6d7bc87b0f
The blocker on all menu-side dynamic RE in this container, measured over four runs and traced to an instruction. A single A press on the title produces a Xenia CRASH DUMP with PC 0x824578A0 and "Access Violation: write at 0x00000001701D0000", repeating 32 356 times and writing 326 MB of register dump in about ten seconds. Four A runs faulted; four no-input runs in the same sessions completed. REFUTED, my own hypothesis: it is not an unimplemented instruction. The config carries break_on_unimplemented_instructions = true and Xenia's own message reads "to skip, disable break_on_unimplemented_instructions", so the flag looked like the fix. Booting with it false faults identically, and no "Unimplemented instr" line is ever logged on stdout or stderr in any run -- and since that path emits its XELOGE BEFORE the guarded DebugBreak, the absence rules the mechanism out rather than leaving it open. The dump comes from Emulator::ExceptionCallback, a genuine guest exception. The instruction, read from the image rather than the database: b0c90000 is sth r6, 0(r9), the first of four halfword stores at offsets 0/2/4/6 through r9 inside a bne- loop -- code filling an array of 8-byte records with four u16 fields each. So r9 is a wild pointer, and 0x1701D0000 is above 4 GB, outside the guest's 32-bit address space entirely: not a null dereference and not a small overrun, but a base that was never a guest address. The database agrees on the containing function, sub_82457780 at +0x120. It is a THIRD failure mode. Not the cache-flush crash at 0x82307128, and not the loader stall documented in canary-scripted-input-traps.md, which logs ZERO crash dumps. Unlike the stall it reproduced 4 of 4, so that page's "retry whole boots" does not obviously apply. It does not explain how Q4 and Q5 pressed A successfully; what differs between those runs and these has not been found. frame_clock.sh's 300 MB guard killed the run as designed -- the session log's "EMULATOR GONE at 56s" is the guard, not the crash. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QsEPXWVaEpyfudtR6re1Pd
Sylpheed
A clean-room reverse engineering and port project for Project Sylpheed: Arc of Deception (Xbox 360, 2007).
Three things live here, in one repository so that a change spanning them lands as one commit:
| The decoders | crates/sylpheed-formats — the disc's formats, read and verified disc-wide |
| The port | port/ — a Godot 4 project, plus crates/sylpheed-export which converts a disc into the open asset tree it reads |
| The corpus | docs/re/ — what has been reverse engineered, with its evidence, its retractions and its dead ends |
You need your own copy of the game. No game content is in this repository and none ever will be. The exporter reads the disc you supply.
The oracle is the real game
sylpheed-cliand the Explorer are tools for verifying our decoding. They are hypotheses under test and they have been wrong. When something must be checked against the truth, the truth is the game running in Xenia Canary, captured — not any renderer of ours.
This is stated first because getting it backwards is the most expensive mistake this project has made.
Layout
crates/
sylpheed-formats/ the decoders. Disc-wide verified; the corpus is its spec
sylpheed-cli/ headless tools -- render a screen, dump a table, probe audio
sylpheed-viewer/ the Explorer: a human's window onto the disc. STATIC data only
sylpheed-export/ disc -> the open, moddable asset tree
port/ the Godot 4 project. Reads open formats ONLY
authored/ decisions that are NOT on the disc, each with its reason
data/
base/ generated by the exporter. Gitignored, never hand-edited
mods/ drop-in overrides. Yours
docs/
re/ the corpus: findings, refutations, method traps
game/ how the game is navigated -- menus, modals, flight
port/ the port's mission, its handoff contract, modding rules
agents/ how the agent team works together
tools/ capture harnesses, probes, the share tool
exchange/ transient inter-agent files. NOT in git
docker/ the agent containers
Where to start
docs/re/INDEX.md— what is decodeddocs/re/REFUTED.md— what has been tested and dieddocs/re/METHOD.md— traps this project has already paid fordocs/game/navigation.md— how the game is navigateddocs/port/MODDING.md— why the asset tree looks the way it does
Xenia Canary is a separate repository: it is a fork tracking upstream, and it carries our instrumentation.
Conventions
Confidence is per claim, never per document: ✅ CONFIRMED · 🟡 PROBABLE ·
❔ HYPOTHESIS · ❌ REFUTED. A withdrawn result is kept with its reasoning
rather than deleted — that is why the numbers here can be trusted.