VRAM ADDR from code

550D 1.0.9:

int i;
unsigned int *bmp_ram_addr = bmp_vram_info;
for (i=0; i<2; i++)
  DebugMsg( DM_MAGIC, 3, "bmp_vram[]=0x%08x, 0x%08x, 0x%08x", 
    bmp_ram_addr[3*i+0],  bmp_ram_addr[3*i+1], bmp_ram_addr[3*i+2] );
unsigned int *vram_info_addr = vram_info;
for (i=0; i<3; i++)
  DebugMsg( DM_MAGIC, 3, "vram_info[]=0x%08x, w=%4d, h=%4d, p=%4d, n=%4d",
      vram_info_addr[5*i+0],  vram_info_addr[5*i+1], 
      vram_info_addr[5*i+2], vram_info_addr[5*i+3], vram_info_addr[5*i+4] );
unsigned int *stateobj_disp = 0x23D8+0x90; // see FF05DAF8 SetBitmapVramAddress
    DebugMsg( DM_MAGIC, 3, "stateobj_disp+0xb0[]=0x%08x,0x%08x,0x%08x,", 
    stateobj_disp[0], stateobj_disp[1], stateobj_disp[2]);

produced this:

2109:  9760.005 [MAGIC] bmp_vram[]=0xc0f140d0, 0x00000000, 0x02087100
2110:  9760.045 [MAGIC] bmp_vram[]=0xc0f140d4, 0x00000000, 0x02087100
2111:  9760.082 [MAGIC] vram_info[]=0x40d07800, w= 720, h= 720, p= 480, n=   2
2112:  9760.116 [MAGIC] vram_info[]=0x4c233800, w= 720, h= 720, p= 480, n=   0
2113:  9760.149 [MAGIC] vram_info[]=0x4f11d800, w= 720, h= 720, p= 480, n=   0
2114:  9760.194 [MAGIC] stateobj_disp+0xb0[]=0x42080008,0x40d07800,0x40958c3c,

See SetBitmapVramAddress

ROM:FF05DAF8 SetBitmapVramAddress
ROM:FF05DAF8    STMFD   SP!, {R4-R6,LR}
ROM:FF05DAFC    LDR     R4, =0x23D8
ROM:FF05DB00    ADR     R2, aSetbitmapvramaddressPbitmap_addr ; "SetBitmapVramAddress pBitmap_Address=%x"...
ROM:FF05DB04    LDR     R3, [R4,#0x90]

600D 1.0.1

this code

int i;
unsigned int *bmp_ram_addr = bmp_vram_info;
for (i=0; i<2; i++)
  DebugMsg( DM_MAGIC, 3, "bmp_vram[]=0x%08x, 0x%08x, 0x%08x", 
    bmp_ram_addr[3*i+0],  bmp_ram_addr[3*i+1], bmp_ram_addr[3*i+2] );
unsigned int *vram_info_addr = vram_info;
for (i=0; i<3; i++)
  DebugMsg( DM_MAGIC, 3, "vram_info[]=0x%08x, w=%4d, h=%4d, p=%4d, n=%4d",
      vram_info_addr[5*i+0],  vram_info_addr[5*i+1], 
      vram_info_addr[5*i+2], vram_info_addr[5*i+3], vram_info_addr[5*i+4] );
unsigned int *stateobj_disp = 0x23DC+0xb0; // see FF062CEC SetBitmapVramAddress
DebugMsg( DM_MAGIC, 3, "stateobj_disp+0xb0[]=0x%08x,0x%08x,0x%08x,", 
  stateobj_disp[0], stateobj_disp[1], stateobj_disp[2]);

produced this

629: 28499.078 [MAGIC] bmp_vram[0]=0xc0f140d0, 0x00000000, 0x02087100
630: 28499.124 [MAGIC] bmp_vram[1]=0xc0f140d4, 0x00000000, 0x02087100
631: 28499.161 [MAGIC] vram_info[0]=0x40d07800, w= 720, h= 720, p= 480, n=   1
632: 28499.198 [MAGIC] vram_info[1]=0x4c233800, w= 720, h= 720, p= 480, n=   0
633: 28499.233 [MAGIC] vram_info[2]=0x4f11d800, w= 720, h= 720, p= 480, n=   0
634: 28499.279 [MAGIC] stateobj_disp+0xb0={0x42080008,0x4c233800,0x40a82a14}

See SetBitmapVramAddress

ROM:FF062CEC SetBitmapVramAddress                   
ROM:FF062CEC   STMFD   SP!, {R4-R6,LR}
ROM:FF062CF0   LDR     R4, =0x23DC
ROM:FF062CF4   ADR     R2, aSetbitmapvramaddress ; "SetBitmapVramAddress pBitmap_Address=%x"...
ROM:FF062CF8   LDR     R3, [R4,#0xB0]

DisplayState stateobject is created here

ROM:FF065A50 sub_FF065A50     CODE XREF: InitializeDisplayDeviceController+A0
ROM:FF065A50
ROM:FF065A50 var_10          = -0x10
ROM:FF065A50
ROM:FF065A50                 STMFD   SP!, {R3-R5,LR}
ROM:FF065A54                 MOV     R3, #4
ROM:FF065A58                 LDR     R4, =0x23DC
ROM:FF065A5C                 STR     R3, [SP,#0x10+var_10]
ROM:FF065A60                 LDR     R0, [R4]
ROM:FF065A64                 LDR     R2, =dword_FF570494
ROM:FF065A68                 MOV     R3, #0x1C
ROM:FF065A6C                 MOV     R1, #0
ROM:FF065A70                 BL      create_state_obj