[Touch Diamond2, Pure Android Development] mweirauch:
another solution?

It might be the case that the direction I thought of can work. It just needs some adjustments to HaRET. :D Dunno if that would be accepted for inclusion.

Every OEM is supposed to provide an OEMAddressTable definition which is baked into WinCE and evaluated by the kernel at the very beginning. By evaluating the memory region of OEMAddressTable (lookup to be made dynamic) one can analyse what memory mappings between WinCEs virtual address space and physical addresses have been defined by the OEM.

I've dumped the OEMAddressTable memory region from my device and parsed with a little Java application.

Analyzing table-topa100-old-mine.txt ...

v=0x8a100000 p=0x15000000 s=31m
v=0x8e200000 p=0x16d00000 s=1m
v=0x8e000000 p=0x16e00000 s=1m
v=0x8e100000 p=0x16f00000 s=1m
v=0x80000000 p=0x10000000 s=79m
v=0x84f00000 p=0x14f00000 s=1m
v=0x85000000 p=0x20000000 s=48m
v=0x88900000 p=0x23000000 s=23m
v=0x8c000000 p=0x24700000 s=32m
v=0x8e300000 p=0x26700000 s=25m
v=0x9c000000 p=0x94000000 s=1m
v=0x88000000 p=0x0 s=9m
v=0x8a000000 p=0x1f00000 s=1m
v=0x96000000 p=0x88000000 s=2m
v=0x98000000 p=0x8c000000 s=2m
v=0x9a000000 p=0x90000000 s=2m
v=0x9d000000 p=0x98000000 s=1m
v=0x9e000000 p=0x9c000000 s=2m
v=0x9f000000 p=0x80000000 s=1m
v=0x90000000 p=0xac000000 s=13m
v=0x90d00000 p=0xa8000000 s=1m
v=0x90e00000 p=0xa0e00000 s=1m
v=0x90f00000 p=0xa0d00000 s=1m
v=0x91000000 p=0xa0c00000 s=1m
v=0x91100000 p=0xa0a00000 s=2m
v=0x91300000 p=0xa0800000 s=1m
v=0x91400000 p=0xa0700000 s=1m
v=0x91500000 p=0xa0600000 s=1m
v=0x91600000 p=0xa0500000 s=1m
v=0x91700000 p=0xa0400000 s=1m
v=0x91800000 p=0xa0200000 s=1m
v=0x91900000 p=0xa0300000 s=1m
v=0x91a00000 p=0xa0100000 s=1m
v=0x91b00000 p=0xa0000000 s=1m
v=0x91c00000 p=0xaa700000 s=1m
v=0x91d00000 p=0xaa600000 s=1m
v=0x91e00000 p=0xaa500000 s=1m
v=0x91f00000 p=0xaa400000 s=1m
v=0x92000000 p=0xaa300000 s=1m
v=0x92100000 p=0xa8100000 s=1m
v=0x92200000 p=0xa9d00000 s=1m
v=0x92300000 p=0xa9900000 s=1m
v=0x92400000 p=0xa8700000 s=1m
v=0x92500000 p=0xaa200000 s=1m
v=0x92600000 p=0xa9c00000 s=1m
v=0x92700000 p=0xa9b00000 s=1m
v=0x92800000 p=0xa9a00000 s=1m
v=0x92900000 p=0xa9800000 s=1m
v=0x92a00000 p=0xa9700000 s=1m
v=0x92b00000 p=0xa9600000 s=1m
v=0x92c00000 p=0xa9500000 s=1m
v=0x92d00000 p=0xa9400000 s=1m
v=0x92e00000 p=0xa9300000 s=1m
v=0x92f00000 p=0xa9200000 s=1m
v=0x93000000 p=0xa9100000 s=1m
v=0x93100000 p=0xa9000000 s=1m
v=0x93200000 p=0xa8600000 s=1m
v=0x93300000 p=0xa8500000 s=1m
v=0x93400000 p=0xa8400000 s=1m
v=0x93500000 p=0xa8300000 s=1m
v=0x93600000 p=0xa8200000 s=1m
v=0x93700000 p=0xa8200000 s=1m
v=0x93800000 p=0xa8200000 s=1m
v=0x93900000 p=0xa8200000 s=1m
v=0x93a00000 p=0xa8200000 s=1m
v=0x93b00000 p=0xa8200000 s=1m
v=0x93c00000 p=0xa8000000 s=1m
v=0x93d00000 p=0xb0000000 s=1m
v=0x93e00000 p=0xb0200000 s=1m
v=0x93f00000 p=0xb0300000 s=1m
v=0x94000000 p=0xb0400000 s=1m
v=0x94100000 p=0xb0500000 s=1m
v=0x94200000 p=0xb0600000 s=1m
v=0x94300000 p=0xb1000000 s=13m
v=0x95000000 p=0xb8000000 s=1m
v=0x95100000 p=0xb8100000 s=1m
v=0x95200000 p=0xb8200000 s=1m
v=0x95300000 p=0xc0000000 s=1m
v=0x95400000 p=0xc0100000 s=1m
v=0x95500000 p=0xc0200000 s=1m
v=0x0 p=0x0 s=0m
Stop indicator found.

Collected Banks:
start=0x0 end=0x900000 (9m)
start=0x1f00000 end=0x2000000 (1m)
start=0x10000000 end=0x16f00000 (111m)
start=0x16d00000 end=0x17000000 (3m)
start=0x20000000 end=0x28000000 (128m)
start=0x80000000 end=0x80100000 (1m)
start=0x88000000 end=0x88200000 (2m)
start=0x8c000000 end=0x8c200000 (2m)
start=0x90000000 end=0x90200000 (2m)
start=0x94000000 end=0x94100000 (1m)
start=0x98000000 end=0x98100000 (1m)
start=0x9c000000 end=0x9c200000 (2m)
start=0xa0000000 end=0xa0900000 (9m)
start=0xa0a00000 end=0xa0f00000 (5m)
start=0xa8000000 end=0xa8100000 (1m)
start=0xa8000000 end=0xa8300000 (3m)
start=0xa8200000 end=0xa8300000 (1m)
start=0xa8200000 end=0xa8300000 (1m)
start=0xa8200000 end=0xa8300000 (1m)
start=0xa8200000 end=0xa8300000 (1m)
start=0xa8200000 end=0xa8800000 (6m)
start=0xa9000000 end=0xa9e00000 (14m)
start=0xaa200000 end=0xaa800000 (6m)
start=0xac000000 end=0xacd00000 (13m)
start=0xb0000000 end=0xb0100000 (1m)
start=0xb0200000 end=0xb0700000 (5m)
start=0xb1000000 end=0xb1d00000 (13m)
start=0xb8000000 end=0xb8300000 (3m)
start=0xc0000000 end=0xc0300000 (3m)

By accumulating contiguous table entries in one bank and dropping collected banks below 32MB (and for safety reason ones starting after phys 0x2800000) I get the following usable banks collected. Apart from the first bank being a bit bigger then what we use (107MB in linux-msm) the start offsets are correct.

Usable Banks:
start=0x10000000 end=0x16f00000 (111m)
start=0x20000000 end=0x28000000 (128m)

Why am I writing this? I need info from other devices ;)

Determining the (virtual) address of OEMAddressTable (yet manually by dumping WinCE dmesg)

Connect to your device via haretconsole ("./console 169.254.2.1") and execute the following:

pwf topa_dmesg.txt 0x16f00000 0x100000

The file will be stored on your device next to your haret.exe. Open it up with a text editor (e.g. Office Mobile Word) and search for "OEMAddressTable". (It might be the case, that your device is running for too long. Then reboot and perform the above step again.)

If you have found the line, there is a number behind "OEMAddressTable". On my topaz it is "800010b8".

Dumping the OEMAddressTable memory region

vd 0x<address-you-found> 2000 (in my case vd 0x800010b8 2000)

Copy the result and post (probably as an attachment) and your device type (topa100, topa200, ...) here. Everybody who can provide the info the better. This is not restricted to monodie topaz.