Mod your Nspire prototypes into real Nspire, at last!

[critor]

Last year, many Nspire prototypes were sold online as if they were real Nspire.

But those prototypes were using development RSA keys different than production RSA keys: you couldn't update them with any of the production Nspire OSes available on TI website.

If you had bought such a prototype, you ended up stuck with an ancient development OS in version 1.1 or 1.2, and couldn't do much with it...

It was unfair...



On TI-Planet, we wanted to fix that. After months of constant research and development, we told you we achieved the impossible upgrade in a previous news, installing an OS 3.X on a prototype!

How was it possible?

It's normally impossible to install a production OS on those prototypes, because the Boot2 checks the OS signature with the development RSA keys, and rejects all OSes from TI website which are signed with production RSA keys.

In a similar way, it's impossible to alter the Boot2, as its signature is checked by the Boot1 with the development RSA keys.

But the Boot1 is not checked by anything. On TI-Nspire ClickPad, it's stored in a specific Flash NOR chip: SST 39WF400A. Thanks to a different connection of just one pin, that chip is write protected on production Nspire, but not on development Nspire!

So using a special Ndless version for prototypes, you'll have to perform the following tasks in order:

• reprogram the Boot1 with the production version 1.1.8916
• reprogram the Boot2 with a production version
• install a production OS

The method has been proven very reliable, tested with 100% success rate on all my 10 Nspire prototypes!

Moreover, if your prototype OS is recent enough and does support the USB, you won't need any special external hardware! It's for everybody!



Tonight at last comes the tutorial to upgrade your Nspire prototype! With many details, explanations and images! A step by step for everybody!

Tonight it's the happy end of 1 year of work on Nspire prototypes: research and development of various tools which revealed much more usefull that what we thought at the beginning, and which are working great together in the end although we really didn't anticipate everything!

Tonight, you can finally perform... the impossible upgrade!





Many thanks to:
- Bsl who has developped allmost all the needed tools
- Levak, Adriweb and Lionel Debroux, who have tested on their own prototypes




Cross-posted from TI-Planet.

Download the tutorial from the TI-Planet news, in french:
http://tiplanet.org/forum/viewtopic.php?p=122160#p122160

If someone wants to translate it to english, just contact me for an editable version of the file.

[thepenguin77]

Now, this might be a stupid question, but if you removed that one component in the production Nspires, could you then modify boot 1?

Hardware hacks aren't really the best option for modding, but a simple desolder would be a cool alternative to constantly fighting TI. (Or even just breaking the component)

Edit:
    Nevermind, looking at datamath, I see that the extra component is on the prototype, not the production model. Adding components wouldn't really be a viable option for many people.

[njaddison]

Hmmm... I wonder if that would work. I don't know, and I don't want to break my nspire trying to test that theory out.

What I hate about the nspire os is that I can't delete any components from it. 7zip keeps on giving me the error, "Not implimented." Why is this?

[critor]

Now, this might be a stupid question, but if you removed that one component in the production Nspires, could you then modify boot 1?

Edit:
    Nevermind, looking at datamath, I see that the extra component is on the prototype, not the production model. Adding components wouldn't really be a viable option for many people.

Yes, sorry - the prototype is on the left in the picture.

So in theory, on production TI-Nspire ClickPad, if you manage to connect the Flash NOR "magic" pin, you'll be able to reflash the Boot1 with anything you want.


Meaning that you could then freely load modified or 3rd party Boot2, and then modified or 3rd party OSes.

[Camdenmil]

According to the datasheet for the NOR flash, the WR pin is on the edge of the package. Is it possible to reach that pin with a wire or is it too close to the board surface/underfilled?

[critor]

I think it's too close to the board surface, but I haven't "really" tried.

Maybe someone who did try could tell us?