Detailed VB Memory Map

0x0000 0000 - 0x0007 FFFF	Display RAM, VIP	0x7FFFF bytes
0x0000 0000 - 0x0000 5FFF	L FrameBuff0		0x6000 bytes
0x0000 6000 - 0x0000 7FFF	CHR 0-511		0x2000 bytes
0x0000 8000 - 0x0000 DFFF	L FrameBuff1		0x6000 bytes  
0x0000 E000 - 0x0000 FFFF	CHR 512-1023		0x2000 bytes
0x0001 0000 - 0x0001 5FFF	R FrameBuff0		0x6000 bytes
0x0001 6000 - 0x0001 7FFF	CHR 1024-1535		0x2000 bytes
0x0001 8000 - 0x0001 DFFF	R FrameBuff1		0x6000 bytes
0x0001 E000 - 0x0001 FFFF	CHR 1536-2047		0x2000 bytes
0x0002 0000 - 0x0003 BFFF	BAM (BGMap RAM)		0x1C000 bytes *(1)
0x0003 C000 - 0x0003 D7FF	PARAM_TABLE		0x017FF bytes
0x0003 D800 - 0x0003 DBFF	WAM (World RAM)		0x00400 bytes
0x0003 DC00 - 0x0003 DDFF	CLMN_TBL1		0x00200 bytes 
0x0003 DE00 - 0x0003 DFFF	CLMN_TBL2		0x00200 bytes 
0x0003 E000 - 0x0003 FFFF	OAM (Object RAM)	0x02000 bytes

*(1)	The boundary between BAM and the PARAM_TABLE is variable

0x0004 0000 - 0x0005 F7FF	VIP Mirroring [How does this work?]
0x0005 F800 - 0x0005 F870	VIP - Only assessable in HWords

*0x0005 F800			INTPND	Interrupt Pending
*0x0005 F802			INTENB	Interrupt Enabled Flag
*0x0005 F804			INTCLR	Clear the bits in INTPND
*0x0005 F820			DPSTTS	Display Status
*0x0005 F822			DPCTRL	Display Control

0x0005 F824			BRTA	Color 1 Brightness (0-80 [0-100?])
0x0005 F826			BRTB	Color 2 Brightness (0-80 [0-100?])
0x0005 F828			BRTC	Color 3 Brightness = A + B + C

0x0005 F82A			REST	Counter, reset with 0x0000?
0x0005 F82E			FRMCYC	Repeat/G_CLK?
0x0005 F830			CTA	Column Table Address, R/L (Read Only?)
*0x0005 F840			XPSTTS	?
*0x0005 F842			XPCTRL	?
0x0005 F844			VER	Static Number?

0x0005 F848			SPT0	Pointers to the 4 OBJ groups in OAM
0x0005 F84A			SPT1
0x0005 F84C			SPT2
0x0005 F84E			SPT3

0x0005 F860			GPLT0	4 four-color (2-bit) palettes for BGMaps
0x0005 F862			GPLT1
0x0005 F864			GPLT2
0x0005 F866			GPLT3
0x0005 F868			JPLT0	4 four-color (2-bit) palettes for OBJs
0x0005 F86A			JPLT1
0x0005 F86C			JPLT2
0x0005 F86E			JPLT3

0x0005 F870			BKCOL	Screen cleared to BKCOL before rendering
					0: Black, 1-3: BRTA-BRTC

0x0007 8000 - 0x0007 FFFF	Linear mirror of CHR Data	0x8000 bytes

	Serial access memory, 0x700 bytes (where?)

0x0008 0000 - 0x00FF FFFF	Mirror of 0x0000 0000 - 0x0007 FFFF

0x0100 0000 - 0x0100 05FF	Sound Memory

Sound data consists of 32 WORDs masked with 0x3F to form 6-bit samples

0x0100 0000 - 0x0100 007F	SOUNDCH1 Data			0x20 bytes
0x0100 0080 - 0x0100 00FF	SOUNDCH2 Data			0x20 bytes
0x0100 0100 - 0x0100 017F	SOUNDCH3 Data			0x20 bytes
0x0100 0180 - 0x0100 01FF	SOUNDCH4 Data			0x20 bytes
0x0100 0200 - 0x0100 027F	Sweep  Data			0x20 bytes
0x0100 0280 - 0x0100 02FF	Modulation Data			0x20 bytes

0x0100 0400 - 0x0100 05FF	Sound Control Registers (WORDs masked w/0xFF)

	Channel 1: Standard wave
0x0100 0400			S1CTRL	Sound1 Control Register
0x0100 0404			S1LEN	Length Register
0x0100 0408			S1FL	Frequency low byte
0x0100 040C			S1FH	Frequency high byte
0x0100 0410			S1?L	Unknown
0x0100 0414			S1?H	Unknown
0x0100 0418			S1INST	Instrument

	Channel 2: Standard wave
0x0100 0440			S2CTRL	Sound2 Control Register
0x0100 0444			S2LEN	Length Register
0x0100 0448			S2FL	Frequency low byte
0x0100 044C			S2FH	Frequency high byte
0x0100 0450			S2?L	Unknown
0x0100 0454			S2?H	Unknown
0x0100 0458			S2INST	Instrument

	Channel 3: Standard wave
0x0100 0480			S3CTRL	Sound3 Control Register
0x0100 0484			S3LEN	Length Register
0x0100 0488			S3FL	Frequency low byte
0x0100 048C			S3FH	Frequency high byte
0x0100 0490			S3?L	Unknown
0x0100 0494			S3?H	Unknown
0x0100 0498			S3INST	Instrument

	Channel 4: Standard wave
0x0100 04C0			S4CTRL	Sound4 Control Register
0x0100 04C4			S4LEN	Length Register
0x0100 04C8			S4FL	Frequency low byte
0x0100 04CC			S4FH	Frequency high byte
0x0100 04D0			S4?L	Unknown
0x0100 04D4			S4?H	Unknown
0x0100 04D8			S4INST	Instrument

	Channel 5: Sweep/Modulation
0x0100 0500			S5CTRL	Sound5 Control Register
0x0100 0504			S5LEN	Length Register
0x0100 0508			S5FL	Frequency low byte
0x0100 050C			S5FH	Frequency high byte
0x0100 0510			S5?L	Unknown
0x0100 0514			S5?H	Unknown
0x0100 0518			S5INST	Instrument

	Channel 6: Noise
0x0100 0540			S6CTRL	Sound6 Control Register
0x0100 0544			S6LEN	Length Register
0x0100 0548			S6FL	Frequency low byte
0x0100 054C			S6FH	Frequency high byte
0x0100 0550			S6?L	Unknown
0x0100 0554			S6?H	Unknown
0x0100 0558			S6INST	Instrument

0x0100 0580			SMREG	Main sound control register

0x0200 0000 - 0x0200 002C	Hardware Control Registers (WORDs masked w/0xFF)

0x0200 0000			LPC	Link Port Control Register

10000000 (R/W)			INTDIS	1: Clear & Disable interrupts
					0: Enable
01000000 (?)			RFU	Unused, set to 1
00100000 (?)			RFU	Unused, set to 1
00010000 (R/W)			CLKSEL	1: External clock
					0: Internal (20 MHz/40 - 500 KHz)
00001000 (?)			RFU	Unused, set to 1
00000100 (W)			COMSTRT	1: Start comm. on falling edge of clock
00000010 (R)			COMSTAT	1: Communicating
					0: Idle
00000001 (?)			RFU	Unused, set to 1


0x0200 0004			LPC2	Link Port Control Register

10000000 (R/W)			INTDIS	1: Clear and disable interrupts
					0: Enable
01000000 (?)			RFU	Unused, set to 1
00100000 (?)			RFU	Unused, set to 1
00010000 (R/W)		InterruptLevel	???
00001000 (R/W)		ControlSignal	???
00000100 (R)		ControlSample	???
00000010 (R/W)		ControlWrite	???
00000001 (R)		ControlRead	???


- In/Out data for the timer, keypad and link port -
0x0200 0008 (R/W)		LPT	Link Port Transmit data
0x0200 000C (R)			LPR	LinkPort Receive data
0x0200 0010 (R)			KLB	Keypad LowByte
0x0200 0014 (R)			KHB	Keypad HighByte
0x0200 0018 (R/W)		TLB	Timer LowByte
0x0200 001C (R/W)		THB	Timer HighByte


0x0200 0020 (R/W)		TCR	Timer Control Register

10000000 (?)			RFU	Unused, set to 1
01000000 (?)			RFU	Unused, set to 1
00100000 (?)			RFU	Unused, set to 1
00010000 (R/W)			TCLK	Resolution of the clock 1: 20s
					0: 100ms (default)
00001000 (R/W)			TINT	1: Enable interrupt
					0: Disable
00000100 (W)			TCLR	1: Clear status flag
00000010 (R)			TSTAT	1: Counted to zero
					0: Disabled
00000001 (R/W)			TEN	1: Restart count
					0: Disable


0x0200 0024 (R/W)		WCR	Wait States Control Register

10000000 (?)			RFU	Unused, set to 1
01000000 (?)			RFU	Unused, set to 1
00100000 (?)			RFU	Unused, set to 1
00010000 (?)			RFU	Unused, set to 1
00001000 (?)			RFU	Unused, set to 1
00000100 (?)			RFU	Unused, set to 1
00000010 (R/W)			WEXP	1: 1 wait  0: 2 waits (default)
00000001 (R/W)			WROM	1: 1 wait  0: 2 waits (default)


0x0200 0028 (R/W)		KCR	Keypad Control Register

10000000 (R/W)			INTDIS	1: Clear and Disable Interrupts
					0: Enable (default)
01000000 (?)			RFU	Unused, set to 1
00100000 (R/W)			KLATCH	1: Software data latch
					0: Hardware read
00010000 (R/W)			KCLK	1: Software clock
					0: Hardware read
00001000 (?)			RFU	Unused, set to 1
00000100 (W)			KSTART	1: Start hardware read
					0: Idle (default)
00000010 (R)			KSTAT	1: Reading
					0: Idle
00000001 (R/W)			KSUSP	1: Pause reading
					0: Resume (default)


0x0400 0000 - 0x04FF FFFF	Expansion area	0x00FF FFFF bytes max
0x0500 0000 - 0x0500 FFFF	Work RAM	0xFFFF bytes (mask with ffff)
0x0600 0000 - 0x0600 1FFF	Cartridge RAM	0x00FF FFFF bytes max
0x0700 0000 - 0x07FF FFFF	Cartridge ROM	0x00FF FFFF bytes max *(2)

*(2)	All ROMs must be powers of 2 in size (256k, 512, 1024, 2048 etc.)
	The ROM starts at 0x700 0000 and goes up. But, due to addressing
	rollover, you can always read the ROM backwards from 0x07FF FFFF
	down.  This is how the reset vector is read.