# Project Frankenstein: Volume IX

## Mode Select (0x55) Structural Analysis

This volume provides an in-depth analysis of the Mode Select (10) command (OpCode `0x55`) as implemented in the Hitachi-LG GCC-4241N. While natively used for device parameter configuration, this project leverages `0x55` for critical vendor-specific operations including RAM jumping, bit-level register manipulation, and firmware streaming [cite: gcc_hitachi_flasher.c, pp_win.c].

## 1. Standard SCSI Command Descriptor Block (CDB)

The `0x55` command typically uses a 12-byte CDB. In the context of this project, specific bytes are repurposed for vendor signatures [cite: gcc_hitachi_flasher.c, pp_win.c].

CDB Byte | Standard Purpose | Frankenstein Usage / Signatures
--- | --- | ---
0 | OpCode | `0x55` (Mode Select 10)
1 | PF / SP Bits | `0x10` (PF bit set for Vendor Format) [cite: gcc_hitachi_flasher.c, pp_win.c]
2 | Reserved | Sequence Byte: Countdown (0xFF to 0x00) during streaming [cite: gcc_hitachi_flasher.c]
3 | Reserved | SIG_H: `0x48` ('H') for RAM Jumping [cite: pp_win.c]
4 | Reserved | SIG_L: `0x4C` ('L') for RAM Jumping [cite: pp_win.c]
5-6 | Reserved | Vendor parameters for sub-commands [cite: gcc_hitachi_flasher.c]
7-8 | Parameter List Length | Length of data payload following the CDB [cite: gcc_hitachi_flasher.c, pp_win.c]

## 2. Use-Case A: The "HL" RAM Jump

This sub-command tells the drive controller to immediately transfer the instruction pointer to a specific address in RAM [cite: pp_win.c].

### RAM Jump Sequence

- CDB Signature: Bytes 3 and 4 must contain `0x48 0x4C` ('HL') [cite: pp_win.c].
- Parameter List: A small 8-byte payload is sent where `payload[1]` is typically set to `6` [cite: pp_win.c].
- Execution: The drive jumps to the address previously populated by a Poke operation (e.g., `0x80000000`) [cite: pp_win.c].

    // Example from pp_win.c
    CDB[0] = 0x55;
    CDB[1] = 0x10;
    CDB[3] = 0x48; // 'H'
    CDB[4] = 0x4C; // 'L'
    CDB[8] = 0x08; // Parameter List Length

## 3. Use-Case B: Firmware Chunk Streaming

Used during the flashing process to move the 512KB binary into the drive's internal buffers [cite: gcc_hitachi_flasher.c].

Phase | CDB Configuration | Data Payload
--- | --- | ---
Setup | `0x55 0x10 00 00 00 00 00 00 0x10 00 ...` | 16-byte Header (Block size setup) [cite: gcc_hitachi_flasher.c]
Streaming | `0x55 0x10 [SEQ] 48 4C 07 01 08 00 ...` | 2048-byte Firmware Chunk [cite: gcc_hitachi_flasher.c]

The Checksum Trigger: When `CDB[2]` (the sequence byte) reaches `0x00`, the drive validates the entire buffer against the internal 32-bit big-endian checksum [cite: gcc_hitachi_flasher.c].

## 4. Use-Case C: Register Bit Manipulation

The `pp_win.c` tool identifies a method to set bit 3 of internal register `59E` to enable certain hardware states [cite: pp_win.c].

    // Setting 59E Bit 3
    CDB[0] = 0x55;
    CDB[1] = 0x10;
    CDB[8] = 0x08; // 8-byte parameter list
    param_list[1] = 6;

### Surgical Precision: Data Payloads

Unlike Peek/Poke (0xE7), the Mode Select command often requires a Parameter List in the Data-Out phase. Sending the wrong length (e.g., 6 bytes instead of 8) will cause the drive to reject the command with an "Invalid Field in Parameter List" sense error [cite: gcc_hitachi_flasher.c, pp_win.c].