@echo off
setlocal EnableExtensions

REM v118: sidecar-backed first Xbox auth packet probes using the sequential
REM source-stream data-in model plus the new centralized GDR hardware MMIO
REM model for DC54/DC55 timer reads and D904/D905 packet status reads.
REM
REM Usage:
REM   run_gdr8050l_auth_packet_v118_hw_timer_model.cmd D:\path\game.xdvd.json [D:\path\game.iso]

if "%~1"=="" (
  echo Usage: %~nx0 D:\path\game.xdvd.json [D:\path\game.iso]
  exit /b 2
)

set "XDVD_JSON=%~1"
set "ISO_FLAGS="
if not "%~2"=="" set "ISO_FLAGS=--iso "%~2""

set "WORKSPACE=D:\vscode-workspace\xbox-dvd-tools-v2"
set "FWBIN=D:\vscode-workspace\xbox-dvd-tools-v2\firmware\GDR-8050L\8050L_fw_plaintext_256k.bin"

echo [V118] XDVD sidecar: %XDVD_JSON%
if not "%~2"=="" echo [V118] ISO metadata: %~2

REM ---------------------------------------------------------------------------
REM Probe 1: MODE SENSE(10), page 0x3E, locked state.  This should still
REM reconstruct the full 28-byte sidecar payload exactly, but DC54/DC55 and
REM D904/D905 are now supplied by the v118 GDR hardware model instead of legacy
REM read overrides.
REM ---------------------------------------------------------------------------
python run_direct_firmware.py ^
  --workspace "%WORKSPACE%" ^
  --bin "%FWBIN%" ^
  --base 0x90000000 ^
  --entry 0x90000020 ^
  --model GDR-8050L ^
  --name "GDR-8050L v118 MODE SENSE 3E locked hw timer model" ^
  --max-cycles 120000 ^
  --sp 0x003FF000 ^
  --preset gdr8050l-packet-full-cdb ^
  --packet-cdb mode-sense-auth-xbox ^
  --xdvd-sidecar "%XDVD_JSON%" ^
  --xdvd-state locked ^
  %ISO_FLAGS% ^
  --packet-data-in-source-mode stream ^
  --packet-data-in-model-match-len 8 ^
  --gdr-hw-model ^
  --auth-watch ^
  --trace-csv gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_trace.csv ^
  --trace-summary ^
  --config-out gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_config.json ^
  > gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer.output.txt 2^>^&1

if errorlevel 1 goto fail_mode_sense

python analyze_gdr8050l_v109_readcap_route.py ^
  gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_trace.csv ^
  --out gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_summary.md

python extract_gdr_handshake.py ^
  gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_trace.csv ^
  --out-json gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_handshake.json ^
  --config gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_config.json ^
  --out-df70 gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_df70_all.bin ^
  --out-df70-after-packet gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_df70_after_packet.bin

python analyze_gdr_chunked_data_in.py ^
  gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_trace.csv ^
  --config gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_config.json ^
  --out gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_verify.md ^
  --out-payload gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_payload_reconstructed.bin

if errorlevel 1 goto fail_mode_verify

REM ---------------------------------------------------------------------------
REM Probe 2: READ DVD STRUCTURE Xbox auth CDB (AD ... C0), locked state.
REM ---------------------------------------------------------------------------
python run_direct_firmware.py ^
  --workspace "%WORKSPACE%" ^
  --bin "%FWBIN%" ^
  --base 0x90000000 ^
  --entry 0x90000020 ^
  --model GDR-8050L ^
  --name "GDR-8050L v118 READ DVD STRUCTURE auth hw timer model" ^
  --max-cycles 180000 ^
  --sp 0x003FF000 ^
  --preset gdr8050l-packet-full-cdb ^
  --packet-cdb read-dvd-structure-xbox ^
  --xdvd-sidecar "%XDVD_JSON%" ^
  --xdvd-state locked ^
  %ISO_FLAGS% ^
  --packet-data-in-source-mode stream ^
  --packet-data-in-model-match-len 8 ^
  --gdr-hw-model ^
  --auth-watch ^
  --trace-csv gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_trace.csv ^
  --trace-summary ^
  --config-out gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_config.json ^
  > gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer.output.txt 2^>^&1

if errorlevel 1 goto fail_ad

python analyze_gdr8050l_v109_readcap_route.py ^
  gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_trace.csv ^
  --out gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_summary.md

python extract_gdr_handshake.py ^
  gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_trace.csv ^
  --out-json gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_handshake.json ^
  --config gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_config.json ^
  --out-df70 gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_df70_all.bin ^
  --out-df70-after-packet gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_df70_after_packet.bin

python analyze_gdr_chunked_data_in.py ^
  gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_trace.csv ^
  --config gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_config.json ^
  --out gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_verify.md ^
  --out-payload gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_payload_reconstructed.bin

if errorlevel 1 goto fail_ad_verify

echo [OK] v118 GDR hardware timer/status model probes complete.
echo [NEXT] Send *_v118_*output.txt, *_v118_*summary.md, *_v118_*handshake.json, and *_v118_*verify.md.
exit /b 0

:fail_mode_sense
echo [FAIL] v118 MODE SENSE 3E hw-timer probe failed. Send gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer.output.txt
exit /b 1

:fail_mode_verify
echo [FAIL] v118 MODE SENSE 3E verification failed. Send gdr8050l_auth_v118_mode_sense_3e_locked_hw_timer_verify.md
exit /b 1

:fail_ad
echo [FAIL] v118 READ DVD STRUCTURE AD hw-timer probe failed. Send gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer.output.txt
exit /b 1

:fail_ad_verify
echo [FAIL] v118 READ DVD STRUCTURE AD verification failed. Send gdr8050l_auth_v118_read_dvd_structure_ad_hw_timer_verify.md
exit /b 1
