* WalrusIRC

You need to have 5 posts and not be part of restricted usergroups in order to use the WalrusIRC embedded shoutbox. However, you can also access our IRC channel called #CodeWalrus via EFnet.

Author Topic: Announcing Rip'Em, a third-party firmware for the HP Prime  (Read 7898 times)

0 Members and 1 Guest are viewing this topic.

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
Odd. I have a HW-C model though.

I hope it's just the keypad matrix being connected to different GPIO pins. A DVT model is too precious to sacrifice FOR SCIENCE! tinker recklessly with its UART.

Previously, I (ab)used the external interrupt pin hooked to the ON key, but I switched to the proper scanning method when I got it working.

I'll make a firmware to dump all GPIO registers on the screen. Since BXCBOOT0.BIN initializes the keypad GPIO to read the ON+Symb key combination, with a bit of luck the configuration registers will tell me where the keypad pins are located.

Offline xlibman

  • Omni founder & CW co-founder
  • Super User
  • Original 5
  • CodeWalrus Supporter
  • *
  • Join Date: Nov 2014
  • Location: Quebec, Canada
  • Posts: 18907
  • Post Rating Ratio: +100/-5
    • dj_omnimaga
    • DJOmnimaga.music
    • @DJOmnimaga
    • dj_omnimaga
    • @DJOmnimaga
    • /u/DJ_Omnimaga
    • DJOmnimaga
    • 112/11286
    • @djomnimaga
    • @DJOmnimaga
    • DJ Omnimaga music store
  • Gender: Male
Maybe you did something that causes the new version to only run on hardware C? I hope hardware differences won't make it too difficult to develop third-party firmwares or bootloaders for that calculator.
  • Calculators owned: TI-57, 73, TI-80 (broken), TI-81, TI-82, TI-83, TI-83+ (broken), TI-83+ (broken), TI-83+SE (broken), TI-84+, TI-84+CSE, TI-84+CE, TI-85, TI-86, TI-89T, TI-92, TI-Nspire, TI-Nspire CX (semi-broken), HP 39gII, HP Prime, Casio fx-7000G, fx-7400G+, fx-7700GE, fx-9750G+, fx-9750GII, fx-9860G, cfx-9850G, FX-1.0+, fx-CG10, fx-CP400
  • Consoles, mobile devices and vintage computers owned: Samsung i5510, Nexus 5, Atari 2600, Lynx, SMS, Game Gear, Genesis, Dreamcast, NES, SNES, N64, GCN, Wii, Wii U, GBA, DS, 3DS, PS2, PS3, PS4, PSP, PSVita, XBox 360, XBOne

Bandcamp|Reverbnation|Facebook|Youtube|Twitter
Retired Omnimaga admin (2001-11) and editor (2012-14)

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
Dumper's done. Hopefully without bugs.

It's in the gpio-dumper branch on the GitHub repository. I took a picture on my HW-C calc and attached the results.

Offline critor

  • Full User
  • Join Date: Dec 2014
  • Location:
  • Posts: 191
  • Post Rating Ratio: +6/-0
Someone needs to test on HW-A.
Visually, the DVT PCB looks like the HW-A PCB.

Offline xlibman

  • Omni founder & CW co-founder
  • Super User
  • Original 5
  • CodeWalrus Supporter
  • *
  • Join Date: Nov 2014
  • Location: Quebec, Canada
  • Posts: 18907
  • Post Rating Ratio: +100/-5
    • dj_omnimaga
    • DJOmnimaga.music
    • @DJOmnimaga
    • dj_omnimaga
    • @DJOmnimaga
    • /u/DJ_Omnimaga
    • DJOmnimaga
    • 112/11286
    • @djomnimaga
    • @DJOmnimaga
    • DJ Omnimaga music store
  • Gender: Male
Would this qualify as safe? I am curious because while under normal means I wouldn't mind sacrifying a calculator to test an OS for compatibility, I am currently short on money for new calculator purchases, so I am reluctant about taking the risk with my only HP Prime.
  • Calculators owned: TI-57, 73, TI-80 (broken), TI-81, TI-82, TI-83, TI-83+ (broken), TI-83+ (broken), TI-83+SE (broken), TI-84+, TI-84+CSE, TI-84+CE, TI-85, TI-86, TI-89T, TI-92, TI-Nspire, TI-Nspire CX (semi-broken), HP 39gII, HP Prime, Casio fx-7000G, fx-7400G+, fx-7700GE, fx-9750G+, fx-9750GII, fx-9860G, cfx-9850G, FX-1.0+, fx-CG10, fx-CP400
  • Consoles, mobile devices and vintage computers owned: Samsung i5510, Nexus 5, Atari 2600, Lynx, SMS, Game Gear, Genesis, Dreamcast, NES, SNES, N64, GCN, Wii, Wii U, GBA, DS, 3DS, PS2, PS3, PS4, PSP, PSVita, XBox 360, XBOne

Bandcamp|Reverbnation|Facebook|Youtube|Twitter
Retired Omnimaga admin (2001-11) and editor (2012-14)

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
Would this qualify as safe? I am curious because while under normal means I wouldn't mind sacrifying a calculator to test an OS for compatibility, I am currently short on money for new calculator purchases, so I am reluctant about taking the risk with my only HP Prime.

Beyond the "decline any responsibility" disclaimer, Rip'Em doesn't touch the NAND at all except for turning on (irrevocably until reset) write-protection for the recovery as the very first thing done, so a brick is theoretically impossible. I'd qualify it as safe.

The reckless part is about opening a HP Prime to connect to the UART and probe the GPIO registers through the GDB stub until something interesting happens. My calc has suffered no side effects, but I wouldn't recommend nor ask anyone to do that.

The dumper firmware merely dumps the contents of the GPIO registers on the screen, no reckless probing here. With screenshots running on different hardware revisions, I can hopefully pinpoint some differences between the revisions and code accordingly.

Offline Lionel Debroux

  • Full User
  • Join Date: Jan 2015
  • Location:
  • Posts: 231
  • Post Rating Ratio: +11/-0
    • debrouxl
    • 58/5891
My Prime is HW A, but I can't run VMs any longer on my main computer to reflash the Prime...
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TIEmu and TILP.
Co-admin of TI-Planet.

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
Yeah, Windows-only flashing sucks, but I don't think I'm up to the task of reverse-engineering the USB flashing protocol. I only have so much sanity to spare ;D

On the other hand, I've reverse-engineered a good chunk of the first 8 KiB (only 2 KiB worth of code, but still) of BXCBOOT0.BIN. There's enough stuff to piggy-back here to allow unlimited read access to the NAND.

It is acceptable to post such material here or should I put it somewhere else ?

Offline alexgt

  • Just your friendly neighborhood Ninja Stach Fancy Iron Man
  • Super User
  • Join Date: Dec 2014
  • Location: Behind you
  • Posts: 2611
  • Post Rating Ratio: +6/-1
  • Something should go here...
    • /u/alexgt9123
  • Gender: Male
This looks great! I can't wait for more features. I am sorry for not following this more closely ._.
  • Calculators owned: Ti-84+, Ti-Nspire, Hp Prime, Broken HP Prime, HP 48SX

Offline Lionel Debroux

  • Full User
  • Join Date: Jan 2015
  • Location:
  • Posts: 231
  • Post Rating Ratio: +11/-0
    • debrouxl
    • 58/5891
Quote
Yeah, Windows-only flashing sucks, but I don't think I'm up to the task of reverse-engineering the USB flashing protocol. I only have so much sanity to spare ;D
I had scratched the surface of that reverse-engineering work, and AHelper0 worked on it later as well. But there's no complete reimplementation of that protocol.

Quote
On the other hand, I've reverse-engineered a good chunk of the first 8 KiB (only 2 KiB worth of code, but still) of BXCBOOT0.BIN. There's enough stuff to piggy-back here to allow unlimited read access to the NAND.
Indeed, we already knew it.

Quote
It is acceptable to post such material here or should I put it somewhere else ?
What about the TI-Planet hpwiki, which already contains such kind of material, as well as other content unmatched elsewhere (not even in the HP community), that I know of ? :)
See https://tiplanet.org/hpwiki/index.php?title=User:BXCBOOT0_BIN_pastebin_com_SKw5xtev , dropped by an anonymous user in August 2013.
« Last Edit: March 08, 2016, 01:36:07 pm by Lionel Debroux »
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TIEmu and TILP.
Co-admin of TI-Planet.

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
Indeed, we already knew it.

Better than knowing it, now we can use it. Besides other things I figured out the subroutine that reads a NAND block, so now I can either write a reimplementation or piggy-back the existing one for Rip'Em.

What about the TI-Planet hpwiki, which already contains such kind of material, as well as other content unmatched elsewhere (not even in the HP community), that I know of ? :)
See https://tiplanet.org/hpwiki/index.php?title=User:BXCBOOT0_BIN_pastebin_com_SKw5xtev , dropped by an anonymous user in August 2013.

I used that page as a starting point, but I've done my reverse-engineering with only arm-none-eabi-objdump since I don't have IDA. I've requested an account, now waiting for the email.

By the way, why is the HP wiki separate from the main TI-Planet wiki and why does it require a separate account from TI-Planet's ? It's not very practical and the HP pages are needlessly hidden away...

Offline Lionel Debroux

  • Full User
  • Join Date: Jan 2015
  • Location:
  • Posts: 231
  • Post Rating Ratio: +11/-0
    • debrouxl
    • 58/5891
Quote
By the way, why is the HP wiki separate from the main TI-Planet wiki
IIRC, that was an aim, for neutrality or something along those lines. Even if hosted on the server which hosts TI-Planet, Inspired-Lua, ToutMonExam and whatever else I forget right now, It could have been accessible from a different URL later, with a redirect.
Of course, we now know that very few people care about tinkering with the Prime...

Quote
and why does it require a separate account from TI-Planet's ?
Indeed, no integration between MediaWiki and PHPBB was performed, but beyond the aforementioned aim, I don't know whether it's because it's "impossible" (as in, annoying) to do, or because "we" - mostly Adriweb - didn't spend time trying, or because of security reasons (deeper integration = more damage upon intrusion or legal attacks).
Hackspire was separated from anything else, too.
Trying to concentrate much shared community knowledge - and therefore power - into a single integrated infrastructure has clear downsides, all the more said concentration is performed partially without permission, as occurred recently on another TI community site.
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TIEmu and TILP.
Co-admin of TI-Planet.

Offline Vogtinator

  • Full User
  • Join Date: Dec 2014
  • Location: Germany
  • Posts: 109
  • Post Rating Ratio: +4/-0
  • Instruction counter
    • @UCii1mkxAsrIGvjFwS80YSmg
    • /u/Vogtinator
    • Vogtinator
    • ../../../cgi-bin/acct-view.cgi?userid=87663#
I used that page as a starting point, but I've done my reverse-engineering with only arm-none-eabi-objdump since I don't have IDA. I've requested an account, now waiting for the email.

IDA 5.0 is free and a huge step up compared to objdump -D...
  • Calculators owned: TI-Nspie CX CAS, Casio FX-85ES

Offline Jean-Baptiste Boric

  • Full User
  • Join Date: Jan 2016
  • Location:
  • Posts: 25
  • Post Rating Ratio: +2/-0
IDA 5.0 is free and a huge step up compared to objdump -D...

If I remember well, IDA 5.0 only supports x86 disassembly and it doesn't run under Linux.

Offline Adriweb

  • Full User
  • CodeWalrus Supporter
  • *
  • Join Date: Jan 2015
  • Location: France & Canada
  • Posts: 429
  • Post Rating Ratio: +7/-1
    • Adriweb
    • @Adriweb
    • Adriweb
    • @UC-UIrbk5SuaUCvnV6SQvt-Q
    • /u/Adriweb
    • Adriweb
    • TI-Planet.org
  • Gender: Male
About the wiki thing, I've now validated the account.

The HP Wiki we have is indeed separate from TI-Planet itself, but the TI-Planet wiki is however using the forum's phpBB account for single-sign-on user friendliness.
  • Calculators owned: TI-Nspire CX CAS, TI-Nspire CX, TI-Nspire CAS (x3), TI-Nspire (x2), TI-Nspire CM-C CAS, TI-Nspire CAS+, TI-80, TI-82 Stats.fr, TI-82 Plus, TI-83 Plus, TI-83 Plus.fr USB, TI-84+, TI-84+ Pocket SE, TI-84+ C Silver Edition, TI-84 Plus CE, TI-89 Titanium, TI-86, TI-Voyage 200, TI-Collège Plus, TI-Collège Plus Solaire, 3 HP, some Casios
Co-founder & co-administrator of TI-Planet and Inspired-Lua

 


You can also use the following HTML or bulletin board code to share it on your page or forum signature!


Also do not forget to check our affiliates below.
Planet Casio TI-Planet Calc.news BroniesQC BosaikNet Velocity Games