Omnimaga

Calculator Community => Casio Calculators => Topic started by: fxdev on February 27, 2011, 04:02:14 pm

Title: Secret debug menu
Post by: fxdev on February 27, 2011, 04:02:14 pm
Yesterday, I found a hidden debug menu. It was not known to Simon L., so I guess it is not known to you guys either. ;D

In order to start it, you have to do the following:
- Press the Restart button plus [OPTN]+[EXP]+[AC/ON] and hold all down
- Release the Restart button
- Wait until the screen becomes white
- Now release the remaining three keys

This will display the text "Please SD Card Insert" on the LCD - maybe a remnant from Casio Prizm development.

Pressing [MENU] (hold down for quite a while) shows the following options:

Code: [Select]
[F1]: Erase User Flash Area // Clears user flash memory (0xA0C00000..0xA2000000)
[F2]: Erase Password Area // Removes user name and organization (0xA0BE0000..0xA0C00000)
[F3]: Erase MCS Backup // Clears user RAM backup on the flash (0xA0B80000..0xA0BE0000)
[F4]: Erase Add-in Language // Removes language add-ins (0xA0B60000..0xA0B80000)
[EXIT]: Flash Program // Makes copy of the OS at 0xA1000000..0xA1B60000 (and may corrupt the file system!)

Note, if you press [OPTN]+[EXP]+[AC/ON] too short, it will display the OS Error screen (which is the OS update routine started from within the BIOS). Also, if you press [OPTN]+[EXP]+[AC/ON] without the Restart button involved, it will enter the diagnostics menu. In this case you have to additionally press [F1] followed by [9].



And here is the test menu: Syscall 0x0EA7 :D

I have attached a program at the bottom.

(http://img685.imageshack.us/img685/4075/prizmsecrets.png)
Diagnostics, test and debug menu.
Title: Re: Secret debug menu
Post by: AngelFish on February 27, 2011, 04:18:02 pm
That's not an SD card slot. Those are the exposed lines of the LCD driver.

Also, I entered the ABS debug menu and there's now an ominous incrementing hex counter that says
NOR Flash erase

Adr: A1FE0000


Also, pin 1 is related to diagnostics mode.

EDIT: Yep, screwed my OS. It's trying to load something.

EDIT EDIT: The OS is fine after a few minutes of booting. However, I no longer have any custom stuff installed.

I went back through the NOR flashing and wrote down the addresses.

Spoiler For Spoiler:
ADR:
A0C60000
A0C80000

.....

A1FE0000

NOR Flash blocks of size 2 0000
9C (156) *20000 (131072) (138 0000, 19.5 megabytes) memory size memory.

Basically, the counter increases by 2 0000 every iteration and I think this has to do with the memory block sizes. The total memory erased is 19.5 MB, which in enough for all of user memory to be flashed as well as 3.5 MB of extra stuff. I suspect RAM is a part of that, as well as OS data about the user.

Title: Re: Secret debug menu
Post by: TIfanx1999 on February 27, 2011, 05:39:16 pm
Nice find cfxm. How did you happen upon it?
Title: Re: Secret debug menu
Post by: jnesselr on February 27, 2011, 05:41:12 pm
Sweet, we found a way to break stuff! Interesting find.
Title: Re: Secret debug menu
Post by: PeonHero on February 27, 2011, 05:44:25 pm
This is an awesome find. Guessing he found it by randomly pressing buttons, trying different combinations, etc, just like how most other secret things were found.

P.S. Type in "Combination Combinations space" in the quick reply box for an interesting effect.
Title: Re: Secret debug menu
Post by: jnesselr on February 27, 2011, 05:45:33 pm
Combination Combinations space

What effect?
Title: Re: Secret debug menu
Post by: PeonHero on February 27, 2011, 05:47:11 pm
It underlines the word Combinations, saying it's not a word
Title: Re: Secret debug menu
Post by: phenomist on February 27, 2011, 05:52:02 pm
Some spellcheckers identify repeated words as possibly misspelled.
Title: Re: Secret debug menu
Post by: fxdev on February 27, 2011, 07:15:19 pm
@
Nice find cfxm. How did you happen upon it?

Well, a simple guess. ;D
The [OPTN]+[EXP]+[AC/ON] key combo is known for years and the Restart button always used to be special...
Title: Re: Secret debug menu
Post by: PeonHero on February 27, 2011, 07:20:56 pm
You don't have to say anything before combinations, it will say it is a misspell no matter what. I just put it there for reference.
Title: Re: Secret debug menu
Post by: yunhua98 on February 27, 2011, 09:09:18 pm
I doesn't work for me...
Title: Re: Secret debug menu
Post by: willrandship on February 27, 2011, 10:41:30 pm
That's because spellcheck is part of your browser, not the site ;)
Title: Re: Secret debug menu
Post by: fxdev on February 28, 2011, 01:09:27 pm
I did some tests in the diagnostic menu and as it seems the debug mode does not enable the cache.
That's why it is so slow and unresponsive.
Title: Re: Secret debug menu
Post by: AngelFish on February 28, 2011, 01:55:42 pm
I find it difficult to believe that not caching the data would make that much of a difference. That menu is extremely slow.
Title: Re: Secret debug menu
Post by: DJ Omnimaga on February 28, 2011, 04:08:34 pm
Wow nice find but yeah the menu is so slow. O.O

Thanks for posting this cfxm :D
Title: Re: Secret debug menu
Post by: DJ Omnimaga on February 28, 2011, 11:09:18 pm
Sorry, but that grammar fail in the SD card message made me unable to resist the temptation.

(http://i-lost-the-ga.me/casioprizmsecretmenu.png)
Title: Re: Secret debug menu
Post by: ralphdspam on March 01, 2011, 02:15:44 am
 :w00t:
ROFL!
A winner is him (that written SD message funny)!
Title: Re: Secret debug menu
Post by: m1ac4 on March 01, 2011, 07:38:14 am
That isn't the only message that is written slightly strange either. 
Code: [Select]
      Please                         OSAREACHECK
   SD Card Remove
They are even inconsistent with how they use the word update (Update vs UP DATE)
Title: Re: Secret debug menu
Post by: fxdev on March 01, 2011, 11:02:29 am
On the fx-9860G the test menu has an option that reads "Valiable Manager".
This is Japanese programming style... ;D
Title: Re: Secret debug menu
Post by: DJ Omnimaga on March 02, 2011, 01:03:06 am
Yeah I noticed that sometimes they have troubles translating stuff to English. That said, they did a pretty good job on the OS parts where most users can see text. It seems the backend of it isn't as good, though.

Title: Re: Secret debug menu
Post by: willrandship on March 02, 2011, 01:54:14 am
They probably just figured Beta Testing would Iron it out, and Beta testers aren't usually in the backend :P I think it's forgiveable.
Title: Re: Secret debug menu
Post by: z80man on March 02, 2011, 02:32:13 am
Hmm my menu seems to have different options.
Code: [Select]
[LY755A MAIN]     111
 1.PATTERN   4.VERSION
 2.FUNC      5.SERICE
 3.TEST      0.RESET


        QUIT  : [EXIT]
unless of course this is what you see. The items though provide access to a big list of tests to run on the calc. One is this strange color test that draws all the standard colors onto the screen.
Title: Re: Secret debug menu
Post by: AngelFish on March 02, 2011, 02:32:51 am
How did you access that? I haven't seen that menu.
Title: Re: Secret debug menu
Post by: z80man on March 02, 2011, 02:39:24 am
Same way that the other menu is accessed. hold down optn + EXp + AC/On until the diagnostic menu comes up, then press F1 then 9. I will post of video of all the tests.

Edit: service ID is tVQZJKr2
Title: Re: Secret debug menu
Post by: DJ Omnimaga on March 02, 2011, 02:41:35 am
I actually planned to post one, but go ahead I guess. :D

Also the menu cfxm accessed in his first post was Reset+optn+EXP+AC/ON, not optn+EXP+AC/ON, which might explain why you got a different one.
Title: Re: Secret debug menu
Post by: AngelFish on March 02, 2011, 02:41:47 am
That's cool. I've never noticed that menu even though I've been into Diagnostics mode before.
Title: Re: Secret debug menu
Post by: fxdev on April 15, 2011, 09:33:47 am
The test menu has been revealed! ;D

http://ourl.ca/9404/179118
Title: Re: Secret debug menu
Post by: DJ Omnimaga on April 17, 2011, 08:32:47 pm
Nice, were there any key combination to access that one or does it need to be done via a program?
Title: Re: Secret debug menu
Post by: fxdev on April 18, 2011, 08:20:06 am
Nice, were there any key combination to access that one [...]?

I guess no. There was one on the fx-9860G/GII up to OS 1.05, but they removed it with OS 2.00. Now you need syscall 0x0924.
You can't even access this menu by closing some contacts on the PCB. On the fx-9860G/GII you had to look for P103.
Title: Re: Secret debug menu
Post by: fxdev on April 19, 2011, 11:48:35 am
Interestingly, in the test menu there is a setup entry named "H-Copy".
According to the AFX manual, this allows sending screenshots directly to a PC; because there is no longer an FA-12x software.

With the decision to freely distribute the prizm screen receiver and the ability to store capture files as bitmaps on the calculator, this feature later became redundant.
Title: Re: Secret debug menu
Post by: DJ Omnimaga on May 12, 2011, 05:12:08 pm
Hmm interesting.

Btw this is shocking how the TI presenter costed like $300 when Casio now offers a similar tool for the Prizm for free...
Title: Re: Secret debug menu
Post by: fxdev on June 17, 2011, 01:37:16 pm
The purpose of the flash program is now known:
It makes a copy of the OS at 0xA1000000..0xA1B60000 and at the same time corrupts the file system. A flash memory optimization may not fix this. It is therefore recommended to run the debug menu again and press [F1] which will erase the entire user area. After reboot the file system will be restored.

PS: For some reason I could not extract the OS by cloning the Prizm's flash drive. I tried Goplat's dumpdrive and some WinHex functionality.
Title: Re: Secret debug menu
Post by: z80man on June 17, 2011, 03:02:56 pm
Dumping the flash drive only extracts the upper 16 mb of the flash chip. If the FAT table was reformatted it could be possible though to use the extra 4 mb that the OS doesn't use, but that could cause incompatibility issues in the future. I think the best bet is to either wait for Casio to make an SD card version of the Prizm or we make a usb flash drive application.
Title: Re: Secret debug menu
Post by: JosJuice on June 17, 2011, 03:51:29 pm
I think the best bet is to either wait for Casio to make an SD card version of the Prizm or we make a usb flash drive application.
Do you mean like msd8x? I don't know if that's possible... We don't know anything at all about USB, and the Prizm doesn't even support mini-A.
Title: Re: Secret debug menu
Post by: TeamFX on February 03, 2014, 08:20:22 pm
Hey, I just found out how to enter the test mode without using an add-in (that is, no syscall interface needed):

1) Turn on your calculator by pressing [OPTN]+[EXP]+[AC/ON]
2) As soon as the popup window appears*, quickly type in: 5963
3) Et VoilĂ , the test mode shows up ;D

And this doesn't reboot the calculator when leaving.

*) Press [F1] for the diagnostic mode.
Title: Re: Secret debug menu
Post by: DJ Omnimaga on February 04, 2014, 11:15:37 pm
Oh wow, thanks for the advice :thumbsup:
Title: Re: Secret debug menu
Post by: thepenguin77 on February 04, 2014, 11:19:05 pm
Hey, I just found out how to enter the test mode without using an add-in (that is, no syscall interface needed):

1) Turn on your calculator by pressing [OPTN]+[EXP]+[AC/ON]
2) As soon as the popup window appears*, quickly type in: 5963
3) Et Voilà, the test mode shows up ;D

And this doesn't reboot the calculator when leaving.

*) Press [F1] for the diagnostic mode.

I guess the question we all have to ask is how did you figure this out?
Title: Re: Secret debug menu
Post by: TeamFX on February 05, 2014, 12:39:04 pm
I guess the question we all have to ask is how did you figure this out?

I stumbled upon the 5963 pattern when analyzing the diagnostic syscall.
Title: Re: Secret debug menu
Post by: gbl08ma on February 05, 2014, 05:07:12 pm
2) As soon as the popup window appears*, quickly type in: 5963

There's not much point in doing it, but this is also reproducible when calling the diagnostics mode from Insight. After answering F1 on Insight's prompt, quickly press 5963 (if using the emulator, you should use the mouse to click on the keys). Note how it has a timeout, if you don't press another key in the sequence quickly, it reboots. Verified on the 1.02 emulator.

Now, more importantly... are there any differences between this test mode and the one available through the syscall? The syscall takes a parameter; has its meaning been revealed yet? And something that has kept me wondering for months and may be related to the high number of Prizms dying: is there something that permanently changes in the system as soon as the test or diagnostic modes are accessed (like, some bit set in flash)?
Title: Re: Secret debug menu
Post by: aeTIos on February 05, 2014, 05:43:35 pm
Holy necropost, Batman! O.O
Title: Re: Secret debug menu
Post by: TeamFX on February 05, 2014, 11:33:08 pm
I had a look at a few things. Here's a small summary.

fx-9860G/GII:
The test mode is syscall 0x0924 and there is no parameter.
The diagnostic mode is syscall 0x0176 and there is no parameter.

In OS 2.02.0200, syscall 0x0176 is no longer available and returns immediately.
However, this function can be found at address 0x8002F0C4. It takes one argument R4 that skips the initial "factory use only" window and enters the diagnostic mode if it is set to zero.


fx-CG10/20:
The test mode is syscall 0x0EA7 and there is one parameter.
If the argument R4 is set to zero, the VRAM is overwritten and not restored.

The diagnostic mode is not available as a syscall.
However, in OS 2.00.0200 this function can be found at address 0x8011D054. It takes one argument R4 that skips the initial "factory use only" window and enters the diagnostic mode if it is set to zero.

Quote
Now, more importantly... are there any differences between this test mode and the one available through the syscall?
There is one branch from the "factory use only" window into the test mode with R4 set to zero. Obviously, this is what happens when you type in 5963.

Quote
And something that has kept me wondering for months and may be related to the high number of Prizms dying: is there something that permanently changes in the system as soon as the test or diagnostic modes are accessed (like, some bit set in flash)?
I did not check on this, but the test and diagnostic main menus do not seem to do any flash writing. However, there are quite a few RAM values that are read and written and I can't say if these values will be reset when leaving those menus or when rebooting the calculator.

Quote
Holy necropost, Batman!
Sounds like a bad habit... but if a topic still provides accurate information that is neither wrong nor outdated, I don't see any reason why someone should open a new topic.
Title: Re: Re: Secret debug menu
Post by: DJ Omnimaga on February 06, 2014, 01:42:11 pm
I think he was kidding about the necroposting actually, since it's obvious that the topic bump is valid and contains important discoveries or progress. Same goes for project topics.
Title: Re: Secret debug menu
Post by: TeamFX on March 11, 2014, 04:18:14 pm
Here are a few more key combos:

[1]+[3]+[AC/ON] -> Reset OK? Initialize all.
- Also works under fx-9860GII OS 2.02 and 2.04 (SH-4A)

[F2]+[Up]+[AC/ON], then [9] -> User name will be deleted. OK?
- Writes an empty password file to 0x80BE0000
- Keys [F1] and [F6] are not checked
- Available since Prizm OS 1.04

[OPTN]+[EXP]+[AC/ON], then [F1] followed by [9] -> Invokes the diagnostic mode.
[OPTN]+[EXP]+[AC/ON], then 5963 or 5964 -> Invokes the test mode.
- 5963 works in all non-ClassPad OSes
- 5964 creates an SD card file containing all ROM data, then invokes the test mode
- 5964 first appeared in fx-9860G OS 1.02 and has been removed in OS 2.02 and 2.04 (SH-4A)
- As of Prizm OS 1.02, 5963 is identical to 5964
- Earlier Prizm OSes include a similar SD card routine, but it has no effect

The routine processing these key combinations also checks that the [EXE] key is not pressed.
Title: Re: Secret debug menu
Post by: DJ Omnimaga on March 11, 2014, 04:19:42 pm
Nice find. :D
Title: Re: Secret debug menu
Post by: TeamFX on March 11, 2014, 05:08:45 pm
I checked the entire thread and there is still one known key combo missing:

- Press [F2]+[4]+[AC/ON]+RESTART at the same time
- Release RESTART and continue pressing the remaining keys for a few seconds
- Press [9] for a second
- Press [X] (multiplication) for a second

This will display the message "OS ERROR" which activates the boot code's emergency OS updater.



When you press [OPTN]+[EXP]+[AC/ON]+RESTART on an fx-9860GII/fx-9750GII/fx-7400GII with SH-4A architecture, then it will display the message "OS ERROR" as well.