Project Frankenstein: Volume VI

Memory & Buffer Layout

This volume provides the physical and logical memory mapping for the GCC-4241N recipient. Understanding these regions is essential for managing the flow of authentication data and ensuring the 8050L donor logic interacts correctly with the drive's internal hardware [cite: User Summary, 129_perfect_trampoline_v18.py].

1. Global Memory Map (MN103S VMA)

The 4241N firmware operates across three primary hardware memory regions. Our custom logic must navigate these boundaries without causing bus contention [cite: User Summary, 129_perfect_trampoline_v18.py].

Region	Address Range	Physical Type	Usage
ROM (Firmware)	`0x00000000 - 0x0007FFFF`	Flash / EEPROM	Standard operating logic and MN103S instructions.
SRAM (Internal)	`0x40000000 - 0x40008EFC`	Static RAM	High-speed scratchpad, flags, and our RAM Cave [cite: 129_perfect_trampoline_v18.py].
SDRAM (External)	`0x10C00000 - 0x10CFFFFF`	Dynamic RAM	Large data buffers for SCSI transfers and handshake staging [cite: 129_perfect_trampoline_v18.py].

2. Handshake Staging: The DRAM Buffers

The drive uses external SDRAM to "stage" the security response. The host requests these specific memory locations via the 0xC0 handshake command [cite: 129_perfect_trampoline_v18.py].

Buffer A: Primary Response (`0x10C80000`)

Offset 0x00 - 0x13: Stores the 20-byte challenge received from the Host (Xbox Console) [cite: 129_perfect_trampoline_v18.py].
Offset 0x14 - 0x27: Destination for the SHA1/RC4 calculated hash [cite: User Summary, 129_perfect_trampoline_v18.py].
Offset 0x40 - 0x83F: Buffer for the raw 2,048-byte Security Sector data read from LBA 0x02FDFFFE [cite: 129_perfect_trampoline_v18.py].

Buffer B: Secondary Cache (`0x10CC0000`)

Used for alternate response formats or extended handshake diagnostics [cite: 129_perfect_trampoline_v18.py].

3. Critical Status Flags (SRAM Scratchpad)

Status flags track the drive's current security state. Our payload must manipulate these to enable "Xbox Mode" features [cite: 129_perfect_trampoline_v18.py].

Flag Address	Context	Logic Behavior
`0x2CC`	4241N Hybrid	Used by the RAM Cave payload to signal "Media Authorized" [cite: 129_perfect_trampoline_v18.py].
`0x5DB`	8050L Donor	The original donor flag used to bypass LBA restrictions and persistent spindle [cite: User Summary].
`0x840`	CDB Cache	The standard MN103S location where the last-received 6/10/12 byte SCSI command is stored.

Theory of Data Flow: The Challenge Cycle

A successful handshake follows a specific movement through these memory regions:

Arrival: Console sends a 20-byte challenge. It is cached in the CDB Cache at 0x840.
Staging: The 4241N payload hooks 0x5A and copies the challenge to DRAM Buffer A (0x10C80000).
Calculation: The SHA1/RC4 donor routines read from the staging buffer and write the result back to 0x10C80014 [cite: User Summary].
Verification: The console requests the data via 0xAD. The drive serves 2,048 bytes starting from 0x10C80000.

4. The RAM Cave Layout (`0x4000807A`)

Our payload is physically located at the very end of the internal SRAM map [cite: 129_perfect_trampoline_v18.py].

0x4000807A: [ Entry Point / Mode Sense Hook ]
0x40008200: [ Vendor Memdump (0xE7) Handler ]
0x40008350: [ Mechanical / Spindle Hook ]
0x40008500: [ SHA1 / RC4 Math Engine ]
0x40008F00: [ SRAM END / STACK BEGIN ]