Recently, my Casio Prizm became a hard brick (would not turn on, not even for "emergency OS updater" modes) and had to have its motherboard replaced. I paid nothing. Thanks Casio for having a three year warranty (my calc broke the day after its second anniversary), you're awesome. Oh wait, maybe you're not so awesome. I'll explain.

As you probably know, Casio makes two models of the Prizm: the fx-CG 10 and the fx-CG 20. The 10 is sold mostly in the Americas, and the 20 in Europe and Asia. These two models are absolutely the same, inside and outside, except for two things: the model label and the fact that the CG 10 can't open g3p files not "provided by Casio" or created on the calculator (with the screen capture feature or using the Geometry add-in, for example).
Whether a calculator is a CG 10 or 20 is defined by some bytes in the lowest flash sector, where the bootloader resides. This area should never be modified, and not even OS updates so far change a thing in it.

As a owner of a fx-CG 20, I could view any g3p picture with it. I could include g3p pictures, created on the computer with Casio's converter, inside eActivity files, and all was well. That was, until the day the calculator had to be repaired.
The repair consisted of replacing the motherboard, and all the data I had on the previous one was irrecoverable - the only way anyone could recover it meant going to the point of desoldering the flash chip to read it with an external reader, mounting the relevant parts of the memory as a FAT filesystem, and copying my files to the new motherboard.
The result: now I got a Prizm that's new on the inside, but has the old shell, screen and keyboard. And I lost everything I didn't back up (mostly things I didn't need, so that's not a big problem).

I noticed one thing when I got the calculator back: it would not read eActivity files with g3p images ("type invalid" error) nor any non-Casio-provided g3p file. That is, just like a fx-CG 10.
I was already suspecting this would happen, because some time ago a friend had to get her Prizm repaired too, and the same thing happened to her. However, because the calculator was not mine I could never fully investigate.

Both calculators now show, on the "System" menu, a strange version number that differs from the usual 01.04.0200 (for CG 20) or 01.04.0100. Mine is 01.04.3201. Also, the versions for the "messages" on mine are all 01.05. This is ahead of other calculators with OS 01.04 installed. I didn't notice any difference in the messages but obviously they may exist.

Using an in-development version of Utilities, triple-checked to ensure it would not break any calculator again (still, who knows?) that has a System Information screen, displaying several strings from the device's memory, including from the bootloader, I got this:

(the source code used to obtain this screen can be found here)

So yes, my calculator is definitely a fx-CG 10 that says fx-CG 20 on the case. The "true" OS version, i.e. the one not modified for display on the "System" menu, is the same as on every other calculator with OS 01.04: 01.04.0000. The last four bytes are modified by the OS depending on the calculator model, and perhaps some other flags too (explaining my strange version number).
Also note how the PCB model is 755A instead of 755D.
I believe this is meant to indicate this is a PCB that was used as a replacement. I'm fully OK with that... just as long as my calculator had the same features it had before the repair, that is, being a fx-CG 20 and not a fx-CG 10!

I don't exactly need the g3p viewing feature, except to open the eActivity files I had created with built-in images, because of the JPEG Image Viewer I developed. Still, I'm going to bother Casio Europe and Ename (their tech support representatives in Portugal, who did the repair) with some emails.
This doesn't quite justify sending my calculator back for another "repair", and I really don't feel like running an "OS update" sent by Casio to rewrite the bootloader (as if they would do that...), but at least I'll let them know they are turning fx-CG 20s into CG 10s and that's illegal here (since you're effectively getting, as the result of a in-warranty repair, a product with less features than the original ones).
Thank you for writing this up so thoroughly, gbl08ma. I enjoyed reading your story, especially after knowing the first three-quarters of it with your initial panic in #cemetech and subsequent need to send it back to Casio for repairs. You say that the bytes that tell the calculator whether it is a fx-CG10 or fx-CG20 lie on the same flash sector as the bootloader, and the whole reason you had to send your calculator back was that you discovered you had run code that led to the bootloader getting overwritten. Does that not mean that with some very carefully-written code, you could change the bytes to make it think it was an fx-CG20 again? Of course, I'd be wary of a general purpose tool out in the wild for that, for fear of making Casio start having reasons to lock down their calculators.
Judging by some commented pieces of code on the source of INSIGHT, I believe Simon Lothar has at least tried to change the relevant bytes in the bootloader. The code would be mostly functional if we had access to the flash erase/write code, which he has (if it was obtained through reverse-engineering or some other means, I don't know*) and calls "flashbios". This I know because there's a commented #include for "flashbios.hpp", but of course this header file is nowhere to be found in any of the source files he shared with the world.
I believe this is exactly for the reason you specify: to avoid having such a tool out in the wild.

On the email I sent to ENAME, I explained exactly what the problem was with g3p pictures and then, just to make sure it is well understood, I said that it now shows the exact same behavior as a fx-CG 10 (so that it is clear as water that they effectively changed the calculator model with the repair). Obviously, the best they could do without me sending the calculator back to them, is sending some form of "OS update" that I could run to rewrite the relevant bytes - and I believe that this, even if developed by Casio, has a great chance of failure. Of course they won't do that (because it would work as a general-purpose tool to switch CG 10s to CG 20s), but I'm waiting on their comments anyway. As I said, I don't really need the functionality as I have my image viewer, but g3p pictures integrate much better with the OS that my image viewer will ever be able to. Anyway, I'm not available for sending the calculator for "repairs" again.

*I managed to obtain the flash erase code by "some other means"... on my first email to Simon, asking for help, I mentioned that he knew how to write the flash back, but on his reply several days later (when my calculator was a hard brick already), he didn't touch the subject.
I would really like to have a ROM dump of your OS 1.04.0201
It is a bit complicated using Simon's Insight add-in and takes about three quarters of an hour.

Download Insight.g3a for fx-CG10/20 here:
https://tiplanet.org/modules/archives/download.php?id=394716

Install this add-in by connecting your calculator to a PC and copying it to the calculator's drive.
Or install it by receiving it from another calculator via 3Pin cable. Check the link menu cable setting!

Now follow these steps:
- Start Insight and press [F1] for the memory viewer
- Press [F1](ADDR) and type in 80000000, then press [EXE]
- Press [F2](SAVE) and type in 00200000 (maximum file size is 2 MB), then press [EXE]
- This will now take almost 7 minutes to complete...
- When this is done, connect the calculator to a PC (or to another calculator via 3Pin cable)
- Move the file MEMORY.BKP onto your PC's desktop and rename it to M1.BKP
- Then disconnect the calculator from the PC by pressing [AC/ON]

- Now this process has to be repeated another five times...
- Start Insight and press [F1] for the memory viewer
- Press [F1](ADDR), type in 80200000 ... Press [F2](SAVE), type in 00200000 ... Name the PC file M2.BKP
- Press [F1](ADDR), type in 80400000 ... Press [F2](SAVE), type in 00200000 ... Name the PC file M3.BKP
- Press [F1](ADDR), type in 80600000 ... Press [F2](SAVE), type in 00200000 ... Name the PC file M4.BKP
- Press [F1](ADDR), type in 80800000 ... Press [F2](SAVE), type in 00200000 ... Name the PC file M5.BKP
- Press [F1](ADDR), type in 80A00000 ... Press [F2](SAVE), type in 00200000 ... Name the PC file M6.BKP

Please send all six Insight files (M1.BKP ... M6.BKP) to my email address teamfx.casio@gmail.com

Thank you and sorry for the inconvenience!
TeamFX wrote:
Simon did not change the boot code because this is an unnecessary risk. He simply changed the relevant OS function that checks the type ID at 0x300.

Clever.

I too would like to have a ROM dump from my machine, but to be honest I haven't even put Insight in there, and I more or less promised to myself that any adventures in OS reverse-engineering would all be done using the emulator (which can't test some things like power-off, meaning I had to use real hardware). Using Insight to read flash memory and write files to SMEM with Bfile syscalls shouldn't do much harm, though... I'll just do the dump in multiple steps like you described and join the resulting files together with cat (I use Linux).

I will also take the opportunity to measure the time it takes to write the files, because to me it seems this new motherboard has much faster flash access - however, it can be just because it is new and doesn't have many files yet.

Quote:
Could you take some high-res photos from the new PCB?

I never opened a Prizm before and I don't feel like doing it two days before a maths test. That 755A PCB model is intriguing me, though, so some day I'll do it. Is there anything that tells the case has been opened, to void the warranty, or one can freely unscrew the screws without Casio knowing?

Quote:
It sounds really strange that Casio replaced the main board... normally, they replace complete units only. This could be a hint that quite a few Prizms died and replacing the main board was then considered cheaper. Although the boot code appears to be a known one, there could still be some interesting changes.

The calculator from my friend which also had the main board replaced, booted but once it got to the wizard, it would not register any key presses. On that case though, they probably could still trigger protocol 7.00 somehow and copied files out of the old board, because her new main board came with her files (and, I believe, even things in Main Memory). This has been almost two years ago so it's a old policy. Perhaps the policy varies with the company that does the repair?

By the way, can someone with a "normal" Prizm, tell me one thing? When you turn the calculator on (not cold boot, simply resuming from standby), does it flash a white screen (w/ busy indicator) for a fraction of a second, before showing the previous screen and resuming normal operation?

EDIT: first memory dump (2 MB) took about 4 minutes and 45 seconds. I have the calculator overclocked to 94.3 MHz, so that probably explains the speedup (at least, this new PCB is not strange enough not to allow that speed Wink )
gbl08ma wrote:
Is there anything that tells the case has been opened, to void the warranty, or one can freely unscrew the screws without Casio knowing?

As long as you do not damage the screws or the PCB or drill a hole through it, Casio will never know that you opened it.
Sad Now Linux doesn't want to recognize the Prizm. It says "do not disconnect USB", however the PC detects no device. I already had to disconnect USB one or two times and the SMEM is OK. Why is it taking so long to mount the storage memory over USB?

Kernel messages show nothing when I connect the Prizm, and I already rebooted the computer. Now I kind of fear rebooting the Prizm...

EDIT: OK, rebooted the Prizm and connected it again, it works now. While checking the kernel messages, I noticed the serial number the calculator reports over USB contains the unique serial number, on the first flash sector. For me it reports 0000NaBJDNL2 as the serial number.
Quote:
first memory dump (2 MB) took about 4 minutes and 45 seconds. I have the calculator overclocked to 94.3 MHz, so that probably explains the speedup (at least, this new PCB is not strange enough not to allow that speed Wink )


Well, that could be the reason why your Prizm died. Those integrated circuits have not been optimized for these speeds. The result is an increase in power consumption, higher heat and wear, and shorter durability.
TeamFX wrote:
Well, that could be the reason why your Prizm died. Those integrated circuits have not been optimized for these speeds. The result is an increase in power consumption, higher heat and wear, and shorter durability.


Don't worry, I was already told the reason why my Prizm died, and I can tell you it had nothing to do with the CPU clock Smile

I have noticed that not all Prizms can "overclock" to the same speed, and on these the bottleneck seems to be the flash chip. Note that even when "overclocking" the CPU is still very far from its maximum speed (which is, if I remember correctly, above 400 MHz), what prevents it from going faster is the peripherals. This has been discussed in detail here: http://www.cemetech.net/forum/viewtopic.php?t=7844
The CPU can be put in a oven, but all the other smaller components will fail way earlier because this is the Casio-designed stuff - not the processor.
Well, while your point of view is correct, my last PCB worked for over an year of use at 94.3 MHz, and when it broke it had nothing to do with it. At 58 MHz, many things in the OS happen too slow, including scrolling in lists and navigating big eActivity files with pictures (those I no longer can open, eh). I actually believe the OS was designed for use at a higher CPU speed, but they had to reduce it because some flash chips could not handle it, and to increase battery lifetime. But even at 94.3 MHz, I only need to charge my 900 mAh NiMH batteries every week or so.

I just finished doing the memory dump, I will email the ZIP to you after I post this.
About g3p's. you can convert an image to jpg, use your jpgviewer to view the pic, take an image with shift-7, and then insert it into an eactivity, afaik.
I know, but I don't need it. I just want the CG 20 functionality to be able to open the files I already have with g3p pictures. I no longer create new g3p because they are really limited and inefficient when compared to JPEGs.
gbl08ma wrote:
By the way, can someone with a "normal" Prizm, tell me one thing? When you turn the calculator on (not cold boot, simply resuming from standby), does it flash a white screen (w/ busy indicator) for a fraction of a second, before showing the previous screen and resuming normal operation?
Yes.
Turns out my Prizm has a LY755AZ motherboard.
This board has some interesting changes, confirmed by TeamFX after seeing pictures of it:
TeamFX wrote:
New flash ROM: Now from Macronix! MX29GL256FLT2I
Hardware version 004! Where is the change? There must be a small change in the layout design...
I guess, I found it:
- the MPU oscillator is smaller
- at the corner of the USB port is something different
- a new test contact at the 3pin port


Now we know what OS 2.00 was for: it probably contains drivers for the new flash chip. (note that the OS 1.04 on my calculator was "special": it was built way after the normal OS 1.04 was, and contained some changes). I can confirm flash r/w is much faster than with my previous Prizm (now we know why!). Since the bottleneck with overclocking above 94.3 MHz was most likely related to the flash chip, I wonder what this chip switch will bring to the OCing scene. Don't count on me for testing...

The main difference of the new flash appears to be the speed: 90ns versus the 100ns of the old Spansion flash.
That's very exciting! I guess I would only assume we can get an 11% speedup on overclocking based on that Flash speed comparison, though. Wink Thanks for sharing this information. Do you have pictures of whatever TeamFX is working from there?
KermMartian wrote:
Do you have pictures of whatever TeamFX is working from there?

I sent him blurry pictures of my Prizm's motherboard. I asked him back for pictures of "normal" calculators, and I can confirm the differences.

I won't be making these pictures public for now. I promise there's nothing that much exciting in them (no, no space for a SD card slot in case you were wondering - unless it's on the other side of the PCB and I didn't see it).
Confirmed for three people now:
OS 1.04.0201 comes preinstalled on new devices (not repaired ones).
TeamFX wrote:
Confirmed for three people now:
OS 1.04.0201 comes preinstalled on new devices (not repaired ones).


I keep on saying it has something to do with the new Macronix flash. It probably needed a slight change in drivers or something.
gbl08ma wrote:
TeamFX wrote:
Confirmed for three people now:
OS 1.04.0201 comes preinstalled on new devices (not repaired ones).


I keep on saying it has something to do with the new Macronix flash. It probably needed a slight change in drivers or something.
Has anyone diff'ed the two OS versions and tried to disassemble/decompile the differing code?
  
Register to Join the Conversation
Have your own thoughts to add to this or any other topic? Want to ask a question, offer a suggestion, share your own programs and projects, upload a file to the file archives, get help with calculator and computer programming, or simply chat with like-minded coders and tech and calculator enthusiasts via the site-wide AJAX SAX widget? Registration for a free Cemetech account only takes a minute.

» Go to Registration page
Page 1 of 2
» All times are UTC - 5 Hours
 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

 

Advertisement