5 replies to this topic

[XYZ]

I've been playing around with the matrix bug in my 9850G and found out quite a few rather interesting things. I've been playing with USgard on my ti-85 too and got interested in trying to make my calc do something it't not supposed to

Anyone still working on it?

Cheers

[Casto Productions]

I've played with that same matrix bug a number of times myself, but I don't really know how to interpert the results of what I find, other than some entries accessed in the matrix seem to force a ROM check and then locks the calc. I used to even have have the locations written down.

Have you found anything interesting yet?

[XYZ]

Depending on the matrix collumn dimension and the number you use to fill the matrix with, you will get some really varied results (I can mail you my findings if you are interested). Also, you can try running it from a program (where you can implement loops etc) which opens another whole dimension of strange screen output. It appears to me that data telling the system where it is currently 'at' (ie mode etc) gets over written, so it just dumps whatever it finds on the screen interpreted as ascii. These system variables might be stored near the end of memory, because when you use a dimension smaller than about 11 the system seems to remain stable, although you will get some garbage data floating around in the y= editor etc.

I'm sure Martin Poupe (who has successfully removed the CFX's rom, rewritten it with his own CASM to run ASM and soldered the rom back in - now that's what I call hacking) of www.rkk.cz/~mpoupe/ would be able to explain it all, and probably nod his head and tell me how little use it all was.

Regardless of the power of mightier machines like the AFX and CP300 (not to mention hp49g and ti89) the CFX still holds something no other calculator does - colour. Poor contrast and slow to react granted, but still it's colour! I don't think there is any way to make the CFX run asm without reporgramming the rom, but perhaps there's hope for the future generations of the CFX (probably no one has tried finding a loophole like that found in the ti85 on the new 9850 model? You know, the 'girl's shaver' one as it's commonly known in my engineering faculty)

[Casto Productions]

haven't heard of the loophole in the TI-85, one of the few calcs I haven't owned What does that involve?

[XYZ]

Here's a link to the guy who claims to have done it - see 'hacking the ti-85'

My Webpage

Because the ti-85 (the 92 was hacked in a similar way) has no support for assmebly, the only way to get your own code to run on it was to figure out how the backup files were structured and how the OS worked. Since the 85 has a 'custom' menu which points to user specified commands in the catalogue it was possible to put your own code in memory and have a custom pointer to it (I've got one called USgard on mine). Then your asm programs are stored as string variables and run from the Usgard 'shell'.

It's pure genius if you ask me

[Martin]

I'm sure Martin Poupe  of www.rkk.cz/~mpoupe/ would be able to explain it all, and probably nod his head and tell me how little use it all was.

I think XMS hacking of cfx9850 (expanded matrix) is very difficult and it doesn't allow you many. As I wrote on my page, the calc has non-linear adressing, memory is divided into 64KB segments. If you are in RAM segment (segment 40h), you can pass any offset as an address and you will still be in RAM. The address is simply taken modulo sizeof(RAM). So these areas are INACCESSIBLE:
-stack (seg 8)
-ROM (seg 20h~27h)
-display (seg 3Fh)
-display ports (seg 10h~11h)

This is also the cause why I don't think it is possible to run asm on cfx without ROM change.
Nevertheless the cfx9850G has "magic" architecture, unsimilar to expectable architecture of i86 or Motorola.

If you are interested more to XMS, see http://www.rkk.cz/~m...ls/CFX9850G.TXT