# Project Frankenstein: GDR-8050L Donor Specification

This document serves as the comprehensive technical reference for the LG/Hitachi GDR-8050L, the original Xbox console optical drive. It details the donor logic, security protocols, and memory map required for transplanting these features into a recipient hybrid firmware.

## 1. Hardware Profile

- Architecture: Matsushita/Panasonic MN103S (MN10300) [cite: User Summary]
- Operating VMA: `0x90000000` (Physical 512KB ROM mapped to 0x90000000 - 0x9007FFFF) [cite: 129_perfect_trampoline_v18.py]
- Servo DSP: Panasonic AN22107A [cite: User Summary]
- Role: Logical "Brain" for Xbox Media Authentication [cite: User Summary]

### Theory of Operation: The Xbox Security Handshake

The Xbox console utilizes a Challenge-Response mechanism to authenticate the optical drive and the media. This occurs primarily through the Group 7 (Vendor Specific) command set.

1. Detection: The drive scans the disc lead-in for the physical `PCJD4` signature [cite: User Summary].
2. Challenge ($5A): The host sends a 20-byte random challenge via a `Mode Sense (10)` command using page code `0x3E` [cite: 129_perfect_trampoline_v18.py].
3. Processing: The drive processes this challenge through an internal SHA1/RC4 engine [cite: User Summary].
4. Response ($AD): The host requests the calculated security sector data via `Read DVD Structure` using format code `0xC0` [cite: 129_perfect_trampoline_v18.py].
5. LBA Liberation: Upon successful authentication, the drive unlocks the partition boundaries, allowing access to the Security Sector at LBA `0x02FDFFFE` [cite: 129_perfect_trampoline_v18.py].

## 2. Key Logic Addresses (MN103S VMA)

The following entry points define the core security handlers within the 8050L firmware:

Routine Name | VMA Address | Description
--- | --- | ---
PCJD4 Scanner | `0x9002E7B8` | Physical lead-in signature checker; triggers Xbox Media Mode [cite: User Summary].
SHA1 Core Engine | `0x90008847` | The primary hash generator for the security challenge [cite: User Summary].
RC4 State Logic | `0x90008852` | Manages the stream cipher used for handshake encryption [cite: User Summary].
Auth State Machine | `0x90013930` | The main dispatcher for Mode Sense ($5A) security pages [cite: User Summary].
Group 7 Handshake | `0x900330E1` | Main entry point for Read DVD Structure ($AD) format code $C0 [cite: 129_perfect_trampoline_v18.py].
Servo Override | `0x90030687` | Retunes the AN22107A DSP for tighter XGD track geometry [cite: User Summary].

## 3. Internal State & Flags

### SRAM Status Registers

- Media Authentication Flag: `0x5DB` (SRAM) - Set to non-zero when an Xbox Game Disc is authenticated; allows Group 0 commands to bypass LBA boundaries [cite: User Summary].
- Command Buffer (CDB): The host command is typically cached at `0x840` (SRAM).

### Memory Segments

- Handshake Buffers: Security data is processed and staged in the DRAM buffers (typically `0x10C80000` or `0x10CC0000`) [cite: 129_perfect_trampoline_v18.py].

## 4. Hardware-Specific Considerations

Hardware Disparity: The 8050L uses the AN22107A servo driver. When porting tracking logic to recipients with different drivers (e.g., BH6590KU), do not copy the raw register values at `0x90030687`. Instead, trigger the recipient's native Dual-Layer (DL) calibration to achieve safe high-gain tracking [cite: User Summary].

### Spindle Behavior

Unlike standard PC drives, the 8050L firmware bypasses the idle timeout when `0x5DB` is active, ensuring the spindle maintains velocity for instantaneous console challenges [cite: User Summary].