Jump to content



Photo
* * * * * 2 votes

FX-82/-83GT/-115/-991ES Hacking


  • Please log in to reply
226 replies to this topic

#1 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 06:27 PM

We with @kaikun97 are trying to find glitches on these calculator models that would allow executing arbitrary code.

 

Known so far:

  1. CFX-9850, fx-82ES, -115ES and -991ES (including the PLUS models) presumably share the same chipset architecture, with the CPU being SH-1 or SH-2 (however there are some doubts). This was deduced by looking up the forensic result (9.00000000733343) and finding that these and 10 other Casio calculators have it the same.
  2. CFX-9850 has a custom-built Hitachi HCD62121 CPU as proven by the Service Manual.
  3. There is an emulator for that CPU in MAME. See this GitHub repository.
  4. When compared to a SuperH instruction list, some instructions from the emulator match the listed ones. That probably isn't the case, as many instructions still don't.
  5. There is a bug in fx-82ES, -115ES and -991ES (including the PLUS models) which allows the user to corrupt the calculator's RAM via abruptly interrupting the process of saving data to the EEPROM, please see this thread.
  6. Perhaps crafting strings that produce arbitrary bytes is possible. See the thread linked above. Also, this character map might help.

 

If you want to help us with our research, feel free to reply!

 

UPDATE: fx-991ES's chip found! According to this forum thread at hpmuseum, the calculator uses an OKI (now Lapis Semiconductor) ML610901 chip. Need more research.

- Datasheet found! See this (Japanese) and this (English).

 

The CPU's architecture is nX-U8.

 

My fx-991ES PLUS has the following checksum:

GY455X VerE
SUM 8928 OK
Pd- Read OK
Press AC

In comparsion, kaikun97's fx-83GT PLUS says:

GY465X VerG
SUM 7A03 OK
Pd- Read OK
Press AC 

Not all calculators use the OKI chip.

You can identify the chip used in your calculator by the forensic result (see above).

Calculators based on the Hitachi HCD62121 or a similar chip have this result:    9.00000000733343.

The newer calculators based on the OKI ML610901 have this one:                      9.00000000733338.

You can find the remaining digits by subtracting 9 and multiplying the number by, say 1000000000.

 

We have an IRC channel now, click here to join. (irc.purplesurge.com #casioes)


Edited by SopaXorzTaker, 09 November 2016 - 04:26 PM.
IRC

  • flyingfisch, Viliami and user202729 like this

#2 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 06:42 PM

More information on the chipset can be seen at the bottom of this service manual PDF for the CFX-9805g plus where it shows the schematics and pinouts of the CPU and some other stuff. The download button will say "..Processing.." you have to wait about 60 seconds before it will say Download Now.

http://elektrotanya....f/download.html

The CPU may still be a different chip (but the same architecture), as the LCD controller and RAM are integrated now.


Edited by SopaXorzTaker, 21 August 2016 - 06:42 PM.


#3 frankmar98

frankmar98

    Casio Addict

  • Moderator
  • PipPipPip
  • 94 posts
  • Gender:Male
  • Location:Spain
  • Interests:Science, programming

  • Calculators:
    CFX-9970G
    HP Prime, TI-84+CE-T, TI-83+ fx-9750GII, CP-300, fx-4800p, fx-3650pII, fx-31, PB-100,fx-991 SPX, fx-82SX, fx-82

Posted 21 August 2016 - 06:47 PM

Interesting to know that fx-82 ES plus and fx-991ES plus are SuperH architecture

 

 

I am a fx-82 ES Plus owner, if you want me to test something in the calc, please, tell me. (Now, I'm in holidays)



#4 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 06:56 PM

Here's a photo of the circuit board inside my fx-991ES:

 

bS4C9RD.jpg

 

There are lots of test points, I could try attaching a logic analyzer and recording the signals later.


Edited by SopaXorzTaker, 21 August 2016 - 06:57 PM.


#5 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:04 PM

Interesting are P156-P159 which seem to be some kind of a debug port. Also, note the vertical row of three contact points near P101. These don't go anywhere else, which suggests that they might be reserved for testing.


Edited by SopaXorzTaker, 21 August 2016 - 07:06 PM.


#6 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:11 PM

My 83GT Plus board looks identical to that apart from the solar panel (its a battery only model)
Here is the board of my FX-83GT Plus
D3vyr57.jpg

Note how P101 is solder-bridged on your board. I guess that's a configuration jumper that changes some functionality. Maybe has to do something with the lack of a solar battery?



#7 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:16 PM

The HCD62121 has only 120 pins, while the test points are numbered to approximately 170. This may suggest of a higher pin count.



#8 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:20 PM

that probably suggests different chip but same architecture and functions and maybe similar pin layout

Yes, as I have noted.



#9 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:36 PM

As per the character table, the characters

Vm +

create two bytes (40 2b) which correspond to instruction 0100000000101011, which is jmp R0 (register number highlighted)

 

This can be used to create hackstrings with "r".


Edited by SopaXorzTaker, 21 August 2016 - 07:37 PM.


#10 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:43 PM

In this table, we have the characters on bytes 00-D7. This allows for embedding some instructions into the hackstrings if we figure how exactly are the strings executed.



#11 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:51 PM

8B (Ans) that is used in the hackstrings is BF label, jumping to the address in the following byte.


r itself is 9D or 1001 1101 in binary, but what would it point to in the instruction set? I'm not sure

 

 

 

 

mov.w @(disp,PC),Rn

 

N being 13 (dec) in this case. No idea what disp is though.

EDIT: disp is the effective base address. Try clicking the instruction mnemonic names in that table to reveal detailed descriptions.


Edited by SopaXorzTaker, 21 August 2016 - 07:53 PM.


#12 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:54 PM

theres a segment on the LCD for disp
Also on the non-plus models, if you press equals on r, it does the shutdown where the casio logo appears. Not sure what it does by itself on the plus models

No, disp is here meant to be "effective address". Hm, must be an abbreviation.



#13 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 07:59 PM

@kaikun97, could you try entering the following hackstring, please?

(Vm+(Vm+(Vm+(Vm+(AnsAnsr

The Vm character can be found in the CONST menu (constant #26).


Edited by SopaXorzTaker, 21 August 2016 - 08:00 PM.


#14 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:03 PM

Also 9D is for 1001 1101 but the instruction you mentioned was 1001nnnndddddddd so what about the 1101 part?

n = 1101(bin) = 13(dec)

It means that R13 is used by the instruction. AFAIK there are sixteen 16-bit registers.


Edited by SopaXorzTaker, 21 August 2016 - 08:04 PM.


#15 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:12 PM

Oh, so then please try this one:

(E+(E+(E+(E+(AnsAnsr

This yields bytes 45 2b, means jmp R5

E as in the ALPHA mode.



#16 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:23 PM

By the way, SuperH may not be the exact instruction set used. HCD62121's set significantly differs.

Let's try using its instructions too.



#17 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:33 PM

By the way, the Hitachi instruction set does not look like SuperH in some aspects. Could you try executing the following sequence, please?

Sqrt(ASqrtA(SqrtA(SqrtA(AnsAnsr

A as in the ALPHA mode, Sqrt is the square root symbol with an opening brace.



#18 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:36 PM

Now the little A and B from the Reg menu have a weird behavoir. If you press equals on A *or* B (not together) by themselves, it doesn't give an answer its blank (not even 0) but you can add it to the A alpha memory (Shift RCL and then A) (and do the same for the little B in the B memory) and then you can go into Comp mode and access this glitch values on any other mode, I havn't been able to get different results but its corrupting something because if I press ON or turn the calculator off and back on, all the settings and memory is reset (the calculator will initialize the memory and settings if it detects abnormalities on powering on), but i'm sure theres something we can do about it. Also when you have these values into comp mode, if you do the A value to the power of the B value, the answer is ERROR (it just says ERROR in the answer area rather than a full screen error) which is strange. Also if you do that power in Table mode, it will behave weird and get partially stuck at the Step phase

It might just print "ERROR" without any other text because of the look up table where the error names are located overflowing.


Edited by SopaXorzTaker, 21 August 2016 - 08:36 PM.


#19 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:39 PM

Idea: try using the hackstrings with those a and b instead of r. It might work.



#20 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 21 August 2016 - 08:45 PM

I did but it displays Math Error. The A and B things only work if they are by themselves, but if I put other stuff with it it will say Math error, I am not sure why.

On the charcter map, the Little A is 9A and the little B is 9B if that helps

Try also using x and y with hats (those weird characters)


Also, the sequences for Ans and r do not match up with Hitachi instructions. No idea why, they do match to the SuperH ones though.



#21 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 06:45 AM

They have the same effect as r where it freezes

they correspond to 89 and 8A respectively

89 is jump A24, as per Hitachi.

8A is call A16.

 

This means jumping to address contained in the next two (16) or three (24) bytes.

It *may* explain some of the glitches encountered, though I don't know what r and Ans do, as they correspond to undefined instructions.

Hm, maybe crafting hackstrings is possible using this method. Let's try:

(x(((x(((x(((x(((AnsAns

Where x is that X character with a hat.

 

Corresponds to jmp 0x282828 (Hitachi), which might do something.


By the way, this Baidu Tieba thread shows some weird firmware running on a calculator. Any ideas?


Edited by SopaXorzTaker, 22 August 2016 - 06:42 AM.


#22 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 07:04 AM

Now the little A and B from the Reg menu have a weird behavoir. If you press equals on A *or* B (not together) by themselves, it doesn't give an answer its blank (not even 0) but you can add it to the A alpha memory (Shift RCL and then A) (and do the same for the little B in the B memory) and then you can go into Comp mode and access this glitch values on any other mode, I havn't been able to get different results but its corrupting something because if I press ON or turn the calculator off and back on, all the settings and memory is reset (the calculator will initialize the memory and settings if it detects abnormalities on powering on), but i'm sure theres something we can do about it. Also when you have these values into comp mode, if you do the A value to the power of the B value, the answer is ERROR (it just says ERROR in the answer area rather than a full screen error) which is strange. Also if you do that power in Table mode, it will behave weird and get partially stuck at the Step phase

That's interesting. I guess that a and b have some special values. Maybe we can try further abusing them? And by the way, my calculator just crashes when I try to store them, it shuts itself down and resets the settings.



#23 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 07:27 AM

Interesting to know that fx-82 ES plus and fx-991ES plus are SuperH architecture

I am a fx-82 ES Plus owner, if you want me to test something in the calc, please, tell me. (Now, I'm in holidays)

Can you please take your calculator apart (if you do it carefully, it won't break) by unscrewing the screws on the back and opening the case?

If you can, please photograph the circuit board inside. This may help in our research.

 

You can also test the hackstrings which we were discussing above.


Edited by SopaXorzTaker, 22 August 2016 - 07:27 AM.


#24 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 11:06 AM

I made a mistake. Its 65 and 66 for the x and y with hat. 89 and 8A are for the X and Y with a line above, not tha hat above my mistake. We need to look at hex 65 and 66

Oh yeah. Maybe try that sequence then?

5Sqrt(5Sqrt(5Sqrt(5Sqrt(AnsAns {glitched character, one of ab, xy, r}

The Sqrt character is 0x98, which corresponds to JMP reg.


And by the way, Google translates Chinese surprisingly well  :rolleyes:


Edited by SopaXorzTaker, 22 August 2016 - 11:06 AM.


#25 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 11:12 AM

@kaikun97 - could you please ask on cncalc.org whether they have a ROM dump for fx-82ES? That would simplify our task, as the calculators share the codebase.



#26 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 11:16 AM

Also, can you please test the glitch described here on your PLUS model?


Interestingly, if I try A on the end of that, it shows Maths error as expected. But then if I delete the A and put the X hat character (the one from the Reg menu) and press equals on the same sequence, it actually works but nothing else happens (and nothing seems to glitch). If I press equals again it this time freezes. However with r it always freezes regardless. Maybe we are getting somewhere with the X hat from reg menu

Try replacing the Sqrt with another function such as log, ln, etc.

The behavior should change. This would prove that the hackstrings are actually executed as data by the CPU.



#27 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 11:35 AM

I don't know chinese. I have looked quite a few pages back and couldnt find anything.

You can find the Emulator for the NON-plus 82ES here http://www.omnimaga....-for-version-b/

But I am not sure if the emulator just has the firmware rewritten for x86 or if it really is actually emulating an embedded ROM, I couldn't find one myself. I cannot seem to find a Plus version emulator anywhere though

I am digging into it right now. Looks interesting.


I found something!

You know the reciprocal button? The one that says x to the power of -1? Do this

I will say that button as reci
I will little A from the reg menu as just A
 

5reci(5reci(5reci(5reci(AnsAnsA
press equals
you should get math error

then press Right on the error screen and delete the A

then go to the reg menu and select the X with a hat so that is on the end instead and press equals. It will freeze but then after a few seconds, the top row will also turn off, then the calculator itself has shutdown, so this is indeed different behavoir

Also when you turn it back on, all the settings have been reset

You have to do A first otherwise it freezes without turning off

 

Looking up that character. I think it is another valid instruction.


That character is 77 hex. Hitachi instruction: sub mem(reg indirect), reg.

Probably corrupts some memory location.


I think that triggers data corruption, so the calculator hard-resets itself.


Edited by SopaXorzTaker, 22 August 2016 - 11:35 AM.


#28 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:04 PM

It froze when I used 1a. Hm.

The "Complete" text does not encounter anywhere in the normal menu, so must be some debugging feature. Now that's interesting.



#29 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:17 PM

Update: seems like the emulator unfortunately did not contain any executable code.


Edited by SopaXorzTaker, 22 August 2016 - 12:17 PM.


#30 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:22 PM

This this time, I pressed two for the data menu and filled some data some. Then I did the óx option from the Var menu and then put A from the reg menu. After math error I put x hat next to the óx and get syntax error. And now A is not giving me math error anymore when I put stuff before it but everything just gives answer zero with A now

The fact that you get characters with digraphs proves that there is another character codepage for text which partially goes unused.


Edited by SopaXorzTaker, 22 August 2016 - 12:24 PM.


#31 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:27 PM

Digraphs? Whats that? óx and óy are available in the VAR section of the menu but they give Math error unless you fill in a few X and Y values in the DATA option in the me u

Not digraphs, sorry, my mistake. I meant diacritics.



#32 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:38 PM

Hm, nice. What if you try putting the hackstrings into the table?

(a just crashes my fx-991ES when executed)


Edited by SopaXorzTaker, 22 August 2016 - 12:39 PM.


#33 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 12:47 PM

The emulator seems to be a packed executable. I think I found some data in it though.



#34 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 01:43 PM

Hey kaikun97!

Could you please extract the resources from the emulator's executable? I use Linux, so I am unable to.

You can use this program to do it on Windows: link.

Zip the extracted files and upload them somewhere. If the emulator actually emulates the Hitachi chip, we can find some code for it in the executable.



#35 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 01:48 PM

There are many binary blobs. If you find some of them which are a power of two bytes in size, such as 16384, 32768, one of them might be the ROM image. I will try decompiling it if you want.


Edited by SopaXorzTaker, 22 August 2016 - 01:49 PM.


#36 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 02:09 PM

Thanks. Unfortunately, there aren't any ROM images, which suggests that only the calculator's software, not hardware is emulated.



#37 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 02:18 PM

@kaikun97, want me to test something on fx-991ES PLUS?



#38 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 02:23 PM

I don't have any ideas. You tried the thing I tried to get that barcode screen but you said it crashed for you might. My 83GT Plus has VerG firmware and yours has VerE firmware im not sure if that is making the difference

Yeah, almost every use of glitch characters crashes it. However there are exceptions.



#39 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 02:36 PM

Also, typing in a or b makes the cursor a small dash instead of a vertical line.



#40 SopaXorzTaker

SopaXorzTaker

    Casio Freak

  • Moderator
  • PipPipPipPip
  • 127 posts
  • Gender:Male
  • Interests:Electronics and programming.

  • Calculators:
    fx-991ES PLUS

Posted 22 August 2016 - 02:41 PM

By the way, I found that pressing ON unfreezes the calc.


Edited by SopaXorzTaker, 22 August 2016 - 02:43 PM.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users