Project Frankenstein: Master Baseline Audit

Version 2.1 - Retail-Grade Hybrid Documentation

1. Finalized Target Anchors (GCC-4241N A101)

Anchor Point	Value / Address	Status
s_auth_flag	`0x06A0`	Verified SRAM GAP
Primary Injection Cave	`0x017D6`	Payload Host (v3)
Donor Engine Cave	`0x4E12D`	138,963 bytes available
DRAM Workspace	`0x10C80000`	Sector Read Cache

2. Security Sector & Handshake Logic

Signature: PCJD4 (50 43 4A 44 34) in Lead-In.
Data Dependency: 2,048-byte Security Sector from LBA 16.
Mechanism: Manual LBA 0 read verified in Payload v3.
Persistence: State 2 bypasses native spin-down commands.

3. LBA Wall Neutralization (A101)

Offset	Original	Patch
0x3034E	c9 05	cb cb
0x2C2CC	c4 09	cb cb
0x31A85	c0 08	cb cb
0x3781A	c4 20	cb cb
0x3782A	c4 10	cb cb

4. Disaster Recovery (Offline T48 Path)

Constants for direct TSOP48 programming of the SST-39LFX00A.

XOR Mask: 0xA7A7A7A7
Bit-Swap Map: [22, 11, 3, 26, 30, 16, 1, 12, 10, 7, 31, 21, 5, 19, 13, 28, 2, 27, 8, 20, 29, 18, 4, 14, 25, 17, 23, 0, 6, 15, 24, 9]

5. MN103S Assembler Syntax Notes

Constants: Direct value usage (no # prefix in current toolchain).
Calls: Use calls (reg) for register-indirect calls.