Omnimaga

Omnimaga => News => Topic started by: critor on July 18, 2013, 04:21:21 pm

Title: 1st mod of a TI-Nspire CM into a TI-Nspire CX CAS
Post by: critor on July 18, 2013, 04:21:21 pm
TI-Nspire CM calculators sold in China and TI-Nspire CX have almost the same software capabilities.
The only disprency between those is to be able to install a bilingual dictionnary for TI-Nspire CX and not for TI-Nspire CM.
A TI-Nspire CM to TI-Nspire CX transformation or the reverse would give no interest, that's why we didn't look forward about that.

But our chinese friends of cnCalc.org (http://www.cncalc.org/) were struggling since one week to do this transformation.

What are their motivations ?
Nlaunch, the OS launcher for TI-Nspire, is available for monochrome TI-Nspire and TI-Nspire CX, but not yet for TI-Nspire CM because it is based on a Boot2 1.4 exploit (for monochrome TI-Nspire) and Boot2 3.1 exploit (for TI-Nspire CX) and the TI-Nspire CM uses a different Boot2.

But once a TI-Nspire CM has been modded into a TI-Nspire CX, it is theoretical to install Nlaunch CX and so :
Lets recall how the different software modules (Boot2, OS) checks the calculator model where they run.

One the one hand, the NAND chip contains the model id at offset 0x804:
You may think it would be enough to modify this value, but a second value is stored in the ASIC chip:
And unlike the NAND chip, we are unable to rewrite the ASIC chip.

When the Boot2 and TI-Nspire OS launch or install an OS, they check if the latter is consistant to these two values:
Take note that the special code 0b11111 found on TI-Nspire DVT prototypes is a debug code that doesn't state the calculator type, and thus disables this second check. That's why we could transform very easily (http://tiplanet.org/forum/viewtopic.php?p=129030) TI-Nspire prototypes to TI-Nspire CAS by rewriting NAND chip.
(http://tiplanet.org/forum/gallery/image.php?mode=thumbnail&album_id=1&image_id=1307) (http://tiplanet.org/forum/gallery/image_page.php?image_id=1307)

Changing the model id written in the NAND memory incoherently with the a ASIC chip, is no less than a permanent brick of the calculator.
Indeed, whatever OS used after this modification, one of the two checkings written above would obviously fail and the OS sent will be rejected and/or deleted.
You end up with a OS-less calculator on which you wouldn't be able anymore to install any OS.



Well, nbzwt, member of the chinese communauty cnCalc.org (http://www.cncalc.org/) has his hand on fire and effectively made a destruction of his TI-Nspire CM calculator:
(http://i.imgur.com/utefSB8.png)(http://i.imgur.com/V1PYr5Z.png)

His calculator was now unable to approve the installation or the launching of any CX or CM OS.
(http://www.cncalc.org/data/attachment/forum/201307/18/130521ozj3byrzjbvieqph.jpg)

But then what was the reason for? No, nbzwt isn't crazy - per contra he showed an extraordinary malice. ;)
Now that his calculator is using 3.1 CX Boot2, he is theoretically able to install the Nlaunch OS launcher, which then allows to install and launch any TI-Nspire CX, CM, and even CAS OSes!  ;D(http://www.omnimaga.org/Themes/default/images/gpbp_arrow_up.gif)
(http://www.cncalc.org/data/attachment/forum/201307/18/130530e0lqp4usj944jtbs.jpg)


A small breakdown had to be known: TI-Nspire CM calculators have only 32 MB of SDRAM memory instead of 64 MB like on the TI-Nspire CX calculators, and official Nlaunch don't work.
But nbzwt released an Nlaunch fork (http://tiplanet.org/forum/archives_voir.php?id=19507) that works with the TI-Nspire CX 3.1 Boot2 on TI-Nspire CM hardware. :bj:



Tutorial to transform a TI-Nspire CM into a TI-Nspire CX CAS (http://tiplanet.org/forum/viewtopic.php?f=57&t=12693&lang=en)



Let's all congratulate awesome nbzwt loudly for this huge achievement!
 ;D(http://www.omnimaga.org/Themes/default/images/gpbp_arrow_up.gif)



Please take note however that I do not invite you to do this modification based on a bricking of the calculator. If for any reason Nlaunch cannot be installed/run (for instance like when future 3.2.4/3.6 OSes will try to fore the Boot2 3.2.4.7 update), the bricking will become permanent.  :mad:
That's why in the actual forecast, I won't change the security policies of nsMandMgr to allow this transformation.

Source:
http://tiplanet.org/forum/gallery/image_page.php?image_id=1307


Edit: And precisely, it seems that nbwzt had unfortunately completed the bricking of his TI-Nspire CM bricking by fulfilling complementary tests for the tutorial :(
Code: [Select]
Boot Loader Stage 1 (3.00.99)
Build: 2010/9/9, 17:29:13
Copyright (c) 2006-2010 Texas Instruments Incorporated
Using production keys

Last boot progress: 65

Available system memory: 33196
Checking for NAND: NAND Flash ID: MICRON     
SDRAM size: 64 MB
External Power Detected: VBUS.
SDRAM memory test:   FAIL TI_B1_ADDRESS_1
BOOT1 Error: Stubbornly refusing to boot due to memory failure.
The Boot1 seeks here for the 64 MB RAM of the TI-Nspire CX, which aren't found because we are on a TI-Nspire CM with only 32 MB RAM.
This issue will not happen if you follow carefully, exactly and in order the linked tutorial.
If you want to share this with nbzwt some encouragement words or to send him a share so he can keep developping us other extraordinary tutorials or tools, do not hesitate: nbzwt @ live.cn
Title: Re: 1st mod of a TI-Nspire CM into a TI-Nspire CX CAS
Post by: lkj on July 19, 2013, 04:28:38 pm
Quote
And unlike the NAND chip, we are unable to rewrite the NAND chip.
You probably wanted to write "we are unable to rewrite the ASIC chip"?

Interesting news, as always  :thumbsup:
Title: Re: 1st mod of a TI-Nspire CM into a TI-Nspire CX CAS
Post by: Streetwalrus on July 19, 2013, 04:33:48 pm
0b00001 for TI-Nspire CAS et TI-Nspire CX CAS

Anyway nice to see Nspire hacking progressing.[/list]
Title: Re: 1st mod of a TI-Nspire CM into a TI-Nspire CX CAS
Post by: critor on July 20, 2013, 06:22:26 am
Errors fixed.
I wasn't available yesterday, sorry.