Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full Reverse Engineering of the TI-84 Plus Operating System

siraben.github.io

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#21

Post by siraben »

asveikau wrote: post #16

> TI-BASIC programs are stored as tokens, not text: every command, function, and variable is a token of 1 or 2 bytes. The OS detokenizes (token→display string) to show a program and tokenizes (keypress/text→token) on entry; the parser walks tokens to execute. From my memory of using a TI-83 in the late 90s, I would not be surprised if the keypad UI injects tokens directly based on your keypress, rather than "tokenizi…

Yes, to type a TI-BASIC program you have to go through the calculator menus which directly insert the tokenized input into the buffer.

The weird thing about TI-BASIC is how seemingly innocent changes in the input can cause huge performance regressions e.g. https://siraben.github.io/ti84p-re/sub-tibasic-for-paren.htm...

  For(I,1,N
  If 0
  1
  End
is much slower than

  For(I,1,N)
  If 0
  1
  End

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#22

Post by asveikau »

siraben wrote: post #21
asveikau wrote: post #16

> TI-BASIC programs are stored as tokens, not text: every command, function, and variable is a token of 1 or 2 bytes. The OS detokenizes (token→display string) to show a program and tokenizes (keypress/text→token) on entry; the parser walks tokens to execute. From my memory of using a TI-83 in the late 90s, I would not be surprised if the keypad UI injects tokens directly based on your keypress, rather than "tokenizi…

Yes, to type a TI-BASIC program you have to go through the calculator menus which directly insert the tokenized input into the buffer. The weird thing about TI-BASIC is how seemingly innocent changes in the input can cause huge performance regressions e.g. https://siraben.github.io/ti84p-re/sub-tibasic-for-paren.htm... For(I,1,N If 0 1 End is much slower than For(I,1,N) If 0 1 End

The open paren being part of the tokens was always weird. I could imagine that doing strange things for the parser; when it sees a close paren it needs to know that several of the preceding tokens may have an open paren even without having a '(' token.

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#23

Post by suburban_strike »

duskwuff wrote: post #18
asveikau wrote: post #16

> TI-BASIC programs are stored as tokens, not text: every command, function, and variable is a token of 1 or 2 bytes. The OS detokenizes (token→display string) to show a program and tokenizes (keypress/text→token) on entry; the parser walks tokens to execute. From my memory of using a TI-83 in the late 90s, I would not be surprised if the keypad UI injects tokens directly based on your keypress, rather than "tokenizi…

I can confirm that. On the TI-83, many of the TI-BASIC tokens contained lowercase characters which couldn't be typed at all - you could only type uppercase letters on the keyboard. (There were a few lowercase letters available as tokens for special purposes, but it wasn't a full set.) Interestingly, you could print tokens in strings - e.g. you could Disp "Disp ".

The 83+ let you type the full set of lowerchase chars as well, but they used 2x as many bytes per character for storage.

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#24

Post by 7jjjjjjj »

duskwuff wrote: post #18
asveikau wrote: post #16

> TI-BASIC programs are stored as tokens, not text: every command, function, and variable is a token of 1 or 2 bytes. The OS detokenizes (token→display string) to show a program and tokenizes (keypress/text→token) on entry; the parser walks tokens to execute. From my memory of using a TI-83 in the late 90s, I would not be surprised if the keypad UI injects tokens directly based on your keypress, rather than "tokenizi…

I can confirm that. On the TI-83, many of the TI-BASIC tokens contained lowercase characters which couldn't be typed at all - you could only type uppercase letters on the keyboard. (There were a few lowercase letters available as tokens for special purposes, but it wasn't a full set.) Interestingly, you could print tokens in strings - e.g. you could Disp "Disp ".

There's actually a hidden lowercase feature, you can use an assembly program to enable it.

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#25

Post by jamesfinlayson »

siraben wrote: post #12
hedgehog wrote: post #11

Earlier quoted context omitted.

Do you have plans to generate a buildable version of the sources, and do you know the original implementation language (C?).

It's highly likely that the original implementation language was assembly. The code is very idiomatic. Regarding source build, I think reverse engineering it to the point where you can reconstruct the source is possibly legally problematic, so I don't plan to do this, but maybe for certain subsystems like MathPrint (equation display) which was especially fun to RE. I have a PR up for it and it will be live at https:/…

> It's highly likely that the original implementation language was assembly.

Agreed. I did a bit of development on a TI-84+ years ago and I was not a skilled programmer back then so only used TI-BASIC, but the fact you could only write apps in assembly makes me think the operating system was the same. ticalc.org had a gcc fork from memory though I don't recall which calculators it targetted.

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#26

Post by jamesfinlayson »

asveikau wrote: post #16

> TI-BASIC programs are stored as tokens, not text: every command, function, and variable is a token of 1 or 2 bytes. The OS detokenizes (token→display string) to show a program and tokenizes (keypress/text→token) on entry; the parser walks tokens to execute. From my memory of using a TI-83 in the late 90s, I would not be surprised if the keypad UI injects tokens directly based on your keypress, rather than "tokenizi…

Ah makes sense. I remember a younger me trying to open .8xp files back in the day and seeing gibberish, and eventually finding the TI IDE which... felt like it had been written a long time ago (the file select dialog capped the display of file names at 8.3 I think and used ~1 and ~2 etc as "the rest of the file name").

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#27

Post by Chu4eeno »

RgrTheShrubbr wrote: post #17
siraben wrote: post #5

Earlier quoted context omitted.

This was made collaboratively by me directing coding agents at the binary, using Ghidra MCP extensively, disassembly and also dynamic analysis with an emulator. I don't have a writeup of the process but it was definitely not fully automatable (I wish though). I might prepare a blog post with transcripts and session history and things I learned along the way. Broad takeaways: - Ghidra MCP is not a silver bullet. Lots…

Having just recently heard about Ghidra and started using it with Claude. I am absolutely blown away how little resistance it has decompiling old Win95/98 binaries. It's turning into a bit of a hobby of mine to take old software, decompile and find hidden treasures like images or messages.

There's this unfortunate common misconception (that LLMs luckily don't tend to share) that reverse engineering is illegal or immoral, when it's both a great source of learning, a necessity for things like interop/preservation, and even has explicit carve-outs in the copyright laws of many/sane countries.

I know my government has a good amount of reverse engineers on the payroll (mostly in the security services).

Re: Full Reverse Engineering of the TI-84 Plus Operating System

#28

Post by boricj »

Isn't the information in this already largely known and documented? There have been over 30 years of tinkering, reverse-engineering work and assembly programs on the (e)z80 TI graphing calculators.

Incidentally, that lineage has finally come to an end as TI has released the TI-84 Evo-T, which uses an ARM Cortex-M core and a firmware apparently rewritten from the ground up.

Post reply on HN