--- In BoschDME@yahoogroups.com, "Weston Pawlowski" <WestonP22@...> wrote:
>
> Excellent. Thank you! That was a great starting point. I looked at code that
was calling the function that you listed, and that led me to find the variant
pointers that start at 0x1090, which specify the map pointer's offset from
0x11E0.

I think this is already documented somewhere here. The R2 stored index to the
table is used in TabIdx (0x1090). That gives you the index to the address table
TabAdr at 0x11E0. The lsb of the second index indicates the format of the table.

The location of TabIdx and TabAdr is the same in all versions of the 944 ML3.1
code. But at some places the code changed significantly so the R2 stored index
is not the same for all versions.