Project Frankenstein: Volume V

Command Reference & Vendor Extensions

This volume serves as the dictionary for the Hitachi GCC-4241N command set. It differentiates between the original factory commands and the high-level vendor extensions added by the Project Frankenstein payload to enable Xbox compatibility and diagnostic visibility [cite: User Summary, 129_perfect_trampoline_v18.py].

1. The Native Command Set (Legacy)

These commands exist in the stock firmware and are used primarily for factory deployment and standard PC operation [cite: gcc_hitachi_flasher.c, 4241N_Mechanical_Analysis.txt].

OpCode	Name	Type	Functionality
`0x1B`	START/STOP UNIT	Native	Standard ATAPI motor control. Handler at `0x14bc` [cite: 4241N_Mechanical_Analysis.txt].
`0x55`	MODE SELECT (10)	Native	Flash mode configuration and firmware chunk streaming [cite: gcc_hitachi_flasher.c].
`0x5A`	MODE SENSE (10)	Native	Polling for flash status and executing the "Ignition" command [cite: gcc_hitachi_flasher.c].
`0xE7`	UNLOCK KNOCK	Native	Responds to ASCII `HL-DT-ST` to open the bootloader [cite: gcc_hitachi_flasher.c].

2. The Frankenstein Extensions (Custom)

These commands are either hijacked native handlers or new entries in the Group 7 jump table [cite: 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

OpCode `0xE7`: REPURPOSED MEMDUMP

Custom Extension

While natively used as a bootloader knock, our payload hooks the Group 7 Jump Table at 0x72282 to redirect this opcode to 0x40008200 [cite: 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

CDB[2-5]: 32-bit Memory Address (Big Endian)
CDB[7-8]: Transfer Length
Result: Dumps internal ROM/RAM/SRAM directly to the SCSI bus [cite: User Summary].

OpCode `0xAD`: XBOX HANDSHAKE + SECURITY DUMP

Modified Handler

Hooked at 0x30249. We augment the standard Read DVD Structure command to handle console security [cite: 129_perfect_trampoline_v18.py].

Format Code 0xC0: Returns the 2,048-byte Security Sector response to the Xbox kernel [cite: 129_perfect_trampoline_v18.py].
Format Code 0xFE (Method B): Forces a physical laser seek to LBA 0x02FDFFFE and returns the raw security data, bypassing all LBA walls [cite: 129_perfect_trampoline_v18.py].

OpCode `0x5A`: XBOX CHALLENGE PAGE

Modified Handler

Hooked at 0x27198. Redirects Mode Sense (10) to the payload when the Xbox security page is requested [cite: 129_perfect_trampoline_v18.py].

Page Code 0x3E: Captures the 20-byte random challenge from the console and triggers the SHA1/RC4 calculation [cite: 129_perfect_trampoline_v18.py].

3. The Hardware Shim (Mechanical Modification)

These are not new commands, but a complete behavioral override of the native 0x1B handler at 0x14bc [cite: 4241N_Mechanical_Analysis.txt].

Native Byte	Original Behavior	Hybrid Behavior
CDB[4] Bit 0 (Start)	Stop spindle on idle timeout.	Persistent Spindle: Bypasses stop command if SRAM flag `0x2CC` is set [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].
CDB[4] Bit 1 (LoEj)	Open/Close physical tray.	Auth Reset: Clears security flags at `0x2CC` and zeros DRAM buffers before tray movement [cite: 4241N_Mechanical_Analysis.txt, 129_perfect_trampoline_v18.py].

Missing Technical Volume Recommendation

To reach a state of 100% completion, the following volume is missing from the archive:

Volume VI: Memory & Buffer Map: A detailed layout of the DRAM Buffers (0x10C80000 and 0x10CC0000) showing exactly where the 20-byte challenge is cached vs. where the 2,048-byte response is staged [cite: 129_perfect_trampoline_v18.py].
Volume VII: Instruction Set Architecture (ISA) Reference: A cheat sheet for MN103S Opcodes (e.g., btst, movbu, call) to assist in modifying the assembly without a constant manual reference [cite: User Summary].