The TI-82Stats.fr and TI-76.fr are 2 cheap graphic calculators available in France.


They include a 256Kb TI-83 compatible OS translated in french.
(TI-Connect detects them as TI-83 calculators - TI-83 assembly programs are working on them - and the dumped ROMs can be used with any TI-83 emulator)

But those calculators become quite interesting when you look at the PCB:
TI-76.fr: http://www.datamath.org/Graphing/Images/TI-76FR_PCB.jpg
TI-82Stats.fr: http://www.datamath.org/Graphing/Images/TI-82STATS_FR_P0509G_PCB.jpg

1st big surprise, unlike TI-83 calculators they don't have a 256Kb EPROM, but a 512Kb FlashROM.
The FlashROM is either a Spansion S29AL004D70 either a MX29LV400, which are both pin compatible and used in recent TI-73 and TI-83+ calculators.

2nd big surprise, the CPU/ASIC is a TI-REF TI-738X, which is also used in recent TI-73 and TI-83+ calculators.

So, the TI-76.fr and TI-82Stats.fr PCB are very similar to recent TI-73 or TI-83+ PCB:
TI-73: http://www.datamath.org/Graphing/Images/TI-73_P0803G_PCB.jpg
TI-83+: http://www.datamath.org/Graphing/Images/TI-83PlusFR_PCB.jpg


So, my goal is to develop a simple way to flash a TI-83+ or TI-73 OS in those calculators.
I'm posting my discoveries, hoping that you will be able to help me.


I've checked the connections between the FlashROM and the ASIC chips on the TI-76.fr and TI-82Stats.fr. Here is what I have up to now:

Legend:
In black, pins not connected to the PCB circuit.
In white,grounded pins.
Connected pins are in the same color.




As FloppusMaximus had noticed, the flash-write pin WE# is connected to the ASIC.
So from the hardware side, the ROM can be flashed.

The highest flash address pin, A17, is grounded. So you cannot accesss the full 512Kb bytes, but only the 1st 256Kb bytes.

Checking in a recent TI-83+, I could find the matching A17 pin on the ASIC.
You just have to:
- disconnect A17 flash pin from ground
- connect A17 flash pin to A17 ASIC pin



Now, from the hardware-side, the full 512Kb bytes can be accessed.


Unfortunately, I haven't managed to trigger any boot code menu using the ON+DEL key.

To my knowledge, the 256Kb dump file is a standard TI-83 OS. That means:
- no boot code
- no functions to write the flash
- impossible to access more than 256Kb ROM

So, I cannot even dump the hidden 256kb to check for a boot code...


So I'm asking for the help of the best TI-83/83+ programmers/hackers out there.

How could we manage to flash a TI-83+ boot code and then a TI-83+ OS ?


I also have some questions:

- How is it possible for the same ASIC to be able to run both TI-83 and TI-83+ OSes ?
I thought that many ports were behaving differently on those calculators...
How are the ports behaviors set up ?

- How is it possible for the same ASIC to be able to boot with or without a boot code?
TI-83+ calculators have a boot code in the last 16Kb sector of the ROM...
To my knowledge, there is no such boot code in the 256Kb TI-82Stats.fr / TI-76.fr dump files, and even if such a boot code was written higher in ROM, it could not be accessed before moding the calculator as explained above.


If we manage to come out with a not to complicated mod, many french students will be very happy.

Please, help me.

If it can run TI-83 or TI-83+ assembly programs, I could probably write a program to flash it.

Spoiler For Spoiler:

Can you email me a ROM so I can find out more about it?

I can run all TI-83 assembly programs on the TI-82Stats.fr and TI-76.fr.
Even shells/kernels.

I don't know how the calculator would react to TI-83+ assembly code...

And I don't understand how the same ASIC can execute both TI-83 and TI-83+ assembly codes, as there are some differences...


Or can the TI-738X ASIC be configured in some way during production to work either as a TI-83 either as a TI-83+? Internally or externally through some kind of jumper/flag for example?...

On a side note, SirCmpwn, if you plan  to write a 83 program nostub, it's Send(9prgmNAME) instead of Asm(prgmNAME), in case you aren't very familiar with that model. Yay for TI undocumented instructions.

This can't work. The ASIC is the CPU's interface to the rest of the hardware, and that one is distinctly 83-ish. There is no way for you to unlock the Flash chip (although I suppose the WE# pin lets you get around that) because there is no port 14h.

Because communication with the Flash chip is done through memory-mapped I/O commands, you MIGHT (and I stress MIGHT) get away with modifying the data in the Flash chip, which means you could modify the 83-ish OS.

But you can never run the 83+ OS, because it relies on an 83+ ASIC and port hardware. With some EXTREME patching to the OS, such a thing might be possible, but it would NEVER run 83+ programs.

Non-Flash calculators don't contain any sort of boot code, they never have to worry about the state of the Flash chip so they simply boot from 0000h.

It's *possible* TI left in some way for you to modify the data in the Flash chip, but there would be no way at all for you to recover from a bad write/erase because there is no boot code to fall back to.

I have both a TI-76.fr and TI-82 Stats.fr, but I'm not sure I want to risk soldering to that pin or erasing sectors of that Flash chip.

If you want to try this, you might want to disassemble the 83+ boot code BCALL _WriteAByte and see how it sends commands to the Flash chip to program a byte, and write an 83 program that does the same and see if it works.

Actually, there is a port 14 on the TI-83 - it's the battery status port.

I'd love to know what the deal is with ports 0036, 003F, 00DF, and 00F2 (yes, the usage suggests that these are 16-bit I/O addresses), which were added to the early initialization code of later versions of the TI-83 and TI-82 STATS, as well as the TI-82 v19.006.

Also, I would suggest that, before you start trying to write to the Flash chip, you try something less potentially destructive, like reading the auto-select data.

@critor: I'd love to see something come of this. That would be really interesting if you could find a loophole to make this work.

I don't know, but I guess a logical next step would be to compare that picture with the PCB from a newer 83+ or 73.

Ouch, yeah, that is problematic.  The TI-73 Explorer with an 84+-style case (as seen here) doesn't look so bad, though.