===== 05 UDA F29 SPU 1DA0 AND 1E60 | BIOS 19951204 System ROM Version 3.0 11/18/96 A BadVaddr as the group starts: 00000480 Row 89. 1E60h-1E7Fh as this group finds them (after the BIOS, the runner and the groups before; a program cannot run before the BIOS card screen's first SPU write): F5FF F3EF BFFF 29DF 74BB FFFE BFF7 FFFF FFFF FD7D 6EFF 33B3 FC7F FFFF BFFF 7D8F 1DA0h read 256 times 1000 cycles apart, value or value x count, in order. As found, nothing written: 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x15 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 (57 runs, 24 shown) The image at 28000h uploaded and read back: 0 halfwords of 512 differ. SPUCNT 8000h, every voice released: AC00x2 0100 AC00x8 0100 AC00x15 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 (55 runs, 24 shown) SPUCNT C000h, released: AC00x4 0100 AC00x15 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x15 0100 AC00x8 0100 (55 runs, 24 shown) SPUCNT 0000h, released: AC00x2 0100 AC00x6 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x6 A000 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 (59 runs, 24 shown) SPUCNT 8000h, voices 1 and 3 keyed: AC00x2 0100 AC00x8 0100 AC00x6 A000 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x6 0100 AC00x8 0100 AC00x8 0100 (59 runs, 24 shown) SPUCNT C000h, keyed: AC00x8 0100 AC00x15 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 (53 runs, 24 shown) SPUCNT 0000h, keyed before: 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 (58 runs, 24 shown) 1DA0h written 0000h, SPUCNT 8000h, keyed: 0000 AC00x2 A000 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 (58 runs, 24 shown) 1DA0h written 0000h, SPUCNT 8000h, released: 0000 0100 AC00x6 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 AC00x8 0100 (59 runs, 24 shown) 1DA0h written back 0100: reads 0100. Done.