Downgrade with Ndless 3.6 and TI-Nspire CX HW-J+

critor

For back to school 2013, we discovered the existence of the new TI-Nspire CX hardware revision J, and since then hardware revisions K and L.

These new calculators come with the 3.2.4 version of the Boot2 which is not exploitable by nLaunchy, the third party OS launcher (OS = operating system) that allowed to install a version of prior to the minimum installable version number set in a specific area of the NAND memory.
Even if the 3.1 version of the nLaunchy compatible Boot2 was flashed using an USB / TTL interface, it did not work properly, aborting on a file system access error in the RS232 log.

Therefore on TI-Nspire CX HW-J+ it was:

• impossible to use Boot2 3.1
• therefore impossible to install nLaunchy
• impossible to install an earlier OS than the minimum authorized version (set to 3.2.4 or 3.6 depending on the context)
• and thus impossible to install Ndless 3.1 that required OS 3.1, Ndless being the jailbreak letting you use unofficial applications that require full access to the hardware and its power
  

This weekend were released together Ndless 3.6 and nLaunchy 2.4.
It becomes now possible to enjoy Ndless on TI-Nspire CX HW-J+ !
But nLaunchy remains unusable as still relying on the Boot2 3.1 incompatible with these calculators.

Tonight, we're not going to solve the problem in any way, but we'll try to understand a little better what TI has designed in hardware revision J to block Boot2 3.1.
To do this, we will try to 'downgrade' a TI-Nspire CX HW-J, by installing older versions of the OS.
This is certainly something useless, since OS 3.6 now has all the benefits with Ndless - but it is necessary in the context of this article, out of scientific curiosity. ;)

Ok we don't have nLaunchy. But we have the new nsNandMgr v2.0 for Ndless 3.6, the utility to reprogram the NAND memory which lets you for example reset the minimum installable OS version to 0.0.0.0.


And indeed, it works! Once this minimum version is reset, we can actually install the old OS following :

• 3.3
• 3.2.4
  

But it's not surprising that it works so far, since the first TI-Nspire CX HW-J+ originally came with OS 3.2.4.

Oddly, receiving OS 3.2.3 or earlier is denied by the OS 3.6 at the end of transfer, although the minimum version number reset to 0.0.0.0 is not a problem anymore. :o
It's just that TI has added an additional protection in OS 3.6 (one more) which must check the received OS before installing it. Regardless, you just need to completely remove the OS 3.6 via the maintenance menu to entrust the OS installation to the Boot2.

After resetting the minimum version and deleting OS 3.6, we can actually install the 3.2.3 OS and it works!

However, versions 3.2.0.1212 and 3.2.0.1219 do not work once installed, putting the calculator in a restart loop. :(



We could have stopped with this, but we still attempted an installation of OS 3.1 and oh... how strange... it works half. :o
Unlike OS 3.2.0 it does not put the calculator in a restart loop and starts, but it's obviously unable to display any icon or string correctly, saying it cannot find its resources.



And this is where we begin to understand what TI has done... ;)
If OS 3.1 doesn't find its resource files containing icons and strings, it's that it just cannot access the filesystem content included in NAND memory.

TI has probably blocked read access to the NAND for 3.2.0 and earlier versions on HW-J+, by changing a hardware port for example.

And some of you will are going to object to me that if the OS has still managed to launch its code which is stored in the same memory, it's that it could be read...
True - except that it is the Boot2 that handles loading the OS code from the NAND storage memory to the SDRAM. And as it is Boot2 version 3.2.4≥3.2.3, it knows the new HW-J+ NAND memory access method.

Finally, we notice that the write access to the NAND memory was probably blocked also on HW-J+ for versions 3.2.0 and earlier, as the calculator in the previous state reports us nonsense about the filesystem, with null or even negative sizes, implying among other things that any attempt to write anything is going to fail.




Finally, after six months we have finally solved the mystery. You can downgrade your TI-Nspire CX HW-J+ down to OS 3.2.3. :D
(note that there has existed a version 3.2.2 coming preloaded on some TI-Nspire CX but I have unfortunately no copy - so by default we'll assume HW-J+ compatibility starts with version 3.2.3)

All 3.2.0 and earlier versions of the OS and Boot2 are incompatible with TI-Nspire CX HW-J+ due to an alteration of the NAND memory access way that only 3.2.3 and later know how to perform correctly. :(




Download :
nsNandMgr v2.0

Link :
Tutorial to downgrade from OS 3.6

549597890

still thank you for exploring!