Right on the money. I eventually backed into these addresses by looking as the Philips ISP misc. write and read functions where you can write and read UCFG1 and the other SFRs, one of the bytes sets a value corresponding to the register you want. I knew that UCFG1 was at 0xFFF0, so I translated the others and guessed right. I just tried them in my source code and the proper values were set in the programmer.