Below is a disassembly of B_CALL 5092h, which will call RecAByteIO and then save it to a specified address and page (only in user space). You can look up where "call RecAByteIO" is on every OS version and call it with the byte you want in A and other memory areas set up as per http://www.brandonw.net/calcstuff/flashwrite.txt. seg001:4289 receiveRestOfDataPacket: ; CODE XREF: receiveDataPacket+1Bj seg001:4289 ; receiveDataPacket+2Cj ... seg001:4289 ld bc, (header+2) seg001:428D ld de, 0 seg001:4290 ld (header+4), de seg001:4294 ld a, c seg001:4295 or b seg001:4296 jr z, loc_42E6 seg001:4298 ld hl, pagedBuf seg001:429B ld (pagedGetPtr), hl seg001:429E xor a seg001:429F ld (pagedCount), a seg001:42A2 ld hl, (iMathPtr5) seg001:42A5 seg001:42A5 receive_loop: ; CODE XREF: receiveDataPacket+84j seg001:42A5 call _CHKERRBREAK seg001:42A8 jp nz, _JErrorNo seg001:42AB push bc seg001:42AC call RecAByteIO seg001:42AF bit 7, h seg001:42B1 jr nz, loc_42CB seg001:42B3 push hl seg001:42B4 ld hl, (pagedGetPtr) seg001:42B7 ld (hl), a seg001:42B8 inc hl seg001:42B9 ld (pagedGetPtr), hl seg001:42BC pop hl seg001:42BD ld a, (pagedCount) seg001:42C0 inc a seg001:42C1 ld (pagedCount), a seg001:42C4 cp 10h seg001:42C6 call z, saveByteDirectlyToFlash seg001:42C9 jr loc_42CD seg001:42CB ; --------------------------------------------------------------------------- seg001:42CB seg001:42CB loc_42CB: ; CODE XREF: receiveDataPacket+59j seg001:42CB ld (hl), a seg001:42CC inc hl seg001:42CD seg001:42CD loc_42CD: ; CODE XREF: receiveDataPacket+71j seg001:42CD ex de, hl seg001:42CE ld b, 0 seg001:42D0 ld hl, (header+4) seg001:42D3 add hl, bc seg001:42D4 ld (header+4), hl seg001:42D7 ex de, hl seg001:42D8 pop bc seg001:42D9 dec bc seg001:42DA ld a, b seg001:42DB or c seg001:42DC jp nz, receive_loop seg001:42DF ld a, (pagedCount) seg001:42E2 or a seg001:42E3 call nz, saveByteDirectlyToFlash seg001:42E6 seg001:42E6 loc_42E6: ; CODE XREF: receiveDataPacket+3Ej seg001:42E6 call RecAByteIO seg001:42E9 push af seg001:42EA call RecAByteIO seg001:42ED ld b, a seg001:42EE pop af seg001:42EF call checkChecksumMaybeSend5Ah seg001:42EF ; End of function receiveDataPacket seg001:42EF seg001:42F2 seg001:42F2 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ seg001:42F2 seg001:42F2 seg001:42F2 sendAcknowledge: ; CODE XREF: sendSkipExitPacket:loc_4073p seg001:42F2 ; seg001:4554p ... seg001:42F2 call HeaderToBakHeader seg001:42F5 ld hl, 0 seg001:42F8 seg001:42F8 loc_42F8: ; CODE XREF: seg001:505Ap seg001:42F8 ld (word_8676), hl seg001:42FB call machineIDtoL seg001:42FE ld h, 56h ; 'V' seg001:4300 ld (header), hl seg001:4303 call Send4Bytes seg001:4303 ; End of function sendAcknowledge seg001:4303 seg001:4306 seg001:4306 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ seg001:4306 seg001:4306 seg001:4306 bakHeaderToHeader: ; CODE XREF: sendSkipExitPacket+123p seg001:4306 ; seg001:4618p ... seg001:4306 ld hl, bakHeader seg001:4309 ld de, header seg001:430C seg001:430C jpMov9B: ; CODE XREF: HeaderToBakHeader+6j seg001:430C jp _Mov9B seg001:430C ; End of function bakHeaderToHeader