Jump to content



Photo
- - - - -

Progress on arbitrary code execution on CLASSWIZ calculators


  • Please log in to reply
7 replies to this topic

#1 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 219 posts

Posted 26 June 2019 - 11:31 PM

Currently, there's no known way to do arbitrary code execution however it's possible to:
  • Basic overflow. (pressing [=] when there's >=200 character appears to always shut down,
    although the behavior is not the same on the official emulator)
  • Extract multibyte character.
  • Convert part of the calculation history to/from number.
  • Execute "an" to modify the stack pointer.
(for more information see http://casiocalc.wik...alculator-model )

#2 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 219 posts

Posted 27 June 2019 - 11:11 AM

Update: it's possible to execute arbitrary code (however it's necessary to get the ROM)

(Move the post here because Baidu keeps deleting my post)

Method on 580VNX: (will not work on other CLASSWIZ calculators)

1. Get "an"
2. Enter 1234567890an, press [=].
3. Enter 1234123412341234 SHIFT 739 (γp) 22 [=] [AC ]

Result: the key checking screen in diagnostic mode (with 00) is displayed
and the cursor still flashes.

Principle:

1. When "an" is pressed, the stack pointer is changed. (only depend on the
original position of "an")
2. In linear mode, the formula is copied to the undo buffer (start at position
D522) when [=] is pressed, and corrupt the stack.

Notes:

1. I think that the PC values being jumped to is the 4 bytes γp22, however
modifying the 16 previous bytes also change the behavior, probably because the
type and the location of the error is important.

Some experiments: (enter sequence then [=] [AC ])

 
1234123412341234γp22 -> ok
γp22γp22γp22 -> nothing (return to formula enter screen) I think that the
stack is not modified because the formula copied is too short.
123412341234γp22γp22γp22 -> ok
+-×÷+-×÷+-×÷+-×÷γp22 -> freeze
)234123412341234γp22 -> ok
)-×÷+-×÷+-×÷+-×÷γp22 -> freeze
+-×÷+-×÷+-×÷γp22 -> weird behavior (display something similar to "Version 11F[")
1234123412γp22 -> nothing
12γp22γp22γp22γp22 -> freeze
123412341234γp22 -> freeze
123412341234γp221234 -> freeze

1234123412341234γp 6 6 -> freeze
1234123412341234γp sin^-1( sin^-1( -> freeze
1234123412341234γp d/dx( d/dx( -> ok
1234123412341234γp A ( -> ok

3. From the last 4 experiments above, 6 (0x36) and sin^-1 (0x7A) doesn't work
while d/dx (0x52) and A (0x42) works, therefore the CSR mask is 0xF.

Edited by user202729, 27 June 2019 - 04:01 PM.


#3 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 219 posts

Posted 28 June 2019 - 09:17 AM

Update:

The reason why sometimes the 16 previous bytes change the behavior is that the
corrupted part doesn't directly affect the top most pushed LR, but a deeper one.
Therefore the control flow still continue normally for a while before being
redirected; however because part of the stack is modified, the execution may be
different.

When = or CALC = is pressed when there's (76+n) bytes before an, in the new mode
(called "mode an(76+n)"), the part starting from byte n being copied to the undo
buffer will be the top of the stack after the first "pop PC" (in strcpy function,
before that er12 and xr8 are popped, just like on ES PLUS calculators)

In mode an(76+n), modifying n first bytes of the undo buffer doesn't crash
the calculator. However, (as far as I can see) it's not possible to do basic
overflow in mode an86. It's possible in mode an90 (remember to set x to a valid
number such as 0 when CALC, invalid value may make the formula failed to execute
and basic overflow will fail. (In mode 90 it may not be necessary to enter the
"longer" formula (usually `X=Σ(X,1,1x10^9`)

Edited by user202729, 28 June 2019 - 09:42 AM.


#4 mrfrakes

mrfrakes

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 17 July 2019 - 09:56 PM

Not quite arbitrary code but there you go

calc.jpg


  • user202729 likes this

#5 yosik

yosik

    Newbie

  • Members
  • Pip
  • 3 posts
  • Gender:Male

  • Calculators:
    casio fx-991-ex

Posted 20 July 2019 - 07:04 PM

Hi!

I read http://casiocalc.wik...alculator-model but I do not understand how can I enter a new character.

Can you give me the details?



#6 yosik

yosik

    Newbie

  • Members
  • Pip
  • 3 posts
  • Gender:Male

  • Calculators:
    casio fx-991-ex

Posted 21 July 2019 - 10:23 AM

Hi all!
I tried to use enter unsupported symbols using unstable byte and got an strange result.

This symbol looks like "A" bold. If I press [=] when this character is on the screen and the output mode is decimal it looks like a colon.

In some cases (e.g. A+1 equals 11) A is interpreted as 10. It also can be stored in variables. When i tried to summ A and variable contains A i get 1A. What is happen?



#7 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 219 posts

Posted 02 August 2019 - 03:51 PM

Hi all!
I tried to use enter unsupported symbols using unstable byte and got an strange result.
This symbol looks like "A" bold. If I press [=] when this character is on the screen and the output mode is decimal it looks like a colon.
In some cases (e.g. A+1 equals 11) A is interpreted as 10. It also can be stored in variables. When i tried to summ A and variable contains A i get 1A. What is happen?


That's the character with hexadecimal value 0x3A. It's used as hexadecimal A in Base-N mode.
In normal mode it evaluates to just "A"; however it's an unexpected value because calculator use BCD.
If you assign it to one of the variables (or Ans/PreAns) and press ON, the calculator will reset itself.



----------------

Progress update

The ROM of segment 2 and 1 are completely read. Reading of segment 3 is in progress.
There are some unknown obstacle that prevent segment 0 (read as data using segment 5) to be read the same way.

TODO: will try on official emulator.

Edited by user202729, 03 August 2019 - 01:21 PM.


#8 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 219 posts

Posted 02 August 2019 - 04:38 PM

Not quite arbitrary code but there you go


I'm not very interested in hardware modification because I don't know how to do it, but if you can do that
you may want to see if you can get the ROM of the calculator using hardware modification, instead of (the
way I'm currently using) writing a ROP chain so the calculator prints its ROM on the screen in some format,
then use OpenCV or something like that to read back the result from a video capture of the screen.

Edited by user202729, 02 August 2019 - 04:41 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users