Looking to hack MP3 player -- how do I find the display address?

As a bit of a different question than my usual ones, I thought it would be an interesting project to hack an old MP3 player I have to see if I could get some custom code running on it just for fun. The processor is a Motorola DSP56004, and I've found an assembly reference guide for it.

My problem though is how to begin. I can compile code and load onto the player (using its firmware update program), but I don't know how to find the LED hardware's address/port. I read all the time about people flashing firmware out of various devices using an LED, but how do you find the correct address -- moreover what sort of format 开发者_开发百科the data sent to it must be in?

So far I've tried writing a loop that goes through all memory address (I assume one is probably mapped to the display hardware) and writes random bytes to it to see if I can get it to light up, but no luck so far.

Any ideas?

Just poking in memory randomly can be quite dangerous. Since you have the firmware update, I assume you can extract the original code from it. I would suggest you to disassemble that code and identify routines which write to GPIO ports. One of them will likely be the LED. The hardware addresses to look for can be found in the DSP56004 User's Manual.