# Project Frankenstein: GCC-4241N Recipient Mapping Specification

This document serves as the architectural map for the LG/Hitachi GCC-4241N PC optical drive, the recipient unit for the original Xbox hybrid firmware modification. It identifies the critical offsets, hook points, and memory areas required to inject the donor logic.

## 1. Hardware Profile

- Architecture: Matsushita/Panasonic MN103S [cite: User Summary]
- Driver Chipset: ROHM BH6590KU [cite: User Summary]
- Native Sub-systems: Handles Dual-Layer (DVD-9) tracking natively, which must be leveraged for Xbox Game Discs (XGD) [cite: User Summary].

### Theory of Injection: Trampolines and Walls

Because we cannot replace the entire firmware, we use "Trampolines" to hijack specific execution points and "NOP Walls" to disable logical restrictions.

- Trampolines: A `JMP` or `CALL` instruction inserted into a native handler that diverts the CPU to our custom logic in the RAM Cave [cite: 129_perfect_trampoline_v18.py].
- Walls: Hardcoded range checks that prevent the drive from seeking beyond standard DVD partitions. These are neutralized by overwriting them with `NOP` instructions [cite: 129_perfect_trampoline_v18.py].

## 2. The RAM Cave (SRAM Injection Area)

The primary location for injected payload code. This area is unused by the native firmware and persists during drive operation.

Property | Value
--- | ---
Start Address (VMA) | `0x4000807A` [cite: 129_perfect_trampoline_v18.py]
Available Size | `0x0E86` (~3.63 KB) [cite: 129_perfect_trampoline_v18.py]
Purpose | Hosts SHA1/RC4 engines, Mechanical hooks, and Vendor commands [cite: 129_perfect_trampoline_v18.py].

## 3. Native Hook & Trampoline Map

The following offsets in the 4241N firmware are modified to link our custom logic.

Command / Feature | Hook Offset (ROM) | Payload Entry Point | Original Logic Description
--- | --- | --- | ---
Mode Sense ($5A) | `0x27198` | `0x30710` | Native Mode Page dispatch; intercepted to catch Xbox Security Page $3E [cite: 129_perfect_trampoline_v18.py].
Read DVD Struct ($AD) | `0x30249` | `0x30760` | Format Code $C0 check; intercepted to serve Xbox security response [cite: 129_perfect_trampoline_v18.py].
Mechanical ($1B) | `0x14bc` | TBD (RAM Cave) | Spindle Start/Stop and Tray Load/Eject handler [cite: 4241N_Mechanical_Analysis.txt].
Memdump ($E7) | `0x72282` | `0x40008200` | Group 7 Jump Table entry for Vendor Memory Dump [cite: 4241N_Corrected_Jump_Table.txt].

## 4. The LBA Walls (Security Sector Liberation)

To read the Xbox Security Sector at LBA `0x02FDFFFE`, these five checks must be neutralized with `0xCBCB` (NOP) [cite: 129_perfect_trampoline_v18.py].

- Wall 1: `0x3034E` [cite: 129_perfect_trampoline_v18.py]
- Wall 2: `0x2C2CC` [cite: 129_perfect_trampoline_v18.py]
- Wall 3: `0x31A85` [cite: 129_perfect_trampoline_v18.py]
- Wall 4: `0x3781A` [cite: 129_perfect_trampoline_v18.py]
- Wall 5: `0x3782A` [cite: 129_perfect_trampoline_v18.py]

## 5. Native Stubs (MN103S Helper Functions)

Using these native addresses in your payload saves SRAM space [cite: User Summary].

- `memcpy`: `0x11de` [cite: 4241N_Final_Stub_Map.txt]
- `memset`: `0x1111` [cite: 4241N_Final_Stub_Map.txt]
- Group 7 Send Buffer: `0x90005046` [cite: 4241N_Corrected_Jump_Table.txt]

### Critical Warning: Checksum Integrity

Any byte modified in the 4241N binary requires a recalculation of the 32-bit Big-Endian Checksum at the end of the file [cite: 01_hitachi_cipher.py]. Failure to correct this will result in a non-bootable drive ("Brick") [cite: 01_hitachi_cipher.py].