About Classwiz hacks

EDIT: Classwiz is very rare.
Can you help me make ascii and characters table by emulator?

@jyx8151 If first byte is F0 - FF then compound for both ASCII and character. Only EF-01+1 + (FF-F0+1)(FF-01+1)=10DF characters. Most are garbled.
Variable length ASCII.
"it supports few East Asian Character" - which?
FE A5 = 尺→m also on 570EX. So 570EX have some Chinese characters.
Can you try this and say if that works
Choose linear input mode
X=Sigma(X,1,1x10^9
[Calc] [=] [ac] [left] [del] [del] [calc] [=] [left]
(usual method for basic overflow)
Enter 210 character, press [left] 207 times, [del] 5 times
Now there should be more than 200 characters on calculator screen. Press [=] may cause an error (character spill)

** If you copy those contents to other places you should copy the text. I had enough pain OCR Chinese. **
Text: pastebin.com/KM15i0hz

Quick way to get bold F (emulator):
1. Get an empty box (character 19) on the screen
2. When cursor in box,
memory ---------- press
(|) 19 00 00 ----- [Right]
19 00 (|) 00 00 ----- [Shift] [7] [3] [x^-1] (or "C")
19 00 FD 3F (|) 00 ----- [Left]
19 00 (|) FD 3F 00 ----- [1]
19 00 31 (|) 3F 00 ----- [Left]
19 00 (I) 31 3F 00 ----- [Del]
19 (|) 31 3F 00
3. Delete remaining

I have some questions:
What is "比号"? Is that the colon " : "?
In the "6.线性伪拼字，拼图" (link below) what is the option name (or corresponding option in 570EX) of the "1.在普通计算模式下，shif,菜单，1，3,shift,两次下，4,2" ?
Edit f/21 post above:
FB prefix -> FD prefix
Ran# = FD 18 (constant prefix)
Is the above table all characters that can be get by normal method? (the calculator support)
Some older posts about Classwiz hack:
http://tieba.baidu.com/p/3738423022
http://tieba.baidu.com/p/3810670052
The bar "imp <>≤≠≥M+M", which is called "A-type converter", have FE prefix (I don't know what is the second byte yet we can discover that)
You mentioned a method that convert one character converter to two corresponding character:
FE FE (I) .......... [1]
FE FE 31 (I) ..... [Left]
FE (I) FE 31 ..... [1]
FE 31 (I) FE 31
Now you have two compound characters on the screen, so all "character converter" are compound charcter of two F? bytes. In the above example, start from FE FE you have FE 31 FE 31, which later you can determine the original converter. Can you find out the original code of all types of character converter (You said that there are 4 types of character converter ABCD, which convert one (the same) character to different characters)?
FE 31 = l.y.⏵m
FD 31 = m_n (constant)
FA 31 = 町⏵反
FB 21 = MatB
"Not all characters can be converted" They are the compound characters, and the character converter can be used to extract the second byte, in fact.

It seems that each constant character (FD prefix) links to a procedure to determine that. So the Sigma x^2, Sigma x, Ran#, ... also have FD prefix. I will post full FD prefix table later.

Note: Translators are often irreversible. I use the words "brush", "unstable character", "basic overflow", "abnormality", ... because the translator translate it that way, but when those words are translated back to Chinese it may not have original meaning.
The source of the linearize (stack overflow?) bug
You all know that, when enter wes.casio.com/math/index.php?q=I-234B+U-000000000000+M-C10000AD00+S-001410100000100E1010B000BB10+R-0100000000000000010000000000000000000000+E-31A931606031741A741A741A741A741A741A741A741A741A741A741A741A311B1B1B1B1B1B1B1B1B1B1B1B
and then press [CALC] the display becomes linearized. However that is not all, some other overflow characters also appear after the first Null.
Explanation:
31 A9 31 60 60 31 .... 1B 1B 1B 00 07 00 00 07 00 00 07 00 00 ...
where:
31 A9 31 60 60 31 .... 1B 1B 1B is the formula 1÷(1((1√(√(√(√(√(...√(1)...)))))
00 is the first null
07 00 00 07 00 00 ... is the overflow part, that I want to say.
In method 7 in http://tieba.baidu.com/p/3810670052, without using any compound character, that compound character appear. So, it must be of this overflow part. If we know exactly what will be generated in what condition, we may get access to "impossible bytes" (that we cannot type directly in calculator) without unstable character.
Casio fx-570VN PLUS also have that bug.
Because I can't be sure if that is different between calculator and emulator (if that is overflow from the stack only), so I must find some way to read those characters on real calculator.
On ES PLUS series that is simpler, but on Classwiz calculators it is very difficult, because of compound characters and some special characters that can't be displayed.
Note: If someone can debug the disassembled (that is, the reverse of assemble, as in "x86 assembly") code of those calculators and work out the method (for example, which procedure write those characters, and where does those characters from), we will done.

Perfect emulator crack method:
0DE11B : 0F 84 C0 00 00 00 -> 90 90 90 90 90 90
0DE136: 0F 84 A5 00 00 00 -> 90 90 90 90 90 90
0DE160: 74 3F -> EB 13
No activation dialog. Can run multiple emulators at once.

The Classwiz calculators have 4 segments of program/code memory, double that of ES PLUS series. The model string of fx 991ex emulator is "CY-234B S9". (Most) large-font character of the calculator is 12 pixels high and 10 pixels wide. (which you may already knew, but is hard to determine on emulator)