Here are a few more key combos:

[1]+[3]+[AC/ON] -> Reset OK? Initialize all.
- Also works under fx-9860GII OS 2.02 and 2.04 (SH-4A)

[F2]+[Up]+[AC/ON], then [9] -> User name will be deleted. OK?
- Writes an empty password file to 0x80BE0000
- Keys [F1] and [F6] are not checked
- Available since Prizm OS 1.04

[OPTN]+[EXP]+[AC/ON], then [F1] followed by [9] -> Invokes the diagnostic mode.
[OPTN]+[EXP]+[AC/ON], then 5963 or 5964 -> Invokes the test mode.
- 5963 works in all non-ClassPad OSes
- 5964 creates an SD card file containing all ROM data, then invokes the test mode
- 5964 first appeared in fx-9860G OS 1.02 and has been removed in OS 2.02 and 2.04 (SH-4A)
- As of Prizm OS 1.02, 5963 is identical to 5964
- Earlier Prizm OSes include a similar SD card routine, but it has no effect

The routine processing these key combinations also checks that the [EXE] key is not pressed.

I chose to not use FX SDK because I don't know how to include properly ASM. Do you have any good idea/methods?

You can include any asm function in a C program when you export it with a function name _FuncName

Here is a small asm-only program:

        .INCLUDE "syscall.inc"

        .MACRO SC SysCall
        mov.l   #\SysCall, r0
        mov.l   #JumpTableTop, r2
        jsr     @r2
        nop
        .ENDM

        .EXPORT _BR_Size
        .EXPORT _AddIn_main
        .SECTION P, CODE, ALIGN=4

_AddIn_main:
        SC      Bdisp_AllClr_VRAM
        mov     #5, r4                  ; col
        mov     #3, r5                  ; row
        SC      locate
        mov.l   #text, r4               ; str
        mov     #1, r5                  ; mode
        SC      Print

loop:
        mov.l   #key, r4                ; key
        SC      GetKey
        bra     loop
        nop

        rts
        nop

        .SECTION C, DATA, ALIGN=4
text        .SDATAZ "Hello, world!"

        .SECTION B, DATA, ALIGN=4
_BR_Size    .RES.L  1
key         .RES.L  1

        .END

JumpTableTop            .EQU    h'80010070

Print                   .EQU    h'013C
Bdisp_AllClr_VRAM       .EQU    h'0143
locate                  .EQU    h'0807
GetKey                  .EQU    h'090F



I had a look at a few things. Here's a small summary.

fx-9860G/GII:
The test mode is syscall 0x0924 and there is no parameter.
The diagnostic mode is syscall 0x0176 and there is no parameter.

In OS 2.02.0200, syscall 0x0176 is no longer available and returns immediately.
However, this function can be found at address 0x8002F0C4. It takes one argument R4 that skips the initial "factory use only" window and enters the diagnostic mode if it is set to zero.


fx-CG10/20:
The test mode is syscall 0x0EA7 and there is one parameter.
If the argument R4 is set to zero, the VRAM is overwritten and not restored.

The diagnostic mode is not available as a syscall.
However, in OS 2.00.0200 this function can be found at address 0x8011D054. It takes one argument R4 that skips the initial "factory use only" window and enters the diagnostic mode if it is set to zero.

Now, more importantly... are there any differences between this test mode and the one available through the syscall?

There is one branch from the "factory use only" window into the test mode with R4 set to zero. Obviously, this is what happens when you type in 5963.

And something that has kept me wondering for months and may be related to the high number of Prizms dying: is there something that permanently changes in the system as soon as the test or diagnostic modes are accessed (like, some bit set in flash)?

I did not check on this, but the test and diagnostic main menus do not seem to do any flash writing. However, there are quite a few RAM values that are read and written and I can't say if these values will be reset when leaving those menus or when rebooting the calculator.

Holy necropost, Batman!

Sounds like a bad habit... but if a topic still provides accurate information that is neither wrong nor outdated, I don't see any reason why someone should open a new topic.

Hey, I just found out how to enter the test mode without using an add-in (that is, no syscall interface needed):

1) Turn on your calculator by pressing [OPTN]+[EXP]+[AC/ON]
2) As soon as the popup window appears*, quickly type in: 5963
3) Et Voilà, the test mode shows up

And this doesn't reboot the calculator when leaving.

*) Press [F1] for the diagnostic mode.

Just a small addition:

They also added StdDev_Sigma() (Population Standard Deviation) and Variance_Sigma2() (Population Variance) in the statistics menu.
And it is now possible to solve overdetermined or underdetermined systems.

Official announcement: http://edu.casio.com/products/cg_series/fxcg10_20/
New add-in page: http://edu.casio.com/products/supportinformation/

Which one is NTSC, btw? The Casio website lists the VI-9850GA as NTSC (Japan) but I am unsure if it's a mistake or not.

It may depend on where you buy it. As both base types (CFX-9850GA PLUS and CFX-9850GB PLUS) are not the same, I don't believe that the GA is only available with a NTSC module and the GB with a PAL module.

Way back in 1995, there was the Casio CFX series which spans through a dozen of derivated models (9850G, 9850G+, 9950G, etc).

According to this, the first color fx was the CFX-9800G from 1993.
This is 10 years before the ClassPad and 20 years before the ClassPad II.