| 2026-08-19 |
Scaffolded,
written, and building |
| 2026-08-19 |
Symbol
census: 30 imports to 277 |
| 2026-08-19 |
The C
runtime, and 395 imports |
| 2026-08-19 |
Depth:
27 positive checks across libc and maths |
| 2026-08-19 |
The
diff loop, which is what the format was for |
| 2026-08-19 |
First
contact with a real emulator |
| - |
Vendor
segment automated; two loader gates down, one named |
| - |
The module runs |
| - |
Kyty:
further than before, and stuck somewhere specific |
| - |
Two swapped
integers |
| - |
The complete
sweep |
| - |
It draws its own
report |
| - |
Enumeration, and
knowing what an expectation is worth |
| - |
Checks
chosen from an emulator's own release notes |
| - |
Writing
down what was only in someone's head |
| - |
A
cracker, and the words that kept getting confused |
| - |
The
orchestration got written down |
| - |
The
settled half of the C library, promoted from counting to
checking |
| - |
The
emulator toolkit, and what the first run through it found |
| - |
libScePosix,
and a check that killed the process on the host |
| - |
Measuring
instead of only judging |
| - |
Three loaders
instead of one |
| - |
Acting on an
external review |
| - |
Through the
ranked backlog |
| - |
The
command protocol, and output that survives the run |
| - |
The
driver, and output that survives the run - completed |
| - |
The
console socket, proven in shadPS4 - no Steam Deck needed |
| - |
Network
handover for orbistoun |
| - |
GPU
compute probe - Vulkan backend, one kernel end to end |
| - |
call and read
implemented |
| - |
GPU kernels,
bulk-authored |
| - |
Serving
robustness, report streaming, Deck target |
| - |
Multi-operand GPU
kernels |
| - |
GPU
set widened, Deck device selection |
| - |
GPU corpus diff
(gpudiff) |
| - |
The gpu protocol
verb |
| - |
Platform HUD |
| - |
One
source, both generations, with pictures |
| - |
HUD
generation field: both resolve is now unknown,
not a claim |
| - |
The
HUD readout is now in the report, not only on screen
(sysinfo records) |
| - |
Numbering,
junk names, and what fpPS4 is actually doing |
| - |
[`sysinfo |
| - |
The
name, and what building shadPS4 from source actually found |
| - |
Threading
contract probes, at the sibling project's request |
| - |
Consensus
run, and a stale ranking |
| - |
Documentation
audit, first pass |
| - |
Files
named for an audience, renamed for their content |
| - |
Repo
survey: litter, and a log nobody can read |
| - |
One
tooling language: the first checker moved to Rust |
| - |
The
bridge, and a contract change that went out unannounced |
| - |
Three
checkers in Rust, and every one was miscounting |
| - |
Every checker is
Rust now |
| - |
Ten
of seventeen: every gate verify.sh runs is Rust |
| - |
Mining in
Rust, and four faults the diff exposed |
| - |
The
surface generator had stopped working, and nothing was watching |
| - |
No Python left |
| - |
Documentation
audit after the port |
| - |
Consensus
outliers, and the runtime census |
| 2026-08-24 |
the
relational section grew, and two of it had never run |
| 2026-08-24 |
the
blind prober was refused at the door, twice |
| 2026-08-24 |
the
most-called function in the corpus, and we were asking it the wrong
question |
| 2026-08-24 |
the
sweep reached 95% and threw it away over one bad run |
| 2026-08-24 |
the
prober reached the end of the list |
| 2026-08-24 |
a
session secret, because a console cannot be bound narrowly |
| 2026-08-25 |
the
two emulators are opposites, and §1 stopped being presence-only |
| 2026-08-25 |
a rung, a
gate for prose, and the concurrent-build fix |
| 2026-08-25 |
fpPS4, and
the handle that did not fit |
| 2026-08-25 |
every
loader retested, and orbistoun in the table for the first time |
| - |
Kyty,
patched to see how far it would go |
| - |
Real
hardware, and the tooling it turned out to need |
| - |
The transport
left, and took a duplicated guard with it |
| - |
The
tool now collects its own report |
| 2026-08-26 |
the
dynamic-table convention, and a deadlock wearing a timeout's
clothes |
| 2026-08-26 |
prosper
as the sixth loader, and the sweep made to fit on a desk |
| 2026-08-26 |
fpPS4: theirs,
and one line |
| 2026-08-26 |
the
substitute oracle, and mistaking my own comparison for a
finding |
| - |
Recording: the
encoder the console already drives |
| - |
The
supervisor exists, and one of two open items closes |
| 2026-08-27 |
hardening the
probe for hardware: the extent blind spot was half-closed |
| 2026-08-27 |
first
payload execution on a real PS5, and the loader contract, by
signal |
| 2026-08-27 |
(cont.) - the
payload ABI, fully mapped by signal, and the real frontier |
| 2026-08-27 |
obSCEne
runs on real PS5 hardware, first report captured |
| - |
The
package was never the wall - the install context is (fw12, measured on
hardware) |
| - |
The
package installs and launches, and the eboot shut the console
down |
| - |
A console
answered the process-parameter experiment, and named the field |
| - |
obSCEne loads
and executes on a real console |
| - |
obSCEne
boots healthy on a real console |
| - |
Forty-five
dead scripts, and why they were not tests |
| - |
The
full probe takes the console down |
| - |
Why the
full probe took the console down, and the guard that was
missing |
| - |
The
emulators earned their keep while the console was down |
| 2026-08-30 |
separating
our defect from the platform's |
| 2026-08-30 |
(later) -
the answer was in a field nobody chose |
| 2026-08-30 |
139-exports:
vaddrs confirmed by behaviour, so the firmware file leaves the
chain |
| 2026-08-31 |
obscene-tool vaddrs:
export vaddrs resolved to names |
| 2026-08-31 |
(later) -
three checks staged for the next hardware run |
| 2026-08-31 |
(later
still) - the hardware run: 139-exports lands, and the payload/eboot
split becomes concrete |
| 2026-08-31 |
(on-console
enumeration) - 139-exports enumerates the full defined export table from
memory |
| 2026-08-31 |
(script
canonicalization) - one bin/obscene verb per hardware task;
report folded into the tool |
| 2026-08-31 |
(compatibility
↔︎ hardware) - the compat table now points to the hardware
results |
| 2026-08-31 |
(report
screen) - the summary wraps into two columns past ~30 sections |
| 2026-08-31 |
(HUD
fields) - GPU field added, DISK wired via statfs, TEMP left honestly
unknown |
| 2026-08-31 |
(payload
verb) - canonized the payload round-trip as
./bin/obscene payload |
| 2026-08-31 |
TSC-frequency band
+ more export candidates (D274) |
| 2026-08-31 |
(payload
runs) - the full payload executes on 12.40; the verb captures both
channels |
| 2026-08-31 |
(context axis
+ link-map) - a third provenance axis, and where module introspection
dies in payload mode |
| 2026-08-31 |
(obscene-injector)
- freestanding native process injector (Plan v2, D278) |
| 2026-08-31 |
(artifact
naming) - standardized release asset names across CI workflows and
frontend (D279) |
| 2026-08-31 |
(ps5_mode
runbook) - documented end-to-end steps to enter native PS5 mode |
| 2026-09-01 |
Porthole
scaffold + the encoder-reachability section (D280) |
| 2026-09-01 |
repo
cleanup sweep, phase 1 (structure + litter) |
| 2026-09-01 |
(freestanding
headers) - removed <sys/types.h> from injector headers and defined
freestanding types |
| 2026-09-01 |
(injector
prototype & warning cleanup) - added injector_start prototype and
cleaned unused consts |
| 2026-09-01 |
cleanup
sweep finished: projects under src/, encoder wired, docs consistent
(D281) |
| 2026-09-01 |
(injector
syscall trampoline & target resolver) - eliminated PPRBUG-22859
direct-syscall traps (D283) |
| 2026-09-01 |
(memory
allocator & online walls) - added probes for VirtualQuery,
AllocateMainDirectMemory, and NpCppWebApi (D284) |
| 2026-09-01 |
(injector
syscall trap & target resolution fix) - direct syscall elimination
& PPSA title prioritization (D285) |
| 2026-09-01 |
(hardware
injector capture #2 analysis & jaildir sandbox resolution)
(D286) |
| 2026-09-01 |
(hardware
injector capture #3 analysis: exit via SYS_exit & socket log
deduplication) (D287) |
| 2026-09-01 |
(foreground
retail game process & Title ID resolution) (D288) |
| 2026-09-01 |
(hardware
injector capture #5 analysis: retail target verified & ucred
synchronization for ptrace) (D289) |
| 2026-09-01 |
(hardware
injector capture #6 analysis: errno diagnostics, thread ucred
synchronization & root uid elevation) (D290) |
| 2026-09-01 |
(hardware
injector capture #7 analysis: thread ucred confirmed, system daemon
false positive diagnosed & direct syscall errno) (D291) |
| 2026-09-01 |
(injector
exhaustive diagnostic logging instrumentation) (D292) |
| 2026-09-01 |
(target
detection diagnosis: eboot.bin POSIX root uid 0 & empty comm
filtering) (D293) |
| 2026-09-01 |
(hardware
injector capture #8 analysis: EPERM resolution, multi-thread ucred sync
& P_SUGID clearing) (D294) |
| 2026-09-01 |
(hardware
injector capture #8 analysis: cr_sceCaps offset correction 0x60 &
readback verification) (D295) |
| 2026-09-01 |
(hardware
injector capture #9 analysis: EPERM eradicated, P_TRACED 0x800 clearing
for EALREADY 37) (D296) |
| 2026-09-01 |
(hardware
injector capture #10 analysis: credential decoupling & p_flag2
P2_NOTRACE/P2_PTRACEREQ clearing) (D297) |
| 2026-09-01 |
(PS5 FW
12.40 ptrace kernel patch implementation: 0xD83088 AppContext gate)
(D298) |
| 2026-09-01 |
(PS5
Parent Reparenting & SceShellCore Inspection Diagnostics)
(D299) |
| 2026-09-01 |
(PS5
Kernel TitleID & Proc Field Offsets Discovery: 0x470)
(D300) |
| 2026-09-01 |
(Injector
WebKit Self-Targeting Elimination & Robust Target Resolution)
(D301) |
| 2026-09-01 |
(Target
Identification & Attachment Succeeded: PPSA02664 Injected, Hijacking
Fix) (D302) |
| 2026-09-01 |
(Orphaned
Process Diagnostics: P_PPWAIT and Init Reparenting Recovery)
(D303) |
| 2026-09-01 |
(Daemon
Disqualification: Requiring eboot.bin & Filtering .self)
(D304) |
| 2026-09-01 |
(PT_DETACH
Timing & Signal 5 Elimination: Post-Detach Credential Drop)
(D305) |
| 2026-09-01 |
(Payload
Output Channel Activation: libkernel Base & Symbol Resolution)
(D306) |
| 2026-09-01 |
(Remote
Syscall Gadget & Non-Spinning Exit Path) (D307) |
| 2026-09-01 |
(Multi-Threaded
LWP Stepping & Dynamic Kernel NID Syscall Resolution)
(D308) |
| 2026-09-01 |
(Fatal
Signal in sceKernelDebugOutText & Safe Write Remediation)
(D309) |
| 2026-09-01 |
(Stack
Frame Return Alignment & Direct SYS_klog Output) (D310) |
| 2026-09-01 |
(Retail
Process Output via Direct SYS_klog Channel) (D311) |
| 2026-09-01 |
(Dedicated
Stack Allocation & Seamless Register Restore Trampoline)
(D312) |
| 2026-09-01 |
(Skipping
Retail-Unsafe sceKernelWrite in Loader Relocations) (D313) |
| 2026-09-01 |
mutexattr-round-trip
now reports per-type read-back |
| 2026-09-01 |
dlsym gains
a positive check; sysmodule positive left out (no citable id) |
| 2026-09-01 |
flexible-configured
probe added (unblocks orbistoun's allocator work) |
| 2026-09-01 |
(native
process injection & retail container probe) - obSCEne runs live
inside retail title |
| 2026-09-02 |
(ps5
native title) gen-5 eboot, a two-id identity, and
native --deploy to a scan root |
| 2026-09-02 |
(ps5
native execution) targeted SDK dictionary, procparam inspection, and PRX
module contract |
| 2026-09-03 |
(Porthole M1)
Encoder sysmodule load and sceVencCore* entry-point
self-resolution |
| 2026-09-03 |
The conformance
matrix, and why the filename is the metadata |
| 2026-09-03 |
poisoning
a scalar out-parameter, and a list of what orbistoun cannot
decide |
| 2026-09-03 |
the
orbistoun backlog is the whole list now |
| 2026-09-03 |
Porthole
M4/M5: Controller input injection (Ghostpad VDI) and dual-socket network
server |
| 2026-09-03 |
Porthole
Video Pipeline: Integrating and Reusing oops-sdk |
| 2026-09-07 |
Two
probes for the heaviest premises orbistoun is blocked on |
| 2026-09-07 |
The
futex and the stack attributes stop being census entries |
| 2026-09-08 |
The
title stops crashing at boot, and a fault guard keeps it
running |
| 2026-09-08 |
The
eboot leg completes, and the sweep stops hanging |
| 2026-09-08 |
The
payload leg completes, and all three shapes run end to end |
| 2026-09-08 |
Pending
probes for what oops-sdk needs from hardware |
| 2026-09-08 |
A
network section for Porthole, and a record for "I could not
look" |
| 2026-09-08 |
Audio
channels settled, mouse payload stub, and POSIX net |
| 2026-09-10 |
libSceAgc
command buffer structure and crash elimination |
| 2026-09-14 |
AGC
pipeline probes, section 160 pruning, and BigApp budget
resolution |
| 2026-09-14 |
Fulfilling
cross-project requests: AGC invariants, synthetic container, and POSIX
resolution |