Casio Fx-991es Plus Calculator Tricks

[Sara Legath]

I also got to Dimension ERROR by entering some symbols by bashing the keyboard, and while entering that, an M symbol appeared, because it corrupts the M variable. I pressed AC/on to get a syntax error, and then replaced some symbols in the expression with M, pressing AC again.

Switching the modes and attempting to enter M yields a syntax error, and when returning to the COMP mode and entering M, a single message "ERROR" is displayed in the place where the value should be, instead of soft-hanging the calculator.

Here it is: =1

It does take me time to find the posts. It actually save time if I knew already where it is, but I don't know in this case. I found out that by search on fx-es(ms) main page for the word "变量存储", which is Chinese Google translate of "variables store", and found the post as the 40th one. It even appear on the main (final summary) page of the group, at



, part 1.4.2.

[edit] That post is new to me, and the integral method to get "ERROR" works on fx-570vn+, while the table method does not work.

Anyway that is not focus now, we need to focus on character spillover (explanation: Basic overflow, press series of characters (enough character), AC, left, equal, and character infinite copy as I described above), because that overwrite the stack and control the program flow.

Hopefully the variable-hack method can do something, for example, special matrix pointer, and that may help reading calculator internal ROM. Very hard, however.

Failed.

"finishing sticking" = the topic that summary all information

score (the translator may translate correctly or not) = fraction


Also note that sometimes some quote is lost, cause some sentences in the form of "6 multiply 5 multiply multiply", which is often translated incorrectly by the translator, and sometimes the translator truncate some (important) part, so better see both the original text and the translated. Even

I found that when entering a hackstring, some characters (probably the memory content) appear on the screen, and when scrolling them, they change. Probably some variable where the cursor position is stored.

Now, entering any symbols will corrupt the calculator's RAM and you'll be able to observe various glitches, for example try entering [.] before the memory indicator appears on the screen, that corrupts the memory variable.

EDIT: That probably does not work on the fx-350ES PLUS, as it doesn't have a sum symbol, unfortunately. We are focused on fx-570ES PLUS and fx-991ES PLUS, but you can search for bugs in your own model, too, and it would be helpful to us.

fx-350es plus is similar to fx-82es plus. That method does not apply to this kind of calculator. However there are other methods to get to basic overflow. First can you try the way LP700_(4) described to get the "similar effect"?

I have been looking this forum during a few months and i'm really interested about casio hacking. First I want to know what's the objetive of 'hacking' those calculator, is it the fact of unlocking other Roms via soft hacking? Or just understand how those works? (I know that one thing leads to another)

So, I'd like to know the current status of the Casio calculator hacking, specially PLUS models. I want to know the development in this point and also you'd probably recommend me a pdf guide or something like that which can help me understand how the different chipsets of this calculator works.

Although we aim to execute arbitrary code, but it is probably impossible to do. The reason is explained in my previous posts.
We can only execute simple functions on the calculator using its built-in function. However that require a lot of (manual) decompile which I don't want to do.
Execute in assembly is impossible, and even if we were able to run nX/U8 assembly on the calculator it would take a lot of time writing the program to the calculator. The calculator have no USB port. Even read its memory is difficult.

I've seen some post from you there, one of them describes an "A-type-converter" which to my understanding converts a prefix to another one. Maybe you could explain that a bit further, as I don't really know what to do there.

I'll pm you my email as youd reach me much faster using my email but most of my research is currently done in boring school lessons where phones are mostly forbidden so it could take some time for me to answer

I'm the former admin of Baidu fx-es(ms) forum and current admin of cnCalc.org. I'm quite interested in your project, so if you are having any trouble reading Chinese, just contact me! Most of the members are junior or senior high school students, they play with their CASIO calculators since classes are boring... Then they post any glitches they found in the forum

What interest me is that there are many clones of fx-ES calculator. One is HP SmartCalc 300s. these clones use a pretty similar ROM with genuine ones, but they are running on totally different processors. If CASIO didn't sell them the source code, where the code come from? So HP (actually not HP but the "solution provider") disassembled CASIO's code?

Also, SunPlus' SPL08x processor (LCD controller integrated) is also known to be used in several clones, but I'm not sure which (maybe Canon F-789SGA?). According to the datasheet, it used a 6502 core, but I'm not sure. There are even clones using processors without LCDC, but I havn't figured out the CPU model.