OS upgrade files

The latest versions of the TI-Nspire and TI-Nspire CAS Operating System are available here. This article describes the format and content of the current versions (v1.1.9253 and v1.1.9170) of the .tno and .tnc files.

.tno/.tnc

A .tno/.tnc is a PK-Zip file with a custom ASCII header describing the OS update file. The PK-Zip file contains a certificate file (TI-Nspire.cer) and a .img file (TI-Nspire.img).

TI-Nspire.cer

The file follows TI's standard certificate format used on many caculator models. See TIGCC's documentation for more information (more particularly cread and cfindfield).

(Format of the following section: Field ID (hex) - size (dec) : comment. The indentation corresponds to subfields.)

350 - 298 : top-level field, similar to TI-68k's FLASH_APP_CERT (0x0300), PRODUCT_CODE (0x0320), FLASH_ROM_CERT (0x0330), etc.

0010 - 4 : ?

0100 - 4 : Revision Number (same field as for the TI-68k)

0260 - 140 : ?

0260 - 140 : A second one! The beginning and the end of the 2 fields are similar.

240 - 128 : Same field ID as in the .tno/.tnc. Certificate signature.
FFF0 - 0 : END_OF_CERT

TI-Nspire.img

As for TI-Nspire.cer, the file is organized as a certificate.

(Format of the following section: Field ID (hex) - size (dec) - @TI-Nspire: offet of the current version (hex) - @TI-Nspire CAS: offset): comment. The indentation corresponds to subfields.)

8000 : AMS Header - Invalid size??

8040 : Product Name: "TI-Nspire"

8010 : First part of Product ID

80E0 : Different on TI-Nspire and TI-Nspire CAS

8020 : Version number: "1.1.9253"/"1.1.9170"

8020 : Version number, a second time

8080 : ?

0320 - 6 : Product code : 0

80F0 - 64 : A signature? Equivalent to TI-68k's field 0200? (but it doesn't seem to be the MD5 of the product code). The first 8 bytes and the 16 last bytes are the same on TI-Nspire and TI-Nspire CAS.

8210 : ? 24ED68 on TI-Nspire, 0BA9CB on TI-Nspire CAS

8200 : Starts with PK. PK-Zipped file system, see further.

8070 - TI-Nspire:2403720, TI-Nspire CAS:2339224 - @TI-Nspire: A7F36, @TI-Nspire CAS: 490E2: Encrypted, probably also compressed. Contains the OS code. Only the 8 first bytes are the same between the .tno and the .tnc. The size is a multiple of 32, so a 128 or 256 bit symmetric encryption may be used.

0240 (024D) - 128 - @TI-Nspire: 2F2CBE, @TI-Nspire CAS : 28427A: the signature of the .img, similar to TI-68k's 64 bytes long field 0200.
FFF0 - 0 : END_OF_CERT

Additional remarks:

• The crypted field 8070 is 195568 bytes longer in the .tno than in the .tnc, that is the TI-84 Plus emulator of the TI-Nspire would be ~200kb bigger than the CAS of the TI-Nspire CAS! May be the two OS integrates a CAS, but it is not enabled on the TI-Nspire.

Compressed file system

Field 8200 of TI-Nspire.img contains PK-Zipped files, used to setup the file system of the TI-Nspire. Its structure probably follows the target file system tree. The .tnc and .tno both have a phoenix/ directory, with a sub-directory for each module of the OS which contain localized resource files (.res), the 'getting started' .tnc file, and factory settings. The .tnc has a special directory ti84/ which contains an image of the TI-84 Plus archive memory splitted into 64kb files, used to setup the memory of the emulated TI-84 Plus. Some flash apps are preinstalled in this image.

The files in the sub-directory phoenix/ are the same between the TI-Nspire and the TI-Nspire CAS, excepted the sample document Getting Started, the .res files of ctlg (catalog) and syst (system), and the factory settings in factory.zip (the TI-Nspire is set to real for Real or Complex, the TI-Nspire is set to 4=??).

We need your help

• Find out what the unknown fields of TI-Nspire.cer and TI-Nspire.img mean
• Help us to break the encryption of field 8070 in TI-Nspire.img
• Find all the differences between the official release of the TI-84 Plus OS and the OS image used in the TI-Nspire for its emulator. Try to flash it to your TI-84 Plus if you are brave enough (note that we don't know if it will continue to work after this).