# Project Frankenstein: Volume X

## SHA1 & RC4 Cryptographic Engine Analysis

This volume provides a deep-dive analysis of the authentication routines extracted from the GDR-8050L donor. It details the mathematical flow, register usage, and memory requirements for the SHA1 and RC4 engines as they are ported to the GCC-4241N RAM Cave [cite: User Summary, GDR-8050L_Donor_Specification.html, Project_Frankenstein_Vol_VI_Addendum.html].

## 1. The SHA1 Hashing Engine

The SHA1 engine is the core of the console challenge response. It processes the 20-byte host challenge to generate a unique digest [cite: GDR-8050L_Donor_Specification.html, 129_perfect_trampoline_v18.py].

Metric | GDR-8050L Donor Value | Hybrid Payload Target
--- | --- | ---
Routine Entry | `0x90008847` [cite: GDR-8050L_Donor_Specification.html] | `0x40008500` [cite: Project_Frankenstein_Vol_VI_Addendum.html]
Context Buffer | SRAM `0x4100` [cite: Project_Frankenstein_Vol_VI_Addendum.html] | DRAM `0x10CC0100` (Recommended) [cite: Project_Frankenstein_Vol_VI_Addendum.html]
Input Buffer | SDRAM `0x10C80000` [cite: 129_perfect_trampoline_v18.py] | SDRAM `0x10C80000` [cite: Project_Frankenstein_Vol_VI_Addendum.html]

### Algorithm Lifecycle (MN103S)

1. Initialization: State variables (H0-H4) are set to standard SHA1 magic constants (e.g., `0x67452301`).
2. Update: The 20-byte challenge from the console is padded and expanded into a 64-byte block.
3. Compression: The core loop executes 80 rounds of bitwise operations (AND, OR, XOR, ROTL) [cite: User Summary].
4. Finalization: The final 160-bit (20-byte) hash is written to the Response Context at `0x10C80014` [cite: Project_Frankenstein_Vol_VI_Addendum.html].

## 2. The RC4 Stream Cipher

RC4 is used to encrypt the communications channel between the drive and the console kernel once the initial hash is verified [cite: User Summary, GDR-8050L_Donor_Specification.html].

Feature | Location / Value
--- | ---
RC4 Logic Entry | `0x90008852` [cite: GDR-8050L_Donor_Specification.html]
S-Box Buffer | SRAM `0x4200` [cite: Project_Frankenstein_Vol_VI_Addendum.html]
Key Length | Typically 128-bit (16 bytes) or 160-bit (20 bytes) depending on game [cite: User Summary].

### KSA (Key Scheduling Algorithm) Logic

The MN103S routine at `0x90008852` initializes a 256-byte S-Box permutation based on the session key. The S-Box is stored in internal SRAM for low-latency access during streaming [cite: GDR-8050L_Donor_Specification.html, Project_Frankenstein_Vol_VI_Addendum.html].

## 3. Integrated Handshake Flow

During the security handshake, the payload executes the following combined routine [cite: 129_perfect_trampoline_v18.py]:

    ; Pseudo-Code for Handshake Routine
    1. Load Challenge from DRAM 0x10C80000
    2. Call SHA1_Engine(0x40008500)
    3. Call RC4_Initialize(Key = SHA1_Output)
    4. Encrypt Security Sector Mirror (0x10C80040)
    5. Signal "Ready" to Host via SRAM 0x2CC

## 4. Register Utilization (MN103S Calling Convention)

When calling these ported routines from your `xbox_hybrid_payload.s`, adhere to the 8050L register map to avoid corruption [cite: User Summary].

- d0: Input data byte / XOR working register.
- d1: Loop counter / bit-rotation offset.
- a0: Pointer to Input Data (Challenge).
- a1: Pointer to Working Context (SRAM Buffers).