Greetings All,

After looking at all the discussion on the keyboard issues and the hardware
vs sofware debate, I decided to try and produce a hacked ROM that would
remove the portion of code that sets the calculator into the slow mode
during idle periods just to see if that would fix the problem. Well, I
figured out where the code was and created a modified ROM image to load on
the calculator. Unfortunately after flashing the 49G+ I discovered something
I should've guessed from the start: the 49G+ has a built-in ROM checksum
routine to prevent unauthorized tampering!

I have no idea how to get around this checksum as I believe it is part of
the flashloader code, not the actual ROM code. If anyone has any suggestions
on how to get around this I'm all ears...

Anyway, the hack basically consists of NOP'ing an instruction that loads the
I/O register at 0x07200010 with the value 0x30, which sets the calc into the
slower operational mode. The hex edit operations to make this change to the
1.23 rom from HP's support site are as follows:

Original code at listed offset in ROM file:

0x000038DC:  00 10 80 E5

replace with:

0x000038DC:  00 00 A0 E1

That's it!

Unfortunately it appears to be a moot point unless someone can figure out a
way around the checksum issue...

Regards,
-Robert Hildinger
rh_public AT mobilevoodoo DOT com

"Robert Hildinger" <no_spam@die_spammers.com> wrote in message
news:8uvPc.21014585$Of.3490466@news.easynews.com...

> Original code at listed offset in ROM file:
>
> 0x000038DC:  00 10 80 E5
>
> replace with:
>
> 0x000038DC:  00 00 A0 E1
>
> That's it!
>
> Unfortunately it appears to be a moot point unless someone can figure out
a
> way around the checksum issue...

Well, I just got extremely lucky and figured out a way around the checksum
issue! Apparently if you zero out 8 bytes in the ROM file header the flash
loader assumes there is no checksum to check against and boots the ROM. With
that in mind here are the additional hex edit operations to perform:

Original code at listed offset in ROM file:

0x00000010:  68 0D 03 00 87 0F 49 01

replace with:

0x00000010:  00 00 00 00 00 00 00 00

You can then flash the ROM file via the SD card method (and perhaps the
other methods as well).

NOTE: Don't do this if you're averse to taking risks! I have no idea if this
will harm the calculator, and I wouldn't suggest leaving this hacked ROM on
the calc. It's just a test to see if this might help the keyboard issue.
I've loaded this hacked ROM on my calc, and it appears to work okay, but it
does have the side effect of making the LCD screen dim when a key is not
being pressed...

Good luck!

regards,
Robert Hildinger
rh_public AT mobilevoodoo DOT com

"Robert Hildinger" <no_spam@die_spammers.com> wrote in message
news:6TvPc.20919115....
> I've loaded this hacked ROM on my calc, and it appears to work okay, but
it
> does have the side effect of making the LCD screen dim when a key is not
 Do you mean that fixed the keyboard problem?
Regards

Robert Hildinger wrote:
> I should've guessed from the start: the 49G+ has a built-in ROM checksum
> routine to prevent unauthorized tampering!

I guess it's more to prevent people incorrectly flashing their calculator.

> 
> I have no idea how to get around this checksum as I believe it is part of
> the flashloader code, not the actual ROM code. If anyone has any suggestions
> on how to get around this I'm all ears...
> 
I don't think the Saturn-ROM look is managing the CPU speed at all, it's 
part of the OS.

You could simply change the CRC at the end of the image, quite easy to do.

Jean-Yves

Reth wrote:

>  Do you mean that fixed the keyboard problem?
> Regards

This may fix the keyboard problem, but it mainly means that you're on 
for less than a week of battery life.

Jean-Yves

Well I'm only trying to find-out if the problem is in software. BTW I
believe there is HW issue either
I personally use my HP49GX for work and my HP49G+ to play with :)

Regards

"Jean-Yves Avenard" <me@privacy.net> wrote in message
news:2n8mvkFu8kdbU2@uni-berlin.de...
> Reth wrote:
>
> >  Do you mean that fixed the keyboard problem?
> > Regards
>
> This may fix the keyboard problem, but it mainly means that you're on
> for less than a week of battery life.
>
> Jean-Yves

Robert,

I don't have the ability to hack a ROM image - but I'm dying to know if your
fix cured the keyboard issue - if so, I'd love for someone to send me a
patched ROM.

Can you keep us informed?

Many thanks,

> This may fix the keyboard problem, but it mainly means that you're on
> for less than a week of battery life.

Jean-Yves I suspect that I speak for many here that we'd happily change
batteries daily (rechargeable) if if fixed the missing keystroke(s) issue -
for many of us the issue means we get wrong answers which for me can (worst
case) overload an aeroplane - so (for me) it's serious stuff.

I wish HP would take it as seriously - even give us a flag to set that locks
the speed at 75MHz at the expense of battery life.

> I personally use my HP49GX for work and my HP49G+ to play with :)

HP49GX - that must be a 49g+ with a keyboard (48GX) that works! :)

"Cockpit Colin" <spam@nospam.com> wrote in message
news:%V_Pc.8870$N77.431667@news.xtra.co.nz...
> Robert,
>
> I don't have the ability to hack a ROM image - but I'm dying to know if
your
> fix cured the keyboard issue - if so, I'd love for someone to send me a
> patched ROM.
>
> Can you keep us informed?

It's hard to say whether or not this hack helped with the keyboard issue.
I've never really had an easily repeatable test of missed keystrokes on my
particular unit. In the short time that I had the hacked ROM on the
calculator I didn't notice any missed keypresses, but I didn't really notice
that many before the ROM hack, so I just don't know. I know other people
have far more repeatable missed keypress episodes, so hopefully they can try
this hack out and see if it fixes their problems.

CC, if you'll send me an email at the address rh_public AT mobilevoodoo DOT
com, obviously replacing the AT and DOT with the appropriate symbols, I'll
email you back a copy of the hacked ROM.

-Robert

I wish it was - :), but just a typo - :( , should be HP48GX
Cheers
"Cockpit Colin" <spam@nospam.com> wrote in message
news:K%_Pc.8874$N77.431722@news.xtra.co.nz...
> > I personally use my HP49GX for work and my HP49G+ to play with :)
>
> HP49GX - that must be a 49g+ with a keyboard (48GX) that works! :)
>
>

"Cockpit Colin" <spam@nospam.com> wrote in message news:<qZ_Pc.8872$N77.431527@news.xtra.co.nz>...
> I wish HP would take it as seriously - even give us a flag to set that locks
> the speed at 75MHz at the expense of battery life.

Isn't it possible to lock it at 75Mhz by doing the old <on><uparrow>
sequence that was used to stop the flickering LCD (before Cyrille came
up with a new ROM to address the problem)?

It put the calculator into "high-drain" mode which increased current
draw from around 10mA to 23mA (when the calculator was sitting idle).

See this old thread for more info (coincidently started by me :)

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&safe=off&threadm=2d624c12.0311121946.73d034a1%40posting.google.com&rnum=1&prev=/groups%3Fq%3D%253Con%253E%253Cup%253E%2Bgroup:comp.sys.hp48%26hl%3Den%26lr%3D%26ie%3DUTF-8%26group%3Dcomp.sys.hp48%26safe%3Doff%26selm%3D2d624c12.0311121946.73d034a1%2540posting.google.com%26rnum%3D1

I don't know if 23mA current draw can be correlated to 75Mhz clock
speed (or not)?

Matt

Hi Matt!
At last someone mentioned amperage.
I had slightly different results with my graphical ammeter.
Calc idle: 20mA
75: 60mA

What's interesting is that whenever you press a key the calc goes
almost immedialtly yo 60mA. The spike lasts about 0.1s and then back
again to 20mA.
These are approx results, if your'e interested aske me and I'll do
again much more precise mesurments with a fluke 189.
Email me at dima_turbinerATimapDOTcc.
 
My belief od fixing the keys problem would be to increase the lenght
of the 60mA spike; increase the timeout for the calc to go back to
12mHz from 1/16s to say 5 secs.

I will work on this and post my results.
Great work everybody
Dimitri
lanrek@attglobal.net (Matt Kernal) wrote in message news:<2d624c12.0408051344.73462d4a@posting.google.com>...
> "Cockpit Colin" <spam@nospam.com> wrote in message news:<qZ_Pc.8872$N77.431527@news.xtra.co.nz>...
> > I wish HP would take it as seriously - even give us a flag to set that locks
> > the speed at 75MHz at the expense of battery life.
> 
> Isn't it possible to lock it at 75Mhz by doing the old <on><uparrow>
> sequence that was used to stop the flickering LCD (before Cyrille came
> up with a new ROM to address the problem)?
> 
> It put the calculator into "high-drain" mode which increased current
> draw from around 10mA to 23mA (when the calculator was sitting idle).
> 
> See this old thread for more info (coincidently started by me :)
> 
> http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&safe=off&threadm=2d624c12.0311121946.73d034a1%40posting.google.com&rnum=1&prev=/groups%3Fq%3D%253Con%253E%253Cup%253E%2Bgroup:comp.sys.hp48%26hl%3Den%26lr%3D%26ie%3DUTF-8%26group%3Dcomp.sys.hp48%26safe%3Doff%26selm%3D2d624c12.0311121946.73d034a1%2540posting.google.com%26rnum%3D1
> 
> I don't know if 23mA current draw can be correlated to 75Mhz clock
> speed (or not)?
> 
> Matt

"Jean-Yves Avenard" <me@privacy.net> wrote in message
news:2n8mvkFu8kdbU2@uni-berlin.de...
> Reth wrote:
>
> >  Do you mean that fixed the keyboard problem?
> > Regards
>
> This may fix the keyboard problem, but it mainly means that you're on
> for less than a week of battery life.
>
> Jean-Yves
BUT
what if 48MHz is enough (as in the 48GII)
then it might last another week
Maybe even less - is the minimum 32MHz?
[VPN]

Matt Kernal wrote:
> Isn't it possible to lock it at 75Mhz by doing the old <on><uparrow>
> sequence that was used to stop the flickering LCD (before Cyrille came
> up with a new ROM to address the problem)?
> 

Yes, that should work if the problem with the keyboard is the CPU going 
from 75Mhz to 11Mhz-or so

Jean-Yves

"Jean-Yves Avenard" <me@privacy.net> wrote in message
news:2nohn0F2ujfhU1@uni-berlin.de...
> Matt Kernal wrote:
> > Isn't it possible to lock it at 75Mhz by doing the old <on><uparrow>
> > sequence that was used to stop the flickering LCD (before Cyrille came
> > up with a new ROM to address the problem)?
> >
>
> Yes, that should work if the problem with the keyboard is the CPU going
> from 75Mhz to 11Mhz-or so
>
Hi,  Jean-Yves!

What is the minimum working speed?
HP 48gII uses 48MHz
Could it be even lower, like 30MHz?

The fixed (=no slow mode) speed
could be low for lower battery consumption
and finally even Steen could use his 49g+ without hassle
[VPN]

> What is the minimum working speed?

Look it up in the samsung datasheet...

Al


> HP 48gII uses 48MHz
> Could it be even lower, like 30MHz?
> 
> The fixed (=no slow mode) speed
> could be low for lower battery consumption
> and finally even Steen could use his 49g+ without hassle
> [VPN]
> 
> 

"Al Borowski" <al.borowski@EraseThis.gmail.com> wrote in message
news:41175a07$0$16348$5a62ac22@per-qv1-newsreader-01.iinet.net.au...
>
> > What is the minimum working speed?
>
> Look it up in the samsung datasheet...

Hi, Al!
I was hoping for that you would release code for that
I mean the hacked ROM for the slowest speed.
OR
just anybody else capable of doing it...
[VPN]