a screwdriver to open the battery
door and remove the battery before plugging it back in.
Using Ndless with nLaunch
=========================
* Ndless 1.7/2.0 should work out of the box.
* if you want to use Ndless 3.1 with nLaunch, just send the custom
ndless_resources.tns provided in this distribution to the /ndless folder,
then reboot. The Ndless 3.1 loader is embedded in nLaunch.
If you want to uninstall a Ndless 3.1 handled by nLaunch, just remove
ndless_resources.tns and reboot. Warning, this is _very_ different from
vanilla Ndless: vanila Ndless is removed through launching
ndless_resources.tns, but one mustn't remove ndless_resources.tns !
License
=======
Copyright (C) 2012-2013 nLaunch team
Copyright (C) 2013 nLaunch CX guy
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2, as
published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software Foundation,
Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Contact
=======
Same as nLaunch 1.0: if you have problems or want to submit an idea / a patch,
leave a message on one of the well-known websites of the TI-community.
I think I think, I think?
