So we have assumed in the above posts that the Boot1 on prototype Nspire ClickPad was rewriteable (which is a very good news if right, and a wonderfull hope for those owning such models currently limited to OSes 1.1/1.2 because of different RSA signing keys).

The only remaining question was if it was also possible on production Nspire ClickPad.

Here's the same Ndless program running simultaneously on a prototype (on the left) and on a production model, trying to get the NOR chip ID:



On the left it does pass.
On the right it does fail.

Which would mean if the test is correct, that TI added some software/hardware protection on production Nspire ClickPad models, preventing direct access to the NOR chip.


Wouldn't that mean that prototypes prices should raise on eBay soon?

But could it not be that the non-prototype used a different type of nor, differently accessible than the prototype? It might be that its not protected, but that it works just different?

According to Datamath.org, the prototype and non-prototype basic ClickPad models are using the same NOR chip:
http://www.datamath.org/Graphing/JPEG_NSpire_P.htm#memory
http://www.datamath.org/Graphing/JPEG_NSpire.htm#memory

R02D is a resistor - should be able to solder that .......
Dont know the size of the resistance.

R02D is a resistor - should be able to solder that .......
Dont know the size of the resistance.

Yes we should be able to solder a resistor, but we have to solder it on *something*.

Just check: the circuit connected to the NOR chip pin is gone

Hmm, thats kinda sad

Edit:
That (removed) circuit line goes directly to a pic named NC (not connected). The closest other pin is WE# (write enable), so maybe its connected with this.
Another option is that that line isn't connected at all with the NOR chip, but just goes under it (there is another line coming out the other side that is perfectly aligned with it).

Anyway, there isn't really a way to any pins on the bottom of the NOR, as the SoC is just under it.