All the addresses in installHandlers are off by 4.
According to bootROM (rom:0 being of course at address 0xffff0000):
ROM:00000004 B sub_9C # undefined instruction
ROM:0000009C ; =============== S U B R O U T I N E =======================================
ROM:0000009C
ROM:0000009C ; Attributes: thunk
ROM:0000009C
ROM:0000009C sub_9C ; CODE XREF: sub_0+4j
ROM:0000009C LDR PC, =0x8000018
ROM:0000009C ; End of function sub_9C
ROM:0000009C
ROM:0000009C ; ---------------------------------------------------------------------------
ROM:000000A0 off_A0 DCD 0x8000018 ; DATA XREF: sub_9Cr
ROM:000000A4
ROM:000000A4 ; =============== S U B R O U T I N E =======================================
thus 0x8000018 should contain 0xe51ff004 (ldr pc, [pc, #-4]) and 0x800001C handleInst, etc.
You can trigger a prefetch abort using bkpt 1 for example.
All the addresses in
installHandlers
are off by 4.According to bootROM (rom:0 being of course at address 0xffff0000):
thus 0x8000018 should contain 0xe51ff004 (ldr pc, [pc, #-4]) and 0x800001C handleInst, etc.
You can trigger a prefetch abort using
bkpt 1
for example.