Author Topic: The 1st step into CAS+ flashing (Read 29147 times)

bsl · « **Reply #30 on:** March 18, 2011, 11:39:15 am »

The usual UNIX xmodem commands are:
sx - xmodem send file
rx - xmodem receive file

Datalight ROMDOS manual uses TRANSFER
TRANSFER /S -- send
TRANSFER /R -- receive
see: http://www.rtd.com/NEW_manuals/software/cpumodules/ROMDOS_manual.pdf

On the shell try either:
C:\> sx /b C:\phoenix\install\devfiletree.zip
or
C:\> transfer /S C:\phoenix\install\devfiletree.zip

If this succeeds then on hyperterminal:
Transfer->Receive File->Place received file in the following folder <= select the name of the file to save as
also set the protocol:
Transfer->Receive File->Using receiving protocol->Xmodem
Then hit the Receive button

Compynerd255 · « **Reply #31 on:** March 18, 2011, 12:22:22 pm »

Okay, this sounds really cool. So, if I understand properly, this is all being viewed from the CAS+ calculator screen? Or is it being viewed from a computer? No matter what it is, it still sounds really cool that you can get down into the calc system on such a base level. I hope to see cool programs on the nSpire soon!

willrandship · « **Reply #32 on:** March 18, 2011, 01:43:26 pm »

It's from a PC. If you've ever used an arduino, it's like the serial console in the IDE (in fact, it's exactly the same

)

critor · « **Reply #33 on:** March 18, 2011, 02:08:08 pm »

Hi!

I've done other tests today.

The CAS+ driver is very different from the final driver.
It seems to setup some virtual local "USB" network.

As you could see in "recent" CAS+ logs, there is some kind of a DHCP server on the calculator.

For example, if I plug a recent CAS+, I'm getting a new peripheral: "Texas Instruments Remote NDIS Network Devices". I'm getting a new network connection, which aumatically gets its IP (for example, it can get 172.16.80.29, with 255.255.255.252 mask).

I mentionned there was no trace of it in the oldest CAS+ log.
Allow me to correct: the DHCP server is there but is not launched automatically.
It is launched when you plug the USB for the 1st time.

When I plug my oldest CAS+, the "Texas Instruments Remote NDIS Network Devices" does appear, but fails at getting an IP.
After a long time, it gets by default the bad 169.254.145.44 IP address.

TI-Nspire Computer Link 1.0 isn't finding anything.

Here's the log, when I plug the USB for the 1st time (takes some time):

Code: [Select]

C:\>pn-srv6-457: nuc_init, release the hounds
01 00:23:23.000 0 | Waiting for next RPC call...
pn-srv6-463: nuc_init done
pn-srv6-333: msg Q id = 8
pn-srv6-1073: bound dhcp-wake [127.0.0.1:10005] to 1
pn-srv6-1073: bound dhcp-req [0.0.0.0:67] to 2

phoenix dhcp server  built 25-Apr-2006  running

pn-srv6-1193: usb insert 2,0,14
pn-srv6-1073: bound dhcp-ans [172.16.46.58:68] to 4
pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=4, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=4, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68

phoenix enum server  built 25-Apr-2006

pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=4, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-1073: bound dhcp-ans [172.16.177.46:68] to 8
pn-srv6-821: ready to reply(hh=8, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=8, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=8, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-821: ready to reply(hh=8, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68
pn-srv6-701: request type 1
pn-srv6-1073: bound dhcp-ans [172.16.50.34:68] to 9
pn-srv6-821: ready to reply(hh=9, sz=281), typ=2, to port 68
pn-srv6-838: sent reply 2, len=281, to port 68

If I unplug the USB, I get:

Code: [Select]

C:\>pn-srv6-1116: usb notify (0) 2,0,9
pn-srv6-1286: usb remove 2,0,9

If I replug the USB, I get:

Code: [Select]

pn-srv6-1116: usb notify (0) 2,0,9
pn-srv6-1286: usb remove 2,0,9
pn-srv6-1116: usb notify (0) 2,0,9
pn-srv6-1286: usb remove 2,0,9
pn-srv6-1116: usb notify (1) 2,0,9
pn-srv6-1193: usb insert 2,0,9

I've tried to force 172.16.80.29 as an IP address.
TI-Nspire Computer Link 1.0 doesn't find any calculator, but is taking more time looking for them...

Has somebody any idea of the problem?

The zip file from /phoenix/install is in the documents folder.
If I can just transfer one file, we can start looking into the OS.

Other various informations:

The "check" command is working:

Code: [Select]

check c:
relFs_Check v2.00.0451
Copyright (c) 2003 - 2005 Datalight, Inc.
Checking 27M Byte drive C:

Checking critical meta blocks.................................OK
Checking indices..............................................OK
Checking all directory contents and inodes....................OK
Checking allocation map.......................................OK
Checking for stranded blocks..................................OK
relFs_Check completed.

Volume Information:
   29,188,096 bytes in volume
   11,594,240 bytes in 238 files
       66,048 bytes in 102 directories
       34,304 bytes system overhead
   17,493,504 bytes available for use

          512 bytes per block
       57,008 total blocks in volume
       34,167 blocks available

The "show" command is working too:

Code: [Select]

show c:
Datalight Reliance v2.00 Build 0451
Copyright (c) 2003 - 2005 Datalight, Inc.
Settings for Volume 'c:'
  Drive number:                    2
  Total file/directory handles:   30
  Handles in use:                  0
  Physical Disk Info
    Sector size:                 512
    Total sectors:             57008
  Logical Disk Info
    Block size:                  512
    Total blocks:              57008
    Used blocks:               22866
    Free blocks:               34142
  Transaction points:           7945
  Transaction flags:          0x0FA7
Driver Settings:
  Maximum logical block size:  65536
  Cache size:                  256Kb
    Buffers:                     456
    Buffer size:                 512
    Write gather size:          16Kb
  Timed Transactions:       Disabled
  Discards:                  Enabled
    Supported by this volume
    Initial table size:         1024
    Current table size:         1024
    Dynamic Growth:         Disabled
  Byte order:             Big Endian
  Character mode:              ASCII
  Case sensitivity:              Off

C:\phoenix\install\>show a:
Datalight Reliance v2.00 Build 0451
Copyright (c) 2003 - 2005 Datalight, Inc.
Drive "a:" is not open.

Error = -3003

C:\phoenix\install\>show b:
Datalight Reliance v2.00 Build 0451
Copyright (c) 2003 - 2005 Datalight, Inc.
Drive "b:" is not open.

Error = -3003

"time" command is working too:

Code: [Select]

C:\phoenix\install\>time
Jan 01 00:12:20 1980

The following commands are unknown:
* exit
* sx
* rx
* transfer
* flashfxdump
* flashfxdiskinfo

You've read all this?
You deserve a little photo:

Spoiler For Spoiler:

Goplat · « **Reply #34 on:** March 18, 2011, 04:28:30 pm »

Quote from: critor on March 18, 2011, 02:08:08 pm

I've tried to force 172.16.80.29 as an IP address.
TI-Nspire Computer Link 1.0 doesn't find any calculator, but is taking more time looking for them...

What if you put in the IP address that appears in the rs232 log after "dhcp-ans"?

Edit:

Quote

Byte order: Big Endian

More evidence of the CAS+ hardware being different from the TI-Nspire and TI-Nspire CAS (which are little-endian)...

bsl · « **Reply #35 on:** March 18, 2011, 04:58:08 pm »

See if any of these commands work:

dump /?
comm /?
ned /?
rsz /?

critor · « **Reply #36 on:** March 18, 2011, 06:02:57 pm »

I'm going to try all that.

I've used another terminal, and was able to get the complete hexadecimal output (including raw control/escape characters) from the "type devfiletree.zip" command.

As mentionned previously, there is no 0x00 byte in the file, meaning each time a 0x00 byte is encoutered, the rest of the read buffer is skipped/lost.

The success rate is very low: I only got 29Kb of data (the file is 624Kb).

In fact, I mainly got the system messages, and allmost no code I suppose.
So I'm attaching the file publicly, as I think there is no problem with such a bad allmost text-only file.

But if you think I'm wrong, just tell me.

Anything interesting in this file?

Would there be any command to segment files?
We might be able to get more data like that...

critor · « **Reply #37 on:** March 19, 2011, 01:09:11 pm »

Quote from: bsl on March 18, 2011, 04:58:08 pm

See if any of these commands work:

dump /?
comm /?
ned /?
rsz /?

None worked.

By the way, I'm now able to flash boot2 images in RS232 (only tested on TI-Nspire / TI-Nspire CAS for now).

I know what test you're all waiting for...

critor · « **Reply #38 on:** March 22, 2011, 12:41:01 pm »

I'm back on the TI-Nspire CAS+.

Today, I can finally answer you about flashing.

I've taken a standard TI-Nspire CAS+ with boot1/boot2 1.0.526.

Using Menu+Enter+B and Menu+Enter+G, I've tried to flash developer & production basic/CAS TI-Nspire boot2 & diags.

Diags flashing:

Code: [Select]

Boot Loader Stage 1 (1.0.526)
Build: 2006/8/11, 6:25:18
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys

Last boot progress: 1

System clock:        78 MHZ
SDRAM memory test:   Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --

Keypad request - installing DIAGS software...

Erasing old DIAGS image.

Ready to download DIAGS software...

Begin XMODEM file transfer.
Updating DIAGS image.
DIAGS image has been updated.
Restarting now.

Boot Loader Stage 1 (1.0.526)
Build: 2006/8/11, 6:25:18
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys

Last boot progress: 15474

System clock:        78 MHZ
SDRAM memory test:   Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --

Loading DIAGS software...

20%Error reading/validating DIAGS image

Loading BOOT2 software...

Boot2 flashing:

Code: [Select]

Boot Loader Stage 1 (1.0.526)
Build: 2006/8/11, 6:25:18
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys

Last boot progress: 1

System clock:        78 MHZ
SDRAM memory test:   Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --

Ready to download BOOT2 image...

Begin XMODEM file transfer.
Erasing old BOOT2 image.
Updating BOOT2 image.
BOOT2 image has been updated.
Restarting now.

Boot Loader Stage 1 (1.0.526)
Build: 2006/8/11, 6:25:18
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys

Last boot progress: 15474

System clock:        78 MHZ
SDRAM memory test:   Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --

Loading DIAGS software...

Error reading/validating DIAGS image

Loading BOOT2 software...

20%Error reading/validating BOOT2 image

Error loading BOOT2, looking for pre-installed images.
Checking for DIAGS image in pre-install area.
No DIAGS image found.
Checking for BOOT2 image in pre-install area.
No BOOT2 image found.

Error loading BOOT2, install new version.
Checking battery level.
Battery level is OK.

Ready to download BOOT2 software...

Begin XMODEM file transfer.

The RSA production keys used on the TI-Nspire CAS+ seem different from both RSA developer and production keys used on basic/CAS TI-Nspire.

Which mean we won't be able to flash a 1.1 OS before many years.

But it's still interesting to dig into the CAS+ in order to:
- dump boot1/boot2/OS
- be able to update boot2/OS
- be able to reinstall boot2/OS if they are damaged
- develop a compatible Ndless version

bsl · « **Reply #39 on:** March 22, 2011, 01:06:08 pm »

Critor,
When you get a chance - on the older calculator enter these commands:

Code: [Select]

C:\phoenix\> type components
C:\phoenix\syst\> dir
C:\phoenix\syst\locales\en\>dir 
C:\phoenix\syst\locales\>dir
C:\phoenix\syst\locales\>type copysamples

The shell has a command for creating files:
C:\documents\examples\> write test.tns 5
<Enter 5 characters then hit return>

I was able to enter control characters, but this is limiting to entering a whole binary file like loader.tns

Can you also type this command:
C:\documents\examples\>showcopyrights

critor · « **Reply #40 on:** March 22, 2011, 01:20:04 pm »

Bsl, here is what you've asked for:

Code: [Select]

C:\phoenix\>type components
ctlg
    dcol
        dlog
            geog
                math
                    ntpd
                        scpd
                            syst
                                tblt

C:\phoenix\>cd syst

C:\phoenix\syst\>dir

1980-01-01 00:00:00     <Dir> .
1980-01-01 00:00:00     <Dir> ..
1980-01-01 00:00:00       109 localenames
1980-01-01 00:00:00     <Dir> locales
1980-01-01 00:00:00     <Dir> settings
1980-01-01 00:00:00        66 docbrowser.data
1980-01-01 00:00:00      1140 imechars.res

Free Space: 17480704 bytes


C:\phoenix\syst\>cd locales

C:\phoenix\syst\locales\>dir

1980-01-01 00:00:00     <Dir> .
1980-01-01 00:00:00     <Dir> ..
1980-01-01 00:00:00     <Dir> da
1980-01-01 00:00:00     <Dir> de
1980-01-01 00:00:00     <Dir> en
1980-01-01 00:00:00     <Dir> fr
1980-01-01 00:00:00     <Dir> it
1980-01-01 00:00:00     <Dir> no

Free Space: 17480704 bytes


C:\phoenix\syst\locales\>type copysamples

Error = -1

C:\phoenix\syst\locales\>cd en

C:\phoenix\syst\locales\en\>dir

1980-01-01 00:00:00     <Dir> .
1980-01-01 00:00:00     <Dir> ..
1980-01-01 00:00:00      1090 dialogs.res
1980-01-01 00:00:00     56008 icons.res
1980-01-01 00:00:00     <Dir> settings
1980-01-01 00:00:00      6154 strings.res
1980-01-01 00:00:00      1284 imechars.res
1980-01-01 00:00:00     <Dir> sampledocuments

Free Space: 17480704 bytes


C:\phoenix\syst\locales\en\>showcopyrights
Command not found!

C:\phoenix\syst\locales\en\>

bsl · « **Reply #41 on:** March 22, 2011, 01:40:39 pm »

strings.res is about half the size of the other prototypes, even 1.7320.
Try: c:\>type strings.res
The reason for "showcopyrights" was a possible second shell exists that might have this command.

critor · « **Reply #42 on:** March 22, 2011, 02:02:53 pm »

Here what the "type" command is showing me for "string.res":

Code: [Select]

C:\phoenix\syst\locales\en\>type strings.res

tionains a file named 'åðŸåðŸåðŸå�˜™™™™™(¡P¡'. Do you want to replace it?ion is managing data collection; if you wish to collect data within TI-Nspire please close TI-Nspire and the other data collection application then restart TI-Nspire.etry OS upgrade.

(remember the type command is buggy, unfortunately...)

critor · « **Reply #43 on:** March 22, 2011, 02:35:33 pm »

I'm back on the production TI-Nspire CAS+with boot1/boot2 1.0.526.

All those who have tried the maintenance menu on their TI-Nspire CAS+ (Menu+Enter+P) ended up with the OS being deleted, without seeing any menu.

Finally, here is a full log of what Menu+Enter+P is triggering:

Code: [Select]

Boot Loader Stage 1 (1.0.526)
Build: 2006/8/11, 6:25:18
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys

Last boot progress: 10546

System clock:        78 MHZ
SDRAM memory test:  Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --

Loading DIAGS software...

Error reading/validating DIAGS image

Loading BOOT2 software...

99%
BOOT1: loading complete (924 ticks), launching image.



Boot Loader Stage 2 (1.0.526)
Build: 2006/8/11, 6:29:51
Copyright (c) 2006 Texas Instruments Incorporated
Using production keys



Initializing graphics subsystem.
Checking for NAND: NAND Flash ID: ST Micro NAND256W3A
Initializing USB and networking.


Initializing filesystem.
Datalight Reliance v2.00.0451
Copyright (c) 2003 - 2005 Datalight, Inc.
Registered to #9DE08703
FlashFX sample project for the OMAP5912 OSK running Nucleus
Datalight FlashFX Pro v2.0 Build 966
Nucleus Edition for ARM9
Copyright (c) 1993-2005 Datalight, Inc.
Patents: US#5860082, US#6260156.
Detected FfxDelay() parameters: Count=58776 MicroSec=8192 Shift=13
FFX: NAND chip manufacturer: ST Micro (20) chip NAND256W3A (75)
Filesystem ready.

-- Bad Block list --
0x00058000 (22)
0x001F0000 (124)
-- Bad Block list end --
Keypad request, deleting current OS to force upgrade.
Checking battery level.
Batteries are low - install fresh batteries.
Battery level is OK.

Loading Operating System...

Error loading OS image. Removing OS remnants.
Deleting file [/phoenix/install/manifest_img]
Deleting file [/phoenix/components]
Deleting file [/phoenix/policy.dat]
Deleting file [/phoenix/manuf.dat]
Removing directory [/phoenix/install/]
Deleting file [/phoenix/ctlg/locales/da/strings.res]
Removing directory [/phoenix/ctlg/locales/da/]
Deleting file [/phoenix/ctlg/locales/de/strings.res]
Removing directory [/phoenix/ctlg/locales/de/]
Deleting file [/phoenix/ctlg/locales/en/2dtemplates.res]
Deleting file [/phoenix/ctlg/locales/en/all.res]
Deleting file [/phoenix/ctlg/locales/en/math.res]
Deleting file [/phoenix/ctlg/locales/en/strings.res]
Deleting file [/phoenix/ctlg/locales/en/units.res]
Removing directory [/phoenix/ctlg/locales/en/]
Deleting file [/phoenix/ctlg/locales/fr/strings.res]
Removing directory [/phoenix/ctlg/locales/fr/]
Deleting file [/phoenix/ctlg/locales/it/strings.res]
Removing directory [/phoenix/ctlg/locales/it/]
Deleting file [/phoenix/ctlg/locales/no/strings.res]
Removing directory [/phoenix/ctlg/locales/no/]
Removing directory [/phoenix/ctlg/locales/]
Removing directory [/phoenix/ctlg/]
Deleting file [/phoenix/dcol/locales/da/strings.res]
Removing directory [/phoenix/dcol/locales/da/]
Deleting file [/phoenix/dcol/locales/de/strings.res]
Removing directory [/phoenix/dcol/locales/de/]
Deleting file [/phoenix/dcol/locales/en/icons.res]
Deleting file [/phoenix/dcol/locales/en/strings.res]
Removing directory [/phoenix/dcol/locales/en/]
Deleting file [/phoenix/dcol/locales/fr/strings.res]
Removing directory [/phoenix/dcol/locales/fr/]
Deleting file [/phoenix/dcol/locales/it/strings.res]
Removing directory [/phoenix/dcol/locales/it/]
Deleting file [/phoenix/dcol/locales/no/strings.res]
Removing directory [/phoenix/dcol/locales/no/]
Removing directory [/phoenix/dcol/locales/]
Removing directory [/phoenix/dcol/]
Deleting file [/phoenix/dlog/locales/da/strings.res]
Removing directory [/phoenix/dlog/locales/da/]
Deleting file [/phoenix/dlog/locales/de/strings.res]
Removing directory [/phoenix/dlog/locales/de/]
Deleting file [/phoenix/dlog/locales/en/strings.res]
Removing directory [/phoenix/dlog/locales/en/]
Deleting file [/phoenix/dlog/locales/fr/strings.res]
Removing directory [/phoenix/dlog/locales/fr/]
Deleting file [/phoenix/dlog/locales/it/strings.res]
Removing directory [/phoenix/dlog/locales/it/]
Deleting file [/phoenix/dlog/locales/no/strings.res]
Removing directory [/phoenix/dlog/locales/no/]
Removing directory [/phoenix/dlog/locales/]
Removing directory [/phoenix/dlog/]
Deleting file [/phoenix/geog/locales/da/strings.res]
Removing directory [/phoenix/geog/locales/da/]
Deleting file [/phoenix/geog/locales/de/strings.res]
Removing directory [/phoenix/geog/locales/de/]
Deleting file [/phoenix/geog/locales/en/icons.res]
Deleting file [/phoenix/geog/locales/en/strings.res]
Removing directory [/phoenix/geog/locales/en/]
Deleting file [/phoenix/geog/locales/fr/strings.res]
Removing directory [/phoenix/geog/locales/fr/]
Deleting file [/phoenix/geog/locales/it/strings.res]
Removing directory [/phoenix/geog/locales/it/]
Deleting file [/phoenix/geog/locales/no/strings.res]
Removing directory [/phoenix/geog/locales/no/]
Removing directory [/phoenix/geog/locales/]
Removing directory [/phoenix/geog/]
Deleting file [/phoenix/math/locales/da/strings.res]
Removing directory [/phoenix/math/locales/da/]
Deleting file [/phoenix/math/locales/de/strings.res]
Removing directory [/phoenix/math/locales/de/]
Deleting file [/phoenix/math/locales/en/strings.res]
Removing directory [/phoenix/math/locales/en/]
Deleting file [/phoenix/math/locales/fr/strings.res]
Removing directory [/phoenix/math/locales/fr/]
Deleting file [/phoenix/math/locales/it/strings.res]
Removing directory [/phoenix/math/locales/it/]
Deleting file [/phoenix/math/locales/no/strings.res]
Removing directory [/phoenix/math/locales/no/]
Removing directory [/phoenix/math/locales/]
Removing directory [/phoenix/math/]
Deleting file [/phoenix/ntpd/locales/da/strings.res]
Removing directory [/phoenix/ntpd/locales/da/]
Deleting file [/phoenix/ntpd/locales/de/strings.res]
Removing directory [/phoenix/ntpd/locales/de/]
Deleting file [/phoenix/ntpd/locales/en/icons.res]
Deleting file [/phoenix/ntpd/locales/en/strings.res]
Removing directory [/phoenix/ntpd/locales/en/]
Deleting file [/phoenix/ntpd/locales/fr/strings.res]
Removing directory [/phoenix/ntpd/locales/fr/]
Deleting file [/phoenix/ntpd/locales/it/strings.res]
Removing directory [/phoenix/ntpd/locales/it/]
Deleting file [/phoenix/ntpd/locales/no/strings.res]
Removing directory [/phoenix/ntpd/locales/no/]
Removing directory [/phoenix/ntpd/locales/]
Removing directory [/phoenix/ntpd/]
Deleting file [/phoenix/scpd/locales/da/strings.res]
Removing directory [/phoenix/scpd/locales/da/]
Deleting file [/phoenix/scpd/locales/de/strings.res]
Removing directory [/phoenix/scpd/locales/de/]
Deleting file [/phoenix/scpd/locales/en/icons.res]
Deleting file [/phoenix/scpd/locales/en/strings.res]
Removing directory [/phoenix/scpd/locales/en/]
Deleting file [/phoenix/scpd/locales/fr/strings.res]
Removing directory [/phoenix/scpd/locales/fr/]
Deleting file [/phoenix/scpd/locales/it/strings.res]
Removing directory [/phoenix/scpd/locales/it/]
Deleting file [/phoenix/scpd/locales/no/strings.res]
Removing directory [/phoenix/scpd/locales/no/]
Removing directory [/phoenix/scpd/locales/]
Removing directory [/phoenix/scpd/]
Deleting file [/phoenix/syst/localenames]
Deleting file [/phoenix/syst/docbrowser.data]
Deleting file [/phoenix/syst/locales/da/dialogs.res]
Deleting file [/phoenix/syst/locales/da/imechars.res]
Deleting file [/phoenix/syst/locales/da/strings.res]
Deleting file [/phoenix/syst/locales/da/sampledocuments/KomGodtIGang.tns]
Removing directory [/phoenix/syst/locales/da/sampledocuments/]
Deleting file [/phoenix/syst/locales/da/settings/factory.zip]
Removing directory [/phoenix/syst/locales/da/settings/]
Removing directory [/phoenix/syst/locales/da/]
Deleting file [/phoenix/syst/locales/de/dialogs.res]
Deleting file [/phoenix/syst/locales/de/imechars.res]
Deleting file [/phoenix/syst/locales/de/strings.res]
Deleting file [/phoenix/syst/locales/de/sampledocuments/ErsteSchritte.tns]
Removing directory [/phoenix/syst/locales/de/sampledocuments/]
Deleting file [/phoenix/syst/locales/de/settings/factory.zip]
Removing directory [/phoenix/syst/locales/de/settings/]
Removing directory [/phoenix/syst/locales/de/]
Deleting file [/phoenix/syst/locales/en/dialogs.res]
Deleting file [/phoenix/syst/locales/en/icons.res]
Deleting file [/phoenix/syst/locales/en/imechars.res]
Deleting file [/phoenix/syst/locales/en/strings.res]
Deleting file [/phoenix/syst/locales/en/sampledocuments/GettingStarted.tns]
Removing directory [/phoenix/syst/locales/en/sampledocuments/]
Deleting file [/phoenix/syst/locales/en/settings/factory.zip]
Removing directory [/phoenix/syst/locales/en/settings/]
Removing directory [/phoenix/syst/locales/en/]
Deleting file [/phoenix/syst/locales/fr/dialogs.res]
Deleting file [/phoenix/syst/locales/fr/imechars.res]
Deleting file [/phoenix/syst/locales/fr/strings.res]
Deleting file [/phoenix/syst/locales/fr/sampledocuments/PriseEnMainRapide.tns]
Removing directory [/phoenix/syst/locales/fr/sampledocuments/]
Deleting file [/phoenix/syst/locales/fr/settings/factory.zip]
Removing directory [/phoenix/syst/locales/fr/settings/]
Removing directory [/phoenix/syst/locales/fr/]
Deleting file [/phoenix/syst/locales/it/dialogs.res]
Deleting file [/phoenix/syst/locales/it/imechars.res]
Deleting file [/phoenix/syst/locales/it/strings.res]
Deleting file [/phoenix/syst/locales/it/sampledocuments/GuidaIntroduttiva.tns]
Removing directory [/phoenix/syst/locales/it/sampledocuments/]
Deleting file [/phoenix/syst/locales/it/settings/factory.zip]
Removing directory [/phoenix/syst/locales/it/settings/]
Removing directory [/phoenix/syst/locales/it/]
Deleting file [/phoenix/syst/locales/no/dialogs.res]
Deleting file [/phoenix/syst/locales/no/imechars.res]
Deleting file [/phoenix/syst/locales/no/strings.res]
Deleting file [/phoenix/syst/locales/no/sampledocuments/KommeIGang.tns]
Removing directory [/phoenix/syst/locales/no/sampledocuments/]
Deleting file [/phoenix/syst/locales/no/settings/factory.zip]
Removing directory [/phoenix/syst/locales/no/settings/]
Removing directory [/phoenix/syst/locales/no/]
Removing directory [/phoenix/syst/locales/]
Deleting file [/phoenix/syst/settings/current.zip]
Deleting file [/phoenix/syst/settings/initialized]
Removing directory [/phoenix/syst/settings/]
Removing directory [/phoenix/syst/]
Deleting file [/phoenix/tblt/locales/da/dialogs.res]
Deleting file [/phoenix/tblt/locales/da/strings.res]
Removing directory [/phoenix/tblt/locales/da/]
Deleting file [/phoenix/tblt/locales/de/dialogs.res]
Deleting file [/phoenix/tblt/locales/de/icons.res]
Deleting file [/phoenix/tblt/locales/de/strings.res]
Removing directory [/phoenix/tblt/locales/de/]
Deleting file [/phoenix/tblt/locales/en/dialogs.res]
Deleting file [/phoenix/tblt/locales/en/icons.res]
Deleting file [/phoenix/tblt/locales/en/strings.res]
Removing directory [/phoenix/tblt/locales/en/]
Deleting file [/phoenix/tblt/locales/fr/dialogs.res]
Deleting file [/phoenix/tblt/locales/fr/strings.res]
Removing directory [/phoenix/tblt/locales/fr/]
Deleting file [/phoenix/tblt/locales/it/dialogs.res]
Deleting file [/phoenix/tblt/locales/it/strings.res]
Removing directory [/phoenix/tblt/locales/it/]
Deleting file [/phoenix/tblt/locales/no/dialogs.res]
Deleting file [/phoenix/tblt/locales/no/strings.res]
Removing directory [/phoenix/tblt/locales/no/]
Removing directory [/phoenix/tblt/locales/]
Removing directory [/phoenix/tblt/]

Waiting for OS download.
Starting Connectivity services.
USB Download is enabled.
Press <Enter> to download through the serial port.
phoenix dhcp server w/ VOODOO  built 12-Jul-2006 (start at 7140)


phoenix enum server  built 12-Jul-2006


phoenix dhcp hook fwd w/ VOODOO  built 12-Jul-2006 (start at 7140)


phoenix file mgt server  built 12-Jul-2006 (start at 7240)

pn-srv2-636: pol_init = -1

Note the "Keypad request, deleting current OS to force upgrade".

Strangely, accessing the maintenance menu on basic/CAS TI-Nspire does log "Boot option: Download Basecode", although it doesn't download any basecode to my knowledge. According to the above log, this message could come from the original Menu+Enter+P use on the CAS+.

By the way, we have a partial view of the production CAS+ filesystem in the above log.

bsl · « **Reply #44 on:** March 22, 2011, 03:49:00 pm »

Looks like manifest_img is the OS.
Now you can start sending boot2 exploits through RS232.
Even though the files are deleted , they may not really be deleted , only unlinked in the inode of the filesystem[Hopefully].

Author Topic: The 1st step into CAS+ flashing (Read 29147 times)

bsl

Re: The 1st step into CAS+ flashing

Compynerd255

Re: The 1st step into CAS+ flashing

willrandship

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

Goplat

Re: The 1st step into CAS+ flashing

bsl

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

bsl

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

bsl

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

bsl

Re: The 1st step into CAS+ flashing