[A89] Re: Disabling 'Protection'
[Prev][Index][Thread]
[A89] Re: Disabling 'Protection'
a word of wisdom before you try to disable "the protection", learn assembly
language well enough to write a 3 or 4 K program. Then I think you'll find
out why the people who know how to write ASM, and know how/why disassembling
works... also know how to disable the protection if they work at it a little
bit.
I just think it would be really stupid to try and do something without
understanding exactly what is going on. FYI people have ruined calcs while
disabling the protection so they could write to the non user portion of the
flash memory.
-Greg
----- Original Message -----
From: "Matt Mullins" <mokomull@cox-internet.com>
To: <assembly-89@lists.ticalc.org>
Sent: Tuesday, May 27, 2003 2:46 PM
Subject: [A89] Re: Disabling 'Protection'
> Hey, I didn't know you could disassemble TI-89 programs, but that still
> doesn't help (right now, I may be able to stare at it long enough).
>
> -MrM
>
> On Tue, 27 May 2003 00:02:09 -0700 (PDT), Laine Walker-Avina
> <nerdguy0@yahoo.com> wrote:
>
> > --- Matthew Mullins <mokomull@cox-internet.com> wrote:
> >> I got that already; I just can't figure out how the
> >> 'instructions' are used!
> >>
> >> -MrM
> >> ----- Original Message ----- From: Laine Walker-Avina To: mokomull@cox-
> >> internet.com Sent: May 26, 2003 2:29 PM
> >> Subject: Re: [A89] Disabling 'Protection'
> >>
> >>
> >> --- Matthew Mullins wrote:
> >> > I am trying to port HW2Patch to AMS 2.08/2.09. I
> >> figured
> >> > out the I/O ports I need to change (0x700000 and
> >> > 0x700004, lwords), but I can't figure out how to
> >> disable
> >> > the Protection on HW2 calculators. Can anybody give
> >> me a
> >> > tip to disabling it?
> >> > > -MrM
> >> From http://tict.ticalc.org/docs/J89hw.txt:
> >>
> >>
> >> $1C0000-$1FFFFF: "the Protection" enable/disable
> >> Note: Four consecutive accesses to this range crashes a
> >> HW1 calc!
> >> READ: Enable the Protection
> >> WRITE: Disable the Protection
> >> Note: No access to this range will have any effect unless
> >> the access is
> >> "authorized," see below.
> >>
> >> $200000-$20FFFF,
> >> $212000-$217FFF,
> >> $21A000-$21FFFF: "the Protection" access authorization
> >> HW1:
> >> In order to alter the state of the Protection, THREE
> >> consecutive read
> >> accesses must occur from any of the three ranges above
> >> immediately prior
> >> to the access to the Protection enable/disable range.
> >> HW2:
> >> (Note: This is somewhat complicated and I don't know
> >> exactly how it works.
> >> The procedure listed below is probably too strict. Anyway, this is what
> >> AMS and the boot sector does.)
> >> In order to alter the state of the Protection, (at
> >> least) SEVEN supervisor
> >> instruction fetches must occur from any of the three
> >> ranges above prior to
> >> the access to the Protection enable/disable range. The
> >> choice of
> >> instructions is not arbitrary, it must be one of the
> >> following sequences:
> >> * To DISABLE the Protection: $4E71, , $4E71, $4E71,
> >> $46FC, $2700, $3080, . The very next access must be the
> >> WRITE to the Protection enable/
> >> disable range.
> >> * To ENABLE the Protection: $4E71, , $4E71, $4E71,
> >> $46FC, $2700, $3010, . The very next access must be the
> >> READ from the Protection
> >> enable/disable range.
> >> ($4E71="nop", $46FC="move #imm16,sr", $3080="move.w
> >> d0,(a0)",
> >> $3010="move.w (a0),d0")Laine
> >
> > It looks to me like you'd have to read those seven values
> > consecutively to disable the protection. Also be sure that
> > that's the only thing being accessed at the time. I believe
> > earlier in the document it says that you must disable the
> > LCD controller from accessing the the video memory because
> > it causes a bus operation. Anyhow, if you can't get it to
> > work that way you can try and see what hw2patch is doing.
> > I've attached a copy of it, disassembled, in cause you wish
> > to go that route.
> > Best of luck!
> > Laine
> >
> > =====
> > Laine Walker-Avina
> > nerdguy0@yahoo.com
> >
> > In /dev/null, no one can hear your stream.
> >
> > __________________________________
> > Do you Yahoo!?
> > The New Yahoo! Search - Faster. Easier. Bingo.
> > http://search.yahoo.com
>
>
>
> --
> Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
References: