From 2e8dc8e8100a2e8bcad4dd2714b0c7ff5c1cf413 Mon Sep 17 00:00:00 2001
From: Luxferre <3335173-suborg@noreply.users.gitlab.com>
Date: Thu, 30 Jul 2020 18:19:09 +0300
Subject: [PATCH] Simplified the structure by moving to the mapping mode 2 from
 mapping mode 3

---
 README.md   | 2 +-
 mtreader.py | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index a20a826..eb33838 100644
--- a/README.md
+++ b/README.md
@@ -66,7 +66,7 @@ It's a key that you hold to open the BROM serial port. It depends on the vendor.
 
 ### How is the tool working without a DA binary?
 
-Yes, MTreader used a DA in the past, but now it's completely blob-free (and this allowed to move it to the [public domain](./UNLICENSE)) and works via BROM itself. The trick is in using the correct mapping register setting: when we set the 32-bit value at the `0xa0510000` to 3, all the ROM contents (in 32-bit little-endian chunks) are mapped onto `0x10000000` base address by the MT626x chipset itself.
+Yes, MTreader used a DA in the past, but now it's completely blob-free (and this allowed to move it to the [public domain](./UNLICENSE)) and works via BROM itself. The trick is in using the correct mapping register setting: when we set the 32-bit value at the `0xa0510000` to 2, all the ROM contents (in 32-bit little-endian chunks) are mapped onto zero base address by the MT626x chipset itself.
 
 ### Where was information collected from?
 
diff --git a/mtreader.py b/mtreader.py
index dfbb73c..0f20681 100644
--- a/mtreader.py
+++ b/mtreader.py
@@ -65,13 +65,12 @@ class MTreader:
         self.write16(0xa0030000, 0x2200) # disable system watchdog
         self.write16(0xa0700a28, 0x8000) # enable USB download mode
         self.write16(0xa0700a24, 2) # disable battery watchdog
-        self.write32(0xa0510000, 3) # enter memory map mode 3
-        # now all flash is mapped as little-endian 32-bit chunks at 0x10000000
+        self.write32(0xa0510000, 2) # enter memory map mode 2 to map ROM from the start of RAM
 
     def read_flash(self, outfile, start, size, blk_size=1024):
         outf = open(outfile, 'wb')
         offset = 0
-        addr = 0x10000000 + start
+        addr = start
         while size > 0:
             rsize = min(size, blk_size)
             chunk = self.read32(addr, rsize>>2, '<')