HP-28C ROM checksum addresses?

[Christoph Giesselink]

Hello together,

I'm looking for the addresses of the four block byte checksums of the 1BB and 1CC HP-28C ROM's.

In difference to the CRC checksums of the HP-28S, these are not at the end of each protected block. I confirmed this on a 28C-1CC ROM at address #0FFFF and #1FFFF. On both positions is valid assembler code, so there can't be two of the checksum addresses.

Regards

Christoph