Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Jean-Baptiste Boric

Pages: 1 [2]
HP Calculators / Re: HP Prime Emulator
« on: August 12, 2017, 11:58:30 am »
I don't have access to my HP Prime right now, but I posted an UART dump here a long time ago :!/hello-everybody-22224/msg403203/#msg403203. It was with an early version of my own firmware.

From memory, the HP Prime booting process has three stages :
  • BXCBOOT0.BIN (the first 256 KiB of the NAND) : the first 8 KiB initializes the hardware and chainloads the rest of the stage, it also contains the recovery and the first splashscreen ;
  • PRIME_OS.ROM (the next 1 MiB) : this is what Rip'Em replaces ;
  • Either armfir.elf for the normal firmware, or the diagnostics utility.

An incomplete, reverse-engineered disassembly of the first 8 KiB of BXCBOOT0.BIN is available at, if that can be of help.

I can take a look at your sources if you want. I promise I won't judge :)

HP Calculators / Re: HP Prime Emulator
« on: July 31, 2017, 01:53:56 pm »
I haven't tried to create a hardware emulator yet, mostly because I'm thoroughly overworked with an internship, sysadmin freelance work and a GSoC student to mentor. I don't expect a saner workload until September. Also, my C++ is rusty and my knowledge of Qt is nil, even though Qt Creator looks slick as heck.

I did not attempt to use JTAG. I did all my debugging with the UART. I wrote a GDB stub to poke stuff around, but without interrupts it is rather limited.

About exam mode: unlike TI hardware, there is no root of trust inside the HP Prime hardware. You can always program whatever you want into the first 8 KiB of Flash and the S3C2416 will happily run it. While HP could introduce crypto checks and obfuscate things in an update, it's nothing some reverse-engineering and a soldering iron can't reverse. Fixing that hole for real would require at the very least a new hardware revision.

HP Calculators / Re: HP Prime Emulator
« on: May 09, 2017, 11:56:14 am »
I'm the author of Rip'em, one (the only?) third-party firmware for the HP Prime. My efforts stalled when flashing the calculator under Windows over and over got really old, so I am interested in a HP Prime hardware emulator. It's been a while, but I'm still probably the guy most familiar with the HP Prime hardware outside of HP.

I did not attempt to write an emulator earlier because I'm not motivated enough to make one from scratch and QEMU's source code gives me headaches. However, I've discovered the Unicorn CPU emulator by browsing your source code. That might be enough to get me started.

While I'm here: as soon as someone circumvents the exam mode, you can bet HP will lock down the bootloader in the next firmware version to put a stop to that. Please don't nuke exam mode, whether directly or indirectly.

New stuff added since last time :
  • Complete keypad support ;
  • gzip-compressed payloads ;
  • Graphical menu to select a payload to launch ;
  • Dumb integer RPN calculator demo, complete with 26 (a-z) variables.
The ability to boot the original firmware is crippled for now (only booting the diagnostic screen works).

I have now run out of simple things to implement. I can't push this thing any further without first porting a real-time operating system and making a USB GDB stub...

Just a quick update : Rip'Em can now use the LCD screen on the HP Prime. The dummy payload has been updated to take advantage of it, displaying the current time from the RTC on it.

Next goal is to figure out the keypad.

HP Calculators / Announcing Rip'Em, a third-party firmware for the HP Prime
« on: December 25, 2015, 05:09:06 am »
Ran out of presents to rip open? How about ripping open your HP Prime for science?

This is Rip'Em, a third-party firmware for the HP Prime calculator. It is a (rather primitive for now) unofficial bootloader that replaces PRIME_OS.ROM and is currently written by someone who doesn't know what he's doing.

For now, unless you can connect to the 3.3v TTL serial port inside the calculator nothing too exciting will happen.

What you can do with it for now :
  • Launch a homegrown GDB stub over serial (only suitable for poking memory and upload/run code) ;
  • Launch a single ELF file as a payload. Current payloads available are :
    • dummy.elf : A dummy payload that blinks the LEDs so you can hang your HP Prime to your Christmas tree ;
    • PRIME_OS.ROM : The official firmware can be launched using the osrom2elf tool supplied.
  • Write your own application on bare metal using the libraries supplied.

Current plans and what you can do to help :
  • Play around with Rip'Em ;
  • Use the GDB stub to figure out the hardware ;
  • Replace the homegrown GDB stub with the real stuff ;
  • Write a USB serial driver to enable the GDB stub to work over it ;
  • Add the ability to have multiple payloads, to read payloads from the FAT16 partition in PRIME_APP.DAT and to select a payload with a simple graphical user interface.

Non-goals (at least for me) :
  • Reverse-engineering, patching or otherwise tampering with the official firmware. The TODO list is already big enough to keep me busy for a long time ;
  • Bloat within RIp'Em itself. It's an ELF launcher, not a operating system. Even the GDB stub should be demoted as a payload eventually.

Source code available over at Kudos to Lionel Debroux for being the first one to run a third-party firmware on the HP Prime.

As always : please void your warranty in a responsible manner. I will decline any responsibility should you turn your HP Prime into the thinnest CAS calculator brick available currently on the market.

Introduce Yourself! / Re: Hello everybody.
« on: December 22, 2015, 03:07:54 pm »
also, have some omniamga peanuts:

Food!  :w00t:

For anyone wondering, I'm so close...  :banghead:

Code: [Select]
Init 320x240
Init 320x240 rVIDCON0=0x5270
320x240 rVIDTCON0=0x110300 rVIDTCON1=0x401100 rVIDTCON2=0x7793f rVIDCON1=0x8080
HCLK  : 133333333
PCLK  : 66666666
nandid: ad da 90 95 44
nandid: ad da 90 95 44
block size:0x20000 page size :0x800 Attr:1c03110b NandSize:256(MB)
read header...ok
has BFS header
BFS End.

1ram size :32MB
GetHWVersion:1 31

Rip'Em version 0.0.0
Current time : 2015/23/12 01:26:54

Loading payload...
Payload address : 0x30003118
Payload size : 2400 bytes
Payload stack : 0x31fffae8
Payload staging area : 0x31000000
Payload entry : 0x30000000
Loading successful, jumping into payload...
Dabort exception.

Introduce Yourself! / Re: Hello everybody.
« on: December 21, 2015, 11:09:46 am »
The link looks... interesting. :D

I bet it looks even more interesting right now :

Code: [Select]
(gdb) x/16x 0x30000000
0x30000000:     0x30000020      0x00000000      0x00100000      0x30000000
0x30000010:     0x00100000      0x004a3556      0x36313432      0x00000000
0x30000020:     0xeb000000      0xeafffffe      0xe92d4008      0xe59f000c
0x30000030:     0xeb00017f      0xe59f0008      0xeb0001cc      0xeb00012b
(gdb) set *(unsigned) 0x30000000 = 0x12345678
(gdb) x/16x 0x30000000
0x30000000:     0x12345678      0x00000000      0x00100000      0x30000000
0x30000010:     0x00100000      0x004a3556      0x36313432      0x00000000
0x30000020:     0xeb000000      0xeafffffe      0xe92d4008      0xe59f000c
0x30000030:     0xeb00017f      0xe59f0008      0xeb0001cc      0xeb00012b
(gdb) x/4x 0x56000070
0x56000070:     0x1400150a      0x00000062      0x01554050      0x00000000

I technically reached the minimum amount of features to one-up Lionel Debroux's PoC. I won't make an official announcement on the relevant board before Christmas for obvious drama and pun combo reasons, but if anyone wants to mutilate their calculator experiment with this before then :

You need a way to connect to a 3.3v TTL serial port. Open up your Prime and connect said way to UART_RX, UART_TX (right on top of the flash chip on my model) and BAT-.

On Debian, install the required cross-compiler packages (binutils-arm-none-eabi gcc-arm-none-eabi gdb-arm-none-eabi), clone the repository, use make to build everything. Prepare a terminal emulator at 115200 bauds.

On Windows, replace PRIME_OS.ROM with ripem.rom, connect the calculator to the computer (the battery isn't required - the Prime can power itself from USB), flash the new OS.

Back on Debian, check that the traditional "Hello world!" appeared on your screen. Close the terminal emulator and use arm-none-eabi-gdb to poke around.

And as always : please void your warranty in a responsible manner, I take no responsibility for whatever you did to your poor calculator.

Introduce Yourself! / Hello everybody.
« on: December 20, 2015, 06:17:02 pm »
Hi all,

I'm a French student with way, way too much time on its hands. There's about a bazillion HP calculators in my house, and I personally own a TI-82 and a HP Prime.

I'm completely new to the community, but I have a small present that should (hopefully) be ready for Christmas. After all, it was about time that someone started to rip'em apart, right?

Got it?

If not, do not spoil Christmas yourself and do not head over to Especially not before I managed to get something more useful running that the last person who did and being disappointed by the shameless hype. Also because there's no instructions yet on how to void your warranty with this because it's time for me to go to bed.

(Hint : I'm not going after armfir.elf, but rather directly for PRIME_OS.ROM).

Pages: 1 [2]