# Project Frankenstein: Master Baseline Audit

Technical anchor for the Retail-Grade Hybrid Implementation (A101 -> Xbox Native)

## 1. Relocation Audit: Donor Engine Isolation

Dependency audit of the 2,615-byte "Must Lift" logic lifted from the 8050L firmware.

Metric | Result | Status
--- | --- | ---
Total Subroutines Lifted | 15 | Verified
External Absolute Dependencies | 0 | Isolated
Relocation Viability | 100% | Ready

Conclusion: The lifted engine is a self-contained cryptographic black box. It can be safely called from the 4241N caves without causing memory access violations or crashes.

## 2. Target Memory Anchors (GCC-4241N)

Anchor Point | Value/Address | Status
--- | --- | ---
s_auth_flag | `0x06A0` | Verified GAP
Primary Injection Cave | `0x017D6` | 1578 bytes
Engine Cave | `0x4E12D` | 138,963 bytes
DRAM Workspace | `0x10C80000` | Verified Workspace

## 3. Lead-In Signature Check (PCJD4)

The status of the Lead-In cache in the clean A101 baseline.

- Signature: `PCJD4` (50 43 4A 44 34)
- Cache Location: NOT CONFIRMED
- Mitigation Strategy: Payload v3 must incorporate a Manual Mechanical Read to LBA 0/PFI if the signature is not present in SRAM during the handshake trigger.

## 4. LBA Wall Neutralization Map

Offset | Original | Patch
--- | --- | ---
0x3034E | c9 05 | cb cb (NOP)
0x2C2CC | c4 09 | cb cb (NOP)
0x31A85 | c0 08 | cb cb (NOP)
0x3781A | c4 20 | cb cb (NOP)
0x3782A | c4 10 | cb cb (NOP)

## 5. Disaster Recovery (T48 Programming)

Pre-encryption constants for direct external flash via TSOP48.

- XOR Key: `0xA7A7A7A7`
- Bit-Swap Map: `[22, 11, 3, 26, 30, 16, 1, 12, 10, 7, 31, 21, 5, 19, 13, 28, 2, 27, 8, 20, 29, 18, 4, 14, 25, 17, 23, 0, 6, 15, 24, 9]`