# Project Frankenstein: Volume XXVII

## Tray Sensor GPIO & Auth Reset Logic

This volume details the hardware-level monitoring of the drive tray sensors in the Hitachi-LG GCC-4241N and how this data is utilized to implement the Auth Reset behavior required for Xbox stability [cite: User Summary, Project_Frankenstein_Vol_VI_Addendum.html, Project_Frankenstein_Vol_XV_Dispatcher_Tables.html].

## 1. GPIO Register Mapping (MN103S)

The tray sensors are physically connected to the CPU's General Purpose Input/Output (GPIO) pins, allowing the firmware to poll the mechanical state of the tray in real-time [cite: User Summary].

Register | VMA Address | Description
--- | --- | ---
`PORTB_IN` | `0x9000A040` | Input Data: Reflects the current high/low state of the sensor pins [cite: User Summary].
`PORTB_DIR` | `0x9000A044` | Direction: Configures pins as Inputs (0) or Outputs (1) [cite: User Summary].

## 2. Tray State Bit Definitions

The GCC-4241N typically utilizes Bit 0 and Bit 1 of Port B to track the tray's movement [cite: User Summary].

- Bit 0 (Tray Closed): Set to `1` when the tray is locked and the laser pickup is at the home position [cite: User Summary].
- Bit 1 (Tray Open): Set to `1` when the tray is fully extended [cite: User Summary].

## 3. The Auth Reset Workflow

### Logic: Enforcing Disc Security

When a user opens the tray to swap discs, the drive must immediately reset its internal security state to prevent a "security bypass" on the new media [cite: Project_Frankenstein_Vol_VI_Addendum.html].

1. Interrupt Trigger: A state change on `PORTB_IN` triggers the External IRQ at `0x00000010` or `0x00000018` [cite: Project_Frankenstein_Vol_XV_Dispatcher_Tables.html].
2. SRAM Clearance: The interrupt handler checks for Bit 1 (Open). If set, it clears the Media Authorized Flag at `0x2CC` [cite: Project_Frankenstein_Vol_VI_Addendum.html].

## 4. RAM Cave Hook Implementation

To ensure this behavior is persistent across all hybrid firmware variants, the reset logic can be injected directly into the RAM Cave [cite: User Summary, 129_perfect_trampoline_v18.py].

    ; MN103S Assembly: Auth Reset Hook
    ; Target: SRAM Cave 0x40008B00
    Check_Tray_State:
        mov     0x9000A040, a0  ; Point to PORTB_IN
        movbu   (a0), d0        ; Read sensors
        btst    1, d0           ; Is Bit 1 (Tray Open) high?
        beq     .done           ; If tray is closed, skip reset

        mov     0x2CC, a1       ; Point to Auth Flag [cite: Project_Frankenstein_Vol_VI_Addendum.html]
        clr     d1
        movbu   d1, (a1)        ; Force state to Unauthorized

    .done:
        ret