8 replies to this topic

[jakiki6]

GUYS I DID IT.

 

For those who don't know "an": http://casiocalc.wik...alculator-model

 

I got the "an" character on real hardware.

I'm going to post an explanation and an image in a few days because I don't have time because of school.

 

Be prepared.

[anon34]

The existing method (http://casiocalc.wik...byte-extraction) doesn't work?

 

If there's anything new you can always edit the wiki. I don't really remember what this is all about, but can still be contacted.

[jakiki6]

That method didn't work for me so I found a new method but it is similar to the once you named (it takes some FDXX and replaces the XX with 00 so you can enter 20 to get FD20).

[anon34]

So the RAM is in segment 1 in 991DE X. Weird. (it takes an extra instruction to access the RAM)

 

The obvious thing to try is to see if code execution from the corresponding location will execute the RAM content as assembly (although it's likely that it would not work)

[jakiki6]

Ok so sorry that I'm a bit late.

 

You first need to get a box character (there is a forum post for it, I'll link it) in the complex numbers mode.

Then you press right for 2 seconds and press left once. If the cursor leaves the box, you'll have to do this again.

Press right once.

Type 99 followed by a constant (press shift 7 1 1).

Type 99 again followed by a square root.

Press del once and then left three times, del three times and left 2 times.

It should be a box with 99 now.

Press ENG.

 

There it is.

Btw the code lives in segment 0 while the ram + stack lives in segment 1. You can still do some kind of ROP.

 

The an symbol also seems to pop some registers and then PC from the stack.

[jakiki6]

Update: it seems like the rom uses the large memory model. This means that the pop pc actually does pop pc, pop csr.

csr is 4 bits but the input area lives in segment 0x0c which fits in 4 bits.

-> you can technically run code from ram but the emulator fails to implement it since it has a weird memory layout (segment 0x0c comes after segment 0x00)

[anon34]

Yes, the memory model is usually large (as in pop pc pops 4 bytes).
It's the same in other models.


...
 
What do you mean by "technically"? Either the real hardware can, or not.


Are you sure you're understanding it correctly?
Previously you said that RAM is in segment 1.
And what does the "input area" (I suppose it's the 200-byte buffer used to store the formula
currently entered on the screen) have to do with pop pc?

[jakiki6]

Ok so the emulator says that segment 1 is actually segment 0x0c (idk why it is like this but it makes sense when you'r rom is bigger than 64k) and the pop pc occurs when the an character is read. It pops it from the input area.

[anon34]

I don't get what you're referring to, is it...

 

* The way that the data is stored internally? Then it could be random coincidence because of heap allocation.

* How the calculator access the RAM as code?

* How the calculator access the RAM as data?

* How the calculator access code segment 1 as code?

* How the calculator access code segment 1 as data?

 

And is it on the official emulator or on the real calculator? They tend to be different.