WebTV Memory Map

A page documenting various memory addresses used by the WebTV and MSN TV box hardware. Information on this right now is very rudimentary and details on how most addresses function are undocumented. Please contact us via email or the WebTV Discord if you have more information regarding this.

Original information written by eMac.

MediaWiki conversion, additional information (Classic memory map, SOLO IR), and re-arrangement by wtv-411.

Classic

Boot ROM:

• 0xbf000000 (Unconfirmed, but likely based on the behavior of the phone settings function in TellyScripts)

LC2 & 2.5, DishPlayer/UltimateTV, BPS (New Classic), Japan

BootROM:

• 0x9fc00000

RAM:

• 0x80200000 (BootROM- 2MB fenced)
• 0x8040xxxx - 0x80xxxxxx (AppROM- ROM length fenced)

SOLO/SOLO2 DMA

Starts from offset 0xa4000000.

SPOT Offset = Offset - 0xa4000000

---

System Chip Type:

• 0xa4000000
  • To get actual value: Value << 24

Clock / High-res Clock:

• 0xa4000048

Crash Counter:

• 0xa40000a8

Board Type:

• 0xa4001000
  • To get actual value: (Value & 0x7000) << 12

Video:

• 0xa400300c - Related to frame buffer

SSID (One Wire):

• 0xa4004008
  • Read one bit at a time. Write-Read, wait. Write->Read wait. ...

IIC:

• 0xa400400c

Modem:

• TBD

IR:

• 0xa4004028
• 0xa4004024 - Address set to 0x0000000a by firmware
• 0xa400402c - Address set to 0x00003083 by firmware

Serial Port:

• 0xa400a000 - TX
• 0xa400a004
• 0xa400a008
• 0xa400a00c
• 0xa400a010

---

• 0xa400a014
• 0xa400a054
• 0xa400a080
• 0xa400a0c0
• 0xa400a104
• 0xa400a108
• 0xa400a10c
• 0xa400a180
• 0xa400a184
• 0xa400a188
• 0xa400a288
• 0xa400a28c
• 0xa400a290
• 0xa400a2a0
• 0xa400a2a8
• 0xa400a2b4
• 0xa400a2b8

Smart Card Port:

• 0xa400aa80
• 0xa400aa88
• 0xa400aa98
• 0xa400aa8c
• 0xa400aab8
• 0xa400aaa8
• 0xa400aa10
• 0xa400aac8
• 0xa400aad8
• 0xa400aae8
• 0xa400aa84

WebTV Port / Pokoe Serial:

• 0xa400101C - Related to initializing WebTV Port. Decompiled code suggests that setting this address to 0x31 turns on the WebTV Port
• 0xa4f00000
• 0xa4f0000c
• 0xa4f00004
• 0xa4f00010
• 0xa4f00014
• 0xa4f00008

GPIO:

• 0xa4004004 - Front panel LEDs

Hardware address: 0xa4004004 => [11111111111111111111111111111ABC]

A=Power LED (1=Off, 0=On)
B=Connection LED (1=Off, 0=On)
C=Message LED (1=Off, 0=On)

0 [000] => All On
1 [001] => (A-Power): On, (B-Connect): On, (C-Message): Off
2 [010] => (A-Power): On, (B-Connect): Off, (C-Message): On
3 [011] => (A-Power): On, (B-Connect): Off, (C-Message): Off
4 [100] => (A-Power): Off, (B-Connect): On, (C-Message): On
5 [101] => (A-Power): Off, (B-Connect): On, (C-Message): Off
6 [110] => (A-Power): Off, (B-Connect): Off, (C-Message): On
7 [111] => All Off

• 0xa4004118 / 0xa4004114 / 0xa4004014 - RFU power state or BT835 Reset