Welcome at the cfx 9850 G hacking page !

Here you can find all information about CPU of this calculator (instruction codes, subroutine adresses,...) I found.

I don`t know the manufacturer or the type of CPU used, so all, what you read here, I found in a lots of hours of hacking, disassembling and hacking....

General about CPU

Address : 16 bits, special unconditional long jump 24 bits

Data : 8,16 and variable length from 8 to 128 bits, step 8 bits selectable in runtime  (also instructions working with RAM)

Registers: array of 128 8 bit registers which can be used as single registers or grouped to any supported size (8 - 128 bits)

Size of segment : 64 KB (16 bit addressing)

More segments : read this

The far jump instruction is used very very few times in the whole ROM


20h..27h : ROM - 8 segments (8x 64 KB = 512 KB), segs 0 - 3 code, 3 - 5 data, 6-7 unused :-))

40h : RAM - 1 segment (32 KB), upgradeable to 64 KB and probably to 512 KB :-))) (not tested),

8h : VIDEO - 1 segment (2 KB) - CPU stack at 02FF and buffers for text screens

60h: Display RAM - 1 segment (8KB), used as graphic display - ((2 color rows) * (128 columns) * (64 rows) bits)
this segment is NEVER  only once in the whole ROM ccessed by DSeg 60h, in all other cases by Dseg R3F

Table of Instructions

:-) x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 xA xB xC xD xE xF
0x shrB R,8 shrW R,8 shr8 R,8 shr10 R,8 maskB maskW mask8 mask10 shlB R,4 shlW R,4 shl8 R,4 shl10 R,4 TestB TestW Test8 Test10
1x xorB xorW xor8 xor10 cmpB cmpW cmp8 cmp10 movB movW mov8 mov10 nmaskB nmaskW nmask8 nmask10
2x shrB shrW shr8 shr10 orB orW or8 or10 shlB shlW shl8 shl10 andB andW and8 and10
3x BsubB BsubW Bsub8 Bsub10 subB subW sub8 sub10 BaddB BaddW Badd8 Badd10 addB addW add8 add10
4x shrB [R],8 shrW [R],8 shr8 [R],8 shr10 [R],8 maskB[] maskW[] mask8[] mask10[] shlB [R],4 shlW [R],4 shl8 [R],4 shl10 [R],4 TestB[] TestW[] Test8 [] Test10[]
5x xorB[] xorW[] xor8[] xor10[] cmpB[] cmpW[] cmp8[] cmp10[] movB[] movW[] mov8[] mov10[] nmaskB[] nmaskW[] nmask8[] nmask10[]
6x shrB[] shrW[] shr8[] shr10[] orB[] orW[] or8[] or10[] shlB[] shlW[] shl8[] shl10[] andB[] andW[] and8[] and10[]
7x BsubB[] BsubW[] Bsub8[] Bsub10[] subB[] subW[] sub8[] sub10[] BaddB[] BaddW[] Badd8[] Badd10[] addB[] addW[] add8[] add10[]
8x 1 1 jump jumpf call 1 1 1
9x rzh rzl rc rz rzc rcl rnc rnz jump[] iret ret
Ax jzh jzl jc jz jzc jcl jnc jnz callzh callzzl callc callz callzc callcl callnc callnz
Cx 3 movW16 3 3 3 3 3 3 3 3 3
Dx Cseg R Cseg 2 2 Sseg R Sseg SReg R SReg SFlag R SFlag Dseg R Dseg
Fx 2 2 2 2 2 2 1 2 2 2 2 2 1 1 1 nop
:-) x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 xA xB xC xD xE xF

<n> = unknown instruction, but it's length is probably n B

<?n> = unknown instruction, unknown length, but probably length = n B


FF nop ; used for filling free space

Jumps and calls

Parameter: target address - 16 bit - big endian

88 jump

89 jumpf - far jump, first parameter is number of target segment, the second and third p. are
offset - big endian

8A call

A1 unknown (conditional) jump

A2 jc    ;jump if carry

A3 jz    ;jump if zero

A4 jzc  ;jump if carry or zero

A6 jnc ;jump if not carry

A7 jnz ;jump if not zero

AA callc ;call if carry

AB callz  ;call if zero

AC callzc ;call if zero or carry

AE callnc ;call if not carry

AF callnz ;call if not zero

Example:  88 12 34    Jump 1234

98 jump <register> : jump to the address stored in the register, it must be big endian, but data are loaded in little endian, so jump to the address 1234 is done

C1 75 34 12 ;mov R75 1234
98 76 ; jump[R76] - it reads the register "backwards"

Returns from subroutines

No parameter

9F ret  ;unconditional return

92 retc; return if carry

93 retz ; return if zero

94 retzc ;return if zero or carry

96 retnc ;return if not carry

97 retnz ;return if not zero

Segment change

Parameter - number of segment or register containing the number of segment - 8 bit

D1 CSeg ;change code segment - number

DC DSeg ;change data segment - register

DD DSeg ;change data segment - number

Example: D1 22   Cseg 22 (skip to the second segment in ROM)

Segment table
Value (HEX) Segment description
00 Some internal ROM (probably stored in the CPU)
08 VIDEO RAM - buffer for text output, stack
20 <-> 27 ROM segment 0 <-> ROM segment 7 (8x64KB = 512 KB)
40 RAM segment 0
41 <-> 47 No device, here should be placed additional RAM (upgrade to 512 KB)
60 Graphic memory - display bitmap

Register and register/value arithmetic operation

Data Length

The last character(s) of instruction name is data length:

B: byte = 8 bits

W: word = 16 bits

8: variable data length X, in most cases it's running in 64 b mode, so I used the length in B

10:variable data length Y, in most cases it's running in 80 b mode, so I used the length in B

If the instruction name starts with "B", this instruction is working in BCD mode, in this mode only digits 0..9 are allowed , one digit is stored using 4 bits. So you can store only numbers 0 .. 99 to 1 byte.

Addressing modes

There is a few addressing modes:

reg-reg/reg-val mode: B1 B2 B3 -used by xor,cmp,mov,or,and,sub,add,mask,nmask - see the first 4 rows.

B1: operation code

B2: lower 7 bits - number of  the first register, the highest bit says, if B3 is direct value (1) or another register (0).

B3: direct value (B2&128=128) or lower 7 bits is number of the second register, the highest bit probably says, which register is used to store result (1- 1st reg, 0-2nd reg)

mem-reg/mem-val mode: B1 B2 B3 -used by cmp,mov,or,and,sub, and ,add - see the second 4 rows.

B1: operation code

B2: lower 7 bits - number of  the address register, the highest bit says, if B3 is direct value (1) or register (0).

B3: direct value (B2&128=128) or lower 7 bits is number of the second register, the highest bit says, where should be result stored (1- back to memory, 0-to register)

1 register only mode: B1 B2 - used by "shr <R>,8", "rol <R>,4", shl,shr

B1:  operation code

B2: lower 7 bits - number of  the register

Note: rol is working through some 4 bits (may be flags)

Load 16bit value to the word register

C1 <register> <data.lo> <data.hi>


Other instructions are unknown for me now. I will be happy if you help me to find them.