# GCC-4241N TSOP Transform Analysis

## Result

The historical GCC transform is **validated** against accurate A100 and A101
TSOP48 dumps.

For each 32-bit word assembled from file bytes in big-endian order:

```text
encrypted = permute32(plaintext XOR 0xA7A7A7A7, ENCRYPT_GCC)
plaintext = permute32(encrypted, DECRYPT_GCC) XOR 0xA7A7A7A7
```

The historical encryption map is:

```text
[22, 11, 3, 26, 30, 16, 1, 12, 10, 7, 31, 21, 5, 19, 13, 28, 2, 27, 8, 20, 29, 18, 4, 14, 25, 17, 23, 0, 6, 15, 24, 9]
```

Both A100 and A101 round-trip byte-exactly. The A101 derived plaintext SHA-256
is `2de556c33f0b3224ab75bfbb9e662a266e19ededb181ceb3b219723d3d523856`, matching the previously generated workspace
plaintext artifact.

## Revision Results

| Revision | Encrypted SHA-256 | Derived plaintext SHA-256 | Exact round trip |
|---|---|---|---|
| A100 | `b6b01b7bb0600d410f1e90ccca9d1e502370503c5c9c64efdac21982a5659c52` | `4a0e4d7d17e44918afb8846a2b61d2e4eb9ac7bfffe9169f4a09f44dad421830` | Pass |
| A101 | `3f75c85597e7b42cc015d754fedebb54da653ec7fd24475dd0cce17b607cd7ab` | `2de556c33f0b3224ab75bfbb9e662a266e19ededb181ceb3b219723d3d523856` | Pass |

The derived images contain coherent `GCC-4241N` A100/A101 identity strings.
The common encrypted word `E9055308` maps to plaintext `FFFFFFFF`, providing a
known-erased-word check.

## Failed Flash Pattern

The failed A101 TSOP image is byte-identical to the derived A101 plaintext:

- from `0x00000` through `0x03FFF`;
- from `0x08000` through `0x7FFFF`.

Only the 16 KiB window `0x04000-0x07FFF` differs, with 16,382
differing bytes. That window is close to the transformed/on-flash image but
contains 603 differences relative to the accurate A101 dump from another unit.

The best current interpretation is that the failed run programmed plaintext
bytes while preserving a drive-specific OEM/calibration window. Same-unit
before/after evidence would be required to identify every byte in that window.

## Important Pipeline Correction

The data do **not** support the historical AES-seed story. The transform is a
static XOR plus bit permutation. The failed image also demonstrates that the
custom flashing path used for that unit did not automatically convert the
plaintext stream into the valid on-flash representation.

This validates direct TSOP recovery with transformed bytes. It does not yet
prove whether the stock OEM updater performs the transform on the host or in
its uploaded RAM stub.

## Log Boundary

The log packaged beside the failed dump is not proven to describe the same
physical attempt: member timestamps differ and the log reports firmware tail
bytes `9333`, whereas the failed dump ends in `26D9`.
The log remains useful protocol evidence but is not used to infer the exact
failed-image write sequence.

## Remaining Questions

- exact checksum/footer algorithm;
- stock OEM transform location (host versus RAM stub);
- exact semantics and ownership of the preserved `0x04000-0x07FFF` window;
- whether every GCC revision uses the same transform constants.
