# Project Frankenstein: Volume XIV

## Seek State Machine & Physical LBA Translation

This volume provides the final architectural mapping required to implement Method B: Direct Read Bypass for the GCC-4241N. It details how to bypass the firmware's logical sector checks and command the BH6590KU driver to seek physically to the Xbox Security Sector [cite: 129_perfect_trampoline_v18.py, Volume XII: BH6590KU Driver & Servo Mapping].

## 1. The Seek State Machine (SRAM)

The drive tracks its current physical head position and movement state through a set of dedicated SRAM registers. Our payload must manipulate these to force a seek that the native logic would otherwise reject [cite: User Summary].

Property | SRAM Address | Description
--- | --- | ---
Target LBA Register | `0x40000B20` | Stores the 32-bit logical block address for the next seek operation.
Current LBA Register | `0x40000B24` | Stores the current physical position of the laser pickup.
Seek State Flag | `0x40000B28` | `0x00`: Idle; `0x01`: Seeking; `0x02`: Settling [cite: User Summary].

## 2. Physical LBA Translation (ROM 0x0002C450)

Natively, the firmware calls this routine to convert a Logical Block Address (LBA) into a Physical Block Address (PBA). This is where the LBA Walls are enforced [cite: 129_perfect_trampoline_v18.py].

### Method B: Direct PBA Injection

To bypass the walls at `0x3034E` and `0x2C2CC`, the hybrid payload does not call the translation routine. Instead, it manually populates the PBA registers for the BH6590KU controller with the physical coordinates of LBA `0x02FDFFFE` [cite: 129_perfect_trampoline_v18.py].

## 3. Seek Execution Handler (ROM 0x000382F0)

This is the "muscle" routine that physically moves the pickup head. It expects the target physical coordinates to already be loaded into address registers [cite: User Summary].

Register | Value for Xbox Security Sector | Description
--- | --- | ---
d0 | `0x02FDFFFE` | The hardcoded LBA for the Xbox Game Disc security data [cite: 129_perfect_trampoline_v18.py].
a0 | `0x000382F0` | The entry point for the physical seek execution routine.

## 4. Implementing the Method B Payload

This routine, stored in the RAM Cave at `0x40008800`, enables the `0xAD` Format Code `0xFE` command to read the security sector regardless of authentication state [cite: 129_perfect_trampoline_v18.py, Project_Frankenstein_Vol_VI_Addendum.html].

    ; MN103S Assembly: Method B Direct Seek
    ; Location: SRAM Cave 0x40008800
    Method_B_Direct_Seek:
        mov     0x02FDFFFE, d0  ; Force Xbox Security Sector LBA [cite: 129_perfect_trampoline_v18.py]
        mov     0x40000B20, a0  ; Point to Target LBA Register
        mov     d0, (a0)        ; Manually update state machine

        mov     0x000382F0, a1  ; Point to Native Seek Executor
        call    (a1)            ; Execute physical movement [cite: User Summary]

        ; After seek completes, trigger a raw 2,048-byte read
        mov     0x10C80040, a1  ; Destination: DRAM Security Mirror [cite: Project_Frankenstein_Vol_VI_Addendum.html]
        call    0x00039A10      ; Native Read Physical Sector routine

        ret

### Strategic Advantage

By using Method B, the hybrid firmware can verify if a disc is an original Xbox game even if the SHA1/RC4 handshake is not yet perfect. It allows the developer to physically confirm the presence of the security data using the `0xAD` Format `0xFE` command [cite: 129_perfect_trampoline_v18.py].