WebTV Memory Map

A page documenting various memory addresses used by the WebTV and MSN TV box hardware. Information on this right now is very rudimentary and details on how most addresses function are undocumented. Please contact us via email or the WebTV Discord if you have more information regarding this.

Original information written by eMac.

MediaWiki conversion, additional information (Classic memory map), and re-arrangement by wtv-411.

Classic

Boot ROM:

• 0xbf000000 (Unconfirmed, but likely based on the behavior of the phone settings function in TellyScripts)

LC2 & 2.5, DishPlayer/UltimateTV, BPS (New Classic), Japan

BootROM:

• 0x9fc00000

RAM:

• 0x80200000 (BootROM- 2MB fenced)
• 0x8040xxxx - 0x80xxxxxx (AppROM- ROM length fenced)

SOLO/SOLO2 DMA

Starts from offset 0xa4000000.

SPOT Offset = Offset - 0xa4000000

---

System Chip Type:

• 0xa4000000
  • To get actual value: Value << 24

Clock / High-res Clock:

• 0xa4000048

Crash Counter:

• 0xa40000a8

Board Type:

• 0xa4001000
  • To get actual value: (Value & 0x7000) << 12

SSID (One Wire):

• 0xa4004008
  • Read one bit at a time. Write-Read, wait. Write->Read wait. ...

IIC:

• 0xa400400c

Modem:

• TBD

Serial Port:

• 0xa400a000 - TX
• 0xa400a004
• 0xa400a008
• 0xa400a00c
• 0xa400a010

---

• 0xa400a014
• 0xa400a054
• 0xa400a080
• 0xa400a0c0
• 0xa400a104
• 0xa400a108
• 0xa400a10c
• 0xa400a180
• 0xa400a184
• 0xa400a188
• 0xa400a288
• 0xa400a28c
• 0xa400a290
• 0xa400a2a0
• 0xa400a2a8
• 0xa400a2b4
• 0xa400a2b8

Smart Card Port:

• 0xa400aa80
• 0xa400aa88
• 0xa400aa98
• 0xa400aa8c
• 0xa400aab8
• 0xa400aaa8
• 0xa400aa10
• 0xa400aac8
• 0xa400aad8
• 0xa400aae8
• 0xa400aa84

WebTV Port / Pokoe Serial:

• 0xa400101C
• 0xa4f00000
• 0xa4f0000c
• 0xa4f00004
• 0xa4f00010
• 0xa4f00014
• 0xa4f00008

GPIO:

• 0xa4004004 - Front panel LEDs

Hardware address: 0xa4004004 => [11111111111111111111111111111ABC]

A=Power LED (1=Off, 0=On)
B=Connection LED (1=Off, 0=On)
C=Message LED (1=Off, 0=On)

0 [000] => All On
1 [001] => (A-Power): On, (B-Connect): On, (C-Message): Off
2 [010] => (A-Power): On, (B-Connect): Off, (C-Message): On
3 [011] => (A-Power): On, (B-Connect): Off, (C-Message): Off
4 [100] => (A-Power): Off, (B-Connect): On, (C-Message): On
5 [101] => (A-Power): Off, (B-Connect): On, (C-Message): Off
6 [110] => (A-Power): Off, (B-Connect): Off, (C-Message): On
7 [111] => All Off

• 0xa4004118 / 0xa4004114 / 0xa4004014 - RFU power state or BT835 Reset
• 0xa4004028 - IR