Most of the aspects of the communication protocol are
covered in ..\fxReverse2x.pdf.
The bootcode supports command 0x01, 0x02, 0x07 and 0x56 only.
The protocol is supported by the models fx-9860G, fx-9860GII, fx-9750GII and fx-7400GII. As fx-9750GII and fx-7400GII do not support the storage memory, the related protocol-functions won't work. The fx-7400GII has no USB-port. Hence the communication takes place via the serial interface. The fx-CG20 supports the protocol, too.
Related syscalls are described here Comm.
Another important subtype may be "56". It is used to upload and run UpdateExe.bin during the OS update process. I can be used as universal "upload and run" function.
Command: 0x01 '56' '1' <upload-size> <loadaddress> <startaddress> <checksum> 0x00
<upload-size> is the eight byte ASCII-HEX representation of the amount of data to be uploaded.
<loadaddress> is the eight byte ASCII-HEX representation of the RAM-address where the data has to be loaded to (OS update: "88030000").
<startaddress> is the eight byte ASCII-HEX representation of the startaddress, where to jump after successful upload (OS update: "88030000").
Contrary to other commands, this one is terminated with a binary zero.
The data are transported with standard data-packets of subtype "56".
The last data-packet is acknowledged with an ack-packet of subtype "03"! The uploaded programm is started automatically after successful transfer of the last data-packet.
The uploaded program mustn't return (rts). It has to reboot.
The uploaded program is not limited to one 64k-sector. In case of calculators with 512k RAM it may extent up to address 0x8807FFFF. As well it may start at 0x88024000, because the heap is not used in this process. Hence the maximum size of the program may be 368k.
Internal Packet type mapping:
Parameter distribution for
OW -> @(0x0C,r15).b
DT -> @(r15).b
FS -> @(0x04,r15).l
SD1 : @(0x24,r15)
SD2 : @(0x20,r15)
SD3 : @(0x28,r15)
SD4 : @(0x2C,r15)
SD5 : @(0x1C,r15) : @(0x3C,r15)
SD6 : @(0x34,r15)
r9 = &D1 -> @(0x114,r15)
r8 = &D2 -> @(0x114+SD1,r15)
(0x544,r15) = &D3 -> @(0x114+SD1+SD2,r15)
(0x530,r15) = &D4 -> @(0x114+SD1+SD2+SD3,r15)
(0x51C,r15) = &D5 -> @(0x114+SD1+SD2+SD3+SD4,r15) : (0x5C,r15)
(0x508,r15) = &D6 -> @(0x114+SD1+SD2+SD3+SD4+SD5,r15)
"crd0" : @(0x38,r15)