# Project Frankenstein: Volume V

## Command Reference & Vendor Extensions

This volume serves as the dictionary for the Hitachi GCC-4241N command set. It differentiates between the original factory commands and the high-level vendor extensions added by the Project Frankenstein payload to enable Xbox compatibility and diagnostic visibility [cite: User Summary, 129_perfect_trampoline_v18.py].

## 1. The Native Command Set (Legacy)

These commands exist in the stock firmware and are used primarily for factory deployment and standard PC operation [cite: gcc_hitachi_flasher.c, 4241N_Mechanical_Analysis.txt].

OpCode | Name | Type | Functionality
--- | --- | --- | ---
`0x1B` | START/STOP UNIT | Native | Standard ATAPI motor control. Handler at `0x14bc` [cite: 4241N_Mechanical_Analysis.txt].
`0x55` | MODE SELECT (10) | Native | Flash mode configuration and firmware chunk streaming [cite: gcc_hitachi_flasher.c].
`0x5A` | MODE SENSE (10) | Native | Polling for flash status and executing the "Ignition" command [cite: gcc_hitachi_flasher.c].
`0xE7` | UNLOCK KNOCK | Native | Responds to ASCII `HL-DT-ST` to open the bootloader [cite: gcc_hitachi_flasher.c].

## 2. The Frankenstein Extensions (Custom)

These commands are either hijacked native handlers or new entries in the Group 7 jump table [cite: 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

### OpCode `0xE7`: REPURPOSED MEMDUMP

Custom Extension

While natively used as a bootloader knock, our payload hooks the Group 7 Jump Table at `0x72282` to redirect this opcode to `0x40008200` [cite: 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

- CDB[2-5]: 32-bit Memory Address (Big Endian)
- CDB[7-8]: Transfer Length
- Result: Dumps internal ROM/RAM/SRAM directly to the SCSI bus [cite: User Summary].

### OpCode `0xAD`: XBOX HANDSHAKE + SECURITY DUMP

Modified Handler

Hooked at `0x30249`. We augment the standard `Read DVD Structure` command to handle console security [cite: 129_perfect_trampoline_v18.py].

- Format Code `0xC0`: Returns the 2,048-byte Security Sector response to the Xbox kernel [cite: 129_perfect_trampoline_v18.py].
- Format Code `0xFE` (Method B): Forces a physical laser seek to LBA `0x02FDFFFE` and returns the raw security data, bypassing all LBA walls [cite: 129_perfect_trampoline_v18.py].

### OpCode `0x5A`: XBOX CHALLENGE PAGE

Modified Handler

Hooked at `0x27198`. Redirects `Mode Sense (10)` to the payload when the Xbox security page is requested [cite: 129_perfect_trampoline_v18.py].

- Page Code `0x3E`: Captures the 20-byte random challenge from the console and triggers the SHA1/RC4 calculation [cite: 129_perfect_trampoline_v18.py].

## 3. The Hardware Shim (Mechanical Modification)

These are not new commands, but a complete behavioral override of the native `0x1B` handler at `0x14bc` [cite: 4241N_Mechanical_Analysis.txt].

Native Byte | Original Behavior | Hybrid Behavior
--- | --- | ---
CDB[4] Bit 0 (Start) | Stop spindle on idle timeout. | Persistent Spindle: Bypasses stop command if SRAM flag `0x2CC` is set [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].
CDB[4] Bit 1 (LoEj) | Open/Close physical tray. | Auth Reset: Clears security flags at `0x2CC` and zeros DRAM buffers before tray movement [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].

### Missing Technical Volume Recommendation

To reach a state of 100% completion, the following volume is missing from the archive:

- Volume VI: Memory & Buffer Map: A detailed layout of the DRAM Buffers (`0x10C80000` and `0x10CC0000`) showing exactly where the 20-byte challenge is cached vs. where the 2,048-byte response is staged [cite: 129_perfect_trampoline_v18.py].
- Volume VII: Instruction Set Architecture (ISA) Reference: A cheat sheet for MN103S Opcodes (e.g., `btst`, `movbu`, `call`) to assist in modifying the assembly without a constant manual reference [cite: User Summary].