Casio-Inside

As for now this manual show how to dump rom using one of these two official Lapis/OKI branded programmers:

• uEASE
• EASE1000 V2

Description of test pads on calculator (click to enlarge):

Connection between programmer and target (calculator):

Download and install LEXIDE-Ω development tools. If you install it do default directory then in file C:\U8Dev\Trg\ML620418.TRG replace target IDs:

from:

TARGETID00=47114180H
TARGETID32=0AF6298B4H
TARGETID64=11810003H

to:

TARGETID00=47119060H
TARGETID32=CF5304B2H
TARGETID64=00810004H

Do it for both sections: [UEASE] and [EASE1000] or just for your programmer.

• In menu start find and run DTU8 Debugger
• In newly opened window select target:
  
  and click OK
• If connection is correct you should see window asking for Security ID:
  
• Enter this: FFFF FFFF 7379 6771 5961 4753 4143 3137 2329 1719 1113 2307.
  First 16 bytes of that password is stored in calculator rom at address 0xFDE0 in reversed order.
  I don't have idea yet from where come the last 8 bytes.
• When password is accepted in main DTU8 window select from menu: File > Save program to file… and provide file name to store rom.
• Rom will be saved to file
  

• Find out how last 8 bytes of security ID was obtained
• Prepare procedure to flash rom
• Create better target file as current one uses larger rom window than necessary

• https://github.com/mc-sdx/CWI-hacking/tree/master
• https://github.com/CalcWorld/CalcCore/tree/master/rom_dump
• https://github.com/Natsuki-Min/PicoEASE/
• https://gitee.com/mc-sdx/calcracker