# Project Frankenstein: Volume VI

## Memory & Buffer Layout

This volume provides the physical and logical memory mapping for the GCC-4241N recipient. Understanding these regions is essential for managing the flow of authentication data and ensuring the 8050L donor logic interacts correctly with the drive's internal hardware [cite: User Summary, 129_perfect_trampoline_v18.py].

## 1. Global Memory Map (MN103S VMA)

The 4241N firmware operates across three primary hardware memory regions. Our custom logic must navigate these boundaries without causing bus contention [cite: User Summary, 129_perfect_trampoline_v18.py].

Region | Address Range | Physical Type | Usage
--- | --- | --- | ---
ROM (Firmware) | `0x00000000 - 0x0007FFFF` | Flash / EEPROM | Standard operating logic and MN103S instructions.
SRAM (Internal) | `0x40000000 - 0x40008EFC` | Static RAM | High-speed scratchpad, flags, and our RAM Cave [cite: 129_perfect_trampoline_v18.py].
SDRAM (External) | `0x10C00000 - 0x10CFFFFF` | Dynamic RAM | Large data buffers for SCSI transfers and handshake staging [cite: 129_perfect_trampoline_v18.py].

## 2. Handshake Staging: The DRAM Buffers

The drive uses external SDRAM to "stage" the security response. The host requests these specific memory locations via the `0xC0` handshake command [cite: 129_perfect_trampoline_v18.py].

### Buffer A: Primary Response (`0x10C80000`)

- Offset 0x00 - 0x13: Stores the 20-byte challenge received from the Host (Xbox Console) [cite: 129_perfect_trampoline_v18.py].
- Offset 0x14 - 0x27: Destination for the SHA1/RC4 calculated hash [cite: User Summary, 129_perfect_trampoline_v18.py].
- Offset 0x40 - 0x83F: Buffer for the raw 2,048-byte Security Sector data read from LBA `0x02FDFFFE` [cite: 129_perfect_trampoline_v18.py].

### Buffer B: Secondary Cache (`0x10CC0000`)

- Used for alternate response formats or extended handshake diagnostics [cite: 129_perfect_trampoline_v18.py].

## 3. Critical Status Flags (SRAM Scratchpad)

Status flags track the drive's current security state. Our payload must manipulate these to enable "Xbox Mode" features [cite: 129_perfect_trampoline_v18.py].

Flag Address | Context | Logic Behavior
--- | --- | ---
`0x2CC` | 4241N Hybrid | Used by the RAM Cave payload to signal "Media Authorized" [cite: 129_perfect_trampoline_v18.py].
`0x5DB` | 8050L Donor | The original donor flag used to bypass LBA restrictions and persistent spindle [cite: User Summary].
`0x840` | CDB Cache | The standard MN103S location where the last-received 6/10/12 byte SCSI command is stored.

### Theory of Data Flow: The Challenge Cycle

A successful handshake follows a specific movement through these memory regions:

1. Arrival: Console sends a 20-byte challenge. It is cached in the CDB Cache at `0x840`.
2. Staging: The 4241N payload hooks `0x5A` and copies the challenge to DRAM Buffer A (`0x10C80000`).
3. Calculation: The SHA1/RC4 donor routines read from the staging buffer and write the result back to `0x10C80014` [cite: User Summary].
4. Verification: The console requests the data via `0xAD`. The drive serves 2,048 bytes starting from `0x10C80000`.

## 4. The RAM Cave Layout (`0x4000807A`)

Our payload is physically located at the very end of the internal SRAM map [cite: 129_perfect_trampoline_v18.py].

    0x4000807A: [ Entry Point / Mode Sense Hook ]
    0x40008200: [ Vendor Memdump (0xE7) Handler ]
    0x40008350: [ Mechanical / Spindle Hook ]
    0x40008500: [ SHA1 / RC4 Math Engine ]
    0x40008F00: [ SRAM END / STACK BEGIN ]