Axe Undeleter



http://www.omnimaga.org/index.php?action=downloads;sa=view;down=692

An undeleter written in Axe that can undelete all variable types except groups. It does some pretty wacky things, such as abusing the files feature and doing shifty things with the VAT. It's far larger than my assembly undeleter, but this is exactly what you need if you need to undelete a picvar, list, string, or something else that isn't a program or appvar.

Remember how in IM 2, the high byte comes from the I register and the low byte of the address for your ISR is random? That may have been true for the TI-83+, but I don't think it's true for the TI-83+SE and TI-84+(SE). A while ago, I did some tests on my TI-84+SE that suggested that in IM 2, the only vector that ever gets used is the FF one. Now, once again, I have written a slightly more advanced tester, based on MicrOS, to keep track of what vectors are issued. Attached is a program for this and its source. Be aware, this program erases all of your RAM. Run the program, and you just get a basic hex editor, starting at address 6200. Address 6200 is the start of a table keeping track of how often a particular IM 2 vector is used. Each entry is two-bytes, so to check how often 20h was used, go to 6240h. The only vector I have ever seen is FF (63FE). Does anybody else with TI-83+SE or TI-84+(SE) ever see a non-zero value in the 6200h to 63FDh range?

That must be a very expensive robot.

Fascinating! Those numbers suggest that the boot sector is hard-locked on that unit. Yet, another TI-83+ owner said that his boot sector wasn't locked. If it's really a a unit from 1999, then TI has substantially changed the TI-83+'s hardware since then (but, we already knew that). This means that TI used the flash chip's locking feature before moving to the ASIC. Now, it's the ASIC itself that handles locking. More experimentation on newer units is clearly called for.

Also, speaking of newer units, while I'm glad that older members of the community with older units are active during the summer, it's the transition between 128 K of RAM and 48 K that I'm most interested in. So, let's get information on some newer models.

Here's the data so far:
Known manufacturer IDs are

ID Manufacturer
01 AMD
04 Fujitsu
7F Unknown
C2 Unknown

Known device IDs are

ID Device
23 512 K (4 megabit) (old units)
B9 512 K (4 megabit) (new units)
C4 2048 K (16 megabit)
DA 1024 K (8 megabit)


Data Chart

Note: VS = ViewScreen

Model HW Bad LCD V# All RAM Port 15 Port 3A Chip ID Boot Owner
84+SE S-0605D No 2 Yes 45 00 04C4 000000 Me
84+SE S-0404 No 2 Yes 44 0F 04C4 000000 Runer112
84+ S-0406F Yes 2 Yes 45 00 01DA 000000 Eeems
84+SE P-0508M Yes 2 No 55 00 01C4 000000 thepenguin77
84+SE P-0510O Yes 2 No 55 00 7FC4 000000 thepenguin77
83+ S-0508K No 2 N/A 00 N/A 01B9 000045 Juju
84+SE S-0606F No 2 Yes 45 00 01C4 000000 graphmastur
84+ K-0207E No 2 Yes 45 00 C2DA 000000 ZippyDee
84+SE S0306-F 10h 2 Yes 45 00 01C4 000000 BuckeyeDude
84+SEVS S-1204A No 2 Yes 44 0F 04C4 000000 JosJuice
84+SEVS S-0404 No 2 Yes 44 0F 04C4 000000 the_mad_joob
83+VS I-0299A Yes 2 N/A 15 No 0123 010146 the_mad_joob

7. Port 3A: No (oddly it doesn't show and goes right to No IDs: without a newline)

I've fixed that bug. I forgot to insert a new line. Also, it just displays "no" for that test on the TI-83+ and TI-83+SE because we don't expect it to read anything of interest anyway.

8. 01B9
9. P?: 000045

Very interesting! It took me a bit to find the data sheet for the B9 device code. Even more interesting is that autoselect reports that the boot sector isn't hardware locked, so there's still a possibility that we can reflash the boot code on the TI-83+. (The 45 is a read from RAM page 1, not any flash sector.)

Introduction
In the past few weeks, we've resolved many important mysteries concerning the hardware of the TI-83+ series of calculators. However, there are still questions remaining. There are three questions that I cannot answer without amassing data from other people. They are:

• What does port 15h mean?
• What does port 3Ah mean?
• Do the autoselect commands work on all units?
• Is the boot sector of the TI-83+ locked by the flash chip?

By giving me some simple information and running a small program on your calculator, you can help answer these questions. People with any model, from the TI-83+ to the TI-84+SE, can help.

Skip to the How to Help heading if you're super lazy or just have no curiosity.

Current Theories
Port 15h has a non-zero value on the TI-83+SE and above. Its value never changes on any one particular unit, but it seems to be different on different units. Also, I've heard nothing about its value on a TI-83+. I think port 15h may be some kind of ASIC hardware version indicator. To verify this, I need data from many units. I'd also like to know whether it reports anything of interest on the TI-83+.

By request of thepenguin77, I've added a test concerning port 3A. It has something to do with USB. DanE (the prophet from the Kingdom of USB) believed it was a USB driver revision ID. We may ask you additional questions if we see an interesting value, because we have some evidence to indicate that it means something really important.

Similarly, I need data from many units too see if the autoselect commands work. I'm particularly interested in the TI-83+, because autoselect hasn't been tested on it. What is autoselect, you ask? It's a special command that allows you to query the flash chip for its manufacturer ID and device ID. The manufacturer ID will probably change from unit to unit, but the device ID should be the same for all models:

• 23h or 0B9h for the TI-83+
• 0DAh for the TI-84+
• 0C4h for the TI-83+SE and the TI-84+SE

Previously, we used port 21 to distinguish between the TI-84+ and the TI-84+SE, but port 21 can be programmed to lie. If autoselect is reliable, we have a way to be certain. (I also believe that the TI-84+ and the TI-84+SE and fully identical except for the flash chip.)

Finally, you may be aware that we've succeeded in unlocking the boot sector of the TI-83+SE and TI-84+/SE. <technical stuff> However, the hardware of the TI-83+ is different. We're not sure if the boot sector on that model can be unlocked. The data sheet for the flash chip says that the chip can be configured, using a piece of hardware known as an external flash programmer, to permanently lock any combination of sectors from being written to or erased. The TI-83+SE and above don't use this method of protection, and it's possible that the TI-83+ doesn't, either. The bad news is that this can only be undone by applying 12 V to one particular pin. </technical stuff>

The good news is that there is a way to find out whether or not the flash chip's internal protection--and therefore if the boot sector can be changed--is being used: there is one additional autoselect command that allows you to query whether any particular sector is has been protected with the flash chip's internal protection. If the boot sector of the TI-83+ is locked with this protection, it will return 01; if not, 00. If you get a 00 on a TI-83+, then there may be a way to unlock the TI-83+'s boot sector.

How to Help
First, answer a few questions about your calculator.

• 1. What is the model? (TI-83+, TI-83+SE, TI-84+, or TI-84+SE)
• 2. What is the HW revision? (This is the last six digits of the serial number on the back of your calculator. Mine is S-0605D.)
• 3. Do you need ALCDFIX? If you've never had any issues with corrupted graphics in games, you don't need it. Optional: If you do need ALCDFIX, how much delay does it add? (check ports 29 and 2A in Calcsys) Just say "yes" if you have a TI-83+.

Next, run the attached program (hwtests.8xp) on your calculator, using the Asm( token found under 2nd+0. The source is attached below, too. This program will report some information:

• 4. The program version number
• 5. Do you have the full 128 K of RAM?
• 6. The value in port 15
• 7. The value in port 3A
• 8. The manufacturer ID and the device ID returned by the autoselect commands
• 9. The protection status of sectors 1F, 3F, and 7F

Post your answers here.

Mine are

• 1. TI-84+SE
• 2. S-0605D
• 3. No LCD issues.
• 4. Version #2
• 5. Do you have the full 128 K of RAM? Yes.
• 6. The value in port 15: 45
• 7. The value in port 3A: 00
• 8. The manufacturer ID and the device ID returned by the autoselect commands: 04 (Fujitsu) C4 (2048 K chip, top boot)
• 9. The protection status of sectors 1F, 3F, and 7F: all 00

Other Mysteries
There are still other unknown ports. If you have hardware that can supply your calculator with a carefully variable voltage (from 2.9 to 5.0 VDC), let me know and I'll send you another program. I believe that the calculator can test the voltage down to at least half a volt of accuracy by writing to port 04, but I don't have the hardware to test this.

Other unknown ports are listed at WikiTI.

That's one of Michael's older programs. He called it a "mistake" on IRC once. It abuses the LCD in ways you can't expect to work anymore, and shouldn't have expected to work in the first place.