|
|
本帖最后由 critor 于 2013-10-26 18:21 编辑
There are two types of TI-Nspire calculators:
- CAS models which return expressions you can transform: TI-Nspire CAS+, TI-Nspire CAS , TI-Nspire CX CAS , TI-Nspire CM CAS...
- non-CAS models which simply return numbers like any normal calculator: TI-Nspire+, TI-Nspire , TI-Nspire CX, TI-Nspire CM...
Some exams in some countries (United States, Portugal...) forbid the use of CAS calculators. That's why TI has split the TI-Nspire handhels in two sister lines. It is obvious that you can't (at least officially) install a CAS OS on a non-CAS calculator and vice versa.
In the hardware, the difference between CAS and non-CAS is using two separate chips:
- the NAND chip
- the ASIC chip
Each of these chips contains a code identifying the calculator as CAS or non-CAS, and these codes are verified and compared at various times:
- by the Boot2 when a new OS is being received and installed
- by the Boot2 each time the OS is being launched
- by the installed OS when a new OS is being received and installed
However Nlaunch, the third party OS launcher released last year exploits a flaw in the Boot2 1.4 to remove the first two checks above, letting you install and run any TI-Nspire OS, and among other CAS OSes on non-CAS calculators.
Intended or not, this attack against the TI business model seems to have greatly displeased. For the the last few months, we've been stroke on all sides by a number of new various protections on the new hardware and software versions of the TI-Nspire.
In a Previous news, we just spotted a new additional protection in the new TI-Nspire OS 3.6 . Indeed, if the CAS version is installed on non-CAS calculator with the help of Nlaunch, the OS just freezes upon startup on the grey screen. So it seems now that once launched, the OS checks the CAS / non-CAS codes one more time in the NAND and ASIC chips.
And what happens when a worker doesn't fully conform to the original plan of the architect-engineer? Quite often the building finally collapses...
With all these protections systematically added around mindlessly (aparently) in the last months and violating the original security model, I was fearing that TI might en up bricking some TI-Nspire... and unfortunately, I was right!{:thumbdown:}
Before the release of the first TI-Nspire, the TI-Nspire ClickPad for back to school 2007, Texas Instruments freely distributed numbers of prototypes during the 2006-2007 schoolyear. I do not know what their lucky owners told TI, but I guess they didn'r really appreciate the gift as many of them rushed to resell it online after the release of TI-Nspire, but of course with a price similar to the production models one. A trained eye will notice several small differences, but the only one common to all prototypes is the mention of an 'EVT', 'DVT' or 'PVT' code in the serial number on the back.{:thumbdown:}
 
Until the release of color TI-Nspire CX for back to school 2011, online resale shops have been flooded with prototypes apparently very similar with the production models. But even if we put aside the dubious morality of this behaviour, it was nothing more than a monstrous scam! Indeed, prototypes Boot1 and Boot2 validated the signatures with the development keys and not the production ones. As a result:
- These prototypes refused to install any OS released on the official TI website. And As TI doesn't release development OSes it was impossible for you to update the prototypes which remained stuck on old 1.1 and 1.2 versions!{:thumbdown:}
- If you had the bad idea to remove the OS via the maintenance menu, your prototype became unusable because no released OS could be installed on it!{:thumbdown:}
Fortunately, TI-Planet has taken this cause to heart and tried its best to repair the scams you experienced.
- We began first by recovering several functional prototypes from which we could extract some development OSes, allowing you to repair prototypes which had their OS removed!{:thumbsup:}
- Then, we noticed on these prototypes that the NOR chip hosting Boot1 was not write-protected. After many months of hard work, we finally proposed you a tutorial based on a Boot1 reflashing in order to transform your TI-Nspire ClickPad DVT prototypes into production models, allowing you to finally install the latest production OSes available at ti.com!{:thumbsup:}
However, the ASIC chip on TI-Nspire ClickPad DVT prototypes doesn't include the non-CAS / CAS identification code. The NAND chip being flashable, a simple modification of its CAS / non-CAS code allows for example the transformation of a non-CAS prototype into a CAS one. This implies that the historical CAS / non-CAS checks are based on differences tests. The code in the ASIC chip being neither CAS nor non-CAS, the test is successful in all cases.{:thumbsup:}
So for months and now years, you've been able to use your TI-Nspire ClickPad DVT prototype as a production model. Unfortunately, you can't anymore. The OS 3.6 freezes at startup on all TI-Nspire ClickPad DVT prototypes, even those whose CAS / non-CAS NAND case has never been changed! :o
So it seems that the new CAS / non-CAS verification on the startup of OS 3.6 was not coded in the same way as the historical verification, using tests of equalities and not differences! In consequences, ASIC verification fails on all these prototypes since there is no CAS or non-CAS code in the ASIC!{:thumbdown:}
This raises some questions about the process of development. Does this error means they do not even test development versions of their new OS on TI-Nspire ClickPad / TouchPad anymore and simply generate them automatically? Or was this change intended to prevent students using six years old non-CAS prototypes turned into CAS ones during exams? It would be really extreme, but not surprising in the context of what we have been experiencing during the last months...
Do you think you simply have to reinstall an earlier version of the OS to repair your prototype? It would have been too easy... Although stuck at the grey screen, the OS 3.6 still has the malice to increase the minimum installable OS version stored in NAND... to 3.6! The only OS that you now have the right to install is the 3.6 which won't work! Your calculator is now unusable... TI just destroyed your rare TI-Nspire ClickPad DVT prototype without warning!{:thumbdown:}
Note that the tool Nlaunch, even if it can't make OS 3.6 work on these prototypes, has the advantage of avoiding their bricking when attempting to use OS 3.6, since it makes Boot2 ignore the minimum installable OS version programmed in NAND.
In addition to the ones you may have purchased online, TI-Planet distributed many of its TI-Nspire ClickPad DVT prototypes, either to developers or to contests winners, and so we have to warn you:
DO NOT INSTALL OS 3.6 ON A TI-NSPIRE CLICKPAD DVT PROTOTYPE - STAY WITH OS 3.2 OR OLDER
There is so far no way to use the OS 3.6 on these prototypes; it is useless to try, even with Nlaunch.
If it's already too late for you, the general idea to ​​repair follows the pattern below:
- if your boot2 is 3.0.1, reflash Boot2 1.4 using an external RS232 interface
- remove the minimum installable OS version using the DowngradeFix tool
Feel free to answer in the TI-Planet topic if needed - we'll try to help everybody.
Let's hope that the TI- Nspire ClickPad DVT prototypes will remain the only victims of the new Texas Instruments behaviour, but it's not impossible to find other similar cases, as a security model designed 6 years ago was suddenly changed.{:thumbdown:}
Source:
http://tiplanet.org/forum/viewtopic.php?t=13280&p=151025&lang=en
|
|
发表于 2013-10-26 00:10:41
沉默卡
变色卡
千斤顶
显身卡
发表于 2013-10-27 11:14:27
楼主