Hi guys, I've managed to Hack my Casio FX-82ES. This hack basicly writes to the calculator's EEPROM (via the calculator itself, we cannot write to it ourself) to make the calculator buggy after a reboot. This hack will work on the FX82, 83 and 85ES models. FX-991ES, FX-570ES and FX-115ES untested but due to having similar ROMs (Normally Rom 18) I assume it will work on those too. This hack does not work on the Plus models due to having new ROMs where the exploit I used has been fixed.
Bearing in mind, this hack does nothing useful, but still interesting.
Disclaimer: This shouldn't break your calculator how ever I am not responsible for any damaged caused to your calculator by using my hacks.
I have documented this hack in a youtube video here
I will also explain it here. Before I explain how I assume it works, I'll explain the steps.
A compatible FX Model,
1) Pol(0,1) then =
2) Type lots of fractions untill cannot type anymore
3) Go to the end and type 1 then x□
8) Press left untill the cursor is just after "1"
You will now have r=0 0=1
10) Delete everything so you just have the "r" on screen.
Now "r" on this calculator is interesting. It could be some code or point to an address in ROM, I do not know, however "r" can be exploited to do many hacks. I have other hacks ive done but today I will explain the EEPROM hack.
Now we are going to write to the eeprom
11) move the cursor so its before "r"
12) type 1
13) type : (alpha and x3, depends on the model)
14) you should have 1:r on screen
15) Press = twice
You will now be presented with a glitched screen.
16) Press the Mode button. Attempt to enter "Table" mode (Button 3 on 82, 83 and 85ES Models)
17) You calculator will crash, Press ON
18) Now you are in a buggy mode
Now attempting to enter Table mode after 1:r seems to write to the EEPROM. I assume 1:r points "r" to the the address in the EEPROM (the 1: could possibly act as a bootstrap) which store the Mode to load on boot (P3, P0 etc.) And attempting to enter Table mode writes the contents of "r" (possibly garbage data or code) to the EEPROM and messes up the boot data which is used to load the mode on Boot.
In this state, the calculator behaves rather strange as demonstrated in my Video
Proof its EEPROM hack?
Turn off: the hack stays and still glitchy.
Removing battery and covering solar panel: the hack stays and still glitchy.
This is also demonstrated in my Video.
To remove this hack, do a wipe all, this resets all values in the EEPROM to the defaults stored in the ROM
So, with no technical details of this calculator being released, this is as far as I can explain. Now that we can write to the EEPROM, this is a step forward for the FX ES series hacking (non plus models)
Edited by kaikun97, 03 October 2014 - 12:19 PM.