Author Topic: Reflash your Nspire Boot2 without RS232!!!  (Read 11278 times)

0 Members and 1 Guest are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Reflash your Nspire Boot2 without RS232!!!
« on: October 25, 2011, 02:28:52 pm »
We did it again!!! :love:


After his diagnostic flasher in the previous news, Bsl sent me a Boot2 flasher today.

I had prepared my RS232 interface in case of bricking problems, but Bsl is so great that it worked on the 1st try on both ClickPad and TouchPad models!

No need for an RS232 inteface anymore! You can freely upgrade/downgrade your Boot2.



Beyond upgrading/downgrading the Boot2, try to think about everything that could be achieved with this new Ndless program...



Another great day you shouldn't forget in the Nspire history! :D



For more informations and photos:
http://tiplanet.org/forum/viewtopic.php?f=43&t=8363
« Last Edit: October 25, 2011, 03:06:17 pm by critor »
TI-Planet co-admin.

Offline Yeong

  • Not a bridge
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3739
  • Rating: +278/-12
  • Survivor of Apocalypse
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #1 on: October 25, 2011, 03:02:48 pm »
so boot1 next? :D
Sig wipe!

Offline Lionel Debroux

  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2135
  • Rating: +290/-45
    • View Profile
    • TI-Chess Team
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #2 on: October 25, 2011, 03:05:34 pm »
Good question.
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TILP and TIEmu.
Co-admin of TI-Planet.

Offline Spyro543

  • LV9 Veteran (Next: 1337)
  • *********
  • Posts: 1189
  • Rating: +74/-3
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #3 on: October 25, 2011, 03:14:53 pm »
I know how the boot2 is important, but what's the boot1 good for for us?

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55942
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #4 on: October 25, 2011, 03:54:18 pm »
That is awesome. This definitively deserves a spot in the news section.
Now active at https://discord.gg/cuZcfcF (CodeWalrus server)

Offline shrear

  • LV4 Regular (Next: 200)
  • ****
  • Posts: 193
  • Rating: +17/-0
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #5 on: October 25, 2011, 04:07:20 pm »
I know how the boot2 is important, but what's the boot1 good for for us?
It's not protected by a RSA key. So we could write our own so that we can also run an unsigned boot2 and through that also a custom OS.
« Last Edit: October 25, 2011, 04:07:52 pm by shrear »

Offline apcalc

  • The Game
  • CoT Emeritus
  • LV10 31337 u53r (Next: 2000)
  • *
  • Posts: 1393
  • Rating: +120/-2
  • VGhlIEdhbWUh (Base 64 :))
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #6 on: October 25, 2011, 06:29:26 pm »
Once again, amazing achievement!  Great work! :)


Offline TIfanx1999

  • ಠ_ಠ ( ͡° ͜ʖ ͡°)
  • CoT Emeritus
  • LV13 Extreme Addict (Next: 9001)
  • *
  • Posts: 6173
  • Rating: +191/-9
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #7 on: October 27, 2011, 01:05:02 am »
Awesome stuff guys! :D

Offline fb39ca4

  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1749
  • Rating: +60/-3
    • View Profile
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #8 on: October 28, 2011, 12:29:37 am »
With this, I'm guessing you can semi-brick your calc if you have an invalid boot2, right? (You would just need to reflash using RS232, but until then it is unusable)

Offline Lionel Debroux

  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2135
  • Rating: +290/-45
    • View Profile
    • TI-Chess Team
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #9 on: October 28, 2011, 12:58:30 am »
Yes, if ones flashes a wrong boot2 and reboots the calculator, RS232 access will be necessary.
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TILP and TIEmu.
Co-admin of TI-Planet.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #10 on: October 30, 2011, 12:56:56 pm »
Take a TI-Nspire ClickPad prototype with its 1.1 development diagnostic software.
Compared to production diagnostic softwares, the development ones have an additional option in the memory menu which seems to test a flash of the Boot1.

And guess what... it does pass!!!

Have a look:



If what we are assuming is true, then it would perfectly be possible to convert TI-Nspire ClickPad prototypes into production TI-Nspire ClickPad, by flashing the 1.1 production Boot1 over the 1.1 development Boot1. Then, OSes 1.3 and above could be installed on those prototypes! :)

Of course, we would expect the Boot1 to be read-only on production TI-Nspire ClickPad, and on TI-Nspire TouchPad where it was moved from the NOR ROM chip to the Zevio ASIC chip. But you never know... The TI-84 Boot Code should not have been writeable either :P
« Last Edit: October 30, 2011, 01:16:03 pm by critor »
TI-Planet co-admin.

Offline Jim Bauwens

  • Lua! Nspire! Linux!
  • Editor
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1881
  • Rating: +206/-7
  • Linux!
    • View Profile
    • nothing...
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #11 on: October 30, 2011, 03:18:36 pm »
Interesting :)

Would it be possible to dump the diag of the prototype and put it on a regular clickpad?
Or are the signing keys different? If you could put it would work, you can try if the test works on it :)

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #12 on: October 30, 2011, 03:37:04 pm »
All the prototype diags have allready been dumped.

But they use the developper keys and cannot be installed on production models.
They should be runnable with DiagsLauncher, though.
TI-Planet co-admin.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #13 on: November 03, 2011, 04:31:06 pm »
The Nspire diagnostic softwares signed with the developer keys have a menu for flashing the Boot1 located in NOR ROM. The matching code still does exist on diagnostic softwares signed with the production keys, but isn't accessible through the menu any more.

The Boot1 flashing code is looking for a "nor.raw" file on the mysterious SD card nobody has ever seen.
So the flashing does fail... That option had never been proved to be usable.


But by using the emulator, it is possible to intercept the SD card accesses and make the Nor flashing option go to the next step:


(all credit for this experience goes to Bsl)


So the TI-Nspire Diagnostic software does include code usable to flash the Boot1, which should at least be usable on developer TI-Nspire ClickPad (prototypes), maybe on production TI-Nspire ClickPad, but probably not on TI-Nspire TouchPad & CX as the NOR chip seems to have been moved into the proprietary ASIC on those modes...
« Last Edit: November 03, 2011, 04:31:35 pm by critor »
TI-Planet co-admin.

Offline Jim Bauwens

  • Lua! Nspire! Linux!
  • Editor
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1881
  • Rating: +206/-7
  • Linux!
    • View Profile
    • nothing...
Re: Reflash your Nspire Boot2 without RS232!!!
« Reply #14 on: November 03, 2011, 06:20:47 pm »
That is very interesting! Thanks for the information :)