Skip to content

Instantly share code, notes, and snippets.

@dogtopus

dogtopus/pocket_challenge.md

Last active October 6, 2025 14:26
Show Gist options
  • Save dogtopus/0e6a3b09eb1fd174340b57e620b95309 to your computer and use it in GitHub Desktop.
Save dogtopus/0e6a3b09eb1fd174340b57e620b95309 to your computer and use it in GitHub Desktop.
Download ZIP
Pocket Challenge stuff
Raw
pocket_challenge.md

Pocket Challenge (JA734) System Config

Nuvoton Stuff

Memory Layout

  • 0x00000000 - 0x00100000 - (v) SRAM region mirrored by TLB
    • 0x00000000 - 0x00002000 - SRAM mirror
  • 0x80000000 - 0x82000000 - (v, p) 32MiB SDRAM
    • 0x80000000 - 0x81d00000 - OS + BSS (kernel and system heap)
    • 0x81d00000 - 0x82000000 - Reserved area (VRAM, TLB, etc.)
  • 0xb0000000 - 0xc0000000 - (v, p) MMIO (see W55FA93_reg.h)
  • 0xff000000 - 0xff002000 - (p) 8KiB SRAM (probably inaccessible directly after OS enables MMU)
  • 0xffff0000 - 0xffff4000 - (p) BootROM (?, probably inaccessible directly after OS enables MMU)

v - virtual memory (accessible after TLB is enabled), p - physical memory

Bootloader

Stage 0 (boot ROM)

Probably just standard Nuvoton stuff. It'd be great if we can dump it but this is probably not really necessary for a simple emulator (assuming that it doesn't do too much initialization work that the rest of the OS cares about).

Stage 1

Legacy N32905 boot header can be found at the sector 1 of the SD card. The boot header seemingly asks the boot ROM to load 0x10000 bytes to 0x80a00000 (only the first 0x4000 bytes seems to be the actual stage 1 though).

Stage 2

Stage 1 reinitializes the SD card and loads 0x80000 bytes from sector 33 to 0x80c00000. This then loads the kernel from the 1MiB mark on the SD card to 0x80000000 and finally boots it.

Pinctrl

Function Selection

  • GPIO: 0b00
  • Port A UART1: 0b11
  • Port E SD: 0b10

Board Config

Pin Function Description
A0, A7 GPIO In Hardware revision jumper (GND: bit 0, NC: bit 1, `A7 << 1
A2 GPIO In Home Key
A3 GPIO In VBAT comparator out? (bootloader immediately powers the system off if it's 0)
A10-A11 UART1 UART debug output (bootloader only)
E2-E7 SD0 eSD
ADC2 ADC VBAT sensing input (probably leftover from battery-powered model).

Bootloader Poweroff Sequence

RTC_FCR[2:] = 0b10
RTC_PWRON[20:16] = 0b0000
RTC_PWRON[1:] = 0b0
AHBCLK[:] = 0

AA battery VBAT sensing

Read out by 0x80c0d534 even on Li-ion battery models.

ADC raw count goes from 65 (0.233V) to 1023 (3.367V), cutoff is at ~611 (2.05V). Algorithm TODO.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment