Project Frankenstein: Volume IX

Mode Select (0x55) Structural Analysis

This volume provides an in-depth analysis of the Mode Select (10) command (OpCode 0x55) as implemented in the Hitachi-LG GCC-4241N. While natively used for device parameter configuration, this project leverages 0x55 for critical vendor-specific operations including RAM jumping, bit-level register manipulation, and firmware streaming [cite: gcc_hitachi_flasher.c, pp_win.c].

1. Standard SCSI Command Descriptor Block (CDB)

The 0x55 command typically uses a 12-byte CDB. In the context of this project, specific bytes are repurposed for vendor signatures [cite: gcc_hitachi_flasher.c, pp_win.c].

CDB Byte	Standard Purpose	Frankenstein Usage / Signatures
0	OpCode	`0x55` (Mode Select 10)
1	PF / SP Bits	`0x10` (PF bit set for Vendor Format) [cite: gcc_hitachi_flasher.c, pp_win.c]
2	Reserved	Sequence Byte: Countdown (0xFF to 0x00) during streaming [cite: gcc_hitachi_flasher.c]
3	Reserved	SIG_H: `0x48` ('H') for RAM Jumping [cite: pp_win.c]
4	Reserved	SIG_L: `0x4C` ('L') for RAM Jumping [cite: pp_win.c]
5-6	Reserved	Vendor parameters for sub-commands [cite: gcc_hitachi_flasher.c]
7-8	Parameter List Length	Length of data payload following the CDB [cite: gcc_hitachi_flasher.c, pp_win.c]

2. Use-Case A: The "HL" RAM Jump

This sub-command tells the drive controller to immediately transfer the instruction pointer to a specific address in RAM [cite: pp_win.c].

RAM Jump Sequence

CDB Signature: Bytes 3 and 4 must contain 0x48 0x4C ('HL') [cite: pp_win.c].
Parameter List: A small 8-byte payload is sent where payload[1] is typically set to 6 [cite: pp_win.c].
Execution: The drive jumps to the address previously populated by a Poke operation (e.g., 0x80000000) [cite: pp_win.c].

// Example from pp_win.c
CDB[0] = 0x55;
CDB[1] = 0x10;
CDB[3] = 0x48; // 'H'
CDB[4] = 0x4C; // 'L'
CDB[8] = 0x08; // Parameter List Length

3. Use-Case B: Firmware Chunk Streaming

Used during the flashing process to move the 512KB binary into the drive's internal buffers [cite: gcc_hitachi_flasher.c].

Phase	CDB Configuration	Data Payload
Setup	`0x55 0x10 00 00 00 00 00 00 0x10 00 ...`	16-byte Header (Block size setup) [cite: gcc_hitachi_flasher.c]
Streaming	`0x55 0x10 [SEQ] 48 4C 07 01 08 00 ...`	2048-byte Firmware Chunk [cite: gcc_hitachi_flasher.c]

The Checksum Trigger: When CDB[2] (the sequence byte) reaches 0x00, the drive validates the entire buffer against the internal 32-bit big-endian checksum [cite: gcc_hitachi_flasher.c].

4. Use-Case C: Register Bit Manipulation

The pp_win.c tool identifies a method to set bit 3 of internal register 59E to enable certain hardware states [cite: pp_win.c].

// Setting 59E Bit 3
CDB[0] = 0x55;
CDB[1] = 0x10;
CDB[8] = 0x08; // 8-byte parameter list
param_list[1] = 6;

Surgical Precision: Data Payloads

Unlike Peek/Poke (0xE7), the Mode Select command often requires a Parameter List in the Data-Out phase. Sending the wrong length (e.g., 6 bytes instead of 8) will cause the drive to reject the command with an "Invalid Field in Parameter List" sense error [cite: gcc_hitachi_flasher.c, pp_win.c].