Upsilon/Omega FOR N0110 could be compatible with N0115

[TechnicAlpha]

I currently have a numworks N0115 and I found interesting things

• N0110 and N0115 have very, very nearly the same hardware, so the drivers for N0110 should probably work for N0115 (maybe close to) "As Is"
• The numworks N0115 must be unlocked. Many (but not all) people say that is impossible. It isn't while RDP2 is not set. For an example, N0120 has already been unlocked but there is no Ion (the Numworks' proprietary HAL) public drivers for N0120, probably at the opposite of the N0115, so it's (theorically) possible to run Upsilon on N0115 but not already on N0120.

So, my issue is : i don't know exactly how to unlock my N0115 with a raspberry pi 3 (have no st-link, sadly). I've tried to follow this guide for n110 (and failed, and it is normal) and i'm searching what command to use wth openOCD.

PS: Excuse me, i'm French and speak English like a Spanish cow.

[Yaya-Cout]

Hi
It's technically possible to run Upsilon on N0115 (someone did it on Discord in fact), but it's dangerous.
The main issue is the screen driver: it requires calibration data, which vary by screen model (Epsilon closed source and proprietary drivers seems to have 7 calibration sets on N0115 from what I read by reading the binary kernel using GHex, as the source code isn't public). If the calibration data is incorrect, it can damage/brick the screen.
To run N0110 software on an N0115, you don't actually need that much changes to the drivers, I think most of it is going to be related to the battery charge level, USB support and external flash, but it's not that much complicated.

Recent Epsilon versions for N0110 can actually run on N0115 as they reuse the same driver (you need to do a manual installation using https://yaya-cout.github.io/Nwagyu/reference/others/downloading-epsilon.html to download the DFU file, then flashing the extracted external flash image using https://ti-planet.github.io/webdfu_numworks/n0110/ at address 0x90000000), they even reuse the same signing key for both models. However, this trick doesn't have a real use case because both models have the same features, and some features could be a bit broken on N0115 as drivers are only tested for N0110.

The same issue as N0120 supports still hold: I don't have any N0115 to port Upsilon to it and not much people are going to use that due to the hardware unlock-only procedure.
Another issue with N0115 is that it's already deprecated: NumWorks is only producing N0120 at the time, so we can guess N0115 is going to disappear. N0120 is now the only produced model.

Anyway if you want to port Upsilon to N0115, go ahead, I'll happily merge your change if you PR them. You can join the Discord to ask questions (or ask them though GitHub if you really prefer to use Microsoft over Discord)
About unlock:

• I guess the method used by Ayabusa could work on N0115 as well.
• If you prefer the Raspberry way, the issue is that the "6" key isn't connected to the BOOT1 key (https://www.numworks.com/engineering/hardware/electrical/parts/stm32f730-arm-mcu-reference-manual-1b6e1356.pdf page 91 for more info). I guess replacing mww 0x40023C18 0x00400080 with mww 0x40023C18 0x00400040 could work to force STM32 internal bootloader on every boot to replace bootloader with Upsilon using USB (DFU), but I didn't check. Once you replaced the bootloader, you should be able to try booting using the DFU leave command (which is usually done automatically). If everything works, follow the Raspberry guide without my edit and normal boot should be restored (It should also work if you restored the official Epsilon bootloader to roll back to stock).
• If you already followed the Raspberry procedure, you can do it again with the change I suggested, or simply connecting the BOOT0 pin to VDD as on N0110 (https://www.numworks.com/engineering/hardware/electrical/schematics/)

This unlock procedure will temporarily brick the calculator (hard bricks are usually hard to archive unless you cause hardware damage or enable RDP2 with a broken bootloader), and can be hard to fix, please don't attempt it on any calculator you need.

For anyone reading this, please don't do this without understanding the risks, It WON'T allow you to play games unless you have low-level programming knowledge, please use NWA apps like Nwagyu instead. It won't allow you to cheat during exam mode for the same reasons + Upsilon team is fully against cheating in exam, which is the main reason NumWorks locked down their calculators

Disclaimer: I'm not responsible for anything you do to your calculator or any damage/loss caused by what I explained earlier.

Sorry for the wall of text, I'm kinda bad at writing short posts…
Btw your English looks fine to me, I'm french too :)

[TechnicAlpha]

Thank you so much for this precise answer.

I have a bricked N0115 (a very strange brick, i havn't seen peole with the same symptoms on the Net), and the brick is probably only repearable the material way. That's why I come to Upsilon. In addition Upsilon is FOSS and support KhiCAS, and it would be a great project to port it on N0115 (BTW it's not for cheat or play (-; ).

However, i've a few question:

The main issue is the screen driver: it requires calibration data, which vary by screen model (Epsilon closed source and proprietary drivers seems to have 7 calibration sets on N0115 from what I read by reading the binary kernel using GHex, as the source code isn't public). If the calibration data is incorrect, it can damage/brick the screen.

Is the screen unbrickable by reflashing Epsilon official ROM ? BTW, It is maybe why my calculator is bricked : red LED, black screen (this is not the symptoms of recovery mode on N0115, only on unlocked N0110), unrecognized in many os with drivers as recovery mode, led don't turn off while pushing reset, tried all that Numworks says...

If you already followed the Raspberry procedure, you can do it again with the change I suggested, or simply connecting the BOOT0 pin to VDD as on N0110 (https://www.numworks.com/engineering/hardware/electrical/schematics/)

As you say, i havn't j-link so I cannot use STM32CUBEPROGRAMMER and so on. I must use openOCD with rpi. I've tried this. However the first two command fails. If I connect BOOT0 to rpi's VDD, does it force DFU ? And if yes, should I then manually disable RDP ?

This unlock procedure will temporarily brick the calculator
Disclaimer: I'm not responsible for anything you do to your calculator or any damage/loss caused by what I explained earlier.

My calculator is already bricked, so lost for lost, it's my biggest hope to unbrick it and port Upsilon on N0115 :-).

Thank you very much.

[Yaya-Cout]

I don't think red led + black screen means screen brick, it usually means the NumWorks is not booting properly (I don't know what it's doing exactly, probably some kind of fast bootloop), or that you are in STM32 recovery mode. My best guess would be a corrupted internal flash, or some internal damage (caused by water/shocks). In case the flash is corrupted, it can probably be fixed.

If it's dead, you can try sending it to NumWorks support (IIRC there is a guarantee for 2 years, at least in UE).

If you can't/don't want to ask the support, you can try doing the OpenOCD procedure with mww 0x40023C18 0x00400040 and hoping it's not an hardware failure. If it prints "Cannot read IDR", it means cables are not plugged correctly (I can take 5-10 minutes to get the right contacts). To make the procedure easier, I usually suggest using an infinite loop (so you have both hands available) and plugging the NumWorks directly to the Raspberry (with battery unplugged to be sure) so you don't need the GND cable plugged to the USB port. This way you have two hands to keep two cables on the calculator.

while true
do
openocd -f "n0110.cfg" -c "init" -f "forcedfu.run"
sleep 1
done

Once it's unlocked, plugging the calculator on a computer with USB should detect it (on Windows it makes sound and be visible in the device manager, on Linux you can find it with lsusb). If the calculator is detected, you can try flashing Upsilon (I'm not sure it will work given the hardware differences) or Epsilon using NumWorks recovery on their website (I never tested this, but it should work. If it doesn't you could try downloading the DFU by hand (https://yaya-cout.github.io/Nwagyu/reference/others/downloading-epsilon.html) then flashing the extracted internal flash image with the WebDFU (https://ti-planet.github.io/webdfu_numworks/n0110/)

What's the error you get with OpenOCD? You can try searching it on the internet for details if it's an error with npm/npx, or give it here if you can't find an answer on the Internet, but I can't help you solving the issue without the error message and more details.

[TechnicAlpha]

I can't test the procedure before 2-3 days, so I havn't the log. However, I've (again) a question:

If the calibration data is incorrect, it can damage/brick the screen

• Could install N0110 software permanently damage the screen? I want to say : if I reinstall official (or patched to avoid signature check) Epsilon after a try of Upsilon with a screen fail, does my screen come back to a normal state ?
• Could I potentially extract calibrations datas from the official Epsilon to patch an Upsilon binary ?
• Is there a way to know my screen version, or, if not, to compare the version with another from a N0110 ?
• How many calibrations datasets exists on the N0110 ?

Thank you very much !

[TechnicAlpha]

Ok, successfully applied your method, command by command with gdb and checked boot_add, but the calculator isn't recognized. Could I try to load a bootloader through openOCD to solve the problem ?

[Alpha-Technologie]

Could I try to load a bootloader through openOCD to solve the problem ?

Yes, cf this thread

Then you can patch it to avoid locking. However, a question remains : if you load the stock but patched bootloader and Upsilon:

1. Does it works ?
2. Does the screen drivers/calibration datas would be preservated ? I mean : are the screen drivers on bootloader, on external flash, or on both ?

I hope you will succeed to port Upsilon on N0115!

[TechnicAlpha]

Looks fine ! I will try. However, the screen drivers are, sadly, in the kernel and in the bootloader. So the bad news are that neither with nor without patching the bootloader, the installation will be risky and instable. The good news are that we can disassemble and even decompile it, and AFAIK, we can produce a licence-less, or better, a GPL licensed code. So it has a great potential ! Thank you for this answer.

[TechnicAlpha]

So i'm fighting to understand the code with ghidra :-). But the big problem is the screen : so I want to test just the Upsilon bootloader but :

• Is there a material risk for my screen ? I mean irreversible and permanent damage that cannot be suppressed by reinstalling Epsilon.
• What concretly are the calibration datas ? Have you an example in the Upsilon's sources ?

Thank you so much for your help !

[Alpha-Technologie]

It's purely theorical, but i don't think.

Firstly, Numworks closed their sources in 2021. However, IIRC, the n0110 production stopped in 2023. And AFAIK Upsilon have not issue on late n0110 while numworks was able to change the screen model. However, there might be a selection bias : these late numworks was already locked, and, unless phi, it required a material unlock.

Secondly, a man succeeded to use a NON-GENUINE screen on a n0110. So I don't think it can cause permanent damages.

However, as I said, it is purely theorical.