Overview - TI-84 Plus OS — Reverse Engineering

Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Auto

Light

Rust

Coal

Navy

Ayu

TI-84 Plus OS — Reverse Engineering

TI-84 Plus OS — Reverse-engineering notes: system overview

Target: ti84plus.rom (1 MiB flash dump). OS self-identifies as 2.55MP. CPU: Zilog Z80 (16-bit address bus, 64 KiB logical space) with hardware flash/RAM paging. Ghidra project: ~/Documents/ti84-re/ti84.gpr (rebuild: tools/build.sh).

Confidence is flagged: [confirmed] = verified in disassembly/decompiler; [standard] = matches documented TI-83+/84+ architecture and is consistent with the disassembly; [hypothesis] = inferred, not yet verified.

The big picture

The TI-84+ is a Z80 machine that can only see 64 KiB at once, but has 1 MiB of flash and 128 KiB of RAM. It bridges that gap with a 4-slot paging scheme and a system-call (“bcall”) mechanism that lets code on one 16 KiB flash page call routines on any other page. The OS is a single-tasking monitor: a boot/kernel core on flash page 0 (always mapped low), a large body of OS routines spread across the other flash pages and reached via bcalls, and a fixed RAM region holding the system state (flags, floating-point registers, display buffers, the variable table).

Everything the user interacts with — the homescreen, TI-BASIC programs, graphing, the catalog — is built on four pillars:

Paging + bcalls — how code and data beyond 64 KiB are reached. (see 02-paging.md, 03-bcall-mechanism.md)

The floating-point engine — 9-byte BCD reals/complex in the OP1–OP6 registers; all math flows through these. (06-floating-point.md)

The variable system (VAT) — named objects (reals, lists, matrices, strings, programs, appvars…) catalogued in the Variable Allocation Table. (05-variables-vat.md)

The tokenizer/parser — TI-BASIC is stored as 1- and 2-byte tokens; the parser executes them. (07-tokenizer-basic.md)

Around those sit the I/O subsystems: the IM1 interrupt that drives timing/APD/cursor/ON-key (04-interrupts.md), the LCD driver, the keypad scanner, and the link port.

Subsystem index

Each row maps a documentation page to the subsystem it covers and its analysis status.

DocSubsystem

01-memory-map.mdAddress space, ports, RAM layout<br>02-paging.mdFlash/RAM banking (ports 6/7)<br>03-bcall-mechanism.mdrst 28h system calls + jump table<br>04-interrupts.mdIM1 ISR, timers, APD, ON key<br>05-variables-vat.mdVariable Allocation Table, object types<br>06-floating-point.mdBCD float format, OP registers<br>07-tokenizer-basic.mdToken tables, parser/interpreter<br>08-display-lcd.mdLCD ports, screen buffers<br>09-keyboard-link.mdKeypad scan, link protocol<br>10-subsystem-map.mdbcall API surface, system through-line<br>11-boot-contexts-errors.mdBoot, context system, _JError/onSP<br>12-memory-management.mdRAM heap, VAT/userMem, Flash archive/GC<br>13-flash-page-map.mdWhat each of the 64 flash pages contains<br>14-ram-pages.mdRAM page selectors, page 83, and restore rules<br>99-open-questions.mdPrioritized future-work roadmap<br>sub-calculation.mdCalculation engine: FP ops, transcendentals, formatting, errors<br>sub-graphing.mdGraphing: window vars, coord↔pixel, draw primitives, Y= eval<br>sub-tibasic.mdTI-BASIC: program execution, control flow, I/O commands<br>sub-tibasic-tracing.mdTI-BASIC fixture traces, smoke runner, coverage anchors<br>sub-vat-archive.mdVariables, Sto/Rcl, Archive/Unarchive, Flash GC<br>sub-apps-mem-settings.mdApps find/launch, RAM-reset, MODE/format flags<br>sub-statistics.mdSTAT: 1/2-var, regressions, statVars<br>sub-matrix-list.mdMatrix/list element access, Gauss-Jordan inverse/det, matmul<br>sub-solver-numeric.mdSolver root-finder, nDeriv/fnInt, TVM finance<br>sub-table-yvars.mdTABLE generation/cache, Y= equation vars<br>sub-equation-display.mdEquation display / MathPrint layout (page 0x39 eqdisp_*)<br>sub-link-transfer.mdLink protocol: byte/packet/var-transfer (page 0x3C)<br>sub-usb-asic.mdUSB ASIC/link-assist ports and OS transport selection

(The sub-* docs are deep dives covering user-facing functionality and I/O internals: calculation, graphing, TI-BASIC, VAT/archive, apps, stats, matrices, solver, table, equation display, link, and USB/link assist.)

New to these notes? Start with Conventions & Methodology (how to read the addresses and confidence flags) and the Glossary; the bcall Index is the full alphabetical system-call reference.

The main 0x4xxx bcall table and the retail boot bcall table (0x8xxx, from the local complete ROM) both carry TI-OS types. Most boot bcall bodies are on page 3F; USB boot routines such as _AttemptUSBOSReceive, _ReceiveOS_USB, _InitUSB, and _KillUSB are on page 2F. Rebuild: tools/build.sh.