This topic is about jailbreaking the TI-Nspire CAS+ with OS 1.0.554.

Crossposting from TI-Bank and UTI, in case anyone can help with ideas or tests.



I have done some tests for months by my side. Here are my results so far:


1)a) Calculator "Send OS":

The "Send OS" menu is disabled.
Even when you connect the calculator to a computer, to a TI-Nspire/Nspire CAS, or even to another TI-Nspire CAS+.

According to tests I had asked for to Datamath, the "Send OS" menu was enabled on previous CAS+ OSes (1.0.4xx, 1.0.3xx). But I've never seen those older prototypes anywhere outside  the Datamath museum.


1)b) Calculator file architecture:

According to a basic link tool I've developped:

The CAS+ doesn't understand ".." folder
It has no "/phoenix" folder.

Visible folders are only:
"/"
"/phx"
"/phx/documents"
"/phx/tmp"

And nothing interesting in those folders.

So, the OS is not visible in the filesystem.

Notice: with so few files, the systems reports 5.9Mb used in the 27.8Mb Flash file system... Where are those Mb?...


2) Maintenance menu:

Do not try menu+enter+p. It doesn't show a menu, but does remove the OS.


3) Diagnostic menu:

I haven't managed to trigger the diagnostic menu.
With Esc+Menu+G, the calculator just doesn't turn on until you remove the batteries... Strange...


4) Ndless 1.4/1.7:

Great news! Trying to install Ndless 1.4/1.7 crashes the calculator!

You can still move the pointer and turn the calculator off and on.
But that's all.
All other keys seem useless...
And except about the pointer, the screen is not updated and seems frozen: no "low battery" or "low ressources" indicator flashing, no control key flag...

Seems the main program/OS loop is crashed/stucked, but that interrupts are still working.

It would be great to try to install Ndless 1.0/1.1/1.1.1...


5) Computer "Send OS":

The TI-Nspire Computer Link 1.0 looks for ".tnc" OS update files.
If a CAS+ calculator is connected, you immediatly get a "bad file" error when trying to flash the 1.1 CAS OS, or even the 1.1 OS renamed from ".tno" to ".tnc".

I've used a Java decompiler. The sources were not 100% ok (won't compile again - syntax errors), but here is what I have understood about the "Send OS" code. Note, I might be wrong.

- I think the ".tnc" file is not sent to the calculator.
- The ".tnc" file is decompressed on the computer in a temporary folder.
- All included files are sent one by one to the CAS+ in the "/phx/tmp" folder.
- The code checks that you've sent a ".img" file, and a "manifest_img" file.
- Then, the code calls a native method installOS() with the calculator pathes of both above files.

I've made various tests by sending such files to the "/phx/tmp" folder, but the native installOS() just triggers a "Bad File" exception without telling me anything more.

Notice: even after sending severall Mb of data in the "/phx/tmp" folder, the free space remains unchanged.


That's all for today.


I've got 2 identical TI-Nspire CAS+.
If you've got any idea of other interesting tests, just tell me.



What would be interesting to do with the CAS+ is:
- installing Ndless 1.0/1.1/1.1.1
- installing Ndless 1.4/1.7
- dumping/reflashing the 1.0 OS
- dumping the 1.0 boot2
- flashing a 1.1 OS
- flashing a 1.1 boot2

Does it have an RS232 "serial console" like the regular Nspire models do?

Be careful if you want to try to flash boot2. This will erase the original boot code. If the boot image is incompatible with CAS+ or rejected because the signing keys have changed, the caculator will become unusable.

I have a breadboard with the required chip I am currently not using, but lending it too may be unfortunately difficult, the chips would probably be damaged during shipping.

I am now using a USB-RS232 adapter hwti sent me, it is much more handy. You could try to find one to avoid building the circuit. There are usually used for transfers between a computer and a cellphone, there are probably not too expensive.

Neither am I

The voltage needs to be adapted. The max3232 does the job.

Yes, it looks like this.