Project Frankenstein: Volume XIV

Seek State Machine & Physical LBA Translation

This volume provides the final architectural mapping required to implement Method B: Direct Read Bypass for the GCC-4241N. It details how to bypass the firmware's logical sector checks and command the BH6590KU driver to seek physically to the Xbox Security Sector [cite: 129_perfect_trampoline_v18.py, Volume XII: BH6590KU Driver & Servo Mapping].

1. The Seek State Machine (SRAM)

The drive tracks its current physical head position and movement state through a set of dedicated SRAM registers. Our payload must manipulate these to force a seek that the native logic would otherwise reject [cite: User Summary].

Property	SRAM Address	Description
Target LBA Register	`0x40000B20`	Stores the 32-bit logical block address for the next seek operation.
Current LBA Register	`0x40000B24`	Stores the current physical position of the laser pickup.
Seek State Flag	`0x40000B28`	`0x00`: Idle; `0x01`: Seeking; `0x02`: Settling [cite: User Summary].

2. Physical LBA Translation (ROM 0x0002C450)

Natively, the firmware calls this routine to convert a Logical Block Address (LBA) into a Physical Block Address (PBA). This is where the LBA Walls are enforced [cite: 129_perfect_trampoline_v18.py].

Method B: Direct PBA Injection

To bypass the walls at 0x3034E and 0x2C2CC, the hybrid payload does not call the translation routine. Instead, it manually populates the PBA registers for the BH6590KU controller with the physical coordinates of LBA 0x02FDFFFE [cite: 129_perfect_trampoline_v18.py].

3. Seek Execution Handler (ROM 0x000382F0)

This is the "muscle" routine that physically moves the pickup head. It expects the target physical coordinates to already be loaded into address registers [cite: User Summary].

Register	Value for Xbox Security Sector	Description
d0	`0x02FDFFFE`	The hardcoded LBA for the Xbox Game Disc security data [cite: 129_perfect_trampoline_v18.py].
a0	`0x000382F0`	The entry point for the physical seek execution routine.

4. Implementing the Method B Payload

This routine, stored in the RAM Cave at 0x40008800, enables the 0xAD Format Code 0xFE command to read the security sector regardless of authentication state [cite: 129_perfect_trampoline_v18.py, Project_Frankenstein_Vol_VI_Addendum.html].

; MN103S Assembly: Method B Direct Seek
; Location: SRAM Cave 0x40008800
Method_B_Direct_Seek:
    mov     0x02FDFFFE, d0  ; Force Xbox Security Sector LBA [cite: 129_perfect_trampoline_v18.py]
    mov     0x40000B20, a0  ; Point to Target LBA Register
    mov     d0, (a0)        ; Manually update state machine
    
    mov     0x000382F0, a1  ; Point to Native Seek Executor
    call    (a1)            ; Execute physical movement [cite: User Summary]
    
    ; After seek completes, trigger a raw 2,048-byte read
    mov     0x10C80040, a1  ; Destination: DRAM Security Mirror [cite: Project_Frankenstein_Vol_VI_Addendum.html]
    call    0x00039A10      ; Native Read Physical Sector routine
    
    ret

Strategic Advantage

By using Method B, the hybrid firmware can verify if a disc is an original Xbox game even if the SHA1/RC4 handshake is not yet perfect. It allows the developer to physically confirm the presence of the security data using the 0xAD Format 0xFE command [cite: 129_perfect_trampoline_v18.py].