Address Reference

Address Reference

Firmware Base

Symbol	Address	Description
FW_BASE	0x04000000	Firmware load address
FW_SIZE	0x02000000	~32 MB

Dispatchers

Name	Address	Size	Description
Entry Point	0x04009000	573B	Boot entry
Primary Dispatcher	0x057A1AC0	558B	Main RPC dispatcher
Secondary Dispatcher	0x04ED39DC	141KB	Branch-based dispatcher
Tertiary Dispatcher	0x05723EF4	13KB	Additional dispatcher
RPC Jump Table	0x059BE7F4	4.9KB	12 RPC type table
RPC Type Table	0x059BFEB0	—	Actual handler addresses

Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8)

Subcmd	Target	Decompiled
0	0x057A1DB4	✅
1	0x057A1C18	✅
2	0x057A39FC	✅
3	0x057A1BCC	✅
4	0x057A1EF4	✅
5	0x057A1E94	✅
6	0x057A3A28	✅
7	0x057A3A60	✅
8	0x057A1C6C	✅
9	0x057A3A48	✅
10	0x057A1F6C	✅
11	0x057A3AC4	✅
12	0x057A1E10	✅
13	0x057A3A90	✅
14	0x057A39BC	✅
15	0x057A3AAC	✅
16	0x057A3A78	✅
17	0x057A1CCC	✅
18	0x057A39E0	✅
19	0x057A1FA8	✅
20	0x057A2094	✅
21	0x057A2074	✅
22	0x057A2044	✅
23	0x057A20D4	✅
24	0x057A20B4	✅
25	0x057A1FC8	✅
26	0x057A2008	✅
27	0x057A1FE8	✅
28	0x057A2024	✅
29	0x057A219C	✅
30	0x057A20FC	✅
31	0x057A214C	✅

Migration Jump Tables

Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC)

Index	Target	Decompiled
0	0x057A2344	✅
1	0x057A2320	✅
2	0x057A230C	✅
3	0x057A22F8	✅
4	0x057A2388	✅
5	0x057A23D8	✅
6	0x057A23AC	✅
7	0x057A2478	✅
8	0x057A2428	✅
9	0x057A2454	✅
10	0x057A2404	✅
11	0x057A2364	✅
12	0x057A1F3C	(dup)
13	0x057A299C	—
14	0x057A1F3C	(dup)
15	0x057A1F3C	(dup)

Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C)

Index	Target	Decompiled
0	0x057A257C	✅
1	0x057A25E4	✅
2	0x057A24EC	✅
3	0x057A2608	✅
4	0x057A2534	✅
5	0x057A25C0	✅
6	0x057A24A4	✅
7	0x057A259C	✅
8	0x057A2510	✅
9	0x057A2558	✅
10	0x057A24C8	✅
11	0x057A262C	✅
12	0x057A345C	✅
13	0x057A36D8	✅
14	0x057A35D8	✅
15	0x057A3658	✅

RPC Handlers (from Jump Table at 0x059BFEB0)

RPC Type	Name	Handler A	Handler B
0x01	ALLOC	—	—
0x02	FREE	—	—
0x03	MAP	0x05766AB7	0x05778A37
0x04	UNMAP	0x057669B7	0x05779937
0x05	PIN	0x057664B7	0x0577A3B7
0x06	UNPIN	0x057682B7	0x05779FB7
0x07	SCHEDULE	0x05767F37	0x0575AEB7
0x08	YIELD	0x0575AE37	0x05767337
0x09	NOTIFY	0x0577C8B7	0x05767837
0x0A	BAR_TRAP	0x057675B7	—
0x0B	MIGRATE	—	—
0x0C	DEBUG	—	—

Specialized Main Handlers

Function	Address	Size
rpc_alloc_main	0x057E94EC	40 KB
rpc_schedule_main	0x051EFBF4	1.8 KB
rpc_bar_trap_handler	0x04CB8188	40 KB
rpc_pin_handler	0x04ED34B8	—

WPR Handlers

Handler	Address	Size
WPR Handler 1	0x04F00B0C	62 KB
WPR Handler 2	0x04F00C78	62 KB

Memory & Global State

Symbol	Address	Description
Global Error Flag	0x04296048	cRam0000000004296048
Error Status Reg	0x0429B750+0x111300	Error register
Stack Canary	0x041DC350	Frame guard value
Allocator Arena	0x429B000	Base
Allocator Entry	0x429B450	UNK_ram_058A1A9C
Cache Manager	0x429B428	UNK_ram_05895BF4

String References

BAR Strings

String	Address
BAR1	0x0406570E, 0x04085DE0
Bar1Rest	0x040656DA
ForceBarAccess	0x040656F2
Bar1Aperture	0x04065722
Bar1Size	(referenced)

WPR Strings

String	Address
WPR_WRITE_COMPLETE	0x5E478F8
WPR_READ_COMPLETE	0x5E478E0
WPR_WRITE_TIMEOUT	0x5E47898
WPR_READ_TIMEOUT	0x5E47880
NV_WPR_WRITE_COMPLETE	0x5E478C8
NV_WPR_READ_COMPLETE	0x5E478B0
NV_WPR_WRITE_TIMEOUT	0x5E47868
NV_WPR_READ_TIMEOUT	0x5E47850

VBIOS Signatures

Signature	Value	Meaning
VBIOS Standard	0xAA55	VBIOS header
WPR Enable	0x57464F4E ("WFON")	WPR on
WPR Version	0x5746564E ("WFVN")	WPR version

Key Function Pointers (Indirect Calls)

Address	Function	Purpose
0x05AB7DA0	Logger	String logging
0x05AC4B7C	Stack unwind	Frame recovery
0x058A1A9C	Allocator	Memory alloc
0x05895BF4	Cache flush	Cache management
0x0588F9C4	DMA copy	Memory copy
0x05AEC86C	Memory read	Read from addr
0x05AE1430	Size query	Region size
0x05AF4D30	Page fault	Page fault handler
0x05B10C3C	Page map	Page mapping
0x05AE9A2C	Crypto/verify	Integrity check
0x05AED674	WPR check	WPR validation
0x05AED430	WPR emulate	WPR emulation
0x05CB30CC	Config read	Config access
0x05CB25E0	BAR config	BAR configuration
0x05CB23D8	BAR map	BAR mapping

Decompiled Output Files

Category	Files
Core	entry_ram_04009000.c, FUN_ram_057a1ac0_ram_057a1ac0.c
Sub-commands	FUN_ram_057a1bcc_ram_057a1bcc.c.. FUN_ram_057a214c_ram_057a214c.c (32)
Dispatchers	FUN_ram_04cc58f8_ram_04cc58f8.c, FUN_ram_04ed39dc_ram_04ed39dc.c, FUN_ram_05723ef4_ram_05723ef4.c
RPC Jump Table	FUN_ram_059be7f4_ram_059be7f4.c
BAR	FUN_ram_04cb8188_ram_04cb8188.c
WPR	FUN_ram_04f00b0c_ram_04f00b0c.c, FUN_ram_04f00c78_ram_04f00c78.c
ALLOC	FUN_ram_057e94ec_ram_057e94ec.c, FUN_ram_04d00a18_ram_04d00a18.c, FUN_ram_054a7de0_ram_054a7de0.c
SCHEDULE	FUN_ram_051efbf4_ram_051efbf4.c
RPC Handlers	FUN_ram_057664b7_ram_057664b7.c.. FUN_ram_0577c8b7_ram_0577c8b7.c (15)
Migration	FUN_ram_057a22f8_ram_057a22f8.c.. FUN_ram_057a3658_ram_057a3658.c (28)

Migration Sub-Command Descriptors (Sample)

Handler	Returned ID	Phase
0x057A22F8	0x10	Prepare
0x057A2344	0x14	Prepare
Others	TBD	Transfer/Commit