see here: http://richard.burtons.org/2015/05/17/e ... t-process/
https://github.com/esp8266/esp8266-wiki/wiki/Memory-Map
and also from viewtopic.php?f=5&t=9&start=30#p274 :
0x40000000 (64K) - ESP8266 builtin ROM. It appears to be truly builtin, as its content doesn't appear in external FlashROM dump. The ROM technology is unclear. It can be mask ROM, or OTP, or just flash ROM whose means of programming are yet to be discovered. As more dumps for different modules will be collected, we'll be able to differentiate these choices.