Anyone know if you can program assembly for this thing yet... i think that's gonna be the key to programming it, cause then we can implement all those experimental virtual machine java things that people made for the ti89 on the cas that runs at like 90+ mhz... or do we gotta wait years for people to reverse engineer the os... zzz i want one anyway :P

imagine... programming in lua... or better yet, a stripped down c# + .net framework via mono... lol that would own no doubt :P

No, we can't, and they certainly will never allow it. Despite how it would benefit them, they want to keep the OS completely locked down.

Take it from me, it's quite useless at the moment.

Are you guys trying to find some hole in the os to run arbitary code, or just run a command in the os that means execute some program, cause the os functions might not be so much use

Yes, we're looking for a hole in the OS to run arbitrary code.

1. Would it really be that hard to execute Assembly code? If it was a 83/84+/SE, one could jump PC to the address that the code's stored at.

2. I currently have no access to any Nspire products (nothing runs on a non-Intel Mac, and I'm broke), so I can't do anything more than speculate right now. Still, is nothing accessible from the TI-84+ keypad?

1. Yes, it's really that hard. We can of course run any 83+/84+ assembly, just no ARM assembly. We have no access to the Nspire's memory, except the part of the Nspire filesystem where the 84+SE's memory is stored (in a series of files).

2. No, nothing is accessible from the 84+SE keypad. It's complete emulation of the 84+SE, so no, there's no way to gain access to the rest of the calculator.

How the OS is able to manipulate some parts of the Nspire's hardware (such as turning on/off, USB, etc.) is through a series of traps, which are special opcodes that, when run, the emulator will intercept and take control, and do something you ask of it, like writing to one of the files that holds the 84+SE's memory, messing with the USB controller, etc. There are a lot of these, and the non-USB ones are mostly unknown. They seem to have no effect when directly executing them, but there's no telling what they really do without having access to the Nspire's unencrypted ROM.

I could've sworn I already replied to this (it might come through later), and I don't feel like typing what I typed earlier, so I'll just say:

1. Yes, it's really that hard. You can't just jump to Nspire code, it's completely hidden from the z80 emulator.

2. No, nothing is accessible from the 84+SE keypad. You can execute emulator traps which tell the emulator to do something, like write to the files in the Nspire filesystem that contain the 84+SE archive, lock the keypad, mess with the USB port, and stuff like that. They're very simplistic and likely not exploitable (although a couple are).

There's that other reply. :)

Thanks for answering those questions... twice. These aren't very nspirational circumstances.

Maybe we can make a ticalc petition where we pledge not to buy one, except for reverse engineering purposes ofcourse :P, until Ti starts listening to the end user and not the committe of teachers that obvioussly do not have a clue...you know they "nSpired" Ti (actually, i think Ti is looking to make money licensing a sdk... they won't).

the only think Ti will accomplish however is forcing ticalc to move its server to Sweden, or never host a nspire file... cause you know it'll be illegal to use the nspire xD Perhaps, Ti also invented Ti warez... and soon we'll be torrenting quadratic solvers and tetris lol

Don't look now, but ticalc is already hosted from Sweden: (See link) :-)

It shouldn't matter anyway, as I don't think ticalc looks kindly upon such things. As for the precise boundaries, I'm not motivated enough to find an official statement at the moment..

How the HECK is TI hosted in Sweden??!!!???!?!?!?! I thought the whole point of being *Texas* Instruments was to have their HQ in ******TEXAS******!!!!!

Btw, TI sucks. They come up with an awesome calc like the Nspire, dangle it in front of our noses like a carrot to a rabbit, and then spray rabbit-poison all over it so we can't even touch it :(!!!

Ps. I live in Texas :)

Again, see link:

"ticalc.org is not affiliated with Texas Instruments Incorporated in any way."

I wasn't talking about TI, just ticalc.org. People should read more background information!

Back to the reverse compiling the os... TI kept the old 92 locked down, but people managed to find a loophole anyway! Where there is a will, there is a way, or it's useless!

Has anyone tried just running the OS through a file extractor before dissecting it any further? FileJuicer (see link) was able to retrieve most if not all parts of the TI-84 ROM.

Oops! Well, I feel stupid now. I only skimmed through that post.

Y'know, I have a sneaky suspicion that even if we had a team of thousands of hackers working on decrypting the OS and figuring out the Nspire, it would still
(a) be impossible STILL

Oops! Well, I feel stupid now. I only skimmed through that post.

Y'know, I have a sneaky suspicion that even if we had a team of thousands of hackers working on decrypting the OS and figuring out the Nspire, it would still
(a) be impossible STILL, or
(b) take only slightly less longer to figure it out.

My reasoning on this is because we have lots of *competent* people who are also probably pretty smart, and they haven't made much headway into this.

That's my two bits without an Icarus reference (inside joke-ish)

I'm not sure if it's already been said here, but no, the OS is encrypted and transferred encrypted to the calculator, where it's decrypted, validated, and then written.

The only way we're going to see any code to look at is if we physically remove the chip and dump it, which is easier said than done if you've opened it and looked.

so is it possible then to somehow dump the rom.. i mean by physically hooking up wires and doing this however it's done... etc.

or is the os decrypted in real-time every time you turn on the calc?

I believe it is decrypted in real time, but who knows at this point, really.

It doesn't matter if it is, because if we were able to dump the entire memory, we could also get whatever decryption key it uses.

Yes, it is possible to extract it, but as I said, it's very difficult. If you don't believe me, I welcome you to try it.

This might take some time. i heard you got some information whether the os is accepted by the calc or not. if the decryption isn't that hard, it could be possible to manually change the os and see what happens (hopes the os just decrypts the op code without the mem)

if the emulated ti-84 uses main RAM for the emulation, then maybe we could have some program dumping ram while we physically short address lines on the RAM chip to dump the hidden portions of RAM....others have used similar techniques..

I've already tried this and it doesn't work.

By that, I mean I've tried reading outside the boundaries of the emulator memory to see what it does. The emulator trap that lets you write directly to the Nspire filesystem for storing emulator data will only let you go to those.

The RAM, Flash, and OS itself are all loaded into RAM, so you can use the trap to set bits in Flash as well as reset them. This is good for a lot of reasons and opens up good possibilities, but it's a hack at best and would only work on the emulated 84+SE, naturally, and not the real one. So it's somewhat useless.

What I meant was to _physically_ short the address lines on the memory IC while reading it in TI-84 mode. Possibly TI left encrpytion keys floating around in "non-accessible" memory ...

You know, the funny thing is; IIRC, Texas Instruments INC's actual headquarters is somewhere in California. :p

I was wrong, it actually is Dallas Texas. Which would make sense, but for some reason I thought I heard it was in California.

From what i've seen, can people make intense text adventures for the Nspire?

There is already a minesweeper game and some other things.