Rex 6000 memory map This is a working document describing the contents of the Rex 6000 RAM, flash memory, and firmware. This information is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. Use at your own risk! First posted: July 5, 2001 - C. Harris Updated: July 7, 2001 - Added Reset and SYSCALLEX vectors Updated: July 21, 2001 - Added info about second MB of flash memory, misc. additions and corrections. Updated: August 24, 2001 - Misc. additions and corrections. Updated: Sept. 6, 2001 - Second 2MB flash found by Marc Nijweide! 64KB address space: ------------------- (The Z80 processor has a 16 bit address bus, and is able to access only 64KB of "physical" memory. This is how the 64KB "appears" in the Rex:) 0000-7FFF - first 32KB of firmware (see below) 8000-9FFF - Bank 1 (8KB) flash memory address space A000-BFFF - Bank 2 (8KB) flash memory address space C000-EFFF - 12KB system RAM - used for firmware globals, SYSCALL parameter passing, etc. F000-FFFF - 4KB RAM, for use by addins and stack 32KB system RAM: ---------------- (The Rex is documented to contain 32KB RAM. It is now apparent that this RAM is accessed using the bank registers, and 16KB of it is "shadowed" in the 16-bit address space.) 02000000 - 02000FFF (page 1000) LCD RAM (appx. 4KB used) 02002000 - 02003FFF (page 1001) 8KB RAM 02004000 - 02005FFF (page 1002) 8KB RAM - Shadowed in 16-bit address space: C000-DFFF? 02006000 - 02007FFF (page 1003) 8KB RAM - Shadowed in 16-bit address space: E000-FFFF? (F000-FFFF = 4KB RAM for Addin RAM and stack) Marc Nijweide also identified the following memory pages, which are still pretty much a mystery: 00400000 - 00401FFF (page 0200) Another 8KB RAM/ROM??? 01400000 - 01407FFF (pages 0A00-0A03) Another 32KB RAM? 4MB flash memory summary ------------------------ (The Rex contains two 2MB flash memory chips. Data sheet for the Fujitsu 29DL164BD-90 16Mbit =2MB flash memory chip: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e520874.pdf ) 00000000 - 000FFFFF (pages 0000-007F) 1MB of Rex firmware 00100000 - 001FFFFF (pages 0080-00FF) 1MB of Rex database 00C00000 - 00CFFFFF (pages 0600-06FF) 2MB of Rex database Firmware memory map ------------------- (Pg = physical 8KB page number) (Lpg = "logical" 8KB page number, as used in firmware) (Description = contents of 8KB page, identified by "logical" page offset, starting at 8000) Physical Pg Lpg Description --------- -- -- ---------------------------------------------------------- 00000000 00 -- 0000-003F: reset vectors (see below), 0081: firmware update entry point, 1BBB: boot/diag strings, 1EF0: REX ID string (this page is NOT updated by REX.BIN. It appears to be the "boot sector") 00002000 01 -- [kernel functions] 21AB: "Hard" reset logic (this and all following pages are updated by REX.BIN) 00004000 02 -- [kernel functions] 4271: SYSCALL director, 4660: diag strings, 4850-4D70: strings, 4F00: RST 10h vectors (see below), 5000: "warm start" entry point (?) 00006000 03 -- 6000-6c40: strings 00008000 04 00 0000A000 05 01 0000C000 06 02 SYSCALLs 0000E000 07 03 00010000 08 04 SYSCALLs 00012000 09 05 SYSCALLs 00014000 0A 06 00016000 0B 07 00018000 0C 08 0001A000 0D 09 0001C000 0E 0A 0001E000 0F 0B 00020000 10 0C SYSCALLEX function processing 00022000 11 0D 8af8: software keyboard character lookups 00024000 12 0E 00026000 13 0F SYSCALLs 00028000 14 10 8000: Rex logo bmp - full screen 0002A000 15 11 SYSCALLs 0002C000 16 12 0002E000 17 13 9a92: battery/memory strings 00030000 18 14 3 software keyboard bmps: 8000: lowercase, 8a52: uppercase, 94a4: numeric 00032000 19 15 horizontal bar bmps for "", strings for tasks, memos, contacts 00034000 1A 16 EMPTY 00036000 1B 17 EMPTY 00038000 1C 18 EMPTY 0003A000 1D 19 SYSCALLs 0003C000 1E 1A 0003E000 1F 1B 89be:"DS" command parsing; Sync entry point 9a41: diag REX logo (alone) 00040000 20 1C 00042000 21 1D 00044000 22 1E 8406: battery/other bmps 00046000 23 1F SYSCALLs 00048000 24 20 0004A000 25 21 8b1b: Pgmr diag entry point; 8d34: Pgmr diag cmd switch table 0004C000 26 22 8000: Internal diag entry point, 9328: diag strings 0004E000 27 23 SYSCALLs 00050000 28 24 8000: assorted scroll buttons & large font text 00052000 29 25 Database (DbXxxxxx) system calls 00054000 2A 26 9080: alarm & battery strings 00056000 2B 27 9739: lock, home, etc. bmps 00058000 2C 28 0005A000 2D 29 0005C000 2E 2A 0005E000 2F 2B EMPTY 00060000-0006FFFF 30-37 2C-33 EMPTY 64KB SECTOR 00070000 38 34 00072000 39 35 8b96: main menu processing; 8bbe/8cb7: Main menu switches; 9616/97f8/99da: 3 Main menu bar bmps 00074000 3A 36 00076000 3B 37 00078000 3C 38 0007A000 3D 39 9cfc: Memos dialog entry point 0007C000 3E 3A 0007E000 3F 3B 00080000 40 3C 973c: Tasks dialog entry point 00082000 41 3D 00084000 42 3E 00086000 43 3F 00088000 44 40 0008A000 45 41 8000: Calculator dialog entry point 0008C000 46 42 0008E000 47 43 8000: Calculator bmps 00090000 48 44 9cba: Calendar dialog entry point 00092000 49 45 00094000 4A 46 8000: calendar strings 00096000 4B 47 00098000 4C 48 88e0: misc strings 0009A000 4D 49 EMPTY 0009C000 4E 4A 0009E000 4F 4B 000A0000 50 4C 000A2000 51 4D EMPTY 000A4000 52 4E 000A6000 53 4F 86ca and 8a89: possible Extras dialog entry points; 990b: Web dialog entry point 000A8000 54 50 000AA000 55 51 8000: Clock (world map) dialog entry point 000AC000 56 52 8000: more bmps; 83b9: world map bmp (240x100?) 000AE000 57 53 000B0000 58 54 000B2000 59 55 000B4000 5A 56 89b0: task bmps 000B6000 5B 57 000B8000 5C 58 EMPTY 000BA000 5D 59 000BC000 5E 5A 000BE000 5F 5B 000C0000 60 5C 9913: Contacts dialog entry point 000C2000 61 5D 000C4000 62 5E 000C6000 63 5F 000C8000 64 60 000CA000 65 61 000CC000 66 62 EMPTY 000CE000 67 63 000D0000 68 64 96c8: japanese bmps 000D2000 69 65 96f5/992b/9c49: more references to Extras (dialog?) 000D4000 6A 66 8000: main menu icons, 8530: main menu item strings 000D6000 6B 67 000D8000 6C 68 8000: control panel strings, 83d3: misc. control panel icons 000DA000 6D 69 000DC000 6E 6A 000DE000 6F 6B 000E0000 70 6C 000E2000 71 6D 000E4000 72 6E 000E6000 73 6F 000E8000 74 70 000EA000 75 71 000EC000 76 72 875d: control panel menu entry point 000EE000 77 73 000F0000 78 74 8000: font 00 (normal) table 000F2000 79 75 8000: font 10 (bold) table 000F4000 7A 76 8000: font 20 (tiny) table 000F6000 7B 77 assorted special character bmps 000F8000 7C 78 EMPTY 000FA000 7D 79 EMPTY 000FC000 7E 7A EMPTY 000FE000 7F 7B web browser code? 9e19: Web strings ------------------------------------------------------------------------------- (2nd 1MB) 00100000 80 7C 8000: addin #0 00102000 81 7D 8000: addin #1 00104000 82 7E 8000: addin #2 00106000 83 7F 8000: addin #3 00108000 84 80 8000: addin #4 0010A000 85 81 8000: addin #5 0010C000 86 82 8000: addin #6 0010E000 87 83 8000: addin #7 00110000-0011FFFF (Pages 0088-008F) EMPTY 64KB SECTOR Database flash memory --------------------- (Nearly 3MB (less 128KB) of flash memory is apparently Rex database At the beginning of each 64KB sector, there is some sort of header, with text "CISF9 FTL100": Page 0090: 13 03 CISF9 FTL100 01 b2 07 ,,, 0098: 13 03 CISF9 FTL100 01 b4 07 ... 00a0: 13 03 CISF9 FTL100 01 54 05 ... 00a8: "" 01 9c 07 00b0: "" 01 bb 06 00b8: "" 01 85 06 00c0: "" 01 8F 07 00c8: "" 01 9f 07 00d0: "" 01 8a 07 00d8: "" 01 9a 07 00e0: "" 01 ba 07 00e8: "" 01 6d 07 00f0: "" 01 76 07 00f8: "" 01 9d 07 Page 0600: 0608: 0610: ... 0678: 0680: 0688: ... 06F0: 06F8: Reset vectors: RST fn. Vector ...to Function ------- ------ ----- --------------------------------- RST 00h 0060 21AB "Hard" reset 0081 Reset option 1: update firmware (Home key pressed) 22:8000 Reset option 2: internal diagnostic (Back key pressed) RST 08h 2008 unused RST 10h 2010 4271 All system calls in SDK (below) RST 18h 2018 unused RST 20h 2020 unused RST 28h 2028 unused RST 30h 2030 unused RST 38h 2038 428E ? RST 10h "SYSCALL" entry points in Rex firmware: (Vector map at 4f00-4fff) Fn. Identifier in SYSCALL.H Vector Entry point (implementation) --- ----------------------- ------ ----------------------------- 00h DS_TIME_GET 380A 02:8a88 02h DS_TIME_SET 3828 02:8a9d 04h DS_LOCAL_TIME_GET 3882 02:8ae4 06h DS_TIME_24_GET 38A6 02:8b13 08h DS_TIME_24_SET 38B8 02:8b1e 0Ah DS_TIME_SUMMER_GET 38D0 02:8b34 0Ch DS_TIME_SUMMER_SET 38E8 02:8bf7 0Eh DS_MONTH_PERIOD_GET 3906 02:81c2 10h DS_HOME_CITY_GET 391E 02:8d5e 12h DS_HOME_CITY_SET 3930 02:8d64 14h DS_ALARM_TIME_GET 399C 0f:8079 16h DS_ALARM_TIME_SET 39B4 0f:8092 18h DS_ALARM_ENABLE 39CC 0f:80b3 1Ah DS_ALARM_SET 39E4 0f:8101 1Ch DS_BEEP_ON 39FC 1Eh DS_BEEP_SET 3A19 20h DS_SHELL_REFRESH_TOP 0000 * 22h DS_SHELL_PROGRAM_TERM 0000 * 24h DS_SHELL_PROGRAM_EXEC 0000 * 26h DS_TIME_FORMAT_GET 3972 02:8f9f 28h DS_TIME_FORMAT_SET 3984 02:8fad 2Ah DS_EVENT_MESSAGE_GET 3E06 1f:9689 2Ch DS_EVENT_ADD 203B 19:90bf 2Eh DS_EVENT_DELETE 2073 19:9108 30h DS_EVENT_CLEAR 2085 19:9199 32h DS_EVENT_ENABLE 2097 19:8f95 34h DS_EVENT_DISABLE 20AF 19:8fde 36h DS_EVENT_STATUS_GET 0000 * 38h DS_EVENT_PRIORITY_GET 0000 * 3Ah DS_READ_MESSAGE 3E1E 1f:98d9 3Ch DS_READ_LAST_MESSAGE 3E3C 1f:9932 3Eh DS_TRAVEL_CITY_SET 395A 02:8E88 40h DS_ADDIN_EXECUTE 4186 00:41e3 42h DS_ADDIN_TERMINATE 419E 00:4203 44h DS_TRAVEL_TIME_GET 3846 02:8aba 46h DS_TRAVEL_TIME_SET 3864 02:8acf 48h DS_TRAVEL_CITY_GET 3948 02:8e82 4Ah DS_DISPLAY_COMPONENT 2A9F 23:8e61 4Ch DS_SET_SCROLL_SIZE 2AC2 11:8508 4Eh DS_DIALOG_SCROLL_THUMB_SET 2ADA 11:85b0 50h DS_DISP_LINE 2AEF 04:8009 52h DS_DISP_POINT_GET 2B1C 04:802d 54h DS_DISP_POINT_SET 2B3A 04:8096 56h DS_DISP_CIRCLE 2B5D 04:8096 58h DS_DISP_BLOCK_CLEAR 2B80 04:811b 5Ah DS_DISP_BLOCK_REV 2BA8 04:8651 5Ch DS_DISP_BLOCK 2BD5 04:8212 5Eh DS_DISP_BLOCK_STORE 2C02 ** 60h DS_DISP_BLOCK_RESTORE 2C07 ** 62h DS_DISP_IMAGE_OR 2C0C ** 64h DS_DISP_WAIT_ICON_DRAW 2C11 04:896c 66h DS_TEXT_OUT 2C29 05:8582 68h DS_DIALOG_EDIT_SHOW 2C8D 23:8e84 6Ah DS_DIALOG_SCROLL_DRAW 2CB5 23:80F9 6Ch DS_DIALOG_EVENT_SET 2CDD 04:8760 6Eh DS_DIALOG_EVENT_DRAW 2D0A 04:87A4 70h DS_DIALOG_CHECK_BOX_SET 2D32 23:8EA7 72h DS_DIALOG_CHECK_BOX_DRAW 2D50 04:8B32 72h DS_DISPLAY_BITMAP_DRAW (same as above) 74h DS_DIALOG_COMPONENT_DRAW 2D81 23:8C7F 76h DS_RESOURCE_CHANGE 0000 * 78h DS_ICON_DRAW 2DA9 04:8889 //7Ah DS_ICON_MOVE 7Ah DS_DIALOG_TEXT_BUTTON 2DD1 19:90BF, 03:82E1 7Ch DS_ICON_REVERSE 0000 * 7Eh 0000 * 80h DS_POWER_IDLE_MODE_ENTRY 37B8 ** 82h DS_POWER_STOP_MODE_ENTRY 37BD 0e:9333 84h DS_POWER_MODE_GET 37CC ** 86h DS_POWER_MODE_SET 37D1 ** 88h DS_POWER_BAT_INFO 37D6 0e:924a 8Ah DS_POWER_LINE_CHECK 37E8 ** 8Ch DS_POWER_OFF_TIME_SET 37ED 32f7 8Eh DS_POWER_HALT_ENABLE 3800 (c029) = 1 90h DS_KEY_CODE_GET 36F4 02:8000 92h DS_KEY_REPEAT_SET 3706 ** 94h DS_KEY_CLICK_SET 370B 32e8 96h DS_FEP_EXECUTE 0000 * 98h DS_SOFT_KEY_CLOSE 371E ** 9Ah DS_TOUCH_CALIBRATION 20C7 11:809b 9Ch DS_TOUCH_CLICK_SET 20E2 11:83c1 9Eh DS_TOUCH_DATA_GET 20F4 11:8000 A0h DS_JSTR_CMP 2133 19:95c5 A2h DS_MALLOC 2160 2a:8573 A4h DS_REALLOC 2178 2a:82c9 A6h DS_FREE 2196 2a:8631 A8h DS_VERSION_GET 3E5A 2a:8883 AAh DS_ADDIN_PREV_GET 41B0 00:4218 ACh DS_ADDIN_PREV_SET 41C2 00:4223 AEh ??? 3E6C 2a:8889 B0h 0000 * B2h 0000 * B4h 0000 * B6h 0000 * B8h 0000 * BAh 0000 * BCh 0000 * BEh 0000 * C0h 0000 * C2h 0000 * C4h 0000 * C6h 0000 * C8h 0000 * CAh 0000 * CCh 0000 * CEh DS_SYSCALL_EXTENDED 366A 0c:8000 D0h DS_DB_INITIALIZE 4051 25:8c5e D2h DS_DB_CREATE 4060 25:8c6c D4h DS_DB_OPEN 406F 25:8c9c D6h DS_DB_CLOSE 407E 25:8cba D8h DS_DB_INSERT_RECORD 408D 25:8cd8 DAh DS_DB_DELETE_RECORD 409C 25:8cfe DCh DS_DB_READ_RECORD 40AB 25:8d1c DEh DS_DB_READ_FIELD 40BA 25:8d42 E0h DS_DB_FIND_RECORD 40C9 25:8d72 E2h DS_DB_NEXT_RECORD 40D8 25:8daa E4h DS_DB_PREVIOUS_RECORD 40E7 25:8dc8 E6h DS_DB_UPDATE_RECORD 40F6 25:8de6 E8h DS_DB_UPDATE_FIELD 4105 25:8e0c EAh DS_DB_TEXT_OP 4114 25:8e3c ECh DS_DB_FLUSH 4123 25:8ebf EEh DS_DB_GET_RECORD_COUNT 4132 25:8ecd F0h DS_DB_DESTROY 4141 25:8ef2 F2h DS_DB_SESSION 4150 25:8f10 F4h DS_DB_COPY_FIELD 415F 25:8f2c F6h DS_DB_MISC 416E 25:8f6d F8h 0000 * FAh 0000 * FCh 0000 * FEh 0000 * Notes: * Null vector - function not implemented ** Dummy (?) implementation: PUSH AF POP AF EI RETI RST 10h "SYSCALLEX" entry points in Rex firmware: Fn. Identifier in SYSCALLEX.H Entry point (implementation) ----- ------------------------- ----------------------------- 0001h DS_TEXT_OUT_24 0C:8062 0002h DS_TEXT_WIDTH 0C:8162 0003h DS_IS_ZENKAKU 0C:818C 0004h /*DS_ */ 0005h DS_VSCROLL_AREA 0C:81B9 0006h DS_GET_BYTE_BY_PIXEL 0C:8269 0007h DS_GET_PIXEL_BY_BYTE 0C:82B5 0008h /*DS_ */ 0009h DS_STRCPY 0C:8304 000Ah DS_MEMCPY 0C:835C 0101h DS_CAL_CURRENT_TIME 0C:8412 0102h DS_CAL_DATE_TIME 0C:845B 0103h DS_CAL_TIME_DATE 0C:8491 0104h DS_CAL_DAY_OF_WEEK_D 0C:84ED 0105h DS_CAL_DAY_OF_WEEK 0C:8526 0106h DS_CAL_STRFTIME 0C:8552 0107h DS_CAL_DAY_ADD 0C:8601 0108h DS_CAL_MONTH_ADD 0C:864A 0109h DS_CAL_MAX_DAY_OF_MONTH 0C:8693 010Ah DS_CAL_NTH_XDAY_IN_MONTH 0C:86BF 010Bh DS_CAL_INT_TO_STR 0C:8747 010Ch DS_CAL_DAY_TO_STR 0C:87CF 010Dh DS_CAL_STRFTIME_24 0C:8814 010Eh DS_CAL_DAY_TO_STR_E 0C:88DA 010Fh DS_CAL_DATE_TO_STR 0C:891F 0110h DS_CAL_WEEK_OF_YEAR 0C:8988 0111h DS_CAL_MINUTE_ADD 0C:89D6 0112h (undocumented) 0C:8A40 0113h (undocumented) 0C:8A85 0114h (undocumented) 0C:8AC9 0201h DS_SLEEP 0C:8B71 0202h (undocumented) 0C:8B98 0211h DS_SYNCHRONIZE 0C:8BC2 0221h DS_SETUP_INFO_SET 0C:8BD0 0222h DS_PASSWD_ENABLE 0C:8BDE 0223h DS_PASSWD_SET 0C:8C08 0224h DS_PASSWD_GET 0C:8C2F 0225h DS_USER_INFO_GET 0C:8C56 0226h DS_ALARM_UPDATE 0C:8CE3 0227h (undocumented) 0C:8CEE 0228h (undocumented) 0C:8D15 0229h (undocumented) 0C:8D23 022Ah (undocumented) 0C:8D90 022Bh (undocumented) 0C:8DBA 022Ch (undocumented) 0C:8DE4 022Dh (undocumented) 0C:8E0E 022Eh (undocumented) 0C:8E5A 022Fh (undocumented) 0C:8EA6 0231h DS_FLASH_WRITE_START 0C:8ED0 0232h DS_FLASH_WRITE_END 0C:8EDB 0241h DS_SYSTEM_ERROR_SET 0C:8EE6 0242h DS_SYSTEM_ERROR_GET 0C:8F50 0250h DS_SHORTCUT_MASK 0C:8F9C 0260h DS_POWER_OFF_COUNT_CLEAR 0C:8FC6 0261h (undocumented) 0C:8FD1 0270h (undocumented) 0C:8FFB 0271h (undocumented) 0C:90D1 0272h (undocumented) 0C:9184 0280h (undocumented) 0C:9236 0301h DS_SOFTWARE_KEYBOARD 0C:9293 0302h DS_SOFTWARE_KEYBOARD_SET_INPUT_MODE 0C:92DF 0303h DS_SOFTWARE_KEYBOARD_WITH_YOMI 0C:934C 0311h DS_DIALOG_WINDOW 0C:93B9 0312h (undocumented) 0C:9449 0313h (undocumented) 0C:94D9 0314h (undocumented) 0C:958C 0321h DS_DISPLAY_DAB 0C:9654 0330h (undocumented) "DS_PRINTF" 0C:976E 0331h (undocumented) 0C:9830 0332h (undocumented) 0C:98AC 0333h (undocumented) 0C:9928 0334h (undocumented) 0C:9A0D 0341h (undocumented) 0C:9ABD