File Structure Analysis
u/Phenakist has delineated the general regions of the flash chip as follows:
So the structure of the firmware seems to be:
A) Chapter Map
B) Chapter
C) Transition
D) Chapter
E) Transtion
... (repeat for number of chapters in cassette) ...
F) 8556 bytes of code, common across all chip dumps
G) Empty space (FF FF FF FF...)
H) 16 byte chip ID and/or key (or possibly the chapter marks)
I) FF's to end of file
They also mentioned that there seems to be 12 segments of "chapters" which correlates with the carousel's 12 windows. Table 1. Hexadecimal addresses of data region boundaries in a p25d80sh chip. Start and End of addresses are inclusive. "xx" is not a byte type, but a placeholder for custom data unique to each cartridge.
Table 1. General stratification of cartridge data by segment. Addresses are reported in hexadecimal.
| Arbitrary Designation | Address Start | Address End (inclusive) | Size (bytes) | Description |
|---|---|---|---|---|
| Segment 1 | 0x0 | 0x6F | 112 | This is a highly variable region with a few conserved markers. This is always the initial pattern to these cartridges. The pattern suggests that there are 4-byte addresses repeated here. In conversing with Gemini, it seems that these may make up a pointer-table. The first pointer seems to be always 0x4EE8 and the other 23 pointers are ascending and unique. In total, this will generate 12 unique regions and 12 conservative regions. |
| Segment 2 | 0x70 | 0x4EE7 | 20088 | This region is completely conserved (needs validation). |
| Segment 3 | 0x4EE8 | variable | variable | Unique data segment. The third and fourth byte may be conserved among cartridges (needs validation). |
| Segment 4 | variable | Variable | 8556 | This is the last significant data chunk. It is completely conserved as well, except for possibly the first four bytes (see region 13 for explanation). |
| Segment 5 | variable | 0xFFF7F | variable | This is purely empty space. It takes up a decent amount of the chip. |
| Segment 6 | 0xFFF80 | 0xFFF8F | 12 | This is the last line of data unique to each book "series" (ie: Puppy, Elephant, and Lion). |
| Segment 7 | 0xFFF90 | 0xFFFFF | 128 | This is the last segment. It is simply empty space. |
A list of cartridge-specific segment specifications
Inter-Cartridge Region Comparisons
Table of Region References by Cartridge
Phenakist notes that 8556 bytes prior to Segment 5 is conserved among all books. However, the pointer table in Segment 1 suggests that Region 13 starts 8600 bytes prior to Segment 5. This 4-byte difference seems to be possibly deviant between books. Upon further investigation, it may seem that each region starts with a potential 4-byte address, usually ending in 00 00.