I'm frankly pissed at TI, so I've decided to get hacking!

This method is different. I'm not interested in finding a way to crash the OS (and from there, develop a hack).
Instead, I'll take the other way instead - hacking with the original firmware/OS update instead!

Of course:

1) I have ZERO knowledge of how this works and such, but I'll use what I know to hack it
2) This isn't a one person project - anyone can join in!
3) You will not be able to download anything I have. You can follow along, but to keep TI from sending crazy
DMCA takedowns, I will NOT post links.

So, let's get started!

======================
Downloading the cursed update
I've downloaded the official, evil update from TI's website.
If you are downloading this, PLEASE, disconnect your Nspire(s) from the computer!
You never know if TI's going to try auto-updating your calc...  



...and it's done.


Into the mysterious world of TI Nspire OS Updates...

Now, there's a forum that gave me a interesting hint on opening these update files:

The tnc and tno files are PKZIPs with 63 header bytes. Some unzippers will unzip them unmodified. Inside are a .img and .cer file. The .img is a zip with other stuff in it as well. I have only managed to extract the .img with Peazip (Windows version runs in wine/darwine -- the source looks like a bitch to compile). Inside it seems to only be factory default settings (which are in a .xml in a .zip), 6 language localizations, and in the non-CAS version, parts of the 84+ ROM (I can only identify the user archive -- has several language localization apps, as well as language-local versions of at least StudyCards and Periodic). The rest of the .img (about 4/5 of it) seems to be the actual code part of the OS. I haven't spent much time examining it yet. It may or may not be compressed and/or encrypted. I certainly haven't tried to ID the processor yet.

So, renaming to ZIP did it:


And of course, it opened:


The files:


Into Pandora's box

Let's examine the files:


Ignore the dBase files. I'm still trying to figure out what they are.
The TI-Nspire file is interesting. I renamed that to a zip and opened it:


So... what exactly IS inside of these folders?
phoenix/clnk/locales/en/strings.res contains... strings (??) about class logins:
(note: this is strings extracted from the binary)
Login to Class
Transfer Status
Session Info
Class not started.
Receiving file...
Destination Folder:
User Name:
Password:*
Class has ended, you have been logged out.'
There are no pending items to transfer.
Transfer completed successfully.
Close
Login
Login Failed,
Unrecognized user for current class session.+
Communication failed. Check the connection.
Class type mismatch.
Wrong username or password.7
Username must be between 3 and 12 characters in length.7
Password must be between 3 and 12 characters in length.
Login attempt failed.
Wrong device type.
 is already logged in.
You are logged in as user:
Login Successful
 is logged in.
Not logged in.
Network:  
Wireless cradle is not attached.
Connecting to AP.
Connected to AP.
Connected to Network.
Network Error.
Recharge cradle immediately.

Anyway, that's all I have for now. I'll keep you guys updated!

Albert

@apcalc: I would assume that if you were interested, you would know what the goal is.
It is to indeed, execute community apps/programs. For Nspire, it's more or less C programs,
but can be ASM too.

I'm not sure about that though. You could go inside the file and muck around and attempt to replace files.

On my Ubuntu, p7zip is installed, so it was able to open and extract it. (p7zip is the linux version of 7zip.)

I'm not really sure about finding the causes though. That requires decrypting and extracting the OS
(and decompiling it too!), so I'm not sure.

If you want to know what the hackers are up to, check out this:
http://www.unitedti.org/forum/index.php?showtopic=8191&st=800

They are far up ahead than me.

You're reinventing the wheel, alberthrocks. Use (and expand if you can find new things) the information already posted at http://hackspire.unsads.com
Between other things, how the upgrade locks out OS downgrading has been documented for more than 24 hours already, on UTI, and cross-posted at least to TI-Bank and yAronet: http://www.unitedti.org/forum/index.php?showtopic=8191&view=findpost&p=141968

If you open up the Nspire OS with a text editor (without using 7-zip or some other program to extract the files contained within), you can clearly see the minimum OS version (in plain text, not even in hex).

Could you change it to "1.1.9523", save, and send to your calculator? Based on ExtendeD's and Goplat's posts on UTI, I assume this would work presuming you haven't already sent 2.1 to your calculator- unless of course it invalidates the OS in some way.

@Ancient Power: My goal is to disassemble it and find bugs that way.

@Lionel Debroux: Wow.... well, I'm certainly behind! :-o I'll look into it.
It seems though that nobody in the UnitedTI forums noticed (nor in the Wiki) that the Nspire OS is BSD based.

Also... in theory, couldn't the boot1 be extracted and used to find the keys?
RSA is public/private key based - it should be decrypting it with the private key.
Finding the private key can lead to the public key...?

BTW, are you the TiLP developer by any chance?

@DJ Omnimaga: I've looked into that. I don't think it'll work, since it's bound to break CRC/MD5/SHA1/whatever checks.
(And possibly the 1028 bit RSA key encryption too!)

And some French will do me some good. I take French, and I think it's a cool language! (Je pense français est très super!)

EDIT: Wow... unfortunately, I was right about the process not working.

@TC01: I wish it was that way. I'm pretty sure there are some interesting checks that they put in (listed above).

And some French will do me some good. I take French, and I think it's a cool language! (Je pense français est très super!)

I agree it can be good to know multiple languages, even if not perfectly. In the TI community case, the 2nd most popular language is French, followed by Dutch, with German lagging far behind.

Anyway, sadly I am not into low level stuff, so I wouldn't be able to help much, unless it was to factor a key or something, I would be happy to put my two computers to contribution. I wish you guys (and girls?) good luck on hacking the OS or the calc

Wait, what exactly are we trying to do here?
We can already execute machine code on OS 1.1, and Ndless 2 is rumored to function on OS 1.7, so barring future downgrade protection, Ndless 2 will bring with it the ability to execute unsigned applications on all versions of the Nspire hardware.
Or are we trying to remove the downgrade protection from 2.1?
Or are we just brainstorming general discoveries?