HP 50g bootloader binary blob format

[mruize85]

When I bought my HP 50g I used a lot userRPL and did some experiments with systemRPL and HPGCC. I'm not using my calculator since few years, so I decided to recycle it to do some other stuff not necessarily related with calculators business.

I saw the amazing newRPL project and now I know it is possible to flash HP 50g with a custom binary blob using built-in bootloader, keeping the option to flash it back again with the official firmware.

I have one problem that prevents me using this approach: I can't reverse engineer nor find information about firmware binary blob format. I only know it starts with "KINPOUPDATEIMAGE" string. Probably there will be a header, maybe sections, an entry point, and some ARM code in ARM or THUMB mode to execute.

Can somebody help me?

Thanks,
Marcial.

[mruize85]

Finally I found the solution. Firmware binary blob must start with the string "KINPOUPDATEIMAGE", followed by 8 bytes with value 0, and followed by executable code in ARM mode (normally a branch instruction to an entry point). Simple.

[pier4r]

Thanks for sharing