Note: This is purely for educational purposes. If these methods are used for other purposes or cheating, I am not responsible for any problems or damage caused.

In clearer words, FX82_Calc4Life and I have found a way to access a portion of Base-N mode on the fx-82AU PLUS II 2nd Generation.

The calculator normally does not have Base-N available, but this method allows us to access a portion of Base-N mode. There are also some other glitches connected to this method, especially with the SHIFT, 3 menu.

First, reset the calculator.

Press:

SHIFT, 9, 3, =, AC

Make sure you are starting from a clean state before continuing.

Go into MATH IO and enter:

POL(0,1)

Press =.

Press the division symbol.

The display should show:

Ans ÷

Enter any number after the division symbol.

Then repeatedly press:

ABS(

Keep entering ABS( until the calculator will not allow you to enter any more ABS( functions.

Press:

=, AC, ↑, AC, ←

You should now see the result from POL(0,1):

r = 1, φ₀ = 90

Delete everything except the φ₀ value.

Store the φ₀ value in any variable you want.

Now enter VERIF, which is Mode 3.

Press:

MODE, 3

Then switch to LINE IO:

SHIFT, MODE, 2

Enter the variable that you stored φ₀ into and press =.

You should get:

Math ERROR

Press the ← arrow.

Then repeatedly enter:

√Ans

For example:

√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√ ...

Keep entering √Ans until the expression wraps back around to the beginning.

This should take approximately 200–300 characters.

Once the expression has wrapped back around to where you started, press:

AC, ←

You should now see the √Ans expression that you repeatedly typed earlier.

Press = and wait approximately 5 seconds.

The calculator should display:

Stack ERROR

The following steps need to be performed fairly quickly after the error appears.

Press the ← arrow.

Immediately enter:

1

Switch back to MATH IO.

Press:

SHIFT, MODE, 1, 1

Press:

1, 1

Now enter STAT mode.

Press:

AC

Press any one of:

-

x²

x□

log(

ln(

The calculator should now be in a partially functional Base-N mode.

Unfortunately, the SHIFT, 3 menu is glitched when accessing this state.

However, the glitch is also useful because it exposes characters and functions that normally cannot be accessed.

Some of the things available through the glitched menu are also obtainable through the basic overflow methods.

For example, we have been able to access functions such as:

MatA(

MatB(

MatC(

VctA(

VctB(

VctC(

Some of these functions work, while others can crash the calculator or cause additional glitches.

Another thing we found is that pressing = after entering one of these matrix or vector values can produce a strange table-like mode.

For example:

Mat(A)

Mat(

Mat©

Mat(Ans)

and:

Vct(A)

Vct(

Vct©

Vct(Ans)

can behave differently from the normal calculator modes.

In some cases, they appear to enter a glitched table-like interface.

This was one of the first things we started posting about on the forums, so there are still parts that are not completely understood.

We have been experimenting with:

• the Base-N access method

• the glitched SHIFT, 3 menu

• illegal characters

• matrix and vector functions

• different characters around the overflow area

• different results depending on where the characters are entered

Some combinations work, some produce different glitches, and some will crash the calculator.

I'm posting this mainly so other people can reproduce the method and experiment with it too.

Feel free to correct any mistakes or add any cool discoveries you find.

There is also something important to know about turning the calculator off while experimenting.

Pressing:

SHIFT, AC

does not turn the calculator off by itself.

To turn the calculator off, press:

ON

first, then:

SHIFT, AC

The calculator also does not turn itself off after 10 minutes, so it needs to be manually turned off.

Over the course of the 1.5 years we have been experimenting with the fx-82AU PLUS II 2nd Generation, we have found multiple other hacks, including computation glitches, STAT mode glitches, and VERIF overflow glitches.

Here are some of the many hacks we have discovered.

Also, credits to EnderFire09 and DaCoolCat123 for helping make these hacks possible.

There are quite a few interesting things you can do in normal computation mode.

Instead of using POL(0,1) to get the result of r = 1 φ₀ = 90, you can enter:

0▫0▫0▫

This should produce:

0°0′0″

Divide by any number, repeatedly enter:

ABS(

Then press:

=, AC, ↑, AC, ←

You should get:

0▫0e0e

Delete everything except the e or e.

This can result in a strange syntax error where the calculator only shows:

ERROR

Repeat the same process again by dividing by any number, repeatedly entering ABS(, and using the same sequence:

=, AC, ↑, AC, ←

You should get:

Eoo÷o

This appears to represent ERROR in the calculator's internal token language.

The token information can be found here:

https://github.com/ilovecats4606/fx-82AU-PLUS-II-2nd/blob/main/tokentable.md

Me and FX82_Calc4Life are working on making a complete digital token table, including the smaller characters.

The current table is not complete yet, but we plan to post the full version once it is finished.

The o in:

Eoo÷o

represents octal.

For example:

o101 = 65

in decimal.

Enter:

1×1010

Then divide by any number and repeat the same overflow process.

You can get something like:

1m▶n mileacre▶m² mmHg▶Pa Pa▶atm

Unfortunately, the conversions themselves do not actually work.

There is another thing you can do with POL(0,1).

First switch to MATH IO:

SHIFT, MODE, 1, 1

Then enter:

POL(0,1)

and press =.

Now divide by any number and use the same ABS( overflow process.

After that, delete everything except:

r

Press:

←

to move the cursor to the left side of r.

Then press:

SHIFT, DEL

Now press the square-root key 4 times.

Press =.

Then delete the four square roots, leaving only:

r

Press = again.

This should give a strange complicated equation.

You can then divide by any number and use the same Abs( overflow method to obtain the greater-than symbol in computation mode.

Normally, the greater-than symbol is only available in VERIF.

There is also a small DISP-related glitch.

Enter:

SHIFT, MODE, ↓, 4, 2

This changes the dots to commas.

Then enter:

POL(0,1)

The result should normally be:

r=1, φ₀=90

With the DISP change, it can become:

r=1;φ₀=90

This also allows us to obtain the k by using the same ABS( overflow process.

Basic overflow can also be accessed in normal computation mode.

Press Ans, divide it by any number, and then keep stacking:

ABS(

Press = and then press the ← arrow.

The ABS( expression should now be in LINE IO format, which is useful if you want to get LINE IO formatted characters in MATH IO.

Delete everything except:

▯

Once you have the ▯, press the ← arrow once to place the cursor behind the ▯ character, then press the → arrow once.

You should now be in basic overflow in computation mode.

From here, you can keep entering fraction symbols and other functions.

Continue overflowing the expression until it wraps around to the beginning.

You can also use the VERIF basic overflow method, such as storing φ₀ or r in STAT mode Sub 0, and then spamming different characters until you start seeing the things you typed appear in computation basic overflow.

The fraction symbol, square root, and other symbols can be different in VERIF overflow because VERIF overflow uses LINE IO while normal computation can use MATH IO.

Unfortunately, we have not really found any major hackstrings in STAT mode yet, but we did find something interesting in STAT sub-mode 0.

Enter:

MODE, 2

Then press AC.

About 0.5 seconds after pressing AC, press ON.

This can be difficult to do at first, but it gets easier with practice.

If successful, you should see the STAT indicator.

You should also be able to access REG in the STAT menu with:

SHIFT, 1

If it did not work, go back to COMP mode and try again.

If successful, you are now in STAT sub-mode 0.

Enter any number that is:

• 69 or less

• not negative

• not a decimal

Then enter ! followed by either ȳ or x̄.

You can get these with:

SHIFT, 1, 5, 5

for x̄

or:

SHIFT, 1, 5, 4

for ȳ.

For example:

69!x̄/69!ȳ

This can produce a strange barcode-like pattern on the display.

Note: This may damage the screen on older calculators that have already been heavily used.

You can also experiment with the STAT functions through:

SHIFT, 1, 5

using A, B, and r.

Most combinations will crash the calculator.

There are not many VERIF hacks yet, apart from the basic overflow method.

However, there are some interesting things you can do in MATH IO.

For example, enter an equation such as:

1+1

Then press =.

The calculator should display either:

TRUE

or:

FALSE

Now divide that result by any number and use the same ABS( overflow process.

This can give you the TRUE or FALSE result in the calculator's internal language.

The VERIF overflow is more interesting.

Using VERIF overflow, we have been able to:

• dump ROM

• draw images

• access different modes supported by the calculator's chip

• produce different calculator errors

• experiment with different internal functions and characters

One of many errors we have been able to produce include:

Can't Solve

AC Break

Cursed Error Showing Random Characters

as well as other errors, including a glitched one depending on the function or pattern used.

Once you are already in basic overflow in VERIF, you can also experiment by repeatedly entering:

▫

Once you have VERIF basic overflow, repeatedly enter:

▫▫▫▫▫▫▫▫▫▫▫▫...

Keep entering it until the expression wraps around to the beginning.

After it wraps around, press:

AC, ←, =

This should produce a strange mode.

The exact result can vary depending on what was entered.

Once you are in VERIF basic overflow, you can experiment with different patterns.

For example:

▫Ans

or:

▫▫Ans

or:

▫AnsAns

or:

(-)Ans

etc.

There are many more combinations that can be tried.

The results vary a lot.

Some produce interesting glitches, while most of the other combinations will simply crash the calculator.

We have also found many other strange things using this like a cursed contrast menu and lots more.

The basic overflow method can also be reached by things such as storing r in STAT sub-mode 0, storing φ₀ in a variable, and then using the resulting overflow area.

There are still a lot of patterns we have not fully figured out yet.

There are also some interesting things that happen when using STAT sub-mode 0 and basic overflow.

If you store r in STAT sub-mode 0 and then use basic overflow, you can see the value of r represented as:

ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(

This is ref( repeated 20 times.

Once you reach the M indicator and type a bit more, you will see this same thing as with any other illegal character stored into a variable.

The same goes for φ₀, which appears as:

<-sinh(,>-F-0.<-sinh(,>-F-0.

These are representations of the illegal values when they are exposed through the overflow.

Another thing you can experiment with is the basic overflow corruption.

In basic overflow, repeatedly enter:

.Ans.Ans...

until it warps back to the beginning.

Then press:

AC, ←, =

After that, keep pressing = or ←, =.

You will slowly corrupt the calculator.

As the calculator becomes more corrupted, you will slowly see pixels appearing and overlapping the .Ans pixels represented in binary.

If you then go into COMP mode, enter an equation, and press =, you will get different results depending on how much you corrupted the calculator seeing what looks like randomly scatted pixels all across the result.

Important note: All of the hacks reset the calculator once ON is pressed, except for STAT sub-mode 0.

One of the more interesting things we found is that VERIF basic overflow can be used to replace the normal TRUE/FALSE text with custom text.

The maximum length we have found is 15 characters.

The basic idea is to replace the text that the calculator normally uses for TRUE or FALSE with tokens representing different characters.

Enter VERIF basic overflow using the general overflow method.

However, do not enter the variable yet.

First, create a string that is exactly 22 characters long:

1234567890123456789012

Then add a minus sign:

1234567890123456789012-

Press =.

You should get:

Syntax ERROR

Now clear everything and enter the variable and use the basic overflow method.

Repeatedly enter:

.Ans

For example:

.Ans.Ans.Ans.Ans.Ans.Ans.Ans...

Continue doing this until the variable from earlier appears, such as:

A=0

or the equivalent for whichever variable you used.

Continue with the same .Ans pattern until you see the 22 characters appear.

Now you need to replace the 22 characters.

Do not overwrite:

-

=

0

Only overwrite the original 22 characters.

After reaching the exact 22-character position after A=0, spam any number.

Once you have spammed characters far enough, you should eventually see a position where the characters change.

This changing position is what we use to place the text.

The calculator internally stores characters as tokens.

The token table we are currently working on is here:

Token Table

The current table is not completely accurate.

Me and FX82_Calc4Life are working on making a complete table, including the smaller characters and other characters that are harder to document.

We have already finished documenting the normal characters, while we are still figuring out the small characters, including one character that looks like a music note.

This may be difficult to document digitally because some characters are what look like strange pixels.

We will post the completed version when it is finished.

As an example, we can write:

Hi.

The hexadecimal value for H is:

48

The internal token for H is:

->B

The problem is that ->B cannot be typed directly.

We therefore need to find the closest character that can be typed.

The closest typeable character before ->B is:

F

At the changing position, overwrite the current character to F.

Every time the cursor blinks, the position advances by one token.

Since ->B is two tokens after F, wait for the blink and then press the → arrow.

Do this twice.

You should now have:

->B

Immediately press the ← arrow before the cursor blinks again and delete the character to the left of ->B.

This keeps the ->B token in place.

Another way to do this is to rapidly spam the → arrow before the cursor blinks, then press ← and delete the character behind ->B.

We also need the letter i.

The hexadecimal value of i is:

69

Its internal token is:

Σ(

The token before it is:

log(

Wait for one cursor blink, then press ← and delete the appropriate character so that:

Σ(

is preserved.

Now put it directly after:

->B

You should have:

->BΣ(

This represents:

Hi

To add the period, place:

.

after the existing tokens.

You should now have:

->BΣ(.

which represents:

Hi.

Now delete the characters in front of the text if there is any.

Move the cursor behind the first character and keep deleting until you reach the original 22-character position.

The important part is that:

->BΣ(.

must be directly after the original 22-character position from A=0.

Now we need to continue entering the .Ans pattern after the text.

The text itself needs to continue following the same .Ans pattern as if the text were not there.

The 22nd character should be Ans.

Do not overwrite the text.

You need to work out which characters are part of the pattern and which are your actual text.

For example, the pattern around the text continues according to the position the text occupies.

A simpler way to keep track of it is:

• If the text has an odd number of characters, the pattern after the text starts with Ans

• If the text has an even number of characters, the pattern after the text starts with .

So for:

Hi.

there are 3 characters, which is odd.

Therefore, after Hi. the pattern continues as:

Ans.Ans.Ans...

For an even number of characters, it would continue as:

.Ans.Ans.Ans…

Continue the same pattern until the overflow wraps around back to the beginning.

Once the overflow wraps around back to the beginning, press:

AC, ←, =

The pattern should now appear as binary data, with:

0 = off

1 = on

This is also useful later for the image-drawing method.

Finally, press:

AC

The calculator should now show:

Hi.

in the place where the normal TRUE or FALSE text would usually appear.

The basic process is:

1. Enter VERIF basic overflow.

2. Do not enter the variable yet.

3. Create a 22-character string.

4. Add - and press =.

5. Enter the variable and start the .Ans overflow.

6. Continue until A=0 or the equivalent appears.

7. Continue until the 22 characters appear.

8. Spam characters until the changing position area appears

9. Use the changing position area to place the characters to produce text.

10. Create the tokens for the text you want.

11. Move the text directly after the original 22-character position.

12. Continue the .Ans pattern around the text.

13. Let the overflow wrap around back to the beginning.

14. Press AC, ←, =.

15. Press AC.

16. The custom text should appear where TRUE or FALSE normally would.

The maximum text length we have found is 15 characters.

One other important detail is that the next character in the pattern depends on whether the text has an odd or even number of characters.

If the text has an odd number of characters, the next character starts with Ans.

If it has an even number of characters, the next part starts with ..

This is probably one of the hardest things we have found so far.

The basic idea is to convert an image into binary, then use the values from the binary data inside the VERIF overflow.

For this example, we will make a small smiley face.

Enter VERIF basic overflow using the usual method.

This time, do not create the 22-character overflow that was used for the text method.

Instead, enter the variable you stored the illegal character into and start entering:

.Ans

over and over.

For example:

.Ans.Ans.Ans.Ans.Ans.Ans...

Continue until you reach:

A=0

or the equivalent variable position.

Once you reach the A=0 position, continue using the same pattern.

The important part is that the following characters become:

A = .

= = Ans

0 = .

So the A=0 should now be replaced with:

.Ans.

For the image, use:

0 = OFF

1 = ON

Each row of the image is represented using binary.

The hexadecimal conversion table is:

0000 = 0

0001 = 1

0010 = 2

0011 = 3

0100 = 4

0101 = 5

0110 = 6

0111 = 7

1000 = 8

1001 = 9

1010 = A

1011 = B

1100 = C

1101 = D

1110 = E

1111 = F

The image we are making is:

00000001

00000001

00101000

00101000

00101000

01000100

01111000

00000001

00000001

Each line represents one row of pixels.

Now convert each 8-bit binary row into hexadecimal.

The rows become:

00000001 = 01

00000001 = 01

00101000 = 28

00101000 = 28

00101000 = 28

01000100 = 44

01111000 = 78

00000001 = 01

00000001 = 01

So the hexadecimal sequence is:

01

01

28

28

28

44

78

01

01

Now convert each hexadecimal value into its corresponding calculator token.

For this example:

01 = mp

01 = mp

28 = (

28 = (

28 = (

44 = D

78 = 8

01 = mp

01 = mp

So the token sequence is:

mp, mp, (, (, (, D, 8, mp, mp

Each token needs to be separated using:

.Ans.Ans.Ans.Ans.Ans.

This is 11 characters.

The complete sequence for the smiley is therefore:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

This is the full data that will be used to create the image.

Go back to the position after A=0.

Continue spamming any character until you reach the changing position.

To get the first:

mp

delete the changing character.

Then press the → arrow once after the cursor blinks.

You should now have the first mp in the changing position.

We need two mp tokens at the start.

Once you have the first mp, delete the 13 characters before it.

Then press the → arrow to put the cursor directly after the mp.

Now enter:

.Ans.Ans.Ans.Ans.Ans.

After doing this, obtain another:

mp

and place it after the first one.

You should now have:

mp.Ans.Ans.Ans.Ans.Ans.mp

Now keep pressing the ← arrow to move to the beginning of the sequence.

Put the cursor directly before the first mp.

Then delete characters before:

mp.Ans.Ans.Ans.Ans.Ans.mp

until the sequence is directly after the original A=0 position.

Now continue entering the complete pattern from earlier:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

After placing the final mp, continue entering the same .Ans pattern:

.Ans.Ans.Ans.Ans.Ans.Ans.Ans.Ans.Ans...

Keep entering .Ans repeatedly until the overflow wraps all the way around back to the beginning.

Once it has wrapped around to the beginning, press:

AC, ←, =

The calculator should then display the small smiley face image.

You will see multiple smileys appear.

According to FX82AU_Calc4Life, this is caused by the calculator's RAM.

So if you see more than one copy of the image, that is not necessarily a mistake in the image data.

For reference, the whole process for the smiley is:

Do not make the 22-character text overflow.

Use:

.Ans.Ans.Ans.Ans.Ans...

until you reach:

A=0

The positions become:

A = .

= = Ans

0 = .

00000001

00000001

00101000

00101000

00101000

01000100

01111000

00000001

00000001

01

01

28

28

28

44

78

01

01

mp

mp

(

(

(

D

8

mp

mp

Use:

.Ans.Ans.Ans.Ans.Ans.

between each token.

The final sequence is:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

Place the first mp, create the second mp, then move the entire sequence into the correct position after the original A=0.

Continue the overflow until it wraps around to the beginning, then:

AC, ←, =

The smiley should appear.

This same method can be used for other images too.

The general process is:

Image

↓

Binary

↓

8-bit rows

↓

Hexadecimal

↓

Calculator tokens

↓

.Ans separators

↓

VERIF overflow

↓

Display

The smiley above is just an example.

Other images can be created using the same principle, as long as they can be converted into the required binary data and then into the calculator's internal tokens.

Note: The separators do not have to be exactly 11 characters long. If you want to make a bigger image, you can put two tokens together instead of separating each token individually. For example, using mp mp together will produce 00000010000001. This allows you to create larger images by combining multiple 8-bit sections.

Now, finally, we can look at dumping the ROM of the fx-82AU PLUS II 2nd Generation.

The original ROM dumping method was discovered by DaCoolCat123. The method and its development were documented on Reddit, where people continued experimenting with it and refining the technique.

• Reddit Part 1 — Dumping the fx-82AU PLUS II ROM

• Reddit Part 2 — Dumping the fx-82AU PLUS II 2nd Edition ROM

Part 2 explains that the technique uses a buffer-overflow vulnerability to produce ROM data as video/display output. The dumped data has visible flaws, but the hackstring still worked and was further experimented with.

Part 1 describes the dumped data as raw binary. The general idea is to push data from the calculator's RAM toward an area that can be displayed on the screen, allowing the output to be captured and processed.

ROM dumping is different from the text and image methods described earlier. Instead of intentionally creating text or images, a carefully constructed hackstring pushes internal calculator data into an area that can be displayed.

The general process still uses the same overflow vulnerability.

1. Enter STAT sub-mode 0.

2. Store r in a variable.

3. Use this to obtain an illegal variable.

4. Switch to LINE IO.

5. Enter VERIF.

6. Evaluate the variable.

After this, press ← to reach the overflow area. The original method then uses the overflow around the A=0 area.

The original documentation identifies an SP offset of 44.

The position is measured from:

99999|A=0

The important position is 44 characters from that point.

In practice, after you reach A=0 in the basic overflow, enter 44 characters starting from the A=0 position.

After those 44 characters, enter:

->D-00%%

Replace %% with any character.

For example, the important sequence is:

A=0

12121212121212121212121212121212121212121212

->D-00%%

Do not use Ans. for this part. Use 12 or another character.

After entering ->D-00%%, continue spamming:

0

Keep doing this until you see the memory indicator.

Once the memory indicator appears, press:

AC, ←, =

This is the point where the ROM data can be produced as display output.

Dumping the ROM can be useful for understanding things such as:

• The calculator's architecture

• How functions are implemented

• Potentially exploitable functions

• Creating an emulator

• The calculator's binary

• Disassembly

• Internal calculator behaviour

The original Reddit documentation describes the output as raw binary, which can then be processed and potentially disassembled according to the calculator's architecture.

ROM dumping is not simple and has several problems.

Some hackstrings are extremely long, and running the process can take around 20 minutes.

There are also stability problems. Parts of the screen or video output sometimes do not move correctly, which can make the dumped data difficult to capture.

The hackstring and its offset may also need further refinement.

Another problem is the calculator's limited RAM. Large programs and additional modes are difficult to work with because there is not much memory available.

Because of these issues, getting a complete, clean ROM dump is complicated.

The general process can be thought of like this:

ROM data

   ↓

Overflow

   ↓

Display area

   ↓

Raw binary on screen

   ↓

Capture

   ↓

Binary file

   ↓

Further analysis / disassembly

There apparently are more ways to dump the ROM that have been discussed in Discord (I am not in the Discord). There are also many other things that can be experimented with around the overflow area by changing the characters, functions, and positions.

While experimenting with basic overflow, we discovered that a line can sometimes appear across the screen after completing a hackstring. This can happen while doing different things with basic overflow.

If a line appears across the screen, be careful, we think it sets the power to DC instead of AC, which can damage the liquid crystals.

For example, this can happen when experimenting with the glitched diagnostic menu and pressing AC.

If this happens, pressing:

ON

can reset the calculator and restore its original properties.

Be careful when experimenting with basic overflow, especially when testing different characters, functions, and glitches.

Another thing we have been experimenting with is writing values into variables such as:

A

B

C

D

This is more complicated than the normal text-writing method.

The values do not always appear to behave like normal text. They seem to contain hexadecimal digits or other internal values.

Interestingly, A, B, and C can sometimes appear the same even when different inputs were used.

There is also odd/even behaviour in some of these experiments.

This is still being experimented with, so there is a lot that is not fully understood yet.

• nX-U8100 Core Instruction Manual — CPU documentation

• fxesplus 82espa/rom.bin — a .bin ROM dump from the 82ES

These can be useful when looking into the calculator's CPU, binary data, and ROM structure.

There are still many more things we have discovered and experimented with on the fx-82AU PLUS II 2nd Generation.

A lot of these experiments involve the basic overflow and trying different characters, functions, patterns, and positions. Some produce interesting results, while others cause glitches or crashes. There are also many results that we still do not fully understand like one where the calculator crashes and then generates a table full of errors. 

We have also been working on documenting the calculator's internal token system.

The token table is available here:

fx-82AU PLUS II 2nd Generation Token Table

The table is not completely accurate or complete yet.

We have finished writing all the normal characters, while we are still figuring out the small characters, which are not completely done. There is also one small character that looks somewhat like a music note.

Some of these characters are difficult to document digitally because they can look like strange pixels rather than normal characters.

ilovecats4606 created the token table, and FX82_Calc4Life and I are continuing to work on expanding and improving it.

Hopefully, by the end of the year, we can have a much more complete token table.

• Reddit Part 1 — Dumping the fx-82AU PLUS II ROM

• Reddit Part 2 — Dumping the fx-82AU PLUS II 2nd Edition ROM

• Casio Calculator Forum — fx-82AU PLUS II Hacking

• fx-82AU PLUS II 2nd Generation Token Table

• nX-U8100 Core Instruction Manual

• fxesplus 82espa/rom.bin

A lot of the discoveries in this post came from me and my friends, through experimenting with the calculator and testing different combinations.

The original ROM dumping method was discovered by DaCoolCat123. The method and its development were documented through the Reddit posts linked above.

Thanks to:

• FX82_Calc4Life

• EnderFire09

• DaCoolCat123

• Other friends who has experimented with the fx-82AU PLUS II and shared information

This is a collection of the methods, experiments, and discoveries we have found while experimenting with the fx-82AU PLUS II 2nd Generation.

There are still a lot of things we do not understand yet. Some glitches are easy to reproduce, while others depend on very specific characters, positions, or sequences.

If you find something that is incorrect, missing, or incomplete, feel free to point it out. If you discover another interesting glitch, token, function, overflow method, or anything else related to the calculator, feel free to share it as well.

This is also my first forum post, so corrections and additional information are welcome.

This is purely for educational purposes. If these methods are used for other purposes or cheating, I am not responsible for any problems or damage caused.

Lastly, sorry for uploading so late.

Codev-Unified

 --- 

I (and friends) have discovered a method to unlock a functional BASE-N mode on the Casio FX82AU-PLUS II V2, with functional base conversions. It is also a possible method of showing "images" (or rather, a 16x4 text with full, none and top/bottom half block characters) using a corrupted/glitched SHIFT-3 menu. All methods/information is listed below. (THIS IS PURELY FOR EDUCATIONAL PURPOSES. IF THESE METHODS ARE USED FOR INAPPROPRIATE OR CHEATING, I AM NOT RESPONSIBLE FOR ANY HARM/PROBLEMS CAUSED).

Method to unlock:

1. In COMP / MathIO, type Pol(0,1 and enter.

2. Next, type Ans÷9 and spam ABS until you are unable to.

3. Press enter, AC, LEFT, AC, UP and delete everything except for the theta symbol (looks like o).

4. Store this into A (or any other variable).

5. Enter VERIF / LineIO and type A (or the variable you chose).

6. Press enter and press the left arrow.

7. Start carefully spamming √ and Ans in the exact pattern. Continue until it wraps around to A=0 (roughly 200-300 characters after).

8. Press AC, Left and Enter.

9. Wait until Stack Error / Syntax Error / Dimension Error (if it crashes or shows a different thing similar to what happens with . Ans, redo the process) appears.

10. Press left arrow, and very quickly do the next instructions (if done too slowly, it will fail and enter a glitchy Matrix mode)

11. Press 1, delete it and enter MathIO.

12. If it does not show MatAns and i (or similar, I forgot), then continue, else feel free to explore / redo.

13. Press AC, and press either x², x^☐, log( or ln(

14. Enter MathIO and AC.

15. Congratulations, you have entered BASE-N on a calculator not supposed to have it. 

Research found:

- Shift+3, down and 3 and Shift+3, down and left seem to show the characterised forms of data entered somewhere between the second A=0 (around 100 characters after the start) and roughly 80 characters beyond. We are currently experimenting with this, and have managed to get characters to show and other cool things.

- Shift+3, left and down seems to be a glitchy version of the above research, and disappears once BASE-N is properly entered (can be accessed before step 14)

- There are methods of obtaining illegal characters in the BASE-N mode, such as obtaining MatC (or was it MatA/B, I forgot) with a key combination involving Shift+3, left, down and I think 9, 8, 7 and 6.

- using . Ans allows us to gain nearly raw access to the frame buffer, although it strangely duplicates. We have managed to get a functional 24x8 image showing using it and the illegal character point (referenced in other fx82-au plus II hacking topics).

- Pressing Enter with Mat(A/B/C/Ans) or Vct(A/B/C/Ans) appears to enter a very glitched, table like mode.

Please note that this is the first time that I have ever posted on these forums. It would be nice to have advice or feedback, or just other people commenting on this with cool things they have found. If there are any mistakes, please let me know.

Casio Basic, 9750giii, latest updates installed, calc is in degree mode.

"ANGLE A":A^   (^ represents the lower right triangle)

I would like to output

36.35*    (* represents the degree symbol)

I tried

"ANGLE A":A*^

"ANGLE A":A"*"^     (degree symbol in quotes)

"ANGLE A"

A*^

"ANGLE A"

A"*"^

Nothing seems to work.

I may have to try Python 

Thanks for any help.

morse

I wrote a C program for the Casio fx-CG50 but I'm unable to compile it (toolchain issues on Mac M1). Could someone kindly compile it for me and provide the .g3m file?

It's a surface area unit converter (in Italian language) that converts between:

• Square meters (m²)
• Ares (a)
• Hectares (ha)
• Milanese pertiche (pm) - historical Italian unit

With all possible conversions between these units.

• 1 are = 100 m²
• 1 hectare = 10,000 m²
• 1 Milanese pertica = 654.5 m²

• Program name: ConvSup
• Platform: Casio fx-CG50 / fx-CG20
• Required format: .g3m
• Maximum size: 2 MB
• Icon: If possible, a simple 30x19 pixel icon (otherwise default is fine)

Thank you so much in advance to anyone who can help! I really appreciate it.

For the past three months, my friend and I have been playing every available Star Wars game on Casio calculators. We have already launched SW games for Casio FP-1100, FX-702P, FX-7700, FX-9850 compartible, CFX. Lacking original calculators, we had to run games on various emulators.Videos of gameplay can be viewed here.

In 1999, the game called Star Wars Episode 1 was released for the Casio Graph 100. We were able to convert .FXI => .G2M to run it on the official Casio CG-50+ emulator but but failed to extract the images needed to run the game correctly using FX-Interface.

Please help us launch the game! A copy of the file is available here.

Also available on planet-casio.
The operating instructions were from the translator (qq1122). Preface and some comments are from BCX74687.
Reproductions are allowed, but Don't use this for bussiness.
中文版请参见两斤时间的这个帖子
语言翻译不一定100%准确。Language translations may not be 100% accurate.
*If there's a [=], simply regard it as EXE.

[Preface] 

Casio's fx-5800P, which was released in 2006, has been in production for nearly 20 years.This not only reflects the important position of fx-5800P in the fields of engineering and education, but also exposes the gradual decline of the calculator business, especially on engineering.
The fx-5800P was once developed a computer connection cable and program around 2018, which is also a great breakthrough in engineering, but because the calculator connection cable is very expensive and difficult to buy, this upgrade has gradually been forgotten by people. 
Until today, we launched another attack on fx-5800P, successfully found the abnormality of the calculator and completed the functional upgrade.
Important Note: Function upgrade requires the cost of clearing your programs. 
If you want to try, a backup is strongly recommended, such as transferring your programs to another calculator.


[Basical Overflow] 

If you want to let your calculator act abnormally, the first thing is to overflow.The following is the overflow process:
1. [MODE] and enter the PROGRAM mode,then select NEW and create a new formula, I named it OUTTEST
2. In the formula editing interface, press [x^] then press [0] until it is full and you can't input anything more
3. EXIT [MODE] 1 Return to COMP mode, Shift [MODE] (setup), 2 to Adjust lineIO, [fmla] 1 and find the previous formula(OUTTEST), EXE, a "syntax error" appears, EXIT [right] DEL [left] DEL [left], press [0] until it cannot be typed
4. [right] [right] [0] [0] [left] [left] DEL DEL and the overflow is succeeded!
The following are two small exceptions:
1. Lock the machine: (press the p button to recovery)
Replace the second DEL in the fourth step with EXE, EXIT and your calculator is locked.
2. Strange errors: (will be mentioned later)
After the fourth step, EXE, [left], (if you don't change mode through [MODE]) The entire machine will be abnormal, and executing the program will produce some strange errors.
The abnormality may delete your programs!
If this happens, do not use Shift AC/on to shut down and save the progress. 
Just press the p button on the back (thanks to casio's memory protection) and the program will be restored.

Effect : 




[Overflow in TABLE and RECUR] 
Enter a operator which includes a box in TABLE and RECUR's MathIO mode and press EXE to save it into the memory,
ignore the error, EXIT and switch to COMP mode ,then adjust lineIO. Enter TABLE or RECUR again then the box will also appears, 
(you can delete other items and only leave the box. Press EXE twice, and there will be a Syntax Error, the box is saved into memory again, [MODE] 1 to enter COMP, Shift [MODE] and select 1 to adjust MathIO, [MODE] 7 to return to TABLE, and only leave the box there.)
and it can also overflow according to the operations above.



[Character Converter] 

People who have studied other casio calculators must be familiar with character converters. It is based on the conversion between double-byte characters and single-byte characters. 
After our research, fx-5800P also has double-byte characters (the character table is in the attachment), so a character converter naturally came into being.
But this converter only supports double-byte characters conversion to single-byte characters, so we also calls it a 'one-way character converter'. 
The following is the instructions for converting characters:
1. Input the box. There are currently two ways:
i) Under COMP and lineIO (Shift [MODE](setup)2), call a boxed fmla (formula)
ii) In TABLE (MODE7) or RECUR (MODE6) mode. The operations are above.
*you can delete other items and only leave the box
2. Make sure that your box is at the end (that is, there are no characters behind the box)
i) Convert a character:
move the cursor to the front of the box, [right], enter a character you need to convert, [left] 9 DEL DEL, the converted characters will appear behind the box.
ii) Convert two characters:
move the cursor to the front of the box, [right], enter two characters you need to convert (the result will be the second character) , 
[left] [left] DEL [right] [right] DEL DEL [left] [right], 
enter another character you need to convert (the result will be the first character), [left] 9 DEL DEL, then the converted two characters will appear behind the box.
Effect :

*This one-way converter also works on CNX and CNCW (and other Casio calculators?). But the disadvantage is that it can only convert double-byte characters to single-byte characters.
*Characters that can be converted include: # ' & @ [line break], etc., see the comparison table for details:

Currently, according to our findings, symbol ' may be used for comments, while symbols & and ' appear in built-in formula names, symbol ~ appear in fmla trans of self-test.
No use of # has been found yet.



[Functional Upgrade] 

We have been understood the Basic overflow, and the upgrade method is obvious.
In fact, this function upgrade is to enter a fusion mode (not comp mode, but also has the characteristics of comp). 
These functions can be upgraded through the following instructions: 
1. Pull out lowercase letters, Greek letters, subscripts, etc. in the program 
2. Use program commands in Formula
3. Use constants and other instructions in baseN programs
4. Use >, <,≥, ≤, ≠, = in the table to determine whether the conditions (0 and 1) are met
There's an advanced example program by BCX74687:

But please note that these functions come at the cost of your data disappearing.
Therefore, it is recommended to prepare 2 fx-5800Ps and use a spare machine to transfer the "advanced" program to the main machine.
The instructions are as follows: 
1.[MODE] 7(TABLE)Shift [MODE] 1(MthlO)
2.[sqrt] [left] and input "0" as more as you can, then EXE EXE EXIT
3.Shift [MODE] 2(LinelO)[MODE] 1 [MODE] 7
4.DEL [left] DEL [left] [0] [0] [0] [right] [right] [0] [0] [left] [left] DEL(to overflow)DEL EXE EXE EXIT
5.Shift [MODE] 1(MthlO)[MODE] 1 [MODE] 7
6.[+]then input [fraction]as more as you can
7.EXE EXIT
8.[+]then input [fraction]as more as you can
9.EXE EXIT
10.[+] keep inputting [Fraction] and the screen will go blank
11.Once the screen goes blank, input more than 14 numbers and wait for obvious lag
*Steps 1-11 will cause the 'unmapped write'. An alternative way will be mentioned later.
12.[MODE]and enter a mode
13.Shift AC/on(OFF)
14.AC/on to turn on, the calculator automatically resets and deletes all data, but the screen just now will be recovered, and the comp mode will be merged with the mode you just selected.
Notice: Run BaseN programs and switch modes will clear the merged effect.
In step 12,
If you use [MODE] 7 to enter program mode, after turning on,press Shift [MODE] 2 to switch LinelO, 
and then create a new COMP program, 
in the program editing interface, press [FUNCTION] ▼ 1(ALPHA), you can enter lowercase English letters, Greek letters, superscripts, etc. in your program.You can also create a new FMLA or BASE-N program, under the editing interface, [FUNCTION] can enter the function menu that is no different from COMP, and you can use program commands, stat, reg, etc. in your formula or BASE-N program.
If you use [MODE] 5 to enter TABLE mode, similarly, press Shift [MODE] 2 to switch LinelO, 
[FUNCTION] can enter the function menu that is the same as comp, 
3 ▼ can enter the verifying symbol for judging the expression's true or false, 
after the table is generated, if the expression is true, f(X)=1, and if it is not, f(X)=0.
If you use [MODE] 8 to enter EQN mode, under the equation input interface, 
[FUNCTION] can enter the function menu that is the same as MAT, and <Edit Row> and <Edit Column> works normally.
*So, the essence of the eqn input interface may be a mat.



[Supplements] 

In steps 1 to 11, the following instructions also work:
(Please see the original post. Translate of this part is currently not available.)

After abnormal shutdown, the 'set version' of Fmla trans in the self-test will be available, but the calculator will crash when trying to transfer.


Overflow in any inputting interface (except the naming interface) :
Follow the Steps 1-11 above and cause the 'unmapped write'. 
Then input any content in any input box you want to overflow.
Shift AC/on to shut down, then input any content after booting.
Effect:
  



[Special Thanks] 

BCX74687 (1kgTime) 
CALCF (for telling me how to input the "box")
Telecomadm1145 (The creator of CasioEmuMsvc, who said that the box of 5800p is "nothing")
CNCALC

[ATTACHMENTS]

fx-5800p Single-byte char Table

The one-way character converter