This whole process started a long time ago when FloppusMaximus unlocked flash on his calculator. Then came custom OS's, the key factoring, and finally modifying the boot code. This will remove almost all traces of TI from your calculator, but your not quite done, you still can't execute code >$C000.

However, today, I managed to do it. I executed code all the way from $C000 to $FFFF on page 0.

I was playing around with DrDnar's MicrOS preparing to do some boot code changes, when I got a little scared and decided to play around with the protected ports a little. I kept going down the line seeing what would change, and what wouldn't, when all of a sudden, writing to port (25h) crashed my calculator. After a little bit of experimentation, I figured out that any value higher than 17h caused a restart. Then I noticed that port (26h) also crashed my calculator, so after a bit more playing, I realized that any value lower than 1Ah would cause a reset.

Why this actually happened caused me quite a bit of trouble. I started outputting different values to the ports and seeing what I could get to crash. I tried running all sorts of programs with these ports enabled and I wasn't really getting any results. But finally, four hours later, with lots of trial and error with StarFox, I realized that the programs would crash if they executed ram low in memory. A quick check with a RET placed at $8000 confirmed this and then I was off to test the limits.

Setting port (25h) to 17h crashed when PC went below 9C00h. 16h crashed at 9800h. So obviously it is counting by 400h. I then did some testing with port (26h). 19h crashed at A800h and 1A crashed at AC00h. So again, counting by 400h.

After a bit more testing, I realized that these ports are looking at the ram chip as a whole where page 00h comes first, then 01h, 02h, and so on and setting the upper and lower ram execution limits.

So...
Send 00h to port (25h) and FFh to (26h) and your calculator will never crash from PC execution ever again.


For more details, see the newly updated wikiTi for ports 25h and 26h.

Cool!  What are the original values?

Too bad this doesn't work on a Ti-83+ BE

Wiow this is awesome, so you totally destroyed the 8 KB limit?

Gone

Cool!  What are the original values?

Too bad this doesn't work on a Ti-83+ BE

Typically, 25h and 26h are at 10h and 20h respectively. As long as bits 4 and 5 are 00 though, you should only have to set 25h to 00h to make this work.

so, doing:

ld a,0
nop
nop
im 1
di
out (25h),a
ld a,$FF
nop
nop
im 1
di
out (26h),a
will allow you to never have the >$C000 thing happen again?

AWESOME.

Well, first, flash has to be unlocked before you can even dream about changing ports 25 and 26.

But actually, what we've found through testing is that you don't need that special sequence and it doesn't have to be on a privileged page, the boot code does it, but I'm not really sure you need it. I've been just changing them with OUT ($24), a.


So, unlock flash. Then use the ports like normal.

Wow. You did it.

It feels awesome to be reminded that underneath all these little details, the TI-83 Plus series are just little computers.

I really need to you run this test if

1. You have a 83+SE. Theoretically, this should work.
2. You have a really low revision 84+BE/SE. We need to know if the port writing still works OK on these.

Works on my ancient 0404 84+SE calc. No revision letter because it was the very first revision.

I bet plenty of people on IRC still got them, because they were around since their release. I think tr1p1ea has one of them.