# Project Frankenstein: Master Baseline Audit

Version 2.1 - Retail-Grade Hybrid Documentation

## 1. Finalized Target Anchors (GCC-4241N A101)

Anchor Point | Value / Address | Status
--- | --- | ---
s_auth_flag | `0x06A0` | Verified SRAM GAP
Primary Injection Cave | `0x017D6` | Payload Host (v3)
Donor Engine Cave | `0x4E12D` | 138,963 bytes available
DRAM Workspace | `0x10C80000` | Sector Read Cache

## 2. Security Sector & Handshake Logic

- Signature: `PCJD4` (50 43 4A 44 34) in Lead-In.
- Data Dependency: 2,048-byte Security Sector from LBA 16.
- Mechanism: Manual LBA 0 read verified in Payload v3.
- Persistence: State 2 bypasses native spin-down commands.

## 3. LBA Wall Neutralization (A101)

Offset | Original | Patch
--- | --- | ---
0x3034E | c9 05 | cb cb
0x2C2CC | c4 09 | cb cb
0x31A85 | c0 08 | cb cb
0x3781A | c4 20 | cb cb
0x3782A | c4 10 | cb cb

## 4. Disaster Recovery (Offline T48 Path)

Constants for direct TSOP48 programming of the SST-39LFX00A.

- XOR Mask: `0xA7A7A7A7`
- Bit-Swap Map: `[22, 11, 3, 26, 30, 16, 1, 12, 10, 7, 31, 21, 5, 19, 13, 28, 2, 27, 8, 20, 29, 18, 4, 14, 25, 17, 23, 0, 6, 15, 24, 9]`

## 5. MN103S Assembler Syntax Notes

- Constants: Direct value usage (no `#` prefix in current toolchain).
- Calls: Use `calls (reg)` for register-indirect calls.