This topic is mostly for documenting stuff we find so it doesn't all stay on IRC. Keep discussing on IRC, but if any important discoveries are made, we'll put them here.

All this information was provided by reflashing my boot code: (thanks to brandonW for the flasher)





At boot, we now know that the memory mapping is as follows:
0000h - 3FFFh: Page 7F - boot code execution
4000h - 7FFFh: Page 00
8000h - BFFFh: Page 00
C000h - FFFFh: Ram Page 00

The way to return page 00 to 0000h is to execute on a page pointed to by port (06h). This is either the $4000h bank in memory map mode 0 or both the $4000 bank and the $8000 bank in memory map mode 1.

If anyone is interested, I made a boot image that jumps to $C000 after doing nothing to the calculator but unlock flash, not a single port besides 14h has been touched.

Although, for me to send this to you, you need to have some qualifications. You can erase the boot code in 5 bytes here, and as of writing this, I still can't turn the LCD on. So basically, in order for me to send you the stuff, you should know how to modify the OS, that's about the experience level you need.

Edit:
   Also, you have to have some way of pulling the link lines low. I use headphones, but a paper clip might work just as well.

edit: wait, why are there a couple of bytes missing in the jp 0 case?

Most likely because they couldn't be read at the time for some reason, but I'm curious as well.

Also, what is the reason that you need to pull the link lines low?