ESP8266 Community Forum

- Sat Sep 06, 2014 5:13 pm #257 Layout of the flash chip

Boot 4KB
Flash.bin 64KB
irom0text.bin 172KB
User parameters 16KB

Duplicate this twice to make 512KB.
The duplicate copy is to support OTA update which may fail.

So maybe this is some kind of scheme where the ROM section is hardware cached from the flash to make it imitate a ROM.

Could it be:
64KB of real RAM
172KB of cached pseudo ROM?

Where the cache might consist of two 4KB hardware pages that fault in pages from the flash chip as needed?

Where I get my modules

- Sat Sep 06, 2014 5:58 pm #263 Apparently, the layout is simpler than that, since what is in 0x40000 is not a copy of what is at 0x00000.

My guess is:

• flash.bin @ 0x00000
• irom0text.bin @ 0x40000
• some config @ 0x7c000
• blank.bin @ 0x7e000

- Sat Sep 06, 2014 6:30 pm #269 wi07c.rom starts with the same header as eagle.app.v6.flash.bin posted by someone on this forum, so that's it - first 256K is for user app, and that AT command interpreter is nothing but a user app (which is little suprise for those who hacked HC-04 bluetooth modules before). At 0x40000, there's indeed code, not random bytes, but code starts not from the very begining.

- Sat Sep 06, 2014 6:52 pm #270 what's in wi07c.rom maps at 0x40240000 and thus is:

Code: Select allirom0_0_seg :                       org = 0x40240000, len = 0x32000


Proof:

Browse wi07c.rom in hex editor from 0x40000 and grep for 0x24 0x40, you'll find B8 01 24 40, and indeed, at 0x401b8 offset there's clearly start a short routine. It ends with 0D F0 (ret.n), as expected, and is preceeded by some data word and ret.n of a previous routine.