# Project Frankenstein: Volume XV

## Interrupt Vector Table & Jump Tables

This volume provides the structural mapping of the firmware's dispatchers. It covers the Interrupt Vector Table (IVT) for hardware stability and the primary SCSI Jump Tables required for command redirection and hybrid logic injection [cite: User Summary, 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

## 1. The Interrupt Vector Table (IVT)

The IVT resides at the very beginning of the 512KB binary. It manages the CPU's response to asynchronous hardware events. For a stable RAM Cave payload, these vectors must be respected to prevent timing collisions during SHA1/RC4 calculations [cite: User Summary, Volume X: Crypto Engine Analysis].

Vector Name | ROM Offset | Description / Hybrid Relevance
--- | --- | ---
Reset Vector | `0x00000000` | Initial entry point; performs cold boot and register initialization.
Timer Interrupt | `0x00000008` | Drives the servo loop; may need to be suppressed during hash generation [cite: User Summary].
SCSI Bus IRQ | `0x00000010` | Triggered when a new Command Descriptor Block (CDB) arrives at `0x840`.
External IRQ | `0x00000018` | Used for tray sensor monitoring (Auth Reset trigger) [cite: 4241N_Mechanical_Analysis.txt].

### Theory: Suppressing Interrupts

The MN103S Program Status Word (psw) can be manipulated to mask interrupts during critical security handshakes. This prevents the "jitter" caused by the servo loop from corrupting the 160-bit SHA1 digest [cite: Volume X: Crypto Engine Analysis].

## 2. Command Dispatcher Jump Tables

The 4241N firmware uses a set of jump tables to route incoming SCSI commands to their respective handlers. Modifying these is the primary method for injecting hybrid logic [cite: 4241N_Corrected_Jump_Table.txt, 129_perfect_trampoline_v18.py].

### Group 0 Jump Table (Standard Commands)

Base Offset: `0x721E6` [cite: 4241N_Corrected_Jump_Table.txt]

OpCode | Target Offset | Handler Description
--- | --- | ---
`0x00` | `0x721E6` | Test Unit Ready (TUR) [cite: gcc_hitachi_flasher.c].
`0x1B` | `0x7222E` | Mechanical / Spindle Control (Hybrid Hook Point) [cite: 4241N_Mechanical_Analysis.txt].

### Group 7 Jump Table (Vendor Commands)

Base Offset: `0x72266` [cite: 4241N_Corrected_Jump_Table.txt]

OpCode | Target Offset | Frankenstein Implementation
--- | --- | ---
`0xE7` | `0x72282` | Vendor Memdump: Pointed to `0x40008200` [cite: 129_perfect_trampoline_v18.py].
`0xEE` | TBD | Peek: Recommended entry for memory reading [cite: pp_win.c].
`0xEF` | TBD | Poke: Recommended entry for memory writing [cite: pp_win.c].

## 3. Mode Page Table (OpCode $5A)

The Mode Sense (10) command at `0x27198` uses a dedicated table to dispatch mode pages. This is where we catch the Page Code 0x3E console challenge [cite: 129_perfect_trampoline_v18.py].

Page Code | Table Offset | Description
--- | --- | ---
`0x01` | `0x271B0` | Read/Write Error Recovery Page.
`0x3E` | `0x271E0` | Xbox Security Challenge Page (Hybrid Hook Point) [cite: 129_perfect_trampoline_v18.py].

## 4. CDB Length Table

Used by the SCSI interrupt handler to validate that the incoming command has the correct number of bytes (6, 10, or 12) before processing [cite: gcc_hitachi_flasher.c].

    ; CDB Length Validation Table (ROM)
    Offset 0x72000: 06 06 06 06 06 06 06 06 ... (Group 0: 6 Bytes)
    Offset 0x72020: 0A 0A 0A 0A 0A 0A 0A 0A ... (Group 1: 10 Bytes)
    Offset 0x72040: 0C 0C 0C 0C 0C 0C 0C 0C ... (Group 2: 12 Bytes)