[weblacky]

Yo,
We may know where the prom is loaded. It says it every time at console boot up (prom copied to ram) with a location (this was stated before as well). This is why I wanted help because there’s still a little bit of math involved until we know where the heck we are.

Return to post #75: http://forums.irixnet.org/thread-2164-po...l#pid22879

Those values with a get should do something. I’m very certain it makes more sense that we are working with the memory shadow copy. Just like the way most PC BIOS work by shadow copy, where often they copy to memory and then the values can be fiddled with and ROMs can be inserted. I know it doesn’t have to work this way. But it often does.

I say this because if you check your console boot up you’ll see the graphics prom loading a graphics module like a ROM. To me this implies that the reason that prom code is copied to memory is because that is the way it is used. I don’t believe for a moment that the running prom MIPS code directly accesses the flash region after initial copy/load of prom image. I think this is why you have to go through this awful flashing a CPU speed anyway because of chicken or the egg. I also think because of such a low programming counter that the programmers did not want to access this flash region very much to prevent degradation. So they obviously don’t write back to it other than to flash it. So any modifications must be done at runtime and in memory. Otherwise there wouldn’t be such an incredibly low and delicate flash counter on this system, if they could just write bits of stuff to it here and there.

So I’d say just see if you can try doing the bytes @ at source you were doing before but use the new found address.

In other words base all your offsets on the base of 0x9000000100000000.