Hi,

Several fun events have occurred over the past few months in the Nspire family and its predecessor, the Nspire CAS+.
These events bear some potential and promise, and they are definitely worth explaining to a wider audience


1) news from the CAS+ series.

The Nspire CAS+ prototype series was made in a year before the regular Nspire series, in 2006. It's completely incompatible with regular Nspires. CAS+ handhelds were never supposed to be sold (after this series was scrapped, that is); however, dozens, probably hundreds, of items slipped from classrooms or teachers into the wild.
Their terrible "Nspire CAS+" name has made them a pleague on the aftermarket since then, because they are easily mistaken by unsuspecting buyers as more capable than the "Nspire CAS" calculators - while they are just old, non-upgradeable prototypes, with the lowest OS capabilities found on the Nspire series - that's not much !
And it's trivial to brick them, by triggering the "OS upgrade" procedure, which erases the OS. Scammed customers are even more unhappy after that...

On the one side, TI has not (yet ?) fixed the persistent problem of the CAS+ series on the marketplace; on the other side, several well-known members of the open development community have recently spent quite a bit of time on helping scammed customers, and managed to dump multiple OS versions suitable for the CAS+ series, and reconstruct OS images which make it possible to unbrick calculators (confirmed by fixing real CAS+ bricks)
As usual, the fact is that the open development community cares more about fellow users than TI does; but it's not too late for TI to do their part of the job...

It's a matter of time and motivation before native code runs on the CAS+ (making it possible to dump the boot1 and boot2), and possibly an emulator is made for it.
A noteworthy bit: we believe that it's possible to write to the boot1, i.e. to subvert the root trust of the calculator. In layman tems, it means that the CAS+ ought to be able to host permanent installs of arbitrary OS.

More information on the CAS+ breakthrough:
http://tiplanet.org/forum/viewtopic.php?f=43&t=9195
http://tiplanet.org/forum/viewtopic.php?f=43&t=9217
http://tiplanet.org/forum/viewtopic.php?f=43&t=9227

http://ourl.ca/15976
http://ourl.ca/16005
http://ourl.ca/16080


2) news from the Clickpad prototypes

Like the CAS+ prototypes, '2007 Clickpad prototypes slipped into the wild. Unlike the CAS+ prototypes, the Clickpad prototypes are fully compatible with production models. There are two known differences between prototypes and production models:
    * one track on the PCB (more on that later);
    * the RSA signing/validation keys are different, so prototypes won't accept production boot2 and OS.
Though easy to dump (they reply politely when the linking software asks them to send "../phoenix/install/TI-Nspire.tnc" - a schoolbook directory traversal vulnerability ), Clickpad prototypes are as hard to upgrade as CAS+ prototypes, because TI doesn't provide OS builds suitable for them (it's just a matter of signing them with a different key !).
Clickpad prototypes are locked onto special OS builds; only the severely outdated 1.1.x and 1.2.x prototype versions are known to us, so again, there's potential for scamming customers.

Well, actually, they _used to be_ locked onto old OS versions: the boot1 of Clickpad prototypes is writable as well. It is therefore possible to permanently install production boot2 and OS, and thereby upgrade them to production status
critor made a detailed tutorial on this topic:
http://tiplanet.org/forum/archives_voir.php?id=4237
http://tiplanet.org/forum/viewtopic.php?f=43&t=8954

http://ourl.ca/15672

But upgrading prototype Clickpads to production status is just a special case of permanently installing arbitrary boot1, boot2 and OS on the calculator. Yes, even the CAS OS on the CAS-capable model sold as non-CAS, and/or an OS which doesn't obey PTT restrictions, as special, and inevitable, cases of the users' inalienable rights of running whatever software they see fit on the computing platforms they own.

Clickpad prototypes can trivially be smuggled into exams: not only untrained exam personnel is unlikely to notice the difference (even though most prototypes models have a "TI-XXXXXXXXXX" mark on the front, and "PROTOTYPE NOT FOR SALE" + non-standard serial numbers on the back), but anyway, the hardware of a prototype Clickpad can easily be put into the casing of a production Clickpad, effectively hiding prototypes.
It would be harder to smuggle CAS+ items into exams unnoticed, because those don't look like regular Clickpads; that said, I bet that untrained exam personnel could be fooled.


3) news from the production Clickpads

Unlike that of Clickpad prototypes, the boot1 of production Clickpads is not directly writable. It's because the PCB track which makes it possible to act on the WE# pin of the SST39WF400A NOR Flash chip, visible on the prototype PCB, does not exist on the production PCB.

But chances are that it doesn't matter: adding an equivalent wire between the main R/Wbar line of the Nspire's bus (found e.g. onto the appropriate pin of the Zevio processor, and onto other places of the PCB) and the WE# pin, thereby making the boot1 writable, may work. Then, people can proceed to subvert the root trust of the calculator, so as to be able to permanently install arbitrary boot2 and OS, and exercise their full user rights on the platform


4) news from the Touchpads and Lab Cradles

Touchpad Nspires do not have an external NOR Flash chip for the boot1, so we assume that the boot1 is embedded into the Zevio processor. That said, there has to be a way to program it into the processor, as part of the calculator production process: either very early on, by the manufacturer, during the production of the Zevio chip, or later by the
user of the Zevio chip (TI).

A related fact is that while Lab Cradles use a Zevio chip with the same name as Touchpad Nspires, they contain an external EN39SL800 NOR Flash chip. See http://tiplanet.org/forum/viewtopic.php?f=43&t=9251 . For obvious cost reasons, few manufacturers add unnecessary hardware / PCB tracks on their boards... so the presence of an external NOR Flash
chip means that the Lab Cradles' Zevio supports an external NOR Flash.

Grafting an external NOR Flash chip onto Touchpad calculators, if at all possible, is expected to be highly impractical, as it requires significant equipment and expertise.


5) news from Clickpads, Touchpads, CX (and undoubtedly CM).

Ndless 3.1 can be installed on a calculator in a resident way; one of the capabilities of Ndless 3.1 is to launch programs at OS startup, before most of the OS's code runs.
Like the rest of developments mentioned here, it's perfectly legal, and besides, it fulfills interesting purposes, such as hot-fixing TI's bugs, e.g. the removal of the useful serial port output in Lua, reverted by a team work of open development community members ( http://tiplanet.org/forum/viewtopic.php?t=8931 and http://ourl.ca/15649 ).

Obviously, Ndless doesn't care about not working at all PTT mode; if it did, checks for the PTT mode would be easily removed, and the modified versions would be easily distributed, so it's completely pointless to add such checks.
As a result:
* since OSLauncher for Ndless 3.1 works (more or less) in startup mode ( http://tiplanet.org/forum/viewtopic.php?f=43&t=9235 ), it's harder to disable than the first iteration (for Ndless 1.7/2.0), last year, was;
* since the PTT implementation itself proves to be fairy dust, it's trivially subverted. See for instance http://ourl.ca/16356 .

Unsurprisingly, the Nspire's so-called protection is just as much of a laughingstock as the 84+'s protection. It is fundamentally impossible to make a foolproof protection, and the lower the cost and complexity, the worse the protection.
Like on the 84+, it's _technically_ possible to defeat the PTT and to install a CAS-capable OS on some Nspire models. But these possibilities didn't get the 84+ banned from the ACT and IB, so there's no reason why the Nspire series should be banned.
That said, since the incompetents who regulate standardized tests freaked about OSLauncher in 2011, though it was clearly perfectly harmless (because its effect went away by just rebooting into PTT mode), who knows what they would do this time...



You might think that this is an avalanche, but on the contrary, the truth is that programmers and users have barely scratched the surface
When TI's repeated egregious violations of our basic user rights to do whatever we want with the hardware we own have _really_ angered people, the Nspire series will go the way of the PS3, and it won't be pretty.
As I told them months ago (I spent the equivalent of two full-time days to write stuff for them - as expected, I failed to convince them, but at least, I'll have tried), all of that could be avoided with TI Education showing respect to its paying customers, who make that division rich enough...


Lionel.

Hi,

I use e-mail notifications a lot, because this forum is very high volume (which is, in itself, a good thing !). And after [this morning, in my timezone] 's server reboot, e-mail notifications don't work anymore... People using the notifications are going to miss lots of replies

TIA for fixing the server

I saw that the well-known French reseller "Lextronic", is currently making special offers with the Arduino Uno board (one of the models which can be used for a CALCnet - globalCALCnet bridge, see http://www.cemetech.net/news.php?id=439 ): http://www.lextronic.fr/P4124-platine-arduino-uno.html

There are two additional gifts, as long as supplies last:
* several resistors, capacitors, LEDs, and other things;
* a VGA output module (for a strange resolution) controlled by a serial link.

That said, 1) the supplies may have already been exhausted since the offer began yesterday, and 2) they ship in France with shipment fees of 8€, or in Europe with shipment fees of 21€...

Over the past few months, in an intermittent manner, I've started scratching an old itch of mine: patching TI's OS for TI-68k in an automated way, in order to optimize several sore performance spots that have bugged me for at least six years... and while at it, killing the silly protections laid out by TI, and why not fixing their bugs as well.
I discussed about the idea and program privately with several persons, one of whom (BrandonW) suggested to go up one level in genericity: split the patcher application and the patches themselves (written in a scripting-type language). The direction is clearly good, but I haven't reached such levels of abstraction yet, although I have tried to make a set of primitive functions generic enough to be usable for both TI-68k OS and TI-Z80 OS

So here's a patcher, which kills several protections, optimizes a bit several sore performance spots of the official TI-68k OS, fixes some bugs - and shrinks two versions so as to provide users 64 KB of additional archive memory (which older versions used to provide).
The latest version can currently be downloaded from http://tict.ticalc.org/beta/tiosmod-0.2.6.zip .


As noted above, the program is by no means a finished product, it's a seed for going further. The todo/wish list proves it. There's a lot that we could collectively do, in order to gain further power on calculator lines that are mostly, or totally, abandoned by the manufacturer - and help our fellow users
Contributions are more than welcome. To that effect, I have opened a Git repository on Github, http://github.com/debrouxl/tiosmod
Enjoy

Older versions, for historical purposes: http://tict.ticalc.org/beta/amsopt-0.1.zip , http://tict.ticalc.org/beta/tiosfix-0.2.zip , http://tict.ticalc.org/beta/tiosfix-0.2.1.zip , http://tict.ticalc.org/beta/tiosmod-0.2.2.zip , http://tict.ticalc.org/beta/tiosmod-0.2.3.zip , http://tict.ticalc.org/beta/tiosmod-0.2.3a.zip , http://tict.ticalc.org/beta/tiosmod-0.2.3b.zip , http://tict.ticalc.org/beta/tiosmod-0.2.4.zip , http://tict.ticalc.org/beta/tiosmod-0.2.5.zip.

[EDIT 20100822: posting a new version.]
[EDITs 20100914: posting two new versions.]
[EDITs 20100916: adding the Github repository information; posting a new version.]
[EDITs 20100922, 20100925, 20101017, 20101024: posting a new version.]

Hello everybody

I have uploaded at http://lpg.ticalc.org/prj_tiemu/downloads/setup.exe a pre-version of TIEmu 3.04 no-GDB, for beta-testing purposes
(*nix users can try http://lpg.ticalc.org/prj_tiemu/downloads/install_tiemu.sh, start by looking inside the script)

Since TIEmu 3.03, visible changes are fixes in the memory maps and I/O definitions, and fixes in the disassembler. Other changes, more visible to *nix users, include code updates not to use functions deprecated in recent GTK+ versions (2.20). Some updates to internal documentation, too. To sum up things, not much so far.

Before TIEmu 3.04 release, Thibault Duponchelle (a.k.a Contra / azerti, also working on TiLem-NG) and I are working to make TIEmu at least not crash anymore when loading on a 64-bit computer savestates created on a 32-bit computer, and vice-versa. With the ongoing switch to 64-bit computers, we'd better fix TIEmu somewhat before this known bug bites too many users
Note that transparently handling savestates created by buggy TIEmu versions is significantly harder than transparently handling images created by buggy TIEmu versions (which I contributed in 2009 to TIEmu, before becoming a (co-)maintainer, and is already available in TIEmu 3.03).

NOTE: thanks to updates of the shared libti* DLLs, as a side effect of installing this setup program for a beta TIEmu _after_ installing the beta TILP version featuring Jonimus' UI improvements (see e.g. http://www.cemetech.net/forum/viewtopic.php?t=4391 ), http://lpg.ticalc.org/prj_tilp/beta/setup.exe , you can get Nspire OS 2.x support in TILP, which I added last week-end by integrating (with minor changes) a patch contributed on the SF bug tracker.


The GDB-enabled version will follow later - I think it would be best to try bringing the huge (more than 120 KB !) NSIS definitions to a more manageable state first. NSIS does support wildcards, but there's no single wildcard in the TIEmu+GDB NSIS definitions created by Kevin, weird...


Thanks in advance for testing