Omnimaga

Omnimaga => News => Topic started by: critor on October 25, 2013, 11:57:15 am

Title: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: critor on October 25, 2013, 11:57:15 am
My deepest sympathy to the Omnimaga team.


There are two types of TI-Nspire calculators:
Some exams in some countries (United States, Portugal...) forbid the use of CAS calculators. That's why TI has split the TI-Nspire handhels in two sister lines. It is obvious that you can't (at least officially) install a CAS OS on a non-CAS calculator and vice versa.

(http://tiplanet.org/forum/gallery/image.php?mode=thumbnail&image_id=1228) (http://tiplanet.org/forum/gallery/image_page.php?image_id=1228)
In the hardware, the difference between CAS and non-CAS is using two separate chips:
Each of these chips contains a code identifying the calculator as CAS or non-CAS, and these codes are verified and compared at various times:
However Nlaunch, the third party OS launcher released last year exploits a flaw in the Boot2 1.4 to remove the first two checks above, letting you install and run any TI-Nspire OS, and among other CAS OSes on non-CAS calculators.

Intended or not, this attack against the TI business model seems to have greatly displeased. For the the last few months, we've been stroke on all sides by a number of new various protections on the new hardware and software versions of the TI-Nspire.

In a Previous news (http://tiplanet.org/forum/viewtopic.php?f=43&t=13214), we just spotted a new additional protection in the new TI-Nspire OS 3.6 . Indeed, if the CAS version is installed on non-CAS calculator with the help of Nlaunch, the OS just freezes upon startup on the grey screen. So it seems now that once launched, the OS checks the CAS / non-CAS codes one more time in the NAND and ASIC chips.



And what happens when a worker doesn't fully conform to the original plan of the architect-engineer? Quite often the building finally collapses...

With all these protections systematically added around mindlessly (aparently) in the last months and violating the original security model, I was fearing that TI might en up bricking some TI-Nspire... and unfortunately, I was right! >:(



Before the release of the first TI-Nspire, the TI-Nspire ClickPad for back to school 2007, Texas Instruments freely distributed numbers of prototypes during the 2006-2007 schoolyear. I do not know what their lucky owners told TI, but I guess they didn'r really appreciate the gift as many of them rushed to resell it online after the release of TI-Nspire, but of course with a price similar to the production models one. A trained eye will notice several small differences, but the only one common to all prototypes is the mention of an 'EVT', 'DVT' or 'PVT' code in the serial number on the back. >:(

(http://tiplanet.org/forum/gallery/image.php?mode=thumbnail&image_id=1579) (http://tiplanet.org/forum/gallery/image_page.php?image_id=1579) (http://tiplanet.org/forum/gallery/image.php?mode=thumbnail&image_id=1301) (http://tiplanet.org/forum/gallery/image_page.php?image_id=1301)
Until the release of color TI-Nspire CX for back to school 2011, online resale shops have been flooded with prototypes apparently very similar with the production models. But even if we put aside the dubious morality of this behaviour, it was nothing more than a monstrous scam! Indeed, prototypes Boot1 and Boot2 validated the signatures with the development keys and not the production ones. As a result:
Fortunately, TI-Planet has taken this cause to heart and tried its best to repair the scams you experienced.
However, the ASIC chip on TI-Nspire ClickPad DVT prototypes doesn't include the non-CAS / CAS identification code. The NAND chip being flashable, a simple modification of its CAS / non-CAS code allows for example the transformation of a non-CAS prototype into a CAS one (http://tiplanet.org/forum/viewtopic.php?p=129030). This implies that the historical CAS / non-CAS checks are based on differences tests. The code in the ASIC chip being neither CAS nor non-CAS, the test is successful in all cases. ;D(http://www.omnimaga.org/Themes/default/images/gpbp_arrow_up.gif)

So for months and now years, you've been able to use your TI-Nspire ClickPad DVT prototype as a production model. Unfortunately, you can't anymore. The OS 3.6 freezes at startup on all TI-Nspire ClickPad DVT prototypes, even those whose CAS / non-CAS NAND case has never been changed! :o
So it seems that the new CAS / non-CAS verification on the startup of OS 3.6 was not coded in the same way as the historical verification, using tests of equalities and not differences! In consequences, ASIC verification fails on all these prototypes since there is no CAS or non-CAS code in the ASIC! >:(

This raises some questions about the process of development. Does this error means they do not even test development versions of their new OS on TI-Nspire ClickPad / TouchPad anymore and simply generate them automatically? Or was this change intended to prevent students using six years old non-CAS prototypes turned into CAS ones during exams? It would be really extreme, but not surprising in the context of what we have been experiencing during the last months...

Do you think you simply have to reinstall an earlier version of the OS to repair your prototype? It would have been too easy... Although stuck at the grey screen, the OS 3.6 still has the malice to increase the minimum installable OS version stored in NAND... to 3.6! The only OS that you now have the right to install is the 3.6 which won't work! Your calculator is now unusable... TI just destroyed your rare TI-Nspire ClickPad DVT prototype without warning! >:(
Note that the tool Nlaunch, even if it can't make OS 3.6 work on these prototypes, has the advantage of avoiding their bricking when attempting to use OS 3.6, since it makes Boot2 ignore the minimum installable OS version programmed in NAND.



In addition to the ones you may have purchased online, TI-Planet distributed many of its TI-Nspire ClickPad DVT prototypes, either to developers or to contests winners, and so we have to warn you:
DO NOT INSTALL OS 3.6 ON A TI-NSPIRE CLICKPAD DVT PROTOTYPE - STAY WITH OS 3.2 OR OLDER
There is so far no way to use the OS 3.6 on these prototypes; it is useless to try, even with Nlaunch.


If it's already too late for you, the general idea to ​​repair follows the pattern below:
Feel free to answer in the TI-Planet topic if needed - we'll try to help everybody.



Let's hope that the TI- Nspire ClickPad DVT prototypes will remain the only victims of the new Texas Instruments behaviour, but it's not impossible to find other similar cases, as a security model designed 6 years ago was suddenly changed. >:(


Source:
http://tiplanet.org/forum/viewtopic.php?t=13280&p=151025&lang=en
Title: Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: DJ Omnimaga on October 25, 2013, 04:31:00 pm
I think TI just decided to not support those prototypes and the unfortunate buyers who got them by mistake. It sucks for these people, although I guess I can understand TI for not supporting unnoficial models. On the other hand, it's kinda irritating considering the hard work you put to help people who couldn't upgrade their prototypes.
Title: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: critor on October 25, 2013, 07:30:24 pm
I'm not sure at all that TI did this on purpose.

Here is according to me the algorithm which is run by the Boot2 and the OS upon the reception-installation of a new OS, and by the Boot2 each time it launches the installed OS:
Code: [Select]
if (OS=CAS and NAND=CAS and ASIC≠non-CAS) or
(OS=non-CAS and NAND=non-CAS and ASIC≠CAS)
then
installs / launches OS
else
rejects / uninstalls the OS
endifOn TI-Nspire ClickPad DVT prototypes, as ASIC chips don't include the CAS / non-CAS codes both differences work in all cases and the test only depends upon the type of the OS to install / launch and the CAS / non-CAS code in the reflashable NAND chip, allowing an easy mod of such non-CAS prototypes into CAS ones by just reflashing the NAND.

Those differences tests may not seem natural to you, but as it's assembly code testing less than 5 bits they don't surprise me.

Based on my tests, here is the new different algorithm which is run by OS 3.6 each time it starts:
Code: [Select]
if (OS=CAS and NAND=CAS and ASIC=CAS ) or
(OS=non-CAS and NAND=non-CAS and ASIC=non-CAS)
then
installs / launches OS
else
freezes OS
endifThis time , as the TI-Nspire ClickPad DVT prototypes ASIC chip doesn't include the CAS / non-CAS codes, both equalities fail in all cases and you can't run OS 3.6.

To my advice, the guy at TI just quickly coded what seemed natural to him, not bothering to check the real historical code in the Boot2, thus violating a security model designed by TI engineers more than 6 years ago and which was used unchanged for more than 6 years.

Such a critic change should have been made with much more care and tested on dozens of TI-Nspire models of all kinds.
It's ovious in computer science that you mustn't lightly modify the rules of a security model which was used unchanged for more than 6 years, and that it would probably have side issues on some of the many models released during that time without a full retesting of the whole TI-Nspire brand, which apparently was not performed.
Title: Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: DJ Omnimaga on October 26, 2013, 07:41:24 am
That seems a bit scary in that case. The next thing I wonder is if they won't break compatibility with clickpads as a whole or something. It would be a big outrage in the technology world if thousands of nspires were reported bricked by an official update.
Title: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: Streetwalrus on October 26, 2013, 07:43:36 am
It already happened with the 2.x upgrade IIRC.
Title: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: Lionel Debroux on October 26, 2013, 07:45:39 am
2.0.1188 probably did, but 3.0.1.1753 did at a far wider scale.
Title: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: critor on October 26, 2013, 08:37:30 am
Yes, 3.0.1.1753 bricked many production TI-Nspire ClickPad/TouchPad while trying to update the Boot2 from 1.4 to 3.0.1, but the problem was random.

Here, with TI-Nspire ClickPad DVT prototypes there is no randomness anymore.
Title: Re: Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
Post by: DJ Omnimaga on October 26, 2013, 10:40:11 am
Quote from: Lionel Debroux on October 26, 2013, 07:45:39 am
2.0.1188 probably did, but 3.0.1.1753 did at a far wider scale.
actually it was 2.0.0, not 2.0.1. Thankfully TI removed 3.0.1 until 3.0.2 was out to limit damage. I worry that they might not always be so fast with a future update. X.x