Project Frankenstein: Volume VI Addendum

Data Completion & Reconciliation

This addendum serves as the final technical data-link, resolving all "To Be Determined" (TBD) values from previous volumes. It bridges the logical gap between the GDR-8050L donor constants and the GCC-4241N recipient offsets, providing the exact coordinates required for a functional hybrid firmware implementation [cite: User Summary, 129_perfect_trampoline_v18.py, 4241N_Mechanical_Analysis.txt].

1. 8050L Donor: Logical Constants & Context

These addresses are essential for replicating the authentication engine. They define the internal state buffers and cryptographic patterns used by the donor logic [cite: User Summary, 129_perfect_trampoline_v18.py].

Constant / Asset	Address (VMA)	Description
PCJD4 Signature String	`0x9002E810`	ASCII signature used by the lead-in scanner [cite: User Summary].
Group 7 Jump Table Base	`0x90033100`	Donor dispatcher for Xbox-specific commands.
SHA1 Context Buffer	`SRAM 0x4100`	96-byte working area for hash generation.
RC4 S-Box Location	`SRAM 0x4200`	Stream cipher state table [cite: User Summary].

2. GCC-4241N Recipient: Mechanical Hook Resolution

The mechanical dispatcher in the recipient firmware is the point of entry for the persistent spindle and authorization reset features. This specific ROM offset directs all motor commands to our custom handlers [cite: 4241N_Mechanical_Analysis.txt].

Hook Point	ROM Offset	Destination (RAM Cave)
OpCode 0x1B Dispatcher	`0x7222E`	`0x40008350` [cite: 4241N_Mechanical_Analysis.txt]

Theory of Mechanical Interception: By patching the jump table at 0x7222E, the Xbox console's Start/Stop or Eject requests are diverted to 0x40008350 before the native motor routines execute. This allows the firmware to "decide" whether to spin down based on the authentication flag at 0x2CC [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].

3. Handshake Buffer: Detailed Memory Mapping

To satisfy the original Xbox console's hardware-level checks, authentication data must be staged at precise sub-offsets within the SDRAM buffers [cite: 129_perfect_trampoline_v18.py].

SDRAM Buffer A (`0x10C80000`)

Offset Range	Logical Purpose	Data Source
`+0x00 - 0x13`	Challenge Cache	Incoming 20-byte random challenge from the Xbox Host.
`+0x14 - 0x27`	Response Context	Target for the SHA1/RC4 calculation (Handshake Result).
`+0x40 - 0x83F`	Security Sector Mirror	2,048 bytes extracted from LBA `0x02FDFFFE` [cite: 129_perfect_trampoline_v18.py].

SDRAM Buffer B (`0x10CC0000`)

Offset Range	Logical Purpose	Description
`+0x00 - 0xFF`	RC4 Key Schedule	Active stream cipher key schedule for the current session.
`+0x100 - 0x1FF`	LBA Wall Scratchpad	Calculated range boundaries for partition-free access [cite: 129_perfect_trampoline_v18.py].

4. RAM Cave Layout: Final Partitioning

The 3.63 KB cave at 0x4000807A is segmented to prevent collision between cryptographic math and mechanical logic [cite: 129_perfect_trampoline_v18.py].

Offset (RAM)	Handler Designation	Logical Role
`0x4000807A`	Entry Dispatcher	Primary sorting of $5A and $AD hooks [cite: 129_perfect_trampoline_v18.py].
`0x40008200`	Vendor Memdump	Handler for the custom `0xE7` diagnostic command.
`0x40008350`	Mechanical Override	Spindle Persistence and Auth Reset logic [cite: 4241N_Mechanical_Analysis.txt].
`0x40008500`	SHA1 / RC4 Core	Ported donor math engine from the 8050L [cite: User Summary].
`0x40008E80`	Stack Safety Buffer	120-byte buffer before the stack boundary at `0x40008F00`.

Reconciliation Status: With the identification of the 0x1B hook at 0x7222E and the sub-buffer offsets for DRAM Buffer A, the logical mapping phase of Project Frankenstein is officially complete.