Hello together,
I'm looking for the addresses of the four block byte checksums of the 1BB and 1CC HP-28C ROM's.
In difference to the CRC checksums of the HP-28S, these are not at the end of each protected block. I confirmed this on a 28C-1CC ROM at address #0FFFF and #1FFFF. On both positions is valid assembler code, so there can't be two of the checksum addresses.
Regards
Christoph