[comp.sys.handhelds] The "wicked" directory on the HP48SX

jurjen@cwi.nl (Jurjen NE Bos) (08/20/90)

(This is a continuation of my article on empty names)

		My wicked, wicked hacks...

-------------------------------------------------------------------------------
This is a transcript of a lecture which was part of a meeting held by STORC,
(Stichting Ter Ondersteuning van RPL Calculators) which is the Dutch support-
group for the HP48SX, HP28S and HP28C. STORC publishes a (dutch) magazine,
"STORC Nieuwsbrief", 10 times a year. STORC is managed by Eric Toonen, Jurjen
Bos, Helene Lankreijer and Christ van Willegen.
Telephone in holland: 040-410049.

Our address:	STORC p.a. Christ van Willegen
		Dordognelaan 45
		5627 HB  Eindhoven
		The Netherlands
-------------------------------------------------------------------------------

In this note you can read:
- About the hidden subdirectory you never knew;
- How binaries > 64 bits are displayed;
- A lot of how the alarms work;
- A lot of how the user-defined keyboard works.

	Written by:	Eric Toonen
			Djept-Zuid 6
			5502 RP Veldhoven
			The Netherlands

Introduction
------------
You cannot enter an empty name. When you do, it is discarded from the
commandline. This fact was used by the designers of the HP48SX.

What the normal user does not know, is that there is always a subdirectory in
your HOME directory. In this directory, the alarms and userkeys are kept.
I found this out by doing a lot of hacking.


How to do that...
-----------------
Here is a description, first of
how to get into this directory, and after that, what exactly is in this
directory.

To be able to follow these steps, you need a BAG (or POKE) routine, which was
written and posted by Alonzo Gariepy.
Also, you need to know how to enter/exit/operate the internal debugger.

If anything goes wrong, type [ON]-[C] and start over. If your machine
crashes, and you get the question "Try to recover memory?" ALWAYS ANSWER
YES!...

o Enter the debugger.
o Go to address F0592. Read the first five nibbles: They are of the
  kind "<m><n><o><p>7"
  Check: The "7" must be there!
o Now go to address "F<p><o><n><m>".
  Check: Here you must see "69A20"!
o Now press [+] 60 times.
  Check: Here you must see "69A20FF7"! If these numbers aren't exactly
  most against the colon, press [+] or [-] until you do.
o Now, remember the 5-nibble address you are at. Replace the first
  nibble (must be "F") with "7", and write it down on paper.
o Exit the debugger. You will get in your HOME directory.
o Enter a directory from which you can use BAG (or POKE).
o Now type 20 STWS HEX
o Now type the binary number you wrote down.
o Type #7059Ch
o Now execute your BAG (or POKE).
  Don't panic, you are in a strange directory. Do nothing but these
  steps.
o Type PATH OBJ\-> DROP.
  Check: Level 1 of your stack will contain an empty name, level 2 will
  contain HOME.
o Type SWAP EVAL
o Type 'WICKED' STO

Congratulations!
If your machine did not crash during this entire session :-), you will now
have a variable 'WICKED' (shown as 'WICK' on the menu bar) in your HOME
directory. It does not have a directory-score over it, but effectively it
*IS* a directory. This directory has the name '', but now, you can use it, as
the directory 'WICKED'.


Some facts about WICKED:
------------------------
If you enter the WICKED directory, you will see no change in the path listing
in your status line.

If you are in WICKED, an empty name is added in the PATH list. You will not
see this when you look at the list, but you will when you type LIST\->. I
suggest you not to play a lot with empty names. Doing so on an HP28S gave me
several crashes.

Normally, there are three variables in WICKED:
You better not STOre or PURGE these.

ALAR:	Alarms
USER:	UserKeys
USER:	UserKeys.CRC

Creating any new variables here is ok.
STOring and PURGEing your own variables is ok.

Do *NOT* ORDER this directory, or STO or PURGE one of the standard three.

The 'Try to recovering memory' software is not able to restore WICKED, so you
have to do that by hand (so: do not lose this article.)
The contents of WICKED will *NEVER* be restored.


Alarms
------
Alarms contains information about the alarms you set.
If you have no alarms, it will contain an empty list.
If you have alarms, there will be a list for every alarm set, of the format:

{ 24-nibble-binary exec }

These 24-nibble binaries are displayed as
C# 24 ...value...
(Compare this to C$ 24 ...value... for strings. Note however, that you cannot
ENTER binaries this way.)
The time, date and repeat-count is probably encoded in these binaries.

If there is no exec, it is an empty string.

Note: I crashed my machine, STOring an ordinary empty list in 'Alarms'. The
alarm I had running was *still* known to the alarm-catalog, but I crashed
acknowledging it.

UserKeys
--------
UserKeys contains either an empty list (if you have no user key assignments),
or:
UserKeys contains a list with 49 (one for every key) lists. Every list is for
a key. These lists:
- are empty if you have no additional assignments on the key.
- have six (one for every shift status) objects if you have *any*
assignment(s) on the key.
	These six objects:
  	- are an empty list if you have no additional assignment on this
	particular shift of the key.
  	- have the assignment (name, string, program,...) for this shift.

The 49 lists are in the order left to right, top to bottom, and therefore
numeric order (as in the ASN command).

The 6 objects are in this order:
1) unshifted
2) left-shift
3) right-shift
4) alfa
5) alfa & left-shift
6) alfa & right-shift

I could not find any information on the 'S' (Standard) key assignment.
This is probably handled by a simple flag somewhere in RAM.

UserKeys.CRC
------------
UserKeys.CRC contains the BYTES checksum on the variable 'UserKeys'. Since
the name is CRC (for Cyclic Redundancy Check) you might have now got some
guesses on what the checksum algorithm is.

UserKeys will probably be considered 'invalid' when the CRC's don't match?...


That's all
---------
Eric Toonen
Djept-Zuid 6
5502 RP  Veldhoven
The Netherlands

			Try to recover memory?
			Just say YES!

PS Of course, since Bill Wickes was so nice to post his ASC\-> program, you
can make and empty name by just entering
"82E2000E147" ASC\->
I left the article intact, as I did not write it.
--
|                 | "Never imagine yourself not to be otherwise than what |
| Jurjen N.E. Bos | it might appear to others that what you were or might |
|                 | have been was not otherwise than what you had been    |
|  jurjen@cwi.nl  | would have appeared to them to be otherwise."         |

cloos@azure.acsu.buffalo.edu (James H. Cloos Jr.) (09/02/90)

In article <1976@charon.cwi.nl> Jurjen Bos posted an article written by Eric
Toonen on the empty name on HP48's.  He described how to create one, and some
files that are in the directory {HOME ''}.  At the end he included a string
to pump thru Bill Wickes' ASC\-> program to get the empty name.  There was a
typo in this string!

The INCORECT string is "82E2000E147"  please change this to:

the  CORECT  string of "84E2000E147"  NB that only one digit was wrong.

If you try to use the wrong string, the error is such that ASC\-> *is* able
to give you an "INVALID STRING" error, rather than crash the 48.

L8r ffolks!

-JimC

ps. Nice to be back on the net, w/o having to phone long dist!

-- (Abreviated .sig)
James H. Cloos, Jr.	cloos@ascu.buffalo.edu
	Snail to zip code 14048-0772		+1 716 673-1250