Downgrade my Ti

[Manu-maker]

Hi, I have just bought a ti-nspire cx II T and I updated it to 5.4.0257 but to install ndless I need 5.3.0. How can I downgrade it? I have already tried to delete de OS and reinstall 5.3.0.564 but it said that i can't install a older version of OS even if there wasn't OS.

[Vogtinator]

You unfortunately can't downgrade the OS (yet).

[BrightonDutson]

while mine did not come with 5.4 installed i was stupid and updated to the wrong os. I have been messing around with some things on my calculator and have been able to "convince" the calculator into accepting an older os and get to the point where is says that I have successfully installed it but everything is reverted once the calculator restarts. I am wondering if you happen to know how to edit the boot files or whatever else the previous os version is saved onto, or even if you know how the calculator remembers its previous os even after deleting everything on the calculator.

[adriweb]

Downgrading would need Ndless in the first place, so no, not doable.

[Vogtinator]

Let's treat this as a duplicate of #300

[deadui]

@BrightonDutson what did you do to get it to accept an older os version

[deadui]

.

[BrightonDutson]

probably is nothing but if you open an older os in notepad on the first few lines it says what os it is (looks like this: PK š®Q)I^g$ $   manifest.txtSDj ¼  Û91kcdia``0 bð
bFV0“UH¥1úy…:¼àÒvx³õ33n9F&&†°V †ÿŒò 1U  ¶Dœ$ÌÀ*¦T bxìd`XÉ „bž"Ð< UT N7_N7_Áˆ3# TI-Nspire.tco2 5.20.771) if you change those numbers at the end to 5.40.259 for example (even if you delete the os from the doc enter ee menu) it will transfer the os without errors and say it was successful bet wont install properly or will just act like an os was never installed and tell you to install one

[deadui]

@BrightonDutson thank you for the information i tried messing with it today but it didn’t work like you said it would say installed successfully but it just wouldn’t work still i did discover something interesting in the file NspireLogs.zip if u put that in note pad and look at it it say says the version of your calculator and i’m thinking that maybe since you can’t open it on the calculator it self it’s probably what the calculator uses to check the version and see if it’s older then the one your trying to install so what i tried to do was go into note pad edit the version to an older one delete the NspireLog that was on my calculator and maybe when i tired to install a version that could run ndless it would look back at the logs and think i was installing and new version but when i added NspireLog to a folder on my desk top it was actually a winrar file with a bunch of different text docs one of them is a stats doc that has the version along with other information so i changed that to 5.3.0.564 and saved it but when i tried to add the file back it said it had to be tns so i tried renaming it and that still didn’t work so my theory is that if you can get the edited nspire log file into the calculator and delete the old one then it would let you install an old os or at least one it thinks is new i just need to find a way to get the new file into the calculator

[adriweb]

NspireLogs is completely unrelated (it's just... logs) ; the minimum OS version is written elsewhere.

Regarding the OS files, they are just zip files that you can open and explore. But can't be modified, because it is all signed.

[BrightonDutson]

I have also discovered this with the OS files and have opened this with 7zip and am able to edit the version info but due to formatting and hidden attributes have so far been unsuccessful but I can feel that I am close I have talked to some other friends about this and we have a few methods on how to bypass this if we figure it out I will upload the modified OS on my website: https://www.thecalculatorguy.net/ and post a video on how I did it on my YouTube channel: https://www.youtube.com/channel/UC1YpjyfXuD9o4zqKh2M80EA If there is a will there is a way and I plan to find it no matter what it takes.

[LambdaLaboratories]

Good luck

[BrightonDutson]

Thanks, also a bit of an update I know im close I have figured out the issue and how everything is checked im currently working on editing the raw binary of the file but there are certain security checks and records associated (such as individual crc records for each file inside the os archive file) with the file that need to be changed to match the file so it does not show it as modified or corrupted and if I can figure out how to do that then I can downgrade it.

[ghost]

Thank you for your service, sir.

[ghost]

Thanks, also a bit of an update I know im close I have figured out the issue and how everything is checked im currently working on editing the raw binary of the file but there are certain security checks and records associated (such as individual crc records for each file inside the os archive file) with the file that need to be changed to match the file so it does not show it as modified or corrupted and if I can figure out how to do that then I can downgrade it.

any updates?

[BrightonDutson]

I figured out the crc records but there is still a few things I have to change with the file to work. I'm not sure when I will get it done and progress has been going a bit slow lately due to school but I will make sure to update you when I make some more progress.

[ghost]

I figured out the crc records but there is still a few things I have to change with the file to work. I'm not sure when I will get it done and progress has been going a bit slow lately due to school but I will make sure to update you when I make some more progress.

ok, thank you so much.

[NovaStorm93]

commenting here to get updated on this, but this seems promising

[ITAC85v2]

I figured out the crc records but there is still a few things I have to change with the file to work. ...

Any progress on this? Given it's only been 12 days, probably not much, but replying to get an update on this.

[BrightonDutson]

Not much I have some things I want to try but I have been busy with school lately, If I get some time today I will try some things out and let you know how it goes.

[LambdaLaboratories]

This is really cool, I'm glad this is happening, though I advise you to test the modified software on a real calculator, those things don't grow in trees!

[LambdaLaboratories]

Also distributing modified TI software is kind of illegal, so I recommend you release this modification in the form of a patch which we can offload into software of our own

Edit: I'm not completely sure how patch files work so I'm just assuming the solution

[BrightonDutson]

I am testing it on a real calculator because the emulation in the cx student software is different. That does not mean that it wont work on it but I'm not even gonna bother with it. As with the legality of it I think I might make a "Tutorial" on how to "Hack" your calculator (or calculators operating system) your self. Without distributing software to anyone just showing people how I did it (if that makes sense).

[LambdaLaboratories]

That sounds great! Can't wait to finally mess around with C on my TI. Also, Doom.

[BrightonDutson]

Those two reasons and a gameboy emulator are the only reasons I'm doing this.

[ITAC85v2]

I found two public keys in manifest.cer (which, by the way, remains the exact same between 5.3.0.564 and 5.4.0.259, perhaps even before then), which are: Public Key 1 Public Key 2 I also included other things about the key, if it helps any.

Not sure if this adds anything to your findings, but I thought I'd share it anyway.

[BrightonDutson]

Thanks, I have not been able to open the certificate file but I have noticed they are the same on both versions so this could help.

[LambdaLaboratories]

Don't forget you're doing this for the community too. You can do this, Dutson!

[PokemonMaster46]

Hey guys I know I'm new to the conversation, but how is progress? I also have a large interest in this, since I upgraded to 5.3.2 so Ndless doesn't work for me as well.

[PokemonMaster46]

Is there someway to run Ndless through a stored OS file? I am pretty new to this stuff so I'm not sure.

[PokemonMaster46]

Or is there a way to jailbreak a 5.3.2+ version OS outside the calculator and then install it pre-broken? So once it is installed you can just downgrade it?

[adriweb]

No

[PokemonMaster46]

Any progress?

[BrightonDutson]

Sorry, I have not made much progress lately I have a large project in school this month so will likely not make much more progress until december. The most recent thing I have done with it is replace the OS and certifactes entirely only editing the os version info from the manifest.txt file. The software still accepts (or thinks) thats its the newest version but stops and says the file is corrupt. This makes sense as when I open it is 7-zip some of the files are missing and the other ones show that they have been edited (although I think I have figured out the crc records) and like LambdaLaboratories said distruibution TI software (without permition and we all though thats not happening) is illegal so if you want more "Information" I will post it on the chat room on my website https://www.thecalculatorguy.net (It does not liik the best but I can promise the security is pretty good (it has had some "real world" testing but thats another story) anyway im rambling, but I will post some things on there (room name: ndless) showing what I have done so maby some other poeple could look at what I have done and contruibute to this.

By the way I am TheCalculatorGuy ;)

[Volkov08]

could you elaborate how you got the keys from the file? i had no succes opening it in any way

I found two public keys in manifest.cer (which, by the way, remains the exact same between 5.3.0.564 and 5.4.0.259, perhaps even before then), which are: Public Key 1 Public Key 2 I also included other things about the key, if it helps any.

Not sure if this adds anything to your findings, but I thought I'd share it anyway.

[ITAC85v2]

could you elaborate how you got the keys from the file? i had no succes opening it in any way

I found two public keys in manifest.cer (which, by the way, remains the exact same between 5.3.0.564 and 5.4.0.259, perhaps even before then), which are: Public Key 1 Public Key 2 I also included other things about the key, if it helps any. Not sure if this adds anything to your findings, but I thought I'd share it anyway.

Sure, I'll try my best to explain it.

In manifest.cer at 0x14 until 0x0121, the first public RSA key is found. It is preceded and followed by four bytes, which are 02 AE 01 0E. Then, at 0x0126 until 0x0233, the second public RSA key is found.

These keys are DER-encoded, which is as simple as base64 encoding them and adding start and end of RSA key headers to the base64.

The second public key is followed by 02 9E 01 00, which is also found in first four bytes of manifest.sig, followed by (likely) a signed RSA message, being finally followed by FF F0 before reaching EOF.

All hex values in code-like stylization are unknown what their purposes are for and I've been struggling to find any form of documentation about them, even unofficial.

[Vogtinator]

All hex values in code-like stylization are unknown what their purposes are for and I've been struggling to find any form of documentation about them, even unofficial.

See https://hackspire.org/index.php?title=OS_upgrade_files#TI-Nspire.cer. The .cer files all use the same "fields" format, with field 0x350 containing subfields 0x0010 (length 4), 0x0100 (length 4) and 0x02a0 (length 0x010e).

[WanSkool]

Sorry, I have not made much progress lately I have a large project in school this month so will likely not make much more progress until december. The most recent thing I have done with it is replace the OS and certifactes entirely only editing the os version info from the manifest.txt file. The software still accepts (or thinks) thats its the newest version but stops and says the file is corrupt. This makes sense as when I open it is 7-zip some of the files are missing and the other ones show that they have been edited (although I think I have figured out the crc records) and like LambdaLaboratories said distruibution TI software (without permition and we all though thats not happening) is illegal so if you want more "Information" I will post it on the chat room on my website https://www.thecalculatorguy.net (It does not liik the best but I can promise the security is pretty good (it has had some "real world" testing but thats another story) anyway im rambling, but I will post some things on there (room name: ndless) showing what I have done so maby some other poeple could look at what I have done and contruibute to this.

By the way I am TheCalculatorGuy ;)

Any Progress?

[billnyethecoderguy]

Any Progress?

[LuukLuik]

Hi guys, I just found that you actually can install older versions by just editing the number below the versionnumber in the txt-editor... Maybe you knew this, but it isn´t very usefull because you still can´t install nodless :(

[adriweb]

No, you can't. -- Thank you, Adrien Bertrand

[Volkov08]

Hi guys, I just found that you actually can install older versions by just editing the number below the versionnumber in the txt-editor...

IIRC this file is also signed, so changing the version there would not wotk

[debrouxl]

It's a good thing that people are looking under the covers, but usually, if a trivial method hasn't seen widespread use and word of mouth over the years, that's probably because it does not work ;)

[ActuallyPositival]

If this works ti will have no way to stop the massive wave of people downgrading to 5.3.0 or below

[MrLasagneYT]

Sorry, I have not made much progress lately I have a large project in school this month so will likely not make much more progress until december. The most recent thing I have done with it is replace the OS and certifactes entirely only editing the os version info from the manifest.txt file. The software still accepts (or thinks) thats its the newest version but stops and says the file is corrupt. This makes sense as when I open it is 7-zip some of the files are missing and the other ones show that they have been edited (although I think I have figured out the crc records) and like LambdaLaboratories said distruibution TI software (without permition and we all though thats not happening) is illegal so if you want more "Information" I will post it on the chat room on my website https://www.thecalculatorguy.net (It does not liik the best but I can promise the security is pretty good (it has had some "real world" testing but thats another story) anyway im rambling, but I will post some things on there (room name: ndless) showing what I have done so maby some other poeple could look at what I have done and contruibute to this.

By the way I am TheCalculatorGuy ;)

Hows this been doing lately?

[calcmanui]

Really hoping for a new version of ndless for 6.0 or a way to downgrade I was really looking forward to radical red on the calculator for school

[ExpertPhisherman]

Really hoping for a new version of ndless for 6.0 or a way to downgrade I was really looking forward to radical red on the calculator for school

k

[smulroy31]

It seems like there should be a version for 6.x by now as it's been years; Keep me posted of any way to downgrade or an update please;

[xero-lib]

It seems like there should be a version for 6.x by now as it's been years; Keep me posted of any way to downgrade or an update please;

That's now how jailbreak development works. We have to find a way to make it work, bypassing TIs lockdown. It's not as simple as just changing a few lines.

[bahillybeans]

What if you used a hex editor to change every instance of the old version number and replaced it with the current version? Could you trick it into thinking it's the current version?

[bahillybeans]

If I so much as touch anything in the os it will say it's corrupt, is there a way to bypass that