Jump to content



Photo
- - - - -

Progress on arbitrary code execution on CLASSWIZ calculators


  • Please log in to reply
14 replies to this topic

#1 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 26 June 2019 - 11:31 PM

Currently, there's no known way to do arbitrary code execution however it's possible to:
  • Basic overflow. (pressing [=] when there's >=200 character appears to always shut down,
    although the behavior is not the same on the official emulator)
  • Extract multibyte character.
  • Convert part of the calculation history to/from number.
  • Execute "an" to modify the stack pointer.
(for more information see http://casiocalc.wik...alculator-model )

#2 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 27 June 2019 - 11:11 AM

Update: it's possible to execute arbitrary code (however it's necessary to get the ROM)

(Move the post here because Baidu keeps deleting my post)

Method on 580VNX: (will not work on other CLASSWIZ calculators)

1. Get "an"
2. Enter 1234567890an, press [=].
3. Enter 1234123412341234 SHIFT 739 (γp) 22 [=] [AC ]

Result: the key checking screen in diagnostic mode (with 00) is displayed
and the cursor still flashes.

Principle:

1. When "an" is pressed, the stack pointer is changed. (only depend on the
original position of "an")
2. In linear mode, the formula is copied to the undo buffer (start at position
D522) when [=] is pressed, and corrupt the stack.

Notes:

1. I think that the PC values being jumped to is the 4 bytes γp22, however
modifying the 16 previous bytes also change the behavior, probably because the
type and the location of the error is important.

Some experiments: (enter sequence then [=] [AC ])

 
1234123412341234γp22 -> ok
γp22γp22γp22 -> nothing (return to formula enter screen) I think that the
stack is not modified because the formula copied is too short.
123412341234γp22γp22γp22 -> ok
+-×÷+-×÷+-×÷+-×÷γp22 -> freeze
)234123412341234γp22 -> ok
)-×÷+-×÷+-×÷+-×÷γp22 -> freeze
+-×÷+-×÷+-×÷γp22 -> weird behavior (display something similar to "Version 11F[")
1234123412γp22 -> nothing
12γp22γp22γp22γp22 -> freeze
123412341234γp22 -> freeze
123412341234γp221234 -> freeze

1234123412341234γp 6 6 -> freeze
1234123412341234γp sin^-1( sin^-1( -> freeze
1234123412341234γp d/dx( d/dx( -> ok
1234123412341234γp A ( -> ok

3. From the last 4 experiments above, 6 (0x36) and sin^-1 (0x7A) doesn't work
while d/dx (0x52) and A (0x42) works, therefore the CSR mask is 0xF.

Edited by user202729, 27 June 2019 - 04:01 PM.


#3 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 28 June 2019 - 09:17 AM

Update:

The reason why sometimes the 16 previous bytes change the behavior is that the
corrupted part doesn't directly affect the top most pushed LR, but a deeper one.
Therefore the control flow still continue normally for a while before being
redirected; however because part of the stack is modified, the execution may be
different.

When = or CALC = is pressed when there's (76+n) bytes before an, in the new mode
(called "mode an(76+n)"), the part starting from byte n being copied to the undo
buffer will be the top of the stack after the first "pop PC" (in strcpy function,
before that er12 and xr8 are popped, just like on ES PLUS calculators)

In mode an(76+n), modifying n first bytes of the undo buffer doesn't crash
the calculator. However, (as far as I can see) it's not possible to do basic
overflow in mode an86. It's possible in mode an90 (remember to set x to a valid
number such as 0 when CALC, invalid value may make the formula failed to execute
and basic overflow will fail. (In mode 90 it may not be necessary to enter the
"longer" formula (usually `X=Σ(X,1,1x10^9`)

Edited by user202729, 28 June 2019 - 09:42 AM.


#4 mrfrakes

mrfrakes

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 17 July 2019 - 09:56 PM

Not quite arbitrary code but there you go

calc.jpg


  • user202729 likes this

#5 yosik

yosik

    Newbie

  • Members
  • Pip
  • 3 posts
  • Gender:Male

  • Calculators:
    casio fx-991-ex

Posted 20 July 2019 - 07:04 PM

Hi!

I read http://casiocalc.wik...alculator-model but I do not understand how can I enter a new character.

Can you give me the details?



#6 yosik

yosik

    Newbie

  • Members
  • Pip
  • 3 posts
  • Gender:Male

  • Calculators:
    casio fx-991-ex

Posted 21 July 2019 - 10:23 AM

Hi all!
I tried to use enter unsupported symbols using unstable byte and got an strange result.

This symbol looks like "A" bold. If I press [=] when this character is on the screen and the output mode is decimal it looks like a colon.

In some cases (e.g. A+1 equals 11) A is interpreted as 10. It also can be stored in variables. When i tried to summ A and variable contains A i get 1A. What is happen?



#7 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 02 August 2019 - 03:51 PM

Hi all!
I tried to use enter unsupported symbols using unstable byte and got an strange result.
This symbol looks like "A" bold. If I press [=] when this character is on the screen and the output mode is decimal it looks like a colon.
In some cases (e.g. A+1 equals 11) A is interpreted as 10. It also can be stored in variables. When i tried to summ A and variable contains A i get 1A. What is happen?


That's the character with hexadecimal value 0x3A. It's used as hexadecimal A in Base-N mode.
In normal mode it evaluates to just "A"; however it's an unexpected value because calculator use BCD.
If you assign it to one of the variables (or Ans/PreAns) and press ON, the calculator will reset itself.



----------------

Progress update

The ROM of segment 2 and 1 are completely read. Reading of segment 3 is in progress.
There are some unknown obstacle that prevent segment 0 (read as data using segment 5) to be read the same way.

TODO: will try on official emulator.

Edited by user202729, 03 August 2019 - 01:21 PM.


#8 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 02 August 2019 - 04:38 PM

Not quite arbitrary code but there you go


I'm not very interested in hardware modification because I don't know how to do it, but if you can do that
you may want to see if you can get the ROM of the calculator using hardware modification, instead of (the
way I'm currently using) writing a ROP chain so the calculator prints its ROM on the screen in some format,
then use OpenCV or something like that to read back the result from a video capture of the screen.

Edited by user202729, 02 August 2019 - 04:41 PM.


#9 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 01 September 2019 - 02:46 AM

Progress update

The ROM of segment 2 and 1 are completely read. Reading of segment 3 is in progress.
There are some unknown obstacle that prevent segment 0 (read as data using segment 5) to be read the same way.

TODO: will try on official emulator.


Now the video containing the data of segment 3 is captured, but it may be too fast for my program to read.

Possible solutions:

1. Change the method so the output is slower.
2. Modify the program to make the recognition algorithm better.

I will post an update when there's any news, but I'm currently busy with other things.

#10 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 26 September 2019 - 06:05 AM

Update: segment 3 is done. (There's only 0xE3E bytes of code in this segment)

Unfortunately there's no DSR read command in the code (of segment 3).

Edited by user202729, 26 September 2019 - 06:06 AM.


#11 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 27 September 2019 - 12:32 AM

Update: segment 0 is in progress. Interestingly (or annoyingly), it's necessary to write 1 to 0xf004 to make content of segment 0 available in segment 5.

#12 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 27 September 2019 - 12:18 PM

Update: segment 0 is done. (Video length ~= 4 hours 57 minutes) (the whole ROM is dumped.)

There's no memory manipulation of segment other than 0, except the stack initialization code
(also exist in 570ES+).

Edited by user202729, 06 October 2019 - 10:11 AM.


#13 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 07 October 2019 - 01:56 PM

It appears that the DSR mask is either 0x1F or 0x3F.
Accessing segment 0 is not the same as segment 0x30, but it's the same as segment 0x40.

UPD: DSR mask = 0x1F.

Edited by user202729, 09 October 2019 - 12:32 PM.


#14 Tritonio

Tritonio

    Casio Fan

  • Members
  • PipPip
  • 39 posts
  • Gender:Male

  • Calculators:
    FX-5800P, FX-991ES+, FX-991EX, HP Prime

Posted 15 October 2019 - 09:16 PM

I don't understand more than half of what is going on, but if you are trying to dump the ROM, would it not be easier to extract it from the emulator instead of the actual hardware?


Edited by Tritonio, 15 October 2019 - 09:16 PM.


#15 user202729

user202729

    Casio Freak

  • Members
  • PipPipPipPip
  • 225 posts

Posted 16 October 2019 - 12:50 AM

The emulator ROM is different from the ROM of the real calculator.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users