Project Frankenstein: Volume XXVII

Tray Sensor GPIO & Auth Reset Logic

This volume details the hardware-level monitoring of the drive tray sensors in the Hitachi-LG GCC-4241N and how this data is utilized to implement the Auth Reset behavior required for Xbox stability [cite: User Summary, Project_Frankenstein_Vol_VI_Addendum.html, Project_Frankenstein_Vol_XV_Dispatcher_Tables.html].

1. GPIO Register Mapping (MN103S)

The tray sensors are physically connected to the CPU's General Purpose Input/Output (GPIO) pins, allowing the firmware to poll the mechanical state of the tray in real-time [cite: User Summary].

Register	VMA Address	Description
`PORTB_IN`	`0x9000A040`	Input Data: Reflects the current high/low state of the sensor pins [cite: User Summary].
`PORTB_DIR`	`0x9000A044`	Direction: Configures pins as Inputs (0) or Outputs (1) [cite: User Summary].

2. Tray State Bit Definitions

The GCC-4241N typically utilizes Bit 0 and Bit 1 of Port B to track the tray's movement [cite: User Summary].

Bit 0 (Tray Closed): Set to 1 when the tray is locked and the laser pickup is at the home position [cite: User Summary].
Bit 1 (Tray Open): Set to 1 when the tray is fully extended [cite: User Summary].

3. The Auth Reset Workflow

Logic: Enforcing Disc Security

When a user opens the tray to swap discs, the drive must immediately reset its internal security state to prevent a "security bypass" on the new media [cite: Project_Frankenstein_Vol_VI_Addendum.html].

Interrupt Trigger: A state change on PORTB_IN triggers the External IRQ at 0x00000010 or 0x00000018 [cite: Project_Frankenstein_Vol_XV_Dispatcher_Tables.html].
SRAM Clearance: The interrupt handler checks for Bit 1 (Open). If set, it clears the Media Authorized Flag at 0x2CC [cite: Project_Frankenstein_Vol_VI_Addendum.html].

4. RAM Cave Hook Implementation

To ensure this behavior is persistent across all hybrid firmware variants, the reset logic can be injected directly into the RAM Cave [cite: User Summary, 129_perfect_trampoline_v18.py].

; MN103S Assembly: Auth Reset Hook
; Target: SRAM Cave 0x40008B00
Check_Tray_State:
    mov     0x9000A040, a0  ; Point to PORTB_IN
    movbu   (a0), d0        ; Read sensors
    btst    1, d0           ; Is Bit 1 (Tray Open) high?
    beq     .done           ; If tray is closed, skip reset
    
    mov     0x2CC, a1       ; Point to Auth Flag [cite: Project_Frankenstein_Vol_VI_Addendum.html]
    clr     d1
    movbu   d1, (a1)        ; Force state to Unauthorized
    
.done:
    ret