Hi all.

I want to be able to run one app from another. I know this is possible with built in apps via syscalls such as as APP_FINANCE but what about other addins?

If there isn't a syscall for this would it be possible to directly load the program into memory?

Yes, there is! Use Syscall 0x1E5B: int OpenAddin(0, 0, index, 0), where index is the index of that app on the main menu. Have a read through my C equivalent if you want to try and figure out what the three zeroes mean: https://bible.planet-casio.com/drcarlos/Syscalls/OpenAddin.c

Also note that I've only tested it on OS 3.60, so if you want to run it on a newer OS I can't guarantee anything.

Nice. What other functions from https://bible.planet-casio.com/drcarlos/Syscalls/ do I need to include to get OpenAddin to compile?

Sorry, I didn't explain that very well.
You need to use Syscall 0x1E5B. Here is an example program which should open the 7th addin on the menu:

Code:


If you want to investigate the internal workings of this function, you can check out https://bible.planet-casio.com/drcarlos/Syscalls/OpenAddin.c
The referenced functions are all either located in https://bible.planet-casio.com/drcarlos/Syscalls/ or will require using a disassembler to investigate personally.

Let me know if you have any issues.

Thanks dr-carlos. Your code worked as intended. As I understand it a syscall involves moving a syscall number to r0 and then jumping to 0x80020070. In your assembly you haven't referenced 'index' ie the addin number. I guess the syscall knows what the addin number is since this the third argument to a function ends up being copied to r6.

Could an addin be run by reading the g3a from 0x7000 and copying into memory then jumping to the start of what we copied?
I would like to investigate some syscalls myself. I have extracted the 11MB binary from the updater. What disassembler do you use for SH4?

Yes, the syscall I run isn't actually the addin itself, but the syscall which the main menu uses to open addins from a certain 'index'. This allows it to do all the setup stuff that you will probably need to do if you want to jump straight to the g3a to run it (though I haven't investigated this specifically and don't know how possible it is).

I use Lephenixnoir's fxos disassembler: https://git.planet-casio.com/Lephenixnoir/fxos/

I'd also recommend having a quick read through my guide on SuperH 4 assembly if you're not too familiar with it: https://bible.planet-casio.com/drcarlos/Assembly.html

When I look at your decompiled syscalls and I look at the code and see functions like Address80365196(0), are these other syscalls or just a jump to the address? How do I find the syscall number from the address so that I can call them?

These are just jumps to the address. In that specific example there is 0 in r4 (the first parameter).
Most addresses on the calculator do not have syscalls associated with them, so you can't call them like that. Instead, if you want to call that address, i suggest using a function similar to this, which looks through the instructions in a syscall which references that address and then jumps to it:

Code: