Casio-Inside

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Rom dump from Casio ClassWiz (I & II) =====

==== 1. Required programmer ====
As for now this manual show how to dump rom using one of these two official Lapis/OKI branded programmers:
  * [[https://fscdn.rohm.com/lapis/en/products/databook/applinote/ic/micon/FEXTuEASE.pdf|uEASE]]
  * [[https://fscdn.rohm.com/lapis/en/products/databook/applinote/ic/micon/FEXTEASE1000V2.pdf|EASE1000 V2]]

==== 2. Pinout and connections ====
Description of test pads on calculator (click to enlarge):\\
== CLASSWIZ 1 ==
{{:pinout_cw1_pcb.jpg?direct&500}}

== CLASSWIZ 2 ==
{{::cw2_pinout.jpg?direct&500|}}

^ Pad  ^ Meaning                     ^
| P150 | VPP - Programming voltage   |
| P151 | SCK - RST/SCK - reset/clock |
| P152 | SDA - Communication Data    |


Connection between programmer and target (calculator):
^ Programmer pin ^ Calculator Pad                            ^
| ''3.3VOUT''        | BT+ or P154 or battery contact (positive) |
| ''Vss''            | BT- or P172 or battery contact (negative) |
| ''VTref''          | Connect together with ''3.3VOUT''         |
| ''RST_OUT/SCK''    | ''P151''                                  |
| ''SDATA''          | ''P152''                                  |
| ''Vpp''            | ''P150'' **Only for flashing!**           |



==== 3. Preparing environment ====

  * Download and install [[http://rohmfs-rohm-com-cn.oss-cn-shanghai.aliyuncs.com/lapis/support/lpmcu/DL_DATA/DEV_TOOL/soft_tool/U8_Development_Tools/LAPIS_LEXIDE_V1_1_1.zip|LEXIDE-Ω development tools]]. 
  * Download additional [[https://github.com/amnemonic/u8dev/tree/main/Target_definitions|target definitions]] and copy to corresponding directories in ''C:\U8Dev\''


==== 4. Dumping rom ====
  * In menu start find and run ''DTU8 Debugger''
  * In newly opened window select target (Depending on CW1 or CW2):\\ {{::target_cw1_selection.png?direct&400|}} \\ and click OK
  * If connection is correct you should see window asking for **Security ID**: \\ {{:security_id_check.png?direct&600|}}
  * Enter this: ''FFFF FFFF 7379 6771 5961 4753 4143 3137 2329 1719 1113 2307''. \\ //(BTW: This password is stored in calculator ROM at address 0xFDE0 in reversed order.)//
  * When password is accepted in main DTU8 window select from menu: ''File'' > ''Save program to file...'' and provide file name to store rom.
  * Rom will be saved to file \\ {{::saving_program.png?direct&300|}}

==== 5. To do ====
  * <del>Find out how last 8 bytes of security ID was obtained</del>
  * <del>Prepare procedure to flash rom</del>
  * Create better target file as current one uses larger rom window than necessary 

==== 6. Links ====
  * https://github.com/mc-sdx/CWI-hacking/tree/master
  * https://github.com/CalcWorld/CalcCore/tree/master/rom_dump
  * https://github.com/Natsuki-Min/PicoEASE/
  * https://gitee.com/mc-sdx/calcracker