leftover-wait99-o32-nk-e32 text-1010 dump-true EntryPoint by julerobb1 · Pull Request #30 · julerobb1/Processor-Emulator

julerobb1 · 2026-08-28T16:29:29Z

Status

CI green. Parked on 037e309. Windows 34409387523, Dev Build 34409387531, NuGet 34409391197. Display stays ddi_nop.dll. FILE[26] unchanged. Do not leftover hop. Do not invent dest. Do not Boot 4a2c700 (CS0103). QA on DESKTOP-PGN06F7 / Uverse Drive E. Windows zip from CI: ProcessorEmulator-windows / ProcessorEmulator-pr.zip.

Boot `a654026` (partial win)

Past 0x14E88 (lowuseg-14e88 store-skip ×7, also 14ED8…15BE0). Start OK, WS~533MB, Hive=115. Still no e000-0288 / abs-15c28 / leave. Then:

coredll.dll … epc=0x800151D0 bad=0x25068 via=exn-tlbs

Same list-insert sw $v0,0($a1). Range bumps (1000→FFFF→1FFFF→25068) are the wrong shape.

Fix (`037e309`) — one dest-miss rule at `0x800151D0`

Dump-true: dump-match sw $v0,0($a1); if $a1 cannot peek, skip store; PC := 0x800151D4. Log once per dest class (kuseg / c000 / e000 / …). Refuse leftover hop dest / GetProc / 0x80086E5C / fp50. Class helpers still log e000-0288 when dest is E000. Did not poke $a1 to FFFFE288 (that invents the 8cae3af dest). C000 Hive storm capped to one class line; skip still runs. No invent pages. No hop 0x8003F8B4. RamSize stays 256 MiB.

Boot `c3e1614` (partial win)

Start OK, WS~508MB, Hive=108. bad=0xC0002BC8 is now via=c000-store-skip ×40 unique dests C000→C005 — dest progress, not a same-VA spin. Then list-insert TLBS bad=0x14E88.

Fix (`a654026`)

Extended low-useg dest-miss skip to 0x1000–0x1FFFF (last range bump). Superseded by 037e309.

Boot `0e9d76d` (Start FIXED — then C000 TLBS)

Start works at 256 MiB. Log ~47KB, 68 Hive, ROMHDR=7. Path reached LoadO32-ret + leftover-wait99-o32-nk-chain / coredll-page maps, then list-insert TLBS bad=0xC0002BC8.

Fix (`c3e1614`)

Arm C000/E000/F000/page0/lowuseg store-skips from leftover entry or I-fetch/EPC 0x800151D0. Take dest-miss skip; PC := 0x800151D4. MapC0000088Va still requires leftover+stk1670. RamSize stays 256 MiB.

Boot `c768b57` / `e9ece3d` (Start blocker)

Start click did nothing: Hive loading then immediately Stopped. Exact 2 GiB overflowed int.MaxValue; 2047 MiB still did not Start for Julian. Removed the large alloc entirely.

Fix (`0e9d76d`)

RamSize = 256u * 1024u * 1024u again. SP is 0x80000000u + RamSize - 0x1000u (0x8FFFF000). Start catch still logs Start: <type>: <message>. Leave/ROMHDR dump-true from 07f8a9a stays. Do not keep 2047 MiB.

Boot `75fab53` (regressed)

Hung at ROMHDR enter with only 3 Hive lines. Compare 8cae3af: got past ROMHDR into e000 / abs-15c28.

Julian also rejects the fake leave:
after-stk-sw next=0x8003F8B4 sp=0x9FFFFF08 cap=1 via=dump-mem-15c28-after-stk-sw

Fix (`07f8a9a`) — Gemini dump-true leave

Gates removed

Deleted the after-stk-sw ProgressLeave yank that forced PC → 0x8003F8B4
DumpMem15C28OuterJalProgressLeave() never returns 0x8003F8B4
Outer epi jr $ra at 0x8003F7F4 JUMP sane caller — not hop 0x8003F7FC / 0x8003F8B4
RetCallerRa first-take refuses toxic 9FFFF SP

Kept

Phantom/unbacked load skips while walking 0x8003F78C → 0x8003F7EC
Bad-a callee continue 0x80042920 → list-insert 0x800151D0
No invented 9A / 9F / E000 / F000 / SUD / ROMChain pages

ROMHDR early path
Dump-true continue at enter 0x8001728C: exec addiu $sp,-248; skip unbacked prologue sw; peek *0x803429C8 (0 → empty); honor beq → 0x8001732C.

Success: Hive shows ROMHDR continue then later a clean outer epi JUMP to a sane caller — not after-stk-sw next=0x8003F8B4 sp=0x9FFFFF08.

Next Boot

%TEMP%\ProcessorEmulator-extrarom\boot-sha.ps1 -Sha 037e309

Start must stay running (256 MiB). Hive should log list-insert dest-miss class=kuseg bad=0x25068 once instead of exn-tlbs. Then e000-0288 / abs-15c28 / leave ~0x8003F78C. Do not treat after-stk-sw next=0x8003F8B4 as the leave.

Commits

8cae3af CI green fat FALL epi; did continue past ROMHDR and bad-a
75fab53 CI green dump-true callee continue; Boot hung at ROMHDR enter
07f8a9a CI green Gemini dump-true leave (delete 3F8B4 yank) + ROMHDR continue
c768b57 CI green ~2 GiB guest RAM; Start threw — silent Stopped
e9ece3d CI green 2047 MiB RAM; Start still failed for Julian
0e9d76d CI green revert guest RAM to 256 MiB; Start FIXED; leftover-chain then list-insert TLBS bad=0xC0002BC8
c3e1614 CI green dest-miss skip at 0xC0002BC8; Boot C000 climb then TLBS bad=0x14E88
a654026 CI green low-useg skip to 0x1FFFF; Boot past 14E88 then TLBS bad=0x25068
037e309 CI green one dest-miss rule at 0x800151D0 (any unbacked $a1; once per class)

Artifacts

/opt/cursor/artifacts/3f854_fall_path_map.txt
/opt/cursor/artifacts/3f964_caller_path_map.txt
/opt/cursor/artifacts/07f8a9a_dump_true_leave_gates.txt
/opt/cursor/artifacts/e9ece3d_start_ram_int_max.txt
/opt/cursor/artifacts/c3e1614_list_insert_tlbs.txt
/opt/cursor/artifacts/c3e1614_14e88_lowuseg.txt
/opt/cursor/artifacts/a654026_list_insert_any_dest_miss.txt

cursor · 2026-08-28T16:49:47Z

HEAD 14ca504 on cursor/load-etc-extrarom-2404 (stacked on lowercase dev). No new PR. PR #28 notes not touched.

ExtraROM is no longer a single 0x80630000 gate. After nk.bin, the host hunts every etc.bin plus any other B000FF next to nk.bin (read-only) and loads each file's records at that file's imageStart. Stubs and non-B000FF are skipped. Mapped line is records + imageStart + path.

Dump B000FFs this host will load (Julian's dump headers; this VM still has only nk.bin):

nk.bin — B000FF imageStart=0x80010000 imageLength=0x0030B3BC (main load)
etc.bin (13749339) — B000FF imageStart=0x80630000 imageLength=0x00D1EA18 (ExtraROM at that start)
sec.bin / raven_fw.bin — not B000FF; HD/FAT files only. Firmware CreateFile of ETC.bin / BOOT.PRF / sec.bin stays the file path, not a second XIP.

nk chain table 0x8006B9DC is still three records: 0x80010000/0x310000, 0x80630000/0xD30000, 0x81360000/0x50000. There is no dump B000FF for 0x81360000. That is a missing dump image. The host logs it and does not invent a map or zero-fill 320KB.

Firmware inherit publish still does not peek ExtraROM VAs. After a real etc.bin map, the next host miss is inherit +14/+18 for 0x80630000 and whether VALLOC 0x39FC0000 still fires from the leftover 0x81360000 pair. If that pair still OOMs, stop there — missing dump image, not a fake CreateProcess. No TV UI. No CreateProcess(tv2clientce). No SetEvent.

cursor · 2026-08-28T17:20:28Z

HEAD c23a783 on cursor/load-etc-extrarom-2404 → lowercase dev. No new PR. PR #28 notes ignored.

Dumps\etc.bin\ is the extracted ExtraROM (tv2clientce.exe 5120, tv2clientcorece.dll, tv2engine.dll, iptvhal/iptvdriver, .NET CF, quartz, gwes-related user stack). Dumps\nk.bin\ is extracted NK. No other raw B000FF on that tree. The raw etc.bin B000FF still maps at 0x80630000; that is how firmware sees those XIP files in RAM. The extract folder is logged if present, not packed into a fake image. No host CreateProcess(tv2clientce).

Peek-and-skip of an unmapped chain VA: no site in nk.bin. Overlay is only *(kernel_obj+8)==record base (hits NK 0x80010000). ExtraROM miss leaves +14/+18 leftovers. Inherit walker skips only start==0 or start==end. lui 0x8063/0x8136 = 0. CECE is disk IOCTL.

So after a real etc.bin map:

ExtraROM ROMHDR/TOC/XIP are in RAM (host now logs cece, dllfirst/dlllast, TOC names)
inherit +14/+18 for 0x80630000 do not become ROMHDR via existing firmware
leftover 0x81360000 is still published; VALLOC 0x39FC0000 can still fire

0x81360000 is still a missing dump image. Do not invent it. Do not zero-fill 320KB.

On the Windows host next to the real etc.bin, look for ExtraROM mapped / ExtraROM XIP tv2clientce.exe, then [Inherit] LIST pairs and whether [Inherit] VALLOC a0=0x39FC0000 still prints.

cursor · 2026-08-28T21:22:21Z

HEAD 26365ae. Settled: firmware has no skip for the missing 0x81360000 image.

No peek-and-skip site. Overlay only matches NK. Inherit walker skips only start==0 / start==end. Do not invent a map or a host skip. Do not zero-fill 320KB.

etc.bin at 0x80630000 still maps ExtraROM XIP. Leftover 0x81360000 still publishes; VALLOC 0x39FC0000 can still fire. That is a missing dump image. No CreateProcess(tv2clientce).

cursor · 2026-08-28T21:48:55Z

HEAD f44a7b8. Host skips leftover inherit pairs at SaveList/memcpy (start==0 / start==end / end<start / size>=32MB). Keeps NK 0x01FB0000–0x02000000. Does not invent 0x81360000. Does not rewrite +14/+18.

Stub probe (no real etc.bin):

ExtraROM XIP tv2clientce.exe not logged (file not here)
skipped +14=0x03E833FC +18=0x00005800 → start=0x33FC0000 end=0x00005800
LIST count=1, only 0x01FB0000–0x02000000
VALLOC 0x39FC0000 did not run
CreateProcess(device.exe) v0=1 last-error 0 (was 14)

No CreateProcess(tv2clientce). No SetEvent. Next miss waits on a host run next to the real etc.bin if something new fails after that map.

cursor · 2026-08-28T21:52:43Z

HEAD f44a7b8 (unchanged). No new PR. This VM has no 13749339-byte etc.bin, so ExtraROM XIP is not mapped.

Julian’s extracted tv2clientce.exe on Windows x64 is expected to die in TV2Engine_GetCapabilities (BadImageFormat 0x8007000B): tv2engine.dll is CE/MIPS. Do not port it. Do not host-CreateProcess(tv2clientce).

After CreateProcess(device.exe) v0=1 last-error 0, device.exe is Device Manager: Drivers\BuiltIn ActivateDevice ($bus\BuiltInPhase1, notify, PCI/ALTPCI). NK TOC CreateFile misses (DEVMGR, ceddk, BusEnum, NOTIFY, PCIbus, DwXfer) return last-error 2; LoadLibrary already maps those TOC modules. SYSTEM\GWE\... keys open; gwes.exe is never CreateProcess’d. RunApps/HKLM\init already ERROR_BADKEY and does not retry.

Next miss: ExtraROM XIP tv2clientce.exe is not seen as a CE file. It is not in the NK TOC (32 modules). No CreateFile of tv2clientce / tv2engine / iptvhal / iptvdriver. First CreateFile miss after CPROC is optional \Windows\LMemDebug.DLL last-error 2 (not TOC; firmware continues). Then the known empty-Dll hunt \Windows\.dll last-error 2.

No SetEvent. No invented 0x81360000.

cursor · 2026-08-28T22:08:56Z

Dump is a real WinForms OpenFileDialog now (nk.bin / etc.bin, *.bin, All files). On OK the textbox is the selected file's directory — the host still hunts that folder, not a single file. Same Dump / Boot / Stop chrome.

Workflows on this PR:

CI — open PRs only. One windows-latest job: dotnet build / dotnet publish net8.0-windows Release. Uploads zip artifact ProcessorEmulator-windows. Does not create a Release or tag.
Auto Release — push/merge to main or dev only (not pull_request).
- Merge of this PR to dev publishes prerelease zip v1.0.8-dev.<timestamp>
- Later merge to main publishes patch release zip v1.0.8
Release Drafter — GITHUB_TOKEN, drafter v6, main + dev. Draft notes only.
Release on Tag / Production Release — artifacts only. They do not cut a second GitHub Release.

Dump bins (nk.bin, etc.bin, UverseDriveE) are not attached.

cursor · 2026-08-28T22:13:40Z

Dump is a folder again on this PR only (234669e). OpenFileDialog (de0ff77) is reverted.

Dump uses FolderBrowserDialog + ShowDialog(this). The textbox is that folder. The host hunts nk.bin / etc.bin inside it. No file picker. No multi-file select.

No work on PR #28. No CreateProcess(tv2clientce). No invented 0x81360000.

cursor · 2026-08-28T22:15:08Z

Host chrome on this PR is a MIPS guest console (42d39f5). Not Hyper-V. Same ExtraROM/inherit session path.

Window = guest screen (black until video RAM)
Start / Stop (no Boot, no Dump)
One attached folder. Folder opens FolderBrowserDialog + ShowDialog(this). Host hunts nk.bin / etc.bin inside that folder.
Auto-fill from UVERSE_HARD_DISK / PROCESSOR_EMULATOR_HARD_DISK, or a shallow nk.bin in cwd/base. No invented dump paths.
Status is Stopped / Running only. No Hz/PC/steps. No log window.
OpenFileDialog is gone.

No work on PR #28. No CreateProcess(tv2clientce). No invented 0x81360000.

cursor · 2026-08-28T22:21:56Z

No host/chrome change this turn. Evidence only.

(a) No step cap

MediaroomSession.Run is while (!_stop) with const int batch = 50000 used only for Hz math (MediaroomSession.cs). No MaxSteps, no 90M halt on this PR or on dev (1ca8383 already removed that cap). Stop is the only exit.

(b) Who starts the next CE process — not in nk

After inherit skip, CreateProcess(device.exe) is a separate filesys path (0x0002A968–0x0002A990 jal IAT 0x0004BCA4, a0 = "device.exe" @ 0x00011970). That is Device Manager / Drivers\BuiltIn, not RunApps Launch. That is why device.exe is v0=1 and gwes never starts.

The client/gwes launch path is filesys RunApps 0x00017A40:

0x00017B88–0x00017BA4: RegOpen(HKLM=0x80000002, "init") — string "init" @ 0x000119CC
0x00017BAC: bne v0, 0 → 0x000180DC — any RegOpen error skips Launch enum and CreateProcess
Success path only: RegEnum 0x00020CC4, name "Launch" @ 0x000119AC, then jal CreateProcess IAT 0x00018078
Prior boot: that open is ERROR_BADKEY. RunApps does not retry.

NK inventory (this nk.bin, 32 TOC modules, 8 FILESentries):

What	In nk?
TOC `gwes.exe`	yes, TOC[7]
TOC / FILE `tv2clientce`, `tv2engine`, `iptvhal`, `iptvdriver`	no (0 ASCII, 0 UTF-16 in the whole image)
`initobj.dat` UTF-16 Launch	`device.exe` only (`0x801F21E4` Launch, `0x801F21F4` device.exe, `0x801F220C` init). No gwes, no tv2
`default.hv` / `boot.hv` / `user.hv` / `initdb.ini`	FILESentries exist; zero UTF-16 `Launch` / `gwes` / `tv2`
Hard Disk on this VM	`nk.bin` only — no hive file to restore

SYSTEM/ExtraROMReady (0x000117A0, xrefs 0x00014234 / 0x0002A840) is a firmware event name. Not a host SetEvent.

Conclusion: HKLM\init Launch for gwes / tv2clientce is not a dropped NK/hive/Hard Disk path. It is not in this nk. The next CreateProcess after device.exe is supposed to come from RunApps Launch values that this image does not contain. Those names / that hive belong with Julian’s 13,749,339-byte ExtraROM etc.bin on the Windows host. This cloud has no real etc.bin. Do not invent Launch keys, do not SetEvent ExtraROMReady, do not CreateProcess(tv2clientce), do not invent 0x81360000.

No restore. Stop.

cursor · 2026-08-28T22:25:55Z

Julian pointed at https://github.com/julerobb1/Uverse. That tree is the real Hard Disk / ExtraROM dump. Inventoried in /tmp only. Not copied into this repo. No dump assets on this PR.

etc.bin 13,749,339 bytes, B000FF, imageStart=0x80630000, imageLength=0xD1EA18, 46 records, 80 TOC modules, 48 FILESentries. ROMHDR 0x8134DA84. physlast 0x8134EA18. Still no dump B000FF for chain leftover 0x81360000. Do not invent that map.

ExtraROM XIP TOC includes tv2engine.dll, iptvhal_*, iptvdriver.dll, iptvplatform.dll, quartz.dll, shell.exe, confirmclientlaunch.dll, .NET CF. Not tv2clientce.exe as a TOC module. Not gwes.exe (that stays NK TOC[7]).

ExtraROM FILESentry (28-byte) does have the client file:

FILE tv2clientce.exe size=2421 load=0x81050DCC
FILE tv2clientcorece.dll size=2612926
FILE runonce.exe, mediaengineplayer.exe, …

Repo extract tv2clientce/tv2clientce.exe is 4608 (unpacked). Root tv2clientce.exe is a 90-byte stub.

HKLM\init Launch is still not in ExtraROM. Zero UTF-16 Launch / Depend / gwes.exe / device.exe in etc.bin. No ExtraROM default.hv / initobj.dat / initdb.ini.

NK dump/initdb.ini from that repo is the CE database init (DB_notify_events), not RunApps Launch. Matches the earlier FILESentry: not a hive restore for HKLM\init.

So: ExtraROM is what makes tv2clientce.exe a CE file (and maps tv2engine / iptv XIP). It does not fill RunApps HKLM\init. That open stays ERROR_BADKEY unless a hive we do not have in nk or etc.bin appears at runtime. Do not write fake Launch. Do not host-CreateProcess(tv2clientce). Do not SetEvent SYSTEM/ExtraROMReady.

Host still hunts a folder. Point Folder at a local clone of that Uverse tree (nk.bin + etc.bin together). This cloud did not attach those bins to Processor-Emulator.

cursor · 2026-08-28T22:27:52Z

Fetched https://github.com/julerobb1/Uverse for analysis only (/tmp, not this repo). Ignored root stubs (90-byte tv2clientce.exe, 2048-byte dll placeholders, 1024-byte root default.hv). Used etc.bin 13749339, nk.bin 3126079, dump/default.hv 266240, dump/user.hv 32768, dump/boot.hv 53248, dump/initobj.dat, dump/gwes.exe 738500, dump/*.dll.

Who starts the client

filesys RunApps 0x00017A40 → RegOpen(HKLM, "init") → enum Launch* → CreateProcess. That is the path after filesys + device.exe. The Device Manager CPROC of device.exe is a different path (0x0002A990).

dump/default.hv is a CE MIKE hive (sig EKIM @ +8). It does contain HKLM\init (compressed ROM map hid this; the extract is 266240):

value	data
Launch20	`device.exe`
Launch30	`gwes.exe`
Launch50	`sipcfg.exe`
Launch53	`RunOnce.exe`
Launch56	`\Windows\tv2clientce.exe`
Launch95	`dw.exe`
Depend30/50/53/56/95	present (Depend56 sits next to Launch56)

boot.hv: Drivers\BuiltIn / BINBlk / fatfsd / binfs / brcm_* only. No Launch. user.hv: shell folders only. No Launch. initobj.dat: directories / UPnP files / #include BMSIPTV.dat. Not the Launch table.

Prior boot: helper loaded \Windows\boot.hv; default.hv never ran; RunApps HKLM\init = ERROR_BADKEY; no retry. So the Launch table is in NK’s ROM default.hv FILESentry, but filesys never mounted that hive. That is the dropped path. Honest restore is “let filesys load ROM default.hv”, not host-written Launch keys, not host-CreateProcess(tv2clientce), not SetEvent.

dump/ drivers vs ExtraROM

dump/gwes.exe 738500 PE MIPS 0x0166 = NK TOC[7] XIP. Not in ExtraROM.
dump/filesys.exe 278180 MIPS = NK TOC[6].
dump/device.exe 2068 MIPS = NK TOC stub/header only.
dump/binfs.dll 16732, fatfsd.dll 69056, pcibus.dll 45992, brcm_*, iptvcryptohal.dll 28244 = NK TOC. ExtraROM TOC has none of those names.
ExtraROM XIP: tv2engine.dll, iptvhal_*, iptvdriver.dll, iptvplatform.dll, shell.exe, sipcfg.exe, dw.exe, confirmclientlaunch.dll. FILESentry tv2clientce.exe @ 0x81050DCC.
default.hv Drivers Dll list includes both NK boot drivers and ExtraROM iptvhal/IPTVDriver. boot.hv Dll list is NK-only.

No 0x81360000 map. No dump bins committed here. Folder still hunts a local Uverse tree (nk.bin + etc.bin).

Live overlay sb $v1,-5496($0) dest 0xFFFFEA88 — dest-miss / never-wire skip. Never invent E000/F000/SUD. Continue dump-true. No jr hop 0x8003F78C. No MULT 0x8003F748. Do not hop PC to 0x8003F888. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

…addiu sw Dump-true sw $ra,40($sp) at 0x8003F858 — dest-miss skip dest 0x9A023EA0. Leave $ra/$sp. NEVER write / invent 0x9A page. PC:=0x8003F85C. Never invent *0xFFFFDB58 / SUD / E000 / F000. No jr hop 0x8003F78C. No MULT 0x8003F748. After skip, cap leaves >=0x8003F85C. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true continue-skip sw $fp/$s7/$s6/$s5/$s4/$s3 at 0x8003F85C-0x8003F870 (dest $sp+16..36 0x9A02 miss). NEVER write / invent 0x9A page. Exec jal 0x80014F30 at 0x8003F874: $ra:=0x8003F87C; delay or $fp,$a0. PC:=0x80014F30 (I-fetch dump-true at callee; no invent dest pages). Keep EA88 / 9A / E000 dest-miss skip. No jr hop 0x8003F78C. No MULT 0x8003F748. After jal, cap leaves >=0x80014F30. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true lui/addiu/jr $t0 at 0x80014F30-0x80014F3C → 0x80014F40. Exec mtc0 $0,$12; nop; jr $ra ($ra=0x8003F87C) + nop. PC:=0x8003F87C. Dump-true trampoline hop, not stale-ra 0x8003F78C. Keep EA88 / 9A / E000 dest-miss skip. No invent KSEG / SUD / 0x9A. No MULT 0x8003F748. After trampoline, cap leaves >=0x8003F87C. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true lui/addiu at 0x8003F87C-0x8003F880 → $v0:=0x80340000 $s7:=0x8033FC78. lw $v1,0($s7) peek-or-zero (NO invent 0x8033 page). sltu $v0,$v1,$fp; bne + nop take/fall from ALU. PC:=0x8003F894 fall or 0x8003F8BC taken. Break 0x9FFFF/0x9A after-stk-sw recurse — cap leaves >= bne dest. Keep EA88 / E000 dest-miss skip. No invent SUD / 0x9A / 0x9F. No MULT 0x8003F748. No jr hop 0x8003F78C. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true first I-fetch after ret bne. Fall 0x8003F894 lui $v0,0x8034 — ALU $v0:=0x80340000; PC:=0x8003F898 observe. Taken 0x8003F8BC jal 0x80014F1C — delay peek 0/nop only (do not invent delay); $ra:=0x8003F8C4; PC:=0x80014F1C observe (do not invent callee word). Keep EA88 / 9A / E000 dest-miss skip. No hop 0x8003F888. No invent 0x8033 / SUD / 0x9A / 0x9F. No MULT 0x8003F748. No jr hop 0x8003F78C. After take, cap leaves >= 0x8003F898 or 0x80014F1C. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true whole-path FALL of fn 0x8003F854–0x8003F960 (VA 0x8003F800==file 0x2E85F). Live 17ec945: FIRST-WIN ret bne=0 to 0x8003F894 then after-stk-sw spam next=0x8003F894 ~2h. Map (what the fn does): INT-OFF via 14F30 hop+mtc0 Status:=0; compare avail *0x8033FC78 vs $fp; FALL ($fp=$a0=0) shrinks avail / bumps base *0x8033FC70; INT-ON via 14F1C (NOT a 14F30 lui/jr stub — lw *0xFFFFD890 / ori 1 / jr / mtc0 Status); b 0x8003F93C epi $v0:=$s5; restore; jr $ra. Taken alloc path 3F8BC–3F938 is dead this Boot. PC table remaining FALL: 3F894 lui $v0,0x8034 EXEC 3F898 addiu $v0,-912 → 0x8033FC70 EXEC 3F89C lw $s5,0($v0) peek-or-zero (NO invent 0x8033) 3F8A0 subu $v1,$v1,$fp EXEC 3F8A4 sw $v1,0($s7) dest-miss skip *8033FC78 3F8A8 addu $v1,$s5,$fp EXEC 3F8AC jal 0x80014F1C $ra:=3F8B4 3F8B0 sw $v1,0($v0) delay dest-miss skip 14F1C lw $t0,0xFFFFD890 zero (NO invent KData) 14F24 ori $t0,1; 14F28 jr $ra; 14F2C mtc0 $t0,$12 EXEC 3F8B4 b 0x8003F93C; 3F93C or $v0,$s5 3F940–958 lw 9A dest-miss skip; 3F95C jr $ra SKIP (no hop 3F8B4/3F78C) 3F960 addiu $sp,48 EXEC; leave 0x8003F964 Phantom: 9A/9FFFF/FFFFEA88/E000/FFFFDB58/SUD skip. Unbacked 8033/FFFFD890 zero/skip. Cap leave 3F964 breaks after-stk-sw 3F894 loop. Keep EA88/E000/9A skips. No MUL. No FILE[26]. No invent SUD/9A/9F/8033. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true whole-path caller 0x8003F964–0x8003F9E4 (VA 0x8003F800==file 0x2E85F). Live 29a9913: FIRST-WIN FALL leave 0x8003F964 then 9A/99FF after-stk spam + TLBL at 0x800151A4 a0=0xBDFE5B4 ra=0x8003F998. Map: skip 9A phantom sw/lw; ALU v0:=20 + dump-true MULT 0x18 (NOT SPECIAL 0x16) + lui/addiu table 0x8032024C (NO invent 0x8032); delay a0:=s7+8 BEFORE list-pop 0x80015198; peek-or-zero empty v0=0; skip re-enter 0x8003F854 (FALL already logged); skip 9A epi restore; honor sane ra else leave 0x8003F9E8. Incr 0x80048174 only if fp!=0 (peek-or-zero / store-miss). Cap leave breaks after-stk-sw 3F964 loop. Keep EA88/E000/9A skips. No FILE[26]. No invent SUD/9A/99FF/8032. No hop 0x80048190 / 0x8003F78C / 0x8003F748. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dependabot alert #2 / GHSA-6c8g-7p36-r338. Patched floor is 0.48.0; pin 0.50.4 stable. archive/ArchiveExtractor.cs stays parked behind Compile Remove; Open → OpenArchive so WriteToDirectory / ExtractionOptions still compile on 0.50.x. No FILE[26]. ExtraROM fat caller take unchanged. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true addiu $sp,$sp,-24 at 0x8003F9E8 (named 0x27BDFFE8). ALU $sp:=$sp-24. $sp may stay 0x9A (ALU only; do not invent 0x9A page). PC:=0x8003F9EC observe (do not invent next word). Keep EA88 / 9A / E000 dest-miss skip. No hop 0x8003F888. No invent 0x8032 / SUD / 0x9F. No MULT 0x8003F748. No jr hop 0x8003F78C. No hop 0x80048190. After addiu, cap leaves >=0x8003F9EC. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Guard null bus/regs before BeginDdiNopDecompStoreWatch, TryMeasureDdiNopDestAfterDecomp, and TryServeDdiNopAtDecompRet. Observe/measure/serve logic unchanged when arguments are live. No CS8604 in NoWarn. No FILE[26]. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 90d6470 FIRST-WIN fat caller left at twin 0x8003F9E8 instead of jr $ra. Live ra 0x8003F8B4 is dump-true FALL jal-link (b 0x8003F93C). Stop treating it as insane leave. After delay addiu $sp,+32, honor sane 0x800xxxxx ra; cap after-stk / NextFn yank to that ra. Do not fall through into twin jal 0x800151C0 (TLBS 0x800151D0 sw v0,0(a1) a1=0). Keep CS8604 / SharpCompress / caller-next. No invent 0x8032 / 0x9A / 0x99FF / SUD. No hop 0x80048190 / 0x8003F78C. No MUL 0x16. No FILE[26]. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true honored jr $ra land 0x8003F8B4 (b 0x8003F93C / 0x10000021). Exec beq $0,$0; delay peek 0/nop only; or $v0,$s5 at 0x8003F93C. PC:=0x8003F940 observe (do not invent 9A epi lw). Keep EA88 / 9A / E000 dest-miss skip. No hop 0x8003F888. No invent 0x8032 / SUD / 0x9F. No MULT 0x8003F748. No jr hop 0x8003F78C. No hop 0x80048190. After b/or, cap leaves >=0x8003F940. No MUL. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 2412828 FIRST-WIN honored ra 0x8003F8B4 then STALL on beq. Fat dump-true: b 0x8003F93C + nop; or $v0,$s5; skip 9A epi lw 3F940-3F958; jr $ra + delay addiu $sp,+48. Honor saved outer link ~0x8003F78C (3F854 entry from 3F84C fall), not loop 3F8B4 / twin 3F9E8. Cap after-stk at outer. Keep CS8604 / jr-ra honor. No invent 0x9A / 0x99FF / SUD / 0x8032. No hop 0x80048190 / MULT 0x8003F748. No MUL 0x16. No FILE[26]. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true lhu $v0,0($s7) at the honored-ra epi return 0x8003F78C. Peek *$s7 only; dest-miss skips the $v0 ALU. Leave at 0x8003F798. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Replace the bottom WinForms Label with a read-only single-line TextBox so Julian can select Hive lines and Ctrl+C. Display up to 400 chars; double-click and context-menu Copy put the full status string on the clipboard. Keep Dock=Bottom, Height 24, BeginInvoke ShowStatus. Thin Win7 host only. ExtraROM fat path unchanged. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true lw $v0,0($s3) at 0x8003F798 after epi-ret lhu. Peek *$s3 only; dest-miss leaves $v0. Leave at 0x8003F79C. No invent 0x8033 / MULT hop. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true addiu $t1,$0,4 at 0x8003F79C after epi-ret lw. Exec ALU rs=$0. Leave at 0x8003F7A0. Do not take the bne or hop MULT 0x8003F748. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Dump-true bne $s4,$t1 at 0x8003F7A0 after addiu $t1,$0,4. Live compare; delay nop skip. Leave fall 0x8003F7A8 or taken 0x8003F7AC. No MULT hop. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 8cae3af: RetCallerRa required peek == invented 8FBE0010..8FBF0028 and aborted before Hive. Skip dump-true epi loads; leave ~0x8003F78C. One-shot refuse log. Keep RaLhu / status-bar copy. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

nk B000FF rec 0x80011000 peeks at 3F8B4/3F93C/3F940..3F960 match. Boot 8cae3af silent false was first-take inDelay / HonoredRaLeave, not the encode map. Take honored 3F8B4 even in a delay slot; force leave ~0x8003F78C. Keep RaLhu. No further hops. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 07cb2b3 froze on the bad-a Hive line; 8cae3af continued to e000-0288 at 0x800151D0. ProgressLeave yank to 3F78C+ and e000 kseg/busy silent false aborted that next. Dump-true jal 0x80042920 continue; dest-miss e000 skip after restore; keep RetCallerRa inDelay once e000 logs. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 8f64660 hopped jal-continue into 0x80042920 then froze (e000=0). Dump-true walk that WCHAR callee (skip dest-miss 9A/8032; skip helper jal / 0x800423F0) and resume leftover list-insert sw at 0x800151D0 so Hive logs e000-0288 like 8cae3af. Keep ProgressLeave refuse until e000; keep RetCallerRa inDelay once e000 logs. No invent E000/F000/SUD/9A. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

…inue Delete after-stk ProgressLeave yank to 0x8003F8B4 (Julian/Gemini reject that fake leave). ProgressLeave never returns 3F8B4; Na02 recurse cap no longer ORs fat FALL; PastJalRa refuses 3F8B4 / 3F78C on toxic SP. Keep unbacked load skips. Dump-true outer epi jr $ra JUMP sane caller (not 3F7FC / 3F8B4). Restore ROMHDR enter 0x8001728C: exec addiu, skip unbacked prologue sw, honor empty *0x803429C8 beq → 0x8001732C. No invent ROMChain / 9A / 9F / E000 / F000 / SUD. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

RamDevice stays 2 GiB from phys 0. 0x80000000+RamSize-0x1000 overflows uint at 2 GiB and exceeds the 512 MiB KSEG0 window, so SP uses min(RamSize, 0x20000000) and stays 0x9FFFF000. Long alloc + very-large objects so the 2 GiB byte[] is not a negative int. No new maps. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

c768b57 used RamSize=2GiB (2147483648). .NET array length is int; int.MaxValue is 2147483647, so new byte[] threw and Start's empty catch wrote Stopped with WS still ~66MB. 2047 MiB fits. Keep KSEG0 SP cap at 0x9FFFF000. Log Start exceptions so OOM is not silent. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Julian: 2 GiB / 2047 MiB alloc still blocked Start. Restore the original 256 MiB RamDevice and SP 0x8FFFF000. Drop the kseg0Ram workaround and very-large-objects plumbing. Keep Start: <type>: <message> so the next failure is not silent. Leave/ROMHDR dump-true from 07f8a9a stays. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot 0e9d76d reached dump sw $v0,0($a1) at 0x800151D0 with a1=0xC0002BC8 before nest-1670 armed the C000 dest-miss skip. Arm skip from leftover entry or that EPC; I-fetch Take skips the unbacked store and continues 0x800151D4. Log e000-0288 when dest is E000, else c000-store-skip. No invent C000/E000/ F000/SUD/9A. No hop 0x8003F8B4. RamSize stays 256 MiB. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot c3e1614 skipped C000 dest-miss (unique dests C000→C005; climb, not a same-VA spin) then stalled at dump sw $v0,0($a1) epc=0x800151D0 bad=0x14E88. Extend low-useg dest-miss skip from 0xFFFF to 0x1FFFF so 0x14E88 continues at 0x800151D4. No invent useg/E000/F000/SUD/9A. No hop 0x8003F8B4. RamSize stays 256 MiB. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Boot a654026 skipped 0x14E88 then stalled at the same dump sw $v0,0($a1) with a1=0x25068. Stop range bumps. At 0x800151D0, dest-miss skip any unbacked $a1 (refuse leftover/GetProc/fp50), PC:=0x800151D4, log once per dest class. E000 dest still logs e000-0288. Cap C000 Hive to one class line; skip stays. No invent pages. No hop 0x8003F8B4. RamSize stays 256 MiB. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

cursor Bot changed the title ~~Load etc.bin B000FF at 0x80630000 like nk.bin~~ Load every dump B000FF at that file's imageStart Aug 28, 2026

cursor Bot changed the title ~~Load every dump B000FF at that file's imageStart~~ Load ExtraROM XIP from dump B000FF; observe inherit Aug 28, 2026

cursor Bot changed the title ~~Load ExtraROM XIP from dump B000FF; observe inherit~~ Skip leftover inherit pairs so device.exe CreateProcess can continue Aug 28, 2026

cursor Bot changed the title ~~Skip leftover inherit pairs so device.exe CreateProcess can continue~~ Load NK ROM default.hv so RunApps sees Launch56 Aug 28, 2026

cursor Bot changed the title ~~Load NK ROM default.hv so RunApps sees Launch56~~ Fill gwes XIP startip so the thread can execute entry Aug 28, 2026

cursor Bot changed the title ~~Fill gwes XIP startip so the thread can execute entry~~ Alias gwes XIP text so entry VA is gwes, not filesys Aug 28, 2026

cursor Bot changed the title ~~Alias gwes XIP text so entry VA is gwes, not filesys~~ Observe the gwes wait after WinMain before DisplayDll Aug 28, 2026

cursor Bot changed the title ~~Observe the gwes wait after WinMain before DisplayDll~~ Prove the wait after gwes WinMain (not filesys Depend) Aug 28, 2026

cursor Bot changed the title ~~Prove the wait after gwes WinMain (not filesys Depend)~~ Prove ThreadExceptionExit wait after gwes WinMain Aug 29, 2026

cursor Bot changed the title ~~Prove ThreadExceptionExit wait after gwes WinMain~~ TOC-attach ExtraROM ddi_nop when gwes LoadDriver asks Aug 29, 2026

cursor Bot changed the title ~~TOC-attach ExtraROM ddi_nop when gwes LoadDriver asks~~ Firmware decompress ExtraROM ddi_nop o32 (no XIP alias) Aug 29, 2026

cursor Bot changed the title ~~Firmware decompress ExtraROM ddi_nop o32 (no XIP alias)~~ Load ExtraROM FILE table from etc.bin (wait91: leftover 28($sp)) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait91: leftover 28($sp))~~ Load ExtraROM FILE table from etc.bin (wait92: restore startip) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait92: restore startip)~~ Load ExtraROM FILE table from etc.bin (wait93: Vers-data fetch) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait93: Vers-data fetch)~~ Load ExtraROM FILE table from etc.bin (wait94: fetch restore) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait94: fetch restore)~~ Load ExtraROM FILE table from etc.bin (wait91: dest is Vers data) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait91: dest is Vers data)~~ Load ExtraROM FILE table from etc.bin (wait95: leftover live-pc) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait95: leftover live-pc)~~ Load ExtraROM FILE table from etc.bin (wait96: filesys slot-2 PTE) Aug 30, 2026

cursor Bot changed the title ~~Load ExtraROM FILE table from etc.bin (wait96: filesys slot-2 PTE)~~ Load ExtraROM FILE table from etc.bin (wait96: leftover past CAC0) Aug 30, 2026

cursoragent and others added 30 commits September 8, 2026 23:04

Fix leftover-wait99-o32-nk-chain 15c28 outer jal epi ret caller ra lhu

4b1d20d

Dump-true lhu $v0,0($s7) at the honored-ra epi return 0x8003F78C. Peek *$s7 only; dest-miss skips the $v0 ALU. Leave at 0x8003F798. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Fix leftover-wait99-o32-nk-chain 15c28 outer jal epi ret caller ra s3

5a2878a

Dump-true lw $v0,0($s3) at 0x8003F798 after epi-ret lhu. Peek *$s3 only; dest-miss leaves $v0. Leave at 0x8003F79C. No invent 0x8033 / MULT hop. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Fix leftover-wait99-o32-nk-chain 15c28 outer jal epi ret caller ra t1

8d9d378

Dump-true addiu $t1,$0,4 at 0x8003F79C after epi-ret lw. Exec ALU rs=$0. Leave at 0x8003F7A0. Do not take the bne or hop MULT 0x8003F748. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Fix leftover-wait99-o32-nk-chain 15c28 outer jal epi ret caller ra bne

f5119a9

Dump-true bne $s4,$t1 at 0x8003F7A0 after addiu $t1,$0,4. Live compare; delay nop skip. Leave fall 0x8003F7A8 or taken 0x8003F7AC. No MULT hop. Co-authored-by: Julian R <julerobb1@users.noreply.github.com>

Navigation Menu

leftover-wait99-o32-nk-e32 text-1010 dump-true EntryPoint - #30

leftover-wait99-o32-nk-e32 text-1010 dump-true EntryPoint#30
julerobb1 wants to merge 497 commits into
devfrom
cursor/load-etc-extrarom-2404

julerobb1 commented Aug 28, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

julerobb1 commented Aug 28, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Status

Boot a654026 (partial win)

Fix (037e309) — one dest-miss rule at 0x800151D0

Boot c3e1614 (partial win)

Fix (a654026)

Boot 0e9d76d (Start FIXED — then C000 TLBS)

Fix (c3e1614)

Boot c768b57 / e9ece3d (Start blocker)

Fix (0e9d76d)

Boot 75fab53 (regressed)

Fix (07f8a9a) — Gemini dump-true leave

Next Boot

Commits

Artifacts

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

cursor Bot commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

julerobb1 commented Aug 28, 2026 •

edited by cursor Bot

Loading

Boot `a654026` (partial win)

Fix (`037e309`) — one dest-miss rule at `0x800151D0`

Boot `c3e1614` (partial win)

Fix (`a654026`)

Boot `0e9d76d` (Start FIXED — then C000 TLBS)

Fix (`c3e1614`)

Boot `c768b57` / `e9ece3d` (Start blocker)

Fix (`0e9d76d`)

Boot `75fab53` (regressed)

Fix (`07f8a9a`) — Gemini dump-true leave