This report consolidates the complete architectural mapping and hybrid logic development for Project Frankenstein. It serves as the definitive reference for the transplantation of security protocols from the Hitachi GDR-8050L donor into the LG/Hitachi GCC-4241N recipient.

1. Core Architecture & Memory Mapping

The system operates on the Matsushita MN103S CPU. The firmware environment is partitioned across three critical memory segments to manage active payloads and security states.

Region	VMA Range	Project Function
Internal SRAM	`0x40000000`	RAM Cave (0x4000807A): Secure storage for the hybrid payload, Interrupt Vector Table (IVT), and the Media Authorized Flag (`0x2CC`).
External SDRAM	`0x10C80000`	Security Mirror: Primary buffer for the 512KB firmware accumulation stream and the 20-byte SHA1 host challenge data.
Peripheral I/O	`0x90000000`	Hardware Interface: Memory-mapped registers for the BH6590KU Servo, DMA Controller, Cache Control, and SCSI Bus Controller.

2. The Cryptographic Core

Authentication spoofing requires precise timing and execution environment management to ensure cryptographic integrity.

SHA1/RC4 Engine Porting

The security routines are ported from the donor entry at 0x90008847. This engine processes the 20-byte challenge received via Mode Sense Page 0x3E.

Jitter & Stability

Calculations must be performed in a stable environment. The Timer IRQ at 0x00000008 must be masked using the psw register during the SHA1 digest generation to prevent timing jitter on the SCSI bus.

Cache Coherency Safety

Any Poke operation to SDRAM resides in the D-Cache. Before the CPU jumps to the injected code, the following must occur:

D-Cache Flush via CHCTR (0x90000000).
I-Cache Invalidate to clear the instruction pipeline.

3. Communication & Identity Protocol

The drive must mimic the donor's behavior to successfully negotiate with the Xbox kernel.

Identity Spoofing

The Inquiry (0x12) response must be dynamically patched in SRAM at 0x40000D40. The device must report as a GDR series model with DVDROM capabilities, including setting the Write-Protect (WP) bit in the Mode Parameter Header.

Direct LBA Access (Method B)

Native LBA walls at 0x3034E and 0x2C2CC are bypassed using the Seek State Machine. Physical coordinates are manually injected into the target registers (0x40000B20) to access the security sector at 0x02FDFFFE.

4. Physical Integration & Safety

        Critical Safety Warning: The Ignition Command (0x5A with 'HL' signature) is physically independent of the checksum validation. If the flasher receives a checksum error on the final 0x00 block, ignition must be aborted to avoid a hard brick.
    

Servo Tracking Enhancements

Xbox Game Discs (XGD) utilize a tighter track pitch than standard DVDs. The BH6590KU tracking gain (0x0044) is boosted via the RAM Cave Shim to ensure reliable reading.

Tray State & Auth Reset

Port B GPIO monitors the mechanical tray sensors. A transition to the "Open" state triggers an External IRQ (0x18) which clears the authorization flag at 0x2CC, enforcing a fresh challenge for every disc insertion.

5. Deployment Workflow

STAGE: Stream 512KB Plaintext binary to SDRAM (OpCode 0x55).
VERIFY: Confirm 0x00 Block returns SCSI_STATUS_GOOD.
IGNITE: Send 0x5A ('HL') to execute RAM Stub.
RECOVER: Utilize SBC_CTRL (0x9000D008) for manual phase management if bus desync occurs.
    