Thanks for getting this and for the info about the last thing TT was doing before it happened, and sorry about your scripts! My thought was that the scene data structure is large enough that, if the out-of-bounds hypothesis above were correct, we would still have most of a scene written to an area of flash that should never be written to from the same write that trashed the âfreshâ field. If this were the case, I thought it might even be possible to recover the scripts saved to that scene, since theyâre in the last part of the scene data.
âŚBut it doesnât seem like this happened. After the calibration defaults, everything else in flash is 0xFF - flash bits are typically set to 1 when erased. So it doesnât seem like a bulk write did it, at least not off the end like that. If there was some other off-by-one condition I thought maybe the padding bytes used to align struct members could also wind up getting set, but those are 0xFF in this firmware image too.
So, sad to say after reading flash.c a half dozen more times, I got nothing. If itâs useful to anybody the âreplâ tool here is the program I used for sifting through the firmware image.