David Erik García Arenas
← All work

RYU6Recomp

Recovering verifiable behaviour from a binary with no source and no documentation

Engineering research · Apr 2026 – present

shadPS4 emulationNative PCshadPS4 emulationNative PC
The before/after: the same cutscene under emulation (hair blocked, no alpha) and through the native rehost with the alpha-to-coverage fix.
Mesh regionDrawn in-frameMesh regionDrawn in-frame
The hair mesh (event 3013): its region in magenta, and its draw within the lit frame.
Mayu regionsDrawn in-frameMayu regionsDrawn in-frame
The mayu meshes: dedicated eyebrow, sideburn and goatee detail geometry (event 3022), and hair plus mayu drawn together.
The in-process diagnostic overlay running on the native rehost, frame 153502: frame-time budget, the live camera block read out of memory, player-position candidate scanning, and every render pass listed by its fragment shader
The in-process diagnostic overlay running on the native rehost, frame 153502: frame-time budget, the live camera block read out of memory, player-position candidate scanning, and every render pass listed by its fragment shader
Frame 50941 with passes switched off one at a time. 147 passes seen in the run; HUD elements, motion blur and a character-halo pass are marked confirmed once switching them off changed what was drawn
Frame 50941 with passes switched off one at a time. 147 passes seen in the run; HUD elements, motion blur and a character-halo pass are marked confirmed once switching them off changed what was drawn
Frame 47819 with most full-screen work skipped, leaving the draws that still compose the scene. Draw counts and indices per draw are listed for each pass
Frame 47819 with most full-screen work skipped, leaving the draws that still compose the scene. Draw counts and indices per draw are listed for each pass
Frame 118777: the recovered view basis, projection matrix and combined view-projection alongside the live pass list, with the free camera driving the main view
Frame 118777: the recovered view basis, projection matrix and combined view-projection alongside the live pass list, with the free camera driving the main view
The hair fix up close: hair, mayu and eyelashes all alpha-tested. RenderDoc backbuffer, frame 1377
The hair fix up close: hair, mayu and eyelashes all alpha-tested. RenderDoc backbuffer, frame 1377
RenderDoc: event browser, vertex buffers, mesh viewer
RenderDoc: event browser, vertex buffers, mesh viewer
Lua test stage loading c_am_dummy, a real model from the game
Lua test stage loading c_am_dummy, a real model from the game
Native PC in an early bring-up state, frames from my own renderer
Native PC in an early bring-up state, frames from my own renderer
Rendered natively through my Vulkan renderer
Rendered natively through my Vulkan renderer
Pass 24 boundary, shader group 11 landing: the street renders with real materials from my own pipeline
Pass 24 boundary, shader group 11 landing: the street renders with real materials from my own pipeline
Live run 235, shader group 145 under a single-channel debug view, checking geometry and coverage
Live run 235, shader group 145 under a single-channel debug view, checking geometry and coverage
Fragcoord passthrough for group 147: isolating a pass to prove the plumbing before the real shader lands
Fragcoord passthrough for group 147: isolating a pass to prove the plumbing before the real shader lands
Shader group 144 during bring-up
Shader group 144 during bring-up
Group 17, event 9696, slot-0 output during shader-group bring-up
Group 17, event 9696, slot-0 output during shader-group bring-up
Group 58, event 10478, slot-0 output
Group 58, event 10478, slot-0 output
Group 183, event 12686, slot-0 output
Group 183, event 12686, slot-0 output

The problem

The binary assumes console-specific memory, GPU commands, shader formats, synchronization and operating-system services that do not exist on a desktop host.

Approach

  • Recover observable contracts from the binary and runtime evidence instead of guessing undocumented behaviour.
  • Translate required graphics work into desktop APIs behind narrow, versioned gates.
  • Separate source acceptance, build acceptance, rendered evidence and playability so partial progress is never presented as final compatibility.

Outcome

Accepted source milestones cover runtime, memory, shader and presentation work; the current state does not establish complete playability, visual correctness or general compatibility.

Built with

  • C++
  • Vulkan
  • SPIR-V
  • Ghidra
  • RenderDoc

Read the writeup