回复：About Classwiz hacks

1. Again, a language problem. What does 坑 means?
2. It seems that you are not very interested in "creating a perfect emulator for 991ES PLUS". In fact, that is very important, that is, to explain the behaviour of hacks. Because it is very hard to make it runs properly, so I really need help to do that.
3. The "basic overflow" can do virtually anything, but that require deliberately build the method instead of testing. For example this is for the 570vn plus ascii writing mode:
<16 bytes of line 2> . <16 bytes of line 3> . <16 bytes of line 4> [conv 08] [integrate] 1 . [const 11] pi [const 04] <5 times .> Pol D 0 . [conv 32] [d/dx] 1 . <13 times .> <16 bytes of line 1> .
where "." is not important and <5 times .> is ". . . . ." (repeat 5)
By similarly (complex) formula we can do things easily. But first we have to do (2.) above. You can look at how I partially done it for 570vn plus.
4. It is unfortunate that newer researches are scattered around the site, and for foreigners, searching something on this site is really difficult.


---
Now finding when the calculator will reset, and avoid that. I still can't find the source of some mode for example the "Mobile mode" (the "1R " in 15-point mode)

On fx 570vn plus, the condition is:
+ The 16 bytes from 0860Eh to 0861Dh must be "0F 0E 0D 0C 0B 0A 09 08 07 06 05 04 03 02 01 00".

+ The contrast byte at [08112h] must be less than or equal 01Dh and greater than or equal 004h.
+ All 10 variables (M, Ans, A..F, X, Y) must have least significant nibble of first byte less than 0A, and the most significant nibble of 10th byte equal to zero.
For example, variable A = 01 00 00 00 00 00 00 00 00 01
The first bold digit must less than 0A and second bold digit must be 0.

+ [80DCh] & 0F8h must be 0.
The purpose of [80DCh] is unknown, but [80DDh] controls if the cursor blink.


If at least one of the conditions above does not satisfy, the calculator will reset all.

Can anyone with Classwiz calculator try this for me:


1. Get an empty box (框), press [->] to get out of the box.
2. Press 203 characters (preferably numbers)
3. Press [←] 202 times
4. Press DEL 2 times
5. There should be 202 characters after a box now. Press [=].


Expected phenomenon: The calculator freeze or shut down.

after delete the 2 characters, it shows :

then press =,it shut down .i turn on it ,it rest all the setup

Can anyone with Classwiz calculator try this for me:


1. Reset all, [ON]
2. Press 197 times "1", then enter Ran#, then [=] [AC]
3. Get an empty box (框) by enter


$$1\div1\left(\left(\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{1}}}}}}}}}}}}\right.\right.:\sqrt{□}$$
(view in Latex) (there are only 3 number "1")


[calc] [=] [left], delete all other characters except the box, press [->] to get out of the box.

4. Press 198+49 (=247) characters (preferably numbers)
5. Press [←] 7 times, press [+]
6. Press [shift] [fraction], wait 23 half-cursor flash, press [ac] [right] [ac] [right]

Expected phenomenon: AtWt .



Note for step 3: I think that you often use
$$1\div1\left(\left(1\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{\sqrt{1}}}}}}}}}}}}\right.\right.:\sqrt{□}$$
instead.

@fx_911cnx
(in reply to your comment on https://tieba.baidu.com/p/5037993996)
1. What is "119"?
2. It seems that, apart from "an" (which is FD20) you can also find character "at". So what is its internal bytes representation, or you get that by which method?
3. Is there any Classwiz calculator that actually have "an" as a statistics calculation? In the internal bytes representation, FD1F is s²y, and FD21 is n. Both are statistics calculation.

@fx_911cnx
1. You reply in Chinese is OK provided you don't reply by image. The translators does its work quite well.
2. You can enter M^(0)+at (with invalid variable M) and press [=] [QR], and parse the URL. (the "E=" part)
3. (Assume the later picture is the result of my experiment above)
Q_1 min(x) Sigma x^2 is FD19 FD0A FD01, so the result is quite surprising.
When you press [ac] [left] the first time, is the cursor a square block?
After screen show Q_1 min(x) Sigma x^2, if you press [left] and [right] to move cursor around the expression, does it partially stuck at the end of the expression?
If you wait for different cursor flash times, does the characters become other characters?

I don't know if you have already found this.
1. [ON]
2. 1234567 = ac
3. According to method 17楼 https://tieba.baidu.com/p/3810670052 to get @, but replace C2 with σ. Only do to step press [CALC].
4. Enter fraction 14 / 8423 [=]
5. [ac] [up]

@user202729 Hi there, sorry that it took me long to see this.


Has anyone actually cracked the emulator for ClassWiz yet?
Do we have a portable version for ClassWiz?


Thanks!

Can anyone with Classwiz 991EX (must be 991EX, not 991CN X) calculator try this?
Press [=] at last.

@461065836
I'm more surprised as Conjg is 66 on fx 991EX calculator and there are no 66 or Conjg(.
Can you try this? (I expect 991CN X don't use different character table)
1. Enter CMPLX mode
2. Enter Conjg(i)>r∠θ
3. [=] [QR], then scan the QR and post the URL here (insert after each "." so that Baidu will allow it).

@GTOGTOGTOGTO
I don't think there is any reason to make the emulator portable. You just need to install the emulator and fix it as in my post.


Moreover, as I have installed the emulator already, it will always work on my computer, regardless of its position. If you think portability is important there are many programs on the web to make any program portable.


--------------------- Add to my previous post: 27楼 ---------------------
I notice that not all calculators have the position of bytes need to be changed the same, but you can search for "0F 84 A5 00 00 00" in the executable (it is unique in 570LA X / 991LA X emulator), and conclude corresponding position.

50 E8 B7 D9 FF FF 8D 4C
24 24 [51 C6 84 24 CC 2F
00 00 02 E8 D5 FB FF FF]
83 C4 04 85 C0 {74 3F} 6A


It seems that, my method above also make the portable version work apart from the "ERROR - An internal error occurred. 0x00001003" dialog. In order to further eliminate that you can edit the block above (right before the "74 3F" I mentioned in my previous post), all contents from 51 to FF (in square bracket) should be changed to 90.


So the block will become
50 E8 B7 D9 FF FF 8D 4C
24 24 [90 90 90 90 90 90
90 90 90 90 90 90 90 90]
83 C4 04 85 C0 {EB 13} 6A


Note: the bytes above is from fx-87DE X emulator, for different emulators the numbers may vary.

https://tieba.baidu.com/p/4393851090
Can anyone explains step 3?


Press any 90 numbers, press [√□̅ ] N times, then press 87-93 numbers, press [√□̅ ] N times, then the cursor's location will be changed, then press [AC]


Is that correct? I can't understand the "N" character in the instruction.


Some questions of mine after experiment with the emulator:


Let mode "Calculate" = 0, mode "Complex" = 1, mode "Base-N" = 2, etc. (as on 991EX), and let the screen with mode 0 to 7 = screen 0, screen with mode 4 to 11 = screen 1.


What is the screen when you reach garbled menu? (expected answer: screen 0, without black highlight)


What is the number of [←] button press you need to do to return to mode 0?
There is "这个位置随你第二次打的数字的数量而变化(比如你打93个数字，会比92个数字往下溢出一个)。" on the page, but it is not very clear.


From mode (n), if you press [←] you will reach mode (n-1), press [↑] you will reach mode (n-4), press [↓] you will reach mode 0 and press [→] will scroll one page down. Correct?


Note: The position of default mode selection is right after the backup cursor position (used in case of [UNDO])

It appears that there are also emulator of CN X and possibly Classwiz JP calculators, just that they don't have free downloadable trial/demo version.

pan.baidu.com/s/1hsvDKoO
Classwiz 991EX character table (garbled characters are not reliable)
Can anyone quickly make a bitmap from this file? (start from character 16 not 00)
F0 - FF character table: will upload.

Character table for 530AZ: (so that the Japanese characters makes sense)
pan.baidu.com/s/1kVSIepT
There is no "spelling" (拼字) hack so this is not yet useful, but there will be.