Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Gemfile
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ source 'https://rubygems.org'
gem "jekyll", "~> 4.3.2" # installed by `gem jekyll`
# gem "webrick" # required when using Ruby >= 3 and Jekyll <= 4.2.2

gem "just-the-docs", "0.5.4" # pinned to the current release
# gem "just-the-docs" # always download the latest release
# gem "just-the-docs", "0.5.4" # pinned to the current release
gem "just-the-docs" # always download the latest release
8 changes: 5 additions & 3 deletions Gemfile.lock
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ GEM
http_parser.rb (~> 0)
eventmachine (1.2.7)
ffi (1.15.5)
ffi (1.15.5-x64-mingw-ucrt)
forwardable-extended (2.6.0)
google-protobuf (3.24.1-x64-mingw-ucrt)
google-protobuf (3.24.1-x86_64-linux)
Expand All @@ -33,14 +32,17 @@ GEM
safe_yaml (~> 1.0)
terminal-table (>= 1.8, < 4.0)
webrick (~> 1.7)
jekyll-include-cache (0.2.1)
jekyll (>= 3.7, < 5.0)
jekyll-sass-converter (3.0.0)
sass-embedded (~> 1.54)
jekyll-seo-tag (2.8.0)
jekyll (>= 3.8, < 5.0)
jekyll-watch (2.2.1)
listen (~> 3.0)
just-the-docs (0.5.4)
just-the-docs (0.6.0)
jekyll (>= 3.8.5)
jekyll-include-cache
jekyll-seo-tag (>= 2.0)
rake (>= 12.3.1)
kramdown (2.4.0)
Expand Down Expand Up @@ -77,7 +79,7 @@ PLATFORMS

DEPENDENCIES
jekyll (~> 4.3.2)
just-the-docs (= 0.5.4)
just-the-docs

BUNDLED WITH
2.3.26
86 changes: 21 additions & 65 deletions docs/casio_emu.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Over the years, [Casio](https://wikipedia.org/wiki/Casio) has made emulators of

## Emulator subscriptions
### What is currently known ###
If you have started a trial period, downloading another evaluation emulator would actually use the same trial period. For example, if you have opened an evaluation Casio fx-570/991EX emulator and used it for a day, downloading and opening a [[Casio fx-580VN X]] evaluation emulator will show that you have 89 days left before a license is required. Uninstalling will not affect anything. This is because the trial license actually uses the same application name and version, therefore it is treated as one single application.
If you have started a trial period, downloading another evaluation emulator would actually use the same trial period. For example, if you have opened an evaluation Casio fx-570/991EX emulator and used it for a day, downloading and opening a Casio fx-580VN X evaluation emulator will show that you have 89 days left before a license is required. Uninstalling will not affect anything. This is because the trial license actually uses the same application name and version, therefore it is treated as one single application.

Casio uses SafeNet Sentinel technology as the license system. You can see this by going to `C:\ProgramData` (`ProgramData` is a system folder), where you will see a folder titled `SafeNet Sentinel`. The official guide to set up a network server made by Casio also tells you to download "Sentinel RMS License Manager". Not much is known about this SafeNet Sentinel technology, other than the fact that it definitely was secure *for the average user*.

Expand All @@ -41,8 +41,8 @@ The basic steps to do this with Windows Sandbox are:

This method is easy to perform, but is very slow, and very frustrating because you have to set up the sandbox every time. Some have worked around this by preparing a folder with all the required software and simply copying it to the sandbox, however it is still very frustrating. This method is only recommended if you are perfectly okay with setting up a sandbox multiple times, or if you need to mass-install a lot of emulators and don't need them much.

#### Modifying the emulator EXE
The harder but more efficient way to bypass activation is to patch the emulator's executable to run the main emulator code no matter what. This way, you do not need a sandbox environment.
#### Modifying the emulator code
The harder but more efficient way to bypass activation is to patch the emulator to run the main emulator code no matter what. This way, you do not need a sandbox environment.

##### Pre-patched versions
If you search hard enough, you can find pre-patched/cracked versions of these emulators. However, these cracks usually don't use the latest version.
Expand All @@ -62,74 +62,30 @@ If you search for "QLam Xmaster", eventually you'll find two more versions of th
Both of these versions are also linked [below](#downloads).

##### DIY patching
Since it's very hard to find cracked versions of these emulators, you probably need to patch the EXE yourself.
Since it's very hard to find cracked versions of these emulators, you probably need to patch it yourself.

This guide below uses [Ghidra](https://wikipedia.org/wiki/Ghidra), an open-source reverse-engineering tool developed by the [National Security Agency](https://wikipedia.org/wiki/National_Security_Agency) of the United States, to patch an emulator EXE to bypass activation.<br>
This guide below uses [Ghidra](https://wikipedia.org/wiki/Ghidra), an open-source reverse-engineering tool developed by the [National Security Agency](https://wikipedia.org/wiki/National_Security_Agency) of the United States, to patch the DLL file `ActivationFx.dll` to bypass activation.<br>
<span class="text-red-300"><u><b>DISCLAIMER:</b></u> Casio's emulators are **[proprietary software](https://wikipedia.org/wiki/Proprietary_software)**. If your country bans [piracy](https://wikipedia.org/wiki/Piracy), please **do not** follow the guide below if you haven't legally purchased a license. The guide below is for **educational and informational purposes only**.</span>

Please read the following before doing the guide below:
- This guide is only recommended if you need to install 1 or 2 emulators so you can use them as long as you want, because this guide takes, at minimum, around **20 minutes** to do. A majority of that time is spent waiting for auto-analyzation to finish, and the auto-analyzation time can change depending on your computer's speed.
- The guide applies to the latest ClassWiz (EX) emulator version (02.01.0030.0000) and the latest fx-ES PLUS re-release emulator version (05.00.0020.0000) as of writing this article.
- The guide uses the fx-580VN X emulator (version 02.01.0020.0000) as an example. Every emulator EXE is different but has the same code recompiled (if the version is the same), so `FUN_xxxxxxxx` function names may be slightly different for you, but everything else should stay the same.
- The guide applies to all Casio calculator emulators with a trial period.
- While the guide uses Ghidra, you can use any reverse-engineering tool to patch the EXE and bypass the activation process.

**Copying the emulator EXE path** (well duh...)
0. Navigate to where the emulator you want to patch is installed. Create a backup of the executable. Then copy the EXE's path (on Windows: click on the *original* (not the backup) emulator EXE, right-click and select *Copy as path*.)

**Setting up**
1. [Download Ghidra](https://github.com/NationalSecurityAgency/ghidra/releases/latest).
2. Open Ghidra and create a new project (name it whatever you want).
3. In the newly created project, press I to bring up an *Import File* window. In the *File name* field, paste the path to the emulator EXE that you copied from earlier. Click on *Select File To Import*, then click OK. Wait for the file to import.
4. Double-click on the file you just imported to open the file with the *Code Browser*.
5. Click *Yes* when you are prompted to analyze the file. Then in the window that appears click *Analyze*. Wait for the auto-analyzation to finish. You can look at the bottom right of the *Code Browser*, and if you see no progress bar, auto-analyzation is done, and you can move on.

**Patch 1/2 -- Patching the activation dialog**
6. After auto-analyzation is done, in the *Symbol Tree* tab, click on *Imports* > `ACTIVATIONFX.DLL`, then click on `AcvFx_IsActivationDialog2` and press Ctrl+Shift+F to show references to the function. Select the first reference and close the window.
7. Look at the *Decompile* tab. You should see decompiled C code that looks something like this:
```c
// ...
iVar3 = FUN_004cc580(local_30e0);
if (iVar3 != 0) {
cVar1 = AcvFx_IsActivationDialog2(local_30e0,0xffffffff,1);
if (cVar1 != '\0') {
memcpy(local_1408,local_30e0,0x1364);
-(undefined4 --)(param_1 + 0x20) = local_1d78;
Ordinal_3627();
}
// ...
```
8. First, click on `memcpy`. The Listing tab will highlight a `CALL` instruction. Now above that instruction are some `PUSH` instructions; find one that comes right after a <span title="Jump if zero" style="border-bottom:1px dotted"><code>JZ</code></span> instruction. On the very left you'll see the instruction address; highlight and copy it.
9. Now go back to the *Decompile* tab and click on the `if` in `if (iVar3 != 0)`. The *Listing* tab will highlight a <span title="Jump if zero" style="border-bottom:1px dotted"><code>JZ</code></span> instruction. Click anywhere on the instruction, then press Ctrl+Shift+G to begin patching the instruction. A dialog box will appear, press OK, and wait for Ghidra to construct an assembler.<br>When it's done, you will see two fields. In the first field, change <span title="Jump if zero" style="border-bottom:1px dotted"><code>JZ</code></span> to <span title="Jump no conditions" style="border-bottom:1px dotted"><code>JMP</code></span>. On the second field, highlight the letters and numbers after `0x`, then paste the address you copied from earlier. Press Enter, and you should be left with a `JMP LAB_00xxxxxx` instruction.

**Patch 2/2 -- Patching a license server check**[^2]
10. Now return to the *Symbol Tree* tab, select `AcvFx_GetPropertyPage2`, Ctrl+Shift+F, select the first reference and close the window. Now in the *Decompile* tab, scroll down. You should find some code looking something like this:
```c
// ...
FUN_004c7fe0();
AcvFx_ActivationErrorDlg(local_136c,1,param_1);
piVar2 = (int -)Ordinal_1944();
if (piVar2 == (int -)0x0) {
iVar3 = 0;
}
else {
iVar3 = (--(code --)(-piVar2 + 0x7c))();
}
PostMessageW(-(HWND -)(iVar3 + 0x20),0x10,0,0);
}
}
FUN_004cb6e0();
SetTimer(-(HWND -)(param_1 + 0x20),1,240000,(TIMERPROC)0x0);
@__security_check_cookie@4(local_8 ^ (uint)&stack0xfffffffc);
return;
}
```
11. First, click on the name of the function above the `SetTimer` function call. On the *Listing* tab you'll see a `LAB_00xxxxxx` label. Copy the label.<br>Back to the *Decompile* tab, click on the name of the function above the `AcvFx_ActivationErrorDlg` call. Over on the *Listing* tab a `CALL` instruction will be highlighted. Click anywhere on the instruction and press Ctrl+Shift+G. In the first field, change `CALL` to <span title="Jump no conditions" style="border-bottom:1px dotted"><code>JMP</code></span>. On the second field, delete **everything** and paste in the `LAB_00xxxxxx` label you copied from earlier. Press Enter.

**Exporting the patched EXE**
12. Press O to bring up the *Export Program* dialog. Select the output as *PE* or *Original File*, and set the output filename to the path to the emulator EXE. You can repeat step 0[^4] to grab the path again (don't create a backup this time, unless you haven't).
13. Press *OK*. In the dialog box that appears click *Overwrite*. **Make sure you have saved a backup of the emulator executable!**
14. Wait for Ghidra to export the EXE. When it's done, a big dialog box will appear. Press Escape to close it. You can now close Ghidra, and delete Ghidra and the project you just made if you want.
15. Profit!
1. Navigate to where the emulator you want to patch is installed. Create a backup of the DLL `ActivationFx.dll`, then copy its path (on Windows: click on the *original* (not the backup) `ActivationFx.dll`, right-click and select *Copy as path*.)
2. [Download Ghidra](https://github.com/NationalSecurityAgency/ghidra/releases/latest).
3. Open Ghidra and create a new project (name it whatever you want).
4. In the newly created project, press I to bring up an *Import File* window. In the *File name* field, paste the path to `ActivationFx.dll` that you copied from earlier. Click on *Select File To Import*, then click OK. Wait for the file to import.
5. Double-click on the file you just imported to open the file with the *Code Browser*.
6. Click *Yes* when you are prompted to analyze the file. Then in the window that appears click *Analyze*. Wait for the auto-analyzation to finish. You can look at the bottom right of the *Code Browser*, and if you see no progress bar, auto-analyzation is done, and you can move on.
7. After auto-analyzation is done, in the *Symbol Tree* tab, click on *Functions* > `AcvFx_` > `AcvFx_IsActivationDialog2`.
8. Look at the Decompile tab. You should see some C code. Click on the very first line in the function. Press Ctrl+Shift+G, close the window that pops up, and wait for Ghidra to construct an assembler.
9. When done, you'll see two fields. Make sure the first field is `MOV` and the second field is `EAX, 0x1`. Press Enter.
10. Under the instruction you patched is a hex byte. Select it and Ctrl+Shift+G again. Now make sure the first field is `RET` and the second field is `0xc`. Press Enter.
11. Press O to bring up the *Export Program* dialog. Select the output as *PE* or *Original File*, and set the output filename to the path to `ActivationFx.dll`. You can repeat step 1 to grab the path again (don't create a backup this time, unless you haven't).
12. Press *OK*. In the dialog box that appears click *Overwrite*. **Make sure you have saved a backup of `ActivationFx.dll`!**
13. Wait for Ghidra to export the DLL. When it's done, a big dialog box will appear. Press Escape to close it. You can now close Ghidra, and delete Ghidra and the project you just made if you want.
14. Profit!

Now, when starting the patched emulator, no activation dialogs will appear, even if the trial period has expired or has been invalidated.

Expand All @@ -152,7 +108,7 @@ Some of Casio's emulators/emulator packs are currently lost or kept private for
- Casio no longer sells this pack, and it wasn't archived by most. No ISO images and *almost* no emulators from the pack have resurfaced on the internet. Instead, you can only find some images of the version 1.1 box and CD, as well as some manuals showing what the emulator looks like and how it would've been installed and uninstalled.
- **FC-200V Emulator** (financial calculator emulator):
- <span class="text-red-300">**Lost.**</span>
- This emulator is also one of Casio's paid products, and it met the same fate just like with the fx-ES Emulator pack. This emulator is largely unpopular partly because it's for finance rather than something you'd use in math class, and probably only a very small number of people actually bought it. To this day, no copies of the emulator were found. The only evidence of it existing is [https://www.youtube.com/watch?v=4LkJfcnCTRk a YouTube video showcasing the emulator].
- This emulator is also one of Casio's paid products, and it met the same fate just like with the fx-ES Emulator pack. This emulator is largely unpopular partly because it's for finance rather than something you'd use in math class, and probably only a very small number of people actually bought it. To this day, no copies of the emulator were found. The only evidence of it existing is [a YouTube video showcasing the emulator](https://www.youtube.com/watch?v=4LkJfcnCTRk).
- **fx-ES PLUS Emulator** (ES PLUS model emulator pack):
- <span class="text-red-300">**Partially found.**</span>
- This pack also met the same fate as the fx-ES Emulator pack, however we do have a full (cracked) version 4.0 pack, as well as a version 3.02.1.0 (albeit modified) fx-570VN PLUS Emulator.
Expand Down