great topic
looking at some of the info from the first post
0001A400 - 0005FFFF : 100% difference (ignoring padding with 0xC3C3 at the end). This is likely our executable code that is different among software versions. Almost every byte in this region is different from map to map. What backups up my theory about software versions is the fact that for each bin file compared, length of this region is different (when ignoring 0xC3C3 at the end of this region) - changes in software sources were made. So:
- 1037353776 ends at 00055420
- 1037364307 ends at 000575c0
- 1037364397 ends at 00058b80
The software upgrade path looks similar to some smart cards. eg Hard coded secure ROM on cpu cannot be updated (boot loader and specific built in functions) to allow for major bugs or future improvement in hardware a eeprom based look-up/jump table is used to call these routines.
Patches/updates are then applied to the bottom of the existing data area (not moving existing code lowers risk of introducing new bugs) and the jump table updated to call these updated routine instead of internal functions etc.