Project Frankenstein: Volume XV

Interrupt Vector Table & Jump Tables

This volume provides the structural mapping of the firmware's dispatchers. It covers the Interrupt Vector Table (IVT) for hardware stability and the primary SCSI Jump Tables required for command redirection and hybrid logic injection [cite: User Summary, 129_perfect_trampoline_v18.py, 4241N_Corrected_Jump_Table.txt].

1. The Interrupt Vector Table (IVT)

The IVT resides at the very beginning of the 512KB binary. It manages the CPU's response to asynchronous hardware events. For a stable RAM Cave payload, these vectors must be respected to prevent timing collisions during SHA1/RC4 calculations [cite: User Summary, Volume X: Crypto Engine Analysis].

Vector Name ROM Offset Description / Hybrid Relevance
Reset Vector 0x00000000 Initial entry point; performs cold boot and register initialization.
Timer Interrupt 0x00000008 Drives the servo loop; may need to be suppressed during hash generation [cite: User Summary].
SCSI Bus IRQ 0x00000010 Triggered when a new Command Descriptor Block (CDB) arrives at 0x840.
External IRQ 0x00000018 Used for tray sensor monitoring (Auth Reset trigger) [cite: 4241N_Mechanical_Analysis.txt].

Theory: Suppressing Interrupts

The MN103S Program Status Word (psw) can be manipulated to mask interrupts during critical security handshakes. This prevents the "jitter" caused by the servo loop from corrupting the 160-bit SHA1 digest [cite: Volume X: Crypto Engine Analysis].

2. Command Dispatcher Jump Tables

The 4241N firmware uses a set of jump tables to route incoming SCSI commands to their respective handlers. Modifying these is the primary method for injecting hybrid logic [cite: 4241N_Corrected_Jump_Table.txt, 129_perfect_trampoline_v18.py].

Group 0 Jump Table (Standard Commands)

Base Offset: 0x721E6 [cite: 4241N_Corrected_Jump_Table.txt]

OpCode Target Offset Handler Description
0x00 0x721E6 Test Unit Ready (TUR) [cite: gcc_hitachi_flasher.c].
0x1B 0x7222E Mechanical / Spindle Control (Hybrid Hook Point) [cite: 4241N_Mechanical_Analysis.txt].

Group 7 Jump Table (Vendor Commands)

Base Offset: 0x72266 [cite: 4241N_Corrected_Jump_Table.txt]

OpCode Target Offset Frankenstein Implementation
0xE7 0x72282 Vendor Memdump: Pointed to 0x40008200 [cite: 129_perfect_trampoline_v18.py].
0xEE TBD Peek: Recommended entry for memory reading [cite: pp_win.c].
0xEF TBD Poke: Recommended entry for memory writing [cite: pp_win.c].

3. Mode Page Table (OpCode $5A)

The Mode Sense (10) command at 0x27198 uses a dedicated table to dispatch mode pages. This is where we catch the Page Code 0x3E console challenge [cite: 129_perfect_trampoline_v18.py].

Page Code Table Offset Description
0x01 0x271B0 Read/Write Error Recovery Page.
0x3E 0x271E0 Xbox Security Challenge Page (Hybrid Hook Point) [cite: 129_perfect_trampoline_v18.py].

4. CDB Length Table

Used by the SCSI interrupt handler to validate that the incoming command has the correct number of bytes (6, 10, or 12) before processing [cite: gcc_hitachi_flasher.c].

; CDB Length Validation Table (ROM)
Offset 0x72000: 06 06 06 06 06 06 06 06 ... (Group 0: 6 Bytes)
Offset 0x72020: 0A 0A 0A 0A 0A 0A 0A 0A ... (Group 1: 10 Bytes)
Offset 0x72040: 0C 0C 0C 0C 0C 0C 0C 0C ... (Group 2: 12 Bytes)
PROJECT FRANKENSTEIN // VOLUME XV // DISPATCHER TABLES // 2026-05-01