Project Frankenstein: GCC-4241N Recipient Mapping Specification

This document serves as the architectural map for the LG/Hitachi GCC-4241N PC optical drive, the recipient unit for the original Xbox hybrid firmware modification. It identifies the critical offsets, hook points, and memory areas required to inject the donor logic.

1. Hardware Profile

Architecture: Matsushita/Panasonic MN103S [cite: User Summary]
Driver Chipset: ROHM BH6590KU [cite: User Summary]
Native Sub-systems: Handles Dual-Layer (DVD-9) tracking natively, which must be leveraged for Xbox Game Discs (XGD) [cite: User Summary].

Theory of Injection: Trampolines and Walls

Because we cannot replace the entire firmware, we use "Trampolines" to hijack specific execution points and "NOP Walls" to disable logical restrictions.

Trampolines: A JMP or CALL instruction inserted into a native handler that diverts the CPU to our custom logic in the RAM Cave [cite: 129_perfect_trampoline_v18.py].
Walls: Hardcoded range checks that prevent the drive from seeking beyond standard DVD partitions. These are neutralized by overwriting them with NOP instructions [cite: 129_perfect_trampoline_v18.py].

2. The RAM Cave (SRAM Injection Area)

The primary location for injected payload code. This area is unused by the native firmware and persists during drive operation.

Property	Value
Start Address (VMA)	`0x4000807A` [cite: 129_perfect_trampoline_v18.py]
Available Size	`0x0E86` (~3.63 KB) [cite: 129_perfect_trampoline_v18.py]
Purpose	Hosts SHA1/RC4 engines, Mechanical hooks, and Vendor commands [cite: 129_perfect_trampoline_v18.py].

3. Native Hook & Trampoline Map

The following offsets in the 4241N firmware are modified to link our custom logic.

Command / Feature	Hook Offset (ROM)	Payload Entry Point	Original Logic Description
Mode Sense ($5A)	`0x27198`	`0x30710`	Native Mode Page dispatch; intercepted to catch Xbox Security Page $3E [cite: 129_perfect_trampoline_v18.py].
Read DVD Struct ($AD)	`0x30249`	`0x30760`	Format Code $C0 check; intercepted to serve Xbox security response [cite: 129_perfect_trampoline_v18.py].
Mechanical ($1B)	`0x14bc`	TBD (RAM Cave)	Spindle Start/Stop and Tray Load/Eject handler [cite: 4241N_Mechanical_Analysis.txt].
Memdump ($E7)	`0x72282`	`0x40008200`	Group 7 Jump Table entry for Vendor Memory Dump [cite: 4241N_Corrected_Jump_Table.txt].

4. The LBA Walls (Security Sector Liberation)

To read the Xbox Security Sector at LBA 0x02FDFFFE, these five checks must be neutralized with 0xCBCB (NOP) [cite: 129_perfect_trampoline_v18.py].

Wall 1: 0x3034E [cite: 129_perfect_trampoline_v18.py]
Wall 2: 0x2C2CC [cite: 129_perfect_trampoline_v18.py]
Wall 3: 0x31A85 [cite: 129_perfect_trampoline_v18.py]
Wall 4: 0x3781A [cite: 129_perfect_trampoline_v18.py]
Wall 5: 0x3782A [cite: 129_perfect_trampoline_v18.py]

5. Native Stubs (MN103S Helper Functions)

Using these native addresses in your payload saves SRAM space [cite: User Summary].

memcpy: 0x11de [cite: 4241N_Final_Stub_Map.txt]
memset: 0x1111 [cite: 4241N_Final_Stub_Map.txt]
Group 7 Send Buffer: 0x90005046 [cite: 4241N_Corrected_Jump_Table.txt]

Critical Warning: Checksum Integrity

Any byte modified in the 4241N binary requires a recalculation of the 32-bit Big-Endian Checksum at the end of the file [cite: 01_hitachi_cipher.py]. Failure to correct this will result in a non-bootable drive ("Brick") [cite: 01_hitachi_cipher.py].