# FriiDump 0.5.3.11 XGD1 logical-boundary probe

## Objective

Collect direct, read-only evidence about the XGD1 ranges that FriiDump
0.5.3.10 still represents with documented synthetic zero-fill. This update
does not change the reconstructed ISO layout.

## Command

```powershell
friidump -d f: --xgd1-layout-probe "docs\debug\xgd1-layout-probe.json"
```

The option is exclusive with image output, conversion, `--allmethods`, and the
HLDS 0xE7 probe modes.

## State sequence

1. Record entry READ CAPACITY(10).
2. Cycle the tray to establish the locked/video view.
3. Probe locked/video boundary LBAs using one-sector READ(10) and READ(12).
4. Apply the existing GDR-8050L full authentication handshake.
5. Verify the unlocked/game READ CAPACITY(10) state.
6. Probe unlocked-source and capacity-edge LBAs using READ(10) and READ(12).
7. Restore the entry locked/video state when required.
8. Atomically publish the JSON report.
9. Return to FriiDump for one STOP UNIT cleanup.

## Evidence captured per command

- command success;
- Win32 error;
- SCSI status;
- sense key, ASC, and ASCQ;
- count of nonzero bytes for a successful read, otherwise `null`;
- all-zero classification for a successful read, otherwise `null`;
- SHA-1 of a successful 2048-byte sector;
- complete successful sector bytes as hexadecimal;
- explicit READ(10)/READ(12) comparability and equality for the same LBA;
- exact 6,992-sector locked/video and 3,431,264-sector unlocked/game state
  verification.

## Probe points

The locked/video state includes the logical start, LBA 31/32, VIDEO-L0 end,
locked VIDEO-L1 start/end, locked-capacity edge, synthetic pregame boundary,
game-output start, output layer break, synthetic postgame boundary, VIDEO-L1
output start, and full-output end.

The unlocked/game state includes source LBA 0/31/32/33, the synthetic-gap
length, output-boundary values interpreted as unlocked source LBAs, the mapped
output-layer-break source, the final reported game-view sector, and
out-of-range capacity/output candidates.

## Interpretation boundary

A successful logical read proves only that the active firmware state exposes
that LBA through ordinary READ(10) or READ(12). A failed read is also useful
sense evidence. Neither result alone proves the physical mastering contents of
an inaccessible XGD1 filler range.

The report therefore fixes these fields to false until later analysis:

- `pregame_padding_resolved`
- `postgame_padding_resolved`
- `game_leadin_resolved`

## Safety

No firmware update, write, flash, erase, vendor-memory write, 3B06, 3B07, or
FLASHUP command is used. The probe uses readiness checks, tray transitions,
the already-established authentication handshake, READ CAPACITY, logical
READ(10)/READ(12), a Windows volume guard, atomic report publication, and STOP
UNIT cleanup.

## Live validation result (2026-07-18)

The cross-flashed GDR-8163B running modified GDR-8050L 0012 firmware passed
the probe. Entry state was the 3,431,264-sector game view. A tray cycle
established the exact 6,992-sector locked/video view, the full challenge
handshake restored the exact game view, and the run ended in its original
game-view state.

Seventeen sampled LBAs were readable in-range. READ(10) and READ(12) returned
identical 2048-byte sectors for every successful pair. Eleven sampled
out-of-range LBAs failed under both commands with sense 05/21/00. Locked LBA
6992 was rejected, and unlocked LBA 3431264 was rejected.

This closes the ordinary logical-read branch: there is no second READ(12)
window and no numeric output-LBA path to the synthetic pregame or postgame
regions. Unlocked LBA 0..31 is directly readable and nonzero, while LBA 32
contains `MICROSOFT*XBOX*MEDIA`; exact physical placement still requires raw
sector-ID geometry evidence.