# Historical HTML Claim Review — Batch 02

## Scope

Reviewed:

- `HTML-006` — GDR-8050L Donor Specification
- `HTML-003` — GCC-4241N Recipient Mapping
- `HTML-008` — Conversion Hunting
- `HTML-010` — Firmware Finalization Guide

Substantive Batch-02 claims: **56**

| Status | Count |
|---|---:|
| Validated | 8 |
| Partially corroborated | 9 |
| Historical/Untrusted | 24 |
| Superseded | 0 |
| Rejected | 6 |
| Negative knowledge | 0 |
| Open question | 9 |

## Controlling Conclusions

### Donor behavior survives; donor address maps do not automatically survive

The donor document correctly identifies GDR-8050L as the canonical Xbox-capability donor, its MN103S execution environment, the validated `0xAD`/`0xC0` structure request, and the authentication-driven locked/unlocked media transition.

It incorrectly states that the host sends the challenge through `MODE SENSE(10)` opcode `0x5A`; validated hardware sends challenge material through `MODE SELECT(10)` opcode `0x55` and reads state/response through `0x5A`.

The exact PCJD4, cryptographic, state-machine, servo, flag, CDB-buffer, and DRAM-buffer addresses remain research leads unless current call/data-flow or hardware traces prove them.

### Recipient hardware capability is not recipient firmware compatibility

GCC-4241N is MN103S-based and is documented to read dual-layer DVD-ROM media. Its companion controller is AN22111A, not the historical BH6590KU identification.

The claimed SRAM cave, hook sites, LBA walls, native stubs, send-buffer helper, and checksum format remain unvalidated. The existence of a GCC-4241N E7/HL path makes the historical custom-command idea testable, but does not validate the exact jump-table patch or RAM target.

### Conversion hunting contained useful method and unsafe generalization

The durable principle is to examine architecture, optical capability, firmware storage, interfaces, and hardware-control mapping before selecting a target. External labels and OEM part numbers are only sourcing heuristics.

The claim that almost any DVD-capable MN103S drive is hardware-capable and blocked mainly by pin mapping is rejected. Current PFES requires full topology, resource, peripheral, servo, media, and firmware-dependency analysis.

The GDR-808xN family claim is also rejected because the user's GDR-8081N boards use HD62602AFD1 rather than MN103S.

### The finalization guide is historical, not executable guidance

The guide's GNU cross-toolchain sequence is technically plausible as an old build recipe, but the end-to-end hybrid, exact trampoline bytes, five NOP walls, and final 0xE7 injection are not validated.

The checksum, encrypted-on-flash representation, Windows-flasher plaintext boundary, double-encryption mechanism, and unbricking recipe remain open or historical. The user's real GCC-4241N TSOP48 dump is now recorded as future Batch-06 evidence for resolving these representation claims.

## Full Claim Index

| Claim | Source | Section | Status | Normalized claim |
|---|---|---|---|---|
| HCLM-B02-001 | HTML-006 | 1. Hardware Profile | validated | The GDR-8050L uses the Panasonic/Matsushita MN103S architecture and a 512 KiB firmware ROM mapped at 0x90000000 through 0x9007FFFF. |
| HCLM-B02-002 | HTML-006 | 1. Hardware Profile | historical_untrusted | The GDR-8050L servo DSP is a Panasonic AN22107A. |
| HCLM-B02-003 | HTML-006 | 1. Hardware Profile | validated | GDR-8050L is the canonical donor for original-Xbox optical-drive authentication and media-access capability. |
| HCLM-B02-004 | HTML-006 | Theory of Operation: The Xbox Security Handshake | partially_corroborated | The authentication sequence is primarily a Group-7 vendor-specific protocol. |
| HCLM-B02-005 | HTML-006 | Theory of Operation: The Xbox Security Handshake | partially_corroborated | The drive detects Xbox media by scanning for a physical PCJD4 lead-in signature. |
| HCLM-B02-006 | HTML-006 | Theory of Operation: The Xbox Security Handshake | rejected | The host sends the 20-byte security challenge using MODE SENSE(10) opcode 0x5A on page 0x3E. |
| HCLM-B02-007 | HTML-006 | Theory of Operation: The Xbox Security Handshake | partially_corroborated | The GDR-8050L internally performs SHA-1 and RC4 processing as part of authentication. |
| HCLM-B02-008 | HTML-006 | Theory of Operation: The Xbox Security Handshake | validated | The host obtains authentication structure data with READ DVD STRUCTURE opcode 0xAD and format code 0xC0. |
| HCLM-B02-009 | HTML-006 | Theory of Operation: The Xbox Security Handshake | validated | Successful authentication changes the visible media state and removes the locked partition boundary. |
| HCLM-B02-010 | HTML-006 | Theory of Operation: The Xbox Security Handshake | partially_corroborated | 0x02FDFFFE is the scalar physical address of the Xbox security sector. |
| HCLM-B02-011 | HTML-006 | 2. Key Logic Addresses | historical_untrusted | 0x9002E7B8 implements the donor PCJD4 scanner. |
| HCLM-B02-012 | HTML-006 | 2. Key Logic Addresses | open_question | 0x90008847 implements the donor primary SHA-1 engine. |
| HCLM-B02-013 | HTML-006 | 2. Key Logic Addresses | open_question | 0x90008852 implements the donor RC4 state logic. |
| HCLM-B02-014 | HTML-006 | 2. Key Logic Addresses | historical_untrusted | 0x90013930 implements the donor page-0x3E authentication state machine. |
| HCLM-B02-015 | HTML-006 | 2. Key Logic Addresses | historical_untrusted | 0x900330E1 implements the donor READ DVD STRUCTURE 0xC0 handler. |
| HCLM-B02-016 | HTML-006 | 2. Key Logic Addresses | historical_untrusted | 0x90030687 implements the donor servo override for Xbox geometry. |
| HCLM-B02-017 | HTML-006 | 3. Internal State & Flags | historical_untrusted | SRAM address 0x5DB is the donor media-authentication flag that allows LBA-boundary bypass. |
| HCLM-B02-018 | HTML-006 | 3. Internal State & Flags | historical_untrusted | The donor CDB is typically cached at SRAM address 0x840. |
| HCLM-B02-019 | HTML-006 | 3. Internal State & Flags | historical_untrusted | Handshake buffers are staged in DRAM at 0x10C80000 or 0x10CC0000. |
| HCLM-B02-020 | HTML-006 | 4. Hardware-Specific Considerations | historical_untrusted | When 0x5DB is active, the donor firmware bypasses idle spin-down to keep the spindle ready for console challenges. |
| HCLM-B02-021 | HTML-003 | 1. Hardware Profile | validated | GCC-4241N uses a Panasonic MN103S controller. |
| HCLM-B02-022 | HTML-003 | 1. Hardware Profile | rejected | GCC-4241N uses a ROHM BH6590KU driver chipset. |
| HCLM-B02-023 | HTML-003 | 1. Hardware Profile | validated | GCC-4241N natively supports dual-layer DVD-ROM media. |
| HCLM-B02-024 | HTML-003 | Theory of Injection: Trampolines and Walls | partially_corroborated | A recipient can in principle redirect execution with trampolines and neutralize selected checks with NOP patches. |
| HCLM-B02-025 | HTML-003 | 2. The RAM Cave | historical_untrusted | 0x4000807A through approximately 0x40008EFF is an unused persistent GCC-4241N SRAM cave suitable for 3.63 KiB of executable payload. |
| HCLM-B02-026 | HTML-003 | 3. Native Hook & Trampoline Map | historical_untrusted | A101 hook sites at ROM offsets 0x27198, 0x30249, and 0x14BC can safely redirect MODE SENSE, READ DVD STRUCTURE, and mechanical handling to injected code. |
| HCLM-B02-027 | HTML-003 | 3. Native Hook & Trampoline Map | open_question | The GCC-4241N Group-7 jump-table entry at 0x72282 can be redirected to 0x40008200 to implement a custom 0xE7 memory-dump command. |
| HCLM-B02-028 | HTML-003 | 4. The LBA Walls | historical_untrusted | The five A101 offsets 0x3034E, 0x2C2CC, 0x31A85, 0x3781A, and 0x3782A are all LBA walls that should be overwritten with 0xCBCB. |
| HCLM-B02-029 | HTML-003 | 5. Native Stubs | historical_untrusted | A101 native helper functions memcpy at 0x11DE and memset at 0x1111 are safe payload-call targets. |
| HCLM-B02-030 | HTML-003 | 5. Native Stubs | historical_untrusted | 0x90005046 is the GCC-4241N Group-7 send-buffer helper. |
| HCLM-B02-031 | HTML-003 | Critical Warning: Checksum Integrity | open_question | Any GCC-4241N firmware modification requires recalculating a 32-bit big-endian checksum stored at the end of the image. |
| HCLM-B02-032 | HTML-003 | Critical Warning: Checksum Integrity | partially_corroborated | Flashing an image with an incorrect checksum necessarily leaves GCC-4241N non-bootable. |
| HCLM-B02-033 | HTML-008 | 1. The Conditions for Success | validated | A conversion candidate must be evaluated for controller architecture, optical capability, firmware storage, host interface, and hardware-control mapping rather than model name alone. |
| HCLM-B02-034 | HTML-008 | 2. Best Guesses & Known Chip Mappings | historical_untrusted | Matsushita SR-8588 and SR-8589 are the parent design of GDR-8163B and the best conversion candidates. |
| HCLM-B02-035 | HTML-008 | 2. Best Guesses & Known Chip Mappings | historical_untrusted | Creative Labs DVD1640E is a rebadged MN103S89FDA Matsushita design suitable for conversion. |
| HCLM-B02-036 | HTML-008 | 2. Best Guesses & Known Chip Mappings | historical_untrusted | The Compaq/HP, IBM, and Dell model-number lists in the document reliably identify hidden MN103S conversion candidates. |
| HCLM-B02-037 | HTML-008 | 2. Best Guesses & Known Chip Mappings | partially_corroborated | The GCC-424xN family is broadly MN103S-based. |
| HCLM-B02-038 | HTML-008 | 2. Best Guesses & Known Chip Mappings | rejected | The GDR-808xN family is confirmed MN103S-based. |
| HCLM-B02-039 | HTML-008 | 2. Best Guesses & Known Chip Mappings | validated | GWA-4164B is likely MN103S-based. |
| HCLM-B02-040 | HTML-008 | 2. Best Guesses & Known Chip Mappings | historical_untrusted | GT10N is probably MN103S-based and a useful conversion candidate. |
| HCLM-B02-041 | HTML-008 | 2. Best Guesses & Known Chip Mappings | historical_untrusted | GCC-H23N is unsuitable because it cannot read dual-layer DVD media. |
| HCLM-B02-042 | HTML-008 | 2. Best Guesses & Known Chip Mappings | partially_corroborated | GDR-816xB drives can read GameCube/Wii media in stock form and can be cross-flashed with GDR-8050L firmware. |
| HCLM-B02-043 | HTML-008 | 3. Stealth Hunting List | historical_untrusted | Sticker brands, country of manufacture, ROM-version format, connector type, and package appearance can identify MN103S drives. |
| HCLM-B02-044 | HTML-008 | Technical Pro-Tip | rejected | Any DVD-capable MN103S drive is almost certainly hardware-capable, and pin mapping is the primary remaining barrier. |
| HCLM-B02-045 | HTML-010 | Document purpose | rejected | The guide provides a valid end-to-end workflow for constructing a working GCC-4241N Xbox hybrid firmware. |
| HCLM-B02-046 | HTML-010 | 1. Payload Assembly Workflow | historical_untrusted | The historical payload was intended to be assembled, linked with a custom linker script, and converted from ELF to a raw binary using GNU MN10300 tools. |
| HCLM-B02-047 | HTML-010 | 1. Payload Assembly Workflow | historical_untrusted | The payload can safely link against recipient memcpy at 0x11DE and memset at 0x1111. |
| HCLM-B02-048 | HTML-010 | 2. Binary Patching Logic | rejected | The V18 script and listed trampoline byte strings safely patch A101 MODE SENSE and READ DVD STRUCTURE handlers. |
| HCLM-B02-049 | HTML-010 | 2. Binary Patching Logic | historical_untrusted | The five 0xCBCB overwrites safely unlock physical tracking to the Xbox security sector. |
| HCLM-B02-050 | HTML-010 | 2. Binary Patching Logic | open_question | Redirecting jump-table offset 0x72282 to 0x40008200 implements a working custom 0xE7 command. |
| HCLM-B02-051 | HTML-010 | 3. Security Finalization | open_question | The patched GCC-4241N image must be transformed back into an encrypted on-flash representation before direct hardware programming. |
| HCLM-B02-052 | HTML-010 | 3. Security Finalization | open_question | A 32-bit big-endian checksum is appended at the end of the firmware image. |
| HCLM-B02-053 | HTML-010 | 3. Security Finalization | open_question | The Windows flasher accepts plaintext and encrypts it in the drive, whereas direct TSOP programming requires encrypted bytes. |
| HCLM-B02-054 | HTML-010 | 3. Security Finalization | partially_corroborated | Double encryption necessarily bricks GCC-4241N. |
| HCLM-B02-055 | HTML-010 | 4. Forensic Un-Bricking Strategy | historical_untrusted | A double-encrypted unit can be recovered by dumping the TSOP, decrypting once with XBOX_HITACHI_KEY, and directly restoring a single-encrypted image. |
| HCLM-B02-056 | HTML-010 | 5. Diagnostic Verification | open_question | The exact CDB E7 00 40 00 80 7A 00 00 20 00 should return 32 bytes from the injected payload entry point and prove the hybrid is active. |
