Segment 0x00000000

Image offset Length Mapped address Description
N/A 0x3FF 0x0 Hardware defined direct address area. Used by DMOV(B,H) instructions. The low 0xFF is byte, the low 0x1FF is half-word sized addressing, and the full 0x3FF is used for full-words. See the Fujitsu docs p.23 for more details. It is used frequently in the CPU firmware, less in the main portion.
0x008155BA n/a 0x000D55BA Origin of the initial pointer to Int 00, the first code that should be executed when the camera is powered on if Fujitsu's specs are followed.
0x00800000 0x40000 0x0(?), 0x000C0000 The CPU firmware is located in the last 0x40000 bytes of the file. (Thanks kpsch...) It appears to be loaded in memory at two locations, with the higher locations being executed and the lower used for various data functions. The portions at 0x0 are partially overwritten by the direct address area, and other data. It is possible that only portions are copied from 0x000C0000 to 0x0.
0x0083FC00 0x400 0x000FFC00 This is the default location pointed to by tbr at startup, the default interrupt vector table. Handles a very limited number of vectors, but Int 00 should be the root entry point when the camera is powered on...

Segment 0x10000000

Image offset Length Mapped address Description
0x00000000 0x840000 0x10000000 Set at firmware flash (?)
0x00003C00 0x400 0x10003C00 Another vector table (?) [kps]
0x00008000 n/a 0x10008000 Address of the first piece of code to be found in the file, and is also the function in the main firmware which sets the TBR.
0x000F0000 n/a 0x100F0000 Int00 from the vector table used by the main firmware. This may be the entry point of the program by logic, but the Fujitsu specs indicate that Int 00 will always be the value from the vector table in lower memory @(0xFFFFC), so this needs to be looked into... more.
0x00400000 N/A 0x10400000 The routine at 0x1046A27A indicates that the CPU firmware starts at 0x10400000 and possibly ends 0x40000 before EOF. The routine also indicates the DSP firmware starts at offset 0x00800000.
0x005A39D0 0x228 0x105A39D0 Table of full stop interval shutter speed values from 30s to 1/4000s, expressed as ordered pairs of half-word values in numerator, denominator order.
0x005A3BF8 0x228 0x105A3BF8 Table of half stop interval shutter speeds organized as above.
0x005A3E20 0xA2 0x105A3E20 Table of third stop ISO values containing only one of each possible value. Used for reverse lookup to the 0-82 format used as input for the functions found thus far which use the ISO tables.
0x005A3EC2 0xA2 0x105A3EC2 Table of full stop interval half-word sized ISO values from 6-6400, followed by a table for third stop values then a table for half stop values.
0x0045A63E - 0x1045A63E Three subroutines which look up numerical ISO values from the tables above. (Rule 34)
0x0045AD4C - 0x1045AD4C A subroutine to match an ISO value to a table. (Rule 34)
0x004A4D7E - 0x104A4D7E Three more ISO lookup subroutines. (Rule 34)
0x004F0288 - 0x104F0288 Subroutines for yet more lookup of various ISOs and strings. These look up values from 50-3200 (and AUTO) rather than 6-6400. (Rule 34)
0x004F0EEE - 0x104F0EEE Subroutine to print color temperature strings
0x004F1742 - 0x104F1742 Subroutine to print EV compensation strings
0x004F48CA - 0x104F48CA Subroutine to print a decimal string
0x004F4962 - 0x104F4962 Subroutine to print a hexadecimal string
0x005248E0 - 0x105248E0 Subroutine to print debugging information
0x005C2EBC - 0x105C2EBC ISO value strings
0x005C2F48 - 0x105C2F48 Color temperature value strings
0x005C3210 - 0x105C3210 Exposure compensation value strings

Segment 0x80000000

Image offset Length Mapped address Description
0x000F03C0 0x000448 0x80000000 At PC 0x100F0066, a block of code (0x100F03C0-0x100F0807) is copied at runtime to address 0x80000000. At PC 0x100F0894, there is a jump to 0x80000002 (0x100F03C2) where some genuine code resides indeed.
0x00008154 0x000234 0x80000448 Found some more copying code to segment 0x80000000 (Klak).
0x00008388 0x00137E 0x8000067C Found some more copying code to segment 0x80000000 (Klak).
0x00009708 0x0028C3 0x800019FC Unconfirmed (Klak).