When the flasher program is running, the c6 register map (read via mcr p15, 0, r0, c6, cM and interpreted based on ARM946 protection region registers). Data/Instr permissions (mcr p15, 0, r0, c5, c0, 2 and mcr p15, 0, r0, c5, c0, 3) both eq 0x03333333, which is user and system read/write to all regions. * Startup at 0xFF81_0000, jumps to 0xFF81_000C * Data segment or config? 0x1900 - 0x20740 * BSS? 0x20740 - 0x47750