The TI-Nspire CAS+ dumped at last !

[critor]

OS 1.0.334T for the TI-Phoenix / TI-Nspire CAS+ was built on 2006 May 1st.

This OS is included in my P1-EVT2 prototype:





By hooking it up to an RS232 interface, we can totally control it through the DataLight shell to copy the system files to user folders:
/phoenix/phoenix.raw
/phoenix/install/manifest
/phoenix/install/devfiletree.zip

Then, by telnetting it on port 10001, we can transfer those files to the computer through USB.





And this evening, on 2012 May 1st, exactly 6 years later, this has finally been done!
The 1st TI-Phoenix / TI-Nspire CAS+ OS has just been dumped!



Things are finally changing for CAS+ owners who can now hope for:

• some Ndless-like tool
• dumps of other OS versions
• dumps of Boot1/Boot2/diags
• reinstallation of the CAS+ OS on calculators which were bricked by trying to access the non-existent maintenance menu through Menu+Enter+P
• upgrade to the latest CAS+ OS (1.0.554)
• upgrade to a 3rd-party OS (production Nspire OSes probably won't work without because of the much different hardware) by reflashing Boot1 and Boot2 (yes, Boot1 seems to have the write-enable pin connected on the CAS+)
• ...

Have a little look at what has been kept secret for far too long: 




More information available in the TI-Planet news:
http://tiplanet.org/forum/viewtopic.php?f=43&t=9195

[Juju]

Awesome!

[Happybobjr]

Would it be logical to buy a few bricked calcs for cheap, or would there be only a slight chance of it being able to help?

[DJ Omnimaga]

That is awesome to see this old model dumped

The best thing will be when it will be upgradeable to a commercial OS. Is the hardware the same?

[mikehill2003]

Sadly I don't think that will ever happen, the CPU is too different from the production models.

[Lionel Debroux]

Yeah, the OMAP hardware is too different from the ZEVIO hardware...

Very nice work, as usual, even if there are pretty few people using a CAS+, and consequently, there will be pretty little developer time spent on the CAS+

[hellninjas]

Critor, you'll never cease to astound me :O

[critor]

TI-nspire computer Link 1.0 is using port 10001 to transfer tns files to and from the CAS+ documents folder.

But we've just discovered a 2nd shell on port 10002, which seems to be able to access the whole filesystem.

And this time, it's working on all CAS+. here is an example with a CAS+ running OS 1.0.529:

Code: Select All | Copy To Clipboard

1 2	size("C:\phoenix/install/phoenix.img") -> 5067229

But as you can see, the syntax is strange.
Could someone help us figuring the commands list and their syntax?

[dl]

it took u 6 yaers to download 1 game on your calculator

[dl]

man how much time did u put into it a day

[Jim Bauwens]

Please do not double post so much, rather edit your post using the edit button

Also, he did not put any game on his calculator yet, and he wasn't busy on it for 6 years
The calculator itself is 6 years old, and he finally managed to extract the rom allowing him to reverse engineer it more

[apcalc]

Congrats!  I am sure this will be useful!

[Jonius7]

This looks great! The number of nspire versions that are now exploited/can be exploited has increased significantly. also may be of some help and hope to people who accidentally bought a CAS+. (And also to people who intentionally obtained one )

[critor]

The TI-Nspire CAS+ P1-EVT2 has a different boot screen than later Nspire:


So it probably has different Boot2 and Diags flashing screens too.

Let's discover them:






Bigger photos available from the TI-Planet news together with the CAS+ key combos:
http://tiplanet.org/forum/viewtopic.php?p=123705#p123705

[Goplat]

TI-nspire computer Link 1.0 is using port 10001 to transfer tns files to and from the CAS+ documents folder.

But we've just discovered a 2nd shell on port 10002, which seems to be able to access the whole filesystem.

And this time, it's working on all CAS+. here is an example with a CAS+ running OS 1.0.529:

Code: Select All | Copy To Clipboard

1 2	size("C:\phoenix/install/phoenix.img") -> 5067229

But as you can see, the syntax is strange.
Could someone help us figuring the commands list and their syntax?

From what I can tell looking at the EVT2 OS, I think the fm_xfer command (syntax: fm_xfer(IP address, operation, destination filename, source filename, callback frequency, callback enabled, options)) initiates a file transfer (connecting to the IP address on port 10001 and requesting or sending a file). Maybe it could be possible to make it connect to the calc's own link handler with something like

fm_xfer(127.0.0.1, pn_fm_fput, "/phx/documents/ndless/phoenix.tns", "/phoenix/install/phoenix.img", 5000, 1, 0)

Or alternatively, maybe it would be possible to run a program on the PC to listen on that port for link commands and have it send the file to that.

The TI-Nspire CAS+ P1-EVT2 has a different boot screen than later Nspire: So it probably has different Boot2 and Diags flashing screens too.

I hope you're making sure there is no diags present before testing the diags reflashing combination, as it immediately erases diags before receiving any data (unlike the boot2 reflashing combination, which doesn't erase until the transfer is completed)