7 replies to this topic

[huhn_m]

Hy there!

I once found the listing of a disassembled and commented int 10h
of the calculator (I think it was on whyp's site).
Unfortunately his provider seems to have deleted some of his sites
(due to inactivity?) or at least dissallowed file listings.
?t seems as if I deleted the file so I ask you:

Does anyone have it still? (french comments would be ok)

If yes please send it to me / post it.

Thanx & Bye huhn

[2072]

Whyp is currently working on an OS for AFX that replaces ROM-DOS for example with his os Scortch works on the AFX+ but it's not finish yet. Whyp said he will rebuild his site soon.

You can email him (find his address in his profile on the g100 forum).

[Roeoender]

Hello 2072,
what do you mean by new OS - did someone on the french forum found a way to upload something to the drive A without causing an error? That would be wonderfull.
www.graph100.com seems to be out of service that is why I am asking.

as for in10h - it was a document writen by BradN, it should be at CALiPSO page and probably BradN has it too.
Roeoender.

[2072]

no in fact it replaces ROM-DOS when you launch it and use less memory than ROM-DOS but cannot modify drive A.

About the drive A: did you try to make a check some of this drive and to search it in the memory? Maybe it's written in drive A itself (at the end of it for example).

If CASIO uses flash memory for the drive A it means that they intend to modify it. So it must be possible to chanche its content, it's like the user memory area: it is checked when the calc is turned on, it must be the same part of code that checks everything. So if we could reverse engineer this part of code we would find what the calc is looking for.

[huhn_m]

I think it's possible that there is and image of drive A somewhere on the rom. I searched for the contents of autoexec.bat and ~5 different memory
locations seem to hold it. That's quit unusal.

@2072: I use the Touche you send me. Is there any way that you
bypass the ram locations 1985:3 / 1990:5 / 199A:6 / 19AA:6 beacause
they hold the entered string no matter what nonsens it is.
It seems to be because you store the strings in this point.

Touche is great!!

as for the INT10h routines, a friend had them and sent them to me.

Bye huhn_m

[2072]

Yeah I know this problem in the next version of TOUCHE I will completely exclude the DS segment so it cannot find itself.

[Roeoender]

As for drive A:
It is surely flashable - for example look at the contents of drive A when you upload it to the PC - it contains the "skin" of the calculator (quite easy changable!).
In the ZX945 test menu there is a service menu "Initialize MASK" and "Initialize FLASH" - they may have something in common with changing the system. I have done some dissassembly on them but I got bored, and it definately use some kind of uploaded data checking (more less like CRC).

A word of warning:
This "CRC checking" suggests that there may be some problems with booting after uploading fake system drive.
Anyway all I want from drive A is to modify config.sys, autoexec.bat and maybe some more files.

PS. I was off-line for this time - that is why so late reply.
Roeoender.

[huhn_m]

Hi roeoender!

I already tested it by increasing the first and decrasing the fifth letter
of a word but it reset the calc. Don't you think it's possible that they
keep copys of the system files (command.com / autoexec.bat ...) in the
rom and compare them on launch and make a reset if necessary.
Anyway they ahve to be in ram because otherwise they couldn't be
restored