# Project Frankenstein: Volume XI

## MN103S Instruction Set Architecture (ISA) Reference

This volume serves as a technical reference for the Matsushita/Panasonic MN103S (MN10300) assembly language as utilized in the LG/Hitachi GCC-4241N hybrid firmware. It provides a "cheat sheet" for the registers, common instructions, and addressing modes required to write and maintain the RAM Cave payload [cite: User Summary].

## 1. Register Architecture

The MN103S is a 32-bit architecture with a distinct separation between data and address registers. [cite: User Summary]

Register | Type | Typical Usage in Project Frankenstein
--- | --- | ---
`d0 - d3` | Data (32-bit) | Arithmetic, bit manipulation, and temporary storage for SCSI payloads. [cite: User Summary]
`a0 - a3` | Address (32-bit) | Pointers to memory VMAs (e.g., SRAM 0x4000807A or DRAM 0x10C80000). [cite: User Summary, 129_perfect_trampoline_v18.py]
`sp` | Stack Pointer | Standard subroutine management (pointing to 0x40008F00). [cite: Project_Frankenstein_Vol_VI_Addendum.html]
`psw` | Program Status Word | Condition codes (Zero, Carry, Negative, Overflow).

## 2. Core Instruction Set

The following mnemonics represent the most critical instructions for the hybrid firmware logic. [cite: User Summary]

### Data Movement

Mnemonic | Description | Example
--- | --- | ---
`mov` | Move 32-bit value | `mov 0x1234, d0` (Immediate to Data) [cite: User Summary]
`movbu` | Move Byte Unsigned | `movbu (a0), d0` (Load byte from memory to register) [cite: User Summary]
`movhu` | Move Half-word Unsigned | `movhu (a0), d0` (Load 16-bit value) [cite: User Summary]

### Bit Manipulation & Logic

Mnemonic | Description | Example
--- | --- | ---
`btst` | Bit Test | `btst 0, (4,a1)` (Test bit 0 of Spindle Start/Stop) [cite: 4241N_Mechanical_Analysis.txt]
`bset` | Bit Set | `bset 3, (a0)` (Set bit in a register) [cite: User Summary]
`bclr` | Bit Clear | `bclr 7, (a0)` (Clear bit) [cite: User Summary]
`clr` | Clear Register | `clr d0` (Sets data register to 0) [cite: User Summary]

### Control Flow

Mnemonic | Description | Example
--- | --- | ---
`jmp` | Absolute Jump | `jmp (a1)` (Indirect jump to native handler) [cite: User Summary]
`call` | Subroutine Call | `call 0x11de` (Call native memcpy stub) [cite: 4241N_Final_Stub_Map.txt]
`ret` | Return | `ret` (Return from mechanical hook) [cite: User Summary]
`cmp` | Compare | `cmp 0x3E, d0` (Is this Xbox Security Page?) [cite: 129_perfect_trampoline_v18.py]
`beq / bne` | Branch if Equal / Not Equal | `bne .exit_handler` (Conditional exit) [cite: User Summary]

## 3. Addressing Modes

Correct addressing is vital for interacting with the 4241N's memory-mapped I/O and buffers. [cite: User Summary]

- Immediate: `mov 0xD1, d0` (Direct value loading). [cite: 129_perfect_trampoline_v18.py]
- Register Indirect: `movbu (a0), d0` (Load from pointer in `a0`). [cite: User Summary]
- Indexed: `btst 1, (4,a1)` (Tests bit 1 at `a1 + 4 bytes`). [cite: 4241N_Mechanical_Analysis.txt]

## 4. Practical Payload Snippet

A typical sequence used to authorize media manually via the `pp_win` utility: [cite: pp_win.c, 129_perfect_trampoline_v18.py]

    ; Manual Authorization Logic
    mov     0x2CC, a0       ; a0 = Xbox Media Auth Flag address
    mov     0x01, d0        ; d0 = Value for "Authorized"
    movbu   d0, (a0)        ; Write 0x01 to address 0x2CC
    ret                     ; Hand control back to the drive firmware