Author Topic: Production TI-Nspire ClickPad Boot1 finally becomes writeable!  (Read 5166 times)

0 Members and 1 Guest are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Production TI-Nspire ClickPad Boot1 finally becomes writeable!
« on: September 15, 2012, 05:32:03 pm »
We've been working a lot on TI-Nspire ClickPad prototypes, which revealed to be very interesting models.



On the one hand, a very small hardware difference made their NOR Flash chip writeable:

Thanks to this, we were able to reprogram the boot1 contained in this chip, turning prototypes into production models accepting the OS published by TI.



On the other hand, we noticed that the prototypes ASIC CAS/non-CAS flag wasn't set.

Thanks to this, we cound turn non-CAS TI-Nspire prototypes into TI-Nspire CAS.



It seemed obvious to us, that on production models, there was probably no way to reprogram the ASIC.



But, somebody (who apparently wants to remain anonymous) followed our work very seriously and decided to do the impossible: make NOR chips rewriteable on production TI-Nspire ClickPad!

Even if no flashing has been attempted yet to our knowledge, the NOR chip from this modified production TI-Nspire ClickPad now reports itself as writeable when asked for its properties through an Ndless program. :o



The Boot1 is the central piece in TI-Nspire models security.
It's the one to check Boot2 and diags checksums and RSA signatures before launching them or not.

Being able to reprogram the Boot1 means being able to run any original, modified or 3rd party diagnostic or boot2 image! :o

Those who think in the short term certainly have in mind installing a CAS OS on a non-CAS TI-Nspire, thanks to a modified or 3rd-party Boot2.

The others are probably allready thinking to installing Linux, thanks to the U-Boot launcher we dumped on some old TI-Nspire prototypes.



However, such mod if a comprehensive documentation is ever released for it, will only deal with TI-Nspire ClickPad models. TI-Nspire TouchPad have their NOR chip included in the ASIC: there is probably no way to open that chip without breaking everything.





Source:
http://tiplanet.org/forum/viewtopic.php?t=10389&lang=en

More information: (fragmented and incomplete so far)
http://tiplanet.org/forum/archives_voir.php?id=6835
http://www.cemetech.net/scripts/countdown.php?/text/production_clickpad_information.tar.gz&path=archives
http://ourl.ca/16358/305205 (point 3)
https://groups.google.com/forum/?fromgroups=#!topic/tinspire/GQJO45-kXyk (point 3)
« Last Edit: September 16, 2012, 03:30:15 am by critor »
TI-Planet co-admin.

Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Production TI-Nspire ClickPad Boot1 finally becomes writeable!
« Reply #1 on: September 15, 2012, 06:22:47 pm »
meh, so still no modding with the cx :P
still awesome thought :D

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline Jim Bauwens

  • Lua! Nspire! Linux!
  • Editor
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1881
  • Rating: +206/-7
  • Linux!
    • View Profile
    • nothing...
Re: Production TI-Nspire ClickPad Boot1 finally becomes writeable!
« Reply #2 on: September 16, 2012, 02:43:00 am »
Wow, I thought that the copper pad going under the NOR chip was missing. But it looks like I'm wrong :D

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Production TI-Nspire ClickPad Boot1 finally becomes writeable!
« Reply #3 on: September 16, 2012, 03:22:59 am »
Wow, I thought that the copper pad going under the NOR chip was missing. But it looks like I'm wrong :D

I thought too...
TI-Planet co-admin.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Production TI-Nspire ClickPad Boot1 finally becomes writeable!
« Reply #4 on: September 25, 2012, 04:08:41 pm »
Finally, here is the mod to make the NOR chip (boot1) writeable on non-CAS TI-Nspire ClickPad.


Only for non-CAS TI-Nspire ClickPad for now.
Don't expect this for TI-Nspire TouchPad, CX or CM.

Source:
http://tiplanet.org/forum/viewtopic.php?t=10446
TI-Planet co-admin.