# v204 GDR-8050L live iSCSI stateful unlock view

This package fixes the v203 architectural mismatch seen when using `unlockdrive.exe` against the Windows-video/direct view.

v203 intentionally split views:

- Windows video/direct: `media_lba = host_lba`, useful for Explorer/VLC DVD-Video mounting.
- Xbox unlocked: `media_lba = host_lba + 306080`, useful only after auth/unlock.

The uploaded v203 unlockdrive log shows the target stayed in the locked/video view during the unlock sequence: final READ CAPACITY still returned `00 00 1B 4F` and the tool reported `Game Title Raw: Not_XDFS` / `Invalid Root LBA`.

v204 adds a stateful live iSCSI mode:

1. Start locked/direct so Windows can attach and see the DVD-video partition.
2. Track the 8050L MODE SELECT challenge/unlock/sticky CDB sequence.
3. After partition-1 unlock/sticky descramble, switch live READs to the proven game window: `media_lba = host_lba + 306080`.
4. Return unlocked READ CAPACITY and page-3E MODE SENSE state.

This is still not full firmware-in-the-loop. It is a SCSI-side state machine using the behavior we proved. Full firmware-in-the-loop should be the next architecture: route each live packet CDB through the MN103S packet/FIFO/MMIO model and use the ISO only as the backing media for the firmware-requested data phase. That does not require laser/servo emulation; laser/servo is only needed for raw physical pickup/ECC/timing fidelity.

## Start stateful target

```powershell
.\gdr8050l_auth_v204_stateful_unlock_iscsi_start.cmd `
  .\gdr8050l_auth_v204_stateful_unlock_iscsi_config.json `
  "D:\vscode-workspace\xbox-dvd-tools-v2\disc_dumps\Red Faction II[TQ00501A].iso" `
  192.168.0.8 `
  3260
```

Then connect with the existing v203/v204 Windows iSCSI connect script and run `unlockdrive.exe` against the single mounted drive letter.

Expected after the unlock sequence:

- page-3E MODE SENSE reflects challenge/unlock state rather than repeating the locked page forever;
- final READ CAPACITY returns `00 34 5B 5F 00 00 08 00`;
- READ(10) host LBA 32 maps to ISO LBA 306112 and should expose the XDFS signature.

Collect logs while the target is still running if it does not find XDFS.
