Author Topic: The TI-Nspire CAS+ dumped at last !  (Read 11326 times)

0 Members and 1 Guest are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
The TI-Nspire CAS+ dumped at last !
« on: April 30, 2012, 08:33:15 pm »
OS 1.0.334T for the TI-Phoenix / TI-Nspire CAS+ was built on 2006 May 1st.

This OS is included in my P1-EVT2 prototype:





By hooking it up to an RS232 interface, we can totally control it through the DataLight shell to copy the system files to user folders:
/phoenix/phoenix.raw
/phoenix/install/manifest
/phoenix/install/devfiletree.zip


Then, by telnetting it on port 10001, we can transfer those files to the computer through USB.





And this evening, on 2012 May 1st, exactly 6 years later, this has finally been done! ;D
The 1st TI-Phoenix / TI-Nspire CAS+ OS has just been dumped! ;D



Things are finally changing for CAS+ owners who can now hope for:
  • some Ndless-like tool
  • dumps of other OS versions
  • dumps of Boot1/Boot2/diags
  • reinstallation of the CAS+ OS on calculators which were bricked by trying to access the non-existent maintenance menu through Menu+Enter+P
  • upgrade to the latest CAS+ OS (1.0.554)
  • upgrade to a 3rd-party OS (production Nspire OSes probably won't work without because of the much different hardware) by reflashing Boot1 and Boot2 (yes, Boot1 seems to have the write-enable pin connected on the CAS+)
  • ...



Have a little look at what has been kept secret for far too long:  ;)




More information available in the TI-Planet news:
http://tiplanet.org/forum/viewtopic.php?f=43&t=9195
« Last Edit: April 30, 2012, 08:55:50 pm by critor »
TI-Planet co-admin.

Offline Juju

  • Incredibly sexy mare
  • Coder Of Tomorrow
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 5730
  • Rating: +500/-19
  • Weird programmer
    • View Profile
    • juju2143's shed
Re: The TI-Nspire CAS+ dumped at last !
« Reply #1 on: April 30, 2012, 08:50:07 pm »
Awesome!

Remember the day the walrus started to fly...

I finally cleared my sig after 4 years you're happy now?
THEGAME
This signature is ridiculously large you've been warned.

The cute mare that used to be in my avatar is Yuki Kagayaki, you can follow her on Facebook and Tumblr.

Offline Happybobjr

  • James Oldiges
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2325
  • Rating: +128/-20
  • Howdy :)
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #2 on: April 30, 2012, 09:11:01 pm »
Would it be logical to buy a few bricked calcs for cheap, or would there be only a slight chance of it being able to help?
School: East Central High School
 
Axe: 1.0.0
TI-84 +SE  ||| OS: 2.53 MP (patched) ||| Version: "M"
TI-Nspire    |||  Lent out, and never returned
____________________________________________________________

Offline DJ Omnimaga

  • Former TI programmer
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55893
  • Rating: +3152/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • DJ Omnimaga Music
Re: The TI-Nspire CAS+ dumped at last !
« Reply #3 on: April 30, 2012, 09:57:45 pm »
That is awesome to see this old model dumped :D

The best thing will be when it will be upgradeable to a commercial OS. Is the hardware the same?

Offline mikehill2003

  • LV5 Advanced (Next: 300)
  • *****
  • Posts: 279
  • Rating: +13/-4
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #4 on: April 30, 2012, 10:37:55 pm »
Sadly I don't think that will ever happen, the CPU is too different from the production models.

Offline Lionel Debroux

  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2135
  • Rating: +290/-45
    • View Profile
    • TI-Chess Team
Re: The TI-Nspire CAS+ dumped at last !
« Reply #5 on: May 01, 2012, 02:07:09 am »
Yeah, the OMAP hardware is too different from the ZEVIO hardware...

Very nice work, as usual, even if there are pretty few people using a CAS+, and consequently, there will be pretty little developer time spent on the CAS+ :)
« Last Edit: May 01, 2012, 02:08:40 am by Lionel Debroux »
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TILP and TIEmu.
Co-admin of TI-Planet.

Offline hellninjas

  • LV7 Elite (Next: 700)
  • *******
  • Posts: 625
  • Rating: +17/-0
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #6 on: May 01, 2012, 11:00:07 am »
Critor, you'll never cease to astound me :O

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: The TI-Nspire CAS+ dumped at last !
« Reply #7 on: May 01, 2012, 03:16:52 pm »
TI-nspire computer Link 1.0 is using port 10001 to transfer tns files to and from the CAS+ documents folder.

But we've just discovered a 2nd shell on port 10002, which seems to be able to access the whole filesystem.

And this time, it's working on all CAS+. here is an example with a CAS+ running OS 1.0.529:
Code: [Select]
size("C:\phoenix/install/phoenix.img")
-> 5067229

But as you can see, the syntax is strange.
Could someone help us figuring the commands list and their syntax?
TI-Planet co-admin.

Offline dl

  • LV1 Newcomer (Next: 20)
  • *
  • Posts: 16
  • Rating: +0/-0
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #8 on: May 02, 2012, 04:15:42 pm »
it took u 6 yaers to download 1 game on your calculator

Offline dl

  • LV1 Newcomer (Next: 20)
  • *
  • Posts: 16
  • Rating: +0/-0
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #9 on: May 02, 2012, 04:16:30 pm »
man how much time did u put into it a day

Offline Jim Bauwens

  • Lua! Nspire! Linux!
  • Editor
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1881
  • Rating: +206/-7
  • Linux!
    • View Profile
    • nothing...
Re: The TI-Nspire CAS+ dumped at last !
« Reply #10 on: May 02, 2012, 04:29:58 pm »
Please do not double post so much, rather edit your post using the edit button ;)

Also, he did not put any game on his calculator yet, and he wasn't busy on it for 6 years :P
The calculator itself is 6 years old, and he finally managed to extract the rom allowing him to reverse engineer it more :)

Offline apcalc

  • The Game
  • CoT Emeritus
  • LV10 31337 u53r (Next: 2000)
  • *
  • Posts: 1393
  • Rating: +120/-2
  • VGhlIEdhbWUh (Base 64 :))
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #11 on: May 02, 2012, 05:04:15 pm »
Congrats!  I am sure this will be useful! :)


Offline Jonius7

  • python! Lua!
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1918
  • Rating: +82/-18
  • Still bringing new dimensions to the TI-nspire...
    • View Profile
    • TI Stadium
Re: The TI-Nspire CAS+ dumped at last !
« Reply #12 on: May 02, 2012, 07:51:55 pm »
This looks great! The number of nspire versions that are now exploited/can be exploited has increased significantly. also may be of some help and hope to people who accidentally bought a CAS+. (And also to people who intentionally obtained one :P)
« Last Edit: May 02, 2012, 07:52:31 pm by Jonius7 »
Programmed some CASIO Basic in the past
DJ Omnimaga Music Discographist ;)
DJ Omnimaga Discography
My Own Music!
My Released Projects (Updated 2015/05/08)
TI-nspire BASIC
TI-nspire Hold 'em
Health Bar
Scissors Paper Rock
TI-nspire Lua
Numstrat
TI-nspire Hold 'em Lua
Transport Chooser
Secret Project (at v0.08.2 - 2015/05/08)
Spoiler For Extra To-Be-Sorted Clutter:

Spoiler For Relegated Projects:
TI-nspire BASIC
Battle of 16s (stalled) | sTIck RPG (stalled) | Monopoly (stalled) | Cosmic Legions (stalled)
Axe Parser
Doodle God (stalled while I go and learn some Axe)

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: The TI-Nspire CAS+ dumped at last !
« Reply #13 on: May 02, 2012, 08:01:49 pm »
The TI-Nspire CAS+ P1-EVT2 has a different boot screen than later Nspire:


So it probably has different Boot2 and Diags flashing screens too.

Let's discover them:






Bigger photos available from the TI-Planet news together with the CAS+ key combos:
http://tiplanet.org/forum/viewtopic.php?p=123705#p123705
« Last Edit: May 02, 2012, 08:02:34 pm by critor »
TI-Planet co-admin.

Offline Goplat

  • LV5 Advanced (Next: 300)
  • *****
  • Posts: 289
  • Rating: +81/-0
    • View Profile
Re: The TI-Nspire CAS+ dumped at last !
« Reply #14 on: May 02, 2012, 10:28:35 pm »
TI-nspire computer Link 1.0 is using port 10001 to transfer tns files to and from the CAS+ documents folder.

But we've just discovered a 2nd shell on port 10002, which seems to be able to access the whole filesystem.

And this time, it's working on all CAS+. here is an example with a CAS+ running OS 1.0.529:
Code: [Select]
size("C:\phoenix/install/phoenix.img")
-> 5067229

But as you can see, the syntax is strange.
Could someone help us figuring the commands list and their syntax?
From what I can tell looking at the EVT2 OS, I think the fm_xfer command (syntax: fm_xfer(IP address, operation, destination filename, source filename, callback frequency, callback enabled, options)) initiates a file transfer (connecting to the IP address on port 10001 and requesting or sending a file). Maybe it could be possible to make it connect to the calc's own link handler with something like

fm_xfer(127.0.0.1, pn_fm_fput, "/phx/documents/ndless/phoenix.tns", "/phoenix/install/phoenix.img", 5000, 1, 0)

Or alternatively, maybe it would be possible to run a program on the PC to listen on that port for link commands and have it send the file to that.

The TI-Nspire CAS+ P1-EVT2 has a different boot screen than later Nspire: So it probably has different Boot2 and Diags flashing screens too.
I hope you're making sure there is no diags present before testing the diags reflashing combination, as it immediately erases diags before receiving any data (unlike the boot2 reflashing combination, which doesn't erase until the transfer is completed)
« Last Edit: May 02, 2012, 10:46:31 pm by Goplat »
Numquam te deseram; numquam te deficiam; numquam circa curram et te desolabo
Numquam te plorare faciam; numquam valedicam; numquam mendacium dicam et te vulnerabo