Author Topic: The 1st step into CAS+ flashing (Read 25697 times)

critor · « **Reply #45 on:** March 22, 2011, 03:51:17 pm »

Ok, so the CAS+ RSA keys are different, which means:
- we can't flash a boot2
- we can't flash a diags (I've never seen any diags on a CAS+)
- we can't flash an OS
- we can't run a test image

Moreover, we can't access the whole filesystem through the USB driver.
(seems we only have access to a virtual drive, which just links to 2 "safe" folders: /documents and /phoenix/tmp ).

Well... The CAS+ seems much more closed than the final TI-Nspire.

I've tried to send an OS with "exploit1" in RS232, and I've added the header this time.
Here's what I got:

Code: [Select]

Loading Operating System...

Error loading OS image. Removing OS remnants.
Deleting file [/phoenix/manuf.dat]
Removing directory [/phoenix/install/]

Waiting for OS download.
Starting Connectivity services.
USB Download is enabled.
Press <Enter> to download through the serial port.
phoenix dhcp server w/ VOODOO  built 12-Jul-2006 (start at 832)


phoenix enum server  built 12-Jul-2006


phoenix dhcp hook fwd w/ VOODOO  built 12-Jul-2006 (start at 832)


phoenix file mgt server  built 12-Jul-2006 (start at 932)

pn-srv2-636: pol_init = -1
Checking battery level.
Battery level is OK.
TI_OS_INSTALL_PRECHECK (5)
TI_OS_INSTALL_VERIFYING_IMAGE (10)
TI_OS_INSTALL_VERIFYING_RESOURCE (95)
Deleting file [/tmp/manifest_img]
Deleting file [/tmp/phoenix.img]
TI_OS_INSTALL_FAILED
  TI_OS_INSTALL_MANIFEST_INVALID

Seems the CAS+ absolutely wants a manifest file.

On my oldest orange-blue CAS+ (OS 1.0.1.0.334T), that file was just named "manifest" and did only include the name of another file: "devfiletree.zip".
But it may be different on production CAS+. According to several logs, the /phoenix/install files are using different names...

Any idea on how to generate a TNC file which would at least pass the "precheck" of the CAS+?
Maybe a look at the TI-Nspire Computer Link 1.0 Java code can be usefull:
http://ti.bank.free.fr/index.php?mod=archives&ac=voir&id=1439
It does some checking on the TNC file too, prior to sending it.

jnesselr · « **Reply #46 on:** March 22, 2011, 04:07:24 pm »

So do we have the public key, though?

critor · « **Reply #47 on:** March 22, 2011, 04:09:48 pm »

Quote from: graphmastur on March 22, 2011, 04:07:24 pm

So do we have the public key, though?

No, because it's not dumped yet.
We're trying to dump...

Goplat · « **Reply #48 on:** March 22, 2011, 06:58:10 pm »

Quote from: critor on March 22, 2011, 03:51:17 pm

Any idea on how to generate a TNC file which would at least pass the "precheck" of the CAS+?

It looks like the two parts of an rs232-sent OS are saved to /tmp/manifest_img and /tmp/phoenix.img. So a good guess would be that a CAS+ .tnc file is a zip file containing a manifest_img file and a phoenix.img file. phoenix.img is probably the equivalent of TI-Nspire.img in the released TI-Nspire.

On another note, I did a little reverse engineering of pn-net.dll. It connects to a CAS+ on TCP port 10001, and the protocol is text based. You could probably use a telnet-type program to communicate with the CAS+ manually. The "info 1" command gets some information about the calculator; the command to list a directory is "dir directoryname". Might be worth seeing if you can access more of the filesystem this way than by using Computer Link.

critor · « **Reply #49 on:** March 22, 2011, 07:38:12 pm »

On another note, I've got a strange key combo for the TI-Nspire CAS+:
Menu+Esc

The calculator just does not turn on and can't be turned on.
I have to remove the batteries.

Maybe the combo to launch the diagnostic software, which is not included in the CAS+?

Strangely, with Esc+Menu+Joypad, the calculator does turn on...

Goplat · « **Reply #50 on:** March 22, 2011, 07:42:13 pm »

Quote from: critor on March 22, 2011, 07:38:12 pm

Maybe the combo to launch the diagnostic software, which is not included in the CAS+?

The RS232 log should tell if that's what it is.

critor · « **Reply #51 on:** March 22, 2011, 07:43:10 pm »

Allready tried -> nothing...

critor · « **Reply #52 on:** March 22, 2011, 08:07:58 pm »

Quote from: Goplat on March 22, 2011, 06:58:10 pm

On another note, I did a little reverse engineering of pn-net.dll. It connects to a CAS+ on TCP port 10001, and the protocol is text based. You could probably use a telnet-type program to communicate with the CAS+ manually. The "info 1" command gets some information about the calculator; the command to list a directory is "dir directoryname". Might be worth seeing if you can access more of the filesystem this way than by using Computer Link.

Very interesting.
Just tried this.

I plugged a production CAS+ and my "Texas Instrument" network interface got the IP 172.16.50.25 (this is the IP of my computer on the "CAS+" network).
Seems the Nspire CAS+ was using the IP 172.16.50.26.

Here is what "info 1" is printing with the production CAS+ (boot1/boot2 1.0.526 + OS 1.0.554)

Code: [Select]

0
 addr=2886742554
                mask=4294967292
                               b1v=01,00,02,14
                                              b2v=01,00,02,14
                                                             bat=0,3,0,0,0,0,0,0

clk=78
      disk=29188096,22750208,4294967295
                                       eid=0C0FE480C1986857BA3
                                                              hwv=00,00,00,192
                                                                              na
me=phoenix
          ram=0,0,20971760
                          ready=32864,0
                                       run=3
                                            scrn=38400
                                                      ser=254,72,12,25,00,00,00,
00
  sgeo=240,320,4,0
                  ver=01,00,02,42

Anything interesting?

Unfortunately, the "dir" command doesn't seem to show anything more than the usual TI-Nspire Computer Link "virtual" drive:
/
/phx
/phx/documents
/phx/tmp

We don't have access to the real file system...
(I wonder why TI didn't keep things like that for the final Nspire...)

Edit: the protocol doesn't seem to unstand special folders like ".", "..", or "~".

Edit2: retried with my developer CAS+ (Boot1/2 1.0.491 + OS 1.0.494)

Code: [Select]

0
 addr=2886748730
                mask=4294967292
                               b1v=01,00,01,235
                                               b2v=01,00,01,235
                                                               bat=0,0,0,0,0,0,0
,0
  clk=78
        disk=29188096,23237632,4294967295
                                         eid=0C039C11C25D761EEFE
                                                                hwv=00,00,00,192

name=phoenix
            ram=0,0,20971760
                            ready=32864,0
                                         run=3
                                              scrn=38400
                                                        ser=57,193,28,37,00,00,0
0,00
    sgeo=240,320,4,0
                    ver=01,00,01,238

This time, the computer got the IP 172.16.74.58 and the CAS+ 172.16.74.59.

bsl · « **Reply #53 on:** March 23, 2011, 01:39:21 am »

Now that you have deleted the OS off one calculator,
USB connect two CAS+ together, reboot the one without the OS.
Does this now activate the Send OS selection ?
Monitor the RS232 traffic while doing this.

If this works , then you can tap into USB to dump the OS.

critor · « **Reply #54 on:** March 23, 2011, 06:41:22 am »

No, the "Send OS" remains disabled.
Anyway, it is enabled on my two oldest CAS+ and seems to do nothing.

garbage · « **Reply #55 on:** March 23, 2011, 07:02:40 am »

Hi. I've been following thist thread ever since it exists and I want to say that keep up with good work. I also have a CAS + and I deleted the OS before I read what the diag key combination actually do.

I also tried to "hack" into my CAS+ but I have none experience with hacking nor the knowledge to do that. All I've done is connect my computer and calculator with USB cable and use TI-Nspire Computer Link to acces files on my cas. Meanwile doing so, I captured TCP and UDP packets and came across following commands:
   - fput
   - fget
   - fdel
   - info 1
   - dir
   - attrib
   - mkdir
   - scrn 1 0 38400.

Edit: another command: - copy (when you move file from one folder to another in computer link software)

Btw, sorry for my English cause it's kinda rusty $:-\$

critor · « **Reply #56 on:** March 23, 2011, 07:04:41 am »

Great! Thank you very much for the list of commands

garbage · « **Reply #57 on:** March 23, 2011, 07:07:43 am »

Quote from: critor on March 23, 2011, 07:04:41 am

Great! Thank you very much for the list of commands

Np... If there is anything else I can do just say.

critor · « **Reply #58 on:** March 23, 2011, 10:30:07 am »

Some more "TI-Nspire Computer Links" CAS+ commands:

info %d ("%d" must be "1")
stat %d (seems to work with "1" or "3" as "%d")
tune %d%s rtime=%lu xtime=%lu (seems to work with "1" or "2" as "%d")
scrn %d %lu %d ("%d" must be "1", "%lu" seems to be the start, and "%d" the size)

mkdir %s
rmdir %s
dir %s
attr %s
fdel %s

fget %s %u ("%u" seems to be the size)
fput %s %ld %u

copy %s %s
move %s %s
osupg %s %s (probably manifest + image files)

All "%s" pathes seems relative to the virtual drive.
/ and /phx directories seems write protected. No file can be added, and the content can't be removed.

DJ Omnimaga · « **Reply #59 on:** March 23, 2011, 02:24:28 pm »

I don't understand anything there, being illiterate about that stuff, but I'm glad to see some progress into attempting hacking the CAS+ prototypes. Also welcome to our new forum member above.

Author Topic: The 1st step into CAS+ flashing (Read 25697 times)

critor

Re: The 1st step into CAS+ flashing

jnesselr

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

Goplat

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

Goplat

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

bsl

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

garbage

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

garbage

Re: The 1st step into CAS+ flashing

critor

Re: The 1st step into CAS+ flashing

DJ Omnimaga

Re: The 1st step into CAS+ flashing