# Historical HTML Claim Review — Batch 03

## Scope

Reviewed:

- `HTML-013` — Command Reference & Vendor Extensions
- `HTML-012` — Mode Select Structural Analysis
- `HTML-016` — SHA-1 / RC4 Cryptographic Engine Analysis
- `HTML-031` — Inquiry Identity vs. Mode Sense Capabilities
- `HTML-032` — Mode Page 0x3E Security Challenge
- `HTML-030` — Security State Machine & Hardware Proxies

Batch-03 claims added: **64**  
Cumulative historical claims: **155**

| Status | Count |
|---|---:|
| Validated | 9 |
| Partially corroborated | 11 |
| Historical/Untrusted | 20 |
| Rejected | 13 |
| Open Question | 11 |

## Core Corrections

### Page 0x3E

The working GDR-8050L exchange is not a 40-byte page containing a 20-byte
challenge and a 20-byte digest.

The validated flow uses:

- a 28-byte total Mode parameter transfer;
- page header `3E 12`, declaring 18 page-data bytes;
- MODE SELECT(10) to send five-byte challenge records;
- MODE SENSE(10) to read verification state.

### Host cryptography

The validated host tool:

1. hashes 0x2C bytes from the READ DVD STRUCTURE response;
2. uses the first seven SHA-1 digest bytes as an RC4 key;
3. decrypts 0xFD bytes of the challenge table;
4. selects five-byte challenge records.

This contradicts the historical 16/20-byte RC4 key theory, the 20-byte page
challenge theory, and the continuing encrypted-channel theory.

### GCC flashing and debug commands

Current source partially corroborates several historical vendor-command
observations:

- `0xE7` plus `HL-DT-ST` as the GCC unlock request;
- `0x55` setup and firmware streaming;
- an `0x55`/`HL` RAM-execution sequence in `pp_win.c`;
- `0x5A`/`HL` final-poll and ignition subcommands in the current flasher.

These are source-observed, not yet hardware-validated. The review therefore
revises the earlier blanket rejection of the vendor-specific 0x5A ignition
interpretation to **Partially Corroborated**, while preserving that ordinary
MODE SENSE(10) itself is not generically an ignition command.

### Security state-machine document

The claimed complete GCC-4241N security map is not accepted. Exact SRAM
aliases, relocated payload addresses, authentication flag, descrambler register,
proxy functions, and dispatcher addresses remain Historical/Untrusted or Open
Questions.

The high-level sticky-descrambling command is independently validated:
MODE SELECT(6) opcode `0x15`, page `0x31`.

## External TSOP Recovery Update

The user has successfully unbricked at least one GCC-4241N with an external
TSOP48 programmer and the available dump. External-programmer recovery
feasibility is therefore validated for that unit.

The exact XOR, bit-swap, encryption, key, and transform-order theories remain
pending Batch 06.

## Full Batch-03 Claim Index

| Claim ID | Source | Section | Status | Claim |
|---|---|---|---|---|
| HCLM-B03-001 | HTML-013 | 1. The Native Command Set (Legacy) | validated | START/STOP UNIT opcode 0x1B is a native optical-drive command used for spindle and tray-related control. |
| HCLM-B03-002 | HTML-013 | 1. The Native Command Set (Legacy) | historical_untrusted | The GCC-4241N START/STOP UNIT handler is located at firmware offset 0x14BC. |
| HCLM-B03-003 | HTML-013 | 1. The Native Command Set (Legacy) | partially_corroborated | GCC-4241N vendor flashing uses MODE SELECT(10) opcode 0x55 for setup and firmware chunk streaming. |
| HCLM-B03-004 | HTML-013 | 1. The Native Command Set (Legacy) | partially_corroborated | GCC-4241N vendor flashing uses MODE SENSE(10) opcode 0x5A with HL-tagged subcommands for final status polling and ignition. |
| HCLM-B03-005 | HTML-013 | 1. The Native Command Set (Legacy) | partially_corroborated | GCC-4241N bootloader unlock uses opcode 0xE7 followed by the ASCII signature HL-DT-ST. |
| HCLM-B03-006 | HTML-013 | 2. The Frankenstein Extensions (Custom) | open_question | Redirecting the Group-7 entry at 0x72282 to 0x40008200 creates a working custom 0xE7 memory-dump handler. |
| HCLM-B03-007 | HTML-013 | 2. The Frankenstein Extensions (Custom) | historical_untrusted | The proposed custom 0xE7 memdump encodes a 32-bit big-endian address in CDB bytes 2-5 and transfer length in bytes 7-8. |
| HCLM-B03-008 | HTML-013 | 2. The Frankenstein Extensions (Custom) | historical_untrusted | A101 READ DVD STRUCTURE handling can be safely hooked at firmware offset 0x30249. |
| HCLM-B03-009 | HTML-013 | 2. The Frankenstein Extensions (Custom) | rejected | READ DVD STRUCTURE format 0xC0 returns a 2,048-byte Xbox security-sector response. |
| HCLM-B03-010 | HTML-013 | 2. The Frankenstein Extensions (Custom) | open_question | A custom READ DVD STRUCTURE format 0xFE can force a physical seek to the FF 02 FD FF FE location and return raw security data. |
| HCLM-B03-011 | HTML-013 | 2. The Frankenstein Extensions (Custom) | rejected | MODE SENSE(10) page 0x3E captures a 20-byte random challenge from the host and triggers SHA-1/RC4 processing. |
| HCLM-B03-012 | HTML-013 | 3. The Hardware Shim (Mechanical Modification) | historical_untrusted | A hybrid START/STOP handler bypasses spindle stop when SRAM flag 0x2CC is set. |
| HCLM-B03-013 | HTML-013 | 3. The Hardware Shim (Mechanical Modification) | partially_corroborated | Tray movement invalidates authentication state and requires state reset before re-use. |
| HCLM-B03-014 | HTML-013 | Missing Technical Volume Recommendation | historical_untrusted | DRAM addresses 0x10C80000 and 0x10CC0000 are established challenge and response staging buffers. |
| HCLM-B03-015 | HTML-012 | 1. Standard SCSI Command Descriptor Block (CDB) | rejected | MODE SELECT(10) normally uses a 12-byte CDB. |
| HCLM-B03-016 | HTML-012 | 1. Standard SCSI Command Descriptor Block (CDB) | partially_corroborated | Current GCC vendor-tool source sets CDB byte 1 to 0x10 for its MODE SELECT(10) operations. |
| HCLM-B03-017 | HTML-012 | 1. Standard SCSI Command Descriptor Block (CDB) | partially_corroborated | Firmware streaming uses CDB byte 2 as a countdown from 0xFF through 0x00. |
| HCLM-B03-018 | HTML-012 | 2. Use-Case A: The HL RAM Jump | partially_corroborated | pp_win uses MODE SELECT(10) with CDB bytes 3-4 equal to HL and an 8-byte parameter list with byte 1 equal to 6 to invoke a RAM routine. |
| HCLM-B03-019 | HTML-012 | 2. Use-Case A: The HL RAM Jump | historical_untrusted | The HL MODE SELECT subcommand transfers execution to code uploaded at 0x80000000. |
| HCLM-B03-020 | HTML-012 | 3. Use-Case B: Firmware Chunk Streaming | partially_corroborated | The current GCC flasher sends a 16-byte setup payload, a 4,080-byte stub in two 2,048-byte transfers, and a 512 KiB firmware image in 256 2,048-byte chunks. |
| HCLM-B03-021 | HTML-012 | 3. Use-Case B: Firmware Chunk Streaming | open_question | When the streaming countdown reaches zero, the drive validates a 32-bit big-endian checksum over the full buffer. |
| HCLM-B03-022 | HTML-012 | 4. Use-Case C: Register Bit Manipulation | partially_corroborated | pp_win sends an 8-byte MODE SELECT parameter list with byte 1 equal to 6 before its RAM-jump sequence and labels this as setting bit 3 of register 0x59E. |
| HCLM-B03-023 | HTML-012 | 4. Use-Case C: Register Bit Manipulation | historical_untrusted | Sending six bytes instead of eight causes an Invalid Field in Parameter List sense error. |
| HCLM-B03-024 | HTML-016 | 1. The SHA1 Hashing Engine | validated | The current host unlock workflow hashes 0x2C bytes from the 0xAD response with SHA-1, uses the first seven digest bytes as an RC4 key, and decrypts 0xFD bytes of the challenge table. |
| HCLM-B03-025 | HTML-016 | 1. The SHA1 Hashing Engine | open_question | GDR-8050L routine 0x90008847 is the donor SHA-1 engine. |
| HCLM-B03-026 | HTML-016 | 1. The SHA1 Hashing Engine | rejected | The donor SHA-1 engine was successfully ported to GCC-4241N address 0x40008500 with context at 0x10CC0100. |
| HCLM-B03-027 | HTML-016 | 1. The SHA1 Hashing Engine | rejected | The Xbox host supplies a 20-byte challenge that the drive hashes into a 20-byte response. |
| HCLM-B03-028 | HTML-016 | 1. The SHA1 Hashing Engine | validated | The listed initialization constants, 512-bit block expansion, and 80-round compression describe standard SHA-1. |
| HCLM-B03-029 | HTML-016 | 1. The SHA1 Hashing Engine | historical_untrusted | The donor or hybrid writes a 20-byte digest to 0x10C80014. |
| HCLM-B03-030 | HTML-016 | 2. The RC4 Stream Cipher | open_question | GDR-8050L routine 0x90008852 is RC4 state logic. |
| HCLM-B03-031 | HTML-016 | 2. The RC4 Stream Cipher | historical_untrusted | The RC4 S-box resides at SRAM address 0x4200. |
| HCLM-B03-032 | HTML-016 | 2. The RC4 Stream Cipher | rejected | The Xbox authentication RC4 key is typically 16 or 20 bytes depending on the game. |
| HCLM-B03-033 | HTML-016 | 2. The RC4 Stream Cipher | rejected | RC4 encrypts the continuing communication channel after the initial hash is verified. |
| HCLM-B03-034 | HTML-016 | 3. Integrated Handshake Flow | rejected | The hybrid loads a challenge at 0x10C80000, calls SHA-1 at 0x40008500, initializes RC4 from the digest, encrypts a mirror at 0x10C80040, and sets ready flag 0x2CC. |
| HCLM-B03-035 | HTML-016 | 4. Register Utilization | historical_untrusted | The listed d0, d1, a0, and a1 roles are the required calling convention for the donor crypto routines. |
| HCLM-B03-036 | HTML-031 | 1. The Identity/Capability Handshake | validated | INQUIRY opcode 0x12 reports vendor, product, and revision identity used by host software to identify the optical drive. |
| HCLM-B03-037 | HTML-031 | 1. The Identity/Capability Handshake | open_question | The original Xbox selects a vendor-specific command set based on the INQUIRY family string. |
| HCLM-B03-038 | HTML-031 | 1. The Identity/Capability Handshake | open_question | Mode Sense capability fields, including the write-protect bit, determine whether the Xbox accepts the drive. |
| HCLM-B03-039 | HTML-031 | 2. Mode Sense Page 0x01: The WP Bit | historical_untrusted | GCC-4241N is rejected specifically because its native combo-drive header reports WP=0. |
| HCLM-B03-040 | HTML-031 | 3. Incremental Identity Tweaking (SRAM) | historical_untrusted | GCC-4241N copies identity strings from ROM into a writable live SRAM table at boot. |
| HCLM-B03-041 | HTML-031 | 3. Incremental Identity Tweaking (SRAM) | historical_untrusted | The live GCC-4241N vendor/product/model fields reside at 0x40000D40, 0x40000D48, and 0x40000D4F. |
| HCLM-B03-042 | HTML-031 | 4. Testing via pp_win.c | partially_corroborated | Current pp_win source can write selected memory bytes by uploading a small MN103S routine and invoking it through vendor commands. |
| HCLM-B03-043 | HTML-031 | 4. Testing via pp_win.c | open_question | Writing DVDROM and GDR strings at the listed SRAM addresses will alter the drive's live INQUIRY identity. |
| HCLM-B03-044 | HTML-031 | 3. Incremental Identity Tweaking (SRAM) | partially_corroborated | Incremental, reversible identity-field changes are preferable to full identity replacement when isolating host compatibility requirements. |
| HCLM-B03-045 | HTML-032 | Document purpose | validated | Mode page 0x3E is a primary interface in the validated GDR-8050L Xbox authentication sequence. |
| HCLM-B03-046 | HTML-032 | 1. The Mode Sense Page 0x3E Structure | validated | The validated MODE SENSE(10) page-0x3E transfer is 28 bytes total, with an 8-byte Mode Parameter Header and a page header declaring 0x12 bytes of page data. |
| HCLM-B03-047 | HTML-032 | 1. The Mode Sense Page 0x3E Structure | open_question | MODE SENSE(6) opcode 0x1A can be used interchangeably with MODE SENSE(10) opcode 0x5A for the Xbox page-0x3E exchange. |
| HCLM-B03-048 | HTML-032 | 1. The Mode Sense Page 0x3E Structure | rejected | Page 0x3E has page length 0x28 and contains a 20-byte challenge followed by a 20-byte SHA-1 response. |
| HCLM-B03-049 | HTML-032 | Document purpose | rejected | The host sends its challenge with MODE SENSE and retrieves a SHA-1 response from the same page. |
| HCLM-B03-050 | HTML-032 | 1. The Mode Sense Page 0x3E Structure | validated | The working host sequence writes challenge records with a 28-byte MODE SELECT(10) page-0x3E frame and reads verification state with MODE SENSE(10). |
| HCLM-B03-051 | HTML-032 | 1. The Mode Sense Page 0x3E Structure | validated | The challenge records sent by the current unlock workflow are five bytes selected from an RC4-decrypted challenge table. |
| HCLM-B03-052 | HTML-032 | 2. Handshake Phase Management | open_question | The drive must hold Data-In or return CHECK CONDITION/Not Ready while SHA-1 and RC4 calculations complete. |
| HCLM-B03-053 | HTML-032 | 3. The Security Mirror Integration | rejected | A GCC hybrid copies a 20-byte challenge to 0x10C80000, calls ported SHA-1 at 0x40008500, and serves a response from 0x10C80040. |
| HCLM-B03-054 | HTML-032 | 4. Diagnostic Verification | historical_untrusted | Poking 20 bytes at 0x10C80000 and peeking 0x10C80040 verifies the hybrid SHA-1 implementation. |
| HCLM-B03-055 | HTML-030 | Executive Summary | rejected | The document provides a complete structural map of GCC-4241N security mechanisms and hardware proxies. |
| HCLM-B03-056 | HTML-030 | 1. Memory Mirroring Architecture | open_question | GCC-4241N SRAM addresses 0x171F and 0x3F1F alias physical cell 0x071F. |
| HCLM-B03-057 | HTML-030 | 1. Memory Mirroring Architecture | historical_untrusted | The claimed SRAM mirroring caused false positives in prior differential memory scans. |
| HCLM-B03-058 | HTML-030 | 2. RAM Execution & Obfuscation | historical_untrusted | GCC-4241N copies a security payload from ROM source 0x40017808 through alias 0xB01F7808 into RAM at 0xB01D3A00 and executes it there. |
| HCLM-B03-059 | HTML-030 | 2. RAM Execution & Obfuscation | historical_untrusted | The RAM copy is a deliberate defense-in-depth technique used to hide cryptographic routines. |
| HCLM-B03-060 | HTML-030 | 3.1 The Authentication Flag (0x0662) | historical_untrusted | Successful GCC cryptographic validation commits authentication state 0x0662 through proxy function 0x4000C485 using a four-byte checksum. |
| HCLM-B03-061 | HTML-030 | 3.2 The Descrambler Enable Register (0x06EC) | validated | The validated Xbox unlock sequence enables sticky descrambling with MODE SELECT(6) opcode 0x15 and mode page 0x31. |
| HCLM-B03-062 | HTML-030 | 3.2 The Descrambler Enable Register (0x06EC) | historical_untrusted | Sticky descrambling is implemented by byte register 0x06EC and commit proxy 0x400110A2 after clearing 0x06E8 and 0x06EA. |
| HCLM-B03-063 | HTML-030 | 4. Application Strategy for Injection | historical_untrusted | The primary GCC-4241N SCSI switchboard is at 0x400011EF and should be hooked for opcodes 0xAD and 0x55. |
| HCLM-B03-064 | HTML-030 | 4. Application Strategy for Injection | rejected | A successful GCC-4241N Xbox conversion must port GDR-8050L SHA-1/RC4 code and manually invoke the claimed native authentication and descrambler proxies. |
