No replies to this topic

[Codev-Unified]

FX-82AU PLUS II 2nd Generation Hacking

Note: This is purely for educational purposes. If these methods are used for other purposes or cheating, I am not responsible for any problems or damage caused.

Base-N Mode Access

In clearer words, FX82_Calc4Life and I have found a way to access a portion of Base-N mode on the fx-82AU PLUS II 2nd Generation.

The calculator normally does not have Base-N available, but this method allows us to access a portion of Base-N mode. There are also some other glitches connected to this method, especially with the SHIFT, 3 menu.

Method 1. Reset the calculator

First, reset the calculator.

Press:

SHIFT, 9, 3, =, AC

Make sure you are starting from a clean state before continuing.

2. Enter POL(0,1)

Go into MATH IO and enter:

POL(0,1)

Press =.

3. Press the division symbol

Press the division symbol.

The display should show:

Ans ÷

4. Enter any number

Enter any number after the division symbol.

Then repeatedly press:

ABS(

Keep entering ABS( until the calculator will not allow you to enter any more ABS( functions.

5. Press the following sequence

Press:

=, AC, ↑, AC, ←

6. Check the result

You should now see the result from POL(0,1):

r = 1, φ₀ = 90

7. Store φ₀

Delete everything except the φ₀ value.

Store the φ₀ value in any variable you want.

8. Enter VERIF and LINE IO

Now enter VERIF, which is Mode 3.

Press:

MODE, 3

Then switch to LINE IO:

SHIFT, MODE, 2

9. Enter the variable containing φ₀

Enter the variable that you stored φ₀ into and press =.

10. The calculator should display Math ERROR

You should get:

Math ERROR

11. Press the left arrow and start the overflow

Press the ← arrow.

Then repeatedly enter:

√Ans

For example:

√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√Ans√ ...

12. Continue until the expression wraps around

Keep entering √Ans until the expression wraps back around to the beginning.

This should take approximately 200–300 characters.

13. Once it has wrapped around

Once the expression has wrapped back around to where you started, press:

AC, ←

14. Check the expression

You should now see the √Ans expression that you repeatedly typed earlier.

15. Trigger the error

Press = and wait approximately 5 seconds.

The calculator should display:

Stack ERROR

The next steps need to be performed quickly

The following steps need to be performed fairly quickly after the error appears.

16. Press the left arrow

Press the ← arrow.

17. Immediately press 1

Immediately enter:

1

18. Enter MATH IO

Switch back to MATH IO.

Press:

SHIFT, MODE, 1, 1

19. Press 1 two times

Press:

1, 1

20. Enter STAT mode

Now enter STAT mode.

21. Press AC

Press:

AC

22. Press one of the following keys/functions

Press any one of:

-

x²

x□

log(

ln(

23. Base-N mode

The calculator should now be in a partially functional Base-N mode.

 

 

The Glitched SHIFT, 3 Menu

Unfortunately, the SHIFT, 3 menu is glitched when accessing this state.

However, the glitch is also useful because it exposes characters and functions that normally cannot be accessed.

Some of the things available through the glitched menu are also obtainable through the basic overflow methods.

For example, we have been able to access functions such as:

MatA(

MatB(

MatC(

VctA(

VctB(

VctC(

Some of these functions work, while others can crash the calculator or cause additional glitches.

MAT / VCT Glitch

Another thing we found is that pressing = after entering one of these matrix or vector values can produce a strange table-like mode.

For example:

Mat(A)

Mat(

Mat©

Mat(Ans)

and:

Vct(A)

Vct(

Vct©

Vct(Ans)

can behave differently from the normal calculator modes.

In some cases, they appear to enter a glitched table-like interface.

 

 

Notes About This Discovery

This was one of the first things we started posting about on the forums, so there are still parts that are not completely understood.

We have been experimenting with:

• the Base-N access method

• the glitched SHIFT, 3 menu

• illegal characters

• matrix and vector functions

• different characters around the overflow area

• different results depending on where the characters are entered

Some combinations work, some produce different glitches, and some will crash the calculator.

I'm posting this mainly so other people can reproduce the method and experiment with it too.

Feel free to correct any mistakes or add any cool discoveries you find.

 

 

Power-Off Note

There is also something important to know about turning the calculator off while experimenting.

Pressing:

SHIFT, AC

does not turn the calculator off by itself.

To turn the calculator off, press:

ON

first, then:

SHIFT, AC

The calculator also does not turn itself off after 10 minutes, so it needs to be manually turned off.

 

 

Computation, STAT and VERIF More Hacks

Over the course of the 1.5 years we have been experimenting with the fx-82AU PLUS II 2nd Generation, we have found multiple other hacks, including computation glitches, STAT mode glitches, and VERIF overflow glitches.

Here are some of the many hacks we have discovered.

Also, credits to EnderFire09 and DaCoolCat123 for helping make these hacks possible.

 

 

Computation Hacks

There are quite a few interesting things you can do in normal computation mode.

1. Another way to get the strange result

Instead of using POL(0,1) to get the result of r = 1 φ₀ = 90, you can enter:

0▫0▫0▫

This should produce:

0°0′0″

2. Getting another strange result

Divide by any number, repeatedly enter:

ABS(

Then press:

=, AC, ↑, AC, ←

You should get:

0▫0e0e

3. Getting the internal ERROR token

Delete everything except the e or e.

This can result in a strange syntax error where the calculator only shows:

ERROR

4. Getting Eoo÷o From ERROR 

Repeat the same process again by dividing by any number, repeatedly entering ABS(, and using the same sequence:

=, AC, ↑, AC, ←

You should get:

Eoo÷o

This appears to represent ERROR in the calculator's internal token language.

The token information can be found here:

https://github.com/ilovecats4606/fx-82AU-PLUS-II-2nd/blob/main/tokentable.md

5. Token table

Me and FX82_Calc4Life are working on making a complete digital token table, including the smaller characters.

The current table is not complete yet, but we plan to post the full version once it is finished.

6. What the o means

The o in:

Eoo÷o

represents octal.

For example:

o101 = 65

in decimal.

7. Strange unit-conversion result

Enter:

1×1010

Then divide by any number and repeat the same overflow process.

You can get something like:

1m▶n mileacre▶m² mmHg▶Pa Pa▶atm

Unfortunately, the conversions themselves do not actually work.

 

 

Another POL(0,1) Computation Glitch

There is another thing you can do with POL(0,1).

First switch to MATH IO:

SHIFT, MODE, 1, 1

Then enter:

POL(0,1)

and press =.

Now divide by any number and use the same ABS( overflow process.

After that, delete everything except:

r

Press:

←

to move the cursor to the left side of r.

Then press:

SHIFT, DEL

Now press the square-root key 4 times.

Press =.

Then delete the four square roots, leaving only:

r

Press = again.

This should give a strange complicated equation.

You can then divide by any number and use the same Abs( overflow method to obtain the greater-than symbol in computation mode.

Normally, the greater-than symbol is only available in VERIF.

 

 

DISP Glitch

There is also a small DISP-related glitch.

Enter:

SHIFT, MODE, ↓, 4, 2

This changes the dots to commas.

Then enter:

POL(0,1)

The result should normally be:

r=1, φ₀=90

With the DISP change, it can become:

r=1;φ₀=90

This also allows us to obtain the k by using the same ABS( overflow process.

 

 

Basic Overflow in Computation Mode

Basic overflow can also be accessed in normal computation mode.

Press Ans, divide it by any number, and then keep stacking:

ABS(

Press = and then press the ← arrow.

The ABS( expression should now be in LINE IO format, which is useful if you want to get LINE IO formatted characters in MATH IO.

Delete everything except:

▯

Once you have the ▯, press the ← arrow once to place the cursor behind the ▯ character, then press the → arrow once.

You should now be in basic overflow in computation mode.

From here, you can keep entering fraction symbols and other functions.

Continue overflowing the expression until it wraps around to the beginning.

You can also use the VERIF basic overflow method, such as storing φ₀ or r in STAT mode Sub 0, and then spamming different characters until you start seeing the things you typed appear in computation basic overflow.

The fraction symbol, square root, and other symbols can be different in VERIF overflow because VERIF overflow uses LINE IO while normal computation can use MATH IO.

 

 

STAT Mode — Sub-mode 0

Unfortunately, we have not really found any major hackstrings in STAT mode yet, but we did find something interesting in STAT sub-mode 0.

1. Enter STAT mode

Enter:

MODE, 2

Then press AC.

About 0.5 seconds after pressing AC, press ON.

This can be difficult to do at first, but it gets easier with practice.

2. Check if it worked

If successful, you should see the STAT indicator.

You should also be able to access REG in the STAT menu with:

SHIFT, 1

If it did not work, go back to COMP mode and try again.

3. STAT sub-mode 0

If successful, you are now in STAT sub-mode 0.

4. Create the strange pattern

Enter any number that is:

• 69 or less

• not negative

• not a decimal

Then enter ! followed by either ȳ or x̄.

You can get these with:

SHIFT, 1, 5, 5

for x̄

or:

SHIFT, 1, 5, 4

for ȳ.

For example:

69!x̄/69!ȳ

This can produce a strange barcode-like pattern on the display.

Note: This may damage the screen on older calculators that have already been heavily used.

You can also experiment with the STAT functions through:

SHIFT, 1, 5

using A, B, and r.

Most combinations will crash the calculator.

 

 

VERIF Hacks

There are not many VERIF hacks yet, apart from the basic overflow method.

However, there are some interesting things you can do in MATH IO.

For example, enter an equation such as:

1+1

Then press =.

The calculator should display either:

TRUE

or:

FALSE

Now divide that result by any number and use the same ABS( overflow process.

This can give you the TRUE or FALSE result in the calculator's internal language.

 

 

VERIF Overflow

The VERIF overflow is more interesting.

Using VERIF overflow, we have been able to:

• dump ROM

• draw images

• access different modes supported by the calculator's chip

• produce different calculator errors

• experiment with different internal functions and characters

One of many errors we have been able to produce include:

Can't Solve

AC Break

Cursed Error Showing Random Characters

as well as other errors, including a glitched one depending on the function or pattern used.

Once you are already in basic overflow in VERIF, you can also experiment by repeatedly entering:

▫

 

 

Repeated ▫ Overflow 1. Spam ▫

Once you have VERIF basic overflow, repeatedly enter:

▫▫▫▫▫▫▫▫▫▫▫▫...

Keep entering it until the expression wraps around to the beginning.

2. Finish the overflow

After it wraps around, press:

AC, ←, =

This should produce a strange mode.

The exact result can vary depending on what was entered.

 

 

Experimenting With Different Characters

Once you are in VERIF basic overflow, you can experiment with different patterns.

For example:

▫Ans

or:

▫▫Ans

or:

▫AnsAns

or:

(-)Ans

etc.

There are many more combinations that can be tried.

The results vary a lot.

Some produce interesting glitches, while most of the other combinations will simply crash the calculator.

We have also found many other strange things using this like a cursed contrast menu and lots more.

The basic overflow method can also be reached by things such as storing r in STAT sub-mode 0, storing φ₀ in a variable, and then using the resulting overflow area.

There are still a lot of patterns we have not fully figured out yet.

 

 

Additional Basic Overflow Discoveries

There are also some interesting things that happen when using STAT sub-mode 0 and basic overflow.

If you store r in STAT sub-mode 0 and then use basic overflow, you can see the value of r represented as:

ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(ref(

This is ref( repeated 20 times.

Once you reach the M indicator and type a bit more, you will see this same thing as with any other illegal character stored into a variable.

The same goes for φ₀, which appears as:

<-sinh(,>-F-0.<-sinh(,>-F-0.

These are representations of the illegal values when they are exposed through the overflow.

 

 

Basic Overflow Corruption

Another thing you can experiment with is the basic overflow corruption.

In basic overflow, repeatedly enter:

.Ans.Ans...

until it warps back to the beginning.

Then press:

AC, ←, =

After that, keep pressing = or ←, =.

You will slowly corrupt the calculator.

As the calculator becomes more corrupted, you will slowly see pixels appearing and overlapping the .Ans pixels represented in binary.

If you then go into COMP mode, enter an equation, and press =, you will get different results depending on how much you corrupted the calculator seeing what looks like randomly scatted pixels all across the result.

 

 

Important note: All of the hacks reset the calculator once ON is pressed, except for STAT sub-mode 0.

 

 

Writing Text Using VERIF Basic Overflow

One of the more interesting things we found is that VERIF basic overflow can be used to replace the normal TRUE/FALSE text with custom text.

The maximum length we have found is 15 characters.

The basic idea is to replace the text that the calculator normally uses for TRUE or FALSE with tokens representing different characters.

 

 

1. Enter VERIF Basic Overflow

Enter VERIF basic overflow using the general overflow method.

However, do not enter the variable yet.

 

 

2. Create a 22-Character Overflow

First, create a string that is exactly 22 characters long:

1234567890123456789012

Then add a minus sign:

1234567890123456789012-

Press =.

You should get:

Syntax ERROR

 

 

3. Enter the Variable and Create Another Overflow

Now clear everything and enter the variable and use the basic overflow method.

Repeatedly enter:

.Ans

For example:

.Ans.Ans.Ans.Ans.Ans.Ans.Ans...

Continue doing this until the variable from earlier appears, such as:

A=0

or the equivalent for whichever variable you used.

Continue with the same .Ans pattern until you see the 22 characters appear.

 

 

4. Replace the 22 Characters

Now you need to replace the 22 characters.

Do not overwrite:

-

=

0

Only overwrite the original 22 characters.

After reaching the exact 22-character position after A=0, spam any number.

Once you have spammed characters far enough, you should eventually see a position where the characters change.

This changing position is what we use to place the text.

 

 

5. Using the Token Table

The calculator internally stores characters as tokens.

The token table we are currently working on is here:

Token Table

The current table is not completely accurate.

Me and FX82_Calc4Life are working on making a complete table, including the smaller characters and other characters that are harder to document.

We have already finished documenting the normal characters, while we are still figuring out the small characters, including one character that looks like a music note.

This may be difficult to document digitally because some characters are what look like strange pixels.

We will post the completed version when it is finished.

 

 

6. Example: Writing Hi.

As an example, we can write:

Hi.

The hexadecimal value for H is:

48

The internal token for H is:

->B

The problem is that ->B cannot be typed directly.

We therefore need to find the closest character that can be typed.

The closest typeable character before ->B is:

F

At the changing position, overwrite the current character to F.

Every time the cursor blinks, the position advances by one token.

Since ->B is two tokens after F, wait for the blink and then press the → arrow.

Do this twice.

You should now have:

->B

Immediately press the ← arrow before the cursor blinks again and delete the character to the left of ->B.

This keeps the ->B token in place.

Another way to do this is to rapidly spam the → arrow before the cursor blinks, then press ← and delete the character behind ->B.

 

 

7. Adding the i

We also need the letter i.

The hexadecimal value of i is:

69

Its internal token is:

Σ(

The token before it is:

log(

Wait for one cursor blink, then press ← and delete the appropriate character so that:

Σ(

is preserved.

Now put it directly after:

->B

You should have:

->BΣ(

This represents:

Hi

 

 

8. Add the Period

To add the period, place:

.

after the existing tokens.

You should now have:

->BΣ(.

which represents:

Hi.

 

 

9. Move the Text Into the Correct Position

Now delete the characters in front of the text if there is any.

Move the cursor behind the first character and keep deleting until you reach the original 22-character position.

The important part is that:

->BΣ(.

must be directly after the original 22-character position from A=0.

 

 

10. Continue the .Ans Pattern

Now we need to continue entering the .Ans pattern after the text.

The text itself needs to continue following the same .Ans pattern as if the text were not there.

The 22nd character should be Ans.

Do not overwrite the text.

You need to work out which characters are part of the pattern and which are your actual text.

For example, the pattern around the text continues according to the position the text occupies.

A simpler way to keep track of it is:

• If the text has an odd number of characters, the pattern after the text starts with Ans

• If the text has an even number of characters, the pattern after the text starts with .

So for:

Hi.

there are 3 characters, which is odd.

Therefore, after Hi. the pattern continues as:

Ans.Ans.Ans...

For an even number of characters, it would continue as:

.Ans.Ans.Ans…

Continue the same pattern until the overflow wraps around back to the beginning.

 

 

11. Finish the Overflow

Once the overflow wraps around back to the beginning, press:

AC, ←, =

The pattern should now appear as binary data, with:

0 = off

1 = on

This is also useful later for the image-drawing method.

 

 

12. Display the Text

Finally, press:

AC

The calculator should now show:

Hi.

in the place where the normal TRUE or FALSE text would usually appear.

 

 

Summary

The basic process is:

1. Enter VERIF basic overflow.

2. Do not enter the variable yet.

3. Create a 22-character string.

4. Add - and press =.

5. Enter the variable and start the .Ans overflow.

6. Continue until A=0 or the equivalent appears.

7. Continue until the 22 characters appear.

8. Spam characters until the changing position area appears

9. Use the changing position area to place the characters to produce text.

10. Create the tokens for the text you want.

11. Move the text directly after the original 22-character position.

12. Continue the .Ans pattern around the text.

13. Let the overflow wrap around back to the beginning.

14. Press AC, ←, =.

15. Press AC.

16. The custom text should appear where TRUE or FALSE normally would.

The maximum text length we have found is 15 characters.

One other important detail is that the next character in the pattern depends on whether the text has an odd or even number of characters.

If the text has an odd number of characters, the next character starts with Ans.

If it has an even number of characters, the next part starts with ..

 

 

Drawing Images Using VERIF Basic Overflow

This is probably one of the hardest things we have found so far.

The basic idea is to convert an image into binary, then use the values from the binary data inside the VERIF overflow.

For this example, we will make a small smiley face.

 

 

1. Enter VERIF Basic Overflow

Enter VERIF basic overflow using the usual method.

This time, do not create the 22-character overflow that was used for the text method.

Instead, enter the variable you stored the illegal character into and start entering:

.Ans

over and over.

For example:

.Ans.Ans.Ans.Ans.Ans.Ans...

Continue until you reach:

A=0

or the equivalent variable position.

 

 

2. Start the Image Position

Once you reach the A=0 position, continue using the same pattern.

The important part is that the following characters become:

A = .

= = Ans

0 = .

So the A=0 should now be replaced with:

.Ans.

 

 

3. Convert the Image to Binary

For the image, use:

0 = OFF

1 = ON

Each row of the image is represented using binary.

The hexadecimal conversion table is:

0000 = 0

0001 = 1

0010 = 2

0011 = 3

0100 = 4

0101 = 5

0110 = 6

0111 = 7

1000 = 8

1001 = 9

1010 = A

1011 = B

1100 = C

1101 = D

1110 = E

1111 = F

The image we are making is:

00000001

00000001

00101000

00101000

00101000

01000100

01111000

00000001

00000001

Each line represents one row of pixels.

 

 

4. Convert Each Row to Hexadecimal

Now convert each 8-bit binary row into hexadecimal.

The rows become:

00000001 = 01

00000001 = 01

00101000 = 28

00101000 = 28

00101000 = 28

01000100 = 44

01111000 = 78

00000001 = 01

00000001 = 01

So the hexadecimal sequence is:

01

01

28

28

28

44

78

01

01

 

 

5. Convert the Hex Values Into Tokens

Now convert each hexadecimal value into its corresponding calculator token.

For this example:

01 = mp

01 = mp

28 = (

28 = (

28 = (

44 = D

78 = 8

01 = mp

01 = mp

So the token sequence is:

mp, mp, (, (, (, D, 8, mp, mp

 

 

6. Separate Each Token

Each token needs to be separated using:

.Ans.Ans.Ans.Ans.Ans.

This is 11 characters.

The complete sequence for the smiley is therefore:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

This is the full data that will be used to create the image.

 

 

7. Place the First mp

Go back to the position after A=0.

Continue spamming any character until you reach the changing position.

To get the first:

mp

delete the changing character.

Then press the → arrow once after the cursor blinks.

You should now have the first mp in the changing position.

 

 

8. Place the Second mp

We need two mp tokens at the start.

Once you have the first mp, delete the 13 characters before it.

Then press the → arrow to put the cursor directly after the mp.

Now enter:

.Ans.Ans.Ans.Ans.Ans.

After doing this, obtain another:

mp

and place it after the first one.

You should now have:

mp.Ans.Ans.Ans.Ans.Ans.mp

 

 

9. Move the Sequence Into Position

Now keep pressing the ← arrow to move to the beginning of the sequence.

Put the cursor directly before the first mp.

Then delete characters before:

mp.Ans.Ans.Ans.Ans.Ans.mp

until the sequence is directly after the original A=0 position.

 

 

10. Continue the Full Sequence

Now continue entering the complete pattern from earlier:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

 

 

Continuing the Overflow

After placing the final mp, continue entering the same .Ans pattern:

.Ans.Ans.Ans.Ans.Ans.Ans.Ans.Ans.Ans...

Keep entering .Ans repeatedly until the overflow wraps all the way around back to the beginning.

Once it has wrapped around to the beginning, press:

AC, ←, =

The calculator should then display the small smiley face image.

 

 

12. Multiple Images

You will see multiple smileys appear.

According to FX82AU_Calc4Life, this is caused by the calculator's RAM.

So if you see more than one copy of the image, that is not necessarily a mistake in the image data.

 

 

Complete Example

For reference, the whole process for the smiley is:

Enter VERIF basic overflow

Do not make the 22-character text overflow.

Use:

.Ans.Ans.Ans.Ans.Ans...

until you reach:

A=0

The image starts at A=0

The positions become:

A = .

= = Ans

0 = .

Convert the image to binary

00000001

00000001

00101000

00101000

00101000

01000100

01111000

00000001

00000001

Convert binary to hexadecimal

01

01

28

28

28

44

78

01

01

Convert hexadecimal to tokens

mp

mp

(

(

(

D

8

mp

mp

Separate the tokens

Use:

.Ans.Ans.Ans.Ans.Ans.

between each token.

The final sequence is:

mp.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.(.Ans.Ans.Ans.Ans.Ans.D.Ans.Ans.Ans.Ans.Ans.8.Ans.Ans.Ans.Ans.Ans.mp.Ans.Ans.Ans.Ans.Ans.mp

Put the sequence after A=0

Place the first mp, create the second mp, then move the entire sequence into the correct position after the original A=0.

Finish

Continue the overflow until it wraps around to the beginning, then:

AC, ←, =

The smiley should appear.

 

 

The Basic Principle

This same method can be used for other images too.

The general process is:

Image

↓

Binary

↓

8-bit rows

↓

Hexadecimal

↓

Calculator tokens

↓

.Ans separators

↓

VERIF overflow

↓

Display

The smiley above is just an example.

Other images can be created using the same principle, as long as they can be converted into the required binary data and then into the calculator's internal tokens.

Note: The separators do not have to be exactly 11 characters long. If you want to make a bigger image, you can put two tokens together instead of separating each token individually. For example, using mp mp together will produce 00000010000001. This allows you to create larger images by combining multiple 8-bit sections.

 

 

ROM Dumping

Now, finally, we can look at dumping the ROM of the fx-82AU PLUS II 2nd Generation.

The original ROM dumping method was discovered by DaCoolCat123. The method and its development were documented on Reddit, where people continued experimenting with it and refining the technique.

Original Sources

• Reddit Part 1 — Dumping the fx-82AU PLUS II ROM

• Reddit Part 2 — Dumping the fx-82AU PLUS II 2nd Edition ROM

Part 2 explains that the technique uses a buffer-overflow vulnerability to produce ROM data as video/display output. The dumped data has visible flaws, but the hackstring still worked and was further experimented with.

Part 1 describes the dumped data as raw binary. The general idea is to push data from the calculator's RAM toward an area that can be displayed on the screen, allowing the output to be captured and processed.

How ROM Dumping Works

ROM dumping is different from the text and image methods described earlier. Instead of intentionally creating text or images, a carefully constructed hackstring pushes internal calculator data into an area that can be displayed.

The general process still uses the same overflow vulnerability.

Basic Setup

1. Enter STAT sub-mode 0.

2. Store r in a variable.

3. Use this to obtain an illegal variable.

4. Switch to LINE IO.

5. Enter VERIF.

6. Evaluate the variable.

After this, press ← to reach the overflow area. The original method then uses the overflow around the A=0 area.

The SP Offset

The original documentation identifies an SP offset of 44.

The position is measured from:

99999|A=0

The important position is 44 characters from that point.

In practice, after you reach A=0 in the basic overflow, enter 44 characters starting from the A=0 position.

After those 44 characters, enter:

->D-00%%

Replace %% with any character.

For example, the important sequence is:

A=0

12121212121212121212121212121212121212121212

->D-00%%

Do not use Ans. for this part. Use 12 or another character.

After entering ->D-00%%, continue spamming:

0

Keep doing this until you see the memory indicator.

Once the memory indicator appears, press:

AC, ←, =

This is the point where the ROM data can be produced as display output.

Why Dump the ROM?

Dumping the ROM can be useful for understanding things such as:

• The calculator's architecture

• How functions are implemented

• Potentially exploitable functions

• Creating an emulator

• The calculator's binary

• Disassembly

• Internal calculator behaviour

The original Reddit documentation describes the output as raw binary, which can then be processed and potentially disassembled according to the calculator's architecture.

Problems With ROM Dumping

ROM dumping is not simple and has several problems.

Some hackstrings are extremely long, and running the process can take around 20 minutes.

There are also stability problems. Parts of the screen or video output sometimes do not move correctly, which can make the dumped data difficult to capture.

The hackstring and its offset may also need further refinement.

Another problem is the calculator's limited RAM. Large programs and additional modes are difficult to work with because there is not much memory available.

Because of these issues, getting a complete, clean ROM dump is complicated.

Raw Binary Output

The general process can be thought of like this:

ROM data

   ↓

Overflow

   ↓

Display area

   ↓

Raw binary on screen

   ↓

Capture

   ↓

Binary file

   ↓

Further analysis / disassembly

Additional ROM Dumping Information

There apparently are more ways to dump the ROM that have been discussed in Discord (I am not in the Discord). There are also many other things that can be experimented with around the overflow area by changing the characters, functions, and positions.

Screen Warning

While experimenting with basic overflow, we discovered that a line can sometimes appear across the screen after completing a hackstring. This can happen while doing different things with basic overflow.

If a line appears across the screen, be careful, we think it sets the power to DC instead of AC, which can damage the liquid crystals.

For example, this can happen when experimenting with the glitched diagnostic menu and pressing AC.

If this happens, pressing:

ON

can reset the calculator and restore its original properties.

Be careful when experimenting with basic overflow, especially when testing different characters, functions, and glitches.

Experimenting With Variables

Another thing we have been experimenting with is writing values into variables such as:

A

B

C

D

This is more complicated than the normal text-writing method.

The values do not always appear to behave like normal text. They seem to contain hexadecimal digits or other internal values.

Interestingly, A, B, and C can sometimes appear the same even when different inputs were used.

There is also odd/even behaviour in some of these experiments.

This is still being experimented with, so there is a lot that is not fully understood yet.

Other Useful Links

• nX-U8100 Core Instruction Manual — CPU documentation

• fxesplus 82espa/rom.bin — a .bin ROM dump from the 82ES

These can be useful when looking into the calculator's CPU, binary data, and ROM structure.

 

 

More Experiments

There are still many more things we have discovered and experimented with on the fx-82AU PLUS II 2nd Generation.

A lot of these experiments involve the basic overflow and trying different characters, functions, patterns, and positions. Some produce interesting results, while others cause glitches or crashes. There are also many results that we still do not fully understand like one where the calculator crashes and then generates a table full of errors. 

Token Table

We have also been working on documenting the calculator's internal token system.

The token table is available here:

fx-82AU PLUS II 2nd Generation Token Table

The table is not completely accurate or complete yet.

We have finished writing all the normal characters, while we are still figuring out the small characters, which are not completely done. There is also one small character that looks somewhat like a music note.

Some of these characters are difficult to document digitally because they can look like strange pixels rather than normal characters.

ilovecats4606 created the token table, and FX82_Calc4Life and I are continuing to work on expanding and improving it.

Hopefully, by the end of the year, we can have a much more complete token table.

Other Useful Resources ROM Dumping

• Reddit Part 1 — Dumping the fx-82AU PLUS II ROM

• Reddit Part 2 — Dumping the fx-82AU PLUS II 2nd Edition ROM

Calculator Hacking

• Casio Calculator Forum — fx-82AU PLUS II Hacking

• fx-82AU PLUS II 2nd Generation Token Table

CPU / ROM Resources

• nX-U8100 Core Instruction Manual

• fxesplus 82espa/rom.bin

Credits

A lot of the discoveries in this post came from me and my friends, through experimenting with the calculator and testing different combinations.

ROM Dumping

The original ROM dumping method was discovered by DaCoolCat123. The method and its development were documented through the Reddit posts linked above.

Other Research

Thanks to:

• FX82_Calc4Life

• EnderFire09

• DaCoolCat123

• Other friends who has experimented with the fx-82AU PLUS II and shared information

Final Notes

This is a collection of the methods, experiments, and discoveries we have found while experimenting with the fx-82AU PLUS II 2nd Generation.

There are still a lot of things we do not understand yet. Some glitches are easy to reproduce, while others depend on very specific characters, positions, or sequences.

If you find something that is incorrect, missing, or incomplete, feel free to point it out. If you discover another interesting glitch, token, function, overflow method, or anything else related to the calculator, feel free to share it as well.

This is also my first forum post, so corrections and additional information are welcome.

This is purely for educational purposes. If these methods are used for other purposes or cheating, I am not responsible for any problems or damage caused.

Lastly, sorry for uploading so late.

 

 

Codev-Unified