网页新闻贴吧知道音乐图片视频地图文库
进入贴吧全吧搜索吧内搜索

 
 
 
日一二三四五六
       
       
       
       
       
       

签到排名:今日本吧第个签到,

本吧因你更精彩,明天继续来努力!

本吧签到人数:0

一键签到
成为超级会员,使用一键签到
一键签到
本月漏签0次!
0
成为超级会员,赠送8张补签卡
如何使用?
点击日历上漏签日期,即可进行补签。
连续签到:天  累计签到:天
0
超级会员单次开通12个月以上,赠送连续签到卡3张
使用连续签到卡
07月10日漏签0天
fx-es(ms)吧 关注:11,643贴子:255,100
  • 看贴

  • 图片

  • 精品

  • 视频

  • 游戏

  • 9回复贴,共1页
<<返回fx-es(ms)吧
>0< 加载中...

Mode preservation - basic overflow

  • 只看楼主
  • 收藏

  • 回复
  • user202729
  • 991EX
    8
An application of my old post https://tieba.baidu.com/p/5029670678 "Read the ROM of 570ES+ calculator"


This post discuss about the reason why press ON will clear all abnormal modes on the calculator, and how to prevent it.
Information in next messages.


  • user202729
  • 991EX
    8
So, as you knew, press [ON] will reset the calculator if it is in an abnormal mode created by basic overflow. That's because, at boot, the calculator check for validity in some memory blocks, which is overwritten by character spill. Thus, in order to preserve mode through [ON] we have to do a "Reset all" after basic overflow.
However, reset all will clear most abnormal properties of the calculator, so we have to reset all before set abnormal properties by jumping to address 0:AFB2.


  • user202729
  • 991EX
    8
Next, about mode preservation. n-random-point mode is caused by the stack pointer being at wrong position. That can't be preserved after pressing [ON], because the stack pointer (SP) will be overwritten by a 2-byte value at address 0:0000 in calculator memory, which is read-only.
The only things we can preserve is variables and modes. Obviously to preserve mode we need to reset all the calculator before change the mode.
0:AFB2 (reset the calculator)
1:54EE (jump to Pop XR0 location)
80F9 C4 ?? (content for XR0)
0:276A (write content in R2 to [ER0])
0:985E (move pointer to a "normal" position so as not to crash the calculator)
Done. Alternatively if you remove the "reset the calculator" part you can still switch mode.


  • user202729
  • 991EX
    8
Some interesting modes:
Useless mode - 89 (hex).
In this mode, you can type only (approximately) 22 different characters, with "atm→Pa" the main character.
When press [ON] this mode looks just normal.
This mode can be tried on emulator.
...... (you can find those modes yourself)


It is unfortunate that there isn't any 68&CMPLX mode. (tested on emulator)


Small character mode - 4A (hex); Math light without Math input - 46 (hex)
Only tested on emulator, not verified.


  • 突发规划
  • TI-84+CE
    13
挽


  • user202729
  • 991EX
    8
Verified that mode 46 and 4A works as expected. Mode 46 allow for weird output form (that is, it does not clear screen before write result) and super-small font (3x5, also used by table forms)
However, all super-small characters of interest have byte = D0 -> FF (probably super-small character table is similar to that of 570vn+), which cannot be seen on any other characters.
In this image, I hack a character to display "D0 D1 D2 D3 D4 D5 D6 D7 E0 F0", and then convert it to super-small font. You can see "01234567Aa" in small font.


  • user202729
  • 991EX
    8
I think you remember the old method, which can get to a weird Base-N mode by pressing ON after enter 68 Math mode.
https://tieba.baidu.com/p/5025136191
Base-N base is determined by sub-mode variable at address 80FA. The name above (Bin, Hex, etc.) is determined by the higher 6 bits only (0 -> 3 have name Bin, 4 -> 7 have name Oct, 8 -> 11 have name Dec, 12 -> 15 have name Hex). Normally the sub-mode holds the largest possible digit to enter (1 for Bin, 7 for Oct, etc.)
I have not read the base conversion procedure directly, but I notice that:
From base 17 and larger, it is possible to display some glitched digits (P, Σ, ɣ, ...) The larger the base, the more glitched digits we can have. So it is possible to get some quick output area ASCII, but that is limited.
The more set bit sub-mode has, the more different digits it can display.
For base 63, 127, 255, the value of 0 is not displayed as 0. Perhaps buffer overflow or something.


All of those is tested only on emulator.


  • user202729
  • 991EX
    8
Finally I have worked out the way how the calculator convert between bases.


So here is the important part in base conversion, written in pseudocode:
byte &sub_mode = [080FAh];


Backup R4 ... R15;
[ER2] = (byte) 0;
if ([ER0] >= 16) return;
ER12 = ER0; ER14 = ER2;
call 01h:0459Ch; // get data from variable?
R9 = sub_mode;
if (R9 == 9) {
cmd_144DC:
EA = ER14;
if (R10 != 0) { // R10 ?
[EA+] = R10 = 96d; // 96d = 60h = negative sign
}
cmd_144E6:
ER0 = ER4;
ER2 = ER6
R4 = R8
ER6 = 10
R8 = 4
R9 = 15
} else { // mode is expected to be Hex, Bin or Oct
Backup R9 for {
cmd_1446E: call 01h:04612h;
} // perhaps this is Dec-to-Hex converter
if (flag LT) return;

// cmd_14476:
EA = FP; // as expected, ER14 = FP should point on stack
R6 = 16, R7 = 1;
R8 = R9;
if (R9 == 1) { // Bin
//cmd_14482:
(R4, R3) = (R1, R0);
} else {
// cmd_14488:
unsigned R8 >>= 3;
R8 += 3;
R6 = 11;
if (R9 != 7) { // so 15 and other bases (Hex)
cmd_14492:
R6 = 8;
(R4 -> R1) = (R3 -> R0); // corresponding to shiftleft of 8 places
} else { // Oct
cmd_1449E:
(R4 -> R0) <<= 7;
Reset bit R4.7;
}
}
}
do {
// cmd_144AA:
R5 = high_byte(ER4 << R8) & R9;
if (R5 != 0 || R7 != 0) goto cmd_144B8;

if (R6 != 1) goto cmd_144C4;

cmd_144B8: R7 = 1;
R5 += '0'; // 030h
if (R5 >= 03Ah) { // R5 > '9'
// cmd_144C0:
R5 += 126d; // equal to 'hex_A' (B8) - '0' + 10
}
[EA+] = R5; // this command write contents to 0:8D9E, in stack
// going to be copied to other positions and displayed on the screen

cmd_144C4:
--R6;
if (R6 == 0) break;
// cmd_144C8:
(R4 -> R0) <<= R8;
} while (true);



Explanation of code in next post.


  • 461065836
  • 小吧主
    13
You can try enter 15-Chaos, ((((((((((( ) in 991ES PLUS,the phenomenon is like that you said.
By the way,June is the Chinese exam month, maybe we are a bit busy to reply to your post.


登录百度帐号

扫二维码下载贴吧客户端

下载贴吧APP
看高清直播、视频!
推荐应用
  • 蓝钻
  • t豆娱乐城
  • 斗地主
  • 食神争霸
  • 添加应用
应用中心应用礼包
  • 贴吧页面意见反馈
  • 违规贴吧举报反馈通道
  • 贴吧违规信息处理公示
  • 9回复贴,共1页
<<返回fx-es(ms)吧
分享到:
©2017 Baidu贴吧协议|吧主制度|意见反馈|网络谣言警示