SuperH-based fx calculators
fx-CG20, G3A-structure

virtual start address: 0x00300000
syscall wrapper: 0x80020070
virtual RAM address: 0x08100000

All file formats that are read or written by the calculator share a common header format. This header is inverted before being written and read, so a description of the inverted file data make more sense than the normal file data:

Offset (b) Size (b) Description
0 8 File identifier: “USBPower”
8 1 File type identifier
9 5 {0x00, 0x01, 0x00, 0x01, 0x00}
0xE 1 Control byte: (LSB of filesize (at offset 0x13)) + 0x41
0xF 1 0x01
0x10 4 Total file size as unsigned integer, big endian format
0x14 1 Control byte: (LSB of filesize (at offset 0x13)) + 0xB8
0x15 1 Unknown purpose (maybe 4-alignment), appears insignificant
0x16 2 this is suspected to be a CRC (doubtful!), but luckily it is not cared for by the fxCG20-OS
0x18 8 unknown
0x20 ... Subheader depending on particular file type

Known file types are:
0x2C Addin

Addin subheader
Upon execution, the addin-code starting at file offset 0x7000 is virtually mapped to 0x00300000, and the OS jumps to address 0x00300000 (“Addin code”). The addin code should use 0x08100000 for its .bss and .data sections (static RAM). CASIOs SDK will automatically add initialization code that loads the .data section and performs various system calls.

Addin subheader fields

Offset (b) Size (b) Description
0x20 4 byte checksum: 0x00000000 to 0x0000001F and 0x00000024 to EOF minus 4
0x24 2 01 01
0x26 8 unknown; obviously insignificant, usually 0x00
0x2E 4 filesize - 0x7000 - 4
0x32 14 unknown; obviously insignificant, usually 0x00
0x40 16 title
0x50 12 unknown; obviously insignificant, usually 0x00
0x5C 4 filesize
0x60 8 internal_name; preceded by @
0x68 3 unknown; obviously insignificant, usually 0x00
0x6B 24 language_1_label; english
0x83 24 language_2_label; spanish
0x9B 24 language_3_label; german
0xB3 24 language_4_label;
0xCB 24 language_5_label;
0xE3 24 language_6_label;
0xFB 24 language_7_label;
0x113 24 language_8_label;
0x12B 1 01
0x12C 4 0 0 0 0
0x130 12 version "01.00.0000",0,0
0x13C 14 stamp "2012.0903.1652
0x14A 38 all zeros
0x170 36 language_1_label; english
  36 language_2_label; spanish
  36 language_3_label; german
  36 language_4_label;
  36 language_5_label;
  36 language_6_label;
  36 language_7_label;
  36 language_8_label;
0x0290 0xC2C some 3C- or bw-bitmap
0x0EBC 0x144 G3A filename; f. i. "PictPlot.g3a"
0x1000 0x3000 selected icon image
0x4000 0x3000 unselected icon image
0x7000  . . . Addin code

The CASIO SDK expects 30x19 bw BMP-files. The first and last line are omitted, when a G1A is assembled.

G3A-startup; fx-CG20; OS1.04
syscall sys0017 App_RegisterAddins_ validates add-ins, when the MAIN MENU is built up.
1. the checksums at 0x20 and at the end of the file are compared (0x8002D376; OS104).
2. the byte at 0x24 is checked to be 1 (0x8002D386; OS104).

The byte at 0x0E is not checked.
The byte at 0x14 is not checked.
With OS 1.04, the complete 0x10 bytes starting at 0x00 are not heeded for.

When the addin is started, the following checks are done inside of 0x8002CB22 (OS104), called by syscall 0x0026 and 0x002C. 0x002C seems to check conv.g3a every time any addin is started.
At first the actual filesize is compared to the filesize stored at file-offset 0x5C (0x8002CB94; OS104).
Then it calculates and compares the checksum (0x8002CCBE; OS104).

Two address-ranges 0xFE240000 and 0xFE241000 are involved in addin-loading. They contain at least 63 int-values, which are initialized with zeros. If an addin is considered to be OK the correspondig entry in table 0xFE240000 is 1. If a checksum-mismatch or a filesize-mismatch is detected, the corressponding value in table 0xFE240000 will be 2. These memory-ranges are a bit peculiar. The calculator freezes, if INSIGHT tries to display the memory-ranges. Theses addresses obviously are not used in the GII-2 series' OSes.


(18.05.2012 17:16:07)