Project Frankenstein: Volume XI

MN103S Instruction Set Architecture (ISA) Reference

This volume serves as a technical reference for the Matsushita/Panasonic MN103S (MN10300) assembly language as utilized in the LG/Hitachi GCC-4241N hybrid firmware. It provides a "cheat sheet" for the registers, common instructions, and addressing modes required to write and maintain the RAM Cave payload [cite: User Summary].

1. Register Architecture

The MN103S is a 32-bit architecture with a distinct separation between data and address registers. [cite: User Summary]

Register	Type	Typical Usage in Project Frankenstein
d0 - d3	Data (32-bit)	Arithmetic, bit manipulation, and temporary storage for SCSI payloads. [cite: User Summary]
a0 - a3	Address (32-bit)	Pointers to memory VMAs (e.g., SRAM 0x4000807A or DRAM 0x10C80000). [cite: User Summary, 129_perfect_trampoline_v18.py]
sp	Stack Pointer	Standard subroutine management (pointing to 0x40008F00). [cite: Project_Frankenstein_Vol_VI_Addendum.html]
psw	Program Status Word	Condition codes (Zero, Carry, Negative, Overflow).

2. Core Instruction Set

The following mnemonics represent the most critical instructions for the hybrid firmware logic. [cite: User Summary]

Data Movement

Mnemonic	Description	Example
mov	Move 32-bit value	mov 0x1234, d0 (Immediate to Data) [cite: User Summary]
movbu	Move Byte Unsigned	movbu (a0), d0 (Load byte from memory to register) [cite: User Summary]
movhu	Move Half-word Unsigned	movhu (a0), d0 (Load 16-bit value) [cite: User Summary]

Bit Manipulation & Logic

Mnemonic	Description	Example
btst	Bit Test	btst 0, (4,a1) (Test bit 0 of Spindle Start/Stop) [cite: 4241N_Mechanical_Analysis.txt]
bset	Bit Set	bset 3, (a0) (Set bit in a register) [cite: User Summary]
bclr	Bit Clear	bclr 7, (a0) (Clear bit) [cite: User Summary]
clr	Clear Register	clr d0 (Sets data register to 0) [cite: User Summary]

Control Flow

Mnemonic	Description	Example
jmp	Absolute Jump	jmp (a1) (Indirect jump to native handler) [cite: User Summary]
call	Subroutine Call	call 0x11de (Call native memcpy stub) [cite: 4241N_Final_Stub_Map.txt]
ret	Return	ret (Return from mechanical hook) [cite: User Summary]
cmp	Compare	cmp 0x3E, d0 (Is this Xbox Security Page?) [cite: 129_perfect_trampoline_v18.py]
beq / bne	Branch if Equal / Not Equal	bne .exit_handler (Conditional exit) [cite: User Summary]

3. Addressing Modes

Correct addressing is vital for interacting with the 4241N's memory-mapped I/O and buffers. [cite: User Summary]

4. Practical Payload Snippet

A typical sequence used to authorize media manually via the pp_win utility: [cite: pp_win.c, 129_perfect_trampoline_v18.py]

; Manual Authorization Logic
mov     0x2CC, a0       ; a0 = Xbox Media Auth Flag address
mov     0x01, d0        ; d0 = Value for "Authorized"
movbu   d0, (a0)        ; Write 0x01 to address 0x2CC
ret                     ; Hand control back to the drive firmware