Hello,

I found a few interesting things about the memory you marked as "Unknown". Maybe you already know this but just in case here it is:

HP49G+ Memory - Additional Info

ARM MMU Tables:

The above is the virtual memory map I read from the memory dump, so this is exactly what we should use. ERAM starts at 0x0800_0000 and will appear again at 0x0808_0000 because there are only 512k and the memory is mapped in 1 Mb blocks. The other addresses you observed might be due to the fact that the screen overlaps the virtual table. So we shouldn't assume that other addresses are usable.

At 0x4000_0000 (remapped to 0x07F0_0000) is:

Offset 0x00000 - 0x04000 ==> in theory this is the virtual memory map, but the HP49G+ only uses part of it, so it's really from 0x00000 - 0x00203 used, the rest are invalid entries. The screen is actually overlapping with the virtual table entry, so we could create a valid entry by drawing the proper pixels to the screen. I have not tried this but if we write the word 0x0800c1a (reversing the nibbles) at 0x07F00260 (the top of the screen), then ERAM and Port 0 should appear also mapped at 0x0980_0000.

0x00260 - 0x0089f ==> The screen is configured for 85 lines, so it actually ends at 0x00903. Of course the last 5 lines are invisible and full of garbage. 

0x00904-0x0FFF ==> Unused FREE RAM for us? (this is also part of the unused virtual memory table). Maybe we could use this area (1788 bytes, and it doesn't seem to be used by the ROM, but who knows...).

Note: Although the virtual memory table covers up to 0x3FFF, this region of memory is mapped with the internal SRAM that the processor has for booting from flash rom, and that's only 4kbytes, so the (free?) memory ends at offset 0x0FFF.

Good job with your web page and the emulator, and thanks for sharing the info.

Claudio