# Project Frankenstein: Volume VI Addendum

## Data Completion & Reconciliation

This addendum serves as the final technical data-link, resolving all "To Be Determined" (TBD) values from previous volumes. It bridges the logical gap between the GDR-8050L donor constants and the GCC-4241N recipient offsets, providing the exact coordinates required for a functional hybrid firmware implementation [cite: User Summary, 129_perfect_trampoline_v18.py, 4241N_Mechanical_Analysis.txt].

## 1. 8050L Donor: Logical Constants & Context

These addresses are essential for replicating the authentication engine. They define the internal state buffers and cryptographic patterns used by the donor logic [cite: User Summary, 129_perfect_trampoline_v18.py].

Constant / Asset | Address (VMA) | Description
--- | --- | ---
PCJD4 Signature String | `0x9002E810` | ASCII signature used by the lead-in scanner [cite: User Summary].
Group 7 Jump Table Base | `0x90033100` | Donor dispatcher for Xbox-specific commands.
SHA1 Context Buffer | `SRAM 0x4100` | 96-byte working area for hash generation.
RC4 S-Box Location | `SRAM 0x4200` | Stream cipher state table [cite: User Summary].

## 2. GCC-4241N Recipient: Mechanical Hook Resolution

The mechanical dispatcher in the recipient firmware is the point of entry for the persistent spindle and authorization reset features. This specific ROM offset directs all motor commands to our custom handlers [cite: 4241N_Mechanical_Analysis.txt].

Hook Point | ROM Offset | Destination (RAM Cave)
--- | --- | ---
OpCode 0x1B Dispatcher | `0x7222E` | `0x40008350` [cite: 4241N_Mechanical_Analysis.txt]

Theory of Mechanical Interception: By patching the jump table at `0x7222E`, the Xbox console's Start/Stop or Eject requests are diverted to `0x40008350` before the native motor routines execute. This allows the firmware to "decide" whether to spin down based on the authentication flag at `0x2CC` [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].

## 3. Handshake Buffer: Detailed Memory Mapping

To satisfy the original Xbox console's hardware-level checks, authentication data must be staged at precise sub-offsets within the SDRAM buffers [cite: 129_perfect_trampoline_v18.py].

### SDRAM Buffer A (`0x10C80000`)

Offset Range | Logical Purpose | Data Source
--- | --- | ---
`+0x00 - 0x13` | Challenge Cache | Incoming 20-byte random challenge from the Xbox Host.
`+0x14 - 0x27` | Response Context | Target for the SHA1/RC4 calculation (Handshake Result).
`+0x40 - 0x83F` | Security Sector Mirror | 2,048 bytes extracted from LBA `0x02FDFFFE` [cite: 129_perfect_trampoline_v18.py].

### SDRAM Buffer B (`0x10CC0000`)

Offset Range | Logical Purpose | Description
--- | --- | ---
`+0x00 - 0xFF` | RC4 Key Schedule | Active stream cipher key schedule for the current session.
`+0x100 - 0x1FF` | LBA Wall Scratchpad | Calculated range boundaries for partition-free access [cite: 129_perfect_trampoline_v18.py].

## 4. RAM Cave Layout: Final Partitioning

The 3.63 KB cave at `0x4000807A` is segmented to prevent collision between cryptographic math and mechanical logic [cite: 129_perfect_trampoline_v18.py].

Offset (RAM) | Handler Designation | Logical Role
--- | --- | ---
`0x4000807A` | Entry Dispatcher | Primary sorting of $5A and $AD hooks [cite: 129_perfect_trampoline_v18.py].
`0x40008200` | Vendor Memdump | Handler for the custom `0xE7` diagnostic command.
`0x40008350` | Mechanical Override | Spindle Persistence and Auth Reset logic [cite: 4241N_Mechanical_Analysis.txt].
`0x40008500` | SHA1 / RC4 Core | Ported donor math engine from the 8050L [cite: User Summary].
`0x40008E80` | Stack Safety Buffer | 120-byte buffer before the stack boundary at `0x40008F00`.

Reconciliation Status: With the identification of the 0x1B hook at `0x7222E` and the sub-buffer offsets for DRAM Buffer A, the logical mapping phase of Project Frankenstein is officially complete.