Where is hidden the VRAM?
Please note that we are dealing here with the metal. There is no lower level than this. This is risky to use those information. Well, I don't think you risk anything but loosing your data, so backup befor trying anything.
The MQ video chip is mapped on the Clie central memory. That means an area of the Clie RAM correspond to the videochip RAM. To make a long story short: acessing to memory between two specific adresses allow you to access the VRAM.
This sheme (from the MQ1100 official doc) describes how the VRAM is mapped onto the RAM.

As you can see, 512Kb of RAM is used for this purpose. But it doesn't mean you can use so much RAM.
First you can see the mapping is described for adress xxx00000 (Base adress) to xxx80000. Well, let me spoil the suspens, xxx on the Clie is 0x1F0. That means the MQ is mapped from 0x1F000000 to 0x1F07FFFF. Beware, this value can change at any version of the OS or Sony library or version of the Clié. I got this adress on a N760c.
How to be sure you have the right Base adress? Simple. In your main loop you start your rendering (draw of the new image) section with the instruction
offscreenAdress= WinScreenLock(winLockDontCare);
(see the article about Page Flipping for more information)
it returns a UInt32 adress.
mask the 20 less significant bits and you get the base adress

Let's get closer to this screens buffer area. It is divided into 3 zones. 2 are used for the 2 screen buffers. So we have
0x000000 - 0x018FFF : first screen buffer (320x320 bytes)
0x019000 - 0x031FFF : second screen buffer (320x320 bytes)
0x032000 - 0x03FFFF : the twilight zone.
Ok, there is an area of 56Kb totally undocumented. Don't forget the MQ chip is a generic chip. It may be ready for other resolutions. Whatever, this area should be available to store extra information. Don't forget that VRAM to VRAM movement are faster than light. This would be a nice place to store a 256x224 sprite for instance. I still have to test this, so don't take it for granted.

The registers area is also mapped. The registers are used to dialog with the MQ, pass parameters and modify colors. This will be detailed in another article.

from 0x420000 and further is another area, about 504Kb. This is used for USB buffers but I don't know what to do with it. This may be useful to hack the USB connection of the Clie, but this may be another story.

WM.