From WebTV/MSN TV Wiki
(Redirected from Flash ROM)
Jump to navigation Jump to search

ROM in the WebTV/MSN TV world is used to refer to two things. It can refer to the type of chips first-gen boxes use to store and execute firmware, whether it be boot ROMs stored on read-only ROM chips that initialize the box hardware when executed on boot up, or the main client software, also known as app ROMs, that's stored on non-volatile flash ROM. It can also refer to the firmware itself that boxes execute.

Load Addresses

It's known that for LC2 (WebTV Plus) and UltimateTV models, the load address that app ROMs are loaded into in RAM is 0x80940000, while the load address for boot ROMs is 0x80200000 in RAM, and 0x9fc00000, supposedly for when it's read directly from its ROM chip. It's unknown if these values apply to WebTV/MSN TV Classic or DishPlayer models.


Firmware, in terms of WebTV/MSN TV, is the software that allow boxes to start up and run the main WebTV/MSN TV client software, which include the browser and capabilities to connect to the proprietary WebTV/MSN TV service. For our purposes, we'll use the term "firmware" to collectively refer to both boot ROMs and app ROMs.

Firmware for first-gen WebTV/MSN TV devices are built as MIPS binaries, possibly designed for the III/IV revision of the architecture. While the size of the client binaries can vary, with the largest one we've seen being an 18.5 MB UltimateTV ROM, boot ROMs, regardless of the hardware they were designed for, always seem to have a consistent 2 MB size.

For client software, since those are designed to be stored on non-volatile memory, the chips can be programmed to store different client software, usually for upgrades.

ROM Header

All firmware ROMs appear to have a header at the very start of the ROM that contain jump instructions pointing to the main code and information about the ROM itself. This header is 0x44 bytes long, and all integer values are packed in big-endian order:

Field Name Type Offset Description
Jump instruction uint32 0x00 MIPS jump instruction to build entry point. If this field has the value 0x10000000, the build has compressed code and data (usually at offset 0x200) that has to be decompressed with an algorithm specified later in the ROM header
"Pre-jump instruction" uint32 0x04 Another MIPS instruction(?). Usually this is just a NOP instruction
Code checksum uint32 0x08 Checksum of ROM code. eMac's WebTV/MSN TV Build Info Viewer program has code to generate these checksums, but we can't guarantee its accuracy
ROM length uint32 0x0c Length of ROM data, excluding ROMFS. Not exactly sure how this is calculated
Code length uint32 0x10 Length of ROM code?
ROM build number uint32 0x14 ROM build number
Heap data address uint32 0x18 Address of initial heap data in RAM
Heap data size uint32 0x1c Uncompressed size of initial heap data
"Heap free size" uint32 0x20 ???
ROMFS base address uint32 0x24 Base address for ROMFS data relative to the address specified in the "ROM base address" field. Also don't know how this is used. In UltimateTV client ROMs, this address is always set to 0x4e6f4653 (NoFS in ASCII)
"unknown1" uint32 0x28 In most builds, this value is either a string specifying a compression algorithm if the build is compressed, or nulled. Some ROMs, however (i.e., bf0app boot ROMs), use this field to store random data and don't have a clear purpose for doing so. Known algorithm strings used for unknown1 are lzj0, lzj1, and lzj2
"unknown2" uint32 0x2c ???
ROM base address uint32 0x30 A base address where the ROM is supposedly loaded into in RAM. Not sure if this contradicts the predefined load addresses mentioned earlier
Build flags uint32 0x34 Bitmask flag value that specifies what type of WebTV/MSN TV ROM was built. See Build Flags
Heap data compressed size uint32 0x38 Compressed size of initial heap data
Compressed code address uint32 0x3c If the ROM code is compressed, this specifies the address of the code relative to the address specified in "ROM base address" field
Compressed code size uint32 0x40 Compressed size of ROM code

Build Flags

Bitmask flags used for the build flags field in the ROM header.

  • 0x01: WebTV/MSN TV build can handle compressed heap data
  • 0x04: WebTV/MSN TV build is a debug build
  • 0x10: Assumed to mark a WebTV/MSN TV build as a Windows CE build. Appears in build flags for UltimateTV app ROMs
  • 0x20: Appears to mark a WebTV/MSN TV build as a satellite build. Appears in build flags for both DishPlayer boot ROMs and UltimateTV app ROMs


WebTV/MSN TV boxes have the ability to download upgrades to the client software from the WebTV/MSN TV network and install them onto themselves. These are known as flash upgrades, namely due to the fact that they're installed onto the flash ROM that boxes boot into. Even outside the realm of WTVP, we have next to no information on how the boxes handled actually installing these upgrades other than simply flashing them onto flash ROM. What we do know so far is that supposedly, these flash upgrades were organized by class of WebTV/MSN TV box, split into pieces, compressed, and digitally signed before being published onto the WebTV/MSN TV network [1]. WNI also had other fancy ways of classifying flash upgrades that for the time being won't be elaborated on here. We advise you to read this article by Andy McFadden instead to get a glimpse into how this was handled:


Before 2021, very little had been done to fully archive the client upgrade ROMs publicly. We are aware that someone operating a private third-party WebTV/MSN TV server had most of these available for download directly through the WebTV/MSN TV protocol supported by the server itself, so it's not like no one tried. Sadly, due to the server being completely private in nature and the difficulty of being able to reach out to the people involved with operating the server to get any missing upgrade ROMs, some of these ROM sets may never see the light of day, at least for a while. This might put them at the risk of being completely lost, and we already have enough to deal with right now concerning the preservation of WebTV/MSN TV information.

With the blessings of eMac and Zefie, however, we have been able to successfully preserve a great amount of builds of the WebTV/MSN TV client software and boot ROMs, which while supposedly only cover the stock (a.k.a. "artemis") versions of the ROMs, span several hardware types and are also available in both their upgrade (chunked) and complete forms. You can currently find these ROMs on This isn't the end of the story, though. There are obviously more builds that we have yet to see surface, and we've yet to see any samples of any vendor-specific (Sony, Philips, etc.) ROMs in any form. This is why we're actively seeking anyone who might have this data among other things so that we can not only obtain it, but document and publish it for future generations. If you have any complete ROM sets or anything else important on hand, don't hesitate to release them or send it over to us.

Hardware Classes

Hardware classes are identifiers that define the hardware components or general type a firmware ROM is compatible with. Aside from hardware classes bf0app and bfeapp, hardware classes usually specify the region, base type, storage medium, and memory size in megabytes it targets ({REGION}-{TYPE}-0MB-{MAX-MEGS}MB), with some specifying softmodem support and a particular CPU they target. Not everything about the hardware class has been figured out right now, but we have a good sense of how it works.

For a list of currently known hardware classes: List of WebTV (MSN TV) Hardware Classes


The WebTV/MSN TV service offered firmware ROMs in both stock (Artemis) and vendor-specific forms, the latter being designed for usage with boxes from authorized manufacturers. We aren't aware of any differences between stock ROMs and ROMs made for specific hardware vendors, nor are we aware of any place to obtain these vendor-specific ROMs knowing that no archive of any ROMs existed before we stepped up. If you happen to have any information on either, check out the Wanted page on the sidebar to see how you can help contribute.

In the meanwhile, we have a (very barren) list of vendor IDs we have been able to obtain and record here: List of WebTV (MSN TV) ROM Vendor IDs.