FreeCalypso > hg > freecalypso-reveng

comparison pirelli/preboot.disasm @ 68:6a136554378e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
pirelli preboot re: figured out the triggering condition
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Mon, 10 Feb 2014 02:33:17 +0000
parents 88cf9811f97c
children
comparison
equal deleted inserted replaced
67:88cf9811f97c 68:6a136554378e
189 2f0: 000002a9 189 2f0: 000002a9
190 190
191 2f4: 4700 bx r0 191 2f4: 4700 bx r0
192 2f6: 0000 192 2f6: 0000
193 193
194 ; Thumb call trampoline to 0x818f2c
195 ; offset 0x8AA8 from start of copy
196 ; should be at 0xAFB0 in flash
194 2f8: b082 sub sp, #8 197 2f8: b082 sub sp, #8
195 2fa: 9400 str r4, [sp, #0] 198 2fa: 9400 str r4, [sp, #0]
196 2fc: 4c01 ldr r4, [pc, #4] (0x304) 199 2fc: 4c01 ldr r4, [pc, #4] (0x304)
197 2fe: 9401 str r4, [sp, #4] 200 2fe: 9401 str r4, [sp, #4]
198 300: bd10 pop {r4, pc} 201 300: bd10 pop {r4, pc}
387 390
388 2500: 00000000 391 2500: 00000000
389 2504: ffffffff 392 2504: ffffffff
390 393
391 2508: 0xAA88 bytes copied to IRAM 394 2508: 0xAA88 bytes copied to IRAM
395
396 ad8c: b5f0 push {r4, r5, r6, r7, lr}
397 ad8e: 4643 mov r3, r8
398 ad90: 464c mov r4, r9
399 ad92: b418 push {r3, r4}
400 ad94: b08b sub sp, #44
401 ad96: 4690 mov r8, r2
402 ad98: 1c0f mov r7, r1 (add r7, r1, #0)
403 ad9a: 4684 mov ip, r0
404 ad9c: 1c3e mov r6, r7 (add r6, r7, #0)
405 ad9e: 1c31 mov r1, r6 (add r1, r6, #0)
406 ada0: aa09 add r2, sp, #36
407 ada2: 2305 mov r3, #5
408 ada4: ffdcf7ff bl 0xad60
409 ada8: 2800 cmp r0, #0
410 adaa: d079 beq 0xaea0
411 adac: 4660 mov r0, ip
412 adae: 3005 add r0, #5
413 adb0: 4684 mov ip, r0
414 adb2: 3f05 sub r7, #5
415 adb4: 2400 mov r4, #0
416 adb6: 2500 mov r5, #0
417 adb8: 4660 mov r0, ip
418 adba: 1c39 mov r1, r7 (add r1, r7, #0)
419 adbc: 221d mov r2, #29
420 adbe: 446a add r2, sp
421 adc0: 2301 mov r3, #1
422 adc2: ffcdf7ff bl 0xad60
423 adc6: 2800 cmp r0, #0
424 adc8: d06a beq 0xaea0
425 adca: 4660 mov r0, ip
426 adcc: 3001 add r0, #1
427 adce: 4684 mov ip, r0
428 add0: 3f01 sub r7, #1
429 add2: 4668 mov r0, sp
430 add4: 7f40 ldrb r0, [r0, #29]
431 add6: 00e9 lsl r1, r5, #3
432 add8: 4088 lsl r0, r1
433 adda: 1904 add r4, r0, r4
434 addc: 3501 add r5, #1
435 adde: 2d04 cmp r5, #4
436 ade0: dbea blt 0xadb8
437 ade2: 2000 mov r0, #0
438 ade4: 43c0 mvn r0, r0
439 ade6: 4284 cmp r4, r0
440 ade8: d05a beq 0xaea0
441 adea: 2504 mov r5, #4
442 adec: 4660 mov r0, ip
443 adee: 1c39 mov r1, r7 (add r1, r7, #0)
444 adf0: aa07 add r2, sp, #28
445 adf2: 2301 mov r3, #1
446 adf4: ffb4f7ff bl 0xad60
447 adf8: 2800 cmp r0, #0
448 adfa: d051 beq 0xaea0
449 adfc: 4668 mov r0, sp
450 adfe: 7f00 ldrb r0, [r0, #28]
451 ae00: 2800 cmp r0, #0
452 ae02: d14d bne 0xaea0
453 ae04: 3f01 sub r7, #1
454 ae06: 4660 mov r0, ip
455 ae08: 3001 add r0, #1
456 ae0a: 4684 mov ip, r0
457 ae0c: 3d01 sub r5, #1
458 ae0e: 2d00 cmp r5, #0
459 ae10: d1ec bne 0xadec
460 ae12: 200d mov r0, #13
461 ae14: 1a30 sub r0, r6, r0
462 ae16: 4681 mov r9, r0
463 ae18: 4660 mov r0, ip
464 ae1a: 2800 cmp r0, #0
465 ae1c: d040 beq 0xaea0
466 ae1e: a809 add r0, sp, #36
467 ae20: 7802 ldrb r2, [r0, #0]
468 ae22: a809 add r0, sp, #36
469 ae24: 7800 ldrb r0, [r0, #0]
470 ae26: 28e1 cmp r0, #225
471 ae28: da3a bge 0xaea0
472 ae2a: 4973 ldr r1, [pc, #460] (0xaff8)
473 ae2c: 2500 mov r5, #0
474 ae2e: 2000 mov r0, #0
475 ae30: 2600 mov r6, #0
476 ae32: 2a2e cmp r2, #46
477 ae34: db06 blt 0xae44
478 ae36: 3a2d sub r2, #45
479 ae38: 0612 lsl r2, r2, #24
480 ae3a: 0e12 lsr r2, r2, #24
481 ae3c: 3601 add r6, #1
482 ae3e: 3901 sub r1, #1
483 ae40: 2900 cmp r1, #0
484 ae42: d1f6 bne 0xae32
485 ae44: 496c ldr r1, [pc, #432] (0xaff8)
486 ae46: 2300 mov r3, #0
487 ae48: 2a09 cmp r2, #9
488 ae4a: db06 blt 0xae5a
489 ae4c: 3a09 sub r2, #9
490 ae4e: 0612 lsl r2, r2, #24
491 ae50: 0e12 lsr r2, r2, #24
492 ae52: 3301 add r3, #1
493 ae54: 3901 sub r1, #1
494 ae56: 2900 cmp r1, #0
495 ae58: d1f6 bne 0xae48
496 ae5a: 1899 add r1, r3, r2
497 ae5c: 2703 mov r7, #3
498 ae5e: 023f lsl r7, r7, #8
499 ae60: 408f lsl r7, r1
500 ae62: 4966 ldr r1, [pc, #408] (0xaffc)
501 ae64: 19c9 add r1, r1, r7
502 ae66: 0049 lsl r1, r1, #1
503 ae68: 277f mov r7, #127
504 ae6a: 043f lsl r7, r7, #16
505 ae6c: 42bc cmp r4, r7
506 ae6e: d800 bhi 0xae72
507 ae70: 4d63 ldr r5, [pc, #396] (0xb000)
508 ae72: 2701 mov r7, #1
509 ae74: 043f lsl r7, r7, #16
510 ae76: 42b9 cmp r1, r7
511 ae78: d801 bhi 0xae7e
512 ae7a: 2001 mov r0, #1
513 ae7c: 0600 lsl r0, r0, #24
514 ae7e: 2d00 cmp r5, #0
515 ae80: d00e beq 0xaea0
516 ae82: 2800 cmp r0, #0
517 ae84: d00c beq 0xaea0
518 ae86: 9600 str r6, [sp, #0]
519 ae88: 4666 mov r6, ip
520 ae8a: 9601 str r6, [sp, #4]
521 ae8c: 464e mov r6, r9
522 ae8e: 9602 str r6, [sp, #8]
523 ae90: 9503 str r5, [sp, #12]
524 ae92: 9404 str r4, [sp, #16]
525 ae94: ac08 add r4, sp, #32
526 ae96: 9405 str r4, [sp, #20]
527 ae98: ff1bf000 bl 0xbcd2
528 ae9c: 2800 cmp r0, #0
529 ae9e: d001 beq 0xaea4
530 aea0: 2000 mov r0, #0
531 aea2: e005 b 0xaeb0
532 aea4: 4640 mov r0, r8
533 aea6: 6005 str r5, [r0, #0]
534 aea8: 2028 mov r0, #40
535 aeaa: fbbbf7f7 bl 0x2624
536 aeae: 9808 ldr r0, [sp, #32]
537 aeb0: b00b add sp, #44
538 aeb2: bc18 pop {r3, r4}
539 aeb4: 4698 mov r8, r3
540 aeb6: 46a1 mov r9, r4
541 aeb8: bdf0 pop {r4, r5, r6, r7, pc}
542
543 aeba: b530 push {r4, r5, lr}
544 aebc: b09e sub sp, #120
545 aebe: 2000 mov r0, #0
546 aec0: 43c4 mvn r4, r0
547 aec2: 2000 mov r0, #0
548 aec4: a901 add r1, sp, #4
549 aec6: 2201 mov r2, #1
550 aec8: f8fbf000 bl 0xb0c2
551 aecc: 2800 cmp r0, #0
552 aece: d13c bne 0xaf4a
553 aed0: a801 add r0, sp, #4
554 aed2: a903 add r1, sp, #12
555 aed4: f93df000 bl 0xb152
556 aed8: 2800 cmp r0, #0
557 aeda: d132 bne 0xaf42
558 aedc: 9d03 ldr r5, [sp, #12]
559 aede: 1c28 mov r0, r5 (add r0, r5, #0)
560 aee0: fd90f7ff bl 0xaa04
561 aee4: 2800 cmp r0, #0
562 aee6: d02c beq 0xaf42
563 aee8: 9803 ldr r0, [sp, #12]
564 aeea: fdf6f7ff bl 0xaada
565 aeee: 2800 cmp r0, #0
566 aef0: d027 beq 0xaf42
567 aef2: 2038 mov r0, #56
568 aef4: 1941 add r1, r0, r5
569 aef6: 2230 mov r2, #48
570 aef8: a805 add r0, sp, #20
571 aefa: 780b ldrb r3, [r1, #0]
572 aefc: 7003 strb r3, [r0, #0]
573 aefe: 3101 add r1, #1
574 af00: 3001 add r0, #1
575 af02: 3a01 sub r2, #1
576 af04: 2a00 cmp r2, #0
577 af06: d1f8 bne 0xaefa
578 af08: 2000 mov r0, #0
579 af0a: 9000 str r0, [sp, #0]
580 af0c: 9803 ldr r0, [sp, #12]
581 af0e: 30ff add r0, #255
582 af10: 3079 add r0, #121
583 af12: 9904 ldr r1, [sp, #16]
584 af14: 39ff sub r1, #255
585 af16: 3979 sub r1, #121
586 af18: 466a mov r2, sp
587 af1a: ff37f7ff bl 0xad8c
588 af1e: 1c03 mov r3, r0 (add r3, r0, #0)
589 af20: 2b00 cmp r3, #0
590 af22: d00e beq 0xaf42
591 af24: 20ff mov r0, #255
592 af26: 3071 add r0, #113
593 af28: 5940 ldr r0, [r0, r5]
594 af2a: fd5df7ff bl 0xa9e8
595 af2e: 1c02 mov r2, r0 (add r2, r0, #0)
596 af30: 9800 ldr r0, [sp, #0]
597 af32: 1c19 mov r1, r3 (add r1, r3, #0)
598 af34: fbcef000 bl 0xb6d4
599 af38: 2800 cmp r0, #0
600 af3a: d101 bne 0xaf40
601 af3c: 2400 mov r4, #0
602 af3e: e000 b 0xaf42
603 af40: e000 b 0xaf44
604 af42: a801 add r0, sp, #4
605 af44: 2100 mov r1, #0
606 af46: f9d5f000 bl 0xb2f4
607 af4a: 2001 mov r0, #1
608 af4c: a901 add r1, sp, #4
609 af4e: 2201 mov r2, #1
610 af50: f8b7f000 bl 0xb0c2
611 af54: 2800 cmp r0, #0
612 af56: d129 bne 0xafac
613 af58: a801 add r0, sp, #4
614 af5a: a903 add r1, sp, #12
615 af5c: f8f9f000 bl 0xb152
616 af60: 2800 cmp r0, #0
617 af62: d123 bne 0xafac
618 af64: 9903 ldr r1, [sp, #12]
619 af66: aa11 add r2, sp, #68
620 af68: 2000 mov r0, #0
621 af6a: 780b ldrb r3, [r1, #0]
622 af6c: 5483 strb r3, [r0, r2]
623 af6e: 3101 add r1, #1
624 af70: 3001 add r0, #1
625 af72: 2834 cmp r0, #52
626 af74: d3f9 bcc 0xaf6a
627 af76: a801 add r0, sp, #4
628 af78: 2100 mov r1, #0
629 af7a: f9bbf000 bl 0xb2f4
630 af7e: 2001 mov r0, #1
631 af80: a901 add r1, sp, #4
632 af82: 2202 mov r2, #2
633 af84: f89df000 bl 0xb0c2
634 af88: 2800 cmp r0, #0
635 af8a: d10f bne 0xafac
636 af8c: 2c00 cmp r4, #0
637 af8e: d101 bne 0xaf94
638 af90: 2003 mov r0, #3
639 af92: 9011 str r0, [sp, #68]
640 af94: a801 add r0, sp, #4
641 af96: a911 add r1, sp, #68
642 af98: 2234 mov r2, #52
643 af9a: f8fdf000 bl 0xb198
644 af9e: a801 add r0, sp, #4
645 afa0: 2100 mov r1, #0
646 afa2: f9a7f000 bl 0xb2f4
647 afa6: 2063 mov r0, #99
648 afa8: fb3cf7f7 bl 0x2624
649 afac: b01e add sp, #120
650 afae: bd30 pop {r4, r5, pc}
651
652 ; This is the first function in the copied code,
653 ; called from the boot entry code.
654 afb0: b510 push {r4, lr}
655 afb2: b084 sub sp, #16
656 afb4: 2001 mov r0, #1
657 afb6: 4669 mov r1, sp
658 afb8: 2201 mov r2, #1
659 afba: f882f000 bl 0xb0c2
660 afbe: 2800 cmp r0, #0
661 afc0: d118 bne 0xaff4
662 afc2: 4668 mov r0, sp
663 afc4: a902 add r1, sp, #8
664 afc6: f8c4f000 bl 0xb152
665 afca: 1c04 mov r4, r0 (add r4, r0, #0)
666 afcc: 4668 mov r0, sp
667 afce: 2100 mov r1, #0
668 afd0: f990f000 bl 0xb2f4
669 afd4: 2c00 cmp r4, #0
670 afd6: d10d bne 0xaff4
671 afd8: 9802 ldr r0, [sp, #8]
672 afda: 6800 ldr r0, [r0, #0]
673 afdc: 2802 cmp r0, #2
674 afde: d109 bne 0xaff4
675 afe0: fb70f7f7 bl 0x26c4
676 afe4: fa90f7f7 bl 0x2508
677 afe8: fac3f7f7 bl 0x2572
678 afec: ff65f7ff bl 0xaeba
679 aff0: f9acf7f8 bl 0x334c
680 aff4: b004 add sp, #16
681 aff6: bd10 pop {r4, pc}
682
683 ; This function ensures that the flash at the given address
684 ; is not toggling.
685 b004: 8802 ldrh r2, [r0, #0]
686 b006: 8801 ldrh r1, [r0, #0]
687 b008: 404a eor r2, r1
688 b00a: 09d1 lsr r1, r2, #7
689 b00c: d2fa bcs 0xb004
690 b00e: 4770 bx lr
691
692 b010: b530 push {r4, r5, lr}
693 b012: 1c0c mov r4, r1 (add r4, r1, #0)
694 b014: 1c05 mov r5, r0 (add r5, r0, #0)
695 b016: fa87f000 bl 0xb528
696 b01a: 0400 lsl r0, r0, #16
697 b01c: 0c00 lsr r0, r0, #16
698 b01e: 49e1 ldr r1, [pc, #900] (0xb3a4)
699 b020: 4288 cmp r0, r1
700 b022: d008 beq 0xb036
701 b024: 2121 mov r1, #33
702 b026: 0209 lsl r1, r1, #8
703 b028: 4288 cmp r0, r1
704 b02a: d126 bne 0xb07a
705 b02c: 49ea ldr r1, [pc, #936] (0xb3d8)
706 b02e: 0b28 lsr r0, r5, #12
707 b030: 0300 lsl r0, r0, #12
708 b032: 1808 add r0, r1, r0
709 b034: e003 b 0xb03e
710 b036: 49e8 ldr r1, [pc, #928] (0xb3d8)
711 b038: 0c28 lsr r0, r5, #16
712 b03a: 0400 lsl r0, r0, #16
713 b03c: 1808 add r0, r1, r0
714 b03e: 4ae7 ldr r2, [pc, #924] (0xb3dc)
715 b040: 21aa mov r1, #170
716 b042: 5211 strh r1, [r2, r0]
717 b044: 2155 mov r1, #85
718 b046: 8001 strh r1, [r0, #0]
719 b048: 49e4 ldr r1, [pc, #912] (0xb3dc)
720 b04a: 22a0 mov r2, #160
721 b04c: 520a strh r2, [r1, r0]
722 b04e: 802c strh r4, [r5, #0]
723 b050: 2080 mov r0, #128
724 b052: 4020 and r0, r4
725 b054: 8829 ldrh r1, [r5, #0]
726 b056: 2280 mov r2, #128
727 b058: 400a and r2, r1
728 b05a: 4282 cmp r2, r0
729 b05c: d00d beq 0xb07a
730 b05e: 0989 lsr r1, r1, #6
731 b060: d3f8 bcc 0xb054
732 b062: 8829 ldrh r1, [r5, #0]
733 b064: 2280 mov r2, #128
734 b066: 400a and r2, r1
735 b068: 4282 cmp r2, r0
736 b06a: d006 beq 0xb07a
737 b06c: 2090 mov r0, #144
738 b06e: 8028 strh r0, [r5, #0]
739 b070: 2000 mov r0, #0
740 b072: 8028 strh r0, [r5, #0]
741 b074: 48da ldr r0, [pc, #872] (0xb3e0)
742 b076: 2101 mov r1, #1
743 b078: 7001 strb r1, [r0, #0]
744 b07a: bd30 pop {r4, r5, pc}
745
746 b07c: b530 push {r4, r5, lr}
747 b07e: b081 sub sp, #4
748 b080: 0b01 lsr r1, r0, #12
749 b082: 030b lsl r3, r1, #12
750 b084: 49d7 ldr r1, [pc, #860] (0xb3e4)
751 b086: 18c9 add r1, r1, r3
752 b088: 22aa mov r2, #170
753 b08a: 800a strh r2, [r1, #0]
754 b08c: 4cd2 ldr r4, [pc, #840] (0xb3d8)
755 b08e: 18e4 add r4, r4, r3
756 b090: 2355 mov r3, #85
757 b092: 8023 strh r3, [r4, #0]
758 b094: 2580 mov r5, #128
759 b096: 800d strh r5, [r1, #0]
760 b098: 800a strh r2, [r1, #0]
761 b09a: 8023 strh r3, [r4, #0]
762 b09c: 2130 mov r1, #48
763 b09e: 8001 strh r1, [r0, #0]
764 b0a0: 8801 ldrh r1, [r0, #0]
765 b0a2: 0909 lsr r1, r1, #4
766 b0a4: d3fc bcc 0xb0a0
767 b0a6: 4669 mov r1, sp
768 b0a8: 8802 ldrh r2, [r0, #0]
769 b0aa: 804a strh r2, [r1, #2]
770 b0ac: 466a mov r2, sp
771 b0ae: 8801 ldrh r1, [r0, #0]
772 b0b0: 8011 strh r1, [r2, #0]
773 b0b2: 4669 mov r1, sp
774 b0b4: 8849 ldrh r1, [r1, #2]
775 b0b6: 8812 ldrh r2, [r2, #0]
776 b0b8: 4051 eor r1, r2
777 b0ba: 09c9 lsr r1, r1, #7
778 b0bc: d2f3 bcs 0xb0a6
779 b0be: b001 add sp, #4
780 b0c0: bd30 pop {r4, r5, pc}
781
782 ; arg1: magic region number
783 ; arg2: ptr to 8-byte buffer receiving copies of arg1 and arg3
784 ; arg3: mode, must be 1 or 2
785 ;
786 ; Mode 1: check the region (which must be in a state other than 2) for
787 ; a checksum-passing image, and advance to state 1 if found. If already
788 ; in state 1, increment the byte at offset 8 in struct.
789 ;
790 ; Mode 2: put the region (which must be in state 0) into state 2.
791 ;
792 ; Returns:
793 ; 0 = success
794 ; 1 = region in the wrong state for mode
795 ; 2 = called with bad arguments
796 ; 3 = mode 1: no checksum-passing image found
797
798 b0c2: b5f0 push {r4, r5, r6, r7, lr}
799 b0c4: 1c15 mov r5, r2 (add r5, r2, #0)
800 b0c6: 1c0e mov r6, r1 (add r6, r1, #0)
801 b0c8: 1c04 mov r4, r0 (add r4, r0, #0)
802 b0ca: 4fe5 ldr r7, [pc, #916] (0xb460) =0x810020
803 b0cc: 7838 ldrb r0, [r7, #0]
804 b0ce: 2800 cmp r0, #0
805 b0d0: d103 bne 0xb0da
806 b0d2: f969f000 bl 0xb3a8
807 b0d6: 2001 mov r0, #1
808 b0d8: 7038 strb r0, [r7, #0]
809 b0da: 2c03 cmp r4, #3
810 b0dc: da07 bge 0xb0ee
811 b0de: 2d03 cmp r5, #3
812 b0e0: da05 bge 0xb0ee
813 b0e2: 1e68 sub r0, r5, #1
814 b0e4: 2800 cmp r0, #0
815 b0e6: d019 beq 0xb11c
816 b0e8: 3801 sub r0, #1
817 b0ea: 2800 cmp r0, #0
818 b0ec: d001 beq 0xb0f2
819 ; return 2; means invalid invokation?
820 b0ee: 2002 mov r0, #2
821 b0f0: bdf0 pop {r4, r5, r6, r7, pc}
822 ; goes here if 3rd arg == 2
823 b0f2: 2018 mov r0, #24
824 b0f4: 4360 mul r0, r4
825 b0f6: 49db ldr r1, [pc, #876] (0xb464) =0x810024
826 b0f8: 1809 add r1, r1, r0
827 b0fa: 2004 mov r0, #4
828 b0fc: 1840 add r0, r0, r1
829 b0fe: 6802 ldr r2, [r0, #0]
830 b100: 2a00 cmp r2, #0
831 b102: d112 bne 0xb12a ; return 1;
832 b104: 2202 mov r2, #2
833 b106: 6002 str r2, [r0, #0]
834 b108: 2000 mov r0, #0
835 b10a: 8288 strh r0, [r1, #20]
836 b10c: 6108 str r0, [r1, #16]
837 b10e: 4aea ldr r2, [pc, #936] (0xb4b8) =0x81006C
838 b110: 00a3 lsl r3, r4, #2
839 b112: 58d2 ldr r2, [r2, r3]
840 b114: 6892 ldr r2, [r2, #8]
841 b116: 600a str r2, [r1, #0]
842 b118: 7248 strb r0, [r1, #9]
843 b11a: e016 b 0xb14a
844 ; goes here if 3rd arg == 1
845 b11c: 2018 mov r0, #24
846 b11e: 4360 mul r0, r4
847 b120: 49d1 ldr r1, [pc, #836] (0xb468) =0x810028
848 b122: 180f add r7, r1, r0
849 b124: 6838 ldr r0, [r7, #0]
850 b126: 2802 cmp r0, #2
851 b128: d101 bne 0xb12e
852 ; return 1;
853 b12a: 2001 mov r0, #1
854 b12c: bdf0 pop {r4, r5, r6, r7, pc}
855 ; continuation of operation with arg3 == 1
856 b12e: 2800 cmp r0, #0
857 b130: d108 bne 0xb144
858 b132: 1c20 mov r0, r4 (add r0, r4, #0)
859 b134: f99af000 bl 0xb46c
860 b138: 2800 cmp r0, #0
861 b13a: d001 beq 0xb140
862 b13c: 2003 mov r0, #3
863 b13e: bdf0 pop {r4, r5, r6, r7, pc}
864 b140: 2001 mov r0, #1
865 b142: 6038 str r0, [r7, #0]
866 b144: 7938 ldrb r0, [r7, #4]
867 b146: 3001 add r0, #1
868 b148: 7138 strb r0, [r7, #4]
869 b14a: 6034 str r4, [r6, #0]
870 b14c: 6075 str r5, [r6, #4]
871 b14e: 2000 mov r0, #0
872 b150: bdf0 pop {r4, r5, r6, r7, pc}
873
874 ; arg1: points to buffer filled by successful 0xb0c2 in mode 1
875 ; arg2: 8-byte buffer filled as:
876 ; 0: points to start of image
877 ; 4: image length
878 b152: b530 push {r4, r5, lr}
879 b154: 1c0c mov r4, r1 (add r4, r1, #0)
880 b156: 1c01 mov r1, r0 (add r1, r0, #0)
881 b158: 48c1 ldr r0, [pc, #772] (0xb460) =0x810020
882 b15a: 7800 ldrb r0, [r0, #0]
883 b15c: 2800 cmp r0, #0
884 b15e: d010 beq 0xb182
885 b160: 6808 ldr r0, [r1, #0]
886 b162: 4ad5 ldr r2, [pc, #852] (0xb4b8) =0x81006C
887 b164: 0083 lsl r3, r0, #2
888 b166: 18d5 add r5, r2, r3
889 b168: 2803 cmp r0, #3
890 b16a: da02 bge 0xb172
891 b16c: 6849 ldr r1, [r1, #4]
892 b16e: 2903 cmp r1, #3
893 b170: db01 blt 0xb176
894 b172: 2002 mov r0, #2
895 b174: bd30 pop {r4, r5, pc}
896 b176: 2118 mov r1, #24
897 b178: 4341 mul r1, r0
898 b17a: 4abb ldr r2, [pc, #748] (0xb468) =0x810028
899 b17c: 5851 ldr r1, [r2, r1]
900 b17e: 2901 cmp r1, #1
901 b180: d001 beq 0xb186
902 b182: 2005 mov r0, #5
903 b184: bd30 pop {r4, r5, pc}
904 b186: f95ff000 bl 0xb448
905 b18a: 6840 ldr r0, [r0, #4]
906 b18c: 6060 str r0, [r4, #4]
907 b18e: 6828 ldr r0, [r5, #0]
908 b190: 6880 ldr r0, [r0, #8]
909 b192: 6020 str r0, [r4, #0]
910 b194: 2000 mov r0, #0
911 b196: bd30 pop {r4, r5, pc}
912
913 b2f4: b570 push {r4, r5, r6, lr}
914 b2f6: 1c04 mov r4, r0 (add r4, r0, #0)
915 b2f8: 4859 ldr r0, [pc, #356] (0xb460) =0x810020
916 b2fa: 7800 ldrb r0, [r0, #0]
917 b2fc: 2800 cmp r0, #0
918 b2fe: d00f beq 0xb320
919 b300: 6820 ldr r0, [r4, #0]
920 b302: 2803 cmp r0, #3
921 b304: da14 bge 0xb330
922 b306: 6866 ldr r6, [r4, #4]
923 b308: 2e03 cmp r6, #3
924 b30a: da11 bge 0xb330
925 b30c: 2902 cmp r1, #2
926 b30e: da0f bge 0xb330
927 b310: 4d54 ldr r5, [pc, #336] (0xb464) =0x810024
928 b312: 2218 mov r2, #24
929 b314: 4342 mul r2, r0
930 b316: 18aa add r2, r5, r2
931 b318: 3204 add r2, #4
932 b31a: 6813 ldr r3, [r2, #0]
933 b31c: 2b00 cmp r3, #0
934 b31e: d101 bne 0xb324
935 b320: 2005 mov r0, #5
936 b322: bd70 pop {r4, r5, r6, pc}
937 b324: 1e73 sub r3, r6, #1
938 b326: 2b00 cmp r3, #0
939 b328: d010 beq 0xb34c
940 b32a: 3b01 sub r3, #1
941 b32c: 2b00 cmp r3, #0
942 b32e: d001 beq 0xb334
943 b330: 2002 mov r0, #2
944 b332: bd70 pop {r4, r5, r6, pc}
945 b334: 2900 cmp r1, #0
946 b336: d106 bne 0xb346
947 b338: f856f000 bl 0xb3e8
948 b33c: 2018 mov r0, #24
949 b33e: 6821 ldr r1, [r4, #0]
950 b340: 4348 mul r0, r1
951 b342: 182a add r2, r5, r0
952 b344: 3204 add r2, #4
953 b346: 2000 mov r0, #0
954 b348: 6010 str r0, [r2, #0]
955 b34a: e00c b 0xb366
956 b34c: 7910 ldrb r0, [r2, #4]
957 b34e: 3801 sub r0, #1
958 b350: 0600 lsl r0, r0, #24
959 b352: 0e00 lsr r0, r0, #24
960 b354: 7110 strb r0, [r2, #4]
961 b356: 2800 cmp r0, #0
962 b358: d105 bne 0xb366
963 b35a: 2018 mov r0, #24
964 b35c: 6821 ldr r1, [r4, #0]
965 b35e: 4348 mul r0, r1
966 b360: 1828 add r0, r5, r0
967 b362: 2100 mov r1, #0
968 b364: 6041 str r1, [r0, #4]
969 b366: 2000 mov r0, #0
970 b368: bd70 pop {r4, r5, r6, pc}
971
972 ; This function adjusts the flash region pointers
973 ; in the table @81006C depending on the chip revision.
974 b36a: b500 push {lr}
975 b36c: f8dcf000 bl 0xb528
976 b370: 0400 lsl r0, r0, #16
977 b372: 0c00 lsr r0, r0, #16
978 b374: 2121 mov r1, #33
979 b376: 0209 lsl r1, r1, #8
980 b378: 4288 cmp r0, r1
981 b37a: d00a beq 0xb392
982 b37c: 4909 ldr r1, [pc, #36] (0xb3a4)
983 b37e: 4288 cmp r0, r1
984 b380: d10e bne 0xb3a0
985 b382: 484d ldr r0, [pc, #308] (0xb4b8)
986 b384: 4981 ldr r1, [pc, #516] (0xb58c)
987 b386: 6001 str r1, [r0, #0]
988 b388: 4981 ldr r1, [pc, #516] (0xb590)
989 b38a: 6041 str r1, [r0, #4]
990 b38c: 4981 ldr r1, [pc, #516] (0xb594)
991 b38e: 6081 str r1, [r0, #8]
992 b390: bd00 pop {pc}
993 b392: 4849 ldr r0, [pc, #292] (0xb4b8)
994 b394: 4980 ldr r1, [pc, #512] (0xb598)
995 b396: 6001 str r1, [r0, #0]
996 b398: 4980 ldr r1, [pc, #512] (0xb59c)
997 b39a: 6041 str r1, [r0, #4]
998 b39c: 4980 ldr r1, [pc, #512] (0xb5a0)
999 b39e: 6081 str r1, [r0, #8]
1000 b3a0: bd00 pop {pc}
1001 b3a2: 46c0 nop (mov r8, r8)
1002 b3a4: 00002101
1003
1004 b3a8: b530 push {r4, r5, lr}
1005 b3aa: ffdef7ff bl 0xb36a
1006 b3ae: 2100 mov r1, #0
1007 b3b0: 4d7c ldr r5, [pc, #496] (0xb5a4) =0x12345678
1008 b3b2: 2303 mov r3, #3
1009 b3b4: 4a40 ldr r2, [pc, #256] (0xb4b8)
1010 b3b6: 482b ldr r0, [pc, #172] (0xb464) =0x810024
1011 b3b8: 6814 ldr r4, [r2, #0]
1012 b3ba: 68a4 ldr r4, [r4, #8]
1013 b3bc: 6004 str r4, [r0, #0]
1014 b3be: 60c5 str r5, [r0, #12]
1015 b3c0: 8281 strh r1, [r0, #20]
1016 b3c2: 6101 str r1, [r0, #16]
1017 b3c4: 6041 str r1, [r0, #4]
1018 b3c6: 7201 strb r1, [r0, #8]
1019 b3c8: 7241 strb r1, [r0, #9]
1020 b3ca: 3204 add r2, #4
1021 b3cc: 3018 add r0, #24
1022 b3ce: 3b01 sub r3, #1
1023 b3d0: 2b00 cmp r3, #0
1024 b3d2: d1f1 bne 0xb3b8
1025 b3d4: bd30 pop {r4, r5, pc}
1026 b3d6: 46c0 nop (mov r8, r8)
1027
1028 ; This function ensures that the flash in the last sector of the
1029 ; specified magic region is not toggling, and then returns
1030 ; the address of where 0x12345678 is expected.
1031 b448: b500 push {lr}
1032 b44a: 491b ldr r1, [pc, #108] (0xb4b8) =0x81006C
1033 b44c: 0080 lsl r0, r0, #2
1034 b44e: 5808 ldr r0, [r1, r0]
1035 b450: 7901 ldrb r1, [r0, #4]
1036 b452: 0089 lsl r1, r1, #2
1037 b454: 1840 add r0, r0, r1
1038 b456: 6880 ldr r0, [r0, #8]
1039 b458: 380c sub r0, #12
1040 b45a: fdd3f7ff bl 0xb004
1041 b45e: bd00 pop {pc}
1042
1043 b460: 00810020
1044 b464: 00810024
1045 b468: 00810028
1046
1047 ; This function checks whether the magic region specified by the argument
1048 ; contains a checksum-passing image or not. Returns 0 if pass, 3 otherwise.
1049 b46c: b530 push {r4, r5, lr}
1050 b46e: 1c04 mov r4, r0 (add r4, r0, #0)
1051 b470: ffeaf7ff bl 0xb448
1052 b474: 1c02 mov r2, r0 (add r2, r0, #0)
1053 b476: 2105 mov r1, #5
1054 b478: 2300 mov r3, #0
1055 b47a: 8815 ldrh r5, [r2, #0]
1056 b47c: 18eb add r3, r5, r3
1057 b47e: 041b lsl r3, r3, #16
1058 b480: 0c1b lsr r3, r3, #16
1059 b482: 3202 add r2, #2
1060 b484: 3901 sub r1, #1
1061 b486: 2900 cmp r1, #0
1062 b488: d1f7 bne 0xb47a
1063 b48a: 8941 ldrh r1, [r0, #10]
1064 b48c: 428b cmp r3, r1
1065 b48e: d11e bne 0xb4ce
1066 b490: 4909 ldr r1, [pc, #36] (0xb4b8) =0x81006C
1067 b492: 00a2 lsl r2, r4, #2
1068 b494: 5889 ldr r1, [r1, r2]
1069 b496: 688b ldr r3, [r1, #8]
1070 b498: 6842 ldr r2, [r0, #4]
1071 b49a: 2400 mov r4, #0
1072 b49c: 0851 lsr r1, r2, #1
1073 b49e: 2900 cmp r1, #0
1074 b4a0: d007 beq 0xb4b2
1075 b4a2: 881d ldrh r5, [r3, #0]
1076 b4a4: 192c add r4, r5, r4
1077 b4a6: 0424 lsl r4, r4, #16
1078 b4a8: 0c24 lsr r4, r4, #16
1079 b4aa: 3302 add r3, #2
1080 b4ac: 3901 sub r1, #1
1081 b4ae: 2900 cmp r1, #0
1082 b4b0: d1f7 bne 0xb4a2
1083 b4b2: 0851 lsr r1, r2, #1
1084 b4b4: d308 bcc 0xb4c8
1085 b4b6: e001 b 0xb4bc
1086 ; interspersed literal
1087 b4b8: 0081006c
1088 ; function continues
1089 b4bc: 8819 ldrh r1, [r3, #0]
1090 b4be: 0609 lsl r1, r1, #24
1091 b4c0: 0e09 lsr r1, r1, #24
1092 b4c2: 1909 add r1, r1, r4
1093 b4c4: 0409 lsl r1, r1, #16
1094 b4c6: 0c0c lsr r4, r1, #16
1095 b4c8: 8900 ldrh r0, [r0, #8]
1096 b4ca: 4284 cmp r4, r0
1097 b4cc: d001 beq 0xb4d2
1098 b4ce: 2003 mov r0, #3
1099 b4d0: bd30 pop {r4, r5, pc}
1100 b4d2: 2000 mov r0, #0
1101 b4d4: bd30 pop {r4, r5, pc}
1102
1103 ; This function reads flash ID from the chip.
1104 ; R0 needs to point to a 2-byte buffer into which the read manuf ID is stored.
1105 ; R1 needs to point to an 8-byte buffer (4 16-bit words) filled as follows:
1106 ; 0: word read from 0x02 in autoselect mode
1107 ; 2: word read from 0x1C ""
1108 ; 4: word read from 0x1E ""
1109 ; 6: revision number word from CFI
1110 b4d6: b5f0 push {r4, r5, r6, r7, lr}
1111 b4d8: 2303 mov r3, #3
1112 b4da: 2200 mov r2, #0
1113 b4dc: 0114 lsl r4, r2, #4
1114 b4de: 4314 orr r4, r2
1115 b4e0: 220a mov r2, #10
1116 b4e2: 4322 orr r2, r4
1117 b4e4: 3b01 sub r3, #1
1118 b4e6: 2b00 cmp r3, #0
1119 b4e8: d1f8 bne 0xb4dc
1120 b4ea: 24aa mov r4, #170
1121 b4ec: 8014 strh r4, [r2, #0]
1122 b4ee: 1056 asr r6, r2, #1
1123 b4f0: 2555 mov r5, #85
1124 b4f2: 8035 strh r5, [r6, #0]
1125 b4f4: 2390 mov r3, #144
1126 b4f6: 8013 strh r3, [r2, #0]
1127 b4f8: 2300 mov r3, #0
1128 b4fa: 881f ldrh r7, [r3, #0]
1129 b4fc: 8007 strh r7, [r0, #0]
1130 b4fe: 8858 ldrh r0, [r3, #2]
1131 b500: 8008 strh r0, [r1, #0]
1132 b502: 8b98 ldrh r0, [r3, #28]
1133 b504: 8048 strh r0, [r1, #2]
1134 b506: 8bd8 ldrh r0, [r3, #30]
1135 b508: 8088 strh r0, [r1, #4]
1136 b50a: 2098 mov r0, #152
1137 b50c: 8010 strh r0, [r2, #0]
1138 b50e: 2086 mov r0, #134
1139 b510: 8847 ldrh r7, [r0, #2]
1140 b512: 8800 ldrh r0, [r0, #0]
1141 b514: 0200 lsl r0, r0, #8
1142 b516: 4307 orr r7, r0
1143 b518: 80cf strh r7, [r1, #6]
1144 b51a: 20ff mov r0, #255
1145 b51c: 8018 strh r0, [r3, #0]
1146 b51e: 8014 strh r4, [r2, #0]
1147 b520: 8035 strh r5, [r6, #0]
1148 b522: 20f0 mov r0, #240
1149 b524: 8010 strh r0, [r2, #0]
1150 b526: bdf0 pop {r4, r5, r6, r7, pc}
1151
1152 ; This function computes a single-word flash device ID. The algorithm is
1153 ; as follows:
1154 ; - if the manuf is other than 01 or 04, return the autoselect word from 0x02
1155 ; - ditto autosel[0x02] != 0x227E
1156 ; - in the case of our expected S71PL129NC0, return value will be
1157 ; 0x2100 or 0x2101 depending on the chip rev indicated in CFI table
1158
1159 b528: b500 push {lr}
1160 b52a: b083 sub sp, #12
1161 b52c: 4668 mov r0, sp
1162 b52e: a901 add r1, sp, #4
1163 b530: ffd1f7ff bl 0xb4d6
1164 b534: 4668 mov r0, sp
1165 b536: 8800 ldrh r0, [r0, #0]
1166 b538: 2801 cmp r0, #1
1167 b53a: d003 beq 0xb544
1168 b53c: 4668 mov r0, sp
1169 b53e: 8800 ldrh r0, [r0, #0]
1170 b540: 2804 cmp r0, #4
1171 b542: d11e bne 0xb582
1172 b544: 4668 mov r0, sp
1173 b546: 8881 ldrh r1, [r0, #4]
1174 b548: 4817 ldr r0, [pc, #92] (0xb5a8)
1175 b54a: 4281 cmp r1, r0
1176 b54c: d119 bne 0xb582
1177 b54e: 4668 mov r0, sp
1178 b550: 7a00 ldrb r0, [r0, #8]
1179 b552: 4669 mov r1, sp
1180 b554: 88c9 ldrh r1, [r1, #6]
1181 b556: 0209 lsl r1, r1, #8
1182 b558: 4308 orr r0, r1
1183 b55a: 0400 lsl r0, r0, #16
1184 b55c: 0c00 lsr r0, r0, #16
1185 b55e: 4669 mov r1, sp
1186 b560: 88c9 ldrh r1, [r1, #6]
1187 b562: 4a12 ldr r2, [pc, #72] (0xb5ac)
1188 b564: 4291 cmp r1, r2
1189 b566: d10e bne 0xb586
1190 b568: 4669 mov r1, sp
1191 b56a: 890a ldrh r2, [r1, #8]
1192 b56c: 2111 mov r1, #17
1193 b56e: 0249 lsl r1, r1, #9
1194 b570: 428a cmp r2, r1
1195 b572: d108 bne 0xb586
1196 b574: 4669 mov r1, sp
1197 b576: 8949 ldrh r1, [r1, #10]
1198 b578: 4a0d ldr r2, [pc, #52] (0xb5b0)
1199 b57a: 4291 cmp r1, r2
1200 b57c: d003 beq 0xb586
1201 b57e: 480d ldr r0, [pc, #52] (0xb5b4)
1202 b580: e001 b 0xb586
1203 b582: 4668 mov r0, sp
1204 b584: 8880 ldrh r0, [r0, #4]
1205 b586: b003 add sp, #12
1206 b588: bd00 pop {pc}
1207 b58a: 46c0 nop (mov r8, r8)
1208
1209 ; written into table @81006C for one chip rev
1210 b58c: 0081a61c
1211 b590: 0081a8b4
1212 b594: 0081ab4c
1213 ; written into table @81006C for the other chip rev
1214 b598: 0081a4d0
1215 b59c: 0081a768
1216 b5a0: 0081aa00
1217 ; looks like 6 records of 0x14C bytes each, starting at 0x81a4d0
1218 ; that's offset 0xA04C from the start of copy, 0xC554 in flash
1219
1220 b5a4: 12345678
1221 b5a8: 0000227e
1222 b5ac: 00002221
1223 b5b0: 00003133
1224 b5b4: 00002101
1225
1226 c554: 00000000
1227 c558: 00000036
1228 c55c: 02480000
1229 c560: 02490000
1230 c564: 024a0000
1231 c568: 024b0000
1232 c56c: 024c0000
1233 c570: 024d0000
1234 c574: 024e0000
1235 c578: 024f0000
1236 c57c: 02500000
1237 c580: 02510000
1238 c584: 02520000
1239 c588: 02530000
1240 c58c: 02540000
1241 c590: 02550000
1242 c594: 02560000
1243 c598: 02570000
1244 c59c: 02580000
1245 c5a0: 02590000
1246 c5a4: 025a0000
1247 c5a8: 025b0000
1248 c5ac: 025c0000
1249 c5b0: 025d0000
1250 c5b4: 025e0000
1251 c5b8: 025f0000
1252 c5bc: 02600000
1253 c5c0: 02610000
1254 c5c4: 02620000
1255 c5c8: 02630000
1256 c5cc: 02640000
1257 c5d0: 02650000
1258 c5d4: 02660000
1259 c5d8: 02670000
1260 c5dc: 02680000
1261 c5e0: 02690000
1262 c5e4: 026a0000
1263 c5e8: 026b0000
1264 c5ec: 026c0000
1265 c5f0: 026d0000
1266 c5f4: 026e0000
1267 c5f8: 026f0000
1268 c5fc: 02700000
1269 c600: 02710000
1270 c604: 02720000
1271 c608: 02730000
1272 c60c: 02740000
1273 c610: 02750000
1274 c614: 02760000
1275 c618: 02770000
1276 c61c: 02780000
1277 c620: 02790000
1278 c624: 027a0000
1279 c628: 027b0000
1280 c62c: 027c0000
1281 c630: 027d0000
1282 c634: 027e0000
1283 ...
1284 c6a4: 0000000f
1285 c6a8: 02480000
1286 c6ac: 024c0000
1287 c6b0: 02500000
1288 c6b4: 02540000
1289 c6b8: 02580000
1290 c6bc: 025c0000
1291 c6c0: 02600000
1292 c6c4: 02640000
1293 c6c8: 02680000
1294 c6cc: 026c0000
1295 c6d0: 02700000
1296 c6d4: 02740000
1297 c6d8: 02780000
1298 c6dc: 027c0000
1299 c6e0: 027d0000
1300 c6e4: 027e0000
1301 ...
1302 c7ec: 00000001
1303 c7f0: 00000001
1304 c7f4: 027e0000
1305 c7f8: 027f0000
1306 ...
1307 c938: 00000001
1308 c93c: 00000001
1309 c940: 027e0000
1310 c944: 027f0000
1311 ...
1312 ca84: 00000002
1313 ca88: 00000008
1314 ca8c: 027f0000
1315 ca90: 027f2000
1316 ca94: 027f4000
1317 ca98: 027f6000
1318 ca9c: 027f8000
1319 caa0: 027fa000
1320 caa4: 027fc000
1321 caa8: 027fe000
1322 caac: 02800000
1323 ...
1324 cbd0: 00000002
1325 cbd4: 00000001
1326 cbd8: 027f0000
1327 cbdc: 02800000
1328 ...
1329 cd1c: 00030000
1330 cd20: 00040000
1331 cd24: 00050000
1332 cd28: 00060000
1333 cd2c: 00070000
1334 cd30: 00080000
1335 cd34: 00090000
1336 cd38: 000a0000
1337 cd3c: 000b0000
1338 cd40: 000c0000
1339 cd44: 000d0000
1340 cd48: 000e0000
1341 cd4c: 000f0000
1342 cd50: 00100000
1343 cd54: 00110000
1344 cd58: 00120000
1345 cd5c: 00130000
1346 cd60: 00140000
1347 cd64: 00150000
1348 cd68: 00160000
1349 cd6c: 00170000
1350 cd70: 00180000
1351 cd74: 00190000
1352 cd78: 001a0000
1353 cd7c: 001b0000
1354 cd80: 001c0000
1355 cd84: 001d0000
1356 cd88: 001e0000
1357 cd8c: 001f0000
1358 cd90: 00200000
1359 cd94: 00210000
1360 cd98: 00220000
1361 cd9c: 00230000
1362 cda0: 00240000
1363 cda4: 00250000
1364 cda8: 00260000
1365 cdac: 00270000
1366 cdb0: 00280000
1367 cdb4: 00290000
1368 cdb8: 002a0000
1369 cdbc: 002b0000
1370 cdc0: 002c0000
1371 cdc4: 002d0000
1372 cdc8: 002e0000
1373 cdcc: 002f0000
1374 cdd0: 00300000
1375 cdd4: 00310000
1376 cdd8: 00320000
1377 cddc: 00330000
1378 cde0: 00340000
1379 cde4: 00350000
1380 cde8: 00360000
1381 cdec: 00370000
1382 cdf0: 00380000
1383 cdf4: 00390000
1384 cdf8: 003a0000
1385 cdfc: 003b0000
1386 ce00: 003c0000
1387 ce04: 003d0000
1388 ce08: 003e0000
1389 ce0c: 003f0000
1390 ce10: 00400000
1391 ce14: 00410000
1392 ce18: 00420000
1393 ce1c: 00430000
1394 ce20: 00440000
1395 ce24: 00450000
1396 ce28: 00460000
1397 ce2c: 00470000
1398 ce30: 00480000
1399 ce34: 00490000
1400 ce38: 004a0000
1401 ce3c: 004b0000
1402 ce40: 004c0000
1403 ce44: 004d0000
1404 ce48: 004e0000
1405 ce4c: 004f0000
1406 ce50: 00500000
1407 ce54: 00510000
1408 ce58: 00520000
1409 ce5c: 00530000
1410 ce60: 00540000
1411 ce64: 00550000
1412 ce68: 00560000
1413 ce6c: 00570000
1414 ce70: 00580000
1415 ce74: 00590000
1416 ce78: 005a0000
1417 ce7c: 005b0000
1418 ce80: 005c0000
1419 ce84: 005d0000
1420 ce88: 005e0000
1421 ce8c: 005f0000
1422 ce90: 00600000
1423 ce94: 00610000
1424 ce98: 00620000
1425 ce9c: 00630000
1426 cea0: 00640000
1427 cea4: 00650000
1428 cea8: 00660000
1429 ceac: 00670000
1430 ceb0: 00680000
1431 ceb4: 00690000
1432 ceb8: 006a0000
1433 cebc: 006b0000
1434 cec0: 006c0000
1435 cec4: 006d0000
1436 cec8: 006e0000
1437 cecc: 006f0000
1438 ced0: 00700000
1439 ced4: 00710000
1440 ced8: 00720000
1441 cedc: 00730000
1442 cee0: 00740000
1443 cee4: 00750000
1444 cee8: 00760000
1445 ceec: 00770000
1446 cef0: 00780000
1447 cef4: 00790000
1448 cef8: 007a0000
1449 cefc: 007b0000
1450 cf00: 007c0000
1451 cf04: 007d0000
1452 cf08: 007e0000
1453 cf0c: 007f0000
1454
1455 cf10: 00030000
1456 cf14: 00040000
1457 cf18: 00080000
1458 cf1c: 000c0000
1459 cf20: 00100000
1460 cf24: 00140000
1461 cf28: 00180000
1462 cf2c: 001c0000
1463 cf30: 00200000
1464 cf34: 00240000
1465 cf38: 00280000
1466 cf3c: 002c0000
1467 cf40: 00300000
1468 cf44: 00340000
1469 cf48: 00380000
1470 cf4c: 003c0000
1471 cf50: 00400000
1472 cf54: 00440000
1473 cf58: 00480000
1474 cf5c: 004c0000
1475 cf60: 00500000
1476 cf64: 00540000
1477 cf68: 00580000
1478 cf6c: 005c0000
1479 cf70: 00600000
1480 cf74: 00640000
1481 cf78: 00680000
1482 cf7c: 006c0000
1483 cf80: 00700000
1484 cf84: 00740000
1485 cf88: 00780000
1486 cf8c: 007c0000
1487
392 CF8F: last copied byte 1488 CF8F: last copied byte
393 1489
394 <CF90-1F9FF: all FFs> 1490 <CF90-1F9FF: all FFs>
395 1491
396 ; initialized data table 1492 ; initialized data table