[removed]

[parrotgeek1]

[removed]

[critor]

Thank you very much for your comprehensive explanations, and especially for the decrypted OS image dumping method.

I'm not sure I can help, but here are the 5-bits ASIC user flags values ( https://hackspire.org/index.php/Memory- ... cellaneous )

• 0b11111 TI-XXXXXXXXXXX DVT1.2, TI-XXXXXXXXXXX CAS DVT1.2, TI-Nspire DVT 2.0, TI-Nspire CAS DVT 2.0
• 0b00000 TI-Nspire, TI-Nspire TouchPad, TI-Nspire CX, TI-Nspire Lab Cradle
• 0b00001 TI-Nspire CAS, TI-Nspire CAS TouchPad, TI-Nspire CX CAS
• 0b00010 TI-Nspire CM
• 0b00011 TI-Nspire CM CAS

[parrotgeek1]

.

[parrotgeek1]

.

[critor]

The ASIC user flags are in the ASIC, not in the Manuf.

The Manuf includes the model ID, which is not exactly the same thing.

[Lionel Debroux]

Mac version [...]
Sorry I don't have a PC.

As you know, modern x86-based Macs are technically PCs, equipped with several Apple-specific components, in an enclosure whose design negatively impacts reliability, and a high price tag
I have worked with such a machine in a past day job, and seen others' experiences with their Macs.

Thank you very much for your comprehensive explanations, and especially for the decrypted OS image dumping method.

That one's trivial and has been known, publicly documented since 2009, in a matter of hours or days after the boot2 was first decompressed
Unlike another offline method developed later, it requires a emulator in working state, and on the CX/CM, a copy of the boot1. But that method is less user-friendly nevertheless.

Amusingly, four suitably aligned zero bytes make one quasi-NOP on an ARM processor running in ARM mode, one quasi-NOP on a 68k processor, and four NOPs on a Z80/eZ80. Both the ARM and the 68000 have explicit, nonzero NOPs.

[parrotgeek1]

.

[parrotgeek1]

.

[critor]

Ah, interesting.

Could you check if your patches can be adapted for OSes 3.6-4.3 ?

[Lionel Debroux]

Patching the memory read instructions is one of the ways to achieve the aim, indeed