basically if the security bits are not set, you can switch the EA pin "on-the-fly" for most of the 80C51 parts. Its the same basic idea. You shadow the bootcode into the internal user space using ENBOOT=1. Then you execute a jump to FC00h. But, in this case we just need some logic that switches the EA pin at the correct time. So lets say we have those two instructions in memory.... address 0000h to 0002h contain the ORL AUXR,#20h instruction (3 bytes). The next three bytes, from addresses 0003h to 0005h contain the LJMP FC00h code. The next byte will be at address 0006h. We don't care what's in here, BUT, it will be fetched! Why? One of the things I learned a long time ago, from a chip designer, is that the 8051 core fetches instruction in groups of two. A three byte instruction will fetch fetch four bytes and simply not use the fourth byte. So what we need to do is detect when the end of our third byte of the LJMP has been fetched and simply switch the EA pin to EA=1. We can use the rising edge of PSEN/ and the address = 0005h to tell us that the third byte of the LJMP has been fetch. So lets use a f/f with a clear input. All the ones that I have seen are active low clears. We need this to be cleared by power on reset and otherwise not drive the clear. So connect a wire from the RSt pin to the input of an inverter. Connect the output of the inverter to the CLR/ input of a f/f. Connect the D-input of the f/f to a "1" (pull it up). Connect the Q output of the f/f to the EA/ pin of the MCU. Using AND gates the clock input to the f/f = A0*(A1/)*A2*(PSEN/), so that only when the address = xxxx xxxx x110 and PSEN/ pulses from low to high at the end of the fetch of the third byte, will the f/f get clocked and drive the EA/ high. Once it switches to external memory we shouldn't see any more pulses on PSEN. Even if the f/f gets clocked again for some reason we don't care 'cause we already said "make my PC=FC00h!". Anyone want to try it? Anyone have time?