WebTV Memory Map
Jump to navigation
Jump to search
A page documenting various memory addresses used by the WebTV and MSN TV box hardware. Information on this right now is very rudimentary and details on how most addresses function are undocumented. Please contact us via email or the WebTV Discord if you have more information regarding this.
Original information written by eMac.
MediaWiki conversion, additional information (Classic memory map, SOLO IR), and re-arrangement by wtv-411.
Boot ROM (All models)
- 0xbfc00000 (MIPS32 reset vector)
LC2 & 2.5, DishPlayer/UltimateTV, BPS (New Classic), Japan
RAM:
- 0x80200000 (BootROM- 2MB fenced)
- 0x8040xxxx - 0x80xxxxxx (AppROM- ROM length fenced)
SOLO/SOLO2 DMA
Starts from offset 0xa4000000.
SPOT Offset = Offset - 0xa4000000
System Chip Type:
- 0xa4000000
- To get actual value:
Value << 24
- To get actual value:
Clock / High-res Clock:
- 0xa4000048
Crash Counter:
- 0xa40000a8
Board Type:
- 0xa4001000
- To get actual value:
(Value & 0x7000) << 12
- To get actual value:
Video:
- 0xa400300c - Related to frame buffer
SSID (One Wire):
- 0xa4004008
- Read one bit at a time. Write-Read, wait. Write->Read wait. ...
IIC:
- 0xa400400c
Modem:
- TBD
IR:
- 0xa4004028
- 0xa4004024 - Address set to 0x0000000a by firmware
- 0xa400402c - Address set to 0x00003083 by firmware
Serial Port:
- 0xa400a000 - TX
- 0xa400a004
- 0xa400a008
- 0xa400a00c
- 0xa400a010
---
- 0xa400a014
- 0xa400a054
- 0xa400a080
- 0xa400a0c0
- 0xa400a104
- 0xa400a108
- 0xa400a10c
- 0xa400a180
- 0xa400a184
- 0xa400a188
- 0xa400a288
- 0xa400a28c
- 0xa400a290
- 0xa400a2a0
- 0xa400a2a8
- 0xa400a2b4
- 0xa400a2b8
Smart Card Port:
- 0xa400aa80
- 0xa400aa88
- 0xa400aa98
- 0xa400aa8c
- 0xa400aab8
- 0xa400aaa8
- 0xa400aa10
- 0xa400aac8
- 0xa400aad8
- 0xa400aae8
- 0xa400aa84
WebTV Port / Pokoe Serial:
- 0xa400101C - Related to initializing WebTV Port. Decompiled code suggests that setting this address to 0x31 turns on the WebTV Port
- 0xa4f00000
- 0xa4f0000c
- 0xa4f00004
- 0xa4f00010
- 0xa4f00014
- 0xa4f00008
GPIO:
- 0xa4004004 - Front panel LEDs
Hardware address: 0xa4004004 => [11111111111111111111111111111ABC] A=Power LED (1=Off, 0=On) B=Connection LED (1=Off, 0=On) C=Message LED (1=Off, 0=On) 0 [000] => All On 1 [001] => (A-Power): On, (B-Connect): On, (C-Message): Off 2 [010] => (A-Power): On, (B-Connect): Off, (C-Message): On 3 [011] => (A-Power): On, (B-Connect): Off, (C-Message): Off 4 [100] => (A-Power): Off, (B-Connect): On, (C-Message): On 5 [101] => (A-Power): Off, (B-Connect): On, (C-Message): Off 6 [110] => (A-Power): Off, (B-Connect): Off, (C-Message): On 7 [111] => All Off
- 0xa4004118 / 0xa4004114 / 0xa4004014 - RFU power state or BT835 Reset