516 replies to this topic

[SopaXorzTaker]

The following list was written by user202729 and serves as the guide to this forum thread.

 

 

 

Tutorial about ROP.

Javascript code to help with writing hackstring.

Character map image. Alternative version. Also available in the Javascript code above.

Scrolling text demonstration with video.

Calculator font.

How to enter a hackstring (991ES+) (less detailed version)

Hackstring used to dump the ROM. No longer needed now as we already have the ROM.

Datasheet contains some information about the hardware.

Hardware description: Part 1, part 2.

  * KI/KO ports (keyboard).
  * Timer: Part 1, part 2.
  * LCD screen.

Variable byte representation (no English translation this time).


High-level functions:

  * getkey

There are some outdated information about "real address" and "emulator address". Now we had the real ROM of the calculator that is not necessary.

Edited by SopaXorzTaker, 28 February 2018 - 02:22 PM.
Add user202729's markdown version

[SopaXorzTaker]

More information on the chipset can be seen at the bottom of this service manual PDF for the CFX-9805g plus where it shows the schematics and pinouts of the CPU and some other stuff. The download button will say "..Processing.." you have to wait about 60 seconds before it will say Download Now.

http://elektrotanya....f/download.html

The CPU may still be a different chip (but the same architecture), as the LCD controller and RAM are integrated now.

Edited by SopaXorzTaker, 21 August 2016 - 05:42 PM.

[frankmar98]

Interesting to know that fx-82 ES plus and fx-991ES plus are SuperH architecture

 

 

I am a fx-82 ES Plus owner, if you want me to test something in the calc, please, tell me. (Now, I'm in holidays)

[SopaXorzTaker]

Here's a photo of the circuit board inside my fx-991ES:

 

 

There are lots of test points, I could try attaching a logic analyzer and recording the signals later.

Edited by SopaXorzTaker, 21 August 2016 - 05:57 PM.

[SopaXorzTaker]

Interesting are P156-P159 which seem to be some kind of a debug port. Also, note the vertical row of three contact points near P101. These don't go anywhere else, which suggests that they might be reserved for testing.

Edited by SopaXorzTaker, 21 August 2016 - 06:06 PM.

[SopaXorzTaker]

My 83GT Plus board looks identical to that apart from the solar panel (its a battery only model)
Here is the board of my FX-83GT Plus

Note how P101 is solder-bridged on your board. I guess that's a configuration jumper that changes some functionality. Maybe has to do something with the lack of a solar battery?

[SopaXorzTaker]

The HCD62121 has only 120 pins, while the test points are numbered to approximately 170. This may suggest of a higher pin count.

[SopaXorzTaker]

that probably suggests different chip but same architecture and functions and maybe similar pin layout

Yes, as I have noted.

[SopaXorzTaker]

As per the character table, the characters

Vm +

create two bytes (40 2b) which correspond to instruction 0100000000101011, which is jmp R0 (register number highlighted)

 

This can be used to create hackstrings with "r".

Edited by SopaXorzTaker, 21 August 2016 - 06:37 PM.

[SopaXorzTaker]

In this table, we have the characters on bytes 00-D7. This allows for embedding some instructions into the hackstrings if we figure how exactly are the strings executed.

[SopaXorzTaker]

8B (Ans) that is used in the hackstrings is BF label, jumping to the address in the following byte.

r itself is 9D or 1001 1101 in binary, but what would it point to in the instruction set? I'm not sure

 

 

 

 

mov.w @(disp,PC),Rn

 

N being 13 (dec) in this case. No idea what disp is though.

EDIT: disp is the effective base address. Try clicking the instruction mnemonic names in that table to reveal detailed descriptions.

Edited by SopaXorzTaker, 21 August 2016 - 06:53 PM.

[SopaXorzTaker]

theres a segment on the LCD for disp
Also on the non-plus models, if you press equals on r, it does the shutdown where the casio logo appears. Not sure what it does by itself on the plus models

No, disp is here meant to be "effective address". Hm, must be an abbreviation.

[SopaXorzTaker]

@kaikun97, could you try entering the following hackstring, please?

(Vm+(Vm+(Vm+(Vm+(AnsAnsr

The Vm character can be found in the CONST menu (constant #26).

Edited by SopaXorzTaker, 21 August 2016 - 07:00 PM.

[SopaXorzTaker]

Also 9D is for 1001 1101 but the instruction you mentioned was 1001nnnndddddddd so what about the 1101 part?

n = 1101(bin) = 13(dec)

It means that R13 is used by the instruction. AFAIK there are sixteen 16-bit registers.

Edited by SopaXorzTaker, 21 August 2016 - 07:04 PM.

[SopaXorzTaker]

Oh, so then please try this one:

(E+(E+(E+(E+(AnsAnsr

This yields bytes 45 2b, means jmp R5

E as in the ALPHA mode.

[SopaXorzTaker]

By the way, SuperH may not be the exact instruction set used. HCD62121's set significantly differs.

Let's try using its instructions too.

[SopaXorzTaker]

By the way, the Hitachi instruction set does not look like SuperH in some aspects. Could you try executing the following sequence, please?

Sqrt(ASqrtA(SqrtA(SqrtA(AnsAnsr

A as in the ALPHA mode, Sqrt is the square root symbol with an opening brace.

[SopaXorzTaker]

Now the little A and B from the Reg menu have a weird behavoir. If you press equals on A *or* B (not together) by themselves, it doesn't give an answer its blank (not even 0) but you can add it to the A alpha memory (Shift RCL and then A) (and do the same for the little B in the B memory) and then you can go into Comp mode and access this glitch values on any other mode, I havn't been able to get different results but its corrupting something because if I press ON or turn the calculator off and back on, all the settings and memory is reset (the calculator will initialize the memory and settings if it detects abnormalities on powering on), but i'm sure theres something we can do about it. Also when you have these values into comp mode, if you do the A value to the power of the B value, the answer is ERROR (it just says ERROR in the answer area rather than a full screen error) which is strange. Also if you do that power in Table mode, it will behave weird and get partially stuck at the Step phase

It might just print "ERROR" without any other text because of the look up table where the error names are located overflowing.

Edited by SopaXorzTaker, 21 August 2016 - 07:36 PM.

[SopaXorzTaker]

Idea: try using the hackstrings with those a and b instead of r. It might work.

[SopaXorzTaker]

I did but it displays Math Error. The A and B things only work if they are by themselves, but if I put other stuff with it it will say Math error, I am not sure why.

On the charcter map, the Little A is 9A and the little B is 9B if that helps

Try also using x and y with hats (those weird characters)

Also, the sequences for Ans and r do not match up with Hitachi instructions. No idea why, they do match to the SuperH ones though.

[SopaXorzTaker]

They have the same effect as r where it freezes

they correspond to 89 and 8A respectively

89 is jump A24, as per Hitachi.

8A is call A16.

 

This means jumping to address contained in the next two (16) or three (24) bytes.

It *may* explain some of the glitches encountered, though I don't know what r and Ans do, as they correspond to undefined instructions.

Hm, maybe crafting hackstrings is possible using this method. Let's try:

(x(((x(((x(((x(((AnsAns

Where x is that X character with a hat.

 

Corresponds to jmp 0x282828 (Hitachi), which might do something.

By the way, this Baidu Tieba thread shows some weird firmware running on a calculator. Any ideas?

Edited by SopaXorzTaker, 22 August 2016 - 05:42 AM.

[SopaXorzTaker]

Now the little A and B from the Reg menu have a weird behavoir. If you press equals on A *or* B (not together) by themselves, it doesn't give an answer its blank (not even 0) but you can add it to the A alpha memory (Shift RCL and then A) (and do the same for the little B in the B memory) and then you can go into Comp mode and access this glitch values on any other mode, I havn't been able to get different results but its corrupting something because if I press ON or turn the calculator off and back on, all the settings and memory is reset (the calculator will initialize the memory and settings if it detects abnormalities on powering on), but i'm sure theres something we can do about it. Also when you have these values into comp mode, if you do the A value to the power of the B value, the answer is ERROR (it just says ERROR in the answer area rather than a full screen error) which is strange. Also if you do that power in Table mode, it will behave weird and get partially stuck at the Step phase

That's interesting. I guess that a and b have some special values. Maybe we can try further abusing them? And by the way, my calculator just crashes when I try to store them, it shuts itself down and resets the settings.

[SopaXorzTaker]

Interesting to know that fx-82 ES plus and fx-991ES plus are SuperH architecture

I am a fx-82 ES Plus owner, if you want me to test something in the calc, please, tell me. (Now, I'm in holidays)

Can you please take your calculator apart (if you do it carefully, it won't break) by unscrewing the screws on the back and opening the case?

If you can, please photograph the circuit board inside. This may help in our research.

 

You can also test the hackstrings which we were discussing above.

Edited by SopaXorzTaker, 22 August 2016 - 06:27 AM.

[SopaXorzTaker]

I made a mistake. Its 65 and 66 for the x and y with hat. 89 and 8A are for the X and Y with a line above, not tha hat above my mistake. We need to look at hex 65 and 66

Oh yeah. Maybe try that sequence then?

5Sqrt(5Sqrt(5Sqrt(5Sqrt(AnsAns {glitched character, one of ab, xy, r}

The Sqrt character is 0x98, which corresponds to JMP reg.

And by the way, Google translates Chinese surprisingly well 

Edited by SopaXorzTaker, 22 August 2016 - 10:06 AM.

[SopaXorzTaker]

@kaikun97 - could you please ask on cncalc.org whether they have a ROM dump for fx-82ES? That would simplify our task, as the calculators share the codebase.

[SopaXorzTaker]

Also, can you please test the glitch described here on your PLUS model?

Interestingly, if I try A on the end of that, it shows Maths error as expected. But then if I delete the A and put the X hat character (the one from the Reg menu) and press equals on the same sequence, it actually works but nothing else happens (and nothing seems to glitch). If I press equals again it this time freezes. However with r it always freezes regardless. Maybe we are getting somewhere with the X hat from reg menu

Try replacing the Sqrt with another function such as log, ln, etc.

The behavior should change. This would prove that the hackstrings are actually executed as data by the CPU.

[SopaXorzTaker]

I don't know chinese. I have looked quite a few pages back and couldnt find anything.

You can find the Emulator for the NON-plus 82ES here http://www.omnimaga....-for-version-b/

But I am not sure if the emulator just has the firmware rewritten for x86 or if it really is actually emulating an embedded ROM, I couldn't find one myself. I cannot seem to find a Plus version emulator anywhere though

I am digging into it right now. Looks interesting.

I found something!

You know the reciprocal button? The one that says x to the power of -1? Do this

I will say that button as reci
I will little A from the reg menu as just A
 

5reci(5reci(5reci(5reci(AnsAnsA

press equals
you should get math error

then press Right on the error screen and delete the A

then go to the reg menu and select the X with a hat so that is on the end instead and press equals. It will freeze but then after a few seconds, the top row will also turn off, then the calculator itself has shutdown, so this is indeed different behavoir

Also when you turn it back on, all the settings have been reset

You have to do A first otherwise it freezes without turning off

 

Looking up that character. I think it is another valid instruction.

That character is 77 hex. Hitachi instruction: sub mem(reg indirect), reg.

Probably corrupts some memory location.

I think that triggers data corruption, so the calculator hard-resets itself.

Edited by SopaXorzTaker, 22 August 2016 - 10:35 AM.

[SopaXorzTaker]

It froze when I used 1a. Hm.

The "Complete" text does not encounter anywhere in the normal menu, so must be some debugging feature. Now that's interesting.

[SopaXorzTaker]

Update: seems like the emulator unfortunately did not contain any executable code.

Edited by SopaXorzTaker, 22 August 2016 - 11:17 AM.

[SopaXorzTaker]

This this time, I pressed two for the data menu and filled some data some. Then I did the óx option from the Var menu and then put A from the reg menu. After math error I put x hat next to the óx and get syntax error. And now A is not giving me math error anymore when I put stuff before it but everything just gives answer zero with A now

The fact that you get characters with digraphs proves that there is another character codepage for text which partially goes unused.

Edited by SopaXorzTaker, 22 August 2016 - 11:24 AM.

[SopaXorzTaker]

Digraphs? Whats that? óx and óy are available in the VAR section of the menu but they give Math error unless you fill in a few X and Y values in the DATA option in the me u

Not digraphs, sorry, my mistake. I meant diacritics.

[SopaXorzTaker]

Hm, nice. What if you try putting the hackstrings into the table?

(a just crashes my fx-991ES when executed)

Edited by SopaXorzTaker, 22 August 2016 - 11:39 AM.

[SopaXorzTaker]

The emulator seems to be a packed executable. I think I found some data in it though.

[SopaXorzTaker]

Hey kaikun97!

Could you please extract the resources from the emulator's executable? I use Linux, so I am unable to.

You can use this program to do it on Windows: link.

Zip the extracted files and upload them somewhere. If the emulator actually emulates the Hitachi chip, we can find some code for it in the executable.

[SopaXorzTaker]

There are many binary blobs. If you find some of them which are a power of two bytes in size, such as 16384, 32768, one of them might be the ROM image. I will try decompiling it if you want.

Edited by SopaXorzTaker, 22 August 2016 - 12:49 PM.

[SopaXorzTaker]

Here you go http://www.mediafire...0/resources.zip

Thanks. Unfortunately, there aren't any ROM images, which suggests that only the calculator's software, not hardware is emulated.

[SopaXorzTaker]

@kaikun97, want me to test something on fx-991ES PLUS?

[SopaXorzTaker]

I don't have any ideas. You tried the thing I tried to get that barcode screen but you said it crashed for you might. My 83GT Plus has VerG firmware and yours has VerE firmware im not sure if that is making the difference

Yeah, almost every use of glitch characters crashes it. However there are exceptions.

[SopaXorzTaker]

Also, typing in a or b makes the cursor a small dash instead of a vertical line.

[SopaXorzTaker]

By the way, I found that pressing ON unfreezes the calc.

Edited by SopaXorzTaker, 22 August 2016 - 01:43 PM.