Author Topic: TI-Nspire CAS prototype 1.1.6925 (Read 10653 times)

critor · « **on:** March 31, 2011, 05:37:46 am »

Hi!

Just got another unknown TI-Nspire CAS prototype.
It's got the "TI-XXXXXXXXXXX" label, which had never been reported on the Internet up to now.

Could you help me saving the included OS/Boot1/Boot2?

It's running the oldest 1.1 Nspire OS we've ever heard off: 1.1.6925 CAS built on 2007-02-07.
Boot1 & Boot2 versions are 1.1.6818.
There is no included diagnostic software.

And of course, like the 1.1.7320 basic OS, no "full" USB support.
So I cannot use TI-Nspire Computer Link to access the filesystem, and I cannot exchange data with another TI-Nspire, and the "Send OS" menu is disabled anyway.

With the 1.1.73xx prototype, the main difference was that I had severall of them.
So I could:
- remove the OS on one of them to use the boot2 exploit at the "install OS" screen and dump boot1/boot2/diags
- flash a more recent boot2 on another one, as the older 1.1.73xx boot2 didn't want to run the more recent developer OSes I had as a test image

This time, I've only got 1 prototype of that kind, and that's the main poblem.
So if I remove the OS or update the boot2, it will be lost and probably forever.

I'm going to try:

- to get the full boot log through my RS232 adapter

- to run the more recent 1.1.8408/1.2.2344 developer CAS OSes as a test image through my RS232 adapter, but according to my previous experience with the 1.1.73xx pototype, I'm very doubtfull it will work...

Here's the 1st photo in the world for you:

Goplat, Bsl, everybody... if you have any idea which could help me fully dump the OS/Boot1/Boot2, please share it.

FinaleTI · « **Reply #1 on:** March 31, 2011, 06:03:20 am »

Quote from: critor on March 31, 2011, 05:37:46 am

Hi!

Just got another unknown TI-Nspire CAS prototype.
It's got the "TI-XXXXXXXXXXX" label, which had never been reported on the Internet up to now.

Could you help me saving the included OS/Boot1/Boot2?

It's running the oldest 1.1 Nspire OS we've ever heard off: 1.1.6925 CAS built on 2007-02-07.
Boot1 & Boot2 versions are 1.1.6818.
There is no included diagnostic software.

And of course, like the 1.1.7320 basic OS, no "full" USB support.
So I cannot use TI-Nspire Computer Link to access the filesystem, and I cannot exchange data with another TI-Nspire, and the "Send OS" menu is disabled anyway.

With the 1.1.73xx prototype, the main difference was that I had severall of them.
So I could:
- remove the OS on one of them to use the boot2 exploit at the "install OS" screen and dump boot1/boot2/diags
- flash a more recent boot2 on another one, as the older 1.1.73xx boot2 didn't want to run the more recent developer OSes I had as a test image

This time, I've only got 1 prototype of that kind, and that's the main poblem.
So if I remove the OS or update the boot2, it will be lost and probably forever.

I'm going to try:

- to get the full boot log through my RS232 adapter

- to run the more recent 1.1.8408/1.2.2344 developer CAS OSes as a test image through my RS232 adapter, but according to my previous experience with the 1.1.73xx pototype, I'm very doubtfull it will work...

Here's the 1st photo in the world for you:

Actually, I have seen a TI-XXXXXXXXXXX online before.
Right here.

critor · « **Reply #2 on:** March 31, 2011, 06:30:31 am »

Quote from: FinaleTI on March 31, 2011, 06:03:20 am

Actually, I have seen a TI-XXXXXXXXXXX online before.
Right here.

Of course I know. The 1.1.73xx we've dumped in my other topic was a TI-XXXXXXXXXXX.
But it was a basic Nspire prototype.

This one is a CAS Nspire prototype, which was clearly stated in my 1st sentence.
Sorry if my 2nd sentence seemed ambiguous to you.

So I'm correcting: "it's a CAS TI-XXXXXXXXXXX, which had never been reported on the Internet up to now".

That's interesting because previous prototypes were labelled "TI-Nspire CAS+".
So we thought the "TI-XXXXXXXXXXX" as reported on datamath.org was because they had not yet chosen a name for the basic version of the Nspire.
But finally, seems not as there have been CAS TI-XXXXXXXXXXX.

Why did they remove the "Nspire" name and then add it again?...

Anyway, here's the boot log:

Code: [Select]

Boot Loader Stage 1 (1.1.6818)
Build: 2007/2/4, 23:19:48
Copyright (c) 2006, 2007 Texas Instruments Incorporated
Using developer keys

Last boot progress: 17368
Clocks:  CPU = 90MHz   AHB = 45MHz   APB = 22MHz

Available system memory: 37292
PM is turning the device OFF
PM has turned the device ON
SDRAM memory test:   Pass
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Clearing SDRAM...Done.
Checking for NAND: NAND Flash ID: ST Micro NAND256R3A
Boot option: Normal

Loading DIAGS software...

Error reading/validating DIAGS image

Error loading DIAGS. Switching to BOOT2.

Loading BOOT2 software...

99%
BOOT1: loading complete (560 ticks), launching image.



Boot Loader Stage 2 (1.1.6818)
Build: 2007/2/4, 23:24:42
Copyright (c) 2006, 2007 Texas Instruments Incorporated
Using developer keys

Clocks:  CPU = 90MHz   AHB = 45MHz   APB = 22MHz


Initializing graphics subsystem.
Checking for NAND: NAND Flash ID: ST Micro NAND256R3A
Boot option: Normal
Initializing USB and networking.


Initializing filesystem.
Datalight Reliance v2.10.1150
Copyright (c) 2003-2006 Datalight, Inc.
Datalight FlashFX Pro v3.00 Build 1358
Nucleus Edition for ARM9
Copyright (c) 1993-2006 Datalight, Inc.
Patents: US#5860082, US#6260156.
Filesystem ready.

Loading Operating System...

100%
žaòžaOž
          xO†ò†y ˜þ

Beginning system initialization.
Preparing file system. This takes a while...
   POSIX layer initialized.
   POSIX devices initialized.
Datalight Reliance v2.10.1150
Copyright (c) 2003-2006 Datalight, Inc.
Datalight FlashFX Pro v3.00 Build 1358
Nucleus Edition for ARM9
Copyright (c) 1993-2006 Datalight, Inc.
Patents: US#5860082, US#6260156.

   POSIX file system initialized.
File system ready.
System build date: Feb  7 2007, 23:36:02
Available memory: 23186488 bytes
Purging temporary files...
Launching system...

I've just had an idea...
Goplat, do you think the boot2 1.1 exploit1 can work by trying to load it as a test image through RS232?...
Any idea of the address I should target in that case?

Goplat · « **Reply #3 on:** March 31, 2011, 05:33:52 pm »

Quote from: critor on March 31, 2011, 06:30:31 am

BOOT1: loading complete (560 ticks), launching image.

I wonder why it takes so long? (Recall that the 1.1.73xx prototype took only 339 ticks to load BOOT2.) Maybe TI accidentally put in a production version of DIAGS, so it takes time to read but ends up getting skipped.

Either that or they optimized some code between this version and 1.1.7314.

Quote

Initializing USB and networking.

Interesting, this message isn't in later versions of boot2 (they initialize USB later on, and only if the OS fails to load).

Quote

Goplat, do you think the boot2 1.1 exploit1 can work by trying to load it as a test image through RS232?...
Any idea of the address I should target in that case?

Let's take that discussion to email.

DJ Omnimaga · « **Reply #4 on:** March 31, 2011, 05:35:47 pm »

Interesting, I wonder how many kind of prototypes there is in total...

critor · « **Reply #5 on:** March 31, 2011, 05:46:48 pm »

Quote from: DJ_O on March 31, 2011, 05:35:47 pm

Interesting, I wonder how many kind of prototypes there is in total...

I'm wondering why I couldn't find up to now any prototype with a software build date or a hardware manufacturing date between october 2006 and february 2007.
4 months...

Freyaday · « **Reply #6 on:** March 31, 2011, 08:43:40 pm »

What's with the random chars in the middle?

critor · « **Reply #7 on:** March 31, 2011, 08:45:30 pm »

Quote from: Freyaday on March 31, 2011, 08:43:40 pm

What's with the random chars in the middle?

It happens when the OS does start.
You can check other 1.1 bootlogs: they are present too, but are completly different.

Freyaday · « **Reply #8 on:** March 31, 2011, 08:56:56 pm »

I wonder if they mean anything....

Goplat · « **Reply #9 on:** March 31, 2011, 10:25:40 pm »

Quote from: Freyaday on March 31, 2011, 08:56:56 pm

I wonder if they mean anything....

My guess is it's just a side effect of the bus speed getting changed (Boot2 uses 45MHz AHB and 22.5MHz APB, but reduces it to 15MHz AHB and 7.5MHz APB just before starting the OS). It never happens in nspire_emu, only on real hardware.

bsl · « **Reply #10 on:** April 01, 2011, 10:07:52 am »

Does the examples document mention "CAS+" also ?

Also when you get to the point of dumping- dump the diags too, even though
it appears not there.

critor · « **Reply #11 on:** April 01, 2011, 01:28:43 pm »

The example not only mentions CAS+, but seems to refer to the CAS+ menu.

I've got a dump file of the OS for now.
I've launched the 1.1.8408 OS as a test image, and used it to get the installed /phoenix/install/ti-nspire.tnc file through USB.

But I'm not sure it's good.

The header seems strange, as it is including null version strings:

Code: [Select]

TI-Nspire.tnc 0.0.0  2619082 0
__RES__ 0.0.0 0   759637
PK

½G6¾µ\·ìò'ìò'
wTI-Nspire.imgSDb¤Zsåcd`ia``PbpbF&‹�UH(ÙŒ¬ .«(�p—{ªÌZ˜PlÙôvHC
XZ‚á?£<†^ˆ8#X«^µ+„PÌPÚUT
É·ÊEÉ·ÊEÉ·ÊE€'òa€JTI-Nspire €0C€0E€â€.0.0.0€.0.0.0

Moreover, it doesn't work with Goplat's emulator:

Code: [Select]

Loading Operating System...

100%

BOOT2: loading complete (428 ticks), launching image.
Error at PC=101675BC: Bad or unimplemented control register value: 5127f

        Backtrace:
Frame     PrvFrame Self     Return   Start
11A04148: 11A04158 11A0414C 118026E8 11801DAC
11A04158: 11A04320 11A0415C 11801180 118026D8
11A04320: 11A04350 11A04324 1184F728 11800D7C
11A04350: 11A04370 11A04354 1181E288 1184F6E0
11A04370: 11A04374 11A04374 00000000 1181E270
debug>

Any idea?

Goplat · « **Reply #12 on:** April 01, 2011, 01:45:09 pm »

Quote from: critor on April 01, 2011, 01:28:43 pm

BOOT2: loading complete (428 ticks), launching image.
Error at PC=101675BC: Bad or unimplemented control register value: 5127f

If the OS validates fully and then doesn't work, it's probably my fault.

Does it work any differently in nspire_emu 0.51, which implemented support for the 0x100 and 0x200 bits in the control register?

critor · « **Reply #13 on:** April 01, 2011, 01:48:57 pm »

Quote from: Goplat on April 01, 2011, 01:45:09 pm

Quote from: critor on April 01, 2011, 01:28:43 pm
BOOT2: loading complete (428 ticks), launching image.
Error at PC=101675BC: Bad or unimplemented control register value: 5127f
If the OS validates fully and then doesn't work, it's probably my fault.

Does it work any differently in nspire_emu 0.51, which implemented support for the 0x100 and 0x200 bits in the control register?

Seems it's time for mu to update your emulator

I'm checking...

Edit: it's booting perfectly with the 0.51.
It was my fault for using an older version. Your emulator is great

critor · « **Reply #14 on:** April 01, 2011, 01:58:06 pm »

In fact, I've posted too fast (no your emulator is great, this hasn't changed - I'm not forgetting it did emulate perfectly all other 1.1.7320 and above prototype OSes without changing anything!).

I get the home screen (which I didn't get with my previous emulator version), but I've got problems later.

For exemple, I get a warning when typing enter to exit the about window:

Code: [Select]

usb reset
Warning at PC=100BC918: Bad read_word: fffbc410
debug>

(tried 2 times)

What do you think about it Goplat?
Emulation which is not yet exactly 100% accurate?
Or a difference on the hardware?

Unfortunately, I cannot test the file on true hardware.
The "0.0.0" in the header is blocked by the downgrade protection.

Author Topic: TI-Nspire CAS prototype 1.1.6925 (Read 10653 times)

critor

TI-Nspire CAS prototype 1.1.6925

FinaleTI

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925

Goplat

Re: TI-Nspire CAS prototype 1.1.6925

DJ Omnimaga

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925

Freyaday

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925

Freyaday

Re: TI-Nspire CAS prototype 1.1.6925

Goplat

Re: TI-Nspire CAS prototype 1.1.6925

bsl

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925

Goplat

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925

critor

Re: TI-Nspire CAS prototype 1.1.6925