Author Topic: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes  (Read 3991 times)

0 Members and 1 Guest are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« on: October 25, 2013, 11:57:15 am »
My deepest sympathy to the Omnimaga team.


There are two types of TI-Nspire calculators:
  • CAS models which return expressions you can transform: TI-Nspire CAS+, TI-Nspire CAS , TI-Nspire CX CAS , TI-Nspire CM CAS...
  • non-CAS models which simply return numbers like any normal calculator: TI-Nspire+, TI-Nspire , TI-Nspire CX, TI-Nspire CM...
Some exams in some countries (United States, Portugal...) forbid the use of CAS calculators. That's why TI has split the TI-Nspire handhels in two sister lines. It is obvious that you can't (at least officially) install a CAS OS on a non-CAS calculator and vice versa.

In the hardware, the difference between CAS and non-CAS is using two separate chips:
  • the NAND chip
  • the ASIC chip
Each of these chips contains a code identifying the calculator as CAS or non-CAS, and these codes are verified and compared at various times:
  • by the Boot2 when a new OS is being received and installed
  • by the Boot2 each time the OS is being launched
  • by the installed OS when a new OS is being received and installed
However Nlaunch, the third party OS launcher released last year exploits a flaw in the Boot2 1.4 to remove the first two checks above, letting you install and run any TI-Nspire OS, and among other CAS OSes on non-CAS calculators.

Intended or not, this attack against the TI business model seems to have greatly displeased. For the the last few months, we've been stroke on all sides by a number of new various protections on the new hardware and software versions of the TI-Nspire.

In a Previous news, we just spotted a new additional protection in the new TI-Nspire OS 3.6 . Indeed, if the CAS version is installed on non-CAS calculator with the help of Nlaunch, the OS just freezes upon startup on the grey screen. So it seems now that once launched, the OS checks the CAS / non-CAS codes one more time in the NAND and ASIC chips.



And what happens when a worker doesn't fully conform to the original plan of the architect-engineer? Quite often the building finally collapses...

With all these protections systematically added around mindlessly (aparently) in the last months and violating the original security model, I was fearing that TI might en up bricking some TI-Nspire... and unfortunately, I was right! >:(




Before the release of the first TI-Nspire, the TI-Nspire ClickPad for back to school 2007, Texas Instruments freely distributed numbers of prototypes during the 2006-2007 schoolyear. I do not know what their lucky owners told TI, but I guess they didn'r really appreciate the gift as many of them rushed to resell it online after the release of TI-Nspire, but of course with a price similar to the production models one. A trained eye will notice several small differences, but the only one common to all prototypes is the mention of an 'EVT', 'DVT' or 'PVT' code in the serial number on the back. >:(

Until the release of color TI-Nspire CX for back to school 2011, online resale shops have been flooded with prototypes apparently very similar with the production models. But even if we put aside the dubious morality of this behaviour, it was nothing more than a monstrous scam! Indeed, prototypes Boot1 and Boot2 validated the signatures with the development keys and not the production ones. As a result:
  • These prototypes refused to install any OS released on the official TI website. And As TI doesn't release development OSes it was impossible for you to update the prototypes which remained stuck on old 1.1 and 1.2 versions! >:(
  • If you had the bad idea to remove the OS via the maintenance menu, your prototype became unusable because no released OS could be installed on it! >:(
Fortunately, TI-Planet has taken this cause to heart and tried its best to repair the scams you experienced.
  • We began first by recovering several functional prototypes from which we could extract some development OSes, allowing you to repair prototypes which had their OS removed! ;D
  • Then, we noticed on these prototypes that the NOR chip hosting Boot1 was not write-protected. After many months of hard work, we finally proposed you a tutorial based on a Boot1 reflashing in order to transform your TI-Nspire ClickPad DVT prototypes into production models, allowing you to finally install the latest production OSes available at ti.com! ;D
However, the ASIC chip on TI-Nspire ClickPad DVT prototypes doesn't include the non-CAS / CAS identification code. The NAND chip being flashable, a simple modification of its CAS / non-CAS code allows for example the transformation of a non-CAS prototype into a CAS one. This implies that the historical CAS / non-CAS checks are based on differences tests. The code in the ASIC chip being neither CAS nor non-CAS, the test is successful in all cases. ;D

So for months and now years, you've been able to use your TI-Nspire ClickPad DVT prototype as a production model. Unfortunately, you can't anymore. The OS 3.6 freezes at startup on all TI-Nspire ClickPad DVT prototypes, even those whose CAS / non-CAS NAND case has never been changed! :o
So it seems that the new CAS / non-CAS verification on the startup of OS 3.6 was not coded in the same way as the historical verification, using tests of equalities and not differences! In consequences, ASIC verification fails on all these prototypes since there is no CAS or non-CAS code in the ASIC! >:(

This raises some questions about the process of development. Does this error means they do not even test development versions of their new OS on TI-Nspire ClickPad / TouchPad anymore and simply generate them automatically? Or was this change intended to prevent students using six years old non-CAS prototypes turned into CAS ones during exams? It would be really extreme, but not surprising in the context of what we have been experiencing during the last months...

Do you think you simply have to reinstall an earlier version of the OS to repair your prototype? It would have been too easy... Although stuck at the grey screen, the OS 3.6 still has the malice to increase the minimum installable OS version stored in NAND... to 3.6! The only OS that you now have the right to install is the 3.6 which won't work! Your calculator is now unusable... TI just destroyed your rare TI-Nspire ClickPad DVT prototype without warning! >:(
Note that the tool Nlaunch, even if it can't make OS 3.6 work on these prototypes, has the advantage of avoiding their bricking when attempting to use OS 3.6, since it makes Boot2 ignore the minimum installable OS version programmed in NAND.



In addition to the ones you may have purchased online, TI-Planet distributed many of its TI-Nspire ClickPad DVT prototypes, either to developers or to contests winners, and so we have to warn you:
DO NOT INSTALL OS 3.6 ON A TI-NSPIRE CLICKPAD DVT PROTOTYPE - STAY WITH OS 3.2 OR OLDER
There is so far no way to use the OS 3.6 on these prototypes; it is useless to try, even with Nlaunch.


If it's already too late for you, the general idea to ​​repair follows the pattern below:
  • if your boot2 is 3.0.1, reflash Boot2 1.4 using an external RS232 interface
  • remove the minimum installable OS version using the DowngradeFix tool
Feel free to answer in the TI-Planet topic if needed - we'll try to help everybody.



Let's hope that the TI- Nspire ClickPad DVT prototypes will remain the only victims of the new Texas Instruments behaviour, but it's not impossible to find other similar cases, as a security model designed 6 years ago was suddenly changed. >:(


Source:
http://tiplanet.org/forum/viewtopic.php?t=13280&p=151025&lang=en
« Last Edit: October 25, 2013, 07:14:16 pm by critor »
TI-Planet co-admin.

Offline DJ Omnimaga

  • Now active at https://codewalr.us
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55821
  • Rating: +3151/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • DJ Omnimaga Music
Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #1 on: October 25, 2013, 04:31:00 pm »
I think TI just decided to not support those prototypes and the unfortunate buyers who got them by mistake. It sucks for these people, although I guess I can understand TI for not supporting unnoficial models. On the other hand, it's kinda irritating considering the hard work you put to help people who couldn't upgrade their prototypes.
In case you are wondering where I went, I left Omni back in 2015 to form CodeWalrus due to various reasons explained back then, but I stopped calc dev in 2016 and am now mostly active on the CW Discord server at https://discord.gg/cuZcfcF


Bandcamp|Reverbnation|Facebook|Youtube|Twitter

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #2 on: October 25, 2013, 07:30:24 pm »
I'm not sure at all that TI did this on purpose.

Here is according to me the algorithm which is run by the Boot2 and the OS upon the reception-installation of a new OS, and by the Boot2 each time it launches the installed OS:
Code: [Select]
if (OS=CAS and NAND=CAS and ASIC≠non-CAS) or
(OS=non-CAS and NAND=non-CAS and ASIC≠CAS)
then
installs / launches OS
else
rejects / uninstalls the OS
endif
On TI-Nspire ClickPad DVT prototypes, as ASIC chips don't include the CAS / non-CAS codes both differences work in all cases and the test only depends upon the type of the OS to install / launch and the CAS / non-CAS code in the reflashable NAND chip, allowing an easy mod of such non-CAS prototypes into CAS ones by just reflashing the NAND.

Those differences tests may not seem natural to you, but as it's assembly code testing less than 5 bits they don't surprise me.

Based on my tests, here is the new different algorithm which is run by OS 3.6 each time it starts:
Code: [Select]
if (OS=CAS and NAND=CAS and ASIC=CAS ) or
(OS=non-CAS and NAND=non-CAS and ASIC=non-CAS)
then
installs / launches OS
else
freezes OS
endif
This time , as the TI-Nspire ClickPad DVT prototypes ASIC chip doesn't include the CAS / non-CAS codes, both equalities fail in all cases and you can't run OS 3.6.

To my advice, the guy at TI just quickly coded what seemed natural to him, not bothering to check the real historical code in the Boot2, thus violating a security model designed by TI engineers more than 6 years ago and which was used unchanged for more than 6 years.

Such a critic change should have been made with much more care and tested on dozens of TI-Nspire models of all kinds.
It's ovious in computer science that you mustn't lightly modify the rules of a security model which was used unchanged for more than 6 years, and that it would probably have side issues on some of the many models released during that time without a full retesting of the whole TI-Nspire brand, which apparently was not performed.
« Last Edit: October 25, 2013, 07:35:26 pm by critor »
TI-Planet co-admin.

Offline DJ Omnimaga

  • Now active at https://codewalr.us
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55821
  • Rating: +3151/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • DJ Omnimaga Music
Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #3 on: October 26, 2013, 07:41:24 am »
That seems a bit scary in that case. The next thing I wonder is if they won't break compatibility with clickpads as a whole or something. It would be a big outrage in the technology world if thousands of nspires were reported bricked by an official update.
In case you are wondering where I went, I left Omni back in 2015 to form CodeWalrus due to various reasons explained back then, but I stopped calc dev in 2016 and am now mostly active on the CW Discord server at https://discord.gg/cuZcfcF


Bandcamp|Reverbnation|Facebook|Youtube|Twitter

Offline Streetwalrus

  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3820
  • Rating: +80/-8
    • View Profile
Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #4 on: October 26, 2013, 07:43:36 am »
It already happened with the 2.x upgrade IIRC.
send it

Offline Lionel Debroux

  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2135
  • Rating: +290/-45
    • View Profile
    • TI-Chess Team
Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #5 on: October 26, 2013, 07:45:39 am »
2.0.1188 probably did, but 3.0.1.1753 did at a far wider scale.
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TILP and TIEmu.
Co-admin of TI-Planet.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #6 on: October 26, 2013, 08:37:30 am »
Yes, 3.0.1.1753 bricked many production TI-Nspire ClickPad/TouchPad while trying to update the Boot2 from 1.4 to 3.0.1, but the problem was random.

Here, with TI-Nspire ClickPad DVT prototypes there is no randomness anymore.
TI-Planet co-admin.

Offline DJ Omnimaga

  • Now active at https://codewalr.us
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55821
  • Rating: +3151/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • DJ Omnimaga Music
Re: Re: Re: Warning: OS 3.6 bricks TI-Nspire ClickPad DVT prototypes
« Reply #7 on: October 26, 2013, 10:40:11 am »
2.0.1188 probably did, but 3.0.1.1753 did at a far wider scale.
actually it was 2.0.0, not 2.0.1. Thankfully TI removed 3.0.1 until 3.0.2 was out to limit damage. I worry that they might not always be so fast with a future update. X.x
In case you are wondering where I went, I left Omni back in 2015 to form CodeWalrus due to various reasons explained back then, but I stopped calc dev in 2016 and am now mostly active on the CW Discord server at https://discord.gg/cuZcfcF


Bandcamp|Reverbnation|Facebook|Youtube|Twitter