Modifying firmware to fix the DEC bug

NOTE: if your calculator is the HP15c Enhanced from The Calculator Store, it already has a patched firmware. You can download it and patch other units with it with no change.

1. Obtain an original firmware file. The easiest way is downloading it from your own HP15c. The process to do it is described in this page

2. Install a Hex Editor app in case you do not have it yet. There are several nice free Hex editors around. I won't recommend any as I am doing it in a Mac

3. Open the firmware file with the HEX editor

4. The instructions we have seen in hpmuseum are to substitute 3 memory positions as follows (with reference to the original HP16c ROM memory space):

• 06EF:000 (was:346)
• 06F0:000 (was:1CB)
• 0718:3AC (was:17A)

(values are the 10-bit word value in the original 16c ROM)

It appears that the HP16c ROM is located in position 0x0E180 in the firmware file. We need to calculate the offset from that point.

Now, each 10-bit word is represented in the file as 2 bytes. So the offset should be, for the first case, 0x06EF * 2. 

Therefore: 

• 0x0E180 + 0x06EF * 2 = 0x0EF5E
• 0x0E180 + 0x06F0 * 2 = 0x0EF60
• 0x0E180 + 0x0718 * 2 = 0x0EFB0

(the HP16c mode is very useful to calculate these offsets!) ​Let's see what we find in these positions.

• At 0x0EF5E we find 46 03 - and this is not what we expected (346)! Then we remember that the coding here is "Little Endian" so all byte nibbles are reversed - so it is correct! We need to replace the 46 03 by 00 00.
• At 0x0EF60 we find CB 01 - which is the Little Endian 2-bytes form of the 10-bit number 1CB. We need to replace the CB 01 by 00 00
• At 0x0EFB0 we find 7A 01 - same as above, this is the Little Endian form of 17A. We need to replace it by AC 03.

Save the file with a different name, and this is your patched firmware! You can now proceed to install it in your calculator following the instructions in this page