Project Frankenstein: GDR-8050L Donor Specification

This document serves as the comprehensive technical reference for the LG/Hitachi GDR-8050L, the original Xbox console optical drive. It details the donor logic, security protocols, and memory map required for transplanting these features into a recipient hybrid firmware.

1. Hardware Profile

Architecture: Matsushita/Panasonic MN103S (MN10300) [cite: User Summary]
Operating VMA: 0x90000000 (Physical 512KB ROM mapped to 0x90000000 - 0x9007FFFF) [cite: 129_perfect_trampoline_v18.py]
Servo DSP: Panasonic AN22107A [cite: User Summary]
Role: Logical "Brain" for Xbox Media Authentication [cite: User Summary]

Theory of Operation: The Xbox Security Handshake

The Xbox console utilizes a Challenge-Response mechanism to authenticate the optical drive and the media. This occurs primarily through the Group 7 (Vendor Specific) command set.

Detection: The drive scans the disc lead-in for the physical PCJD4 signature [cite: User Summary].
Challenge ($5A): The host sends a 20-byte random challenge via a Mode Sense (10) command using page code 0x3E [cite: 129_perfect_trampoline_v18.py].
Processing: The drive processes this challenge through an internal SHA1/RC4 engine [cite: User Summary].
Response ($AD): The host requests the calculated security sector data via Read DVD Structure using format code 0xC0 [cite: 129_perfect_trampoline_v18.py].
LBA Liberation: Upon successful authentication, the drive unlocks the partition boundaries, allowing access to the Security Sector at LBA 0x02FDFFFE [cite: 129_perfect_trampoline_v18.py].

2. Key Logic Addresses (MN103S VMA)

The following entry points define the core security handlers within the 8050L firmware:

Routine Name	VMA Address	Description
PCJD4 Scanner	`0x9002E7B8`	Physical lead-in signature checker; triggers Xbox Media Mode [cite: User Summary].
SHA1 Core Engine	`0x90008847`	The primary hash generator for the security challenge [cite: User Summary].
RC4 State Logic	`0x90008852`	Manages the stream cipher used for handshake encryption [cite: User Summary].
Auth State Machine	`0x90013930`	The main dispatcher for Mode Sense ($5A) security pages [cite: User Summary].
Group 7 Handshake	`0x900330E1`	Main entry point for Read DVD Structure ($AD) format code $C0 [cite: 129_perfect_trampoline_v18.py].
Servo Override	`0x90030687`	Retunes the AN22107A DSP for tighter XGD track geometry [cite: User Summary].

3. Internal State & Flags

SRAM Status Registers

Media Authentication Flag: 0x5DB (SRAM) - Set to non-zero when an Xbox Game Disc is authenticated; allows Group 0 commands to bypass LBA boundaries [cite: User Summary].
Command Buffer (CDB): The host command is typically cached at 0x840 (SRAM).

Memory Segments

Handshake Buffers: Security data is processed and staged in the DRAM buffers (typically 0x10C80000 or 0x10CC0000) [cite: 129_perfect_trampoline_v18.py].

4. Hardware-Specific Considerations

Hardware Disparity: The 8050L uses the AN22107A servo driver. When porting tracking logic to recipients with different drivers (e.g., BH6590KU), do not copy the raw register values at 0x90030687. Instead, trigger the recipient's native Dual-Layer (DL) calibration to achieve safe high-gain tracking [cite: User Summary].

Spindle Behavior

Unlike standard PC drives, the 8050L firmware bypasses the idle timeout when 0x5DB is active, ensuring the spindle maintains velocity for instantaneous console challenges [cite: User Summary].